@gajae-code/ai 0.12.1 → 0.12.4

package/CHANGELOG.md

@@ -2,6 +2,20 @@
 
 ## [Unreleased]
 
+## [0.12.4] - 2026-07-30
+
+### Fixed
+
+- Mara Cloud login now validates pasted credentials against the authenticated chat-completions endpoint instead of the public `/v1/models` catalog. The catalog returns `200` even for random invalid bearer tokens, so the previous check could persist unusable keys.
+
+## [0.12.3] - 2026-07-30
+
+### Added
+
+- Added first-class support for **Mara Cloud**, an OpenAI-compatible enterprise AI inference platform. Registers the `mara` provider descriptor, `/login` entry (API-key paste validated against `https://api.cloud.mara.com/v1/models`), `MARA_API_KEY` environment resolution, and bundled `models.json` seed models. Models are discovered dynamically from `GET /v1/models` (base URL `https://api.cloud.mara.com/v1`).
+
+## [0.12.2] - 2026-07-30
+
 ## [0.12.1] - 2026-07-29
 
 ### Fixed
@@ -19,6 +33,7 @@
 - The Anthropic "thinking blocks in the latest assistant message cannot be modified" 400 now escalates its one-shot replay repair. The error names the latest assistant message but its cited `messages.N.content.M` path can point at an earlier replayed turn, so the latest-only repair was rejected identically and killed the turn; recovery now retries once more with thinking dropped from every replayed assistant message.
 - Anthropic adaptive-thinking `display` support is now decided by the canonical model-version parser instead of a provider-local `claude-opus-(\d+)-(\d+)` regex. The regex only matched two-component ids, so a single-component alias such as `claude-opus-5` was classified as pre-4.7 while its dated snapshot `claude-opus-5-20260101` was not: the alias sent `thinking: { type: "adaptive" }` without `display: "summarized"`, additionally requested the `interleaved-thinking-2025-05-14` beta, and had its returned thinking blocks recorded as raw rather than summarized. Both Anthropic and Bedrock providers now share `supportsAnthropicAdaptiveThinkingDisplay`, so alias and dated ids of the same model send an identical request shape.
 - Anthropic requests that force a tool choice no longer replay signed thinking blocks. Forcing `tool_choice` strips `thinking` from the request (the API rejects the combination), but the converted history still carried native `thinking`/`redacted_thinking` blocks from thinking-enabled turns, so eager tool-forcing turns (e.g. the todo bootstrap) sent a request whose history contradicted its own thinking setting and drew a 400. The replay now degrades in the same rebuild; the forced request trades its prompt-cache prefix for a shape the API accepts.
+- A definitively failed OAuth refresh can no longer loop forever instead of disabling the credential. The refresh-failure path disables the row with a CAS conditioned on its serialized `data`, and treated a lost CAS as proof that a peer had rotated the token: it reloaded the store and re-resolved, without bound. That predicate also misses when nothing was rotated — an account switcher that replaces the provider's rows leaves the attempted id gone, and an unrelated identity-metadata write leaves the row byte-different — so a revoked credential was never disabled and every subsequent request re-issued the same `invalid_grant` refresh (observed in the wild as ~3k `OAuth token refresh failed` / `disable lost CAS` log pairs in 3.5 hours, one wasted refresh round-trip per request). When the row still holds the refresh token that just failed, it is now disabled by id (no peer rotation exists to clobber); otherwise the reload-and-retry recovery is capped, so resolution terminates instead of recursing until the runtime dies.
 
 ## [0.12.0] - 2026-07-28
 

package/README.md

@@ -71,6 +71,7 @@ Unified LLM API with automatic model discovery, provider configuration, token an
 - **ZenMux** (requires `ZENMUX_API_KEY`)
 - **OpenGateway by Sionic AI** (requires `OPENGATEWAY_API_KEY`)
 - **BizRouter** (requires `BIZROUTER_API_KEY`)
+- **Mara Cloud** (requires `MARA_API_KEY`)
 - **Qwen Portal** (supports `QWEN_OAUTH_TOKEN` or `QWEN_PORTAL_API_KEY`)
 - **Cloudflare AI Gateway** (requires `CLOUDFLARE_AI_GATEWAY_API_KEY` and provider-specific gateway base URL)
 - **Ollama** (local OpenAI-compatible runtime; optional `OLLAMA_API_KEY`)
@@ -958,6 +959,7 @@ In Node.js environments, you can set environment variables to avoid passing API
 | ZenMux         | `ZENMUX_API_KEY`                                                             |
 | OpenGateway    | `OPENGATEWAY_API_KEY`                                                        |
 | BizRouter      | `BIZROUTER_API_KEY`                                                          |
+| Mara Cloud     | `MARA_API_KEY`                                                               |
 | vLLM           | `VLLM_API_KEY`                                                               |
 | Cloudflare AI Gateway | `CLOUDFLARE_AI_GATEWAY_API_KEY`                                      |
 | GitHub Copilot | `COPILOT_GITHUB_TOKEN` or `GH_TOKEN` or `GITHUB_TOKEN`                      |
@@ -983,6 +985,7 @@ Provider endpoint defaults for the current OpenAI-compatible integrations:
 - ZenMux (Anthropic models): `https://zenmux.ai/api/anthropic`
 - OpenGateway by Sionic AI: `https://apis.opengateway.ai/v1`
 - BizRouter: `https://api.bizrouter.ai/v1`
+- Mara Cloud: `https://api.cloud.mara.com/v1`
 - vLLM: `http://127.0.0.1:8000/v1`
 - Ollama: local OpenAI-compatible runtime (`http://127.0.0.1:11434/v1`)
 - Ollama Cloud: native Ollama API host (`https://ollama.com/api`, configured here as base URL `https://ollama.com`)

package/dist/types/provider-models/openai-compat.d.ts

@@ -128,6 +128,15 @@ export interface BizRouterModelManagerConfig {
     baseUrl?: string;
 }
 export declare function bizrouterModelManagerOptions(config?: BizRouterModelManagerConfig): ModelManagerOptions<"openai-completions">;
+export interface MaraModelManagerConfig {
+    apiKey?: string;
+    baseUrl?: string;
+}
+/**
+ * Mara Cloud — an OpenAI-compatible enterprise AI inference platform. Models
+ * are discovered from the OpenAI-compatible `/v1/models` endpoint.
+ */
+export declare function maraModelManagerOptions(config?: MaraModelManagerConfig): ModelManagerOptions<"openai-completions">;
 export interface KiloModelManagerConfig {
     apiKey?: string;
     baseUrl?: string;

package/dist/types/types.d.ts

@@ -51,7 +51,7 @@ export interface ThinkingConfig {
     /** Provider-specific transport used to encode the selected effort. */
     mode: ThinkingControlMode;
 }
-export type KnownProvider = "alibaba-token-plan" | "amazon-bedrock" | "azure-openai" | "anthropic" | "google" | "google-gemini-cli" | "google-antigravity" | "google-vertex" | "openai" | "openai-codex" | "kimi-code" | "minimax-code" | "minimax-code-cn" | "github-copilot" | "fireworks" | "firepass" | "fugu" | "gitlab-duo" | "cursor" | "deepseek" | "deepinfra" | "xai" | "groq" | "cerebras" | "openrouter" | "kilo" | "vercel-ai-gateway" | "zai" | "glm-zcode" | "mistral" | "minimax" | "opencode-go" | "opencode-zen" | "opengateway" | "bizrouter" | "synthetic" | "cloudflare-ai-gateway" | "huggingface" | "litellm" | "moonshot" | "nvidia" | "nanogpt" | "ollama" | "ollama-cloud" | "qianfan" | "qwen-portal" | "together" | "venice" | "vllm" | "xiaomi" | "xiaomi-token-plan-sgp" | "xiaomi-token-plan-ams" | "xiaomi-token-plan-cn" | "zenmux" | "lm-studio";
+export type KnownProvider = "alibaba-token-plan" | "amazon-bedrock" | "azure-openai" | "anthropic" | "google" | "google-gemini-cli" | "google-antigravity" | "google-vertex" | "openai" | "openai-codex" | "kimi-code" | "minimax-code" | "minimax-code-cn" | "github-copilot" | "fireworks" | "firepass" | "fugu" | "gitlab-duo" | "cursor" | "deepseek" | "deepinfra" | "xai" | "groq" | "cerebras" | "openrouter" | "kilo" | "vercel-ai-gateway" | "zai" | "glm-zcode" | "mistral" | "minimax" | "opencode-go" | "opencode-zen" | "opengateway" | "bizrouter" | "mara" | "synthetic" | "cloudflare-ai-gateway" | "huggingface" | "litellm" | "moonshot" | "nvidia" | "nanogpt" | "ollama" | "ollama-cloud" | "qianfan" | "qwen-portal" | "together" | "venice" | "vllm" | "xiaomi" | "xiaomi-token-plan-sgp" | "xiaomi-token-plan-ams" | "xiaomi-token-plan-cn" | "zenmux" | "lm-studio";
 export type Provider = KnownProvider | string;
 import type { Effort } from "./model-thinking";
 /** Token budgets for each thinking level (token-based providers only) */

package/dist/types/utils/oauth/mara.d.ts

@@ -0,0 +1 @@
+export declare const loginMara: (options: import("./types").OAuthController) => Promise<string>;

package/dist/types/utils/oauth/types.d.ts

@@ -7,7 +7,7 @@ export type OAuthCredentials = {
     email?: string;
     accountId?: string;
 };
-export type OAuthProvider = "alibaba-token-plan" | "anthropic" | "bizrouter" | "cerebras" | "cloudflare-ai-gateway" | "cursor" | "deepseek" | "deepinfra" | "fireworks" | "firepass" | "fugu" | "github-copilot" | "google-gemini-cli" | "google-antigravity" | "gitlab-duo" | "huggingface" | "kimi-code" | "kilo" | "kagi" | "litellm" | "lm-studio" | "minimax-code" | "minimax-code-cn" | "moonshot" | "nvidia" | "nanogpt" | "ollama" | "ollama-cloud" | "openai-codex" | "openai-codex-device" | "opencode-go" | "opencode-zen" | "opengateway" | "parallel" | "perplexity" | "qianfan" | "qwen-portal" | "synthetic" | "tavily" | "together" | "venice" | "vercel-ai-gateway" | "vllm" | "xai" | "glm-zcode" | "xiaomi" | "xiaomi-token-plan-sgp" | "xiaomi-token-plan-ams" | "xiaomi-token-plan-cn" | "zenmux" | "zai";
+export type OAuthProvider = "alibaba-token-plan" | "anthropic" | "bizrouter" | "mara" | "cerebras" | "cloudflare-ai-gateway" | "cursor" | "deepseek" | "deepinfra" | "fireworks" | "firepass" | "fugu" | "github-copilot" | "google-gemini-cli" | "google-antigravity" | "gitlab-duo" | "huggingface" | "kimi-code" | "kilo" | "kagi" | "litellm" | "lm-studio" | "minimax-code" | "minimax-code-cn" | "moonshot" | "nvidia" | "nanogpt" | "ollama" | "ollama-cloud" | "openai-codex" | "openai-codex-device" | "opencode-go" | "opencode-zen" | "opengateway" | "parallel" | "perplexity" | "qianfan" | "qwen-portal" | "synthetic" | "tavily" | "together" | "venice" | "vercel-ai-gateway" | "vllm" | "xai" | "glm-zcode" | "xiaomi" | "xiaomi-token-plan-sgp" | "xiaomi-token-plan-ams" | "xiaomi-token-plan-cn" | "zenmux" | "zai";
 export type OAuthProviderId = OAuthProvider | (string & {});
 export type OAuthPrompt = {
     message: string;

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@gajae-code/ai",
-	"version": "0.12.1",
+	"version": "0.12.4",
 	"description": "Unified LLM API with automatic model discovery and provider configuration",
 	"homepage": "https://gajae-code.com",
 	"author": "Yeachan-Heo and Gajae Code Contributors",
@@ -40,7 +40,7 @@
 	"dependencies": {
 		"@anthropic-ai/sdk": "^0.94.0",
 		"@bufbuild/protobuf": "^2.12.0",
-		"@gajae-code/utils": "0.12.1",
+		"@gajae-code/utils": "0.12.4",
 		"openai": "^6.36.0",
 		"partial-json": "^0.1.7",
 		"zod": "4.4.3"

package/src/auth-storage.ts

@@ -572,6 +572,16 @@ const OAUTH_REFRESH_SKEW_MS = 60_000;
  * pathological detach-without-reattach loops can't grow memory unboundedly.
  */
 const MAX_PENDING_DISABLED_EVENTS = 32;
+/**
+ * Cap on how many times an OAuth resolution may reload the credential store and
+ * re-resolve after a failed refresh. Each retry exists to recover from a peer
+ * process rotating (or replacing) the row under us, which is a bounded event:
+ * the peer either published a usable credential we pick up on the next pass, or
+ * it did not. Without a cap, a credential whose disable can never be applied
+ * (row replaced by an account switcher, CAS predicate that can never match)
+ * makes the recovery path re-issue the same failing token refresh forever.
+ */
+const MAX_OAUTH_RESOLUTION_RELOADS = 3;
 
 type UsageCacheEntry<T> = {
 	value: T;
@@ -1426,6 +1436,34 @@ export class AuthStorage {
 		return true;
 	}
 
+	/**
+	 * Whether the persisted row `credentialId` is still an OAuth credential holding
+	 * `refreshToken`. Used by the refresh-failure path to tell "a peer rotated this
+	 * row" (retry is worthwhile) apart from "the row is unchanged but the CAS
+	 * predicate cannot match it" (retry replays the same failing refresh).
+	 */
+	#credentialRowHoldsRefreshToken(provider: string, credentialId: number, refreshToken: string): boolean {
+		const row = this.#store.listAuthCredentials(provider).find(entry => entry.id === credentialId);
+		const credential = row?.credential;
+		return credential?.type === "oauth" && credential.refresh === refreshToken;
+	}
+
+	/**
+	 * Soft-deletes a row by id, bypassing the data-equality CAS. Only safe when the
+	 * caller has confirmed the row still holds the credential it attempted to
+	 * refresh, so no peer rotation can be clobbered.
+	 */
+	#disableCredentialById(provider: string, credentialId: number, disabledCause: string): void {
+		this.#store.deleteAuthCredential(credentialId, disabledCause);
+		const entries = this.#getStoredCredentials(provider);
+		this.#setStoredCredentials(
+			provider,
+			entries.filter(entry => entry.id !== credentialId),
+		);
+		this.#resetProviderAssignments(provider);
+		this.#emitCredentialDisabled({ provider, disabledCause });
+	}
+
 	#emitCredentialDisabled(event: CredentialDisabledEvent): void {
 		if (this.#credentialDisabledListeners.size === 0) {
 			// No subscribers — buffer for later replay. Cap the backlog so a process that runs
@@ -2004,6 +2042,12 @@ export class AuthStorage {
 				await saveApiKeyCredential(apiKey);
 				return;
 			}
+			case "mara": {
+				const { loginMara } = await import("./utils/oauth/mara");
+				const apiKey = await loginMara(ctrl);
+				await saveApiKeyCredential(apiKey);
+				return;
+			}
 			case "opengateway": {
 				const { loginOpenGateway } = await import("./utils/oauth/opengateway");
 				const apiKey = await loginOpenGateway(ctrl);
@@ -2989,7 +3033,15 @@ export class AuthStorage {
 		provider: string,
 		sessionId?: string,
 		options?: AuthApiKeyOptions,
+		reloadsUsed = 0,
 	): Promise<OAuthResolutionResult | undefined> {
+		if (reloadsUsed > MAX_OAUTH_RESOLUTION_RELOADS) {
+			logger.warn("OAuth credential resolution exhausted its reload budget", {
+				provider,
+				reloadsUsed,
+			});
+			return undefined;
+		}
 		const selectedCredential = this.#resolveSelectedStoredCredential(provider, options);
 		const selectedOAuthCredential =
 			selectedCredential?.credential.type === "oauth"
@@ -3087,18 +3139,27 @@ export class AuthStorage {
 					usagePrechecked: candidate.usageChecked,
 					enforceProRequirement,
 				},
+				reloadsUsed,
 			);
 			if (resolved) return resolved;
 		}
 
 		if (fallback && this.#isCredentialBlocked(providerKey, fallback.selection.index)) {
-			return this.#tryOAuthCredential(provider, fallback.selection, providerKey, sessionId, options, {
-				checkUsage,
-				allowBlocked: true,
-				prefetchedUsage: fallback.usage,
-				usagePrechecked: fallback.usageChecked,
-				enforceProRequirement,
-			});
+			return this.#tryOAuthCredential(
+				provider,
+				fallback.selection,
+				providerKey,
+				sessionId,
+				options,
+				{
+					checkUsage,
+					allowBlocked: true,
+					prefetchedUsage: fallback.usage,
+					usagePrechecked: fallback.usageChecked,
+					enforceProRequirement,
+				},
+				reloadsUsed,
+			);
 		}
 
 		return undefined;
@@ -3219,6 +3280,7 @@ export class AuthStorage {
 			usagePrechecked?: boolean;
 			enforceProRequirement?: boolean;
 		},
+		reloadsUsed = 0,
 	): Promise<OAuthResolutionResult | undefined> {
 		const {
 			checkUsage,
@@ -3357,7 +3419,7 @@ export class AuthStorage {
 						credentialId: attemptedCredentialId,
 					});
 					await this.reload();
-					return this.#resolveOAuthSelection(provider, sessionId, options);
+					return this.#resolveOAuthSelection(provider, sessionId, options, reloadsUsed + 1);
 				}
 			}
 			// Only remove credentials for definitive auth failures
@@ -3387,18 +3449,39 @@ export class AuthStorage {
 					`oauth refresh failed: ${errorMsg}`,
 				);
 				if (!disabled) {
-					logger.debug("OAuth refresh disable lost CAS; reloading after peer rotation", {
-						provider,
-						index: selection.index,
-					});
-					await this.reload();
-					return this.#resolveOAuthSelection(provider, sessionId, options);
+					// The CAS predicate compares the row's serialized `data`, so it also
+					// misses when nothing was rotated: the row may have been replaced by
+					// a peer (account switcher rewriting the provider's credentials, so
+					// our snapshot's id no longer exists) or updated with unrelated
+					// identity metadata. Reload-and-retry only makes progress in the
+					// rotation case; otherwise the same revoked token is re-refreshed on
+					// every request forever. When the row is still present with the very
+					// refresh token we just tried, disabling by id is safe — there is no
+					// peer rotation to clobber — so apply it directly instead of looping.
+					const stillHoldsAttemptedToken =
+						attemptedCredentialId !== undefined &&
+						this.#credentialRowHoldsRefreshToken(provider, attemptedCredentialId, selection.credential.refresh);
+					if (stillHoldsAttemptedToken && attemptedCredentialId !== undefined) {
+						logger.warn("OAuth refresh disable CAS mismatched an unrotated row; disabling by id", {
+							provider,
+							index: selection.index,
+							credentialId: attemptedCredentialId,
+						});
+						this.#disableCredentialById(provider, attemptedCredentialId, `oauth refresh failed: ${errorMsg}`);
+					} else {
+						logger.debug("OAuth refresh disable lost CAS; reloading after peer rotation", {
+							provider,
+							index: selection.index,
+						});
+						await this.reload();
+						return this.#resolveOAuthSelection(provider, sessionId, options, reloadsUsed + 1);
+					}
 				}
 				if (
 					!this.#getCredentialSelector(provider, options) &&
 					this.#getCredentialsForProvider(provider).some(credential => credential.type === "oauth")
 				) {
-					return this.#resolveOAuthSelection(provider, sessionId, options);
+					return this.#resolveOAuthSelection(provider, sessionId, options, reloadsUsed);
 				}
 			} else {
 				// Block temporarily for transient failures (5 minutes)

package/src/cli.ts

@@ -120,6 +120,7 @@ Providers:
   zenmux            ZenMux
   opengateway       OpenGateway by Sionic AI
   bizrouter         BizRouter
+  mara              Mara Cloud
   ollama-cloud      Ollama Cloud
 
 Examples:

package/src/models.json

@@ -39882,6 +39882,94 @@
 			"maxTokens": 8888
 		}
 	},
+	"mara": {
+		"DeepSeek-V3.1": {
+			"id": "DeepSeek-V3.1",
+			"name": "DeepSeek V3.1",
+			"api": "openai-completions",
+			"provider": "mara",
+			"baseUrl": "https://api.cloud.mara.com/v1",
+			"reasoning": true,
+			"input": [
+				"text"
+			],
+			"cost": {
+				"input": 0.6,
+				"output": 1.7,
+				"cacheRead": 0,
+				"cacheWrite": 0
+			},
+			"contextWindow": 131072,
+			"maxTokens": 16384,
+			"thinking": {
+				"mode": "effort",
+				"minLevel": "minimal",
+				"maxLevel": "xhigh"
+			}
+		},
+		"MiniMax-M2.5": {
+			"id": "MiniMax-M2.5",
+			"name": "MiniMax M2.5",
+			"api": "openai-completions",
+			"provider": "mara",
+			"baseUrl": "https://api.cloud.mara.com/v1",
+			"reasoning": false,
+			"input": [
+				"text"
+			],
+			"cost": {
+				"input": 0.3,
+				"output": 1.2,
+				"cacheRead": 0,
+				"cacheWrite": 0
+			},
+			"contextWindow": 196608,
+			"maxTokens": 16384
+		},
+		"MiniMax-M2.7": {
+			"id": "MiniMax-M2.7",
+			"name": "MiniMax M2.7",
+			"api": "openai-completions",
+			"provider": "mara",
+			"baseUrl": "https://api.cloud.mara.com/v1",
+			"reasoning": false,
+			"input": [
+				"text"
+			],
+			"cost": {
+				"input": 0.3,
+				"output": 1.2,
+				"cacheRead": 0,
+				"cacheWrite": 0
+			},
+			"contextWindow": 196608,
+			"maxTokens": 16384
+		},
+		"gpt-oss-120b": {
+			"id": "gpt-oss-120b",
+			"name": "GPT OSS 120B",
+			"api": "openai-completions",
+			"provider": "mara",
+			"baseUrl": "https://api.cloud.mara.com/v1",
+			"reasoning": true,
+			"input": [
+				"text"
+			],
+			"cost": {
+				"input": 0.15,
+				"output": 0.75,
+				"cacheRead": 0,
+				"cacheWrite": 0
+			},
+			"contextWindow": 131072,
+			"maxTokens": 16384,
+			"thinking": {
+				"mode": "effort",
+				"minLevel": "minimal",
+				"maxLevel": "xhigh"
+			}
+		}
+	},
 	"minimax": {
 		"MiniMax-M2": {
 			"id": "MiniMax-M2",
@@ -85423,4 +85511,4 @@
 			}
 		}
 	}
-}
+}

package/src/provider-models/descriptors.ts

@@ -26,6 +26,7 @@ import {
 	kimiCodeModelManagerOptions,
 	litellmModelManagerOptions,
 	lmStudioModelManagerOptions,
+	maraModelManagerOptions,
 	mistralModelManagerOptions,
 	moonshotModelManagerOptions,
 	nanoGptModelManagerOptions,
@@ -326,6 +327,12 @@ export const PROVIDER_DESCRIPTORS: readonly ProviderDescriptor[] = [
 		config => bizrouterModelManagerOptions(config),
 		catalog("BizRouter", ["BIZROUTER_API_KEY"]),
 	),
+	catalogDescriptor(
+		"mara",
+		"DeepSeek-V3.1",
+		config => maraModelManagerOptions(config),
+		catalog("Mara Cloud", ["MARA_API_KEY"]),
+	),
 	catalogDescriptor("zai", "glm-5.2", config => zaiModelManagerOptions(config), catalog("zAI", ["ZAI_API_KEY"])),
 	catalogDescriptor(
 		"glm-zcode",

package/src/provider-models/openai-compat.ts

@@ -1180,6 +1180,22 @@ export function bizrouterModelManagerOptions(
 	};
 }
 
+// ---------------------------------------------------------------------------
+// 10.5.3 Mara Cloud
+// ---------------------------------------------------------------------------
+
+export interface MaraModelManagerConfig {
+	apiKey?: string;
+	baseUrl?: string;
+}
+
+/**
+ * Mara Cloud — an OpenAI-compatible enterprise AI inference platform. Models
+ * are discovered from the OpenAI-compatible `/v1/models` endpoint.
+ */
+export function maraModelManagerOptions(config?: MaraModelManagerConfig): ModelManagerOptions<"openai-completions"> {
+	return createSimpleOpenAICompletionsOptions("mara", "https://api.cloud.mara.com/v1", config);
+}
 // ---------------------------------------------------------------------------
 // 10.6 Kilo Gateway
 // ---------------------------------------------------------------------------

package/src/stream.ts

@@ -164,6 +164,7 @@ const serviceProviderMap: Record<string, KeyResolver> = {
 	zenmux: "ZENMUX_API_KEY",
 	opengateway: "OPENGATEWAY_API_KEY",
 	bizrouter: "BIZROUTER_API_KEY",
+	mara: "MARA_API_KEY",
 	venice: "VENICE_API_KEY",
 	vllm: "VLLM_API_KEY",
 	xiaomi: "XIAOMI_API_KEY",

package/src/types.ts

@@ -149,6 +149,7 @@ export type KnownProvider =
 	| "opencode-zen"
 	| "opengateway"
 	| "bizrouter"
+	| "mara"
 	| "synthetic"
 	| "cloudflare-ai-gateway"
 	| "huggingface"

package/src/utils/oauth/index.ts

@@ -245,6 +245,11 @@ const builtInOAuthProviders: OAuthProviderInfo[] = [
 		name: "BizRouter",
 		available: true,
 	},
+	{
+		id: "mara",
+		name: "Mara Cloud",
+		available: true,
+	},
 	{
 		id: "opengateway",
 		name: "OpenGateway by Sionic AI",
@@ -393,6 +398,7 @@ export async function refreshOAuthToken(
 		case "moonshot":
 		case "kagi":
 		case "cloudflare-ai-gateway":
+		case "mara":
 		case "vercel-ai-gateway":
 		case "qwen-portal":
 		case "zenmux":

package/src/utils/oauth/mara.ts

@@ -0,0 +1,16 @@
+/** Mara Cloud login flow (API key paste, validated via chat completions). */
+import { createApiKeyLogin } from "./api-key-login";
+
+export const loginMara = createApiKeyLogin({
+	providerLabel: "Mara Cloud",
+	authUrl: "https://cloud.mara.com/apis",
+	instructions: "Create or copy your Mara Cloud API key",
+	promptMessage: "Paste your Mara Cloud API key",
+	placeholder: "<your-mara-api-key>",
+	validation: {
+		kind: "chat-completions",
+		provider: "Mara Cloud",
+		baseUrl: "https://api.cloud.mara.com/v1",
+		model: "DeepSeek-V3.1",
+	},
+});

package/src/utils/oauth/types.ts

@@ -12,6 +12,7 @@ export type OAuthProvider =
 	| "alibaba-token-plan"
 	| "anthropic"
 	| "bizrouter"
+	| "mara"
 	| "cerebras"
 	| "cloudflare-ai-gateway"
 	| "cursor"