A Bluesky labeler that marks posts whose links carry a publisher's unlock token. A gift link and a paywalled link look identical until you read the query string — this reads it for you.
One label value, gift-link, meaning exactly this:
This link carried an unlock token when this service saw it.
That's a fact about a URL, checkable by anyone who reads the link. A post earns the label when one of its links — the embed card or a link in the text — points at a covered publisher and carries that publisher's unlock token.
The caveat that matters: gift tokens expire and get revoked, and nothing here re-checks one. The label is a dated observation, not a promise the article is still readable. /policy says so in those words.
Nothing about the person who posted. It isn't a judgment that sharing the link was generous, or wrong, or against a publisher's terms, and it doesn't mark the post as good or bad. This labels other people's posts, so the value stays descriptive: it names something true about the URL and stops.
Don't want to be labeled? Ask @bisks.net — a single post or your account entirely, no reason needed. /policy has the details.
By searching for recent links to each covered publisher every few minutes, then reading the URLs. Not by watching the firehose: this runs on a stateless Worker that can't hold a connection open. So coverage is best-effort — an unlabeled post means not seen, never checked and found no token.
Labels are served over com.atproto.label.queryLabels. This labeler does not run the websocket label stream — it's a stateless Cloudflare Worker with no standing connections, so tools that only ingest the stream will see nothing, while anything that queries sees every label. That tradeoff is explained on /policy.