@byoky/core 0.3.0 → 0.4.1

package/dist/index.d.cts

@@ -56,6 +56,9 @@ interface SessionProvider {
     credentialId: string;
     available: boolean;
     authMethod: AuthMethod;
+    giftId?: string;
+    giftRelayUrl?: string;
+    giftAuthToken?: string;
 }
 interface ConnectRequest {
     providers?: ProviderRequirement[];
@@ -155,6 +158,7 @@ interface PendingApproval {
 interface TrustedSite {
     origin: string;
     trustedAt: number;
+    allowedProviders?: string[];
 }
 interface TokenAllowance {
     origin: string;
@@ -267,7 +271,17 @@ interface RelayPong {
     type: 'relay:pong';
     ts: number;
 }
-type RelayMessage = RelayHello | RelayRequest | RelayResponseMeta | RelayResponseChunk | RelayResponseDone | RelayResponseError | RelayPing | RelayPong;
+interface RelayPairHello {
+    type: 'relay:pair:hello';
+    providers: Record<string, {
+        available: boolean;
+        authMethod: AuthMethod;
+    }>;
+}
+interface RelayPairAck {
+    type: 'relay:pair:ack';
+}
+type RelayMessage = RelayHello | RelayRequest | RelayResponseMeta | RelayResponseChunk | RelayResponseDone | RelayResponseError | RelayPing | RelayPong | RelayPairHello | RelayPairAck;
 declare function parseRelayMessage(data: unknown): RelayMessage | null;
 declare function sendRelayMessage(ws: WebSocketLike, msg: RelayMessage): void;
 
@@ -289,9 +303,6 @@ declare function validateProxyUrl(providerId: string, url: string): boolean;
  * Strips any fake session-key headers and injects the real API key.
  */
 declare function buildHeaders(providerId: string, requestHeaders: Record<string, string>, apiKey: string, authMethod?: string): Record<string, string>;
-/**
- * Parse the model name from a request body (JSON).
- */
 declare function parseModel(body?: string): string | undefined;
 /**
  * Parse token usage from a provider API response body.
@@ -317,4 +328,99 @@ declare function computeAllowanceCheck(allowance: TokenAllowance | undefined, en
     reason?: string;
 };
 
-export { type ApiKeyCredential, type AuthMethod, BYOKY_MESSAGE_PREFIX, BYOKY_PROVIDER_KEY, ByokyError, ByokyErrorCode, type ByokyMessage, type ConnectRequest, type ConnectResponse, type Credential, type CredentialBase, type CredentialMeta, MIN_PASSWORD_LENGTH, type MessageType, type OAuthConfig, type OAuthCredential, PROVIDERS, type PasswordStrength, type PendingApproval, type ProviderConfig, type ProviderId, type ProviderRequirement, type ProxyRequest, type ProxyResponseChunk, type ProxyResponseError, type ProxyResponseMeta, type RelayHello, type RelayMessage, type RelayPing, type RelayPong, type RelayRequest, type RelayResponseChunk, type RelayResponseDone, type RelayResponseError, type RelayResponseMeta, type RequestLogEntry, type Session, type SessionProvider, type SessionUsage, type TokenAllowance, type TrustedSite, WS_READY_STATE, type WebSocketLike, buildHeaders, checkPasswordStrength, computeAllowanceCheck, createConnectRequest, createConnectResponse, createErrorMessage, createMessage, decrypt, deriveKey, encrypt, extractUsageFromParsed, getProvider, getProviderIds, hashPassword, isByokyMessage, maskKey, parseModel, parseRelayMessage, parseUsage, sendRelayMessage, validateProxyUrl, verifyPassword };
+interface Gift {
+    id: string;
+    credentialId: string;
+    providerId: string;
+    label: string;
+    authToken: string;
+    maxTokens: number;
+    usedTokens: number;
+    expiresAt: number;
+    createdAt: number;
+    active: boolean;
+    relayUrl: string;
+}
+interface GiftLink {
+    v: 1;
+    id: string;
+    p: string;
+    n: string;
+    s: string;
+    t: string;
+    m: number;
+    e: number;
+    r: string;
+}
+interface GiftedCredential {
+    id: string;
+    giftId: string;
+    providerId: string;
+    providerName: string;
+    senderLabel: string;
+    authToken: string;
+    maxTokens: number;
+    usedTokens: number;
+    expiresAt: number;
+    relayUrl: string;
+    createdAt: number;
+}
+interface RelayAuth {
+    type: 'relay:auth';
+    roomId: string;
+    authToken: string;
+    role: 'sender' | 'recipient';
+}
+interface RelayAuthResult {
+    type: 'relay:auth:result';
+    success: boolean;
+    error?: string;
+    peerOnline?: boolean;
+}
+interface RelayPeerStatus {
+    type: 'relay:peer:status';
+    online: boolean;
+}
+interface RelayUsageUpdate {
+    type: 'relay:usage';
+    roomId: string;
+    usedTokens: number;
+}
+type RelayProtocolMessage = RelayAuth | RelayAuthResult | RelayPeerStatus | RelayUsageUpdate;
+declare function encodeGiftLink(link: GiftLink): string;
+declare function decodeGiftLink(encoded: string): GiftLink | null;
+declare function giftLinkToUrl(encoded: string): string;
+declare function validateGiftLink(link: GiftLink): {
+    valid: boolean;
+    reason?: string;
+};
+declare function isGiftExpired(gift: {
+    expiresAt: number;
+}): boolean;
+declare function isGiftBudgetExhausted(gift: {
+    usedTokens: number;
+    maxTokens: number;
+}): boolean;
+declare function giftBudgetRemaining(gift: {
+    usedTokens: number;
+    maxTokens: number;
+}): number;
+declare function giftBudgetPercent(gift: {
+    usedTokens: number;
+    maxTokens: number;
+}): number;
+declare function createGiftLink(gift: Gift): {
+    encoded: string;
+    link: GiftLink;
+};
+interface PairPayload {
+    v: 1;
+    r: string;
+    id: string;
+    t: string;
+    o: string;
+}
+declare function encodePairPayload(payload: PairPayload): string;
+declare function decodePairPayload(encoded: string): PairPayload | null;
+
+export { type ApiKeyCredential, type AuthMethod, BYOKY_MESSAGE_PREFIX, BYOKY_PROVIDER_KEY, ByokyError, ByokyErrorCode, type ByokyMessage, type ConnectRequest, type ConnectResponse, type Credential, type CredentialBase, type CredentialMeta, type Gift, type GiftLink, type GiftedCredential, MIN_PASSWORD_LENGTH, type MessageType, type OAuthConfig, type OAuthCredential, PROVIDERS, type PairPayload, type PasswordStrength, type PendingApproval, type ProviderConfig, type ProviderId, type ProviderRequirement, type ProxyRequest, type ProxyResponseChunk, type ProxyResponseError, type ProxyResponseMeta, type RelayAuth, type RelayAuthResult, type RelayHello, type RelayMessage, type RelayPairAck, type RelayPairHello, type RelayPeerStatus, type RelayPing, type RelayPong, type RelayProtocolMessage, type RelayRequest, type RelayResponseChunk, type RelayResponseDone, type RelayResponseError, type RelayResponseMeta, type RelayUsageUpdate, type RequestLogEntry, type Session, type SessionProvider, type SessionUsage, type TokenAllowance, type TrustedSite, WS_READY_STATE, type WebSocketLike, buildHeaders, checkPasswordStrength, computeAllowanceCheck, createConnectRequest, createConnectResponse, createErrorMessage, createGiftLink, createMessage, decodeGiftLink, decodePairPayload, decrypt, deriveKey, encodeGiftLink, encodePairPayload, encrypt, extractUsageFromParsed, getProvider, getProviderIds, giftBudgetPercent, giftBudgetRemaining, giftLinkToUrl, hashPassword, isByokyMessage, isGiftBudgetExhausted, isGiftExpired, maskKey, parseModel, parseRelayMessage, parseUsage, sendRelayMessage, validateGiftLink, validateProxyUrl, verifyPassword };

package/dist/index.d.ts

@@ -56,6 +56,9 @@ interface SessionProvider {
     credentialId: string;
     available: boolean;
     authMethod: AuthMethod;
+    giftId?: string;
+    giftRelayUrl?: string;
+    giftAuthToken?: string;
 }
 interface ConnectRequest {
     providers?: ProviderRequirement[];
@@ -155,6 +158,7 @@ interface PendingApproval {
 interface TrustedSite {
     origin: string;
     trustedAt: number;
+    allowedProviders?: string[];
 }
 interface TokenAllowance {
     origin: string;
@@ -267,7 +271,17 @@ interface RelayPong {
     type: 'relay:pong';
     ts: number;
 }
-type RelayMessage = RelayHello | RelayRequest | RelayResponseMeta | RelayResponseChunk | RelayResponseDone | RelayResponseError | RelayPing | RelayPong;
+interface RelayPairHello {
+    type: 'relay:pair:hello';
+    providers: Record<string, {
+        available: boolean;
+        authMethod: AuthMethod;
+    }>;
+}
+interface RelayPairAck {
+    type: 'relay:pair:ack';
+}
+type RelayMessage = RelayHello | RelayRequest | RelayResponseMeta | RelayResponseChunk | RelayResponseDone | RelayResponseError | RelayPing | RelayPong | RelayPairHello | RelayPairAck;
 declare function parseRelayMessage(data: unknown): RelayMessage | null;
 declare function sendRelayMessage(ws: WebSocketLike, msg: RelayMessage): void;
 
@@ -289,9 +303,6 @@ declare function validateProxyUrl(providerId: string, url: string): boolean;
  * Strips any fake session-key headers and injects the real API key.
  */
 declare function buildHeaders(providerId: string, requestHeaders: Record<string, string>, apiKey: string, authMethod?: string): Record<string, string>;
-/**
- * Parse the model name from a request body (JSON).
- */
 declare function parseModel(body?: string): string | undefined;
 /**
  * Parse token usage from a provider API response body.
@@ -317,4 +328,99 @@ declare function computeAllowanceCheck(allowance: TokenAllowance | undefined, en
     reason?: string;
 };
 
-export { type ApiKeyCredential, type AuthMethod, BYOKY_MESSAGE_PREFIX, BYOKY_PROVIDER_KEY, ByokyError, ByokyErrorCode, type ByokyMessage, type ConnectRequest, type ConnectResponse, type Credential, type CredentialBase, type CredentialMeta, MIN_PASSWORD_LENGTH, type MessageType, type OAuthConfig, type OAuthCredential, PROVIDERS, type PasswordStrength, type PendingApproval, type ProviderConfig, type ProviderId, type ProviderRequirement, type ProxyRequest, type ProxyResponseChunk, type ProxyResponseError, type ProxyResponseMeta, type RelayHello, type RelayMessage, type RelayPing, type RelayPong, type RelayRequest, type RelayResponseChunk, type RelayResponseDone, type RelayResponseError, type RelayResponseMeta, type RequestLogEntry, type Session, type SessionProvider, type SessionUsage, type TokenAllowance, type TrustedSite, WS_READY_STATE, type WebSocketLike, buildHeaders, checkPasswordStrength, computeAllowanceCheck, createConnectRequest, createConnectResponse, createErrorMessage, createMessage, decrypt, deriveKey, encrypt, extractUsageFromParsed, getProvider, getProviderIds, hashPassword, isByokyMessage, maskKey, parseModel, parseRelayMessage, parseUsage, sendRelayMessage, validateProxyUrl, verifyPassword };
+interface Gift {
+    id: string;
+    credentialId: string;
+    providerId: string;
+    label: string;
+    authToken: string;
+    maxTokens: number;
+    usedTokens: number;
+    expiresAt: number;
+    createdAt: number;
+    active: boolean;
+    relayUrl: string;
+}
+interface GiftLink {
+    v: 1;
+    id: string;
+    p: string;
+    n: string;
+    s: string;
+    t: string;
+    m: number;
+    e: number;
+    r: string;
+}
+interface GiftedCredential {
+    id: string;
+    giftId: string;
+    providerId: string;
+    providerName: string;
+    senderLabel: string;
+    authToken: string;
+    maxTokens: number;
+    usedTokens: number;
+    expiresAt: number;
+    relayUrl: string;
+    createdAt: number;
+}
+interface RelayAuth {
+    type: 'relay:auth';
+    roomId: string;
+    authToken: string;
+    role: 'sender' | 'recipient';
+}
+interface RelayAuthResult {
+    type: 'relay:auth:result';
+    success: boolean;
+    error?: string;
+    peerOnline?: boolean;
+}
+interface RelayPeerStatus {
+    type: 'relay:peer:status';
+    online: boolean;
+}
+interface RelayUsageUpdate {
+    type: 'relay:usage';
+    roomId: string;
+    usedTokens: number;
+}
+type RelayProtocolMessage = RelayAuth | RelayAuthResult | RelayPeerStatus | RelayUsageUpdate;
+declare function encodeGiftLink(link: GiftLink): string;
+declare function decodeGiftLink(encoded: string): GiftLink | null;
+declare function giftLinkToUrl(encoded: string): string;
+declare function validateGiftLink(link: GiftLink): {
+    valid: boolean;
+    reason?: string;
+};
+declare function isGiftExpired(gift: {
+    expiresAt: number;
+}): boolean;
+declare function isGiftBudgetExhausted(gift: {
+    usedTokens: number;
+    maxTokens: number;
+}): boolean;
+declare function giftBudgetRemaining(gift: {
+    usedTokens: number;
+    maxTokens: number;
+}): number;
+declare function giftBudgetPercent(gift: {
+    usedTokens: number;
+    maxTokens: number;
+}): number;
+declare function createGiftLink(gift: Gift): {
+    encoded: string;
+    link: GiftLink;
+};
+interface PairPayload {
+    v: 1;
+    r: string;
+    id: string;
+    t: string;
+    o: string;
+}
+declare function encodePairPayload(payload: PairPayload): string;
+declare function decodePairPayload(encoded: string): PairPayload | null;
+
+export { type ApiKeyCredential, type AuthMethod, BYOKY_MESSAGE_PREFIX, BYOKY_PROVIDER_KEY, ByokyError, ByokyErrorCode, type ByokyMessage, type ConnectRequest, type ConnectResponse, type Credential, type CredentialBase, type CredentialMeta, type Gift, type GiftLink, type GiftedCredential, MIN_PASSWORD_LENGTH, type MessageType, type OAuthConfig, type OAuthCredential, PROVIDERS, type PairPayload, type PasswordStrength, type PendingApproval, type ProviderConfig, type ProviderId, type ProviderRequirement, type ProxyRequest, type ProxyResponseChunk, type ProxyResponseError, type ProxyResponseMeta, type RelayAuth, type RelayAuthResult, type RelayHello, type RelayMessage, type RelayPairAck, type RelayPairHello, type RelayPeerStatus, type RelayPing, type RelayPong, type RelayProtocolMessage, type RelayRequest, type RelayResponseChunk, type RelayResponseDone, type RelayResponseError, type RelayResponseMeta, type RelayUsageUpdate, type RequestLogEntry, type Session, type SessionProvider, type SessionUsage, type TokenAllowance, type TrustedSite, WS_READY_STATE, type WebSocketLike, buildHeaders, checkPasswordStrength, computeAllowanceCheck, createConnectRequest, createConnectResponse, createErrorMessage, createGiftLink, createMessage, decodeGiftLink, decodePairPayload, decrypt, deriveKey, encodeGiftLink, encodePairPayload, encrypt, extractUsageFromParsed, getProvider, getProviderIds, giftBudgetPercent, giftBudgetRemaining, giftLinkToUrl, hashPassword, isByokyMessage, isGiftBudgetExhausted, isGiftExpired, maskKey, parseModel, parseRelayMessage, parseUsage, sendRelayMessage, validateGiftLink, validateProxyUrl, verifyPassword };

package/dist/index.js

@@ -325,8 +325,10 @@ var WS_READY_STATE = {
   CLOSING: 2,
   CLOSED: 3
 };
+var MAX_RELAY_MESSAGE_SIZE = 1048576;
 function parseRelayMessage(data) {
   try {
+    if (typeof data === "string" && data.length > MAX_RELAY_MESSAGE_SIZE) return null;
     const raw = typeof data === "string" ? JSON.parse(data) : data;
     if (!raw || typeof raw !== "object" || typeof raw.type !== "string" || !raw.type.startsWith("relay:")) {
       return null;
@@ -345,13 +347,21 @@ function parseRelayMessage(data) {
         if (typeof raw.requestId !== "string" || typeof raw.chunk !== "string") return null;
         break;
       case "relay:response:done":
+        if (typeof raw.requestId !== "string") return null;
+        break;
       case "relay:response:error":
         if (typeof raw.requestId !== "string") return null;
+        if (raw.error && (typeof raw.error !== "object" || typeof raw.error.code !== "string" || typeof raw.error.message !== "string")) return null;
         break;
       case "relay:ping":
       case "relay:pong":
         if (typeof raw.ts !== "number") return null;
         break;
+      case "relay:pair:hello":
+        if (!raw.providers || typeof raw.providers !== "object") return null;
+        break;
+      case "relay:pair:ack":
+        break;
       default:
         return null;
     }
@@ -387,16 +397,59 @@ var COMMON_PASSWORDS = /* @__PURE__ */ new Set([
   "shadow123",
   "michael1",
   "jordan123",
-  "superman1"
+  "superman1",
+  "password123",
+  "admin12345",
+  "letmein123",
+  "p@ssw0rd",
+  "p@ssw0rd1",
+  "qwerty1234",
+  "changeme12",
+  "welcome123",
+  "1234567890",
+  "baseball1",
+  "starwars12",
+  "whatever1",
+  "passw0rd1",
+  "mustang12",
+  "access1234",
+  "charlie123",
+  "donald1234",
+  "maggie1234",
+  "master1234",
+  "michael123",
+  "jennifer1",
+  "hunter1234",
+  "thomas1234",
+  "corvette12",
+  "robert1234",
+  "summer1234",
+  "george1234",
+  "harley1234",
+  "cheese1234",
+  "computer1",
+  "internet1",
+  "secret1234",
+  "diamond1",
+  "chicken123",
+  "pepper1234",
+  "jessica123",
+  "hannah1234",
+  "ginger1234",
+  "joshua1234",
+  "abcdefgh1",
+  "qwertyuiop",
+  "asdfghjkl1",
+  "zxcvbnm123",
+  "1q2w3e4r5t",
+  "passpass1"
 ]);
 function checkPasswordStrength(password) {
   const feedback = [];
   let score = 0;
-  if (password.length < 12) {
+  if (password.length < MIN_PASSWORD_LENGTH) {
     feedback.push("Use at least 12 characters");
-    if (password.length < 8) {
-      return { score: 0, label: "Too weak", feedback };
-    }
+    return { score: 0, label: "Too weak", feedback };
   } else {
     score++;
     if (password.length >= 16) score++;
@@ -462,12 +515,23 @@ function buildHeaders(providerId, requestHeaders, apiKey, authMethod = "api_key"
   delete headers["authorization"];
   delete headers["x-api-key"];
   delete headers["api-key"];
+  delete headers["origin"];
+  delete headers["referer"];
+  for (const key of Object.keys(headers)) {
+    if (key.startsWith("x-stainless-")) delete headers[key];
+  }
+  delete headers["sec-fetch-mode"];
+  delete headers["accept-language"];
+  delete headers["accept-encoding"];
+  delete headers["content-length"];
   if (providerId === "anthropic") {
     if (authMethod === "oauth") {
       headers["authorization"] = `Bearer ${apiKey}`;
-      headers["user-agent"] = "claude-cli/2.1.75";
+      headers["user-agent"] = "claude-cli/2.1.76";
       headers["x-app"] = "cli";
-      headers["anthropic-beta"] = "claude-code-20250219,oauth-2025-04-20";
+      headers["accept"] = "application/json";
+      headers["anthropic-beta"] = "claude-code-20250219,oauth-2025-04-20,fine-grained-tool-streaming-2025-05-14,interleaved-thinking-2025-05-14";
+      headers["anthropic-dangerous-direct-browser-access"] = "true";
     } else {
       headers["x-api-key"] = apiKey;
     }
@@ -479,8 +543,9 @@ function buildHeaders(providerId, requestHeaders, apiKey, authMethod = "api_key"
   }
   return headers;
 }
+var MAX_BODY_PARSE_SIZE = 10485760;
 function parseModel(body) {
-  if (!body) return void 0;
+  if (!body || body.length > MAX_BODY_PARSE_SIZE) return void 0;
   try {
     const parsed = JSON.parse(body);
     return parsed.model ?? void 0;
@@ -510,25 +575,28 @@ function parseUsage(providerId, body) {
     return void 0;
   }
 }
+function sanitizeTokenCounts(input, output) {
+  const i = Math.max(0, Math.floor(input));
+  const o = Math.max(0, Math.floor(output));
+  if (!Number.isFinite(i) || !Number.isFinite(o)) return void 0;
+  return { inputTokens: i, outputTokens: o };
+}
 function extractUsageFromParsed(providerId, parsed) {
   if (providerId === "anthropic") {
     const usage2 = parsed.usage;
     if (usage2?.input_tokens != null && usage2?.output_tokens != null) {
-      return { inputTokens: usage2.input_tokens, outputTokens: usage2.output_tokens };
+      return sanitizeTokenCounts(usage2.input_tokens, usage2.output_tokens);
     }
   }
   if (providerId === "gemini") {
     const meta = parsed.usageMetadata;
     if (meta?.promptTokenCount != null) {
-      return {
-        inputTokens: meta.promptTokenCount,
-        outputTokens: meta.candidatesTokenCount ?? 0
-      };
+      return sanitizeTokenCounts(meta.promptTokenCount, meta.candidatesTokenCount ?? 0);
     }
   }
   const usage = parsed.usage;
   if (usage?.prompt_tokens != null && usage?.completion_tokens != null) {
-    return { inputTokens: usage.prompt_tokens, outputTokens: usage.completion_tokens };
+    return sanitizeTokenCounts(usage.prompt_tokens, usage.completion_tokens);
   }
   return void 0;
 }
@@ -550,6 +618,105 @@ function computeAllowanceCheck(allowance, entries, providerId) {
   }
   return { allowed: true };
 }
+
+// src/gift.ts
+function encodeGiftLink(link) {
+  const json = JSON.stringify(link);
+  const bytes = new TextEncoder().encode(json);
+  return base64UrlEncode(bytes);
+}
+var MAX_GIFT_LINK_SIZE = 8192;
+function decodeGiftLink(encoded) {
+  try {
+    if (encoded.length > MAX_GIFT_LINK_SIZE) return null;
+    const clean = encoded.replace(/^byoky:\/\/gift\//, "");
+    const bytes = base64UrlDecode(clean);
+    const json = new TextDecoder().decode(bytes);
+    const parsed = JSON.parse(json);
+    if (parsed.v !== 1) return null;
+    return parsed;
+  } catch {
+    return null;
+  }
+}
+function giftLinkToUrl(encoded) {
+  return `byoky://gift/${encoded}`;
+}
+function validateGiftLink(link) {
+  if (link.v !== 1) return { valid: false, reason: "Unsupported gift version" };
+  if (!link.id || typeof link.id !== "string") return { valid: false, reason: "Missing gift ID" };
+  if (!link.p || typeof link.p !== "string") return { valid: false, reason: "Missing provider" };
+  if (!link.t || typeof link.t !== "string") return { valid: false, reason: "Missing auth token" };
+  if (!link.r || typeof link.r !== "string") return { valid: false, reason: "Missing relay URL" };
+  if (typeof link.m !== "number" || link.m <= 0) return { valid: false, reason: "Invalid token budget" };
+  if (typeof link.e !== "number" || link.e <= Date.now()) return { valid: false, reason: "Gift has expired" };
+  try {
+    const url = new URL(link.r);
+    if (url.protocol !== "ws:" && url.protocol !== "wss:") {
+      return { valid: false, reason: "Relay URL must use ws:// or wss://" };
+    }
+  } catch {
+    return { valid: false, reason: "Invalid relay URL" };
+  }
+  return { valid: true };
+}
+function isGiftExpired(gift) {
+  return gift.expiresAt <= Date.now();
+}
+function isGiftBudgetExhausted(gift) {
+  return gift.usedTokens >= gift.maxTokens;
+}
+function giftBudgetRemaining(gift) {
+  return Math.max(0, gift.maxTokens - gift.usedTokens);
+}
+function giftBudgetPercent(gift) {
+  if (gift.maxTokens === 0) return 100;
+  return Math.min(100, Math.round(gift.usedTokens / gift.maxTokens * 100));
+}
+function createGiftLink(gift) {
+  const provider = PROVIDERS[gift.providerId];
+  const link = {
+    v: 1,
+    id: gift.id,
+    p: gift.providerId,
+    n: provider?.name ?? gift.providerId,
+    s: gift.label,
+    t: gift.authToken,
+    m: gift.maxTokens,
+    e: gift.expiresAt,
+    r: gift.relayUrl
+  };
+  return { encoded: encodeGiftLink(link), link };
+}
+function encodePairPayload(payload) {
+  const json = JSON.stringify(payload);
+  const bytes = new TextEncoder().encode(json);
+  return base64UrlEncode(bytes);
+}
+function decodePairPayload(encoded) {
+  try {
+    if (encoded.length > 2048) return null;
+    const bytes = base64UrlDecode(encoded);
+    const json = new TextDecoder().decode(bytes);
+    const parsed = JSON.parse(json);
+    if (parsed.v !== 1) return null;
+    return parsed;
+  } catch {
+    return null;
+  }
+}
+function base64UrlEncode(bytes) {
+  let binary = "";
+  for (const byte of bytes) binary += String.fromCharCode(byte);
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function base64UrlDecode(str) {
+  const padded = str.replace(/-/g, "+").replace(/_/g, "/");
+  const binary = atob(padded);
+  const bytes = new Uint8Array(binary.length);
+  for (let i = 0; i < binary.length; i++) bytes[i] = binary.charCodeAt(i);
+  return bytes;
+}
 export {
   BYOKY_MESSAGE_PREFIX,
   BYOKY_PROVIDER_KEY,
@@ -564,20 +731,31 @@ export {
   createConnectRequest,
   createConnectResponse,
   createErrorMessage,
+  createGiftLink,
   createMessage,
+  decodeGiftLink,
+  decodePairPayload,
   decrypt,
   deriveKey,
+  encodeGiftLink,
+  encodePairPayload,
   encrypt,
   extractUsageFromParsed,
   getProvider,
   getProviderIds,
+  giftBudgetPercent,
+  giftBudgetRemaining,
+  giftLinkToUrl,
   hashPassword,
   isByokyMessage,
+  isGiftBudgetExhausted,
+  isGiftExpired,
   maskKey,
   parseModel,
   parseRelayMessage,
   parseUsage,
   sendRelayMessage,
+  validateGiftLink,
   validateProxyUrl,
   verifyPassword
 };