@lightninglabs/pi-402 0.0.1 → 0.0.2

package/README.md

@@ -95,6 +95,7 @@ Select a paid model and prompt:
 
 ```
 /model l402-baseten/kimi-k3           # 1M context, natively multimodal
+/model l402-baseten/kimi-k3.1-pro     # 1M context, cheaper than K3 upstream
 /model l402-baseten/glm-4.7           # 200K context
 /model l402-baseten/glm-5.2           # 200K context
 /model l402-baseten/deepseek-v4-flash # 1M context, the cheap one
@@ -183,6 +184,7 @@ The WASM bundle is not in git. To work on the embedded wallet, build it with
 
 ## Docs
 
+- [`docs/architecture.md`](docs/architecture.md): a map of the extension: components, request and payment pipelines, storage, and concurrency.
 - [`docs/l402-walletdk-inference-payments.md`](docs/l402-walletdk-inference-payments.md): end-to-end design of the extension.
 - [`docs/l402-protocol-extensions.md`](docs/l402-protocol-extensions.md): furthering L402 for metered / streaming inference: keep the macaroon + preimage atomic core, add the session economic model (verifiable receipts, HTLC-native refunds, a BOLT12 payment plane), informed by the Machine Payment Protocol.
 

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@lightninglabs/pi-402",
-	"version": "0.0.1",
+	"version": "0.0.2",
 	"description": "Pay for Pi inference with Lightning: an L402 + walletdk extension for the Pi coding agent",
 	"type": "module",
 	"license": "MIT",

package/src/index.ts

@@ -47,6 +47,19 @@ export default function (pi: ExtensionAPI): void {
 		pi.on("session_start", async () => {
 			await wallet.startAndUnlock();
 		});
+
+		// Release the wallet when Pi tears the extension down. Without this
+		// the WASM runtime and its SQLite worker thread keep Node's event
+		// loop alive, and a non-interactive `pi -p` never exits.
+		//
+		// Only a quit stops it. Pi also emits session_shutdown when it replaces
+		// the session (reload, new, resume, fork) and keeps running, and the
+		// next session needs the wallet the SQLite bridge belongs to.
+		pi.on("session_shutdown", async (event) => {
+			if (event.reason === "quit") {
+				await wallet.stop();
+			}
+		});
 	}
 
 	// Register the paid model provider. Its streamSimple owns the request path,
@@ -103,6 +116,17 @@ export default function (pi: ExtensionAPI): void {
 				contextWindow: 1_048_576,
 				maxTokens: 32_768,
 			},
+			{
+				// Maps to moonshotai/Kimi-K3.1-Pro on the wire. 1M-token
+				// context, priced below Kimi K3 upstream.
+				id: "kimi-k3.1-pro",
+				name: "Kimi K3.1 Pro (L402)",
+				input: ["text"],
+				reasoning: true,
+				cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 },
+				contextWindow: 1_000_000,
+				maxTokens: 32_768,
+			},
 		],
 		streamSimple: makeStreamSimple({ payer, policy, tokenStore, credentialStore, receiptLog }),
 	});

package/src/provider.ts

@@ -57,6 +57,7 @@ const BASETEN_MODEL_SLUGS: Record<string, string> = {
 	"glm-5": "zai-org/GLM-5",
 	"glm-5.2": "zai-org/GLM-5.2",
 	"kimi-k3": "moonshotai/Kimi-K3",
+	"kimi-k3.1-pro": "moonshotai/Kimi-K3.1-Pro",
 };
 
 // wireModelId resolves the model id sent to the proxy/upstream.

package/src/wallet.ts

@@ -104,6 +104,9 @@ export class WalletService {
 	// any more, so calls have to fail fast rather than hang against it.
 	private runtimeExited = false;
 
+	// stopped records that stop() has run, so a second call does nothing.
+	private stopped = false;
+
 	// startAndUnlock brings up the selected backend and unlocks the wallet,
 	// creating it on the first run. It is bootstrapped once per session from
 	// the session_start hook.
@@ -274,6 +277,14 @@ export class WalletService {
 		}
 	}
 
+	// Credit caps: small payments (under about 1,000 sat) go over the swap
+	// server's credit rail, and the wallet only authorizes that rail when the
+	// caller sets an explicit cap. With no cap the quote is refused ("below
+	// the 1000 sat minimum for pay swaps"), which is how a 20 sat session
+	// deposit fails. We pass the per-request ceiling for both caps, so the
+	// wallet never reserves or tops up more credit than a single request may
+	// spend.
+	//
 	// payInvoice pays a BOLT11 invoice via a two-phase wavewalletdk send.
 	// prepareSend quotes the payment (including the swap fee), send
 	// dispatches it, and the preimage is read from the settled entry once
@@ -289,7 +300,11 @@ export class WalletService {
 		const ceiling = maxSatPerRequest();
 
 		if (this.gateway) {
-			const quote = await this.rest("/v1/wallet/prepare-send", { invoice });
+			const quote = await this.rest("/v1/wallet/prepare-send", {
+				invoice,
+				max_credit_sat: ceiling,
+				max_credit_topup_sat: ceiling,
+			});
 			const outflow = quotedOutflowSat(quote);
 			assertWithinCeiling(outflow, ceiling);
 
@@ -312,7 +327,11 @@ export class WalletService {
 		}
 
 		const call = this.requireCall();
-		const quote = await call("prepareSend", { Invoice: invoice });
+		const quote = await call("prepareSend", {
+			Invoice: invoice,
+			MaxCreditSat: ceiling,
+			MaxCreditTopupSat: ceiling,
+		});
 		const outflow = quotedOutflowSat(quote);
 		assertWithinCeiling(outflow, ceiling);
 
@@ -502,6 +521,57 @@ export class WalletService {
 		return payload;
 	}
 
+	// stop shuts the embedded wallet down so the process can exit. The Go
+	// runtime parks on a channel and the SQLite bridge owns a worker thread;
+	// a worker thread is a live handle, so until both are released Node never
+	// drains its event loop and a non-interactive `pi -p` hangs after the
+	// reply is printed.
+	//
+	// It is idempotent, a no-op when the embedded runtime never started (mock
+	// mode, sidecar mode, or a failed bootstrap), and never throws: it runs on
+	// Pi's shutdown path, where an error would only mask the exit. Each step
+	// is bounded by timeoutMs so a wedged wallet cannot hang the exit it is
+	// meant to enable.
+	async stop(timeoutMs = 5_000): Promise<void> {
+		const call = this.call;
+		if (!call || this.stopped) {
+			return;
+		}
+		this.stopped = true;
+
+		// Once stopping begins nothing may use the wallet again.
+		this.ready = false;
+
+		const bounded = async (what: string, work: () => Promise<unknown>) => {
+			let timer: NodeJS.Timeout | undefined;
+			try {
+				await Promise.race([
+					work(),
+					new Promise((_, reject) => {
+						timer = setTimeout(() => reject(new Error(`timed out after ${timeoutMs}ms`)), timeoutMs);
+					}),
+				]);
+			} catch (err) {
+				console.error(`[pi-402] embedded wallet ${what} failed:`, err);
+			} finally {
+				clearTimeout(timer);
+			}
+		};
+
+		// If the runtime already died on its own there is nothing to stop,
+		// but the worker thread may still be holding the process open.
+		if (!this.runtimeExited) {
+			await bounded("stop", () => call("stop"));
+		}
+
+		// The bridge's shutdown terminates the SQLite worker. It runs even
+		// when stop failed, since a leaked worker is what blocks the exit.
+		const bridge = (globalThis as any).sqliteBridge;
+		if (typeof bridge?.shutdown === "function") {
+			await bounded("sqlite shutdown", () => bridge.shutdown());
+		}
+	}
+
 	// noteRuntimeExit records that the embedded Go runtime is gone. The
 	// program is supposed to run for the lifetime of the process, so any exit
 	// is the wallet dying, and the only useful things to do are say so once,

package/wasm/wavewalletdk.wasm

@@ -1,4 +1,4 @@
 [diffend] Oversized file quarantined before diffing.
 name: package/wasm/wavewalletdk.wasm
-size: 136699930 bytes
-sha256: eac3751112c824328c2d62224453e34b18ef94c5459b897e44718d881e8353ac
+size: 133563673 bytes
+sha256: 6d945797ce051806ed880b80a22a3a79e2b303d229cea41dc6d5071a30139f84