@bytexbyte/nxtlinq-ai-agent-ui-react-development 0.3.4 → 2.0.0

package/dist/context/ChatBotContext.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ChatBotContext.d.ts","sourceRoot":"","sources":["../../src/context/ChatBotContext.tsx"],"names":[],"mappings":"AAEA,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAyB/B,OAAO,EAEL,kBAAkB,EAClB,YAAY,EAEb,MAAM,uBAAuB,CAAC;AAM/B,eAAO,MAAM,UAAU,0BAMtB,CAAC;AAEF,eAAO,MAAM,eAAe,EAAE,KAAK,CAAC,EAAE,CAAC,YAAY,CA4vGlD,CAAC"}
+{"version":3,"file":"ChatBotContext.d.ts","sourceRoot":"","sources":["../../src/context/ChatBotContext.tsx"],"names":[],"mappings":"AAEA,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AA0B/B,OAAO,EAEL,kBAAkB,EAClB,YAAY,EAEb,MAAM,uBAAuB,CAAC;AAsB/B,eAAO,MAAM,UAAU,0BAMtB,CAAC;AAEF,eAAO,MAAM,eAAe,EAAE,KAAK,CAAC,EAAE,CAAC,YAAY,CAoyGlD,CAAC"}

package/dist/context/ChatBotContext.js

@@ -5,6 +5,7 @@ import * as React from 'react';
 import { flushSync } from 'react-dom';
 import { v4 as uuidv4 } from 'uuid';
 import { createNxtlinqApi, setApiHosts, synthesizeSpeechToBuffer, streamSpeechToAudioContext, useLocalStorage, useSessionStorage, useSpeechToTextFromMic, useVoiceMode, metakeepClient, getEthers, sleep, walletTextUtils, } from '@bytexbyte/nxtlinq-ai-agent-web-development';
+import { dispatchRuntimeAITCompleteReplacement, removeOneDeniedPermission, replaceCurrentMaximumDenyList, RuntimeAITMutationQueue, RuntimeAITRecomputeCoordinator, StaleRuntimeAITResponseError, runtimeAITContextKey, runtimeAITSubjectKey, runtimeAuthorizationMatchesContext, runtimeAuthorizationState, unavailableRuntimeAuthorization, useProviderRuntimeCommit, useRuntimeAITContextCommit, } from '../permissionState';
 const MIC_ENABLED_SESSION_KEY = 'chatbot-mic-enabled';
 const ChatBotContext = React.createContext(undefined);
 export const useChatBot = () => {
@@ -14,7 +15,7 @@ export const useChatBot = () => {
     }
     return context;
 };
-export const ChatBotProvider = ({ onMessage, onError, onToolUse, presetMessages = [], placeholder = 'Type a message...', className = '', maxRetries = 3, retryDelay = 2000, serviceId, apiKey, apiSecret, serviceToken, getAuthToken, environment = 'production', onVerifyWallet, permissionGroup, children, 
+export const ChatBotProvider = ({ onMessage, onError, onToolUse, presetMessages = [], placeholder = 'Type a message...', className = '', maxRetries = 3, retryDelay = 2000, serviceId, apiKey, apiSecret, serviceToken, getAuthToken, environment = 'production', onVerifyWallet, permissionGroup, roles, children, 
 // AI Model related attributes
 onModelChange, 
 // Storage mode configuration
@@ -33,8 +34,6 @@ isStopRecordingOnSend = false,
 customError, 
 // PII display mode
 piiDisplayMode = 'redacted', voiceThresholds, debugVoiceRms = false, sttGlossary, }) => {
-    // Set API hosts immediately based on environment (before any API calls)
-    setApiHosts(environment);
     const nxtlinqApi = React.useMemo(() => (serviceToken || getAuthToken
         ? createNxtlinqApi({ apiKey, apiSecret, serviceToken, getAuthToken })
         : createNxtlinqApi(apiKey ?? '', apiSecret ?? '')), [apiKey, apiSecret, serviceToken, getAuthToken]);
@@ -86,7 +85,17 @@ piiDisplayMode = 'redacted', voiceThresholds, debugVoiceRms = false, sttGlossary
     const [hitAddress, setHitAddress] = React.useState(null);
     const [ait, setAit] = React.useState(null);
     const [permissions, setPermissions] = React.useState([]);
-    const [availablePermissions, setAvailablePermissions] = React.useState([]);
+    const [maximumPermissions, setMaximumPermissions] = React.useState([]);
+    const [deniedPermissions, setDeniedPermissions] = React.useState([]);
+    const [runtimePermissionsUnavailable, setRuntimePermissionsUnavailable] = React.useState(false);
+    const [runtimeAuthorizationContextKey, setRuntimeAuthorizationContextKey] = React.useState(null);
+    const [servicePermissionCatalog, setServicePermissionCatalog] = React.useState([]);
+    const availablePermissions = React.useMemo(() => maximumPermissions.map((label) => servicePermissionCatalog.find((permission) => permission.label === label) ?? {
+        id: label,
+        label,
+        description: '',
+        groups: [],
+    }), [maximumPermissions, servicePermissionCatalog]);
     const [showPermissionForm, setShowPermissionForm] = React.useState(false);
     const [isPermissionFormOpen, setIsPermissionFormOpen] = React.useState(false);
     const [isAITLoading, setIsAITLoading] = React.useState(false);
@@ -95,6 +104,7 @@ piiDisplayMode = 'redacted', voiceThresholds, debugVoiceRms = false, sttGlossary
     const [walletInfo, setWalletInfo] = React.useState(null);
     const [isWalletLoading, setIsWalletLoading] = React.useState(false);
     const [isAutoConnecting, setIsAutoConnecting] = React.useState(false);
+    const runtimeRolesKey = JSON.stringify(roles ?? null);
     // Persistent data (always use localStorage)
     const [nxtlinqAITServiceAccessToken, setNxtlinqAITServiceAccessToken] = useLocalStorage('nxtlinqAITServiceAccessToken', '');
     const [pseudoId, setPseudoId] = useLocalStorage('pseudoId', uuidv4());
@@ -143,8 +153,12 @@ piiDisplayMode = 'redacted', voiceThresholds, debugVoiceRms = false, sttGlossary
     const hitAddressRef = React.useRef(hitAddress);
     const aitRef = React.useRef(ait);
     const permissionsRef = React.useRef(permissions);
+    const deniedPermissionsRef = React.useRef(deniedPermissions);
     const nxtlinqAITServiceAccessTokenRef = React.useRef(nxtlinqAITServiceAccessToken);
     const signerRef = React.useRef(signer);
+    const runtimeRecomputeCoordinatorRef = React.useRef(new RuntimeAITRecomputeCoordinator());
+    const runtimeMutationQueueRef = React.useRef(new RuntimeAITMutationQueue());
+    useProviderRuntimeCommit(hitAddressRef, hitAddress, environment, setApiHosts);
     // Helper function to combine customUsername with Adilas customUserInfo
     const getFinalCustomUsername = React.useCallback((username) => {
         if (!username)
@@ -463,15 +477,15 @@ piiDisplayMode = 'redacted', voiceThresholds, debugVoiceRms = false, sttGlossary
         }
     }, []);
     // Update refs when state changes
-    React.useEffect(() => {
-        hitAddressRef.current = hitAddress;
-    }, [hitAddress]);
     React.useEffect(() => {
         aitRef.current = ait;
     }, [ait]);
     React.useEffect(() => {
         permissionsRef.current = permissions;
     }, [permissions]);
+    React.useEffect(() => {
+        deniedPermissionsRef.current = deniedPermissions;
+    }, [deniedPermissions]);
     React.useEffect(() => {
         nxtlinqAITServiceAccessTokenRef.current = nxtlinqAITServiceAccessToken;
     }, [nxtlinqAITServiceAccessToken]);
@@ -843,7 +857,7 @@ piiDisplayMode = 'redacted', voiceThresholds, debugVoiceRms = false, sttGlossary
                 console.error('Failed to fetch permissions:', result.error);
                 return undefined;
             }
-            setAvailablePermissions(result.permissions);
+            setServicePermissionCatalog(result.permissions);
             return result.permissions;
         }
         catch (error) {
@@ -851,12 +865,81 @@ piiDisplayMode = 'redacted', voiceThresholds, debugVoiceRms = false, sttGlossary
             return undefined;
         }
     };
-    // Refresh AIT
+    const clearRuntimeAuthorization = React.useCallback(() => {
+        const cleared = unavailableRuntimeAuthorization(deniedPermissionsRef.current);
+        const activeContext = runtimeRecomputeCoordinatorRef.current.getActiveContext();
+        aitRef.current = null;
+        permissionsRef.current = [];
+        setAit(cleared.ait);
+        setPermissions(cleared.effectivePermissions);
+        setMaximumPermissions(cleared.maximumPermissions);
+        setRuntimePermissionsUnavailable(cleared.unavailable);
+        setRuntimeAuthorizationContextKey(activeContext ? runtimeAITContextKey(activeContext) : null);
+    }, []);
+    const applyRuntimeResult = React.useCallback((result, context) => {
+        const next = runtimeAuthorizationState(result, context.controller, context.serviceId);
+        aitRef.current = next.ait;
+        permissionsRef.current = next.effectivePermissions;
+        setAit(next.ait);
+        setPermissions(next.effectivePermissions);
+        setMaximumPermissions(next.maximumPermissions);
+        setDeniedPermissions(next.deniedPermissions);
+        deniedPermissionsRef.current = next.deniedPermissions;
+        setRuntimePermissionsUnavailable(false);
+        setRuntimeAuthorizationContextKey(runtimeAITContextKey(context));
+        return result;
+    }, []);
+    const runtimeContext = React.useMemo(() => hitAddress ? {
+        controller: hitAddress,
+        serviceId,
+        ...(roles !== undefined ? { roles: [...roles] } : {}),
+        ...(permissionGroup !== undefined ? { permissionGroup } : {}),
+    } : null, [hitAddress, permissionGroup, runtimeRolesKey, serviceId]);
+    const invalidateCommittedRuntimeContext = React.useCallback(() => {
+        const activeContext = runtimeRecomputeCoordinatorRef.current.getActiveContext();
+        aitRef.current = null;
+        permissionsRef.current = [];
+        deniedPermissionsRef.current = [];
+        setAit(null);
+        setPermissions([]);
+        setMaximumPermissions([]);
+        setDeniedPermissions([]);
+        setRuntimePermissionsUnavailable(activeContext !== null);
+        setRuntimeAuthorizationContextKey(activeContext ? runtimeAITContextKey(activeContext) : null);
+    }, []);
+    useRuntimeAITContextCommit(runtimeRecomputeCoordinatorRef.current, runtimeContext, invalidateCommittedRuntimeContext);
+    const recomputeRuntimeAIT = React.useCallback(async (context) => {
+        const capturedContext = {
+            controller: context.controller,
+            serviceId: context.serviceId,
+            ...(context.roles !== undefined ? { roles: [...context.roles] } : {}),
+            ...(context.permissionGroup !== undefined ? { permissionGroup: context.permissionGroup } : {}),
+        };
+        return runtimeRecomputeCoordinatorRef.current.run(capturedContext, () => nxtlinqApi.ait.recomputeAIT(capturedContext), applyRuntimeResult, clearRuntimeAuthorization);
+    }, [applyRuntimeResult, clearRuntimeAuthorization, nxtlinqApi]);
+    const queueRuntimeAITRefresh = React.useCallback((context) => runtimeMutationQueueRef.current.run(runtimeAITSubjectKey(context), async () => {
+        runtimeRecomputeCoordinatorRef.current.assertContextActive(context);
+        return recomputeRuntimeAIT(context);
+    }), [recomputeRuntimeAIT]);
+    const convergeRuntimeAITSubject = React.useCallback(async (subjectKey) => {
+        const activeContext = runtimeRecomputeCoordinatorRef.current.getActiveContext();
+        if (!activeContext || runtimeAITSubjectKey(activeContext) !== subjectKey) {
+            return;
+        }
+        await recomputeRuntimeAIT(activeContext);
+    }, [recomputeRuntimeAIT]);
+    const dispatchRuntimeDenyListReplacement = React.useCallback(async (context, nextDeniedPermissions) => dispatchRuntimeAITCompleteReplacement(runtimeRecomputeCoordinatorRef.current, context, () => nxtlinqApi.ait.updatePermissionDenyList({
+        ...context,
+        deniedPermissions: nextDeniedPermissions,
+    }), convergeRuntimeAITSubject, clearRuntimeAuthorization), [clearRuntimeAuthorization, convergeRuntimeAITSubject, nxtlinqApi]);
+    // Refresh the authoritative runtime AIT state.
     const refreshAIT = async (forceUpdatePermissions = false) => {
         if (!hitAddress) {
             setAit(null);
             setPermissions([]);
+            setMaximumPermissions([]);
             setWalletInfo(null);
+            setRuntimePermissionsUnavailable(false);
             setIsAITLoading(false);
             return;
         }
@@ -881,35 +964,20 @@ piiDisplayMode = 'redacted', voiceThresholds, debugVoiceRms = false, sttGlossary
                     console.error('Failed to fetch wallet info:', error);
                 }
             }
-            // Only try to fetch AIT if we have a token
+            // Recompute is the sole mint/reuse path and the only permission authority.
             if (nxtlinqAITServiceAccessToken) {
-                const response = await nxtlinqApi.ait.getAITByServiceIdAndController({
-                    serviceId,
-                    controller: hitAddress,
-                    customUsername: (!requireWalletIDVVerification && customUsername) ? getFinalCustomUsername(customUsername) : undefined
-                }, nxtlinqAITServiceAccessToken);
-                if ('error' in response) {
-                    console.error('Failed to fetch AIT:', response.error);
-                    setAit(null);
-                    setPermissions([]);
-                    return;
-                }
-                setAit(response);
-                if (!isPermissionFormOpen || forceUpdatePermissions) {
-                    const newPermissions = response.metadata?.permissions || [];
-                    setPermissions(newPermissions);
+                if (runtimeContext) {
+                    await queueRuntimeAITRefresh(runtimeContext);
                 }
             }
             else {
-                // No token available, clear AIT data
-                setAit(null);
-                setPermissions([]);
+                clearRuntimeAuthorization();
             }
         }
         catch (error) {
-            console.error('Failed to fetch AIT:', error);
-            setAit(null);
-            setPermissions([]);
+            if (!(error instanceof StaleRuntimeAITResponseError)) {
+                console.error('Failed to recompute AIT:', error);
+            }
         }
         finally {
             setIsAITLoading(false);
@@ -1097,9 +1165,13 @@ piiDisplayMode = 'redacted', voiceThresholds, debugVoiceRms = false, sttGlossary
             }
             const { accessToken } = response;
             setNxtlinqAITServiceAccessToken(accessToken);
-            // Wait for state to update before refreshing AIT
-            await new Promise(resolve => setTimeout(resolve, 100));
-            await refreshAIT();
+            localStorage.setItem('nxtlinqAITServiceAccessToken', JSON.stringify(accessToken));
+            await queueRuntimeAITRefresh({
+                controller: addressToUse,
+                serviceId,
+                ...(roles !== undefined ? { roles: [...roles] } : {}),
+                ...(permissionGroup !== undefined ? { permissionGroup } : {}),
+            });
             if (autoShowSuccessMessage) {
                 showSuccess(walletTextUtils.getWalletText('Successfully signed in with your HIT wallet. You can now use the AI agent.', serviceId));
             }
@@ -2442,86 +2514,6 @@ piiDisplayMode = 'redacted', voiceThresholds, debugVoiceRms = false, sttGlossary
             setInputValue(message.text);
         }
     };
-    // Generate and register AIT
-    const generateAndRegisterAIT = async (newPermissions, isFromAIAgent = false) => {
-        let currentSigner = signer;
-        let currentAddress = hitAddress;
-        // If we have an address but no signer, try to auto-connect wallet
-        if (currentAddress && !currentSigner) {
-            const storedWalletAddress = localStorage.getItem('walletAddress');
-            if (storedWalletAddress === currentAddress) {
-                try {
-                    const autoConnectResult = await connectWallet(false); // Don't show sign-in message yet
-                    if (autoConnectResult) {
-                        // Wait for state to update
-                        await new Promise(resolve => setTimeout(resolve, 1000));
-                        // Get the updated signer and address
-                        currentSigner = signerRef.current || signer;
-                        currentAddress = hitAddressRef.current || hitAddress;
-                    }
-                }
-                catch (error) {
-                    console.error('Auto-connect failed during AIT generation:', error);
-                }
-            }
-        }
-        if (!currentSigner || !currentAddress) {
-            throw new Error('Missing signer or wallet address');
-        }
-        return generateAndRegisterAITWithSigner(newPermissions, isFromAIAgent, currentSigner, currentAddress);
-    };
-    // Generate and register AIT with explicit signer and address
-    const generateAndRegisterAITWithSigner = async (newPermissions, isFromAIAgent = false, explicitSigner, explicitAddress) => {
-        const currentSigner = explicitSigner || signer;
-        const currentAddress = explicitAddress || hitAddress;
-        if (!currentSigner || !currentAddress) {
-            throw new Error('Missing signer or wallet address');
-        }
-        // If AI Agent is creating, must check if user has existing AIT
-        if (isFromAIAgent && !aitRef.current) {
-            throw new Error('You must have an existing AIT before AI Agent can create new AITs');
-        }
-        // aitId is assigned by AIT-Service (UUIDv7) and returned in the response. It must not be
-        // minted here: the client cannot guarantee uniqueness, and this value feeds parentAITId, which
-        // is part of the on-chain commitment -- a locally invented id would anchor a parent that does
-        // not exist.
-        const metadata = {
-            permissions: newPermissions || permissions,
-            issuedBy: currentAddress,
-        };
-        const metadataStr = stringify(metadata);
-        // ethers v6: utils.keccak256 -> keccak256, utils.toUtf8Bytes -> toUtf8Bytes
-        const metadataHash = ethers.keccak256(ethers.toUtf8Bytes(metadataStr));
-        // AIT-Service no longer publishes metadata to IPFS: the registry is hash-only, integrity comes
-        // from the on-chain commitment, and /api/metadata has been removed. `permissions` now travels
-        // in the request body instead of being recovered from a CID, so nothing is uploaded here.
-        const createAITParams = {
-            controller: currentAddress,
-            serviceId,
-            permissions: metadata.permissions,
-            metadataHash,
-            isFromAIAgent: isFromAIAgent,
-            parentAITId: isFromAIAgent ? aitRef.current?.aitId : undefined,
-        };
-        const createAITResponse = await nxtlinqApi.ait.createAIT(createAITParams, nxtlinqAITServiceAccessToken || '');
-        if ('error' in createAITResponse) {
-            throw new Error(`Failed to create AIT: ${createAITResponse.error}`);
-        }
-        const aitId = createAITResponse.aitId;
-        if (!aitId) {
-            // Surfaced rather than substituted: this id becomes parentAITId on agent-created AITs, and
-            // parentAITId is committed on chain. Guessing one would anchor a dangling parent link.
-            throw new Error('AIT-Service did not return an aitId; refusing to invent one.');
-        }
-        const aitInfo = {
-            aitId,
-            controller: currentAddress,
-            metadata,
-            metadataHash,
-        };
-        setAit(aitInfo);
-        setPermissions(newPermissions || permissions);
-    };
     // Auto enable AIT permission
     const enableAIT = async (toolName) => {
         if (isAITEnabling)
@@ -2583,35 +2575,41 @@ piiDisplayMode = 'redacted', voiceThresholds, debugVoiceRms = false, sttGlossary
             }
         }
         try {
-            // Get available permissions to find the tool
-            const availablePermissionLabels = availablePermissions.map(p => p.label);
-            if (!availablePermissionLabels.includes(toolName)) {
+            const context = {
+                controller: currentHitAddress,
+                serviceId,
+                ...(roles !== undefined ? { roles: [...roles] } : {}),
+                ...(permissionGroup !== undefined ? { permissionGroup } : {}),
+            };
+            const enabled = await runtimeMutationQueueRef.current.run(runtimeAITSubjectKey(context), async () => {
+                runtimeRecomputeCoordinatorRef.current.assertContextActive(context);
+                const current = await recomputeRuntimeAIT(context);
+                if (!current.maximumPermissions.includes(toolName)) {
+                    return false;
+                }
+                const nextDeniedPermissions = removeOneDeniedPermission(current.deniedPermissions, toolName);
+                runtimeRecomputeCoordinatorRef.current.assertContextActive(context);
+                await dispatchRuntimeDenyListReplacement(context, nextDeniedPermissions);
+                return true;
+            });
+            if (!enabled) {
                 showError(`Tool ${toolName} is not available for your current identity provider`);
                 setIsAITEnabling(false);
                 return false;
             }
-            // Get current permissions from AIT metadata instead of React state
-            // This ensures we don't lose existing permissions when enabling new ones
-            const currentAITPermissions = aitRef.current?.metadata?.permissions || permissions;
-            const newPermissions = [...currentAITPermissions];
-            if (!newPermissions.includes(toolName)) {
-                newPermissions.push(toolName);
-            }
-            // Filter out deleted permissions before saving
-            const validPermissions = newPermissions.filter(permission => availablePermissionLabels.includes(permission));
-            // Generate and register AIT with new permissions
-            // For auto-enable, we should create a regular AIT (not AI Agent AIT) if user doesn't have existing AIT
-            const shouldCreateAsAIAgent = !!aitRef.current; // Only create as AI Agent if user already has an AIT
-            await generateAndRegisterAITWithSigner(validPermissions, shouldCreateAsAIAgent, currentSigner, currentHitAddress);
             showSuccess('AIT permission enabled successfully! You can now use the AI agent.');
-            await refreshAIT(true);
             setIsAITEnabling(false);
             return true;
         }
         catch (error) {
-            console.error('Failed to auto-enable AIT:', error);
+            if (!(error instanceof StaleRuntimeAITResponseError)) {
+                console.error('Failed to auto-enable AIT:', error);
+            }
             setIsAITEnabling(false);
-            if (error instanceof Error) {
+            if (error instanceof StaleRuntimeAITResponseError) {
+                return false;
+            }
+            else if (error instanceof Error) {
                 showError(error.message);
             }
             else {
@@ -2624,20 +2622,36 @@ piiDisplayMode = 'redacted', voiceThresholds, debugVoiceRms = false, sttGlossary
     const savePermissions = async (newPermissions) => {
         setIsDisabled(true);
         try {
-            // Filter out deleted permissions before saving
-            const permissionsToSave = newPermissions || permissions;
-            const availablePermissionLabels = availablePermissions.map(p => p.label);
-            const validPermissions = permissionsToSave.filter(permission => availablePermissionLabels.includes(permission));
-            await generateAndRegisterAIT(validPermissions, false);
+            if (!hitAddress) {
+                throw new Error('Please connect your wallet first');
+            }
+            const context = {
+                controller: hitAddress,
+                serviceId,
+                ...(roles !== undefined ? { roles: [...roles] } : {}),
+                ...(permissionGroup !== undefined ? { permissionGroup } : {}),
+            };
+            const checkedPermissions = [...(newPermissions ?? permissions)];
+            await runtimeMutationQueueRef.current.run(runtimeAITSubjectKey(context), async () => {
+                runtimeRecomputeCoordinatorRef.current.assertContextActive(context);
+                const fresh = await recomputeRuntimeAIT(context);
+                const nextDeniedPermissions = replaceCurrentMaximumDenyList(fresh.deniedPermissions, fresh.maximumPermissions, checkedPermissions);
+                runtimeRecomputeCoordinatorRef.current.assertContextActive(context);
+                await dispatchRuntimeDenyListReplacement(context, nextDeniedPermissions);
+            });
             showSuccess('AIT permissions saved successfully! You can now use the AI agent with your configured permissions.');
             setShowPermissionForm(false);
             setIsPermissionFormOpen(false);
-            await refreshAIT(true);
         }
         catch (error) {
-            console.error('Failed to generate AIT:', error);
+            if (!(error instanceof StaleRuntimeAITResponseError)) {
+                console.error('Failed to update AIT deny-list:', error);
+            }
             setIsDisabled(false);
-            if (error instanceof Error) {
+            if (error instanceof StaleRuntimeAITResponseError) {
+                return;
+            }
+            else if (error instanceof Error) {
                 showError(error.message);
             }
             else {
@@ -2683,14 +2697,12 @@ piiDisplayMode = 'redacted', voiceThresholds, debugVoiceRms = false, sttGlossary
                                     const walletResponse = await nxtlinqApi.wallet.getWallet({ address }, token);
                                     if (!('error' in walletResponse)) {
                                         setWalletInfo(walletResponse);
-                                        const aitResponse = await nxtlinqApi.ait.getAITByServiceIdAndController({
-                                            serviceId,
+                                        await queueRuntimeAITRefresh({
                                             controller: address,
-                                            customUsername: (!requireWalletIDVVerification && customUsername) ? getFinalCustomUsername(customUsername) : undefined
-                                        }, token);
-                                        if (!('error' in aitResponse)) {
-                                            setAit(aitResponse);
-                                        }
+                                            serviceId,
+                                            ...(roles !== undefined ? { roles: [...roles] } : {}),
+                                            ...(permissionGroup !== undefined ? { permissionGroup } : {}),
+                                        });
                                     }
                                 }
                                 finally {
@@ -2723,14 +2735,12 @@ piiDisplayMode = 'redacted', voiceThresholds, debugVoiceRms = false, sttGlossary
                             const walletResponse = await nxtlinqApi.wallet.getWallet({ address }, token);
                             if (!('error' in walletResponse)) {
                                 setWalletInfo(walletResponse);
-                                const aitResponse = await nxtlinqApi.ait.getAITByServiceIdAndController({
-                                    serviceId,
+                                await queueRuntimeAITRefresh({
                                     controller: address,
-                                    customUsername: (!requireWalletIDVVerification && customUsername) ? getFinalCustomUsername(customUsername) : undefined
-                                }, token);
-                                if (!('error' in aitResponse)) {
-                                    setAit(aitResponse);
-                                }
+                                    serviceId,
+                                    ...(roles !== undefined ? { roles: [...roles] } : {}),
+                                    ...(permissionGroup !== undefined ? { permissionGroup } : {}),
+                                });
                             }
                         }
                         finally {
@@ -2839,7 +2849,7 @@ piiDisplayMode = 'redacted', voiceThresholds, debugVoiceRms = false, sttGlossary
         if (hitAddress && nxtlinqAITServiceAccessToken) {
             refreshAIT();
         }
-    }, [hitAddress, nxtlinqAITServiceAccessToken]);
+    }, [hitAddress, nxtlinqAITServiceAccessToken, permissionGroup, runtimeRolesKey, serviceId]);
     // Set loading state when permission form opens
     React.useEffect(() => {
         if (isPermissionFormOpen && hitAddress) {
@@ -2918,6 +2928,7 @@ piiDisplayMode = 'redacted', voiceThresholds, debugVoiceRms = false, sttGlossary
         };
         updateExternalId();
     }, [hitAddress, nxtlinqApi, authFields, pseudoId]);
+    const runtimeAuthorizationMatchesRenderedContext = runtimeAuthorizationMatchesContext(runtimeAuthorizationContextKey, runtimeContext);
     const contextValue = {
         // State
         messages,
@@ -2925,9 +2936,16 @@ piiDisplayMode = 'redacted', voiceThresholds, debugVoiceRms = false, sttGlossary
         isLoading,
         isOpen,
         hitAddress,
-        ait,
-        permissions,
-        availablePermissions,
+        ait: runtimeAuthorizationMatchesRenderedContext ? ait : null,
+        permissions: runtimeAuthorizationMatchesRenderedContext ? permissions : [],
+        maximumPermissions: runtimeAuthorizationMatchesRenderedContext ? maximumPermissions : [],
+        deniedPermissions: runtimeAuthorizationMatchesRenderedContext ? deniedPermissions : [],
+        runtimePermissionsUnavailable: runtimeAuthorizationMatchesRenderedContext
+            ? runtimePermissionsUnavailable
+            : runtimeContext !== null,
+        availablePermissions: runtimeAuthorizationMatchesRenderedContext
+            ? availablePermissions
+            : [],
         showPermissionForm,
         isPermissionFormOpen,
         isAITLoading,
@@ -2963,7 +2981,6 @@ piiDisplayMode = 'redacted', voiceThresholds, debugVoiceRms = false, sttGlossary
         setIsOpen,
         setShowPermissionForm,
         setIsPermissionFormOpen,
-        setPermissions,
         setIsDisabled,
         setIsWalletLoading,
         setNotification,
@@ -3011,6 +3028,7 @@ piiDisplayMode = 'redacted', voiceThresholds, debugVoiceRms = false, sttGlossary
         onVerifyWallet: (method) => handleVerifyWalletClick(method),
         serviceId,
         permissionGroup,
+        roles,
         // Props
         props: {
             onMessage,
@@ -3028,6 +3046,7 @@ piiDisplayMode = 'redacted', voiceThresholds, debugVoiceRms = false, sttGlossary
             getAuthToken,
             onVerifyWallet,
             permissionGroup,
+            roles,
             onModelChange,
             storageMode,
             requireWalletIDVVerification,

package/dist/index.d.ts

@@ -1,7 +1,7 @@
 export { ChatBot } from './ChatBot';
 export { ChatBotProvider, useChatBot } from './context/ChatBotContext';
 export { ChatBotUI, MessageInput, MessageList, ModelSelector, NotificationModal, PermissionForm, PresetMessages, BerifyMeModal, } from './ui/index';
-export type { AIModel, AITMetadata, ChatBotContextType, ChatBotProps, NovaError, NovaResponse, ToolCall, ToolUse, PresetMessage, } from './types/ChatBotTypes';
+export type { AIModel, ChatBotContextType, ChatBotProps, NovaError, NovaResponse, ToolCall, ToolUse, PresetMessage, } from './types/ChatBotTypes';
 export type { AgentEnvironment, AgentConfig, Attachment, AgentResponse, Message, SendMessageOptions, NxtlinqAgentSnapshot, VoiceSession, VoiceStatus, } from '@bytexbyte/nxtlinq-ai-agent-core-development';
 export { NxtlinqAgent, setApiHosts, VoiceNotSupportedError, STORAGE_KEYS, } from '@bytexbyte/nxtlinq-ai-agent-core-development';
 export { createNxtlinqApi, useLocalStorage, useSessionStorage, useSpeechToTextFromMic, useVoiceMode, metakeepClient, getEthers, sleep, walletTextUtils, } from '@bytexbyte/nxtlinq-ai-agent-web-development';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAEvE,OAAO,EACL,SAAS,EACT,YAAY,EACZ,WAAW,EACX,aAAa,EACb,iBAAiB,EACjB,cAAc,EACd,cAAc,EACd,aAAa,GACd,MAAM,YAAY,CAAC;AAEpB,YAAY,EACV,OAAO,EACP,WAAW,EACX,kBAAkB,EAClB,YAAY,EACZ,SAAS,EACT,YAAY,EACZ,QAAQ,EACR,OAAO,EACP,aAAa,GACd,MAAM,sBAAsB,CAAC;AAE9B,YAAY,EACV,gBAAgB,EAChB,WAAW,EACX,UAAU,EACV,aAAa,EACb,OAAO,EACP,kBAAkB,EAClB,oBAAoB,EACpB,YAAY,EACZ,WAAW,GACZ,MAAM,8CAA8C,CAAC;AAEtD,OAAO,EACL,YAAY,EACZ,WAAW,EACX,sBAAsB,EACtB,YAAY,GACb,MAAM,8CAA8C,CAAC;AAEtD,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,iBAAiB,EACjB,sBAAsB,EACtB,YAAY,EACZ,cAAc,EACd,SAAS,EACT,KAAK,EACL,eAAe,GAChB,MAAM,6CAA6C,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAEvE,OAAO,EACL,SAAS,EACT,YAAY,EACZ,WAAW,EACX,aAAa,EACb,iBAAiB,EACjB,cAAc,EACd,cAAc,EACd,aAAa,GACd,MAAM,YAAY,CAAC;AAEpB,YAAY,EACV,OAAO,EACP,kBAAkB,EAClB,YAAY,EACZ,SAAS,EACT,YAAY,EACZ,QAAQ,EACR,OAAO,EACP,aAAa,GACd,MAAM,sBAAsB,CAAC;AAE9B,YAAY,EACV,gBAAgB,EAChB,WAAW,EACX,UAAU,EACV,aAAa,EACb,OAAO,EACP,kBAAkB,EAClB,oBAAoB,EACpB,YAAY,EACZ,WAAW,GACZ,MAAM,8CAA8C,CAAC;AAEtD,OAAO,EACL,YAAY,EACZ,WAAW,EACX,sBAAsB,EACtB,YAAY,GACb,MAAM,8CAA8C,CAAC;AAEtD,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,iBAAiB,EACjB,sBAAsB,EACtB,YAAY,EACZ,cAAc,EACd,SAAS,EACT,KAAK,EACL,eAAe,GAChB,MAAM,6CAA6C,CAAC"}

package/dist/permissionState.d.ts

@@ -0,0 +1,53 @@
+import type { AIT, RuntimeAITResult } from '@bytexbyte/nxtlinq-ai-agent-core-development';
+import * as React from 'react';
+export declare function commitProviderRuntime<T, E>(identityRef: React.MutableRefObject<T>, identity: T, environment: E, publishEnvironment: (environment: E) => void): void;
+export declare function useProviderRuntimeCommit<T, E>(identityRef: React.MutableRefObject<T>, identity: T, environment: E, publishEnvironment: (environment: E) => void): void;
+export declare function replaceCurrentMaximumDenyList(persistedDeniedPermissions: readonly string[], maximumPermissions: readonly string[], checkedPermissions: readonly string[]): string[];
+export declare function removeOneDeniedPermission(persistedDeniedPermissions: readonly string[], permission: string): string[];
+export type RuntimeAITContext = {
+    controller: string;
+    serviceId: string;
+    roles?: string[];
+    permissionGroup?: string;
+};
+export declare function runtimeAITContextKey(context: RuntimeAITContext): string;
+export declare function runtimeAITSubjectKey(context: RuntimeAITContext): string;
+export declare function runtimeAuthorizationMatchesContext(authorizationContextKey: string | null, renderedContext: RuntimeAITContext | null): boolean;
+export declare class StaleRuntimeAITResponseError extends Error {
+    constructor();
+}
+/**
+ * Owns the authoritative recompute lifecycle. Only the newest request for the
+ * active captured context may write state; its failures clear state first.
+ */
+export declare class RuntimeAITRecomputeCoordinator {
+    private activeContextKey;
+    private activeContext;
+    private generation;
+    commitContext(context: RuntimeAITContext | null, invalidate: () => void): boolean;
+    getActiveContext(): RuntimeAITContext | null;
+    isContextActive(context: RuntimeAITContext): boolean;
+    assertContextActive(context: RuntimeAITContext): void;
+    run<T>(context: RuntimeAITContext, request: () => Promise<T>, apply: (result: T, context: RuntimeAITContext) => void, clear: () => void): Promise<T>;
+}
+export declare function useRuntimeAITContextCommit(coordinator: RuntimeAITRecomputeCoordinator, context: RuntimeAITContext | null, invalidate: () => void): void;
+export declare function dispatchRuntimeAITCompleteReplacement(coordinator: RuntimeAITRecomputeCoordinator, context: RuntimeAITContext, update: () => Promise<unknown>, converge: (subjectKey: string) => Promise<void>, clear: () => void): Promise<void>;
+/** Serializes reads, complete replacements, and convergence for one persistence subject. */
+export declare class RuntimeAITMutationQueue {
+    private readonly tails;
+    run<T>(subjectKey: string, mutation: () => Promise<T>): Promise<T>;
+}
+export type RuntimeAuthorizationState = {
+    ait: AIT | null;
+    maximumPermissions: string[];
+    effectivePermissions: string[];
+    deniedPermissions: string[];
+    selectedRuleId: string | null;
+    selectedRuleType: RuntimeAITResult['selectedRuleType'];
+    expiresAt: string | null;
+    grantActive: boolean;
+    unavailable: boolean;
+};
+export declare function runtimeAuthorizationState(result: RuntimeAITResult, controller: string, serviceId: string): RuntimeAuthorizationState;
+export declare function unavailableRuntimeAuthorization(persistedDeniedPermissions: readonly string[]): RuntimeAuthorizationState;
+//# sourceMappingURL=permissionState.d.ts.map

package/dist/permissionState.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissionState.d.ts","sourceRoot":"","sources":["../src/permissionState.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,GAAG,EAAE,gBAAgB,EAAE,MAAM,8CAA8C,CAAC;AAC1F,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAM/B,wBAAgB,qBAAqB,CAAC,CAAC,EAAE,CAAC,EACxC,WAAW,EAAE,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC,EACtC,QAAQ,EAAE,CAAC,EACX,WAAW,EAAE,CAAC,EACd,kBAAkB,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,IAAI,GAC3C,IAAI,CAGN;AAED,wBAAgB,wBAAwB,CAAC,CAAC,EAAE,CAAC,EAC3C,WAAW,EAAE,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC,EACtC,QAAQ,EAAE,CAAC,EACX,WAAW,EAAE,CAAC,EACd,kBAAkB,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,IAAI,GAC3C,IAAI,CASN;AAcD,wBAAgB,6BAA6B,CAC3C,0BAA0B,EAAE,SAAS,MAAM,EAAE,EAC7C,kBAAkB,EAAE,SAAS,MAAM,EAAE,EACrC,kBAAkB,EAAE,SAAS,MAAM,EAAE,GACpC,MAAM,EAAE,CAgBV;AAED,wBAAgB,yBAAyB,CACvC,0BAA0B,EAAE,SAAS,MAAM,EAAE,EAC7C,UAAU,EAAE,MAAM,GACjB,MAAM,EAAE,CAEV;AAED,MAAM,MAAM,iBAAiB,GAAG;IAC9B,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B,CAAC;AAEF,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,iBAAiB,GAAG,MAAM,CAOvE;AAED,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,iBAAiB,GAAG,MAAM,CAEvE;AAED,wBAAgB,kCAAkC,CAChD,uBAAuB,EAAE,MAAM,GAAG,IAAI,EACtC,eAAe,EAAE,iBAAiB,GAAG,IAAI,GACxC,OAAO,CAIT;AAED,qBAAa,4BAA6B,SAAQ,KAAK;;CAKtD;AAED;;;GAGG;AACH,qBAAa,8BAA8B;IACzC,OAAO,CAAC,gBAAgB,CAAuB;IAC/C,OAAO,CAAC,aAAa,CAAkC;IACvD,OAAO,CAAC,UAAU,CAAK;IAEvB,aAAa,CACX,OAAO,EAAE,iBAAiB,GAAG,IAAI,EACjC,UAAU,EAAE,MAAM,IAAI,GACrB,OAAO;IAmBV,gBAAgB,IAAI,iBAAiB,GAAG,IAAI;IAa5C,eAAe,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO;IAIpD,mBAAmB,CAAC,OAAO,EAAE,iBAAiB,GAAG,IAAI;IAM/C,GAAG,CAAC,CAAC,EACT,OAAO,EAAE,iBAAiB,EAC1B,OAAO,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,EACzB,KAAK,EAAE,CAAC,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,iBAAiB,KAAK,IAAI,EACtD,KAAK,EAAE,MAAM,IAAI,GAChB,OAAO,CAAC,CAAC,CAAC;CAuBd;AAED,wBAAgB,0BAA0B,CACxC,WAAW,EAAE,8BAA8B,EAC3C,OAAO,EAAE,iBAAiB,GAAG,IAAI,EACjC,UAAU,EAAE,MAAM,IAAI,GACrB,IAAI,CAKN;AAED,wBAAsB,qCAAqC,CACzD,WAAW,EAAE,8BAA8B,EAC3C,OAAO,EAAE,iBAAiB,EAC1B,MAAM,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,EAC9B,QAAQ,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,EAC/C,KAAK,EAAE,MAAM,IAAI,GAChB,OAAO,CAAC,IAAI,CAAC,CA6Bf;AAED,4FAA4F;AAC5F,qBAAa,uBAAuB;IAClC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAoC;IAEpD,GAAG,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;CAazE;AAED,MAAM,MAAM,yBAAyB,GAAG;IACtC,GAAG,EAAE,GAAG,GAAG,IAAI,CAAC;IAChB,kBAAkB,EAAE,MAAM,EAAE,CAAC;IAC7B,oBAAoB,EAAE,MAAM,EAAE,CAAC;IAC/B,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,gBAAgB,EAAE,gBAAgB,CAAC,kBAAkB,CAAC,CAAC;IACvD,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,WAAW,EAAE,OAAO,CAAC;IACrB,WAAW,EAAE,OAAO,CAAC;CACtB,CAAC;AAEF,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,gBAAgB,EACxB,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,GAChB,yBAAyB,CAmB3B;AAED,wBAAgB,+BAA+B,CAC7C,0BAA0B,EAAE,SAAS,MAAM,EAAE,GAC5C,yBAAyB,CAY3B"}