@bytexbyte/nxtlinq-ai-agent-ui-react-development 0.3.4 → 2.0.0

package/src/context/ChatBotContext.tsx

@@ -23,6 +23,7 @@ import type {
   Attachment,
   ClientTtsVoiceSettings,
   Message,
+  RuntimeAITResult,
   ServicePermission,
 } from '@bytexbyte/nxtlinq-ai-agent-core-development';
 import {
@@ -31,6 +32,22 @@ import {
   ChatBotProps,
   PresetMessage
 } from '../types/ChatBotTypes';
+import {
+  dispatchRuntimeAITCompleteReplacement,
+  removeOneDeniedPermission,
+  replaceCurrentMaximumDenyList,
+  RuntimeAITMutationQueue,
+  RuntimeAITRecomputeCoordinator,
+  StaleRuntimeAITResponseError,
+  runtimeAITContextKey,
+  runtimeAITSubjectKey,
+  runtimeAuthorizationMatchesContext,
+  runtimeAuthorizationState,
+  unavailableRuntimeAuthorization,
+  useProviderRuntimeCommit,
+  useRuntimeAITContextCommit,
+  type RuntimeAITContext,
+} from '../permissionState';
 
 const MIC_ENABLED_SESSION_KEY = 'chatbot-mic-enabled';
 
@@ -61,6 +78,7 @@ export const ChatBotProvider: React.FC<ChatBotProps> = ({
   environment = 'production',
   onVerifyWallet,
   permissionGroup,
+  roles,
   children,
   // AI Model related attributes
   onModelChange,
@@ -85,9 +103,6 @@ export const ChatBotProvider: React.FC<ChatBotProps> = ({
   debugVoiceRms = false,
   sttGlossary,
 }) => {
-  // Set API hosts immediately based on environment (before any API calls)
-  setApiHosts(environment);
-
   const nxtlinqApi = React.useMemo(
     () => (serviceToken || getAuthToken
       ? createNxtlinqApi({ apiKey, apiSecret, serviceToken, getAuthToken })
@@ -147,7 +162,22 @@ export const ChatBotProvider: React.FC<ChatBotProps> = ({
   const [hitAddress, setHitAddress] = React.useState<string | null>(null);
   const [ait, setAit] = React.useState<AIT | null>(null);
   const [permissions, setPermissions] = React.useState<string[]>([]);
-  const [availablePermissions, setAvailablePermissions] = React.useState<ServicePermission[]>([]);
+  const [maximumPermissions, setMaximumPermissions] = React.useState<string[]>([]);
+  const [deniedPermissions, setDeniedPermissions] = React.useState<string[]>([]);
+  const [runtimePermissionsUnavailable, setRuntimePermissionsUnavailable] = React.useState(false);
+  const [runtimeAuthorizationContextKey, setRuntimeAuthorizationContextKey] =
+    React.useState<string | null>(null);
+  const [servicePermissionCatalog, setServicePermissionCatalog] = React.useState<ServicePermission[]>([]);
+  const availablePermissions = React.useMemo(
+    () => maximumPermissions.map((label) =>
+      servicePermissionCatalog.find((permission) => permission.label === label) ?? {
+        id: label,
+        label,
+        description: '',
+        groups: [],
+      }),
+    [maximumPermissions, servicePermissionCatalog],
+  );
   const [showPermissionForm, setShowPermissionForm] = React.useState(false);
   const [isPermissionFormOpen, setIsPermissionFormOpen] = React.useState(false);
   const [isAITLoading, setIsAITLoading] = React.useState(false);
@@ -156,6 +186,7 @@ export const ChatBotProvider: React.FC<ChatBotProps> = ({
   const [walletInfo, setWalletInfo] = React.useState<any>(null);
   const [isWalletLoading, setIsWalletLoading] = React.useState(false);
   const [isAutoConnecting, setIsAutoConnecting] = React.useState(false);
+  const runtimeRolesKey = JSON.stringify(roles ?? null);
 
   // Persistent data (always use localStorage)
   const [nxtlinqAITServiceAccessToken, setNxtlinqAITServiceAccessToken] = useLocalStorage<string>('nxtlinqAITServiceAccessToken', '');
@@ -212,8 +243,17 @@ export const ChatBotProvider: React.FC<ChatBotProps> = ({
   const hitAddressRef = React.useRef(hitAddress);
   const aitRef = React.useRef(ait);
   const permissionsRef = React.useRef(permissions);
+  const deniedPermissionsRef = React.useRef(deniedPermissions);
   const nxtlinqAITServiceAccessTokenRef = React.useRef(nxtlinqAITServiceAccessToken);
   const signerRef = React.useRef(signer);
+  const runtimeRecomputeCoordinatorRef = React.useRef(new RuntimeAITRecomputeCoordinator());
+  const runtimeMutationQueueRef = React.useRef(new RuntimeAITMutationQueue());
+  useProviderRuntimeCommit(
+    hitAddressRef,
+    hitAddress,
+    environment,
+    setApiHosts,
+  );
 
   // Helper function to combine customUsername with Adilas customUserInfo
   const getFinalCustomUsername = React.useCallback((username: string | undefined): string | undefined => {
@@ -546,10 +586,6 @@ export const ChatBotProvider: React.FC<ChatBotProps> = ({
   }, []);
 
   // Update refs when state changes
-  React.useEffect(() => {
-    hitAddressRef.current = hitAddress;
-  }, [hitAddress]);
-
   React.useEffect(() => {
     aitRef.current = ait;
   }, [ait]);
@@ -558,6 +594,10 @@ export const ChatBotProvider: React.FC<ChatBotProps> = ({
     permissionsRef.current = permissions;
   }, [permissions]);
 
+  React.useEffect(() => {
+    deniedPermissionsRef.current = deniedPermissions;
+  }, [deniedPermissions]);
+
   React.useEffect(() => {
     nxtlinqAITServiceAccessTokenRef.current = nxtlinqAITServiceAccessToken;
   }, [nxtlinqAITServiceAccessToken]);
@@ -979,7 +1019,7 @@ export const ChatBotProvider: React.FC<ChatBotProps> = ({
         console.error('Failed to fetch permissions:', result.error);
         return undefined;
       }
-      setAvailablePermissions(result.permissions);
+      setServicePermissionCatalog(result.permissions);
       return result.permissions;
     } catch (error) {
       console.error('Error fetching permissions:', error);
@@ -987,12 +1027,116 @@ export const ChatBotProvider: React.FC<ChatBotProps> = ({
     }
   };
 
-  // Refresh AIT
+  const clearRuntimeAuthorization = React.useCallback(() => {
+    const cleared = unavailableRuntimeAuthorization(deniedPermissionsRef.current);
+    const activeContext = runtimeRecomputeCoordinatorRef.current.getActiveContext();
+    aitRef.current = null;
+    permissionsRef.current = [];
+    setAit(cleared.ait);
+    setPermissions(cleared.effectivePermissions);
+    setMaximumPermissions(cleared.maximumPermissions);
+    setRuntimePermissionsUnavailable(cleared.unavailable);
+    setRuntimeAuthorizationContextKey(
+      activeContext ? runtimeAITContextKey(activeContext) : null,
+    );
+  }, []);
+
+  const applyRuntimeResult = React.useCallback((result: RuntimeAITResult, context: RuntimeAITContext) => {
+    const next = runtimeAuthorizationState(result, context.controller, context.serviceId);
+    aitRef.current = next.ait;
+    permissionsRef.current = next.effectivePermissions;
+    setAit(next.ait);
+    setPermissions(next.effectivePermissions);
+    setMaximumPermissions(next.maximumPermissions);
+    setDeniedPermissions(next.deniedPermissions);
+    deniedPermissionsRef.current = next.deniedPermissions;
+    setRuntimePermissionsUnavailable(false);
+    setRuntimeAuthorizationContextKey(runtimeAITContextKey(context));
+    return result;
+  }, []);
+
+  const runtimeContext = React.useMemo<RuntimeAITContext | null>(() => hitAddress ? {
+    controller: hitAddress,
+    serviceId,
+    ...(roles !== undefined ? { roles: [...roles] } : {}),
+    ...(permissionGroup !== undefined ? { permissionGroup } : {}),
+  } : null, [hitAddress, permissionGroup, runtimeRolesKey, serviceId]);
+  const invalidateCommittedRuntimeContext = React.useCallback(() => {
+    const activeContext = runtimeRecomputeCoordinatorRef.current.getActiveContext();
+    aitRef.current = null;
+    permissionsRef.current = [];
+    deniedPermissionsRef.current = [];
+    setAit(null);
+    setPermissions([]);
+    setMaximumPermissions([]);
+    setDeniedPermissions([]);
+    setRuntimePermissionsUnavailable(activeContext !== null);
+    setRuntimeAuthorizationContextKey(
+      activeContext ? runtimeAITContextKey(activeContext) : null,
+    );
+  }, []);
+  useRuntimeAITContextCommit(
+    runtimeRecomputeCoordinatorRef.current,
+    runtimeContext,
+    invalidateCommittedRuntimeContext,
+  );
+
+  const recomputeRuntimeAIT = React.useCallback(async (context: RuntimeAITContext) => {
+    const capturedContext: RuntimeAITContext = {
+      controller: context.controller,
+      serviceId: context.serviceId,
+      ...(context.roles !== undefined ? { roles: [...context.roles] } : {}),
+      ...(context.permissionGroup !== undefined ? { permissionGroup: context.permissionGroup } : {}),
+    };
+    return runtimeRecomputeCoordinatorRef.current.run(
+      capturedContext,
+      () => nxtlinqApi.ait.recomputeAIT(capturedContext),
+      applyRuntimeResult,
+      clearRuntimeAuthorization,
+    );
+  }, [applyRuntimeResult, clearRuntimeAuthorization, nxtlinqApi]);
+
+  const queueRuntimeAITRefresh = React.useCallback(
+    (context: RuntimeAITContext) => runtimeMutationQueueRef.current.run(
+      runtimeAITSubjectKey(context),
+      async () => {
+        runtimeRecomputeCoordinatorRef.current.assertContextActive(context);
+        return recomputeRuntimeAIT(context);
+      },
+    ),
+    [recomputeRuntimeAIT],
+  );
+
+  const convergeRuntimeAITSubject = React.useCallback(async (subjectKey: string) => {
+    const activeContext = runtimeRecomputeCoordinatorRef.current.getActiveContext();
+    if (!activeContext || runtimeAITSubjectKey(activeContext) !== subjectKey) {
+      return;
+    }
+    await recomputeRuntimeAIT(activeContext);
+  }, [recomputeRuntimeAIT]);
+
+  const dispatchRuntimeDenyListReplacement = React.useCallback(async (
+    context: RuntimeAITContext,
+    nextDeniedPermissions: string[],
+  ) => dispatchRuntimeAITCompleteReplacement(
+    runtimeRecomputeCoordinatorRef.current,
+    context,
+    () => nxtlinqApi.ait.updatePermissionDenyList({
+      ...context,
+      deniedPermissions: nextDeniedPermissions,
+    }),
+    convergeRuntimeAITSubject,
+    clearRuntimeAuthorization,
+  ), [clearRuntimeAuthorization, convergeRuntimeAITSubject, nxtlinqApi]);
+
+  // Refresh the authoritative runtime AIT state.
   const refreshAIT = async (forceUpdatePermissions = false) => {
     if (!hitAddress) {
       setAit(null);
       setPermissions([]);
+      setMaximumPermissions([]);
       setWalletInfo(null);
+      setRuntimePermissionsUnavailable(false);
       setIsAITLoading(false);
       return;
     }
@@ -1017,35 +1161,18 @@ export const ChatBotProvider: React.FC<ChatBotProps> = ({
         }
       }
 
-      // Only try to fetch AIT if we have a token
+      // Recompute is the sole mint/reuse path and the only permission authority.
       if (nxtlinqAITServiceAccessToken) {
-        const response = await nxtlinqApi.ait.getAITByServiceIdAndController({
-          serviceId,
-          controller: hitAddress,
-          customUsername: (!requireWalletIDVVerification && customUsername) ? getFinalCustomUsername(customUsername) : undefined
-        }, nxtlinqAITServiceAccessToken);
-
-        if ('error' in response) {
-          console.error('Failed to fetch AIT:', response.error);
-          setAit(null);
-          setPermissions([]);
-          return;
-        }
-
-        setAit(response);
-        if (!isPermissionFormOpen || forceUpdatePermissions) {
-          const newPermissions = response.metadata?.permissions || [];
-          setPermissions(newPermissions);
+        if (runtimeContext) {
+          await queueRuntimeAITRefresh(runtimeContext);
         }
       } else {
-        // No token available, clear AIT data
-        setAit(null);
-        setPermissions([]);
+        clearRuntimeAuthorization();
       }
     } catch (error) {
-      console.error('Failed to fetch AIT:', error);
-      setAit(null);
-      setPermissions([]);
+      if (!(error instanceof StaleRuntimeAITResponseError)) {
+        console.error('Failed to recompute AIT:', error);
+      }
     } finally {
       setIsAITLoading(false);
     }
@@ -1250,10 +1377,13 @@ export const ChatBotProvider: React.FC<ChatBotProps> = ({
       }
       const { accessToken } = response;
       setNxtlinqAITServiceAccessToken(accessToken);
-
-      // Wait for state to update before refreshing AIT
-      await new Promise(resolve => setTimeout(resolve, 100));
-      await refreshAIT();
+      localStorage.setItem('nxtlinqAITServiceAccessToken', JSON.stringify(accessToken));
+      await queueRuntimeAITRefresh({
+        controller: addressToUse,
+        serviceId,
+        ...(roles !== undefined ? { roles: [...roles] } : {}),
+        ...(permissionGroup !== undefined ? { permissionGroup } : {}),
+      });
 
       if (autoShowSuccessMessage) {
         showSuccess(walletTextUtils.getWalletText('Successfully signed in with your HIT wallet. You can now use the AI agent.', serviceId));
@@ -2717,109 +2847,6 @@ export const ChatBotProvider: React.FC<ChatBotProps> = ({
     }
   };
 
-  // Generate and register AIT
-  const generateAndRegisterAIT = async (newPermissions?: string[], isFromAIAgent = false) => {
-    let currentSigner = signer;
-    let currentAddress = hitAddress;
-
-    // If we have an address but no signer, try to auto-connect wallet
-    if (currentAddress && !currentSigner) {
-      const storedWalletAddress = localStorage.getItem('walletAddress');
-      if (storedWalletAddress === currentAddress) {
-        try {
-          const autoConnectResult = await connectWallet(false); // Don't show sign-in message yet
-          if (autoConnectResult) {
-            // Wait for state to update
-            await new Promise(resolve => setTimeout(resolve, 1000));
-            // Get the updated signer and address
-            currentSigner = signerRef.current || signer;
-            currentAddress = hitAddressRef.current || hitAddress;
-          }
-        } catch (error) {
-          console.error('Auto-connect failed during AIT generation:', error);
-        }
-      }
-    }
-
-    if (!currentSigner || !currentAddress) {
-      throw new Error('Missing signer or wallet address');
-    }
-
-    return generateAndRegisterAITWithSigner(newPermissions, isFromAIAgent, currentSigner, currentAddress);
-  };
-
-  // Generate and register AIT with explicit signer and address
-  const generateAndRegisterAITWithSigner = async (
-    newPermissions?: string[],
-    isFromAIAgent = false,
-    explicitSigner?: ethers.JsonRpcSigner,
-    explicitAddress?: string
-  ) => {
-    const currentSigner = explicitSigner || signer;
-    const currentAddress = explicitAddress || hitAddress;
-
-    if (!currentSigner || !currentAddress) {
-      throw new Error('Missing signer or wallet address');
-    }
-
-    // If AI Agent is creating, must check if user has existing AIT
-    if (isFromAIAgent && !aitRef.current) {
-      throw new Error('You must have an existing AIT before AI Agent can create new AITs');
-    }
-
-    // aitId is assigned by AIT-Service (UUIDv7) and returned in the response. It must not be
-    // minted here: the client cannot guarantee uniqueness, and this value feeds parentAITId, which
-    // is part of the on-chain commitment -- a locally invented id would anchor a parent that does
-    // not exist.
-
-    const metadata = {
-      permissions: newPermissions || permissions,
-      issuedBy: currentAddress,
-    };
-
-    const metadataStr = stringify(metadata);
-    // ethers v6: utils.keccak256 -> keccak256, utils.toUtf8Bytes -> toUtf8Bytes
-    const metadataHash = ethers.keccak256(ethers.toUtf8Bytes(metadataStr));
-
-    // AIT-Service no longer publishes metadata to IPFS: the registry is hash-only, integrity comes
-    // from the on-chain commitment, and /api/metadata has been removed. `permissions` now travels
-    // in the request body instead of being recovered from a CID, so nothing is uploaded here.
-
-    const createAITParams = {
-      controller: currentAddress,
-      serviceId,
-      permissions: metadata.permissions,
-      metadataHash,
-      isFromAIAgent: isFromAIAgent,
-      parentAITId: isFromAIAgent ? aitRef.current?.aitId : undefined,
-    };
-
-    const createAITResponse = await nxtlinqApi.ait.createAIT(createAITParams, nxtlinqAITServiceAccessToken || '');
-
-    if ('error' in createAITResponse) {
-      throw new Error(`Failed to create AIT: ${createAITResponse.error}`);
-    }
-
-    const aitId = (createAITResponse as { aitId?: string }).aitId;
-    if (!aitId) {
-      // Surfaced rather than substituted: this id becomes parentAITId on agent-created AITs, and
-      // parentAITId is committed on chain. Guessing one would anchor a dangling parent link.
-      throw new Error('AIT-Service did not return an aitId; refusing to invent one.');
-    }
-
-    const aitInfo = {
-      aitId,
-      controller: currentAddress,
-      metadata,
-      metadataHash,
-    };
-
-    setAit(aitInfo);
-    setPermissions(newPermissions || permissions);
-  };
-
-
-
   // Auto enable AIT permission
   const enableAIT = async (toolName: string) => {
     if (isAITEnabling) return false; // Prevent duplicate
@@ -2886,40 +2913,45 @@ export const ChatBotProvider: React.FC<ChatBotProps> = ({
     }
 
     try {
-      // Get available permissions to find the tool
-      const availablePermissionLabels = availablePermissions.map(p => p.label);
-      if (!availablePermissionLabels.includes(toolName)) {
+      const context: RuntimeAITContext = {
+        controller: currentHitAddress,
+        serviceId,
+        ...(roles !== undefined ? { roles: [...roles] } : {}),
+        ...(permissionGroup !== undefined ? { permissionGroup } : {}),
+      };
+      const enabled = await runtimeMutationQueueRef.current.run(
+        runtimeAITSubjectKey(context),
+        async () => {
+          runtimeRecomputeCoordinatorRef.current.assertContextActive(context);
+          const current = await recomputeRuntimeAIT(context);
+          if (!current.maximumPermissions.includes(toolName)) {
+            return false;
+          }
+          const nextDeniedPermissions = removeOneDeniedPermission(
+            current.deniedPermissions,
+            toolName,
+          );
+          runtimeRecomputeCoordinatorRef.current.assertContextActive(context);
+          await dispatchRuntimeDenyListReplacement(context, nextDeniedPermissions);
+          return true;
+        },
+      );
+      if (!enabled) {
         showError(`Tool ${toolName} is not available for your current identity provider`);
         setIsAITEnabling(false);
         return false;
       }
-
-      // Get current permissions from AIT metadata instead of React state
-      // This ensures we don't lose existing permissions when enabling new ones
-      const currentAITPermissions = aitRef.current?.metadata?.permissions || permissions;
-      const newPermissions = [...currentAITPermissions];
-      if (!newPermissions.includes(toolName)) {
-        newPermissions.push(toolName);
-      }
-
-      // Filter out deleted permissions before saving
-      const validPermissions = newPermissions.filter(permission =>
-        availablePermissionLabels.includes(permission)
-      );
-
-      // Generate and register AIT with new permissions
-      // For auto-enable, we should create a regular AIT (not AI Agent AIT) if user doesn't have existing AIT
-      const shouldCreateAsAIAgent = !!aitRef.current; // Only create as AI Agent if user already has an AIT
-
-      await generateAndRegisterAITWithSigner(validPermissions, shouldCreateAsAIAgent, currentSigner, currentHitAddress);
       showSuccess('AIT permission enabled successfully! You can now use the AI agent.');
-      await refreshAIT(true);
       setIsAITEnabling(false);
       return true;
     } catch (error) {
-      console.error('Failed to auto-enable AIT:', error);
+      if (!(error instanceof StaleRuntimeAITResponseError)) {
+        console.error('Failed to auto-enable AIT:', error);
+      }
       setIsAITEnabling(false);
-      if (error instanceof Error) {
+      if (error instanceof StaleRuntimeAITResponseError) {
+        return false;
+      } else if (error instanceof Error) {
         showError(error.message);
       } else {
         showError('Failed to enable AIT permission. Please try again.');
@@ -2932,22 +2964,41 @@ export const ChatBotProvider: React.FC<ChatBotProps> = ({
   const savePermissions = async (newPermissions?: string[]) => {
     setIsDisabled(true);
     try {
-      // Filter out deleted permissions before saving
-      const permissionsToSave = newPermissions || permissions;
-      const availablePermissionLabels = availablePermissions.map(p => p.label);
-      const validPermissions = permissionsToSave.filter(permission =>
-        availablePermissionLabels.includes(permission)
+      if (!hitAddress) {
+        throw new Error('Please connect your wallet first');
+      }
+      const context: RuntimeAITContext = {
+        controller: hitAddress,
+        serviceId,
+        ...(roles !== undefined ? { roles: [...roles] } : {}),
+        ...(permissionGroup !== undefined ? { permissionGroup } : {}),
+      };
+      const checkedPermissions = [...(newPermissions ?? permissions)];
+      await runtimeMutationQueueRef.current.run(
+        runtimeAITSubjectKey(context),
+        async () => {
+          runtimeRecomputeCoordinatorRef.current.assertContextActive(context);
+          const fresh = await recomputeRuntimeAIT(context);
+          const nextDeniedPermissions = replaceCurrentMaximumDenyList(
+            fresh.deniedPermissions,
+            fresh.maximumPermissions,
+            checkedPermissions,
+          );
+          runtimeRecomputeCoordinatorRef.current.assertContextActive(context);
+          await dispatchRuntimeDenyListReplacement(context, nextDeniedPermissions);
+        },
       );
-
-      await generateAndRegisterAIT(validPermissions, false);
       showSuccess('AIT permissions saved successfully! You can now use the AI agent with your configured permissions.');
       setShowPermissionForm(false);
       setIsPermissionFormOpen(false);
-      await refreshAIT(true);
     } catch (error) {
-      console.error('Failed to generate AIT:', error);
+      if (!(error instanceof StaleRuntimeAITResponseError)) {
+        console.error('Failed to update AIT deny-list:', error);
+      }
       setIsDisabled(false);
-      if (error instanceof Error) {
+      if (error instanceof StaleRuntimeAITResponseError) {
+        return;
+      } else if (error instanceof Error) {
         showError(error.message);
       } else {
         showError('Failed to save permissions. Please try again.');
@@ -2996,14 +3047,12 @@ export const ChatBotProvider: React.FC<ChatBotProps> = ({
                   const walletResponse = await nxtlinqApi.wallet.getWallet({ address }, token);
                   if (!('error' in walletResponse)) {
                     setWalletInfo(walletResponse);
-                    const aitResponse = await nxtlinqApi.ait.getAITByServiceIdAndController({
-                      serviceId,
+                    await queueRuntimeAITRefresh({
                       controller: address,
-                      customUsername: (!requireWalletIDVVerification && customUsername) ? getFinalCustomUsername(customUsername) : undefined
-                    }, token);
-                    if (!('error' in aitResponse)) {
-                      setAit(aitResponse);
-                    }
+                      serviceId,
+                      ...(roles !== undefined ? { roles: [...roles] } : {}),
+                      ...(permissionGroup !== undefined ? { permissionGroup } : {}),
+                    });
                   }
                 } finally {
                   setIsWalletLoading(false);
@@ -3034,14 +3083,12 @@ export const ChatBotProvider: React.FC<ChatBotProps> = ({
               const walletResponse = await nxtlinqApi.wallet.getWallet({ address }, token);
               if (!('error' in walletResponse)) {
                 setWalletInfo(walletResponse);
-                const aitResponse = await nxtlinqApi.ait.getAITByServiceIdAndController({
-                  serviceId,
+                await queueRuntimeAITRefresh({
                   controller: address,
-                  customUsername: (!requireWalletIDVVerification && customUsername) ? getFinalCustomUsername(customUsername) : undefined
-                }, token);
-                if (!('error' in aitResponse)) {
-                  setAit(aitResponse);
-                }
+                  serviceId,
+                  ...(roles !== undefined ? { roles: [...roles] } : {}),
+                  ...(permissionGroup !== undefined ? { permissionGroup } : {}),
+                });
               }
             } finally {
               setIsWalletLoading(false);
@@ -3148,7 +3195,7 @@ export const ChatBotProvider: React.FC<ChatBotProps> = ({
     if (hitAddress && nxtlinqAITServiceAccessToken) {
       refreshAIT();
     }
-  }, [hitAddress, nxtlinqAITServiceAccessToken]);
+  }, [hitAddress, nxtlinqAITServiceAccessToken, permissionGroup, runtimeRolesKey, serviceId]);
 
   // Set loading state when permission form opens
   React.useEffect(() => {
@@ -3236,6 +3283,8 @@ export const ChatBotProvider: React.FC<ChatBotProps> = ({
     updateExternalId()
   }, [hitAddress, nxtlinqApi, authFields, pseudoId]);
 
+  const runtimeAuthorizationMatchesRenderedContext =
+    runtimeAuthorizationMatchesContext(runtimeAuthorizationContextKey, runtimeContext);
   const contextValue: ChatBotContextType = {
     // State
     messages,
@@ -3243,9 +3292,16 @@ export const ChatBotProvider: React.FC<ChatBotProps> = ({
     isLoading,
     isOpen,
     hitAddress,
-    ait,
-    permissions,
-    availablePermissions,
+    ait: runtimeAuthorizationMatchesRenderedContext ? ait : null,
+    permissions: runtimeAuthorizationMatchesRenderedContext ? permissions : [],
+    maximumPermissions: runtimeAuthorizationMatchesRenderedContext ? maximumPermissions : [],
+    deniedPermissions: runtimeAuthorizationMatchesRenderedContext ? deniedPermissions : [],
+    runtimePermissionsUnavailable: runtimeAuthorizationMatchesRenderedContext
+      ? runtimePermissionsUnavailable
+      : runtimeContext !== null,
+    availablePermissions: runtimeAuthorizationMatchesRenderedContext
+      ? availablePermissions
+      : [],
     showPermissionForm,
     isPermissionFormOpen,
     isAITLoading,
@@ -3282,7 +3338,6 @@ export const ChatBotProvider: React.FC<ChatBotProps> = ({
     setIsOpen,
     setShowPermissionForm,
     setIsPermissionFormOpen,
-    setPermissions,
     setIsDisabled,
     setIsWalletLoading,
     setNotification,
@@ -3332,6 +3387,7 @@ export const ChatBotProvider: React.FC<ChatBotProps> = ({
     onVerifyWallet: (method: 'berifyme' | 'custom') => handleVerifyWalletClick(method),
     serviceId,
     permissionGroup,
+    roles,
 
     // Props
     props: {
@@ -3350,6 +3406,7 @@ export const ChatBotProvider: React.FC<ChatBotProps> = ({
       getAuthToken,
       onVerifyWallet,
       permissionGroup,
+      roles,
       onModelChange,
       storageMode,
       requireWalletIDVVerification,

package/src/index.ts

@@ -14,7 +14,6 @@ export {
 
 export type {
   AIModel,
-  AITMetadata,
   ChatBotContextType,
   ChatBotProps,
   NovaError,