@bytexbyte/nxtlinq-ai-agent-ui-react-development 0.4.5 → 0.4.8

package/dist/context/ChatBotContext.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ChatBotContext.d.ts","sourceRoot":"","sources":["../../src/context/ChatBotContext.tsx"],"names":[],"mappings":"AAEA,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AA8B/B,OAAO,EAEL,kBAAkB,EAClB,YAAY,EAEb,MAAM,uBAAuB,CAAC;AAW/B,eAAO,MAAM,UAAU,0BAMtB,CAAC;AAEF,eAAO,MAAM,eAAe,EAAE,KAAK,CAAC,EAAE,CAAC,YAAY,CAohGlD,CAAC"}
+{"version":3,"file":"ChatBotContext.d.ts","sourceRoot":"","sources":["../../src/context/ChatBotContext.tsx"],"names":[],"mappings":"AAEA,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AA+B/B,OAAO,EAEL,kBAAkB,EAClB,YAAY,EAEb,MAAM,uBAAuB,CAAC;AA0B/B,eAAO,MAAM,UAAU,0BAMtB,CAAC;AAEF,eAAO,MAAM,eAAe,EAAE,KAAK,CAAC,EAAE,CAAC,YAAY,CAwgGlD,CAAC"}

package/dist/context/ChatBotContext.js

@@ -6,11 +6,11 @@ import { flushSync } from 'react-dom';
 import { v4 as uuidv4 } from 'uuid';
 import { createNxtlinqApi, setApiHosts, synthesizeSpeechToBuffer, streamSpeechToAudioContext, useLocalStorage, useSessionStorage, useSpeechToTextFromMic, useVoiceMode, metakeepClient, getEthers, sleep, walletTextUtils, } from '@bytexbyte/nxtlinq-ai-agent-web-development';
 import { authorizeTextFrontendTool, hasRecordedWalletVerification, validateWalletSession, } from '@bytexbyte/nxtlinq-ai-agent-core-development';
-import { waitForAITPermissions } from '../aitPermissionPropagation';
 import { AuthorizationLoadingState } from '../authorizationLoadingState';
 import { PendingTextToolRetryController } from '../pendingTextToolRetry';
 import { completePiiScan } from '../piiMessageState';
 import { filterSuggestions } from '../suggestionState';
+import { dispatchRuntimeAITCompleteReplacement, removeOneDeniedPermission, replaceCurrentMaximumDenyList, RuntimeAITMutationQueue, RuntimeAITRecomputeCoordinator, StaleRuntimeAITResponseError, runtimeAITContextKey, runtimeAITSubjectKey, runtimeAuthorizationMatchesContext, runtimeAuthorizationState, unavailableRuntimeAuthorization, useProviderRuntimeCommit, useRuntimeAITContextCommit, } from '../permissionState';
 const MIC_ENABLED_SESSION_KEY = 'chatbot-mic-enabled';
 const ChatBotContext = React.createContext(undefined);
 export const useChatBot = () => {
@@ -20,7 +20,7 @@ export const useChatBot = () => {
     }
     return context;
 };
-export const ChatBotProvider = ({ onMessage, onError, onToolUse, presetMessages = [], placeholder = 'Type a message...', className = '', maxRetries = 3, retryDelay = 2000, serviceId, apiKey, apiSecret, serviceToken, getAuthToken, environment = 'production', onVerifyWallet, permissionGroup, children, 
+export const ChatBotProvider = ({ onMessage, onError, onToolUse, presetMessages = [], placeholder = 'Type a message...', className = '', maxRetries = 3, retryDelay = 2000, serviceId, apiKey, apiSecret, serviceToken, getAuthToken, environment = 'production', onVerifyWallet, permissionGroup, roles, children, 
 // AI Model related attributes
 onModelChange, 
 // Storage mode configuration
@@ -37,8 +37,6 @@ idvBannerDismissSeconds = 86400,
 isStopRecordingOnSend = false, 
 // Custom error message to display in chat
 customError, voiceThresholds, debugVoiceRms = false, sttGlossary, }) => {
-    // Set API hosts immediately based on environment (before any API calls)
-    setApiHosts(environment);
     const nxtlinqApi = React.useMemo(() => (serviceToken || getAuthToken
         ? createNxtlinqApi({ apiKey, apiSecret, serviceToken, getAuthToken })
         : createNxtlinqApi(apiKey ?? '', apiSecret ?? '')), [apiKey, apiSecret, serviceToken, getAuthToken]);
@@ -90,7 +88,17 @@ customError, voiceThresholds, debugVoiceRms = false, sttGlossary, }) => {
     const [hitAddress, setHitAddress] = React.useState(null);
     const [ait, setAit] = React.useState(null);
     const [permissions, setPermissions] = React.useState([]);
-    const [availablePermissions, setAvailablePermissions] = React.useState([]);
+    const [maximumPermissions, setMaximumPermissions] = React.useState([]);
+    const [deniedPermissions, setDeniedPermissions] = React.useState([]);
+    const [runtimePermissionsUnavailable, setRuntimePermissionsUnavailable] = React.useState(false);
+    const [runtimeAuthorizationContextKey, setRuntimeAuthorizationContextKey] = React.useState(null);
+    const [servicePermissionCatalog, setServicePermissionCatalog] = React.useState([]);
+    const availablePermissions = React.useMemo(() => maximumPermissions.map((label) => servicePermissionCatalog.find((permission) => permission.label === label) ?? {
+        id: label,
+        label,
+        description: '',
+        groups: [],
+    }), [maximumPermissions, servicePermissionCatalog]);
     const [showPermissionForm, setShowPermissionForm] = React.useState(false);
     const [isPermissionFormOpen, setIsPermissionFormOpen] = React.useState(false);
     const [isAITLoading, setIsAITLoading] = React.useState(false);
@@ -99,6 +107,7 @@ customError, voiceThresholds, debugVoiceRms = false, sttGlossary, }) => {
     const [walletInfo, setWalletInfo] = React.useState(null);
     const [isWalletLoading, setIsWalletLoading] = React.useState(false);
     const [isAutoConnecting, setIsAutoConnecting] = React.useState(false);
+    const runtimeRolesKey = JSON.stringify(roles ?? null);
     // Persistent data (always use localStorage)
     const [nxtlinqAITServiceAccessToken, setNxtlinqAITServiceAccessToken] = useLocalStorage('nxtlinqAITServiceAccessToken', '');
     const [pseudoId, setPseudoId] = useLocalStorage('pseudoId', uuidv4());
@@ -147,6 +156,7 @@ customError, voiceThresholds, debugVoiceRms = false, sttGlossary, }) => {
     const hitAddressRef = React.useRef(hitAddress);
     const aitRef = React.useRef(ait);
     const permissionsRef = React.useRef(permissions);
+    const deniedPermissionsRef = React.useRef(deniedPermissions);
     const nxtlinqAITServiceAccessTokenRef = React.useRef(nxtlinqAITServiceAccessToken);
     const signerRef = React.useRef(signer);
     const authorizationLoadingStateRef = React.useRef(new AuthorizationLoadingState(isAITLoading, isAutoConnecting));
@@ -161,6 +171,9 @@ customError, voiceThresholds, debugVoiceRms = false, sttGlossary, }) => {
             await sendMessageRef.current(request.content, 1, request.isPresetMessage, request.attachments);
         });
     }, []);
+    const runtimeRecomputeCoordinatorRef = React.useRef(new RuntimeAITRecomputeCoordinator());
+    const runtimeMutationQueueRef = React.useRef(new RuntimeAITMutationQueue());
+    useProviderRuntimeCommit(hitAddressRef, hitAddress, environment, setApiHosts);
     // Helper function to combine customUsername with Adilas customUserInfo
     const getFinalCustomUsername = React.useCallback((username) => {
         if (!username)
@@ -480,9 +493,6 @@ customError, voiceThresholds, debugVoiceRms = false, sttGlossary, }) => {
         }
     }, []);
     // Update refs when state changes
-    React.useEffect(() => {
-        hitAddressRef.current = hitAddress;
-    }, [hitAddress]);
     React.useEffect(() => {
         aitRef.current = ait;
     }, [ait]);
@@ -495,6 +505,9 @@ customError, voiceThresholds, debugVoiceRms = false, sttGlossary, }) => {
     React.useEffect(() => {
         authorizationLoadingStateRef.current.setAutoConnecting(isAutoConnecting);
     }, [isAutoConnecting]);
+    React.useEffect(() => {
+        deniedPermissionsRef.current = deniedPermissions;
+    }, [deniedPermissions]);
     React.useEffect(() => {
         nxtlinqAITServiceAccessTokenRef.current = nxtlinqAITServiceAccessToken;
     }, [nxtlinqAITServiceAccessToken]);
@@ -874,7 +887,7 @@ customError, voiceThresholds, debugVoiceRms = false, sttGlossary, }) => {
                 console.error('Failed to fetch permissions:', result.error);
                 return undefined;
             }
-            setAvailablePermissions(result.permissions);
+            setServicePermissionCatalog(result.permissions);
             return result.permissions;
         }
         catch (error) {
@@ -882,7 +895,74 @@ customError, voiceThresholds, debugVoiceRms = false, sttGlossary, }) => {
             return undefined;
         }
     };
-    // Refresh AIT
+    const clearRuntimeAuthorization = React.useCallback(() => {
+        const cleared = unavailableRuntimeAuthorization(deniedPermissionsRef.current);
+        const activeContext = runtimeRecomputeCoordinatorRef.current.getActiveContext();
+        aitRef.current = null;
+        permissionsRef.current = [];
+        setAit(cleared.ait);
+        setPermissions(cleared.effectivePermissions);
+        setMaximumPermissions(cleared.maximumPermissions);
+        setRuntimePermissionsUnavailable(cleared.unavailable);
+        setRuntimeAuthorizationContextKey(activeContext ? runtimeAITContextKey(activeContext) : null);
+    }, []);
+    const applyRuntimeResult = React.useCallback((result, context) => {
+        const next = runtimeAuthorizationState(result, context.controller, context.serviceId);
+        aitRef.current = next.ait;
+        permissionsRef.current = next.effectivePermissions;
+        setAit(next.ait);
+        setPermissions(next.effectivePermissions);
+        setMaximumPermissions(next.maximumPermissions);
+        setDeniedPermissions(next.deniedPermissions);
+        deniedPermissionsRef.current = next.deniedPermissions;
+        setRuntimePermissionsUnavailable(false);
+        setRuntimeAuthorizationContextKey(runtimeAITContextKey(context));
+        return result;
+    }, []);
+    const runtimeContext = React.useMemo(() => hitAddress ? {
+        controller: hitAddress,
+        serviceId,
+        ...(roles !== undefined ? { roles: [...roles] } : {}),
+        ...(permissionGroup !== undefined ? { permissionGroup } : {}),
+    } : null, [hitAddress, permissionGroup, runtimeRolesKey, serviceId]);
+    const invalidateCommittedRuntimeContext = React.useCallback(() => {
+        const activeContext = runtimeRecomputeCoordinatorRef.current.getActiveContext();
+        aitRef.current = null;
+        permissionsRef.current = [];
+        deniedPermissionsRef.current = [];
+        setAit(null);
+        setPermissions([]);
+        setMaximumPermissions([]);
+        setDeniedPermissions([]);
+        setRuntimePermissionsUnavailable(activeContext !== null);
+        setRuntimeAuthorizationContextKey(activeContext ? runtimeAITContextKey(activeContext) : null);
+    }, []);
+    useRuntimeAITContextCommit(runtimeRecomputeCoordinatorRef.current, runtimeContext, invalidateCommittedRuntimeContext);
+    const recomputeRuntimeAIT = React.useCallback(async (context) => {
+        const capturedContext = {
+            controller: context.controller,
+            serviceId: context.serviceId,
+            ...(context.roles !== undefined ? { roles: [...context.roles] } : {}),
+            ...(context.permissionGroup !== undefined ? { permissionGroup: context.permissionGroup } : {}),
+        };
+        return runtimeRecomputeCoordinatorRef.current.run(capturedContext, () => nxtlinqApi.ait.recomputeAIT(capturedContext), applyRuntimeResult, clearRuntimeAuthorization);
+    }, [applyRuntimeResult, clearRuntimeAuthorization, nxtlinqApi]);
+    const queueRuntimeAITRefresh = React.useCallback((context) => runtimeMutationQueueRef.current.run(runtimeAITSubjectKey(context), async () => {
+        runtimeRecomputeCoordinatorRef.current.assertContextActive(context);
+        return recomputeRuntimeAIT(context);
+    }), [recomputeRuntimeAIT]);
+    const convergeRuntimeAITSubject = React.useCallback(async (subjectKey) => {
+        const activeContext = runtimeRecomputeCoordinatorRef.current.getActiveContext();
+        if (!activeContext || runtimeAITSubjectKey(activeContext) !== subjectKey) {
+            return;
+        }
+        await recomputeRuntimeAIT(activeContext);
+    }, [recomputeRuntimeAIT]);
+    const dispatchRuntimeDenyListReplacement = React.useCallback(async (context, nextDeniedPermissions) => dispatchRuntimeAITCompleteReplacement(runtimeRecomputeCoordinatorRef.current, context, () => nxtlinqApi.ait.updatePermissionDenyList({
+        ...context,
+        deniedPermissions: nextDeniedPermissions,
+    }), convergeRuntimeAITSubject, clearRuntimeAuthorization), [clearRuntimeAuthorization, convergeRuntimeAITSubject, nxtlinqApi]);
+    // Refresh the authoritative runtime AIT state.
     const refreshAIT = async (forceUpdatePermissions = false) => {
         const currentHitAddress = hitAddressRef.current || hitAddress;
         const currentToken = nxtlinqAITServiceAccessTokenRef.current || nxtlinqAITServiceAccessToken;
@@ -891,8 +971,10 @@ customError, voiceThresholds, debugVoiceRms = false, sttGlossary, }) => {
             permissionsRef.current = [];
             setAit(null);
             setPermissions([]);
+            setMaximumPermissions([]);
             setWalletInfo(null);
             authorizationLoadingStateRef.current.setAITLoading(false);
+            setRuntimePermissionsUnavailable(false);
             setIsAITLoading(false);
             return;
         }
@@ -923,52 +1005,24 @@ customError, voiceThresholds, debugVoiceRms = false, sttGlossary, }) => {
                     console.error('Failed to fetch wallet info:', error);
                 }
             }
-            // AIT existence is not identity verification. In strict mode, stop before
-            // the legacy AIT lookup can synthesize a custom wallet record.
             if (currentToken && !walletAllowsAITLookup) {
-                aitRef.current = null;
-                permissionsRef.current = [];
-                setAit(null);
-                setPermissions([]);
+                clearRuntimeAuthorization();
                 return;
             }
-            // Only try to fetch AIT if we have a token
+            // Recompute is the sole mint/reuse path and the only permission authority.
             if (currentToken) {
-                const response = await nxtlinqApi.ait.getAITByServiceIdAndController({
-                    serviceId,
-                    controller: currentHitAddress,
-                    customUsername: (!requireWalletIDVVerification && customUsername) ? getFinalCustomUsername(customUsername) : undefined
-                }, currentToken);
-                if ('error' in response) {
-                    console.error('Failed to fetch AIT:', response.error);
-                    aitRef.current = null;
-                    permissionsRef.current = [];
-                    setAit(null);
-                    setPermissions([]);
-                    return;
-                }
-                aitRef.current = response;
-                setAit(response);
-                if (!isPermissionFormOpen || forceUpdatePermissions) {
-                    const newPermissions = response.metadata?.permissions || [];
-                    permissionsRef.current = newPermissions;
-                    setPermissions(newPermissions);
+                if (runtimeContext) {
+                    await queueRuntimeAITRefresh(runtimeContext);
                 }
             }
             else {
-                // No token available, clear AIT data
-                aitRef.current = null;
-                permissionsRef.current = [];
-                setAit(null);
-                setPermissions([]);
+                clearRuntimeAuthorization();
             }
         }
         catch (error) {
-            console.error('Failed to fetch AIT:', error);
-            aitRef.current = null;
-            permissionsRef.current = [];
-            setAit(null);
-            setPermissions([]);
+            if (!(error instanceof StaleRuntimeAITResponseError)) {
+                console.error('Failed to recompute AIT:', error);
+            }
         }
         finally {
             // Keep the authorization snapshot current before refreshAIT resolves.
@@ -977,48 +1031,6 @@ customError, voiceThresholds, debugVoiceRms = false, sttGlossary, }) => {
             setIsAITLoading(false);
         }
     };
-    const waitForPersistedAITPermissions = async (expectedPermissions) => {
-        const currentHitAddress = hitAddressRef.current || hitAddress;
-        const currentToken = nxtlinqAITServiceAccessTokenRef.current || nxtlinqAITServiceAccessToken;
-        if (!currentHitAddress || !currentToken)
-            return false;
-        authorizationLoadingStateRef.current.setAITLoading(true);
-        setIsAITLoading(true);
-        try {
-            const persistedAIT = await waitForAITPermissions({
-                expectedPermissions,
-                readAIT: async () => {
-                    try {
-                        const response = await nxtlinqApi.ait.getAITByServiceIdAndController({
-                            serviceId,
-                            controller: currentHitAddress,
-                            customUsername: (!requireWalletIDVVerification && customUsername)
-                                ? getFinalCustomUsername(customUsername)
-                                : undefined,
-                        }, currentToken);
-                        return 'error' in response ? undefined : response;
-                    }
-                    catch (error) {
-                        console.warn('AIT permission propagation check failed:', error);
-                        return undefined;
-                    }
-                },
-                getPermissions: (currentAIT) => currentAIT.metadata?.permissions || [],
-            });
-            if (!persistedAIT)
-                return false;
-            const persistedPermissions = persistedAIT.metadata?.permissions || [];
-            aitRef.current = persistedAIT;
-            permissionsRef.current = persistedPermissions;
-            setAit(persistedAIT);
-            setPermissions(persistedPermissions);
-            return true;
-        }
-        finally {
-            authorizationLoadingStateRef.current.setAITLoading(false);
-            setIsAITLoading(false);
-        }
-    };
     // Check if user needs to sign in
     const isNeedSignInWithWallet = React.useMemo(() => {
         if (!hitAddress)
@@ -1197,9 +1209,13 @@ customError, voiceThresholds, debugVoiceRms = false, sttGlossary, }) => {
             const { accessToken } = response;
             setNxtlinqAITServiceAccessToken(accessToken);
             nxtlinqAITServiceAccessTokenRef.current = accessToken;
-            // Wait for state to update before refreshing AIT
-            await new Promise(resolve => setTimeout(resolve, 100));
-            await refreshAIT();
+            localStorage.setItem('nxtlinqAITServiceAccessToken', JSON.stringify(accessToken));
+            await queueRuntimeAITRefresh({
+                controller: addressToUse,
+                serviceId,
+                ...(roles !== undefined ? { roles: [...roles] } : {}),
+                ...(permissionGroup !== undefined ? { permissionGroup } : {}),
+            });
             if (autoShowSuccessMessage) {
                 showSuccess(walletTextUtils.getWalletText('Successfully signed in with your HIT wallet. You can now use the AI agent.', serviceId));
             }
@@ -1234,6 +1250,8 @@ customError, voiceThresholds, debugVoiceRms = false, sttGlossary, }) => {
                 loading: authorizationLoadingStateRef.current.isLoading(),
             },
             ...authFields(),
+            ...(roles !== undefined ? { roles: [...roles] } : {}),
+            ...(permissionGroup !== undefined ? { permissionGroup } : {}),
             customUsername: (!requireWalletIDVVerification && customUsername)
                 ? getFinalCustomUsername(customUsername)
                 : undefined,
@@ -1634,6 +1652,10 @@ customError, voiceThresholds, debugVoiceRms = false, sttGlossary, }) => {
                     const isToolAllowed = await hasPermission(toolUse.name);
                     // Typed preflight already emitted the only permitted recovery UI.
                     if (!isToolAllowed) {
+                        // Do not leave suggestions from the previous turn visible while
+                        // authorization recovery short-circuits the normal response path.
+                        setSuggestions([]);
+                        void updateSuggestions(pseudoId, localStorage.getItem('walletAddress') || undefined, content);
                         pendingTextToolRetryRef.current.set({
                             content,
                             isPresetMessage,
@@ -2211,85 +2233,6 @@ customError, voiceThresholds, debugVoiceRms = false, sttGlossary, }) => {
             setInputValue(message.text);
         }
     };
-    // Generate and register AIT
-    const generateAndRegisterAIT = async (newPermissions, isFromAIAgent = false) => {
-        let currentSigner = signer;
-        let currentAddress = hitAddress;
-        // If we have an address but no signer, try to auto-connect wallet
-        if (currentAddress && !currentSigner) {
-            const storedWalletAddress = localStorage.getItem('walletAddress');
-            if (storedWalletAddress === currentAddress) {
-                try {
-                    const autoConnectResult = await connectWallet(false); // Don't show sign-in message yet
-                    if (autoConnectResult) {
-                        // Wait for state to update
-                        await new Promise(resolve => setTimeout(resolve, 1000));
-                        // Get the updated signer and address
-                        currentSigner = signerRef.current || signer;
-                        currentAddress = hitAddressRef.current || hitAddress;
-                    }
-                }
-                catch (error) {
-                    console.error('Auto-connect failed during AIT generation:', error);
-                }
-            }
-        }
-        if (!currentSigner || !currentAddress) {
-            throw new Error('Missing signer or wallet address');
-        }
-        return generateAndRegisterAITWithSigner(newPermissions, isFromAIAgent, currentSigner, currentAddress);
-    };
-    // Generate and register AIT with explicit signer and address
-    const generateAndRegisterAITWithSigner = async (newPermissions, isFromAIAgent = false, explicitSigner, explicitAddress) => {
-        const currentSigner = explicitSigner || signer;
-        const currentAddress = explicitAddress || hitAddress;
-        if (!currentSigner || !currentAddress) {
-            throw new Error('Missing signer or wallet address');
-        }
-        // If AI Agent is creating, must check if user has existing AIT
-        if (isFromAIAgent && !aitRef.current) {
-            throw new Error('You must have an existing AIT before AI Agent can create new AITs');
-        }
-        const timestamp = Math.floor(Date.now() / 1000);
-        const aitId = `did:polygon:nxtlinq:${currentAddress}:${timestamp}`;
-        const metadata = {
-            permissions: newPermissions || permissions,
-            issuedBy: currentAddress,
-        };
-        const metadataStr = stringify(metadata);
-        // ethers v6: utils.keccak256 -> keccak256, utils.toUtf8Bytes -> toUtf8Bytes
-        const metadataHash = ethers.keccak256(ethers.toUtf8Bytes(metadataStr));
-        const uploadResponse = await nxtlinqApi.metadata.createMetadata(metadata, nxtlinqAITServiceAccessToken || '');
-        if ('error' in uploadResponse) {
-            throw new Error(`Failed to upload metadata: ${uploadResponse.error}`);
-        }
-        const { metadataCid } = uploadResponse;
-        const createAITParams = {
-            aitId,
-            controller: currentAddress,
-            serviceId,
-            metadataHash,
-            metadataCid,
-            isFromAIAgent: isFromAIAgent,
-            parentAITId: isFromAIAgent ? aitRef.current?.aitId : undefined,
-        };
-        const createAITResponse = await nxtlinqApi.ait.createAIT(createAITParams, nxtlinqAITServiceAccessToken || '');
-        if ('error' in createAITResponse) {
-            throw new Error(`Failed to create AIT: ${createAITResponse.error}`);
-        }
-        const aitInfo = {
-            aitId,
-            controller: currentAddress,
-            metadata,
-            metadataHash,
-            metadataCid,
-        };
-        const nextPermissions = newPermissions || permissions;
-        aitRef.current = aitInfo;
-        permissionsRef.current = nextPermissions;
-        setAit(aitInfo);
-        setPermissions(nextPermissions);
-    };
     // Auto enable AIT permission
     const enableAIT = async (toolName) => {
         if (isAITEnabling)
@@ -2351,40 +2294,41 @@ customError, voiceThresholds, debugVoiceRms = false, sttGlossary, }) => {
             }
         }
         try {
-            // Get available permissions to find the tool
-            const availablePermissionLabels = availablePermissions.map(p => p.label);
-            if (!availablePermissionLabels.includes(toolName)) {
+            const context = {
+                controller: currentHitAddress,
+                serviceId,
+                ...(roles !== undefined ? { roles: [...roles] } : {}),
+                ...(permissionGroup !== undefined ? { permissionGroup } : {}),
+            };
+            const enabled = await runtimeMutationQueueRef.current.run(runtimeAITSubjectKey(context), async () => {
+                runtimeRecomputeCoordinatorRef.current.assertContextActive(context);
+                const current = await recomputeRuntimeAIT(context);
+                if (!current.maximumPermissions.includes(toolName)) {
+                    return false;
+                }
+                const nextDeniedPermissions = removeOneDeniedPermission(current.deniedPermissions, toolName);
+                runtimeRecomputeCoordinatorRef.current.assertContextActive(context);
+                await dispatchRuntimeDenyListReplacement(context, nextDeniedPermissions);
+                return true;
+            });
+            if (!enabled) {
                 showError(`Tool ${toolName} is not available for your current identity provider`);
                 setIsAITEnabling(false);
                 return false;
             }
-            // Get current permissions from AIT metadata instead of React state
-            // This ensures we don't lose existing permissions when enabling new ones
-            const currentAITPermissions = aitRef.current?.metadata?.permissions || permissions;
-            const newPermissions = [...currentAITPermissions];
-            if (!newPermissions.includes(toolName)) {
-                newPermissions.push(toolName);
-            }
-            // Filter out deleted permissions before saving
-            const validPermissions = newPermissions.filter(permission => availablePermissionLabels.includes(permission));
-            // Generate and register AIT with new permissions
-            // For auto-enable, we should create a regular AIT (not AI Agent AIT) if user doesn't have existing AIT
-            const shouldCreateAsAIAgent = !!aitRef.current; // Only create as AI Agent if user already has an AIT
-            await generateAndRegisterAITWithSigner(validPermissions, shouldCreateAsAIAgent, currentSigner, currentHitAddress);
-            const permissionsPersisted = await waitForPersistedAITPermissions(validPermissions);
-            if (!permissionsPersisted) {
-                showWarning('AIT permission was submitted but is still synchronizing. Please try again shortly.');
-                setIsAITEnabling(false);
-                return false;
-            }
             showSuccess('AIT permission enabled successfully! You can now use the AI agent.');
             setIsAITEnabling(false);
             return true;
         }
         catch (error) {
-            console.error('Failed to auto-enable AIT:', error);
+            if (!(error instanceof StaleRuntimeAITResponseError)) {
+                console.error('Failed to auto-enable AIT:', error);
+            }
             setIsAITEnabling(false);
-            if (error instanceof Error) {
+            if (error instanceof StaleRuntimeAITResponseError) {
+                return false;
+            }
+            else if (error instanceof Error) {
                 showError(error.message);
             }
             else {
@@ -2397,11 +2341,23 @@ customError, voiceThresholds, debugVoiceRms = false, sttGlossary, }) => {
     const savePermissions = async (newPermissions) => {
         setIsDisabled(true);
         try {
-            // Filter out deleted permissions before saving
-            const permissionsToSave = newPermissions || permissions;
-            const availablePermissionLabels = availablePermissions.map(p => p.label);
-            const validPermissions = permissionsToSave.filter(permission => availablePermissionLabels.includes(permission));
-            await generateAndRegisterAIT(validPermissions, false);
+            if (!hitAddress) {
+                throw new Error('Please connect your wallet first');
+            }
+            const context = {
+                controller: hitAddress,
+                serviceId,
+                ...(roles !== undefined ? { roles: [...roles] } : {}),
+                ...(permissionGroup !== undefined ? { permissionGroup } : {}),
+            };
+            const checkedPermissions = [...(newPermissions ?? permissions)];
+            await runtimeMutationQueueRef.current.run(runtimeAITSubjectKey(context), async () => {
+                runtimeRecomputeCoordinatorRef.current.assertContextActive(context);
+                const fresh = await recomputeRuntimeAIT(context);
+                const nextDeniedPermissions = replaceCurrentMaximumDenyList(fresh.deniedPermissions, fresh.maximumPermissions, checkedPermissions);
+                runtimeRecomputeCoordinatorRef.current.assertContextActive(context);
+                await dispatchRuntimeDenyListReplacement(context, nextDeniedPermissions);
+            });
             showSuccess('AIT permissions saved successfully! You can now use the AI agent with your configured permissions.');
             setShowPermissionForm(false);
             setIsPermissionFormOpen(false);
@@ -2409,9 +2365,14 @@ customError, voiceThresholds, debugVoiceRms = false, sttGlossary, }) => {
             await retryPendingTextTool();
         }
         catch (error) {
-            console.error('Failed to generate AIT:', error);
+            if (!(error instanceof StaleRuntimeAITResponseError)) {
+                console.error('Failed to update AIT deny-list:', error);
+            }
             setIsDisabled(false);
-            if (error instanceof Error) {
+            if (error instanceof StaleRuntimeAITResponseError) {
+                return;
+            }
+            else if (error instanceof Error) {
                 showError(error.message);
             }
             else {
@@ -2457,15 +2418,12 @@ customError, voiceThresholds, debugVoiceRms = false, sttGlossary, }) => {
                                     const walletResponse = await nxtlinqApi.wallet.getWallet({ address }, token);
                                     if (!('error' in walletResponse)) {
                                         setWalletInfo(walletResponse);
-                                        const aitResponse = await nxtlinqApi.ait.getAITByServiceIdAndController({
-                                            serviceId,
+                                        await queueRuntimeAITRefresh({
                                             controller: address,
-                                            customUsername: (!requireWalletIDVVerification && customUsername) ? getFinalCustomUsername(customUsername) : undefined
-                                        }, token);
-                                        if (!('error' in aitResponse)) {
-                                            aitRef.current = aitResponse;
-                                            setAit(aitResponse);
-                                        }
+                                            serviceId,
+                                            ...(roles !== undefined ? { roles: [...roles] } : {}),
+                                            ...(permissionGroup !== undefined ? { permissionGroup } : {}),
+                                        });
                                     }
                                 }
                                 finally {
@@ -2499,15 +2457,12 @@ customError, voiceThresholds, debugVoiceRms = false, sttGlossary, }) => {
                             const walletResponse = await nxtlinqApi.wallet.getWallet({ address }, token);
                             if (!('error' in walletResponse)) {
                                 setWalletInfo(walletResponse);
-                                const aitResponse = await nxtlinqApi.ait.getAITByServiceIdAndController({
-                                    serviceId,
+                                await queueRuntimeAITRefresh({
                                     controller: address,
-                                    customUsername: (!requireWalletIDVVerification && customUsername) ? getFinalCustomUsername(customUsername) : undefined
-                                }, token);
-                                if (!('error' in aitResponse)) {
-                                    aitRef.current = aitResponse;
-                                    setAit(aitResponse);
-                                }
+                                    serviceId,
+                                    ...(roles !== undefined ? { roles: [...roles] } : {}),
+                                    ...(permissionGroup !== undefined ? { permissionGroup } : {}),
+                                });
                             }
                         }
                         finally {
@@ -2619,7 +2574,7 @@ customError, voiceThresholds, debugVoiceRms = false, sttGlossary, }) => {
         if (hitAddress && nxtlinqAITServiceAccessToken) {
             refreshAIT();
         }
-    }, [hitAddress, nxtlinqAITServiceAccessToken]);
+    }, [hitAddress, nxtlinqAITServiceAccessToken, permissionGroup, runtimeRolesKey, serviceId]);
     // Set loading state when permission form opens
     React.useEffect(() => {
         if (isPermissionFormOpen && hitAddress) {
@@ -2699,6 +2654,7 @@ customError, voiceThresholds, debugVoiceRms = false, sttGlossary, }) => {
         };
         updateExternalId();
     }, [hitAddress, nxtlinqApi, authFields, pseudoId]);
+    const runtimeAuthorizationMatchesRenderedContext = runtimeAuthorizationMatchesContext(runtimeAuthorizationContextKey, runtimeContext);
     const contextValue = {
         // State
         messages,
@@ -2706,9 +2662,16 @@ customError, voiceThresholds, debugVoiceRms = false, sttGlossary, }) => {
         isLoading,
         isOpen,
         hitAddress,
-        ait,
-        permissions,
-        availablePermissions,
+        ait: runtimeAuthorizationMatchesRenderedContext ? ait : null,
+        permissions: runtimeAuthorizationMatchesRenderedContext ? permissions : [],
+        maximumPermissions: runtimeAuthorizationMatchesRenderedContext ? maximumPermissions : [],
+        deniedPermissions: runtimeAuthorizationMatchesRenderedContext ? deniedPermissions : [],
+        runtimePermissionsUnavailable: runtimeAuthorizationMatchesRenderedContext
+            ? runtimePermissionsUnavailable
+            : runtimeContext !== null,
+        availablePermissions: runtimeAuthorizationMatchesRenderedContext
+            ? availablePermissions
+            : [],
         showPermissionForm,
         isPermissionFormOpen,
         isAITLoading,
@@ -2744,7 +2707,6 @@ customError, voiceThresholds, debugVoiceRms = false, sttGlossary, }) => {
         setIsOpen,
         setShowPermissionForm,
         setIsPermissionFormOpen,
-        setPermissions,
         setIsDisabled,
         setIsWalletLoading,
         setNotification,
@@ -2793,6 +2755,7 @@ customError, voiceThresholds, debugVoiceRms = false, sttGlossary, }) => {
         onVerifyWallet: (method) => handleVerifyWalletClick(method),
         serviceId,
         permissionGroup,
+        roles,
         // Props
         props: {
             onMessage,
@@ -2810,6 +2773,7 @@ customError, voiceThresholds, debugVoiceRms = false, sttGlossary, }) => {
             getAuthToken,
             onVerifyWallet,
             permissionGroup,
+            roles,
             onModelChange,
             storageMode,
             requireWalletIDVVerification,

package/dist/index.d.ts

@@ -1,7 +1,7 @@
 export { ChatBot } from './ChatBot';
 export { ChatBotProvider, useChatBot } from './context/ChatBotContext';
 export { ChatBotUI, MessageInput, MessageList, ModelSelector, NotificationModal, PermissionForm, PresetMessages, BerifyMeModal, } from './ui/index';
-export type { AIModel, AITMetadata, ChatBotContextType, ChatBotProps, NovaError, NovaResponse, ToolCall, ToolUse, PresetMessage, } from './types/ChatBotTypes';
+export type { AIModel, ChatBotContextType, ChatBotProps, NovaError, NovaResponse, ToolCall, ToolUse, PresetMessage, } from './types/ChatBotTypes';
 export type { AgentEnvironment, AgentConfig, Attachment, AgentResponse, Message, SendMessageOptions, NxtlinqAgentSnapshot, TextToolAuthorizationSnapshot, TextToolAuthorizationOutcome, VoiceSession, VoiceStatus, } from '@bytexbyte/nxtlinq-ai-agent-core-development';
 export { NxtlinqAgent, setApiHosts, VoiceNotSupportedError, STORAGE_KEYS, authorizeTextFrontendTool, hasRecordedWalletVerification, validateWalletSession, } from '@bytexbyte/nxtlinq-ai-agent-core-development';
 export { createNxtlinqApi, useLocalStorage, useSessionStorage, useSpeechToTextFromMic, useVoiceMode, metakeepClient, getEthers, sleep, walletTextUtils, } from '@bytexbyte/nxtlinq-ai-agent-web-development';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAEvE,OAAO,EACL,SAAS,EACT,YAAY,EACZ,WAAW,EACX,aAAa,EACb,iBAAiB,EACjB,cAAc,EACd,cAAc,EACd,aAAa,GACd,MAAM,YAAY,CAAC;AAEpB,YAAY,EACV,OAAO,EACP,WAAW,EACX,kBAAkB,EAClB,YAAY,EACZ,SAAS,EACT,YAAY,EACZ,QAAQ,EACR,OAAO,EACP,aAAa,GACd,MAAM,sBAAsB,CAAC;AAE9B,YAAY,EACV,gBAAgB,EAChB,WAAW,EACX,UAAU,EACV,aAAa,EACb,OAAO,EACP,kBAAkB,EAClB,oBAAoB,EACpB,6BAA6B,EAC7B,4BAA4B,EAC5B,YAAY,EACZ,WAAW,GACZ,MAAM,8CAA8C,CAAC;AAEtD,OAAO,EACL,YAAY,EACZ,WAAW,EACX,sBAAsB,EACtB,YAAY,EACZ,yBAAyB,EACzB,6BAA6B,EAC7B,qBAAqB,GACtB,MAAM,8CAA8C,CAAC;AAEtD,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,iBAAiB,EACjB,sBAAsB,EACtB,YAAY,EACZ,cAAc,EACd,SAAS,EACT,KAAK,EACL,eAAe,GAChB,MAAM,6CAA6C,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAEvE,OAAO,EACL,SAAS,EACT,YAAY,EACZ,WAAW,EACX,aAAa,EACb,iBAAiB,EACjB,cAAc,EACd,cAAc,EACd,aAAa,GACd,MAAM,YAAY,CAAC;AAEpB,YAAY,EACV,OAAO,EACP,kBAAkB,EAClB,YAAY,EACZ,SAAS,EACT,YAAY,EACZ,QAAQ,EACR,OAAO,EACP,aAAa,GACd,MAAM,sBAAsB,CAAC;AAE9B,YAAY,EACV,gBAAgB,EAChB,WAAW,EACX,UAAU,EACV,aAAa,EACb,OAAO,EACP,kBAAkB,EAClB,oBAAoB,EACpB,6BAA6B,EAC7B,4BAA4B,EAC5B,YAAY,EACZ,WAAW,GACZ,MAAM,8CAA8C,CAAC;AAEtD,OAAO,EACL,YAAY,EACZ,WAAW,EACX,sBAAsB,EACtB,YAAY,EACZ,yBAAyB,EACzB,6BAA6B,EAC7B,qBAAqB,GACtB,MAAM,8CAA8C,CAAC;AAEtD,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,iBAAiB,EACjB,sBAAsB,EACtB,YAAY,EACZ,cAAc,EACd,SAAS,EACT,KAAK,EACL,eAAe,GAChB,MAAM,6CAA6C,CAAC"}