@vorionsys/security 1.0.0

package/dist/security/ai-governance/rate-limiter.d.ts

@@ -0,0 +1,156 @@
+/**
+ * AI-Specific Rate Limiting
+ * Token-based, cost-based, and quota-based rate limiting for AI models
+ * Vorion Security Platform
+ */
+import { EventEmitter } from 'events';
+import { RateLimitConfig, RateLimitRule, RateLimitStatus, BurstConfig, CostLimit } from './types';
+/**
+ * Rate limiter configuration
+ */
+export interface RateLimiterConfig {
+    enabled: boolean;
+    defaultLimits: RateLimitRule[];
+    defaultBurstConfig: BurstConfig;
+    defaultCostLimits: CostLimit[];
+    enforcementMode: 'strict' | 'warn' | 'log-only';
+    gracePeriodMs: number;
+    cleanupIntervalMs: number;
+}
+/**
+ * Usage window for tracking
+ */
+interface UsageWindow {
+    tokens: number;
+    requests: number;
+    cost: number;
+    windowStart: Date;
+    burstTokens: number;
+    burstStart?: Date;
+}
+/**
+ * Rate limit storage interface
+ */
+export interface RateLimitStorage {
+    getUsage(key: string): Promise<UsageWindow | null>;
+    setUsage(key: string, usage: UsageWindow, ttlSeconds: number): Promise<void>;
+    incrementUsage(key: string, tokens: number, cost: number, ttlSeconds: number): Promise<UsageWindow>;
+    getConfig(modelId: string): Promise<RateLimitConfig | null>;
+    setConfig(modelId: string, config: RateLimitConfig): Promise<void>;
+}
+/**
+ * In-memory rate limit storage
+ */
+export declare class InMemoryRateLimitStorage implements RateLimitStorage {
+    private usage;
+    private configs;
+    private cleanupInterval?;
+    constructor(cleanupIntervalMs?: number);
+    getUsage(key: string): Promise<UsageWindow | null>;
+    setUsage(key: string, usage: UsageWindow, _ttlSeconds: number): Promise<void>;
+    incrementUsage(key: string, tokens: number, cost: number, ttlSeconds: number): Promise<UsageWindow>;
+    getConfig(modelId: string): Promise<RateLimitConfig | null>;
+    setConfig(modelId: string, config: RateLimitConfig): Promise<void>;
+    private cleanup;
+    destroy(): void;
+}
+/**
+ * Rate limit check result
+ */
+export interface RateLimitCheckResult {
+    allowed: boolean;
+    status: RateLimitStatus;
+    violatedRules: RateLimitRule[];
+    warnings: string[];
+}
+/**
+ * AI Rate Limiter
+ * Enforces rate limits based on tokens, requests, and cost
+ */
+export declare class AIRateLimiter extends EventEmitter {
+    private config;
+    private storage;
+    private modelConfigs;
+    constructor(config?: Partial<RateLimiterConfig>, storage?: RateLimitStorage);
+    /**
+     * Configure rate limits for a specific model
+     */
+    configureModel(modelId: string, config: RateLimitConfig): Promise<void>;
+    /**
+     * Get rate limit configuration for a model
+     */
+    getModelConfig(modelId: string): Promise<RateLimitConfig>;
+    /**
+     * Check if a request is allowed
+     */
+    checkLimit(modelId: string, userId: string, estimatedTokens: number, estimatedCost: number, department?: string, organization?: string): Promise<RateLimitCheckResult>;
+    /**
+     * Record usage after a successful request
+     */
+    recordUsage(modelId: string, userId: string, tokens: number, cost: number, department?: string, organization?: string): Promise<void>;
+    /**
+     * Get current rate limit status
+     */
+    getStatus(modelId: string, userId: string, department?: string, organization?: string): Promise<RateLimitStatus>;
+    /**
+     * Reset rate limits for a user
+     */
+    resetLimits(modelId: string, userId: string, department?: string, organization?: string): Promise<void>;
+    /**
+     * Build storage key for rate limit tracking
+     */
+    private buildKey;
+    /**
+     * Calculate effective burst limit
+     */
+    private calculateBurstLimit;
+    /**
+     * Calculate remaining quota
+     */
+    private calculateRemainingQuota;
+    /**
+     * Get maximum window from config
+     */
+    private getMaxWindow;
+    /**
+     * Create an allowed result when rate limiting is disabled
+     */
+    private createAllowedResult;
+    /**
+     * Update global configuration
+     */
+    updateConfig(updates: Partial<RateLimiterConfig>): void;
+    /**
+     * Get current configuration
+     */
+    getConfig(): RateLimiterConfig;
+    /**
+     * Set cost limits for a scope
+     */
+    setCostLimits(modelId: string, costLimits: CostLimit[]): Promise<void>;
+    /**
+     * Get usage statistics for a model
+     */
+    getModelUsageStats(modelId: string, scope: RateLimitRule['scope'], scopeId?: string): Promise<{
+        totalTokens: number;
+        totalRequests: number;
+        totalCost: number;
+        windowStart: Date;
+        utilizationPercent: number;
+    }>;
+    /**
+     * Create a temporary limit override
+     */
+    createOverride(modelId: string, userId: string, overrideLimits: Partial<RateLimitRule>[], durationSeconds: number): Promise<void>;
+    /**
+     * Estimate if a request would exceed limits
+     */
+    estimateRequest(modelId: string, userId: string, estimatedTokens: number, estimatedCost: number): Promise<{
+        wouldExceed: boolean;
+        tokensRemaining: number;
+        costRemaining: number;
+        requestsRemaining: number;
+    }>;
+}
+export default AIRateLimiter;
+//# sourceMappingURL=rate-limiter.d.ts.map

package/dist/security/ai-governance/rate-limiter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limiter.d.ts","sourceRoot":"","sources":["../../../src/security/ai-governance/rate-limiter.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AACtC,OAAO,EACL,eAAe,EACf,aAAa,EACb,eAAe,EAGf,WAAW,EACX,SAAS,EACV,MAAM,SAAS,CAAC;AAEjB;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,OAAO,CAAC;IACjB,aAAa,EAAE,aAAa,EAAE,CAAC;IAC/B,kBAAkB,EAAE,WAAW,CAAC;IAChC,iBAAiB,EAAE,SAAS,EAAE,CAAC;IAC/B,eAAe,EAAE,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAC;IAChD,aAAa,EAAE,MAAM,CAAC;IACtB,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAED;;GAEG;AACH,UAAU,WAAW;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,IAAI,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,IAAI,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IACnD,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7E,cAAc,CACZ,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,WAAW,CAAC,CAAC;IACxB,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAAC;IAC5D,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACpE;AAED;;GAEG;AACH,qBAAa,wBAAyB,YAAW,gBAAgB;IAC/D,OAAO,CAAC,KAAK,CAAuC;IACpD,OAAO,CAAC,OAAO,CAA2C;IAC1D,OAAO,CAAC,eAAe,CAAC,CAAiC;gBAE7C,iBAAiB,GAAE,MAAc;IAKvC,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAgBlD,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI7E,cAAc,CAClB,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,WAAW,CAAC;IAqDjB,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC;IAI3D,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC;IAIxE,OAAO,CAAC,OAAO;IAWf,OAAO,IAAI,IAAI;CAKhB;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,eAAe,CAAC;IACxB,aAAa,EAAE,aAAa,EAAE,CAAC;IAC/B,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED;;;GAGG;AACH,qBAAa,aAAc,SAAQ,YAAY;IAC7C,OAAO,CAAC,MAAM,CAAoB;IAClC,OAAO,CAAC,OAAO,CAAmB;IAClC,OAAO,CAAC,YAAY,CAA2C;gBAEnD,MAAM,CAAC,EAAE,OAAO,CAAC,iBAAiB,CAAC,EAAE,OAAO,CAAC,EAAE,gBAAgB;IAgC3E;;OAEG;IACG,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC;IAK7E;;OAEG;IACG,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC;IAuB/D;;OAEG;IACG,UAAU,CACd,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,eAAe,EAAE,MAAM,EACvB,aAAa,EAAE,MAAM,EACrB,UAAU,CAAC,EAAE,MAAM,EACnB,YAAY,CAAC,EAAE,MAAM,GACpB,OAAO,CAAC,oBAAoB,CAAC;IA+FhC;;OAEG;IACG,WAAW,CACf,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,UAAU,CAAC,EAAE,MAAM,EACnB,YAAY,CAAC,EAAE,MAAM,GACpB,OAAO,CAAC,IAAI,CAAC;IAShB;;OAEG;IACG,SAAS,CACb,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,UAAU,CAAC,EAAE,MAAM,EACnB,YAAY,CAAC,EAAE,MAAM,GACpB,OAAO,CAAC,eAAe,CAAC;IAmE3B;;OAEG;IACG,WAAW,CACf,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,UAAU,CAAC,EAAE,MAAM,EACnB,YAAY,CAAC,EAAE,MAAM,GACpB,OAAO,CAAC,IAAI,CAAC;IAmBhB;;OAEG;IACH,OAAO,CAAC,QAAQ;IAqBhB;;OAEG;IACH,OAAO,CAAC,mBAAmB;IAgC3B;;OAEG;IACH,OAAO,CAAC,uBAAuB;IA6B/B;;OAEG;IACH,OAAO,CAAC,YAAY;IAIpB;;OAEG;IACH,OAAO,CAAC,mBAAmB;IA0B3B;;OAEG;IACH,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,iBAAiB,CAAC,GAAG,IAAI;IAIvD;;OAEG;IACH,SAAS,IAAI,iBAAiB;IAI9B;;OAEG;IACG,aAAa,CACjB,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,SAAS,EAAE,GACtB,OAAO,CAAC,IAAI,CAAC;IAMhB;;OAEG;IACG,kBAAkB,CACtB,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,aAAa,CAAC,OAAO,CAAC,EAC7B,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC;QACT,WAAW,EAAE,MAAM,CAAC;QACpB,aAAa,EAAE,MAAM,CAAC;QACtB,SAAS,EAAE,MAAM,CAAC;QAClB,WAAW,EAAE,IAAI,CAAC;QAClB,kBAAkB,EAAE,MAAM,CAAC;KAC5B,CAAC;IAwCF;;OAEG;IACG,cAAc,CAClB,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,cAAc,EAAE,OAAO,CAAC,aAAa,CAAC,EAAE,EACxC,eAAe,EAAE,MAAM,GACtB,OAAO,CAAC,IAAI,CAAC;IAoBhB;;OAEG;IACG,eAAe,CACnB,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,eAAe,EAAE,MAAM,EACvB,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC;QACT,WAAW,EAAE,OAAO,CAAC;QACrB,eAAe,EAAE,MAAM,CAAC;QACxB,aAAa,EAAE,MAAM,CAAC;QACtB,iBAAiB,EAAE,MAAM,CAAC;KAC3B,CAAC;CAaH;AAED,eAAe,aAAa,CAAC"}

package/dist/security/ai-governance/rate-limiter.js

@@ -0,0 +1,541 @@
+/**
+ * AI-Specific Rate Limiting
+ * Token-based, cost-based, and quota-based rate limiting for AI models
+ * Vorion Security Platform
+ */
+import { EventEmitter } from 'events';
+/**
+ * In-memory rate limit storage
+ */
+export class InMemoryRateLimitStorage {
+    usage = new Map();
+    configs = new Map();
+    cleanupInterval;
+    constructor(cleanupIntervalMs = 60000) {
+        // Periodic cleanup of expired entries
+        this.cleanupInterval = setInterval(() => this.cleanup(), cleanupIntervalMs);
+    }
+    async getUsage(key) {
+        const usage = this.usage.get(key);
+        if (!usage)
+            return null;
+        // Check if window has expired
+        const now = new Date();
+        const windowAge = now.getTime() - usage.windowStart.getTime();
+        if (windowAge > 3600000) {
+            // 1 hour default window
+            this.usage.delete(key);
+            return null;
+        }
+        return { ...usage };
+    }
+    async setUsage(key, usage, _ttlSeconds) {
+        this.usage.set(key, { ...usage });
+    }
+    async incrementUsage(key, tokens, cost, ttlSeconds) {
+        const existing = await this.getUsage(key);
+        const now = new Date();
+        if (!existing) {
+            const usage = {
+                tokens,
+                requests: 1,
+                cost,
+                windowStart: now,
+                burstTokens: tokens,
+                burstStart: now,
+            };
+            await this.setUsage(key, usage, ttlSeconds);
+            return usage;
+        }
+        // Check if we need to reset the window
+        const windowAge = now.getTime() - existing.windowStart.getTime();
+        if (windowAge > ttlSeconds * 1000) {
+            const usage = {
+                tokens,
+                requests: 1,
+                cost,
+                windowStart: now,
+                burstTokens: tokens,
+                burstStart: now,
+            };
+            await this.setUsage(key, usage, ttlSeconds);
+            return usage;
+        }
+        // Update existing usage
+        existing.tokens += tokens;
+        existing.requests += 1;
+        existing.cost += cost;
+        // Update burst tracking
+        const burstAge = existing.burstStart
+            ? now.getTime() - existing.burstStart.getTime()
+            : Infinity;
+        if (burstAge > 60000) {
+            // Reset burst window every minute
+            existing.burstTokens = tokens;
+            existing.burstStart = now;
+        }
+        else {
+            existing.burstTokens += tokens;
+        }
+        await this.setUsage(key, existing, ttlSeconds);
+        return existing;
+    }
+    async getConfig(modelId) {
+        return this.configs.get(modelId) || null;
+    }
+    async setConfig(modelId, config) {
+        this.configs.set(modelId, { ...config });
+    }
+    cleanup() {
+        const now = new Date();
+        for (const [key, usage] of this.usage.entries()) {
+            const age = now.getTime() - usage.windowStart.getTime();
+            if (age > 3600000) {
+                // Remove entries older than 1 hour
+                this.usage.delete(key);
+            }
+        }
+    }
+    destroy() {
+        if (this.cleanupInterval) {
+            clearInterval(this.cleanupInterval);
+        }
+    }
+}
+/**
+ * AI Rate Limiter
+ * Enforces rate limits based on tokens, requests, and cost
+ */
+export class AIRateLimiter extends EventEmitter {
+    config;
+    storage;
+    modelConfigs = new Map();
+    constructor(config, storage) {
+        super();
+        this.config = {
+            enabled: true,
+            defaultLimits: [
+                { type: 'request', limit: 100, window: 3600, scope: 'user', action: 'block' },
+                { type: 'token', limit: 100000, window: 3600, scope: 'user', action: 'block' },
+                { type: 'cost', limit: 10, window: 86400, scope: 'user', action: 'block' },
+            ],
+            defaultBurstConfig: {
+                enabled: true,
+                maxBurstMultiplier: 2,
+                recoveryTimeSeconds: 60,
+                burstWindowSeconds: 10,
+            },
+            defaultCostLimits: [
+                {
+                    scope: 'user',
+                    dailyLimit: 10,
+                    monthlyLimit: 100,
+                    currency: 'USD',
+                    alertThresholds: [0.5, 0.8, 0.95],
+                },
+            ],
+            enforcementMode: 'strict',
+            gracePeriodMs: 1000,
+            cleanupIntervalMs: 60000,
+            ...config,
+        };
+        this.storage = storage || new InMemoryRateLimitStorage(this.config.cleanupIntervalMs);
+    }
+    /**
+     * Configure rate limits for a specific model
+     */
+    async configureModel(modelId, config) {
+        this.modelConfigs.set(modelId, config);
+        await this.storage.setConfig(modelId, config);
+    }
+    /**
+     * Get rate limit configuration for a model
+     */
+    async getModelConfig(modelId) {
+        // Check cache first
+        if (this.modelConfigs.has(modelId)) {
+            return this.modelConfigs.get(modelId);
+        }
+        // Check storage
+        const stored = await this.storage.getConfig(modelId);
+        if (stored) {
+            this.modelConfigs.set(modelId, stored);
+            return stored;
+        }
+        // Return default config
+        return {
+            modelId,
+            limits: this.config.defaultLimits,
+            burstConfig: this.config.defaultBurstConfig,
+            costLimits: this.config.defaultCostLimits,
+            enforcementMode: this.config.enforcementMode,
+        };
+    }
+    /**
+     * Check if a request is allowed
+     */
+    async checkLimit(modelId, userId, estimatedTokens, estimatedCost, department, organization) {
+        if (!this.config.enabled) {
+            return this.createAllowedResult(modelId, userId);
+        }
+        const modelConfig = await this.getModelConfig(modelId);
+        const violatedRules = [];
+        const warnings = [];
+        // Check each limit rule
+        for (const rule of modelConfig.limits) {
+            const key = this.buildKey(modelId, rule.scope, userId, department, organization);
+            const usage = await this.storage.getUsage(key);
+            let currentValue = 0;
+            if (usage) {
+                switch (rule.type) {
+                    case 'request':
+                        currentValue = usage.requests;
+                        break;
+                    case 'token':
+                        currentValue = usage.tokens;
+                        break;
+                    case 'cost':
+                        currentValue = usage.cost;
+                        break;
+                }
+            }
+            // Check with burst allowance
+            let effectiveLimit = rule.limit;
+            if (modelConfig.burstConfig.enabled && rule.type === 'token') {
+                effectiveLimit = this.calculateBurstLimit(rule.limit, modelConfig.burstConfig, usage);
+            }
+            // Check estimated value
+            const projectedValue = currentValue + (rule.type === 'token' ? estimatedTokens : rule.type === 'cost' ? estimatedCost : 1);
+            if (projectedValue > effectiveLimit) {
+                if (rule.action === 'block' || modelConfig.enforcementMode === 'strict') {
+                    violatedRules.push(rule);
+                }
+                else {
+                    warnings.push(`${rule.type} limit warning: ${projectedValue}/${effectiveLimit} (${rule.scope})`);
+                }
+            }
+            // Check alert thresholds for cost limits
+            if (rule.type === 'cost') {
+                const costLimit = modelConfig.costLimits.find((c) => c.scope === rule.scope);
+                if (costLimit) {
+                    const dailyUsage = usage?.cost || 0;
+                    const dailyRatio = dailyUsage / costLimit.dailyLimit;
+                    for (const threshold of costLimit.alertThresholds) {
+                        if (dailyRatio >= threshold && dailyRatio - (estimatedCost / costLimit.dailyLimit) < threshold) {
+                            this.emit('cost:threshold-reached', {
+                                modelId,
+                                userId,
+                                threshold,
+                                currentUsage: dailyUsage,
+                                limit: costLimit.dailyLimit,
+                            });
+                        }
+                    }
+                }
+            }
+        }
+        // Determine if request is allowed
+        const allowed = violatedRules.length === 0 || this.config.enforcementMode === 'log-only';
+        // Build status
+        const status = await this.getStatus(modelId, userId, department, organization);
+        const result = {
+            allowed,
+            status,
+            violatedRules,
+            warnings,
+        };
+        if (!allowed) {
+            this.emit('rate-limit:exceeded', {
+                modelId,
+                userId,
+                violatedRules,
+                status,
+            });
+        }
+        return result;
+    }
+    /**
+     * Record usage after a successful request
+     */
+    async recordUsage(modelId, userId, tokens, cost, department, organization) {
+        const modelConfig = await this.getModelConfig(modelId);
+        for (const rule of modelConfig.limits) {
+            const key = this.buildKey(modelId, rule.scope, userId, department, organization);
+            await this.storage.incrementUsage(key, tokens, cost, rule.window);
+        }
+    }
+    /**
+     * Get current rate limit status
+     */
+    async getStatus(modelId, userId, department, organization) {
+        const modelConfig = await this.getModelConfig(modelId);
+        // Get user-level usage
+        const userKey = this.buildKey(modelId, 'user', userId);
+        const userUsage = await this.storage.getUsage(userKey);
+        const currentUsage = {
+            tokens: userUsage?.tokens || 0,
+            requests: userUsage?.requests || 0,
+            cost: userUsage?.cost || 0,
+            windowStart: userUsage?.windowStart || new Date(),
+        };
+        // Calculate remaining quota
+        const remainingQuota = this.calculateRemainingQuota(modelConfig, currentUsage);
+        // Check if currently limited
+        let isLimited = false;
+        let retryAfterSeconds;
+        for (const rule of modelConfig.limits) {
+            const key = this.buildKey(modelId, rule.scope, userId, department, organization);
+            const usage = await this.storage.getUsage(key);
+            if (usage) {
+                let currentValue = 0;
+                switch (rule.type) {
+                    case 'request':
+                        currentValue = usage.requests;
+                        break;
+                    case 'token':
+                        currentValue = usage.tokens;
+                        break;
+                    case 'cost':
+                        currentValue = usage.cost;
+                        break;
+                }
+                if (currentValue >= rule.limit) {
+                    isLimited = true;
+                    const windowEndTime = usage.windowStart.getTime() + rule.window * 1000;
+                    const secondsUntilReset = Math.ceil((windowEndTime - Date.now()) / 1000);
+                    retryAfterSeconds = retryAfterSeconds
+                        ? Math.min(retryAfterSeconds, secondsUntilReset)
+                        : secondsUntilReset;
+                }
+            }
+        }
+        // Calculate reset time
+        const resetAt = userUsage
+            ? new Date(userUsage.windowStart.getTime() + this.getMaxWindow(modelConfig) * 1000)
+            : new Date(Date.now() + this.getMaxWindow(modelConfig) * 1000);
+        return {
+            modelId,
+            userId,
+            isLimited,
+            currentUsage,
+            limits: modelConfig.limits,
+            resetAt,
+            retryAfterSeconds,
+            remainingQuota,
+        };
+    }
+    /**
+     * Reset rate limits for a user
+     */
+    async resetLimits(modelId, userId, department, organization) {
+        const modelConfig = await this.getModelConfig(modelId);
+        for (const rule of modelConfig.limits) {
+            const key = this.buildKey(modelId, rule.scope, userId, department, organization);
+            await this.storage.setUsage(key, {
+                tokens: 0,
+                requests: 0,
+                cost: 0,
+                windowStart: new Date(),
+                burstTokens: 0,
+            }, rule.window);
+        }
+    }
+    /**
+     * Build storage key for rate limit tracking
+     */
+    buildKey(modelId, scope, userId, department, organization) {
+        switch (scope) {
+            case 'user':
+                return `ratelimit:${modelId}:user:${userId}`;
+            case 'department':
+                return `ratelimit:${modelId}:dept:${department || 'default'}`;
+            case 'organization':
+                return `ratelimit:${modelId}:org:${organization || 'default'}`;
+            case 'global':
+                return `ratelimit:${modelId}:global`;
+            default:
+                return `ratelimit:${modelId}:user:${userId}`;
+        }
+    }
+    /**
+     * Calculate effective burst limit
+     */
+    calculateBurstLimit(baseLimit, burstConfig, usage) {
+        if (!burstConfig.enabled)
+            return baseLimit;
+        // If no recent burst activity, allow burst
+        if (!usage?.burstStart) {
+            return baseLimit * burstConfig.maxBurstMultiplier;
+        }
+        const burstAge = Date.now() - usage.burstStart.getTime();
+        const burstWindowMs = burstConfig.burstWindowSeconds * 1000;
+        // If within burst window and burst tokens used, reduce allowance
+        if (burstAge < burstWindowMs) {
+            const burstUsedRatio = usage.burstTokens / (baseLimit * burstConfig.maxBurstMultiplier);
+            if (burstUsedRatio > 0.5) {
+                return baseLimit; // Revert to base limit after heavy burst
+            }
+        }
+        // Check if in recovery period
+        const recoveryMs = burstConfig.recoveryTimeSeconds * 1000;
+        if (burstAge < recoveryMs && usage.burstTokens > baseLimit) {
+            return baseLimit; // No burst during recovery
+        }
+        return baseLimit * burstConfig.maxBurstMultiplier;
+    }
+    /**
+     * Calculate remaining quota
+     */
+    calculateRemainingQuota(config, currentUsage) {
+        let remainingTokens = Infinity;
+        let remainingRequests = Infinity;
+        let remainingCostBudget = Infinity;
+        for (const rule of config.limits) {
+            switch (rule.type) {
+                case 'token':
+                    remainingTokens = Math.min(remainingTokens, rule.limit - currentUsage.tokens);
+                    break;
+                case 'request':
+                    remainingRequests = Math.min(remainingRequests, rule.limit - currentUsage.requests);
+                    break;
+                case 'cost':
+                    remainingCostBudget = Math.min(remainingCostBudget, rule.limit - currentUsage.cost);
+                    break;
+            }
+        }
+        return {
+            tokens: Math.max(0, remainingTokens),
+            requests: Math.max(0, remainingRequests),
+            costBudget: Math.max(0, remainingCostBudget),
+        };
+    }
+    /**
+     * Get maximum window from config
+     */
+    getMaxWindow(config) {
+        return Math.max(...config.limits.map((l) => l.window));
+    }
+    /**
+     * Create an allowed result when rate limiting is disabled
+     */
+    createAllowedResult(modelId, userId) {
+        return {
+            allowed: true,
+            status: {
+                modelId,
+                userId,
+                isLimited: false,
+                currentUsage: {
+                    tokens: 0,
+                    requests: 0,
+                    cost: 0,
+                    windowStart: new Date(),
+                },
+                limits: [],
+                resetAt: new Date(),
+                remainingQuota: {
+                    tokens: Infinity,
+                    requests: Infinity,
+                    costBudget: Infinity,
+                },
+            },
+            violatedRules: [],
+            warnings: [],
+        };
+    }
+    /**
+     * Update global configuration
+     */
+    updateConfig(updates) {
+        this.config = { ...this.config, ...updates };
+    }
+    /**
+     * Get current configuration
+     */
+    getConfig() {
+        return { ...this.config };
+    }
+    /**
+     * Set cost limits for a scope
+     */
+    async setCostLimits(modelId, costLimits) {
+        const config = await this.getModelConfig(modelId);
+        config.costLimits = costLimits;
+        await this.configureModel(modelId, config);
+    }
+    /**
+     * Get usage statistics for a model
+     */
+    async getModelUsageStats(modelId, scope, scopeId) {
+        const config = await this.getModelConfig(modelId);
+        const key = this.buildKey(modelId, scope, scopeId || 'default');
+        const usage = await this.storage.getUsage(key);
+        if (!usage) {
+            return {
+                totalTokens: 0,
+                totalRequests: 0,
+                totalCost: 0,
+                windowStart: new Date(),
+                utilizationPercent: 0,
+            };
+        }
+        // Calculate utilization based on primary limit
+        const primaryLimit = config.limits.find((l) => l.type === 'token') || config.limits[0];
+        let currentValue = 0;
+        switch (primaryLimit.type) {
+            case 'token':
+                currentValue = usage.tokens;
+                break;
+            case 'request':
+                currentValue = usage.requests;
+                break;
+            case 'cost':
+                currentValue = usage.cost;
+                break;
+        }
+        const utilizationPercent = (currentValue / primaryLimit.limit) * 100;
+        return {
+            totalTokens: usage.tokens,
+            totalRequests: usage.requests,
+            totalCost: usage.cost,
+            windowStart: usage.windowStart,
+            utilizationPercent: Math.min(100, utilizationPercent),
+        };
+    }
+    /**
+     * Create a temporary limit override
+     */
+    async createOverride(modelId, userId, overrideLimits, durationSeconds) {
+        const config = await this.getModelConfig(modelId);
+        const overrideConfig = {
+            ...config,
+            limits: config.limits.map((limit) => {
+                const override = overrideLimits.find((o) => o.type === limit.type && o.scope === limit.scope);
+                return override ? { ...limit, ...override } : limit;
+            }),
+        };
+        // Store override with user-specific key
+        const overrideKey = `${modelId}:override:${userId}`;
+        this.modelConfigs.set(overrideKey, overrideConfig);
+        // Schedule removal of override
+        setTimeout(() => {
+            this.modelConfigs.delete(overrideKey);
+        }, durationSeconds * 1000);
+    }
+    /**
+     * Estimate if a request would exceed limits
+     */
+    async estimateRequest(modelId, userId, estimatedTokens, estimatedCost) {
+        const status = await this.getStatus(modelId, userId);
+        return {
+            wouldExceed: status.remainingQuota.tokens < estimatedTokens ||
+                status.remainingQuota.costBudget < estimatedCost ||
+                status.remainingQuota.requests < 1,
+            tokensRemaining: status.remainingQuota.tokens,
+            costRemaining: status.remainingQuota.costBudget,
+            requestsRemaining: status.remainingQuota.requests,
+        };
+    }
+}
+export default AIRateLimiter;
+//# sourceMappingURL=rate-limiter.js.map