vidspotai-shared 1.0.68 → 1.0.69-dev.0

package/lib/services/musicGen/providers/mubert.service.js

@@ -0,0 +1,128 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MubertMusicProvider = void 0;
+const axios_1 = __importDefault(require("axios"));
+const logger_1 = require("../../../utils/logger");
+/**
+ * Mubert generative music — Public API v3.
+ *
+ * Conceptually a "search" replacement: instead of looking up an existing
+ * track, we generate one from a prompt + duration. The provider presents the
+ * same MusicSearchProvider surface so the planner doesn't have to special-case it.
+ *
+ * Two-step flow:
+ *   1. POST /api/v3/public/tracks  → returns `data.id` (track id)
+ *   2. Poll GET /api/v3/public/tracks/{id} until
+ *      `data.generations[0].status === "done"`, then read `generations[0].url`.
+ *
+ * Auth: HTTP headers `customer-id` + `access-token`. These are minted per
+ * customer from the company-level `(company-id, license-token)` via
+ * `POST /api/v3/service/customers`. The company credentials must NEVER leave
+ * the server — we provision a customer at boot (or once per user) and cache
+ * the resulting customer pair. For now we accept pre-provisioned customer
+ * credentials via env: MUBERT_CUSTOMER_ID + MUBERT_ACCESS_TOKEN.
+ *
+ * Cost: pay-per-track per license tier; budget gates live in estimate_cost
+ * upstream — this provider just executes when called.
+ */
+const MUBERT_BASE_URL = "https://music-api.mubert.com/api/v3/public";
+const MUBERT_TIMEOUT_MS = 25000;
+const POLL_INTERVAL_MS = 1500;
+const MOOD_TO_PROMPT = {
+    energetic: "energetic upbeat pop",
+    cinematic: "cinematic orchestral epic",
+    calm: "calm ambient piano",
+    uplifting: "uplifting inspirational corporate",
+    dark: "dark moody trap",
+    acoustic: "acoustic folk guitar",
+    retro: "retro synthwave 80s",
+    quirky: "quirky playful indie",
+};
+class MubertMusicProvider {
+    constructor() {
+        this.source = "mubert";
+        this.customerId = process.env.MUBERT_CUSTOMER_ID;
+        this.accessToken = process.env.MUBERT_ACCESS_TOKEN;
+    }
+    isAvailable() {
+        return Boolean(this.customerId && this.accessToken);
+    }
+    async search(params) {
+        if (!this.customerId || !this.accessToken)
+            return { tracks: [] };
+        const prompt = (params.query
+            ?? (params.mood && MOOD_TO_PROMPT[params.mood.toLowerCase()])
+            ?? "energetic upbeat").slice(0, 200); // Mubert caps prompt at 200 chars
+        const duration = Math.max(30, params.durationSecMin ?? 60);
+        const headers = {
+            "customer-id": this.customerId,
+            "access-token": this.accessToken,
+            "Content-Type": "application/json",
+        };
+        try {
+            const startResp = await axios_1.default.post(`${MUBERT_BASE_URL}/tracks`, {
+                prompt,
+                duration,
+                bitrate: 128,
+                format: "mp3",
+                intensity: "medium",
+                mode: "track",
+            }, { headers, timeout: 8000 });
+            const trackId = startResp.data?.data?.id;
+            if (!trackId)
+                return { tracks: [] };
+            const trackUrl = await this.pollTrackUrl(trackId, headers);
+            if (!trackUrl)
+                return { tracks: [] };
+            return {
+                tracks: [
+                    {
+                        id: `mubert-${trackId}`,
+                        url: trackUrl,
+                        durationSec: duration,
+                        bpm: params.bpmTarget,
+                        mood: params.mood,
+                        attribution: "Mubert (generated)",
+                        source: "mubert",
+                    },
+                ],
+            };
+        }
+        catch (err) {
+            // Provider down or rejected the prompt — caller falls through, but log
+            // so we notice persistent failures.
+            logger_1.logger.error("mubert: search failed", {
+                query: prompt,
+                durationSec: duration,
+                err: err instanceof Error ? err.stack ?? err.message : String(err),
+            });
+            return { tracks: [] };
+        }
+    }
+    async pollTrackUrl(trackId, headers) {
+        const deadline = Date.now() + MUBERT_TIMEOUT_MS;
+        while (Date.now() < deadline) {
+            try {
+                const resp = await axios_1.default.get(`${MUBERT_BASE_URL}/tracks/${trackId}`, { headers, timeout: 5000 });
+                const gen = resp.data?.data?.generations?.[0];
+                if (gen?.status === "done" && gen.url)
+                    return gen.url;
+                if (gen?.status === "failed")
+                    return undefined;
+            }
+            catch (err) {
+                // Transient — retry next tick, but log so a persistent poll loop is visible.
+                logger_1.logger.warn("mubert: track poll transient error", {
+                    trackId,
+                    err: err instanceof Error ? err.stack ?? err.message : String(err),
+                });
+            }
+            await new Promise((r) => setTimeout(r, POLL_INTERVAL_MS));
+        }
+        return undefined;
+    }
+}
+exports.MubertMusicProvider = MubertMusicProvider;

package/lib/services/musicGen/types.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Music search/generation provider surface used by the agent's `search_music`
+ * tool and the post-planner `selectMusicForPlan` step.
+ *
+ * Three sources ship under one interface deliberately — the planner doesn't
+ * care whether a track is curated, fetched, or generated; it only needs
+ * `{ url, bpm, durationSec }` to drive the beat-snap pass.
+ */
+export type MusicSource = "curated" | "jamendo" | "mubert";
+export interface MusicSearchParams {
+    query?: string;
+    /** "energetic" / "cinematic" / "calm" / "uplifting" / "dark" / "quirky" / "retro" / "acoustic". */
+    mood?: string;
+    /** Soft target — providers prefer matches near this BPM but may return others. */
+    bpmTarget?: number;
+    bpmMin?: number;
+    bpmMax?: number;
+    /** Required minimum length so the track covers the whole video. */
+    durationSecMin?: number;
+    /** Hard upper bound on duration (paired with min for server-side filter). */
+    durationSecMax?: number;
+    /** Jamendo: prefer vocal vs instrumental tracks (useful when video has VO). */
+    vocalInstrumental?: "vocal" | "instrumental";
+    /** Cap result count. */
+    limit?: number;
+}
+export interface MusicTrack {
+    id: string;
+    url: string;
+    durationSec: number;
+    bpm?: number;
+    mood?: string;
+    tags?: string[];
+    attribution?: string;
+    source: MusicSource;
+}
+export interface MusicSearchResult {
+    tracks: MusicTrack[];
+}
+export interface MusicSearchProvider {
+    source: MusicSource;
+    /** True when the provider is configured (env vars / catalog) and ready to call. */
+    isAvailable(): boolean;
+    search(params: MusicSearchParams): Promise<MusicSearchResult>;
+}
+//# sourceMappingURL=types.d.ts.map

package/lib/services/musicGen/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/services/musicGen/types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,MAAM,MAAM,WAAW,GAAG,SAAS,GAAG,SAAS,GAAG,QAAQ,CAAC;AAE3D,MAAM,WAAW,iBAAiB;IAChC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,mGAAmG;IACnG,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,kFAAkF;IAClF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,mEAAmE;IACnE,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,6EAA6E;IAC7E,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,+EAA+E;IAC/E,iBAAiB,CAAC,EAAE,OAAO,GAAG,cAAc,CAAC;IAC7C,wBAAwB;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,EAAE,MAAM,CAAC;IACpB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,WAAW,CAAC;CACrB;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,UAAU,EAAE,CAAC;CACtB;AAED,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,WAAW,CAAC;IACpB,mFAAmF;IACnF,WAAW,IAAI,OAAO,CAAC;IACvB,MAAM,CAAC,MAAM,EAAE,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;CAC/D"}

package/lib/services/musicGen/types.js

@@ -0,0 +1,10 @@
+"use strict";
+/**
+ * Music search/generation provider surface used by the agent's `search_music`
+ * tool and the post-planner `selectMusicForPlan` step.
+ *
+ * Three sources ship under one interface deliberately — the planner doesn't
+ * care whether a track is curated, fetched, or generated; it only needs
+ * `{ url, bpm, durationSec }` to drive the beat-snap pass.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });

package/lib/services/notification.service.d.ts

@@ -0,0 +1,22 @@
+import { ENotificationSeverity, ENotificationType } from "../globals/types";
+export interface CreateNotificationInput {
+    userId: string;
+    type: ENotificationType;
+    severity?: ENotificationSeverity;
+    title: string;
+    body?: string;
+    link?: string;
+    data?: Record<string, unknown>;
+}
+/**
+ * Writes an in-app notification doc IF the user hasn't muted this type.
+ *
+ * Best-effort: failures are logged but never re-thrown — callers (worker
+ * processors, webhook handlers, credit service) should not be blocked by a
+ * notification write. The user reads via Firestore onSnapshot, so a missed
+ * write just means a missing bell entry, not a broken job.
+ */
+export declare class NotificationService {
+    static create(input: CreateNotificationInput): Promise<string | null>;
+}
+//# sourceMappingURL=notification.service.d.ts.map

package/lib/services/notification.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"notification.service.d.ts","sourceRoot":"","sources":["../../src/services/notification.service.ts"],"names":[],"mappings":"AACA,OAAO,EAEL,qBAAqB,EACrB,iBAAiB,EAClB,MAAM,kBAAkB,CAAC;AAM1B,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,iBAAiB,CAAC;IACxB,QAAQ,CAAC,EAAE,qBAAqB,CAAC;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC;AAED;;;;;;;GAOG;AACH,qBAAa,mBAAmB;WACjB,MAAM,CAAC,KAAK,EAAE,uBAAuB,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;CA+B5E"}

package/lib/services/notification.service.js

@@ -0,0 +1,76 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.NotificationService = void 0;
+const firestore_1 = require("firebase-admin/firestore");
+const types_1 = require("../globals/types");
+const logger_1 = require("../utils/logger");
+const firestore_service_1 = require("./firestore.service");
+/**
+ * Writes an in-app notification doc IF the user hasn't muted this type.
+ *
+ * Best-effort: failures are logged but never re-thrown — callers (worker
+ * processors, webhook handlers, credit service) should not be blocked by a
+ * notification write. The user reads via Firestore onSnapshot, so a missed
+ * write just means a missing bell entry, not a broken job.
+ */
+class NotificationService {
+    static async create(input) {
+        try {
+            const user = await firestore_service_1.FirestoreService.getUserById(input.userId);
+            if (!user)
+                return null;
+            if (!isEnabled(user, input.type))
+                return null;
+            const doc = {
+                userId: input.userId,
+                type: input.type,
+                severity: input.severity ?? defaultSeverity(input.type),
+                title: input.title,
+                ...(input.body && { body: input.body }),
+                ...(input.link && { link: input.link }),
+                ...(input.data && { data: input.data }),
+                read: false,
+                createdAt: firestore_1.FieldValue.serverTimestamp(),
+            };
+            const ref = await firestore_service_1.FirestoreService.appendNewRecord(firestore_service_1.FirestoreService.notificationsCol, doc);
+            return ref.id;
+        }
+        catch (err) {
+            // Intentionally swallowed for caller — notifications must never break the
+            // worker / webhook handler / credit service. But surface to ops so we
+            // notice persistent write failures.
+            logger_1.logger.error("notification create failed", {
+                userId: input.userId,
+                type: input.type,
+                err: err instanceof Error ? err.stack ?? err.message : String(err),
+            });
+            return null;
+        }
+    }
+}
+exports.NotificationService = NotificationService;
+function isEnabled(user, type) {
+    const prefs = user.notificationPreferences ?? {};
+    if (type in prefs)
+        return prefs[type] !== false;
+    return types_1.DEFAULT_NOTIFICATION_PREFERENCES[type] !== false;
+}
+function defaultSeverity(type) {
+    switch (type) {
+        case types_1.ENotificationType.VIDEO_FAILED:
+        case types_1.ENotificationType.IMAGE_FAILED:
+        case types_1.ENotificationType.SUBSCRIPTION_PAYMENT_FAILED:
+            return types_1.ENotificationSeverity.ERROR;
+        case types_1.ENotificationType.VIDEO_PARTIAL:
+        case types_1.ENotificationType.CREDITS_LOW:
+        case types_1.ENotificationType.SUBSCRIPTION_TRIAL_ENDING:
+        case types_1.ENotificationType.SUBSCRIPTION_CANCELED:
+            return types_1.ENotificationSeverity.WARNING;
+        case types_1.ENotificationType.VIDEO_COMPLETED:
+        case types_1.ENotificationType.IMAGE_COMPLETED:
+        case types_1.ENotificationType.SUBSCRIPTION_RENEWED:
+            return types_1.ENotificationSeverity.SUCCESS;
+        default:
+            return types_1.ENotificationSeverity.INFO;
+    }
+}

package/lib/services/rateLimiter/distributedRateLimiter.service.d.ts

@@ -0,0 +1,78 @@
+import { TAiGenModel } from "../../globals/aiModels";
+import { TtsProvider } from "../../globals/ttsModels/types";
+/**
+ * DistributedRateLimiter — three-tier provider quota gate.
+ *
+ *   concurrent  (in-process, Promise wait queue, single-process-correct)
+ *   per-minute  (Redis sliding-window sorted set, atomic via Lua)
+ *   per-day     (Redis counter with midnight-UTC TTL, atomic via Lua)
+ *
+ * Replaces the original in-memory AiGenModelRateLimiter so the per-minute
+ * and per-day quotas survive process restarts — the old version's counters
+ * reset on every nodemon reload / deploy, which let us blow past a provider's
+ * daily cap with a few restarts.
+ *
+ * API mirrors the old class (`waitUntilAvailable()` + `releaseSlot()`) so the
+ * legacy /v1/video processors don't need any callsite changes. Two new entry
+ * points added for the agent path:
+ *   - waitUntilAvailableForOneShot(): used by poll calls that consume rate
+ *     budget but should NOT count toward the concurrent-in-flight cap.
+ *   - snapshot(): used by /health/rate-limits for live utilization.
+ *
+ * Single-process design: concurrent counter is intentionally in-process — at
+ * one Express server it's a true global cap with zero Redis round-trip. If
+ * we ever scale horizontally that gate alone needs promoting to Redis; the
+ * caller API stays the same.
+ */
+interface DistributedRateLimiterConfig {
+    concurrentRequests?: number;
+    requestPerMin?: number;
+    requestPerDay?: number;
+}
+export interface LimiterSnapshot {
+    modelKey: string;
+    active: number;
+    waitQueueDepth: number;
+    perMinUsed: number;
+    perDayUsed: number;
+    concurrentLimit?: number;
+    perMinLimit?: number;
+    perDayLimit?: number;
+}
+export declare class DistributedRateLimiter {
+    private readonly modelKey;
+    private readonly concurrentLimit;
+    private readonly perMinLimit;
+    private readonly perDayLimit;
+    private activeRequests;
+    private waitQueue;
+    constructor(modelKey: string, config: DistributedRateLimiterConfig);
+    /**
+     * Block until concurrent + per-min + per-day all have headroom, then claim
+     * a slot in each. Caller MUST call releaseSlot() when the in-flight task
+     * settles — per-min / per-day auto-expire but the concurrent counter does
+     * not. Mirrors the old AiGenModelRateLimiter API.
+     */
+    waitUntilAvailable(): Promise<void>;
+    /**
+     * Bumps per-min + per-day only — does NOT count toward the concurrent cap.
+     * Use for short-lived calls that share a provider's rate budget but aren't
+     * "in-flight tasks" (status polls, sync image/TTS gens that complete in the
+     * same call). No release is needed — Redis auto-expires the counters.
+     */
+    waitUntilAvailableForOneShot(): Promise<void>;
+    /** Free a concurrent slot acquired via waitUntilAvailable(). */
+    releaseSlot(): void;
+    get activeConcurrentCount(): number;
+    snapshot(): Promise<LimiterSnapshot>;
+    private acquireConcurrent;
+    private releaseConcurrent;
+    private consumeRedisGates;
+}
+export declare function getAiGenModelRateLimiter(modelKey: TAiGenModel): DistributedRateLimiter;
+export declare function getTtsProviderRateLimiter(provider: TtsProvider): DistributedRateLimiter;
+/** Snapshot every limiter that has ever been instantiated. Used by the
+ *  /health/rate-limits endpoint for live ops visibility. */
+export declare function snapshotAllRateLimiters(): Promise<LimiterSnapshot[]>;
+export {};
+//# sourceMappingURL=distributedRateLimiter.service.d.ts.map

package/lib/services/rateLimiter/distributedRateLimiter.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"distributedRateLimiter.service.d.ts","sourceRoot":"","sources":["../../../src/services/rateLimiter/distributedRateLimiter.service.ts"],"names":[],"mappings":"AACA,OAAO,EAAkB,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAErE,OAAO,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAU5D;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,UAAU,4BAA4B;IACpC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAuDD,qBAAa,sBAAsB;IACjC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAS;IACzC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IACrC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IAErC,OAAO,CAAC,cAAc,CAAK;IAC3B,OAAO,CAAC,SAAS,CAAyB;gBAE9B,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,4BAA4B;IAOlE;;;;;OAKG;IACG,kBAAkB,IAAI,OAAO,CAAC,IAAI,CAAC;IAUzC;;;;;OAKG;IACG,4BAA4B,IAAI,OAAO,CAAC,IAAI,CAAC;IAInD,gEAAgE;IAChE,WAAW,IAAI,IAAI;IAInB,IAAI,qBAAqB,IAAI,MAAM,CAElC;IAEK,QAAQ,IAAI,OAAO,CAAC,eAAe,CAAC;YAoC5B,iBAAiB;IAc/B,OAAO,CAAC,iBAAiB;YAQX,iBAAiB;CA6DhC;AAwBD,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,WAAW,GACpB,sBAAsB,CAaxB;AAED,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,WAAW,GACpB,sBAAsB,CAexB;AAED;4DAC4D;AAC5D,wBAAsB,uBAAuB,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC,CAM1E"}

package/lib/services/rateLimiter/distributedRateLimiter.service.js

@@ -0,0 +1,269 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DistributedRateLimiter = void 0;
+exports.getAiGenModelRateLimiter = getAiGenModelRateLimiter;
+exports.getTtsProviderRateLimiter = getTtsProviderRateLimiter;
+exports.snapshotAllRateLimiters = snapshotAllRateLimiters;
+const crypto_1 = __importDefault(require("crypto"));
+const aiModels_1 = require("../../globals/aiModels");
+const ttsModels_1 = require("../../globals/ttsModels");
+const logger_1 = require("../../utils/logger");
+const redis_service_1 = require("../redis.service");
+// Module-level throttle so Redis outages don't fire a Slack error every
+// request. First failure goes through; subsequent failures within the
+// window log at warn level (Console + Loki only) until the window resets.
+const RATE_LIMITER_ERROR_THROTTLE_MS = 60000;
+let lastRateLimiterErrorLoggedAt = 0;
+/**
+ * Atomic Redis check-and-consume for per-min + per-day gates. Returns
+ *   { 1, 0, "ok"  }   — both gates passed, slot consumed
+ *   { 0, retryMs, "min"|"day" } — gate hit, caller should sleep retryMs and retry
+ *
+ * Per-minute is a sorted-set sliding window (score = ms timestamp). Per-day
+ * is a plain counter keyed by UTC date with TTL set on first INCR to
+ * seconds-until-midnight, so the key self-expires.
+ */
+const CONSUME_SCRIPT = `
+local minKey = KEYS[1]
+local dayKey = KEYS[2]
+local nowMs = tonumber(ARGV[1])
+local minLimit = tonumber(ARGV[2])
+local dayLimit = tonumber(ARGV[3])
+local secsTilMidnight = tonumber(ARGV[4])
+local uniqueId = ARGV[5]
+
+redis.call('ZREMRANGEBYSCORE', minKey, 0, nowMs - 60000)
+
+if minLimit > 0 then
+  local minCount = redis.call('ZCARD', minKey)
+  if minCount >= minLimit then
+    local oldest = redis.call('ZRANGE', minKey, 0, 0, 'WITHSCORES')
+    local retryMs = 1000
+    if oldest[2] then
+      retryMs = 60000 - (nowMs - tonumber(oldest[2]))
+      if retryMs < 50 then retryMs = 50 end
+      if retryMs > 60000 then retryMs = 60000 end
+    end
+    return { 0, retryMs, 'min' }
+  end
+end
+
+if dayLimit > 0 then
+  local dayCount = tonumber(redis.call('GET', dayKey) or '0')
+  if dayCount >= dayLimit then
+    local retryMs = secsTilMidnight * 1000
+    if retryMs > 60000 then retryMs = 60000 end
+    return { 0, retryMs, 'day' }
+  end
+end
+
+redis.call('ZADD', minKey, nowMs, uniqueId)
+redis.call('PEXPIRE', minKey, 90000)
+local newDay = redis.call('INCR', dayKey)
+if newDay == 1 then
+  redis.call('EXPIRE', dayKey, secsTilMidnight)
+end
+
+return { 1, 0, 'ok' }
+`;
+class DistributedRateLimiter {
+    constructor(modelKey, config) {
+        this.activeRequests = 0;
+        this.waitQueue = [];
+        this.modelKey = modelKey;
+        this.concurrentLimit = config.concurrentRequests ?? 0;
+        this.perMinLimit = config.requestPerMin ?? 0;
+        this.perDayLimit = config.requestPerDay ?? 0;
+    }
+    /**
+     * Block until concurrent + per-min + per-day all have headroom, then claim
+     * a slot in each. Caller MUST call releaseSlot() when the in-flight task
+     * settles — per-min / per-day auto-expire but the concurrent counter does
+     * not. Mirrors the old AiGenModelRateLimiter API.
+     */
+    async waitUntilAvailable() {
+        await this.acquireConcurrent();
+        try {
+            await this.consumeRedisGates();
+        }
+        catch (err) {
+            this.releaseConcurrent();
+            throw err;
+        }
+    }
+    /**
+     * Bumps per-min + per-day only — does NOT count toward the concurrent cap.
+     * Use for short-lived calls that share a provider's rate budget but aren't
+     * "in-flight tasks" (status polls, sync image/TTS gens that complete in the
+     * same call). No release is needed — Redis auto-expires the counters.
+     */
+    async waitUntilAvailableForOneShot() {
+        await this.consumeRedisGates();
+    }
+    /** Free a concurrent slot acquired via waitUntilAvailable(). */
+    releaseSlot() {
+        this.releaseConcurrent();
+    }
+    get activeConcurrentCount() {
+        return this.activeRequests;
+    }
+    async snapshot() {
+        const snap = {
+            modelKey: this.modelKey,
+            active: this.activeRequests,
+            waitQueueDepth: this.waitQueue.length,
+            perMinUsed: 0,
+            perDayUsed: 0,
+            concurrentLimit: this.concurrentLimit || undefined,
+            perMinLimit: this.perMinLimit || undefined,
+            perDayLimit: this.perDayLimit || undefined,
+        };
+        const client = redis_service_1.redis.getClient();
+        if (!client)
+            return snap;
+        const minKey = `ratelimit:${this.modelKey}:min`;
+        const dayKey = `ratelimit:${this.modelKey}:day:${utcDateKey()}`;
+        try {
+            const [minCount, dayCountRaw] = await Promise.all([
+                client.zcount(minKey, Date.now() - 60000, "+inf"),
+                client.get(dayKey),
+            ]);
+            snap.perMinUsed = minCount;
+            snap.perDayUsed = dayCountRaw ? Number(dayCountRaw) : 0;
+        }
+        catch (err) {
+            // best-effort; leave snapshot zeros if Redis blips
+            logger_1.logger.warn("distributedRateLimiter: snapshot read failed", {
+                modelKey: this.modelKey,
+                err: err instanceof Error ? err.stack ?? err.message : String(err),
+            });
+        }
+        return snap;
+    }
+    // ── Internals ──────────────────────────────────────────────────────────
+    async acquireConcurrent() {
+        if (!this.concurrentLimit) {
+            this.activeRequests++;
+            return;
+        }
+        while (this.activeRequests >= this.concurrentLimit) {
+            // Promise wait queue — woken by releaseConcurrent. Replaces the old
+            // 1s setTimeout busy-poll; latency drops from up-to-1s to ~0ms when
+            // a slot frees.
+            await new Promise((resolve) => this.waitQueue.push(resolve));
+        }
+        this.activeRequests++;
+    }
+    releaseConcurrent() {
+        if (this.activeRequests > 0) {
+            this.activeRequests--;
+        }
+        const next = this.waitQueue.shift();
+        if (next)
+            next();
+    }
+    async consumeRedisGates() {
+        if (!this.perMinLimit && !this.perDayLimit)
+            return;
+        const client = redis_service_1.redis.getClient();
+        if (!client) {
+            // REDIS_URL unset (local dev with caching off, or a degraded boot).
+            // Fail open — a missed gate is better than blocking the entire
+            // generation pipeline. The legacy in-memory limiter behaved the
+            // same way (no Redis dependency at all).
+            return;
+        }
+        const minKey = `ratelimit:${this.modelKey}:min`;
+        const secsTilMidnight = secsUntilMidnight();
+        const uniqueId = `${Date.now()}-${crypto_1.default.randomBytes(4).toString("hex")}`;
+        while (true) {
+            const nowMs = Date.now();
+            // Day key resolved per-iteration so a retry across midnight UTC
+            // rolls into the new day's counter naturally.
+            const dayKey = `ratelimit:${this.modelKey}:day:${utcDateKey()}`;
+            let result;
+            try {
+                result = (await client.eval(CONSUME_SCRIPT, 2, minKey, dayKey, String(nowMs), String(this.perMinLimit), String(this.perDayLimit), String(secsTilMidnight), uniqueId));
+            }
+            catch (err) {
+                // Redis blip — fail open rather than blocking the pipeline. Throttle
+                // the Slack-routed error so a sustained Redis outage doesn't fire a
+                // ping per request; subsequent failures inside the window log at
+                // warn (Console + Loki only).
+                const now = Date.now();
+                const errMeta = {
+                    key: `${this.modelKey}`,
+                    modelKey: this.modelKey,
+                    err: err instanceof Error ? err.stack ?? err.message : String(err),
+                };
+                if (now - lastRateLimiterErrorLoggedAt > RATE_LIMITER_ERROR_THROTTLE_MS) {
+                    lastRateLimiterErrorLoggedAt = now;
+                    logger_1.logger.error("distributedRateLimiter: Redis EVAL failed, fail-open active", errMeta);
+                }
+                else {
+                    logger_1.logger.warn("distributedRateLimiter: Redis EVAL failed, fail-open active (throttled)", errMeta);
+                }
+                return;
+            }
+            if (result[0] === 1)
+                return;
+            const waitMs = Math.max(50, Math.min(1000, result[1]));
+            await sleep(waitMs);
+        }
+    }
+}
+exports.DistributedRateLimiter = DistributedRateLimiter;
+function utcDateKey() {
+    // YYYY-MM-DD in UTC — matches the TTL set on first INCR
+    return new Date().toISOString().slice(0, 10);
+}
+function secsUntilMidnight() {
+    const now = new Date();
+    const midnight = new Date(Date.UTC(now.getUTCFullYear(), now.getUTCMonth(), now.getUTCDate() + 1));
+    return Math.ceil((midnight.getTime() - now.getTime()) / 1000);
+}
+function sleep(ms) {
+    return new Promise((r) => setTimeout(r, ms));
+}
+// ── Singleton registries ─────────────────────────────────────────────────
+const aiModelLimiters = {};
+const ttsProviderLimiters = {};
+function getAiGenModelRateLimiter(modelKey) {
+    if (!aiModelLimiters[modelKey]) {
+        const config = aiModels_1.aiModelConfigs[modelKey];
+        if (!config) {
+            throw new Error(`No model config for model key: ${modelKey}`);
+        }
+        aiModelLimiters[modelKey] = new DistributedRateLimiter(modelKey, {
+            concurrentRequests: config.concurrentRequests,
+            requestPerMin: config.requestPerMin,
+            requestPerDay: config.requestPerDay,
+        });
+    }
+    return aiModelLimiters[modelKey];
+}
+function getTtsProviderRateLimiter(provider) {
+    if (!ttsProviderLimiters[provider]) {
+        const config = ttsModels_1.ttsProviderConfigs[provider];
+        if (!config) {
+            throw new Error(`No TTS provider config for: ${provider}`);
+        }
+        ttsProviderLimiters[provider] = new DistributedRateLimiter(`tts:${provider}`, {
+            concurrentRequests: config.concurrentRequests,
+            requestPerMin: config.requestPerMin,
+        });
+    }
+    return ttsProviderLimiters[provider];
+}
+/** Snapshot every limiter that has ever been instantiated. Used by the
+ *  /health/rate-limits endpoint for live ops visibility. */
+async function snapshotAllRateLimiters() {
+    const all = [
+        ...Object.values(aiModelLimiters),
+        ...Object.values(ttsProviderLimiters),
+    ];
+    return Promise.all(all.map((l) => l.snapshot()));
+}

package/lib/services/rateLimiter/index.d.ts

@@ -0,0 +1,2 @@
+export * from "./distributedRateLimiter.service";
+//# sourceMappingURL=index.d.ts.map

package/lib/services/rateLimiter/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/services/rateLimiter/index.ts"],"names":[],"mappings":"AAAA,cAAc,kCAAkC,CAAC"}

package/lib/services/rateLimiter/index.js

@@ -0,0 +1,17 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./distributedRateLimiter.service"), exports);