type LLMGateway struct {
    authService      *AuthService
    rateLimiter      *RateLimiter
    cacheManager     *CacheManager
    modelRouter      *ModelRouter
    costTracker      *CostTracker
    piiDetector      *PIIDetector
    metricsCollector *MetricsCollector
}

type InferenceRequest struct {
    RequestID    string
    TeamID       string
    ProjectID    string
    UserID       string
    Prompt       string
    ModelHint    string  // Optional: preferred model
    MaxTokens    int
    Temperature  float64
    Priority     Priority // HIGH, MEDIUM, LOW
    Metadata     map[string]string
    CachePolicy  CachePolicy
}

type InferenceResponse struct {
    RequestID       string
    Response        string
    ModelUsed       string
    TokensUsed      TokenUsage
    Latency         time.Duration
    CacheHit        bool
    Cost            Cost
    Metadata        map[string]string
}

type TokenUsage struct {
    PromptTokens     int
    CompletionTokens int
    TotalTokens      int
}

type Cost struct {
    Amount       float64
    Currency     string
    ModelCost    float64
    CacheSavings float64
}

func (g *LLMGateway) ProcessRequest(ctx context.Context, req *InferenceRequest) (*InferenceResponse, error) {
    // 1. Authentication & Authorization
    team, err := g.authService.Authenticate(ctx, req)
    if err != nil {
        return nil, fmt.Errorf("auth failed: %w", err)
    }
    
    // 2. Rate Limiting & Quota Check
    allowed, err := g.rateLimiter.CheckAndConsume(ctx, team.ID, req)
    if err != nil {
        return nil, fmt.Errorf("rate limit check failed: %w", err)
    }
    if !allowed {
        return nil, ErrRateLimitExceeded
    }
    
    // 3. PII Detection & Redaction (async for performance)
    go g.piiDetector.ScanAndLog(ctx, req)
    
    // 4. Cache Lookup
    if cachedResp, found := g.cacheManager.Get(ctx, req); found {
        g.metricsCollector.RecordCacheHit(team.ID)
        return cachedResp, nil
    }
    
    // 5. Model Selection & Routing
    model, err := g.modelRouter.SelectModel(ctx, team, req)
    if err != nil {
        return nil, fmt.Errorf("model selection failed: %w", err)
    }
    
    // 6. Execute Inference
    startTime := time.Now()
    resp, err := model.Generate(ctx, req)
    if err != nil {
        return nil, fmt.Errorf("inference failed: %w", err)
    }
    latency := time.Since(startTime)
    
    // 7. Cost Attribution
    cost := g.costTracker.CalculateCost(model, resp.TokensUsed)
    g.costTracker.RecordUsage(ctx, team.ID, req.ProjectID, cost)
    
    // 8. Cache Response (async)
    go g.cacheManager.Set(ctx, req, resp)
    
    // 9. Metrics & Logging
    g.metricsCollector.RecordRequest(team.ID, model.Name, latency, cost)
    
    return &InferenceResponse{
        RequestID:       req.RequestID,
        Response:        resp.Text,
        ModelUsed:       model.Name,
        TokensUsed:      resp.TokensUsed,
        Latency:         latency,
        CacheHit:        false,
        Cost:            cost,
    }, nil
}

type AuthService struct {
    apiKeyStore    *APIKeyStore
    jwtValidator   *JWTValidator
    rbacEngine     *RBACEngine
    auditLogger    *AuditLogger
}

type Team struct {
    ID              string
    Name            string
    Tier            TeamTier  // FREE, STANDARD, PREMIUM, ENTERPRISE
    Quotas          Quotas
    AllowedModels   []string
    CostCenter      string
    Admins          []string
}

type TeamTier int
const (
    TierFree TeamTier = iota
    TierStandard
    TierPremium
    TierEnterprise
)

type Quotas struct {
    TokensPerMinute      int
    RequestsPerSecond    int
    ConcurrentRequests   int
    MonthlyTokenQuota    int64
    MonthlyBudget        float64
    DailyBudget          float64
}

func (a *AuthService) Authenticate(ctx context.Context, req *InferenceRequest) (*Team, error) {
    // Extract API key or JWT from request
    token := extractToken(req)
    
    // Validate token
    claims, err := a.jwtValidator.Validate(token)
    if err != nil {
        a.auditLogger.LogFailedAuth(req, err)
        return nil, ErrUnauthorized
    }
    
    // Load team configuration
    team, err := a.loadTeam(claims.TeamID)
    if err != nil {
        return nil, err
    }
    
    // Check RBAC permissions
    if !a.rbacEngine.HasPermission(claims.UserID, "llm:inference") {
        return nil, ErrForbidden
    }
    
    // Audit log
    a.auditLogger.LogAuth(req, team, claims.UserID)
    
    return team, nil
}

type RateLimiter struct {
    redis          *redis.Client
    quotaStore     *QuotaStore
    alertManager   *AlertManager
}

type RateLimitConfig struct {
    TeamID                string
    TokensPerMinute       int
    RequestsPerSecond     int
    ConcurrentRequests    int
    MonthlyTokenQuota     int64
    BurstAllowance        int  // Allow temporary bursts
}

// Multi-dimensional rate limiting check
func (r *RateLimiter) CheckAndConsume(ctx context.Context, teamID string, req *InferenceRequest) (bool, error) {
    config, err := r.quotaStore.GetConfig(teamID)
    if err != nil {
        return false, err
    }
    
    // 1. Check concurrent requests (using Redis counter)
    concurrent, err := r.checkConcurrentRequests(ctx, teamID, config.ConcurrentRequests)
    if err != nil || !concurrent {
        return false, ErrConcurrentLimitExceeded
    }
    
    // 2. Check requests per second (sliding window)
    rps, err := r.checkRequestsPerSecond(ctx, teamID, config.RequestsPerSecond)
    if err != nil || !rps {
        return false, ErrRPSLimitExceeded
    }
    
    // 3. Check tokens per minute (token bucket)
    estimatedTokens := estimateTokens(req.Prompt, req.MaxTokens)
    tpm, err := r.checkTokensPerMinute(ctx, teamID, estimatedTokens, config.TokensPerMinute)
    if err != nil || !tpm {
        return false, ErrTPMLimitExceeded
    }
    
    // 4. Check monthly quota
    monthlyOk, err := r.checkMonthlyQuota(ctx, teamID, estimatedTokens, config.MonthlyTokenQuota)
    if err != nil || !monthlyOk {
        r.alertManager.SendQuotaAlert(teamID, "monthly_quota_exceeded")
        return false, ErrMonthlyQuotaExceeded
    }
    
    return true, nil
}

// Token bucket implementation for TPM
func (r *RateLimiter) checkTokensPerMinute(ctx context.Context, teamID string, tokens, limit int) (bool, error) {
    key := fmt.Sprintf("tpm:%s", teamID)
    
    // Lua script for atomic token bucket operation
    script := `
        local key = KEYS[1]
        local limit = tonumber(ARGV[1])
        local tokens = tonumber(ARGV[2])
        local now = tonumber(ARGV[3])
        local window = 60  -- 60 seconds
        
        local current = redis.call('GET', key)
        if current == false then
            current = 0
        else
            current = tonumber(current)
        end
        
        -- Reset if window expired
        local ttl = redis.call('TTL', key)
        if ttl == -1 or ttl == -2 then
            redis.call('SET', key, tokens, 'EX', window)
            return 1
        end
        
        -- Check if adding tokens exceeds limit
        if current + tokens > limit then
            return 0
        end
        
        -- Consume tokens
        redis.call('INCRBY', key, tokens)
        return 1
    `
    
    result, err := r.redis.Eval(ctx, script, []string{key}, limit, tokens, time.Now().Unix()).Int()
    if err != nil {
        return false, err
    }
    
    return result == 1, nil
}

// Sliding window for RPS
func (r *RateLimiter) checkRequestsPerSecond(ctx context.Context, teamID string, limit int) (bool, error) {
    key := fmt.Sprintf("rps:%s", teamID)
    now := time.Now().Unix()
    windowStart := now - 1  // 1 second window
    
    pipe := r.redis.Pipeline()
    
    // Remove old entries
    pipe.ZRemRangeByScore(ctx, key, "0", fmt.Sprintf("%d", windowStart))
    
    // Count current requests in window
    pipe.ZCard(ctx, key)
    
    // Add current request
    pipe.ZAdd(ctx, key, redis.Z{Score: float64(now), Member: fmt.Sprintf("%d", now)})
    
    // Set expiry
    pipe.Expire(ctx, key, 2*time.Second)
    
    cmds, err := pipe.Exec(ctx)
    if err != nil {
        return false, err
    }
    
    count := cmds[1].(*redis.IntCmd).Val()
    return count < int64(limit), nil
}

type QuotaManager struct {
    store          *QuotaStore
    usageAnalyzer  *UsageAnalyzer
    alertManager   *AlertManager
}

// Auto-scaling quotas based on usage patterns
func (q *QuotaManager) AdjustQuotas(ctx context.Context) error {
    teams, err := q.store.GetAllTeams()
    if err != nil {
        return err
    }
    
    for _, team := range teams {
        usage := q.usageAnalyzer.GetUsageStats(team.ID, 30*24*time.Hour)
        
        // Alert if approaching limits
        if usage.TokensUsed > float64(team.Quotas.MonthlyTokenQuota)*0.8 {
            q.alertManager.SendAlert(team.ID, AlertTypeQuotaWarning, map[string]interface{}{
                "usage_percent": (usage.TokensUsed / float64(team.Quotas.MonthlyTokenQuota)) * 100,
                "days_remaining": daysRemainingInMonth(),
            })
        }
        
        // Suggest quota increases for consistent high usage
        if usage.AverageUtilization > 0.9 {
            q.alertManager.SendAlert(team.ID, AlertTypeQuotaSuggestion, map[string]interface{}{
                "suggested_increase": calculateSuggestedIncrease(usage),
                "current_quota": team.Quotas.MonthlyTokenQuota,
            })
        }
    }
    
    return nil
}

type CostTracker struct {
    db             *sql.DB
    pricingEngine  *PricingEngine
    billingService *BillingService
}

type UsageRecord struct {
    ID              string
    Timestamp       time.Time
    TeamID          string
    ProjectID       string
    UserID          string
    RequestID       string
    ModelName       string
    PromptTokens    int
    CompletionTokens int
    TotalTokens     int
    Cost            float64
    CacheHit        bool
    Latency         time.Duration
    Metadata        map[string]string
}

type PricingEngine struct {
    modelPrices map[string]ModelPricing
}

type ModelPricing struct {
    ModelName           string
    PromptPricePer1K    float64  // USD per 1K tokens
    CompletionPricePer1K float64
    CachePricePer1K     float64  // Discounted price for cached prompts
}

var defaultPricing = map[string]ModelPricing{
    "gpt-4o": {
        ModelName:           "gpt-4o",
        PromptPricePer1K:    0.005,
        CompletionPricePer1K: 0.015,
        CachePricePer1K:     0.0025,
    },
    "gpt-3.5-turbo": {
        ModelName:           "gpt-3.5-turbo",
        PromptPricePer1K:    0.0005,
        CompletionPricePer1K: 0.0015,
        CachePricePer1K:     0.00025,
    },
    "claude-opus": {
        ModelName:           "claude-opus",
        PromptPricePer1K:    0.015,
        CompletionPricePer1K: 0.075,
        CachePricePer1K:     0.0075,
    },
}

func (c *CostTracker) CalculateCost(model string, tokens TokenUsage) Cost {
    pricing := c.pricingEngine.GetPricing(model)
    
    promptCost := (float64(tokens.PromptTokens) / 1000.0) * pricing.PromptPricePer1K
    completionCost := (float64(tokens.CompletionTokens) / 1000.0) * pricing.CompletionPricePer1K
    
    return Cost{
        Amount:    promptCost + completionCost,
        Currency:  "USD",
        ModelCost: promptCost + completionCost,
    }
}

func (c *CostTracker) RecordUsage(ctx context.Context, teamID, projectID string, cost Cost) error {
    record := &UsageRecord{
        ID:        generateID(),
        Timestamp: time.Now(),
        TeamID:    teamID,
        ProjectID: projectID,
        Cost:      cost.Amount,
    }
    
    // Store in database
    if err := c.db.InsertUsageRecord(ctx, record); err != nil {
        return err
    }
    
    // Update real-time billing
    return c.billingService.UpdateBalance(ctx, teamID, cost.Amount)
}

type ChargebackReport struct {
    TeamID          string
    Period          Period
    TotalCost       float64
    TotalTokens     int64
    RequestCount    int64
    BreakdownByModel map[string]ModelUsage
    BreakdownByProject map[string]ProjectUsage
    TopUsers        []UserUsage
    CacheSavings    float64
}

type ModelUsage struct {
    ModelName    string
    Requests     int64
    Tokens       int64
    Cost         float64
    AvgLatency   time.Duration
}

type ProjectUsage struct {
    ProjectID    string
    ProjectName  string
    Cost         float64
    Tokens       int64
    Requests     int64
}

func (c *CostTracker) GenerateChargebackReport(teamID string, period Period) (*ChargebackReport, error) {
    // Query usage data
    records, err := c.db.QueryUsageRecords(teamID, period.Start, period.End)
    if err != nil {
        return nil, err
    }
    
    report := &ChargebackReport{
        TeamID:             teamID,
        Period:             period,
        BreakdownByModel:   make(map[string]ModelUsage),
        BreakdownByProject: make(map[string]ProjectUsage),
    }
    
    // Aggregate data
    for _, record := range records {
        report.TotalCost += record.Cost
        report.TotalTokens += int64(record.TotalTokens)
        report.RequestCount++
        
        // By model
        modelUsage := report.BreakdownByModel[record.ModelName]
        modelUsage.ModelName = record.ModelName
        modelUsage.Requests++
        modelUsage.Tokens += int64(record.TotalTokens)
        modelUsage.Cost += record.Cost
        report.BreakdownByModel[record.ModelName] = modelUsage
        
        // By project
        projectUsage := report.BreakdownByProject[record.ProjectID]
        projectUsage.ProjectID = record.ProjectID
        projectUsage.Cost += record.Cost
        projectUsage.Tokens += int64(record.TotalTokens)
        projectUsage.Requests++
        report.BreakdownByProject[record.ProjectID] = projectUsage
        
        // Cache savings
        if record.CacheHit {
            report.CacheSavings += record.Cost * 0.5  // Assume 50% savings
        }
    }
    
    return report, nil
}

type ModelRouter struct {
    modelRegistry  *ModelRegistry
    costOptimizer  *CostOptimizer
    performanceDB  *PerformanceDB
}

type Model struct {
    Name            string
    Provider        string  // OpenAI, Anthropic, Google, etc.
    Tier            ModelTier
    MaxTokens       int
    ContextWindow   int
    Capabilities    []string  // ["code", "reasoning", "creative", "analysis"]
    CostPerToken    float64
    AvgLatency      time.Duration
    Availability    float64  // 0.0 to 1.0
}

type ModelTier int
const (
    TierShared ModelTier = iota
    TierPremium
    TierExperimental
)

func (m *ModelRouter) SelectModel(ctx context.Context, team *Team, req *InferenceRequest) (*Model, error) {
    // 1. Check if team has access to requested model
    if req.ModelHint != "" {
        if !team.HasAccessToModel(req.ModelHint) {
            return nil, ErrModelAccessDenied
        }
        return m.modelRegistry.GetModel(req.ModelHint)
    }
    
    // 2. Automatic model selection based on request characteristics
    candidates := m.getCandidateModels(team)
    
    // 3. Score models based on multiple factors
    scores := make(map[string]float64)
    for _, model := range candidates {
        score := m.scoreModel(model, req, team)
        scores[model.Name] = score
    }
    
    // 4. Select best model
    bestModel := m.selectBestModel(candidates, scores)
    
    return bestModel, nil
}

func (m *ModelRouter) scoreModel(model *Model, req *InferenceRequest, team *Team) float64 {
    var score float64
    
    // Factor 1: Cost efficiency (40% weight)
    costScore := 1.0 - (model.CostPerToken / maxCostPerToken)
    score += costScore * 0.4
    
    // Factor 2: Performance (30% weight)
    latencyScore := 1.0 - (float64(model.AvgLatency) / float64(maxLatency))
    score += latencyScore * 0.3
    
    // Factor 3: Capability match (20% weight)
    capabilityScore := m.matchCapabilities(model, req)
    score += capabilityScore * 0.2
    
    // Factor 4: Availability (10% weight)
    score += model.Availability * 0.1
    
    // Adjust for priority
    if req.Priority == PriorityHigh {
        // Prefer faster models for high priority
        score += latencyScore * 0.2
    } else if req.Priority == PriorityLow {
        // Prefer cheaper models for low priority
        score += costScore * 0.2
    }
    
    return score
}

// Automatic model downgrading for simple queries
func (m *ModelRouter) shouldDowngradeModel(req *InferenceRequest) bool {
    // Heuristics for simple queries
    promptLength := len(req.Prompt)
    
    // Short prompts might not need premium models
    if promptLength < 100 && req.MaxTokens < 200 {
        return true
    }
    
    // Check for simple patterns (e.g., classification, extraction)
    simplePatterns := []string{
        "classify",
        "extract",
        "summarize in one sentence",
        "yes or no",
        "true or false",
    }
    
    promptLower := strings.ToLower(req.Prompt)
    for _, pattern := range simplePatterns {
        if strings.Contains(promptLower, pattern) {
            return true
        }
    }
    
    return false
}

type CircuitBreaker struct {
    state          CircuitState
    failureCount   int
    successCount   int
    lastFailTime   time.Time
    threshold      int
    timeout        time.Duration
    mu             sync.RWMutex
}

type CircuitState int
const (
    StateClosed CircuitState = iota
    StateOpen
    StateHalfOpen
)

func (cb *CircuitBreaker) Call(fn func() error) error {
    cb.mu.Lock()
    defer cb.mu.Unlock()
    
    switch cb.state {
    case StateOpen:
        if time.Since(cb.lastFailTime) > cb.timeout {
            cb.state = StateHalfOpen
            cb.successCount = 0
        } else {
            return ErrCircuitOpen
        }
    }
    
    err := fn()
    
    if err != nil {
        cb.failureCount++
        cb.lastFailTime = time.Now()
        
        if cb.failureCount >= cb.threshold {
            cb.state = StateOpen
        }
        return err
    }
    
    cb.successCount++
    if cb.state == StateHalfOpen && cb.successCount >= 3 {
        cb.state = StateClosed
        cb.failureCount = 0
    }
    
    return nil
}

// Model fallback chain
func (m *ModelRouter) ExecuteWithFallback(ctx context.Context, req *InferenceRequest, models []*Model) (*InferenceResponse, error) {
    var lastErr error
    
    for i, model := range models {
        cb := m.getCircuitBreaker(model.Name)
        
        err := cb.Call(func() error {
            resp, err := model.Generate(ctx, req)
            if err == nil {
                return nil
            }
            return err
        })
        
        if err == nil {
            resp, err := model.Generate(ctx, req)
            if err == nil {
                return resp, nil
            }
        }
        
        lastErr = err
        
        // Log fallback
        log.Warnf("Model %s failed, falling back to %s", model.Name, models[i+1].Name)
    }
    
    return nil, fmt.Errorf("all models failed: %w", lastErr)
}

type MetricsCollector struct {
    registry *prometheus.Registry
    
    // Request metrics
    requestCounter    *prometheus.CounterVec
    requestDuration   *prometheus.HistogramVec
    requestSize       *prometheus.HistogramVec
    
    // Token metrics
    tokenCounter      *prometheus.CounterVec
    tokenCost         *prometheus.CounterVec
    
    // Cache metrics
    cacheHitRatio     *prometheus.GaugeVec
    cacheSize         *prometheus.GaugeVec
    
    // Model metrics
    modelLatency      *prometheus.HistogramVec
    modelErrors       *prometheus.CounterVec
    
    // Quota metrics
    quotaUsage        *prometheus.GaugeVec
    quotaRemaining    *prometheus.GaugeVec
}

func NewMetricsCollector() *MetricsCollector {
    mc := &MetricsCollector{
        registry: prometheus.NewRegistry(),
    }
    
    // Request metrics
    mc.requestCounter = prometheus.NewCounterVec(
        prometheus.CounterOpts{
            Name: "llm_requests_total",
            Help: "Total number of LLM requests",
        },
        []string{"team_id", "model", "status", "priority"},
    )
    
    mc.requestDuration = prometheus.NewHistogramVec(
        prometheus.HistogramOpts{
            Name:    "llm_request_duration_seconds",
            Help:    "Request duration in seconds",
            Buckets: []float64{0.1, 0.5, 1, 2, 5, 10, 30},
        },
        []string{"team_id", "model"},
    )
    
    // Token metrics
    mc.tokenCounter = prometheus.NewCounterVec(
        prometheus.CounterOpts{
            Name: "llm_tokens_total",
            Help: "Total tokens consumed",
        },
        []string{"team_id", "model", "type"}, // type: prompt, completion
    )
    
    mc.tokenCost = prometheus.NewCounterVec(
        prometheus.CounterOpts{
            Name: "llm_cost_usd_total",
            Help: "Total cost in USD",
        },
        []string{"team_id", "model"},
    )
    
    // Cache metrics
    mc.cacheHitRatio = prometheus.NewGaugeVec(
        prometheus.GaugeOpts{
            Name: "llm_cache_hit_ratio",
            Help: "Cache hit ratio (0-1)",
        },
        []string{"team_id"},
    )
    
    // Register all metrics
    mc.registry.MustRegister(
        mc.requestCounter,
        mc.requestDuration,
        mc.tokenCounter,
        mc.tokenCost,
        mc.cacheHitRatio,
    )
    
    return mc
}

func (mc *MetricsCollector) RecordRequest(teamID, model string, latency time.Duration, cost Cost) {
    mc.requestCounter.WithLabelValues(teamID, model, "success", "medium").Inc()
    mc.requestDuration.WithLabelValues(teamID, model).Observe(latency.Seconds())
    mc.tokenCost.WithLabelValues(teamID, model).Add(cost.Amount)
}

type TracingService struct {
    tracer trace.Tracer
}

func (g *LLMGateway) ProcessRequestWithTracing(ctx context.Context, req *InferenceRequest) (*InferenceResponse, error) {
    ctx, span := g.tracer.Start(ctx, "ProcessRequest",
        trace.WithAttributes(
            attribute.String("team_id", req.TeamID),
            attribute.String("model_hint", req.ModelHint),
            attribute.Int("max_tokens", req.MaxTokens),
        ),
    )
    defer span.End()
    
    // Authentication span
    ctx, authSpan := g.tracer.Start(ctx, "Authenticate")
    team, err := g.authService.Authenticate(ctx, req)
    authSpan.End()
    if err != nil {
        span.RecordError(err)
        return nil, err
    }
    
    // Rate limiting span
    ctx, rlSpan := g.tracer.Start(ctx, "RateLimit")
    allowed, err := g.rateLimiter.CheckAndConsume(ctx, team.ID, req)
    rlSpan.End()
    if !allowed {
        span.SetStatus(codes.Error, "rate limit exceeded")
        return nil, ErrRateLimitExceeded
    }
    
    // Cache lookup span
    ctx, cacheSpan := g.tracer.Start(ctx, "CacheLookup")
    cachedResp, found := g.cacheManager.Get(ctx, req)
    cacheSpan.SetAttributes(attribute.Bool("cache_hit", found))
    cacheSpan.End()
    
    if found {
        span.SetAttributes(attribute.Bool("cache_hit", true))
        return cachedResp, nil
    }
    
    // Model inference span
    ctx, inferSpan := g.tracer.Start(ctx, "ModelInference")
    model, _ := g.modelRouter.SelectModel(ctx, team, req)
    inferSpan.SetAttributes(attribute.String("model_selected", model.Name))
    
    resp, err := model.Generate(ctx, req)
    inferSpan.End()
    
    if err != nil {
        span.RecordError(err)
        return nil, err
    }
    
    span.SetAttributes(
        attribute.Int("tokens_used", resp.TokensUsed.TotalTokens),
        attribute.Float64("cost", cost.Amount),
    )
    
    return resp, nil
}

type AlertManager struct {
    notifier     *Notifier
    alertStore   *AlertStore
    ruleEngine   *RuleEngine
}

type Alert struct {
    ID          string
    TeamID      string
    Type        AlertType
    Severity    Severity
    Message     string
    Timestamp   time.Time
    Metadata    map[string]interface{}
    Resolved    bool
}

type AlertType string
const (
    AlertTypeQuotaWarning     AlertType = "quota_warning"
    AlertTypeQuotaExceeded    AlertType = "quota_exceeded"
    AlertTypeCostAnomaly      AlertType = "cost_anomaly"
    AlertTypeHighLatency      AlertType = "high_latency"
    AlertTypeHighErrorRate    AlertType = "high_error_rate"
    AlertTypeModelUnavailable AlertType = "model_unavailable"
)

type Severity string
const (
    SeverityInfo     Severity = "info"
    SeverityWarning  Severity = "warning"
    SeverityCritical Severity = "critical"
)

// Alert rules
func (am *AlertManager) EvaluateAlerts(ctx context.Context) error {
    teams, _ := am.getTeams()
    
    for _, team := range teams {
        // Rule 1: Quota approaching limit (80%)
        usage := am.getUsage(team.ID)
        if usage.Percentage > 0.8 {
            am.SendAlert(team.ID, AlertTypeQuotaWarning, SeverityWarning, map[string]interface{}{
                "usage_percent": usage.Percentage * 100,
                "quota_remaining": team.Quotas.MonthlyTokenQuota - usage.TokensUsed,
            })
        }
        
        // Rule 2: Cost anomaly detection (3σ from baseline)
        if am.detectCostAnomaly(team.ID) {
            am.SendAlert(team.ID, AlertTypeCostAnomaly, SeverityCritical, map[string]interface{}{
                "current_cost": usage.CurrentCost,
                "baseline_cost": usage.BaselineCost,
                "deviation": usage.Deviation,
            })
        }
        
        // Rule 3: High error rate (>5%)
        errorRate := am.getErrorRate(team.ID)
        if errorRate > 0.05 {
            am.SendAlert(team.ID, AlertTypeHighErrorRate, SeverityCritical, map[string]interface{}{
                "error_rate": errorRate * 100,
                "error_count": usage.ErrorCount,
            })
        }
        
        // Rule 4: High latency (P95 > 5s)
        p95Latency := am.getP95Latency(team.ID)
        if p95Latency > 5*time.Second {
            am.SendAlert(team.ID, AlertTypeHighLatency, SeverityWarning, map[string]interface{}{
                "p95_latency_ms": p95Latency.Milliseconds(),
            })
        }
    }
    
    return nil
}

func (am *AlertManager) SendAlert(teamID string, alertType AlertType, severity Severity, metadata map[string]interface{}) {
    alert := &Alert{
        ID:        generateID(),
        TeamID:    teamID,
        Type:      alertType,
        Severity:  severity,
        Timestamp: time.Now(),
        Metadata:  metadata,
    }
    
    // Store alert
    am.alertStore.Save(alert)
    
    // Send notifications
    am.notifier.Notify(alert)
}

type CacheManager struct {
    exactCache    *ExactCache     // Redis for exact matches
    semanticCache *SemanticCache  // Vector DB for semantic similarity
    localCache    *LocalCache     // In-memory LRU cache
}

type CachePolicy string
const (
    CachePolicyNone      CachePolicy = "none"
    CachePolicyExact     CachePolicy = "exact"
    CachePolicySemantic  CachePolicy = "semantic"
    CachePolicyAggressive CachePolicy = "aggressive"
)

// Exact cache using Redis
type ExactCache struct {
    redis *redis.Client
    ttl   time.Duration
}

func (ec *ExactCache) Get(ctx context.Context, req *InferenceRequest) (*InferenceResponse, bool) {
    // Generate cache key from request
    key := ec.generateKey(req)
    
    // Lookup in Redis
    data, err := ec.redis.Get(ctx, key).Bytes()
    if err != nil {
        return nil, false
    }
    
    var resp InferenceResponse
    if err := json.Unmarshal(data, &resp); err != nil {
        return nil, false
    }
    
    return &resp, true
}

func (ec *ExactCache) Set(ctx context.Context, req *InferenceRequest, resp *InferenceResponse) error {
    key := ec.generateKey(req)
    data, _ := json.Marshal(resp)
    
    return ec.redis.Set(ctx, key, data, ec.ttl).Err()
}

func (ec *ExactCache) generateKey(req *InferenceRequest) string {
    // Hash of prompt + model + parameters
    h := sha256.New()
    h.Write([]byte(req.Prompt))
    h.Write([]byte(req.ModelHint))
    h.Write([]byte(fmt.Sprintf("%d%.2f", req.MaxTokens, req.Temperature)))
    return fmt.Sprintf("cache:exact:%x", h.Sum(nil))
}

// Semantic cache using vector similarity
type SemanticCache struct {
    vectorDB    *VectorDB
    embedder    *Embedder
    threshold   float64  // Similarity threshold (0.9 = 90% similar)
}

func (sc *SemanticCache) Get(ctx context.Context, req *InferenceRequest) (*InferenceResponse, bool) {
    // Generate embedding for prompt
    embedding, err := sc.embedder.Embed(req.Prompt)
    if err != nil {
        return nil, false
    }
    
    // Search for similar prompts
    results, err := sc.vectorDB.Search(ctx, embedding, 1)
    if err != nil || len(results) == 0 {
        return nil, false
    }
    
    // Check similarity threshold
    if results[0].Similarity < sc.threshold {
        return nil, false
    }
    
    // Return cached response
    return results[0].Response, true
}

func (sc *SemanticCache) Set(ctx context.Context, req *InferenceRequest, resp *InferenceResponse) error {
    embedding, err := sc.embedder.Embed(req.Prompt)
    if err != nil {
        return err
    }
    
    return sc.vectorDB.Insert(ctx, embedding, resp)
}

// Cache warming for common queries
func (cm *CacheManager) WarmCache(ctx context.Context) error {
    commonQueries := cm.getCommonQueries()
    
    for _, query := range commonQueries {
        // Check if already cached
        if _, found := cm.Get(ctx, query); found {
            continue
        }
        
        // Generate and cache response
        resp, err := cm.generateResponse(ctx, query)
        if err != nil {
            continue
        }
        
        cm.Set(ctx, query, resp)
    }
    
    return nil
}

type BatchProcessor struct {
    batchSize    int
    batchTimeout time.Duration
    queue        chan *InferenceRequest
    responses    map[string]chan *InferenceResponse
    mu           sync.RWMutex
}

func (bp *BatchProcessor) ProcessBatch(ctx context.Context) {
    ticker := time.NewTicker(bp.batchTimeout)
    defer ticker.Stop()
    
    batch := make([]*InferenceRequest, 0, bp.batchSize)
    
    for {
        select {
        case req := <-bp.queue:
            batch = append(batch, req)
            
            if len(batch) >= bp.batchSize {
                bp.executeBatch(ctx, batch)
                batch = batch[:0]
            }
            
        case <-ticker.C:
            if len(batch) > 0 {
                bp.executeBatch(ctx, batch)
                batch = batch[:0]
            }
            
        case <-ctx.Done():
            return
        }
    }
}

func (bp *BatchProcessor) executeBatch(ctx context.Context, batch []*InferenceRequest) {
    // Combine prompts for batch inference
    combinedPrompt := bp.combinePrompts(batch)
    
    // Execute batch inference
    resp, err := bp.model.GenerateBatch(ctx, combinedPrompt)
    if err != nil {
        // Handle error for all requests
        for _, req := range batch {
            bp.sendResponse(req.RequestID, nil, err)
        }
        return
    }
    
    // Split responses
    responses := bp.splitResponses(resp, len(batch))
    
    // Send individual responses
    for i, req := range batch {
        bp.sendResponse(req.RequestID, responses[i], nil)
    }
}

type ModelPool struct {
    models    []*ModelInstance
    strategy  LoadBalancingStrategy
    mu        sync.RWMutex
}

type LoadBalancingStrategy string
const (
    StrategyRoundRobin    LoadBalancingStrategy = "round_robin"
    StrategyLeastLatency  LoadBalancingStrategy = "least_latency"
    StrategyLeastLoad     LoadBalancingStrategy = "least_load"
)

type ModelInstance struct {
    ID            string
    Endpoint      string
    CurrentLoad   int32
    AvgLatency    time.Duration
    Healthy       bool
    LastHealthCheck time.Time
}

func (mp *ModelPool) GetInstance() (*ModelInstance, error) {
    mp.mu.RLock()
    defer mp.mu.RUnlock()
    
    switch mp.strategy {
    case StrategyRoundRobin:
        return mp.roundRobin()
    case StrategyLeastLatency:
        return mp.leastLatency()
    case StrategyLeastLoad:
        return mp.leastLoad()
    default:
        return mp.roundRobin()
    }
}

func (mp *ModelPool) leastLoad() (*ModelInstance, error) {
    var best *ModelInstance
    minLoad := int32(math.MaxInt32)
    
    for _, instance := range mp.models {
        if !instance.Healthy {
            continue
        }
        
        load := atomic.LoadInt32(&instance.CurrentLoad)
        if load < minLoad {
            minLoad = load
            best = instance
        }
    }
    
    if best == nil {
        return nil, ErrNoHealthyInstances
    }
    
    atomic.AddInt32(&best.CurrentLoad, 1)
    return best, nil
}

// Health checking
func (mp *ModelPool) HealthCheck(ctx context.Context) {
    ticker := time.NewTicker(30 * time.Second)
    defer ticker.Stop()
    
    for {
        select {
        case <-ticker.C:
            for _, instance := range mp.models {
                go mp.checkInstance(ctx, instance)
            }
        case <-ctx.Done():
            return
        }
    }
}

func (mp *ModelPool) checkInstance(ctx context.Context, instance *ModelInstance) {
    ctx, cancel := context.WithTimeout(ctx, 5*time.Second)
    defer cancel()
    
    start := time.Now()
    err := instance.Ping(ctx)
    latency := time.Since(start)
    
    mp.mu.Lock()
    defer mp.mu.Unlock()
    
    instance.LastHealthCheck = time.Now()
    instance.Healthy = (err == nil)
    
    if err == nil {
        // Update average latency (exponential moving average)
        alpha := 0.3
        instance.AvgLatency = time.Duration(
            alpha*float64(latency) + (1-alpha)*float64(instance.AvgLatency),
        )
    }
}

type ShardedDatabase struct {
    shards    []*DatabaseShard
    hasher    *ConsistentHash
}

type DatabaseShard struct {
    ID         int
    Connection *sql.DB
    Region     string
}

func (sd *ShardedDatabase) GetShard(teamID string) *DatabaseShard {
    shardID := sd.hasher.GetShard(teamID)
    return sd.shards[shardID]
}

func (sd *ShardedDatabase) InsertUsageRecord(ctx context.Context, record *UsageRecord) error {
    shard := sd.GetShard(record.TeamID)
    
    query := `
        INSERT INTO usage_records 
        (id, timestamp, team_id, project_id, model_name, tokens, cost)
        VALUES ($1, $2, $3, $4, $5, $6, $7)
    `
    
    _, err := shard.Connection.ExecContext(ctx, query,
        record.ID,
        record.Timestamp,
        record.TeamID,
        record.ProjectID,
        record.ModelName,
        record.TotalTokens,
        record.Cost,
    )
    
    return err
}

// Consistent hashing for even distribution
type ConsistentHash struct {
    ring       map[uint32]int
    sortedKeys []uint32
    replicas   int
}

func (ch *ConsistentHash) GetShard(key string) int {
    hash := ch.hash(key)
    
    idx := sort.Search(len(ch.sortedKeys), func(i int) bool {
        return ch.sortedKeys[i] >= hash
    })
    
    if idx == len(ch.sortedKeys) {
        idx = 0
    }
    
    return ch.ring[ch.sortedKeys[idx]]
}

type DisasterRecovery struct {
    primaryRegion   string
    backupRegions   []string
    replicationMgr  *ReplicationManager
    failoverMgr     *FailoverManager
}

// Multi-region replication
func (dr *DisasterRecovery) ReplicateData(ctx context.Context, data interface{}) error {
    // Write to primary
    if err := dr.writeToPrimary(ctx, data); err != nil {
        return err
    }
    
    // Async replication to backups
    for _, region := range dr.backupRegions {
        go dr.replicateToRegion(ctx, region, data)
    }
    
    return nil
}

// Automatic failover
func (dr *DisasterRecovery) MonitorHealth(ctx context.Context) {
    ticker := time.NewTicker(10 * time.Second)
    defer ticker.Stop()
    
    for {
        select {
        case <-ticker.C:
            if !dr.isPrimaryHealthy() {
                dr.failoverMgr.InitiateFailover(ctx)
            }
        case <-ctx.Done():
            return
        }
    }
}

type PIIDetector struct {
    patterns map[string]*regexp.Regexp
    ml       *MLClassifier
}

func NewPIIDetector() *PIIDetector {
    return &PIIDetector{
        patterns: map[string]*regexp.Regexp{
            "email":      regexp.MustCompile(`[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}`),
            "phone":      regexp.MustCompile(`\b\d{3}[-.]?\d{3}[-.]?\d{4}\b`),
            "ssn":        regexp.MustCompile(`\b\d{3}-\d{2}-\d{4}\b`),
            "credit_card": regexp.MustCompile(`\b\d{4}[-\s]?\d{4}[-\s]?\d{4}[-\s]?\d{4}\b`),
            "ip_address": regexp.MustCompile(`\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b`),
        },
    }
}

func (pd *PIIDetector) DetectAndRedact(text string) (string, []PIIMatch) {
    var matches []PIIMatch
    redacted := text
    
    for piiType, pattern := range pd.patterns {
        found := pattern.FindAllString(text, -1)
        for _, match := range found {
            matches = append(matches, PIIMatch{
                Type:  piiType,
                Value: match,
            })
            
            // Redact with placeholder
            redacted = strings.ReplaceAll(redacted, match, fmt.Sprintf("[%s_REDACTED]", strings.ToUpper(piiType)))
        }
    }
    
    return redacted, matches
}

type PIIMatch struct {
    Type  string
    Value string
}

// Async PII scanning and logging
func (pd *PIIDetector) ScanAndLog(ctx context.Context, req *InferenceRequest) {
    redacted, matches := pd.DetectAndRedact(req.Prompt)
    
    if len(matches) > 0 {
        // Log PII detection
        log.Warnf("PII detected in request %s: %d matches", req.RequestID, len(matches))
        
        // Store audit log
        pd.auditLog.LogPIIDetection(ctx, req.TeamID, req.RequestID, matches)
        
        // Alert if sensitive data detected
        if pd.containsSensitivePII(matches) {
            pd.alertManager.SendAlert(req.TeamID, AlertTypePIIDetected, SeverityCritical, map[string]interface{}{
                "request_id": req.RequestID,
                "pii_types":  pd.getPIITypes(matches),
            })
        }
    }
}

type AuditLogger struct {
    db        *sql.DB
    encryptor *Encryptor
}

type AuditLog struct {
    ID          string
    Timestamp   time.Time
    TeamID      string
    UserID      string
    Action      string
    Resource    string
    Status      string
    IPAddress   string
    UserAgent   string
    Metadata    map[string]interface{}
}

func (al *AuditLogger) LogAuth(req *InferenceRequest, team *Team, userID string) {
    log := &AuditLog{
        ID:        generateID(),
        Timestamp: time.Now(),
        TeamID:    team.ID,
        UserID:    userID,
        Action:    "authenticate",
        Resource:  "llm_gateway",
        Status:    "success",
        IPAddress: req.IPAddress,
        UserAgent: req.UserAgent,
    }
    
    al.store(log)
}

func (al *AuditLogger) LogInference(req *InferenceRequest, resp *InferenceResponse) {
    // Encrypt sensitive data
    encryptedPrompt := al.encryptor.Encrypt(req.Prompt)
    encryptedResponse := al.encryptor.Encrypt(resp.Response)
    
    log := &AuditLog{
        ID:        generateID(),
        Timestamp: time.Now(),
        TeamID:    req.TeamID,
        UserID:    req.UserID,
        Action:    "inference",
        Resource:  resp.ModelUsed,
        Status:    "success",
        Metadata: map[string]interface{}{
            "request_id":      req.RequestID,
            "tokens_used":     resp.TokensUsed.TotalTokens,
            "cost":            resp.Cost.Amount,
            "latency_ms":      resp.Latency.Milliseconds(),
            "encrypted_prompt": encryptedPrompt,
            "encrypted_response": encryptedResponse,
        },
    }
    
    al.store(log)
}

// Compliance reporting
func (al *AuditLogger) GenerateComplianceReport(teamID string, period Period) (*ComplianceReport, error) {
    logs, err := al.queryLogs(teamID, period)
    if err != nil {
        return nil, err
    }
    
    report := &ComplianceReport{
        TeamID:          teamID,
        Period:          period,
        TotalRequests:   len(logs),
        PIIDetections:   al.countPIIDetections(logs),
        FailedAuths:     al.countFailedAuths(logs),
        AnomalousAccess: al.detectAnomalies(logs),
    }
    
    return report, nil
}

type APIKeyManager struct {
    store     *APIKeyStore
    encryptor *Encryptor
    rotator   *KeyRotator
}

type APIKey struct {
    ID          string
    TeamID      string
    Key         string  // Hashed
    Name        string
    Permissions []string
    CreatedAt   time.Time
    ExpiresAt   time.Time
    LastUsed    time.Time
    Revoked     bool
}

func (akm *APIKeyManager) CreateKey(teamID, name string, permissions []string) (*APIKey, error) {
    // Generate secure random key
    keyBytes := make([]byte, 32)
    if _, err := rand.Read(keyBytes); err != nil {
        return nil, err
    }
    
    rawKey := base64.URLEncoding.EncodeToString(keyBytes)
    hashedKey := akm.hashKey(rawKey)
    
    apiKey := &APIKey{
        ID:          generateID(),
        TeamID:      teamID,
        Key:         hashedKey,
        Name:        name,
        Permissions: permissions,
        CreatedAt:   time.Now(),
        ExpiresAt:   time.Now().Add(365 * 24 * time.Hour), // 1 year
        Revoked:     false,
    }
    
    if err := akm.store.Save(apiKey); err != nil {
        return nil, err
    }
    
    // Return key with raw value (only time it's visible)
    apiKey.Key = rawKey
    return apiKey, nil
}

func (akm *APIKeyManager) RotateKeys(ctx context.Context) error {
    // Automatic key rotation for keys older than 90 days
    oldKeys, err := akm.store.GetKeysOlderThan(90 * 24 * time.Hour)
    if err != nil {
        return err
    }
    
    for _, key := range oldKeys {
        // Create new key
        newKey, err := akm.CreateKey(key.TeamID, key.Name+"_rotated", key.Permissions)
        if err != nil {
            continue
        }
        
        // Notify team
        akm.notifyKeyRotation(key.TeamID, key.ID, newKey.ID)
        
        // Schedule old key for deletion (grace period)
        akm.scheduleKeyDeletion(key.ID, 30*24*time.Hour)
    }
    
    return nil
}

// BAD: All quotas reset at exact same time
func resetQuotas() {
    for _, team := range teams {
        redis.Set(fmt.Sprintf("quota:%s", team.ID), 0)  // All at midnight
    }
}

// GOOD: Staggered quota resets with jitter
func resetQuotasWithJitter() {
    for _, team := range teams {
        // Add random jitter (0-60 minutes)
        jitter := time.Duration(rand.Intn(3600)) * time.Second
        resetTime := getNextResetTime().Add(jitter)
        
        scheduler.ScheduleAt(resetTime, func() {
            redis.Set(fmt.Sprintf("quota:%s", team.ID), 0)
        })
    }
}

// Alternative: Rolling window instead of fixed window
func useRollingWindow(teamID string) int {
    now := time.Now().Unix()
    windowStart := now - 86400  // 24 hours ago
    
    // Count tokens in rolling 24-hour window
    return redis.ZCount(
        fmt.Sprintf("tokens:%s", teamID),
        windowStart,
        now,
    )
}

// BAD: No protection against simultaneous cache misses
func getResponse(prompt string) (*Response, error) {
    cached, found := cache.Get(prompt)
    if found {
        return cached, nil
    }
    
    // Multiple goroutines execute this simultaneously
    resp, err := llm.Generate(prompt)
    cache.Set(prompt, resp)
    return resp, err
}

// GOOD: Use singleflight pattern
import "golang.org/x/sync/singleflight"

type CacheManager struct {
    cache       *Cache
    sfGroup     singleflight.Group
}

func (cm *CacheManager) GetResponse(prompt string) (*Response, error) {
    // Check cache first
    if cached, found := cm.cache.Get(prompt); found {
        return cached, nil
    }
    
    // Use singleflight to deduplicate concurrent requests
    result, err, shared := cm.sfGroup.Do(prompt, func() (interface{}, error) {
        // Only one goroutine executes this
        resp, err := llm.Generate(prompt)
        if err != nil {
            return nil, err
        }
        
        // Cache with probabilistic early expiration to prevent stampede
        ttl := baseTTL + time.Duration(rand.Intn(300))*time.Second
        cm.cache.SetWithTTL(prompt, resp, ttl)
        
        return resp, nil
    })
    
    if err != nil {
        return nil, err
    }
    
    metrics.RecordCacheSharing(shared)
    return result.(*Response), nil
}

// Alternative: Probabilistic early recomputation
func (cm *CacheManager) GetWithEarlyRecompute(prompt string) (*Response, error) {
    cached, ttl, found := cm.cache.GetWithTTL(prompt)
    
    if found {
        // Recompute probabilistically before expiration
        // Probability increases as TTL decreases
        delta := baseTTL - ttl
        beta := 1.0
        probability := beta * math.Log(rand.Float64()) * delta
        
        if probability < 0 {
            // Async recompute
            go cm.recompute(prompt)
        }
        
        return cached, nil
    }
    
    return cm.compute(prompt)
}

// BAD: Naive token estimation
func estimateTokens(prompt string) int {
    // Assumes 1 token = 4 characters (very inaccurate)
    return len(prompt) / 4
}

// GOOD: Use actual tokenizer
import "github.com/tiktoken-go/tokenizer"

type TokenEstimator struct {
    tokenizers map[string]*tokenizer.Tokenizer
    cache      *sync.Map  // Cache tokenization results
}

func (te *TokenEstimator) EstimateTokens(prompt string, model string) int {
    // Check cache first
    cacheKey := fmt.Sprintf("%s:%s", model, hashPrompt(prompt))
    if cached, ok := te.cache.Load(cacheKey); ok {
        return cached.(int)
    }
    
    // Get appropriate tokenizer for model
    tok := te.tokenizers[model]
    if tok == nil {
        tok = te.tokenizers["default"]
    }
    
    // Actual tokenization
    tokens := tok.Encode(prompt)
    count := len(tokens)
    
    // Cache result
    te.cache.Store(cacheKey, count)
    
    return count
}

// Track estimation accuracy
func (te *TokenEstimator) RecordActual(estimatedTokens, actualTokens int, model string) {
    accuracy := float64(estimatedTokens) / float64(actualTokens)
    
    metrics.RecordTokenEstimationAccuracy(model, accuracy)
    
    // Alert if accuracy degrades
    if accuracy < 0.8 || accuracy > 1.2 {
        alerts.Send(AlertTokenEstimationDrift, map[string]interface{}{
            "model":     model,
            "accuracy":  accuracy,
            "estimated": estimatedTokens,
            "actual":    actualTokens,
        })
    }
}

// Adaptive estimation with feedback loop
type AdaptiveEstimator struct {
    baseEstimator *TokenEstimator
    corrections   map[string]float64  // model -> correction factor
    mu            sync.RWMutex
}

func (ae *AdaptiveEstimator) Estimate(prompt string, model string) int {
    baseEstimate := ae.baseEstimator.EstimateTokens(prompt, model)
    
    ae.mu.RLock()
    correction := ae.corrections[model]
    ae.mu.RUnlock()
    
    if correction == 0 {
        correction = 1.0
    }
    
    return int(float64(baseEstimate) * correction)
}

func (ae *AdaptiveEstimator) UpdateCorrection(model string, estimated, actual int) {
    ratio := float64(actual) / float64(estimated)
    
    ae.mu.Lock()
    defer ae.mu.Unlock()
    
    // Exponential moving average
    alpha := 0.1
    if current, exists := ae.corrections[model]; exists {
        ae.corrections[model] = alpha*ratio + (1-alpha)*current
    } else {
        ae.corrections[model] = ratio
    }
}