interface ProvisionedService {
  id: string;
  accountId: string; // Team or Organization ID
  accountType: 'team' | 'organization';
  category: ServiceCategory;
  provider: ServiceProvider;
  name: string;
  description?: string;
  configuration: ServiceConfiguration;
  credentials: ServiceCredentials;
  quotas: ServiceQuotas;
  costLimits: CostLimits;
  enabled: boolean;
  healthStatus: ServiceHealthStatus;
  createdAt: Date;
  updatedAt: Date;
  createdBy: string;
}

type ServiceCategory = 
  | 'ai_models'
  | 'data_stores' 
  | 'integrations'
  | 'web_crawlers'
  | 'specialized';

type ServiceProvider = 
  // AI Models
  | 'openai' | 'anthropic' | 'groq' | 'google' | 'cohere' | 'huggingface'
  // Data Stores
  | 'nocodb' | 'airtable' | 'databricks' | 'postgresql' | 'mongodb' | 'supabase'
  // Integrations
  | 'zapier' | 'make' | 'slack' | 'discord' | 'sendgrid' | 'twilio'
  // Web Crawlers
  | 'scrapfly' | 'brightdata' | 'proxycrawl' | 'scraperapi'
  // Specialized
  | 'aws_textract' | 'google_vision' | 'azure_cognitive' | 'deepgram';

interface ServiceConfiguration {
  baseUrl?: string;
  region?: string;
  version?: string;
  features: ServiceFeature[];
  parameters: Record<string, any>;
  retryPolicy: RetryPolicy;
  timeoutMs: number;
}

interface ServiceFeature {
  name: string;
  enabled: boolean;
  config?: Record<string, any>;
  quotas?: FeatureQuotas;
}

interface ServiceCredentials {
  keyId: string; // Reference to encrypted key in Vault
  keyType: 'api_key' | 'oauth2' | 'jwt' | 'basic_auth' | 'custom';
  additionalSecrets?: Record<string, string>; // Additional encrypted values
  rotationPolicy?: KeyRotationPolicy;
}

interface ServiceQuotas {
  requestsPerMinute?: number;
  requestsPerHour?: number;
  requestsPerDay?: number;
  requestsPerMonth?: number;
  dataPerDay?: number; // in MB
  concurrentRequests?: number;
  customQuotas?: Record<string, number>;
}

interface CostLimits {
  dailyLimit?: number;
  monthlyLimit?: number;
  perRequestLimit?: number;
  currency: string;
  alertThresholds: AlertThreshold[];
}

interface AlertThreshold {
  percentage: number; // e.g., 80 for 80% of limit
  recipients: string[]; // email addresses
  actions: AlertAction[];
}

type AlertAction = 'email' | 'slack' | 'webhook' | 'disable_service';

interface ServiceHealthStatus {
  isHealthy: boolean;
  lastChecked: Date;
  responseTime: number;
  uptime: number; // percentage
  errorRate: number; // percentage
  lastError?: string;
}

class ServiceAccessManager {
  constructor(
    private accountRepo: AccountRepository,
    private vaultService: VaultService,
    private quotaManager: QuotaManager
  ) {}

  public async getUserAvailableServices(userId: string): Promise<AvailableServices> {
    const hierarchy = await this.getAccountHierarchy(userId);
    const allServices: ProvisionedService[] = [];
    
    // Collect services from all levels in hierarchy
    for (const level of hierarchy) {
      const services = await this.getAccountServices(level.id, level.type);
      allServices.push(...services);
    }
    
    // Deduplicate and resolve conflicts (team overrides org, etc.)
    const resolvedServices = this.resolveServiceConflicts(allServices);
    
    // Apply user-specific quotas and permissions
    const availableServices: AvailableServices = {
      aiModels: [],
      dataStores: [],
      integrations: [],
      webCrawlers: [],
      specialized: []
    };
    
    for (const service of resolvedServices) {
      if (service.enabled) {
        const userAccess = await this.calculateUserAccess(userId, service);
        const serviceInfo: ServiceInfo = {
          id: service.id,
          provider: service.provider,
          name: service.name,
          features: service.configuration.features,
          quotas: userAccess.quotas,
          costLimits: userAccess.costLimits,
          healthStatus: service.healthStatus
        };
        
        // Categorize service
        switch (service.category) {
          case 'ai_models':
            availableServices.aiModels.push(serviceInfo);
            break;
          case 'data_stores':
            availableServices.dataStores.push(serviceInfo);
            break;
          case 'integrations':
            availableServices.integrations.push(serviceInfo);
            break;
          case 'web_crawlers':
            availableServices.webCrawlers.push(serviceInfo);
            break;
          case 'specialized':
            availableServices.specialized.push(serviceInfo);
            break;
        }
      }
    }
    
    return availableServices;
  }
  
  public async checkServiceAccess(
    userId: string, 
    provider: ServiceProvider, 
    feature?: string
  ): Promise<ServiceAccessResult> {
    
    const hierarchy = await this.getAccountHierarchy(userId);
    
    // Find service in hierarchy (team services override org services)
    for (const level of hierarchy) {
      const service = await this.findServiceInAccount(level.id, level.type, provider);
      if (service && service.enabled) {
        
        // Check feature access if specified
        if (feature) {
          const featureConfig = service.configuration.features.find(f => f.name === feature);
          if (!featureConfig || !featureConfig.enabled) {
            continue; // Try next level in hierarchy
          }
        }
        
        // Check quotas
        const quotaStatus = await this.quotaManager.checkServiceQuota(
          userId, 
          service.id, 
          feature
        );
        
        if (!quotaStatus.withinLimits && quotaStatus.hardLimit) {
          return {
            hasAccess: false,
            reason: 'Quota exceeded',
            quotaStatus
          };
        }
        
        return {
          hasAccess: true,
          serviceId: service.id,
          accountLevel: level.type,
          quotaStatus,
          costLimits: service.costLimits
        };
      }
    }
    
    return {
      hasAccess: false,
      reason: `No access configured for ${provider}${feature ? ` feature: ${feature}` : ''}`
    };
  }
  
  public async getServiceCredentials(
    userId: string, 
    provider: ServiceProvider
  ): Promise<ServiceCredentials> {
    
    const accessResult = await this.checkServiceAccess(userId, provider);
    if (!accessResult.hasAccess) {
      throw new Error(`Access denied for ${provider}`);
    }
    
    const service = await this.accountRepo.getProvisionedService(accessResult.serviceId);
    
    // Decrypt credentials from vault
    const apiKey = await this.vaultService.getSecret(service.credentials.keyId);
    const additionalSecrets: Record<string, string> = {};
    
    if (service.credentials.additionalSecrets) {
      for (const [key, secretId] of Object.entries(service.credentials.additionalSecrets)) {
        additionalSecrets[key] = await this.vaultService.getSecret(secretId);
      }
    }
    
    return {
      apiKey,
      keyType: service.credentials.keyType,
      additionalSecrets,
      serviceConfig: service.configuration
    };
  }
  
  private resolveServiceConflicts(services: ProvisionedService[]): ProvisionedService[] {
    const serviceMap = new Map<string, ProvisionedService>();
    
    // Sort by precedence: team services override org services
    const sortedServices = services.sort((a, b) => {
      if (a.provider !== b.provider) return 0;
      
      // Team level takes precedence over org level
      if (a.accountType === 'team' && b.accountType === 'organization') return -1;
      if (a.accountType === 'organization' && b.accountType === 'team') return 1;
      
      // More recent services take precedence
      return b.updatedAt.getTime() - a.updatedAt.getTime();
    });
    
    for (const service of sortedServices) {
      const key = `${service.provider}`;
      if (!serviceMap.has(key)) {
        serviceMap.set(key, service);
      }
    }
    
    return Array.from(serviceMap.values());
  }
  
  private async calculateUserAccess(
    userId: string, 
    service: ProvisionedService
  ): Promise<UserServiceAccess> {
    
    // Get user's role in the account that provides this service
    const userRole = await this.getUserRoleInAccount(
      userId, 
      service.accountId, 
      service.accountType
    );
    
    // Apply role-based quota multipliers
    const quotaMultiplier = this.getQuotaMultiplier(userRole);
    const adjustedQuotas = this.applyQuotaMultiplier(service.quotas, quotaMultiplier);
    
    return {
      quotas: adjustedQuotas,
      costLimits: service.costLimits,
      permissions: this.getRolePermissions(userRole)
    };
  }
  
  private getQuotaMultiplier(role: TeamRole): number {
    const multipliers: Record<TeamRole, number> = {
      'owner': 1.0,
      'admin': 1.0,
      'member': 0.8,
      'viewer': 0.5
    };
    return multipliers[role] || 0.5;
  }
}

interface AvailableServices {
  aiModels: ServiceInfo[];
  dataStores: ServiceInfo[];
  integrations: ServiceInfo[];
  webCrawlers: ServiceInfo[];
  specialized: ServiceInfo[];
}

interface ServiceInfo {
  id: string;
  provider: ServiceProvider;
  name: string;
  features: ServiceFeature[];
  quotas: ServiceQuotas;
  costLimits: CostLimits;
  healthStatus: ServiceHealthStatus;
}

interface ServiceAccessResult {
  hasAccess: boolean;
  serviceId?: string;
  accountLevel?: 'team' | 'organization';
  quotaStatus?: QuotaStatus;
  costLimits?: CostLimits;
  reason?: string;
}

interface UserServiceAccess {
  quotas: ServiceQuotas;
  costLimits: CostLimits;
  permissions: string[];
}

interface ProvisionedServicesAPI {
  // Service Provisioning
  provisionService(
    accountId: string, 
    accountType: 'team' | 'organization',
    serviceData: CreateProvisionedServiceRequest
  ): Promise<ProvisionedService>;
  
  updateProvisionedService(
    serviceId: string, 
    updates: Partial<ProvisionedService>
  ): Promise<ProvisionedService>;
  
  removeProvisionedService(serviceId: string): Promise<void>;
  
  // Service Discovery
  getAvailableServices(userId: string): Promise<AvailableServices>;
  getProvisionedServices(
    accountId: string, 
    accountType: 'team' | 'organization'
  ): Promise<ProvisionedService[]>;
  
  // Access Control
  checkServiceAccess(
    userId: string, 
    provider: ServiceProvider, 
    feature?: string
  ): Promise<ServiceAccessResult>;
  
  getServiceCredentials(
    userId: string, 
    provider: ServiceProvider
  ): Promise<ServiceCredentials>;
  
  // Service Health
  checkServiceHealth(serviceId: string): Promise<ServiceHealthStatus>;
  getServiceHealthHistory(
    serviceId: string, 
    period: DateRange
  ): Promise<ServiceHealthMetric[]>;
  
  // Usage and Quotas
  trackServiceUsage(
    userId: string, 
    serviceId: string, 
    usage: ServiceUsageData
  ): Promise<void>;
  
  getServiceUsage(
    accountId: string, 
    accountType: 'team' | 'organization',
    period: DateRange
  ): Promise<ServiceUsageMetrics>;
  
  updateServiceQuotas(
    serviceId: string, 
    quotas: ServiceQuotas
  ): Promise<void>;
  
  // Cost Management
  getServiceCosts(
    accountId: string, 
    accountType: 'team' | 'organization',
    period: DateRange
  ): Promise<ServiceCostBreakdown>;
  
  // Credential Management
  rotateServiceCredentials(serviceId: string): Promise<void>;
  testServiceConnection(serviceId: string): Promise<ServiceConnectionTest>;
}

interface User {
  id: string;
  email: string;
  profile: UserProfile;
  preferences: UserPreferences;
  teamMemberships: TeamMembership[];
  createdAt: Date;
  updatedAt: Date;
}

interface UserProfile {
  firstName?: string;
  lastName?: string;
  displayName?: string;
  avatar?: string;
  bio?: string;
  timezone?: string;
  locale?: string;
  phoneNumber?: string;
  company?: string;
  jobTitle?: string;
}

interface UserPreferences {
  notifications: NotificationSettings;
  privacy: PrivacySettings;
  ui: UIPreferences;
  integrations: IntegrationSettings;
}

interface Team {
  id: string;
  name: string;
  description?: string;
  organizationId?: string;
  avatar?: string;
  settings: TeamSettings;
  members: TeamMembership[];
  modelAccess: ModelAccess[];
  billingInfo: BillingInfo;
  quotas: QuotaSettings;
  createdAt: Date;
  updatedAt: Date;
}

interface Organization {
  id: string;
  name: string;
  description?: string;
  domain?: string; // for email-based auto-joining
  avatar?: string;
  settings: OrganizationSettings;
  teams: Team[];
  paymentMethods: PaymentMethod[];
  billingInfo: BillingInfo;
  modelAccess: ModelAccess[];
  quotas: QuotaSettings;
  compliance: ComplianceSettings;
  createdAt: Date;
  updatedAt: Date;
}

interface TeamMembership {
  id: string;
  userId: string;
  teamId: string;
  role: TeamRole;
  permissions: TeamPermission[];
  joinedAt: Date;
  invitedBy?: string;
}

type TeamRole = 'owner' | 'admin' | 'member' | 'viewer';

interface TeamPermission {
  resource: string;
  actions: string[];
  conditions?: PolicyCondition[];
}

interface ModelAccess {
  provider: AIProvider;
  models: ModelConfiguration[];
  apiKeyId: string; // Reference to encrypted key in Vault
  enabled: boolean;
  quotas: ModelQuotas;
  costLimits: CostLimits;
  createdAt: Date;
}

type AIProvider = 'openai' | 'anthropic' | 'groq' | 'google' | 'cohere' | 'huggingface';

interface ModelConfiguration {
  name: string;
  enabled: boolean;
  parameters?: ModelParameters;
  costPerToken?: number;
  quotas?: ModelQuotas;
}

interface ModelQuotas {
  requestsPerMinute?: number;
  requestsPerDay?: number;
  tokensPerMinute?: number;
  tokensPerDay?: number;
  maxCostPerDay?: number;
}

interface BillingInfo {
  customerId: string; // Stripe customer ID
  subscriptionId?: string;
  planType: PlanType;
  billingCycle: BillingCycle;
  currentUsage: UsageMetrics;
  invoices: Invoice[];
  paymentHistory: PaymentRecord[];
}

type PlanType = 'free' | 'starter' | 'professional' | 'enterprise';
type BillingCycle = 'monthly' | 'yearly';

interface PaymentMethod {
  id: string;
  type: 'card' | 'bank' | 'paypal';
  details: PaymentMethodDetails;
  isDefault: boolean;
  createdAt: Date;
}

interface UsageMetrics {
  period: {
    start: Date;
    end: Date;
  };
  aiModelUsage: ModelUsage[];
  totalCost: number;
  requestCount: number;
  tokenCount: number;
}

interface ModelUsage {
  provider: AIProvider;
  model: string;
  requestCount: number;
  tokenCount: number;
  cost: number;
}

interface AccountManagementService {
  // User Account Management
  createUserAccount(userData: CreateUserRequest): Promise<User>;
  updateUserProfile(userId: string, profile: Partial<UserProfile>): Promise<User>;
  updateUserPreferences(userId: string, preferences: Partial<UserPreferences>): Promise<User>;
  getUserAccount(userId: string): Promise<User>;
  deleteUserAccount(userId: string): Promise<void>;
  
  // Team Management
  createTeam(creatorId: string, teamData: CreateTeamRequest): Promise<Team>;
  updateTeam(teamId: string, updates: Partial<Team>): Promise<Team>;
  deleteTeam(teamId: string): Promise<void>;
  getTeam(teamId: string): Promise<Team>;
  getUserTeams(userId: string): Promise<Team[]>;
  
  // Team Membership
  inviteUserToTeam(teamId: string, email: string, role: TeamRole, invitedBy: string): Promise<TeamInvitation>;
  acceptTeamInvitation(invitationToken: string): Promise<TeamMembership>;
  rejectTeamInvitation(invitationToken: string): Promise<void>;
  updateTeamMembership(membershipId: string, updates: Partial<TeamMembership>): Promise<TeamMembership>;
  removeTeamMember(teamId: string, userId: string): Promise<void>;
  leaveTeam(teamId: string, userId: string): Promise<void>;
  
  // Organization Management
  createOrganization(creatorId: string, orgData: CreateOrganizationRequest): Promise<Organization>;
  updateOrganization(orgId: string, updates: Partial<Organization>): Promise<Organization>;
  deleteOrganization(orgId: string): Promise<void>;
  getOrganization(orgId: string): Promise<Organization>;
  addTeamToOrganization(orgId: string, teamId: string): Promise<void>;
  removeTeamFromOrganization(orgId: string, teamId: string): Promise<void>;
  
  // Resource Access Management
  addModelAccess(accountId: string, accountType: 'team' | 'org', modelAccess: ModelAccess): Promise<void>;
  updateModelAccess(accessId: string, updates: Partial<ModelAccess>): Promise<ModelAccess>;
  removeModelAccess(accessId: string): Promise<void>;
  getUserAvailableModels(userId: string): Promise<AvailableModels>;
  checkModelAccess(userId: string, provider: AIProvider, model: string): Promise<ModelAccessResult>;
  
  // API Key Management
  addAPIKey(accountId: string, accountType: 'team' | 'org', provider: AIProvider, apiKey: string): Promise<string>;
  rotateAPIKey(keyId: string, newKey: string): Promise<void>;
  removeAPIKey(keyId: string): Promise<void>;
  getAPIKeyForUser(userId: string, provider: AIProvider): Promise<string>;
  
  // Billing and Payment
  addPaymentMethod(accountId: string, accountType: 'team' | 'org', paymentMethod: PaymentMethodData): Promise<PaymentMethod>;
  updatePaymentMethod(paymentMethodId: string, updates: Partial<PaymentMethodData>): Promise<PaymentMethod>;
  removePaymentMethod(paymentMethodId: string): Promise<void>;
  setDefaultPaymentMethod(paymentMethodId: string): Promise<void>;
  getPaymentMethods(accountId: string, accountType: 'team' | 'org'): Promise<PaymentMethod[]>;
  
  // Subscription Management
  createSubscription(accountId: string, accountType: 'team' | 'org', planType: PlanType): Promise<Subscription>;
  updateSubscription(subscriptionId: string, changes: SubscriptionUpdate): Promise<Subscription>;
  cancelSubscription(subscriptionId: string): Promise<void>;
  
  // Usage Tracking and Quotas
  trackModelUsage(userId: string, provider: AIProvider, model: string, usage: UsageData): Promise<void>;
  getUserUsage(userId: string, period: DateRange): Promise<UsageMetrics>;
  getTeamUsage(teamId: string, period: DateRange): Promise<UsageMetrics>;
  getOrganizationUsage(orgId: string, period: DateRange): Promise<UsageMetrics>;
  checkQuota(userId: string, provider: AIProvider, model: string): Promise<QuotaStatus>;
  updateQuotas(accountId: string, accountType: 'team' | 'org', quotas: QuotaSettings): Promise<void>;
  
  // Billing and Invoicing
  generateInvoice(accountId: string, accountType: 'team' | 'org', period: DateRange): Promise<Invoice>;
  getInvoices(accountId: string, accountType: 'team' | 'org'): Promise<Invoice[]>;
  payInvoice(invoiceId: string): Promise<PaymentResult>;
  
  // Analytics and Reporting
  getUsageAnalytics(accountId: string, accountType: 'team' | 'org', period: DateRange): Promise<UsageAnalytics>;
  getCostAnalytics(accountId: string, accountType: 'team' | 'org', period: DateRange): Promise<CostAnalytics>;
  getPerformanceMetrics(accountId: string, accountType: 'team' | 'org'): Promise<PerformanceMetrics>;
  
  // Administrative
  getAccountHierarchy(userId: string): Promise<AccountHierarchy>;
  transferTeamOwnership(teamId: string, newOwnerId: string): Promise<void>;
  transferOrganizationOwnership(orgId: string, newOwnerId: string): Promise<void>;
  suspendAccount(accountId: string, accountType: 'user' | 'team' | 'org', reason: string): Promise<void>;
  reactivateAccount(accountId: string, accountType: 'user' | 'team' | 'org'): Promise<void>;
}

class TeamInvitationManager {
  constructor(
    private emailService: EmailService,
    private teamRepository: TeamRepository,
    private userRepository: UserRepository
  ) {}

  public async inviteUserToTeam(
    teamId: string, 
    email: string, 
    role: TeamRole, 
    invitedBy: string
  ): Promise<TeamInvitation> {
    
    // Validate team exists and inviter has permission
    const team = await this.teamRepository.findById(teamId);
    if (!team) {
      throw new Error('Team not found');
    }

    const inviterMembership = team.members.find(m => m.userId === invitedBy);
    if (!inviterMembership || !this.canInviteMembers(inviterMembership.role)) {
      throw new Error('Insufficient permissions to invite members');
    }

    // Check if user already exists
    const existingUser = await this.userRepository.findByEmail(email);
    
    // Generate invitation token
    const invitationToken = this.generateInvitationToken();
    const expiresAt = new Date(Date.now() + 7 * 24 * 60 * 60 * 1000); // 7 days

    const invitation: TeamInvitation = {
      id: uuidv4(),
      teamId,
      email,
      role,
      invitedBy,
      token: invitationToken,
      status: 'pending',
      expiresAt,
      createdAt: new Date()
    };

    // Store invitation
    await this.teamRepository.saveInvitation(invitation);

    // Send invitation email
    await this.sendInvitationEmail(invitation, team, existingUser);

    return invitation;
  }

  public async acceptInvitation(token: string): Promise<TeamMembership> {
    const invitation = await this.teamRepository.findInvitationByToken(token);
    if (!invitation || invitation.status !== 'pending') {
      throw new Error('Invalid or expired invitation');
    }

    if (invitation.expiresAt < new Date()) {
      throw new Error('Invitation has expired');
    }

    // Get or create user
    let user = await this.userRepository.findByEmail(invitation.email);
    if (!user) {
      // Create minimal user record - they'll complete registration later
      user = await this.userRepository.create({
        email: invitation.email,
        profile: { displayName: invitation.email.split('@')[0] },
        status: 'pending_verification'
      });
    }

    // Create team membership
    const membership: TeamMembership = {
      id: uuidv4(),
      userId: user.id,
      teamId: invitation.teamId,
      role: invitation.role,
      permissions: this.getDefaultPermissions(invitation.role),
      joinedAt: new Date(),
      invitedBy: invitation.invitedBy
    };

    await this.teamRepository.addMember(membership);
    
    // Update invitation status
    await this.teamRepository.updateInvitation(invitation.id, { 
      status: 'accepted',
      acceptedAt: new Date()
    });

    return membership;
  }

  private async sendInvitationEmail(
    invitation: TeamInvitation, 
    team: Team, 
    existingUser?: User
  ): Promise<void> {
    const inviterUser = await this.userRepository.findById(invitation.invitedBy);
    const acceptUrl = `${process.env.APP_URL}/invite/${invitation.token}`;

    await this.emailService.sendTemplate(invitation.email, 'team-invitation', {
      teamName: team.name,
      inviterName: inviterUser?.profile.displayName || inviterUser?.email,
      role: invitation.role,
      acceptUrl,
      isExistingUser: !!existingUser,
      expiresAt: invitation.expiresAt
    });
  }

  private canInviteMembers(role: TeamRole): boolean {
    return ['owner', 'admin'].includes(role);
  }

  private generateInvitationToken(): string {
    return crypto.randomBytes(32).toString('hex');
  }

  private getDefaultPermissions(role: TeamRole): TeamPermission[] {
    const basePermissions: Record<TeamRole, TeamPermission[]> = {
      owner: [
        { resource: '*', actions: ['*'] }
      ],
      admin: [
        { resource: 'team', actions: ['read', 'update'] },
        { resource: 'members', actions: ['read', 'invite', 'remove'] },
        { resource: 'models', actions: ['read', 'use'] },
        { resource: 'billing', actions: ['read'] }
      ],
      member: [
        { resource: 'team', actions: ['read'] },
        { resource: 'members', actions: ['read'] },
        { resource: 'models', actions: ['read', 'use'] }
      ],
      viewer: [
        { resource: 'team', actions: ['read'] },
        { resource: 'models', actions: ['read'] }
      ]
    };

    return basePermissions[role] || [];
  }
}

class ResourceAccessManager {
  constructor(
    private accountRepo: AccountRepository,
    private vaultService: VaultService
  ) {}

  public async checkModelAccess(
    userId: string, 
    provider: AIProvider, 
    model: string
  ): Promise<ModelAccessResult> {
    
    // Get user's account hierarchy
    const hierarchy = await this.getAccountHierarchy(userId);
    
    // Check access at each level (user -> team -> org)
    for (const level of hierarchy) {
      const access = await this.checkLevelAccess(level, provider, model);
      if (access.hasAccess) {
        // Check quotas
        const quotaStatus = await this.checkQuotas(userId, level, provider, model);
        
        return {
          hasAccess: true,
          level: level.type,
          accountId: level.id,
          apiKeyId: access.apiKeyId,
          quotas: access.quotas,
          quotaStatus,
          costLimits: access.costLimits
        };
      }
    }

    return {
      hasAccess: false,
      reason: 'No access configured for this model'
    };
  }

  public async getAPIKeyForUser(userId: string, provider: AIProvider): Promise<string> {
    const hierarchy = await this.getAccountHierarchy(userId);
    
    for (const level of hierarchy) {
      const modelAccess = await this.getLevelModelAccess(level.id, level.type, provider);
      if (modelAccess && modelAccess.enabled && modelAccess.apiKeyId) {
        // Decrypt API key from vault
        return await this.vaultService.getSecret(modelAccess.apiKeyId);
      }
    }

    throw new Error(`No API key configured for ${provider}`);
  }

  public async trackUsage(
    userId: string, 
    provider: AIProvider, 
    model: string, 
    usage: UsageData
  ): Promise<void> {
    
    const hierarchy = await this.getAccountHierarchy(userId);
    const accessResult = await this.checkModelAccess(userId, provider, model);
    
    if (!accessResult.hasAccess) {
      throw new Error('Access denied for usage tracking');
    }

    // Track usage at the account level that provides access
    const usageRecord: UsageRecord = {
      id: uuidv4(),
      userId,
      accountId: accessResult.accountId,
      accountType: accessResult.level,
      provider,
      model,
      requestCount: usage.requestCount,
      tokenCount: usage.tokenCount,
      cost: usage.cost,
      metadata: usage.metadata,
      timestamp: new Date()
    };

    await this.accountRepo.saveUsageRecord(usageRecord);
    
    // Update real-time usage counters
    await this.updateUsageCounters(accessResult.accountId, accessResult.level, usage);
    
    // Check if usage exceeds any limits
    await this.checkAndEnforceQuotas(userId, accessResult.accountId, accessResult.level, provider, model);
  }

  private async getAccountHierarchy(userId: string): Promise<AccountLevel[]> {
    const user = await this.accountRepo.getUserWithHierarchy(userId);
    const hierarchy: AccountLevel[] = [];

    // Start with user's teams
    for (const membership of user.teamMemberships) {
      const team = await this.accountRepo.getTeam(membership.teamId);
      hierarchy.push({
        type: 'team',
        id: team.id,
        name: team.name,
        permissions: membership.permissions
      });

      // Add organization if team belongs to one
      if (team.organizationId) {
        const org = await this.accountRepo.getOrganization(team.organizationId);
        hierarchy.push({
          type: 'organization',
          id: org.id,
          name: org.name,
          permissions: [] // Org permissions inherited through team
        });
      }
    }

    // Remove duplicates and sort by precedence (org -> team -> user)
    return this.deduplicateAndSort(hierarchy);
  }

  private async checkLevelAccess(
    level: AccountLevel, 
    provider: AIProvider, 
    model: string
  ): Promise<LevelAccessResult> {
    
    const modelAccess = await this.getLevelModelAccess(level.id, level.type, provider);
    
    if (!modelAccess || !modelAccess.enabled) {
      return { hasAccess: false };
    }

    // Check if specific model is enabled
    const modelConfig = modelAccess.models.find(m => m.name === model);
    if (!modelConfig || !modelConfig.enabled) {
      return { hasAccess: false };
    }

    return {
      hasAccess: true,
      apiKeyId: modelAccess.apiKeyId,
      quotas: modelConfig.quotas || modelAccess.quotas,
      costLimits: modelAccess.costLimits
    };
  }

  private async checkQuotas(
    userId: string, 
    level: AccountLevel, 
    provider: AIProvider, 
    model: string
  ): Promise<QuotaStatus> {
    
    const currentUsage = await this.getCurrentUsage(level.id, level.type, provider, model);
    const quotas = await this.getQuotas(level.id, level.type, provider, model);

    const status: QuotaStatus = {
      withinLimits: true,
      usage: currentUsage,
      limits: quotas,
      warnings: []
    };

    // Check various quota limits
    if (quotas.requestsPerMinute && currentUsage.requestsPerMinute >= quotas.requestsPerMinute) {
      status.withinLimits = false;
      status.warnings.push('Requests per minute limit exceeded');
    }

    if (quotas.requestsPerDay && currentUsage.requestsPerDay >= quotas.requestsPerDay) {
      status.withinLimits = false;
      status.warnings.push('Daily request limit exceeded');
    }

    if (quotas.maxCostPerDay && currentUsage.costPerDay >= quotas.maxCostPerDay) {
      status.withinLimits = false;
      status.warnings.push('Daily cost limit exceeded');
    }

    return status;
  }
}

interface ModelAccessResult {
  hasAccess: boolean;
  level?: 'team' | 'organization';
  accountId?: string;
  apiKeyId?: string;
  quotas?: ModelQuotas;
  quotaStatus?: QuotaStatus;
  costLimits?: CostLimits;
  reason?: string;
}

interface AccountLevel {
  type: 'team' | 'organization';
  id: string;
  name: string;
  permissions: TeamPermission[];
}

interface QuotaStatus {
  withinLimits: boolean;
  usage: CurrentUsage;
  limits: ModelQuotas;
  warnings: string[];
}

class BillingManager {
  constructor(
    private stripeService: StripeService,
    private accountRepo: AccountRepository,
    private emailService: EmailService
  ) {}

  public async addPaymentMethod(
    accountId: string, 
    accountType: 'team' | 'org', 
    paymentMethodData: PaymentMethodData
  ): Promise<PaymentMethod> {
    
    // Get or create Stripe customer
    const account = await this.getAccount(accountId, accountType);
    let customerId = account.billingInfo?.customerId;
    
    if (!customerId) {
      const customer = await this.stripeService.customers.create({
        email: account.billingEmail,
        name: account.name,
        metadata: {
          accountId,
          accountType
        }
      });
      customerId = customer.id;
      
      // Update account with customer ID
      await this.updateBillingInfo(accountId, accountType, { customerId });
    }

    // Create payment method in Stripe
    const stripePaymentMethod = await this.stripeService.paymentMethods.create({
      type: paymentMethodData.type,
      ...paymentMethodData.details
    });

    // Attach to customer
    await this.stripeService.paymentMethods.attach(stripePaymentMethod.id, {
      customer: customerId
    });

    const paymentMethod: PaymentMethod = {
      id: uuidv4(),
      stripePaymentMethodId: stripePaymentMethod.id,
      type: paymentMethodData.type,
      details: this.extractPaymentMethodDetails(stripePaymentMethod),
      isDefault: false,
      createdAt: new Date()
    };

    await this.accountRepo.savePaymentMethod(accountId, accountType, paymentMethod);
    
    return paymentMethod;
  }

  public async processUsageBilling(
    accountId: string, 
    accountType: 'team' | 'org', 
    period: DateRange
  ): Promise<Invoice> {
    
    const usage = await this.calculateUsageForPeriod(accountId, accountType, period);
    const account = await this.getAccount(accountId, accountType);
    
    if (usage.totalCost === 0) {
      // No usage, no invoice needed
      return null;
    }

    // Create invoice items in Stripe
    const invoiceItems = await Promise.all(
      usage.aiModelUsage.map(modelUsage => 
        this.stripeService.invoiceItems.create({
          customer: account.billingInfo.customerId,
          amount: Math.round(modelUsage.cost * 100), // Convert to cents
          currency: 'usd',
          description: `${modelUsage.provider} ${modelUsage.model} - ${modelUsage.requestCount} requests, ${modelUsage.tokenCount} tokens`,
          period: {
            start: Math.floor(period.start.getTime() / 1000),
            end: Math.floor(period.end.getTime() / 1000)
          }
        })
      )
    );

    // Create invoice
    const stripeInvoice = await this.stripeService.invoices.create({
      customer: account.billingInfo.customerId,
      collection_method: 'charge_automatically',
      auto_advance: true
    });

    // Finalize and pay invoice
    const finalizedInvoice = await this.stripeService.invoices.finalizeInvoice(stripeInvoice.id);
    
    const invoice: Invoice = {
      id: uuidv4(),
      stripeInvoiceId: finalizedInvoice.id,
      accountId,
      accountType,
      period,
      items: usage.aiModelUsage.map(modelUsage => ({
        description: `${modelUsage.provider} ${modelUsage.model}`,
        quantity: modelUsage.requestCount,
        unitPrice: modelUsage.cost / modelUsage.requestCount,
        totalPrice: modelUsage.cost
      })),
      subtotal: usage.totalCost,
      tax: finalizedInvoice.tax || 0,
      total: finalizedInvoice.total / 100,
      status: finalizedInvoice.status as InvoiceStatus,
      paidAt: finalizedInvoice.status_transitions?.paid_at ? new Date(finalizedInvoice.status_transitions.paid_at * 1000) : null,
      createdAt: new Date()
    };

    await this.accountRepo.saveInvoice(invoice);
    
    // Send invoice email
    await this.sendInvoiceEmail(account, invoice);
    
    return invoice;
  }

  public async handleWebhook(event: Stripe.Event): Promise<void> {
    switch (event.type) {
      case 'invoice.payment_succeeded':
        await this.handleInvoicePaymentSuccess(event.data.object as Stripe.Invoice);
        break;
      case 'invoice.payment_failed':
        await this.handleInvoicePaymentFailure(event.data.object as Stripe.Invoice);
        break;
      case 'customer.subscription.updated':
        await this.handleSubscriptionUpdate(event.data.object as Stripe.Subscription);
        break;
      default:
        console.log(`Unhandled webhook event type: ${event.type}`);
    }
  }

  private async handleInvoicePaymentSuccess(invoice: Stripe.Invoice): Promise<void> {
    const ourInvoice = await this.accountRepo.findInvoiceByStripeId(invoice.id);
    if (ourInvoice) {
      await this.accountRepo.updateInvoice(ourInvoice.id, {
        status: 'paid',
        paidAt: new Date()
      });
      
      // Send payment confirmation email
      const account = await this.getAccount(ourInvoice.accountId, ourInvoice.accountType);
      await this.emailService.sendTemplate(account.billingEmail, 'payment-confirmation', {
        invoiceId: ourInvoice.id,
        amount: ourInvoice.total,
        paidAt: new Date()
      });
    }
  }

  private async calculateUsageForPeriod(
    accountId: string, 
    accountType: 'team' | 'org', 
    period: DateRange
  ): Promise<UsageMetrics> {
    
    const usageRecords = await this.accountRepo.getUsageRecords(accountId, accountType, period);
    
    const modelUsageMap = new Map<string, ModelUsage>();
    let totalCost = 0;
    let totalRequests = 0;
    let totalTokens = 0;

    for (const record of usageRecords) {
      const key = `${record.provider}-${record.model}`;
      const existing = modelUsageMap.get(key) || {
        provider: record.provider,
        model: record.model,
        requestCount: 0,
        tokenCount: 0,
        cost: 0
      };

      existing.requestCount += record.requestCount;
      existing.tokenCount += record.tokenCount;
      existing.cost += record.cost;

      modelUsageMap.set(key, existing);
      
      totalCost += record.cost;
      totalRequests += record.requestCount;
      totalTokens += record.tokenCount;
    }

    return {
      period,
      aiModelUsage: Array.from(modelUsageMap.values()),
      totalCost,
      requestCount: totalRequests,
      tokenCount: totalTokens
    };
  }
}