create(orgSlug: string, payload: CreateServicePayload): Promise<CreateServiceResponse>

const result = await sso.services.create('acme-corp', {
  slug: 'main-app',
  name: 'Main Application',
  service_type: 'web',
  github_scopes: ['user:email', 'read:org'],
  redirect_uris: ['https://app.acme.com/callback']
});
console.log('Service created with client_id:', result.service.client_id);

list(orgSlug: string): Promise<ServiceListResponse>

const result = await sso.services.list('acme-corp');
console.log(`Using ${result.usage.current_services} of ${result.usage.max_services} services`);
result.services.forEach(svc => console.log(svc.name, svc.client_id));

get(orgSlug: string, serviceSlug: string): Promise<ServiceResponse>

const service = await sso.services.get('acme-corp', 'main-app');
console.log(service.service.redirect_uris);
console.log(service.plans);

update(orgSlug: string, serviceSlug: string, payload: UpdateServicePayload): Promise<Service>

const updated = await sso.services.update('acme-corp', 'main-app', {
  name: 'Main Application v2',
  redirect_uris: ['https://app.acme.com/callback', 'https://app.acme.com/oauth']
});
console.log('Service updated:', updated.name);

delete(orgSlug: string, serviceSlug: string): Promise<void>

await sso.services.delete('acme-corp', 'old-app');
console.log('Service deleted successfully');

plans.create(orgSlug: string, serviceSlug: string, payload: CreatePlanPayload): Promise<PlanResponse>

const result = await sso.services.plans.create('acme-corp', 'main-app', {
  name: 'pro',
  price_cents: 2999,
  currency: 'usd',
  features: ['api-access', 'advanced-analytics', 'priority-support']
});
console.log(result.plan.name, result.subscription_count);

plans.list(orgSlug: string, serviceSlug: string): Promise<PlanResponse[]>

const plans = await sso.services.plans.list('acme-corp', 'main-app');
plans.forEach(p => console.log(p.plan.name, p.subscription_count));

plans.update(orgSlug: string, serviceSlug: string, planId: string, payload: UpdatePlanPayload): Promise<PlanResponse>

const result = await sso.services.plans.update('acme-corp', 'main-app', 'plan_123', {
  name: 'Pro Plus',
  price_cents: 3999,
  features: ['api-access', 'advanced-analytics', 'priority-support', 'custom-integrations']
});
console.log('Updated plan:', result.plan.name);

plans.delete(orgSlug: string, serviceSlug: string, planId: string): Promise<void>

try {
  await sso.services.plans.delete('acme-corp', 'main-app', 'plan_123');
  console.log('Plan deleted successfully');
} catch (error) {
  console.error('Cannot delete plan with active subscriptions');
}

apiKeys.create(orgSlug: string, serviceSlug: string, payload: CreateApiKeyPayload): Promise<ApiKeyCreateResponse>

const apiKey = await sso.services.apiKeys.create('acme-corp', 'main-app', {
  name: 'Production Backend',
  permissions: ['read:users', 'write:subscriptions'],
  expires_in_days: 90
});

// IMPORTANT: Store this key securely - it won't be shown again
console.log('API Key:', apiKey.key);
console.log('Prefix:', apiKey.prefix);

// Store in environment variable or secrets manager
process.env.SSO_API_KEY = apiKey.key;

apiKeys.list(orgSlug: string, serviceSlug: string, options?: { limit?: number; offset?: number }): Promise<ListApiKeysResponse>

const result = await sso.services.apiKeys.list('acme-corp', 'main-app', {
  limit: 50,
  offset: 0
});

console.log(`Total API keys: ${result.total}`);
result.api_keys.forEach(key => {
  console.log(`${key.name} (${key.prefix})`);
  console.log(`Permissions: ${key.permissions.join(', ')}`);
  console.log(`Last used: ${key.last_used_at || 'Never'}`);
});

apiKeys.get(orgSlug: string, serviceSlug: string, apiKeyId: string): Promise<ApiKey>

const apiKey = await sso.services.apiKeys.get('acme-corp', 'main-app', 'key_abc123');
console.log(`Name: ${apiKey.name}`);
console.log(`Permissions: ${apiKey.permissions.join(', ')}`);
console.log(`Expires: ${apiKey.expires_at || 'Never'}`);

apiKeys.delete(orgSlug: string, serviceSlug: string, apiKeyId: string): Promise<void>

await sso.services.apiKeys.delete('acme-corp', 'main-app', 'key_abc123');
console.log('API key deleted successfully');

saml.configure(orgSlug: string, serviceSlug: string, payload: ConfigureSamlPayload): Promise<ConfigureSamlResponse>

const result = await sso.services.saml.configure('acme-corp', 'main-app', {
  enabled: true,
  entity_id: 'https://salesforce.example.com',
  acs_url: 'https://salesforce.example.com/saml/acs',
  name_id_format: 'urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress',
  attribute_mapping: {
    email: 'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress',
    id: 'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name'
  },
  sign_assertions: true,
  sign_response: true
});
console.log(result.message); // "SAML configuration updated successfully"

saml.getConfig(orgSlug: string, serviceSlug: string): Promise<SamlConfig>

const config = await sso.services.saml.getConfig('acme-corp', 'main-app');
if (config.enabled && config.has_certificate) {
  console.log('SAML IdP is ready');
  console.log('Entity ID:', config.entity_id);
  console.log('ACS URL:', config.acs_url);
}

saml.deleteConfig(orgSlug: string, serviceSlug: string): Promise<ConfigureSamlResponse>

await sso.services.saml.deleteConfig('acme-corp', 'main-app');
console.log('SAML IdP configuration deleted');

saml.generateCertificate(orgSlug: string, serviceSlug: string): Promise<SamlCertificate>

const cert = await sso.services.saml.generateCertificate('acme-corp', 'main-app');
console.log('Certificate generated, valid until:', cert.valid_until);
console.log('Public certificate:\n', cert.public_key);
// Provide cert.public_key to your Service Provider

saml.getCertificate(orgSlug: string, serviceSlug: string): Promise<SamlCertificate>

try {
  const cert = await sso.services.saml.getCertificate('acme-corp', 'main-app');
  console.log('Certificate expires:', cert.valid_until);
} catch (error) {
  console.log('No active certificate - generate one first');
}

saml.getMetadataUrl(baseURL: string, orgSlug: string, serviceSlug: string): string

const metadataUrl = sso.services.saml.getMetadataUrl(
  'https://sso.example.com',
  'acme-corp',
  'main-app'
);
console.log('Provide this URL to your SP:', metadataUrl);
// https://sso.example.com/saml/acme-corp/main-app/metadata

saml.getSsoUrl(baseURL: string, orgSlug: string, serviceSlug: string): string

const ssoUrl = sso.services.saml.getSsoUrl(
  'https://sso.example.com',
  'acme-corp',
  'main-app'
);
console.log('SSO endpoint:', ssoUrl);
// https://sso.example.com/saml/acme-corp/main-app/sso

interface Service {
  id: string;
  organization_id: string;
  slug: string;
  name: string;
  service_type: 'web' | 'mobile' | 'cli' | 'api';
  client_id: string;
  redirect_uris: string[];
  created_at: string;
  updated_at: string;
}

interface ServiceResponse {
  service: Service;
  provider_grants: ProviderGrant[];
  plans: Plan[];
}

interface ServiceListResponse {
  services: Service[];
  usage: ServiceUsage;
}

interface CreateServicePayload {
  slug: string;
  name: string;
  service_type: 'web' | 'mobile' | 'cli' | 'api';
  github_scopes?: string[];
  google_scopes?: string[];
  microsoft_scopes?: string[];
  redirect_uris: string[];
}

interface CreateServiceResponse {
  service: Service;
  client_id: string;
}

interface UpdateServicePayload {
  name?: string;
  github_scopes?: string[];
  google_scopes?: string[];
  microsoft_scopes?: string[];
  redirect_uris?: string[];
}

interface Plan {
  id: string;
  service_id: string;
  name: string;
  price_cents: number;
  currency: string;
  features: string[];
  created_at: string;
  updated_at: string;
}

interface PlanResponse {
  plan: Plan;
  subscription_count: number;
}

interface CreatePlanPayload {
  name: string;
  price_cents: number;
  currency: string;
  features: string[];
}

interface UpdatePlanPayload {
  name?: string;
  price_cents?: number;
  currency?: string;
  features?: string[];
}

interface ApiKey {
  id: string;
  prefix: string;
  name: string;
  permissions: string[];
  expires_at?: string;
  last_used_at?: string;
  created_at: string;
}

interface ApiKeyCreateResponse {
  id: string;
  key: string;
  prefix: string;
  name: string;
  permissions: string[];
  expires_at?: string;
  created_at: string;
}

interface CreateApiKeyPayload {
  name: string;
  permissions: string[];
  expires_in_days?: number;
}

interface ListApiKeysResponse {
  api_keys: ApiKey[];
  total: number;
}

interface SamlConfig {
  enabled: boolean;
  entity_id: string;
  acs_url: string;
  name_id_format: string;
  attribute_mapping: Record<string, string>;
  sign_assertions: boolean;
  sign_response: boolean;
  has_certificate: boolean;
}

interface ConfigureSamlPayload {
  enabled: boolean;
  entity_id: string;
  acs_url: string;
  name_id_format: string;
  attribute_mapping: Record<string, string>;
  sign_assertions: boolean;
  sign_response: boolean;
}

interface ConfigureSamlResponse {
  message: string;
}

interface SamlCertificate {
  id: string;
  public_key: string;
  valid_from: string;
  valid_until: string;
  is_active: boolean;
}