@flowcore/cli-plugin-iam 1.7.0 → 1.8.1

package/oclif.manifest.json

@@ -1,5 +1,178 @@
 {
   "commands": {
+    "assign:policy": {
+      "aliases": [],
+      "args": {
+        "POLICY_NAME": {
+          "description": "The name of the policy to assign",
+          "name": "POLICY_NAME",
+          "required": true
+        }
+      },
+      "description": "Assign an IAM policy to a user, API key, or role. Exactly one of --user, --key, or --role must be specified",
+      "examples": [
+        "$ flowcore iam assign policy read-access --user \"auth0|abc123\" -t my-org",
+        "$ flowcore iam assign policy read-access --key \"550e8400-e29b-41d4-a716-446655440000\" -t my-org",
+        "$ flowcore iam assign policy read-access --role data-reader -t my-org",
+        "$ flowcore iam assign policy read-access --user \"auth0|abc123\" -t my-org -j"
+      ],
+      "flags": {
+        "profile": {
+          "description": "Specify the configuration profile to use",
+          "name": "profile",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "json": {
+          "char": "j",
+          "description": "Output result as JSON",
+          "name": "json",
+          "required": false,
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "key": {
+          "description": "The API key ID to assign the policy to",
+          "exclusive": [
+            "user",
+            "role"
+          ],
+          "name": "key",
+          "required": false,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "role": {
+          "description": "The role name to assign the policy to",
+          "exclusive": [
+            "user",
+            "key"
+          ],
+          "name": "role",
+          "required": false,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "tenant": {
+          "char": "t",
+          "description": "The tenant (organization slug) containing the policy",
+          "name": "tenant",
+          "required": true,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "user": {
+          "description": "The user ID to assign the policy to",
+          "exclusive": [
+            "key",
+            "role"
+          ],
+          "name": "user",
+          "required": false,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "assign:policy",
+      "pluginAlias": "@flowcore/cli-plugin-iam",
+      "pluginName": "@flowcore/cli-plugin-iam",
+      "pluginType": "core",
+      "strict": true,
+      "enableJsonFlag": false,
+      "isESM": true,
+      "relativePath": [
+        "dist",
+        "commands",
+        "assign",
+        "policy.js"
+      ]
+    },
+    "assign:role": {
+      "aliases": [],
+      "args": {
+        "ROLE_NAME": {
+          "description": "The name of the role to assign",
+          "name": "ROLE_NAME",
+          "required": true
+        }
+      },
+      "description": "Assign an IAM role to a user or API key. Exactly one of --user or --key must be specified",
+      "examples": [
+        "$ flowcore iam assign role data-reader --user \"auth0|abc123\" -t my-org",
+        "$ flowcore iam assign role data-reader --key \"550e8400-e29b-41d4-a716-446655440000\" -t my-org",
+        "$ flowcore iam assign role data-reader --user \"auth0|abc123\" -t my-org -j"
+      ],
+      "flags": {
+        "profile": {
+          "description": "Specify the configuration profile to use",
+          "name": "profile",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "json": {
+          "char": "j",
+          "description": "Output result as JSON",
+          "name": "json",
+          "required": false,
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "key": {
+          "description": "The API key ID to assign the role to",
+          "exclusive": [
+            "user"
+          ],
+          "name": "key",
+          "required": false,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "tenant": {
+          "char": "t",
+          "description": "The tenant (organization slug) containing the role",
+          "name": "tenant",
+          "required": true,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "user": {
+          "description": "The user ID to assign the role to",
+          "exclusive": [
+            "key"
+          ],
+          "name": "user",
+          "required": false,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "assign:role",
+      "pluginAlias": "@flowcore/cli-plugin-iam",
+      "pluginName": "@flowcore/cli-plugin-iam",
+      "pluginType": "core",
+      "strict": true,
+      "enableJsonFlag": false,
+      "isESM": true,
+      "relativePath": [
+        "dist",
+        "commands",
+        "assign",
+        "role.js"
+      ]
+    },
     "delete:policy": {
       "aliases": [],
       "args": {
@@ -122,19 +295,20 @@
         "role.js"
       ]
     },
-    "edit:policy": {
+    "create:policy": {
       "aliases": [],
       "args": {
         "NAME": {
-          "description": "name",
+          "description": "The name of the policy to create",
           "name": "NAME",
           "required": true
         }
       },
-      "description": "Edit a policy in your preferred editor",
+      "description": "Create a new IAM policy with the specified name, version, and policy documents defining resource access rules",
       "examples": [
-        "$ flowcore iam edit policy my-policy -t my-tenant",
-        "$ FC_EDITOR=code flowcore iam edit policy my-policy -t my-tenant"
+        "$ flowcore iam create policy read-access -t my-org --version \"2024-01-01\" --documents '[{\"resource\":\"frn::my-org:data-core/*\",\"action\":[\"read\",\"fetch\"]}]'",
+        "$ cat docs.json | flowcore iam create policy read-access -t my-org --version \"2024-01-01\" --documents -",
+        "$ flowcore iam create policy admin-access -t my-org --version \"2024-01-01\" --description \"Full admin access\" --documents '[{\"resource\":\"frn::my-org:*\",\"action\":\"*\"}]' -j"
       ],
       "flags": {
         "profile": {
@@ -144,19 +318,51 @@
           "multiple": false,
           "type": "option"
         },
+        "description": {
+          "description": "A description of the policy",
+          "name": "description",
+          "required": false,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "documents": {
+          "description": "JSON array of policy documents, each with \"resource\" and \"action\" fields. Use \"-\" to read from stdin",
+          "name": "documents",
+          "required": true,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "json": {
+          "char": "j",
+          "description": "Output result as JSON",
+          "name": "json",
+          "required": false,
+          "allowNo": false,
+          "type": "boolean"
+        },
         "tenant": {
           "char": "t",
-          "description": "tenant",
+          "description": "The tenant (organization slug) to create the policy in",
           "name": "tenant",
           "required": true,
           "hasDynamicHelp": false,
           "multiple": false,
           "type": "option"
+        },
+        "version": {
+          "description": "The version of the policy (e.g. 2024-01-01)",
+          "name": "version",
+          "required": true,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
         }
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "edit:policy",
+      "id": "create:policy",
       "pluginAlias": "@flowcore/cli-plugin-iam",
       "pluginName": "@flowcore/cli-plugin-iam",
       "pluginType": "core",
@@ -166,23 +372,23 @@
       "relativePath": [
         "dist",
         "commands",
-        "edit",
+        "create",
         "policy.js"
       ]
     },
-    "edit:role": {
+    "create:role": {
       "aliases": [],
       "args": {
         "NAME": {
-          "description": "name",
+          "description": "The name of the role to create",
           "name": "NAME",
           "required": true
         }
       },
-      "description": "Edit a role in your preferred editor",
+      "description": "Create a new IAM role with the specified name and optional description",
       "examples": [
-        "$ flowcore iam edit role my-role -t my-tenant",
-        "$ FC_EDITOR=code flowcore iam edit role my-role -t my-tenant"
+        "$ flowcore iam create role data-reader -t my-org --description \"Read-only data access\"",
+        "$ flowcore iam create role admin -t my-org -j"
       ],
       "flags": {
         "profile": {
@@ -192,9 +398,25 @@
           "multiple": false,
           "type": "option"
         },
+        "description": {
+          "description": "A description of the role",
+          "name": "description",
+          "required": false,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "json": {
+          "char": "j",
+          "description": "Output result as JSON",
+          "name": "json",
+          "required": false,
+          "allowNo": false,
+          "type": "boolean"
+        },
         "tenant": {
           "char": "t",
-          "description": "tenant",
+          "description": "The tenant (organization slug) to create the role in",
           "name": "tenant",
           "required": true,
           "hasDynamicHelp": false,
@@ -204,7 +426,7 @@
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "edit:role",
+      "id": "create:role",
       "pluginAlias": "@flowcore/cli-plugin-iam",
       "pluginName": "@flowcore/cli-plugin-iam",
       "pluginType": "core",
@@ -214,21 +436,24 @@
       "relativePath": [
         "dist",
         "commands",
-        "edit",
+        "create",
         "role.js"
       ]
     },
-    "get:policy": {
+    "edit:policy": {
       "aliases": [],
       "args": {
         "NAME": {
           "description": "name",
           "name": "NAME",
-          "required": false
+          "required": true
         }
       },
-      "description": "Get a policy",
-      "examples": [],
+      "description": "Edit a policy in your preferred editor",
+      "examples": [
+        "$ flowcore iam edit policy my-policy -t my-tenant",
+        "$ FC_EDITOR=code flowcore iam edit policy my-policy -t my-tenant"
+      ],
       "flags": {
         "profile": {
           "description": "Specify the configuration profile to use",
@@ -237,35 +462,19 @@
           "multiple": false,
           "type": "option"
         },
-        "json": {
-          "char": "j",
-          "description": "json output",
-          "name": "json",
-          "required": false,
-          "allowNo": false,
-          "type": "boolean"
-        },
         "tenant": {
           "char": "t",
           "description": "tenant",
           "name": "tenant",
-          "required": false,
+          "required": true,
           "hasDynamicHelp": false,
           "multiple": false,
           "type": "option"
-        },
-        "wide": {
-          "char": "w",
-          "description": "wide output",
-          "name": "wide",
-          "required": false,
-          "allowNo": false,
-          "type": "boolean"
         }
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "get:policy",
+      "id": "edit:policy",
       "pluginAlias": "@flowcore/cli-plugin-iam",
       "pluginName": "@flowcore/cli-plugin-iam",
       "pluginType": "core",
@@ -275,21 +484,24 @@
       "relativePath": [
         "dist",
         "commands",
-        "get",
+        "edit",
         "policy.js"
       ]
     },
-    "get:role": {
+    "edit:role": {
       "aliases": [],
       "args": {
         "NAME": {
           "description": "name",
           "name": "NAME",
-          "required": false
+          "required": true
         }
       },
-      "description": "Get a role",
-      "examples": [],
+      "description": "Edit a role in your preferred editor",
+      "examples": [
+        "$ flowcore iam edit role my-role -t my-tenant",
+        "$ FC_EDITOR=code flowcore iam edit role my-role -t my-tenant"
+      ],
       "flags": {
         "profile": {
           "description": "Specify the configuration profile to use",
@@ -298,35 +510,19 @@
           "multiple": false,
           "type": "option"
         },
-        "json": {
-          "char": "j",
-          "description": "json output",
-          "name": "json",
-          "required": false,
-          "allowNo": false,
-          "type": "boolean"
-        },
         "tenant": {
           "char": "t",
           "description": "tenant",
           "name": "tenant",
-          "required": false,
+          "required": true,
           "hasDynamicHelp": false,
           "multiple": false,
           "type": "option"
-        },
-        "wide": {
-          "char": "w",
-          "description": "wide output",
-          "name": "wide",
-          "required": false,
-          "allowNo": false,
-          "type": "boolean"
         }
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "get:role",
+      "id": "edit:role",
       "pluginAlias": "@flowcore/cli-plugin-iam",
       "pluginName": "@flowcore/cli-plugin-iam",
       "pluginType": "core",
@@ -336,10 +532,709 @@
       "relativePath": [
         "dist",
         "commands",
-        "get",
+        "edit",
         "role.js"
       ]
+    },
+    "get:key-policies": {
+      "aliases": [],
+      "args": {
+        "KEY_ID": {
+          "description": "The API key ID to get policies for",
+          "name": "KEY_ID",
+          "required": true
+        }
+      },
+      "description": "List all IAM policies assigned to a specific API key",
+      "examples": [
+        "$ flowcore iam get key-policies \"550e8400-e29b-41d4-a716-446655440000\"",
+        "$ flowcore iam get key-policies \"550e8400-e29b-41d4-a716-446655440000\" -j",
+        "$ flowcore iam get key-policies \"550e8400-e29b-41d4-a716-446655440000\" -w"
+      ],
+      "flags": {
+        "profile": {
+          "description": "Specify the configuration profile to use",
+          "name": "profile",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "json": {
+          "char": "j",
+          "description": "Output result as JSON",
+          "name": "json",
+          "required": false,
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "wide": {
+          "char": "w",
+          "description": "Show additional columns in table output",
+          "name": "wide",
+          "required": false,
+          "allowNo": false,
+          "type": "boolean"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "get:key-policies",
+      "pluginAlias": "@flowcore/cli-plugin-iam",
+      "pluginName": "@flowcore/cli-plugin-iam",
+      "pluginType": "core",
+      "strict": true,
+      "enableJsonFlag": false,
+      "isESM": true,
+      "relativePath": [
+        "dist",
+        "commands",
+        "get",
+        "key-policies.js"
+      ]
+    },
+    "get:key-roles": {
+      "aliases": [],
+      "args": {
+        "KEY_ID": {
+          "description": "The API key ID to get roles for",
+          "name": "KEY_ID",
+          "required": true
+        }
+      },
+      "description": "List all IAM roles assigned to a specific API key",
+      "examples": [
+        "$ flowcore iam get key-roles \"550e8400-e29b-41d4-a716-446655440000\"",
+        "$ flowcore iam get key-roles \"550e8400-e29b-41d4-a716-446655440000\" -j",
+        "$ flowcore iam get key-roles \"550e8400-e29b-41d4-a716-446655440000\" -w"
+      ],
+      "flags": {
+        "profile": {
+          "description": "Specify the configuration profile to use",
+          "name": "profile",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "json": {
+          "char": "j",
+          "description": "Output result as JSON",
+          "name": "json",
+          "required": false,
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "wide": {
+          "char": "w",
+          "description": "Show additional columns in table output",
+          "name": "wide",
+          "required": false,
+          "allowNo": false,
+          "type": "boolean"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "get:key-roles",
+      "pluginAlias": "@flowcore/cli-plugin-iam",
+      "pluginName": "@flowcore/cli-plugin-iam",
+      "pluginType": "core",
+      "strict": true,
+      "enableJsonFlag": false,
+      "isESM": true,
+      "relativePath": [
+        "dist",
+        "commands",
+        "get",
+        "key-roles.js"
+      ]
+    },
+    "get:policy": {
+      "aliases": [],
+      "args": {
+        "NAME": {
+          "description": "name",
+          "name": "NAME",
+          "required": false
+        }
+      },
+      "description": "Get a policy",
+      "examples": [],
+      "flags": {
+        "profile": {
+          "description": "Specify the configuration profile to use",
+          "name": "profile",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "json": {
+          "char": "j",
+          "description": "json output",
+          "name": "json",
+          "required": false,
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "tenant": {
+          "char": "t",
+          "description": "tenant",
+          "name": "tenant",
+          "required": false,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "wide": {
+          "char": "w",
+          "description": "wide output",
+          "name": "wide",
+          "required": false,
+          "allowNo": false,
+          "type": "boolean"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "get:policy",
+      "pluginAlias": "@flowcore/cli-plugin-iam",
+      "pluginName": "@flowcore/cli-plugin-iam",
+      "pluginType": "core",
+      "strict": true,
+      "enableJsonFlag": false,
+      "isESM": true,
+      "relativePath": [
+        "dist",
+        "commands",
+        "get",
+        "policy.js"
+      ]
+    },
+    "get:role": {
+      "aliases": [],
+      "args": {
+        "NAME": {
+          "description": "name",
+          "name": "NAME",
+          "required": false
+        }
+      },
+      "description": "Get a role",
+      "examples": [],
+      "flags": {
+        "profile": {
+          "description": "Specify the configuration profile to use",
+          "name": "profile",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "json": {
+          "char": "j",
+          "description": "json output",
+          "name": "json",
+          "required": false,
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "tenant": {
+          "char": "t",
+          "description": "tenant",
+          "name": "tenant",
+          "required": false,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "wide": {
+          "char": "w",
+          "description": "wide output",
+          "name": "wide",
+          "required": false,
+          "allowNo": false,
+          "type": "boolean"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "get:role",
+      "pluginAlias": "@flowcore/cli-plugin-iam",
+      "pluginName": "@flowcore/cli-plugin-iam",
+      "pluginType": "core",
+      "strict": true,
+      "enableJsonFlag": false,
+      "isESM": true,
+      "relativePath": [
+        "dist",
+        "commands",
+        "get",
+        "role.js"
+      ]
+    },
+    "get:user-policies": {
+      "aliases": [],
+      "args": {
+        "USER_ID": {
+          "description": "The user ID to get policies for (e.g. auth0|abc123)",
+          "name": "USER_ID",
+          "required": true
+        }
+      },
+      "description": "List all IAM policies assigned to a specific user, optionally scoped to a tenant",
+      "examples": [
+        "$ flowcore iam get user-policies \"auth0|abc123\" -t my-org",
+        "$ flowcore iam get user-policies \"auth0|abc123\" -j",
+        "$ flowcore iam get user-policies \"auth0|abc123\" -t my-org -w"
+      ],
+      "flags": {
+        "profile": {
+          "description": "Specify the configuration profile to use",
+          "name": "profile",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "json": {
+          "char": "j",
+          "description": "Output result as JSON",
+          "name": "json",
+          "required": false,
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "tenant": {
+          "char": "t",
+          "description": "Scope results to a specific tenant (organization slug)",
+          "name": "tenant",
+          "required": false,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "wide": {
+          "char": "w",
+          "description": "Show additional columns in table output",
+          "name": "wide",
+          "required": false,
+          "allowNo": false,
+          "type": "boolean"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "get:user-policies",
+      "pluginAlias": "@flowcore/cli-plugin-iam",
+      "pluginName": "@flowcore/cli-plugin-iam",
+      "pluginType": "core",
+      "strict": true,
+      "enableJsonFlag": false,
+      "isESM": true,
+      "relativePath": [
+        "dist",
+        "commands",
+        "get",
+        "user-policies.js"
+      ]
+    },
+    "get:user-roles": {
+      "aliases": [],
+      "args": {
+        "USER_ID": {
+          "description": "The user ID to get roles for (e.g. auth0|abc123)",
+          "name": "USER_ID",
+          "required": true
+        }
+      },
+      "description": "List all IAM roles assigned to a specific user, optionally scoped to a tenant",
+      "examples": [
+        "$ flowcore iam get user-roles \"auth0|abc123\" -t my-org",
+        "$ flowcore iam get user-roles \"auth0|abc123\" -j",
+        "$ flowcore iam get user-roles \"auth0|abc123\" -t my-org -w"
+      ],
+      "flags": {
+        "profile": {
+          "description": "Specify the configuration profile to use",
+          "name": "profile",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "json": {
+          "char": "j",
+          "description": "Output result as JSON",
+          "name": "json",
+          "required": false,
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "tenant": {
+          "char": "t",
+          "description": "Scope results to a specific tenant (organization slug)",
+          "name": "tenant",
+          "required": false,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "wide": {
+          "char": "w",
+          "description": "Show additional columns in table output",
+          "name": "wide",
+          "required": false,
+          "allowNo": false,
+          "type": "boolean"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "get:user-roles",
+      "pluginAlias": "@flowcore/cli-plugin-iam",
+      "pluginName": "@flowcore/cli-plugin-iam",
+      "pluginType": "core",
+      "strict": true,
+      "enableJsonFlag": false,
+      "isESM": true,
+      "relativePath": [
+        "dist",
+        "commands",
+        "get",
+        "user-roles.js"
+      ]
+    },
+    "unassign:policy": {
+      "aliases": [],
+      "args": {
+        "POLICY_NAME": {
+          "description": "The name of the policy to unassign",
+          "name": "POLICY_NAME",
+          "required": true
+        }
+      },
+      "description": "Remove an IAM policy assignment from a user, API key, or role. Exactly one of --user, --key, or --role must be specified",
+      "examples": [
+        "$ flowcore iam unassign policy read-access --user \"auth0|abc123\" -t my-org -y",
+        "$ flowcore iam unassign policy read-access --key \"550e8400-e29b-41d4-a716-446655440000\" -t my-org -y",
+        "$ flowcore iam unassign policy read-access --role data-reader -t my-org -y",
+        "$ flowcore iam unassign policy read-access --user \"auth0|abc123\" -t my-org -j -y"
+      ],
+      "flags": {
+        "profile": {
+          "description": "Specify the configuration profile to use",
+          "name": "profile",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "json": {
+          "char": "j",
+          "description": "Output result as JSON",
+          "name": "json",
+          "required": false,
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "key": {
+          "description": "The API key ID to unassign the policy from",
+          "exclusive": [
+            "user",
+            "role"
+          ],
+          "name": "key",
+          "required": false,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "role": {
+          "description": "The role name to unassign the policy from",
+          "exclusive": [
+            "user",
+            "key"
+          ],
+          "name": "role",
+          "required": false,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "tenant": {
+          "char": "t",
+          "description": "The tenant (organization slug) containing the policy",
+          "name": "tenant",
+          "required": true,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "user": {
+          "description": "The user ID to unassign the policy from",
+          "exclusive": [
+            "key",
+            "role"
+          ],
+          "name": "user",
+          "required": false,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "yes": {
+          "char": "y",
+          "description": "Skip confirmation prompt",
+          "name": "yes",
+          "required": false,
+          "allowNo": false,
+          "type": "boolean"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "unassign:policy",
+      "pluginAlias": "@flowcore/cli-plugin-iam",
+      "pluginName": "@flowcore/cli-plugin-iam",
+      "pluginType": "core",
+      "strict": true,
+      "enableJsonFlag": false,
+      "isESM": true,
+      "relativePath": [
+        "dist",
+        "commands",
+        "unassign",
+        "policy.js"
+      ]
+    },
+    "unassign:role": {
+      "aliases": [],
+      "args": {
+        "ROLE_NAME": {
+          "description": "The name of the role to unassign",
+          "name": "ROLE_NAME",
+          "required": true
+        }
+      },
+      "description": "Remove an IAM role assignment from a user or API key. Exactly one of --user or --key must be specified",
+      "examples": [
+        "$ flowcore iam unassign role data-reader --user \"auth0|abc123\" -t my-org -y",
+        "$ flowcore iam unassign role data-reader --key \"550e8400-e29b-41d4-a716-446655440000\" -t my-org -y",
+        "$ flowcore iam unassign role data-reader --user \"auth0|abc123\" -t my-org -j -y"
+      ],
+      "flags": {
+        "profile": {
+          "description": "Specify the configuration profile to use",
+          "name": "profile",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "json": {
+          "char": "j",
+          "description": "Output result as JSON",
+          "name": "json",
+          "required": false,
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "key": {
+          "description": "The API key ID to unassign the role from",
+          "exclusive": [
+            "user"
+          ],
+          "name": "key",
+          "required": false,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "tenant": {
+          "char": "t",
+          "description": "The tenant (organization slug) containing the role",
+          "name": "tenant",
+          "required": true,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "user": {
+          "description": "The user ID to unassign the role from",
+          "exclusive": [
+            "key"
+          ],
+          "name": "user",
+          "required": false,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "yes": {
+          "char": "y",
+          "description": "Skip confirmation prompt",
+          "name": "yes",
+          "required": false,
+          "allowNo": false,
+          "type": "boolean"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "unassign:role",
+      "pluginAlias": "@flowcore/cli-plugin-iam",
+      "pluginName": "@flowcore/cli-plugin-iam",
+      "pluginType": "core",
+      "strict": true,
+      "enableJsonFlag": false,
+      "isESM": true,
+      "relativePath": [
+        "dist",
+        "commands",
+        "unassign",
+        "role.js"
+      ]
+    },
+    "validate:key": {
+      "aliases": [],
+      "args": {
+        "KEY_ID": {
+          "description": "The API key ID to validate access for",
+          "name": "KEY_ID",
+          "required": true
+        }
+      },
+      "description": "Validate whether an API key has permission to perform an action on one or more resources",
+      "examples": [
+        "$ flowcore iam validate key \"550e8400-e29b-41d4-a716-446655440000\" -t my-org --action ingest --resource \"frn::my-org:event-type/*\"",
+        "$ flowcore iam validate key \"550e8400-e29b-41d4-a716-446655440000\" -t my-org --action read --resource \"frn::my-org:data-core/my-core\" -j",
+        "$ flowcore iam validate key \"550e8400-e29b-41d4-a716-446655440000\" -t my-org --action read --resource \"frn::my-org:data-core/core1\" --resource \"frn::my-org:data-core/core2\""
+      ],
+      "flags": {
+        "profile": {
+          "description": "Specify the configuration profile to use",
+          "name": "profile",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "action": {
+          "description": "The action to validate (e.g. read, write, ingest, fetch)",
+          "name": "action",
+          "required": true,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "json": {
+          "char": "j",
+          "description": "Output result as JSON",
+          "name": "json",
+          "required": false,
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "resource": {
+          "description": "The resource FRN to validate against (can be specified multiple times)",
+          "name": "resource",
+          "required": true,
+          "hasDynamicHelp": false,
+          "multiple": true,
+          "type": "option"
+        },
+        "tenant": {
+          "char": "t",
+          "description": "The tenant (organization slug) to validate within",
+          "name": "tenant",
+          "required": true,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "validate:key",
+      "pluginAlias": "@flowcore/cli-plugin-iam",
+      "pluginName": "@flowcore/cli-plugin-iam",
+      "pluginType": "core",
+      "strict": true,
+      "enableJsonFlag": false,
+      "isESM": true,
+      "relativePath": [
+        "dist",
+        "commands",
+        "validate",
+        "key.js"
+      ]
+    },
+    "validate:user": {
+      "aliases": [],
+      "args": {
+        "USER_ID": {
+          "description": "The user ID to validate access for (e.g. auth0|abc123)",
+          "name": "USER_ID",
+          "required": true
+        }
+      },
+      "description": "Validate whether a user has permission to perform an action on one or more resources",
+      "examples": [
+        "$ flowcore iam validate user \"auth0|abc123\" -t my-org --action read --resource \"frn::my-org:data-core/my-core\"",
+        "$ flowcore iam validate user \"auth0|abc123\" -t my-org --action write --resource \"frn::my-org:data-core/*\" -j",
+        "$ flowcore iam validate user \"auth0|abc123\" -t my-org --action read --resource \"frn::my-org:data-core/core1\" --resource \"frn::my-org:data-core/core2\""
+      ],
+      "flags": {
+        "profile": {
+          "description": "Specify the configuration profile to use",
+          "name": "profile",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "action": {
+          "description": "The action to validate (e.g. read, write, ingest, fetch)",
+          "name": "action",
+          "required": true,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "json": {
+          "char": "j",
+          "description": "Output result as JSON",
+          "name": "json",
+          "required": false,
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "resource": {
+          "description": "The resource FRN to validate against (can be specified multiple times)",
+          "name": "resource",
+          "required": true,
+          "hasDynamicHelp": false,
+          "multiple": true,
+          "type": "option"
+        },
+        "tenant": {
+          "char": "t",
+          "description": "The tenant (organization slug) to validate within",
+          "name": "tenant",
+          "required": true,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "validate:user",
+      "pluginAlias": "@flowcore/cli-plugin-iam",
+      "pluginName": "@flowcore/cli-plugin-iam",
+      "pluginType": "core",
+      "strict": true,
+      "enableJsonFlag": false,
+      "isESM": true,
+      "relativePath": [
+        "dist",
+        "commands",
+        "validate",
+        "user.js"
+      ]
     }
   },
-  "version": "1.7.0"
+  "version": "1.8.1"
 }