designcode · Oct 13, 2026 · Oct 13, 2026 · Oct 13, 2026
diff --git a/.changeset/cli-access-key-scope.md b/.changeset/cli-access-key-scope.md
diff --git a/.changeset/cli-shell-auth0-token-type.md b/.changeset/cli-shell-auth0-token-type.md
diff --git a/.changeset/iam-access-key-scope.md b/.changeset/iam-access-key-scope.md
diff --git a/packages/cli-shell/CHANGELOG.md b/packages/cli-shell/CHANGELOG.md
@@ -1,5 +1,13 @@
 # @tigrisdata/cli-shell
 
+## 0.2.3
+
+### Patch Changes
+
+- [#366](https://github.com/tigrisdata/storage/pull/366) [`e983443`](https://github.com/tigrisdata/storage/commit/e983443ea1eb74b53f51fb987e32368d96057c9f) Thanks [@renovate](https://github.com/apps/renovate)! - Builds against `@auth0/auth0-spa-js` 2.25 and later, where `getTokenSilently` is typed as possibly returning nothing. An empty result — which the modes the shell uses cannot produce — is reported as an error instead of being read as a token.
+- Updated dependencies [[`d9c5e75`](https://github.com/tigrisdata/storage/commit/d9c5e753ec7c31a88f543de338b9352ca9a03c99)]:
+  - @tigrisdata/cli@3.17.0
+
 ## 0.2.2
 
 ### Patch Changes

diff --git a/packages/cli-shell/package.json b/packages/cli-shell/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@tigrisdata/cli-shell",
-  "version": "0.2.2",
+  "version": "0.2.3",
   "description": "The Tigris CLI as an embeddable React terminal, backed by a virtual bash environment",
   "type": "module",
   "main": "./dist/index.js",

diff --git a/packages/cli/CHANGELOG.md b/packages/cli/CHANGELOG.md
@@ -1,5 +1,16 @@
 # @tigrisdata/cli
 
+## 3.17.0
+
+### Minor Changes
+
+- [#368](https://github.com/tigrisdata/storage/pull/368) [`d9c5e75`](https://github.com/tigrisdata/storage/commit/d9c5e753ec7c31a88f543de338b9352ca9a03c99) Thanks [@designcode](https://github.com/designcode)! - `tigris access-keys create --default-permissions disable` creates a key without the default permissions — it can do only what its roles and policies explicitly allow — and `tigris access-keys set <id> --default-permissions enable|disable` changes the setting on an existing key, leaving its bucket roles as they are. This is the console's "Enable default permissions" toggle; JSON output carries it as the SDK's `scope` (`standard` or `no_default_allow`). `access-keys get` and `access-keys list` show the setting for every key.
+
+### Patch Changes
+
+- Updated dependencies [[`d9c5e75`](https://github.com/tigrisdata/storage/commit/d9c5e753ec7c31a88f543de338b9352ca9a03c99)]:
+  - @tigrisdata/iam@2.8.0
+
 ## 3.16.0
 
 ### Minor Changes

diff --git a/packages/cli/package.json b/packages/cli/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@tigrisdata/cli",
-  "version": "3.16.0",
+  "version": "3.17.0",
   "description": "Command line interface for Tigris object storage",
   "type": "module",
   "exports": {

diff --git a/packages/iam/CHANGELOG.md b/packages/iam/CHANGELOG.md
@@ -1,5 +1,11 @@
 # @tigrisdata/iam
 
+## 2.8.0
+
+### Minor Changes
+
+- [#368](https://github.com/tigrisdata/storage/pull/368) [`d9c5e75`](https://github.com/tigrisdata/storage/commit/d9c5e753ec7c31a88f543de338b9352ca9a03c99) Thanks [@designcode](https://github.com/designcode)! - Access keys gain a scope. `createAccessKey(name, { scope })` sets it at creation and the new `setAccessKeyScope(id, scope)` changes it on an existing key, leaving its bucket roles as they are. `standard` (the default) grants the implicit default-allowed operations such as creating and listing buckets on top of what the key's policies and bucket roles grant; `no_default_allow` limits the key to what they explicitly allow. `getAccessKey` and `listAccessKeys` report it as `scope`, and `ACCESS_KEY_SCOPES` lists the valid values.
+
 ## 2.7.0
 
 ### Minor Changes

diff --git a/packages/iam/package.json b/packages/iam/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@tigrisdata/iam",
-  "version": "2.7.0",
+  "version": "2.8.0",
   "description": "Tigris SDK for IAM operations",
   "type": "module",
   "main": "./dist/index.js",

diff --git a/packages/tigris/CHANGELOG.md b/packages/tigris/CHANGELOG.md
@@ -1,5 +1,12 @@
 # tigris
 
+## 3.17.0
+
+### Patch Changes
+
+- Updated dependencies [[`d9c5e75`](https://github.com/tigrisdata/storage/commit/d9c5e753ec7c31a88f543de338b9352ca9a03c99)]:
+  - @tigrisdata/cli@3.17.0
+
 ## 3.16.0
 
 ### Patch Changes

diff --git a/packages/tigris/package.json b/packages/tigris/package.json
@@ -1,6 +1,6 @@
 {
   "name": "tigris",
-  "version": "3.16.0",
+  "version": "3.17.0",
   "description": "Unscoped alias for @tigrisdata/cli — the command line interface for Tigris object storage",
   "type": "module",
   "bin": {