@@ -1,3 +1,59 @@
+## [0.26.0] - 2026-08-19
+
+### 🚀 Features
+
+- *(auth)* [**breaking**] Stop minting jwts from api tokens
+- *(sdk)* [**breaking**] Adopt hotdata 0.13.0 and restore the per-request bearer hook
+- *(databases)* [**breaking**] Remove the run command
+
+### 🐛 Bug Fixes
+
+- *(databases)* Stop tables load misrouting into wrong database
+- *(sdk)* Re-resolve bearer per call for CLI-owned request paths
+- *(sdk)* Diagnose expired-session upload failures, fix blocking probe
+- *(sdk)* Scope expired-session upload hint to real sessions
+- *(databases)* Treat a 403 existence check as unverifiable in set
+
+### 🚜 Refactor
+
+- *(auth)* Share the /workspaces fetch helper
+- *(databases)* [**breaking**] Drop guessed database-token detection
+
+### 📚 Documentation
+
+- *(ingest)* Create starts no run — correct the causality (#260)
+- *(jwt)* Correct stale JWT-exchange doc comments
+- *(credentials)* Correct stale empty-ids semantics
+
+### 🧪 Testing
+
+- *(sdk)* Prove the bearer re-resolves per request, not once
+- *(sdk)* Pin which mint answers which upload refresh
+
+### ⚠️ Breaking: `databases run` is gone, and API tokens are no longer exchanged for JWTs
+
+`databases run` is removed with no replacement. It was the only command that
+minted a database session token, so the client side of that credential goes
+with it — the `HOTDATA_DATABASE_TOKEN` auth path no longer exists.
+`HOTDATA_DATABASE` and the `hd_…` database API token are untouched.
+
+An `hd_…` API token is now sent verbatim as the bearer instead of being
+exchanged for a JWT, and the credential is resolved once per request rather
+than once per client. That fixes uploads large enough to outlive the credential
+they started with, which used to 401 at finalize (#120).
+
+Three consequences of losing the JWT claims the CLI used to read:
+
+- `auth status` no longer shows an "API Key Source" row.
+- `tables load` no longer routes a database-scoped API token to the
+  database-scoped endpoints — the claim it keyed off is gone and there is no
+  replacement signal, so those tokens now surface the server's `ACCESS_DENIED`
+  403. `databases set` still works with them: its existence check is advisory,
+  so a 403 there means "can't verify, proceed".
+- Workspace scope for an API key comes from a live `GET /workspaces` instead of
+  a claim. An unrestricted key with no saved default used to have no
+  discoverable scope and forced `--workspace-id`; it now resolves to whichever
+  workspace the API lists first.
 ## [0.25.0] - 2026-08-14
 
 ### 🚀 Features
 
@@ -1,6 +1,6 @@
 [package]
 name = "hotdata-cli"
-version = "0.25.0"
+version = "0.26.0"
 edition = "2024"
 repository = "https://github.com/hotdata-dev/hotdata-cli"
 description = "CLI tool for Hotdata.dev"
 
@@ -1,7 +1,7 @@
 ---
 name: hotdata
 description: Use this skill when the user wants to run core hotdata CLI commands — auth, workspaces, managed databases, tables, basic SQL query, database context (context:DATAMODEL), jobs, datasources/ingests/runs (pull external data), and skill install. Activate for "run hotdata", "list workspaces", "list databases", "managed database", "load parquet", "list tables", "show table columns", "execute a query", "database context", "context:DATAMODEL", "ingest", "datasource", "ingest run", "show a run", "schedule an ingest", "import data from", "connect a data source", "connector", "pull data from postgres/mysql/an API/S3 buckets/Iceberg", or general Hotdata CLI usage. This skill bundles three specialized guides under subskills/, loaded on demand: read subskills/search/SKILL.md for full-text/vector search and retrieval indexes, subskills/analytics/SKILL.md for OLAP analytics, query history, stored results, and Chain materializations, and subskills/geospatial/SKILL.md for geospatial/GIS.
-version: 0.25.0
+version: 0.26.0
 ---
 
 # Hotdata CLI Skill
 
@@ -1,7 +1,7 @@
 ---
 name: hotdata-analytics
 description: Use this skill when the user wants OLAP-style SQL analytics in Hotdata — aggregations, GROUP BY, JOINs, reporting, exploratory queries, query run history, stored results, or materialized follow-up tables (Chain into managed databases). Activate for "analyze", "aggregate", "rollup", "pivot", "report", "metrics", "GROUP BY", "query history", "past queries", "query runs", "stored results", "materialize", "chain", "intermediate table", or sorted indexes for filters/range scans. Do not load for BM25/vector search or geospatial SQL — use hotdata-search or hotdata-geospatial. Requires the core hotdata skill for tables and auth.
-version: 0.25.0
+version: 0.26.0
 ---
 
 # Hotdata Analytics Skill
 
@@ -1,7 +1,7 @@
 ---
 name: hotdata-geospatial
 description: Use this skill only when the user is working with geospatial data in Hotdata (PostGIS-style SQL like ST_* functions, geometry/WKB, bbox filtering, point-in-polygon, distance/area, lat/lon, spatial joins, “geospatial”, “GIS”, “PostGIS”). Do not load this skill for non-geospatial SQL or general Hotdata usage.
-version: 0.25.0
+version: 0.26.0
 ---
 
 # Hotdata Geospatial Skill
 
@@ -1,7 +1,7 @@
 ---
 name: hotdata-search
 description: Use this skill when the user wants full-text search, BM25 keyword search, vector similarity search, semantic search, embeddings, or retrieval indexes in Hotdata. Activate for "hotdata search", "BM25", "full-text", "vector search", "semantic search", "similarity", "embedding", "embedding provider", "create an index" (bm25 or vector), "list indexes" for search, or SQL using bm25_search or vector_distance. Do not load for general SQL analytics (aggregations, GROUP BY) or geospatial work — use hotdata-analytics or hotdata-geospatial instead. Requires the core hotdata skill for auth and workspace basics.
-version: 0.25.0
+version: 0.26.0
 ---
 
 # Hotdata Search Skill