PrivateAIM · tada5hi · Sep 11, 2026 · Sep 11, 2026
diff --git a/.release-please-manifest.json b/.release-please-manifest.json
@@ -1,28 +1,28 @@
 {
-    ".": "0.15.0",
-    "apps/client-ui": "0.15.0",
-    "packages/client-vue": "0.15.0",
-    "packages/client-vue-theme": "0.15.0",
-    "packages/core-http-kit": "0.15.0",
-    "packages/core-kit": "0.15.0",
-    "packages/core-realtime-kit": "0.10.23",
-    "packages/kit": "0.15.0",
-    "packages/messenger-kit": "0.15.0",
-    "packages/messenger-http-kit": "0.15.0",
-    "apps/server-core": "0.15.0",
-    "apps/server-core-worker": "0.15.0",
-    "packages/server-core-worker-kit": "0.13.3",
-    "packages/server-db-kit": "0.15.0",
-    "packages/server-http-kit": "0.15.0",
-    "packages/server-kit": "0.15.0",
-    "apps/server-messenger": "0.15.0",
-    "packages/server-realtime-kit": "0.15.0",
-    "packages/server-test-kit": "0.15.0",
-    "apps/server-storage": "0.15.0",
-    "packages/server-storage-kit": "0.13.3",
-    "packages/storage-kit": "0.15.0",
-    "apps/server-telemetry": "0.15.0",
-    "packages/server-telemetry-kit": "0.14.0",
-    "packages/telemetry-kit": "0.15.0",
-    "docs": "0.15.0"
+    ".": "0.16.0",
+    "apps/client-ui": "0.16.0",
+    "packages/client-vue": "0.16.0",
+    "packages/client-vue-theme": "0.15.1",
+    "packages/core-http-kit": "0.15.1",
+    "packages/core-kit": "0.15.1",
+    "packages/core-realtime-kit": "0.10.24",
+    "packages/kit": "0.15.1",
+    "packages/messenger-kit": "0.15.1",
+    "packages/messenger-http-kit": "0.15.1",
+    "apps/server-core": "0.16.0",
+    "apps/server-core-worker": "0.15.1",
+    "packages/server-core-worker-kit": "0.13.4",
+    "packages/server-db-kit": "0.16.0",
+    "packages/server-http-kit": "0.15.1",
+    "packages/server-kit": "0.16.0",
+    "apps/server-messenger": "0.16.0",
+    "packages/server-realtime-kit": "0.15.1",
+    "packages/server-test-kit": "0.16.0",
+    "apps/server-storage": "0.16.0",
+    "packages/server-storage-kit": "0.13.4",
+    "packages/storage-kit": "0.15.1",
+    "apps/server-telemetry": "0.16.0",
+    "packages/server-telemetry-kit": "0.15.0",
+    "packages/telemetry-kit": "0.16.0",
+    "docs": "0.16.0"
 }
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,5 +1,29 @@
 # Changelog
 
+## [0.16.0](https://github.com/PrivateAIM/hub/compare/v0.15.0...v0.16.0) (2026-09-11)
+
+
+### ⚠ BREAKING CHANGES
+
+* the telemetry event query surface narrowed - filters createdAt/updatedAt are gone (dateToISOStringTransformer never applies to WHERE binds, so they matched wrong rows silently) and sorts allow only createdAt, with createdAt DESC as the new schema default; the analysis filter description is gone (unindexable text column). Multi-key sorts of individually advertised keys decode to the schema's sort default (or no ordering) unless a composite backs them, documented in api.md. En route this fixes masterImage sort handling: the derived allow-list had silently dropped the UI's virtualPath sort, and masterImageGroup rejected every sort key.
+* **telemetry-kit,server-db-kit,server-telemetry:** `EventAPI.update()` and `IEventAPI`'s `update` are removed (the route never existed and there is no EVENT_UPDATE permission). `Event['scope']` is now the closed `EventScope` union, and POST /events answers 400 outside it. `EntityEventMetadata.event` and `SubscriberPublishPayload.type` narrow to `DomainEventName`. Entity-event payloads no longer carry `select:false` columns.
+
+### Features
+
+* back every queryable key with a real index and gate schema drift ([#1873](https://github.com/PrivateAIM/hub/issues/1873)) ([cdf83ce](https://github.com/PrivateAIM/hub/commit/cdf83ce24f4c58a247ae461cb80905261a409754))
+* **client-vue,client-ui:** hand server-rendered data to the client instead of fetching it twice ([#1870](https://github.com/PrivateAIM/hub/issues/1870)) ([d71b19c](https://github.com/PrivateAIM/hub/commit/d71b19c173d94fa369b40eec9861456f4edc531e))
+* squash unreleased migrations and add ref_type/ref_id to buckets ([#1886](https://github.com/PrivateAIM/hub/issues/1886)) ([bbad96a](https://github.com/PrivateAIM/hub/commit/bbad96ac3cf5822c466c27cab9083cbc8d9c2412))
+
+
+### Bug Fixes
+
+* connect every new node to a registry, and let node admins manage that connection ([#1859](https://github.com/PrivateAIM/hub/issues/1859)) ([0be5ce6](https://github.com/PrivateAIM/hub/commit/0be5ce63f7a3a50d70ef3d23351ae4409d47b87b))
+* **deps:** bump authup to beta.65 and follow the FHS provisioning move ([#1882](https://github.com/PrivateAIM/hub/issues/1882)) ([0cb7565](https://github.com/PrivateAIM/hub/commit/0cb756505154ef48b604665e74231d1dcf733a6f))
+* **deps:** bump the minorandpatch group with 8 updates ([#1862](https://github.com/PrivateAIM/hub/issues/1862)) ([450bc71](https://github.com/PrivateAIM/hub/commit/450bc71ca82f0cccee979d61995cd7d371178e95))
+* **server-core-worker,server-storage:** create the code directory regardless of the base image user ([#1875](https://github.com/PrivateAIM/hub/issues/1875)) ([d46f8a3](https://github.com/PrivateAIM/hub/commit/d46f8a3ea8a8b27c86760c444af0f4f51afa6170))
+* **server-core-worker:** reject non-file tar entries, and settle every pack failure route ([#1872](https://github.com/PrivateAIM/hub/issues/1872)) ([fe8294f](https://github.com/PrivateAIM/hub/commit/fe8294fe5b0f6b8d240522bc61963968d515e3a2))
+* **telemetry-kit,server-db-kit,server-telemetry:** harden the telemetry event system ([#1866](https://github.com/PrivateAIM/hub/issues/1866)) ([dd579e9](https://github.com/PrivateAIM/hub/commit/dd579e934bbdaa1408324983fe15795df1babc64))
+
 ## [0.15.0](https://github.com/PrivateAIM/hub/compare/v0.14.0...v0.15.0) (2026-08-26)
 
 

diff --git a/CITATION.cff b/CITATION.cff
@@ -21,7 +21,7 @@ authors:
 repository-code: "https://github.com/PrivateAIM/hub"
 url: "https://privateaim.net"
 license: Apache-2.0
-version: 0.15.0 # x-release-please-version
+version: 0.16.0 # x-release-please-version
 # date-released: 2026-01-01  # set/automate to the release date of `version`
 keywords:
   - federated analytics

diff --git a/apps/client-ui/CHANGELOG.md b/apps/client-ui/CHANGELOG.md
@@ -1,5 +1,37 @@
 # Changelog
 
+## [0.16.0](https://github.com/PrivateAIM/hub/compare/v0.15.0...v0.16.0) (2026-09-11)
+
+
+### ⚠ BREAKING CHANGES
+
+* the telemetry event query surface narrowed - filters createdAt/updatedAt are gone (dateToISOStringTransformer never applies to WHERE binds, so they matched wrong rows silently) and sorts allow only createdAt, with createdAt DESC as the new schema default; the analysis filter description is gone (unindexable text column). Multi-key sorts of individually advertised keys decode to the schema's sort default (or no ordering) unless a composite backs them, documented in api.md. En route this fixes masterImage sort handling: the derived allow-list had silently dropped the UI's virtualPath sort, and masterImageGroup rejected every sort key.
+* **telemetry-kit,server-db-kit,server-telemetry:** `EventAPI.update()` and `IEventAPI`'s `update` are removed (the route never existed and there is no EVENT_UPDATE permission). `Event['scope']` is now the closed `EventScope` union, and POST /events answers 400 outside it. `EntityEventMetadata.event` and `SubscriberPublishPayload.type` narrow to `DomainEventName`. Entity-event payloads no longer carry `select:false` columns.
+
+### Features
+
+* back every queryable key with a real index and gate schema drift ([#1873](https://github.com/PrivateAIM/hub/issues/1873)) ([cdf83ce](https://github.com/PrivateAIM/hub/commit/cdf83ce24f4c58a247ae461cb80905261a409754))
+* **client-vue,client-ui:** hand server-rendered data to the client instead of fetching it twice ([#1870](https://github.com/PrivateAIM/hub/issues/1870)) ([d71b19c](https://github.com/PrivateAIM/hub/commit/d71b19c173d94fa369b40eec9861456f4edc531e))
+
+
+### Bug Fixes
+
+* **deps:** bump authup to beta.65 and follow the FHS provisioning move ([#1882](https://github.com/PrivateAIM/hub/issues/1882)) ([0cb7565](https://github.com/PrivateAIM/hub/commit/0cb756505154ef48b604665e74231d1dcf733a6f))
+* **deps:** bump the minorandpatch group with 8 updates ([#1862](https://github.com/PrivateAIM/hub/issues/1862)) ([450bc71](https://github.com/PrivateAIM/hub/commit/450bc71ca82f0cccee979d61995cd7d371178e95))
+* **telemetry-kit,server-db-kit,server-telemetry:** harden the telemetry event system ([#1866](https://github.com/PrivateAIM/hub/issues/1866)) ([dd579e9](https://github.com/PrivateAIM/hub/commit/dd579e934bbdaa1408324983fe15795df1babc64))
+
+
+### Dependencies
+
+* The following workspace dependencies were updated
+  * devDependencies
+    * @privateaim/client-vue bumped from ^0.15.0 to ^0.16.0
+    * @privateaim/client-vue-theme bumped from ^0.15.0 to ^0.15.1
+    * @privateaim/core-kit bumped from ^0.15.0 to ^0.15.1
+    * @privateaim/kit bumped from ^0.15.0 to ^0.15.1
+    * @privateaim/storage-kit bumped from ^0.15.0 to ^0.15.1
+    * @privateaim/telemetry-kit bumped from ^0.15.0 to ^0.16.0
+
 ## [0.15.0](https://github.com/PrivateAIM/hub/compare/v0.14.0...v0.15.0) (2026-08-26)
 
 

diff --git a/apps/client-ui/package.json b/apps/client-ui/package.json
@@ -2,7 +2,7 @@
     "name": "@privateaim/client-ui",
     "type": "module",
     "private": true,
-    "version": "0.15.0",
+    "version": "0.16.0",
     "license": "Apache-2.0",
     "author": {
         "name": "Peter Placzek",
@@ -39,12 +39,12 @@
         "@nuxt/icon": "^2.5.1",
         "@nuxtjs/google-fonts": "^3.2.0",
         "@pinia/nuxt": "^1.0.2",
-        "@privateaim/client-vue": "^0.15.0",
-        "@privateaim/client-vue-theme": "^0.15.0",
-        "@privateaim/core-kit": "^0.15.0",
-        "@privateaim/kit": "^0.15.0",
-        "@privateaim/storage-kit": "^0.15.0",
-        "@privateaim/telemetry-kit": "^0.15.0",
+        "@privateaim/client-vue": "^0.16.0",
+        "@privateaim/client-vue-theme": "^0.15.1",
+        "@privateaim/core-kit": "^0.15.1",
+        "@privateaim/kit": "^0.15.1",
+        "@privateaim/storage-kit": "^0.15.1",
+        "@privateaim/telemetry-kit": "^0.16.0",
         "@rapiq/core": "^2.2.0",
         "@tailwindcss/vite": "^4.3.3",
         "@validup/vue": "^2.0.1",

diff --git a/apps/server-core-worker/CHANGELOG.md b/apps/server-core-worker/CHANGELOG.md
@@ -1,5 +1,29 @@
 # Changelog
 
+## [0.15.1](https://github.com/PrivateAIM/hub/compare/v0.15.0...v0.15.1) (2026-09-11)
+
+
+### Bug Fixes
+
+* **deps:** bump authup to beta.65 and follow the FHS provisioning move ([#1882](https://github.com/PrivateAIM/hub/issues/1882)) ([0cb7565](https://github.com/PrivateAIM/hub/commit/0cb756505154ef48b604665e74231d1dcf733a6f))
+* **deps:** bump the minorandpatch group with 8 updates ([#1862](https://github.com/PrivateAIM/hub/issues/1862)) ([450bc71](https://github.com/PrivateAIM/hub/commit/450bc71ca82f0cccee979d61995cd7d371178e95))
+* **server-core-worker,server-storage:** create the code directory regardless of the base image user ([#1875](https://github.com/PrivateAIM/hub/issues/1875)) ([d46f8a3](https://github.com/PrivateAIM/hub/commit/d46f8a3ea8a8b27c86760c444af0f4f51afa6170))
+* **server-core-worker:** reject non-file tar entries, and settle every pack failure route ([#1872](https://github.com/PrivateAIM/hub/issues/1872)) ([fe8294f](https://github.com/PrivateAIM/hub/commit/fe8294fe5b0f6b8d240522bc61963968d515e3a2))
+
+
+### Dependencies
+
+* The following workspace dependencies were updated
+  * dependencies
+    * @privateaim/core-http-kit bumped from ^0.15.0 to ^0.15.1
+    * @privateaim/core-kit bumped from ^0.15.0 to ^0.15.1
+    * @privateaim/kit bumped from ^0.15.0 to ^0.15.1
+    * @privateaim/server-core-worker-kit bumped from ^0.13.3 to ^0.13.4
+    * @privateaim/server-kit bumped from ^0.15.0 to ^0.16.0
+    * @privateaim/server-telemetry-kit bumped from ^0.14.0 to ^0.15.0
+    * @privateaim/storage-kit bumped from ^0.15.0 to ^0.15.1
+    * @privateaim/telemetry-kit bumped from ^0.15.0 to ^0.16.0
+
 ## [0.15.0](https://github.com/PrivateAIM/hub/compare/v0.14.0...v0.15.0) (2026-08-26)
 
 

diff --git a/apps/server-core-worker/package.json b/apps/server-core-worker/package.json
@@ -1,7 +1,7 @@
 {
     "name": "@privateaim/server-core-worker",
     "type": "module",
-    "version": "0.15.0",
+    "version": "0.15.1",
     "private": true,
     "module": "./dist/index.mjs",
     "types": "./dist/index.d.mts",
@@ -32,14 +32,14 @@
     "dependencies": {
         "@authup/core-http-kit": "^1.0.0-beta.65",
         "@hapic/harbor": "^3.0.2",
-        "@privateaim/core-http-kit": "^0.15.0",
-        "@privateaim/core-kit": "^0.15.0",
-        "@privateaim/kit": "^0.15.0",
-        "@privateaim/server-core-worker-kit": "^0.13.3",
-        "@privateaim/server-kit": "^0.15.0",
-        "@privateaim/server-telemetry-kit": "^0.14.0",
-        "@privateaim/storage-kit": "^0.15.0",
-        "@privateaim/telemetry-kit": "^0.15.0",
+        "@privateaim/core-http-kit": "^0.15.1",
+        "@privateaim/core-kit": "^0.15.1",
+        "@privateaim/kit": "^0.15.1",
+        "@privateaim/server-core-worker-kit": "^0.13.4",
+        "@privateaim/server-kit": "^0.16.0",
+        "@privateaim/server-telemetry-kit": "^0.15.0",
+        "@privateaim/storage-kit": "^0.15.1",
+        "@privateaim/telemetry-kit": "^0.16.0",
         "@validup/zod": "^2.0.1",
         "docken": "^2.0.2",
         "dockerode": "^5.0.1",

diff --git a/apps/server-core/CHANGELOG.md b/apps/server-core/CHANGELOG.md
@@ -1,5 +1,48 @@
 # Changelog
 
+## [0.16.0](https://github.com/PrivateAIM/hub/compare/v0.15.0...v0.16.0) (2026-09-11)
+
+
+### ⚠ BREAKING CHANGES
+
+* the telemetry event query surface narrowed - filters createdAt/updatedAt are gone (dateToISOStringTransformer never applies to WHERE binds, so they matched wrong rows silently) and sorts allow only createdAt, with createdAt DESC as the new schema default; the analysis filter description is gone (unindexable text column). Multi-key sorts of individually advertised keys decode to the schema's sort default (or no ordering) unless a composite backs them, documented in api.md. En route this fixes masterImage sort handling: the derived allow-list had silently dropped the UI's virtualPath sort, and masterImageGroup rejected every sort key.
+* **telemetry-kit,server-db-kit,server-telemetry:** `EventAPI.update()` and `IEventAPI`'s `update` are removed (the route never existed and there is no EVENT_UPDATE permission). `Event['scope']` is now the closed `EventScope` union, and POST /events answers 400 outside it. `EntityEventMetadata.event` and `SubscriberPublishPayload.type` narrow to `DomainEventName`. Entity-event payloads no longer carry `select:false` columns.
+
+### Features
+
+* back every queryable key with a real index and gate schema drift ([#1873](https://github.com/PrivateAIM/hub/issues/1873)) ([cdf83ce](https://github.com/PrivateAIM/hub/commit/cdf83ce24f4c58a247ae461cb80905261a409754))
+* squash unreleased migrations and add ref_type/ref_id to buckets ([#1886](https://github.com/PrivateAIM/hub/issues/1886)) ([bbad96a](https://github.com/PrivateAIM/hub/commit/bbad96ac3cf5822c466c27cab9083cbc8d9c2412))
+
+
+### Bug Fixes
+
+* connect every new node to a registry, and let node admins manage that connection ([#1859](https://github.com/PrivateAIM/hub/issues/1859)) ([0be5ce6](https://github.com/PrivateAIM/hub/commit/0be5ce63f7a3a50d70ef3d23351ae4409d47b87b))
+* **deps:** bump authup to beta.65 and follow the FHS provisioning move ([#1882](https://github.com/PrivateAIM/hub/issues/1882)) ([0cb7565](https://github.com/PrivateAIM/hub/commit/0cb756505154ef48b604665e74231d1dcf733a6f))
+* **deps:** bump the minorandpatch group with 8 updates ([#1862](https://github.com/PrivateAIM/hub/issues/1862)) ([450bc71](https://github.com/PrivateAIM/hub/commit/450bc71ca82f0cccee979d61995cd7d371178e95))
+* **telemetry-kit,server-db-kit,server-telemetry:** harden the telemetry event system ([#1866](https://github.com/PrivateAIM/hub/issues/1866)) ([dd579e9](https://github.com/PrivateAIM/hub/commit/dd579e934bbdaa1408324983fe15795df1babc64))
+
+
+### Dependencies
+
+* The following workspace dependencies were updated
+  * dependencies
+    * @privateaim/core-kit bumped from ^0.15.0 to ^0.15.1
+    * @privateaim/core-realtime-kit bumped from ^0.10.23 to ^0.10.24
+    * @privateaim/kit bumped from ^0.15.0 to ^0.15.1
+    * @privateaim/server-core-worker-kit bumped from ^0.13.3 to ^0.13.4
+    * @privateaim/server-db-kit bumped from ^0.15.0 to ^0.16.0
+    * @privateaim/server-http-kit bumped from ^0.15.0 to ^0.15.1
+    * @privateaim/server-kit bumped from ^0.15.0 to ^0.16.0
+    * @privateaim/server-realtime-kit bumped from ^0.15.0 to ^0.15.1
+    * @privateaim/server-storage-kit bumped from ^0.13.3 to ^0.13.4
+    * @privateaim/server-telemetry bumped from ^0.15.0 to ^0.16.0
+    * @privateaim/server-telemetry-kit bumped from ^0.14.0 to ^0.15.0
+    * @privateaim/storage-kit bumped from ^0.15.0 to ^0.15.1
+    * @privateaim/telemetry-kit bumped from ^0.15.0 to ^0.16.0
+  * devDependencies
+    * @privateaim/core-http-kit bumped from ^0.15.0 to ^0.15.1
+    * @privateaim/server-test-kit bumped from ^0.15.0 to ^0.16.0
+
 ## [0.15.0](https://github.com/PrivateAIM/hub/compare/v0.14.0...v0.15.0) (2026-08-26)
 
 

diff --git a/apps/server-core/package.json b/apps/server-core/package.json
@@ -8,7 +8,7 @@
         "url": "https://tada5hi.net"
     },
     "license": "Apache-2.0",
-    "version": "0.15.0",
+    "version": "0.16.0",
     "description": "This package contains the server core service.",
     "main": "./dist/cli/index.mjs",
     "module": "./dist/index.mjs",
@@ -21,20 +21,20 @@
         "@ebec/core": "^1.3.2",
         "@hapic/harbor": "^3.0.2",
         "@hapic/oauth2": "^4.0.2",
-        "@privateaim/core-kit": "^0.15.0",
-        "@privateaim/core-realtime-kit": "^0.10.23",
+        "@privateaim/core-kit": "^0.15.1",
+        "@privateaim/core-realtime-kit": "^0.10.24",
         "@privateaim/errors": "^0.8.42",
-        "@privateaim/kit": "^0.15.0",
-        "@privateaim/server-core-worker-kit": "^0.13.3",
-        "@privateaim/server-db-kit": "^0.15.0",
-        "@privateaim/server-http-kit": "^0.15.0",
-        "@privateaim/server-kit": "^0.15.0",
-        "@privateaim/server-realtime-kit": "^0.15.0",
-        "@privateaim/server-storage-kit": "^0.13.3",
-        "@privateaim/server-telemetry": "^0.15.0",
-        "@privateaim/server-telemetry-kit": "^0.14.0",
-        "@privateaim/storage-kit": "^0.15.0",
-        "@privateaim/telemetry-kit": "^0.15.0",
+        "@privateaim/kit": "^0.15.1",
+        "@privateaim/server-core-worker-kit": "^0.13.4",
+        "@privateaim/server-db-kit": "^0.16.0",
+        "@privateaim/server-http-kit": "^0.15.1",
+        "@privateaim/server-kit": "^0.16.0",
+        "@privateaim/server-realtime-kit": "^0.15.1",
+        "@privateaim/server-storage-kit": "^0.13.4",
+        "@privateaim/server-telemetry": "^0.16.0",
+        "@privateaim/server-telemetry-kit": "^0.15.0",
+        "@privateaim/storage-kit": "^0.15.1",
+        "@privateaim/telemetry-kit": "^0.16.0",
         "@rapiq/adapter-sql": "^2.2.0",
         "@rapiq/adapter-typeorm": "^2.2.0",
         "@rapiq/codec-url": "^2.2.0",
@@ -67,8 +67,8 @@
     },
     "devDependencies": {
         "@faker-js/faker": "^10.6.0",
-        "@privateaim/core-http-kit": "^0.15.0",
-        "@privateaim/server-test-kit": "^0.15.0",
+        "@privateaim/core-http-kit": "^0.15.1",
+        "@privateaim/server-test-kit": "^0.16.0",
         "@trapi/cli": "^2.0.5",
         "@types/busboy": "^1.5.4",
         "better-sqlite3": "^13.0.3",