Release v2.17.4: add API region sorting and indexed placeholders

CHANGELOG.md

@@ -2,6 +2,18 @@
 
 All notable changes to this project will be documented in this file.
 
+## 2.17.4 - 2026-10-23
+
+### Added
+
+- API regions can sort array results by a selected field in ascending or descending order, independently per region.
+- API placeholders can reference array entries by zero-based index, such as `{{0.name}}` and `{{1.name}}`; plain field placeholders continue to work with single-object responses.
+- API result previews show the first item as an expandable JSON tree.
+
+### Changed
+
+- Image dimension guides appear in the small editor preview but not in the popup preview.
+
 ## 2.17.3 - 2026-10-23
 
 ### Fixed
@@ -13,7 +25,7 @@ All notable changes to this project will be documented in this file.
 
 ### Added
 
-- Added provider-specific weather normalization for Open-Meteo and Pirate Weather, giving current, hourly, and daily forecasts a shared format across previews, playback, and thumbnails, including cached responses, condition icons, timezone-aware dates, and independently selected display units.
+- Provider-specific weather normalization for Open-Meteo and Pirate Weather, giving current, hourly, and daily forecasts a shared format across previews, playback, and thumbnails, including cached responses, condition icons, timezone-aware dates, and independently selected display units.
 
 ### Fixed
 
@@ -30,9 +42,9 @@ All notable changes to this project will be documented in this file.
 
 ### Added
 
-- Added read-only user previews from the Users page, controlled by Impersonate > Allow, with an expiring session, a persistent exit banner, and audit logging.
-- Added a responsive changelog page linked from About, with collapsible release history and the latest release expanded by default.
-- Added a password-only screen for required password changes, keeping profile and session controls unavailable until completion.
+- Read-only user previews from the Users page, controlled by Impersonate > Allow, with an expiring session, a persistent exit banner, and audit logging.
+- A responsive changelog page linked from About, with collapsible release history and the latest release expanded by default.
+- A password-only screen for required password changes, keeping profile and session controls unavailable until completion.
 - Dashboard-wide reload, pause, and blackout actions use Connected clients > Allow, the same permission as per-client commands.
 - Signed-in users without Dashboard access now land on their first permitted section; users without assigned sections get a no-access page with Account and Sign out options.
 - Role permission checkboxes show each permission's description on hover.
@@ -41,7 +53,7 @@ All notable changes to this project will be documented in this file.
 
 ### Added
 
-- Added a responsive changelog page linked from About, with collapsible release history and the latest release expanded by default.
+- A responsive changelog page linked from About, with collapsible release history and the latest release expanded by default.
 
 ## 2.16.7 - 2026-10-22
 
@@ -88,7 +100,7 @@ All notable changes to this project will be documented in this file.
 
 ### Added
 
-- Added an API source Enable/Disable action in the Connection card that pauses all request refreshes while preserving each request's individual enabled setting and unsaved form changes.
+- An API source Enable/Disable action in the Connection card that pauses all request refreshes while preserving each request's individual enabled setting and unsaved form changes.
 
 ### Fixed
 
@@ -101,19 +113,19 @@ All notable changes to this project will be documented in this file.
 
 ### Added
 
-- Added API source groups with shared authentication and cached tokens, plus support for unauthenticated public APIs. Existing request IDs and slide bindings are preserved.
-- Added individually named request cards with independent URLs, enabled states, refresh schedules, and full-width response trees with Expand all/Collapse all controls. The Connection card provides source actions and Add request, with confirmation before removing a request.
-- Added group-level authentication testing and per-request diagnostics using unsaved settings, with dismissible results below the tested section. Diagnostic reports redact credentials and populated tokens while preserving OAuth metadata and null or empty token fields.
+- API source groups with shared authentication and cached tokens, plus support for unauthenticated public APIs. Existing request IDs and slide bindings are preserved.
+- Individually named request cards with independent URLs, enabled states, refresh schedules, and full-width response trees with Expand all/Collapse all controls. The Connection card provides source actions and Add request, with confirmation before removing a request.
+- Group-level authentication testing and per-request diagnostics using unsaved settings, with dismissible results below the tested section. Diagnostic reports redact credentials and populated tokens while preserving OAuth metadata and null or empty token fields.
 
 ## 2.16.0 - 2026-10-20
 
 ### Added
 
-- Added a slide layout editor with drag/resize, pixel position and size, z-index, ratio locking, keyboard nudging, undo/redo, and reset-to-template controls. Its wide modal leaves the sidebar visible and matches the template editor's region outlines; both editors provide alignment guides and snapping, with the template snap toggle in the Designer header.
-- Added slide-specific region geometry overrides that flow through previews, playback, and thumbnails without changing sibling slides. Users with template-edit permission can apply the layout to this slide or save it to the shared template; shared saves confirm the affected-slide count, preserve region IDs and animations, clear only the current slide's geometry overrides, and reject stale templates.
-- Added a separate slide animation editor with the template's presets and advanced timing controls, plus intro/outro/attention previews on the actual slide canvas. Changes can be applied to this slide or saved to the shared template; per-region and all-region reset actions are available, and shared saves preserve slide content and sibling overrides.
-- Added consistent +/- sizing controls to HTML region editors, matching WYSIWYG regions, with the sandboxed iframe note alongside the controls.
-- Added an API source connection test using unsaved form values, with separate authentication, data request, and JSON/items checks, sanitised response previews, available field paths, and a copyable diagnostic report in a dismissible results card without changing stored responses.
+- A slide layout editor with drag/resize, pixel position and size, z-index, ratio locking, keyboard nudging, undo/redo, and reset-to-template controls. Its wide modal leaves the sidebar visible and matches the template editor's region outlines; both editors provide alignment guides and snapping, with the template snap toggle in the Designer header.
+- Slide-specific region geometry overrides that flow through previews, playback, and thumbnails without changing sibling slides. Users with template-edit permission can apply the layout to this slide or save it to the shared template; shared saves confirm the affected-slide count, preserve region IDs and animations, clear only the current slide's geometry overrides, and reject stale templates.
+- A separate slide animation editor with the template's presets and advanced timing controls, plus intro/outro/attention previews on the actual slide canvas. Changes can be applied to this slide or saved to the shared template; per-region and all-region reset actions are available, and shared saves preserve slide content and sibling overrides.
+- Consistent +/- sizing controls to HTML region editors, matching WYSIWYG regions, with the sandboxed iframe note alongside the controls.
+- An API source connection test using unsaved form values, with separate authentication, data request, and JSON/items checks, sanitised response previews, available field paths, and a copyable diagnostic report in a dismissible results card without changing stored responses.
 
 ### Changed
 
@@ -123,8 +135,8 @@ All notable changes to this project will be documented in this file.
 
 ### Fixed
 
-- Fixed region dragging and resizing when template animation metadata is null.
-- Fixed template and slide region outlines so they follow sizes below 12px, including scaled one-pixel regions, while keeping resize handles usable.
+- Region dragging and resizing when template animation metadata is null.
+- Template and slide region outlines so they follow sizes below 12px, including scaled one-pixel regions, while keeping resize handles usable.
 
 ## 2.15.7 - 2026-10-19
 
@@ -142,8 +154,8 @@ All notable changes to this project will be documented in this file.
 
 ### Added
 
-- Added an All timetable display mode that includes past items while respecting date filters and the item limit.
-- Added filename renaming in Media Library image and video previews without changing stored media paths or slide references.
+- An All timetable display mode that includes past items while respecting date filters and the item limit.
+- Filename renaming in Media Library image and video previews without changing stored media paths or slide references.
 
 ### Changed
 
@@ -165,8 +177,8 @@ All notable changes to this project will be documented in this file.
 
 ### Added
 
-- Added configurable audit events for media-library assets, managed fonts, and weather icon sets.
-- Added All / Between Dates / Before Date / After Date filtering to timetable regions, with optional inclusive start-time boundaries shared by previews and playback.
+- Configurable audit events for media-library assets, managed fonts, and weather icon sets.
+- All / Between Dates / Before Date / After Date filtering to timetable regions, with optional inclusive start-time boundaries shared by previews and playback.
 
 ### Changed
 
@@ -197,13 +209,13 @@ All notable changes to this project will be documented in this file.
 
 ### Added
 
-- Added Pick / Repeat group modes beside the group title. Repeat plays the entire eligible group in order for the configured number of passes, independently of Pick and shuffle settings.
+- Pick / Repeat group modes beside the group title. Repeat plays the entire eligible group in order for the configured number of passes, independently of Pick and shuffle settings.
 
 ## 2.15.1 - 2026-10-15
 
 ### Added
 
-- Added an optional shuffle toggle for playlist groups; ordered rotation is now the default.
+- An optional shuffle toggle for playlist groups; ordered rotation is now the default.
 
 ### Changed
 
@@ -214,7 +226,7 @@ All notable changes to this project will be documented in this file.
 
 ### Added
 
-- Added playlist groups with configurable per-pass selection counts and independent multi-rule display schedules.
+- Playlist groups with configurable per-pass selection counts and independent multi-rule display schedules.
 
 ## 2.14.3 - 2026-10-13
 
@@ -226,7 +238,7 @@ All notable changes to this project will be documented in this file.
 
 ### Added
 
-- Added managed weather icon sets under Settings > Assets, with day and optional night variants, PNG/WebP/SVG uploads, per-region selection, and player synchronization.
+- Managed weather icon sets under Settings > Assets, with day and optional night variants, PNG/WebP/SVG uploads, per-region selection, and player synchronization.
 
 ### Changed
 
@@ -236,7 +248,7 @@ All notable changes to this project will be documented in this file.
 
 ### Added
 
-- Added a configurable text size for chart axis labels, legends, and tooltips.
+- A configurable text size for chart axis labels, legends, and tooltips.
 
 ### Changed
 
@@ -259,10 +271,10 @@ All notable changes to this project will be documented in this file.
 
 ### Added
 
-- Added configurable chart data sources, multi-series line charts, chart type and source options, value ordering, grid line colors, and text colors across editor, popout preview, and player rendering.
-- Added player playlist and playback recovery for cached snapshots, offline states, stalled media, failed image/video loads, and service-worker cache failures.
-- Added deterministic image derivatives for large uploads while preserving the original file and preventing generated variants from exceeding the original dimensions or file size.
-- Added immediate template background uploads with shared media validation, variant generation, cleanup of abandoned uploads, and permission checks.
+- Configurable chart data sources, multi-series line charts, chart type and source options, value ordering, grid line colors, and text colors across editor, popout preview, and player rendering.
+- Player playlist and playback recovery for cached snapshots, offline states, stalled media, failed image/video loads, and service-worker cache failures.
+- Deterministic image derivatives for large uploads while preserving the original file and preventing generated variants from exceeding the original dimensions or file size.
+- Immediate template background uploads with shared media validation, variant generation, cleanup of abandoned uploads, and permission checks.
 
 ### Changed
 
@@ -280,13 +292,13 @@ All notable changes to this project will be documented in this file.
 
 ### Fixed
 
-- Fixed the template background image media picker Upload media button so it opens the file selector.
-- Fixed the template designer empty background message moving when the background image is removed.
-- Fixed cached API and RSS images not being served by the player after being downloaded.
-- Fixed blank time/date regions displaying the default clock format on the player.
-- Fixed the time/date placeholder popup omitting text and math transform help.
-- Fixed empty region previews displaying type labels instead of remaining blank.
-- Fixed empty weather regions displaying the default weather summary.
+- The template background image media picker Upload media button so it opens the file selector.
+- The template designer empty background message moving when the background image is removed.
+- Cached API and RSS images not being served by the player after being downloaded.
+- Blank time/date regions displaying the default clock format on the player.
+- The time/date placeholder popup omitting text and math transform help.
+- Empty region previews displaying type labels instead of remaining blank.
+- Empty weather regions displaying the default weather summary.
 
 ## 2.13.2 - 2026-09-11
 
@@ -298,7 +310,7 @@ All notable changes to this project will be documented in this file.
 
 ### Added
 
-- Added the shared Media Library to slide region controls and template editors, preserving existing media paths while providing safe private uploads, responsive four-row server-side batching, and card-only scrolling with Load more pagination.
+- The shared Media Library to slide region controls and template editors, preserving existing media paths while providing safe private uploads, responsive four-row server-side batching, and card-only scrolling with Load more pagination.
 
 ### Changed
 
@@ -310,9 +322,9 @@ All notable changes to this project will be documented in this file.
 
 ### Added
 
-- Added offline-capable Local Control for central users with `clients.allow`, scoped to each player and its connected clients, with responsive client actions, current slide titles, and live WebSocket updates for pause and blackout state changes.
-- Added player-specific HTTP-only sessions, minimized cached authentication data with hashed usernames, immediate session and socket revocation when authorization changes, and login throttling after repeated failures.
-- Added web-owned authorization synchronization: connected remote players refresh every fifteen minutes and receive the current authorization state immediately after reconnecting, while the configured local player is excluded from remote fanout.
+- Offline-capable Local Control for central users with `clients.allow`, scoped to each player and its connected clients, with responsive client actions, current slide titles, and live WebSocket updates for pause and blackout state changes.
+- Player-specific HTTP-only sessions, minimized cached authentication data with hashed usernames, immediate session and socket revocation when authorization changes, and login throttling after repeated failures.
+- Web-owned authorization synchronization: connected remote players refresh every fifteen minutes and receive the current authorization state immediately after reconnecting, while the configured local player is excluded from remote fanout.
 
 ## 2.11.3 - 2026-09-08
 
@@ -382,7 +394,7 @@ All notable changes to this project will be documented in this file.
 
 ### Fixed
 
-- Fixed client screen moves from mobile cards so the next move disables the client’s current screen group rather than its previous one.
+- Client screen moves from mobile cards so the next move disables the client’s current screen group rather than its previous one.
 - Removed unused Bootstrap Icons font preloads that triggered browser warnings on pages where icons were not rendered.
 
 ## 2.10.6 - 2026-08-29
@@ -398,23 +410,23 @@ All notable changes to this project will be documented in this file.
 
 ### Fixed
 
-- Fixed remote player commands and media synchronization so they route through the bridge using the physical player device identity, including announcement and playlist refresh notifications.
-- Fixed player media handling for remote bridge uploads and deletes by using the bridge endpoint with explicit player-device authentication.
-- Fixed player service-worker caching so ranged media requests bypass stale cached responses and video playback remains reliable.
+- Remote player commands and media synchronization so they route through the bridge using the physical player device identity, including announcement and playlist refresh notifications.
+- Player media handling for remote bridge uploads and deletes by using the bridge endpoint with explicit player-device authentication.
+- Player service-worker caching so ranged media requests bypass stale cached responses and video playback remains reliable.
 
 ## 2.10.5 - 2026-08-29
 
 ### Fixed
 
-- Fixed intermittent pairing failures while player registration and pairing sessions propagate through the bridge by retrying transient resolution and completion requests.
-- Fixed the pairing page so transient submission failures retry automatically and pairing progress uses a single spinner without dimming the form.
-- Fixed the player onboarding page so it continues polling until the pairing code and QR code are available.
+- Intermittent pairing failures while player registration and pairing sessions propagate through the bridge by retrying transient resolution and completion requests.
+- The pairing page so transient submission failures retry automatically and pairing progress uses a single spinner without dimming the form.
+- The player onboarding page so it continues polling until the pairing code and QR code are available.
 
 ## 2.10.4 - 2026-08-29
 
 ### Fixed
 
-- Fixed remote client move commands so they route through the player bridge to the correct browser tab using the physical player identity and connection ID.
+- Remote client move commands so they route through the player bridge to the correct browser tab using the physical player identity and connection ID.
 - Removed the obsolete `PLAYER_BASE_URL` configuration fallback; command routing uses `PLAYER_INTERNAL_URL` locally or the player bridge remotely, while `PLAYER_PUBLIC_URL` remains available for kiosk launcher and direct player access.
 - Removed the player URL list from screen-group add/edit pages and expanded the remaining form card to full width.
 
@@ -427,19 +439,19 @@ All notable changes to this project will be documented in this file.
 
 ### Fixed
 
-- Fixed the weather edit preview so the daily forecast is shown initially, the 24-hour forecast is hidden until selected, and the redundant hourly heading is removed.
-- Fixed onboarding cleanup so incomplete pairings are retained for the 15-minute pairing-code lifetime while inactive completed bindings are pruned after 24 hours.
-- Fixed client-name handling so offline names can be reused, active collisions receive numeric suffixes, and reconnecting players resolve duplicate names consistently.
-- Fixed an internal server error when renaming clients by forwarding the available-name resolver to the client command routes.
-- Fixed remote client moves to resolve the paired browser client binding before changing its target screen.
-- Fixed remote player heartbeats to update the central onboarding bindings for active browser clients without treating the physical player registry ID as a client binding.
-- Fixed targeted commands after browser reconnects by falling back to the stable client ID when a transient connection ID is stale.
-- Fixed stale browser command connections remaining active indefinitely when the physical player heartbeat was still healthy.
-- Fixed media synchronization so generated player caches are excluded while remote image caches remain available to players.
-- Fixed weather screen notifications so changes in the fetched data or the current forecast hour trigger a refresh.
-- Fixed player runtime script loading and slide rendering so region modules, transitions, and cached playlists initialize consistently.
-- Fixed command delivery reporting to require acknowledgement from the receiving browser tab.
-- Fixed playlist refresh notifications to target the physical player hosting each screen instead of always targeting the local player.
+- The weather edit preview so the daily forecast is shown initially, the 24-hour forecast is hidden until selected, and the redundant hourly heading is removed.
+- Onboarding cleanup so incomplete pairings are retained for the 15-minute pairing-code lifetime while inactive completed bindings are pruned after 24 hours.
+- Client-name handling so offline names can be reused, active collisions receive numeric suffixes, and reconnecting players resolve duplicate names consistently.
+- An internal server error when renaming clients by forwarding the available-name resolver to the client command routes.
+- Remote client moves to resolve the paired browser client binding before changing its target screen.
+- Remote player heartbeats to update the central onboarding bindings for active browser clients without treating the physical player registry ID as a client binding.
+- Targeted commands after browser reconnects by falling back to the stable client ID when a transient connection ID is stale.
+- Stale browser command connections remaining active indefinitely when the physical player heartbeat was still healthy.
+- Media synchronization so generated player caches are excluded while remote image caches remain available to players.
+- Weather screen notifications so changes in the fetched data or the current forecast hour trigger a refresh.
+- Player runtime script loading and slide rendering so region modules, transitions, and cached playlists initialize consistently.
+- Command delivery reporting to require acknowledgement from the receiving browser tab.
+- Playlist refresh notifications to target the physical player hosting each screen instead of always targeting the local player.
 
 ## 2.10.2 - 2026-08-28
 
@@ -449,7 +461,7 @@ All notable changes to this project will be documented in this file.
 
 ### Fixed
 
-- Fixed the weather forecast preview to show only its first-fetch message until a successful forecast is available.
+- The weather forecast preview to show only its first-fetch message until a successful forecast is available.
 
 ## 2.10.1 - 2026-08-28
 
@@ -527,7 +539,7 @@ All notable changes to this project will be documented in this file.
 
 ### Fixed
 
-- Fixed thumbnail capture timing so video assets are ready before the preview canvas is captured.
+- Thumbnail capture timing so video assets are ready before the preview canvas is captured.
 - Replaced unavailable webpage thumbnails with a subdued placeholder while keeping live webpage previews intact.
 
 ## 2.8.4 - 2026-08-17
@@ -539,9 +551,9 @@ All notable changes to this project will be documented in this file.
 
 ### Fixed
 
-- Fixed popup preview authentication for background thumbnail capture.
-- Fixed thumbnails so they use the same popup-preview canvas and resolve API/RSS placeholders, fonts, styles, and cached images correctly.
-- Fixed manual scheduled-task run notifications so they use task-neutral wording.
+- Popup preview authentication for background thumbnail capture.
+- Thumbnails so they use the same popup-preview canvas and resolve API/RSS placeholders, fonts, styles, and cached images correctly.
+- Manual scheduled-task run notifications so they use task-neutral wording.
 
 ## 2.8.3 - 2026-08-17
 
@@ -1217,7 +1229,7 @@ All notable changes to this project will be documented in this file.
 ### Fixed
 
 - Removed several onboarding and runtime code paths that were still inserting or refreshing `d_players` rows during normal player playback.
-- Fixed the screen-binding flow so it no longer writes a device UUID into `d_screens.player_id`, which avoided foreign key errors under the shared-player model.
+- The screen-binding flow so it no longer writes a device UUID into `d_screens.player_id`, which avoided foreign key errors under the shared-player model.
 
 ## 2.0.0 - 2026-07-28
 
@@ -1356,7 +1368,7 @@ All notable changes to this project will be documented in this file.
 
 ### Fixed
 
-- Fixed a migration gap that could leave `slides.thumbnail_path` missing on upgraded databases.
+- A migration gap that could leave `slides.thumbnail_path` missing on upgraded databases.
 
 ## 1.5.4 - 2026-07-25
 
@@ -1393,13 +1405,13 @@ All notable changes to this project will be documented in this file.
 
 ### Fixed
 
-- Fixed player media upload sync so signed upload requests are verified after the request body has been parsed.
+- Player media upload sync so signed upload requests are verified after the request body has been parsed.
 
 ## 1.5.1 - 2026-07-25
 
 ### Fixed
 
-- Fixed the account page so it can save changes again.
+- The account page so it can save changes again.
 
 ## 1.5.0 - 2026-07-25
 
@@ -1452,13 +1464,13 @@ All notable changes to this project will be documented in this file.
 
 ### Fixed
 
-- Fixed RBAC client action visibility.
+- RBAC client action visibility.
 
 ## 1.4.2 - 2026-07-21
 
 ### Fixed
 
-- Fixed duplicate permissions cleanup.
+- Duplicate permissions cleanup.
 
 ## 1.4.1 - 2026-07-21
 
@@ -1478,7 +1490,7 @@ All notable changes to this project will be documented in this file.
 
 ### Fixed
 
-- Fixed duplicate onboarding client names.
+- Duplicate onboarding client names.
 
 ## 1.3.3 - 2026-07-21
 
@@ -1514,20 +1526,20 @@ All notable changes to this project will be documented in this file.
 
 ### Fixed
 
-- Fixed screen playlist reassignment so changing a screen's playlist now triggers a refresh.
-- Fixed single-slide playlist refresh behavior so updates do not get stuck behind the current slide.
+- Screen playlist reassignment so changing a screen's playlist now triggers a refresh.
+- Single-slide playlist refresh behavior so updates do not get stuck behind the current slide.
 
 ## 1.1.5 - 2026-07-15
 
 ### Fixed
 
-- Fixed text pasting in the admin UI.
+- Text pasting in the admin UI.
 
 ## 1.1.4 - 2026-07-15
 
 ### Fixed
 
-- Fixed the admin table and playlist reorder UI.
+- The admin table and playlist reorder UI.
 
 ## 1.1.3 - 2026-07-15