Release 2.10.2

# Conflicts:
#	CHANGELOG.md
#	build/package.player.json
#	build/package.web.json
#	package-lock.json
#	package.json

.dockerignore

@@ -1,4 +1,9 @@
 *
 !package.json
+!package-lock.json
+!build/
+!build/**
 !src/
 !src/**
+!scripts/
+!scripts/**

.env.example

@@ -1,18 +0,0 @@
-PULSE_SIGNAGE_IMAGE=git.lzstealth.com/lzstealth/pulse-signage:latest
-PULSE_SIGNAGE_SHARED_SECRET=
-
-DB_HOST=mysql
-DB_PORT=3306
-DB_NAME=pulse-signage
-DB_USER=pulse-signage
-DB_PASSWORD=signage_password
-MYSQL_ROOT_PASSWORD=root_password
-
-PLAYER_PUBLIC_BASE_URL=http://localhost:8081
-PLAYER_INTERNAL_BASE_URL=http://player:8081
-
-SESSION_MAX_AGE_DAYS=14
-DEFAULT_ADMIN_USERNAME=admin
-DEFAULT_ADMIN_NAME=Admin
-DEFAULT_ADMIN_PASSWORD=admin
-PASSWORD_HASH_ITERATIONS=310000

.github/copilot-instructions.md

@@ -3,6 +3,9 @@
 ## Versioning and releases
 
 - Treat `package.json` as the source of truth for the application version.
+- Keep `package.json`, `build/package.player.json`, and `build/package.web.json` on the same version number.
+- Keep dependency versions and package metadata in `package.json`, `package-lock.json`, `build/package.player.json`, and `build/package.web.json` aligned unless a dependency is intentionally omitted from a specific bundle.
+- When changing bundled library versions, update the About page source data from the same package metadata or vendored asset banner rather than hardcoding a fresh literal.
 - When the app version changes, update `CHANGELOG.md` in the same change.
 - Keep database migration versions aligned with the release they actually belong to.
 - If only part of a migration batch belongs to a newer release, split that batch into a separate migration entry instead of relabeling the earlier release.

.github/workflows/docker-publish.yml

@@ -7,9 +7,20 @@ on:
   workflow_dispatch:
 
 jobs:
-  build-and-push:
+  build-and-push-existing-registry:
     runs-on: ubuntu-latest
 
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - name: web
+            repository: pulse-signage-web
+            dockerfile: ./build/Dockerfile
+          - name: player
+            repository: pulse-signage-player
+            dockerfile: ./build/Dockerfile.player
+
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
@@ -17,7 +28,7 @@ jobs:
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
 
-      - name: Log in to container registry
+      - name: Log in to existing package registry
         uses: docker/login-action@v3
         with:
           registry: git.lzstealth.com
@@ -28,18 +39,19 @@ jobs:
         id: meta
         uses: docker/metadata-action@v5
         with:
-          images: git.lzstealth.com/LZStealth/pulse-signage
+          images: |
+            git.lzstealth.com/lzstealth/${{ matrix.repository }}
           tags: |
             type=raw,value=latest
             type=ref,event=tag
-            type=semver,pattern=v{{major}}.{{minor}}
             type=semver,pattern=v{{major}}
+            type=semver,pattern=v{{major}}.{{minor}}
 
       - name: Build and push image
         uses: docker/build-push-action@v6
         with:
           context: .
-          file: ./Dockerfile
+          file: ${{ matrix.dockerfile }}
           push: true
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}

.gitignore

@@ -3,9 +3,13 @@ media/
 !src/web/lib/media/
 !src/web/lib/media/**
 docker-compose.dev.yml
+/docker-compose/*.dev.yml
+/docker-compose/*.env
+/dev-demo-seed.js
 .vscode/
 .env
 npm-debug.log*
 yarn-debug.log*
 yarn-error.log*
 .DS_Store
+TODO.md

CHANGELOG.md

@@ -2,6 +2,704 @@
 
 All notable changes to this project will be documented in this file.
 
+## 2.10.2 - 2026-08-28
+
+### Fixed
+
+- Fixed the weather forecast preview to show only its first-fetch message until a successful forecast is available.
+
+## 2.10.1 - 2026-08-28
+
+### Added
+
+- Added linear gradient backgrounds to templates, including multiple colours and angle control.
+- Added a visual gradient stop editor with draggable stops, click-to-add support, and stop reordering.
+
+## 2.10.0 - 2026-08-28
+
+### Added
+
+- Added secure kiosk onboarding with QR-first and manual pairing flows.
+- Added browser-specific pairing sessions with expiring pairing codes.
+- Added circular QR presentation and a compatible QR scanner with decoder fallbacks.
+- Added responsive player onboarding and a post-pair option to connect another player.
+- Added stable player identity bindings for paired players and moved-client aliases.
+- Added per-tab client identities backed by browser session storage for commands, pairing, and screen moves.
+- Added RBAC protection for player pairing through the `pairing.allow` permission.
+- Added a dedicated web onboarding workflow for pairing and managing player setup.
+
+### Changed
+
+- Restricted direct screen URLs to the player configured for the requested screen.
+- Added pairing entry points to the dashboard and connected clients workflows.
+- Made pairing QR codes easier to scan by encoding only the short pairing code.
+- Added a mobile-friendly connected clients link after successful pairing.
+- Made connected-client controls and player pairing UI render independently according to their permissions.
+- Added player keyboard feedback for slide navigation, plus `P` pause/unpause and `B` blackout toggles.
+- Removed client identities from onboarding and screen-move URLs; authorized player data now loads after the tab identity handshake.
+- Updated connected-client commands and screen moves to resolve tab and registered-player identities reliably.
+
+## 2.9.0 - 2026-08-28
+
+### Added
+
+- API sources, RSS feeds, and weather locations can be enabled or disabled without deleting their cached data.
+- Added Weather slide regions with current, daily, and hourly placeholders, date/time transforms, and Bootstrap weather icon transforms.
+- Added multiple saved weather locations with provider, coordinate, unit, and refresh settings.
+- Added separate Allow permissions for manually refreshing API sources, RSS feeds, and weather locations.
+
+### Changed
+
+- API, RSS, and Weather refresh jobs now skip disabled sources across scheduled, startup, queued, and manual refresh paths, while re-enabling a source resumes refresh scheduling.
+- Weather placeholders now show all current fields, or all fields for the first daily/hourly entry before the remaining entries in a Show more section.
+- Weather previews, player playback, and slide thumbnails now use cached Weather data and consistent text/icon sizing.
+- API, RSS, and Weather lists now show enabled status and their forms provide action-oriented Enable/Disable controls.
+- Enable/Disable actions on API, RSS, and Weather forms now run asynchronously without reloading unsaved form changes.
+- Weather locations can now be duplicated from the weather list.
+- Startup data-source refreshes now respect each API, RSS, and weather source's configured repull interval.
+- RSS feeds now persist their last collection timestamp.
+- Refreshed the vendored AdminLTE assets to 4.8.5.
+- Added AdminLTE extended palette colours to announcement colour choices and player rendering.
+- Removed Digital Signage Subheading and top padding.
+- API and RSS source saves now preserve cached data without pulling; added explicit manual refresh actions.
+
+## 2.8.7 - 2026-08-22
+
+### Added
+
+- Added configurable JSON POST requests and two-step login-then-token authentication for API sources.
+
+## 2.8.6 - 2026-08-18
+
+### Fixed
+
+- Added live URL validation with inline feedback and explicit HTTP or HTTPS scheme enforcement for URL fields.
+- Prevented Enter in slide editor inputs from implicitly saving the slide.
+- Collapsed nested API response JSON sections by default while keeping the root response visible.
+
+## 2.8.5 - 2026-08-17
+
+### Fixed
+
+- Fixed thumbnail capture timing so video assets are ready before the preview canvas is captured.
+- Replaced unavailable webpage thumbnails with a subdued placeholder while keeping live webpage previews intact.
+
+## 2.8.4 - 2026-08-17
+
+### Added
+
+- Added local caching for API and RSS image placeholders under `player-cache/remote-images` for offline player playback.
+- Added reconciliation of cached remote images so files no longer referenced by slides are removed.
+
+### Fixed
+
+- Fixed popup preview authentication for background thumbnail capture.
+- Fixed thumbnails so they use the same popup-preview canvas and resolve API/RSS placeholders, fonts, styles, and cached images correctly.
+- Fixed manual scheduled-task run notifications so they use task-neutral wording.
+
+## 2.8.3 - 2026-08-17
+
+### Added
+
+- Added API, RSS, Timetable, and Time / Date placeholder help panels with shared transform and date-token documentation.
+- Added render-time API and RSS image placeholders with proportional sizing and preview-only bounding boxes.
+
+### Changed
+
+- API and RSS regions now preserve authored content when no data source is selected and remain blank when a selected source has no authored content.
+- Normal WYSIWYG image insertion remains upload-backed and separate from image placeholder transforms.
+
+## 2.8.2 - 2026-08-16
+
+### Changed
+
+- Standardized update audit events on from/to changes and added readable table diffs for nested JSON, arrays, null values, and empty strings.
+- Standardized internal `src/data` imports on the `#src` alias.
+
+## 2.8.1 - 2026-08-16
+
+### Fixed
+
+- Prevented startup and runtime duplicate-key writes from consuming auto-increment values in permission, player, onboarding, settings, and relationship tables.
+- Prevented partial timetable schemas from being incorrectly treated as fully migrated during schema version detection.
+
+### Changed
+
+- Renamed the built-in administrator role key to `super-admin`, while allowing its display name and description to be edited without being overwritten on restart.
+
+## 2.8.0 - 2026-08-16
+
+### Added
+
+- Filtered audit-log CSV export with a dedicated `audit-log.export` permission.
+- Canvas Sizes as an individual Content audit category.
+- Audit events for slide, template, playlist, and screen changes.
+- Audit events for System Settings changes.
+- Administration audit events for user and role management.
+- Audit logging enablement, category selection, and request metadata controls.
+- The extensible audit event storage, retention setting, dedicated audit-log permission, and paginated viewer foundation.
+- A Defaults settings section for player and announcement defaults.
+- A configurable maximum active session limit that removes the oldest sessions first.
+- IP address and user-agent metadata to active sessions.
+- The option for users to sign out their other active sessions from My Account.
+- Persistent administrator-controlled account locking and unlocking.
+- Database-backed login rate limiting with configurable attempts, lockout duration, and tracking scope.
+- A permissions-gated System Settings page for announcement icon suggestions, media upload limits and MIME types, session lifetime, and password-change policies.
+- Configurable forced password changes for newly created users and administrator password resets.
+- The database foundation for key-based application settings, including typed defaults and validation.
+
+### Changed
+
+- Updated the API and database documentation and added the Docker publish status badge to the project README.
+- Renamed the audit export permission to `audit-log.allow`.
+- Made Content and Data Sources audit categories opt-in and excluded automatic data-source refreshes from audit logging.
+- Split Content audit logging into individual Slides, Templates, Playlists, Screens, and Announcements categories.
+- Renamed the System Settings audit category key from `settings` to `system-settings`.
+- Split audit administration events into separate Users and Roles categories.
+- Split RSS and API data-source refresh defaults.
+- Made the default announcement duration use a value and unit selector, matching announcement forms.
+- Replaced password strength presets with customizable length, category, and character requirements.
+- Session expiration now uses the configured system setting, and user and role administration is grouped under the Settings area.
+- Renamed the system settings permissions to the `system-settings.*` namespace and migrated existing role assignments.
+- Added numeric auto-increment identifiers to every table and retained natural or relationship keys as unique constraints.
+
+## 2.7.6 - 2026-08-15
+
+### Changed
+
+- The announcement icon picker now supports searching the full Bootstrap Icons catalog while still showing the curated suggestion set by default.
+
+### Fixed
+
+- The announcement Play/Stop button now refreshes after saving screen-group changes, so Play stays disabled until the announcement actually has targets again.
+
+## 2.7.5 - 2026-08-15
+
+### Changed
+
+- The About page now reads bundled library versions from package metadata and the vendored AdminLTE stylesheet.
+- AdminLTE is now reported as 4.3.1.
+- Animate.css is now reported as 4.1.1.
+- Bootstrap Icons is now reported as 1.13.1.
+- Cropper.js is now reported as 1.6.2.
+- Express is now reported as 5.2.1.
+- Handlebars is now reported as 4.7.8.
+- hls.js is now reported as 1.7.0.
+- Multer is now reported as 2.2.0.
+- MySQL2 is now reported as 3.23.3.
+- Sharp is now reported as 0.35.3.
+- TinyMCE is now reported from the vendored package metadata.
+- ws is now reported as 8.21.3.
+- The runtime and container images now target Node.js 26.
+
+## 2.7.4 - 2026-08-15
+
+### Added
+
+- A new About page.
+
+### Changed
+
+- Refreshed the vendored AdminLTE assets to 4.3.1.
+
+## 2.7.3 - 2026-08-15
+
+### Changed
+
+- The slide image cropper now warns that SVG and GIF files will be rasterized if they are edited, and it keeps the original file only when the full image remains selected.
+- The slide image upload flow now accepts PNG, JPG, GIF, WebP, and SVG images, while the WYSIWYG image uploader now matches that same allowlist.
+- TIFF is no longer accepted by the WYSIWYG image uploader.
+
+### Fixed
+
+- The player now preserves quoted custom font-family values from rich text content, so fonts with spaces such as Old London render correctly on screens.
+
+## 2.7.2 - 2026-08-14
+
+### Fixed
+
+- HTML and webpage region previews now normalize object-shaped content before rendering, so the player, thumbnails, and popup preview show the intended iframe content instead of leaking raw objects.
+- HTML and webpage preview iframes now size explicitly to the full region bounds in the player, thumbnails, and popup preview.
+
+## 2.7.1 - 2026-08-14
+
+### Changed
+
+- The player page now supports keyboard navigation with arrow keys to move between slides.
+
+## 2.7.0 - 2026-08-14
+
+### Added
+
+- The WYSIWYG editor now supports adding small images.
+
+### Changed
+
+- The WYSIWYG image insertion flow also received a small code cleanup to simplify the related helper logic.
+- The default table formatting has been applied.
+- Timetable regions now use the renamed helpers end to end in the editor and player, including timezone-aware rendering for timetable entry placeholders.
+
+## 2.6.27 - 2026-08-14
+
+### Fixed
+
+- Scheduled task intervals now display the most appropriate exact unit, such as seconds, minutes, hours, or days, while keeping the sort order numeric.
+
+## 2.6.26 - 2026-08-10
+
+### Changed
+
+- API sources and RSS feeds now accept hours as an update interval unit, and the list and background task scheduling paths now format and convert that unit correctly.
+
+## 2.6.25 - 2026-08-10
+
+### Fixed
+
+- Screen group edit now keeps the slug locked after creation, so existing screen group URLs remain stable.
+
+## 2.6.24 - 2026-08-10
+
+### Fixed
+
+- Deferred playlist updates now keep the current slide index when the next playlist snapshot is applied, so playback no longer jumps back to the first slide mid-cycle.
+
+## 2.6.23 - 2026-08-09
+
+### Fixed
+
+- Dashboard quick-action and kiosk-launcher cards now use row spacing instead of extra card padding, so the layout stays consistent at large widths.
+- API and RSS refresh jobs now notify affected player screens only when the refreshed data actually changes, so unchanged polls no longer trigger redundant player refreshes.
+
+## 2.6.22 - 2026-08-09
+
+### Changed
+
+- Startup now logs the previously detected schema version, the current app version, and whether pending migrations exist.
+
+### Fixed
+
+- Direct-to-URL player sessions now generate and persist a stable onboarding device id in session storage, so connected screens can still be moved and renamed independently without going through the onboarding flow first.
+- The connected-clients move action now tolerates rows that only have a live connection id, which keeps move operations working for screens that skipped onboarding.
+
+## 2.6.21 - 2026-08-09
+
+### Changed
+
+- Startup now logs the previously detected schema version, the current app version, and whether migrations are required.
+- The schema documentation now reflects the timetable table rename, the new `o_app_state` table, and startup version tracking.
+- Timetable timezone placeholders now use `tz` for the short zone name and `tz_long` for the full IANA zone.
+
+## 2.6.20 - 2026-08-09
+
+### Changed
+
+- Startup now logs the previously detected schema version, the current app version, and whether migrations are required.
+
+## 2.6.19 - 2026-08-09
+
+### Changed
+
+- Timetable editor helpers, routes, and table layout now use timetable-specific naming and tighter card/table styling.
+- Connected clients now sort by client identity fields instead of the old IP-based ordering assumption.
+
+## 2.6.18 - 2026-08-09
+
+### Changed
+
+- Timetable tables were renamed from the old `schedule` names to `timetable` names, and existing databases now rename those tables during migration.
+- The timetable group editor now uses timetable-specific naming in its shared helpers and keeps the entries table aligned with the standard admin card/table layout.
+
+## 2.6.17 - 2026-08-09
+
+### Changed
+
+- Existing timetable groups and entries are now migrated to Europe/London, and timetable dates are rewritten to UTC using that source timezone so the wall-clock meaning stays intact.
+
+### Fixed
+
+- New timetable groups now default to Europe/London so the timetable editor and saved data start from the same timezone assumption as the migrated rows.
+
+## 2.6.16 - 2026-08-09
+
+### Changed
+
+- Timetable groups now store an IANA time zone and render their entry datetimes in that timetable time zone, so schedules keep the same wall-clock meaning when they are edited from another country.
+
+### Fixed
+
+- Timetable entry date inputs now round-trip through the timetable time zone instead of the browser locale, so saving from Florida while targeting Germany keeps the intended local times.
+
+## 2.6.15 - 2026-08-08
+
+### Fixed
+
+- Slide update media sync on the player now removes uploads that were removed from the slide, so player storage stays aligned with the current slide content.
+- Routine player and player-bridge media upload/delete logs were removed to keep remote player and bridge operation quieter.
+- Background task descriptions no longer repeat the player slug when the task key already ends with that player name.
+
+## 2.6.14 - 2026-08-08
+
+### Fixed
+
+- Slide updates and template deletes now fan out media sync work across all live players instead of targeting only one player.
+
+## 2.6.13 - 2026-08-08
+
+### Fixed
+
+- The player bundle now keeps the browser-only QR export dependencies lazy-loaded, so the remote player image no longer needs `puppeteer-core` or `@sparticuz/chromium` at startup.
+- Remote player startup sync now falls back to `WEB_INTERNAL_URL` when it is configured, which avoids 404s when the bridge is not the correct sync target.
+- The player startup sync and media-write info logs were removed to keep normal remote-player operation quieter.
+
+## 2.6.12 - 2026-08-08
+
+### Fixed
+
+- The Docker build inputs now live under `build/`, with separate web and player package manifests so the player image no longer carries the web browser tooling bundle.
+- The Docker publish workflow now restores `v2` and `v2.2` style image tags alongside `latest` and the full release tag.
+- Remote player sync and upload routing now carry the exact connected player device id through the bridge, so startup media and font jobs target the correct player instance in split-device deployments.
+- Player websocket registration now learns the public base URL from the actual screen request origin, so localhost and 127.0.0.1 aliases both keep websocket commands working.
+
+## 2.6.11 - 2026-08-08
+
+### Fixed
+
+- Role edits now save selected permissions from the shared RBAC form, so changes on the role page persist when you submit the form.
+- RBAC permission sections now stay open independently in the accordion, so opening one section no longer closes the others.
+
+## 2.6.10 - 2026-08-08
+
+### Fixed
+
+- The onboarding landing page and form no longer restore a previously selected screen, so the screen picker always starts clean while still keeping the saved client name.
+
+## 2.6.9 - 2026-08-08
+
+### Fixed
+
+- The connected-clients view no longer exposes or sorts by client IP, so the table stays focused on the player identity, screen, and playback state.
+- The connected-clients dashboard row renderer now keeps the actions column aligned after removing the IP column, so row updates no longer append a duplicate actions cell.
+
+## 2.6.8 - 2026-08-08
+
+### Fixed
+
+- The screen-group command buttons stay disabled until a real target group is selected, so the placeholder "Select Screen Group" state cannot send commands.
+
+## 2.6.7 - 2026-08-08
+
+### Fixed
+
+- Admin client commands now stay on the bridge for remote players, so screen control no longer depends on a public player address.
+- The connected-clients screen-group controls now use the same async bulk-command path as the dashboard, including the All Screens option and live pause/blackout toggles.
+
+## 2.6.6 - 2026-08-07
+
+### Fixed
+
+- Timetable entry editing now validates end times locally, requires the end to be at least one minute after the start, and highlights the end field when the value is invalid.
+
+## 2.6.5 - 2026-08-07
+
+### Added
+
+- Multiple players are now supported across the player registry, dashboard snapshots, and screen group management, so a deployment can track more than one connected player at a time.
+- The player-agent can now run remotely, which lets a player connect through the bridge instead of requiring everything to stay on the same host.
+- The Docker Compose setup now includes a public stack with a player bridge service and a separate remote player stack, so local and split-device deployments share the same documented layout.
+- Dedicated local and remote compose manifests now live at `docker-compose/docker-compose.yml` and `docker-compose/docker-compose.remote.yml`, with matching example env files for the two deployment modes.
+- Admin client commands now have a dedicated route and test coverage, which keeps dashboard actions aligned with the current player control-plane flow.
+
+### Changed
+
+- Screen group views now show each registered player's public base URL and computed player URL on the edit screen instead of assuming a single local player.
+- The dashboard status indicator now reports the connected player count, which makes the live feed status more explicit when several players are online.
+- Player command dispatch, playlist playback, and render preloading were tightened so the player keeps using the active web base URL and can warm assets before the slide is shown.
+- Playlist video-duration selection now uses the longest matching video region when a slide contains more than one video region.
+- Media sync, font sync, and upload sync now follow the newer player-agent workflow, keeping background tasks and dashboard refreshes consistent with split-device deployments.
+- The onboarding landing page now shows a built-in QR placeholder and falls back to it when the QR request fails, so the screen never starts blank.
+- Upload sync now resolves the player internal base URL once per batch and reuses it for queued upload and delete operations, keeping mirrored media writes pointed at the active player endpoint.
+- The connected clients list now defaults to client name, then IP address, so rows stay in a stable order when connection details change.
+
+### Fixed
+
+- Connected clients search results now keep the row action column, because the row template resolves `currentUser` from the parent view context while rendering inside the `clients` loop.
+- The move-client modal now carries the row's player base URL through to the redirect step, so clients move correctly even when local and bridge-backed players are mixed.
+- Paginated table cards now only apply their minimum height when the table content would otherwise exceed that threshold, which keeps short result sets compact in smaller browser windows.
+
+## 2.6.4 - 2026-08-07
+
+### Fixed
+
+- The screen table no longer stores a player foreign key, and screen/player URLs now resolve from the current player registration instead of a screen assignment.
+
+## 2.6.3 - 2026-08-07
+
+### Fixed
+
+- The screen table no longer enforces a foreign key to the player table, which keeps player assignments flexible while preserving the existing screen schema.
+
+## 2.6.2 - 2026-08-07
+
+### Fixed
+
+- The player registry now upgrades to an integer player id with a separate player identifier so the schema migration can complete cleanly on existing databases.
+- Dashboard screen lookups now tolerate the upgraded player table layout during the rollout.
+
+## 2.6.1 - 2026-08-06
+
+### Fixed
+
+
+### Changed
+
+- The web side now resolves the player base URL from the database-backed player registration record instead of depending on a web-container environment fallback.
+- Player registrations now store a separate friendly identifier, so a player can keep the same device key while showing a label like `Shop2`.
+
+## 2.5.14 - 2026-08-06
+
+### Added
+
+- Added branded Windows and Linux kiosk launcher downloads on the dashboard, with updated copy that explains the launcher behavior more clearly.
+- Kiosk launchers now start the browser in kiosk mode, suppress notifications for Chromium-based browsers, and use the correct Firefox kiosk flag.
+
+
+## 2.5.13 - 2026-08-05
+
+### Fixed
+
+- Slide and template save forms now allow larger multipart text fields, so rich region content no longer trips Multer's default field-value limit.
+
+## 2.5.12 - 2026-08-05
+
+### Fixed
+
+- The auth route test now loads the alias bootstrap before the login flow, so isolated test runs do not depend on prior module initialization.
+- The slide editor now blocks pasted data images in TinyMCE so image content must come through the upload flow.
+
+## 2.5.11 - 2026-08-05
+
+### Fixed
+
+- Single-slide playlists now re-render the active slide immediately when a refresh arrives, instead of waiting for a transition that never happens.
+- Playlist create and update flows now redirect to the canonical `/playlists/:id/edit` path after saving.
+- Slide preview popups now keep rich-text spacing and line height consistent with the editor preview.
+
+## 2.5.10 - 2026-08-05
+
+### Fixed
+
+- Slide editor rich-text updates now keep the hidden field and preview state in sync after inline formatting actions.
+
+## 2.5.9 - 2026-08-05
+
+### Fixed
+
+- Screen playlist refreshes now wait until the next slide transition before applying a pending update, so one-slide playlists do not swap immediately during a refresh.
+- Playlist rows now show the mute control for any playable media region, including RTMP slides, instead of only video regions.
+
+## 2.5.8 - 2026-08-05
+
+### Fixed
+
+- MariaDB migrations now retry alternate foreign-key constraint names when screen-to-player constraint creation reports a duplicate-key error.
+
+## 2.5.7 - 2026-08-05
+
+### Fixed
+
+- QR template backgrounds now use a single solid color only, and the editor no longer exposes a background gradient mode.
+
+## 2.5.6 - 2026-08-05
+
+### Added
+
+- Onboarding QR rendering now uses the vendored `qr-code-styling` library directly, with a wider quiet zone and extra frame padding so the code does not clip at the corners.
+
+### Changed
+
+- The shared QR helper now renders `qr-code-styling` in Node without the old `qrcode` or `qrcode-generator` packages.
+- The onboarding QR endpoint now generates the styled QR at request time, and the player onboarding page requests it only after confirming the player is not already onboarded.
+- Playlist QR preview backfill now uses the same styled QR helper as onboarding, so playlist snapshots and generated previews stay consistent.
+- The onboarding QR layout now keeps the code inset within its frame so the corners have more breathing room.
+
+## 2.5.5 - 2026-08-04
+
+### Added
+
+- A shared Dupe flow was added to most admin create pages and list views, including roles, users, playlists, slides, templates, canvas sizes, announcements, and supported data sources.
+
+### Changed
+
+- RBAC roles now include a Dupe action that opens a copy-on-create flow with the selected permissions already populated.
+- Users now include a Dupe action that opens the add-user form with the copied name and roles, while leaving the username blank for a new login.
+- User usernames are now editable from the admin users section, while the personal account password page remains unchanged.
+- The users form now allows creating an account without assigning any roles.
+- Save and New on the users form now returns to the blank create page instead of falling back to the list.
+- Password updates now accept a slightly lighter policy of 10 characters with 3 of 4 character classes, and the account and user password forms now describe the updated requirement.
+- The slide rich-text editor now groups underline, strikethrough, subscript, and superscript into a single split-button control, with the main button using the underline icon and the dropdown exposing the other text-format actions.
+- Chip formatting in the slide rich-text editor now uses a reusable inline-format helper so the chip action continues to sync and mark the editor as edited when applied.
+- RSS, API, and timetable placeholder help text now uses the same transform examples, spacing, and typography as the timetable version, with the hint shown after the visible placeholders and before any overflow disclosure.
+
+### Fixed
+
+- Cells and inputs now enforce route-specific character limits on the form itself and on the matching save paths, so overlong values no longer fail at submit time.
+- Playlist rows now use a grip drag handle with separate up/down move controls, and the drag grip cursor now changes to grab and grabbing on hover and drag.
+- Playlist duration inputs now respect a min-only limit correctly, so the shared limiter no longer coerces values down to 0 when no max attribute is present.
+- Playlist row video and mute toggles now use the correct filled/outline Bootstrap button styles for their current state without relying on the `active` class.
+- Slides table search now only matches slide titles and template names, and no longer searches within slide content.
+- Banner marquee text now measures its real cycle width so top-banner and lower-third announcements loop continuously instead of resetting from a fixed start position.
+- Slide editor template selection now stays editable on blank slides until the user makes a real content edit, so TinyMCE hydration no longer locks the canvas immediately.
+- Slide editor region cards now share a common header shell, so the image and video chips stay aligned with the other region types on the Video Webpage and HTML RTMP pages.
+- Firefox preview popup now centers the preview canvas in normal layout flow and scales from the center, so the popup preview lines up correctly in Chrome and Firefox.
+- Canvas size edits now keep the width and height fields locked while the size is in use, and oversized canvas dimensions are rejected at 16384 instead of reaching the save path.
+- Schedule rules now start collapsed by default, use the built-in card collapse behavior, and keep validation messages visible without re-highlighting empty paired inputs.
+- Timetable group deletes now scan slide content for the actual `timetable_group_id` field, so groups that are still referenced by slides stay protected from deletion.
+- Timetable add and edit pages now keep cancel confirmation tied to timetable entry edits, so changes inside the entries table are treated as unsaved form changes.
+- Screen add and edit pages now keep the Player URL box in a stable two-column layout, so switching between the forms no longer causes the page to jump or shift.
+- Screen add pages now show the secondary Save and Close / Save and New actions, and screen edit delete actions now prompt for confirmation before removing the screen.
+- Admin user password resets now keep the selected user in view by returning to that user's edit page after saving.
+- Account password saves now refresh the page after the success toast is queued so the confirmation message stays visible.
+- Shared toast handling now preserves a pending success message across the redirect so refreshes do not drop the confirmation banner.
+- Announcement create and edit pages now keep the save action buttons visible, and the edit-page delete action now prompts for confirmation before deleting.
+- Active announcements are now blocked from deletion with a clearer edit-page message that explains why.
+- Slide template create now shows the background image remove button and clear flag, matching the edit page behavior.
+- Template create now exposes Save & Close and Save & New actions, and template edit delete actions now use the shared action-button helper with a confirmation prompt instead of a separate hidden form.
+- The advanced animation modal now shows intro, outro, and loop durations as 1-200% fields, with 100% saving back as 1000ms.
+- The advanced animation modal now hard-limits repeat counts to 999 so attention-seeker animations cannot be configured with unbounded loops.
+- Template editor region boxes now rerender when the canvas or stage resizes, and region width/height changes now keep the lock ratio, stay within the canvas, and shift back on-canvas instead of spilling over.
+- Background tasks and scheduled tasks now render timestamps in 24-hour format, and the background task queue keeps a confirmation prompt before clearing finished items.
+
+## 2.5.4 - 2026-08-03
+
+### Changed
+
+- The API source bearer token field now uses a password input with a right-side toggle to show or hide the token.
+
+### Fixed
+
+- QR code regions now render at the correct size in the slide editor preview, and the QR chip header now matches the other region cards.
+- The dashboard onboarding link now uses the player public base URL stored in the database instead of a `/screen/...` URL.
+
+## 2.5.3 - 2026-08-03
+
+### Changed
+
+- The user edit page delete action now shows a confirmation prompt before removing an account.
+
+### Fixed
+
+- Schedule modal cancel now restores the original rule set instead of keeping edits made after the modal opened.
+
+## 2.5.2 - 2026-08-03
+
+### Changed
+
+- Player page auth now writes a cookie for websocket reuse, and player and announcement sockets accept that cookie so they no longer depend on query-string tokens.
+- RSS and API region placeholder panels now use shared field-aware chip rendering, with updated spacing and defaults across the slide editor.
+- RTMP regions now default audio to enabled in the editor, and the slide rich-text editor no longer allows anchor tags.
+
+### Fixed
+
+- Player websocket auth now falls back to the `pulse_page_auth` cookie when the auth query parameter is unavailable.
+
+## 2.5.1 - 2026-08-03
+
+### Added
+
+- Template regions now include a dedicated advanced animation modal for editing intro, outro, and Attention Seekers settings directly.
+
+### Changed
+
+- Template region animation settings now store as a single JSON object with `intro`, `outro`, and `loop` keys.
+- The template editor advanced animation field now edits the JSON object directly instead of separate preset selects.
+- Animate.css is now loaded from vendored assets so template previews and player rendering use the local copy.
+
+### Fixed
+
+- Existing databases now migrate legacy animation columns into `animation_json` and then drop the old columns.
+
+## 2.5.0 - 2026-08-03
+
+### Added
+
+- Template regions now support intro, exit, and Attention Seekers animation presets in the editor, with in-canvas preview controls.
+
+### Changed
+
+- The template editor now locks editing while preview playback is running so animation changes are easier to inspect.
+
+### Fixed
+
+- Existing databases now receive the template region animation columns through the versioned migration path.
+
+## 2.4.2 - 2026-08-02
+
+### Added
+
+- Screen-level controls are now shown on the dashboard for quicker access to screen actions.
+- Connected clients can now be moved to another screen from the dashboard, and the player redirects to the new screen after the binding updates.
+- Playlist slide config now includes a mute toggle for video and RTMP items, and the player honors the stored mute state during playback.
+
+### Changed
+
+- Playlist canvas lock now stores `canvas_id` on `c_playlists` and links directly to `c_canvas_sizes`.
+- Playlist add and edit now keep the selected canvas size tied to the playlist form flow, so canvas changes stay consistent while editing.
+- RBAC permission sections now follow the same order as the admin sidebar, with section spacing kept in 10-point increments.
+- Admin add/edit pages now share form view-model helpers and common form shells across data sources, signage, RBAC, and user settings, reducing duplicated template markup.
+- Playlist editing now goes through a shared form page helper with dedicated schedule-rule cards and drag sorting, keeping slide rows and rule state in sync.
+- Data sources now use per-section route modules for API sources, RSS feeds, and timetables, while the shared controller only keeps the root `/data-sources` redirect.
+- The consolidated admin shell also refreshed shared layout, toast, login, and error rendering to match the newer helper registration flow.
+- Connected client row actions now use consistent icon-and-label buttons for pause and blackout across the server-rendered page and live dashboard updates.
+
+### Fixed
+
+- Canvas filtering for playlist slides now follows the selected canvas size id instead of a derived signature.
+- Saving API sources and RSS feeds no longer throws an internal server error after the route split, because the shared data-source refresh task service is wired through the web bootstrap again.
+
+## 2.4.1 - 2026-08-02
+
+### Changed
+
+- Playlist canvas size is now stored on `c_playlists.canvas_signature` and the migration backfills existing single-canvas playlists.
+
+### Fixed
+
+- Playlist canvas sizing no longer relies on startup bootstrap logic.
+
+## 2.4.0 - 2026-08-02
+
+### Added
+
+- Playlist slide scheduling now supports multiple OR-ed rule blocks instead of a single date-or-time schedule.
+
+### Changed
+
+- Playlist slide schedule data now stores rule sets in `schedule_rules_json`, and the migration backfills legacy schedule columns before dropping them.
+
+### Fixed
+
+- Legacy `schedule_mode`, date, time, and day columns are removed from `c_playlist_slides` after the new rule schema is installed.
+
+## 2.3.0 - 2026-08-02
+
+### Added
+
+- Shared add/edit form templates now cover API sources, RSS feeds, announcements, canvas sizes, screens, and templates, reducing duplicate page markup.
+- Schedule data source CRUD was added for grouped events in the admin UI.
+- The schedule region was added for rendering grouped events in slides and player playback.
+- Schedule data now flows through `scheduleGroups` in the slide editor and player payloads, letting the schedule region show upcoming or current entries from a selected group.
+
+### Changed
+
+- Admin save actions were standardized around the shared `saveActionButtons` helper, including save, save-and-close, save-and-new, cancel, and delete controls.
+- Admin routes and page renderers now route through the shared form/view helpers instead of separate add/edit templates for the refactored sections.
+- Toast, error, login, and shared layout rendering were refreshed to line up with the consolidated admin shell and helper registration flow.
+
+### Fixed
+
+- Canvas size defaults now seed only once during bootstrap when `c_canvas_sizes` is empty, instead of running from the schema layout path on every startup.
+- The schema bootstrap file is now limited to table layout definitions, with one-time seed data handled by the bootstrap layer.
+
 ## 2.2.2 - 2026-08-01
 
 ### Fixed

Dockerfile

@@ -1,16 +0,0 @@
-FROM node:24-alpine
-
-WORKDIR /app
-
-RUN apk add --no-cache ffmpeg chromium nss freetype harfbuzz ttf-freefont
-
-COPY package*.json ./
-RUN npm install --omit=dev --no-audit --no-fund
-
-COPY src ./src
-
-RUN mkdir -p /app/media
-
-EXPOSE 3000
-
-CMD ["npm", "run", "start:web"]

README.md

@@ -1,104 +1,41 @@
 # Pulse Signage
 
-Pulse Signage is a digital signage system that lets you manage screens, playlists, slides, templates, and uploaded media from one admin interface.
+[![Publish Docker Image](https://git.lzstealth.com/lzstealth/pulse-signage/actions/workflows/docker-publish.yml/badge.svg?branch=main)](https://git.lzstealth.com/lzstealth/pulse-signage/actions?workflow=docker-publish.yml)
 
-It runs as two connected services:
+Pulse Signage is a self-hosted digital signage platform for teams that want clear, reliable control over the content on every screen.
 
-- the web admin app for managing content and screens
+It gives you one place to publish playlists, slides, announcements, and live updates without handing the workflow to a third-party service.
-- the player app that shows the current signage on each screen and listens for live updates
 
-## What You Can Do
+## What It Can Do
 
-- Sign in to the admin dashboard
+- Run polished screen experiences with playlists, slides, and reusable templates.
-- Create and organize playlists and slides
+- Keep announcements, schedules, RSS feeds, API content, and other live data in sync.
-- Design reusable templates and canvas sizes
+- Manage many screens from a single dashboard.
-- Register screens and assign playlists to them
+- Support everyday signage, event messages, lobbies, dashboards, and other always-on displays.
-- Manage roles and permissions for the admin web UI
+- Keep the player, dashboard, and bridge connected so updates move quickly and consistently.
-- Upload images and other media for use in slides and templates
-- View live screen connections and send player commands
 
-Admin permissions are split into CRUD actions per section, so you can grant read-only, editor, creator, or delete access separately.
+## Why It Fits
 
-## What You Need
+- It keeps signage under your own control.
+- It is built for teams that need screens to stay current without extra manual work.
+- It works well for offices, venues, campuses, and operations teams.
+- It stays focused on display management instead of trying to be a general-purpose CMS.
 
-- Docker and Docker Compose
+## Deploying
-- A MySQL database
 
-## First-Time Setup
+Docker Compose is the recommended way to deploy Pulse Signage. It keeps the web app, player, bridge, and database together in a predictable setup.
 
-When the app starts for the first time, it creates the database tables it needs and adds a default admin account if no users exist yet.
+If you want the details, start with the [Compose guide](docker-compose/README.md).
 
-- Username: `admin`
+## Docs
-- Password: `admin`
 
-The first admin account is placed into the built-in `Administrators` role, which has full web-admin access through the CRUD permissions.
+- [Documentation home](docs/README.md) - the technical reference index.
+- [API reference](docs/api.md) - the player HTTP surface and onboarding endpoints.
+- [Database schema](docs/schema.md) - the tables and data model the app maintains.
+- [WebSocket reference](docs/websocket.md) - the live player and snapshot channels.
+- [Compose guide](docker-compose/README.md) - deployment options and service layout.
+- [Changelog](CHANGELOG.md) - release history and notable changes.
 
-You can change the initial admin credentials with these optional environment variables:
+## Explore The Docs
 
-- `DEFAULT_ADMIN_USERNAME`
+The project includes a dashboard for managing content, a player runtime for rendering screens, an onboarding flow for connecting devices, and a bridge layer for remote screens. If you want to understand how the pieces fit together, the docs above cover the technical details without repeating the project overview.
-- `DEFAULT_ADMIN_NAME`
-- `DEFAULT_ADMIN_PASSWORD`
-
-## Configuration
-
-The app reads its settings from environment variables. The list below matches the provided `.env.example` file.
-
-### Compose and Shared Settings
-
-- `PULSE_SIGNAGE_IMAGE` - image tag used by the published Compose setup, default `git.lzstealth.com/lzstealth/pulse-signage:latest`
-- `PULSE_SIGNAGE_SHARED_SECRET` - shared secret used to sign player page API fetches and server-to-player requests; page tokens auto-renew while the page stays active and request signatures must be fresh; leave unset to keep the auth checks disabled for compatibility
-
-### Database Connection
-
-- `DB_HOST` - MySQL host, default `mysql`
-- `DB_PORT` - MySQL port, default `3306`
-- `DB_NAME` - database name, default `pulse-signage`
-- `DB_USER` - database user, default `pulse-signage`
-- `DB_PASSWORD` - database password, default `signage_password`
-- `MYSQL_ROOT_PASSWORD` - root password for the bundled MySQL container, default `root_password`
-
-### Player App
-
-- `PLAYER_INTERNAL_BASE_URL` - internal player URL used by the web app, default `http://player:8081`
-- `PLAYER_PUBLIC_BASE_URL` - public player URL used by browser-facing links, default `http://localhost:8081`
-
-### Web App
-
-- `SESSION_MAX_AGE_DAYS` - admin session lifetime in days, default `14`
-- `DEFAULT_ADMIN_USERNAME` - username used for the initial admin account, default `admin`
-- `DEFAULT_ADMIN_NAME` - display name used for the initial admin account, default `Admin`
-- `DEFAULT_ADMIN_PASSWORD` - password used for the initial admin account, default `admin`
-- `PASSWORD_HASH_ITERATIONS` - password hash iteration count, default `310000`
-
-## Docker Compose
-
-The repository includes a `docker-compose.yml` file that starts three services:
-
-- `web` - the admin app exposed on container port `8080`
-- `player` - the signage player exposed on container port `8081`
-- `mysql` - the database on port `3306`
-
-Change the published host ports in Docker Compose if you want different external ports; the app containers listen on `8080` and `8081` internally.
-
-By default, `web` and `player` use the published image from `git.lzstealth.com/lzstealth/pulse-signage:latest`. You can point both services at a specific release by setting `PULSE_SIGNAGE_IMAGE` to a tagged image such as `git.lzstealth.com/lzstealth/pulse-signage:v1.0.0`.
-
-The Compose file also defines a shared `media` volume for stored assets and a `mysql_data` volume for database persistence.
-
-In Docker, media storage is controlled by the `media` volume mount at `/app/media`.
-Outside Docker, the web app and player do not have to use the same upload location or even the same server, as long as each service can access its own configured media path.
-
-## Important Notes
-
-- The web app must be able to reach the player through `PLAYER_INTERNAL_BASE_URL`.
-- When running in Docker, that value should point to the Docker service name, not `localhost`.
-- If `PULSE_SIGNAGE_SHARED_SECRET` is set, the web and player containers must use the same value, and any reverse proxy in front of the player must forward `/api/media/...` without rewriting the path.
-- Uploaded media is stored separately from the application source, so make sure it is backed up if you are not using Docker volumes.
-- The player page uses the browser Screen Wake Lock API when available, but kiosk mode and OS sleep settings still matter because the browser can deny or release the wake lock.
-
-## Documentation
-
-Player-facing API details live in [docs/api.md](docs/api.md). It covers the player HTTP endpoints for screen playback, playlist data, connections, and commands.
-
-Database schema details live in [docs/schema.md](docs/schema.md). It summarizes the current tables created at startup.
-
-Player websocket behavior lives in [docs/websocket.md](docs/websocket.md). It covers the player control socket, snapshot stream, and the command/message shapes the player accepts.

build/Dockerfile

@@ -0,0 +1,18 @@
+FROM node:26-alpine
+
+WORKDIR /app
+
+RUN apk add --no-cache chromium nss freetype harfbuzz ttf-freefont
+
+COPY build/package.web.json ./package.json
+RUN npm install --omit=dev --no-audit --no-fund
+COPY package-lock.json ./package-lock.json
+
+COPY src ./src
+COPY scripts ./scripts
+
+RUN mkdir -p /app/media
+
+EXPOSE 3000
+
+CMD ["npm", "run", "start:web"]

build/Dockerfile.player

@@ -0,0 +1,18 @@
+FROM node:26-alpine
+
+WORKDIR /app
+
+RUN apk add --no-cache ffmpeg
+
+COPY build/package.player.json ./package.json
+RUN npm install --omit=dev --no-audit --no-fund
+COPY package-lock.json ./package-lock.json
+
+COPY src ./src
+COPY scripts ./scripts
+
+RUN mkdir -p /app/media
+
+EXPOSE 3000
+
+CMD ["npm", "run", "start:player"]

build/package.player.json

@@ -0,0 +1,22 @@
+{
+  "name": "pulse-signage-player",
+  "version": "2.10.2",
+  "private": false,
+  "description": "Pulse Signage player application bundle",
+  "engines": {
+    "node": ">=26.0.0"
+  },
+  "main": "src/common.js",
+  "scripts": {
+    "start": "node -r dotenv/config src/player.js",
+    "start:player": "node -r dotenv/config src/player.js"
+  },
+  "dependencies": {
+    "dotenv": "^17.4.2",
+    "express": "^5.2.1",
+    "handlebars": "^4.7.8",
+    "hls.js": "^1.7.0",
+    "mysql2": "^3.23.3",
+    "ws": "^8.21.3"
+  }
+}

build/package.web.json

@@ -0,0 +1,26 @@
+{
+  "name": "pulse-signage-web",
+  "version": "2.10.2",
+  "private": false,
+  "description": "Pulse Signage web and bridge application bundle",
+  "engines": {
+    "node": ">=26.0.0"
+  },
+  "main": "src/common.js",
+  "scripts": {
+    "start": "node -r dotenv/config src/web.js",
+    "start:web": "node -r dotenv/config src/web.js"
+  },
+  "dependencies": {
+    "@sparticuz/chromium": "^149.0.0",
+    "dotenv": "^17.4.2",
+    "express": "^5.2.1",
+    "handlebars": "^4.7.8",
+    "multer": "^2.2.0",
+    "mysql2": "^3.23.3",
+    "puppeteer-core": "^25.7.0",
+    "sharp": "^0.35.3",
+    "jsqr": "^1.4.0",
+    "ws": "^8.21.3"
+  }
+}

docker-compose.yml

@@ -1,82 +0,0 @@
-services:
-  web:
-    image: ${PULSE_SIGNAGE_IMAGE:-git.lzstealth.com/lzstealth/pulse-signage:latest}
-    container_name: signage-web
-    restart: unless-stopped
-    ports:
-      - "8080:8080"
-    environment:
-      DB_HOST: ${DB_HOST:-mysql}
-      DB_PORT: ${DB_PORT:-3306}
-      DB_NAME: ${DB_NAME:-signage}
-      DB_USER: ${DB_USER:-signage_user}
-      DB_PASSWORD: ${DB_PASSWORD:-signage_password}
-      PULSE_SIGNAGE_SHARED_SECRET: ${PULSE_SIGNAGE_SHARED_SECRET:-}
-      SESSION_MAX_AGE_DAYS: ${SESSION_MAX_AGE_DAYS:-14}
-      DASHBOARD_REFRESH_INTERVAL_MS: ${DASHBOARD_REFRESH_INTERVAL_MS:-2000}
-      DEFAULT_ADMIN_USERNAME: ${DEFAULT_ADMIN_USERNAME:-admin}
-      DEFAULT_ADMIN_NAME: ${DEFAULT_ADMIN_NAME:-Admin}
-      DEFAULT_ADMIN_PASSWORD: ${DEFAULT_ADMIN_PASSWORD:-admin}
-      PASSWORD_HASH_ITERATIONS: ${PASSWORD_HASH_ITERATIONS:-310000}
-    volumes:
-      - media:/app/media
-    command: ["node", "src/web.js"]
-    depends_on:
-      mysql:
-        condition: service_healthy
-    networks:
-      - pulse_signage
-
-  player:
-    image: ${PULSE_SIGNAGE_IMAGE:-git.lzstealth.com/lzstealth/pulse-signage:latest}
-    container_name: signage-player
-    restart: unless-stopped
-    ports:
-      - "8081:8081"
-    environment:
-      PLAYER_PUBLIC_BASE_URL: ${PLAYER_PUBLIC_BASE_URL:-http://localhost:8081}
-      PULSE_SIGNAGE_SHARED_SECRET: ${PULSE_SIGNAGE_SHARED_SECRET:-}
-      DB_HOST: ${DB_HOST:-mysql}
-      DB_PORT: ${DB_PORT:-3306}
-      DB_NAME: ${DB_NAME:-signage}
-      DB_USER: ${DB_USER:-signage_user}
-      DB_PASSWORD: ${DB_PASSWORD:-signage_password}
-    volumes:
-      - media:/app/media
-    command: ["node", "src/player.js"]
-    depends_on:
-      mysql:
-        condition: service_healthy
-    networks:
-      - pulse_signage
-
-  mysql:
-    image: mysql:8.4
-    container_name: signage-mysql
-    restart: unless-stopped
-    environment:
-      MYSQL_DATABASE: ${DB_NAME:-signage}
-      MYSQL_USER: ${DB_USER:-signage_user}
-      MYSQL_PASSWORD: ${DB_PASSWORD:-signage_password}
-      MYSQL_ROOT_PASSWORD: ${MYSQL_ROOT_PASSWORD:-root_password}
-    command:
-      - --character-set-server=utf8mb4
-      - --collation-server=utf8mb4_unicode_ci
-    volumes:
-      - mysql_data:/var/lib/mysql
-    healthcheck:
-      test: ["CMD-SHELL", "mysqladmin ping -h localhost -uroot -p$$MYSQL_ROOT_PASSWORD"]
-      interval: 10s
-      timeout: 5s
-      retries: 10
-    networks:
-      - pulse_signage
-
-volumes:
-  mysql_data:
-  media:
-
-networks:
-  pulse_signage:
-    name: pulse_signage
-    external: false

docker-compose/.env.example

@@ -0,0 +1,27 @@
+# Shared application settings
+PULSE_SIGNAGE_WEB_IMAGE="git.lzstealth.com/lzstealth/pulse-signage-web:latest"
+PULSE_SIGNAGE_PLAYER_IMAGE="git.lzstealth.com/lzstealth/pulse-signage-player:latest"
+PULSE_SIGNAGE_SHARED_SECRET=""
+
+# Database settings for the web, player, and bridge services
+DB_HOST="mysql"
+DB_PORT=3306
+DB_NAME="pulse-signage"
+DB_USER="pulse-signage"
+DB_PASSWORD="signage_password"
+MYSQL_ROOT_PASSWORD="root_password"
+
+# Player settings
+PLAYER_IDENTIFIER="player-local"
+PLAYER_PUBLIC_URL="http://localhost:8081"
+PLAYER_INTERNAL_URL="http://player:8081"
+WEB_PUBLIC_URL="http://localhost:8080"
+
+# Web app bootstrap settings
+DEFAULT_ADMIN_USERNAME="admin"
+DEFAULT_ADMIN_NAME="Admin"
+DEFAULT_ADMIN_PASSWORD="password123!"
+
+# Bridge settings for the player-bridge service
+WEB_INTERNAL_URL="http://web:8080"
+BRIDGE_INTERNAL_URL="http://player-bridge:8090"

docker-compose/.env.remote.example

@@ -0,0 +1,11 @@
+# Shared application settings
+PULSE_SIGNAGE_PLAYER_IMAGE="git.lzstealth.com/lzstealth/pulse-signage-player:latest"
+PULSE_SIGNAGE_SHARED_SECRET=""
+
+# Player settings
+PLAYER_IDENTIFIER="player-remote"
+PLAYER_PUBLIC_URL="http://localhost:8081"
+PLAYER_AGENT_RECONNECT_DELAY_MS=5000
+
+# Remote player connectivity settings
+BRIDGE_PUBLIC_URL="http://player-bridge.example.com:8090"

docker-compose/README.md

@@ -0,0 +1,228 @@
+# Docker Compose Setup
+
+This folder contains the Docker Compose definitions for Pulse Signage, including the public stack and the remote player stack.
+
+## Files
+
+- [docker-compose.yml](docker-compose.yml) - full public stack with web, player, player bridge, and MySQL.
+- [.env.example](.env.example) - sample environment values for the public stack.
+- [docker-compose.remote.yml](docker-compose.remote.yml) - remote player-only stack for machines that sit behind the player bridge.
+- [.env.remote.example](.env.remote.example) - sample environment values for the remote stack.
+
+## Stack Overview
+
+### Public stack
+
+The main compose stack is the most complete setup. It runs:
+
+- `web` - the dashboard and admin app.
+- `player` - the local screen player.
+- `player-bridge` - the bridge service that proxies dashboard commands and player communication.
+- `mysql` - the database used by the web, player, and bridge services.
+
+This is the stack to use when you want the full app running on one machine.
+
+### Remote player
+
+The remote stack runs only the `player` service.
+
+Use it when the player is installed on a remote device and connects back through the player bridge instead of running the full app separately.
+
+## Services
+
+### `web`
+
+The dashboard and admin application.
+
+Responsibilities:
+
+- serves the web UI on port `8080`
+- reads and writes application data from MySQL
+- forwards player actions through the configured bridge base URL
+- renders connected clients, dashboard pages, and admin workflows
+
+Key configuration:
+
+- `DB_HOST`, `DB_PORT`, `DB_NAME`, `DB_USER`, `DB_PASSWORD`
+- `PULSE_SIGNAGE_SHARED_SECRET`
+- `DEFAULT_ADMIN_USERNAME`
+- `DEFAULT_ADMIN_NAME`
+- `DEFAULT_ADMIN_PASSWORD`
+- `PASSWORD_HASH_ITERATIONS`
+
+### `player`
+
+The screen runtime that renders playlists and receives commands.
+
+Responsibilities:
+
+- serves the player UI on port `8081`
+- connects to MySQL in local mode
+- connects to the bridge in remote mode through `BRIDGE_PUBLIC_URL`
+- registers live connections and accepts control commands
+
+Key configuration:
+
+- `PLAYER_PUBLIC_URL`
+- `PLAYER_INTERNAL_URL`
+- `BRIDGE_INTERNAL_URL`
+- `PLAYER_IDENTIFIER`
+- `BRIDGE_PUBLIC_URL` in remote mode
+- `PULSE_SIGNAGE_SHARED_SECRET`
+- database settings in local mode
+
+### `player-bridge`
+
+The bridge layer that connects the dashboard to the player network.
+
+Responsibilities:
+
+- serves the bridge API on port `8090`
+- forwards authenticated dashboard commands to registered players
+- exposes screen connection snapshots and player registration data
+- proxies command traffic between the web app and remote players
+
+Key configuration:
+
+- `PULSE_SIGNAGE_SHARED_SECRET`
+- `WEB_INTERNAL_URL` for the bridge when it should call the web app directly instead of inferring from request headers
+- `DB_HOST`, `DB_PORT`, `DB_NAME`, `DB_USER`, `DB_PASSWORD`
+
+### `mysql`
+
+The MySQL 8.4 database used by the public stack.
+
+Responsibilities:
+
+- stores application data, screen state, onboarding state, and registry records
+- provides persistent storage through `mysql_data`
+
+Key configuration:
+
+- `MYSQL_DATABASE`
+- `MYSQL_USER`
+- `MYSQL_PASSWORD`
+- `MYSQL_ROOT_PASSWORD`
+
+## Environment Files
+
+### `.env.example`
+
+Use this file as a starting point for the public compose stack.
+
+Important values:
+
+- `PULSE_SIGNAGE_WEB_IMAGE` - image to run for the web app and bridge services, typically `.../pulse-signage-web:latest`
+- `PULSE_SIGNAGE_PLAYER_IMAGE` - image to run for the player services, typically `.../pulse-signage-player:latest`
+- `PULSE_SIGNAGE_SHARED_SECRET` - long random secret shared by the web, player, and bridge services for authenticated requests
+- `PLAYER_IDENTIFIER` - unique local player identifier
+- `DB_*` - MySQL credentials and database name for the stack
+- `PLAYER_PUBLIC_URL` - public URL the player advertises
+- `PLAYER_INTERNAL_URL` - internal URL the web app uses for local player calls
+- `BRIDGE_INTERNAL_URL` - bridge URL the web app uses for player snapshot and command forwarding
+- `WEB_INTERNAL_URL` - internal URL the bridge uses to call the web app directly
+- `DEFAULT_ADMIN_*` - bootstrap admin account values
+- `PASSWORD_HASH_ITERATIONS` - password hashing cost
+- `MYSQL_ROOT_PASSWORD` - root password for the local MySQL container
+
+### `.env.remote.example`
+
+Use this file on a remote player device.
+
+Important values:
+
+- `PULSE_SIGNAGE_PLAYER_IMAGE` - image to run on the device, typically `.../pulse-signage-player:latest`
+- `PULSE_SIGNAGE_SHARED_SECRET` - must match the public stack and should be the same long random value used everywhere in the deployment
+- `PLAYER_IDENTIFIER` - unique remote player identifier
+- `PLAYER_PUBLIC_URL` - public URL for the remote player
+- `BRIDGE_PUBLIC_URL` - bridge URL the player connects back to
+- `PLAYER_AGENT_RECONNECT_DELAY_MS` - reconnect delay for the player agent
+
+### `PULSE_SIGNAGE_SHARED_SECRET`
+
+This secret is the shared signing key for requests between the services. Use a single value for every service that needs to talk to the same stack, including the web app, player, bridge, and any remote player that connects back to that bridge.
+
+Recommended shape:
+
+- at least 32 random bytes
+- ideally 64 hex characters, or another equally long cryptographically random string
+- not a password, phrase, or anything human-readable
+
+If you want a quick local value, generate one with a password manager or a command such as `openssl rand -hex 32`.
+
+Leave it blank only if you intentionally want to run without request signing in a throwaway local setup.
+
+## Main Configuration Variables
+
+| Variable | Used By | Purpose |
+| --- | --- | --- |
+| `PULSE_SIGNAGE_WEB_IMAGE` | web, bridge | Docker image to run for the web app and bridge services. |
+| `PULSE_SIGNAGE_PLAYER_IMAGE` | player, remote player | Docker image to run for the player services. |
+| `PULSE_SIGNAGE_SHARED_SECRET` | web, player, bridge, remote player | Shared secret for authenticated requests between services. |
+| `DB_HOST` | web, player, bridge | Database host name. |
+| `DB_PORT` | web, player, bridge | Database port. |
+| `DB_NAME` | web, player, bridge, mysql | Database name. |
+| `DB_USER` | web, player, bridge, mysql | Database user. |
+| `DB_PASSWORD` | web, player, bridge, mysql | Database password. |
+| `MYSQL_ROOT_PASSWORD` | mysql | Root password for the local MySQL container. |
+| `DEFAULT_ADMIN_USERNAME` | web | Bootstrap admin username. |
+| `DEFAULT_ADMIN_NAME` | web | Bootstrap admin display name. |
+| `DEFAULT_ADMIN_PASSWORD` | web | Bootstrap admin password. |
+| `PASSWORD_HASH_ITERATIONS` | web | Password hashing cost. |
+| `PLAYER_INTERNAL_URL` | web, player | Internal player URL used by the dashboard and player runtime. |
+| `BRIDGE_INTERNAL_URL` | web | Bridge URL used by the web app for player snapshot and command forwarding. |
+| `WEB_INTERNAL_URL` | player-bridge | Internal web URL used by the bridge to call the dashboard app directly. |
+| `PLAYER_PUBLIC_URL` | player, remote player | Public URL advertised by the player. |
+| `BRIDGE_PUBLIC_URL` | player, remote player | URL of the bridge service. |
+| `PLAYER_IDENTIFIER` | player | Stable player identifier. |
+| `PLAYER_AGENT_RECONNECT_DELAY_MS` | remote player | Delay before reconnecting to the bridge. |
+| `MYSQL_DATABASE` | mysql | Database name used by the local MySQL container. |
+| `MYSQL_USER` | mysql | Database user used by the local MySQL container. |
+| `MYSQL_PASSWORD` | mysql | Database password used by the local MySQL container. |
+
+## Ports
+
+Public stack ports:
+
+- `8080` - web dashboard
+- `8081` - player
+- `8090` - player bridge
+- `3306` - MySQL
+
+Remote stack ports:
+
+- `8081` - player only
+
+## Volumes
+
+### Public stack
+
+- `mysql_data` - persistent MySQL data.
+- `pulse-signage` - shared media and cache volume for the app services.
+
+### Remote stack
+
+- `pulse-signage` - shared media and cache volume for the remote player.
+
+## Networks
+
+Each compose file creates its own named network:
+
+- `pulse-signage` for the public stack
+- `pulse-signage-remote` for remote player deployment.
+
+## Notes
+
+- The public stack expects the app services and MySQL to share the same `PULSE_SIGNAGE_SHARED_SECRET`.
+- A remote player must use the same `PULSE_SIGNAGE_SHARED_SECRET` as the bridge it connects to.
+- The bridge service is the dashboard-facing command path for connected remote players.
+- The remote player should point `BRIDGE_PUBLIC_URL` at the bridge, not at the public web endpoint.
+- The `PULSE_SIGNAGE_WEB_IMAGE` and `PULSE_SIGNAGE_PLAYER_IMAGE` tags default to the published `pulse-signage-web` and `pulse-signage-player` repositories with `latest` and `v1.2.3` style tags, but they can be overridden for local builds or custom releases.
+
+## Recommended Setup
+
+1. Copy `.env.example` to a local `.env` file for the public stack.
+2. Copy `.env.remote.example` to a device-specific `.env` file for the remote player.
+3. Make sure `PULSE_SIGNAGE_SHARED_SECRET` matches everywhere.
+4. Start the public stack first, then start the remote player after the bridge is reachable.
+5. Verify that the player appears in Connected clients before testing screen commands.

docker-compose/docker-compose.remote.yml

@@ -0,0 +1,28 @@
+name: pulse-signage-remote
+
+services:
+
+  player:
+    image: ${PULSE_SIGNAGE_PLAYER_IMAGE:-git.lzstealth.com/lzstealth/pulse-signage-player:latest}
+    restart: unless-stopped
+    networks:
+      - pulse_signage
+    ports:
+      - "8081:8081"
+    environment:
+      PLAYER_IDENTIFIER: ${PLAYER_IDENTIFIER:-player-remote}
+      PLAYER_PUBLIC_URL: ${PLAYER_PUBLIC_URL:-http://localhost:8081}
+      BRIDGE_PUBLIC_URL: ${BRIDGE_PUBLIC_URL:-}
+      PULSE_SIGNAGE_SHARED_SECRET: ${PULSE_SIGNAGE_SHARED_SECRET:-}
+      PLAYER_AGENT_RECONNECT_DELAY_MS: ${PLAYER_AGENT_RECONNECT_DELAY_MS:-5000}
+    volumes:
+      - pulse-signage:/app/media
+    command: ["node", "src/player.js"]
+
+volumes:
+  pulse-signage:
+
+networks:
+  pulse_signage:
+    name: pulse-signage-remote
+    external: false

docker-compose/docker-compose.yml

@@ -0,0 +1,106 @@
+name: pulse-signage
+
+services:
+  web:
+    image: ${PULSE_SIGNAGE_WEB_IMAGE:-git.lzstealth.com/lzstealth/pulse-signage-web:latest}
+    restart: unless-stopped
+    networks:
+      - pulse_signage
+    ports:
+      - "8080:8080"
+    environment:
+      DB_HOST: ${DB_HOST:-mysql}
+      DB_PORT: ${DB_PORT:-3306}
+      DB_NAME: ${DB_NAME:-pulse-signage}
+      DB_USER: ${DB_USER:-pulse-signage}
+      DB_PASSWORD: ${DB_PASSWORD:-signage_password}
+      PULSE_SIGNAGE_SHARED_SECRET: ${PULSE_SIGNAGE_SHARED_SECRET:-}
+      WEB_PUBLIC_URL: ${WEB_PUBLIC_URL:-http://localhost:8080}
+      BRIDGE_INTERNAL_URL: ${BRIDGE_INTERNAL_URL:-http://player-bridge:8090}
+      DEFAULT_ADMIN_USERNAME: ${DEFAULT_ADMIN_USERNAME:-admin}
+      DEFAULT_ADMIN_NAME: ${DEFAULT_ADMIN_NAME:-Admin}
+      DEFAULT_ADMIN_PASSWORD: ${DEFAULT_ADMIN_PASSWORD:-password123}
+    volumes:
+      - pulse-signage:/app/media
+    command: ["node", "src/web.js"]
+    depends_on:
+      mysql:
+        condition: service_healthy
+
+  player:
+    image: ${PULSE_SIGNAGE_PLAYER_IMAGE:-git.lzstealth.com/lzstealth/pulse-signage-player:latest}
+    restart: unless-stopped
+    networks:
+      - pulse_signage
+    ports:
+      - "8081:8081"
+    environment:
+      PLAYER_PUBLIC_URL: ${PLAYER_PUBLIC_URL:-http://localhost:8081}
+      PLAYER_INTERNAL_URL: ${PLAYER_INTERNAL_URL:-http://player:8081}
+      PLAYER_IDENTIFIER: ${PLAYER_IDENTIFIER:-player-local}
+      PULSE_SIGNAGE_SHARED_SECRET: ${PULSE_SIGNAGE_SHARED_SECRET:-}
+      WEB_PUBLIC_URL: ${WEB_PUBLIC_URL:-http://localhost:8080}
+      DB_HOST: ${DB_HOST:-mysql}
+      DB_PORT: ${DB_PORT:-3306}
+      DB_NAME: ${DB_NAME:-pulse-signage}
+      DB_USER: ${DB_USER:-pulse-signage}
+      DB_PASSWORD: ${DB_PASSWORD:-signage_password}
+    volumes:
+      - pulse-signage:/app/media
+    command: ["node", "src/player.js"]
+    depends_on:
+      mysql:
+        condition: service_healthy
+
+  player-bridge:
+    image: ${PULSE_SIGNAGE_WEB_IMAGE:-git.lzstealth.com/lzstealth/pulse-signage-web:latest}
+    restart: unless-stopped
+    networks:
+      - pulse_signage
+    ports:
+      - "8090:8090"
+    environment:
+      WEB_INTERNAL_URL: ${WEB_INTERNAL_URL:-http://web:8080}
+      WEB_PUBLIC_URL: ${WEB_PUBLIC_URL:-http://localhost:8080}
+      PULSE_SIGNAGE_SHARED_SECRET: ${PULSE_SIGNAGE_SHARED_SECRET:-}
+      DB_HOST: ${DB_HOST:-mysql}
+      DB_PORT: ${DB_PORT:-3306}
+      DB_NAME: ${DB_NAME:-pulse-signage}
+      DB_USER: ${DB_USER:-pulse-signage}
+      DB_PASSWORD: ${DB_PASSWORD:-signage_password}
+    command: ["node", "src/player-bridge/index.js"]
+    depends_on:
+      mysql:
+        condition: service_healthy
+
+  mysql:
+    image: mysql:8.4
+    restart: unless-stopped
+    ports:
+      - "3306:3306"
+    environment:
+      MYSQL_DATABASE: ${DB_NAME:-pulse-signage}
+      MYSQL_USER: ${DB_USER:-pulse-signage}
+      MYSQL_PASSWORD: ${DB_PASSWORD:-signage_password}
+      MYSQL_ROOT_PASSWORD: ${MYSQL_ROOT_PASSWORD:-root_password}
+    command:
+      - --character-set-server=utf8mb4
+      - --collation-server=utf8mb4_unicode_ci
+    volumes:
+      - mysql_data:/var/lib/mysql
+    healthcheck:
+      test: ["CMD-SHELL", "mysqladmin ping -h localhost -uroot -p$$MYSQL_ROOT_PASSWORD"]
+      interval: 10s
+      timeout: 5s
+      retries: 10
+    networks:
+      - pulse_signage
+
+volumes:
+  mysql_data:
+  pulse-signage:
+
+networks:
+  pulse_signage:
+    name: pulse-signage
+    external: false

docs/README.md

@@ -0,0 +1,13 @@
+# Documentation
+
+This folder contains the technical reference material for Pulse Signage.
+
+## What’s Here
+
+- [API reference](api.md) - the player HTTP surface and onboarding endpoints.
+- [Database schema](schema.md) - the tables and data model used by the app.
+- [WebSocket reference](websocket.md) - the live player and snapshot channels.
+
+## How To Read It
+
+If you want the big picture first, start with the main [project README](../README.md). It gives a plain overview of what Pulse Signage does, while the pages in this folder explain how the pieces work.

docs/api.md

@@ -6,7 +6,7 @@ Player service base URL: `http://localhost:8081`
 
 This document covers the player HTTP surface only. The admin dashboard exposes its own routes for screen commands and onboarding management.
 
-Access note: most player endpoints are unauthenticated because they are meant to run inside a trusted deployment network. Anything that mutates state or writes files should be treated as internal-only unless you add your own auth layer in front of it.
+Access note: most player endpoints are unauthenticated because they are meant to run inside a trusted deployment network. Anything that mutates state or writes files should be treated as internal-only unless you add your own auth layer in front of it. Pairing uses a short-lived random PIN displayed by the kiosk; the PIN is accepted only through the authenticated Web UI pairing flow.
 
 When `PULSE_SIGNAGE_SHARED_SECRET` is set, the player pages sign same-origin API fetches with `x-pulse-page-auth`, and the web app signs server-to-player requests with `x-pulse-request-timestamp` plus `x-pulse-request-signature`. Page tokens auto-renew before expiry while the page stays active, and signed server requests are only accepted when their timestamp is fresh. If the secret is unset, those checks stay disabled for compatibility.
 
@@ -17,12 +17,12 @@ Returns the player onboarding landing page.
 Access: public within the trusted player deployment.
 
 ### `GET /onboard`
-Returns the onboarding form page.
+Redirects to the authenticated Web UI pairing page for compatibility with older QR codes.
-Access: public within the trusted player deployment.
+Access: the Web UI pairing page requires a logged-in Web UI session.
 
 ### `GET /screen/{slug}`
 Returns the rendered player page for a screen.
-Access: public within the trusted player deployment.
+Access: the configured player may load only its persisted paired screen. An unpaired player is redirected to `/`; a different screen slug is rejected. The route is public within the trusted player deployment, but it no longer changes the player's binding.
 
 ### `GET /api/onboarding/status`
 Returns the persisted onboarding status for a device.
@@ -56,7 +56,7 @@ Response fields:
 
 ### `POST /api/onboarding`
 Binds a device to a screen and client name.
-Access: internal-only. Protect this endpoint if the player service is reachable outside your trusted network.
+Access: internal-only. Browser submissions must go through the authenticated Web UI pairing page. The Web UI resolves the short-lived kiosk PIN to a device ID before forwarding the signed request. Protect this endpoint if the player service is reachable outside your trusted network.
 
 Accepted request fields:
 
@@ -78,6 +78,11 @@ Response fields:
 Returns the upload directory configured for the player service.
 Access: internal-only.
 
+Response fields:
+
+- `mediaDir`
+- `uploadDir`
+
 ### `PUT /api/media/{filename}`
 Writes an uploaded file into the player upload directory.
 Access: internal-only and write-protected behind your deployment boundary.
@@ -95,6 +100,14 @@ Query fields:
 - `source` required
 - `disableAudio` optional
 
+Response fields:
+
+- `key`
+- `playlistUrl`
+- `disableAudio`
+- `ready`
+- `live`
+
 ### `GET /api/rtmp/streams/{key}/index.m3u8`
 Returns the RTMP session HLS manifest.
 Access: internal-only.
@@ -114,6 +127,7 @@ Response fields:
 - `slides`
 - `rssFeeds`
 - `apiSources`
+- `timetableGroups`
 - `revision`
 
 ### `GET /api/screens/{slug}/connections`
@@ -198,6 +212,7 @@ Response fields:
 
 `GET /api/media/config` returns an object with:
 
+- `mediaDir`
 - `uploadDir`
 
 ### RTMP Session Response
@@ -208,6 +223,7 @@ Response fields:
 - `playlistUrl`
 - `disableAudio`
 - `ready`
+- `live`
 
 ### Onboarding Write Response
 
@@ -230,6 +246,7 @@ Response fields:
 - `slides`
 - `rssFeeds`
 - `apiSources`
+- `timetableGroups`
 - `revision`
 
 ### Connections Response
@@ -269,6 +286,8 @@ Response fields:
 - `id`
 - `name`
 - `fade_between_slides`
+- `skip_unavailable_rtmp`
+- `canvas_id`
 
 ### Slide
 
@@ -276,12 +295,9 @@ Response fields:
 - `title`
 - `body`
 - `duration_seconds`
-- `schedule_mode`
+- `use_video_duration`
-- `schedule_start_datetime`
+- `disable_audio`
-- `schedule_end_datetime`
+- `scheduleRules`
-- `schedule_start_time`
-- `schedule_end_time`
-- `schedule_days_json`
 - `media_url`
 - `media_type`
 - `kind`

docs/schema.md

@@ -3,7 +3,7 @@
 This app creates and maintains its schema at startup through `src/db/index.js`.
 The sections below summarize the current tables and their purpose.
 
-Primary keys are `id` unless noted otherwise. Timestamps are stored as `created_at` and `modified_at` when a table supports auditing.
+Tables generally use a numeric auto-increment `id` primary key. The relationship table `d_announcement_screens` intentionally uses the composite `(announcement_id, screen_id)` primary key instead. Natural and relationship keys remain as unique constraints where needed. Timestamps are stored as `created_at` and `modified_at` when a table supports auditing.
 
 ## Admin
 
@@ -16,12 +16,13 @@ Primary keys are `id` unless noted otherwise. Timestamps are stored as `created_
 
 ### `a_users`
 
-- `id`, `name`, `username`, `password_hash`, `password_salt`, `password_iterations`, `created_at`, `created_by`, `modified_at`, `modified_by`
+- `id`, `name`, `username`, `password_hash`, `password_salt`, `password_iterations`, `must_change_password`, `account_locked`, `created_at`, `created_by`, `modified_at`, `modified_by`
 - `username` is unique.
 
 ### `a_roles`
 
-- `id`, `name`, `description`, `created_at`, `created_by`, `modified_at`, `modified_by`
+- `id`, `role_key`, `name`, `description`, `created_at`, `created_by`, `modified_at`, `modified_by`
+- `role_key` is unique.
 - `name` is unique.
 
 ### `a_permissions`
@@ -31,35 +32,36 @@ Primary keys are `id` unless noted otherwise. Timestamps are stored as `created_
 
 ### `a_role_permissions`
 
-- `role_id`, `permission_id`, `created_at`, `modified_at`
+- `id`, `role_id`, `permission_id`, `created_at`, `modified_at`
 - Foreign keys:
         - `role_id` -> `a_roles.id`
         - `permission_id` -> `a_permissions.id`
-- Composite primary key: `(role_id, permission_id)`
+- Unique key: `(role_id, permission_id)`
 
 ### `a_user_roles`
 
-- `user_id`, `role_id`, `created_at`, `modified_at`
+- `id`, `user_id`, `role_id`, `created_at`, `modified_at`
 - Foreign keys:
         - `user_id` -> `a_users.id`
         - `role_id` -> `a_roles.id`
-- Composite primary key: `(user_id, role_id)`
+- Unique key: `(user_id, role_id)`
 
 ### `a_sessions`
 
-- `session_hash`, `user_id`, `expires_at`, `created_at`, `created_by`, `last_used_at`, `modified_by`
+- `id`, `session_hash`, `user_id`, `ip_address`, `user_agent`, `expires_at`, `created_at`, `created_by`, `last_used_at`, `modified_by`
-- `session_hash` is the primary key.
+- `session_hash` is unique.
 - Foreign key:
         - `user_id` -> `a_users.id`
 
 ## Content
 
 - `c_canvas_sizes` - reusable canvas presets for templates.
-- `c_playlists` - playlist definitions and playback options.
+- `c_playlists` - playlist definitions, playback options, and canvas assignment.
 - `c_templates` - slide templates with canvas and background settings.
 - `c_template_regions` - template region layout and metadata.
 - `c_slides` - slide records with template binding, JSON content, and thumbnail path.
-- `c_playlist_slides` - ordered playlist items, timing, and schedule rules.
+- `c_playlist_slides` - ordered playlist items and timing.
+- `c_playlist_slide_schedule_rules` - rule rows attached to playlist slides.
 
 ### `c_canvas_sizes`
 
@@ -68,7 +70,9 @@ Primary keys are `id` unless noted otherwise. Timestamps are stored as `created_
 
 ### `c_playlists`
 
-- `id`, `name`, `fade_between_slides`, `skip_unavailable_rtmp`, `created_at`, `created_by`, `modified_at`, `modified_by`
+- `id`, `name`, `fade_between_slides`, `skip_unavailable_rtmp`, `canvas_id`, `created_at`, `created_by`, `modified_at`, `modified_by`
+- Foreign key:
+        - `canvas_id` -> `c_canvas_sizes.id` with `ON DELETE SET NULL`
 
 ### `c_templates`
 
@@ -78,7 +82,7 @@ Primary keys are `id` unless noted otherwise. Timestamps are stored as `created_
 
 ### `c_template_regions`
 
-- `id`, `template_id`, `region_key`, `region_type`, `label`, `lock_ratio`, `x`, `y`, `width`, `height`, `z_index`, `created_at`, `created_by`, `modified_at`, `modified_by`
+- `id`, `template_id`, `region_key`, `region_type`, `label`, `font_family`, `lock_ratio`, `animation_json`, `x`, `y`, `width`, `height`, `z_index`, `created_at`, `created_by`, `modified_at`, `modified_by`
 - Foreign key:
         - `template_id` -> `c_templates.id` with `ON DELETE CASCADE`
 
@@ -90,44 +94,59 @@ Primary keys are `id` unless noted otherwise. Timestamps are stored as `created_
 
 ### `c_playlist_slides`
 
-- `id`, `playlist_id`, `slide_id`, `position`, `duration_seconds`, `use_video_duration`, `schedule_mode`, `schedule_start_datetime`, `schedule_end_datetime`, `schedule_start_time`, `schedule_end_time`, `schedule_days_json`, `created_at`, `created_by`, `modified_at`, `modified_by`
+- `id`, `playlist_id`, `slide_id`, `position`, `duration_seconds`, `use_video_duration`, `disable_audio`, `created_at`, `created_by`, `modified_at`, `modified_by`
 - Foreign keys:
         - `playlist_id` -> `c_playlists.id` with `ON DELETE CASCADE`
         - `slide_id` -> `c_slides.id` with `ON DELETE CASCADE`
 
+### `c_playlist_slide_schedule_rules`
+
+- `id`, `playlist_slide_id`, `position`, `start_datetime`, `end_datetime`, `start_time`, `end_time`, `schedule_days_json`, `created_at`, `created_by`, `modified_at`, `modified_by`
+- Foreign key:
+        - `playlist_slide_id` -> `c_playlist_slides.id` with `ON DELETE CASCADE`
+- Index:
+        - `(playlist_slide_id, position)`
+
+- Each playlist slide can have zero or more schedule rules.
+- Rules are evaluated with OR across rows and with AND across the fields inside a single rule.
+
 ## Devices
 
 - `d_players` - player registry and connection metadata.
-- `d_screens` - screen records and playlist/player assignment.
+- `d_screens` - screen records and playlist assignment.
 - `d_onboarding_devices` - device-to-screen bindings and onboarded client names.
 
+### `d_players`
+
+- `id`, `identifier`, `public_base_url`, `internal_base_url`, `last_seen_at`, `created_at`, `modified_at`
+- `id` is the primary key.
+- `identifier` is unique and is the stable player identity used by the app.
+        
+### `d_screens`
+
+- `id`, `name`, `slug`, `playlist_id`, `created_at`, `created_by`, `modified_at`, `modified_by`
+- `slug` is unique.
+- Foreign keys:
+        - `playlist_id` -> `c_playlists.id` with `ON DELETE SET NULL`
+
+- Screens are no longer tied to a player foreign key directly; player registration and live connection metadata are tracked separately in `d_players`.
+
+### `d_onboarding_devices`
+
+- `id`, `device_id`, `client_name`, `screen_id`, `created_at`, `created_by`, `modified_at`, `modified_by`
+- `device_id` is unique.
+- Foreign key:
+        - `screen_id` -> `d_screens.id` with `ON DELETE SET NULL`
+
+## Onboarding
+
+- The onboarding flow uses `d_onboarding_devices` to bind a device to a screen and persist the client name.
+
 ## Announcements
 
 - `d_announcements` - announcement content and display metadata.
 - `d_announcement_screens` - announcement-to-screen assignments.
 
-### `d_players`
-
-- `device_id`, `public_base_url`, `internal_base_url`, `last_seen_at`, `created_at`, `modified_at`
-- `device_id` is the primary key.
-        
-### `d_screens`
-
-- `id`, `name`, `slug`, `playlist_id`, `player_id`, `created_at`, `created_by`, `modified_at`, `modified_by`
-- `slug` is unique.
-- Foreign keys:
-        - `playlist_id` -> `c_playlists.id` with `ON DELETE SET NULL`
-        - `player_id` -> `d_players.id` with `ON DELETE RESTRICT`
-
-- `player_id` is required and defaults to `'1'` for the current singleton-player model.
-
-### `d_onboarding_devices`
-
-- `device_id`, `client_name`, `screen_id`, `created_at`, `created_by`, `modified_at`, `modified_by`
-- `device_id` is the primary key.
-- Foreign key:
-        - `screen_id` -> `d_screens.id` with `ON DELETE SET NULL`
-
 ### `d_announcements`
 
 - `id`, `message`, `short_label`, `announcement_type`, `color_key`, `icon_key`, `duration_seconds`, `expires_at`, `created_at`, `created_by`, `modified_at`, `modified_by`
@@ -139,17 +158,15 @@ Primary keys are `id` unless noted otherwise. Timestamps are stored as `created_
 - Foreign keys:
         - `announcement_id` -> `d_announcements.id` with `ON DELETE CASCADE`
         - `screen_id` -> `d_screens.id` with `ON DELETE CASCADE`
-- Composite primary key: `(announcement_id, screen_id)`
+- Unique key: `(announcement_id, screen_id)`
-
-## Onboarding
-
-- The onboarding flow uses `d_onboarding_devices` to bind a device to a screen and persist the client name.
 
 ## Integrations
 
 - `i_rss_feeds` - RSS feed definitions and refresh cadence.
 - `i_rss_feed_items` - cached RSS feed items.
 - `i_api_sources` - API source definitions and last response snapshot.
+- `i_timetable_groups` - grouped timetable definitions used by the timetable region.
+- `i_timetable_entries` - dated entries that belong to a timetable group.
 
 ### `i_rss_feeds`
 
@@ -167,255 +184,109 @@ Primary keys are `id` unless noted otherwise. Timestamps are stored as `created_
 
 - `id`, `name`, `api_url`, `auth_method`, `auth_username`, `auth_password`, `auth_bearer_token`, `auth_header_name`, `auth_header_value`, `items_path`, `update_interval_value`, `update_interval_unit`, `last_pulled_at`, `last_pull_error`, `last_response_status`, `last_response_content_type`, `last_response_json`, `created_at`, `created_by`, `modified_at`, `modified_by`
 
+### `i_timetable_groups`
+
+- `id`, `name`, `short_description`, `timezone`, `created_at`, `created_by`, `modified_at`, `modified_by`
+- `timezone` defaults to `Europe/London`.
+
+### `i_timetable_entries`
+
+- `id`, `schedule_group_id`, `title`, `short_description`, `start_datetime`, `end_datetime`, `created_at`, `created_by`, `modified_at`, `modified_by`
+- Foreign key:
+        - `schedule_group_id` -> `i_timetable_groups.id` with `ON DELETE CASCADE`
+- Index:
+        - `(schedule_group_id, start_datetime)`
+
 ## Operations
 
 - `o_background_tasks` - queue and history for background jobs.
+- `o_app_state` - generic app state and version markers stored as key/value pairs.
+- `o_app_settings` - administrator-configurable application settings stored by key.
+- `o_audit_events` - retained audit events for administrator activity and system changes.
 
 ### `o_background_tasks`
 
 - `id`, `task_key`, `task_type`, `title`, `category`, `status`, `payload_json`, `metadata_json`, `attempts`, `created_at`, `created_by`, `started_at`, `finished_at`, `error_message`
 - Indexed by `status`, `task_key`, and `task_type`.
 
+### `o_app_state`
+
+- `id`, `state_key`, `state_value`, `created_at`, `modified_at`
+- `state_key` is unique.
+- `schema_version` is stored here so startup can detect the previously recorded schema version before deciding whether migrations need to run.
+
+### `o_app_settings`
+
+- `id`, `setting_key`, `setting_value`, `created_at`, `created_by`, `modified_at`, `modified_by`
+- `setting_key` is unique.
+- Values are stored as JSON and validated against the application setting definitions in `src/data/app-settings.js`.
+
+### `o_audit_events`
+
+- `id`, `occurred_at`, `category`, `event_type`, `actor_user_id`, `target_type`, `target_id`, `target_label`, `ip_address`, `user_agent`, `details_json`
+- Indexed by occurrence time, category and event type, actor, and target.
+
 ## Notes
 
 - The schema is initialized with `CREATE TABLE IF NOT EXISTS`, so new installs can start from an empty database.
-- `src/db/index.js` also seeds default permissions and the default administrator role.
+- `src/db/bootstrap.js` seeds the canvas size defaults, default permissions, and the default administrator role.
-- The migration module stays in place for future releases, but this version treats the current schema as the install baseline.
+- `src/db/migrations.js` records the current schema version in `o_app_state` during startup so later launches can tell whether an update is happening.
 
 ```mermaid
 erDiagram
         A_USERS {
-                INT id
-                VARCHAR name
-                VARCHAR username
-                CHAR password_hash
-                VARCHAR password_salt
-                INT password_iterations
-                TIMESTAMP created_at
-                INT created_by
-                TIMESTAMP modified_at
-                INT modified_by
         }
         A_ROLES {
-                INT id
-                VARCHAR role_key
-                VARCHAR name
-                TEXT description
-                TIMESTAMP created_at
-                INT created_by
-                TIMESTAMP modified_at
-                INT modified_by
         }
         A_PERMISSIONS {
-                INT id
-                VARCHAR permission_key
-                VARCHAR name
-                VARCHAR section_name
-                TEXT description
-                TIMESTAMP created_at
-                TIMESTAMP modified_at
         }
         A_ROLE_PERMISSIONS {
-                INT role_id
-                INT permission_id
-                TIMESTAMP created_at
-                INT created_by
-                TIMESTAMP modified_at
-                INT modified_by
         }
         A_USER_ROLES {
-                INT user_id
-                INT role_id
-                TIMESTAMP created_at
-                INT created_by
-                TIMESTAMP modified_at
-                INT modified_by
         }
         A_SESSIONS {
-                CHAR session_hash
-                INT user_id
-                DATETIME expires_at
-                TIMESTAMP created_at
-                INT created_by
-                TIMESTAMP last_used_at
-                INT modified_by
         }
         C_CANVAS_SIZES {
-                INT id
-                VARCHAR name
-                INT width
-                INT height
-                TIMESTAMP created_at
-                INT created_by
-                TIMESTAMP modified_at
-                INT modified_by
         }
         C_PLAYLISTS {
-                INT id
-                VARCHAR name
-                TINYINT fade_between_slides
-                TINYINT skip_unavailable_rtmp
-                TIMESTAMP created_at
-                INT created_by
-                TIMESTAMP modified_at
-                INT modified_by
         }
         C_TEMPLATES {
-                INT id
-                VARCHAR name
-                INT canvas_size_id
-                VARCHAR background_image_path
-                VARCHAR background_color
-                TIMESTAMP created_at
-                INT created_by
-                TIMESTAMP modified_at
-                INT modified_by
         }
         C_TEMPLATE_REGIONS {
-                INT id
-                INT template_id
-                VARCHAR region_key
-                VARCHAR region_type
-                VARCHAR label
-                VARCHAR font_family
-                VARCHAR lock_ratio
-                INT x
-                INT y
-                INT width
-                INT height
-                INT z_index
-                TIMESTAMP created_at
-                INT created_by
-                TIMESTAMP modified_at
-                INT modified_by
         }
         C_SLIDES {
-                INT id
-                VARCHAR title
-                INT template_id
-                JSON content_json
-                VARCHAR thumbnail_path
-                TIMESTAMP created_at
-                INT created_by
-                TIMESTAMP modified_at
-                INT modified_by
         }
         C_PLAYLIST_SLIDES {
-                INT id
+        }
-                INT playlist_id
+        C_PLAYLIST_SLIDE_SCHEDULE_RULES {
-                INT slide_id
-                INT position
-                DECIMAL duration_seconds
-                TINYINT use_video_duration
-                VARCHAR schedule_mode
-                DATETIME schedule_start_datetime
-                DATETIME schedule_end_datetime
-                TIME schedule_start_time
-                TIME schedule_end_time
-                JSON schedule_days_json
-                TIMESTAMP created_at
-                INT created_by
-                TIMESTAMP modified_at
-                INT modified_by
         }
         D_PLAYERS {
-                INT device_id
-                VARCHAR public_base_url
-                VARCHAR internal_base_url
-                TIMESTAMP last_seen_at
-                TIMESTAMP created_at
-                TIMESTAMP modified_at
         }
         D_SCREENS {
-                INT id
-                VARCHAR name
-                VARCHAR slug
-                INT playlist_id
-                INT player_id
-                TIMESTAMP created_at
-                INT created_by
-                TIMESTAMP modified_at
-                INT modified_by
         }
         D_ONBOARDING_DEVICES {
-                VARCHAR device_id
-                VARCHAR client_name
-                INT screen_id
-                TIMESTAMP created_at
-                INT created_by
-                TIMESTAMP modified_at
-                INT modified_by
         }
         D_ANNOUNCEMENTS {
-                INT id
-                TEXT message
-                VARCHAR short_label
-                VARCHAR announcement_type
-                VARCHAR color_key
-                VARCHAR icon_key
-                INT duration_seconds
-                TIMESTAMP expires_at
-                TIMESTAMP created_at
-                INT created_by
-                TIMESTAMP modified_at
-                INT modified_by
         }
         D_ANNOUNCEMENT_SCREENS {
-                INT announcement_id
-                INT screen_id
-                TIMESTAMP created_at
-                INT created_by
-                TIMESTAMP modified_at
-                INT modified_by
         }
         I_RSS_FEEDS {
-                INT id
-                VARCHAR name
-                VARCHAR feed_url
-                INT update_interval_value
-                VARCHAR update_interval_unit
-                INT item_limit
-                TIMESTAMP created_at
-                INT created_by
-                TIMESTAMP modified_at
-                INT modified_by
         }
         I_RSS_FEED_ITEMS {
-                INT id
-                INT rss_feed_id
-                INT position
-                MEDIUMTEXT item_json
-                TIMESTAMP created_at
-                INT created_by
-                TIMESTAMP modified_at
-                INT modified_by
         }
         I_API_SOURCES {
-                INT id
+        }
-                VARCHAR name
+        I_TIMETABLE_GROUPS {
-                VARCHAR api_url
+        }
-                INT update_interval_value
+        I_TIMETABLE_ENTRIES {
-                VARCHAR update_interval_unit
+        }
-                TIMESTAMP last_pulled_at
+        O_APP_STATE {
-                MEDIUMTEXT last_pull_error
+        }
-                INT last_response_status
+        O_APP_SETTINGS {
-                VARCHAR last_response_content_type
-                MEDIUMTEXT last_response_json
         }
         O_BACKGROUND_TASKS {
-                BIGINT id
+        }
-                VARCHAR task_key
+        O_AUDIT_EVENTS {
-                VARCHAR task_type
-                VARCHAR title
-                VARCHAR category
-                VARCHAR status
-                MEDIUMTEXT payload_json
-                MEDIUMTEXT metadata_json
-                INT attempts
-                TIMESTAMP created_at
-                TIMESTAMP started_at
-                TIMESTAMP finished_at
-                MEDIUMTEXT error_message
         }
 
         A_USERS ||--o{ A_USER_ROLES : has
@@ -423,18 +294,21 @@ erDiagram
         A_ROLES ||--o{ A_ROLE_PERMISSIONS : has
         A_PERMISSIONS ||--o{ A_ROLE_PERMISSIONS : granted_to
         A_USERS ||--o{ A_SESSIONS : owns
+        A_USERS ||--o{ O_AUDIT_EVENTS : acts
 
         C_CANVAS_SIZES ||--o{ C_TEMPLATES : used_by
+        C_CANVAS_SIZES ||--o{ C_PLAYLISTS : used_by
         C_TEMPLATES ||--o{ C_TEMPLATE_REGIONS : contains
         C_TEMPLATES ||--o{ C_SLIDES : used_by
         C_PLAYLISTS ||--o{ C_PLAYLIST_SLIDES : contains
         C_SLIDES ||--o{ C_PLAYLIST_SLIDES : included_in
+        C_PLAYLIST_SLIDES ||--o{ C_PLAYLIST_SLIDE_SCHEDULE_RULES : has_rules
 
-        D_PLAYERS ||--o{ D_SCREENS : assigned_to
         C_PLAYLISTS ||--o{ D_SCREENS : uses
         D_SCREENS ||--o{ D_ONBOARDING_DEVICES : binds
         D_ANNOUNCEMENTS ||--o{ D_ANNOUNCEMENT_SCREENS : targets
         D_SCREENS ||--o{ D_ANNOUNCEMENT_SCREENS : receives
 
         I_RSS_FEEDS ||--o{ I_RSS_FEED_ITEMS : caches
+        I_TIMETABLE_GROUPS ||--o{ I_TIMETABLE_ENTRIES : contains
 ```

package.json

@@ -1,8 +1,11 @@
 {
   "name": "pulse-signage",
-  "version": "2.2.2",
+  "version": "2.10.2",
   "private": false,
   "description": "Pulse Signage application with MySQL and media storage",
+  "engines": {
+    "node": ">=26.0.0"
+  },
   "repository": {
     "type": "git",
     "url": "https://git.lzstealth.com/LZStealth/pulse-signage.git"
@@ -13,22 +16,24 @@
     "start:web": "node -r dotenv/config src/web.js",
     "start:player": "node -r dotenv/config src/player.js",
     "dev:web": "nodemon -r dotenv/config src/web.js",
-    "dev:player": "nodemon -r dotenv/config src/player.js"
+    "dev:player": "nodemon -r dotenv/config src/player.js",
+    "test": "node --test"
   },
   "dependencies": {
-    "@sparticuz/chromium": "^137.0.0",
+    "@sparticuz/chromium": "^149.0.0",
-    "bootstrap-icons": "1.11.3",
+    "animate.css": "^4.1.1",
+    "bootstrap-icons": "1.13.1",
     "cropperjs": "^1.6.2",
     "dotenv": "^17.4.2",
-    "express": "^4.21.2",
+    "express": "^5.2.1",
     "handlebars": "^4.7.8",
-    "hls.js": "^1.5.15",
+    "hls.js": "^1.7.0",
+    "jsqr": "^1.4.0",
     "multer": "^2.2.0",
-    "mysql2": "^3.14.3",
+    "mysql2": "^3.23.3",
-    "puppeteer-core": "^24.16.0",
+    "puppeteer-core": "^25.7.0",
-    "qrcode": "^1.5.4",
     "sharp": "^0.35.3",
-    "ws": "^8.21.0"
+    "ws": "^8.21.3"
   },
   "devDependencies": {
     "nodemon": "^3.1.10"

scripts/pulse-signage-kiosk.bat

@@ -0,0 +1,64 @@
+@echo off
+setlocal EnableExtensions EnableDelayedExpansion
+
+set "TARGET_URL=%~1"
+if not defined TARGET_URL set "TARGET_URL=http://localhost:8081"
+
+set "BROWSER_PATH="
+set "BROWSER_KIND="
+
+for %%B in (chrome.exe msedge.exe firefox.exe) do if not defined BROWSER_PATH (
+  for /f "delims=" %%I in ('where %%B 2^>nul') do if not defined BROWSER_PATH (
+    set "BROWSER_PATH=%%I"
+    set "BROWSER_KIND=%%~nB"
+  )
+)
+
+if not defined BROWSER_PATH if not defined BROWSER_KIND (
+  for %%P in (
+    "%ProgramFiles%\Google\Chrome\Application\chrome.exe"
+    "%ProgramFiles(x86)%\Google\Chrome\Application\chrome.exe"
+    "%LocalAppData%\Google\Chrome\Application\chrome.exe"
+  ) do if not defined BROWSER_PATH if exist "%%~fP" (
+    set "BROWSER_PATH=%%~fP"
+    set "BROWSER_KIND=chrome"
+  )
+)
+
+if not defined BROWSER_PATH if not defined BROWSER_KIND (
+  for %%P in (
+    "%ProgramFiles%\Microsoft\Edge\Application\msedge.exe"
+    "%ProgramFiles(x86)%\Microsoft\Edge\Application\msedge.exe"
+    "%LocalAppData%\Microsoft\Edge\Application\msedge.exe"
+  ) do if not defined BROWSER_PATH if exist "%%~fP" (
+    set "BROWSER_PATH=%%~fP"
+    set "BROWSER_KIND=edge"
+  )
+)
+
+if not defined BROWSER_PATH if not defined BROWSER_KIND (
+  for %%P in (
+    "%ProgramFiles%\Mozilla Firefox\firefox.exe"
+    "%ProgramFiles(x86)%\Mozilla Firefox\firefox.exe"
+    "%LocalAppData%\Mozilla Firefox\firefox.exe"
+  ) do if not defined BROWSER_PATH if exist "%%~fP" (
+    set "BROWSER_PATH=%%~fP"
+    set "BROWSER_KIND=firefox"
+  )
+)
+
+if not defined BROWSER_PATH (
+  echo No supported browser was found.
+  echo Tried Chrome, Edge, and Firefox in PATH and common install locations.
+  exit /b 1
+)
+
+set "KIOSK_PROFILE=%LocalAppData%\PulseSignage\kiosk-browser-profile"
+if not exist "!KIOSK_PROFILE!" mkdir "!KIOSK_PROFILE!"
+
+echo Launching !BROWSER_KIND! in kiosk mode: !TARGET_URL!
+if /I "!BROWSER_KIND!"=="firefox" (
+  start "" "!BROWSER_PATH!" -no-remote -profile "!KIOSK_PROFILE!" -new-window -kiosk "!TARGET_URL!"
+) else (
+  start "" "!BROWSER_PATH!" --disable-notifications --no-first-run --no-default-browser-check --new-window --kiosk --user-data-dir="!KIOSK_PROFILE!" "!TARGET_URL!"
+)

scripts/pulse-signage-kiosk.sh

@@ -0,0 +1,50 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+target_url="${1:-http://localhost:8081}"
+
+find_browser() {
+  local candidate
+  for candidate in "$@"; do
+    if command -v "$candidate" >/dev/null 2>&1; then
+      printf '%s' "$candidate"
+      return 0
+    fi
+  done
+  return 1
+}
+
+browser=""
+browser_kind=""
+
+if browser="$(find_browser google-chrome-stable google-chrome chromium chromium-browser msedge microsoft-edge firefox)"; then
+  case "$browser" in
+    firefox)
+      browser_kind="firefox"
+      ;;
+    msedge|microsoft-edge)
+      browser_kind="edge"
+      ;;
+    *)
+      browser_kind="chrome"
+      ;;
+  esac
+else
+  echo "No supported browser was found."
+  echo "Tried Chrome, Chromium, Edge, and Firefox in PATH."
+  exit 1
+fi
+
+kiosk_profile="${XDG_DATA_HOME:-$HOME/.local/share}/pulse-signage/kiosk-browser-profile"
+mkdir -p "$kiosk_profile"
+
+echo "Launching ${browser_kind} in kiosk mode: ${target_url}"
+
+case "$browser_kind" in
+  firefox)
+    exec "$browser" -no-remote -profile "$kiosk_profile" -new-window -kiosk "$target_url"
+    ;;
+  edge|chrome)
+    exec "$browser" --disable-notifications --no-first-run --no-default-browser-check --new-window --kiosk --user-data-dir="$kiosk_profile" "$target_url"
+    ;;
+esac

src/auth.js

@@ -7,6 +7,55 @@ const PASSWORD_KEY_LENGTH = 32;
 const PASSWORD_DIGEST = 'sha256';
 const SESSION_BYTES = 32;
 
+function validatePasswordStrength(password, options) {
+  const value = String(password || '');
+  const requirements = options && options.policy
+    ? getPasswordPolicyPreset(options.policy)
+    : {
+      minimumLength: Number(options && options.minimumLength) || 10,
+      minimumCategories: Number(options && options.minimumCategories) || 3,
+      requireLowercase: Boolean(options && options.requireLowercase),
+      requireUppercase: Boolean(options && options.requireUppercase),
+      requireNumber: Boolean(options && options.requireNumber),
+      requireSymbol: Boolean(options && options.requireSymbol)
+    };
+  const hasLowercase = /[a-z]/.test(value);
+  const hasUppercase = /[A-Z]/.test(value);
+  const hasNumber = /[0-9]/.test(value);
+  const hasSymbol = /[^A-Za-z0-9]/.test(value);
+  const categoryCount = [hasLowercase, hasUppercase, hasNumber, hasSymbol].filter(Boolean).length;
+
+  const missingRequiredCategory = requirements.requireLowercase && !hasLowercase
+    || requirements.requireUppercase && !hasUppercase
+    || requirements.requireNumber && !hasNumber
+    || requirements.requireSymbol && !hasSymbol;
+  if (value.length < requirements.minimumLength || categoryCount < requirements.minimumCategories || missingRequiredCategory) {
+    if (missingRequiredCategory) {
+      const requiredCategories = [];
+      if (requirements.requireLowercase) requiredCategories.push('lowercase');
+      if (requirements.requireUppercase) requiredCategories.push('uppercase');
+      if (requirements.requireNumber) requiredCategories.push('number');
+      if (requirements.requireSymbol) requiredCategories.push('symbol');
+      return `Password must be at least ${requirements.minimumLength} characters and include ${requiredCategories.join(', ')}.`;
+    }
+    if (requirements.minimumCategories === 4) {
+      return `Password must be at least ${requirements.minimumLength} characters and include uppercase, lowercase, number, and symbol.`;
+    }
+    return `Password must be at least ${requirements.minimumLength} characters and include ${requirements.minimumCategories} of: uppercase, lowercase, number, and symbol.`;
+  }
+
+  return '';
+}
+
+function getPasswordPolicyPreset(policy) {
+  const normalizedPolicy = String(policy || 'standard').trim().toLowerCase();
+  return normalizedPolicy === 'strict'
+    ? { minimumLength: 14, minimumCategories: 4 }
+    : normalizedPolicy === 'strong'
+      ? { minimumLength: 12, minimumCategories: 3 }
+      : { minimumLength: 10, minimumCategories: 3 };
+}
+
 function hashPassword(password, salt) {
   const safePassword = String(password || '');
   const safeSalt = salt || crypto.randomBytes(16).toString('hex');
@@ -40,6 +89,7 @@ function hashSessionToken(token) {
 module.exports = {
   hashPassword,
   verifyPassword,
+  validatePasswordStrength,
   createSessionToken,
   hashSessionToken
 };

src/common.js

@@ -27,6 +27,7 @@ const dbBootstrap = require('#src/db/bootstrap');
 const data = require('#src/data');
 const player = require('#src/player/render');
 const listQuery = require('#src/web/lib/list-query');
+const { fetchPlaylistCanvasId } = require('#src/web/lib/helpers');
 
 module.exports = {
   createPool: dbCommon.createPool,
@@ -36,6 +37,8 @@ module.exports = {
   slugify: data.slugify,
   uniqueScreenSlug: data.uniqueScreenSlug,
   parseJsonSafe: data.parseJsonSafe,
+  validateMaxLength: data.validateMaxLength,
+  truncateToMaxLength: data.truncateToMaxLength,
   fetchAdminData: data.fetchAdminData,
   fetchPlaylistsPage: data.fetchPlaylistsPage,
   fetchSlidesPage: data.fetchSlidesPage,
@@ -59,6 +62,13 @@ module.exports = {
   getSortQuery: listQuery.getSortQuery,
   getSortDirectionQuery: listQuery.getSortDirectionQuery,
   fetchPlaylistById: data.fetchPlaylistById,
+  fetchPlaylistCanvasId: fetchPlaylistCanvasId,
+  normalizeDisplayMode: data.normalizeDisplayMode,
+  fetchTimetablesData: data.fetchTimetablesData,
+  fetchTimetableGroupsPage: data.fetchTimetableGroupsPage,
+  fetchTimetableGroupById: data.fetchTimetableGroupById,
+  fetchTimetableEntriesByGroupId: data.fetchTimetableEntriesByGroupId,
+  buildTimetableGroupPayload: data.buildTimetableGroupPayload,
   fetchApiSourcesData: data.fetchApiSourcesData,
   fetchApiSourcesPage: data.fetchApiSourcesPage,
   fetchApiSourceById: data.fetchApiSourceById,
@@ -72,16 +82,25 @@ module.exports = {
   buildRssFeedPayload: data.buildRssFeedPayload,
   fetchRssFeedItems: data.fetchRssFeedItems,
   replaceRssFeedItems: data.replaceRssFeedItems,
+  fetchWeatherLocationsData: data.fetchWeatherLocationsData,
+  fetchWeatherLocationsPage: data.fetchWeatherLocationsPage,
+  fetchWeatherLocationById: data.fetchWeatherLocationById,
+  fetchWeatherLocationSuggestions: data.fetchWeatherLocationSuggestions,
+  fetchWeatherLocationForecast: data.fetchWeatherLocationForecast,
+  buildWeatherLocationPayload: data.buildWeatherLocationPayload,
   fetchScreenById: data.fetchScreenById,
   fetchScreenEditData: data.fetchScreenEditData,
   fetchScreenPlayerUrls: data.fetchScreenPlayerUrls,
+  fetchPlayerPublicBaseUrl: data.fetchPlayerPublicBaseUrl,
   fetchScreenPlayerRecord: data.fetchScreenPlayerRecord,
   fetchTemplateById: data.fetchTemplateById,
+  fetchPlayerRegistrations: data.fetchPlayerRegistrations,
   fetchSlideById: data.fetchSlideById,
   fetchTemplatesData: data.fetchTemplatesData,
   fetchCanvasSizesData: data.fetchCanvasSizesData,
   fetchCanvasSizeById: data.fetchCanvasSizeById,
   buildCanvasSizePayload: data.buildCanvasSizePayload,
+  MAX_CANVAS_SIZE_DIMENSION: data.MAX_CANVAS_SIZE_DIMENSION,
   buildSlidePayload: data.buildSlidePayload,
   extractTemplateRegions: data.extractTemplateRegions,
   buildTemplatePayload: data.buildTemplatePayload,

src/data/admin.js

@@ -6,7 +6,7 @@ async function fetchAdminData(pool) {
   const [playlists] = await pool.query('SELECT id, name, fade_between_slides, skip_unavailable_rtmp, created_at, modified_at, created_by, modified_by FROM c_playlists ORDER BY id DESC');
   const [canvasSizes] = await pool.query('SELECT id, name, width, height, created_at, modified_at, created_by, modified_by FROM c_canvas_sizes ORDER BY width ASC, height ASC, name ASC');
   const [templates] = await pool.query(`
-    SELECT st.id, st.name, st.canvas_size_id, st.background_image_path, st.background_color, st.created_at, st.modified_at,
+    SELECT st.id, st.name, st.canvas_size_id, st.background_image_path, st.background_color, st.background_gradient, st.created_at, st.modified_at,
            cs.name AS canvas_size_name, cs.width AS canvas_size_width, cs.height AS canvas_size_height
     FROM c_templates st
     LEFT JOIN c_canvas_sizes cs ON cs.id = st.canvas_size_id
@@ -14,7 +14,7 @@ async function fetchAdminData(pool) {
   `);
   const [templateRegions] = await pool.query('SELECT id, template_id, region_key, region_type, label, lock_ratio, x, y, width, height, z_index, created_at, modified_at, created_by, modified_by FROM c_template_regions ORDER BY template_id ASC, z_index ASC, id ASC');
   const [slides] = await pool.query(`
-    SELECT s.id, s.title, s.template_id, s.content_json, s.thumbnail_path, s.created_at, s.modified_at, s.created_by, s.modified_by, st.name AS template_name, cs.width AS canvas_width, cs.height AS canvas_height,
+    SELECT s.id, s.title, s.template_id, s.content_json, s.thumbnail_path, s.created_at, s.modified_at, s.created_by, s.modified_by, st.name AS template_name, st.canvas_size_id, cs.width AS canvas_width, cs.height AS canvas_height,
            (SELECT COUNT(DISTINCT ps.playlist_id) FROM c_playlist_slides ps WHERE ps.slide_id = s.id) AS playlist_count
     FROM c_slides s
     LEFT JOIN c_templates st ON st.id = s.template_id
@@ -28,14 +28,35 @@ async function fetchAdminData(pool) {
     ORDER BY s.id DESC
   `);
   const [playlistSlides] = await pool.query(`
-    SELECT ps.id, ps.playlist_id, ps.position, ps.duration_seconds, ps.use_video_duration, ps.schedule_mode, ps.schedule_start_datetime, ps.schedule_end_datetime, ps.schedule_start_time, ps.schedule_end_time, ps.schedule_days_json, sl.id AS slide_id, sl.title, sl.content_json, sl.thumbnail_path, cs.width AS canvas_width, cs.height AS canvas_height
+    SELECT ps.id, ps.playlist_id, ps.position, ps.duration_seconds, ps.use_video_duration, ps.disable_audio, sl.id AS slide_id, sl.title, sl.content_json, sl.thumbnail_path, st.canvas_size_id, cs.width AS canvas_width, cs.height AS canvas_height
     FROM c_playlist_slides ps
     JOIN c_slides sl ON sl.id = ps.slide_id
     LEFT JOIN c_templates st ON st.id = sl.template_id
     LEFT JOIN c_canvas_sizes cs ON cs.id = st.canvas_size_id
     ORDER BY ps.playlist_id ASC, ps.position ASC, ps.id ASC
   `);
-  return { playlists, canvasSizes, templates, templateRegions, slides, screens, playlistSlides };
+  const [playlistScheduleRules] = await pool.query(`
+    SELECT id, playlist_slide_id, position, start_datetime, end_datetime, start_time, end_time, schedule_days_json, created_at, modified_at, created_by, modified_by
+    FROM c_playlist_slide_schedule_rules
+    ORDER BY playlist_slide_id ASC, position ASC, id ASC
+  `);
+
+  const rulesBySlideId = new Map();
+  playlistScheduleRules.forEach(function (rule) {
+    const slideId = Number(rule.playlist_slide_id);
+    if (!rulesBySlideId.has(slideId)) {
+      rulesBySlideId.set(slideId, []);
+    }
+    rulesBySlideId.get(slideId).push(rule);
+  });
+
+  const playlistSlidesWithRules = playlistSlides.map(function (slide) {
+    return Object.assign({}, slide, {
+      scheduleRules: rulesBySlideId.get(Number(slide.id)) || []
+    });
+  });
+
+  return { playlists, canvasSizes, templates, templateRegions, slides, screens, playlistSlides: playlistSlidesWithRules };
 }
 
 async function fetchPlaylistsPage(pool, page, pageSize, searchTerm, sortKey, sortDirection) {
@@ -72,7 +93,7 @@ async function fetchSlidesPage(pool, page, pageSize, searchTerm, sortKey, sortDi
     LEFT JOIN c_canvas_sizes cs ON cs.id = st.canvas_size_id
      ORDER BY s.id DESC`,
     countSql: 'SELECT COUNT(*) AS count FROM c_slides',
-    searchColumns: ['s.title', 'st.name', 's.content_json'],
+    searchColumns: ['s.title', 'st.name'],
     searchTerm: searchTerm,
     sortColumns: {
       title: 's.title',
@@ -91,7 +112,7 @@ async function fetchSlidesPage(pool, page, pageSize, searchTerm, sortKey, sortDi
 
 async function fetchTemplatesPage(pool, page, pageSize, searchTerm, sortKey, sortDirection) {
   const paged = await fetchPagedRows(pool, {
-    selectSql: `SELECT st.id, st.name, st.canvas_size_id, st.background_image_path, st.background_color, st.created_at, st.modified_at,
+    selectSql: `SELECT st.id, st.name, st.canvas_size_id, st.background_image_path, st.background_color, st.background_gradient, st.created_at, st.modified_at,
            cs.name AS canvas_size_name, cs.width AS canvas_size_width, cs.height AS canvas_size_height,
         (SELECT COUNT(*) FROM c_template_regions str WHERE str.template_id = st.id) AS region_count,
            (SELECT COUNT(*) FROM c_slides s WHERE s.template_id = st.id) AS slide_count

src/data/announcement-icons.js

@@ -1,55 +1,69 @@
-const ANNOUNCEMENT_ICON_OPTIONS = [
+const fs = require('fs');
-  { value: 'megaphone-fill', label: 'Megaphone' },
+const path = require('path');
-  { value: 'megaphone', label: 'Megaphone outline' },
+
-  { value: 'bell-fill', label: 'Bell' },
+const BOOTSTRAP_ICON_CSS_PATH = path.join(__dirname, '..', 'web', 'public', 'adminlte', 'bootstrap-icons', 'css', 'bootstrap-icons.min.css');
-  { value: 'bell', label: 'Bell outline' },
+
-  { value: 'exclamation-triangle-fill', label: 'Warning' },
+const DEFAULT_ANNOUNCEMENT_ICON_KEYS = [
-  { value: 'exclamation-triangle', label: 'Warning outline' },
+  'megaphone-fill', 'megaphone', 'bell-fill', 'bell',
-  { value: 'info-circle-fill', label: 'Info' },
+  'exclamation-triangle-fill', 'exclamation-triangle', 'info-circle-fill', 'info-circle',
-  { value: 'info-circle', label: 'Info outline' },
+  'check-circle-fill', 'check-circle', 'lightbulb-fill', 'lightbulb',
-  { value: 'check-circle-fill', label: 'Success' },
+  'calendar-event-fill', 'calendar-event', 'clock-fill', 'clock',
-  { value: 'check-circle', label: 'Success outline' },
+  'wifi-off', 'wifi', 'hdd-network', 'hdd-network-fill',
-  { value: 'lightbulb-fill', label: 'Idea' },
+  'speaker-fill', 'speaker', 'shield-fill', 'shield',
-  { value: 'lightbulb', label: 'Idea outline' },
+  'collection-play-fill', 'collection-play', 'broadcast', 'broadcast-pin',
-  { value: 'calendar-event-fill', label: 'Calendar' },
+  'plug-fill', 'plug', 'lightning-charge-fill', 'lightning-charge',
-  { value: 'calendar-event', label: 'Calendar outline' },
+  'car-front-fill', 'car-front', 'lamp-fill', 'lamp',
-  { value: 'clock-fill', label: 'Clock' },
+  'envelope-fill', 'envelope', 'people-fill', 'people',
-  { value: 'clock', label: 'Clock outline' },
+  'browser-chrome', 'browser-edge', 'browser-firefox', 'browser-safari',
-  { value: 'wifi-off', label: 'Wi-Fi Offline' },
+  'cone', 'cone-striped', 'cup-straw', 'fire'
-  { value: 'wifi', label: 'Wi-Fi' },
-  { value: 'hdd-network', label: 'Network' },
-  { value: 'hdd-network-fill', label: 'Network fill' },
-  { value: 'speaker-fill', label: 'Speaker' },
-  { value: 'speaker', label: 'Speaker outline' },
-  { value: 'shield-fill', label: 'Shield' },
-  { value: 'shield', label: 'Shield outline' },
-  { value: 'collection-play-fill', label: 'Playlist' },
-  { value: 'collection-play', label: 'Playlist outline' },
-  { value: 'broadcast', label: 'Broadcast' },
-  { value: 'broadcast-pin', label: 'Broadcast pin' },
-  { value: 'plug-fill', label: 'Plug' },
-  { value: 'plug', label: 'Plug outline' },
-  { value: 'lightning-charge-fill', label: 'Urgent' },
-  { value: 'lightning-charge', label: 'Urgent outline' },
-  { value: 'car-front-fill', label: 'Car Front' },
-  { value: 'car-front', label: 'Car Front outline' },
-  { value: 'lamp-fill', label: 'Lamp' },
-  { value: 'lamp', label: 'Lamp outline' },
-  { value: 'envelope-fill', label: 'Message' },
-  { value: 'envelope', label: 'Message outline' },
-  { value: 'people-fill', label: 'Audience' },
-  { value: 'people', label: 'Audience outline' },
-  { value: 'browser-chrome', label: 'Browser Chrome' },
-  { value: 'browser-edge', label: 'Browser Edge' },
-  { value: 'browser-firefox', label: 'Browser Firefox' },
-  { value: 'browser-safari', label: 'Browser Safari' },
-  { value: 'cone', label: 'Cone' },
-  { value: 'cone-striped', label: 'Cone striped' },
-  { value: 'cup-straw', label: 'Cup straw' },
-  { value: 'fire', label: 'Fire' }
 ];
 
-const ANNOUNCEMENT_ICON_KEYS = ANNOUNCEMENT_ICON_OPTIONS.map(function (option) {
+function humanizeBootstrapIconLabel(iconKey) {
+  return String(iconKey || '')
+    .trim()
+    .replace(/[-_]+/g, ' ')
+    .replace(/\b\w/g, function (character) {
+      return character.toUpperCase();
+    });
+}
+
+function loadBootstrapIconCatalog() {
+  try {
+    const css = fs.readFileSync(BOOTSTRAP_ICON_CSS_PATH, 'utf8');
+    const keys = Array.from(new Set((css.match(/\.bi-([a-z0-9-]+)::?before/g) || []).map(function (match) {
+      return String(match || '')
+        .replace(/^\.bi-/, '')
+        .replace(/::?before$/, '')
+        .trim()
+        .toLowerCase();
+    }).filter(Boolean)));
+
+    return keys.map(function (value) {
+      return {
+        value: value,
+        label: humanizeBootstrapIconLabel(value)
+      };
+    }).sort(function (left, right) {
+      return left.value.localeCompare(right.value);
+    });
+  } catch (_error) {
+    return DEFAULT_ANNOUNCEMENT_ICON_KEYS.map(function (value) {
+      return { value: value, label: humanizeBootstrapIconLabel(value) };
+    });
+  }
+}
+
+const ANNOUNCEMENT_ICON_CATALOG = loadBootstrapIconCatalog();
+const ANNOUNCEMENT_ICON_OPTIONS = DEFAULT_ANNOUNCEMENT_ICON_KEYS.map(function (value) {
+  const catalogOption = ANNOUNCEMENT_ICON_CATALOG.find(function (option) {
+    return option.value === value;
+  });
+  return catalogOption || { value: value, label: humanizeBootstrapIconLabel(value) };
+});
+
+const ANNOUNCEMENT_ICON_KEYS = DEFAULT_ANNOUNCEMENT_ICON_KEYS.slice();
+
+const ANNOUNCEMENT_ICON_CATALOG_KEYS = ANNOUNCEMENT_ICON_CATALOG.map(function (option) {
   return option.value;
 });
 
@@ -58,17 +72,27 @@ const ANNOUNCEMENT_ICON_LABELS = ANNOUNCEMENT_ICON_OPTIONS.reduce(function (labe
   return labels;
 }, Object.create(null));
 
+ANNOUNCEMENT_ICON_CATALOG.forEach(function (option) {
+  if (!Object.prototype.hasOwnProperty.call(ANNOUNCEMENT_ICON_LABELS, option.value)) {
+    ANNOUNCEMENT_ICON_LABELS[option.value] = option.label;
+  }
+});
+
 const DEFAULT_ANNOUNCEMENT_ICON = 'megaphone-fill';
 
 function normalizeAnnouncementIcon(value) {
   const normalized = String(value || '').trim().toLowerCase();
-  return ANNOUNCEMENT_ICON_KEYS.includes(normalized) ? normalized : DEFAULT_ANNOUNCEMENT_ICON;
+  return ANNOUNCEMENT_ICON_CATALOG_KEYS.includes(normalized) ? normalized : DEFAULT_ANNOUNCEMENT_ICON;
 }
 
 module.exports = {
+  DEFAULT_ANNOUNCEMENT_ICON_KEYS,
   ANNOUNCEMENT_ICON_OPTIONS,
   ANNOUNCEMENT_ICON_KEYS,
+  ANNOUNCEMENT_ICON_CATALOG,
+  ANNOUNCEMENT_ICON_CATALOG_KEYS,
   ANNOUNCEMENT_ICON_LABELS,
   DEFAULT_ANNOUNCEMENT_ICON,
+  humanizeBootstrapIconLabel,
   normalizeAnnouncementIcon
 };

src/data/announcements.js

@@ -6,9 +6,16 @@ const {
   DEFAULT_ANNOUNCEMENT_ICON,
   normalizeAnnouncementIcon: normalizeAnnouncementIconFromConfig
 } = require('./announcement-icons');
+const { validateMaxLength } = require('./utils');
+
+const SHORT_LABEL_MAX_LENGTH = 255;
 
 const ANNOUNCEMENT_TYPES = ['lower-third', 'fullscreen', 'top-banner'];
-const ANNOUNCEMENT_COLORS = ['primary', 'secondary', 'success', 'info', 'warning', 'danger', 'dark', 'light'];
+const ANNOUNCEMENT_COLORS = [
+  'primary', 'secondary', 'success', 'info', 'warning', 'danger', 'dark', 'light',
+  'orange', 'amber', 'olive', 'teal', 'sky', 'indigo', 'violet', 'fuchsia', 'pink',
+  'navy', 'steel', 'slate', 'graphite', 'midnight'
+];
 
 function normalizeAnnouncementType(value) {
   const normalized = String(value || '').trim().toLowerCase();
@@ -57,7 +64,7 @@ function normalizeAnnouncementScreenIds(value) {
 
 function buildAnnouncementPayload(input) {
   const message = normalizeAnnouncementMessage(input && input.message);
-  const shortLabel = normalizeAnnouncementShortLabel(input && input.short_label);
+  const shortLabel = validateMaxLength(normalizeAnnouncementShortLabel(input && input.short_label), SHORT_LABEL_MAX_LENGTH, 'Announcement short description');
   const announcementType = normalizeAnnouncementType(input && input.announcement_type);
   const colorKey = normalizeAnnouncementColor(input && input.color_key);
   const iconKey = normalizeAnnouncementIconFromConfig(input && input.icon_key);

src/data/api-sources.js

@@ -2,20 +2,33 @@
 
 const http = require('http');
 const https = require('https');
-const { fetchPagedRows } = require('./utils');
+const { fetchPagedRows, validateMaxLength } = require('./utils');
+
+const NAME_MAX_LENGTH = 255;
+const URL_MAX_LENGTH = 1024;
+const AUTH_MAX_LENGTH = 255;
+const ITEMS_PATH_MAX_LENGTH = 255;
+const REQUEST_BODY_MAX_LENGTH = 1000000;
+const TOKEN_URL_MAX_LENGTH = 1024;
+const TOKEN_RESPONSE_PATH_MAX_LENGTH = 255;
+const TOKEN_HEADER_PREFIX_MAX_LENGTH = 64;
+const tokenCache = new Map();
 
 function normalizeUpdateIntervalUnit(value) {
   const unit = String(value || '').trim().toLowerCase();
-  return unit === 'seconds' ? 'seconds' : 'minutes';
+  if (unit === 'seconds' || unit === 'minutes' || unit === 'hours') {
+    return unit;
+  }
+  return 'minutes';
 }
 
 function normalizeAuthMethod(value) {
   const method = String(value || '').trim().toLowerCase();
-  return ['basic', 'bearer', 'api_key_header'].includes(method) ? method : 'none';
+  return ['basic', 'bearer', 'api_key_header', 'token_login'].includes(method) ? method : 'none';
 }
 
-function getItemsPath(source) {
+function normalizeRequestMethod(value) {
-  return String(source && (source.items_path || source.itemsPath) || '').trim();
+  return String(value || '').trim().toUpperCase() === 'POST' ? 'POST' : 'GET';
 }
 
 function buildAuthHeaders(source) {
@@ -46,7 +59,7 @@ function buildAuthHeaders(source) {
 
 async function fetchApiSourcesData(pool) {
   const [apiSources] = await pool.query(
-    'SELECT id, name, api_url, auth_method, auth_username, auth_password, auth_bearer_token, auth_header_name, auth_header_value, items_path, update_interval_value, update_interval_unit, last_pulled_at, last_pull_error, last_response_status, last_response_content_type, last_response_json, created_at, modified_at, created_by, modified_by FROM i_api_sources ORDER BY modified_at DESC, id DESC'
+    'SELECT id, name, api_url, request_method, request_body_json, auth_method, auth_username, auth_password, auth_bearer_token, auth_header_name, auth_header_value, token_url, token_request_body_json, token_response_path, token_header_name, token_header_prefix, items_path, enabled, update_interval_value, update_interval_unit, last_pulled_at, last_pull_error, last_response_status, last_response_content_type, last_response_json, created_at, modified_at, created_by, modified_by FROM i_api_sources ORDER BY modified_at DESC, id DESC'
   );
 
   return { apiSources: apiSources };
@@ -54,7 +67,7 @@ async function fetchApiSourcesData(pool) {
 
 async function fetchApiSourcesPage(pool, page, pageSize, searchTerm, sortKey, sortDirection) {
   const paged = await fetchPagedRows(pool, {
-    selectSql: 'SELECT id, name, api_url, auth_method, auth_username, auth_password, auth_bearer_token, auth_header_name, auth_header_value, items_path, update_interval_value, update_interval_unit, last_pulled_at, last_pull_error, last_response_status, last_response_content_type, last_response_json, created_at, modified_at, created_by, modified_by FROM i_api_sources ORDER BY modified_at DESC, id DESC',
+    selectSql: 'SELECT id, name, api_url, request_method, request_body_json, auth_method, auth_username, auth_password, auth_bearer_token, auth_header_name, auth_header_value, token_url, token_request_body_json, token_response_path, token_header_name, token_header_prefix, items_path, enabled, update_interval_value, update_interval_unit, last_pulled_at, last_pull_error, last_response_status, last_response_content_type, last_response_json, created_at, modified_at, created_by, modified_by FROM i_api_sources ORDER BY modified_at DESC, id DESC',
     countSql: 'SELECT COUNT(*) AS count FROM i_api_sources',
     searchColumns: ['name', 'api_url', 'last_pull_error'],
     searchTerm: searchTerm,
@@ -78,7 +91,7 @@ async function fetchApiSourcesPage(pool, page, pageSize, searchTerm, sortKey, so
 
 async function fetchApiSourceById(pool, id) {
   const [rows] = await pool.query(
-    'SELECT id, name, api_url, auth_method, auth_username, auth_password, auth_bearer_token, auth_header_name, auth_header_value, items_path, update_interval_value, update_interval_unit, last_pulled_at, last_pull_error, last_response_status, last_response_content_type, last_response_json, created_at, modified_at, created_by, modified_by FROM i_api_sources WHERE id = ?',
+    'SELECT id, name, api_url, request_method, request_body_json, auth_method, auth_username, auth_password, auth_bearer_token, auth_header_name, auth_header_value, token_url, token_request_body_json, token_response_path, token_header_name, token_header_prefix, items_path, enabled, update_interval_value, update_interval_unit, last_pulled_at, last_pull_error, last_response_status, last_response_content_type, last_response_json, created_at, modified_at, created_by, modified_by FROM i_api_sources WHERE id = ?',
     [id]
   );
 
@@ -87,13 +100,18 @@ async function fetchApiSourceById(pool, id) {
 
 async function loadUrlText(urlValue, requestOptions) {
   const extraHeaders = requestOptions && requestOptions.headers ? requestOptions.headers : {};
-  if (typeof fetch === 'function') {
+  const method = String(requestOptions && requestOptions.method || 'GET').toUpperCase();
-    const response = await fetch(urlValue, {
+  const body = requestOptions && requestOptions.body !== undefined ? requestOptions.body : undefined;
-      headers: Object.assign({
+  const headers = Object.assign({
     Accept: 'application/json, text/plain;q=0.9, */*;q=0.8',
     'User-Agent': 'Pulse Signage API Reader'
-      }, extraHeaders)
+  }, extraHeaders);
-    });
+  if (typeof fetch === 'function') {
+    const fetchOptions = { method: method, headers: headers };
+    if (body !== undefined && method !== 'GET' && method !== 'HEAD') {
+      fetchOptions.body = body;
+    }
+    const response = await fetch(urlValue, fetchOptions);
 
     return {
       statusCode: response.status,
@@ -106,12 +124,9 @@ async function loadUrlText(urlValue, requestOptions) {
   return await new Promise(function (resolve, reject) {
     const url = new URL(urlValue);
     const transport = url.protocol === 'https:' ? https : http;
-    const requestHeaders = Object.assign({
+    const request = transport.request(url, Object.assign({}, requestOptions || {}, {
-      Accept: 'application/json, text/plain;q=0.9, */*;q=0.8',
+      method: method,
-      'User-Agent': 'Pulse Signage API Reader'
+      headers: headers
-    }, extraHeaders);
-    const request = transport.get(url, Object.assign({}, requestOptions || {}, {
-      headers: requestHeaders
     }), function (response) {
       response.setEncoding('utf8');
       let body = '';
@@ -129,15 +144,126 @@ async function loadUrlText(urlValue, requestOptions) {
       response.on('error', reject);
     });
 
+    if (body !== undefined && method !== 'GET' && method !== 'HEAD') {
+      request.write(body);
+    }
+    request.end();
     request.on('error', reject);
   });
 }
 
+function parseJsonRequestBody(value, fieldName) {
+  const text = String(value || '').trim();
+  if (!text) {
+    return undefined;
+  }
+  try {
+    return JSON.parse(text);
+  } catch (_error) {
+    const error = new Error(fieldName + ' must contain valid JSON.');
+    error.statusCode = 400;
+    throw error;
+  }
+}
+
+function resolveResponsePath(value, responsePath) {
+  let current = value;
+  String(responsePath || '').split('.').forEach(function (segment) {
+    if (current === undefined || current === null) {
+      current = undefined;
+      return;
+    }
+    current = current[segment];
+  });
+  return current;
+}
+
+function getTokenCacheKey(source) {
+  return JSON.stringify([
+    source && source.id || '',
+    source && (source.token_url || source.tokenUrl) || '',
+    source && (source.token_request_body_json || source.tokenRequestBodyJson) || '',
+    source && (source.token_response_path || source.tokenResponsePath) || 'access_token',
+    source && (source.token_header_name || source.tokenHeaderName) || 'Authorization',
+    source && (source.token_header_prefix || source.tokenHeaderPrefix) || 'Bearer'
+  ]);
+}
+
+function clearCachedToken(source) {
+  tokenCache.delete(getTokenCacheKey(source));
+}
+
+async function fetchLoginToken(source) {
+  const cacheKey = getTokenCacheKey(source);
+  const cached = tokenCache.get(cacheKey);
+  if (cached && cached.expiresAt > Date.now()) {
+    return cached.value;
+  }
+
+  const tokenUrl = source.token_url || source.tokenUrl;
+  const tokenBody = parseJsonRequestBody(source.token_request_body_json || source.tokenRequestBodyJson, 'Login request body');
+  const tokenHeaders = { 'Content-Type': 'application/json' };
+  const response = await loadUrlText(tokenUrl, {
+    method: 'POST',
+    headers: tokenHeaders,
+    body: tokenBody === undefined ? undefined : JSON.stringify(tokenBody)
+  });
+  if (!response.ok) {
+    throw new Error(`Unable to obtain API token (${response.statusCode}).`);
+  }
+
+  let parsed;
+  try {
+    parsed = JSON.parse(String(response.bodyText || '').trim());
+  } catch (_error) {
+    throw new Error('Token response was not valid JSON.');
+  }
+
+  const tokenPath = source.token_response_path || source.tokenResponsePath || 'access_token';
+  const token = resolveResponsePath(parsed, tokenPath);
+  if (token === undefined || token === null || String(token).trim() === '') {
+    throw new Error('Token response did not contain a token at the configured path.');
+  }
+
+  const expiresIn = Number(parsed && (parsed.expires_in || parsed.expiresIn));
+  const lifetimeMs = Number.isFinite(expiresIn) && expiresIn > 0
+    ? Math.max(30000, expiresIn * 1000 - 60000)
+    : 300000;
+  tokenCache.set(cacheKey, { value: String(token), expiresAt: Date.now() + lifetimeMs });
+  return String(token);
+}
+
+async function buildRequestHeaders(source) {
+  const method = normalizeAuthMethod(source && (source.auth_method || source.authMethod));
+  if (method !== 'token_login') {
+    return buildAuthHeaders(source);
+  }
+
+  const token = await fetchLoginToken(source);
+  const headerName = String(source.token_header_name || source.tokenHeaderName || 'Authorization').trim() || 'Authorization';
+  const prefix = String(source.token_header_prefix || source.tokenHeaderPrefix || 'Bearer').trim();
+  return { [headerName]: prefix ? prefix + ' ' + token : token };
+}
+
 async function fetchApiSourceResponse(apiSource) {
   const source = apiSource && typeof apiSource === 'object' ? apiSource : { api_url: apiSource };
-  const response = await loadUrlText(source.api_url, {
+  const requestMethod = normalizeRequestMethod(source.request_method || source.requestMethod);
-    headers: buildAuthHeaders(source)
+  const requestBody = parseJsonRequestBody(source.request_body_json || source.requestBodyJson, 'API request body');
+  let response;
+  let tokenRetry = false;
+  do {
+    response = await loadUrlText(source.api_url || source.apiUrl, {
+      method: requestMethod,
+      headers: Object.assign({}, await buildRequestHeaders(source), requestBody === undefined ? {} : { 'Content-Type': 'application/json' }),
+      body: requestBody === undefined ? undefined : JSON.stringify(requestBody)
     });
+    if (response.statusCode === 401 && normalizeAuthMethod(source.auth_method || source.authMethod) === 'token_login' && !tokenRetry) {
+      clearCachedToken(source);
+      tokenRetry = true;
+    } else {
+      break;
+    }
+  } while (true);
   if (!response.ok) {
     throw new Error(`Unable to load API response (${response.statusCode}).`);
   }
@@ -171,15 +297,22 @@ function buildApiSourcePayload(req, existingApiSource) {
     return fallbackValue;
   }
 
-  const name = String(req.body.name || fallback.name || '').trim();
+  const name = validateMaxLength(req.body.name || fallback.name || '', NAME_MAX_LENGTH, 'API source name');
-  const apiUrl = String(req.body.api_url || req.body.apiUrl || fallback.api_url || '').trim();
+  const apiUrl = validateMaxLength(req.body.api_url || req.body.apiUrl || fallback.api_url || '', URL_MAX_LENGTH, 'API source URL');
   const authMethod = normalizeAuthMethod(readBodyValue('auth_method', readBodyValue('authMethod', fallback.auth_method || 'none')));
-  const authUsername = String(readBodyValue('auth_username', readBodyValue('authUsername', fallback.auth_username || '')) || '').trim();
+  const requestMethod = normalizeRequestMethod(readBodyValue('request_method', readBodyValue('requestMethod', fallback.request_method || 'GET')));
-  const authPassword = String(readBodyValue('auth_password', readBodyValue('authPassword', fallback.auth_password || '')) || '');
+  const requestBodyJson = validateMaxLength(readBodyValue('request_body_json', readBodyValue('requestBodyJson', fallback.request_body_json || '')) || '', REQUEST_BODY_MAX_LENGTH, 'API request body');
-  const authBearerToken = String(readBodyValue('auth_bearer_token', readBodyValue('authBearerToken', fallback.auth_bearer_token || '')) || '').trim();
+  const authUsername = validateMaxLength(readBodyValue('auth_username', readBodyValue('authUsername', fallback.auth_username || '')) || '', AUTH_MAX_LENGTH, 'API source username');
-  const authHeaderName = String(readBodyValue('auth_header_name', readBodyValue('authHeaderName', fallback.auth_header_name || 'X-API-Key')) || 'X-API-Key').trim() || 'X-API-Key';
+  const authPassword = validateMaxLength(readBodyValue('auth_password', readBodyValue('authPassword', fallback.auth_password || '')) || '', AUTH_MAX_LENGTH, 'API source password');
-  const authHeaderValue = String(readBodyValue('auth_header_value', readBodyValue('authHeaderValue', fallback.auth_header_value || '')) || '').trim();
+  const authBearerToken = validateMaxLength(readBodyValue('auth_bearer_token', readBodyValue('authBearerToken', fallback.auth_bearer_token || '')) || '', AUTH_MAX_LENGTH, 'API source bearer token');
-  const itemsPath = String(readBodyValue('items_path', readBodyValue('itemsPath', fallback.items_path || '')) || '').trim();
+  const authHeaderName = validateMaxLength(readBodyValue('auth_header_name', readBodyValue('authHeaderName', fallback.auth_header_name || 'X-API-Key')) || 'X-API-Key', AUTH_MAX_LENGTH, 'API source header name') || 'X-API-Key';
+  const authHeaderValue = validateMaxLength(readBodyValue('auth_header_value', readBodyValue('authHeaderValue', fallback.auth_header_value || '')) || '', AUTH_MAX_LENGTH, 'API source header value');
+  const tokenUrl = validateMaxLength(readBodyValue('token_url', readBodyValue('tokenUrl', fallback.token_url || '')) || '', TOKEN_URL_MAX_LENGTH, 'API token URL');
+  const tokenRequestBodyJson = validateMaxLength(readBodyValue('token_request_body_json', readBodyValue('tokenRequestBodyJson', fallback.token_request_body_json || '')) || '', REQUEST_BODY_MAX_LENGTH, 'Login request body');
+  const tokenResponsePath = validateMaxLength(readBodyValue('token_response_path', readBodyValue('tokenResponsePath', fallback.token_response_path || 'access_token')) || 'access_token', TOKEN_RESPONSE_PATH_MAX_LENGTH, 'Token response path');
+  const tokenHeaderName = validateMaxLength(readBodyValue('token_header_name', readBodyValue('tokenHeaderName', fallback.token_header_name || 'Authorization')) || 'Authorization', AUTH_MAX_LENGTH, 'Token header name');
+  const tokenHeaderPrefix = validateMaxLength(readBodyValue('token_header_prefix', readBodyValue('tokenHeaderPrefix', fallback.token_header_prefix || 'Bearer')) || '', TOKEN_HEADER_PREFIX_MAX_LENGTH, 'Token prefix');
+  const itemsPath = validateMaxLength(readBodyValue('items_path', readBodyValue('itemsPath', fallback.items_path || '')) || '', ITEMS_PATH_MAX_LENGTH, 'API source items path');
   const updateIntervalValue = Math.max(1, Number(req.body.update_interval_value || req.body.updateIntervalValue || fallback.update_interval_value || 60));
   const updateIntervalUnit = normalizeUpdateIntervalUnit(req.body.update_interval_unit || req.body.updateIntervalUnit || fallback.update_interval_unit || 'minutes');
 
@@ -234,15 +367,48 @@ function buildApiSourcePayload(req, existingApiSource) {
     throw error;
   }
 
+  parseJsonRequestBody(requestBodyJson, 'API request body');
+  parseJsonRequestBody(tokenRequestBodyJson, 'Login request body');
+
+  if (authMethod === 'token_login') {
+    if (!tokenUrl) {
+      const error = new Error('Token login requires a login URL.');
+      error.statusCode = 400;
+      throw error;
+    }
+    try {
+      const tokenParsedUrl = new URL(tokenUrl);
+      if (tokenParsedUrl.protocol !== 'http:' && tokenParsedUrl.protocol !== 'https:') {
+        throw new Error('invalid protocol');
+      }
+    } catch (_error) {
+      const error = new Error('Enter a valid API token URL.');
+      error.statusCode = 400;
+      throw error;
+    }
+    if (!tokenRequestBodyJson) {
+      const error = new Error('Token login requires a JSON request body.');
+      error.statusCode = 400;
+      throw error;
+    }
+  }
+
   return {
     name: name,
     apiUrl: parsedUrl.toString(),
+    requestMethod: requestMethod,
+    requestBodyJson: requestBodyJson,
     authMethod: authMethod,
     authUsername: authUsername,
     authPassword: authPassword,
     authBearerToken: authBearerToken,
     authHeaderName: authHeaderName,
     authHeaderValue: authHeaderValue,
+    tokenUrl: tokenUrl,
+    tokenRequestBodyJson: tokenRequestBodyJson,
+    tokenResponsePath: tokenResponsePath,
+    tokenHeaderName: tokenHeaderName,
+    tokenHeaderPrefix: tokenHeaderPrefix,
     itemsPath: itemsPath,
     updateIntervalValue: Math.floor(updateIntervalValue),
     updateIntervalUnit: updateIntervalUnit

src/data/app-settings.js

@@ -0,0 +1,209 @@
+const { DEFAULT_ANNOUNCEMENT_ICON_KEYS } = require('./announcement-icons');
+
+const SETTING_DEFINITIONS = [
+  { key: 'app.name', type: 'string', defaultValue: 'Pulse Signage' },
+  { key: 'locale.timezone', type: 'string', defaultValue: 'Europe/London' },
+  { key: 'locale.language', type: 'string', defaultValue: 'en' },
+  { key: 'ui.theme', type: 'enum', values: ['dark', 'light', 'auto'], defaultValue: 'dark' },
+  { key: 'security.session_lifetime_days', type: 'integer', min: 1, defaultValue: 14 },
+  { key: 'security.allow_user_session_revocation', type: 'boolean', defaultValue: true },
+  { key: 'security.max_active_sessions', type: 'integer', min: 0, defaultValue: 0 },
+  { key: 'security.password_min_length', type: 'integer', min: 8, defaultValue: 10 },
+  { key: 'security.password_min_categories', type: 'integer', min: 1, defaultValue: 3 },
+  { key: 'security.password_require_lowercase', type: 'boolean', defaultValue: false },
+  { key: 'security.password_require_uppercase', type: 'boolean', defaultValue: false },
+  { key: 'security.password_require_number', type: 'boolean', defaultValue: false },
+  { key: 'security.password_require_symbol', type: 'boolean', defaultValue: false },
+  { key: 'security.require_password_change_for_new_users', type: 'boolean', defaultValue: true },
+  { key: 'security.require_password_change_after_admin_reset', type: 'boolean', defaultValue: true },
+  { key: 'security.login_max_attempts', type: 'integer', min: 1, defaultValue: 5 },
+  { key: 'security.login_lockout_minutes', type: 'integer', min: 1, defaultValue: 15 },
+  { key: 'security.login_rate_limit_scope', type: 'enum', values: ['both', 'username', 'ip'], defaultValue: 'both' },
+  { key: 'audit.enabled', type: 'boolean', defaultValue: true },
+  { key: 'audit.categories', type: 'string_array', defaultValue: ['authentication', 'security', 'sessions', 'users', 'roles', 'system-settings'] },
+  { key: 'audit.include_request_metadata', type: 'boolean', defaultValue: true },
+  { key: 'audit.retention_days', type: 'integer', min: 0, defaultValue: 180 },
+  { key: 'uploads.image_max_bytes', type: 'integer', min: 1, defaultValue: 100 * 1024 * 1024 },
+  { key: 'uploads.video_max_bytes', type: 'integer', min: 1, defaultValue: 1024 * 1024 * 1024 },
+  { key: 'uploads.wysiwyg_image_max_bytes', type: 'integer', min: 1, defaultValue: 2 * 1024 * 1024 },
+  { key: 'uploads.allowed_mime_types', type: 'string_array', defaultValue: ['image/png', 'image/jpeg', 'image/gif', 'image/webp', 'image/svg+xml', 'video/mp4', 'video/webm', 'video/ogg'] },
+  { key: 'uploads.cleanup_days', type: 'integer', min: 0, defaultValue: 30 },
+  { key: 'uploads.optimize_images', type: 'boolean', defaultValue: true },
+  { key: 'announcements.default_icon', type: 'string', defaultValue: 'megaphone-fill' },
+  { key: 'announcements.default_duration_value', type: 'integer', min: 1, defaultValue: 10 },
+  { key: 'announcements.default_duration_unit', type: 'enum', values: ['seconds', 'minutes'], defaultValue: 'seconds' },
+  { key: 'announcements.suggested_icons', type: 'string_array', defaultValue: DEFAULT_ANNOUNCEMENT_ICON_KEYS.slice() },
+  { key: 'player.default_slide_duration_seconds', type: 'integer', min: 1, defaultValue: 10 },
+  { key: 'player.default_fade_between_slides', type: 'boolean', defaultValue: true },
+  { key: 'player.skip_unavailable_rtmp', type: 'boolean', defaultValue: true }
+  ,{ key: 'data-sources.rss_default_interval_value', type: 'integer', min: 1, defaultValue: 60 }
+  ,{ key: 'data-sources.rss_default_interval_unit', type: 'enum', values: ['seconds', 'minutes', 'hours'], defaultValue: 'minutes' }
+  ,{ key: 'data-sources.api_default_interval_value', type: 'integer', min: 1, defaultValue: 60 }
+  ,{ key: 'data-sources.api_default_interval_unit', type: 'enum', values: ['seconds', 'minutes', 'hours'], defaultValue: 'minutes' }
+  ,{ key: 'weather.open_meteo_api_key', type: 'string', defaultValue: '' }
+  ,{ key: 'weather.pirate_weather_api_key', type: 'string', defaultValue: '' }
+];
+
+const DEFINITIONS_BY_KEY = new Map(SETTING_DEFINITIONS.map(function (definition) {
+  return [definition.key, definition];
+}));
+
+function cloneValue(value) {
+  if (Array.isArray(value)) {
+    return value.slice();
+  }
+  return value;
+}
+
+function getAppSettingDefinitions() {
+  return SETTING_DEFINITIONS.map(function (definition) {
+    return Object.assign({}, definition, {
+      values: definition.values ? definition.values.slice() : undefined,
+      defaultValue: cloneValue(definition.defaultValue)
+    });
+  });
+}
+
+function getDefaultAppSettings() {
+  return SETTING_DEFINITIONS.reduce(function (settings, definition) {
+    settings[definition.key] = cloneValue(definition.defaultValue);
+    return settings;
+  }, {});
+}
+
+function normalizeSettingValue(key, value) {
+  const definition = DEFINITIONS_BY_KEY.get(String(key || '').trim());
+  if (!definition) {
+    throw new Error('Unknown application setting: ' + key);
+  }
+
+  if (definition.type === 'string') {
+    return String(value == null ? '' : value).trim();
+  }
+
+  if (definition.type === 'integer') {
+    const normalized = Number(value);
+    if (!Number.isInteger(normalized) || normalized < definition.min) {
+      throw new Error('Invalid value for application setting: ' + definition.key);
+    }
+    return normalized;
+  }
+
+  if (definition.type === 'boolean') {
+    if (value === true || value === 1 || value === '1' || value === 'true') {
+      return true;
+    }
+    if (value === false || value === 0 || value === '0' || value === 'false') {
+      return false;
+    }
+    throw new Error('Invalid value for application setting: ' + definition.key);
+  }
+
+  if (definition.type === 'enum') {
+    const normalized = String(value == null ? '' : value).trim();
+    if (!definition.values.includes(normalized)) {
+      throw new Error('Invalid value for application setting: ' + definition.key);
+    }
+    return normalized;
+  }
+
+  if (definition.type === 'string_array') {
+    if (!Array.isArray(value)) {
+      throw new Error('Invalid value for application setting: ' + definition.key);
+    }
+    return Array.from(new Set(value.map(function (item) {
+      return String(item || '').trim();
+    }).filter(Boolean)));
+  }
+
+  throw new Error('Unsupported application setting type: ' + definition.type);
+}
+
+function normalizeAppSettings(settings) {
+  const input = settings && typeof settings === 'object' ? settings : {};
+  return SETTING_DEFINITIONS.reduce(function (normalized, definition) {
+    const value = Object.prototype.hasOwnProperty.call(input, definition.key)
+      ? input[definition.key]
+      : definition.defaultValue;
+    normalized[definition.key] = normalizeSettingValue(definition.key, value);
+    return normalized;
+  }, {});
+}
+
+function parseStoredValue(value) {
+  if (typeof value !== 'string') {
+    return value;
+  }
+  try {
+    return JSON.parse(value);
+  } catch (_error) {
+    return value;
+  }
+}
+
+async function fetchAppSettings(pool) {
+  const [rows] = await pool.query('SELECT id, setting_key, setting_value FROM o_app_settings ORDER BY setting_key');
+  const storedSettings = {};
+  (rows || []).forEach(function (row) {
+    const key = String(row && row.setting_key || '').trim();
+    if (DEFINITIONS_BY_KEY.has(key)) {
+      storedSettings[key] = parseStoredValue(row.setting_value);
+    }
+  });
+  return normalizeAppSettings(Object.assign({}, getDefaultAppSettings(), storedSettings));
+}
+
+async function saveAppSettings(pool, settings, modifiedBy) {
+  const inputSettings = settings && typeof settings === 'object' ? settings : {};
+  const normalizedSettings = normalizeAppSettings(inputSettings);
+  const connection = typeof pool.getConnection === 'function' ? await pool.getConnection() : pool;
+  const shouldRelease = connection !== pool;
+
+  try {
+    if (typeof connection.beginTransaction === 'function') {
+      await connection.beginTransaction();
+    }
+    for (const definition of SETTING_DEFINITIONS) {
+      if (!Object.prototype.hasOwnProperty.call(inputSettings, definition.key)) {
+        continue;
+      }
+      await connection.query(
+        `UPDATE o_app_settings
+            SET setting_value = ?, modified_by = ?
+          WHERE setting_key = ?`,
+        [JSON.stringify(normalizedSettings[definition.key]), modifiedBy || null, definition.key]
+      );
+      await connection.query(
+        `INSERT INTO o_app_settings (setting_key, setting_value, created_by, modified_by)
+         SELECT ?, ?, ?, ?
+          WHERE NOT EXISTS (
+            SELECT 1 FROM o_app_settings WHERE setting_key = ?
+          )`,
+        [definition.key, JSON.stringify(normalizedSettings[definition.key]), modifiedBy || null, modifiedBy || null, definition.key]
+      );
+    }
+    if (typeof connection.commit === 'function') {
+      await connection.commit();
+    }
+  } catch (error) {
+    if (typeof connection.rollback === 'function') {
+      await connection.rollback();
+    }
+    throw error;
+  } finally {
+    if (shouldRelease && typeof connection.release === 'function') {
+      connection.release();
+    }
+  }
+
+  return normalizedSettings;
+}
+
+module.exports = {
+  getAppSettingDefinitions,
+  getDefaultAppSettings,
+  normalizeSettingValue,
+  normalizeAppSettings,
+  fetchAppSettings,
+  saveAppSettings
+};

src/data/audit-log.js

@@ -0,0 +1,118 @@
+const AUDIT_EVENT_CATEGORIES = Object.freeze({
+  AUTHENTICATION: 'authentication',
+  SECURITY: 'security',
+  SESSIONS: 'sessions',
+  USERS: 'users',
+  ROLES: 'roles',
+  SETTINGS: 'system-settings',
+  SLIDES: 'slides',
+  TEMPLATES: 'templates',
+  PLAYLISTS: 'playlists',
+  SCREENS: 'screens',
+  ANNOUNCEMENTS: 'announcements',
+  CANVAS_SIZES: 'canvas-sizes',
+  API_SOURCES: 'api-sources',
+  RSS_FEEDS: 'rss-feeds',
+  TIMETABLES: 'timetables'
+});
+const AUDIT_CATEGORY_KEYS = Object.freeze(Object.values(AUDIT_EVENT_CATEGORIES));
+const AUDIT_CATEGORY_LABELS = Object.freeze({
+  authentication: 'Authentication',
+  security: 'Security',
+  sessions: 'Sessions',
+  users: 'Users',
+  roles: 'Roles',
+  'system-settings': 'System Settings',
+  slides: 'Slides',
+  templates: 'Templates',
+  playlists: 'Playlists',
+  screens: 'Screens',
+  announcements: 'Announcements',
+  'canvas-sizes': 'Canvas Sizes',
+  'api-sources': 'API Sources',
+  'rss-feeds': 'RSS Feeds',
+  timetables: 'Timetables'
+});
+const { fetchAppSettings } = require('./app-settings');
+
+function normalizeDetails(details) {
+  if (details === undefined || details === null) {
+    return null;
+  }
+  return JSON.stringify(details);
+}
+
+function buildAuditChanges(previousValues, nextValues) {
+  const previous = previousValues && typeof previousValues === 'object' ? previousValues : {};
+  const next = nextValues && typeof nextValues === 'object' ? nextValues : {};
+  const changes = {};
+  const keys = new Set(Object.keys(previous).concat(Object.keys(next)));
+
+  keys.forEach(function (key) {
+    if (JSON.stringify(previous[key]) !== JSON.stringify(next[key])) {
+      changes[key] = { from: previous[key], to: next[key] };
+    }
+  });
+
+  return changes;
+}
+
+function getRequestMetadata(req) {
+  const forwardedAddress = String(req && req.headers && req.headers['x-forwarded-for'] || '').split(',')[0].trim();
+  return {
+    ipAddress: forwardedAddress || String(req && req.ip || req && req.socket && req.socket.remoteAddress || '').trim() || null,
+    userAgent: String(req && req.headers && req.headers['user-agent'] || '').trim() || null
+  };
+}
+
+async function recordAuditEvent(pool, event) {
+  const input = event && typeof event === 'object' ? event : {};
+  const category = String(input.category || '').trim().toLowerCase();
+  const eventType = String(input.eventType || '').trim().toLowerCase();
+  if (!category || !eventType) {
+    throw new Error('Audit events require a category and event type.');
+  }
+
+  await pool.query(
+    `INSERT INTO o_audit_events
+      (category, event_type, actor_user_id, target_type, target_id, target_label, ip_address, user_agent, details_json)
+     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+    [
+      category,
+      eventType,
+      Number.isInteger(Number(input.actorUserId)) && Number(input.actorUserId) > 0 ? Number(input.actorUserId) : null,
+      String(input.targetType || '').trim() || null,
+      String(input.targetId || '').trim() || null,
+      String(input.targetLabel || '').trim() || null,
+      String(input.ipAddress || '').trim() || null,
+      String(input.userAgent || '').trim() || null,
+      normalizeDetails(input.details)
+    ]
+  );
+}
+
+async function recordRequestAuditEvent(pool, req, event) {
+  try {
+    const settings = await fetchAppSettings(pool);
+    const category = String(event && event.category || '').trim().toLowerCase();
+    const enabledCategories = Array.isArray(settings['audit.categories']) ? settings['audit.categories'] : AUDIT_CATEGORY_KEYS;
+    if (!settings['audit.enabled'] || !enabledCategories.includes(category)) {
+      return;
+    }
+    const metadata = settings['audit.include_request_metadata'] ? getRequestMetadata(req) : {};
+    await recordAuditEvent(pool, Object.assign({}, event, metadata));
+  } catch (error) {
+    // Auditing must not turn a successful login or administration action into a failed request.
+    console.error('Unable to record audit event:', error.message);
+  }
+}
+
+module.exports = {
+  AUDIT_EVENT_CATEGORIES,
+  AUDIT_CATEGORY_KEYS,
+  AUDIT_CATEGORY_LABELS,
+  getRequestMetadata,
+  buildAuditChanges,
+  recordAuditEvent,
+  recordRequestAuditEvent
+};

src/data/canvas-sizes.js

@@ -1,6 +1,7 @@
 // Canvas size data access and pagination helpers.
 
 const { fetchPagedRows } = require('./utils');
+const MAX_CANVAS_SIZE_DIMENSION = 16384;
 
 async function fetchCanvasSizesData(pool) {
   const [canvasSizes] = await pool.query('SELECT id, name, width, height, created_at, modified_at, created_by, modified_by FROM c_canvas_sizes ORDER BY width ASC, height ASC, name ASC');
@@ -33,10 +34,31 @@ async function fetchCanvasSizeById(pool, id) {
   return rows[0] || null;
 }
 
+function readCanvasDimension(rawValue, fallbackValue, fieldName) {
+  const sourceValue = rawValue !== undefined && rawValue !== null && String(rawValue).trim() !== ''
+    ? rawValue
+    : fallbackValue;
+  const numericValue = Number(sourceValue);
+
+  if (!Number.isFinite(numericValue)) {
+    const error = new Error('Canvas size ' + fieldName + ' must be a number.');
+    error.statusCode = 400;
+    throw error;
+  }
+
+  if (numericValue > MAX_CANVAS_SIZE_DIMENSION) {
+    const error = new Error('Canvas size dimensions must be 16384 or less.');
+    error.statusCode = 400;
+    throw error;
+  }
+
+  return Math.max(1, numericValue);
+}
+
 function buildCanvasSizePayload(req, existingCanvasSize) {
   const name = String(req.body.name || '').trim();
-  const width = Math.max(1, Number(req.body.width || (existingCanvasSize && existingCanvasSize.width) || 0));
+  const width = readCanvasDimension(req.body.width, existingCanvasSize && existingCanvasSize.width, 'width');
-  const height = Math.max(1, Number(req.body.height || (existingCanvasSize && existingCanvasSize.height) || 0));
+  const height = readCanvasDimension(req.body.height, existingCanvasSize && existingCanvasSize.height, 'height');
 
   if (!name) {
     const error = new Error('Canvas size name is required.');
@@ -55,5 +77,6 @@ module.exports = {
   fetchCanvasSizesData,
   fetchCanvasSizesPage,
   fetchCanvasSizeById,
-  buildCanvasSizePayload
+  buildCanvasSizePayload,
+  MAX_CANVAS_SIZE_DIMENSION
 };

src/data/index.js

@@ -4,18 +4,23 @@ const { fetchAdminData, fetchPlaylistsPage, fetchSlidesPage, fetchTemplatesPage,
 const { ANNOUNCEMENT_TYPES, ANNOUNCEMENT_COLORS, ANNOUNCEMENT_ICONS, DEFAULT_ANNOUNCEMENT_ICON, normalizeAnnouncementType, normalizeAnnouncementColor, normalizeAnnouncementIcon, fetchAnnouncementsPage, fetchAnnouncementById, fetchActiveAnnouncement, buildAnnouncementPayload } = require('./announcements');
 const { ANNOUNCEMENT_ICON_OPTIONS, ANNOUNCEMENT_ICON_LABELS } = require('./announcement-icons');
 const { fetchPlaylistById } = require('./playlists');
+const { normalizeDisplayMode, fetchTimetablesData, fetchTimetableGroupsPage, fetchTimetableGroupById, fetchTimetableEntriesByGroupId, buildTimetableGroupPayload } = require('./timetables');
 const { fetchApiSourcesData, fetchApiSourcesPage, fetchApiSourceById, fetchApiSourceResponse, buildApiSourcePayload } = require('./api-sources');
 const { fetchRssFeedsData, fetchRssFeedsPage, fetchRssFeedById, fetchRssFeedItemsByFeedId, normalizeRssFeedItem, buildRssFeedPayload, fetchRssFeedItems, replaceRssFeedItems } = require('./rss-feeds');
-const { slugify, uniqueScreenSlug, fetchScreenById, fetchScreenEditData, fetchScreenPlayerUrls, fetchScreenPlayerRecord } = require('./screens');
+const { fetchWeatherLocationsData, fetchWeatherLocationsPage, fetchWeatherLocationById, fetchWeatherLocationSuggestions, fetchWeatherLocationForecast, buildWeatherLocationPayload } = require('./weather');
+const { slugify, uniqueScreenSlug, fetchScreenById, fetchScreenEditData, fetchScreenPlayerUrls, fetchPlayerPublicBaseUrl, fetchScreenPlayerRecord, fetchPlayerRecordByIdentifier } = require('./screens');
+const { fetchPlayerRegistrations } = require('./player-registry');
 const { fetchTemplateById, fetchTemplatesData, extractTemplateRegions, buildTemplatePayload } = require('./templates');
-const { fetchCanvasSizesData, fetchCanvasSizeById, buildCanvasSizePayload } = require('./canvas-sizes');
+const { fetchCanvasSizesData, fetchCanvasSizeById, buildCanvasSizePayload, MAX_CANVAS_SIZE_DIMENSION } = require('./canvas-sizes');
 const { fetchSlideById, buildSlidePayload } = require('./slides');
-const { parseJsonSafe, fetchDuplicateName } = require('./utils');
+const { parseJsonSafe, fetchDuplicateName, validateMaxLength, truncateToMaxLength } = require('./utils');
 
 module.exports = {
   slugify,
   uniqueScreenSlug,
   parseJsonSafe,
+  validateMaxLength,
+  truncateToMaxLength,
   fetchAdminData,
   fetchPlaylistsPage,
   fetchSlidesPage,
@@ -36,6 +41,12 @@ module.exports = {
   fetchActiveAnnouncement,
   buildAnnouncementPayload,
   fetchPlaylistById,
+  normalizeDisplayMode,
+  fetchTimetablesData,
+  fetchTimetableGroupsPage,
+  fetchTimetableGroupById,
+  fetchTimetableEntriesByGroupId,
+  buildTimetableGroupPayload,
   fetchApiSourcesData,
   fetchApiSourcesPage,
   fetchApiSourceById,
@@ -49,16 +60,26 @@ module.exports = {
   buildRssFeedPayload,
   fetchRssFeedItems,
   replaceRssFeedItems,
+  fetchWeatherLocationsData,
+  fetchWeatherLocationsPage,
+  fetchWeatherLocationById,
+  fetchWeatherLocationSuggestions,
+  fetchWeatherLocationForecast,
+  buildWeatherLocationPayload,
   fetchScreenById,
   fetchScreenEditData,
   fetchScreenPlayerUrls,
+  fetchPlayerPublicBaseUrl,
   fetchScreenPlayerRecord,
+  fetchPlayerRecordByIdentifier,
+  fetchPlayerRegistrations,
   fetchTemplateById,
   fetchSlideById,
   fetchTemplatesData,
   fetchCanvasSizesData,
   fetchCanvasSizeById,
   buildCanvasSizePayload,
+  MAX_CANVAS_SIZE_DIMENSION,
   buildSlidePayload,
   extractTemplateRegions,
   buildTemplatePayload,

src/data/player-registry.js

@@ -0,0 +1,151 @@
+function normalizeDeviceId(value) {
+  return String(value || '')
+    .trim()
+    .replace(/[^a-zA-Z0-9_-]/g, '')
+    .slice(0, 128);
+}
+
+function normalizeBaseUrl(value) {
+  return String(value || '').trim().replace(/\/$/, '');
+}
+
+function normalizeIdentifier(value) {
+  return String(value || '').trim().slice(0, 255);
+}
+
+async function columnExists(pool, tableName, columnName) {
+  const [rows] = await pool.query(
+    `SELECT COUNT(*) AS column_count
+     FROM information_schema.COLUMNS
+     WHERE TABLE_SCHEMA = DATABASE()
+       AND TABLE_NAME = ?
+       AND COLUMN_NAME = ?`,
+    [tableName, columnName]
+  );
+
+  return Number(rows && rows[0] && rows[0].column_count) > 0;
+}
+
+async function fetchPlayerRegistrations(pool) {
+  if (!pool) {
+    return [];
+  }
+
+  const [rows] = await pool.query(
+    `SELECT id, identifier, public_base_url, internal_base_url, last_seen_at, modified_at
+     FROM d_players
+     ORDER BY modified_at DESC, identifier ASC`
+  );
+
+  return rows;
+}
+
+function getConfiguredPlayerIdentifier() {
+  return normalizeDeviceId(process.env.PLAYER_IDENTIFIER || process.env.PLAYER_DEVICE_ID || '');
+}
+
+async function resolvePlayerRegistration(pool, identifier) {
+  const normalizedIdentifier = normalizeDeviceId(identifier);
+  if (!pool || !normalizedIdentifier) {
+    return null;
+  }
+
+  const hasIdentifierColumn = await columnExists(pool, 'd_players', 'identifier');
+  const hasDeviceIdColumn = await columnExists(pool, 'd_players', 'device_id');
+  const identifierColumn = hasIdentifierColumn ? 'identifier' : (hasDeviceIdColumn ? 'device_id' : '');
+  if (!identifierColumn) {
+    return null;
+  }
+
+  const selectIdExpression = hasIdentifierColumn ? 'id' : 'NULL AS id';
+  const selectIdentifierExpression = hasIdentifierColumn ? 'identifier' : 'device_id AS identifier';
+  const orderByExpression = hasIdentifierColumn ? 'modified_at DESC, id DESC' : 'modified_at DESC';
+
+  const [rows] = await pool.query(
+    `SELECT ${selectIdExpression}, ${selectIdentifierExpression}, public_base_url, internal_base_url, last_seen_at
+     FROM d_players
+     WHERE ${identifierColumn} = ?
+     LIMIT 1`,
+    [normalizedIdentifier]
+  );
+
+  if (rows[0]) {
+    return rows[0];
+  }
+
+  const [fallbackRows] = await pool.query(
+    `SELECT ${selectIdExpression}, ${selectIdentifierExpression}, public_base_url, internal_base_url, last_seen_at
+     FROM d_players
+     ORDER BY ${orderByExpression}
+     LIMIT 1`
+  );
+
+  return fallbackRows[0] || null;
+}
+
+async function upsertPlayerRegistration(pool, options) {
+  const identifier = normalizeDeviceId(options && (options.identifier || options.deviceId));
+  const publicBaseUrl = normalizeBaseUrl(options && options.publicBaseUrl);
+  const internalBaseUrl = normalizeBaseUrl(options && options.internalBaseUrl);
+
+  if (!pool || !identifier) {
+    return null;
+  }
+
+  await pool.query(
+    `UPDATE d_players
+        SET public_base_url = ?, internal_base_url = ?, last_seen_at = CURRENT_TIMESTAMP, modified_at = CURRENT_TIMESTAMP
+      WHERE identifier = ?`,
+    [publicBaseUrl || null, internalBaseUrl || null, identifier]
+  );
+  await pool.query(
+    `INSERT INTO d_players (identifier, public_base_url, internal_base_url, last_seen_at)
+     SELECT ?, ?, ?, CURRENT_TIMESTAMP
+      WHERE NOT EXISTS (
+        SELECT 1 FROM d_players WHERE identifier = ?
+      )`,
+    [identifier, publicBaseUrl || null, internalBaseUrl || null, identifier]
+  );
+
+  return resolvePlayerRegistration(pool, identifier);
+}
+
+async function recordPlayerHeartbeat(pool, options) {
+  const identifier = normalizeDeviceId(options && (options.identifier || options.deviceId));
+  const publicBaseUrl = normalizeBaseUrl(options && options.publicBaseUrl);
+  const internalBaseUrl = normalizeBaseUrl(options && options.internalBaseUrl);
+
+  if (!pool || !identifier) {
+    return null;
+  }
+
+  await pool.query(
+    `UPDATE d_players
+        SET public_base_url = COALESCE(?, public_base_url),
+            internal_base_url = COALESCE(?, internal_base_url),
+            last_seen_at = CURRENT_TIMESTAMP,
+            modified_at = CURRENT_TIMESTAMP
+      WHERE identifier = ?`,
+    [publicBaseUrl || null, internalBaseUrl || null, identifier]
+  );
+  await pool.query(
+    `INSERT INTO d_players (identifier, public_base_url, internal_base_url, last_seen_at)
+     SELECT ?, ?, ?, CURRENT_TIMESTAMP
+      WHERE NOT EXISTS (
+        SELECT 1 FROM d_players WHERE identifier = ?
+      )`,
+    [identifier, publicBaseUrl || null, internalBaseUrl || null, identifier]
+  );
+
+  return resolvePlayerRegistration(pool, identifier);
+}
+
+module.exports = {
+  normalizeDeviceId: normalizeDeviceId,
+  normalizeIdentifier: normalizeIdentifier,
+  getConfiguredPlayerIdentifier: getConfiguredPlayerIdentifier,
+  fetchPlayerRegistrations: fetchPlayerRegistrations,
+  resolvePlayerRegistration: resolvePlayerRegistration,
+  upsertPlayerRegistration: upsertPlayerRegistration,
+  recordPlayerHeartbeat: recordPlayerHeartbeat
+};

src/data/playlists.js

@@ -1,7 +1,7 @@
 // Playlist data access helpers.
 
 async function fetchPlaylistById(pool, id) {
-  const [rows] = await pool.query('SELECT id, name, fade_between_slides, skip_unavailable_rtmp, created_at, modified_at, created_by, modified_by FROM c_playlists WHERE id = ?', [id]);
+  const [rows] = await pool.query('SELECT id, name, fade_between_slides, skip_unavailable_rtmp, canvas_id, created_at, modified_at, created_by, modified_by FROM c_playlists WHERE id = ?', [id]);
   return rows[0] || null;
 }
 

src/data/qr-code.js

@@ -0,0 +1,472 @@
+const path = require('path');
+const QRCodeStyling = require(path.join(__dirname, '..', 'web', 'public', 'vendor', 'qr-code-styling', 'qr-code-styling.js'));
+const QR_PNG_WIDTH = 2048;
+
+function escapeXml(value) {
+  return String(value === undefined || value === null ? '' : value).replace(/[&<>"']/g, function (character) {
+    return {
+      '&': '&amp;',
+      '<': '&lt;',
+      '>': '&gt;',
+      '"': '&quot;',
+      "'": '&apos;'
+    }[character];
+  });
+}
+
+function serializeNode(node) {
+  if (!node) {
+    return '';
+  }
+  if (node.nodeType === 3) {
+    return escapeXml(node.textContent || '');
+  }
+
+  const attributeEntries = Object.keys(node.attributes || {}).map(function (name) {
+    return name + '="' + escapeXml(node.attributes[name]) + '"';
+  });
+  if (node.tagName === 'svg' && node.namespaceURI === 'http://www.w3.org/2000/svg' && !Object.prototype.hasOwnProperty.call(node.attributes || {}, 'xmlns')) {
+    attributeEntries.unshift('xmlns="http://www.w3.org/2000/svg"');
+  }
+  const attributes = attributeEntries.join(' ');
+  const children = (node.childNodes || []).map(serializeNode).join('') + escapeXml(node.textContent || '');
+  return '<' + node.tagName + (attributes ? ' ' + attributes : '') + '>' + children + '</' + node.tagName + '>';
+}
+
+function createDomNode(tagName, namespaceUri) {
+  return {
+    tagName: tagName,
+    namespaceURI: namespaceUri || null,
+    attributes: {},
+    childNodes: [],
+    parentNode: null,
+    nodeType: 1,
+    textContent: '',
+    style: {},
+    setAttribute: function (name, value) {
+      this.attributes[name] = String(value);
+    },
+    appendChild: function (child) {
+      if (child) {
+        this.childNodes.push(child);
+        child.parentNode = this;
+      }
+      return child;
+    },
+    removeChild: function (child) {
+      this.childNodes = this.childNodes.filter(function (node) { return node !== child; });
+      return child;
+    },
+    get firstChild() {
+      return this.childNodes[0] || null;
+    },
+    get outerHTML() {
+      return serializeNode(this);
+    }
+  };
+}
+
+function createCanvasContext() {
+  return {
+    fillStyle: '#000000',
+    strokeStyle: '#000000',
+    lineWidth: 1,
+    beginPath: function () {},
+    closePath: function () {},
+    clearRect: function () {},
+    fillRect: function () {},
+    strokeRect: function () {},
+    moveTo: function () {},
+    lineTo: function () {},
+    arc: function () {},
+    rect: function () {},
+    fill: function () {},
+    stroke: function () {},
+    save: function () {},
+    restore: function () {},
+    translate: function () {},
+    rotate: function () {},
+    scale: function () {},
+    setTransform: function () {},
+    transform: function () {},
+    drawImage: function () {},
+    measureText: function (text) {
+      return { width: String(text === undefined || text === null ? '' : text).length * 8 };
+    },
+    createLinearGradient: function () {
+      return { addColorStop: function () {} };
+    },
+    createRadialGradient: function () {
+      return { addColorStop: function () {} };
+    },
+    createPattern: function () {
+      return null;
+    },
+    getImageData: function () {
+      return { data: [] };
+    },
+    putImageData: function () {},
+    clip: function () {}
+  };
+}
+
+function createCanvasNode() {
+  const node = createDomNode('canvas', 'http://www.w3.org/1999/xhtml');
+  node.width = 0;
+  node.height = 0;
+  node.getContext = function () {
+    return createCanvasContext();
+  };
+  node.toDataURL = function () {
+    return '';
+  };
+  node.toBlob = function (callback) {
+    if (typeof callback === 'function') {
+      callback(null);
+    }
+  };
+  return node;
+}
+
+function createQrStylingWindow() {
+  const document = {
+    createElement: function (tagName) {
+      if (String(tagName || '').toLowerCase() === 'canvas') {
+        return createCanvasNode();
+      }
+      return createDomNode(tagName, 'http://www.w3.org/1999/xhtml');
+    },
+    createElementNS: function (namespaceUri, tagName) {
+      return createDomNode(tagName, namespaceUri);
+    },
+    createTextNode: function (text) {
+      return {
+        nodeType: 3,
+        textContent: String(text === undefined || text === null ? '' : text),
+        parentNode: null
+      };
+    },
+    body: createDomNode('body', 'http://www.w3.org/1999/xhtml'),
+    head: createDomNode('head', 'http://www.w3.org/1999/xhtml')
+  };
+
+  const window = {
+    document: document,
+    navigator: { userAgent: 'node' },
+    URL: {
+      createObjectURL: function () { return ''; },
+      revokeObjectURL: function () {}
+    }
+  };
+
+  window.window = window;
+  window.self = window;
+  window.Image = class {
+    constructor() {
+      this.onload = null;
+      this.onerror = null;
+      this.width = 1;
+      this.height = 1;
+      this.naturalWidth = 1;
+      this.naturalHeight = 1;
+      this._src = '';
+    }
+
+    set src(value) {
+      this._src = String(value === undefined || value === null ? '' : value);
+      if (typeof this.onload === 'function') {
+        setTimeout(() => this.onload(), 0);
+      }
+    }
+
+    get src() {
+      return this._src;
+    }
+  };
+  window.HTMLImageElement = window.Image;
+
+  window.XMLSerializer = class {
+    serializeToString(node) {
+      return serializeNode(node);
+    }
+  };
+
+  return { window: window, document: document };
+}
+
+async function renderStyledQrRawData(options, format) {
+  const previousWindow = global.window;
+  const previousDocument = global.document;
+  const previousXMLSerializer = global.XMLSerializer;
+  const dom = createQrStylingWindow();
+
+  global.window = dom.window;
+  global.document = dom.document;
+  global.XMLSerializer = dom.window.XMLSerializer;
+
+  try {
+    const qrCode = new QRCodeStyling(options);
+    const blob = await qrCode.getRawData(format);
+    if (!blob) {
+      return '';
+    }
+
+    if (typeof blob === 'string') {
+      return blob;
+    }
+
+    if (typeof blob.text === 'function') {
+      return blob.text();
+    }
+
+    if (typeof blob.arrayBuffer === 'function') {
+      const buffer = await blob.arrayBuffer();
+      const bytes = new Uint8Array(buffer);
+      let binary = '';
+      for (let index = 0; index < bytes.length; index += 1) {
+        binary += String.fromCharCode(bytes[index]);
+      }
+      return binary;
+    }
+
+    return '';
+  } finally {
+    global.window = previousWindow;
+    global.document = previousDocument;
+    global.XMLSerializer = previousXMLSerializer;
+  }
+}
+
+function svgToDataUrl(svg) {
+  const markup = String(svg === undefined || svg === null ? '' : svg).trim();
+  if (!markup) {
+    return '';
+  }
+
+  return 'data:image/svg+xml;charset=utf-8,' + encodeURIComponent(markup);
+}
+
+function normalizeQrStyleColor(value, fallback) {
+  const raw = String(value === undefined || value === null ? '' : value).trim();
+  return raw || fallback;
+}
+
+function normalizeQrStyleNumber(value, fallback, min, max) {
+  const parsed = Number(value);
+  if (!Number.isFinite(parsed)) {
+    return fallback;
+  }
+
+  let next = parsed;
+  if (typeof min === 'number') {
+    next = Math.max(min, next);
+  }
+  if (typeof max === 'number') {
+    next = Math.min(max, next);
+  }
+  return next;
+}
+
+function buildQrStylingOptions(source) {
+  const text = String(source && source.value === undefined ? '' : source && source.value === null ? '' : source.value || '').trim();
+  const qrStyle = source && typeof source === 'object' ? source : {};
+  const dotsGradient = qrStyle.qr_dots_color_mode === 'gradient' ? {
+    type: String(qrStyle.qr_dots_gradient_type || 'linear').trim() || 'linear',
+    rotation: normalizeQrStyleNumber(qrStyle.qr_dots_gradient_rotation, 0, undefined, undefined),
+    colorStops: [
+      { offset: 0, color: normalizeQrStyleColor(qrStyle.qr_dots_gradient_color_1, normalizeQrStyleColor(qrStyle.qr_dots_color, '#000000')) },
+      { offset: 1, color: normalizeQrStyleColor(qrStyle.qr_dots_gradient_color_2, '#ffffff') }
+    ]
+  } : null;
+  const cornersSquareGradient = qrStyle.qr_corners_square_color_mode === 'gradient' ? {
+    type: String(qrStyle.qr_corners_square_gradient_type || 'linear').trim() || 'linear',
+    rotation: normalizeQrStyleNumber(qrStyle.qr_corners_square_gradient_rotation, 0, undefined, undefined),
+    colorStops: [
+      { offset: 0, color: normalizeQrStyleColor(qrStyle.qr_corners_square_gradient_color_1, normalizeQrStyleColor(qrStyle.qr_corners_square_color, '#000000')) },
+      { offset: 1, color: normalizeQrStyleColor(qrStyle.qr_corners_square_gradient_color_2, '#ffffff') }
+    ]
+  } : null;
+  const cornersDotGradient = qrStyle.qr_corners_dot_color_mode === 'gradient' ? {
+    type: String(qrStyle.qr_corners_dot_gradient_type || 'linear').trim() || 'linear',
+    rotation: normalizeQrStyleNumber(qrStyle.qr_corners_dot_gradient_rotation, 0, undefined, undefined),
+    colorStops: [
+      { offset: 0, color: normalizeQrStyleColor(qrStyle.qr_corners_dot_gradient_color_1, normalizeQrStyleColor(qrStyle.qr_corners_dot_color, '#000000')) },
+      { offset: 1, color: normalizeQrStyleColor(qrStyle.qr_corners_dot_gradient_color_2, '#ffffff') }
+    ]
+  } : null;
+
+  return {
+    width: QR_PNG_WIDTH,
+    height: QR_PNG_WIDTH,
+    type: 'canvas',
+    data: text,
+    margin: normalizeQrStyleNumber(qrStyle.qr_margin, 10, 0, undefined),
+    qrOptions: {},
+    dotsOptions: {
+      type: String(qrStyle.qr_dots_type || 'square').trim() || 'square',
+      color: normalizeQrStyleColor(qrStyle.qr_dots_color, '#000000'),
+      gradient: dotsGradient || undefined
+    },
+    cornersSquareOptions: {
+      type: String(qrStyle.qr_corners_square_type || 'square').trim() || 'square',
+      color: normalizeQrStyleColor(qrStyle.qr_corners_square_color, '#000000'),
+      gradient: cornersSquareGradient || undefined
+    },
+    cornersDotOptions: {
+      type: String(qrStyle.qr_corners_dot_type || 'square').trim() || 'square',
+      color: normalizeQrStyleColor(qrStyle.qr_corners_dot_color, '#000000'),
+      gradient: cornersDotGradient || undefined
+    },
+    backgroundOptions: {
+      color: qrStyle.qr_background_transparent ? 'transparent' : normalizeQrStyleColor(qrStyle.qr_background_color, '#ffffff')
+    },
+    image: String(qrStyle.qr_image || '').trim() || undefined,
+    imageOptions: {
+      hideBackgroundDots: Boolean(qrStyle.qr_image_hide_background_dots),
+      imageSize: normalizeQrStyleNumber(qrStyle.qr_image_size, 0.4, 0, 1),
+      margin: normalizeQrStyleNumber(qrStyle.qr_image_margin, 5, 0, undefined)
+    }
+  };
+}
+
+async function createStyledQrCodeDataUrl(value) {
+  const source = value && typeof value === 'object' ? value : { value: value };
+  const options = buildQrStylingOptions(source);
+  if (!options.data) {
+    return '';
+  }
+
+  return svgToDataUrl(await createStyledQrCodeSvg(options.data));
+}
+
+async function createStyledQrCodeSvg(value) {
+  const source = value && typeof value === 'object' ? value : { value: value };
+  const options = buildQrStylingOptions(source);
+  if (!options.data) {
+    return '';
+  }
+
+  return renderStyledQrRawData(options, 'svg');
+}
+
+async function createQrCodeSvg(value) {
+  return createStyledQrCodeSvg(value);
+}
+
+async function createQrCodeDataUrl(value) {
+  return createStyledQrCodeDataUrl(value);
+}
+
+async function buildQrCodeContent(value, options) {
+  const source = value && typeof value === 'object' ? value : { value: value };
+  const forcePreviewRefresh = Boolean(options && options.forcePreviewRefresh);
+  const text = String(source.value === undefined || source.value === null ? '' : source.value).trim();
+  const hasBooleanField = function (key) {
+    return Object.prototype.hasOwnProperty.call(source, key);
+  };
+  const margin = Number(source.qr_margin);
+  const normalizeHex = function (value) {
+    const raw = String(value === undefined || value === null ? '' : value).trim();
+    return raw || undefined;
+  };
+  const normalizeNumber = function (value, min, max, round) {
+    const parsed = Number(value);
+    if (!Number.isFinite(parsed)) {
+      return undefined;
+    }
+
+    let next = parsed;
+    if (round) {
+      next = Math.round(next);
+    }
+    if (typeof min === 'number') {
+      next = Math.max(min, next);
+    }
+    if (typeof max === 'number') {
+      next = Math.min(max, next);
+    }
+    return next;
+  };
+  const style = {
+    qr_margin: Number.isFinite(margin) && margin >= 0 ? Math.round(margin) : undefined,
+    qr_border_radius: Number.isFinite(Number(source.qr_border_radius)) ? Math.max(0, Math.round(Number(source.qr_border_radius))) : undefined,
+    qr_background_color: String(source.qr_background_color === undefined || source.qr_background_color === null ? '' : source.qr_background_color).trim() || undefined,
+    qr_background_transparent: hasBooleanField('qr_background_transparent') ? Boolean(source.qr_background_transparent) : undefined,
+    qr_background_color_mode: 'single',
+    qr_background_gradient_type: String(source.qr_background_gradient_type === undefined || source.qr_background_gradient_type === null ? '' : source.qr_background_gradient_type).trim() || undefined,
+    qr_background_gradient_rotation: normalizeNumber(source.qr_background_gradient_rotation),
+    qr_background_gradient_color_1: normalizeHex(source.qr_background_gradient_color_1),
+    qr_background_gradient_color_2: normalizeHex(source.qr_background_gradient_color_2),
+    qr_dots_color: String(source.qr_dots_color === undefined || source.qr_dots_color === null ? '' : source.qr_dots_color).trim() || undefined,
+    qr_dots_type: String(source.qr_dots_type === undefined || source.qr_dots_type === null ? '' : source.qr_dots_type).trim() || undefined,
+    qr_dots_color_mode: String(source.qr_dots_color_mode === undefined || source.qr_dots_color_mode === null ? '' : source.qr_dots_color_mode).trim() || undefined,
+    qr_dots_gradient_type: String(source.qr_dots_gradient_type === undefined || source.qr_dots_gradient_type === null ? '' : source.qr_dots_gradient_type).trim() || undefined,
+    qr_dots_gradient_rotation: normalizeNumber(source.qr_dots_gradient_rotation),
+    qr_dots_gradient_color_1: normalizeHex(source.qr_dots_gradient_color_1),
+    qr_dots_gradient_color_2: normalizeHex(source.qr_dots_gradient_color_2),
+    qr_corners_square_color: String(source.qr_corners_square_color === undefined || source.qr_corners_square_color === null ? '' : source.qr_corners_square_color).trim() || undefined,
+    qr_corners_square_type: String(source.qr_corners_square_type === undefined || source.qr_corners_square_type === null ? '' : source.qr_corners_square_type).trim() || undefined,
+    qr_corners_square_color_mode: String(source.qr_corners_square_color_mode === undefined || source.qr_corners_square_color_mode === null ? '' : source.qr_corners_square_color_mode).trim() || undefined,
+    qr_corners_square_gradient_type: String(source.qr_corners_square_gradient_type === undefined || source.qr_corners_square_gradient_type === null ? '' : source.qr_corners_square_gradient_type).trim() || undefined,
+    qr_corners_square_gradient_rotation: normalizeNumber(source.qr_corners_square_gradient_rotation),
+    qr_corners_square_gradient_color_1: normalizeHex(source.qr_corners_square_gradient_color_1),
+    qr_corners_square_gradient_color_2: normalizeHex(source.qr_corners_square_gradient_color_2),
+    qr_corners_dot_color: String(source.qr_corners_dot_color === undefined || source.qr_corners_dot_color === null ? '' : source.qr_corners_dot_color).trim() || undefined,
+    qr_corners_dot_type: String(source.qr_corners_dot_type === undefined || source.qr_corners_dot_type === null ? '' : source.qr_corners_dot_type).trim() || undefined,
+    qr_corners_dot_color_mode: String(source.qr_corners_dot_color_mode === undefined || source.qr_corners_dot_color_mode === null ? '' : source.qr_corners_dot_color_mode).trim() || undefined,
+    qr_corners_dot_gradient_type: String(source.qr_corners_dot_gradient_type === undefined || source.qr_corners_dot_gradient_type === null ? '' : source.qr_corners_dot_gradient_type).trim() || undefined,
+    qr_corners_dot_gradient_rotation: normalizeNumber(source.qr_corners_dot_gradient_rotation),
+    qr_corners_dot_gradient_color_1: normalizeHex(source.qr_corners_dot_gradient_color_1),
+    qr_corners_dot_gradient_color_2: normalizeHex(source.qr_corners_dot_gradient_color_2),
+    qr_image: String(source.qr_image === undefined || source.qr_image === null ? '' : source.qr_image).trim() || undefined,
+    qr_image_size: Number.isFinite(Number(source.qr_image_size)) ? Math.max(0, Math.min(1, Number(source.qr_image_size))) : undefined,
+    qr_image_margin: Number.isFinite(Number(source.qr_image_margin)) ? Math.max(0, Math.round(Number(source.qr_image_margin))) : undefined,
+    qr_image_hide_background_dots: hasBooleanField('qr_image_hide_background_dots') ? Boolean(source.qr_image_hide_background_dots) : undefined
+  };
+  const content = {
+    type: 'qr-code',
+    value: text
+  };
+
+  Object.keys(style).forEach((key) => {
+    if (style[key] !== undefined) {
+      content[key] = style[key];
+    }
+  });
+
+  content.qr_background_use_gradient = false;
+  content.qr_dots_use_gradient = content.qr_dots_gradient_type && content.qr_dots_gradient_type !== 'none';
+  content.qr_corners_square_use_gradient = content.qr_corners_square_gradient_type && content.qr_corners_square_gradient_type !== 'none';
+  content.qr_corners_dot_use_gradient = content.qr_corners_dot_gradient_type && content.qr_corners_dot_gradient_type !== 'none';
+
+  const svg = String(source.qr_svg === undefined || source.qr_svg === null ? '' : source.qr_svg).trim();
+  if (svg) {
+    content.qr_svg = svg;
+  }
+
+  const preview = forcePreviewRefresh ? '' : String(source.qr_preview === undefined || source.qr_preview === null ? '' : source.qr_preview).trim();
+  if (preview) {
+    content.qr_preview = preview;
+  }
+
+  if (text && !content.qr_preview) {
+    const generatedSvg = await createQrCodeSvg(text);
+    if (generatedSvg) {
+      content.qr_svg = generatedSvg;
+    }
+    const generatedDataUrl = await createStyledQrCodeDataUrl(content);
+    if (generatedDataUrl) {
+      content.qr_preview = generatedDataUrl;
+    }
+  }
+
+  return content;
+}
+
+module.exports = {
+  createQrCodeSvg,
+  createStyledQrCodeSvg,
+  createStyledQrCodeDataUrl,
+  createQrCodeDataUrl,
+  buildQrCodeContent
+};

src/data/rss-feeds.js

@@ -2,16 +2,22 @@
 
 const http = require('http');
 const https = require('https');
-const { fetchPagedRows } = require('./utils');
+const { fetchPagedRows, validateMaxLength } = require('./utils');
+
+const NAME_MAX_LENGTH = 255;
+const URL_MAX_LENGTH = 1024;
 
 function normalizeUpdateIntervalUnit(value) {
   const unit = String(value || '').trim().toLowerCase();
-  return unit === 'seconds' ? 'seconds' : 'minutes';
+  if (unit === 'seconds' || unit === 'minutes' || unit === 'hours') {
+    return unit;
+  }
+  return 'minutes';
 }
 
 async function fetchRssFeedsData(pool) {
   const [rssFeeds] = await pool.query(
-    'SELECT id, name, feed_url, update_interval_value, update_interval_unit, item_limit, created_at, modified_at, created_by, modified_by FROM i_rss_feeds ORDER BY modified_at DESC, id DESC'
+    'SELECT id, name, feed_url, enabled, update_interval_value, update_interval_unit, item_limit, last_pulled_at, created_at, modified_at, created_by, modified_by FROM i_rss_feeds ORDER BY modified_at DESC, id DESC'
   );
 
   return { rssFeeds: rssFeeds };
@@ -19,7 +25,7 @@ async function fetchRssFeedsData(pool) {
 
 async function fetchRssFeedsPage(pool, page, pageSize, searchTerm, sortKey, sortDirection) {
   const paged = await fetchPagedRows(pool, {
-    selectSql: 'SELECT id, name, feed_url, update_interval_value, update_interval_unit, item_limit, created_at, modified_at, created_by, modified_by FROM i_rss_feeds ORDER BY modified_at DESC, id DESC',
+    selectSql: 'SELECT id, name, feed_url, enabled, update_interval_value, update_interval_unit, item_limit, last_pulled_at, created_at, modified_at, created_by, modified_by FROM i_rss_feeds ORDER BY modified_at DESC, id DESC',
     countSql: 'SELECT COUNT(*) AS count FROM i_rss_feeds',
     searchColumns: ['name', 'feed_url'],
     searchTerm: searchTerm,
@@ -42,7 +48,7 @@ async function fetchRssFeedsPage(pool, page, pageSize, searchTerm, sortKey, sort
 
 async function fetchRssFeedById(pool, id) {
   const [rows] = await pool.query(
-    'SELECT id, name, feed_url, update_interval_value, update_interval_unit, item_limit, created_at, modified_at, created_by, modified_by FROM i_rss_feeds WHERE id = ?',
+    'SELECT id, name, feed_url, enabled, update_interval_value, update_interval_unit, item_limit, last_pulled_at, created_at, modified_at, created_by, modified_by FROM i_rss_feeds WHERE id = ?',
     [id]
   );
 
@@ -255,8 +261,8 @@ async function replaceRssFeedItems(connection, rssFeedId, items) {
 
 function buildRssFeedPayload(req, existingRssFeed) {
   const fallback = existingRssFeed || {};
-  const name = String(req.body.name || fallback.name || '').trim();
+  const name = validateMaxLength(req.body.name || fallback.name || '', NAME_MAX_LENGTH, 'RSS feed name');
-  const feedUrl = String(req.body.feed_url || req.body.feedUrl || fallback.feed_url || '').trim();
+  const feedUrl = validateMaxLength(req.body.feed_url || req.body.feedUrl || fallback.feed_url || '', URL_MAX_LENGTH, 'RSS feed URL');
   const updateIntervalValue = Math.max(1, Number(req.body.update_interval_value || req.body.updateIntervalValue || fallback.update_interval_value || 60));
   const updateIntervalUnit = normalizeUpdateIntervalUnit(req.body.update_interval_unit || req.body.updateIntervalUnit || fallback.update_interval_unit || 'minutes');
   const itemLimit = Math.max(1, Number(req.body.item_limit || req.body.itemLimit || fallback.item_limit || 1));

src/data/screens.js

@@ -13,6 +13,27 @@ function normalizePlayerBaseUrl(value) {
   return String(value || '').trim().replace(/\/$/, '');
 }
 
+function getConfiguredPlayerIdentifier() {
+  return String(process.env.PLAYER_IDENTIFIER || process.env.PLAYER_DEVICE_ID || '').trim() || null;
+}
+
+async function fetchPlayerRecordByIdentifier(pool, identifier) {
+  const normalizedIdentifier = String(identifier || '').trim();
+  if (!normalizedIdentifier) {
+    return null;
+  }
+
+  const [rows] = await pool.query(
+    `SELECT id, identifier, public_base_url, internal_base_url, last_seen_at
+     FROM d_players
+     WHERE identifier = ?
+     LIMIT 1`,
+    [normalizedIdentifier]
+  );
+
+  return rows[0] || null;
+}
+
 function buildScreenPlayerUrl(screen, fallbackBaseUrl) {
   const slug = String(screen && screen.slug || '').trim();
   if (!slug) {
@@ -28,20 +49,21 @@ function buildScreenPlayerUrl(screen, fallbackBaseUrl) {
 }
 
 async function fetchScreenPlayerUrls(pool) {
+  const playerBaseUrl = await fetchPlayerPublicBaseUrl(pool);
+  if (!playerBaseUrl) {
+    return {};
+  }
+
   const [rows] = await pool.query(`
-    SELECT s.slug, p.public_base_url
+    SELECT slug
-    FROM d_screens s
+    FROM d_screens
-    LEFT JOIN d_players p ON p.device_id = s.player_id
+    ORDER BY slug ASC
-    WHERE p.public_base_url IS NOT NULL
-      AND TRIM(p.public_base_url) <> ''
-    ORDER BY p.modified_at DESC, s.slug ASC
   `);
 
   const playerUrls = {};
   rows.forEach(function (row) {
     const slug = String(row && row.slug || '').trim();
-    const publicBaseUrl = normalizePlayerBaseUrl(row && row.public_base_url);
+    const playerUrl = buildScreenPlayerUrl({ slug: slug }, playerBaseUrl);
-    const playerUrl = buildScreenPlayerUrl({ slug: slug }, publicBaseUrl);
     if (slug && playerUrl && !playerUrls[slug]) {
       playerUrls[slug] = playerUrl;
     }
@@ -50,17 +72,33 @@ async function fetchScreenPlayerUrls(pool) {
   return playerUrls;
 }
 
-async function fetchScreenPlayerRecord(pool, slug) {
+async function fetchPlayerPublicBaseUrl(pool) {
+  const configuredPlayerIdentifier = getConfiguredPlayerIdentifier();
   const [rows] = await pool.query(`
-    SELECT p.device_id, p.public_base_url, p.internal_base_url, p.last_seen_at
+    SELECT public_base_url
-    FROM d_screens s
+    FROM d_players
-    JOIN d_players p ON p.device_id = s.player_id
+    WHERE identifier = ?
-    WHERE s.slug = ?
-    ORDER BY p.modified_at DESC, p.device_id ASC
     LIMIT 1
-  `, [slug]);
+  `, [configuredPlayerIdentifier]);
 
-  return rows[0] || null;
+  return normalizePlayerBaseUrl(rows[0] && rows[0].public_base_url) || null;
+}
+
+async function fetchScreenPlayerRecord(pool, slug) {
+  if (slug) {
+    const [rows] = await pool.query(
+      `SELECT slug
+       FROM d_screens
+       WHERE slug = ?
+       LIMIT 1`,
+      [slug]
+    );
+    if (!rows.length) {
+      return null;
+    }
+  }
+
+  return fetchPlayerRecordByIdentifier(pool, getConfiguredPlayerIdentifier());
 }
 
 async function uniqueScreenSlug(pool, baseSlug, excludeId) {
@@ -101,8 +139,11 @@ async function fetchScreenEditData(pool) {
 module.exports = {
   slugify,
   normalizePlayerBaseUrl,
+  getConfiguredPlayerIdentifier,
+  fetchPlayerRecordByIdentifier,
   buildScreenPlayerUrl,
   fetchScreenPlayerUrls,
+  fetchPlayerPublicBaseUrl,
   fetchScreenPlayerRecord,
   uniqueScreenSlug,
   fetchScreenById,

src/data/slides.js

@@ -1,40 +1,98 @@
 // Slide data access helpers, including rich-text normalization and payload building.
 
 const { fetchTemplateById } = require('./templates');
-const { parseJsonSafe } = require('./utils');
+const { parseJsonSafe, validateMaxLength } = require('./utils');
+
+const TITLE_MAX_LENGTH = 255;
+const { buildQrCodeContent } = require('./qr-code');
 
-const ALLOWED_RICH_TEXT_TAGS = ['b', 'strong', 'i', 'em', 'u', 'br', 'p', 'div', 'ul', 'ol', 'li'];
 const DEFAULT_FONT_SIZE = 32;
 
+const ALLOWED_RICH_TEXT_TAGS = ['a', 'b', 'blockquote', 'br', 'code', 'div', 'em', 'figure', 'figcaption', 'h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'hr', 'i', 'img', 'li', 'ol', 'p', 'pre', 'span', 'strong', 'sub', 'sup', 'table', 'tbody', 'td', 'th', 'thead', 'tr', 'u', 'ul'];
+
+function sanitizeRichTextAttributes(tagName, attrText) {
+  const allowedAttributes = {
+    a: ['href', 'title', 'target', 'rel', 'class', 'style'],
+    blockquote: ['class', 'style'],
+    div: ['class', 'style'],
+    figure: ['class', 'style'],
+    figcaption: ['class', 'style'],
+    h1: ['class', 'style'],
+    h2: ['class', 'style'],
+    h3: ['class', 'style'],
+    h4: ['class', 'style'],
+    h5: ['class', 'style'],
+    h6: ['class', 'style'],
+    img: ['src', 'alt', 'title', 'width', 'height', 'class', 'style', 'loading', 'decoding'],
+    li: ['class', 'style'],
+    ol: ['class', 'style', 'start'],
+    p: ['class', 'style'],
+    pre: ['class', 'style'],
+    span: ['class', 'style'],
+    table: ['class', 'style'],
+    td: ['class', 'style', 'colspan', 'rowspan'],
+    th: ['class', 'style', 'colspan', 'rowspan', 'scope'],
+    tr: ['class', 'style'],
+    ul: ['class', 'style']
+  };
+  const allowed = allowedAttributes[tagName] || [];
+  if (!allowed.length) {
+    return '';
+  }
+
+  const attrs = [];
+  String(attrText || '').replace(/([a-zA-Z0-9:-]+)(?:\s*=\s*("([^"]*)"|'([^']*)'|([^\s"'>/=`]+)))?/g, (_full, key, _valuePart, doubleQuoted, singleQuoted, bareValue) => {
+    const lowerKey = String(key || '').toLowerCase();
+    if (!allowed.includes(lowerKey)) {
+      return '';
+    }
+
+    const value = doubleQuoted !== undefined ? doubleQuoted : singleQuoted !== undefined ? singleQuoted : bareValue !== undefined ? bareValue : '';
+    if (lowerKey === 'href' && /^(?:\s*javascript:|\s*data:)/i.test(String(value || ''))) {
+      return '';
+    }
+    if (lowerKey === 'style' && /(?:expression\s*\(|javascript:|url\s*\()/i.test(String(value || ''))) {
+      return '';
+    }
+    if (lowerKey === 'target') {
+      const targetValue = String(value || '').trim();
+      if (targetValue === '_blank') {
+        attrs.push(' target="_blank"');
+        if (!attrs.includes(' rel="noreferrer noopener"')) {
+          attrs.push(' rel="noreferrer noopener"');
+        }
+        return '';
+      }
+    }
+    attrs.push(' ' + lowerKey + '="' + String(value || '').replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;').replace(/'/g, '&#39;') + '"');
+    return '';
+  });
+
+  return attrs.join('');
+}
+
 function sanitizeRichText(html) {
   let output = String(html || '');
   output = output.replace(/<script[\s\S]*?<\/script>/gi, '');
   output = output.replace(/<style[\s\S]*?<\/style>/gi, '');
   return output.replace(/<[^>]+>/g, (tag) => {
-    const match = tag.match(/^<\s*(\/?)\s*([a-z0-9]+)(?:\s[^>]*)?>$/i);
+    const match = tag.match(/^<\s*(\/?)\s*([a-z0-9]+)([\s\S]*?)(\/?)>$/i);
     if (!match) {
       return '';
     }
     const closing = Boolean(match[1]);
     const name = String(match[2] || '').toLowerCase();
+    const attrText = String(match[3] || '');
     if (!ALLOWED_RICH_TEXT_TAGS.includes(name)) {
       return '';
     }
-    if (name === 'br') {
+    if (closing) {
-      return '<br>';
+      return `</${name}>`;
     }
-    return closing ? `</${name}>` : `<${name}>`;
+    return `<${name}${sanitizeRichTextAttributes(name, attrText)}>`;
   });
 }
 
-function normalizePlainText(value) {
-  return String(value === undefined || value === null ? '' : value)
-    .replace(/<\s*br\s*\/?\s*>/gi, '\n')
-    .replace(/<[^>]*>/g, '')
-    .replace(/&nbsp;/gi, ' ')
-    .trim();
-}
-
 function stripEditorOnlyMarkup(value) {
   return String(value || '')
     .replace(/<pre[^>]*class="[^"]*api-region-sample-preview[^"]*"[^>]*>[\s\S]*?<\/pre>/gi, '')
@@ -49,7 +107,7 @@ function normalizeEditorMarkup(value) {
 async function fetchSlideById(pool, id) {
   const [slides] = await pool.query(`
     SELECT s.id, s.title, s.template_id, s.content_json, s.thumbnail_path, s.created_at, s.modified_at,
-           st.name AS template_name, cs.name AS canvas_size_name, cs.width AS canvas_width, cs.height AS canvas_height
+           st.name AS template_name, st.canvas_size_id, cs.name AS canvas_size_name, cs.width AS canvas_width, cs.height AS canvas_height
     FROM c_slides s
     LEFT JOIN c_templates st ON st.id = s.template_id
     LEFT JOIN c_canvas_sizes cs ON cs.id = st.canvas_size_id
@@ -111,9 +169,130 @@ function getTextRegionStyle(body, region, existingContent) {
   };
 }
 
-function buildTemplateContent(template, body, filesByField, existingContent) {
+function getQrRegionStyle(body, region, existingContent) {
+  const existing = existingContent && existingContent[region.region_key] ? existingContent[region.region_key] : {};
+  const styleKeys = [
+    'qr_margin',
+    'qr_background_color',
+    'qr_background_transparent',
+    'qr_background_color_mode',
+    'qr_background_gradient_type',
+    'qr_background_gradient_rotation',
+    'qr_background_gradient_color_1',
+    'qr_background_gradient_color_2',
+    'qr_dots_color',
+    'qr_dots_type',
+    'qr_dots_color_mode',
+    'qr_dots_gradient_type',
+    'qr_dots_gradient_rotation',
+    'qr_dots_gradient_color_1',
+    'qr_dots_gradient_color_2',
+    'qr_corners_square_color',
+    'qr_corners_square_type',
+    'qr_corners_square_color_mode',
+    'qr_corners_square_gradient_type',
+    'qr_corners_square_gradient_rotation',
+    'qr_corners_square_gradient_color_1',
+    'qr_corners_square_gradient_color_2',
+    'qr_corners_dot_color',
+    'qr_corners_dot_type',
+    'qr_corners_dot_color_mode',
+    'qr_corners_dot_gradient_type',
+    'qr_corners_dot_gradient_rotation',
+    'qr_corners_dot_gradient_color_1',
+    'qr_corners_dot_gradient_color_2',
+    'qr_image',
+    'qr_image_size',
+    'qr_image_margin',
+    'qr_image_hide_background_dots',
+    'qr_border_radius'
+  ];
+  const style = {};
+
+  styleKeys.forEach((key) => {
+    const fieldNames = [`region_${key}_${region.id}`, `${key}_${region.id}`];
+    let fieldName = fieldNames[0];
+    let hasSubmittedValue = false;
+    let submitted;
+
+    for (let index = 0; index < fieldNames.length; index += 1) {
+      const candidate = fieldNames[index];
+      if (Object.prototype.hasOwnProperty.call(body || {}, candidate)) {
+        fieldName = candidate;
+        hasSubmittedValue = true;
+        submitted = body[candidate];
+        break;
+      }
+    }
+
+    const value = String(submitted || '').trim();
+
+    if (key === 'qr_background_transparent' || key === 'qr_image_hide_background_dots') {
+      style[key] = hasSubmittedValue;
+      return;
+    }
+
+    if (key === 'qr_background_color_mode' || key === 'qr_dots_color_mode' || key === 'qr_corners_square_color_mode' || key === 'qr_corners_dot_color_mode' || key === 'qr_background_gradient_type' || key === 'qr_dots_gradient_type' || key === 'qr_corners_square_gradient_type' || key === 'qr_corners_dot_gradient_type') {
+      style[key] = value === 'none' ? 'none' : value;
+      return;
+    }
+
+    if (key === 'qr_image') {
+      style[key] = value;
+      return;
+    }
+
+    if (submitted === undefined) {
+      if (existing[key] !== undefined && existing[key] !== null && String(existing[key]).trim() !== '') {
+        style[key] = existing[key];
+      }
+      return;
+    }
+
+    if (value !== '') {
+      if (key === 'qr_margin') {
+        const parsedMargin = Number(value);
+        if (Number.isFinite(parsedMargin)) {
+          style[key] = Math.max(0, Math.round(parsedMargin));
+        }
+        return;
+      }
+
+      if (key === 'qr_image_size') {
+        const parsedSize = Number(value);
+        if (Number.isFinite(parsedSize)) {
+          style[key] = Math.max(0, Math.min(1, parsedSize));
+        }
+        return;
+      }
+
+      if (key === 'qr_image_margin' || key === 'qr_border_radius') {
+        const parsedImageMargin = Number(value);
+        if (Number.isFinite(parsedImageMargin)) {
+          style[key] = Math.max(0, Math.round(parsedImageMargin));
+        }
+        return;
+      }
+
+      style[key] = value;
+    }
+  });
+
+  return style;
+}
+
+async function getRssFeedItemCount(pool, feedId) {
+  const [rows] = await pool.query(
+    'SELECT COUNT(*) AS count FROM i_rss_feed_items WHERE rss_feed_id = ?',
+    [feedId]
+  );
+
+  return Number(rows && rows[0] && rows[0].count) || 0;
+}
+
+async function buildTemplateContent(pool, template, body, filesByField, existingContent) {
   const content = {};
-  template.regions.forEach((region) => {
+  for (const region of template.regions) {
     if (region.region_type === 'image') {
       const uploaded = filesByField[`region_image_${region.id}`];
       const existing = body[`existing_region_image_${region.id}`];
@@ -142,6 +321,24 @@ function buildTemplateContent(template, body, filesByField, existingContent) {
         type: 'webpage',
         value: submitted === undefined ? current : String(submitted || '').trim()
       };
+    } else if (region.region_type === 'qr-code') {
+      const uploadedImage = filesByField[`region_qr_image_${region.id}`];
+      const submitted = body[`region_qr_code_${region.id}`];
+      const submittedSvg = body[`region_qr_svg_${region.id}`];
+      const submittedPreview = body[`region_qr_preview_${region.id}`];
+      const existingImage = body[`existing_region_qr_image_${region.id}`];
+      const current = existingContent && existingContent[region.region_key] ? existingContent[region.region_key] : {};
+      const nextValue = submitted === undefined ? String(current.value !== undefined ? current.value : current.qr_code || '').trim() : String(submitted || '').trim();
+      const qrStyle = getQrRegionStyle(body, region, existingContent);
+      delete qrStyle.qr_image;
+      content[region.region_key] = {
+        type: 'qr-code',
+        value: nextValue,
+        qr_svg: submittedSvg === undefined ? String(current.qr_svg || '').trim() : String(submittedSvg || '').trim(),
+        qr_preview: submittedPreview === undefined ? String(current.qr_preview || '').trim() : String(submittedPreview || '').trim(),
+        qr_image: uploadedImage ? `/media/uploads/${uploadedImage.filename}` : String(existingImage === undefined ? String(current.qr_image || '').trim() : String(existingImage || '').trim()),
+        ...qrStyle
+      };
     } else if (region.region_type === 'rtmp') {
       const submitted = body[`region_rtmp_${region.id}`];
       const current = existingContent && existingContent[region.region_key] ? existingContent[region.region_key] : {};
@@ -166,6 +363,49 @@ function buildTemplateContent(template, body, filesByField, existingContent) {
         value: submitted === undefined ? String(current.value !== undefined ? current.value : current.text !== undefined ? current.text : '') : String(submitted || ''),
         timezone: timezoneValue === undefined || timezoneValue === null ? String(current.timezone || current.time_zone || '') : String(timezoneValue || '').trim()
       };
+    } else if (region.region_type === 'timetable') {
+      const current = existingContent && existingContent[region.region_key] && typeof existingContent[region.region_key] === 'object' ? existingContent[region.region_key] : {};
+      const suffix = '_' + region.id;
+      const generic = {};
+      const submittedText = body[`region_text_${region.id}`];
+      const normalizedText = submittedText === undefined ? String(current.text !== undefined ? current.text : current.value !== undefined ? current.value : '') : String(submittedText || '');
+
+      Object.keys(body || {}).forEach((key) => {
+        if (!key.startsWith('region_') || !key.endsWith(suffix)) {
+          return;
+        }
+
+        const field = key.slice('region_'.length, -suffix.length);
+        if (!field || field === 'type' || field === 'key' || field === 'name' || field === 'label') {
+          return;
+        }
+
+        generic[field] = body[key];
+      });
+
+      if (Object.prototype.hasOwnProperty.call(generic, 'timetable_display_mode')) {
+        generic.display_mode = generic.timetable_display_mode;
+        delete generic.timetable_display_mode;
+      }
+
+      if (Object.prototype.hasOwnProperty.call(generic, 'timetable_max_items')) {
+        generic.max_items = generic.timetable_max_items;
+        delete generic.timetable_max_items;
+      }
+
+      Object.keys(current).forEach((key) => {
+        if (generic[key] === undefined) {
+          generic[key] = current[key];
+        }
+      });
+
+      delete generic.timetable_display_mode;
+      delete generic.timetable_max_items;
+
+      generic.text = normalizedText;
+      generic.value = normalizedText;
+      generic.type = region.region_type;
+      content[region.region_key] = generic;
     } else if (region.region_type === 'rss') {
       const submitted = body[`region_text_${region.id}`];
       const current = existingContent && existingContent[region.region_key] ? existingContent[region.region_key] : {};
@@ -173,11 +413,13 @@ function buildTemplateContent(template, body, filesByField, existingContent) {
       const feedId = body[`region_rss_feed_id_${region.id}`];
       const itemNumber = body[`region_rss_item_number_${region.id}`];
       const parsedItemNumber = Math.max(1, Number(itemNumber || current.item_number || 1));
+      const normalizedFeedId = feedId === undefined || feedId === null || feedId === '' ? Number(current.feed_id || 0) : Number(feedId);
+      const itemCount = normalizedFeedId > 0 ? Math.max(1, await getRssFeedItemCount(pool, normalizedFeedId) || 1) : 1;
       content[region.region_key] = {
         type: 'rss',
         value: stripEditorOnlyMarkup(normalizeEditorMarkup(submitted === undefined ? String(current.value || '') : String(submitted || ''))),
-        feed_id: feedId === undefined || feedId === null || feedId === '' ? (current.feed_id || null) : Number(feedId),
+        feed_id: feedId === undefined || feedId === null ? (current.feed_id || null) : (feedId === '' ? null : Number(feedId)),
-        item_number: Number.isFinite(parsedItemNumber) && parsedItemNumber > 0 ? parsedItemNumber : 1,
+        item_number: Math.min(itemCount, Number.isFinite(parsedItemNumber) && parsedItemNumber > 0 ? parsedItemNumber : 1),
         variable_name: 'item',
         font_family: style.font_family,
         font_size: style.font_size,
@@ -194,7 +436,7 @@ function buildTemplateContent(template, body, filesByField, existingContent) {
       content[region.region_key] = {
         type: 'api',
         value: stripEditorOnlyMarkup(normalizeEditorMarkup(submitted === undefined ? String(current.value || '') : String(submitted || ''))),
-        source_id: sourceId === undefined || sourceId === null || sourceId === '' ? (current.source_id || null) : Number(sourceId),
+        source_id: sourceId === undefined || sourceId === null ? (current.source_id || null) : (sourceId === '' ? null : Number(sourceId)),
         item_number: Number.isFinite(parsedItemNumber) && parsedItemNumber > 0 ? parsedItemNumber : 1,
         items_path: itemsPath === undefined || itemsPath === null ? (current.items_path === undefined || current.items_path === null ? '' : String(current.items_path)) : String(itemsPath || '').trim(),
         variable_name: 'item',
@@ -202,7 +444,22 @@ function buildTemplateContent(template, body, filesByField, existingContent) {
         font_size: style.font_size,
         font_color: style.font_color
       };
-    } else if (!['text', 'image', 'video', 'webpage', 'html', 'rtmp', 'rss', 'api'].includes(String(region.region_type || '').trim())) {
+    } else if (region.region_type === 'weather') {
+      const current = existingContent && existingContent[region.region_key] ? existingContent[region.region_key] : {};
+      const locationId = body[`region_weather_location_id_${region.id}`];
+      const submittedForecastMode = body[`region_weather_forecast_mode_${region.id}`];
+      const forecastMode = ['current', 'hourly'].includes(submittedForecastMode) ? submittedForecastMode : 'daily';
+      const style = getTextRegionStyle(body, region, existingContent);
+      content[region.region_key] = {
+        type: 'weather',
+        value: body[`region_text_${region.id}`] !== undefined ? String(body[`region_text_${region.id}`] || '') : String(current.value || ''),
+        weather_location_id: locationId === undefined || locationId === null ? (current.weather_location_id || null) : (locationId === '' ? null : Number(locationId)),
+        forecast_mode: body[`region_weather_forecast_mode_${region.id}`] === undefined ? (['current', 'hourly'].includes(current.forecast_mode) ? current.forecast_mode : 'daily') : forecastMode,
+        font_family: style.font_family,
+        font_size: style.font_size,
+        font_color: style.font_color
+      };
+    } else if (!['text', 'image', 'video', 'webpage', 'qr-code', 'html', 'rtmp', 'rss', 'api', 'weather'].includes(String(region.region_type || '').trim())) {
       const current = existingContent && existingContent[region.region_key] && typeof existingContent[region.region_key] === 'object' ? existingContent[region.region_key] : {};
       const suffix = '_' + region.id;
       const generic = {};
@@ -243,18 +500,18 @@ function buildTemplateContent(template, body, filesByField, existingContent) {
       const style = getTextRegionStyle(body, region, existingContent);
       content[region.region_key] = {
         type: 'text',
-        value: stripEditorOnlyMarkup(normalizeEditorMarkup(submitted === undefined ? current : String(submitted || ''))),
+        value: sanitizeRichText(stripEditorOnlyMarkup(normalizeEditorMarkup(submitted === undefined ? current : String(submitted || '')))),
         font_family: style.font_family,
         font_size: style.font_size,
         font_color: style.font_color
       };
     }
-  });
+  }
   return content;
 }
 
 async function buildSlidePayload(pool, req, existingSlide) {
-  const title = String(req.body.title || '').trim();
+  const title = validateMaxLength(req.body.title || '', TITLE_MAX_LENGTH, 'Slide title');
   const templateId = req.body.template_id ? Number(req.body.template_id) : null;
   const filesByField = getFilesByField(req.files || []);
   const template = templateId ? await fetchTemplateById(pool, templateId) : null;
@@ -273,10 +530,22 @@ async function buildSlidePayload(pool, req, existingSlide) {
   }
 
   if (template) {
+    const content = await buildTemplateContent(pool, template, req.body, filesByField, existingContent);
+    await Promise.all(Object.keys(content).map(async function (regionKey) {
+      const region = template.regions.find(function (item) {
+        return String(item.region_key || '').trim() === regionKey;
+      });
+      if (!region || region.region_type !== 'qr-code') {
+        return;
+      }
+
+      content[regionKey] = await buildQrCodeContent(content[regionKey]);
+    }));
+
     return {
       title,
       templateId: template.id,
-      contentJson: JSON.stringify(buildTemplateContent(template, req.body, filesByField, existingContent))
+      contentJson: JSON.stringify(content)
     };
   }
 

src/data/templates.js

@@ -1,6 +1,10 @@
 // Template data access helpers and region normalization logic.
 
-const { parseJsonSafe, readFormArray } = require('./utils');
+const { parseJsonSafe, readFormArray, validateMaxLength } = require('./utils');
+const animationPresets = require('../web/public/js/templates/animation-presets');
+
+const TEMPLATE_NAME_MAX_LENGTH = 255;
+const REGION_NAME_MAX_LENGTH = 255;
 
 function sanitizeBackgroundColor(value) {
   const raw = String(value || '').trim();
@@ -10,6 +14,39 @@ function sanitizeBackgroundColor(value) {
   return '#111111';
 }
 
+function normalizeBackgroundGradient(value) {
+  let gradient = value;
+  if (typeof gradient === 'string') {
+    try {
+      gradient = JSON.parse(gradient);
+    } catch (_error) {
+      gradient = null;
+    }
+  }
+  if (!gradient || typeof gradient !== 'object' || Array.isArray(gradient)) {
+    return null;
+  }
+  const sourceStops = Array.isArray(gradient.stops) && gradient.stops.length
+    ? gradient.stops
+    : (Array.isArray(gradient.colors) ? gradient.colors.map((color, index, colors) => ({
+      color,
+      position: colors.length > 1 ? Math.round((index / (colors.length - 1)) * 100) : 0
+    })) : []);
+  const stops = sourceStops.slice(0, 12).map((stop) => ({
+    color: sanitizeBackgroundColor(stop && stop.color),
+    position: Math.max(0, Math.min(100, Number.isFinite(Number(stop && stop.position)) ? Number(stop.position) : 0))
+  }));
+  if (stops.length < 2) {
+    return null;
+  }
+  const angle = Number(gradient.angle);
+  return JSON.stringify({
+    type: 'linear',
+    stops,
+    angle: Number.isFinite(angle) ? Math.max(0, Math.min(360, angle)) : 90
+  });
+}
+
 function normalizeTemplateRegionType(value) {
   const rawType = String(value || 'text').trim();
   return rawType || 'text';
@@ -23,6 +60,61 @@ function normalizeTemplateRegionLockRatio(value) {
   return rawRatio.replace(/\s+/g, '');
 }
 
+function normalizeTemplateRegionAnimation(value) {
+  if (animationPresets && typeof animationPresets.normalize === 'function') {
+    return animationPresets.normalize(value);
+  }
+
+  const allowed = new Set(
+    Array.isArray(animationPresets && animationPresets.allValues) && animationPresets.allValues.length
+      ? animationPresets.allValues
+      : ['none', 'fadeIn', 'fadeInDown', 'fadeInLeft', 'fadeInRight', 'fadeInUp', 'zoomIn', 'zoomInDown', 'zoomInLeft', 'zoomInRight', 'zoomInUp', 'slideInDown', 'slideInLeft', 'slideInRight', 'slideInUp', 'fadeOut', 'fadeOutDown', 'fadeOutLeft', 'fadeOutRight', 'fadeOutUp', 'zoomOut', 'zoomOutDown', 'zoomOutLeft', 'zoomOutRight', 'zoomOutUp', 'slideOutDown', 'slideOutLeft', 'slideOutRight', 'slideOutUp', 'backInDown', 'backInLeft', 'backInRight', 'backInUp', 'backOutDown', 'backOutLeft', 'backOutRight', 'backOutUp', 'bounceIn', 'bounceInDown', 'bounceInLeft', 'bounceInRight', 'bounceInUp', 'bounceOut', 'bounceOutDown', 'bounceOutLeft', 'bounceOutRight', 'bounceOutUp', 'flip', 'flipInX', 'flipInY', 'flipOutX', 'flipOutY', 'lightSpeedInLeft', 'lightSpeedInRight', 'lightSpeedOutLeft', 'lightSpeedOutRight', 'rotateIn', 'rotateInDownLeft', 'rotateInDownRight', 'rotateInUpLeft', 'rotateInUpRight', 'rotateOut', 'rotateOutDownLeft', 'rotateOutDownRight', 'rotateOutUpLeft', 'rotateOutUpRight', 'hinge', 'jackInTheBox', 'rollIn', 'rollOut', 'flash', 'pulse', 'rubberBand', 'shakeX', 'shakeY', 'headShake', 'swing', 'tada', 'wobble', 'jello', 'heartBeat', 'bounce']
+  );
+  const raw = String(value || '').trim().toLowerCase();
+  return allowed.has(raw) ? raw : 'none';
+}
+
+function normalizeTemplateRegionAnimationStep(value, fallbackPreset) {
+  if (value && typeof value === 'object' && !Array.isArray(value)) {
+    const normalized = {};
+    Object.keys(value).forEach((key) => {
+      normalized[key] = value[key];
+    });
+    normalized.preset = normalizeTemplateRegionAnimation(value.preset !== undefined ? value.preset : fallbackPreset || 'none');
+    return normalized;
+  }
+
+  return {
+    preset: normalizeTemplateRegionAnimation(typeof value === 'string' ? value : fallbackPreset || 'none')
+  };
+}
+
+function normalizeTemplateRegionAnimationConfig(value) {
+  let raw = value;
+  if (typeof raw === 'string') {
+    const text = String(raw || '').trim();
+    if (!text) {
+      raw = null;
+    } else {
+      try {
+        raw = JSON.parse(text);
+      } catch (_error) {
+        raw = null;
+      }
+    }
+  }
+
+  if (!raw || typeof raw !== 'object' || Array.isArray(raw)) {
+    raw = {};
+  }
+
+  return {
+    intro: normalizeTemplateRegionAnimationStep(raw.intro, 'none'),
+    outro: normalizeTemplateRegionAnimationStep(raw.outro !== undefined ? raw.outro : raw.out, 'none'),
+    loop: normalizeTemplateRegionAnimationStep(raw.loop, 'none')
+  };
+}
+
 function normalizeTemplateRegionName(value) {
   return String(value || '').trim();
 }
@@ -47,7 +139,7 @@ function ensureUniqueTemplateRegionNames(regions) {
 
 async function fetchTemplateById(pool, id) {
   const [templates] = await pool.query(`
-    SELECT st.id, st.name, st.canvas_size_id, st.background_image_path, st.background_color, st.created_at, st.modified_at,
+    SELECT st.id, st.name, st.canvas_size_id, st.background_image_path, st.background_color, st.background_gradient, st.created_at, st.modified_at,
            cs.name AS canvas_size_name, cs.width AS canvas_size_width, cs.height AS canvas_size_height
     FROM c_templates st
     LEFT JOIN c_canvas_sizes cs ON cs.id = st.canvas_size_id
@@ -57,20 +149,20 @@ async function fetchTemplateById(pool, id) {
     return null;
   }
   const template = templates[0];
-  const [regions] = await pool.query('SELECT id, template_id, region_key, region_type, label, lock_ratio, x, y, width, height, z_index, created_at, modified_at, created_by, modified_by FROM c_template_regions WHERE template_id = ? ORDER BY z_index ASC, id ASC', [id]);
+  const [regions] = await pool.query('SELECT id, template_id, region_key, region_type, label, lock_ratio, animation_json, x, y, width, height, z_index, created_at, modified_at, created_by, modified_by FROM c_template_regions WHERE template_id = ? ORDER BY z_index ASC, id ASC', [id]);
   template.regions = regions;
   return template;
 }
 
 async function fetchTemplatesData(pool) {
   const [templates] = await pool.query(`
-    SELECT st.id, st.name, st.canvas_size_id, st.background_image_path, st.background_color, st.created_at, st.modified_at,
+    SELECT st.id, st.name, st.canvas_size_id, st.background_image_path, st.background_color, st.background_gradient, st.created_at, st.modified_at,
            cs.name AS canvas_size_name, cs.width AS canvas_size_width, cs.height AS canvas_size_height
     FROM c_templates st
     LEFT JOIN c_canvas_sizes cs ON cs.id = st.canvas_size_id
     ORDER BY st.id DESC
   `);
-  const [templateRegions] = await pool.query('SELECT id, template_id, region_key, region_type, label, lock_ratio, x, y, width, height, z_index, created_at, modified_at, created_by, modified_by FROM c_template_regions ORDER BY template_id ASC, z_index ASC, id ASC');
+  const [templateRegions] = await pool.query('SELECT id, template_id, region_key, region_type, label, lock_ratio, animation_json, x, y, width, height, z_index, created_at, modified_at, created_by, modified_by FROM c_template_regions ORDER BY template_id ASC, z_index ASC, id ASC');
   return { templates, templateRegions };
 }
 
@@ -81,11 +173,13 @@ function extractTemplateRegions(body) {
     if (Array.isArray(parsed)) {
       return parsed.map((region) => {
         const regionType = normalizeTemplateRegionType(region.region_type);
+        const regionName = validateMaxLength(region.region_name || region.region_key || region.label || '', REGION_NAME_MAX_LENGTH, 'Region name');
         return {
-          region_key: String(region.region_name || region.region_key || region.label || '').trim(),
+          region_key: regionName,
           region_type: regionType,
-          label: String(region.region_name || region.label || region.region_key || '').trim(),
+          label: regionName,
           lock_ratio: normalizeTemplateRegionLockRatio(region.lock_ratio),
+          animation_json: normalizeTemplateRegionAnimationConfig(region.animation_json),
           x: Number(region.x || 0),
           y: Number(region.y || 0),
           width: Number(region.width || 100),
@@ -101,6 +195,7 @@ function extractTemplateRegions(body) {
   const labels = readFormArray(body, 'region_label[]');
   const types = readFormArray(body, 'region_type[]');
   const ratios = readFormArray(body, 'region_lock_ratio[]');
+  const animationJsons = readFormArray(body, 'region_animation_json[]');
   const xs = readFormArray(body, 'region_x[]');
   const ys = readFormArray(body, 'region_y[]');
   const widths = readFormArray(body, 'region_width[]');
@@ -109,7 +204,7 @@ function extractTemplateRegions(body) {
   const regions = [];
 
   for (let i = 0; i < keys.length; i += 1) {
-    const name = String(names[i] || keys[i] || labels[i] || '').trim();
+    const name = validateMaxLength(names[i] || keys[i] || labels[i] || '', REGION_NAME_MAX_LENGTH, 'Region name');
     const rawType = String(types[i] || 'text').trim();
     const regionType = normalizeTemplateRegionType(rawType);
     if (!name) {
@@ -120,6 +215,7 @@ function extractTemplateRegions(body) {
       region_type: regionType,
       label: name,
       lock_ratio: normalizeTemplateRegionLockRatio(ratios[i]),
+      animation_json: normalizeTemplateRegionAnimationConfig(animationJsons[i]),
       x: Number(xs[i] || 0),
       y: Number(ys[i] || 0),
       width: Number(widths[i] || 100),
@@ -131,43 +227,6 @@ function extractTemplateRegions(body) {
   return regions;
 }
 
-function extractGenericRegionContent(region, body, filesByField, existingContent) {
-  const content = {};
-  const current = existingContent && existingContent[region.region_key] && typeof existingContent[region.region_key] === 'object' ? existingContent[region.region_key] : {};
-  const suffix = '_' + region.id;
-
-  Object.keys(body || {}).forEach((key) => {
-    if (!key.startsWith('region_') || !key.endsWith(suffix)) {
-      return;
-    }
-    const field = key.slice('region_'.length, -suffix.length);
-    if (!field || field === 'type' || field === 'key' || field === 'name' || field === 'label') {
-      return;
-    }
-    content[field] = body[key];
-  });
-
-  Object.keys(filesByField || {}).forEach((fieldName) => {
-    if (!fieldName.startsWith('region_') || !fieldName.endsWith(suffix)) {
-      return;
-    }
-    const field = fieldName.slice('region_'.length, -suffix.length);
-    if (!field) {
-      return;
-    }
-    content[field] = `/media/uploads/${filesByField[fieldName].filename}`;
-  });
-
-  Object.keys(current).forEach((key) => {
-    if (content[key] === undefined) {
-      content[key] = current[key];
-    }
-  });
-
-  content.type = region.region_type;
-  return content;
-}
-
 function getFilesByField(files) {
   const map = {};
   (files || []).forEach((file) => {
@@ -177,7 +236,7 @@ function getFilesByField(files) {
 }
 
 async function buildTemplatePayload(pool, req, existingTemplate) {
-  const name = String(req.body.name || '').trim();
+  const name = validateMaxLength(req.body.name || '', TEMPLATE_NAME_MAX_LENGTH, 'Template name');
   const canvasSizeId = req.body.canvas_size_id ? Number(req.body.canvas_size_id) : null;
   let canvasWidth = Math.max(1, Number((existingTemplate && existingTemplate.canvas_size_width) || 1920));
   let canvasHeight = Math.max(1, Number((existingTemplate && existingTemplate.canvas_size_height) || 1080));
@@ -186,6 +245,10 @@ async function buildTemplatePayload(pool, req, existingTemplate) {
   const backgroundImage = filesByField.background_image;
   const removeBackgroundImage = Boolean(req.body.remove_background_image);
   const backgroundColor = sanitizeBackgroundColor(req.body.background_color || (existingTemplate && existingTemplate.background_color));
+  const submittedBackgroundGradient = Object.prototype.hasOwnProperty.call(req.body, 'background_gradient')
+    ? req.body.background_gradient
+    : existingTemplate && existingTemplate.background_gradient;
+  const backgroundGradient = normalizeBackgroundGradient(submittedBackgroundGradient);
   const backgroundImagePath = backgroundImage
     ? `/media/uploads/${backgroundImage.filename}`
     : removeBackgroundImage
@@ -230,6 +293,7 @@ async function buildTemplatePayload(pool, req, existingTemplate) {
     canvasSizeHeight: canvasHeight,
     backgroundImagePath,
     backgroundColor,
+    backgroundGradient,
     regions
   };
 }
@@ -239,5 +303,6 @@ module.exports = {
   fetchTemplatesData,
   extractTemplateRegions,
   buildTemplatePayload,
+  normalizeBackgroundGradient,
   parseJsonSafe
 };

src/data/timetables.js

@@ -0,0 +1,144 @@
+// Timetable group and entry data access helpers.
+
+const { fetchPagedRows, validateMaxLength } = require('./utils');
+
+const NAME_MAX_LENGTH = 255;
+const DESCRIPTION_MAX_LENGTH = 255;
+const DEFAULT_TIME_ZONE = 'Europe/London';
+
+function normalizeTimeZone(value, fallback) {
+  const raw = String(value || '').trim();
+  if (!raw) {
+    return String(fallback || DEFAULT_TIME_ZONE).trim() || DEFAULT_TIME_ZONE;
+  }
+
+  try {
+    new Intl.DateTimeFormat('en-GB', { timeZone: raw }).format(new Date());
+    return raw;
+  } catch (_error) {
+    const error = new Error('Timetable time zone is invalid.');
+    error.statusCode = 400;
+    throw error;
+  }
+}
+
+function normalizeDisplayMode(value) {
+  const mode = String(value || 'upcoming').trim().toLowerCase();
+  if (mode === 'current' || mode === 'both') {
+    return mode;
+  }
+  return 'upcoming';
+}
+
+async function fetchTimetablesData(pool) {
+  const [timetableGroups] = await pool.query(`
+    SELECT g.id, g.name, g.short_description, g.timezone, g.created_at, g.modified_at, g.created_by, g.modified_by,
+           (SELECT COUNT(*) FROM i_timetable_entries e WHERE e.schedule_group_id = g.id) AS entry_count,
+           (SELECT MIN(e.start_datetime) FROM i_timetable_entries e WHERE e.schedule_group_id = g.id AND e.start_datetime IS NOT NULL) AS next_start_datetime
+    FROM i_timetable_groups g
+    ORDER BY g.modified_at DESC, g.id DESC
+  `);
+  const [timetableEntries] = await pool.query(`
+    SELECT id, schedule_group_id, title, short_description, start_datetime, end_datetime, created_at, modified_at, created_by, modified_by
+    FROM i_timetable_entries
+    ORDER BY schedule_group_id ASC, start_datetime ASC, id ASC
+  `);
+
+  const entriesByGroupId = new Map();
+  timetableEntries.forEach(function (entry) {
+    const groupId = Number(entry.schedule_group_id);
+    if (!entriesByGroupId.has(groupId)) {
+      entriesByGroupId.set(groupId, []);
+    }
+    entriesByGroupId.get(groupId).push(entry);
+  });
+
+  const groups = timetableGroups.map(function (group) {
+    return Object.assign({}, group, {
+      entries: entriesByGroupId.get(Number(group.id)) || []
+    });
+  });
+
+  return {
+    timetableGroups: groups,
+    timetableEntries: timetableEntries
+  };
+}
+
+async function fetchTimetableGroupsPage(pool, page, pageSize, searchTerm, sortKey, sortDirection) {
+  const paged = await fetchPagedRows(pool, {
+    selectSql: `SELECT g.id, g.name, g.short_description, g.timezone, g.created_at, g.modified_at, g.created_by, g.modified_by,
+        (SELECT COUNT(*) FROM i_timetable_entries e WHERE e.schedule_group_id = g.id) AS entry_count,
+        (SELECT MIN(e.start_datetime) FROM i_timetable_entries e WHERE e.schedule_group_id = g.id AND e.start_datetime IS NOT NULL) AS next_start_datetime
+      FROM i_timetable_groups g
+    ORDER BY g.modified_at DESC, g.id DESC`,
+      countSql: 'SELECT COUNT(*) AS count FROM i_timetable_groups',
+    searchColumns: ['g.name', 'g.short_description'],
+    searchTerm: searchTerm,
+    sortColumns: {
+      name: 'g.name',
+      description: 'g.short_description',
+      timezone: 'g.timezone',
+      entries: 'entry_count',
+      next_start: 'next_start_datetime',
+      created: 'g.created_at',
+      modified: 'g.modified_at'
+    },
+    sortKey: sortKey,
+    sortDirection: sortDirection,
+    page: page,
+    pageSize: pageSize
+  });
+
+  return Object.assign({ timetableGroups: paged.rows }, paged);
+}
+
+async function fetchTimetableGroupById(pool, id) {
+  const [rows] = await pool.query(
+    'SELECT id, name, short_description, timezone, created_at, modified_at, created_by, modified_by FROM i_timetable_groups WHERE id = ?',
+    [id]
+  );
+
+  return rows[0] || null;
+}
+
+async function fetchTimetableEntriesByGroupId(pool, timetableGroupId) {
+  const [rows] = await pool.query(
+    `SELECT id, schedule_group_id, title, short_description, start_datetime, end_datetime, created_at, modified_at, created_by, modified_by
+     FROM i_timetable_entries
+     WHERE schedule_group_id = ?
+     ORDER BY start_datetime ASC, id ASC`,
+    [timetableGroupId]
+  );
+
+  return rows;
+}
+
+function buildTimetableGroupPayload(req, existingTimetableGroup) {
+  const fallback = existingTimetableGroup || {};
+  const name = validateMaxLength(req.body.name || fallback.name || '', NAME_MAX_LENGTH, 'Timetable group name');
+  const shortDescription = validateMaxLength(req.body.short_description || req.body.shortDescription || fallback.short_description || '', DESCRIPTION_MAX_LENGTH, 'Timetable group description');
+  const timezone = normalizeTimeZone(req.body.timezone || req.body.time_zone || fallback.timezone || DEFAULT_TIME_ZONE, fallback.timezone || DEFAULT_TIME_ZONE);
+
+  if (!name) {
+    const error = new Error('Timetable group name is required.');
+    error.statusCode = 400;
+    throw error;
+  }
+
+  return {
+    name: name,
+    shortDescription: shortDescription,
+    timezone: timezone
+  };
+}
+
+module.exports = {
+  normalizeDisplayMode,
+  fetchTimetablesData,
+  fetchTimetableGroupsPage,
+  fetchTimetableGroupById,
+  fetchTimetableEntriesByGroupId,
+  buildTimetableGroupPayload,
+  normalizeTimeZone
+};

src/data/utils.js

@@ -24,6 +24,26 @@ function readFormArray(body, key) {
   return [body[key]];
 }
 
+function validateMaxLength(value, maxLength, fieldName) {
+  const text = String(value || '').trim();
+  const limit = Number(maxLength);
+  if (Number.isFinite(limit) && limit > 0 && text.length > limit) {
+    const error = new Error(fieldName + ' must be ' + limit + ' characters or fewer.');
+    error.statusCode = 400;
+    throw error;
+  }
+  return text;
+}
+
+function truncateToMaxLength(value, maxLength) {
+  const text = String(value || '').trim();
+  const limit = Number(maxLength);
+  if (!Number.isFinite(limit) || limit <= 0 || text.length <= limit) {
+    return text;
+  }
+  return text.slice(0, limit);
+}
+
 function normalizePageNumber(value) {
   const pageNumber = Math.floor(Number(value) || 1);
   return Math.max(1, pageNumber);
@@ -201,6 +221,75 @@ function findTopLevelWhereIndex(sql) {
   return lastWhereIndex;
 }
 
+function findTopLevelGroupByIndex(sql) {
+  const text = String(sql || '');
+  let depth = 0;
+  let inSingleQuote = false;
+  let inDoubleQuote = false;
+  let inBacktick = false;
+  let lastGroupByIndex = -1;
+
+  for (let index = 0; index < text.length; index += 1) {
+    const character = text[index];
+    const previousCharacter = index > 0 ? text[index - 1] : '';
+
+    if (inSingleQuote) {
+      if (character === '\'' && previousCharacter !== '\\') {
+        inSingleQuote = false;
+      }
+      continue;
+    }
+
+    if (inDoubleQuote) {
+      if (character === '"' && previousCharacter !== '\\') {
+        inDoubleQuote = false;
+      }
+      continue;
+    }
+
+    if (inBacktick) {
+      if (character === '`') {
+        inBacktick = false;
+      }
+      continue;
+    }
+
+    if (character === '\'') {
+      inSingleQuote = true;
+      continue;
+    }
+
+    if (character === '"') {
+      inDoubleQuote = true;
+      continue;
+    }
+
+    if (character === '`') {
+      inBacktick = true;
+      continue;
+    }
+
+    if (character === '(') {
+      depth += 1;
+      continue;
+    }
+
+    if (character === ')' && depth > 0) {
+      depth -= 1;
+      continue;
+    }
+
+    if (depth === 0 && /[gG]/.test(character)) {
+      const remaining = text.slice(index);
+      if (/^group\s+by\b/i.test(remaining)) {
+        lastGroupByIndex = index;
+      }
+    }
+  }
+
+  return lastGroupByIndex;
+}
+
 function buildSearchFilter(searchColumns, searchTerm) {
   const columns = Array.isArray(searchColumns) ? searchColumns.map(function (column) {
     return String(column || '').trim();
@@ -238,17 +327,24 @@ async function fetchPagedRows(pool, options) {
     throw new Error('fetchPagedRows requires selectSql and countSql.');
   }
   const orderByIndex = findTopLevelOrderByIndex(selectSql);
+  const groupByIndex = findTopLevelGroupByIndex(selectSql);
   let baseSelectSql = selectSql;
   let orderBySql = '';
+  let groupBySql = '';
 
   if (orderByIndex >= 0) {
     baseSelectSql = selectSql.slice(0, orderByIndex).trim();
     orderBySql = selectSql.slice(orderByIndex).trim();
   }
 
+  if (groupByIndex >= 0 && (orderByIndex < 0 || groupByIndex < orderByIndex)) {
+    baseSelectSql = selectSql.slice(0, groupByIndex).trim();
+    groupBySql = selectSql.slice(groupByIndex, orderByIndex >= 0 ? orderByIndex : selectSql.length).trim();
+  }
+
   const hasTopLevelWhere = findTopLevelWhereIndex(baseSelectSql) >= 0;
   const searchClause = searchFilter.clause ? (hasTopLevelWhere ? searchFilter.clause.replace(/^\s*WHERE\s+/i, ' AND ') : searchFilter.clause) : '';
-  const filteredSelectSql = `${baseSelectSql}${searchClause}`;
+  const filteredSelectSql = `${baseSelectSql}${searchClause}${groupBySql ? ' ' + groupBySql : ''}`;
   const countQuery = searchFilter.clause
     ? `SELECT COUNT(*) AS count FROM (${filteredSelectSql}) AS filtered_rows`
     : countSql;
@@ -294,10 +390,13 @@ async function fetchDuplicateName(pool, tableName, name, excludeId, columnName)
 module.exports = {
   parseJsonSafe,
   readFormArray,
+  validateMaxLength,
+  truncateToMaxLength,
   normalizePageNumber,
   normalizeSortDirection,
   buildSortOrderClause,
   findTopLevelOrderByIndex,
+  findTopLevelGroupByIndex,
   buildSearchFilter,
   fetchPagedRows,
   fetchDuplicateName

src/data/weather-units.js

@@ -0,0 +1,67 @@
+// Convert cached weather snapshots for display without refetching.
+
+function convertTemperature(value, fromUnit, toUnit) {
+  const number = Number(value);
+  if (!Number.isFinite(number) || fromUnit === toUnit) return value;
+  const converted = toUnit === 'fahrenheit' ? number * 9 / 5 + 32 : (number - 32) * 5 / 9;
+  return Math.round(converted * 10) / 10;
+}
+
+function convertWind(value, fromUnit, toUnit) {
+  const number = Number(value);
+  if (!Number.isFinite(number) || fromUnit === toUnit) return value;
+  const metresPerSecond = fromUnit === 'mph' ? number * 0.44704 : fromUnit === 'kmh' ? number / 3.6 : number;
+  const converted = toUnit === 'mph' ? metresPerSecond / 0.44704 : toUnit === 'kmh' ? metresPerSecond * 3.6 : metresPerSecond;
+  return Math.round(converted * 10) / 10;
+}
+
+function convertPrecipitation(value, fromUnit, toUnit) {
+  const number = Number(value);
+  if (!Number.isFinite(number) || fromUnit === toUnit) return value;
+  const converted = toUnit === 'inch' ? number / 25.4 : number * 25.4;
+  return Math.round(converted * 100) / 100;
+}
+
+function temperatureUnitFromLabel(label) {
+  return /f/i.test(String(label || '')) ? 'fahrenheit' : 'celsius';
+}
+
+function windUnitFromLabel(label) {
+  const value = String(label || '').toLowerCase();
+  return value.includes('mph') ? 'mph' : value.includes('m/s') ? 'ms' : 'kmh';
+}
+
+function precipitationUnitFromLabel(label) {
+  return /in/i.test(String(label || '')) ? 'inch' : 'mm';
+}
+
+function convertField(data, fields, converter, fromUnit, toUnit) {
+  fields.forEach(function (field) {
+    if (data[field] === undefined || data[field] === null) return;
+    data[field] = Array.isArray(data[field])
+      ? data[field].map(function (value) { return converter(value, fromUnit, toUnit); })
+      : converter(data[field], fromUnit, toUnit);
+  });
+}
+
+function convertWeatherSnapshot(snapshot, targetUnits) {
+  const source = snapshot && typeof snapshot === 'object' ? snapshot : {};
+  const target = Object.assign({ temperature: 'celsius', wind: 'kmh', precipitation: 'mm' }, targetUnits || {});
+  const result = JSON.parse(JSON.stringify(source));
+  const currentUnits = source.current_units || {};
+  const hourlyUnits = source.hourly_units || currentUnits;
+  const dailyUnits = source.daily_units || currentUnits;
+
+  convertField(result.current || {}, ['temperature_2m', 'apparent_temperature'], convertTemperature, temperatureUnitFromLabel(currentUnits.temperature_2m), target.temperature);
+  convertField(result.current || {}, ['wind_speed_10m'], convertWind, windUnitFromLabel(currentUnits.wind_speed_10m), target.wind);
+  convertField(result.current || {}, ['precipitation', 'rain'], convertPrecipitation, precipitationUnitFromLabel(currentUnits.precipitation), target.precipitation);
+  convertField(result.hourly || {}, ['temperature_2m'], convertTemperature, temperatureUnitFromLabel(hourlyUnits.temperature_2m), target.temperature);
+  convertField(result.hourly || {}, ['wind_speed_10m'], convertWind, windUnitFromLabel(hourlyUnits.wind_speed_10m), target.wind);
+  convertField(result.hourly || {}, ['precipitation'], convertPrecipitation, precipitationUnitFromLabel(hourlyUnits.precipitation), target.precipitation);
+  convertField(result.daily || {}, ['temperature_2m_max', 'temperature_2m_min'], convertTemperature, temperatureUnitFromLabel(dailyUnits.temperature_2m_max), target.temperature);
+  convertField(result.daily || {}, ['wind_speed_10m_max'], convertWind, windUnitFromLabel(dailyUnits.wind_speed_10m_max), target.wind);
+  convertField(result.daily || {}, ['precipitation_sum'], convertPrecipitation, precipitationUnitFromLabel(dailyUnits.precipitation_sum), target.precipitation);
+  return result;
+}
+
+module.exports = { convertWeatherSnapshot };

src/data/weather.js

@@ -0,0 +1,138 @@
+// Weather location data access and form normalization.
+
+const { fetchPagedRows, validateMaxLength } = require('./utils');
+const { fetchAppSettings } = require('./app-settings');
+
+const NAME_MAX_LENGTH = 255;
+const LOCATION_MAX_LENGTH = 255;
+const TIMEZONE_MAX_LENGTH = 128;
+const PROVIDERS = ['open-meteo', 'pirate-weather'];
+const TEMPERATURE_UNITS = ['celsius', 'fahrenheit'];
+const WIND_UNITS = ['kmh', 'mph', 'ms'];
+const PRECIPITATION_UNITS = ['mm', 'inch'];
+
+async function fetchWeatherLocationSuggestions(query) {
+  const search = validateMaxLength(query, LOCATION_MAX_LENGTH, 'Location search');
+  if (!search) {
+    return [];
+  }
+
+  const response = await fetch('https://geocoding-api.open-meteo.com/v1/search?name=' + encodeURIComponent(search) + '&count=8&language=en&format=json', {
+    headers: { Accept: 'application/json', 'User-Agent': 'Pulse Signage weather location lookup' }
+  });
+  if (!response.ok) {
+    throw new Error('Weather location lookup failed.');
+  }
+  const data = await response.json();
+  return (Array.isArray(data.results) ? data.results : []).map(function (result) {
+    return {
+      label: [result.name, result.admin1, result.country].filter(Boolean).join(', '),
+      latitude: Number(result.latitude),
+      longitude: Number(result.longitude),
+      timezone: String(result.timezone || '')
+    };
+  }).filter(function (result) {
+    return result.label && Number.isFinite(result.latitude) && Number.isFinite(result.longitude) && result.timezone;
+  });
+}
+
+function normalizeChoice(value, choices, fallback) {
+  const normalized = String(value || '').trim().toLowerCase();
+  return choices.includes(normalized) ? normalized : fallback;
+}
+
+async function fetchWeatherLocationsPage(pool, page, pageSize, searchTerm, sortKey, sortDirection) {
+  const paged = await fetchPagedRows(pool, {
+    selectSql: 'SELECT id, name, location_label, latitude, longitude, timezone, provider, temperature_unit, wind_unit, precipitation_unit, enabled, update_interval_value, update_interval_unit, last_pulled_at, last_pull_error, created_at, modified_at FROM i_weather_locations ORDER BY modified_at DESC, id DESC',
+    countSql: 'SELECT COUNT(*) AS count FROM i_weather_locations',
+    searchColumns: ['name', 'location_label', 'timezone', 'provider'],
+    searchTerm: searchTerm,
+    sortColumns: {
+      name: 'name',
+      location: 'location_label',
+      provider: 'provider',
+      interval: ['update_interval_value', 'update_interval_unit'],
+      last_pulled: 'last_pulled_at',
+      modified: 'modified_at'
+    },
+    sortKey: sortKey,
+    sortDirection: sortDirection,
+    page: page,
+    pageSize: pageSize
+  });
+  return Object.assign({ weatherLocations: paged.rows }, paged);
+}
+
+async function fetchWeatherLocationsData(pool) {
+  const [rows] = await pool.query('SELECT id, name, location_label, latitude, longitude, timezone, provider, temperature_unit, wind_unit, precipitation_unit, enabled, update_interval_value, update_interval_unit, last_pulled_at, last_pull_error, last_response_json, created_at, modified_at FROM i_weather_locations ORDER BY modified_at DESC, id DESC');
+  return { weatherLocations: rows };
+}
+
+async function fetchWeatherLocationById(pool, id) {
+  const [rows] = await pool.query('SELECT id, name, location_label, latitude, longitude, timezone, provider, temperature_unit, wind_unit, precipitation_unit, enabled, update_interval_value, update_interval_unit, last_pulled_at, last_pull_error, last_response_json, created_at, modified_at, created_by, modified_by FROM i_weather_locations WHERE id = ?', [id]);
+  return rows[0] || null;
+}
+
+async function fetchWeatherLocationForecast(pool, location) {
+  const source = location || {};
+  const settings = await fetchAppSettings(pool);
+  const latitude = Number(source.latitude);
+  const longitude = Number(source.longitude);
+  const temperatureUnit = source.temperature_unit === 'fahrenheit' ? 'fahrenheit' : 'celsius';
+  const windUnit = source.wind_unit === 'mph' ? 'mph' : source.wind_unit === 'ms' ? 'ms' : 'kmh';
+  const precipitationUnit = source.precipitation_unit === 'inch' ? 'inch' : 'mm';
+  let url;
+  let headers = { Accept: 'application/json', 'User-Agent': 'Pulse Signage weather reader' };
+
+  if (source.provider === 'pirate-weather') {
+    const apiKey = String(settings['weather.pirate_weather_api_key'] || '').trim();
+    if (!apiKey) throw new Error('Pirate Weather API key is not configured.');
+    url = 'https://api.pirateweather.net/forecast/' + encodeURIComponent(apiKey) + '/' + latitude + ',' + longitude + '?units=' + (temperatureUnit === 'fahrenheit' ? 'us' : 'si');
+  } else {
+    const params = new URLSearchParams({ latitude: String(latitude), longitude: String(longitude), timezone: String(source.timezone || 'auto'), forecast_days: '7', forecast_hours: '24', current: 'temperature_2m,relative_humidity_2m,apparent_temperature,is_day,precipitation,rain,weather_code,wind_speed_10m,wind_direction_10m,uv_index,cloud_cover', hourly: 'temperature_2m,precipitation_probability,precipitation,weather_code,wind_speed_10m,uv_index,cloud_cover', daily: 'weather_code,temperature_2m_max,temperature_2m_min,sunrise,sunset,precipitation_probability_max,precipitation_sum,wind_speed_10m_max,uv_index_max,cloud_cover_mean', temperature_unit: temperatureUnit, wind_speed_unit: windUnit, precipitation_unit: precipitationUnit });
+    const apiKey = String(settings['weather.open_meteo_api_key'] || '').trim();
+    if (apiKey) params.set('apikey', apiKey);
+    url = 'https://api.open-meteo.com/v1/forecast?' + params.toString();
+  }
+
+  const response = await fetch(url, { headers: headers });
+  if (!response.ok) throw new Error('Weather provider returned HTTP ' + response.status + '.');
+  const snapshot = await response.json();
+  return { snapshot: snapshot, responseJson: JSON.stringify(snapshot), fetchedAt: new Date() };
+}
+
+function buildWeatherLocationPayload(req, existingLocation) {
+  const body = req && req.body ? req.body : {};
+  const fallback = existingLocation || {};
+  const name = validateMaxLength(body.name || fallback.name || '', NAME_MAX_LENGTH, 'Weather location name');
+  const locationLabel = validateMaxLength(body.location_label || fallback.location_label || '', LOCATION_MAX_LENGTH, 'Location label');
+  const latitude = Number(body.latitude !== undefined ? body.latitude : fallback.latitude);
+  const longitude = Number(body.longitude !== undefined ? body.longitude : fallback.longitude);
+  const timezone = validateMaxLength(body.timezone || fallback.timezone || '', TIMEZONE_MAX_LENGTH, 'Timezone');
+  const provider = normalizeChoice(body.provider || fallback.provider, PROVIDERS, 'open-meteo');
+  const temperatureUnit = normalizeChoice(body.temperature_unit || fallback.temperature_unit, TEMPERATURE_UNITS, 'celsius');
+  const windUnit = normalizeChoice(body.wind_unit || fallback.wind_unit, WIND_UNITS, 'kmh');
+  const precipitationUnit = normalizeChoice(body.precipitation_unit || fallback.precipitation_unit, PRECIPITATION_UNITS, 'mm');
+  const updateIntervalValue = Number(body.update_interval_value || fallback.update_interval_value || 30);
+  const updateIntervalUnit = normalizeChoice(body.update_interval_unit || fallback.update_interval_unit, ['minutes', 'hours'], 'minutes');
+
+  if (!name || !locationLabel || !timezone) {
+    const error = new Error('Name, location label, and timezone are required.');
+    error.statusCode = 400;
+    throw error;
+  }
+  if (!Number.isFinite(latitude) || latitude < -90 || latitude > 90 || !Number.isFinite(longitude) || longitude < -180 || longitude > 180) {
+    const error = new Error('Latitude must be between -90 and 90, and longitude must be between -180 and 180.');
+    error.statusCode = 400;
+    throw error;
+  }
+  if (!Number.isInteger(updateIntervalValue) || updateIntervalValue < 1 || updateIntervalValue > 1440) {
+    const error = new Error('Update interval must be a whole number between 1 and 1440.');
+    error.statusCode = 400;
+    throw error;
+  }
+
+  return { name, locationLabel, latitude, longitude, timezone, provider, temperatureUnit, windUnit, precipitationUnit, updateIntervalValue, updateIntervalUnit };
+}
+
+module.exports = { fetchWeatherLocationsData, fetchWeatherLocationsPage, fetchWeatherLocationById, fetchWeatherLocationSuggestions, fetchWeatherLocationForecast, buildWeatherLocationPayload, PROVIDERS, TEMPERATURE_UNITS, WIND_UNITS, PRECIPITATION_UNITS };

src/db/bootstrap.js

@@ -1,13 +1,33 @@
-const { hashPassword } = require('../auth');
+const { hashPassword } = require('#src/auth');
-const { PERMISSIONS, DEFAULT_ROLE } = require('../rbac');
+const { PERMISSIONS, DEFAULT_ROLE } = require('#src/rbac');
 
 async function bootstrapDatabase(pool) {
+  const [canvasSizeCountRows] = await pool.query('SELECT COUNT(*) AS canvas_size_count FROM c_canvas_sizes');
+  if (!canvasSizeCountRows.length || Number(canvasSizeCountRows[0].canvas_size_count) === 0) {
+    await pool.query(`
+      INSERT IGNORE INTO c_canvas_sizes (name, width, height) VALUES
+        ('Full HD', 1920, 1080),
+        ('HD', 1280, 720),
+        ('4K UHD', 3840, 2160),
+        ('Portrait Full HD', 1080, 1920),
+        ('Portrait HD', 720, 1280)
+    `);
+  }
+
   for (const permission of PERMISSIONS) {
+    await pool.query(
+      `UPDATE a_permissions
+          SET name = ?, section_name = ?, description = ?, modified_by = ?
+        WHERE permission_key = ?`,
+      [permission.name, permission.sectionName, permission.description || null, null, permission.key]
+    );
     await pool.query(
       `INSERT INTO a_permissions (permission_key, name, section_name, description, created_by, modified_by)
-       VALUES (?, ?, ?, ?, ?, ?)
+       SELECT ?, ?, ?, ?, ?, ?
-       ON DUPLICATE KEY UPDATE name = VALUES(name), section_name = VALUES(section_name), description = VALUES(description), modified_by = VALUES(modified_by)` ,
+        WHERE NOT EXISTS (
-      [permission.key, permission.name, permission.sectionName, permission.description || null, null, null]
+          SELECT 1 FROM a_permissions WHERE permission_key = ?
+        )`,
+      [permission.key, permission.name, permission.sectionName, permission.description || null, null, null, permission.key]
     );
   }
 
@@ -23,22 +43,37 @@ async function bootstrapDatabase(pool) {
     );
   }
 
-  await pool.query('UPDATE a_users SET name = username WHERE name IS NULL OR name = ""');
+  const [legacyRoleRows] = await pool.query('SELECT id FROM a_roles WHERE role_key = ? LIMIT 1', ['administrators']);
+  const [currentRoleRows] = await pool.query('SELECT id FROM a_roles WHERE role_key = ? LIMIT 1', [DEFAULT_ROLE.key]);
+  if (legacyRoleRows.length && !currentRoleRows.length) {
+    await pool.query(
+      `UPDATE a_roles
+          SET role_key = ?, name = ?, description = ?, modified_by = ?
+        WHERE role_key = ?`,
+      [DEFAULT_ROLE.key, DEFAULT_ROLE.name, DEFAULT_ROLE.description || null, null, 'administrators']
+    );
+  }
 
   await pool.query(
     `INSERT INTO a_roles (role_key, name, description, created_by, modified_by)
-     VALUES (?, ?, ?, ?, ?)
+     SELECT ?, ?, ?, ?, ?
-     ON DUPLICATE KEY UPDATE name = VALUES(name), description = VALUES(description), modified_by = VALUES(modified_by)`,
+      WHERE NOT EXISTS (
-    [DEFAULT_ROLE.key, DEFAULT_ROLE.name, DEFAULT_ROLE.description || null, null, null]
+        SELECT 1 FROM a_roles WHERE role_key = ?
+      )`,
+    [DEFAULT_ROLE.key, DEFAULT_ROLE.name, DEFAULT_ROLE.description || null, null, null, DEFAULT_ROLE.key]
   );
 
   const [defaultRoleRows] = await pool.query('SELECT id FROM a_roles WHERE role_key = ? LIMIT 1', [DEFAULT_ROLE.key]);
   const defaultRoleId = defaultRoleRows.length ? Number(defaultRoleRows[0].id) : null;
   if (defaultRoleId) {
     await pool.query(
-      `INSERT IGNORE INTO a_role_permissions (role_id, permission_id, created_by, modified_by)
+      `INSERT INTO a_role_permissions (role_id, permission_id, created_by, modified_by)
-       SELECT ?, id, NULL, NULL FROM a_permissions`,
+       SELECT ?, permissions.id, NULL, NULL
-      [defaultRoleId]
+         FROM a_permissions permissions
+         LEFT JOIN a_role_permissions existing
+           ON existing.role_id = ? AND existing.permission_id = permissions.id
+        WHERE existing.id IS NULL`,
+      [defaultRoleId, defaultRoleId]
     );
   }
 

src/db/common.js

@@ -7,6 +7,7 @@ function createPool() {
     user: process.env.DB_USER || 'signage_user',
     password: process.env.DB_PASSWORD || 'signage_password',
     database: process.env.DB_NAME || 'signage',
+    timezone: 'Z',
     waitForConnections: true,
     connectionLimit: 10,
     namedPlaceholders: true
@@ -16,7 +17,8 @@ function createPool() {
 async function pruneStaleOnboardingDevices(pool) {
   await pool.query(
     `DELETE FROM d_onboarding_devices
-     WHERE modified_at < (CURRENT_TIMESTAMP - INTERVAL 1 MINUTE)`
+     WHERE screen_id IS NULL
+       AND modified_at < (CURRENT_TIMESTAMP - INTERVAL 1 MINUTE)`
   );
 }
 

src/db/index.js

@@ -1,5 +1,26 @@
+const { version: appVersion } = require('#root/package.json');
+const { compareVersions, detectSchemaVersion, getPendingMigrations, recordSchemaVersion, runMigrations } = require('./migrations');
+
 // Snapshot only: keep this file aligned with the current schema state.
 async function ensureSchema(pool, options) {
+  const schemaLockName = 'pulse_signage_schema_lock';
+  const schemaConnection = await pool.getConnection();
+
+  try {
+    pool = schemaConnection;
+
+    const [lockRows] = await pool.query('SELECT GET_LOCK(?, 120) AS lock_acquired', [schemaLockName]);
+    if (!Number(lockRows && lockRows[0] && lockRows[0].lock_acquired)) {
+      throw new Error('Unable to acquire the schema migration lock.');
+    }
+
+    try {
+      const currentVersion = await detectSchemaVersion(pool);
+      const pendingMigrations = await getPendingMigrations(pool, { currentVersion: currentVersion });
+      const updateRequired = pendingMigrations.length > 0;
+
+      console.info('[schema] previous=' + currentVersion + ' current=' + appVersion + ' update=' + (updateRequired ? 'yes' : 'no'));
+
       await pool.query(`
     CREATE TABLE IF NOT EXISTS c_canvas_sizes (
       id INT AUTO_INCREMENT PRIMARY KEY,
@@ -20,10 +41,12 @@ async function ensureSchema(pool, options) {
       name VARCHAR(255) NOT NULL,
       fade_between_slides TINYINT(1) NOT NULL DEFAULT 0,
       skip_unavailable_rtmp TINYINT(1) NOT NULL DEFAULT 0,
+      canvas_id INT NULL,
       created_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
       created_by INT NULL,
       modified_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
-      modified_by INT NULL
+      modified_by INT NULL,
+      CONSTRAINT fk_playlists_canvas FOREIGN KEY (canvas_id) REFERENCES c_canvas_sizes(id) ON DELETE SET NULL
     ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci
   `);
 
@@ -34,6 +57,7 @@ async function ensureSchema(pool, options) {
       canvas_size_id INT NULL,
       background_image_path VARCHAR(512) NULL,
       background_color VARCHAR(32) NULL,
+      background_gradient LONGTEXT NULL,
       created_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
       created_by INT NULL,
       modified_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
@@ -41,15 +65,6 @@ async function ensureSchema(pool, options) {
     ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci
   `);
 
-  await pool.query(`
-    INSERT IGNORE INTO c_canvas_sizes (name, width, height) VALUES
-      ('Full HD', 1920, 1080),
-      ('HD', 1280, 720),
-      ('4K UHD', 3840, 2160),
-      ('Portrait Full HD', 1080, 1920),
-      ('Portrait HD', 720, 1280)
-  `);
-
   await pool.query(`
     CREATE TABLE IF NOT EXISTS c_template_regions (
       id INT AUTO_INCREMENT PRIMARY KEY,
@@ -59,6 +74,7 @@ async function ensureSchema(pool, options) {
       label VARCHAR(255) NOT NULL,
       font_family VARCHAR(100) NULL,
       lock_ratio VARCHAR(20) NULL,
+      animation_json JSON NULL,
       x INT NOT NULL DEFAULT 0,
       y INT NOT NULL DEFAULT 0,
       width INT NOT NULL DEFAULT 100,
@@ -93,12 +109,7 @@ async function ensureSchema(pool, options) {
       position INT NOT NULL DEFAULT 0,
       duration_seconds DECIMAL(10,3) NOT NULL DEFAULT 10.000,
       use_video_duration TINYINT(1) NOT NULL DEFAULT 0,
-      schedule_mode VARCHAR(20) NOT NULL DEFAULT 'always',
+      disable_audio TINYINT(1) NOT NULL DEFAULT 1,
-      schedule_start_datetime DATETIME NULL,
-      schedule_end_datetime DATETIME NULL,
-      schedule_start_time TIME NULL,
-      schedule_end_time TIME NULL,
-      schedule_days_json JSON NULL,
       created_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
       created_by INT NULL,
       modified_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
@@ -108,13 +119,43 @@ async function ensureSchema(pool, options) {
     ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci
   `);
 
+  await pool.query(`
+    CREATE TABLE IF NOT EXISTS c_playlist_slide_schedule_rules (
+      id INT AUTO_INCREMENT PRIMARY KEY,
+      playlist_slide_id INT NOT NULL,
+      position INT NOT NULL DEFAULT 0,
+      start_datetime DATETIME NULL,
+      end_datetime DATETIME NULL,
+      start_time TIME NULL,
+      end_time TIME NULL,
+      schedule_days_json JSON NULL,
+      created_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
+      created_by INT NULL,
+      modified_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
+      modified_by INT NULL,
+      CONSTRAINT fk_playlist_slide_schedule_rules_slide FOREIGN KEY (playlist_slide_id) REFERENCES c_playlist_slides(id) ON DELETE CASCADE,
+      INDEX idx_playlist_slide_schedule_rules_slide_position (playlist_slide_id, position)
+    ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci
+  `);
+
+  await pool.query(`
+    CREATE TABLE IF NOT EXISTS d_players (
+      id INT AUTO_INCREMENT PRIMARY KEY,
+      identifier VARCHAR(128) NOT NULL UNIQUE,
+      public_base_url VARCHAR(512) NULL,
+      internal_base_url VARCHAR(512) NULL,
+      last_seen_at TIMESTAMP NULL,
+      created_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
+      modified_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP
+    ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci
+  `);
+
   await pool.query(`
     CREATE TABLE IF NOT EXISTS d_screens (
       id INT AUTO_INCREMENT PRIMARY KEY,
       name VARCHAR(255) NOT NULL,
       slug VARCHAR(255) NOT NULL UNIQUE,
       playlist_id INT NULL,
-      player_id INT NULL,
       created_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
       created_by INT NULL,
       modified_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
@@ -144,13 +185,14 @@ async function ensureSchema(pool, options) {
 
   await pool.query(`
     CREATE TABLE IF NOT EXISTS d_announcement_screens (
+      id BIGINT AUTO_INCREMENT PRIMARY KEY,
       announcement_id INT NOT NULL,
       screen_id INT NOT NULL,
       created_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
       created_by INT NULL,
       modified_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
       modified_by INT NULL,
-      PRIMARY KEY (announcement_id, screen_id),
+      UNIQUE KEY uq_announcement_screens_pair (announcement_id, screen_id),
       INDEX idx_announcement_screens_screen_id (screen_id),
       CONSTRAINT fk_announcement_screens_announcement FOREIGN KEY (announcement_id) REFERENCES d_announcements(id) ON DELETE CASCADE,
       CONSTRAINT fk_announcement_screens_screen FOREIGN KEY (screen_id) REFERENCES d_screens(id) ON DELETE CASCADE
@@ -162,9 +204,11 @@ async function ensureSchema(pool, options) {
       id INT AUTO_INCREMENT PRIMARY KEY,
       name VARCHAR(255) NOT NULL,
       feed_url VARCHAR(1024) NOT NULL,
+      enabled TINYINT(1) NOT NULL DEFAULT 1,
       update_interval_value INT NOT NULL DEFAULT 60,
       update_interval_unit VARCHAR(10) NOT NULL DEFAULT 'minutes',
       item_limit INT NOT NULL DEFAULT 1,
+      last_pulled_at DATETIME NULL,
       created_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
       created_by INT NULL,
       modified_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
@@ -192,6 +236,21 @@ async function ensureSchema(pool, options) {
       id INT AUTO_INCREMENT PRIMARY KEY,
       name VARCHAR(255) NOT NULL,
       api_url VARCHAR(1024) NOT NULL,
+      request_method VARCHAR(10) NOT NULL DEFAULT 'GET',
+      request_body_json MEDIUMTEXT NULL,
+      auth_method VARCHAR(32) NOT NULL DEFAULT 'none',
+      auth_username VARCHAR(255) NULL,
+      auth_password MEDIUMTEXT NULL,
+      auth_bearer_token MEDIUMTEXT NULL,
+      auth_header_name VARCHAR(255) NULL,
+      auth_header_value MEDIUMTEXT NULL,
+      token_url VARCHAR(1024) NULL,
+      token_request_body_json MEDIUMTEXT NULL,
+      token_response_path VARCHAR(255) NULL DEFAULT 'access_token',
+      token_header_name VARCHAR(255) NULL DEFAULT 'Authorization',
+      token_header_prefix VARCHAR(64) NULL DEFAULT 'Bearer',
+      items_path VARCHAR(255) NULL,
+      enabled TINYINT(1) NOT NULL DEFAULT 1,
       update_interval_value INT NOT NULL DEFAULT 60,
       update_interval_unit VARCHAR(10) NOT NULL DEFAULT 'minutes',
       last_pulled_at TIMESTAMP NULL,
@@ -206,9 +265,66 @@ async function ensureSchema(pool, options) {
     ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci
   `);
 
+  await pool.query(`
+    CREATE TABLE IF NOT EXISTS i_weather_locations (
+      id BIGINT AUTO_INCREMENT PRIMARY KEY,
+      name VARCHAR(255) NOT NULL UNIQUE,
+      location_label VARCHAR(255) NOT NULL,
+      latitude DECIMAL(9,6) NOT NULL,
+      longitude DECIMAL(9,6) NOT NULL,
+      timezone VARCHAR(128) NOT NULL,
+      provider VARCHAR(32) NOT NULL DEFAULT 'open-meteo',
+      temperature_unit VARCHAR(16) NOT NULL DEFAULT 'celsius',
+      wind_unit VARCHAR(16) NOT NULL DEFAULT 'kmh',
+      precipitation_unit VARCHAR(16) NOT NULL DEFAULT 'mm',
+      enabled TINYINT(1) NOT NULL DEFAULT 1,
+      update_interval_value INT NOT NULL DEFAULT 30,
+      update_interval_unit VARCHAR(16) NOT NULL DEFAULT 'minutes',
+      last_pulled_at DATETIME NULL,
+      last_pull_error VARCHAR(1024) NULL,
+      last_response_json MEDIUMTEXT NULL,
+      created_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
+      created_by INT NULL,
+      modified_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
+      modified_by INT NULL,
+      INDEX idx_weather_locations_modified_at (modified_at)
+    ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci
+  `);
+
+  await pool.query(`
+    CREATE TABLE IF NOT EXISTS i_timetable_groups (
+      id INT AUTO_INCREMENT PRIMARY KEY,
+      name VARCHAR(255) NOT NULL,
+      short_description VARCHAR(255) NULL,
+      timezone VARCHAR(64) NOT NULL DEFAULT 'Europe/London',
+      created_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
+      created_by INT NULL,
+      modified_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
+      modified_by INT NULL
+    ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci
+  `);
+
+  await pool.query(`
+    CREATE TABLE IF NOT EXISTS i_timetable_entries (
+      id INT AUTO_INCREMENT PRIMARY KEY,
+      schedule_group_id INT NOT NULL,
+      title VARCHAR(255) NOT NULL,
+      short_description VARCHAR(255) NULL,
+      start_datetime DATETIME NOT NULL,
+      end_datetime DATETIME NULL,
+      created_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
+      created_by INT NULL,
+      modified_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
+      modified_by INT NULL,
+      CONSTRAINT fk_timetable_entries_group FOREIGN KEY (schedule_group_id) REFERENCES i_timetable_groups(id) ON DELETE CASCADE,
+      INDEX idx_timetable_entries_group_start (schedule_group_id, start_datetime)
+    ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci
+  `);
+
   await pool.query(`
     CREATE TABLE IF NOT EXISTS d_onboarding_devices (
-      device_id VARCHAR(128) PRIMARY KEY,
+      id BIGINT AUTO_INCREMENT PRIMARY KEY,
+      device_id VARCHAR(128) NOT NULL UNIQUE,
       client_name VARCHAR(255) NULL,
       screen_id INT NULL,
       created_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
@@ -227,6 +343,8 @@ async function ensureSchema(pool, options) {
       password_hash CHAR(64) NOT NULL,
       password_salt VARCHAR(64) NOT NULL,
       password_iterations INT NOT NULL,
+      must_change_password TINYINT(1) NOT NULL DEFAULT 0,
+      account_locked TINYINT(1) NOT NULL DEFAULT 0,
       created_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
       created_by INT NULL,
       modified_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
@@ -263,13 +381,14 @@ async function ensureSchema(pool, options) {
 
   await pool.query(`
     CREATE TABLE IF NOT EXISTS a_role_permissions (
+      id BIGINT AUTO_INCREMENT PRIMARY KEY,
       role_id INT NOT NULL,
       permission_id INT NOT NULL,
       created_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
       created_by INT NULL,
       modified_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
       modified_by INT NULL,
-      PRIMARY KEY (role_id, permission_id),
+      UNIQUE KEY uq_role_permissions_pair (role_id, permission_id),
       CONSTRAINT fk_role_permissions_role FOREIGN KEY (role_id) REFERENCES a_roles(id) ON DELETE CASCADE,
       CONSTRAINT fk_role_permissions_permission FOREIGN KEY (permission_id) REFERENCES a_permissions(id) ON DELETE CASCADE
     ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci
@@ -277,13 +396,14 @@ async function ensureSchema(pool, options) {
 
   await pool.query(`
     CREATE TABLE IF NOT EXISTS a_user_roles (
+      id BIGINT AUTO_INCREMENT PRIMARY KEY,
       user_id INT NOT NULL,
       role_id INT NOT NULL,
       created_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
       created_by INT NULL,
       modified_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
       modified_by INT NULL,
-      PRIMARY KEY (user_id, role_id),
+      UNIQUE KEY uq_user_roles_pair (user_id, role_id),
       CONSTRAINT fk_user_roles_user FOREIGN KEY (user_id) REFERENCES a_users(id) ON DELETE CASCADE,
       CONSTRAINT fk_user_roles_role FOREIGN KEY (role_id) REFERENCES a_roles(id) ON DELETE CASCADE
     ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci
@@ -291,8 +411,11 @@ async function ensureSchema(pool, options) {
 
   await pool.query(`
     CREATE TABLE IF NOT EXISTS a_sessions (
-      session_hash CHAR(64) PRIMARY KEY,
+      id BIGINT AUTO_INCREMENT PRIMARY KEY,
+      session_hash CHAR(64) NOT NULL UNIQUE,
       user_id INT NOT NULL,
+      ip_address VARCHAR(255) NULL,
+      user_agent VARCHAR(512) NULL,
       expires_at DATETIME NOT NULL,
       created_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
       created_by INT NULL,
@@ -302,6 +425,18 @@ async function ensureSchema(pool, options) {
     ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci
   `);
 
+  await pool.query(`
+    CREATE TABLE IF NOT EXISTS a_login_attempts (
+      id BIGINT AUTO_INCREMENT PRIMARY KEY,
+      rate_key VARCHAR(600) NOT NULL UNIQUE,
+      failed_count INT NOT NULL DEFAULT 0,
+      last_failed_at DATETIME NULL,
+      locked_until DATETIME NULL,
+      created_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
+      modified_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP
+    ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci
+  `);
+
   await pool.query(`
     CREATE TABLE IF NOT EXISTS o_background_tasks (
       id BIGINT AUTO_INCREMENT PRIMARY KEY,
@@ -323,8 +458,27 @@ async function ensureSchema(pool, options) {
     ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci
   `);
 
-  const { runMigrations } = require('./migrations');
+  await pool.query(`
-  await runMigrations(pool, options);
+    CREATE TABLE IF NOT EXISTS o_app_settings (
+      id BIGINT AUTO_INCREMENT PRIMARY KEY,
+      setting_key VARCHAR(191) NOT NULL UNIQUE,
+      setting_value JSON NOT NULL,
+      created_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
+      created_by INT NULL,
+      modified_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
+      modified_by INT NULL
+    ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci
+  `);
+
+      await runMigrations(pool, Object.assign({}, options, { currentVersion: currentVersion }));
+      await recordSchemaVersion(pool, appVersion);
+    } finally {
+      await pool.query('SELECT RELEASE_LOCK(?)', [schemaLockName]).catch(function () {
+      });
+    }
+  } finally {
+    schemaConnection.release();
+  }
 }
 
 module.exports = {

src/db/migrations.js

@@ -1,4 +1,7 @@
 const { version: appVersion } = require('#root/package.json');
+const TIMETABLE_TIME_ZONE = 'Europe/London';
+const APP_STATE_TABLE = 'o_app_state';
+const APP_STATE_SCHEMA_VERSION_KEY = 'schema_version';
 
 const VERSIONED_MIGRATIONS = [
   {
@@ -19,10 +22,6 @@ const VERSIONED_MIGRATIONS = [
         `);
       }
 
-      // Seed the singleton player row used by the current one-player model.
-      // For multi-player support, this seed and the hardcoded screen_id/player_id mapping will need to be replaced.
-      await pool.query(`INSERT IGNORE INTO d_players (device_id) VALUES ('1')`);
-
       // Store the player pointer on screens so we can resolve the player without needing a player-side screen_id.
       // This is the singleton-player shortcut; a multi-player model should make this relational instead of hardcoded to '1'.
       if (!(await columnExists(pool, 'd_screens', 'player_id'))) {
@@ -55,21 +54,11 @@ const VERSIONED_MIGRATIONS = [
       }
 
       // Recreate the screen-to-player foreign key after the column exists and legacy data is copied over.
-      const [screenPlayerFkRows] = await pool.query(
+      await ensureForeignKey(pool, 'd_screens', 'fk_screens_player', 'player_id', 'd_players', 'device_id', 'RESTRICT');
-        `SELECT COUNT(*) AS fk_count
-         FROM information_schema.KEY_COLUMN_USAGE
-         WHERE TABLE_SCHEMA = DATABASE()
-           AND TABLE_NAME = 'd_screens'
-           AND CONSTRAINT_NAME = 'fk_screens_player'`
-      );
-      if (Number(screenPlayerFkRows && screenPlayerFkRows[0] && screenPlayerFkRows[0].fk_count) === 0) {
-        await pool.query('ALTER TABLE d_screens ADD CONSTRAINT fk_screens_player FOREIGN KEY (player_id) REFERENCES d_players(device_id) ON DELETE RESTRICT');
-      }
 
       if (await columnExists(pool, 'c_template_regions', 'font_family')) {
         await pool.query('ALTER TABLE c_template_regions DROP COLUMN font_family');
       }
-
     }
   },
   {
@@ -107,7 +96,70 @@ const VERSIONED_MIGRATIONS = [
           INDEX idx_announcements_modified_at (modified_at)
         ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci
       `);
+    }
+  },
+  {
+    version: '2.4.0',
+    label: 'v2.4.0 playlist schedule rules schema',
+    run: async function (pool) {
+      await pool.query(`
+        CREATE TABLE IF NOT EXISTS c_playlist_slide_schedule_rules (
+          id INT AUTO_INCREMENT PRIMARY KEY,
+          playlist_slide_id INT NOT NULL,
+          position INT NOT NULL DEFAULT 0,
+          start_datetime DATETIME NULL,
+          end_datetime DATETIME NULL,
+          start_time TIME NULL,
+          end_time TIME NULL,
+          schedule_days_json JSON NULL,
+          created_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
+          created_by INT NULL,
+          modified_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
+          modified_by INT NULL,
+          CONSTRAINT fk_playlist_slide_schedule_rules_slide FOREIGN KEY (playlist_slide_id) REFERENCES c_playlist_slides(id) ON DELETE CASCADE,
+          INDEX idx_playlist_slide_schedule_rules_slide_position (playlist_slide_id, position)
+        ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci
+      `);
 
+      const legacyColumnNames = [
+        'schedule_mode',
+        'schedule_start_datetime',
+        'schedule_end_datetime',
+        'schedule_start_time',
+        'schedule_end_time',
+        'schedule_days_json',
+        'schedule_rules_json'
+      ];
+      const existingLegacyColumns = [];
+      for (const columnName of legacyColumnNames) {
+        if (await columnExists(pool, 'c_playlist_slides', columnName)) {
+          existingLegacyColumns.push(columnName);
+        }
+      }
+
+      const selectColumns = ['id'].concat(existingLegacyColumns).join(', ');
+      const [legacyRows] = await pool.query('SELECT ' + selectColumns + ' FROM c_playlist_slides');
+
+      for (const row of legacyRows) {
+        const rules = normalizeLegacyScheduleRules(row);
+        if (rules.length) {
+          for (let index = 0; index < rules.length; index += 1) {
+            const rule = rules[index];
+            await pool.query(
+              'INSERT INTO c_playlist_slide_schedule_rules (playlist_slide_id, position, start_datetime, end_datetime, start_time, end_time, schedule_days_json, created_by, modified_by) VALUES (?, ?, ?, ?, ?, ?, ?, NULL, NULL)',
+              [row.id, index, rule.start_datetime || null, rule.end_datetime || null, rule.start_time || null, rule.end_time || null, rule.schedule_days_json ? JSON.stringify(rule.schedule_days_json) : null]
+            );
+          }
+        }
+      }
+
+      await dropColumnIfExists(pool, 'c_playlist_slides', 'schedule_rules_json');
+      await dropColumnIfExists(pool, 'c_playlist_slides', 'schedule_mode');
+      await dropColumnIfExists(pool, 'c_playlist_slides', 'schedule_start_datetime');
+      await dropColumnIfExists(pool, 'c_playlist_slides', 'schedule_end_datetime');
+      await dropColumnIfExists(pool, 'c_playlist_slides', 'schedule_start_time');
+      await dropColumnIfExists(pool, 'c_playlist_slides', 'schedule_end_time');
+      await dropColumnIfExists(pool, 'c_playlist_slides', 'schedule_days_json');
       await pool.query(`
         CREATE TABLE IF NOT EXISTS d_announcement_screens (
           announcement_id INT NOT NULL,
@@ -123,6 +175,383 @@ const VERSIONED_MIGRATIONS = [
         ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci
       `);
     }
+  },
+  {
+    version: '2.4.2',
+    label: 'v2.4.2 playlist canvas id schema',
+    run: async function (pool) {
+      await ensureColumn(pool, 'c_playlists', 'canvas_id', 'INT NULL', 'skip_unavailable_rtmp');
+      await ensureForeignKey(pool, 'c_playlists', 'fk_playlists_canvas', 'canvas_id', 'c_canvas_sizes', 'id', 'SET NULL');
+      await ensureColumn(pool, 'c_playlist_slides', 'disable_audio', 'TINYINT(1) NOT NULL DEFAULT 1', 'use_video_duration');
+      await pool.query(`
+        UPDATE c_playlists p
+        JOIN (
+          SELECT ps.playlist_id,
+                 COUNT(DISTINCT CONCAT(cs.width, 'x', cs.height)) AS signature_count,
+                 MIN(CONCAT(cs.width, 'x', cs.height)) AS canvas_signature
+          FROM c_playlist_slides ps
+          JOIN c_slides sl ON sl.id = ps.slide_id
+          LEFT JOIN c_templates st ON st.id = sl.template_id
+          LEFT JOIN c_canvas_sizes cs ON cs.id = st.canvas_size_id
+          WHERE cs.width IS NOT NULL
+            AND cs.height IS NOT NULL
+          GROUP BY ps.playlist_id
+        ) x ON x.playlist_id = p.id
+        JOIN c_canvas_sizes cs ON CONCAT(cs.width, 'x', cs.height) = x.canvas_signature
+        SET p.canvas_id = cs.id
+        WHERE (p.canvas_id IS NULL)
+          AND x.signature_count = 1
+      `);
+    }
+  },
+  {
+    version: '2.5.1',
+    label: 'v2.5.1 template animation json schema',
+    run: async function (pool) {
+      await ensureColumn(pool, 'c_template_regions', 'animation_json', 'JSON NULL', 'lock_ratio');
+    }
+  },
+  {
+    version: '2.6.2',
+    label: 'v2.6.2 player identity schema',
+    run: async function (pool) {
+      if (!(await columnExists(pool, 'd_players', 'device_id'))) {
+        await dropForeignKeyIfExists(pool, 'd_screens', 'player_id');
+
+        if (!(await columnExists(pool, 'd_players', 'identifier'))) {
+          await ensureColumn(pool, 'd_players', 'identifier', 'VARCHAR(128) NOT NULL UNIQUE', 'id');
+        }
+        if (!(await columnExists(pool, 'd_players', 'id'))) {
+          await ensureColumn(pool, 'd_players', 'id', 'INT NOT NULL AUTO_INCREMENT', null);
+          await pool.query('ALTER TABLE d_players ADD PRIMARY KEY (id)');
+        } else if (!(await columnIsAutoIncrement(pool, 'd_players', 'id'))) {
+          await pool.query('ALTER TABLE d_players MODIFY COLUMN id INT NOT NULL AUTO_INCREMENT');
+        }
+        await pool.query('ALTER TABLE d_screens MODIFY COLUMN player_id INT NULL AFTER playlist_id');
+        return;
+      }
+
+      await dropForeignKeyIfExists(pool, 'd_screens', 'player_id');
+
+      await pool.query('DROP TABLE IF EXISTS d_players_rebuild');
+      await pool.query(`
+        CREATE TABLE d_players_rebuild (
+          id INT NOT NULL AUTO_INCREMENT PRIMARY KEY,
+          identifier VARCHAR(128) NOT NULL UNIQUE,
+          public_base_url VARCHAR(512) NULL,
+          internal_base_url VARCHAR(512) NULL,
+          last_seen_at TIMESTAMP NULL,
+          created_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
+          modified_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP
+        ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci
+      `);
+
+      await pool.query(`
+        INSERT INTO d_players_rebuild (identifier, public_base_url, internal_base_url, last_seen_at, created_at, modified_at)
+        SELECT DISTINCT
+          device_id AS identifier,
+          public_base_url,
+          internal_base_url,
+          last_seen_at,
+          created_at,
+          modified_at
+        FROM d_players
+        ORDER BY COALESCE(created_at, modified_at, device_id), device_id
+      `);
+
+      await pool.query('DROP TEMPORARY TABLE IF EXISTS d_player_id_map');
+      await pool.query(`
+        CREATE TEMPORARY TABLE d_player_id_map AS
+        SELECT old_players.device_id AS old_device_id, rebuilt_players.id AS new_player_id
+        FROM d_players old_players
+        JOIN d_players_rebuild rebuilt_players ON rebuilt_players.identifier = old_players.device_id
+      `);
+
+      await pool.query(
+        `UPDATE d_screens s
+         JOIN d_player_id_map m ON m.old_device_id = CAST(s.player_id AS CHAR)
+         SET s.player_id = m.new_player_id
+         WHERE s.player_id IS NOT NULL`
+      );
+
+      await pool.query('DROP TABLE d_players');
+      await pool.query('RENAME TABLE d_players_rebuild TO d_players');
+
+      await pool.query('ALTER TABLE d_screens MODIFY COLUMN player_id INT NULL AFTER playlist_id');
+      return;
+    }
+  },
+  {
+    version: '2.6.3',
+    label: 'v2.6.3 screen-player fk removal',
+    run: async function (pool) {
+      await dropForeignKeyIfExists(pool, 'd_screens', 'player_id');
+      if (await columnExists(pool, 'd_screens', 'player_id')) {
+        await pool.query('ALTER TABLE d_screens MODIFY COLUMN player_id INT NULL AFTER playlist_id');
+      }
+    }
+  },
+  {
+    version: '2.6.4',
+    label: 'v2.6.4 drop screen player id',
+    run: async function (pool) {
+      await dropForeignKeyIfExists(pool, 'd_screens', 'player_id');
+      await dropColumnIfExists(pool, 'd_screens', 'player_id');
+    }
+  },
+  {
+    version: '2.6.16',
+    label: 'v2.6.16 timetable timezone schema',
+    run: async function (pool) {
+      const timetableGroupsExists = await tableExists(pool, 'i_timetable_groups');
+      const scheduleGroupsExists = await tableExists(pool, 'i_schedule_groups');
+      const tableName = timetableGroupsExists ? 'i_timetable_groups' : scheduleGroupsExists ? 'i_schedule_groups' : null;
+
+      if (!tableName) {
+        return;
+      }
+
+      await ensureColumn(pool, tableName, 'timezone', "VARCHAR(64) NOT NULL DEFAULT 'Europe/London'", 'short_description');
+    }
+  },
+  {
+    version: '2.6.17',
+    label: 'v2.6.17 timetable europe/london conversion',
+    run: async function (pool) {
+      const timetableGroupsExists = await tableExists(pool, 'i_timetable_groups');
+      const timetableEntriesExists = await tableExists(pool, 'i_timetable_entries');
+      const scheduleGroupsExists = await tableExists(pool, 'i_schedule_groups');
+      const scheduleEntriesExists = await tableExists(pool, 'i_schedule_entries');
+      const groupTableName = timetableGroupsExists ? 'i_timetable_groups' : scheduleGroupsExists ? 'i_schedule_groups' : null;
+      const entryTableName = timetableEntriesExists ? 'i_timetable_entries' : scheduleEntriesExists ? 'i_schedule_entries' : null;
+
+      if (!groupTableName || !entryTableName) {
+        return;
+      }
+
+      await ensureColumn(pool, groupTableName, 'timezone', "VARCHAR(64) NOT NULL DEFAULT 'Europe/London'", 'short_description');
+
+      await pool.query('UPDATE ' + groupTableName + ' SET timezone = ?', [TIMETABLE_TIME_ZONE]);
+
+      const [rows] = await pool.query('SELECT id, start_datetime, end_datetime FROM ' + entryTableName + ' ORDER BY id ASC');
+      for (const row of rows) {
+        const startDate = convertMigrationDateTimeFromTimeZone(row.start_datetime, TIMETABLE_TIME_ZONE);
+        const endDate = row.end_datetime ? convertMigrationDateTimeFromTimeZone(row.end_datetime, TIMETABLE_TIME_ZONE) : null;
+        await pool.query(
+          'UPDATE ' + entryTableName + ' SET start_datetime = ?, end_datetime = ? WHERE id = ?',
+          [formatMigrationDateTimeUtc(startDate), endDate ? formatMigrationDateTimeUtc(endDate) : null, row.id]
+        );
+      }
+    }
+  },
+  {
+    version: '2.6.18',
+    label: 'v2.6.18 timetable table rename',
+    run: async function (pool) {
+      const scheduleGroupsExists = await tableExists(pool, 'i_schedule_groups');
+      const timetableGroupsExists = await tableExists(pool, 'i_timetable_groups');
+
+      if (scheduleGroupsExists) {
+        if (!timetableGroupsExists) {
+          await pool.query('RENAME TABLE i_schedule_groups TO i_timetable_groups, i_schedule_entries TO i_timetable_entries');
+          await ensureColumn(pool, 'i_timetable_groups', 'timezone', "VARCHAR(64) NOT NULL DEFAULT 'Europe/London'", 'short_description');
+          return;
+        }
+
+        await ensureColumn(pool, 'i_timetable_groups', 'timezone', "VARCHAR(64) NOT NULL DEFAULT 'Europe/London'", 'short_description');
+
+        await pool.query(`
+          INSERT IGNORE INTO i_timetable_groups (id, name, short_description, timezone, created_at, created_by, modified_at, modified_by)
+          SELECT id, name, short_description, 'Europe/London' AS timezone, created_at, created_by, modified_at, modified_by
+          FROM i_schedule_groups
+          ORDER BY id ASC
+        `);
+
+        await pool.query(`
+          INSERT IGNORE INTO i_timetable_entries (id, schedule_group_id, title, short_description, start_datetime, end_datetime, created_at, created_by, modified_at, modified_by)
+          SELECT id, schedule_group_id, title, short_description, start_datetime, end_datetime, created_at, created_by, modified_at, modified_by
+          FROM i_schedule_entries
+          ORDER BY schedule_group_id ASC, start_datetime ASC, id ASC
+        `);
+
+        const [groupRows] = await pool.query('SELECT COALESCE(MAX(id), 0) AS max_id FROM i_timetable_groups');
+        const [entryRows] = await pool.query('SELECT COALESCE(MAX(id), 0) AS max_id FROM i_timetable_entries');
+        const nextGroupId = Number(groupRows && groupRows[0] && groupRows[0].max_id) + 1;
+        const nextEntryId = Number(entryRows && entryRows[0] && entryRows[0].max_id) + 1;
+        await pool.query('ALTER TABLE i_timetable_groups AUTO_INCREMENT = ' + nextGroupId);
+        await pool.query('ALTER TABLE i_timetable_entries AUTO_INCREMENT = ' + nextEntryId);
+
+        await pool.query('DROP TABLE i_schedule_entries');
+        await pool.query('DROP TABLE i_schedule_groups');
+      }
+    }
+  },
+  {
+    version: '2.8.0',
+    label: 'v2.8.0 combined application schema',
+    run: async function (pool) {
+      await pool.query(`
+        CREATE TABLE IF NOT EXISTS o_app_settings (
+          id BIGINT AUTO_INCREMENT PRIMARY KEY,
+          setting_key VARCHAR(191) NOT NULL UNIQUE,
+          setting_value JSON NOT NULL,
+          created_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
+          created_by INT NULL,
+          modified_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
+          modified_by INT NULL
+        ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci
+      `);
+      await pool.query(`
+        CREATE TABLE IF NOT EXISTS o_app_state (
+          id BIGINT AUTO_INCREMENT PRIMARY KEY,
+          state_key VARCHAR(191) NOT NULL UNIQUE,
+          state_value MEDIUMTEXT NULL,
+          created_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
+          modified_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP
+        ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci
+      `);
+
+      const numericIdTables = [
+        ['d_announcement_screens', 'uq_announcement_screens_pair', '(announcement_id, screen_id)'],
+        ['d_onboarding_devices', 'uq_onboarding_devices_device_id', '(device_id)'],
+        ['a_role_permissions', 'uq_role_permissions_pair', '(role_id, permission_id)'],
+        ['a_user_roles', 'uq_user_roles_pair', '(user_id, role_id)'],
+        ['a_sessions', 'uq_sessions_hash', '(session_hash)'],
+        ['o_app_state', 'uq_app_state_key', '(state_key)']
+      ];
+
+      for (const [tableName, uniqueKeyName, uniqueColumns] of numericIdTables) {
+        if (!(await tableExists(pool, tableName)) || await columnExists(pool, tableName, 'id')) {
+          continue;
+        }
+        await pool.query('ALTER TABLE ' + tableName + ' DROP PRIMARY KEY, ADD COLUMN id BIGINT NOT NULL AUTO_INCREMENT PRIMARY KEY FIRST, ADD UNIQUE KEY ' + uniqueKeyName + ' ' + uniqueColumns);
+      }
+      await ensureColumn(pool, 'a_users', 'must_change_password', 'TINYINT(1) NOT NULL DEFAULT 0', 'password_iterations');
+      await pool.query(`
+        CREATE TABLE IF NOT EXISTS a_login_attempts (
+          id BIGINT AUTO_INCREMENT PRIMARY KEY,
+          rate_key VARCHAR(600) NOT NULL UNIQUE,
+          failed_count INT NOT NULL DEFAULT 0,
+          last_failed_at DATETIME NULL,
+          locked_until DATETIME NULL,
+          created_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
+          modified_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP
+        ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci
+      `);
+      await ensureColumn(pool, 'a_users', 'account_locked', 'TINYINT(1) NOT NULL DEFAULT 0', 'must_change_password');
+      await ensureColumn(pool, 'a_sessions', 'ip_address', 'VARCHAR(255) NULL', 'user_id');
+      await ensureColumn(pool, 'a_sessions', 'user_agent', 'VARCHAR(512) NULL', 'ip_address');
+      await pool.query(`
+        CREATE TABLE IF NOT EXISTS o_audit_events (
+          id BIGINT AUTO_INCREMENT PRIMARY KEY,
+          occurred_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
+          category VARCHAR(64) NOT NULL,
+          event_type VARCHAR(128) NOT NULL,
+          actor_user_id INT NULL,
+          target_type VARCHAR(64) NULL,
+          target_id VARCHAR(191) NULL,
+          target_label VARCHAR(255) NULL,
+          ip_address VARCHAR(255) NULL,
+          user_agent VARCHAR(512) NULL,
+          details_json JSON NULL,
+          INDEX idx_audit_events_occurred_at (occurred_at),
+          INDEX idx_audit_events_category_type (category, event_type),
+          INDEX idx_audit_events_actor (actor_user_id),
+          INDEX idx_audit_events_target (target_type, target_id)
+        ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci
+      `);
+      await pool.query(
+        `INSERT INTO o_app_settings (setting_key, setting_value, created_by, modified_by)
+         VALUES (?, ?, NULL, NULL) ON DUPLICATE KEY UPDATE setting_value = VALUES(setting_value)`,
+        ['audit.retention_days', JSON.stringify(30)]
+      );
+      const settings = [
+        ['audit.enabled', true],
+        ['audit.categories', ['authentication', 'security', 'sessions', 'users', 'roles', 'system-settings']],
+        ['audit.include_request_metadata', true]
+      ];
+      for (const [key, value] of settings) {
+        await pool.query(
+          `INSERT INTO o_app_settings (setting_key, setting_value, created_by, modified_by)
+           VALUES (?, ?, NULL, NULL) ON DUPLICATE KEY UPDATE setting_value = VALUES(setting_value)`,
+          [key, JSON.stringify(value)]
+        );
+      }
+      await pool.query(
+        `INSERT IGNORE INTO a_permissions
+          (permission_key, name, section_name, description, created_by, modified_by)
+         VALUES (?, ?, ?, ?, NULL, NULL)`,
+        ['audit-log.allow', 'Audit log', 'Settings', 'Download filtered audit events.']
+      );
+      await pool.query(
+        `INSERT IGNORE INTO a_role_permissions (role_id, permission_id, created_by, modified_by)
+         SELECT roles.id, permissions.id, NULL, NULL
+           FROM a_roles roles
+           CROSS JOIN a_permissions permissions
+          WHERE roles.role_key = 'administrators'
+            AND permissions.permission_key = 'audit-log.allow'`
+      );
+    }
+  },
+  {
+    version: '2.8.7',
+    label: 'v2.8.7 API request and token authentication schema',
+    run: async function (pool) {
+      await ensureColumn(pool, 'i_api_sources', 'request_method', "VARCHAR(10) NOT NULL DEFAULT 'GET'", 'api_url');
+      await ensureColumn(pool, 'i_api_sources', 'request_body_json', 'MEDIUMTEXT NULL', 'request_method');
+      await ensureColumn(pool, 'i_api_sources', 'token_url', 'VARCHAR(1024) NULL', 'auth_header_value');
+      await ensureColumn(pool, 'i_api_sources', 'token_request_body_json', 'MEDIUMTEXT NULL', 'token_url');
+      await ensureColumn(pool, 'i_api_sources', 'token_response_path', "VARCHAR(255) NULL DEFAULT 'access_token'", 'token_request_body_json');
+      await ensureColumn(pool, 'i_api_sources', 'token_header_name', "VARCHAR(255) NULL DEFAULT 'Authorization'", 'token_response_path');
+      await ensureColumn(pool, 'i_api_sources', 'token_header_prefix', "VARCHAR(64) NULL DEFAULT 'Bearer'", 'token_header_name');
+    }
+  },
+  {
+    version: '2.8.8',
+    label: 'v2.8.8 weather locations and RSS collection timestamps schema',
+    run: async function (pool) {
+      await pool.query(`
+        CREATE TABLE IF NOT EXISTS i_weather_locations (
+          id BIGINT AUTO_INCREMENT PRIMARY KEY,
+          name VARCHAR(255) NOT NULL UNIQUE,
+          location_label VARCHAR(255) NOT NULL,
+          latitude DECIMAL(9,6) NOT NULL,
+          longitude DECIMAL(9,6) NOT NULL,
+          timezone VARCHAR(128) NOT NULL,
+          provider VARCHAR(32) NOT NULL DEFAULT 'open-meteo',
+          temperature_unit VARCHAR(16) NOT NULL DEFAULT 'celsius',
+          wind_unit VARCHAR(16) NOT NULL DEFAULT 'kmh',
+          precipitation_unit VARCHAR(16) NOT NULL DEFAULT 'mm',
+          update_interval_value INT NOT NULL DEFAULT 30,
+          update_interval_unit VARCHAR(16) NOT NULL DEFAULT 'minutes',
+          last_pulled_at DATETIME NULL,
+          last_pull_error VARCHAR(1024) NULL,
+          last_response_json MEDIUMTEXT NULL,
+          created_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
+          created_by INT NULL,
+          modified_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
+          modified_by INT NULL,
+          INDEX idx_weather_locations_modified_at (modified_at)
+        ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci
+      `);
+      await ensureColumn(pool, 'i_rss_feeds', 'last_pulled_at', 'DATETIME NULL', 'item_limit');
+    }
+  },
+  {
+    version: '2.8.9',
+    label: 'v2.8.9 data source enablement schema',
+    run: async function (pool) {
+      await ensureColumn(pool, 'i_api_sources', 'enabled', 'TINYINT(1) NOT NULL DEFAULT 1', 'api_url');
+      await ensureColumn(pool, 'i_rss_feeds', 'enabled', 'TINYINT(1) NOT NULL DEFAULT 1', 'feed_url');
+      await ensureColumn(pool, 'i_weather_locations', 'enabled', 'TINYINT(1) NOT NULL DEFAULT 1', 'precipitation_unit');
+    }
+  },
+  {
+    version: '2.10.1',
+    label: 'v2.10.1 template background gradient schema',
+    run: async function (pool) {
+      await ensureColumn(pool, 'c_templates', 'background_gradient', 'LONGTEXT NULL', 'background_color');
+    }
   }
 ];
 
@@ -139,13 +568,394 @@ async function columnExists(pool, tableName, columnName) {
   return Number(rows && rows[0] && rows[0].column_count) > 0;
 }
 
+async function tableExists(pool, tableName) {
+  const [rows] = await pool.query(
+    `SELECT COUNT(*) AS table_count
+     FROM information_schema.TABLES
+     WHERE TABLE_SCHEMA = DATABASE()
+       AND TABLE_NAME = ?`,
+    [tableName]
+  );
+
+  return Number(rows && rows[0] && rows[0].table_count) > 0;
+}
+
+async function detectSchemaVersion(pool) {
+  if (await tableExists(pool, APP_STATE_TABLE)) {
+    const [rows] = await pool.query(
+      'SELECT state_value FROM ' + APP_STATE_TABLE + ' WHERE state_key = ? LIMIT 1',
+      [APP_STATE_SCHEMA_VERSION_KEY]
+    );
+
+    const storedVersion = String(rows && rows[0] && rows[0].state_value || '').trim();
+    if (storedVersion) {
+      return storedVersion;
+    }
+  }
+
+  const timetableGroupsExists = await tableExists(pool, 'i_timetable_groups');
+  const timetableEntriesExists = await tableExists(pool, 'i_timetable_entries');
+  const scheduleGroupsExists = await tableExists(pool, 'i_schedule_groups');
+  const scheduleEntriesExists = await tableExists(pool, 'i_schedule_entries');
+
+  if (timetableGroupsExists && timetableEntriesExists && !scheduleGroupsExists && !scheduleEntriesExists) {
+    return '2.6.18';
+  }
+
+  return '0.0.0';
+}
+
+async function recordSchemaVersion(pool, version) {
+  await pool.query(
+    `CREATE TABLE IF NOT EXISTS ${APP_STATE_TABLE} (
+      id BIGINT AUTO_INCREMENT PRIMARY KEY,
+      state_key VARCHAR(191) NOT NULL UNIQUE,
+      state_value MEDIUMTEXT NULL,
+      created_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP,
+      modified_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP
+    ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci`
+  );
+
+  const stateValue = String(version || appVersion || '0.0.0').trim();
+  await pool.query(
+    'UPDATE ' + APP_STATE_TABLE + ' SET state_value = ? WHERE state_key = ?',
+    [stateValue, APP_STATE_SCHEMA_VERSION_KEY]
+  );
+  await pool.query(
+    'INSERT INTO ' + APP_STATE_TABLE + ' (state_key, state_value) SELECT ?, ? WHERE NOT EXISTS (SELECT 1 FROM ' + APP_STATE_TABLE + ' WHERE state_key = ?)',
+    [APP_STATE_SCHEMA_VERSION_KEY, stateValue, APP_STATE_SCHEMA_VERSION_KEY]
+  );
+}
+
+async function columnIsAutoIncrement(pool, tableName, columnName) {
+  const [rows] = await pool.query(
+    `SELECT COUNT(*) AS auto_increment_count
+     FROM information_schema.COLUMNS
+     WHERE TABLE_SCHEMA = DATABASE()
+       AND TABLE_NAME = ?
+       AND COLUMN_NAME = ?
+       AND EXTRA LIKE '%auto_increment%'`,
+    [tableName, columnName]
+  );
+
+  return Number(rows && rows[0] && rows[0].auto_increment_count) > 0;
+}
+
 async function ensureColumn(pool, tableName, columnName, columnDefinition, afterColumn) {
   if (await columnExists(pool, tableName, columnName)) {
     return;
   }
 
   const afterClause = afterColumn ? ' AFTER ' + afterColumn : '';
+  try {
     await pool.query('ALTER TABLE ' + tableName + ' ADD COLUMN ' + columnName + ' ' + columnDefinition + afterClause);
+  } catch (error) {
+    if (!error || (error.code !== 'ER_DUP_FIELDNAME' && error.errno !== 1060)) {
+      throw error;
+    }
+  }
+}
+
+async function ensureForeignKey(pool, tableName, constraintName, columnName, referencedTable, referencedColumn, onDeleteAction) {
+  const [existingFkRows] = await pool.query(
+    `SELECT COUNT(*) AS fk_count
+     FROM information_schema.KEY_COLUMN_USAGE
+     WHERE TABLE_SCHEMA = DATABASE()
+       AND TABLE_NAME = ?
+       AND COLUMN_NAME = ?
+       AND REFERENCED_TABLE_NAME IS NOT NULL`,
+    [tableName, columnName]
+  );
+
+  if (Number(existingFkRows && existingFkRows[0] && existingFkRows[0].fk_count) > 0) {
+    return;
+  }
+
+  const [rows] = await pool.query(
+    `SELECT COUNT(*) AS fk_count
+     FROM information_schema.KEY_COLUMN_USAGE
+     WHERE TABLE_SCHEMA = DATABASE()
+       AND CONSTRAINT_NAME = ?`,
+    [constraintName]
+  );
+
+  if (Number(rows && rows[0] && rows[0].fk_count) > 0) {
+    return;
+  }
+
+  const fallbackNames = [
+    constraintName,
+    tableName + '_' + columnName + '_fk',
+    tableName + '_' + columnName + '_fk_2',
+    tableName + '_' + columnName + '_fk_3'
+  ];
+
+  for (const candidateName of fallbackNames) {
+    try {
+      await pool.query('ALTER TABLE ' + tableName + ' ADD CONSTRAINT ' + candidateName + ' FOREIGN KEY (' + columnName + ') REFERENCES ' + referencedTable + '(' + referencedColumn + ') ON DELETE ' + onDeleteAction);
+      return;
+    } catch (error) {
+      if (!error || (error.code !== 'ER_FK_DUP_NAME' && error.errno !== 1826 && error.errno !== 121)) {
+        throw error;
+      }
+    }
+  }
+}
+
+async function dropForeignKeyIfExists(pool, tableName, columnName) {
+  const [rows] = await pool.query(
+    `SELECT CONSTRAINT_NAME AS constraint_name
+     FROM information_schema.KEY_COLUMN_USAGE
+     WHERE TABLE_SCHEMA = DATABASE()
+       AND TABLE_NAME = ?
+       AND COLUMN_NAME = ?
+       AND REFERENCED_TABLE_NAME IS NOT NULL
+     LIMIT 1`,
+    [tableName, columnName]
+  );
+
+  const constraintName = String(rows && rows[0] && rows[0].constraint_name || '').trim();
+  if (!constraintName) {
+    return;
+  }
+
+  try {
+    await pool.query('ALTER TABLE ' + tableName + ' DROP FOREIGN KEY ' + constraintName);
+  } catch (error) {
+    if (!error || (error.code !== 'ER_CANT_DROP_FIELD_OR_KEY' && error.errno !== 1091)) {
+      throw error;
+    }
+  }
+}
+
+async function dropColumnIfExists(pool, tableName, columnName) {
+  if (await columnExists(pool, tableName, columnName)) {
+    try {
+      await pool.query('ALTER TABLE ' + tableName + ' DROP COLUMN ' + columnName);
+    } catch (error) {
+      if (!error || (error.code !== 'ER_CANT_DROP_FIELD_OR_KEY' && error.errno !== 1091)) {
+        throw error;
+      }
+    }
+  }
+}
+
+function normalizeLegacyScheduleRules(row) {
+  const rules = [];
+  if (!row) {
+    return rules;
+  }
+
+  if (row.schedule_rules_json) {
+    try {
+      const parsed = JSON.parse(row.schedule_rules_json);
+      if (Array.isArray(parsed)) {
+        parsed.forEach(function (rule) {
+          const normalized = normalizeScheduleRule(rule);
+          if (normalized) {
+            rules.push(normalized);
+          }
+        });
+        return rules;
+      }
+    } catch (_error) {
+      // fall through to legacy columns
+    }
+  }
+
+  const mode = String(row.schedule_mode || 'always').trim().toLowerCase();
+  if (mode === 'dates' && row.schedule_start_datetime && row.schedule_end_datetime) {
+    rules.push({
+      start_datetime: formatMigrationDateTime(row.schedule_start_datetime),
+      end_datetime: formatMigrationDateTime(row.schedule_end_datetime)
+    });
+    return rules;
+  }
+
+  if (mode === 'times' && row.schedule_start_time && row.schedule_end_time) {
+    const days = normalizeMigrationDays(row.schedule_days_json);
+    const rule = {
+      start_time: formatMigrationTime(row.schedule_start_time),
+      end_time: formatMigrationTime(row.schedule_end_time)
+    };
+    if (days.length) {
+      rule.schedule_days_json = days;
+    }
+    rules.push(rule);
+  }
+
+  return rules;
+}
+
+function normalizeScheduleRule(rule) {
+  if (!rule || typeof rule !== 'object') {
+    return null;
+  }
+  const normalized = {};
+  if (rule.start_datetime) {
+    normalized.start_datetime = String(rule.start_datetime);
+  }
+  if (rule.end_datetime) {
+    normalized.end_datetime = String(rule.end_datetime);
+  }
+  if (rule.start_time) {
+    normalized.start_time = String(rule.start_time).slice(0, 5);
+  }
+  if (rule.end_time) {
+    normalized.end_time = String(rule.end_time).slice(0, 5);
+  }
+  if (Array.isArray(rule.schedule_days_json)) {
+    normalized.schedule_days_json = rule.schedule_days_json;
+  } else if (Array.isArray(rule.days)) {
+    normalized.schedule_days_json = rule.days;
+  }
+  return Object.keys(normalized).length ? normalized : null;
+}
+
+function formatMigrationDateTime(value) {
+  if (!value) {
+    return null;
+  }
+  const date = value instanceof Date ? value : new Date(value);
+  if (Number.isNaN(date.getTime())) {
+    return null;
+  }
+  const year = date.getFullYear();
+  const month = String(date.getMonth() + 1).padStart(2, '0');
+  const day = String(date.getDate()).padStart(2, '0');
+  const hours = String(date.getHours()).padStart(2, '0');
+  const minutes = String(date.getMinutes()).padStart(2, '0');
+  return year + '-' + month + '-' + day + 'T' + hours + ':' + minutes;
+}
+
+function parseMigrationDateTimeParts(value) {
+  if (!value) {
+    return null;
+  }
+
+  if (value instanceof Date) {
+    if (Number.isNaN(value.getTime())) {
+      return null;
+    }
+
+    return {
+      year: value.getUTCFullYear(),
+      month: value.getUTCMonth() + 1,
+      day: value.getUTCDate(),
+      hour: value.getUTCHours(),
+      minute: value.getUTCMinutes(),
+      second: value.getUTCSeconds()
+    };
+  }
+
+  const raw = String(value || '').trim();
+  const match = raw.match(/^(\d{4})-(\d{2})-(\d{2})(?:[ T](\d{2}):(\d{2})(?::(\d{2}))?)?$/);
+  if (!match) {
+    return null;
+  }
+
+  return {
+    year: Number(match[1]),
+    month: Number(match[2]),
+    day: Number(match[3]),
+    hour: Number(match[4] || 0),
+    minute: Number(match[5] || 0),
+    second: Number(match[6] || 0)
+  };
+}
+
+function getMigrationTimeZoneOffsetMillis(date, timeZone) {
+  if (!(date instanceof Date) || Number.isNaN(date.getTime())) {
+    return 0;
+  }
+
+  const parts = new Intl.DateTimeFormat('en-GB', {
+    timeZone: timeZone,
+    hour12: false,
+    year: 'numeric',
+    month: '2-digit',
+    day: '2-digit',
+    hour: '2-digit',
+    minute: '2-digit',
+    second: '2-digit'
+  }).formatToParts(date).reduce(function (acc, part) {
+    if (part && part.type && part.type !== 'literal') {
+      acc[part.type] = part.value;
+    }
+    return acc;
+  }, Object.create(null));
+
+  const localAsUtc = Date.UTC(
+    Number(parts.year) || 0,
+    (Number(parts.month) || 1) - 1,
+    Number(parts.day) || 1,
+    Number(parts.hour) || 0,
+    Number(parts.minute) || 0,
+    Number(parts.second) || 0,
+    0
+  );
+
+  return localAsUtc - date.getTime();
+}
+
+function convertMigrationDateTimeFromTimeZone(value, timeZone) {
+  const parts = parseMigrationDateTimeParts(value);
+  if (!parts) {
+    return null;
+  }
+
+  const utcMillis = Date.UTC(parts.year, parts.month - 1, parts.day, parts.hour, parts.minute, parts.second, 0);
+  let adjusted = new Date(utcMillis - getMigrationTimeZoneOffsetMillis(new Date(utcMillis), timeZone));
+  const adjustedOffset = getMigrationTimeZoneOffsetMillis(adjusted, timeZone);
+
+  if (adjustedOffset !== getMigrationTimeZoneOffsetMillis(new Date(utcMillis), timeZone)) {
+    adjusted = new Date(utcMillis - adjustedOffset);
+  }
+
+  return adjusted;
+}
+
+function formatMigrationDateTimeUtc(value) {
+  if (!(value instanceof Date) || Number.isNaN(value.getTime())) {
+    return null;
+  }
+
+  const year = value.getUTCFullYear();
+  const month = String(value.getUTCMonth() + 1).padStart(2, '0');
+  const day = String(value.getUTCDate()).padStart(2, '0');
+  const hours = String(value.getUTCHours()).padStart(2, '0');
+  const minutes = String(value.getUTCMinutes()).padStart(2, '0');
+  const seconds = String(value.getUTCSeconds()).padStart(2, '0');
+  return year + '-' + month + '-' + day + ' ' + hours + ':' + minutes + ':' + seconds;
+}
+
+function formatMigrationTime(value) {
+  if (!value) {
+    return null;
+  }
+  return String(value).slice(0, 5);
+}
+
+function normalizeMigrationDays(value) {
+  let parsed = [];
+  if (Array.isArray(value)) {
+    parsed = value;
+  } else if (value) {
+    try {
+      const raw = typeof value === 'string' ? JSON.parse(value) : value;
+      parsed = Array.isArray(raw) ? raw : [];
+    } catch (_error) {
+      parsed = [];
+    }
+  }
+
+  return Array.from(new Set(parsed.map(function (day) {
+    return Number(day);
+  }).filter(function (day) {
+    return Number.isInteger(day) && day >= 0 && day <= 6;
+  }))).sort(function (left, right) {
+    return left - right;
+  });
 }
 
 function compareVersions(leftVersion, rightVersion) {
@@ -169,19 +979,46 @@ function compareVersions(leftVersion, rightVersion) {
   return 0;
 }
 
-async function runMigrations(pool, options) {
+async function getPendingMigrations(pool, options) {
-  // Only run migrations that are newer than the installed schema version and not beyond the app version.
   const targetVersion = String(appVersion || '0.0.0').trim();
   const currentVersion = String(options && options.currentVersion || '0.0.0').trim();
+  const legacyPlayerSchemaPresent = await columnExists(pool, 'd_players', 'device_id');
+  const screenPlayerColumnPresent = await columnExists(pool, 'd_screens', 'player_id');
+  const legacyTimetableGroupsPresent = await tableExists(pool, 'i_schedule_groups');
+  const legacyTimetableEntriesPresent = await tableExists(pool, 'i_schedule_entries');
+  let effectiveCurrentVersion = currentVersion;
 
-  for (const migration of VERSIONED_MIGRATIONS) {
+  if (!legacyPlayerSchemaPresent && compareVersions(effectiveCurrentVersion, '2.1.0') < 0) {
-    if (compareVersions(migration.version, currentVersion) > 0 && compareVersions(migration.version, targetVersion) <= 0) {
+    effectiveCurrentVersion = '2.1.0';
-      await migration.run(pool);
   }
+
+  if (!screenPlayerColumnPresent && compareVersions(effectiveCurrentVersion, '2.6.3') < 0) {
+    effectiveCurrentVersion = '2.6.3';
+  }
+
+  if (legacyTimetableGroupsPresent || legacyTimetableEntriesPresent) {
+    effectiveCurrentVersion = compareVersions(effectiveCurrentVersion, '2.6.18') < 0 ? '2.6.17' : '2.6.17';
+  }
+
+  return VERSIONED_MIGRATIONS.filter(function (migration) {
+    return compareVersions(migration.version, effectiveCurrentVersion) > 0 && compareVersions(migration.version, targetVersion) <= 0;
+  });
+}
+
+async function runMigrations(pool, options) {
+  // Only run migrations that are newer than the installed schema version and not beyond the app version.
+  const pendingMigrations = await getPendingMigrations(pool, options);
+
+  for (const migration of pendingMigrations) {
+    await migration.run(pool);
   }
 }
 
 module.exports = {
   appVersion: appVersion,
-  runMigrations: runMigrations
+  getPendingMigrations: getPendingMigrations,
+  runMigrations: runMigrations,
+  detectSchemaVersion: detectSchemaVersion,
+  recordSchemaVersion: recordSchemaVersion,
+  compareVersions: compareVersions
 };

src/player.js

@@ -2,6 +2,7 @@ const express = require('express');
 const fs = require('fs');
 const http = require('http');
 const path = require('path');
+const { WebSocket } = require('ws');
 const common = require('./common');
 const { createPlayerRuntime } = require('./player/runtime');
 const { createPlayerPlaylistService } = require('./player/playlist');
@@ -10,28 +11,60 @@ const { normalizeDeviceId, registerPlayerOnboardingRoutes, commitDeviceBinding }
 const { createOnboardingStore } = require('./player/onboarding/store');
 const { registerPlayerRoutes } = require('./player/routes');
 const { ensureFontLibrary } = require('#src/web/lib/media/font-library');
+const { createRequestAuthHeaders } = require('#src/request-auth');
+const { getConfiguredPlayerIdentifier, recordPlayerHeartbeat } = require('#src/data/player-registry');
 
 
 // Player runtime, media API, and websocket wiring.
 async function start() {
   const app = express();
-  const pool = common.createPool();
+  const pool = String(process.env.BRIDGE_PUBLIC_URL || '').trim().replace(/\/$/, '') ? null : common.createPool();
   const PORT = Number(process.env.PLAYER_PORT || 8081);
-  const PLAYER_PUBLIC_BASE_URL = String(process.env.PLAYER_PUBLIC_BASE_URL || process.env.PLAYER_BASE_URL || '').trim().replace(/\/$/, '');
+  const PLAYER_PUBLIC_URL = String(process.env.PLAYER_PUBLIC_URL || process.env.PLAYER_BASE_URL || '').trim().replace(/\/$/, '');
-  const PLAYER_INTERNAL_BASE_URL = String(process.env.PLAYER_INTERNAL_BASE_URL || process.env.PLAYER_BASE_URL || '').trim().replace(/\/$/, '');
+  const BRIDGE_PUBLIC_URL = String(process.env.BRIDGE_PUBLIC_URL || '').trim().replace(/\/$/, '');
-  const PLAYER_IDENTIFIER = '1';
+  const WEB_INTERNAL_URL = String(process.env.WEB_INTERNAL_URL || '').trim().replace(/\/$/, '');
+  const isRemotePlayer = Boolean(BRIDGE_PUBLIC_URL);
+  const PLAYER_INTERNAL_URL = String(isRemotePlayer ? BRIDGE_PUBLIC_URL : (process.env.PLAYER_INTERNAL_URL || PLAYER_PUBLIC_URL || process.env.PLAYER_BASE_URL || '')).trim().replace(/\/$/, '');
+  const PLAYER_DEVICE_ID = getConfiguredPlayerIdentifier();
+  const PLAYER_AGENT_RECONNECT_DELAY_MS = Number(process.env.PLAYER_AGENT_RECONNECT_DELAY_MS || 5000);
   const ASSET_DIR = path.join(__dirname, 'player', 'public');
   const MEDIA_DIR = path.join(__dirname, '..', 'media');
   const ONBOARDING_QUEUE_FILE = path.join(MEDIA_DIR, 'player-onboarding-queue.json');
   const DB_SYNC_INTERVAL_MS = Number(process.env.PLAYER_DB_SYNC_INTERVAL_MS || 15000);
+  const RECONNECT_SYNC_STALE_MS = 60 * 1000;
   const onboardingStore = createOnboardingStore(ONBOARDING_QUEUE_FILE);
+  let thinClientSocket = null;
+  let lastDisconnectAt = 0;
+  let playerPublicBaseUrl = PLAYER_PUBLIC_URL || null;
+  let refreshThinClientRegistration = null;
+  let activePairingCode = '';
+  let activePairingCodes = [];
+  let activePairingSessions = [];
   const playerRuntime = createPlayerRuntime({
     pool: pool,
-    normalizeDeviceId: normalizeDeviceId
+    normalizeDeviceId: normalizeDeviceId,
+    notifySnapshot: function (snapshot) {
+      if (!thinClientSocket || thinClientSocket.readyState !== WebSocket.OPEN) {
+        return;
+      }
+
+      try {
+        thinClientSocket.send(JSON.stringify({
+          type: 'snapshot',
+          deviceId: PLAYER_DEVICE_ID,
+          slug: snapshot && snapshot.slug ? String(snapshot.slug).trim() : '',
+          connections: Array.isArray(snapshot && snapshot.connections) ? snapshot.connections : []
+        }));
+      } catch (_error) {
+      }
+    }
   });
-  const playerPlaylistService = createPlayerPlaylistService({
+  const playerPlaylistService = isRemotePlayer
+    ? null
+    : createPlayerPlaylistService({
         pool: pool,
         common: common,
+        mediaDir: MEDIA_DIR,
         snapshotDir: path.join(MEDIA_DIR, 'player-cache', 'screen-playlists')
       });
   const rtmpStreamService = createRtmpStreamService({
@@ -40,14 +73,252 @@ async function start() {
   const server = http.createServer(app);
   playerRuntime.installWebsocket(server);
   app.use(express.json());
+
+  let hasLoggedPlayerStartup = false;
+
+  function normalizePlayerPublicBaseUrl(value) {
+    const normalized = String(value || '').trim().replace(/\/$/, '');
+    if (!normalized) {
+      return null;
+    }
+
+    try {
+      return new URL(normalized).origin.replace(/\/$/, '');
+    } catch (_error) {
+      return normalized;
+    }
+  }
+
+  function setPlayerPublicBaseUrl(value) {
+    const nextBaseUrl = normalizePlayerPublicBaseUrl(value);
+    if (!nextBaseUrl || nextBaseUrl === playerPublicBaseUrl) {
+      return;
+    }
+
+    playerPublicBaseUrl = nextBaseUrl;
+    if (typeof refreshThinClientRegistration === 'function') {
+      refreshThinClientRegistration();
+    }
+  }
+
+  function getPlayerPublicBaseUrl() {
+    return playerPublicBaseUrl;
+  }
+
+  function logPlayerStartup(connectionState) {
+    if (hasLoggedPlayerStartup) {
+      return;
+    }
+
+    hasLoggedPlayerStartup = true;
+    console.info('[player] startup', {
+      mode: isRemotePlayer ? 'bridge client' : 'local',
+      connected: connectionState && typeof connectionState.connected === 'boolean' ? connectionState.connected : false,
+      publicBaseUrl: getPlayerPublicBaseUrl(),
+      bridgeBaseUrl: PLAYER_INTERNAL_URL || null,
+      bridgeWebSocketUrl: BRIDGE_PUBLIC_URL ? createThinClientWebSocketUrl() : null
+    });
+  }
+
+  fs.mkdirSync(MEDIA_DIR, { recursive: true });
+
+  function resolveLocalMediaFilePath(fileName) {
+    const relativePath = path.normalize(String(fileName || '').trim()).replace(/^([\\/])+/, '');
+    if (!relativePath || relativePath === '.' || relativePath.startsWith('..') || path.isAbsolute(relativePath)) {
+      return null;
+    }
+
+    const resolvedMediaDir = path.resolve(MEDIA_DIR);
+    const resolvedFilePath = path.resolve(MEDIA_DIR, relativePath);
+    if (resolvedFilePath !== resolvedMediaDir && !resolvedFilePath.startsWith(resolvedMediaDir + path.sep)) {
+      return null;
+    }
+
+    return resolvedFilePath;
+  }
+
+  async function triggerWebMediaSync() {
+    const syncBaseUrl = WEB_INTERNAL_URL || BRIDGE_PUBLIC_URL;
+    if (!isRemotePlayer || !syncBaseUrl) {
+      return false;
+    }
+
+    const requestBody = {
+      playerIdentifier: PLAYER_DEVICE_ID,
+      playerPublicBaseUrl: getPlayerPublicBaseUrl(),
+      playerInternalBaseUrl: PLAYER_INTERNAL_URL
+    };
+
+    try {
+      const authHeaders = createRequestAuthHeaders({
+        method: 'POST',
+        pathname: '/api/internal/sync/player-media',
+        body: requestBody
+      });
+      const response = await fetch(`${syncBaseUrl}/api/internal/sync/player-media`, {
+        method: 'POST',
+        headers: Object.assign({
+          Accept: 'application/json',
+          'Content-Type': 'application/json'
+        }, authHeaders),
+        body: JSON.stringify(requestBody)
+      });
+
+      return Boolean(response && response.ok);
+    } catch (_error) {
+      console.warn('[player] Startup media sync failed');
+      return false;
+    }
+  }
+
+  async function triggerWebFontSync() {
+    const syncBaseUrl = WEB_INTERNAL_URL || BRIDGE_PUBLIC_URL;
+    if (!isRemotePlayer || !syncBaseUrl) {
+      return false;
+    }
+
+    const requestBody = {
+      playerIdentifier: PLAYER_DEVICE_ID,
+      playerPublicBaseUrl: getPlayerPublicBaseUrl(),
+      playerInternalBaseUrl: PLAYER_INTERNAL_URL
+    };
+
+    try {
+      const authHeaders = createRequestAuthHeaders({
+        method: 'POST',
+        pathname: '/api/internal/sync/player-font',
+        body: requestBody
+      });
+      const response = await fetch(`${syncBaseUrl}/api/internal/sync/player-font`, {
+        method: 'POST',
+        headers: Object.assign({
+          Accept: 'application/json',
+          'Content-Type': 'application/json'
+        }, authHeaders),
+        body: JSON.stringify(requestBody)
+      });
+
+      return Boolean(response && response.ok);
+    } catch (_error) {
+      console.warn('[player] Startup font sync failed');
+      return false;
+    }
+  }
+
+  let webMediaSyncCompleted = false;
+  let webFontSyncCompleted = false;
+  let webFontSyncTriggered = false;
+
+  function shouldTriggerReconnectSync() {
+    if (!lastDisconnectAt) {
+      return true;
+    }
+
+    return Date.now() - lastDisconnectAt >= RECONNECT_SYNC_STALE_MS;
+  }
+
+  async function handleThinClientCommand(socket, rawMessage) {
+    let payload = null;
+    try {
+      payload = JSON.parse(String(rawMessage || ''));
+    } catch (_error) {
+      return;
+    }
+
+    if (!payload || typeof payload !== 'object' || Array.isArray(payload) || String(payload.type || '').trim() !== 'command') {
+      return;
+    }
+
+    const requestId = String(payload.requestId || '').trim() || null;
+    const command = String(payload.command || '').trim().toLowerCase();
+    const response = {
+      type: 'command-response',
+      requestId: requestId,
+      ok: false
+    };
+
+    try {
+      if (command === 'media-put') {
+        const relativePath = String(payload.relativePath || payload.filename || '').trim();
+        const filePath = resolveLocalMediaFilePath(relativePath);
+        const bodyBase64 = String(payload.bodyBase64 || '').trim();
+        if (!filePath || !bodyBase64) {
+          response.error = 'Invalid media payload.';
+        } else {
+          const bodyBuffer = Buffer.from(bodyBase64, 'base64');
+          await fs.promises.mkdir(path.dirname(filePath), { recursive: true });
+          await fs.promises.writeFile(filePath, bodyBuffer);
+          response.ok = true;
+        }
+      } else if (command === 'media-delete') {
+        const relativePath = String(payload.relativePath || payload.filename || '').trim();
+        const filePath = resolveLocalMediaFilePath(relativePath);
+        if (!filePath) {
+          response.error = 'Invalid media path.';
+        } else {
+          try {
+            await fs.promises.unlink(filePath);
+          } catch (error) {
+            if (!error || error.code !== 'ENOENT') {
+              throw error;
+            }
+          }
+          response.ok = true;
+        }
+      } else if (['refresh', 'reload', 'redirect', 'pause', 'blackout', 'previous', 'next', 'setclientname', 'announcement-refresh'].indexOf(command) !== -1) {
+        const screenSlug = String(payload.screenSlug || payload.slug || '').trim();
+        if (!screenSlug) {
+          response.error = 'Screen slug is required.';
+        } else if (payload.connectionId) {
+          const sent = await playerRuntime.sendCommandToConnection(screenSlug, String(payload.connectionId || '').trim(), payload);
+          response.ok = sent > 0;
+          if (!response.ok) {
+            response.error = 'Player is not connected.';
+          }
+        } else {
+          const sent = await playerRuntime.broadcastCommand(screenSlug, payload);
+          response.ok = sent > 0;
+          if (!response.ok) {
+            response.error = 'Player is not connected.';
+          }
+        }
+      } else {
+        response.error = 'Unsupported command.';
+      }
+    } catch (error) {
+      response.error = error && error.message ? error.message : 'Command failed.';
+    }
+
+    if (socket && socket.readyState === WebSocket.OPEN) {
+      socket.send(JSON.stringify(response));
+    }
+  }
+  app.use(function (error, _req, res, _next) {
+    console.error(error);
+    res.status(error.statusCode || 500).send(error.statusCode ? error.message : 'Internal server error');
+  });
+
+  await ensureFontLibrary(MEDIA_DIR);
+
   registerPlayerOnboardingRoutes(app, {
     pool: pool,
     common: common,
     playerRuntime: playerRuntime,
     onboardingStore: onboardingStore,
-    playerPublicBaseUrl: PLAYER_PUBLIC_BASE_URL,
+    playerPublicBaseUrl: getPlayerPublicBaseUrl(),
-    playerInternalBaseUrl: PLAYER_INTERNAL_BASE_URL,
+    playerInternalBaseUrl: PLAYER_INTERNAL_URL,
-    QRCode: require('qrcode')
+    bridgeBaseUrl: BRIDGE_PUBLIC_URL,
+    playerDeviceId: PLAYER_DEVICE_ID,
+    onPairingCode: function (code, codes) {
+      activePairingCode = String(code || '').trim().toUpperCase();
+      activePairingSessions = Array.isArray(codes) ? codes.map(function (entry) {
+        return { deviceId: String(entry && entry.deviceId || '').trim(), clientId: String(entry && entry.clientId || '').trim(), code: String(entry && entry.code || '').trim().toUpperCase() };
+      }).filter(function (entry) { return entry.deviceId && entry.code; }) : [];
+      activePairingCodes = activePairingSessions.map(function (entry) { return entry.code; });
+      if (typeof refreshThinClientRegistration === 'function') {
+        refreshThinClientRegistration();
+      }
+    }
   });
   registerPlayerRoutes(app, {
     pool: pool,
@@ -57,27 +328,242 @@ async function start() {
     playerRuntime: playerRuntime,
     playerPlaylistService: playerPlaylistService,
     rtmpStreamService: rtmpStreamService,
-    playerPublicBaseUrl: PLAYER_PUBLIC_BASE_URL,
+    playerInternalBaseUrl: PLAYER_INTERNAL_URL,
-    playerInternalBaseUrl: PLAYER_INTERNAL_BASE_URL,
+    bridgeBaseUrl: BRIDGE_PUBLIC_URL,
-    playerIdentifier: PLAYER_IDENTIFIER
+    playerDeviceId: PLAYER_DEVICE_ID,
+    onPlayerPublicBaseUrl: setPlayerPublicBaseUrl
   });
 
-  app.use(function (error, _req, res, _next) {
+  function createThinClientWebSocketUrl() {
-    console.error(error);
+    if (!BRIDGE_PUBLIC_URL) {
-    res.status(error.statusCode || 500).send(error.statusCode ? error.message : 'Internal server error');
+      return null;
+    }
+
+    return BRIDGE_PUBLIC_URL.replace(/^http:/i, 'ws:').replace(/^https:/i, 'wss:') + '/ws/players';
+  }
+
+  function startThinClientRegistration() {
+    const thinClientUrl = createThinClientWebSocketUrl();
+    if (!thinClientUrl) {
+      return null;
+    }
+
+    let socket = null;
+    let reconnectTimer = null;
+    let heartbeatTimer = null;
+
+    function clearTimers() {
+      if (reconnectTimer) {
+        clearTimeout(reconnectTimer);
+        reconnectTimer = null;
+      }
+      if (heartbeatTimer) {
+        clearInterval(heartbeatTimer);
+        heartbeatTimer = null;
+      }
+    }
+
+    function connect() {
+      clearTimers();
+      const timestamp = String(Date.now());
+      const authHeaders = createRequestAuthHeaders({
+        method: 'GET',
+        pathname: '/ws/players',
+        timestamp: timestamp
+      });
+      let webMediaSyncTriggered = false;
+      socket = new WebSocket(thinClientUrl, {
+        headers: Object.assign({
+          'x-pulse-request-timestamp': timestamp
+        }, authHeaders)
+      });
+      thinClientSocket = socket;
+
+      function sendHeartbeat() {
+        if (!socket || socket.readyState !== WebSocket.OPEN) {
+          return;
+        }
+
+        socket.send(JSON.stringify({
+          type: 'heartbeat',
+          deviceId: PLAYER_DEVICE_ID,
+          publicBaseUrl: getPlayerPublicBaseUrl(),
+          internalBaseUrl: PLAYER_INTERNAL_URL,
+          pairingCode: activePairingCode,
+          pairingCodes: activePairingCodes,
+          pairingSessions: activePairingSessions
+        }));
+      }
+
+      refreshThinClientRegistration = sendHeartbeat;
+
+      function triggerMediaSyncIfNeeded() {
+        if (webMediaSyncTriggered || webMediaSyncCompleted) {
+          return;
+        }
+
+        webMediaSyncTriggered = true;
+        triggerWebMediaSync().then(function (success) {
+          webMediaSyncCompleted = Boolean(success) || webMediaSyncCompleted;
+          if (!success) {
+            webMediaSyncTriggered = false;
+          }
+        }).catch(function () {
+          webMediaSyncTriggered = false;
+        });
+      }
+
+      function triggerFontSyncIfNeeded() {
+        if (webFontSyncTriggered || webFontSyncCompleted) {
+          return;
+        }
+
+        webFontSyncTriggered = true;
+        triggerWebFontSync().then(function (success) {
+          webFontSyncCompleted = Boolean(success) || webFontSyncCompleted;
+          if (!success) {
+            webFontSyncTriggered = false;
+          }
+        }).catch(function () {
+          webFontSyncTriggered = false;
+          webFontSyncCompleted = false;
+        });
+      }
+
+      function sendSnapshot(slug) {
+        if (!socket || socket.readyState !== WebSocket.OPEN) {
+          return;
+        }
+
+        try {
+          socket.send(JSON.stringify({
+            type: 'snapshot',
+            deviceId: PLAYER_DEVICE_ID,
+            slug: String(slug || '').trim(),
+            connections: playerRuntime.snapshotConnections(slug)
+          }));
+        } catch (_error) {
+        }
+      }
+
+      socket.on('open', function () {
+        logPlayerStartup({
+          connected: true
         });
 
-  fs.mkdirSync(MEDIA_DIR, { recursive: true });
+        socket.send(JSON.stringify({
-  await ensureFontLibrary(MEDIA_DIR);
+          type: 'register',
+          deviceId: PLAYER_DEVICE_ID,
+          publicBaseUrl: getPlayerPublicBaseUrl(),
+          internalBaseUrl: PLAYER_INTERNAL_URL,
+          pairingCode: activePairingCode,
+          pairingCodes: activePairingCodes,
+          pairingSessions: activePairingSessions
+        }));
+
+        playerRuntime.snapshotSlugs().forEach(function (slug) {
+          sendSnapshot(slug);
+        });
+
+        heartbeatTimer = setInterval(function () {
+          sendHeartbeat();
+        }, DB_SYNC_INTERVAL_MS);
+      });
+
+      socket.on('message', function (rawMessage) {
+        let parsedMessage = null;
+        try {
+          parsedMessage = JSON.parse(String(rawMessage || '{}'));
+        } catch (_error) {
+          parsedMessage = null;
+        }
+
+        if (parsedMessage && String(parsedMessage.type || '').trim() === 'registered') {
+          sendHeartbeat();
+          return;
+        }
+
+        if (parsedMessage && String(parsedMessage.type || '').trim() === 'heartbeat-ack') {
+          if (shouldTriggerReconnectSync()) {
+            triggerMediaSyncIfNeeded();
+            triggerFontSyncIfNeeded();
+          }
+          return;
+        }
+
+        handleThinClientCommand(socket, rawMessage).catch(function (error) {
+          try {
+            socket.send(JSON.stringify({
+              type: 'command-response',
+              requestId: null,
+              ok: false,
+              error: error && error.message ? error.message : 'Command failed.'
+            }));
+          } catch (_sendError) {
+            // ignore send errors
+          }
+        });
+      });
+
+      socket.on('close', function () {
+        lastDisconnectAt = Date.now();
+        webFontSyncTriggered = false;
+        webFontSyncCompleted = false;
+        webMediaSyncCompleted = false;
+        clearTimers();
+        thinClientSocket = null;
+        refreshThinClientRegistration = null;
+        reconnectTimer = setTimeout(connect, PLAYER_AGENT_RECONNECT_DELAY_MS);
+      });
+
+      socket.on('error', function () {
+        try {
+          socket.close();
+        } catch (_error) {
+          // ignore reconnect noise
+        }
+      });
+    }
+
+    connect();
+    return function stop() {
+      clearTimers();
+      if (socket) {
+        try {
+          socket.close();
+        } catch (_error) {
+          // ignore close errors
+        }
+        socket = null;
+      }
+    };
+  }
+
+  if (!isRemotePlayer) {
+    logPlayerStartup({
+      connected: false
+    });
+  }
+
+  const stopThinClientRegistration = startThinClientRegistration();
 
   server.listen(PORT, function () {
     console.log(`Pulse Signage app listening on port ${PORT}`);
   });
 
   async function syncDatabaseState() {
+    if (isRemotePlayer) {
+      return;
+    }
+
     try {
-      await common.ensureSchema(pool, { mediaDir: MEDIA_DIR });
+      await recordPlayerHeartbeat(pool, {
-      await common.bootstrapDatabase(pool);
+        deviceId: PLAYER_DEVICE_ID,
+        publicBaseUrl: getPlayerPublicBaseUrl(),
+        internalBaseUrl: PLAYER_INTERNAL_URL
+      }).catch(function (error) {
+        console.error(error);
+      });
 
       if (playerRuntime.snapshotAllConnections().length > 0) {
         await common.pruneStaleOnboardingDevices(pool);
@@ -100,16 +586,27 @@ async function start() {
 
   await syncDatabaseState();
 
-  if (PLAYER_IDENTIFIER) {
+  if (PLAYER_DEVICE_ID && !isRemotePlayer) {
     const { upsertPlayerRegistration } = require('./player/onboarding');
-    await upsertPlayerRegistration(pool, PLAYER_IDENTIFIER, PLAYER_PUBLIC_BASE_URL, PLAYER_INTERNAL_BASE_URL, null);
+    await upsertPlayerRegistration(pool, PLAYER_DEVICE_ID, getPlayerPublicBaseUrl(), PLAYER_INTERNAL_URL).catch(function (error) {
+      console.error(error);
+    });
   }
 
   setInterval(function () {
+    if (isRemotePlayer) {
+      return;
+    }
     syncDatabaseState().catch(function (error) {
       console.error(error);
     });
   }, DB_SYNC_INTERVAL_MS);
+
+  process.on('exit', function () {
+    if (typeof stopThinClientRegistration === 'function') {
+      stopThinClientRegistration();
+    }
+  });
 }
 
 module.exports = { start };

src/player/announcement-templates/lower-third.template.html

@@ -99,8 +99,8 @@
   display: inline-flex;
   align-items: center;
   gap: 2.5rem;
-  min-width: 100%;
   width: max-content;
+  backface-visibility: hidden;
   will-change: transform;
   animation: lower-third-scroll var(--announcement-scroll-duration, 20s) linear infinite;
 }
@@ -144,10 +144,10 @@
 
 @keyframes lower-third-scroll {
   from {
-    transform: translateX(0);
+    transform: translate3d(0, 0, 0);
   }
   to {
-    transform: translateX(-50%);
+    transform: translate3d(calc(-1 * var(--announcement-scroll-distance, 0px)), 0, 0);
   }
 }
 </style>
@@ -177,21 +177,10 @@
   }
 
   var track = root.querySelector('.player-announcement__message-track');
-  if (!track) {
+  if (!track || typeof window.initPlayerAnnouncementMarquee !== 'function') {
     return;
   }
 
-  if (track.dataset.marqueeMeasured === 'true') {
+  window.initPlayerAnnouncementMarquee(track, { container: root.querySelector('.player-announcement__message') || root });
-    return;
-  }
-
-  var rate = Number(track.getAttribute('data-announcement-marquee-rate') || 44) || 44;
-  var singlePassWidth = Math.max(1, track.scrollWidth / 2);
-  var durationSeconds = Math.max(8, singlePassWidth / rate);
-  var durationValue = durationSeconds.toFixed(2) + 's';
-
-  track.dataset.marqueeMeasured = 'true';
-  track.style.setProperty('--announcement-scroll-duration', durationValue);
-  track.style.animationDuration = durationValue;
 }());
 </script>

src/player/announcement-templates/top-banner.template.html

@@ -101,8 +101,8 @@
   display: inline-flex;
   align-items: center;
   gap: 2.5rem;
-  min-width: 100%;
   width: max-content;
+  backface-visibility: hidden;
   will-change: transform;
   animation: top-banner-scroll var(--announcement-scroll-duration, 20s) linear infinite;
 }
@@ -146,10 +146,10 @@
 
 @keyframes top-banner-scroll {
   from {
-    transform: translateX(0);
+    transform: translate3d(0, 0, 0);
   }
   to {
-    transform: translateX(-50%);
+    transform: translate3d(calc(-1 * var(--announcement-scroll-distance, 0px)), 0, 0);
   }
 }
 </style>
@@ -179,21 +179,10 @@
   }
 
   var track = root.querySelector('.player-announcement__message-track');
-  if (!track) {
+  if (!track || typeof window.initPlayerAnnouncementMarquee !== 'function') {
     return;
   }
 
-  if (track.dataset.marqueeMeasured === 'true') {
+  window.initPlayerAnnouncementMarquee(track, { container: root.querySelector('.player-announcement__message') || root });
-    return;
-  }
-
-  var rate = Number(track.getAttribute('data-announcement-marquee-rate') || 44) || 44;
-  var singlePassWidth = Math.max(1, track.scrollWidth / 2);
-  var durationSeconds = Math.max(8, singlePassWidth / rate);
-  var durationValue = durationSeconds.toFixed(2) + 's';
-
-  track.dataset.marqueeMeasured = 'true';
-  track.style.setProperty('--announcement-scroll-duration', durationValue);
-  track.style.animationDuration = durationValue;
 }());
 </script>

src/player/onboarding/index.js

@@ -1,27 +1,55 @@
 // Player onboarding routes and signup flow helpers.
 
+const express = require('express');
+const crypto = require('crypto');
 const { isClientNameAvailable, withClientNameReservation } = require('#src/data/client-name-check');
-const { getSharedSecret, verifyPageAuthToken } = require('#src/request-auth');
+const { createStyledQrCodeSvg } = require('#src/data/qr-code');
+const { getSharedSecret, verifyPageAuthToken, verifyRequestAuth, createRequestAuthHeaders } = require('#src/request-auth');
+const { resolvePlayerRegistration, upsertPlayerRegistration: upsertPlayerRegistrationRecord } = require('#src/data/player-registry');
 const { isTransientDbError } = require('./store');
 
 const ONBOARDING_SIGNUP_LIMIT_WINDOW_MS = 5 * 60 * 1000;
 const ONBOARDING_SIGNUP_LIMIT_MAX_ATTEMPTS = 8;
+const PAIRING_CODE_LENGTH = 6;
+const PAIRING_CODE_TTL_MS = 15 * 60 * 1000;
+const PAIRING_CODE_ALPHABET = 'ABCDEFGHJKLMNPQRSTUVWXYZ23456789';
 const onboardingSignupAttempts = new Map();
 
 function normalizeDeviceId(value) {
   return String(value || '').trim().replace(/[^a-zA-Z0-9_-]/g, '').slice(0, 128);
 }
 
-function getPublicBaseUrl(req, configuredUrl) {
+function createPairingCode() {
-  const configured = String(configuredUrl || process.env.PLAYER_PUBLIC_BASE_URL || process.env.PLAYER_BASE_URL || '').trim().replace(/\/$/, '');
+  const bytes = crypto.randomBytes(PAIRING_CODE_LENGTH);
-  if (configured) {
+  let code = '';
-    return configured;
+  for (let index = 0; index < PAIRING_CODE_LENGTH; index += 1) {
+    code += PAIRING_CODE_ALPHABET[bytes[index] % PAIRING_CODE_ALPHABET.length];
   }
+  return code;
+}
+
+function createPairingSession(deviceId, clientId) {
+  return { deviceId: normalizeDeviceId(deviceId), clientId: normalizeDeviceId(clientId), code: createPairingCode(), expiresAt: Date.now() + PAIRING_CODE_TTL_MS };
+}
+
+function isValidOnboardingPairingCode(pairingSession, pairingCode, now) {
+  const suppliedCode = Buffer.from(String(pairingCode || '').trim().toUpperCase());
+  const expectedCode = Buffer.from(String(pairingSession && pairingSession.code || '').trim());
+  const currentTime = Number(now || Date.now());
+  return Boolean(pairingSession && pairingSession.deviceId && pairingSession.expiresAt > currentTime && suppliedCode.length === expectedCode.length && suppliedCode.length > 0 && crypto.timingSafeEqual(suppliedCode, expectedCode));
+}
+
+function getPublicBaseUrl(req, configuredUrl) {
   const forwardedProto = String(req.headers['x-forwarded-proto'] || '').trim().split(',')[0];
   const protocol = forwardedProto || (req.socket && req.socket.encrypted ? 'https' : 'http');
   const forwardedHost = String(req.headers['x-forwarded-host'] || '').trim().split(',')[0];
   const host = forwardedHost || String(req.headers.host || '').trim();
+  if (host) {
     return `${protocol}://${host}`.replace(/\/$/, '');
+  }
+
+  const configured = String(configuredUrl || process.env.PLAYER_PUBLIC_URL || process.env.PLAYER_BASE_URL || '').trim().replace(/\/$/, '');
+  return configured || null;
 }
 
 function getRequestIp(req) {
@@ -47,7 +75,7 @@ function getPlayerPublicBaseUrl(req, configuredUrl) {
 }
 
 function getPlayerInternalBaseUrl(configuredUrl) {
-  const configured = String(configuredUrl || process.env.PLAYER_INTERNAL_BASE_URL || process.env.PLAYER_BASE_URL || '').trim().replace(/\/$/, '');
+  const configured = String(configuredUrl || process.env.PLAYER_INTERNAL_URL || process.env.PLAYER_BASE_URL || '').trim().replace(/\/$/, '');
   return configured || null;
 }
 
@@ -116,7 +144,7 @@ async function commitDeviceBinding(pool, deviceId, clientName, screenSlug, isNam
     }
     const screen = screenRows[0];
 
-    const available = await isClientNameAvailable(pool, normalizedClientName, normalizedDeviceId, liveConnections);
+    const available = await isClientNameAvailable(pool, normalizedClientName, null, liveConnections);
     if (!available) {
       const error = new Error('Client name already exists.');
       error.statusCode = 400;
@@ -124,15 +152,25 @@ async function commitDeviceBinding(pool, deviceId, clientName, screenSlug, isNam
     }
 
     await pool.query(
-      'INSERT INTO d_onboarding_devices (device_id, client_name, screen_id) VALUES (?, ?, ?) ON DUPLICATE KEY UPDATE client_name = VALUES(client_name), screen_id = VALUES(screen_id), modified_at = CURRENT_TIMESTAMP',
+      `UPDATE d_onboarding_devices
-      [normalizedDeviceId, normalizedClientName, screen.id]
+          SET client_name = ?, screen_id = ?, modified_at = CURRENT_TIMESTAMP
+        WHERE device_id = ?`,
+      [normalizedClientName, screen.id, normalizedDeviceId]
+    );
+    await pool.query(
+      `INSERT INTO d_onboarding_devices (device_id, client_name, screen_id)
+       SELECT ?, ?, ?
+        WHERE NOT EXISTS (
+          SELECT 1 FROM d_onboarding_devices WHERE device_id = ?
+        )`,
+      [normalizedDeviceId, normalizedClientName, screen.id, normalizedDeviceId]
     );
 
     return getOnboardingStatus(pool, normalizedDeviceId);
   });
 }
 
-async function upsertPlayerRegistration(pool, deviceId, publicBaseUrl, internalBaseUrl, screenSlug) {
+async function upsertPlayerRegistration(pool, deviceId, publicBaseUrl, internalBaseUrl) {
   const normalizedDeviceId = normalizeDeviceId(deviceId);
   const normalizedPublicBaseUrl = String(publicBaseUrl || '').trim().replace(/\/$/, '');
   const normalizedInternalBaseUrl = String(internalBaseUrl || '').trim().replace(/\/$/, '');
@@ -140,18 +178,11 @@ async function upsertPlayerRegistration(pool, deviceId, publicBaseUrl, internalB
     return null;
   }
 
-  await pool.query(
+  return upsertPlayerRegistrationRecord(pool, {
-    `INSERT INTO d_players (device_id, public_base_url, internal_base_url, last_seen_at)
+    identifier: normalizedDeviceId,
-     VALUES (?, ?, ?, CURRENT_TIMESTAMP)
+    publicBaseUrl: normalizedPublicBaseUrl || null,
-     ON DUPLICATE KEY UPDATE public_base_url = VALUES(public_base_url), internal_base_url = VALUES(internal_base_url), last_seen_at = CURRENT_TIMESTAMP, modified_at = CURRENT_TIMESTAMP`,
+    internalBaseUrl: normalizedInternalBaseUrl || null
-    [normalizedDeviceId, normalizedPublicBaseUrl || null, normalizedInternalBaseUrl || null]
+  });
-  );
-
-  return {
-    device_id: normalizedDeviceId,
-    public_base_url: normalizedPublicBaseUrl || null,
-    internal_base_url: normalizedInternalBaseUrl || null
-  };
 }
 
 async function bindPlayerToScreen(pool, deviceId, screenSlug) {
@@ -166,25 +197,9 @@ async function bindPlayerToScreen(pool, deviceId, screenSlug) {
     return null;
   }
 
-  const screenId = Number(screenRows[0].id);
-  const connection = await pool.getConnection();
-  try {
-    await connection.beginTransaction();
-    // Current model: every screen binds to the shared player row '1'.
-    // If we introduce multiple players, resolve the correct player row here instead of hardcoding it.
-    await connection.query("UPDATE d_screens SET player_id = '1', modified_at = CURRENT_TIMESTAMP WHERE id = ?", [screenId]);
-    await connection.commit();
-  } catch (error) {
-    await connection.rollback();
-    throw error;
-  } finally {
-    connection.release();
-  }
-
   return {
-    screen_id: screenId,
+    screen_id: Number(screenRows[0].id),
-    screen_slug: normalizedScreenSlug,
+    screen_slug: normalizedScreenSlug
-    player_id: '1'
   };
 }
 
@@ -222,15 +237,99 @@ function registerPlayerOnboardingRoutes(app, options) {
   const pool = options && options.pool ? options.pool : null;
   const common = options && options.common ? options.common : null;
   const playerRuntime = options && options.playerRuntime ? options.playerRuntime : null;
-  const QRCode = options && options.QRCode ? options.QRCode : null;
   const onboardingStore = options && options.onboardingStore ? options.onboardingStore : null;
+  const playerPublicUrl = String(options && options.playerPublicBaseUrl || process.env.PLAYER_PUBLIC_URL || process.env.PLAYER_BASE_URL || '').trim().replace(/\/$/, '');
+  const bridgeBaseUrl = String(options && options.bridgeBaseUrl || process.env.BRIDGE_PUBLIC_URL || '').trim().replace(/\/$/, '');
+  const playerDeviceId = normalizeDeviceId(options && options.playerDeviceId);
+  const onPairingCode = options && typeof options.onPairingCode === 'function' ? options.onPairingCode : null;
+  const pairingSessions = new Map();
 
-  if (!app || !pool || !common || !playerRuntime || !QRCode) {
+  function getPairingSession(deviceId, clientId) {
-    throw new Error('registerPlayerOnboardingRoutes requires app, pool, common, playerRuntime, and QRCode.');
+    const normalizedDeviceId = normalizeDeviceId(deviceId) || playerDeviceId;
+    if (!normalizedDeviceId) {
+      return null;
+    }
+    const sessionKey = `${normalizedDeviceId}:${normalizeDeviceId(clientId) || 'default'}`;
+    let pairingSession = pairingSessions.get(sessionKey);
+    if (!isValidOnboardingPairingCode(pairingSession, pairingSession && pairingSession.code)) {
+      pairingSession = createPairingSession(normalizedDeviceId, clientId);
+      pairingSessions.set(sessionKey, pairingSession);
+    }
+    if (onPairingCode) {
+      onPairingCode(pairingSession.code, Array.from(pairingSessions.entries()).filter(function (entry) {
+        return isValidOnboardingPairingCode(entry[1], entry[1] && entry[1].code);
+      }).map(function (entry) {
+                return { deviceId: entry[1].deviceId, clientId: entry[1].clientId || null, code: entry[1].code };
+      }));
+    }
+    return pairingSession;
+  }
+
+  function findPairingSession(pairingCode) {
+    for (const [deviceId, pairingSession] of pairingSessions.entries()) {
+      if (isValidOnboardingPairingCode(pairingSession, pairingCode)) {
+        return { deviceId: pairingSession.deviceId, session: pairingSession };
+      }
+    }
+    return null;
+  }
+
+  if (!app || !common) {
+    throw new Error('registerPlayerOnboardingRoutes requires app and common.');
+  }
+
+  if (!bridgeBaseUrl && (!pool || !playerRuntime)) {
+    throw new Error('registerPlayerOnboardingRoutes requires pool and playerRuntime unless bridgeBaseUrl is configured.');
   }
 
   const sharedSecret = getSharedSecret();
 
+  async function fetchThinClient(req, pathname, options) {
+    if (!bridgeBaseUrl) {
+      return null;
+    }
+
+    const requestOptions = options && typeof options === 'object' ? options : {};
+    const method = String(requestOptions.method || req.method || 'GET').trim().toUpperCase();
+    const body = Object.prototype.hasOwnProperty.call(requestOptions, 'body') ? requestOptions.body : undefined;
+    const requestPathname = String(pathname || '').split('?')[0];
+    const headers = Object.assign({}, requestOptions.headers || {}, createRequestAuthHeaders({
+      method: method,
+      pathname: requestPathname,
+      body: body
+    }));
+
+    if (req.headers['x-pulse-page-auth']) {
+      headers['x-pulse-page-auth'] = String(req.headers['x-pulse-page-auth']).trim();
+    }
+    if (requestOptions.contentType) {
+      headers['content-type'] = requestOptions.contentType;
+    }
+
+    return fetch(new URL(pathname, bridgeBaseUrl).toString(), {
+      method: method,
+      headers: headers,
+      body: body === undefined || body === null || method === 'GET' || method === 'HEAD' ? undefined : body
+    });
+  }
+
+  async function readJsonResponse(response) {
+    if (!response) {
+      return null;
+    }
+
+    const contentType = String(response.headers && typeof response.headers.get === 'function' ? response.headers.get('content-type') : '').toLowerCase();
+    if (contentType.indexOf('application/json') === -1 && contentType.indexOf('+json') === -1) {
+      return null;
+    }
+
+    try {
+      return await response.json();
+    } catch (_error) {
+      return null;
+    }
+  }
+
   function requireOnboardingPageAuth(req, res, next) {
     if (!sharedSecret) {
       return next();
@@ -246,15 +345,71 @@ function registerPlayerOnboardingRoutes(app, options) {
     next();
   }
 
-  app.get('/', function (_req, res) {
+  function requireOnboardingAuth(req, res, next) {
+    if (!sharedSecret) {
+      return next();
+    }
+
+    const pageToken = String(req.headers['x-pulse-page-auth'] || '').trim();
+    const pagePayload = verifyPageAuthToken(pageToken);
+    if (pagePayload && String(pagePayload.scope || '').trim() === 'onboarding') {
+      req.playerPageAuth = pagePayload;
+      return next();
+    }
+
+    if (verifyRequestAuth(req)) {
+      return next();
+    }
+
+    return res.status(401).json({ error: 'Onboarding authentication required.' });
+  }
+
+  app.get('/', async function (req, res, next) {
     res.set('Cache-Control', 'no-store, no-cache, must-revalidate, proxy-revalidate');
-    res.send(common.renderPlayerOnboardingLandingPage());
+    try {
+      const deviceId = normalizeDeviceId(req.query && req.query.clientId);
+      let status = null;
+      if (deviceId) {
+        if (bridgeBaseUrl) {
+          const response = await fetchThinClient(req, '/api/onboarding/status?deviceId=' + encodeURIComponent(deviceId), {
+            method: 'GET'
+          });
+          status = await readJsonResponse(response);
+        } else {
+          status = await getOnboardingStatus(pool, deviceId);
+        }
+      }
+      const screenId = status && (status.screen_id || status.screenId);
+      const screenSlug = status && (status.screen_slug || status.screenSlug);
+      if (screenId && screenSlug) {
+        return res.redirect('/screen/' + encodeURIComponent(screenSlug));
+      }
+      res.send(common.renderPlayerOnboardingLandingPage({ pairingCode: '' }));
+    } catch (error) {
+      next(error);
+    }
   });
 
   app.get('/onboard', async function (req, res, next) {
     res.set('Cache-Control', 'no-store, no-cache, must-revalidate, proxy-revalidate');
     try {
-      res.send(common.renderPlayerOnboardingFormPage(String(req.query.deviceId || '').trim()));
+      const deviceId = playerDeviceId;
+      const onboardingBaseUrl = String(process.env.WEB_PUBLIC_URL || '').trim().replace(/\/$/, '') || getPublicBaseUrl(req, playerPublicUrl);
+      const clientId = normalizeDeviceId(req.query.clientId);
+      const pairingSession = getPairingSession(deviceId, clientId);
+      const pairingParams = [];
+      if (pairingSession && pairingSession.code) {
+        pairingParams.push(`code=${encodeURIComponent(pairingSession.code)}`);
+      }
+      const pairingQuery = pairingParams.length ? `?${pairingParams.join('&')}` : '';
+      if (bridgeBaseUrl && pairingSession && pairingSession.code) {
+        const response = await fetchThinClient(req, `/api/onboarding/url?pairingCode=${encodeURIComponent(pairingSession.code)}`);
+        const payload = await readJsonResponse(response);
+        if (payload && payload.url) {
+          return res.redirect(String(payload.url));
+        }
+      }
+      return res.redirect(`${onboardingBaseUrl}/pairing${pairingQuery}`);
     } catch (error) {
       next(error);
     }
@@ -272,23 +427,70 @@ function registerPlayerOnboardingRoutes(app, options) {
     next();
   }, async function (req, res, next) {
     try {
-      const status = await getOnboardingStatus(pool, req.query.deviceId);
+      const deviceId = normalizeDeviceId(req.query.deviceId || req.query.clientId);
+      if (bridgeBaseUrl) {
+        const response = await fetchThinClient(req, '/api/onboarding/status?deviceId=' + encodeURIComponent(deviceId || ''), {
+          method: 'GET'
+        });
+        if (!response) {
+          return res.status(502).json({ error: 'Player bridge unavailable.' });
+        }
+        res.status(response.status);
+        const payload = await readJsonResponse(response);
+        if (!payload) {
+          return res.status(502).json({ error: 'Player bridge returned an invalid response.' });
+        }
+        payload.playerUrl = payload && payload.screenSlug ? `${getPublicBaseUrl(req, playerPublicUrl)}/screen/${encodeURIComponent(payload.screenSlug)}` : null;
+        return res.json(payload);
+      }
+
+      const status = await getOnboardingStatus(pool, deviceId);
       res.json({
-        deviceId: normalizeDeviceId(req.query.deviceId),
+        deviceId: normalizeDeviceId(deviceId),
         onboarded: Boolean(status && status.screen_id),
         clientName: status ? status.client_name : null,
         screenId: status ? status.screen_id : null,
         screenSlug: status ? status.screen_slug : null,
         screenName: status ? status.screen_name : null,
-        playerUrl: status && status.screen_slug ? `${getPublicBaseUrl(req)}/screen/${encodeURIComponent(status.screen_slug)}` : null
+        playerUrl: status && status.screen_slug ? `${getPublicBaseUrl(req, playerPublicUrl)}/screen/${encodeURIComponent(status.screen_slug)}` : null
       });
     } catch (error) {
       next(error);
     }
   });
 
+  app.get('/api/onboarding/resolve', requireOnboardingAuth, function (req, res) {
+    const pairingCode = String(req.query.pairingCode || '').trim();
+    const pairing = findPairingSession(pairingCode);
+    if (!pairing) {
+      return res.status(401).json({ error: 'A valid kiosk pairing code is required.' });
+    }
+    res.json({ deviceId: pairing.deviceId, clientId: pairing.session.clientId || null });
+  });
+
+  app.get('/api/onboarding/session', requireOnboardingPageAuth, function (req, res) {
+    const deviceId = normalizeDeviceId(req.query.deviceId) || playerDeviceId;
+    const clientId = normalizeDeviceId(req.query.clientId);
+    const pairingSession = getPairingSession(deviceId, clientId);
+    if (!pairingSession) {
+      return res.status(503).json({ error: 'Player identity is unavailable.' });
+    }
+    res.set('Cache-Control', 'no-store');
+    res.json({ deviceId: deviceId, pairingCode: pairingSession.code });
+  });
+
   app.get('/api/onboarding/screens', requireOnboardingPageAuth, async function (_req, res, next) {
     try {
+      if (bridgeBaseUrl) {
+        const response = await fetchThinClient(_req, '/api/onboarding/screens', {
+          method: 'GET'
+        });
+        res.status(response.status);
+        const text = await response.text();
+        res.type(response.headers.get('content-type') || 'application/json');
+        return res.send(text);
+      }
+
       const [rows] = await pool.query('SELECT id, name, slug FROM d_screens ORDER BY name ASC, id ASC');
       res.json({ screens: rows });
     } catch (error) {
@@ -296,14 +498,40 @@ function registerPlayerOnboardingRoutes(app, options) {
     }
   });
 
+
   app.get('/api/onboarding/qr', async function (req, res, next) {
     try {
-      const deviceId = normalizeDeviceId(req.query.deviceId);
+      const deviceId = normalizeDeviceId(req.query.deviceId) || playerDeviceId;
+      const clientId = normalizeDeviceId(req.query.clientId);
       if (!deviceId) {
         return res.status(400).json({ error: 'Device ID is required' });
       }
-      const onboardingUrl = `${getPublicBaseUrl(req, options && options.playerPublicBaseUrl)}/onboard?deviceId=${encodeURIComponent(deviceId)}`;
+      const pairingSession = getPairingSession(deviceId, clientId);
-      const svg = await QRCode.toString(onboardingUrl, { type: 'svg', margin: 1, errorCorrectionLevel: 'M' });
+      if (!pairingSession) {
+        return res.status(503).json({ error: 'Pairing session is unavailable.' });
+      }
+      if (bridgeBaseUrl) {
+        const response = await fetchThinClient(req, `/api/onboarding/qr?pairingCode=${encodeURIComponent(pairingSession.code)}`);
+        if (response && response.ok) {
+          const svg = await response.text();
+          res.set('Content-Type', response.headers.get('content-type') || 'image/svg+xml; charset=utf-8');
+          res.set('Cache-Control', 'no-store');
+          return res.send(svg);
+        }
+      }
+      const onboardingBaseUrl = String(process.env.WEB_PUBLIC_URL || '').trim().replace(/\/$/, '') || getPublicBaseUrl(req, playerPublicUrl);
+      const onboardingUrl = `${onboardingBaseUrl}/pairing?code=${encodeURIComponent(pairingSession.code)}`;
+      const svg = await createStyledQrCodeSvg({
+        value: onboardingUrl,
+        qr_margin: 20,
+        qr_dots_type: 'dots',
+        qr_dots_color: '#f4f8f5',
+        qr_corners_square_type: 'dot',
+        qr_corners_square_color: '#f4f8f5',
+        qr_corners_dot_type: 'dot',
+        qr_corners_dot_color: '#f0bd70',
+        qr_background_transparent: true
+      });
       res.set('Content-Type', 'image/svg+xml; charset=utf-8');
       res.set('Cache-Control', 'no-store');
       res.send(svg);
@@ -312,16 +540,51 @@ function registerPlayerOnboardingRoutes(app, options) {
     }
   });
 
-  app.post('/api/onboarding', requireOnboardingPageAuth, async function (req, res, next) {
+  app.post('/api/onboarding', express.json(), requireOnboardingAuth, async function (req, res, next) {
     try {
-      const deviceId = normalizeDeviceId(req.body && req.body.deviceId);
+      const deviceId = playerDeviceId;
       const clientName = String((req.body && req.body.clientName) || '').trim();
       const screenSlug = String((req.body && req.body.screenSlug) || '').trim();
+      const pairingCode = String((req.body && req.body.pairingCode) || '').trim();
+      const clientId = normalizeDeviceId(req.body && req.body.clientId);
       const retryAfterSeconds = isOnboardingSignupRateLimited(req, deviceId);
       if (retryAfterSeconds) {
         res.set('Retry-After', String(retryAfterSeconds));
         return res.status(429).json({ error: 'Too many onboarding attempts. Please try again later.' });
       }
+
+      const pairing = findPairingSession(pairingCode);
+      const pairingSession = pairing && pairing.session;
+      if (!isValidOnboardingPairingCode(pairingSession, pairingCode)) {
+        return res.status(401).json({ error: 'A valid kiosk pairing code is required.' });
+      }
+
+      if (bridgeBaseUrl) {
+        const forwardedBody = Object.assign({}, req.body || {}, {
+          clientId: clientId || null
+        });
+        const response = await fetch(new URL('/api/onboarding', bridgeBaseUrl).toString(), {
+          method: 'POST',
+          headers: Object.assign({
+            'content-type': 'application/json'
+          }, createRequestAuthHeaders({
+            method: 'POST',
+            pathname: '/api/onboarding',
+            body: forwardedBody
+          }), req.headers['x-pulse-page-auth'] ? { 'x-pulse-page-auth': String(req.headers['x-pulse-page-auth']).trim() } : {}),
+          body: JSON.stringify(forwardedBody)
+        });
+        res.status(response.status);
+        const payload = await readJsonResponse(response);
+        if (!payload) {
+          return res.status(502).json({ error: 'Player bridge returned an invalid response.' });
+        }
+        if (response.ok) {
+          pairingSessions.delete(deviceId);
+        }
+        payload.playerUrl = payload && payload.screenSlug ? `${getPublicBaseUrl(req, playerPublicUrl)}/screen/${encodeURIComponent(payload.screenSlug)}` : `${getPublicBaseUrl(req, playerPublicUrl)}/screen/${encodeURIComponent(screenSlug)}`;
+        return res.json(payload);
+      }
       if (!deviceId) {
         return res.status(400).json({ error: 'Device ID is required' });
       }
@@ -332,19 +595,25 @@ function registerPlayerOnboardingRoutes(app, options) {
         return res.status(400).json({ error: 'Screen is required' });
       }
 
-      const status = await bindDeviceToScreen(pool, deviceId, clientName, screenSlug, playerRuntime.isClientNameAvailableOnScreen, playerRuntime, onboardingStore);
+      if (!clientId) {
-      await bindPlayerToScreen(pool, deviceId, screenSlug);
+        return res.status(400).json({ error: 'Client ID is required' });
+      }
+      const status = await bindDeviceToScreen(pool, clientId, clientName, screenSlug, playerRuntime.isClientNameAvailableOnScreen, playerRuntime, onboardingStore);
+      pairingSessions.delete(deviceId);
       res.json({
         deviceId: deviceId,
         clientName: status ? status.client_name : clientName,
         screenId: status && status.screen_id ? status.screen_id : null,
         screenSlug: status ? status.screen_slug : screenSlug,
         screenName: status && status.screen_name ? status.screen_name : null,
-        playerUrl: status && status.screen_slug ? `${getPublicBaseUrl(req)}/screen/${encodeURIComponent(status.screen_slug)}` : `${getPublicBaseUrl(req)}/screen/${encodeURIComponent(screenSlug)}`,
+        playerUrl: status && status.screen_slug ? `${getPublicBaseUrl(req, playerPublicUrl)}/screen/${encodeURIComponent(status.screen_slug)}` : `${getPublicBaseUrl(req, playerPublicUrl)}/screen/${encodeURIComponent(screenSlug)}`,
         queued: Boolean(status && status.queued)
       });
     } catch (error) {
-      next(error);
+        const statusCode = Number(error && error.statusCode || error && error.status || 500);
+        res.status(Number.isFinite(statusCode) && statusCode >= 400 ? statusCode : 500).json({
+          error: error && error.message ? error.message : 'Onboarding failed.'
+        });
     }
   });
 }
@@ -359,5 +628,6 @@ module.exports = {
   upsertPlayerRegistration: upsertPlayerRegistration,
   bindPlayerToScreen: bindPlayerToScreen,
   bindDeviceToScreen: bindDeviceToScreen,
+  isValidOnboardingPairingCode: isValidOnboardingPairingCode,
   registerPlayerOnboardingRoutes: registerPlayerOnboardingRoutes
 };

src/player/onboarding/player-onboarding-form.script.html

@@ -7,6 +7,12 @@
     var form = document.getElementById("onboarding-form");
     var message = document.getElementById("onboarding-message");
     var screenSelect = document.getElementById("onboarding-screen-select");
+    function getSessionStorageItem(key) {
+      try { return window.sessionStorage.getItem(key) || ""; } catch (_error) { return ""; }
+    }
+    function setSessionStorageItem(key, value) {
+      try { window.sessionStorage.setItem(key, value); } catch (_error) {}
+    }
     function setMessage(value) { if (message) { message.textContent = value || ""; } }
       function parseResponseError(response) {
         return response.text().then(function (text) {
@@ -39,15 +45,19 @@
           return screens;
         });
     }
-    if (!deviceId) { setMessage("Missing device id. Scan the QR code from the player screen again."); return; }
+    try {
-    try { window.localStorage.setItem(deviceKey, deviceId); } catch (_error) {}
+      if (!deviceId) {
+        deviceId = window.sessionStorage.getItem(deviceKey) || "";
+      }
+      if (deviceId) {
+        window.sessionStorage.setItem(deviceKey, deviceId);
+      }
+    } catch (_error) {}
     loadScreens().then(function () {
       try {
-        var storedClientName = window.localStorage.getItem(clientNameKey) || "";
+        var storedClientName = getSessionStorageItem(clientNameKey) || "";
-        var storedScreenSlug = window.localStorage.getItem(screenKey) || "";
         var clientNameInput = form.querySelector("input[name=\"clientName\"]");
         if (clientNameInput && storedClientName) { clientNameInput.value = storedClientName; }
-        if (screenSelect && storedScreenSlug) { screenSelect.value = storedScreenSlug; }
       } catch (_error) {}
     });
     form.addEventListener("submit", function (event) {
@@ -55,13 +65,18 @@
       var formData = new FormData(form);
       var clientName = String(formData.get("clientName") || "").trim();
       var screenSlug = String(formData.get("screenSlug") || "").trim();
+      var pairingCode = String(formData.get("pairingCode") || "").trim();
       if (!clientName) { setMessage("Client name is required."); return; }
       if (!screenSlug) { setMessage("Screen is required."); return; }
       setMessage("Saving client...");
+      var payload = { clientName: clientName, screenSlug: screenSlug, pairingCode: pairingCode };
+      if (deviceId) {
+        payload.deviceId = deviceId;
+      }
       fetch("/api/onboarding", {
         method: "POST",
         headers: { "Content-Type": "application/json", Accept: "application/json" },
-        body: JSON.stringify({ deviceId: deviceId, clientName: clientName, screenSlug: screenSlug })
+        body: JSON.stringify(payload)
       })
          .then(function (response) {
            if (response.ok) {
@@ -73,7 +88,7 @@
          })
         .then(function (payload) {
           if (!payload || !payload.screenSlug) { throw new Error("Unable to save onboarding."); }
-          if (payload.clientName) { try { window.localStorage.setItem(clientNameKey, payload.clientName); } catch (_error) {} }
+          if (payload.clientName) { setSessionStorageItem(clientNameKey, payload.clientName); }
           try { window.localStorage.setItem(screenKey, payload.screenSlug); } catch (_error) {}
           setMessage("Onboarding complete.");
           if (form) {

src/player/onboarding/player-onboarding-landing.script.html

@@ -2,139 +2,81 @@
   (function () {
     var deviceKey = "pulse-signage-player-device-id";
     var clientNameKey = "pulse-signage-player-client-name";
+    function getSessionStorageItem(key) {
+      try { return window.sessionStorage.getItem(key) || ""; } catch (_error) { return ""; }
+    }
+    function setSessionStorageItem(key, value) {
+      try { window.sessionStorage.setItem(key, value); } catch (_error) {}
+    }
     function getClientNameStorageKey(_screenSlug) {
       return clientNameKey;
     }
     var screenKey = "pulse-signage-player-screen-slug";
     var qr = document.getElementById("onboarding-qr");
-    var status = document.getElementById("onboarding-status");
+    var pairingCodeElement = document.getElementById("onboarding-pairing-code");
-    var localForm = document.getElementById("onboarding-local-form");
+    var qrPlaceholderSrc = "data:image/svg+xml;charset=utf-8,%3Csvg xmlns=%22http://www.w3.org/2000/svg%22 viewBox=%220 0 320 320%22%3E%3Crect width=%22320%22 height=%22320%22 rx=%2224%22 fill=%22%23ffffff%22/%3E%3Crect x=%2230%22 y=%2230%22 width=%22260%22 height=%22260%22 rx=%2218%22 fill=%22%23f8fafc%22 stroke=%22%23cbd5e1%22 stroke-width=%223%22 stroke-dasharray=%2212 10%22/%3E%3Cpath d=%22M106 118h108M106 156h108M106 194h72%22 stroke=%22%2394a3b8%22 stroke-width=%2214%22 stroke-linecap=%22round%22/%3E%3Ccircle cx=%22128%22 cy=%22248%22 r=%2212%22 fill=%22%2394a3b8%22/%3E%3Ctext x=%22160%22 y=%2278%22 text-anchor=%22middle%22 fill=%22%230f172a%22 font-family=%22Arial,sans-serif%22 font-size=%2224%22 font-weight=%22700%22%3EQR code loading%3C/text%3E%3Ctext x=%22160%22 y=%22266%22 text-anchor=%22middle%22 fill=%22%234b5563%22 font-family=%22Arial,sans-serif%22 font-size=%2214%22%3EPlease wait%3C/text%3E%3C/svg%3E";
-    var localMessage = document.getElementById("onboarding-message");
-    var localScreenSelect = document.getElementById("onboarding-screen-select");
-    function parseResponseError(response) {
-      return response.text().then(function (text) {
-        var fallbackMessage = text && text.trim() ? text.trim() : "Unable to save onboarding.";
-        try {
-          var payload = JSON.parse(text);
-          return payload && payload.error ? payload.error : fallbackMessage;
-        } catch (_error) {
-          return fallbackMessage;
-        }
-      });
-    }
     function getDeviceId() {
+      var configuredDeviceId = document.getElementById("onboarding-shell");
+      configuredDeviceId = configuredDeviceId ? String(configuredDeviceId.getAttribute("data-player-device-id") || "").trim() : "";
+      if (configuredDeviceId) { return configuredDeviceId; }
       var stored = "";
-      try { stored = window.localStorage.getItem(deviceKey) || ""; } catch (_error) { stored = ""; }
+      try { stored = window.sessionStorage.getItem(deviceKey) || ""; } catch (_error) { stored = ""; }
       if (stored) { return stored; }
       var next = (window.crypto && window.crypto.randomUUID ? window.crypto.randomUUID() : "device-" + Date.now() + "-" + Math.random().toString(16).slice(2));
-      try { window.localStorage.setItem(deviceKey, next); } catch (_error2) {}
+      try { window.sessionStorage.setItem(deviceKey, next); } catch (_error2) {}
       return next;
     }
-    function setStatus(message) { if (status) { status.textContent = message; } }
+    function loadQr(deviceId, clientId) {
-    function setLocalMessage(message) { if (localMessage) { localMessage.textContent = message || ""; } }
+      if (!qr) { return; }
-    function setSelectOptions(select, screens, selectedSlug) {
+      qr.onerror = function () {
-      if (!select) { return; }
+        qr.src = qrPlaceholderSrc;
-      while (select.firstChild) { select.removeChild(select.firstChild); }
+      };
-      var placeholder = document.createElement("option");
+      qr.src = "/api/onboarding/qr?deviceId=" + encodeURIComponent(deviceId) + "&clientId=" + encodeURIComponent(clientId);
-      placeholder.value = "";
-      placeholder.textContent = "Select a screen";
-      select.appendChild(placeholder);
-      (Array.isArray(screens) ? screens : []).forEach(function (screen) {
-        var option = document.createElement("option");
-        option.value = String(screen && screen.slug ? screen.slug : "");
-        option.textContent = String(screen && (screen.name || screen.slug) ? (screen.name || screen.slug) : "Screen");
-        if (selectedSlug && String(option.value) === String(selectedSlug)) {
-          option.selected = true;
     }
-        select.appendChild(option);
+    function loadPairingSession(deviceId, clientId) {
-      });
+      return fetch("/api/onboarding/session?deviceId=" + encodeURIComponent(deviceId) + "&clientId=" + encodeURIComponent(clientId), { cache: "no-store" })
-    }
-    function loadScreens(selectedSlug) {
-      return fetch("/api/onboarding/screens", { cache: "no-store" })
         .then(function (response) { return response.ok ? response.json() : null; })
         .then(function (payload) {
-          var screens = payload && Array.isArray(payload.screens) ? payload.screens : [];
+          if (payload && payload.pairingCode && pairingCodeElement) {
-          setSelectOptions(localScreenSelect, screens, selectedSlug);
+            pairingCodeElement.textContent = payload.pairingCode;
-          return screens;
+          }
+          return payload;
         })
-        .catch(function () { setSelectOptions(localScreenSelect, [], selectedSlug); return []; });
+        .catch(function () { return null; });
     }
-    function loadQr(deviceId) {
+    function getClientId() {
-      if (qr) { qr.src = "/api/onboarding/qr?deviceId=" + encodeURIComponent(deviceId); }
+      var stored = getSessionStorageItem("pulse-signage-player-client-id");
-    }
+      if (stored) { return stored; }
-    function submitOnboarding(deviceId, clientName, screenSlug) {
+      var next = (window.crypto && window.crypto.randomUUID ? window.crypto.randomUUID() : "client-" + Date.now() + "-" + Math.random().toString(16).slice(2));
-      return fetch("/api/onboarding", {
+      setSessionStorageItem("pulse-signage-player-client-id", next);
-        method: "POST",
+      return next;
-        headers: { "Content-Type": "application/json", Accept: "application/json" },
-        body: JSON.stringify({ deviceId: deviceId, clientName: clientName, screenSlug: screenSlug })
-      })
-        .then(function (response) {
-          if (response.ok) {
-            return response.json();
-          }
-          return parseResponseError(response).then(function (messageText) {
-            throw new Error(messageText);
-          });
-        })
-        .then(function (payload) {
-          if (!payload || !payload.screenSlug) { throw new Error("Unable to save onboarding."); }
-          if (payload.clientName) { try { window.localStorage.setItem(clientNameKey, payload.clientName); } catch (_error) {} }
-          if (payload.clientName && payload.screenSlug) { try { window.localStorage.setItem(getClientNameStorageKey(payload.screenSlug), payload.clientName); } catch (_error2) {} }
-          try { window.localStorage.setItem(screenKey, payload.screenSlug); } catch (_error) {}
-          setLocalMessage("Onboarding complete.");
-          if (localForm) {
-            Array.prototype.slice.call(localForm.querySelectorAll("input, select, button")).forEach(function (control) {
-              control.disabled = true;
-            });
-          }
-        });
     }
     function redirectIfOnboarded(deviceId) {
-      return fetch("/api/onboarding/status?deviceId=" + encodeURIComponent(deviceId), { cache: "no-store" })
+      var bindingId = getClientId() || deviceId;
+      return fetch("/api/onboarding/status?deviceId=" + encodeURIComponent(bindingId), { cache: "no-store" })
         .then(function (response) { return response.ok ? response.json() : null; })
         .then(function (payload) {
           if (payload && payload.onboarded && payload.screenSlug) {
-            if (payload.clientName) { try { window.localStorage.setItem(clientNameKey, payload.clientName); } catch (_error) {} }
+            if (payload.clientName) { setSessionStorageItem(clientNameKey, payload.clientName); }
-            if (payload.clientName && payload.screenSlug) { try { window.localStorage.setItem(getClientNameStorageKey(payload.screenSlug), payload.clientName); } catch (_error2) {} }
+            if (payload.clientName && payload.screenSlug) { setSessionStorageItem(getClientNameStorageKey(payload.screenSlug), payload.clientName); }
             try { window.localStorage.setItem(screenKey, payload.screenSlug); } catch (_error) {}
-            window.location.replace("/screen/" + encodeURIComponent(payload.screenSlug));
+            window.location.replace("/screen/" + encodeURIComponent(payload.screenSlug) + "?clientId=" + encodeURIComponent(clientId));
             return true;
           }
           return false;
         })
         .catch(function () { return false; });
     }
+    var clientId = getClientId();
     var deviceId = getDeviceId();
-    if (localForm) {
-      localForm.addEventListener("submit", function (event) {
-        event.preventDefault();
-        var formData = new FormData(localForm);
-        var clientName = String(formData.get("clientName") || "").trim();
-        var screenSlug = String(formData.get("screenSlug") || "").trim();
-        if (!clientName) { setLocalMessage("Client name is required."); return; }
-        if (!screenSlug) { setLocalMessage("Screen is required."); return; }
-        setLocalMessage("Saving client...");
-        submitOnboarding(deviceId, clientName, screenSlug).catch(function (error) {
-          setLocalMessage(error && error.message ? error.message : "Unable to save onboarding.");
-        });
-      });
-    }
-    loadScreens().then(function () {
-      try {
-        var storedScreenSlug = window.localStorage.getItem(screenKey) || "";
-        var storedClientName = window.localStorage.getItem(clientNameKey) || "";
-        if (!storedClientName && storedScreenSlug) { storedClientName = window.localStorage.getItem(getClientNameStorageKey(storedScreenSlug)) || ""; }
-        if (storedClientName && localForm) {
-          var clientNameInput = localForm.querySelector("input[name=\"clientName\"]");
-          if (clientNameInput && !clientNameInput.value) { clientNameInput.value = storedClientName; }
-        }
-        if (storedScreenSlug && localScreenSelect) { localScreenSelect.value = storedScreenSlug; }
-      } catch (_error) {}
-    });
     redirectIfOnboarded(deviceId).then(function (redirected) {
       if (redirected) { return; }
-      loadQr(deviceId);
+      if (qr && !qr.getAttribute("src")) {
-      setStatus("Waiting for onboarding to finish.");
+        qr.src = qrPlaceholderSrc;
+      }
+      loadPairingSession(deviceId, clientId).then(function () {
+          loadQr(deviceId, clientId);
+      });
       window.setInterval(function () { redirectIfOnboarded(deviceId); }, 2000);
     });
   }());

src/player/player-client-name.script.html

@@ -4,10 +4,31 @@
   const onboardingClientNameStorageKey = 'pulse-signage-player-client-name';
   const onboardingDeviceIdStorageKey = 'pulse-signage-player-device-id';
 
+  function getSessionStorageItem(key) {
+    try {
+      return window.sessionStorage.getItem(key) || '';
+    } catch (_error) {
+      return '';
+    }
+  }
+
+  function setSessionStorageItem(key, value) {
+    try {
+      window.sessionStorage.setItem(key, value);
+    } catch (_error) {
+      // ignore storage errors
+    }
+  }
+
   function getOnboardingDeviceId() {
     try {
-      var storedDeviceId = window.localStorage.getItem(onboardingDeviceIdStorageKey) || '';
+      var storedDeviceId = getSessionStorageItem(onboardingDeviceIdStorageKey);
+      if (storedDeviceId) {
         return String(storedDeviceId || '').trim();
+      }
+      var nextDeviceId = window.crypto && window.crypto.randomUUID ? window.crypto.randomUUID() : 'device-' + Date.now() + '-' + Math.random().toString(16).slice(2);
+      setSessionStorageItem(onboardingDeviceIdStorageKey, nextDeviceId);
+      return String(nextDeviceId || '').trim();
     } catch (_error) {
       return '';
     }
@@ -19,24 +40,14 @@
       return onboardingClientName;
     }
     try {
-      var storedClientName = window.localStorage.getItem(onboardingClientNameStorageKey);
+      var storedClientName = getSessionStorageItem(onboardingClientNameStorageKey);
       if (storedClientName) {
         onboardingClientName = storedClientName;
-        try {
-          window.localStorage.setItem('pulse-signage-player-client-name', storedClientName);
-        } catch (_mirrorError) {
-          // ignore storage errors
-        }
         return onboardingClientName;
       }
-      var genericClientName = window.localStorage.getItem('pulse-signage-player-client-name');
+      var genericClientName = getSessionStorageItem('pulse-signage-player-client-name');
       if (genericClientName) {
         onboardingClientName = genericClientName;
-        try {
-          window.localStorage.setItem(onboardingClientNameStorageKey, genericClientName);
-        } catch (_error) {
-          // ignore storage errors
-        }
         return onboardingClientName;
       }
     } catch (_error) {
@@ -51,12 +62,8 @@
       return;
     }
     onboardingClientName = normalizedName;
-    try {
+    setSessionStorageItem('pulse-signage-player-client-name', normalizedName);
-      window.localStorage.setItem('pulse-signage-player-client-name', normalizedName);
+    setSessionStorageItem(onboardingClientNameStorageKey, normalizedName);
-      window.localStorage.setItem(onboardingClientNameStorageKey, normalizedName);
-    } catch (_error) {
-      // ignore storage errors
-    }
     if (socket && socket.readyState === WebSocket.OPEN) {
       sendCommandState(socket);
     }
@@ -83,7 +90,7 @@
       });
     }).then(function (payload) {
       var serverName = payload && payload.clientName ? String(payload.clientName).trim() : '';
-      if (serverName) {
+      if (serverName && !getOnboardingClientName()) {
         applyOnboardingClientName(serverName, null);
       }
       return onboardingClientName || getOnboardingClientName();

src/player/player-page-announcements.js

@@ -1,6 +1,10 @@
 // Announcement overlay polling and rendering helpers.
 
 (function () {
+  if (window.__pulseThumbnailPreview) {
+    return;
+  }
+
   var announcementLayer = null;
   var announcementRefreshTimer = null;
   var announcementPollTimer = null;
@@ -127,6 +131,9 @@
     if (window.__pulsePageAuthToken) {
       request.setRequestHeader('x-pulse-page-auth', window.__pulsePageAuthToken);
     }
+    if (typeof getCommandClientId === 'function') {
+      request.setRequestHeader('x-pulse-client-id', getCommandClientId());
+    }
     if (announcementEtag) {
       request.setRequestHeader('If-None-Match', announcementEtag);
     }
@@ -211,12 +218,7 @@
       return;
     }
 
-    var socketUrl = new URL(announcementSocketPath, window.location.origin);
+    var socket = new WebSocket(new URL(announcementSocketPath, window.location.origin).toString());
-    if (window.__pulsePageAuthToken) {
-      socketUrl.searchParams.set('auth', window.__pulsePageAuthToken);
-    }
-
-    var socket = new WebSocket(socketUrl.toString());
     announcementSocket = socket;
 
     socket.onopen = function () {

src/player/player-page.script.html

@@ -1,6 +1,6 @@
 <script>
   const slug = {{SLUG_JSON}};
-  const initialData = {{INITIAL_DATA_JSON}};
+  let initialData = {{INITIAL_DATA_JSON}};
   window.slug = slug;
   window.initialData = initialData;
   const app = document.getElementById('app');
@@ -73,7 +73,7 @@
   let slideExpiresAt = null;
   const slideFadeDurationMs = 560;
   const commandSocketPath = '/ws/screens/' + encodeURIComponent(slug);
-  const commandClientStorageKey = 'pulse-signage-player-client-id:' + slug;
+  const commandClientStorageKey = 'pulse-signage-player-client-id';
   const playlistSnapshotStorageKey = 'pulse-signage-player-playlist-snapshot:' + slug;
   const initialPlaylistSnapshot = loadPlaylistSnapshot();
   let offlineBanner = null;
@@ -181,10 +181,6 @@
     releaseScreenWakeLock();
   });
 
-  if (initialPlaylistSnapshot && initialPlaylistSnapshot.slides.length) {
-    applyPlaylistSnapshot(initialPlaylistSnapshot);
-  }
-
   if (slides.length) {
     if (!currentPlaylistSignature) {
       currentPlaylistSignature = getPlaylistRevision(initialData && initialData.slides ? initialData : { slides: slides });

src/player/player-page.template.html

@@ -6,7 +6,8 @@
     <title>{{TITLE}}</title>
     <link rel="icon" type="image/png" href="/assets/favicon.png" />
     <link rel="stylesheet" href="/assets/adminlte/bootstrap-icons/css/bootstrap-icons.min.css" />
-    <link rel="stylesheet" href="/assets/css/player.css?v=36" />
+    <link rel="stylesheet" href="/assets/vendor/animate.css/animate.min.css" />
+    <link rel="stylesheet" href="/assets/css/player.css?v=37" />
     {{{STYLESHEETS}}}
   </head>
   <body class="{{BODY_CLASS}}">

src/player/playlist.js

@@ -1,13 +1,17 @@
 // Player playlist assembly, snapshot persistence, and playlist revision helpers.
 
 const crypto = require('crypto');
+const { convertWeatherSnapshot } = require('#src/data/weather-units');
 const fs = require('fs');
 const path = require('path');
+const { createStyledQrCodeDataUrl } = require('../data/qr-code');
 
 function createPlayerPlaylistService(options) {
   const pool = options && options.pool ? options.pool : null;
   const common = options && options.common ? options.common : null;
   const snapshotDir = options && options.snapshotDir ? options.snapshotDir : null;
+  const mediaDir = options && options.mediaDir ? path.resolve(String(options.mediaDir)) : null;
+  const remoteImageCacheDir = mediaDir ? path.join(mediaDir, 'player-cache', 'remote-images') : null;
 
   if (!pool) {
     throw new Error('pool is required');
@@ -56,11 +60,114 @@ function createPlayerPlaylistService(options) {
     await fs.promises.writeFile(filePath, JSON.stringify(payload, null, 2), 'utf8');
   }
 
+  async function createQrPreviewDataUrl(value) {
+    return createStyledQrCodeDataUrl(value);
+  }
+
+  function getPlaceholderImageExpressions(value, output) {
+    const expressions = output || [];
+    const source = String(value || '');
+    const pattern = /\{\{\s*([^{}]*?\.image\s*\([^{}]*\)[^{}]*?)\s*\}\}/gi;
+    let match = null;
+    while ((match = pattern.exec(source))) {
+      expressions.push(String(match[1] || '').trim());
+    }
+    return expressions;
+  }
+
+  function resolvePathValue(value, expression) {
+    const parsed = String(expression || '').replace(/\.image\s*\([^)]*\)\s*$/i, '').trim();
+    return parsed.split('.').reduce(function (current, segment) {
+      return current === undefined || current === null ? '' : current[segment];
+    }, value);
+  }
+
+  function getApiItems(responseJson, itemsPath) {
+    let current = responseJson;
+    const pathValue = String(itemsPath || '').trim();
+    if (pathValue) {
+      pathValue.split('.').forEach(function (segment) {
+        current = current === undefined || current === null ? '' : current[segment];
+      });
+      return Array.isArray(current) ? current : [];
+    }
+    if (Array.isArray(responseJson)) return responseJson;
+    if (responseJson && Array.isArray(responseJson.items)) return responseJson.items;
+    if (responseJson && Array.isArray(responseJson.results)) return responseJson.results;
+    if (responseJson && Array.isArray(responseJson.data)) return responseJson.data;
+    return responseJson ? [responseJson] : [];
+  }
+
+  async function cacheRemoteImage(url) {
+    const remoteUrl = String(url || '').trim();
+    if (!remoteImageCacheDir || !/^https?:\/\//i.test(remoteUrl)) return '';
+    const hash = crypto.createHash('sha256').update(remoteUrl).digest('hex');
+    await fs.promises.mkdir(remoteImageCacheDir, { recursive: true });
+    const existing = (await fs.promises.readdir(remoteImageCacheDir)).find(function (name) { return name.startsWith(hash + '.'); });
+    if (existing) return '/media/player-cache/remote-images/' + existing;
+    try {
+      const response = await fetch(remoteUrl, { signal: AbortSignal.timeout(15000) });
+      if (!response.ok || !String(response.headers.get('content-type') || '').toLowerCase().startsWith('image/')) return '';
+      const bytes = Buffer.from(await response.arrayBuffer());
+      if (bytes.length > 10 * 1024 * 1024) return '';
+      const contentType = String(response.headers.get('content-type') || '').toLowerCase();
+      const extension = contentType.includes('svg') ? '.svg' : contentType.includes('png') ? '.png' : contentType.includes('webp') ? '.webp' : contentType.includes('gif') ? '.gif' : '.jpg';
+      const fileName = hash + extension;
+      const filePath = path.join(remoteImageCacheDir, fileName);
+      await fs.promises.writeFile(filePath, bytes);
+      return '/media/player-cache/remote-images/' + fileName;
+    } catch (_error) {
+      return '';
+    }
+  }
+
+  async function cachePlaceholderImages(slides, rssFeeds, apiSources) {
+    if (!remoteImageCacheDir) return;
+    const usedPaths = new Set();
+    const allSlideRows = await pool.query('SELECT content_json FROM c_slides').then(function (result) { return result[0] || []; });
+    const allContents = allSlideRows.map(function (row) { return common.parseJsonSafe(row.content_json) || {}; });
+    const sourceContent = allContents.concat((slides || []).map(function (slide) { return slide.content || {}; }));
+    const cacheSource = async function (source, item, expressions) {
+      if (!source || !item) return;
+      for (const expression of expressions) {
+        const remoteUrl = String(resolvePathValue(item, expression) || '').trim();
+        const localPath = await cacheRemoteImage(remoteUrl);
+        if (localPath) {
+          source.imageCache = source.imageCache || {};
+          source.imageCache[remoteUrl] = localPath;
+          usedPaths.add(localPath);
+        }
+      }
+    };
+    for (const content of sourceContent) {
+      for (const key of Object.keys(content || {})) {
+        const region = content[key];
+        if (!region || typeof region !== 'object') continue;
+        const expressions = getPlaceholderImageExpressions(region.value, []);
+        if (!expressions.length) continue;
+        const itemNumber = Math.max(1, Number(region.item_number || 1)) - 1;
+        if (String(region.type || '').toLowerCase() === 'api') {
+          const source = (apiSources || []).find(function (entry) { return Number(entry.id) === Number(region.source_id); });
+          const items = source ? getApiItems(source.responseJson, region.items_path) : [];
+          await cacheSource(source, items[itemNumber], expressions);
+        }
+        if (String(region.type || '').toLowerCase() === 'rss') {
+          const feed = (rssFeeds || []).find(function (entry) { return Number(entry.id) === Number(region.feed_id); });
+          await cacheSource(feed, feed && feed.items && feed.items[itemNumber], expressions);
+        }
+      }
+    }
+    const files = await fs.promises.readdir(remoteImageCacheDir).catch(function () { return []; });
+    await Promise.all(files.filter(function (file) { return !usedPaths.has('/media/player-cache/remote-images/' + file); }).map(function (file) {
+      return fs.promises.unlink(path.join(remoteImageCacheDir, file)).catch(function () {});
+    }));
+  }
+
   async function buildScreenPlaylist(slug) {
     try {
       const [screenRows] = await pool.query('SELECT id, name, slug, playlist_id, created_at, modified_at, created_by, modified_by FROM d_screens WHERE slug = ?', [slug]);
       if (!screenRows.length) {
-        return { screen: null, playlist: null, slides: [], rssFeeds: [], apiSources: [] };
+        return { screen: null, playlist: null, slides: [], rssFeeds: [], apiSources: [], timetableGroups: [], weatherLocations: [] };
       }
 
       const screen = screenRows[0];
@@ -69,7 +176,11 @@ function createPlayerPlaylistService(options) {
           screen: screen,
           playlist: null,
           slides: [],
-          revision: getPlaylistRevision(screen, null, [], [], [], [], [])
+          rssFeeds: [],
+          apiSources: [],
+          timetableGroups: [],
+          weatherLocations: [],
+          revision: getPlaylistRevision(screen, null, [], [], [], [], [], [])
         };
         await writeSnapshot(slug, payloadWithoutPlaylist);
         return payloadWithoutPlaylist;
@@ -79,7 +190,7 @@ function createPlayerPlaylistService(options) {
       const playlist = playlistRows[0] || null;
       const [slideRows] = await pool.query(`
         SELECT sl.id, sl.title, sl.template_id, sl.content_json, sl.created_at, sl.modified_at,
-           ps.position, ps.duration_seconds AS duration_seconds, ps.use_video_duration, ps.schedule_mode, ps.schedule_start_datetime, ps.schedule_end_datetime, ps.schedule_start_time, ps.schedule_end_time, ps.schedule_days_json,
+           ps.position, ps.duration_seconds AS duration_seconds, ps.use_video_duration, ps.disable_audio,
                st.name AS template_name, cs.name AS canvas_size_name, cs.width AS canvas_size_width, cs.height AS canvas_size_height, cs.width AS canvas_width, cs.height AS canvas_height
         FROM c_playlist_slides ps
         JOIN c_slides sl ON sl.id = ps.slide_id
@@ -88,6 +199,21 @@ function createPlayerPlaylistService(options) {
         WHERE ps.playlist_id = ?
         ORDER BY ps.position ASC, ps.id ASC
       `, [screen.playlist_id]);
+      const [scheduleRuleRows] = await pool.query(`
+        SELECT r.id, r.playlist_slide_id, r.position, r.start_datetime, r.end_datetime, r.start_time, r.end_time, r.schedule_days_json, r.created_at, r.modified_at, r.created_by, r.modified_by
+        FROM c_playlist_slide_schedule_rules r
+        JOIN c_playlist_slides ps ON ps.id = r.playlist_slide_id
+        WHERE ps.playlist_id = ?
+        ORDER BY r.playlist_slide_id ASC, r.position ASC, r.id ASC
+      `, [screen.playlist_id]);
+      const rulesBySlideId = {};
+      scheduleRuleRows.forEach(function (rule) {
+        const slideId = Number(rule.playlist_slide_id);
+        if (!rulesBySlideId[slideId]) {
+          rulesBySlideId[slideId] = [];
+        }
+        rulesBySlideId[slideId].push(rule);
+      });
 
       const templateIds = slideRows
         .filter(function (slide) { return slide.template_id; })
@@ -97,13 +223,13 @@ function createPlayerPlaylistService(options) {
       let regionRows = [];
       if (templateIds.length) {
         [templateRows] = await pool.query(`
-                SELECT st.id, st.name, st.canvas_size_id, st.background_image_path, st.background_color, st.created_at, st.modified_at,
+                SELECT st.id, st.name, st.canvas_size_id, st.background_image_path, st.background_color, st.background_gradient, st.created_at, st.modified_at,
                  cs.name AS canvas_size_name, cs.width AS canvas_size_width, cs.height AS canvas_size_height, cs.width AS canvas_width, cs.height AS canvas_height
           FROM c_templates st
           LEFT JOIN c_canvas_sizes cs ON cs.id = st.canvas_size_id
           WHERE st.id IN (?)
         `, [templateIds]);
-        [regionRows] = await pool.query('SELECT id, template_id, region_key, region_type, label, lock_ratio, x, y, width, height, z_index, created_at, modified_at, created_by, modified_by FROM c_template_regions WHERE template_id IN (?) ORDER BY template_id ASC, z_index ASC, id ASC', [templateIds]);
+        [regionRows] = await pool.query('SELECT id, template_id, region_key, region_type, label, lock_ratio, animation_json, x, y, width, height, z_index, created_at, modified_at, created_by, modified_by FROM c_template_regions WHERE template_id IN (?) ORDER BY template_id ASC, z_index ASC, id ASC', [templateIds]);
         templateRows.forEach(function (template) {
           template.regions = regionRows.filter(function (region) { return region.template_id === template.id; });
           templatesById[template.id] = template;
@@ -121,45 +247,73 @@ function createPlayerPlaylistService(options) {
             return null;
           }
 
-          const videoRegion = Object.keys(parsed).map(function (key) { return parsed[key]; }).find(function (region) {
+          const videoRegions = Object.keys(parsed).map(function (key) { return parsed[key]; }).filter(function (region) {
             return region && typeof region === 'object' && String(region.type || '').trim().toLowerCase() === 'video' && Number(region.duration_seconds || 0) > 0;
           });
 
-          const duration = Math.round(Number(videoRegion && videoRegion.duration_seconds || 0) * 1000) / 1000;
+          const duration = videoRegions.reduce(function (longest, region) {
+            const regionDuration = Math.round(Number(region.duration_seconds || 0) * 1000) / 1000;
+            return regionDuration > longest ? regionDuration : longest;
+          }, 0);
           return Number.isFinite(duration) && duration > 0 ? duration : null;
         } catch (_error) {
           return null;
         }
       }
 
-      const slides = slideRows.map(function (slide) {
+      const slides = await Promise.all(slideRows.map(async function (slide) {
         const storedDuration = Number(slide.duration_seconds || 0);
         const videoDuration = slide.use_video_duration ? getVideoRegionDurationSeconds(slide.content_json) : null;
+        const disableAudio = slide.disable_audio === undefined || slide.disable_audio === null ? true : Boolean(slide.disable_audio);
         const videoCacheBust = String(slide.modified_at || slide.content_json || slide.id || '');
         const content = common.parseJsonSafe(slide.content_json) || {};
+        const qrBackfillTasks = [];
         Object.keys(content).forEach(function (key) {
           const region = content[key];
+          if (region && typeof region === 'object') {
+            const regionType = String(region.type || '').trim().toLowerCase();
+            if (regionType === 'video' || regionType === 'rtmp') {
+              region.disable_audio = disableAudio;
+            }
+          }
           if (region && typeof region === 'object' && String(region.type || '').trim().toLowerCase() === 'video') {
             region.cache_bust = videoCacheBust;
           }
         });
+
+        Object.keys(content).forEach(function (key) {
+          const region = content[key];
+          if (!region || typeof region !== 'object' || String(region.type || '').trim().toLowerCase() !== 'qr-code') {
+            return;
+          }
+
+          if (region.qr_preview && /^data:image\//i.test(String(region.qr_preview || '').trim())) {
+            return;
+          }
+
+          qrBackfillTasks.push(createQrPreviewDataUrl(region.value).then(function (preview) {
+            if (preview) {
+              region.qr_preview = preview;
+            }
+            return null;
+          }).catch(function () {
+            return null;
+          }));
+        });
+        await Promise.all(qrBackfillTasks);
         return {
           id: slide.id,
           title: slide.title,
           modified_at: slide.modified_at,
           duration_seconds: videoDuration || storedDuration,
           use_video_duration: Boolean(slide.use_video_duration),
-          schedule_mode: slide.schedule_mode,
+          disable_audio: disableAudio,
-          schedule_start_datetime: slide.schedule_start_datetime,
+          scheduleRules: rulesBySlideId[Number(slide.id)] || [],
-          schedule_end_datetime: slide.schedule_end_datetime,
-          schedule_start_time: slide.schedule_start_time,
-          schedule_end_time: slide.schedule_end_time,
-          schedule_days_json: slide.schedule_days_json,
           template_id: slide.template_id,
           template: slide.template_id ? templatesById[slide.template_id] || null : null,
           content: content
         };
-      });
+      }));
 
       let rssFeeds = [];
       if (typeof common.fetchRssFeedsData === 'function' && typeof common.fetchRssFeedItemsByFeedId === 'function') {
@@ -184,8 +338,31 @@ function createPlayerPlaylistService(options) {
         });
       }
 
-      const revision = getPlaylistRevision(screen, playlist, slideRows, templateRows, regionRows, rssFeeds, apiSources);
+      let timetableGroups = [];
-      const payload = { screen: screen, playlist: playlist, slides: slides, rssFeeds: rssFeeds, apiSources: apiSources, revision: revision };
+      if (typeof common.fetchTimetablesData === 'function') {
+        const timetableData = await common.fetchTimetablesData(pool);
+        timetableGroups = Array.isArray(timetableData && timetableData.timetableGroups) ? timetableData.timetableGroups : [];
+      }
+
+      let weatherLocations = [];
+      if (typeof common.fetchWeatherLocationsData === 'function') {
+        const weatherData = await common.fetchWeatherLocationsData(pool);
+        weatherLocations = (weatherData.weatherLocations || []).map(function (location) {
+          const responseJson = common.parseJsonSafe ? common.parseJsonSafe(location.last_response_json) : null;
+          return Object.assign({}, location, {
+            responseJson: convertWeatherSnapshot(responseJson, {
+              temperature: location.temperature_unit === 'fahrenheit' ? 'fahrenheit' : 'celsius',
+              wind: location.wind_unit === 'mph' ? 'mph' : location.wind_unit === 'ms' ? 'ms' : 'kmh',
+              precipitation: location.precipitation_unit === 'inch' ? 'inch' : 'mm'
+            })
+          });
+        });
+      }
+
+      await cachePlaceholderImages(slides, rssFeeds, apiSources);
+
+      const revision = getPlaylistRevision(screen, playlist, slideRows, scheduleRuleRows, templateRows, regionRows, rssFeeds, apiSources, timetableGroups, weatherLocations);
+      const payload = { screen: screen, playlist: playlist, slides: slides, rssFeeds: rssFeeds, apiSources: apiSources, timetableGroups: timetableGroups, weatherLocations: weatherLocations, revision: revision };
       await writeSnapshot(slug, payload);
       return payload;
     } catch (error) {
@@ -202,7 +379,7 @@ function createPlayerPlaylistService(options) {
     hash.update('\0');
   }
 
-  function getPlaylistRevision(screen, playlist, slideRows, templateRows, regionRows, rssFeeds, apiSources) {
+  function getPlaylistRevision(screen, playlist, slideRows, scheduleRuleRows, templateRows, regionRows, rssFeeds, apiSources, timetableGroups, weatherLocations) {
     const hash = crypto.createHash('sha1');
 
     updatePlaylistRevisionHash(hash, screen && screen.id);
@@ -223,12 +400,18 @@ function createPlayerPlaylistService(options) {
       updatePlaylistRevisionHash(hash, slide.position);
       updatePlaylistRevisionHash(hash, slide.duration_seconds);
       updatePlaylistRevisionHash(hash, slide.use_video_duration);
-      updatePlaylistRevisionHash(hash, slide.schedule_mode);
+      updatePlaylistRevisionHash(hash, slide.disable_audio);
-      updatePlaylistRevisionHash(hash, slide.schedule_start_datetime);
+    });
-      updatePlaylistRevisionHash(hash, slide.schedule_end_datetime);
+
-      updatePlaylistRevisionHash(hash, slide.schedule_start_time);
+    (Array.isArray(scheduleRuleRows) ? scheduleRuleRows : []).forEach(function (rule) {
-      updatePlaylistRevisionHash(hash, slide.schedule_end_time);
+      updatePlaylistRevisionHash(hash, rule.id);
-      updatePlaylistRevisionHash(hash, slide.schedule_days_json);
+      updatePlaylistRevisionHash(hash, rule.playlist_slide_id);
+      updatePlaylistRevisionHash(hash, rule.position);
+      updatePlaylistRevisionHash(hash, rule.start_datetime);
+      updatePlaylistRevisionHash(hash, rule.end_datetime);
+      updatePlaylistRevisionHash(hash, rule.start_time);
+      updatePlaylistRevisionHash(hash, rule.end_time);
+      updatePlaylistRevisionHash(hash, rule.schedule_days_json);
     });
 
     (Array.isArray(templateRows) ? templateRows : []).forEach(function (template) {
@@ -239,6 +422,8 @@ function createPlayerPlaylistService(options) {
       updatePlaylistRevisionHash(hash, template.canvas_size_height);
       updatePlaylistRevisionHash(hash, template.background_image_path);
       updatePlaylistRevisionHash(hash, template.background_color);
+      updatePlaylistRevisionHash(hash, template.background_gradient);
+      updatePlaylistRevisionHash(hash, template.background_gradient);
       updatePlaylistRevisionHash(hash, template.modified_at);
     });
 
@@ -259,6 +444,8 @@ function createPlayerPlaylistService(options) {
 
     updatePlaylistRevisionHash(hash, JSON.stringify(rssFeeds || []));
     updatePlaylistRevisionHash(hash, JSON.stringify(apiSources || []));
+    updatePlaylistRevisionHash(hash, JSON.stringify(timetableGroups || []));
+    updatePlaylistRevisionHash(hash, JSON.stringify(weatherLocations || []));
 
     return hash.digest('hex');
   }

src/player/public/css/player.css

@@ -4,16 +4,16 @@ body {
   width: 100%;
   height: 100%;
   overflow: hidden;
-  background: #111;
+  background: #0a0a0a;
   color: #fff;
   font-family: Arial, sans-serif;
 }
 
 body.onboarding-page {
   background:
-    radial-gradient(circle at top, rgba(82, 144, 255, 0.28), transparent 32%),
+    radial-gradient(circle at 78% 20%, rgba(55, 195, 178, 0.16), transparent 28%),
-    radial-gradient(circle at bottom right, rgba(34, 197, 94, 0.18), transparent 26%),
+    radial-gradient(circle at 12% 90%, rgba(237, 177, 89, 0.12), transparent 30%),
-    linear-gradient(160deg, #09111f 0%, #0b1323 52%, #111827 100%);
+    linear-gradient(145deg, #07131b 0%, #0b2028 58%, #10252a 100%);
   overflow-x: hidden;
   overflow-y: auto;
 }
@@ -22,25 +22,69 @@ body.onboarding-page #app {
   display: none;
 }
 
+body.thumbnail-preview *,
+body.thumbnail-preview *::before,
+body.thumbnail-preview *::after {
+  animation: none !important;
+  animation-delay: 0s !important;
+  animation-duration: 0s !important;
+  animation-iteration-count: 1 !important;
+  transition: none !important;
+}
+
+body.thumbnail-preview .player-announcement-layer,
+body.thumbnail-preview .player-offline-banner {
+  display: none !important;
+}
+
 #app {
   width: 100%;
   height: 100%;
   display: flex;
   align-items: center;
   justify-content: center;
-  background: #111;
+  background: #0a0a0a;
   position: relative;
 }
 
 .onboarding-shell {
-  min-height: 100vh;
+  min-height: 100%;
   display: flex;
   align-items: center;
   justify-content: center;
-  padding: clamp(16px, 3vw, 40px);
+  padding: clamp(24px, 5vw, 72px);
   box-sizing: border-box;
 }
 
+.onboarding-stage {
+  width: min(100%, 1160px);
+}
+
+.onboarding-header {
+  display: flex;
+  align-items: center;
+  gap: 14px;
+  margin-bottom: 10px;
+}
+
+.onboarding-brand-mark {
+  width: 42px;
+  height: 42px;
+  display: grid;
+  place-items: center;
+  border-radius: 13px;
+  background: #f0bd70;
+  color: #10252a;
+  font-size: 1.45rem;
+  font-weight: 800;
+}
+
+.onboarding-label {
+  margin: 3px 0 0;
+  color: #8faeb0;
+  font-size: 0.88rem;
+}
+
 .onboarding-card {
   width: min(100%, 1040px);
   padding: clamp(20px, 3vw, 40px);
@@ -58,14 +102,35 @@ body.onboarding-page #app {
   line-height: 1.05;
 }
 
+.onboarding-stage h1 {
+  max-width: 560px;
+  font-size: clamp(2.5rem, 5vw, 5rem);
+  letter-spacing: 0;
+}
+
+.onboarding-stage--landing h1 {
+  max-width: 500px;
+  font-size: clamp(2.1rem, 3.6vw, 3.4rem);
+  line-height: 1.08;
+}
+
 .onboarding-kicker {
   margin: 0 0 12px;
   text-transform: uppercase;
   letter-spacing: 0.14em;
-  color: #8ab4ff;
+  color: #f0bd70;
   font-size: 0.82rem;
 }
 
+.onboarding-step {
+  margin: 0 0 18px;
+  color: #70d0c2;
+  font-size: 0.9rem;
+  font-weight: 700;
+  letter-spacing: 0.08em;
+  text-transform: uppercase;
+}
+
 .onboarding-copy {
   margin: 0 0 28px;
   color: #cbd5e1;
@@ -75,32 +140,121 @@ body.onboarding-page #app {
 
 .onboarding-layout {
   display: grid;
-  grid-template-columns: minmax(280px, 1fr) minmax(320px, 1fr);
+  grid-template-columns: minmax(320px, 0.9fr) minmax(320px, 1.1fr);
   gap: clamp(20px, 3vw, 32px);
   align-items: stretch;
 }
 
+.onboarding-copy-panel {
+  display: flex;
+  grid-column: 1;
+  grid-row: 1;
+  flex-direction: column;
+  justify-content: center;
+}
+
+.onboarding-instructions {
+  display: grid;
+  gap: 14px;
+  max-width: 440px;
+  margin: 18px 0 0;
+  padding: 0;
+  list-style: none;
+  counter-reset: setup-step;
+}
+
+.onboarding-instructions li {
+  display: grid;
+  grid-template-columns: 24px 1fr;
+  gap: 10px;
+  color: #b7cccd;
+  font-size: 0.96rem;
+  line-height: 1.35;
+  counter-increment: setup-step;
+}
+
+.onboarding-instructions li::before {
+  content: counter(setup-step);
+  width: 22px;
+  height: 22px;
+  display: grid;
+  place-items: center;
+  border: 1px solid rgba(112, 208, 194, 0.55);
+  border-radius: 50%;
+  color: #70d0c2;
+  font-size: 0.75rem;
+  font-weight: 700;
+}
+
+.onboarding-pin-block {
+  margin-top: 28px;
+}
+
+.onboarding-pin-label {
+  display: block;
+  margin-bottom: 10px;
+  color: #8faeb0;
+  font-size: 0.92rem;
+}
+
+.onboarding-pin-label strong { color: #f0bd70; }
+
+.onboarding-pin {
+  display: block;
+  color: #f4f8f5;
+  font-size: clamp(1.7rem, 3vw, 2.8rem);
+  font-weight: 800;
+  letter-spacing: 0.18em;
+  line-height: 1;
+}
+
 .onboarding-qr-pane {
   display: grid;
-  gap: 16px;
+  width: min(100%, 420px);
+  grid-column: 2;
+  grid-row: 1;
+  gap: 0;
   align-content: start;
+  justify-self: center;
 }
 
 .onboarding-qr-frame {
   display: flex;
+  width: min(100%, 420px);
+  aspect-ratio: 1;
+  box-sizing: border-box;
   justify-content: center;
-  padding: 22px;
+  align-items: center;
-  border-radius: 26px;
+  justify-self: center;
-  background: rgba(255, 255, 255, 0.04);
+  padding: 14px;
-  border: 1px solid rgba(255, 255, 255, 0.08);
+  border-radius: 22px;
+  background: rgba(7, 19, 27, 0.7);
+  border: 1px solid rgba(244, 248, 245, 0.42);
+  box-shadow: 0 24px 64px rgba(0, 0, 0, 0.22);
 }
 
 .onboarding-qr-frame img {
-  width: min(100%, 320px);
+  width: min(100%, 390px);
   aspect-ratio: 1;
   display: block;
-  background: #fff;
+  background: transparent;
-  border-radius: 18px;
+  border-radius: 16px;
+  padding: 12px;
+  box-sizing: border-box;
+}
+
+.onboarding-qr-caption {
+  margin: 6px 0 0;
+  color: #8faeb0;
+  font-size: 0.92rem;
+  text-align: center;
+}
+
+.onboarding-brand-title {
+  margin-bottom: 10px;
+  font-size: 1.2rem;
+  font-weight: 700;
+  letter-spacing: 0.1em;
 }
 
 .onboarding-form {
@@ -164,14 +318,14 @@ body.onboarding-page #app {
 }
 
 .onboarding-status {
-  margin-top: 8px;
+  margin-top: clamp(32px, 6vh, 56px);
   min-height: 1.4em;
-  color: #cbd5e1;
+  color: #8faeb0;
   font-size: 0.96rem;
 }
 
 .onboarding-card--landing .onboarding-status {
-  text-align: center;
+  text-align: left;
 }
 
 @media (max-width: 860px), (orientation: portrait) {
@@ -183,12 +337,45 @@ body.onboarding-page #app {
     grid-template-columns: 1fr;
   }
 
+  .onboarding-copy-panel,
+  .onboarding-qr-pane {
+    grid-column: 1;
+  }
+
+  .onboarding-copy-panel {
+    grid-row: 1;
+  }
+
+  .onboarding-qr-pane {
+    grid-row: 2;
+  }
+
   .onboarding-card {
     width: 100%;
   }
 
   .onboarding-qr-frame img {
-    width: min(100%, 280px);
+    width: min(100%, 390px);
+  }
+
+  .onboarding-qr-frame {
+    width: min(100%, 420px);
+  }
+
+  .onboarding-qr-pane {
+    width: min(100%, 420px);
+  }
+
+  .onboarding-stage--landing h1 {
+    font-size: clamp(2rem, 7vw, 3rem);
+  }
+
+  .onboarding-header {
+    margin-bottom: 38px;
+  }
+
+  .onboarding-pin {
+    font-size: clamp(1.7rem, 9vw, 2.8rem);
   }
 }
 
@@ -199,6 +386,8 @@ body.onboarding-page #app {
   height: 100%;
   opacity: 0;
   transition: opacity 560ms ease;
+  will-change: opacity;
+  backface-visibility: hidden;
 }
 
 .slide-shell.is-visible {
@@ -220,6 +409,29 @@ body.screen-blackout #app {
   opacity: 0;
 }
 
+.player-keyboard-feedback {
+  position: fixed;
+  top: 1.5rem;
+  left: 50%;
+  z-index: 10000;
+  padding: 0.65rem 1rem;
+  border: 1px solid rgba(255, 255, 255, 0.32);
+  border-radius: 0.4rem;
+  background: rgba(15, 23, 42, 0.88);
+  color: #fff;
+  font-size: 0.95rem;
+  font-weight: 700;
+  opacity: 0;
+  pointer-events: none;
+  transform: translate(-50%, -0.5rem);
+  transition: opacity 120ms ease, transform 120ms ease;
+}
+
+.player-keyboard-feedback.is-visible {
+  opacity: 1;
+  transform: translate(-50%, 0);
+}
+
 .player-announcement-layer {
   position: fixed;
   left: 50%;
@@ -228,7 +440,8 @@ body.screen-blackout #app {
   height: var(--player-canvas-height, 100vh);
   max-width: 100vw;
   max-height: 100vh;
-  transform: translate(-50%, -50%);
+  transform: translate3d(-50%, -50%, 0);
+  backface-visibility: hidden;
   z-index: 9999;
   pointer-events: none;
   display: flex;
@@ -274,15 +487,6 @@ body.screen-blackout #app {
   display: block;
 }
 
-.slide img,
-.slide video,
-.slide iframe {
-  width: 100%;
-  height: 100%;
-  object-fit: contain;
-  border: 0;
-}
-
 .body {
   position: absolute;
   left: 5%;
@@ -375,18 +579,6 @@ body.screen-blackout #app {
   white-space: pre-wrap;
 }
 
-.template-region.text > *,
-.template-region.api > *,
-.template-region.rss > * {
-  margin: 0;
-}
-
-.template-region.text > * + *,
-.template-region.api > * + *,
-.template-region.rss > * + * {
-  margin-top: 0.5em;
-}
-
 .template-region.text ul,
 .template-region.text ol,
 .template-region.api ul,
@@ -425,6 +617,14 @@ body.screen-blackout #app {
   overflow: hidden;
 }
 
+.template-region.qr-code img {
+  width: 100%;
+  height: 100%;
+  object-fit: contain;
+  display: block;
+  background: #fff;
+}
+
 .template-region.html iframe {
   width: 100%;
   height: 100%;
@@ -463,29 +663,6 @@ body.screen-blackout #app {
   font-size: 0.9rem;
 }
 
-.template-region table,
-.template-region th,
-.template-region td {
-  border: 1px solid rgba(255, 255, 255, 0.35);
-  border-collapse: collapse;
-}
-
-.template-region table {
-  width: 100%;
-  border-spacing: 0;
-}
-
-.template-region th,
-.template-region td {
-  padding: 0.35em 0.5em;
-  text-align: left;
-  vertical-align: top;
-}
-
-.template-region th {
-  font-weight: 700;
-}
-
 .webpage-preloads {
   position: fixed;
   width: 1px;
@@ -503,3 +680,20 @@ body.screen-blackout #app {
   border: 0;
   display: block;
 }
+
+.template-region table {
+  width: 100%;
+  border-collapse: collapse;
+  border-spacing: 0;
+}
+
+.template-region th,
+.template-region td {
+  padding: 0.35em 0.5em;
+  text-align: left;
+  vertical-align: top;
+}
+
+.template-region th {
+  font-weight: 700;
+}

src/player/public/js/player-announcement-templates.js

@@ -22,7 +22,11 @@
 
   function normalizeAnnouncementColor(value) {
     var normalized = String(value || '').trim().toLowerCase();
-    if (['primary', 'secondary', 'success', 'info', 'warning', 'danger', 'dark', 'light'].indexOf(normalized) !== -1) {
+    if ([
+      'primary', 'secondary', 'success', 'info', 'warning', 'danger', 'dark', 'light',
+      'orange', 'amber', 'olive', 'teal', 'sky', 'indigo', 'violet', 'fuchsia', 'pink',
+      'navy', 'steel', 'slate', 'graphite', 'midnight'
+    ].indexOf(normalized) !== -1) {
       return normalized;
     }
     return 'primary';
@@ -42,7 +46,21 @@
       warning: { accent: '#ffc107', foreground: '#201400', glow: 'rgba(255, 193, 7, 0.30)' },
       danger: { accent: '#dc3545', foreground: '#ffffff', glow: 'rgba(220, 53, 69, 0.34)' },
       dark: { accent: '#212529', foreground: '#ffffff', glow: 'rgba(33, 37, 41, 0.34)' },
-      light: { accent: '#f8f9fa', foreground: '#1f2937', glow: 'rgba(248, 249, 250, 0.34)' }
+      light: { accent: '#f8f9fa', foreground: '#1f2937', glow: 'rgba(248, 249, 250, 0.34)' },
+      orange: { accent: '#c84e10', foreground: '#ffffff', glow: 'rgba(200, 78, 16, 0.34)' },
+      amber: { accent: '#a56710', foreground: '#ffffff', glow: 'rgba(165, 103, 16, 0.34)' },
+      olive: { accent: '#5f7f0f', foreground: '#ffffff', glow: 'rgba(95, 127, 15, 0.34)' },
+      teal: { accent: '#12827d', foreground: '#ffffff', glow: 'rgba(18, 130, 125, 0.34)' },
+      sky: { accent: '#127caf', foreground: '#ffffff', glow: 'rgba(18, 124, 175, 0.34)' },
+      indigo: { accent: '#6f60ea', foreground: '#ffffff', glow: 'rgba(111, 96, 234, 0.34)' },
+      violet: { accent: '#9553db', foreground: '#ffffff', glow: 'rgba(149, 83, 219, 0.34)' },
+      fuchsia: { accent: '#b347be', foreground: '#ffffff', glow: 'rgba(179, 71, 190, 0.34)' },
+      pink: { accent: '#cd388d', foreground: '#ffffff', glow: 'rgba(205, 56, 141, 0.34)' },
+      navy: { accent: '#1d2d4c', foreground: '#ffffff', glow: 'rgba(29, 45, 76, 0.34)' },
+      steel: { accent: '#3a4860', foreground: '#ffffff', glow: 'rgba(58, 72, 96, 0.34)' },
+      slate: { accent: '#566577', foreground: '#ffffff', glow: 'rgba(86, 101, 119, 0.34)' },
+      graphite: { accent: '#32363c', foreground: '#ffffff', glow: 'rgba(50, 54, 60, 0.34)' },
+      midnight: { accent: '#1e1d2d', foreground: '#ffffff', glow: 'rgba(30, 29, 45, 0.34)' }
     };
 
     return tokens[colorKey] || tokens.primary;
@@ -54,12 +72,68 @@
     });
   }
 
+  function getComputedGapWidth(track) {
+    if (!track || !window.getComputedStyle) {
+      return 0;
+    }
+
+    var computedStyle = window.getComputedStyle(track);
+    var gapValue = String(computedStyle.columnGap || computedStyle.gap || '0').trim();
+    var gap = Number.parseFloat(gapValue);
+    return Number.isFinite(gap) ? gap : 0;
+  }
+
+  function getElementWidth(element) {
+    if (!element || !element.getBoundingClientRect) {
+      return 0;
+    }
+
+    return Math.max(0, element.getBoundingClientRect().width || 0);
+  }
+
+  function initPlayerAnnouncementMarquee(track, options) {
+    if (!track || track.dataset.marqueeMeasured === 'true') {
+      return;
+    }
+
+    var settings = options || {};
+    var rate = Number(settings.rate || track.getAttribute('data-announcement-marquee-rate') || 44) || 44;
+    var textSelector = String(settings.textSelector || '.player-announcement__message-text').trim() || '.player-announcement__message-text';
+    var textNodes = Array.prototype.slice.call(track.querySelectorAll(textSelector));
+    if (!textNodes.length) {
+      return;
+    }
+
+    var container = settings.container || track.parentElement || track;
+    var containerWidth = Math.max(1, getElementWidth(container) || 0);
+    var gapWidth = getComputedGapWidth(track);
+    var firstItemWidth = Math.max(1, getElementWidth(textNodes[0]) || 0);
+    var cycleWidth = Math.max(1, firstItemWidth + gapWidth);
+    var minimumTrackWidth = Math.max(containerWidth + cycleWidth, cycleWidth * 2);
+    var cloneIndex = 0;
+
+    while (getElementWidth(track) < minimumTrackWidth && cloneIndex < 8) {
+      var clone = textNodes[cloneIndex % textNodes.length].cloneNode(true);
+      clone.setAttribute('aria-hidden', 'true');
+      track.appendChild(clone);
+      cloneIndex += 1;
+    }
+
+    var durationSeconds = Math.max(8, cycleWidth / rate);
+    var durationValue = durationSeconds.toFixed(2) + 's';
+
+    track.dataset.marqueeMeasured = 'true';
+    track.style.setProperty('--announcement-scroll-distance', cycleWidth.toFixed(2) + 'px');
+    track.style.setProperty('--announcement-scroll-duration', durationValue);
+    track.style.animationDuration = durationValue;
+  }
+
   function renderPlayerAnnouncementMarkup(announcement) {
     var normalizedType = normalizeAnnouncementType(announcement && announcement.announcement_type);
     var colorKey = normalizeAnnouncementColor(announcement && announcement.color_key);
     var colorTokens = getAnnouncementColorTokens(colorKey);
     var iconKey = normalizeAnnouncementIcon(announcement && announcement.icon_key);
-    var text = escapeHtml(String(announcement && announcement.message || '').trim()).replace(/\n/g, '<br />');
+    var text = escapeHtml(String(announcement && announcement.message || '').trim()).replace(/[\r\n]+/g, ' ');
     var titleText = escapeHtml(String(announcement && announcement.short_label || 'Announcement').trim() || 'Announcement');
     var templates = window.playerAnnouncementTemplates || {};
     var templateName = normalizedType === 'fullscreen' ? 'fullscreen' : normalizedType === 'top-banner' ? 'topBanner' : 'lowerThird';
@@ -77,4 +151,5 @@
   }
 
   window.renderPlayerAnnouncementMarkup = renderPlayerAnnouncementMarkup;
+  window.initPlayerAnnouncementMarquee = initPlayerAnnouncementMarquee;
 })();

src/player/public/js/player-page-commands.js

@@ -6,6 +6,8 @@ function getCurrentViewport() {
   };
 }
 
+var slideOutroTimers = [];
+
 // Command websocket and player-state helpers.
 // Send the current playback state to the command websocket.
 function sendCommandState(currentSlide) {
@@ -65,6 +67,56 @@ function clearSlideTimer() {
     window.clearTimeout(timer);
     timer = null;
   }
+  clearSlideOutroTimer();
+}
+
+// Cancel any pending outro triggers for the current slide.
+function clearSlideOutroTimer() {
+  if (!Array.isArray(slideOutroTimers) || !slideOutroTimers.length) {
+    slideOutroTimers = [];
+    return;
+  }
+
+  slideOutroTimers.forEach(function (timerId) {
+    window.clearTimeout(timerId);
+  });
+  slideOutroTimers = [];
+}
+
+// Return the rendered slide root that is currently on screen.
+function getCurrentSlideRoot() {
+  var shells = Array.prototype.slice.call(app ? app.querySelectorAll('.slide-shell') : []);
+  if (shells.length) {
+    return shells[shells.length - 1];
+  }
+  return app && app.firstElementChild ? app.firstElementChild : app;
+}
+
+// Schedule the outgoing slide animation for each region so it finishes before removal.
+function scheduleSlideOutro(holdDelayMs) {
+  clearSlideOutroTimer();
+
+  var currentRoot = getCurrentSlideRoot();
+  if (!currentRoot || typeof getRegionAnimationPhaseTimings !== 'function' || typeof playRegionAnimation !== 'function') {
+    return;
+  }
+
+  var regionTimings = getRegionAnimationPhaseTimings(currentRoot, 'outro');
+  if (!regionTimings.length) {
+    return;
+  }
+
+  var slideDurationMs = Math.max(1, Math.round(Number(holdDelayMs || 0)));
+  slideOutroTimers = regionTimings.map(function (entry) {
+    var timingMs = Math.max(0, Math.round(Number(entry && entry.timingMs || 0)));
+    var triggerDelayMs = Math.max(0, slideDurationMs - timingMs);
+    return window.setTimeout(function () {
+      if (!entry || !entry.element || !entry.element.isConnected) {
+        return;
+      }
+      playRegionAnimation(entry.element, 'outro');
+    }, triggerDelayMs);
+  });
 }
 
 // Schedule the next slide transition.
@@ -72,13 +124,16 @@ function scheduleSlideAdvance(delayMs) {
   clearSlideTimer();
   var holdDelayMs = Math.max(1, Number(delayMs || 0));
   slideExpiresAt = Date.now() + holdDelayMs;
+  scheduleSlideOutro(holdDelayMs);
   timer = window.setTimeout(function () {
     timer = null;
     slideExpiresAt = null;
     pausedRemainingMs = null;
+    clearSlideOutroTimer();
+    applyPendingPlaylistUpdate();
     const activeSlides = getCurrentActiveSlides();
     if (activeSlides.length < 2) {
-      refresh();
+      showCurrent();
       return;
     }
     if (index >= activeSlides.length) {
@@ -89,13 +144,10 @@ function scheduleSlideAdvance(delayMs) {
   }, holdDelayMs);
 }
 
-// Account for fade only when it is enabled so the transition is centered on the slide boundary.
+// Return the slide duration without shifting it for fade timing.
 function getSlideHoldDelay(delayMs) {
   var holdDelayMs = Math.max(1, Number(delayMs || 0));
-  if (!currentPlaylistFadeBetweenSlides) {
   return holdDelayMs;
-  }
-  return Math.max(1, holdDelayMs - (slideFadeDurationMs / 2));
 }
 
 // Cancel any pending fade-transition cleanup.
@@ -114,11 +166,19 @@ function getPlayerRegionModules() {
   return window.pulsePlayerRegionTypes.list();
 }
 
+function isThumbnailPreview() {
+  return Boolean(window.__pulseThumbnailPreview);
+}
+
 function runRegionLifecycle(root, lifecycleName) {
   if (!root) {
     return;
   }
 
+  if (isThumbnailPreview() && lifecycleName === 'initRegion') {
+    return;
+  }
+
   getPlayerRegionModules().forEach(function (entry) {
     var module = entry && entry.definition ? entry.definition : null;
     if (!module || typeof module[lifecycleName] !== 'function') {
@@ -165,7 +225,7 @@ function renderSlideMarkup(markup, shouldFade) {
 
       video.autoplay = true;
       video.loop = true;
-      video.muted = true;
+  video.muted = !(video.dataset && video.dataset.disableAudio === '0');
       video.playsInline = true;
 
       function startPlayback() {
@@ -203,13 +263,33 @@ function renderSlideMarkup(markup, shouldFade) {
     });
   }
 
+  function schedulePostRenderSetup(root, delayMs) {
+    if (!root) {
+      return;
+    }
+
+    if (root.isConnected === false) {
+      return;
+    }
+
+    if (typeof syncRtmpRegions === 'function') {
+      syncRtmpRegions(root);
+    }
+
+    if (!isThumbnailPreview()) {
+      initializeRegionInstances(root);
+    }
+
+    initializeRenderedVideoPlayback(root, delayMs);
+
+    if (typeof playRegionAnimations === 'function') {
+      playRegionAnimations(root, 'intro');
+    }
+  }
+
   if (!shouldFade) {
     app.innerHTML = markup;
-    if (typeof syncRtmpRegions === 'function') {
+    schedulePostRenderSetup(app, 0);
-      syncRtmpRegions(app);
-    }
-    initializeRegionInstances(app);
-    initializeRenderedVideoPlayback(app);
     return app.firstElementChild;
   }
 
@@ -258,11 +338,7 @@ function renderSlideMarkup(markup, shouldFade) {
     app.innerHTML = '';
     nextShell.style.opacity = '1';
     app.appendChild(nextShell);
-    if (typeof syncRtmpRegions === 'function') {
+    schedulePostRenderSetup(nextShell, slideFadeDurationMs / 2);
-      syncRtmpRegions(nextShell);
-    }
-    initializeRegionInstances(nextShell);
-    initializeRenderedVideoPlayback(nextShell, slideFadeDurationMs / 2);
     return nextShell;
   }
 
@@ -273,20 +349,12 @@ function renderSlideMarkup(markup, shouldFade) {
   pauseRenderedVideoPlayback(previousShell, slideFadeDurationMs / 2);
 
   app.appendChild(nextShell);
-  void nextShell.offsetHeight;
   window.requestAnimationFrame(function () {
     nextShell.style.opacity = '1';
     previousShell.style.opacity = '0';
+    schedulePostRenderSetup(nextShell, slideFadeDurationMs / 2);
   });
 
-  if (typeof syncRtmpRegions === 'function') {
-    syncRtmpRegions(nextShell);
-  }
-
-  initializeRegionInstances(nextShell);
-
-  initializeRenderedVideoPlayback(nextShell, slideFadeDurationMs / 2);
-
   slideTransitionTimer = window.setTimeout(function () {
     if (previousShell && previousShell.parentNode) {
       previousShell.parentNode.removeChild(previousShell);
@@ -359,6 +427,86 @@ function normalizeBoolean(value) {
   return null;
 }
 
+function isEditableTarget(target) {
+  if (!target) {
+    return false;
+  }
+
+  if (target.isContentEditable) {
+    return true;
+  }
+
+  var tagName = String(target.tagName || '').toUpperCase();
+  return ['INPUT', 'TEXTAREA', 'SELECT', 'OPTION'].indexOf(tagName) !== -1;
+}
+
+var keyboardFeedbackTimer = null;
+
+function showKeyboardFeedback(message) {
+  if (typeof document === 'undefined' || !document.body) {
+    return;
+  }
+
+  var feedback = document.querySelector('.player-keyboard-feedback');
+  if (!feedback) {
+    feedback = document.createElement('div');
+    feedback.className = 'player-keyboard-feedback';
+    feedback.setAttribute('aria-live', 'polite');
+    document.body.appendChild(feedback);
+  }
+
+  feedback.textContent = String(message || '');
+  feedback.classList.remove('is-visible');
+  void feedback.offsetWidth;
+  feedback.classList.add('is-visible');
+  if (keyboardFeedbackTimer) {
+    window.clearTimeout(keyboardFeedbackTimer);
+  }
+  keyboardFeedbackTimer = window.setTimeout(function () {
+    feedback.classList.remove('is-visible');
+    keyboardFeedbackTimer = null;
+  }, 900);
+}
+
+function handlePlayerKeydown(event) {
+  if (!event || event.defaultPrevented || event.altKey || event.ctrlKey || event.metaKey) {
+    return;
+  }
+
+  if (isEditableTarget(event.target)) {
+    return;
+  }
+
+  if (event.key === 'ArrowLeft') {
+    event.preventDefault();
+    navigateSlides(-1);
+    showKeyboardFeedback('Previous slide');
+    return;
+  }
+
+  if (event.key === 'ArrowRight') {
+    event.preventDefault();
+    navigateSlides(1);
+    showKeyboardFeedback('Next slide');
+    return;
+  }
+
+  if (String(event.key || '').toLowerCase() === 'p') {
+    event.preventDefault();
+    setPaused(!isPaused);
+    showKeyboardFeedback(isPaused ? 'Paused' : 'Playing');
+    return;
+  }
+
+  if (String(event.key || '').toLowerCase() === 'b') {
+    event.preventDefault();
+    setBlackout(!isBlackout);
+    showKeyboardFeedback(isBlackout ? 'Blackout on' : 'Blackout off');
+  }
+}
+
+window.addEventListener('keydown', handlePlayerKeydown);
+
 // Move to the previous or next active slide.
 function navigateSlides(offset) {
   const manualSlides = getCurrentActiveSlides();
@@ -385,6 +533,10 @@ function handleCommandMessage(rawMessage) {
   } catch (_error) {
     return;
   }
+  if (payload && payload.type === 'client-id-conflict') {
+    handleClientIdConflict();
+    return;
+  }
 
   if (!payload || payload.type !== 'command') {
     return;
@@ -401,7 +553,17 @@ function handleCommandMessage(rawMessage) {
       return;
     case 'redirect':
       if (payload.url) {
-        window.location.replace(String(payload.url));
+        var redirectUrl = String(payload.url);
+        var authorizeMove = payload.moveToken
+          ? fetch('/api/screen-move-authorize', {
+              method: 'POST',
+              headers: { 'Content-Type': 'application/json', 'Accept': 'application/json' },
+              body: JSON.stringify({ moveToken: String(payload.moveToken) })
+            })
+          : Promise.resolve();
+        authorizeMove.finally(function () {
+          window.location.replace(redirectUrl);
+        });
       }
       return;
     case 'pause':
@@ -437,6 +599,13 @@ function handleCommandMessage(rawMessage) {
   }
 }
 
+function handleClientIdConflict() {
+  var replacementClientId = regenerateCommandClientId();
+  var onboardingUrl = new URL('/', window.location.origin);
+  onboardingUrl.searchParams.set('clientId', replacementClientId);
+  window.location.replace(onboardingUrl.toString());
+}
+
 // Retry the command websocket after a disconnect.
 function scheduleCommandReconnect() {
   if (commandReconnectTimer) {
@@ -456,12 +625,7 @@ function connectCommandSocket() {
   if (commandSocket && (commandSocket.readyState === WebSocket.OPEN || commandSocket.readyState === WebSocket.CONNECTING)) {
     return;
   }
-  var protocol = window.location.protocol === 'https:' ? 'wss:' : 'ws:';
+  var socket = new WebSocket(new URL(commandSocketPath, window.location.origin).toString());
-  var socketUrl = new URL(commandSocketPath, window.location.origin);
-  if (window.__pulsePageAuthToken) {
-    socketUrl.searchParams.set('auth', window.__pulsePageAuthToken);
-  }
-  var socket = new WebSocket(socketUrl.toString());
   commandSocket = socket;
 
   socket.onopen = function () {
@@ -478,8 +642,12 @@ function connectCommandSocket() {
     handleCommandMessage(event.data);
   };
 
-  socket.onclose = function () {
+  socket.onclose = function (event) {
     commandSocket = null;
+    if (event && event.code === 4009) {
+      handleClientIdConflict();
+      return;
+    }
     scheduleCommandReconnect();
   };
 

src/player/public/js/player-page-playback.js

@@ -54,6 +54,9 @@ async function renderSlideAtIndex(sourceSlides, targetIndex) {
   index = currentIndex;
   var markup = buildSlideMarkup(slide);
   renderSlideMarkup(markup, currentPlaylistFadeBetweenSlides);
+  if (typeof scheduleSlideMarkupPreload === 'function') {
+    scheduleSlideMarkupPreload(availableSlides, currentIndex);
+  }
   sendCommandState(slide);
   if (!isPaused) {
     scheduleSlideAdvance(getSlideHoldDelay(Math.max(1, Number(slide.duration_seconds || 10)) * 1000));
@@ -67,6 +70,7 @@ function applyPendingPlaylistUpdate() {
   if (!pendingPlaylistUpdate) {
     return false;
   }
+  var nextIndex = Number(index || 0);
   slides = pendingPlaylistUpdate.slides;
   currentPlaylistSignature = pendingPlaylistUpdate.signature;
   currentPlaylistFadeBetweenSlides = pendingPlaylistUpdate.fadeBetweenSlides;
@@ -77,7 +81,11 @@ function applyPendingPlaylistUpdate() {
   templateLayoutCache = Object.create(null);
   templateRenderPlanCache = Object.create(null);
   renderCacheViewportKey = window.innerWidth + 'x' + window.innerHeight;
-  index = 0;
+  const activeSlides = getCurrentActiveSlides();
+  if (!Number.isFinite(nextIndex) || nextIndex < 0) {
+    nextIndex = 0;
+  }
+  index = activeSlides.length ? Math.min(nextIndex, activeSlides.length - 1) : 0;
   logDebug('Applied updated playlist on slide transition.');
   return true;
 }
@@ -85,12 +93,14 @@ function applyPendingPlaylistUpdate() {
 // Render the current active slide or the empty state.
 function showCurrent() {
   clearSlideTimer();
-  applyPendingPlaylistUpdate();
   const activeSlides = getCurrentActiveSlides();
   syncWebpagePreloads(activeSlides, index);
   if (typeof syncRtmpWarmups === 'function') {
     syncRtmpWarmups(activeSlides, index);
   }
+  if (typeof scheduleSlideMarkupPreload === 'function') {
+    scheduleSlideMarkupPreload(activeSlides, index);
+  }
   if (!activeSlides.length) {
     renderEmpty(slides.length ? 'No slides are scheduled for this time.' : 'No slides assigned to this screen yet.');
     lastRenderedViewKey = getCurrentRenderKey(activeSlides);
@@ -100,6 +110,16 @@ function showCurrent() {
   lastRenderedViewKey = getCurrentRenderKey(activeSlides);
 }
 
+function isSlideInList(slide, slideList) {
+  if (!slide || !Array.isArray(slideList)) {
+    return false;
+  }
+
+  return slideList.some(function (item) {
+    return item && Number(item.id) === Number(slide.id);
+  });
+}
+
 // Skip the current slide when an RTMP feed is unavailable and the playlist asks for it.
 function handleRtmpPlaybackFailure(message, options) {
   if (!currentPlaylistSkipUnavailableRtmp) {
@@ -136,6 +156,9 @@ function refresh() {
   if (window.__pulsePageAuthToken) {
     request.setRequestHeader('x-pulse-page-auth', window.__pulsePageAuthToken);
   }
+  if (typeof getCommandClientId === 'function') {
+    request.setRequestHeader('x-pulse-client-id', getCommandClientId());
+  }
   if (currentPlaylistEtag) {
     request.setRequestHeader('If-None-Match', currentPlaylistEtag);
   }
@@ -152,6 +175,10 @@ function refresh() {
       return;
     }
     if (request.status < 200 || request.status >= 300) {
+      if (request.status === 401 || request.status === 403) {
+        window.location.replace('/');
+        return;
+      }
       setOfflineBannerVisible(true);
       scheduleRefreshRetry();
       logDebug(
@@ -166,8 +193,24 @@ function refresh() {
       const data = JSON.parse(request.responseText || '{}');
       const nextSignature = getPlaylistRevision(data);
       const nextSlides = Array.isArray(data.slides) ? data.slides.map(normalizeSlide) : [];
+      const nextActiveSlides = getActiveSlidesFrom(nextSlides);
       const nextFadeBetweenSlides = Boolean(data && data.playlist && data.playlist.fade_between_slides);
       const nextSkipUnavailableRtmp = Boolean(data && data.playlist && data.playlist.skip_unavailable_rtmp);
+      var refreshedInitialData = Object.assign({},
+        typeof initialData !== 'undefined' && initialData ? initialData : (window.initialData || {}), {
+        screen: data.screen || null,
+        playlist: data.playlist || null,
+        slides: nextSlides,
+        rssFeeds: Array.isArray(data.rssFeeds) ? data.rssFeeds : [],
+        apiSources: Array.isArray(data.apiSources) ? data.apiSources : [],
+        timetableGroups: Array.isArray(data.timetableGroups) ? data.timetableGroups : [],
+        weatherLocations: Array.isArray(data.weatherLocations) ? data.weatherLocations : [],
+        revision: nextSignature
+      });
+      if (typeof initialData !== 'undefined') {
+        initialData = refreshedInitialData;
+      }
+      window.initialData = refreshedInitialData;
       savePlaylistSnapshot({
         slides: nextSlides,
         signature: nextSignature,
@@ -197,19 +240,26 @@ function refresh() {
         }
         return;
       }
-      syncWebpagePreloads(getActiveSlidesFrom(nextSlides), index);
+      syncWebpagePreloads(nextActiveSlides, index);
       if (typeof syncRtmpWarmups === 'function') {
-        syncRtmpWarmups(getActiveSlidesFrom(nextSlides), index);
+        syncRtmpWarmups(nextActiveSlides, index);
       }
-      if (currentActiveSlides.length < 2) {
+      if (typeof scheduleSlideMarkupPreload === 'function') {
-        slides = nextSlides;
+        scheduleSlideMarkupPreload(nextActiveSlides, index);
-        currentPlaylistSignature = nextSignature;
+      }
-        currentPlaylistFadeBetweenSlides = nextFadeBetweenSlides;
+      if (nextActiveSlides.length < 2) {
-        currentPlaylistSkipUnavailableRtmp = nextSkipUnavailableRtmp;
+        pendingPlaylistUpdate = {
-        pendingPlaylistUpdate = null;
+          slides: nextSlides,
-        index = 0;
+          signature: nextSignature,
+          fadeBetweenSlides: nextFadeBetweenSlides,
+          skipUnavailableRtmp: nextSkipUnavailableRtmp
+        };
+        if (!isSlideInList(lastRenderedSlide, nextSlides)) {
+          applyPendingPlaylistUpdate();
           showCurrent();
-        sendCommandState(lastRenderedSlide);
+          return;
+        }
+        logDebug('Playlist update detected; applying on next slide transition.');
         return;
       }
       pendingPlaylistUpdate = {

src/player/public/js/player-page-playlist.js

@@ -84,7 +84,7 @@ function getCurrentRenderKey(activeSlides) {
   return [currentPlaylistSignature || '', viewportKey, 'slide', slide && slide.id ? slide.id : ''].join('|');
 }
 
-// Pick the current slide and the next slide for webpage preloading.
+// Pick the next slide for webpage preloading.
 function getWebpagePreloadSlides(sourceSlides, targetIndex) {
   const availableSlides = Array.isArray(sourceSlides) ? sourceSlides : [];
   if (!availableSlides.length) {
@@ -97,19 +97,71 @@ function getWebpagePreloadSlides(sourceSlides, targetIndex) {
   }
 
   const preloadSlides = [];
-  const currentSlide = availableSlides[normalizedIndex];
   const nextSlide = availableSlides[normalizedIndex + 1];
 
-  if (currentSlide) {
+  if (nextSlide) {
-    preloadSlides.push(currentSlide);
-  }
-  if (nextSlide && nextSlide !== currentSlide) {
     preloadSlides.push(nextSlide);
   }
 
   return preloadSlides;
 }
 
+// Pick the next slide to warm its markup before it becomes visible.
+function getSlideMarkupPreloadSlides(sourceSlides, targetIndex) {
+  const availableSlides = Array.isArray(sourceSlides) ? sourceSlides : [];
+  if (!availableSlides.length) {
+    return [];
+  }
+
+  let normalizedIndex = Number(targetIndex || 0);
+  if (!Number.isFinite(normalizedIndex) || normalizedIndex < 0 || normalizedIndex >= availableSlides.length) {
+    normalizedIndex = 0;
+  }
+
+  const preloadSlides = [];
+  const nextSlide = availableSlides[normalizedIndex + 1];
+
+  if (nextSlide) {
+    preloadSlides.push(nextSlide);
+  }
+
+  return preloadSlides;
+}
+
+function scheduleSlideMarkupPreload(sourceSlides, targetIndex) {
+  if (window.__pulseThumbnailPreview) {
+    return;
+  }
+
+  const preloadSlides = getSlideMarkupPreloadSlides(sourceSlides, targetIndex);
+  if (!preloadSlides.length || typeof primeSlideMarkup !== 'function') {
+    return;
+  }
+
+  const slide = preloadSlides[0];
+  const preloadSignature = [
+    currentPlaylistSignature || '',
+    slide && slide.id ? slide.id : '',
+    slide && slide.template_id ? slide.template_id : '',
+    slide && slide.modified_at ? slide.modified_at : '',
+    window.innerWidth + 'x' + window.innerHeight,
+    videoRegionRenderVersion || 0
+  ].join('|');
+
+  if (scheduleSlideMarkupPreload.signature === preloadSignature) {
+    return;
+  }
+
+  scheduleSlideMarkupPreload.signature = preloadSignature;
+
+  window.setTimeout(function () {
+    if (scheduleSlideMarkupPreload.signature !== preloadSignature) {
+      return;
+    }
+    primeSlideMarkup(slide);
+  }, 0);
+}
+
 // Mount hidden iframe preloads for the chosen webpage URLs.
 function syncWebpagePreloads(sourceSlides, targetIndex) {
   const urls = getWebpageUrls(getWebpagePreloadSlides(sourceSlides, targetIndex));
@@ -136,13 +188,13 @@ function syncWebpagePreloads(sourceSlides, targetIndex) {
   preloadSignature = signature;
 }
 
-// Return a stable client id for this browser session.
+// Return a stable client id for this screen session.
 function getCommandClientId() {
   if (commandClientId) {
     return commandClientId;
   }
   try {
-    var storedClientId = window.localStorage.getItem(commandClientStorageKey);
+    var storedClientId = window.sessionStorage.getItem(commandClientStorageKey);
     if (storedClientId) {
       commandClientId = storedClientId;
       return commandClientId;
@@ -152,13 +204,23 @@ function getCommandClientId() {
   }
   commandClientId = (window.crypto && window.crypto.randomUUID ? window.crypto.randomUUID() : 'client-' + Date.now() + '-' + Math.random().toString(16).slice(2));
   try {
-    window.localStorage.setItem(commandClientStorageKey, commandClientId);
+    window.sessionStorage.setItem(commandClientStorageKey, commandClientId);
   } catch (_error2) {
     // ignore storage errors
   }
   return commandClientId;
 }
 
+function regenerateCommandClientId() {
+  commandClientId = null;
+  try {
+    window.sessionStorage.removeItem(commandClientStorageKey);
+  } catch (_error) {
+    // ignore storage errors
+  }
+  return getCommandClientId();
+}
+
 // Load the most recent playlist snapshot from browser storage.
 function loadPlaylistSnapshot() {
   try {

src/player/public/js/player-page-rendering.js

@@ -4,6 +4,14 @@ function sanitizeFontFamily(value) {
   return String(value || '').replace(/[^a-zA-Z0-9 ,\"-]/g, '').trim();
 }
 
+function normalizeStyleAttributeValue(value) {
+  return String(value || '')
+    .replace(/"/g, '"')
+    .replace(/'/g, "'")
+    .replace(/"/g, '"')
+    .replace(/'/g, "'");
+}
+
 // Clamp font size to the supported range.
 function sanitizeFontSize(value) {
   return Math.max(8, Number(value || 0) || 24);
@@ -53,6 +61,276 @@ function fitCanvasSize(canvasWidth, canvasHeight, maxWidth, maxHeight) {
   };
 }
 
+function normalizePlayerAnimationStep(value, fallbackPreset) {
+  if (value && typeof value === 'object' && !Array.isArray(value)) {
+    return {
+      preset: String(value.preset || fallbackPreset || 'none').trim(),
+      duration_ms: Number.isFinite(Number(value.duration_ms)) && Number(value.duration_ms) > 0 ? Math.round(Number(value.duration_ms)) : null,
+      delay_ms: Number.isFinite(Number(value.delay_ms)) && Number(value.delay_ms) >= 0 ? Math.round(Number(value.delay_ms)) : null,
+      iterations: Number.isFinite(Number(value.iterations)) && Number(value.iterations) > 0 ? Math.round(Number(value.iterations)) : null
+    };
+  }
+
+  return {
+    preset: String(typeof value === 'string' ? value : fallbackPreset || 'none').trim(),
+    duration_ms: null,
+    delay_ms: null,
+    iterations: null
+  };
+}
+
+function normalizePlayerAnimationConfig(value) {
+  var raw = value;
+  if (typeof raw === 'string') {
+    var text = String(raw || '').trim();
+    if (!text) {
+      raw = null;
+    } else {
+      try {
+        raw = JSON.parse(text);
+      } catch (_error) {
+        raw = null;
+      }
+    }
+  }
+
+  if (!raw || typeof raw !== 'object' || Array.isArray(raw)) {
+    raw = {};
+  }
+
+  return {
+    intro: normalizePlayerAnimationStep(raw.intro, 'none'),
+    outro: normalizePlayerAnimationStep(raw.outro !== undefined ? raw.outro : raw.out, 'none'),
+    loop: normalizePlayerAnimationStep(raw.loop, 'none')
+  };
+}
+
+function hasPlayerAnimation(config) {
+  return Boolean(config && ['intro', 'outro', 'loop'].some(function (stepName) {
+    return String((config[stepName] && config[stepName].preset) || '').trim() && String((config[stepName] && config[stepName].preset) || '').trim() !== 'none';
+  }));
+}
+
+function decorateRegionMarkup(markup, region) {
+  if (!markup || !region || !hasPlayerAnimation(region.animationConfig)) {
+    return markup;
+  }
+
+  var animationJson = escapeHtml(JSON.stringify(region.animationConfig));
+  return markup.replace(/^(\s*)<([a-z0-9-]+)(\s[^>]*)?>/i, function (match, leadingWhitespace, tagName, attributes) {
+    return leadingWhitespace + '<' + tagName + (attributes || '') + ' data-animation-json="' + animationJson + '">';
+  });
+}
+
+function clearRegionAnimationClasses(root) {
+  if (!root) {
+    return;
+  }
+
+  var elements = [];
+  if (typeof root.matches === 'function' && root.matches('[data-animation-json]')) {
+    elements.push(root);
+  }
+  Array.prototype.forEach.call(root.querySelectorAll('[data-animation-json]'), function (element) {
+    elements.push(element);
+  });
+
+  elements.forEach(function (element) {
+    if (!element) {
+      return;
+    }
+    element.classList.remove('animate__animated', 'animate__infinite');
+    element.classList.remove('animate__repeat-1', 'animate__repeat-2', 'animate__repeat-3');
+    Array.prototype.slice.call(element.classList || []).forEach(function (className) {
+      if (String(className || '').indexOf('animate__') === 0) {
+        element.classList.remove(className);
+      }
+    });
+    element.style.removeProperty('--animate-duration');
+    element.style.removeProperty('--animate-delay');
+    element.style.removeProperty('--animate-repeat');
+  });
+}
+
+function isAttentionSeekerAnimation(preset) {
+  return ['bounce', 'flash', 'pulse', 'rubberBand', 'shakeX', 'shakeY', 'headShake', 'swing', 'tada', 'wobble', 'jello', 'heartBeat'].indexOf(String(preset || '').trim()) !== -1;
+}
+
+function applyAnimationStep(element, step, phase) {
+  if (!element || !step) {
+    return;
+  }
+
+  var preset = String(step.preset || 'none').trim();
+  if (!preset || preset === 'none') {
+    return;
+  }
+
+  element.classList.add('animate__animated', 'animate__' + preset);
+  element.style.setProperty('--animate-duration', String(Math.max(1, Number(step.duration_ms || 0) || 1000)) + 'ms');
+  if (Number(step.delay_ms || 0) > 0) {
+    element.style.setProperty('--animate-delay', String(Math.max(0, Number(step.delay_ms || 0))) + 'ms');
+  } else {
+    element.style.removeProperty('--animate-delay');
+  }
+
+  if (phase === 'loop') {
+    var repeatCount = Number(step.iterations);
+    if (!Number.isFinite(repeatCount) || repeatCount < 1) {
+      repeatCount = 1;
+    }
+    if (repeatCount > 1) {
+      element.classList.add('animate__repeat-1');
+    }
+    element.style.setProperty('--animate-repeat', String(repeatCount));
+    return;
+  }
+
+  if (isAttentionSeekerAnimation(preset) && Number(step.iterations || 0) > 1) {
+    element.style.setProperty('--animate-repeat', String(Math.max(1, Number(step.iterations || 1))));
+  }
+}
+
+function getAnimationStepTimingMs(step) {
+  if (!step) {
+    return 0;
+  }
+
+  var preset = String(step.preset || 'none').trim();
+  if (!preset || preset === 'none') {
+    return 0;
+  }
+
+  var durationMs = Number(step.duration_ms);
+  if (!Number.isFinite(durationMs) || durationMs <= 0) {
+    durationMs = 1000;
+  }
+
+  var delayMs = Number(step.delay_ms);
+  if (!Number.isFinite(delayMs) || delayMs < 0) {
+    delayMs = 0;
+  }
+
+  var iterations = Number(step.iterations);
+  if (!Number.isFinite(iterations) || iterations < 1) {
+    iterations = 1;
+  }
+
+  return delayMs + (durationMs * iterations);
+}
+
+function getRegionAnimationPhaseTimingMs(root, phase) {
+  var timings = getRegionAnimationPhaseTimings(root, phase);
+  return timings.reduce(function (maxTimingMs, entry) {
+    return Math.max(maxTimingMs, Number(entry && entry.timingMs || 0));
+  }, 0);
+}
+
+function getRegionAnimationPhaseTimings(root, phase) {
+  if (!root || isThumbnailPreview()) {
+    return [];
+  }
+
+  var normalizedPhase = String(phase || 'intro').trim().toLowerCase();
+  if (normalizedPhase !== 'intro' && normalizedPhase !== 'outro') {
+    normalizedPhase = 'intro';
+  }
+
+  var timings = [];
+  Array.prototype.forEach.call(root.querySelectorAll('[data-animation-json]'), function (element) {
+    if (!element) {
+      return;
+    }
+
+    var config;
+    try {
+      config = normalizePlayerAnimationConfig(element.getAttribute('data-animation-json') || '{}');
+    } catch (_error) {
+      config = null;
+    }
+
+    if (!config) {
+      return;
+    }
+
+    var timingMs = getAnimationStepTimingMs(normalizedPhase === 'outro' ? config.outro : config.intro);
+    if (timingMs > 0) {
+      timings.push({
+        element: element,
+        timingMs: timingMs
+      });
+    }
+  });
+
+  return timings;
+}
+
+function playRegionAnimation(element, phase) {
+  if (!element || isThumbnailPreview()) {
+    return;
+  }
+
+  var normalizedPhase = String(phase || 'intro').trim().toLowerCase();
+  if (normalizedPhase !== 'intro' && normalizedPhase !== 'outro') {
+    normalizedPhase = 'intro';
+  }
+
+  var config;
+  try {
+    config = normalizePlayerAnimationConfig(element.getAttribute('data-animation-json') || '{}');
+  } catch (_error) {
+    config = null;
+  }
+
+  if (!config) {
+    return;
+  }
+
+  element.dataset.animationPhase = normalizedPhase;
+  clearRegionAnimationClasses(element);
+
+  if (normalizedPhase === 'outro') {
+    applyAnimationStep(element, config.outro, 'outro');
+    return;
+  }
+
+  if (config.intro && String(config.intro.preset || '').trim() && String(config.intro.preset || '').trim() !== 'none') {
+    applyAnimationStep(element, config.intro, 'intro');
+    if (config.loop && String(config.loop.preset || '').trim() && String(config.loop.preset || '').trim() !== 'none') {
+      element.addEventListener('animationend', function handleAnimationEnd(event) {
+        if (event.target !== element) {
+          return;
+        }
+        if (String(element.dataset.animationPhase || '').trim() !== 'intro') {
+          return;
+        }
+        element.removeEventListener('animationend', handleAnimationEnd);
+        clearRegionAnimationClasses(element);
+        applyAnimationStep(element, config.loop, 'loop');
+      });
+    }
+    return;
+  }
+
+  applyAnimationStep(element, config.loop, 'loop');
+}
+
+function playRegionAnimations(root, phase) {
+  if (!root || isThumbnailPreview()) {
+    return;
+  }
+
+  var normalizedPhase = String(phase || 'intro').trim().toLowerCase();
+  if (normalizedPhase !== 'intro' && normalizedPhase !== 'outro') {
+    normalizedPhase = 'intro';
+  }
+
+  var elements = Array.prototype.slice.call(root.querySelectorAll('[data-animation-json]'));
+  elements.forEach(function (element) {
+    playRegionAnimation(element, normalizedPhase);
+  });
+}
+
 function setPlayerCanvasDimensions(canvasWidth, canvasHeight) {
   if (!document || !document.documentElement) {
     return;
@@ -64,7 +342,7 @@ function setPlayerCanvasDimensions(canvasWidth, canvasHeight) {
   document.documentElement.style.setProperty('--player-canvas-height', height + 'px');
 }
 
-const ALLOWED_RICH_TEXT_TAGS = ['a', 'b', 'blockquote', 'br', 'code', 'div', 'em', 'figure', 'figcaption', 'h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'hr', 'i', 'li', 'ol', 'p', 'pre', 'span', 'strong', 'sub', 'sup', 'table', 'tbody', 'td', 'th', 'thead', 'tr', 'u', 'ul'];
+const ALLOWED_RICH_TEXT_TAGS = ['a', 'b', 'blockquote', 'br', 'code', 'col', 'colgroup', 'div', 'em', 'figure', 'figcaption', 'h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'hr', 'i', 'img', 'li', 'ol', 'p', 'pre', 'span', 'strong', 'sub', 'sup', 'table', 'tbody', 'td', 'th', 'thead', 'tr', 'u', 'ul'];
 
 function sanitizeRichTextAttributes(tagName, attrText) {
   const allowedAttributes = {
@@ -79,14 +357,20 @@ function sanitizeRichTextAttributes(tagName, attrText) {
     h4: ['class', 'style'],
     h5: ['class', 'style'],
     h6: ['class', 'style'],
+    img: ['src', 'alt', 'title', 'width', 'height', 'class', 'style', 'loading', 'decoding'],
+    i: ['class', 'style', 'aria-hidden'],
+    col: ['class', 'style', 'span', 'width'],
+    colgroup: ['class', 'style', 'span'],
     li: ['class', 'style'],
     ol: ['class', 'style', 'start'],
     p: ['class', 'style'],
     pre: ['class', 'style'],
     span: ['class', 'style'],
     table: ['class', 'style'],
+    tbody: ['class', 'style'],
     td: ['class', 'style', 'colspan', 'rowspan'],
     th: ['class', 'style', 'colspan', 'rowspan', 'scope'],
+    thead: ['class', 'style'],
     tr: ['class', 'style'],
     ul: ['class', 'style']
   };
@@ -95,6 +379,14 @@ function sanitizeRichTextAttributes(tagName, attrText) {
     return '';
   }
 
+  if (tagName === 'img') {
+    const srcMatch = String(attrText || '').match(/\bsrc\s*=\s*("([^"]*)"|'([^']*)'|([^\s"'>/=`]+))/i);
+    const srcValue = srcMatch ? String(srcMatch[2] !== undefined ? srcMatch[2] : srcMatch[3] !== undefined ? srcMatch[3] : srcMatch[4] !== undefined ? srcMatch[4] : '').trim() : '';
+    if (!srcValue || !/^(?:https?:\/\/|\/media\/|\/assets\/|\/[^/]|data:image\/)/i.test(srcValue)) {
+      return '';
+    }
+  }
+
   const attrs = [];
   String(attrText || '').replace(/([a-zA-Z0-9:-]+)(?:\s*=\s*("([^"]*)"|'([^']*)'|([^\s"'>/=`]+)))?/g, (_full, key, _valuePart, doubleQuoted, singleQuoted, bareValue) => {
     const lowerKey = String(key || '').toLowerCase();
@@ -118,7 +410,7 @@ function sanitizeRichTextAttributes(tagName, attrText) {
         return '';
       }
     }
-    attrs.push(' ' + lowerKey + '="' + escapeHtml(value) + '"');
+    attrs.push(' ' + lowerKey + '="' + escapeHtml(lowerKey === 'style' ? normalizeStyleAttributeValue(value) : value) + '"');
     return '';
   });
 
@@ -340,31 +632,82 @@ function parseTimeToMinutes(value) {
   return Number(match[1]) * 60 + Number(match[2]);
 }
 
-// Determine whether a slide should be shown at the current time.
+function normalizeScheduleRule(rule) {
-function isSlideActive(slide, now) {
+  const input = rule && typeof rule === 'object' ? rule : {};
-  const mode = String(slide.schedule_mode || 'always');
+  const startDatetime = String(input.start_datetime || input.startDateTime || '').trim();
-  if (mode === 'always') {
+  const endDatetime = String(input.end_datetime || input.endDateTime || '').trim();
-    return true;
+  const startTime = String(input.start_time || input.startTime || '').trim();
+  const endTime = String(input.end_time || input.endTime || '').trim();
+  const days = parseScheduleDays(input.days);
+
+  if (startDatetime || endDatetime) {
+    if (!startDatetime || !endDatetime) {
+      return null;
     }
-  if (mode === 'dates') {
+  }
-    const start = slide.schedule_start_datetime ? new Date(slide.schedule_start_datetime) : null;
+  if (startTime || endTime) {
-    const end = slide.schedule_end_datetime ? new Date(slide.schedule_end_datetime) : null;
+    if (!startTime || !endTime) {
-    if (!start || !end || Number.isNaN(start.getTime()) || Number.isNaN(end.getTime())) {
+      return null;
+    }
+  }
+  if (!startDatetime && !endDatetime && !startTime && !endTime && !days.length) {
+    return null;
+  }
+
+  return {
+    start_datetime: startDatetime || null,
+    end_datetime: endDatetime || null,
+    start_time: startTime || null,
+    end_time: endTime || null,
+    days: days
+  };
+}
+
+function parseScheduleRules(value) {
+  let rawRules = [];
+
+  if (Array.isArray(value)) {
+    rawRules = value;
+  } else {
+    const raw = String(value || '').trim();
+    if (!raw) {
+      return [];
+    }
+    try {
+      const parsed = JSON.parse(raw);
+      rawRules = Array.isArray(parsed) ? parsed : [];
+    } catch (_error) {
+      return [];
+    }
+  }
+
+  return rawRules.map(normalizeScheduleRule).filter(Boolean);
+}
+
+function matchesScheduleRule(rule, now) {
+  const normalized = normalizeScheduleRule(rule);
+  if (!normalized) {
     return false;
   }
-    return now >= start && now <= end;
+
-  }
+  if (normalized.start_datetime && normalized.end_datetime) {
-  if (mode === 'times') {
+    const start = new Date(normalized.start_datetime);
-    const days = parseScheduleDays(slide.schedule_days_json);
+    const end = new Date(normalized.end_datetime);
-    if (!days.length) {
+    if (Number.isNaN(start.getTime()) || Number.isNaN(end.getTime())) {
       return false;
     }
-    const day = now.getDay();
+    if (now < start || now > end) {
-    if (days.indexOf(day) === -1) {
       return false;
     }
-    const startMinutes = parseTimeToMinutes(slide.schedule_start_time);
+  }
-    const endMinutes = parseTimeToMinutes(slide.schedule_end_time);
+
+  if (normalized.days.length && normalized.days.indexOf(now.getDay()) === -1) {
+    return false;
+  }
+
+  if (normalized.start_time && normalized.end_time) {
+    const startMinutes = parseTimeToMinutes(normalized.start_time);
+    const endMinutes = parseTimeToMinutes(normalized.end_time);
     if (startMinutes === null || endMinutes === null) {
       return false;
     }
@@ -374,8 +717,20 @@ function isSlideActive(slide, now) {
     }
     return nowMinutes >= startMinutes || nowMinutes <= endMinutes;
   }
+
   return true;
 }
+
+// Determine whether a slide should be shown at the current time.
+function isSlideActive(slide, now) {
+  const rules = Array.isArray(slide.scheduleRules) ? slide.scheduleRules : [];
+  if (!rules.length) {
+    return true;
+  }
+  return rules.some(function (rule) {
+    return matchesScheduleRule(rule, now);
+  });
+}
 // Build the cache key for a template layout.
 function getTemplateLayoutCacheKey(template) {
   var viewportKey = window.innerWidth + 'x' + window.innerHeight;
@@ -411,6 +766,7 @@ function getTemplateLayout(template) {
       regionKey: region.region_key,
       regionType: region.region_type,
       label: region.label,
+      animationJson: region.animation_json || null,
       baseStyle: baseStyle,
       pixelWidth: pixelWidth,
       pixelHeight: pixelHeight,
@@ -426,6 +782,7 @@ function getTemplateLayout(template) {
     canvasHeight: canvasSize.height,
     background: template.background_image_path ? '<img class="template-background" src="' + escapeHtml(template.background_image_path) + '" alt="" />' : '',
     backgroundColor: template.background_color || '#111111',
+    backgroundGradient: template.background_gradient || '',
     regions: regions
   };
 
@@ -434,17 +791,31 @@ function getTemplateLayout(template) {
 }
 
 // Build a dark backdrop style for template and media canvases.
-function buildBackdropStyle(backgroundColor, backgroundImagePath) {
+function buildBackdropStyle(backgroundColor, backgroundImagePath, backgroundGradient) {
   var color = String(backgroundColor || '#111111').trim() || '#111111';
   var style = 'background-color:' + escapeHtml(color) + ';';
+  var gradient = '';
+  try {
+    var gradientData = typeof backgroundGradient === 'string' ? JSON.parse(backgroundGradient) : backgroundGradient;
+    if (gradientData && gradientData.type === 'linear' && Array.isArray(gradientData.colors) && gradientData.colors.length >= 2) {
+      var stops = Array.isArray(gradientData.stops) ? gradientData.stops : (gradientData.colors || []).map(function (color, index, colors) { return { color: color, position: colors.length > 1 ? Math.round(index * 100 / (colors.length - 1)) : 0 }; });
+      stops = stops.filter(function (stop) { return stop && /^#[0-9a-fA-F]{3,8}$/.test(String(stop.color || '').trim()); }).slice(0, 12);
+      if (stops.length >= 2) {
+        var angle = Number(gradientData.angle);
+        gradient = 'linear-gradient(' + (Number.isFinite(angle) ? Math.max(0, Math.min(360, angle)) : 90) + 'deg,' + stops.map(function (stop) { return stop.color + ' ' + Math.max(0, Math.min(100, Number(stop.position) || 0)) + '%'; }).join(',') + ')';
+      }
+    }
+  } catch (_error) {
+    gradient = '';
+  }
 
   if (backgroundImagePath) {
-    style += 'background-image:url("' + escapeHtml(backgroundImagePath) + '");';
+    style += 'background-image:url("' + escapeHtml(backgroundImagePath) + '")' + (gradient ? ',' + gradient : '') + ';';
-    style += 'background-position:center;background-size:contain;background-repeat:no-repeat;';
+    style += 'background-position:center,center;background-size:contain,cover;background-repeat:no-repeat,no-repeat;';
     return style;
   }
 
-  style += 'background-image:none;background-position:center;background-size:cover;background-repeat:no-repeat;';
+  style += 'background-image:' + (gradient || 'none') + ';background-position:center;background-size:cover;background-repeat:no-repeat;';
   return style;
 }
 
@@ -515,9 +886,12 @@ function renderTemplateSlideMarkup(slide) {
   const layout = plan ? plan.layout : null;
   const regions = layout ? layout.regions.map(function (region) {
     const regionContent = content[region.regionKey] || {};
-    return plan.renderRegion(region, regionContent);
+    const markup = plan.renderRegion(region, regionContent);
+    return decorateRegionMarkup(markup, {
+      animationConfig: normalizePlayerAnimationConfig(region.animationJson)
+    });
   }).join('') : '';
-  const stageStyle = layout ? buildBackdropStyle(layout.backgroundColor || '#111111', template.background_image_path) : '';
+  const stageStyle = layout ? buildBackdropStyle(layout.backgroundColor || '#111111', template.background_image_path, layout.backgroundGradient) : '';
   if (layout) {
     setPlayerCanvasDimensions(layout.canvasWidth, layout.canvasHeight);
   }
@@ -556,6 +930,45 @@ function getSlideMarkupCacheKey(slide) {
   return [currentPlaylistSignature || '', slide && slide.id ? slide.id : '', slide && slide.template_id ? slide.template_id : '', slide && slide.modified_at ? slide.modified_at : '', viewportKey, videoRegionRenderVersion || 0].join('|');
 }
 
+function restorePlayerCanvasDimensions(width, height) {
+  if (!document || !document.documentElement) {
+    return;
+  }
+
+  var style = document.documentElement.style;
+  if (width) {
+    style.setProperty('--player-canvas-width', width);
+  } else {
+    style.removeProperty('--player-canvas-width');
+  }
+
+  if (height) {
+    style.setProperty('--player-canvas-height', height);
+  } else {
+    style.removeProperty('--player-canvas-height');
+  }
+}
+
+function primeSlideMarkup(slide) {
+  if (!slide) {
+    return '';
+  }
+
+  var cachedMarkup = getCachedSlideMarkup(slide);
+  if (cachedMarkup) {
+    return cachedMarkup;
+  }
+
+  var previousWidth = document && document.documentElement && document.documentElement.style ? String(document.documentElement.style.getPropertyValue('--player-canvas-width') || '') : '';
+  var previousHeight = document && document.documentElement && document.documentElement.style ? String(document.documentElement.style.getPropertyValue('--player-canvas-height') || '') : '';
+
+  try {
+    return buildSlideMarkupForState(slide, false);
+  } finally {
+    restorePlayerCanvasDimensions(previousWidth.trim(), previousHeight.trim());
+  }
+}
+
 function notifyVideoRegionSourceReady() {
   if (typeof videoRegionRenderVersion === 'number') {
     videoRegionRenderVersion += 1;
@@ -582,9 +995,12 @@ function setCachedSlideMarkup(slide, markup) {
 
 // Slide rendering and markup cache helpers.
 // Choose the right slide renderer and cache the result.
-function buildSlideMarkup(slide) {
+function buildSlideMarkupForState(slide, updateCurrentState) {
+  if (updateCurrentState) {
     lastRenderedSlide = slide || null;
     syncBlackoutState();
+  }
+
   var cachedMarkup = getCachedSlideMarkup(slide);
   if (cachedMarkup) {
     return cachedMarkup;
@@ -601,3 +1017,7 @@ function buildSlideMarkup(slide) {
   setCachedSlideMarkup(slide, markup);
   return markup;
 }
+
+function buildSlideMarkup(slide) {
+  return buildSlideMarkupForState(slide, true);
+}

src/player/public/sw.js

@@ -1,6 +1,6 @@
 // Service worker cache strategy for player pages, assets, media, and playlists.
 
-const CACHE_VERSION = 'v36';
+const CACHE_VERSION = 'v38';
 const PAGE_CACHE = `pulse-signage-player-pages-${CACHE_VERSION}`;
 const ASSET_CACHE = `pulse-signage-player-assets-${CACHE_VERSION}`;
 const MEDIA_CACHE = `pulse-signage-player-media-${CACHE_VERSION}`;
@@ -16,6 +16,20 @@ function normalizeRequest(request) {
   });
 }
 
+function shouldBypassCache(request) {
+  if (!request) {
+    return false;
+  }
+
+  if (request.cache === 'reload' || request.cache === 'no-store') {
+    return true;
+  }
+
+  const cacheControl = String(request.headers.get('cache-control') || '').toLowerCase();
+  const pragma = String(request.headers.get('pragma') || '').toLowerCase();
+  return cacheControl.includes('no-cache') || cacheControl.includes('max-age=0') || pragma.includes('no-cache');
+}
+
 async function cacheResponse(cacheName, request, response, cacheKeyRequest) {
   if (!response || !response.ok) {
     return;
@@ -47,7 +61,7 @@ async function networkFirst(request, cacheName, cacheKeyRequest) {
     if (cached) {
       return cached;
     }
-    throw _error;
+    return new Response('', { status: 504, statusText: 'Offline' });
   }
 }
 
@@ -126,6 +140,11 @@ self.addEventListener('fetch', function (event) {
     return;
   }
 
+  if (shouldBypassCache(request)) {
+    event.respondWith(networkOnly(request));
+    return;
+  }
+
   if (url.pathname.startsWith('/assets/')) {
     event.respondWith(cacheFirst(request, ASSET_CACHE));
     return;

src/player/regions/api.js

@@ -56,7 +56,7 @@ function getApiItem(sourceId, itemNumber, itemsPathOverride) {
   return items[index] || null;
 }
 
-function substituteApiVariables(html, item) {
+function substituteApiVariables(html, item, sourceId) {
   var source = String(html || '');
   return source.replace(/\{\{\s*([^{}]+?)\s*\}\}/g, function (_match, expression) {
     if (!item || typeof item !== 'object') {
@@ -67,7 +67,25 @@ function substituteApiVariables(html, item) {
       return '';
     }
 
-    return escapeHtml(placeholderUtils.formatPlaceholderValue(placeholderUtils.resolvePlaceholderExpression(item, expression)));
+    var resolved = placeholderUtils.resolvePlaceholderExpression(item, expression);
+    if (typeof placeholderUtils.isImagePlaceholderExpression === 'function' && placeholderUtils.isImagePlaceholderExpression(expression)) {
+      var imageSource = placeholderUtils.formatPlaceholderValue(resolved);
+      var source = getApiSourceById(sourceId);
+      imageSource = source && source.imageCache && source.imageCache[imageSource] ? source.imageCache[imageSource] : imageSource;
+      if (!/^(?:https?:\/\/|\/media\/|\/assets\/|\/[^/])/i.test(imageSource)) {
+        return '';
+      }
+      var imageConfig = typeof placeholderUtils.getImagePlaceholderConfig === 'function' ? placeholderUtils.getImagePlaceholderConfig(expression) : {};
+      var hasImageBounds = imageConfig.width && imageConfig.height;
+      var imageStyle = hasImageBounds
+        ? 'display:block;width:100%;height:100%;object-fit:contain;'
+        : 'display:block;width:auto;height:auto;' + (imageConfig.width ? 'max-width:' + imageConfig.width + 'px;' : '') + (imageConfig.height ? 'max-height:' + imageConfig.height + 'px;' : '');
+      var image = '<img src="' + escapeHtml(imageSource) + '" alt="" style="' + imageStyle + '" />';
+      return hasImageBounds
+        ? '<span style="display:inline-flex;align-items:center;justify-content:center;box-sizing:border-box;width:' + imageConfig.width + 'px;height:' + imageConfig.height + 'px;">' + image + '</span>'
+        : image;
+    }
+    return escapeHtml(placeholderUtils.formatPlaceholderValue(resolved));
   });
 }
 
@@ -120,10 +138,8 @@ function renderApiRegion(region, regionContent) {
   var fontSize = sanitizeFontSize(regionContent.font_size || region.fontSize);
   var fontColor = sanitizeTextColor(regionContent.font_color || region.fontColor);
   var item = getApiItem(sourceId, itemNumber, itemsPath);
-  var body = item ? substituteApiVariables(content, item) : '';
+  var hasSource = String(sourceId === undefined || sourceId === null ? '' : sourceId).trim() !== '';
-  if (!body && item) {
+  var body = hasSource ? (item ? substituteApiVariables(content, item, sourceId) : '') : content;
-    body = getApiPreviewFallback(item);
-  }
   var contentStyle = 'width:' + region.pixelWidth + 'px;height:' + region.pixelHeight + 'px;transform:scale(' + region.canvasScale + ');transform-origin:top left;' + (fontFamily ? 'font-family:' + escapeHtml(fontFamily) + ';' : '') + 'font-size:' + fontSize + 'px;color:' + escapeHtml(fontColor) + ';';
   if (!body) {
     return '';

src/player/regions/html.js

@@ -2,16 +2,52 @@
 
 var registry = window.pulsePlayerRegionTypes;
 
+function normalizeRenderableValue(value) {
+  if (value && typeof value === 'object') {
+    if (value.value !== undefined) {
+      return normalizeRenderableValue(value.value);
+    }
+    if (value.text !== undefined) {
+      return normalizeRenderableValue(value.text);
+    }
+    if (value.html !== undefined) {
+      return normalizeRenderableValue(value.html);
+    }
+    if (value.content !== undefined) {
+      return normalizeRenderableValue(value.content);
+    }
+    return '';
+  }
+
+  return String(value === undefined || value === null ? '' : value);
+}
+
+function buildHtmlDocument(html) {
+  var raw = String(html || '').trim();
+  if (!raw) {
+    return '';
+  }
+
+  if (/^<!doctype\b/i.test(raw) || /^<html\b/i.test(raw)) {
+    return raw;
+  }
+
+  return '<!doctype html><html><head><style>html,body{margin:0;width:100%;height:100%;overflow:hidden;background:transparent;}html,body{background:transparent !important;}</style></head><body>' + raw + '</body></html>';
+}
+
 function renderHtmlRegionContent(value) {
-  var html = String(value || '').trim();
+  var html = normalizeRenderableValue(value).trim();
   if (!html) {
     return '';
   }
-  return '<iframe class="template-region-html-frame" sandbox="" scrolling="no" srcdoc="<!doctype html><html><head><style>html,body{margin:0;width:100%;height:100%;overflow:hidden;background:transparent;}</style></head><body>' + escapeHtml(html) + '</body></html>" title="HTML region" loading="eager"></iframe>';
+  if (/^<!doctype\b/i.test(html) || /^<html\b/i.test(html)) {
+    return '<iframe class="template-region-html-frame" sandbox="" allowtransparency="true" scrolling="no" srcdoc="' + escapeHtml(html) + '" title="HTML region" loading="eager" style="width:100%;height:100%;border:0;display:block;background:transparent;overflow:hidden;"></iframe>';
+  }
+  return '<div class="template-region-html-content" style="width:100%;height:100%;overflow:hidden;background:transparent;">' + html + '</div>';
 }
 
 function renderHtmlRegion(region, regionContent) {
-  return '<div class="template-region html" style="' + region.baseStyle + '">' + renderHtmlRegionContent(regionContent.value || '') + '</div>';
+  return '<div class="template-region html" style="' + region.baseStyle + '">' + renderHtmlRegionContent(regionContent && regionContent.value !== undefined ? regionContent.value : '') + '</div>';
 }
 
 registry.register('html', {

src/player/regions/qr-code.js

@@ -0,0 +1,20 @@
+// QR code region rendering for embedded URL-to-image output.
+
+var registry = window.pulsePlayerRegionTypes;
+
+function renderQrCodeRegion(region, regionContent) {
+  var borderRadius = Math.max(0, Math.round(Number(regionContent && regionContent.qr_border_radius || 0)));
+  var radiusStyle = borderRadius > 0 ? 'border-radius:' + borderRadius + 'px;overflow:hidden;' : '';
+  var preview = String(regionContent && regionContent.qr_preview || '').trim();
+
+  if (!preview) {
+    return '';
+  }
+
+  return '<div class="template-region qr-code" style="' + region.baseStyle + radiusStyle + '"><img class="template-region-qr-code-image" src="' + escapeHtml(preview) + '" alt="QR code" role="img" draggable="false" style="background:transparent;display:block;width:100%;height:100%;object-fit:contain;' + radiusStyle + '" /></div>';
+}
+
+registry.register('qr-code', {
+  renderRegion: renderQrCodeRegion,
+  initRegion: function () {}
+});

src/player/regions/rss.js

@@ -1,6 +1,7 @@
 // RSS region helpers for resolving feeds, items, and nested values.
 
 var registry = window.pulsePlayerRegionTypes;
+var placeholderUtils = window.placeholderUtils || {};
 
 function getDefaultStyle() {
   return {
@@ -63,14 +64,34 @@ function resolveRssPath(value, path) {
   return current === undefined || current === null ? '' : current;
 }
 
-function substituteRssVariables(html, item) {
+function substituteRssVariables(html, item, feedId) {
   var source = String(html || '');
-  return source.replace(/\{\{\s*([a-zA-Z0-9_]+)(?:\.([a-zA-Z0-9_.]+))?\s*\}\}/g, function (_match, tokenName, tokenPath) {
+  return source.replace(/\{\{\s*([^{}]+?)\s*\}\}/g, function (_match, expression) {
     if (!item || typeof item !== 'object') {
       return '';
     }
-    var key = tokenPath ? tokenName + '.' + tokenPath : tokenName;
+    if (typeof placeholderUtils.resolvePlaceholderExpression !== 'function' || typeof placeholderUtils.formatPlaceholderValue !== 'function') {
-    return escapeHtml(resolveRssPath(item, key || ''));
+      return '';
+    }
+    var resolved = placeholderUtils.resolvePlaceholderExpression(item, expression);
+    if (typeof placeholderUtils.isImagePlaceholderExpression === 'function' && placeholderUtils.isImagePlaceholderExpression(expression)) {
+      var imageSource = placeholderUtils.formatPlaceholderValue(resolved);
+      var feed = getRssFeedById(feedId);
+      imageSource = feed && feed.imageCache && feed.imageCache[imageSource] ? feed.imageCache[imageSource] : imageSource;
+      if (!/^(?:https?:\/\/|\/media\/|\/assets\/|\/[^/])/i.test(imageSource)) {
+        return '';
+      }
+      var imageConfig = typeof placeholderUtils.getImagePlaceholderConfig === 'function' ? placeholderUtils.getImagePlaceholderConfig(expression) : {};
+      var hasImageBounds = imageConfig.width && imageConfig.height;
+      var imageStyle = hasImageBounds
+        ? 'display:block;width:100%;height:100%;object-fit:contain;'
+        : 'display:block;width:auto;height:auto;' + (imageConfig.width ? 'max-width:' + imageConfig.width + 'px;' : '') + (imageConfig.height ? 'max-height:' + imageConfig.height + 'px;' : '');
+      var image = '<img src="' + escapeHtml(imageSource) + '" alt="" style="' + imageStyle + '" />';
+      return hasImageBounds
+        ? '<span style="display:inline-flex;align-items:center;justify-content:center;box-sizing:border-box;width:' + imageConfig.width + 'px;height:' + imageConfig.height + 'px;">' + image + '</span>'
+        : image;
+    }
+    return escapeHtml(placeholderUtils.formatPlaceholderValue(resolved));
   });
 }
 
@@ -83,17 +104,8 @@ function renderRssRegion(region, regionContent) {
   var fontSize = sanitizeFontSize(regionContent.font_size || region.fontSize || defaultStyle.font_size);
   var fontColor = sanitizeTextColor(regionContent.font_color || region.fontColor || defaultStyle.font_color);
   var item = getRssFeedItem(feedId, itemNumber);
-  var body = item ? substituteRssVariables(content, item) : '';
+  var hasFeed = String(feedId === undefined || feedId === null ? '' : feedId).trim() !== '';
-  if (!body && item) {
+  var body = hasFeed ? (item ? substituteRssVariables(content, item, feedId) : '') : content;
-    var summaryParts = [];
-    if (item.title) {
-      summaryParts.push('<h3>' + escapeHtml(item.title) + '</h3>');
-    }
-    if (item.description) {
-      summaryParts.push('<div>' + sanitizeRichText(item.description) + '</div>');
-    }
-    body = summaryParts.join('');
-  }
   var contentStyle = 'width:' + region.pixelWidth + 'px;height:' + region.pixelHeight + 'px;transform:scale(' + region.canvasScale + ');transform-origin:top left;' + (fontFamily ? 'font-family:' + escapeHtml(fontFamily) + ';' : '') + 'font-size:' + fontSize + 'px;color:' + escapeHtml(fontColor) + ';';
   if (!body) {
     return '';

src/player/regions/rtmp.js

@@ -8,7 +8,7 @@ function renderRtmpRegion(region, regionContent) {
     return '';
   }
 
-  return '<div class="template-region rtmp" style="' + region.baseStyle + '"><video class="template-region-rtmp-video" data-rtmp-source="' + escapeHtml(url) + '" data-rtmp-disable-audio="' + (disableAudio ? '1' : '0') + '" data-rtmp-skip-unavailable="' + (skipUnavailable ? '1' : '0') + '" autoplay playsinline preload="auto" tabindex="-1" disablepictureinpicture></video><div class="template-region-placeholder template-region-rtmp-placeholder">Loading RTMP stream...</div></div>';
+  return '<div class="template-region rtmp" style="' + region.baseStyle + '"><video class="template-region-rtmp-video" data-rtmp-source="' + escapeHtml(url) + '" data-rtmp-disable-audio="' + (disableAudio ? '1' : '0') + '" data-rtmp-skip-unavailable="' + (skipUnavailable ? '1' : '0') + '" autoplay playsinline preload="auto" tabindex="-1" disablepictureinpicture' + (disableAudio ? ' muted' : '') + '></video><div class="template-region-placeholder template-region-rtmp-placeholder">Loading RTMP stream...</div></div>';
 }
 
 function getRtmpSessionUrl(sourceUrl, disableAudio) {
@@ -304,13 +304,9 @@ function getRtmpWarmupSlides(sourceSlides, targetIndex) {
   }
 
   var warmupSlides = [];
-  var currentSlide = availableSlides[normalizedIndex];
   var nextSlide = availableSlides[normalizedIndex + 1];
 
-  if (currentSlide) {
+  if (nextSlide) {
-    warmupSlides.push(currentSlide);
-  }
-  if (nextSlide && nextSlide !== currentSlide) {
     warmupSlides.push(nextSlide);
   }
 
@@ -693,12 +689,11 @@ function startRtmpPlayback(video, sourceUrl, disableAudio, skipUnavailable, plac
     if (window.Hls && window.Hls.isSupported && window.Hls.isSupported()) {
       var hls = new window.Hls({
         enableWorker: true,
-        lowLatencyMode: true,
+        liveSyncDurationCount: 6,
-        liveSyncDurationCount: 4,
+        liveMaxLatencyDurationCount: 12,
-        liveMaxLatencyDurationCount: 8,
+        maxBufferLength: 30,
-        maxBufferLength: 20,
         maxLiveSyncPlaybackRate: 1,
-        backBufferLength: 30
+        backBufferLength: 60
       });
       video.__rtmpHls = hls;
       hls.attachMedia(video);

src/player/regions/text.js

@@ -40,7 +40,7 @@ function renderTextRegion(region, regionContent) {
   var fontFamily = sanitizeFontFamily(regionContent.font_family || region.fontFamily || defaultStyle.font_family);
   var fontSize = sanitizeFontSize(regionContent.font_size || region.fontSize || defaultStyle.font_size);
   var fontColor = sanitizeTextColor(regionContent.font_color || region.fontColor || defaultStyle.font_color);
-  var contentStyle = 'width:' + region.pixelWidth + 'px;height:' + region.pixelHeight + 'px;transform:scale(' + region.canvasScale + ');transform-origin:top left;' + (fontFamily ? 'font-family:' + escapeHtml(fontFamily) + ';' : '') + 'font-size:' + fontSize + 'px;color:' + escapeHtml(fontColor) + ';';
+  var contentStyle = 'width:' + region.pixelWidth + 'px;height:' + region.pixelHeight + 'px;transform:scale(' + region.canvasScale + ');transform-origin:top left;line-height:1.5;' + (fontFamily ? 'font-family:' + escapeHtml(fontFamily) + ';' : '') + 'font-size:' + fontSize + 'px;color:' + escapeHtml(fontColor) + ';';
   var renderedBody = renderEditorJsContent(rawValue);
   return renderedBody ? '<div class="template-region text" style="' + region.baseStyle + '"><div class="template-region-text-scale" style="' + contentStyle + '">' + renderedBody + '</div></div>' : '';
 }

src/player/regions/time-date.js

@@ -1,6 +1,7 @@
 // Time/date region rendering and live updates.
 
 var registry = window.pulsePlayerRegionTypes;
+var placeholderUtils = window.placeholderUtils || {};
 var DEFAULT_FORMAT = '{{hh}}:{{mm}}';
 var DEFAULT_STYLE = {
   font_family: 'Arial',
@@ -9,15 +10,6 @@ var DEFAULT_STYLE = {
 };
 var timeDateFormatterCache = Object.create(null);
 
-function escapeHtml(value) {
-  return String(value === undefined || value === null ? '' : value)
-    .replace(/&/g, '&')
-    .replace(/</g, '&lt;')
-    .replace(/>/g, '&gt;')
-    .replace(/"/g, '&quot;')
-    .replace(/'/g, '&#39;');
-}
-
 function sanitizeTagAttributes(tagName, attrText) {
   var allowedAttributes = {
     a: ['href', 'title', 'target', 'rel', 'class', 'style'],
@@ -133,7 +125,7 @@ function resolveTimeZone(value) {
   }
 }
 
-function getFormatter(key, options) {
+function getTimeDateFormatter(key, options) {
   if (!timeDateFormatterCache[key]) {
     timeDateFormatterCache[key] = new Intl.DateTimeFormat('en-GB', options);
   }
@@ -141,10 +133,10 @@ function getFormatter(key, options) {
   return timeDateFormatterCache[key];
 }
 
-function getFormattedParts(timeZone, date) {
+function getTimeDateFormattedParts(timeZone, date) {
   var targetDate = date instanceof Date ? date : new Date();
   var resolvedTimeZone = resolveTimeZone(timeZone);
-  var numericParts = getFormatter('numeric:' + resolvedTimeZone, {
+  var numericParts = getTimeDateFormatter('numeric:' + resolvedTimeZone, {
     timeZone: resolvedTimeZone,
     hour12: false,
     hour: '2-digit',
@@ -154,29 +146,29 @@ function getFormattedParts(timeZone, date) {
     month: '2-digit',
     year: 'numeric'
   }).formatToParts(targetDate);
-  var weekdayLong = getFormatter('weekday-long:' + resolvedTimeZone, {
+  var weekdayLong = getTimeDateFormatter('weekday-long:' + resolvedTimeZone, {
     timeZone: resolvedTimeZone,
     weekday: 'long'
   }).formatToParts(targetDate);
-  var weekdayShort = getFormatter('weekday-short:' + resolvedTimeZone, {
+  var weekdayShort = getTimeDateFormatter('weekday-short:' + resolvedTimeZone, {
     timeZone: resolvedTimeZone,
     weekday: 'short'
   }).formatToParts(targetDate);
-  var monthLong = getFormatter('month-long:' + resolvedTimeZone, {
+  var monthLong = getTimeDateFormatter('month-long:' + resolvedTimeZone, {
     timeZone: resolvedTimeZone,
     month: 'long'
   }).formatToParts(targetDate);
-  var monthShort = getFormatter('month-short:' + resolvedTimeZone, {
+  var monthShort = getTimeDateFormatter('month-short:' + resolvedTimeZone, {
     timeZone: resolvedTimeZone,
     month: 'short'
   }).formatToParts(targetDate);
-  var ampm = getFormatter('ampm:' + resolvedTimeZone, {
+  var ampm = getTimeDateFormatter('ampm:' + resolvedTimeZone, {
     timeZone: resolvedTimeZone,
     hour12: true,
     hour: '2-digit',
     minute: '2-digit'
   }).formatToParts(targetDate);
-  var timezoneShort = getFormatter('tz-short:' + resolvedTimeZone, {
+  var timezoneShort = getTimeDateFormatter('tz-short:' + resolvedTimeZone, {
     timeZone: resolvedTimeZone,
     timeZoneName: 'short'
   }).formatToParts(targetDate);
@@ -213,27 +205,28 @@ function getFormattedParts(timeZone, date) {
     MMM: toTitleCase(getPart(monthShort, 'month')),
     MMMM: toTitleCase(getPart(monthLong, 'month')),
     a: toTitleCase(getPart(ampm, 'dayPeriod')),
-    tz: resolvedTimeZone,
+      tz: getPart(timezoneShort, 'timeZoneName'),
-    tz_short: getPart(timezoneShort, 'timeZoneName'),
+      tz_long: resolvedTimeZone,
     date: getPart(numericParts, 'year') + '-' + getPart(numericParts, 'month') + '-' + getPart(numericParts, 'day'),
     time: getPart(numericParts, 'hour') + ':' + getPart(numericParts, 'minute') + ':' + getPart(numericParts, 'second')
   };
 }
 
-function resolveTimeDatePlaceholder(values, expression) {
+function resolveTimeDateTemplatePlaceholder(values, expression) {
-  if (typeof placeholderUtils.resolvePlaceholderExpression === 'function' && typeof placeholderUtils.formatPlaceholderValue === 'function') {
+  var currentPlaceholderUtils = window.placeholderUtils || placeholderUtils || {};
-    return placeholderUtils.formatPlaceholderValue(placeholderUtils.resolvePlaceholderExpression(values, expression));
+  if (typeof currentPlaceholderUtils.resolvePlaceholderExpression === 'function' && typeof currentPlaceholderUtils.formatPlaceholderValue === 'function') {
+    return currentPlaceholderUtils.formatPlaceholderValue(currentPlaceholderUtils.resolvePlaceholderExpression(values, expression));
   }
 
   var parsed = String(expression || '').trim();
   return Object.prototype.hasOwnProperty.call(values, parsed) ? values[parsed] : '';
 }
 
-function renderTemplate(format, timeZone, date) {
+function renderTimeDateTemplate(format, timeZone, date) {
   var template = String(format || '').trim() || DEFAULT_FORMAT;
-  var values = getFormattedParts(timeZone, date);
+  var values = getTimeDateFormattedParts(timeZone, date);
   return template.replace(/\{\{\s*([a-zA-Z0-9_.()\-]+)\s*\}\}/g, function (_match, key) {
-    return String(resolveTimeDatePlaceholder(values, key) || '');
+    return String(resolveTimeDateTemplatePlaceholder(values, key, { timeZone: timeZone }) || '');
   });
 }
 
@@ -257,7 +250,7 @@ function renderTimeDateRegion(region, regionContent) {
   var fontSize = style.font_size ? 'font-size:' + Math.max(1, Math.round(Number(style.font_size))) + 'px;' : '';
   var fontColor = style.font_color ? 'color:' + escapeHtml(style.font_color) + ';' : '';
   var contentStyle = 'width:' + region.pixelWidth + 'px;height:' + region.pixelHeight + 'px;transform:scale(' + region.canvasScale + ');transform-origin:top left;' + (fontFamily ? fontFamily : '') + fontSize + fontColor + 'white-space:pre-wrap;line-height:1.1;';
-  var renderedText = renderTemplate(format, timeZone, new Date());
+  var renderedText = renderTimeDateTemplate(format, timeZone, new Date());
   return '<div class="template-region time-date" data-time-date-format="' + escapeHtml(format) + '" data-time-date-timezone="' + escapeHtml(timeZone) + '" style="' + region.baseStyle + '"><div class="template-region-text-scale" style="' + contentStyle + '">' + renderEditorJsContent(renderedText) + '</div></div>';
 }
 
@@ -273,7 +266,7 @@ function updateTimeDateRegion(element) {
     return;
   }
 
-  scaleWrapper.innerHTML = renderEditorJsContent(renderTemplate(format, timeZone, new Date()));
+  scaleWrapper.innerHTML = renderEditorJsContent(renderTimeDateTemplate(format, timeZone, new Date()));
 }
 
 function scheduleTimeDateRegionUpdate(element) {

src/player/regions/timetable.js

@@ -0,0 +1,160 @@
+// Timetable region rendering for live playback.
+
+var registry = window.pulsePlayerRegionTypes;
+
+function substituteTimetableVariables(html, entry) {
+  var source = String(html || '');
+  return source.replace(/\{\{\s*([^{}]+?)\s*\}\}/g, function (_match, expression) {
+    if (!entry || typeof entry !== 'object') {
+      return '';
+    }
+
+    if (!window.placeholderUtils || typeof window.placeholderUtils.resolvePlaceholderExpression !== 'function' || typeof window.placeholderUtils.formatPlaceholderValue !== 'function') {
+      return '';
+    }
+
+    return escapeHtml(window.placeholderUtils.formatPlaceholderValue(window.placeholderUtils.resolvePlaceholderExpression(entry, expression)));
+  });
+}
+
+function renderTemplate(template, context) {
+  var source = String(template || '');
+  if (!source) {
+    return '';
+  }
+  return substituteTimetableVariables(source, context);
+}
+
+function getTimetableGroups() {
+  return Array.isArray(initialData && initialData.timetableGroups) ? initialData.timetableGroups : [];
+}
+
+function getGroupById(groupId, groups) {
+  var normalizedId = Number(groupId || 0);
+  return (Array.isArray(groups) ? groups : getTimetableGroups()).find(function (group) {
+    return Number(group.id) === normalizedId;
+  }) || null;
+}
+
+function getEntries(groupId, groups) {
+  var group = getGroupById(groupId, groups);
+  return group && Array.isArray(group.entries) ? group.entries : [];
+}
+
+function toDate(value) {
+  if (!value) {
+    return null;
+  }
+  var date = value instanceof Date ? value : new Date(value);
+  return Number.isNaN(date.getTime()) ? null : date;
+}
+
+function isUpcoming(entry, now) {
+  var start = toDate(entry && entry.start_datetime);
+  return Boolean(start && now < start);
+}
+
+function isLive(entry, now) {
+  var start = toDate(entry && entry.start_datetime);
+  var end = toDate(entry && entry.end_datetime);
+  return Boolean(start && end && now >= start && now < end);
+}
+
+function getVisibleEntries(groupId, displayMode, maxItems, groups) {
+  var now = new Date();
+  var entries = getEntries(groupId, groups).slice().sort(function (left, right) {
+    var leftStart = toDate(left && left.start_datetime);
+    var rightStart = toDate(right && right.start_datetime);
+    return (leftStart ? leftStart.getTime() : 0) - (rightStart ? rightStart.getTime() : 0) || Number(left.id || 0) - Number(right.id || 0);
+  });
+  var mode = String(displayMode || 'upcoming').trim().toLowerCase();
+
+  entries = entries.filter(function (entry) {
+    if (mode === 'current') {
+      return isLive(entry, now);
+    }
+    if (mode === 'both') {
+      return isUpcoming(entry, now) || isLive(entry, now);
+    }
+    return isUpcoming(entry, now);
+  });
+
+  if (!entries.length && mode === 'upcoming') {
+    entries = getEntries(groupId, groups).filter(function (entry) {
+      return isLive(entry, now);
+    });
+  }
+
+  return entries.slice(0, Math.max(1, Number(maxItems || 5)));
+}
+
+function formatDateTime(value) {
+  var date = toDate(value);
+  if (!date) {
+    return '';
+  }
+
+  try {
+    return new Intl.DateTimeFormat(undefined, {
+      month: 'short',
+      day: '2-digit',
+      hour: 'numeric',
+      minute: '2-digit'
+    }).format(date);
+  } catch (_error) {
+    return date.toLocaleString();
+  }
+}
+
+function getDefaultStyle() {
+  return {
+    font_family: 'Arial',
+    font_size: 28,
+    font_color: '#000000'
+  };
+}
+
+function getTextStyle(region, regionContent) {
+  var current = regionContent && typeof regionContent === 'object' ? regionContent : {};
+  var defaultStyle = getDefaultStyle();
+  return {
+    font_family: String(current.font_family || region.font_family || defaultStyle.font_family || 'Arial').trim() || 'Arial',
+    font_size: Math.max(8, Number(current.font_size || region.font_size || defaultStyle.font_size || 28)),
+    font_color: String(current.font_color || region.font_color || defaultStyle.font_color || '#000000').trim() || '#000000'
+  };
+}
+
+function renderRegion(region, regionContent) {
+  var value = String(regionContent && (regionContent.value !== undefined ? regionContent.value : regionContent.text !== undefined ? regionContent.text : '') || '').trim();
+  var style = getTextStyle(region, regionContent || {});
+  var groups = getTimetableGroups();
+  var groupId = regionContent && regionContent.timetable_group_id !== undefined ? regionContent.timetable_group_id : '';
+  var displayMode = regionContent && regionContent.display_mode ? regionContent.display_mode : 'upcoming';
+  var maxItems = regionContent && regionContent.max_items !== undefined ? regionContent.max_items : 5;
+  var group = getGroupById(groupId, groups);
+  var entries = getVisibleEntries(groupId, displayMode, maxItems, groups);
+  var timeZone = group && (group.timezone || group.time_zone) ? String(group.timezone || group.time_zone) : '';
+  var width = Math.max(1, Math.round(Number(region && region.pixelWidth ? region.pixelWidth : 0) || 1));
+  var height = Math.max(1, Math.round(Number(region && region.pixelHeight ? region.pixelHeight : 0) || 1));
+  var canvasScale = Number(region && region.canvasScale ? region.canvasScale : 1) || 1;
+  var contentStyle = 'width:' + width + 'px;height:' + height + 'px;transform:scale(' + canvasScale + ');transform-origin:top left;' + (style.font_family ? 'font-family:' + escapeHtml(style.font_family) + ';' : '') + (style.font_size ? 'font-size:' + Math.max(1, Math.round(Number(style.font_size))) + 'px;' : '') + (style.font_color ? 'color:' + escapeHtml(style.font_color) + ';' : '');
+
+  if (!value) {
+    return '<div class="template-region timetable" style="' + region.baseStyle + '"><div class="template-region-text-scale" style="' + contentStyle + ' overflow:hidden;"></div></div>';
+  }
+
+  return '<div class="template-region timetable" style="' + region.baseStyle + '"><div class="template-region-text-scale" style="' + contentStyle + ' overflow:hidden;">' + entries.map(function (entry, index) {
+    return '<div class="timetable-region-entry" data-timetable-entry-index="' + index + '">' + sanitizeRichText(substituteTimetableVariables(value, Object.assign({}, entry || {}, {
+      start: entry && entry.start_datetime !== undefined ? entry.start_datetime : '',
+      end: entry && entry.end_datetime !== undefined ? entry.end_datetime : '',
+      timeZone: timeZone,
+      group: group || {},
+      entries: entries,
+      index: index + 1
+    }))) + '</div>';
+  }).join('') + '</div></div>';
+}
+
+registry.register('timetable', {
+  renderRegion: renderRegion
+});

src/player/regions/video.js

@@ -111,6 +111,7 @@ function renderVideoRegion(region, regionContent) {
   var regionKey = getVideoRegionCacheKey(region);
   var cachedSrc = regionKey ? String(videoRegionLastGoodSrcCache[regionKey] || '').trim() : '';
   var cachedSrcVersioned = appendCacheBust(cachedSrc, regionContent && regionContent.cache_bust);
+  var disableAudio = regionContent && regionContent.disable_audio === undefined ? true : Boolean(regionContent && regionContent.disable_audio);
 
   if (!requestedSrc) {
     return '';
@@ -121,7 +122,7 @@ function renderVideoRegion(region, regionContent) {
       videoRegionLastGoodSrcCache[regionKey] = requestedSrc;
     }
     setVideoSourceAvailability(requestedSrc, true);
-    return '<div class="template-region video" style="' + region.baseStyle + '"><video src="' + escapeHtml(requestedSrcVersioned) + '" title="' + escapeHtml(region.label) + '" autoplay muted loop playsinline preload="auto" disablepictureinpicture oncanplay="this.play().catch(function () {})" onloadedmetadata="this.play().catch(function () {})"></video></div>';
+    return '<div class="template-region video" style="' + region.baseStyle + '"><video src="' + escapeHtml(requestedSrcVersioned) + '" title="' + escapeHtml(region.label) + '" data-disable-audio="' + (disableAudio ? '1' : '0') + '" autoplay' + (disableAudio ? ' muted' : '') + ' loop playsinline preload="auto" disablepictureinpicture oncanplay="this.play().catch(function () {})"></video></div>';
   }
 
   var requestedState = getVideoSourceAvailability(requestedSrc);
@@ -131,7 +132,7 @@ function renderVideoRegion(region, regionContent) {
     if (regionKey) {
       videoRegionLastGoodSrcCache[regionKey] = requestedSrc;
     }
-    return '<div class="template-region video" style="' + region.baseStyle + '"><video src="' + escapeHtml(requestedSrcVersioned) + '" title="' + escapeHtml(region.label) + '" autoplay muted loop playsinline preload="auto" disablepictureinpicture oncanplay="this.play().catch(function () {})" onloadedmetadata="this.play().catch(function () {})"></video></div>';
+    return '<div class="template-region video" style="' + region.baseStyle + '"><video src="' + escapeHtml(requestedSrcVersioned) + '" title="' + escapeHtml(region.label) + '" data-disable-audio="' + (disableAudio ? '1' : '0') + '" autoplay' + (disableAudio ? ' muted' : '') + ' loop playsinline preload="auto" disablepictureinpicture oncanplay="this.play().catch(function () {})"></video></div>';
   }
 
   scheduleVideoSourceProbe(regionKey, requestedSrc, false);
@@ -140,7 +141,7 @@ function renderVideoRegion(region, regionContent) {
     if (cachedSrc !== requestedSrc) {
       logVideoRegionStatus('Keeping the previous playable video until the new mirrored file finishes transferring.', 'region=' + regionKey + ' old=' + cachedSrc + ' new=' + requestedSrc);
     }
-    return '<div class="template-region video" style="' + region.baseStyle + '"><video src="' + escapeHtml(cachedSrcVersioned) + '" title="' + escapeHtml(region.label) + '" autoplay muted loop playsinline preload="auto" disablepictureinpicture oncanplay="this.play().catch(function () {})" onloadedmetadata="this.play().catch(function () {})"></video></div>';
+    return '<div class="template-region video" style="' + region.baseStyle + '"><video src="' + escapeHtml(cachedSrcVersioned) + '" title="' + escapeHtml(region.label) + '" data-disable-audio="' + (disableAudio ? '1' : '0') + '" autoplay' + (disableAudio ? ' muted' : '') + ' loop playsinline preload="auto" disablepictureinpicture oncanplay="this.play().catch(function () {})"></video></div>';
   }
 
   return '';

src/player/regions/weather.js

@@ -0,0 +1,90 @@
+// Weather region rendering for live playback.
+
+var weatherRegistry = window.pulsePlayerRegionTypes;
+var weatherPlaceholderUtils = window.placeholderUtils || {};
+
+function weatherIconForCode(code) {
+  var value = Number(code);
+  if (value === 0) return 'bi-sun';
+  if (value <= 3) return 'bi-cloud-sun';
+  if (value <= 48) return 'bi-cloud-fog';
+  if (value <= 67 || value > 77 && value <= 82) return 'bi-cloud-rain';
+  if (value <= 77) return 'bi-cloud-snow';
+  return 'bi-cloud-lightning-rain';
+}
+
+function getWeatherLocation(locationId) {
+  var locations = Array.isArray(initialData && initialData.weatherLocations) ? initialData.weatherLocations : [];
+  return locations.find(function (location) { return Number(location.id) === Number(locationId); }) || null;
+}
+
+function normalizeWeatherExpression(expression) {
+  var value = String(expression || '').trim();
+  var currentAliases = { temp: 'current.temperature_2m', temp_unit: 'current.temperature_unit', feels_like: 'current.apparent_temperature', humidity: 'current.relative_humidity_2m', code: 'current.weather_code', wind: 'current.wind_speed_10m', wind_unit: 'current.wind_speed_unit', precip: 'current.precipitation', precip_unit: 'current.precipitation_unit', uv_index: 'current.uv_index', cloud_cover: 'current.cloud_cover', icon: 'current.weather_code.icon' };
+  var globalAliases = { temp_unit: 'temperature_unit', wind_unit: 'wind_speed_unit', precip_unit: 'precipitation_unit' };
+  if (globalAliases[value]) return globalAliases[value];
+  var currentField = value.replace(/^current\./, '');
+  var currentMatch = currentField.match(/^([^.()]+)((?:\(.*\))|(?:\..*))?$/);
+  if (currentMatch && currentAliases[currentMatch[1]]) return currentAliases[currentMatch[1]] + (currentMatch[2] || '');
+  var indexed = value.match(/^(daily|hourly)\.(\d+)\.(.+)$/);
+  if (!indexed) return value;
+  var fieldMatch = indexed[3].match(/^([^.()]+)((?:\(.*\))|(?:\..*))?$/);
+  var field = fieldMatch ? fieldMatch[1] : indexed[3];
+  var aliases = indexed[1] === 'daily' ? { time: 'time', code: 'weather_code', temp_max: 'temperature_2m_max', temp_min: 'temperature_2m_min', precip: 'precipitation_sum', wind: 'wind_speed_10m_max', uv_index: 'uv_index_max', cloud_cover: 'cloud_cover_mean', sunrise: 'sunrise', sunset: 'sunset', icon: 'weather_code' } : { time: 'time', code: 'weather_code', temp: 'temperature_2m', precip: 'precipitation', wind: 'wind_speed_10m', uv_index: 'uv_index', cloud_cover: 'cloud_cover', icon: 'weather_code' };
+  if (!Object.prototype.hasOwnProperty.call(aliases, field)) return value;
+  return field === 'icon' ? indexed[1] + '.' + aliases[field] + '.' + indexed[2] + '.icon' + (fieldMatch[2] || '') : indexed[1] + '.' + aliases[field] + '.' + indexed[2] + (fieldMatch[2] || '');
+}
+
+function withWeatherUnits(snapshot, location) {
+  var data = Object.assign({}, snapshot, { location_label: location.location_label || '', name: location.name || '', timezone: location.timezone || '', temp_unit: location.temperature_unit === 'fahrenheit' ? '°F' : '°C', wind_unit: location.wind_unit === 'mph' ? 'mph' : location.wind_unit === 'ms' ? 'm/s' : 'km/h', precip_unit: location.precipitation_unit === 'inch' ? 'in' : 'mm' });
+  var temperatureUnit = location.temperature_unit === 'fahrenheit' ? '°F' : '°C';
+  var windUnit = location.wind_unit === 'mph' ? 'mph' : location.wind_unit === 'ms' ? 'm/s' : 'km/h';
+  var precipitationUnit = location.precipitation_unit === 'inch' ? 'in' : 'mm';
+  data.current = Object.assign({}, snapshot.current || {}, { temperature_unit: temperatureUnit, wind_speed_unit: windUnit, precipitation_unit: precipitationUnit });
+  data.daily = Object.assign({}, snapshot.daily || {}, { temperature_unit: temperatureUnit });
+  data.hourly = Object.assign({}, snapshot.hourly || {}, { temperature_unit: temperatureUnit });
+  return data;
+}
+
+function substituteWeatherVariables(html, value) {
+  return String(html || '').replace(/\{\{\s*([^{}]+?)\s*\}\}/g, function (_match, expression) {
+    if (!value || typeof value !== 'object' || typeof weatherPlaceholderUtils.resolvePlaceholderExpression !== 'function' || typeof weatherPlaceholderUtils.formatPlaceholderValue !== 'function') return '';
+    var rawExpression = String(expression).trim();
+    var normalizedExpression = normalizeWeatherExpression(rawExpression);
+    var iconMatch = normalizedExpression.match(/^(?:current\.weather_code|daily\.weather_code\.\d+|hourly\.weather_code\.\d+)\.icon(?:\((\d+)(?:\s*,\s*(\d+))?\))?$/);
+    if (iconMatch) {
+      var codeExpression = normalizedExpression.replace(/\.icon(?:\(.*\))?$/, '');
+      var width = iconMatch[1] ? Math.max(1, Math.min(1000, Number(iconMatch[1]))) : 0;
+      var height = iconMatch[2] ? Math.max(1, Math.min(1000, Number(iconMatch[2]))) : width;
+      var style = width ? ' style="display:inline-block;vertical-align:middle;font-size:' + width + 'px;line-height:' + height + 'px;width:' + width + 'px;height:' + height + 'px;"' : '';
+        var weatherCode = weatherPlaceholderUtils.resolvePlaceholderExpression(value, codeExpression, { timeZone: value.timezone });
+        var icon = '<i class="bi ' + weatherIconForCode(weatherCode) + '"' + style + ' aria-hidden="true"></i>';
+        return width ? '<span style="display:inline-flex;align-items:center;justify-content:center;box-sizing:border-box;width:' + width + 'px;height:' + height + 'px;">' + icon + '</span>' : icon;
+    }
+    return escapeHtml(weatherPlaceholderUtils.formatPlaceholderValue(weatherPlaceholderUtils.resolvePlaceholderExpression(value, normalizeWeatherExpression(expression), { timeZone: value.timezone })));
+  });
+}
+
+function renderWeatherRegion(region, regionContent) {
+  var location = getWeatherLocation(regionContent && regionContent.weather_location_id);
+  var snapshot = location && location.responseJson && typeof location.responseJson === 'object' ? location.responseJson : null;
+  var width = Math.max(1, Math.round(Number(region && region.pixelWidth) || 1));
+  var height = Math.max(1, Math.round(Number(region && region.pixelHeight) || 1));
+  var scale = Number(region && region.canvasScale) || 1;
+  var style = 'width:' + width + 'px;height:' + height + 'px;transform:scale(' + scale + ');transform-origin:top left;overflow:hidden;';
+  if (!location || !snapshot) return '<div class="template-region weather" style="' + region.baseStyle + '"><div style="' + style + '"></div></div>';
+  var current = snapshot.current || {};
+  var value = String(regionContent && regionContent.value || '');
+  if (value) {
+    var weatherData = withWeatherUnits(snapshot, location);
+    var fontSize = Math.max(8, Number(regionContent && regionContent.font_size || region && (region.font_size || region.fontSize) || 32) || 32);
+    return '<div class="template-region weather" style="' + region.baseStyle + '"><div style="' + style + 'font-family:Arial,sans-serif;font-size:' + fontSize + 'px;line-height:1.5;">' + renderEditorJsContent(substituteWeatherVariables(value, weatherData)) + '</div></div>';
+  }
+  var daily = snapshot.daily || {};
+  var days = (daily.time || []).slice(0, 7).map(function (day, index) {
+    return '<div class="weather-region-day"><strong>' + escapeHtml(index === 0 ? 'Today' : String(day).slice(5)) + '</strong><i class="bi ' + weatherIconForCode(daily.weather_code && daily.weather_code[index]) + '"></i><span>' + escapeHtml(daily.temperature_2m_max && daily.temperature_2m_max[index] !== undefined ? daily.temperature_2m_max[index] + '°' : '-') + '</span></div>';
+  }).join('');
+  return '<div class="template-region weather" style="' + region.baseStyle + '"><div style="' + style + 'padding:3%;font-family:Arial,sans-serif;"><div style="display:flex;align-items:center;justify-content:space-between;"><div><div style="font-size:.8em;opacity:.72;">' + escapeHtml(location.location_label || location.name) + '</div><strong style="font-size:2em;">' + escapeHtml(current.temperature_2m === undefined ? '-' : current.temperature_2m) + '°</strong></div><i class="bi ' + weatherIconForCode(current.weather_code) + '" style="font-size:3em;"></i></div><div style="display:grid;grid-template-columns:repeat(7,minmax(0,1fr));gap:.35em;margin-top:1em;">' + days + '</div></div></div>';
+}
+
+weatherRegistry.register('weather', { renderRegion: renderWeatherRegion });

src/player/regions/webpage.js

@@ -2,12 +2,38 @@
 
 var registry = window.pulsePlayerRegionTypes;
 
+function normalizeRenderableValue(value) {
+  if (value && typeof value === 'object') {
+    if (value.value !== undefined) {
+      return normalizeRenderableValue(value.value);
+    }
+    if (value.text !== undefined) {
+      return normalizeRenderableValue(value.text);
+    }
+    if (value.url !== undefined) {
+      return normalizeRenderableValue(value.url);
+    }
+    if (value.href !== undefined) {
+      return normalizeRenderableValue(value.href);
+    }
+    if (value.src !== undefined) {
+      return normalizeRenderableValue(value.src);
+    }
+    if (value.content !== undefined) {
+      return normalizeRenderableValue(value.content);
+    }
+    return '';
+  }
+
+  return String(value === undefined || value === null ? '' : value);
+}
+
 function renderWebpageRegion(region, regionContent) {
-  var url = String(regionContent.value || '').trim();
+  var url = normalizeRenderableValue(regionContent && regionContent.value !== undefined ? regionContent.value : '').trim();
   if (!url) {
     return '';
   }
-  return '<div class="template-region webpage" style="' + region.baseStyle + '"><iframe src="' + escapeHtml(url) + '" title="' + escapeHtml(region.label) + '" loading="eager" referrerpolicy="no-referrer" scrolling="no"></iframe></div>';
+  return '<div class="template-region webpage" style="' + region.baseStyle + '"><iframe src="' + escapeHtml(url) + '" title="' + escapeHtml(region.label) + '" loading="eager" referrerpolicy="no-referrer" scrolling="no" style="width:100%;height:100%;border:0;display:block;background:#fff;overflow:hidden;"></iframe></div>';
 }
 
 registry.register('webpage', {

src/player/render-helpers.js

@@ -25,6 +25,14 @@ function escapeHtml(value) {
     .replace(/'/g, ''');
 }
 
+function normalizeStyleAttributeValue(value) {
+  return String(value || '')
+    .replace(/"/g, '"')
+    .replace(/'/g, "'")
+    .replace(/"/g, '"')
+    .replace(/'/g, "'");
+}
+
 function sanitizeFontFamily(value) {
   return String(value || '').replace(/[^a-zA-Z0-9 ,"-]/g, '').trim();
 }
@@ -41,7 +49,7 @@ function sanitizeTextColor(value, fallback) {
   return fallback || '#000000';
 }
 
-const ALLOWED_RICH_TEXT_TAGS = ['a', 'b', 'blockquote', 'br', 'code', 'div', 'em', 'figure', 'figcaption', 'h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'hr', 'i', 'li', 'ol', 'p', 'pre', 'span', 'strong', 'sub', 'sup', 'table', 'tbody', 'td', 'th', 'thead', 'tr', 'u', 'ul'];
+const ALLOWED_RICH_TEXT_TAGS = ['a', 'b', 'blockquote', 'br', 'code', 'col', 'colgroup', 'div', 'em', 'figure', 'figcaption', 'h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'hr', 'i', 'img', 'li', 'ol', 'p', 'pre', 'span', 'strong', 'sub', 'sup', 'table', 'tbody', 'td', 'th', 'thead', 'tr', 'u', 'ul'];
 
 function sanitizeRichTextAttributes(tagName, attrText) {
   const allowedAttributes = {
@@ -56,6 +64,10 @@ function sanitizeRichTextAttributes(tagName, attrText) {
     h4: ['class', 'style'],
     h5: ['class', 'style'],
     h6: ['class', 'style'],
+    i: ['class', 'style', 'aria-hidden'],
+    img: ['src', 'alt', 'title', 'width', 'height', 'class', 'style', 'loading', 'decoding'],
+    col: ['class', 'style', 'span', 'width'],
+    colgroup: ['class', 'style', 'span'],
     li: ['class', 'style'],
     ol: ['class', 'style', 'start'],
     p: ['class', 'style'],
@@ -72,6 +84,14 @@ function sanitizeRichTextAttributes(tagName, attrText) {
     return '';
   }
 
+  if (tagName === 'img') {
+    const srcMatch = String(attrText || '').match(/\bsrc\s*=\s*("([^"]*)"|'([^']*)'|([^\s"'>/=`]+))/i);
+    const srcValue = srcMatch ? String(srcMatch[2] !== undefined ? srcMatch[2] : srcMatch[3] !== undefined ? srcMatch[3] : srcMatch[4] !== undefined ? srcMatch[4] : '').trim() : '';
+    if (!srcValue || !/^(?:https?:\/\/|\/media\/|\/assets\/|\/[^/]|data:image\/)/i.test(srcValue)) {
+      return '';
+    }
+  }
+
   const attrs = [];
   String(attrText || '').replace(/([a-zA-Z0-9:-]+)(?:\s*=\s*("([^"]*)"|'([^']*)'|([^\s"'>/=`]+)))?/g, (_full, key, _valuePart, doubleQuoted, singleQuoted, bareValue) => {
     const lowerKey = String(key || '').toLowerCase();
@@ -95,7 +115,7 @@ function sanitizeRichTextAttributes(tagName, attrText) {
         return '';
       }
     }
-    attrs.push(' ' + lowerKey + '="' + escapeHtml(value) + '"');
+    attrs.push(' ' + lowerKey + '="' + escapeHtml(lowerKey === 'style' ? normalizeStyleAttributeValue(value) : value) + '"');
     return '';
   });
 
@@ -268,12 +288,45 @@ function renderEditorJsContent(value) {
   return wrapRichTextParagraph(sanitizeRichText(raw));
 }
 
+function buildHtmlDocument(html) {
+  const raw = String(html || '').trim();
+  if (!raw) {
+    return '';
+  }
+
+  if (/^<!doctype\b/i.test(raw) || /^<html\b/i.test(raw)) {
+    return raw;
+  }
+
+  return '<!doctype html><html><head><style>html,body{margin:0;width:100%;height:100%;overflow:hidden;background:transparent;}</style></head><body>' + raw + '</body></html>';
+}
+
 function renderHtmlRegionContent(value) {
-  const html = String(value || '').trim();
+  const html = normalizeRenderableValue(value).trim();
   if (!html) {
     return '<div class="template-region-placeholder">HTML</div>';
   }
-  return '<iframe class="template-region-html-frame" sandbox="" srcdoc="' + escapeHtml(html) + '" title="HTML region" loading="eager"></iframe>';
+  return '<iframe class="template-region-html-frame" sandbox="" srcdoc="' + escapeHtml(buildHtmlDocument(html)) + '" title="HTML region" loading="eager" style="width:100%;height:100%;border:0;display:block;background:transparent;overflow:hidden;"></iframe>';
+}
+
+function normalizeRenderableValue(value) {
+  if (value && typeof value === 'object') {
+    if (value.value !== undefined) {
+      return normalizeRenderableValue(value.value);
+    }
+    if (value.text !== undefined) {
+      return normalizeRenderableValue(value.text);
+    }
+    if (value.html !== undefined) {
+      return normalizeRenderableValue(value.html);
+    }
+    if (value.content !== undefined) {
+      return normalizeRenderableValue(value.content);
+    }
+    return '';
+  }
+
+  return String(value === undefined || value === null ? '' : value);
 }
 
 function fitCanvasSize(canvasWidth, canvasHeight, maxWidth, maxHeight) {
@@ -374,7 +427,7 @@ function getPlayerAnnouncementTemplatesScript() {
 function getAnnouncementIconsDataScript() {
   return [
     '(function () {',
-    '  window.pulseAnnouncementIconKeys = ' + safeJsonForScript(announcementIcons.ANNOUNCEMENT_ICON_KEYS) + ';',
+    '  window.pulseAnnouncementIconKeys = ' + safeJsonForScript(announcementIcons.ANNOUNCEMENT_ICON_CATALOG_KEYS) + ';',
     '  window.pulseAnnouncementDefaultIconKey = ' + safeJsonForScript(announcementIcons.DEFAULT_ANNOUNCEMENT_ICON) + ';',
     '}());'
   ].join('\n');
@@ -442,8 +495,9 @@ function getPlayerRegionScriptPaths() {
 
 function getPlayerRegionScripts() {
   const sharedPlaceholderUtilsPath = path.join(__dirname, '..', 'web', 'public', 'js', 'shared', 'placeholder-utils.js');
+  const sharedQrSvgUtilsPath = path.join(__dirname, '..', 'web', 'public', 'js', 'shared', 'qr-code-svg.js');
   const playerRegionScriptPaths = getPlayerRegionScriptPaths();
-  const scriptPaths = [sharedPlaceholderUtilsPath].concat(playerRegionScriptPaths);
+  const scriptPaths = [sharedPlaceholderUtilsPath, sharedQrSvgUtilsPath].concat(playerRegionScriptPaths);
   const statSignature = scriptPaths.map(function (filePath) {
     return fs.statSync(filePath).mtimeMs;
   }).join('|');

src/player/render.js

@@ -4,7 +4,7 @@ const Handlebars = require('handlebars');
 const path = require('path');
 const { mediaKind, safeJsonForScript, getPlayerPageTemplate, getPlayerClientNameScript, getPlayerPageOfflineScript, getPlayerPagePlaylistScript, getPlayerPageCommandsScript, getPlayerPageRenderingScript, getPlayerPagePlaybackScript, getAnnouncementIconsDataScript, getPlayerAnnouncementTemplatesDataScript, getPlayerAnnouncementTemplatesScript, getPlayerPageAnnouncementsScript, getPlayerPageScript, getPlayerRegionScripts, getPlayerOnboardingLandingScript, getPlayerOnboardingFormScript } = require('./render-helpers');
 const { createThumbnailPreviewBootstrapScript } = require('./thumbnail-preview');
-const { createPageAuthBundle, createPageFetchAuthScript } = require('../request-auth');
+const { createPageAuthBundle, createPageFetchAuthScript } = require('#src/request-auth');
 const { getFontStylesheetHref } = require('#src/web/lib/media/font-library');
 
 const PLAYER_MEDIA_DIR = path.join(__dirname, '..', '..', 'media');
@@ -27,7 +27,7 @@ function getPlayerServiceWorkerRegistrationScript() {
     '<script>',
     '  if ("serviceWorker" in navigator) {',
     '    window.addEventListener("load", function () {',
-    '      navigator.serviceWorker.register("/sw.js").catch(function () {',
+      '      navigator.serviceWorker.register("/sw.js?v=38").catch(function () {',
     '        return null;',
     '      });',
     '    });',
@@ -36,34 +36,31 @@ function getPlayerServiceWorkerRegistrationScript() {
   ].join('');
 }
 
-function renderOnboardingLandingBody() {
+function renderOnboardingLandingBody(options) {
+  const onboardingCode = String(options && options.pairingCode || '').trim();
+  const deviceId = String(options && options.deviceId || '').trim();
   return [
-    '<main class="onboarding-shell">',
+    '    <main id="onboarding-shell" class="onboarding-shell">',
-    '  <section class="onboarding-card onboarding-card--landing">',
+    '  <section class="onboarding-stage onboarding-stage--landing">',
-    '    <p class="onboarding-kicker">Pulse Signage</p>',
-    '    <h1>Onboard this player</h1>',
-    '    <p class="onboarding-copy">Choose an existing screen, name the client, and either scan the QR code or finish right here with a keyboard and mouse.</p>',
     '    <div class="onboarding-layout">',
     '      <div class="onboarding-qr-pane">',
     '        <div class="onboarding-qr-frame">',
-    '          <img id="onboarding-qr" alt="Onboarding QR code" />',
+    '          <img id="onboarding-qr" alt="Onboarding QR code" src="data:image/svg+xml;charset=utf-8,%3Csvg xmlns=%22http://www.w3.org/2000/svg%22 viewBox=%220 0 320 320%22%3E%3Crect width=%22320%22 height=%22320%22 rx=%2224%22 fill=%22%23ffffff%22/%3E%3Crect x=%2230%22 y=%2230%22 width=%22260%22 height=%22260%22 rx=%2218%22 fill=%22%23f8fafc%22 stroke=%22%23cbd5e1%22 stroke-width=%223%22 stroke-dasharray=%2212 10%22/%3E%3Cpath d=%22M106 118h108M106 156h108M106 194h72%22 stroke=%22%2394a3b8%22 stroke-width=%2214%22 stroke-linecap=%22round%22/%3E%3Ccircle cx=%22128%22 cy=%22248%22 r=%2212%22 fill=%22%2394a3b8%22/%3E%3Ctext x=%22160%22 y=%2278%22 text-anchor=%22middle%22 fill=%22%230f172a%22 font-family=%22Arial,sans-serif%22 font-size=%2224%22 font-weight=%22700%22%3EQR code loading%3C/text%3E%3Ctext x=%22160%22 y=%22266%22 text-anchor=%22middle%22 fill=%22%234b5563%22 font-family=%22Arial,sans-serif%22 font-size=%2214%22%3EPlease wait%3C/text%3E%3C/svg%3E" />',
+    '        </div>',
+    '        <p class="onboarding-qr-caption">Scan this QR code with your phone</p>',
+    '      </div>',
+    '      <div class="onboarding-copy-panel">',
+    '        <p class="onboarding-kicker onboarding-brand-title">Pulse Signage</p>',
+    '        <h1>Quickly set up with your phone</h1>',
+    '        <ol class="onboarding-instructions">',
+    '          <li>Open the camera and scan the QR code.</li>',
+    '          <li>Log in to Pulse Signage and choose a screen.</li>',
+    '        </ol>',
+    '        <div class="onboarding-pin-block">',
+    '          <span class="onboarding-pin-label">Pairing Code</span>',
+    '          <strong id="onboarding-pairing-code" class="onboarding-pin">' + Handlebars.escapeExpression(onboardingCode || 'Loading...') + '</strong>',
     '        </div>',
-    '        <div id="onboarding-status" class="onboarding-status">Preparing onboarding link...</div>',
     '      </div>',
-    '      <form id="onboarding-local-form" class="onboarding-form onboarding-form--local">',
-    '        <label>',
-    '          <span>Client name</span>',
-    '          <input name="clientName" type="text" maxlength="255" required placeholder="Lobby player" autocomplete="off" />',
-    '        </label>',
-    '        <label>',
-    '          <span>Screen</span>',
-    '          <select name="screenSlug" id="onboarding-screen-select" required>',
-    '            <option value="">Loading screens...</option>',
-    '          </select>',
-    '        </label>',
-    '        <button type="submit">Save client</button>',
-    '        <div id="onboarding-message" class="onboarding-status"></div>',
-    '      </form>',
     '    </div>',
     '  </section>',
     '</main>'
@@ -79,6 +76,10 @@ function renderOnboardingFormBody(deviceId) {
     '    <p class="onboarding-copy">Pick an existing screen and give this player a friendly name that will persist after refreshes.</p>',
     '    <form id="onboarding-form" class="onboarding-form">',
     '      <label>',
+    '        <span>Pairing code</span>',
+    '        <input name="pairingCode" type="text" inputmode="numeric" pattern="[0-9]{6}" maxlength="6" required autocomplete="one-time-code" placeholder="Enter the code shown on the kiosk" />',
+    '      </label>',
+    '      <label>',
     '        <span>Client name</span>',
     '        <input name="clientName" type="text" maxlength="255" required placeholder="Lobby player" />',
     '      </label>',
@@ -120,6 +121,7 @@ function renderPlayerPage(slug, initialData) {
   const hlsScriptTag = '<script src="/assets/vendor/hls.min.js"></script>';
   const pageAuthToken = createPageAuthBundle({ scope: 'player', slug: String(slug || '').trim() });
   const fontStylesheetHref = getFontStylesheetHref(PLAYER_MEDIA_DIR);
+  const bodyClass = [initialData && initialData.thumbnailPreview ? 'thumbnail-preview' : '', ''].join(' ').trim();
   const script = getPlayerPageScript()({
     SLUG_JSON: new Handlebars.SafeString(JSON.stringify(slug)),
     INITIAL_DATA_JSON: new Handlebars.SafeString(safeJsonForScript(initialData || null)),
@@ -128,19 +130,20 @@ function renderPlayerPage(slug, initialData) {
 
   return renderPage(template, {
     title: 'Screen ' + slug,
+    bodyClass: bodyClass,
     body: '<div id="app"><div class="empty">Loading screen...</div></div>',
     stylesheets: fontStylesheetHref ? [fontStylesheetHref] : [],
-    script: createPageFetchAuthScript(pageAuthToken) + hlsScriptTag + serviceWorkerScript + createThumbnailPreviewBootstrapScript(initialData) + '<script>' + offlineScript + '</script>' + '<script>' + playlistScript + '</script>' + '<script>' + commandScript + '</script>' + '<script>' + renderingScript + '</script>' + '<script>' + playbackScript + '</script>' + '<script>' + getAnnouncementIconsDataScript() + '</script>' + '<script>' + getPlayerAnnouncementTemplatesDataScript() + '</script>' + '<script>' + getPlayerAnnouncementTemplatesScript() + '</script>' + onboardingScript + script + '<script>' + getPlayerPageAnnouncementsScript()() + '</script>'
+    script: createPageFetchAuthScript(pageAuthToken, '/ws/screens/' + encodeURIComponent(slug || '')) + hlsScriptTag + serviceWorkerScript + createThumbnailPreviewBootstrapScript(initialData) + '<script>' + offlineScript + '</script>' + '<script>' + playlistScript + '</script>' + '<script>' + commandScript + '</script>' + '<script>' + renderingScript + '</script>' + '<script>' + playbackScript + '</script>' + '<script>' + getAnnouncementIconsDataScript() + '</script>' + '<script>' + getPlayerAnnouncementTemplatesDataScript() + '</script>' + '<script>' + getPlayerAnnouncementTemplatesScript() + '</script>' + onboardingScript + script + '<script>' + getPlayerPageAnnouncementsScript()() + '</script>'
   });
 }
 
-function renderPlayerOnboardingLandingPage() {
+function renderPlayerOnboardingLandingPage(options) {
   const pageAuthToken = createPageAuthBundle({ scope: 'onboarding' });
   const fontStylesheetHref = getFontStylesheetHref(PLAYER_MEDIA_DIR);
   return renderPage(getPlayerPageTemplate(), {
     title: 'Onboard player',
     bodyClass: 'onboarding-page',
-    body: renderOnboardingLandingBody(),
+    body: renderOnboardingLandingBody(options),
     stylesheets: fontStylesheetHref ? [fontStylesheetHref] : [],
     script: createPageFetchAuthScript(pageAuthToken) + getPlayerServiceWorkerRegistrationScript() + renderOnboardingLandingScript()
   });

src/player/routes.js

@@ -3,7 +3,8 @@
 const fs = require('fs');
 const express = require('express');
 const path = require('path');
-const { getSharedSecret, createPageAuthBundle, verifyPageAuthToken, verifyRequestAuth } = require('../request-auth');
+const { getSharedSecret, createPageAuthBundle, verifyPageAuthToken, verifyRequestAuth, createRequestAuthHeaders } = require('#src/request-auth');
+const { getPlayerPublicBaseUrl } = require('./onboarding');
 const { buildThumbnailPreviewData } = require('./thumbnail-preview');
 
 const TRANSIENT_DB_ERROR_CODES = ['ECONNREFUSED', 'ECONNRESET', 'ETIMEDOUT', 'EPIPE', 'ENOTFOUND', 'PROTOCOL_CONNECTION_LOST', 'POOL_CLOSED', 'ERR_POOL_CLOSED'];
@@ -12,6 +13,17 @@ function isTransientDbError(error) {
   return Boolean(error && TRANSIENT_DB_ERROR_CODES.indexOf(String(error.code || '').trim()) !== -1);
 }
 
+function isBridgeFetchError(error) {
+  const message = String(error && error.message || '').toLowerCase();
+  return Boolean(error && (
+    message.indexOf('fetch failed') !== -1 ||
+    message.indexOf('network error') !== -1 ||
+    message.indexOf('econnreset') !== -1 ||
+    message.indexOf('econnrefused') !== -1 ||
+    message.indexOf('enotfound') !== -1
+  ));
+}
+
 function registerPlayerRoutes(app, options) {
   const pool = options && options.pool ? options.pool : null;
   const common = options && options.common ? options.common : null;
@@ -20,16 +32,144 @@ function registerPlayerRoutes(app, options) {
   const playerRuntime = options && options.playerRuntime ? options.playerRuntime : null;
   const playerPlaylistService = options && options.playerPlaylistService ? options.playerPlaylistService : null;
   const rtmpStreamService = options && options.rtmpStreamService ? options.rtmpStreamService : null;
-  const playerPublicBaseUrl = String(options && options.playerPublicBaseUrl || process.env.PLAYER_PUBLIC_BASE_URL || process.env.PLAYER_BASE_URL || '').trim().replace(/\/$/, '');
+  const playerInternalUrl = String(options && options.playerInternalBaseUrl || process.env.PLAYER_INTERNAL_URL || process.env.PLAYER_BASE_URL || '').trim().replace(/\/$/, '');
-  const playerInternalBaseUrl = String(options && options.playerInternalBaseUrl || process.env.PLAYER_INTERNAL_BASE_URL || process.env.PLAYER_BASE_URL || '').trim().replace(/\/$/, '');
+  const bridgeBaseUrl = String(options && options.bridgeBaseUrl || process.env.BRIDGE_PUBLIC_URL || '').trim().replace(/\/$/, '');
-  const playerIdentifier = String(options && options.playerIdentifier || '1').trim() || '1';
+  const playerDeviceId = String(options && options.playerDeviceId || '').trim() || null;
+  const onPlayerPublicBaseUrl = typeof options.onPlayerPublicBaseUrl === 'function' ? options.onPlayerPublicBaseUrl : null;
 
-  if (!app || !pool || !common || !mediaDir || !assetDir || !playerRuntime || !playerPlaylistService || !rtmpStreamService) {
+  if (!app || !common || !mediaDir || !assetDir || !playerRuntime || !rtmpStreamService) {
-    throw new Error('registerPlayerRoutes requires app, pool, common, mediaDir, assetDir, playerRuntime, playerPlaylistService, and rtmpStreamService.');
+    throw new Error('registerPlayerRoutes requires app, common, mediaDir, assetDir, playerRuntime, and rtmpStreamService.');
+  }
+
+  if (!bridgeBaseUrl && (!pool || !playerPlaylistService)) {
+    throw new Error('registerPlayerRoutes requires pool and playerPlaylistService unless bridgeBaseUrl is configured.');
   }
 
   const sharedSecret = getSharedSecret();
 
+  async function fetchBridge(req, pathname, options) {
+    if (!bridgeBaseUrl) {
+      return null;
+    }
+
+    const requestOptions = options && typeof options === 'object' ? options : {};
+    const method = String(requestOptions.method || req.method || 'GET').trim().toUpperCase();
+    const body = Object.prototype.hasOwnProperty.call(requestOptions, 'body') ? requestOptions.body : undefined;
+    const requestPathname = String(pathname || '').split('?')[0];
+    const headers = Object.assign({}, requestOptions.headers || {}, createRequestAuthHeaders({
+      method: method,
+      pathname: requestPathname,
+      body: body
+    }));
+
+    const requestHeaders = req && req.headers ? req.headers : {};
+    if (requestHeaders['x-pulse-page-auth']) {
+      headers['x-pulse-page-auth'] = String(requestHeaders['x-pulse-page-auth']).trim();
+    }
+    if (requestHeaders['if-none-match']) {
+      headers['if-none-match'] = String(requestHeaders['if-none-match']).trim();
+    }
+    if (requestHeaders['x-pulse-client-id']) {
+      headers['x-pulse-client-id'] = String(requestHeaders['x-pulse-client-id']).trim();
+    }
+    if (requestOptions.contentType) {
+      headers['content-type'] = requestOptions.contentType;
+    }
+
+    return fetch(new URL(pathname, bridgeBaseUrl).toString(), {
+      method: method,
+      headers: headers,
+      body: body === undefined || body === null || method === 'GET' || method === 'HEAD' ? undefined : body
+    });
+  }
+
+  async function readJsonResponse(response) {
+    if (!response) {
+      return null;
+    }
+
+    const contentType = String(response.headers && typeof response.headers.get === 'function' ? response.headers.get('content-type') : '').toLowerCase();
+    if (contentType.indexOf('application/json') === -1 && contentType.indexOf('+json') === -1) {
+      return null;
+    }
+
+    try {
+      return await response.json();
+    } catch (_error) {
+      return null;
+    }
+  }
+
+  async function getBoundScreenSlug(req) {
+    if (!playerDeviceId) {
+      return null;
+    }
+
+    const clientId = String(req.query && req.query.clientId || '').trim();
+    if (!clientId) {
+      return null;
+    }
+    const bindingId = clientId;
+
+    if (bridgeBaseUrl) {
+      const response = await fetchBridge(req, '/api/onboarding/status?deviceId=' + encodeURIComponent(bindingId), {
+        method: 'GET'
+      });
+      const status = await readJsonResponse(response);
+      return status && status.screenSlug ? String(status.screenSlug).trim() : null;
+    }
+
+    const [rows] = await pool.query(
+      `SELECT s.slug
+         FROM d_onboarding_devices d
+         JOIN d_screens s ON s.id = d.screen_id
+        WHERE d.device_id = ?`,
+      [bindingId]
+    );
+    return rows[0] && rows[0].slug ? String(rows[0].slug).trim() : null;
+  }
+
+  async function isClientAuthorizedForScreen(req, requestedSlug) {
+    const clientId = String(req.headers['x-pulse-client-id'] || '').trim();
+    if (!clientId) {
+      return false;
+    }
+    const boundSlug = await getBoundScreenSlug({ query: { clientId: clientId } });
+    return boundSlug === String(requestedSlug || '').trim();
+  }
+
+  function isAuthorizedScreenMove(req, requestedSlug) {
+    const queryToken = String(req.query && req.query.moveToken || '').trim();
+    const cookieHeader = String(req.headers && req.headers.cookie || '');
+    const cookieToken = cookieHeader.split(';').map(function (part) {
+      const separator = part.indexOf('=');
+      return separator === -1 ? null : [part.slice(0, separator).trim(), part.slice(separator + 1).trim()];
+    }).filter(Boolean).find(function (entry) { return entry[0] === 'pulse-screen-move'; });
+    const token = queryToken || (cookieToken ? decodeURIComponent(cookieToken[1]) : '');
+    if (!token) {
+      return false;
+    }
+
+    const payload = verifyPageAuthToken(token);
+    return Boolean(payload
+      && String(payload.scope || '').trim() === 'screen-move'
+      && String(payload.playerId || '').trim() === String(playerDeviceId || '').trim()
+      && String(payload.screenSlug || '').trim() === String(requestedSlug || '').trim());
+  }
+
+  app.post('/api/screen-move-authorize', express.json(), function (req, res) {
+    const token = String(req.body && req.body.moveToken || '').trim();
+    const payload = verifyPageAuthToken(token);
+    if (!payload
+      || String(payload.scope || '').trim() !== 'screen-move'
+      || String(payload.playerId || '').trim() !== String(playerDeviceId || '').trim()) {
+      return res.status(401).json({ error: 'Invalid screen move authorization.' });
+    }
+
+    res.setHeader('Set-Cookie', `pulse-screen-move=${encodeURIComponent(token)}; Max-Age=60; Path=/; HttpOnly; SameSite=Lax`);
+    return res.json({ ok: true });
+  });
+
   function requirePageAuth(allowedScopes) {
     return function (req, res, next) {
       if (!sharedSecret) {
@@ -114,6 +254,26 @@ function registerPlayerRoutes(app, options) {
   });
 
   app.get('/api/media/config', requireRequestAuth, function (_req, res) {
+    if (bridgeBaseUrl) {
+      void fetch(new URL('/api/media/config', bridgeBaseUrl).toString(), {
+        method: 'GET',
+        headers: createRequestAuthHeaders({
+          method: 'GET',
+          pathname: '/api/media/config'
+        })
+      }).then(async function (response) {
+        res.status(response.status);
+        const contentType = response.headers.get('content-type');
+        if (contentType) {
+          res.type(contentType);
+        }
+        res.send(await response.text());
+      }).catch(function (_error) {
+        res.status(502).json({ error: 'Thin client unavailable.' });
+      });
+      return;
+    }
+
     res.json({
       mediaDir: mediaDir,
       uploadDir: path.join(mediaDir, 'uploads')
@@ -210,18 +370,44 @@ function registerPlayerRoutes(app, options) {
     }
   });
 
-  app.get('/screen/:slug', function (req, res) {
+  app.get('/screen/:slug', async function (req, res, next) {
+    if (onPlayerPublicBaseUrl) {
+      try {
+        onPlayerPublicBaseUrl(getPlayerPublicBaseUrl(req, null));
+      } catch (_error) {
+      }
+    }
+
     res.set('Cache-Control', 'no-store, no-cache, must-revalidate, proxy-revalidate');
     res.set('Pragma', 'no-cache');
-    const { bindPlayerToScreen } = require('./onboarding');
+    if (bridgeBaseUrl) {
-    if (playerIdentifier) {
+      const pageAuthToken = createPageAuthBundle({ scope: 'player', slug: String(req.params.slug || '').trim() }).token;
-      void bindPlayerToScreen(pool, playerIdentifier, req.params.slug)
+      void fetchBridge(req, '/api/screens/' + encodeURIComponent(req.params.slug) + '/playlist?ts=' + Date.now(), {
-        .catch(function (error) {
+        method: 'GET',
-          console.error(error);
+        headers: pageAuthToken ? { 'x-pulse-page-auth': pageAuthToken } : {}
-        });
+      }).then(async function (response) {
+        if (!response || response.status >= 400) {
+          res.set('X-Player-Offline', '1');
+          return res.send(common.renderPlayerPage(req.params.slug, null));
         }
+        const data = await readJsonResponse(response);
+        if (!data) {
+          res.set('X-Player-Offline', '1');
+          return res.send(common.renderPlayerPage(req.params.slug, null));
+        }
+        res.send(common.renderPlayerPage(req.params.slug, null));
+      }).catch(function (error) {
+        if (!isBridgeFetchError(error)) {
+          console.error(error);
+        }
+        res.set('X-Player-Offline', '1');
+        res.send(common.renderPlayerPage(req.params.slug, null));
+      });
+      return;
+    }
+
     playerPlaylistService.buildScreenPlaylist(req.params.slug).then(function (data) {
-      res.send(common.renderPlayerPage(req.params.slug, data));
+      res.send(common.renderPlayerPage(req.params.slug, null));
     }).catch(function (error) {
       console.error(error);
       res.set('X-Player-Offline', '1');
@@ -231,6 +417,19 @@ function registerPlayerRoutes(app, options) {
 
   app.get('/api/internal/slide-thumbnails/:id/preview', requireRequestAuth, async function (req, res, next) {
     try {
+      if (bridgeBaseUrl) {
+        const response = await fetchBridge(req, '/api/internal/slide-thumbnails/' + encodeURIComponent(req.params.id) + '/preview', {
+          method: 'GET'
+        });
+        if (!response) {
+          return res.status(502).send('Thin client unavailable');
+        }
+        res.status(response.status);
+        res.set('Cache-Control', response.headers.get('cache-control') || 'no-store, no-cache, must-revalidate, proxy-revalidate');
+        res.type(response.headers.get('content-type') || 'text/html; charset=utf-8');
+        return res.send(await response.text());
+      }
+
       const slide = await common.fetchSlideById(pool, Number(req.params.id));
       if (!slide) {
         return res.status(404).send('Slide not found');
@@ -259,6 +458,11 @@ function registerPlayerRoutes(app, options) {
         });
       }
 
+      if (typeof common.fetchTimetablesData === 'function') {
+        const timetableData = await common.fetchTimetablesData(pool);
+        data.timetableGroups = Array.isArray(timetableData && timetableData.timetableGroups) ? timetableData.timetableGroups : [];
+      }
+
       res.set('Cache-Control', 'no-store, no-cache, must-revalidate, proxy-revalidate');
       res.send(common.renderPlayerPage('slide-thumbnail-preview-' + slide.id, data));
     } catch (error) {
@@ -268,6 +472,32 @@ function registerPlayerRoutes(app, options) {
 
   app.get('/api/screens/:slug/playlist', requirePageAuth(['player']), async function (req, res, next) {
     try {
+      if (playerDeviceId && !(await isClientAuthorizedForScreen(req, req.params.slug))) {
+        return res.status(403).json({ error: 'This browser tab is not authorized for this screen.' });
+      }
+      if (bridgeBaseUrl) {
+        const response = await fetchBridge(req, '/api/screens/' + encodeURIComponent(req.params.slug) + '/playlist', {
+          method: 'GET'
+        });
+        if (!response) {
+          return res.status(502).json({ error: 'Thin client unavailable.' });
+        }
+        res.status(response.status);
+        const etag = response.headers.get('etag');
+        const cacheControl = response.headers.get('cache-control');
+        if (etag) {
+          res.set('ETag', etag);
+        }
+        if (cacheControl) {
+          res.set('Cache-Control', cacheControl);
+        }
+        if (response.status === 304) {
+          return res.end();
+        }
+        res.type(response.headers.get('content-type') || 'application/json');
+        return res.send(await response.text());
+      }
+
       res.set('Cache-Control', 'no-store, no-cache, must-revalidate, proxy-revalidate');
       const data = await playerPlaylistService.buildScreenPlaylist(req.params.slug);
       if (!data.screen) {
@@ -288,6 +518,32 @@ function registerPlayerRoutes(app, options) {
 
   app.get('/api/screens/:slug/announcement', requirePageAuth(['player']), async function (req, res, next) {
     try {
+      if (playerDeviceId && !(await isClientAuthorizedForScreen(req, req.params.slug))) {
+        return res.status(403).json({ error: 'This browser tab is not authorized for this screen.' });
+      }
+      if (bridgeBaseUrl) {
+        const response = await fetchBridge(req, '/api/screens/' + encodeURIComponent(req.params.slug) + '/announcement', {
+          method: 'GET'
+        });
+        if (!response) {
+          return res.status(502).json({ error: 'Thin client unavailable.' });
+        }
+        res.status(response.status);
+        const etag = response.headers.get('etag');
+        const cacheControl = response.headers.get('cache-control');
+        if (etag) {
+          res.set('ETag', etag);
+        }
+        if (cacheControl) {
+          res.set('Cache-Control', cacheControl);
+        }
+        if (response.status === 304) {
+          return res.end();
+        }
+        res.type(response.headers.get('content-type') || 'application/json');
+        return res.send(await response.text());
+      }
+
       res.set('Cache-Control', 'no-store, no-cache, must-revalidate, proxy-revalidate');
       const announcement = typeof common.fetchActiveAnnouncement === 'function'
         ? await common.fetchActiveAnnouncement(pool, req.params.slug)
@@ -330,6 +586,7 @@ function registerPlayerRoutes(app, options) {
       const connections = playerRuntime.snapshotConnections(req.params.slug);
       let screen = null;
       let screenLookupFailed = false;
+      if (pool && typeof pool.query === 'function') {
         try {
           const [screenRows] = await pool.query('SELECT id, name, slug FROM d_screens WHERE slug = ?', [req.params.slug]);
           screen = screenRows[0] || null;
@@ -339,6 +596,7 @@ function registerPlayerRoutes(app, options) {
             throw error;
           }
         }
+      }
       res.json({
         screen: screen,
         screenSlug: req.params.slug,
@@ -369,7 +627,7 @@ function registerPlayerRoutes(app, options) {
       const isRedirectCommand = command === 'redirect';
       let screen = null;
       let screenLookupFailed = false;
-      if (!isRedirectCommand) {
+      if (!isRedirectCommand && pool && typeof pool.query === 'function') {
         try {
           const [screenRows] = await pool.query('SELECT id, name, slug FROM d_screens WHERE slug = ?', [req.params.slug]);
           screen = screenRows[0] || null;

src/player/runtime.js

@@ -2,8 +2,9 @@
 
 const crypto = require('crypto');
 const { WebSocketServer, WebSocket } = require('ws');
-const { isClientNameAvailable } = require('../data/client-name-check');
+const { isClientNameAvailable } = require('#src/data/client-name-check');
-const { verifyPageAuthToken, verifyRequestAuth } = require('../request-auth');
+const { verifyPageAuthToken, verifyRequestAuth } = require('#src/request-auth');
+const PAGE_AUTH_COOKIE_NAME = 'pulse_page_auth';
 
 function normalizePlayerPublicBaseUrl(pageUrl) {
   const value = String(pageUrl || '').trim();
@@ -20,6 +21,7 @@ function normalizePlayerPublicBaseUrl(pageUrl) {
 
 function createPlayerRuntime(options) {
   const pool = options && options.pool ? options.pool : null;
+  const notifySnapshot = typeof options.notifySnapshot === 'function' ? options.notifySnapshot : null;
   const normalizeDeviceId = typeof options.normalizeDeviceId === 'function'
     ? options.normalizeDeviceId
     : function (value) {
@@ -30,6 +32,21 @@ function createPlayerRuntime(options) {
   const announcementListenersBySlug = new Map();
   const wss = new WebSocketServer({ noServer: true });
 
+  function hasActiveClientId(clientId, currentConnection) {
+    const normalizedClientId = String(clientId || '').trim();
+    if (!normalizedClientId) {
+      return false;
+    }
+    for (const connections of connectionsBySlug.values()) {
+      for (const connection of connections.values()) {
+        if (connection !== currentConnection && String(connection.clientId || '').trim() === normalizedClientId) {
+          return true;
+        }
+      }
+    }
+    return false;
+  }
+
   function normalizeClientIp(value) {
     const ip = String(value || '').trim();
     if (!ip) {
@@ -43,6 +60,104 @@ function createPlayerRuntime(options) {
     return ip;
   }
 
+  function firstHeaderValue(value) {
+    return String(value || '').trim().split(',')[0].trim();
+  }
+
+  function isPrivateOrReservedIp(ip) {
+    const normalized = normalizeClientIp(ip);
+    if (!normalized) {
+      return true;
+    }
+
+    const lower = normalized.toLowerCase();
+    if (lower === 'localhost' || lower === '::1') {
+      return true;
+    }
+
+    if (/^10\./.test(lower) || /^192\.168\./.test(lower) || /^127\./.test(lower) || /^169\.254\./.test(lower)) {
+      return true;
+    }
+
+    if (/^172\.(1[6-9]|2\d|3[0-1])\./.test(lower)) {
+      return true;
+    }
+
+    if (lower.startsWith('fc') || lower.startsWith('fd') || lower.startsWith('fe80:') || lower.startsWith('::ffff:127.')) {
+      return true;
+    }
+
+    return false;
+  }
+
+  function pickForwardedIp(candidates) {
+    const normalizedCandidates = Array.isArray(candidates)
+      ? candidates.map(function (candidate) {
+        return normalizeClientIp(candidate);
+      }).filter(Boolean)
+      : [];
+
+    const publicCandidate = normalizedCandidates.find(function (candidate) {
+      return !isPrivateOrReservedIp(candidate);
+    });
+
+    return publicCandidate || normalizedCandidates[0] || null;
+  }
+
+  function resolveRequestIp(request) {
+    const forwardedFor = String(request && request.headers && request.headers['x-forwarded-for'] || '').split(',');
+    const forwardedForIp = pickForwardedIp(forwardedFor);
+    if (forwardedForIp) {
+      return forwardedForIp;
+    }
+
+    const realIp = pickForwardedIp([firstHeaderValue(request && request.headers && request.headers['x-real-ip'])]);
+    if (realIp) {
+      return realIp;
+    }
+
+    const forwarded = firstHeaderValue(request && request.headers && request.headers.forwarded);
+    if (forwarded) {
+      const forwardedMatches = Array.from(forwarded.matchAll(/(?:^|,\s*|;\s*)for=(?:"?\[?)([^"\];,\s]+)/gi)).map(function (match) {
+        return match[1];
+      });
+      const forwardedIp = pickForwardedIp(forwardedMatches);
+      if (forwardedIp) {
+        return forwardedIp;
+      }
+    }
+
+    return normalizeClientIp(request && request.socket && request.socket.remoteAddress);
+  }
+
+  function parseCookies(cookieHeader) {
+    return String(cookieHeader || '').split(/;\s*/).reduce(function (cookies, pair) {
+      if (!pair) {
+        return cookies;
+      }
+      const separatorIndex = pair.indexOf('=');
+      if (separatorIndex === -1) {
+        return cookies;
+      }
+      const name = decodeURIComponent(pair.slice(0, separatorIndex).trim());
+      const value = decodeURIComponent(pair.slice(separatorIndex + 1).trim());
+      if (name) {
+        cookies[name] = value;
+      }
+      return cookies;
+    }, {});
+  }
+
+  function readPageAuthToken(request) {
+    const queryToken = String(new URL(request.url, 'http://localhost').searchParams.get('auth') || '').trim();
+    if (queryToken) {
+      return queryToken;
+    }
+
+    const cookies = parseCookies(request.headers && request.headers.cookie || '');
+    return String(cookies[PAGE_AUTH_COOKIE_NAME] || '').trim();
+  }
+
   function getConnectionBucket(slug) {
     const key = String(slug || '').trim();
     if (!key) {
@@ -115,7 +230,6 @@ function createPlayerRuntime(options) {
     const clientName = String(connection.clientName || '').trim();
     const clientId = String(connection.clientId || '').trim();
     const userAgent = String(connection.userAgent || '').trim();
-    const clientIp = String(connection.clientIp || '').trim();
     const viewport = connection.viewport && typeof connection.viewport === 'object'
       ? connection.viewport
       : null;
@@ -131,10 +245,6 @@ function createPlayerRuntime(options) {
       labelParts.push(`id ${clientId.slice(-6)}`);
     }
 
-    if (clientIp) {
-      labelParts.push(clientIp);
-    }
-
     if (viewport && Number.isFinite(Number(viewport.width)) && Number.isFinite(Number(viewport.height))) {
       labelParts.push(`${Number(viewport.width)}x${Number(viewport.height)}`);
     }
@@ -168,8 +278,6 @@ function createPlayerRuntime(options) {
         blackout: Boolean(connection.blackout),
         currentSlideId: connection.currentSlide && connection.currentSlide.id ? connection.currentSlide.id : null,
         currentSlideTitle: connection.currentSlide && connection.currentSlide.title ? connection.currentSlide.title : null,
-        clientIp: connection.clientIp || null,
-        remoteAddress: connection.remoteAddress || null,
         connectedAt: connection.connectedAt ? connection.connectedAt.toISOString() : null,
         lastSeenAt: connection.lastSeenAt ? connection.lastSeenAt.toISOString() : null
       };
@@ -193,6 +301,10 @@ function createPlayerRuntime(options) {
     return allConnections;
   }
 
+  function snapshotSlugs() {
+    return Array.from(connectionsBySlug.keys());
+  }
+
   async function isClientNameAvailableOnScreen(poolArg, clientName, excludeDeviceId) {
     return isClientNameAvailable(poolArg || pool, clientName, excludeDeviceId, snapshotAllConnections());
   }
@@ -200,6 +312,16 @@ function createPlayerRuntime(options) {
   function broadcastConnectionSnapshot(slug) {
     const key = String(slug || '').trim();
     const bucket = dashboardListenersBySlug.get(key);
+    const connections = snapshotConnections(slug);
+    if (notifySnapshot) {
+      try {
+        notifySnapshot({
+          slug: key,
+          connections: connections
+        });
+      } catch (_error) {
+      }
+    }
     if (!bucket || !bucket.size) {
       return;
     }
@@ -207,7 +329,7 @@ function createPlayerRuntime(options) {
     const payload = JSON.stringify({
       type: 'snapshot',
       slug: key,
-      connections: snapshotConnections(slug),
+      connections: connections,
       sentAt: new Date().toISOString()
     });
 
@@ -314,7 +436,7 @@ function createPlayerRuntime(options) {
     }
 
     if (playerMatch) {
-      const authToken = String(new URL(request.url, 'http://localhost').searchParams.get('auth') || '').trim();
+      const authToken = readPageAuthToken(request);
       const payload = verifyPageAuthToken(authToken);
       if (!payload || String(payload.scope || '').trim() !== 'player') {
         socket.destroy();
@@ -323,7 +445,7 @@ function createPlayerRuntime(options) {
     }
 
     if (announcementMatch) {
-      const authToken = String(new URL(request.url, 'http://localhost').searchParams.get('auth') || '').trim();
+      const authToken = readPageAuthToken(request);
       const payload = verifyPageAuthToken(authToken);
       if (!payload || String(payload.scope || '').trim() !== 'player') {
         socket.destroy();
@@ -387,9 +509,6 @@ function createPlayerRuntime(options) {
       return;
     }
 
-    const remoteAddress = request.socket && request.socket.remoteAddress ? request.socket.remoteAddress : null;
-    const forwardedFor = normalizeClientIp(String(request.headers['x-forwarded-for'] || '').split(',')[0]);
-    const normalizedRemoteAddress = normalizeClientIp(remoteAddress);
     const connectionId = crypto.randomUUID();
     const connection = {
       id: connectionId,
@@ -404,9 +523,7 @@ function createPlayerRuntime(options) {
       paused: false,
       blackout: false,
       playerPublicBaseUrl: null,
-      clientIp: forwardedFor || normalizedRemoteAddress,
+      label: 'connected client',
-      remoteAddress: normalizedRemoteAddress,
-      label: forwardedFor || normalizedRemoteAddress || 'connected client',
       connectedAt: new Date(),
       lastSeenAt: new Date()
     };
@@ -432,7 +549,13 @@ function createPlayerRuntime(options) {
         return;
       }
 
-      connection.clientId = payload.clientId ? String(payload.clientId).trim() : connection.clientId;
+      const nextClientId = payload.clientId ? String(payload.clientId).trim() : connection.clientId;
+      if (nextClientId && hasActiveClientId(nextClientId, connection)) {
+        socket.send(JSON.stringify({ type: 'client-id-conflict' }));
+        socket.close(4009, 'Client ID is already in use.');
+        return;
+      }
+      connection.clientId = nextClientId;
       connection.clientName = payload.clientName ? String(payload.clientName).trim() : connection.clientName;
       connection.deviceId = payload.deviceId ? normalizeDeviceId(payload.deviceId) || connection.deviceId : connection.deviceId;
       if (!connection.clientName && connection.clientId) {
@@ -447,7 +570,6 @@ function createPlayerRuntime(options) {
       }
       connection.paused = Boolean(payload.paused);
       connection.blackout = Boolean(payload.blackout);
-      connection.clientIp = payload.clientIp ? normalizeClientIp(payload.clientIp) || connection.clientIp : connection.clientIp;
       connection.currentSlide = payload.currentSlide && typeof payload.currentSlide === 'object' ? {
         id: payload.currentSlide.id || null,
         title: payload.currentSlide.title || '',
@@ -479,6 +601,7 @@ function createPlayerRuntime(options) {
     broadcastAnnouncementRefresh: broadcastAnnouncementRefresh,
     snapshotConnections: snapshotConnections,
     snapshotAllConnections: snapshotAllConnections,
+    snapshotSlugs: snapshotSlugs,
     isClientNameAvailableOnScreen: isClientNameAvailableOnScreen,
     sendCommandToConnection: sendCommandToConnection,
     broadcastCommand: broadcastCommand

src/player/thumbnail-preview.js

@@ -15,6 +15,7 @@ function buildThumbnailPreviewData(slide) {
     slides: [slide],
     rssFeeds: [],
     apiSources: [],
+    timetableGroups: [],
     revision: String(slide.modified_at || slide.id || Date.now())
   };
 }

src/rbac.js

@@ -1,12 +1,15 @@
 // Permission section definitions and normalization helpers for RBAC.
 
 const PERMISSION_SECTIONS = [
+  {
+    sectionName: 'Main navigation',
+    order: 10,
+    permissions: [
       {
         key: 'dashboard',
         order: 10,
         name: 'Dashboard',
-    sectionName: 'Main navigation',
+        permissions: [
-    actions: [
           { key: 'read', name: 'Read', description: 'Access the dashboard overview.' },
           { key: 'allow', name: 'Allow', description: 'Send global player commands.' }
         ]
@@ -15,42 +18,41 @@ const PERMISSION_SECTIONS = [
         key: 'clients',
         order: 20,
         name: 'Connected clients',
-    sectionName: 'Main navigation',
+        permissions: [
-    actions: [
           { key: 'read', name: 'Read', description: 'View connected player clients and live status.' },
           { key: 'allow', name: 'Allow', description: 'Use the connected client command buttons.' }
         ]
       },
       {
-    key: 'screens',
+        key: 'pairing',
         order: 30,
-    name: 'Screens',
+        name: 'Player pairing',
+        permissions: [
+          { key: 'allow', name: 'Allow', description: 'Pair players with screen groups.' }
+        ]
+      }
+    ]
+  },
+  {
     sectionName: 'Content',
-    actions: [
+    order: 20,
+    permissions: [
+      {
+        key: 'screens',
+        order: 10,
+        name: 'Screens',
+        permissions: [
           { key: 'read', name: 'Read', description: 'View the screen list and open screen details.' },
           { key: 'create', name: 'Create', description: 'Create new screens.' },
           { key: 'update', name: 'Update', description: 'Update screens.' },
           { key: 'delete', name: 'Delete', description: 'Delete screens.' }
         ]
       },
-  {
-    key: 'announcements',
-    order: 35,
-    name: 'Announcements',
-    sectionName: 'Content',
-    actions: [
-      { key: 'read', name: 'Read', description: 'View announcements.' },
-      { key: 'create', name: 'Create', description: 'Create new announcements.' },
-      { key: 'update', name: 'Update', description: 'Update announcements.' },
-      { key: 'delete', name: 'Delete', description: 'Delete announcements.' }
-    ]
-  },
       {
         key: 'playlists',
-    order: 40,
+        order: 20,
         name: 'Playlists',
-    sectionName: 'Content',
+        permissions: [
-    actions: [
           { key: 'read', name: 'Read', description: 'View playlists and playlist contents.' },
           { key: 'create', name: 'Create', description: 'Create new playlists.' },
           { key: 'update', name: 'Update', description: 'Update playlists and playlist slides.' },
@@ -59,10 +61,9 @@ const PERMISSION_SECTIONS = [
       },
       {
         key: 'slides',
-    order: 50,
+        order: 30,
         name: 'Slides',
-    sectionName: 'Content',
+        permissions: [
-    actions: [
           { key: 'read', name: 'Read', description: 'View slides.' },
           { key: 'create', name: 'Create', description: 'Create new slides.' },
           { key: 'update', name: 'Update', description: 'Update slide content.' },
@@ -71,10 +72,9 @@ const PERMISSION_SECTIONS = [
       },
       {
         key: 'templates',
-    order: 60,
+        order: 40,
         name: 'Slide templates',
-    sectionName: 'Content',
+        permissions: [
-    actions: [
           { key: 'read', name: 'Read', description: 'View slide templates.' },
           { key: 'create', name: 'Create', description: 'Create new slide templates.' },
           { key: 'update', name: 'Update', description: 'Update slide templates.' },
@@ -83,10 +83,9 @@ const PERMISSION_SECTIONS = [
       },
       {
         key: 'canvas-sizes',
-    order: 70,
+        order: 50,
         name: 'Canvas sizes',
-    sectionName: 'Content',
+        permissions: [
-    actions: [
           { key: 'read', name: 'Read', description: 'View canvas sizes.' },
           { key: 'create', name: 'Create', description: 'Create new canvas sizes.' },
           { key: 'update', name: 'Update', description: 'Update canvas sizes.' },
@@ -94,66 +93,98 @@ const PERMISSION_SECTIONS = [
         ]
       },
       {
-    key: 'rss-feeds',
+        key: 'announcements',
-    order: 75,
+        order: 60,
-    name: 'RSS feeds',
+        name: 'Announcements',
+        permissions: [
+          { key: 'read', name: 'Read', description: 'View announcements.' },
+          { key: 'create', name: 'Create', description: 'Create new announcements.' },
+          { key: 'update', name: 'Update', description: 'Update announcements.' },
+          { key: 'delete', name: 'Delete', description: 'Delete announcements.' }
+        ]
+      }
+    ]
+  },
+  {
     sectionName: 'Data Sources',
-    actions: [
+    order: 30,
+    permissions: [
+      {
+        key: 'rss-feeds',
+        order: 10,
+        name: 'RSS feeds',
+        permissions: [
           { key: 'read', name: 'Read', description: 'View configured RSS feeds.' },
           { key: 'create', name: 'Create', description: 'Create new RSS feeds.' },
           { key: 'update', name: 'Update', description: 'Update RSS feeds.' },
+          { key: 'allow', name: 'Allow', description: 'Manually refresh RSS feeds.' },
           { key: 'delete', name: 'Delete', description: 'Delete RSS feeds.' }
         ]
       },
       {
         key: 'api-sources',
-    order: 76,
+        order: 20,
         name: 'API sources',
-    sectionName: 'Data Sources',
+        permissions: [
-    actions: [
           { key: 'read', name: 'Read', description: 'View configured API sources.' },
           { key: 'create', name: 'Create', description: 'Create new API sources.' },
           { key: 'update', name: 'Update', description: 'Update API sources.' },
+          { key: 'allow', name: 'Allow', description: 'Manually refresh API sources.' },
           { key: 'delete', name: 'Delete', description: 'Delete API sources.' }
         ]
       },
       {
-    key: 'fonts',
+        key: 'timetables',
-    order: 95,
+        order: 30,
-    name: 'Fonts',
+        name: 'Timetables',
-    sectionName: 'Settings',
+        permissions: [
-    actions: [
+          { key: 'read', name: 'Read', description: 'View configured timetable groups.' },
-      { key: 'read', name: 'Read', description: 'View managed fonts.' },
+          { key: 'create', name: 'Create', description: 'Create new timetable groups.' },
-      { key: 'create', name: 'Create', description: 'Upload managed fonts.' },
+          { key: 'update', name: 'Update', description: 'Update timetable groups and entries.' },
-      { key: 'delete', name: 'Delete', description: 'Remove managed fonts.' }
+          { key: 'delete', name: 'Delete', description: 'Delete timetable groups.' }
         ]
       },
       {
-    key: 'background-tasks',
+        key: 'weather',
-    order: 100,
+        order: 40,
-    name: 'Background tasks',
+        name: 'Weather locations',
-    sectionName: 'Settings',
+        permissions: [
-    actions: [
+          { key: 'read', name: 'Read', description: 'View configured weather locations.' },
-      { key: 'read', name: 'Read', description: 'View queued background tasks.' },
+          { key: 'create', name: 'Create', description: 'Create new weather locations.' },
-      { key: 'allow', name: 'Allow', description: 'Manage queued background tasks and clear finished items.' }
+          { key: 'update', name: 'Update', description: 'Update weather locations.' },
+          { key: 'allow', name: 'Allow', description: 'Manually refresh weather locations.' },
+          { key: 'delete', name: 'Delete', description: 'Delete weather locations.' }
+        ]
+      }
     ]
   },
   {
-    key: 'scheduled-tasks',
-    order: 101,
-    name: 'Scheduled tasks',
     sectionName: 'Settings',
-    actions: [
+    order: 40,
-      { key: 'read', name: 'Read', description: 'View scheduled refresh tasks.' },
+    permissions: [
-      { key: 'allow', name: 'Allow', description: 'Run scheduled refreshes manually.' }
+      {
+        key: 'system-settings',
+        order: 70,
+        name: 'System settings',
+        permissions: [
+          { key: 'read', name: 'Read', description: 'View global application settings.' },
+          { key: 'update', name: 'Update', description: 'Update global application settings.' }
+        ]
+      },
+      {
+        key: 'audit-log',
+        order: 60,
+        name: 'Audit log',
+        permissions: [
+          { key: 'read', name: 'Read', description: 'View security and session audit events.' },
+          { key: 'allow', name: 'Allow', description: 'Download filtered audit events.' }
         ]
       },
       {
         key: 'users',
-    order: 80,
+        order: 10,
         name: 'Users',
-    sectionName: 'Settings',
+        permissions: [
-    actions: [
           { key: 'read', name: 'Read', description: 'View users and role assignments.' },
           { key: 'create', name: 'Create', description: 'Create new users.' },
           { key: 'update', name: 'Update', description: 'Update users, passwords, and role assignments.' },
@@ -162,36 +193,73 @@ const PERMISSION_SECTIONS = [
       },
       {
         key: 'rbac',
-    order: 90,
+        order: 20,
         name: 'Roles and permissions',
-    sectionName: 'Settings',
+        permissions: [
-    actions: [
           { key: 'read', name: 'Read', description: 'View roles and permissions.' },
           { key: 'create', name: 'Create', description: 'Create new roles.' },
           { key: 'update', name: 'Update', description: 'Update role details and permissions.' },
           { key: 'delete', name: 'Delete', description: 'Delete roles.' }
         ]
+      },
+      {
+        key: 'fonts',
+        order: 30,
+        name: 'Fonts',
+        permissions: [
+          { key: 'read', name: 'Read', description: 'View managed fonts.' },
+          { key: 'create', name: 'Create', description: 'Upload managed fonts.' },
+          { key: 'delete', name: 'Delete', description: 'Remove managed fonts.' }
+        ]
+      },
+      {
+        key: 'background-tasks',
+        order: 40,
+        name: 'Task Queue',
+        permissions: [
+          { key: 'read', name: 'Read', description: 'View queued background tasks.' },
+          { key: 'allow', name: 'Allow', description: 'Manage queued background tasks and clear finished items.' }
+        ]
+      },
+      {
+        key: 'scheduled-tasks',
+        order: 50,
+        name: 'Scheduled tasks',
+        permissions: [
+          { key: 'read', name: 'Read', description: 'View scheduled refresh tasks.' },
+          { key: 'allow', name: 'Allow', description: 'Run scheduled refreshes manually.' }
+        ]
+      }
+    ]
   }
 ];
 
-const PERMISSIONS = PERMISSION_SECTIONS.flatMap(function (section) {
+const PERMISSIONS = PERMISSION_SECTIONS.flatMap(function (section, sectionIndex) {
-  return section.actions.map(function (action) {
+  return (Array.isArray(section.permissions) ? section.permissions : []).flatMap(function (resource, resourceIndex) {
+    return (Array.isArray(resource.permissions) ? resource.permissions : []).map(function (action, actionIndex) {
       return {
-      key: `${section.key}.${action.key}`,
+        key: `${resource.key}.${action.key}`,
-      name: section.name,
+        name: resource.name,
         sectionOrder: section.order,
+        sectionIndex: sectionIndex,
         actionName: action.name,
+        permissionOrder: actionIndex + 1,
+        permissionIndex: actionIndex,
         sectionName: section.sectionName,
-      sectionKey: section.key,
+        resourceKey: resource.key,
+        resourceOrder: resource.order,
+        resourceIndex: resourceIndex,
+        resourceName: resource.name,
         actionKey: action.key,
         description: action.description
       };
     });
+  });
 });
 
 const DEFAULT_ROLE = {
-  key: 'administrators',
+  key: 'super-admin',
-  name: 'Administrators',
+  name: 'Super Admin',
   description: 'Full access to the admin interface.'
 };
 
@@ -199,6 +267,8 @@ function normalizePermissionKey(permissionKey) {
   return String(permissionKey || '').trim();
 }
 
+const PERMISSION_DENIED_MESSAGE = 'You do not have permissions to do this.';
+
 function normalizePermissionKeys(permissionKeys) {
   const normalized = [];
 
@@ -283,7 +353,7 @@ function requirePermission(permissionKey, options) {
       return next();
     }
 
-    const error = new Error('You do not have permission to access this area.');
+    const error = new Error(PERMISSION_DENIED_MESSAGE);
     error.statusCode = 403;
     error.expose = true;
     next(error);
@@ -297,5 +367,6 @@ module.exports = {
   hasPermission,
   hasAnyPermission,
   requirePermission,
-  normalizePermissionKeys
+  normalizePermissionKeys,
+  PERMISSION_DENIED_MESSAGE
 };

src/request-auth.js

@@ -246,12 +246,13 @@ function verifyRequestAuth(req) {
   return timingSafeEqualHex(expectedSignature, signature);
 }
 
-function createPageFetchAuthScript(token) {
+function createPageFetchAuthScript(token, cookiePath) {
   const normalizedToken = String(token && typeof token === 'object' ? token.token : token || '').trim();
   if (!normalizedToken) {
     return '';
   }
 
+  const normalizedCookiePath = String(cookiePath || '').trim();
   const pageAuthExpiresAt = token && typeof token === 'object' && Number.isFinite(Number(token.expiresAt))
     ? Number(token.expiresAt)
     : null;
@@ -262,6 +263,8 @@ function createPageFetchAuthScript(token) {
     '  (function () {',
     '    var pageAuthToken = ' + JSON.stringify(normalizedToken) + ';',
     '    var pageAuthExpiresAt = ' + JSON.stringify(pageAuthExpiresAt) + ';',
+    '    var pageAuthCookiePath = ' + JSON.stringify(normalizedCookiePath) + ';',
+    '    var pageAuthCookieName = "pulse_page_auth";',
     '    var pageAuthRenewalTimer = null;',
     '    var pageAuthRenewalInFlight = null;',
     '    var pageAuthRenewalSkewMs = ' + JSON.stringify(renewSkewMs) + ';',
@@ -287,11 +290,28 @@ function createPageFetchAuthScript(token) {
     '        });',
     '      }, delayMs);',
     '    }',
+    '    function writePageAuthCookie(nextToken, nextExpiresAt) {',
+    '      if (!pageAuthCookiePath) {',
+    '        return;',
+    '      }',
+    '      var cookieParts = [pageAuthCookieName + "=" + encodeURIComponent(String(nextToken || "").trim()), "Path=" + pageAuthCookiePath, "SameSite=Lax"];',
+    '      var expiresInMs = Number(nextExpiresAt || 0) - Date.now();',
+    '      if (Number.isFinite(expiresInMs) && expiresInMs > 0) {',
+    '        cookieParts.push("Max-Age=" + Math.max(1, Math.floor(expiresInMs / 1000)));',
+    '      } else {',
+    '        cookieParts.push("Max-Age=0");',
+    '      }',
+    '      if (window.location.protocol === "https:") {',
+    '        cookieParts.push("Secure");',
+    '      }',
+    '      document.cookie = cookieParts.join("; ");',
+    '    }',
     '    function setPageAuthToken(nextToken, nextExpiresAt) {',
     '      pageAuthToken = String(nextToken || "").trim();',
     '      pageAuthExpiresAt = Number(nextExpiresAt || 0) || null;',
     '      window.__pulsePageAuthToken = pageAuthToken;',
     '      window.__pulsePageAuthExpiresAt = pageAuthExpiresAt;',
+    '      writePageAuthCookie(pageAuthToken, pageAuthExpiresAt);',
     '      schedulePageAuthRenewal();',
     '    }',
     '    async function renewPageAuthToken() {',
@@ -326,6 +346,7 @@ function createPageFetchAuthScript(token) {
     '    window.__pulseRenewPageAuthToken = renewPageAuthToken;',
     '    window.__pulsePageAuthToken = pageAuthToken;',
     '    window.__pulsePageAuthExpiresAt = pageAuthExpiresAt;',
+    '    writePageAuthCookie(pageAuthToken, pageAuthExpiresAt);',
     '    window.addEventListener("focus", function () {',
     '      schedulePageAuthRenewal();',
     '    });',

src/web.js

@@ -6,22 +6,26 @@ const multer = require('multer');
 const fs = require('fs');
 const crypto = require('crypto');
 const common = require('./common');
-const { verifyPassword, createSessionToken, hashSessionToken, hashPassword } = require('#src/auth');
+const { verifyPassword, createSessionToken, hashSessionToken, hashPassword, validatePasswordStrength } = require('#src/auth');
 const pages = require('#src/web/pages');
 const registerMiddleware = require('#src/web/middleware');
+const registerNotFoundHandler = require('#src/web/middleware/not-found');
 const { createBackgroundTaskQueue } = require('#src/web/lib/background-tasks/queue');
 const { initializeBackgroundTasks } = require('#src/web/lib/background-tasks');
+const { createDataSourceTaskService } = require('#src/web/lib/background-tasks/tasks-scheduled/data-source-refresh');
 const { captureSlideThumbnail } = require('#src/web/lib/media');
 const { createWebBootstrap } = require('#src/web/bootstrap');
 const { registerRoutes } = require('#src/web/routes/register');
 const { createNotifyPlayerScreens } = require('#src/web/lib/notify-player-screens');
 const { initializeWebServer } = require('#src/web/lib/web-startup');
 const { createWebConfig } = require('#src/web/lib/config');
-const { requirePermission: createRequirePermission } = require('#src/rbac');
+const { requirePermission: createRequirePermission, PERMISSION_DENIED_MESSAGE } = require('#src/rbac');
 const { rbacData } = require('#src/web/lib/auth');
 const { createPlayerActionService } = require('#src/web/lib/player-actions');
 const { isClientNameAvailable, withClientNameReservation } = require('#src/data/client-name-check');
 const { createSessionService } = require('#src/web/lib/auth');
+const { fetchAppSettings } = require('#src/data/app-settings');
+const { recordRequestAuditEvent } = require('#src/data/audit-log');
 const { hasAnyPermission } = require('#src/rbac');
 const { ensureFontLibrary } = require('#src/web/lib/media/font-library');
 const {
@@ -32,7 +36,7 @@ const {
   normalizeScheduleMode,
   getAuditUserId,
   getCanvasSignature,
-  fetchPlaylistCanvasSignature,
+  fetchPlaylistCanvasId,
   fetchScreensByPlaylistId,
   fetchScreensBySlideId,
   fetchScreensByTemplateId,
@@ -52,10 +56,16 @@ async function start() {
     pool: pool,
     maxConcurrent: 1
   });
+  const dataSourceTasks = createDataSourceTaskService({
+    pool: pool,
+    common: common,
+    backgroundTaskQueue: backgroundTaskQueue
+  });
   const playerActionService = createPlayerActionService({
     pool: pool,
     common: common,
-    playerInternalBaseUrl: webConfig.playerInternalBaseUrl
+    playerInternalBaseUrl: webConfig.playerInternalUrl,
+    bridgeInternalBaseUrl: webConfig.bridgeInternalUrl
   });
   const notifyPlayerScreens = createNotifyPlayerScreens(playerActionService.forwardPlayerCommand);
 
@@ -63,8 +73,8 @@ async function start() {
   const webBootstrap = createWebBootstrap({
     pool: pool,
     common: common,
-    playerInternalBaseUrl: webConfig.playerInternalBaseUrl,
+    playerInternalBaseUrl: webConfig.playerInternalUrl,
-    playerPublicBaseUrl: webConfig.playerPublicBaseUrl,
+    bridgeInternalBaseUrl: webConfig.bridgeInternalUrl,
     uploadDir: webConfig.uploadsDir,
     formatDashboardDate: formatDashboardDate,
     notifyPlayerScreens: notifyPlayerScreens,
@@ -84,6 +94,14 @@ async function start() {
   const sessionService = createSessionService({
     sessionCookieName: webConfig.sessionCookieName,
     sessionMaxAgeMs: webConfig.sessionMaxAgeMs,
+    getConfiguredSessionMaxAgeMs: async function () {
+      const settings = await fetchAppSettings(pool);
+      return Number(settings['security.session_lifetime_days']) * 24 * 60 * 60 * 1000;
+    },
+    getConfiguredMaxActiveSessions: async function () {
+      const settings = await fetchAppSettings(pool);
+      return Number(settings['security.max_active_sessions']);
+    },
     hashSessionToken: hashSessionToken,
     createSessionToken: createSessionToken
   });
@@ -91,6 +109,7 @@ async function start() {
   const createUserSession = sessionService.createUserSession;
   const clearSessionCookie = sessionService.clearSessionCookie;
   const setSessionCookie = sessionService.setSessionCookie;
+  const getSessionMaxAgeMs = sessionService.getSessionMaxAgeMs;
   const setAuthMessageCookie = sessionService.setAuthMessageCookie;
   const consumeAuthMessageCookie = sessionService.consumeAuthMessageCookie;
   const loadCurrentUser = sessionService.loadCurrentUser;
@@ -111,9 +130,11 @@ async function start() {
     common: common,
     pages: pages,
     upload: upload,
+    mediaDir: webConfig.mediaDir,
     uploadDir: webConfig.uploadsDir,
     createUserSession: createUserSession,
     setSessionCookie: setSessionCookie,
+    getSessionMaxAgeMs: getSessionMaxAgeMs,
     clearSessionCookie: clearSessionCookie,
     setAuthMessageCookie: setAuthMessageCookie,
     consumeAuthMessageCookie: consumeAuthMessageCookie,
@@ -123,14 +144,16 @@ async function start() {
     sessionCookieName: webConfig.sessionCookieName,
     formatDashboardDate: formatDashboardDate,
     getAuditUserId: getAuditUserId,
+    recordRequestAuditEvent: recordRequestAuditEvent,
     hashPassword: hashPassword,
+    validatePasswordStrength: validatePasswordStrength,
     readArrayField: readArrayField,
     rbacData: rbacData,
     fetchOrderedPlaylistSlides: fetchOrderedPlaylistSlides,
     fetchScreensByPlaylistId: fetchScreensByPlaylistId,
     fetchScreensBySlideId: fetchScreensBySlideId,
     fetchScreensByTemplateId: fetchScreensByTemplateId,
-    fetchPlaylistCanvasSignature: fetchPlaylistCanvasSignature,
+    fetchPlaylistCanvasId: fetchPlaylistCanvasId,
     getCanvasSignature: getCanvasSignature,
     normalizeScheduleMode: normalizeScheduleMode,
     parseDateTimeLocal: parseDateTimeLocal,
@@ -138,12 +161,17 @@ async function start() {
     redirectAfterSave: redirectAfterSave,
     notifyPlayerScreens: notifyPlayerScreens,
     broadcastDashboardState: broadcastDashboardState,
+    dataSourceTasks: dataSourceTasks,
     playerActionService: playerActionService,
+    playerInternalBaseUrl: webConfig.playerInternalUrl,
     isClientNameAvailable: isClientNameAvailable,
     withClientNameReservation: withClientNameReservation,
-    requirePermission: createRequirePermission,
+    requirePermission: function (permissionKey, options) {
+      return createRequirePermission(permissionKey, Object.assign({ setAuthMessageCookie: setAuthMessageCookie }, options));
+    },
     hasAnyPermission: hasAnyPermission,
     backgroundTaskQueue: backgroundTaskQueue,
+    uploadSyncService: webBootstrap.uploadSyncService,
     collectUploadReferencesFromSlide: collectUploadReferencesFromSlide,
     collectUploadReferencesFromTemplate: collectUploadReferencesFromTemplate,
     collectUploadReferencesFromPayload: collectUploadReferencesFromPayload,
@@ -152,16 +180,22 @@ async function start() {
     buildDashboardState: webBootstrap.buildDashboardState
   });
 
+  registerNotFoundHandler(app);
+
   app.use(function (error, req, res, _next) {
-    console.error(error);
     const statusCode = Number(error && (error.statusCode || error.status)) || 500;
+    if (statusCode >= 500) {
+      console.error(error);
+    } else if (statusCode >= 400 && statusCode !== 404) {
+      console.warn(error && error.message ? error.message : 'Request failed.', { statusCode: statusCode });
+    }
     const isXhr = String(req.get && req.get('X-Requested-With') || '').toLowerCase() === 'xmlhttprequest';
     const wantsHtml = !isXhr && !String(req.originalUrl || '').startsWith('/api/') && (!req.accepts || req.accepts('html'));
 
     if (wantsHtml && pages.renderErrorPage) {
       const isPermissionError = statusCode === 403;
       const message = isPermissionError
-        ? String(error && error.message ? error.message : 'You do not have permission to access this area.')
+        ? String(error && error.message ? error.message : PERMISSION_DENIED_MESSAGE)
         : String(error && error.message ? error.message : 'An unexpected error occurred.');
       const title = isPermissionError
         ? 'Access denied'
@@ -192,10 +226,12 @@ async function start() {
     mediaDir: webConfig.mediaDir,
     backgroundTaskQueue: backgroundTaskQueue,
     webBootstrap: webBootstrap,
+    notifyPlayerScreens: notifyPlayerScreens,
     loadCurrentUser: loadCurrentUser,
     initializeBackgroundTasks: initializeBackgroundTasks,
     captureSlideThumbnail: captureSlideThumbnail,
     server: server,
+    webBaseUrl: webConfig.webInternalUrl,
     dataSourceStartupRefreshStaggerMs: webConfig.dataSourceStartupRefreshStaggerMs
   });
 

src/web/bootstrap.js

@@ -3,13 +3,13 @@
 const { WebSocketServer, WebSocket } = require('ws');
 const { createDashboardStateService } = require('./lib/dashboard-state');
 const { createUploadSyncService } = require('./lib/media');
-const { createRequestAuthHeaders } = require('../request-auth');
+const { createRequestAuthHeaders } = require('#src/request-auth');
 
 function createWebBootstrap(options) {
   const pool = options && options.pool;
   const common = options && options.common;
-  const configuredPlayerInternalBaseUrl = String(options && options.playerInternalBaseUrl || '').replace(/\/$/, '');
+  const configuredPlayerInternalUrl = String(options && options.playerInternalBaseUrl || '').replace(/\/$/, '');
-  const playerPublicBaseUrl = String(options && options.playerPublicBaseUrl || '').replace(/\/$/, '');
+  const configuredBridgeInternalUrl = String(options && options.bridgeInternalBaseUrl || process.env.BRIDGE_INTERNAL_URL || '').trim().replace(/\/$/, '');
   const uploadDir = String(options && options.uploadDir || '').trim();
   const dashboardRefreshIntervalMs = 5000;
   const formatDashboardDate = options && options.formatDashboardDate;
@@ -22,53 +22,12 @@ function createWebBootstrap(options) {
 
   const dashboardWs = new WebSocketServer({ noServer: true });
   const dashboardClients = new Set();
-  const playerSnapshotCache = new Map();
+  const playerSnapshotCache = options && options.playerSnapshotCache ? options.playerSnapshotCache : new Map();
-  const playerSnapshotSockets = new Map();
+  const playerSnapshotSockets = options && options.playerSnapshotSockets ? options.playerSnapshotSockets : new Map();
   let dashboardRefreshInFlight = null;
   let broadcastDashboardState = null;
-  let playerInternalBaseUrl = null;
+  function getPlayerSnapshotSocketUrl(slug) {
-  let playerInternalBaseUrlPromise = null;
+    const resolvedPlayerInternalBaseUrl = configuredBridgeInternalUrl || configuredPlayerInternalUrl;
-
-  async function getPlayerInternalBaseUrl() {
-    if (playerInternalBaseUrl) {
-      return playerInternalBaseUrl;
-    }
-
-    if (playerInternalBaseUrlPromise) {
-      return playerInternalBaseUrlPromise;
-    }
-
-    playerInternalBaseUrlPromise = (async function () {
-      if (!pool) {
-        return configuredPlayerInternalBaseUrl || null;
-      }
-
-      try {
-        const [rows] = await pool.query(
-          `SELECT internal_base_url
-           FROM d_players
-           WHERE device_id = '1'
-           LIMIT 1`
-        );
-        const resolvedBaseUrl = String(rows && rows[0] && rows[0].internal_base_url || '').trim().replace(/\/$/, '');
-        return resolvedBaseUrl || configuredPlayerInternalBaseUrl || null;
-      } catch (_error) {
-        return configuredPlayerInternalBaseUrl || null;
-      }
-    })().then(function (baseUrl) {
-      playerInternalBaseUrl = baseUrl || null;
-      playerInternalBaseUrlPromise = null;
-      return playerInternalBaseUrl;
-    }, function () {
-      playerInternalBaseUrlPromise = null;
-      return configuredPlayerInternalBaseUrl || null;
-    });
-
-    return playerInternalBaseUrlPromise;
-  }
-
-  async function getPlayerSnapshotSocketUrl(slug) {
-    const resolvedPlayerInternalBaseUrl = await getPlayerInternalBaseUrl();
     if (!resolvedPlayerInternalBaseUrl) {
       throw new Error('Unable to resolve the player internal base URL.');
     }
@@ -79,34 +38,28 @@ function createWebBootstrap(options) {
     return url.toString();
   }
 
-  function storePlayerSnapshot(slug, connections) {
-    const normalizedSlug = String(slug || '').trim();
-    const normalizedConnections = Array.isArray(connections) ? connections : [];
-    playerSnapshotCache.set(normalizedSlug, {
-      slug: normalizedSlug,
-      count: normalizedConnections.length,
-      connections: normalizedConnections
-    });
-  }
-
   function clearPlayerSnapshotSocket(slug) {
     const key = String(slug || '').trim();
     playerSnapshotSockets.delete(key);
   }
 
   function ensurePlayerSnapshotSubscription(slug) {
+    if (options && typeof options.ensurePlayerSnapshotSubscription === 'function' && options.ensurePlayerSnapshotSubscription !== ensurePlayerSnapshotSubscription) {
+      return options.ensurePlayerSnapshotSubscription(slug);
+    }
+
     const key = String(slug || '').trim();
     if (!key || playerSnapshotSockets.has(key)) {
       return;
     }
 
     playerSnapshotSockets.set(key, null);
-    const socketUrlPromise = getPlayerSnapshotSocketUrl(key);
     const authHeaders = createRequestAuthHeaders({
       method: 'GET',
       pathname: `/ws/screens/${encodeURIComponent(key)}/events`
     });
-    socketUrlPromise.then(function (socketUrl) {
+
+    Promise.resolve(getPlayerSnapshotSocketUrl(key)).then(function (socketUrl) {
       const socket = new WebSocket(socketUrl, {
         headers: authHeaders
       });
@@ -118,7 +71,11 @@ function createWebBootstrap(options) {
           if (!payload || payload.type !== 'snapshot' || payload.slug !== key) {
             return;
           }
-          storePlayerSnapshot(key, payload.connections || []);
+          playerSnapshotCache.set(key, {
+            slug: key,
+            count: Array.isArray(payload.connections) ? payload.connections.length : 0,
+            connections: Array.isArray(payload.connections) ? payload.connections : []
+          });
           if (broadcastDashboardState) {
             broadcastDashboardState().catch(function (error) {
               console.error(error);
@@ -152,10 +109,10 @@ function createWebBootstrap(options) {
   const dashboardStateService = createDashboardStateService({
     pool: pool,
     common: common,
+    thinClientBaseUrl: configuredBridgeInternalUrl,
     playerSnapshotCache: playerSnapshotCache,
     playerSnapshotSockets: playerSnapshotSockets,
     ensurePlayerSnapshotSubscription: ensurePlayerSnapshotSubscription,
-    playerPublicBaseUrl: playerPublicBaseUrl,
     formatDashboardDate: formatDashboardDate
   });
   const buildDashboardState = dashboardStateService.buildDashboardState;
@@ -163,7 +120,7 @@ function createWebBootstrap(options) {
   const uploadSyncService = createUploadSyncService({
     pool: pool,
     common: common,
-    playerInternalBaseUrl: configuredPlayerInternalBaseUrl,
+    playerInternalBaseUrl: configuredPlayerInternalUrl,
     playerSnapshotCache: playerSnapshotCache,
     notifyPlayerScreens: notifyPlayerScreens,
     backgroundTaskQueue: backgroundTaskQueue
@@ -177,12 +134,44 @@ function createWebBootstrap(options) {
   const collectUploadPathsFromDirectory = uploadSyncService.collectUploadPathsFromDirectory;
   const syncPlaylistUploadsOnChange = uploadSyncService.syncPlaylistUploadsOnChange;
   const runMediaSyncTask = uploadSyncService.runMediaSyncTask;
+  let lastDashboardState = null;
+
+  function getFallbackDashboardState() {
+    return lastDashboardState || {
+      playlists: [],
+      screens: [],
+      clients: [],
+      kioskPlayers: [],
+      slides: [],
+      playerServiceConnected: false,
+      connectedPlayersCount: 0,
+      connectedClientsCount: 0
+    };
+  }
+
+  async function resolveDashboardState() {
+    try {
+      const state = await buildDashboardState();
+      lastDashboardState = state;
+      return state;
+    } catch (error) {
+      if (lastDashboardState) {
+        console.error(error);
+        return lastDashboardState;
+      }
+
+      throw error;
+    }
+  }
 
   async function sendDashboardStateToSocket(socket) {
     if (!socket || socket.readyState !== WebSocket.OPEN) {
       return;
     }
-    const state = await buildDashboardState();
+    const state = await resolveDashboardState().catch(function (error) {
+      console.error(error);
+      return getFallbackDashboardState();
+    });
     socket.send(JSON.stringify({ type: 'dashboard-state', state: state }));
   }
 
@@ -192,7 +181,10 @@ function createWebBootstrap(options) {
     }
 
     dashboardRefreshInFlight = (async function () {
-      const state = await buildDashboardState();
+      const state = await resolveDashboardState().catch(function (error) {
+        console.error(error);
+        return getFallbackDashboardState();
+      });
       const payload = JSON.stringify({ type: 'dashboard-state', state: state });
       for (const socket of dashboardClients) {
         if (socket && socket.readyState === WebSocket.OPEN) {
@@ -261,6 +253,7 @@ function createWebBootstrap(options) {
   return {
     upload: upload,
     uploadSyncService: uploadSyncService,
+    playerInternalBaseUrl: configuredPlayerInternalUrl || null,
     buildDashboardState: buildDashboardState,
     collectUploadReferencesFromSlide: collectUploadReferencesFromSlide,
     collectUploadReferencesFromTemplate: collectUploadReferencesFromTemplate,

src/web/handlebars.js

@@ -28,6 +28,15 @@ function registerGeneralHelpers(Handlebars) {
 
     return `${text.slice(0, Math.max(0, limit - 1)).trimEnd()}…`;
   });
+
+  Handlebars.registerHelper('textLengthAttrs', function (maxLength) {
+    const limit = Number(maxLength);
+    if (!Number.isFinite(limit) || limit < 1) {
+      return '';
+    }
+
+    return new Handlebars.SafeString(`maxlength="${Handlebars.escapeExpression(String(Math.floor(limit)))}" data-limit-text-length`);
+  });
 }
 
 // URL helpers for generating links and external URL checks.
@@ -49,7 +58,11 @@ function registerUrlHelpers(Handlebars) {
   });
 
   Handlebars.registerHelper('playerUrl', function (slug) {
-    const base = (process.env.PLAYER_PUBLIC_BASE_URL || process.env.PLAYER_BASE_URL || 'http://localhost:3001').replace(/\/$/, '');
+    const base = String(arguments[1] || '').trim().replace(/\/$/, '');
+    if (!base) {
+      return '';
+    }
+
     return `${base}/screen/${encodeURIComponent(slug)}`;
   });
 }
@@ -82,18 +95,44 @@ function registerActionHelpers(Handlebars) {
   Handlebars.registerHelper('saveActionButtons', function (options) {
     const hash = options && options.hash ? options.hash : {};
     const formId = String(hash.formId || '').trim();
-    const saveLabel = String(hash.saveLabel || 'Save');
+
-    const saveButtonClass = String(hash.saveButtonClass || 'btn btn-success');
+    const save = {
-    const saveActionName = String(hash.saveActionName || 'save_action');
+      label: String(hash.saveLabel || 'Save'),
-    const saveActionValue = String(hash.saveActionValue || 'save');
+      className: String(hash.saveButtonClass || 'btn btn-success'),
-    const closeLabel = String(hash.saveAndCloseLabel || 'Save and Close');
+      actionName: String(hash.saveActionName || 'save_action'),
-    const closeValue = String(hash.saveAndCloseValue || 'close');
+      actionValue: String(hash.saveActionValue || 'save'),
-    const newLabel = String(hash.saveAndNewLabel || 'Save and New');
+      closeLabel: String(hash.saveAndCloseLabel || 'Save and Close'),
-    const newValue = String(hash.saveAndNewValue || 'new');
+      closeValue: String(hash.saveAndCloseValue || 'close'),
+      newLabel: String(hash.saveAndNewLabel || 'Save and New'),
+      newValue: String(hash.saveAndNewValue || 'new')
+    };
+
     const showSaveAndClose = hash.showSaveAndClose === undefined ? true : String(hash.showSaveAndClose).toLowerCase() !== 'false';
     const showSaveAndNew = hash.showSaveAndNew === undefined ? true : String(hash.showSaveAndNew).toLowerCase() !== 'false';
-    const ariaLabel = String(hash.ariaLabel || 'Save actions');
+    const showDelete = hash.showDelete === undefined ? true : String(hash.showDelete).toLowerCase() !== 'false';
     const hasSecondaryActions = showSaveAndClose || showSaveAndNew;
+    const ariaLabel = String(hash.ariaLabel || 'Save actions');
+    const saveUrl = String(hash.saveUrl || '').trim();
+
+    const cancel = {
+      label: String(hash.cancelLabel || 'Cancel'),
+      className: String(hash.cancelClass || 'btn btn-warning'),
+      url: String(hash.cancelUrl || '').trim(),
+      confirmMessage: String(hash.cancelConfirmMessage || hash.cancelConfirm || 'You have unsaved changes. Leave this page?')
+    };
+
+    const deleteAction = {
+      label: String(hash.deleteLabel || 'Delete'),
+      className: String(hash.deleteClass || 'btn btn-danger'),
+      url: String(hash.deleteUrl || '').trim(),
+      formId: String(hash.deleteFormId || '').trim(),
+      confirmMessage: String(hash.deleteConfirmMessage || '').trim(),
+      disabled: hash.deleteDisabled === undefined ? false : String(hash.deleteDisabled).toLowerCase() !== 'false',
+      title: String(hash.deleteTitle || '')
+    };
+
+    const resolvedDeleteUrl = deleteAction.url || (!deleteAction.disabled && saveUrl ? saveUrl.replace(/\/+$/, '') + '/delete' : '');
+    const resolvedDeleteFormId = deleteAction.formId || '';
 
     if (!formId) {
       return '';
@@ -102,16 +141,31 @@ function registerActionHelpers(Handlebars) {
     const escape = Handlebars.escapeExpression;
     const formAttr = ` form="${escape(formId)}"`;
 
-    return new Handlebars.SafeString([
+    const parts = [
       '<div class="btn-group save-action-group" role="group">',
-      `<button type="submit" class="${escape(saveButtonClass)}"${formAttr} name="${escape(saveActionName)}" value="${escape(saveActionValue)}">${escape(saveLabel)}</button>`,
+      `<button type="submit" class="${escape(save.className)}"${formAttr} name="${escape(save.actionName)}" value="${escape(save.actionValue)}">${escape(save.label)}</button>`,
-      hasSecondaryActions ? `<button type="button" class="btn btn-success dropdown-toggle dropdown-toggle-split" data-bs-toggle="dropdown" aria-expanded="false"><span class="visually-hidden">${escape(ariaLabel)}</span></button>` : '',
+      hasSecondaryActions ? `<button type="button" class="btn btn-success dropdown-toggle dropdown-toggle-split rounded-0" data-bs-toggle="dropdown" aria-expanded="false"><span class="visually-hidden">${escape(ariaLabel)}</span></button>` : '',
       hasSecondaryActions ? '<div class="dropdown-menu dropdown-menu-end">' : '',
-      hasSecondaryActions && showSaveAndClose ? `<button type="submit" class="dropdown-item"${formAttr} name="${escape(saveActionName)}" value="${escape(closeValue)}">${escape(closeLabel)}</button>` : '',
+      hasSecondaryActions && showSaveAndClose ? `<button type="submit" class="dropdown-item"${formAttr} name="${escape(save.actionName)}" value="${escape(save.closeValue)}">${escape(save.closeLabel)}</button>` : '',
-      hasSecondaryActions && showSaveAndNew ? `<button type="submit" class="dropdown-item"${formAttr} name="${escape(saveActionName)}" value="${escape(newValue)}">${escape(newLabel)}</button>` : '',
+      hasSecondaryActions && showSaveAndNew ? `<button type="submit" class="dropdown-item"${formAttr} name="${escape(save.actionName)}" value="${escape(save.newValue)}">${escape(save.newLabel)}</button>` : '',
       hasSecondaryActions ? '</div>' : '',
-      '</div>',
+    ];
-    ].join(''));
+
+    if (cancel.url) {
+      parts.push(`<a class="${escape(cancel.className)}" href="${escape(cancel.url)}" data-confirm-unsaved="${escape(cancel.confirmMessage)}">${escape(cancel.label)}</a>`);
+    }
+
+    if (showDelete && (deleteAction.disabled || resolvedDeleteUrl)) {
+      const deleteActionAttr = resolvedDeleteUrl && !resolvedDeleteFormId ? ` data-delete-action-url="${escape(resolvedDeleteUrl)}"` : '';
+      const deleteFormAttr = resolvedDeleteFormId ? ` form="${escape(resolvedDeleteFormId)}"` : '';
+      const confirmAttr = deleteAction.confirmMessage ? ` data-confirm-message="${escape(deleteAction.confirmMessage)}"` : '';
+      const titleAttr = deleteAction.disabled && deleteAction.title ? ` title="${escape(deleteAction.title)}"` : '';
+      parts.push(`<button type="${resolvedDeleteFormId ? 'submit' : 'button'}" class="${escape(deleteAction.className)}"${deleteFormAttr}${deleteActionAttr}${confirmAttr}${deleteAction.disabled ? ' disabled' : ''}${titleAttr}>${escape(deleteAction.label)}</button>`);
+    }
+
+    parts.push('</div>');
+
+    return new Handlebars.SafeString(parts.join(''));
   });
 }
 
@@ -119,6 +173,14 @@ function registerActionHelpers(Handlebars) {
 function registerPartials(Handlebars, viewsRoot) {
   Handlebars.registerPartial('modal-shell', fs.readFileSync(path.join(viewsRoot, 'shared', 'modal-shell.hbs'), 'utf8'));
   Handlebars.registerPartial('table-pagination', fs.readFileSync(path.join(viewsRoot, 'shared', 'table', 'table-pagination.hbs'), 'utf8'));
+  Handlebars.registerPartial('playlists/form', fs.readFileSync(path.join(viewsRoot, 'signage', 'playlists', 'form.hbs'), 'utf8'));
+  Handlebars.registerPartial('signage/playlists/slide-row', fs.readFileSync(path.join(viewsRoot, 'signage', 'playlists', 'slide-row.hbs'), 'utf8'));
+  Handlebars.registerPartial('signage/playlists/schedule-rule-card', fs.readFileSync(path.join(viewsRoot, 'signage', 'playlists', 'schedule-rule-card.hbs'), 'utf8'));
+  Handlebars.registerPartial('signage/templates/animation-advanced-modal', fs.readFileSync(path.join(viewsRoot, 'signage', 'templates', 'animation-advanced-modal.hbs'), 'utf8'));
+  Handlebars.registerPartial('data-sources/api-sources/form', fs.readFileSync(path.join(viewsRoot, 'data-sources', 'api-sources', 'form.hbs'), 'utf8'));
+  Handlebars.registerPartial('data-sources/rss-feeds/form', fs.readFileSync(path.join(viewsRoot, 'data-sources', 'rss-feeds', 'form.hbs'), 'utf8'));
+  Handlebars.registerPartial('data-sources/weather/preview', fs.readFileSync(path.join(viewsRoot, 'data-sources', 'weather', 'preview.hbs'), 'utf8'));
+  Handlebars.registerPartial('data-sources/weather/forecast-preview', fs.readFileSync(path.join(viewsRoot, 'data-sources', 'weather', 'forecast-preview.hbs'), 'utf8'));
 }
 
 // One entry point keeps Handlebars bootstrap centralized.

src/web/lib/auth/rbac-data.js

@@ -113,7 +113,7 @@ async function fetchRolesForUser(pool, userId) {
 
 async function fetchUsersWithRoles(pool) {
   const [rows] = await pool.query(
-    `SELECT u.id, u.name, u.username, u.created_at, u.modified_at,
+    `SELECT u.id, u.name, u.username, u.account_locked, u.created_at, u.modified_at,
             COALESCE(role_data.role_names, '') AS role_names,
             COALESCE(role_data.role_ids_csv, '') AS role_ids_csv
     FROM a_users u
@@ -142,7 +142,7 @@ async function fetchUsersWithRolesPage(pool, page, pageSize, searchTerm, sortKey
   const whereSql = hasExcludedUserId ? 'WHERE u.id <> ?' : '';
   const queryArgs = hasExcludedUserId ? [excludedUserId] : [];
   const paged = await fetchPagedRows(pool, {
-    selectSql: `SELECT u.id, u.name, u.username, u.created_at, u.modified_at,
+    selectSql: `SELECT u.id, u.name, u.username, u.account_locked, u.created_at, u.modified_at,
             COALESCE(role_data.role_names, '') AS role_names,
             COALESCE(role_data.role_ids_csv, '') AS role_ids_csv
     FROM a_users u
@@ -189,7 +189,7 @@ async function fetchUsersWithRolesPage(pool, page, pageSize, searchTerm, sortKey
 
 async function fetchUserWithRoles(pool, userId) {
   const [rows] = await pool.query(
-    `SELECT u.id, u.name, u.username, u.created_at, u.modified_at,
+    `SELECT u.id, u.name, u.username, u.account_locked, u.created_at, u.modified_at,
             COALESCE(role_data.role_names, '') AS role_names,
             COALESCE(role_data.role_ids_csv, '') AS role_ids_csv
     FROM a_users u
@@ -216,6 +216,17 @@ async function fetchUserWithRoles(pool, userId) {
   });
 }
 
+async function fetchActiveUserSessions(pool, userId) {
+  const [rows] = await pool.query(
+    `SELECT id, ip_address, user_agent, created_at, last_used_at, expires_at
+     FROM a_sessions
+     WHERE user_id = ? AND expires_at > NOW()
+     ORDER BY last_used_at DESC`,
+    [userId]
+  );
+  return rows || [];
+}
+
 async function syncUserRoles(pool, userId, roleIds) {
   const uniqueRoleIds = Array.from(new Set((Array.isArray(roleIds) ? roleIds : []).map(function (roleId) {
     return Number(roleId);
@@ -225,7 +236,14 @@ async function syncUserRoles(pool, userId, roleIds) {
 
   await pool.query('DELETE FROM a_user_roles WHERE user_id = ?', [userId]);
   for (const roleId of uniqueRoleIds) {
-    await pool.query('INSERT IGNORE INTO a_user_roles (user_id, role_id, created_by, modified_by) VALUES (?, ?, ?, ?)', [userId, roleId, null, null]);
+    await pool.query(
+      `INSERT INTO a_user_roles (user_id, role_id, created_by, modified_by)
+       SELECT ?, ?, ?, ?
+        WHERE NOT EXISTS (
+          SELECT 1 FROM a_user_roles WHERE user_id = ? AND role_id = ?
+        )`,
+      [userId, roleId, null, null, userId, roleId]
+    );
   }
 }
 
@@ -238,7 +256,14 @@ async function syncRoleUsers(pool, roleId, userIds) {
 
   await pool.query('DELETE FROM a_user_roles WHERE role_id = ?', [roleId]);
   for (const userId of uniqueUserIds) {
-    await pool.query('INSERT IGNORE INTO a_user_roles (user_id, role_id, created_by, modified_by) VALUES (?, ?, ?, ?)', [userId, roleId, null, null]);
+    await pool.query(
+      `INSERT INTO a_user_roles (user_id, role_id, created_by, modified_by)
+       SELECT ?, ?, ?, ?
+        WHERE NOT EXISTS (
+          SELECT 1 FROM a_user_roles WHERE user_id = ? AND role_id = ?
+        )`,
+      [userId, roleId, null, null, userId, roleId]
+    );
   }
 }
 
@@ -257,7 +282,15 @@ async function syncRolePermissions(pool, roleId, permissionKeys) {
 
   await pool.query('DELETE FROM a_role_permissions WHERE role_id = ?', [roleId]);
   for (const permissionRow of permissionRows) {
-    await pool.query('INSERT IGNORE INTO a_role_permissions (role_id, permission_id, created_by, modified_by) VALUES (?, ?, ?, ?)', [roleId, Number(permissionRow.id), null, null]);
+    const permissionId = Number(permissionRow.id);
+    await pool.query(
+      `INSERT INTO a_role_permissions (role_id, permission_id, created_by, modified_by)
+       SELECT ?, ?, ?, ?
+        WHERE NOT EXISTS (
+          SELECT 1 FROM a_role_permissions WHERE role_id = ? AND permission_id = ?
+        )`,
+      [roleId, permissionId, null, null, roleId, permissionId]
+    );
   }
 }
 
@@ -273,6 +306,7 @@ module.exports = {
   fetchUsersWithRoles,
   fetchUsersWithRolesPage,
   fetchUserWithRoles,
+  fetchActiveUserSessions,
   syncUserRoles,
   syncRoleUsers,
   syncRolePermissions

src/web/lib/auth/session.js

@@ -2,9 +2,40 @@
 
 const { normalizePermissionKeys } = require('#src/rbac');
 
+function getRequestOrigin(req) {
+  const forwardedProto = String(req && req.headers && req.headers['x-forwarded-proto'] || '').trim().split(',')[0];
+  const protocol = forwardedProto || (req && req.socket && req.socket.encrypted ? 'https' : 'http');
+  const forwardedHost = String(req && req.headers && req.headers['x-forwarded-host'] || '').trim().split(',')[0];
+  const host = forwardedHost || String(req && req.headers && req.headers.host || '').trim();
+  return host ? `${protocol}://${host}`.replace(/\/$/, '') : 'http://localhost';
+}
+
+function normalizeReturnToPath(value, baseUrl) {
+  const rawValue = String(value || '').trim();
+  if (!rawValue) {
+    return '';
+  }
+
+  const normalizedBaseUrl = String(baseUrl || '').trim().replace(/\/$/, '') || 'http://localhost';
+
+  try {
+    const parsed = new URL(rawValue, normalizedBaseUrl);
+    const baseOrigin = new URL(normalizedBaseUrl).origin;
+    if (parsed.origin !== baseOrigin) {
+      return '';
+    }
+
+    return parsed.pathname + parsed.search + parsed.hash;
+  } catch (_error) {
+    return rawValue.charAt(0) === '/' ? rawValue : '';
+  }
+}
+
 function createSessionService(options) {
   const sessionCookieName = String(options && options.sessionCookieName || '').trim();
   const sessionMaxAgeMs = Number(options && options.sessionMaxAgeMs);
+  const getConfiguredSessionMaxAgeMs = options && options.getConfiguredSessionMaxAgeMs;
+  const getConfiguredMaxActiveSessions = options && options.getConfiguredMaxActiveSessions;
   const hashSessionToken = options && options.hashSessionToken;
   const createSessionToken = options && options.createSessionToken;
   const authMessageCookieName = 'pulse_auth_message';
@@ -59,7 +90,20 @@ function createSessionService(options) {
   }
 
   function setSessionCookie(res, token) {
-    appendCookieHeader(res, serializeCookie(sessionCookieName, token, { maxAge: sessionMaxAgeMs }));
+    const hasRequestedMaxAge = arguments.length > 2;
+    const requestedMaxAgeMs = hasRequestedMaxAge ? Number(arguments[2]) : sessionMaxAgeMs;
+    const cookieOptions = hasRequestedMaxAge && arguments[2] === null
+      ? {}
+      : { maxAge: Number.isFinite(requestedMaxAgeMs) && requestedMaxAgeMs > 0 ? requestedMaxAgeMs : sessionMaxAgeMs };
+    appendCookieHeader(res, serializeCookie(sessionCookieName, token, cookieOptions));
+  }
+
+  async function getSessionMaxAgeMs() {
+    const configuredValue = typeof getConfiguredSessionMaxAgeMs === 'function'
+      ? await getConfiguredSessionMaxAgeMs()
+      : sessionMaxAgeMs;
+    const normalizedValue = Number(configuredValue);
+    return Number.isFinite(normalizedValue) && normalizedValue > 0 ? normalizedValue : sessionMaxAgeMs;
   }
 
   function setAuthMessageCookie(res, message) {
@@ -84,7 +128,7 @@ function createSessionService(options) {
 
     const tokenHash = hashSessionToken(token);
     const [rows] = await pool.query(
-      `SELECT s.user_id, u.id, u.name, u.username
+      `SELECT s.user_id, u.id, u.name, u.username, u.must_change_password
       FROM a_sessions s
       JOIN a_users u ON u.id = s.user_id
        WHERE s.session_hash = ?
@@ -117,6 +161,7 @@ function createSessionService(options) {
 
     await pool.query('UPDATE a_sessions SET last_used_at = CURRENT_TIMESTAMP, modified_by = ? WHERE session_hash = ?', [rows[0].user_id, tokenHash]);
     return Object.assign({}, rows[0], {
+      mustChangePassword: Boolean(rows[0].must_change_password),
       roleKeys: roleRows.map(function (row) {
         return String(row.role_key || '').trim();
       }).filter(Boolean),
@@ -126,14 +171,34 @@ function createSessionService(options) {
     });
   }
 
-  async function createUserSession(pool, userId) {
+  async function createUserSession(pool, userId, configuredMaxAgeMs, metadata) {
     const token = createSessionToken();
     const tokenHash = hashSessionToken(token);
-    const expiresAt = new Date(Date.now() + sessionMaxAgeMs);
+    const maxAgeMs = Number.isFinite(Number(configuredMaxAgeMs)) && Number(configuredMaxAgeMs) > 0
+      ? Number(configuredMaxAgeMs)
+      : await getSessionMaxAgeMs();
+    const expiresAt = new Date(Date.now() + maxAgeMs);
+    const sessionMetadata = metadata && typeof metadata === 'object' ? metadata : {};
     await pool.query(
-      'INSERT INTO a_sessions (session_hash, user_id, expires_at, created_by, modified_by) VALUES (?, ?, ?, ?, ?)',
+      'INSERT INTO a_sessions (session_hash, user_id, ip_address, user_agent, expires_at, created_by, modified_by) VALUES (?, ?, ?, ?, ?, ?, ?)',
-      [tokenHash, userId, expiresAt, userId, userId]
+      [tokenHash, userId, String(sessionMetadata.ipAddress || '').slice(0, 255) || null, String(sessionMetadata.userAgent || '').slice(0, 512) || null, expiresAt, userId, userId]
     );
+
+    if (typeof getConfiguredMaxActiveSessions === 'function') {
+      const maxActiveSessions = Number(await getConfiguredMaxActiveSessions());
+      if (Number.isInteger(maxActiveSessions) && maxActiveSessions > 0) {
+        const [sessionRows] = await pool.query(
+          'SELECT id, session_hash FROM a_sessions WHERE user_id = ? AND expires_at > NOW() ORDER BY last_used_at ASC, created_at ASC, id ASC',
+          [userId]
+        );
+        const sessionsToRemove = (sessionRows || []).filter(function (session) {
+          return session.session_hash !== tokenHash;
+        }).slice(0, Math.max(0, sessionRows.length - maxActiveSessions));
+        for (const session of sessionsToRemove) {
+          await pool.query('DELETE FROM a_sessions WHERE id = ? AND user_id = ?', [session.id, userId]);
+        }
+      }
+    }
     return token;
   }
 
@@ -142,7 +207,8 @@ function createSessionService(options) {
       return next();
     }
     setAuthMessageCookie(res, 'Please sign in to continue.');
-    res.redirect('/login');
+    const returnTo = normalizeReturnToPath(req && (req.originalUrl || req.url || req.path), getRequestOrigin(req));
+    res.redirect(returnTo ? '/login?returnTo=' + encodeURIComponent(returnTo) : '/login');
   }
 
   return {
@@ -154,8 +220,10 @@ function createSessionService(options) {
     consumeAuthMessageCookie: consumeAuthMessageCookie,
     loadCurrentUser: loadCurrentUser,
     createUserSession: createUserSession,
-    requireAuth: requireAuth
+    getSessionMaxAgeMs: getSessionMaxAgeMs,
+    requireAuth: requireAuth,
+    getRequestOrigin: getRequestOrigin
   };
 }
 
-module.exports = { createSessionService };
+  module.exports = { createSessionService, normalizeReturnToPath, getRequestOrigin };

src/web/lib/background-tasks/index.js

@@ -52,7 +52,13 @@ function registerStartupTasks(options) {
   }
 
   async function initialize() {
-    await loadTaskModules(backgroundTaskDirectory, options);
+    const startupTaskFile = path.join(backgroundTaskDirectory, 'data-source-refresh.js');
+    const taskModule = require(startupTaskFile);
+    const exported = getTaskExport(taskModule);
+
+    if (typeof exported === 'function') {
+      await exported(options);
+    }
   }
 
   return {

src/web/lib/background-tasks/queue.js

@@ -19,6 +19,9 @@ function normalizeIntervalMs(value, unit) {
   if (normalizedUnit === 'seconds') {
     return numericValue * 1000;
   }
+  if (normalizedUnit === 'hours') {
+    return numericValue * 60 * 60 * 1000;
+  }
   return numericValue * 60 * 1000;
 }
 

src/web/lib/background-tasks/tasks-adhoc/data-source-refresh.js

@@ -1,4 +1,4 @@
-const { refreshApiSource, refreshRssFeed } = require('../../data-source-refresh');
+const { refreshApiSource, refreshRssFeed, refreshWeatherLocation } = require('../../data-source-refresh');
 
 const TASK = {
   taskType: 'data-source-refresh'
@@ -24,7 +24,8 @@ function registerDataSourceRefreshTask(options) {
       if (!apiSource) {
         throw new Error('API source not found.');
       }
-      return refreshApiSource(pool, common, apiSource, Number(payload.actorId) || null);
+      if (apiSource.enabled === 0 || apiSource.enabled === false) return { skipped: true, reason: 'disabled' };
+      return refreshApiSource(pool, common, apiSource, Number(payload.actorId) || null, options.notifyPlayerScreens);
     }
 
     if (sourceType === 'rss-feed') {
@@ -32,7 +33,17 @@ function registerDataSourceRefreshTask(options) {
       if (!rssFeed) {
         throw new Error('RSS feed not found.');
       }
-      return refreshRssFeed(pool, common, rssFeed.id, rssFeed.feed_url, rssFeed.item_limit, Number(payload.actorId) || null);
+      if (rssFeed.enabled === 0 || rssFeed.enabled === false) return { skipped: true, reason: 'disabled' };
+      return refreshRssFeed(pool, common, rssFeed.id, rssFeed.feed_url, rssFeed.item_limit, Number(payload.actorId) || null, options.notifyPlayerScreens);
+    }
+
+    if (sourceType === 'weather-location') {
+      const location = await common.fetchWeatherLocationById(pool, sourceId);
+      if (!location) {
+        throw new Error('Weather location not found.');
+      }
+      if (location.enabled === 0 || location.enabled === false) return { skipped: true, reason: 'disabled' };
+      return refreshWeatherLocation(pool, common, location, Number(payload.actorId) || null, options.notifyPlayerScreens);
     }
 
     throw new Error('Unsupported data source refresh task.');

src/web/lib/background-tasks/tasks-adhoc/font-sync.js

@@ -9,6 +9,7 @@ function registerFontSyncTask(options) {
   backgroundTaskQueue.setTaskHandler('font-sync', async function (task) {
     const payload = task && task.payload ? task.payload : task || {};
     const uploadDir = String(payload.uploadDir || '').trim();
+    const playerIdentifier = String(payload.playerIdentifier || payload.deviceId || '').trim();
     const operations = Array.isArray(payload.operations)
       ? payload.operations
       : Array.isArray(payload.uploadPaths)
@@ -28,9 +29,9 @@ function registerFontSyncTask(options) {
         continue;
       }
       if (String(operation.type || '').trim().toLowerCase() === 'delete') {
-        await uploadSyncService.removeUploadFileFromPlayer(uploadPath, uploadDir);
+        await uploadSyncService.removeUploadFileFromPlayer(uploadPath, uploadDir, undefined, playerIdentifier);
       } else {
-        await uploadSyncService.pushUploadFileToPlayer(uploadPath, uploadDir);
+        await uploadSyncService.pushUploadFileToPlayer(uploadPath, uploadDir, undefined, playerIdentifier);
       }
     }
   });

src/web/lib/background-tasks/tasks-adhoc/thumbnail-refresh-slide.js

@@ -1,16 +1,18 @@
+const { resolvePlayerRegistration } = require('#src/data/player-registry');
+
 const TASK = {
   taskType: 'slide-thumbnail-refresh'
 };
 
-async function fetchPlayerInternalBaseUrl(pool) {
+async function fetchPlayerInternalBaseUrl(pool, configuredPlayerInternalBaseUrl) {
-  const [rows] = await pool.query(
+  const configured = String(configuredPlayerInternalBaseUrl || '').trim().replace(/\/$/, '');
-    `SELECT internal_base_url
+  if (configured) {
-     FROM d_players
+    return configured;
-     WHERE device_id = '1'
+  }
-     LIMIT 1`
-  );
 
-  return String(rows && rows[0] && rows[0].internal_base_url || '').trim().replace(/\/$/, '') || null;
+  const { getConfiguredPlayerIdentifier } = require('#src/data/player-registry');
+  const player = await resolvePlayerRegistration(pool, getConfiguredPlayerIdentifier());
+  return String(player && player.internal_base_url || '').trim().replace(/\/$/, '') || null;
 }
 
 function registerSlideThumbnailRefreshTask(options) {
@@ -19,6 +21,7 @@ function registerSlideThumbnailRefreshTask(options) {
   const pool = options && options.pool;
   const common = options && options.common;
   const mediaDir = String(options && options.mediaDir || '').trim();
+  const configuredWebBaseUrl = String(options && options.webBaseUrl || '').trim().replace(/\/$/, '');
 
   if (!backgroundTaskQueue || typeof captureSlideThumbnail !== 'function' || !pool || !common || !mediaDir) {
     throw new Error('registerSlideThumbnailRefreshTask requires the slide thumbnail dependencies.');
@@ -32,18 +35,19 @@ function registerSlideThumbnailRefreshTask(options) {
       throw new Error('Slide id is required.');
     }
 
-    const playerInternalBaseUrl = await fetchPlayerInternalBaseUrl(pool);
+    const webBaseUrl = configuredWebBaseUrl || `http://127.0.0.1:${Number(process.env.WEB_PORT || 8080)}`;
-    if (!playerInternalBaseUrl) {
+    if (!webBaseUrl) {
-      throw new Error('Player internal base URL is required.');
+      throw new Error('Web base URL is required.');
     }
 
     return captureSlideThumbnail({
       pool: pool,
       common: common,
       mediaDir: mediaDir,
-      baseUrl: playerInternalBaseUrl,
+      baseUrl: webBaseUrl,
       slideId: slideId,
-      previousThumbnailPath: payload.previousThumbnailPath || null
+      previousThumbnailPath: payload.previousThumbnailPath || null,
+      fontStylesheetHref: payload.fontStylesheetHref || ''
     });
   });
 }

src/web/lib/background-tasks/tasks-adhoc/thumbnail-refresh-template.js

@@ -1,16 +1,18 @@
+const { resolvePlayerRegistration } = require('#src/data/player-registry');
+
 const TASK = {
   taskType: 'template-slide-thumbnail-refresh'
 };
 
-async function fetchPlayerInternalBaseUrl(pool) {
+async function fetchPlayerInternalBaseUrl(pool, configuredPlayerInternalBaseUrl) {
-  const [rows] = await pool.query(
+  const configured = String(configuredPlayerInternalBaseUrl || '').trim().replace(/\/$/, '');
-    `SELECT internal_base_url
+  if (configured) {
-     FROM d_players
+    return configured;
-     WHERE device_id = '1'
+  }
-     LIMIT 1`
-  );
 
-  return String(rows && rows[0] && rows[0].internal_base_url || '').trim().replace(/\/$/, '') || null;
+  const { getConfiguredPlayerIdentifier } = require('#src/data/player-registry');
+  const player = await resolvePlayerRegistration(pool, getConfiguredPlayerIdentifier());
+  return String(player && player.internal_base_url || '').trim().replace(/\/$/, '') || null;
 }
 
 function registerTemplateSlideThumbnailRefreshTask(options) {
@@ -19,6 +21,7 @@ function registerTemplateSlideThumbnailRefreshTask(options) {
   const pool = options && options.pool;
   const common = options && options.common;
   const mediaDir = String(options && options.mediaDir || '').trim();
+  const configuredWebBaseUrl = String(options && options.webBaseUrl || '').trim().replace(/\/$/, '');
 
   if (!backgroundTaskQueue || typeof captureSlideThumbnail !== 'function' || !pool || !common || !mediaDir) {
     throw new Error('registerTemplateSlideThumbnailRefreshTask requires the template thumbnail dependencies.');
@@ -32,9 +35,9 @@ function registerTemplateSlideThumbnailRefreshTask(options) {
       throw new Error('Template id is required.');
     }
 
-    const playerInternalBaseUrl = await fetchPlayerInternalBaseUrl(pool);
+    const webBaseUrl = configuredWebBaseUrl || `http://127.0.0.1:${Number(process.env.WEB_PORT || 8080)}`;
-    if (!playerInternalBaseUrl) {
+    if (!webBaseUrl) {
-      throw new Error('Player internal base URL is required.');
+      throw new Error('Web base URL is required.');
     }
 
     const [slides] = await pool.query(
@@ -52,7 +55,7 @@ function registerTemplateSlideThumbnailRefreshTask(options) {
         pool: pool,
         common: common,
         mediaDir: mediaDir,
-        baseUrl: playerInternalBaseUrl,
+        baseUrl: webBaseUrl,
         slideId: slideId,
         previousThumbnailPath: slide && slide.thumbnail_path ? slide.thumbnail_path : null
       });

src/web/lib/background-tasks/tasks-scheduled/audit-log-sweep.js

@@ -0,0 +1,34 @@
+const { fetchAppSettings } = require('#src/data/app-settings');
+
+const TASK = {
+  key: 'audit-log-sweep',
+  title: 'Audit log cleanup',
+  category: 'cleanup',
+  intervalMs: 24 * 60 * 60 * 1000
+};
+
+function registerAuditLogSweepTask(options) {
+  const backgroundTaskQueue = options && options.backgroundTaskQueue;
+  const pool = options && options.pool;
+  if (!backgroundTaskQueue || !pool) {
+    throw new Error('registerAuditLogSweepTask requires audit cleanup dependencies.');
+  }
+  backgroundTaskQueue.registerRecurringTask({
+    key: TASK.key,
+    title: TASK.title,
+    category: TASK.category,
+    intervalMs: TASK.intervalMs,
+    metadata: {},
+    run: async function () {
+      const settings = await fetchAppSettings(pool);
+      const retentionDays = Number(settings['audit.retention_days']);
+      if (!Number.isInteger(retentionDays) || retentionDays <= 0) {
+        return;
+      }
+      const cutoff = new Date(Date.now() - retentionDays * 24 * 60 * 60 * 1000);
+      await pool.query('DELETE FROM o_audit_events WHERE occurred_at < ?', [cutoff]);
+    }
+  });
+}
+
+module.exports = { registerAuditLogSweepTask };