@blamejs/blamejs-shop 0.3.25 → 0.3.26

package/CHANGELOG.md

@@ -8,6 +8,8 @@ upgrading across more than a few patches at a time.
 
 ## v0.3.x
 
+- v0.3.26 (2026-05-31) — **Customers can raise support tickets and operators work them from a queue.** The support-ticket system had a complete backend — threaded messages, assignment, tags, and a status workflow — but no way in or out: a shopper could not open a ticket and an operator could not see one. Both sides are now wired. A logged-in customer can raise a ticket from their account (with an optional link to one of their own orders), see the thread, and reply while it is open. Operators get a Support queue in the console with an unassigned-triage view, the full thread for each ticket, and controls to reply (with an internal-note option that the customer never sees), assign, tag, and move the ticket through its status workflow. A customer only ever sees their own tickets, and replying to a closed ticket is refused. **Added:** *Customer support tickets* — A Support section in the account area lets a signed-in customer open a ticket (subject, message, category, and an optional reference to one of their own orders), list their tickets with status, read the full message thread, and reply while the ticket is open. Internal operator notes are never shown to the customer, a customer can only see and reply to their own tickets, and a reply to a closed ticket is refused. · *Support queue in the admin console* — A Support screen lists inbound tickets by status with an unassigned-triage view. Opening a ticket shows the full thread, the requester, the current status, the assignee, and tags. From there an operator can reply (optionally as an internal note), assign the ticket, tag it, and move it through its status workflow — in progress, waiting on the customer, resolved, closed, or reopened.
+
 - v0.3.25 (2026-05-30) — **Open an individual customer to see their orders and manage store credit, notes, and loyalty.** The customers list was view-only — there was no way to open a single customer. Each customer now has a detail screen showing their identity, recent orders (linked), store-credit balance with a grant/deduct control, loyalty balance and tier (with a link to adjust points), internal operator notes, and the segments they belong to. A store-credit grant or deduction requires a reason and is written to the store-credit ledger, an over-deduction is refused, and segment membership is shown read-only because it is computed from purchase behavior rather than set by hand. **Added:** *Customer detail screen* — Opening a customer from the roster now shows their record, recent orders, store-credit balance with a reason-gated grant/deduct (recorded in the store-credit ledger; an over-deduction is refused), their loyalty balance and tier with a link to adjust points, and an internal notes log you can add to. The segments a customer belongs to are listed read-only, since membership is derived from their behavior. Customer identity fields remain read-only by design.
 
 - v0.3.24 (2026-05-30) — **Manage the loyalty program from the admin console.** The loyalty program was visible to customers at /account/loyalty — their points balance, tier, the ways to earn, and the rewards — but there was no way to configure it from the console, so it could not actually be run. A new Loyalty admin screen now manages the whole program: create and edit the rules that award points (and archive ones that should no longer apply), build and edit the rewards catalog (a reward must be active to appear to customers), and grant or deduct a specific customer's points balance. A points adjustment requires a reason and is written to the loyalty ledger, so every manual change is recorded. **Added:** *Loyalty program administration* — A Loyalty screen in the admin console manages earn rules (the events that award points and how many), the rewards catalog (what points can be redeemed for, with per-kind values), and per-customer point adjustments. Only active, non-archived rules and rewards appear to customers. A manual grant or deduction requires a reason and is recorded in the loyalty ledger alongside automatic earn and redeem activity, and an over-deduction or invalid adjustment is rejected without changing the balance. This completes a program that previously could be shown to shoppers but not configured.

package/lib/admin.js

@@ -508,6 +508,7 @@ function mount(router, deps) {
   var shippingLabels = deps.shippingLabels || null;  // per-shipment carrier-label record disabled when absent
   var splitShipments = deps.splitShipments || null;  // order split-shipment planner disabled when absent
   var salesTaxFilings = deps.salesTaxFilings || null; // sales-tax-filing remittance console disabled when absent
+  var supportTickets  = deps.supportTickets  || null; // support-ticket queue + thread console disabled when absent
 
   // Which optional console sections are wired — gates their nav links so a
   // signed-in admin is never sent to a route that wasn't mounted. Passed
@@ -515,7 +516,7 @@ function mount(router, deps) {
   // `reports` is always present in the nav (read-only sales summary needs no
   // extra dep); its route mounts unconditionally and renders an unconfigured
   // notice when the salesReports primitive isn't wired.
-  var navAvailable = { returns: !!returns, reviews: !!reviews, productQa: !!productQa, subscriptions: !!deps.subscriptions, webhooks: !!deps.webhooks, collections: !!deps.collections, customers: !!deps.customers, giftcards: !!deps.giftcards, announcementBar: !!deps.announcementBar, blog: !!deps.blog, customerSurveys: !!deps.customerSurveys, storefrontPages: !!deps.storefrontPages, businessHours: !!deps.businessHours, taxRates: !!deps.taxRates, shippingZones: !!deps.shippingZones, autoDiscount: !!deps.autoDiscount, discountAllocation: !!deps.discountAllocation, quantityDiscounts: !!deps.quantityDiscounts, loyalty: !!deps.loyalty, pickLists: !!pickLists, salesTaxFilings: !!salesTaxFilings, shippingLabels: !!shippingLabels };
+  var navAvailable = { returns: !!returns, reviews: !!reviews, productQa: !!productQa, subscriptions: !!deps.subscriptions, webhooks: !!deps.webhooks, collections: !!deps.collections, customers: !!deps.customers, giftcards: !!deps.giftcards, announcementBar: !!deps.announcementBar, blog: !!deps.blog, customerSurveys: !!deps.customerSurveys, storefrontPages: !!deps.storefrontPages, businessHours: !!deps.businessHours, taxRates: !!deps.taxRates, shippingZones: !!deps.shippingZones, autoDiscount: !!deps.autoDiscount, discountAllocation: !!deps.discountAllocation, quantityDiscounts: !!deps.quantityDiscounts, loyalty: !!deps.loyalty, pickLists: !!pickLists, salesTaxFilings: !!salesTaxFilings, shippingLabels: !!shippingLabels, supportTickets: !!supportTickets };
 
   try { b.audit.registerNamespace(AUDIT_NAMESPACE); } catch (_e) { /* idempotent */ }
 
@@ -3578,6 +3579,220 @@ function mount(router, deps) {
     ));
   }
 
+  // ---- support tickets ------------------------------------------------
+  // The operator queue over the customer-service ticketing surface: a
+  // status-filterable list (plus an unassigned-triage view via the
+  // primitive's listUnassigned), a ticket detail with the full thread +
+  // requester + assignee + tags, an operator reply, assign, tag, and the
+  // FSM status transitions the module exposes (in_progress / waiting /
+  // resolved / closed / reopened). Content-negotiated like the other
+  // screens: bearer → JSON; signed-in browser → the HTML console.
+  if (supportTickets) {
+    var support = supportTickets;
+
+    // Resolve the ?status= chip into a list. The special "unassigned"
+    // chip routes through listUnassigned; every real status routes through
+    // the primitive's status-filtered list. A bad/absent chip falls back
+    // to the whole board.
+    async function _supportRows(filter) {
+      if (filter === "unassigned") {
+        return { rows: await support.listUnassigned({}), filter: "unassigned" };
+      }
+      if (filter && support.ALLOWED_STATUSES.indexOf(filter) !== -1) {
+        return { rows: await support.list({ status_filter: filter, limit: support.MAX_LIST_LIMIT }), filter: filter };
+      }
+      return { rows: await support.list({ limit: support.MAX_LIST_LIMIT }), filter: "all" };
+    }
+
+    router.get("/admin/support", _pageOrApi(true,
+      R(async function (req, res) {
+        var url = req.url ? new URL(req.url, "http://localhost") : null;
+        var filter = (url && url.searchParams.get("status")) || null;
+        var resolved = await _supportRows(filter);
+        _json(res, 200, { rows: resolved.rows, status: resolved.filter });
+      }),
+      async function (req, res) {
+        var url = req.url ? new URL(req.url, "http://localhost") : null;
+        var filter = (url && url.searchParams.get("status")) || null;
+        var resolved = await _supportRows(filter);
+        _sendHtml(res, 200, renderAdminSupport({
+          shop_name: deps.shop_name, nav_available: navAvailable,
+          tickets: resolved.rows, status: resolved.filter,
+        }));
+      },
+    ));
+
+    // Resolve a ticket by :id, surfacing a malformed / unknown id as a
+    // 404 (the route is a defensive request-shape reader, never a 500).
+    // Returns null after sending the 404 so the caller short-circuits.
+    async function _supportTicketOr404(req, res, isJson) {
+      var ticket;
+      try { ticket = await support.get(req.params.id); }
+      catch (e) {
+        if (e instanceof TypeError) {
+          if (isJson) { _problem(res, 404, "support-ticket-not-found"); return null; }
+          _sendHtml(res, 404, renderAdminSupport({
+            shop_name: deps.shop_name, nav_available: navAvailable, tickets: [], status: "all", notice: "Ticket not found.",
+          }));
+          return null;
+        }
+        throw e;
+      }
+      if (!ticket) {
+        if (isJson) { _problem(res, 404, "support-ticket-not-found"); return null; }
+        _sendHtml(res, 404, renderAdminSupport({
+          shop_name: deps.shop_name, nav_available: navAvailable, tickets: [], status: "all", notice: "Ticket not found.",
+        }));
+        return null;
+      }
+      return ticket;
+    }
+
+    router.get("/admin/support/:id", _pageOrApi(true,
+      R(async function (req, res) {
+        var ticket = await _supportTicketOr404(req, res, true); if (!ticket) return;
+        var thread = await support.thread(ticket.id);
+        _json(res, 200, thread);
+      }),
+      async function (req, res) {
+        var ticket = await _supportTicketOr404(req, res, false); if (!ticket) return;
+        var thread = await support.thread(ticket.id);
+        var url = req.url ? new URL(req.url, "http://localhost") : null;
+        _sendHtml(res, 200, renderAdminSupportTicket({
+          shop_name:   deps.shop_name,
+          nav_available: navAvailable,
+          ticket:      thread.ticket,
+          messages:    thread.messages,
+          transitions: support.ALLOWED_STATUSES,
+          moved:       url && url.searchParams.get("moved"),
+          notice:      url && url.searchParams.get("err") ? "That action couldn't be completed for this ticket." : null,
+        }));
+      },
+    ));
+
+    // The browser side of a per-ticket action: run `opFn(id, body)`, then
+    // PRG back to the detail. A bad shape (TypeError), an FSM refusal, a
+    // closed-ticket reply, or a not-found row becomes an ?err=1 notice on
+    // the detail, never a 500; anything else propagates to the wrapper.
+    function _supportClientError(e) {
+      if (!e) return false;
+      if (e instanceof TypeError) return true;
+      return e.code === "SUPPORT_TICKET_NOT_FOUND" ||
+             e.code === "SUPPORT_TICKET_CLOSED" ||
+             e.code === "SUPPORT_TICKET_TRANSITION_REFUSED";
+    }
+    function _supportAction(jsonHandler, auditEvent, opFn) {
+      return _pageOrApi(false, jsonHandler, async function (req, res) {
+        var id = req.params.id;
+        try { await opFn(id, req.body || {}); }
+        catch (e) {
+          if (_supportClientError(e)) {
+            return _redirect(res, "/admin/support/" + encodeURIComponent(id) + "?err=1");
+          }
+          throw e;
+        }
+        b.audit.safeEmit({ action: AUDIT_NAMESPACE + "." + auditEvent, outcome: "success", metadata: { id: id } });
+        _redirect(res, "/admin/support/" + encodeURIComponent(id) + "?moved=1");
+      });
+    }
+
+    // Map a support primitive error to an API problem. A bad shape is a
+    // 400, a not-found a 404, a closed-ticket reply / refused transition a
+    // 409 — same classification the browser path uses, surfaced as
+    // problem-details for the JSON contract.
+    function _supportApiError(res, e) {
+      if (e instanceof TypeError) return _problem(res, 400, "bad-request", e.message);
+      if (e && e.code === "SUPPORT_TICKET_NOT_FOUND") return _problem(res, 404, "support-ticket-not-found");
+      if (e && e.code === "SUPPORT_TICKET_CLOSED") return _problem(res, 409, "conflict", e.message);
+      if (e && e.code === "SUPPORT_TICKET_TRANSITION_REFUSED") return _problem(res, 409, "conflict", e.message);
+      return null;
+    }
+
+    // Operator reply — author "operator". An internal=1 note is supported
+    // (operator-only; never shown to the customer) via the form's
+    // checkbox.
+    router.post("/admin/support/:id/reply", _supportAction(
+      W("support.reply", async function (req, res) {
+        var body = req.body || {};
+        var ticket;
+        try {
+          ticket = await support.reply({
+            ticket_id: req.params.id,
+            author:    "operator",
+            body:      body.body,
+            internal:  body.internal === "1" || body.internal === true,
+          });
+        } catch (e) {
+          var mapped = _supportApiError(res, e); if (mapped !== null) return mapped;
+          throw e;
+        }
+        _json(res, 200, ticket);
+        return ticket;
+      }),
+      "support.reply",
+      function (id, body) {
+        return support.reply({
+          ticket_id: id, author: "operator", body: body.body,
+          internal:  body.internal === "1" || body.internal === true,
+        });
+      },
+    ));
+
+    // Assign the ticket to an operator (operator_id is a UUID — the
+    // console seeds it from a hidden field carrying the signed-in
+    // operator's id, or an explicit input).
+    router.post("/admin/support/:id/assign", _supportAction(
+      W("support.assign", async function (req, res) {
+        var body = req.body || {};
+        var ticket;
+        try { ticket = await support.assign({ ticket_id: req.params.id, operator_id: body.operator_id }); }
+        catch (e) { var mapped = _supportApiError(res, e); if (mapped !== null) return mapped; throw e; }
+        _json(res, 200, ticket);
+        return ticket;
+      }),
+      "support.assign",
+      function (id, body) { return support.assign({ ticket_id: id, operator_id: body.operator_id }); },
+    ));
+
+    // Add a free-form tag.
+    router.post("/admin/support/:id/tag", _supportAction(
+      W("support.tag", async function (req, res) {
+        var body = req.body || {};
+        var ticket;
+        try { ticket = await support.addTag({ ticket_id: req.params.id, tag: body.tag }); }
+        catch (e) { var mapped = _supportApiError(res, e); if (mapped !== null) return mapped; throw e; }
+        _json(res, 200, ticket);
+        return ticket;
+      }),
+      "support.tag",
+      function (id, body) { return support.addTag({ ticket_id: id, tag: body.tag }); },
+    ));
+
+    // FSM status transitions. Each posts to /admin/support/:id/<to_status>
+    // for the edges the module's graph exposes; an illegal edge from the
+    // current state is refused by the primitive (→ ?err=1 notice). The
+    // `reopen` URL maps to the module's `reopened` status (the customer-
+    // facing verb for a resolved ticket re-entering the workflow).
+    function _supportTransition(verb, toStatus) {
+      router.post("/admin/support/:id/" + verb, _supportAction(
+        W("support." + verb, async function (req, res) {
+          var ticket;
+          try { ticket = await support.transition({ ticket_id: req.params.id, to_status: toStatus, reason: (req.body && req.body.reason) || undefined }); }
+          catch (e) { var mapped = _supportApiError(res, e); if (mapped !== null) return mapped; throw e; }
+          _json(res, 200, ticket);
+          return ticket;
+        }),
+        "support." + verb,
+        function (id, body) { return support.transition({ ticket_id: id, to_status: toStatus, reason: (body && body.reason) || undefined }); },
+      ));
+    }
+    _supportTransition("in-progress",      "in_progress");
+    _supportTransition("waiting-customer", "waiting_customer");
+    _supportTransition("resolved",         "resolved");
+    _supportTransition("closed",           "closed");
+    _supportTransition("reopen",           "reopened");
+  }
+
   // ---- config ---------------------------------------------------------
 
   var config = deps.config || null;
@@ -7881,6 +8096,7 @@ var ADMIN_NAV_ITEMS = [
   { key: "reports",      href: "/admin/reports",      label: "Reports" },
   { key: "customers",    href: "/admin/customers",    label: "Customers",    requires: "customers" },
   { key: "returns",      href: "/admin/returns",      label: "Returns",      requires: "returns" },
+  { key: "support",      href: "/admin/support",      label: "Support",      requires: "supportTickets" },
   { key: "reviews",      href: "/admin/reviews",      label: "Reviews",      requires: "reviews" },
   { key: "questions",    href: "/admin/questions",    label: "Q&A",          requires: "productQa" },
   { key: "subscriptions", href: "/admin/subscription-plans", label: "Subscriptions", requires: "subscriptions" },
@@ -9360,6 +9576,165 @@ function renderAdminReturn(opts) {
   return _renderAdminShell(opts.shop_name, "Return " + (r.rma_code || r.id.slice(0, 8)), body, "returns", opts.nav_available);
 }
 
+// The support-ticket queue chips: every FSM status the module exposes,
+// plus "all" (the whole board) and an "unassigned" triage view.
+var SUPPORT_STATUS_FILTERS = [
+  "all", "unassigned", "new", "in_progress", "waiting_customer", "resolved", "closed", "reopened",
+];
+
+function _supportPillClass(status) {
+  if (status === "resolved") return "paid";
+  if (status === "closed")   return "cancelled";
+  if (status === "new" || status === "reopened") return "pending";
+  return "";   // in_progress / waiting_customer use the default pill
+}
+
+function _supportPriorityClass(priority) {
+  return priority === "urgent" || priority === "high" ? "cancelled"
+    : priority === "low" ? "" : "pending";
+}
+
+// Operator queue. A status / unassigned chip set filters the board; each
+// row links to the ticket detail. Renders the requester (email is stored
+// hash-only, so the row shows the short hash), the status + priority
+// pills, the assignee state, and when it was opened.
+function renderAdminSupport(opts) {
+  opts = opts || {};
+  var tickets = opts.tickets || [];
+  var active = opts.status || "all";
+  var notice = opts.notice ? "<div class=\"banner banner--warn\">" + _htmlEscape(opts.notice) + "</div>" : "";
+
+  var chips = "<div class=\"order-filters\">" +
+    SUPPORT_STATUS_FILTERS.map(function (s) {
+      return "<a class=\"chip" + (active === s ? " chip--on" : "") + "\" href=\"/admin/support?status=" + encodeURIComponent(s) + "\">" + _htmlEscape(s) + "</a>";
+    }).join("") +
+    "</div>";
+
+  var rows = tickets.map(function (t) {
+    var assignee = t.assigned_operator_id ? _htmlEscape(String(t.assigned_operator_id).slice(0, 8)) : "<span class=\"meta\">unassigned</span>";
+    return "<tr>" +
+      "<td><a class=\"order-id\" href=\"/admin/support/" + _htmlEscape(t.id) + "\">" + _htmlEscape(t.subject) + "</a></td>" +
+      "<td>" + _htmlEscape(t.category) + "</td>" +
+      "<td><span class=\"status-pill " + _supportPillClass(t.status) + "\">" + _htmlEscape(t.status) + "</span></td>" +
+      "<td><span class=\"status-pill " + _supportPriorityClass(t.priority) + "\">" + _htmlEscape(t.priority) + "</span></td>" +
+      "<td>" + assignee + "</td>" +
+      "<td>" + _htmlEscape(_fmtDate(t.opened_at)) + "</td>" +
+      "</tr>";
+  }).join("");
+
+  var table = tickets.length
+    ? "<div class=\"panel\"><table><thead><tr><th scope=\"col\">Subject</th><th scope=\"col\">Category</th><th scope=\"col\">Status</th><th scope=\"col\">Priority</th><th scope=\"col\">Assignee</th><th scope=\"col\">Opened</th></tr></thead><tbody>" + rows + "</tbody></table></div>"
+    : "<p class=\"empty\">No “" + _htmlEscape(active) + "” tickets.</p>";
+
+  var body = "<section><h2>Support</h2>" + notice + chips + table + "</section>";
+  return _renderAdminShell(opts.shop_name, "Support", body, "support", opts.nav_available);
+}
+
+// Ticket detail — the full thread (customer + operator + system + internal
+// notes), the requester / status / assignee / tags, and the action forms:
+// operator reply (with an internal-note toggle), assign, tag, and the FSM
+// status transitions legal from the current state.
+function renderAdminSupportTicket(opts) {
+  opts = opts || {};
+  var t = opts.ticket;
+  var messages = opts.messages || [];
+  var moved  = opts.moved  ? "<div class=\"banner banner--ok\">Ticket updated.</div>" : "";
+  var notice = opts.notice ? "<div class=\"banner banner--err\">" + _htmlEscape(opts.notice) + "</div>" : "";
+
+  var thread = messages.map(function (m) {
+    var who = m.author === "operator" ? "Operator" : m.author === "system" ? "System" : "Customer";
+    var internalTag = Number(m.internal) === 1 ? " <span class=\"status-pill pending\">internal</span>" : "";
+    return "<li class=\"support-msg support-msg--" + _htmlEscape(String(m.author)) + "\">" +
+      "<p class=\"meta\">" + _htmlEscape(who) + internalTag + " · " + _htmlEscape(_fmtDate(m.created_at)) + "</p>" +
+      "<p class=\"support-msg__body\">" + _htmlEscape(String(m.body)).replace(/\n/g, "<br>") + "</p>" +
+      "</li>";
+  }).join("");
+  var threadHtml = messages.length
+    ? "<ul class=\"support-thread\">" + thread + "</ul>"
+    : "<p class=\"empty\">No messages.</p>";
+
+  var tags = (t.tags || []).map(function (tag) {
+    return "<span class=\"status-pill\">" + _htmlEscape(tag) + "</span>";
+  }).join(" ") || "<span class=\"meta\">none</span>";
+
+  function _field(label, value) {
+    return "<p><span class=\"meta\">" + _htmlEscape(label) + "</span><br>" + (value ? _htmlEscape(String(value)) : "<span class=\"meta\">—</span>") + "</p>";
+  }
+
+  // Legal FSM edges from the current status drive which transition
+  // buttons render. Mirrors the module's TRANSITIONS graph.
+  var EDGES = {
+    "new":              ["in-progress", "closed"],
+    "in_progress":      ["waiting-customer", "resolved", "closed"],
+    "waiting_customer": ["in-progress", "resolved", "closed"],
+    "resolved":         ["reopen", "closed"],
+    "reopened":         ["in-progress", "closed"],
+    "closed":           [],
+  };
+  var TRANSITION_LABELS = {
+    "in-progress": "Mark in progress", "waiting-customer": "Wait on customer",
+    "resolved": "Resolve", "closed": "Close", "reopen": "Reopen",
+  };
+  var transitionForms = (EDGES[t.status] || []).map(function (verb) {
+    return "<form method=\"post\" action=\"/admin/support/" + _htmlEscape(t.id) + "/" + verb + "\" class=\"form-inline\">" +
+      "<button class=\"btn" + (verb === "closed" ? " btn--danger" : "") + "\" type=\"submit\">" + _htmlEscape(TRANSITION_LABELS[verb] || verb) + "</button>" +
+      "</form>";
+  }).join("");
+  var transitions = transitionForms
+    ? "<div class=\"order-actions\">" + transitionForms + "</div>"
+    : "<span class=\"meta\">This ticket is closed — no further status changes.</span>";
+
+  var replyForm = t.status === "closed"
+    ? "<span class=\"meta\">Closed tickets can't take a reply.</span>"
+    : "<form method=\"post\" action=\"/admin/support/" + _htmlEscape(t.id) + "/reply\" class=\"return-action\">" +
+        "<h4>Reply</h4>" +
+        "<label class=\"form-field\"><span>Message</span><textarea name=\"body\" rows=\"4\" maxlength=\"8000\" required></textarea></label>" +
+        "<label class=\"form-field form-field--inline\"><input type=\"checkbox\" name=\"internal\" value=\"1\"> <span>Internal note (not shown to the customer)</span></label>" +
+        "<button class=\"btn\" type=\"submit\">Send reply</button>" +
+      "</form>";
+
+  var assignForm =
+    "<form method=\"post\" action=\"/admin/support/" + _htmlEscape(t.id) + "/assign\" class=\"return-action\">" +
+      "<h4>Assign</h4>" +
+      _setupField("Operator id (UUID)", "operator_id", t.assigned_operator_id || "", "text", "The operator to own this ticket.", " required") +
+      "<button class=\"btn\" type=\"submit\">Assign</button>" +
+    "</form>";
+
+  var tagForm =
+    "<form method=\"post\" action=\"/admin/support/" + _htmlEscape(t.id) + "/tag\" class=\"return-action\">" +
+      "<h4>Add tag</h4>" +
+      _setupField("Tag", "tag", "", "text", "", " maxlength=\"32\" required") +
+      "<button class=\"btn\" type=\"submit\">Add tag</button>" +
+    "</form>";
+
+  var body =
+    "<section class=\"mw-48\">" +
+      "<div class=\"actions-row\"><a class=\"btn btn--ghost\" href=\"/admin/support\">&larr; Support</a></div>" +
+      "<h2>" + _htmlEscape(t.subject) + " " +
+        "<span class=\"status-pill " + _supportPillClass(t.status) + "\">" + _htmlEscape(t.status) + "</span></h2>" +
+      "<p class=\"meta\">Opened " + _htmlEscape(_fmtDate(t.opened_at)) +
+        " · priority " + _htmlEscape(t.priority) +
+        (t.order_id ? " · order <a class=\"order-id\" href=\"/admin/orders/" + _htmlEscape(t.order_id) + "\">" + _htmlEscape(String(t.order_id).slice(0, 8)) + "</a>" : "") +
+        "</p>" +
+      moved + notice +
+      "<div class=\"two-col\">" +
+        "<div class=\"panel\"><h3 class=\"subhead\">Conversation</h3>" + threadHtml + "</div>" +
+        "<div class=\"panel\"><h3 class=\"subhead\">Details</h3>" +
+          _field("Category", t.category) +
+          _field("Requester", t.customer_email_hash ? String(t.customer_email_hash).slice(0, 12) + "…" : null) +
+          _field("Customer id", t.customer_id ? String(t.customer_id).slice(0, 8) : null) +
+          _field("Assignee", t.assigned_operator_id ? String(t.assigned_operator_id).slice(0, 8) : null) +
+          "<p><span class=\"meta\">Tags</span><br>" + tags + "</p>" +
+        "</div>" +
+      "</div>" +
+      "<div class=\"panel mt\"><h3 class=\"subhead\">Status</h3>" + transitions + "</div>" +
+      "<div class=\"panel mt\"><h3 class=\"subhead\">Actions</h3>" +
+        "<div class=\"return-actions\">" + replyForm + assignForm + tagForm + "</div>" +
+      "</div>" +
+    "</section>";
+  return _renderAdminShell(opts.shop_name, "Ticket", body, "support", opts.nav_available);
+}
+
 // The review states an operator can filter the moderation queue by.
 var REVIEW_STATUS_FILTERS = ["pending", "published", "rejected"];
 

package/lib/asset-manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.3.25",
+  "version": "0.3.26",
   "assets": {
     "css/admin.css": {
       "integrity": "sha384-1SIn6oAf1DjECbRfKENZasdKHJiywGdXR58wn0hsFGcdVHzUmvfgMkEz5ANIAZJ3",

package/lib/storefront.js

@@ -3158,6 +3158,215 @@ function renderReturns(opts) {
   });
 }
 
+// Support ticket — the categories a shopper can pick when raising one,
+// and the human label for each. The values mirror the support-tickets
+// module's ALLOWED_CATEGORIES; the backend validates the submitted value
+// against its own allow-list, so a forged value is refused there.
+var SUPPORT_CATEGORIES = [
+  ["pre_sale",        "Pre-sale question"],
+  ["order_issue",     "Problem with an order"],
+  ["shipping",        "Shipping / delivery"],
+  ["billing",         "Billing"],
+  ["refund",          "Refund"],
+  ["account",         "My account"],
+  ["complaint",       "Complaint"],
+  ["feature_request", "Feature request"],
+  ["other",           "Something else"],
+];
+
+// Customer-facing status word for a ticket. The module's status enum is
+// operator vocabulary (new / in_progress / waiting_customer / resolved /
+// closed / reopened); these are the shopper-facing phrasings.
+var SUPPORT_STATUS_LABELS = {
+  "new":              "Received",
+  "in_progress":      "In progress",
+  "waiting_customer": "Awaiting your reply",
+  "resolved":         "Resolved",
+  "closed":           "Closed",
+  "reopened":         "Reopened",
+};
+
+function _supportStatusBadge(status) {
+  var esc = b.template.escapeHtml;
+  var label = SUPPORT_STATUS_LABELS[status] || status;
+  return "<span class=\"return-status return-status--" + esc(String(status)) + "\">" +
+    esc(String(label)) + "</span>";
+}
+
+function _supportCategoryLabel(value) {
+  for (var i = 0; i < SUPPORT_CATEGORIES.length; i += 1) {
+    if (SUPPORT_CATEGORIES[i][0] === value) return SUPPORT_CATEGORIES[i][1];
+  }
+  return value;
+}
+
+// The signed-in customer's support-ticket list. `opts.tickets` is the
+// ownership-scoped set (already filtered to this customer); each links to
+// its thread view.
+function renderSupportList(opts) {
+  var esc = b.template.escapeHtml;
+  var tickets = opts.tickets || [];
+  var rowsHtml = "";
+  for (var i = 0; i < tickets.length; i += 1) {
+    var t = tickets[i];
+    var date = t.opened_at ? new Date(Number(t.opened_at)).toISOString().slice(0, 10) : "";
+    rowsHtml +=
+      "<li class=\"return-card\">" +
+        "<div class=\"return-card__head\">" +
+          "<a class=\"return-card__rma\" href=\"/account/support/" + esc(String(t.id)) + "\">" + esc(String(t.subject)) + "</a>" +
+          _supportStatusBadge(t.status) +
+        "</div>" +
+        "<p class=\"return-card__meta\">" + esc(_supportCategoryLabel(t.category)) +
+          (date ? " &middot; <time datetime=\"" + esc(date) + "\">" + esc(date) + "</time>" : "") +
+        "</p>" +
+      "</li>";
+  }
+  var inner = rowsHtml
+    ? "<ul class=\"return-list\">" + rowsHtml + "</ul>"
+    : "<div class=\"account-empty\">" +
+        "<p class=\"account-empty__lede\">No support tickets yet. Raise one and we'll get back to you.</p>" +
+      "</div>";
+  var notice = "";
+  if (opts.created) {
+    notice = "<p class=\"form-notice form-notice--ok\" role=\"status\">Your ticket has been raised — we'll reply here.</p>";
+  }
+  var body =
+    "<section class=\"account-returns\">" +
+      "<nav class=\"breadcrumb\" aria-label=\"Breadcrumb\"><ol>" +
+        "<li><a href=\"/account\">Account</a></li>" +
+        "<li aria-current=\"page\">Support</li>" +
+      "</ol></nav>" +
+      "<header class=\"account-recently-viewed__head\">" +
+        "<h1 class=\"account-returns__title\">Support</h1>" +
+        "<a class=\"btn-primary\" href=\"/account/support/new\">Raise a ticket</a>" +
+      "</header>" +
+      notice +
+      inner +
+    "</section>";
+  return _wrap({
+    title:      "Support",
+    shop_name:  opts.shop_name || "blamejs.shop",
+    cart_count: opts.cart_count == null ? 0 : opts.cart_count,
+    theme_css:  opts.theme_css,
+    body:       body,
+  });
+}
+
+// The new-ticket form. `opts.orders` is the signed-in customer's recent
+// orders so they can attach one (optional). `opts.values` re-fills the
+// form after a validation bounce; `opts.notice` is the error to show.
+function renderSupportNew(opts) {
+  var esc = b.template.escapeHtml;
+  var v = opts.values || {};
+  var orders = opts.orders || [];
+  var categoryOpts = SUPPORT_CATEGORIES.map(function (c) {
+    var sel = v.category === c[0] ? " selected" : "";
+    return "<option value=\"" + esc(c[0]) + "\"" + sel + ">" + esc(c[1]) + "</option>";
+  }).join("");
+  var orderOptions = "<option value=\"\">No specific order</option>" +
+    orders.map(function (o) {
+      var sel = v.order_id === o.id ? " selected" : "";
+      var when = o.created_at ? new Date(Number(o.created_at)).toISOString().slice(0, 10) : "";
+      return "<option value=\"" + esc(String(o.id)) + "\"" + sel + ">" +
+        esc(String(o.id).slice(0, 8)) + (when ? " · " + esc(when) : "") + "</option>";
+    }).join("");
+  var orderField = orders.length
+    ? "<label class=\"form-field\"><span class=\"form-field__label\">Related order (optional)</span>" +
+        "<select name=\"order_id\">" + orderOptions + "</select></label>"
+    : "";
+  var notice = opts.notice
+    ? "<p class=\"form-notice form-notice--error\" role=\"alert\">" + esc(String(opts.notice)) + "</p>"
+    : "";
+  var body =
+    "<section class=\"return-form-page\">" +
+      "<nav class=\"breadcrumb\" aria-label=\"Breadcrumb\"><ol>" +
+        "<li><a href=\"/account\">Account</a></li>" +
+        "<li><a href=\"/account/support\">Support</a></li>" +
+        "<li aria-current=\"page\">Raise a ticket</li>" +
+      "</ol></nav>" +
+      "<h1 class=\"return-form-page__title\">Raise a support ticket</h1>" +
+      notice +
+      "<form class=\"return-form form-stack\" method=\"post\" action=\"/account/support\">" +
+        "<label class=\"form-field\"><span class=\"form-field__label\">Email for our reply</span>" +
+          "<input type=\"email\" name=\"customer_email\" value=\"" + esc(v.customer_email == null ? "" : String(v.customer_email)) + "\" required autocomplete=\"email\" maxlength=\"254\"></label>" +
+        "<label class=\"form-field\"><span class=\"form-field__label\">Category</span>" +
+          "<select name=\"category\" required>" + categoryOpts + "</select></label>" +
+        orderField +
+        "<label class=\"form-field\"><span class=\"form-field__label\">Subject</span>" +
+          "<input type=\"text\" name=\"subject\" value=\"" + esc(v.subject == null ? "" : String(v.subject)) + "\" required maxlength=\"200\"></label>" +
+        "<label class=\"form-field\"><span class=\"form-field__label\">How can we help?</span>" +
+          "<textarea name=\"body\" required maxlength=\"8000\" rows=\"6\">" + esc(v.body == null ? "" : String(v.body)) + "</textarea></label>" +
+        "<button type=\"submit\" class=\"btn-primary\">Send</button>" +
+      "</form>" +
+    "</section>";
+  return _wrap({
+    title:      "Raise a ticket",
+    shop_name:  opts.shop_name || "blamejs.shop",
+    cart_count: opts.cart_count == null ? 0 : opts.cart_count,
+    theme_css:  opts.theme_css,
+    body:       body,
+  });
+}
+
+// One ticket's thread view. `opts.ticket` is the row, `opts.messages` the
+// thread in created_at ASC. Internal operator notes (internal=1) are
+// filtered out by the route before rendering — they never reach the
+// customer. A non-closed ticket shows the reply box.
+function renderSupportTicket(opts) {
+  var esc = b.template.escapeHtml;
+  var t = opts.ticket;
+  var messages = opts.messages || [];
+  var msgHtml = "";
+  for (var i = 0; i < messages.length; i += 1) {
+    var m = messages[i];
+    var who = m.author === "operator" ? "Support" : m.author === "system" ? "System" : "You";
+    var when = m.created_at ? new Date(Number(m.created_at)).toISOString().slice(0, 16).replace("T", " ") : "";
+    msgHtml +=
+      "<li class=\"support-msg support-msg--" + esc(String(m.author)) + "\">" +
+        "<p class=\"support-msg__who\">" + esc(who) +
+          (when ? " <time class=\"support-msg__when\" datetime=\"" + esc(when) + "\">" + esc(when) + "</time>" : "") + "</p>" +
+        "<p class=\"support-msg__body\">" + esc(String(m.body)).replace(/\n/g, "<br>") + "</p>" +
+      "</li>";
+  }
+  var notice = opts.notice
+    ? "<p class=\"form-notice form-notice--error\" role=\"alert\">" + esc(String(opts.notice)) + "</p>"
+    : "";
+  var replyOk = opts.replied
+    ? "<p class=\"form-notice form-notice--ok\" role=\"status\">Your reply has been added.</p>"
+    : "";
+  var closed = t.status === "closed";
+  var replyForm = closed
+    ? "<p class=\"meta\">This ticket is closed. Raise a new one if you still need help.</p>"
+    : "<form class=\"return-form form-stack\" method=\"post\" action=\"/account/support/" + esc(String(t.id)) + "/reply\">" +
+        "<label class=\"form-field\"><span class=\"form-field__label\">Add a reply</span>" +
+          "<textarea name=\"body\" required maxlength=\"8000\" rows=\"5\"></textarea></label>" +
+        "<button type=\"submit\" class=\"btn-primary\">Send reply</button>" +
+      "</form>";
+  var body =
+    "<section class=\"account-returns\">" +
+      "<nav class=\"breadcrumb\" aria-label=\"Breadcrumb\"><ol>" +
+        "<li><a href=\"/account\">Account</a></li>" +
+        "<li><a href=\"/account/support\">Support</a></li>" +
+        "<li aria-current=\"page\">Ticket</li>" +
+      "</ol></nav>" +
+      "<header class=\"account-recently-viewed__head\">" +
+        "<h1 class=\"account-returns__title\">" + esc(String(t.subject)) + "</h1>" +
+        _supportStatusBadge(t.status) +
+      "</header>" +
+      "<p class=\"return-card__meta\">" + esc(_supportCategoryLabel(t.category)) + "</p>" +
+      replyOk + notice +
+      "<ul class=\"support-thread\">" + msgHtml + "</ul>" +
+      replyForm +
+    "</section>";
+  return _wrap({
+    title:      String(t.subject),
+    shop_name:  opts.shop_name || "blamejs.shop",
+    cart_count: opts.cart_count == null ? 0 : opts.cart_count,
+    theme_css:  opts.theme_css,
+    body:       body,
+  });
+}
+
 // Loyalty transaction-type pill — reuses the `pdp__badge` class the
 // theme already styles. The type is one of the ledger's closed enum
 // (earn / redeem / expire / adjust / tier-bonus).
@@ -5978,6 +6187,7 @@ var ACCOUNT_DASH_PAGE =
   "      <a class=\"btn-secondary\" href=\"/account/recently-viewed\">Recently viewed</a>\n" +
   "      <a class=\"btn-secondary\" href=\"/account/addresses\">Addresses</a>\n" +
   "      <a class=\"btn-secondary\" href=\"/account/returns\">Returns</a>\n" +
+  "      <a class=\"btn-secondary\" href=\"/account/support\">Support</a>\n" +
   "      <a class=\"btn-secondary\" href=\"/account/loyalty\">Rewards</a>\n" +
   "      <a class=\"btn-secondary\" href=\"/account/referrals\">Refer a friend</a>\n" +
   "      <a class=\"btn-secondary\" href=\"/account/subscriptions\">Subscriptions</a>\n" +
@@ -10531,6 +10741,212 @@ function mount(router, deps) {
       });
     }
 
+    // Support tickets — the signed-in customer raises a ticket, lists
+    // their own, reads a thread, and replies. EVERY route is login-gated
+    // AND scoped to the session customer's id: the support primitive
+    // stores `customer_id` on each ticket, so a ticket whose customer_id
+    // doesn't match the signed-in shopper is a 404 (never a cross-customer
+    // reveal — the IDOR defense). The raw email is never on disk, so the
+    // intake form collects a reply-to address (the backend validates +
+    // hashes it); the list / view / reply paths key on the session
+    // customer_id alone, independent of any email.
+    if (deps.supportTickets) {
+      var support = deps.supportTickets;
+
+      function _supportAuth(req, res) {
+        var auth;
+        try { auth = _currentCustomer(req); }
+        catch (e) {
+          if (e && e.code === "vault/not-initialized") { _serviceUnavailable(res, "auth not configured"); return null; }
+          throw e;
+        }
+        if (!auth) {
+          res.status(303); res.setHeader && res.setHeader("location", "/account/login");
+          res.end ? res.end() : res.send("");
+          return null;
+        }
+        return auth;
+      }
+
+      // Load the ticket named in :id and confirm it belongs to the
+      // signed-in customer. A malformed id (guardUuid TypeError from
+      // support.get), a missing ticket, or a ticket owned by someone else
+      // ALL return 404 — never a 500, never a leak of another customer's
+      // ticket. This single helper is the ownership gate every per-ticket
+      // route funnels through.
+      async function _ownedTicket(req, res, auth) {
+        var ticket;
+        try { ticket = await support.get(req.params && req.params.id); }
+        catch (e) {
+          if (e instanceof TypeError) { _send(res, 404, renderNotFound({ shop_name: shopName, theme: theme })); return null; }
+          throw e;
+        }
+        if (!ticket || ticket.customer_id !== auth.customer_id) {
+          _send(res, 404, renderNotFound({ shop_name: shopName, theme: theme }));
+          return null;
+        }
+        return ticket;
+      }
+
+      // The customer's own ticket list, scoped to their session customer_id.
+      router.get("/account/support", async function (req, res) {
+        var auth = _supportAuth(req, res); if (!auth) return;
+        var tickets = await support.listByCustomerId(auth.customer_id, { limit: 100 });
+        var cartCount = await _cartCountForReq(req);
+        var url = req.url ? new URL(req.url, "http://localhost") : null;
+        _send(res, 200, renderSupportList({
+          tickets:    tickets,
+          created:    url && url.searchParams.get("ok") === "1",
+          shop_name:  shopName,
+          cart_count: cartCount,
+        }));
+      });
+
+      // The new-ticket form. Offers the customer's recent orders as an
+      // optional attachment.
+      router.get("/account/support/new", async function (req, res) {
+        var auth = _supportAuth(req, res); if (!auth) return;
+        var orders = [];
+        if (deps.order) {
+          try {
+            var page = await deps.order.listForCustomer(auth.customer_id, { limit: 20 });
+            orders = page.rows;
+          } catch (_e) { orders = []; }
+        }
+        var cartCount = await _cartCountForReq(req);
+        _send(res, 200, renderSupportNew({
+          orders:     orders,
+          shop_name:  shopName,
+          cart_count: cartCount,
+        }));
+      });
+
+      // Create the ticket as the session customer. customer_id is pinned
+      // to the session — never read off the form — so a shopper can only
+      // ever open a ticket against their own account. An optional order_id
+      // is accepted only after confirming the order belongs to this
+      // customer (so a forged id can't attach a stranger's order); a
+      // non-owned / unknown order is dropped silently rather than failing
+      // the ticket. The backend validates subject / body / category /
+      // email shape and surfaces a TypeError on bad input as a clean
+      // re-render, never a 500.
+      router.post("/account/support", async function (req, res) {
+        var auth = _supportAuth(req, res); if (!auth) return;
+        var body = req.body || {};
+        var cartCount = await _cartCountForReq(req);
+
+        async function _orders() {
+          if (!deps.order) return [];
+          try { return (await deps.order.listForCustomer(auth.customer_id, { limit: 20 })).rows; }
+          catch (_e) { return []; }
+        }
+
+        // Only attach an order the requesting customer actually owns.
+        var orderId;
+        if (body.order_id && deps.order) {
+          try {
+            var ord = await deps.order.get(body.order_id);
+            if (ord && ord.customer_id === auth.customer_id) orderId = ord.id;
+          } catch (_e) { /* malformed / unknown order id — attach nothing */ }
+        }
+
+        var opened;
+        try {
+          opened = await support.open({
+            customer_id:    auth.customer_id,
+            customer_email: body.customer_email,
+            subject:        body.subject,
+            body:           body.body,
+            category:       body.category,
+            order_id:       orderId,
+          });
+        } catch (e) {
+          if (e instanceof TypeError) {
+            return _send(res, 400, renderSupportNew({
+              orders:     await _orders(),
+              values:     body,
+              notice:     (e && e.message || "").replace(/^supportTickets[.:]\s*/, "") || "Please check your ticket and try again.",
+              shop_name:  shopName,
+              cart_count: cartCount,
+            }));
+          }
+          throw e;
+        }
+        res.status(303);
+        res.setHeader && res.setHeader("location", "/account/support/" + encodeURIComponent(opened.id) + "?ok=1");
+        return res.end ? res.end() : res.send("");
+      });
+
+      // One ticket's thread. Ownership-scoped (foreign / unknown → 404).
+      // Internal operator notes are filtered out before render — the
+      // customer never sees an internal=1 message.
+      router.get("/account/support/:id", async function (req, res) {
+        var auth = _supportAuth(req, res); if (!auth) return;
+        var ticket = await _ownedTicket(req, res, auth); if (!ticket) return;
+        var thread = await support.thread(ticket.id);
+        var visible = (thread.messages || []).filter(function (m) { return Number(m.internal) !== 1; });
+        var cartCount = await _cartCountForReq(req);
+        var url = req.url ? new URL(req.url, "http://localhost") : null;
+        _send(res, 200, renderSupportTicket({
+          ticket:     thread.ticket,
+          messages:   visible,
+          replied:    url && url.searchParams.get("ok") === "1",
+          shop_name:  shopName,
+          cart_count: cartCount,
+        }));
+      });
+
+      // Append a customer reply. Ownership-scoped; refused on a closed
+      // ticket (the backend rejects a closed-ticket reply with a typed
+      // SUPPORT_TICKET_CLOSED error — surfaced as a 409 re-render, never a
+      // 500). author is pinned to "customer".
+      router.post("/account/support/:id/reply", async function (req, res) {
+        var auth = _supportAuth(req, res); if (!auth) return;
+        var ticket = await _ownedTicket(req, res, auth); if (!ticket) return;
+        var body = req.body || {};
+        var cartCount = await _cartCountForReq(req);
+
+        // A closed ticket can't take a reply — short-circuit to a
+        // re-render with a notice rather than calling the backend (which
+        // would also refuse, but this keeps the message customer-readable).
+        if (ticket.status === "closed") {
+          var closedThread = await support.thread(ticket.id);
+          return _send(res, 409, renderSupportTicket({
+            ticket:     closedThread.ticket,
+            messages:   (closedThread.messages || []).filter(function (m) { return Number(m.internal) !== 1; }),
+            notice:     "This ticket is closed — raise a new one if you still need help.",
+            shop_name:  shopName,
+            cart_count: cartCount,
+          }));
+        }
+
+        try {
+          await support.reply({
+            ticket_id: ticket.id,
+            author:    "customer",
+            author_id: auth.customer_id,
+            body:      body.body,
+          });
+        } catch (e) {
+          if (e instanceof TypeError || (e && e.code === "SUPPORT_TICKET_CLOSED")) {
+            var againThread = await support.thread(ticket.id);
+            var status = (e && e.code === "SUPPORT_TICKET_CLOSED") ? 409 : 400;
+            return _send(res, status, renderSupportTicket({
+              ticket:     againThread.ticket,
+              messages:   (againThread.messages || []).filter(function (m) { return Number(m.internal) !== 1; }),
+              notice:     (e && e.message || "").replace(/^supportTickets[.:]\s*/, "") || "Please check your reply and try again.",
+              shop_name:  shopName,
+              cart_count: cartCount,
+            }));
+          }
+          throw e;
+        }
+        res.status(303);
+        res.setHeader && res.setHeader("location", "/account/support/" + encodeURIComponent(ticket.id) + "?ok=1");
+        return res.end ? res.end() : res.send("");
+      });
+    }
+
     // Loyalty — the signed-in customer's points balance + tier, the
     // earn/redeem ledger, how points are earned, and (when a reward
     // catalog + redemption primitive are wired) a redeem-a-reward

package/lib/support-tickets.js

@@ -755,6 +755,60 @@ function create(opts) {
       return r.rows.map(_hydrate);
     },
 
+    // Customer-account-scoped list — every ticket whose `customer_id`
+    // matches, newest-opened first, optionally narrowed to one status.
+    // Keyed on the row's `customer_id` (NOT the email hash) so the
+    // storefront, which holds only the session customer id (the raw
+    // email is never on disk), can list + ownership-gate a signed-in
+    // shopper's tickets without re-deriving the email hash. Composes the
+    // same id / status / limit validators as the rest of the surface.
+    listByCustomerId: async function (customerId, listOpts) {
+      customerId = _uuid(customerId, "customer_id");
+      listOpts = listOpts || {};
+      var limit = _limit(listOpts.limit);
+      var where  = ["customer_id = ?1"];
+      var params = [customerId];
+      var idx    = 2;
+      if (listOpts.status_filter != null) {
+        where.push("status = ?" + idx);
+        params.push(_status(listOpts.status_filter, "status_filter"));
+        idx += 1;
+      }
+      params.push(limit);
+      var sql = "SELECT * FROM support_tickets WHERE " + where.join(" AND ") +
+                " ORDER BY opened_at DESC, id DESC LIMIT ?" + idx;
+      var r = await query(sql, params);
+      return r.rows.map(_hydrate);
+    },
+
+    // Operator queue across every assignment state — newest-stale first
+    // (oldest last_action_at), optionally narrowed to one status. The
+    // status filter drives the admin console's status chips; absent a
+    // filter it surfaces the whole board (every status, including
+    // resolved / closed) so the operator can audit history, capped at
+    // `limit`.
+    list: async function (listOpts) {
+      listOpts = listOpts || {};
+      var limit = _limit(listOpts.limit);
+      var where  = [];
+      var params = [];
+      var idx    = 1;
+      if (listOpts.status_filter != null) {
+        where.push("status = ?" + idx);
+        params.push(_status(listOpts.status_filter, "status_filter"));
+        idx += 1;
+      }
+      params.push(limit);
+      var sql = "SELECT * FROM support_tickets" +
+                (where.length ? " WHERE " + where.join(" AND ") : "") +
+                " ORDER BY CASE priority " +
+                "  WHEN 'urgent' THEN 0 WHEN 'high' THEN 1 " +
+                "  WHEN 'normal' THEN 2 WHEN 'low' THEN 3 ELSE 4 END, " +
+                "last_action_at ASC LIMIT ?" + idx;
+      var r = await query(sql, params);
+      return r.rows.map(_hydrate);
+    },
+
     // Full thread view — ticket + every message in created_at ASC
     // order so the caller can render the conversation top-to-bottom.
     thread: async function (ticketId) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/blamejs-shop",
-  "version": "0.3.25",
+  "version": "0.3.26",
   "description": "Open-source framework built on blamejs. Vendored stack, zero npm runtime deps, PQC-first crypto, security-on by default.",
   "main": "lib/index.js",
   "scripts": {