@consilioweb/payload-support 0.16.0 → 1.0.0

package/dist/index.js

@@ -1,4 +1,7 @@
-import crypto3, { randomBytes, createHmac } from 'crypto';
+import crypto3, { createHmac, randomBytes } from 'crypto';
+import PDFDocument from 'pdfkit';
+import { APIError, getFieldsToSign, jwtSign } from 'payload';
+import sanitizeHtml from 'sanitize-html';
 
 var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
   get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
@@ -58,6 +61,9 @@ var DEFAULT_SLUGS = {
   macros: "macros",
   ticketStatuses: "ticket-statuses",
   ticketFeedback: "ticket-feedback",
+  notificationQueue: "notification-queue",
+  automationRules: "automation-rules",
+  supportTeams: "support-teams",
   users: "users",
   media: "media"
 };
@@ -89,6 +95,26 @@ function handleAuthError(error) {
   return null;
 }
 
+// src/utils/db.ts
+function dbFind(payload, slug, options = {}) {
+  return payload.find({ collection: slug, ...options });
+}
+function dbFindByID(payload, slug, options) {
+  return payload.findByID({ collection: slug, ...options });
+}
+function dbCreate(payload, slug, options) {
+  return payload.create({ collection: slug, ...options });
+}
+function dbUpdate(payload, slug, options) {
+  return payload.update({ collection: slug, ...options });
+}
+function dbCount(payload, slug, options = {}) {
+  return payload.count({ collection: slug, ...options });
+}
+function dbDelete(payload, slug, options) {
+  return payload.delete({ collection: slug, ...options });
+}
+
 // src/utils/readSettings.ts
 var PREF_KEY = "support-settings";
 var USER_PREFS_KEY_PREFIX = "support-user-prefs";
@@ -102,10 +128,18 @@ var DEFAULT_USER_PREFS = {
   locale: "fr",
   signature: ""
 };
+var settingsCache = null;
+var SETTINGS_TTL_MS = 6e4;
+function invalidateSupportSettingsCache() {
+  settingsCache = null;
+}
 async function readSupportSettings(payload) {
+  if (settingsCache && Date.now() - settingsCache.ts < SETTINGS_TTL_MS) {
+    return settingsCache.value;
+  }
+  let value = { ...DEFAULT_SETTINGS };
   try {
-    const prefs = await payload.find({
-      collection: "payload-preferences",
+    const prefs = await dbFind(payload, "payload-preferences", {
       where: { key: { equals: PREF_KEY } },
       limit: 1,
       depth: 0,
@@ -113,7 +147,7 @@ async function readSupportSettings(payload) {
     });
     if (prefs.docs.length > 0) {
       const stored = prefs.docs[0].value;
-      return {
+      value = {
         email: { ...DEFAULT_SETTINGS.email, ...stored.email },
         ai: { ...DEFAULT_SETTINGS.ai, ...stored.ai },
         sla: { ...DEFAULT_SETTINGS.sla, ...stored.sla },
@@ -122,13 +156,13 @@ async function readSupportSettings(payload) {
     }
   } catch {
   }
-  return { ...DEFAULT_SETTINGS };
+  settingsCache = { value, ts: Date.now() };
+  return value;
 }
 async function readUserPrefs(payload, userId) {
   try {
     const key = `${USER_PREFS_KEY_PREFIX}-${userId}`;
-    const prefs = await payload.find({
-      collection: "payload-preferences",
+    const prefs = await dbFind(payload, "payload-preferences", {
       where: { key: { equals: key } },
       limit: 1,
       depth: 0,
@@ -314,8 +348,130 @@ ${text}`;
   };
 }
 
-// src/endpoints/client-intelligence.ts
+// src/utils/aiAgent.ts
+async function applyAgentDecision(payload, slugs, ticketId, decision) {
+  if (decision.action === "reply" && decision.reply && decision.reply.trim()) {
+    const msg = await dbCreate(payload, slugs.ticketMessages, {
+      data: {
+        ticket: ticketId,
+        body: decision.reply.trim(),
+        authorType: "admin",
+        isInternal: false,
+        fromAlias: "Assistant IA"
+      },
+      overrideAccess: true
+    });
+    return { acted: "reply", messageId: msg.id, confidence: decision.confidence };
+  }
+  await dbCreate(payload, slugs.ticketMessages, {
+    data: {
+      ticket: ticketId,
+      body: `[Agent IA] Escalade vers un humain. Raison : ${decision.reason || "non d\xE9termin\xE9e"} (confiance ${Math.round((decision.confidence ?? 0) * 100)} %).`,
+      authorType: "admin",
+      isInternal: true,
+      skipNotification: true
+    },
+    overrideAccess: true
+  });
+  await dbUpdate(payload, slugs.tickets, { id: ticketId, data: { status: "escalated" }, overrideAccess: true });
+  return { acted: "escalate", confidence: decision.confidence };
+}
 function getClient2(aiSettings) {
+  const Anthropic = __require("@anthropic-ai/sdk").default;
+  if (aiSettings.provider === "ollama") {
+    return new Anthropic({ apiKey: "ollama", baseURL: process.env.OLLAMA_API_URL || "https://ollama.orkelis.app/v1" });
+  }
+  return new Anthropic({ apiKey: process.env.ANTHROPIC_API_KEY });
+}
+function stripHtml(s) {
+  return (s || "").replace(/<[^>]+>/g, " ").replace(/\s+/g, " ").trim();
+}
+function parseDecision(text) {
+  try {
+    const match = text.match(/\{[\s\S]*\}/);
+    if (match) {
+      const obj = JSON.parse(match[0]);
+      return {
+        action: obj.action === "reply" ? "reply" : "escalate",
+        reply: typeof obj.reply === "string" ? obj.reply : void 0,
+        reason: typeof obj.reason === "string" ? obj.reason : void 0,
+        confidence: typeof obj.confidence === "number" ? obj.confidence : 0
+      };
+    }
+  } catch {
+  }
+  return { action: "escalate", reason: "R\xE9ponse IA non interpr\xE9table", confidence: 0 };
+}
+async function runAiAgent(payload, slugs, ticketId, opts) {
+  const settings = await readSupportSettings(payload);
+  const threshold = opts?.confidenceThreshold ?? 0.7;
+  const ticket = await dbFindByID(payload, slugs.tickets, { id: ticketId, depth: 0, overrideAccess: true });
+  const messages = await dbFind(payload, slugs.ticketMessages, { where: { ticket: { equals: ticketId } }, sort: "createdAt", limit: 50, depth: 0, overrideAccess: true });
+  const kb = await dbFind(payload, slugs.knowledgeBase, { where: { published: { equals: true } }, limit: 20, depth: 0, overrideAccess: true });
+  const conversation = messages.docs.map((m) => `${m.authorType}: ${m.body || ""}`).join("\n");
+  const kbText = kb.docs.map((a) => `# ${a.title || ""}
+${stripHtml(String(a.content ?? ""))}`).join("\n\n").slice(0, 8e3);
+  const prompt = `Tu es un agent de support IA. \xC0 partir du ticket et de la base de connaissances ci-dessous, d\xE9cide :
+- "reply" si tu peux r\xE9pondre avec certitude UNIQUEMENT \xE0 partir de la base de connaissances ;
+- "escalate" sinon (question hors KB, ambigu\xEB, sensible, ou n\xE9cessitant une action humaine).
+R\xE9ponds en JSON STRICT, sans texte autour : {"action":"reply"|"escalate","reply":"<r\xE9ponse au client si reply>","reason":"<courte raison>","confidence":<0 \xE0 1>}.
+
+TICKET : ${ticket.subject || ""}
+CONVERSATION :
+${conversation}
+
+BASE DE CONNAISSANCES :
+${kbText || "(vide)"}`;
+  let decision;
+  try {
+    const client = getClient2(settings.ai);
+    const resp = await client.messages.create({
+      model: settings.ai.model || "claude-haiku-4-5-20251001",
+      max_tokens: 1024,
+      messages: [{ role: "user", content: prompt }]
+    });
+    const text = resp?.content?.[0]?.text || "";
+    decision = parseDecision(text);
+  } catch (err) {
+    console.error("[support] AI agent decision failed:", err);
+    decision = { action: "escalate", reason: "Erreur du fournisseur IA", confidence: 0 };
+  }
+  const finalDecision = decision.action === "reply" && (decision.confidence ?? 0) >= threshold ? decision : { action: "escalate", reason: decision.reason || "Confiance insuffisante pour une r\xE9ponse automatique", confidence: decision.confidence };
+  return applyAgentDecision(payload, slugs, ticketId, finalDecision);
+}
+
+// src/endpoints/ai-agent.ts
+function createAiAgentEndpoint(slugs) {
+  return {
+    path: "/support/ai-agent",
+    method: "post",
+    handler: async (req) => {
+      try {
+        requireAdmin(req, slugs);
+        let body = {};
+        try {
+          body = await req.json();
+        } catch {
+        }
+        if (!body.ticketId) {
+          return Response.json({ error: "ticketId requis." }, { status: 400 });
+        }
+        const result = await runAiAgent(req.payload, slugs, body.ticketId, {
+          confidenceThreshold: body.confidenceThreshold
+        });
+        return Response.json({ ok: true, ...result });
+      } catch (error) {
+        const authResponse = handleAuthError(error);
+        if (authResponse) return authResponse;
+        console.error("[ai-agent] Error:", error);
+        return Response.json({ error: "Erreur interne" }, { status: 500 });
+      }
+    }
+  };
+}
+
+// src/endpoints/client-intelligence.ts
+function getClient3(aiSettings) {
   const Anthropic = __require("@anthropic-ai/sdk").default;
   if (aiSettings.provider === "ollama") {
     const baseURL = process.env.OLLAMA_API_URL || "https://ollama.orkelis.app/v1";
@@ -469,7 +625,7 @@ R\xE9ponds en JSON strict (pas de markdown, pas de commentaires) avec cette stru
 }
 
 Sois factuel. Ne d\xE9passe pas 5 items par tableau. R\xE9ponds UNIQUEMENT avec le JSON.`;
-  const anthropic = getClient2(aiSettings);
+  const anthropic = getClient3(aiSettings);
   const model = getModel2(aiSettings);
   const res = await anthropic.messages.create({
     model,
@@ -533,8 +689,7 @@ function createSearchEndpoint(slugs) {
           return Response.json({ tickets: [], clients: [], messages: [], articles: [] });
         }
         const [ticketsRes, clientsRes, messagesRes, articlesRes] = await Promise.all([
-          payload.find({
-            collection: slugs.tickets,
+          dbFind(payload, slugs.tickets, {
             where: {
               or: [
                 { ticketNumber: { contains: q } },
@@ -546,8 +701,7 @@ function createSearchEndpoint(slugs) {
             depth: 1,
             overrideAccess: true
           }),
-          payload.find({
-            collection: slugs.supportClients,
+          dbFind(payload, slugs.supportClients, {
             where: {
               or: [
                 { firstName: { contains: q } },
@@ -560,16 +714,14 @@ function createSearchEndpoint(slugs) {
             depth: 0,
             overrideAccess: true
           }),
-          payload.find({
-            collection: slugs.ticketMessages,
+          dbFind(payload, slugs.ticketMessages, {
             where: { body: { contains: q } },
             sort: "-createdAt",
             limit: 5,
             depth: 1,
             overrideAccess: true
           }),
-          payload.find({
-            collection: slugs.knowledgeBase,
+          dbFind(payload, slugs.knowledgeBase, {
             where: { title: { contains: q } },
             limit: 5,
             depth: 0,
@@ -669,8 +821,7 @@ function createKbSearchEndpoint(slugs) {
           orClauses.push({ category: { contains: t } });
         }
         orClauses.push({ title: { contains: q } });
-        const res = await payload.find({
-          collection: slugs.knowledgeBase,
+        const res = await dbFind(payload, slugs.knowledgeBase, {
           where: {
             and: [
               { published: { equals: true } },
@@ -729,16 +880,14 @@ function createBulkActionEndpoint(slugs) {
           try {
             switch (action) {
               case "close":
-                await payload.update({
-                  collection: slugs.tickets,
+                await dbUpdate(payload, slugs.tickets, {
                   id: ticketId,
                   data: { status: "resolved", resolvedAt: (/* @__PURE__ */ new Date()).toISOString() },
                   overrideAccess: true
                 });
                 break;
               case "reopen":
-                await payload.update({
-                  collection: slugs.tickets,
+                await dbUpdate(payload, slugs.tickets, {
                   id: ticketId,
                   data: { status: "open" },
                   overrideAccess: true
@@ -746,8 +895,7 @@ function createBulkActionEndpoint(slugs) {
                 break;
               case "assign":
                 if (value) {
-                  await payload.update({
-                    collection: slugs.tickets,
+                  await dbUpdate(payload, slugs.tickets, {
                     id: ticketId,
                     data: { assignedTo: Number(value) },
                     overrideAccess: true
@@ -756,8 +904,7 @@ function createBulkActionEndpoint(slugs) {
                 break;
               case "set_priority":
                 if (value) {
-                  await payload.update({
-                    collection: slugs.tickets,
+                  await dbUpdate(payload, slugs.tickets, {
                     id: ticketId,
                     data: { priority: String(value) },
                     overrideAccess: true
@@ -766,8 +913,7 @@ function createBulkActionEndpoint(slugs) {
                 break;
               case "set_category":
                 if (value) {
-                  await payload.update({
-                    collection: slugs.tickets,
+                  await dbUpdate(payload, slugs.tickets, {
                     id: ticketId,
                     data: { category: String(value) },
                     overrideAccess: true
@@ -775,8 +921,7 @@ function createBulkActionEndpoint(slugs) {
                 }
                 break;
               case "delete":
-                await payload.delete({
-                  collection: slugs.tickets,
+                await dbDelete(payload, slugs.tickets, {
                   id: ticketId,
                   overrideAccess: true
                 });
@@ -815,8 +960,8 @@ function createMergeTicketsEndpoint(slugs) {
           return Response.json({ error: "Impossible de fusionner un ticket avec lui-m\xEAme" }, { status: 400 });
         }
         const [source, target] = await Promise.all([
-          payload.findByID({ collection: slugs.tickets, id: sourceTicketId, depth: 0, overrideAccess: true }),
-          payload.findByID({ collection: slugs.tickets, id: targetTicketId, depth: 0, overrideAccess: true })
+          dbFindByID(payload, slugs.tickets, { id: sourceTicketId, depth: 0, overrideAccess: true }),
+          dbFindByID(payload, slugs.tickets, { id: targetTicketId, depth: 0, overrideAccess: true })
         ]);
         if (!source) return Response.json({ error: "Ticket source introuvable" }, { status: 404 });
         if (!target) return Response.json({ error: "Ticket cible introuvable" }, { status: 404 });
@@ -825,39 +970,34 @@ function createMergeTicketsEndpoint(slugs) {
         if (sourceClient !== targetClient) {
           return Response.json({ error: "Les deux tickets doivent appartenir au m\xEAme client" }, { status: 400 });
         }
-        const messages = await payload.find({
-          collection: slugs.ticketMessages,
+        const messages = await dbFind(payload, slugs.ticketMessages, {
           where: { ticket: { equals: sourceTicketId } },
           limit: 500,
           depth: 0,
           overrideAccess: true
         });
         for (const msg of messages.docs) {
-          await payload.update({
-            collection: slugs.ticketMessages,
+          await dbUpdate(payload, slugs.ticketMessages, {
             id: msg.id,
             data: { ticket: targetTicketId },
             overrideAccess: true
           });
         }
-        const timeEntries = await payload.find({
-          collection: slugs.timeEntries,
+        const timeEntries = await dbFind(payload, slugs.timeEntries, {
           where: { ticket: { equals: sourceTicketId } },
           limit: 500,
           depth: 0,
           overrideAccess: true
         });
         for (const entry of timeEntries.docs) {
-          await payload.update({
-            collection: slugs.timeEntries,
+          await dbUpdate(payload, slugs.timeEntries, {
             id: entry.id,
             data: { ticket: targetTicketId },
             overrideAccess: true
           });
         }
         const sourceNumber = source.ticketNumber || `#${sourceTicketId}`;
-        await payload.create({
-          collection: slugs.ticketMessages,
+        await dbCreate(payload, slugs.ticketMessages, {
           data: {
             ticket: targetTicketId,
             body: `Messages fusionn\xE9s depuis ${sourceNumber} (${messages.totalDocs} messages, ${timeEntries.totalDocs} entr\xE9es de temps)`,
@@ -867,13 +1007,11 @@ function createMergeTicketsEndpoint(slugs) {
           },
           overrideAccess: true
         });
-        await payload.delete({
-          collection: slugs.tickets,
+        await dbDelete(payload, slugs.tickets, {
           id: sourceTicketId,
           overrideAccess: true
         });
-        const allTimeEntries = await payload.find({
-          collection: slugs.timeEntries,
+        const allTimeEntries = await dbFind(payload, slugs.timeEntries, {
           where: { ticket: { equals: targetTicketId } },
           limit: 500,
           depth: 0,
@@ -883,8 +1021,7 @@ function createMergeTicketsEndpoint(slugs) {
           (sum, e) => sum + (e.duration || 0),
           0
         );
-        await payload.update({
-          collection: slugs.tickets,
+        await dbUpdate(payload, slugs.tickets, {
           id: targetTicketId,
           data: { totalTimeMinutes: totalMinutes },
           overrideAccess: true
@@ -919,8 +1056,7 @@ function createSplitTicketEndpoint(slugs) {
         if (!messageId) {
           return Response.json({ error: "messageId required" }, { status: 400 });
         }
-        const message = await payload.findByID({
-          collection: slugs.ticketMessages,
+        const message = await dbFindByID(payload, slugs.ticketMessages, {
           id: messageId,
           depth: 1,
           overrideAccess: true
@@ -933,8 +1069,7 @@ function createSplitTicketEndpoint(slugs) {
           return Response.json({ error: "Cannot resolve source ticket" }, { status: 400 });
         }
         const clientId = typeof sourceTicket.client === "object" ? sourceTicket.client.id : sourceTicket.client;
-        const newTicket = await payload.create({
-          collection: slugs.tickets,
+        const newTicket = await dbCreate(payload, slugs.tickets, {
           data: {
             subject: subject || `Split: ${sourceTicket.subject}`,
             client: clientId,
@@ -949,8 +1084,7 @@ function createSplitTicketEndpoint(slugs) {
         const attachments = message.attachments?.map((a) => ({
           file: typeof a.file === "object" ? a.file.id : a.file
         })) || [];
-        await payload.create({
-          collection: slugs.ticketMessages,
+        await dbCreate(payload, slugs.ticketMessages, {
           data: {
             ticket: newTicket.id,
             body: message.body,
@@ -963,8 +1097,7 @@ function createSplitTicketEndpoint(slugs) {
           },
           overrideAccess: true
         });
-        await payload.create({
-          collection: slugs.ticketMessages,
+        await dbCreate(payload, slugs.ticketMessages, {
           data: {
             ticket: sourceTicket.id,
             body: `Message extrait vers le ticket ${newTicket.ticketNumber}`,
@@ -976,15 +1109,13 @@ function createSplitTicketEndpoint(slugs) {
         });
         const existingRelated = Array.isArray(sourceTicket.relatedTickets) ? sourceTicket.relatedTickets.map((t) => typeof t === "object" ? t.id : t) : [];
         if (!existingRelated.includes(newTicket.id)) {
-          await payload.update({
-            collection: slugs.tickets,
+          await dbUpdate(payload, slugs.tickets, {
             id: sourceTicket.id,
             data: { relatedTickets: [...existingRelated, newTicket.id] },
             overrideAccess: true
           });
         }
-        await payload.create({
-          collection: slugs.ticketActivityLog,
+        await dbCreate(payload, slugs.ticketActivityLog, {
           data: {
             ticket: sourceTicket.id,
             action: "split",
@@ -1199,8 +1330,7 @@ function createSettingsGetEndpoint(slugs) {
       try {
         const payload = req.payload;
         requireAdmin(req, slugs);
-        const prefs = await payload.find({
-          collection: "payload-preferences",
+        const prefs = await dbFind(payload, "payload-preferences", {
           where: { key: { equals: PREF_KEY2 } },
           limit: 1,
           depth: 0,
@@ -1257,6 +1387,7 @@ function createSettingsPostEndpoint(slugs) {
             ]
           }
         });
+        invalidateSupportSettingsCache();
         return Response.json(merged);
       } catch (error) {
         const authResponse = handleAuthError(error);
@@ -1278,8 +1409,7 @@ function createSignatureGetEndpoint(slugs) {
       try {
         const payload = req.payload;
         requireAdmin(req, slugs);
-        const prefs = await payload.find({
-          collection: "payload-preferences",
+        const prefs = await dbFind(payload, "payload-preferences", {
           where: { key: { equals: `${PREF_KEY3}-${req.user.id}` } },
           limit: 1,
           depth: 0,
@@ -1306,8 +1436,7 @@ function createSignaturePostEndpoint(slugs) {
         requireAdmin(req, slugs);
         const { signature } = await req.json();
         const key = `${PREF_KEY3}-${req.user.id}`;
-        const existing = await payload.find({
-          collection: "payload-preferences",
+        const existing = await dbFind(payload, "payload-preferences", {
           where: { key: { equals: key } },
           limit: 1,
           depth: 0,
@@ -1350,8 +1479,7 @@ function createRoundRobinConfigGetEndpoint(slugs) {
       try {
         const payload = req.payload;
         requireAdmin(req, slugs);
-        const prefs = await payload.find({
-          collection: "payload-preferences",
+        const prefs = await dbFind(payload, "payload-preferences", {
           where: { key: { equals: PREF_KEY4 } },
           limit: 1,
           depth: 0,
@@ -1377,8 +1505,7 @@ function createRoundRobinConfigPostEndpoint(slugs) {
         const payload = req.payload;
         requireAdmin(req, slugs);
         const { enabled } = await req.json();
-        const existing = await payload.find({
-          collection: "payload-preferences",
+        const existing = await dbFind(payload, "payload-preferences", {
           where: { key: { equals: PREF_KEY4 } },
           limit: 1,
           depth: 0,
@@ -1422,8 +1549,7 @@ function createSlaCheckEndpoint(slugs) {
         requireAdmin(req, slugs);
         const now = /* @__PURE__ */ new Date();
         const nowISO = now.toISOString();
-        const { docs: tickets } = await payload.find({
-          collection: slugs.tickets,
+        const { docs: tickets } = await dbFind(payload, slugs.tickets, {
           where: {
             and: [
               { status: { in: ["open", "waiting_client"] } },
@@ -1517,6 +1643,107 @@ function createSlaCheckEndpoint(slugs) {
     }
   };
 }
+var TRANSPARENT_GIF = Buffer.from(
+  "R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7",
+  "base64"
+);
+function generateTrackingToken(ticketId, messageId, secret) {
+  return createHmac("sha256", secret).update(`${ticketId}:${messageId}`).digest("hex").substring(0, 16);
+}
+function createTrackOpenEndpoint(slugs) {
+  return {
+    path: "/support/track-open",
+    method: "get",
+    handler: async (req) => {
+      const url = new URL(req.url);
+      const ticketId = url.searchParams.get("t");
+      const messageId = url.searchParams.get("m");
+      const sig = url.searchParams.get("sig");
+      const parsedId = ticketId ? Number(ticketId) : NaN;
+      const parsedMsgId = messageId ? Number(messageId) : NaN;
+      const secret = process.env.PAYLOAD_SECRET || "";
+      const validSig = !!secret && !!ticketId && !!messageId && !!sig && sig === generateTrackingToken(ticketId, messageId, secret);
+      if (!validSig) {
+        return new Response(TRANSPARENT_GIF, {
+          status: 200,
+          headers: {
+            "Content-Type": "image/gif",
+            "Content-Length": String(TRANSPARENT_GIF.length),
+            "Cache-Control": "no-store, no-cache, must-revalidate, max-age=0"
+          }
+        });
+      }
+      if (ticketId && Number.isInteger(parsedId) && parsedId > 0) {
+        try {
+          const payload = req.payload;
+          const ticket = await dbFindByID(payload, slugs.tickets, {
+            id: parsedId,
+            depth: 0,
+            overrideAccess: true,
+            select: { lastClientReadAt: true }
+          });
+          if (ticket) {
+            const lastRead = ticket.lastClientReadAt ? new Date(ticket.lastClientReadAt).getTime() : 0;
+            const fiveMinAgo = Date.now() - 5 * 60 * 1e3;
+            if (lastRead < fiveMinAgo) {
+              await dbUpdate(payload, slugs.tickets, {
+                id: parsedId,
+                data: { lastClientReadAt: (/* @__PURE__ */ new Date()).toISOString() },
+                overrideAccess: true
+              });
+            }
+          }
+          if (Number.isInteger(parsedMsgId) && parsedMsgId > 0) {
+            const msg = await dbFindByID(payload, slugs.ticketMessages, {
+              id: parsedMsgId,
+              depth: 0,
+              overrideAccess: true,
+              select: { emailOpenedAt: true }
+            });
+            if (msg && !msg.emailOpenedAt) {
+              await dbUpdate(payload, slugs.ticketMessages, {
+                id: parsedMsgId,
+                data: { emailOpenedAt: (/* @__PURE__ */ new Date()).toISOString() },
+                overrideAccess: true
+              });
+              const ticketInfo = await dbFindByID(payload, slugs.tickets, {
+                id: parsedId,
+                depth: 1,
+                overrideAccess: true,
+                select: { ticketNumber: true, subject: true, client: true }
+              });
+              const clientName = typeof ticketInfo?.client === "object" ? ticketInfo.client?.firstName || "Client" : "Client";
+              try {
+                await dbCreate(payload, "admin-notifications", {
+                  data: {
+                    title: `Email ouvert \u2014 ${ticketInfo?.ticketNumber || "TK-????"}`,
+                    message: `${clientName} a ouvert votre email pour "${ticketInfo?.subject || "ticket"}"`,
+                    type: "email_opened",
+                    link: `/admin/ticket?id=${parsedId}`
+                  },
+                  overrideAccess: true
+                });
+              } catch {
+              }
+            }
+          }
+        } catch (err) {
+          console.error("[track-open] Error:", err);
+        }
+      }
+      return new Response(TRANSPARENT_GIF, {
+        status: 200,
+        headers: {
+          "Content-Type": "image/gif",
+          "Content-Length": String(TRANSPARENT_GIF.length),
+          "Cache-Control": "no-store, no-cache, must-revalidate, max-age=0",
+          "Pragma": "no-cache",
+          "Expires": "0"
+        }
+      });
+    }
+  };
+}
 
 // src/utils/emailTemplate.ts
 var COLORS = {
@@ -1553,7 +1780,10 @@ function escapeHtml(str) {
 }
 function emailTrackingPixel(ticketId, messageId, baseUrl) {
   const url = process.env.NEXT_PUBLIC_SERVER_URL || "";
-  const params = `t=${ticketId}${messageId ? `&m=${messageId}` : ""}`;
+  const secret = process.env.PAYLOAD_SECRET || "";
+  if (!secret || messageId === void 0 || messageId === null) return "";
+  const sig = generateTrackingToken(String(ticketId), String(messageId), secret);
+  const params = `t=${ticketId}&m=${messageId}&sig=${sig}`;
   return `<img src="${url}/api/support/track-open?${params}" width="1" height="1" alt="" style="display:block;width:1px;height:1px;border:0;" />`;
 }
 function emailRichContent(html, config) {
@@ -1818,8 +2048,7 @@ function createAutoCloseEndpoint(slugs) {
         const CLOSE_AFTER_REMIND_DAYS = settings.autoClose.reminderDaysBefore;
         const results = { reminded: 0, closed: 0, errors: 0 };
         const remindCutoff = new Date(now.getTime() - REMIND_AFTER_DAYS * 24 * 60 * 60 * 1e3);
-        const ticketsToRemind = await payload.find({
-          collection: slugs.tickets,
+        const ticketsToRemind = await dbFind(payload, slugs.tickets, {
           where: {
             and: [
               { status: { equals: "waiting_client" } },
@@ -1850,8 +2079,7 @@ function createAutoCloseEndpoint(slugs) {
                 <p><a href="${portalUrl}">R\xE9pondre au ticket</a></p>
               </div>`
             });
-            await payload.update({
-              collection: slugs.tickets,
+            await dbUpdate(payload, slugs.tickets, {
               id: t.id,
               data: { autoCloseRemindedAt: now.toISOString() },
               overrideAccess: true
@@ -1863,8 +2091,7 @@ function createAutoCloseEndpoint(slugs) {
           }
         }
         const closeCutoff = new Date(now.getTime() - CLOSE_AFTER_REMIND_DAYS * 24 * 60 * 60 * 1e3);
-        const ticketsToClose = await payload.find({
-          collection: slugs.tickets,
+        const ticketsToClose = await dbFind(payload, slugs.tickets, {
           where: {
             and: [
               { status: { equals: "waiting_client" } },
@@ -1899,8 +2126,7 @@ function createAutoCloseEndpoint(slugs) {
             const closeTotalDays = REMIND_AFTER_DAYS + CLOSE_AFTER_REMIND_DAYS;
             const viaSchedule = !!t.autoCloseScheduledAt && new Date(t.autoCloseScheduledAt).getTime() <= now.getTime();
             const noteBody = viaSchedule ? "Ticket r\xE9solu automatiquement \u2014 relance manuelle rest\xE9e sans r\xE9ponse du client" : `Ticket r\xE9solu automatiquement \u2014 sans r\xE9ponse client depuis ${closeTotalDays} jours`;
-            await payload.create({
-              collection: slugs.ticketMessages,
+            await dbCreate(payload, slugs.ticketMessages, {
               data: {
                 ticket: t.id,
                 body: noteBody,
@@ -1910,8 +2136,7 @@ function createAutoCloseEndpoint(slugs) {
               },
               overrideAccess: true
             });
-            await payload.update({
-              collection: slugs.tickets,
+            await dbUpdate(payload, slugs.tickets, {
               id: t.id,
               // Clear the armed deadline so a later manual reopen can't be
               // closed instantly by a stale timestamp.
@@ -2034,8 +2259,7 @@ function createSendReminderEndpoint(slugs) {
         }
         const rawHours = Number(body.hours);
         const hours = Number.isFinite(rawHours) ? Math.min(MAX_HOURS, Math.max(MIN_HOURS, Math.round(rawHours))) : 24;
-        const ticket = await payload.findByID({
-          collection: slugs.tickets,
+        const ticket = await dbFindByID(payload, slugs.tickets, {
           id: ticketId,
           depth: 1,
           overrideAccess: true
@@ -2057,8 +2281,7 @@ function createSendReminderEndpoint(slugs) {
         const replyTo = settings.email.replyToAddress || process.env.SUPPORT_REPLY_TO || "";
         let waitingSince = ticket.firstResponseAt || ticket.createdAt;
         try {
-          const lastAdminMsg = await payload.find({
-            collection: slugs.ticketMessages,
+          const lastAdminMsg = await dbFind(payload, slugs.ticketMessages, {
             where: {
               and: [
                 { ticket: { equals: ticketId } },
@@ -2099,8 +2322,7 @@ function createSendReminderEndpoint(slugs) {
             preheader: `Sans r\xE9ponse de votre part, votre ticket ${ticketNumber} sera cl\xF4tur\xE9 le ${deadlineLabel}.`
           })
         });
-        await payload.create({
-          collection: slugs.ticketMessages,
+        await dbCreate(payload, slugs.ticketMessages, {
           data: {
             ticket: ticketId,
             body: `Relance envoy\xE9e \xE0 ${client.email}. Fermeture automatique programm\xE9e le ${deadlineLabel} sans r\xE9ponse du client.`,
@@ -2110,8 +2332,7 @@ function createSendReminderEndpoint(slugs) {
           },
           overrideAccess: true
         });
-        await payload.update({
-          collection: slugs.tickets,
+        await dbUpdate(payload, slugs.tickets, {
           id: ticketId,
           data: {
             status: "waiting_client",
@@ -2146,8 +2367,7 @@ function createStatusesEndpoint(slugs) {
         if (!req.user) {
           return Response.json({ error: "Unauthorized" }, { status: 401 });
         }
-        const { docs } = await payload.find({
-          collection: slugs.ticketStatuses,
+        const { docs } = await dbFind(payload, slugs.ticketStatuses, {
           sort: "sortOrder",
           limit: 100,
           depth: 0,
@@ -2186,16 +2406,14 @@ function createApplyMacroEndpoint(slugs) {
         if (!macroId || !ticketId) {
           return Response.json({ error: "macroId and ticketId are required" }, { status: 400 });
         }
-        const macro = await payload.findByID({
-          collection: slugs.macros,
+        const macro = await dbFindByID(payload, slugs.macros, {
           id: macroId,
           depth: 0,
           overrideAccess: true
         });
         if (!macro) return Response.json({ error: "Macro not found" }, { status: 404 });
         if (!macro.isActive) return Response.json({ error: "Macro is disabled" }, { status: 400 });
-        const ticket = await payload.findByID({
-          collection: slugs.tickets,
+        const ticket = await dbFindByID(payload, slugs.tickets, {
           id: ticketId,
           depth: 0,
           overrideAccess: true
@@ -2207,8 +2425,7 @@ function createApplyMacroEndpoint(slugs) {
           try {
             switch (action.type) {
               case "set_status":
-                await payload.update({
-                  collection: slugs.tickets,
+                await dbUpdate(payload, slugs.tickets, {
                   id: ticketId,
                   data: { status: action.value },
                   overrideAccess: true
@@ -2216,8 +2433,7 @@ function createApplyMacroEndpoint(slugs) {
                 appliedActions.push({ type: action.type, value: action.value, success: true });
                 break;
               case "set_priority":
-                await payload.update({
-                  collection: slugs.tickets,
+                await dbUpdate(payload, slugs.tickets, {
                   id: ticketId,
                   data: { priority: action.value },
                   overrideAccess: true
@@ -2229,8 +2445,7 @@ function createApplyMacroEndpoint(slugs) {
                 if (!currentTags.includes(action.value)) {
                   currentTags.push(action.value);
                 }
-                await payload.update({
-                  collection: slugs.tickets,
+                await dbUpdate(payload, slugs.tickets, {
                   id: ticketId,
                   data: { tags: currentTags },
                   overrideAccess: true
@@ -2239,8 +2454,7 @@ function createApplyMacroEndpoint(slugs) {
                 break;
               }
               case "send_reply":
-                await payload.create({
-                  collection: slugs.ticketMessages,
+                await dbCreate(payload, slugs.ticketMessages, {
                   data: {
                     ticket: ticketId,
                     body: action.value,
@@ -2257,8 +2471,7 @@ function createApplyMacroEndpoint(slugs) {
                   appliedActions.push({ type: action.type, value: action.value, success: false, error: "Invalid user ID" });
                   break;
                 }
-                await payload.update({
-                  collection: slugs.tickets,
+                await dbUpdate(payload, slugs.tickets, {
                   id: ticketId,
                   data: { assignedTo: userId },
                   overrideAccess: true
@@ -2310,8 +2523,7 @@ function createPurgeLogsEndpoint(slugs) {
           return Response.json({ error: "Invalid collection. Use email-logs or auth-logs." }, { status: 400 });
         }
         const cutoff = days > 0 ? new Date(Date.now() - days * 864e5).toISOString() : null;
-        const result = await payload.delete({
-          collection: allowedCollections[collection],
+        const result = await dbDelete(payload, allowedCollections[collection], {
           where: cutoff ? { createdAt: { less_than: cutoff } } : { id: { exists: true } },
           overrideAccess: true
         });
@@ -2354,8 +2566,7 @@ function createChatbotEndpoint(slugs) {
           return Response.json({ error: "Question too short" }, { status: 400 });
         }
         const payload = req.payload;
-        const articles = await payload.find({
-          collection: slugs.knowledgeBase,
+        const articles = await dbFind(payload, slugs.knowledgeBase, {
           where: { published: { equals: true } },
           limit: 100,
           depth: 0,
@@ -2445,8 +2656,7 @@ function createChatGetEndpoint(slugs) {
         if (after) {
           where.createdAt = { greater_than: after };
         }
-        const messages = await payload.find({
-          collection: slugs.chatMessages,
+        const messages = await dbFind(payload, slugs.chatMessages, {
           where,
           sort: "createdAt",
           limit: 100,
@@ -2489,8 +2699,7 @@ function createChatPostEndpoint(slugs) {
             return Response.json({ error: "Trop de sessions cr\xE9\xE9es. R\xE9essayez plus tard." }, { status: 429 });
           }
           const sessionId = `chat_${crypto3.randomBytes(16).toString("hex")}`;
-          const systemMsg = await payload.create({
-            collection: slugs.chatMessages,
+          const systemMsg = await dbCreate(payload, slugs.chatMessages, {
             data: {
               session: sessionId,
               client: req.user.id,
@@ -2510,8 +2719,7 @@ function createChatPostEndpoint(slugs) {
           if (!trimmedMessage || trimmedMessage.length > 2e3) {
             return Response.json({ error: "Message invalide (1-2000 caract\xE8res)." }, { status: 400 });
           }
-          const existing = await payload.find({
-            collection: slugs.chatMessages,
+          const existing = await dbFind(payload, slugs.chatMessages, {
             where: { session: { equals: session }, client: { equals: req.user.id } },
             limit: 1,
             overrideAccess: true
@@ -2519,8 +2727,7 @@ function createChatPostEndpoint(slugs) {
           if (existing.docs.length === 0) {
             return Response.json({ error: "Session invalide" }, { status: 403 });
           }
-          const newMsg = await payload.create({
-            collection: slugs.chatMessages,
+          const newMsg = await dbCreate(payload, slugs.chatMessages, {
             data: {
               session,
               client: req.user.id,
@@ -2533,8 +2740,7 @@ function createChatPostEndpoint(slugs) {
           return Response.json({ message: newMsg });
         }
         if (action === "close" && session) {
-          const existing = await payload.find({
-            collection: slugs.chatMessages,
+          const existing = await dbFind(payload, slugs.chatMessages, {
             where: { session: { equals: session }, client: { equals: req.user.id } },
             limit: 1,
             overrideAccess: true
@@ -2542,8 +2748,7 @@ function createChatPostEndpoint(slugs) {
           if (existing.docs.length === 0) {
             return Response.json({ error: "Session invalide" }, { status: 403 });
           }
-          await payload.create({
-            collection: slugs.chatMessages,
+          await dbCreate(payload, slugs.chatMessages, {
             data: {
               session,
               client: req.user.id,
@@ -2585,8 +2790,7 @@ function createChatStreamEndpoint(slugs) {
       if (!sessionId) {
         return Response.json({ error: "Missing session parameter" }, { status: 400 });
       }
-      const existing = await req.payload.find({
-        collection: slugs.chatMessages,
+      const existing = await dbFind(req.payload, slugs.chatMessages, {
         where: {
           session: { equals: sessionId },
           client: { equals: userId }
@@ -2608,8 +2812,7 @@ function createChatStreamEndpoint(slugs) {
           );
           const interval = setInterval(async () => {
             try {
-              const messages = await req.payload.find({
-                collection: slugs.chatMessages,
+              const messages = await dbFind(req.payload, slugs.chatMessages, {
                 where: {
                   session: { equals: sessionId },
                   createdAt: { greater_than: lastCheck }
@@ -2690,8 +2893,7 @@ function createAdminChatGetEndpoint(slugs) {
         if (session) {
           const where = { session: { equals: session } };
           if (after) where.createdAt = { greater_than: after };
-          const messages = await payload.find({
-            collection: slugs.chatMessages,
+          const messages = await dbFind(payload, slugs.chatMessages, {
             where,
             sort: "createdAt",
             limit: 200,
@@ -2705,8 +2907,7 @@ function createAdminChatGetEndpoint(slugs) {
             }
           });
         }
-        const recentMessages = await payload.find({
-          collection: slugs.chatMessages,
+        const recentMessages = await dbFind(payload, slugs.chatMessages, {
           sort: "-createdAt",
           limit: 50,
           depth: 1,
@@ -2769,8 +2970,7 @@ function createAdminChatPostEndpoint(slugs) {
         if (!session) {
           return Response.json({ error: "Session requise" }, { status: 400 });
         }
-        const sessionMsg = await payload.find({
-          collection: slugs.chatMessages,
+        const sessionMsg = await dbFind(payload, slugs.chatMessages, {
           where: { session: { equals: session } },
           limit: 1,
           depth: 0,
@@ -2788,8 +2988,7 @@ function createAdminChatPostEndpoint(slugs) {
           if (!trimmedMessage || trimmedMessage.length > 2e3) {
             return Response.json({ error: "Message invalide (1-2000 caract\xE8res)." }, { status: 400 });
           }
-          const newMsg = await payload.create({
-            collection: slugs.chatMessages,
+          const newMsg = await dbCreate(payload, slugs.chatMessages, {
             data: {
               session,
               client: clientId,
@@ -2801,8 +3000,7 @@ function createAdminChatPostEndpoint(slugs) {
             overrideAccess: true
           });
           try {
-            const linkedTicket = await payload.find({
-              collection: slugs.tickets,
+            const linkedTicket = await dbFind(payload, slugs.tickets, {
               where: { chatSession: { equals: session } },
               limit: 1,
               depth: 0,
@@ -2810,8 +3008,7 @@ function createAdminChatPostEndpoint(slugs) {
             });
             if (linkedTicket.docs.length > 0) {
               const ticketId = linkedTicket.docs[0].id;
-              await payload.create({
-                collection: slugs.ticketMessages,
+              await dbCreate(payload, slugs.ticketMessages, {
                 data: {
                   ticket: ticketId,
                   body: trimmedMessage,
@@ -2820,8 +3017,7 @@ function createAdminChatPostEndpoint(slugs) {
                 },
                 overrideAccess: true
               });
-              await payload.update({
-                collection: slugs.chatMessages,
+              await dbUpdate(payload, slugs.chatMessages, {
                 id: newMsg.id,
                 data: { ticket: ticketId },
                 overrideAccess: true
@@ -2833,8 +3029,7 @@ function createAdminChatPostEndpoint(slugs) {
           return Response.json({ message: newMsg });
         }
         if (action === "close") {
-          await payload.create({
-            collection: slugs.chatMessages,
+          await dbCreate(payload, slugs.chatMessages, {
             data: {
               session,
               client: clientId,
@@ -2845,16 +3040,14 @@ function createAdminChatPostEndpoint(slugs) {
             overrideAccess: true
           });
           try {
-            const linkedTicket = await payload.find({
-              collection: slugs.tickets,
+            const linkedTicket = await dbFind(payload, slugs.tickets, {
               where: { chatSession: { equals: session } },
               limit: 1,
               depth: 0,
               overrideAccess: true
             });
             if (linkedTicket.docs.length > 0) {
-              await payload.create({
-                collection: slugs.ticketMessages,
+              await dbCreate(payload, slugs.ticketMessages, {
                 data: {
                   ticket: linkedTicket.docs[0].id,
                   body: "Session de chat termin\xE9e par un agent.",
@@ -2917,8 +3110,7 @@ function createSessionStream(req, slugs, sessionId) {
       );
       const interval = setInterval(async () => {
         try {
-          const messages = await req.payload.find({
-            collection: slugs.chatMessages,
+          const messages = await dbFind(req.payload, slugs.chatMessages, {
             where: {
               session: { equals: sessionId },
               createdAt: { greater_than: lastCheck }
@@ -2991,8 +3183,7 @@ function createSessionListStream(req, slugs) {
       );
       const interval = setInterval(async () => {
         try {
-          const recentMessages = await req.payload.find({
-            collection: slugs.chatMessages,
+          const recentMessages = await dbFind(req.payload, slugs.chatMessages, {
             sort: "-createdAt",
             limit: 50,
             depth: 1,
@@ -3079,8 +3270,7 @@ function createAdminStatsEndpoint(slugs) {
         const statuses = ["open", "waiting_client", "resolved"];
         const statusCounts = await Promise.all(
           statuses.map(async (status) => {
-            const result = await payload.count({
-              collection: slugs.tickets,
+            const result = await dbCount(payload, slugs.tickets, {
               where: { status: { equals: status } },
               overrideAccess: true
             });
@@ -3092,8 +3282,7 @@ function createAdminStatsEndpoint(slugs) {
         const priorities = ["low", "normal", "high", "urgent"];
         const priorityCounts = await Promise.all(
           priorities.map(async (priority) => {
-            const result = await payload.count({
-              collection: slugs.tickets,
+            const result = await dbCount(payload, slugs.tickets, {
               where: { priority: { equals: priority } },
               overrideAccess: true
             });
@@ -3104,8 +3293,7 @@ function createAdminStatsEndpoint(slugs) {
         const categories = ["bug", "content", "feature", "question", "hosting"];
         const categoryCounts = await Promise.all(
           categories.map(async (category) => {
-            const result = await payload.count({
-              collection: slugs.tickets,
+            const result = await dbCount(payload, slugs.tickets, {
               where: { category: { equals: category } },
               overrideAccess: true
             });
@@ -3119,17 +3307,34 @@ function createAdminStatsEndpoint(slugs) {
         const thirtyDaysAgo = new Date(now.getTime() - 30 * 24 * 60 * 60 * 1e3);
         const sevenDaysAgo = new Date(now.getTime() - 7 * 24 * 60 * 60 * 1e3);
         const [created7, created30] = await Promise.all([
-          payload.count({
-            collection: slugs.tickets,
+          dbCount(payload, slugs.tickets, {
             where: { createdAt: { greater_than_equal: sevenDaysAgo.toISOString() } },
             overrideAccess: true
           }),
-          payload.count({
-            collection: slugs.tickets,
+          dbCount(payload, slugs.tickets, {
             where: { createdAt: { greater_than_equal: thirtyDaysAgo.toISOString() } },
             overrideAccess: true
           })
         ]);
+        const volumeByDay = await Promise.all(
+          Array.from({ length: 7 }, (_, i) => i).map(async (offset) => {
+            const dayStart = new Date(now);
+            dayStart.setHours(0, 0, 0, 0);
+            dayStart.setDate(dayStart.getDate() - (6 - offset));
+            const dayEnd = new Date(dayStart);
+            dayEnd.setDate(dayEnd.getDate() + 1);
+            const r = await dbCount(payload, slugs.tickets, {
+              where: {
+                and: [
+                  { createdAt: { greater_than_equal: dayStart.toISOString() } },
+                  { createdAt: { less_than: dayEnd.toISOString() } }
+                ]
+              },
+              overrideAccess: true
+            });
+            return { date: dayStart.toISOString(), count: r.totalDocs };
+          })
+        );
         const PAGE_SIZE2 = 100;
         const MAX_PAGES2 = 50;
         let totalResponseTimeMs = 0;
@@ -3140,8 +3345,7 @@ function createAdminStatsEndpoint(slugs) {
         let page = 1;
         let hasMore = true;
         while (hasMore && page <= MAX_PAGES2) {
-          const batch = await payload.find({
-            collection: slugs.tickets,
+          const batch = await dbFind(payload, slugs.tickets, {
             limit: PAGE_SIZE2,
             page,
             depth: 0,
@@ -3174,43 +3378,62 @@ function createAdminStatsEndpoint(slugs) {
           hasMore = batch.hasNextPage ?? false;
           page++;
         }
-        const surveyCount = await payload.count({
-          collection: slugs.satisfactionSurveys,
+        const surveyCount = await dbCount(payload, slugs.satisfactionSurveys, {
           overrideAccess: true
         });
         let satisfactionAvg = 0;
+        let satisfactionCount = 0;
+        let npsScore = null;
+        let npsCount = 0;
         if (surveyCount.totalDocs > 0) {
-          let totalRating = 0;
+          let ratingSum = 0;
+          let ratingN = 0;
+          let promoters = 0;
+          let detractors = 0;
+          let npsN = 0;
           let surveyPage = 1;
           let surveyHasMore = true;
           while (surveyHasMore && surveyPage <= MAX_PAGES2) {
-            const batch = await payload.find({
-              collection: slugs.satisfactionSurveys,
+            const batch = await dbFind(payload, slugs.satisfactionSurveys, {
               limit: PAGE_SIZE2,
               page: surveyPage,
               depth: 0,
               overrideAccess: true,
-              select: { rating: true }
+              select: { rating: true, nps: true }
             });
             for (const s of batch.docs) {
-              totalRating += s.rating || 0;
+              const r = s.rating;
+              if (typeof r === "number" && r > 0) {
+                ratingSum += r;
+                ratingN++;
+              }
+              const n = s.nps;
+              if (typeof n === "number") {
+                npsN++;
+                if (n >= 9) promoters++;
+                else if (n <= 6) detractors++;
+              }
             }
             surveyHasMore = batch.hasNextPage ?? false;
             surveyPage++;
           }
-          satisfactionAvg = Math.round(totalRating / surveyCount.totalDocs * 10) / 10;
+          satisfactionAvg = ratingN > 0 ? Math.round(ratingSum / ratingN * 10) / 10 : 0;
+          satisfactionCount = ratingN;
+          if (npsN > 0) {
+            npsScore = Math.round((promoters - detractors) / npsN * 100);
+            npsCount = npsN;
+          }
         }
-        const [clientCount, pendingEmailsCount] = await Promise.all([
-          payload.count({
-            collection: slugs.supportClients,
-            overrideAccess: true
-          }),
-          payload.count({
-            collection: slugs.pendingEmails,
+        const clientCount = await dbCount(payload, slugs.supportClients, { overrideAccess: true });
+        let pendingEmailsTotal = 0;
+        try {
+          const pe = await dbCount(payload, slugs.pendingEmails, {
             where: { status: { equals: "pending" } },
             overrideAccess: true
-          })
-        ]);
+          });
+          pendingEmailsTotal = pe.totalDocs;
+        } catch {
+        }
         return new Response(JSON.stringify({
           total,
           byStatus,
@@ -3218,13 +3441,16 @@ function createAdminStatsEndpoint(slugs) {
           byCategory,
           createdLast7Days: created7.totalDocs,
           createdLast30Days: created30.totalDocs,
+          volumeByDay,
           avgResponseTimeHours: responseTimeCount > 0 ? Math.round(totalResponseTimeMs / responseTimeCount / (1e3 * 60 * 60) * 10) / 10 : null,
           avgResolutionTimeHours: resolutionTimeCount > 0 ? Math.round(totalResolutionTimeMs / resolutionTimeCount / (1e3 * 60 * 60) * 10) / 10 : null,
           totalTimeMinutes,
           satisfactionAvg,
-          satisfactionCount: surveyCount.totalDocs,
+          satisfactionCount,
+          npsScore,
+          npsCount,
           clientCount: clientCount.totalDocs,
-          pendingEmailsCount: pendingEmailsCount.totalDocs
+          pendingEmailsCount: pendingEmailsTotal
         }), {
           headers: {
             "Content-Type": "application/json",
@@ -3294,13 +3520,26 @@ function createBillingEndpoint(slugs) {
         let ticketPage = 1;
         let ticketHasMore = true;
         while (ticketHasMore && ticketPage <= MAX_PAGES) {
-          const batch = await payload.find({
-            collection: slugs.tickets,
+          const batch = await dbFind(payload, slugs.tickets, {
             where: ticketWhere,
             limit: PAGE_SIZE,
             page: ticketPage,
+            // depth 2 is required: we read ticket.project.client.company below.
             depth: 2,
-            overrideAccess: true
+            overrideAccess: true,
+            // Bound the payload to only the fields the report consumes (skips body,
+            // richText, SLA fields, etc.) while keeping project/client populated.
+            select: {
+              ticketNumber: true,
+              subject: true,
+              status: true,
+              billedAmount: true,
+              aiSummary: true,
+              aiSummaryGeneratedAt: true,
+              aiSummaryStatus: true,
+              project: true,
+              client: true
+            }
           });
           allTickets.push(...batch.docs);
           ticketHasMore = batch.hasNextPage ?? false;
@@ -3310,8 +3549,7 @@ function createBillingEndpoint(slugs) {
         let entryPage = 1;
         let entryHasMore = true;
         while (entryHasMore && entryPage <= MAX_PAGES) {
-          const batch = await payload.find({
-            collection: slugs.timeEntries,
+          const batch = await dbFind(payload, slugs.timeEntries, {
             where: {
               and: [
                 { date: { greater_than_equal: from } },
@@ -3409,43 +3647,205 @@ function createBillingEndpoint(slugs) {
     }
   };
 }
-
-// src/utils/generateTicketSynthesis.ts
-function getClient3(aiSettings) {
-  const Anthropic = __require("@anthropic-ai/sdk").default;
-  if (aiSettings.provider === "ollama") {
-    const baseURL = process.env.OLLAMA_API_URL || "https://ollama.orkelis.app/v1";
-    return new Anthropic({ apiKey: "ollama", baseURL });
-  }
-  return new Anthropic({ apiKey: process.env.ANTHROPIC_API_KEY });
-}
-function getModel3(aiSettings) {
-  return aiSettings.model || "claude-haiku-4-5-20251001";
-}
-async function generateTicketSynthesis(args) {
-  const { payload, slugs, ticketId } = args;
-  const settings = await readSupportSettings(payload);
-  if (settings.ai.enableSynthesis === false) {
-    return { summary: "", generatedAt: (/* @__PURE__ */ new Date()).toISOString(), status: "skipped", reason: "synthesis disabled" };
-  }
-  const ticket = await payload.findByID({
-    collection: slugs.tickets,
-    id: ticketId,
-    depth: 1,
-    overrideAccess: true
+var fmtAmount = (n) => `${n.toFixed(2)} EUR`;
+var fmtTime = (min) => `${Math.floor(min / 60)}h${String(min % 60).padStart(2, "0")}`;
+function generateInvoicePdf(data) {
+  return new Promise((resolve, reject) => {
+    try {
+      const doc = new PDFDocument({ size: "A4", margin: 50 });
+      const chunks = [];
+      doc.on("data", (c) => chunks.push(c));
+      doc.on("end", () => resolve(Buffer.concat(chunks)));
+      doc.on("error", reject);
+      doc.fillColor("#0f172a").fontSize(22).text("Invoice / Pre-billing");
+      doc.moveDown(0.2);
+      doc.fillColor("#64748b").fontSize(10).text(`Period: ${data.from} -> ${data.to}${data.projectId ? `   \xB7   Project #${data.projectId}` : ""}`);
+      doc.moveDown(1);
+      const X = { ticket: 50, subject: 130, client: 320, time: 430, amount: 500 };
+      const drawRow = (r, opts) => {
+        const y = doc.y;
+        doc.fontSize(opts?.header ? 9 : 10).fillColor(opts?.header ? "#475569" : "#0f172a");
+        if (opts?.total) doc.font("Helvetica-Bold");
+        doc.text(r.ticket, X.ticket, y, { width: X.subject - X.ticket - 6 });
+        doc.text(r.subject, X.subject, y, { width: X.client - X.subject - 6 });
+        doc.text(r.client, X.client, y, { width: X.time - X.client - 6 });
+        doc.text(r.time, X.time, y, { width: X.amount - X.time - 6, align: "right" });
+        doc.text(r.amount, X.amount, y, { width: 545 - X.amount, align: "right" });
+        doc.font("Helvetica");
+        doc.moveDown(0.4);
+      };
+      drawRow({ ticket: "Ticket", subject: "Subject", client: "Client", time: "Time", amount: "Amount" }, { header: true });
+      doc.moveTo(50, doc.y).lineTo(545, doc.y).strokeColor("#e2e8f0").stroke();
+      doc.moveDown(0.3);
+      for (const l of data.lines) {
+        if (doc.y > 760) doc.addPage();
+        drawRow({
+          ticket: l.ticketNumber || "",
+          subject: l.subject || "",
+          client: l.client || "",
+          time: fmtTime(l.minutes),
+          amount: fmtAmount(l.amount)
+        });
+      }
+      doc.moveTo(50, doc.y).lineTo(545, doc.y).strokeColor("#0f172a").stroke();
+      doc.moveDown(0.3);
+      drawRow({
+        ticket: "",
+        subject: `Total (${data.lines.length} ticket${data.lines.length > 1 ? "s" : ""})`,
+        client: "",
+        time: fmtTime(data.totalMinutes),
+        amount: fmtAmount(data.totalAmount)
+      }, { total: true });
+      doc.end();
+    } catch (err) {
+      reject(err);
+    }
   });
-  if (!ticket) {
-    return { summary: "", generatedAt: (/* @__PURE__ */ new Date()).toISOString(), status: "error", reason: "ticket not found" };
-  }
-  await payload.update({
-    collection: slugs.tickets,
-    id: ticketId,
-    data: { aiSummaryStatus: "pending" },
+}
+
+// src/endpoints/invoice.ts
+function createInvoiceEndpoint(slugs) {
+  return {
+    path: "/support/billing/invoice",
+    method: "get",
+    handler: async (req) => {
+      try {
+        requireAdmin(req, slugs);
+        const payload = req.payload;
+        const url = new URL(req.url);
+        const from = url.searchParams.get("from");
+        const to = url.searchParams.get("to");
+        const projectId = url.searchParams.get("projectId");
+        const format = url.searchParams.get("format") === "pdf" ? "pdf" : "html";
+        if (!from || !to) {
+          return Response.json({ error: "Param\xE8tres from et to requis." }, { status: 400 });
+        }
+        const toExclusive = new Date(to);
+        toExclusive.setDate(toExclusive.getDate() + 1);
+        const toIso = toExclusive.toISOString();
+        const where = {
+          and: [
+            { billable: { equals: true } },
+            ...projectId ? [{ project: { equals: Number(projectId) } }] : [],
+            {
+              or: [
+                { and: [{ updatedAt: { greater_than_equal: from } }, { updatedAt: { less_than: toIso } }] },
+                { and: [{ createdAt: { greater_than_equal: from } }, { createdAt: { less_than: toIso } }] },
+                { and: [{ resolvedAt: { greater_than_equal: from } }, { resolvedAt: { less_than: toIso } }] }
+              ]
+            }
+          ]
+        };
+        const tickets = [];
+        let page = 1;
+        let hasMore = true;
+        while (hasMore && page <= 50) {
+          const batch = await dbFind(payload, slugs.tickets, {
+            where,
+            limit: 500,
+            page,
+            depth: 2,
+            overrideAccess: true,
+            select: { ticketNumber: true, subject: true, billedAmount: true, totalTimeMinutes: true, project: true, client: true }
+          });
+          tickets.push(...batch.docs);
+          hasMore = batch.hasNextPage ?? false;
+          page++;
+        }
+        let totalAmount = 0;
+        let totalMinutes = 0;
+        const lines = tickets.map((t) => {
+          const amount = typeof t.billedAmount === "number" ? t.billedAmount : 0;
+          const minutes = typeof t.totalTimeMinutes === "number" ? t.totalTimeMinutes : 0;
+          totalAmount += amount;
+          totalMinutes += minutes;
+          const client = typeof t.client === "object" && t.client ? t.client.company || "" : "";
+          return { ticketNumber: String(t.ticketNumber || ""), subject: String(t.subject || ""), client, minutes, amount };
+        });
+        if (format === "pdf") {
+          const pdf = await generateInvoicePdf({ from, to, projectId, lines, totalMinutes, totalAmount });
+          return new Response(new Uint8Array(pdf), {
+            status: 200,
+            headers: {
+              "Content-Type": "application/pdf",
+              "Content-Disposition": `inline; filename="invoice-${from}_${to}.pdf"`
+            }
+          });
+        }
+        const fmtAmount2 = (n) => `${n.toFixed(2)} \u20AC`;
+        const fmtTime2 = (min) => `${Math.floor(min / 60)}h${String(min % 60).padStart(2, "0")}`;
+        const rows = lines.map((l) => `<tr>
+            <td>${escapeHtml(l.ticketNumber)}</td>
+            <td>${escapeHtml(l.subject)}</td>
+            <td>${escapeHtml(l.client)}</td>
+            <td style="text-align:right;">${fmtTime2(l.minutes)}</td>
+            <td style="text-align:right;">${fmtAmount2(l.amount)}</td>
+          </tr>`).join("");
+        const html = `<!doctype html>
+<html lang="fr"><head><meta charset="utf-8"><title>Facture ${escapeHtml(from)} \u2192 ${escapeHtml(to)}</title>
+<style>
+  body { font-family: system-ui, -apple-system, sans-serif; color: #1e293b; max-width: 820px; margin: 32px auto; padding: 0 24px; }
+  h1 { font-size: 22px; margin: 0 0 4px; }
+  .period { color: #64748b; margin-bottom: 24px; }
+  table { width: 100%; border-collapse: collapse; font-size: 14px; }
+  th, td { padding: 8px 10px; border-bottom: 1px solid #e2e8f0; text-align: left; }
+  th { background: #f8fafc; font-size: 12px; text-transform: uppercase; letter-spacing: .04em; color: #475569; }
+  tfoot td { font-weight: 700; border-top: 2px solid #0f172a; border-bottom: none; }
+  @media print { body { margin: 0; } }
+</style></head>
+<body>
+  <h1>Facture / Pr\xE9-facture</h1>
+  <div class="period">P\xE9riode : ${escapeHtml(from)} \u2192 ${escapeHtml(to)}${projectId ? ` \xB7 Projet #${escapeHtml(projectId)}` : ""}</div>
+  <table>
+    <thead><tr><th>Ticket</th><th>Sujet</th><th>Client</th><th style="text-align:right;">Temps</th><th style="text-align:right;">Montant</th></tr></thead>
+    <tbody>${rows || '<tr><td colspan="5" style="color:#94a3b8;">Aucun ticket facturable sur la p\xE9riode.</td></tr>'}</tbody>
+    <tfoot><tr><td colspan="3">Total (${lines.length} ticket${lines.length > 1 ? "s" : ""})</td><td style="text-align:right;">${fmtTime2(totalMinutes)}</td><td style="text-align:right;">${fmtAmount2(totalAmount)}</td></tr></tfoot>
+  </table>
+</body></html>`;
+        return new Response(html, { status: 200, headers: { "Content-Type": "text/html; charset=utf-8" } });
+      } catch (error) {
+        const authResponse = handleAuthError(error);
+        if (authResponse) return authResponse;
+        console.error("[invoice] Error:", error);
+        return Response.json({ error: "Erreur interne" }, { status: 500 });
+      }
+    }
+  };
+}
+
+// src/utils/generateTicketSynthesis.ts
+function getClient4(aiSettings) {
+  const Anthropic = __require("@anthropic-ai/sdk").default;
+  if (aiSettings.provider === "ollama") {
+    const baseURL = process.env.OLLAMA_API_URL || "https://ollama.orkelis.app/v1";
+    return new Anthropic({ apiKey: "ollama", baseURL });
+  }
+  return new Anthropic({ apiKey: process.env.ANTHROPIC_API_KEY });
+}
+function getModel3(aiSettings) {
+  return aiSettings.model || "claude-haiku-4-5-20251001";
+}
+async function generateTicketSynthesis(args) {
+  const { payload, slugs, ticketId } = args;
+  const settings = await readSupportSettings(payload);
+  if (settings.ai.enableSynthesis === false) {
+    return { summary: "", generatedAt: (/* @__PURE__ */ new Date()).toISOString(), status: "skipped", reason: "synthesis disabled" };
+  }
+  const ticket = await dbFindByID(payload, slugs.tickets, {
+    id: ticketId,
+    depth: 1,
+    overrideAccess: true
+  });
+  if (!ticket) {
+    return { summary: "", generatedAt: (/* @__PURE__ */ new Date()).toISOString(), status: "error", reason: "ticket not found" };
+  }
+  await dbUpdate(payload, slugs.tickets, {
+    id: ticketId,
+    data: { aiSummaryStatus: "pending" },
     overrideAccess: true
   }).catch(() => {
   });
-  const messagesResult = await payload.find({
-    collection: slugs.ticketMessages,
+  const messagesResult = await dbFind(payload, slugs.ticketMessages, {
     where: { ticket: { equals: ticketId } },
     sort: "createdAt",
     limit: 500,
@@ -3455,8 +3855,7 @@ async function generateTicketSynthesis(args) {
   const messages = messagesResult.docs;
   if (messages.length === 0) {
     const generatedAt = (/* @__PURE__ */ new Date()).toISOString();
-    await payload.update({
-      collection: slugs.tickets,
+    await dbUpdate(payload, slugs.tickets, {
       id: ticketId,
       data: {
         aiSummary: "(Aucun message dans ce ticket)",
@@ -3501,7 +3900,7 @@ Regles strictes :
 - Si le ticket n'a pas abouti, decris quand meme le travail d'analyse realise
 
 Reponds UNIQUEMENT avec la liste de puces, rien d'autre.`;
-  const anthropic = getClient3(settings.ai);
+  const anthropic = getClient4(settings.ai);
   const model = getModel3(settings.ai);
   try {
     const res = await anthropic.messages.create({
@@ -3511,8 +3910,7 @@ Reponds UNIQUEMENT avec la liste de puces, rien d'autre.`;
     });
     const summary = res.content[0]?.type === "text" ? res.content[0].text.trim() : "";
     const generatedAt = (/* @__PURE__ */ new Date()).toISOString();
-    await payload.update({
-      collection: slugs.tickets,
+    await dbUpdate(payload, slugs.tickets, {
       id: ticketId,
       data: {
         aiSummary: summary,
@@ -3524,8 +3922,7 @@ Reponds UNIQUEMENT avec la liste de puces, rien d'autre.`;
     return { summary, generatedAt, status: "done" };
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
-    await payload.update({
-      collection: slugs.tickets,
+    await dbUpdate(payload, slugs.tickets, {
       id: ticketId,
       data: { aiSummaryStatus: "error" },
       overrideAccess: true
@@ -3555,8 +3952,7 @@ function createTicketSynthesisEndpoint(slugs) {
           return Response.json({ error: "ticketId must be a number" }, { status: 400 });
         }
         if (!force) {
-          const existing = await payload.findByID({
-            collection: slugs.tickets,
+          const existing = await dbFindByID(payload, slugs.tickets, {
             id: ticketId,
             depth: 0,
             overrideAccess: true
@@ -3600,8 +3996,7 @@ function createEmailStatsEndpoint(slugs) {
         let page = 1;
         let hasMore = true;
         while (hasMore && page <= MAX_PAGES2) {
-          const result = await payload.find({
-            collection: slugs.emailLogs,
+          const result = await dbFind(payload, slugs.emailLogs, {
             where: { createdAt: { greater_than: cutoff } },
             sort: "-createdAt",
             limit: 500,
@@ -3675,12 +4070,20 @@ function createSatisfactionEndpoint(slugs) {
         const payload = req.payload;
         requireClient(req, slugs);
         const body = await req.json();
-        const { ticketId, rating, comment } = body;
-        if (!ticketId || !rating || !Number.isInteger(rating) || rating < 1 || rating > 5) {
-          return Response.json(
-            { error: "ticketId et rating (entier 1-5) sont requis." },
-            { status: 400 }
-          );
+        const { ticketId, rating, nps, comment } = body;
+        if (!ticketId) {
+          return Response.json({ error: "ticketId est requis." }, { status: 400 });
+        }
+        const hasRating = rating !== void 0 && rating !== null;
+        const hasNps = nps !== void 0 && nps !== null;
+        if (!hasRating && !hasNps) {
+          return Response.json({ error: "Un rating (1-5) et/ou un nps (0-10) est requis." }, { status: 400 });
+        }
+        if (hasRating && (!Number.isInteger(rating) || rating < 1 || rating > 5)) {
+          return Response.json({ error: "rating doit \xEAtre un entier 1-5." }, { status: 400 });
+        }
+        if (hasNps && (!Number.isInteger(nps) || nps < 0 || nps > 10)) {
+          return Response.json({ error: "nps doit \xEAtre un entier 0-10." }, { status: 400 });
         }
         if (comment && typeof comment === "string" && comment.length > 5e3) {
           return Response.json(
@@ -3688,8 +4091,7 @@ function createSatisfactionEndpoint(slugs) {
             { status: 400 }
           );
         }
-        const ticket = await payload.findByID({
-          collection: slugs.tickets,
+        const ticket = await dbFindByID(payload, slugs.tickets, {
           id: ticketId,
           depth: 0,
           overrideAccess: false,
@@ -3704,8 +4106,7 @@ function createSatisfactionEndpoint(slugs) {
             { status: 400 }
           );
         }
-        const existing = await payload.find({
-          collection: slugs.satisfactionSurveys,
+        const existing = await dbFind(payload, slugs.satisfactionSurveys, {
           where: { ticket: { equals: ticketId } },
           limit: 1,
           depth: 0,
@@ -3717,13 +4118,13 @@ function createSatisfactionEndpoint(slugs) {
             { status: 409 }
           );
         }
-        const survey = await payload.create({
-          collection: slugs.satisfactionSurveys,
+        const survey = await dbCreate(payload, slugs.satisfactionSurveys, {
           data: {
             source: "ticket",
             ticket: ticketId,
             client: req.user.id,
-            rating: Math.round(rating),
+            ...hasRating ? { rating: Math.round(rating) } : {},
+            ...hasNps ? { nps: Math.round(nps) } : {},
             ...comment ? { comment: comment.trim() } : {}
           },
           overrideAccess: true
@@ -3738,124 +4139,6 @@ function createSatisfactionEndpoint(slugs) {
     }
   };
 }
-var TRANSPARENT_GIF = Buffer.from(
-  "R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7",
-  "base64"
-);
-function generateTrackingToken(ticketId, messageId, secret) {
-  return createHmac("sha256", secret).update(`${ticketId}:${messageId}`).digest("hex").substring(0, 16);
-}
-function createTrackOpenEndpoint(slugs) {
-  return {
-    path: "/support/track-open",
-    method: "get",
-    handler: async (req) => {
-      const url = new URL(req.url);
-      const ticketId = url.searchParams.get("t");
-      const messageId = url.searchParams.get("m");
-      const sig = url.searchParams.get("sig");
-      const parsedId = ticketId ? Number(ticketId) : NaN;
-      const parsedMsgId = messageId ? Number(messageId) : NaN;
-      const secret = process.env.PAYLOAD_SECRET || "";
-      if (secret && ticketId && messageId && sig) {
-        const expected = generateTrackingToken(ticketId, messageId, secret);
-        if (sig !== expected) {
-          return new Response(TRANSPARENT_GIF, {
-            status: 200,
-            headers: {
-              "Content-Type": "image/gif",
-              "Content-Length": String(TRANSPARENT_GIF.length),
-              "Cache-Control": "no-store, no-cache, must-revalidate, max-age=0"
-            }
-          });
-        }
-      } else if (secret && (!sig || !ticketId || !messageId)) {
-        return new Response(TRANSPARENT_GIF, {
-          status: 200,
-          headers: {
-            "Content-Type": "image/gif",
-            "Content-Length": String(TRANSPARENT_GIF.length),
-            "Cache-Control": "no-store, no-cache, must-revalidate, max-age=0"
-          }
-        });
-      }
-      if (ticketId && Number.isInteger(parsedId) && parsedId > 0) {
-        try {
-          const payload = req.payload;
-          const ticket = await payload.findByID({
-            collection: slugs.tickets,
-            id: parsedId,
-            depth: 0,
-            overrideAccess: true,
-            select: { lastClientReadAt: true }
-          });
-          if (ticket) {
-            const lastRead = ticket.lastClientReadAt ? new Date(ticket.lastClientReadAt).getTime() : 0;
-            const fiveMinAgo = Date.now() - 5 * 60 * 1e3;
-            if (lastRead < fiveMinAgo) {
-              await payload.update({
-                collection: slugs.tickets,
-                id: parsedId,
-                data: { lastClientReadAt: (/* @__PURE__ */ new Date()).toISOString() },
-                overrideAccess: true
-              });
-            }
-          }
-          if (Number.isInteger(parsedMsgId) && parsedMsgId > 0) {
-            const msg = await payload.findByID({
-              collection: slugs.ticketMessages,
-              id: parsedMsgId,
-              depth: 0,
-              overrideAccess: true,
-              select: { emailOpenedAt: true }
-            });
-            if (msg && !msg.emailOpenedAt) {
-              await payload.update({
-                collection: slugs.ticketMessages,
-                id: parsedMsgId,
-                data: { emailOpenedAt: (/* @__PURE__ */ new Date()).toISOString() },
-                overrideAccess: true
-              });
-              const ticketInfo = await payload.findByID({
-                collection: slugs.tickets,
-                id: parsedId,
-                depth: 1,
-                overrideAccess: true,
-                select: { ticketNumber: true, subject: true, client: true }
-              });
-              const clientName = typeof ticketInfo?.client === "object" ? ticketInfo.client?.firstName || "Client" : "Client";
-              try {
-                await payload.create({
-                  collection: "admin-notifications",
-                  data: {
-                    title: `Email ouvert \u2014 ${ticketInfo?.ticketNumber || "TK-????"}`,
-                    message: `${clientName} a ouvert votre email pour "${ticketInfo?.subject || "ticket"}"`,
-                    type: "email_opened",
-                    link: `/admin/ticket?id=${parsedId}`
-                  },
-                  overrideAccess: true
-                });
-              } catch {
-              }
-            }
-          }
-        } catch (err) {
-          console.error("[track-open] Error:", err);
-        }
-      }
-      return new Response(TRANSPARENT_GIF, {
-        status: 200,
-        headers: {
-          "Content-Type": "image/gif",
-          "Content-Length": String(TRANSPARENT_GIF.length),
-          "Cache-Control": "no-store, no-cache, must-revalidate, max-age=0",
-          "Pragma": "no-cache",
-          "Expires": "0"
-        }
-      });
-    }
-  };
-}
 
 // src/endpoints/export-csv.ts
 function createExportCsvEndpoint(slugs) {
@@ -3871,8 +4154,7 @@ function createExportCsvEndpoint(slugs) {
         let hasMore = true;
         const allDocs = [];
         while (hasMore) {
-          const batch = await payload.find({
-            collection: slugs.tickets,
+          const batch = await dbFind(payload, slugs.tickets, {
             limit: PAGE_SIZE2,
             page,
             depth: 1,
@@ -3948,21 +4230,18 @@ function createExportDataEndpoint(slugs) {
         const payload = req.payload;
         requireClient(req, slugs);
         const [clientData, ticketsResult, messagesResult, surveysResult] = await Promise.all([
-          payload.findByID({
-            collection: slugs.supportClients,
+          dbFindByID(payload, slugs.supportClients, {
             id: req.user.id,
             depth: 0,
             overrideAccess: true
           }),
-          payload.find({
-            collection: slugs.tickets,
+          dbFind(payload, slugs.tickets, {
             where: { client: { equals: req.user.id } },
             limit: 1e3,
             depth: 0,
             overrideAccess: true
           }),
-          payload.find({
-            collection: slugs.ticketMessages,
+          dbFind(payload, slugs.ticketMessages, {
             where: {
               "ticket.client": { equals: req.user.id },
               authorType: { equals: "client" }
@@ -3971,8 +4250,7 @@ function createExportDataEndpoint(slugs) {
             depth: 0,
             overrideAccess: true
           }),
-          payload.find({
-            collection: slugs.satisfactionSurveys,
+          dbFind(payload, slugs.satisfactionSurveys, {
             where: { client: { equals: req.user.id } },
             limit: 500,
             depth: 0,
@@ -4046,8 +4324,7 @@ function createPendingEmailsProcessEndpoint(slugs) {
         if (!["create_ticket", "add_to_ticket", "ignore"].includes(action)) {
           return Response.json({ error: "Invalid action" }, { status: 400 });
         }
-        const pendingEmail = await payload.findByID({
-          collection: slugs.pendingEmails,
+        const pendingEmail = await dbFindByID(payload, slugs.pendingEmails, {
           id: Number(id),
           depth: 1,
           overrideAccess: true
@@ -4061,14 +4338,12 @@ function createPendingEmailsProcessEndpoint(slugs) {
         let clientId = overrideClientId || (typeof pendingEmail.client === "object" ? pendingEmail.client?.id : pendingEmail.client);
         let clientDoc = typeof pendingEmail.client === "object" ? pendingEmail.client : null;
         if (overrideClientId && overrideClientId !== clientDoc?.id) {
-          clientDoc = await payload.findByID({
-            collection: slugs.supportClients,
+          clientDoc = await dbFindByID(payload, slugs.supportClients, {
             id: overrideClientId,
             depth: 0,
             overrideAccess: true
           });
-          await payload.update({
-            collection: slugs.pendingEmails,
+          await dbUpdate(payload, slugs.pendingEmails, {
             id: Number(id),
             data: { client: overrideClientId },
             overrideAccess: true
@@ -4085,8 +4360,7 @@ function createPendingEmailsProcessEndpoint(slugs) {
           file: typeof a.file === "object" ? a.file.id : a.file
         })) || [];
         if (action === "ignore") {
-          await payload.update({
-            collection: slugs.pendingEmails,
+          await dbUpdate(payload, slugs.pendingEmails, {
             id: Number(id),
             data: {
               status: "ignored",
@@ -4098,8 +4372,7 @@ function createPendingEmailsProcessEndpoint(slugs) {
           return Response.json({ action: "ignored", pendingEmailId: Number(id) });
         }
         if (action === "create_ticket") {
-          const newTicket = await payload.create({
-            collection: slugs.tickets,
+          const newTicket = await dbCreate(payload, slugs.tickets, {
             data: {
               subject: pendingEmail.subject,
               client: clientId,
@@ -4110,8 +4383,7 @@ function createPendingEmailsProcessEndpoint(slugs) {
             },
             overrideAccess: true
           });
-          await payload.create({
-            collection: slugs.ticketMessages,
+          await dbCreate(payload, slugs.ticketMessages, {
             data: {
               ticket: newTicket.id,
               body: pendingEmail.body,
@@ -4138,8 +4410,7 @@ function createPendingEmailsProcessEndpoint(slugs) {
           } catch (err) {
             console.error("[pending-email-process] Failed to send notification:", err);
           }
-          await payload.update({
-            collection: slugs.pendingEmails,
+          await dbUpdate(payload, slugs.pendingEmails, {
             id: Number(id),
             data: {
               status: "processed",
@@ -4159,8 +4430,7 @@ function createPendingEmailsProcessEndpoint(slugs) {
           if (!ticketId) {
             return Response.json({ error: "ticketId is required for add_to_ticket" }, { status: 400 });
           }
-          const targetTicket = await payload.findByID({
-            collection: slugs.tickets,
+          const targetTicket = await dbFindByID(payload, slugs.tickets, {
             id: ticketId,
             depth: 0,
             overrideAccess: true
@@ -4168,8 +4438,7 @@ function createPendingEmailsProcessEndpoint(slugs) {
           if (!targetTicket) {
             return Response.json({ error: "Target ticket not found" }, { status: 404 });
           }
-          await payload.create({
-            collection: slugs.ticketMessages,
+          await dbCreate(payload, slugs.ticketMessages, {
             data: {
               ticket: ticketId,
               body: pendingEmail.body,
@@ -4181,15 +4450,13 @@ function createPendingEmailsProcessEndpoint(slugs) {
             overrideAccess: true
           });
           if (targetTicket.status === "resolved") {
-            await payload.update({
-              collection: slugs.tickets,
+            await dbUpdate(payload, slugs.tickets, {
               id: ticketId,
               data: { status: "open" },
               overrideAccess: true
             });
           }
-          await payload.update({
-            collection: slugs.pendingEmails,
+          await dbUpdate(payload, slugs.pendingEmails, {
             id: Number(id),
             data: {
               status: "processed",
@@ -4242,8 +4509,7 @@ function createResendNotificationEndpoint(slugs) {
         if (!messageId) {
           return Response.json({ error: "messageId requis" }, { status: 400 });
         }
-        const message = await payload.findByID({
-          collection: slugs.ticketMessages,
+        const message = await dbFindByID(payload, slugs.ticketMessages, {
           id: messageId,
           depth: 0,
           overrideAccess: true
@@ -4252,8 +4518,7 @@ function createResendNotificationEndpoint(slugs) {
           return Response.json({ error: "Message introuvable" }, { status: 404 });
         }
         const ticketId = typeof message.ticket === "object" ? message.ticket.id : message.ticket;
-        const ticket = await payload.findByID({
-          collection: slugs.tickets,
+        const ticket = await dbFindByID(payload, slugs.tickets, {
           id: ticketId,
           depth: 1,
           overrideAccess: true
@@ -4379,8 +4644,7 @@ function createSeedKbEndpoint(slugs) {
         let created = 0;
         let skipped = 0;
         for (const article of KB_ARTICLES) {
-          const existing = await payload.find({
-            collection: slugs.knowledgeBase,
+          const existing = await dbFind(payload, slugs.knowledgeBase, {
             where: { slug: { equals: article.slug } },
             limit: 1,
             depth: 0,
@@ -4407,8 +4671,7 @@ function createSeedKbEndpoint(slugs) {
               version: 1
             }
           };
-          await payload.create({
-            collection: slugs.knowledgeBase,
+          await dbCreate(payload, slugs.knowledgeBase, {
             data: {
               title: article.title,
               slug: article.slug,
@@ -4463,8 +4726,7 @@ function createLoginEndpoint(slugs) {
           collection: slugs.supportClients,
           data: { email, password }
         });
-        payload.create({
-          collection: slugs.authLogs,
+        dbCreate(payload, slugs.authLogs, {
           data: { email, success: true, action: "login", ipAddress: ip, userAgent },
           overrideAccess: true
         }).catch(() => {
@@ -4488,12 +4750,14 @@ function createLoginEndpoint(slugs) {
         );
       } catch (err) {
         const errorMessage = err instanceof Error ? err.message : "Erreur inconnue";
+        if (errorMessage.includes("2FA_REQUIRED")) {
+          return Response.json({ requires2FA: true }, { status: 200 });
+        }
         let errorReason = "Identifiants incorrects";
         if (errorMessage.includes("locked") || errorMessage.includes("verrouill\xE9") || errorMessage.includes("Too many")) {
           errorReason = "Compte verrouill\xE9 (trop de tentatives)";
         }
-        payload.create({
-          collection: slugs.authLogs,
+        dbCreate(payload, slugs.authLogs, {
           data: { email, success: false, action: "login", errorReason, ipAddress: ip, userAgent },
           overrideAccess: true
         }).catch(() => {
@@ -4514,7 +4778,10 @@ function generateSecureCode() {
   return String(num);
 }
 function hashCode(code) {
-  const secret = process.env.PAYLOAD_SECRET || "payload-support-2fa";
+  const secret = process.env.PAYLOAD_SECRET;
+  if (!secret) {
+    throw new Error("[support][2fa] PAYLOAD_SECRET is not set \u2014 refusing to operate 2FA with an insecure fallback secret");
+  }
   return createHmac("sha256", secret).update(code).digest("hex");
 }
 function createAuth2faEndpoint(slugs) {
@@ -4539,8 +4806,7 @@ function createAuth2faEndpoint(slugs) {
           if (sendLimiter.check(email)) {
             return Response.json(genericSendResponse);
           }
-          const clients = await payload.find({
-            collection: slugs.supportClients,
+          const clients = await dbFind(payload, slugs.supportClients, {
             where: { email: { equals: email } },
             limit: 1,
             depth: 0,
@@ -4553,8 +4819,7 @@ function createAuth2faEndpoint(slugs) {
           const plainCode = generateSecureCode();
           const twoFactorCode = hashCode(plainCode);
           const twoFactorExpiry = new Date(Date.now() + 10 * 60 * 1e3).toISOString();
-          await payload.update({
-            collection: slugs.supportClients,
+          await dbUpdate(payload, slugs.supportClients, {
             id: client.id,
             data: { twoFactorCode, twoFactorExpiry },
             overrideAccess: true
@@ -4585,8 +4850,7 @@ function createAuth2faEndpoint(slugs) {
               { status: 429 }
             );
           }
-          const clients = await payload.find({
-            collection: slugs.supportClients,
+          const clients = await dbFind(payload, slugs.supportClients, {
             where: { email: { equals: email } },
             limit: 1,
             depth: 0,
@@ -4602,8 +4866,7 @@ function createAuth2faEndpoint(slugs) {
             return Response.json({ error: "Aucun code en attente" }, { status: 400 });
           }
           if (/* @__PURE__ */ new Date() > new Date(storedExpiry)) {
-            await payload.update({
-              collection: slugs.supportClients,
+            await dbUpdate(payload, slugs.supportClients, {
               id: client.id,
               data: { twoFactorCode: "", twoFactorExpiry: "" },
               overrideAccess: true
@@ -4617,10 +4880,9 @@ function createAuth2faEndpoint(slugs) {
           if (submittedBuffer.length !== storedBuffer.length || !crypto3.timingSafeEqual(submittedBuffer, storedBuffer)) {
             return Response.json({ error: "Code incorrect" }, { status: 400 });
           }
-          await payload.update({
-            collection: slugs.supportClients,
+          await dbUpdate(payload, slugs.supportClients, {
             id: client.id,
-            data: { twoFactorCode: "", twoFactorExpiry: "" },
+            data: { twoFactorCode: "", twoFactorExpiry: "", twoFactorVerifiedAt: (/* @__PURE__ */ new Date()).toISOString() },
             overrideAccess: true
           });
           verifyLimiter.reset(email);
@@ -4694,15 +4956,33 @@ function createOAuthGoogleEndpoint(slugs, options) {
           if (!profile.email) {
             return Response.json({ error: "no_email" }, { status: 400 });
           }
+          if (profile.verified_email !== true) {
+            return Response.json({ error: "email_not_verified" }, { status: 403 });
+          }
           const payload = req.payload;
-          const existing = await payload.find({
-            collection: slugs.supportClients,
-            where: { email: { equals: profile.email } },
+          const byGoogle = await dbFind(payload, slugs.supportClients, {
+            where: { googleId: { equals: profile.id } },
             limit: 1,
             depth: 0,
             overrideAccess: true
           });
-          let clientDoc = existing.docs[0];
+          let clientDoc = byGoogle.docs[0];
+          if (!clientDoc) {
+            const byEmail = await dbFind(payload, slugs.supportClients, {
+              where: { email: { equals: profile.email } },
+              limit: 1,
+              depth: 0,
+              overrideAccess: true
+            });
+            clientDoc = byEmail.docs[0];
+            if (clientDoc && profile.id) {
+              await dbUpdate(payload, slugs.supportClients, {
+                id: clientDoc.id,
+                data: { googleId: profile.id },
+                overrideAccess: true
+              });
+            }
+          }
           if (!clientDoc) {
             const allowedDomains = options?.allowedEmailDomains;
             if (allowedDomains && allowedDomains.length > 0) {
@@ -4720,43 +5000,64 @@ function createOAuthGoogleEndpoint(slugs, options) {
             const autoPassword = crypto3.randomBytes(48).toString("base64url");
             const fullName = profile.name || profile.email.split("@")[0];
             const nameParts = fullName.split(" ");
-            clientDoc = await payload.create({
-              collection: slugs.supportClients,
+            clientDoc = await dbCreate(payload, slugs.supportClients, {
               data: {
                 email: profile.email,
                 firstName: nameParts[0] || fullName,
                 lastName: nameParts.slice(1).join(" ") || "-",
                 company: fullName,
+                googleId: profile.id,
                 password: autoPassword
               },
               overrideAccess: true
             });
           }
-          const tempPassword = crypto3.randomBytes(48).toString("base64url");
-          await payload.update({
-            collection: slugs.supportClients,
-            id: clientDoc.id,
-            data: { password: tempPassword },
-            overrideAccess: true
-          });
-          const loginResult = await payload.login({
-            collection: slugs.supportClients,
-            data: { email: profile.email, password: tempPassword }
-          });
-          const postLoginPassword = crypto3.randomBytes(48).toString("base64url");
-          await payload.update({
-            collection: slugs.supportClients,
-            id: clientDoc.id,
-            data: { password: postLoginPassword },
-            overrideAccess: true
-          });
-          if (!loginResult.token) {
-            return Response.json({ error: "login_failed" }, { status: 400 });
+          const secret = process.env.PAYLOAD_SECRET;
+          if (!secret) {
+            return Response.json({ error: "server_misconfigured" }, { status: 500 });
           }
-          return Response.json({
-            token: loginResult.token,
-            user: loginResult.user,
-            exp: loginResult.exp
+          const collectionConfig = payload.collections[slugs.supportClients].config;
+          const tokenExpiration = collectionConfig.auth?.tokenExpiration ?? 7200;
+          let sid;
+          if (collectionConfig.auth?.useSessions) {
+            sid = crypto3.randomUUID();
+            const now = /* @__PURE__ */ new Date();
+            const expiresAt = new Date(now.getTime() + tokenExpiration * 1e3);
+            const fresh = await dbFindByID(payload, slugs.supportClients, {
+              id: clientDoc.id,
+              depth: 0,
+              overrideAccess: true,
+              showHiddenFields: true
+            });
+            const kept = Array.isArray(fresh?.sessions) ? fresh.sessions.filter((s) => new Date(s.expiresAt) > now) : [];
+            await payload.db.updateOne({
+              collection: slugs.supportClients,
+              id: clientDoc.id,
+              data: {
+                sessions: [
+                  ...kept,
+                  { id: sid, createdAt: now.toISOString(), expiresAt: expiresAt.toISOString() }
+                ]
+              },
+              returning: false
+            });
+          }
+          const fieldsToSign = getFieldsToSign({
+            collectionConfig,
+            email: clientDoc.email,
+            sid,
+            user: { ...clientDoc, collection: slugs.supportClients }
+          });
+          const { token, exp } = await jwtSign({ fieldsToSign, secret, tokenExpiration });
+          const headers = new Headers({ "Content-Type": "application/json" });
+          const cookieSecure = process.env.NODE_ENV === "production";
+          headers.append(
+            "Set-Cookie",
+            `payload-token=${token}; HttpOnly; ${cookieSecure ? "Secure; " : ""}SameSite=Lax; Path=/; Max-Age=${tokenExpiration}`
+          );
+          return new Response(JSON.stringify({ token, user: clientDoc, exp }), {
+            status: 200,
+            headers
           });
         }
         return Response.json({ error: "Action invalide" }, { status: 400 });
@@ -4797,8 +5098,7 @@ function createDeleteAccountEndpoint(slugs) {
           );
         }
         const clientId = req.user.id;
-        const tickets = await payload.find({
-          collection: slugs.tickets,
+        const tickets = await dbFind(payload, slugs.tickets, {
           where: { client: { equals: clientId } },
           limit: 1e4,
           depth: 0,
@@ -4807,39 +5107,32 @@ function createDeleteAccountEndpoint(slugs) {
         });
         const ticketIds = tickets.docs.map((t) => t.id);
         if (ticketIds.length > 0) {
-          await payload.delete({
-            collection: slugs.ticketMessages,
+          await dbDelete(payload, slugs.ticketMessages, {
             where: { ticket: { in: ticketIds } },
             overrideAccess: true
           });
-          await payload.delete({
-            collection: slugs.ticketActivityLog,
+          await dbDelete(payload, slugs.ticketActivityLog, {
             where: { ticket: { in: ticketIds } },
             overrideAccess: true
           });
-          await payload.delete({
-            collection: slugs.timeEntries,
+          await dbDelete(payload, slugs.timeEntries, {
             where: { ticket: { in: ticketIds } },
             overrideAccess: true
           });
-          await payload.delete({
-            collection: slugs.tickets,
+          await dbDelete(payload, slugs.tickets, {
             where: { client: { equals: clientId } },
             overrideAccess: true
           });
         }
-        await payload.delete({
-          collection: slugs.satisfactionSurveys,
+        await dbDelete(payload, slugs.satisfactionSurveys, {
           where: { client: { equals: clientId } },
           overrideAccess: true
         });
-        await payload.delete({
-          collection: slugs.chatMessages,
+        await dbDelete(payload, slugs.chatMessages, {
           where: { client: { equals: clientId } },
           overrideAccess: true
         });
-        await payload.delete({
-          collection: slugs.supportClients,
+        await dbDelete(payload, slugs.supportClients, {
           id: clientId,
           overrideAccess: true
         });
@@ -4880,8 +5173,8 @@ function createMergeClientsEndpoint(slugs) {
           return Response.json({ error: "sourceId and targetId are required and must be different" }, { status: 400 });
         }
         const [source, target] = await Promise.all([
-          payload.findByID({ collection: slugs.supportClients, id: sourceId, depth: 0, overrideAccess: true }),
-          payload.findByID({ collection: slugs.supportClients, id: targetId, depth: 0, overrideAccess: true })
+          dbFindByID(payload, slugs.supportClients, { id: sourceId, depth: 0, overrideAccess: true }),
+          dbFindByID(payload, slugs.supportClients, { id: targetId, depth: 0, overrideAccess: true })
         ]);
         if (!source || !target) {
           return Response.json({ error: "Source or target client not found" }, { status: 404 });
@@ -4893,63 +5186,57 @@ function createMergeClientsEndpoint(slugs) {
           pendingEmails: 0,
           satisfactionSurveys: 0
         };
-        const tickets = await payload.find({
-          collection: slugs.tickets,
+        const tickets = await dbFind(payload, slugs.tickets, {
           where: { client: { equals: sourceId } },
           limit: 500,
           depth: 0,
           overrideAccess: true
         });
         for (const ticket of tickets.docs) {
-          await payload.update({ collection: slugs.tickets, id: ticket.id, data: { client: targetId }, overrideAccess: true });
+          await dbUpdate(payload, slugs.tickets, { id: ticket.id, data: { client: targetId }, overrideAccess: true });
           results.tickets++;
         }
-        const messages = await payload.find({
-          collection: slugs.ticketMessages,
+        const messages = await dbFind(payload, slugs.ticketMessages, {
           where: { authorClient: { equals: sourceId } },
           limit: 1e3,
           depth: 0,
           overrideAccess: true
         });
         for (const msg of messages.docs) {
-          await payload.update({ collection: slugs.ticketMessages, id: msg.id, data: { authorClient: targetId }, overrideAccess: true });
+          await dbUpdate(payload, slugs.ticketMessages, { id: msg.id, data: { authorClient: targetId }, overrideAccess: true });
           results.ticketMessages++;
         }
-        const chats = await payload.find({
-          collection: slugs.chatMessages,
+        const chats = await dbFind(payload, slugs.chatMessages, {
           where: { client: { equals: sourceId } },
           limit: 1e3,
           depth: 0,
           overrideAccess: true
         });
         for (const chat of chats.docs) {
-          await payload.update({ collection: slugs.chatMessages, id: chat.id, data: { client: targetId }, overrideAccess: true });
+          await dbUpdate(payload, slugs.chatMessages, { id: chat.id, data: { client: targetId }, overrideAccess: true });
           results.chatMessages++;
         }
-        const pendingEmails = await payload.find({
-          collection: slugs.pendingEmails,
+        const pendingEmails = await dbFind(payload, slugs.pendingEmails, {
           where: { client: { equals: sourceId } },
           limit: 500,
           depth: 0,
           overrideAccess: true
         });
         for (const pe of pendingEmails.docs) {
-          await payload.update({ collection: slugs.pendingEmails, id: pe.id, data: { client: targetId }, overrideAccess: true });
+          await dbUpdate(payload, slugs.pendingEmails, { id: pe.id, data: { client: targetId }, overrideAccess: true });
           results.pendingEmails++;
         }
-        const surveys = await payload.find({
-          collection: slugs.satisfactionSurveys,
+        const surveys = await dbFind(payload, slugs.satisfactionSurveys, {
           where: { client: { equals: sourceId } },
           limit: 500,
           depth: 0,
           overrideAccess: true
         });
         for (const survey of surveys.docs) {
-          await payload.update({ collection: slugs.satisfactionSurveys, id: survey.id, data: { client: targetId }, overrideAccess: true });
+          await dbUpdate(payload, slugs.satisfactionSurveys, { id: survey.id, data: { client: targetId }, overrideAccess: true });
           results.satisfactionSurveys++;
         }
-        await payload.delete({
-          collection: slugs.supportClients,
+        await dbDelete(payload, slugs.supportClients, {
           id: sourceId,
           overrideAccess: true
         });
@@ -5143,8 +5430,7 @@ function createImportConversationEndpoint(slugs) {
         if (blockedEmails.includes(conversation.client.email)) {
           return Response.json({ error: "Cannot create ticket from system email address" }, { status: 400 });
         }
-        const clientResult = await payload.find({
-          collection: slugs.supportClients,
+        const clientResult = await dbFind(payload, slugs.supportClients, {
           where: { email: { equals: conversation.client.email } },
           limit: 1,
           depth: 0,
@@ -5155,8 +5441,7 @@ function createImportConversationEndpoint(slugs) {
         if (!client) {
           const nameParts = conversation.client.name.split(" ");
           const randomPassword = crypto3.randomBytes(48).toString("base64url");
-          client = await payload.create({
-            collection: slugs.supportClients,
+          client = await dbCreate(payload, slugs.supportClients, {
             data: {
               email: conversation.client.email,
               password: randomPassword,
@@ -5168,15 +5453,13 @@ function createImportConversationEndpoint(slugs) {
           });
           isNewClient = true;
         }
-        const adminUsers = await payload.find({
-          collection: slugs.users,
+        const adminUsers = await dbFind(payload, slugs.users, {
           limit: 1,
           depth: 0,
           overrideAccess: true
         });
         const adminUserId = adminUsers.docs[0]?.id;
-        const ticket = await payload.create({
-          collection: slugs.tickets,
+        const ticket = await dbCreate(payload, slugs.tickets, {
           data: {
             subject: conversation.subject,
             client: client.id,
@@ -5189,8 +5472,7 @@ function createImportConversationEndpoint(slugs) {
         let importedCount = 0;
         for (const msg of conversation.messages) {
           const isAdmin = msg.from === "admin";
-          await payload.create({
-            collection: slugs.ticketMessages,
+          await dbCreate(payload, slugs.ticketMessages, {
             data: {
               ticket: ticket.id,
               body: msg.content,
@@ -5226,8 +5508,7 @@ function createImportConversationEndpoint(slugs) {
 // src/utils/fireWebhooks.ts
 async function fireWebhooks(payload, slugs, event, data) {
   try {
-    const endpoints = await payload.find({
-      collection: slugs.webhookEndpoints,
+    const endpoints = await dbFind(payload, slugs.webhookEndpoints, {
       where: {
         active: { equals: true },
         events: { contains: event }
@@ -5251,8 +5532,7 @@ async function fireWebhooks(payload, slugs, event, data) {
             signal: AbortSignal.timeout(1e4)
           });
           try {
-            await payload.update({
-              collection: slugs.webhookEndpoints,
+            await dbUpdate(payload, slugs.webhookEndpoints, {
               id: endpoint.id,
               data: {
                 lastTriggeredAt: timestamp,
@@ -5265,8 +5545,7 @@ async function fireWebhooks(payload, slugs, event, data) {
         } catch (error) {
           console.warn(`[support] Webhook delivery failed: ${endpoint.url}`, error);
           try {
-            await payload.update({
-              collection: slugs.webhookEndpoints,
+            await dbUpdate(payload, slugs.webhookEndpoints, {
               id: endpoint.id,
               data: {
                 lastTriggeredAt: timestamp,
@@ -5301,8 +5580,7 @@ function createProcessScheduledEndpoint(slugs) {
         const settings = await readSupportSettings(payload);
         const replyTo = settings.email.replyToAddress || process.env.SUPPORT_EMAIL || "";
         const results = { processed: 0, errors: 0 };
-        const scheduled = await payload.find({
-          collection: slugs.ticketMessages,
+        const scheduled = await dbFind(payload, slugs.ticketMessages, {
           where: {
             and: [
               { scheduledAt: { less_than_equal: now.toISOString() } },
@@ -5322,8 +5600,7 @@ function createProcessScheduledEndpoint(slugs) {
           try {
             const msg = message;
             const ticketId = typeof msg.ticket === "object" ? msg.ticket.id : msg.ticket;
-            const ticket = await payload.findByID({
-              collection: slugs.tickets,
+            const ticket = await dbFindByID(payload, slugs.tickets, {
               id: ticketId,
               depth: 1,
               overrideAccess: true
@@ -5346,8 +5623,7 @@ function createProcessScheduledEndpoint(slugs) {
                 subject: `Re: [${ticketNumber}] ${subject}`,
                 html: `<p>Bonjour ${escapeHtml(client.firstName || "")},</p><p>Notre \xE9quipe a r\xE9pondu \xE0 votre ticket <strong>${escapeHtml(ticketNumber)}</strong>.</p><blockquote style="border-left:4px solid #2563eb;padding:12px;margin:16px 0;background:#f8fafc;">${escapeHtml(preview)}</blockquote><p><a href="${baseUrl}/support/tickets/${ticketId}">Consulter le ticket</a></p>`
               });
-              await payload.update({
-                collection: slugs.ticketMessages,
+              await dbUpdate(payload, slugs.ticketMessages, {
                 id: msg.id,
                 data: {
                   scheduledSent: true,
@@ -5357,16 +5633,14 @@ function createProcessScheduledEndpoint(slugs) {
                 overrideAccess: true
               });
             } else {
-              await payload.update({
-                collection: slugs.ticketMessages,
+              await dbUpdate(payload, slugs.ticketMessages, {
                 id: msg.id,
                 data: { scheduledSent: true },
                 overrideAccess: true
               });
             }
             if (msg.authorType === "admin" && !msg.isInternal) {
-              await payload.update({
-                collection: slugs.tickets,
+              await dbUpdate(payload, slugs.tickets, {
                 id: ticketId,
                 data: { status: "waiting_client" },
                 overrideAccess: true
@@ -5398,6 +5672,208 @@ function createProcessScheduledEndpoint(slugs) {
   };
 }
 
+// src/endpoints/process-snooze.ts
+function createProcessSnoozeEndpoint(slugs) {
+  return {
+    path: "/support/process-snooze",
+    method: "post",
+    handler: async (req) => {
+      const secret = req.headers.get("x-cron-secret");
+      const expectedSecret = process.env.CRON_SECRET;
+      if (!expectedSecret || secret !== expectedSecret) {
+        return Response.json({ error: "Non autoris\xE9" }, { status: 401 });
+      }
+      try {
+        const payload = req.payload;
+        const nowIso = (/* @__PURE__ */ new Date()).toISOString();
+        const results = { processed: 0, errors: 0 };
+        const due = await dbFind(payload, slugs.tickets, {
+          where: {
+            and: [
+              { snoozeUntil: { exists: true } },
+              { snoozeUntil: { less_than_equal: nowIso } }
+            ]
+          },
+          limit: 500,
+          depth: 0,
+          overrideAccess: true,
+          select: { id: true, ticketNumber: true }
+        });
+        for (const ticket of due.docs) {
+          try {
+            await dbUpdate(payload, slugs.tickets, {
+              id: ticket.id,
+              data: { snoozeUntil: null },
+              overrideAccess: true
+            });
+            try {
+              await dbCreate(payload, slugs.ticketActivityLog, {
+                data: {
+                  ticket: ticket.id,
+                  action: "snooze_expired",
+                  detail: "Snooze \xE9chu \u2014 ticket r\xE9activ\xE9",
+                  actorType: "system"
+                },
+                overrideAccess: true
+              });
+            } catch {
+            }
+            results.processed++;
+          } catch (err) {
+            console.error("[support] Failed to wake snoozed ticket:", err);
+            results.errors++;
+          }
+        }
+        return Response.json({ ok: true, ...results });
+      } catch (err) {
+        console.error("[process-snooze] Error:", err);
+        return Response.json({ error: "Erreur interne" }, { status: 500 });
+      }
+    }
+  };
+}
+
+// src/endpoints/process-digests.ts
+function createProcessDigestsEndpoint(slugs) {
+  return {
+    path: "/support/process-digests",
+    method: "post",
+    handler: async (req) => {
+      const secret = req.headers.get("x-cron-secret");
+      if (!process.env.CRON_SECRET || secret !== process.env.CRON_SECRET) {
+        return Response.json({ error: "Non autoris\xE9" }, { status: 401 });
+      }
+      try {
+        const payload = req.payload;
+        let body = {};
+        try {
+          body = await req.json();
+        } catch {
+        }
+        const frequency = body.frequency === "weekly" ? "weekly" : "daily";
+        const settings = await readSupportSettings(payload);
+        const replyTo = settings.email.replyToAddress || process.env.SUPPORT_EMAIL || "";
+        const baseUrl = process.env.NEXT_PUBLIC_SERVER_URL || "";
+        const itemsByClient = /* @__PURE__ */ new Map();
+        let page = 1;
+        let hasMore = true;
+        while (hasMore && page <= 50) {
+          const batch = await dbFind(payload, slugs.notificationQueue, { limit: 200, page, depth: 0, overrideAccess: true, sort: "createdAt" });
+          for (const it of batch.docs) {
+            const raw = it;
+            const clientId = typeof raw.client === "object" ? raw.client?.id : raw.client;
+            if (clientId === void 0 || clientId === null) continue;
+            const key = String(clientId);
+            if (!itemsByClient.has(key)) itemsByClient.set(key, []);
+            itemsByClient.get(key).push({ id: raw.id, title: raw.title, message: raw.message });
+          }
+          hasMore = batch.hasNextPage ?? false;
+          page++;
+        }
+        const results = { clients: 0, items: 0, errors: 0 };
+        for (const [clientId, items] of itemsByClient) {
+          try {
+            const client = await dbFindByID(payload, slugs.supportClients, { id: clientId, depth: 0, overrideAccess: true });
+            if (!client || client.notificationFrequency !== frequency) continue;
+            if (client.email) {
+              const rows = items.map((i) => `<tr><td style="padding:8px 0;font-size:14px;color:#1e293b;border-bottom:1px solid #f1f5f9;"><strong>${escapeHtml(i.title || "")}</strong><br/><span style="color:#64748b;font-size:13px;">${escapeHtml(i.message || "")}</span></td></tr>`).join("");
+              const html = emailWrapper("Recapitulatif de vos tickets", [
+                emailParagraph(`Bonjour <strong>${escapeHtml(client.firstName || "")}</strong>,`),
+                emailParagraph(`Voici le recapitulatif de l'activite sur vos tickets (${items.length} notification${items.length > 1 ? "s" : ""}) :`),
+                `<table cellpadding="0" cellspacing="0" border="0" width="100%">${rows}</table>`,
+                ...baseUrl ? [emailParagraph(`<a href="${baseUrl}/support/dashboard">Acceder a votre espace support</a>`)] : []
+              ].join(""), { kind: "system" });
+              await payload.sendEmail({ to: client.email, ...replyTo ? { replyTo } : {}, subject: `Recapitulatif support (${items.length})`, html });
+            }
+            for (const i of items) {
+              try {
+                await dbDelete(payload, slugs.notificationQueue, { id: i.id, overrideAccess: true });
+              } catch {
+              }
+            }
+            results.clients++;
+            results.items += items.length;
+          } catch (err) {
+            console.error("[process-digests] client error:", err);
+            results.errors++;
+          }
+        }
+        return Response.json({ ok: true, frequency, ...results });
+      } catch (err) {
+        console.error("[process-digests] Error:", err);
+        return Response.json({ error: "Erreur interne" }, { status: 500 });
+      }
+    }
+  };
+}
+var PROVIDERS = ["whatsapp", "messenger"];
+function createChannelsWebhookEndpoint(slugs) {
+  return {
+    path: "/support/channels/webhook",
+    method: "post",
+    handler: async (req) => {
+      const secret = req.headers.get("x-channel-secret");
+      if (!process.env.CHANNELS_WEBHOOK_SECRET || secret !== process.env.CHANNELS_WEBHOOK_SECRET) {
+        return Response.json({ error: "Non autoris\xE9" }, { status: 401 });
+      }
+      let body;
+      try {
+        body = await req.json();
+      } catch {
+        return Response.json({ error: "Invalid JSON body" }, { status: 400 });
+      }
+      const provider = body.provider;
+      const from = (body.from || "").trim();
+      const text = (body.text || "").trim();
+      if (!PROVIDERS.includes(provider) || !from || !text) {
+        return Response.json({ error: "provider, from et text requis." }, { status: 400 });
+      }
+      try {
+        const payload = req.payload;
+        const email = `${from}@${provider}.channel`;
+        const existing = await dbFind(payload, slugs.supportClients, { where: { email: { equals: email } }, limit: 1, depth: 0, overrideAccess: true });
+        let clientId;
+        if (existing.docs.length > 0) {
+          clientId = existing.docs[0].id;
+        } else {
+          const created = await dbCreate(payload, slugs.supportClients, {
+            data: { email, firstName: body.name || provider, lastName: from.slice(0, 40), company: provider, password: randomBytes(16).toString("hex") },
+            overrideAccess: true
+          });
+          clientId = created.id;
+        }
+        const open = await dbFind(payload, slugs.tickets, {
+          where: { and: [{ client: { equals: clientId } }, { source: { equals: provider } }, { status: { in: ["open", "waiting_client"] } }] },
+          sort: "-createdAt",
+          limit: 1,
+          depth: 0,
+          overrideAccess: true
+        });
+        let ticketId;
+        let createdTicket = false;
+        if (open.docs.length > 0) {
+          ticketId = open.docs[0].id;
+        } else {
+          const t = await dbCreate(payload, slugs.tickets, {
+            data: { subject: text.slice(0, 80), client: clientId, status: "open", priority: "normal", source: provider },
+            overrideAccess: true
+          });
+          ticketId = t.id;
+          createdTicket = true;
+        }
+        const msg = await dbCreate(payload, slugs.ticketMessages, {
+          data: { ticket: ticketId, body: text, authorType: "client", authorClient: clientId },
+          overrideAccess: true
+        });
+        return Response.json({ ok: true, ticketId, createdTicket, messageId: msg.id });
+      } catch (err) {
+        console.error("[channels] Error:", err);
+        return Response.json({ error: "Erreur interne" }, { status: 500 });
+      }
+    }
+  };
+}
+
 // src/endpoints/user-prefs.ts
 var PREF_KEY_PREFIX = "support-user-prefs";
 var DEFAULT_USER_PREFS2 = {
@@ -5413,8 +5889,7 @@ function createUserPrefsGetEndpoint(slugs) {
         const payload = req.payload;
         requireAdmin(req, slugs);
         const key = `${PREF_KEY_PREFIX}-${req.user.id}`;
-        const prefs = await payload.find({
-          collection: "payload-preferences",
+        const prefs = await dbFind(payload, "payload-preferences", {
           where: { key: { equals: key } },
           limit: 1,
           depth: 0,
@@ -5448,8 +5923,7 @@ function createUserPrefsPostEndpoint(slugs) {
         requireAdmin(req, slugs);
         const body = await req.json();
         const key = `${PREF_KEY_PREFIX}-${req.user.id}`;
-        const existing = await payload.find({
-          collection: "payload-preferences",
+        const existing = await dbFind(payload, "payload-preferences", {
           where: { key: { equals: key } },
           limit: 1,
           depth: 0,
@@ -5510,8 +5984,7 @@ function createEscalateEndpoint(slugs) {
         if (Number.isNaN(ticketId)) {
           return Response.json({ error: "invalid-id" }, { status: 400 });
         }
-        const ticket = await req.payload.update({
-          collection: slugs.tickets,
+        const ticket = await dbUpdate(req.payload, slugs.tickets, {
           id: ticketId,
           data: { status: "escalated" },
           overrideAccess: true
@@ -5559,8 +6032,7 @@ function createTicketFeedbackEndpoint(slugs) {
             { status: 400 }
           );
         }
-        const ticket = await payload.findByID({
-          collection: slugs.tickets,
+        const ticket = await dbFindByID(payload, slugs.tickets, {
           id: ticketId,
           depth: 0,
           overrideAccess: true
@@ -5572,8 +6044,7 @@ function createTicketFeedbackEndpoint(slugs) {
         if (ticketClientId !== req.user.id) {
           return Response.json({ error: "forbidden" }, { status: 403 });
         }
-        const existing = await payload.find({
-          collection: "ticket-feedback",
+        const existing = await dbFind(payload, "ticket-feedback", {
           where: { ticket: { equals: ticketId } },
           limit: 1,
           depth: 0,
@@ -5585,8 +6056,7 @@ function createTicketFeedbackEndpoint(slugs) {
             { status: 409 }
           );
         }
-        const feedback = await payload.create({
-          collection: "ticket-feedback",
+        const feedback = await dbCreate(payload, "ticket-feedback", {
           data: {
             ticket: ticketId,
             client: req.user.id,
@@ -5610,6 +6080,7 @@ function createTicketFeedbackEndpoint(slugs) {
 // src/endpoints/transfer-ticket.ts
 var EMAIL_RE = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
 var MAX_TRANSFERS_PER_DAY = 5;
+var transferLimiter = new RateLimiter(24 * 60 * 60 * 1e3, MAX_TRANSFERS_PER_DAY);
 function createTransferTicketEndpoint(slugs) {
   return {
     path: "/support/tickets/:id/transfer",
@@ -5634,8 +6105,7 @@ function createTransferTicketEndpoint(slugs) {
         const includeAttachments = body.includeAttachments !== false;
         const customMessage = typeof body.message === "string" ? body.message.slice(0, 1e3) : "";
         const payload = req.payload;
-        const ticket = await payload.findByID({
-          collection: slugs.tickets,
+        const ticket = await dbFindByID(payload, slugs.tickets, {
           id: ticketId,
           depth: 1,
           overrideAccess: true
@@ -5646,10 +6116,15 @@ function createTransferTicketEndpoint(slugs) {
         if (!isAdmin && !isOwner) {
           return Response.json({ error: "Forbidden" }, { status: 403 });
         }
+        if (transferLimiter.check(`${req.user.id}:${ticketId}`)) {
+          return Response.json(
+            { error: `Limite atteinte (${MAX_TRANSFERS_PER_DAY} transferts par 24h sur ce ticket)` },
+            { status: 429 }
+          );
+        }
         try {
           const since = new Date(Date.now() - 24 * 60 * 60 * 1e3).toISOString();
-          const existing = await payload.count({
-            collection: slugs.emailLogs,
+          const existing = await dbCount(payload, slugs.emailLogs, {
             where: {
               and: [
                 { action: { equals: "transfer" } },
@@ -5667,8 +6142,7 @@ function createTransferTicketEndpoint(slugs) {
           }
         } catch {
         }
-        const messages = await payload.find({
-          collection: slugs.ticketMessages,
+        const messages = await dbFind(payload, slugs.ticketMessages, {
           where: {
             and: [
               { ticket: { equals: ticketId } },
@@ -5748,8 +6222,7 @@ function createTransferTicketEndpoint(slugs) {
           html
         });
         try {
-          await payload.create({
-            collection: slugs.emailLogs,
+          await dbCreate(payload, slugs.emailLogs, {
             data: {
               status: "success",
               action: "transfer",
@@ -5789,6 +6262,8 @@ function statusToLabel(status) {
   }
 }
 var EMAIL_RE2 = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+var MAX_COLLABORATORS_PER_TICKET = 20;
+var inviteLimiter = new RateLimiter(60 * 60 * 1e3, 10);
 function createInviteCollaboratorEndpoint(slugs) {
   return {
     path: "/support/tickets/:id/invite",
@@ -5812,8 +6287,7 @@ function createInviteCollaboratorEndpoint(slugs) {
         }
         const role = body.role === "collaborator" ? "collaborator" : "viewer";
         const payload = req.payload;
-        const ticket = await payload.findByID({
-          collection: slugs.tickets,
+        const ticket = await dbFindByID(payload, slugs.tickets, {
           id: ticketId,
           depth: 1,
           overrideAccess: true
@@ -5825,13 +6299,22 @@ function createInviteCollaboratorEndpoint(slugs) {
         if (!isAdmin && !isOwner) {
           return Response.json({ error: "Forbidden" }, { status: 403 });
         }
+        if (inviteLimiter.check(String(req.user.id))) {
+          return Response.json({ error: "Trop d'invitations. R\xE9essayez plus tard." }, { status: 429 });
+        }
+        const collabCount = await dbCount(payload, "ticket-collaborators", { where: { ticket: { equals: ticketId } }, overrideAccess: true }).catch(() => ({ totalDocs: 0 }));
+        if (collabCount.totalDocs >= MAX_COLLABORATORS_PER_TICKET) {
+          return Response.json(
+            { error: `Limite de ${MAX_COLLABORATORS_PER_TICKET} collaborateurs atteinte sur ce ticket` },
+            { status: 429 }
+          );
+        }
         const ownerEmail = typeof ticket.client === "object" ? ticket.client?.email : void 0;
         if (ownerEmail && ownerEmail.toLowerCase() === email) {
           return Response.json({ error: "Ce client est d\xE9j\xE0 propri\xE9taire du ticket" }, { status: 400 });
         }
         let inviteeId = null;
-        const existing = await payload.find({
-          collection: slugs.supportClients,
+        const existing = await dbFind(payload, slugs.supportClients, {
           where: { email: { equals: email } },
           limit: 1,
           depth: 0,
@@ -5841,8 +6324,7 @@ function createInviteCollaboratorEndpoint(slugs) {
           inviteeId = existing.docs[0].id;
         } else {
           const tempPassword = randomBytes(16).toString("hex");
-          const created = await payload.create({
-            collection: slugs.supportClients,
+          const created = await dbCreate(payload, slugs.supportClients, {
             data: {
               email,
               firstName: "Invit\xE9",
@@ -5859,8 +6341,7 @@ function createInviteCollaboratorEndpoint(slugs) {
         if (!inviteeId) {
           return Response.json({ error: "Impossible de cr\xE9er le client invit\xE9" }, { status: 500 });
         }
-        const dupe = await payload.find({
-          collection: "ticket-collaborators",
+        const dupe = await dbFind(payload, "ticket-collaborators", {
           where: {
             and: [
               { ticket: { equals: ticketId } },
@@ -5873,15 +6354,13 @@ function createInviteCollaboratorEndpoint(slugs) {
         });
         const invitationToken = randomBytes(24).toString("hex");
         if (dupe.docs.length > 0) {
-          await payload.update({
-            collection: "ticket-collaborators",
+          await dbUpdate(payload, "ticket-collaborators", {
             id: dupe.docs[0].id,
             data: { role, invitationToken },
             overrideAccess: true
           });
         } else {
-          await payload.create({
-            collection: "ticket-collaborators",
+          await dbCreate(payload, "ticket-collaborators", {
             data: {
               ticket: ticketId,
               client: inviteeId,
@@ -5924,8 +6403,7 @@ function createInviteCollaboratorEndpoint(slugs) {
           )
         });
         try {
-          await payload.create({
-            collection: slugs.emailLogs,
+          await dbCreate(payload, slugs.emailLogs, {
             data: {
               status: "success",
               action: "invite",
@@ -5978,6 +6456,7 @@ function createSupportEndpoints(slugs, options) {
   ];
   if (!f || f.ai !== false) {
     endpoints.push(createAiEndpoint(slugs));
+    endpoints.push(createAiAgentEndpoint(slugs));
     endpoints.push(...createClientIntelligenceEndpoint(slugs));
     endpoints.push(createTicketSynthesisEndpoint(slugs));
   }
@@ -6008,21 +6487,26 @@ function createSupportEndpoints(slugs, options) {
     endpoints.push(createAdminChatGetEndpoint(slugs), createAdminChatPostEndpoint(slugs));
     endpoints.push(createAdminChatStreamEndpoint(slugs));
   }
-  if (!f || f.timeTracking !== false) endpoints.push(createBillingEndpoint(slugs));
+  if (!f || f.timeTracking !== false) {
+    endpoints.push(createBillingEndpoint(slugs));
+    endpoints.push(createInvoiceEndpoint(slugs));
+  }
   if (!f || f.satisfaction !== false) endpoints.push(createSatisfactionEndpoint(slugs));
   if (!f || f.emailTracking !== false) {
     endpoints.push(createEmailStatsEndpoint(slugs), createTrackOpenEndpoint(slugs));
   }
   if (!f || f.pendingEmails !== false) endpoints.push(createPendingEmailsProcessEndpoint(slugs));
   if (!f || f.scheduledReplies !== false) endpoints.push(createProcessScheduledEndpoint(slugs));
+  if (!f || f.snooze !== false) endpoints.push(createProcessSnoozeEndpoint(slugs));
+  endpoints.push(createProcessDigestsEndpoint(slugs));
+  endpoints.push(createChannelsWebhookEndpoint(slugs));
   return endpoints;
 }
 
 // src/utils/adminNotification.ts
 async function createAdminNotification(payload, data, collectionSlug = "admin-notifications") {
   try {
-    await payload.create({
-      collection: collectionSlug,
+    await dbCreate(payload, collectionSlug, {
       data: {
         title: data.title,
         message: data.message,
@@ -6042,8 +6526,7 @@ function dispatchWebhook(data, event, payload, slugs) {
 }
 async function _dispatch(data, event, payload, slugs) {
   try {
-    const { docs: endpoints } = await payload.find({
-      collection: slugs.webhookEndpoints,
+    const { docs: endpoints } = await dbFind(payload, slugs.webhookEndpoints, {
       where: {
         and: [
           { active: { equals: true } },
@@ -6080,8 +6563,7 @@ async function _sendToEndpoint(endpoint, body, payload, slugs) {
       signal: AbortSignal.timeout(1e4)
       // 10s timeout
     });
-    await payload.update({
-      collection: slugs.webhookEndpoints,
+    await dbUpdate(payload, slugs.webhookEndpoints, {
       id: endpoint.id,
       data: {
         lastTriggeredAt: (/* @__PURE__ */ new Date()).toISOString(),
@@ -6095,8 +6577,7 @@ async function _sendToEndpoint(endpoint, body, payload, slugs) {
   } catch (err) {
     console.error(`[webhook] Failed to call ${endpoint.name || endpoint.url}:`, err);
     try {
-      await payload.update({
-        collection: slugs.webhookEndpoints,
+      await dbUpdate(payload, slugs.webhookEndpoints, {
         id: endpoint.id,
         data: {
           lastTriggeredAt: (/* @__PURE__ */ new Date()).toISOString(),
@@ -6330,8 +6811,7 @@ async function resolveSlaPolicy(payload, ticket, slugs) {
         if (typeof policyRef === "object" && policyRef.firstResponseTime) {
           return policyRef;
         }
-        return await payload.findByID({
-          collection: slugs.slaPolicies,
+        return await dbFindByID(payload, slugs.slaPolicies, {
           id: policyId,
           depth: 0,
           overrideAccess: true
@@ -6342,8 +6822,7 @@ async function resolveSlaPolicy(payload, ticket, slugs) {
   }
   const priority = field(ticket, "priority") || "normal";
   try {
-    const defaults = await payload.find({
-      collection: slugs.slaPolicies,
+    const defaults = await dbFind(payload, slugs.slaPolicies, {
       where: {
         and: [
           { isDefault: { equals: true } },
@@ -6380,8 +6859,7 @@ async function handleSlaBreach(payload, ticket, type, slugs, notificationSlug) {
     if (typeof policyRef === "object" && policyRef.escalateOnBreach !== void 0) {
       policy = policyRef;
     } else {
-      policy = await payload.findByID({
-        collection: slugs.slaPolicies,
+      policy = await dbFindByID(payload, slugs.slaPolicies, {
         id: policyId,
         depth: 0,
         overrideAccess: true
@@ -6394,8 +6872,7 @@ async function handleSlaBreach(payload, ticket, type, slugs, notificationSlug) {
   try {
     const escalateToId = typeof policy.escalateTo === "object" ? policy.escalateTo.id : policy.escalateTo;
     if (!escalateToId) return;
-    const escalateUser = typeof policy.escalateTo === "object" && policy.escalateTo.email ? policy.escalateTo : await payload.findByID({
-      collection: slugs.users,
+    const escalateUser = typeof policy.escalateTo === "object" && policy.escalateTo.email ? policy.escalateTo : await dbFindByID(payload, slugs.users, {
       id: escalateToId,
       depth: 0,
       overrideAccess: true
@@ -6443,8 +6920,7 @@ function createAssignSlaDeadlines(slugs, notificationSlug = "admin-notifications
       if (!field(doc, "slaPolicy") && policy.id) {
         updateData.slaPolicy = policy.id;
       }
-      await payload.update({
-        collection: slugs.tickets,
+      await dbUpdate(payload, slugs.tickets, {
         id: doc.id,
         data: updateData,
         overrideAccess: true
@@ -6467,8 +6943,7 @@ function createCheckSlaOnResolve(slugs, notificationSlug = "admin-notifications"
       const now = /* @__PURE__ */ new Date();
       const deadline = new Date(doc.slaResolutionDue);
       const breached = now > deadline;
-      await payload.update({
-        collection: slugs.tickets,
+      await dbUpdate(payload, slugs.tickets, {
         id: doc.id,
         data: { slaResolutionBreached: breached },
         overrideAccess: true
@@ -6482,6 +6957,35 @@ function createCheckSlaOnResolve(slugs, notificationSlug = "admin-notifications"
     return doc;
   };
 }
+function createPauseSlaOnHold(slugs) {
+  return async ({ doc, previousDoc, operation, req }) => {
+    if (operation !== "update" || !previousDoc) return doc;
+    if (previousDoc.status === doc.status) return doc;
+    if (!doc.slaResolutionDue) return doc;
+    const wasWaiting = previousDoc.status === "waiting_client";
+    const isWaiting = doc.status === "waiting_client";
+    try {
+      if (!wasWaiting && isWaiting && !doc.slaPausedAt && doc.status !== "resolved") {
+        await req.payload.update({
+          collection: slugs.tickets,
+          id: doc.id,
+          data: { slaPausedAt: (/* @__PURE__ */ new Date()).toISOString() },
+          overrideAccess: true
+        });
+      } else if (wasWaiting && !isWaiting && doc.slaPausedAt) {
+        const pausedMs = Date.now() - new Date(doc.slaPausedAt).getTime();
+        const data = { slaPausedAt: null };
+        if (pausedMs > 0) {
+          data.slaResolutionDue = new Date(new Date(doc.slaResolutionDue).getTime() + pausedMs).toISOString();
+        }
+        await req.payload.update({ collection: slugs.tickets, id: doc.id, data, overrideAccess: true });
+      }
+    } catch (err) {
+      console.error("[sla] Failed to pause/resume SLA on hold:", err);
+    }
+    return doc;
+  };
+}
 function createCheckSlaOnReply(slugs, notificationSlug = "admin-notifications") {
   return async ({ doc, operation, req }) => {
     if (operation !== "create") return doc;
@@ -6489,8 +6993,7 @@ function createCheckSlaOnReply(slugs, notificationSlug = "admin-notifications")
     try {
       const { payload } = req;
       const ticketId = typeof doc.ticket === "object" ? doc.ticket.id : doc.ticket;
-      const ticket = await payload.findByID({
-        collection: slugs.tickets,
+      const ticket = await dbFindByID(payload, slugs.tickets, {
         id: ticketId,
         depth: 1,
         overrideAccess: true
@@ -6501,8 +7004,7 @@ function createCheckSlaOnReply(slugs, notificationSlug = "admin-notifications")
       const now = /* @__PURE__ */ new Date();
       const deadline = new Date(ticket.slaFirstResponseDue);
       const breached = now > deadline;
-      await payload.update({
-        collection: slugs.tickets,
+      await dbUpdate(payload, slugs.tickets, {
         id: ticketId,
         data: { slaFirstResponseBreached: breached },
         overrideAccess: true
@@ -6517,6 +7019,108 @@ function createCheckSlaOnReply(slugs, notificationSlug = "admin-notifications")
   };
 }
 
+// src/hooks/automationRules.ts
+function evaluateConditions(doc, rule) {
+  const conds = Array.isArray(rule.conditions) ? rule.conditions : [];
+  if (conds.length === 0) return true;
+  const results = conds.map((c) => {
+    const fieldVal = String(doc[c.field] ?? "");
+    const v = String(c.value ?? "");
+    switch (c.operator) {
+      case "equals":
+        return fieldVal === v;
+      case "not_equals":
+        return fieldVal !== v;
+      case "contains":
+        return fieldVal.toLowerCase().includes(v.toLowerCase());
+      default:
+        return false;
+    }
+  });
+  return rule.matchType === "any" ? results.some(Boolean) : results.every(Boolean);
+}
+function createApplyAutomationRules(slugs) {
+  return async ({ doc, previousDoc, operation, req }) => {
+    if (req.context?.skipAutomation) return doc;
+    const events = [];
+    if (operation === "create") events.push("ticket_created");
+    if (operation === "update") {
+      events.push("ticket_updated");
+      if (previousDoc && previousDoc.status !== doc.status) events.push("ticket_status_changed");
+    }
+    if (events.length === 0) return doc;
+    try {
+      const rules = await dbFind(req.payload, slugs.automationRules, {
+        where: { and: [{ enabled: { equals: true } }, { event: { in: events } }] },
+        sort: "order",
+        limit: 200,
+        depth: 0,
+        overrideAccess: true
+      });
+      const changes = {};
+      const tags = Array.isArray(doc.tags) ? [...doc.tags] : [];
+      let tagsTouched = false;
+      for (const rule of rules.docs) {
+        if (!evaluateConditions(doc, rule)) continue;
+        for (const a of Array.isArray(rule.actions) ? rule.actions : []) {
+          if (!a.value) continue;
+          switch (a.type) {
+            case "set_status":
+              changes.status = a.value;
+              break;
+            case "set_priority":
+              changes.priority = a.value;
+              break;
+            case "set_category":
+              changes.category = a.value;
+              break;
+            case "assign":
+              changes.assignedTo = a.value;
+              break;
+            case "add_tag":
+              if (!tags.includes(a.value)) {
+                tags.push(a.value);
+                tagsTouched = true;
+              }
+              break;
+          }
+        }
+      }
+      if (tagsTouched) changes.tags = tags;
+      if (Object.keys(changes).length > 0) {
+        await req.payload.update({
+          collection: slugs.tickets,
+          id: doc.id,
+          data: changes,
+          overrideAccess: true,
+          context: { skipAutomation: true }
+        });
+      }
+    } catch (err) {
+      console.error("[support] Failed to apply automation rules:", err);
+    }
+    return doc;
+  };
+}
+
+// src/utils/teamAccess.ts
+function isTeamScopingEnabled() {
+  return process.env.SUPPORT_TEAM_SCOPING === "1" || process.env.SUPPORT_TEAM_SCOPING === "true";
+}
+async function resolveAgentTeamIds(payload, slugs, userId) {
+  try {
+    const teams = await dbFind(payload, slugs.supportTeams, {
+      where: { members: { in: [userId] } },
+      limit: 200,
+      depth: 0,
+      overrideAccess: true
+    });
+    return teams.docs.map((t) => t.id);
+  } catch {
+    return [];
+  }
+}
+
 // src/collections/Tickets.ts
 function createAssignTicketNumber(slugs) {
   return async ({ data, operation, req }) => {
@@ -6779,56 +7383,6 @@ function createNotifyClientOnResolve(slugs) {
     return doc;
   };
 }
-function createAutoCalculateSLA(slugs) {
-  return async ({ doc, operation, req }) => {
-    if (operation !== "create") return doc;
-    try {
-      const { payload } = req;
-      const ticketPriority = doc.priority || "normal";
-      let policy = null;
-      const byPriority = await payload.find({
-        collection: slugs.slaPolicies,
-        where: { priority: { equals: ticketPriority } },
-        limit: 1,
-        depth: 0,
-        overrideAccess: true
-      });
-      if (byPriority.docs.length > 0) {
-        policy = byPriority.docs[0];
-      } else {
-        const defaults = await payload.find({
-          collection: slugs.slaPolicies,
-          where: { isDefault: { equals: true } },
-          limit: 1,
-          depth: 0,
-          overrideAccess: true
-        });
-        if (defaults.docs.length > 0) {
-          policy = defaults.docs[0];
-        }
-      }
-      if (!policy) return doc;
-      const now = /* @__PURE__ */ new Date();
-      const firstResponseMinutes = policy.firstResponseTime || 240;
-      const resolutionMinutes = policy.resolutionTime || 1440;
-      const firstResponseDue = new Date(now.getTime() + firstResponseMinutes * 6e4);
-      const resolutionDue = new Date(now.getTime() + resolutionMinutes * 6e4);
-      await payload.update({
-        collection: slugs.tickets,
-        id: doc.id,
-        data: {
-          slaPolicy: policy.id,
-          slaFirstResponseDue: firstResponseDue.toISOString(),
-          slaResolutionDue: resolutionDue.toISOString()
-        },
-        overrideAccess: true
-      });
-    } catch (err) {
-      console.error("[support] Failed to auto-calculate SLA:", err);
-    }
-    return doc;
-  };
-}
 function createFireTicketWebhooks(slugs) {
   return async ({ doc, previousDoc, operation, req }) => {
     const { payload } = req;
@@ -6920,8 +7474,7 @@ function createCascadeDelete(slugs) {
   return async ({ id, req }) => {
     const collections = [slugs.ticketMessages, slugs.ticketActivityLog, slugs.timeEntries, slugs.satisfactionSurveys];
     for (const slug of collections) {
-      await req.payload.delete({
-        collection: slug,
+      await dbDelete(req.payload, slug, {
         where: { ticket: { equals: id } },
         overrideAccess: true
       });
@@ -7046,6 +7599,7 @@ function createTicketsCollection(slugs, options) {
           {
             name: "status",
             type: "select",
+            index: true,
             defaultValue: "open",
             label: "Statut",
             options: [
@@ -7060,6 +7614,7 @@ function createTicketsCollection(slugs, options) {
           {
             name: "priority",
             type: "select",
+            index: true,
             defaultValue: "normal",
             label: "Priorite",
             options: [
@@ -7075,7 +7630,7 @@ function createTicketsCollection(slugs, options) {
       {
         type: "row",
         fields: [
-          { name: "client", type: "relationship", relationTo: slugs.supportClients, required: true, label: "Client", admin: { width: "50%" } }
+          { name: "client", type: "relationship", relationTo: slugs.supportClients, required: true, index: true, label: "Client", admin: { width: "50%" } }
         ]
       },
       // Billing collapsible
@@ -7144,15 +7699,16 @@ function createTicketsCollection(slugs, options) {
           {
             type: "row",
             fields: [
-              { name: "slaFirstResponseDue", type: "date", label: "Echeance 1ere reponse (SLA)", admin: { readOnly: true, width: "50%", date: { displayFormat: "dd/MM/yyyy HH:mm" } } },
-              { name: "slaResolutionDue", type: "date", label: "Echeance resolution (SLA)", admin: { readOnly: true, width: "50%", date: { displayFormat: "dd/MM/yyyy HH:mm" } } }
+              { name: "slaFirstResponseDue", type: "date", index: true, label: "Echeance 1ere reponse (SLA)", admin: { readOnly: true, width: "50%", date: { displayFormat: "dd/MM/yyyy HH:mm" } } },
+              { name: "slaResolutionDue", type: "date", index: true, label: "Echeance resolution (SLA)", admin: { readOnly: true, width: "50%", date: { displayFormat: "dd/MM/yyyy HH:mm" } } }
             ]
           },
           {
             type: "row",
             fields: [
               { name: "slaFirstResponseBreached", type: "checkbox", label: "1ere reponse depassee", admin: { readOnly: true, width: "50%" } },
-              { name: "slaResolutionBreached", type: "checkbox", label: "Resolution depassee", admin: { readOnly: true, width: "50%" } }
+              { name: "slaResolutionBreached", type: "checkbox", label: "Resolution depassee", admin: { readOnly: true, width: "50%" } },
+              { name: "slaPausedAt", type: "date", label: "SLA en pause depuis", admin: { hidden: true } }
             ]
           }
         ]
@@ -7174,7 +7730,7 @@ function createTicketsCollection(slugs, options) {
           },
           { name: "mergedInto", type: "relationship", relationTo: slugs.tickets, label: "Fusionne dans", admin: { readOnly: true } },
           { name: "autoCloseRemindedAt", type: "date", label: "Rappel auto-close envoye", admin: { readOnly: true, date: { displayFormat: "dd/MM/yyyy HH:mm" } } },
-          { name: "autoCloseScheduledAt", type: "date", label: "Fermeture auto programmee", admin: { readOnly: true, date: { displayFormat: "dd/MM/yyyy HH:mm" }, description: "Echeance ferme posee par une relance manuelle. Le ticket se ferme apres cette date sans reponse client." } }
+          { name: "autoCloseScheduledAt", type: "date", index: true, label: "Fermeture auto programmee", admin: { readOnly: true, date: { displayFormat: "dd/MM/yyyy HH:mm" }, description: "Echeance ferme posee par une relance manuelle. Le ticket se ferme apres cette date sans reponse client." } }
         ]
       },
       // Sidebar
@@ -7183,6 +7739,7 @@ function createTicketsCollection(slugs, options) {
       {
         name: "category",
         type: "select",
+        index: true,
         label: "Categorie",
         options: [
           { label: "Bug / Dysfonctionnement", value: "bug" },
@@ -7193,7 +7750,8 @@ function createTicketsCollection(slugs, options) {
         ],
         admin: { position: "sidebar" }
       },
-      { name: "assignedTo", type: "relationship", relationTo: slugs.users, label: "Assigne a", admin: { position: "sidebar" } },
+      { name: "assignedTo", type: "relationship", relationTo: slugs.users, index: true, label: "Assigne a", admin: { position: "sidebar" } },
+      { name: "team", type: "relationship", relationTo: slugs.supportTeams, index: true, label: "Equipe", admin: { position: "sidebar" } },
       {
         name: "source",
         type: "select",
@@ -7203,7 +7761,9 @@ function createTicketsCollection(slugs, options) {
           { label: "Portail client", value: "portal" },
           { label: "Chat en direct", value: "live-chat" },
           { label: "Email", value: "email" },
-          { label: "Admin", value: "admin" }
+          { label: "Admin", value: "admin" },
+          { label: "WhatsApp", value: "whatsapp" },
+          { label: "Messenger", value: "messenger" }
         ],
         admin: { position: "sidebar" }
       },
@@ -7254,8 +7814,8 @@ function createTicketsCollection(slugs, options) {
       afterChange: [
         createTrackSLA(slugs),
         createTrackAiSummaryOnResolve(slugs),
-        createAutoCalculateSLA(slugs),
         createAssignSlaDeadlines(slugs, notificationSlug),
+        createPauseSlaOnHold(slugs),
         createCheckSlaOnResolve(slugs, notificationSlug),
         createLogTicketActivity(slugs),
         createNotifyOnAssignment(slugs),
@@ -7263,7 +7823,8 @@ function createTicketsCollection(slugs, options) {
         createTicketStatusEmail(slugs),
         createNotifyAdminOnNewTicket(slugs, notificationSlug),
         createFireTicketWebhooks(slugs),
-        createDispatchWebhookOnTicket(slugs)
+        createDispatchWebhookOnTicket(slugs),
+        createApplyAutomationRules(slugs)
       ],
       beforeDelete: [createCascadeDelete(slugs)]
     },
@@ -7274,12 +7835,20 @@ function createTicketsCollection(slugs, options) {
         return false;
       },
       read: async ({ req }) => {
-        if (req.user?.collection === slugs.users) return true;
+        if (req.user?.collection === slugs.users) {
+          if (!isTeamScopingEnabled()) return true;
+          const teamIds = await resolveAgentTeamIds(req.payload, slugs, req.user.id);
+          return {
+            or: [
+              { team: { in: teamIds.length > 0 ? teamIds : [-1] } },
+              { team: { exists: false } }
+            ]
+          };
+        }
         if (req.user?.collection === slugs.supportClients) {
           let collabTicketIds = [];
           try {
-            const rows = await req.payload.find({
-              collection: "ticket-collaborators",
+            const rows = await dbFind(req.payload, "ticket-collaborators", {
               where: { client: { equals: req.user.id } },
               limit: 1e3,
               depth: 0,
@@ -7314,6 +7883,125 @@ function createTicketsCollection(slugs, options) {
   };
 }
 
+// src/utils/ticketAccess.ts
+async function resolveAccessibleTicketIds(payload, slugs, clientId) {
+  const ids = /* @__PURE__ */ new Set();
+  try {
+    const owned = await dbFind(payload, slugs.tickets, {
+      where: { client: { equals: clientId } },
+      limit: 5e3,
+      depth: 0,
+      overrideAccess: true
+    });
+    for (const t of owned.docs) ids.add(t.id);
+  } catch {
+  }
+  try {
+    const collab = await dbFind(payload, "ticket-collaborators", {
+      where: { client: { equals: clientId } },
+      limit: 1e3,
+      depth: 0,
+      overrideAccess: true
+    });
+    for (const r of collab.docs) {
+      const row = r;
+      const tid = typeof row.ticket === "object" ? row.ticket?.id : row.ticket;
+      if (tid !== void 0 && tid !== null) ids.add(tid);
+    }
+  } catch {
+  }
+  return Array.from(ids);
+}
+var OPTIONS = {
+  allowedTags: [
+    "p",
+    "br",
+    "b",
+    "strong",
+    "i",
+    "em",
+    "u",
+    "s",
+    "strike",
+    "del",
+    "ins",
+    "mark",
+    "a",
+    "ul",
+    "ol",
+    "li",
+    "blockquote",
+    "code",
+    "pre",
+    "kbd",
+    "span",
+    "div",
+    "h1",
+    "h2",
+    "h3",
+    "h4",
+    "h5",
+    "h6",
+    "hr",
+    "img",
+    "table",
+    "thead",
+    "tbody",
+    "tr",
+    "th",
+    "td"
+  ],
+  allowedAttributes: {
+    a: ["href", "title", "target", "rel"],
+    img: ["src", "alt", "title", "width", "height"],
+    code: ["class"],
+    pre: ["class"],
+    span: ["class"],
+    "*": ["style"]
+  },
+  allowedSchemes: ["http", "https", "mailto", "tel"],
+  allowedSchemesByTag: { img: ["http", "https", "data"] },
+  allowProtocolRelative: false,
+  disallowedTagsMode: "discard",
+  // Force safe rel on links opening a new tab (defense against tabnabbing).
+  transformTags: {
+    a: sanitizeHtml.simpleTransform("a", { rel: "noopener noreferrer nofollow" }, true)
+  },
+  // Only allow CSS that cannot carry a script payload.
+  allowedStyles: {
+    "*": {
+      color: [/^#(0x)?[0-9a-f]+$/i, /^rgb\(\s*(\d{1,3}\s*,\s*){2}\d{1,3}\s*\)$/i, /^[a-z-]+$/i],
+      "background-color": [/^#(0x)?[0-9a-f]+$/i, /^rgb\(\s*(\d{1,3}\s*,\s*){2}\d{1,3}\s*\)$/i, /^[a-z-]+$/i],
+      "text-align": [/^(left|right|center|justify)$/],
+      "font-weight": [/^(normal|bold|[1-9]00)$/],
+      "font-style": [/^(normal|italic)$/],
+      "text-decoration": [/^(underline|line-through|none)$/]
+    }
+  }
+};
+function sanitizeMessageHtml(html) {
+  if (!html) return html;
+  return sanitizeHtml(html, OPTIONS);
+}
+
+// src/utils/notificationQueue.ts
+async function queueClientNotification(payload, slugs, item) {
+  try {
+    await dbCreate(payload, slugs.notificationQueue, {
+      data: {
+        client: item.client,
+        type: item.type,
+        title: item.title,
+        message: item.message,
+        ...item.ticket ? { ticket: item.ticket } : {}
+      },
+      overrideAccess: true
+    });
+  } catch (err) {
+    console.error("[support] Failed to queue client notification:", err);
+  }
+}
+
 // src/collections/TicketMessages.ts
 function createAssignAuthor(slugs) {
   return async ({ data, operation, req }) => {
@@ -7376,29 +8064,46 @@ function createNotifyClient(slugs) {
       const internalBcc = process.env.SUPPORT_CLIENT_BCC || void 0;
       const rawContent = doc.bodyHtml ? emailRichContent(doc.bodyHtml) : emailQuote(doc.body?.length > 500 ? doc.body.slice(0, 500) + "..." : doc.body);
       const replyPreview = (doc.body || "").replace(/\s+/g, " ").trim().slice(0, 90);
-      await req.payload.sendEmail({
-        to: client.email,
-        ...supportEmail ? { replyTo: supportEmail } : {},
-        ...internalBcc ? { bcc: internalBcc } : {},
-        subject: `Re: [${ticketNumber}] ${subject}`,
-        html: emailWrapper(`Nouvelle reponse \u2014 ${ticketNumber}`, [
-          emailParagraph(`Bonjour <strong>${escapeHtml(client.firstName || "")}</strong>,`),
-          emailParagraph(`Notre equipe a apporte une reponse a votre ticket <strong>${escapeHtml(ticketNumber)}</strong> \u2014 <em>${escapeHtml(subject)}</em>.`),
-          rawContent,
-          emailButton("Consulter le ticket", portalUrl),
-          emailParagraph('<span style="font-size: 13px; color: #6b7280;">Vous pouvez egalement repondre directement a cet email. Votre message sera automatiquement ajoute au ticket.</span>'),
-          emailTrackingPixel(ticketId, doc.id)
-        ].join(""), {
-          kind: "reply",
-          preheader: replyPreview ? `${replyPreview}\u2026` : `Nouvelle reponse a votre ticket ${ticketNumber}`
-        })
-      });
-      await req.payload.update({
-        collection: slugs.ticketMessages,
-        id: doc.id,
-        data: { emailSentAt: (/* @__PURE__ */ new Date()).toISOString(), emailSentTo: client.email },
-        overrideAccess: true
-      });
+      const freq = client.notificationFrequency;
+      if (freq === "daily" || freq === "weekly") {
+        await queueClientNotification(req.payload, slugs, {
+          client: client.id,
+          type: "reply",
+          title: `Nouvelle reponse \u2014 ${ticketNumber}`,
+          message: replyPreview || `Reponse a votre ticket ${ticketNumber}`,
+          ticket: ticketId
+        });
+        return doc;
+      }
+      void (async () => {
+        try {
+          await req.payload.sendEmail({
+            to: client.email,
+            ...supportEmail ? { replyTo: supportEmail } : {},
+            ...internalBcc ? { bcc: internalBcc } : {},
+            subject: `Re: [${ticketNumber}] ${subject}`,
+            html: emailWrapper(`Nouvelle reponse \u2014 ${ticketNumber}`, [
+              emailParagraph(`Bonjour <strong>${escapeHtml(client.firstName || "")}</strong>,`),
+              emailParagraph(`Notre equipe a apporte une reponse a votre ticket <strong>${escapeHtml(ticketNumber)}</strong> \u2014 <em>${escapeHtml(subject)}</em>.`),
+              rawContent,
+              emailButton("Consulter le ticket", portalUrl),
+              emailParagraph('<span style="font-size: 13px; color: #6b7280;">Vous pouvez egalement repondre directement a cet email. Votre message sera automatiquement ajoute au ticket.</span>'),
+              emailTrackingPixel(ticketId, doc.id)
+            ].join(""), {
+              kind: "reply",
+              preheader: replyPreview ? `${replyPreview}\u2026` : `Nouvelle reponse a votre ticket ${ticketNumber}`
+            })
+          });
+          await req.payload.update({
+            collection: slugs.ticketMessages,
+            id: doc.id,
+            data: { emailSentAt: (/* @__PURE__ */ new Date()).toISOString(), emailSentTo: client.email },
+            overrideAccess: true
+          });
+        } catch (err) {
+          console.error("[support] Failed to notify client (async):", err);
+        }
+      })();
     } catch (err) {
       console.error("[support] Failed to notify client:", err);
     }
@@ -7436,8 +8141,7 @@ function createSyncTicketReplyToChat(slugs) {
       if (!ticket?.chatSession) return doc;
       if (doc.skipNotification) return doc;
       const clientId = typeof ticket.client === "object" ? ticket.client.id : ticket.client;
-      await payload.create({
-        collection: slugs.chatMessages,
+      await dbCreate(payload, slugs.chatMessages, {
         data: {
           session: ticket.chatSession,
           client: clientId,
@@ -7554,6 +8258,57 @@ function createDispatchWebhookOnReply(slugs) {
     return doc;
   };
 }
+function createSanitizeMessageHtml() {
+  return ({ data }) => {
+    if (data && typeof data.bodyHtml === "string" && data.bodyHtml) {
+      data.bodyHtml = sanitizeMessageHtml(data.bodyHtml);
+    }
+    return data;
+  };
+}
+var MENTION_RE = /@([^\s@]+@[^\s@]+\.[^\s@]+)/g;
+function createResolveMentions(slugs) {
+  return async ({ data, operation, req }) => {
+    if (operation !== "create") return data;
+    const body = typeof data?.body === "string" ? data.body : "";
+    const emails = Array.from(new Set([...body.matchAll(MENTION_RE)].map((m) => m[1].toLowerCase())));
+    if (emails.length === 0) return data;
+    try {
+      const users = await dbFind(req.payload, slugs.users, { where: { email: { in: emails } }, limit: 50, depth: 0, overrideAccess: true });
+      const ids = users.docs.map((u) => u.id);
+      if (ids.length > 0) data.mentions = ids;
+    } catch {
+    }
+    return data;
+  };
+}
+function createNotifyMentions(slugs) {
+  return async ({ doc, operation, req }) => {
+    if (operation !== "create") return doc;
+    const mentions = Array.isArray(doc.mentions) ? doc.mentions : [];
+    if (mentions.length === 0) return doc;
+    const ticketId = typeof doc.ticket === "object" ? doc.ticket.id : doc.ticket;
+    const baseUrl = process.env.NEXT_PUBLIC_SERVER_URL || "";
+    for (const m of mentions) {
+      const userId = typeof m === "object" ? m.id : m;
+      try {
+        const user = await dbFindByID(req.payload, slugs.users, { id: userId, depth: 0, overrideAccess: true });
+        if (!user?.email) continue;
+        await req.payload.sendEmail({
+          to: user.email,
+          subject: `Vous avez ete mentionne \u2014 ticket #${ticketId}`,
+          html: emailWrapper("Mention", [
+            emailParagraph(`Vous avez ete mentionne dans un message du ticket <strong>#${escapeHtml(String(ticketId))}</strong>.`),
+            ...baseUrl ? [emailButton("Ouvrir le ticket", `${baseUrl}/admin/collections/${slugs.tickets}/${ticketId}`, "dark")] : []
+          ].join(""), { kind: "system" })
+        });
+      } catch (err) {
+        console.error("[support] Failed to notify mention:", err);
+      }
+    }
+    return doc;
+  };
+}
 function createTicketMessagesCollection(slugs, options) {
   const notificationSlug = options?.notificationSlug || "admin-notifications";
   return {
@@ -7561,7 +8316,7 @@ function createTicketMessagesCollection(slugs, options) {
     labels: { singular: "Message", plural: "Messages" },
     admin: { hidden: true, group: "Support", defaultColumns: ["ticket", "authorType", "createdAt"] },
     fields: [
-      { name: "ticket", type: "relationship", relationTo: slugs.tickets, required: true, label: "Ticket" },
+      { name: "ticket", type: "relationship", relationTo: slugs.tickets, required: true, index: true, label: "Ticket" },
       { name: "body", type: "textarea", required: true, label: "Message" },
       { name: "bodyHtml", type: "textarea", label: "Message HTML", admin: { hidden: true } },
       {
@@ -7570,6 +8325,7 @@ function createTicketMessagesCollection(slugs, options) {
           {
             name: "authorType",
             type: "select",
+            index: true,
             label: "Type d'auteur",
             defaultValue: "admin",
             options: [
@@ -7605,8 +8361,9 @@ function createTicketMessagesCollection(slugs, options) {
       },
       { name: "isInternal", type: "checkbox", defaultValue: false, label: "Note interne", admin: { position: "sidebar" } },
       { name: "isSolution", type: "checkbox", defaultValue: false, label: "Reponse solution", admin: { position: "sidebar" } },
+      { name: "mentions", type: "relationship", relationTo: slugs.users, hasMany: true, label: "Agents mentionnes", admin: { hidden: true } },
       { name: "skipNotification", type: "checkbox", defaultValue: false, label: "Sans notification", admin: { position: "sidebar", condition: (data) => data?.skipNotification === true } },
-      { name: "scheduledAt", type: "date", label: "Programme pour", admin: { date: { pickerAppearance: "dayAndTime" }, position: "sidebar", condition: (data) => !!data?.scheduledAt } },
+      { name: "scheduledAt", type: "date", index: true, label: "Programme pour", admin: { date: { pickerAppearance: "dayAndTime" }, position: "sidebar", condition: (data) => !!data?.scheduledAt } },
       { name: "scheduledSent", type: "checkbox", defaultValue: false, admin: { hidden: true } },
       { name: "editedAt", type: "date", label: "Modifie le", admin: { hidden: true } },
       { name: "deletedAt", type: "date", label: "Supprime le", admin: { hidden: true } },
@@ -7615,7 +8372,7 @@ function createTicketMessagesCollection(slugs, options) {
       { name: "emailOpenedAt", type: "date", label: "Email ouvert le", admin: { hidden: true } }
     ],
     hooks: {
-      beforeChange: [createAssignAuthor(slugs)],
+      beforeChange: [createSanitizeMessageHtml(), createResolveMentions(slugs), createAssignAuthor(slugs)],
       afterChange: [
         createAutoUpdateStatus(slugs),
         createNotifyClient(slugs),
@@ -7624,17 +8381,19 @@ function createTicketMessagesCollection(slugs, options) {
         createSyncTicketReplyToChat(slugs),
         createNotifyAdminOnClientMessage(slugs, notificationSlug),
         createFireMessageWebhooks(slugs),
-        createDispatchWebhookOnReply(slugs)
+        createDispatchWebhookOnReply(slugs),
+        createNotifyMentions(slugs)
       ]
     },
     access: {
       create: ({ req }) => req.user?.collection === slugs.users || req.user?.collection === slugs.supportClients,
-      read: ({ req }) => {
+      read: async ({ req }) => {
         if (req.user?.collection === slugs.users) return true;
         if (req.user?.collection === slugs.supportClients) {
+          const ids = await resolveAccessibleTicketIds(req.payload, slugs, req.user.id);
           return {
             and: [
-              { "ticket.client": { equals: req.user.id } },
+              { ticket: { in: ids.length > 0 ? ids : [-1] } },
               { isInternal: { equals: false } },
               { or: [{ scheduledAt: { exists: false } }, { scheduledSent: { equals: true } }] }
             ]
@@ -7654,8 +8413,6 @@ function createTicketMessagesCollection(slugs, options) {
     timestamps: true
   };
 }
-
-// src/collections/SupportClients.ts
 function createSendInvitationOnCreate(slugs) {
   return async ({ doc, operation, req }) => {
     if (operation !== "create") return doc;
@@ -7695,6 +8452,26 @@ function createSendInvitationOnCreate(slugs) {
     return doc;
   };
 }
+var TWO_FA_WINDOW_MS = 5 * 60 * 1e3;
+function createEnforce2FA(slugs) {
+  return async ({ req, user }) => {
+    if (!user?.twoFactorEnabled) return user;
+    const raw = user.twoFactorVerifiedAt;
+    const verifiedAt = raw ? new Date(raw).getTime() : 0;
+    if (!(verifiedAt > Date.now() - TWO_FA_WINDOW_MS)) {
+      throw new APIError("2FA_REQUIRED", 401);
+    }
+    await req.payload.update({
+      collection: slugs.supportClients,
+      id: user.id,
+      data: { twoFactorVerifiedAt: null },
+      req,
+      overrideAccess: true
+    });
+    user.twoFactorVerifiedAt = null;
+    return user;
+  };
+}
 function createSupportClientsCollection(slugs) {
   return {
     slug: slugs.supportClients,
@@ -7823,6 +8600,10 @@ function createSupportClientsCollection(slugs) {
         name: "opportunities",
         type: "textarea",
         label: "Opportunites commerciales",
+        access: {
+          // Admin-only: never serialize commercial notes onto the client's own doc.
+          read: ({ req }) => req.user?.collection === slugs.users
+        },
         admin: {
           description: "Notes commerciales (visible uniquement par les admins)"
         }
@@ -7866,6 +8647,19 @@ function createSupportClientsCollection(slugs) {
         type: "date",
         admin: { hidden: true }
       },
+      {
+        // Set by /support/2fa "verify"; gates login via the beforeLogin hook.
+        name: "twoFactorVerifiedAt",
+        type: "date",
+        admin: { hidden: true }
+      },
+      {
+        // Google OAuth subject id — accounts are linked by this, not email alone.
+        name: "googleId",
+        type: "text",
+        index: true,
+        admin: { hidden: true }
+      },
       {
         name: "notifyOnReply",
         type: "checkbox",
@@ -7932,6 +8726,10 @@ function createSupportClientsCollection(slugs) {
         name: "notes",
         type: "textarea",
         label: "Notes internes",
+        access: {
+          // Admin-only: never serialize internal notes onto the client's own doc.
+          read: ({ req }) => req.user?.collection === slugs.users
+        },
         admin: {
           description: "Visible uniquement par les admins",
           position: "sidebar"
@@ -7939,6 +8737,7 @@ function createSupportClientsCollection(slugs) {
       }
     ],
     hooks: {
+      beforeLogin: [createEnforce2FA(slugs)],
       afterChange: [createSendInvitationOnCreate(slugs)]
     },
     access: {
@@ -8152,6 +8951,7 @@ function createTicketActivityLogCollection(slugs) {
         type: "relationship",
         relationTo: slugs.tickets,
         required: true,
+        index: true,
         label: "Ticket"
       },
       {
@@ -8197,10 +8997,11 @@ function createTicketActivityLogCollection(slugs) {
     access: {
       create: () => false,
       // Created only by hooks via overrideAccess
-      read: ({ req }) => {
+      read: async ({ req }) => {
         if (req.user?.collection === slugs.users) return true;
         if (req.user?.collection === slugs.supportClients) {
-          return { "ticket.client": { equals: req.user.id } };
+          const ids = await resolveAccessibleTicketIds(req.payload, slugs, req.user.id);
+          return { ticket: { in: ids.length > 0 ? ids : [-1] } };
         }
         return false;
       },
@@ -8269,12 +9070,21 @@ function createSatisfactionSurveysCollection(slugs) {
       {
         name: "rating",
         type: "number",
-        required: true,
         min: 1,
         max: 5,
         label: "Note (1-5)",
         admin: {
-          description: "1 = Tr\xE8s insatisfait, 5 = Tr\xE8s satisfait"
+          description: "1 = Tr\xE8s insatisfait, 5 = Tr\xE8s satisfait (CSAT)"
+        }
+      },
+      {
+        name: "nps",
+        type: "number",
+        min: 0,
+        max: 10,
+        label: "NPS (0-10)",
+        admin: {
+          description: "\xAB Recommanderiez-vous ? \xBB \u2014 promoteur 9-10, passif 7-8, d\xE9tracteur 0-6"
         }
       },
       {
@@ -9520,6 +10330,124 @@ function createTicketCollaboratorsCollection(slugs) {
   };
 }
 
+// src/collections/NotificationQueue.ts
+function createNotificationQueueCollection(slugs) {
+  return {
+    slug: slugs.notificationQueue,
+    labels: { singular: "Notification en file", plural: "Notifications en file" },
+    admin: { hidden: true, group: "Support", defaultColumns: ["client", "type", "title", "createdAt"] },
+    access: {
+      // Internal: written/drained only via overrideAccess (hooks + cron).
+      create: () => false,
+      update: () => false,
+      read: ({ req }) => req.user?.collection === slugs.users,
+      delete: ({ req }) => req.user?.collection === slugs.users
+    },
+    fields: [
+      { name: "client", type: "relationship", relationTo: slugs.supportClients, required: true, index: true, label: "Client" },
+      { name: "type", type: "text", label: "Type" },
+      { name: "title", type: "text", label: "Titre" },
+      { name: "message", type: "textarea", label: "Message" },
+      { name: "ticket", type: "relationship", relationTo: slugs.tickets, label: "Ticket" }
+    ],
+    timestamps: true
+  };
+}
+
+// src/collections/AutomationRules.ts
+var CONDITION_FIELDS = ["status", "priority", "category", "source", "subject"];
+var ACTION_TYPES = [
+  { label: "D\xE9finir le statut", value: "set_status" },
+  { label: "D\xE9finir la priorit\xE9", value: "set_priority" },
+  { label: "D\xE9finir la cat\xE9gorie", value: "set_category" },
+  { label: "Assigner \xE0 (id agent)", value: "assign" },
+  { label: "Ajouter un tag", value: "add_tag" }
+];
+function createAutomationRulesCollection(slugs) {
+  return {
+    slug: slugs.automationRules,
+    labels: { singular: "R\xE8gle d'automatisation", plural: "R\xE8gles d'automatisation" },
+    admin: { useAsTitle: "name", group: "Support", defaultColumns: ["name", "event", "enabled", "order"] },
+    access: {
+      read: ({ req }) => req.user?.collection === slugs.users,
+      create: ({ req }) => req.user?.collection === slugs.users,
+      update: ({ req }) => req.user?.collection === slugs.users,
+      delete: ({ req }) => req.user?.collection === slugs.users
+    },
+    fields: [
+      { name: "name", type: "text", required: true, label: "Nom" },
+      { name: "enabled", type: "checkbox", defaultValue: true, label: "Active", index: true },
+      {
+        name: "event",
+        type: "select",
+        defaultValue: "ticket_created",
+        index: true,
+        label: "D\xE9clencheur",
+        options: [
+          { label: "Ticket cr\xE9\xE9", value: "ticket_created" },
+          { label: "Ticket mis \xE0 jour", value: "ticket_updated" },
+          { label: "Changement de statut", value: "ticket_status_changed" }
+        ]
+      },
+      {
+        name: "matchType",
+        type: "select",
+        defaultValue: "all",
+        label: "Correspondance",
+        options: [{ label: "Toutes les conditions (ET)", value: "all" }, { label: "Au moins une (OU)", value: "any" }]
+      },
+      { name: "order", type: "number", defaultValue: 0, label: "Ordre d'\xE9valuation" },
+      {
+        name: "conditions",
+        type: "array",
+        label: "Conditions",
+        fields: [
+          { name: "field", type: "select", required: true, options: CONDITION_FIELDS.map((v) => ({ label: v, value: v })) },
+          {
+            name: "operator",
+            type: "select",
+            defaultValue: "equals",
+            required: true,
+            options: [{ label: "= \xE9gal", value: "equals" }, { label: "\u2260 diff\xE9rent", value: "not_equals" }, { label: "contient", value: "contains" }]
+          },
+          { name: "value", type: "text", required: true }
+        ]
+      },
+      {
+        name: "actions",
+        type: "array",
+        label: "Actions",
+        fields: [
+          { name: "type", type: "select", required: true, options: ACTION_TYPES },
+          { name: "value", type: "text", required: true }
+        ]
+      }
+    ],
+    timestamps: true
+  };
+}
+
+// src/collections/SupportTeam.ts
+function createSupportTeamCollection(slugs) {
+  return {
+    slug: slugs.supportTeams,
+    labels: { singular: "\xC9quipe support", plural: "\xC9quipes support" },
+    admin: { useAsTitle: "name", group: "Support", defaultColumns: ["name", "members"] },
+    access: {
+      read: ({ req }) => req.user?.collection === slugs.users,
+      create: ({ req }) => req.user?.collection === slugs.users,
+      update: ({ req }) => req.user?.collection === slugs.users,
+      delete: ({ req }) => req.user?.collection === slugs.users
+    },
+    fields: [
+      { name: "name", type: "text", required: true, label: "Nom" },
+      { name: "description", type: "textarea", label: "Description" },
+      { name: "members", type: "relationship", relationTo: slugs.users, hasMany: true, index: true, label: "Membres (agents)" }
+    ],
+    timestamps: true
+  };
+}
+
 // src/plugin.ts
 function viewConfig(component, path) {
   return { Component: component, path };
@@ -9555,7 +10483,10 @@ function supportPlugin(config) {
       createSatisfactionSurveysCollection(slugs),
       createKnowledgeBaseCollection(slugs),
       createTicketFeedbackCollection(slugs, { notificationSlug: config?.notificationSlug }),
-      createTicketCollaboratorsCollection(slugs)
+      createTicketCollaboratorsCollection(slugs),
+      createNotificationQueueCollection(slugs),
+      createAutomationRulesCollection(slugs),
+      createSupportTeamCollection(slugs)
     ];
     if (features.authLogs !== false) supportCollections.push(createAuthLogsCollection(slugs));
     if (features.timeTracking !== false) supportCollections.push(createTimeEntriesCollection(slugs));