@consilioweb/payload-support 0.16.0 → 1.1.0

package/src/endpoints/admin-stats.ts

@@ -1,6 +1,7 @@
 import type { Endpoint } from 'payload'
 import type { CollectionSlugs } from '../utils/slugs'
 import { requireAdmin, handleAuthError } from '../utils/auth'
+import { dbFind, dbCount } from '../utils/db'
 
 /**
  * GET /api/support/admin-stats
@@ -17,13 +18,16 @@ export function createAdminStatsEndpoint(slugs: CollectionSlugs): Endpoint {
 
         requireAdmin(req, slugs)
 
+        // Optional per-team dashboard scoping (?teamId=) — applied to ticket counts.
+        const teamId = new URL(req.url!).searchParams.get('teamId')
+        const teamAnd = teamId ? [{ team: { equals: Number(teamId) } }] : []
+
         // ── Status counts via individual count queries ──
         const statuses = ['open', 'waiting_client', 'resolved'] as const
         const statusCounts = await Promise.all(
           statuses.map(async (status) => {
-            const result = await payload.count({
-              collection: slugs.tickets as any,
-              where: { status: { equals: status } },
+            const result = await dbCount(payload, slugs.tickets, {
+              where: { and: [{ status: { equals: status } }, ...teamAnd] },
               overrideAccess: true,
             })
             return [status, result.totalDocs] as const
@@ -36,9 +40,8 @@ export function createAdminStatsEndpoint(slugs: CollectionSlugs): Endpoint {
         const priorities = ['low', 'normal', 'high', 'urgent'] as const
         const priorityCounts = await Promise.all(
           priorities.map(async (priority) => {
-            const result = await payload.count({
-              collection: slugs.tickets as any,
-              where: { priority: { equals: priority } },
+            const result = await dbCount(payload, slugs.tickets, {
+              where: { and: [{ priority: { equals: priority } }, ...teamAnd] },
               overrideAccess: true,
             })
             return [priority, result.totalDocs] as const
@@ -50,9 +53,8 @@ export function createAdminStatsEndpoint(slugs: CollectionSlugs): Endpoint {
         const categories = ['bug', 'content', 'feature', 'question', 'hosting'] as const
         const categoryCounts = await Promise.all(
           categories.map(async (category) => {
-            const result = await payload.count({
-              collection: slugs.tickets as any,
-              where: { category: { equals: category } },
+            const result = await dbCount(payload, slugs.tickets, {
+              where: { and: [{ category: { equals: category } }, ...teamAnd] },
               overrideAccess: true,
             })
             return [category, result.totalDocs] as const
@@ -68,18 +70,38 @@ export function createAdminStatsEndpoint(slugs: CollectionSlugs): Endpoint {
         const sevenDaysAgo = new Date(now.getTime() - 7 * 24 * 60 * 60 * 1000)
 
         const [created7, created30] = await Promise.all([
-          payload.count({
-            collection: slugs.tickets as any,
+          dbCount(payload, slugs.tickets, {
             where: { createdAt: { greater_than_equal: sevenDaysAgo.toISOString() } },
             overrideAccess: true,
           }),
-          payload.count({
-            collection: slugs.tickets as any,
+          dbCount(payload, slugs.tickets, {
             where: { createdAt: { greater_than_equal: thirtyDaysAgo.toISOString() } },
             overrideAccess: true,
           }),
         ])
 
+        // Real per-day ticket volume for the last 7 days (chronological), replacing
+        // the previous synthetic distribution in the dashboard chart.
+        const volumeByDay = await Promise.all(
+          Array.from({ length: 7 }, (_, i) => i).map(async (offset) => {
+            const dayStart = new Date(now)
+            dayStart.setHours(0, 0, 0, 0)
+            dayStart.setDate(dayStart.getDate() - (6 - offset))
+            const dayEnd = new Date(dayStart)
+            dayEnd.setDate(dayEnd.getDate() + 1)
+            const r = await dbCount(payload, slugs.tickets, {
+              where: {
+                and: [
+                  { createdAt: { greater_than_equal: dayStart.toISOString() } },
+                  { createdAt: { less_than: dayEnd.toISOString() } },
+                ],
+              },
+              overrideAccess: true,
+            })
+            return { date: dayStart.toISOString(), count: r.totalDocs }
+          }),
+        )
+
         // ── Averages: paginate with limit:100, only fetch needed fields ──
         const PAGE_SIZE = 100
         const MAX_PAGES = 50
@@ -93,8 +115,7 @@ export function createAdminStatsEndpoint(slugs: CollectionSlugs): Endpoint {
         let hasMore = true
 
         while (hasMore && page <= MAX_PAGES) {
-          const batch = await payload.find({
-            collection: slugs.tickets as any,
+          const batch = await dbFind(payload, slugs.tickets, {
             limit: PAGE_SIZE,
             page,
             depth: 0,
@@ -124,46 +145,64 @@ export function createAdminStatsEndpoint(slugs: CollectionSlugs): Endpoint {
           page++
         }
 
-        // ── Satisfaction: use count + paginated average ──
-        const surveyCount = await payload.count({
-          collection: slugs.satisfactionSurveys as any,
+        // ── Satisfaction (CSAT) + NPS: count + paginated aggregation ──
+        const surveyCount = await dbCount(payload, slugs.satisfactionSurveys, {
           overrideAccess: true,
         })
 
         let satisfactionAvg = 0
+        let satisfactionCount = 0
+        let npsScore: number | null = null
+        let npsCount = 0
         if (surveyCount.totalDocs > 0) {
-          let totalRating = 0
+          let ratingSum = 0
+          let ratingN = 0
+          let promoters = 0
+          let detractors = 0
+          let npsN = 0
           let surveyPage = 1
           let surveyHasMore = true
           while (surveyHasMore && surveyPage <= MAX_PAGES) {
-            const batch = await payload.find({
-              collection: slugs.satisfactionSurveys as any,
+            const batch = await dbFind(payload, slugs.satisfactionSurveys, {
               limit: PAGE_SIZE,
               page: surveyPage,
               depth: 0,
               overrideAccess: true,
-              select: { rating: true },
+              select: { rating: true, nps: true },
             })
             for (const s of batch.docs) {
-              totalRating += ((s as any).rating || 0)
+              const r = (s as { rating?: number }).rating
+              if (typeof r === 'number' && r > 0) { ratingSum += r; ratingN++ }
+              const n = (s as { nps?: number }).nps
+              if (typeof n === 'number') {
+                npsN++
+                if (n >= 9) promoters++
+                else if (n <= 6) detractors++
+              }
             }
             surveyHasMore = batch.hasNextPage ?? false
             surveyPage++
           }
-          satisfactionAvg = Math.round((totalRating / surveyCount.totalDocs) * 10) / 10
+          satisfactionAvg = ratingN > 0 ? Math.round((ratingSum / ratingN) * 10) / 10 : 0
+          satisfactionCount = ratingN
+          if (npsN > 0) {
+            // NPS = %promoters - %detractors, on a -100..100 scale.
+            npsScore = Math.round(((promoters - detractors) / npsN) * 100)
+            npsCount = npsN
+          }
         }
 
-        const [clientCount, pendingEmailsCount] = await Promise.all([
-          payload.count({
-            collection: slugs.supportClients as any,
-            overrideAccess: true,
-          }),
-          payload.count({
-            collection: slugs.pendingEmails as any,
+        const clientCount = await dbCount(payload, slugs.supportClients, { overrideAccess: true })
+        // pendingEmails is an optional feature — tolerate its collection being absent
+        // (otherwise the whole stats endpoint 500s on installs without it).
+        let pendingEmailsTotal = 0
+        try {
+          const pe = await dbCount(payload, slugs.pendingEmails, {
             where: { status: { equals: 'pending' } },
             overrideAccess: true,
-          }),
-        ])
+          })
+          pendingEmailsTotal = pe.totalDocs
+        } catch { /* pendingEmails feature disabled — count stays 0 */ }
 
         return new Response(JSON.stringify({
           total,
@@ -172,6 +211,7 @@ export function createAdminStatsEndpoint(slugs: CollectionSlugs): Endpoint {
           byCategory,
           createdLast7Days: created7.totalDocs,
           createdLast30Days: created30.totalDocs,
+          volumeByDay,
           avgResponseTimeHours: responseTimeCount > 0
             ? Math.round((totalResponseTimeMs / responseTimeCount / (1000 * 60 * 60)) * 10) / 10
             : null,
@@ -180,9 +220,11 @@ export function createAdminStatsEndpoint(slugs: CollectionSlugs): Endpoint {
             : null,
           totalTimeMinutes,
           satisfactionAvg,
-          satisfactionCount: surveyCount.totalDocs,
+          satisfactionCount,
+          npsScore,
+          npsCount,
           clientCount: clientCount.totalDocs,
-          pendingEmailsCount: pendingEmailsCount.totalDocs,
+          pendingEmailsCount: pendingEmailsTotal,
         }), {
           headers: {
             'Content-Type': 'application/json',

package/src/endpoints/ai-agent.ts

@@ -0,0 +1,36 @@
+import type { Endpoint } from 'payload'
+import type { CollectionSlugs } from '../utils/slugs'
+import { requireAdmin, handleAuthError } from '../utils/auth'
+import { runAiAgent } from '../utils/aiAgent'
+
+/**
+ * POST /api/support/ai-agent   body: { ticketId, confidenceThreshold? }
+ *
+ * Runs the autonomous AI agent on a ticket: it either posts a KB-grounded answer
+ * (when confident) or escalates to a human with an internal note. Admin-only.
+ */
+export function createAiAgentEndpoint(slugs: CollectionSlugs): Endpoint {
+  return {
+    path: '/support/ai-agent',
+    method: 'post',
+    handler: async (req) => {
+      try {
+        requireAdmin(req, slugs)
+        let body: { ticketId?: number | string; confidenceThreshold?: number } = {}
+        try { body = (await req.json!()) as typeof body } catch { /* no body */ }
+        if (!body.ticketId) {
+          return Response.json({ error: 'ticketId requis.' }, { status: 400 })
+        }
+        const result = await runAiAgent(req.payload, slugs, body.ticketId, {
+          confidenceThreshold: body.confidenceThreshold,
+        })
+        return Response.json({ ok: true, ...result })
+      } catch (error) {
+        const authResponse = handleAuthError(error)
+        if (authResponse) return authResponse
+        console.error('[ai-agent] Error:', error)
+        return Response.json({ error: 'Erreur interne' }, { status: 500 })
+      }
+    },
+  }
+}

package/src/endpoints/apply-macro.ts

@@ -1,6 +1,7 @@
 import type { Endpoint } from 'payload'
 import type { CollectionSlugs } from '../utils/slugs'
 import { requireAdmin, handleAuthError } from '../utils/auth'
+import { dbFindByID, dbUpdate, dbCreate } from '../utils/db'
 
 interface MacroAction {
   type: 'set_status' | 'set_priority' | 'add_tag' | 'send_reply' | 'assign'
@@ -28,8 +29,7 @@ export function createApplyMacroEndpoint(slugs: CollectionSlugs): Endpoint {
           return Response.json({ error: 'macroId and ticketId are required' }, { status: 400 })
         }
 
-        const macro = await payload.findByID({
-          collection: slugs.macros as any,
+        const macro = await dbFindByID(payload, slugs.macros, {
           id: macroId,
           depth: 0,
           overrideAccess: true,
@@ -38,8 +38,7 @@ export function createApplyMacroEndpoint(slugs: CollectionSlugs): Endpoint {
         if (!macro) return Response.json({ error: 'Macro not found' }, { status: 404 })
         if (!macro.isActive) return Response.json({ error: 'Macro is disabled' }, { status: 400 })
 
-        const ticket = await payload.findByID({
-          collection: slugs.tickets as any,
+        const ticket = await dbFindByID(payload, slugs.tickets, {
           id: ticketId,
           depth: 0,
           overrideAccess: true,
@@ -54,8 +53,7 @@ export function createApplyMacroEndpoint(slugs: CollectionSlugs): Endpoint {
           try {
             switch (action.type) {
               case 'set_status':
-                await payload.update({
-                  collection: slugs.tickets as any,
+                await dbUpdate(payload, slugs.tickets, {
                   id: ticketId,
                   data: { status: action.value },
                   overrideAccess: true,
@@ -64,8 +62,7 @@ export function createApplyMacroEndpoint(slugs: CollectionSlugs): Endpoint {
                 break
 
               case 'set_priority':
-                await payload.update({
-                  collection: slugs.tickets as any,
+                await dbUpdate(payload, slugs.tickets, {
                   id: ticketId,
                   data: { priority: action.value },
                   overrideAccess: true,
@@ -78,8 +75,7 @@ export function createApplyMacroEndpoint(slugs: CollectionSlugs): Endpoint {
                 if (!currentTags.includes(action.value)) {
                   currentTags.push(action.value)
                 }
-                await payload.update({
-                  collection: slugs.tickets as any,
+                await dbUpdate(payload, slugs.tickets, {
                   id: ticketId,
                   data: { tags: currentTags },
                   overrideAccess: true,
@@ -89,8 +85,7 @@ export function createApplyMacroEndpoint(slugs: CollectionSlugs): Endpoint {
               }
 
               case 'send_reply':
-                await payload.create({
-                  collection: slugs.ticketMessages as any,
+                await dbCreate(payload, slugs.ticketMessages, {
                   data: {
                     ticket: ticketId,
                     body: action.value,
@@ -108,8 +103,7 @@ export function createApplyMacroEndpoint(slugs: CollectionSlugs): Endpoint {
                   appliedActions.push({ type: action.type, value: action.value, success: false, error: 'Invalid user ID' })
                   break
                 }
-                await payload.update({
-                  collection: slugs.tickets as any,
+                await dbUpdate(payload, slugs.tickets, {
                   id: ticketId,
                   data: { assignedTo: userId },
                   overrideAccess: true,

package/src/endpoints/auth-2fa.ts

@@ -3,6 +3,7 @@ import type { CollectionSlugs } from '../utils/slugs'
 import crypto, { createHmac } from 'crypto'
 import { RateLimiter } from '../utils/rateLimiter'
 import { escapeHtml } from '../utils/emailTemplate'
+import { dbFind, dbUpdate } from '../utils/db'
 
 const sendLimiter = new RateLimiter(60 * 60 * 1000, 3) // 3 per hour
 const verifyLimiter = new RateLimiter(15 * 60 * 1000, 5) // 5 per 15 min
@@ -14,7 +15,11 @@ function generateSecureCode(): string {
 }
 
 function hashCode(code: string): string {
-  const secret = process.env.PAYLOAD_SECRET || 'payload-support-2fa'
+  const secret = process.env.PAYLOAD_SECRET
+  if (!secret) {
+    // Fail closed: never hash 2FA codes with an insecure, source-visible fallback.
+    throw new Error('[support][2fa] PAYLOAD_SECRET is not set — refusing to operate 2FA with an insecure fallback secret')
+  }
   return createHmac('sha256', secret).update(code).digest('hex')
 }
 
@@ -48,8 +53,7 @@ export function createAuth2faEndpoint(slugs: CollectionSlugs): Endpoint {
             return Response.json(genericSendResponse)
           }
 
-          const clients = await payload.find({
-            collection: slugs.supportClients as any,
+          const clients = await dbFind(payload, slugs.supportClients, {
             where: { email: { equals: email } },
             limit: 1,
             depth: 0,
@@ -65,8 +69,7 @@ export function createAuth2faEndpoint(slugs: CollectionSlugs): Endpoint {
           const twoFactorCode = hashCode(plainCode)
           const twoFactorExpiry = new Date(Date.now() + 10 * 60 * 1000).toISOString()
 
-          await payload.update({
-            collection: slugs.supportClients as any,
+          await dbUpdate(payload, slugs.supportClients, {
             id: client.id,
             data: { twoFactorCode, twoFactorExpiry },
             overrideAccess: true,
@@ -102,8 +105,7 @@ export function createAuth2faEndpoint(slugs: CollectionSlugs): Endpoint {
             )
           }
 
-          const clients = await payload.find({
-            collection: slugs.supportClients as any,
+          const clients = await dbFind(payload, slugs.supportClients, {
             where: { email: { equals: email } },
             limit: 1,
             depth: 0,
@@ -123,8 +125,7 @@ export function createAuth2faEndpoint(slugs: CollectionSlugs): Endpoint {
           }
 
           if (new Date() > new Date(storedExpiry)) {
-            await payload.update({
-              collection: slugs.supportClients as any,
+            await dbUpdate(payload, slugs.supportClients, {
               id: client.id,
               data: { twoFactorCode: '', twoFactorExpiry: '' },
               overrideAccess: true,
@@ -141,10 +142,9 @@ export function createAuth2faEndpoint(slugs: CollectionSlugs): Endpoint {
             return Response.json({ error: 'Code incorrect' }, { status: 400 })
           }
 
-          await payload.update({
-            collection: slugs.supportClients as any,
+          await dbUpdate(payload, slugs.supportClients, {
             id: client.id,
-            data: { twoFactorCode: '', twoFactorExpiry: '' },
+            data: { twoFactorCode: '', twoFactorExpiry: '', twoFactorVerifiedAt: new Date().toISOString() },
             overrideAccess: true,
           })
 

package/src/endpoints/auto-close.ts

@@ -2,6 +2,7 @@ import type { Endpoint } from 'payload'
 import type { CollectionSlugs } from '../utils/slugs'
 import { escapeHtml } from '../utils/emailTemplate'
 import { readSupportSettings } from '../utils/readSettings'
+import { dbFind, dbCreate, dbUpdate } from '../utils/db'
 
 /**
  * GET /api/support/auto-close
@@ -40,8 +41,7 @@ export function createAutoCloseEndpoint(slugs: CollectionSlugs): Endpoint {
         // Step 1: Find tickets needing a reminder
         const remindCutoff = new Date(now.getTime() - REMIND_AFTER_DAYS * 24 * 60 * 60 * 1000)
 
-        const ticketsToRemind = await payload.find({
-          collection: slugs.tickets as any,
+        const ticketsToRemind = await dbFind(payload, slugs.tickets, {
           where: {
             and: [
               { status: { equals: 'waiting_client' } },
@@ -76,8 +76,7 @@ export function createAutoCloseEndpoint(slugs: CollectionSlugs): Endpoint {
               </div>`,
             })
 
-            await payload.update({
-              collection: slugs.tickets as any,
+            await dbUpdate(payload, slugs.tickets, {
               id: t.id,
               data: { autoCloseRemindedAt: now.toISOString() },
               overrideAccess: true,
@@ -99,8 +98,7 @@ export function createAutoCloseEndpoint(slugs: CollectionSlugs): Endpoint {
         //    the past means no reply was received.
         const closeCutoff = new Date(now.getTime() - CLOSE_AFTER_REMIND_DAYS * 24 * 60 * 60 * 1000)
 
-        const ticketsToClose = await payload.find({
-          collection: slugs.tickets as any,
+        const ticketsToClose = await dbFind(payload, slugs.tickets, {
           where: {
             and: [
               { status: { equals: 'waiting_client' } },
@@ -142,8 +140,7 @@ export function createAutoCloseEndpoint(slugs: CollectionSlugs): Endpoint {
               ? 'Ticket résolu automatiquement — relance manuelle restée sans réponse du client'
               : `Ticket résolu automatiquement — sans réponse client depuis ${closeTotalDays} jours`
 
-            await payload.create({
-              collection: slugs.ticketMessages as any,
+            await dbCreate(payload, slugs.ticketMessages, {
               data: {
                 ticket: t.id,
                 body: noteBody,
@@ -154,8 +151,7 @@ export function createAutoCloseEndpoint(slugs: CollectionSlugs): Endpoint {
               overrideAccess: true,
             })
 
-            await payload.update({
-              collection: slugs.tickets as any,
+            await dbUpdate(payload, slugs.tickets, {
               id: t.id,
               // Clear the armed deadline so a later manual reopen can't be
               // closed instantly by a stale timestamp.

package/src/endpoints/billing.ts

@@ -1,6 +1,7 @@
 import type { Endpoint, Where } from 'payload'
 import type { CollectionSlugs } from '../utils/slugs'
 import { requireAdmin, handleAuthError } from '../utils/auth'
+import { dbFind } from '../utils/db'
 
 const PAGE_SIZE = 500
 const MAX_PAGES = 50
@@ -75,13 +76,26 @@ export function createBillingEndpoint(slugs: CollectionSlugs): Endpoint {
         let ticketHasMore = true
 
         while (ticketHasMore && ticketPage <= MAX_PAGES) {
-          const batch = await payload.find({
-            collection: slugs.tickets as any,
+          const batch = await dbFind(payload, slugs.tickets, {
             where: ticketWhere,
             limit: PAGE_SIZE,
             page: ticketPage,
+            // depth 2 is required: we read ticket.project.client.company below.
             depth: 2,
             overrideAccess: true,
+            // Bound the payload to only the fields the report consumes (skips body,
+            // richText, SLA fields, etc.) while keeping project/client populated.
+            select: {
+              ticketNumber: true,
+              subject: true,
+              status: true,
+              billedAmount: true,
+              aiSummary: true,
+              aiSummaryGeneratedAt: true,
+              aiSummaryStatus: true,
+              project: true,
+              client: true,
+            },
           })
           allTickets.push(...batch.docs as any[])
           ticketHasMore = batch.hasNextPage ?? false
@@ -94,8 +108,7 @@ export function createBillingEndpoint(slugs: CollectionSlugs): Endpoint {
         let entryHasMore = true
 
         while (entryHasMore && entryPage <= MAX_PAGES) {
-          const batch = await payload.find({
-            collection: slugs.timeEntries as any,
+          const batch = await dbFind(payload, slugs.timeEntries, {
             where: {
               and: [
                 { date: { greater_than_equal: from } },

package/src/endpoints/bulk-action.ts

@@ -1,6 +1,7 @@
 import type { Endpoint } from 'payload'
 import type { CollectionSlugs } from '../utils/slugs'
 import { requireAdmin, handleAuthError } from '../utils/auth'
+import { dbUpdate, dbDelete } from '../utils/db'
 
 /**
  * POST /api/support/bulk-action
@@ -32,16 +33,14 @@ export function createBulkActionEndpoint(slugs: CollectionSlugs): Endpoint {
           try {
             switch (action) {
               case 'close':
-                await payload.update({
-                  collection: slugs.tickets as any,
+                await dbUpdate(payload, slugs.tickets, {
                   id: ticketId,
                   data: { status: 'resolved', resolvedAt: new Date().toISOString() },
                   overrideAccess: true,
                 })
                 break
               case 'reopen':
-                await payload.update({
-                  collection: slugs.tickets as any,
+                await dbUpdate(payload, slugs.tickets, {
                   id: ticketId,
                   data: { status: 'open' },
                   overrideAccess: true,
@@ -49,8 +48,7 @@ export function createBulkActionEndpoint(slugs: CollectionSlugs): Endpoint {
                 break
               case 'assign':
                 if (value) {
-                  await payload.update({
-                    collection: slugs.tickets as any,
+                  await dbUpdate(payload, slugs.tickets, {
                     id: ticketId,
                     data: { assignedTo: Number(value) },
                     overrideAccess: true,
@@ -59,8 +57,7 @@ export function createBulkActionEndpoint(slugs: CollectionSlugs): Endpoint {
                 break
               case 'set_priority':
                 if (value) {
-                  await payload.update({
-                    collection: slugs.tickets as any,
+                  await dbUpdate(payload, slugs.tickets, {
                     id: ticketId,
                     data: { priority: String(value) },
                     overrideAccess: true,
@@ -69,8 +66,7 @@ export function createBulkActionEndpoint(slugs: CollectionSlugs): Endpoint {
                 break
               case 'set_category':
                 if (value) {
-                  await payload.update({
-                    collection: slugs.tickets as any,
+                  await dbUpdate(payload, slugs.tickets, {
                     id: ticketId,
                     data: { category: String(value) },
                     overrideAccess: true,
@@ -78,8 +74,7 @@ export function createBulkActionEndpoint(slugs: CollectionSlugs): Endpoint {
                 }
                 break
               case 'delete':
-                await payload.delete({
-                  collection: slugs.tickets as any,
+                await dbDelete(payload, slugs.tickets, {
                   id: ticketId,
                   overrideAccess: true,
                 })

package/src/endpoints/channels.ts

@@ -0,0 +1,89 @@
+import type { Endpoint } from 'payload'
+import type { CollectionSlugs } from '../utils/slugs'
+import { dbFind, dbCreate } from '../utils/db'
+import { randomBytes } from 'crypto'
+
+const PROVIDERS = ['whatsapp', 'messenger'] as const
+type Provider = (typeof PROVIDERS)[number]
+
+/**
+ * POST /api/support/channels/webhook
+ *
+ * Inbound social-channel webhook (WhatsApp / Messenger). Accepts a NORMALIZED
+ * payload `{ provider, from, name?, text }` — a thin adapter maps the provider's
+ * raw webhook (Meta X-Hub-Signature-256 etc.) to this shape at the edge. Creates
+ * or appends the client's open ticket for that channel.
+ *
+ * Protected by the `x-channel-secret` header (`CHANNELS_WEBHOOK_SECRET`).
+ */
+export function createChannelsWebhookEndpoint(slugs: CollectionSlugs): Endpoint {
+  return {
+    path: '/support/channels/webhook',
+    method: 'post',
+    handler: async (req) => {
+      const secret = req.headers.get('x-channel-secret')
+      if (!process.env.CHANNELS_WEBHOOK_SECRET || secret !== process.env.CHANNELS_WEBHOOK_SECRET) {
+        return Response.json({ error: 'Non autorisé' }, { status: 401 })
+      }
+
+      let body: { provider?: string; from?: string; name?: string; text?: string }
+      try {
+        body = (await req.json!()) as typeof body
+      } catch {
+        return Response.json({ error: 'Invalid JSON body' }, { status: 400 })
+      }
+
+      const provider = body.provider as Provider
+      const from = (body.from || '').trim()
+      const text = (body.text || '').trim()
+      if (!PROVIDERS.includes(provider) || !from || !text) {
+        return Response.json({ error: 'provider, from et text requis.' }, { status: 400 })
+      }
+
+      try {
+        const payload = req.payload
+        // Resolve (or create) the channel client by a synthetic, stable identity.
+        const email = `${from}@${provider}.channel`
+        const existing = await dbFind(payload, slugs.supportClients, { where: { email: { equals: email } }, limit: 1, depth: 0, overrideAccess: true })
+        let clientId: number | string
+        if (existing.docs.length > 0) {
+          clientId = (existing.docs[0] as { id: number | string }).id
+        } else {
+          const created = await dbCreate(payload, slugs.supportClients, {
+            data: { email, firstName: body.name || provider, lastName: from.slice(0, 40), company: provider, password: randomBytes(16).toString('hex') },
+            overrideAccess: true,
+          })
+          clientId = (created as { id: number | string }).id
+        }
+
+        // Find an open ticket for this client + channel, else open a new one.
+        const open = await dbFind(payload, slugs.tickets, {
+          where: { and: [{ client: { equals: clientId } }, { source: { equals: provider } }, { status: { in: ['open', 'waiting_client'] } }] },
+          sort: '-createdAt', limit: 1, depth: 0, overrideAccess: true,
+        })
+        let ticketId: number | string
+        let createdTicket = false
+        if (open.docs.length > 0) {
+          ticketId = (open.docs[0] as { id: number | string }).id
+        } else {
+          const t = await dbCreate(payload, slugs.tickets, {
+            data: { subject: text.slice(0, 80), client: clientId, status: 'open', priority: 'normal', source: provider },
+            overrideAccess: true,
+          })
+          ticketId = (t as { id: number | string }).id
+          createdTicket = true
+        }
+
+        const msg = await dbCreate(payload, slugs.ticketMessages, {
+          data: { ticket: ticketId, body: text, authorType: 'client', authorClient: clientId },
+          overrideAccess: true,
+        })
+
+        return Response.json({ ok: true, ticketId, createdTicket, messageId: (msg as { id: number | string }).id })
+      } catch (err) {
+        console.error('[channels] Error:', err)
+        return Response.json({ error: 'Erreur interne' }, { status: 500 })
+      }
+    },
+  }
+}