@consilioweb/payload-support 0.16.0 → 1.1.0

package/src/utils/aiAgent.ts

@@ -0,0 +1,147 @@
+import type { Payload } from 'payload'
+import type { CollectionSlugs } from './slugs'
+import { readSupportSettings, type SupportSettings } from './readSettings'
+import { dbFind, dbFindByID, dbCreate, dbUpdate } from './db'
+
+export interface AgentDecision {
+  action: 'reply' | 'escalate'
+  reply?: string
+  reason?: string
+  confidence?: number
+}
+
+export interface AgentResult {
+  acted: 'reply' | 'escalate'
+  messageId?: number | string
+  confidence?: number
+}
+
+/**
+ * Execute an AI agent decision on a ticket. DETERMINISTIC (no LLM) — this is the
+ * tested core: a `reply` posts a public answer (attributed to the AI assistant),
+ * an `escalate` records an internal note with the reasoning and flags the ticket.
+ */
+export async function applyAgentDecision(
+  payload: Payload,
+  slugs: CollectionSlugs,
+  ticketId: number | string,
+  decision: AgentDecision,
+): Promise<AgentResult> {
+  if (decision.action === 'reply' && decision.reply && decision.reply.trim()) {
+    const msg = await dbCreate(payload, slugs.ticketMessages, {
+      data: {
+        ticket: ticketId,
+        body: decision.reply.trim(),
+        authorType: 'admin',
+        isInternal: false,
+        fromAlias: 'Assistant IA',
+      },
+      overrideAccess: true,
+    })
+    return { acted: 'reply', messageId: (msg as { id: number | string }).id, confidence: decision.confidence }
+  }
+
+  // Escalate: leave an internal note + flag the ticket for a human.
+  await dbCreate(payload, slugs.ticketMessages, {
+    data: {
+      ticket: ticketId,
+      body: `[Agent IA] Escalade vers un humain. Raison : ${decision.reason || 'non déterminée'} (confiance ${Math.round((decision.confidence ?? 0) * 100)} %).`,
+      authorType: 'admin',
+      isInternal: true,
+      skipNotification: true,
+    },
+    overrideAccess: true,
+  })
+  await dbUpdate(payload, slugs.tickets, { id: ticketId, data: { status: 'escalated' }, overrideAccess: true })
+  return { acted: 'escalate', confidence: decision.confidence }
+}
+
+// ─── LLM decision (runtime only — not unit-tested) ───────────────────
+
+function getClient(aiSettings: SupportSettings['ai']) {
+  const Anthropic = require('@anthropic-ai/sdk').default
+  if (aiSettings.provider === 'ollama') {
+    return new Anthropic({ apiKey: 'ollama', baseURL: process.env.OLLAMA_API_URL || 'https://ollama.orkelis.app/v1' })
+  }
+  return new Anthropic({ apiKey: process.env.ANTHROPIC_API_KEY })
+}
+
+function stripHtml(s: string): string {
+  return (s || '').replace(/<[^>]+>/g, ' ').replace(/\s+/g, ' ').trim()
+}
+
+function parseDecision(text: string): AgentDecision {
+  try {
+    const match = text.match(/\{[\s\S]*\}/)
+    if (match) {
+      const obj = JSON.parse(match[0])
+      return {
+        action: obj.action === 'reply' ? 'reply' : 'escalate',
+        reply: typeof obj.reply === 'string' ? obj.reply : undefined,
+        reason: typeof obj.reason === 'string' ? obj.reason : undefined,
+        confidence: typeof obj.confidence === 'number' ? obj.confidence : 0,
+      }
+    }
+  } catch { /* fall through */ }
+  return { action: 'escalate', reason: 'Réponse IA non interprétable', confidence: 0 }
+}
+
+/**
+ * Run the autonomous AI agent on a ticket: builds context (ticket + thread + KB),
+ * asks the LLM for a structured decision, applies a confidence threshold, then
+ * executes it via {@link applyAgentDecision}. Requires an AI provider at runtime.
+ */
+export async function runAiAgent(
+  payload: Payload,
+  slugs: CollectionSlugs,
+  ticketId: number | string,
+  opts?: { confidenceThreshold?: number },
+): Promise<AgentResult> {
+  const settings = await readSupportSettings(payload)
+  const threshold = opts?.confidenceThreshold ?? 0.7
+
+  const ticket = await dbFindByID(payload, slugs.tickets, { id: ticketId, depth: 0, overrideAccess: true })
+  const messages = await dbFind(payload, slugs.ticketMessages, { where: { ticket: { equals: ticketId } }, sort: 'createdAt', limit: 50, depth: 0, overrideAccess: true })
+  const kb = await dbFind(payload, slugs.knowledgeBase, { where: { published: { equals: true } }, limit: 20, depth: 0, overrideAccess: true })
+
+  const conversation = messages.docs.map((m) => `${(m as { authorType?: string }).authorType}: ${(m as { body?: string }).body || ''}`).join('\n')
+  const kbText = kb.docs
+    .map((a) => `# ${(a as { title?: string }).title || ''}\n${stripHtml(String((a as { content?: unknown }).content ?? ''))}`)
+    .join('\n\n')
+    .slice(0, 8000)
+
+  const prompt = `Tu es un agent de support IA. À partir du ticket et de la base de connaissances ci-dessous, décide :
+- "reply" si tu peux répondre avec certitude UNIQUEMENT à partir de la base de connaissances ;
+- "escalate" sinon (question hors KB, ambiguë, sensible, ou nécessitant une action humaine).
+Réponds en JSON STRICT, sans texte autour : {"action":"reply"|"escalate","reply":"<réponse au client si reply>","reason":"<courte raison>","confidence":<0 à 1>}.
+
+TICKET : ${(ticket as { subject?: string }).subject || ''}
+CONVERSATION :
+${conversation}
+
+BASE DE CONNAISSANCES :
+${kbText || '(vide)'}`
+
+  let decision: AgentDecision
+  try {
+    const client = getClient(settings.ai)
+    const resp = await client.messages.create({
+      model: settings.ai.model || 'claude-haiku-4-5-20251001',
+      max_tokens: 1024,
+      messages: [{ role: 'user', content: prompt }],
+    })
+    const text = resp?.content?.[0]?.text || ''
+    decision = parseDecision(text)
+  } catch (err) {
+    console.error('[support] AI agent decision failed:', err)
+    decision = { action: 'escalate', reason: 'Erreur du fournisseur IA', confidence: 0 }
+  }
+
+  // Confidence gate: only auto-reply when the model is confident enough.
+  const finalDecision: AgentDecision =
+    decision.action === 'reply' && (decision.confidence ?? 0) >= threshold
+      ? decision
+      : { action: 'escalate', reason: decision.reason || 'Confiance insuffisante pour une réponse automatique', confidence: decision.confidence }
+
+  return applyAgentDecision(payload, slugs, ticketId, finalDecision)
+}

package/src/utils/auth.ts

@@ -1,3 +1,4 @@
+import type { PayloadRequest } from 'payload'
 import type { CollectionSlugs } from './slugs'
 
 /**
@@ -19,9 +20,9 @@ export class AuthError extends Error {
  * Throws AuthError(401) if unauthenticated, AuthError(403) if not an admin.
  * Uses TypeScript assertion signature so `req.user` is narrowed to non-null after call.
  */
-export function requireAdmin(req: { user?: any }, slugs: CollectionSlugs): asserts req is { user: NonNullable<typeof req.user> } {
+export function requireAdmin(req: PayloadRequest, slugs: CollectionSlugs): asserts req is PayloadRequest & { user: NonNullable<PayloadRequest['user']> } {
   if (!req.user) throw new AuthError('Authentication required', 401)
-  if (req.user.collection !== slugs.users) throw new AuthError('Admin access required', 403)
+  if ((req.user as any).collection !== slugs.users) throw new AuthError('Admin access required', 403)
 }
 
 /**
@@ -29,9 +30,9 @@ export function requireAdmin(req: { user?: any }, slugs: CollectionSlugs): asser
  * Throws AuthError(401) if unauthenticated, AuthError(403) if not a client.
  * Uses TypeScript assertion signature so `req.user` is narrowed to non-null after call.
  */
-export function requireClient(req: { user?: any }, slugs: CollectionSlugs): asserts req is { user: NonNullable<typeof req.user> } {
+export function requireClient(req: PayloadRequest, slugs: CollectionSlugs): asserts req is PayloadRequest & { user: NonNullable<PayloadRequest['user']> } {
   if (!req.user) throw new AuthError('Authentication required', 401)
-  if (req.user.collection !== slugs.supportClients) throw new AuthError('Client access required', 403)
+  if ((req.user as any).collection !== slugs.supportClients) throw new AuthError('Client access required', 403)
 }
 
 /**

package/src/utils/channels.ts

@@ -0,0 +1,36 @@
+export type ChannelProvider = 'whatsapp' | 'messenger'
+
+/**
+ * Send an outbound reply to a social channel (WhatsApp / Messenger) via the Meta
+ * Graph API. RUNTIME-only: requires provider credentials in the environment.
+ * Returns `{ ok: false }` (and logs) when credentials are missing or the call fails.
+ */
+export async function sendChannelReply(provider: ChannelProvider, to: string, text: string): Promise<{ ok: boolean }> {
+  try {
+    if (provider === 'whatsapp') {
+      const token = process.env.WHATSAPP_TOKEN
+      const phoneId = process.env.WHATSAPP_PHONE_ID
+      if (!token || !phoneId) return { ok: false }
+      const res = await fetch(`https://graph.facebook.com/v21.0/${phoneId}/messages`, {
+        method: 'POST',
+        headers: { Authorization: `Bearer ${token}`, 'Content-Type': 'application/json' },
+        body: JSON.stringify({ messaging_product: 'whatsapp', to, type: 'text', text: { body: text } }),
+      })
+      return { ok: res.ok }
+    }
+    if (provider === 'messenger') {
+      const token = process.env.MESSENGER_PAGE_TOKEN
+      if (!token) return { ok: false }
+      const res = await fetch(`https://graph.facebook.com/v21.0/me/messages?access_token=${encodeURIComponent(token)}`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ recipient: { id: to }, message: { text } }),
+      })
+      return { ok: res.ok }
+    }
+    return { ok: false }
+  } catch (err) {
+    console.error('[support] Channel send failed:', err)
+    return { ok: false }
+  }
+}

package/src/utils/db.ts

@@ -0,0 +1,73 @@
+import type { Payload } from 'payload'
+
+/**
+ * Thin typed wrappers around Payload data operations.
+ *
+ * Collection slugs are user-overridable config (`string`), not Payload's literal
+ * `CollectionSlug` union — so every call site otherwise needs `collection: X as any`.
+ * These helpers isolate that single unavoidable cast in ONE place, removing the
+ * ~200 scattered `as any` while staying an EXACT behavioral pass-through of options.
+ *
+ * Returns default to `any` (callers consume docs loosely, as before). Pass a type
+ * argument to opt into stronger typing: `dbFind<TicketData>(payload, slug, { ... })`.
+ */
+
+interface PaginatedResult<T> {
+  docs: T[]
+  totalDocs: number
+  totalPages: number
+  page?: number
+  limit: number
+  hasNextPage: boolean
+  hasPrevPage: boolean
+  nextPage?: number | null
+  prevPage?: number | null
+}
+
+export function dbFind<T = any>(
+  payload: Payload,
+  slug: string,
+  options: Record<string, unknown> = {},
+): Promise<PaginatedResult<T>> {
+  return payload.find({ collection: slug as any, ...options }) as any
+}
+
+export function dbFindByID<T = any>(
+  payload: Payload,
+  slug: string,
+  options: { id: number | string } & Record<string, unknown>,
+): Promise<T> {
+  return payload.findByID({ collection: slug as any, ...options }) as any
+}
+
+export function dbCreate<T = any>(
+  payload: Payload,
+  slug: string,
+  options: Record<string, unknown>,
+): Promise<T> {
+  return (payload.create as any)({ collection: slug, ...options })
+}
+
+export function dbUpdate<T = any>(
+  payload: Payload,
+  slug: string,
+  options: Record<string, unknown>,
+): Promise<T> {
+  return (payload.update as any)({ collection: slug, ...options })
+}
+
+export function dbCount(
+  payload: Payload,
+  slug: string,
+  options: Record<string, unknown> = {},
+): Promise<{ totalDocs: number }> {
+  return payload.count({ collection: slug as any, ...options }) as any
+}
+
+export function dbDelete<T = any>(
+  payload: Payload,
+  slug: string,
+  options: Record<string, unknown>,
+): Promise<T> {
+  return (payload.delete as any)({ collection: slug, ...options })
+}

package/src/utils/emailTemplate.ts

@@ -16,6 +16,8 @@
  * emailInfoRow, escapeHtml, createEmailTemplateFactory must not change.
  */
 
+import { generateTrackingToken } from '../endpoints/track-open'
+
 // ─── Design tokens ───────────────────────────────────────────────────
 
 const COLORS = {
@@ -86,7 +88,12 @@ export function escapeHtml(str: string): string {
  */
 export function emailTrackingPixel(ticketId: number | string, messageId?: number | string, baseUrl?: string): string {
   const url = baseUrl || process.env.NEXT_PUBLIC_SERVER_URL || ''
-  const params = `t=${ticketId}${messageId ? `&m=${messageId}` : ''}`
+  const secret = process.env.PAYLOAD_SECRET || ''
+  // Open-tracking requires a signed URL (HMAC). Without a secret or a messageId we
+  // cannot sign, so we emit NO pixel rather than an unsigned (abusable) one.
+  if (!secret || messageId === undefined || messageId === null) return ''
+  const sig = generateTrackingToken(String(ticketId), String(messageId), secret)
+  const params = `t=${ticketId}&m=${messageId}&sig=${sig}`
   return `<img src="${url}/api/support/track-open?${params}" width="1" height="1" alt="" style="display:block;width:1px;height:1px;border:0;" />`
 }
 

package/src/utils/fireWebhooks.ts

@@ -1,5 +1,6 @@
 import type { Payload } from 'payload'
 import type { CollectionSlugs } from './slugs'
+import { dbFind, dbUpdate } from './db'
 
 /**
  * Fire all active webhooks matching the given event.
@@ -14,8 +15,7 @@ export async function fireWebhooks(
 ): Promise<void> {
   try {
     // Find all active webhook endpoints subscribed to this event
-    const endpoints = await payload.find({
-      collection: slugs.webhookEndpoints as any,
+    const endpoints = await dbFind(payload, slugs.webhookEndpoints, {
       where: {
         active: { equals: true },
         events: { contains: event },
@@ -45,8 +45,7 @@ export async function fireWebhooks(
 
           // Update webhook metadata (best-effort, don't throw on failure)
           try {
-            await payload.update({
-              collection: slugs.webhookEndpoints as any,
+            await dbUpdate(payload, slugs.webhookEndpoints, {
               id: endpoint.id,
               data: {
                 lastTriggeredAt: timestamp,
@@ -62,8 +61,7 @@ export async function fireWebhooks(
 
           // Record the failure
           try {
-            await payload.update({
-              collection: slugs.webhookEndpoints as any,
+            await dbUpdate(payload, slugs.webhookEndpoints, {
               id: endpoint.id,
               data: {
                 lastTriggeredAt: timestamp,

package/src/utils/generateTicketSynthesis.ts

@@ -1,6 +1,7 @@
 import type { Payload } from 'payload'
 import type { CollectionSlugs } from './slugs'
 import { readSupportSettings, type SupportSettings } from './readSettings'
+import { dbFindByID, dbUpdate, dbFind } from './db'
 
 function getClient(aiSettings: SupportSettings['ai']) {
   // eslint-disable-next-line @typescript-eslint/no-require-imports
@@ -53,8 +54,7 @@ export async function generateTicketSynthesis(args: {
     return { summary: '', generatedAt: new Date().toISOString(), status: 'skipped', reason: 'synthesis disabled' }
   }
 
-  const ticket = await payload.findByID({
-    collection: slugs.tickets as any,
+  const ticket = await dbFindByID(payload, slugs.tickets, {
     id: ticketId,
     depth: 1,
     overrideAccess: true,
@@ -65,16 +65,14 @@ export async function generateTicketSynthesis(args: {
   }
 
   // Mark as pending so the UI can show a spinner
-  await payload.update({
-    collection: slugs.tickets as any,
+  await dbUpdate(payload, slugs.tickets, {
     id: ticketId,
     data: { aiSummaryStatus: 'pending' },
     overrideAccess: true,
   }).catch(() => { /* non-blocking */ })
 
   // Load all ticket messages, ordered chronologically
-  const messagesResult = await payload.find({
-    collection: slugs.ticketMessages as any,
+  const messagesResult = await dbFind(payload, slugs.ticketMessages, {
     where: { ticket: { equals: ticketId } },
     sort: 'createdAt',
     limit: 500,
@@ -86,8 +84,7 @@ export async function generateTicketSynthesis(args: {
 
   if (messages.length === 0) {
     const generatedAt = new Date().toISOString()
-    await payload.update({
-      collection: slugs.tickets as any,
+    await dbUpdate(payload, slugs.tickets, {
       id: ticketId,
       data: {
         aiSummary: '(Aucun message dans ce ticket)',
@@ -153,8 +150,7 @@ Reponds UNIQUEMENT avec la liste de puces, rien d'autre.`
     const summary = res.content[0]?.type === 'text' ? res.content[0].text.trim() : ''
     const generatedAt = new Date().toISOString()
 
-    await payload.update({
-      collection: slugs.tickets as any,
+    await dbUpdate(payload, slugs.tickets, {
       id: ticketId,
       data: {
         aiSummary: summary,
@@ -167,8 +163,7 @@ Reponds UNIQUEMENT avec la liste de puces, rien d'autre.`
     return { summary, generatedAt, status: 'done' }
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err)
-    await payload.update({
-      collection: slugs.tickets as any,
+    await dbUpdate(payload, slugs.tickets, {
       id: ticketId,
       data: { aiSummaryStatus: 'error' },
       overrideAccess: true,

package/src/utils/invoicePdf.ts

@@ -0,0 +1,88 @@
+import PDFDocument from 'pdfkit'
+
+export interface InvoiceLine {
+  ticketNumber: string
+  subject: string
+  client: string
+  minutes: number
+  amount: number
+}
+
+export interface InvoiceData {
+  from: string
+  to: string
+  projectId?: string | null
+  lines: InvoiceLine[]
+  totalMinutes: number
+  totalAmount: number
+}
+
+const fmtAmount = (n: number) => `${n.toFixed(2)} EUR`
+const fmtTime = (min: number) => `${Math.floor(min / 60)}h${String(min % 60).padStart(2, '0')}`
+
+/**
+ * Render a real (binary) PDF invoice from billing data, using pdfkit. Returns the
+ * complete PDF as a Buffer (suitable for an HTTP `application/pdf` response).
+ */
+export function generateInvoicePdf(data: InvoiceData): Promise<Buffer> {
+  return new Promise((resolve, reject) => {
+    try {
+      const doc = new PDFDocument({ size: 'A4', margin: 50 })
+      const chunks: Buffer[] = []
+      doc.on('data', (c: Buffer) => chunks.push(c))
+      doc.on('end', () => resolve(Buffer.concat(chunks)))
+      doc.on('error', reject)
+
+      // Header
+      doc.fillColor('#0f172a').fontSize(22).text('Invoice / Pre-billing')
+      doc.moveDown(0.2)
+      doc.fillColor('#64748b').fontSize(10)
+        .text(`Period: ${data.from} -> ${data.to}${data.projectId ? `   ·   Project #${data.projectId}` : ''}`)
+      doc.moveDown(1)
+
+      // Column layout (x positions)
+      const X = { ticket: 50, subject: 130, client: 320, time: 430, amount: 500 }
+      const drawRow = (r: { ticket: string; subject: string; client: string; time: string; amount: string }, opts?: { header?: boolean; total?: boolean }) => {
+        const y = doc.y
+        doc.fontSize(opts?.header ? 9 : 10).fillColor(opts?.header ? '#475569' : '#0f172a')
+        if (opts?.total) doc.font('Helvetica-Bold')
+        doc.text(r.ticket, X.ticket, y, { width: X.subject - X.ticket - 6 })
+        doc.text(r.subject, X.subject, y, { width: X.client - X.subject - 6 })
+        doc.text(r.client, X.client, y, { width: X.time - X.client - 6 })
+        doc.text(r.time, X.time, y, { width: X.amount - X.time - 6, align: 'right' })
+        doc.text(r.amount, X.amount, y, { width: 545 - X.amount, align: 'right' })
+        doc.font('Helvetica')
+        doc.moveDown(0.4)
+      }
+
+      drawRow({ ticket: 'Ticket', subject: 'Subject', client: 'Client', time: 'Time', amount: 'Amount' }, { header: true })
+      doc.moveTo(50, doc.y).lineTo(545, doc.y).strokeColor('#e2e8f0').stroke()
+      doc.moveDown(0.3)
+
+      for (const l of data.lines) {
+        if (doc.y > 760) doc.addPage()
+        drawRow({
+          ticket: l.ticketNumber || '',
+          subject: l.subject || '',
+          client: l.client || '',
+          time: fmtTime(l.minutes),
+          amount: fmtAmount(l.amount),
+        })
+      }
+
+      doc.moveTo(50, doc.y).lineTo(545, doc.y).strokeColor('#0f172a').stroke()
+      doc.moveDown(0.3)
+      drawRow({
+        ticket: '',
+        subject: `Total (${data.lines.length} ticket${data.lines.length > 1 ? 's' : ''})`,
+        client: '',
+        time: fmtTime(data.totalMinutes),
+        amount: fmtAmount(data.totalAmount),
+      }, { total: true })
+
+      doc.end()
+    } catch (err) {
+      reject(err as Error)
+    }
+  })
+}

package/src/utils/notificationQueue.ts

@@ -0,0 +1,36 @@
+import type { Payload } from 'payload'
+import type { CollectionSlugs } from './slugs'
+import { dbCreate } from './db'
+
+export interface QueuedNotification {
+  client: number | string
+  type: string
+  title: string
+  message: string
+  ticket?: number | string
+}
+
+/**
+ * Queue a client notification for later digest delivery (best-effort). Used when
+ * the client opted into `daily`/`weekly` notification frequency instead of immediate.
+ */
+export async function queueClientNotification(
+  payload: Payload,
+  slugs: CollectionSlugs,
+  item: QueuedNotification,
+): Promise<void> {
+  try {
+    await dbCreate(payload, slugs.notificationQueue, {
+      data: {
+        client: item.client,
+        type: item.type,
+        title: item.title,
+        message: item.message,
+        ...(item.ticket ? { ticket: item.ticket } : {}),
+      },
+      overrideAccess: true,
+    })
+  } catch (err) {
+    console.error('[support] Failed to queue client notification:', err)
+  }
+}

package/src/utils/push.ts

@@ -0,0 +1,63 @@
+import type { Payload } from 'payload'
+import type { CollectionSlugs } from './slugs'
+import { dbFind, dbDelete } from './db'
+import webpush from 'web-push'
+
+let configured = false
+function ensureVapid(): boolean {
+  if (configured) return true
+  const publicKey = process.env.VAPID_PUBLIC_KEY
+  const privateKey = process.env.VAPID_PRIVATE_KEY
+  if (!publicKey || !privateKey) return false
+  webpush.setVapidDetails(process.env.VAPID_SUBJECT || 'mailto:support@example.com', publicKey, privateKey)
+  configured = true
+  return true
+}
+
+/** Public VAPID key for the browser to subscribe (null if push isn't configured). */
+export function getVapidPublicKey(): string | null {
+  return process.env.VAPID_PUBLIC_KEY || null
+}
+
+export interface PushNotification {
+  title: string
+  body: string
+  url?: string
+}
+
+/**
+ * Send a Web Push notification to all of an agent's subscriptions. RUNTIME-only:
+ * requires VAPID keys; without them it no-ops (`{ sent: 0 }`). Stale subscriptions
+ * (404/410) are pruned automatically.
+ */
+export async function sendPushToUser(
+  payload: Payload,
+  slugs: CollectionSlugs,
+  userId: number | string,
+  notification: PushNotification,
+): Promise<{ sent: number }> {
+  if (!ensureVapid()) return { sent: 0 }
+  let sent = 0
+  try {
+    const subs = await dbFind(payload, slugs.pushSubscriptions, { where: { user: { equals: userId } }, limit: 100, depth: 0, overrideAccess: true })
+    for (const s of subs.docs) {
+      const row = s as { id: number | string; endpoint?: string; p256dh?: string; auth?: string }
+      if (!row.endpoint || !row.p256dh || !row.auth) continue
+      try {
+        await webpush.sendNotification(
+          { endpoint: row.endpoint, keys: { p256dh: row.p256dh, auth: row.auth } },
+          JSON.stringify(notification),
+        )
+        sent++
+      } catch (err) {
+        const code = (err as { statusCode?: number })?.statusCode
+        if (code === 404 || code === 410) {
+          try { await dbDelete(payload, slugs.pushSubscriptions, { id: row.id, overrideAccess: true }) } catch { /* ignore */ }
+        }
+      }
+    }
+  } catch (err) {
+    console.error('[support] Push send failed:', err)
+  }
+  return { sent }
+}

package/src/utils/readSettings.ts

@@ -1,4 +1,5 @@
 import type { Payload } from 'payload'
+import { dbFind } from './db'
 
 const PREF_KEY = 'support-settings'
 const USER_PREFS_KEY_PREFIX = 'support-user-prefs'
@@ -27,16 +28,31 @@ export const DEFAULT_USER_PREFS: UserPrefs = {
   signature: '',
 }
 
+// In-process cache: readSupportSettings is hit many times per ticket mutation
+// (the afterChange hook chain). The settings doc changes rarely, so a short TTL
+// + explicit invalidation on save (endpoints/settings.ts) avoids redundant DB
+// reads of the same `payload-preferences` row.
+let settingsCache: { value: SupportSettings; ts: number } | null = null
+const SETTINGS_TTL_MS = 60_000
+
+/** Invalidate the settings cache — call right after writing support settings. */
+export function invalidateSupportSettingsCache(): void {
+  settingsCache = null
+}
+
 export async function readSupportSettings(payload: Payload): Promise<SupportSettings> {
+  if (settingsCache && Date.now() - settingsCache.ts < SETTINGS_TTL_MS) {
+    return settingsCache.value
+  }
+  let value: SupportSettings = { ...DEFAULT_SETTINGS }
   try {
-    const prefs = await payload.find({
-      collection: 'payload-preferences' as any,
+    const prefs = await dbFind(payload, 'payload-preferences', {
       where: { key: { equals: PREF_KEY } },
       limit: 1, depth: 0, overrideAccess: true,
     })
     if (prefs.docs.length > 0) {
       const stored = prefs.docs[0].value as Partial<SupportSettings>
-      return {
+      value = {
         email: { ...DEFAULT_SETTINGS.email, ...stored.email },
         ai: { ...DEFAULT_SETTINGS.ai, ...stored.ai },
         sla: { ...DEFAULT_SETTINGS.sla, ...stored.sla },
@@ -44,14 +60,14 @@ export async function readSupportSettings(payload: Payload): Promise<SupportSett
       }
     }
   } catch { /* fallback to defaults */ }
-  return { ...DEFAULT_SETTINGS }
+  settingsCache = { value, ts: Date.now() }
+  return value
 }
 
 export async function readUserPrefs(payload: Payload, userId: string | number): Promise<UserPrefs> {
   try {
     const key = `${USER_PREFS_KEY_PREFIX}-${userId}`
-    const prefs = await payload.find({
-      collection: 'payload-preferences' as any,
+    const prefs = await dbFind(payload, 'payload-preferences', {
       where: { key: { equals: key } },
       limit: 1, depth: 0, overrideAccess: true,
     })