@consilioweb/payload-support 1.1.1 → 2.0.0

package/dist/index.js

@@ -1,6 +1,6 @@
-import crypto3, { createHmac, randomBytes } from 'crypto';
+import { initTransaction, commitTransaction, killTransaction, getFieldsToSign, jwtSign, APIError } from 'payload';
+import crypto3, { createHash, timingSafeEqual, createHmac, randomBytes } from 'crypto';
 import PDFDocument from 'pdfkit';
-import { APIError, getFieldsToSign, jwtSign } from 'payload';
 import webpush from 'web-push';
 import sanitizeHtml from 'sanitize-html';
 
@@ -66,12 +66,263 @@ var DEFAULT_SLUGS = {
   automationRules: "automation-rules",
   supportTeams: "support-teams",
   pushSubscriptions: "push-subscriptions",
+  rateLimits: "support-rate-limits",
+  counters: "support-counters",
   users: "users",
   media: "media"
 };
 function resolveSlugs(overrides) {
   return { ...DEFAULT_SLUGS, ...overrides };
 }
+var MemoryRateLimitStore = class {
+  entries = /* @__PURE__ */ new Map();
+  async increment(key, windowMs) {
+    const now = Date.now();
+    const current = this.entries.get(key);
+    const next = !current || now > current.resetAt ? { count: 1, resetAt: now + windowMs } : { ...current, count: current.count + 1 };
+    this.entries.set(key, next);
+    return next;
+  }
+  async reset(key) {
+    this.entries.delete(key);
+  }
+};
+var PayloadRateLimitStore = class {
+  constructor(collectionSlug = "support-rate-limits") {
+    this.collectionSlug = collectionSlug;
+  }
+  collectionSlug;
+  async increment(key, windowMs, context) {
+    const { payload, req } = this.resolveContext(context);
+    const ownsTransaction = req ? await initTransaction(req) : false;
+    try {
+      const now = Date.now();
+      const result = await payload.find({
+        collection: this.collectionSlug,
+        where: { key: { equals: key } },
+        limit: 1,
+        depth: 0,
+        overrideAccess: true,
+        ...req ? { req } : {}
+      });
+      const current = result.docs[0];
+      const currentResetAt = current?.resetAt ? new Date(String(current.resetAt)).getTime() : 0;
+      const next = !current || now > currentResetAt ? { count: 1, resetAt: now + windowMs } : { count: Number(current.count || 0) + 1, resetAt: currentResetAt };
+      if (current?.id != null) {
+        await payload.update({
+          collection: this.collectionSlug,
+          id: current.id,
+          data: { count: next.count, resetAt: new Date(next.resetAt).toISOString() },
+          overrideAccess: true,
+          ...req ? { req } : {}
+        });
+      } else {
+        await payload.create({
+          collection: this.collectionSlug,
+          data: { key, count: next.count, resetAt: new Date(next.resetAt).toISOString() },
+          overrideAccess: true,
+          ...req ? { req } : {}
+        });
+      }
+      if (ownsTransaction && req) await commitTransaction(req);
+      return next;
+    } catch (error) {
+      if (ownsTransaction && req) await killTransaction(req);
+      throw error;
+    }
+  }
+  async reset(key, context) {
+    const { payload, req } = this.resolveContext(context);
+    const ownsTransaction = req ? await initTransaction(req) : false;
+    try {
+      await payload.delete({
+        collection: this.collectionSlug,
+        where: { key: { equals: key } },
+        overrideAccess: true,
+        ...req ? { req } : {}
+      });
+      if (ownsTransaction && req) await commitTransaction(req);
+    } catch (error) {
+      if (ownsTransaction && req) await killTransaction(req);
+      throw error;
+    }
+  }
+  resolveContext(context) {
+    if (!context || typeof context !== "object") {
+      throw new Error("PayloadRateLimitStore requires the current Payload request or instance");
+    }
+    if ("payload" in context) {
+      const req = context;
+      return { payload: req.payload, req };
+    }
+    return { payload: context };
+  }
+};
+var RateLimiter = class {
+  constructor(windowMs, maxRequests, store) {
+    this.windowMs = windowMs;
+    this.maxRequests = maxRequests;
+    this.store = store ?? new MemoryRateLimitStore();
+  }
+  windowMs;
+  maxRequests;
+  store;
+  async check(key, context) {
+    const entry = context === void 0 ? await this.store.increment(key, this.windowMs) : await this.store.increment(key, this.windowMs, context);
+    return entry.count > this.maxRequests;
+  }
+  async reset(key, context) {
+    if (context === void 0) await this.store.reset(key);
+    else await this.store.reset(key, context);
+  }
+};
+var DEFAULT_INBOUND_EMAIL_LIMITS = {
+  maxRequestBytes: 25 * 1024 * 1024,
+  maxAttachmentBytes: 10 * 1024 * 1024,
+  maxAttachments: 10,
+  maxSubjectLength: 1e3,
+  maxNameLength: 500,
+  maxEmailLength: 320,
+  maxBodyLength: 38e3
+};
+function verifySecret(provided, expected) {
+  if (!provided || !expected) return false;
+  const providedDigest = createHash("sha256").update(provided).digest();
+  const expectedDigest = createHash("sha256").update(expected).digest();
+  return timingSafeEqual(providedDigest, expectedDigest);
+}
+function validateInboundEmailPayload(input, contentLength, limits = DEFAULT_INBOUND_EMAIL_LIMITS) {
+  if (contentLength != null && contentLength > limits.maxRequestBytes) {
+    return { code: "request_too_large", status: 413 };
+  }
+  const attachments = Array.isArray(input.attachments) ? input.attachments : [];
+  if (attachments.length > limits.maxAttachments) {
+    return { code: "too_many_attachments", status: 413 };
+  }
+  for (const attachment of attachments) {
+    const decodedSize = attachment.content ? Math.ceil(attachment.content.length * 0.75) : 0;
+    if (Math.max(Number(attachment.size || 0), decodedSize) > limits.maxAttachmentBytes) {
+      return { code: "attachment_too_large", status: 413 };
+    }
+  }
+  const tooLong = (input.subject?.length || 0) > limits.maxSubjectLength || (input.senderName?.length || 0) > limits.maxNameLength || (input.senderEmail?.length || 0) > limits.maxEmailLength || (input.recipientEmail?.length || 0) > limits.maxEmailLength || (input.cc?.length || 0) > limits.maxEmailLength || (input.body?.length || 0) > limits.maxBodyLength || (input.htmlBody?.length || 0) > limits.maxBodyLength;
+  return tooLong ? { code: "text_field_too_large", status: 413 } : null;
+}
+
+// src/endpoints/capabilities.ts
+function createInboundEmailEndpoint(capability, store) {
+  const limiter = new RateLimiter(6e4, 60, store);
+  return {
+    path: "/support-webhook/inbound-email",
+    method: "post",
+    handler: async (req) => {
+      const secretHeader = capability.secretHeader || "x-webhook-secret";
+      if (!verifySecret(req.headers.get(secretHeader), capability.secret)) {
+        return Response.json({ error: "Unauthorized" }, { status: 401 });
+      }
+      const ip = req.headers.get("x-forwarded-for")?.split(",")[0]?.trim() || req.headers.get("x-real-ip") || "unknown";
+      if (await limiter.check(ip, req)) {
+        return Response.json({ error: "Rate limit exceeded" }, { status: 429 });
+      }
+      const declaredLength = Number(req.headers.get("content-length") || 0) || void 0;
+      let input;
+      try {
+        input = await req.json();
+      } catch {
+        return Response.json({ error: "Invalid JSON body" }, { status: 400 });
+      }
+      const measuredLength = new TextEncoder().encode(JSON.stringify(input)).byteLength;
+      const validation = validateInboundEmailPayload(
+        input,
+        Math.max(declaredLength || 0, measuredLength)
+      );
+      if (validation) return Response.json({ error: validation.code }, { status: validation.status });
+      return capability.handle(req, input);
+    }
+  };
+}
+function createProjectSuggestionsEndpoint(slugs, capability, store) {
+  const limiter = new RateLimiter(6e4, 20, store);
+  return {
+    path: "/support/suggest-projects",
+    method: "post",
+    handler: async (req) => {
+      if (!req.user || req.user.collection !== slugs.users) {
+        return Response.json({ error: "Unauthorized" }, { status: 401 });
+      }
+      const key = req.user?.id ? String(req.user.id) : "anonymous";
+      if (await limiter.check(key, req)) {
+        return Response.json({ error: "Rate limit exceeded" }, { status: 429 });
+      }
+      return capability.suggest(req);
+    }
+  };
+}
+function createTicketTitleEndpoint(slugs, capability, store) {
+  const limiter = new RateLimiter(6e4, 20, store);
+  return {
+    path: "/support/ticket-title",
+    method: "post",
+    handler: async (req) => {
+      if (!req.user || req.user.collection !== slugs.users) {
+        return Response.json({ error: "Unauthorized" }, { status: 401 });
+      }
+      if (await limiter.check(String(req.user.id), req)) {
+        return Response.json({ error: "Rate limit exceeded" }, { status: 429 });
+      }
+      const ticketId = Number(new URL(req.url || "", "http://localhost").searchParams.get("ticketId"));
+      if (!Number.isFinite(ticketId) || ticketId <= 0) {
+        return Response.json({ error: "ticketId required" }, { status: 400 });
+      }
+      const title = await capability.generate(req.payload, ticketId);
+      if (!title) return Response.json({ error: "Generation unavailable" }, { status: 502 });
+      return Response.json({ title, status: "suggested" });
+    }
+  };
+}
+function createGenerateMissingTitlesEndpoint(slugs, capability, store) {
+  const limiter = new RateLimiter(6e4, 5, store);
+  return {
+    path: "/support/generate-missing-titles",
+    method: "post",
+    handler: async (req) => {
+      if (!req.user || req.user.collection !== slugs.users) {
+        return Response.json({ error: "Unauthorized" }, { status: 401 });
+      }
+      if (await limiter.check(String(req.user.id), req)) {
+        return Response.json({ error: "Rate limit exceeded" }, { status: 429 });
+      }
+      const limit = Math.min(
+        Math.max(Number(new URL(req.url || "", "http://localhost").searchParams.get("limit")) || 8, 1),
+        20
+      );
+      const where = {
+        and: [
+          { displayTitle: { exists: false } },
+          { displayTitleStatus: { not_equals: "error" } }
+        ]
+      };
+      const batch = await req.payload.find({
+        collection: slugs.tickets,
+        where,
+        limit,
+        depth: 0,
+        overrideAccess: true,
+        sort: "-createdAt"
+      });
+      let generated = 0;
+      for (const ticket of batch.docs) {
+        if (await capability.generate(req.payload, ticket.id)) generated++;
+      }
+      const remaining = await req.payload.count({
+        collection: slugs.tickets,
+        where,
+        overrideAccess: true
+      });
+      return Response.json({ generated, remaining: remaining.totalDocs });
+    }
+  };
+}
 
 // src/utils/auth.ts
 var AuthError = class extends Error {
@@ -183,8 +434,9 @@ async function readUserPrefs(payload, userId) {
 }
 
 // src/endpoints/ai.ts
-function getClient(aiSettings) {
-  const Anthropic = __require("@anthropic-ai/sdk").default;
+async function getClient(aiSettings) {
+  const moduleName = "@anthropic-ai/sdk";
+  const { default: Anthropic } = await import(moduleName);
   if (aiSettings.provider === "ollama") {
     const baseURL = process.env.OLLAMA_API_URL || "https://ollama.orkelis.app/v1";
     return new Anthropic({ apiKey: "ollama", baseURL });
@@ -194,7 +446,8 @@ function getClient(aiSettings) {
 function getModel(aiSettings) {
   return aiSettings.model || "claude-haiku-4-5-20251001";
 }
-function createAiEndpoint(slugs) {
+function createAiEndpoint(slugs, store) {
+  const limiter = new RateLimiter(6e4, 30, store);
   return {
     path: "/support/ai",
     method: "post",
@@ -202,6 +455,9 @@ function createAiEndpoint(slugs) {
       try {
         const payload = req.payload;
         requireAdmin(req, slugs);
+        if (await limiter.check(String(req.user.id), req)) {
+          return Response.json({ error: "Rate limit exceeded" }, { status: 429 });
+        }
         const settings = await readSupportSettings(payload);
         const aiSettings = settings.ai;
         let body;
@@ -211,7 +467,7 @@ function createAiEndpoint(slugs) {
           return Response.json({ error: "Invalid JSON body" }, { status: 400 });
         }
         const { action } = body;
-        const anthropic = getClient(aiSettings);
+        const anthropic = await getClient(aiSettings);
         const model = getModel(aiSettings);
         if (action === "sentiment") {
           if (!aiSettings.enableSentiment) {
@@ -443,13 +699,17 @@ ${kbText || "(vide)"}`;
 }
 
 // src/endpoints/ai-agent.ts
-function createAiAgentEndpoint(slugs) {
+function createAiAgentEndpoint(slugs, store) {
+  const limiter = new RateLimiter(6e4, 10, store);
   return {
     path: "/support/ai-agent",
     method: "post",
     handler: async (req) => {
       try {
         requireAdmin(req, slugs);
+        if (await limiter.check(String(req.user.id), req)) {
+          return Response.json({ error: "Rate limit exceeded" }, { status: 429 });
+        }
         let body = {};
         try {
           body = await req.json();
@@ -473,8 +733,9 @@ function createAiAgentEndpoint(slugs) {
 }
 
 // src/endpoints/client-intelligence.ts
-function getClient3(aiSettings) {
-  const Anthropic = __require("@anthropic-ai/sdk").default;
+async function getClient3(aiSettings) {
+  const moduleName = "@anthropic-ai/sdk";
+  const { default: Anthropic } = await import(moduleName);
   if (aiSettings.provider === "ollama") {
     const baseURL = process.env.OLLAMA_API_URL || "https://ollama.orkelis.app/v1";
     return new Anthropic({ apiKey: "ollama", baseURL });
@@ -485,10 +746,14 @@ function getModel2(aiSettings) {
   return aiSettings.model || "claude-haiku-4-5-20251001";
 }
 var CACHE_TTL_MS = 24 * 60 * 60 * 1e3;
-function createClientIntelligenceEndpoint(slugs) {
+function createClientIntelligenceEndpoint(slugs, store) {
+  const limiter = new RateLimiter(6e4, 20, store);
   const getHandler = async (req) => {
     try {
       requireAdmin(req, slugs);
+      if (await limiter.check(String(req.user.id), req)) {
+        return Response.json({ error: "Rate limit exceeded" }, { status: 429 });
+      }
       const payload = req.payload;
       const url = new URL(req.url || "", "http://localhost");
       const clientId = url.searchParams.get("clientId");
@@ -518,6 +783,9 @@ function createClientIntelligenceEndpoint(slugs) {
   const postHandler = async (req) => {
     try {
       requireAdmin(req, slugs);
+      if (await limiter.check(String(req.user.id), req)) {
+        return Response.json({ error: "Rate limit exceeded" }, { status: 429 });
+      }
       const payload = req.payload;
       const body = await req.json?.() || {};
       const clientId = body.clientId;
@@ -627,7 +895,7 @@ R\xE9ponds en JSON strict (pas de markdown, pas de commentaires) avec cette stru
 }
 
 Sois factuel. Ne d\xE9passe pas 5 items par tableau. R\xE9ponds UNIQUEMENT avec le JSON.`;
-  const anthropic = getClient3(aiSettings);
+  const anthropic = await getClient3(aiSettings);
   const model = getModel2(aiSettings);
   const res = await anthropic.messages.create({
     model,
@@ -1650,7 +1918,13 @@ var TRANSPARENT_GIF = Buffer.from(
   "base64"
 );
 function generateTrackingToken(ticketId, messageId, secret) {
-  return createHmac("sha256", secret).update(`${ticketId}:${messageId}`).digest("hex").substring(0, 16);
+  return createHmac("sha256", secret).update(`${ticketId}:${messageId}`).digest("hex");
+}
+function verifyTrackingToken(ticketId, messageId, signature, secret) {
+  if (!/^[0-9a-f]{64}$/i.test(signature)) return false;
+  const expected = Buffer.from(generateTrackingToken(ticketId, messageId, secret), "hex");
+  const received = Buffer.from(signature, "hex");
+  return expected.length === received.length && timingSafeEqual(expected, received);
 }
 function createTrackOpenEndpoint(slugs) {
   return {
@@ -1664,7 +1938,7 @@ function createTrackOpenEndpoint(slugs) {
       const parsedId = ticketId ? Number(ticketId) : NaN;
       const parsedMsgId = messageId ? Number(messageId) : NaN;
       const secret = process.env.PAYLOAD_SECRET || "";
-      const validSig = !!secret && !!ticketId && !!messageId && !!sig && sig === generateTrackingToken(ticketId, messageId, secret);
+      const validSig = !!secret && Number.isInteger(parsedId) && parsedId > 0 && Number.isInteger(parsedMsgId) && parsedMsgId > 0 && !!ticketId && !!messageId && !!sig && verifyTrackingToken(ticketId, messageId, sig, secret);
       if (!validSig) {
         return new Response(TRANSPARENT_GIF, {
           status: 200,
@@ -1678,6 +1952,16 @@ function createTrackOpenEndpoint(slugs) {
       if (ticketId && Number.isInteger(parsedId) && parsedId > 0) {
         try {
           const payload = req.payload;
+          const msg = await dbFindByID(payload, slugs.ticketMessages, {
+            id: parsedMsgId,
+            depth: 0,
+            overrideAccess: true,
+            select: { ticket: true, emailOpenedAt: true }
+          });
+          const messageTicketId = typeof msg?.ticket === "object" ? msg.ticket?.id : msg?.ticket;
+          if (!msg || String(messageTicketId) !== String(parsedId)) {
+            return transparentGifResponse();
+          }
           const ticket = await dbFindByID(payload, slugs.tickets, {
             id: parsedId,
             depth: 0,
@@ -1696,12 +1980,6 @@ function createTrackOpenEndpoint(slugs) {
             }
           }
           if (Number.isInteger(parsedMsgId) && parsedMsgId > 0) {
-            const msg = await dbFindByID(payload, slugs.ticketMessages, {
-              id: parsedMsgId,
-              depth: 0,
-              overrideAccess: true,
-              select: { emailOpenedAt: true }
-            });
             if (msg && !msg.emailOpenedAt) {
               await dbUpdate(payload, slugs.ticketMessages, {
                 id: parsedMsgId,
@@ -1733,19 +2011,22 @@ function createTrackOpenEndpoint(slugs) {
           console.error("[track-open] Error:", err);
         }
       }
-      return new Response(TRANSPARENT_GIF, {
-        status: 200,
-        headers: {
-          "Content-Type": "image/gif",
-          "Content-Length": String(TRANSPARENT_GIF.length),
-          "Cache-Control": "no-store, no-cache, must-revalidate, max-age=0",
-          "Pragma": "no-cache",
-          "Expires": "0"
-        }
-      });
+      return transparentGifResponse();
     }
   };
 }
+function transparentGifResponse() {
+  return new Response(TRANSPARENT_GIF, {
+    status: 200,
+    headers: {
+      "Content-Type": "image/gif",
+      "Content-Length": String(TRANSPARENT_GIF.length),
+      "Cache-Control": "no-store, no-cache, must-revalidate, max-age=0",
+      "Pragma": "no-cache",
+      "Expires": "0"
+    }
+  });
+}
 
 // src/utils/emailTemplate.ts
 var COLORS = {
@@ -2032,7 +2313,7 @@ function createAutoCloseEndpoint(slugs) {
     handler: async (req) => {
       const secret = req.headers.get("x-cron-secret");
       const expectedSecret = process.env.CRON_SECRET;
-      if (!expectedSecret || secret !== expectedSecret) {
+      if (!verifySecret(secret, expectedSecret)) {
         return Response.json({ error: "Non autoris\xE9" }, { status: 401 });
       }
       try {
@@ -2178,52 +2459,7 @@ function createAutoCloseEndpoint(slugs) {
   };
 }
 
-// src/utils/rateLimiter.ts
-var RateLimiter = class {
-  constructor(windowMs, maxRequests) {
-    this.windowMs = windowMs;
-    this.maxRequests = maxRequests;
-    const timer = setInterval(() => this.cleanup(), windowMs);
-    timer.unref();
-  }
-  windowMs;
-  maxRequests;
-  store = /* @__PURE__ */ new Map();
-  /**
-   * Check if a key has exceeded the rate limit.
-   * Returns true if the request should be blocked.
-   */
-  check(key) {
-    const now = Date.now();
-    const entry = this.store.get(key);
-    if (!entry || now > entry.resetAt) {
-      this.store.set(key, { count: 1, resetAt: now + this.windowMs });
-      return false;
-    }
-    entry.count++;
-    return entry.count > this.maxRequests;
-  }
-  /**
-   * Reset the counter for a specific key.
-   */
-  reset(key) {
-    this.store.delete(key);
-  }
-  /**
-   * Remove expired entries from the store.
-   */
-  cleanup() {
-    const now = Date.now();
-    for (const [key, entry] of this.store) {
-      if (now > entry.resetAt) {
-        this.store.delete(key);
-      }
-    }
-  }
-};
-
 // src/endpoints/send-reminder.ts
-var reminderLimiter = new RateLimiter(60 * 60 * 1e3, 30);
 var MIN_HOURS = 1;
 var MAX_HOURS = 24 * 30;
 function formatFr(date, withTime) {
@@ -2235,7 +2471,8 @@ function formatFr(date, withTime) {
     timeZone: "Europe/Paris"
   });
 }
-function createSendReminderEndpoint(slugs) {
+function createSendReminderEndpoint(slugs, store) {
+  const reminderLimiter = new RateLimiter(60 * 60 * 1e3, 30, store);
   return {
     path: "/support/send-reminder",
     method: "post",
@@ -2243,7 +2480,7 @@ function createSendReminderEndpoint(slugs) {
       try {
         const payload = req.payload;
         requireAdmin(req, slugs);
-        if (reminderLimiter.check(String(req.user.id))) {
+        if (await reminderLimiter.check(String(req.user.id), req)) {
           return Response.json(
             { error: "Trop de relances. R\xE9essayez dans une heure." },
             { status: 429 }
@@ -2546,15 +2783,15 @@ function createPurgeLogsEndpoint(slugs) {
 }
 
 // src/endpoints/chatbot.ts
-var chatbotLimiter = new RateLimiter(6e4, 10);
-function createChatbotEndpoint(slugs) {
+function createChatbotEndpoint(slugs, store) {
+  const chatbotLimiter = new RateLimiter(6e4, 10, store);
   return {
     path: "/support/chatbot",
     method: "post",
     handler: async (req) => {
       try {
         const ip = req.headers.get("x-forwarded-for")?.split(",")[0]?.trim() || req.headers.get("x-real-ip") || "unknown";
-        if (chatbotLimiter.check(ip)) {
+        if (await chatbotLimiter.check(ip, req)) {
           return Response.json({ error: "Too many requests. Please wait a moment." }, { status: 429 });
         }
         let body;
@@ -2635,8 +2872,6 @@ R\xE9ponds en fran\xE7ais, de mani\xE8re concise et utile. Si tu ne trouves pas
     }
   };
 }
-var chatSessionLimiter = new RateLimiter(36e5, 5);
-var chatMessageLimiter = new RateLimiter(6e4, 15);
 function createChatGetEndpoint(slugs) {
   return {
     path: "/support/chat",
@@ -2680,7 +2915,9 @@ function createChatGetEndpoint(slugs) {
     }
   };
 }
-function createChatPostEndpoint(slugs) {
+function createChatPostEndpoint(slugs, store) {
+  const chatSessionLimiter = new RateLimiter(36e5, 5, store);
+  const chatMessageLimiter = new RateLimiter(6e4, 15, store);
   return {
     path: "/support/chat",
     method: "post",
@@ -2697,7 +2934,7 @@ function createChatPostEndpoint(slugs) {
         const { action, session, message } = body;
         const userId = String(req.user.id);
         if (action === "start") {
-          if (chatSessionLimiter.check(userId)) {
+          if (await chatSessionLimiter.check(userId, req)) {
             return Response.json({ error: "Trop de sessions cr\xE9\xE9es. R\xE9essayez plus tard." }, { status: 429 });
           }
           const sessionId = `chat_${crypto3.randomBytes(16).toString("hex")}`;
@@ -2714,7 +2951,7 @@ function createChatPostEndpoint(slugs) {
           return Response.json({ session: sessionId, messages: [systemMsg] });
         }
         if (action === "send" && session && message) {
-          if (chatMessageLimiter.check(userId)) {
+          if (await chatMessageLimiter.check(userId, req)) {
             return Response.json({ error: "Trop de messages. Attendez un moment." }, { status: 429 });
           }
           const trimmedMessage = String(message).trim();
@@ -2880,7 +3117,6 @@ function createChatStreamEndpoint(slugs) {
 }
 
 // src/endpoints/admin-chat.ts
-var adminChatLimiter = new RateLimiter(6e4, 30);
 function createAdminChatGetEndpoint(slugs) {
   return {
     path: "/support/admin-chat",
@@ -2954,7 +3190,8 @@ function createAdminChatGetEndpoint(slugs) {
     }
   };
 }
-function createAdminChatPostEndpoint(slugs) {
+function createAdminChatPostEndpoint(slugs, store) {
+  const adminChatLimiter = new RateLimiter(6e4, 30, store);
   return {
     path: "/support/admin-chat",
     method: "post",
@@ -2983,7 +3220,7 @@ function createAdminChatPostEndpoint(slugs) {
         }
         const clientId = typeof sessionMsg.docs[0].client === "object" ? sessionMsg.docs[0].client.id : sessionMsg.docs[0].client;
         if (action === "send" && message) {
-          if (adminChatLimiter.check(String(req.user.id))) {
+          if (await adminChatLimiter.check(String(req.user.id), req)) {
             return Response.json({ error: "Rate limit atteint." }, { status: 429 });
           }
           const trimmedMessage = String(message).trim();
@@ -3937,13 +4174,17 @@ Reponds UNIQUEMENT avec la liste de puces, rien d'autre.`;
 }
 
 // src/endpoints/ticket-synthesis.ts
-function createTicketSynthesisEndpoint(slugs) {
+function createTicketSynthesisEndpoint(slugs, generator, store) {
+  const limiter = new RateLimiter(6e4, 20, store);
   return {
     path: "/support/ticket-synthesis",
     method: "post",
     handler: async (req) => {
       try {
         requireAdmin(req, slugs);
+        if (await limiter.check(String(req.user.id), req)) {
+          return Response.json({ error: "Rate limit exceeded" }, { status: 429 });
+        }
         const payload = req.payload;
         const url = new URL(req.url || "", "http://localhost");
         const ticketIdRaw = url.searchParams.get("ticketId");
@@ -3969,7 +4210,10 @@ function createTicketSynthesisEndpoint(slugs) {
             });
           }
         }
-        const result = await generateTicketSynthesis({ payload, slugs, ticketId });
+        const result = generator ? await generator.generate(payload, ticketId) : await generateTicketSynthesis({ payload, slugs, ticketId });
+        if (!result) {
+          return Response.json({ error: "Generation unavailable" }, { status: 502 });
+        }
         return Response.json(result);
       } catch (err) {
         const authResponse = handleAuthError(err);
@@ -4488,8 +4732,8 @@ function createPendingEmailsProcessEndpoint(slugs) {
 }
 
 // src/endpoints/resend-notification.ts
-var resendLimiter = new RateLimiter(60 * 60 * 1e3, 10);
-function createResendNotificationEndpoint(slugs) {
+function createResendNotificationEndpoint(slugs, store) {
+  const resendLimiter = new RateLimiter(60 * 60 * 1e3, 10, store);
   return {
     path: "/support/resend-notification",
     method: "post",
@@ -4497,7 +4741,7 @@ function createResendNotificationEndpoint(slugs) {
       try {
         const payload = req.payload;
         requireAdmin(req, slugs);
-        if (resendLimiter.check(String(req.user.id))) {
+        if (await resendLimiter.check(String(req.user.id), req)) {
           return Response.json(
             { error: "Trop de renvois. R\xE9essayez dans une heure." },
             { status: 429 }
@@ -4700,14 +4944,14 @@ function createSeedKbEndpoint(slugs) {
 }
 
 // src/endpoints/login.ts
-var loginLimiter = new RateLimiter(15 * 6e4, 10);
-function createLoginEndpoint(slugs) {
+function createLoginEndpoint(slugs, store) {
+  const loginLimiter = new RateLimiter(15 * 6e4, 10, store);
   return {
     path: "/support/login",
     method: "post",
     handler: async (req) => {
       const ip = req.headers.get("x-forwarded-for")?.split(",")[0]?.trim() || req.headers.get("x-real-ip") || "unknown";
-      if (loginLimiter.check(ip)) {
+      if (await loginLimiter.check(ip, req)) {
         return Response.json(
           { error: "Trop de tentatives. R\xE9essayez dans quelques minutes." },
           { status: 429 }
@@ -4747,7 +4991,6 @@ function createLoginEndpoint(slugs) {
           JSON.stringify({
             message: "Login successful",
             user: result.user,
-            token: result.token,
             exp: result.exp
           }),
           { status: 200, headers }
@@ -4774,8 +5017,6 @@ function createLoginEndpoint(slugs) {
     }
   };
 }
-var sendLimiter = new RateLimiter(60 * 60 * 1e3, 3);
-var verifyLimiter = new RateLimiter(15 * 60 * 1e3, 5);
 function generateSecureCode() {
   const buf = crypto3.randomBytes(4);
   const num = buf.readUInt32BE(0) % 9e5 + 1e5;
@@ -4788,7 +5029,9 @@ function hashCode(code) {
   }
   return createHmac("sha256", secret).update(code).digest("hex");
 }
-function createAuth2faEndpoint(slugs) {
+function createAuth2faEndpoint(slugs, store) {
+  const sendLimiter = new RateLimiter(60 * 60 * 1e3, 3, store);
+  const verifyLimiter = new RateLimiter(15 * 60 * 1e3, 5, store);
   return {
     path: "/support/2fa",
     method: "post",
@@ -4807,7 +5050,7 @@ function createAuth2faEndpoint(slugs) {
         }
         const genericSendResponse = { success: true, message: "Si un compte existe, un code a \xE9t\xE9 envoy\xE9." };
         if (action === "send") {
-          if (sendLimiter.check(email)) {
+          if (await sendLimiter.check(email, req)) {
             return Response.json(genericSendResponse);
           }
           const clients = await dbFind(payload, slugs.supportClients, {
@@ -4848,7 +5091,7 @@ function createAuth2faEndpoint(slugs) {
           if (!code) {
             return Response.json({ error: "Code manquant" }, { status: 400 });
           }
-          if (verifyLimiter.check(email)) {
+          if (await verifyLimiter.check(email, req)) {
             return Response.json(
               { error: "Trop de tentatives. R\xE9essayez dans 15 minutes." },
               { status: 429 }
@@ -5059,7 +5302,7 @@ function createOAuthGoogleEndpoint(slugs, options) {
             "Set-Cookie",
             `payload-token=${token}; HttpOnly; ${cookieSecure ? "Secure; " : ""}SameSite=Lax; Path=/; Max-Age=${tokenExpiration}`
           );
-          return new Response(JSON.stringify({ token, user: clientDoc, exp }), {
+          return new Response(JSON.stringify({ user: clientDoc, exp }), {
             status: 200,
             headers
           });
@@ -5262,7 +5505,6 @@ function createMergeClientsEndpoint(slugs) {
     }
   };
 }
-var importLimiter = new RateLimiter(36e5, 10);
 function parseStructuredMarkdown(markdown) {
   const clientMatch = markdown.match(
     /\*\*Client\s*:\*\*\s*(.+?)\s*[—–-]\s*(.+?)\s*\(([^)]+@[^)]+)\)/i
@@ -5365,7 +5607,8 @@ ONLY JSON, nothing else.`
     return null;
   }
 }
-function createImportConversationEndpoint(slugs) {
+function createImportConversationEndpoint(slugs, store) {
+  const importLimiter = new RateLimiter(36e5, 10, store);
   return {
     path: "/support/import-conversation",
     method: "post",
@@ -5374,7 +5617,7 @@ function createImportConversationEndpoint(slugs) {
         const payload = req.payload;
         const webhookSecret = req.headers.get("x-webhook-secret");
         let isAuthed = false;
-        if (webhookSecret && process.env.SUPPORT_WEBHOOK_SECRET && webhookSecret === process.env.SUPPORT_WEBHOOK_SECRET) {
+        if (verifySecret(webhookSecret, process.env.SUPPORT_WEBHOOK_SECRET)) {
           isAuthed = true;
         } else if (req.user && req.user.collection === slugs.users) {
           isAuthed = true;
@@ -5383,7 +5626,7 @@ function createImportConversationEndpoint(slugs) {
           return Response.json({ error: "Unauthorized" }, { status: 401 });
         }
         const ip = req.headers.get("x-forwarded-for")?.split(",")[0]?.trim() || "unknown";
-        if (importLimiter.check(ip)) {
+        if (await importLimiter.check(ip, req)) {
           return Response.json({ error: "Rate limit exceeded. Maximum 10 imports per hour." }, { status: 429 });
         }
         let body;
@@ -5575,7 +5818,7 @@ function createProcessScheduledEndpoint(slugs) {
     handler: async (req) => {
       const secret = req.headers.get("x-cron-secret");
       const expectedSecret = process.env.CRON_SECRET;
-      if (!expectedSecret || secret !== expectedSecret) {
+      if (!verifySecret(secret, expectedSecret)) {
         return Response.json({ error: "Non autoris\xE9" }, { status: 401 });
       }
       try {
@@ -5684,7 +5927,7 @@ function createProcessSnoozeEndpoint(slugs) {
     handler: async (req) => {
       const secret = req.headers.get("x-cron-secret");
       const expectedSecret = process.env.CRON_SECRET;
-      if (!expectedSecret || secret !== expectedSecret) {
+      if (!verifySecret(secret, expectedSecret)) {
         return Response.json({ error: "Non autoris\xE9" }, { status: 401 });
       }
       try {
@@ -5744,7 +5987,7 @@ function createProcessDigestsEndpoint(slugs) {
     method: "post",
     handler: async (req) => {
       const secret = req.headers.get("x-cron-secret");
-      if (!process.env.CRON_SECRET || secret !== process.env.CRON_SECRET) {
+      if (!verifySecret(secret, process.env.CRON_SECRET)) {
         return Response.json({ error: "Non autoris\xE9" }, { status: 401 });
       }
       try {
@@ -5817,7 +6060,7 @@ function createChannelsWebhookEndpoint(slugs) {
     method: "post",
     handler: async (req) => {
       const secret = req.headers.get("x-channel-secret");
-      if (!process.env.CHANNELS_WEBHOOK_SECRET || secret !== process.env.CHANNELS_WEBHOOK_SECRET) {
+      if (!verifySecret(secret, process.env.CHANNELS_WEBHOOK_SECRET)) {
         return Response.json({ error: "Non autoris\xE9" }, { status: 401 });
       }
       let body;
@@ -6172,8 +6415,8 @@ function createTicketFeedbackEndpoint(slugs) {
 // src/endpoints/transfer-ticket.ts
 var EMAIL_RE = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
 var MAX_TRANSFERS_PER_DAY = 5;
-var transferLimiter = new RateLimiter(24 * 60 * 60 * 1e3, MAX_TRANSFERS_PER_DAY);
-function createTransferTicketEndpoint(slugs) {
+function createTransferTicketEndpoint(slugs, store) {
+  const transferLimiter = new RateLimiter(24 * 60 * 60 * 1e3, MAX_TRANSFERS_PER_DAY, store);
   return {
     path: "/support/tickets/:id/transfer",
     method: "post",
@@ -6208,7 +6451,7 @@ function createTransferTicketEndpoint(slugs) {
         if (!isAdmin && !isOwner) {
           return Response.json({ error: "Forbidden" }, { status: 403 });
         }
-        if (transferLimiter.check(`${req.user.id}:${ticketId}`)) {
+        if (await transferLimiter.check(`${req.user.id}:${ticketId}`, req)) {
           return Response.json(
             { error: `Limite atteinte (${MAX_TRANSFERS_PER_DAY} transferts par 24h sur ce ticket)` },
             { status: 429 }
@@ -6355,8 +6598,8 @@ function statusToLabel(status) {
 }
 var EMAIL_RE2 = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
 var MAX_COLLABORATORS_PER_TICKET = 20;
-var inviteLimiter = new RateLimiter(60 * 60 * 1e3, 10);
-function createInviteCollaboratorEndpoint(slugs) {
+function createInviteCollaboratorEndpoint(slugs, store) {
+  const inviteLimiter = new RateLimiter(60 * 60 * 1e3, 10, store);
   return {
     path: "/support/tickets/:id/invite",
     method: "post",
@@ -6391,7 +6634,7 @@ function createInviteCollaboratorEndpoint(slugs) {
         if (!isAdmin && !isOwner) {
           return Response.json({ error: "Forbidden" }, { status: 403 });
         }
-        if (inviteLimiter.check(String(req.user.id))) {
+        if (await inviteLimiter.check(String(req.user.id), req)) {
           return Response.json({ error: "Trop d'invitations. R\xE9essayez plus tard." }, { status: 429 });
         }
         const collabCount = await dbCount(payload, "ticket-collaborators", { where: { ticket: { equals: ticketId } }, overrideAccess: true }).catch(() => ({ totalDocs: 0 }));
@@ -6522,6 +6765,7 @@ function createInviteCollaboratorEndpoint(slugs) {
 // src/endpoints/index.ts
 function createSupportEndpoints(slugs, options) {
   const f = options?.features;
+  const rateLimitStore = options?.rateLimitStore;
   const endpoints = [
     createSearchEndpoint(slugs),
     createKbSearchEndpoint(slugs),
@@ -6531,26 +6775,26 @@ function createSupportEndpoints(slugs, options) {
     createExportCsvEndpoint(slugs),
     createExportDataEndpoint(slugs),
     createSeedKbEndpoint(slugs),
-    createLoginEndpoint(slugs),
-    createAuth2faEndpoint(slugs),
+    createLoginEndpoint(slugs, rateLimitStore),
+    createAuth2faEndpoint(slugs, rateLimitStore),
     createOAuthGoogleEndpoint(slugs, options?.oauth),
     createDeleteAccountEndpoint(slugs),
     createMergeClientsEndpoint(slugs),
-    createImportConversationEndpoint(slugs),
+    createImportConversationEndpoint(slugs, rateLimitStore),
     createPurgeLogsEndpoint(slugs),
-    createResendNotificationEndpoint(slugs),
+    createResendNotificationEndpoint(slugs, rateLimitStore),
     createUserPrefsGetEndpoint(slugs),
     createUserPrefsPostEndpoint(slugs),
     createEscalateEndpoint(slugs),
     createTicketFeedbackEndpoint(slugs),
-    createTransferTicketEndpoint(slugs),
-    createInviteCollaboratorEndpoint(slugs)
+    createTransferTicketEndpoint(slugs, rateLimitStore),
+    createInviteCollaboratorEndpoint(slugs, rateLimitStore)
   ];
   if (!f || f.ai !== false) {
-    endpoints.push(createAiEndpoint(slugs));
-    endpoints.push(createAiAgentEndpoint(slugs));
-    endpoints.push(...createClientIntelligenceEndpoint(slugs));
-    endpoints.push(createTicketSynthesisEndpoint(slugs));
+    endpoints.push(createAiEndpoint(slugs, rateLimitStore));
+    endpoints.push(createAiAgentEndpoint(slugs, rateLimitStore));
+    endpoints.push(...createClientIntelligenceEndpoint(slugs, rateLimitStore));
+    endpoints.push(createTicketSynthesisEndpoint(slugs, options?.capabilities?.aiSummaries, rateLimitStore));
   }
   if (!f || f.bulkActions !== false) endpoints.push(createBulkActionEndpoint(slugs));
   if (!f || f.merge !== false) endpoints.push(createMergeTicketsEndpoint(slugs));
@@ -6565,18 +6809,18 @@ function createSupportEndpoints(slugs, options) {
   if (!f || f.sla !== false) endpoints.push(createSlaCheckEndpoint(slugs));
   if (!f || f.autoClose !== false) {
     endpoints.push(createAutoCloseEndpoint(slugs));
-    endpoints.push(createSendReminderEndpoint(slugs));
+    endpoints.push(createSendReminderEndpoint(slugs, rateLimitStore));
   }
   if (!f || f.customStatuses !== false) endpoints.push(createStatusesEndpoint(slugs));
   if (!f || f.macros !== false) endpoints.push(createApplyMacroEndpoint(slugs));
   if (!f || f.roundRobin !== false) {
     endpoints.push(createRoundRobinConfigGetEndpoint(slugs), createRoundRobinConfigPostEndpoint(slugs));
   }
-  if (!f || f.chatbot !== false) endpoints.push(createChatbotEndpoint(slugs));
+  if (!f || f.chatbot !== false) endpoints.push(createChatbotEndpoint(slugs, rateLimitStore));
   if (!f || f.chat !== false) {
-    endpoints.push(createChatGetEndpoint(slugs), createChatPostEndpoint(slugs));
+    endpoints.push(createChatGetEndpoint(slugs), createChatPostEndpoint(slugs, rateLimitStore));
     endpoints.push(createChatStreamEndpoint(slugs));
-    endpoints.push(createAdminChatGetEndpoint(slugs), createAdminChatPostEndpoint(slugs));
+    endpoints.push(createAdminChatGetEndpoint(slugs), createAdminChatPostEndpoint(slugs, rateLimitStore));
     endpoints.push(createAdminChatStreamEndpoint(slugs));
   }
   if (!f || f.timeTracking !== false) {
@@ -6594,6 +6838,16 @@ function createSupportEndpoints(slugs, options) {
   endpoints.push(createChannelsWebhookEndpoint(slugs));
   endpoints.push(createVapidKeyEndpoint());
   endpoints.push(createPushSubscribeEndpoint(slugs));
+  if (options?.capabilities?.inboundEmail) {
+    endpoints.push(createInboundEmailEndpoint(options.capabilities.inboundEmail, rateLimitStore));
+  }
+  if (options?.capabilities?.projectSuggestions) {
+    endpoints.push(createProjectSuggestionsEndpoint(slugs, options.capabilities.projectSuggestions, rateLimitStore));
+  }
+  if (options?.capabilities?.aiTitles) {
+    endpoints.push(createTicketTitleEndpoint(slugs, options.capabilities.aiTitles, rateLimitStore));
+    endpoints.push(createGenerateMissingTitlesEndpoint(slugs, options.capabilities.aiTitles, rateLimitStore));
+  }
   return endpoints;
 }
 
@@ -7230,38 +7484,69 @@ async function resolveAgentTeamIds(payload, slugs, userId) {
 }
 
 // src/collections/Tickets.ts
-function createAssignTicketNumber(slugs) {
+var ticketNumberQueues = /* @__PURE__ */ new Map();
+async function withTicketNumberLock(key, operation) {
+  const previous = ticketNumberQueues.get(key) ?? Promise.resolve();
+  let release;
+  const gate = new Promise((resolve) => {
+    release = resolve;
+  });
+  const queued = previous.then(() => gate);
+  ticketNumberQueues.set(key, queued);
+  await previous;
+  try {
+    return await operation();
+  } finally {
+    release();
+    if (ticketNumberQueues.get(key) === queued) ticketNumberQueues.delete(key);
+  }
+}
+function createAssignTicketNumber(slugs, options) {
   return async ({ data, operation, req }) => {
     if (operation === "create") {
-      let retries = 3;
-      while (retries > 0) {
-        try {
-          const countResult = await req.payload.count({
-            collection: slugs.tickets,
-            overrideAccess: true
-          });
-          const baseNumber = countResult.totalDocs + 1;
-          data.ticketNumber = `TK-${String(baseNumber).padStart(4, "0")}`;
-          const existing = await req.payload.find({
-            collection: slugs.tickets,
-            where: { ticketNumber: { equals: data.ticketNumber } },
-            limit: 1,
-            depth: 0,
-            overrideAccess: true
+      const value = await withTicketNumberLock(slugs.tickets, async () => {
+        const counterResult = await req.payload.find({
+          collection: slugs.counters,
+          where: { key: { equals: slugs.tickets } },
+          limit: 1,
+          depth: 0,
+          overrideAccess: true,
+          req
+        });
+        const counter = counterResult.docs[0];
+        if (counter) {
+          const allocated2 = Number(counter.nextValue);
+          await req.payload.update({
+            collection: slugs.counters,
+            id: counter.id,
+            data: { nextValue: allocated2 + 1 },
+            overrideAccess: true,
+            req
           });
-          if (existing.docs.length > 0) {
-            const suffix = Date.now() % 1e4;
-            data.ticketNumber = `TK-${String(baseNumber + suffix).padStart(4, "0")}`;
-          }
-          break;
-        } catch (error) {
-          if (retries > 1 && (error?.message?.includes("UNIQUE") || error?.message?.includes("unique") || error?.code === "SQLITE_CONSTRAINT")) {
-            retries--;
-            continue;
-          }
-          throw error;
+          return allocated2;
         }
-      }
+        const tickets = await req.payload.find({
+          collection: slugs.tickets,
+          limit: 0,
+          depth: 0,
+          overrideAccess: true,
+          select: { ticketNumber: true },
+          req
+        });
+        const highest = tickets.docs.reduce((max, ticket) => {
+          const match = String(ticket.ticketNumber || "").match(/(\d+)$/);
+          return match ? Math.max(max, Number(match[1])) : max;
+        }, 0);
+        const allocated = highest + 1;
+        await req.payload.create({
+          collection: slugs.counters,
+          data: { key: slugs.tickets, nextValue: allocated + 1 },
+          overrideAccess: true,
+          req
+        });
+        return allocated;
+      });
+      data.ticketNumber = `${options?.prefix ?? "TK-"}${String(value).padStart(options?.padding ?? 4, "0")}`;
     }
     return data;
   };
@@ -7354,7 +7639,7 @@ function createTrackSLA(slugs) {
     return doc;
   };
 }
-function createTrackAiSummaryOnResolve(slugs) {
+function createTrackAiSummaryOnResolve(slugs, generator) {
   return async ({ doc, previousDoc, operation, req }) => {
     if (operation !== "update" || !previousDoc) return doc;
     const wasResolved = previousDoc.status === "resolved";
@@ -7374,7 +7659,33 @@ function createTrackAiSummaryOnResolve(slugs) {
     }
     if (!wasResolved && isResolved && !doc.aiSummary) {
       setImmediate(() => {
-        generateTicketSynthesis({ payload: req.payload, slugs, ticketId: doc.id }).catch((err) => console.error("[support] Background ai synthesis failed:", err));
+        const operation2 = generator ? generator.generate(req.payload, doc.id) : generateTicketSynthesis({ payload: req.payload, slugs, ticketId: doc.id });
+        operation2.catch((err) => console.error("[support] Background ai synthesis failed:", err));
+      });
+    }
+    return doc;
+  };
+}
+function createTrackWaitingSince() {
+  return ({ data, originalDoc, operation }) => {
+    if (operation !== "update") return data;
+    const previous = originalDoc?.status;
+    const next = data.status ?? previous;
+    if (next === "waiting_client" && previous !== "waiting_client") {
+      data.waitingSince = (/* @__PURE__ */ new Date()).toISOString();
+      data.autoCloseRemindedAt = null;
+    } else if (next !== "waiting_client" && previous === "waiting_client") {
+      data.waitingSince = null;
+      data.autoCloseRemindedAt = null;
+    }
+    return data;
+  };
+}
+function createGenerateTitleOnCreate(generator) {
+  return ({ doc, operation, req }) => {
+    if (operation === "create" && doc?.id && !doc.displayTitle) {
+      setImmediate(() => {
+        generator.generate(req.payload, doc.id).catch((err) => console.error("[support] Background title generation failed:", err));
       });
     }
     return doc;
@@ -7592,6 +7903,7 @@ function createCascadeDelete(slugs) {
 function createTicketsCollection(slugs, options) {
   const notificationSlug = options?.notificationSlug || "admin-notifications";
   const dynamicFields = [];
+  const capabilities = options?.capabilities;
   dynamicFields.push({
     name: "conversation",
     type: "ui",
@@ -7610,6 +7922,28 @@ function createTicketsCollection(slugs, options) {
       admin: { position: "sidebar" }
     });
   }
+  if (capabilities?.aiTitles) {
+    dynamicFields.push(
+      {
+        name: "displayTitle",
+        type: "text",
+        label: "Titre d'affichage",
+        admin: { description: "Titre court sugg\xE9r\xE9 par l'IA, \xE9ditable sans modifier le sujet email." }
+      },
+      {
+        name: "displayTitleStatus",
+        type: "select",
+        defaultValue: "none",
+        options: [
+          { label: "Aucun", value: "none" },
+          { label: "G\xE9n\xE9ration en cours", value: "pending" },
+          { label: "Sugg\xE9r\xE9", value: "suggested" },
+          { label: "Valid\xE9", value: "validated" },
+          { label: "\xC9chec", value: "error" }
+        ]
+      }
+    );
+  }
   const billingFields = [
     {
       type: "row",
@@ -7688,6 +8022,39 @@ function createTicketsCollection(slugs, options) {
       ]
     }
   ];
+  if (capabilities?.detailedBilling) {
+    billingFields.push(
+      {
+        name: "billedAt",
+        type: "date",
+        label: "Factur\xE9 le"
+      },
+      {
+        name: "billingLines",
+        type: "array",
+        label: "Lignes de facturation",
+        fields: [
+          { name: "period", type: "text", label: "P\xE9riode (AAAA-MM)" },
+          { name: "label", type: "text", label: "Libell\xE9" },
+          { name: "amount", type: "number", label: "Montant (\u20AC)" },
+          { name: "billingType", type: "select", options: ["hourly", "flat"], defaultValue: "flat", label: "Type" },
+          { name: "billed", type: "checkbox", defaultValue: false, label: "Factur\xE9" },
+          { name: "billedAt", type: "date", label: "Factur\xE9 le" }
+        ]
+      }
+    );
+  }
+  if (capabilities?.volunteering) {
+    billingFields.push(
+      { name: "volunteer", type: "checkbox", defaultValue: false, label: "B\xE9n\xE9volat (non factur\xE9)" },
+      {
+        name: "volunteerValue",
+        type: "number",
+        label: "Valeur offerte (\u20AC)",
+        admin: { condition: (data) => Boolean(data?.volunteer) }
+      }
+    );
+  }
   return {
     slug: slugs.tickets,
     labels: { singular: "Ticket", plural: "Tickets" },
@@ -7838,7 +8205,20 @@ function createTicketsCollection(slugs, options) {
           },
           { name: "mergedInto", type: "relationship", relationTo: slugs.tickets, label: "Fusionne dans", admin: { readOnly: true } },
           { name: "autoCloseRemindedAt", type: "date", label: "Rappel auto-close envoye", admin: { readOnly: true, date: { displayFormat: "dd/MM/yyyy HH:mm" } } },
-          { name: "autoCloseScheduledAt", type: "date", index: true, label: "Fermeture auto programmee", admin: { readOnly: true, date: { displayFormat: "dd/MM/yyyy HH:mm" }, description: "Echeance ferme posee par une relance manuelle. Le ticket se ferme apres cette date sans reponse client." } }
+          { name: "autoCloseScheduledAt", type: "date", index: true, label: "Fermeture auto programmee", admin: { readOnly: true, date: { displayFormat: "dd/MM/yyyy HH:mm" }, description: "Echeance ferme posee par une relance manuelle. Le ticket se ferme apres cette date sans reponse client." } },
+          { name: "waitingSince", type: "date", index: true, label: "En attente depuis", admin: { readOnly: true } },
+          {
+            name: "relanceDelayDays",
+            type: "select",
+            defaultValue: "2",
+            label: "D\xE9lai de relance client",
+            options: [
+              { label: "1 jour", value: "1" },
+              { label: "2 jours", value: "2" },
+              { label: "3 jours", value: "3" }
+            ]
+          },
+          { name: "satisfactionRemindedAt", type: "date", admin: { hidden: true, readOnly: true } }
         ]
       },
       // Sidebar
@@ -7913,15 +8293,17 @@ function createTicketsCollection(slugs, options) {
     ],
     hooks: {
       beforeChange: [
-        createAssignTicketNumber(slugs),
+        createAssignTicketNumber(slugs, options?.ticketNumber),
         createAssignClientOnCreate(slugs),
         createAutoAssignAdmin(slugs),
         autoPaidAt,
+        createTrackWaitingSince(),
         createRestrictClientUpdates(slugs)
       ],
       afterChange: [
         createTrackSLA(slugs),
-        createTrackAiSummaryOnResolve(slugs),
+        createTrackAiSummaryOnResolve(slugs, capabilities?.aiSummaries),
+        ...capabilities?.aiTitles ? [createGenerateTitleOnCreate(capabilities.aiTitles)] : [],
         createAssignSlaDeadlines(slugs, notificationSlug),
         createPauseSlaOnHold(slugs),
         createCheckSlaOnResolve(slugs, notificationSlug),
@@ -8426,6 +8808,56 @@ function createNotifyMentions(slugs) {
     return doc;
   };
 }
+function createSmsNotification(slugs, capability) {
+  return async ({ doc, operation, req }) => {
+    try {
+      if (operation !== "create" || !doc.notifyBySms) return doc;
+      if (doc.authorType !== "admin" || doc.isInternal) return doc;
+      if (doc.scheduledAt && !doc.scheduledSent) return doc;
+      if (capability.adapter.isConfigured && !capability.adapter.isConfigured()) return doc;
+      const ticketId = typeof doc.ticket === "object" ? doc.ticket.id : doc.ticket;
+      const ticket = await req.payload.findByID({
+        collection: slugs.tickets,
+        id: ticketId,
+        depth: 1,
+        overrideAccess: true
+      });
+      const client = typeof ticket.client === "object" && ticket.client ? ticket.client : null;
+      if (!client) return doc;
+      const target = typeof doc.smsTo === "string" && doc.smsTo.trim() || String(client.phone || "");
+      if (!target) return doc;
+      const fallback = `ConsilioWEB : nouvelle r\xE9ponse au ticket ${String(ticket.ticketNumber || "")}.`;
+      const message = typeof doc.smsMessage === "string" && doc.smsMessage.trim() || (capability.buildMessage ? await capability.buildMessage({ client, ticket }) : fallback);
+      const result = await capability.adapter.send({
+        message,
+        to: target,
+        payload: req.payload,
+        ticket,
+        client
+      });
+      if (!result.sent && !result.skipped) {
+        req.payload.logger?.warn(`[support:sms] Delivery failed: ${result.error || "unknown error"}`);
+      }
+    } catch (error) {
+      req.payload.logger?.warn(`[support:sms] Adapter error: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    return doc;
+  };
+}
+function createThreadCleanup(capability) {
+  return async ({ doc, operation, req }) => {
+    if (operation !== "create" || doc.isInternal) return doc;
+    if (doc.authorType !== "client" && doc.authorType !== "email") return doc;
+    const ticketId = typeof doc.ticket === "object" ? doc.ticket.id : doc.ticket;
+    if (!ticketId) return doc;
+    try {
+      await capability.clean(req.payload, ticketId, doc.id);
+    } catch (error) {
+      req.payload.logger?.warn(`[support:thread-cleanup] ${error instanceof Error ? error.message : String(error)}`);
+    }
+    return doc;
+  };
+}
 function createTicketMessagesCollection(slugs, options) {
   const notificationSlug = options?.notificationSlug || "admin-notifications";
   return {
@@ -8486,11 +8918,23 @@ function createTicketMessagesCollection(slugs, options) {
       { name: "deletedAt", type: "date", label: "Supprime le", admin: { hidden: true } },
       { name: "emailSentAt", type: "date", label: "Email envoye le", admin: { hidden: true } },
       { name: "emailSentTo", type: "text", label: "Email envoye a", admin: { hidden: true } },
-      { name: "emailOpenedAt", type: "date", label: "Email ouvert le", admin: { hidden: true } }
+      { name: "emailOpenedAt", type: "date", label: "Email ouvert le", admin: { hidden: true } },
+      ...options?.capabilities?.sms ? [
+        { name: "notifyBySms", type: "checkbox", defaultValue: false, admin: { hidden: true } },
+        { name: "smsTo", type: "text", admin: { hidden: true } },
+        { name: "smsMessage", type: "textarea", admin: { hidden: true } }
+      ] : [],
+      ...options?.capabilities?.threadCleanup ? [
+        { name: "isMarkedAsNoise", type: "checkbox", defaultValue: false, admin: { hidden: true } },
+        { name: "noiseReason", type: "text", admin: { hidden: true } },
+        { name: "emailContext", type: "json", admin: { hidden: true } },
+        { name: "emailBodyOriginal", type: "textarea", admin: { hidden: true } }
+      ] : []
     ],
     hooks: {
       beforeChange: [createSanitizeMessageHtml(), createResolveMentions(slugs), createAssignAuthor(slugs)],
       afterChange: [
+        ...options?.capabilities?.sms ? [createSmsNotification(slugs, options.capabilities.sms)] : [],
         createAutoUpdateStatus(slugs),
         createNotifyClient(slugs),
         createTrackFirstResponse(slugs),
@@ -8499,7 +8943,8 @@ function createTicketMessagesCollection(slugs, options) {
         createNotifyAdminOnClientMessage(slugs, notificationSlug),
         createFireMessageWebhooks(slugs),
         createDispatchWebhookOnReply(slugs),
-        createNotifyMentions(slugs)
+        createNotifyMentions(slugs),
+        ...options?.capabilities?.threadCleanup ? [createThreadCleanup(options.capabilities.threadCleanup)] : []
       ]
     },
     access: {
@@ -8589,7 +9034,7 @@ function createEnforce2FA(slugs) {
     return user;
   };
 }
-function createSupportClientsCollection(slugs) {
+function createSupportClientsCollection(slugs, options) {
   return {
     slug: slugs.supportClients,
     labels: {
@@ -8851,7 +9296,45 @@ function createSupportClientsCollection(slugs) {
           description: "Visible uniquement par les admins",
           position: "sidebar"
         }
-      }
+      },
+      ...options?.capabilities?.sms ? [
+        {
+          name: "notifyBySmsChannel",
+          type: "checkbox",
+          defaultValue: false,
+          label: "Canal SMS activ\xE9",
+          admin: { position: "sidebar" }
+        }
+      ] : [],
+      ...options?.capabilities?.aiTitles || options?.capabilities?.aiSummaries ? [
+        {
+          name: "preferredFormality",
+          type: "select",
+          defaultValue: "auto",
+          label: "Formule IA",
+          options: [
+            { label: "Auto", value: "auto" },
+            { label: "Tutoiement", value: "tutoyer" },
+            { label: "Vouvoiement", value: "vouvoyer" }
+          ],
+          admin: { position: "sidebar" }
+        },
+        {
+          name: "preferredTone",
+          type: "select",
+          defaultValue: "auto",
+          label: "Ton IA",
+          options: [
+            { label: "Auto", value: "auto" },
+            { label: "Neutre / professionnel", value: "neutre" },
+            { label: "Amical", value: "amical" },
+            { label: "Direct / concis", value: "direct" },
+            { label: "Formel", value: "formel" }
+          ],
+          admin: { position: "sidebar" }
+        },
+        { name: "lastRewriteStyle", type: "text", admin: { hidden: true } }
+      ] : []
     ],
     hooks: {
       beforeLogin: [createEnforce2FA(slugs)],
@@ -9466,7 +9949,7 @@ function createPendingEmailsCollection(slugs) {
       create: ({ req }) => {
         if (req.user?.collection === slugs.users) return true;
         const webhookSecret = req.headers.get("x-webhook-secret");
-        if (webhookSecret && process.env.SUPPORT_WEBHOOK_SECRET && webhookSecret === process.env.SUPPORT_WEBHOOK_SECRET) return true;
+        if (verifySecret(webhookSecret, process.env.SUPPORT_WEBHOOK_SECRET)) return true;
         return false;
       }
     },
@@ -10599,6 +11082,40 @@ function createPushSubscriptionCollection(slugs) {
   };
 }
 
+// src/collections/SupportRateLimits.ts
+function createSupportRateLimitsCollection(slug = "support-rate-limits") {
+  return {
+    slug,
+    admin: { hidden: true },
+    access: {
+      create: () => false,
+      read: () => false,
+      update: () => false,
+      delete: () => false
+    },
+    fields: [
+      { name: "key", type: "text", required: true, unique: true, index: true },
+      { name: "count", type: "number", required: true, min: 1 },
+      { name: "resetAt", type: "date", required: true, index: true }
+    ],
+    timestamps: false
+  };
+}
+
+// src/collections/SupportCounters.ts
+function createSupportCountersCollection(slug = "support-counters") {
+  return {
+    slug,
+    admin: { hidden: true },
+    access: { create: () => false, read: () => false, update: () => false, delete: () => false },
+    fields: [
+      { name: "key", type: "text", required: true, unique: true, index: true },
+      { name: "nextValue", type: "number", required: true, min: 1 }
+    ],
+    timestamps: false
+  };
+}
+
 // src/plugin.ts
 function viewConfig(component, path) {
   return { Component: component, path };
@@ -10614,21 +11131,25 @@ function supportPlugin(config) {
     ...config?.collectionSlugs,
     users: config?.userCollectionSlug || "users"
   });
+  const rateLimitStore = config?.rateLimitStore === "payload" ? new PayloadRateLimitStore(slugs.rateLimits) : config?.rateLimitStore;
   return (incomingConfig) => {
     const existingCollections = incomingConfig.collections || [];
     const ticketOptions = {
       conversationComponent: config?.conversationComponent,
       projectCollectionSlug: config?.projectCollectionSlug,
       documentsCollectionSlug: config?.documentsCollectionSlug,
-      notificationSlug: config?.notificationSlug
+      notificationSlug: config?.notificationSlug,
+      ticketNumber: config?.ticketNumber,
+      capabilities: config?.capabilities
     };
     const messageOptions = {
-      notificationSlug: config?.notificationSlug
+      notificationSlug: config?.notificationSlug,
+      capabilities: config?.capabilities
     };
     const supportCollections = [
       createTicketsCollection(slugs, ticketOptions),
       createTicketMessagesCollection(slugs, messageOptions),
-      createSupportClientsCollection(slugs),
+      createSupportClientsCollection(slugs, { capabilities: config?.capabilities }),
       createCannedResponsesCollection(slugs),
       createTicketActivityLogCollection(slugs),
       createSatisfactionSurveysCollection(slugs),
@@ -10638,8 +11159,12 @@ function supportPlugin(config) {
       createNotificationQueueCollection(slugs),
       createAutomationRulesCollection(slugs),
       createSupportTeamCollection(slugs),
-      createPushSubscriptionCollection(slugs)
+      createPushSubscriptionCollection(slugs),
+      createSupportCountersCollection(slugs.counters)
     ];
+    if (config?.rateLimitStore === "payload") {
+      supportCollections.push(createSupportRateLimitsCollection(slugs.rateLimits));
+    }
     if (features.authLogs !== false) supportCollections.push(createAuthLogsCollection(slugs));
     if (features.timeTracking !== false) supportCollections.push(createTimeEntriesCollection(slugs));
     if (features.emailTracking !== false) supportCollections.push(createEmailLogsCollection(slugs));
@@ -10677,7 +11202,9 @@ function supportPlugin(config) {
     const existingEndpoints = incomingConfig.endpoints || [];
     const supportEndpoints = createSupportEndpoints(slugs, {
       oauth: { allowedEmailDomains: config?.allowedEmailDomains },
-      features
+      features,
+      rateLimitStore,
+      capabilities: config?.capabilities
     });
     return {
       ...incomingConfig,
@@ -10694,4 +11221,4 @@ function supportPlugin(config) {
   };
 }
 
-export { DEFAULT_FEATURES, DEFAULT_SETTINGS, DEFAULT_SLUGS, DEFAULT_USER_PREFS, calculateBusinessHoursDeadline, createAdminNotification, createAssignSlaDeadlines, createAuthLogsCollection, createCannedResponsesCollection, createChatMessagesCollection, createCheckSlaOnReply, createCheckSlaOnResolve, createEmailLogsCollection, createKnowledgeBaseCollection, createMacrosCollection, createPendingEmailsCollection, createSatisfactionSurveysCollection, createSlaPoliciesCollection, createSupportClientsCollection, createTicketActivityLogCollection, createTicketCollaboratorsCollection, createTicketMessagesCollection, createTicketStatusEmail, createTicketStatusesCollection, createTicketsCollection, createTimeEntriesCollection, createWebhookEndpointsCollection, dispatchWebhook, generateTicketSynthesis, readSupportSettings, readUserPrefs, resolveSlugs, supportPlugin };
+export { DEFAULT_FEATURES, DEFAULT_INBOUND_EMAIL_LIMITS, DEFAULT_SETTINGS, DEFAULT_SLUGS, DEFAULT_USER_PREFS, MemoryRateLimitStore, PayloadRateLimitStore, RateLimiter, calculateBusinessHoursDeadline, createAdminNotification, createAssignSlaDeadlines, createAuthLogsCollection, createCannedResponsesCollection, createChatMessagesCollection, createCheckSlaOnReply, createCheckSlaOnResolve, createEmailLogsCollection, createKnowledgeBaseCollection, createLoginEndpoint, createMacrosCollection, createOAuthGoogleEndpoint, createPendingEmailsCollection, createSatisfactionSurveysCollection, createSlaPoliciesCollection, createSupportClientsCollection, createTicketActivityLogCollection, createTicketCollaboratorsCollection, createTicketMessagesCollection, createTicketStatusEmail, createTicketStatusesCollection, createTicketsCollection, createTimeEntriesCollection, createTrackOpenEndpoint, createWebhookEndpointsCollection, dispatchWebhook, generateTicketSynthesis, readSupportSettings, readUserPrefs, resolveSlugs, supportPlugin, validateInboundEmailPayload, verifySecret };