@consilioweb/payload-support 1.1.1 → 2.0.1

package/src/portal/page.tsx

@@ -6,7 +6,7 @@ const supportEmail = process.env.SUPPORT_EMAIL || 'support@example.com'
 
 export default function SupportPage() {
   return (
-    <div className="flex min-h-screen flex-col bg-white dark:bg-slate-950">
+    <div className="flex min-h-[100dvh] flex-col bg-white dark:bg-slate-950">
       {/* Header */}
       <header className="border-b border-slate-200 bg-white/80 backdrop-blur-lg dark:border-slate-800 dark:bg-slate-950/80">
         <div className="mx-auto flex max-w-5xl items-center justify-between px-6 py-4">
@@ -20,7 +20,7 @@ export default function SupportPage() {
           </Link>
           <Link
             href="/support/login"
-            className="rounded-lg bg-blue-600 px-5 py-2 text-sm font-medium text-white shadow-sm transition-all hover:bg-blue-700 hover:shadow-md active:scale-[0.98]"
+            className="rounded-lg bg-blue-600 px-5 py-2 text-sm font-medium text-white shadow-sm transition-[color,background-color,border-color,box-shadow,transform] motion-reduce:transition-none hover:bg-blue-700 hover:shadow-md active:scale-[0.98]"
           >
             Se connecter
           </Link>
@@ -49,7 +49,7 @@ export default function SupportPage() {
             <div className="mt-10 flex flex-col items-center gap-4 sm:flex-row sm:justify-center">
               <Link
                 href="/support/login"
-                className="inline-flex items-center gap-2 rounded-xl bg-blue-600 px-8 py-3.5 text-base font-medium text-white shadow-lg shadow-blue-600/25 transition-all hover:bg-blue-700 hover:shadow-xl hover:shadow-blue-600/30 active:scale-[0.98] dark:shadow-blue-600/20"
+                className="inline-flex items-center gap-2 rounded-xl bg-blue-600 px-8 py-3.5 text-base font-medium text-white shadow-lg shadow-blue-600/25 transition-[color,background-color,border-color,box-shadow,transform] motion-reduce:transition-none hover:bg-blue-700 hover:shadow-xl hover:shadow-blue-600/30 active:scale-[0.98] dark:shadow-blue-600/20"
               >
                 Accéder à mon espace
                 <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 20 20" fill="currentColor" className="h-5 w-5">
@@ -58,7 +58,7 @@ export default function SupportPage() {
               </Link>
               <Link
                 href="/support/register"
-                className="inline-flex items-center rounded-xl border border-slate-300 bg-white px-8 py-3.5 text-base font-medium text-slate-700 shadow-sm transition-all hover:bg-slate-50 hover:shadow-md active:scale-[0.98] dark:border-slate-700 dark:bg-slate-800 dark:text-slate-300 dark:hover:bg-slate-700"
+                className="inline-flex items-center rounded-xl border border-slate-300 bg-white px-8 py-3.5 text-base font-medium text-slate-700 shadow-sm transition-[color,background-color,border-color,box-shadow,transform] motion-reduce:transition-none hover:bg-slate-50 hover:shadow-md active:scale-[0.98] dark:border-slate-700 dark:bg-slate-800 dark:text-slate-300 dark:hover:bg-slate-700"
               >
                 Créer un compte
               </Link>
@@ -80,7 +80,7 @@ export default function SupportPage() {
             </p>
             <div className="grid gap-8 sm:grid-cols-3">
               {/* Card 1 */}
-              <div className="group rounded-2xl border border-slate-200 bg-white p-8 shadow-sm transition-all hover:shadow-lg hover:-translate-y-0.5 dark:border-slate-700 dark:bg-slate-800">
+              <div className="group rounded-2xl border border-slate-200 bg-white p-8 shadow-sm transition-[color,background-color,border-color,box-shadow,transform] motion-reduce:transition-none hover:shadow-lg hover:-translate-y-0.5 dark:border-slate-700 dark:bg-slate-800">
                 <div className="mb-5 flex h-12 w-12 items-center justify-center rounded-xl bg-blue-100 text-blue-600 transition-colors group-hover:bg-blue-600 group-hover:text-white dark:bg-blue-950 dark:text-blue-400 dark:group-hover:bg-blue-600 dark:group-hover:text-white">
                   <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="currentColor" strokeWidth="2" strokeLinecap="round" strokeLinejoin="round" className="h-6 w-6">
                     <path d="M14.5 2H6a2 2 0 0 0-2 2v16a2 2 0 0 0 2 2h12a2 2 0 0 0 2-2V7.5L14.5 2z" />
@@ -96,7 +96,7 @@ export default function SupportPage() {
               </div>
 
               {/* Card 2 */}
-              <div className="group rounded-2xl border border-slate-200 bg-white p-8 shadow-sm transition-all hover:shadow-lg hover:-translate-y-0.5 dark:border-slate-700 dark:bg-slate-800">
+              <div className="group rounded-2xl border border-slate-200 bg-white p-8 shadow-sm transition-[color,background-color,border-color,box-shadow,transform] motion-reduce:transition-none hover:shadow-lg hover:-translate-y-0.5 dark:border-slate-700 dark:bg-slate-800">
                 <div className="mb-5 flex h-12 w-12 items-center justify-center rounded-xl bg-blue-100 text-blue-600 transition-colors group-hover:bg-blue-600 group-hover:text-white dark:bg-blue-950 dark:text-blue-400 dark:group-hover:bg-blue-600 dark:group-hover:text-white">
                   <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="currentColor" strokeWidth="2" strokeLinecap="round" strokeLinejoin="round" className="h-6 w-6">
                     <path d="M21 15a2 2 0 0 1-2 2H7l-4 4V5a2 2 0 0 1 2-2h14a2 2 0 0 1 2 2z" />
@@ -109,7 +109,7 @@ export default function SupportPage() {
               </div>
 
               {/* Card 3 */}
-              <div className="group rounded-2xl border border-slate-200 bg-white p-8 shadow-sm transition-all hover:shadow-lg hover:-translate-y-0.5 dark:border-slate-700 dark:bg-slate-800">
+              <div className="group rounded-2xl border border-slate-200 bg-white p-8 shadow-sm transition-[color,background-color,border-color,box-shadow,transform] motion-reduce:transition-none hover:shadow-lg hover:-translate-y-0.5 dark:border-slate-700 dark:bg-slate-800">
                 <div className="mb-5 flex h-12 w-12 items-center justify-center rounded-xl bg-blue-100 text-blue-600 transition-colors group-hover:bg-blue-600 group-hover:text-white dark:bg-blue-950 dark:text-blue-400 dark:group-hover:bg-blue-600 dark:group-hover:text-white">
                   <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="currentColor" strokeWidth="2" strokeLinecap="round" strokeLinejoin="round" className="h-6 w-6">
                     <circle cx="12" cy="12" r="10" />
@@ -139,13 +139,13 @@ export default function SupportPage() {
             <div className="flex flex-col items-center gap-4 sm:flex-row sm:justify-center">
               <Link
                 href="/support/register"
-                className="inline-flex items-center rounded-xl bg-blue-600 px-8 py-3.5 text-base font-medium text-white shadow-lg shadow-blue-600/25 transition-all hover:bg-blue-700 hover:shadow-xl active:scale-[0.98]"
+                className="inline-flex items-center rounded-xl bg-blue-600 px-8 py-3.5 text-base font-medium text-white shadow-lg shadow-blue-600/25 transition-[color,background-color,border-color,box-shadow,transform] motion-reduce:transition-none hover:bg-blue-700 hover:shadow-xl active:scale-[0.98]"
               >
                 Créer un compte
               </Link>
               <a
                 href={`mailto:${supportEmail}`}
-                className="inline-flex items-center gap-2 rounded-xl border border-slate-300 bg-white px-8 py-3.5 text-base font-medium text-slate-700 shadow-sm transition-all hover:bg-slate-50 hover:shadow-md active:scale-[0.98] dark:border-slate-700 dark:bg-slate-800 dark:text-slate-300 dark:hover:bg-slate-700"
+                className="inline-flex items-center gap-2 rounded-xl border border-slate-300 bg-white px-8 py-3.5 text-base font-medium text-slate-700 shadow-sm transition-[color,background-color,border-color,box-shadow,transform] motion-reduce:transition-none hover:bg-slate-50 hover:shadow-md active:scale-[0.98] dark:border-slate-700 dark:bg-slate-800 dark:text-slate-300 dark:hover:bg-slate-700"
               >
                 <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 20 20" fill="currentColor" className="h-5 w-5 text-slate-400">
                   <path d="M3 4a2 2 0 00-2 2v1.161l8.441 4.221a1.25 1.25 0 001.118 0L19 7.162V6a2 2 0 00-2-2H3z" />

package/src/portal/register/page.tsx

@@ -73,10 +73,10 @@ export default function SupportRegisterPage() {
   }
 
   const inputClassName =
-    'w-full rounded-xl border border-slate-300 bg-white px-4 py-3 text-sm text-slate-900 outline-none transition-all placeholder:text-slate-400 focus:border-blue-500 focus:ring-4 focus:ring-blue-500/10 dark:border-slate-600 dark:bg-slate-900 dark:text-white dark:placeholder:text-slate-500 dark:focus:border-blue-500 dark:focus:ring-blue-500/20'
+    'w-full rounded-xl border border-slate-300 bg-white px-4 py-3 text-sm text-slate-900 outline-none transition-[color,background-color,border-color,box-shadow,transform] motion-reduce:transition-none placeholder:text-slate-400 focus:border-blue-500 focus:ring-4 focus:ring-blue-500/10 dark:border-slate-600 dark:bg-slate-900 dark:text-white dark:placeholder:text-slate-500 dark:focus:border-blue-500 dark:focus:ring-blue-500/20'
 
   return (
-    <div className="flex min-h-screen flex-col items-center justify-center px-4 py-12 bg-gradient-to-br from-slate-50 via-white to-blue-50 dark:from-slate-950 dark:via-slate-950 dark:to-blue-950/20">
+    <div className="flex min-h-[100dvh] flex-col items-center justify-center px-4 py-12 bg-gradient-to-br from-slate-50 via-white to-blue-50 dark:from-slate-950 dark:via-slate-950 dark:to-blue-950/20">
       {/* Decorative background element */}
       <div className="pointer-events-none absolute inset-0 bg-[radial-gradient(ellipse_60%_50%_at_50%_0%,rgba(37,99,235,0.08),transparent)] dark:bg-[radial-gradient(ellipse_60%_50%_at_50%_0%,rgba(37,99,235,0.12),transparent)]" />
 
@@ -242,7 +242,7 @@ export default function SupportRegisterPage() {
           <button
             type="submit"
             disabled={loading}
-            className="w-full rounded-xl bg-blue-600 px-6 py-3 text-sm font-medium text-white shadow-lg shadow-blue-600/25 transition-all hover:bg-blue-700 hover:shadow-xl active:scale-[0.98] disabled:cursor-not-allowed disabled:opacity-50 disabled:shadow-none"
+            className="w-full rounded-xl bg-blue-600 px-6 py-3 text-sm font-medium text-white shadow-lg shadow-blue-600/25 transition-[color,background-color,border-color,box-shadow,transform] motion-reduce:transition-none hover:bg-blue-700 hover:shadow-xl active:scale-[0.98] disabled:cursor-not-allowed disabled:opacity-50 disabled:shadow-none"
           >
             {loading ? 'Creation du compte...' : 'Créer mon compte'}
           </button>
@@ -257,7 +257,7 @@ export default function SupportRegisterPage() {
           {/* eslint-disable-next-line @next/next/no-html-link-for-pages */}
           <a
             href="/api/support/oauth/google?action=register"
-            className="flex w-full items-center justify-center gap-3 rounded-xl border border-slate-300 bg-white px-6 py-3 text-sm font-medium text-slate-700 transition-all hover:bg-slate-50 hover:shadow-md active:scale-[0.98] dark:border-slate-600 dark:bg-slate-900 dark:text-slate-300 dark:hover:bg-slate-800"
+            className="flex w-full items-center justify-center gap-3 rounded-xl border border-slate-300 bg-white px-6 py-3 text-sm font-medium text-slate-700 transition-[color,background-color,border-color,box-shadow,transform] motion-reduce:transition-none hover:bg-slate-50 hover:shadow-md active:scale-[0.98] dark:border-slate-600 dark:bg-slate-900 dark:text-slate-300 dark:hover:bg-slate-800"
           >
             <svg className="h-5 w-5" viewBox="0 0 24 24">
               <path d="M22.56 12.25c0-.78-.07-1.53-.2-2.25H12v4.26h5.92a5.06 5.06 0 0 1-2.2 3.32v2.77h3.57c2.08-1.92 3.28-4.74 3.28-8.1z" fill="#4285F4" />

package/src/portal/reset-password/page.tsx

@@ -82,7 +82,7 @@ function ResetPasswordForm() {
           </div>
           <Link
             href="/support/login"
-            className="block w-full rounded-xl border-3 border-black bg-[#00E5FF] px-6 py-3 text-center text-base font-black text-black shadow-[4px_4px_0px_#000] transition-all hover:translate-x-[2px] hover:translate-y-[2px] hover:shadow-[2px_2px_0px_#000]"
+            className="block w-full rounded-xl border-3 border-black bg-[#00E5FF] px-6 py-3 text-center text-base font-black text-black shadow-[4px_4px_0px_#000] transition-[color,background-color,border-color,box-shadow,transform] motion-reduce:transition-none hover:translate-x-[2px] hover:translate-y-[2px] hover:shadow-[2px_2px_0px_#000]"
           >
             Se connecter
           </Link>
@@ -131,7 +131,7 @@ function ResetPasswordForm() {
           <button
             type="submit"
             disabled={loading}
-            className="w-full rounded-xl border-3 border-black bg-[#00E5FF] px-6 py-3 text-base font-black text-black shadow-[4px_4px_0px_#000] transition-all hover:translate-x-[2px] hover:translate-y-[2px] hover:shadow-[2px_2px_0px_#000] disabled:opacity-50"
+            className="w-full rounded-xl border-3 border-black bg-[#00E5FF] px-6 py-3 text-base font-black text-black shadow-[4px_4px_0px_#000] transition-[color,background-color,border-color,box-shadow,transform] motion-reduce:transition-none hover:translate-x-[2px] hover:translate-y-[2px] hover:shadow-[2px_2px_0px_#000] disabled:opacity-50"
           >
             {loading ? 'Modification...' : 'Modifier le mot de passe'}
           </button>
@@ -143,7 +143,7 @@ function ResetPasswordForm() {
 
 export default function ResetPasswordPage() {
   return (
-    <div className="flex min-h-screen items-center justify-center px-4 py-12">
+    <div className="flex min-h-[100dvh] items-center justify-center px-4 py-12">
       <Suspense fallback={<p className="text-gray-400">Chargement...</p>}>
         <ResetPasswordForm />
       </Suspense>

package/src/styles/ChatView.module.scss

@@ -37,7 +37,7 @@ $font-stack: -apple-system, BlinkMacSystemFont, 'Inter', 'Segoe UI', system-ui,
 .container {
   display: flex;
   gap: 16px;
-  height: calc(100vh - 220px);
+  height: calc(100dvh - 220px);
   min-height: 500px;
 }
 

package/src/styles/TicketDetail.module.scss

@@ -531,7 +531,7 @@
   gap: 8px;
   padding: 8px 14px;
   font-size: 12px;
-  color: #7c3aed;
+  color: #17807c;
   font-weight: 500;
 }
 
@@ -539,7 +539,7 @@
   display: flex;
   gap: 3px;
   span {
-    width: 5px; height: 5px; border-radius: 50%; background: #7c3aed;
+    width: 5px; height: 5px; border-radius: 50%; background: #17807c;
     animation: bounce 1.2s infinite;
     &:nth-child(2) { animation-delay: 150ms; }
     &:nth-child(3) { animation-delay: 300ms; }
@@ -612,7 +612,7 @@
   &:disabled { opacity: 0.4; cursor: not-allowed; }
 }
 
-// Bouton IA — accent purple, pill style
+// AI button — teal accent, pill style
 .toolbarBtnAi {
   background: var(--theme-accent-50, color-mix(in srgb, var(--theme-accent-500, #6b46e8) 10%, transparent));
   border-color: color-mix(in srgb, var(--theme-accent-500, #6b46e8) 25%, transparent);

package/src/styles/_tokens.scss

@@ -18,7 +18,7 @@ $green: #16a34a;
 $amber: #d97706;
 $orange: #ea580c;
 $red: #dc2626;
-$purple: #7c3aed;
+$teal: #17807c;
 $cyan: #0891b2;
 
 // Mixins

package/src/styles/theme.css

@@ -136,7 +136,7 @@
   --support-cat-core: #2563eb;
   --support-cat-communication: #16a34a;
   --support-cat-productivity: #d97706;
-  --support-cat-advanced: #7c3aed;
+  --support-cat-advanced: #17807c;
 
   /* ------------------------------------------
    * 8. PROJECT STATUS COLORS
@@ -385,7 +385,7 @@
   --support-activity-line-color: var(--support-border-color);
   --support-activity-dot-default: var(--support-text-muted);
   --support-activity-dot-status: var(--support-primary);
-  --support-activity-dot-assign: #7c3aed;
+  --support-activity-dot-assign: #17807c;
   --support-activity-dot-merge: #0891b2;
 
   /* ------------------------------------------
@@ -465,10 +465,10 @@
    * Indicator for messages scheduled to be
    * sent at a future date/time.
    * ------------------------------------------ */
-  --support-scheduled-bg: #f5f3ff;
+  --support-scheduled-bg: #eef8f7;
   --support-scheduled-border: #a78bfa;
   --support-scheduled-text: #5b21b6;
-  --support-scheduled-icon: #7c3aed;
+  --support-scheduled-icon: #17807c;
 
   /* ------------------------------------------
    * 34. EMAIL TRACKING
@@ -615,8 +615,8 @@
 
   /* Scheduled */
   --support-scheduled-bg: #2e1065;
-  --support-scheduled-border: #7c3aed;
-  --support-scheduled-text: #c4b5fd;
+  --support-scheduled-border: #17807c;
+  --support-scheduled-text: #80bbb7;
 
   /* Email tracking */
   --support-email-pending: #64748b;

package/src/types.ts

@@ -1,3 +1,7 @@
+import type { RateLimitStore } from './utils/rateLimiter'
+import type { InboundEmailInput } from './utils/webhookSecurity'
+import type { Payload, PayloadRequest } from 'payload'
+
 // ─── Feature flags ───────────────────────────────────────
 
 export interface SupportFeatures {
@@ -76,6 +80,62 @@ export interface EmailConfig {
   replyTo?: string
 }
 
+export interface SmsSendResult {
+  sent: boolean
+  skipped?: boolean
+  error?: string
+}
+
+export interface SmsAdapter {
+  isConfigured?: () => boolean
+  send: (input: {
+    message: string
+    to: string
+    payload: Payload
+    ticket: Record<string, unknown>
+    client: Record<string, unknown>
+  }) => Promise<SmsSendResult>
+}
+
+export interface SupportCapabilities {
+  /** Optional SMS transport. The module never depends on a concrete provider. */
+  sms?: {
+    adapter: SmsAdapter
+    buildMessage?: (input: {
+      client: Record<string, unknown>
+      ticket: Record<string, unknown>
+    }) => string | Promise<string>
+  }
+  /** Native daily/weekly notification queue. */
+  digests?: boolean
+  /** Incoming email business adapter, protected and validated by the module. */
+  inboundEmail?: {
+    handle: (req: PayloadRequest, input: InboundEmailInput) => Promise<Response>
+    secret?: string
+    secretHeader?: string
+  }
+  /** Generate a short, editable display title after ticket creation. */
+  aiTitles?: {
+    generate: (payload: Payload, ticketId: number | string) => Promise<unknown>
+  }
+  /** Override the module's default resolved-ticket synthesis generator. */
+  aiSummaries?: {
+    generate: (payload: Payload, ticketId: number | string) => Promise<unknown>
+  }
+  /** Persist billing lines and their invoicing state. */
+  detailedBilling?: boolean
+  /** Persist pro-bono work and its estimated value. */
+  volunteering?: boolean
+  /** Best-effort cleanup of noisy messages after an inbound client reply. */
+  threadCleanup?: {
+    clean: (payload: Payload, ticketId: number | string, messageId: number | string) => Promise<unknown>
+  }
+  /** Deployment-specific project suggestion adapter. */
+  projectSuggestions?: {
+    suggest: (req: PayloadRequest) => Promise<Response>
+  }
+}
+
 // ─── Plugin configuration ────────────────────────────────
 
 export interface SupportPluginConfig {
@@ -88,6 +148,15 @@ export interface SupportPluginConfig {
   /** Email configuration for ticket notifications */
   email?: EmailConfig
 
+  /** Shared rate-limit storage. Defaults to process-local memory. */
+  rateLimitStore?: RateLimitStore | 'payload'
+
+  /** Sequential ticket number formatting. */
+  ticketNumber?: { prefix?: string; padding?: number }
+
+  /** Optional generic capabilities backed by deployment-specific adapters. */
+  capabilities?: SupportCapabilities
+
   /** Locale: 'fr' or 'en' (default: 'fr') */
   locale?: 'fr' | 'en'
 
@@ -136,6 +205,8 @@ export interface SupportPluginConfig {
     macros?: string
     ticketStatuses?: string
     ticketFeedback?: string
+    rateLimits?: string
+    counters?: string
   }
 
   /** Admin notification collection slug (default: 'admin-notifications') */

package/src/utils/rateLimiter.ts

@@ -1,52 +1,145 @@
+export interface RateLimitEntry {
+  count: number
+  resetAt: number
+}
+
+export interface RateLimitStore {
+  increment(key: string, windowMs: number, context?: unknown): Promise<RateLimitEntry>
+  reset(key: string, context?: unknown): Promise<void>
+}
+
 /**
- * Shared in-memory rate limiter with automatic cleanup.
- * Replaces duplicated rate-limiting logic across endpoints.
+ * Process-local fallback store. Applications running more than one process
+ * should provide a persistent RateLimitStore through the plugin options.
  */
-export class RateLimiter {
-  private store = new Map<string, { count: number; resetAt: number }>()
+export class MemoryRateLimitStore implements RateLimitStore {
+  private readonly entries = new Map<string, RateLimitEntry>()
 
-  constructor(
-    private windowMs: number,
-    private maxRequests: number,
-  ) {
-    // Periodic cleanup to prevent memory leaks
-    const timer = setInterval(() => this.cleanup(), windowMs)
-    timer.unref()
+  async increment(key: string, windowMs: number): Promise<RateLimitEntry> {
+    const now = Date.now()
+    const current = this.entries.get(key)
+    const next = !current || now > current.resetAt
+      ? { count: 1, resetAt: now + windowMs }
+      : { ...current, count: current.count + 1 }
+
+    this.entries.set(key, next)
+    return next
   }
 
-  /**
-   * Check if a key has exceeded the rate limit.
-   * Returns true if the request should be blocked.
-   */
-  check(key: string): boolean {
-    const now = Date.now()
-    const entry = this.store.get(key)
+  async reset(key: string): Promise<void> {
+    this.entries.delete(key)
+  }
+}
 
-    if (!entry || now > entry.resetAt) {
-      this.store.set(key, { count: 1, resetAt: now + this.windowMs })
-      return false
-    }
+interface PayloadRateLimitContext {
+  find(args: Record<string, unknown>): Promise<{ docs: Array<Record<string, unknown>> }>
+  create(args: Record<string, unknown>): Promise<Record<string, unknown>>
+  update(args: Record<string, unknown>): Promise<Record<string, unknown>>
+  delete(args: Record<string, unknown>): Promise<unknown>
+}
 
-    entry.count++
-    return entry.count > this.maxRequests
+type PayloadRateLimitRequest = Pick<PayloadRequest, 'payload' | 'transactionID'>
+
+export class PayloadRateLimitStore implements RateLimitStore {
+  constructor(private readonly collectionSlug = 'support-rate-limits') {}
+
+  async increment(key: string, windowMs: number, context?: unknown): Promise<RateLimitEntry> {
+    const { payload, req } = this.resolveContext(context)
+    const ownsTransaction = req ? await initTransaction(req) : false
+    try {
+      const now = Date.now()
+      const result = await payload.find({
+        collection: this.collectionSlug,
+        where: { key: { equals: key } },
+        limit: 1,
+        depth: 0,
+        overrideAccess: true,
+        ...(req ? { req } : {}),
+      })
+      const current = result.docs[0]
+      const currentResetAt = current?.resetAt ? new Date(String(current.resetAt)).getTime() : 0
+      const next = !current || now > currentResetAt
+        ? { count: 1, resetAt: now + windowMs }
+        : { count: Number(current.count || 0) + 1, resetAt: currentResetAt }
+
+      if (current?.id != null) {
+        await payload.update({
+          collection: this.collectionSlug,
+          id: current.id,
+          data: { count: next.count, resetAt: new Date(next.resetAt).toISOString() },
+          overrideAccess: true,
+          ...(req ? { req } : {}),
+        })
+      } else {
+        await payload.create({
+          collection: this.collectionSlug,
+          data: { key, count: next.count, resetAt: new Date(next.resetAt).toISOString() },
+          overrideAccess: true,
+          ...(req ? { req } : {}),
+        })
+      }
+
+      if (ownsTransaction && req) await commitTransaction(req)
+      return next
+    } catch (error) {
+      if (ownsTransaction && req) await killTransaction(req)
+      throw error
+    }
   }
 
-  /**
-   * Reset the counter for a specific key.
-   */
-  reset(key: string): void {
-    this.store.delete(key)
+  async reset(key: string, context?: unknown): Promise<void> {
+    const { payload, req } = this.resolveContext(context)
+    const ownsTransaction = req ? await initTransaction(req) : false
+    try {
+      await payload.delete({
+        collection: this.collectionSlug,
+        where: { key: { equals: key } },
+        overrideAccess: true,
+        ...(req ? { req } : {}),
+      })
+      if (ownsTransaction && req) await commitTransaction(req)
+    } catch (error) {
+      if (ownsTransaction && req) await killTransaction(req)
+      throw error
+    }
   }
 
-  /**
-   * Remove expired entries from the store.
-   */
-  private cleanup(): void {
-    const now = Date.now()
-    for (const [key, entry] of this.store) {
-      if (now > entry.resetAt) {
-        this.store.delete(key)
-      }
+  private resolveContext(context: unknown): {
+    payload: PayloadRateLimitContext
+    req?: PayloadRateLimitRequest
+  } {
+    if (!context || typeof context !== 'object') {
+      throw new Error('PayloadRateLimitStore requires the current Payload request or instance')
     }
+    if ('payload' in context) {
+      const req = context as PayloadRateLimitRequest
+      return { payload: req.payload as unknown as PayloadRateLimitContext, req }
+    }
+    return { payload: context as PayloadRateLimitContext }
+  }
+}
+
+export class RateLimiter {
+  private readonly store: RateLimitStore
+
+  constructor(
+    private readonly windowMs: number,
+    private readonly maxRequests: number,
+    store?: RateLimitStore,
+  ) {
+    this.store = store ?? new MemoryRateLimitStore()
+  }
+
+  async check(key: string, context?: unknown): Promise<boolean> {
+    const entry = context === undefined
+      ? await this.store.increment(key, this.windowMs)
+      : await this.store.increment(key, this.windowMs, context)
+    return entry.count > this.maxRequests
+  }
+
+  async reset(key: string, context?: unknown): Promise<void> {
+    if (context === undefined) await this.store.reset(key)
+    else await this.store.reset(key, context)
   }
 }
+import { commitTransaction, initTransaction, killTransaction, type PayloadRequest } from 'payload'

package/src/utils/slugs.ts

@@ -24,6 +24,8 @@ export interface CollectionSlugs {
   automationRules: string
   supportTeams: string
   pushSubscriptions: string
+  rateLimits: string
+  counters: string
   users: string
   media: string
 }
@@ -50,6 +52,8 @@ export const DEFAULT_SLUGS: CollectionSlugs = {
   automationRules: 'automation-rules',
   supportTeams: 'support-teams',
   pushSubscriptions: 'push-subscriptions',
+  rateLimits: 'support-rate-limits',
+  counters: 'support-counters',
   users: 'users',
   media: 'media',
 }

package/src/utils/webhookSecurity.ts

@@ -0,0 +1,81 @@
+import { createHash, timingSafeEqual } from 'crypto'
+
+export interface InboundEmailLimits {
+  maxRequestBytes: number
+  maxAttachmentBytes: number
+  maxAttachments: number
+  maxSubjectLength: number
+  maxNameLength: number
+  maxEmailLength: number
+  maxBodyLength: number
+}
+
+export const DEFAULT_INBOUND_EMAIL_LIMITS: InboundEmailLimits = {
+  maxRequestBytes: 25 * 1024 * 1024,
+  maxAttachmentBytes: 10 * 1024 * 1024,
+  maxAttachments: 10,
+  maxSubjectLength: 1_000,
+  maxNameLength: 500,
+  maxEmailLength: 320,
+  maxBodyLength: 38_000,
+}
+
+interface InboundAttachment {
+  filename?: string
+  size?: number
+  content?: string
+}
+
+export interface InboundEmailInput {
+  senderEmail?: string
+  senderName?: string
+  recipientEmail?: string
+  cc?: string
+  subject?: string
+  body?: string
+  htmlBody?: string
+  attachments?: InboundAttachment[]
+}
+
+export interface InboundEmailValidationError {
+  code: 'request_too_large' | 'too_many_attachments' | 'attachment_too_large' | 'text_field_too_large'
+  status: 413
+}
+
+export function verifySecret(provided: string | null | undefined, expected: string | null | undefined): boolean {
+  if (!provided || !expected) return false
+  const providedDigest = createHash('sha256').update(provided).digest()
+  const expectedDigest = createHash('sha256').update(expected).digest()
+  return timingSafeEqual(providedDigest, expectedDigest)
+}
+
+export function validateInboundEmailPayload(
+  input: InboundEmailInput,
+  contentLength?: number,
+  limits: InboundEmailLimits = DEFAULT_INBOUND_EMAIL_LIMITS,
+): InboundEmailValidationError | null {
+  if (contentLength != null && contentLength > limits.maxRequestBytes) {
+    return { code: 'request_too_large', status: 413 }
+  }
+
+  const attachments = Array.isArray(input.attachments) ? input.attachments : []
+  if (attachments.length > limits.maxAttachments) {
+    return { code: 'too_many_attachments', status: 413 }
+  }
+  for (const attachment of attachments) {
+    const decodedSize = attachment.content ? Math.ceil(attachment.content.length * 0.75) : 0
+    if (Math.max(Number(attachment.size || 0), decodedSize) > limits.maxAttachmentBytes) {
+      return { code: 'attachment_too_large', status: 413 }
+    }
+  }
+
+  const tooLong =
+    (input.subject?.length || 0) > limits.maxSubjectLength ||
+    (input.senderName?.length || 0) > limits.maxNameLength ||
+    (input.senderEmail?.length || 0) > limits.maxEmailLength ||
+    (input.recipientEmail?.length || 0) > limits.maxEmailLength ||
+    (input.cc?.length || 0) > limits.maxEmailLength ||
+    (input.body?.length || 0) > limits.maxBodyLength ||
+    (input.htmlBody?.length || 0) > limits.maxBodyLength
+  return tooLong ? { code: 'text_field_too_large', status: 413 } : null
+}

package/src/views/SupportDashboardView/client.tsx

@@ -540,7 +540,7 @@ export const SupportDashboardClient: React.FC = () => {
 
           {/* CSAT ring */}
           <div className={styles.panel}>
-            <h2 className={styles.panelTitle}>{t('dashboard.csat')}</h2>
+            <h2 className={styles.panelTitle}>{t('dashboard.csatTitle')}</h2>
             <CSATRing score={stats.satisfactionAvg} count={stats.satisfactionCount} />
           </div>
         </div>

package/src/views/TicketingSettingsView/client.tsx

@@ -206,7 +206,7 @@ function getCategories(t: (key: string) => string) {
     { key: 'core', label: t('settingsView.categories.core'), color: V.blue },
     { key: 'communication', label: t('settingsView.categories.communication'), color: V.green },
     { key: 'productivity', label: t('settingsView.categories.productivity'), color: V.amber },
-    { key: 'advanced', label: t('settingsView.categories.advanced'), color: '#7c3aed' },
+    { key: 'advanced', label: t('settingsView.categories.advanced'), color: '#17807c' },
   ]
 }
 
@@ -413,7 +413,7 @@ export const TicketingSettingsClient: React.FC = () => {
        * SECTION 1 — Feature Flags
        * ======================================== */}
       <CollapsibleSection
-        title={t('settingsView.features')}
+        title={t('settingsView.featuresTitle')}
         icon={<Settings size={16} />}
         color={V.blue}
         badge={
@@ -532,7 +532,7 @@ export const TicketingSettingsClient: React.FC = () => {
       <CollapsibleSection
         title={t('settingsView.aiTitle')}
         icon={<Bot size={16} />}
-        color="#7c3aed"
+        color="#17807c"
         defaultOpen={false}
         badge={
           features.ai
@@ -604,7 +604,7 @@ export const TicketingSettingsClient: React.FC = () => {
             <Toggle
               checked={settings.ai[item.key]}
               onChange={() => updateAI(item.key, !settings.ai[item.key])}
-              color="#7c3aed"
+              color="#17807c"
               size="sm"
             />
             <div style={{ flex: 1 }}>