@consilioweb/payload-support 2.0.1 → 3.0.0

package/src/utils/features.ts

@@ -0,0 +1,297 @@
+/**
+ * Ticketing feature flags — single source of truth (client + server).
+ *
+ * Flags are stored SERVER-side, in the `support-settings` row of
+ * `payload-preferences` (see `readSettings.ts` and `endpoints/settings.ts`).
+ * A flag toggled on one machine therefore applies to every browser and to
+ * server-side code (hooks, cron endpoints) alike.
+ *
+ * `localStorage` is still used, but demoted to a plain CACHE: it lets admin
+ * views paint synchronously on first render and keeps them usable when the
+ * settings endpoint is unreachable. It is never authoritative.
+ *
+ * Two flags are *projections* of settings that already lived server-side long
+ * before this module, and are deliberately NOT stored twice:
+ *   - `autoClose`     ← `settings.autoClose.enabled`
+ *   - `autoCloseDays` ← `settings.autoClose.daysBeforeClose`
+ * The `autoClose` block stays authoritative; the flags are recomputed on read
+ * and dropped on write. See `projectAutoClose` / `stripProjectedFeatures`.
+ */
+
+/**
+ * Feature flags for the ticketing module.
+ * Each feature can be enabled/disabled by the admin.
+ * When disabled, the corresponding UI section is hidden entirely.
+ */
+export interface TicketingFeatures {
+  /** Time tracking: timer, manual entries, billing */
+  timeTracking: boolean
+  /** AI features: sentiment, synthesis, suggestion, rewrite */
+  ai: boolean
+  /** Satisfaction surveys: CSAT rating after resolution */
+  satisfaction: boolean
+  /** Live chat integration: chat → ticket conversion */
+  chat: boolean
+  /** Email tracking: pixel tracking, open/sent status per message */
+  emailTracking: boolean
+  /** Canned responses: quick reply templates */
+  canned: boolean
+  /** Ticket merge: combine two tickets into one */
+  merge: boolean
+  /** Snooze: temporarily hide a ticket */
+  snooze: boolean
+  /** External messages: add messages received outside the system */
+  externalMessages: boolean
+  /** Client history: past tickets, projects, notes sidebar */
+  clientHistory: boolean
+  /** Activity log: audit trail of actions on the ticket */
+  activityLog: boolean
+  /** Split ticket: extract a message into a new ticket */
+  splitTicket: boolean
+  /** Scheduled replies: send a message at a future date */
+  scheduledReplies: boolean
+  /** Auto-close: automatically resolve inactive tickets (projection of settings.autoClose.enabled) */
+  autoClose: boolean
+  /** Auto-close delay in days (projection of settings.autoClose.daysBeforeClose) */
+  autoCloseDays: number
+  /** Round-robin: distribute new tickets evenly among agents */
+  roundRobin: boolean
+}
+
+/** Default features — all enabled except round-robin */
+export const DEFAULT_TICKETING_FEATURES: TicketingFeatures = {
+  timeTracking: true,
+  ai: true,
+  satisfaction: true,
+  chat: true,
+  emailTracking: true,
+  canned: true,
+  merge: true,
+  snooze: true,
+  externalMessages: true,
+  clientHistory: true,
+  activityLog: true,
+  splitTicket: true,
+  scheduledReplies: true,
+  autoClose: true,
+  autoCloseDays: 7,
+  roundRobin: false,
+}
+
+type BooleanFeatureKey = Exclude<keyof TicketingFeatures, 'autoCloseDays'>
+
+const BOOLEAN_FEATURE_KEYS: readonly BooleanFeatureKey[] = [
+  'timeTracking',
+  'ai',
+  'satisfaction',
+  'chat',
+  'emailTracking',
+  'canned',
+  'merge',
+  'snooze',
+  'externalMessages',
+  'clientHistory',
+  'activityLog',
+  'splitTicket',
+  'scheduledReplies',
+  'autoClose',
+  'roundRobin',
+]
+
+/** Flags derived from another settings block — never persisted inside `features`. */
+const PROJECTED_FEATURE_KEYS = ['autoClose', 'autoCloseDays'] as const
+
+/**
+ * Coerce arbitrary input (stale localStorage, hand-edited preference row, older
+ * plugin version) into a complete, well-typed feature set. Unknown keys are
+ * dropped and wrongly-typed values fall back to their default.
+ */
+export function normalizeFeatures(raw: unknown): TicketingFeatures {
+  const out = { ...DEFAULT_TICKETING_FEATURES }
+  if (!raw || typeof raw !== 'object') return out
+
+  const src = raw as Record<string, unknown>
+  for (const key of BOOLEAN_FEATURE_KEYS) {
+    if (typeof src[key] === 'boolean') out[key] = src[key] as boolean
+  }
+
+  const days = src.autoCloseDays
+  if (typeof days === 'number' && Number.isFinite(days) && days >= 1) {
+    out.autoCloseDays = Math.floor(days)
+  }
+
+  return out
+}
+
+/** Shape of the `autoClose` settings block the two projected flags mirror. */
+export interface AutoCloseProjectionSource {
+  enabled?: boolean
+  daysBeforeClose?: number
+}
+
+/** Recompute the projected flags from the authoritative `autoClose` block. */
+export function projectAutoClose(
+  features: TicketingFeatures,
+  autoClose: AutoCloseProjectionSource | undefined,
+): TicketingFeatures {
+  if (!autoClose) return features
+  return {
+    ...features,
+    autoClose: typeof autoClose.enabled === 'boolean' ? autoClose.enabled : features.autoClose,
+    autoCloseDays:
+      typeof autoClose.daysBeforeClose === 'number' && autoClose.daysBeforeClose >= 1
+        ? Math.floor(autoClose.daysBeforeClose)
+        : features.autoCloseDays,
+  }
+}
+
+/**
+ * Drop the projected flags before persisting, so `features` and the `autoClose`
+ * block can never disagree.
+ */
+export function stripProjectedFeatures(
+  features: TicketingFeatures,
+): Omit<TicketingFeatures, (typeof PROJECTED_FEATURE_KEYS)[number]> {
+  const out = { ...features } as Record<string, unknown>
+  for (const key of PROJECTED_FEATURE_KEYS) delete out[key]
+  return out as Omit<TicketingFeatures, (typeof PROJECTED_FEATURE_KEYS)[number]>
+}
+
+// ─── Client-side cache ───────────────────────────────────
+
+/** localStorage key. Was the source of truth before 2.1 — now only a cache. */
+export const FEATURES_CACHE_KEY = 'ticketing_features'
+/** Set once the pre-2.1 localStorage values have been pushed to the server. */
+export const FEATURES_ADOPTED_KEY = 'ticketing_features_adopted'
+/** Admin-only settings endpoint backing the flags. */
+export const FEATURES_ENDPOINT = '/api/support/settings'
+
+/** localStorage can throw (Safari private mode, disabled storage) — never let it bubble. */
+function storage(): Storage | null {
+  try {
+    if (typeof window === 'undefined' || !window.localStorage) return null
+    return window.localStorage
+  } catch {
+    return null
+  }
+}
+
+/** Read the cached flags, or `null` when nothing usable is cached. */
+export function readFeaturesCache(): TicketingFeatures | null {
+  const store = storage()
+  if (!store) return null
+  try {
+    const stored = store.getItem(FEATURES_CACHE_KEY)
+    if (!stored) return null
+    return normalizeFeatures(JSON.parse(stored))
+  } catch {
+    return null
+  }
+}
+
+/** Refresh the cache with the values the server just confirmed. */
+export function writeFeaturesCache(features: TicketingFeatures): void {
+  const store = storage()
+  if (!store) return
+  try {
+    store.setItem(FEATURES_CACHE_KEY, JSON.stringify(features))
+  } catch {
+    /* quota exceeded / storage disabled — the server copy still stands */
+  }
+}
+
+/**
+ * Synchronous read used for first paint. Returns the cache when present, the
+ * defaults otherwise. Callers must still refresh from the server — see
+ * `useFeatures`.
+ */
+export function getFeatures(): TicketingFeatures {
+  return readFeaturesCache() ?? { ...DEFAULT_TICKETING_FEATURES }
+}
+
+// ─── One-shot migration of pre-2.1 localStorage ──────────
+
+/** True once this browser's legacy flags have been handed over to the server. */
+export function hasAdoptedLegacyFeatures(): boolean {
+  const store = storage()
+  if (!store) return true // nothing to migrate without storage
+  try {
+    return store.getItem(FEATURES_ADOPTED_KEY) === '1'
+  } catch {
+    return true
+  }
+}
+
+export function markLegacyFeaturesAdopted(): void {
+  const store = storage()
+  if (!store) return
+  try {
+    store.setItem(FEATURES_ADOPTED_KEY, '1')
+  } catch {
+    /* ignore */
+  }
+}
+
+/**
+ * Flags this browser configured before the server became authoritative, or
+ * `null` when there is nothing to migrate (no local values, or already done).
+ */
+export function readLegacyFeatures(): TicketingFeatures | null {
+  if (hasAdoptedLegacyFeatures()) return null
+  return readFeaturesCache()
+}
+
+// ─── Server round-trips ──────────────────────────────────
+
+export interface FetchedFeatures {
+  features: TicketingFeatures
+  /** False when the server has never had feature flags saved (fresh install). */
+  configured: boolean
+  /** True when the values come from the cache/defaults because the call failed. */
+  offline: boolean
+}
+
+/**
+ * Read the flags from the server. Falls back to the local cache, then to the
+ * defaults: a failed settings call must never leave a ticket screen unusable.
+ */
+export async function fetchFeatures(signal?: AbortSignal): Promise<FetchedFeatures> {
+  try {
+    const res = await fetch(FEATURES_ENDPOINT, { credentials: 'include', signal })
+    if (res.ok) {
+      const data = (await res.json()) as {
+        features?: unknown
+        featuresConfigured?: boolean
+        autoClose?: AutoCloseProjectionSource
+      }
+      const features = projectAutoClose(normalizeFeatures(data.features), data.autoClose)
+      writeFeaturesCache(features)
+      return { features, configured: data.featuresConfigured === true, offline: false }
+    }
+  } catch {
+    /* network error / aborted — fall through to the cache */
+  }
+  return { features: getFeatures(), configured: false, offline: true }
+}
+
+/**
+ * Persist the flags server-side, then refresh the local cache.
+ *
+ * @returns true when the server accepted the write.
+ */
+export async function saveFeatures(features: TicketingFeatures): Promise<boolean> {
+  const normalized = normalizeFeatures(features)
+  try {
+    const res = await fetch(FEATURES_ENDPOINT, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      credentials: 'include',
+      body: JSON.stringify({ features: normalized }),
+    })
+    if (!res.ok) return false
+    writeFeaturesCache(normalized)
+    return true
+  } catch {
+    return false
+  }
+}

package/src/utils/fireWebhooks.ts

@@ -6,6 +6,12 @@ import { dbFind, dbUpdate } from './db'
  * Fire all active webhooks matching the given event.
  * Uses fire-and-forget pattern (Promise.allSettled) so hook callers are never blocked.
  * Each webhook request has a 10-second timeout.
+ *
+ * @deprecated Use `dispatchWebhook` instead. This transport sends the endpoint
+ * secret IN CLEAR in the `X-Webhook-Secret` header, which contradicts the
+ * description of the `secret` field (HMAC-SHA256 signature) and defeats the point
+ * of signing. No hook in the plugin calls it any more — it stays exported only
+ * because it is part of the public surface, and will be removed in the next major.
  */
 export async function fireWebhooks(
   payload: Payload,

package/src/utils/generateTicketSynthesis.ts

@@ -2,12 +2,13 @@ import type { Payload } from 'payload'
 import type { CollectionSlugs } from './slugs'
 import { readSupportSettings, type SupportSettings } from './readSettings'
 import { dbFindByID, dbUpdate, dbFind } from './db'
+import { resolveOllamaBaseUrl } from './aiProvider'
 
 function getClient(aiSettings: SupportSettings['ai']) {
   // eslint-disable-next-line @typescript-eslint/no-require-imports
   const Anthropic = require('@anthropic-ai/sdk').default
   if (aiSettings.provider === 'ollama') {
-    const baseURL = process.env.OLLAMA_API_URL || 'https://ollama.orkelis.app/v1'
+    const baseURL = resolveOllamaBaseUrl()
     return new Anthropic({ apiKey: 'ollama', baseURL })
   }
   return new Anthropic({ apiKey: process.env.ANTHROPIC_API_KEY })

package/src/utils/index.ts

@@ -1,5 +1,7 @@
-export { readSupportSettings, DEFAULT_SETTINGS } from './readSettings'
-export type { SupportSettings } from './readSettings'
+export { readSupportSettings, readSupportSettingsState, mergeSupportSettings, invalidateSupportSettingsCache, DEFAULT_SETTINGS } from './readSettings'
+export type { SupportSettings, SupportSettingsState } from './readSettings'
+export { DEFAULT_TICKETING_FEATURES, normalizeFeatures, projectAutoClose, stripProjectedFeatures } from './features'
+export type { TicketingFeatures } from './features'
 export { resolveSlugs, DEFAULT_SLUGS } from './slugs'
 export type { CollectionSlugs } from './slugs'
 export { RateLimiter } from './rateLimiter'

package/src/utils/readSettings.ts

@@ -1,14 +1,25 @@
 import type { Payload } from 'payload'
 import { dbFind } from './db'
+import {
+  DEFAULT_TICKETING_FEATURES,
+  normalizeFeatures,
+  projectAutoClose,
+  type TicketingFeatures,
+} from './features'
 
-const PREF_KEY = 'support-settings'
+export const SUPPORT_SETTINGS_PREF_KEY = 'support-settings'
+const PREF_KEY = SUPPORT_SETTINGS_PREF_KEY
 const USER_PREFS_KEY_PREFIX = 'support-user-prefs'
+/** Pre-2.1 standalone round-robin row — read as a fallback, then folded into `features`. */
+const LEGACY_ROUND_ROBIN_KEY = 'support-round-robin'
 
 export interface SupportSettings {
   email: { fromAddress: string; fromName: string; replyToAddress: string }
   ai: { provider: string; model: string; enableSentiment: boolean; enableSynthesis: boolean; enableSuggestion: boolean; enableRewrite: boolean }
   sla: { firstResponseMinutes: number; resolutionMinutes: number; businessHoursOnly: boolean; escalationEmail: string }
   autoClose: { enabled: boolean; daysBeforeClose: number; reminderDaysBefore: number }
+  /** Ticketing feature flags — server-authoritative since 2.1 (used to be per-browser localStorage). */
+  features: TicketingFeatures
 }
 
 export interface UserPrefs {
@@ -21,6 +32,7 @@ export const DEFAULT_SETTINGS: SupportSettings = {
   ai: { provider: 'anthropic', model: 'claude-haiku-4-5-20251001', enableSentiment: true, enableSynthesis: true, enableSuggestion: true, enableRewrite: true },
   sla: { firstResponseMinutes: 120, resolutionMinutes: 1440, businessHoursOnly: true, escalationEmail: '' },
   autoClose: { enabled: true, daysBeforeClose: 7, reminderDaysBefore: 2 },
+  features: { ...DEFAULT_TICKETING_FEATURES },
 }
 
 export const DEFAULT_USER_PREFS: UserPrefs = {
@@ -32,38 +44,99 @@ export const DEFAULT_USER_PREFS: UserPrefs = {
 // (the afterChange hook chain). The settings doc changes rarely, so a short TTL
 // + explicit invalidation on save (endpoints/settings.ts) avoids redundant DB
 // reads of the same `payload-preferences` row.
-let settingsCache: { value: SupportSettings; ts: number } | null = null
+let settingsCache: { value: SupportSettingsState; ts: number } | null = null
 const SETTINGS_TTL_MS = 60_000
 
+export interface SupportSettingsState {
+  settings: SupportSettings
+  /**
+   * False when the preference row carries no `features` object yet — a
+   * pre-2.1 install, or a fresh one. Clients use it to decide whether their
+   * legacy `localStorage` flags should seed the server.
+   */
+  featuresConfigured: boolean
+}
+
 /** Invalidate the settings cache — call right after writing support settings. */
 export function invalidateSupportSettingsCache(): void {
   settingsCache = null
 }
 
-export async function readSupportSettings(payload: Payload): Promise<SupportSettings> {
+/**
+ * Merge a stored preference value onto the defaults.
+ * Exported for the settings endpoint, which must not re-implement the merge.
+ */
+export function mergeSupportSettings(
+  stored: Partial<SupportSettings> | undefined | null,
+  base: SupportSettings = DEFAULT_SETTINGS,
+): SupportSettings {
+  const autoClose = { ...base.autoClose, ...stored?.autoClose }
+  return {
+    email: { ...base.email, ...stored?.email },
+    ai: { ...base.ai, ...stored?.ai },
+    sla: { ...base.sla, ...stored?.sla },
+    autoClose,
+    // `autoClose` / `autoCloseDays` are projections of the block above, so they
+    // are recomputed here rather than trusted from whatever was persisted.
+    features: projectAutoClose(
+      normalizeFeatures({ ...base.features, ...(stored?.features as object | undefined) }),
+      autoClose,
+    ),
+  }
+}
+
+export async function readSupportSettingsState(payload: Payload): Promise<SupportSettingsState> {
   if (settingsCache && Date.now() - settingsCache.ts < SETTINGS_TTL_MS) {
     return settingsCache.value
   }
-  let value: SupportSettings = { ...DEFAULT_SETTINGS }
+  let value: SupportSettingsState = {
+    settings: mergeSupportSettings(null),
+    featuresConfigured: false,
+  }
   try {
     const prefs = await dbFind(payload, 'payload-preferences', {
       where: { key: { equals: PREF_KEY } },
+      // The upsert is scoped per admin user, so several rows can share the key.
+      // Sorting makes "last write wins" deterministic instead of arbitrary.
+      sort: '-updatedAt',
       limit: 1, depth: 0, overrideAccess: true,
     })
     if (prefs.docs.length > 0) {
       const stored = prefs.docs[0].value as Partial<SupportSettings>
-      value = {
-        email: { ...DEFAULT_SETTINGS.email, ...stored.email },
-        ai: { ...DEFAULT_SETTINGS.ai, ...stored.ai },
-        sla: { ...DEFAULT_SETTINGS.sla, ...stored.sla },
-        autoClose: { ...DEFAULT_SETTINGS.autoClose, ...stored.autoClose },
+      const featuresConfigured = !!stored.features && typeof stored.features === 'object'
+      const settings = mergeSupportSettings(stored)
+
+      // Pre-2.1 installs enabled round-robin through its own preference row.
+      // Honour it until the first save writes `features` — after that the
+      // legacy row is ignored, and both write paths land in `features`.
+      if (!featuresConfigured) {
+        settings.features.roundRobin = await readLegacyRoundRobin(payload)
       }
+
+      value = { settings, featuresConfigured }
     }
   } catch { /* fallback to defaults */ }
   settingsCache = { value, ts: Date.now() }
   return value
 }
 
+export async function readSupportSettings(payload: Payload): Promise<SupportSettings> {
+  return (await readSupportSettingsState(payload)).settings
+}
+
+async function readLegacyRoundRobin(payload: Payload): Promise<boolean> {
+  try {
+    const prefs = await dbFind(payload, 'payload-preferences', {
+      where: { key: { equals: LEGACY_ROUND_ROBIN_KEY } },
+      limit: 1, depth: 0, overrideAccess: true,
+    })
+    if (prefs.docs.length > 0) {
+      return (prefs.docs[0].value as { enabled?: boolean })?.enabled === true
+    }
+  } catch { /* ignore — defaults to disabled */ }
+  return DEFAULT_TICKETING_FEATURES.roundRobin
+}
+
 export async function readUserPrefs(payload: Payload, userId: string | number): Promise<UserPrefs> {
   try {
     const key = `${USER_PREFS_KEY_PREFIX}-${userId}`

package/src/utils/webhookDispatcher.ts

@@ -3,7 +3,16 @@ import type { BasePayload } from 'payload'
 import type { CollectionSlugs } from './slugs'
 import { dbFind, dbUpdate } from './db'
 
-type WebhookEvent = 'ticket_created' | 'ticket_resolved' | 'ticket_replied' | 'sla_breached'
+/**
+ * Outbound webhook events. Must stay in sync with the `events` options of the
+ * webhook-endpoints collection.
+ */
+export type WebhookEvent =
+  | 'ticket_created'
+  | 'ticket_resolved'
+  | 'ticket_replied'
+  | 'ticket_assigned'
+  | 'sla_breached'
 
 /**
  * Dispatch outbound webhooks for a given event.
@@ -21,9 +30,12 @@ export function dispatchWebhook(
   event: WebhookEvent,
   payload: BasePayload,
   slugs: CollectionSlugs,
-): void {
-  // Fire and forget — do not await
-  void _dispatch(data, event, payload, slugs)
+): Promise<void> {
+  // Fire and forget for callers (hooks never await it); the promise is returned so
+  // tests — and any caller that wants to — can wait for delivery to settle.
+  const done = _dispatch(data, event, payload, slugs)
+  void done
+  return done
 }
 
 async function _dispatch(
@@ -49,9 +61,9 @@ async function _dispatch(
 
     const body = JSON.stringify({ event, data, timestamp: new Date().toISOString() })
 
-    for (const endpoint of endpoints) {
-      void _sendToEndpoint(endpoint as any, body, payload, slugs)
-    }
+    await Promise.allSettled(
+      endpoints.map((endpoint) => _sendToEndpoint(endpoint as any, body, payload, slugs)),
+    )
   } catch (err) {
     console.error(`[webhook] Failed to fetch endpoints for event ${event}:`, err)
   }

package/src/views/ChatView/client.tsx

@@ -40,6 +40,11 @@ export const ChatViewClient: React.FC = () => {
   const sessionsPollTimeout = useRef<NodeJS.Timeout>(undefined)
   const messagesPollInterval = useRef(3000)
   const messagesPollTimeout = useRef<NodeJS.Timeout>(undefined)
+  // Serialized snapshot of the last sessions payload. The change detection MUST
+  // live outside the setSessions updater: React skips the updater entirely on the
+  // eager-state path, so a flag assigned inside it stops being written after the
+  // first render and the adaptive backoff then climbs to its ceiling and stays there.
+  const sessionsSnapshotRef = useRef<string>('')
 
   // Fetch sessions list
   const [sessionExpired, setSessionExpired] = useState(false)
@@ -50,15 +55,14 @@ export const ChatViewClient: React.FC = () => {
       if (res.status === 401 || res.status === 403) { setSessionExpired(true); return }
       if (res.ok) {
         const data = await res.json()
-        setSessions((prev) => {
-          const newActive = data.active || []
-          const newClosed = data.closed || []
-          if (JSON.stringify(prev.active) !== JSON.stringify(newActive) || JSON.stringify(prev.closed) !== JSON.stringify(newClosed)) {
-            hadChanges = true
-            return { active: newActive, closed: newClosed }
-          }
-          return prev
-        })
+        const newActive = data.active || []
+        const newClosed = data.closed || []
+        const snapshot = JSON.stringify([newActive, newClosed])
+        if (snapshot !== sessionsSnapshotRef.current) {
+          sessionsSnapshotRef.current = snapshot
+          hadChanges = true
+          setSessions({ active: newActive, closed: newClosed })
+        }
       }
     } catch { /* ignore */ }
     setLoading(false)

package/src/views/CrmView/client.tsx

@@ -144,26 +144,25 @@ export const CrmClient: React.FC = () => {
   const fetchDetail = useCallback(async (clientId: number) => {
     setDetailLoading(true)
     try {
-      const [clientRes, ticketsRes, projectsRes, timeRes] = await Promise.all([
+      const [clientRes, ticketsRes, projectsRes] = await Promise.all([
         fetch(`/api/support-clients/${clientId}?depth=0`),
         fetch(`/api/tickets?where[client][equals]=${clientId}&sort=-createdAt&limit=20&depth=0`),
         fetch(`/api/projects?where[client][equals]=${clientId}&depth=0`),
-        fetch(`/api/time-entries?limit=0&depth=0`),
       ])
 
       const client = clientRes.ok ? await clientRes.json() : null
       const tickets = ticketsRes.ok ? (await ticketsRes.json()).docs || [] : []
       const projects = projectsRes.ok ? (await projectsRes.json()).docs || [] : []
 
-      // Get time entries for this client's tickets
-      const ticketIds = tickets.map((t: { id: number }) => t.id)
-      let totalTimeMinutes = 0
-      if (timeRes.ok) {
-        const timeData = await timeRes.json()
-        totalTimeMinutes = timeData.docs
-          .filter((e: { ticket: number }) => ticketIds.includes(e.ticket))
-          .reduce((sum: number, e: { duration: number }) => sum + (e.duration || 0), 0)
-      }
+      // Sum the per-ticket rollup maintained by the TimeEntries afterChange /
+      // afterDelete hooks. This used to download the ENTIRE time-entries table
+      // (via limit=0, which does not mean "no document") only to keep the rows whose
+      // ticket is one of the 20 listed here — same result, O(1) payload instead of
+      // O(all time entries ever recorded).
+      const totalTimeMinutes = tickets.reduce(
+        (sum: number, t: { totalTimeMinutes?: number }) => sum + (t.totalTimeMinutes || 0),
+        0,
+      )
 
       const openTickets = tickets.filter((t: { status: string }) =>
         ['open', 'waiting_client'].includes(t.status),

package/src/views/TicketDetailView/client.tsx

@@ -6,7 +6,7 @@ import Link from 'next/link'
 import { RichTextEditor, type RichTextEditorHandle } from '../../components/RichTextEditor/index'
 import { hasCodeBlocks, MessageWithCodeBlocks, CodeBlockRendererHtml } from '../../components/TicketConversation/components/CodeBlock'
 import { CodeBlockInserter } from '../../components/TicketConversation/components/CodeBlockInserter'
-import { getFeatures } from '../shared/config'
+import { useFeatures } from '../../components/TicketConversation/hooks/useFeatures'
 import { computeSlaState, formatSlaRemaining } from '../shared/sla'
 import { useTranslation } from '../../components/TicketConversation/hooks/useTranslation'
 import { DATE_LOCALE } from '../shared/dateLocale'
@@ -21,7 +21,7 @@ export const TicketDetailClient: React.FC = () => {
   const { t } = useTranslation()
   const searchParams = useSearchParams()
   const ticketId = searchParams.get('id')
-  const features = getFeatures()
+  const { features } = useFeatures()
   const editorRef = useRef<RichTextEditorHandle>(null)
   const threadEndRef = useRef<HTMLDivElement>(null)
   const dropdownRef = useRef<HTMLDivElement>(null)

package/src/views/TicketInboxView/client.tsx

@@ -165,12 +165,17 @@ export const TicketInboxClient: React.FC = () => {
       try {
         // Exclude snoozed tickets from the counts too (mirrors the list query).
         const sn = `where[and][0][or][0][snoozeUntil][exists]=false&where[and][0][or][1][snoozeUntil][less_than_equal]=${encodeURIComponent(new Date().toISOString())}`
+        // `/count` is a real SQL COUNT. The previous limit=0 idiom did NOT mean
+        // "no document": Payload disables pagination for limit=0, skips the count
+        // query and derives totalDocs from the rows it just materialised — so each
+        // of these five counters used to read the whole tickets table (relations
+        // included) just to display a badge.
         const [all, openRes, waiting, resolved, breach] = await Promise.all([
-          fetch(`/api/tickets?limit=0&depth=0&${sn}`, { credentials: 'include' }),
-          fetch(`/api/tickets?limit=0&depth=0&where[status][equals]=open&${sn}`, { credentials: 'include' }),
-          fetch(`/api/tickets?limit=0&depth=0&where[status][equals]=waiting_client&${sn}`, { credentials: 'include' }),
-          fetch(`/api/tickets?limit=0&depth=0&where[status][equals]=resolved&${sn}`, { credentials: 'include' }),
-          fetch(`/api/tickets?limit=0&depth=0&where[or][0][slaFirstResponseBreached][equals]=true&where[or][1][slaResolutionBreached][equals]=true&${sn}`, { credentials: 'include' }),
+          fetch(`/api/tickets/count?${sn}`, { credentials: 'include' }),
+          fetch(`/api/tickets/count?where[status][equals]=open&${sn}`, { credentials: 'include' }),
+          fetch(`/api/tickets/count?where[status][equals]=waiting_client&${sn}`, { credentials: 'include' }),
+          fetch(`/api/tickets/count?where[status][equals]=resolved&${sn}`, { credentials: 'include' }),
+          fetch(`/api/tickets/count?where[or][0][slaFirstResponseBreached][equals]=true&where[or][1][slaResolutionBreached][equals]=true&${sn}`, { credentials: 'include' }),
         ])
         const [a, o, w, r, b] = await Promise.all([all.json(), openRes.json(), waiting.json(), resolved.json(), breach.json()])
         setCounts({