@consilioweb/payload-support 5.0.0 → 6.0.1

package/dist/index.d.ts

@@ -65,6 +65,94 @@ declare class RateLimiter {
     reset(key: string, context?: unknown): Promise<void>;
 }
 
+/**
+ * Default collection slugs used by the support plugin.
+ * All slugs can be overridden via SupportPluginConfig.collectionSlugs.
+ */
+interface CollectionSlugs {
+    tickets: string;
+    ticketMessages: string;
+    supportClients: string;
+    timeEntries: string;
+    cannedResponses: string;
+    ticketActivityLog: string;
+    satisfactionSurveys: string;
+    knowledgeBase: string;
+    chatMessages: string;
+    pendingEmails: string;
+    emailLogs: string;
+    authLogs: string;
+    webhookEndpoints: string;
+    slaPolicies: string;
+    macros: string;
+    ticketStatuses: string;
+    ticketFeedback: string;
+    notificationQueue: string;
+    automationRules: string;
+    supportTeams: string;
+    pushSubscriptions: string;
+    rateLimits: string;
+    counters: string;
+    users: string;
+    media: string;
+}
+declare const DEFAULT_SLUGS: CollectionSlugs;
+/**
+ * Resolve collection slugs merging user overrides with defaults.
+ */
+declare function resolveSlugs(overrides?: Partial<CollectionSlugs>): CollectionSlugs;
+
+/**
+ * How long the two journals are kept, in days.
+ *
+ * Defaults follow the CNIL guidance the README documents: six months would be
+ * the floor for connection logs, a year is the ceiling usually accepted, and
+ * these two values sit inside that range while staying long enough to
+ * investigate an intrusion. Set a value to 0 to disable the automatic purge of
+ * that journal — never to mean "delete everything", which is what `days=0`
+ * means on the manual endpoint.
+ */
+interface RetentionConfig {
+    /** Retention of `auth-logs` in days. `0` disables the scheduled purge. */
+    authLogsDays?: number;
+    /** Retention of `email-logs` in days. `0` disables the scheduled purge. */
+    emailLogsDays?: number;
+    /**
+     * Cron for the scheduled purge. Payload's cron takes an optional leading
+     * seconds field. Default: every day at 03:30.
+     */
+    cron?: string;
+    /** Queue the scheduled job is pushed to. Default: `default`. */
+    queue?: string;
+}
+declare const DEFAULT_RETENTION: {
+    readonly authLogsDays: 180;
+    readonly emailLogsDays: 365;
+    readonly cron: "0 30 3 * * *";
+    readonly queue: "default";
+};
+declare const PURGE_LOGS_TASK_SLUG = "support-purge-logs";
+/** Journals the purge is allowed to touch, keyed by their public name. */
+declare function purgeableCollections(slugs: CollectionSlugs): Record<string, string>;
+/**
+ * Delete rows of `slug` created more than `days` days ago.
+ *
+ * `days <= 0` means "everything" and is only reachable from the manual
+ * admin-only endpoint. The scheduled task refuses it: a misconfigured cron
+ * that wipes the whole security journal every night is a far worse outcome
+ * than a journal that grows.
+ */
+declare function purgeOlderThan(payload: Payload, slug: string, days: number, req?: PayloadRequest): Promise<number>;
+interface ScheduledPurgeResult {
+    purged: Record<string, number>;
+    skipped: string[];
+}
+/**
+ * The scheduled half of the purge. Never accepts `days <= 0`, and silently
+ * skips a journal whose collection is not registered (its feature flag is off).
+ */
+declare function runScheduledPurge(payload: Payload, slugs: CollectionSlugs, retention: RetentionConfig | false | undefined, req?: PayloadRequest): Promise<ScheduledPurgeResult>;
+
 interface InboundEmailLimits {
     maxRequestBytes: number;
     maxAttachmentBytes: number;
@@ -228,6 +316,24 @@ interface SupportPluginConfig {
     email?: EmailConfig;
     /** Shared rate-limit storage. Defaults to process-local memory. */
     rateLimitStore?: RateLimitStore | 'payload';
+    /**
+     * Automatic retention of the two journals the plugin writes.
+     *
+     * The plugin registers a daily Payload Jobs task that deletes rows older
+     * than the configured number of days. Set a value to 0 to keep that journal
+     * forever (the manual `DELETE /api/support/purge-logs` endpoint stays
+     * available either way).
+     *
+     * Defaults: auth-logs 180 days, email-logs 365 days, cron `0 30 3 * * *`.
+     *
+     * `false` registers no task at all. That is the ONLY value that changes the
+     * schema footprint: registering a task turns Payload's job queue on, which
+     * adds the `payload-jobs` collection and the `payload-jobs-stats` global to
+     * an app that had no jobs — two tables you would have to migrate. Pass
+     * `false` if you would rather purge from your own cron, calling
+     * `DELETE /api/support/purge-logs`.
+     */
+    retention?: RetentionConfig | false;
     /** Sequential ticket number formatting. */
     ticketNumber?: {
         prefix?: string;
@@ -376,43 +482,6 @@ declare const DEFAULT_FEATURES: Required<SupportFeatures>;
  */
 declare function supportPlugin(config?: SupportPluginConfig): Plugin;
 
-/**
- * Default collection slugs used by the support plugin.
- * All slugs can be overridden via SupportPluginConfig.collectionSlugs.
- */
-interface CollectionSlugs {
-    tickets: string;
-    ticketMessages: string;
-    supportClients: string;
-    timeEntries: string;
-    cannedResponses: string;
-    ticketActivityLog: string;
-    satisfactionSurveys: string;
-    knowledgeBase: string;
-    chatMessages: string;
-    pendingEmails: string;
-    emailLogs: string;
-    authLogs: string;
-    webhookEndpoints: string;
-    slaPolicies: string;
-    macros: string;
-    ticketStatuses: string;
-    ticketFeedback: string;
-    notificationQueue: string;
-    automationRules: string;
-    supportTeams: string;
-    pushSubscriptions: string;
-    rateLimits: string;
-    counters: string;
-    users: string;
-    media: string;
-}
-declare const DEFAULT_SLUGS: CollectionSlugs;
-/**
- * Resolve collection slugs merging user overrides with defaults.
- */
-declare function resolveSlugs(overrides?: Partial<CollectionSlugs>): CollectionSlugs;
-
 /**
  * Ticketing feature flags — single source of truth (client + server).
  *
@@ -710,4 +779,4 @@ declare function createTicketStatusesCollection(slugs: CollectionSlugs): Collect
  */
 declare function createTicketCollaboratorsCollection(slugs: CollectionSlugs): CollectionConfig;
 
-export { type AIProviderConfig, type ActivityEntryData, type CannedResponseData, type ClientData, type CollectionSlugs, DEFAULT_FEATURES, DEFAULT_INBOUND_EMAIL_LIMITS, DEFAULT_SETTINGS, DEFAULT_SLUGS, DEFAULT_TICKETING_FEATURES, DEFAULT_USER_PREFS, type EmailConfig, type InboundEmailInput, type InboundEmailLimits, type InboundEmailValidationError, MemoryRateLimitStore, type MessageData, PayloadRateLimitStore, type RateLimitEntry, type RateLimitStore, RateLimiter, type SatisfactionSurveyData, type SupportFeatures, type SupportPluginConfig, type SupportSettings, type SupportSettingsState, type TicketData, type TicketSynthesisResult, type TicketingFeatures, type TimeEntryData, type UserPrefs, calculateBusinessHoursDeadline, createAdminNotification, createAssignSlaDeadlines, createAuthLogsCollection, createCannedResponsesCollection, createChatMessagesCollection, createCheckSlaOnReply, createCheckSlaOnResolve, createEmailLogsCollection, createKnowledgeBaseCollection, createLoginEndpoint, createMacrosCollection, createOAuthGoogleEndpoint, createPendingEmailsCollection, createSatisfactionSurveysCollection, createSlaPoliciesCollection, createSupportClientsCollection, createTicketActivityLogCollection, createTicketCollaboratorsCollection, createTicketMessagesCollection, createTicketStatusEmail, createTicketStatusesCollection, createTicketsCollection, createTimeEntriesCollection, createTrackOpenEndpoint, createWebhookEndpointsCollection, dispatchWebhook, generateTicketSynthesis, normalizeFeatures, projectAutoClose, readSupportSettings, readSupportSettingsState, readUserPrefs, resolveSlugs, stripProjectedFeatures, supportPlugin, validateInboundEmailPayload, verifySecret };
+export { type AIProviderConfig, type ActivityEntryData, type CannedResponseData, type ClientData, type CollectionSlugs, DEFAULT_FEATURES, DEFAULT_INBOUND_EMAIL_LIMITS, DEFAULT_RETENTION, DEFAULT_SETTINGS, DEFAULT_SLUGS, DEFAULT_TICKETING_FEATURES, DEFAULT_USER_PREFS, type EmailConfig, type InboundEmailInput, type InboundEmailLimits, type InboundEmailValidationError, MemoryRateLimitStore, type MessageData, PURGE_LOGS_TASK_SLUG, PayloadRateLimitStore, type RateLimitEntry, type RateLimitStore, RateLimiter, type RetentionConfig, type SatisfactionSurveyData, type ScheduledPurgeResult, type SupportFeatures, type SupportPluginConfig, type SupportSettings, type SupportSettingsState, type TicketData, type TicketSynthesisResult, type TicketingFeatures, type TimeEntryData, type UserPrefs, calculateBusinessHoursDeadline, createAdminNotification, createAssignSlaDeadlines, createAuthLogsCollection, createCannedResponsesCollection, createChatMessagesCollection, createCheckSlaOnReply, createCheckSlaOnResolve, createEmailLogsCollection, createKnowledgeBaseCollection, createLoginEndpoint, createMacrosCollection, createOAuthGoogleEndpoint, createPendingEmailsCollection, createSatisfactionSurveysCollection, createSlaPoliciesCollection, createSupportClientsCollection, createTicketActivityLogCollection, createTicketCollaboratorsCollection, createTicketMessagesCollection, createTicketStatusEmail, createTicketStatusesCollection, createTicketsCollection, createTimeEntriesCollection, createTrackOpenEndpoint, createWebhookEndpointsCollection, dispatchWebhook, generateTicketSynthesis, normalizeFeatures, projectAutoClose, purgeOlderThan, purgeableCollections, readSupportSettings, readSupportSettingsState, readUserPrefs, resolveSlugs, runScheduledPurge, stripProjectedFeatures, supportPlugin, validateInboundEmailPayload, verifySecret };

package/dist/index.js

@@ -72,6 +72,11 @@ var DEFAULT_SLUGS = {
   users: "users",
   media: "media"
 };
+var FIXED_SLUGS = {
+  clientSummaries: "client-summaries",
+  ticketCollaborators: "ticket-collaborators",
+  ticketFeedback: "ticket-feedback"
+};
 function resolveSlugs(overrides) {
   return { ...DEFAULT_SLUGS, ...overrides };
 }
@@ -2988,6 +2993,51 @@ function createApplyMacroEndpoint(slugs) {
   };
 }
 
+// src/utils/retention.ts
+var DEFAULT_RETENTION = {
+  authLogsDays: 180,
+  emailLogsDays: 365,
+  cron: "0 30 3 * * *",
+  queue: "default"
+};
+var PURGE_LOGS_TASK_SLUG = "support-purge-logs";
+function purgeableCollections(slugs) {
+  return {
+    "email-logs": slugs.emailLogs,
+    "auth-logs": slugs.authLogs
+  };
+}
+async function purgeOlderThan(payload, slug, days, req) {
+  const cutoff = days > 0 ? new Date(Date.now() - days * 864e5).toISOString() : null;
+  const result = await dbDelete(payload, slug, {
+    where: cutoff ? { createdAt: { less_than: cutoff } } : { id: { exists: true } },
+    overrideAccess: true,
+    ...req ? { req } : {}
+  });
+  return Array.isArray(result?.docs) ? result.docs.length : 0;
+}
+async function runScheduledPurge(payload, slugs, retention, req) {
+  if (retention === false) return { purged: {}, skipped: ["auth-logs", "email-logs"] };
+  const plan = [
+    ["auth-logs", slugs.authLogs, retention?.authLogsDays ?? DEFAULT_RETENTION.authLogsDays],
+    ["email-logs", slugs.emailLogs, retention?.emailLogsDays ?? DEFAULT_RETENTION.emailLogsDays]
+  ];
+  const purged = {};
+  const skipped = [];
+  for (const [name, slug, days] of plan) {
+    if (!Number.isFinite(days) || days <= 0) {
+      skipped.push(name);
+      continue;
+    }
+    if (!payload.collections?.[slug]) {
+      skipped.push(name);
+      continue;
+    }
+    purged[name] = await purgeOlderThan(payload, slug, days, req);
+  }
+  return { purged, skipped };
+}
+
 // src/endpoints/purge-logs.ts
 function createPurgeLogsEndpoint(slugs) {
   return {
@@ -3000,19 +3050,11 @@ function createPurgeLogsEndpoint(slugs) {
         const url = new URL(req.url);
         const collection = url.searchParams.get("collection");
         const days = Number(url.searchParams.get("days") || "0");
-        const allowedCollections = {
-          "email-logs": slugs.emailLogs,
-          "auth-logs": slugs.authLogs
-        };
+        const allowedCollections = purgeableCollections(slugs);
         if (!collection || !allowedCollections[collection]) {
           return Response.json({ error: "Invalid collection. Use email-logs or auth-logs." }, { status: 400 });
         }
-        const cutoff = days > 0 ? new Date(Date.now() - days * 864e5).toISOString() : null;
-        const result = await dbDelete(payload, allowedCollections[collection], {
-          where: cutoff ? { createdAt: { less_than: cutoff } } : { id: { exists: true } },
-          overrideAccess: true
-        });
-        const count = Array.isArray(result.docs) ? result.docs.length : 0;
+        const count = await purgeOlderThan(payload, allowedCollections[collection], days, req);
         return Response.json({
           purged: count,
           collection,
@@ -4735,6 +4777,7 @@ function createExportCsvEndpoint(slugs) {
 }
 
 // src/endpoints/export-data.ts
+var EMPTY = { docs: [] };
 function createExportDataEndpoint(slugs) {
   return {
     path: "/support/export-data",
@@ -4743,7 +4786,16 @@ function createExportDataEndpoint(slugs) {
       try {
         const payload = req.payload;
         requireClient(req, slugs);
-        const [clientData, ticketsResult, messagesResult, surveysResult] = await Promise.all([
+        const isRegistered = (slug) => Boolean(payload.collections?.[slug]);
+        const [
+          clientData,
+          ticketsResult,
+          messagesResult,
+          surveysResult,
+          chatResult,
+          feedbackResult,
+          summariesResult
+        ] = await Promise.all([
           dbFindByID(payload, slugs.supportClients, {
             id: req.user.id,
             depth: 0,
@@ -4769,12 +4821,35 @@ function createExportDataEndpoint(slugs) {
             limit: 500,
             depth: 0,
             overrideAccess: true
-          })
+          }),
+          isRegistered(slugs.chatMessages) ? dbFind(payload, slugs.chatMessages, {
+            where: { client: { equals: req.user.id } },
+            limit: 5e3,
+            depth: 0,
+            overrideAccess: true
+          }) : EMPTY,
+          isRegistered(FIXED_SLUGS.ticketFeedback) ? dbFind(payload, FIXED_SLUGS.ticketFeedback, {
+            where: { client: { equals: req.user.id } },
+            limit: 500,
+            depth: 0,
+            overrideAccess: true
+          }) : EMPTY,
+          isRegistered(FIXED_SLUGS.clientSummaries) ? dbFind(payload, FIXED_SLUGS.clientSummaries, {
+            where: { client: { equals: req.user.id } },
+            limit: 100,
+            depth: 0,
+            overrideAccess: true
+          }) : EMPTY
         ]);
+        const ticketIds = ticketsResult.docs.map((t) => t.id);
+        const timeResult = ticketIds.length > 0 && isRegistered(slugs.timeEntries) ? await dbFind(payload, slugs.timeEntries, {
+          where: { ticket: { in: ticketIds } },
+          limit: 5e3,
+          depth: 0,
+          overrideAccess: true
+        }) : EMPTY;
         const c = clientData;
-        const exportData = {
-          exportDate: (/* @__PURE__ */ new Date()).toISOString(),
-          exportType: "RGPD - Export des donn\xE9es personnelles",
+        const providedByYou = {
           profile: {
             email: c.email,
             firstName: c.firstName,
@@ -4803,8 +4878,50 @@ function createExportDataEndpoint(slugs) {
             rating: s.rating,
             comment: s.comment,
             createdAt: s.createdAt
+          })),
+          feedback: feedbackResult.docs.map((f) => ({
+            ticketId: f.ticket,
+            rating: f.rating,
+            comment: f.comment,
+            submittedFrom: f.submittedFrom,
+            createdAt: f.createdAt
+          })),
+          chatMessages: chatResult.docs.map((m) => ({
+            session: m.session,
+            senderType: m.senderType,
+            message: m.message,
+            createdAt: m.createdAt
+          })),
+          timeEntries: timeResult.docs.map((e) => ({
+            ticketId: e.ticket,
+            duration: e.duration,
+            date: e.date,
+            description: e.description,
+            billable: e.billable
           }))
         };
+        const exportData = {
+          exportDate: (/* @__PURE__ */ new Date()).toISOString(),
+          exportType: "RGPD - Export des donn\xE9es personnelles",
+          providedByYou: {
+            legalBasis: "Art. 20 RGPD - droit \xE0 la portabilit\xE9",
+            ...providedByYou
+          },
+          derivedData: {
+            legalBasis: "Art. 15 RGPD - droit d'acc\xE8s (donn\xE9es d\xE9riv\xE9es, hors portabilit\xE9)",
+            clientSummaries: summariesResult.docs.map((s) => ({
+              summary: s.summary,
+              recurringTopics: s.recurringTopics,
+              patterns: s.patterns,
+              keyFacts: s.keyFacts,
+              ticketCount: s.ticketCount,
+              messageCount: s.messageCount,
+              averageSatisfaction: s.averageSatisfaction,
+              generatedAt: s.generatedAt,
+              aiModel: s.aiModel
+            }))
+          }
+        };
         const json = JSON.stringify(exportData, null, 2);
         return new Response(json, {
           status: 200,
@@ -5718,8 +5835,15 @@ function createOAuthGoogleEndpoint(slugs, options) {
     }
   };
 }
-
-// src/endpoints/delete-account.ts
+function collectAttachmentIds(docs, into) {
+  for (const doc of docs) {
+    for (const attachment of doc.attachments ?? []) {
+      const file = attachment?.file;
+      const id = file != null && typeof file === "object" ? file.id : file;
+      if (id != null) into.add(id);
+    }
+  }
+}
 function createDeleteAccountEndpoint(slugs) {
   return {
     path: "/support/delete-account",
@@ -5748,44 +5872,135 @@ function createDeleteAccountEndpoint(slugs) {
           );
         }
         const clientId = req.user.id;
-        const tickets = await dbFind(payload, slugs.tickets, {
-          where: { client: { equals: clientId } },
-          limit: 1e4,
-          depth: 0,
-          overrideAccess: true,
-          select: { id: true }
-        });
-        const ticketIds = tickets.docs.map((t) => t.id);
-        if (ticketIds.length > 0) {
-          await dbDelete(payload, slugs.ticketMessages, {
-            where: { ticket: { in: ticketIds } },
-            overrideAccess: true
-          });
-          await dbDelete(payload, slugs.ticketActivityLog, {
-            where: { ticket: { in: ticketIds } },
-            overrideAccess: true
-          });
-          await dbDelete(payload, slugs.timeEntries, {
-            where: { ticket: { in: ticketIds } },
-            overrideAccess: true
-          });
-          await dbDelete(payload, slugs.tickets, {
+        const clientEmail = req.user.email;
+        const isRegistered = (slug) => Boolean(payload.collections?.[slug]);
+        const startedTransaction = await initTransaction(req);
+        try {
+          const tickets = await dbFind(payload, slugs.tickets, {
             where: { client: { equals: clientId } },
-            overrideAccess: true
+            limit: 1e4,
+            depth: 0,
+            overrideAccess: true,
+            select: { id: true },
+            req
           });
+          const ticketIds = tickets.docs.map((t) => t.id);
+          const attachmentIds = /* @__PURE__ */ new Set();
+          if (ticketIds.length > 0) {
+            const messages = await dbFind(
+              payload,
+              slugs.ticketMessages,
+              {
+                where: { ticket: { in: ticketIds } },
+                limit: 1e4,
+                depth: 0,
+                overrideAccess: true,
+                req
+              }
+            );
+            collectAttachmentIds(messages.docs, attachmentIds);
+          }
+          if (isRegistered(slugs.pendingEmails)) {
+            const pendingEmails = await dbFind(
+              payload,
+              slugs.pendingEmails,
+              {
+                where: { client: { equals: clientId } },
+                limit: 1e4,
+                depth: 0,
+                overrideAccess: true,
+                req
+              }
+            );
+            collectAttachmentIds(pendingEmails.docs, attachmentIds);
+          }
+          if (ticketIds.length > 0) {
+            for (const slug of [FIXED_SLUGS.ticketFeedback, FIXED_SLUGS.ticketCollaborators]) {
+              if (!isRegistered(slug)) continue;
+              await dbDelete(payload, slug, {
+                where: {
+                  or: [
+                    { ticket: { in: ticketIds } },
+                    { client: { equals: clientId } }
+                  ]
+                },
+                overrideAccess: true,
+                req
+              });
+            }
+          }
+          if (ticketIds.length > 0) {
+            await dbDelete(payload, slugs.tickets, {
+              where: { client: { equals: clientId } },
+              overrideAccess: true,
+              req
+            });
+          }
+          for (const slug of [
+            slugs.satisfactionSurveys,
+            slugs.chatMessages,
+            slugs.notificationQueue,
+            slugs.pendingEmails,
+            FIXED_SLUGS.clientSummaries,
+            FIXED_SLUGS.ticketFeedback
+          ]) {
+            if (!isRegistered(slug)) continue;
+            await dbDelete(payload, slug, {
+              where: { client: { equals: clientId } },
+              overrideAccess: true,
+              req
+            });
+          }
+          if (isRegistered(FIXED_SLUGS.ticketCollaborators)) {
+            await dbDelete(payload, FIXED_SLUGS.ticketCollaborators, {
+              where: {
+                or: [
+                  { client: { equals: clientId } },
+                  ...clientEmail ? [{ email: { equals: clientEmail } }] : []
+                ]
+              },
+              overrideAccess: true,
+              req
+            });
+          }
+          if (clientEmail) {
+            if (isRegistered(slugs.authLogs)) {
+              await dbDelete(payload, slugs.authLogs, {
+                where: { email: { equals: clientEmail } },
+                overrideAccess: true,
+                req
+              });
+            }
+            if (isRegistered(slugs.emailLogs)) {
+              await dbDelete(payload, slugs.emailLogs, {
+                where: {
+                  or: [
+                    { senderEmail: { equals: clientEmail } },
+                    { recipientEmail: { equals: clientEmail } }
+                  ]
+                },
+                overrideAccess: true,
+                req
+              });
+            }
+          }
+          for (const id of isRegistered(slugs.media) ? attachmentIds : []) {
+            await dbDelete(payload, slugs.media, {
+              id,
+              overrideAccess: true,
+              req
+            });
+          }
+          await dbDelete(payload, slugs.supportClients, {
+            id: clientId,
+            overrideAccess: true,
+            req
+          });
+          if (startedTransaction) await commitTransaction(req);
+        } catch (err) {
+          if (startedTransaction) await killTransaction(req);
+          throw err;
         }
-        await dbDelete(payload, slugs.satisfactionSurveys, {
-          where: { client: { equals: clientId } },
-          overrideAccess: true
-        });
-        await dbDelete(payload, slugs.chatMessages, {
-          where: { client: { equals: clientId } },
-          overrideAccess: true
-        });
-        await dbDelete(payload, slugs.supportClients, {
-          id: clientId,
-          overrideAccess: true
-        });
         const headers = new Headers({ "Content-Type": "application/json" });
         const secure = process.env.NODE_ENV === "production";
         headers.append(
@@ -8428,9 +8643,11 @@ function createCascadeDelete(slugs) {
   return async ({ id, req }) => {
     const collections = [slugs.ticketMessages, slugs.ticketActivityLog, slugs.timeEntries, slugs.satisfactionSurveys];
     for (const slug of collections) {
+      if (!req.payload.collections?.[slug]) continue;
       await dbDelete(req.payload, slug, {
         where: { ticket: { equals: id } },
-        overrideAccess: true
+        overrideAccess: true,
+        req
       });
     }
   };
@@ -9918,7 +10135,7 @@ function createSupportClientsCollection(slugs, options) {
 }
 
 // src/collections/TimeEntries.ts
-async function recalculateTicketTime(payload, slugs, ticketId) {
+async function recalculateTicketTime(payload, slugs, ticketId, req) {
   let totalMinutes = 0;
   let page = 1;
   let hasMore = true;
@@ -9930,7 +10147,8 @@ async function recalculateTicketTime(payload, slugs, ticketId) {
       page,
       depth: 0,
       overrideAccess: true,
-      select: { duration: true }
+      select: { duration: true },
+      req
     });
     for (const entry of entries.docs) {
       totalMinutes += entry.duration || 0;
@@ -9942,14 +10160,15 @@ async function recalculateTicketTime(payload, slugs, ticketId) {
     collection: slugs.tickets,
     id: ticketId,
     data: { totalTimeMinutes: totalMinutes },
-    overrideAccess: true
+    overrideAccess: true,
+    req
   });
 }
 function createRecalculateTicketTime(slugs) {
   return async ({ doc, req }) => {
     if (!doc.ticket) return;
     const ticketId = typeof doc.ticket === "object" ? doc.ticket.id : doc.ticket;
-    await recalculateTicketTime(req.payload, slugs, ticketId);
+    await recalculateTicketTime(req.payload, slugs, ticketId, req);
   };
 }
 function createRecalculateTicketTimeOnDelete(slugs) {
@@ -9957,7 +10176,7 @@ function createRecalculateTicketTimeOnDelete(slugs) {
     if (!doc?.ticket) return;
     const ticketId = typeof doc.ticket === "object" ? doc.ticket.id : doc.ticket;
     try {
-      await recalculateTicketTime(req.payload, slugs, ticketId);
+      await recalculateTicketTime(req.payload, slugs, ticketId, req);
     } catch (err) {
       console.error("[support] Failed to recalculate ticket time after delete:", err);
     }
@@ -11828,8 +12047,30 @@ function supportPlugin(config) {
       rateLimitStore,
       capabilities: config?.capabilities
     });
+    const retention = config?.retention === false ? void 0 : config?.retention;
+    const retentionEnabled = Boolean(retention);
+    const purgeTask = {
+      slug: PURGE_LOGS_TASK_SLUG,
+      label: "Support \u2014 purge des journaux",
+      schedule: [
+        {
+          cron: retention?.cron ?? DEFAULT_RETENTION.cron,
+          queue: retention?.queue ?? DEFAULT_RETENTION.queue
+        }
+      ],
+      handler: async ({ req }) => {
+        const result = await runScheduledPurge(req.payload, slugs, retention, req);
+        return { output: result };
+      }
+    };
+    const existingJobs = incomingConfig.jobs;
+    const jobs = retentionEnabled ? {
+      ...existingJobs,
+      tasks: [...existingJobs?.tasks ?? [], purgeTask]
+    } : existingJobs;
     return {
       ...incomingConfig,
+      jobs,
       // Publish the resolved staff collection so the server-side readers share
       // ONE source of truth with the writers. `requireAdmin` compares against
       // `slugs.users`; the `payload-preferences` reads used to scope themselves
@@ -11854,4 +12095,4 @@ function supportPlugin(config) {
   };
 }
 
-export { DEFAULT_FEATURES, DEFAULT_INBOUND_EMAIL_LIMITS, DEFAULT_SETTINGS, DEFAULT_SLUGS, DEFAULT_TICKETING_FEATURES, DEFAULT_USER_PREFS, MemoryRateLimitStore, PayloadRateLimitStore, RateLimiter, calculateBusinessHoursDeadline, createAdminNotification, createAssignSlaDeadlines, createAuthLogsCollection, createCannedResponsesCollection, createChatMessagesCollection, createCheckSlaOnReply, createCheckSlaOnResolve, createEmailLogsCollection, createKnowledgeBaseCollection, createLoginEndpoint, createMacrosCollection, createOAuthGoogleEndpoint, createPendingEmailsCollection, createSatisfactionSurveysCollection, createSlaPoliciesCollection, createSupportClientsCollection, createTicketActivityLogCollection, createTicketCollaboratorsCollection, createTicketMessagesCollection, createTicketStatusEmail, createTicketStatusesCollection, createTicketsCollection, createTimeEntriesCollection, createTrackOpenEndpoint, createWebhookEndpointsCollection, dispatchWebhook, generateTicketSynthesis, normalizeFeatures, projectAutoClose, readSupportSettings, readSupportSettingsState, readUserPrefs, resolveSlugs, stripProjectedFeatures, supportPlugin, validateInboundEmailPayload, verifySecret };
+export { DEFAULT_FEATURES, DEFAULT_INBOUND_EMAIL_LIMITS, DEFAULT_RETENTION, DEFAULT_SETTINGS, DEFAULT_SLUGS, DEFAULT_TICKETING_FEATURES, DEFAULT_USER_PREFS, MemoryRateLimitStore, PURGE_LOGS_TASK_SLUG, PayloadRateLimitStore, RateLimiter, calculateBusinessHoursDeadline, createAdminNotification, createAssignSlaDeadlines, createAuthLogsCollection, createCannedResponsesCollection, createChatMessagesCollection, createCheckSlaOnReply, createCheckSlaOnResolve, createEmailLogsCollection, createKnowledgeBaseCollection, createLoginEndpoint, createMacrosCollection, createOAuthGoogleEndpoint, createPendingEmailsCollection, createSatisfactionSurveysCollection, createSlaPoliciesCollection, createSupportClientsCollection, createTicketActivityLogCollection, createTicketCollaboratorsCollection, createTicketMessagesCollection, createTicketStatusEmail, createTicketStatusesCollection, createTicketsCollection, createTimeEntriesCollection, createTrackOpenEndpoint, createWebhookEndpointsCollection, dispatchWebhook, generateTicketSynthesis, normalizeFeatures, projectAutoClose, purgeOlderThan, purgeableCollections, readSupportSettings, readSupportSettingsState, readUserPrefs, resolveSlugs, runScheduledPurge, stripProjectedFeatures, supportPlugin, validateInboundEmailPayload, verifySecret };