Initial Ladill Queue release — enterprise QMS standalone app.

Phases 1–6: tickets, counters, displays, appointments, workflows, rules, analytics, reports, feedback, admin, device API, and Gitea deploy workflow for queue.ladill.com.

Co-authored-by: Cursor <cursoragent@cursor.com>

app/Http/Controllers/Api/AnalyticsController.php

@@ -0,0 +1,27 @@
+<?php
+
+namespace App\Http\Controllers\Api;
+
+use App\Http\Controllers\Api\Concerns\ScopesApiToAccount;
+use App\Http\Controllers\Controller;
+use App\Services\Qms\AnalyticsService;
+use App\Services\Qms\OrganizationResolver;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+
+class AnalyticsController extends Controller
+{
+    use ScopesApiToAccount;
+
+    public function overview(Request $request, AnalyticsService $analytics): JsonResponse
+    {
+        $this->authorizeAbility($request, 'reports.view');
+        $organization = $this->organization($request);
+        $branchScope = app(OrganizationResolver::class)->branchScope($this->member($request));
+
+        return response()->json([
+            'data' => $analytics->overview($this->ownerRef($request), $organization->id, $branchScope),
+            'trend' => $analytics->dailyTrend($this->ownerRef($request), $organization->id, 14, $branchScope),
+        ]);
+    }
+}

app/Http/Controllers/Api/AppointmentController.php

@@ -0,0 +1,69 @@
+<?php
+
+namespace App\Http\Controllers\Api;
+
+use App\Http\Controllers\Api\Concerns\ScopesApiToAccount;
+use App\Http\Controllers\Controller;
+use App\Models\QueueAppointment;
+use App\Services\Qms\AppointmentService;
+use App\Services\Qms\AuditLogger;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+use Illuminate\Support\Str;
+
+class AppointmentController extends Controller
+{
+    use ScopesApiToAccount;
+
+    public function index(Request $request): JsonResponse
+    {
+        $this->authorizeAbility($request, 'appointments.view');
+        $owner = $this->ownerRef($request);
+        $organization = $this->organization($request);
+
+        $items = QueueAppointment::owned($owner)
+            ->where('organization_id', $organization->id)
+            ->orderBy('scheduled_at')
+            ->paginate(50);
+
+        return response()->json(['data' => $items]);
+    }
+
+    public function store(Request $request): JsonResponse
+    {
+        $this->authorizeAbility($request, 'appointments.manage');
+        $owner = $this->ownerRef($request);
+        $organization = $this->organization($request);
+
+        $validated = $request->validate([
+            'branch_id' => ['required', 'exists:queue_branches,id'],
+            'service_queue_id' => ['nullable', 'exists:queue_service_queues,id'],
+            'customer_name' => ['required', 'string', 'max:255'],
+            'customer_phone' => ['nullable', 'string', 'max:50'],
+            'customer_email' => ['nullable', 'email', 'max:255'],
+            'scheduled_at' => ['required', 'date'],
+        ]);
+
+        $appointment = QueueAppointment::create([
+            'owner_ref' => $owner,
+            'organization_id' => $organization->id,
+            ...$validated,
+            'status' => 'scheduled',
+            'reference' => 'APT-'.Str::upper(Str::random(6)),
+        ]);
+
+        AuditLogger::record($owner, 'appointment.created', $organization->id, $owner, QueueAppointment::class, $appointment->id);
+
+        return response()->json(['data' => $appointment], 201);
+    }
+
+    public function checkIn(Request $request, QueueAppointment $appointment): JsonResponse
+    {
+        $this->authorizeAbility($request, 'appointments.manage');
+        $this->authorizeOwner($request, $appointment);
+
+        $ticket = app(AppointmentService::class)->checkIn($appointment, $this->ownerRef($request));
+
+        return response()->json(['data' => \App\Services\Qms\TicketPresenter::toArray($ticket)]);
+    }
+}

app/Http/Controllers/Api/BranchController.php

@@ -0,0 +1,55 @@
+<?php
+
+namespace App\Http\Controllers\Api;
+
+use App\Http\Controllers\Api\Concerns\ScopesApiToAccount;
+use App\Http\Controllers\Controller;
+use App\Models\Branch;
+use App\Services\Qms\AuditLogger;
+use App\Services\Qms\PlanService;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+
+class BranchController extends Controller
+{
+    use ScopesApiToAccount;
+
+    public function index(Request $request): JsonResponse
+    {
+        $this->authorizeAbility($request, 'admin.branches.view');
+        $branches = Branch::owned($this->ownerRef($request))
+            ->where('organization_id', $this->organization($request)->id)
+            ->orderBy('name')
+            ->get();
+
+        return response()->json(['data' => $branches]);
+    }
+
+    public function store(Request $request): JsonResponse
+    {
+        $this->authorizeAbility($request, 'admin.branches.manage');
+        $organization = $this->organization($request);
+        $owner = $this->ownerRef($request);
+
+        $currentCount = Branch::owned($owner)->where('organization_id', $organization->id)->count();
+        abort_unless(app(PlanService::class)->canAddBranch($organization, $currentCount), 422, 'Branch limit reached for current plan.');
+
+        $validated = $request->validate([
+            'name' => ['required', 'string', 'max:255'],
+            'code' => ['nullable', 'string', 'max:50'],
+            'address' => ['nullable', 'string', 'max:500'],
+            'phone' => ['nullable', 'string', 'max:50'],
+        ]);
+
+        $branch = Branch::create([
+            'owner_ref' => $owner,
+            'organization_id' => $organization->id,
+            ...$validated,
+            'is_active' => true,
+        ]);
+
+        AuditLogger::record($owner, 'branch.created', $organization->id, $owner, Branch::class, $branch->id);
+
+        return response()->json(['data' => $branch], 201);
+    }
+}

app/Http/Controllers/Api/Concerns/ScopesApiToAccount.php

@@ -0,0 +1,44 @@
+<?php
+
+namespace App\Http\Controllers\Api\Concerns;
+
+use App\Models\Member;
+use App\Models\Organization;
+use App\Services\Qms\OrganizationResolver;
+use App\Services\Qms\QmsPermissions;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Http\Request;
+
+trait ScopesApiToAccount
+{
+    protected function ownerRef(Request $request): string
+    {
+        return (string) $request->user()->public_id;
+    }
+
+    protected function organization(Request $request): Organization
+    {
+        $organization = app(OrganizationResolver::class)->resolveForUser($request->user());
+        abort_unless($organization, 404);
+
+        return $organization;
+    }
+
+    protected function member(Request $request): ?Member
+    {
+        return app(OrganizationResolver::class)->memberFor($request->user(), $this->organization($request));
+    }
+
+    protected function authorizeAbility(Request $request, string $ability): void
+    {
+        abort_unless(
+            app(QmsPermissions::class)->can($this->member($request), $ability),
+            403,
+        );
+    }
+
+    protected function authorizeOwner(Request $request, Model $model): void
+    {
+        abort_unless($model->getAttribute('owner_ref') === $this->ownerRef($request), 404);
+    }
+}

app/Http/Controllers/Api/CounterController.php

@@ -0,0 +1,74 @@
+<?php
+
+namespace App\Http\Controllers\Api;
+
+use App\Http\Controllers\Api\Concerns\ScopesApiToAccount;
+use App\Http\Controllers\Controller;
+use App\Models\Counter;
+use App\Models\ServiceQueue;
+use App\Services\Qms\AuditLogger;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+
+class CounterController extends Controller
+{
+    use ScopesApiToAccount;
+
+    public function index(Request $request): JsonResponse
+    {
+        $this->authorizeAbility($request, 'counters.view');
+        $owner = $this->ownerRef($request);
+        $organization = $this->organization($request);
+
+        $counters = Counter::owned($owner)
+            ->where('organization_id', $organization->id)
+            ->with('serviceQueues')
+            ->orderBy('name')
+            ->get()
+            ->map(fn (Counter $c) => [
+                'uuid' => $c->uuid,
+                'name' => $c->name,
+                'code' => $c->code,
+                'status' => $c->status,
+                'queues' => $c->serviceQueues->pluck('name'),
+            ]);
+
+        return response()->json(['data' => $counters]);
+    }
+
+    public function store(Request $request): JsonResponse
+    {
+        $this->authorizeAbility($request, 'counters.manage');
+        $owner = $this->ownerRef($request);
+        $organization = $this->organization($request);
+
+        $validated = $request->validate([
+            'name' => ['required', 'string', 'max:255'],
+            'code' => ['nullable', 'string', 'max:50'],
+            'branch_id' => ['required', 'integer'],
+            'department_id' => ['nullable', 'integer'],
+            'queue_ids' => ['nullable', 'array'],
+            'queue_ids.*' => ['uuid'],
+        ]);
+
+        $counter = Counter::create([
+            'owner_ref' => $owner,
+            'organization_id' => $organization->id,
+            'branch_id' => $validated['branch_id'],
+            'department_id' => $validated['department_id'] ?? null,
+            'name' => $validated['name'],
+            'code' => $validated['code'] ?? null,
+            'status' => 'offline',
+            'is_active' => true,
+        ]);
+
+        if (! empty($validated['queue_ids'])) {
+            $queueIds = ServiceQueue::owned($owner)->whereIn('uuid', $validated['queue_ids'])->pluck('id');
+            $counter->serviceQueues()->sync($queueIds);
+        }
+
+        AuditLogger::record($owner, 'counter.created', $organization->id, $owner, Counter::class, $counter->id);
+
+        return response()->json(['data' => ['uuid' => $counter->uuid, 'name' => $counter->name]], 201);
+    }
+}

app/Http/Controllers/Api/DeviceHeartbeatController.php

@@ -0,0 +1,32 @@
+<?php
+
+namespace App\Http\Controllers\Api;
+
+use App\Http\Controllers\Controller;
+use App\Services\Qms\DeviceService;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+
+class DeviceHeartbeatController extends Controller
+{
+    public function __construct(
+        protected DeviceService $devices,
+    ) {}
+
+    public function __invoke(Request $request): JsonResponse
+    {
+        $token = $request->bearerToken() ?? $request->input('device_token');
+        abort_unless($token, 401, 'Device token required.');
+
+        $device = $this->devices->findByToken($token);
+        abort_unless($device, 401, 'Invalid device token.');
+
+        $this->devices->recordHeartbeat($device);
+
+        return response()->json([
+            'status' => 'ok',
+            'device_id' => $device->uuid,
+            'server_time' => now()->toIso8601String(),
+        ]);
+    }
+}

app/Http/Controllers/Api/PublicQueueController.php

@@ -0,0 +1,78 @@
+<?php
+
+namespace App\Http\Controllers\Api;
+
+use App\Http\Controllers\Controller;
+use App\Models\ServiceQueue;
+use App\Models\Ticket;
+use App\Services\Qms\QueueEngine;
+use App\Services\Qms\TicketPresenter;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+
+class PublicQueueController extends Controller
+{
+    public function __construct(
+        protected QueueEngine $engine,
+    ) {}
+
+    public function join(Request $request): JsonResponse
+    {
+        $validated = $request->validate([
+            'queue_uuid' => ['required', 'uuid'],
+            'customer_name' => ['nullable', 'string', 'max:255'],
+            'customer_phone' => ['required', 'string', 'max:50'],
+            'customer_email' => ['nullable', 'email'],
+            'priority' => ['nullable', 'string', 'in:'.implode(',', array_keys(config('qms.ticket_priorities')))],
+        ]);
+
+        $queue = ServiceQueue::where('uuid', $validated['queue_uuid'])
+            ->where('is_active', true)
+            ->where('is_paused', false)
+            ->firstOrFail();
+
+        $ticket = $this->engine->issueTicket($queue, $queue->owner_ref, [
+            'customer_name' => $validated['customer_name'] ?? null,
+            'customer_phone' => $validated['customer_phone'],
+            'customer_email' => $validated['customer_email'] ?? null,
+            'priority' => $validated['priority'] ?? 'walk_in',
+            'source' => 'mobile',
+        ]);
+
+        return response()->json(['data' => TicketPresenter::toArray($ticket)], 201);
+    }
+
+    public function show(string $qrToken): JsonResponse
+    {
+        $ticket = Ticket::where('qr_token', $qrToken)->with(['serviceQueue', 'counter'])->firstOrFail();
+
+        $ahead = Ticket::query()
+            ->where('service_queue_id', $ticket->service_queue_id)
+            ->where('status', 'waiting')
+            ->where('issued_at', '<', $ticket->issued_at)
+            ->count();
+
+        $data = TicketPresenter::toArray($ticket, false);
+        $data['customers_ahead'] = $ahead;
+
+        return response()->json(['data' => $data]);
+    }
+
+    public function delay(Request $request, string $qrToken): JsonResponse
+    {
+        $ticket = Ticket::where('qr_token', $qrToken)->whereIn('status', ['waiting', 'on_hold'])->firstOrFail();
+
+        $validated = $request->validate(['minutes' => ['required', 'integer', 'min:5', 'max:120']]);
+        $ticket = $this->engine->delayArrival($ticket, $validated['minutes']);
+
+        return response()->json(['data' => TicketPresenter::toArray($ticket)]);
+    }
+
+    public function cancel(string $qrToken): JsonResponse
+    {
+        $ticket = Ticket::where('qr_token', $qrToken)->whereIn('status', ['waiting', 'on_hold', 'called'])->firstOrFail();
+        $ticket = $this->engine->cancel($ticket);
+
+        return response()->json(['data' => TicketPresenter::toArray($ticket)]);
+    }
+}

app/Http/Controllers/Api/QueueRuleController.php

@@ -0,0 +1,52 @@
+<?php
+
+namespace App\Http\Controllers\Api;
+
+use App\Http\Controllers\Api\Concerns\ScopesApiToAccount;
+use App\Http\Controllers\Controller;
+use App\Models\QueueRule;
+use App\Models\ServiceQueue;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+
+class QueueRuleController extends Controller
+{
+    use ScopesApiToAccount;
+
+    public function index(Request $request, ServiceQueue $serviceQueue): JsonResponse
+    {
+        $this->authorizeAbility($request, 'rules.view');
+        $this->authorizeOwner($request, $serviceQueue);
+
+        $rules = QueueRule::owned($this->ownerRef($request))
+            ->where('service_queue_id', $serviceQueue->id)
+            ->orderBy('sort_order')
+            ->get();
+
+        return response()->json(['data' => $rules]);
+    }
+
+    public function store(Request $request, ServiceQueue $serviceQueue): JsonResponse
+    {
+        $this->authorizeAbility($request, 'rules.manage');
+        $this->authorizeOwner($request, $serviceQueue);
+
+        $validated = $request->validate([
+            'rule_type' => ['required', 'string', 'in:'.implode(',', array_keys(config('qms.rule_types')))],
+            'conditions' => ['nullable', 'array'],
+            'actions' => ['nullable', 'array'],
+        ]);
+
+        $rule = QueueRule::create([
+            'owner_ref' => $this->ownerRef($request),
+            'service_queue_id' => $serviceQueue->id,
+            'rule_type' => $validated['rule_type'],
+            'conditions' => $validated['conditions'] ?? [],
+            'actions' => $validated['actions'] ?? [],
+            'sort_order' => QueueRule::where('service_queue_id', $serviceQueue->id)->max('sort_order') + 1,
+            'is_active' => true,
+        ]);
+
+        return response()->json(['data' => $rule], 201);
+    }
+}

app/Http/Controllers/Api/ReportController.php

@@ -0,0 +1,41 @@
+<?php
+
+namespace App\Http\Controllers\Api;
+
+use App\Http\Controllers\Api\Concerns\ScopesApiToAccount;
+use App\Http\Controllers\Controller;
+use App\Services\Qms\OrganizationResolver;
+use App\Services\Qms\ReportService;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+use Illuminate\Support\Carbon;
+
+class ReportController extends Controller
+{
+    use ScopesApiToAccount;
+
+    public function show(Request $request, string $type, ReportService $reports): JsonResponse
+    {
+        abort_unless(array_key_exists($type, config('qms.report_types')), 404);
+        $this->authorizeAbility($request, 'reports.view');
+
+        $organization = $this->organization($request);
+        $branchScope = app(OrganizationResolver::class)->branchScope($this->member($request));
+        $branchId = $request->input('branch_id') ? (int) $request->input('branch_id') : $branchScope;
+        $from = Carbon::parse($request->input('from', now()->subDays(30)->toDateString()))->startOfDay();
+        $to = Carbon::parse($request->input('to', now()->toDateString()))->endOfDay();
+        $owner = $this->ownerRef($request);
+
+        $data = match ($type) {
+            'tickets' => $reports->ticketsReport($owner, $organization->id, $from, $to, $branchId),
+            'wait_times' => $reports->waitTimesReport($owner, $organization->id, $from, $to, $branchId),
+            'counters' => $reports->countersReport($owner, $organization->id, $from, $to, $branchId),
+            'appointments' => $reports->appointmentsReport($owner, $organization->id, $from, $to, $branchId),
+            'feedback' => $reports->feedbackReport($owner, $organization->id, $from, $to, $branchId),
+            'service_sessions' => $reports->serviceSessionsReport($owner, $organization->id, $from, $to, $branchId),
+            default => abort(404),
+        };
+
+        return response()->json(['data' => $data, 'from' => $from->toDateString(), 'to' => $to->toDateString()]);
+    }
+}

app/Http/Controllers/Api/ServiceEventController.php

@@ -0,0 +1,35 @@
+<?php
+
+namespace App\Http\Controllers\Api;
+
+use App\Events\ServiceEventOccurred;
+use App\Http\Controllers\Controller;
+use App\Services\Events\ServiceEventSignature;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Cache;
+
+class ServiceEventController extends Controller
+{
+    public function __invoke(Request $request): JsonResponse
+    {
+        $secret = (string) config('service_events.inbound_secret');
+        $signature = (string) $request->header('X-Ladill-Signature', '');
+
+        if (! ServiceEventSignature::verify($request->getContent(), $signature, $secret)) {
+            return response()->json(['error' => 'invalid signature'], 401);
+        }
+
+        $eventId = (string) $request->header('X-Ladill-Event-Id', (string) $request->input('id', ''));
+        if ($eventId !== '') {
+            if (Cache::has("svcevt:{$eventId}")) {
+                return response()->json(['status' => 'duplicate']);
+            }
+            Cache::put("svcevt:{$eventId}", true, now()->addDay());
+        }
+
+        event(new ServiceEventOccurred((string) $request->input('event'), (array) $request->input('data', [])));
+
+        return response()->json(['status' => 'accepted']);
+    }
+}

app/Http/Controllers/Api/ServiceQueueController.php

@@ -0,0 +1,71 @@
+<?php
+
+namespace App\Http\Controllers\Api;
+
+use App\Http\Controllers\Api\Concerns\ScopesApiToAccount;
+use App\Http\Controllers\Controller;
+use App\Models\Counter;
+use App\Models\ServiceQueue;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+
+class ServiceQueueController extends Controller
+{
+    use ScopesApiToAccount;
+
+    public function index(Request $request): JsonResponse
+    {
+        $this->authorizeAbility($request, 'queues.view');
+        $owner = $this->ownerRef($request);
+        $organization = $this->organization($request);
+
+        $queues = ServiceQueue::owned($owner)
+            ->where('organization_id', $organization->id)
+            ->with(['branch', 'department'])
+            ->orderBy('name')
+            ->get()
+            ->map(fn (ServiceQueue $q) => [
+                'uuid' => $q->uuid,
+                'name' => $q->name,
+                'prefix' => $q->prefix,
+                'strategy' => $q->strategy,
+                'is_active' => $q->is_active,
+                'is_paused' => $q->is_paused,
+                'branch' => $q->branch?->name,
+            ]);
+
+        return response()->json(['data' => $queues]);
+    }
+
+    public function waiting(Request $request, ServiceQueue $serviceQueue): JsonResponse
+    {
+        $this->authorizeAbility($request, 'queues.view');
+        $this->authorizeOwner($request, $serviceQueue);
+
+        $tickets = app(\App\Services\Qms\QueueEngine::class)->waitingTickets($serviceQueue);
+
+        return response()->json([
+            'data' => array_map(fn ($t) => \App\Services\Qms\TicketPresenter::toArray($t), $tickets),
+        ]);
+    }
+
+    public function pause(Request $request, ServiceQueue $serviceQueue): JsonResponse
+    {
+        $this->authorizeAbility($request, 'queues.manage');
+        $this->authorizeOwner($request, $serviceQueue);
+
+        $queue = app(\App\Services\Qms\QueueEngine::class)->pauseQueue($serviceQueue, $this->ownerRef($request));
+
+        return response()->json(['data' => ['uuid' => $queue->uuid, 'is_paused' => $queue->is_paused]]);
+    }
+
+    public function resume(Request $request, ServiceQueue $serviceQueue): JsonResponse
+    {
+        $this->authorizeAbility($request, 'queues.manage');
+        $this->authorizeOwner($request, $serviceQueue);
+
+        $queue = app(\App\Services\Qms\QueueEngine::class)->resumeQueue($serviceQueue, $this->ownerRef($request));
+
+        return response()->json(['data' => ['uuid' => $queue->uuid, 'is_paused' => $queue->is_paused]]);
+    }
+}

app/Http/Controllers/Api/TicketController.php

@@ -0,0 +1,129 @@
+<?php
+
+namespace App\Http\Controllers\Api;
+
+use App\Http\Controllers\Api\Concerns\ScopesApiToAccount;
+use App\Http\Controllers\Controller;
+use App\Models\ServiceQueue;
+use App\Models\Ticket;
+use App\Services\Qms\QueueEngine;
+use App\Services\Qms\TicketPresenter;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+
+class TicketController extends Controller
+{
+    use ScopesApiToAccount;
+
+    public function __construct(
+        protected QueueEngine $engine,
+    ) {}
+
+    public function index(Request $request): JsonResponse
+    {
+        $this->authorizeAbility($request, 'tickets.view');
+        $owner = $this->ownerRef($request);
+        $organization = $this->organization($request);
+
+        $tickets = Ticket::owned($owner)
+            ->where('organization_id', $organization->id)
+            ->when($request->query('queue'), fn ($q, $uuid) => $q->whereHas('serviceQueue', fn ($sq) => $sq->where('uuid', $uuid)))
+            ->when($request->query('status'), fn ($q, $status) => $q->where('status', $status))
+            ->with(['serviceQueue', 'counter'])
+            ->latest('issued_at')
+            ->paginate(50);
+
+        return response()->json([
+            'data' => $tickets->getCollection()->map(fn (Ticket $t) => TicketPresenter::toArray($t)),
+            'meta' => [
+                'current_page' => $tickets->currentPage(),
+                'last_page' => $tickets->lastPage(),
+                'total' => $tickets->total(),
+            ],
+        ]);
+    }
+
+    public function store(Request $request): JsonResponse
+    {
+        $this->authorizeAbility($request, 'tickets.issue');
+        $owner = $this->ownerRef($request);
+
+        $validated = $request->validate([
+            'service_queue_id' => ['required', 'uuid'],
+            'customer_name' => ['nullable', 'string', 'max:255'],
+            'customer_phone' => ['nullable', 'string', 'max:50'],
+            'customer_email' => ['nullable', 'email', 'max:255'],
+            'priority' => ['nullable', 'string', 'in:'.implode(',', array_keys(config('qms.ticket_priorities')))],
+            'source' => ['nullable', 'string', 'in:'.implode(',', array_keys(config('qms.ticket_sources')))],
+        ]);
+
+        $queue = ServiceQueue::where('uuid', $validated['service_queue_id'])->firstOrFail();
+        $this->authorizeOwner($request, $queue);
+
+        $ticket = $this->engine->issueTicket($queue, $owner, [
+            ...$validated,
+            'source' => $validated['source'] ?? 'api',
+            'actor_ref' => $owner,
+        ]);
+
+        return response()->json(['data' => TicketPresenter::toArray($ticket)], 201);
+    }
+
+    public function show(Request $request, Ticket $ticket): JsonResponse
+    {
+        $this->authorizeAbility($request, 'tickets.view');
+        $this->authorizeOwner($request, $ticket);
+
+        return response()->json(['data' => TicketPresenter::toArray($ticket->load(['serviceQueue', 'counter']))]);
+    }
+
+    public function callNext(Request $request, ServiceQueue $serviceQueue): JsonResponse
+    {
+        $this->authorizeAbility($request, 'console.use');
+        $this->authorizeOwner($request, $serviceQueue);
+
+        $validated = $request->validate([
+            'counter_id' => ['required', 'uuid'],
+        ]);
+
+        $counter = \App\Models\Counter::where('uuid', $validated['counter_id'])->firstOrFail();
+        $this->authorizeOwner($request, $counter);
+
+        $ticket = $this->engine->callNext($serviceQueue, $counter, $this->ownerRef($request));
+
+        return response()->json(['data' => $ticket ? TicketPresenter::toArray($ticket) : null]);
+    }
+
+    public function action(Request $request, Ticket $ticket): JsonResponse
+    {
+        $this->authorizeAbility($request, 'tickets.manage');
+        $this->authorizeOwner($request, $ticket);
+        $actor = $this->ownerRef($request);
+
+        $validated = $request->validate([
+            'action' => ['required', 'string', 'in:recall,start,hold,skip,complete,no_show,cancel,delay'],
+            'minutes' => ['nullable', 'integer', 'min:5', 'max:120'],
+            'to_queue_id' => ['nullable', 'uuid'],
+            'reason' => ['nullable', 'string', 'max:500'],
+        ]);
+
+        $result = match ($validated['action']) {
+            'recall' => $this->engine->recall($ticket, $actor),
+            'start' => $this->engine->startServing($ticket, $actor),
+            'hold' => $this->engine->hold($ticket, $actor),
+            'skip' => $this->engine->skip($ticket, $actor),
+            'complete' => $this->engine->completeTicket($ticket, $actor),
+            'no_show' => $this->engine->markNoShow($ticket, $actor),
+            'cancel' => $this->engine->cancel($ticket, $actor),
+            'delay' => $this->engine->delayArrival($ticket, (int) ($validated['minutes'] ?? 15), $actor),
+            default => $ticket,
+        };
+
+        if ($validated['action'] === 'transfer' && ! empty($validated['to_queue_id'])) {
+            $toQueue = ServiceQueue::where('uuid', $validated['to_queue_id'])->firstOrFail();
+            $result = $this->engine->transfer($ticket, $toQueue, null, $validated['reason'] ?? null, $actor);
+        }
+
+        return response()->json(['data' => TicketPresenter::toArray($result->load(['serviceQueue', 'counter']))]);
+    }
+}

app/Http/Controllers/Api/WorkflowController.php

@@ -0,0 +1,34 @@
+<?php
+
+namespace App\Http\Controllers\Api;
+
+use App\Http\Controllers\Api\Concerns\ScopesApiToAccount;
+use App\Http\Controllers\Controller;
+use App\Models\Workflow;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+
+class WorkflowController extends Controller
+{
+    use ScopesApiToAccount;
+
+    public function index(Request $request): JsonResponse
+    {
+        $this->authorizeAbility($request, 'workflows.view');
+        $workflows = Workflow::owned($this->ownerRef($request))
+            ->where('organization_id', $this->organization($request)->id)
+            ->with('steps.serviceQueue')
+            ->orderBy('name')
+            ->get();
+
+        return response()->json(['data' => $workflows]);
+    }
+
+    public function show(Request $request, Workflow $workflow): JsonResponse
+    {
+        $this->authorizeAbility($request, 'workflows.view');
+        $this->authorizeOwner($request, $workflow);
+
+        return response()->json(['data' => $workflow->load('steps.serviceQueue')]);
+    }
+}