Attachments

Files on the ticket itself live in a private media-library bucket:

$media = Tickets::for($ticket)->by($agent)->attachments()->add($request->file('log'));
Tickets::for($ticket)->attachments()->remove($media);   // by model or uuid; another owner's is refused
Tickets::for($ticket)->attachments()->all();

• The bucket is tickets.attachments.bucket on tickets.attachments.disk (local — never media-library’s web-served public default), with tickets.attachments.mimes and max_kb.
• Downloads are temporary URLs — the disk’s own, or media-library’s signed stream route. API resources mint them for 5 minutes.
• Add and remove record an activity entry and fire TicketAttachmentAdded / TicketAttachmentRemoved; remove() takes a model or a uuid and refuses another owner’s media.
• Requesters see ticket attachments; for agent-only files use internal-note attachments. In the API, ticket-level uploads and removals are agent-only — requesters attach files to their replies.
• Reply and note attachments are comment attachments and follow comments’ comments.media.*. tickets:doctor checks that the attachments disk is not public and that download URLs can be minted.