Collaboration modules

Sharing and friends

/api/v1/sharing/ owns single and bulk share creation, sent/received/request lists, accept/reject transitions, detail, and authorized shared-file download. /api/v1/friends/ owns search, requests, accept/decline/cancel, nicknames, and removal. Both modules validate actor and recipient state before transitions.

/api/v1/notifications/ provides listing, unread count, read/mark-all-read, and deletion. Unread counts may be cached in Redis, but rows remain PostgreSQL authority.

Schedules and public feeds

/api/v1/schedule/ owns private calendars and events. /api/v1/public/schedule/ serves token-scoped public information, ICS/webcal output, and QR-based access. The schedule reminder dispatcher finds due events, checks SMS credit conditionally, invokes the provider, and records delivery state.

Public feeds expose only token-scoped calendar information. They never make private calendar credentials or unrelated events available.