# 03 — Sitemap (Mobile · Website · Dashboard · API)

## Mobile (Expo Router groups)

```
(auth)
  splash
  onboarding/[step]   # 1, 2, 3
  login
  signup
  forgot-password
  otp/[purpose]       # signup, login, reset

(tabs)
  home
  discover
  bookings
  saved
  profile

services/[type]       # stays | activities | taxi | food | pharmacy | grocery | sim | emergency
listing/[id]          # hotel, restaurant, activity, etc.
room-select/[listingId]
checkout/[bookingId]
trip-planner/[step]   # 1..4
trip-planner/result/[tripId]
translator
emergency
settings
settings/language
settings/notifications
settings/payment-methods
settings/security
```

Modal stack: `image-viewer`, `confirm-call`, `share-sheet`.

## Website (Next.js, app router, locale-prefixed)

```
/[locale]/                      hero, services, featured destinations, CTA
/[locale]/tourists              value prop, app screens, store badges
/[locale]/partners              partner pitch, types, apply form
/[locale]/destinations          UAE city grid (filterable)
/[locale]/destinations/[city]   city detail + listings preview
/[locale]/about
/[locale]/press
/[locale]/contact
/[locale]/privacy
/[locale]/terms
/sitemap.xml
/robots.txt
/api/contact         (server action)
```

`locale` ∈ `{en, ar}`. AR routes render RTL.

## Dashboard (Next.js, app router, auth-gated)

```
/login

/overview
/users                  list, filter, invite
/users/[id]             profile, roles, memberships
/roles
/roles/[id]
/permissions

/businesses             partner orgs
/businesses/[id]        listings, members, payouts
/memberships

/destinations
/destinations/[id]
/categories

/listings               umbrella across types
/listings/[id]

/bookings
/bookings/[id]
/orders
/orders/[id]

/payments               (placeholder)
/refunds
/payouts                (placeholder)
/reports                (placeholder)

/content                blocks, banners, hero copy
/audit-logs
/settings
/settings/integrations
/settings/feature-flags
```

## API v1 (`/v1`)

```
auth/             signup, login, refresh, logout, otp, forgot, reset, social
users/            me, [id], invitations
roles/            crud
permissions/      list (read-only)
businesses/       crud + members
memberships/      crud, invite, accept
destinations/     crud + content translations
categories/       crud
listings/         umbrella; sub-routes by type
listings/stays/[id]/rooms
bookings/         create, list (own/all), [id], cancel
orders/           create, list, [id], cancel
payments/         intent, confirm, webhook
refunds/          request, approve, list
payouts/          list, run (admin)
saved/            list, add, remove
trip-planner/     start, step, result
translator/       upload, translate
emergency/        list (UAE seed)
reviews/          create, list, moderate
support/tickets/  create, list, [id], message
audit-logs/       list, [id]
i18n/content/     fetch translatable content
health
webhooks/<provider>
```

All endpoints follow REST/Problem-Details, return `application/json`, and accept `Accept-Language: en|ar`.