Every product screen has a clear owner.
Use this map to go from a URL or visible screen to the HTML, mobile route, shared assets, and backend access boundary that power it.
Public discovery and account routes
| Route | Source | Access | Responsibility |
|---|---|---|---|
/ | index.html | Public | Product positioning, use cases, translation story, pricing entry |
/products/record | product-record.html | Public | Record-specific product page and capture entry |
/products/meet | product-meet.html | Public | Meet-specific product page and room entry |
/pricing | pricing.html | Public | Guest/free/trial/paid limits and plan comparison |
/agencies-enterprise | agencies-enterprise.html | Public | Enterprise, agencies, security, and sales positioning |
/contact-sales | contact-sales.html | Public | Sales contact path |
/login | login.html, assets/login.js | Public | Login, registration, SSO start, password recovery |
/oauth-callback | oauth-callback.html | Public callback | Supabase OAuth code exchange and session completion |
/reset-password | reset-password.html | Recovery session | Password reset completion |
/privacy, /terms | privacy.html, terms.html | Public | Legal disclosures |
/support | Static export from support-docs | Public | Product handbook and support knowledgebase |
Record and video routes
| Route | Source | Access | Responsibility |
|---|---|---|---|
/record | record.html | Public; plan-aware | Multi-source browser capture, local download, paid workspace save |
/library | library.html | Product context | Recording library/player entry and editor handoff |
/video-editor | video-editor.html | Product context | Timeline, trim, layout, captions, clip and export configuration |
/share/:shareId | share.html | Public or password-gated | Public playback, transcript, summary, comments, CTA, export/download visibility |
/embed/:shareId | embed.html | Public or password-gated | Minimal embedded playback surface |
Meet routes
| Route | Source | Access | Responsibility |
|---|---|---|---|
/meet | meet.html | Public | Create/join lobby, name, captions, translation, camera preview |
/meet/:roomId | meet.html | Public room link | Host or guest prejoin, waiting room, live media, chat, captions, recording |
The same page moves through several modes: general lobby, created-room host prejoin, guest waiting room, active live room, and ended-call state. The URL and host token determine authority; the DOM is not the security boundary.
Workspace and administration routes
| Route | Source | Access | Responsibility |
|---|---|---|---|
/dashboard | dashboard.html | Authenticated | Active tenant, usage, videos, folders, scheduled meetings, summaries, team, billing, domains, security, identity |
/custom-domain | custom-domain.html | Paid workspace admin | Domain add, DNS instructions, verification, purpose and primary selection |
/workspace-tutorial | workspace-tutorial.html | Public guidance | Visual onboarding for workspaces, seats, billing, domains, and ownership |
/appsumo/redeem | appsumo-redeem.html | Authenticated buyer | AppSumo code redemption and entitlement confirmation |
/superadmin | superadmin.html, assets/superadmin*.js | Owner/staff role | Support cockpit, platform ops, users, tenants, billing, security, incidents, feature flags |
Mobile routes
| Route | Source | Responsibility |
|---|---|---|
/ | apps/mobile/app/index.tsx | Mobile product entry |
/auth | apps/mobile/app/auth.tsx | Mobile session and account access |
/meet/create | apps/mobile/app/meet/create.tsx | Create a meeting |
/meet/join | apps/mobile/app/meet/join.tsx | Join by link or room identifier |
/meet/[roomId] | apps/mobile/app/meet/[roomId].tsx | Live mobile meeting room |
Cross-screen contracts
Authentication
/api/me bootstraps the user, tenants, active tenant, plan, and entitlements. Protected page routes redirect before private HTML is served.
Tenant context
Workspace data always resolves through the active tenant and a current membership. Switching tenants changes the scope of subsequent requests.
Plan capabilities
Visible controls may preview a paid feature, but the API repeats the entitlement check for every protected write.
Finding the backend route
Search server.js for the exact /api/... path shown in the browser network request. Most browser helpers call requestJson; state-changing calls also include the current CSRF token. WebSocket behavior is owned by attachMeetingWebSocketServer and the /api/meetings/ws upgrade path.