<?xml version="1.0" encoding="UTF-8"?>
<!--
  Wild American Dog Food Co. — public pages only.

  THE RULE THIS FILE HALF-ENFORCES (Constitution X): every public page is either listed here or
  carries `noindex`. Never neither. A page that is in no sitemap and carries no directive is not
  "private" — it is simply undeclared, and search engines discover it by link, by referrer, or by a
  certificate-transparency log.

  Listed: the 14 HTML documents at the repository root that are meant to be found.
  Deliberately absent, and the reason for each:

    order-success.html    carries <meta name="robots" content="noindex">. It is a post-checkout
    contact-thanks.html   confirmation page, meaningless without the transaction that produced it.
                          Listed AND noindexed would be two halves contradicting each other.

    /portal/*             the internal staff portal. It is absent, and it must NOT be added — nor
                          may it be added to robots.txt as a `Disallow`, which would publish its
                          existence and its exact path to every crawler and every scraper that
                          reads robots.txt looking for exactly that. It is kept out of indexes by
                          `X-Robots-Tag: noindex` on its own responses and by requiring an
                          authenticated staff session on every route (FR-AP-014, FR-AP-001).

    /account/*            the CUSTOMER account, behind a sign-in. Absent for the same reason the
                          portal is, and it must NOT be added to robots.txt as a `Disallow` either:
                          that would publish the path to every scraper reading robots.txt looking
                          for exactly that. Kept out of indexes by `X-Robots-Tag: noindex` on its
                          own responses and by requiring a customer session on every route
                          (FR-CA-008, FR-CA-016).

                          ONE EXCEPTION, LISTED BELOW: `/account/signin`. Surface Classes
                          (constitution 1.2.0) puts the sign-in ENTRY POINT in the public page set —
                          it renders its content to an anonymous visitor — so the listed-or-noindex
                          rule applies to it as a public page, and it is listed. Its sibling
                          `/account/signin/verify` is NOT: that URL is a single-use credential, and
                          a crawler following it would burn one.

    /api/*                not content. Disallowed in robots.txt.

  No <lastmod>, <changefreq> or <priority>. There is no build step generating this file, so a
  lastmod would be hand-maintained, would go stale within a release, and a sitemap whose dates are
  wrong is one a crawler learns to disregard entirely. Absent is honest; stale is worse than absent.
  Google ignores changefreq and priority outright.

  Absolute URLs are required by the sitemap protocol, so this file names the production origin.
  The same object is also served from the staging distribution, where it points at production —
  harmless, but see the note in robots.txt about staging being crawlable at all.

  WHEN YOU ADD A PAGE: add it here, or give it `noindex`. Doing neither is the failure this comment
  exists to prevent, and nothing currently asserts it — see the note at the end of robots.txt.
-->
<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">
  <url><loc>https://wildamericandogfood.com/</loc></url>
  <url><loc>https://wildamericandogfood.com/about.html</loc></url>
  <url><loc>https://wildamericandogfood.com/contact.html</loc></url>
  <url><loc>https://wildamericandogfood.com/faqs.html</loc></url>
  <url><loc>https://wildamericandogfood.com/manage-subscription.html</loc></url>
  <url><loc>https://wildamericandogfood.com/meal-plans.html</loc></url>
  <url><loc>https://wildamericandogfood.com/order.html</loc></url>
  <url><loc>https://wildamericandogfood.com/our-process.html</loc></url>
  <url><loc>https://wildamericandogfood.com/privacy.html</loc></url>
  <url><loc>https://wildamericandogfood.com/recipe.html</loc></url>
  <url><loc>https://wildamericandogfood.com/refund-policy.html</loc></url>
  <url><loc>https://wildamericandogfood.com/shipping-policy.html</loc></url>
  <url><loc>https://wildamericandogfood.com/terms.html</loc></url>
  <url><loc>https://wildamericandogfood.com/testimonials.html</loc></url>
  <!-- The customer sign-in entry point is DELIBERATELY ABSENT, and this is a temporary state.

       It is a PUBLIC page (Surface Classes, constitution 1.2.0): served in full to an anonymous
       visitor, and the only /account path that is. When the surface is enabled it belongs here,
       listed like every other public page.

       It is not enabled. FR-CA-090 gates that on the privacy-policy amendment going back through
       counsel — line 11 of docs/launch-compliance-checklist.md. Nothing on the site links to
       /account, so this entry was the only public pointer at it, and listing a sign-in page for a
       feature whose privacy disclosure is unapproved is an invitation we should not send.

       Because a page must be LISTED or NOINDEXED and never neither, its absence here is paired
       with `x-robots-tag: noindex` in ACCOUNT_PUBLIC_HEADERS. Restoring one without the other is
       caught by services/payment/test/account-indexability.test.ts.

       TO ENABLE: add a url entry for https://wildamericandogfood.com/account/signin alongside the
       others above, and delete that header line, in one commit.

       (Written as prose rather than as a commented-out entry on purpose. A real <loc> tag sitting
       inside this comment would be found by every grep that scans this file for listed URLs — and
       this repo has twice shipped a test that failed on its own documentation.) -->
</urlset>
