<?xml version="1.0" encoding="UTF-8"?>
<!--
  Wild American Dog Food Co. — public pages only.

  THE RULE THIS FILE HALF-ENFORCES (Constitution X): every public page is either listed here or
  carries `noindex`. Never neither. A page that is in no sitemap and carries no directive is not
  "private" — it is simply undeclared, and search engines discover it by link, by referrer, or by a
  certificate-transparency log.

  Listed: the 14 HTML documents at the repository root that are meant to be found.
  Deliberately absent, and the reason for each:

    order-success.html    carries <meta name="robots" content="noindex">. It is a post-checkout
    contact-thanks.html   confirmation page, meaningless without the transaction that produced it.
                          Listed AND noindexed would be two halves contradicting each other.

    /portal/*             the internal staff portal. It is absent, and it must NOT be added — nor
                          may it be added to robots.txt as a `Disallow`, which would publish its
                          existence and its exact path to every crawler and every scraper that
                          reads robots.txt looking for exactly that. It is kept out of indexes by
                          `X-Robots-Tag: noindex` on its own responses and by requiring an
                          authenticated staff session on every route (FR-AP-014, FR-AP-001).

    /account/*            the CUSTOMER account, behind a sign-in. Absent for the same reason the
                          portal is, and it must NOT be added to robots.txt as a `Disallow` either:
                          that would publish the path to every scraper reading robots.txt looking
                          for exactly that. Kept out of indexes by `X-Robots-Tag: noindex` on its
                          own responses and by requiring a customer session on every route
                          (FR-CA-008, FR-CA-016).

                          ONE EXCEPTION, LISTED BELOW: `/account/signin`. Surface Classes
                          (constitution 1.2.0) puts the sign-in ENTRY POINT in the public page set —
                          it renders its content to an anonymous visitor — so the listed-or-noindex
                          rule applies to it as a public page, and it is listed. Its sibling
                          `/account/signin/verify` is NOT: that URL is a single-use credential, and
                          a crawler following it would burn one.

    /api/*                not content. Disallowed in robots.txt.

  No <lastmod>, <changefreq> or <priority>. There is no build step generating this file, so a
  lastmod would be hand-maintained, would go stale within a release, and a sitemap whose dates are
  wrong is one a crawler learns to disregard entirely. Absent is honest; stale is worse than absent.
  Google ignores changefreq and priority outright.

  Absolute URLs are required by the sitemap protocol, so this file names the production origin.
  The same object is also served from the staging distribution, where it points at production —
  harmless, but see the note in robots.txt about staging being crawlable at all.

  WHEN YOU ADD A PAGE: add it here, or give it `noindex`. Doing neither is the failure this comment
  exists to prevent, and nothing currently asserts it — see the note at the end of robots.txt.
-->
<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">
  <url><loc>https://wildamericandogfood.com/</loc></url>
  <url><loc>https://wildamericandogfood.com/about.html</loc></url>
  <url><loc>https://wildamericandogfood.com/account/signin</loc></url>
  <url><loc>https://wildamericandogfood.com/contact.html</loc></url>
  <url><loc>https://wildamericandogfood.com/faqs.html</loc></url>
  <url><loc>https://wildamericandogfood.com/manage-subscription.html</loc></url>
  <url><loc>https://wildamericandogfood.com/meal-plans.html</loc></url>
  <url><loc>https://wildamericandogfood.com/order.html</loc></url>
  <url><loc>https://wildamericandogfood.com/our-process.html</loc></url>
  <url><loc>https://wildamericandogfood.com/privacy.html</loc></url>
  <url><loc>https://wildamericandogfood.com/recipe.html</loc></url>
  <url><loc>https://wildamericandogfood.com/refund-policy.html</loc></url>
  <url><loc>https://wildamericandogfood.com/shipping-policy.html</loc></url>
  <url><loc>https://wildamericandogfood.com/terms.html</loc></url>
  <url><loc>https://wildamericandogfood.com/testimonials.html</loc></url>
  <!-- /account/signin is LISTED, as of 2026-08-31.

       It is a PUBLIC page (Surface Classes, constitution 1.2.0): served in full to an anonymous
       visitor, and the only /account path that is. Everything behind the sign-in is a customer
       authenticated surface and stays out of this file permanently, kept from indexes by
       `x-robots-tag: noindex` on its own responses (ACCOUNT_RESPONSE_HEADERS).

       /account/signin/verify is NOT here and never will be: that URL is a single-use credential,
       and ACCOUNT_CREDENTIAL_HEADERS noindexes it for that reason.

       It was absent until now because FR-CA-090 gated enablement on the privacy-policy amendment
       going back through counsel — re-approved 2026-08-31, line 11 of
       docs/launch-compliance-checklist.md. Listing a sign-in page for a feature whose privacy
       disclosure was unapproved is an invitation we should not have sent.

       Because a page must be LISTED or NOINDEXED and never neither, this entry is paired with the
       ABSENCE of `x-robots-tag: noindex` in ACCOUNT_PUBLIC_HEADERS. Removing one without the other
       is caught by services/payment/test/account-indexability.test.ts. -->
</urlset>
