<?xml version="1.0" encoding="UTF-8"?>
<!--
  Sitemap for the /user/ app. Deployed from public/, so it is served at
  https://app.cardify.co/user/sitemap.xml and is therefore only allowed to list
  URLs under /user/ — which is exactly its scope.

  Contents: the three indexable auth routes plus the whole public storefront.
  This file is the SOURCE: at build time vite.config.js (crawlFiles) drops the
  storefront entries from the app's copy and turns them into
  https://store.cardify.co/sitemap.xml for the store build (npm run build:store),
  since the store's canonical home is the subdomain.
  Deliberately ABSENT:
    - /user/auth/{reset-password,verify,verification,complete-registration}
      one-shot token/step pages shipping noindex, follow (src/auth/seo.js)
    - /user/store/{checkout,account,track}  session/order-scoped, noindex
      (src/store/seo.js)
    - /user/dash/*  session-gated; noindex on every route (src/dash/seo.js)
  Listing any of those would contradict the noindex the page itself serves.

  Product and collection URLs are derived from src/store/data/products.js —
  when that catalogue changes, this file must be regenerated to match.
-->
<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9"
        xmlns:xhtml="http://www.w3.org/1999/xhtml">

  <!-- Auth -->
  <url>
    <loc>https://app.cardify.co/user/auth/login</loc>
    <xhtml:link rel="alternate" hreflang="en-NG" href="https://app.cardify.co/user/auth/login"/>
    <xhtml:link rel="alternate" hreflang="x-default" href="https://app.cardify.co/user/auth/login"/>
    <lastmod>2026-07-28</lastmod>
    <changefreq>weekly</changefreq>
    <priority>1.0</priority>
  </url>
  <url>
    <loc>https://app.cardify.co/user/auth/register</loc>
    <xhtml:link rel="alternate" hreflang="en-NG" href="https://app.cardify.co/user/auth/register"/>
    <xhtml:link rel="alternate" hreflang="x-default" href="https://app.cardify.co/user/auth/register"/>
    <lastmod>2026-07-28</lastmod>
    <changefreq>weekly</changefreq>
    <priority>0.9</priority>
  </url>
  <url>
    <loc>https://app.cardify.co/user/auth/forgot-password</loc>
    <xhtml:link rel="alternate" hreflang="en-NG" href="https://app.cardify.co/user/auth/forgot-password"/>
    <xhtml:link rel="alternate" hreflang="x-default" href="https://app.cardify.co/user/auth/forgot-password"/>
    <lastmod>2026-07-28</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.6</priority>
  </url>

</urlset>
