<?xml version="1.0" encoding="UTF-8"?>
<!--
  BACKLOG I1 — the public pages of FlyerPostCMS Deals.

  🔴 Until 25 August 2026 there was no sitemap. A request for /sitemap.xml fell
  through the `/*` catch-all in `_redirects` and returned the Flutter app shell
  as `text/html`, which a crawler reads as "no sitemap" rather than as an error.

  ⚠️ EVERY URL HERE IS A SECTION, NOT A LISTING. This is a single-page Flutter
  app: a flyer's own page is rendered by JavaScript, and a crawler that does not
  run JavaScript sees an empty document. Listing one flyer per line would be
  listing pages that read as blank, which is worse for the site than not listing
  them at all. Per-flyer share cards are a different mechanism and already
  exist — the flipbook viewer rewrites its own tags at the edge, per flyer, in
  `viewer/functions/b/[slug].ts`.

  🔴 NOT ONE GUARDED PATH IS LISTED, and that is checked rather than trusted:
  `sitemap_and_robots_test.dart` runs every URL below through the router's real
  `Routes.requiresSignIn` and fails if any of them would bounce a signed-out
  visitor to sign-in. A sitemap advertising a page that asks for a password is
  how a site gets its own login screen indexed.

  ⚠️ No <lastmod>. A date nothing maintains is a claim a crawler acts on, and
  nothing in the deploy would update one. Leaving it out says less and is true.

  ⚠️ Three public routes are deliberately ABSENT — /basket, /following and
  /scan. They are real and public, and every one of them is device-local: the
  basket, the follow list and the barcode scanner hold their state on the
  shopper's own machine and never reach a server. To a crawler they are empty
  rooms. The test knows they are excluded on purpose and fails if a route is
  added that is neither listed nor named there, so nothing can go missing
  silently.
-->
<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">

  <!-- Deals near you. The front page. -->
  <url>
    <loc>https://flyerpostcms.com/</loc>
    <changefreq>daily</changefreq>
    <priority>1.0</priority>
  </url>

  <!-- This week's flyers. -->
  <url>
    <loc>https://flyerpostcms.com/flyers</loc>
    <changefreq>daily</changefreq>
    <priority>0.9</priority>
  </url>

  <!-- Search a product by name or barcode. -->
  <url>
    <loc>https://flyerpostcms.com/search</loc>
    <changefreq>daily</changefreq>
    <priority>0.8</priority>
  </url>

  <!-- One product, every shop near you. -->
  <url>
    <loc>https://flyerpostcms.com/compare</loc>
    <changefreq>daily</changefreq>
    <priority>0.8</priority>
  </url>

  <!-- Shops around you. -->
  <url>
    <loc>https://flyerpostcms.com/stores</loc>
    <changefreq>weekly</changefreq>
    <priority>0.7</priority>
  </url>

  <!-- Coupons a shopper can take. -->
  <url>
    <loc>https://flyerpostcms.com/coupons</loc>
    <changefreq>weekly</changefreq>
    <priority>0.6</priority>
  </url>

  <!--
    🔴 The front door of the entire retailer product, and it sits UNDER the
    guarded /retailer prefix. It was locked from the outside until 22 August
    2026 and nothing on the public site said a shop could join at all. A
    shopkeeper searching for how to list their shop has to be able to find this.
  -->
  <url>
    <loc>https://flyerpostcms.com/retailer/apply</loc>
    <changefreq>monthly</changefreq>
    <priority>0.9</priority>
  </url>

  <!-- Terms, privacy, cookies, acceptable use, IP and takedown. -->
  <url>
    <loc>https://flyerpostcms.com/legal</loc>
    <changefreq>monthly</changefreq>
    <priority>0.4</priority>
  </url>

  <!--
    ⚠️ Listed on purpose. Google Play requires an account-deletion page that a
    person can reach WITHOUT signing in, and the whole point is that somebody
    locked out of their account can find it. A page nobody can find does not
    satisfy that, whatever the Play Console submission says.
  -->
  <url>
    <loc>https://flyerpostcms.com/delete-account</loc>
    <changefreq>yearly</changefreq>
    <priority>0.3</priority>
  </url>

</urlset>
