<?xml version="1.0" encoding="UTF-8"?>
<!--
  Whole-host sitemap. Canonical host: https://verifiedtradealerts.com (apex, non-www).

  Like robots.txt this is authored in the Customer repo but governs BOTH apps, and
  is served at the origin root by a dedicated cache behaviour in
  Customer/infrastructure/cloudfront.yml. After the root-domain flip the trader app
  owns `/` and the customer app owns `/members`, so both prefixes appear below.

  Every loc must match that page's own canonical tag exactly.

  Deliberately EXCLUDED:
    - Per-trader routes: profile/, plans/, education/, coaching/, t/. These are
      prerendered and indexable, but are NEVER listed here. Discovery happens via
      traders' own links so search cannot enumerate the roster into a de-facto
      directory. This is the anti-directory decision, not an oversight or a TODO.
      See the `project_seo_trader_profile_indexing` note before changing it.
    - Redirect-only paths (/members/landing -> /members, /members/support ->
      /members/support/contact-us): list the canonical target, not the redirect.
    - Old root URLs that now 301 into /members: list the destination only.
    - All robots.txt-disallowed routes (auth, gated, transactional, ad landings).
    - `/` itself: it renders a redirect component that router.navigates to
      /landing, so it is the redirect SOURCE. Per the rule above, the canonical
      target is listed instead. Making `/` serve the landing page directly would
      let `/` be the listed URL, which is the nicer end state.

  NOT prerendered: the seven trader-app URLs below are served by a client-rendered
  SPA (no @angular/ssr in the Trader repo), so their title, description, and
  canonical are written at runtime by its SeoService. Google renders JS and will
  see them; non-rendering crawlers get the shell. This is a known asymmetry with
  the /members half, which IS backed by prerendered HTML. Prerendering the trader
  app is the fix, tracked separately.

  Legal pages resolve to the ROOT copies. The customer app still serves its own at
  /members/privacy-policy and /members/terms-of-service for in-app links, but those
  canonicalize to the root URLs and are not listed here.

  Keep consistent with src/robots.txt: never list a Disallow-ed URL.
-->
<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">
  <!-- Trader app (site root): public marketing -->
  <url>
    <loc>https://verifiedtradealerts.com/landing</loc>
  </url>
  <url>
    <loc>https://verifiedtradealerts.com/faqs</loc>
  </url>
  <url>
    <loc>https://verifiedtradealerts.com/privacy-policy</loc>
  </url>
  <url>
    <loc>https://verifiedtradealerts.com/terms-of-service</loc>
  </url>
  <url>
    <loc>https://verifiedtradealerts.com/legal/repeat-infringer-policy</loc>
  </url>
  <url>
    <loc>https://verifiedtradealerts.com/legal/dmca-notice</loc>
  </url>

  <!-- Customer app (/members): public subscriber-facing surfaces -->
  <url>
    <loc>https://verifiedtradealerts.com/members</loc>
  </url>
  <url>
    <loc>https://verifiedtradealerts.com/members/trader-search</loc>
  </url>
  <url>
    <loc>https://verifiedtradealerts.com/members/support/contact-us</loc>
  </url>
</urlset>
