<?xml version="1.0" encoding="UTF-8"?>
<!--
  Kyndara sitemap — served at https://www.kyndara.org/sitemap.xml

  SERVING: shared/vite/brandSitemap.ts copies THIS file to dist/kyndara/sitemap.xml
  at build time and deletes every other brand's leaked sitemap from that dist.
  There is deliberately no /kyndara-sitemap.xml URL in production; the filename
  in public/ only distinguishes the three brands inside the shared publicDir.

  ROUTE SET: every <loc> here must be a path App.tsx actually mounts as a public
  Kyndara page. Kyndara's pages live under /kyndara/*, NOT at the unprefixed
  marketing paths — this file used to list /pricing, /about, /contact,
  /transparency, /security, /privacy and /terms, and on kyndara.org those render
  Pulsar's page (BrandRouteGuard treats /security, /privacy and /terms as shared
  routes, and src/pages/Pricing.tsx hardcodes a pulsarcampaigns.app canonical) or
  bounce to the Kyndara home as a soft 404 (bare /transparency has no route at
  all — only /transparency/:slug).

  DELIBERATE OMISSIONS (declared, not forgotten):
    /kyndara                 — renders the same KyndaraHome component as "/".
                               "/" is the canonical homepage; /kyndara has no
                               static shell of its own, so it falls through the
                               vercel.json SPA rewrite to the "/" prerender and
                               inherits its canonical.
    /kyndara/privacy         — src/pages/kyndara/KyndaraPrivacy.tsx and
    /kyndara/terms             KyndaraTerms.tsx both set <SEOHead noindex>.
                               Sitemapping a noindex page is a contradiction
                               Search Console reports as an error. They stay
                               crawlable in robots.txt so the noindex is seen.
    /donate/:slug            — per-organization pages, unbounded and
    /transparency/:slug        organization-owned. No static enumeration exists;
                               they are discovered from the organizations' own
                               links.
    /embed/*                 — iframe surfaces, Disallowed in robots.txt.

  NO <lastmod>: see the block comment above SITEMAP_LASTMOD_POLICY in
  scripts/generate-static-seo.mjs. There is no honest per-URL "last changed"
  signal available here, and a build-stamped date would be a lie that also
  breaks generator idempotency (repo hygiene rule 3).
-->
<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">

  <url>
    <loc>https://www.kyndara.org/</loc>
    <changefreq>daily</changefreq>
    <priority>1.0</priority>
  </url>
  <url>
    <loc>https://www.kyndara.org/kyndara/pricing</loc>
    <changefreq>weekly</changefreq>
    <priority>0.9</priority>
  </url>
  <url>
    <loc>https://www.kyndara.org/kyndara/about</loc>
    <changefreq>monthly</changefreq>
    <priority>0.8</priority>
  </url>
  <url>
    <loc>https://www.kyndara.org/kyndara/campaigns</loc>
    <changefreq>daily</changefreq>
    <priority>0.8</priority>
  </url>
  <url>
    <loc>https://www.kyndara.org/kyndara/contact</loc>
    <changefreq>monthly</changefreq>
    <priority>0.6</priority>
  </url>
  <url>
    <loc>https://www.kyndara.org/kyndara/security</loc>
    <changefreq>monthly</changefreq>
    <priority>0.6</priority>
  </url>
</urlset>
