<?xml version="1.0" encoding="UTF-8"?>
<!--
  BROSINO sitemap.

  Only the three publicly reachable URLs are listed. Everything else is either
  auth-gated (/, /profile, /room/*), a one-time token page (/auth,
  /reset-password) or a per-floor invite (/join/*) — those are noindex in the
  route head and disallowed in robots.txt, and a sitemap must never contradict
  those signals.

  "/" is included even though it bounces anonymous visitors to /login: it is
  the canonical brand URL and the PWA start_url.
-->
<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">
  <url>
    <loc>https://brosino.app/</loc>
    <lastmod>2026-08-02</lastmod>
    <changefreq>weekly</changefreq>
    <priority>1.0</priority>
  </url>
  <url>
    <loc>https://brosino.app/login</loc>
    <lastmod>2026-08-02</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.8</priority>
  </url>
  <url>
    <loc>https://brosino.app/signup</loc>
    <lastmod>2026-08-02</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.8</priority>
  </url>
</urlset>
