<?xml version="1.0" encoding="utf-8"?>
<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9"
        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
        xsi:schemaLocation="http://www.sitemaps.org/schemas/sitemap/0.9
                            http://www.sitemaps.org/schemas/sitemap/0.9/sitemap.xsd">

  <!--
    Only public, non-PHI pages.
    All authenticated routes are blocked in robots.txt and excluded here.
    "Page with redirect" fix: / now serves a real landing page (no JS redirect
    for unauthenticated visitors) so Google gets a 200 OK, not a redirect.
  -->

  <!-- Home landing page — 200 OK for unauthenticated visitors after fix -->
  <url>
    <loc>https://www.rxledgercs.com/</loc>
    <lastmod>2026-06-05</lastmod>
    <changefreq>monthly</changefreq>
    <priority>1.0</priority>
  </url>

  <!-- Sign-in page — direct URL, no redirect, 200 OK -->
  <url>
    <loc>https://www.rxledgercs.com/Account/Login</loc>
    <lastmod>2026-06-05</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.9</priority>
  </url>

  <!-- Product / marketing page -->
  <url>
    <loc>https://www.rxledgercs.com/rxledgercs.html</loc>
    <lastmod>2026-06-05</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.8</priority>
  </url>

  <!--
    ❌ /forgot-password excluded — it is Disallowed in robots.txt.
       Including a disallowed URL causes a "blocked by robots.txt" conflict.
  -->

</urlset>