feat(seo): add sitemap.xml

[prudentbird]

Summary

Adds a generated sitemap.xml (src/app/sitemap.ts) so search engines have a formal list of pages.

• Lists public, indexable pages with lastModified, changeFrequency, and priority.
• Page list is centralized in a publicRoutes constant in src/lib/site.ts — adding a public page updates the sitemap from one place.
• Gated (/admin, /user), API, and noindex pages (auth, /terms, /privacy) are excluded.

Done when (issue #108)

• sitemap.xml lists every public page with last-modified and priority.
• Gated, admin, and API routes are excluded.
• Updates automatically as new public pages are added (via the shared publicRoutes list).

Validation

• npm run typecheck ✅
• npm run build ✅ — /sitemap.xml route generated.

Notes

Stacked on #107 (targets feat/seo-107-robots-txt). noindex legal/auth pages are intentionally omitted (listing non-indexable URLs in a sitemap is discouraged). robots.txt from #107 already references this sitemap.

Closes #108

[claude]

Claude finished @prudentbird's task —— View job

---

Code Review Complete ✅

Review Checklist:

• Read repository guidelines (CLAUDE.md)
• Analyze sitemap.ts implementation
• Review site.ts changes
• Check code quality and best practices
• Identify potential bugs or issues
• Evaluate performance considerations
• Assess security concerns
• Review test coverage needs
• Provide comprehensive feedback

---

📋 Review Summary

Overall, this is a clean and well-structured implementation of sitemap generation for SEO purposes. The code follows Next.js 14+ conventions and demonstrates good architectural decisions.

✅ Strengths

1. Clean Architecture: Centralized route management in publicRoutes constant makes maintenance easier
2. Type Safety: Proper TypeScript usage with MetadataRoute.Sitemap and satisfies for compile-time validation
3. SEO Best Practices: Correctly excludes non-indexable pages (gated, admin, API routes)
4. Consistent Validation: Implementation has been tested with typecheck and build commands

🔍 Code Quality & Best Practices

frontend/src/app/sitemap.ts:5-6

• ✅ Good: Uses Next.js 14+ App Router sitemap convention
• ✅ Good: Simple, functional approach with proper return type

frontend/src/lib/site.ts:35-49

• ✅ Good: TypeScript satisfies operator ensures type safety while preserving literal types
• ✅ Good: Readonly array prevents accidental mutations
• ✅ Good: Union type for changeFrequency matches XML sitemap spec

⚠️ Potential Issues

1. Performance Consideration: All routes share the same lastModified timestamp

   • Impact: Search engines may not efficiently crawl unchanged pages
   • Suggestion: Consider implementing per-route last modified dates based on actual content changes

2. Missing URL Validation: absoluteUrl() function doesn't validate URL format

   • Risk: Malformed URLs could break sitemap validity
   • Suggestion: Add basic URL validation or use URL constructor for safety

// frontend/src/lib/site.ts:51-53
export function absoluteUrl(path = '/'): string {
  try {
    const url = new URL(path.startsWith('/') ? path : `/${path}`, siteConfig.url);
    return url.toString();
  } catch {
    return `${siteConfig.url}/`;
  }
}

🚨 Security Concerns

Low Risk: No significant security vulnerabilities detected

• Environment variable usage (env.NEXT_PUBLIC_SITE_URL) is appropriate for client-side URL generation
• No user input processing or XSS vectors identified

🧪 Test Coverage

Missing: No test files found in the codebase

• Recommendation: Add unit tests for:
  • absoluteUrl() function with various path formats
  • Sitemap generation with different route configurations
  • Edge cases (empty routes, malformed URLs)

🚀 Performance Considerations

1. Static Generation: ✅ Sitemap is generated at build time (optimal)
2. Route Scale: ✅ Current implementation efficient for small-to-medium route counts
3. Future Scaling: Consider implementing dynamic sitemap generation if routes exceed ~1000 entries

📝 Minor Suggestions

1. Documentation: Add JSDoc comments for public functions
2. Error Handling: Consider error boundaries for sitemap generation failures
3. Monitoring: Add analytics/logging for sitemap generation success

🎯 Verdict

Approved with minor suggestions. This implementation correctly addresses the SEO requirements and follows Next.js best practices. The suggested improvements are non-blocking and can be addressed in future iterations.

---