# =============================================================================
# robots.txt — RenderThat
# Purpose: CRAWL control only. Indexing is controlled via meta robots / auth.
# Spec: https://www.rfc-editor.org/rfc/rfc9309.html
# =============================================================================

User-agent: *
Allow: /

# Backend / non-HTML endpoints — save crawl budget.
Disallow: /api/
Disallow: /functions/
Disallow: /rest/
Disallow: /auth/

# NOTE: /admin, /account, /dashboard, /settings are NOT disallowed here.
# They are auth-gated and ship <meta name="robots" content="noindex,nofollow">,
# which is the only reliable way to keep them out of search results.
# (Disallow would prevent Google from seeing the noindex tag.)

# NOTE: Tracking-param duplicates (utm_*, fbclid, gclid, ...) are handled via
# canonical tags — not blocked here, so Google can read the canonical.

# Two sitemaps: the static copy (regenerated from the edge function on every
# build via scripts/generate-sitemap.ts) and the edge function itself, which
# stays current even when blog/glossary content changes in Supabase between
# publishes. Cross-host sitemap references are valid when declared here.
Sitemap: https://renderthat.com/sitemap.xml
Sitemap: https://axgcfdkydvdystmmtgsu.supabase.co/functions/v1/sitemap