# See https://www.robotstxt.org/robotstxt.html for documentation on how to use the robots.txt file

User-agent: *
Allow: /

# Content Signals — declare AI content-usage preferences (contentsignals.org,
# draft-romm-aipref-contentsignals). These signals apply only to crawlable
# content, which is our public marketing site (landing, blog, docs) — all user
# data is client-side encrypted and auth-walled. We allow AI usage of that
# marketing content for discoverability (Answer Engine Optimization), which is
# the same goal as our llms.txt:
#   search=yes    — allow indexing for search results
#   ai-input=yes  — allow use as live AI input (RAG/grounding) in answers
#   ai-train=yes  — allow use to train AI models
Content-Signal: search=yes, ai-input=yes, ai-train=yes

# Sitemap location
Sitemap: https://killswitch.app/sitemap.xml

# LLM/AI context file (AEO - Answer Engine Optimization)
# See https://llmstxt.org for specification
# LLMsTxt: https://killswitch.app/llms.txt
# LLMsFullTxt: https://killswitch.app/llms-full.txt

# Disallow admin and authenticated areas.
#
# Patterns use:
#   /path$    — exact match for the bare URL only
#   /path/    — anything under that directory
#
# Together these block both the index route and all sub-routes without
# prefix-matching unrelated public URLs (e.g. /deadman$ + /deadman/
# blocks /deadman and /deadman/123 but does NOT block the public SEO
# page /deadman-switch-email). Google, Bing, and all major crawlers
# support $ and *; older bots that don't will see no match and may
# crawl the auth-walled URL, which the application then redirects to
# sign-in — harmless.
#
# Whenever you add a new top-level authenticated route, add BOTH a
# /path$ and a /path/ entry here.

Disallow: /admin$
Disallow: /admin/
Disallow: /dashboard$
Disallow: /dashboard/
Disallow: /notebooks$
Disallow: /notebooks/
Disallow: /notebook-media/
Disallow: /notebook-entries/
Disallow: /settings$
Disallow: /settings/
Disallow: /beneficiaries$
Disallow: /beneficiaries/
Disallow: /deadman$
Disallow: /deadman/
Disallow: /shares$
Disallow: /shares/
Disallow: /api$
Disallow: /api/
Disallow: /webhooks$
Disallow: /webhooks/
Disallow: /auth$
Disallow: /auth/

# NOT blocked here, deliberately (killswit-mnd):
#
#   /register — the trial page. Blog CTAs link to it, so Google found it via
#     those links and then could not fetch it, which is what produced the GSC
#     "Indexed, though blocked by robots.txt" warning. It is a public
#     conversion page and should be indexed normally.
#
#   /sign-in — carries a `noindex` meta instead (SignInLive assigns
#     `noindex: true`; see root.html.heex). Blocking it here would be
#     counter-productive: a disallowed URL can still be indexed from inbound
#     links, and Google can never see a noindex on a page it is not allowed to
#     fetch. Letting it be crawled is what lets Google read the noindex and
#     DROP the leftover indexation.
#
# The rule of thumb: robots.txt controls crawling, not indexing. To keep a
# page OUT of the index, let it be crawled and serve `noindex`.

Disallow: /reset$
Disallow: /password-reset/
Disallow: /dev$
Disallow: /dev/