User-agent: *
Allow: /

# Private post-login flows. These have never been indexed, so blocking the crawl
# costs nothing. The blank app shells that WERE indexed - /auth/purchase-plan/*,
# /app, /projects/my, /auth/user-deletion-steps - are deliberately absent from this
# list: they carry X-Robots-Tag: noindex from app.routes.server.ts, and a Disallow
# here would stop Google fetching them and therefore stop it ever reading that
# noindex, freezing them in the index as thin duplicates forever.
Disallow: /auth/login
Disallow: /auth/sign-up
Disallow: /auth/action
Disallow: /auth/forgot-password
Disallow: /auth/mfa-setup
Disallow: /auth/verify-email
Disallow: /auth/profile
Disallow: /auth/profile-edit
Disallow: /auth/agreements
Disallow: /auth/updated-agreements
Disallow: /auth/email-not-verified

# Non-page files at root
Disallow: /data/projects-data.json
Disallow: /manifest.json
Disallow: /scully-routes.json
Disallow: /material-icons.css
Disallow: /material-icons.woff2
Disallow: /index.csr.html

Sitemap: https://bitbybit.dev/sitemap.xml