User-agent: *
Allow: /

# Private in-app views (authenticated SPA routes). They carry no SEO value and
# only show up in Search Console as 404 / soft-404 when crawled as paths, so we
# keep them out of the index. Public marketing/content routes stay crawlable.
Disallow: /portfolio
Disallow: /watchlist
Disallow: /memory
Disallow: /trade-intent
Disallow: /commitments
Disallow: /coach
Disallow: /ai$
Disallow: /ai/
Disallow: /auth
Disallow: /feedback

# API endpoint paths (2026-07-14, GSC review). Google extracts these route
# strings from the JS bundle and crawls them on the main domain; the SPA
# fallback answers 200 with the app shell, which then piles up in Search
# Console as "Alternate page with proper canonical" (37 pages). They are
# backend routes, not pages — block the crawl entirely.
Disallow: /admin
Disallow: /telegram
Disallow: /markets$
Disallow: /markets/
Disallow: /heatmap
Disallow: /reflection
Disallow: /exchange-link
Disallow: /broker-link
Disallow: /paper$
Disallow: /paper/
Disallow: /brief$
Disallow: /brief/
Disallow: /journal$
Disallow: /journal/
Disallow: /signals$
Disallow: /signals/
Disallow: /candles$
Disallow: /candles/
Disallow: /autotrader
Disallow: /opportunities
Disallow: /fundamentals
Disallow: /analytics$
Disallow: /analytics/
Disallow: /ctrader/
# 2026-08-08 (handoff-18 item 34). The live API routes are /coach/risk-budget,
# /coach/risk-state and /coach/risk-alerts, already covered by /coach above.
# Bare fragments are listed here for the case where Google extracts a partial
# route string from the JS bundle instead of the whole one.
#
# DO NOT collapse these into `Disallow: /risk`. robots.txt matches by PREFIX,
# and /risk is a REAL public page — the "Risk Disclosure" route in
# build.mjs PRERENDER_ROUTES, shipped as /risk.html with its own title and
# meta description, alongside /terms and /privacy. A bare /risk rule blocks
# the risk disclosure of a trading product from search, which is the opposite
# of what anyone wants. It was live for about 20 minutes on 2026-08-08 and was
# caught by fetching https://indikora.com/risk and getting a robots refusal.
# Checking sitemap.xml and the SPA routes is NOT enough: prerendered static
# pages live in build.mjs PRERENDER_ROUTES and appear only in the build output.
Disallow: /risk-state
Disallow: /risk-budget
Disallow: /risk-alerts
# Junk one-offs Google picked out of UI strings ("/30", "/USDT", "/mo", …)
#
# These are $-ANCHORED on purpose. robots.txt matches by PREFIX, so the
# unanchored form of these rules is a landmine: `Disallow: /mo` also blocks
# /moving-averages-explained and /momentum-explained, `Disallow: /candles`
# blocks /candlestick-patterns, and `Disallow: /USD` blocks /USDCAD, /USDCHF
# and /USDJPY the moment anything on this site is spelled with capitals. Every
# one of those is a page we either publish under /blog or /learn today, or
# would plausibly promote to root tomorrow. The same lesson as the /risk
# incident below, which cost us the risk-disclosure page for 20 minutes.
# Google, Bing and the major AI crawlers all support $.
Disallow: /USDT$
Disallow: /USD$
Disallow: /mo$
Disallow: /month$
Disallow: /6$
Disallow: /30$
Disallow: /100$

# GDPR — keep opt-in public TrustScore profiles out of search indexes.
Disallow: /trader/

# ── AI / answer-engine crawlers (2026-08-24) ─────────────────────────────────
# GPTBot, OAI-SearchBot, ClaudeBot, PerplexityBot, CCBot, Google-Extended,
# Applebot-Extended and the rest are ALLOWED, deliberately: being quoted by
# answer engines is the point. They are covered by the `User-agent: *` group
# above and need no rules of their own.
#
# DO NOT "make that explicit" by adding `User-agent: GPTBot` groups. robots.txt
# does not merge groups: the moment a named group exists, that crawler reads
# ONLY its own group and ignores every Disallow above. A well-meant
#     User-agent: GPTBot
#     Allow: /
# would hand the AI crawlers the whole /admin, /journal and /signals surface
# this file spends 60 lines keeping out of indexes. If a named group is ever
# genuinely needed, copy the entire Disallow list into it.
#
# Machine-readable site index for language models: https://indikora.com/llms.txt
# Full text of every English lesson and article: https://indikora.com/llms-full.txt

Sitemap: https://indikora.com/sitemap.xml
# Academy lessons live in their own sitemap so build.mjs and
# scripts/build_all_seo.py never fight over the same file.
Sitemap: https://indikora.com/sitemap-learn.xml