# As a condition of accessing this website, you agree to abide by the following
# content signals:

# (a)  If a Content-Signal = yes, you may collect content for the corresponding
#      use.
# (b)  If a Content-Signal = no, you may not collect content for the
#      corresponding use.
# (c)  If the website operator does not include a Content-Signal for a
#      corresponding use, the website operator neither grants nor restricts
#      permission via Content-Signal with respect to the corresponding use.

# The content signals and their meanings are:

# search:   building a search index and providing search results (e.g., returning
#           hyperlinks and short excerpts from your website's contents). Search does not
#           include providing AI-generated search summaries.
# ai-input: inputting content into one or more AI models (e.g., retrieval
#           augmented generation, grounding, or other real-time taking of content for
#           generative AI search answers).
# ai-train: training or fine-tuning AI models.
# use:      how AI systems may consume the content (immediate, reference, or full).

# ANY RESTRICTIONS EXPRESSED VIA CONTENT SIGNALS ARE EXPRESS RESERVATIONS OF
# RIGHTS UNDER ARTICLE 4 OF THE EUROPEAN UNION DIRECTIVE 2019/790 ON COPYRIGHT
# AND RELATED RIGHTS IN THE DIGITAL SINGLE MARKET.

# BEGIN Cloudflare Managed content

User-agent: *
Content-Signal: search=yes,ai-train=no,use=reference
Allow: /

User-agent: Amazonbot
Disallow: /

User-agent: Applebot-Extended
Disallow: /

User-agent: Bytespider
Disallow: /

User-agent: CCBot
Disallow: /

User-agent: ClaudeBot
Disallow: /

User-agent: CloudflareBrowserRenderingCrawler
Disallow: /

User-agent: Google-Extended
Disallow: /

User-agent: GPTBot
Disallow: /

User-agent: meta-externalagent
Disallow: /

# END Cloudflare Managed Content

# Mirrors the exclusion sitemap[.]xml.ts already declares ("excludes
# auth/account/admin/dynamic/embed/legacy/internal") — absence from a sitemap
# does not stop a crawler, only this file does. Source of truth:
# NON_PUBLIC_NAMESPACES in src/routes/sitemap[.]xml.ts; the p39 guard test keeps
# the two in step. Matching is longest-prefix-wins, so the /terminal/demo Allow
# below beats the /terminal Disallow.

User-agent: *
Allow: /

# Authenticated app shells and internal surfaces — each serves a login redirect
# or an auth shell to an anonymous crawler.
Disallow: /_dev
Disallow: /_subscribed
Disallow: /account
Disallow: /admin
Disallow: /api
Disallow: /auth
Disallow: /checkout
Disallow: /embed
Disallow: /login
Disallow: /onboarding
Disallow: /pay
Disallow: /redeem
Disallow: /tg
Disallow: /unsubscribe
Disallow: /verify
Disallow: /verify-email

# /terminal is the authenticated trading cockpit; /terminal/demo is the public
# marketing demo and is in the sitemap, so it needs the narrower Allow.
Allow: /terminal/demo
Disallow: /terminal

# Internal debt/readiness scorecard (/prod) is deliberately NOT Disallow'd
# here: per Google's own guidance, blocking crawl access to a page prevents
# Google from ever seeing its noindex signal, so a disallowed-but-linked URL
# can still surface in search results (without a snippet). It stays
# noindex-only via the X-Robots-Tag response header
# (cloudflare/gateway/src/production-report-routing.ts) and a <meta
# name="robots"> tag, which reliably keep it out of the index while still
# letting Google crawl it and honor the directive. (A naive `Disallow: /prod`
# also collided with /product via simple prefix matching — one more reason
# not to add it here.)

Sitemap: https://hyperbeast.ai/sitemap.xml
Sitemap: https://hyperbeast.ai/sitemap-wallets.xml