# ACPrompt — robots.txt
#
# Allow indexing of public surface (landing page, /api/discover protocol
# document, public agent pages, etc.) so search engines can find the
# project, but keep admin / cron / system surfaces out of search results.
#
# This is NOT a security boundary — admin endpoints are gated by
# ACP_ADMIN_SECRET regardless of indexing. robots.txt is a hint to
# well-behaved crawlers (Google, Bing, DuckDuckGo) that there's no
# user-facing content here. Bad-actor scrapers ignore robots.txt and
# must be defeated by auth + rate limiting (already in place).

User-agent: *

# Admin UI + APIs — operator-only, no public content.
Disallow: /admin
Disallow: /api/admin/

# Cron endpoints — service-to-service only, useless to humans.
Disallow: /api/cron/

# Pilaf / system internals — operator-controlled, not user-facing.
Disallow: /api/system/

# Webhooks — accept POSTs from GitHub, never serve content.
Disallow: /api/webhooks/

# Auth callback — bounces users through OAuth, no value to crawlers.
Disallow: /auth/

# Allow everything else by default. The discover protocol doc at
# /api/discover should be indexed so agents (and humans) can find it.