# Only the public landing page at "/" is meant to be crawled. Everything below is either
# an embedded-admin surface (needs a Shopify session), an OAuth/webhook endpoint, or an
# app-proxy route, none of which render anything useful to a crawler.
User-agent: *
Allow: /$
Allow: /favicon
Allow: /icon-
Disallow: /app
Disallow: /auth
Disallow: /oauth
Disallow: /webhooks
Disallow: /proxy
Disallow: /mcp
Disallow: /.well-known

# Googlebot-Favicon fetches the icon separately from Googlebot and honours robots.txt.
# Without this it inherits the rules above, which is fine today but breaks the moment
# someone tightens the wildcard group.
User-agent: Googlebot-Favicon
Allow: /