robots.ts

import type { MetadataRoute } from 'next';
import { getSiteOrigin, isProduction } from '@/lib/seo/env';

/**
 * robots.txt from the route source of truth.
 *
 * Non-production environments disallow everything as a belt to the
 * `X-Robots-Tag: noindex` braces set in `proxy.ts` — preview/staging must never
 * be crawled or indexed. Production advertises the sitemap and allows crawling.
 */

// Resolve at request time, not build time. Both the production/preview decision
// and the origin come from the live environment (see lib/seo/env.ts); a static
// robots.txt would freeze the build-time values, so a preview deploy of the same
// build would serve the permissive PRODUCTION rules — the exact leak this file
// exists to prevent.
export const dynamic = 'force-dynamic';
export default function robots(): MetadataRoute.Robots {
  const origin = getSiteOrigin();

  if (!isProduction()) {
    return {
      rules: [{ userAgent: '*', disallow: '/' }],
    };
  }

  return {
    rules: [{ userAgent: '*', allow: '/', disallow: ['/api/'] }],
    sitemap: `${origin}/sitemap.xml`,
    host: origin,
  };
}