User-agent: *
Allow: /

Disallow: /secure/
Disallow: /method-quiz
Disallow: /customer-feedback
Disallow: /pharmacy-onboarding
Disallow: /hmo-fulfillment
Disallow: /refill/preferences
Disallow: /refill/survey
Disallow: /refill/product-selection
Disallow: /refill/cart
Disallow: /refill/persona
Disallow: /refill/checkout
Disallow: /refill/track-order
Disallow: /refill/payment-success
Disallow: /refill/payment-failed

# Top-level payment outcome pages — transactional, same reason as the /refill ones.
Disallow: /payment-success
Disallow: /payment-failed

# Same-host sitemap: the Amplify rewrite serves /sitemap.xml from the backend as
# application/xml (audit #18). It briefly pointed at core.onehealthng.com directly,
# as a workaround while this URL still returned the SPA's HTML shell — but a
# cross-host sitemap needs both hosts verified in Search Console, so Google
# reported "Couldn't fetch". Keep it same-host.
Sitemap: https://www.onehealthng.com/sitemap.xml