v0.11.1

The build knows which paths your middleware gates.

Both packages move together: @transclude/core and @transclude/create are
0.11.1.

npm install @transclude/core@latest

Upgrade if app/server.js gates a page. Nothing else changes.

Fixed

A page gated only by middleware was written to a file and given away.

Middleware does not run during a build. So a page behind a payment check or an
auth check was rendered, written to dist/static, counted in the build's own
"pages prerendered" line, and then served by any static host to anyone who asked.
Nothing errored.

A layout guard was never affected, and the difference is worth knowing. The
build runs layout loaders, and a guard reads a cookie, which the build already
refuses to write down. Nothing runs app/server.js at all.

The build cannot find a gate on its own, so the app says where they are:

// app/server.js
export const gated = ['/premium', '/api/*'];

export default (app) => {
  app.use('/premium', requireSubscription);
  app.use('/api/*', requirePayment);
};

No file is written for those paths and the sitemap leaves them out. They are
still routes, and the middleware still answers them at runtime. A path matches
itself, and /api/* matches that path and everything under it.

An entry that is not a path fails the build. Every mistake here fails open: the
file gets written, and the build reports a success.

Changed

/sitemap.xml leaves out the same URLs the build did. gated travels in
routes.json, so the file the build writes and the route that serves one agree.
Before this, only the build could have known.

Notes

Charge for an endpoint is a worked
example, using x402 over @x402/hono. The server here is
Hono, so a payment gate needs nothing from this framework except the line above.

Middleware has the rest.