1.4.0: not_found, server-only response options, compression

- Server functions can return not_found: true to render the 404 page
  with status 404.
- Page components and window.__PAGE_PROPS__ (and HMR updates) only get
  props, query, url and error. response_options, redirect, cache settings
  and res_transform stay on the server, so cookies and private headers no
  longer end up in the HTML. BunextPageProps is narrowed to match
  (breaking for code that read server-only fields from component props).
- response_options headers go through a Headers object, so repeated
  headers such as several Set-Cookie survive.
- Redirects: status_code wins over permanent; response_options headers
  and res_transform apply to redirects too.
- Gzip for compressible text responses; compress: false to turn it off.
- Files the router matches but never bundles (.server.ts, __root,
  excluded paths and directories) return 404 instead of looping through
  dev rebuild retries.
- Missing public files return 404 rather than 403, so dotted page paths
  like /users/john.doe fall through to pages again.
- importFresh detects rewrites within the filesystem's mtime granularity.
- README: self-hosted React (not esm.sh), snake_case option names, static
  file serving, cache headers, the new options.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

dist/functions/server/handle-bunext-public-assets.js

@@ -1,14 +1,16 @@
 import grabDirNames from "../../utils/grab-dir-names";
+import grabBunextPublicUrlPath from "../../utils/grab-bunext-public-url-path";
 import path from "path";
 import isDevelopment from "../../utils/is-development";
 import { readFileResponse } from "./handle-public";
 import isSafePath from "../../utils/is-safe-path";
-const { BUNEXT_PUBLIC_DIR } = grabDirNames();
 export default async function ({ req }) {
+    const { BUNEXT_PUBLIC_DIR } = grabDirNames();
+    const BUNEXT_PUBLIC_URL_PATH = grabBunextPublicUrlPath();
     try {
         const is_dev = isDevelopment();
         const url = new URL(req.url);
-        const file_path = path.join(BUNEXT_PUBLIC_DIR, decodeURIComponent(url.pathname).replace(/\/\.bunext\/public\//, ""));
+        const file_path = path.join(BUNEXT_PUBLIC_DIR, decodeURIComponent(url.pathname).slice(BUNEXT_PUBLIC_URL_PATH.length));
         if (!isSafePath({ filePath: file_path, allowedDir: BUNEXT_PUBLIC_DIR })) {
             return new Response("Forbidden", { status: 403 });
         }