1.4.0: not_found, server-only response options, compression

- Server functions can return not_found: true to render the 404 page
  with status 404.
- Page components and window.__PAGE_PROPS__ (and HMR updates) only get
  props, query, url and error. response_options, redirect, cache settings
  and res_transform stay on the server, so cookies and private headers no
  longer end up in the HTML. BunextPageProps is narrowed to match
  (breaking for code that read server-only fields from component props).
- response_options headers go through a Headers object, so repeated
  headers such as several Set-Cookie survive.
- Redirects: status_code wins over permanent; response_options headers
  and res_transform apply to redirects too.
- Gzip for compressible text responses; compress: false to turn it off.
- Files the router matches but never bundles (.server.ts, __root,
  excluded paths and directories) return 404 instead of looping through
  dev rebuild retries.
- Missing public files return 404 rather than 403, so dotted page paths
  like /users/john.doe fall through to pages again.
- importFresh detects rewrites within the filesystem's mtime granularity.
- README: self-hosted React (not esm.sh), snake_case option names, static
  file serving, cache headers, the new options.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

dist/functions/server/handle-public.js

@@ -1,17 +1,22 @@
 import grabDirNames from "../../utils/grab-dir-names";
-import path from "path";
 import isDevelopment from "../../utils/is-development";
 import { existsSync } from "fs";
-import isSafePath from "../../utils/is-safe-path";
+import resolvePublicFile from "../../utils/resolve-public-file";
 const { PUBLIC_DIR } = grabDirNames();
 export default async function ({ req }) {
     try {
         const is_dev = isDevelopment();
         const url = new URL(req.url);
-        const file_path = path.join(PUBLIC_DIR, decodeURIComponent(url.pathname).replace(/^\/public/, ""));
-        if (!isSafePath({ filePath: file_path, allowedDir: PUBLIC_DIR })) {
+        const resolved = resolvePublicFile(PUBLIC_DIR, url.pathname.replace(/^\/public/, ""));
+        if (resolved.status == 403) {
             return new Response("Forbidden", { status: 403 });
         }
+        if (resolved.status != 200) {
+            return new Response(`Public File Doesn't Exist`, {
+                status: 404,
+            });
+        }
+        const { file_path } = resolved;
         return readFileResponse({ file_path });
     }
     catch (error) {