1.4.0: not_found, server-only response options, compression

- Server functions can return not_found: true to render the 404 page
  with status 404.
- Page components and window.__PAGE_PROPS__ (and HMR updates) only get
  props, query, url and error. response_options, redirect, cache settings
  and res_transform stay on the server, so cookies and private headers no
  longer end up in the HTML. BunextPageProps is narrowed to match
  (breaking for code that read server-only fields from component props).
- response_options headers go through a Headers object, so repeated
  headers such as several Set-Cookie survive.
- Redirects: status_code wins over permanent; response_options headers
  and res_transform apply to redirects too.
- Gzip for compressible text responses; compress: false to turn it off.
- Files the router matches but never bundles (.server.ts, __root,
  excluded paths and directories) return 404 instead of looping through
  dev rebuild retries.
- Missing public files return 404 rather than 403, so dotted page paths
  like /users/john.doe fall through to pages again.
- importFresh detects rewrites within the filesystem's mtime granularity.
- README: self-hosted React (not esm.sh), snake_case option names, static
  file serving, cache headers, the new options.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

dist/utils/resolve-public-file.js

@@ -0,0 +1,31 @@
+import { existsSync, statSync } from "fs";
+import path from "path";
+import isSafePath from "./is-safe-path";
+/**
+ * Maps a URL path onto a file in `dir`, in this order:
+ * - `..` segments (encoded or not) are resolved against `/`, so they
+ *   can never climb above `dir`; the 403 check is a second guard
+ * - 404 if there is no such file (so callers can fall through to pages)
+ * - 403 if a symlink points outside `dir`
+ */
+export default function resolvePublicFile(dir, url_path) {
+    let decoded;
+    try {
+        decoded = decodeURIComponent(url_path);
+    }
+    catch {
+        return { status: 404 };
+    }
+    const root = path.resolve(dir);
+    const file_path = path.resolve(root, "." + path.posix.join("/", decoded));
+    if (file_path !== root && !file_path.startsWith(root + path.sep)) {
+        return { status: 403 };
+    }
+    if (!existsSync(file_path) || !statSync(file_path).isFile()) {
+        return { status: 404 };
+    }
+    if (!isSafePath({ filePath: file_path, allowedDir: root })) {
+        return { status: 403 };
+    }
+    return { status: 200, file_path };
+}