История коммитов

The base path is PUBLIC_PATH in every call site, so the argument became
optional and defaults to it. Passing it explicitly still works, which keeps
third party themes and modules building.

Everything reachable over HTTP now lives in public/, the code stays in the
repository root and is no longer served. The layout below public/ mirrors the
old one, so not a single URL changes.

The preparation landed earlier: PUBLIC_PATH switching to ROOT_PATH . 'public'
is what actually moves the application.

- nginx: root points at /app/public in both templates.
- webpack: setPublicPath('public') keeps the mix-manifest keys as /themes/...,
the build output moves under public/.
- a root .htaccess forwards requests into public/ and denies access to the code,
for Apache hosting where the document root cannot be changed.

BREAKING CHANGE: the document root must be pointed at public/. Restart php-fpm
after updating, the realpath cache holds the old paths.

The scanned folders were suffixes appended to ROOT_PATH, so assets and upload
would have silently dropped out of the snapshot once they move into public/.
They are now absolute roots, taken from the constants that follow them.

The implicit rule that only the repository root is scanned without recursion
became an explicit flag.

The installer directory is now covered as well: it is reachable by URL but was
never scanned. Existing snapshots keep working, since scan() only compares the
paths they already contain.

A language pack ships both system/locale/xx.ini and a theme flag under
themes/default/assets/. Extracting the archive straight into ROOT_PATH would
drop the flag outside of the document root once themes assets move into
public/, leaving a stray themes/default/assets/ directory in the root.

The archive is now extracted into a temporary directory and moved into place:
theme assets go under PUBLIC_THEMES_PATH, everything else into ROOT_PATH.

Both paths were relative to the current working directory. They run before
vendor/autoload.php, so they use __DIR__ rather than the path constants.

The installer resolved the autoloader, the config check and the step files
relative to the current working directory, and the translation domain relative
to ROOT_PATH. They now come from __DIR__ or from the path constants.

step_3 read the .env file through dirname(__DIR__, 2), a hardcoded depth that
would silently break and drop the database autofill under Docker. step_2 lists
the writable directories as absolute paths and labels them by subtracting
ROOT_PATH; PUBLIC_PATH joins the list, the sitemap and robots.txt are written
there.

Both scripts addressed the upload directory relative to the current working
directory. Once assets and upload move into public/ together, those relative
paths would keep working while ../../../vendor/autoload.php would resolve to
public/vendor and fail.

thumbinal.php did not load the autoloader at all, so it had no constants to
work with.

preview.php accepts the path with or without a leading slash, since one caller
passes each form, and now refuses to serve anything resolving outside of the
document root.

upload/.htaccess only silences PHP under Apache, nginx had no counterpart: a
PHP file placed in the upload directory was executed. The ^~ prefix stops the
regex locations from picking those requests up, while static files keep being
served. The rule matches on the URI, so it holds both before and after the
document root moves.

The dev template also gets the dotfile rule the production one already had.

Both files are fetched over HTTP, so they belong in the document root.
atomicWrite() writes its .tmp file next to the target, which means the public
path has to be writable.

Published assets and language flags are served over HTTP, so they resolve from
PUBLIC_THEMES_PATH. The list of available themes keeps using THEMES_PATH: it is
built from the theme templates, which stay outside the document root.