Web: phpc.json assets directory served beside public docroot (003-MiniWebApp /assets/)

[PurHur]

Problem

examples/003-MiniWebApp/templates/layout.php links /assets/style.css, but files live in examples/003-MiniWebApp/assets/ — outside the public/ docroot (phpc.json "public": "public").

DevServer::resolveDocrootFile() only maps URLs under public/, so GET /assets/style.css returns 404 during phpc serve even when HTML routes are green (#539). Production deploy (#180) needs the same asset tree beside the binary.

Goal

Manifest field (proposed "assets": "assets") or documented convention:

{
  "entry": "public/index.php",
  "public": "public",
  "assets": "assets",
  "binary": ".phpc/bin/app"
}

phpc serve and phpc serve --aot resolve /assets/* from the project assets/ directory (with path traversal guards matching DevServer::isSafeUrlPath).

Scope

• lib/Web/ProjectManifest.php — resolveAssetsDir() + validator in ManifestValidator
• lib/Web/DevServer.php — static file lookup: try public/ first, then assets/ for non-.php paths
• examples/003-MiniWebApp/phpc.json — add "assets": "assets" (or move CSS under public/assets/)
• script/examples-web-smoke.sh — curl /assets/style.css needle body { (Stdlib: strspn() and strcspn() VM + LLVM JIT/AOT #589)
• Deploy bundle (AOT: Deploy bundle (binary + public assets + phpc.json manifest) #180) copies assets/ using same manifest field

Acceptance criteria

cd examples/003-MiniWebApp
../../phpc serve 127.0.0.1:8080 .
curl -s -o /dev/null -w '%{http_code}' http://127.0.0.1:8080/assets/style.css
# → 200

Docker:

docker run --rm -v "$(pwd):/compiler" -w /compiler php-compiler:22.04-dev \
  bash -lc 'cd examples/003-MiniWebApp && ../../phpc serve 127.0.0.1:18080 . & sleep 1; curl -sf http://127.0.0.1:18080/assets/style.css | head -1'

No GitHub Actions required.

Dependencies

• Web: phpc serve uses phpc.json "public" as docroot when serving a project #443 public docroot ✅
• Reference app: MiniWebApp runtime green (lint 0, VM serve, routes) #539 VM routes green
• AOT: Deploy bundle (binary + public assets + phpc.json manifest) #180 deploy bundle (copy assets)
• Testing: ServeAotTest MiniWebApp routes via phpc serve --aot (blocked #764 execute) #478 ServeAotTest can assert CSS when AOT serve enabled

Links

• ROADMAP #78 Phase 3 Web runtime
• Layout: examples/003-MiniWebApp/templates/layout.php
• Related: #277 static CSS in ServeAotTest (flat examples)