PR-B — enable the credential API on the crate app + real READMEs

[edgrosvenor]

PR-B — enable the credential API on the crate app + real READMEs (Build step 7b)

Bumps the consumed built-for-cloud to ^0.2, turns on its HTTP credential API so a deployed Crate can issue/revoke credentials over /api/credentials, and replaces the placeholder READMEs with real, accurate docs. Final PR of step 7.

What shipped (vs the plan)

• built-for-cloud → ^0.2 in crate-server (composer.lock now pins v0.2.0), consumed as a normal published dependency — the package itself is not modified.
• Credential API enabled + mounted on the app. Published config/built-for-cloud.php with credential_api.enabled defaulting on for Crate; the provider mounts GET|POST /api/credentials and DELETE /api/credentials/{name}, each behind EnsureAdminToken (bfc.token.admin). Verified with route:list.
• Feature test tests/Feature/CredentialApiTest proves the endpoint is live and admin-gated: no token → 401; an admin-ability token (minted via TokenRegistry::store(..., ['admin'])) → 200 on GET (list) and 201 on POST (issue → {name, plaintext, expires_at}).
• Four real READMEs (replacing the placeholders): the root README (what Crate is + the operator/test-drive flow: register repo → build → mint admin token → issue credential → crate:auth → composer require through the gate; documents token:create --abilities=admin) and one per package (crate-contracts, crate-client, crate-server) accurate to the shipped commands/routes/APIs.

Deserves attention (the security-sensitive bit)

• The credential API is admin-token gated. The package default is off; Crate deliberately enables it (its whole product is issue/revoke) via env('BUILT_FOR_CLOUD_CREDENTIAL_API_ENABLED', true). Because every route requires a valid admin-ability bearer token (EnsureAdminToken), "enabled" without an admin token still returns 401 to everyone — so default-on is safe and product-appropriate. It can be turned off per-environment with the env flag. No token or secret is hardcoded or committed.

Findings disposition

• Independent quality/security reviewer: no blocking findings. It cross-checked every command, route, API, DTO, and enum in the READMEs against the shipped source (all match) and confirmed no invented/aspirational features (the docs explicitly disclaim a web UI, per-package ACLs, webhooks, MCP, search, billing). Two cosmetic README advisories were fixed (commit 77c1912): the customer-setup snippet now exports CRATE_URL before the composer config line (a copy-paste would otherwise use an empty URL), and the token:create step now notes it dispatches to the environment via the Cloud CLI (or --execute to run on the environment directly).
• Independent acceptance judge: ACCEPT — all acceptance criteria pass on self-observed runs.

Gate evidence (verified by the coordinator on committed SHA 9dcc4f1; the only later change, 77c1912, is README-only)

• composer ready → exit 0 (pint passed, phpstan errors:0, pest 35/89, composer audit: no advisories); tree clean.
• composer packages:check → exit 0; all packages green.
• route:list --path=api/credentials → GET|POST api/credentials + DELETE api/credentials/{name}, all behind EnsureAdminToken.

Risk / next

• Completes step 7. A deployed Crate now: serves gated packages (PR1–PR5), issues/revokes credentials over /api/credentials, and ships an issuer SDK + consumer helper (PR-A) plus accurate docs.
• Left for you (unchanged hard stops): no v* release tag was pushed (Ed-authorized). Remaining roadmap item is step 8's Cloud provisioning installer (crate:install) if/when desired.

🤖 Generated with Claude Code