[alejouribesanchez]

Summary

Adds a self-contained, version-controlled Cloud Agent development environment for the Veryfi PHP SDK so future agents (and contributors) can install dependencies and run the test suite out of the box.

Cursor's default image does not ship PHP, so the environment builds its base from a small Dockerfile. This keeps the setup reproducible and committed to the repo (highest-precedence environment source), with no reliance on a personal snapshot.

Files

• .cursor/Dockerfile — ubuntu:24.04 base with PHP 8.3 CLI and the extensions required by composer.json (curl, json, mbstring, fileinfo) plus php8.3-xml (dom, for PHPUnit) and php8.3-xdebug (coverage), along with git, curl, unzip. This matches the PHP 8.3 version used in CI (.github/workflows/php.yml, .github/workflows/main.yml).
• .cursor/environment.json — builds from the Dockerfile and runs install: php composer.phar install --prefer-dist --no-interaction using the repo-pinned composer.phar.

No start/terminals are needed — this is a headless library, not a service.

This branch also incorporates the maintainer/Copilot commit relaxing phpunit/phpunit from 12.3.0 to ^12.4 (resolves to 12.5.33), which sidesteps the Composer security-advisory block on 12.3.0.

Validation (Docker image built from .cursor/Dockerfile)

The image was built and the exact Cloud Agent flow was exercised inside a container against a clean checkout:

Check	Result
docker build of .cursor/Dockerfile	Succeeds
PHP + extensions (curl, json, mbstring, fileinfo, xml, xdebug)	All present (PHP 8.3.6)
install step (php composer.phar install)	Succeeds; idempotent on re-run
Test suite (XDEBUG_MODE=coverage ./vendor/bin/phpunit)	OK (69 tests, 148 assertions)
Live SDK action	verify_signature() → VALID; live get_documents() → fail (transport + egress confirmed)

Note: test_bad_credentials performs a real round-trip to api.veryfi.com, so the passing suite also confirms outbound network works.

Full evidence log: veryfi_php_env_verification.log (attached to the agent run).