[frostevent]

Adds template/, a Cloudflare C3 template for an x401 Verifier built on @proof.com/x401-workers:

npm create cloudflare@latest -- my-verifier --template=proof/x401-workers/template
cd my-verifier
npm run setup                  # sandbox, on workers.dev
npm run setup -- --production  # production, on a custom domain

What's in it

• src/: a Worker serving the CIMD at /.well-known/proof-client.json and protecting /protected with withX401 and d1NonceStore.

• wrangler.jsonc: sandbox and production environments, each with its own D1 database, vars and required SIGNING_JWK secret.

• scripts/setup.mjs (npm run setup, also run when you answer yes to C3's deploy prompt). It can be rerun and resumes where it stopped:

  • generates a signing key per environment
  • deploys with the key as a secret
  • applies the nonce migration
  • sets the client id
  • smoke-tests the deployment
  • prompts for an email and enrolls on Proof

  Enrollment state is kept per environment, and --fresh starts an environment over.

• scripts/smoke.mjs: checks the CIMD and the 401 + PROOF-REQUEST challenge.

• test/: Vitest in workerd (CIMD, challenge, malformed response, missing config, 404).

• Uses @proof.com/proof-vc-server 0.6.3, whose enroll checks the email domain only in production.

Repo changes

• CI: new template job that tests the template against this repo's source (wrangler types --check, typecheck, dry-run deploy of both environments, tests).
• eslint and prettier now cover template/; *.jsonc files are formatted without trailing commas.
• README, CONTRIBUTING and CLAUDE.md mention the template.

Not covered

• setup.mjs has no automated tests.
• The template job needs to be added as a required check on main.

🤖 Generated with Claude Code