Add C3 template

.github/workflows/ci.yml

@@ -70,6 +70,28 @@ jobs:
       - if: needs.test-matrix.result != 'success'
         run: exit 1
 
+  template:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - run: corepack enable
+      - uses: actions/setup-node@v7
+        with:
+          node-version-file: .node-version
+          cache: yarn
+      - run: yarn install
+      - run: npm pack --pack-destination template
+      - working-directory: template
+        run: npm ci
+      - working-directory: template
+        run: npm install --no-save ./proof.com-x401-workers-*.tgz
+      - working-directory: template
+        run: npm run cf-typegen -- --check
+      - working-directory: template
+        run: npm run check
+      - working-directory: template
+        run: npm test
+
   build:
     runs-on: ubuntu-latest
     steps:

.prettierignore

@@ -1 +1,4 @@
 .yarn/
+template/.wrangler/
+template/package-lock.json
+template/worker-configuration.d.ts

.prettierrc.json

@@ -1,3 +1,9 @@
 {
-  "plugins": ["prettier-plugin-packagejson"]
+  "plugins": ["prettier-plugin-packagejson"],
+  "overrides": [
+    {
+      "files": "*.jsonc",
+      "options": { "trailingComma": "none" }
+    }
+  ]
 }

.yarnrc.yml

@@ -8,4 +8,7 @@ nodeLinker: node-modules
 
 npmMinimalAgeGate: 1w
 
+npmPreapprovedPackages:
+  - "@proof.com/*"
+
 yarnPath: .yarn/releases/yarn-4.17.0.cjs

CLAUDE.md

@@ -38,9 +38,15 @@ verification.
 - `src/index.ts` — `withX401` and the public barrel (nothing else is public).
 - `src/stores/d1.ts`, `src/stores/kv.ts` — `NonceStore` implementations.
 - `src/hono.ts` — Hono middleware, exported as `@proof.com/x401-workers/hono`.
+- `template/` — C3 / Deploy button template (`npm create cloudflare -- --template=proof/x401-workers/template`).
+  A standalone npm project depending on the published package; it uses only the public API. Its
+  config validation and `scripts/setup.mjs` are template-only and add no library defaults. Tested
+  by the `template` job in `.github/workflows/ci.yml`; `yarn check-all` only formats and lints it.
 
 ## Publishing
 
 Same flow as `@proof.com/x401-node`: bump on a `release-X.Y.Z` branch, merge, then
 `gh release create vX.Y.Z --target <merged sha> --generate-notes`. The Release triggers
 `publish.yml` (npm Trusted Publishing, `npm publish --provenance --access public`).
+On every release, bump `@proof.com/x401-workers` in `template/package.json` (on 0.x, `^0.1.0` does
+not accept `0.2.0`) and refresh `template/package-lock.json`.

CONTRIBUTING.md

@@ -24,10 +24,15 @@
 - `yarn test`
 - `yarn publint`
 
+## Template
+
+`template/` is a standalone npm project. After changing it, run `npm run check` and `npm test` in
+`template/`, and `npm run cf-typegen` if `wrangler.jsonc` changed.
+
 ## Pull Requests
 
 - Branch off `main`, keep changes focused, explain what changed and why.
-- CI runs `format`, `lint`, `typecheck`, `test` (Node 22 and 24), `build` and `publint`; all are required on `main`.
+- CI runs `format`, `lint`, `typecheck`, `test` (Node 22 and 24), `template`, `build` and `publint`; all are required on `main`.
 
 ## Code of conduct
 

README.md

@@ -9,6 +9,18 @@ Credentials presentation request. The user agent delegates it to the user's **Wa
 with a `PROOF-RESPONSE` header. This package builds the request, verifies the presented credential
 against Proof, accepts each nonce once, and hands the verified presentation to your handler.
 
+## Start from a template
+
+Create, deploy and enroll a sandbox Verifier:
+
+```sh
+npm create cloudflare@latest -- my-verifier --template=proof/x401-workers/template
+cd my-verifier
+npm run setup
+```
+
+See [template/README.md](template/README.md).
+
 ## Installation
 
 ```sh
@@ -44,7 +56,7 @@ An x401 **Verifier** is an OID4VP client identified by the URL of its
    your `clientId`; the samples below serve it at `/.well-known/proof-client.json`.
 
 3. **Register your CIMD.** Enroll on Proof as an x401 Verifier once the CIMD is live, then follow
-   the instructions received by email. The email must be on the CIMD's domain.
+   the instructions received by email. In production, the email must be on the CIMD's domain.
 
    ```sh
    npx @proof.com/proof-vc-server enroll https://example.com/.well-known/proof-client.json --email admin@example.com --key signing-key.json

eslint.config.mjs

@@ -2,7 +2,13 @@ import tseslint from "typescript-eslint";
 import unusedImports from "eslint-plugin-unused-imports";
 
 export default tseslint.config(
-  { ignores: ["dist/**"] },
+  {
+    ignores: [
+      "dist/**",
+      "template/.wrangler/**",
+      "template/worker-configuration.d.ts",
+    ],
+  },
   ...tseslint.configs.recommended,
   {
     plugins: {

package.json

@@ -48,8 +48,8 @@
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
-    "@proof.com/proof-vc-common": "^0.6.2",
-    "@proof.com/proof-vc-server": "^0.6.2",
+    "@proof.com/proof-vc-common": "^0.6.3",
+    "@proof.com/proof-vc-server": "^0.6.3",
     "@proof.com/x401-node": "^0.3.3"
   },
   "devDependencies": {

template/.dev.vars.example

@@ -0,0 +1 @@
+SIGNING_JWK=

template/.gitignore

@@ -0,0 +1,6 @@
+node_modules/
+.wrangler/
+.dev.vars
+.env
+signing-key.*.json
+.proof-enrollment.json

template/README.md

@@ -0,0 +1,25 @@
+# x401-workers Cloudflare Template
+
+A Cloudflare Worker that protects `/protected` with [x401](https://x401.proof.com/spec/latest/),
+built on [`@proof.com/x401-workers`](https://github.com/proof/x401-workers).
+
+## 🚀 Get started
+
+```sh
+npm create cloudflare@latest -- my-verifier --template=proof/x401-workers/template
+cd my-verifier
+npm run setup                  # sandbox, on workers.dev
+npm run setup -- --production  # production, on a domain of a zone in your Cloudflare account
+```
+
+`setup` deploys the Worker and enrolls it on Proof; for production, the enrollment email must be on
+the Worker's domain.
+
+## Try it
+
+1. Follow the activation email from Proof.
+2. Ask an agent connected to Proof's MCP server to fetch `https://<your worker>/protected`.
+
+## Start over
+
+Run `npm run setup -- --fresh` to discard the signing key, client id and start the setup again.

template/migrations/0001_create_x401_nonces.sql

@@ -0,0 +1,6 @@
+CREATE TABLE x401_nonces (
+  nonce TEXT PRIMARY KEY,
+  expires_at INTEGER NOT NULL
+);
+
+CREATE INDEX x401_nonces_expires_at ON x401_nonces (expires_at);