v0.5.0 — Verifiable trust & provenance

Superseded by v0.5.1 for a release-pipeline fix (Node 22). Package content is identical. Install v0.5.1.

Verifiable trust & provenance: a Facet deployment now signs machine-readable statements about itself — its keys, identity, privacy processing, and build/config state — and can root its signing key in hardware. Entirely optional and off by default; every analytics feature is unchanged, and Facet stays strictly cookieless with no cross-session identity.

Highlights

• Well-known trust documents — jwks.json, did.json (did:web), did-configuration.json (DIF domain linkage), facet-privacy.json (W3C DPV), alongside security.txt.
• Signed deployment attestations — a W3C VC 2.0 PrivacyAttestationCredential (eddsa-jcs-2022) and a RATS process-evidence EAT with challenge-response proof-of-possession.
• COSE_Sign1 (RFC 9052) — the SCITT / COSE-receipts native wire form, verified in workerd.
• SCITT transparency — a D1-persisted Merkle Mountain Range log with real signed inclusion receipts and external-receipt verification.
• Hardware key-attestation — key-attributes.hardware is a verified, conditional claim gated on a configured trust anchor (native credential in workerd; X.509 chain via the Node CLI). The one boundary we do not fake: Cloudflare exposes no isolate self-quote, covered instead by build-time SLSA provenance + a signed config hash.
• CLI — keys generate provisions the signing key; sd ships the W3C ecdsa-sd-2023/bbs-2023 cryptosuites (Node-only); keyattest verify validates X.509 attestation chains.

New trust primitives ship in a Workers-native @facet/trust package (proven to run in real workerd). See docs/trust.md.

Full changelog: https://github.com/writerslogic/facet/blob/v0.5.0/CHANGELOG.md