test: build against c2pa-rs PR #2231 (split-out c2pa-raw-crypto)

[scouten-adobe]

⚠️ Not for merge

This PR exists to run CI against contentauth/c2pa-rs#2231 ("Split out c2pa-raw-crypto, take 2"). It must not be merged until that c2pa-rs change is released to crates.io.

What this does

• Points the workspace c2pa dependency at the c2pa-rs PR branch via a git reference (branch = "split-out-c2pa-raw-crypto-take-2") in Cargo.toml. Cargo.lock pins the current branch HEAD; the cargo build steps don't use --locked, so CI re-resolves.
• packages/c2pa-types/index.ts: SigningAlg now lives in the new c2pa_raw_crypto crate, which deliberately does not depend on schemars. The generated JSON schema therefore exposes a mirror type SigningAlgSchema (identical serialized variants) instead of SigningAlg. index.ts re-exports it under the original public name, so the public TypeScript API is unchanged.
• packages/c2pa-node (replays contentauth/c2pa-node-v2#69, now that c2pa-node-v2 has been migrated into this monorepo): the split removes the c2pa::crypto::raw_signature module (AsyncRawSigner, RawSigner, RawSignerError) and the AsyncSigner::async_raw_signer() hook. Accordingly:
  • removes the now-redundant AsyncRawSigner / RawSigner impls and the async_raw_signer() / as_raw_signer() overrides from both NeonCallbackSigner and NeonIdentityAssertionSigner, keeping only their complete public AsyncSigner impls;
  • rewrites NeonIdentityAssertionSigner::certs() to use AsyncSigner::certs() instead of the removed raw cert_chain();
  • refreshes the stale Send/Sync doc comments that referenced AsyncRawSigner (including neon_credential_holder.rs).
  • No behavior change: the async JS signing callback path is preserved, now driven through AsyncSigner::sign.

This branch has been brought up to date with main (which migrated c2pa-node-v2 in as packages/c2pa-node), and c2pa-rs#2231 has likewise been updated to current c2pa-rs main (now c2pa 0.88.0 + the crate split).

Before merge (once c2pa-rs is released)

• Replace the git reference in Cargo.toml with the published crates.io version (currently c2pa = { version = "=0.88.0", ... }).
• The index.ts and packages/c2pa-node source changes stay — the crate split is permanent.

Verification (local)

• ✅ cargo build (wasm32) for c2pa-wasm against the PR branch
• ✅ cargo build for c2pa-node against the PR branch
• ✅ nx build for c2pa-types, c2pa-wasm, c2pa-web (from the original run)
• ✅ nx lint (0 errors, from the original run)

Notes

• All five features in use (pdf, rust_native_crypto, fetch_remote_manifests, json_schema, http_reqwest) still exist in the PR.
• c2pa-wasm / c2pa-node compile with deprecation warnings from c2pa-rs's new Context-based API (Builder::from_archive, Settings::from_string, etc.) — non-blocking; worth a follow-up migration. (c2pa-rs#2206's removal of long-deprecated APIs does not affect any code here.)

🤖 Generated with Claude Code

[changeset-bot]

🦋 Changeset detected

Latest commit: 3a55f70

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 3 packages

Name	Type
@contentauth/c2pa-node	Patch
@contentauth/c2pa-types	Patch
@contentauth/c2pa-web	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[cdmurph32]

LGTM. You just need to run pnpm changeset and add the changeset.