refactor: Consolidate SigningAlg, re-use existing ManifestAssertionKind definition, fix dependency list

.changeset/tame-otters-relax.md

@@ -0,0 +1,7 @@
+---
+'@contentauth/c2pa-node': patch
+'@contentauth/c2pa-web': patch
+'@contentauth/c2pa-utilities': minor
+---
+
+Consolidate the `SigningAlg` type into `@contentauth/c2pa-utilities` (derived from `@contentauth/c2pa-types`'s schema-generated type). Re-use `ManifestAssertionKind` from `@contentauth/c2pa-types` instead of a duplicate hand-written copy. Fix `c2pa-node`'s `package.json` to list `@contentauth/c2pa-types` as a `dependency` rather than a `devDependency`, matching `c2pa-web`.

packages/c2pa-node/js-src/types.d.ts

@@ -19,26 +19,18 @@ import type {
   C2paReason,
   Ingredient,
   Manifest,
+  ManifestAssertionKind,
   ManifestStore,
 } from "@contentauth/c2pa-types";
+import type { SigningAlg } from "@contentauth/c2pa-utilities";
 
-export type { Action, C2paReason, Ingredient } from "@contentauth/c2pa-types";
-
-/**
- * Describes the digital signature algorithms allowed by the C2PA spec
- *
- * Per <https://c2pa.org/specifications/specifications/1.0/specs/C2PA_Specification.html#_digital_signatures>:
- *
- * > All digital signatures that are stored in a C2PA Manifest shall > be generated using one of the digital signature algorithms and > key types listed as described in this section
- */
-export type SigningAlg =
-  | "es256"
-  | "es384"
-  | "es512"
-  | "ps256"
-  | "ps384"
-  | "ps512"
-  | "ed25519";
+export type {
+  Action,
+  C2paReason,
+  Ingredient,
+  ManifestAssertionKind,
+} from "@contentauth/c2pa-types";
+export type { SigningAlg } from "@contentauth/c2pa-utilities";
 
 export type ClaimVersion = 1 | 2;
 
@@ -64,8 +56,6 @@ export type TrustmarkVariant =
   // Quality Trustmark model
   | "Q";
 
-export type ManifestAssertionKind = "Cbor" | "Json" | "Binary" | "Uri";
-
 /**
  * A buffer for the source asset
  */

packages/c2pa-node/package.json

@@ -43,7 +43,6 @@
   "license": "MIT",
   "devDependencies": {
     "@changesets/cli": "^2.31.0",
-    "@contentauth/c2pa-types": "workspace:*",
     "@eslint/js": "^9.39.4",
     "@neon-rs/cli": "0.1.82",
     "@types/cli-progress": "^3.11.6",
@@ -75,6 +74,7 @@
   },
   "homepage": "https://github.com/contentauth/c2pa-js/tree/main/packages/c2pa-node#readme",
   "dependencies": {
+    "@contentauth/c2pa-types": "workspace:*",
     "@contentauth/c2pa-utilities": "workspace:*",
     "cargo-cp-artifact": "^0.1.9",
     "cli-progress": "^3.12.0",

packages/c2pa-utilities/package.json

@@ -32,6 +32,7 @@
     }
   },
   "dependencies": {
+    "@contentauth/c2pa-types": "workspace:*",
     "ts-deepmerge": "^8.0.0"
   },
   "scripts": {

packages/c2pa-utilities/src/index.ts

@@ -10,4 +10,5 @@
 export * from './settings.js';
 export * from './fetchWithRetry.js';
 export * from './caseConversion.js';
+export * from './signingAlg.js';
 export * from './assetSize.js';

packages/c2pa-utilities/src/signingAlg.ts

@@ -0,0 +1,21 @@
+/**
+ * Copyright 2026 Adobe
+ * All Rights Reserved.
+ *
+ * NOTICE: Adobe permits you to use, modify, and distribute this file in
+ * accordance with the terms of the Adobe license agreement accompanying
+ * it.
+ */
+
+import type { SigningAlg as SchemaSigningAlg } from '@contentauth/c2pa-types';
+
+/**
+ * The digital signature algorithms allowed by the C2PA spec, as accepted/produced by the core
+ * native library at the signer construction boundary.
+ *
+ * The native library deserializes and displays this value as lowercase here, which is distinct from the
+ * PascalCase casing it serializes into manifests (see `SigningAlg` from `@contentauth/c2pa-types`,
+ * used for `SignatureInfo.alg` when reading manifests). This is therefore derived from that schema
+ * type rather than being identical to it.
+ */
+export type SigningAlg = Lowercase<SchemaSigningAlg>;

packages/c2pa-utilities/tsconfig.json

@@ -3,6 +3,9 @@
   "files": [],
   "include": [],
   "references": [
+    {
+      "path": "../c2pa-types"
+    },
     {
       "path": "./tsconfig.lib.json"
     },

packages/c2pa-utilities/tsconfig.lib.json

@@ -10,6 +10,11 @@
     "lib": ["ES2023", "DOM"]
   },
   "include": ["src/**/*.ts"],
+  "references": [
+    {
+      "path": "../c2pa-types"
+    }
+  ],
   "exclude": [
     "vitest.config.ts",
     "vitest.config.mts",

packages/c2pa-web/src/lib/signer.ts

@@ -7,14 +7,9 @@
  * it.
  */
 
-export type SigningAlg =
-  | 'es256'
-  | 'es384'
-  | 'es512'
-  | 'ps256'
-  | 'ps384'
-  | 'ps512'
-  | 'ed25519';
+import type { SigningAlg } from '@contentauth/c2pa-utilities';
+
+export type { SigningAlg };
 
 export interface Signer {
   sign: (