feat: support standard CKB registry wallets

Author: a19q3

CHANGELOG.md

@@ -2,6 +2,33 @@
 
 ## Unreleased
 
+- Redesign the Registry submission and package-maintenance surfaces around
+  contextual, task-first workflows: remove the public `Manage` tab and
+  redundant form controls, link maintenance from package details, guide first
+  publication through one progressive wallet action, show the publication
+  orientation only once per browser, replace the CCC post-connect surface with
+  a compact Registry-owned wallet chooser that has no unrelated `Manage`
+  action, reveal yank fields only for the yank task, and close write commands
+  over verify, dry-run, and publish. Registry route and workflow state changes
+  now use reduced-motion-aware transitions instead of abrupt swaps. Browse and
+  Submit share one DOM-persistent Registry header through navigation, avoiding
+  replacement flicker while retaining the active locale; wallet connection no
+  longer depends on completing the package coordinate first, and the primary
+  authorisation controls use larger, shorter-reach interaction targets.
+  Browse uses a no-flash loading state, URL-backed server search, and API
+  pagination; bundled data appears only as an explicitly labelled error
+  fallback. Static and live package details share one responsive view with
+  localized statuses and copyable audit values. Publisher authorisation now
+  accepts both JoyID
+  (`joyid_ckb`) and standard CKB secp256k1 (`ckb_secp256k1`) principals through
+  the CCC CKB-signer boundary on mainnet or testnet. The frontend never accepts
+  mnemonic words; traditional recovery phrases remain inside the wallet. CLI
+  auth commands use `--wallet-signature`, with `--joyid-signature` retained as
+  a visible compatibility alias, and the API adds the corresponding typed
+  principal migration and signature verification. The compact chooser now
+  preserves the complete official twelve-wallet CKB directory: compatible CCC
+  signers connect directly, while the remaining wallets use the same verified
+  external-signature handoff instead of disappearing from the UI.
 - Deploy the public Registry production slice at
   `api.registry.cellscript.dev` and `registry.cellscript.dev`: Postgres 17 is
   the authoritative write store, the Node 22 adapter persists source snapshots

README.md

@@ -790,31 +790,38 @@ Non-CellScript artifact profiles still fail closed.
 
 **Public registry boundary / fail-closed:**
 
-- Public registry publishing is designed around JoyID-rooted publisher
-  identity: CCC is the connection layer, JoyID is the accepted publisher root,
-  and delegated publisher credentials are stored in the OS keychain for daily
-  `cellc publish`; see
+- Public registry publishing uses typed wallet-rooted publisher identities:
+  CCC is the browser connection layer, `joyid_ckb` accepts JoyID passkeys, and
+  `ckb_secp256k1` accepts standard CKB wallets that expose a compressed public
+  key and recoverable CKB message signature. Delegated publisher credentials
+  are stored in the OS keychain for daily `cellc publish`; see
   [`docs/CELLSCRIPT_REGISTRY_PRODUCTION_BOUNDARY_ADR.md`](docs/CELLSCRIPT_REGISTRY_PRODUCTION_BOUNDARY_ADR.md)
-- `cellc auth capability create --principal-id <principal_id> --scope
+- `cellc auth capability create --principal-type <principal_type>
+  --principal-id <principal_id> --scope
   publish:<namespace>/<package> --expires 90d --json >
   capability-payload.json` creates the local P-256 capability key when
   `--capability-pubkey` is not supplied, stores the private key in the OS
-  keychain, and prints the JoyID-bound authorisation payload. The
-  `principal_id` is the normalized JoyID/CKB identity binding derived by the
-  CCC-backed JoyID submit flow, not the display address.
-  After the same payload is signed through JoyID/CCC, `cellc auth capability
-  submit --payload capability-payload.json --joyid-signature
-  joyid-signature.json` registers the delegated key with the write API.
+  keychain, and prints the wallet-bound authorisation payload. The
+  `principal_id` is the normalized binding derived from the connected signer,
+  not the display address. After the same payload is signed through CCC,
+  `cellc auth capability submit --payload capability-payload.json
+  --wallet-signature wallet-signature.json` registers the delegated key with
+  the write API.
   `cellc auth namespace claim --namespace <namespace> --payload
-  capability-payload.json --joyid-signature joyid-signature.json` then
+  capability-payload.json --wallet-signature wallet-signature.json` then
   establishes the required namespace ownership. Bare
   `cellc publish` then signs the concrete publish payload and submits the
   source snapshot to the public registry.
+- The Registry chooser includes Neuron, JoyID, imToken, CKBull, SafePal,
+  Ledger, imKey, OneKey, UTXO Global, Rei Wallet, Gate, and QuantumPurse.
+  Compatible CCC signers connect directly; the remaining directory entries use
+  the same verified `wallet-signature.json` handoff without exposing mnemonic
+  words to the site.
 - `cellc auth capability revoke --principal-id <principal_id>
   --capability-key-id <capability_key_id> --json > revoke-payload.json`
-  generates a JoyID-bound revocation challenge; after signing that challenge,
+  generates a wallet-bound revocation challenge; after signing that challenge,
   `cellc auth capability revoke --payload revoke-payload.json
-  --joyid-signature joyid-signature.json` revokes the delegated key without
+  --wallet-signature wallet-signature.json` revokes the delegated key without
   creating a separate registry account.
 - CI can avoid interactive keychain access by using
   `cellc publish --print-payload --json`, signing the `canonical_payload`
@@ -828,7 +835,7 @@ Non-CellScript artifact profiles still fail closed.
   verification; default search/list visibility begins at `verified_build`, and
   direct URLs preserve admitted `source_published` history. The same typed app
   retains a Cloudflare Worker/Hyperdrive/R2 deployment option. Both paths share
-  JoyID capability authorisation, namespace ACLs, quota hooks, ordered evidence
+  typed wallet capability authorisation, namespace ACLs, quota hooks, ordered evidence
   promotion, and audit events.
 - Public version responses bind a content-addressed source snapshot URL. The
   read-only service exposes `/source-snapshots/*` independently of Postgres and
@@ -900,7 +907,7 @@ Non-CellScript artifact profiles still fail closed.
 | `cellc repl` | Start the interactive REPL |
 | `cellc run` | Run ELF entrypoints via VM runner or simulator; `--json` includes cycles for VM execution and `cycles: null` for simulation |
 | `cellc publish` / `cellc publish --offline` / `cellc registry add` / `cellc registry edit --yank` | Public publish plus explicit local/offline registry metadata flow; public registry policy makes bare `cellc publish` an authenticated registry write, with Git/static metadata retained for audit and fallback |
-| `cellc auth capability create/submit/revoke` / public registry write API / non-CellScript artifact install | JoyID-rooted publication policy and future-facing artifact profiles; fail-closed where unsupported |
+| `cellc auth capability create/submit/revoke` / public registry write API / non-CellScript artifact install | Typed wallet-rooted publication policy and future-facing artifact profiles; fail-closed where unsupported |
 
 ### CLI Options
 

docs/CELLSCRIPT_GATE_POLICY.md

@@ -66,6 +66,11 @@ The CLI coverage includes the explicit first-publish admission sequence:
 `cellc auth capability submit`, `cellc auth namespace claim`, then
 `cellc publish`. Capability registration does not silently claim a namespace;
 the claim response must be `active` before the write API accepts a version.
+Registry API tests pin both accepted publisher roots: JoyID signatures under
+`principal_type = joyid_ckb` and recoverable CKB message signatures under
+`principal_type = ckb_secp256k1`. CLI fixtures use the generic
+`--wallet-signature` surface; the former `--joyid-signature` spelling remains a
+visible compatibility alias and does not define a second request shape.
 Explicit `--allow-unverified` and `--allow-quarantined` install choices are
 persisted per dependency so the lock refresh and later builds exercise the
 same auditable resolver policy.