fix(registry): address review findings + CI failures

CI fixes:
- Rename normalizeCapabilities -> canonicalCapabilitiesForDriftCheck
  to avoid namespace clash with the existing capability normalizer
  exported from @emdash-cms/plugin-types via core's index. The old
  name shadowed plugin-types' helper at the top level of core's dist,
  which made the definePlugin() overload set look ambiguous to TS in
  plugins/forms and caused a typecheck cascade there.
- [...seen].toSorted() instead of [...seen].sort() to clear the
  e18e/prefer-spread-syntax + unicorn/no-array-sort lint errors.

Review findings (ask-bonk[bot]):
- HIGH: drift check tripped on every install when the release record's
  extension was empty. The browser now omits acknowledgedDeclaredAccess
  when capabilities is empty, opting out of the server-side drift gate
  for the (currently common) case where publishers haven't filled in
  the extension block. The bundle's real capabilities are still bound
  to the checksum-verified bytes.
- HIGH: DID-only publishers (no resolvable handle) could be linked from
  the browse grid but never installed because the server rejects
  handles without a '.'. Cards now render as non-interactive with a
  'Publisher handle unresolved' badge; the detail page surfaces a
  matching warning and disables Install.
- MEDIUM: registry-enabled sites were unconditionally routing existing
  marketplace plugin detail URLs to RegistryPluginDetail, breaking deep
  links. Detail-route selection now discriminates by param shape
  (pluginId.includes('/')) rather than the manifest flag.
- MEDIUM: state-row write failure after storeBundleInR2 left orphan
  bundles. Best-effort cleanup in the catch via deleteBundleFromR2.
- LOW: parseDurationSeconds runs on the user-supplied integration
  option per install (not the already-normalized manifest shape). Wrap
  in try/catch and surface as REGISTRY_POLICY_INVALID rather than
  letting it bubble to a generic INSTALL_FAILED.
- LOW: validator-pattern doc drift in plugin-id.ts (already fixed in
  the prior commit).

Author: ascorbic

packages/admin/src/components/RegistryBrowse.tsx

@@ -154,43 +154,69 @@ interface RegistryPackageCardProps {
 
 function RegistryPackageCard({ pkg, installed }: RegistryPackageCardProps) {
 	const { t } = useLingui();
-	const handle = pkg.handle ?? pkg.did;
+	// Only domain-like handles are installable; the server's handle
+	// validator rejects DID strings. Cards for packages whose handle the
+	// aggregator couldn't resolve render the same content but without a
+	// link, so the user understands the package isn't actionable.
+	const installable = Boolean(pkg.handle && pkg.handle.includes("."));
+	const handleDisplay = pkg.handle ?? pkg.did;
 	// `profile` is a pass-through of the signed package profile record.
 	// We duck-type minimal display fields out of it.
 	const profile = pkg.profile as { name?: string; description?: string };
 	const verified = (pkg.labels ?? []).some((l: { val?: string }) => l.val === "verified");
 
+	const inner = (
+		<div className="flex items-start gap-3">
+			<div className="mt-1 rounded-md bg-kumo-subtle p-2 text-kumo-subtle">
+				<PuzzlePiece className="h-5 w-5" />
+			</div>
+			<div className="min-w-0 flex-1">
+				<div className="flex items-center gap-2">
+					<h2 className="truncate font-semibold">{profile.name ?? pkg.slug}</h2>
+					{verified ? (
+						<ShieldCheck
+							className="h-4 w-4 shrink-0 text-kumo-brand"
+							aria-label={t`Verified publisher`}
+						/>
+					) : null}
+				</div>
+				<p className="truncate text-xs text-kumo-subtle">{handleDisplay}</p>
+				{profile.description ? (
+					<p className="mt-2 line-clamp-2 text-sm text-kumo-default">{profile.description}</p>
+				) : null}
+				{installed ? (
+					<div className="mt-3">
+						<Badge variant="success">{t`Installed`}</Badge>
+					</div>
+				) : null}
+				{!installable ? (
+					<div className="mt-3">
+						<Badge variant="outline">{t`Publisher handle unresolved`}</Badge>
+					</div>
+				) : null}
+			</div>
+		</div>
+	);
+
+	if (!installable) {
+		return (
+			<div
+				className="block rounded-md border border-kumo-border bg-kumo-surface p-4 opacity-60"
+				aria-disabled="true"
+			>
+				{inner}
+			</div>
+		);
+	}
+
 	return (
 		<Link
 			to="/plugins/marketplace/$pluginId"
-			params={{ pluginId: `${pkg.handle ?? pkg.did}/${pkg.slug}` }}
+			// eslint-disable-next-line @typescript-eslint/no-non-null-assertion -- installable check above ensures pkg.handle is defined
+			params={{ pluginId: `${pkg.handle!}/${pkg.slug}` }}
 			className="block rounded-md border border-kumo-border bg-kumo-surface p-4 transition-colors hover:bg-kumo-subtle focus:outline-none focus-visible:ring-2 focus-visible:ring-kumo-brand"
 		>
-			<div className="flex items-start gap-3">
-				<div className="mt-1 rounded-md bg-kumo-subtle p-2 text-kumo-subtle">
-					<PuzzlePiece className="h-5 w-5" />
-				</div>
-				<div className="min-w-0 flex-1">
-					<div className="flex items-center gap-2">
-						<h2 className="truncate font-semibold">{profile.name ?? pkg.slug}</h2>
-						{verified ? (
-							<ShieldCheck
-								className="h-4 w-4 shrink-0 text-kumo-brand"
-								aria-label={t`Verified publisher`}
-							/>
-						) : null}
-					</div>
-					<p className="truncate text-xs text-kumo-subtle">{handle}</p>
-					{profile.description ? (
-						<p className="mt-2 line-clamp-2 text-sm text-kumo-default">{profile.description}</p>
-					) : null}
-					{installed ? (
-						<div className="mt-3">
-							<Badge variant="success">{t`Installed`}</Badge>
-						</div>
-					) : null}
-				</div>
-			</div>
+			{inner}
 		</Link>
 	);
 }

packages/admin/src/components/RegistryPluginDetail.tsx

@@ -21,9 +21,9 @@ import { Link } from "@tanstack/react-router";
 import * as React from "react";
 
 import {
+	canonicalCapabilitiesForDriftCheck,
 	getLatestRegistryRelease,
 	installRegistryPlugin,
-	normalizeCapabilities,
 	releasePassesPolicy,
 	resolveRegistryPackage,
 	type RegistryClientConfig,
@@ -84,22 +84,39 @@ export function RegistryPluginDetail({ pluginId, config }: RegistryPluginDetailP
 	)?.[1];
 
 	const capabilities: string[] = Array.isArray(ext?.capabilities)
-		? normalizeCapabilities(ext?.capabilities)
-		: normalizeCapabilities(declaredAccessToCapabilityList(ext?.declaredAccess));
+		? canonicalCapabilitiesForDriftCheck(ext?.capabilities)
+		: canonicalCapabilitiesForDriftCheck(declaredAccessToCapabilityList(ext?.declaredAccess));
 
 	const profile = pkg?.profile as { name?: string; description?: string } | undefined;
 	const verified = (pkg?.labels ?? []).some((l: { val?: string }) => l.val === "verified");
 
 	const policyOk =
 		release && pkg ? releasePassesPolicy(release, { did: pkg.did, slug }, config.policy) : true;
+	// Install requires a resolvable handle: the server validates handles
+	// with at least one `.`, which DID strings (`did:plc:abc`) don't
+	// satisfy. Publishers whose handle the aggregator couldn't resolve
+	// (or who haven't claimed one yet) can't be installed today. Surface
+	// the limitation in the UI rather than letting the user click into
+	// `INVALID_HANDLE` from the server.
+	const hasResolvableHandle = Boolean(pkg?.handle && pkg.handle.includes("."));
 
 	const installMutation = useMutation({
 		mutationFn: () =>
 			installRegistryPlugin({
 				handle,
 				slug,
 				version: release?.version,
-				acknowledgedDeclaredAccess: capabilities,
+				// Only send the acknowledgement when the dialog had real
+				// capability data to display. The server's drift check is
+				// gated on `acknowledgedDeclaredAccess !== undefined`, so
+				// omitting the field opts out of the check entirely --
+				// correct behaviour for the (currently common) case where
+				// the publisher's release record doesn't yet carry an
+				// extension block. The bundle's actual capabilities are
+				// still bound to the checksum-verified bytes; the drift
+				// check is a UX sanity belt for already-displayed
+				// consent, not an authorization gate.
+				acknowledgedDeclaredAccess: capabilities.length > 0 ? capabilities : undefined,
 			}),
 		onSuccess: () => {
 			setShowConsent(false);
@@ -173,14 +190,30 @@ export function RegistryPluginDetail({ pluginId, config }: RegistryPluginDetailP
 				<div>
 					<Button
 						variant="primary"
-						disabled={!release || !policyOk}
+						disabled={!release || !policyOk || !hasResolvableHandle}
 						onClick={() => setShowConsent(true)}
 					>
 						{t`Install`}
 					</Button>
 				</div>
 			</div>
 
+			{/* Unresolvable handle notice */}
+			{pkg && !hasResolvableHandle ? (
+				<div
+					className="flex items-start gap-3 rounded-md border border-kumo-warning bg-kumo-warning/10 p-4 text-kumo-warning"
+					role="status"
+				>
+					<Warning className="mt-0.5 h-5 w-5 shrink-0" />
+					<div>
+						<p className="font-medium">{t`Publisher handle is not resolvable`}</p>
+						<p className="mt-1 text-sm text-kumo-default">
+							{t`This package's publisher hasn't claimed a handle the aggregator can resolve, so it can't be installed yet. The publisher needs to set up a handle (any domain they control) before this plugin is installable.`}
+						</p>
+					</div>
+				</div>
+			) : null}
+
 			{/* Policy holdback notice */}
 			{release && !policyOk ? (
 				<div

packages/admin/src/lib/api/registry.ts

@@ -208,23 +208,23 @@ export function releasePassesPolicy(
 }
 
 /**
- * Normalize a capabilities list for set-style comparison. Mirrors the
- * server-side helper of the same name in
+ * Canonicalize a capabilities list for set-style comparison. Mirrors
+ * the server-side helper `canonicalCapabilitiesForDriftCheck` in
  * `packages/core/src/registry/config.ts` -- both sides must produce
  * the same canonical shape so the install handler's drift check is
  * stable across reorderings, duplicates, and junk entries.
  *
  * Filters non-strings, deduplicates, and sorts lexically.
  */
-export function normalizeCapabilities(value: unknown): string[] {
+export function canonicalCapabilitiesForDriftCheck(value: unknown): string[] {
 	if (!Array.isArray(value)) return [];
 	const seen = new Set<string>();
 	for (const entry of value) {
 		if (typeof entry === "string" && entry.length > 0) {
 			seen.add(entry);
 		}
 	}
-	return Array.from(seen).sort();
+	return [...seen].toSorted();
 }
 
 /**

packages/admin/src/router.tsx

@@ -1336,10 +1336,14 @@ function MarketplaceDetailPage() {
 		return new Set(plugins.map((p) => p.id));
 	}, [plugins]);
 
-	// Registry detail when configured. The `pluginId` route param carries
-	// `${handle}/${slug}` in the registry case; the slash is encoded once
-	// by the router and decoded back here.
-	if (manifest?.registry) {
+	// Discriminate by param shape, not by the manifest flag. A registry
+	// pluginId is always `${handle}/${slug}` and contains exactly one `/`;
+	// a marketplace pluginId is a single segment with no `/`. This keeps
+	// deep links to marketplace-installed plugins working on sites that
+	// later opt into the registry, instead of unconditionally routing
+	// every visit to RegistryPluginDetail.
+	const looksLikeRegistryId = pluginId.includes("/");
+	if (manifest?.registry && looksLikeRegistryId) {
 		return <RegistryPluginDetail pluginId={pluginId} config={manifest.registry} />;
 	}
 

packages/core/src/api/handlers/registry.ts

@@ -48,7 +48,7 @@ import type { PluginBundle } from "../../plugins/marketplace.js";
 import type { SandboxRunner } from "../../plugins/sandbox/types.js";
 import { PluginStateRepository } from "../../plugins/state.js";
 import {
-	normalizeCapabilities,
+	canonicalCapabilitiesForDriftCheck,
 	parseDurationSeconds,
 	releaseExemptFromMinimumAge,
 	validateAggregatorUrl,
@@ -57,7 +57,7 @@ import { makeRegistryPluginId } from "../../registry/plugin-id.js";
 import { EmDashStorageError } from "../../storage/types.js";
 import type { Storage } from "../../storage/types.js";
 import type { ApiResult } from "../types.js";
-import { storeBundleInR2 } from "./marketplace.js";
+import { deleteBundleFromR2, storeBundleInR2 } from "./marketplace.js";
 
 // ── Types ──────────────────────────────────────────────────────────
 
@@ -690,9 +690,31 @@ export async function handleRegistryInstall(
 		// signed createdAt from the publisher's PDS (deferred to the
 		// follow-up that adds full MST verification). If the timestamp
 		// is missing or malformed, we fail closed and reject the install.
+		// `registryConfig` is the user-supplied integration option, not
+		// the normalized manifest shape, so the duration parse runs once
+		// per install. Catch a malformed value here -- normally caught at
+		// `normalizeRegistryConfig` time, but a future config-mutation
+		// path could re-enter with a bad value -- and surface it as a
+		// structured error rather than letting it bubble out as a generic
+		// 500.
 		const minimumReleaseAge = registryConfig.policy?.minimumReleaseAge;
-		const minimumReleaseAgeSeconds =
-			minimumReleaseAge !== undefined ? parseDurationSeconds(minimumReleaseAge) : 0;
+		let minimumReleaseAgeSeconds = 0;
+		if (minimumReleaseAge !== undefined) {
+			try {
+				minimumReleaseAgeSeconds = parseDurationSeconds(minimumReleaseAge);
+			} catch (err) {
+				return {
+					success: false,
+					error: {
+						code: "REGISTRY_POLICY_INVALID",
+						message:
+							err instanceof Error
+								? err.message
+								: "Invalid minimumReleaseAge value in registry config",
+					},
+				};
+			}
+		}
 		if (minimumReleaseAgeSeconds > 0) {
 			const exclude = registryConfig.policy?.minimumReleaseAgeExclude?.map((e) =>
 				e.trim().toLowerCase(),
@@ -876,8 +898,8 @@ export async function handleRegistryInstall(
 		// the runtime starts enforcing `declaredAccess` natively, this
 		// comparison switches to that shape.
 		if (input.acknowledgedDeclaredAccess !== undefined) {
-			const acknowledged = normalizeCapabilities(input.acknowledgedDeclaredAccess);
-			const actual = normalizeCapabilities(bundle.manifest.capabilities);
+			const acknowledged = canonicalCapabilitiesForDriftCheck(input.acknowledgedDeclaredAccess);
+			const actual = canonicalCapabilitiesForDriftCheck(bundle.manifest.capabilities);
 			if (
 				acknowledged.length !== actual.length ||
 				acknowledged.some((cap, i) => cap !== actual[i])
@@ -901,14 +923,32 @@ export async function handleRegistryInstall(
 		// (the signed record from the publisher's repo), not from the
 		// bundle manifest -- the manifest carries the trust contract,
 		// the profile carries the marketing copy.
+		//
+		// If the state-row write fails (DB error, PK race against a
+		// concurrent install of the same package), clean up the R2 bundle
+		// we just wrote so we don't leave orphans. The cleanup is
+		// best-effort; if it also fails, the row failure still surfaces
+		// to the caller.
 		const profile = packageView.profile as { name?: string; description?: string };
-		await stateRepo.upsert(pluginId, version, "active", {
-			source: "registry",
-			displayName: profile.name ?? slug,
-			description: profile.description ?? undefined,
-			registryPublisherDid: publisherDid,
-			registrySlug: slug,
-		});
+		try {
+			await stateRepo.upsert(pluginId, version, "active", {
+				source: "registry",
+				displayName: profile.name ?? slug,
+				description: profile.description ?? undefined,
+				registryPublisherDid: publisherDid,
+				registrySlug: slug,
+			});
+		} catch (stateErr) {
+			try {
+				await deleteBundleFromR2(storage, pluginId, version, "registry");
+			} catch (cleanupErr) {
+				console.warn(
+					`[registry-install] Failed to clean up R2 bundle for ${pluginId}@${version} after state-row write failure:`,
+					cleanupErr,
+				);
+			}
+			throw stateErr;
+		}
 
 		return {
 			success: true,

packages/core/src/registry/config.ts

@@ -38,30 +38,34 @@ export interface ManifestRegistryConfig {
 }
 
 /**
- * Normalize a capabilities list for set-style comparison.
+ * Canonicalize a capabilities list for set-style comparison.
  *
  * Capabilities (the legacy declared-access shape used by the current
  * sandbox enforcer) are conceptually a *set*: order, duplicates, and
  * non-string entries don't carry meaning. The install handler's drift
  * check compares the admin's acknowledged set against the bundle
- * manifest's set; both sides pass through this normalizer first so
+ * manifest's set; both sides pass through this canonicalizer first so
  * an aggregator-supplied array with unstable order or junk entries
  * can't cause a spurious drift rejection.
  *
- * Filters non-strings, deduplicates, and sorts lexically. Exported so
- * the same shape is produced by the browser before sending the
- * `acknowledgedDeclaredAccess` payload and by the server before
+ * Filters non-strings, deduplicates, and sorts lexically. Named to
+ * avoid shadowing `@emdash-cms/plugin-types`'s existing
+ * `normalizeCapabilities` (which dedupes + applies the deprecated →
+ * current alias map but does not filter junk or sort).
+ *
+ * Exported so the same shape is produced by the browser before sending
+ * the `acknowledgedDeclaredAccess` payload and by the server before
  * comparing against the bundle.
  */
-export function normalizeCapabilities(value: unknown): string[] {
+export function canonicalCapabilitiesForDriftCheck(value: unknown): string[] {
 	if (!Array.isArray(value)) return [];
 	const seen = new Set<string>();
 	for (const entry of value) {
 		if (typeof entry === "string" && entry.length > 0) {
 			seen.add(entry);
 		}
 	}
-	return Array.from(seen).sort();
+	return [...seen].toSorted();
 }
 
 /**