Publish a provider

A provider distribution registers one pllm.providers.v1 entry point whose top-level package contains pllm-plugin.json. The manifest records provider, distribution, component, category, resource, tested-build, and factory identities under independently versioned contracts. Discovery reads installed distribution metadata and static JSON only: it does not call the entry point, import provider code, load native libraries, fetch dependencies, or contact a service.

Manifest resource paths are package-relative and digest-checked. Paths that escape the package, files absent from distribution metadata, changed files, duplicate component identities, unsupported host/category versions, and malformed manifests fail closed. Editable installations require allow_editable=True and do not silently count as release-conformant artifacts.

Python SDK example

from pllm import discover_providers

providers = discover_providers()
assert all(provider.entry_point for provider in providers)
assert all(provider.manifest_digest for provider in providers)

Discovery is not a sandbox or a trust decision. load_component_factory(...) imports code only when the provider is named in the caller's explicit approval set. An imported in-process factory joins that role's trusted computing base. The native plugin ABI remains unavailable.

API: pllm.providers