Skip to main content
The projector turns one accepted authored graph into a complete provider tree. JavaScript owns file and process effects. Pkl owns provider-specific shapes and text transformations.

Freeze, evaluate, seal, publish

The entry point reads regular source files once and keeps their bytes and Unix modes. It rejects source symlinks and nonregular resources. It also captures local evidence outside source/ when current routing cases cite those files. Graph and catalog checks run against a temporary copy of those same inputs. Pkl receives the frozen model through a temporary JSON file. Evaluation uses isolated module copies, explicit module and resource allowlists, and a bounded timeout. Exactly Pkl 0.32.0 is accepted. A missing runtime, wrong version, rejected model, or malformed plan stops the operation. The first evaluation derives output operations. The second evaluation seals the digests of actual derived payloads. The projector rejects changed derived bytes, changed modes, incomplete plugin coverage, and mismatched reference digests. It reexamines source and routing evidence before publication. A concurrent input change produces INPUT_CHANGED. The complete tree enters a staging directory beside the requested destination. The native publisher uses a no-replace directory operation. An existing destination, a destination inside the source repository, or unavailable atomic publication stops the operation. The projector does not download a runtime or replace a previous tree.

Provider capability limits

The Pi model projects every accepted catalog plugin. It needs one shared version and unique hook owners. The aggregate deduplicates shared skill registrations by name. Its inventory binds every payload file to a digest. The retired single-skill Pi package does not describe current projection.

Generate a provider tree

From a prepared checkout, install the pinned runtime explicitly:
Set PKL_BIN to that executable. Use a fresh output path for each provider:
The projection guide explains installation and provider-specific recovery. Focused tests exercise accepted source and rejection paths. Projection proves package construction. Hook delivery, consumer installation, and release publication need separate evidence.