Bump nu.validator:validator from 26.5.29 to 26.6.24

Bumps [nu.validator:validator](https://github.com/validator/validator) from 26.5.29 to 26.6.24.
- [Release notes](https://github.com/validator/validator/releases)
- [Commits](https://github.com/validator/validator/compare/26.5.29...26.6.24)

---
updated-dependencies:
- dependency-name: nu.validator:validator
  dependency-version: 26.6.24
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

.github/workflows/__lockfile__.yml

@@ -17,7 +17,7 @@ jobs:
     runs-on: nothing
     steps:
     - name: EnricoMi/publish-unit-test-result-action@v2
-      uses: EnricoMi/publish-unit-test-result-action@c950f6fb443cb5af20a377fd0dfaa78838901040 # v2
+      uses: EnricoMi/publish-unit-test-result-action@d0a4676d0e0b938bc201470d88276b7c74c712b3 # v2
     - name: actions/checkout@v6
       uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
     - name: actions/create-github-app-token@v2
@@ -25,7 +25,7 @@ jobs:
     - name: actions/download-artifact@v6
       uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6
     - name: actions/setup-java@v5
-      uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+      uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5
     - name: actions/upload-artifact@v5
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
     - name: dawidd6/action-download-artifact@v11

.github/workflows/build.yml

@@ -23,7 +23,7 @@ jobs:
       with:
         persist-credentials: false
         fetch-depth: 0
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5
       with:
         java-version: '25'
         distribution: temurin
@@ -64,7 +64,7 @@ jobs:
       with:
         persist-credentials: false
         fetch-depth: 0
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5
       with:
         java-version: '25'
         distribution: temurin
@@ -103,7 +103,7 @@ jobs:
     - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5
       with:
         java-version: '25'
         distribution: temurin
@@ -130,7 +130,7 @@ jobs:
       with:
         persist-credentials: false
         fetch-depth: 0
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5
       with:
         java-version: '25'
         distribution: temurin
@@ -170,7 +170,7 @@ jobs:
       with:
         persist-credentials: false
         fetch-depth: 0
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5
       with:
         java-version: '25'
         distribution: temurin
@@ -220,7 +220,7 @@ jobs:
     - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5
       with:
         java-version: '25'
         distribution: temurin
@@ -266,7 +266,7 @@ jobs:
     - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5
       with:
         java-version: '25'
         distribution: temurin
@@ -317,7 +317,7 @@ jobs:
     - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5
       with:
         java-version: '25'
         distribution: temurin
@@ -363,7 +363,7 @@ jobs:
     - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5
       with:
         java-version: '25'
         distribution: temurin
@@ -411,7 +411,7 @@ jobs:
     - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5
       with:
         java-version: '25'
         distribution: temurin
@@ -529,7 +529,7 @@ jobs:
     - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5
       with:
         java-version: '25'
         distribution: temurin
@@ -576,7 +576,7 @@ jobs:
     - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5
       with:
         java-version: '25'
         distribution: temurin
@@ -622,7 +622,7 @@ jobs:
     - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5
       with:
         java-version: '25'
         distribution: temurin
@@ -673,7 +673,7 @@ jobs:
     - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5
       with:
         java-version: '25'
         distribution: temurin
@@ -719,7 +719,7 @@ jobs:
     - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5
       with:
         java-version: '25'
         distribution: temurin
@@ -767,7 +767,7 @@ jobs:
     - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5
       with:
         java-version: '25'
         distribution: temurin
@@ -885,7 +885,7 @@ jobs:
     - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5
       with:
         java-version: '25'
         distribution: temurin
@@ -949,7 +949,7 @@ jobs:
         pattern: test-results-xml-*
     - name: Publish test results
       if: '!cancelled()'
-      uses: EnricoMi/publish-unit-test-result-action@c950f6fb443cb5af20a377fd0dfaa78838901040 # v2
+      uses: EnricoMi/publish-unit-test-result-action@d0a4676d0e0b938bc201470d88276b7c74c712b3 # v2
       with:
         comment_mode: 'off'
         files: test-results-xml-*/**/*.xml

.github/workflows/main.yml

@@ -21,7 +21,7 @@ jobs:
       with:
         persist-credentials: false
         fetch-depth: 0
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5
       with:
         java-version: '25'
         distribution: temurin
@@ -62,7 +62,7 @@ jobs:
       with:
         persist-credentials: false
         fetch-depth: 0
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5
       with:
         java-version: '25'
         distribution: temurin
@@ -101,7 +101,7 @@ jobs:
     - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5
       with:
         java-version: '25'
         distribution: temurin
@@ -128,7 +128,7 @@ jobs:
       with:
         persist-credentials: false
         fetch-depth: 0
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5
       with:
         java-version: '25'
         distribution: temurin
@@ -168,7 +168,7 @@ jobs:
       with:
         persist-credentials: false
         fetch-depth: 0
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5
       with:
         java-version: '25'
         distribution: temurin
@@ -218,7 +218,7 @@ jobs:
     - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5
       with:
         java-version: '25'
         distribution: temurin
@@ -264,7 +264,7 @@ jobs:
     - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5
       with:
         java-version: '25'
         distribution: temurin
@@ -315,7 +315,7 @@ jobs:
     - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5
       with:
         java-version: '25'
         distribution: temurin
@@ -361,7 +361,7 @@ jobs:
     - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5
       with:
         java-version: '25'
         distribution: temurin
@@ -409,7 +409,7 @@ jobs:
     - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5
       with:
         java-version: '25'
         distribution: temurin
@@ -527,7 +527,7 @@ jobs:
     - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5
       with:
         java-version: '25'
         distribution: temurin
@@ -574,7 +574,7 @@ jobs:
     - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5
       with:
         java-version: '25'
         distribution: temurin
@@ -620,7 +620,7 @@ jobs:
     - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5
       with:
         java-version: '25'
         distribution: temurin
@@ -671,7 +671,7 @@ jobs:
     - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5
       with:
         java-version: '25'
         distribution: temurin
@@ -717,7 +717,7 @@ jobs:
     - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5
       with:
         java-version: '25'
         distribution: temurin
@@ -765,7 +765,7 @@ jobs:
     - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5
       with:
         java-version: '25'
         distribution: temurin
@@ -883,7 +883,7 @@ jobs:
     - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5
       with:
         java-version: '25'
         distribution: temurin
@@ -946,7 +946,7 @@ jobs:
     - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5
       with:
         java-version: '25'
         distribution: temurin
@@ -983,7 +983,7 @@ jobs:
     - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5
       with:
         java-version: '25'
         distribution: temurin
@@ -1018,7 +1018,7 @@ jobs:
         pattern: test-results-xml-*
     - name: Publish test results
       if: '!cancelled()'
-      uses: EnricoMi/publish-unit-test-result-action@c950f6fb443cb5af20a377fd0dfaa78838901040 # v2
+      uses: EnricoMi/publish-unit-test-result-action@d0a4676d0e0b938bc201470d88276b7c74c712b3 # v2
       with:
         comment_mode: 'off'
         files: test-results-xml-*/**/*.xml

.github/workflows/prb.yml

@@ -17,7 +17,7 @@ jobs:
       with:
         persist-credentials: false
         fetch-depth: 0
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5
       with:
         java-version: '25'
         distribution: temurin
@@ -60,7 +60,7 @@ jobs:
       with:
         persist-credentials: false
         fetch-depth: 0
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5
       with:
         java-version: '25'
         distribution: temurin
@@ -103,7 +103,7 @@ jobs:
     - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5
       with:
         java-version: '25'
         distribution: temurin
@@ -151,7 +151,7 @@ jobs:
     - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5
       with:
         java-version: '25'
         distribution: temurin
@@ -203,7 +203,7 @@ jobs:
     - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5
       with:
         java-version: '25'
         distribution: temurin
@@ -251,7 +251,7 @@ jobs:
     - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5
       with:
         java-version: '25'
         distribution: temurin
@@ -301,7 +301,7 @@ jobs:
     - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5
       with:
         java-version: '25'
         distribution: temurin
@@ -421,7 +421,7 @@ jobs:
     - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5
       with:
         java-version: '25'
         distribution: temurin
@@ -469,7 +469,7 @@ jobs:
     - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5
       with:
         java-version: '25'
         distribution: temurin
@@ -517,7 +517,7 @@ jobs:
     - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5
       with:
         java-version: '25'
         distribution: temurin
@@ -569,7 +569,7 @@ jobs:
     - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5
       with:
         java-version: '25'
         distribution: temurin
@@ -617,7 +617,7 @@ jobs:
     - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5
       with:
         java-version: '25'
         distribution: temurin
@@ -667,7 +667,7 @@ jobs:
     - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5
       with:
         java-version: '25'
         distribution: temurin
@@ -787,7 +787,7 @@ jobs:
     - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5
       with:
         java-version: '25'
         distribution: temurin

.github/workflows/release-branch.yml

@@ -21,7 +21,7 @@ jobs:
       with:
         persist-credentials: false
         fetch-depth: 0
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5
       with:
         java-version: '25'
         distribution: temurin
@@ -62,7 +62,7 @@ jobs:
       with:
         persist-credentials: false
         fetch-depth: 0
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5
       with:
         java-version: '25'
         distribution: temurin
@@ -101,7 +101,7 @@ jobs:
     - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5
       with:
         java-version: '25'
         distribution: temurin
@@ -128,7 +128,7 @@ jobs:
       with:
         persist-credentials: false
         fetch-depth: 0
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5
       with:
         java-version: '25'
         distribution: temurin
@@ -168,7 +168,7 @@ jobs:
       with:
         persist-credentials: false
         fetch-depth: 0
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5
       with:
         java-version: '25'
         distribution: temurin
@@ -218,7 +218,7 @@ jobs:
     - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5
       with:
         java-version: '25'
         distribution: temurin
@@ -264,7 +264,7 @@ jobs:
     - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5
       with:
         java-version: '25'
         distribution: temurin
@@ -315,7 +315,7 @@ jobs:
     - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5
       with:
         java-version: '25'
         distribution: temurin
@@ -361,7 +361,7 @@ jobs:
     - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5
       with:
         java-version: '25'
         distribution: temurin
@@ -409,7 +409,7 @@ jobs:
     - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5
       with:
         java-version: '25'
         distribution: temurin
@@ -527,7 +527,7 @@ jobs:
     - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5
       with:
         java-version: '25'
         distribution: temurin
@@ -574,7 +574,7 @@ jobs:
     - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5
       with:
         java-version: '25'
         distribution: temurin
@@ -620,7 +620,7 @@ jobs:
     - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5
       with:
         java-version: '25'
         distribution: temurin
@@ -671,7 +671,7 @@ jobs:
     - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5
       with:
         java-version: '25'
         distribution: temurin
@@ -717,7 +717,7 @@ jobs:
     - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5
       with:
         java-version: '25'
         distribution: temurin
@@ -765,7 +765,7 @@ jobs:
     - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5
       with:
         java-version: '25'
         distribution: temurin
@@ -883,7 +883,7 @@ jobs:
     - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5
       with:
         java-version: '25'
         distribution: temurin
@@ -947,7 +947,7 @@ jobs:
         pattern: test-results-xml-*
     - name: Publish test results
       if: '!cancelled()'
-      uses: EnricoMi/publish-unit-test-result-action@c950f6fb443cb5af20a377fd0dfaa78838901040 # v2
+      uses: EnricoMi/publish-unit-test-result-action@d0a4676d0e0b938bc201470d88276b7c74c712b3 # v2
       with:
         comment_mode: 'off'
         files: test-results-xml-*/**/*.xml

.github/workflows/release.yml

@@ -21,7 +21,7 @@ jobs:
       with:
         persist-credentials: false
         fetch-depth: 0
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5
       with:
         java-version: '25'
         distribution: temurin
@@ -62,7 +62,7 @@ jobs:
       with:
         persist-credentials: false
         fetch-depth: 0
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5
       with:
         java-version: '25'
         distribution: temurin
@@ -101,7 +101,7 @@ jobs:
     - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5
       with:
         java-version: '25'
         distribution: temurin
@@ -128,7 +128,7 @@ jobs:
       with:
         persist-credentials: false
         fetch-depth: 0
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5
       with:
         java-version: '25'
         distribution: temurin
@@ -168,7 +168,7 @@ jobs:
       with:
         persist-credentials: false
         fetch-depth: 0
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5
       with:
         java-version: '25'
         distribution: temurin
@@ -219,7 +219,7 @@ jobs:
     - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5
       with:
         java-version: '25'
         distribution: temurin
@@ -266,7 +266,7 @@ jobs:
     - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5
       with:
         java-version: '25'
         distribution: temurin
@@ -318,7 +318,7 @@ jobs:
     - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5
       with:
         java-version: '25'
         distribution: temurin
@@ -365,7 +365,7 @@ jobs:
     - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5
       with:
         java-version: '25'
         distribution: temurin
@@ -414,7 +414,7 @@ jobs:
     - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5
       with:
         java-version: '25'
         distribution: temurin
@@ -533,7 +533,7 @@ jobs:
     - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5
       with:
         java-version: '25'
         distribution: temurin
@@ -581,7 +581,7 @@ jobs:
     - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5
       with:
         java-version: '25'
         distribution: temurin
@@ -628,7 +628,7 @@ jobs:
     - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5
       with:
         java-version: '25'
         distribution: temurin
@@ -680,7 +680,7 @@ jobs:
     - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5
       with:
         java-version: '25'
         distribution: temurin
@@ -727,7 +727,7 @@ jobs:
     - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5
       with:
         java-version: '25'
         distribution: temurin
@@ -776,7 +776,7 @@ jobs:
     - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5
       with:
         java-version: '25'
         distribution: temurin
@@ -895,7 +895,7 @@ jobs:
     - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5
       with:
         java-version: '25'
         distribution: temurin
@@ -959,7 +959,7 @@ jobs:
     - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
         persist-credentials: false
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+    - uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5
       with:
         java-version: '25'
         distribution: temurin
@@ -1043,7 +1043,7 @@ jobs:
         pattern: test-results-xml-*
     - name: Publish test results
       if: '!cancelled()'
-      uses: EnricoMi/publish-unit-test-result-action@c950f6fb443cb5af20a377fd0dfaa78838901040 # v2
+      uses: EnricoMi/publish-unit-test-result-action@d0a4676d0e0b938bc201470d88276b7c74c712b3 # v2
       with:
         comment_mode: 'off'
         files: test-results-xml-*/**/*.xml

.github/workflows/test_report.yml

@@ -25,7 +25,7 @@ jobs:
         name_is_regexp: true
         run_id: ${{ github.event.workflow_run.id }}
     - name: Publish test results
-      uses: EnricoMi/publish-unit-test-result-action@c950f6fb443cb5af20a377fd0dfaa78838901040 # v2
+      uses: EnricoMi/publish-unit-test-result-action@d0a4676d0e0b938bc201470d88276b7c74c712b3 # v2
       with:
         commit: ${{ github.event.workflow_run.head_sha }}
         comment_mode: 'off'

build-logic/src/main/kotlin/InstallGraalVm.kt

@@ -13,10 +13,13 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
+import java.nio.file.AtomicMoveNotSupportedException
 import java.nio.file.Files
+import java.nio.file.Path
 import java.nio.file.Paths
 import java.nio.file.StandardCopyOption
 import java.util.*
+import java.util.zip.ZipInputStream
 import javax.inject.Inject
 import kotlin.io.path.createDirectories
 import org.gradle.api.DefaultTask
@@ -41,19 +44,14 @@ constructor(
   @TaskAction
   @Suppress("unused")
   fun run() {
-    // minimize chance of corruption by extract-to-random-dir-and-flip-symlink
+    // minimize chance of corruption by extract-to-random-dir-and-publish
     val distroDir = Paths.get(graalVm.get().homeDir, UUID.randomUUID().toString())
     try {
       distroDir.createDirectories()
       println("Extracting ${graalVm.get().downloadFile} into $distroDir")
-      // faster and more reliable than Gradle's `copy { from tarTree() }`
-      execOperations.exec {
-        workingDir = distroDir.toFile()
-        executable = "tar"
-        args("--strip-components=1", "-xzf", graalVm.get().downloadFile)
-      }
-
       val os = org.gradle.internal.os.OperatingSystem.current()
+      if (os.isWindows) extractZip(distroDir) else extractTarGz(distroDir)
+
       val distroBinDir =
         if (os.isMacOsX) distroDir.resolve("Contents/Home/bin") else distroDir.resolve("bin")
 
@@ -70,17 +68,7 @@ constructor(
         }
       }
 
-      println("Creating symlink ${graalVm.get().installDir} for $distroDir")
+      publishInstallDir(distroDir, os)
-      val tempLink = Paths.get(graalVm.get().homeDir, UUID.randomUUID().toString())
-      Files.createSymbolicLink(tempLink, distroDir)
-      try {
-        Files.move(tempLink, graalVm.get().installDir.toPath(), StandardCopyOption.ATOMIC_MOVE)
-      } catch (e: Exception) {
-        try {
-          fileOperations.delete(tempLink.toFile())
-        } catch (ignored: Exception) {}
-        throw e
-      }
     } catch (e: Exception) {
       try {
         fileOperations.delete(distroDir)
@@ -88,4 +76,75 @@ constructor(
       throw e
     }
   }
+
+  private fun extractTarGz(distroDir: Path) {
+    // faster and more reliable than Gradle's `copy { from tarTree() }`
+    execOperations.exec {
+      workingDir = distroDir.toFile()
+      executable = "tar"
+      args("--strip-components=1", "-xzf", graalVm.get().downloadFile)
+    }
+  }
+
+  private fun extractZip(distroDir: Path) {
+    val targetDir = distroDir.toAbsolutePath().normalize()
+    ZipInputStream(graalVm.get().downloadFile.inputStream().buffered()).use { zipInput ->
+      var entry = zipInput.nextEntry
+      while (entry != null) {
+        try {
+          val strippedPath = stripFirstPathComponent(entry.name)
+          if (strippedPath != null) {
+            val target = targetDir.resolve(strippedPath).normalize()
+            require(target.startsWith(targetDir)) {
+              "GraalVM archive entry escapes destination directory: ${entry.name}"
+            }
+            if (entry.isDirectory) {
+              target.createDirectories()
+            } else {
+              target.parent?.createDirectories()
+              Files.copy(zipInput, target)
+            }
+          }
+        } finally {
+          zipInput.closeEntry()
+        }
+        entry = zipInput.nextEntry
+      }
+    }
+  }
+
+  private fun stripFirstPathComponent(path: String): String? {
+    val normalizedPath = path.replace('\\', '/').trimStart('/')
+    val separatorIndex = normalizedPath.indexOf('/')
+    if (separatorIndex == -1) return null
+    return normalizedPath.substring(separatorIndex + 1).takeIf { it.isNotEmpty() }
+  }
+
+  private fun publishInstallDir(distroDir: Path, os: org.gradle.internal.os.OperatingSystem) {
+    if (os.isWindows) {
+      println("Installing ${graalVm.get().installDir} from $distroDir")
+      moveAtomicallyOrRegularly(distroDir, graalVm.get().installDir.toPath())
+      return
+    }
+
+    println("Creating symlink ${graalVm.get().installDir} for $distroDir")
+    val tempLink = Paths.get(graalVm.get().homeDir, UUID.randomUUID().toString())
+    Files.createSymbolicLink(tempLink, distroDir)
+    try {
+      moveAtomicallyOrRegularly(tempLink, graalVm.get().installDir.toPath())
+    } catch (e: Exception) {
+      try {
+        fileOperations.delete(tempLink.toFile())
+      } catch (ignored: Exception) {}
+      throw e
+    }
+  }
+
+  private fun moveAtomicallyOrRegularly(source: Path, target: Path) {
+    try {
+      Files.move(source, target, StandardCopyOption.ATOMIC_MOVE)
+    } catch (e: AtomicMoveNotSupportedException) {
+      Files.move(source, target)
+    }
+  }
 }

docs/modules/ROOT/partials/component-attributes.adoc

@@ -69,6 +69,7 @@ endif::[]
 
 :uri-stdlib-baseModule: {uri-pkl-stdlib-docs}/base
 :uri-stdlib-CommandModule: {uri-pkl-stdlib-docs}/Command
+:uri-stdlib-refModule: {uri-pkl-stdlib-docs}/ref
 :uri-stdlib-analyzeModule: {uri-pkl-stdlib-docs}/analyze
 :uri-stdlib-jsonnetModule: {uri-pkl-stdlib-docs}/jsonnet
 :uri-stdlib-reflectModule: {uri-pkl-stdlib-docs}/reflect
@@ -160,6 +161,8 @@ endif::[]
 :uri-stdlib-Command-CountedFlag: {uri-stdlib-CommandModule}/CountedFlag
 :uri-stdlib-Command-Argument: {uri-stdlib-CommandModule}/Argument
 :uri-stdlib-Command-Import: {uri-stdlib-CommandModule}/Import
+:uri-stdlib-ref-Reference: {uri-stdlib-baseModule}/Reference
+:uri-stdlib-ref-Access: {uri-stdlib-baseModule}/Access
 
 :uri-messagepack: https://msgpack.org/index.html
 :uri-messagepack-spec: https://github.com/msgpack/msgpack/blob/master/spec.md

docs/modules/bindings-specification/pages/binary-encoding.adoc

@@ -187,7 +187,15 @@ The array's length is the number of slots that are filled. For example, xref:{ur
 |
 |
 |
-|===
+
+|link:{uri-stdlib-ref-Reference}[Reference]
+|`0x20`
+|`<value>` (Typed)
+|Domain
+|`<value>`
+|Data
+|link:{uri-messagepack-array}[array]
+|Array of link:{uri-stdlib-ref-Access}[`pkl.ref#Access`] values
 
 [[type-name-encoding]]
 [NOTE]

gradle/libs.versions.toml

@@ -5,7 +5,7 @@ checksumPlugin = "1.4.0"
 clikt = "5.0.3"
 commonMark = "0.28.0"
 downloadTaskPlugin = "5.7.0"
-errorProne = "2.49.0"
+errorProne = "2.50.0"
 errorPronePlugin = "5.1.0"
 geantyref = "2.0.1"
 #noinspection UnusedVersionCatalogEntry
@@ -32,7 +32,7 @@ ideaExtPlugin = "1.4.1"
 javaPoet = "0.16.0"
 javaxInject = "1"
 jimfs = "1.3.1"
-jline = "4.1.3"
+jline = "4.2.1"
 jmh = "1.37"
 jmhPlugin = "0.7.3"
 jspecify = "1.0.0"
@@ -54,14 +54,14 @@ ktfmt = "0.62"
 log4j = "2.17.1"
 msgpack = "0.9.12"
 nexusPublishPlugin = "2.0.0"
-nullaway = "0.13.4"
+nullaway = "0.13.7"
 nullawayPlugin = "3.0.0"
-nuValidator = "26.5.29"
+nuValidator = "26.6.24"
 paguro = "3.10.3"
 shadowPlugin = "9.4.2"
 slf4j = "2.0.18"
 snakeYaml = "3.0.1"
-spotlessPlugin = "8.6.0"
+spotlessPlugin = "8.7.0"
 wiremock = "3.13.2"
 
 [libraries] # ordered alphabetically

pkl-core/src/main/java/org/pkl/core/ImportGraph.java

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -69,11 +69,11 @@ public record ImportGraph(Map<URI, Set<Import>> imports, Map<URI, URI> resolvedI
         var value = entry.getValue();
         var set = new TreeSet<Import>();
         if (!(value instanceof JsArray array)) {
-          throw new FormatException("array", value.getClass());
+          throw new FormatException("array", value == null ? Void.class : value.getClass());
         }
         for (var elem : array) {
           if (!(elem instanceof JsObject importObj)) {
-            throw new FormatException("object", elem.getClass());
+            throw new FormatException("object", elem == null ? Void.class : elem.getClass());
           }
           set.add(parseImport(importObj));
         }
@@ -98,7 +98,7 @@ public record ImportGraph(Map<URI, Set<Import>> imports, Map<URI, URI> resolvedI
         var key = new URI(entry.getKey());
         var value = entry.getValue();
         if (!(value instanceof String str)) {
-          throw new FormatException("string", value.getClass());
+          throw new FormatException("string", value == null ? Void.class : value.getClass());
         }
         var valueUri = new URI(str);
         ret.put(key, valueUri);

pkl-core/src/main/java/org/pkl/core/JsonRenderer.java

@@ -109,6 +109,8 @@ final class JsonRenderer implements ValueRenderer {
               "Values of type `Bytes` cannot be rendered as JSON. Value: %s", (Object) value));
     }
 
+    // Pair coming from the runtime can never admit null (in-language null is represented as PNull)
+    @SuppressWarnings("DataFlowIssue")
     @Override
     public void visitPair(Pair<?, ?> value) {
       try {

pkl-core/src/main/java/org/pkl/core/ModuleSchema.java

@@ -18,7 +18,6 @@ package org.pkl.core;
 import java.net.URI;
 import java.util.*;
 import org.jspecify.annotations.Nullable;
-import org.pkl.core.util.LateInit;
 
 /** Describes the property, method and class members of a module. */
 public final class ModuleSchema {
@@ -33,8 +32,8 @@ public final class ModuleSchema {
   private final Map<String, TypeAlias> typeAliases;
   private final Map<String, URI> imports;
 
-  @LateInit private Map<String, PClass> __allClasses;
+  private @Nullable Map<String, PClass> __allClasses;
-  @LateInit private Map<String, TypeAlias> __allTypeAliases;
+  private @Nullable Map<String, TypeAlias> __allTypeAliases;
 
   /** Constructs a {@code ModuleSchema} instance. */
   public ModuleSchema(

pkl-core/src/main/java/org/pkl/core/PClass.java

@@ -27,6 +27,7 @@ public final class PClass extends Member implements Value {
   private final List<TypeParameter> typeParameters;
   private final Map<String, Property> properties;
   private final Map<String, Method> methods;
+  private final @Nullable PClass moduleClass;
 
   private @Nullable PType supertype;
   private @Nullable PClass superclass;
@@ -42,12 +43,14 @@ public final class PClass extends Member implements Value {
       PClassInfo<?> classInfo,
       List<TypeParameter> typeParameters,
       Map<String, Property> properties,
-      Map<String, Method> methods) {
+      Map<String, Method> methods,
+      @Nullable PClass moduleClass) {
     super(docComment, sourceLocation, modifiers, annotations, classInfo.getSimpleName());
     this.classInfo = classInfo;
     this.typeParameters = typeParameters;
     this.properties = properties;
     this.methods = methods;
+    this.moduleClass = moduleClass;
   }
 
   public void initSupertype(PType supertype, PClass superclass) {
@@ -57,7 +60,7 @@ public final class PClass extends Member implements Value {
 
   /**
    * Returns the name of the module that this class is declared in. Note that a module name is not
-   * guaranteed to be unique, especially if it not declared but inferred from the module URI.
+   * guaranteed to be unique, especially if it is not declared but inferred from the module URI.
    */
   public String getModuleName() {
     return classInfo.getModuleName();
@@ -119,6 +122,11 @@ public final class PClass extends Member implements Value {
     return allMethods;
   }
 
+  /** Returns the class's containing module's class, or this class if it is a module class. */
+  public PClass getModuleClass() {
+    return moduleClass != null ? moduleClass : this;
+  }
+
   @Override
   public void accept(ValueVisitor visitor) {
     visitor.visitClass(this);
@@ -138,6 +146,10 @@ public final class PClass extends Member implements Value {
     return getDisplayName();
   }
 
+  public boolean isSubclassOf(PClass other) {
+    return this == other || getSuperclass() != null && getSuperclass().isSubclassOf(other);
+  }
+
   public abstract static class ClassMember extends Member {
     @Serial private static final long serialVersionUID = 0L;
 

pkl-core/src/main/java/org/pkl/core/PClassInfo.java

@@ -39,6 +39,7 @@ public final class PClassInfo<T> implements Serializable {
   public static final URI pklSemverUri = URI.create("pkl:semver");
   public static final URI pklSettingsUri = URI.create("pkl:settings");
   public static final URI pklProjectUri = URI.create("pkl:Project");
+  public static final URI pklRefUri = URI.create("pkl:ref");
 
   public static final PClassInfo<Void> Any = pklBaseClassInfo("Any", Void.class);
   public static final PClassInfo<PNull> Null = pklBaseClassInfo("Null", PNull.class);
@@ -82,9 +83,11 @@ public final class PClassInfo<T> implements Serializable {
   public static final PClassInfo<PObject> Version =
       new PClassInfo<>("pkl.semver", "Version", PObject.class, pklSemverUri);
   public static final PClassInfo<PObject> Project =
-      new PClassInfo<>("pkl.Project", "ModuleClass", PObject.class, pklProjectUri);
+      new PClassInfo<>("pkl.Project", MODULE_CLASS_NAME, PObject.class, pklProjectUri);
   public static final PClassInfo<PObject> Settings =
-      new PClassInfo<>("pkl.settings", "ModuleClass", PObject.class, pklSettingsUri);
+      new PClassInfo<>("pkl.settings", MODULE_CLASS_NAME, PObject.class, pklSettingsUri);
+  public static final PClassInfo<Reference> Reference =
+      new PClassInfo<>("pkl.ref", "Reference", Reference.class, pklRefUri);
 
   public static final PClassInfo<Object> Unavailable =
       new PClassInfo<>("unavailable", "unavailable", Object.class, URI.create("pkl:unavailable"));

pkl-core/src/main/java/org/pkl/core/PType.java

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -18,6 +18,7 @@ package org.pkl.core;
 import java.io.Serial;
 import java.io.Serializable;
 import java.util.*;
+import java.util.stream.Collectors;
 
 /** A Pkl type as used in type annotations. */
 public abstract class PType implements Serializable {
@@ -27,18 +28,33 @@ public abstract class PType implements Serializable {
   public static final PType UNKNOWN =
       new PType() {
         @Serial private static final long serialVersionUID = 0L;
+
+        @Override
+        public String toString() {
+          return "unknown";
+        }
       };
 
   /** The bottom type. */
   public static final PType NOTHING =
       new PType() {
         @Serial private static final long serialVersionUID = 0L;
+
+        @Override
+        public String toString() {
+          return "nothing";
+        }
       };
 
   /** The type of the enclosing module. */
   public static final PType MODULE =
       new PType() {
         @Serial private static final long serialVersionUID = 0L;
+
+        @Override
+        public String toString() {
+          return "module";
+        }
       };
 
   private PType() {}
@@ -59,6 +75,22 @@ public abstract class PType implements Serializable {
     public String getLiteral() {
       return literal;
     }
+
+    @Override
+    public String toString() {
+      return ValueFormatter.basic().formatStringValue(literal, "");
+    }
+
+    @Override
+    public boolean equals(@org.jspecify.annotations.Nullable Object obj) {
+      if (obj == this) return true;
+      return obj instanceof StringLiteral that && literal.equals(that.literal);
+    }
+
+    @Override
+    public int hashCode() {
+      return literal.hashCode();
+    }
   }
 
   public static final class Class extends PType {
@@ -92,6 +124,31 @@ public abstract class PType implements Serializable {
     public List<PType> getTypeArguments() {
       return typeArguments;
     }
+
+    @Override
+    public String toString() {
+      var result = pClass.getDisplayName();
+      if (!typeArguments.isEmpty()) {
+        result +=
+            "<"
+                + typeArguments.stream().map(Object::toString).collect(Collectors.joining(", "))
+                + ">";
+      }
+      return result;
+    }
+
+    @Override
+    public boolean equals(@org.jspecify.annotations.Nullable Object obj) {
+      if (obj == this) return true;
+      return obj instanceof Class that
+          && pClass.equals(that.pClass)
+          && typeArguments.equals(that.typeArguments);
+    }
+
+    @Override
+    public int hashCode() {
+      return 31 * pClass.hashCode() + typeArguments.hashCode();
+    }
   }
 
   public static final class Nullable extends PType {
@@ -106,6 +163,24 @@ public abstract class PType implements Serializable {
     public PType getBaseType() {
       return baseType;
     }
+
+    @Override
+    public String toString() {
+      return baseType instanceof Function || baseType instanceof Union
+          ? "(" + baseType + ")?"
+          : baseType + "?";
+    }
+
+    @Override
+    public boolean equals(@org.jspecify.annotations.Nullable Object obj) {
+      if (obj == this) return true;
+      return obj instanceof Nullable that && baseType.equals(that.baseType);
+    }
+
+    @Override
+    public int hashCode() {
+      return baseType.hashCode();
+    }
   }
 
   public static final class Constrained extends PType {
@@ -126,6 +201,29 @@ public abstract class PType implements Serializable {
     public List<String> getConstraints() {
       return constraints;
     }
+
+    @Override
+    public String toString() {
+      return (baseType instanceof Function || baseType instanceof Union
+              ? "(" + baseType + ")"
+              : baseType)
+          + "("
+          + String.join(", ", constraints)
+          + ")";
+    }
+
+    @Override
+    public boolean equals(@org.jspecify.annotations.Nullable Object obj) {
+      if (obj == this) return true;
+      return obj instanceof Constrained that
+          && baseType.equals(that.baseType)
+          && constraints.equals(that.constraints);
+    }
+
+    @Override
+    public int hashCode() {
+      return 31 * baseType.hashCode() + constraints.hashCode();
+    }
   }
 
   public static final class Alias extends PType {
@@ -161,6 +259,31 @@ public abstract class PType implements Serializable {
     public PType getAliasedType() {
       return aliasedType;
     }
+
+    @Override
+    public String toString() {
+      var result = typeAlias.getDisplayName();
+      if (!typeArguments.isEmpty()) {
+        result +=
+            "<"
+                + typeArguments.stream().map(Object::toString).collect(Collectors.joining(", "))
+                + ">";
+      }
+      return result;
+    }
+
+    @Override
+    public boolean equals(@org.jspecify.annotations.Nullable Object obj) {
+      if (obj == this) return true;
+      return obj instanceof Alias that
+          && typeAlias.equals(that.typeAlias)
+          && typeArguments.equals(that.typeArguments);
+    }
+
+    @Override
+    public int hashCode() {
+      return 31 * typeAlias.hashCode() + typeArguments.hashCode();
+    }
   }
 
   public static final class Function extends PType {
@@ -181,6 +304,27 @@ public abstract class PType implements Serializable {
     public PType getReturnType() {
       return returnType;
     }
+
+    @Override
+    public String toString() {
+      return "("
+          + parameterTypes.stream().map(Object::toString).collect(Collectors.joining(", "))
+          + ") -> "
+          + returnType;
+    }
+
+    @Override
+    public boolean equals(@org.jspecify.annotations.Nullable Object obj) {
+      if (obj == this) return true;
+      return obj instanceof Function that
+          && parameterTypes.equals(that.parameterTypes)
+          && returnType.equals(that.returnType);
+    }
+
+    @Override
+    public int hashCode() {
+      return 31 * parameterTypes.hashCode() + returnType.hashCode();
+    }
   }
 
   public static final class Union extends PType {
@@ -195,6 +339,22 @@ public abstract class PType implements Serializable {
     public List<PType> getElementTypes() {
       return elementTypes;
     }
+
+    @Override
+    public String toString() {
+      return elementTypes.stream().map(Object::toString).collect(Collectors.joining(" | "));
+    }
+
+    @Override
+    public boolean equals(@org.jspecify.annotations.Nullable Object obj) {
+      if (obj == this) return true;
+      return obj instanceof Union that && elementTypes.equals(that.elementTypes);
+    }
+
+    @Override
+    public int hashCode() {
+      return elementTypes.hashCode();
+    }
   }
 
   public static final class TypeVariable extends PType {
@@ -213,5 +373,21 @@ public abstract class PType implements Serializable {
     public TypeParameter getTypeParameter() {
       return typeParameter;
     }
+
+    @Override
+    public String toString() {
+      return typeParameter.getName();
+    }
+
+    @Override
+    public boolean equals(@org.jspecify.annotations.Nullable Object obj) {
+      if (obj == this) return true;
+      return obj instanceof TypeVariable that && typeParameter.equals(that.typeParameter);
+    }
+
+    @Override
+    public int hashCode() {
+      return typeParameter.hashCode();
+    }
   }
 }

pkl-core/src/main/java/org/pkl/core/PcfRenderer.java

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024-2025 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -227,9 +227,7 @@ final class PcfRenderer implements ValueRenderer {
             write(currIndent);
             writeIdentifier(name);
 
-            if (value == null) { // unevaluated property
+            if (value instanceof Composite) {
-              write(" = ?");
-            } else if (value instanceof Composite) {
               write(' ');
               visit(value);
             } else {

pkl-core/src/main/java/org/pkl/core/PklBinaryDecoder.java

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2025 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2025-2026 Apple Inc. and the Pkl project authors. All rights reserved.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -21,7 +21,9 @@ import java.io.UncheckedIOException;
 import java.net.URI;
 import java.util.ArrayList;
 import java.util.List;
+import java.util.Map;
 import java.util.regex.Pattern;
+import org.jspecify.annotations.Nullable;
 import org.msgpack.core.MessagePack;
 import org.msgpack.core.MessageUnpacker;
 import org.pkl.core.runtime.BaseModule;
@@ -111,7 +113,7 @@ public class PklBinaryDecoder extends AbstractPklBinaryDecoder {
 
   @Override
   protected Object doDecodeMap(MapDecodeIterator iter) {
-    var map = CollectionUtils.newLinkedHashMap(iter.getSize());
+    Map<@Nullable Object, @Nullable Object> map = CollectionUtils.newLinkedHashMap(iter.getSize());
     while (iter.hasNext()) {
       var entry = iter.next();
       map.put(entry.getFirst(), entry.getSecond());

pkl-core/src/main/java/org/pkl/core/PropertiesRenderer.java

@@ -54,6 +54,9 @@ final class PropertiesRenderer implements ValueRenderer {
       } else if (value instanceof Map<?, ?> map) {
         doVisitMap(null, map);
       } else if (value instanceof Pair<?, ?> pair) {
+        // Pair coming from the runtime can never admit null (in-language null is represented as
+        // PNull)
+        //noinspection DataFlowIssue
         doVisitKeyAndValue(null, pair.getFirst(), pair.getSecond());
       } else {
         throw new RendererException(
@@ -177,6 +180,13 @@ final class PropertiesRenderer implements ValueRenderer {
               "Values of type `Regex` cannot be rendered as Properties. Value: %s", value));
     }
 
+    @Override
+    public String convertReference(Reference value) {
+      throw new RendererException(
+          String.format(
+              "Values of type `Reference` cannot be rendered as Properties. Value: %s", value));
+    }
+
     private void doVisitMap(@Nullable String keyPrefix, Map<?, ?> map) {
       for (Map.Entry<?, ?> entry : map.entrySet()) {
         doVisitKeyAndValue(keyPrefix, entry.getKey(), entry.getValue());

pkl-core/src/main/java/org/pkl/core/Reference.java

@@ -0,0 +1,101 @@
+/*
+ * Copyright © 2026 Apple Inc. and the Pkl project authors. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.pkl.core;
+
+import java.io.Serial;
+import java.util.List;
+
+public class Reference implements Value {
+  @Serial private static final long serialVersionUID = 0L;
+
+  private final Composite domain;
+  private final Object data;
+  private final List<Composite> path;
+  private final PType referentType;
+
+  /** Constructs a reference. */
+  public Reference(Composite domain, Object data, List<Composite> path, PType referentType) {
+    this.domain = domain;
+    this.data = data;
+    this.path = path;
+    this.referentType = referentType;
+  }
+
+  /** Returns the domain object of this reference. */
+  public Composite getDomain() {
+    return domain;
+  }
+
+  /** Returns the data object of this reference. */
+  public Object getData() {
+    return data;
+  }
+
+  /**
+   * Returns the access path of this reference.
+   *
+   * <p>All elements are exported {@code pkl.ref#Access} instances.
+   */
+  public List<Composite> getPath() {
+    return path;
+  }
+
+  /** Returns the referent type of this reference. */
+  public PType getReferentType() {
+    return referentType;
+  }
+
+  @Override
+  public void accept(ValueVisitor visitor) {
+    visitor.visitReference(this);
+  }
+
+  @Override
+  public <T> T accept(ValueConverter<T> converter) {
+    return converter.convertReference(this);
+  }
+
+  @Override
+  public final boolean equals(Object o) {
+    if (!(o instanceof Reference reference)) {
+      return false;
+    }
+
+    return domain.equals(reference.domain)
+        && data.equals(reference.data)
+        && path.equals(reference.path)
+        && referentType.equals(reference.referentType);
+  }
+
+  @Override
+  public PClassInfo<?> getClassInfo() {
+    return PClassInfo.Reference;
+  }
+
+  @Override
+  public int hashCode() {
+    int result = domain.hashCode();
+    result = 31 * result + data.hashCode();
+    result = 31 * result + path.hashCode();
+    result = 31 * result + referentType.hashCode();
+    return result;
+  }
+
+  @Override
+  public String toString() {
+    return super.toString();
+  }
+}

pkl-core/src/main/java/org/pkl/core/TypeAlias.java

@@ -28,6 +28,7 @@ public final class TypeAlias extends Member implements Value {
   private final String moduleName;
   private final String qualifiedName;
   private final List<TypeParameter> typeParameters;
+  private final PClass moduleClass;
 
   @LateInit private PType aliasedType;
 
@@ -39,11 +40,13 @@ public final class TypeAlias extends Member implements Value {
       String simpleName,
       String moduleName,
       String qualifiedName,
-      List<TypeParameter> typeParameters) {
+      List<TypeParameter> typeParameters,
+      PClass moduleClass) {
     super(docComment, sourceLocation, modifiers, annotations, simpleName);
     this.moduleName = moduleName;
     this.qualifiedName = qualifiedName;
     this.typeParameters = typeParameters;
+    this.moduleClass = moduleClass;
   }
 
   public void initAliasedType(PType type) {
@@ -79,6 +82,10 @@ public final class TypeAlias extends Member implements Value {
     return typeParameters;
   }
 
+  public PClass getModuleClass() {
+    return moduleClass;
+  }
+
   /** Returns the type that this type alias stands for. */
   public PType getAliasedType() {
     //noinspection ConstantValue

pkl-core/src/main/java/org/pkl/core/TypeParameter.java

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -17,7 +17,7 @@ package org.pkl.core;
 
 import java.io.Serial;
 import java.io.Serializable;
-import org.pkl.core.util.LateInit;
+import org.jspecify.annotations.Nullable;
 
 /** A type parameter of a generic class, type alias, or method. */
 public final class TypeParameter implements Serializable {
@@ -27,7 +27,7 @@ public final class TypeParameter implements Serializable {
   private final String name;
   private final int index;
 
-  @LateInit private volatile Member owner;
+  private volatile @Nullable Member owner;
 
   public TypeParameter(Variance variance, String name, int index) {
     this.variance = variance;
@@ -48,6 +48,7 @@ public final class TypeParameter implements Serializable {
   /** Returns the generic class, type alias, or method that this type parameter belongs to. */
   public Member getOwner() {
     assert owner != null;
+    //noinspection DataFlowIssue
     return owner;
   }
 

pkl-core/src/main/java/org/pkl/core/ValueConverter.java

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024-2025 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -57,6 +57,8 @@ public interface ValueConverter<T> {
 
   T convertRegex(Pattern value);
 
+  T convertReference(Reference value);
+
   default T convert(Object value) {
     if (value instanceof Value v) {
       return (v.accept(this));

pkl-core/src/main/java/org/pkl/core/ValueVisitor.java

@@ -93,6 +93,10 @@ public interface ValueVisitor {
     visitDefault(value);
   }
 
+  default void visitReference(Reference value) {
+    visitDefault(value);
+  }
+
   default void visit(Object value) {
     if (value instanceof Value v) {
       v.accept(this);

pkl-core/src/main/java/org/pkl/core/Version.java

@@ -18,7 +18,6 @@ package org.pkl.core;
 import java.util.*;
 import java.util.regex.*;
 import org.jspecify.annotations.Nullable;
-import org.pkl.core.util.LateInit;
 
 /**
  * A <a href="https://semver.org/spec/v2.0.0.html">semantic version</a>.
@@ -59,7 +58,7 @@ public final class Version implements Comparable<Version> {
   private final @Nullable String preRelease;
   private final @Nullable String build;
 
-  @LateInit private volatile Identifier[] __preReleaseIdentifiers;
+  private volatile Identifier @Nullable [] __preReleaseIdentifiers;
 
   /** Constructs a semantic version. */
   public Version(
@@ -230,6 +229,7 @@ public final class Version implements Comparable<Version> {
                               : new Identifier(-1, str))
                   .toArray(Identifier[]::new);
     }
+    //noinspection DataFlowIssue
     return __preReleaseIdentifiers;
   }
 

pkl-core/src/main/java/org/pkl/core/ast/builder/AstBuilder.java

@@ -724,7 +724,7 @@ public class AstBuilder extends AbstractAstBuilder<Object> {
       //     elem
       //   }
       // }
-      return p.levelsUp() == 0
+      return p.levelsUp() == 0 && !p.needsFrameSkip()
           ? ReadExactFrameSlotNodeGen.create(sourceSection, p.slot())
           : ReadFrameSlotNodeGen.create(
               sourceSection, p.slot(), new GetEnclosingFrameNode(p.levelsUp()));
@@ -1476,8 +1476,6 @@ public class AstBuilder extends AbstractAstBuilder<Object> {
     var scope = (ModuleScope) symbolTable.getCurrentScope();
     scope.setModifiers(modifiers);
 
-    checkAbstractMembersAllowed(modifiers, mod.getProperties(), mod.getMethods());
-
     // visit imports first so that we already have the object member name available
     var imports = mod.getImports();
     var importMembers = new ObjectMember[imports.size()];
@@ -1722,7 +1720,6 @@ public class AstBuilder extends AbstractAstBuilder<Object> {
           List<ClassProperty> properties = bodyNode != null ? bodyNode.getProperties() : List.of();
           List<ClassMethod> methods = bodyNode != null ? bodyNode.getMethods() : List.of();
           registerClassScopeNames(scope, properties, methods);
-          checkAbstractMembersAllowed(modifiers, properties, methods);
 
           var supertypeCtx = clazz.getSuperClass();
 
@@ -1813,30 +1810,6 @@ public class AstBuilder extends AbstractAstBuilder<Object> {
     };
   }
 
-  private void checkAbstractMembersAllowed(
-      int enclosingModifiers, List<ClassProperty> properties, List<ClassMethod> methods) {
-    if (VmModifier.isAbstract(enclosingModifiers)) {
-      return;
-    }
-    for (var property : properties) {
-      checkMemberNotAbstract(property.getModifiers());
-    }
-    for (var method : methods) {
-      checkMemberNotAbstract(method.getModifiers());
-    }
-  }
-
-  private void checkMemberNotAbstract(List<Modifier> modifiers) {
-    for (var modifier : modifiers) {
-      if (modifier.getValue() == ModifierValue.ABSTRACT) {
-        throw exceptionBuilder()
-            .evalError("abstractMemberInNonAbstractClass")
-            .withSourceSection(createSourceSection(modifier.span()))
-            .build();
-      }
-    }
-  }
-
   private UnresolvedPropertyNode[] doVisitClassProperties(
       List<ClassProperty> propertyContexts, Set<String> propertyNames) {
     var propertyNodes = new UnresolvedPropertyNode[propertyContexts.size()];

pkl-core/src/main/java/org/pkl/core/ast/builder/SymbolTable.java

@@ -509,6 +509,7 @@ public final class SymbolTable {
     private @Nullable <R> R resolveLexical(ResolutionFunction<R> fun) {
       var levelsUp = 0;
       var shouldSkip = false;
+      var skippedObjectScope = false;
       for (var scope = this; scope != null; scope = scope.getParent()) {
         // for headers resolve variables one scope up
         if (scope instanceof EagerGeneratorScope) {
@@ -524,11 +525,24 @@ public final class SymbolTable {
             if (scope instanceof ObjectScope objectScope && objectScope.hasParams()) {
               levelsUp++;
             }
+            // An EagerGeneratorScope (for `when` predicates) skipped an ObjectScope.
+            // The ObjectScope may become a parse-time-invisible amend function at runtime,
+            // so for-gen variables at levelsUp == 0 need ReadFrameSlotNode
+            // (which calls skipInvisibleScopes) rather than ReadExactFrameSlotNode.
+            if (scope instanceof ObjectScope) {
+              skippedObjectScope = true;
+            }
             shouldSkip = false;
             continue;
           }
           var result = fun.apply(lex, levelsUp);
-          if (result != null) return result;
+          if (result != null) {
+            if (result instanceof ForGeneratorVariableOrLetBinding p && skippedObjectScope) {
+              //noinspection unchecked
+              return (R) new ForGeneratorVariableOrLetBinding(p.slot(), p.levelsUp(), true);
+            }
+            return result;
+          }
           if (scope instanceof MethodScope
               || scope instanceof ForGeneratorScope
               || scope instanceof LetExpressionScope) {
@@ -798,7 +812,7 @@ public final class SymbolTable {
         return null;
       }
       if (name.equals(binding.name())) {
-        return new ForGeneratorVariableOrLetBinding(binding.slot(), levelsUp);
+        return new ForGeneratorVariableOrLetBinding(binding.slot(), levelsUp, false);
       }
       return null;
     }
@@ -910,10 +924,10 @@ public final class SymbolTable {
     @Override
     public @Nullable VariableResolution doResolveProperty(String name, int levelsUp) {
       if (keyBinding != null && keyBinding.name().equals(name)) {
-        return new ForGeneratorVariableOrLetBinding(keyBinding.slot(), levelsUp);
+        return new ForGeneratorVariableOrLetBinding(keyBinding.slot(), levelsUp, false);
       }
       if (valueBinding != null && valueBinding.name().equals(name)) {
-        return new ForGeneratorVariableOrLetBinding(valueBinding.slot(), levelsUp);
+        return new ForGeneratorVariableOrLetBinding(valueBinding.slot(), levelsUp, false);
       }
       return null;
     }

pkl-core/src/main/java/org/pkl/core/ast/builder/VariableResolution.java

@@ -34,7 +34,8 @@ public sealed interface VariableResolution {
   // method, lambda, object body param
   record Parameter(int slot, int levelsUp) implements VariableResolution {}
 
-  record ForGeneratorVariableOrLetBinding(int slot, int levelsUp) implements VariableResolution {}
+  record ForGeneratorVariableOrLetBinding(int slot, int levelsUp, boolean needsFrameSkip)
+      implements VariableResolution {}
 
   // Implicit base module lookup
   record ImplicitBaseProperty() implements VariableResolution {}

pkl-core/src/main/java/org/pkl/core/ast/expression/binary/SubscriptNode.java

@@ -100,6 +100,20 @@ public abstract class SubscriptNode extends BinaryExpressionNode {
     return readMember(dynamic, key, callNode);
   }
 
+  @Specialization
+  protected VmReference eval(VmReference reference, Object key) {
+    var result = reference.withSubscriptAccess(key);
+    if (result != null) return result;
+
+    CompilerDirectives.transferToInterpreter();
+    throw exceptionBuilder()
+        .evalError(
+            "operatorNotDefined2", getShortName(), reference.exportType(), VmUtils.getClass(key))
+        .withProgramValue("Left operand", reference)
+        .withProgramValue("Right operand", key)
+        .build();
+  }
+
   @Specialization
   protected long eval(VmBytes receiver, long index) {
     if (index < 0 || index >= receiver.getLength()) {

pkl-core/src/main/java/org/pkl/core/ast/expression/literal/BytesLiteralNode.java

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2025 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2025-2026 Apple Inc. and the Pkl project authors. All rights reserved.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -20,19 +20,19 @@ import com.oracle.truffle.api.frame.VirtualFrame;
 import com.oracle.truffle.api.nodes.ExplodeLoop;
 import com.oracle.truffle.api.nodes.NodeInfo;
 import com.oracle.truffle.api.source.SourceSection;
+import org.jspecify.annotations.Nullable;
 import org.pkl.core.ast.ExpressionNode;
 import org.pkl.core.ast.type.TypeNode;
 import org.pkl.core.ast.type.TypeNode.UInt8TypeAliasTypeNode;
 import org.pkl.core.ast.type.VmTypeMismatchException;
 import org.pkl.core.runtime.VmBytes;
 import org.pkl.core.runtime.VmUtils;
-import org.pkl.core.util.LateInit;
 
 @NodeInfo(shortName = "Bytes()")
 public final class BytesLiteralNode extends ExpressionNode {
   @Children private final ExpressionNode[] elements;
 
-  @Child @LateInit private TypeNode typeNode;
+  @Child private @Nullable TypeNode typeNode;
 
   public BytesLiteralNode(SourceSection sourceSection, ExpressionNode[] elements) {
     super(sourceSection);

pkl-core/src/main/java/org/pkl/core/ast/expression/member/AbstractInvokeMethodLexicalNode.java

@@ -22,6 +22,7 @@ import com.oracle.truffle.api.frame.VirtualFrame;
 import com.oracle.truffle.api.nodes.DirectCallNode;
 import com.oracle.truffle.api.nodes.ExplodeLoop;
 import com.oracle.truffle.api.source.SourceSection;
+import org.jspecify.annotations.Nullable;
 import org.pkl.core.ast.ExpressionNode;
 import org.pkl.core.runtime.Identifier;
 import org.pkl.core.runtime.VmObjectLike;
@@ -34,7 +35,7 @@ public abstract sealed class AbstractInvokeMethodLexicalNode extends ExpressionN
   protected final int levelsUp;
   private final boolean needsConst;
   @Children private ExpressionNode[] argumentNodes;
-  @Child private DirectCallNode callNode;
+  @Child private @Nullable DirectCallNode callNode;
   @CompilationFinal protected boolean isConstChecked;
 
   protected AbstractInvokeMethodLexicalNode(
@@ -90,6 +91,7 @@ public abstract sealed class AbstractInvokeMethodLexicalNode extends ExpressionN
       callNode = DirectCallNode.create(getCallTarget(owner));
       insert(callNode);
     }
+    assert callNode != null;
     return callNode;
   }
 }

pkl-core/src/main/java/org/pkl/core/ast/expression/member/InferParentWithinMethodNode.java

@@ -19,17 +19,17 @@ import com.oracle.truffle.api.CompilerDirectives;
 import com.oracle.truffle.api.CompilerDirectives.CompilationFinal;
 import com.oracle.truffle.api.frame.VirtualFrame;
 import com.oracle.truffle.api.source.SourceSection;
+import org.jspecify.annotations.Nullable;
 import org.pkl.core.ast.ExpressionNode;
 import org.pkl.core.ast.type.TypeNode.UnknownTypeNode;
 import org.pkl.core.runtime.*;
-import org.pkl.core.util.LateInit;
 
 /** Infers the parent to amend in `function createPerson(): Person = new { ... }`. */
 public final class InferParentWithinMethodNode extends ExpressionNode {
   private final VmLanguage language;
   private final Identifier methodName;
-  @Child private ExpressionNode ownerNode;
+  @Child private @Nullable ExpressionNode ownerNode;
-  @CompilationFinal @LateInit private Object inferredParent;
+  @CompilationFinal private @Nullable Object inferredParent;
 
   public InferParentWithinMethodNode(
       SourceSection sourceSection,
@@ -52,6 +52,7 @@ public final class InferParentWithinMethodNode extends ExpressionNode {
 
     CompilerDirectives.transferToInterpreter();
 
+    assert ownerNode != null;
     var owner = (VmObjectLike) ownerNode.executeGeneric(frame);
     assert owner.isPrototype();
 

pkl-core/src/main/java/org/pkl/core/ast/expression/member/InferParentWithinObjectMethodNode.java

@@ -19,6 +19,7 @@ import com.oracle.truffle.api.CompilerDirectives;
 import com.oracle.truffle.api.CompilerDirectives.CompilationFinal;
 import com.oracle.truffle.api.frame.VirtualFrame;
 import com.oracle.truffle.api.source.SourceSection;
+import org.jspecify.annotations.Nullable;
 import org.pkl.core.ast.ExpressionNode;
 import org.pkl.core.ast.member.ObjectMethodNode;
 import org.pkl.core.ast.type.TypeNode.UnknownTypeNode;
@@ -26,14 +27,13 @@ import org.pkl.core.runtime.Identifier;
 import org.pkl.core.runtime.VmDynamic;
 import org.pkl.core.runtime.VmLanguage;
 import org.pkl.core.runtime.VmObjectLike;
-import org.pkl.core.util.LateInit;
 
 /** Infers the parent to amend in `obj { local function createPerson(): Person = new { ... } }`. */
 public final class InferParentWithinObjectMethodNode extends ExpressionNode {
   private final VmLanguage language;
   private final Identifier localMethodName;
-  @Child private ExpressionNode ownerNode;
+  @Child private @Nullable ExpressionNode ownerNode;
-  @CompilationFinal @LateInit private Object inferredParent;
+  @CompilationFinal private @Nullable Object inferredParent;
 
   public InferParentWithinObjectMethodNode(
       SourceSection sourceSection,
@@ -58,6 +58,7 @@ public final class InferParentWithinObjectMethodNode extends ExpressionNode {
 
     CompilerDirectives.transferToInterpreter();
 
+    assert ownerNode != null;
     var owner = (VmObjectLike) ownerNode.executeGeneric(frame);
 
     var member = owner.getMember(localMethodName);

pkl-core/src/main/java/org/pkl/core/ast/expression/member/ReadAmbiguousLocalityPropertyNode.java

@@ -18,6 +18,7 @@ package org.pkl.core.ast.expression.member;
 import com.oracle.truffle.api.CompilerDirectives;
 import com.oracle.truffle.api.frame.VirtualFrame;
 import com.oracle.truffle.api.source.SourceSection;
+import org.jspecify.annotations.Nullable;
 import org.pkl.core.ast.ExpressionNode;
 import org.pkl.core.ast.MemberLookupMode;
 import org.pkl.core.ast.expression.primary.GetEnclosingReceiverNode;
@@ -49,8 +50,8 @@ public final class ReadAmbiguousLocalityPropertyNode extends ExpressionNode {
   private final Identifier name;
   private final int levelsUp;
   private final boolean needsConst;
-  private @Child ExpressionNode readLocalPropertyNode;
+  @Child private @Nullable ExpressionNode readLocalPropertyNode;
-  private @Child ExpressionNode readPropertyNode;
+  @Child private @Nullable ExpressionNode readPropertyNode;
 
   public ReadAmbiguousLocalityPropertyNode(
       SourceSection sourceSection, Identifier name, int levelsUp, boolean needsConst) {

pkl-core/src/main/java/org/pkl/core/ast/expression/member/ReadLocalPropertyNode.java

@@ -22,6 +22,7 @@ import com.oracle.truffle.api.frame.VirtualFrame;
 import com.oracle.truffle.api.nodes.DirectCallNode;
 import com.oracle.truffle.api.nodes.ExplodeLoop;
 import com.oracle.truffle.api.source.SourceSection;
+import org.jspecify.annotations.Nullable;
 import org.pkl.core.PklBugException;
 import org.pkl.core.ast.ExpressionNode;
 import org.pkl.core.ast.member.ObjectMember;
@@ -34,8 +35,8 @@ public final class ReadLocalPropertyNode extends ExpressionNode {
   private final Identifier name;
   private final int levelsUp;
   private final boolean needsConst;
-  @Child private DirectCallNode callNode;
+  @Child private @Nullable DirectCallNode callNode;
-  @CompilationFinal private ObjectMember property;
+  @CompilationFinal @Nullable private ObjectMember property;
 
   public ReadLocalPropertyNode(
       SourceSection sourceSection, Identifier name, int levelsUp, boolean needsConst) {
@@ -91,6 +92,7 @@ public final class ReadLocalPropertyNode extends ExpressionNode {
       callNode = DirectCallNode.create(property.getCallTarget());
       insert(callNode);
     }
+    assert callNode != null;
     return callNode;
   }
 }

pkl-core/src/main/java/org/pkl/core/ast/expression/member/ReadPropertyNode.java

@@ -61,6 +61,18 @@ public abstract class ReadPropertyNode extends ExpressionNode {
     this(sourceSection, propertyName, MemberLookupMode.EXPLICIT_RECEIVER, false);
   }
 
+  @Specialization
+  protected VmReference evalReference(VmReference receiver) {
+    assert lookupMode == MemberLookupMode.EXPLICIT_RECEIVER;
+    var result = receiver.withPropertyAccess(propertyName);
+    if (result != null) return result;
+
+    CompilerDirectives.transferToInterpreter();
+    throw exceptionBuilder()
+        .evalError("cannotFindPropertyInReference", propertyName, receiver.exportType())
+        .build();
+  }
+
   // This method effectively covers `VmObject receiver` but is implemented in a more
   // efficient way. See:
   // https://www.graalvm.org/22.0/graalvm-as-a-platform/language-implementation-framework/TruffleLibraries/#strategy-2-java-interfaces

pkl-core/src/main/java/org/pkl/core/ast/expression/unary/ImportGlobNode.java

@@ -23,6 +23,7 @@ import com.oracle.truffle.api.nodes.NodeInfo;
 import com.oracle.truffle.api.source.SourceSection;
 import java.io.IOException;
 import java.net.URI;
+import org.jspecify.annotations.Nullable;
 import org.pkl.core.SecurityManagerException;
 import org.pkl.core.ast.member.SharedMemberNode;
 import org.pkl.core.externalreader.ExternalReaderProcessException;
@@ -35,13 +36,12 @@ import org.pkl.core.runtime.VmMapping;
 import org.pkl.core.runtime.VmObjectBuilder;
 import org.pkl.core.util.GlobResolver;
 import org.pkl.core.util.GlobResolver.InvalidGlobPatternException;
-import org.pkl.core.util.LateInit;
 
 @NodeInfo(shortName = "import*")
 public class ImportGlobNode extends AbstractImportNode {
   private final String globPattern;
-  @Child @LateInit private SharedMemberNode memberNode;
+  @Child private @Nullable SharedMemberNode memberNode;
-  @CompilationFinal @LateInit private VmMapping cachedResult;
+  @CompilationFinal private @Nullable VmMapping cachedResult;
 
   public ImportGlobNode(
       SourceSection sourceSection,

pkl-core/src/main/java/org/pkl/core/ast/expression/unary/ImportNode.java

@@ -21,6 +21,7 @@ import com.oracle.truffle.api.frame.VirtualFrame;
 import com.oracle.truffle.api.nodes.NodeInfo;
 import com.oracle.truffle.api.source.SourceSection;
 import java.net.URI;
+import org.jspecify.annotations.Nullable;
 import org.pkl.core.SecurityManagerException;
 import org.pkl.core.http.HttpClientException;
 import org.pkl.core.module.ResolvedModuleKey;
@@ -28,13 +29,12 @@ import org.pkl.core.packages.PackageLoadError;
 import org.pkl.core.runtime.VmContext;
 import org.pkl.core.runtime.VmLanguage;
 import org.pkl.core.runtime.VmTyped;
-import org.pkl.core.util.LateInit;
 
 @NodeInfo(shortName = "import")
 public final class ImportNode extends AbstractImportNode {
   private final VmLanguage language;
 
-  @CompilationFinal @LateInit private VmTyped importedModule;
+  @CompilationFinal private @Nullable VmTyped importedModule;
 
   public ImportNode(
       VmLanguage language,

pkl-core/src/main/java/org/pkl/core/ast/expression/unary/ReadGlobNode.java

@@ -24,6 +24,7 @@ import com.oracle.truffle.api.source.SourceSection;
 import java.io.IOException;
 import java.net.URISyntaxException;
 import org.graalvm.collections.EconomicMap;
+import org.jspecify.annotations.Nullable;
 import org.pkl.core.SecurityManagerException;
 import org.pkl.core.ast.member.SharedMemberNode;
 import org.pkl.core.externalreader.ExternalReaderProcessException;
@@ -36,12 +37,11 @@ import org.pkl.core.runtime.VmObjectBuilder;
 import org.pkl.core.util.GlobResolver;
 import org.pkl.core.util.GlobResolver.InvalidGlobPatternException;
 import org.pkl.core.util.IoUtils;
-import org.pkl.core.util.LateInit;
 
 @NodeInfo(shortName = "read*")
 public abstract class ReadGlobNode extends AbstractReadNode {
   private final EconomicMap<String, VmMapping> cachedResults = EconomicMap.create();
-  @Child @LateInit private SharedMemberNode memberNode;
+  @Child private @Nullable SharedMemberNode memberNode;
 
   protected ReadGlobNode(SourceSection sourceSection, ModuleKey currentModule) {
     super(sourceSection, currentModule);
@@ -67,6 +67,7 @@ public abstract class ReadGlobNode extends AbstractReadNode {
   @TruffleBoundary
   public Object read(String globPattern) {
     var cachedResult = cachedResults.get(globPattern);
+    //noinspection ConstantValue
     if (cachedResult != null) return cachedResult;
 
     // use same check as for globbed imports (see AstBuilder)

pkl-core/src/main/java/org/pkl/core/ast/internal/ToStringNode.java

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024-2025 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -20,6 +20,7 @@ import com.oracle.truffle.api.dsl.Cached;
 import com.oracle.truffle.api.dsl.Fallback;
 import com.oracle.truffle.api.dsl.Specialization;
 import com.oracle.truffle.api.frame.VirtualFrame;
+import com.oracle.truffle.api.nodes.DirectCallNode;
 import com.oracle.truffle.api.source.SourceSection;
 import org.pkl.core.ast.ExpressionNode;
 import org.pkl.core.ast.MemberLookupMode;
@@ -62,10 +63,18 @@ public abstract class ToStringNode extends UnaryExpressionNode {
       VmTyped value,
       @Cached(value = "createInvokeNode()", neverDefault = true)
           InvokeMethodVirtualNode invokeNode) {
-
     return (String) invokeNode.executeWith(frame, value, value.getVmClass());
   }
 
+  @Specialization
+  protected String evalReference(
+      VirtualFrame frame,
+      VmReference value,
+      @Cached(value = "createReferenceCallNode(value)", neverDefault = true)
+          DirectCallNode callNode) {
+    return (String) callNode.call(value, value.getVmClass().getPrototype());
+  }
+
   @Fallback
   @Override
   @TruffleBoundary
@@ -74,7 +83,6 @@ public abstract class ToStringNode extends UnaryExpressionNode {
   }
 
   protected InvokeMethodVirtualNode createInvokeNode() {
-    //noinspection ConstantConditions
     return InvokeMethodVirtualNodeGen.create(
         sourceSection,
         Identifier.TO_STRING,
@@ -83,4 +91,10 @@ public abstract class ToStringNode extends UnaryExpressionNode {
         null,
         null);
   }
+
+  protected DirectCallNode createReferenceCallNode(VmReference reference) {
+    var toStringMethod = reference.getVmClass().getDeclaredMethod(Identifier.TO_STRING);
+    assert toStringMethod != null;
+    return DirectCallNode.create(toStringMethod.getCallTarget());
+  }
 }

pkl-core/src/main/java/org/pkl/core/ast/member/ClassMethod.java

@@ -26,6 +26,7 @@ import org.pkl.core.TypeParameter;
 import org.pkl.core.ast.VmModifier;
 import org.pkl.core.ast.type.TypeNode;
 import org.pkl.core.runtime.*;
+import org.pkl.core.util.LateInit;
 
 public final class ClassMethod extends ClassMember {
   private final List<TypeParameter> typeParameters;
@@ -33,7 +34,7 @@ public final class ClassMethod extends ClassMember {
   // null = not deprecated, "" = no/empty message in the @Deprecated body
   private final @Nullable String deprecation;
 
-  @CompilationFinal private FunctionNode functionNode;
+  @CompilationFinal @LateInit private FunctionNode functionNode;
 
   public ClassMethod(
       SourceSection sourceSection,
@@ -61,6 +62,7 @@ public final class ClassMethod extends ClassMember {
   }
 
   public void initFunctionNode(FunctionNode functionNode) {
+    //noinspection ConstantValue
     assert this.functionNode == null;
     this.functionNode = functionNode;
   }

pkl-core/src/main/java/org/pkl/core/ast/member/ClassNode.java

@@ -84,6 +84,7 @@ public final class ClassNode extends ExpressionNode {
     // Caching of classes also guarantees that classes are singletons and can be compared by
     // identity,
     // which improves efficiency and performance (for example in shape checks).
+    //noinspection ConstantValue
     if (cachedClass != null) return cachedClass;
 
     CompilerDirectives.transferToInterpreter();

pkl-core/src/main/java/org/pkl/core/ast/member/ListingOrMappingTypeCastNode.java

@@ -18,7 +18,6 @@ package org.pkl.core.ast.member;
 import com.oracle.truffle.api.frame.FrameDescriptor;
 import com.oracle.truffle.api.frame.VirtualFrame;
 import com.oracle.truffle.api.source.SourceSection;
-import org.jspecify.annotations.Nullable;
 import org.pkl.core.ast.PklRootNode;
 import org.pkl.core.ast.type.TypeNode;
 import org.pkl.core.runtime.VmLanguage;
@@ -46,7 +45,7 @@ public final class ListingOrMappingTypeCastNode extends PklRootNode {
   }
 
   @Override
-  public @Nullable String getName() {
+  public String getName() {
     return qualifiedName;
   }
 

pkl-core/src/main/java/org/pkl/core/ast/member/LocalTypedPropertyNode.java

@@ -23,12 +23,11 @@ import org.pkl.core.ast.ExpressionNode;
 import org.pkl.core.ast.type.TypeNode;
 import org.pkl.core.ast.type.UnresolvedTypeNode;
 import org.pkl.core.runtime.VmLanguage;
-import org.pkl.core.util.LateInit;
 
 public final class LocalTypedPropertyNode extends RegularMemberNode {
   private final VmLanguage language;
-  @Child private UnresolvedTypeNode unresolvedTypeNode;
+  @Child private @Nullable UnresolvedTypeNode unresolvedTypeNode;
-  @Child @LateInit private TypeNode typeNode;
+  @Child private @Nullable TypeNode typeNode;
   private @Nullable Object defaultValue;
   private boolean defaultValueInitialized;
 
@@ -47,6 +46,7 @@ public final class LocalTypedPropertyNode extends RegularMemberNode {
 
   public @Nullable Object getDefaultValue(VirtualFrame frame) {
     if (!defaultValueInitialized) {
+      assert typeNode != null;
       defaultValue =
           typeNode.createDefaultValue(
               frame, language, member.getHeaderSection(), member.getQualifiedName());
@@ -59,6 +59,7 @@ public final class LocalTypedPropertyNode extends RegularMemberNode {
   protected Object executeImpl(VirtualFrame frame) {
     if (typeNode == null) {
       CompilerDirectives.transferToInterpreter();
+      assert unresolvedTypeNode != null;
       typeNode = insert(unresolvedTypeNode.execute(frame));
       unresolvedTypeNode = null;
     }

pkl-core/src/main/java/org/pkl/core/ast/member/ObjectMethodNode.java

@@ -25,7 +25,6 @@ import org.pkl.core.ast.ExpressionNode;
 import org.pkl.core.ast.type.TypeNode;
 import org.pkl.core.ast.type.UnresolvedTypeNode;
 import org.pkl.core.runtime.*;
-import org.pkl.core.util.LateInit;
 
 public final class ObjectMethodNode extends RegularMemberNode {
   private final VmLanguage language;
@@ -33,7 +32,7 @@ public final class ObjectMethodNode extends RegularMemberNode {
   @Children private final @Nullable UnresolvedTypeNode[] unresolvedParameterTypeNodes;
   @Child private @Nullable UnresolvedTypeNode unresolvedReturnTypeNode;
 
-  @CompilationFinal @LateInit private FunctionNode functionNode;
+  @CompilationFinal private @Nullable FunctionNode functionNode;
 
   public ObjectMethodNode(
       VmLanguage language,

pkl-core/src/main/java/org/pkl/core/ast/member/UnresolvedFunctionNode.java

@@ -31,7 +31,7 @@ public final class UnresolvedFunctionNode extends PklNode {
   private final int parameterCount;
   @Children private final @Nullable UnresolvedTypeNode[] unresolvedParameterTypeNodes;
   @Child private @Nullable UnresolvedTypeNode unresolvedReturnTypeNode;
-  private final ExpressionNode bodyNode;
+  @Child private ExpressionNode bodyNode;
 
   public UnresolvedFunctionNode(
       VmLanguage language,

pkl-core/src/main/java/org/pkl/core/ast/type/GetParentForTypeNode.java

@@ -19,6 +19,7 @@ import com.oracle.truffle.api.CompilerDirectives;
 import com.oracle.truffle.api.CompilerDirectives.CompilationFinal;
 import com.oracle.truffle.api.frame.VirtualFrame;
 import com.oracle.truffle.api.source.SourceSection;
+import org.jspecify.annotations.Nullable;
 import org.pkl.core.ast.ExpressionNode;
 import org.pkl.core.runtime.*;
 import org.pkl.core.util.LateInit;
@@ -26,7 +27,7 @@ import org.pkl.core.util.LateInit;
 /** Resolves `<type>` to the type's default value in `new <type> { ... }`. */
 public final class GetParentForTypeNode extends ExpressionNode {
   @Child private UnresolvedTypeNode unresolvedTypeNode;
-  @Child private TypeNode typeNode;
+  @Child private @Nullable TypeNode typeNode;
   private final String qualifiedName;
 
   @CompilationFinal @LateInit Object defaultValue;
@@ -49,6 +50,7 @@ public final class GetParentForTypeNode extends ExpressionNode {
 
   @Override
   public Object executeGeneric(VirtualFrame frame) {
+    //noinspection ConstantValue
     if (defaultValue != null) return defaultValue;
     CompilerDirectives.transferToInterpreterAndInvalidate();
 

pkl-core/src/main/java/org/pkl/core/ast/type/TypeCastNode.java

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -19,14 +19,14 @@ import com.oracle.truffle.api.CompilerDirectives;
 import com.oracle.truffle.api.frame.VirtualFrame;
 import com.oracle.truffle.api.nodes.NodeInfo;
 import com.oracle.truffle.api.source.SourceSection;
+import org.jspecify.annotations.Nullable;
 import org.pkl.core.ast.ExpressionNode;
-import org.pkl.core.util.LateInit;
 
 @NodeInfo(shortName = "as")
 public final class TypeCastNode extends ExpressionNode {
   @Child private ExpressionNode valueNode;
-  @Child private UnresolvedTypeNode unresolvedTypeNode;
+  @Child private @Nullable UnresolvedTypeNode unresolvedTypeNode;
-  @Child @LateInit private TypeNode typeNode;
+  @Child private @Nullable TypeNode typeNode;
 
   public TypeCastNode(
       SourceSection sourceSection,
@@ -43,6 +43,7 @@ public final class TypeCastNode extends ExpressionNode {
       // don't compile unresolvedTypeNode.execute()
       // invalidation is done by insert()
       CompilerDirectives.transferToInterpreter();
+      assert unresolvedTypeNode != null;
       typeNode = insert(unresolvedTypeNode.execute(frame));
       unresolvedTypeNode = null;
     }

pkl-core/src/main/java/org/pkl/core/ast/type/TypeNode.java

@@ -27,7 +27,10 @@ import com.oracle.truffle.api.frame.FrameSlotKind;
 import com.oracle.truffle.api.frame.VirtualFrame;
 import com.oracle.truffle.api.nodes.ExplodeLoop;
 import com.oracle.truffle.api.nodes.LoopNode;
+import com.oracle.truffle.api.nodes.Node;
+import com.oracle.truffle.api.nodes.NodeUtil;
 import com.oracle.truffle.api.source.SourceSection;
+import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.List;
 import java.util.Map;
@@ -38,6 +41,7 @@ import org.jspecify.annotations.Nullable;
 import org.pkl.core.PType;
 import org.pkl.core.PType.StringLiteral;
 import org.pkl.core.PklBugException;
+import org.pkl.core.StackFrame;
 import org.pkl.core.TypeParameter;
 import org.pkl.core.ast.*;
 import org.pkl.core.ast.builder.SymbolTable.CustomThisScope;
@@ -54,6 +58,7 @@ import org.pkl.core.util.EconomicMaps;
 import org.pkl.core.util.EconomicSets;
 import org.pkl.core.util.LateInit;
 import org.pkl.core.util.MutableBoolean;
+import org.pkl.core.util.MutableReference;
 
 public abstract class TypeNode extends PklNode {
 
@@ -234,7 +239,7 @@ public abstract class TypeNode extends PklNode {
   public abstract static class FrameSlotTypeNode extends TypeNode {
     @CompilationFinal protected int slot = -1;
 
-    @CompilationFinal @Child protected WriteFrameSlotNode writeFrameSlotNode;
+    @CompilationFinal @Child protected @Nullable WriteFrameSlotNode writeFrameSlotNode;
 
     protected FrameSlotTypeNode(SourceSection sourceSection) {
       super(sourceSection);
@@ -2127,6 +2132,130 @@ public abstract class TypeNode extends PklNode {
     }
   }
 
+  public abstract static class ReferenceTypeNode extends ValidatingObjectSlotTypeNode {
+    @Child private TypeNode domainTypeNode;
+    @Child private TypeNode referentTypeNode;
+    @Child private ExpressionNode getModuleNode;
+
+    public ReferenceTypeNode(
+        SourceSection sourceSection, TypeNode domainTypeNode, TypeNode referentTypeNode) {
+      super(sourceSection);
+      this.domainTypeNode = domainTypeNode;
+      this.referentTypeNode = referentTypeNode;
+      this.getModuleNode = new GetModuleNode(sourceSection);
+      validate();
+    }
+
+    @Override
+    public final String getValidationErrorKey() {
+      return "invalidReferenceTypeAnnotationWithConstraint";
+    }
+
+    @Override
+    protected final @Nullable Node getViolatingNode() {
+      // constraints may not be used in Reference type annotation referents
+      // walk the type and throw if any part of the referent is constrained
+      var violation = new MutableReference<Node>(null);
+      referentTypeNode.acceptTypeNode(
+          true,
+          (typeNode) -> {
+            if (typeNode instanceof ConstrainedTypeNode) {
+              violation.set(typeNode);
+              return false;
+            }
+            return true;
+          });
+      return violation.getOrNull();
+    }
+
+    @Override
+    protected final boolean isIncludedInTrace(Node node) {
+      return node instanceof ReferenceTypeNode || node instanceof ConstrainedTypeNode;
+    }
+
+    @Specialization
+    protected Object eval(VirtualFrame frame, VmReference value) {
+      if (domainTypeNode.isNoopTypeCheck() && referentTypeNode.isNoopTypeCheck()) {
+        return value;
+      }
+
+      try {
+        domainTypeNode.execute(frame, value.getDomain());
+      } catch (VmTypeMismatchException e) {
+        CompilerDirectives.transferToInterpreter();
+        throw new VmTypeMismatchException.Reference(
+            sourceSection,
+            value,
+            TypeNode.export(domainTypeNode),
+            TypeNode.export(referentTypeNode));
+      }
+
+      var module = (VmTyped) getModuleNode.executeGeneric(frame);
+      return doEval(value, module);
+    }
+
+    @TruffleBoundary
+    private Object doEval(VmReference value, VmTyped module) {
+      var referentType = TypeNode.export(referentTypeNode);
+      if (value.referentTypeIsSubtypeOf(referentType, module.getVmClass().export())) {
+        return value;
+      }
+
+      throw new VmTypeMismatchException.Reference(
+          sourceSection, value, TypeNode.export(domainTypeNode), referentType);
+    }
+
+    @Fallback
+    protected Object fallback(Object value) {
+      throw typeMismatch(value, RefModule.getReferenceClass());
+    }
+
+    @Override
+    protected boolean acceptTypeNode(boolean visitTypeArguments, TypeNodeConsumer consumer) {
+      if (visitTypeArguments)
+        return consumer.accept(this)
+            && consumer.accept(domainTypeNode)
+            && consumer.accept(referentTypeNode);
+      return consumer.accept(this);
+    }
+
+    @Override
+    public VmClass getVmClass() {
+      return RefModule.getReferenceClass();
+    }
+
+    @Override
+    public VmList getTypeArgumentMirrors() {
+      return VmList.of(domainTypeNode.getMirror(), referentTypeNode.getMirror());
+    }
+
+    @Override
+    protected boolean doIsEquivalentTo(TypeNode other) {
+      if (!(other instanceof ReferenceTypeNode referenceTypeNode)) {
+        return false;
+      }
+      return referentTypeNode.isEquivalentTo(referenceTypeNode.referentTypeNode);
+    }
+
+    @Override
+    public boolean isNoopTypeCheck() {
+      return domainTypeNode.isNoopTypeCheck() && referentTypeNode.isNoopTypeCheck();
+    }
+
+    @Override
+    protected PType doExport() {
+      return new PType.Class(
+          RefModule.getReferenceClass().export(),
+          domainTypeNode.doExport(),
+          referentTypeNode.doExport());
+    }
+
+    @Override
+    protected boolean isParametric() {
+      return true;
+    }
+  }
+
   public static final class PairTypeNode extends ObjectSlotTypeNode {
     @Child private TypeNode firstTypeNode;
     @Child private TypeNode secondTypeNode;
@@ -2585,12 +2714,23 @@ public abstract class TypeNode extends PklNode {
       this.typeAlias = typeAlias;
       this.typeArgumentNodes = typeArgumentNodes;
       aliasedTypeNode = typeAlias.instantiate(typeArgumentNodes);
+      aliasedTypeNode.accept(
+          node -> {
+            if (node instanceof ValidatingObjectSlotTypeNode typeNode) {
+              typeNode.validate(this);
+            }
+            return true;
+          });
     }
 
     public TypeNode getAliasedTypeNode() {
       return aliasedTypeNode;
     }
 
+    public VmTypeAlias getTypeAlias() {
+      return typeAlias;
+    }
+
     @Override
     public FrameSlotKind getFrameSlotKind() {
       return aliasedTypeNode.getFrameSlotKind();
@@ -3081,6 +3221,78 @@ public abstract class TypeNode extends PklNode {
     }
   }
 
+  public abstract static class ValidatingObjectSlotTypeNode extends ObjectSlotTypeNode {
+
+    protected ValidatingObjectSlotTypeNode(SourceSection sourceSection) {
+      super(sourceSection);
+    }
+
+    protected abstract String getValidationErrorKey();
+
+    protected abstract @Nullable Node getViolatingNode();
+
+    protected final void validate() {
+      var violation = getViolatingNode();
+      if (violation == null) return;
+      throw exceptionBuilder()
+          .evalError(getValidationErrorKey())
+          .withLeadingStackFrames(buildLeadingFrames(violation, getSourceSection(), null))
+          .build();
+    }
+
+    public final void validate(TypeAliasTypeNode outermostAliasNode) {
+      var violation = getViolatingNode();
+      if (violation == null) return;
+
+      throw exceptionBuilder()
+          .withLocation(outermostAliasNode)
+          .evalError(getValidationErrorKey())
+          .withLeadingStackFrames(
+              buildLeadingFrames(
+                  violation,
+                  outermostAliasNode.getSourceSection(),
+                  outermostAliasNode.getTypeAlias()))
+          .build();
+    }
+
+    protected abstract boolean isIncludedInTrace(Node node);
+
+    private List<StackFrame> buildLeadingFrames(
+        Node violatingNode, SourceSection usageSection, @Nullable VmTypeAlias outermostAlias) {
+      var frames = new ArrayList<StackFrame>();
+      for (var node = violatingNode; node != null; node = node.getParent()) {
+        if (!(node instanceof TypeAliasTypeNode || isIncludedInTrace(node))) continue;
+        var section = node.getSourceSection();
+        if (section == null || !section.isAvailable() || isWithin(usageSection, section)) {
+          continue;
+        }
+        var owner = ownerAlias(node, outermostAlias);
+        if (owner != null) {
+          frames.add(VmUtils.createStackFrame(section, owner.getQualifiedName()));
+        }
+      }
+      return frames;
+    }
+
+    /**
+     * The type alias whose body contains {@code node}: the nearest enclosing alias, else the
+     * outermost alias being instantiated (which is {@code null} when no alias is used).
+     */
+    @SuppressWarnings("DataFlowIssue")
+    private static @Nullable VmTypeAlias ownerAlias(
+        Node node, @Nullable VmTypeAlias outermostAlias) {
+      var parent = NodeUtil.findParent(node, TypeAliasTypeNode.class);
+      //noinspection ConstantValue
+      return parent != null ? parent.getTypeAlias() : outermostAlias;
+    }
+
+    private static boolean isWithin(SourceSection outer, SourceSection inner) {
+      return inner.getSource().equals(outer.getSource())
+          && inner.getCharIndex() >= outer.getCharIndex()
+          && inner.getCharEndIndex() <= outer.getCharEndIndex();
+    }
+  }
+
   private static @Nullable Object createDefaultValue(VmClass clazz) {
     if (clazz.isInstantiable()) {
       if (clazz.isListingClass()) return VmListing.empty();

pkl-core/src/main/java/org/pkl/core/ast/type/TypeTestNode.java

@@ -26,7 +26,7 @@ import org.pkl.core.runtime.VmLanguage;
 @NodeInfo(shortName = "is")
 public final class TypeTestNode extends ExpressionNode {
   @Child private ExpressionNode valueNode;
-  @Child private UnresolvedTypeNode unresolvedTypeNode;
+  @Child private @Nullable UnresolvedTypeNode unresolvedTypeNode;
   @Child private @Nullable TypeNode typeNode;
 
   public TypeTestNode(
@@ -49,6 +49,7 @@ public final class TypeTestNode extends ExpressionNode {
       // don't compile unresolvedTypeNode.execute()
       // invalidation is done by insert()
       CompilerDirectives.transferToInterpreter();
+      assert unresolvedTypeNode != null;
       typeNode = insert(unresolvedTypeNode.execute(frame));
       unresolvedTypeNode = null;
     }

pkl-core/src/main/java/org/pkl/core/ast/type/UnresolvedTypeNode.java

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024-2025 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -287,6 +287,13 @@ public abstract class UnresolvedTypeNode extends PklNode {
           return new VarArgsTypeNode(sourceSection, typeArgumentNodes[0].execute(frame));
         }
 
+        if (clazz.isReferenceClass()) {
+          return ReferenceTypeNodeGen.create(
+              sourceSection,
+              typeArgumentNodes[0].execute(frame),
+              typeArgumentNodes[1].execute(frame));
+        }
+
         throw exceptionBuilder()
             .evalError("notAParameterizableClass", clazz.getDisplayName())
             .withSourceSection(typeArgumentNodes[0].sourceSection)
@@ -422,6 +429,10 @@ public abstract class UnresolvedTypeNode extends PklNode {
       this.typeParameter = typeParameter;
     }
 
+    public int getTypeParameterIndex() {
+      return typeParameter.getIndex();
+    }
+
     @Override
     public TypeNode execute(VirtualFrame frame) {
       CompilerDirectives.transferToInterpreter();
@@ -429,4 +440,23 @@ public abstract class UnresolvedTypeNode extends PklNode {
       return new TypeVariableNode(sourceSection, typeParameter);
     }
   }
+
+  /**
+   * An unresolved type node that is pre-resolved to a concrete type node. Used during type alias
+   * instantiation to replace type variable references inside constraint expressions (e.g., {@code
+   * every((it) -> it is T)}) with the corresponding concrete type argument.
+   */
+  public static final class Resolved extends UnresolvedTypeNode {
+    @Child private TypeNode typeNode;
+
+    public Resolved(SourceSection sourceSection, TypeNode typeNode) {
+      super(sourceSection);
+      this.typeNode = typeNode;
+    }
+
+    @Override
+    public TypeNode execute(VirtualFrame frame) {
+      return typeNode;
+    }
+  }
 }

pkl-core/src/main/java/org/pkl/core/ast/type/VmTypeMismatchException.java

@@ -23,6 +23,7 @@ import com.oracle.truffle.api.source.SourceSection;
 import java.util.*;
 import java.util.stream.Collectors;
 import org.jspecify.annotations.Nullable;
+import org.pkl.core.PType;
 import org.pkl.core.StackFrame;
 import org.pkl.core.ValueFormatter;
 import org.pkl.core.ast.type.TypeNode.UnionTypeNode;
@@ -333,4 +334,44 @@ public abstract class VmTypeMismatchException extends ControlFlowException {
       return false;
     }
   }
+
+  public static final class Reference extends VmTypeMismatchException {
+
+    private final PType expectedDomainType;
+    private final PType expectedReferentType;
+
+    public Reference(
+        SourceSection sourceSection,
+        VmReference actualValue,
+        PType expectedDomainType,
+        PType expectedReferentType) {
+      super(sourceSection, actualValue);
+      this.expectedDomainType = expectedDomainType;
+      this.expectedReferentType = expectedReferentType;
+    }
+
+    @Override
+    public void buildMessage(
+        AnsiStringBuilder builder, String indent, boolean withPowerAssertions) {
+      builder
+          .append(
+              ErrorMessages.createIndented(
+                  "typeMismatch",
+                  indent,
+                  new PType.Class(
+                      RefModule.getReferenceClass().export(),
+                      expectedDomainType,
+                      expectedReferentType),
+                  ((VmReference) actualValue).exportType()))
+          .append("\n")
+          .append(indent)
+          .append("Value: ")
+          .append(VmValueRenderer.singleLine(80 - indent.length()).render(actualValue));
+    }
+
+    @Override
+    protected Boolean hasHint() {
+      return false;
+    }
+  }
 }

pkl-core/src/main/java/org/pkl/core/externalreader/ExternalResourceResolverImpl.java

@@ -103,7 +103,7 @@ final class ExternalResourceResolverImpl implements ExternalResourceResolver {
         readResponses.computeIfAbsent(
             baseUri,
             (uri) -> {
-              var future = new CompletableFuture<byte[]>();
+              var future = new CompletableFuture<byte @Nullable []>();
               var request =
                   new ReadResourceRequest(requestIdGenerator.nextLong(), evaluatorId, uri);
               try {

pkl-core/src/main/java/org/pkl/core/http/JdkHttpClient.java

@@ -46,7 +46,6 @@ import javax.net.ssl.SSLContext;
 import javax.net.ssl.SSLException;
 import javax.net.ssl.SSLHandshakeException;
 import javax.net.ssl.TrustManagerFactory;
-import org.pkl.core.SecurityManagerException;
 import org.pkl.core.util.ErrorMessages;
 import org.pkl.core.util.Exceptions;
 
@@ -93,7 +92,7 @@ final class JdkHttpClient implements HttpClient {
       HttpRequest request,
       BodyHandler<T> responseBodyHandler,
       HttpRequestChecker httpRequestChecker)
-      throws IOException, SecurityManagerException {
+      throws IOException {
     try {
       return underlying.send(request, responseBodyHandler);
     } catch (ConnectException e) {

pkl-core/src/main/java/org/pkl/core/messaging/Messages.java

@@ -84,7 +84,7 @@ public final class Messages {
     }
 
     @Override
-    public boolean equals(Object o) {
+    public boolean equals(@Nullable Object o) {
       if (this == o) {
         return true;
       }

pkl-core/src/main/java/org/pkl/core/module/PathElement.java

@@ -93,12 +93,14 @@ public class PathElement {
     }
 
     /** Returns the element at path {@code basePath}, given a {@link Path}. */
+    @SuppressWarnings("DataFlowIssue") // incorrect analysis; this can return null.
     public @Nullable TreePathElement getElement(Path basePath) {
       var path = basePath.normalize();
       var element = this;
       for (var i = 0; i < path.getNameCount(); i++) {
         var part = path.getName(i).toString();
         element = element.getChildren().get(part);
+        //noinspection ConstantValue
         if (element == null) {
           return null;
         }

pkl-core/src/main/java/org/pkl/core/module/ProjectDependenciesManager.java

@@ -183,6 +183,7 @@ public final class ProjectDependenciesManager {
   public Map<String, Dependency> getLocalPackageDependencies(PackageUri packageUri) {
     ensureDependenciesInitialized();
     var dep = localPackageDependencies.get(packageUri);
+    //noinspection ConstantValue
     assert dep != null;
     return dep;
   }

pkl-core/src/main/java/org/pkl/core/packages/Dependency.java

@@ -67,7 +67,7 @@ public abstract class Dependency {
     }
 
     @Override
-    public boolean equals(Object o) {
+    public boolean equals(@Nullable Object o) {
       if (this == o) {
         return true;
       }
@@ -107,7 +107,7 @@ public abstract class Dependency {
     }
 
     @Override
-    public boolean equals(Object o) {
+    public boolean equals(@Nullable Object o) {
       if (this == o) {
         return true;
       }

pkl-core/src/main/java/org/pkl/core/packages/DependencyMetadata.java

@@ -217,6 +217,7 @@ public final class DependencyMetadata {
           var map = new HashMap<>();
           for (var kv : value) {
             var kvObj = (JsObject) kv;
+            assert kvObj != null;
             map.put(parsePObject(kvObj.get("key")), parsePObject(kvObj.get("value")));
           }
           return map;
@@ -294,7 +295,7 @@ public final class DependencyMetadata {
     var ret = new ArrayList<String>(arr.size());
     for (var elem : arr) {
       if (!(elem instanceof String string)) {
-        throw new FormatException("string", elem.getClass());
+        throw new FormatException("string", elem != null ? elem.getClass() : Void.class);
       }
       ret.add(string);
     }
@@ -414,7 +415,7 @@ public final class DependencyMetadata {
   }
 
   @Override
-  public boolean equals(Object o) {
+  public boolean equals(@Nullable Object o) {
     if (this == o) {
       return true;
     }
@@ -624,8 +625,8 @@ public final class DependencyMetadata {
       jsonWriter.endObject();
     }
 
-    private void writeGenericObject(Object value) throws IOException {
+    private void writeGenericObject(@Nullable Object value) throws IOException {
-      if (value instanceof PNull) {
+      if (value == null || value instanceof PNull) {
         jsonWriter.nullValue();
       } else if (value instanceof PObject pObject) {
         writePObject(pObject);

pkl-core/src/main/java/org/pkl/core/packages/PackageAssetUri.java

@@ -18,6 +18,7 @@ package org.pkl.core.packages;
 import java.net.URI;
 import java.net.URISyntaxException;
 import java.nio.file.Path;
+import org.jspecify.annotations.Nullable;
 import org.pkl.core.PklBugException;
 import org.pkl.core.Version;
 import org.pkl.core.util.ErrorMessages;
@@ -98,7 +99,7 @@ public final class PackageAssetUri {
   }
 
   @Override
-  public boolean equals(Object o) {
+  public boolean equals(@Nullable Object o) {
     if (this == o) {
       return true;
     }

pkl-core/src/main/java/org/pkl/core/packages/PackageResolvers.java

@@ -45,6 +45,7 @@ import java.util.stream.StreamSupport;
 import java.util.zip.ZipInputStream;
 import org.graalvm.collections.EconomicMap;
 import org.jspecify.annotations.Nullable;
+import org.pkl.core.PklBugException;
 import org.pkl.core.SecurityManager;
 import org.pkl.core.SecurityManagerException;
 import org.pkl.core.http.HttpClient;
@@ -456,10 +457,17 @@ final class PackageResolvers {
     }
 
     private Path getRelativePath(PackageUri uri) {
-      return Path.of(
+      var relativePath =
-          CACHE_DIR_PREFIX,
+          Path.of(
-          IoUtils.encodePath(uri.getUri().getAuthority()),
+              CACHE_DIR_PREFIX,
-          getEffectivePackageUriPath(uri));
+              IoUtils.encodePath(uri.getUri().getAuthority()),
+              getEffectivePackageUriPath(uri));
+      // ensure the derived path cannot escape the cache directory
+      var resolved = cacheDir.resolve(relativePath).normalize();
+      if (!resolved.startsWith(cacheDir.normalize())) {
+        throw new PklBugException("Package URI escapes the cache directory");
+      }
+      return relativePath;
     }
 
     private String getLastSegmentName(PackageUri packageUri) {

pkl-core/src/main/java/org/pkl/core/packages/PackageUri.java

@@ -61,6 +61,13 @@ public final class PackageUri {
       throw new URISyntaxException(
           uri.toString(), ErrorMessages.create("missingPathInPackageUri", uri));
     }
+    // reject `..` segments, percent-encoded or not
+    for (var segment : path.split("/", -1)) {
+      if (segment.equals("..")) {
+        throw new URISyntaxException(
+            uri.toString(), ErrorMessages.create("invalidRelativePathInPackageUri"));
+      }
+    }
     var versionIdx = path.lastIndexOf('@');
     if (versionIdx == -1) {
       throw new URISyntaxException(
@@ -111,7 +118,7 @@ public final class PackageUri {
   }
 
   @Override
-  public boolean equals(Object o) {
+  public boolean equals(@Nullable Object o) {
     if (this == o) {
       return true;
     }

pkl-core/src/main/java/org/pkl/core/project/CanonicalPackageUri.java

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -17,6 +17,7 @@ package org.pkl.core.project;
 
 import java.net.URI;
 import java.net.URISyntaxException;
+import org.jspecify.annotations.Nullable;
 import org.pkl.core.PklBugException;
 import org.pkl.core.packages.PackageUri;
 import org.pkl.core.util.ErrorMessages;
@@ -84,7 +85,7 @@ public record CanonicalPackageUri(URI baseUri, int majorVersion) {
   }
 
   @Override
-  public boolean equals(Object o) {
+  public boolean equals(@Nullable Object o) {
     if (this == o) {
       return true;
     }

pkl-core/src/main/java/org/pkl/core/project/Project.java

@@ -199,7 +199,7 @@ public final class Project {
         sb.append("\n│");
       }
       sb.append("\n│  ");
-      sb.append(uri.toString());
+      sb.append(uri);
     }
     sb.append("\n└─");
   }
@@ -477,7 +477,7 @@ public final class Project {
   }
 
   @Override
-  public boolean equals(Object o) {
+  public boolean equals(@Nullable Object o) {
     if (this == o) {
       return true;
     }
@@ -611,7 +611,7 @@ public final class Project {
     }
 
     @Override
-    public boolean equals(Object o) {
+    public boolean equals(@Nullable Object o) {
       if (this == o) {
         return true;
       }

pkl-core/src/main/java/org/pkl/core/project/ProjectDependenciesResolver.java

@@ -141,6 +141,7 @@ public final class ProjectDependenciesResolver {
   private void updateDependency(Dependency dependency) {
     var canonicalPackageUri = CanonicalPackageUri.fromPackageUri(dependency.getPackageUri());
     var currentDependency = resolvedDependencies.get(canonicalPackageUri);
+    //noinspection ConstantValue
     if (currentDependency == null
         || currentDependency.getVersion().compareTo(dependency.getVersion()) < 0) {
       EconomicMaps.put(resolvedDependencies, canonicalPackageUri, dependency);

pkl-core/src/main/java/org/pkl/core/project/ProjectDeps.java

@@ -135,6 +135,7 @@ public final class ProjectDeps {
   }
 
   /** Given a declared dependency, return the resolved dependency. */
+  @SuppressWarnings("DataFlowIssue") // incorrect analysis
   public @Nullable Dependency get(CanonicalPackageUri canonicalPackageUri) {
     return resolvedDependencies.get(canonicalPackageUri);
   }
@@ -150,7 +151,7 @@ public final class ProjectDeps {
   }
 
   @Override
-  public boolean equals(Object o) {
+  public boolean equals(@Nullable Object o) {
     if (this == o) {
       return true;
     }

pkl-core/src/main/java/org/pkl/core/runtime/FileSystemManager.java

@@ -51,6 +51,8 @@ public final class FileSystemManager {
 
   public static synchronized FileSystem getFileSystem(URI uri) throws IOException {
     var fs = fileSystems.get(uri);
+    // incorrect nullability for `org.graalvm.collections.UnmodifiableEconomicMap`
+    //noinspection ConstantValue
     if (fs != null) {
       var count = counts.get(fs);
       assert count != null;

pkl-core/src/main/java/org/pkl/core/runtime/Identifier.java

@@ -165,6 +165,10 @@ public final class Identifier implements Comparable<Identifier> {
 
   public static final Identifier ILLEGAL = get("`");
 
+  // members of pkl.ref
+  public static final Identifier PROPERTY = get("property");
+  public static final Identifier KEY = get("key");
+
   // common in lambdas etc
   public static final Identifier IT = get("it");
 

pkl-core/src/main/java/org/pkl/core/runtime/ModuleCache.java

@@ -104,6 +104,8 @@ public final class ModuleCache {
           return PlatformModule.getModule();
         case "project":
           return ProjectModule.getModule();
+        case "ref":
+          return RefModule.getModule();
         case "reflect":
           return ReflectModule.getModule();
         case "release":

pkl-core/src/main/java/org/pkl/core/runtime/ModuleInfo.java

@@ -40,10 +40,10 @@ public final class ModuleInfo {
 
   @LateInit private List<VmTyped> annotations;
 
-  @LateInit private VmTyped __mirror;
+  private @Nullable VmTyped __mirror;
   private final Object mirrorLock = new Object();
 
-  @LateInit private ModuleSchema __moduleSchema;
+  private @Nullable ModuleSchema __moduleSchema;
   private final Object moduleSchemaLock = new Object();
 
   public ModuleInfo(
@@ -65,12 +65,12 @@ public final class ModuleInfo {
   }
 
   public void initAnnotations(List<VmTyped> annotations) {
+    //noinspection ConstantValue
     assert this.annotations == null;
     this.annotations = annotations;
   }
 
   public List<VmTyped> getAnnotations() {
-    assert annotations != null;
     return annotations;
   }
 

pkl-core/src/main/java/org/pkl/core/runtime/RefModule.java

@@ -0,0 +1,53 @@
+/*
+ * Copyright © 2026 Apple Inc. and the Pkl project authors. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.pkl.core.runtime;
+
+import com.oracle.truffle.api.CompilerDirectives.TruffleBoundary;
+import java.net.URI;
+
+public class RefModule extends StdLibModule {
+  private static final VmTyped instance = VmUtils.createEmptyModule();
+
+  static {
+    loadModule(URI.create("pkl:ref"), instance);
+  }
+
+  public static VmClass getReferenceClass() {
+    return ReferenceClass.instance;
+  }
+
+  public static VmClass getAccessClass() {
+    return AccessClass.instance;
+  }
+
+  private static final class ReferenceClass {
+    static final VmClass instance = loadClass("Reference");
+  }
+
+  private static final class AccessClass {
+    static final VmClass instance = loadClass("Access");
+  }
+
+  @TruffleBoundary
+  private static VmClass loadClass(String className) {
+    var theModule = getModule();
+    return (VmClass) VmUtils.readMember(theModule, Identifier.get(className));
+  }
+
+  public static VmTyped getModule() {
+    return instance;
+  }
+}

pkl-core/src/main/java/org/pkl/core/runtime/StackTraceGenerator.java

@@ -38,6 +38,10 @@ final class StackTraceGenerator {
   }
 
   private List<StackFrame> capture() {
+    // frames that aren't part of the runtime call stack are
+    // shown ahead of the captured frames.
+    frames.addAll(exception.getLeadingStackFrames());
+
     var truffleElements = TruffleStackTrace.getStackTrace(exception);
     if (truffleElements.isEmpty()) {
       addFrame(exception.getSourceSection(), exception.getMemberName());

pkl-core/src/main/java/org/pkl/core/runtime/StackTraceRenderer.java

@@ -101,8 +101,14 @@ public final class StackTraceRenderer {
     if (hint != null) {
       out.append(AnsiTheme.ERROR_MESSAGE_HINT, hint);
     } else {
-      assert hintBuilder != null;
+      out.append(
-      out.append(AnsiTheme.ERROR_MESSAGE_HINT, () -> hintBuilder.accept(out, true));
+          AnsiTheme.ERROR_MESSAGE_HINT,
+          () -> {
+            // nullaway needs this assertion
+            //noinspection ConstantValue
+            assert hintBuilder != null;
+            hintBuilder.accept(out, true);
+          });
     }
     out.append('\n');
   }

pkl-core/src/main/java/org/pkl/core/runtime/TestRunner.java

@@ -491,11 +491,11 @@ public final class TestRunner {
           sb.append("\n  Expected: ");
           appendLocation(sb, expectedLocation);
           sb.append("\n  ");
-          sb.append(AnsiTheme.TEST_EXAMPLE_OUTPUT, expectedValue.replaceAll("\n", "\n  "));
+          sb.append(AnsiTheme.TEST_EXAMPLE_OUTPUT, expectedValue.replace("\n", "\n  "));
           sb.append("\n  Actual: ");
           appendLocation(sb, actualLocation);
           sb.append("\n  ");
-          sb.append(AnsiTheme.TEST_EXAMPLE_OUTPUT, actualValue.replaceAll("\n", "\n  "));
+          sb.append(AnsiTheme.TEST_EXAMPLE_OUTPUT, actualValue.replace("\n", "\n  "));
         });
     return new Failure("Example Failure", sb.toString());
   }

pkl-core/src/main/java/org/pkl/core/runtime/VmBugException.java

@@ -38,7 +38,8 @@ public final class VmBugException extends VmException {
       @Nullable SourceSection sourceSection,
       @Nullable String memberName,
       @Nullable BiConsumer<AnsiStringBuilder, Boolean> hintBuilder,
-      Map<CallTarget, StackFrame> insertedStackFrames) {
+      Map<CallTarget, StackFrame> insertedStackFrames,
+      List<StackFrame> leadingStackFrames) {
 
     super(
         message,
@@ -51,7 +52,8 @@ public final class VmBugException extends VmException {
         sourceSection,
         memberName,
         hintBuilder,
-        insertedStackFrames);
+        insertedStackFrames,
+        leadingStackFrames);
   }
 
   @Override

pkl-core/src/main/java/org/pkl/core/runtime/VmClass.java

@@ -445,6 +445,11 @@ public final class VmClass extends VmValue {
     return isClass(BaseModule.getVarArgsClass(), "pkl.base#VarArgs");
   }
 
+  @Idempotent
+  public boolean isReferenceClass() {
+    return isClass(RefModule.getReferenceClass(), "pkl.ref#Reference");
+  }
+
   private boolean isClass(@Nullable VmClass clazz, String qualifiedClassName) {
     // may be null during evaluation of base module
     return clazz != null ? this == clazz : getQualifiedName().equals(qualifiedClassName);
@@ -621,49 +626,62 @@ public final class VmClass extends VmValue {
   public PClass export() {
     synchronized (pClassLock) {
       //noinspection ConstantValue
-      if (__pClass == null) {
+      if (__pClass != null) {
-        var exportedAnnotations = new ArrayList<PObject>();
+        return __pClass;
-        var properties =
+      }
-            CollectionUtils.<String, PClass.Property>newLinkedHashMap(
-                EconomicMaps.size(declaredProperties));
-        var methods =
-            CollectionUtils.<String, PClass.Method>newLinkedHashMap(
-                EconomicMaps.size(declaredMethods));
 
-        // set pClass before exporting class members to prevent
+      // if this is not a module class, export this class's module's class first to break the cycle
-        // infinite recursion in case of cyclic references
+      PClass moduleClass = null;
-        __pClass =
+      if (!classInfo.isModuleClass()) {
-            new PClass(
+        moduleClass = getModule().getVmClass().export();
-                VmUtils.exportDocComment(docComment),
+      }
-                new SourceLocation(headerSection.getStartLine(), sourceSection.getEndLine()),
+      // then if the cached value is still null, initialize it
-                VmModifier.export(modifiers, true),
+      if (__pClass != null) {
-                exportedAnnotations,
+        return __pClass;
-                classInfo,
+      }
-                typeParameters,
-                properties,
-                methods);
 
-        for (var parameter : typeParameters) {
+      var exportedAnnotations = new ArrayList<PObject>();
-          parameter.initOwner(__pClass);
+      var properties =
+          CollectionUtils.<String, PClass.Property>newLinkedHashMap(
+              EconomicMaps.size(declaredProperties));
+      var methods =
+          CollectionUtils.<String, PClass.Method>newLinkedHashMap(
+              EconomicMaps.size(declaredMethods));
+
+      // set pClass before exporting class members to prevent
+      // infinite recursion in case of cyclic references
+      __pClass =
+          new PClass(
+              VmUtils.exportDocComment(docComment),
+              new SourceLocation(headerSection.getStartLine(), sourceSection.getEndLine()),
+              VmModifier.export(modifiers, true),
+              exportedAnnotations,
+              classInfo,
+              typeParameters,
+              properties,
+              methods,
+              moduleClass);
+
+      for (var parameter : typeParameters) {
+        parameter.initOwner(__pClass);
+      }
+
+      if (supertypeNode != null) {
+        assert superclass != null;
+        __pClass.initSupertype(TypeNode.export(supertypeNode), superclass.export());
+      }
+
+      VmUtils.exportAnnotations(annotations, exportedAnnotations);
+
+      for (var property : EconomicMaps.getValues(declaredProperties)) {
+        if (isClassPropertyDefinition(property)) {
+          properties.put(property.getName().toString(), property.export(__pClass));
         }
+      }
 
-        if (supertypeNode != null) {
+      for (var method : EconomicMaps.getValues(declaredMethods)) {
-          assert superclass != null;
+        if (method.isLocal()) continue;
-          __pClass.initSupertype(TypeNode.export(supertypeNode), superclass.export());
+        methods.put(method.getName().toString(), method.export(__pClass));
-        }
-
-        VmUtils.exportAnnotations(annotations, exportedAnnotations);
-
-        for (var property : EconomicMaps.getValues(declaredProperties)) {
-          if (isClassPropertyDefinition(property)) {
-            properties.put(property.getName().toString(), property.export(__pClass));
-          }
-        }
-
-        for (var method : EconomicMaps.getValues(declaredMethods)) {
-          if (method.isLocal()) continue;
-          methods.put(method.getName().toString(), method.export(__pClass));
-        }
       }
 
       return __pClass;

pkl-core/src/main/java/org/pkl/core/runtime/VmContext.java

@@ -107,6 +107,7 @@ public final class VmContext {
   }
 
   public void initialize(Holder holder) {
+    //noinspection ConstantValue
     assert this.holder == null;
     this.holder = holder;
   }

pkl-core/src/main/java/org/pkl/core/runtime/VmDynamic.java

@@ -19,6 +19,7 @@ import com.oracle.truffle.api.CompilerDirectives.TruffleBoundary;
 import com.oracle.truffle.api.frame.MaterializedFrame;
 import java.util.Objects;
 import org.graalvm.collections.UnmodifiableEconomicMap;
+import org.jspecify.annotations.Nullable;
 import org.pkl.core.PClassInfo;
 import org.pkl.core.PObject;
 import org.pkl.core.ast.member.ObjectMember;
@@ -75,12 +76,14 @@ public final class VmDynamic extends VmObject {
   @Override
   @TruffleBoundary
   public PObject export() {
+    assert forced : "Value was not forced prior to export";
+
     var properties =
         CollectionUtils.<String, Object>newLinkedHashMap(EconomicMaps.size(cachedValues));
 
-    iterateMemberValues(
+    iterateAlreadyForcedMemberValues(
         (key, member, value) -> {
-          properties.put(key.toString(), VmValue.exportNullable(value));
+          properties.put(key.toString(), VmValue.export(value));
           return true;
         });
 
@@ -99,9 +102,8 @@ public final class VmDynamic extends VmObject {
 
   @Override
   @TruffleBoundary
-  public boolean equals(Object obj) {
+  public boolean equals(@Nullable Object obj) {
-    if (this == obj) // noinspection Contract
+    if (this == obj) return true;
-    return true;
     if (!(obj instanceof VmDynamic other)) return false;
 
     // could use shallow force, but deep force is cached
@@ -115,6 +117,7 @@ public final class VmDynamic extends VmObject {
       if (isHiddenOrLocalProperty(key)) continue;
 
       var value = cursor.getValue();
+      //noinspection ConstantValue
       assert value != null;
       var otherValue = other.getCachedValue(key);
       if (!value.equals(otherValue)) return false;
@@ -137,6 +140,7 @@ public final class VmDynamic extends VmObject {
       if (isHiddenOrLocalProperty(key)) continue;
 
       var value = cursor.getValue();
+      //noinspection ConstantValue
       assert value != null;
       result += key.hashCode() ^ value.hashCode();
     }

pkl-core/src/main/java/org/pkl/core/runtime/VmEvalException.java

@@ -37,7 +37,8 @@ public class VmEvalException extends VmException {
       @Nullable SourceSection sourceSection,
       @Nullable String memberName,
       @Nullable BiConsumer<AnsiStringBuilder, Boolean> hintBuilder,
-      Map<CallTarget, StackFrame> insertedStackFrames) {
+      Map<CallTarget, StackFrame> insertedStackFrames,
+      List<StackFrame> leadingStackFrames) {
 
     super(
         message,
@@ -50,6 +51,7 @@ public class VmEvalException extends VmException {
         sourceSection,
         memberName,
         hintBuilder,
-        insertedStackFrames);
+        insertedStackFrames,
+        leadingStackFrames);
   }
 }

pkl-core/src/main/java/org/pkl/core/runtime/VmException.java

@@ -34,6 +34,7 @@ public abstract class VmException extends AbstractTruffleException {
   private final @Nullable SourceSection sourceSection;
   private final @Nullable String memberName;
   private final Map<CallTarget, StackFrame> insertedStackFrames;
+  private final List<StackFrame> leadingStackFrames;
   @Nullable private final BiConsumer<AnsiStringBuilder, Boolean> messageBuilder;
   @Nullable protected BiConsumer<AnsiStringBuilder, Boolean> hintBuilder;
 
@@ -48,7 +49,8 @@ public abstract class VmException extends AbstractTruffleException {
       @Nullable SourceSection sourceSection,
       @Nullable String memberName,
       @Nullable BiConsumer<AnsiStringBuilder, Boolean> hintBuilder,
-      Map<CallTarget, StackFrame> insertedStackFrames) {
+      Map<CallTarget, StackFrame> insertedStackFrames,
+      List<StackFrame> leadingStackFrames) {
     super(message, cause, UNLIMITED_STACK_TRACE, location);
     assert message != null || messageBuilder != null;
     this.messageBuilder = messageBuilder;
@@ -58,6 +60,7 @@ public abstract class VmException extends AbstractTruffleException {
     this.sourceSection = sourceSection;
     this.memberName = memberName;
     this.insertedStackFrames = insertedStackFrames;
+    this.leadingStackFrames = leadingStackFrames;
     this.hintBuilder = hintBuilder;
   }
 
@@ -89,6 +92,14 @@ public abstract class VmException extends AbstractTruffleException {
     return insertedStackFrames;
   }
 
+  /**
+   * Stack frames to prepend to the rendered stack trace, ahead of the captured frames. Used to show
+   * source locations that aren't part of the runtime call stack.
+   */
+  public final List<StackFrame> getLeadingStackFrames() {
+    return leadingStackFrames;
+  }
+
   public @Nullable BiConsumer<AnsiStringBuilder, Boolean> getMessageBuilder() {
     return messageBuilder;
   }

pkl-core/src/main/java/org/pkl/core/runtime/VmExceptionBuilder.java

@@ -99,6 +99,7 @@ public final class VmExceptionBuilder {
   private @Nullable Node location;
   private @Nullable SourceSection sourceSection;
   private @Nullable String memberName;
+  private List<StackFrame> leadingStackFrames = List.of();
 
   public VmExceptionBuilder typeMismatch(Object value, VmClass expectedType) {
     if (value instanceof VmNull) {
@@ -359,6 +360,15 @@ public final class VmExceptionBuilder {
     return this;
   }
 
+  /**
+   * Frames to show ahead of the captured stack trace (see {@link
+   * VmException#getLeadingStackFrames()}).
+   */
+  public VmExceptionBuilder withLeadingStackFrames(List<StackFrame> leadingStackFrames) {
+    this.leadingStackFrames = leadingStackFrames;
+    return this;
+  }
+
   public VmException build() {
     if (message != null && messageBuilder != null) {
       throw new IllegalStateException("Both message and messageBuilder are set");
@@ -387,7 +397,8 @@ public final class VmExceptionBuilder {
               sourceSection,
               memberName,
               hintBuilder,
-              effectiveInsertedStackFrames);
+              effectiveInsertedStackFrames,
+              leadingStackFrames);
       case UNDEFINED_VALUE ->
           new VmUndefinedValueException(
               message,
@@ -401,7 +412,8 @@ public final class VmExceptionBuilder {
               memberName,
               hintBuilder,
               receiver,
-              effectiveInsertedStackFrames);
+              effectiveInsertedStackFrames,
+              leadingStackFrames);
       case BUG ->
           new VmBugException(
               message,
@@ -414,7 +426,8 @@ public final class VmExceptionBuilder {
               sourceSection,
               memberName,
               hintBuilder,
-              effectiveInsertedStackFrames);
+              effectiveInsertedStackFrames,
+              leadingStackFrames);
       case WRAPPED -> {
         assert wrappedException != null;
         yield new VmWrappedEvalException(
@@ -429,6 +442,7 @@ public final class VmExceptionBuilder {
             memberName,
             hintBuilder,
             effectiveInsertedStackFrames,
+            leadingStackFrames,
             wrappedException);
       }
     };

pkl-core/src/main/java/org/pkl/core/runtime/VmListing.java

@@ -87,13 +87,15 @@ public final class VmListing extends VmListingOrMapping {
   @Override
   @TruffleBoundary
   public List<Object> export() {
+    assert forced : "Value was not forced prior to export";
+
     var properties = new ArrayList<>(EconomicMaps.size(cachedValues));
 
-    iterateMemberValues(
+    iterateAlreadyForcedMemberValues(
         (key, prop, value) -> {
           if (isDefaultProperty(key)) return true;
 
-          properties.add(VmValue.exportNullable(value));
+          properties.add(VmValue.export(value));
           return true;
         });
 
@@ -127,6 +129,7 @@ public final class VmListing extends VmListingOrMapping {
       if (key instanceof Identifier) continue;
 
       var value = cursor.getValue();
+      //noinspection ConstantValue
       assert value != null;
       var otherValue = other.getCachedValue(key);
       if (!value.equals(otherValue)) return false;
@@ -149,6 +152,7 @@ public final class VmListing extends VmListingOrMapping {
       if (key instanceof Identifier) continue;
 
       var value = cursor.getValue();
+      //noinspection ConstantValue
       assert value != null;
       result = 31 * result + value.hashCode();
     }

pkl-core/src/main/java/org/pkl/core/runtime/VmMap.java

@@ -147,6 +147,7 @@ public final class VmMap extends VmValue implements Iterable<Map.Entry<Object, O
 
     for (var key : other.keyOrder) {
       var value = other.map.get(key);
+      assert value != null;
 
       if (!map.containsKey(key)) {
         keyOrderBuilder.append(key);

pkl-core/src/main/java/org/pkl/core/runtime/VmMapping.java

@@ -21,19 +21,18 @@ import com.oracle.truffle.api.frame.MaterializedFrame;
 import java.util.HashSet;
 import java.util.Map;
 import org.graalvm.collections.UnmodifiableEconomicMap;
+import org.jspecify.annotations.Nullable;
 import org.pkl.core.ast.member.ListingOrMappingTypeCastNode;
 import org.pkl.core.ast.member.ObjectMember;
 import org.pkl.core.util.CollectionUtils;
 import org.pkl.core.util.EconomicMaps;
-import org.pkl.core.util.LateInit;
 import org.pkl.core.util.MutableLong;
 
 public final class VmMapping extends VmListingOrMapping {
   private long cachedLength = -1;
 
   @GuardedBy("this")
-  @LateInit
+  private @Nullable VmSet __allKeys;
-  private VmSet __allKeys;
 
   private static final class EmptyHolder {
     private static final VmMapping EMPTY =
@@ -94,13 +93,15 @@ public final class VmMapping extends VmListingOrMapping {
   @Override
   @TruffleBoundary
   public Map<Object, Object> export() {
+    assert forced : "Value was not forced prior to export";
+
     var properties = CollectionUtils.newLinkedHashMap(EconomicMaps.size(cachedValues));
 
-    iterateMemberValues(
+    iterateAlreadyForcedMemberValues(
         (key, prop, value) -> {
           if (isDefaultProperty(key)) return true;
 
-          properties.put(VmValue.export(key), VmValue.exportNullable(value));
+          properties.put(VmValue.export(key), VmValue.export(value));
           return true;
         });
 
@@ -119,9 +120,8 @@ public final class VmMapping extends VmListingOrMapping {
 
   @Override
   @TruffleBoundary
-  public boolean equals(Object obj) {
+  public boolean equals(@Nullable Object obj) {
-    if (this == obj) // noinspection Contract
+    if (this == obj) return true;
-    return true;
     if (!(obj instanceof VmMapping other)) return false;
 
     // could use shallow force, but deep force is cached
@@ -135,6 +135,7 @@ public final class VmMapping extends VmListingOrMapping {
       if (key instanceof Identifier) continue;
 
       var value = cursor.getValue();
+      //noinspection ConstantValue
       assert value != null;
       var otherValue = other.getCachedValue(key);
       if (!value.equals(otherValue)) return false;
@@ -157,6 +158,7 @@ public final class VmMapping extends VmListingOrMapping {
       if (key instanceof Identifier) continue;
 
       var value = cursor.getValue();
+      //noinspection ConstantValue
       assert value != null;
       result += key.hashCode() ^ value.hashCode();
     }

pkl-core/src/main/java/org/pkl/core/runtime/VmObject.java

@@ -34,7 +34,7 @@ public abstract class VmObject extends VmObjectLike {
   protected final EconomicMap<Object, Object> cachedValues;
 
   protected int cachedHash;
-  private boolean forced;
+  protected boolean forced;
 
   public VmObject(
       MaterializedFrame enclosingFrame,
@@ -204,17 +204,20 @@ public abstract class VmObject extends VmObjectLike {
 
   /**
    * Exports this object's members. Skips local members, hidden members, class definitions, and type
-   * aliases. Members that haven't been forced have a `null` value.
+   * aliases.
+   *
+   * <p>Assumes that this object has already been forced.
    */
   @TruffleBoundary
   protected final Map<String, Object> exportMembers() {
-    var result = CollectionUtils.<String, Object>newLinkedHashMap(EconomicMaps.size(cachedValues));
+    Map<String, Object> result = CollectionUtils.newLinkedHashMap(EconomicMaps.size(cachedValues));
+    assert forced : "Value was not forced prior to export";
 
-    iterateMemberValues(
+    iterateAlreadyForcedMemberValues(
         (key, member, value) -> {
           if (member.isClass() || member.isTypeAlias()) return true;
 
-          result.put(key.toString(), VmValue.exportNullable(value));
+          result.put(key.toString(), VmValue.export(value));
           return true;
         });
 

pkl-core/src/main/java/org/pkl/core/runtime/VmObjectBuilder.java

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -87,4 +87,9 @@ public final class VmObjectBuilder {
         members,
         elementCount);
   }
+
+  public VmTyped toTyped(VmClass clazz) {
+    return new VmTyped(
+        VmUtils.createEmptyMaterializedFrame(), clazz.getPrototype(), clazz, members);
+  }
 }

pkl-core/src/main/java/org/pkl/core/runtime/VmPklBinaryEncoder.java

@@ -324,6 +324,22 @@ public class VmPklBinaryEncoder extends AbstractRenderer {
     }
   }
 
+  @Override
+  public void visitReference(VmReference value) {
+    try {
+      packer.packArrayHeader(4);
+      packCode(PklBinaryCode.REFERENCE);
+      visit(value.getDomain());
+      visit(value.getData());
+      packer.packArrayHeader(value.getPath().size());
+      for (var access : value.getPath()) {
+        visit(access);
+      }
+    } catch (IOException e) {
+      throw PklBugException.unreachableCode();
+    }
+  }
+
   @Override
   protected void visitEntryKey(Object key, boolean isFirst) {
     visit(key);

pkl-core/src/main/java/org/pkl/core/runtime/VmReference.java

@@ -0,0 +1,493 @@
+/*
+ * Copyright © 2025-2026 Apple Inc. and the Pkl project authors. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.pkl.core.runtime;
+
+import com.oracle.truffle.api.CompilerDirectives.TruffleBoundary;
+import com.oracle.truffle.api.nodes.DirectCallNode;
+import java.util.ArrayList;
+import java.util.Collections;
+import java.util.Comparator;
+import java.util.HashSet;
+import java.util.List;
+import java.util.Set;
+import java.util.function.BiConsumer;
+import java.util.function.Supplier;
+import org.jspecify.annotations.Nullable;
+import org.pkl.core.Composite;
+import org.pkl.core.PClass;
+import org.pkl.core.PClassInfo;
+import org.pkl.core.PType;
+import org.pkl.core.PklBugException;
+import org.pkl.core.Reference;
+import org.pkl.core.TypeAlias;
+import org.pkl.core.util.paguro.RrbTree;
+import org.pkl.core.util.paguro.RrbTree.ImRrbt;
+
+public final class VmReference extends VmValue {
+
+  private final VmTyped domain;
+  private final Object data;
+  private final ImRrbt<VmTyped> path;
+  // candidate types can only be: PType.Class, PType.Alias (only preservedAliasTypes),
+  // PType.StringLiteral, PType.UNKNOWN, or PType.Union (containing only the previous; flattened)
+  private final PType referentType;
+
+  private boolean forced = false;
+
+  private static VmTyped newAccess(@Nullable String property, @Nullable Object key) {
+    return new VmObjectBuilder()
+        .addProperty(Identifier.PROPERTY, property == null ? VmNull.withoutDefault() : property)
+        .addProperty(Identifier.KEY, key == null ? VmNull.withoutDefault() : key)
+        .toTyped(RefModule.getAccessClass());
+  }
+
+  @TruffleBoundary
+  public VmReference(VmTyped domain, VmClass clazz, Object data) {
+    this(
+        domain,
+        data,
+        RrbTree.empty(),
+        normalizeTypes(new PType.Class(clazz.export()), clazz.getModule().getVmClass().export()));
+  }
+
+  public VmReference(VmTyped domain, Object data, ImRrbt<VmTyped> path, PType referentType) {
+    this.domain = domain;
+    this.data = data;
+    this.referentType = referentType;
+    this.path = path;
+  }
+
+  public VmTyped getDomain() {
+    return domain;
+  }
+
+  public Object getData() {
+    return data;
+  }
+
+  public List<VmTyped> getPath() {
+    return path;
+  }
+
+  public PType getReferentType() {
+    return referentType;
+  }
+
+  // simplifies a type by:
+  // * erasing constraints
+  // * transforming T? into T|Null
+  // * dereferencing aliases (except for well-known stdlib alias types)
+  // * flattening unions
+  // * when moduleClass is supplied, replace PType.MODULE with appropriate PType.Class
+  // * drop PType.Function and PType.TypeVariable
+  private static PType normalizeTypes(PType type, PClass moduleClass) {
+    var types = new HashSet<PType>();
+    normalizeTypes(type, moduleClass, types);
+    return minimizeTypes(types);
+  }
+
+  private static PType minimizeTypes(Set<PType> types) {
+    if (types.size() == 1) return types.iterator().next();
+    // optimization: unknown allows all references, erase all candidates to only unknown
+    if (types.contains(PType.UNKNOWN)) return PType.UNKNOWN;
+    // optimization: All allows all references, erase all candidates to only All
+    if (containsClass(types, BaseModule.getAnyClass().export()))
+      return new PType.Class(BaseModule.getAnyClass().export());
+    var typesList = new ArrayList<>(types);
+    typesList.sort(Comparator.comparing(Object::toString));
+    return new PType.Union(typesList);
+  }
+
+  private static void normalizeTypes(PType type, PClass moduleClass, Set<PType> result) {
+    if (type == PType.UNKNOWN || type == PType.NOTHING || type instanceof PType.StringLiteral) {
+      result.add(type);
+    } else if (type instanceof PType.Class clazz) {
+      if (clazz.getTypeArguments().isEmpty()) {
+        // if a generic type is used without type arguments, it needs to be normalized so all args
+        // are unknown; i.e. with bare List/Map/etc. type annotations (via FinalClassTypeNode).
+        var typeParameterCount = clazz.getPClass().getTypeParameters().size();
+        result.add(
+            typeParameterCount == 0
+                ? clazz
+                : new PType.Class(
+                    clazz.getPClass(), Collections.nCopies(typeParameterCount, PType.UNKNOWN)));
+      } else {
+        var typeArgs = new ArrayList<PType>(clazz.getTypeArguments().size());
+        for (var arg : clazz.getTypeArguments()) {
+          typeArgs.add(normalizeTypes(arg, moduleClass));
+        }
+        result.add(new PType.Class(clazz.getPClass(), typeArgs));
+      }
+    } else if (type instanceof PType.Nullable nullable) {
+      normalizeTypes(nullable.getBaseType(), moduleClass, result);
+      result.add(new PType.Class(BaseModule.getNullClass().export()));
+    } else if (type instanceof PType.Constrained constrained) {
+      normalizeTypes(constrained.getBaseType(), moduleClass, result);
+    } else if (type instanceof PType.Alias alias) {
+      if (isPreservedTypeAlias(alias.getTypeAlias())) {
+        result.add(alias);
+      } else {
+        normalizeTypes(alias.getAliasedType(), alias.getTypeAlias().getModuleClass(), result);
+      }
+    } else if (type instanceof PType.Union union) {
+      for (var t : union.getElementTypes()) {
+        normalizeTypes(t, moduleClass, result);
+      }
+    } else if (type == PType.MODULE) {
+      result.add(new PType.Class(moduleClass));
+    }
+  }
+
+  private static Iterable<PType> iterateTypes(PType t) {
+    if (t instanceof PType.Union union) return union.getElementTypes();
+    return Collections.singleton(t);
+  }
+
+  public @Nullable VmReference withPropertyAccess(Identifier property) {
+    var propString = property.toString();
+    return withAccess(
+        (t, candidates) -> getCandidatePropertyType(t, propString, candidates),
+        () -> newAccess(property.toString(), null));
+  }
+
+  public @Nullable VmReference withSubscriptAccess(Object key) {
+    return withAccess(
+        (t, candidates) -> getCandidateSubscriptType(t, key, candidates),
+        () -> newAccess(null, key));
+  }
+
+  @TruffleBoundary
+  private @Nullable VmReference withAccess(
+      BiConsumer<PType, Set<PType>> checkCandidate, Supplier<VmTyped> makeAccess) {
+    Set<PType> candidates = new HashSet<>();
+    for (var t : iterateTypes(referentType)) {
+      checkCandidate.accept(t, candidates);
+    }
+    if (candidates.isEmpty()) {
+      return null; // no valid access found
+    }
+    return new VmReference(domain, data, path.append(makeAccess.get()), minimizeTypes(candidates));
+  }
+
+  @SuppressWarnings("DuplicatedCode")
+  private static void getCandidatePropertyType(PType type, String property, Set<PType> result) {
+    if (type == PType.UNKNOWN) {
+      result.add(type);
+      return;
+    }
+    // restriction: only class types can have their properties referenced
+    if (!(type instanceof PType.Class clazz)) return;
+    // restriction: cannot reference properties of external classes
+    if (clazz.getPClass().isExternal()) return;
+    if (clazz.getPClass().getInfo() == PClassInfo.Dynamic) {
+      // restriction: cannot reference Dynamic.default
+      if (!property.equals("default")) result.add(PType.UNKNOWN);
+      return;
+    }
+    // restriction: cannot reference Listing/Mapping.default
+    if (clazz.getPClass().getInfo() == PClassInfo.Listing
+        || clazz.getPClass().getInfo() == PClassInfo.Mapping) {
+      return;
+    }
+    // restriction: cannot reference Module.output.
+    //   generalized: properties originally defined in external classes; the only extant example.
+    // This is implemented specifically because this is the only case where an external class
+    //   containing a property can be subclassed.
+    // And this can't check prop.getOwner().isExternal() because fully overriding the property with
+    //   a new type annotation means the owner isn't Module.
+    if (clazz.getPClass().isSubclassOf(BaseModule.getModuleClass().export())
+        && property.equals("output")) return;
+
+    var prop = clazz.getPClass().getAllProperties().get(property);
+    // restriction: cannot reference external properties
+    if (prop == null || prop.isExternal()) {
+      return;
+    }
+    normalizeTypes(prop.getType(), clazz.getPClass().getModuleClass(), result);
+  }
+
+  private static PClassInfo<?> getClassInfo(Object value) {
+    if (value instanceof VmValue vmValue) return vmValue.getVmClass().getPClassInfo();
+    if (value instanceof String) return PClassInfo.String;
+    if (value instanceof Boolean) return PClassInfo.Boolean;
+    if (value instanceof Long) return PClassInfo.Int;
+    if (value instanceof Double) return PClassInfo.Float;
+    throw new PklBugException("Not a Pkl value: " + value.getClass());
+  }
+
+  @SuppressWarnings("DuplicatedCode")
+  private static void getCandidateSubscriptType(PType type, Object key, Set<PType> result) {
+    if (type == PType.UNKNOWN) {
+      result.add(type);
+      return;
+    }
+    if (!(type instanceof PType.Class clazz)) {
+      return;
+    }
+    if (clazz.getPClass().getInfo() == PClassInfo.Dynamic) {
+      result.add(PType.UNKNOWN);
+      return;
+    }
+    if (clazz.getPClass().getInfo() == PClassInfo.Listing
+        || clazz.getPClass().getInfo() == PClassInfo.List) {
+      if (key instanceof Long) {
+        normalizeTypes(clazz.getTypeArguments().get(0), clazz.getPClass().getModuleClass(), result);
+      }
+      return;
+    }
+    if (clazz.getPClass().getInfo() == PClassInfo.Mapping
+        || clazz.getPClass().getInfo() == PClassInfo.Map) {
+      var typeArgs = clazz.getTypeArguments();
+      var keyTypes = normalizeTypes(typeArgs.get(0), clazz.getPClass().getModuleClass());
+      for (var kt : iterateTypes(keyTypes)) {
+        if (kt == PType.UNKNOWN
+            || (kt instanceof PType.Class klazz && klazz.getPClass().getInfo() == getClassInfo(key))
+            || (kt instanceof PType.StringLiteral stringLiteral
+                && stringLiteral.getLiteral().equals(key))) {
+          normalizeTypes(typeArgs.get(1), clazz.getPClass().getModuleClass(), result);
+          return;
+        }
+      }
+    }
+  }
+
+  /**
+   * Tells if this reference's referent type is a subtype of {@code type}. Does not check domain.
+   */
+  public boolean referentTypeIsSubtypeOf(PType type, PClass moduleClass) {
+    // fast path: if referent is unknown it can match any type check
+    if (referentType == PType.UNKNOWN) {
+      return true;
+    }
+
+    var checkType = normalizeTypes(type, moduleClass);
+    // fast path: short circuit if any referent is accepted
+    if (checkType == PType.UNKNOWN || isClass(checkType, BaseModule.getAnyClass().export())) {
+      return true;
+    }
+    // fast path: short circuit if nothing is accepted
+    if (checkType == PType.NOTHING) {
+      return false;
+    }
+
+    return isSubtype(referentType, checkType);
+  }
+
+  private static boolean containsClass(Set<PType> types, PClass pClass) {
+    for (var t : types) {
+      if (isClass(t, pClass)) return true;
+    }
+    return false;
+  }
+
+  private static boolean isClass(PType t, PClass pClass) {
+    return t instanceof PType.Class clazz && clazz.getPClass() == pClass;
+  }
+
+  private static boolean isSubtype(PType a, PType b) {
+    // checks if A is a subtype of B
+    // cases (A -> B)
+    // * A == B
+    // * StringLiteral -> StringLiteral: if literals are the same
+    // * StringLiteral -> Class: B is String
+    // * Char Alias -> Char Alias, StringLiteral (known single character)
+    // * Int Alias -> Class: B is a subtype of Number (Int|Float|Number)
+    // * Int Alias -> Alias
+    //   * same alias
+    //   * Int8 is Int16|Int32
+    //   * Int16 is Int32
+    //   * UInt8 is Int16|Int32|Uint16|UInt32|UInt
+    //   * UInt16 is Int32|UInt32|UInt
+    //   * UInt32 is UInt
+    // * Class -> Class: if same class or A is a subclass of B
+    //   * if type args are present, must have equal number of them
+    //   * for each pair of type args, check variance
+    //     * invariant: A_i must be identical to B_i
+    //     * covariant: A_i must be a subtype of B_i
+    //     * contravariant: B_i must be a subtype of A_i
+    // * Union -> Union: Each elem of A must be a subtype of at least one elem of B
+    // * Non-union -> Union: A must be a subtype of at least one elem of B
+    if (a == b) return true;
+
+    if (a instanceof PType.StringLiteral aStr) {
+      if (b instanceof PType.StringLiteral bStr) {
+        return aStr.getLiteral().equals(bStr.getLiteral());
+      } else if (b instanceof PType.Class bClass) {
+        return bClass.getPClass() == BaseModule.getStringClass().export();
+      }
+    } else if (a instanceof PType.Alias aAlias) {
+      var aa = aAlias.getTypeAlias();
+      if (isIntTypeAlias(aa)) {
+        // special casing for stdlib Int typealiases
+        if (b instanceof PType.Class bClass) {
+          // A is an int alias, B is a Number (sub)class
+          return bClass.getPClass().isSubclassOf(BaseModule.getNumberClass().export());
+        } else if (b instanceof PType.Alias bAlias) {
+          var bb = bAlias.getTypeAlias();
+          if (aa == bb) {
+            return true;
+          }
+          if (aa == BaseModule.getInt8TypeAlias().export()) {
+            return bb == BaseModule.getInt16TypeAlias().export()
+                || bb == BaseModule.getInt32TypeAlias().export();
+          } else if (aa == BaseModule.getInt16TypeAlias().export()) {
+            return bb == BaseModule.getInt32TypeAlias().export();
+          } else if (aa == BaseModule.getUInt8TypeAlias().export()) {
+            return bb == BaseModule.getInt16TypeAlias().export()
+                || bb == BaseModule.getInt32TypeAlias().export()
+                || bb == BaseModule.getUInt16TypeAlias().export()
+                || bb == BaseModule.getUInt32TypeAlias().export()
+                || bb == BaseModule.getUIntTypeAlias().export();
+          } else if (aa == BaseModule.getUInt16TypeAlias().export()) {
+            return bb == BaseModule.getInt32TypeAlias().export()
+                || bb == BaseModule.getUInt32TypeAlias().export()
+                || bb == BaseModule.getUIntTypeAlias().export();
+          } else if (aa == BaseModule.getUInt32TypeAlias().export()) {
+            return bb == BaseModule.getUIntTypeAlias().export();
+          }
+        }
+      }
+    } else if (a instanceof PType.Class aClass && b instanceof PType.Class bClass) {
+      if (!aClass.getPClass().isSubclassOf(bClass.getPClass())) {
+        return false;
+      }
+      var aArgs = aClass.getTypeArguments();
+      var bArgs = bClass.getTypeArguments();
+      var bParams = bClass.getPClass().getTypeParameters();
+      if (aArgs.size() != bArgs.size()) {
+        return false;
+      }
+      // check variance of type args pairwise
+      for (var i = 0; i < aArgs.size(); i++) {
+        if (!switch (bParams.get(i).getVariance()) {
+          case INVARIANT -> aArgs.get(i) == bArgs.get(i);
+          case COVARIANT -> isSubtype(aArgs.get(i), bArgs.get(i));
+          case CONTRAVARIANT -> isSubtype(bArgs.get(i), aArgs.get(i));
+        }) {
+          return false;
+        }
+      }
+      return true;
+    } else if (b instanceof PType.Union bUnion) {
+      if (a instanceof PType.Union aUnion) {
+        a:
+        for (var aElem : aUnion.getElementTypes()) {
+          for (var bElem : bUnion.getElementTypes()) {
+            if (isSubtype(aElem, bElem)) continue a;
+          }
+          return false;
+        }
+        return true;
+      } else {
+        for (var bElem : bUnion.getElementTypes()) {
+          if (isSubtype(a, bElem)) return true;
+        }
+      }
+    }
+    return false;
+  }
+
+  private static boolean isIntTypeAlias(TypeAlias t) {
+    return t == BaseModule.getInt8TypeAlias().export()
+        || t == BaseModule.getInt16TypeAlias().export()
+        || t == BaseModule.getInt32TypeAlias().export()
+        || t == BaseModule.getUInt8TypeAlias().export()
+        || t == BaseModule.getUInt16TypeAlias().export()
+        || t == BaseModule.getUInt32TypeAlias().export()
+        || t == BaseModule.getUIntTypeAlias().export();
+  }
+
+  private static boolean isPreservedTypeAlias(TypeAlias t) {
+    return isIntTypeAlias(t);
+  }
+
+  @Override
+  public VmClass getVmClass() {
+    return RefModule.getReferenceClass();
+  }
+
+  @Override
+  public void force(boolean allowUndefinedValues) {
+    if (forced) return;
+
+    forced = true;
+
+    domain.force(allowUndefinedValues);
+    VmValue.force(data, allowUndefinedValues);
+    for (var elem : path) {
+      elem.force(allowUndefinedValues);
+    }
+  }
+
+  @Override
+  public Reference export() {
+    var pathList = new ArrayList<Composite>(path.size());
+    for (var elem : path) {
+      pathList.add(elem.export());
+    }
+
+    return new Reference(domain.export(), VmValue.export(data), pathList, getReferentType());
+  }
+
+  public PType exportType() {
+    return new PType.Class(
+        RefModule.getReferenceClass().export(),
+        new PType.Class(domain.getVmClass().export()),
+        getReferentType());
+  }
+
+  @Override
+  public void accept(VmValueVisitor visitor) {
+    visitor.visitReference(this);
+  }
+
+  @Override
+  public <T> T accept(VmValueConverter<T> converter, Iterable<Object> path) {
+    return converter.convertReference(this, path);
+  }
+
+  @Override
+  public boolean equals(@Nullable Object o) {
+    if (o == this) return true;
+    if (!(o instanceof VmReference that)) {
+      return false;
+    }
+
+    return domain.equals(that.domain)
+        && data.equals(that.data)
+        && path.equals(that.path)
+        && referentType.equals(that.referentType);
+  }
+
+  @Override
+  public int hashCode() {
+    int result = domain.hashCode();
+    result = 31 * result + data.hashCode();
+    result = 31 * result + path.hashCode();
+    result = 31 * result + referentType.hashCode();
+    return result;
+  }
+
+  // in-language calls _should_ all go through `ToStringNode`.
+  // however, some calls escape through to here currently (e.g. `Listing.join`).
+  @Override
+  public String toString() {
+    var toStringMethod = getVmClass().getDeclaredMethod(Identifier.TO_STRING);
+    assert toStringMethod != null;
+    var callNode = DirectCallNode.create(toStringMethod.getCallTarget());
+    return (String) callNode.call(this, getVmClass().getPrototype());
+  }
+}

pkl-core/src/main/java/org/pkl/core/runtime/VmStackOverflowException.java

@@ -32,6 +32,7 @@ public final class VmStackOverflowException extends VmException {
         null,
         null,
         null,
-        new HashMap<>());
+        new HashMap<>(),
+        List.of());
   }
 }

pkl-core/src/main/java/org/pkl/core/runtime/VmTypeAlias.java

@@ -34,7 +34,7 @@ import org.pkl.core.ast.type.TypeNode;
 import org.pkl.core.ast.type.TypeNode.ConstrainedTypeNode;
 import org.pkl.core.ast.type.TypeNode.TypeVariableNode;
 import org.pkl.core.ast.type.TypeNode.UnknownTypeNode;
-import org.pkl.core.util.LateInit;
+import org.pkl.core.ast.type.UnresolvedTypeNode;
 
 public final class VmTypeAlias extends VmValue {
   private final SourceSection sourceSection;
@@ -48,17 +48,15 @@ public final class VmTypeAlias extends VmValue {
   private final List<TypeParameter> typeParameters;
   private final MaterializedFrame enclosingFrame;
 
-  @LateInit private TypeNode typeNode;
+  private @Nullable TypeNode typeNode;
 
-  @LateInit
   @GuardedBy("pTypeAliasLock")
-  private TypeAlias __pTypeAlias;
+  private @Nullable TypeAlias __pTypeAlias;
 
   private final Object pTypeAliasLock = new Object();
 
-  @LateInit
   @GuardedBy("mirrorLock")
-  private VmTyped __mirror;
+  private @Nullable VmTyped __mirror;
 
   private final Object mirrorLock = new Object();
 
@@ -86,7 +84,6 @@ public final class VmTypeAlias extends VmValue {
   }
 
   public void initTypeCheckNode(TypeNode typeNode) {
-    assert this.typeNode == null;
     this.typeNode = typeNode;
   }
 
@@ -100,6 +97,7 @@ public final class VmTypeAlias extends VmValue {
    */
   @TruffleBoundary
   public SourceSection getBaseTypeSection() {
+    assert typeNode != null;
     if (typeNode instanceof ConstrainedTypeNode constrainedTypeNode) {
       return constrainedTypeNode.getBaseTypeSection();
     }
@@ -116,6 +114,7 @@ public final class VmTypeAlias extends VmValue {
    */
   @TruffleBoundary
   public SourceSection getConstraintSection() {
+    assert typeNode != null;
     if (typeNode instanceof ConstrainedTypeNode) {
       return ((ConstrainedTypeNode) typeNode).getFirstConstraintSection();
     }
@@ -169,6 +168,7 @@ public final class VmTypeAlias extends VmValue {
   }
 
   public TypeNode getTypeNode() {
+    assert typeNode != null;
     return typeNode;
   }
 
@@ -178,14 +178,23 @@ public final class VmTypeAlias extends VmValue {
 
   @TruffleBoundary
   public TypeNode instantiate(TypeNode[] typeArgumentNodes) {
+    assert typeNode != null;
     // Cloning the type node means that the entire type check remains within a single root node,
     // which should be good for interpreted and compiled performance alike:
     // * Fewer root nodes to call
     // * ControlFlowException used to implement union types doesn't escape root node
+
+    if (typeParameters.isEmpty()) return (TypeNode) typeNode.deepCopy();
+
+    // handle if alias root is itself a type variable (https://github.com/apple/pkl/issues/1711)
+    if (typeNode instanceof TypeVariableNode typeVarNode) {
+      // no need to run validation since the arg itself has already been checked
+      return typeArgumentNodes.length == 0
+          ? new UnknownTypeNode(sourceSection)
+          : typeArgumentNodes[typeVarNode.getTypeParameterIndex()];
+    }
+
     var clone = (TypeNode) typeNode.deepCopy();
-
-    if (typeParameters.isEmpty()) return clone;
-
     clone.accept(
         node -> {
           if (node instanceof TypeVariableNode typeVarNode) {
@@ -196,6 +205,15 @@ public final class VmTypeAlias extends VmValue {
                 typeArgumentNodes.length == 0
                     ? new UnknownTypeNode(sourceSection)
                     : typeArgumentNodes[index]);
+          } else if (node instanceof UnresolvedTypeNode.TypeVariable unresolvedTypeVar) {
+            // Type variables inside constraint expressions (e.g. `every((it) -> it is T)`)
+            // are still unresolved at instantiation time. Replace them with a resolved
+            // unresolved type node that returns the concrete type argument.
+            var index = unresolvedTypeVar.getTypeParameterIndex();
+            node.replace(
+                typeArgumentNodes.length == 0
+                    ? new UnresolvedTypeNode.Unknown(sourceSection)
+                    : new UnresolvedTypeNode.Resolved(sourceSection, typeArgumentNodes[index]));
           }
           return true;
         });
@@ -228,7 +246,8 @@ public final class VmTypeAlias extends VmValue {
                 simpleName,
                 getModuleName(),
                 qualifiedName,
-                typeParameters);
+                typeParameters,
+                module.getVmClass().export());
 
         for (var parameter : typeParameters) {
           parameter.initOwner(__pTypeAlias);
@@ -264,6 +283,7 @@ public final class VmTypeAlias extends VmValue {
   }
 
   public VmTyped getTypeMirror() {
+    assert typeNode != null;
     return typeNode.getMirror();
   }
 

pkl-core/src/main/java/org/pkl/core/runtime/VmTyped.java

@@ -29,10 +29,9 @@ import org.pkl.core.ast.ExpressionNode;
 import org.pkl.core.ast.expression.unary.ImportNode;
 import org.pkl.core.ast.member.ObjectMember;
 import org.pkl.core.util.EconomicMaps;
-import org.pkl.core.util.LateInit;
 
 public final class VmTyped extends VmObject {
-  @CompilationFinal @LateInit private VmClass clazz;
+  @CompilationFinal private @Nullable VmClass clazz;
 
   public VmTyped(
       MaterializedFrame enclosingFrame,
@@ -162,6 +161,8 @@ public final class VmTyped extends VmObject {
   @Override
   @TruffleBoundary
   public Composite export() {
+    assert forced : "Value was not forced prior to export";
+    assert clazz != null;
     if (!isModuleObject()) {
       return new PObject(clazz.getPClassInfo(), exportMembers());
     }
@@ -190,6 +191,7 @@ public final class VmTyped extends VmObject {
     if (this == obj) return true;
     if (!(obj instanceof VmTyped other)) return false;
 
+    assert clazz != null;
     if (clazz != other.clazz) return false;
     // could use shallow force, but deep force is cached
     force(false);
@@ -210,6 +212,7 @@ public final class VmTyped extends VmObject {
   public int hashCode() {
     if (cachedHash != 0) return cachedHash;
 
+    assert clazz != null;
     force(false);
     var result = 0;
 

pkl-core/src/main/java/org/pkl/core/runtime/VmTypes.java

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -40,6 +40,7 @@ import com.oracle.truffle.api.dsl.TypeSystem;
   VmRegex.class,
   VmTypeAlias.class,
   VmObjectLike.class,
-  VmValue.class
+  VmReference.class,
+  VmValue.class,
 })
 public class VmTypes {}

pkl-core/src/main/java/org/pkl/core/runtime/VmUndefinedValueException.java

@@ -43,7 +43,8 @@ public final class VmUndefinedValueException extends VmEvalException {
       @Nullable String memberName,
       @Nullable BiConsumer<AnsiStringBuilder, Boolean> hintBuilder,
       @Nullable Object receiver,
-      @Nullable Map<CallTarget, StackFrame> insertedStackFrames) {
+      @Nullable Map<CallTarget, StackFrame> insertedStackFrames,
+      List<StackFrame> leadingStackFrames) {
 
     super(
         message,
@@ -56,7 +57,8 @@ public final class VmUndefinedValueException extends VmEvalException {
         sourceSection,
         memberName,
         hintBuilder,
-        insertedStackFrames == null ? Collections.emptyMap() : insertedStackFrames);
+        insertedStackFrames == null ? Collections.emptyMap() : insertedStackFrames,
+        leadingStackFrames);
 
     this.receiver = receiver;
   }

pkl-core/src/main/java/org/pkl/core/runtime/VmValueConverter.java

@@ -85,6 +85,8 @@ public interface VmValueConverter<T> {
 
   T convertFunction(VmFunction value, Iterable<Object> path);
 
+  T convertReference(VmReference value, Iterable<Object> path);
+
   /** Returns with an empty identifier if the second value is a RenderDirective */
   Pair<Identifier, T> convertProperty(ClassProperty property, Object value, Iterable<Object> path);
 

pkl-core/src/main/java/org/pkl/core/runtime/VmValueRenderer.java

@@ -271,6 +271,30 @@ public final class VmValueRenderer {
       append("null");
     }
 
+    @Override
+    public void visitReference(VmReference value) {
+      contexts.push(Context.EXPLICIT);
+      append("Reference(");
+      visit(value.getDomain());
+      append(", ");
+      append(value.getReferentType());
+      append(", ");
+      visit(value.getData());
+      append(")");
+      for (var elem : value.getPath()) {
+        var property = VmUtils.readMember(elem, Identifier.PROPERTY);
+        if (property instanceof String propName) {
+          append(".");
+          writeIdentifier(propName);
+        } else {
+          append("[");
+          visit(VmUtils.readMember(elem, Identifier.KEY));
+          append("]");
+        }
+      }
+      contexts.pop();
+    }
+
     private void append(Object value) {
       builder.append(value);
       checkLengthLimit();

pkl-core/src/main/java/org/pkl/core/runtime/VmValueVisitor.java

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024-2025 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -60,6 +60,8 @@ public interface VmValueVisitor {
 
   void visitFunction(VmFunction value);
 
+  void visitReference(VmReference value);
+
   default void visit(Object value) {
     Objects.requireNonNull(value, "Value to be visited must be non-null.");
 

pkl-core/src/main/java/org/pkl/core/runtime/VmWrappedEvalException.java

@@ -41,6 +41,7 @@ public class VmWrappedEvalException extends VmEvalException {
       @Nullable String memberName,
       @Nullable BiConsumer<AnsiStringBuilder, Boolean> hintBuilder,
       Map<CallTarget, StackFrame> insertedStackFrames,
+      List<StackFrame> leadingStackFrames,
       VmException wrappedException) {
     super(
         message,
@@ -53,7 +54,8 @@ public class VmWrappedEvalException extends VmEvalException {
         sourceSection,
         memberName,
         hintBuilder,
-        insertedStackFrames);
+        insertedStackFrames,
+        leadingStackFrames);
     this.wrappedException = wrappedException;
   }
 

pkl-core/src/main/java/org/pkl/core/stdlib/AbstractRenderer.java

@@ -34,6 +34,7 @@ import org.pkl.core.runtime.VmListing;
 import org.pkl.core.runtime.VmMap;
 import org.pkl.core.runtime.VmMapping;
 import org.pkl.core.runtime.VmNull;
+import org.pkl.core.runtime.VmReference;
 import org.pkl.core.runtime.VmSet;
 import org.pkl.core.runtime.VmTypeAlias;
 import org.pkl.core.runtime.VmTyped;
@@ -397,6 +398,11 @@ public abstract class AbstractRenderer implements VmValueVisitor {
     currSourceSection = prevSourceSection;
   }
 
+  @Override
+  public void visitReference(VmReference value) {
+    cannotRenderTypeAddConverter(value);
+  }
+
   protected void cannotRenderTypeAddConverter(VmValue value) {
     var builder =
         new VmExceptionBuilder()