Fix errors around strings with lone high or low surrogates (#1673)

This fixes some errors around treatment of strings with lone high/low
surrogates.

.git-blame-ignore-revs

@@ -1,2 +1,4 @@
 # Auto-format Kotlin code
 816cd483c8adf4c04e14236c173a1dc6bd2579ea
+# Format Kotlin code again
+2b3603b544bae2ad87374b65afaf8ac018216261

.github/PklProject

@@ -2,7 +2,7 @@ amends "pkl:Project"
 
 dependencies {
   ["pkl.impl.ghactions"] {
-    uri = "package://pkg.pkl-lang.org/pkl-project-commons/pkl.impl.ghactions@1.6.0"
+    uri = "package://pkg.pkl-lang.org/pkl-project-commons/pkl.impl.ghactions@1.8.1"
   }
   ["gha"] {
     uri = "package://pkg.pkl-lang.org/pkl-pantry/com.github.actions@1.4.0"

.github/PklProject.deps.json

@@ -3,16 +3,16 @@
   "resolvedDependencies": {
     "package://pkg.pkl-lang.org/pkl-pantry/com.github.actions@1": {
       "type": "remote",
-      "uri": "projectpackage://pkg.pkl-lang.org/pkl-pantry/com.github.actions@1.4.0",
+      "uri": "projectpackage://pkg.pkl-lang.org/pkl-pantry/com.github.actions@1.7.0",
       "checksums": {
-        "sha256": "e0b9a9f71071d6101e9d764c069b2ec4a597d5315cb6e4c265b3f0d90c2b482c"
+        "sha256": "e3461c3f8d00a6a657f9fa4f391afdab4a53a2e528862a4d8624e545cd3cb2b1"
       }
     },
     "package://pkg.pkl-lang.org/pkl-project-commons/pkl.impl.ghactions@1": {
       "type": "remote",
-      "uri": "projectpackage://pkg.pkl-lang.org/pkl-project-commons/pkl.impl.ghactions@1.6.0",
+      "uri": "projectpackage://pkg.pkl-lang.org/pkl-project-commons/pkl.impl.ghactions@1.8.1",
       "checksums": {
-        "sha256": "fbc3c456ea468a0fe6baa9b3d30167259ac04e721a41a10fe82d2970026f0b1d"
+        "sha256": "476cd931de6868b3f5e088ac741261d7beb9f4de3305564675510fd74ffb83f3"
       }
     },
     "package://pkg.pkl-lang.org/pkl-pantry/pkl.experimental.deepToTyped@1": {
@@ -24,16 +24,16 @@
     },
     "package://pkg.pkl-lang.org/pkl-pantry/pkl.github.dependabotManagedActions@1": {
       "type": "remote",
-      "uri": "projectpackage://pkg.pkl-lang.org/pkl-pantry/pkl.github.dependabotManagedActions@1.1.0",
+      "uri": "projectpackage://pkg.pkl-lang.org/pkl-pantry/pkl.github.dependabotManagedActions@1.1.6",
       "checksums": {
-        "sha256": "025fac778f2c5f75c8229fa4ec0f49ebdb99a61affe9aae489fefd8fccd92faa"
+        "sha256": "85ad51d257bad4729f0b9edecade48fcad6f55bacd0fa36106782475e912919a"
       }
     },
     "package://pkg.pkl-lang.org/pkl-pantry/com.github.dependabot@1": {
       "type": "remote",
-      "uri": "projectpackage://pkg.pkl-lang.org/pkl-pantry/com.github.dependabot@1.0.1",
+      "uri": "projectpackage://pkg.pkl-lang.org/pkl-pantry/com.github.dependabot@1.0.4",
       "checksums": {
-        "sha256": "0a4fe9b0983716ec49fb060b9e5e83f8c365eb899d517123b43134416a9574b6"
+        "sha256": "c7391119f946d7761d0ca0cc358ed8fe2bdfc691411087ccac89637bd96fec4a"
       }
     }
   }

.github/codeql.pkl

@@ -1,67 +0,0 @@
-amends "@gha/Workflow.pkl"
-
-import "@gha/catalog.pkl"
-
-on {
-  push {
-    branches {
-      "main"
-    }
-  }
-  pull_request {}
-  schedule {
-    // Run at 01:38 on Saturday
-    new { cron = "38 1 * * 6" }
-  }
-}
-
-local class CodeQLScan {
-  language: String
-
-  `build-mode`: String
-}
-
-local scans: Listing<CodeQLScan> = new {
-  new {
-    language = "actions"
-    `build-mode` = "none"
-  }
-  new {
-    language = "java-kotlin"
-    `build-mode` = "autobuild"
-  }
-  new {
-    language = "javascript-typescript"
-    `build-mode` = "none"
-  }
-}
-
-jobs {
-  for (scan in scans) {
-    ["analyze-\(scan.language)"] {
-      name = "Analyze (\(scan.language))"
-      `runs-on` = "ubuntu-latest"
-      permissions {
-        `security-events` = "write"
-      }
-      steps {
-        catalog.`actions/checkout@v6`
-        new {
-          name = "Initialize CodeQL"
-          uses = "github/codeql-action/init@v4"
-          with {
-            ["languages"] = scan.language
-            ["build-mode"] = scan.`build-mode`
-          }
-        }
-        new {
-          name = "Perform CodeQL Analysis"
-          uses = "github/codeql-action/analyze@v4"
-          with {
-            ["category"] = "/language:\(scan.language)"
-          }
-        }
-      }
-    }
-  }
-}

.github/index.pkl

@@ -9,7 +9,6 @@ import "jobs/GithubRelease.pkl"
 import "jobs/GradleJob.pkl"
 import "jobs/PklJob.pkl"
 import "jobs/SimpleGradleJob.pkl"
-import "codeql.pkl"
 
 triggerDocsBuild = "both"
 
@@ -241,7 +240,15 @@ dependabot {
   }
 }
 
-workflows {
-  // add codeql workflow to set of workflows
-  ["workflows/codeql.yml"] = codeql
+codeql {
+  scans {
+    new {
+      language = "java-kotlin"
+      buildMode = "autobuild"
+    }
+    new {
+      language = "javascript-typescript"
+      buildMode = "none"
+    }
+  }
 }

.github/jobs/GradleJob.pkl

@@ -3,6 +3,7 @@ abstract module GradleJob
 extends "PklJob.pkl"
 
 import "@gha/Workflow.pkl"
+import "@gha/context.pkl"
 import "@pkl.impl.ghactions/catalog.pkl"
 
 /// Whether this is a release build or not.
@@ -29,8 +30,7 @@ fetchDepth: Int?
 
 fixed gradleArgs =
   new Listing {
-    "--info"
-    "--stacktrace"
+    "$DEBUG_ARGS"
     "--no-daemon"
     "-DpklMultiJdkTesting=true"
     when (isRelease) {
@@ -97,6 +97,20 @@ fixed job {
         }
       }
     }
+    new {
+      name = "Set DEBUG_ARGS env var"
+      env {
+        ["RUNNER_DEBUG"] = context.runner.debug
+      }
+      shell = "bash"
+      // language=bash
+      run =
+        """
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
+        """
+    }
     ...module.steps
   }
 }

.github/workflows/__lockfile__.yml

@@ -31,9 +31,9 @@ jobs:
     - name: dawidd6/action-download-artifact@v11
       uses: dawidd6/action-download-artifact@ac66b43f0e6a346234dd65d4d0c8fbb31cb316e5 # v11
     - name: github/codeql-action/analyze@v4
-      uses: github/codeql-action/analyze@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4
+      uses: github/codeql-action/analyze@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4
     - name: github/codeql-action/init@v4
-      uses: github/codeql-action/init@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4
+      uses: github/codeql-action/init@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4
     - name: gradle/actions/dependency-submission@v6
       uses: gradle/actions/dependency-submission@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6
     - name: gradle/actions/setup-gradle@v5

.github/workflows/build.yml

@@ -30,9 +30,17 @@ jobs:
         architecture: x64
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
     - name: check
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true check
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true check
     - name: Upload Test Result XML
       if: '!cancelled()'
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
@@ -63,9 +71,17 @@ jobs:
         architecture: x64
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
     - name: check
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true check
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true check
     - name: Upload Test Result XML
       if: '!cancelled()'
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
@@ -94,9 +110,17 @@ jobs:
         architecture: x64
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
     - name: bench:jmh
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true bench:jmh
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true bench:jmh
   gradle-compatibility:
     runs-on: ubuntu-latest
     env:
@@ -113,9 +137,17 @@ jobs:
         architecture: x64
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
     - name: :pkl-gradle:build :pkl-gradle:compatibilityTestReleases
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true :pkl-gradle:build :pkl-gradle:compatibilityTestReleases
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true :pkl-gradle:build :pkl-gradle:compatibilityTestReleases
     - name: Upload Test Result XML
       if: '!cancelled()'
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
@@ -145,12 +177,20 @@ jobs:
         architecture: x64
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
     - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
       with:
         persist-credentials: false
     - name: gradle build java executables
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-doc:build pkl-cli:build pkl-codegen-java:build pkl-codegen-kotlin:build
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true pkl-doc:build pkl-cli:build pkl-codegen-java:build pkl-codegen-kotlin:build
     - name: Upload executable artifacts
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
@@ -187,9 +227,17 @@ jobs:
         architecture: x64
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
     - name: gradle buildNative
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -Dpkl.targetArch=amd64 "-Dpkl.native--native-compiler-path=${GITHUB_WORKSPACE}/.github/scripts/cc_macos_amd64.sh" pkl-cli:buildNative
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true -Dpkl.targetArch=amd64 "-Dpkl.native--native-compiler-path=${GITHUB_WORKSPACE}/.github/scripts/cc_macos_amd64.sh" pkl-cli:buildNative
     - name: Upload executable artifacts
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
@@ -225,11 +273,19 @@ jobs:
         architecture: x64
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
     - name: Fix git ownership
       run: git status || git config --system --add safe.directory "$GITHUB_WORKSPACE"
     - name: gradle buildNative
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-cli:buildNative
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true pkl-cli:buildNative
     - name: Upload executable artifacts
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
@@ -268,9 +324,17 @@ jobs:
         architecture: aarch64
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
     - name: gradle buildNative
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-cli:buildNative
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true pkl-cli:buildNative
     - name: Upload executable artifacts
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
@@ -306,11 +370,19 @@ jobs:
         architecture: aarch64
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
     - name: Fix git ownership
       run: git status || git config --system --add safe.directory "$GITHUB_WORKSPACE"
     - name: gradle buildNative
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-cli:buildNative
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true pkl-cli:buildNative
     - name: Upload executable artifacts
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
@@ -346,6 +418,14 @@ jobs:
         architecture: x64
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
     - name: Install musl and zlib
       run: |
         set -e
@@ -421,7 +501,7 @@ jobs:
         echo "${HOME}/staticdeps/bin" >> "$GITHUB_PATH"
     - name: gradle buildNative
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -Dpkl.musl=true pkl-cli:buildNative
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true -Dpkl.musl=true pkl-cli:buildNative
     - name: Upload executable artifacts
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
@@ -456,9 +536,17 @@ jobs:
         architecture: x64
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
     - name: gradle buildNative
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-cli:buildNative
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true pkl-cli:buildNative
     - name: Upload executable artifacts
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
@@ -495,9 +583,17 @@ jobs:
         architecture: x64
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
     - name: gradle buildNative
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -Dpkl.targetArch=amd64 "-Dpkl.native--native-compiler-path=${GITHUB_WORKSPACE}/.github/scripts/cc_macos_amd64.sh" pkl-doc:buildNative
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true -Dpkl.targetArch=amd64 "-Dpkl.native--native-compiler-path=${GITHUB_WORKSPACE}/.github/scripts/cc_macos_amd64.sh" pkl-doc:buildNative
     - name: Upload executable artifacts
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
@@ -533,11 +629,19 @@ jobs:
         architecture: x64
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
     - name: Fix git ownership
       run: git status || git config --system --add safe.directory "$GITHUB_WORKSPACE"
     - name: gradle buildNative
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-doc:buildNative
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true pkl-doc:buildNative
     - name: Upload executable artifacts
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
@@ -576,9 +680,17 @@ jobs:
         architecture: aarch64
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
     - name: gradle buildNative
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-doc:buildNative
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true pkl-doc:buildNative
     - name: Upload executable artifacts
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
@@ -614,11 +726,19 @@ jobs:
         architecture: aarch64
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
     - name: Fix git ownership
       run: git status || git config --system --add safe.directory "$GITHUB_WORKSPACE"
     - name: gradle buildNative
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-doc:buildNative
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true pkl-doc:buildNative
     - name: Upload executable artifacts
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
@@ -654,6 +774,14 @@ jobs:
         architecture: x64
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
     - name: Install musl and zlib
       run: |
         set -e
@@ -729,7 +857,7 @@ jobs:
         echo "${HOME}/staticdeps/bin" >> "$GITHUB_PATH"
     - name: gradle buildNative
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -Dpkl.musl=true pkl-doc:buildNative
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true -Dpkl.musl=true pkl-doc:buildNative
     - name: Upload executable artifacts
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
@@ -764,9 +892,17 @@ jobs:
         architecture: x64
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
     - name: gradle buildNative
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-doc:buildNative
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true pkl-doc:buildNative
     - name: Upload executable artifacts
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:

.github/workflows/codeql.yml

@@ -1,11 +1,13 @@
 # Generated from Workflow.pkl. DO NOT EDIT.
 'on':
-  pull_request: {}
+  pull_request:
+    branches:
+    - main
   push:
     branches:
     - main
   schedule:
-  - cron: 38 1 * * 6
+  - cron: 29 17 * * 4
 jobs:
   analyze-actions:
     name: Analyze (actions)
@@ -16,13 +18,12 @@ jobs:
     - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
       with:
         persist-credentials: false
-    - name: Initialize CodeQL
-      uses: github/codeql-action/init@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4
+    - uses: github/codeql-action/init@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4
       with:
         languages: actions
         build-mode: none
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4
+      uses: github/codeql-action/analyze@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4
       with:
         category: /language:actions
   analyze-java-kotlin:
@@ -34,13 +35,12 @@ jobs:
     - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
       with:
         persist-credentials: false
-    - name: Initialize CodeQL
-      uses: github/codeql-action/init@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4
+    - uses: github/codeql-action/init@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4
       with:
         languages: java-kotlin
         build-mode: autobuild
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4
+      uses: github/codeql-action/analyze@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4
       with:
         category: /language:java-kotlin
   analyze-javascript-typescript:
@@ -52,12 +52,11 @@ jobs:
     - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
       with:
         persist-credentials: false
-    - name: Initialize CodeQL
-      uses: github/codeql-action/init@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4
+    - uses: github/codeql-action/init@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4
       with:
         languages: javascript-typescript
         build-mode: none
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4
+      uses: github/codeql-action/analyze@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4
       with:
         category: /language:javascript-typescript

.github/workflows/main.yml

@@ -28,9 +28,17 @@ jobs:
         architecture: x64
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
     - name: check
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true check
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true check
     - name: Upload Test Result XML
       if: '!cancelled()'
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
@@ -61,9 +69,17 @@ jobs:
         architecture: x64
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
     - name: check
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true check
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true check
     - name: Upload Test Result XML
       if: '!cancelled()'
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
@@ -92,9 +108,17 @@ jobs:
         architecture: x64
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
     - name: bench:jmh
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true bench:jmh
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true bench:jmh
   gradle-compatibility:
     runs-on: ubuntu-latest
     env:
@@ -111,9 +135,17 @@ jobs:
         architecture: x64
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
     - name: :pkl-gradle:build :pkl-gradle:compatibilityTestReleases
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true :pkl-gradle:build :pkl-gradle:compatibilityTestReleases
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true :pkl-gradle:build :pkl-gradle:compatibilityTestReleases
     - name: Upload Test Result XML
       if: '!cancelled()'
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
@@ -143,12 +175,20 @@ jobs:
         architecture: x64
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
     - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
       with:
         persist-credentials: false
     - name: gradle build java executables
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-doc:build pkl-cli:build pkl-codegen-java:build pkl-codegen-kotlin:build
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true pkl-doc:build pkl-cli:build pkl-codegen-java:build pkl-codegen-kotlin:build
     - name: Upload executable artifacts
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
@@ -185,9 +225,17 @@ jobs:
         architecture: x64
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
     - name: gradle buildNative
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -Dpkl.targetArch=amd64 "-Dpkl.native--native-compiler-path=${GITHUB_WORKSPACE}/.github/scripts/cc_macos_amd64.sh" pkl-cli:buildNative
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true -Dpkl.targetArch=amd64 "-Dpkl.native--native-compiler-path=${GITHUB_WORKSPACE}/.github/scripts/cc_macos_amd64.sh" pkl-cli:buildNative
     - name: Upload executable artifacts
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
@@ -223,11 +271,19 @@ jobs:
         architecture: x64
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
     - name: Fix git ownership
       run: git status || git config --system --add safe.directory "$GITHUB_WORKSPACE"
     - name: gradle buildNative
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-cli:buildNative
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true pkl-cli:buildNative
     - name: Upload executable artifacts
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
@@ -266,9 +322,17 @@ jobs:
         architecture: aarch64
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
     - name: gradle buildNative
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-cli:buildNative
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true pkl-cli:buildNative
     - name: Upload executable artifacts
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
@@ -304,11 +368,19 @@ jobs:
         architecture: aarch64
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
     - name: Fix git ownership
       run: git status || git config --system --add safe.directory "$GITHUB_WORKSPACE"
     - name: gradle buildNative
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-cli:buildNative
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true pkl-cli:buildNative
     - name: Upload executable artifacts
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
@@ -344,6 +416,14 @@ jobs:
         architecture: x64
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
     - name: Install musl and zlib
       run: |
         set -e
@@ -419,7 +499,7 @@ jobs:
         echo "${HOME}/staticdeps/bin" >> "$GITHUB_PATH"
     - name: gradle buildNative
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -Dpkl.musl=true pkl-cli:buildNative
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true -Dpkl.musl=true pkl-cli:buildNative
     - name: Upload executable artifacts
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
@@ -454,9 +534,17 @@ jobs:
         architecture: x64
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
     - name: gradle buildNative
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-cli:buildNative
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true pkl-cli:buildNative
     - name: Upload executable artifacts
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
@@ -493,9 +581,17 @@ jobs:
         architecture: x64
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
     - name: gradle buildNative
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -Dpkl.targetArch=amd64 "-Dpkl.native--native-compiler-path=${GITHUB_WORKSPACE}/.github/scripts/cc_macos_amd64.sh" pkl-doc:buildNative
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true -Dpkl.targetArch=amd64 "-Dpkl.native--native-compiler-path=${GITHUB_WORKSPACE}/.github/scripts/cc_macos_amd64.sh" pkl-doc:buildNative
     - name: Upload executable artifacts
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
@@ -531,11 +627,19 @@ jobs:
         architecture: x64
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
     - name: Fix git ownership
       run: git status || git config --system --add safe.directory "$GITHUB_WORKSPACE"
     - name: gradle buildNative
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-doc:buildNative
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true pkl-doc:buildNative
     - name: Upload executable artifacts
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
@@ -574,9 +678,17 @@ jobs:
         architecture: aarch64
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
     - name: gradle buildNative
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-doc:buildNative
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true pkl-doc:buildNative
     - name: Upload executable artifacts
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
@@ -612,11 +724,19 @@ jobs:
         architecture: aarch64
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
     - name: Fix git ownership
       run: git status || git config --system --add safe.directory "$GITHUB_WORKSPACE"
     - name: gradle buildNative
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-doc:buildNative
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true pkl-doc:buildNative
     - name: Upload executable artifacts
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
@@ -652,6 +772,14 @@ jobs:
         architecture: x64
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
     - name: Install musl and zlib
       run: |
         set -e
@@ -727,7 +855,7 @@ jobs:
         echo "${HOME}/staticdeps/bin" >> "$GITHUB_PATH"
     - name: gradle buildNative
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -Dpkl.musl=true pkl-doc:buildNative
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true -Dpkl.musl=true pkl-doc:buildNative
     - name: Upload executable artifacts
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
@@ -762,9 +890,17 @@ jobs:
         architecture: x64
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
     - name: gradle buildNative
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-doc:buildNative
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true pkl-doc:buildNative
     - name: Upload executable artifacts
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
@@ -817,6 +953,14 @@ jobs:
         architecture: x64
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
     - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
       with:
         persist-credentials: false
@@ -830,7 +974,7 @@ jobs:
         ORG_GRADLE_PROJECT_signingPassword: ${{ secrets.ORG_GRADLE_PROJECT_SIGNINGPASSWORD }}
         ORG_GRADLE_PROJECT_sonatypePassword: ${{ secrets.ORG_GRADLE_PROJECT_SONATYPEPASSWORD }}
         ORG_GRADLE_PROJECT_sonatypeUsername: ${{ secrets.ORG_GRADLE_PROJECT_SONATYPEUSERNAME }}
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true --no-parallel publishToSonatype
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true --no-parallel publishToSonatype
   dependency-submission:
     permissions:
       contents: write

.github/workflows/prb.yml

@@ -24,9 +24,17 @@ jobs:
         architecture: x64
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
     - name: check
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true check
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true check
     - name: Upload Test Result XML
       if: '!cancelled()'
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
@@ -59,9 +67,17 @@ jobs:
         architecture: x64
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
     - name: check
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true check
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true check
     - name: Upload Test Result XML
       if: '!cancelled()'
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
@@ -94,9 +110,17 @@ jobs:
         architecture: x64
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
     - name: gradle buildNative
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -Dpkl.targetArch=amd64 "-Dpkl.native--native-compiler-path=${GITHUB_WORKSPACE}/.github/scripts/cc_macos_amd64.sh" pkl-cli:buildNative
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true -Dpkl.targetArch=amd64 "-Dpkl.native--native-compiler-path=${GITHUB_WORKSPACE}/.github/scripts/cc_macos_amd64.sh" pkl-cli:buildNative
     - name: Upload executable artifacts
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
@@ -134,11 +158,19 @@ jobs:
         architecture: x64
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
     - name: Fix git ownership
       run: git status || git config --system --add safe.directory "$GITHUB_WORKSPACE"
     - name: gradle buildNative
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-cli:buildNative
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true pkl-cli:buildNative
     - name: Upload executable artifacts
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
@@ -178,9 +210,17 @@ jobs:
         architecture: aarch64
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
     - name: gradle buildNative
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-cli:buildNative
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true pkl-cli:buildNative
     - name: Upload executable artifacts
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
@@ -218,11 +258,19 @@ jobs:
         architecture: aarch64
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
     - name: Fix git ownership
       run: git status || git config --system --add safe.directory "$GITHUB_WORKSPACE"
     - name: gradle buildNative
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-cli:buildNative
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true pkl-cli:buildNative
     - name: Upload executable artifacts
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
@@ -260,6 +308,14 @@ jobs:
         architecture: x64
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
     - name: Install musl and zlib
       run: |
         set -e
@@ -335,7 +391,7 @@ jobs:
         echo "${HOME}/staticdeps/bin" >> "$GITHUB_PATH"
     - name: gradle buildNative
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -Dpkl.musl=true pkl-cli:buildNative
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true -Dpkl.musl=true pkl-cli:buildNative
     - name: Upload executable artifacts
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
@@ -372,9 +428,17 @@ jobs:
         architecture: x64
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
     - name: gradle buildNative
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-cli:buildNative
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true pkl-cli:buildNative
     - name: Upload executable artifacts
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
@@ -412,9 +476,17 @@ jobs:
         architecture: x64
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
     - name: gradle buildNative
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -Dpkl.targetArch=amd64 "-Dpkl.native--native-compiler-path=${GITHUB_WORKSPACE}/.github/scripts/cc_macos_amd64.sh" pkl-doc:buildNative
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true -Dpkl.targetArch=amd64 "-Dpkl.native--native-compiler-path=${GITHUB_WORKSPACE}/.github/scripts/cc_macos_amd64.sh" pkl-doc:buildNative
     - name: Upload executable artifacts
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
@@ -452,11 +524,19 @@ jobs:
         architecture: x64
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
     - name: Fix git ownership
       run: git status || git config --system --add safe.directory "$GITHUB_WORKSPACE"
     - name: gradle buildNative
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-doc:buildNative
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true pkl-doc:buildNative
     - name: Upload executable artifacts
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
@@ -496,9 +576,17 @@ jobs:
         architecture: aarch64
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
     - name: gradle buildNative
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-doc:buildNative
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true pkl-doc:buildNative
     - name: Upload executable artifacts
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
@@ -536,11 +624,19 @@ jobs:
         architecture: aarch64
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
     - name: Fix git ownership
       run: git status || git config --system --add safe.directory "$GITHUB_WORKSPACE"
     - name: gradle buildNative
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-doc:buildNative
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true pkl-doc:buildNative
     - name: Upload executable artifacts
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
@@ -578,6 +674,14 @@ jobs:
         architecture: x64
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
     - name: Install musl and zlib
       run: |
         set -e
@@ -653,7 +757,7 @@ jobs:
         echo "${HOME}/staticdeps/bin" >> "$GITHUB_PATH"
     - name: gradle buildNative
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -Dpkl.musl=true pkl-doc:buildNative
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true -Dpkl.musl=true pkl-doc:buildNative
     - name: Upload executable artifacts
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
@@ -690,9 +794,17 @@ jobs:
         architecture: x64
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
     - name: gradle buildNative
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-doc:buildNative
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true pkl-doc:buildNative
     - name: Upload executable artifacts
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
@@ -712,6 +824,31 @@ jobs:
         name: test-results-html-pkl-doc-windows-amd64-snapshot
         path: '**/build/reports/tests/**/*'
         if-no-files-found: ignore
+  verdict:
+    if: always()
+    needs:
+    - check-pkl-github-actions
+    - gradle-check
+    - gradle-check-windows
+    - pkl-cli-macOS-amd64-snapshot
+    - pkl-cli-linux-amd64-snapshot
+    - pkl-cli-macOS-aarch64-snapshot
+    - pkl-cli-linux-aarch64-snapshot
+    - pkl-cli-alpine-linux-amd64-snapshot
+    - pkl-cli-windows-amd64-snapshot
+    - pkl-doc-macOS-amd64-snapshot
+    - pkl-doc-linux-amd64-snapshot
+    - pkl-doc-macOS-aarch64-snapshot
+    - pkl-doc-linux-aarch64-snapshot
+    - pkl-doc-alpine-linux-amd64-snapshot
+    - pkl-doc-windows-amd64-snapshot
+    runs-on: ubuntu-latest
+    steps:
+    - name: Failure verdict
+      if: contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled')
+      run: |-
+        echo "Some of the required jobs are either failing or were cancelled"
+        exit 1
   upload-event-file:
     runs-on: ubuntu-latest
     steps:

.github/workflows/release-branch.yml

@@ -28,9 +28,17 @@ jobs:
         architecture: x64
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
     - name: check
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true check
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true check
     - name: Upload Test Result XML
       if: '!cancelled()'
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
@@ -61,9 +69,17 @@ jobs:
         architecture: x64
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
     - name: check
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true check
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true check
     - name: Upload Test Result XML
       if: '!cancelled()'
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
@@ -92,9 +108,17 @@ jobs:
         architecture: x64
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
     - name: bench:jmh
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true bench:jmh
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true bench:jmh
   gradle-compatibility:
     runs-on: ubuntu-latest
     env:
@@ -111,9 +135,17 @@ jobs:
         architecture: x64
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
     - name: :pkl-gradle:build :pkl-gradle:compatibilityTestReleases
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true :pkl-gradle:build :pkl-gradle:compatibilityTestReleases
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true :pkl-gradle:build :pkl-gradle:compatibilityTestReleases
     - name: Upload Test Result XML
       if: '!cancelled()'
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
@@ -143,12 +175,20 @@ jobs:
         architecture: x64
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
     - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
       with:
         persist-credentials: false
     - name: gradle build java executables
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-doc:build pkl-cli:build pkl-codegen-java:build pkl-codegen-kotlin:build
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true pkl-doc:build pkl-cli:build pkl-codegen-java:build pkl-codegen-kotlin:build
     - name: Upload executable artifacts
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
@@ -185,9 +225,17 @@ jobs:
         architecture: x64
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
     - name: gradle buildNative
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -Dpkl.targetArch=amd64 "-Dpkl.native--native-compiler-path=${GITHUB_WORKSPACE}/.github/scripts/cc_macos_amd64.sh" pkl-cli:buildNative
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true -Dpkl.targetArch=amd64 "-Dpkl.native--native-compiler-path=${GITHUB_WORKSPACE}/.github/scripts/cc_macos_amd64.sh" pkl-cli:buildNative
     - name: Upload executable artifacts
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
@@ -223,11 +271,19 @@ jobs:
         architecture: x64
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
     - name: Fix git ownership
       run: git status || git config --system --add safe.directory "$GITHUB_WORKSPACE"
     - name: gradle buildNative
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-cli:buildNative
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true pkl-cli:buildNative
     - name: Upload executable artifacts
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
@@ -266,9 +322,17 @@ jobs:
         architecture: aarch64
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
     - name: gradle buildNative
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-cli:buildNative
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true pkl-cli:buildNative
     - name: Upload executable artifacts
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
@@ -304,11 +368,19 @@ jobs:
         architecture: aarch64
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
     - name: Fix git ownership
       run: git status || git config --system --add safe.directory "$GITHUB_WORKSPACE"
     - name: gradle buildNative
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-cli:buildNative
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true pkl-cli:buildNative
     - name: Upload executable artifacts
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
@@ -344,6 +416,14 @@ jobs:
         architecture: x64
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
     - name: Install musl and zlib
       run: |
         set -e
@@ -419,7 +499,7 @@ jobs:
         echo "${HOME}/staticdeps/bin" >> "$GITHUB_PATH"
     - name: gradle buildNative
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -Dpkl.musl=true pkl-cli:buildNative
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true -Dpkl.musl=true pkl-cli:buildNative
     - name: Upload executable artifacts
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
@@ -454,9 +534,17 @@ jobs:
         architecture: x64
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
     - name: gradle buildNative
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-cli:buildNative
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true pkl-cli:buildNative
     - name: Upload executable artifacts
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
@@ -493,9 +581,17 @@ jobs:
         architecture: x64
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
     - name: gradle buildNative
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -Dpkl.targetArch=amd64 "-Dpkl.native--native-compiler-path=${GITHUB_WORKSPACE}/.github/scripts/cc_macos_amd64.sh" pkl-doc:buildNative
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true -Dpkl.targetArch=amd64 "-Dpkl.native--native-compiler-path=${GITHUB_WORKSPACE}/.github/scripts/cc_macos_amd64.sh" pkl-doc:buildNative
     - name: Upload executable artifacts
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
@@ -531,11 +627,19 @@ jobs:
         architecture: x64
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
     - name: Fix git ownership
       run: git status || git config --system --add safe.directory "$GITHUB_WORKSPACE"
     - name: gradle buildNative
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-doc:buildNative
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true pkl-doc:buildNative
     - name: Upload executable artifacts
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
@@ -574,9 +678,17 @@ jobs:
         architecture: aarch64
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
     - name: gradle buildNative
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-doc:buildNative
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true pkl-doc:buildNative
     - name: Upload executable artifacts
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
@@ -612,11 +724,19 @@ jobs:
         architecture: aarch64
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
     - name: Fix git ownership
       run: git status || git config --system --add safe.directory "$GITHUB_WORKSPACE"
     - name: gradle buildNative
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-doc:buildNative
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true pkl-doc:buildNative
     - name: Upload executable artifacts
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
@@ -652,6 +772,14 @@ jobs:
         architecture: x64
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
     - name: Install musl and zlib
       run: |
         set -e
@@ -727,7 +855,7 @@ jobs:
         echo "${HOME}/staticdeps/bin" >> "$GITHUB_PATH"
     - name: gradle buildNative
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -Dpkl.musl=true pkl-doc:buildNative
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true -Dpkl.musl=true pkl-doc:buildNative
     - name: Upload executable artifacts
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
@@ -762,9 +890,17 @@ jobs:
         architecture: x64
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
     - name: gradle buildNative
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true pkl-doc:buildNative
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true pkl-doc:buildNative
     - name: Upload executable artifacts
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:

.github/workflows/release.yml

@@ -28,9 +28,17 @@ jobs:
         architecture: x64
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
     - name: check
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true check
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true check
     - name: Upload Test Result XML
       if: '!cancelled()'
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
@@ -61,9 +69,17 @@ jobs:
         architecture: x64
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
     - name: check
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true check
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true check
     - name: Upload Test Result XML
       if: '!cancelled()'
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
@@ -92,9 +108,17 @@ jobs:
         architecture: x64
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
     - name: bench:jmh
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true bench:jmh
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true bench:jmh
   gradle-compatibility:
     runs-on: ubuntu-latest
     env:
@@ -111,9 +135,17 @@ jobs:
         architecture: x64
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with: {}
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
     - name: :pkl-gradle:build :pkl-gradle:compatibilityTestReleases
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true :pkl-gradle:build :pkl-gradle:compatibilityTestReleases
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true :pkl-gradle:build :pkl-gradle:compatibilityTestReleases
     - name: Upload Test Result XML
       if: '!cancelled()'
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
@@ -144,12 +176,20 @@ jobs:
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with:
         cache-disabled: true
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
     - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
       with:
         persist-credentials: false
     - name: gradle build java executables
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -DreleaseBuild=true pkl-doc:build pkl-cli:build pkl-codegen-java:build pkl-codegen-kotlin:build
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true -DreleaseBuild=true pkl-doc:build pkl-cli:build pkl-codegen-java:build pkl-codegen-kotlin:build
     - name: Upload executable artifacts
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
@@ -187,9 +227,17 @@ jobs:
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with:
         cache-disabled: true
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
     - name: gradle buildNative
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -DreleaseBuild=true -Dpkl.targetArch=amd64 "-Dpkl.native--native-compiler-path=${GITHUB_WORKSPACE}/.github/scripts/cc_macos_amd64.sh" pkl-cli:buildNative
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true -DreleaseBuild=true -Dpkl.targetArch=amd64 "-Dpkl.native--native-compiler-path=${GITHUB_WORKSPACE}/.github/scripts/cc_macos_amd64.sh" pkl-cli:buildNative
     - name: Upload executable artifacts
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
@@ -226,11 +274,19 @@ jobs:
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with:
         cache-disabled: true
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
     - name: Fix git ownership
       run: git status || git config --system --add safe.directory "$GITHUB_WORKSPACE"
     - name: gradle buildNative
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -DreleaseBuild=true pkl-cli:buildNative
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true -DreleaseBuild=true pkl-cli:buildNative
     - name: Upload executable artifacts
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
@@ -270,9 +326,17 @@ jobs:
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with:
         cache-disabled: true
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
     - name: gradle buildNative
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -DreleaseBuild=true pkl-cli:buildNative
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true -DreleaseBuild=true pkl-cli:buildNative
     - name: Upload executable artifacts
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
@@ -309,11 +373,19 @@ jobs:
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with:
         cache-disabled: true
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
     - name: Fix git ownership
       run: git status || git config --system --add safe.directory "$GITHUB_WORKSPACE"
     - name: gradle buildNative
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -DreleaseBuild=true pkl-cli:buildNative
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true -DreleaseBuild=true pkl-cli:buildNative
     - name: Upload executable artifacts
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
@@ -350,6 +422,14 @@ jobs:
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with:
         cache-disabled: true
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
     - name: Install musl and zlib
       run: |
         set -e
@@ -425,7 +505,7 @@ jobs:
         echo "${HOME}/staticdeps/bin" >> "$GITHUB_PATH"
     - name: gradle buildNative
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -DreleaseBuild=true -Dpkl.musl=true pkl-cli:buildNative
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true -DreleaseBuild=true -Dpkl.musl=true pkl-cli:buildNative
     - name: Upload executable artifacts
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
@@ -461,9 +541,17 @@ jobs:
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with:
         cache-disabled: true
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
     - name: gradle buildNative
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -DreleaseBuild=true pkl-cli:buildNative
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true -DreleaseBuild=true pkl-cli:buildNative
     - name: Upload executable artifacts
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
@@ -501,9 +589,17 @@ jobs:
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with:
         cache-disabled: true
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
     - name: gradle buildNative
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -DreleaseBuild=true -Dpkl.targetArch=amd64 "-Dpkl.native--native-compiler-path=${GITHUB_WORKSPACE}/.github/scripts/cc_macos_amd64.sh" pkl-doc:buildNative
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true -DreleaseBuild=true -Dpkl.targetArch=amd64 "-Dpkl.native--native-compiler-path=${GITHUB_WORKSPACE}/.github/scripts/cc_macos_amd64.sh" pkl-doc:buildNative
     - name: Upload executable artifacts
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
@@ -540,11 +636,19 @@ jobs:
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with:
         cache-disabled: true
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
     - name: Fix git ownership
       run: git status || git config --system --add safe.directory "$GITHUB_WORKSPACE"
     - name: gradle buildNative
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -DreleaseBuild=true pkl-doc:buildNative
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true -DreleaseBuild=true pkl-doc:buildNative
     - name: Upload executable artifacts
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
@@ -584,9 +688,17 @@ jobs:
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with:
         cache-disabled: true
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
     - name: gradle buildNative
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -DreleaseBuild=true pkl-doc:buildNative
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true -DreleaseBuild=true pkl-doc:buildNative
     - name: Upload executable artifacts
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
@@ -623,11 +735,19 @@ jobs:
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with:
         cache-disabled: true
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
     - name: Fix git ownership
       run: git status || git config --system --add safe.directory "$GITHUB_WORKSPACE"
     - name: gradle buildNative
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -DreleaseBuild=true pkl-doc:buildNative
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true -DreleaseBuild=true pkl-doc:buildNative
     - name: Upload executable artifacts
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
@@ -664,6 +784,14 @@ jobs:
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with:
         cache-disabled: true
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
     - name: Install musl and zlib
       run: |
         set -e
@@ -739,7 +867,7 @@ jobs:
         echo "${HOME}/staticdeps/bin" >> "$GITHUB_PATH"
     - name: gradle buildNative
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -DreleaseBuild=true -Dpkl.musl=true pkl-doc:buildNative
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true -DreleaseBuild=true -Dpkl.musl=true pkl-doc:buildNative
     - name: Upload executable artifacts
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
@@ -775,9 +903,17 @@ jobs:
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with:
         cache-disabled: true
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
     - name: gradle buildNative
       shell: bash
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -DreleaseBuild=true pkl-doc:buildNative
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true -DreleaseBuild=true pkl-doc:buildNative
     - name: Upload executable artifacts
       uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
       with:
@@ -831,6 +967,14 @@ jobs:
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5
       with:
         cache-disabled: true
+    - name: Set DEBUG_ARGS env var
+      env:
+        RUNNER_DEBUG: ${{ runner.debug }}
+      shell: bash
+      run: |-
+        if [[ "$RUNNER_DEBUG" -eq 1 ]]; then
+          echo "DEBUG_ARGS=--info --stacktrace" >> $GITHUB_ENV
+        fi
     - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
       with:
         persist-credentials: false
@@ -844,7 +988,7 @@ jobs:
         ORG_GRADLE_PROJECT_signingPassword: ${{ secrets.ORG_GRADLE_PROJECT_SIGNINGPASSWORD }}
         ORG_GRADLE_PROJECT_sonatypePassword: ${{ secrets.ORG_GRADLE_PROJECT_SONATYPEPASSWORD }}
         ORG_GRADLE_PROJECT_sonatypeUsername: ${{ secrets.ORG_GRADLE_PROJECT_SONATYPEUSERNAME }}
-      run: ./gradlew --info --stacktrace --no-daemon -DpklMultiJdkTesting=true -DreleaseBuild=true publishToSonatype closeAndReleaseSonatypeStagingRepository
+      run: ./gradlew $DEBUG_ARGS --no-daemon -DpklMultiJdkTesting=true -DreleaseBuild=true publishToSonatype closeAndReleaseSonatypeStagingRepository
   github-release:
     needs: deploy-release
     permissions:

.idea/codeStyles/Project.xml

@@ -10,16 +10,6 @@
     <option name="INSERT_INNER_CLASS_IMPORTS" value="true" />
     <option name="CLASS_COUNT_TO_USE_IMPORT_ON_DEMAND" value="999" />
     <option name="NAMES_COUNT_TO_USE_IMPORT_ON_DEMAND" value="999" />
-    <option name="PACKAGES_TO_USE_IMPORT_ON_DEMAND">
-      <value />
-    </option>
-    <option name="IMPORT_LAYOUT_TABLE">
-      <value>
-        <package name="" withSubpackages="true" static="true" />
-        <emptyLine />
-        <package name="" withSubpackages="true" static="false" />
-      </value>
-    </option>
     <option name="RIGHT_MARGIN" value="100" />
     <option name="KEEP_BLANK_LINES_IN_CODE" value="1" />
     <option name="KEEP_CONTROL_STATEMENT_IN_ONE_LINE" value="false" />

.idea/inspectionProfiles/Project_Default.xml

@@ -27,12 +27,19 @@
                   <option name="searchContext" value="ANY" />
                   <option name="replacement" value="evaluatorSettings" />
                 </InspectionPattern>
+                <InspectionPattern>
+                  <option name="regExp" value="project\?\.resolvedEvaluatorSettings" />
+                  <option name="_fileType" value="Kotlin" />
+                  <option name="searchContext" value="ANY" />
+                  <option name="replacement" value="evaluatorSettings" />
+                </InspectionPattern>
               </list>
             </option>
           </RegExpInspectionConfiguration>
         </list>
       </option>
     </inspection_tool>
+    <inspection_tool class="FieldAccessNotGuarded" enabled="true" level="WARNING" enabled_by_default="true" />
     <inspection_tool class="FieldMayBeFinal" enabled="true" level="INFORMATION" enabled_by_default="true">
       <scope name="AllExceptTruffleAst" level="WARNING" enabled="true" />
     </inspection_tool>
@@ -94,6 +101,7 @@
       <option name="processLiterals" value="true" />
       <option name="processComments" value="true" />
     </inspection_tool>
+    <inspection_tool class="StringToUpperWithoutLocale" enabled="true" level="WARNING" enabled_by_default="true" editorAttributes="WARNING_ATTRIBUTES" />
     <inspection_tool class="dd497f47-d38f-3fab-9ed7-eabe699620c8" enabled="true" level="ERROR" enabled_by_default="true" editorAttributes="ERRORS_ATTRIBUTES" />
   </profile>
-</component>
+</component>

build-logic/src/main/kotlin/ConfigureLateInitAnnotation.kt

@@ -0,0 +1,76 @@
+/*
+ * Copyright © 2026 Apple Inc. and the Pkl project authors. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import groovy.util.Node
+import groovy.xml.XmlParser
+import groovy.xml.XmlUtil
+import org.gradle.api.DefaultTask
+import org.gradle.api.tasks.TaskAction
+
+abstract class ConfigureLateInitAnnotation : DefaultTask() {
+  private val miscXmlFile = project.rootProject.file(".idea/misc.xml")
+
+  init {
+    inputs.file(miscXmlFile)
+    outputs.file(miscXmlFile)
+  }
+
+  @TaskAction
+  fun run() {
+    val annotationName = "org.pkl.core.util.LateInit"
+
+    if (!miscXmlFile.exists()) {
+      miscXmlFile.writeText(
+        """
+        <?xml version="1.0" encoding="UTF-8"?>
+        <project version="4">
+        </project>
+        """
+          .trimIndent()
+          .trim()
+      )
+    }
+
+    val root = XmlParser().parse(miscXmlFile)
+
+    fun Node.childNodes() = children().filterIsInstance<Node>()
+
+    var entryPointsManager =
+      root.childNodes().find {
+        it.name() == "component" && it.attribute("name") == "EntryPointsManager"
+      }
+    if (entryPointsManager == null) {
+      entryPointsManager = root.appendNode("component", mapOf("name" to "EntryPointsManager"))
+    }
+
+    var writeAnnotations = entryPointsManager.childNodes().find { it.name() == "writeAnnotations" }
+    if (writeAnnotations == null) {
+      writeAnnotations = entryPointsManager.appendNode("writeAnnotations")
+    }
+
+    val alreadyExists =
+      writeAnnotations.childNodes().any {
+        it.name() == "writeAnnotation" && it.attribute("name") == annotationName
+      }
+
+    if (!alreadyExists) {
+      writeAnnotations.appendNode("writeAnnotation", mapOf("name" to annotationName))
+      miscXmlFile.writeText(XmlUtil.serialize(root))
+      logger.lifecycle("Updated .idea/misc.xml")
+    } else {
+      logger.info("$annotationName is already configured in .idea/misc.xml")
+    }
+  }
+}

build-logic/src/main/kotlin/pklJSpecify.gradle.kts

@@ -13,6 +13,7 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
+import net.ltgt.gradle.errorprone.CheckSeverity
 import net.ltgt.gradle.errorprone.errorprone
 import net.ltgt.gradle.nullaway.nullaway
 import org.gradle.accessors.dm.LibrariesForLibs
@@ -36,6 +37,8 @@ nullaway { onlyNullMarked = true }
 
 tasks.withType<JavaCompile>().configureEach {
   options.errorprone.disableAllChecks = true
+  options.errorprone.check("StringCaseLocaleUsage", CheckSeverity.ERROR)
+  options.errorprone.check("GuardedBy", CheckSeverity.ERROR)
   options.errorprone.nullaway {
     error()
     onlyNullMarked = true

build-logic/src/main/kotlin/pklKotlinBase.gradle.kts

@@ -44,7 +44,6 @@ kotlin {
     freeCompilerArgs.addAll(
       "-jvm-default=no-compatibility", // was: -Xjvm-default=all
       "-Xjdk-release=${buildInfo.jvmTarget}",
-      "-Xjsr305=strict",
     )
   }
 }

build.gradle.kts

@@ -17,6 +17,7 @@
 import org.jetbrains.gradle.ext.ActionDelegationConfig
 import org.jetbrains.gradle.ext.ActionDelegationConfig.TestRunner.PLATFORM
 import org.jetbrains.gradle.ext.ProjectSettings
+import org.jetbrains.gradle.ext.taskTriggers
 
 plugins {
   id("pklAllProjects")
@@ -36,6 +37,8 @@ nexusPublishing {
   }
 }
 
+val configureLateInitAnnotation by tasks.registering(ConfigureLateInitAnnotation::class)
+
 idea {
   project {
     this as ExtensionAware
@@ -45,6 +48,7 @@ idea {
         delegateBuildRunToGradle = true
         testRunner = PLATFORM
       }
+      taskTriggers.afterSync(configureLateInitAnnotation)
     }
   }
 }

docs/modules/ROOT/partials/component-attributes.adoc

@@ -78,8 +78,10 @@ endif::[]
 :uri-stdlib-pklbinaryModule: {uri-pkl-stdlib-docs}/pklbinary
 :uri-stdlib-yamlModule: {uri-pkl-stdlib-docs}/yaml
 :uri-stdlib-YamlParser: {uri-stdlib-yamlModule}/Parser
+:uri-stdlib-projectModule: {uri-pkl-stdlib-docs}/Project
 :uri-stdlib-evaluatorSettingsModule: {uri-pkl-stdlib-docs}/EvaluatorSettings
 :uri-stdlib-evaluatorSettingsHttpClass: {uri-stdlib-evaluatorSettingsModule}/Http
+:uri-stdlib-evaluatorSettingsExternalReaderClass: {uri-stdlib-evaluatorSettingsModule}/ExternalReader
 :uri-stdlib-Boolean: {uri-stdlib-baseModule}/Boolean
 :uri-stdlib-xor: {uri-stdlib-baseModule}/Boolean#xor()
 :uri-stdlib-implies: {uri-stdlib-baseModule}/Boolean#implies()

docs/modules/bindings-specification/pages/message-passing-api.adoc

@@ -210,6 +210,11 @@ class Http {
   ///
   /// Each rewrite must start with `http://` or `https://`, and must end with `/`.
   rewrites: Mapping<String, String>?
+
+  /// HTTP headers.
+  /// Each entry key is a glob pattern that is matched against outbound request URLs.
+  /// Each value is a map of headers that is added to the matching request.
+  headers: Mapping<String, Mapping<String, Listing<String>>>?
 }
 
 /// Settings that control how Pkl talks to HTTP proxies.

docs/modules/java-binding/pages/codegen.adoc

@@ -198,7 +198,7 @@ For Spring Boot applications, and for users of `pkl-config-java` compiling the g
 .--non-null-annotation
 [%collapsible]
 ====
-Default: `org.pkl.config.java.mapper.NonNull` +
+Default: `org.jspecify.annotations.NonNull` +
 Fully qualified name of the annotation type to use for annotating non-null types. +
 The specified annotation type must be annotated with `@java.lang.annotation.Target(ElementType.TYPE_USE)`
 or the generated code may not compile.

docs/modules/language-reference/pages/index.adoc

@@ -5059,8 +5059,6 @@ in the context of that module.
 [[glob-patterns]]
 === Glob Patterns
 
-Resources and modules may be imported at the same time by globbing with the <<globbed-imports>> and <<globbed-reads>> features.
-
 Pkl's glob patterns mostly follow the rules described by link:{uri-glob-7}[glob(7)], with the following differences:
 
 * `*` includes names that start with a dot (`.`).

docs/modules/pkl-cli/pages/index.adoc

@@ -546,6 +546,15 @@ When enabled, test failures will show intermediate values in the assertion expre
 Use `--no-power-assertions` to disable this feature if you prefer simpler output.
 ====
 
+[[test-reporter]]
+.--test-reporter
+[%collapsible]
+====
+Default: `spec` +
+Example: `--test-reporter minimal` +
+Which test reporter to use for CLI output. Possible values are `spec` and `minimal`.
+====
+
 This command also takes <<common-options, common options>>.
 
 [[command-run]]
@@ -667,6 +676,14 @@ Force generation of expected examples. +
 The old expected files will be deleted if present.
 ====
 
+.--test-reporter
+[%collapsible]
+====
+Default: `spec` +
+Example: `--test-reporter minimal` +
+Which test reporter to use for CLI output. Possible values are `spec` and `minimal`.
+====
+
 This command also takes <<common-options,common options>>.
 
 [[command-project-resolve]]

docs/modules/pkl-cli/partials/cli-common-options.adoc

@@ -158,6 +158,23 @@ This option is commonly used to enable package mirroring.
 The above example will rewrite URL `\https://pkg.pkl-lang.org/pkl-k8s/k8s@1.0.0` to `\https://my.internal.mirror/pkl-k8s/k8s@1.0.0`.
 ====
 
+.--http-header
+[%collapsible]
+====
+Default: (none) +
+Example: `**=User-Agent: My User Agent` +
+
+Additional headers to add to outbound HTTP requests.
+
+The syntax is `<glob pattern>=<header name>:<header value>`, and any whitespace after the leading colon is trimmed.
+
+The glob pattern is used to match against the URLs of outbound HTTP calls, and the value is the header name and value to add.
+In the case of multiple matches, every header is added.
+
+To describe a prefix match, the `\\**` wildcard should be added to the pattern.
+For example, `https?://example.com/**` matches against every request to host `example.com`.
+====
+
 .--trace-mode
 [%collapsible]
 ====

docs/modules/pkl-doc/pages/index.adoc

@@ -204,7 +204,7 @@ Download links:
 The Pkldoc tool is offered as Gradle plugin, Java library, and CLI.
 It can generate documentation either for modules directly, or generate documentation for _package uris_.
 
-The tool requires an argument of a module named _docsite-info.pkl_, that amends link:{uri-DocsiteInfo}[pkl.DocsiteInfo].
+The tool accepts an optional argument of a module named _docsite-info.pkl_, that amends link:{uri-DocsiteInfo}[pkl.DocsiteInfo].
 
 [discrete]
 ==== Generating documentation for modules directly

docs/modules/pkl-gradle/pages/index.adoc

@@ -322,6 +322,15 @@ Default: `false` +
 Whether to ignore expected example files and generate them again.
 ====
 
+[[test-reporter]]
+.testReporter: Property<String>
+[%collapsible]
+====
+Default: `"spec"` +
+Example: `reporter = "minimal"` +
+Which test reporter to use for CLI output. Possible values are `"spec"` and `"minimal"`.
+====
+
 [[power-assertions-test]]
 .powerAssertions: Property<Boolean>
 [%collapsible]
@@ -414,7 +423,7 @@ For Spring Boot applications, and for users of `pkl-config-java` compiling the g
 .nonNullAnnotation: Property<String>
 [%collapsible]
 ====
-Default: `"org.pkl.config.java.mapper.NonNull"` +
+Default: `"org.jspecify.annotations.NonNull"` +
 Example: `nonNullAnnotation = "org.project.MyAnnotation"` +
 Fully qualified name of the annotation type to use for annotating non-null types. +
 The specified annotation type must be annotated with `@java.lang.annotation.Target(ElementType.TYPE_USE)`
@@ -677,6 +686,14 @@ Default: `false` +
 Whether to ignore expected example files and generate them again.
 ====
 
+.testReporter: Property<String>
+[%collapsible]
+====
+Default: `"spec"` +
+Example: `reporter = "minimal"` +
+Which test reporter to use for CLI output. Possible values are `"spec"` and `"minimal"`.
+====
+
 Common properties:
 
 include::../partials/gradle-common-properties.adoc[]

docs/modules/pkl-gradle/partials/gradle-common-properties.adoc

@@ -119,6 +119,19 @@ This option is commonly used to enable package mirroring.
 The above example will rewrite URL `\https://pkg.pkl-lang.org/pkl-k8s/k8s@1.0.0` to `\https://my.internal.mirror/pkl-k8s/k8s@1.0.0`.
 ====
 
+.httpHeaders: MapProperty<String, Map<String, List<String>>>
+[%collapsible]
+====
+Default: `null` +
+Example: `httpHeaders = ["**": ["User-Agent": ["My User Agent"]]]` +
+Additional headers to add to outbound HTTP requests.
+The key is a glob pattern that is used to match against the URLs of outbound HTTP calls, and the value is the header name and values to add.
+Each header value becomes its own HTTP header.
+
+To describe a prefix match, the `\\**` wildcard should be added to the pattern.
+For example, `https?://example.com/**` matches against every request to host `example.com`.
+====
+
 .powerAssertions: Property<Boolean>
 [%collapsible]
 ====

docs/modules/release-notes/pages/0.32.adoc

@@ -21,27 +21,60 @@ XXX
 
 Ready when you need them.
 
-.XXX
-[%collapsible]
-====
-XXX
-====
+=== Standard Library Changes
+
+==== `pkl:EvaluatorSettings`
+
+**Additions**
+
+* New method: link:{uri-stdlib-evaluatorSettingsModule}#resolve()[`EvaluatorSettings.resolve()`]
+* New method: link:{uri-stdlib-evaluatorSettingsModule}#resolveForOs()[`EvaluatorSettings.resolveForOs()`]
+* New property: link:{uri-stdlib-evaluatorSettingsExternalReaderClass}#workingDir[`EvaluatorSettings#ExternalReader.workingDir`]
+
+==== `pkl:Project`
+
+**Additions**
+
+* New property: link:{uri-stdlib-projectModule}#resolvedEvaluatorSettings[`Project.resolvedEvaluatorSettings`]
 
 == Breaking Changes [small]#💔#
 
 Things to watch out for when upgrading.
 
-=== Removed Java APIs
+=== Java API changes
+
+Changes have been made to the Java API.
+
+==== Removals and deprecations
 
 The following APIs have been removed without replacement.
 
 * `org.pkl.config.java.Config#makeConfig` (pr:https://github.com/apple/pkl/pull/1531[])
 
-.XXX
-[%collapsible]
-====
-XXX
-====
+The following APIs have been deprecated for removal.
+
+* `org.pkl.config.java.mapper.NonNull` (https://github.com/apple/pkl/pull/1607[#1607]).
+
+==== Changes
+
+* `org.pkl.core.evaluatorSettings.PklEvaluatorSettings.parse` no longer accepts a `pathNormalizer` argument.
+
+=== Loading rule changes in `pkl:EvaluatorSettings`
+
+Breaking changes have been made to how evaluator settings are loaded (https://github.com/apple/pkl/pull/1394[#1394]).
+
+==== Loading rule changes for the external reader executable
+
+The following changes have been made for the `executable` property in an external reader:
+
+* If the executable does not contain a slash (`/` on POSIX, `\` on Windows) character, it is always resolved against the `PATH` environment variable.
+* If it does contain a slash, it is resolved relative to the enclosing PklProject directory, instead of the current working directory.
+
+=== Changes to `--external-module-reader` and `--external-resource-reader` CLI flags 
+
+The `--external-module-reader` and `--external-resource-reader` CLI flags will _replace_ any external readers otherwise configured within a PklProject, instead of add to it (https://github.com/apple/pkl/pull/1394[#1394]).
+
+This makes this behavior consistent with how other settings work.
 
 == Work In Progress [small]#🚆#
 

docs/modules/style-guide/pages/index.adoc

@@ -193,7 +193,7 @@ Too many lines separate `foo` and `baz`.
 Properties that override an existing property shouldn't have doc comments nor type annotations,
 unless the type is intentionally overridden via `extends`.
 
-[source%tested,{pkl}]
+[source%parsed,{pkl}]
 ----
 amends "myOtherModule.pkl"
 

docs/src/test/kotlin/DocSnippetTests.kt

@@ -1,3 +1,22 @@
+/*
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import java.nio.file.Files
+import kotlin.io.path.isDirectory
+import kotlin.io.path.isRegularFile
+import kotlin.io.path.useDirectoryEntries
 import org.junit.platform.commons.annotation.Testable
 import org.junit.platform.engine.*
 import org.junit.platform.engine.TestDescriptor.Type
@@ -16,23 +35,18 @@ import org.pkl.core.Loggers
 import org.pkl.core.SecurityManagers
 import org.pkl.core.StackFrameTransformers
 import org.pkl.core.evaluatorSettings.TraceMode
+import org.pkl.core.http.HttpClient
 import org.pkl.core.module.ModuleKeyFactories
 import org.pkl.core.repl.ReplRequest
 import org.pkl.core.repl.ReplResponse
 import org.pkl.core.repl.ReplServer
+import org.pkl.core.resource.ResourceReaders
 import org.pkl.core.util.IoUtils
-import org.pkl.core.http.HttpClient
 import org.pkl.parser.Parser
 import org.pkl.parser.ParserError
 import org.pkl.parser.syntax.ClassProperty
-import org.pkl.core.resource.ResourceReaders
-import java.nio.file.Files
-import kotlin.io.path.isDirectory
-import kotlin.io.path.isRegularFile
-import kotlin.io.path.useDirectoryEntries
 
-@Testable
-class DocSnippetTests
+@Testable class DocSnippetTests
 
 class DocSnippetTestsEngine : HierarchicalTestEngine<DocSnippetTestsEngine.ExecutionContext>() {
   private val projectDir = rootProjectDir.resolve("docs")
@@ -41,7 +55,8 @@ class DocSnippetTestsEngine : HierarchicalTestEngine<DocSnippetTestsEngine.Execu
   private companion object {
     val headingRegex = Regex("""(?u)^\s*(=++)\s*(.+)""")
     val collapsibleBlockRegex = Regex("""(?u)^\s*\[%collapsible""")
-    val codeBlockRegex = Regex("""(?u)^\s*\[source(?:%(tested|parsed)(%error)?)?(?:,\{?([a-zA-Z-_]+)}?)?""")
+    val codeBlockRegex =
+      Regex("""(?u)^\s*\[source(?:%(tested|parsed)(%error)?)?(?:,\{?([a-zA-Z-_]+)}?)?""")
     val codeBlockNameRegex = Regex("""(?u)^\s*\.(.+)""")
     val codeBlockDelimiterRegex = Regex("""(?u)^\s*----""")
     val graphicsRegex = Regex("\\[small]#.+#")
@@ -51,7 +66,7 @@ class DocSnippetTestsEngine : HierarchicalTestEngine<DocSnippetTestsEngine.Execu
 
   override fun discover(
     discoveryRequest: EngineDiscoveryRequest,
-    uniqueId: UniqueId
+    uniqueId: UniqueId,
   ): TestDescriptor {
     val packageSelectors = discoveryRequest.getSelectorsByType(PackageSelector::class.java)
     val classSelectors = discoveryRequest.getSelectorsByType(ClassSelector::class.java)
@@ -62,12 +77,14 @@ class DocSnippetTestsEngine : HierarchicalTestEngine<DocSnippetTestsEngine.Execu
     val packageName = testClass.`package`.name
     val className = testClass.name
 
-    if (methodSelectors.isEmpty()
-      && (packageSelectors.isEmpty() || packageSelectors.any { it.packageName == packageName })
-      && (classSelectors.isEmpty() || classSelectors.any { it.className == className })
+    if (
+      methodSelectors.isEmpty() &&
+        (packageSelectors.isEmpty() || packageSelectors.any { it.packageName == packageName }) &&
+        (classSelectors.isEmpty() || classSelectors.any { it.className == className })
     ) {
 
-      val rootDescriptor = Descriptor.Path(uniqueId, docsDir.fileName.toString(), ClassSource.from(testClass), docsDir)
+      val rootDescriptor =
+        Descriptor.Path(uniqueId, docsDir.fileName.toString(), ClassSource.from(testClass), docsDir)
       doDiscover(rootDescriptor, uniqueIdSelectors)
       return rootDescriptor
     }
@@ -77,36 +94,34 @@ class DocSnippetTestsEngine : HierarchicalTestEngine<DocSnippetTestsEngine.Execu
   }
 
   override fun createExecutionContext(request: ExecutionRequest): ExecutionContext {
-    val replServer = ReplServer(
-      SecurityManagers.defaultManager,
-      HttpClient.dummyClient(),
-      Loggers.stdErr(),
-      listOf(
-        ModuleKeyFactories.standardLibrary,
-        ModuleKeyFactories.classPath(DocSnippetTests::class.java.classLoader),
-        ModuleKeyFactories.file
-      ),
-      listOf(
-        ResourceReaders.environmentVariable(),
-        ResourceReaders.externalProperty()
-      ),
-      System.getenv(),
-      emptyMap(),
-      null,
-      null,
-      null,
-      IoUtils.getCurrentWorkingDir(),
-      StackFrameTransformers.defaultTransformer,
-      false,
-      TraceMode.COMPACT,
-    )
+    val replServer =
+      ReplServer(
+        SecurityManagers.defaultManager,
+        HttpClient.dummyClient(),
+        Loggers.stdErr(),
+        listOf(
+          ModuleKeyFactories.standardLibrary,
+          ModuleKeyFactories.classPath(DocSnippetTests::class.java.classLoader),
+          ModuleKeyFactories.file,
+        ),
+        listOf(ResourceReaders.environmentVariable(), ResourceReaders.externalProperty()),
+        System.getenv(),
+        emptyMap(),
+        null,
+        null,
+        null,
+        IoUtils.getCurrentWorkingDir(),
+        StackFrameTransformers.defaultTransformer,
+        false,
+        TraceMode.COMPACT,
+      )
     return ExecutionContext(replServer)
   }
 
   private fun doDiscover(rootDescriptor: TestDescriptor, selectors: List<UniqueIdSelector>) {
-    fun isMatch(other: UniqueId) = selectors.isEmpty() || selectors.any {
-      it.uniqueId.hasPrefix(other) || other.hasPrefix(it.uniqueId)
-    }
+    fun isMatch(other: UniqueId) =
+      selectors.isEmpty() ||
+        selectors.any { it.uniqueId.hasPrefix(other) || other.hasPrefix(it.uniqueId) }
 
     docsDir.useDirectoryEntries { docsDirEntries ->
       for (docsDirEntry in docsDirEntries) {
@@ -116,12 +131,13 @@ class DocSnippetTestsEngine : HierarchicalTestEngine<DocSnippetTestsEngine.Execu
         val docsDirEntryId = rootDescriptor.uniqueId.append("dir", docsDirEntryName)
         if (!isMatch(docsDirEntryId)) continue
 
-        val docsDirEntryDescriptor = Descriptor.Path(
-          docsDirEntryId,
-          docsDirEntryName,
-          DirectorySource.from(docsDirEntry.toFile()),
-          docsDirEntry
-        )
+        val docsDirEntryDescriptor =
+          Descriptor.Path(
+            docsDirEntryId,
+            docsDirEntryName,
+            DirectorySource.from(docsDirEntry.toFile()),
+            docsDirEntry,
+          )
         rootDescriptor.addChild(docsDirEntryDescriptor)
 
         val pagesDir = docsDirEntry.resolve("pages")
@@ -131,17 +147,20 @@ class DocSnippetTestsEngine : HierarchicalTestEngine<DocSnippetTestsEngine.Execu
           for (pagesDirEntry in pagesDirEntries) {
             val pagesDirEntryName = pagesDirEntry.fileName.toString()
             val pagesDirEntryId = docsDirEntryId.append("file", pagesDirEntryName)
-            if (!pagesDirEntry.isRegularFile() ||
-              !pagesDirEntryName.endsWith(".adoc") ||
-              !isMatch(pagesDirEntryId)
-            ) continue
-
-            val pagesDirEntryDescriptor = Descriptor.Path(
-              pagesDirEntryId,
-              pagesDirEntryName,
-              FileSource.from(pagesDirEntry.toFile()),
-              pagesDirEntry
+            if (
+              !pagesDirEntry.isRegularFile() ||
+                !pagesDirEntryName.endsWith(".adoc") ||
+                !isMatch(pagesDirEntryId)
             )
+              continue
+
+            val pagesDirEntryDescriptor =
+              Descriptor.Path(
+                pagesDirEntryId,
+                pagesDirEntryName,
+                FileSource.from(pagesDirEntry.toFile()),
+                pagesDirEntry,
+              )
             docsDirEntryDescriptor.addChild(pagesDirEntryDescriptor)
 
             parseAsciidoc(pagesDirEntryDescriptor, selectors)
@@ -174,17 +193,15 @@ class DocSnippetTestsEngine : HierarchicalTestEngine<DocSnippetTestsEngine.Execu
         }
 
         val parent = sections.firstOrNull() ?: docDescriptor
-        val normalizedTitle = title
-          .replace("<code>", "")
-          .replace("</code>", "")
-          .replace(graphicsRegex, "")
-          .trim()
-        val childSection = Descriptor.Section(
-          parent.uniqueId.append("section", normalizedTitle),
-          normalizedTitle,
-          FileSource.from(docDescriptor.path.toFile(), FilePosition.from(lineNum)),
-          newLevel
-        )
+        val normalizedTitle =
+          title.replace("<code>", "").replace("</code>", "").replace(graphicsRegex, "").trim()
+        val childSection =
+          Descriptor.Section(
+            parent.uniqueId.append("section", normalizedTitle),
+            normalizedTitle,
+            FileSource.from(docDescriptor.path.toFile(), FilePosition.from(lineNum)),
+            newLevel,
+          )
 
         sections.addFirst(childSection)
         parent.addChild(childSection)
@@ -217,7 +234,8 @@ class DocSnippetTestsEngine : HierarchicalTestEngine<DocSnippetTestsEngine.Execu
           codeBlockNum += 1
           val (testMode, error, language) = codeBlockMatch.destructured
           if (testMode.isNotEmpty()) {
-            val blockName = codeBlockNameRegex.find(prevLine)?.groupValues?.get(1) ?: "snippet$codeBlockNum"
+            val blockName =
+              codeBlockNameRegex.find(prevLine)?.groupValues?.get(1) ?: "snippet$codeBlockNum"
             while (linesIterator.hasNext()) {
               advance()
               val startDelimiterMatch = codeBlockDelimiterRegex.find(line)
@@ -236,10 +254,13 @@ class DocSnippetTestsEngine : HierarchicalTestEngine<DocSnippetTestsEngine.Execu
                           snippetId,
                           blockName,
                           language,
-                          FileSource.from(docDescriptor.path.toFile(), FilePosition.from(jumpToLineNum)),
+                          FileSource.from(
+                            docDescriptor.path.toFile(),
+                            FilePosition.from(jumpToLineNum),
+                          ),
                           builder.toString(),
                           testMode == "parsed",
-                          error.isNotEmpty()
+                          error.isNotEmpty(),
                         )
                       )
                     }
@@ -261,28 +282,21 @@ class DocSnippetTestsEngine : HierarchicalTestEngine<DocSnippetTestsEngine.Execu
     }
   }
 
-  private sealed class Descriptor(
-    uniqueId: UniqueId,
-    displayName: String,
-    source: TestSource
-  ) : AbstractTestDescriptor(uniqueId, displayName, source), Node<ExecutionContext> {
+  private sealed class Descriptor(uniqueId: UniqueId, displayName: String, source: TestSource) :
+    AbstractTestDescriptor(uniqueId, displayName, source), Node<ExecutionContext> {
 
     class Path(
       uniqueId: UniqueId,
       displayName: String,
       source: TestSource,
-      val path: java.nio.file.Path
+      val path: java.nio.file.Path,
     ) : Descriptor(uniqueId, displayName, source) {
 
       override fun getType() = Type.CONTAINER
     }
 
-    class Section(
-      uniqueId: UniqueId,
-      displayName: String,
-      source: TestSource,
-      val level: Int
-    ) : Descriptor(uniqueId, displayName, source) {
+    class Section(uniqueId: UniqueId, displayName: String, source: TestSource, val level: Int) :
+      Descriptor(uniqueId, displayName, source) {
 
       override fun getType() = Type.CONTAINER
 
@@ -299,7 +313,7 @@ class DocSnippetTestsEngine : HierarchicalTestEngine<DocSnippetTestsEngine.Execu
       source: TestSource,
       private val code: String,
       private val parseOnly: Boolean,
-      private val expectError: Boolean
+      private val expectError: Boolean,
     ) : Descriptor(uniqueId, displayName, source) {
 
       override fun getType() = Type.TEST
@@ -308,11 +322,14 @@ class DocSnippetTestsEngine : HierarchicalTestEngine<DocSnippetTestsEngine.Execu
         when (language) {
           "pkl" -> Parser().parseModule(code)
           "pkl-expr" -> Parser().parseExpressionInput(code)
-          else -> throw(Exception("Unrecognized language: $language"))
+          else -> throw (Exception("Unrecognized language: $language"))
         }
       }
 
-      override fun execute(context: ExecutionContext, executor: DynamicTestExecutor): ExecutionContext {
+      override fun execute(
+        context: ExecutionContext,
+        executor: DynamicTestExecutor,
+      ): ExecutionContext {
         if (parseOnly) {
           try {
             parsed
@@ -328,12 +345,7 @@ class DocSnippetTestsEngine : HierarchicalTestEngine<DocSnippetTestsEngine.Execu
         }
 
         context.replServer.handleRequest(
-          ReplRequest.Eval(
-            "snippet",
-            code,
-            !expectError,
-            !expectError
-          )
+          ReplRequest.Eval("snippet", code, !expectError, !expectError)
         )
 
         val properties = parsed.children()?.filterIsInstance<ClassProperty>() ?: emptyList()
@@ -342,21 +354,21 @@ class DocSnippetTestsEngine : HierarchicalTestEngine<DocSnippetTestsEngine.Execu
 
         // force each property
         for (prop in properties) {
-          responses.addAll(context.replServer.handleRequest(
-            ReplRequest.Eval(
-              "snippet",
-              prop.name.value,
-              false,
-              true
+          responses.addAll(
+            context.replServer.handleRequest(
+              ReplRequest.Eval("snippet", prop.name.value, false, true)
             )
-          ))
+          )
         }
         if (expectError) {
-          if (responses.dropLast(1).any { it !is ReplResponse.EvalSuccess } ||
-            responses.last() !is ReplResponse.EvalError) {
+          if (
+            responses.dropLast(1).any { it !is ReplResponse.EvalSuccess } ||
+              responses.last() !is ReplResponse.EvalError
+          ) {
             throw AssertionError(
               "Expected %error snippet to fail at the end, but got the following REPL responses:\n\n" +
-                  responses.joinToString("\n\n") { it.message })
+                responses.joinToString("\n\n") { it.message }
+            )
           }
 
           return context

gradle/libs.versions.toml

@@ -5,9 +5,9 @@ checksumPlugin = "1.4.0"
 clikt = "5.0.3"
 commonMark = "0.28.0"
 downloadTaskPlugin = "5.7.0"
-errorProne = "2.48.0"
+errorProne = "2.49.0"
 errorPronePlugin = "5.1.0"
-geantyref = "1.3.16"
+geantyref = "2.0.1"
 #noinspection UnusedVersionCatalogEntry
 googleJavaFormat = "1.35.0"
 # 25.0.2 no longer supports macos-x64
@@ -29,40 +29,39 @@ graalVmSha256-windows-x64 = "fde83c5ceec2c75560c747ccd9f314f90e4cf5c5287416e67c4
 #noinspection UnusedVersionCatalogEntry
 graalVmSha256-windows-aarch64 = "unavailable"
 ideaExtPlugin = "1.4.1"
-javaPoet = "0.14.0"
+javaPoet = "0.15.0"
 javaxInject = "1"
 jimfs = "1.3.1"
-jline = "4.0.12"
+jline = "4.1.3"
 jmh = "1.37"
 jmhPlugin = "0.7.3"
 jspecify = "1.0.0"
-jsr305 = "3.0.2"
-junit = "6.0.3"
+junit = "6.1.0"
 # 1.7+ generates much more verbose code
-kotlinPoet = "2.3.0"
+kotlinPoet = "1.6.0"
 kotlinStdLib = "2.2.21"
 #noinspection UnusedVersionCatalogEntry
 kotlinTarget = "2.2"
-kotlinToolchain = "2.3.20"
+kotlinToolchain = "2.3.21"
 kotlinxHtml = "0.12.0"
 # 1.9.0 is the last version compatible with Kotlin 2.2
 kotlinxSerialization = "1.9.0"
-kotlinxCoroutines = "1.10.2"
+kotlinxCoroutines = "1.11.0"
 #noinspection UnusedVersionCatalogEntry
 ktfmt = "0.62"
 # replaces nuValidator's log4j dependency
 # 2.17.1 is the last version compatible with nuValidator
 log4j = "2.17.1"
-msgpack = "0.9.11"
+msgpack = "0.9.12"
 nexusPublishPlugin = "2.0.0"
-nullaway = "0.13.2"
+nullaway = "0.13.4"
 nullawayPlugin = "3.0.0"
-nuValidator = "26.4.2"
+nuValidator = "26.5.22"
 paguro = "3.10.3"
-shadowPlugin = "9.4.1"
-slf4j = "2.0.17"
+shadowPlugin = "9.4.2"
+slf4j = "2.0.18"
 snakeYaml = "3.0.1"
-spotlessPlugin = "8.4.0"
+spotlessPlugin = "8.6.0"
 wiremock = "3.13.2"
 
 [libraries] # ordered alphabetically
@@ -74,6 +73,7 @@ commonMarkTables = { group = "org.commonmark", name = "commonmark-ext-gfm-tables
 downloadTaskPlugin = { group = "de.undercouch", name = "gradle-download-task", version.ref = "downloadTaskPlugin" }
 #noinspection UnusedVersionCatalogEntry
 errorProne = { group = "com.google.errorprone", name = "error_prone_core", version.ref = "errorProne" }
+errorProneAnnotations = { group = "com.google.errorprone", name = "error_prone_annotations", version.ref = "errorProne" }
 errorPronePlugin = { group = "net.ltgt.gradle", name = "gradle-errorprone-plugin", version.ref = "errorPronePlugin" }
 geantyref = { group = "io.leangen.geantyref", name = "geantyref", version.ref = "geantyref" }
 graalCompiler = { group = "org.graalvm.compiler", name = "compiler", version.ref = "graalVm" }
@@ -87,7 +87,6 @@ jlineTerminal = { group = "org.jline", name = "jline-terminal", version.ref = "j
 jlineTerminalJni = { group = "org.jline", name = "jline-terminal-jni", version.ref = "jline" }
 #noinspection UnusedVersionCatalogEntry
 jspecify = { group = "org.jspecify", name = "jspecify", version.ref = "jspecify" }
-jsr305 = { group = "com.google.code.findbugs", name = "jsr305", version.ref = "jsr305" }
 junitApi = { group = "org.junit.jupiter", name = "junit-jupiter-api", version.ref = "junit" }
 junitEngine = { group = "org.junit.jupiter", name = "junit-jupiter-engine", version.ref = "junit" }
 junitParams = { group = "org.junit.jupiter", name = "junit-jupiter-params", version.ref = "junit" }

gradle/wrapper/gradle-wrapper.properties

@@ -1,8 +1,10 @@
 distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
-distributionSha256Sum=2ab2958f2a1e51120c326cad6f385153bb11ee93b3c216c5fccebfdfbb7ec6cb
-distributionUrl=https\://services.gradle.org/distributions/gradle-9.4.1-bin.zip
+distributionSha256Sum=bafc141b619ad6350fd975fc903156dd5c151998cc8b058e8c1044ab5f7b031f
+distributionUrl=https\://services.gradle.org/distributions/gradle-9.5.1-bin.zip
 networkTimeout=10000
+retries=0
+retryBackOffMs=500
 validateDistributionUrl=true
 zipStoreBase=GRADLE_USER_HOME
 zipStorePath=wrapper/dists

gradlew

@@ -57,7 +57,7 @@
 #       Darwin, MinGW, and NonStop.
 #
 #   (3) This script is generated from the Groovy template
-#       https://github.com/gradle/gradle/blob/2d6327017519d23b96af35865dc997fcb544fb40/platforms/jvm/plugins-application/src/main/resources/org/gradle/api/internal/plugins/unixStartScript.txt
+#       https://github.com/gradle/gradle/blob/3d91ce3b8caaf77ad09f381f43615b715b53f72c/platforms/jvm/plugins-application/src/main/resources/org/gradle/api/internal/plugins/unixStartScript.txt
 #       within the Gradle project.
 #
 #       You can find Gradle at https://github.com/gradle/gradle/.

gradlew.bat

@@ -23,8 +23,8 @@
 @rem
 @rem ##########################################################################
 
-@rem Set local scope for the variables with windows NT shell
-if "%OS%"=="Windows_NT" setlocal
+@rem Set local scope for the variables, and ensure extensions are enabled
+setlocal EnableExtensions
 
 set DIRNAME=%~dp0
 if "%DIRNAME%"=="" set DIRNAME=.
@@ -51,7 +51,7 @@ echo. 1>&2
 echo Please set the JAVA_HOME variable in your environment to match the 1>&2
 echo location of your Java installation. 1>&2
 
-goto fail
+"%COMSPEC%" /c exit 1
 
 :findJavaFromJavaHome
 set JAVA_HOME=%JAVA_HOME:"=%
@@ -65,7 +65,7 @@ echo. 1>&2
 echo Please set the JAVA_HOME variable in your environment to match the 1>&2
 echo location of your Java installation. 1>&2
 
-goto fail
+"%COMSPEC%" /c exit 1
 
 :execute
 @rem Setup the command line
@@ -73,21 +73,10 @@ goto fail
 
 
 @rem Execute Gradle
-"%JAVA_EXE%" %DEFAULT_JVM_OPTS% %JAVA_OPTS% %GRADLE_OPTS% "-Dorg.gradle.appname=%APP_BASE_NAME%" -jar "%APP_HOME%\gradle\wrapper\gradle-wrapper.jar" %*
+@rem endlocal doesn't take effect until after the line is parsed and variables are expanded
+@rem which allows us to clear the local environment before executing the java command
+endlocal & "%JAVA_EXE%" %DEFAULT_JVM_OPTS% %JAVA_OPTS% %GRADLE_OPTS% "-Dorg.gradle.appname=%APP_BASE_NAME%" -jar "%APP_HOME%\gradle\wrapper\gradle-wrapper.jar" %* & call :exitWithErrorLevel
 
-:end
-@rem End local scope for the variables with windows NT shell
-if %ERRORLEVEL% equ 0 goto mainEnd
-
-:fail
-rem Set variable GRADLE_EXIT_CONSOLE if you need the _script_ return code instead of
-rem the _cmd.exe /c_ return code!
-set EXIT_CODE=%ERRORLEVEL%
-if %EXIT_CODE% equ 0 set EXIT_CODE=1
-if not ""=="%GRADLE_EXIT_CONSOLE%" exit %EXIT_CODE%
-exit /b %EXIT_CODE%
-
-:mainEnd
-if "%OS%"=="Windows_NT" endlocal
-
-:omega
+:exitWithErrorLevel
+@rem Use "%COMSPEC%" /c exit to allow operators to work properly in scripts
+"%COMSPEC%" /c exit %ERRORLEVEL%

pkl-cli/src/main/kotlin/org/pkl/cli/CliCommandRunner.kt

@@ -67,7 +67,7 @@ constructor(
     val evaluator = builder.build()
     evaluator.use {
       evaluator.evaluateCommand(
-        uri(resolvedSourceModules.first()),
+        uri(options.normalizedSourceModules.first()),
         reservedFlagNames,
         reservedFlagShortNames,
       ) { spec ->

pkl-cli/src/main/kotlin/org/pkl/cli/CliEvaluator.kt

@@ -115,7 +115,7 @@ constructor(
     // used just to resolve the `%{moduleName}` placeholder
     val moduleResolver = ModuleResolver(moduleKeyFactories(ModulePathResolver.empty()))
 
-    return resolvedSourceModules.associateWith { uri ->
+    return options.base.normalizedSourceModules.associateWith { uri ->
       val moduleDir: String? =
         IoUtils.toPath(uri)?.let {
           IoUtils.relativize(it.parent, workingDir).toString().ifEmpty { "." }
@@ -191,7 +191,7 @@ constructor(
         }
       } else {
         var outputWritten = false
-        for (moduleUri in resolvedSourceModules) {
+        for (moduleUri in options.base.normalizedSourceModules) {
           val moduleSource = toModuleSource(moduleUri, inputStream)
           if (options.expression != null) {
             val output = evaluator.evaluateExpressionString(moduleSource, options.expression)
@@ -229,42 +229,43 @@ constructor(
   private fun writeMultipleFileOutput(builder: EvaluatorBuilder) {
     val outputDirs = directoryOutputPaths!!
     val writtenFiles = mutableMapOf<Path, OutputFile>()
-    for ((moduleUri, outputDir) in outputDirs) {
-      val evaluator = builder.setOutputFormat(options.outputFormat).build()
-      if (outputDir.exists() && !outputDir.isDirectory()) {
-        throw CliException("Output path `$outputDir` exists and is not a directory.")
-      }
-      val moduleSource = toModuleSource(moduleUri, inputStream)
-      val output = evaluator.evaluateOutputFiles(moduleSource)
-      val realOutputDir = if (outputDir.exists()) outputDir.toRealPath() else outputDir
+    builder.setOutputFormat(options.outputFormat).build().use { evaluator ->
+      for ((moduleUri, outputDir) in outputDirs) {
+        if (outputDir.exists() && !outputDir.isDirectory()) {
+          throw CliException("Output path `$outputDir` exists and is not a directory.")
+        }
+        val moduleSource = toModuleSource(moduleUri, inputStream)
+        val output = evaluator.evaluateOutputFiles(moduleSource)
+        val realOutputDir = if (outputDir.exists()) outputDir.toRealPath() else outputDir
 
-      for ((pathSpec, fileOutput) in output) {
-        checkPathSpec(pathSpec)
-        val (realPath, resolvedPath) = realOutputDir.resolveRealPath(Path.of(pathSpec))
-        if (!realPath.startsWith(realOutputDir)) {
-          throw CliException(
-            "Output file conflict: `output.files` entry `\"$pathSpec\"` in module `$moduleUri` resolves to file path `$realPath`, which is outside output directory `$realOutputDir`."
+        for ((pathSpec, fileOutput) in output) {
+          checkPathSpec(pathSpec)
+          val (realPath, resolvedPath) = realOutputDir.resolveRealPath(Path.of(pathSpec))
+          if (!realPath.startsWith(realOutputDir)) {
+            throw CliException(
+              "Output file conflict: `output.files` entry `\"$pathSpec\"` in module `$moduleUri` resolves to file path `$realPath`, which is outside output directory `$realOutputDir`."
+            )
+          }
+          val previousOutput = writtenFiles[realPath]
+          if (previousOutput != null) {
+            throw CliException(
+              "Output file conflict: `output.files` entries `\"${previousOutput.pathSpec}\"` in module `${previousOutput.moduleUri}` and `\"$pathSpec\"` in module `$moduleUri` resolve to the same file path `$realPath`."
+            )
+          }
+          if (realPath.isDirectory()) {
+            throw CliException(
+              "Output file conflict: `output.files` entry `\"$pathSpec\"` in module `$moduleUri` resolves to file path `$realPath`, which is a directory."
+            )
+          }
+          writtenFiles[realPath] = OutputFile(pathSpec, moduleUri)
+          realPath.createParentDirectories()
+          realPath.writeBytes(fileOutput.bytes)
+          outputStream.writeText(
+            IoUtils.relativize(resolvedPath, currentWorkingDir).toString() +
+              IoUtils.getLineSeparator()
           )
+          outputStream.flush()
         }
-        val previousOutput = writtenFiles[realPath]
-        if (previousOutput != null) {
-          throw CliException(
-            "Output file conflict: `output.files` entries `\"${previousOutput.pathSpec}\"` in module `${previousOutput.moduleUri}` and `\"$pathSpec\"` in module `$moduleUri` resolve to the same file path `$realPath`."
-          )
-        }
-        if (realPath.isDirectory()) {
-          throw CliException(
-            "Output file conflict: `output.files` entry `\"$pathSpec\"` in module `$moduleUri` resolves to file path `$realPath`, which is a directory."
-          )
-        }
-        writtenFiles[realPath] = OutputFile(pathSpec, moduleUri)
-        realPath.createParentDirectories()
-        realPath.writeBytes(fileOutput.bytes)
-        outputStream.writeText(
-          IoUtils.relativize(resolvedPath, currentWorkingDir).toString() +
-            IoUtils.getLineSeparator()
-        )
-        outputStream.flush()
       }
     }
   }

pkl-cli/src/main/kotlin/org/pkl/cli/CliImportAnalyzer.kt

@@ -44,19 +44,19 @@ constructor(
   private val sourceModule =
     ModuleSource.text(
       """
-        import "pkl:analyze"
+      import "pkl:analyze"
 
-        local importStrings = read*("prop:pkl.analyzeImports.**").toMap().values.toSet()
+      local importStrings = read*("prop:pkl.analyzeImports.**").toMap().values.toSet()
 
-        output {
-          value = analyze.importGraph(importStrings)
-          renderer {
-            converters {
-              [Map] = (it) -> it.toMapping()
-              [Set] = (it) -> it.toListing()
-            }
+      output {
+        value = analyze.importGraph(importStrings)
+        renderer {
+          converters {
+            [Map] = (it) -> it.toMapping()
+            [Set] = (it) -> it.toListing()
           }
         }
+      }
       """
         .trimIndent()
     )
@@ -66,7 +66,7 @@ constructor(
     try {
       return builder
         .apply {
-          for ((idx, sourceModule) in resolvedSourceModules.withIndex()) {
+          for ((idx, sourceModule) in options.base.normalizedSourceModules.withIndex()) {
             addExternalProperty("pkl.analyzeImports.$idx", sourceModule.toString())
           }
         }

pkl-cli/src/main/kotlin/org/pkl/cli/CliTestRunner.kt

@@ -15,6 +15,7 @@
  */
 package org.pkl.cli
 
+import java.io.StringWriter
 import java.io.Writer
 import org.pkl.commons.cli.*
 import org.pkl.core.Closeables
@@ -22,8 +23,9 @@ import org.pkl.core.EvaluatorBuilder
 import org.pkl.core.ModuleSource.uri
 import org.pkl.core.PklException
 import org.pkl.core.TestResults
-import org.pkl.core.stdlib.test.report.JUnitReport
-import org.pkl.core.stdlib.test.report.SimpleReport
+import org.pkl.core.stdlib.test.report.JUnitReporter
+import org.pkl.core.stdlib.test.report.MinimalReporter
+import org.pkl.core.stdlib.test.report.SpecReporter
 import org.pkl.core.util.ErrorMessages
 
 class CliTestRunner
@@ -47,15 +49,15 @@ constructor(
 
   private fun evalTest(builder: EvaluatorBuilder) {
     val sources =
-      resolvedSourceModules.ifEmpty { project?.tests?.map { it.toUri() } }
+      options.normalizedSourceModules.ifEmpty { project?.tests?.map { it.toUri() } }
         ?:
         // keep in sync with error message thrown by clikt
         throw CliException(
           """
           Usage: pkl test [<options>] <modules>...
-          
+
           Error: missing argument <modules>
-        """
+          """
             .trimIndent()
         )
 
@@ -64,13 +66,15 @@ constructor(
       var failed = false
       var isExampleWrittenFailure = true
       val moduleNames = mutableSetOf<String>()
-      val reporter = SimpleReport(useColor)
+      val reporter =
+        when (testOptions.reporter) {
+          TestReporter.SPEC -> SpecReporter(useColor)
+          TestReporter.MINIMAL -> MinimalReporter(useColor)
+        }
       val allTestResults = mutableListOf<TestResults>()
 
       val junitDir = testOptions.junitDir
-      if (junitDir != null) {
-        junitDir.toFile().mkdirs()
-      }
+      junitDir?.toFile()?.mkdirs()
 
       for ((idx, moduleUri) in sources.withIndex()) {
         try {
@@ -80,8 +84,11 @@ constructor(
             failed = results.failed()
             isExampleWrittenFailure = results.isExampleWrittenFailure.and(isExampleWrittenFailure)
           }
-          reporter.report(results, consoleWriter)
-          if (sources.size > 1 && idx != sources.size - 1) {
+          val tmpWriter = StringWriter()
+          reporter.report(results, tmpWriter)
+          val report = tmpWriter.toString()
+          consoleWriter.write(report)
+          if (report.isNotEmpty() && sources.size > 1 && idx != sources.size - 1) {
             consoleWriter.append('\n')
           }
           consoleWriter.flush()
@@ -101,7 +108,7 @@ constructor(
             moduleNames += moduleName
 
             if (!testOptions.junitAggregateReports) {
-              JUnitReport().reportToPath(results, junitDir.resolve(moduleName))
+              JUnitReporter().reportToPath(results, junitDir.resolve(moduleName))
             }
           }
         } catch (ex: Exception) {
@@ -119,7 +126,7 @@ constructor(
       }
       if (testOptions.junitAggregateReports && junitDir != null) {
         val fileName = "${testOptions.junitAggregateSuiteName}.xml"
-        JUnitReport(testOptions.junitAggregateSuiteName)
+        JUnitReporter(testOptions.junitAggregateSuiteName)
           .summarizeToPath(allTestResults, junitDir.resolve(fileName))
       }
       consoleWriter.append('\n')

pkl-cli/src/main/kotlin/org/pkl/cli/repl/ReplMessages.kt

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -47,7 +47,7 @@ internal object ReplMessages {
     * Incomplete input will be continued on the next line.
     * Multi-line programs can be copy-pasted into the REPL.
 
-  """
+    """
       .trimIndent()
 
   val examples: String =

pkl-cli/src/test/kotlin/org/pkl/cli/CliEvaluatorTest.kt

@@ -58,7 +58,7 @@ class CliEvaluatorTest {
         name = "pigeon"
         age = 20 + 10
       }
-    """
+      """
         .trimIndent()
 
     private val packageServer = PackageServer()
@@ -243,12 +243,12 @@ person:
       .resolve("test2.pkl")
       .writeString(
         """
-      amends "test.pkl"
-      
-      person {
-        name = "barn owl"
-      }
-      """
+        amends "test.pkl"
+
+        person {
+          name = "barn owl"
+        }
+        """
           .trimIndent()
       )
 
@@ -655,9 +655,9 @@ result = someLib.x
       "output.pcf",
       """
       x = 1
-      
+
       y = 2
-      
+
       z = 3
       """
         .trimIndent(),
@@ -739,7 +739,7 @@ result = someLib.x
               }
             } 
           }
-        """
+          """
             .trimIndent(),
         )
       )
@@ -815,31 +815,31 @@ result = someLib.x
         writePklFile(
           "test0.pkl",
           """
-        output {
-          files {
-            ["foo.pcf"] {
-              value = new Dynamic {
-                ["bar"] = "baz"
+          output {
+            files {
+              ["foo.pcf"] {
+                value = new Dynamic {
+                  ["bar"] = "baz"
+                }
               }
             }
           }
-        }
-        """
+          """
             .trimIndent(),
         ),
         writePklFile(
           "test1.pkl",
           """
-        output {
-          files {
-            ["bar.pcf"] {
-              value = new Dynamic {
-                ["bar"] = "baz"
+          output {
+            files {
+              ["bar.pcf"] {
+                value = new Dynamic {
+                  ["bar"] = "baz"
+                }
               }
             }
           }
-        }
-        """
+          """
             .trimIndent(),
         ),
       )
@@ -860,27 +860,27 @@ result = someLib.x
         writePklFile(
           "bar.pkl",
           """
-        output {
-          files {
-            ["foo.pcf"] {
-              text = "myBar"
+          output {
+            files {
+              ["foo.pcf"] {
+                text = "myBar"
+              }
             }
           }
-        }
-      """
+          """
             .trimIndent(),
         ),
         writePklFile(
           "foo.pkl",
           """
-        output {
-          files {
-            ["foo.pcf"] {
-              text = "myFoo"
+          output {
+            files {
+              ["foo.pcf"] {
+                text = "myFoo"
+              }
             }
           }
-        }
-      """
+          """
             .trimIndent(),
         ),
       )
@@ -918,7 +918,7 @@ result = someLib.x
             }
           }
         }
-      """
+        """
           .trimIndent(),
       )
     val options =
@@ -949,7 +949,7 @@ result = someLib.x
             }
           }
         }
-      """
+        """
           .trimIndent(),
       )
     val options =
@@ -970,23 +970,23 @@ result = someLib.x
         writePklFile(
           "test1.pkl",
           """
-        output {
-          files {
-            ["."] { text = "bar" }
+          output {
+            files {
+              ["."] { text = "bar" }
+            }
           }
-        }
-      """
+          """
             .trimIndent(),
         ),
         writePklFile(
           "test2.pkl",
           """
-        output {
-          files {
-            ["myDir"] { text = "bar" }
+          output {
+            files {
+              ["myDir"] { text = "bar" }
+            }
           }
-        }
-      """
+          """
             .trimIndent(),
         ),
       )
@@ -1009,23 +1009,23 @@ result = someLib.x
         writePklFile(
           "test1.pkl",
           """
-        output {
-          files {
-            ["foo.txt"] { text = "bar" }
+          output {
+            files {
+              ["foo.txt"] { text = "bar" }
+            }
           }
-        }
-      """
+          """
             .trimIndent(),
         ),
         writePklFile(
           "test2.pkl",
           """
-        output {
-          files {
-            ["foo.txt"] { text = "bar" }
+          output {
+            files {
+              ["foo.txt"] { text = "bar" }
+            }
           }
-        }
-      """
+          """
             .trimIndent(),
         ),
       )
@@ -1045,13 +1045,13 @@ result = someLib.x
       writePklFile(
         "test.pkl",
         """
-      output {
-        files {
-          ["foo.txt"] { text = "bar" }
-          ["./foo.txt"] { text = "bar" }
+        output {
+          files {
+            ["foo.txt"] { text = "bar" }
+            ["./foo.txt"] { text = "bar" }
+          }
         }
-      }
-    """
+        """
           .trimIndent(),
       )
     val options =
@@ -1071,12 +1071,12 @@ result = someLib.x
       writePklFile(
         "test.pkl",
         """
-      output {
-        files {
-          ["foo:bar"] { text = "bar" }
+        output {
+          files {
+            ["foo:bar"] { text = "bar" }
+          }
         }
-      }
-    """
+        """
           .trimIndent(),
       )
 
@@ -1096,12 +1096,12 @@ result = someLib.x
       writePklFile(
         "test.pkl",
         """
-      output {
-        files {
-          ["foo\\bar"] { text = "bar" }
+        output {
+          files {
+            ["foo\\bar"] { text = "bar" }
+          }
         }
-      }
-    """
+        """
           .trimIndent(),
       )
 
@@ -1120,10 +1120,10 @@ result = someLib.x
       writePklFile(
         "test.pkl",
         """
-      foo {
-        bar = 1
-      }
-    """
+        foo {
+          bar = 1
+        }
+        """
           .trimIndent(),
       )
     val options =
@@ -1136,8 +1136,8 @@ result = someLib.x
     assertThat(buffer.toString(StandardCharsets.UTF_8))
       .isEqualTo(
         """
-      new Dynamic { bar = 1 }
-    """
+        new Dynamic { bar = 1 }
+        """
           .trimIndent()
       )
   }
@@ -1148,13 +1148,13 @@ result = someLib.x
       writePklFile(
         "test.pkl",
         """
-      class Person {
-        name: String
+        class Person {
+          name: String
 
-        function toString() = "Person(\(name))"
-      }
-      person: Person = new { name = "Frodo" }
-    """
+          function toString() = "Person(\(name))"
+        }
+        person: Person = new { name = "Frodo" }
+        """
           .trimIndent(),
       )
     val options =
@@ -1173,10 +1173,10 @@ result = someLib.x
       writePklFile(
         "test.pkl",
         """
-      person {
-        friend { name = "Bilbo" }
-      }
-    """
+        person {
+          friend { name = "Bilbo" }
+        }
+        """
           .trimIndent(),
       )
     val options =
@@ -1196,17 +1196,17 @@ result = someLib.x
       writePklFile(
         "test.pkl",
         """
-      res = 1
-    """
+        res = 1
+        """
           .trimIndent(),
       )
     writePklFile(
       "PklProject",
       """
       amends "pkl:Project"
-      
+
       package = throw("invalid project package")
-    """
+      """
         .trimIndent(),
     )
     val options =
@@ -1225,8 +1225,8 @@ result = someLib.x
       writePklFile(
         "test.pkl",
         """
-      res = read*("env:**")
-    """
+        res = read*("env:**")
+        """
           .trimIndent(),
       )
     writePklFile(
@@ -1234,14 +1234,14 @@ result = someLib.x
       // language=Pkl
       """
       amends "pkl:Project"
-      
+
       evaluatorSettings {
         env {
           ["foo"] = "foo"
           ["bar"] = "bar"
         }
       }
-    """
+      """
         .trimIndent(),
     )
     val options =
@@ -1251,12 +1251,12 @@ result = someLib.x
     assertThat(buffer.toString(StandardCharsets.UTF_8))
       .isEqualTo(
         """
-      res {
-        ["env:bar"] = "bar"
-        ["env:foo"] = "foo"
-      }
-      
-    """
+        res {
+          ["env:bar"] = "bar"
+          ["env:foo"] = "foo"
+        }
+
+        """
           .trimIndent()
       )
   }
@@ -1295,7 +1295,7 @@ result = someLib.x
         CliBaseOptions(
           sourceModules = listOf(moduleUri),
           workingDir = tempDir,
-          caCertificates = listOf(FileTestUtils.selfSignedCertificate),
+          caCertificates = listOf(FileTestUtils.selfSignedCertificatePem),
         )
       )
     val buffer = ByteArrayOutputStream()
@@ -1337,7 +1337,7 @@ result = someLib.x
         CliBaseOptions(
           sourceModules = listOf(moduleUri),
           workingDir = tempDir,
-          caCertificates = listOf(FileTestUtils.selfSignedCertificate),
+          caCertificates = listOf(FileTestUtils.selfSignedCertificatePem),
           settings = settingsFile,
         )
       )
@@ -1353,10 +1353,10 @@ result = someLib.x
       writePklFile(
         "test.pkl",
         """
-      import "package://localhost:0/birds@0.5.0#/catalog/Swallow.pkl"
-      
-      res = Swallow
-    """
+        import "package://localhost:0/birds@0.5.0#/catalog/Swallow.pkl"
+
+        res = Swallow
+        """
           .trimIndent(),
       )
     val buffer = ByteArrayOutputStream()
@@ -1367,7 +1367,7 @@ result = someLib.x
           workingDir = tempDir,
           moduleCacheDir = tempDir,
           noCache = true,
-          caCertificates = listOf(FileTestUtils.selfSignedCertificate),
+          caCertificates = listOf(FileTestUtils.selfSignedCertificatePem),
           testPort = packageServer.port,
         )
       )
@@ -1375,14 +1375,14 @@ result = someLib.x
     assertThat(buffer.toString(StandardCharsets.UTF_8))
       .isEqualTo(
         """
-      res {
-        name = "Swallow"
-        favoriteFruit {
-          name = "Apple"
+        res {
+          name = "Swallow"
+          favoriteFruit {
+            name = "Apple"
+          }
         }
-      }
-      
-    """
+
+        """
           .trimIndent()
       )
     assertThat(tempDir.resolve("package-2")).doesNotExist()
@@ -1473,7 +1473,7 @@ result = someLib.x
           sourceModules = listOf(URI("package://localhost:1/birds@0.5.0#/catalog/Ostrich.pkl")),
           noCache = true,
           httpProxy = URI(wwRuntimeInfo.httpBaseUrl),
-          caCertificates = listOf(FileTestUtils.selfSignedCertificate),
+          caCertificates = listOf(FileTestUtils.selfSignedCertificatePem),
           allowedModules = SecurityManagers.defaultAllowedModules + Pattern.compile("http:"),
         )
       )
@@ -1481,13 +1481,13 @@ result = someLib.x
     assertThat(output)
       .isEqualTo(
         """
-      name = "Ostrich"
+        name = "Ostrich"
 
-      favoriteFruit {
-        name = "Orange"
-      }
+        favoriteFruit {
+          name = "Orange"
+        }
 
-    """
+        """
           .trimIndent()
       )
     verify(getRequestedFor(urlEqualTo("birds@0.5.0")))
@@ -1590,13 +1590,13 @@ result = someLib.x
     homeDir.writeFile(
       "settings.pkl",
       """
-        amends "pkl:settings"
+      amends "pkl:settings"
 
-        http {
-          proxy {
-            address = "http://invalid.proxy.address"
-          }
+      http {
+        proxy {
+          address = "http://invalid.proxy.address"
         }
+      }
       """
         .trimIndent(),
     )
@@ -1614,6 +1614,24 @@ result = someLib.x
     assertThat(output).isEqualTo("result = 1\n")
   }
 
+  @Test
+  fun `eval configured http headers`(wwRuntimeInfo: WireMockRuntimeInfo) {
+    stubFor(get(anyUrl()).willReturn(ok("result = 1")))
+    val file = URI("${wwRuntimeInfo.httpBaseUrl}/foo.pkl")
+    val output =
+      evalToConsole(
+        CliEvaluatorOptions(
+          CliBaseOptions(
+            sourceModules = listOf(file),
+            httpHeaders = mapOf("**" to mapOf("X-Foo" to listOf("Foo"))),
+            allowedModules =
+              listOf(Pattern.compile("http:"), Pattern.compile("file:"), Pattern.compile("pkl:")),
+          )
+        )
+      )
+    verify(getRequestedFor(urlEqualTo("/foo.pkl")).withHeader("X-Foo", equalTo("Foo")))
+  }
+
   @Test
   fun `eval file with non-ASCII name`() {
     val tempDirUri = tempDir.toUri()
@@ -1677,26 +1695,26 @@ result = someLib.x
       writePklFile(
         "test.pkl",
         """
-          pigeon {
-            name = "Pigeon"
-            diet = "Seeds"
-          }
-          parrot {
-            name = "Parrot"
-            diet = "Seeds"
-          }
-          output {
-            files {
-              ["pigeon.json"] {
-                value = pigeon
-                renderer = new JsonRenderer {}
-              }
-              ["birds/parrot.yaml"] {
-                value = parrot
-                renderer = new YamlRenderer {}
-              }
+        pigeon {
+          name = "Pigeon"
+          diet = "Seeds"
+        }
+        parrot {
+          name = "Parrot"
+          diet = "Seeds"
+        }
+        output {
+          files {
+            ["pigeon.json"] {
+              value = pigeon
+              renderer = new JsonRenderer {}
+            }
+            ["birds/parrot.yaml"] {
+              value = parrot
+              renderer = new YamlRenderer {}
             }
           }
+        }
         """
           .trimIndent(),
       )
@@ -1713,10 +1731,10 @@ result = someLib.x
       realOutputDir.resolve("pigeon.json"),
       "pigeon.json",
       """
-        {
-          "name": "Pigeon",
-          "diet": "Seeds"
-        }
+      {
+        "name": "Pigeon",
+        "diet": "Seeds"
+      }
       """
         .trimIndent(),
     )
@@ -1725,8 +1743,8 @@ result = someLib.x
       realOutputDir.resolve("birds/parrot.yaml"),
       "parrot.yaml",
       """
-        name: Parrot
-        diet: Seeds
+      name: Parrot
+      diet: Seeds
       """
         .trimIndent(),
     )
@@ -1735,10 +1753,10 @@ result = someLib.x
       symlinkOutputDir.resolve("pigeon.json"),
       "pigeon.json",
       """
-        {
-          "name": "Pigeon",
-          "diet": "Seeds"
-        }
+      {
+        "name": "Pigeon",
+        "diet": "Seeds"
+      }
       """
         .trimIndent(),
     )
@@ -1747,13 +1765,39 @@ result = someLib.x
       symlinkOutputDir.resolve("birds/parrot.yaml"),
       "parrot.yaml",
       """
-        name: Parrot
-        diet: Seeds
+      name: Parrot
+      diet: Seeds
       """
         .trimIndent(),
     )
   }
 
+  @Test
+  fun `eval dependency notation source`(@TempDir tempDir: Path) {
+    PackageServer.populateCacheDir(tempDir)
+    val projectPath =
+      FileTestUtils.rootProjectDir.resolve(
+        "pkl-commons-cli/src/main/resources/org/pkl/commons/cli/project1/"
+      )
+    val options =
+      CliEvaluatorOptions(
+        CliBaseOptions(
+          sourceModules = listOf(URI("@fruit/catalog/apple.pkl")),
+          projectDir = projectPath,
+          moduleCacheDir = tempDir,
+        )
+      )
+    val output = evalToConsole(options)
+    assertThat(output)
+      .isEqualTo(
+        """
+        name = "Apple 🍎"
+
+        """
+          .trimIndent()
+      )
+  }
+
   private fun evalModuleThatImportsPackage(certsFile: Path?, testPort: Int = -1) {
     val moduleUri =
       writePklFile(

pkl-cli/src/test/kotlin/org/pkl/cli/CliMainTest.kt

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024-2025 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -69,12 +69,12 @@ class CliMainTest {
     val code =
       """
       x = 3
-      
+
       output {
         value = x
         renderer = new JsonRenderer {}
       }
-    """
+      """
         .trimIndent()
     val inputFile = tempDir.resolve("test.pkl").writeString(code).toString()
     val outputFile = makeSymdir(tempDir, "out", "linkOut").resolve("test.pkl").toString()
@@ -169,4 +169,60 @@ class CliMainTest {
     link.createSymbolicLinkPointingTo(dir)
     return link
   }
+
+  @Test
+  fun `invalid http header glob pattern`() {
+    val ex =
+      assertThrows<BadParameterValue> {
+        rootCmd.parse(arrayOf("eval", "--http-header", "foo{{}}=bar:baz", "myModule.pkl"))
+      }
+    assertThat(ex.message)
+      .contains("Sub-patterns cannot be nested. To fix, remove or escape the inner `{` character.")
+  }
+
+  @Test
+  fun `forbidden http header name`() {
+    val ex =
+      assertThrows<BadParameterValue> {
+        rootCmd.parse(arrayOf("eval", "--http-header", "**=Connection: baz", "myModule.pkl"))
+      }
+    assertThat(ex.message).contains("HTTP header `Connection` is a reserved header")
+  }
+
+  @Test
+  fun `bad http header value`() {
+    val ex =
+      assertThrows<BadParameterValue> {
+        rootCmd.parse(arrayOf("eval", "--http-header", "**=X-Foo:🙃", "myModule.pkl"))
+      }
+    assertThat(ex.message).contains("HTTP header value `🙃` has invalid syntax")
+  }
+
+  @Test
+  fun `multiple headers`() {
+    val cmd = RootCommand()
+    cmd.parse(
+      arrayOf(
+        "eval",
+        "--http-header",
+        "**=X-Foo:Foo",
+        "--http-header",
+        "**=X-Foo:Foo2",
+        "--http-header",
+        "**=X-Bar:Bar",
+        "--http-header",
+        "https://example.com/**=X-Qux:Qux",
+        "pkl:base",
+      )
+    )
+
+    val evalCmd = cmd.registeredSubcommands().filterIsInstance<EvalCommand>().first()
+    assertThat(evalCmd.baseOptions.httpHeaders)
+      .isEqualTo(
+        mapOf(
+          "**" to mapOf("X-Foo" to listOf("Foo", "Foo2"), "X-Bar" to listOf("Bar")),
+          "https://example.com/**" to mapOf("X-Qux" to listOf("Qux")),
+        )
+      )
+  }
 }

pkl-cli/src/test/kotlin/org/pkl/cli/CliPackageDownloaderTest.kt

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024-2025 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -44,7 +44,7 @@ class CliPackageDownloaderTest {
         baseOptions =
           CliBaseOptions(
             moduleCacheDir = tempDir,
-            caCertificates = listOf(FileTestUtils.selfSignedCertificate),
+            caCertificates = listOf(FileTestUtils.selfSignedCertificatePem),
             testPort = server.port,
           ),
         packageUris =
@@ -70,11 +70,11 @@ class CliPackageDownloaderTest {
       "PklProject",
       """
       amends "pkl:Project"
-      
+
       evaluatorSettings {
         moduleCacheDir = ".my-cache"
       }
-    """
+      """
         .trimIndent(),
     )
 
@@ -83,7 +83,7 @@ class CliPackageDownloaderTest {
         baseOptions =
           CliBaseOptions(
             workingDir = tempDir,
-            caCertificates = listOf(FileTestUtils.selfSignedCertificate),
+            caCertificates = listOf(FileTestUtils.selfSignedCertificatePem),
             testPort = server.port,
           ),
         packageUris = listOf(PackageUri("package://localhost:0/birds@0.5.0")),
@@ -103,7 +103,7 @@ class CliPackageDownloaderTest {
         baseOptions =
           CliBaseOptions(
             moduleCacheDir = tempDir,
-            caCertificates = listOf(FileTestUtils.selfSignedCertificate),
+            caCertificates = listOf(FileTestUtils.selfSignedCertificatePem),
             testPort = server.port,
           ),
         packageUris =
@@ -124,7 +124,7 @@ class CliPackageDownloaderTest {
         baseOptions =
           CliBaseOptions(
             moduleCacheDir = tempDir,
-            caCertificates = listOf(FileTestUtils.selfSignedCertificate),
+            caCertificates = listOf(FileTestUtils.selfSignedCertificatePem),
             testPort = server.port,
           ),
         packageUris =
@@ -165,7 +165,7 @@ class CliPackageDownloaderTest {
         baseOptions =
           CliBaseOptions(
             moduleCacheDir = tempDir,
-            caCertificates = listOf(FileTestUtils.selfSignedCertificate),
+            caCertificates = listOf(FileTestUtils.selfSignedCertificatePem),
             testPort = server.port,
           ),
         packageUris = listOf(PackageUri("package://localhost:0/badChecksum@1.0.0")),
@@ -184,7 +184,7 @@ class CliPackageDownloaderTest {
         baseOptions =
           CliBaseOptions(
             moduleCacheDir = tempDir,
-            caCertificates = listOf(FileTestUtils.selfSignedCertificate),
+            caCertificates = listOf(FileTestUtils.selfSignedCertificatePem),
             testPort = server.port,
           ),
         packageUris =
@@ -210,7 +210,7 @@ class CliPackageDownloaderTest {
         Exception when making request `GET https://bogus.domain/notAPackage@1.0.0`:
         Error connecting to host `bogus.domain`.
 
-      """
+        """
           .trimIndent()
       )
   }
@@ -221,7 +221,7 @@ class CliPackageDownloaderTest {
         baseOptions =
           CliBaseOptions(
             moduleCacheDir = tempDir,
-            caCertificates = listOf(FileTestUtils.selfSignedCertificate),
+            caCertificates = listOf(FileTestUtils.selfSignedCertificatePem),
             testPort = server.port,
           ),
         packageUris = listOf(PackageUri("package://localhost:0/birds@0.5.0")),

pkl-cli/src/test/kotlin/org/pkl/cli/CliProjectPackagerTest.kt

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024-2025 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -85,8 +85,8 @@ class CliProjectPackagerTest {
       .resolve("PklProject")
       .writeString(
         """
-      amends "pkl:Project"
-    """
+        amends "pkl:Project"
+        """
           .trimIndent()
       )
     val packager =
@@ -108,20 +108,20 @@ class CliProjectPackagerTest {
       "myTest.pkl",
       """
       amends "pkl:test"
-      
+
       facts {
         ["1 == 2"] {
           1 == 2
         }
       }
-    """
+      """
         .trimIndent(),
     )
     tempDir.writeFile(
       "PklProject",
       """
       amends "pkl:Project"
-      
+
       package {
         name = "mypackage"
         version = "1.0.0"
@@ -129,7 +129,7 @@ class CliProjectPackagerTest {
         packageZipUrl = "https://foo.com"
         apiTests { "myTest.pkl" }
       }
-    """
+      """
         .trimIndent(),
     )
     val buffer = StringWriter()
@@ -154,13 +154,13 @@ class CliProjectPackagerTest {
       .writeString(
         """
         amends "pkl:test"
-        
+
         facts {
           ["1 == 1"] {
             1 == 1
           }
         }
-      """
+        """
           .trimIndent()
       )
     tempDir
@@ -168,7 +168,7 @@ class CliProjectPackagerTest {
       .writeString(
         """
         amends "pkl:Project"
-        
+
         package {
           name = "mypackage"
           version = "1.0.0"
@@ -176,7 +176,7 @@ class CliProjectPackagerTest {
           packageZipUrl = "https://foo.com"
           apiTests { "myTest.pkl" }
         }
-      """
+        """
           .trimIndent()
       )
     val buffer = StringWriter()
@@ -203,13 +203,13 @@ class CliProjectPackagerTest {
         """
         amends "pkl:test"
         import "@birds/Bird.pkl"
-        
+
         examples {
           ["Bird"] {
             new Bird { name = "Finch"; favoriteFruit { name = "Tangerine" } }
           }
         }
-      """
+        """
           .trimIndent()
       )
     projectDir
@@ -226,8 +226,8 @@ class CliProjectPackagerTest {
             }
           }
         }
-        
-      """
+
+        """
           .trimIndent()
       )
     projectDir
@@ -235,7 +235,7 @@ class CliProjectPackagerTest {
       .writeString(
         """
         amends "pkl:Project"
-        
+
         package {
           name = "mypackage"
           version = "1.0.0"
@@ -249,7 +249,7 @@ class CliProjectPackagerTest {
             uri = "package://localhost:0/birds@0.5.0"
           }
         }
-      """
+        """
           .trimIndent()
       )
     projectDir
@@ -298,9 +298,9 @@ class CliProjectPackagerTest {
         "a/b/foo.pkl",
         """
         module foo
-        
+
         name: String
-      """
+        """
           .trimIndent(),
       )
 
@@ -311,7 +311,7 @@ class CliProjectPackagerTest {
         foo
         bar
         baz
-      """
+        """
           .trimIndent(),
       )
 
@@ -320,14 +320,14 @@ class CliProjectPackagerTest {
       .writeString(
         """
         amends "pkl:Project"
-        
+
         package {
           name = "mypackage"
           version = "1.0.0"
           baseUri = "package://example.com/mypackage"
           packageZipUrl = "https://foo.com"
         }
-      """
+        """
           .trimIndent()
       )
     val packager =
@@ -348,18 +348,18 @@ class CliProjectPackagerTest {
     assertThat(expectedMetadata)
       .hasContent(
         """
-      {
-        "name": "mypackage",
-        "packageUri": "package://example.com/mypackage@1.0.0",
-        "version": "1.0.0",
-        "packageZipUrl": "https://foo.com",
-        "packageZipChecksums": {
-          "sha256": "e83b67722ea17ba41717ce6e99ae8ee02d66df6294bd319ce403075b1071c3e0"
-        },
-        "dependencies": {},
-        "authors": []
-      }
-    """
+        {
+          "name": "mypackage",
+          "packageUri": "package://example.com/mypackage@1.0.0",
+          "version": "1.0.0",
+          "packageZipUrl": "https://foo.com",
+          "packageZipChecksums": {
+            "sha256": "e83b67722ea17ba41717ce6e99ae8ee02d66df6294bd319ce403075b1071c3e0"
+          },
+          "dependencies": {},
+          "authors": []
+        }
+        """
           .trimIndent()
       )
     assertThat(expectedArchive).exists()
@@ -395,21 +395,21 @@ class CliProjectPackagerTest {
     tempDir.writeFile(
       "PklProject",
       """
-        amends "pkl:Project"
-        
-        package {
-          name = "mypackage"
-          version = "1.0.0"
-          baseUri = "package://example.com/mypackage"
-          packageZipUrl = "https://foo.com"
-          exclude {
-            "*.bin"
-            "child/main.pkl"
-            "*.test.pkl"
-            "examples/Ex1.pkl"
-            "tests/**"
-          }
+      amends "pkl:Project"
+
+      package {
+        name = "mypackage"
+        version = "1.0.0"
+        baseUri = "package://example.com/mypackage"
+        packageZipUrl = "https://foo.com"
+        exclude {
+          "*.bin"
+          "child/main.pkl"
+          "*.test.pkl"
+          "examples/Ex1.pkl"
+          "tests/**"
         }
+      }
       """
         .trimIndent(),
     )
@@ -444,21 +444,21 @@ class CliProjectPackagerTest {
     projectDir.writeFile(
       "PklProject",
       """
-        amends "pkl:Project"
-        
-        package {
-          name = "mypackage"
-          version = "1.0.0"
-          baseUri = "package://example.com/mypackage"
-          packageZipUrl = "https://foo.com"
-        }
-        
-        dependencies {
-          ["birds"] {
-            uri = "package://localhost:0/birds@0.5.0"
-          }
-          ["project2"] = import("../project2/PklProject")
+      amends "pkl:Project"
+
+      package {
+        name = "mypackage"
+        version = "1.0.0"
+        baseUri = "package://example.com/mypackage"
+        packageZipUrl = "https://foo.com"
+      }
+
+      dependencies {
+        ["birds"] {
+          uri = "package://localhost:0/birds@0.5.0"
         }
+        ["project2"] = import("../project2/PklProject")
+      }
       """
         .trimIndent(),
     )
@@ -489,24 +489,24 @@ class CliProjectPackagerTest {
     project2Dir.writeFile(
       "PklProject",
       """
-        amends "pkl:Project"
-        
-        package {
-          name = "project2"
-          baseUri = "package://localhost:0/project2"
-          version = "5.0.0"
-          packageZipUrl = "https://foo.com/project2.zip"
-        }
+      amends "pkl:Project"
+
+      package {
+        name = "project2"
+        baseUri = "package://localhost:0/project2"
+        version = "5.0.0"
+        packageZipUrl = "https://foo.com/project2.zip"
+      }
       """
         .trimIndent(),
     )
     project2Dir.writeFile(
       "PklProject.deps.json",
       """
-        {
-          "schemaVersion": 1,
-          "resolvedDependencies": {}
-        }
+      {
+        "schemaVersion": 1,
+        "resolvedDependencies": {}
+      }
       """
         .trimIndent(),
     )
@@ -557,18 +557,18 @@ class CliProjectPackagerTest {
     assertThat(project2Metadata.readString())
       .isEqualTo(
         """
-    {
-      "name": "project2",
-      "packageUri": "package://localhost:0/project2@5.0.0",
-      "version": "5.0.0",
-      "packageZipUrl": "https://foo.com/project2.zip",
-      "packageZipChecksums": {
-        "sha256": "8739c76e681f900923b900c9df0ef75cf421d39cabb54650c4b9ad19b6a76d85"
-      },
-      "dependencies": {},
-      "authors": []
-    }
-    """
+        {
+          "name": "project2",
+          "packageUri": "package://localhost:0/project2@5.0.0",
+          "version": "5.0.0",
+          "packageZipUrl": "https://foo.com/project2.zip",
+          "packageZipChecksums": {
+            "sha256": "8739c76e681f900923b900c9df0ef75cf421d39cabb54650c4b9ad19b6a76d85"
+          },
+          "dependencies": {},
+          "authors": []
+        }
+        """
           .trimIndent()
       )
   }
@@ -582,44 +582,44 @@ class CliProjectPackagerTest {
     projectDir.writeFile(
       "PklProject",
       """
-        amends "pkl:Project"
-        
-        package {
-          name = "mypackage"
-          version = "1.0.0"
-          baseUri = "package://example.com/mypackage"
-          packageZipUrl = "https://foo.com"
-        }
-        
-        dependencies {
-          ["birds"] {
-            uri = "package://localhost:0/birds@0.5.0"
-          }
-          ["project2"] = import("../project2/PklProject")
+      amends "pkl:Project"
+
+      package {
+        name = "mypackage"
+        version = "1.0.0"
+        baseUri = "package://example.com/mypackage"
+        packageZipUrl = "https://foo.com"
+      }
+
+      dependencies {
+        ["birds"] {
+          uri = "package://localhost:0/birds@0.5.0"
         }
+        ["project2"] = import("../project2/PklProject")
+      }
       """
         .trimIndent(),
     )
     projectDir.writeFile(
       "PklProject.deps.json",
       """
-        {
-          "schemaVersion": 1,
-          "resolvedDependencies": {
-            "package://localhost:0/birds@0": {
-              "type": "remote",
-              "uri": "projectpackage://localhost:0/birds@0.5.0",
-              "checksums": {
-                "sha256": "0a5ad2dc13f06f73f96ba94e8d01d48252bc934e2de71a837620ca0fef8a7453"
-              }
-            },
-            "package://localhost:0/project2@5": {
-              "type": "local",
-              "uri": "projectpackage://localhost:0/project2@5.0.0",
-              "path": "../project2"
+      {
+        "schemaVersion": 1,
+        "resolvedDependencies": {
+          "package://localhost:0/birds@0": {
+            "type": "remote",
+            "uri": "projectpackage://localhost:0/birds@0.5.0",
+            "checksums": {
+              "sha256": "0a5ad2dc13f06f73f96ba94e8d01d48252bc934e2de71a837620ca0fef8a7453"
             }
+          },
+          "package://localhost:0/project2@5": {
+            "type": "local",
+            "uri": "projectpackage://localhost:0/project2@5.0.0",
+            "path": "../project2"
           }
         }
+      }
       """
         .trimIndent(),
     )
@@ -627,24 +627,24 @@ class CliProjectPackagerTest {
     project2Dir.writeFile(
       "PklProject",
       """
-        amends "pkl:Project"
-        
-        package {
-          name = "project2"
-          baseUri = "package://localhost:0/project2"
-          version = "5.0.0"
-          packageZipUrl = "https://foo.com/project2.zip"
-        }
+      amends "pkl:Project"
+
+      package {
+        name = "project2"
+        baseUri = "package://localhost:0/project2"
+        version = "5.0.0"
+        packageZipUrl = "https://foo.com/project2.zip"
+      }
       """
         .trimIndent(),
     )
     project2Dir.writeFile(
       "PklProject.deps.json",
       """
-        {
-          "schemaVersion": 1,
-          "resolvedDependencies": {}
-        }
+      {
+        "schemaVersion": 1,
+        "resolvedDependencies": {}
+      }
       """
         .trimIndent(),
     )
@@ -667,23 +667,23 @@ class CliProjectPackagerTest {
     tempDir.writeFile(
       "main.pkl",
       """
-        import "../foo.pkl"
-  
-        res = foo
+      import "../foo.pkl"
+
+      res = foo
       """
         .trimIndent(),
     )
     tempDir.writeFile(
       "PklProject",
       """
-        amends "pkl:Project"
-        
-        package {
-          name = "mypackage"
-          version = "1.0.0"
-          baseUri = "package://example.com/mypackage"
-          packageZipUrl = "https://foo.com"
-        }
+      amends "pkl:Project"
+
+      package {
+        name = "mypackage"
+        version = "1.0.0"
+        baseUri = "package://example.com/mypackage"
+        packageZipUrl = "https://foo.com"
+      }
       """
         .trimIndent(),
     )
@@ -702,12 +702,12 @@ class CliProjectPackagerTest {
     assertThat(e.message)
       .startsWith(
         """
-      –– Pkl Error ––
-      Path `../foo.pkl` includes path segments that are outside the project root directory.
-      
-      1 | import "../foo.pkl"
-                 ^^^^^^^^^^^^
-    """
+        –– Pkl Error ––
+        Path `../foo.pkl` includes path segments that are outside the project root directory.
+
+        1 | import "../foo.pkl"
+                   ^^^^^^^^^^^^
+        """
           .trimIndent()
       )
   }
@@ -730,14 +730,14 @@ class CliProjectPackagerTest {
     tempDir.writeFile(
       "PklProject",
       """
-        amends "pkl:Project"
-        
-        package {
-          name = "mypackage"
-          version = "1.0.0"
-          baseUri = "package://example.com/mypackage"
-          packageZipUrl = "https://foo.com"
-        }
+      amends "pkl:Project"
+
+      package {
+        name = "mypackage"
+        version = "1.0.0"
+        baseUri = "package://example.com/mypackage"
+        packageZipUrl = "https://foo.com"
+      }
       """
         .trimIndent(),
     )
@@ -763,6 +763,43 @@ class CliProjectPackagerTest {
       )
   }
 
+  @Test
+  fun `import path verification with glob imports`(@TempDir tempDir: Path) {
+    tempDir.writeFile(
+      "main.pkl",
+      """
+      import* "**.pkl" as foo
+
+      res = foo
+      """
+        .trimIndent(),
+    )
+    tempDir.writeFile(
+      "PklProject",
+      """
+      amends "pkl:Project"
+
+      package {
+        name = "mypackage"
+        version = "1.0.0"
+        baseUri = "package://example.com/mypackage"
+        packageZipUrl = "https://foo.com"
+      }
+      """
+        .trimIndent(),
+    )
+
+    CliProjectPackager(
+        CliBaseOptions(workingDir = tempDir),
+        listOf(tempDir),
+        CliTestOptions(),
+        ".out/%{name}@%{version}",
+        skipPublishCheck = true,
+        consoleWriter = StringWriter(),
+      )
+      .run()
+  }
+
   @Test
   @DisabledOnOs(OS.WINDOWS)
   fun `import path verification -- absolute read from root dir`(@TempDir tempDir: Path) {
@@ -776,14 +813,14 @@ class CliProjectPackagerTest {
     tempDir.writeFile(
       "PklProject",
       """
-        amends "pkl:Project"
-        
-        package {
-          name = "mypackage"
-          version = "1.0.0"
-          baseUri = "package://example.com/mypackage"
-          packageZipUrl = "https://foo.com"
-        }
+      amends "pkl:Project"
+
+      package {
+        name = "mypackage"
+        version = "1.0.0"
+        baseUri = "package://example.com/mypackage"
+        packageZipUrl = "https://foo.com"
+      }
       """
         .trimIndent(),
     )
@@ -814,21 +851,21 @@ class CliProjectPackagerTest {
     tempDir.writeFile(
       "foo/bar.pkl",
       """
-        import "baz.pkl"
+      import "baz.pkl"
       """
         .trimIndent(),
     )
     tempDir.writeFile(
       "PklProject",
       """
-        amends "pkl:Project"
-        
-        package {
-          name = "mypackage"
-          version = "1.0.0"
-          baseUri = "package://example.com/mypackage"
-          packageZipUrl = "https://foo.com"
-        }
+      amends "pkl:Project"
+
+      package {
+        name = "mypackage"
+        version = "1.0.0"
+        baseUri = "package://example.com/mypackage"
+        packageZipUrl = "https://foo.com"
+      }
       """
         .trimIndent(),
     )
@@ -849,14 +886,14 @@ class CliProjectPackagerTest {
     tempDir.writeFile(
       "project1/PklProject",
       """
-        amends "pkl:Project"
-        
-        package {
-          name = "project1"
-          version = "1.0.0"
-          baseUri = "package://example.com/project1"
-          packageZipUrl = "https://foo.com"
-        }
+      amends "pkl:Project"
+
+      package {
+        name = "project1"
+        version = "1.0.0"
+        baseUri = "package://example.com/project1"
+        packageZipUrl = "https://foo.com"
+      }
       """
         .trimIndent(),
     )
@@ -864,14 +901,14 @@ class CliProjectPackagerTest {
     tempDir.writeFile(
       "project2/PklProject",
       """
-        amends "pkl:Project"
-        
-        package {
-          name = "project2"
-          version = "2.0.0"
-          baseUri = "package://example.com/project2"
-          packageZipUrl = "https://foo.com"
-        }
+      amends "pkl:Project"
+
+      package {
+        name = "project2"
+        version = "2.0.0"
+        baseUri = "package://example.com/project2"
+        packageZipUrl = "https://foo.com"
+      }
       """
         .trimIndent(),
     )
@@ -914,14 +951,14 @@ class CliProjectPackagerTest {
       "project/PklProject",
       // intentionally conflict with localhost:0/birds@0.5.0 from our test fixtures
       """
-        amends "pkl:Project"
-        
-        package {
-          name = "birds"
-          version = "0.5.0"
-          baseUri = "package://localhost:0/birds"
-          packageZipUrl = "https://foo.com"
-        }
+      amends "pkl:Project"
+
+      package {
+        name = "birds"
+        version = "0.5.0"
+        baseUri = "package://localhost:0/birds"
+        packageZipUrl = "https://foo.com"
+      }
       """
         .trimIndent(),
     )
@@ -930,7 +967,7 @@ class CliProjectPackagerTest {
         CliProjectPackager(
             CliBaseOptions(
               workingDir = tempDir,
-              caCertificates = listOf(FileTestUtils.selfSignedCertificate),
+              caCertificates = listOf(FileTestUtils.selfSignedCertificatePem),
               testPort = packageServer.port,
             ),
             listOf(tempDir.resolve("project")),
@@ -959,14 +996,14 @@ class CliProjectPackagerTest {
     tempDir.writeFile(
       "project/PklProject",
       """
-        amends "pkl:Project"
-        
-        package {
-          name = "mangos"
-          version = "1.0.0"
-          baseUri = "package://localhost:0/mangos"
-          packageZipUrl = "https://foo.com"
-        }
+      amends "pkl:Project"
+
+      package {
+        name = "mangos"
+        version = "1.0.0"
+        baseUri = "package://localhost:0/mangos"
+        packageZipUrl = "https://foo.com"
+      }
       """
         .trimIndent(),
     )
@@ -974,7 +1011,7 @@ class CliProjectPackagerTest {
     CliProjectPackager(
         CliBaseOptions(
           workingDir = tempDir,
-          caCertificates = listOf(FileTestUtils.selfSignedCertificate),
+          caCertificates = listOf(FileTestUtils.selfSignedCertificatePem),
           testPort = packageServer.port,
         ),
         listOf(tempDir.resolve("project")),
@@ -1008,14 +1045,14 @@ class CliProjectPackagerTest {
         @Deprecated { since = "0.26.1"; message = "do not use" }
         @ModuleInfo { minPklVersion = "0.26.0" }
         amends "pkl:Project"
-        
+
         package {
           name = "mypackage"
           version = "1.0.0"
           baseUri = "package://example.com/mypackage"
           packageZipUrl = "https://foo.com"
         }
-      """
+        """
           .trimIndent()
       )
     val packager =
@@ -1033,53 +1070,53 @@ class CliProjectPackagerTest {
     assertThat(expectedMetadata)
       .hasContent(
         """
-      {
-        "name": "mypackage",
-        "packageUri": "package://example.com/mypackage@1.0.0",
-        "version": "1.0.0",
-        "packageZipUrl": "https://foo.com",
-        "packageZipChecksums": {
-          "sha256": "8739c76e681f900923b900c9df0ef75cf421d39cabb54650c4b9ad19b6a76d85"
-        },
-        "dependencies": {},
-        "authors": [],
-        "annotations": [
-          {
-            "type": "PObject",
-            "classInfo": {
-              "moduleName": "pkl.base",
-              "class": "Unlisted",
-              "moduleUri": "pkl:base"
-            },
-            "properties": {}
+        {
+          "name": "mypackage",
+          "packageUri": "package://example.com/mypackage@1.0.0",
+          "version": "1.0.0",
+          "packageZipUrl": "https://foo.com",
+          "packageZipChecksums": {
+            "sha256": "8739c76e681f900923b900c9df0ef75cf421d39cabb54650c4b9ad19b6a76d85"
           },
-          {
-            "type": "PObject",
-            "classInfo": {
-              "moduleName": "pkl.base",
-              "class": "Deprecated",
-              "moduleUri": "pkl:base"
+          "dependencies": {},
+          "authors": [],
+          "annotations": [
+            {
+              "type": "PObject",
+              "classInfo": {
+                "moduleName": "pkl.base",
+                "class": "Unlisted",
+                "moduleUri": "pkl:base"
+              },
+              "properties": {}
             },
-            "properties": {
-              "since": "0.26.1",
-              "message": "do not use",
-              "replaceWith": null
-            }
-          },
-          {
-            "type": "PObject",
-            "classInfo": {
-              "moduleName": "pkl.base",
-              "class": "ModuleInfo",
-              "moduleUri": "pkl:base"
+            {
+              "type": "PObject",
+              "classInfo": {
+                "moduleName": "pkl.base",
+                "class": "Deprecated",
+                "moduleUri": "pkl:base"
+              },
+              "properties": {
+                "since": "0.26.1",
+                "message": "do not use",
+                "replaceWith": null
+              }
             },
-            "properties": {
-              "minPklVersion": "0.26.0"
+            {
+              "type": "PObject",
+              "classInfo": {
+                "moduleName": "pkl.base",
+                "class": "ModuleInfo",
+                "moduleUri": "pkl:base"
+              },
+              "properties": {
+                "minPklVersion": "0.26.0"
+              }
             }
-          }
-        ]
-      }
-    """
+          ]
+        }
+        """
           .trimIndent()
       )
   }

pkl-cli/src/test/kotlin/org/pkl/cli/CliProjectResolverTest.kt

@@ -74,20 +74,20 @@ class CliProjectResolverTest {
     tempDir.writeFile(
       "PklProject",
       """
-        amends "pkl:Project"
+      amends "pkl:Project"
 
-        dependencies {
-          ["birds"] {
-            uri = "package://localhost:0/birds@0.5.0"
-          }
+      dependencies {
+        ["birds"] {
+          uri = "package://localhost:0/birds@0.5.0"
         }
+      }
       """
         .trimIndent(),
     )
     CliProjectResolver(
         CliBaseOptions(
           workingDir = tempDir,
-          caCertificates = listOf(FileTestUtils.selfSignedCertificate),
+          caCertificates = listOf(FileTestUtils.selfSignedCertificatePem),
           testPort = packageServer.port,
           noCache = true,
         ),
@@ -129,20 +129,20 @@ class CliProjectResolverTest {
     tempDir.writeFile(
       "PklProject",
       """
-        amends "pkl:Project"
+      amends "pkl:Project"
 
-        dependencies {
-          ["birds"] {
-            uri = "package://localhost:0/birds@0.5.0"
-          }
+      dependencies {
+        ["birds"] {
+          uri = "package://localhost:0/birds@0.5.0"
         }
+      }
       """
         .trimIndent(),
     )
     CliProjectResolver(
         CliBaseOptions(
           workingDir = tempDir,
-          caCertificates = listOf(FileTestUtils.selfSignedCertificate),
+          caCertificates = listOf(FileTestUtils.selfSignedCertificatePem),
           testPort = packageServer.port,
           noCache = true,
         ),
@@ -185,35 +185,35 @@ class CliProjectResolverTest {
     projectDir.writeFile(
       "PklProject",
       """
-        amends "pkl:Project"
+      amends "pkl:Project"
 
-        dependencies {
-          ["birds"] {
-            uri = "package://localhost:0/birds@0.5.0"
-          }
-          ["project2"] = import("../project2/PklProject")
+      dependencies {
+        ["birds"] {
+          uri = "package://localhost:0/birds@0.5.0"
         }
+        ["project2"] = import("../project2/PklProject")
+      }
       """
         .trimIndent(),
     )
     projectDir.writeFile(
       "../project2/PklProject",
       """
-        amends "pkl:Project"
-        
-        package {
-          name = "project2"
-          baseUri = "package://localhost:0/package2"
-          version = "5.0.0"
-          packageZipUrl = "https://foo.com/package2.zip"
-        }
-        
-        dependencies {
-          ["fruit"] {
-            uri = "package://localhost:0/fruit@1.0.5"
-          }
-          ["project3"] = import("../project3/PklProject")
+      amends "pkl:Project"
+
+      package {
+        name = "project2"
+        baseUri = "package://localhost:0/package2"
+        version = "5.0.0"
+        packageZipUrl = "https://foo.com/package2.zip"
+      }
+
+      dependencies {
+        ["fruit"] {
+          uri = "package://localhost:0/fruit@1.0.5"
         }
+        ["project3"] = import("../project3/PklProject")
+      }
       """
         .trimIndent(),
     )
@@ -221,26 +221,26 @@ class CliProjectResolverTest {
     projectDir.writeFile(
       "../project3/PklProject",
       """
-        amends "pkl:Project"
-        
-        package {
-          name = "project3"
-          baseUri = "package://localhost:0/package3"
-          version = "5.0.0"
-          packageZipUrl = "https://foo.com/package3.zip"
-        }
-        
-        dependencies {
-          ["fruit"] {
-            uri = "package://localhost:0/fruit@1.1.0"
-          }
+      amends "pkl:Project"
+
+      package {
+        name = "project3"
+        baseUri = "package://localhost:0/package3"
+        version = "5.0.0"
+        packageZipUrl = "https://foo.com/package3.zip"
+      }
+
+      dependencies {
+        ["fruit"] {
+          uri = "package://localhost:0/fruit@1.1.0"
         }
+      }
       """
         .trimIndent(),
     )
     CliProjectResolver(
         CliBaseOptions(
-          caCertificates = listOf(FileTestUtils.selfSignedCertificate),
+          caCertificates = listOf(FileTestUtils.selfSignedCertificatePem),
           testPort = packageServer.port,
           noCache = true,
         ),
@@ -293,28 +293,28 @@ class CliProjectResolverTest {
     projectDir.writeFile(
       "PklProject",
       """
-        amends "pkl:Project"
+      amends "pkl:Project"
 
-        dependencies {
-          ["birds"] {
-            uri = "package://localhost:0/birds@0.5.0"
-          }
-          ["fruit"] = import("../fruit/PklProject")
+      dependencies {
+        ["birds"] {
+          uri = "package://localhost:0/birds@0.5.0"
         }
+        ["fruit"] = import("../fruit/PklProject")
+      }
       """
         .trimIndent(),
     )
     projectDir.writeFile(
       "../fruit/PklProject",
       """
-        amends "pkl:Project"
-        
-        package {
-          name = "fruit"
-          baseUri = "package://localhost:0/fruit"
-          version = "1.0.0"
-          packageZipUrl = "https://foo.com/fruit.zip"
-        }
+      amends "pkl:Project"
+
+      package {
+        name = "fruit"
+        baseUri = "package://localhost:0/fruit"
+        version = "1.0.0"
+        packageZipUrl = "https://foo.com/fruit.zip"
+      }
       """
         .trimIndent(),
     )
@@ -322,7 +322,7 @@ class CliProjectResolverTest {
     val errOut = StringWriter()
     CliProjectResolver(
         CliBaseOptions(
-          caCertificates = listOf(FileTestUtils.selfSignedCertificate),
+          caCertificates = listOf(FileTestUtils.selfSignedCertificatePem),
           testPort = packageServer.port,
           noCache = true,
         ),
@@ -375,7 +375,7 @@ class CliProjectResolverTest {
           uri = "package://localhost:0/birds@0.5.0"
         }
       }
-    """
+      """
         .trimIndent(),
     )
 
@@ -389,7 +389,7 @@ class CliProjectResolverTest {
           uri = "package://localhost:0/fruit@1.1.0"
         }
       }
-    """
+      """
         .trimIndent(),
     )
 
@@ -397,7 +397,7 @@ class CliProjectResolverTest {
     val errOut = StringWriter()
     CliProjectResolver(
         CliBaseOptions(
-          caCertificates = listOf(FileTestUtils.selfSignedCertificate),
+          caCertificates = listOf(FileTestUtils.selfSignedCertificatePem),
           testPort = packageServer.port,
           noCache = true,
         ),
@@ -469,14 +469,14 @@ class CliProjectResolverTest {
       .resolve("PklProject")
       .writeString(
         """
-      amends "pkl:Project"
+        amends "pkl:Project"
 
-      dependencies {
-        ["birds"] {
-          uri = "package://localhost:0/birds@0.5.0"
+        dependencies {
+          ["birds"] {
+            uri = "package://localhost:0/birds@0.5.0"
+          }
         }
-      }
-    """
+        """
           .trimIndent()
       )
     // coerce an IOException by making this a directory
@@ -484,7 +484,7 @@ class CliProjectResolverTest {
     assertThatCode {
         CliProjectResolver(
             CliBaseOptions(
-              caCertificates = listOf(FileTestUtils.selfSignedCertificate),
+              caCertificates = listOf(FileTestUtils.selfSignedCertificatePem),
               testPort = packageServer.port,
               noCache = true,
             ),

pkl-cli/src/test/kotlin/org/pkl/cli/CliTestRunnerTest.kt

@@ -47,7 +47,7 @@ class CliTestRunnerTest {
           3 == 3
         }
       }
-    """
+      """
         .trimIndent()
     val input = tempDir.resolve("test.pkl").writeString(code).toString()
     val out = StringWriter()
@@ -65,13 +65,13 @@ class CliTestRunnerTest {
     assertThat(out.toString().stripFileAndLines(tempDir))
       .isEqualTo(
         """
-      module test
-        facts
-          ✔ succeed
-      
-      100.0% tests pass [1 passed], 100.0% asserts pass [2 passed]
+        module test
+          facts
+            ✔ succeed
 
-    """
+        100.0% tests pass [1 passed], 100.0% asserts pass [2 passed]
+
+        """
           .trimIndent()
       )
     assertThat(err.toString()).isEqualTo("")
@@ -89,7 +89,7 @@ class CliTestRunnerTest {
           1 == 5
         }
       }
-    """
+      """
         .trimIndent()
     val input = tempDir.resolve("test.pkl").writeString(code).toString()
     val out = StringWriter()
@@ -136,7 +136,7 @@ class CliTestRunnerTest {
           throw("uh oh")
         }
       }
-    """
+      """
         .trimIndent()
     val input = tempDir.resolve("test.pkl").writeString(code).toString()
     val out = StringWriter()
@@ -154,19 +154,19 @@ class CliTestRunnerTest {
     assertThat(out.toString().stripFileAndLines(tempDir))
       .isEqualToNormalizingNewlines(
         """
-      module test
-        facts
-          ✘ fail
-             –– Pkl Error ––
-             uh oh
+        module test
+          facts
+            ✘ fail
+               –– Pkl Error ––
+               uh oh
 
-             5 | throw("uh oh")
-                 ^^^^^^^^^^^^^^
-             at test#facts["fail"][#1] (/tempDir/test.pkl, line xx)
+               5 | throw("uh oh")
+                   ^^^^^^^^^^^^^^
+               at test#facts["fail"][#1] (/tempDir/test.pkl, line xx)
 
-      0.0% tests pass [1/1 failed], 0.0% asserts pass [1/1 failed]
+        0.0% tests pass [1/1 failed], 0.0% asserts pass [1/1 failed]
 
-    """
+        """
           .trimIndent()
       )
     assertThat(err.toString()).isEqualTo("")
@@ -183,7 +183,7 @@ class CliTestRunnerTest {
           throw("uh oh")
         }
       }
-    """
+      """
         .trimIndent()
     val input = tempDir.resolve("test.pkl").writeString(code).toString()
     val out = StringWriter()
@@ -201,19 +201,19 @@ class CliTestRunnerTest {
     assertThat(out.toString().stripFileAndLines(tempDir))
       .isEqualTo(
         """
-      module test
-        examples
-          ✘ fail
-             –– Pkl Error ––
-             uh oh
+        module test
+          examples
+            ✘ fail
+               –– Pkl Error ––
+               uh oh
 
-             5 | throw("uh oh")
-                 ^^^^^^^^^^^^^^
-             at test#examples["fail"][#1] (/tempDir/test.pkl, line xx)
+               5 | throw("uh oh")
+                   ^^^^^^^^^^^^^^
+               at test#examples["fail"][#1] (/tempDir/test.pkl, line xx)
 
-      0.0% tests pass [1/1 failed], 0.0% asserts pass [1/1 failed]
+        0.0% tests pass [1/1 failed], 0.0% asserts pass [1/1 failed]
 
-    """
+        """
           .trimIndent()
       )
     assertThat(err.toString()).isEqualTo("")
@@ -232,19 +232,19 @@ class CliTestRunnerTest {
           throw("uh oh")
         }
       }
-    """
+      """
         .trimIndent()
     val input = tempDir.resolve("test.pkl").writeString(code).toString()
     tempDir
       .resolve("test.pkl-expected.pcf")
       .writeString(
         """
-      examples {
-        ["fail"] {
-          "never compared to"
+        examples {
+          ["fail"] {
+            "never compared to"
+          }
         }
-      }
-    """
+        """
           .trimIndent()
       )
     val out = StringWriter()
@@ -262,19 +262,19 @@ class CliTestRunnerTest {
     assertThat(out.toString().stripFileAndLines(tempDir))
       .isEqualToNormalizingNewlines(
         """
-      module test
-        examples
-          ✘ fail
-             –– Pkl Error ––
-             uh oh
-      
-             5 | throw("uh oh")
-                 ^^^^^^^^^^^^^^
-             at test#examples["fail"][#1] (/tempDir/test.pkl, line xx)
+        module test
+          examples
+            ✘ fail
+               –– Pkl Error ––
+               uh oh
 
-      0.0% tests pass [1/1 failed], 0.0% asserts pass [1/1 failed]
+               5 | throw("uh oh")
+                   ^^^^^^^^^^^^^^
+               at test#examples["fail"][#1] (/tempDir/test.pkl, line xx)
 
-    """
+        0.0% tests pass [1/1 failed], 0.0% asserts pass [1/1 failed]
+
+        """
           .trimIndent()
       )
     assertThat(err.toString()).isEqualTo("")
@@ -296,7 +296,7 @@ class CliTestRunnerTest {
           5 == 9
         }
       }
-    """
+      """
         .trimIndent()
     val input = tempDir.resolve("test.pkl").writeString(code).toString()
     val noopWriter = noopWriter()
@@ -314,19 +314,19 @@ class CliTestRunnerTest {
     assertThat(junitReport)
       .isEqualTo(
         """
-      <?xml version="1.0" encoding="UTF-8"?>
-      <testsuite name="test" tests="2" failures="1">
-          <testcase classname="test.facts" name="foo"></testcase>
-          <testcase classname="test.facts" name="bar">
-              <failure message="Fact Failure">5 == 9 (/tempDir/test.pkl, line xx)
-        │
-        false</failure>
-          </testcase>
-          <system-err><![CDATA[9 = 9
-      ]]></system-err>
-      </testsuite>
+        <?xml version="1.0" encoding="UTF-8"?>
+        <testsuite name="test" tests="2" failures="1">
+            <testcase classname="test.facts" name="foo"></testcase>
+            <testcase classname="test.facts" name="bar">
+                <failure message="Fact Failure">5 == 9 (/tempDir/test.pkl, line xx)
+          │
+          false</failure>
+            </testcase>
+            <system-err><![CDATA[9 = 9
+        ]]></system-err>
+        </testsuite>
 
-    """
+        """
           .trimIndent()
       )
   }
@@ -346,7 +346,7 @@ class CliTestRunnerTest {
           throw("uh oh")
         }
       }
-    """
+      """
         .trimIndent()
     val input = tempDir.resolve("test.pkl").writeString(code).toString()
     val noopWriter = noopWriter()
@@ -364,23 +364,23 @@ class CliTestRunnerTest {
     assertThat(junitReport)
       .isEqualTo(
         """
-      <?xml version="1.0" encoding="UTF-8"?>
-      <testsuite name="test" tests="2" failures="1">
-          <testcase classname="test.facts" name="foo"></testcase>
-          <testcase classname="test.facts" name="fail">
-              <error message="uh oh">–– Pkl Error ––
-      uh oh
-      
-      9 | throw(&quot;uh oh&quot;)
-          ^^^^^^^^^^^^^^
-      at test#facts[&quot;fail&quot;][#1] (/tempDir/test.pkl, line xx)
-      </error>
-          </testcase>
-          <system-err><![CDATA[9 = 9
-      ]]></system-err>
-      </testsuite>
-      
-    """
+        <?xml version="1.0" encoding="UTF-8"?>
+        <testsuite name="test" tests="2" failures="1">
+            <testcase classname="test.facts" name="foo"></testcase>
+            <testcase classname="test.facts" name="fail">
+                <error message="uh oh">–– Pkl Error ––
+        uh oh
+
+        9 | throw(&quot;uh oh&quot;)
+            ^^^^^^^^^^^^^^
+        at test#facts[&quot;fail&quot;][#1] (/tempDir/test.pkl, line xx)
+        </error>
+            </testcase>
+            <system-err><![CDATA[9 = 9
+        ]]></system-err>
+        </testsuite>
+
+        """
           .trimIndent()
       )
   }
@@ -390,7 +390,7 @@ class CliTestRunnerTest {
     val foo =
       """
       module foo
-      
+
       amends "pkl:test"
 
       facts {
@@ -398,13 +398,13 @@ class CliTestRunnerTest {
           1 == 1
         }
       }
-    """
+      """
         .trimIndent()
 
     val bar =
       """
       module foo
-      
+
       amends "pkl:test"
 
       facts {
@@ -412,7 +412,7 @@ class CliTestRunnerTest {
           1 == 1
         }
       }
-    """
+      """
         .trimIndent()
     val input = tempDir.resolve("test.pkl").writeString(foo).toString()
     val input2 = tempDir.resolve("test.pkl").writeString(bar).toString()
@@ -438,7 +438,7 @@ class CliTestRunnerTest {
           true
         }
       }
-    """
+      """
         .trimIndent()
 
     val code2 =
@@ -450,7 +450,7 @@ class CliTestRunnerTest {
           true
         }
       }
-    """
+      """
         .trimIndent()
     val input1 = tempDir.resolve("test1.pkl").writeString(code1).toString()
     val input2 = tempDir.resolve("test2.pkl").writeString(code2).toString()
@@ -482,7 +482,7 @@ class CliTestRunnerTest {
           5 == 9
         }
       }
-    """
+      """
         .trimIndent()
 
     val code2 =
@@ -500,7 +500,7 @@ class CliTestRunnerTest {
           true
         }
       }
-    """
+      """
         .trimIndent()
     val input1 = tempDir.resolve("test1.pkl").writeString(code1).toString()
     val input2 = tempDir.resolve("test2.pkl").writeString(code2).toString()
@@ -547,7 +547,7 @@ class CliTestRunnerTest {
             </testsuite>
         </testsuites>
 
-      """
+        """
           .trimIndent()
       )
   }
@@ -563,7 +563,7 @@ class CliTestRunnerTest {
           true
         }
       }
-    """
+      """
         .trimIndent()
 
     val code2 =
@@ -575,7 +575,7 @@ class CliTestRunnerTest {
           true
         }
       }
-    """
+      """
         .trimIndent()
     val input1 = tempDir.resolve("test1.pkl").writeString(code1).toString()
     val input2 = tempDir.resolve("test2.pkl").writeString(code2).toString()
@@ -620,19 +620,19 @@ class CliTestRunnerTest {
           2
         }
       }
-    """
+      """
         .trimIndent()
     val input = tempDir.resolve("test.pkl").writeString(code).toString()
     tempDir
       .resolve("test.pkl-expected.pcf")
       .writeString(
         """
-      examples {
-        ["nums"] {
-          1
+        examples {
+          ["nums"] {
+            1
+          }
         }
-      }
-    """
+        """
           .trimIndent()
       )
     val out = StringWriter()
@@ -676,7 +676,7 @@ class CliTestRunnerTest {
           2
         }
       }
-    """
+      """
         .trimIndent()
     val input = tempDir.resolve("test.pkl").writeString(code).toString()
     val out = StringWriter()
@@ -694,13 +694,13 @@ class CliTestRunnerTest {
     assertThat(out.toString())
       .isEqualTo(
         """
-          module test
-            examples
-              ✍️ nums
+        module test
+          examples
+            ✍️ nums
 
-          1 examples written
-          
-          """
+        1 examples written
+
+        """
           .trimIndent()
       )
   }
@@ -738,13 +738,13 @@ class CliTestRunnerTest {
       assertThat(out.toString().stripFileAndLines(tempDir))
         .isEqualTo(
           """
-            module test
-              facts
-                ✔ localeTest
+          module test
+            facts
+              ✔ localeTest
 
-            100.0% tests pass [1 passed], 100.0% asserts pass [1 passed]
+          100.0% tests pass [1 passed], 100.0% asserts pass [1 passed]
 
-            """
+          """
             .trimIndent()
         )
       assertThat(err.toString()).isEqualTo("")

pkl-codegen-java/src/main/kotlin/org/pkl/codegen/java/CliJavaCodeGenerator.kt

@@ -31,7 +31,7 @@ class CliJavaCodeGenerator(private val options: CliJavaCodeGeneratorOptions) :
     val builder = evaluatorBuilder()
     try {
       builder.build().use { evaluator ->
-        for (moduleUri in resolvedSourceModules) {
+        for (moduleUri in options.base.normalizedSourceModules) {
           val schema = evaluator.evaluateSchema(ModuleSource.uri(moduleUri))
           val codeGenerator = JavaCodeGenerator(schema, options.toJavaCodeGeneratorOptions())
           try {

pkl-codegen-java/src/main/kotlin/org/pkl/codegen/java/JavaCodeGenerator.kt

@@ -13,7 +13,7 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-@file:Suppress("unused")
+@file:Suppress("unused", "CanConvertToMultiDollarString")
 
 package org.pkl.codegen.java
 
@@ -172,7 +172,7 @@ class JavaCodeGenerator(
       val annotation = codegenOptions.nonNullAnnotation
       val className =
         if (annotation == null) {
-          ClassName.get("org.pkl.config.java.mapper", "NonNull")
+          ClassName.get("org.jspecify.annotations", "NonNull")
         } else {
           toClassName(annotation)
         }

pkl-codegen-java/src/main/kotlin/org/pkl/codegen/java/Main.kt

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024-2025 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -102,10 +102,10 @@ class PklJavaCodegenCommand : ModulesCommand(name = "pkl-codegen-java", helpLink
       names = arrayOf("--non-null-annotation"),
       help =
         """
-      Fully qualified name of the annotation type to use for annotating non-null types.
-      The specified annotation type must be annotated with `@java.lang.annotation.Target(ElementType.TYPE_USE)`
-      or the generated code may not compile.
-    """
+        Fully qualified name of the annotation type to use for annotating non-null types.
+        The specified annotation type must be annotated with `@java.lang.annotation.Target(ElementType.TYPE_USE)`
+        or the generated code may not compile.
+        """
           .trimIndent(),
     )
 
@@ -122,10 +122,10 @@ class PklJavaCodegenCommand : ModulesCommand(name = "pkl-codegen-java", helpLink
         metavar = "old_name=new_name",
         help =
           """
-            Replace a prefix in the names of the generated Java classes (repeatable).
-            By default, the names of generated classes are derived from the Pkl module names.
-            With this option, you can override or modify the default names, renaming entire
-            classes or just their packages.
+          Replace a prefix in the names of the generated Java classes (repeatable).
+          By default, the names of generated classes are derived from the Pkl module names.
+          With this option, you can override or modify the default names, renaming entire
+          classes or just their packages.
           """
             .trimIndent(),
       )

pkl-codegen-java/src/test/resources/org/pkl/codegen/java/GenerateGetters.jva

@@ -5,8 +5,8 @@ import java.lang.Override;
 import java.lang.String;
 import java.lang.StringBuilder;
 import java.util.Objects;
+import org.jspecify.annotations.NonNull;
 import org.pkl.config.java.mapper.Named;
-import org.pkl.config.java.mapper.NonNull;
 import org.pkl.core.DataSize;
 import org.pkl.core.Duration;
 

pkl-codegen-java/src/test/resources/org/pkl/codegen/java/Inheritance.jva

@@ -5,8 +5,8 @@ import java.lang.Override;
 import java.lang.String;
 import java.lang.StringBuilder;
 import java.util.Objects;
+import org.jspecify.annotations.NonNull;
 import org.pkl.config.java.mapper.Named;
-import org.pkl.config.java.mapper.NonNull;
 import org.pkl.core.Duration;
 
 public final class Mod {

pkl-codegen-java/src/test/resources/org/pkl/codegen/java/Javadoc.jva

@@ -5,8 +5,8 @@ import java.lang.Override;
 import java.lang.String;
 import java.lang.StringBuilder;
 import java.util.Objects;
+import org.jspecify.annotations.NonNull;
 import org.pkl.config.java.mapper.Named;
-import org.pkl.config.java.mapper.NonNull;
 
 /**
  * module comment.

pkl-codegen-java/src/test/resources/org/pkl/codegen/java/PropertyTypes.jva

@@ -11,8 +11,8 @@ import java.util.Map;
 import java.util.Objects;
 import java.util.Set;
 import java.util.regex.Pattern;
+import org.jspecify.annotations.NonNull;
 import org.pkl.config.java.mapper.Named;
-import org.pkl.config.java.mapper.NonNull;
 import org.pkl.core.DataSize;
 import org.pkl.core.DataSizeUnit;
 import org.pkl.core.Duration;

pkl-codegen-kotlin/src/main/kotlin/org/pkl/codegen/kotlin/CliKotlinCodeGenerator.kt

@@ -32,7 +32,7 @@ class CliKotlinCodeGenerator(private val options: CliKotlinCodeGeneratorOptions)
 
     try {
       builder.build().use { evaluator ->
-        for (moduleUri in resolvedSourceModules) {
+        for (moduleUri in options.base.normalizedSourceModules) {
           val schema = evaluator.evaluateSchema(ModuleSource.uri(moduleUri))
           val codeGenerator = KotlinCodeGenerator(schema, options.toKotlinCodeGeneratorOptions())
           try {

pkl-codegen-kotlin/src/main/kotlin/org/pkl/codegen/kotlin/Main.kt

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024-2025 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -91,10 +91,10 @@ class PklKotlinCodegenCommand : ModulesCommand(name = "pkl-codegen-kotlin", help
         metavar = "old_name=new_name",
         help =
           """
-            Replace a prefix in the names of the generated Kotlin classes (repeatable).
-            By default, the names of generated classes are derived from the Pkl module names.
-            With this option, you can override or modify the default names, renaming entire
-            classes or just their packages.
+          Replace a prefix in the names of the generated Kotlin classes (repeatable).
+          By default, the names of generated classes are derived from the Pkl module names.
+          With this option, you can override or modify the default names, renaming entire
+          classes or just their packages.
           """
             .trimIndent(),
       )

pkl-codegen-kotlin/src/test/kotlin/org/pkl/codegen/kotlin/CliKotlinCodeGeneratorTest.kt

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024-2025 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -77,7 +77,7 @@ class CliKotlinCodeGeneratorTest {
       open class Mod1(
         open val pigeon: Person
       ) {
-    """
+      """
         .trimIndent(),
       module1KotlinFile.readString(),
     )
@@ -88,7 +88,7 @@ class CliKotlinCodeGeneratorTest {
         pigeon: Mod1.Person,
         val parrot: Mod1.Person
       ) : Mod1(pigeon) {
-    """
+      """
         .trimIndent(),
       module2KotlinFile.readString(),
     )

pkl-commons-cli/src/main/kotlin/org/pkl/commons/cli/CliBaseOptions.kt

@@ -144,11 +144,14 @@ data class CliBaseOptions(
   /** URL prefixes to rewrite. */
   val httpRewrites: Map<URI, URI>? = null,
 
+  /** HTTP headers to add to the request. */
+  val httpHeaders: Map<String, Map<String, List<String>>>? = null,
+
   /** External module reader process specs */
-  val externalModuleReaders: Map<String, ExternalReader> = mapOf(),
+  val externalModuleReaders: Map<String, ExternalReader>? = null,
 
   /** External resource reader process specs */
-  val externalResourceReaders: Map<String, ExternalReader> = mapOf(),
+  val externalResourceReaders: Map<String, ExternalReader>? = null,
 
   /** Defines options for the formatting of calls to the trace() method. */
   val traceMode: TraceMode? = null,
@@ -186,16 +189,15 @@ data class CliBaseOptions(
     sourceModules
       .map { uri ->
         if (uri.isAbsolute) uri
-        else if (uri.path.startsWith("@") && !noProject && normalizedProjectFile != null) uri
+        else if (uri.path.startsWith("@")) uri
         else IoUtils.resolve(normalizedWorkingDir.toUri(), uri)
       }
       // sort modules to make cli output independent of source module order
       .sorted()
 
-  val normalizedSettingsModule: URI? =
-    settings?.let { uri ->
-      if (uri.isAbsolute) uri else IoUtils.resolve(normalizedWorkingDir.toUri(), uri)
-    }
+  val normalizedSettingsModule: URI? = settings?.let { uri ->
+    if (uri.isAbsolute) uri else IoUtils.resolve(normalizedWorkingDir.toUri(), uri)
+  }
 
   /** [modulePath] after normalization. */
   val normalizedModulePath: List<Path>? = modulePath?.map(normalizedWorkingDir::resolve)

pkl-commons-cli/src/main/kotlin/org/pkl/commons/cli/CliCommand.kt

@@ -86,36 +86,6 @@ abstract class CliCommand(protected val cliOptions: CliBaseOptions) {
     }
   }
 
-  protected fun resolveModuleUri(uri: URI): URI =
-    if (uri.isAbsolute) uri
-    else { // must be @dep/mod.pkl notation!!
-      if (!uri.path.startsWith('@'))
-        throw CliBugException(
-          RuntimeException("tried to resolve project URI `$uri` with no @ prefix")
-        )
-      if (project == null)
-        throw CliBugException(
-          RuntimeException("tried to resolve project URI `$uri` with no project present")
-        )
-      val dep = uri.path.substringBefore('/').drop(1)
-      val path = uri.path.dropWhile { it != '/' }
-      if (path.isEmpty()) throw CliException("Invalid project dependency URI `$uri`.")
-
-      val remoteDep =
-        project!!.dependencies.remoteDependencies()[dep]
-          ?: if (project!!.dependencies.localDependencies().containsKey(dep))
-            throw CliException(
-              "Only remote project dependencies may be referenced using @-notation. Dependency `@$dep` is a local dependency."
-            )
-          else throw CliException("Project does not contain dependency `@$dep`.")
-      remoteDep.packageUri.toPackageAssetUri(path).uri
-    }
-
-  protected val resolvedSourceModules: List<URI> by lazy {
-    if (project == null) cliOptions.normalizedSourceModules
-    else cliOptions.normalizedSourceModules.map(::resolveModuleUri)
-  }
-
   protected fun loadProject(projectFile: Path): Project {
     val securityManager =
       SecurityManagers.standard(
@@ -140,7 +110,7 @@ abstract class CliCommand(protected val cliOptions: CliBaseOptions) {
 
   private val evaluatorSettings: PklEvaluatorSettings? by lazy {
     @Suppress("PklCliDirectProjectEvaluatorSettingsAccess")
-    if (cliOptions.omitProjectSettings) null else project?.evaluatorSettings
+    if (cliOptions.omitProjectSettings) null else project?.resolvedEvaluatorSettings
   }
 
   protected val allowedModules: List<Pattern> by lazy {
@@ -215,15 +185,19 @@ abstract class CliCommand(protected val cliOptions: CliBaseOptions) {
   }
 
   protected val httpRewrites: Map<URI, URI>? by lazy {
-    cliOptions.httpRewrites ?: evaluatorSettings?.http?.rewrites ?: settings.http?.rewrites()
+    cliOptions.httpRewrites ?: evaluatorSettings?.http?.rewrites ?: settings.http?.rewrites
+  }
+
+  private val httpHeaders: Map<String, Map<String, List<String>>>? by lazy {
+    cliOptions.httpHeaders ?: evaluatorSettings?.http?.headers ?: settings.http?.headers
   }
 
   protected val externalModuleReaders: Map<String, PklEvaluatorSettings.ExternalReader> by lazy {
-    (evaluatorSettings?.externalModuleReaders ?: emptyMap()) + cliOptions.externalModuleReaders
+    cliOptions.externalModuleReaders ?: evaluatorSettings?.externalModuleReaders ?: mapOf()
   }
 
   protected val externalResourceReaders: Map<String, PklEvaluatorSettings.ExternalReader> by lazy {
-    (evaluatorSettings?.externalResourceReaders ?: emptyMap()) + cliOptions.externalResourceReaders
+    cliOptions.externalResourceReaders ?: evaluatorSettings?.externalResourceReaders ?: mapOf()
   }
 
   private val externalProcesses:
@@ -277,6 +251,7 @@ abstract class CliCommand(protected val cliOptions: CliBaseOptions) {
         setProxy(proxyAddress, noProxy ?: listOf())
       }
       httpRewrites?.let(::setRewrites)
+      httpHeaders?.let(::setHeaders)
       // Lazy building significantly reduces execution time of commands that do minimal work.
       // However, it means that HTTP client initialization errors won't surface until an HTTP
       // request is made.
@@ -307,6 +282,7 @@ abstract class CliCommand(protected val cliOptions: CliBaseOptions) {
       add(ResourceReaders.modulePath(modulePathResolver))
       add(ResourceReaders.pkg())
       add(ResourceReaders.projectpackage())
+      addAll(ResourceReaders.fromServiceProviders())
       add(ResourceReaders.file())
       add(ResourceReaders.http())
       add(ResourceReaders.https())

pkl-commons-cli/src/main/kotlin/org/pkl/commons/cli/CliTestOptions.kt

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024-2025 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -22,4 +22,5 @@ class CliTestOptions(
   val overwrite: Boolean = false,
   val junitAggregateReports: Boolean = false,
   val junitAggregateSuiteName: String = "pkl-tests",
+  val reporter: TestReporter = TestReporter.default,
 )

pkl-commons-cli/src/main/kotlin/org/pkl/commons/cli/TestReporter.kt

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2026 Apple Inc. and the Pkl project authors. All rights reserved.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -13,15 +13,13 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-package org.pkl.core.util;
+package org.pkl.commons.cli
 
-import java.lang.annotation.*;
-import javax.annotation.meta.TypeQualifierNickname;
-import javax.annotation.meta.When;
+enum class TestReporter {
+  SPEC,
+  MINIMAL;
 
-@Target({ElementType.TYPE_PARAMETER, ElementType.TYPE_USE})
-@Retention(RetentionPolicy.RUNTIME)
-@Documented
-@javax.annotation.Nonnull(when = When.ALWAYS)
-@TypeQualifierNickname
-public @interface Nonnull {}
+  companion object {
+    @JvmStatic val default: TestReporter = SPEC
+  }
+}

pkl-commons-cli/src/main/kotlin/org/pkl/commons/cli/commands/BaseOptions.kt

@@ -35,6 +35,7 @@ import org.pkl.core.evaluatorSettings.Color
 import org.pkl.core.evaluatorSettings.PklEvaluatorSettings.ExternalReader
 import org.pkl.core.evaluatorSettings.TraceMode
 import org.pkl.core.runtime.VmUtils
+import org.pkl.core.util.GlobResolver
 import org.pkl.core.util.IoUtils
 
 @Suppress("MemberVisibilityCanBePrivate")
@@ -54,7 +55,8 @@ class BaseOptions : OptionGroup() {
             if (IoUtils.isUriLike(moduleName)) URI(moduleName)
             // Can't just use URI constructor, because URI(null, null, "C:/foo/bar", null) turns
             // into `URI("C", null, "/foo/bar", null)`.
-            else if (IoUtils.isWindowsAbsolutePath(moduleName)) Path.of(moduleName).toUri()
+            else if (IoUtils.isWindows() && IoUtils.isWindowsAbsolutePath(moduleName))
+              Path.of(moduleName).toUri()
             else URI(null, null, IoUtils.toNormalizedPathString(Path.of(moduleName)), null)
           } catch (e: URISyntaxException) {
             val message = buildString {
@@ -90,9 +92,11 @@ class BaseOptions : OptionGroup() {
     > {
       return splitPair(delimiter).convert {
         val cmd = shlex(it.second)
-        Pair(it.first, ExternalReader(cmd.first(), cmd.drop(1)))
+        Pair(it.first, ExternalReader(cmd.first(), cmd.drop(1), null))
       }
     }
+
+    private val headerRegex = Regex("""^(.+?):[ \t]*(.*)$""")
   }
 
   private val defaults = CliBaseOptions()
@@ -285,6 +289,37 @@ class BaseOptions : OptionGroup() {
       .multiple()
       .toMap()
 
+  val httpHeaders: Map<String, Map<String, List<String>>> by
+    option(
+        names = arrayOf("--http-header"),
+        metavar = "<url-pattern>=<header name>:<header value>",
+        help = "HTTP header to add to the request.",
+      )
+      .splitPair()
+      .transformAll { pairs ->
+        buildMap<String, MutableMap<String, MutableList<String>>> {
+          for ((pattern, headerNameAndValue) in pairs) {
+            try {
+              GlobResolver.toRegexPattern(pattern)
+            } catch (e: GlobResolver.InvalidGlobPatternException) {
+              fail(e.message!!)
+            }
+            val (headerName, headerValue) =
+              headerRegex.find(headerNameAndValue)?.destructured
+                ?: fail("Header '$headerNameAndValue' is not in 'name:value' format.")
+            try {
+              IoUtils.validateHeaderName(headerName)
+              IoUtils.validateHeaderValue(headerValue)
+            } catch (e: IllegalArgumentException) {
+              fail(e.message!!)
+            }
+            getOrPut(pattern) { mutableMapOf() }
+              .getOrPut(headerName) { mutableListOf() }
+              .add(headerValue)
+          }
+        }
+      }
+
   val externalModuleReaders: Map<String, ExternalReader> by
     option(
         names = arrayOf("--external-module-reader"),
@@ -351,8 +386,9 @@ class BaseOptions : OptionGroup() {
       httpProxy = proxy,
       httpNoProxy = noProxy,
       httpRewrites = httpRewrites.ifEmpty { null },
-      externalModuleReaders = externalModuleReaders,
-      externalResourceReaders = externalResourceReaders,
+      httpHeaders = httpHeaders.ifEmpty { null },
+      externalModuleReaders = externalModuleReaders.ifEmpty { null },
+      externalResourceReaders = externalResourceReaders.ifEmpty { null },
       traceMode = traceMode,
       powerAssertionsEnabled = powerAssertionsEnabled,
     )

pkl-commons-cli/src/main/kotlin/org/pkl/commons/cli/commands/TestOptions.kt

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024-2025 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -19,9 +19,11 @@ import com.github.ajalt.clikt.parameters.groups.OptionGroup
 import com.github.ajalt.clikt.parameters.options.default
 import com.github.ajalt.clikt.parameters.options.flag
 import com.github.ajalt.clikt.parameters.options.option
+import com.github.ajalt.clikt.parameters.types.enum
 import com.github.ajalt.clikt.parameters.types.path
 import java.nio.file.Path
 import org.pkl.commons.cli.CliTestOptions
+import org.pkl.commons.cli.TestReporter
 
 class TestOptions : OptionGroup() {
   private val junitReportDir: Path? by
@@ -51,7 +53,19 @@ class TestOptions : OptionGroup() {
   private val overwrite: Boolean by
     option(names = arrayOf("--overwrite"), help = "Force generation of expected examples.").flag()
 
+  private val reporter: TestReporter by
+    option(names = arrayOf("--test-reporter"), help = "Which test reporter to use for CLI output.")
+      .enum<TestReporter> { it.name.lowercase() }
+      .single()
+      .default(TestReporter.default)
+
   val cliTestOptions: CliTestOptions by lazy {
-    CliTestOptions(junitReportDir, overwrite, junitAggregateReports, junitAggregateSuiteName)
+    CliTestOptions(
+      junitReportDir,
+      overwrite,
+      junitAggregateReports,
+      junitAggregateSuiteName,
+      reporter,
+    )
   }
 }

pkl-commons-cli/src/main/resources/org/pkl/commons/cli/project1/PklProject

@@ -0,0 +1,5 @@
+amends "pkl:Project"
+
+dependencies {
+  ["fruit"] { uri = "package://localhost:0/fruit@1.1.0" }
+}

pkl-commons-cli/src/main/resources/org/pkl/commons/cli/project1/PklProject.deps.json

@@ -0,0 +1,12 @@
+{
+  "schemaVersion": 1,
+  "resolvedDependencies": {
+    "package://localhost:0/fruit@1": {
+      "type": "remote",
+      "uri": "projectpackage://localhost:0/fruit@1.1.0",
+      "checksums": {
+        "sha256": "$skipChecksumVerification"
+      }
+    }
+  }
+}

pkl-commons-cli/src/test/kotlin/org/pkl/commons/cli/BaseCommandTest.kt

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024-2025 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -98,17 +98,17 @@ class BaseCommandTest {
     assertThat(cmd.baseOptions.externalModuleReaders)
       .isEqualTo(
         mapOf(
-          "scheme3" to ExternalReader("reader3", emptyList()),
-          "scheme4" to ExternalReader("reader4", listOf("with", "args")),
-          "scheme+ext" to ExternalReader("reader5", listOf("with", "args")),
+          "scheme3" to ExternalReader("reader3", emptyList(), null),
+          "scheme4" to ExternalReader("reader4", listOf("with", "args"), null),
+          "scheme+ext" to ExternalReader("reader5", listOf("with", "args"), null),
         )
       )
     assertThat(cmd.baseOptions.externalResourceReaders)
       .isEqualTo(
         mapOf(
-          "scheme1" to ExternalReader("reader1", emptyList()),
-          "scheme2" to ExternalReader("reader2", listOf("with", "args")),
-          "scheme+ext" to ExternalReader("reader5", listOf("with", "args")),
+          "scheme1" to ExternalReader("reader1", emptyList(), null),
+          "scheme2" to ExternalReader("reader2", listOf("with", "args"), null),
+          "scheme+ext" to ExternalReader("reader5", listOf("with", "args"), null),
         )
       )
   }

pkl-commons-cli/src/test/kotlin/org/pkl/commons/cli/CliCommandTest.kt

@@ -17,13 +17,10 @@ package org.pkl.commons.cli
 
 import com.github.ajalt.clikt.core.parse
 import com.github.ajalt.clikt.parameters.groups.provideDelegate
-import java.net.URI
 import java.nio.file.Path
 import kotlin.io.path.ExperimentalPathApi
-import kotlin.io.path.writeText
 import org.assertj.core.api.Assertions.assertThat
 import org.junit.jupiter.api.Test
-import org.junit.jupiter.api.assertThrows
 import org.junit.jupiter.api.condition.DisabledOnJre
 import org.junit.jupiter.api.condition.JRE
 import org.junit.jupiter.api.io.TempDir
@@ -31,12 +28,12 @@ import org.pkl.commons.cli.commands.BaseCommand
 import org.pkl.commons.cli.commands.ProjectOptions
 import org.pkl.commons.writeString
 import org.pkl.core.SecurityManagers
+import org.pkl.core.evaluatorSettings.PklEvaluatorSettings
 import org.pkl.core.evaluatorSettings.TraceMode
 import org.pkl.core.util.IoUtils
 
 @OptIn(ExperimentalPathApi::class)
 class CliCommandTest {
-
   private val cmd =
     object : BaseCommand("test", "") {
       val projectOptions: ProjectOptions by ProjectOptions()
@@ -49,7 +46,6 @@ class CliCommandTest {
   class CliTest(options: CliBaseOptions) : CliCommand(options) {
     override fun doRun() = Unit
 
-    val myResolvedSourceModules = resolvedSourceModules
     val myAllowedModules = allowedModules
     val myAllowedResources = allowedResources
     val myRootDir = rootDir
@@ -98,114 +94,6 @@ class CliCommandTest {
       )
   }
 
-  @Test
-  fun `@-notation package URIs - treated as relative paths when no project present`(
-    @TempDir tempDir: Path
-  ) {
-    cmd.parse(arrayOf("--working-dir=$tempDir"))
-    val opts = cmd.baseOptions.baseOptions(listOf(URI("@foo/bar.pkl")), testMode = true)
-    val cliTest = CliTest(opts)
-    assertThat(cliTest.myResolvedSourceModules)
-      .isEqualTo(listOf(tempDir.toUri().resolve("@foo/bar.pkl")))
-  }
-
-  @Test
-  fun `@-notation package URIs - empty paths are rejected`(@TempDir tempDir: Path) {
-    tempDir
-      .resolve("PklProject")
-      .writeText(
-        """
-        amends "pkl:Project"
-        """
-          .trimIndent()
-      )
-    cmd.parse(arrayOf("--working-dir=$tempDir"))
-    val opts = cmd.baseOptions.baseOptions(listOf(URI("@no.slash")), testMode = true)
-    val exc = assertThrows<CliException> { CliTest(opts) }
-    assertThat(exc.message).isEqualTo("Invalid project dependency URI `@no.slash`.")
-  }
-
-  @Test
-  fun `@-notation package URIs - missing dependencies are rejected`(@TempDir tempDir: Path) {
-    tempDir
-      .resolve("PklProject")
-      .writeText(
-        """
-        amends "pkl:Project"
-        """
-          .trimIndent()
-      )
-    cmd.parse(arrayOf("--working-dir=$tempDir"))
-    val opts = cmd.baseOptions.baseOptions(listOf(URI("@foo/bar.pkl")), testMode = true)
-    val exc = assertThrows<CliException> { CliTest(opts) }
-    assertThat(exc.message).isEqualTo("Project does not contain dependency `@foo`.")
-  }
-
-  @Test
-  fun `@-notation package URIs - local dependencies are rejected`(
-    @TempDir tempDir: Path,
-    @TempDir depDir: Path,
-  ) {
-    depDir
-      .resolve("PklProject")
-      .writeText(
-        """
-        amends "pkl:Project"
-
-        package {
-          name = "foo"
-          baseUri = "package://example.com/foo"
-          version = "0.0.1"
-          packageZipUrl = "https://example.com/foo@\(version).zip"
-        }
-        """
-          .trimIndent()
-      )
-
-    tempDir
-      .resolve("PklProject")
-      .writeText(
-        """
-      amends "pkl:Project"
-
-      dependencies {
-        ["foo"] = import("${depDir.toUri().resolve("PklProject")}")
-      }
-    """
-          .trimIndent()
-      )
-    cmd.parse(arrayOf("--working-dir=$tempDir"))
-    val opts = cmd.baseOptions.baseOptions(listOf(URI("@foo/bar.pkl")), testMode = true)
-    val exc = assertThrows<CliException> { CliTest(opts) }
-    assertThat(exc.message)
-      .isEqualTo(
-        "Only remote project dependencies may be referenced using @-notation. Dependency `@foo` is a local dependency."
-      )
-  }
-
-  @Test
-  fun `@-notation package URIs - remote dependencies are resolved`(@TempDir tempDir: Path) {
-    tempDir
-      .resolve("PklProject")
-      .writeText(
-        """
-        amends "pkl:Project"
-
-        dependencies {
-          ["foo"] {
-            uri = "package://example.com/foo@1.2.3"
-          }
-        }
-        """
-          .trimIndent()
-      )
-    cmd.parse(arrayOf("--working-dir=$tempDir"))
-    val opts = cmd.baseOptions.baseOptions(listOf(URI("@foo/bar.pkl")), testMode = true)
-    val cliTest = CliTest(opts)
-    assertThat(cliTest.myResolvedSourceModules)
-      .isEqualTo(listOf(tempDir.toUri().resolve("package://example.com/foo@1.2.3#/bar.pkl")))
-  }
-
   val projectWithAllEvaluatorSettings =
     """
     amends "pkl:Project"
@@ -284,4 +172,32 @@ class CliCommandTest {
           .isNotNull
       }
   }
+
+  @Test
+  fun `--external-module-reader blows away PklProject externalModuleReaders`(
+    @TempDir tempDir: Path
+  ) {
+    tempDir
+      .resolve("PklProject")
+      .writeString(
+        // language=pkl
+        """
+        amends "pkl:Project"
+
+        evaluatorSettings {
+          externalModuleReaders {
+            ["foo"] {
+              executable = "foo"
+            }
+          }
+        }
+        """
+          .trimIndent()
+      )
+    cmd.parse(arrayOf("--external-module-reader", "bar=bar"))
+    val opts = cmd.baseOptions.baseOptions(emptyList(), null, true)
+    val cliTest = CliTest(opts)
+    assertThat(cliTest.myExternalModuleReaders)
+      .isEqualTo(mapOf("bar" to PklEvaluatorSettings.ExternalReader("bar", listOf(), null)))
+  }
 }

pkl-commons-test/src/main/kotlin/org/pkl/commons/test/FileTestUtils.kt

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024-2025 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -31,12 +31,19 @@ object FileTestUtils {
       ?: workingDir.parent.parent.takeIf { it.resolve("settings.gradle.kts").exists() }
       ?: throw AssertionError("Failed to locate root project directory.")
   }
-  val selfSignedCertificate: Path by lazy {
+
+  val selfSignedCertificateP12: Path by lazy {
+    rootProjectDir.resolve("pkl-commons-test/build/keystore/localhost.p12")
+  }
+
+  val selfSignedCertificatePem: Path by lazy {
     rootProjectDir.resolve("pkl-commons-test/build/keystore/localhost.pem")
   }
 
+  val selfSignedCertificatePassword = "password"
+
   fun writeCertificateWithMissingLines(dir: Path): Path {
-    val lines = selfSignedCertificate.readLines()
+    val lines = selfSignedCertificatePem.readLines()
     // drop some lines in the middle
     return dir.resolve("invalidCerts.pem").writeLines(lines.take(5) + lines.takeLast(5))
   }

pkl-config-java/src/main/java/org/pkl/config/java/AbstractConfig.java

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -17,6 +17,7 @@ package org.pkl.config.java;
 
 import java.lang.reflect.Type;
 import java.util.Map;
+import org.jspecify.annotations.Nullable;
 import org.pkl.config.java.mapper.ValueMapper;
 import org.pkl.core.Composite;
 
@@ -49,17 +50,37 @@ abstract class AbstractConfig implements Config {
 
   @Override
   public <T> T as(Class<T> type) {
-    return as((Type) type);
+    return trustNonNull(asNullable(type));
+  }
+
+  @Override
+  public <T> T as(JavaType<T> type) {
+    return trustNonNull(asNullable(type));
   }
 
   @Override
   public <T> T as(Type type) {
+    return trustNonNull(asNullable(type));
+  }
+
+  @Override
+  public <T> @Nullable T asNullable(Class<T> type) {
     return mapper.map(getRawValue(), type);
   }
 
   @Override
-  public <T> T as(JavaType<T> javaType) {
-    return as(javaType.getType());
+  public <T> @Nullable T asNullable(JavaType<T> type) {
+    return mapper.map(getRawValue(), type.getType());
+  }
+
+  @Override
+  public <T extends @Nullable Object> T asNullable(Type type) {
+    return mapper.map(getRawValue(), type);
+  }
+
+  @SuppressWarnings({"unchecked", "DataFlowIssue", "NullAway"})
+  private static <T> T trustNonNull(@Nullable Object value) {
+    return (T) value;
   }
 
   protected abstract Object getRawChildValue(String property);

pkl-config-java/src/main/java/org/pkl/config/java/Config.java

@@ -17,60 +17,130 @@ package org.pkl.config.java;
 
 import java.io.InputStream;
 import java.lang.reflect.Type;
+import org.jspecify.annotations.NullUnmarked;
 import org.jspecify.annotations.Nullable;
 import org.pkl.config.java.mapper.ConversionException;
 import org.pkl.config.java.mapper.ValueMapper;
-import org.pkl.core.Evaluator;
 
 /**
- * A root, intermediate, or leaf node in a configuration tree. Child nodes can be obtained by name
- * using {@link #get(String)}. To consume the node's composite or scalar value, convert the value to
- * the desired Java type, using one of the provided {@link #as} methods.
+ * A root, intermediate, or leaf node in a configuration tree.
+ *
+ * <p>To navigate to a child node, use {@link #get(String)} with the child's unqualified name.
+ *
+ * <p>To retrieve this node's value, use:
+ *
+ * <ul>
+ *   <li>{@link #as(Class)} for non-null types.
+ *   <li>{@link #asNullable(Class)} for nullable types.
+ *   <li>{@link #as(JavaType)} for parameterized types, such as {@code List<@Nullable String>}.
+ * </ul>
+ *
+ * <p>Whether a method can return null depends on the method and target type used. For example,
+ * {@code asNullable(String.class)} can return {@code null}, while {@code
+ * as(JavaType.listOfNullable(String.class))} can return a {@code List<String>} with nullable
+ * elements. These nullness rules are for static analysis tools such as IntelliJ IDEA and NullAway
+ * and are not enforced at runtime.
  */
 @SuppressWarnings({"DeprecatedIsStillUsed"})
 public interface Config {
   /**
-   * The dot-separated name of this node. For example, the node reached using {@code
-   * rootNode.get("foo").get("bar")} has qualified name {@code foo.bar}. Returns the empty String
-   * for the root node itself.
+   * Returns the qualified name of this node, or the empty string if this is the root node.
+   *
+   * <p>The qualified name is formed by joining child names using {@code '.'}. For example, {@code
+   * rootNode.get("foo").get("bar").getQualifiedName()} returns {@code "foo.bar"}.
    */
   String getQualifiedName();
 
   /**
-   * The raw value of this node, as provided by {@link Evaluator}. Typically, a node's value is not
-   * consumed directly, but converted to the desired Java type using {@link #as}.
+   * Returns the underlying value of this node.
+   *
+   * <p>This value is typically accessed indirectly via {@link #as(Class)}, {@link
+   * #asNullable(Class)}, or {@link #as(JavaType)}.
    */
   Object getRawValue();
 
   /**
    * Returns the child node with the given unqualified name.
    *
+   * <p>For example, {@code get("foo").get("bar")} returns the child named {@code "bar"} of the
+   * child named {@code "foo"}. Passing a qualified name to this method, as in {@code
+   * get("foo.bar")}, is not supported.
+   *
    * @throws NoSuchChildException if a child with the given name does not exist
    */
   Config get(String childName);
 
   /**
-   * Converts this node's value to the given {@link Class}.
+   * Returns this node's value as a non-null value of the given {@link Class}.
+   *
+   * <p>If this node's value may be {@code null}, use {@link #asNullable(Class)} instead. In a
+   * future version, this method will perform a non-null check.
    *
    * @throws ConversionException if the value cannot be converted to the given type
    */
-  <T extends @Nullable Object> T as(Class<T> type);
+  @NullUnmarked
+  <T> T as(Class<T> type);
 
   /**
-   * Converts this node's value to the given {@link Type}.
+   * Returns this node's value as a non-null value of the given {@link JavaType}.
    *
-   * <p>Note that usages of this method are not type safe.
+   * <p>If this node's value may be {@code null}, use {@link #asNullable(JavaType)} instead. In a
+   * future version, this method will perform a non-null check.
+   *
+   * <p>Use this method when converting to a parameterized type, such as {@code List<@Nullable
+   * String>}.
    *
    * @throws ConversionException if the value cannot be converted to the given type
    */
-  <T extends @Nullable Object> T as(Type type);
+  @NullUnmarked
+  <T> T as(JavaType<T> type);
 
   /**
-   * Converts this node's value to the given {@link JavaType}.
+   * Returns this node's value as a non-null value of the given {@link Type}.
+   *
+   * <p>If this node's value may be {@code null}, use {@link #asNullable(Type)} instead. In a future
+   * version, this method will perform a non-null check.
+   *
+   * <p>Use this method when the target type is already available as a {@link Type}; otherwise,
+   * prefer {@link #as(Class)} or {@link #as(JavaType)}.
    *
    * @throws ConversionException if the value cannot be converted to the given type
    */
-  <T extends @Nullable Object> T as(JavaType<T> type);
+  @NullUnmarked
+  <T> T as(Type type);
+
+  /**
+   * Returns this node's value as a nullable value of the given {@link Class}.
+   *
+   * <p>If this node's value cannot be {@code null}, use {@link #as(Class)} instead.
+   *
+   * @throws ConversionException if the value cannot be converted to the given type
+   */
+  <T> @Nullable T asNullable(Class<T> type);
+
+  /**
+   * Returns this node's value as a nullable value of the given {@link Class}.
+   *
+   * <p>If this node's value cannot be {@code null}, use {@link #as(JavaType)} instead.
+   *
+   * <p>Use this method when converting to a parameterized type, such as {@code List<@Nullable
+   * String>}.
+   *
+   * @throws ConversionException if the value cannot be converted to the given type
+   */
+  <T> @Nullable T asNullable(JavaType<T> type);
+
+  /**
+   * Returns this node's value as a nullable value of the given {@link Type}.
+   *
+   * <p>If this node's value cannot be {@code null}, use {@link #as(Type)} instead.
+   *
+   * <p>Use this method when the target type is already available as a {@link Type}; otherwise,
+   * prefer {@link #asNullable(Class)} or {@link #as(JavaType)}.
+   *
+   * @throws ConversionException if the value cannot be converted to the given type
+   */
+  <T extends @Nullable Object> T asNullable(Type type);
 
   /**
    * Decodes a config from the supplied byte array.

pkl-config-java/src/main/java/org/pkl/config/java/JavaType.java

@@ -23,30 +23,77 @@ import org.pkl.config.java.mapper.Types;
 import org.pkl.core.Pair;
 
 /**
- * Runtime representation of a possibly parameterized Java type. Factory methods are provided to
- * ease construction of commonly used Java standard library types. For example, a {@code JavaType}
- * for {@code List<String>} can be constructed using {@code JavaType.listOf(String.class)}.
+ * Represents a Java type, including fully parameterized types.
  *
- * <p>Parameterizations of other types can be constructed using the <em>super type token</em> idiom:
+ * <p>This class captures complete type information that cannot be expressed with {@link Class}, for
+ * example {@code List<String>} or {@code Result<String, @Nullable Integer>}. It is often used with
+ * {@link Config#as(JavaType)}.
  *
- * <p>
+ * <p>A {@code JavaType} always represents a non-null top-level type, but its type arguments may be
+ * nullable. For example, {@code listOfNullable(String.class)} represents {@code List<@Nullable
+ * String>}.
+ *
+ * <p>To construct a non-parameterized type, use {@link #of(Class)}.
+ *
+ * <p>To construct common parameterized types, use one of:
+ *
+ * <ul>
+ *   <li>{@link #optionalOf(Class)}
+ *   <li>{@link #arrayOf(Class)}
+ *   <li>{@link #collectionOf(Class)}
+ *   <li>{@link #iterableOf(Class)}
+ *   <li>{@link #listOf(Class)}
+ *   <li>{@link #setOf(Class)}
+ *   <li>{@link #mapOf(Class, Class)}
+ *   <li>{@link #pairOf(Class, Class)}
+ * </ul>
+ *
+ * <p>Apart from {@code optionalOf()}, the above methods have nullable variants:
+ *
+ * <ul>
+ *   <li>{@link #arrayOfNullable(Class)}
+ *   <li>{@link #collectionOfNullable(Class)}
+ *   <li>{@link #iterableOfNullable(Class)}
+ *   <li>{@link #listOfNullable(Class)}
+ *   <li>{@link #setOfNullable(Class)}
+ *   <li>{@link #mapOfNullableKeys(Class, Class)}
+ *   <li>{@link #mapOfNullableValues(Class, Class)}
+ *   <li>{@link #mapOfNullableKeysAndValues(Class, Class)}
+ *   <li>{@link #pairOfNullableFirst(Class, Class)}
+ *   <li>{@link #pairOfNullableSecond(Class, Class)}
+ *   <li>{@link #pairOfNullableFirstAndSecond(Class, Class)}
+ * </ul>
+ *
+ * <p>These methods can be nested. For example, {@code optionalOf(listOfNullable(String.class))}
+ * represents {@code Optional<List<@Nullable String>>}.
+ *
+ * <p>To construct arbitrary parameterized types, use the <em>super-type token</em> idiom:
  *
  * <pre>{@code
- * class Mapping<T> {} // some user-defined type
+ * class Result<T, U> {} // library or user-defined type
+ *
  * Config config = ...
  *
- * Mapping<String> container = config.as(
- *   // construct super type token for Mapping<String>
- *   new JavaType<Mapping<String>>() {}
- * );
+ * Result<String, @Nullable Integer> result =
+ *     config.as(new JavaType<Result<String, @Nullable Integer>>() {});
  * }</pre>
  *
- * @param <T> the type reified by this {@code JavaType} instance
+ * @param <T> the non-null type represented by this {@code JavaType}
  */
-@SuppressWarnings("unused")
 public class JavaType<T> {
   private final Type type;
 
+  /**
+   * Constructs a {@code JavaType} using the super-type token idiom.
+   *
+   * <p>Subclasses must be parameterized with the desired type, for example:
+   *
+   * <pre>{@code
+   * new JavaType<List<@Nullable String>>() {}
+   * }</pre>
+   *
+   * @throws IllegalStateException if this instance is not parameterized
+   */
   protected JavaType() {
     var superclass = getClass().getGenericSuperclass();
     if (!(superclass instanceof ParameterizedType parameterizedType)) {
@@ -59,100 +106,382 @@ public class JavaType<T> {
     this.type = type;
   }
 
-  /** Creates a {@code JavaType} for the given {@code Class}. */
+  /** Creates a {@code JavaType} for the given type. */
   public static <T> JavaType<T> of(Class<T> type) {
     return new JavaType<>(type);
   }
 
   /**
-   * Creates a {@code JavaType} for the given {@code Type}.
+   * Creates a {@code JavaType} for the given {@link Type}.
    *
-   * <p>Note: This method is not type safe, and should be used with care.
+   * <p>Use this method when the target type is already available as a {@link Type}; otherwise,
+   * prefer {@link #of(Class)}.
    */
   public static <T> JavaType<T> of(Type type) {
     return new JavaType<>(type);
   }
 
-  /** Creates an {@link Optional} type with the given element type. */
+  /**
+   * Creates an {@link Optional} type with the given non-null element type.
+   *
+   * <p>For a parameterized element type, use {@link #optionalOf(JavaType)}.
+   */
   public static <E> JavaType<Optional<E>> optionalOf(Class<E> elementType) {
     return JavaType.of(Types.optionalOf(elementType));
   }
 
-  /** Creates an {@link Optional} type with the given element type. */
+  /** Creates an {@link Optional} type with the given non-null element type. */
   public static <E> JavaType<Optional<E>> optionalOf(JavaType<E> elementType) {
     return JavaType.of(Types.optionalOf(elementType.type));
   }
 
-  /** Creates a {@link Pair} type with the given first and second element types. */
+  /**
+   * Creates a {@link Pair} type with the given non-null first and non-null second element types.
+   *
+   * <p>For nullable first and/or second element types, use one of the {@code pairOfNullable*}
+   * methods.
+   *
+   * <p>For parameterized element types, use {@link #pairOf(JavaType, JavaType)}.
+   */
   public static <F, S> JavaType<Pair<F, S>> pairOf(Class<F> firstType, Class<S> secondType) {
     return JavaType.of(Types.pairOf(firstType, secondType));
   }
 
-  /** Creates a {@link Pair} type with the given first and second element types. */
+  /**
+   * Creates a {@link Pair} type with the given non-null first and non-null second element types.
+   *
+   * <p>For nullable first and/or second element types, use one of the {@code pairOfNullable*}
+   * methods.
+   */
   public static <F, S> JavaType<Pair<F, S>> pairOf(JavaType<F> firstType, JavaType<S> secondType) {
     return JavaType.of(Types.pairOf(firstType.type, secondType.type));
   }
 
-  /** Creates an array type with the given element type. */
+  /**
+   * Creates a {@link Pair} type with the given nullable first and non-null second element types.
+   *
+   * <p>For parameterized element types, use {@link #pairOfNullableFirst(JavaType, JavaType)}.
+   */
+  public static <F, S> JavaType<Pair<@Nullable F, S>> pairOfNullableFirst(
+      Class<F> firstType, Class<S> secondType) {
+    return JavaType.of(Types.pairOf(firstType, secondType));
+  }
+
+  /**
+   * Creates a {@link Pair} type with the given nullable first and non-null second element types.
+   */
+  public static <F, S> JavaType<Pair<@Nullable F, S>> pairOfNullableFirst(
+      JavaType<F> firstType, JavaType<S> secondType) {
+    return JavaType.of(Types.pairOf(firstType.type, secondType.type));
+  }
+
+  /**
+   * Creates a {@link Pair} type with the given non-null first and nullable second element types.
+   *
+   * <p>For parameterized element types, use {@link #pairOfNullableSecond(JavaType, JavaType)}.
+   */
+  public static <F, S> JavaType<Pair<F, @Nullable S>> pairOfNullableSecond(
+      Class<F> firstType, Class<S> secondType) {
+    return JavaType.of(Types.pairOf(firstType, secondType));
+  }
+
+  /**
+   * Creates a {@link Pair} type with the given non-null first and nullable second element types.
+   */
+  public static <F, S> JavaType<Pair<F, @Nullable S>> pairOfNullableSecond(
+      JavaType<F> firstType, JavaType<S> secondType) {
+    return JavaType.of(Types.pairOf(firstType.type, secondType.type));
+  }
+
+  /**
+   * Creates a {@link Pair} type with the given nullable first and nullable second element types.
+   *
+   * <p>For parameterized element types, use {@link #pairOfNullableFirstAndSecond(JavaType,
+   * JavaType)}.
+   */
+  public static <F, S> JavaType<Pair<@Nullable F, @Nullable S>> pairOfNullableFirstAndSecond(
+      Class<F> firstType, Class<S> secondType) {
+    return JavaType.of(Types.pairOf(firstType, secondType));
+  }
+
+  /**
+   * Creates a {@link Pair} type with the given nullable first and nullable second element types.
+   */
+  public static <F, S> JavaType<Pair<@Nullable F, @Nullable S>> pairOfNullableFirstAndSecond(
+      JavaType<F> firstType, JavaType<S> secondType) {
+    return JavaType.of(Types.pairOf(firstType.type, secondType.type));
+  }
+
+  /**
+   * Creates an array type with the given non-null element type.
+   *
+   * <p>For a nullable element type, use {@link #arrayOfNullable(Class)}.
+   *
+   * <p>For a parameterized element type, use {@link #arrayOf(JavaType)}.
+   */
   public static <E> JavaType<E[]> arrayOf(Class<E> elementType) {
     return JavaType.of(Types.arrayOf(elementType));
   }
 
-  /** Creates an array type with the given element type. */
+  /**
+   * Creates an array type with the given non-null element type.
+   *
+   * <p>For a nullable element type, use {@link #arrayOfNullable(JavaType)}.
+   */
   public static <E> JavaType<E[]> arrayOf(JavaType<E> elementType) {
     return JavaType.of(Types.arrayOf(elementType.type));
   }
 
-  /** Creates an {@link Iterable} type with the given element type. */
+  /**
+   * Creates an array type whose element type is nullable.
+   *
+   * <p>For a non-null element type, use {@link #arrayOf(Class)}.
+   *
+   * <p>For a parameterized element type, use {@link #arrayOfNullable(JavaType)}.
+   */
+  public static <E> JavaType<@Nullable E[]> arrayOfNullable(Class<E> elementType) {
+    return JavaType.of(Types.arrayOf(elementType));
+  }
+
+  /**
+   * Creates an array type whose element type is nullable.
+   *
+   * <p>For a non-null element type, use {@link #arrayOf(JavaType)}.
+   */
+  public static <E> JavaType<@Nullable E[]> arrayOfNullable(JavaType<E> elementType) {
+    return JavaType.of(Types.arrayOf(elementType.type));
+  }
+
+  /**
+   * Creates an {@link Iterable} type with the given non-null element type.
+   *
+   * <p>For a nullable element type, use {@link #iterableOfNullable(Class)}.
+   *
+   * <p>For a parameterized element type, use {@link #iterableOf(JavaType)}.
+   */
   public static <E> JavaType<Iterable<E>> iterableOf(Class<E> elementType) {
     return JavaType.of(Types.iterableOf(elementType));
   }
 
-  /** Creates an {@link Iterable} type with the given element type. */
+  /**
+   * Creates an {@link Iterable} type with the given non-null element type.
+   *
+   * <p>For a nullable element type, use {@link #iterableOfNullable(JavaType)}.
+   */
   public static <E> JavaType<Iterable<E>> iterableOf(JavaType<E> elementType) {
     return JavaType.of(Types.iterableOf(elementType.type));
   }
 
-  /** Creates a {@link Collection} type with the given element type. */
+  /**
+   * Creates an {@link Iterable} type whose element type is nullable.
+   *
+   * <p>For a non-null element type, use {@link #iterableOf(Class)}.
+   *
+   * <p>For a parameterized element type, use {@link #iterableOfNullable(JavaType)}.
+   */
+  public static <E> JavaType<Iterable<@Nullable E>> iterableOfNullable(Class<E> elementType) {
+    return JavaType.of(Types.iterableOf(elementType));
+  }
+
+  /**
+   * Creates an {@link Iterable} type whose element type is nullable.
+   *
+   * <p>For a non-null element type, use {@link #iterableOf(JavaType)}.
+   */
+  public static <E> JavaType<Iterable<@Nullable E>> iterableOfNullable(JavaType<E> elementType) {
+    return JavaType.of(Types.iterableOf(elementType.type));
+  }
+
+  /**
+   * Creates a {@link Collection} type with the given non-null element type.
+   *
+   * <p>For a nullable element type, use {@link #collectionOfNullable(Class)}.
+   *
+   * <p>For a parameterized element type, use {@link #collectionOf(JavaType)}.
+   */
   public static <E> JavaType<Collection<E>> collectionOf(Class<E> elementType) {
     return JavaType.of(Types.collectionOf(elementType));
   }
 
-  /** Creates a {@link Collection} type with the given element type. */
+  /**
+   * Creates a {@link Collection} type with the given non-null element type.
+   *
+   * <p>For a nullable element type, use {@link #collectionOfNullable(JavaType)}.
+   */
   public static <E> JavaType<Collection<E>> collectionOf(JavaType<E> elementType) {
     return JavaType.of(Types.collectionOf(elementType.type));
   }
 
-  /** Creates a {@link List} type with the given element type. */
+  /**
+   * Creates a {@link Collection} type whose element type is nullable.
+   *
+   * <p>For a non-null element type, use {@link #collectionOf(Class)}.
+   *
+   * <p>For a parameterized element type, use {@link #collectionOfNullable(JavaType)}.
+   */
+  public static <E> JavaType<Collection<@Nullable E>> collectionOfNullable(Class<E> elementType) {
+    return JavaType.of(Types.collectionOf(elementType));
+  }
+
+  /**
+   * Creates a {@link Collection} type whose element type is nullable.
+   *
+   * <p>For a non-null element type, use {@link #collectionOf(JavaType)}.
+   */
+  public static <E> JavaType<Collection<@Nullable E>> collectionOfNullable(
+      JavaType<E> elementType) {
+    return JavaType.of(Types.collectionOf(elementType.type));
+  }
+
+  /**
+   * Creates a {@link List} type with the given non-null element type.
+   *
+   * <p>For a nullable element type, use {@link #listOfNullable(Class)}.
+   *
+   * <p>For a parameterized element type, use {@link #listOf(JavaType)}.
+   */
   public static <E> JavaType<List<E>> listOf(Class<E> elementType) {
     return JavaType.of(Types.listOf(elementType));
   }
 
-  /** Creates a {@link List} type with the given element type. */
+  /**
+   * Creates a {@link List} type with the given non-null element type.
+   *
+   * <p>For a nullable element type, use {@link #listOfNullable(JavaType)}.
+   */
   public static <E> JavaType<List<E>> listOf(JavaType<E> elementType) {
     return JavaType.of(Types.listOf(elementType.type));
   }
 
-  /** Creates a {@link Set} type with the given element type. */
+  /**
+   * Creates a {@link List} type whose element type is nullable.
+   *
+   * <p>For a non-null element type, use {@link #listOf(Class)}.
+   *
+   * <p>For a parameterized element type, use {@link #listOfNullable(JavaType)}.
+   */
+  public static <E> JavaType<List<@Nullable E>> listOfNullable(Class<E> elementType) {
+    return JavaType.of(Types.listOf(elementType));
+  }
+
+  /**
+   * Creates a {@link List} type whose element type is nullable.
+   *
+   * <p>For a non-null element type, use {@link #listOf(JavaType)}.
+   */
+  public static <E> JavaType<List<@Nullable E>> listOfNullable(JavaType<E> elementType) {
+    return JavaType.of(Types.listOf(elementType.type));
+  }
+
+  /**
+   * Creates a {@link Set} type with the given non-null element type.
+   *
+   * <p>For a nullable element type, use {@link #setOfNullable(Class)}.
+   *
+   * <p>For a parameterized element type, use {@link #setOf(JavaType)}.
+   */
   public static <E> JavaType<Set<E>> setOf(Class<E> elementType) {
     return JavaType.of(Types.setOf(elementType));
   }
 
-  /** Creates a {@link Set} type with the given element type. */
+  /**
+   * Creates a {@link Set} type with the given non-null element type.
+   *
+   * <p>For a nullable element type, use {@link #setOfNullable(JavaType)}.
+   */
   public static <E> JavaType<Set<E>> setOf(JavaType<E> elementType) {
     return JavaType.of(Types.setOf(elementType.type));
   }
 
-  /** Creates a {@link Map} type with the given key and value types. */
+  /**
+   * Creates a {@link Set} type whose element type is nullable.
+   *
+   * <p>For a non-null element type, use {@link #setOf(Class)}.
+   *
+   * <p>For a parameterized element type, use {@link #setOfNullable(JavaType)}.
+   */
+  public static <E> JavaType<Set<@Nullable E>> setOfNullable(Class<E> elementType) {
+    return JavaType.of(Types.setOf(elementType));
+  }
+
+  /**
+   * Creates a {@link Set} type whose element type is nullable.
+   *
+   * <p>For a non-null element type, use {@link #setOf(JavaType)}.
+   */
+  public static <E> JavaType<Set<@Nullable E>> setOfNullable(JavaType<E> elementType) {
+    return JavaType.of(Types.setOf(elementType.type));
+  }
+
+  /**
+   * Creates a {@link Map} type with the given non-null key and non-null value types.
+   *
+   * <p>For nullable keys and/or values, use one of the {@code mapOfNullable*} methods.
+   *
+   * <p>For parameterized key and value types, use {@link #mapOf(JavaType, JavaType)}.
+   */
   public static <K, V> JavaType<Map<K, V>> mapOf(Class<K> keyType, Class<V> valueType) {
     return JavaType.of(Types.mapOf(keyType, valueType));
   }
 
-  /** Creates a {@link Map} type with the given key and value types. */
+  /**
+   * Creates a {@link Map} type with the given non-null key and non-null value types.
+   *
+   * <p>For nullable keys and/or values, use one of the {@code mapOfNullable*} methods.
+   */
   public static <K, V> JavaType<Map<K, V>> mapOf(JavaType<K> keyType, JavaType<V> valueType) {
     return JavaType.of(Types.mapOf(keyType.type, valueType.type));
   }
 
+  /**
+   * Creates a {@link Map} type with the given nullable key and non-null value types.
+   *
+   * <p>For parameterized key and value types, use {@link #mapOfNullableKeys(JavaType, JavaType)}.
+   */
+  public static <K, V> JavaType<Map<@Nullable K, V>> mapOfNullableKeys(
+      Class<K> keyType, Class<V> valueType) {
+    return JavaType.of(Types.mapOf(keyType, valueType));
+  }
+
+  /** Creates a {@link Map} type with the given nullable key and non-null value types. */
+  public static <K, V> JavaType<Map<@Nullable K, V>> mapOfNullableKeys(
+      JavaType<K> keyType, JavaType<V> valueType) {
+    return JavaType.of(Types.mapOf(keyType.type, valueType.type));
+  }
+
+  /**
+   * Creates a {@link Map} type with the given non-null key and nullable value types.
+   *
+   * <p>For parameterized key and value types, use {@link #mapOfNullableValues(JavaType, JavaType)}.
+   */
+  public static <K, V> JavaType<Map<K, @Nullable V>> mapOfNullableValues(
+      Class<K> keyType, Class<V> valueType) {
+    return JavaType.of(Types.mapOf(keyType, valueType));
+  }
+
+  /** Creates a {@link Map} type with the given non-null key and nullable value types. */
+  public static <K, V> JavaType<Map<K, @Nullable V>> mapOfNullableValues(
+      JavaType<K> keyType, JavaType<V> valueType) {
+    return JavaType.of(Types.mapOf(keyType.type, valueType.type));
+  }
+
+  /**
+   * Creates a {@link Map} type with the given nullable key and nullable value types.
+   *
+   * <p>For parameterized key and value types, use {@link #mapOfNullableKeysAndValues(JavaType,
+   * JavaType)}.
+   */
+  public static <K, V> JavaType<Map<@Nullable K, @Nullable V>> mapOfNullableKeysAndValues(
+      Class<K> keyType, Class<V> valueType) {
+    return JavaType.of(Types.mapOf(keyType, valueType));
+  }
+
+  /** Creates a {@link Map} type with the given nullable key and nullable value types. */
+  public static <K, V> JavaType<Map<@Nullable K, @Nullable V>> mapOfNullableKeysAndValues(
+      JavaType<K> keyType, JavaType<V> valueType) {
+    return JavaType.of(Types.mapOf(keyType.type, valueType.type));
+  }
+
   /** Returns the underlying {@link Type}. */
   public Type getType() {
     return type;

pkl-config-java/src/main/java/org/pkl/config/java/mapper/NonNull.java

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -21,8 +21,16 @@ import java.lang.annotation.Retention;
 import java.lang.annotation.RetentionPolicy;
 import java.lang.annotation.Target;
 
-/** Indicates that a type does not accept {@code null} as a value. */
+/**
+ * Indicates that a type does not accept {@code null} as a value.
+ *
+ * <p>This annotation is deprecated, and any usage should be replaced with {@link
+ * org.jspecify.annotations.NonNull}.
+ *
+ * @deprecated since 0.32.0
+ */
 @Target({ElementType.TYPE_PARAMETER, ElementType.TYPE_USE})
 @Retention(RetentionPolicy.CLASS)
 @Documented
+@Deprecated(forRemoval = true)
 public @interface NonNull {}

pkl-config-java/src/test/java/org/pkl/config/java/ConfigEvaluatorTest.java

@@ -17,6 +17,8 @@ package org.pkl.config.java;
 
 import static org.assertj.core.api.Assertions.assertThat;
 
+import java.lang.reflect.Type;
+import org.jspecify.annotations.Nullable;
 import org.junit.jupiter.api.AfterAll;
 import org.junit.jupiter.api.Test;
 import org.pkl.core.ModuleSource;
@@ -50,4 +52,31 @@ public final class ConfigEvaluatorTest extends AbstractConfigTest {
     var address = addressConfig.as(Address.class);
     assertThat(address.street).isEqualTo("Fuzzy St.");
   }
+
+  @Test
+  public void asNullableWithClass() {
+    var mod = evaluator.evaluate(ModuleSource.text("nullValue = null; strValue = \"Bob\""));
+    @Nullable String nullValue = mod.get("nullValue").asNullable(String.class);
+    @Nullable String strValue = mod.get("strValue").asNullable(String.class);
+    assertThat(nullValue).isNull();
+    assertThat(strValue).isNotNull();
+  }
+
+  @Test
+  public void asNullableWithType() {
+    var mod = evaluator.evaluate(ModuleSource.text("nullValue = null; strValue = \"Bob\""));
+    @Nullable String nullValue = mod.get("nullValue").asNullable((Type) String.class);
+    @Nullable String strValue = mod.get("strValue").asNullable((Type) String.class);
+    assertThat(nullValue).isNull();
+    assertThat(strValue).isNotNull();
+  }
+
+  @Test
+  public void asNullableWithJavaType() {
+    var mod = evaluator.evaluate(ModuleSource.text("nullValue = null; strValue = \"Bob\""));
+    @Nullable String nullValue = mod.get("nullValue").asNullable(JavaType.of(String.class));
+    @Nullable String strValue = mod.get("strValue").asNullable(JavaType.of(String.class));
+    assertThat(nullValue).isNull();
+    assertThat(strValue).isNotNull();
+  }
 }

pkl-config-java/src/test/java/org/pkl/config/java/JavaTypeTest.java

@@ -17,15 +17,25 @@ package org.pkl.config.java;
 
 import static org.assertj.core.api.Assertions.*;
 
+import java.lang.reflect.Type;
 import java.net.URI;
 import java.net.URL;
 import java.nio.file.Path;
 import java.util.*;
+import org.jspecify.annotations.Nullable;
 import org.junit.jupiter.api.Test;
 import org.pkl.config.java.mapper.Reflection;
 import org.pkl.config.java.mapper.Types;
+import org.pkl.core.Pair;
 
 public final class JavaTypeTest {
+  @Test
+  public void constructSimpleType() {
+    assertThat(JavaType.of(String.class)).isEqualTo(new JavaType<String>() {});
+    //noinspection AssertBetweenInconvertibleTypes
+    assertThat(JavaType.of((Type) String.class)).isEqualTo(new JavaType<String>() {});
+  }
+
   @Test
   public void constructOptionalType() {
     var type = JavaType.optionalOf(String.class);
@@ -34,6 +44,14 @@ public final class JavaTypeTest {
     assertThat(Reflection.toRawType(type.getType())).isEqualTo(Optional.class);
   }
 
+  @Test
+  public void constructPairType() {
+    var type = JavaType.pairOf(String.class, Integer.class);
+    assertThat(type).isEqualTo(new JavaType<Pair<String, Integer>>() {});
+    assertThat(type)
+        .isEqualTo(JavaType.pairOf(JavaType.of(String.class), JavaType.of(Integer.class)));
+  }
+
   @Test
   public void constructArrayType() {
     var type = JavaType.arrayOf(String.class);
@@ -42,6 +60,14 @@ public final class JavaTypeTest {
     assertThat(Reflection.toRawType(type.getType()).isArray()).isTrue();
   }
 
+  @Test
+  public void constructArrayOfNullableType() {
+    var type = JavaType.arrayOfNullable(String.class);
+    assertThat(type).isEqualTo(new JavaType<@Nullable String[]>() {});
+    assertThat(type).isEqualTo(JavaType.arrayOfNullable(JavaType.of(String.class)));
+    assertThat(Reflection.toRawType(type.getType()).isArray()).isTrue();
+  }
+
   @Test
   public void constructIterableType() {
     var type = JavaType.iterableOf(String.class);
@@ -50,6 +76,14 @@ public final class JavaTypeTest {
     assertThat(Reflection.toRawType(type.getType())).isEqualTo(Iterable.class);
   }
 
+  @Test
+  public void constructIterableOfNullableType() {
+    var type = JavaType.iterableOfNullable(String.class);
+    assertThat(type).isEqualTo(new JavaType<Iterable<@Nullable String>>() {});
+    assertThat(type).isEqualTo(JavaType.iterableOfNullable(JavaType.of(String.class)));
+    assertThat(Reflection.toRawType(type.getType())).isEqualTo(Iterable.class);
+  }
+
   @Test
   public void constructCollectionType() {
     var type = JavaType.collectionOf(String.class);
@@ -58,6 +92,14 @@ public final class JavaTypeTest {
     assertThat(Reflection.toRawType(type.getType())).isEqualTo(Collection.class);
   }
 
+  @Test
+  public void constructCollectionOfNullableType() {
+    var type = JavaType.collectionOfNullable(String.class);
+    assertThat(type).isEqualTo(new JavaType<Collection<@Nullable String>>() {});
+    assertThat(type).isEqualTo(JavaType.collectionOfNullable(JavaType.of(String.class)));
+    assertThat(Reflection.toRawType(type.getType())).isEqualTo(Collection.class);
+  }
+
   @Test
   public void constructListType() {
     var type = JavaType.listOf(String.class);
@@ -66,6 +108,14 @@ public final class JavaTypeTest {
     assertThat(Reflection.toRawType(type.getType())).isEqualTo(List.class);
   }
 
+  @Test
+  public void constructListOfNullableType() {
+    var type = JavaType.listOfNullable(String.class);
+    assertThat(type).isEqualTo(new JavaType<List<@Nullable String>>() {});
+    assertThat(type).isEqualTo(JavaType.listOfNullable(JavaType.of(String.class)));
+    assertThat(Reflection.toRawType(type.getType())).isEqualTo(List.class);
+  }
+
   @Test
   public void constructSetType() {
     var type = JavaType.setOf(String.class);
@@ -74,6 +124,14 @@ public final class JavaTypeTest {
     assertThat(Reflection.toRawType(type.getType())).isEqualTo(Set.class);
   }
 
+  @Test
+  public void constructSetOfNullableType() {
+    var type = JavaType.setOfNullable(String.class);
+    assertThat(type).isEqualTo(new JavaType<Set<@Nullable String>>() {});
+    assertThat(type).isEqualTo(JavaType.setOfNullable(JavaType.of(String.class)));
+    assertThat(Reflection.toRawType(type.getType())).isEqualTo(Set.class);
+  }
+
   @Test
   public void constructMapType() {
     var type = JavaType.mapOf(String.class, URI.class);
@@ -83,7 +141,63 @@ public final class JavaTypeTest {
   }
 
   @Test
-  public void usageAsTypeToken() {
+  public void constructPairOfNullableFirstType() {
+    var type = JavaType.pairOfNullableFirst(String.class, Integer.class);
+    assertThat(type).isEqualTo(new JavaType<Pair<@Nullable String, Integer>>() {});
+    assertThat(type)
+        .isEqualTo(
+            JavaType.pairOfNullableFirst(JavaType.of(String.class), JavaType.of(Integer.class)));
+  }
+
+  @Test
+  public void constructPairOfNullableSecondType() {
+    var type = JavaType.pairOfNullableSecond(String.class, Integer.class);
+    assertThat(type).isEqualTo(new JavaType<Pair<String, @Nullable Integer>>() {});
+    assertThat(type)
+        .isEqualTo(
+            JavaType.pairOfNullableSecond(JavaType.of(String.class), JavaType.of(Integer.class)));
+  }
+
+  @Test
+  public void constructPairOfNullableFirstAndSecondType() {
+    var type = JavaType.pairOfNullableFirstAndSecond(String.class, Integer.class);
+    assertThat(type).isEqualTo(new JavaType<Pair<@Nullable String, @Nullable Integer>>() {});
+    assertThat(type)
+        .isEqualTo(
+            JavaType.pairOfNullableFirstAndSecond(
+                JavaType.of(String.class), JavaType.of(Integer.class)));
+  }
+
+  @Test
+  public void constructMapOfNullableKeysType() {
+    var type = JavaType.mapOfNullableKeys(String.class, URI.class);
+    assertThat(type).isEqualTo(new JavaType<Map<@Nullable String, URI>>() {});
+    assertThat(type)
+        .isEqualTo(JavaType.mapOfNullableKeys(JavaType.of(String.class), JavaType.of(URI.class)));
+    assertThat(Reflection.toRawType(type.getType())).isEqualTo(Map.class);
+  }
+
+  @Test
+  public void constructMapOfNullableValuesType() {
+    var type = JavaType.mapOfNullableValues(String.class, URI.class);
+    assertThat(type).isEqualTo(new JavaType<Map<String, @Nullable URI>>() {});
+    assertThat(type)
+        .isEqualTo(JavaType.mapOfNullableValues(JavaType.of(String.class), JavaType.of(URI.class)));
+    assertThat(Reflection.toRawType(type.getType())).isEqualTo(Map.class);
+  }
+
+  @Test
+  public void constructMapOfNullableKeysAndValuesType() {
+    var type = JavaType.mapOfNullableKeysAndValues(String.class, URI.class);
+    assertThat(type).isEqualTo(new JavaType<Map<@Nullable String, @Nullable URI>>() {});
+    assertThat(type)
+        .isEqualTo(
+            JavaType.mapOfNullableKeysAndValues(JavaType.of(String.class), JavaType.of(URI.class)));
+    assertThat(Reflection.toRawType(type.getType())).isEqualTo(Map.class);
+  }
+
+  @Test
+  public void constructTypeToken() {
     var javaType = new JavaType<Map<String, List<URI>>>() {};
 
     assertThat(javaType.getType()).isEqualTo(Types.mapOf(String.class, Types.listOf(URI.class)));
@@ -110,6 +224,7 @@ public final class JavaTypeTest {
     var type2 = new JavaType<Map<String, List<URL>>>() {};
     var type3 = JavaType.of(Types.mapOf(String.class, Types.listOf(Path.class)));
 
+    //noinspection AssertBetweenInconvertibleTypes
     assertThat(type2).isNotEqualTo(type1);
     assertThat(type3).isNotEqualTo(type1);
     assertThat(type2).isNotEqualTo(type3);

pkl-config-kotlin/src/main/kotlin/org/pkl/config/kotlin/ConfigExtensions.kt

@@ -40,14 +40,15 @@ import org.pkl.config.kotlin.mapper.KotlinConverterFactories
  *   `as(JavaType.listOf(String::class.java))`
  */
 inline fun <reified T> Config.to(): T {
-  val result = `as`<T>(typeOf<T>().javaType)
-  if (result == null && null !is T) {
-    throw ConversionException(
+  if (null is T) {
+    return asNullable(typeOf<T>().javaType)
+  }
+
+  return `as`(typeOf<T>().javaType)
+    ?: throw ConversionException(
       "Expected a non-null value but got `null`. " +
         "To allow null values, convert to a nullable Kotlin type, for example `String?`."
     )
-  }
-  return result
 }
 
 /**

pkl-config-kotlin/src/test/kotlin/org/pkl/config/kotlin/KotlinObjectMappingTest.kt

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024-2025 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -62,34 +62,34 @@ class KotlinObjectMappingTest {
     val code =
       """
       module KotlinGenericTypesTest
-      
+
       class Foo {
         value: Int
       }
-      
+
       // Sets
       stringSet: Set<String> = Set("in set")
       intSet: Set<Int> = Set(1,2,4,8,16,32)
       booleanSetSet: Set<Set<Boolean>> = Set(Set(false), Set(true), Set(true, false))
-      
+
       // Lists
       stringList: List<String> = List("in list")
       intList: List<Int> = List(1,2,3,5,7,11)
       booleanListList: List<List<Boolean>> = List(List(false), List(true), List(true, false))
-      
+
       // Maps
       intStringMap: Map<Int, String> = Map(0, "in map")
       booleanIntStringMapMap: Map<Boolean, Map<Int, String>> = Map(false, Map(0, "in map in map"))
       booleanIntMapStringMap: Map<Map<Boolean, Int>, String> = Map(Map(true, 42), "in map with map keys")
-      
+
       // Listings
       stringSetListing: Listing<Set<String>> = new { Set("in set in listing") }
       intListingListing: Listing<Listing<Int>> = new { new { 1337 } new { 100 } }
-      
+
       // Mappings
       intStringMapping: Mapping<Int, String> = new { [42] = "in map" }
       stringStringSetMapping: Mapping<String, Set<String>> = new { ["key"] = Set("in set in map") }
-      
+
       // Map & Mappings with structured keys
       intSetListStringMap: Map<List<Set<Int>>, String> = Map(List(Set(27)), "in map with structured key")
       typedStringMap: Map<Foo, String> = Map(
@@ -98,7 +98,7 @@ class KotlinObjectMappingTest {
       dynamicStringMap: Map<Dynamic, String> = Map(
         new Dynamic { value = 42 }, "using Dynamics",
         new Dynamic { hello = "world" }, "also works")
-      
+
       intListingStringMapping: Mapping<Listing<Int>, String> = new {
         [new Listing { 42 1337 }] = "structured key works"
       }
@@ -109,7 +109,7 @@ class KotlinObjectMappingTest {
       thisOneGoesToEleven: Mapping<List<Set<Int>>, Map<Listing<Int>, Mapping<Int, String>>> = new {
         [List(Set(0), Set(0), Set(7))] = Map(intListing, intStringMapping)
       }
-    """
+      """
         .trimIndent()
     val result = ConfigEvaluator.preconfigured().forKotlin().evaluate(text(code))
     assertDoesNotThrow { result.to<KotlinGenericTypesTest>() }

pkl-core/pkl-core.gradle.kts

@@ -13,6 +13,8 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
+import net.ltgt.gradle.errorprone.errorprone
+import net.ltgt.gradle.nullaway.nullaway
 import org.apache.tools.ant.filters.ReplaceTokens
 
 plugins {
@@ -21,10 +23,21 @@ plugins {
   id("pklJavaLibrary")
   id("pklPublishLibrary")
   id("pklNativeLifecycle")
+  id("pklJSpecify")
   idea
 }
 
-val generatorSourceSet = sourceSets.register("generator")
+val generatorSourceSet: NamedDomainObjectProvider<SourceSet> = sourceSets.register("generator")
+
+val externalReaderFixtureSourceSet: NamedDomainObjectProvider<SourceSet> =
+  sourceSets.register("externalReaderFixture") {
+    compileClasspath += sourceSets.test.get().output + sourceSets.test.get().compileClasspath
+    runtimeClasspath += sourceSets.test.get().output + sourceSets.test.get().runtimeClasspath
+  }
+
+val externalReaderFixtureImplementation: Configuration by configurations.getting {
+  extendsFrom(configurations.testImplementation.get())
+}
 
 idea {
   module {
@@ -40,7 +53,7 @@ dependencies {
   annotationProcessor(libs.truffleDslProcessor)
   annotationProcessor(generatorSourceSet.get().runtimeClasspath)
 
-  compileOnly(libs.jsr305)
+  compileOnly(libs.errorProneAnnotations)
   // pkl-core implements pkl-executor's ExecutorSpi, but the SPI doesn't ship with pkl-core
   compileOnly(projects.pklExecutor)
 
@@ -54,9 +67,12 @@ dependencies {
   implementation(libs.snakeYaml)
 
   testImplementation(projects.pklCommonsTest)
+  testImplementation(libs.wiremock)
 
   add("generatorImplementation", libs.javaPoet)
   add("generatorImplementation", libs.truffleApi)
+  add("generatorImplementation", libs.jspecify)
+  add("generatorImplementation", projects.pklParser)
 
   javaExecutableConfiguration(project(":pkl-cli", "javaExecutable"))
 }
@@ -107,10 +123,59 @@ tasks.processResources {
 
 tasks.compileJava { options.generatedSourceOutputDirectory.set(file("generated/truffle")) }
 
+tasks.withType<JavaCompile>().configureEach {
+  options.errorprone.nullaway {
+    // Do not require LateInit fields to be initialized at construction time.
+    // Unfortunately, IntelliJ doesn't currently understand this,
+    // and therefore emits many warnings related to LateInit.
+    excludedFieldAnnotations.add("org.pkl.core.util.LateInit")
+
+    // For now, don't analyze code that deals with Truffle ASTs.
+    unannotatedSubPackages.addAll("org.pkl.core.ast", "org.pkl.core.stdlib")
+  }
+}
+
 tasks.compileKotlin { enabled = false }
 
+val externalReaderFixture by tasks.registering {
+  group = "build"
+  dependsOn(tasks.named("compileExternalReaderFixtureJava"))
+  inputs.files(externalReaderFixtureSourceSet.map { it.output })
+  val fileName = if (buildInfo.os.isWindows) "externalreader.bat" else "externalreader"
+  val outputFile = layout.buildDirectory.file("fixtures/$fileName")
+  outputs.file(outputFile)
+  doLast {
+    val classpath = externalReaderFixtureSourceSet.get().runtimeClasspath.asPath
+    val scriptContent =
+      if (buildInfo.os.isWindows) {
+        """
+          @echo off
+          java -cp $classpath org.pkl.core.externalreaderfixture.Main
+        """
+          .trimIndent()
+      } else {
+        """
+          #!/usr/bin/env bash
+
+          java -cp $classpath org.pkl.core.externalreaderfixture.Main
+        """
+          .trimIndent()
+      }
+
+    outputFile.get().asFile.writeText(scriptContent)
+    outputFile.get().asFile.setExecutable(true)
+    println("Created external reader ${outputFile.get().asFile.absolutePath}")
+  }
+}
+
 tasks.test {
   configureTest()
+  dependsOn(externalReaderFixture)
+  environment(
+    "PATH",
+    listOf(System.getenv("PATH"), layout.buildDirectory.dir("fixtures/").get())
+      .joinToString(File.pathSeparator),
+  )
   useJUnitPlatform {
     excludeEngines("MacAmd64LanguageSnippetTestsEngine")
     excludeEngines("MacAarch64LanguageSnippetTestsEngine")
@@ -122,8 +187,45 @@ tasks.test {
 
   // testing very large lists requires more memory than the default 512m!
   maxHeapSize = "1g"
+
+  systemProperty(
+    "org.pkl.core.testExternalReaderPath",
+    externalReaderFixture.map { it.outputs.files.singleFile.absolutePath },
+  )
 }
 
+val generateBaseModuleMembers by
+  tasks.registering(JavaExec::class) {
+    group = "build"
+
+    val outputDir = layout.buildDirectory.dir("generated/sources/baseModuleMembers")
+
+    val basePklFile = layout.projectDirectory.file("../stdlib/base.pkl")
+
+    inputs
+      .file(basePklFile)
+      .withPropertyName("basePkl")
+      .withPathSensitivity(PathSensitivity.RELATIVE)
+
+    outputs.dir(outputDir)
+
+    classpath =
+      generatorSourceSet.get().runtimeClasspath + tasks.processResources.get().outputs.files
+    mainClass = "org.pkl.core.generator.BaseModuleMembersGenerator"
+
+    argumentProviders.add(
+      CommandLineArgumentProvider {
+        listOf(basePklFile.asFile.absolutePath, outputDir.get().asFile.absolutePath)
+      }
+    )
+  }
+
+sourceSets.main { java.srcDir(layout.buildDirectory.dir("generated/sources/baseModuleMembers")) }
+
+tasks.compileJava { dependsOn(generateBaseModuleMembers) }
+
+tasks.sourcesJar { dependsOn(generateBaseModuleMembers) }
+
 val testJavaExecutable by
   tasks.registering(Test::class) {
     configureExecutableTest("LanguageSnippetTestsEngine")

pkl-core/src/externalReaderFixture/kotlin/org/pkl/core/externalreader/util.kt

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2026 Apple Inc. and the Pkl project authors. All rights reserved.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -13,22 +13,12 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */
-package org.pkl.core.util;
+package org.pkl.core.externalreader
 
-import static javax.annotation.meta.When.MAYBE;
+import org.pkl.core.messaging.MessageTransports
 
-import java.lang.annotation.*;
-import javax.annotation.meta.TypeQualifierNickname;
+private val systemInDecoder = ExternalReaderMessagePackDecoder(System.`in`)
 
-@Target({
-  ElementType.TYPE_PARAMETER,
-  ElementType.TYPE_USE,
-  ElementType.PARAMETER,
-  ElementType.FIELD,
-  ElementType.METHOD
-})
-@Retention(RetentionPolicy.RUNTIME)
-@Documented
-@javax.annotation.Nonnull(when = MAYBE)
-@TypeQualifierNickname
-public @interface Nullable {}
+private val systemOutEncoder = ExternalReaderMessagePackEncoder(System.out)
+
+val stdioTransport = MessageTransports.stream(systemInDecoder, systemOutEncoder) {}

pkl-core/src/externalReaderFixture/kotlin/org/pkl/core/externalreaderfixture/Main.kt

@@ -0,0 +1,60 @@
+/*
+ * Copyright © 2026 Apple Inc. and the Pkl project authors. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+@file:JvmName("Main")
+
+package org.pkl.core.externalreaderfixture
+
+import java.net.URI
+import org.pkl.core.externalreader.ExternalModuleReader
+import org.pkl.core.externalreader.ExternalReaderClient
+import org.pkl.core.externalreader.ExternalResourceReader
+import org.pkl.core.externalreader.stdioTransport
+import org.pkl.core.module.PathElement
+
+object ModuleReader : ExternalModuleReader {
+  override val isLocal: Boolean = true
+
+  override fun read(uri: URI): String = "hello"
+
+  override val scheme: String = "foo"
+
+  override val hasHierarchicalUris: Boolean = false
+
+  override val isGlobbable: Boolean = false
+
+  override fun listElements(uri: URI): List<PathElement> {
+    throw NotImplementedError()
+  }
+}
+
+object ResourceReader : ExternalResourceReader {
+  override fun read(uri: URI): ByteArray = "hello".toByteArray()
+
+  override val scheme: String = "foo"
+
+  override val hasHierarchicalUris: Boolean = false
+
+  override val isGlobbable: Boolean = false
+
+  override fun listElements(uri: URI): List<PathElement> {
+    throw NotImplementedError()
+  }
+}
+
+fun main() {
+  val client = ExternalReaderClient(listOf(ModuleReader), listOf(ResourceReader), stdioTransport)
+  client.run()
+}

pkl-core/src/generator/java/org/pkl/core/generator/BaseModuleMembersGenerator.java

@@ -0,0 +1,144 @@
+/*
+ * Copyright © 2026 Apple Inc. and the Pkl project authors. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.pkl.core.generator;
+
+import com.palantir.javapoet.CodeBlock;
+import com.palantir.javapoet.JavaFile;
+import com.palantir.javapoet.MethodSpec;
+import com.palantir.javapoet.TypeName;
+import com.palantir.javapoet.TypeSpec;
+import java.io.IOException;
+import java.io.UncheckedIOException;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.HashSet;
+import java.util.List;
+import java.util.Set;
+import javax.lang.model.element.Modifier;
+import org.pkl.parser.Parser;
+import org.pkl.parser.syntax.Modifier.ModifierValue;
+
+public final class BaseModuleMembersGenerator {
+  record Members(Set<String> properties, Set<String> methods) {}
+
+  public static void main(String[] args) {
+    if (args.length < 2) {
+      throw new IllegalArgumentException(
+          "Usage: BaseModuleMembersGenerator <path-to-base.pkl> <output-dir>");
+    }
+    var members = buildMembers(args[0]);
+    generateJavaCode(members, args[1]);
+  }
+
+  private static void generateJavaCode(Members members, String outputDir) {
+    var privateConstructor = MethodSpec.constructorBuilder().addModifiers(Modifier.PRIVATE).build();
+
+    var hasPropertyMethod =
+        buildHasMethod("hasProperty", members.properties().stream().sorted().toList());
+    var hasMethodMethod = buildHasMethod("hasMethod", members.methods().stream().sorted().toList());
+
+    var classSpec =
+        TypeSpec.classBuilder("BaseModuleMembers")
+            .addModifiers(Modifier.PUBLIC, Modifier.FINAL)
+            .addMethod(privateConstructor)
+            .addMethod(hasPropertyMethod)
+            .addMethod(hasMethodMethod)
+            .build();
+
+    var javaFile =
+        JavaFile.builder("org.pkl.core.runtime", classSpec)
+            .addFileComment("DO NOT EDIT — generated by BaseModuleMembersGenerator")
+            .build();
+
+    try {
+      javaFile.writeTo(Path.of(outputDir));
+    } catch (IOException e) {
+      throw new UncheckedIOException(e);
+    }
+  }
+
+  private static MethodSpec buildHasMethod(String methodName, List<String> names) {
+    var code = CodeBlock.builder();
+    code.add("return switch (name) {\n");
+    code.indent();
+    code.add("case $S", names.get(0));
+    if (names.size() == 1) {
+      code.add(" -> true;\n");
+    } else {
+      code.add(",\n");
+      code.indent();
+      for (var i = 1; i < names.size() - 1; i++) {
+        code.add("$S,\n", names.get(i));
+      }
+      code.add("$S -> true;\n", names.get(names.size() - 1));
+      code.unindent();
+    }
+    code.add("default -> false;\n");
+    code.unindent();
+    code.add("};\n");
+
+    return MethodSpec.methodBuilder(methodName)
+        .addModifiers(Modifier.PUBLIC, Modifier.STATIC)
+        .returns(TypeName.BOOLEAN)
+        .addParameter(String.class, "name")
+        .addCode(code.build())
+        .build();
+  }
+
+  private static String getBaseModuleText(String path) {
+    try {
+      return Files.readString(Path.of(path));
+    } catch (IOException e) {
+      throw new UncheckedIOException(e);
+    }
+  }
+
+  private static Members buildMembers(String basePklPath) {
+    var text = getBaseModuleText(basePklPath);
+    var parsed = new Parser().parseModule(text);
+    var properties = new HashSet<String>();
+    var methods = new HashSet<String>();
+    for (var property : parsed.getProperties()) {
+      if (isLocal(property.getModifiers())) {
+        continue;
+      }
+      properties.add(property.getName().getValue());
+    }
+    for (var clazz : parsed.getClasses()) {
+      if (isLocal(clazz.getModifiers())) {
+        continue;
+      }
+      properties.add(clazz.getName().getValue());
+    }
+    for (var typealias : parsed.getTypeAliases()) {
+      if (isLocal(typealias.getModifiers())) {
+        continue;
+      }
+      properties.add(typealias.getName().getValue());
+    }
+    for (var method : parsed.getMethods()) {
+      if (isLocal(method.getModifiers())) {
+        continue;
+      }
+      methods.add(method.getName().getValue());
+    }
+    return new Members(properties, methods);
+  }
+
+  private static boolean isLocal(List<org.pkl.parser.syntax.Modifier> modifiers) {
+    return modifiers.stream().anyMatch((it) -> it.getValue() == ModifierValue.LOCAL);
+  }
+}

pkl-core/src/generator/java/org/pkl/core/generator/MemberRegistryGenerator.java

@@ -39,6 +39,7 @@ import javax.lang.model.element.Modifier;
 import javax.lang.model.element.PackageElement;
 import javax.lang.model.element.TypeElement;
 import javax.lang.model.type.TypeMirror;
+import org.jspecify.annotations.Nullable;
 
 /**
  * Generates a subclass of {@code org.pkl.core.stdlib.registry.ExternalMemberRegistry} for each
@@ -114,6 +115,7 @@ public final class MemberRegistryGenerator extends AbstractProcessor {
         Comparator.comparing(
                 (TypeElement element) -> {
                   var enclosingElement = element.getEnclosingElement();
+                  assert enclosingElement != null;
                   return enclosingElement.getKind() == ElementKind.PACKAGE
                       ? ""
                       : enclosingElement.getSimpleName().toString();
@@ -155,6 +157,7 @@ public final class MemberRegistryGenerator extends AbstractProcessor {
 
     for (var nodeClass : nodeClasses) {
       var enclosingClass = nodeClass.getEnclosingElement();
+      assert enclosingClass != null;
 
       var pklClassName = getAnnotatedPklName(enclosingClass);
       if (pklClassName == null) {
@@ -226,7 +229,7 @@ public final class MemberRegistryGenerator extends AbstractProcessor {
     writeJavaFile(REGISTRY_PACKAGE_NAME, registryFactoryClass.build());
   }
 
-  private String getAnnotatedPklName(Element element) {
+  private @Nullable String getAnnotatedPklName(Element element) {
     for (var annotation : element.getAnnotationMirrors()) {
       var annotationName = annotation.getAnnotationType().asElement().getSimpleName().toString();
 

pkl-core/src/generator/java/org/pkl/core/generator/package-info.java

@@ -0,0 +1,4 @@
+@NullMarked
+package org.pkl.core.generator;
+
+import org.jspecify.annotations.NullMarked;

pkl-core/src/main/java/org/pkl/core/Analyzer.java

@@ -22,9 +22,10 @@ import java.util.Collection;
 import java.util.List;
 import java.util.Map;
 import org.graalvm.polyglot.Context;
+import org.jspecify.annotations.Nullable;
 import org.pkl.core.evaluatorSettings.TraceMode;
 import org.pkl.core.http.HttpClient;
-import org.pkl.core.http.HttpClientInitException;
+import org.pkl.core.http.HttpClientException;
 import org.pkl.core.module.ModuleKeyFactory;
 import org.pkl.core.module.ProjectDependenciesManager;
 import org.pkl.core.packages.PackageLoadError;
@@ -36,7 +37,6 @@ import org.pkl.core.runtime.VmContext;
 import org.pkl.core.runtime.VmException;
 import org.pkl.core.runtime.VmImportAnalyzer;
 import org.pkl.core.runtime.VmUtils;
-import org.pkl.core.util.Nullable;
 
 /** Utility library for static analysis of Pkl programs. */
 public class Analyzer {
@@ -79,10 +79,7 @@ public class Analyzer {
       context.enter();
       var vmContext = VmContext.get(null);
       return VmImportAnalyzer.analyze(sources, vmContext);
-    } catch (SecurityManagerException
-        | IOException
-        | PackageLoadError
-        | HttpClientInitException e) {
+    } catch (SecurityManagerException | IOException | PackageLoadError | HttpClientException e) {
       throw new PklException(e.getMessage(), e);
     } catch (PklException err) {
       throw err;

pkl-core/src/main/java/org/pkl/core/CommandSpec.java

@@ -21,8 +21,21 @@ import java.util.Map;
 import java.util.Set;
 import java.util.function.BiFunction;
 import java.util.function.Function;
-import org.pkl.core.util.Nullable;
+import org.jspecify.annotations.Nullable;
 
+/**
+ * A specification parsed from a valid {@code pkl:Command} submodule.
+ *
+ * @param name the name of the (sub)command.
+ * @param helpText the CLI help text of the (sub)command.
+ * @param hidden whether the subcommand should be hidden from CLI help.
+ * @param noOp whether the (sub)command cannot be directly be executed (if true, it must have
+ *     subcommands).
+ * @param options specifications for the (sub)command's CLI options.
+ * @param subcommands specifications for the (sub)command's subcommands.
+ * @param apply a function that transforms command execution {@link State}, applying the parsed
+ *     options from this command.
+ */
 public record CommandSpec(
     String name,
     @Nullable String helpText,
@@ -32,43 +45,64 @@ public record CommandSpec(
     List<CommandSpec> subcommands,
     ApplyFunction apply) {
 
+  /** A command line option. */
   public sealed interface Option {
+    /** Primary name of the option with no type-specific punctuation. */
     String name();
 
+    /**
+     * All option names include type-specific punctuation (e.g. {@code -} for flags). If multiple,
+     * the primary name is listed last.
+     */
     String[] getNames();
 
+    /**
+     * An exception thrown by {@link Flag} and {@link Argument} transform functions to indicate that
+     * no value was provided for a required option.
+     */
     class MissingOption extends RuntimeException {
       public MissingOption() {}
     }
 
+    /**
+     * An exception thrown by {@link Flag} and {@link Argument} transform functions to indicate that
+     * a provided option value is not valid.
+     */
     class BadValue extends RuntimeException {
       public BadValue(String message) {
         super(message);
       }
 
+      /** Creates an exception for type mismatches. */
       public static BadValue invalid(String value, String type) {
         return new BadValue(String.format("%s is not a valid %s", value, type));
       }
 
+      /** Creates an exception for invalid key=value strings. */
       public static BadValue badKeyValue(String value) {
         return new BadValue(String.format("%s is not a valid key=value pair", value));
       }
 
+      /** Creates an exception for an invalid value with a set of known valid values. */
       public static BadValue invalidChoice(String value, List<String> choices) {
         return new BadValue(
             String.format(
                 "invalid choice: %s. (choose from %s)", value, String.join(", ", choices)));
       }
 
+      /** Creates an exception for an invalid value with a single known valid value. */
       public static BadValue invalidChoice(String value, String choice) {
         return new BadValue(String.format("invalid choice: %s. (choose from %s)", value, choice));
       }
     }
   }
 
+  /** Specifications for how shells should auto-complete an {@link Option}'s value */
   public abstract static sealed class CompletionCandidates {
+    /** Shells should auto-complete file paths for this option. */
     public static final CompletionCandidates PATH = new StaticCompletionCandidates();
 
+    /** Shells should auto-complete a set of static values for this option. */
     public static final class Fixed extends CompletionCandidates {
       private final Set<String> values;
 
@@ -76,6 +110,7 @@ public record CommandSpec(
         this.values = values;
       }
 
+      /** Specific static values offered by shell auto-complete. */
       public Set<String> getValues() {
         return values;
       }
@@ -84,12 +119,32 @@ public record CommandSpec(
     private static final class StaticCompletionCandidates extends CompletionCandidates {}
   }
 
+  /**
+   * A specification for a single CLI flag.
+   *
+   * <p>A flag's name becomes its CLI flag (prefixed with {@code --}) and may optionally have a
+   * single-character short name (prefixed with {@code -}). A flag is always followed by a single
+   * argument that becomes its value.
+   *
+   * @param name the primary (long) name of the flag.
+   * @param helpText the flag's CLI help text.
+   * @param showAsRequired determines whether the CLI help should show the flag as required.
+   * @param transformEach a function that transforms a flag's raw value (and working dir URI) into a
+   *     valid Pkl value.
+   * @param transformAll a function that transforms the list of parsed Pkl values for the flag into
+   *     a single final value.
+   * @param completionCandidates specifies if/how the shell should auto-complete the flag value.
+   * @param shortName the single-character abbreviated form of the flag.
+   * @param metavar the text used to substitute for the flag's value in CLI help text.
+   * @param hidden whether the flag should be hidden from CLI help.
+   * @param defaultValue a string representation of the flag's default value for use in CLI help.
+   */
   public record Flag(
       String name,
       @Nullable String helpText,
       boolean showAsRequired,
       BiFunction<String, URI, Object> transformEach,
-      BiFunction<List<Object>, URI, Object> transformAll,
+      BiFunction<List<Object>, URI, @Nullable Object> transformAll,
       @Nullable CompletionCandidates completionCandidates,
       @Nullable String shortName,
       String metavar,
@@ -104,6 +159,20 @@ public record CommandSpec(
     }
   }
 
+  /**
+   * A specification for a single on/off CLI flag.
+   *
+   * <p>A boolean flag's name becomes its CLI flag (prefixed with {@code --}) and may optionally
+   * have a single-character short name (prefixed with {@code -}). An additional name for the
+   * inverted form of the flag (prefixed with {@code --no-} is also added. A boolean flag accepts no
+   * value argument.
+   *
+   * @param name the primary (long) name of the flag.
+   * @param helpText the flag's CLI help text.
+   * @param shortName the single-character abbreviated form of the flag.
+   * @param hidden whether the flag should be hidden from CLI help.
+   * @param defaultValue a string representation of the flag's default value for use in CLI help.
+   */
   public record BooleanFlag(
       String name,
       @Nullable String helpText,
@@ -119,6 +188,18 @@ public record CommandSpec(
     }
   }
 
+  /**
+   * A specification for a single CLI flag that counts how many times it is used.
+   *
+   * <p>A counted flag's name becomes its CLI flag (prefixed with {@code --}) and may optionally
+   * have a single-character short name (prefixed with {@code -}). A counted flag accepts no value
+   * argument.
+   *
+   * @param name the primary (long) name of the flag.
+   * @param helpText the flag's CLI help text.
+   * @param shortName the single-character abbreviated form of the flag.
+   * @param hidden whether the flag should be hidden from CLI help.
+   */
   public record CountedFlag(
       String name, @Nullable String helpText, @Nullable String shortName, boolean hidden)
       implements Option {
@@ -130,11 +211,23 @@ public record CommandSpec(
     }
   }
 
+  /**
+   * A specification for a single CLI positional argument.
+   *
+   * @param name the name of the argument.
+   * @param helpText the argument's CLI help text.
+   * @param transformEach a function that transforms a argument's raw value (and working dir URI)
+   *     into a valid Pkl value.
+   * @param transformAll a function that transforms the list of parsed Pkl values for the argument
+   *     into a single final value.
+   * @param completionCandidates specifies if/how the shell should auto-complete the argument value.
+   * @param repeated whether the argument accepts multiple values.
+   */
   public record Argument(
       String name,
       @Nullable String helpText,
       BiFunction<String, URI, Object> transformEach,
-      BiFunction<List<Object>, URI, Object> transformAll,
+      BiFunction<List<Object>, URI, @Nullable Object> transformAll,
       @Nullable CompletionCandidates completionCandidates,
       boolean repeated)
       implements Option {
@@ -144,15 +237,31 @@ public record CommandSpec(
     }
   }
 
+  /** A function used to transform command {@link State} as arguments are parsed. */
   public interface ApplyFunction {
-    State apply(Map<String, Object> options, @Nullable State parent);
+    State apply(Map<String, @Nullable Object> options, @Nullable State parent);
   }
 
+  /**
+   * The execution state of a command.
+   *
+   * @param contents the opaque, implementation-defined state of the command. It must not be
+   *     directly inspected or modified outside of an {@link ApplyFunction}.
+   * @param reify an implementation-defined function that transforms some state contents to a {@link
+   *     Result}.
+   */
   public record State(Object contents, Function<Object, Result> reify) {
+    /** Evaluate the state to produce its output {@link Result}. */
     public Result evaluate() {
       return reify.apply(contents);
     }
   }
 
+  /**
+   * The result of executing a command.
+   *
+   * @param outputBytes the executed command's {@code output.bytes}.
+   * @param outputFiles the executed command's {@code output.files}.
+   */
   public record Result(byte[] outputBytes, Map<String, FileOutput> outputFiles) {}
 }

pkl-core/src/main/java/org/pkl/core/Composite.java

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -16,7 +16,7 @@
 package org.pkl.core;
 
 import java.util.Map;
-import org.pkl.core.util.Nullable;
+import org.jspecify.annotations.Nullable;
 
 /** A container of properties. */
 public interface Composite extends Value {

pkl-core/src/main/java/org/pkl/core/DataSize.java

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -19,8 +19,8 @@ import static org.pkl.core.DataSizeUnit.*;
 
 import java.io.Serial;
 import java.util.Objects;
+import org.jspecify.annotations.Nullable;
 import org.pkl.core.util.MathUtils;
-import org.pkl.core.util.Nullable;
 
 /** Java representation of a {@code pkl.base#DataSize} value. */
 public final class DataSize implements Value {

pkl-core/src/main/java/org/pkl/core/DataSizeUnit.java

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -15,7 +15,7 @@
  */
 package org.pkl.core;
 
-import org.pkl.core.util.Nullable;
+import org.jspecify.annotations.Nullable;
 
 /**
  * The unit of a {@link DataSize}. In Pkl, data size units are represented as String {@link

pkl-core/src/main/java/org/pkl/core/Duration.java

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -19,8 +19,8 @@ import static org.pkl.core.DurationUnit.*;
 
 import java.io.Serial;
 import java.util.Objects;
+import org.jspecify.annotations.Nullable;
 import org.pkl.core.util.DurationUtils;
-import org.pkl.core.util.Nullable;
 
 /** Java representation of a {@code pkl.base#Duration} value. */
 public final class Duration implements Value {

pkl-core/src/main/java/org/pkl/core/DurationUnit.java

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -17,7 +17,7 @@ package org.pkl.core;
 
 import java.time.temporal.ChronoUnit;
 import java.util.concurrent.TimeUnit;
-import org.pkl.core.util.Nullable;
+import org.jspecify.annotations.Nullable;
 
 /**
  * The unit of a {@link Duration}. In Pkl, duration units are represented as String {@link

pkl-core/src/main/java/org/pkl/core/EvaluatorBuilder.java

@@ -19,6 +19,7 @@ import com.oracle.truffle.api.TruffleOptions;
 import java.nio.file.Path;
 import java.util.*;
 import java.util.regex.Pattern;
+import org.jspecify.annotations.Nullable;
 import org.pkl.core.SecurityManagers.StandardBuilder;
 import org.pkl.core.evaluatorSettings.PklEvaluatorSettings.ExternalReader;
 import org.pkl.core.evaluatorSettings.TraceMode;
@@ -33,7 +34,6 @@ import org.pkl.core.resource.ResourceReader;
 import org.pkl.core.resource.ResourceReaders;
 import org.pkl.core.runtime.LoggerImpl;
 import org.pkl.core.util.IoUtils;
-import org.pkl.core.util.Nullable;
 
 /** A builder for an {@link Evaluator}. Can be reused to build multiple evaluators. */
 @SuppressWarnings({"UnusedReturnValue", "unused"})
@@ -56,7 +56,7 @@ public final class EvaluatorBuilder {
 
   private final Map<String, String> externalProperties = new HashMap<>();
 
-  private @Nullable java.time.Duration timeout;
+  private java.time.@Nullable Duration timeout;
 
   private @Nullable Path moduleCacheDir = IoUtils.getDefaultModuleCacheDir();
 
@@ -386,7 +386,7 @@ public final class EvaluatorBuilder {
   /**
    * Sets an evaluation timeout to be enforced by the {@link Evaluator}'s {@code evaluate} methods.
    */
-  public EvaluatorBuilder setTimeout(@Nullable java.time.Duration timeout) {
+  public EvaluatorBuilder setTimeout(java.time.@Nullable Duration timeout) {
     this.timeout = timeout;
     return this;
   }
@@ -488,7 +488,7 @@ public final class EvaluatorBuilder {
    */
   public EvaluatorBuilder applyFromProject(Project project) {
     this.dependencies = project.getDependencies();
-    var settings = project.getEvaluatorSettings();
+    var settings = project.getResolvedEvaluatorSettings();
     if (securityManager != null) {
       throw new IllegalStateException(
           "Cannot call both `setSecurityManager` and `setProject`, because both define security manager settings. Call `setProjectOnly` if the security manager is desired.");
@@ -557,6 +557,9 @@ public final class EvaluatorBuilder {
       if (settings.http().rewrites() != null) {
         httpClientBuilder.setRewrites(settings.http().rewrites());
       }
+      if (settings.http().headers() != null) {
+        httpClientBuilder.setHeaders(settings.http().headers());
+      }
       setHttpClient(httpClientBuilder.buildLazily());
     }
 

pkl-core/src/main/java/org/pkl/core/EvaluatorImpl.java

@@ -16,6 +16,8 @@
 package org.pkl.core;
 
 import java.io.IOException;
+import java.net.URI;
+import java.net.URISyntaxException;
 import java.nio.file.Path;
 import java.time.Duration;
 import java.util.Collection;
@@ -28,14 +30,17 @@ import java.util.function.Consumer;
 import java.util.function.Function;
 import java.util.function.Supplier;
 import org.graalvm.polyglot.Context;
+import org.jspecify.annotations.Nullable;
 import org.msgpack.core.MessageBufferPacker;
 import org.msgpack.core.MessagePack;
 import org.pkl.core.ast.ConstantValueNode;
 import org.pkl.core.ast.internal.ToStringNodeGen;
 import org.pkl.core.evaluatorSettings.TraceMode;
+import org.pkl.core.externalreader.ExternalReaderProcessException;
 import org.pkl.core.http.HttpClient;
 import org.pkl.core.module.ModuleKeyFactory;
 import org.pkl.core.module.ProjectDependenciesManager;
+import org.pkl.core.packages.PackageLoadError;
 import org.pkl.core.packages.PackageResolver;
 import org.pkl.core.project.DeclaredDependencies;
 import org.pkl.core.resource.ResourceReader;
@@ -56,7 +61,7 @@ import org.pkl.core.runtime.VmUtils;
 import org.pkl.core.runtime.VmValue;
 import org.pkl.core.runtime.VmValueRenderer;
 import org.pkl.core.util.ErrorMessages;
-import org.pkl.core.util.Nullable;
+import org.pkl.core.util.IoUtils;
 
 public final class EvaluatorImpl implements Evaluator {
   private final StackFrameTransformer frameTransformer;
@@ -69,6 +74,7 @@ public final class EvaluatorImpl implements Evaluator {
   private final BufferedLogger logger;
   private final PackageResolver packageResolver;
   private final VmValueRenderer vmValueRenderer = VmValueRenderer.singleLine(1000);
+  private final @Nullable URI projectFileUri;
   private @Nullable MessageBufferPacker messagePacker;
 
   public EvaluatorImpl(
@@ -94,6 +100,11 @@ public final class EvaluatorImpl implements Evaluator {
     moduleResolver = new ModuleResolver(factories);
     this.logger = new BufferedLogger(logger);
     packageResolver = PackageResolver.getInstance(securityManager, httpClient, moduleCacheDir);
+    if (projectDependencies != null) {
+      this.projectFileUri = projectDependencies.projectFileUri();
+    } else {
+      this.projectFileUri = null;
+    }
     polyglotContext =
         VmUtils.createContext(
             () -> {
@@ -296,7 +307,7 @@ public final class EvaluatorImpl implements Evaluator {
                   reservedFlagShortNames,
                   (fileOutput) -> new FileOutputImpl(this, fileOutput));
           run.accept(commandRunner.parse(module));
-          return null;
+          return true; // return value is not used; returning null would violate nullness
         });
   }
 
@@ -424,10 +435,37 @@ public final class EvaluatorImpl implements Evaluator {
     return evalResult;
   }
 
+  /** Resolve dependency notation URIs (e.g. `@foo/bar.pkl`) to its resolved absolute URI. */
+  private ModuleSource normalizeModuleSource(ModuleSource moduleSource) {
+    if (moduleSource.getContents() != null
+        || moduleSource.getUri().isAbsolute()
+        || !moduleSource.getUri().getPath().startsWith("@")) {
+      return moduleSource;
+    }
+    try {
+      if (projectFileUri != null) {
+        var moduleKey = moduleResolver.resolve(projectFileUri);
+        var uri = IoUtils.resolve(securityManager, moduleKey, moduleSource.getUri());
+        return ModuleSource.uri(uri);
+      } else {
+        throw new PackageLoadError("cannotResolveDependencyNoProject");
+      }
+    } catch (URISyntaxException e) {
+      // impossible condition
+      throw PklBugException.unreachableCode();
+    } catch (IOException e) {
+      throw new VmExceptionBuilder()
+          .evalError("ioErrorLoadingModule", moduleSource.getUri())
+          .build();
+    } catch (ExternalReaderProcessException | SecurityManagerException | PackageLoadError e) {
+      throw new VmExceptionBuilder().withCause(e).build();
+    }
+  }
+
   private <T> T doEvaluate(ModuleSource moduleSource, Function<VmTyped, T> doEvaluate) {
     return doEvaluate(
         () -> {
-          var moduleKey = moduleResolver.resolve(moduleSource);
+          var moduleKey = moduleResolver.resolve(normalizeModuleSource(moduleSource));
           var module = VmLanguage.get(null).loadModule(moduleKey);
           return doEvaluate.apply(module);
         });

pkl-core/src/main/java/org/pkl/core/Member.java

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -20,7 +20,7 @@ import java.io.Serializable;
 import java.util.List;
 import java.util.Objects;
 import java.util.Set;
-import org.pkl.core.util.Nullable;
+import org.jspecify.annotations.Nullable;
 
 /** Common base class for TypeAlias, PClass, PClass.Property, and PClass.Method. */
 public abstract class Member implements Serializable {

pkl-core/src/main/java/org/pkl/core/ModuleSchema.java

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -17,8 +17,8 @@ package org.pkl.core;
 
 import java.net.URI;
 import java.util.*;
+import org.jspecify.annotations.Nullable;
 import org.pkl.core.util.LateInit;
-import org.pkl.core.util.Nullable;
 
 /** Describes the property, method and class members of a module. */
 public final class ModuleSchema {

pkl-core/src/main/java/org/pkl/core/ModuleSource.java

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -18,8 +18,8 @@ package org.pkl.core;
 import java.io.File;
 import java.net.URI;
 import java.nio.file.Path;
+import org.jspecify.annotations.Nullable;
 import org.pkl.core.runtime.VmUtils;
-import org.pkl.core.util.Nullable;
 
 /**
  * A representation for a Pkl module's source URI, and optionally its source text.

pkl-core/src/main/java/org/pkl/core/PClass.java

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -17,7 +17,7 @@ package org.pkl.core;
 
 import java.io.Serial;
 import java.util.*;
-import org.pkl.core.util.Nullable;
+import org.jspecify.annotations.Nullable;
 
 /** Java representation of a {@code pkl.base#Class} value. */
 public final class PClass extends Member implements Value {

pkl-core/src/main/java/org/pkl/core/PClassInfo.java

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024-2025 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -22,7 +22,7 @@ import java.io.Serializable;
 import java.net.URI;
 import java.util.*;
 import java.util.regex.Pattern;
-import org.pkl.core.util.Nullable;
+import org.jspecify.annotations.Nullable;
 
 /** Information about a Pkl class and its Java representation. */
 @SuppressWarnings("rawtypes")

pkl-core/src/main/java/org/pkl/core/PModule.java

@@ -1,5 +1,5 @@
 /*
- * Copyright © 2024 Apple Inc. and the Pkl project authors. All rights reserved.
+ * Copyright © 2024-2026 Apple Inc. and the Pkl project authors. All rights reserved.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -19,7 +19,7 @@ import java.io.Serial;
 import java.net.URI;
 import java.util.Map;
 import java.util.Objects;
-import org.pkl.core.util.Nullable;
+import org.jspecify.annotations.Nullable;
 
 /** Java representation of a Pkl module. */
 public final class PModule extends PObject {