From 5e6e35d608f64b7bd376f14ceb1ea4177848d0c8 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Wed, 5 Nov 2025 13:52:25 +0000
Subject: [PATCH 01/32] Initial plan


From 0e5cdb82de528100192a249de71361d274371c2e Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Wed, 5 Nov 2025 14:03:39 +0000
Subject: [PATCH 02/32] feat: add automated package update workflow

Implement GitHub Action workflow that:
- Runs weekly to check for Terraform provider updates
- Queries OpenTofu registry for latest versions
- Updates package.json and CHANGELOG.md automatically
- Creates Nx release plan
- Opens PR with all updates

Co-authored-by: hckhanh <6380436+hckhanh@users.noreply.github.com>
---
 .github/scripts/README.md             |  52 ++++++
 .github/scripts/check-updates.js      | 235 ++++++++++++++++++++++++++
 .github/workflows/update-packages.yml |  65 +++++++
 3 files changed, 352 insertions(+)
 create mode 100644 .github/scripts/README.md
 create mode 100755 .github/scripts/check-updates.js
 create mode 100644 .github/workflows/update-packages.yml

diff --git a/.github/scripts/README.md b/.github/scripts/README.md
new file mode 100644
index 0000000..bfee5ce
--- /dev/null
+++ b/.github/scripts/README.md
@@ -0,0 +1,52 @@
+# Automation Scripts
+
+This directory contains automation scripts for maintaining the Pulumi provider packages.
+
+## check-updates.js
+
+This script automatically checks for updates to Terraform providers and updates the corresponding Pulumi packages.
+
+### How it works
+
+1. **Scans packages**: Iterates through all packages in the `packages/` directory
+2. **Extracts provider info**: Decodes the base64-encoded parameterization value to get the current provider version and registry URL
+3. **Checks for updates**: Queries the OpenTofu registry API for the latest version of each provider
+4. **Fetches changelogs**: Attempts to fetch release notes from GitHub if available
+5. **Updates packages**: For packages with newer versions available:
+   - Updates the `package.json` with new parameterization value
+   - Adds an entry to `CHANGELOG.md` with release notes or a generic update message
+6. **Creates release plan**: Uses `nx release plan` to prepare versioning for updated packages
+7. **Stages changes**: Adds all changes to git staging area
+
+### Usage
+
+Manual execution:
+```bash
+node .github/scripts/check-updates.js
+```
+
+Automated execution via GitHub Actions:
+- Runs weekly on Mondays at 00:00 UTC
+- Can be triggered manually via workflow dispatch
+
+### Output
+
+The script produces:
+- Updated `package.json` files with new provider versions
+- Updated `CHANGELOG.md` files with release information
+- Nx release plan files
+- GitHub Actions outputs for PR creation
+
+### Environment Variables
+
+When running in GitHub Actions, the script uses:
+- `GITHUB_OUTPUT`: To pass update information to subsequent workflow steps
+
+### API Endpoints
+
+- **OpenTofu Registry**: `https://registry.opentofu.org/v1/providers/{namespace}/{name}/versions`
+- **GitHub Releases**: `https://api.github.com/repos/{namespace}/terraform-provider-{name}/releases/tags/v{version}`
+
+### Error Handling
+
+The script continues processing other packages if one fails, logging errors to console. It only exits with a non-zero status if the release plan creation fails.
diff --git a/.github/scripts/check-updates.js b/.github/scripts/check-updates.js
new file mode 100755
index 0000000..01eaba3
--- /dev/null
+++ b/.github/scripts/check-updates.js
@@ -0,0 +1,235 @@
+#!/usr/bin/env node
+
+const fs = require('node:fs');
+const path = require('node:path');
+const { execSync } = require('node:child_process');
+
+/**
+ * Fetches the latest version of a Terraform provider from the OpenTofu registry
+ * @param {string} namespace - Provider namespace
+ * @param {string} name - Provider name
+ * @returns {Promise<string|null>} Latest version or null if not found
+ */
+async function getLatestProviderVersion(namespace, name) {
+  try {
+    const registryUrl = `https://registry.opentofu.org/v1/providers/${namespace}/${name}/versions`;
+    const response = await fetch(registryUrl);
+    
+    if (!response.ok) {
+      console.error(`Failed to fetch versions for ${namespace}/${name}: ${response.status}`);
+      return null;
+    }
+    
+    const data = await response.json();
+    
+    if (!data.versions || data.versions.length === 0) {
+      console.error(`No versions found for ${namespace}/${name}`);
+      return null;
+    }
+    
+    // Return the latest version (versions are sorted by the API)
+    return data.versions[0].version;
+  } catch (error) {
+    console.error(`Error fetching version for ${namespace}/${name}:`, error);
+    return null;
+  }
+}
+
+/**
+ * Fetches changelog for a specific version of a provider
+ * @param {string} namespace - Provider namespace
+ * @param {string} name - Provider name
+ * @param {string} version - Version to fetch changelog for
+ * @returns {Promise<string|null>} Changelog content or null
+ */
+async function getProviderChangelog(namespace, name, version) {
+  try {
+    // Try to fetch from GitHub releases
+    const githubUrl = `https://api.github.com/repos/${namespace}/terraform-provider-${name}/releases/tags/v${version}`;
+    const response = await fetch(githubUrl, {
+      headers: {
+        'Accept': 'application/vnd.github+json',
+        'User-Agent': 'pulumi-any-terraform-updater'
+      }
+    });
+    
+    if (response.ok) {
+      const data = await response.json();
+      return data.body || null;
+    }
+    
+    return null;
+  } catch (error) {
+    console.error(`Error fetching changelog for ${namespace}/${name}@${version}:`, error);
+    return null;
+  }
+}
+
+/**
+ * Updates a package's provider version
+ * @param {string} packagePath - Path to the package
+ * @param {object} currentProvider - Current provider information
+ * @param {string} newVersion - New version to update to
+ * @param {string|null} changelog - Changelog content
+ */
+function updatePackage(packagePath, currentProvider, newVersion, changelog) {
+  const packageJsonPath = path.join(packagePath, 'package.json');
+  const packageJson = JSON.parse(fs.readFileSync(packageJsonPath, 'utf8'));
+  
+  // Update parameterization
+  const newParamValue = {
+    remote: {
+      url: currentProvider.url,
+      version: newVersion
+    }
+  };
+  
+  const encodedParam = Buffer.from(JSON.stringify(newParamValue)).toString('base64');
+  packageJson.pulumi.parameterization.value = encodedParam;
+  packageJson.pulumi.parameterization.version = newVersion;
+  
+  // Write updated package.json
+  fs.writeFileSync(packageJsonPath, JSON.stringify(packageJson, null, 2) + '\n');
+  
+  // Update CHANGELOG.md
+  const changelogPath = path.join(packagePath, 'CHANGELOG.md');
+  let changelogContent = '';
+  
+  if (fs.existsSync(changelogPath)) {
+    changelogContent = fs.readFileSync(changelogPath, 'utf8');
+  }
+  
+  const date = new Date().toISOString().split('T')[0];
+  const changelogEntry = changelog 
+    ? `## ${newVersion} (${date})\n\n${changelog}\n\n`
+    : `## ${newVersion} (${date})\n\nUpdate to version ${newVersion}\n\n`;
+  
+  // Prepend new entry at the beginning (before the first ## entry)
+  const versionMatch = changelogContent.match(/^##\s/m);
+  if (versionMatch) {
+    const insertPos = versionMatch.index;
+    changelogContent = changelogContent.slice(0, insertPos) + 
+                      changelogEntry + 
+                      changelogContent.slice(insertPos);
+  } else {
+    // No version entries yet, just append to the end
+    changelogContent = changelogContent + '\n' + changelogEntry;
+  }
+  
+  fs.writeFileSync(changelogPath, changelogContent);
+  
+  console.log(`Updated ${packageJson.name} to version ${newVersion}`);
+}
+
+/**
+ * Main function to check and update packages
+ */
+async function main() {
+  const packagesDir = path.join(process.cwd(), 'packages');
+  const packages = fs.readdirSync(packagesDir).filter(f => {
+    const stat = fs.statSync(path.join(packagesDir, f));
+    return stat.isDirectory();
+  });
+  
+  const updates = [];
+  let updateSummary = '';
+  
+  for (const pkg of packages) {
+    const packagePath = path.join(packagesDir, pkg);
+    const packageJsonPath = path.join(packagePath, 'package.json');
+    
+    if (!fs.existsSync(packageJsonPath)) {
+      continue;
+    }
+    
+    const packageJson = JSON.parse(fs.readFileSync(packageJsonPath, 'utf8'));
+    
+    if (!packageJson.pulumi?.parameterization?.value) {
+      console.log(`Skipping ${pkg}: no parameterization found`);
+      continue;
+    }
+    
+    // Decode current provider info
+    const decodedParam = Buffer.from(packageJson.pulumi.parameterization.value, 'base64').toString('utf8');
+    const currentProvider = JSON.parse(decodedParam).remote;
+    
+    // Parse namespace and name from URL
+    const urlParts = currentProvider.url.split('/');
+    const namespace = urlParts[urlParts.length - 2];
+    const name = urlParts[urlParts.length - 1];
+    
+    console.log(`Checking ${pkg} (${namespace}/${name})...`);
+    console.log(`  Current version: ${currentProvider.version}`);
+    
+    // Fetch latest version
+    const latestVersion = await getLatestProviderVersion(namespace, name);
+    
+    if (!latestVersion) {
+      console.log(`  Could not fetch latest version`);
+      continue;
+    }
+    
+    console.log(`  Latest version: ${latestVersion}`);
+    
+    if (latestVersion === currentProvider.version) {
+      console.log(`  Already up to date`);
+      continue;
+    }
+    
+    // Fetch changelog
+    const changelog = await getProviderChangelog(namespace, name, latestVersion);
+    
+    // Update package
+    updatePackage(packagePath, currentProvider, latestVersion, changelog);
+    
+    updates.push({
+      name: packageJson.name,
+      oldVersion: currentProvider.version,
+      newVersion: latestVersion,
+      namespace,
+      providerName: name
+    });
+    
+    updateSummary += `- **${packageJson.name}**: ${currentProvider.version} → ${latestVersion}\n`;
+  }
+  
+  if (updates.length > 0) {
+    console.log(`\nUpdated ${updates.length} package(s)`);
+    
+    // Create release plan
+    const releaseMessage = updates.map(u => 
+      `Update ${u.name} from ${u.oldVersion} to ${u.newVersion}`
+    ).join('\n\n');
+    
+    try {
+      execSync(`pnpm nx release plan --message="${releaseMessage}"`, {
+        stdio: 'inherit',
+        cwd: process.cwd()
+      });
+      
+      // Stage all changes
+      execSync('git add .', { stdio: 'inherit', cwd: process.cwd() });
+      
+      console.log('\nChanges staged successfully');
+    } catch (error) {
+      console.error('Error creating release plan:', error);
+      process.exit(1);
+    }
+    
+    // Set outputs for GitHub Actions
+    if (process.env.GITHUB_OUTPUT) {
+      fs.appendFileSync(process.env.GITHUB_OUTPUT, `has_updates=true\n`);
+      fs.appendFileSync(process.env.GITHUB_OUTPUT, `update_summary=${updateSummary}\n`);
+    }
+  } else {
+    console.log('\nNo updates available');
+    if (process.env.GITHUB_OUTPUT) {
+      fs.appendFileSync(process.env.GITHUB_OUTPUT, `has_updates=false\n`);
+    }
+  }
+}
+
+main().catch(error => {
+  console.error('Error:', error);
+  process.exit(1);
+});
diff --git a/.github/workflows/update-packages.yml b/.github/workflows/update-packages.yml
new file mode 100644
index 0000000..f700835
--- /dev/null
+++ b/.github/workflows/update-packages.yml
@@ -0,0 +1,65 @@
+name: Update Packages
+
+on:
+  workflow_dispatch:
+  schedule:
+    # Run weekly on Monday at 00:00 UTC
+    - cron: '0 0 * * 1'
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  check-updates:
+    name: Check for Package Updates
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          fetch-depth: 0
+          filter: tree:0
+
+      - name: Setup toolchains
+        uses: jdx/mise-action@be3be2260bc02bc3fbf94c5e2fed8b7964baf074 # v3.4.0
+
+      - name: Setup Socket Firewall
+        uses: SocketDev/action@4337a545deecc20f19a909e52db7a2f6ba292f42 # v1.2.0
+        with:
+          mode: firewall
+
+      - name: Install dependencies
+        run: sfw pnpm install
+
+      - name: Configure Git
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+
+      - name: Check for updates
+        id: check
+        run: |
+          node .github/scripts/check-updates.js
+
+      - name: Create Pull Request
+        if: steps.check.outputs.has_updates == 'true'
+        uses: peter-evans/create-pull-request@c5a7806660adbe173f04e3e038b0ccdcd758773c # v7.0.5
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          commit-message: 'chore: update terraform providers'
+          title: 'chore: Update Terraform providers'
+          body: |
+            This PR updates Terraform providers to their latest versions.
+            
+            ## Updates
+            
+            ${{ steps.check.outputs.update_summary }}
+            
+            ---
+            *This PR was automatically generated by the update-packages workflow*
+          branch: automated/update-providers
+          delete-branch: true
+          labels: |
+            automated
+            dependencies

From 48b4a514633947ff68e7efe2e0dbc55276a83a3c Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Wed, 5 Nov 2025 14:04:51 +0000
Subject: [PATCH 03/32] style: apply prettier formatting to automation files

Co-authored-by: hckhanh <6380436+hckhanh@users.noreply.github.com>
---
 .github/scripts/README.md             |   4 +
 .github/scripts/check-updates.js      | 278 ++++++++++++++------------
 .github/workflows/update-packages.yml |   6 +-
 3 files changed, 153 insertions(+), 135 deletions(-)

diff --git a/.github/scripts/README.md b/.github/scripts/README.md
index bfee5ce..56c5b47 100644
--- a/.github/scripts/README.md
+++ b/.github/scripts/README.md
@@ -21,17 +21,20 @@ This script automatically checks for updates to Terraform providers and updates
 ### Usage
 
 Manual execution:
+
 ```bash
 node .github/scripts/check-updates.js
 ```
 
 Automated execution via GitHub Actions:
+
 - Runs weekly on Mondays at 00:00 UTC
 - Can be triggered manually via workflow dispatch
 
 ### Output
 
 The script produces:
+
 - Updated `package.json` files with new provider versions
 - Updated `CHANGELOG.md` files with release information
 - Nx release plan files
@@ -40,6 +43,7 @@ The script produces:
 ### Environment Variables
 
 When running in GitHub Actions, the script uses:
+
 - `GITHUB_OUTPUT`: To pass update information to subsequent workflow steps
 
 ### API Endpoints
diff --git a/.github/scripts/check-updates.js b/.github/scripts/check-updates.js
index 01eaba3..a6c53ea 100755
--- a/.github/scripts/check-updates.js
+++ b/.github/scripts/check-updates.js
@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 
-const fs = require('node:fs');
-const path = require('node:path');
-const { execSync } = require('node:child_process');
+const fs = require('node:fs')
+const path = require('node:path')
+const { execSync } = require('node:child_process')
 
 /**
  * Fetches the latest version of a Terraform provider from the OpenTofu registry
@@ -12,26 +12,28 @@ const { execSync } = require('node:child_process');
  */
 async function getLatestProviderVersion(namespace, name) {
   try {
-    const registryUrl = `https://registry.opentofu.org/v1/providers/${namespace}/${name}/versions`;
-    const response = await fetch(registryUrl);
-    
+    const registryUrl = `https://registry.opentofu.org/v1/providers/${namespace}/${name}/versions`
+    const response = await fetch(registryUrl)
+
     if (!response.ok) {
-      console.error(`Failed to fetch versions for ${namespace}/${name}: ${response.status}`);
-      return null;
+      console.error(
+        `Failed to fetch versions for ${namespace}/${name}: ${response.status}`,
+      )
+      return null
     }
-    
-    const data = await response.json();
-    
+
+    const data = await response.json()
+
     if (!data.versions || data.versions.length === 0) {
-      console.error(`No versions found for ${namespace}/${name}`);
-      return null;
+      console.error(`No versions found for ${namespace}/${name}`)
+      return null
     }
-    
+
     // Return the latest version (versions are sorted by the API)
-    return data.versions[0].version;
+    return data.versions[0].version
   } catch (error) {
-    console.error(`Error fetching version for ${namespace}/${name}:`, error);
-    return null;
+    console.error(`Error fetching version for ${namespace}/${name}:`, error)
+    return null
   }
 }
 
@@ -45,23 +47,26 @@ async function getLatestProviderVersion(namespace, name) {
 async function getProviderChangelog(namespace, name, version) {
   try {
     // Try to fetch from GitHub releases
-    const githubUrl = `https://api.github.com/repos/${namespace}/terraform-provider-${name}/releases/tags/v${version}`;
+    const githubUrl = `https://api.github.com/repos/${namespace}/terraform-provider-${name}/releases/tags/v${version}`
     const response = await fetch(githubUrl, {
       headers: {
-        'Accept': 'application/vnd.github+json',
-        'User-Agent': 'pulumi-any-terraform-updater'
-      }
-    });
-    
+        Accept: 'application/vnd.github+json',
+        'User-Agent': 'pulumi-any-terraform-updater',
+      },
+    })
+
     if (response.ok) {
-      const data = await response.json();
-      return data.body || null;
+      const data = await response.json()
+      return data.body || null
     }
-    
-    return null;
+
+    return null
   } catch (error) {
-    console.error(`Error fetching changelog for ${namespace}/${name}@${version}:`, error);
-    return null;
+    console.error(
+      `Error fetching changelog for ${namespace}/${name}@${version}:`,
+      error,
+    )
+    return null
   }
 }
 
@@ -73,163 +78,172 @@ async function getProviderChangelog(namespace, name, version) {
  * @param {string|null} changelog - Changelog content
  */
 function updatePackage(packagePath, currentProvider, newVersion, changelog) {
-  const packageJsonPath = path.join(packagePath, 'package.json');
-  const packageJson = JSON.parse(fs.readFileSync(packageJsonPath, 'utf8'));
-  
+  const packageJsonPath = path.join(packagePath, 'package.json')
+  const packageJson = JSON.parse(fs.readFileSync(packageJsonPath, 'utf8'))
+
   // Update parameterization
   const newParamValue = {
     remote: {
       url: currentProvider.url,
-      version: newVersion
-    }
-  };
-  
-  const encodedParam = Buffer.from(JSON.stringify(newParamValue)).toString('base64');
-  packageJson.pulumi.parameterization.value = encodedParam;
-  packageJson.pulumi.parameterization.version = newVersion;
-  
+      version: newVersion,
+    },
+  }
+
+  const encodedParam = Buffer.from(JSON.stringify(newParamValue)).toString(
+    'base64',
+  )
+  packageJson.pulumi.parameterization.value = encodedParam
+  packageJson.pulumi.parameterization.version = newVersion
+
   // Write updated package.json
-  fs.writeFileSync(packageJsonPath, JSON.stringify(packageJson, null, 2) + '\n');
-  
+  fs.writeFileSync(packageJsonPath, JSON.stringify(packageJson, null, 2) + '\n')
+
   // Update CHANGELOG.md
-  const changelogPath = path.join(packagePath, 'CHANGELOG.md');
-  let changelogContent = '';
-  
+  const changelogPath = path.join(packagePath, 'CHANGELOG.md')
+  let changelogContent = ''
+
   if (fs.existsSync(changelogPath)) {
-    changelogContent = fs.readFileSync(changelogPath, 'utf8');
+    changelogContent = fs.readFileSync(changelogPath, 'utf8')
   }
-  
-  const date = new Date().toISOString().split('T')[0];
-  const changelogEntry = changelog 
+
+  const date = new Date().toISOString().split('T')[0]
+  const changelogEntry = changelog
     ? `## ${newVersion} (${date})\n\n${changelog}\n\n`
-    : `## ${newVersion} (${date})\n\nUpdate to version ${newVersion}\n\n`;
-  
+    : `## ${newVersion} (${date})\n\nUpdate to version ${newVersion}\n\n`
+
   // Prepend new entry at the beginning (before the first ## entry)
-  const versionMatch = changelogContent.match(/^##\s/m);
+  const versionMatch = changelogContent.match(/^##\s/m)
   if (versionMatch) {
-    const insertPos = versionMatch.index;
-    changelogContent = changelogContent.slice(0, insertPos) + 
-                      changelogEntry + 
-                      changelogContent.slice(insertPos);
+    const insertPos = versionMatch.index
+    changelogContent =
+      changelogContent.slice(0, insertPos) +
+      changelogEntry +
+      changelogContent.slice(insertPos)
   } else {
     // No version entries yet, just append to the end
-    changelogContent = changelogContent + '\n' + changelogEntry;
+    changelogContent = changelogContent + '\n' + changelogEntry
   }
-  
-  fs.writeFileSync(changelogPath, changelogContent);
-  
-  console.log(`Updated ${packageJson.name} to version ${newVersion}`);
+
+  fs.writeFileSync(changelogPath, changelogContent)
+
+  console.log(`Updated ${packageJson.name} to version ${newVersion}`)
 }
 
 /**
  * Main function to check and update packages
  */
 async function main() {
-  const packagesDir = path.join(process.cwd(), 'packages');
-  const packages = fs.readdirSync(packagesDir).filter(f => {
-    const stat = fs.statSync(path.join(packagesDir, f));
-    return stat.isDirectory();
-  });
-  
-  const updates = [];
-  let updateSummary = '';
-  
+  const packagesDir = path.join(process.cwd(), 'packages')
+  const packages = fs.readdirSync(packagesDir).filter((f) => {
+    const stat = fs.statSync(path.join(packagesDir, f))
+    return stat.isDirectory()
+  })
+
+  const updates = []
+  let updateSummary = ''
+
   for (const pkg of packages) {
-    const packagePath = path.join(packagesDir, pkg);
-    const packageJsonPath = path.join(packagePath, 'package.json');
-    
+    const packagePath = path.join(packagesDir, pkg)
+    const packageJsonPath = path.join(packagePath, 'package.json')
+
     if (!fs.existsSync(packageJsonPath)) {
-      continue;
+      continue
     }
-    
-    const packageJson = JSON.parse(fs.readFileSync(packageJsonPath, 'utf8'));
-    
+
+    const packageJson = JSON.parse(fs.readFileSync(packageJsonPath, 'utf8'))
+
     if (!packageJson.pulumi?.parameterization?.value) {
-      console.log(`Skipping ${pkg}: no parameterization found`);
-      continue;
+      console.log(`Skipping ${pkg}: no parameterization found`)
+      continue
     }
-    
+
     // Decode current provider info
-    const decodedParam = Buffer.from(packageJson.pulumi.parameterization.value, 'base64').toString('utf8');
-    const currentProvider = JSON.parse(decodedParam).remote;
-    
+    const decodedParam = Buffer.from(
+      packageJson.pulumi.parameterization.value,
+      'base64',
+    ).toString('utf8')
+    const currentProvider = JSON.parse(decodedParam).remote
+
     // Parse namespace and name from URL
-    const urlParts = currentProvider.url.split('/');
-    const namespace = urlParts[urlParts.length - 2];
-    const name = urlParts[urlParts.length - 1];
-    
-    console.log(`Checking ${pkg} (${namespace}/${name})...`);
-    console.log(`  Current version: ${currentProvider.version}`);
-    
+    const urlParts = currentProvider.url.split('/')
+    const namespace = urlParts[urlParts.length - 2]
+    const name = urlParts[urlParts.length - 1]
+
+    console.log(`Checking ${pkg} (${namespace}/${name})...`)
+    console.log(`  Current version: ${currentProvider.version}`)
+
     // Fetch latest version
-    const latestVersion = await getLatestProviderVersion(namespace, name);
-    
+    const latestVersion = await getLatestProviderVersion(namespace, name)
+
     if (!latestVersion) {
-      console.log(`  Could not fetch latest version`);
-      continue;
+      console.log(`  Could not fetch latest version`)
+      continue
     }
-    
-    console.log(`  Latest version: ${latestVersion}`);
-    
+
+    console.log(`  Latest version: ${latestVersion}`)
+
     if (latestVersion === currentProvider.version) {
-      console.log(`  Already up to date`);
-      continue;
+      console.log(`  Already up to date`)
+      continue
     }
-    
+
     // Fetch changelog
-    const changelog = await getProviderChangelog(namespace, name, latestVersion);
-    
+    const changelog = await getProviderChangelog(namespace, name, latestVersion)
+
     // Update package
-    updatePackage(packagePath, currentProvider, latestVersion, changelog);
-    
+    updatePackage(packagePath, currentProvider, latestVersion, changelog)
+
     updates.push({
       name: packageJson.name,
       oldVersion: currentProvider.version,
       newVersion: latestVersion,
       namespace,
-      providerName: name
-    });
-    
-    updateSummary += `- **${packageJson.name}**: ${currentProvider.version} → ${latestVersion}\n`;
+      providerName: name,
+    })
+
+    updateSummary += `- **${packageJson.name}**: ${currentProvider.version} → ${latestVersion}\n`
   }
-  
+
   if (updates.length > 0) {
-    console.log(`\nUpdated ${updates.length} package(s)`);
-    
+    console.log(`\nUpdated ${updates.length} package(s)`)
+
     // Create release plan
-    const releaseMessage = updates.map(u => 
-      `Update ${u.name} from ${u.oldVersion} to ${u.newVersion}`
-    ).join('\n\n');
-    
+    const releaseMessage = updates
+      .map((u) => `Update ${u.name} from ${u.oldVersion} to ${u.newVersion}`)
+      .join('\n\n')
+
     try {
       execSync(`pnpm nx release plan --message="${releaseMessage}"`, {
         stdio: 'inherit',
-        cwd: process.cwd()
-      });
-      
+        cwd: process.cwd(),
+      })
+
       // Stage all changes
-      execSync('git add .', { stdio: 'inherit', cwd: process.cwd() });
-      
-      console.log('\nChanges staged successfully');
+      execSync('git add .', { stdio: 'inherit', cwd: process.cwd() })
+
+      console.log('\nChanges staged successfully')
     } catch (error) {
-      console.error('Error creating release plan:', error);
-      process.exit(1);
+      console.error('Error creating release plan:', error)
+      process.exit(1)
     }
-    
+
     // Set outputs for GitHub Actions
     if (process.env.GITHUB_OUTPUT) {
-      fs.appendFileSync(process.env.GITHUB_OUTPUT, `has_updates=true\n`);
-      fs.appendFileSync(process.env.GITHUB_OUTPUT, `update_summary=${updateSummary}\n`);
+      fs.appendFileSync(process.env.GITHUB_OUTPUT, `has_updates=true\n`)
+      fs.appendFileSync(
+        process.env.GITHUB_OUTPUT,
+        `update_summary=${updateSummary}\n`,
+      )
     }
   } else {
-    console.log('\nNo updates available');
+    console.log('\nNo updates available')
     if (process.env.GITHUB_OUTPUT) {
-      fs.appendFileSync(process.env.GITHUB_OUTPUT, `has_updates=false\n`);
+      fs.appendFileSync(process.env.GITHUB_OUTPUT, `has_updates=false\n`)
     }
   }
 }
 
-main().catch(error => {
-  console.error('Error:', error);
-  process.exit(1);
-});
+main().catch((error) => {
+  console.error('Error:', error)
+  process.exit(1)
+})
diff --git a/.github/workflows/update-packages.yml b/.github/workflows/update-packages.yml
index f700835..eab1b7b 100644
--- a/.github/workflows/update-packages.yml
+++ b/.github/workflows/update-packages.yml
@@ -51,11 +51,11 @@ jobs:
           title: 'chore: Update Terraform providers'
           body: |
             This PR updates Terraform providers to their latest versions.
-            
+
             ## Updates
-            
+
             ${{ steps.check.outputs.update_summary }}
-            
+
             ---
             *This PR was automatically generated by the update-packages workflow*
           branch: automated/update-providers

From a77cbe3e2240a836daeb66057cb004405e34a14d Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Wed, 5 Nov 2025 14:08:09 +0000
Subject: [PATCH 04/32] fix: use spawnSync to prevent command injection in
 release plan

Replace execSync with spawnSync for better security when passing
release messages to nx release plan command. This prevents potential
command injection vulnerabilities.

Co-authored-by: hckhanh <6380436+hckhanh@users.noreply.github.com>
---
 .github/scripts/check-updates.js | 19 ++++++++++++++-----
 1 file changed, 14 insertions(+), 5 deletions(-)

diff --git a/.github/scripts/check-updates.js b/.github/scripts/check-updates.js
index a6c53ea..9314b51 100755
--- a/.github/scripts/check-updates.js
+++ b/.github/scripts/check-updates.js
@@ -2,7 +2,7 @@
 
 const fs = require('node:fs')
 const path = require('node:path')
-const { execSync } = require('node:child_process')
+const { execSync, spawnSync } = require('node:child_process')
 
 /**
  * Fetches the latest version of a Terraform provider from the OpenTofu registry
@@ -213,10 +213,19 @@ async function main() {
       .join('\n\n')
 
     try {
-      execSync(`pnpm nx release plan --message="${releaseMessage}"`, {
-        stdio: 'inherit',
-        cwd: process.cwd(),
-      })
+      // Use spawnSync to avoid command injection
+      const result = spawnSync(
+        'pnpm',
+        ['nx', 'release', 'plan', `--message=${releaseMessage}`],
+        {
+          stdio: 'inherit',
+          cwd: process.cwd(),
+        },
+      )
+
+      if (result.status !== 0) {
+        throw new Error(`nx release plan failed with status ${result.status}`)
+      }
 
       // Stage all changes
       execSync('git add .', { stdio: 'inherit', cwd: process.cwd() })

From c77ab6acc0b46363ca9c248f837a8af850e8d632 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Wed, 5 Nov 2025 14:11:56 +0000
Subject: [PATCH 05/32] fix: improve security of automation script

- Use spawnSync for git commands instead of execSync
- Properly escape output variables for GitHub Actions
- Prevent potential injection in GITHUB_OUTPUT

Co-authored-by: hckhanh <6380436+hckhanh@users.noreply.github.com>
---
 .github/scripts/check-updates.js | 17 +++++++++++++++--
 1 file changed, 15 insertions(+), 2 deletions(-)

diff --git a/.github/scripts/check-updates.js b/.github/scripts/check-updates.js
index 9314b51..ebf120f 100755
--- a/.github/scripts/check-updates.js
+++ b/.github/scripts/check-updates.js
@@ -228,7 +228,14 @@ async function main() {
       }
 
       // Stage all changes
-      execSync('git add .', { stdio: 'inherit', cwd: process.cwd() })
+      const gitResult = spawnSync('git', ['add', '.'], {
+        stdio: 'inherit',
+        cwd: process.cwd(),
+      })
+
+      if (gitResult.status !== 0) {
+        throw new Error(`git add failed with status ${gitResult.status}`)
+      }
 
       console.log('\nChanges staged successfully')
     } catch (error) {
@@ -238,10 +245,16 @@ async function main() {
 
     // Set outputs for GitHub Actions
     if (process.env.GITHUB_OUTPUT) {
+      // Escape newlines and backslashes for multiline output
+      const escapedSummary = updateSummary
+        .replace(/\\/g, '\\\\')
+        .replace(/\n/g, '\\n')
+        .replace(/\r/g, '\\r')
+
       fs.appendFileSync(process.env.GITHUB_OUTPUT, `has_updates=true\n`)
       fs.appendFileSync(
         process.env.GITHUB_OUTPUT,
-        `update_summary=${updateSummary}\n`,
+        `update_summary=${escapedSummary}\n`,
       )
     }
   } else {

From 53e48b9525a2b0b6848bf0408cc9ce1181f5daaf Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Wed, 5 Nov 2025 14:14:52 +0000
Subject: [PATCH 06/32] feat: use pulumi package add to generate updated
 packages

- Create temporary Pulumi project for each update
- Run pulumi package add with terraform-provider
- Copy generated TypeScript files and other files to target package
- Only copy pulumi property from generated package.json
- Skip copying README.md
- Handle multiple packages in sdks folder structure
- Clean up temporary directories after processing

Co-authored-by: hckhanh <6380436+hckhanh@users.noreply.github.com>
---
 .github/scripts/check-updates.js | 244 +++++++++++++++++++++++++------
 1 file changed, 202 insertions(+), 42 deletions(-)

diff --git a/.github/scripts/check-updates.js b/.github/scripts/check-updates.js
index ebf120f..d3e0dff 100755
--- a/.github/scripts/check-updates.js
+++ b/.github/scripts/check-updates.js
@@ -3,6 +3,7 @@
 const fs = require('node:fs')
 const path = require('node:path')
 const { execSync, spawnSync } = require('node:child_process')
+const os = require('node:os')
 
 /**
  * Fetches the latest version of a Terraform provider from the OpenTofu registry
@@ -71,62 +72,214 @@ async function getProviderChangelog(namespace, name, version) {
 }
 
 /**
- * Updates a package's provider version
+ * Recursively copy directory contents
+ * @param {string} src - Source directory
+ * @param {string} dest - Destination directory
+ * @param {string[]} excludeFiles - Files to exclude (e.g., ['README.md'])
+ */
+function copyDirectory(src, dest, excludeFiles = []) {
+  if (!fs.existsSync(dest)) {
+    fs.mkdirSync(dest, { recursive: true })
+  }
+
+  const entries = fs.readdirSync(src, { withFileTypes: true })
+
+  for (const entry of entries) {
+    const srcPath = path.join(src, entry.name)
+    const destPath = path.join(dest, entry.name)
+
+    if (excludeFiles.includes(entry.name)) {
+      continue
+    }
+
+    if (entry.isDirectory()) {
+      copyDirectory(srcPath, destPath, excludeFiles)
+    } else {
+      fs.copyFileSync(srcPath, destPath)
+    }
+  }
+}
+
+/**
+ * Updates a package's provider version using pulumi package add
  * @param {string} packagePath - Path to the package
  * @param {object} currentProvider - Current provider information
  * @param {string} newVersion - New version to update to
+ * @param {string} namespace - Provider namespace
+ * @param {string} providerName - Provider name
  * @param {string|null} changelog - Changelog content
  */
-function updatePackage(packagePath, currentProvider, newVersion, changelog) {
+function updatePackage(
+  packagePath,
+  currentProvider,
+  newVersion,
+  namespace,
+  providerName,
+  changelog,
+) {
   const packageJsonPath = path.join(packagePath, 'package.json')
   const packageJson = JSON.parse(fs.readFileSync(packageJsonPath, 'utf8'))
 
-  // Update parameterization
-  const newParamValue = {
-    remote: {
-      url: currentProvider.url,
-      version: newVersion,
-    },
-  }
+  // Create a temporary directory for the Pulumi project
+  const tempDir = fs.mkdtempSync(path.join(os.tmpdir(), 'pulumi-update-'))
 
-  const encodedParam = Buffer.from(JSON.stringify(newParamValue)).toString(
-    'base64',
-  )
-  packageJson.pulumi.parameterization.value = encodedParam
-  packageJson.pulumi.parameterization.version = newVersion
+  try {
+    console.log(`  Creating temporary Pulumi project in ${tempDir}`)
+
+    // Initialize Pulumi project with TypeScript template
+    const initResult = spawnSync(
+      'pulumi',
+      ['new', 'typescript', '--yes', '--force'],
+      {
+        cwd: tempDir,
+        stdio: 'pipe',
+      },
+    )
 
-  // Write updated package.json
-  fs.writeFileSync(packageJsonPath, JSON.stringify(packageJson, null, 2) + '\n')
+    if (initResult.status !== 0) {
+      throw new Error(
+        `Failed to initialize Pulumi project: ${initResult.stderr?.toString()}`,
+      )
+    }
 
-  // Update CHANGELOG.md
-  const changelogPath = path.join(packagePath, 'CHANGELOG.md')
-  let changelogContent = ''
+    // Run pulumi package add command
+    console.log(
+      `  Running: pulumi package add terraform-provider ${namespace}/${providerName}@v${newVersion}`,
+    )
+    const addResult = spawnSync(
+      'pulumi',
+      [
+        'package',
+        'add',
+        'terraform-provider',
+        `${namespace}/${providerName}@v${newVersion}`,
+      ],
+      {
+        cwd: tempDir,
+        stdio: 'pipe',
+      },
+    )
 
-  if (fs.existsSync(changelogPath)) {
-    changelogContent = fs.readFileSync(changelogPath, 'utf8')
-  }
+    if (addResult.status !== 0) {
+      throw new Error(`Failed to add provider: ${addResult.stderr?.toString()}`)
+    }
 
-  const date = new Date().toISOString().split('T')[0]
-  const changelogEntry = changelog
-    ? `## ${newVersion} (${date})\n\n${changelog}\n\n`
-    : `## ${newVersion} (${date})\n\nUpdate to version ${newVersion}\n\n`
-
-  // Prepend new entry at the beginning (before the first ## entry)
-  const versionMatch = changelogContent.match(/^##\s/m)
-  if (versionMatch) {
-    const insertPos = versionMatch.index
-    changelogContent =
-      changelogContent.slice(0, insertPos) +
-      changelogEntry +
-      changelogContent.slice(insertPos)
-  } else {
-    // No version entries yet, just append to the end
-    changelogContent = changelogContent + '\n' + changelogEntry
-  }
+    // Find the generated SDK directory
+    const sdksDir = path.join(tempDir, 'sdks')
+    if (!fs.existsSync(sdksDir)) {
+      throw new Error(`SDKs directory not found at ${sdksDir}`)
+    }
 
-  fs.writeFileSync(changelogPath, changelogContent)
+    // Find the generated package directory that matches the provider name
+    // The sdks folder contains multiple packages (package1, package2, etc.)
+    const sdkPackages = fs
+      .readdirSync(sdksDir, { withFileTypes: true })
+      .filter((entry) => entry.isDirectory())
 
-  console.log(`Updated ${packageJson.name} to version ${newVersion}`)
+    if (sdkPackages.length === 0) {
+      throw new Error(`No package directories found in ${sdksDir}`)
+    }
+
+    // Try to find the package by checking package.json name or use the first one
+    let sdkDir = null
+    for (const pkgDir of sdkPackages) {
+      const pkgPath = path.join(sdksDir, pkgDir.name)
+      const pkgJsonPath = path.join(pkgPath, 'package.json')
+
+      if (fs.existsSync(pkgJsonPath)) {
+        const pkgJson = JSON.parse(fs.readFileSync(pkgJsonPath, 'utf8'))
+        // Check if this package matches the provider name
+        if (
+          pkgJson.name.includes(providerName) ||
+          pkgJson.pulumi?.name === providerName
+        ) {
+          sdkDir = pkgPath
+          console.log(`  Found matching package at ${sdkDir}`)
+          break
+        }
+      }
+    }
+
+    // If no match found, use the first package directory
+    if (!sdkDir) {
+      sdkDir = path.join(sdksDir, sdkPackages[0].name)
+      console.log(`  Using first package directory at ${sdkDir}`)
+    }
+
+    console.log(`  Copying files from generated SDK to ${packagePath}`)
+
+    // Copy all TypeScript files and other files (excluding README.md and package.json)
+    const entries = fs.readdirSync(sdkDir, { withFileTypes: true })
+
+    for (const entry of entries) {
+      const srcPath = path.join(sdkDir, entry.name)
+      const destPath = path.join(packagePath, entry.name)
+
+      // Skip README.md and package.json (we'll handle package.json separately)
+      if (entry.name === 'README.md' || entry.name === 'package.json') {
+        continue
+      }
+
+      if (entry.isDirectory()) {
+        // Copy entire directory
+        copyDirectory(srcPath, destPath)
+      } else {
+        // Copy file
+        fs.copyFileSync(srcPath, destPath)
+      }
+    }
+
+    // Update package.json: only copy the pulumi property
+    const generatedPackageJsonPath = path.join(sdkDir, 'package.json')
+    if (fs.existsSync(generatedPackageJsonPath)) {
+      const generatedPackageJson = JSON.parse(
+        fs.readFileSync(generatedPackageJsonPath, 'utf8'),
+      )
+
+      if (generatedPackageJson.pulumi) {
+        packageJson.pulumi = generatedPackageJson.pulumi
+        fs.writeFileSync(
+          packageJsonPath,
+          JSON.stringify(packageJson, null, 2) + '\n',
+        )
+        console.log(`  Updated pulumi property in package.json`)
+      }
+    }
+
+    // Update CHANGELOG.md
+    const changelogPath = path.join(packagePath, 'CHANGELOG.md')
+    let changelogContent = ''
+
+    if (fs.existsSync(changelogPath)) {
+      changelogContent = fs.readFileSync(changelogPath, 'utf8')
+    }
+
+    const date = new Date().toISOString().split('T')[0]
+    const changelogEntry = changelog
+      ? `## ${newVersion} (${date})\n\n${changelog}\n\n`
+      : `## ${newVersion} (${date})\n\nUpdate to version ${newVersion}\n\n`
+
+    // Prepend new entry at the beginning (before the first ## entry)
+    const versionMatch = changelogContent.match(/^##\s/m)
+    if (versionMatch) {
+      const insertPos = versionMatch.index
+      changelogContent =
+        changelogContent.slice(0, insertPos) +
+        changelogEntry +
+        changelogContent.slice(insertPos)
+    } else {
+      // No version entries yet, just append to the end
+      changelogContent = changelogContent + '\n' + changelogEntry
+    }
+
+    fs.writeFileSync(changelogPath, changelogContent)
+
+    console.log(`Updated ${packageJson.name} to version ${newVersion}`)
+  } finally {
+    // Clean up temporary directory
+    fs.rmSync(tempDir, { recursive: true, force: true })
+    console.log(`  Cleaned up temporary directory`)
+  }
 }
 
 /**
@@ -191,7 +344,14 @@ async function main() {
     const changelog = await getProviderChangelog(namespace, name, latestVersion)
 
     // Update package
-    updatePackage(packagePath, currentProvider, latestVersion, changelog)
+    updatePackage(
+      packagePath,
+      currentProvider,
+      latestVersion,
+      namespace,
+      name,
+      changelog,
+    )
 
     updates.push({
       name: packageJson.name,

From b29e7cb13703ece40363d2926a36979b3c21ae20 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Wed, 5 Nov 2025 14:16:43 +0000
Subject: [PATCH 07/32] fix: improve GitHub Actions output escaping

Use proper percent-encoding for GitHub Actions output to prevent
injection attacks. Escapes %, newlines, carriage returns, colons, and commas.

Co-authored-by: hckhanh <6380436+hckhanh@users.noreply.github.com>
---
 .github/scripts/check-updates.js | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/.github/scripts/check-updates.js b/.github/scripts/check-updates.js
index d3e0dff..b4188cf 100755
--- a/.github/scripts/check-updates.js
+++ b/.github/scripts/check-updates.js
@@ -405,11 +405,13 @@ async function main() {
 
     // Set outputs for GitHub Actions
     if (process.env.GITHUB_OUTPUT) {
-      // Escape newlines and backslashes for multiline output
+      // Properly escape all special characters for GitHub Actions output
       const escapedSummary = updateSummary
-        .replace(/\\/g, '\\\\')
-        .replace(/\n/g, '\\n')
-        .replace(/\r/g, '\\r')
+        .replace(/%/g, '%25') // Must be first to avoid double-escaping
+        .replace(/\r/g, '%0D')
+        .replace(/\n/g, '%0A')
+        .replace(/:/g, '%3A')
+        .replace(/,/g, '%2C')
 
       fs.appendFileSync(process.env.GITHUB_OUTPUT, `has_updates=true\n`)
       fs.appendFileSync(

From 608ebac41d4bbd039ff7a114c1c645fe945d5a59 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Wed, 5 Nov 2025 14:21:42 +0000
Subject: [PATCH 08/32] feat: fetch versions and changelogs from GitHub
 releases

- Get GitHub repository URL from OpenTofu registry
- Fetch latest release version from GitHub API
- Extract changelog from GitHub release notes
- Keep namespace and provider name from Terraform provider parameterization
- Remove dependency on Terraform registry for versions

Co-authored-by: hckhanh <6380436+hckhanh@users.noreply.github.com>
---
 .github/scripts/check-updates.js | 95 ++++++++++++++++++++------------
 1 file changed, 60 insertions(+), 35 deletions(-)

diff --git a/.github/scripts/check-updates.js b/.github/scripts/check-updates.js
index b4188cf..db36b37 100755
--- a/.github/scripts/check-updates.js
+++ b/.github/scripts/check-updates.js
@@ -6,67 +6,82 @@ const { execSync, spawnSync } = require('node:child_process')
 const os = require('node:os')
 
 /**
- * Fetches the latest version of a Terraform provider from the OpenTofu registry
+ * Fetches the GitHub repository URL from OpenTofu registry
  * @param {string} namespace - Provider namespace
  * @param {string} name - Provider name
- * @returns {Promise<string|null>} Latest version or null if not found
+ * @returns {Promise<string|null>} GitHub repository URL or null
  */
-async function getLatestProviderVersion(namespace, name) {
+async function getGitHubRepoFromRegistry(namespace, name) {
   try {
-    const registryUrl = `https://registry.opentofu.org/v1/providers/${namespace}/${name}/versions`
+    const registryUrl = `https://registry.opentofu.org/v1/providers/${namespace}/${name}`
     const response = await fetch(registryUrl)
 
     if (!response.ok) {
       console.error(
-        `Failed to fetch versions for ${namespace}/${name}: ${response.status}`,
+        `Failed to fetch provider info for ${namespace}/${name}: ${response.status}`,
       )
       return null
     }
 
     const data = await response.json()
 
-    if (!data.versions || data.versions.length === 0) {
-      console.error(`No versions found for ${namespace}/${name}`)
-      return null
+    // The source field contains the GitHub repository URL
+    if (data.source) {
+      return data.source
     }
 
-    // Return the latest version (versions are sorted by the API)
-    return data.versions[0].version
+    return null
   } catch (error) {
-    console.error(`Error fetching version for ${namespace}/${name}:`, error)
+    console.error(`Error fetching repo info for ${namespace}/${name}:`, error)
     return null
   }
 }
 
 /**
- * Fetches changelog for a specific version of a provider
- * @param {string} namespace - Provider namespace
- * @param {string} name - Provider name
- * @param {string} version - Version to fetch changelog for
- * @returns {Promise<string|null>} Changelog content or null
+ * Fetches the latest release from GitHub repository
+ * @param {string} repoUrl - GitHub repository URL (e.g., "https://github.com/BunnyWay/terraform-provider-bunnynet")
+ * @returns {Promise<{version: string, changelog: string|null}|null>} Latest release info or null
  */
-async function getProviderChangelog(namespace, name, version) {
+async function getLatestGitHubRelease(repoUrl) {
   try {
-    // Try to fetch from GitHub releases
-    const githubUrl = `https://api.github.com/repos/${namespace}/terraform-provider-${name}/releases/tags/v${version}`
-    const response = await fetch(githubUrl, {
+    // Extract owner/repo from URL
+    const match = repoUrl.match(/github\.com\/([^\/]+\/[^\/]+)/)
+    if (!match) {
+      console.error(`Invalid GitHub URL: ${repoUrl}`)
+      return null
+    }
+
+    const repoPath = match[1]
+    const apiUrl = `https://api.github.com/repos/${repoPath}/releases/latest`
+
+    const response = await fetch(apiUrl, {
       headers: {
         Accept: 'application/vnd.github+json',
         'User-Agent': 'pulumi-any-terraform-updater',
       },
     })
 
-    if (response.ok) {
-      const data = await response.json()
-      return data.body || null
+    if (!response.ok) {
+      console.error(
+        `Failed to fetch latest release from ${repoPath}: ${response.status}`,
+      )
+      return null
     }
 
-    return null
+    const data = await response.json()
+
+    // Extract version (remove 'v' prefix if present)
+    let version = data.tag_name
+    if (version && version.startsWith('v')) {
+      version = version.substring(1)
+    }
+
+    return {
+      version: version || null,
+      changelog: data.body || null,
+    }
   } catch (error) {
-    console.error(
-      `Error fetching changelog for ${namespace}/${name}@${version}:`,
-      error,
-    )
+    console.error(`Error fetching GitHub release from ${repoUrl}:`, error)
     return null
   }
 }
@@ -325,14 +340,27 @@ async function main() {
     console.log(`Checking ${pkg} (${namespace}/${name})...`)
     console.log(`  Current version: ${currentProvider.version}`)
 
-    // Fetch latest version
-    const latestVersion = await getLatestProviderVersion(namespace, name)
+    // Get GitHub repository URL from registry
+    const githubRepoUrl = await getGitHubRepoFromRegistry(namespace, name)
 
-    if (!latestVersion) {
-      console.log(`  Could not fetch latest version`)
+    if (!githubRepoUrl) {
+      console.log(`  Could not find GitHub repository for ${namespace}/${name}`)
       continue
     }
 
+    console.log(`  GitHub repository: ${githubRepoUrl}`)
+
+    // Fetch latest release from GitHub
+    const releaseInfo = await getLatestGitHubRelease(githubRepoUrl)
+
+    if (!releaseInfo || !releaseInfo.version) {
+      console.log(`  Could not fetch latest release from GitHub`)
+      continue
+    }
+
+    const latestVersion = releaseInfo.version
+    const changelog = releaseInfo.changelog
+
     console.log(`  Latest version: ${latestVersion}`)
 
     if (latestVersion === currentProvider.version) {
@@ -340,9 +368,6 @@ async function main() {
       continue
     }
 
-    // Fetch changelog
-    const changelog = await getProviderChangelog(namespace, name, latestVersion)
-
     // Update package
     updatePackage(
       packagePath,

From f52462e2257923f0c9ff2fbff606b92f74e772a0 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Wed, 5 Nov 2025 14:25:28 +0000
Subject: [PATCH 09/32] fix: improve security and robustness of update script

- Add validation for parameterization JSON structure
- Improve GitHub URL regex to handle .git suffix
- Add URL format validation before parsing
- Use base64 encoding for GitHub Actions output to handle all special characters safely
- Update workflow to decode base64 output
- Fix API endpoint documentation

Co-authored-by: hckhanh <6380436+hckhanh@users.noreply.github.com>
---
 .github/scripts/README.md             |  4 +--
 .github/scripts/check-updates.js      | 41 ++++++++++++++++++++-------
 .github/workflows/update-packages.yml | 10 ++++++-
 3 files changed, 41 insertions(+), 14 deletions(-)

diff --git a/.github/scripts/README.md b/.github/scripts/README.md
index 56c5b47..b053035 100644
--- a/.github/scripts/README.md
+++ b/.github/scripts/README.md
@@ -48,8 +48,8 @@ When running in GitHub Actions, the script uses:
 
 ### API Endpoints
 
-- **OpenTofu Registry**: `https://registry.opentofu.org/v1/providers/{namespace}/{name}/versions`
-- **GitHub Releases**: `https://api.github.com/repos/{namespace}/terraform-provider-{name}/releases/tags/v{version}`
+- **OpenTofu Registry**: `https://registry.opentofu.org/v1/providers/{namespace}/{name}` - to get the GitHub repository URL
+- **GitHub Releases**: `https://api.github.com/repos/{owner}/{repo}/releases/latest` - to get the latest version and changelog
 
 ### Error Handling
 
diff --git a/.github/scripts/check-updates.js b/.github/scripts/check-updates.js
index db36b37..100d4a3 100755
--- a/.github/scripts/check-updates.js
+++ b/.github/scripts/check-updates.js
@@ -44,8 +44,10 @@ async function getGitHubRepoFromRegistry(namespace, name) {
  */
 async function getLatestGitHubRelease(repoUrl) {
   try {
-    // Extract owner/repo from URL
-    const match = repoUrl.match(/github\.com\/([^\/]+\/[^\/]+)/)
+    // Extract owner/repo from URL (handle .git suffix and trailing paths)
+    const match = repoUrl.match(
+      /github\.com\/([^\/]+\/[^\/]+?)(?:\.git|\/.*)?$/,
+    )
     if (!match) {
       console.error(`Invalid GitHub URL: ${repoUrl}`)
       return null
@@ -330,10 +332,32 @@ async function main() {
       packageJson.pulumi.parameterization.value,
       'base64',
     ).toString('utf8')
-    const currentProvider = JSON.parse(decodedParam).remote
+
+    let currentProvider
+    try {
+      const parsed = JSON.parse(decodedParam)
+      if (!parsed.remote || typeof parsed.remote !== 'object') {
+        console.log(`  Invalid parameterization structure`)
+        continue
+      }
+      currentProvider = parsed.remote
+    } catch (error) {
+      console.log(`  Failed to parse parameterization: ${error.message}`)
+      continue
+    }
 
     // Parse namespace and name from URL
+    if (!currentProvider.url || typeof currentProvider.url !== 'string') {
+      console.log(`  Invalid provider URL`)
+      continue
+    }
+
     const urlParts = currentProvider.url.split('/')
+    if (urlParts.length < 2) {
+      console.log(`  Invalid provider URL format`)
+      continue
+    }
+
     const namespace = urlParts[urlParts.length - 2]
     const name = urlParts[urlParts.length - 1]
 
@@ -430,18 +454,13 @@ async function main() {
 
     // Set outputs for GitHub Actions
     if (process.env.GITHUB_OUTPUT) {
-      // Properly escape all special characters for GitHub Actions output
-      const escapedSummary = updateSummary
-        .replace(/%/g, '%25') // Must be first to avoid double-escaping
-        .replace(/\r/g, '%0D')
-        .replace(/\n/g, '%0A')
-        .replace(/:/g, '%3A')
-        .replace(/,/g, '%2C')
+      // Use base64 encoding to safely pass multiline content with special characters
+      const encodedSummary = Buffer.from(updateSummary).toString('base64')
 
       fs.appendFileSync(process.env.GITHUB_OUTPUT, `has_updates=true\n`)
       fs.appendFileSync(
         process.env.GITHUB_OUTPUT,
-        `update_summary=${escapedSummary}\n`,
+        `update_summary_base64=${encodedSummary}\n`,
       )
     }
   } else {
diff --git a/.github/workflows/update-packages.yml b/.github/workflows/update-packages.yml
index eab1b7b..8162c27 100644
--- a/.github/workflows/update-packages.yml
+++ b/.github/workflows/update-packages.yml
@@ -42,6 +42,14 @@ jobs:
         run: |
           node .github/scripts/check-updates.js
 
+      - name: Decode update summary
+        if: steps.check.outputs.has_updates == 'true'
+        id: decode
+        run: |
+          echo "update_summary<<EOF" >> $GITHUB_OUTPUT
+          echo "${{ steps.check.outputs.update_summary_base64 }}" | base64 -d >> $GITHUB_OUTPUT
+          echo "EOF" >> $GITHUB_OUTPUT
+
       - name: Create Pull Request
         if: steps.check.outputs.has_updates == 'true'
         uses: peter-evans/create-pull-request@c5a7806660adbe173f04e3e038b0ccdcd758773c # v7.0.5
@@ -54,7 +62,7 @@ jobs:
 
             ## Updates
 
-            ${{ steps.check.outputs.update_summary }}
+            ${{ steps.decode.outputs.update_summary }}
 
             ---
             *This PR was automatically generated by the update-packages workflow*

From b789c6576171afa1e0c7b7fc4833bf6391e83856 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Wed, 5 Nov 2025 14:31:29 +0000
Subject: [PATCH 10/32] fix: use Terraform registry for pulumi package add
 command

- Use registry.terraform.io instead of OpenTofu registry for pulumi package add
- Remove manual CHANGELOG.md updates (handled by Nx release plan)
- Let Nx handle all changelog generation through release plan
- Update documentation to reflect Nx-managed changelogs

Co-authored-by: hckhanh <6380436+hckhanh@users.noreply.github.com>
---
 .github/scripts/README.md        | 12 ++++----
 .github/scripts/check-updates.js | 51 ++++----------------------------
 2 files changed, 13 insertions(+), 50 deletions(-)

diff --git a/.github/scripts/README.md b/.github/scripts/README.md
index b053035..313d5b6 100644
--- a/.github/scripts/README.md
+++ b/.github/scripts/README.md
@@ -10,12 +10,14 @@ This script automatically checks for updates to Terraform providers and updates
 
 1. **Scans packages**: Iterates through all packages in the `packages/` directory
 2. **Extracts provider info**: Decodes the base64-encoded parameterization value to get the current provider version and registry URL
-3. **Checks for updates**: Queries the OpenTofu registry API for the latest version of each provider
-4. **Fetches changelogs**: Attempts to fetch release notes from GitHub if available
+3. **Gets GitHub repository**: Queries the OpenTofu registry to get the source GitHub repository
+4. **Fetches latest release**: Gets the latest release version and changelog from GitHub API
 5. **Updates packages**: For packages with newer versions available:
-   - Updates the `package.json` with new parameterization value
-   - Adds an entry to `CHANGELOG.md` with release notes or a generic update message
-6. **Creates release plan**: Uses `nx release plan` to prepare versioning for updated packages
+   - Creates a temporary Pulumi project
+   - Runs `pulumi package add terraform-provider namespace/name@version`
+   - Copies generated TypeScript files to the package directory
+   - Updates the `pulumi` property in `package.json` with new parameterization
+6. **Creates release plan**: Uses `nx release plan` to prepare versioning and changelog updates
 7. **Stages changes**: Adds all changes to git staging area
 
 ### Usage
diff --git a/.github/scripts/check-updates.js b/.github/scripts/check-updates.js
index 100d4a3..cd03926 100755
--- a/.github/scripts/check-updates.js
+++ b/.github/scripts/check-updates.js
@@ -124,7 +124,6 @@ function copyDirectory(src, dest, excludeFiles = []) {
  * @param {string} newVersion - New version to update to
  * @param {string} namespace - Provider namespace
  * @param {string} providerName - Provider name
- * @param {string|null} changelog - Changelog content
  */
 function updatePackage(
   packagePath,
@@ -132,7 +131,6 @@ function updatePackage(
   newVersion,
   namespace,
   providerName,
-  changelog,
 ) {
   const packageJsonPath = path.join(packagePath, 'package.json')
   const packageJson = JSON.parse(fs.readFileSync(packageJsonPath, 'utf8'))
@@ -160,17 +158,15 @@ function updatePackage(
     }
 
     // Run pulumi package add command
+    // Note: pulumi package add terraform-provider uses Terraform registry format
+    // We need to use registry.terraform.io, not registry.opentofu.org
+    const registryUrl = `registry.terraform.io/${namespace}/${providerName}`
     console.log(
-      `  Running: pulumi package add terraform-provider ${namespace}/${providerName}@v${newVersion}`,
+      `  Running: pulumi package add terraform-provider ${registryUrl}@v${newVersion}`,
     )
     const addResult = spawnSync(
       'pulumi',
-      [
-        'package',
-        'add',
-        'terraform-provider',
-        `${namespace}/${providerName}@v${newVersion}`,
-      ],
+      ['package', 'add', 'terraform-provider', `${registryUrl}@v${newVersion}`],
       {
         cwd: tempDir,
         stdio: 'pipe',
@@ -263,34 +259,6 @@ function updatePackage(
       }
     }
 
-    // Update CHANGELOG.md
-    const changelogPath = path.join(packagePath, 'CHANGELOG.md')
-    let changelogContent = ''
-
-    if (fs.existsSync(changelogPath)) {
-      changelogContent = fs.readFileSync(changelogPath, 'utf8')
-    }
-
-    const date = new Date().toISOString().split('T')[0]
-    const changelogEntry = changelog
-      ? `## ${newVersion} (${date})\n\n${changelog}\n\n`
-      : `## ${newVersion} (${date})\n\nUpdate to version ${newVersion}\n\n`
-
-    // Prepend new entry at the beginning (before the first ## entry)
-    const versionMatch = changelogContent.match(/^##\s/m)
-    if (versionMatch) {
-      const insertPos = versionMatch.index
-      changelogContent =
-        changelogContent.slice(0, insertPos) +
-        changelogEntry +
-        changelogContent.slice(insertPos)
-    } else {
-      // No version entries yet, just append to the end
-      changelogContent = changelogContent + '\n' + changelogEntry
-    }
-
-    fs.writeFileSync(changelogPath, changelogContent)
-
     console.log(`Updated ${packageJson.name} to version ${newVersion}`)
   } finally {
     // Clean up temporary directory
@@ -393,14 +361,7 @@ async function main() {
     }
 
     // Update package
-    updatePackage(
-      packagePath,
-      currentProvider,
-      latestVersion,
-      namespace,
-      name,
-      changelog,
-    )
+    updatePackage(packagePath, currentProvider, latestVersion, namespace, name)
 
     updates.push({
       name: packageJson.name,

From 7de3b39d08064c483f0e96c4a5aa932fa29a54d2 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Wed, 5 Nov 2025 14:45:27 +0000
Subject: [PATCH 11/32] fix: use Terraform registry instead of OpenTofu for API
 calls

The OpenTofu registry API endpoint returns 404 errors. Switch to using
registry.terraform.io which works correctly and returns the GitHub
repository URLs needed for fetching release information.

This fixes the issue where all provider lookups were failing with 404 errors.

Co-authored-by: hckhanh <6380436+hckhanh@users.noreply.github.com>
---
 .github/scripts/README.md        | 4 ++--
 .github/scripts/check-updates.js | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/scripts/README.md b/.github/scripts/README.md
index 313d5b6..935a568 100644
--- a/.github/scripts/README.md
+++ b/.github/scripts/README.md
@@ -10,7 +10,7 @@ This script automatically checks for updates to Terraform providers and updates
 
 1. **Scans packages**: Iterates through all packages in the `packages/` directory
 2. **Extracts provider info**: Decodes the base64-encoded parameterization value to get the current provider version and registry URL
-3. **Gets GitHub repository**: Queries the OpenTofu registry to get the source GitHub repository
+3. **Gets GitHub repository**: Queries the Terraform registry to get the source GitHub repository
 4. **Fetches latest release**: Gets the latest release version and changelog from GitHub API
 5. **Updates packages**: For packages with newer versions available:
    - Creates a temporary Pulumi project
@@ -50,7 +50,7 @@ When running in GitHub Actions, the script uses:
 
 ### API Endpoints
 
-- **OpenTofu Registry**: `https://registry.opentofu.org/v1/providers/{namespace}/{name}` - to get the GitHub repository URL
+- **Terraform Registry**: `https://registry.terraform.io/v1/providers/{namespace}/{name}` - to get the GitHub repository URL
 - **GitHub Releases**: `https://api.github.com/repos/{owner}/{repo}/releases/latest` - to get the latest version and changelog
 
 ### Error Handling
diff --git a/.github/scripts/check-updates.js b/.github/scripts/check-updates.js
index cd03926..1e69764 100755
--- a/.github/scripts/check-updates.js
+++ b/.github/scripts/check-updates.js
@@ -6,14 +6,14 @@ const { execSync, spawnSync } = require('node:child_process')
 const os = require('node:os')
 
 /**
- * Fetches the GitHub repository URL from OpenTofu registry
+ * Fetches the GitHub repository URL from Terraform registry
  * @param {string} namespace - Provider namespace
  * @param {string} name - Provider name
  * @returns {Promise<string|null>} GitHub repository URL or null
  */
 async function getGitHubRepoFromRegistry(namespace, name) {
   try {
-    const registryUrl = `https://registry.opentofu.org/v1/providers/${namespace}/${name}`
+    const registryUrl = `https://registry.terraform.io/v1/providers/${namespace}/${name}`
     const response = await fetch(registryUrl)
 
     if (!response.ok) {

From 8514e3f419a2d0aebc963eda8f241a03acf44a30 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Wed, 5 Nov 2025 15:03:29 +0000
Subject: [PATCH 12/32] feat: add GitHub token authentication for API calls

Add support for GITHUB_TOKEN environment variable to authenticate
GitHub API requests. This prevents rate limiting issues.

The script now:
- Uses GITHUB_TOKEN if available (in GitHub Actions)
- Falls back to unauthenticated requests (local testing)
- Workflow passes GITHUB_TOKEN to the check-updates step

When run locally without a token, the script will hit rate limits (403),
but it will work correctly in GitHub Actions with authentication.

Co-authored-by: hckhanh <6380436+hckhanh@users.noreply.github.com>
---
 .github/scripts/check-updates.js      | 17 +++++++++++------
 .github/workflows/update-packages.yml |  2 ++
 2 files changed, 13 insertions(+), 6 deletions(-)

diff --git a/.github/scripts/check-updates.js b/.github/scripts/check-updates.js
index 1e69764..ed2b444 100755
--- a/.github/scripts/check-updates.js
+++ b/.github/scripts/check-updates.js
@@ -56,12 +56,17 @@ async function getLatestGitHubRelease(repoUrl) {
     const repoPath = match[1]
     const apiUrl = `https://api.github.com/repos/${repoPath}/releases/latest`
 
-    const response = await fetch(apiUrl, {
-      headers: {
-        Accept: 'application/vnd.github+json',
-        'User-Agent': 'pulumi-any-terraform-updater',
-      },
-    })
+    const headers = {
+      Accept: 'application/vnd.github+json',
+      'User-Agent': 'pulumi-any-terraform-updater',
+    }
+
+    // Add authentication if GITHUB_TOKEN is available
+    if (process.env.GITHUB_TOKEN) {
+      headers.Authorization = `Bearer ${process.env.GITHUB_TOKEN}`
+    }
+
+    const response = await fetch(apiUrl, { headers })
 
     if (!response.ok) {
       console.error(
diff --git a/.github/workflows/update-packages.yml b/.github/workflows/update-packages.yml
index 8162c27..839a0b6 100644
--- a/.github/workflows/update-packages.yml
+++ b/.github/workflows/update-packages.yml
@@ -39,6 +39,8 @@ jobs:
 
       - name: Check for updates
         id: check
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           node .github/scripts/check-updates.js
 

From 40cc4cf141f005f26b9f3eaff2d840a84738034f Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Wed, 5 Nov 2025 15:35:03 +0000
Subject: [PATCH 13/32] fix: add PULUMI_CONFIG_PASSPHRASE for temporary
 projects

Set PULUMI_CONFIG_PASSPHRASE environment variable when creating temporary
Pulumi projects to avoid secrets manager errors. The passphrase is only
used for the temporary project and is not stored or reused.

This fixes the error: "passphrase must be set with PULUMI_CONFIG_PASSPHRASE
or PULUMI_CONFIG_PASSPHRASE_FILE environment variables"

Co-authored-by: hckhanh <6380436+hckhanh@users.noreply.github.com>
---
 .github/scripts/check-updates.js | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/.github/scripts/check-updates.js b/.github/scripts/check-updates.js
index ed2b444..7772bb5 100755
--- a/.github/scripts/check-updates.js
+++ b/.github/scripts/check-updates.js
@@ -147,12 +147,17 @@ function updatePackage(
     console.log(`  Creating temporary Pulumi project in ${tempDir}`)
 
     // Initialize Pulumi project with TypeScript template
+    // Set a passphrase for the temporary project (not used for secrets)
     const initResult = spawnSync(
       'pulumi',
       ['new', 'typescript', '--yes', '--force'],
       {
         cwd: tempDir,
         stdio: 'pipe',
+        env: {
+          ...process.env,
+          PULUMI_CONFIG_PASSPHRASE: 'temp-passphrase-for-update',
+        },
       },
     )
 
@@ -175,6 +180,10 @@ function updatePackage(
       {
         cwd: tempDir,
         stdio: 'pipe',
+        env: {
+          ...process.env,
+          PULUMI_CONFIG_PASSPHRASE: 'temp-passphrase-for-update',
+        },
       },
     )
 

From 4826cc3ce9303c3ea53980d52c69c828b566863b Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Wed, 5 Nov 2025 15:58:51 +0000
Subject: [PATCH 14/32] fix: update pulumi command syntax and exclude
 .gitignore from copy

- Change pulumi package add command to use separate arguments:
  `pulumi package add terraform-provider namespace/provider version`
  instead of using @version notation
- Exclude .gitignore from being copied to prevent overwriting existing
  repository .gitignore files

Co-authored-by: hckhanh <6380436+hckhanh@users.noreply.github.com>
---
 .github/scripts/check-updates.js | 21 ++++++++++++++-------
 1 file changed, 14 insertions(+), 7 deletions(-)

diff --git a/.github/scripts/check-updates.js b/.github/scripts/check-updates.js
index 7772bb5..b304953 100755
--- a/.github/scripts/check-updates.js
+++ b/.github/scripts/check-updates.js
@@ -168,15 +168,18 @@ function updatePackage(
     }
 
     // Run pulumi package add command
-    // Note: pulumi package add terraform-provider uses Terraform registry format
-    // We need to use registry.terraform.io, not registry.opentofu.org
-    const registryUrl = `registry.terraform.io/${namespace}/${providerName}`
     console.log(
-      `  Running: pulumi package add terraform-provider ${registryUrl}@v${newVersion}`,
+      `  Running: pulumi package add terraform-provider ${namespace}/${providerName} ${newVersion}`,
     )
     const addResult = spawnSync(
       'pulumi',
-      ['package', 'add', 'terraform-provider', `${registryUrl}@v${newVersion}`],
+      [
+        'package',
+        'add',
+        'terraform-provider',
+        `${namespace}/${providerName}`,
+        newVersion,
+      ],
       {
         cwd: tempDir,
         stdio: 'pipe',
@@ -242,8 +245,12 @@ function updatePackage(
       const srcPath = path.join(sdkDir, entry.name)
       const destPath = path.join(packagePath, entry.name)
 
-      // Skip README.md and package.json (we'll handle package.json separately)
-      if (entry.name === 'README.md' || entry.name === 'package.json') {
+      // Skip README.md, package.json, and .gitignore (we'll handle package.json separately)
+      if (
+        entry.name === 'README.md' ||
+        entry.name === 'package.json' ||
+        entry.name === '.gitignore'
+      ) {
         continue
       }
 

From 40f89728f4c829c7a89775c2f593e133de0f9bb4 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Wed, 5 Nov 2025 16:07:16 +0000
Subject: [PATCH 15/32] feat: run nx release plan per project with bump type

- Add determineBumpType function to compare versions and detect major/minor/patch
- Run nx release plan individually for each updated project
- Pass bump type (major/minor/patch) and project name to nx command
- Format: `nx release plan <bump> --message="..." --projects=<project>`

This ensures each project gets its own release plan with the correct
semver bump based on version comparison.

Co-authored-by: hckhanh <6380436+hckhanh@users.noreply.github.com>
---
 .github/scripts/check-updates.js | 69 ++++++++++++++++++++++++--------
 1 file changed, 53 insertions(+), 16 deletions(-)

diff --git a/.github/scripts/check-updates.js b/.github/scripts/check-updates.js
index b304953..7ef0be0 100755
--- a/.github/scripts/check-updates.js
+++ b/.github/scripts/check-updates.js
@@ -5,6 +5,26 @@ const path = require('node:path')
 const { execSync, spawnSync } = require('node:child_process')
 const os = require('node:os')
 
+/**
+ * Determines the semver bump type based on version comparison
+ * @param {string} oldVersion - Current version (e.g., "1.2.3")
+ * @param {string} newVersion - New version (e.g., "2.0.0")
+ * @returns {string} Bump type: "major", "minor", or "patch"
+ */
+function determineBumpType(oldVersion, newVersion) {
+  const parseVersion = (v) => {
+    const parts = v.replace(/^v/, '').split('.').map(Number)
+    return { major: parts[0] || 0, minor: parts[1] || 0, patch: parts[2] || 0 }
+  }
+
+  const oldV = parseVersion(oldVersion)
+  const newV = parseVersion(newVersion)
+
+  if (newV.major > oldV.major) return 'major'
+  if (newV.minor > oldV.minor) return 'minor'
+  return 'patch'
+}
+
 /**
  * Fetches the GitHub repository URL from Terraform registry
  * @param {string} namespace - Provider namespace
@@ -384,10 +404,14 @@ async function main() {
     // Update package
     updatePackage(packagePath, currentProvider, latestVersion, namespace, name)
 
+    const bumpType = determineBumpType(currentProvider.version, latestVersion)
+
     updates.push({
       name: packageJson.name,
+      projectName: pkg, // The directory name which is the nx project name
       oldVersion: currentProvider.version,
       newVersion: latestVersion,
+      bumpType,
       namespace,
       providerName: name,
     })
@@ -398,24 +422,37 @@ async function main() {
   if (updates.length > 0) {
     console.log(`\nUpdated ${updates.length} package(s)`)
 
-    // Create release plan
-    const releaseMessage = updates
-      .map((u) => `Update ${u.name} from ${u.oldVersion} to ${u.newVersion}`)
-      .join('\n\n')
-
+    // Create release plan for each project
     try {
-      // Use spawnSync to avoid command injection
-      const result = spawnSync(
-        'pnpm',
-        ['nx', 'release', 'plan', `--message=${releaseMessage}`],
-        {
-          stdio: 'inherit',
-          cwd: process.cwd(),
-        },
-      )
+      for (const update of updates) {
+        const releaseMessage = `Update ${update.name} from ${update.oldVersion} to ${update.newVersion}`
+
+        console.log(
+          `\nCreating release plan for ${update.projectName} (${update.bumpType})...`,
+        )
+
+        // Use spawnSync to avoid command injection
+        const result = spawnSync(
+          'pnpm',
+          [
+            'nx',
+            'release',
+            'plan',
+            update.bumpType,
+            `--message=${releaseMessage}`,
+            `--projects=${update.projectName}`,
+          ],
+          {
+            stdio: 'inherit',
+            cwd: process.cwd(),
+          },
+        )
 
-      if (result.status !== 0) {
-        throw new Error(`nx release plan failed with status ${result.status}`)
+        if (result.status !== 0) {
+          throw new Error(
+            `nx release plan failed for ${update.projectName} with status ${result.status}`,
+          )
+        }
       }
 
       // Stage all changes

From a833366d3911b51ea297de90a4e8f0f6edf9b52f Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Wed, 5 Nov 2025 16:14:17 +0000
Subject: [PATCH 16/32] fix: include changelog in release plan message

- Add changelog to updates array so it's not an unused variable
- Include changelog content in nx release plan message when available
- Format: "Update package from x to y\n\n<changelog content>"

This ensures the changelog from GitHub releases is utilized in the
release plan message, providing better context for version updates.

Co-authored-by: hckhanh <6380436+hckhanh@users.noreply.github.com>
---
 .github/scripts/check-updates.js | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/.github/scripts/check-updates.js b/.github/scripts/check-updates.js
index 7ef0be0..36a036e 100755
--- a/.github/scripts/check-updates.js
+++ b/.github/scripts/check-updates.js
@@ -412,6 +412,7 @@ async function main() {
       oldVersion: currentProvider.version,
       newVersion: latestVersion,
       bumpType,
+      changelog, // Include changelog for potential use in release message
       namespace,
       providerName: name,
     })
@@ -425,7 +426,11 @@ async function main() {
     // Create release plan for each project
     try {
       for (const update of updates) {
-        const releaseMessage = `Update ${update.name} from ${update.oldVersion} to ${update.newVersion}`
+        // Include changelog in message if available, otherwise use simple update message
+        let releaseMessage = `Update ${update.name} from ${update.oldVersion} to ${update.newVersion}`
+        if (update.changelog) {
+          releaseMessage += `\n\n${update.changelog}`
+        }
 
         console.log(
           `\nCreating release plan for ${update.projectName} (${update.bumpType})...`,

From 8e6562438f87933bbeea848ac7e4fc6ba834aa8c Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Wed, 5 Nov 2025 16:22:42 +0000
Subject: [PATCH 17/32] refactor: remove redundant Configure Git step

The peter-evans/create-pull-request action automatically configures
git user.name and user.email for its commits. Our script only runs
`git add` which doesn't require git configuration. The Configure Git
step is therefore redundant.

Co-authored-by: hckhanh <6380436+hckhanh@users.noreply.github.com>
---
 .github/workflows/update-packages.yml | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/.github/workflows/update-packages.yml b/.github/workflows/update-packages.yml
index 839a0b6..88e547f 100644
--- a/.github/workflows/update-packages.yml
+++ b/.github/workflows/update-packages.yml
@@ -32,11 +32,6 @@ jobs:
       - name: Install dependencies
         run: sfw pnpm install
 
-      - name: Configure Git
-        run: |
-          git config user.name "github-actions[bot]"
-          git config user.email "github-actions[bot]@users.noreply.github.com"
-
       - name: Check for updates
         id: check
         env:

From 0b1e8cfa9835bd83c0b923ecf80794dd8553748a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Kh=C3=A1nh=20Ho=C3=A0ng?= <hi@khanh.id>
Date: Thu, 6 Nov 2025 06:43:35 +0700
Subject: [PATCH 18/32] update check-updates script refine release message to
 align with terraform provider changes

---
 .github/scripts/check-updates.js | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/scripts/check-updates.js b/.github/scripts/check-updates.js
index 36a036e..ccd0fd0 100755
--- a/.github/scripts/check-updates.js
+++ b/.github/scripts/check-updates.js
@@ -2,7 +2,7 @@
 
 const fs = require('node:fs')
 const path = require('node:path')
-const { execSync, spawnSync } = require('node:child_process')
+const { spawnSync } = require('node:child_process')
 const os = require('node:os')
 
 /**
@@ -427,7 +427,7 @@ async function main() {
     try {
       for (const update of updates) {
         // Include changelog in message if available, otherwise use simple update message
-        let releaseMessage = `Update ${update.name} from ${update.oldVersion} to ${update.newVersion}`
+        let releaseMessage = `Update ${update.name} from ${update.oldVersion} to ${update.newVersion} to match upstream terraform provider`
         if (update.changelog) {
           releaseMessage += `\n\n${update.changelog}`
         }

From 06eff8737fc3bde7437533c477bae96731815da5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Kh=C3=A1nh=20Ho=C3=A0ng?= <hi@khanh.id>
Date: Thu, 6 Nov 2025 06:46:40 +0700
Subject: [PATCH 19/32] Simplify GitHub Actions workflow by removing
 unnecessary blank lines

---
 .github/workflows/update-packages.yml | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/.github/workflows/update-packages.yml b/.github/workflows/update-packages.yml
index 88e547f..c5ebd6f 100644
--- a/.github/workflows/update-packages.yml
+++ b/.github/workflows/update-packages.yml
@@ -20,25 +20,20 @@ jobs:
         with:
           fetch-depth: 0
           filter: tree:0
-
       - name: Setup toolchains
         uses: jdx/mise-action@be3be2260bc02bc3fbf94c5e2fed8b7964baf074 # v3.4.0
-
       - name: Setup Socket Firewall
         uses: SocketDev/action@4337a545deecc20f19a909e52db7a2f6ba292f42 # v1.2.0
         with:
           mode: firewall
-
       - name: Install dependencies
         run: sfw pnpm install
-
       - name: Check for updates
         id: check
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           node .github/scripts/check-updates.js
-
       - name: Decode update summary
         if: steps.check.outputs.has_updates == 'true'
         id: decode
@@ -46,7 +41,6 @@ jobs:
           echo "update_summary<<EOF" >> $GITHUB_OUTPUT
           echo "${{ steps.check.outputs.update_summary_base64 }}" | base64 -d >> $GITHUB_OUTPUT
           echo "EOF" >> $GITHUB_OUTPUT
-
       - name: Create Pull Request
         if: steps.check.outputs.has_updates == 'true'
         uses: peter-evans/create-pull-request@c5a7806660adbe173f04e3e038b0ccdcd758773c # v7.0.5

From eb23f66aec2a7a582a621516fc2dfcdd07441f5b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Kh=C3=A1nh=20Ho=C3=A0ng?= <hi@khanh.id>
Date: Thu, 6 Nov 2025 07:11:28 +0700
Subject: [PATCH 20/32] Update GitHub Actions workflows move env variables to
 steps and refine permissions

---
 .github/workflows/publish.yml         | 15 +++++++--------
 .github/workflows/test.yml            |  4 ----
 .github/workflows/update-packages.yml | 13 +++++++++++--
 3 files changed, 18 insertions(+), 14 deletions(-)

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 34153c2..268651f 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -6,12 +6,6 @@ on:
     tags:
       - '*@*.*.*'
 
-env:
-  NX_KEY: ${{ secrets.NX_KEY }}
-  AWS_ENDPOINT_URL: ${{ secrets.AWS_ENDPOINT_URL }}
-  AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
-  AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-
 permissions:
   contents: read
 
@@ -36,11 +30,16 @@ jobs:
           mode: firewall
       - name: Install dependencies
         run: sfw pnpm install
-      - name: Show Nx report
-        run: pnpm nx report
       - name: Build packages
         run: pnpm nx run-many -t build
+        env:
+          NX_KEY: ${{ secrets.NX_KEY }}
+          AWS_ENDPOINT_URL: ${{ secrets.AWS_ENDPOINT_URL }}
+          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
       - name: Update npm
         run: npm install -g npm@latest
       - name: Publish packages
         run: pnpm nx release publish
+        env:
+          NX_KEY: ${{ secrets.NX_KEY }}
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 7e0b153..499f78a 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -28,8 +28,6 @@ jobs:
           mode: firewall
       - name: Install dependencies
         run: sfw pnpm install
-      - name: Show Nx report
-        run: pnpm nx report
       - name: Set SHAs
         uses: nrwl/nx-set-shas@826660b82addbef3abff5fa871492ebad618c9e1 # v4.3.3
       - name: Fix
@@ -64,8 +62,6 @@ jobs:
           mode: firewall
       - name: Install dependencies
         run: sfw pnpm install
-      - name: Show Nx report
-        run: pnpm nx report
       - name: Set SHAs
         uses: nrwl/nx-set-shas@826660b82addbef3abff5fa871492ebad618c9e1 # v4.3.3
       - name: Check
diff --git a/.github/workflows/update-packages.yml b/.github/workflows/update-packages.yml
index c5ebd6f..93651f6 100644
--- a/.github/workflows/update-packages.yml
+++ b/.github/workflows/update-packages.yml
@@ -7,13 +7,15 @@ on:
     - cron: '0 0 * * 1'
 
 permissions:
-  contents: write
-  pull-requests: write
+  contents: read
 
 jobs:
   check-updates:
     name: Check for Package Updates
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
     steps:
       - name: Checkout
         uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
@@ -41,6 +43,13 @@ jobs:
           echo "update_summary<<EOF" >> $GITHUB_OUTPUT
           echo "${{ steps.check.outputs.update_summary_base64 }}" | base64 -d >> $GITHUB_OUTPUT
           echo "EOF" >> $GITHUB_OUTPUT
+      - name: Fix
+        run: pnpm nx run-many -t fix
+        env:
+          NX_KEY: ${{ secrets.NX_KEY }}
+          AWS_ENDPOINT_URL: ${{ secrets.AWS_ENDPOINT_URL }}
+          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
       - name: Create Pull Request
         if: steps.check.outputs.has_updates == 'true'
         uses: peter-evans/create-pull-request@c5a7806660adbe173f04e3e038b0ccdcd758773c # v7.0.5

From a79c0f9f1bab3609a88869fa32baae4238141440 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Kh=C3=A1nh=20Ho=C3=A0ng?= <hi@khanh.id>
Date: Thu, 6 Nov 2025 07:13:25 +0700
Subject: [PATCH 21/32] Relocate GITHUB_TOKEN env variable to correct step in
 update-packages workflow

---
 .github/workflows/update-packages.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/update-packages.yml b/.github/workflows/update-packages.yml
index 93651f6..905e598 100644
--- a/.github/workflows/update-packages.yml
+++ b/.github/workflows/update-packages.yml
@@ -32,10 +32,10 @@ jobs:
         run: sfw pnpm install
       - name: Check for updates
         id: check
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           node .github/scripts/check-updates.js
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       - name: Decode update summary
         if: steps.check.outputs.has_updates == 'true'
         id: decode

From 95c22e2bd695989802bb910e1a411585a77249d2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Kh=C3=A1nh=20Ho=C3=A0ng?= <hi@khanh.id>
Date: Thu, 6 Nov 2025 07:20:37 +0700
Subject: [PATCH 22/32] Add git add command after pnpm fix in update-packages
 workflow

---
 .github/workflows/update-packages.yml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/update-packages.yml b/.github/workflows/update-packages.yml
index 905e598..a0fd9de 100644
--- a/.github/workflows/update-packages.yml
+++ b/.github/workflows/update-packages.yml
@@ -44,7 +44,9 @@ jobs:
           echo "${{ steps.check.outputs.update_summary_base64 }}" | base64 -d >> $GITHUB_OUTPUT
           echo "EOF" >> $GITHUB_OUTPUT
       - name: Fix
-        run: pnpm nx run-many -t fix
+        run: |
+          pnpm nx run-many -t fix
+          git add .
         env:
           NX_KEY: ${{ secrets.NX_KEY }}
           AWS_ENDPOINT_URL: ${{ secrets.AWS_ENDPOINT_URL }}

From 84024ef624eae307f64d5ebbe887dcd4444fe135 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Thu, 6 Nov 2025 00:34:15 +0000
Subject: [PATCH 23/32] feat: commit updates directly to main instead of
 creating PR

- Replace peter-evans/create-pull-request with direct git commit and push
- Configure git user for commits (github-actions[bot])
- Include update summary in commit message body
- Update permissions to only require contents: write
- Remove pull-requests: write permission

This allows automated updates to be committed directly to main branch
without manual PR review.

Co-authored-by: hckhanh <6380436+hckhanh@users.noreply.github.com>
---
 .github/workflows/update-packages.yml | 32 ++++++++-------------------
 1 file changed, 9 insertions(+), 23 deletions(-)

diff --git a/.github/workflows/update-packages.yml b/.github/workflows/update-packages.yml
index a0fd9de..083bf20 100644
--- a/.github/workflows/update-packages.yml
+++ b/.github/workflows/update-packages.yml
@@ -7,15 +7,12 @@ on:
     - cron: '0 0 * * 1'
 
 permissions:
-  contents: read
+  contents: write
 
 jobs:
   check-updates:
     name: Check for Package Updates
     runs-on: ubuntu-latest
-    permissions:
-      contents: write
-      pull-requests: write
     steps:
       - name: Checkout
         uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
@@ -52,24 +49,13 @@ jobs:
           AWS_ENDPOINT_URL: ${{ secrets.AWS_ENDPOINT_URL }}
           AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
           AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-      - name: Create Pull Request
-        if: steps.check.outputs.has_updates == 'true'
-        uses: peter-evans/create-pull-request@c5a7806660adbe173f04e3e038b0ccdcd758773c # v7.0.5
-        with:
-          token: ${{ secrets.GITHUB_TOKEN }}
-          commit-message: 'chore: update terraform providers'
-          title: 'chore: Update Terraform providers'
-          body: |
-            This PR updates Terraform providers to their latest versions.
-
-            ## Updates
 
-            ${{ steps.decode.outputs.update_summary }}
+      - name: Commit and push changes
+        if: steps.check.outputs.has_updates == 'true'
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          git commit -m "chore: update terraform providers
 
-            ---
-            *This PR was automatically generated by the update-packages workflow*
-          branch: automated/update-providers
-          delete-branch: true
-          labels: |
-            automated
-            dependencies
+          ${{ steps.decode.outputs.update_summary }}"
+          git push

From d6a42a676182aa04c3b26bdd763fd1be1273dd07 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Thu, 6 Nov 2025 00:57:33 +0000
Subject: [PATCH 24/32] refactor: switch from nx release to changesets for
 version management

- Revert workflow to create PRs instead of direct commits to main
- Add @changesets/cli as devDependency
- Initialize changesets with config.json and README
- Update check-updates.js to create changeset markdown files instead of nx release plans
- Changeset files follow the template: package name, bump type, and changelog message
- Each update generates a unique changeset file in .changeset/ directory

This provides better control over version management and follows changeset conventions.

Co-authored-by: hckhanh <6380436+hckhanh@users.noreply.github.com>
---
 .changeset/README.md                  |  8 ++++
 .changeset/config.json                | 11 ++++++
 .github/scripts/check-updates.js      | 53 ++++++++++++---------------
 .github/workflows/update-packages.yml | 32 +++++++++++-----
 package.json                          |  1 +
 5 files changed, 67 insertions(+), 38 deletions(-)
 create mode 100644 .changeset/README.md
 create mode 100644 .changeset/config.json

diff --git a/.changeset/README.md b/.changeset/README.md
new file mode 100644
index 0000000..e5b6d8d
--- /dev/null
+++ b/.changeset/README.md
@@ -0,0 +1,8 @@
+# Changesets
+
+Hello and welcome! This folder has been automatically generated by `@changesets/cli`, a build tool that works
+with multi-package repos, or single-package repos to help you version and publish your code. You can
+find the full documentation for it [in our repository](https://github.com/changesets/changesets)
+
+We have a quick list of common questions to get you started engaging with this project in
+[our documentation](https://github.com/changesets/changesets/blob/main/docs/common-questions.md)
diff --git a/.changeset/config.json b/.changeset/config.json
new file mode 100644
index 0000000..428ac59
--- /dev/null
+++ b/.changeset/config.json
@@ -0,0 +1,11 @@
+{
+  "$schema": "https://unpkg.com/@changesets/config@3.0.3/schema.json",
+  "changelog": "@changesets/cli/changelog",
+  "commit": false,
+  "fixed": [],
+  "linked": [],
+  "access": "public",
+  "baseBranch": "main",
+  "updateInternalDependencies": "patch",
+  "ignore": []
+}
diff --git a/.github/scripts/check-updates.js b/.github/scripts/check-updates.js
index ccd0fd0..4d96400 100755
--- a/.github/scripts/check-updates.js
+++ b/.github/scripts/check-updates.js
@@ -423,41 +423,36 @@ async function main() {
   if (updates.length > 0) {
     console.log(`\nUpdated ${updates.length} package(s)`)
 
-    // Create release plan for each project
+    // Create changeset files for each project
     try {
+      const changesetsDir = path.join(process.cwd(), '.changeset')
+
       for (const update of updates) {
-        // Include changelog in message if available, otherwise use simple update message
-        let releaseMessage = `Update ${update.name} from ${update.oldVersion} to ${update.newVersion} to match upstream terraform provider`
-        if (update.changelog) {
-          releaseMessage += `\n\n${update.changelog}`
-        }
+        // Create changeset message
+        let changesetMessage = update.changelog
+          ? update.changelog
+          : `Update ${update.name} from ${update.oldVersion} to ${update.newVersion}`
 
         console.log(
-          `\nCreating release plan for ${update.projectName} (${update.bumpType})...`,
+          `\nCreating changeset for ${update.name} (${update.bumpType})...`,
         )
 
-        // Use spawnSync to avoid command injection
-        const result = spawnSync(
-          'pnpm',
-          [
-            'nx',
-            'release',
-            'plan',
-            update.bumpType,
-            `--message=${releaseMessage}`,
-            `--projects=${update.projectName}`,
-          ],
-          {
-            stdio: 'inherit',
-            cwd: process.cwd(),
-          },
-        )
+        // Generate a unique filename using timestamp and package name
+        const timestamp = Date.now()
+        const sanitizedName = update.name.replace(/[^a-z0-9]/gi, '-')
+        const changesetFilename = `${sanitizedName}-${timestamp}.md`
+        const changesetPath = path.join(changesetsDir, changesetFilename)
 
-        if (result.status !== 0) {
-          throw new Error(
-            `nx release plan failed for ${update.projectName} with status ${result.status}`,
-          )
-        }
+        // Create changeset content
+        const changesetContent = `---
+'${update.name}': ${update.bumpType}
+---
+
+${changesetMessage}
+`
+
+        fs.writeFileSync(changesetPath, changesetContent)
+        console.log(`  Created changeset: ${changesetFilename}`)
       }
 
       // Stage all changes
@@ -472,7 +467,7 @@ async function main() {
 
       console.log('\nChanges staged successfully')
     } catch (error) {
-      console.error('Error creating release plan:', error)
+      console.error('Error creating changesets:', error)
       process.exit(1)
     }
 
diff --git a/.github/workflows/update-packages.yml b/.github/workflows/update-packages.yml
index 083bf20..a0fd9de 100644
--- a/.github/workflows/update-packages.yml
+++ b/.github/workflows/update-packages.yml
@@ -7,12 +7,15 @@ on:
     - cron: '0 0 * * 1'
 
 permissions:
-  contents: write
+  contents: read
 
 jobs:
   check-updates:
     name: Check for Package Updates
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
     steps:
       - name: Checkout
         uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
@@ -49,13 +52,24 @@ jobs:
           AWS_ENDPOINT_URL: ${{ secrets.AWS_ENDPOINT_URL }}
           AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
           AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-
-      - name: Commit and push changes
+      - name: Create Pull Request
         if: steps.check.outputs.has_updates == 'true'
-        run: |
-          git config user.name "github-actions[bot]"
-          git config user.email "github-actions[bot]@users.noreply.github.com"
-          git commit -m "chore: update terraform providers
+        uses: peter-evans/create-pull-request@c5a7806660adbe173f04e3e038b0ccdcd758773c # v7.0.5
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          commit-message: 'chore: update terraform providers'
+          title: 'chore: Update Terraform providers'
+          body: |
+            This PR updates Terraform providers to their latest versions.
+
+            ## Updates
+
+            ${{ steps.decode.outputs.update_summary }}
 
-          ${{ steps.decode.outputs.update_summary }}"
-          git push
+            ---
+            *This PR was automatically generated by the update-packages workflow*
+          branch: automated/update-providers
+          delete-branch: true
+          labels: |
+            automated
+            dependencies
diff --git a/package.json b/package.json
index 99ef3b7..7eb0a6f 100644
--- a/package.json
+++ b/package.json
@@ -11,6 +11,7 @@
     "release": "nx release --skip-publish"
   },
   "devDependencies": {
+    "@changesets/cli": "2.27.10",
     "@nx/devkit": "22.0.2",
     "@nx/js": "22.0.2",
     "@nx/s3-cache": "4.0.0",

From f2e548baaa4a5190a8a14fd2ad25401a21786c57 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Thu, 6 Nov 2025 01:11:12 +0000
Subject: [PATCH 25/32] feat: use changesets/action for PR creation and
 publishing

- Replace peter-evans/create-pull-request with changesets/action
- Configure changesets/action to create release PRs and publish packages
- Update release script to run nx build and changeset publish
- Add required environment variables (NX_KEY, AWS credentials) to changesets step
- Use github-api commitMode for changesets/action

This integrates the full changesets workflow for version bumping and publishing.

Co-authored-by: hckhanh <6380436+hckhanh@users.noreply.github.com>
---
 .github/workflows/update-packages.yml | 32 +++++++++++----------------
 package.json                          |  2 +-
 2 files changed, 14 insertions(+), 20 deletions(-)

diff --git a/.github/workflows/update-packages.yml b/.github/workflows/update-packages.yml
index a0fd9de..5517983 100644
--- a/.github/workflows/update-packages.yml
+++ b/.github/workflows/update-packages.yml
@@ -52,24 +52,18 @@ jobs:
           AWS_ENDPOINT_URL: ${{ secrets.AWS_ENDPOINT_URL }}
           AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
           AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-      - name: Create Pull Request
+      - name: Create Release Pull Request or Publish to npm
         if: steps.check.outputs.has_updates == 'true'
-        uses: peter-evans/create-pull-request@c5a7806660adbe173f04e3e038b0ccdcd758773c # v7.0.5
+        uses: changesets/action@e0145edc7d9d8679003495b11f87bd8ef63c0cba # v1.5.3
+        id: changesets
         with:
-          token: ${{ secrets.GITHUB_TOKEN }}
-          commit-message: 'chore: update terraform providers'
-          title: 'chore: Update Terraform providers'
-          body: |
-            This PR updates Terraform providers to their latest versions.
-
-            ## Updates
-
-            ${{ steps.decode.outputs.update_summary }}
-
-            ---
-            *This PR was automatically generated by the update-packages workflow*
-          branch: automated/update-providers
-          delete-branch: true
-          labels: |
-            automated
-            dependencies
+          commit: 'chore(release): match upstream terraform providers'
+          title: 'Update packages to match upstream terraform providers'
+          publish: pnpm release
+          commitMode: 'github-api'
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          NX_KEY: ${{ secrets.NX_KEY }}
+          AWS_ENDPOINT_URL: ${{ secrets.AWS_ENDPOINT_URL }}
+          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
diff --git a/package.json b/package.json
index 7eb0a6f..d2271ac 100644
--- a/package.json
+++ b/package.json
@@ -8,7 +8,7 @@
   },
   "private": true,
   "scripts": {
-    "release": "nx release --skip-publish"
+    "release": "nx run-many -t build && changeset publish"
   },
   "devDependencies": {
     "@changesets/cli": "2.27.10",

From 2aff0fca8c0a6cbf37ea8c9e04b685351716b329 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Thu, 6 Nov 2025 01:15:32 +0000
Subject: [PATCH 26/32] feat: add auto-merge for release PRs using rebase

Add a step to automatically merge release PRs created by changesets/action
using rebase merge strategy. The step only runs when a PR is created
(when pullRequestNumber output is available) and uses gh CLI to merge
with --rebase flag and automatically delete the branch after merge.

Co-authored-by: hckhanh <6380436+hckhanh@users.noreply.github.com>
---
 .github/workflows/update-packages.yml | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/.github/workflows/update-packages.yml b/.github/workflows/update-packages.yml
index 5517983..d359407 100644
--- a/.github/workflows/update-packages.yml
+++ b/.github/workflows/update-packages.yml
@@ -67,3 +67,10 @@ jobs:
           AWS_ENDPOINT_URL: ${{ secrets.AWS_ENDPOINT_URL }}
           AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
           AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+
+      - name: Auto-merge release PR
+        if: steps.changesets.outputs.pullRequestNumber != ''
+        run: |
+          gh pr merge ${{ steps.changesets.outputs.pullRequestNumber }} --rebase --delete-branch
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

From 3f18d09120ad54e879f95972c456a307d4dab7a4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Kh=C3=A1nh=20Ho=C3=A0ng?= <hi@khanh.id>
Date: Thu, 6 Nov 2025 08:23:59 +0700
Subject: [PATCH 27/32] Update workflows to refine package publishing steps and
 adjust release process

---
 .github/workflows/publish.yml         | 19 +++++++++++--------
 .github/workflows/update-packages.yml |  3 +--
 2 files changed, 12 insertions(+), 10 deletions(-)

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 268651f..5221c6a 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -30,16 +30,19 @@ jobs:
           mode: firewall
       - name: Install dependencies
         run: sfw pnpm install
-      - name: Build packages
-        run: pnpm nx run-many -t build
+      - name: Update npm
+        run: npm install -g npm@latest
+      - name: Publish to npm
+        uses: changesets/action@e0145edc7d9d8679003495b11f87bd8ef63c0cba # v1.5.3
+        id: changesets
+        with:
+          commit: 'chore(release): match upstream terraform providers'
+          title: 'Update packages to match upstream terraform providers'
+          publish: pnpm release
+          commitMode: 'github-api'
         env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           NX_KEY: ${{ secrets.NX_KEY }}
           AWS_ENDPOINT_URL: ${{ secrets.AWS_ENDPOINT_URL }}
           AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
           AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-      - name: Update npm
-        run: npm install -g npm@latest
-      - name: Publish packages
-        run: pnpm nx release publish
-        env:
-          NX_KEY: ${{ secrets.NX_KEY }}
diff --git a/.github/workflows/update-packages.yml b/.github/workflows/update-packages.yml
index d359407..41d790d 100644
--- a/.github/workflows/update-packages.yml
+++ b/.github/workflows/update-packages.yml
@@ -52,7 +52,7 @@ jobs:
           AWS_ENDPOINT_URL: ${{ secrets.AWS_ENDPOINT_URL }}
           AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
           AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-      - name: Create Release Pull Request or Publish to npm
+      - name: Create Release Pull Request
         if: steps.check.outputs.has_updates == 'true'
         uses: changesets/action@e0145edc7d9d8679003495b11f87bd8ef63c0cba # v1.5.3
         id: changesets
@@ -67,7 +67,6 @@ jobs:
           AWS_ENDPOINT_URL: ${{ secrets.AWS_ENDPOINT_URL }}
           AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
           AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-
       - name: Auto-merge release PR
         if: steps.changesets.outputs.pullRequestNumber != ''
         run: |

From 6ebc66488ee3cf5d0ff0101c657a31b24492502e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Kh=C3=A1nh=20Ho=C3=A0ng?= <hi@khanh.id>
Date: Thu, 6 Nov 2025 08:25:31 +0700
Subject: [PATCH 28/32] Update changeset configuration and dependencies to use
 restricted access and latest schema

---
 .changeset/config.json |   4 +-
 pnpm-lock.yaml         | 662 ++++++++++++++++++++++++++++++++++++++++-
 2 files changed, 662 insertions(+), 4 deletions(-)

diff --git a/.changeset/config.json b/.changeset/config.json
index 428ac59..d88011f 100644
--- a/.changeset/config.json
+++ b/.changeset/config.json
@@ -1,10 +1,10 @@
 {
-  "$schema": "https://unpkg.com/@changesets/config@3.0.3/schema.json",
+  "$schema": "https://unpkg.com/@changesets/config@3.1.1/schema.json",
   "changelog": "@changesets/cli/changelog",
   "commit": false,
   "fixed": [],
   "linked": [],
-  "access": "public",
+  "access": "restricted",
   "baseBranch": "main",
   "updateInternalDependencies": "patch",
   "ignore": []
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index e1f00a3..760c029 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -11,6 +11,9 @@ importers:
 
   .:
     devDependencies:
+      '@changesets/cli':
+        specifier: 2.27.10
+        version: 2.27.10
       '@nx/devkit':
         specifier: 22.0.2
         version: 22.0.2(nx@22.0.2(@swc-node/register@1.11.1(@swc/core@1.14.0(@swc/helpers@0.5.17))(@swc/types@0.1.25)(typescript@5.9.3))(@swc/core@1.14.0(@swc/helpers@0.5.17)))
@@ -878,6 +881,61 @@ packages:
     resolution: {integrity: sha512-bkFqkLhh3pMBUQQkpVgWDWq/lqzc2678eUyDlTBhRqhCHFguYYGM0Efga7tYk4TogG/3x0EEl66/OQ+WGbWB/Q==}
     engines: {node: '>=6.9.0'}
 
+  '@changesets/apply-release-plan@7.0.13':
+    resolution: {integrity: sha512-BIW7bofD2yAWoE8H4V40FikC+1nNFEKBisMECccS16W1rt6qqhNTBDmIw5HaqmMgtLNz9e7oiALiEUuKrQ4oHg==}
+
+  '@changesets/assemble-release-plan@6.0.9':
+    resolution: {integrity: sha512-tPgeeqCHIwNo8sypKlS3gOPmsS3wP0zHt67JDuL20P4QcXiw/O4Hl7oXiuLnP9yg+rXLQ2sScdV1Kkzde61iSQ==}
+
+  '@changesets/changelog-git@0.2.1':
+    resolution: {integrity: sha512-x/xEleCFLH28c3bQeQIyeZf8lFXyDFVn1SgcBiR2Tw/r4IAWlk1fzxCEZ6NxQAjF2Nwtczoen3OA2qR+UawQ8Q==}
+
+  '@changesets/cli@2.27.10':
+    resolution: {integrity: sha512-PfeXjvs9OfQJV8QSFFHjwHX3QnUL9elPEQ47SgkiwzLgtKGyuikWjrdM+lO9MXzOE22FO9jEGkcs4b+B6D6X0Q==}
+    hasBin: true
+
+  '@changesets/config@3.1.1':
+    resolution: {integrity: sha512-bd+3Ap2TKXxljCggI0mKPfzCQKeV/TU4yO2h2C6vAihIo8tzseAn2e7klSuiyYYXvgu53zMN1OeYMIQkaQoWnA==}
+
+  '@changesets/errors@0.2.0':
+    resolution: {integrity: sha512-6BLOQUscTpZeGljvyQXlWOItQyU71kCdGz7Pi8H8zdw6BI0g3m43iL4xKUVPWtG+qrrL9DTjpdn8eYuCQSRpow==}
+
+  '@changesets/get-dependents-graph@2.1.3':
+    resolution: {integrity: sha512-gphr+v0mv2I3Oxt19VdWRRUxq3sseyUpX9DaHpTUmLj92Y10AGy+XOtV+kbM6L/fDcpx7/ISDFK6T8A/P3lOdQ==}
+
+  '@changesets/get-release-plan@4.0.13':
+    resolution: {integrity: sha512-DWG1pus72FcNeXkM12tx+xtExyH/c9I1z+2aXlObH3i9YA7+WZEVaiHzHl03thpvAgWTRaH64MpfHxozfF7Dvg==}
+
+  '@changesets/get-version-range-type@0.4.0':
+    resolution: {integrity: sha512-hwawtob9DryoGTpixy1D3ZXbGgJu1Rhr+ySH2PvTLHvkZuQ7sRT4oQwMh0hbqZH1weAooedEjRsbrWcGLCeyVQ==}
+
+  '@changesets/git@3.0.4':
+    resolution: {integrity: sha512-BXANzRFkX+XcC1q/d27NKvlJ1yf7PSAgi8JG6dt8EfbHFHi4neau7mufcSca5zRhwOL8j9s6EqsxmT+s+/E6Sw==}
+
+  '@changesets/logger@0.1.1':
+    resolution: {integrity: sha512-OQtR36ZlnuTxKqoW4Sv6x5YIhOmClRd5pWsjZsddYxpWs517R0HkyiefQPIytCVh4ZcC5x9XaG8KTdd5iRQUfg==}
+
+  '@changesets/parse@0.4.1':
+    resolution: {integrity: sha512-iwksMs5Bf/wUItfcg+OXrEpravm5rEd9Bf4oyIPL4kVTmJQ7PNDSd6MDYkpSJR1pn7tz/k8Zf2DhTCqX08Ou+Q==}
+
+  '@changesets/pre@2.0.2':
+    resolution: {integrity: sha512-HaL/gEyFVvkf9KFg6484wR9s0qjAXlZ8qWPDkTyKF6+zqjBe/I2mygg3MbpZ++hdi0ToqNUF8cjj7fBy0dg8Ug==}
+
+  '@changesets/read@0.6.5':
+    resolution: {integrity: sha512-UPzNGhsSjHD3Veb0xO/MwvasGe8eMyNrR/sT9gR8Q3DhOQZirgKhhXv/8hVsI0QpPjR004Z9iFxoJU6in3uGMg==}
+
+  '@changesets/should-skip-package@0.1.2':
+    resolution: {integrity: sha512-qAK/WrqWLNCP22UDdBTMPH5f41elVDlsNyat180A33dWxuUDyNpg6fPi/FyTZwRriVjg0L8gnjJn2F9XAoF0qw==}
+
+  '@changesets/types@4.1.0':
+    resolution: {integrity: sha512-LDQvVDv5Kb50ny2s25Fhm3d9QSZimsoUGBsUioj6MC3qbMUCuC8GPIvk/M6IvXx3lYhAs0lwWUQLb+VIEUCECw==}
+
+  '@changesets/types@6.1.0':
+    resolution: {integrity: sha512-rKQcJ+o1nKNgeoYRHKOS07tAMNd3YSN0uHaJOZYjBAgxfV7TUE7JE+z4BzZdQwb5hKaYbayKN5KrYV7ODb2rAA==}
+
+  '@changesets/write@0.3.2':
+    resolution: {integrity: sha512-kDxDrPNpUgsjDbWBvUo27PzKX4gqeKOlhibaOXDJA6kuBisGqNHv/HwGJrAu8U/dSf8ZEFIeHIPtvSlZI1kULw==}
+
   '@emnapi/core@1.4.5':
     resolution: {integrity: sha512-XsLw1dEOpkSX/WucdqUhPWP7hDxSvZiY+fsUC14h+FtQ2Ifni4znbBt8punRX+Uj2JG/uDb8nEHVKvrVlvdZ5Q==}
 
@@ -1094,12 +1152,30 @@ packages:
     resolution: {integrity: sha512-XGSsWDweP80Fks16lwkAUIr54ICyBs6PsI4mpfTLQaWgEJRtY9xEV+PeyDpJ+sJEGZxqINlpmAwe/6tS1pP8Ng==}
     engines: {node: '>=10.3.0'}
 
+  '@manypkg/find-root@1.1.0':
+    resolution: {integrity: sha512-mki5uBvhHzO8kYYix/WRy2WX8S3B5wdVSc9D6KcU5lQNglP2yt58/VfLuAK49glRXChosY8ap2oJ1qgma3GUVA==}
+
+  '@manypkg/get-packages@1.1.3':
+    resolution: {integrity: sha512-fo+QhuU3qE/2TQMQmbVMqaQ6EWbMhi4ABWP+O4AM1NqPBuy0OrApV5LO6BrrgnhtAHS2NH6RrVk9OL181tTi8A==}
+
   '@napi-rs/wasm-runtime@0.2.4':
     resolution: {integrity: sha512-9zESzOO5aDByvhIAsOy9TbpZ0Ur2AJbUI7UT73kcUTS2mxAMHOBaa1st/jAymNoCtvrit99kkzT1FZuXVcgfIQ==}
 
   '@napi-rs/wasm-runtime@1.0.3':
     resolution: {integrity: sha512-rZxtMsLwjdXkMUGC3WwsPwLNVqVqnTJT6MNIB6e+5fhMcSCPP0AOsNWuMQ5mdCq6HNjs/ZeWAEchpqeprqBD2Q==}
 
+  '@nodelib/fs.scandir@2.1.5':
+    resolution: {integrity: sha512-vq24Bq3ym5HEQm2NKCr3yXDwjc7vTsEThRDnkp2DK9p1uqLR+DHurm/NOTo0KG7HYHU7eppKZj3MyqYuMBf62g==}
+    engines: {node: '>= 8'}
+
+  '@nodelib/fs.stat@2.0.5':
+    resolution: {integrity: sha512-RkhPPp2zrqDAQA/2jNhnztcPAlv64XdhIp7a7454A5ovI7Bukxgt7MX7udwAu3zg1DcpPU0rz3VV1SeaqvY4+A==}
+    engines: {node: '>= 8'}
+
+  '@nodelib/fs.walk@1.2.8':
+    resolution: {integrity: sha512-oGB+UxlgWcgQkgwo8GcEGwemoTFt3FIO9ababBmaGwXIoBKZ+GTy0pP185beGg7Llih/NSHSV2XAs1lnznocSg==}
+    engines: {node: '>= 8'}
+
   '@npmcli/agent@2.2.2':
     resolution: {integrity: sha512-OrcNPXdpSl9UX7qPVRWbmWMCSXrcDa2M9DvrbOTj7ao1S4PlqVFYv9/yLKMkrJKZ/V5A/kDBC690or307i26Og==}
     engines: {node: ^16.14.0 || >=18.0.0}
@@ -1199,24 +1275,28 @@ packages:
     engines: {node: '>= 10'}
     cpu: [arm64]
     os: [linux]
+    libc: [glibc]
 
   '@nx/key-linux-arm64-musl@4.0.0':
     resolution: {integrity: sha512-UKqaA0tNaqYCNFOAXwdZsozl09eIrLg3JwDu4N3U0Z8NQAQoqfOacDq/23d9D7lO+uR7Umsi7xl5h578MPrTKQ==}
     engines: {node: '>= 10'}
     cpu: [arm64]
     os: [linux]
+    libc: [musl]
 
   '@nx/key-linux-x64-gnu@4.0.0':
     resolution: {integrity: sha512-RC4FpcJ+72J8NgJnhwx4XyO1xm0zHzZKe3Wz3xg2LAUj/h/RVWJmqiSVcAItZcBk0XNEvJXR9YlKkT615+Y//A==}
     engines: {node: '>= 10'}
     cpu: [x64]
     os: [linux]
+    libc: [glibc]
 
   '@nx/key-linux-x64-musl@4.0.0':
     resolution: {integrity: sha512-GNORZAgYLPm1I3sJSLukbBv3ac4ctbN1HsPBPzrSxHJygr6R/AaLGEmCVlhOgl2eD+x47Dqcg5WonuY9nwfl8Q==}
     engines: {node: '>= 10'}
     cpu: [x64]
     os: [linux]
+    libc: [musl]
 
   '@nx/key-win32-arm64-msvc@4.0.0':
     resolution: {integrity: sha512-liOMgjzIZbAtePSSpwPER7QIcUTuf883UAFpaQ8v/6w8egysKbJNEOmBk+ANig6/zJ5p6I0S4a7B8J/gUk0tXg==}
@@ -1258,21 +1338,25 @@ packages:
     resolution: {integrity: sha512-aaWUYXFaB9ztrICg0WHuz0tzoil+OkSpWi+wtM9PsV+vNQTYWIPclO+OpSp4am68/bdtuMuITOH99EvEIfv7ZA==}
     cpu: [arm64]
     os: [linux]
+    libc: [glibc]
 
   '@nx/nx-linux-arm64-musl@22.0.2':
     resolution: {integrity: sha512-ylT5GBJCUpTXp5ud8f/uRyW9OA2KR65nuFQ5iXNf1KXwfjGuinFDvZEDDj0zGQ4E/PwLrInqBkkSH25Ry99lOQ==}
     cpu: [arm64]
     os: [linux]
+    libc: [musl]
 
   '@nx/nx-linux-x64-gnu@22.0.2':
     resolution: {integrity: sha512-N8beYlkdKbAC5CA3i5WoqUUbbsSO/0cQk3gMW7c41bouqdMWDUKG6m50d4yHk8V7RFC+sqY59tso3rYmXW3big==}
     cpu: [x64]
     os: [linux]
+    libc: [glibc]
 
   '@nx/nx-linux-x64-musl@22.0.2':
     resolution: {integrity: sha512-Q0joIxZHs9JVr/+6x1bee7z+7Z4SoO0mbhADuugjxly50O44Igg+rx78Iou00VrtSR+Ht5NlpILxOe4GhpFCpA==}
     cpu: [x64]
     os: [linux]
+    libc: [musl]
 
   '@nx/nx-win32-arm64-msvc@22.0.2':
     resolution: {integrity: sha512-/4FXsBh+SB6fKFeVBFptPPWJIeFPQWmK29Q+XLrjYW/31bOs1k2uwn+7QYX0D+Z4HiME3iiRdAInFD9pVlyZbQ==}
@@ -1407,41 +1491,49 @@ packages:
     resolution: {integrity: sha512-SjwhNynjSG2yMdyA0f7wz7Yvo3ppejO+ET7n2oiI7ApCXrwxMzeRWjBzQt+oVWr2HzVOfaEcDS9rMtnR83ulig==}
     cpu: [arm64]
     os: [linux]
+    libc: [glibc]
 
   '@oxc-resolver/binding-linux-arm64-musl@11.6.1':
     resolution: {integrity: sha512-f4EMidK6rosInBzPMnJ0Ri4RttFCvvLNUNDFUBtELW/MFkBwPTDlvbsmW0u0Mk/ruBQ2WmRfOZ6tT62kWMcX2Q==}
     cpu: [arm64]
     os: [linux]
+    libc: [musl]
 
   '@oxc-resolver/binding-linux-ppc64-gnu@11.6.1':
     resolution: {integrity: sha512-1umENVKeUsrWnf5IlF/6SM7DCv8G6CoKI2LnYR6qhZuLYDPS4PBZ0Jow3UDV9Rtbv5KRPcA3/uXjI88ntWIcOQ==}
     cpu: [ppc64]
     os: [linux]
+    libc: [glibc]
 
   '@oxc-resolver/binding-linux-riscv64-gnu@11.6.1':
     resolution: {integrity: sha512-Hjyp1FRdJhsEpIxsZq5VcDuFc8abC0Bgy8DWEa31trCKoTz7JqA7x3E2dkFbrAKsEFmZZ0NvuG5Ip3oIRARhow==}
     cpu: [riscv64]
     os: [linux]
+    libc: [glibc]
 
   '@oxc-resolver/binding-linux-riscv64-musl@11.6.1':
     resolution: {integrity: sha512-ODJOJng6f3QxpAXhLel3kyWs8rPsJeo9XIZHzA7p//e+5kLMDU7bTVk4eZnUHuxsqsB8MEvPCicJkKCEuur5Ag==}
     cpu: [riscv64]
     os: [linux]
+    libc: [musl]
 
   '@oxc-resolver/binding-linux-s390x-gnu@11.6.1':
     resolution: {integrity: sha512-hCzRiLhqe1ZOpHTsTGKp7gnMJRORlbCthawBueer2u22RVAka74pV/+4pP1tqM07mSlQn7VATuWaDw9gCl+cVg==}
     cpu: [s390x]
     os: [linux]
+    libc: [glibc]
 
   '@oxc-resolver/binding-linux-x64-gnu@11.6.1':
     resolution: {integrity: sha512-JansPD8ftOzMYIC3NfXJ68tt63LEcIAx44Blx6BAd7eY880KX7A0KN3hluCrelCz5aQkPaD95g8HBiJmKaEi2w==}
     cpu: [x64]
     os: [linux]
+    libc: [glibc]
 
   '@oxc-resolver/binding-linux-x64-musl@11.6.1':
     resolution: {integrity: sha512-R78ES1rd4z2x5NrFPtSWb/ViR1B8wdl+QN2X8DdtoYcqZE/4tvWtn9ZTCXMEzUp23tchJ2wUB+p6hXoonkyLpA==}
     cpu: [x64]
     os: [linux]
+    libc: [musl]
 
   '@oxc-resolver/binding-wasm32-wasi@11.6.1':
     resolution: {integrity: sha512-qAR3tYIf3afkij/XYunZtlz3OH2Y4ni10etmCFIJB5VRGsqJyI6Hl+2dXHHGJNwbwjXjSEH/KWJBpVroF3TxBw==}
@@ -1799,24 +1891,28 @@ packages:
     engines: {node: '>=10'}
     cpu: [arm64]
     os: [linux]
+    libc: [glibc]
 
   '@swc/core-linux-arm64-musl@1.14.0':
     resolution: {integrity: sha512-uofpVoPCEUjYIv454ZEZ3sLgMD17nIwlz2z7bsn7rl301Kt/01umFA7MscUovFfAK2IRGck6XB+uulMu6aFhKQ==}
     engines: {node: '>=10'}
     cpu: [arm64]
     os: [linux]
+    libc: [musl]
 
   '@swc/core-linux-x64-gnu@1.14.0':
     resolution: {integrity: sha512-quTTx1Olm05fBfv66DEBuOsOgqdypnZ/1Bh3yGXWY7ANLFeeRpCDZpljD9BSjdsNdPOlwJmEUZXMHtGm3v1TZQ==}
     engines: {node: '>=10'}
     cpu: [x64]
     os: [linux]
+    libc: [glibc]
 
   '@swc/core-linux-x64-musl@1.14.0':
     resolution: {integrity: sha512-caaNAu+aIqT8seLtCf08i8C3/UC5ttQujUjejhMcuS1/LoCKtNiUs4VekJd2UGt+pyuuSrQ6dKl8CbCfWvWeXw==}
     engines: {node: '>=10'}
     cpu: [x64]
     os: [linux]
+    libc: [musl]
 
   '@swc/core-win32-arm64-msvc@1.14.0':
     resolution: {integrity: sha512-EeW3jFlT3YNckJ6V/JnTfGcX7UHGyh6/AiCPopZ1HNaGiXVCKHPpVQZicmtyr/UpqxCXLrTgjHOvyMke7YN26A==}
@@ -1884,6 +1980,9 @@ packages:
   '@types/keyv@3.1.4':
     resolution: {integrity: sha512-BQ5aZNSCpj7D6K2ksrRCTmKRLEpnPvWDiLPfoGyhZ++8YtiK9d/3DBKPJgry359X/P1PfruyYwvnvwFjuEiEIg==}
 
+  '@types/node@12.20.55':
+    resolution: {integrity: sha512-J8xLz7q2OFulZ2cyGTLE1TbbZcjpno7FaN6zdJNrgAdrJ+DZzh/uFR6YrTb4C+nXakvud8Q4+rbhoIWlYQbUFQ==}
+
   '@types/node@24.9.2':
     resolution: {integrity: sha512-uWN8YqxXxqFMX2RqGOrumsKeti4LlmIMIyV0lgut4jx7KQBcBiW6vkDtIBvHnHIquwNfJhk8v2OtmO8zXWHfPA==}
 
@@ -1972,6 +2071,10 @@ packages:
   argparse@2.0.1:
     resolution: {integrity: sha512-8+9WqebbFzpX9OR+Wa6O29asIogeRMzcGtAINdpMHHyAg10f05aSFVBbcEqGf/PXw1EjAZ+q2/bEBg3DvurK3Q==}
 
+  array-union@2.1.0:
+    resolution: {integrity: sha512-HGyxoOTYUyCM6stUe6EJgnd4EoewAI7zMdfqO+kGjnlZmBDz/cR5pf8r/cR4Wq60sL/p0IkcjUEEPwS3GFrIyw==}
+    engines: {node: '>=8'}
+
   async-mutex@0.5.0:
     resolution: {integrity: sha512-1A94B18jkJ3DYq284ohPxoXbfTA5HsQ7/Mf4DEhcyLx3Bz27Rh59iScbB6EPiP+B+joue6YCxcMXSbFC1tZKwA==}
 
@@ -2038,6 +2141,10 @@ packages:
     resolution: {integrity: sha512-wrH5NNqren/QMtKUEEJf7z86YjfqW/2uw3IL3/xpqZUC95SSVIFXYQeeGjL6FT/X68IROu6RMehZQS5foy2BXw==}
     hasBin: true
 
+  better-path-resolve@1.0.0:
+    resolution: {integrity: sha512-pbnl5XzGBdrFU/wT4jqmJVPn2B6UHPBOhzMQkY/SPUPB6QtUXtmBHBIwCbXJol93mOpGMnQyP/+BB19q04xj7g==}
+    engines: {node: '>=4'}
+
   bin-links@4.0.4:
     resolution: {integrity: sha512-cMtq4W5ZsEwcutJrVId+a/tjt8GSbS+h0oNkdl6+6rBuEv8Ot33Bevj5KPm40t309zuhVic8NjpuL42QCiJWWA==}
     engines: {node: ^14.17.0 || ^16.13.0 || >=18.0.0}
@@ -2051,6 +2158,10 @@ packages:
   brace-expansion@2.0.2:
     resolution: {integrity: sha512-Jt0vHyM+jmUBqojB7E1NIYadt0vI0Qxjxd2TErW94wDz+E2LAm5vKMXXwg6ZZBTHPuUlDgQHKXvjGBdfcF1ZDQ==}
 
+  braces@3.0.3:
+    resolution: {integrity: sha512-yQbXgO/OSZVD2IsiLlro+7Hf6Q18EJrKSEsdoMzKePKXct3gvD8oLcOQdIzGupr5Fj+EDe8gO/lxc1BzfMpxvA==}
+    engines: {node: '>=8'}
+
   browserslist@4.26.2:
     resolution: {integrity: sha512-ECFzp6uFOSB+dcZ5BK/IBaGWssbSYBHvuMeMt3MMFyhI0Z8SqGgEkBLARgpRH3hutIgPVsALcMwbDrJqPxQ65A==}
     engines: {node: ^6 || ^7 || ^8 || ^9 || ^10 || ^11 || ^12 || >=13.7}
@@ -2092,10 +2203,17 @@ packages:
     resolution: {integrity: sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==}
     engines: {node: '>=10'}
 
+  chardet@0.7.0:
+    resolution: {integrity: sha512-mT8iDcrh03qDGRRmoA2hmBJnxpllMR+0/0qlzjqZES6NdiWDcZkCNAk4rPFZ9Q85r27unkiNNg8ZOiwZXBHwcA==}
+
   chownr@2.0.0:
     resolution: {integrity: sha512-bIomtDF5KGpdogkLd9VspvFzk9KfpyyGlS8YFVZl7TGPBHL5snIOnxeshwVgPteQ9b4Eydl+pVbIyE1DcvCWgQ==}
     engines: {node: '>=10'}
 
+  ci-info@3.9.0:
+    resolution: {integrity: sha512-NIxF55hv4nSqQswkAeiOi1r83xy8JldOFDTWiug55KBu9Jnblncd2U6ViHmYgHf01TPZS77NJBhBMKdWj9HQMQ==}
+    engines: {node: '>=8'}
+
   cjs-module-lexer@1.4.3:
     resolution: {integrity: sha512-9z8TZaGM1pfswYeXrUpzPrkx8UnWYdhJclsiYMm6x/w5+nN+8Tf/LnAgfLGQCm59qAOxU8WwHEq2vNwF6i4j+Q==}
 
@@ -2194,11 +2312,19 @@ packages:
     resolution: {integrity: sha512-ZySD7Nf91aLB0RxL4KGrKHBXl7Eds1DAmEdcoVawXnLD7SDhpNgtuII2aAkg7a7QS41jxPSZ17p4VdGnMHk3MQ==}
     engines: {node: '>=0.4.0'}
 
+  detect-indent@6.1.0:
+    resolution: {integrity: sha512-reYkTUJAZb9gUuZ2RvVCNhVHdg62RHnJ7WJl8ftMi4diZ6NWlciOzQN88pUhSELEwflJht4oQDv0F0BMlwaYtA==}
+    engines: {node: '>=8'}
+
   detect-port@1.6.1:
     resolution: {integrity: sha512-CmnVc+Hek2egPx1PeTFVta2W78xy2K/9Rkf6cC4T59S50tVnzKj+tnx5mmx5lwvCkujZ4uRrpRSuV+IVs3f90Q==}
     engines: {node: '>= 4.0.0'}
     hasBin: true
 
+  dir-glob@3.0.1:
+    resolution: {integrity: sha512-WkrWp9GR4KXfKGYzOLmTuGVi1UWFfws377n9cc55/tb6DuqyF6pcQ5AbiHEshaDpY9v6oaSr2XCDidGmMwdzIA==}
+    engines: {node: '>=8'}
+
   dotenv-expand@11.0.7:
     resolution: {integrity: sha512-zIHwmZPRshsCdpMDyVsqGmgyP0yT8GAgXUnkdAoJisxvf33k7yO6OuoKmcTGuXPWSsm8Oh88nZicRLA9Y0rUeA==}
     engines: {node: '>=12'}
@@ -2301,13 +2427,27 @@ packages:
   exponential-backoff@3.1.2:
     resolution: {integrity: sha512-8QxYTVXUkuy7fIIoitQkPwGonB8F3Zj8eEO8Sqg9Zv/bkI7RJAzowee4gr81Hak/dUTpA2Z7VfQgoijjPNlUZA==}
 
+  extendable-error@0.1.7:
+    resolution: {integrity: sha512-UOiS2in6/Q0FK0R0q6UY9vYpQ21mr/Qn1KOnte7vsACuNJf514WvCCUHSRCPcgjPT2bAhNIJdlE6bVap1GKmeg==}
+
+  external-editor@3.1.0:
+    resolution: {integrity: sha512-hMQ4CX1p1izmuLYyZqLMO/qGNw10wSv9QDCPfzXfyFrOaCSSoRfqE1Kf1s5an66J5JZC62NewG+mK49jOCtQew==}
+    engines: {node: '>=4'}
+
   fast-fifo@1.3.2:
     resolution: {integrity: sha512-/d9sfos4yxzpwkDkuN7k2SqFKtYNmCTzgfEpz82x34IM9/zc8KGxQoXg1liNC/izpRM/MBdt44Nmx41ZWqk+FQ==}
 
+  fast-glob@3.3.3:
+    resolution: {integrity: sha512-7MptL8U0cqcFdzIzwOTHoilX9x5BrNqye7Z/LuC7kCMRio1EMSyqRK3BEAUD7sXRq4iT4AzTVuZdhgQ2TCvYLg==}
+    engines: {node: '>=8.6.0'}
+
   fast-xml-parser@4.4.1:
     resolution: {integrity: sha512-xkjOecfnKGkSsOwtZ5Pz7Us/T6mrbPQrq0nh+aCO5V9nk5NLWmasAHumTKjiPJPWANe+kAZ84Jc8ooJkzZ88Sw==}
     hasBin: true
 
+  fastq@1.19.1:
+    resolution: {integrity: sha512-GwLTyxkCXjXbxqIhTsMI2Nui8huMPtnxg7krajPJAjnEG/iiOS7i+zCtWGZR9G0NBKbXKh6X9m9UIsYX/N6vvQ==}
+
   fdir@6.5.0:
     resolution: {integrity: sha512-tIbYtZbucOs0BRGqPJkshJUYdL+SDH7dVM8gjy+ERp3WAUjLEFJE+02kanyHtwjWOnwrKYBiwAmM0p4kLJAnXg==}
     engines: {node: '>=12.0.0'}
@@ -2324,6 +2464,14 @@ packages:
   filelist@1.0.4:
     resolution: {integrity: sha512-w1cEuf3S+DrLCQL7ET6kz+gmlJdbq9J7yXCSjK/OZCPA+qEN1WyF4ZAf0YYJa4/shHJra2t/d/r8SV4Ji+x+8Q==}
 
+  fill-range@7.1.1:
+    resolution: {integrity: sha512-YsGpe3WHLK8ZYi4tWDg2Jy3ebRz2rXowDxnld4bkQB00cc/1Zw9AWnC0i9ztDJitivtQvaI9KaLyKrc+hBW0yg==}
+    engines: {node: '>=8'}
+
+  find-up@4.1.0:
+    resolution: {integrity: sha512-PpOwAdQ/YlXQ2vj8a3h8IipDuYRi3wceVQQGYWxNINccq40Anw7BlsEXCMbt1Zt+OLA6Fq9suIpIWD0OsnISlw==}
+    engines: {node: '>=8'}
+
   find-up@6.3.0:
     resolution: {integrity: sha512-v2ZsoEuVHYy8ZIlYqwPe/39Cy+cFDzp4dXPaxNvkEuouymu+2Jbz0PxpKarJHYJTmv2HWT3O382qY8l4jMWthw==}
     engines: {node: ^12.20.0 || ^14.13.1 || >=16.0.0}
@@ -2355,6 +2503,14 @@ packages:
   fs-constants@1.0.0:
     resolution: {integrity: sha512-y6OAwoSIf7FyjMIv94u+b5rdheZEjzR63GTyZJm5qh4Bi+2YgwLCcI/fPFZkL5PSixOt6ZNKm+w+Hfp/Bciwow==}
 
+  fs-extra@7.0.1:
+    resolution: {integrity: sha512-YJDaCJZEnBmcbw13fvdAM9AwNOJwOzrE4pqMqBq5nFiEqXUqHwlK4B+3pUw6JNvfSPtX05xFHtYy/1ni01eGCw==}
+    engines: {node: '>=6 <7 || >=8'}
+
+  fs-extra@8.1.0:
+    resolution: {integrity: sha512-yhlQgA6mnOJUKOsRUFsgJdQCvkKhcz8tlZG5HBQfReYZy46OwLcY+Zia0mtdHsOo9y/hP+CxMN0TU9QxoOtG4g==}
+    engines: {node: '>=6 <7 || >=8'}
+
   fs-minipass@2.1.0:
     resolution: {integrity: sha512-V/JgOLFCS+R6Vcq0slCuaeWEdNC3ouDlJMNIsacH2VtALiu9mV4LPrHc5cDl8k5aw6J8jwgWWpiTo5RYhmIzvg==}
     engines: {node: '>= 8'}
@@ -2398,10 +2554,18 @@ packages:
   get-tsconfig@4.10.1:
     resolution: {integrity: sha512-auHyJ4AgMz7vgS8Hp3N6HXSmlMdUyhSUrfBF16w153rxtLIEOE+HGqaBppczZvnHLqQJfiHotCYpNhl0lUROFQ==}
 
+  glob-parent@5.1.2:
+    resolution: {integrity: sha512-AOIgSQCepiJYwP3ARnGx+5VnTu2HBYdzbGP45eLw1vr3zB3vZLeyed1sC9hnbcOc9/SrMyM5RPQrkGz4aS9Zow==}
+    engines: {node: '>= 6'}
+
   glob@10.4.5:
     resolution: {integrity: sha512-7Bv8RF0k6xjo7d4A/PxYLbUCfb6c+Vpd2/mB2yRDlew7Jb5hEXiCD9ibfO7wpk8i4sevK6DFny9h7EYbM3/sHg==}
     hasBin: true
 
+  globby@11.1.0:
+    resolution: {integrity: sha512-jhIXaOzy1sb8IyocaruWSn1TjmnBVs8Ayhcy83rmxNJ8q2uWKCAj3CnJY+KpGSXCueAPc0i05kVvVKtP1t9S3g==}
+    engines: {node: '>=10'}
+
   google-protobuf@3.21.4:
     resolution: {integrity: sha512-MnG7N936zcKTco4Jd2PX2U96Kf9PxygAPKBug+74LHzmHXmceN16MmRcdgZv+DGef/S9YvQAfRsNCn4cjf9yyQ==}
 
@@ -2451,10 +2615,17 @@ packages:
     resolution: {integrity: sha512-vK9P5/iUfdl95AI+JVyUuIcVtd4ofvtrOr3HNtM2yxC9bnMbEdp3x01OhQNnjb8IJYi38VlTE3mBXwcfvywuSw==}
     engines: {node: '>= 14'}
 
+  human-id@1.0.2:
+    resolution: {integrity: sha512-UNopramDEhHJD+VR+ehk8rOslwSfByxPIZyJRfV739NDhN5LF1fa1MqnzKm2lGTQRjNrjK19Q5fhkgIfjlVUKw==}
+
   human-signals@2.1.0:
     resolution: {integrity: sha512-B4FFZ6q/T2jhhksgkbEW3HBvWIfDW85snkQgawt07S7J5QXTk6BkNV+0yAeZrM5QpMAdYlocGoljn0sJ/WQkFw==}
     engines: {node: '>=10.17.0'}
 
+  iconv-lite@0.4.24:
+    resolution: {integrity: sha512-v3MXnZAcvnywkTUEZomIActle7RXXeedOR31wwl7VlyoXO4Qi9arvSenNQWne1TcRwhCL1HwLI21bEqdpj8/rA==}
+    engines: {node: '>=0.10.0'}
+
   iconv-lite@0.6.3:
     resolution: {integrity: sha512-4fCk79wshMdzMp2rH06qWrJE4iolqLhCUH+OiuIgU++RB0+94NlDL81atO7GX55uUKueo0txHNtvEyI6D7WdMw==}
     engines: {node: '>=0.10.0'}
@@ -2516,10 +2687,18 @@ packages:
     engines: {node: '>=8'}
     hasBin: true
 
+  is-extglob@2.1.1:
+    resolution: {integrity: sha512-SbKbANkN603Vi4jEZv49LeVJMn4yGwsbzZworEoyEiutsN3nJYdbO36zfhGJ6QEDpOZIFkDtnq5JRxmvl3jsoQ==}
+    engines: {node: '>=0.10.0'}
+
   is-fullwidth-code-point@3.0.0:
     resolution: {integrity: sha512-zymm5+u+sCsSWyD9qNaejV3DFvhCKclKdizYaJUuHA83RLjb7nSuGnddCHGv0hk+KY7BMAlsWeK4Ueg6EV6XQg==}
     engines: {node: '>=8'}
 
+  is-glob@4.0.3:
+    resolution: {integrity: sha512-xelSayHH36ZgE7ZWhli7pW34hNbNl8Ojv5KVmkJD4hBdD3th8Tfk9vYasLM+mXWOZhFkgZfxhLSnrwRr4elSSg==}
+    engines: {node: '>=0.10.0'}
+
   is-interactive@1.0.0:
     resolution: {integrity: sha512-2HvIEKRoqS62guEC+qBjpvRubdX910WCMuJTZ+I9yvqKU2/12eSL549HMwtabb4oupdj2sMP50k+XJfB/8JE6w==}
     engines: {node: '>=8'}
@@ -2527,6 +2706,10 @@ packages:
   is-lambda@1.0.1:
     resolution: {integrity: sha512-z7CMFGNrENq5iFB9Bqo64Xk6Y9sg+epq1myIcdHaGnbMTYOxvzsEtdYqQUylB7LxfkvgrrjP32T6Ywciio9UIQ==}
 
+  is-number@7.0.0:
+    resolution: {integrity: sha512-41Cifkg6e8TylSpdtTpeLVMqvSBEVzTttHvERD741+pnZ8ANv0004MRL43QKPDlK9cGvNp6NZWZUBlbGXYxxng==}
+    engines: {node: '>=0.12.0'}
+
   is-retry-allowed@2.2.0:
     resolution: {integrity: sha512-XVm7LOeLpTW4jV19QSH38vkswxoLud8sQ57YwJVTPWdiaI9I8keEhGFpBlslyVsgdQy4Opg8QOLb8YRgsyZiQg==}
     engines: {node: '>=10'}
@@ -2535,10 +2718,18 @@ packages:
     resolution: {integrity: sha512-hFoiJiTl63nn+kstHGBtewWSKnQLpyb155KHheA1l39uvtO9nWIop1p3udqPcUd/xbF1VLMO4n7OI6p7RbngDg==}
     engines: {node: '>=8'}
 
+  is-subdir@1.2.0:
+    resolution: {integrity: sha512-2AT6j+gXe/1ueqbW6fLZJiIw3F8iXGJtt0yDrZaBhAZEG1raiTxKWU+IPqMCzQAXOUCKdA4UDMgacKH25XG2Cw==}
+    engines: {node: '>=4'}
+
   is-unicode-supported@0.1.0:
     resolution: {integrity: sha512-knxG2q4UC3u8stRGyAVJCOdxFmv5DZiRcdlIaAQXAbSfJya+OhopNotLQrstBhququ4ZpuKbDc/8S6mgXgPFPw==}
     engines: {node: '>=10'}
 
+  is-windows@1.0.2:
+    resolution: {integrity: sha512-eXK1UInq2bPmjyX6e3VHIzMLobc4J94i4AWn+Hpq3OU5KkrRC96OAcR3PRJ/pGu6m8TRnBHP9dkXQVsT/COVIA==}
+    engines: {node: '>=0.10.0'}
+
   is-wsl@2.2.0:
     resolution: {integrity: sha512-fKzAra0rGJUUBwGBgNkHZuToZcn+TtXHpeCgmkMJMMYx1sQDYaCSyjJBSCa2nH1DGm7s3n1oBnohoVTBaN7Lww==}
     engines: {node: '>=8'}
@@ -2598,6 +2789,9 @@ packages:
   jsonc-parser@3.2.0:
     resolution: {integrity: sha512-gfFQZrcTc8CnKXp6Y4/CBT3fTc0OVuDofpre4aEeEpSBPV5X5v4+Vmx+8snU7RLPrNHPKSgLxGo9YuQzz20o+w==}
 
+  jsonfile@4.0.0:
+    resolution: {integrity: sha512-m6F1R3z8jjlf2imQHS2Qez5sjKWQzbuuhuJ/FKYFRZvPE3PuHcSMVZzfsLhGVOkfd20obL5SWEBew5ShlquNxg==}
+
   jsonparse@1.3.1:
     resolution: {integrity: sha512-POQXvpdL69+CluYsillJ7SUhKvytYjW9vG/GKpnf+xP8UWgYEM/RaMzHHofbALDiKbbP1W8UEYmgGl39WkPZsg==}
     engines: {'0': node >= 0.2.0}
@@ -2618,6 +2812,10 @@ packages:
     resolution: {integrity: sha512-cNOjgCnLB+FnvWWtyRTzmB3POJ+cXxTA81LoW7u8JdmhfXzriropYwpjShnz1QLLWsQwY7nIxoDmcPTwphDK9w==}
     engines: {node: ^12.20.0 || ^14.13.1 || >=16.0.0}
 
+  locate-path@5.0.0:
+    resolution: {integrity: sha512-t7hw9pI+WvuwNJXwk5zVHpyhIqzg2qTlklJOf0mVxGSbe3Fp2VieZcduNYjaLDoy6p9uGpQEGWG87WpMKlNq8g==}
+    engines: {node: '>=8'}
+
   locate-path@7.2.0:
     resolution: {integrity: sha512-gvVijfZvn7R+2qyPX8mAuKcFGDf6Nc61GdvGafQsHL0sBIxfKzA+usWn4GFC/bk+QdwPUD4kWFJLhElipq+0VA==}
     engines: {node: ^12.20.0 || ^14.13.1 || >=16.0.0}
@@ -2628,6 +2826,9 @@ packages:
   lodash.debounce@4.0.8:
     resolution: {integrity: sha512-FT1yDzDYEoYWhnSGnpE/4Kj1fLZkDFyqRb7fNt6FdYOSxlUWAtp42Eh6Wb0rGIv/m9Bgo7x4GhQbm5Ys4SG5ow==}
 
+  lodash.startcase@4.4.0:
+    resolution: {integrity: sha512-+WKqsK294HMSc2jEbNgpHpd0JfIBhp7rEV4aqXWqFr6AlXov+SlcgB1Fv01y2kGe3Gc8nMW7VA0SrGuSkRfIEg==}
+
   log-symbols@4.1.0:
     resolution: {integrity: sha512-8XPvpAA8uyhfteu8pIvQxpJZ7SYYdpUivZpGy6sFsBuKRY/7rQGavedeB8aK+Zkyq6upMFVL/9AW6vOYzfRyLg==}
     engines: {node: '>=10'}
@@ -2660,6 +2861,14 @@ packages:
   merge-stream@2.0.0:
     resolution: {integrity: sha512-abv/qOcuPfk3URPfDzmZU1LKmuw8kT+0nIHvKrKgFrwifol/doWcdA4ZqsWQ8ENrFKkd67Mfpo/LovbIUsbt3w==}
 
+  merge2@1.4.1:
+    resolution: {integrity: sha512-8q7VEgMJW4J8tcfVPy8g09NcQwZdbwFEqhe/WZkoIzjn/3TGDwtOCYtXGxA3O8tPzpczCCDgv+P2P5y00ZJOOg==}
+    engines: {node: '>= 8'}
+
+  micromatch@4.0.8:
+    resolution: {integrity: sha512-PXwfBhYu0hBCPw8Dn0E+WDYb7af3dSLVWKi3HGv84IdF4TyFoC0ysxFd0Goxw7nSv4T/PzEJQxsYsEiFCKo2BA==}
+    engines: {node: '>=8.6'}
+
   mime-db@1.52.0:
     resolution: {integrity: sha512-sPU4uV7dYlvtWJxwwxHD0PuihVNiE7TyAbQ5SWxDCB9mUYvOgroQOwYQQOKPJ8CIbE+1ETVlOoK1UC2nU3gYvg==}
     engines: {node: '>= 0.6'}
@@ -2739,6 +2948,10 @@ packages:
   module-details-from-path@1.0.4:
     resolution: {integrity: sha512-EGWKgxALGMgzvxYF1UyGTy0HXX/2vHLkw6+NvDKW2jypWbHpjQuj4UMcqQWXHERJhVGKikolT06G3bcKe4fi7w==}
 
+  mri@1.2.0:
+    resolution: {integrity: sha512-tzzskb3bG8LvYGFF/mDTpq3jpI6Q9wc3LEmBaghu+DdCssd1FakN7Bc0hVNmEyGq1bq3RgfkCb3cmQLpNPOroA==}
+    engines: {node: '>=4'}
+
   ms@2.1.3:
     resolution: {integrity: sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==}
 
@@ -2838,6 +3051,13 @@ packages:
     resolution: {integrity: sha512-5b6Y85tPxZZ7QytO+BQzysW31HJku27cRIlkbAXaNx+BdcVi+LlRFmVXzeF6a7JCwJpyw5c4b+YSVImQIrBpuQ==}
     engines: {node: '>=10'}
 
+  os-tmpdir@1.0.2:
+    resolution: {integrity: sha512-D2FR03Vir7FIu45XBY20mTb+/ZSWB00sjU9jdQXt83gDrI4Ztz5Fs7/yy74g2N5SVQY4xY1qDr4rNddwYRVX0g==}
+    engines: {node: '>=0.10.0'}
+
+  outdent@0.5.0:
+    resolution: {integrity: sha512-/jHxFIzoMXdqPzTaCpFzAAWhpkSjZPF4Vsn6jAfNpmbH/ymsmd7Qc6VE9BGn0L6YMj6uwpQLxCECpus4ukKS9Q==}
+
   oxc-resolver@11.6.1:
     resolution: {integrity: sha512-WQgmxevT4cM5MZ9ioQnEwJiHpPzbvntV5nInGAKo9NQZzegcOonHvcVcnkYqld7bTG35UFHEKeF7VwwsmA3cZg==}
 
@@ -2845,21 +3065,44 @@ packages:
     resolution: {integrity: sha512-BZOr3nRQHOntUjTrH8+Lh54smKHoHyur8We1V8DSMVrl5A2malOOwuJRnKRDjSnkoeBh4at6BwEnb5I7Jl31wg==}
     engines: {node: '>=8'}
 
+  p-filter@2.1.0:
+    resolution: {integrity: sha512-ZBxxZ5sL2HghephhpGAQdoskxplTwr7ICaehZwLIlfL6acuVgZPm8yBNuRAFBGEqtD/hmUeq9eqLg2ys9Xr/yw==}
+    engines: {node: '>=8'}
+
+  p-limit@2.3.0:
+    resolution: {integrity: sha512-//88mFWSJx8lxCzwdAABTJL2MyWB12+eIY7MDL2SqLmAkeKU9qxRvWuSyTjm3FUmpBEMuFfckAIqEaVGUDxb6w==}
+    engines: {node: '>=6'}
+
   p-limit@4.0.0:
     resolution: {integrity: sha512-5b0R4txpzjPWVw/cXXUResoD4hb6U/x9BH08L7nw+GN1sezDzPdxeRvpc9c433fZhBan/wusjbCsqwqm4EIBIQ==}
     engines: {node: ^12.20.0 || ^14.13.1 || >=16.0.0}
 
+  p-locate@4.1.0:
+    resolution: {integrity: sha512-R79ZZ/0wAxKGu3oYMlz8jy/kbhsNrS7SKZ7PxEHBgJ5+F2mtFW2fK2cOtBh1cHYkQsbzFV7I+EoRKe6Yt0oK7A==}
+    engines: {node: '>=8'}
+
   p-locate@6.0.0:
     resolution: {integrity: sha512-wPrq66Llhl7/4AGC6I+cqxT07LhXvWL08LNXz1fENOw0Ap4sRZZ/gZpTTJ5jpurzzzfS2W/Ge9BY3LgLjCShcw==}
     engines: {node: ^12.20.0 || ^14.13.1 || >=16.0.0}
 
+  p-map@2.1.0:
+    resolution: {integrity: sha512-y3b8Kpd8OAN444hxfBbFfj1FY/RjtTd8tzYwhUqNYXx0fXx2iX4maP4Qr6qhIKbQXI02wTLAda4fYUbDagTUFw==}
+    engines: {node: '>=6'}
+
   p-map@4.0.0:
     resolution: {integrity: sha512-/bjOqmgETBYB5BoEeGVea8dmvHb2m9GLy1E9W43yeyfP6QQCZGFNa+XRceJEuDB6zqr+gKpIAmlLebMpykw/MQ==}
     engines: {node: '>=10'}
 
+  p-try@2.2.0:
+    resolution: {integrity: sha512-R4nPAVTAU0B9D35/Gk3uJf/7XYbQcyohSKdvAxIRSNghFl4e71hVoGnBNQz9cWaXxO2I10KTC+3jMdvvoKw6dQ==}
+    engines: {node: '>=6'}
+
   package-json-from-dist@1.0.1:
     resolution: {integrity: sha512-UEZIS3/by4OC8vL3P2dTXRETpebLI2NiI5vIrjaD/5UtrkFX/tNbwjTSRAGC/+7CAo2pIcBaRgWmcBBHcsaCIw==}
 
+  package-manager-detector@0.2.11:
+    resolution: {integrity: sha512-BEnLolu+yuz22S56CU1SUKq3XC3PkwD5wv4ikR4MfGvnRVcmzXR9DwSlW2fEamyTPyXHomBJRzgapeuBvRNzJQ==}
+
   pacote@18.0.6:
     resolution: {integrity: sha512-+eK3G27SMwsB8kLIuj4h1FUhHtwiEUo21Tw8wNjmvdlpOEr613edv+8FUsTj/4F/VN5ywGE19X18N7CC2EJk6A==}
     engines: {node: ^16.14.0 || >=18.0.0}
@@ -2877,6 +3120,10 @@ packages:
     resolution: {integrity: sha512-ayCKvm/phCGxOkYRSCM82iDwct8/EonSEgCSxWxD7ve6jHggsFl4fZVQBPRNgQoKiuV/odhFrGzQXZwbifC8Rg==}
     engines: {node: '>=8'}
 
+  path-exists@4.0.0:
+    resolution: {integrity: sha512-ak9Qy5Q7jYb2Wwcey5Fpvg2KoAc/ZIhLSLOSBmRmygPsGwkVVt0fZa0qrtMz+m6tJTAHfZQ8FnmB4MG4LWy7/w==}
+    engines: {node: '>=8'}
+
   path-exists@5.0.0:
     resolution: {integrity: sha512-RjhtfwJOxzcFmNOi6ltcbcu4Iu+FL3zEj83dk4kAS+fVpTxXLO1b38RvJgT/0QwvV/L3aY9TAnyv0EOqW4GoMQ==}
     engines: {node: ^12.20.0 || ^14.13.1 || >=16.0.0}
@@ -2899,6 +3146,10 @@ packages:
   picocolors@1.1.1:
     resolution: {integrity: sha512-xceH2snhtb5M9liqDsmEw56le376mTZkEX/jEb/RxNFyegNul7eNslCXP9FDj/Lcu0X8KEyMceP2ntpaHrDEVA==}
 
+  picomatch@2.3.1:
+    resolution: {integrity: sha512-JU3teHTNjmE2VCGFzuY8EXzCDVwEqB2a8fsIvwaStHhAWJEeVd1o1QD80CU6+ZdEXXSLbSsuLwJjkCBWqRQUVA==}
+    engines: {node: '>=8.6'}
+
   picomatch@3.0.1:
     resolution: {integrity: sha512-I3EurrIQMlRc9IaAZnqRR044Phh2DXY+55o7uJ0V+hYZAcQYSuFWsc9q5PvyDHUSCe1Qxn/iBz+78s86zWnGag==}
     engines: {node: '>=10'}
@@ -2911,6 +3162,10 @@ packages:
     resolution: {integrity: sha512-5gTmgEY/sqK6gFXLIsQNH19lWb4ebPDLA4SdLP7dsWkIXHWlG66oPuVvXSGFPppYZz8ZDZq0dYYrbHfBCVUb1Q==}
     engines: {node: '>=12'}
 
+  pify@4.0.1:
+    resolution: {integrity: sha512-uB80kBFb/tfd68bVleG9T5GGsGPjJrLAUpR5PZIrhBnIaRTQRjqdJSsIKkOP6OAIFbj7GOrcudc5pNjZ+geV2g==}
+    engines: {node: '>=6'}
+
   pirates@4.0.7:
     resolution: {integrity: sha512-TfySrs/5nm8fQJDcBDuUng3VOUKsd7S+zqvbOTiGXHfxX4wK31ard+hoNuvkicM/2YFzlpDgABOevKSsB4G/FA==}
     engines: {node: '>= 6'}
@@ -2923,6 +3178,11 @@ packages:
     resolution: {integrity: sha512-Q8qQfPiZ+THO/3ZrOrO0cJJKfpYCagtMUkXbnEfmgUjwXg6z/WBeOyS9APBBPCTSiDV+s4SwQGu8yFsiMRIudg==}
     engines: {node: '>=4'}
 
+  prettier@2.8.8:
+    resolution: {integrity: sha512-tdN8qQGvNjw4CHbY+XXk0JgCXn9QiF21a55rBe5LJAU+kDyC4WQn4+awm2Xfk2lQMk5fKup9XgzTZtGkjBdP9Q==}
+    engines: {node: '>=10.13.0'}
+    hasBin: true
+
   prettier@3.6.2:
     resolution: {integrity: sha512-I7AIg5boAr5R0FFtJ6rCfD+LFsWHp81dolrFD8S79U9tb8Az2nGrJncnMSnys+bpQJfRUzqs9hnA81OAA3hCuQ==}
     engines: {node: '>=14'}
@@ -2968,6 +3228,12 @@ packages:
   pump@3.0.3:
     resolution: {integrity: sha512-todwxLMY7/heScKmntwQG8CXVkWUOdYxIvY2s0VWAAMh/nd8SoYiRaKjlr7+iCs984f2P8zvrfWcDDYVb73NfA==}
 
+  quansync@0.2.11:
+    resolution: {integrity: sha512-AifT7QEbW9Nri4tAwR5M/uzpBuqfZf+zwaEM/QkzEjj7NBuFD2rBuy0K3dE+8wltbezDV7JMA0WfnCPYRSYbXA==}
+
+  queue-microtask@1.2.3:
+    resolution: {integrity: sha512-NuaNSa6flKT5JaSYQzJok04JzTL1CA6aGhv5rfLW3PgqA+M2ChpZQnAC8h8i4ZFkBS8X5RqkDBHA7r4hej3K9A==}
+
   quick-lru@5.1.1:
     resolution: {integrity: sha512-WuyALRjWPDGtt/wzJiadO5AXY+8hZ80hVpe6MyivgraREW751X3SbhRvG3eLKOYN+8VEvqLcf3wdnt44Z4S4SA==}
     engines: {node: '>=10'}
@@ -2983,6 +3249,10 @@ packages:
     resolution: {integrity: sha512-0J+Msgym3vrLOUB3hzQCuZHII0xkNGCtz/HJH9xZshwv9DbDwkw1KaE3gx/e2J5rpEY5rtOy6cyhKOPrkP7FZw==}
     engines: {node: ^14.17.0 || ^16.13.0 || >=18.0.0}
 
+  read-yaml-file@1.1.0:
+    resolution: {integrity: sha512-VIMnQi/Z4HT2Fxuwg5KrY174U1VdUIASQVWXXyqtNRtxSr9IYkn1rsI6Tb6HsrHCmB7gVpNwX6JxPTHcH6IoTA==}
+    engines: {node: '>=6'}
+
   readable-stream@3.6.2:
     resolution: {integrity: sha512-9u/sniCrY3D5WdsERHzHE4G2YCXqoG5FTHUiCC4SIbr6XcLZBY05ya9EKjYek9O5xOAwjGq+1JdGBAS7Q9ScoA==}
     engines: {node: '>= 6'}
@@ -3024,6 +3294,10 @@ packages:
     resolution: {integrity: sha512-pb/MYmXstAkysRFx8piNI1tGFNQIFA3vkE3Gq4EuA1dF6gHp/+vgZqsCGJapvy8N3Q+4o7FwvquPJcnZ7RYy4g==}
     engines: {node: '>=4'}
 
+  resolve-from@5.0.0:
+    resolution: {integrity: sha512-qYg9KP24dD5qka9J47d0aVky0N+b4fTU89LN9iDnjB5waksiC49rvMB0PrUJQGoTmH50XPiqOvAjDfaijGxYZw==}
+    engines: {node: '>=8'}
+
   resolve-pkg-maps@1.0.0:
     resolution: {integrity: sha512-seS2Tj26TBVOC2NIc2rOe2y2ZO7efxITtLZcGSOnHHNOQ7CkiUBfw0Iw2ck6xkIhPwLhKNLS8BO+hEpngQlqzw==}
 
@@ -3047,6 +3321,13 @@ packages:
     resolution: {integrity: sha512-9LkiTwjUh6rT555DtE9rTX+BKByPfrMzEAtnlEtdEwr3Nkffwiihqe2bWADg+OQRjt9gl6ICdmB/ZFDCGAtSow==}
     engines: {node: '>= 4'}
 
+  reusify@1.1.0:
+    resolution: {integrity: sha512-g6QUff04oZpHs0eG5p83rFLhHeV00ug/Yf9nZM6fLeUrPguBTkTQOdpAWWspMh55TZfVQDPaN3NQJfbVRAxdIw==}
+    engines: {iojs: '>=1.0.0', node: '>=0.10.0'}
+
+  run-parallel@1.2.0:
+    resolution: {integrity: sha512-5l4VyZR86LZ/lDxZTR6jqL8AFE2S0IFLMP26AbjsLVADxHdhB/c0GUsH+y39UfCi3dzz8OlQuPmnaJOMoDHQBA==}
+
   safe-buffer@5.2.1:
     resolution: {integrity: sha512-rp3So07KcdmmKbGvgaNxQSJr7bGVSVk5S9Eq1F+ppbRo70+YeaDxkw5Dd8NPN+GD6bjnYm2VuPuCXmpuYvmCXQ==}
 
@@ -3089,6 +3370,10 @@ packages:
     resolution: {integrity: sha512-8G+/XDU8wNsJOQS5ysDVO0Etg9/2uA5gR9l4ZwijjlwxBcrU6RPfwi2+jJmbP+Ap1Hlp/nVAaEO4Fj22/SL2gQ==}
     engines: {node: ^16.14.0 || >=18.0.0}
 
+  slash@3.0.0:
+    resolution: {integrity: sha512-g9Q1haeby36OSStwb4ntCGGGaKsaVSjQ68fBxoQcutl5fS1vuY18H3wSt3jFyFtrkx+Kz0V1G85A4MyAdDMi2Q==}
+    engines: {node: '>=8'}
+
   smart-buffer@4.2.0:
     resolution: {integrity: sha512-94hK0Hh8rPqQl2xXc3HsaBoOXKV20MToPkcXvwbISWLEs+64sBq5kFgn2kJDHb1Pry9yrP0dxrCI9RRci7RXKg==}
     engines: {node: '>= 6.0.0', npm: '>= 3.0.0'}
@@ -3111,6 +3396,9 @@ packages:
     resolution: {integrity: sha512-UjgapumWlbMhkBgzT7Ykc5YXUT46F0iKu8SGXq0bcwP5dz/h0Plj6enJqjz1Zbq2l5WaqYnrVbwWOWMyF3F47g==}
     engines: {node: '>=0.10.0'}
 
+  spawndamnit@3.0.1:
+    resolution: {integrity: sha512-MmnduQUuHCoFckZoWnXsTg7JaiLBJrKFj9UI2MbRPGaJeVpsLcVBu6P/IGZovziM/YBsellCmsprgNA+w0CzVg==}
+
   spdx-correct@3.2.0:
     resolution: {integrity: sha512-kN9dJbvnySHULIluDHy32WHRUu3Og7B9sbY7tsFLctQkIqnMh3hErYgdMjTYuqmcXX+lK5T1lnUt3G7zNswmZA==}
 
@@ -3223,6 +3511,10 @@ packages:
     resolution: {integrity: sha512-DZ4yORTwrbTj/7MZYq2w+/ZFdI6OZ/f9SFHR+71gIVUZhOQPHzVCLpvRnPgyaMpfWxxk/4ONva3GQSyNIKRv6A==}
     engines: {node: '>=10'}
 
+  term-size@2.2.1:
+    resolution: {integrity: sha512-wK0Ri4fOGjv/XPy8SBHZChl8CM7uMc5VML7SqiQ0zG7+J5Vr+RMQDoHa2CNT6KHUnTGIXH34UDMkPzAUyapBZg==}
+    engines: {node: '>=8'}
+
   text-decoder@1.2.3:
     resolution: {integrity: sha512-3/o9z3X0X0fTupwsYvR03pJ/DjWuqqrfwBgTQzdWDiQSm9KitAyz/9WqsT2JQW7KV2m+bC2ol/zqpW37NHxLaA==}
 
@@ -3230,10 +3522,18 @@ packages:
     resolution: {integrity: sha512-j2Zq4NyQYG5XMST4cbs02Ak8iJUdxRM0XI5QyxXuZOzKOINmWurp3smXu3y5wDcJrptwpSjgXHzIQxR0omXljQ==}
     engines: {node: '>=12.0.0'}
 
+  tmp@0.0.33:
+    resolution: {integrity: sha512-jRCJlojKnZ3addtTOjdIqoRuPEKBvNXcGYqzO6zWZX8KfKEpnGY5jfggJQ3EjKuu8D4bJRr0y+cYJFmYbImXGw==}
+    engines: {node: '>=0.6.0'}
+
   tmp@0.2.5:
     resolution: {integrity: sha512-voyz6MApa1rQGUxT3E+BK7/ROe8itEx7vD8/HEvt4xwXucvQ5G5oeEiHkmHZJuBO21RpOf+YYm9MOivj709jow==}
     engines: {node: '>=14.14'}
 
+  to-regex-range@5.0.1:
+    resolution: {integrity: sha512-65P7iz6X5yEr1cwcgvQxbbIw7Uk3gOy5dIdtZ4rDveLqhrdJP+Li/Hx6tyK0NEb+2GCyneCMJiGqrADCSNk8sQ==}
+    engines: {node: '>=8.0'}
+
   tree-kill@1.2.2:
     resolution: {integrity: sha512-L0Orpi8qGpRG//Nd+H90vFB+3iHnue1zSSGmNOOCh1GLJ7rUKVwV2HvijphGQS2UmhUZewS9VgvxYIdgr+fG1A==}
     hasBin: true
@@ -3290,6 +3590,10 @@ packages:
     resolution: {integrity: sha512-WrcA6AyEfqDX5bWige/4NQfPZMtASNVxdmWR76WESYQVAACSgWcR6e9i0mofqqBxYFtL4oAxPIptY73/0YE1DQ==}
     engines: {node: ^14.17.0 || ^16.13.0 || >=18.0.0}
 
+  universalify@0.1.2:
+    resolution: {integrity: sha512-rBJeI5CXAlmy1pV+617WB9J63U6XcazHHF2f2dbJix4XzpUF0RS3Zbj0FGIOCAva5P/d/GBOYaACQ1w+0azUkg==}
+    engines: {node: '>= 4.0.0'}
+
   upath@1.2.0:
     resolution: {integrity: sha512-aZwGpamFO61g3OlfT7OQCHqhGnW43ieH9WZeP7QxN/G/jS4jfqUkZxoryvJgVPEcrl5NL/ggHsSmLMHuH64Lhg==}
     engines: {node: '>=4'}
@@ -4637,6 +4941,148 @@ snapshots:
       '@babel/helper-string-parser': 7.27.1
       '@babel/helper-validator-identifier': 7.27.1
 
+  '@changesets/apply-release-plan@7.0.13':
+    dependencies:
+      '@changesets/config': 3.1.1
+      '@changesets/get-version-range-type': 0.4.0
+      '@changesets/git': 3.0.4
+      '@changesets/should-skip-package': 0.1.2
+      '@changesets/types': 6.1.0
+      '@manypkg/get-packages': 1.1.3
+      detect-indent: 6.1.0
+      fs-extra: 7.0.1
+      lodash.startcase: 4.4.0
+      outdent: 0.5.0
+      prettier: 2.8.8
+      resolve-from: 5.0.0
+      semver: 7.7.2
+
+  '@changesets/assemble-release-plan@6.0.9':
+    dependencies:
+      '@changesets/errors': 0.2.0
+      '@changesets/get-dependents-graph': 2.1.3
+      '@changesets/should-skip-package': 0.1.2
+      '@changesets/types': 6.1.0
+      '@manypkg/get-packages': 1.1.3
+      semver: 7.7.2
+
+  '@changesets/changelog-git@0.2.1':
+    dependencies:
+      '@changesets/types': 6.1.0
+
+  '@changesets/cli@2.27.10':
+    dependencies:
+      '@changesets/apply-release-plan': 7.0.13
+      '@changesets/assemble-release-plan': 6.0.9
+      '@changesets/changelog-git': 0.2.1
+      '@changesets/config': 3.1.1
+      '@changesets/errors': 0.2.0
+      '@changesets/get-dependents-graph': 2.1.3
+      '@changesets/get-release-plan': 4.0.13
+      '@changesets/git': 3.0.4
+      '@changesets/logger': 0.1.1
+      '@changesets/pre': 2.0.2
+      '@changesets/read': 0.6.5
+      '@changesets/should-skip-package': 0.1.2
+      '@changesets/types': 6.1.0
+      '@changesets/write': 0.3.2
+      '@manypkg/get-packages': 1.1.3
+      ansi-colors: 4.1.3
+      ci-info: 3.9.0
+      enquirer: 2.4.1
+      external-editor: 3.1.0
+      fs-extra: 7.0.1
+      mri: 1.2.0
+      p-limit: 2.3.0
+      package-manager-detector: 0.2.11
+      picocolors: 1.1.1
+      resolve-from: 5.0.0
+      semver: 7.7.2
+      spawndamnit: 3.0.1
+      term-size: 2.2.1
+
+  '@changesets/config@3.1.1':
+    dependencies:
+      '@changesets/errors': 0.2.0
+      '@changesets/get-dependents-graph': 2.1.3
+      '@changesets/logger': 0.1.1
+      '@changesets/types': 6.1.0
+      '@manypkg/get-packages': 1.1.3
+      fs-extra: 7.0.1
+      micromatch: 4.0.8
+
+  '@changesets/errors@0.2.0':
+    dependencies:
+      extendable-error: 0.1.7
+
+  '@changesets/get-dependents-graph@2.1.3':
+    dependencies:
+      '@changesets/types': 6.1.0
+      '@manypkg/get-packages': 1.1.3
+      picocolors: 1.1.1
+      semver: 7.7.2
+
+  '@changesets/get-release-plan@4.0.13':
+    dependencies:
+      '@changesets/assemble-release-plan': 6.0.9
+      '@changesets/config': 3.1.1
+      '@changesets/pre': 2.0.2
+      '@changesets/read': 0.6.5
+      '@changesets/types': 6.1.0
+      '@manypkg/get-packages': 1.1.3
+
+  '@changesets/get-version-range-type@0.4.0': {}
+
+  '@changesets/git@3.0.4':
+    dependencies:
+      '@changesets/errors': 0.2.0
+      '@manypkg/get-packages': 1.1.3
+      is-subdir: 1.2.0
+      micromatch: 4.0.8
+      spawndamnit: 3.0.1
+
+  '@changesets/logger@0.1.1':
+    dependencies:
+      picocolors: 1.1.1
+
+  '@changesets/parse@0.4.1':
+    dependencies:
+      '@changesets/types': 6.1.0
+      js-yaml: 3.14.1
+
+  '@changesets/pre@2.0.2':
+    dependencies:
+      '@changesets/errors': 0.2.0
+      '@changesets/types': 6.1.0
+      '@manypkg/get-packages': 1.1.3
+      fs-extra: 7.0.1
+
+  '@changesets/read@0.6.5':
+    dependencies:
+      '@changesets/git': 3.0.4
+      '@changesets/logger': 0.1.1
+      '@changesets/parse': 0.4.1
+      '@changesets/types': 6.1.0
+      fs-extra: 7.0.1
+      p-filter: 2.1.0
+      picocolors: 1.1.1
+
+  '@changesets/should-skip-package@0.1.2':
+    dependencies:
+      '@changesets/types': 6.1.0
+      '@manypkg/get-packages': 1.1.3
+
+  '@changesets/types@4.1.0': {}
+
+  '@changesets/types@6.1.0': {}
+
+  '@changesets/write@0.3.2':
+    dependencies:
+      '@changesets/types': 6.1.0
+      fs-extra: 7.0.1
+      human-id: 1.0.2
+      prettier: 2.8.8
+
   '@emnapi/core@1.4.5':
     dependencies:
       '@emnapi/wasi-threads': 1.0.4
@@ -4782,6 +5228,22 @@ snapshots:
 
   '@logdna/tail-file@2.2.0': {}
 
+  '@manypkg/find-root@1.1.0':
+    dependencies:
+      '@babel/runtime': 7.28.4
+      '@types/node': 12.20.55
+      find-up: 4.1.0
+      fs-extra: 8.1.0
+
+  '@manypkg/get-packages@1.1.3':
+    dependencies:
+      '@babel/runtime': 7.28.4
+      '@changesets/types': 4.1.0
+      '@manypkg/find-root': 1.1.0
+      fs-extra: 8.1.0
+      globby: 11.1.0
+      read-yaml-file: 1.1.0
+
   '@napi-rs/wasm-runtime@0.2.4':
     dependencies:
       '@emnapi/core': 1.4.5
@@ -4795,6 +5257,18 @@ snapshots:
       '@tybys/wasm-util': 0.10.0
     optional: true
 
+  '@nodelib/fs.scandir@2.1.5':
+    dependencies:
+      '@nodelib/fs.stat': 2.0.5
+      run-parallel: 1.2.0
+
+  '@nodelib/fs.stat@2.0.5': {}
+
+  '@nodelib/fs.walk@1.2.8':
+    dependencies:
+      '@nodelib/fs.scandir': 2.1.5
+      fastq: 1.19.1
+
   '@npmcli/agent@2.2.2':
     dependencies:
       agent-base: 7.1.4
@@ -5793,6 +6267,8 @@ snapshots:
     dependencies:
       '@types/node': 24.9.2
 
+  '@types/node@12.20.55': {}
+
   '@types/node@24.9.2':
     dependencies:
       undici-types: 7.16.0
@@ -5859,6 +6335,8 @@ snapshots:
 
   argparse@2.0.1: {}
 
+  array-union@2.1.0: {}
+
   async-mutex@0.5.0:
     dependencies:
       tslib: 2.8.1
@@ -5937,6 +6415,10 @@ snapshots:
 
   baseline-browser-mapping@2.8.6: {}
 
+  better-path-resolve@1.0.0:
+    dependencies:
+      is-windows: 1.0.2
+
   bin-links@4.0.4:
     dependencies:
       cmd-shim: 6.0.3
@@ -5956,6 +6438,10 @@ snapshots:
     dependencies:
       balanced-match: 1.0.2
 
+  braces@3.0.3:
+    dependencies:
+      fill-range: 7.1.1
+
   browserslist@4.26.2:
     dependencies:
       baseline-browser-mapping: 2.8.6
@@ -6017,8 +6503,12 @@ snapshots:
       ansi-styles: 4.3.0
       supports-color: 7.2.0
 
+  chardet@0.7.0: {}
+
   chownr@2.0.0: {}
 
+  ci-info@3.9.0: {}
+
   cjs-module-lexer@1.4.3: {}
 
   clean-stack@2.2.0: {}
@@ -6102,6 +6592,8 @@ snapshots:
 
   delayed-stream@1.0.0: {}
 
+  detect-indent@6.1.0: {}
+
   detect-port@1.6.1:
     dependencies:
       address: 1.2.2
@@ -6109,6 +6601,10 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
+  dir-glob@3.0.1:
+    dependencies:
+      path-type: 4.0.0
+
   dotenv-expand@11.0.7:
     dependencies:
       dotenv: 16.4.7
@@ -6227,12 +6723,32 @@ snapshots:
 
   exponential-backoff@3.1.2: {}
 
+  extendable-error@0.1.7: {}
+
+  external-editor@3.1.0:
+    dependencies:
+      chardet: 0.7.0
+      iconv-lite: 0.4.24
+      tmp: 0.0.33
+
   fast-fifo@1.3.2: {}
 
+  fast-glob@3.3.3:
+    dependencies:
+      '@nodelib/fs.stat': 2.0.5
+      '@nodelib/fs.walk': 1.2.8
+      glob-parent: 5.1.2
+      merge2: 1.4.1
+      micromatch: 4.0.8
+
   fast-xml-parser@4.4.1:
     dependencies:
       strnum: 1.1.2
 
+  fastq@1.19.1:
+    dependencies:
+      reusify: 1.1.0
+
   fdir@6.5.0(picomatch@3.0.1):
     optionalDependencies:
       picomatch: 3.0.1
@@ -6249,6 +6765,15 @@ snapshots:
     dependencies:
       minimatch: 5.1.6
 
+  fill-range@7.1.1:
+    dependencies:
+      to-regex-range: 5.0.1
+
+  find-up@4.1.0:
+    dependencies:
+      locate-path: 5.0.0
+      path-exists: 4.0.0
+
   find-up@6.3.0:
     dependencies:
       locate-path: 7.2.0
@@ -6277,6 +6802,18 @@ snapshots:
 
   fs-constants@1.0.0: {}
 
+  fs-extra@7.0.1:
+    dependencies:
+      graceful-fs: 4.2.11
+      jsonfile: 4.0.0
+      universalify: 0.1.2
+
+  fs-extra@8.1.0:
+    dependencies:
+      graceful-fs: 4.2.11
+      jsonfile: 4.0.0
+      universalify: 0.1.2
+
   fs-minipass@2.1.0:
     dependencies:
       minipass: 3.3.6
@@ -6322,6 +6859,10 @@ snapshots:
     dependencies:
       resolve-pkg-maps: 1.0.0
 
+  glob-parent@5.1.2:
+    dependencies:
+      is-glob: 4.0.3
+
   glob@10.4.5:
     dependencies:
       foreground-child: 3.3.1
@@ -6331,6 +6872,15 @@ snapshots:
       package-json-from-dist: 1.0.1
       path-scurry: 1.11.1
 
+  globby@11.1.0:
+    dependencies:
+      array-union: 2.1.0
+      dir-glob: 3.0.1
+      fast-glob: 3.3.3
+      ignore: 5.3.2
+      merge2: 1.4.1
+      slash: 3.0.0
+
   google-protobuf@3.21.4: {}
 
   gopd@1.2.0: {}
@@ -6388,8 +6938,14 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
+  human-id@1.0.2: {}
+
   human-signals@2.1.0: {}
 
+  iconv-lite@0.4.24:
+    dependencies:
+      safer-buffer: 2.1.2
+
   iconv-lite@0.6.3:
     dependencies:
       safer-buffer: 2.1.2
@@ -6440,18 +6996,32 @@ snapshots:
 
   is-docker@2.2.1: {}
 
+  is-extglob@2.1.1: {}
+
   is-fullwidth-code-point@3.0.0: {}
 
+  is-glob@4.0.3:
+    dependencies:
+      is-extglob: 2.1.1
+
   is-interactive@1.0.0: {}
 
   is-lambda@1.0.1: {}
 
+  is-number@7.0.0: {}
+
   is-retry-allowed@2.2.0: {}
 
   is-stream@2.0.1: {}
 
+  is-subdir@1.2.0:
+    dependencies:
+      better-path-resolve: 1.0.0
+
   is-unicode-supported@0.1.0: {}
 
+  is-windows@1.0.2: {}
+
   is-wsl@2.2.0:
     dependencies:
       is-docker: 2.2.1
@@ -6502,6 +7072,10 @@ snapshots:
 
   jsonc-parser@3.2.0: {}
 
+  jsonfile@4.0.0:
+    optionalDependencies:
+      graceful-fs: 4.2.11
+
   jsonparse@1.3.1: {}
 
   just-diff-apply@5.5.0: {}
@@ -6516,6 +7090,10 @@ snapshots:
 
   lines-and-columns@2.0.3: {}
 
+  locate-path@5.0.0:
+    dependencies:
+      p-locate: 4.1.0
+
   locate-path@7.2.0:
     dependencies:
       p-locate: 6.0.0
@@ -6524,6 +7102,8 @@ snapshots:
 
   lodash.debounce@4.0.8: {}
 
+  lodash.startcase@4.4.0: {}
+
   log-symbols@4.1.0:
     dependencies:
       chalk: 4.1.2
@@ -6564,6 +7144,13 @@ snapshots:
 
   merge-stream@2.0.0: {}
 
+  merge2@1.4.1: {}
+
+  micromatch@4.0.8:
+    dependencies:
+      braces: 3.0.3
+      picomatch: 2.3.1
+
   mime-db@1.52.0: {}
 
   mime-types@2.1.35:
@@ -6631,6 +7218,8 @@ snapshots:
 
   module-details-from-path@1.0.4: {}
 
+  mri@1.2.0: {}
+
   ms@2.1.3: {}
 
   napi-postinstall@0.3.3: {}
@@ -6803,6 +7392,10 @@ snapshots:
       strip-ansi: 6.0.1
       wcwidth: 1.0.1
 
+  os-tmpdir@1.0.2: {}
+
+  outdent@0.5.0: {}
+
   oxc-resolver@11.6.1:
     dependencies:
       napi-postinstall: 0.3.3
@@ -6829,20 +7422,40 @@ snapshots:
 
   p-cancelable@2.1.1: {}
 
+  p-filter@2.1.0:
+    dependencies:
+      p-map: 2.1.0
+
+  p-limit@2.3.0:
+    dependencies:
+      p-try: 2.2.0
+
   p-limit@4.0.0:
     dependencies:
       yocto-queue: 1.2.1
 
+  p-locate@4.1.0:
+    dependencies:
+      p-limit: 2.3.0
+
   p-locate@6.0.0:
     dependencies:
       p-limit: 4.0.0
 
+  p-map@2.1.0: {}
+
   p-map@4.0.0:
     dependencies:
       aggregate-error: 3.1.0
 
+  p-try@2.2.0: {}
+
   package-json-from-dist@1.0.1: {}
 
+  package-manager-detector@0.2.11:
+    dependencies:
+      quansync: 0.2.11
+
   pacote@18.0.6:
     dependencies:
       '@npmcli/git': 5.0.8
@@ -6883,6 +7496,8 @@ snapshots:
       json-parse-even-better-errors: 2.3.1
       lines-and-columns: 1.2.4
 
+  path-exists@4.0.0: {}
+
   path-exists@5.0.0: {}
 
   path-key@3.1.1: {}
@@ -6898,12 +7513,16 @@ snapshots:
 
   picocolors@1.1.1: {}
 
+  picomatch@2.3.1: {}
+
   picomatch@3.0.1: {}
 
   picomatch@4.0.2: {}
 
   picomatch@4.0.3: {}
 
+  pify@4.0.1: {}
+
   pirates@4.0.7: {}
 
   pkg-dir@7.0.0:
@@ -6915,6 +7534,8 @@ snapshots:
       cssesc: 3.0.0
       util-deprecate: 1.0.2
 
+  prettier@2.8.8: {}
+
   prettier@3.6.2: {}
 
   pretty-format@30.0.5:
@@ -6960,6 +7581,10 @@ snapshots:
       end-of-stream: 1.4.5
       once: 1.4.0
 
+  quansync@0.2.11: {}
+
+  queue-microtask@1.2.3: {}
+
   quick-lru@5.1.1: {}
 
   react-is@18.3.1: {}
@@ -6971,6 +7596,13 @@ snapshots:
       json-parse-even-better-errors: 3.0.2
       npm-normalize-package-bin: 3.0.1
 
+  read-yaml-file@1.1.0:
+    dependencies:
+      graceful-fs: 4.2.11
+      js-yaml: 3.14.1
+      pify: 4.0.1
+      strip-bom: 3.0.0
+
   readable-stream@3.6.2:
     dependencies:
       inherits: 2.0.4
@@ -7014,6 +7646,8 @@ snapshots:
 
   resolve-from@4.0.0: {}
 
+  resolve-from@5.0.0: {}
+
   resolve-pkg-maps@1.0.0: {}
 
   resolve.exports@2.0.3: {}
@@ -7035,10 +7669,15 @@ snapshots:
 
   retry@0.12.0: {}
 
+  reusify@1.1.0: {}
+
+  run-parallel@1.2.0:
+    dependencies:
+      queue-microtask: 1.2.3
+
   safe-buffer@5.2.1: {}
 
-  safer-buffer@2.1.2:
-    optional: true
+  safer-buffer@2.1.2: {}
 
   semver@6.3.1: {}
 
@@ -7071,6 +7710,8 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
+  slash@3.0.0: {}
+
   smart-buffer@4.2.0: {}
 
   socks-proxy-agent@8.0.5:
@@ -7098,6 +7739,11 @@ snapshots:
 
   source-map@0.6.1: {}
 
+  spawndamnit@3.0.1:
+    dependencies:
+      cross-spawn: 7.0.6
+      signal-exit: 4.1.0
+
   spdx-correct@3.2.0:
     dependencies:
       spdx-expression-parse: 3.0.1
@@ -7220,6 +7866,8 @@ snapshots:
       mkdirp: 1.0.4
       yallist: 4.0.0
 
+  term-size@2.2.1: {}
+
   text-decoder@1.2.3:
     dependencies:
       b4a: 1.6.7
@@ -7229,8 +7877,16 @@ snapshots:
       fdir: 6.5.0(picomatch@4.0.3)
       picomatch: 4.0.3
 
+  tmp@0.0.33:
+    dependencies:
+      os-tmpdir: 1.0.2
+
   tmp@0.2.5: {}
 
+  to-regex-range@5.0.1:
+    dependencies:
+      is-number: 7.0.0
+
   tree-kill@1.2.2: {}
 
   treeverse@3.0.0: {}
@@ -7281,6 +7937,8 @@ snapshots:
     dependencies:
       imurmurhash: 0.1.4
 
+  universalify@0.1.2: {}
+
   upath@1.2.0: {}
 
   update-browserslist-db@1.1.3(browserslist@4.26.2):

From bbdab8e8314f3e7b3bd996583bfbcfab7727e312 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Kh=C3=A1nh=20Ho=C3=A0ng?= <hi@khanh.id>
Date: Thu, 6 Nov 2025 08:26:08 +0700
Subject: [PATCH 29/32] Update changesets CLI and pnpm-lock dependencies to
 latest versions

---
 package.json   |  2 +-
 pnpm-lock.yaml | 91 ++++++++++++++++++++++++--------------------------
 2 files changed, 44 insertions(+), 49 deletions(-)

diff --git a/package.json b/package.json
index d2271ac..cf16bc0 100644
--- a/package.json
+++ b/package.json
@@ -11,7 +11,7 @@
     "release": "nx run-many -t build && changeset publish"
   },
   "devDependencies": {
-    "@changesets/cli": "2.27.10",
+    "@changesets/cli": "2.29.7",
     "@nx/devkit": "22.0.2",
     "@nx/js": "22.0.2",
     "@nx/s3-cache": "4.0.0",
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 760c029..fc6bc08 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -12,8 +12,8 @@ importers:
   .:
     devDependencies:
       '@changesets/cli':
-        specifier: 2.27.10
-        version: 2.27.10
+        specifier: 2.29.7
+        version: 2.29.7(@types/node@24.9.2)
       '@nx/devkit':
         specifier: 22.0.2
         version: 22.0.2(nx@22.0.2(@swc-node/register@1.11.1(@swc/core@1.14.0(@swc/helpers@0.5.17))(@swc/types@0.1.25)(typescript@5.9.3))(@swc/core@1.14.0(@swc/helpers@0.5.17)))
@@ -890,8 +890,8 @@ packages:
   '@changesets/changelog-git@0.2.1':
     resolution: {integrity: sha512-x/xEleCFLH28c3bQeQIyeZf8lFXyDFVn1SgcBiR2Tw/r4IAWlk1fzxCEZ6NxQAjF2Nwtczoen3OA2qR+UawQ8Q==}
 
-  '@changesets/cli@2.27.10':
-    resolution: {integrity: sha512-PfeXjvs9OfQJV8QSFFHjwHX3QnUL9elPEQ47SgkiwzLgtKGyuikWjrdM+lO9MXzOE22FO9jEGkcs4b+B6D6X0Q==}
+  '@changesets/cli@2.29.7':
+    resolution: {integrity: sha512-R7RqWoaksyyKXbKXBTbT4REdy22yH81mcFK6sWtqSanxUCbUi9Uf+6aqxZtDQouIqPdem2W56CdxXgsxdq7FLQ==}
     hasBin: true
 
   '@changesets/config@3.1.1':
@@ -933,8 +933,8 @@ packages:
   '@changesets/types@6.1.0':
     resolution: {integrity: sha512-rKQcJ+o1nKNgeoYRHKOS07tAMNd3YSN0uHaJOZYjBAgxfV7TUE7JE+z4BzZdQwb5hKaYbayKN5KrYV7ODb2rAA==}
 
-  '@changesets/write@0.3.2':
-    resolution: {integrity: sha512-kDxDrPNpUgsjDbWBvUo27PzKX4gqeKOlhibaOXDJA6kuBisGqNHv/HwGJrAu8U/dSf8ZEFIeHIPtvSlZI1kULw==}
+  '@changesets/write@0.4.0':
+    resolution: {integrity: sha512-CdTLvIOPiCNuH71pyDu3rA+Q0n65cmAbXnwWH84rKGiFumFzkmHNT8KHTMEchcxN+Kl8I54xGUhJ7l3E7X396Q==}
 
   '@emnapi/core@1.4.5':
     resolution: {integrity: sha512-XsLw1dEOpkSX/WucdqUhPWP7hDxSvZiY+fsUC14h+FtQ2Ifni4znbBt8punRX+Uj2JG/uDb8nEHVKvrVlvdZ5Q==}
@@ -1110,6 +1110,15 @@ packages:
     engines: {node: '>=6'}
     hasBin: true
 
+  '@inquirer/external-editor@1.0.2':
+    resolution: {integrity: sha512-yy9cOoBnx58TlsPrIxauKIFQTiyH+0MK4e97y4sV9ERbI+zDxw7i2hxHLCIEGIE/8PPvDxGhgzIOTSOWcs6/MQ==}
+    engines: {node: '>=18'}
+    peerDependencies:
+      '@types/node': '>=18'
+    peerDependenciesMeta:
+      '@types/node':
+        optional: true
+
   '@isaacs/cliui@8.0.2':
     resolution: {integrity: sha512-O8jcjabXaleOG9DQ0+ARXWZBTfnP4WNAqzuiJK7ll44AmxGKv/J2M4TPjxjY3znBCfvBXFzucm1twdyFybFqEA==}
     engines: {node: '>=12'}
@@ -2203,8 +2212,8 @@ packages:
     resolution: {integrity: sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==}
     engines: {node: '>=10'}
 
-  chardet@0.7.0:
-    resolution: {integrity: sha512-mT8iDcrh03qDGRRmoA2hmBJnxpllMR+0/0qlzjqZES6NdiWDcZkCNAk4rPFZ9Q85r27unkiNNg8ZOiwZXBHwcA==}
+  chardet@2.1.1:
+    resolution: {integrity: sha512-PsezH1rqdV9VvyNhxxOW32/d75r01NY7TQCmOqomRo15ZSOKbpTFVsfjghxo6JloQUCGnH4k1LGu0R4yCLlWQQ==}
 
   chownr@2.0.0:
     resolution: {integrity: sha512-bIomtDF5KGpdogkLd9VspvFzk9KfpyyGlS8YFVZl7TGPBHL5snIOnxeshwVgPteQ9b4Eydl+pVbIyE1DcvCWgQ==}
@@ -2430,10 +2439,6 @@ packages:
   extendable-error@0.1.7:
     resolution: {integrity: sha512-UOiS2in6/Q0FK0R0q6UY9vYpQ21mr/Qn1KOnte7vsACuNJf514WvCCUHSRCPcgjPT2bAhNIJdlE6bVap1GKmeg==}
 
-  external-editor@3.1.0:
-    resolution: {integrity: sha512-hMQ4CX1p1izmuLYyZqLMO/qGNw10wSv9QDCPfzXfyFrOaCSSoRfqE1Kf1s5an66J5JZC62NewG+mK49jOCtQew==}
-    engines: {node: '>=4'}
-
   fast-fifo@1.3.2:
     resolution: {integrity: sha512-/d9sfos4yxzpwkDkuN7k2SqFKtYNmCTzgfEpz82x34IM9/zc8KGxQoXg1liNC/izpRM/MBdt44Nmx41ZWqk+FQ==}
 
@@ -2615,21 +2620,22 @@ packages:
     resolution: {integrity: sha512-vK9P5/iUfdl95AI+JVyUuIcVtd4ofvtrOr3HNtM2yxC9bnMbEdp3x01OhQNnjb8IJYi38VlTE3mBXwcfvywuSw==}
     engines: {node: '>= 14'}
 
-  human-id@1.0.2:
-    resolution: {integrity: sha512-UNopramDEhHJD+VR+ehk8rOslwSfByxPIZyJRfV739NDhN5LF1fa1MqnzKm2lGTQRjNrjK19Q5fhkgIfjlVUKw==}
+  human-id@4.1.2:
+    resolution: {integrity: sha512-v/J+4Z/1eIJovEBdlV5TYj1IR+ZiohcYGRY+qN/oC9dAfKzVT023N/Bgw37hrKCoVRBvk3bqyzpr2PP5YeTMSg==}
+    hasBin: true
 
   human-signals@2.1.0:
     resolution: {integrity: sha512-B4FFZ6q/T2jhhksgkbEW3HBvWIfDW85snkQgawt07S7J5QXTk6BkNV+0yAeZrM5QpMAdYlocGoljn0sJ/WQkFw==}
     engines: {node: '>=10.17.0'}
 
-  iconv-lite@0.4.24:
-    resolution: {integrity: sha512-v3MXnZAcvnywkTUEZomIActle7RXXeedOR31wwl7VlyoXO4Qi9arvSenNQWne1TcRwhCL1HwLI21bEqdpj8/rA==}
-    engines: {node: '>=0.10.0'}
-
   iconv-lite@0.6.3:
     resolution: {integrity: sha512-4fCk79wshMdzMp2rH06qWrJE4iolqLhCUH+OiuIgU++RB0+94NlDL81atO7GX55uUKueo0txHNtvEyI6D7WdMw==}
     engines: {node: '>=0.10.0'}
 
+  iconv-lite@0.7.0:
+    resolution: {integrity: sha512-cf6L2Ds3h57VVmkZe+Pn+5APsT7FpqJtEhhieDCvrE2MK5Qk9MyffgQyuxQTm6BChfeZNtcOLHp9IcWRVcIcBQ==}
+    engines: {node: '>=0.10.0'}
+
   ieee754@1.2.1:
     resolution: {integrity: sha512-dcyqhDvX1C46lXZcVqCpK+FtMRQVdIMN6/Df5js2zouUsqG7I6sFxitIC+7KYK29KdXOLHdu9zL4sFnoVQnqaA==}
 
@@ -3051,10 +3057,6 @@ packages:
     resolution: {integrity: sha512-5b6Y85tPxZZ7QytO+BQzysW31HJku27cRIlkbAXaNx+BdcVi+LlRFmVXzeF6a7JCwJpyw5c4b+YSVImQIrBpuQ==}
     engines: {node: '>=10'}
 
-  os-tmpdir@1.0.2:
-    resolution: {integrity: sha512-D2FR03Vir7FIu45XBY20mTb+/ZSWB00sjU9jdQXt83gDrI4Ztz5Fs7/yy74g2N5SVQY4xY1qDr4rNddwYRVX0g==}
-    engines: {node: '>=0.10.0'}
-
   outdent@0.5.0:
     resolution: {integrity: sha512-/jHxFIzoMXdqPzTaCpFzAAWhpkSjZPF4Vsn6jAfNpmbH/ymsmd7Qc6VE9BGn0L6YMj6uwpQLxCECpus4ukKS9Q==}
 
@@ -3522,10 +3524,6 @@ packages:
     resolution: {integrity: sha512-j2Zq4NyQYG5XMST4cbs02Ak8iJUdxRM0XI5QyxXuZOzKOINmWurp3smXu3y5wDcJrptwpSjgXHzIQxR0omXljQ==}
     engines: {node: '>=12.0.0'}
 
-  tmp@0.0.33:
-    resolution: {integrity: sha512-jRCJlojKnZ3addtTOjdIqoRuPEKBvNXcGYqzO6zWZX8KfKEpnGY5jfggJQ3EjKuu8D4bJRr0y+cYJFmYbImXGw==}
-    engines: {node: '>=0.6.0'}
-
   tmp@0.2.5:
     resolution: {integrity: sha512-voyz6MApa1rQGUxT3E+BK7/ROe8itEx7vD8/HEvt4xwXucvQ5G5oeEiHkmHZJuBO21RpOf+YYm9MOivj709jow==}
     engines: {node: '>=14.14'}
@@ -4970,7 +4968,7 @@ snapshots:
     dependencies:
       '@changesets/types': 6.1.0
 
-  '@changesets/cli@2.27.10':
+  '@changesets/cli@2.29.7(@types/node@24.9.2)':
     dependencies:
       '@changesets/apply-release-plan': 7.0.13
       '@changesets/assemble-release-plan': 6.0.9
@@ -4985,12 +4983,12 @@ snapshots:
       '@changesets/read': 0.6.5
       '@changesets/should-skip-package': 0.1.2
       '@changesets/types': 6.1.0
-      '@changesets/write': 0.3.2
+      '@changesets/write': 0.4.0
+      '@inquirer/external-editor': 1.0.2(@types/node@24.9.2)
       '@manypkg/get-packages': 1.1.3
       ansi-colors: 4.1.3
       ci-info: 3.9.0
       enquirer: 2.4.1
-      external-editor: 3.1.0
       fs-extra: 7.0.1
       mri: 1.2.0
       p-limit: 2.3.0
@@ -5000,6 +4998,8 @@ snapshots:
       semver: 7.7.2
       spawndamnit: 3.0.1
       term-size: 2.2.1
+    transitivePeerDependencies:
+      - '@types/node'
 
   '@changesets/config@3.1.1':
     dependencies:
@@ -5076,11 +5076,11 @@ snapshots:
 
   '@changesets/types@6.1.0': {}
 
-  '@changesets/write@0.3.2':
+  '@changesets/write@0.4.0':
     dependencies:
       '@changesets/types': 6.1.0
       fs-extra: 7.0.1
-      human-id: 1.0.2
+      human-id: 4.1.2
       prettier: 2.8.8
 
   '@emnapi/core@1.4.5':
@@ -5186,6 +5186,13 @@ snapshots:
       protobufjs: 7.5.3
       yargs: 17.7.2
 
+  '@inquirer/external-editor@1.0.2(@types/node@24.9.2)':
+    dependencies:
+      chardet: 2.1.1
+      iconv-lite: 0.7.0
+    optionalDependencies:
+      '@types/node': 24.9.2
+
   '@isaacs/cliui@8.0.2':
     dependencies:
       string-width: 5.1.2
@@ -6503,7 +6510,7 @@ snapshots:
       ansi-styles: 4.3.0
       supports-color: 7.2.0
 
-  chardet@0.7.0: {}
+  chardet@2.1.1: {}
 
   chownr@2.0.0: {}
 
@@ -6725,12 +6732,6 @@ snapshots:
 
   extendable-error@0.1.7: {}
 
-  external-editor@3.1.0:
-    dependencies:
-      chardet: 0.7.0
-      iconv-lite: 0.4.24
-      tmp: 0.0.33
-
   fast-fifo@1.3.2: {}
 
   fast-glob@3.3.3:
@@ -6938,18 +6939,18 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  human-id@1.0.2: {}
+  human-id@4.1.2: {}
 
   human-signals@2.1.0: {}
 
-  iconv-lite@0.4.24:
+  iconv-lite@0.6.3:
     dependencies:
       safer-buffer: 2.1.2
+    optional: true
 
-  iconv-lite@0.6.3:
+  iconv-lite@0.7.0:
     dependencies:
       safer-buffer: 2.1.2
-    optional: true
 
   ieee754@1.2.1: {}
 
@@ -7392,8 +7393,6 @@ snapshots:
       strip-ansi: 6.0.1
       wcwidth: 1.0.1
 
-  os-tmpdir@1.0.2: {}
-
   outdent@0.5.0: {}
 
   oxc-resolver@11.6.1:
@@ -7877,10 +7876,6 @@ snapshots:
       fdir: 6.5.0(picomatch@4.0.3)
       picomatch: 4.0.3
 
-  tmp@0.0.33:
-    dependencies:
-      os-tmpdir: 1.0.2
-
   tmp@0.2.5: {}
 
   to-regex-range@5.0.1:

From 45be33e4ab5d18d45cf15d78e0c29eba80d99ce5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Kh=C3=A1nh=20Ho=C3=A0ng?= <hi@khanh.id>
Date: Thu, 6 Nov 2025 08:26:34 +0700
Subject: [PATCH 30/32] Remove unused id changesets from publish workflow

---
 .github/workflows/publish.yml | 1 -
 1 file changed, 1 deletion(-)

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 5221c6a..2909bfb 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -34,7 +34,6 @@ jobs:
         run: npm install -g npm@latest
       - name: Publish to npm
         uses: changesets/action@e0145edc7d9d8679003495b11f87bd8ef63c0cba # v1.5.3
-        id: changesets
         with:
           commit: 'chore(release): match upstream terraform providers'
           title: 'Update packages to match upstream terraform providers'

From 6e3524283323d4777b6902eda080994ec1325af0 Mon Sep 17 00:00:00 2001
From: "autofix-ci[bot]" <114827586+autofix-ci[bot]@users.noreply.github.com>
Date: Thu, 6 Nov 2025 01:27:16 +0000
Subject: [PATCH 31/32] [autofix.ci] apply automated fixes

---
 pnpm-lock.yaml | 20 --------------------
 1 file changed, 20 deletions(-)

diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index fc6bc08..588d496 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -1284,28 +1284,24 @@ packages:
     engines: {node: '>= 10'}
     cpu: [arm64]
     os: [linux]
-    libc: [glibc]
 
   '@nx/key-linux-arm64-musl@4.0.0':
     resolution: {integrity: sha512-UKqaA0tNaqYCNFOAXwdZsozl09eIrLg3JwDu4N3U0Z8NQAQoqfOacDq/23d9D7lO+uR7Umsi7xl5h578MPrTKQ==}
     engines: {node: '>= 10'}
     cpu: [arm64]
     os: [linux]
-    libc: [musl]
 
   '@nx/key-linux-x64-gnu@4.0.0':
     resolution: {integrity: sha512-RC4FpcJ+72J8NgJnhwx4XyO1xm0zHzZKe3Wz3xg2LAUj/h/RVWJmqiSVcAItZcBk0XNEvJXR9YlKkT615+Y//A==}
     engines: {node: '>= 10'}
     cpu: [x64]
     os: [linux]
-    libc: [glibc]
 
   '@nx/key-linux-x64-musl@4.0.0':
     resolution: {integrity: sha512-GNORZAgYLPm1I3sJSLukbBv3ac4ctbN1HsPBPzrSxHJygr6R/AaLGEmCVlhOgl2eD+x47Dqcg5WonuY9nwfl8Q==}
     engines: {node: '>= 10'}
     cpu: [x64]
     os: [linux]
-    libc: [musl]
 
   '@nx/key-win32-arm64-msvc@4.0.0':
     resolution: {integrity: sha512-liOMgjzIZbAtePSSpwPER7QIcUTuf883UAFpaQ8v/6w8egysKbJNEOmBk+ANig6/zJ5p6I0S4a7B8J/gUk0tXg==}
@@ -1347,25 +1343,21 @@ packages:
     resolution: {integrity: sha512-aaWUYXFaB9ztrICg0WHuz0tzoil+OkSpWi+wtM9PsV+vNQTYWIPclO+OpSp4am68/bdtuMuITOH99EvEIfv7ZA==}
     cpu: [arm64]
     os: [linux]
-    libc: [glibc]
 
   '@nx/nx-linux-arm64-musl@22.0.2':
     resolution: {integrity: sha512-ylT5GBJCUpTXp5ud8f/uRyW9OA2KR65nuFQ5iXNf1KXwfjGuinFDvZEDDj0zGQ4E/PwLrInqBkkSH25Ry99lOQ==}
     cpu: [arm64]
     os: [linux]
-    libc: [musl]
 
   '@nx/nx-linux-x64-gnu@22.0.2':
     resolution: {integrity: sha512-N8beYlkdKbAC5CA3i5WoqUUbbsSO/0cQk3gMW7c41bouqdMWDUKG6m50d4yHk8V7RFC+sqY59tso3rYmXW3big==}
     cpu: [x64]
     os: [linux]
-    libc: [glibc]
 
   '@nx/nx-linux-x64-musl@22.0.2':
     resolution: {integrity: sha512-Q0joIxZHs9JVr/+6x1bee7z+7Z4SoO0mbhADuugjxly50O44Igg+rx78Iou00VrtSR+Ht5NlpILxOe4GhpFCpA==}
     cpu: [x64]
     os: [linux]
-    libc: [musl]
 
   '@nx/nx-win32-arm64-msvc@22.0.2':
     resolution: {integrity: sha512-/4FXsBh+SB6fKFeVBFptPPWJIeFPQWmK29Q+XLrjYW/31bOs1k2uwn+7QYX0D+Z4HiME3iiRdAInFD9pVlyZbQ==}
@@ -1500,49 +1492,41 @@ packages:
     resolution: {integrity: sha512-SjwhNynjSG2yMdyA0f7wz7Yvo3ppejO+ET7n2oiI7ApCXrwxMzeRWjBzQt+oVWr2HzVOfaEcDS9rMtnR83ulig==}
     cpu: [arm64]
     os: [linux]
-    libc: [glibc]
 
   '@oxc-resolver/binding-linux-arm64-musl@11.6.1':
     resolution: {integrity: sha512-f4EMidK6rosInBzPMnJ0Ri4RttFCvvLNUNDFUBtELW/MFkBwPTDlvbsmW0u0Mk/ruBQ2WmRfOZ6tT62kWMcX2Q==}
     cpu: [arm64]
     os: [linux]
-    libc: [musl]
 
   '@oxc-resolver/binding-linux-ppc64-gnu@11.6.1':
     resolution: {integrity: sha512-1umENVKeUsrWnf5IlF/6SM7DCv8G6CoKI2LnYR6qhZuLYDPS4PBZ0Jow3UDV9Rtbv5KRPcA3/uXjI88ntWIcOQ==}
     cpu: [ppc64]
     os: [linux]
-    libc: [glibc]
 
   '@oxc-resolver/binding-linux-riscv64-gnu@11.6.1':
     resolution: {integrity: sha512-Hjyp1FRdJhsEpIxsZq5VcDuFc8abC0Bgy8DWEa31trCKoTz7JqA7x3E2dkFbrAKsEFmZZ0NvuG5Ip3oIRARhow==}
     cpu: [riscv64]
     os: [linux]
-    libc: [glibc]
 
   '@oxc-resolver/binding-linux-riscv64-musl@11.6.1':
     resolution: {integrity: sha512-ODJOJng6f3QxpAXhLel3kyWs8rPsJeo9XIZHzA7p//e+5kLMDU7bTVk4eZnUHuxsqsB8MEvPCicJkKCEuur5Ag==}
     cpu: [riscv64]
     os: [linux]
-    libc: [musl]
 
   '@oxc-resolver/binding-linux-s390x-gnu@11.6.1':
     resolution: {integrity: sha512-hCzRiLhqe1ZOpHTsTGKp7gnMJRORlbCthawBueer2u22RVAka74pV/+4pP1tqM07mSlQn7VATuWaDw9gCl+cVg==}
     cpu: [s390x]
     os: [linux]
-    libc: [glibc]
 
   '@oxc-resolver/binding-linux-x64-gnu@11.6.1':
     resolution: {integrity: sha512-JansPD8ftOzMYIC3NfXJ68tt63LEcIAx44Blx6BAd7eY880KX7A0KN3hluCrelCz5aQkPaD95g8HBiJmKaEi2w==}
     cpu: [x64]
     os: [linux]
-    libc: [glibc]
 
   '@oxc-resolver/binding-linux-x64-musl@11.6.1':
     resolution: {integrity: sha512-R78ES1rd4z2x5NrFPtSWb/ViR1B8wdl+QN2X8DdtoYcqZE/4tvWtn9ZTCXMEzUp23tchJ2wUB+p6hXoonkyLpA==}
     cpu: [x64]
     os: [linux]
-    libc: [musl]
 
   '@oxc-resolver/binding-wasm32-wasi@11.6.1':
     resolution: {integrity: sha512-qAR3tYIf3afkij/XYunZtlz3OH2Y4ni10etmCFIJB5VRGsqJyI6Hl+2dXHHGJNwbwjXjSEH/KWJBpVroF3TxBw==}
@@ -1900,28 +1884,24 @@ packages:
     engines: {node: '>=10'}
     cpu: [arm64]
     os: [linux]
-    libc: [glibc]
 
   '@swc/core-linux-arm64-musl@1.14.0':
     resolution: {integrity: sha512-uofpVoPCEUjYIv454ZEZ3sLgMD17nIwlz2z7bsn7rl301Kt/01umFA7MscUovFfAK2IRGck6XB+uulMu6aFhKQ==}
     engines: {node: '>=10'}
     cpu: [arm64]
     os: [linux]
-    libc: [musl]
 
   '@swc/core-linux-x64-gnu@1.14.0':
     resolution: {integrity: sha512-quTTx1Olm05fBfv66DEBuOsOgqdypnZ/1Bh3yGXWY7ANLFeeRpCDZpljD9BSjdsNdPOlwJmEUZXMHtGm3v1TZQ==}
     engines: {node: '>=10'}
     cpu: [x64]
     os: [linux]
-    libc: [glibc]
 
   '@swc/core-linux-x64-musl@1.14.0':
     resolution: {integrity: sha512-caaNAu+aIqT8seLtCf08i8C3/UC5ttQujUjejhMcuS1/LoCKtNiUs4VekJd2UGt+pyuuSrQ6dKl8CbCfWvWeXw==}
     engines: {node: '>=10'}
     cpu: [x64]
     os: [linux]
-    libc: [musl]
 
   '@swc/core-win32-arm64-msvc@1.14.0':
     resolution: {integrity: sha512-EeW3jFlT3YNckJ6V/JnTfGcX7UHGyh6/AiCPopZ1HNaGiXVCKHPpVQZicmtyr/UpqxCXLrTgjHOvyMke7YN26A==}

From 4769e62b08369f4b158428a57f7909a5e2db107a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Kh=C3=A1nh=20Ho=C3=A0ng?= <hi@khanh.id>
Date: Thu, 6 Nov 2025 08:31:21 +0700
Subject: [PATCH 32/32] Update publish workflow to trigger on main branch
 instead of tags

---
 .github/workflows/publish.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 2909bfb..3e932c4 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -3,8 +3,8 @@ name: Publish
 on:
   workflow_dispatch:
   push:
-    tags:
-      - '*@*.*.*'
+    branches:
+      - main
 
 permissions:
   contents: read