diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 000000000..bba71a575
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,119 @@
+
+version: 2
+updates:
+  - package-ecosystem: "npm"
+    schedule:
+      interval: "daily"
+      time: "02:00"
+    commit-message:
+      prefix: ":arrow_up: maint"
+      include: scope
+    directory: "/"
+
+  - package-ecosystem: "npm"
+    schedule:
+      interval: "daily"
+      time: "02:00"
+    commit-message:
+      prefix: ":arrow_up: maint"
+      include: scope
+    directory: "/packages/ide/jetbrains"
+  
+  - package-ecosystem: "npm"
+    schedule:
+      interval: "daily"
+      time: "02:00"
+    commit-message:
+      prefix: ":arrow_up: maint"
+      include: scope
+    directory: "/packages/language"
+  
+  - package-ecosystem: "npm"
+    schedule:
+      interval: "daily"
+      time: "02:00"
+    commit-message:
+      prefix: ":arrow_up: maint"
+      include: scope
+    directory: "/packages/misc/redwood"
+  
+  - package-ecosystem: "npm"
+    schedule:
+      interval: "daily"
+      time: "02:00"
+    commit-message:
+      prefix: ":arrow_up: maint"
+      include: scope
+    directory: "/packages/plugins/openapi"
+  
+  - package-ecosystem: "npm"
+    schedule:
+      interval: "daily"
+      time: "02:00"
+    commit-message:
+      prefix: ":arrow_up: maint"
+      include: scope
+    directory: "/packages/plugins/swr"
+  
+  - package-ecosystem: "npm"
+    schedule:
+      interval: "daily"
+      time: "02:00"
+    commit-message:
+      prefix: ":arrow_up: maint"
+      include: scope
+    directory: "/packages/plugins/tanstack-query"
+  
+  - package-ecosystem: "npm"
+    schedule:
+      interval: "daily"
+      time: "02:00"
+    commit-message:
+      prefix: ":arrow_up: maint"
+      include: scope
+    directory: "/packages/plugins/trpc"
+  
+  - package-ecosystem: "npm"
+    schedule:
+      interval: "daily"
+      time: "02:00"
+    commit-message:
+      prefix: ":arrow_up: maint"
+      include: scope
+    directory: "/packages/runtime"
+  
+  - package-ecosystem: "npm"
+    schedule:
+      interval: "daily"
+      time: "02:00"
+    commit-message:
+      prefix: ":arrow_up: maint"
+      include: scope
+    directory: "/packages/sdk"
+  
+  - package-ecosystem: "npm"
+    schedule:
+      interval: "daily"
+      time: "02:00"
+    commit-message:
+      prefix: ":arrow_up: maint"
+      include: scope
+    directory: "/packages/server"
+  
+  - package-ecosystem: "npm"
+    schedule:
+      interval: "daily"
+      time: "02:00"
+    commit-message:
+      prefix: ":arrow_up: maint"
+      include: scope
+    directory: "/packages/testtools"
+
+  - package-ecosystem: "github-actions"
+    schedule:
+      interval: "daily"
+      time: "02:00"
+    commit-message:
+      prefix: ":arrow_up: maint"
+      include: scope
+    directory: "/"
\ No newline at end of file
diff --git a/.github/release/.release-manifest.json b/.github/release/.release-manifest.json
new file mode 100644
index 000000000..5b18bf702
--- /dev/null
+++ b/.github/release/.release-manifest.json
@@ -0,0 +1,14 @@
+{
+    ".": "2.0.0-alpha.1",
+    "packages/ide/jetbrains": "2.0.0-alpha.1",
+    "packages/language": "2.0.0-alpha.1",
+    "packages/misc/redwood": "2.0.0-alpha.1",
+    "packages/plugins/openapi": "2.0.0-alpha.1",
+    "packages/plugins/swr": "2.0.0-alpha.1",
+    "packages/plugins/tanstack-query": "2.0.0-alpha.1",
+    "packages/plugins/trpc": "2.0.0-alpha.1",
+    "packages/runtime": "2.0.0-alpha.1",
+    "packages/sdk": "2.0.0-alpha.1",
+    "packages/server": "2.0.0-alpha.1",
+    "packages/testtools": "2.0.0-alpha.1"
+}
\ No newline at end of file
diff --git a/.github/release/release-main-config.json b/.github/release/release-main-config.json
new file mode 100644
index 000000000..731a26788
--- /dev/null
+++ b/.github/release/release-main-config.json
@@ -0,0 +1,60 @@
+{
+  "packages": {
+    ".": {
+      "package-name": "zenstack-monorepo",
+      "component": "Monorepo"
+    },
+    "packages/ide/jetbrains": {
+      "package-name": "jetbrains",
+      "component": "JetBrains_IDE"
+    },
+    "packages/language": {
+      "package-name": "@zenstackhq/language",
+      "component": "Language"
+    },
+    "packages/misc/redwood": {
+      "package-name": "@zenstackhq/redwood",
+      "component": "Redwood"
+    },
+    "packages/plugins/openapi": {
+      "package-name": "@zenstackhq/openapi",
+      "component": "OpenAPI_Plugin"
+    },
+    "packages/plugins/swr": {
+      "package-name": "@zenstackhq/swr",
+      "component": "SWR_Plugin"
+    },
+    "packages/plugins/tanstack-query": {
+      "package-name": "@zenstackhq/tanstack-query",
+      "component": "Tanstack_Query_Plugin"
+    },
+    "packages/plugins/trpc": {
+      "package-name": "@zenstackhq/trpc",
+      "component": "tRPC_Plugin"
+    },
+    "packages/runtime": {
+      "package-name": "@zenstackhq/runtime",
+      "component": "Runtime"
+    },
+    "packages/sdk": {
+      "package-name": "@zenstackhq/sdk",
+      "component": "SDK"
+    },
+    "packages/server": {
+      "package-name": "@zenstackhq/server",
+      "component": "Server"
+    },
+    "packages/testtools": {
+      "package-name": "@zenstackhq/testtools",
+      "component": "Test_Tools"
+    }
+  },
+  "pull-request-footer": "This PR was generated by [Release-Please](https://github.com/googleapis/release-please), and approved by the ZenStack Team.",
+  "bump-minor-pre-major": true,
+  "bump-patch-for-minor-pre-major": true,
+  "sequential-calls": true,
+  "separate-pull-requests": true,
+  "versioning": "default",
+  "release-type": "node",
+  "$schema": "https://raw.githubusercontent.com/googleapis/release-please/main/schemas/config.json"
+}
\ No newline at end of file
diff --git a/.github/workflows/build-test.yml b/.github/workflows/build-test.yml
index cbdbce76c..27982bbd2 100644
--- a/.github/workflows/build-test.yml
+++ b/.github/workflows/build-test.yml
@@ -8,8 +8,22 @@ env:
     DO_NOT_TRACK: '1'
 
 on:
-    pull_request:
-        branches: ['dev', 'main', 'v2']
+  merge_group:
+  push:
+    branches: 
+      - main
+      - dev
+      - release/*
+      - v2
+  pull_request:
+    branches: 
+      - main
+      - dev
+      - release/*
+      - v2
+
+permissions:
+  contents: read
 
 jobs:
     build-test:
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
new file mode 100644
index 000000000..0a2173708
--- /dev/null
+++ b/.github/workflows/codeql.yml
@@ -0,0 +1,77 @@
+
+name: Security - CodeQL
+
+on:
+  merge_group:
+  push:
+    branches: 
+      - main
+      - dev
+      - release/*
+      - v2
+  pull_request:
+    branches: 
+      - main
+      - dev
+      - release/*
+      - v2
+  schedule:
+    - cron: "0 0 * * 1"
+
+permissions:
+  contents: read
+  
+
+jobs:
+  analyze:
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+    name: Analyze
+    runs-on: ubuntu-latest
+    
+    strategy:
+      fail-fast: false
+      matrix:
+        language: ["javascript", "typescript"]
+        # CodeQL supports [ $supported-codeql-languages ]
+        # Learn more about CodeQL language support at https://aka.ms/codeql-docs/language-support
+
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 # v2.6.1
+        with:
+          egress-policy: audit
+
+      - name: Checkout repository
+        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
+
+      # Initializes the CodeQL tools for scanning.
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v2.22.12
+        with:
+          languages: ${{ matrix.language }}
+          # If you wish to specify custom queries, you can do so here or in a config file.
+          # By default, queries listed here will override any specified in a config file.
+          # Prefix the list here with "+" to use these queries and those in the config file.
+
+      # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
+      # If this step fails, then you should remove it and run the build manually (see below)
+      - name: Autobuild
+        uses: github/codeql-action/autobuild@1500a131381b66de0c52ac28abb13cd79f4b7ecc # v2.22.12
+
+      # ℹ️ Command-line programs to run using the OS shell.
+      # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
+
+      #   If the Autobuild fails above, remove it and uncomment the following three lines.
+      #   modify them (or add more) to build your code if your project, please refer to the EXAMPLE below for guidance.
+
+      # - run: |
+      #   echo "Run, Build Application using script"
+      #   ./location_of_script_within_repo/buildscript.sh
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@1500a131381b66de0c52ac28abb13cd79f4b7ecc # v2.22.12
+        with:
+          category: "/language:${{matrix.language}}"
diff --git a/.github/workflows/management-changelog.yml b/.github/workflows/management-changelog.yml
new file mode 100644
index 000000000..12a968f46
--- /dev/null
+++ b/.github/workflows/management-changelog.yml
@@ -0,0 +1,66 @@
+
+
+
+on:
+  push:
+    branches:
+    - main # Your main branch
+    - dev # Your development branch
+    - release/* # Your releases branch
+    # - v2 # Your current v2 branch - disabled for now because I don't know if you want to have this tag on this branch or not -_- 
+    # TODO: Rename your V2 brach to release/v2 for proper versioning if you intend to use a Release branch method
+
+permissions:
+  contents: read
+
+name: Management - Release Workflow
+
+jobs:
+  release:
+    permissions:
+      contents: write
+      pull-requests: write
+    env:
+      GITHUB_TOKEN: ${{ secrets.BOT_TOKEN || github.token }} # Bot Token is a PAT for a automation account.
+    runs-on: ubuntu-latest
+    steps:
+      # Harden-Runner provides runtime security for GitHub-hosted and self-hosted environments.
+      - name: Harden Runner
+        uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 # v2.6.1
+        with:
+          egress-policy: audit
+
+      # This tells you useful infomation about the workflow, but it's not required (hence commented out) - it's just nice to have
+      # - name: Workflow Telemetry
+      #   uses: catchpoint/workflow-telemetry-action@6705383eabd01833acfe8412ec697384830e1455 # v1.8.7
+      #   with: 
+      #     comment_on_pr: false
+      #     theme: dark
+      #     proc_trace_sys_enable: true
+      
+      - uses: google-github-actions/release-please-action@v4
+        id: release
+        with:
+          config-file: '.github/release/release-main-config.json'
+          manifest-file: '.github/release/.release-manifest.json'
+          target-branch: ${{ github.ref_name == 'dev' && 'main' || github.ref_name }}
+          include-component-in-tag: true
+      
+      - uses: actions/checkout@v4
+        if: ${{ steps.release.outputs.release_created }}
+
+      - uses: actions/setup-node@v4
+        if: ${{ steps.release.outputs.release_created }}
+        with:
+          node-version: 12
+          registry-url: 'https://registry.npmjs.org'
+
+      - run: pnpm i # Install using pnpm
+        if: ${{ steps.release.outputs.release_created }}
+
+      - run: pnpm publish-all # Publish using pre-defined pnpm script
+        if: ${{ steps.release.outputs.release_created }}
+        env:
+          NODE_AUTH_TOKEN: ${{secrets.NPM_TOKEN}}
+        
+        
\ No newline at end of file
diff --git a/.github/workflows/security-defender-for-devops.yml b/.github/workflows/security-defender-for-devops.yml
new file mode 100644
index 000000000..dc32fc584
--- /dev/null
+++ b/.github/workflows/security-defender-for-devops.yml
@@ -0,0 +1,72 @@
+
+# This workflow uses actions that are not certified by GitHub.
+# They are provided by a third-party and are governed by
+# separate terms of service, privacy policy, and support
+# documentation.
+#
+# Microsoft Security DevOps (MSDO) is a command line application which integrates static analysis tools into the development cycle.
+# MSDO installs, configures and runs the latest versions of static analysis tools
+# (including, but not limited to, SDL/security and compliance tools).
+#
+# The Microsoft Security DevOps action is currently in beta and runs on the windows-latest queue,
+# as well as Windows self hosted agents. ubuntu-latest support coming soon.
+#
+# For more information about the action , check out https://github.com/microsoft/security-devops-action
+#
+# Please note this workflow do not integrate your GitHub Org with Microsoft Defender For DevOps. You have to create an integration
+# and provide permission before this can report data back to azure.
+# Read the official documentation here : https://learn.microsoft.com/en-us/azure/defender-for-cloud/quickstart-onboard-github
+
+name: Security - Microsoft Defender For Devops
+
+on:
+  merge_group:
+  push:
+    branches: 
+      - main
+      - dev
+      - release/*
+      - v2
+  pull_request:
+    branches: 
+      - main
+      - dev
+      - release/*
+      - v2
+  schedule:
+    - cron: '34 12 * * 0'
+
+permissions:
+  contents: read
+  security-events: read
+
+jobs:
+  MSDO:
+    # currently only windows latest is supported
+    runs-on: windows-latest
+    permissions:
+      security-events: write
+
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 # v2.6.1
+        with:
+          egress-policy: audit
+
+      # checks out the repository
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-dotnet@3447fd6a9f9e57506b15f895c5b76d3b197dc7c2 # v3.2.0
+        with:
+          dotnet-version: |
+            5.0.x
+            6.0.x
+
+      - name: Run Microsoft Security DevOps
+        uses: microsoft/security-devops-action@v1.6.0
+        id: msdo
+
+      - name: Upload results to Security tab
+        uses: github/codeql-action/upload-sarif@1500a131381b66de0c52ac28abb13cd79f4b7ecc # v2.22.12
+        with:
+          sarif_file: ${{ steps.msdo.outputs.sarifFile }}
diff --git a/.github/workflows/security-dependency-review.yml b/.github/workflows/security-dependency-review.yml
new file mode 100644
index 000000000..17b0f0506
--- /dev/null
+++ b/.github/workflows/security-dependency-review.yml
@@ -0,0 +1,35 @@
+
+# Dependency Review Action
+#
+# This Action will scan dependency manifest files that change as part of a Pull Request,
+# surfacing known-vulnerable versions of the packages declared or updated in the PR.
+# Once installed, if the workflow run is marked as required,
+# PRs introducing known-vulnerable packages will be blocked from merging.
+#
+# Source repository: https://github.com/actions/dependency-review-action
+name: Security - Dependency Review
+on: 
+  merge_group:
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  dependency-review:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 # v2.6.1
+        with:
+          egress-policy: audit
+
+      # checks out the repository
+      - uses: actions/checkout@v4
+        with:
+          submodules: 'recursive'
+          token: ${{ secrets.BOT_TOKEN || github.token }} # Bot Token is a PAT for a automation account.
+
+      - name: 'Dependency Review'
++       uses: actions/dependency-review-action@v2.5.1
+        uses: actions/dependency-review-action@0efb1d1d84fc9633afcdaad14c485cbbc90ef46c # v2.5.1 
diff --git a/.github/workflows/security-ossar.yml b/.github/workflows/security-ossar.yml
new file mode 100644
index 000000000..10db124ae
--- /dev/null
+++ b/.github/workflows/security-ossar.yml
@@ -0,0 +1,75 @@
+
+# This workflow uses actions that are not certified by GitHub.
+# They are provided by a third-party and are governed by
+# separate terms of service, privacy policy, and support
+# documentation.
+
+# This workflow integrates a collection of open source static analysis tools
+# with GitHub code scanning. For documentation, or to provide feedback, visit
+# https://github.com/github/ossar-action
+name: Security - OSSAR
+
+on:
+  merge_group:
+  push:
+    branches: 
+      - main
+      - dev
+      - release/*
+      - v2
+  pull_request:
+    branches: 
+      - main
+      - dev
+      - release/*
+      - v2
+  schedule:
+    - cron: '41 3 * * 5'
+
+permissions:
+  contents: read
+
+jobs:
+  OSSAR-Scan:
+    runs-on: windows-latest
+    permissions:
+      contents: read # for actions/checkout to fetch code
+      security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
+      actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
+
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 # v2.6.1
+        with:
+          egress-policy: audit
+
+      - name: Workflow Telemetry
+        uses: catchpoint/workflow-telemetry-action@6705383eabd01833acfe8412ec697384830e1455 # v1.8.7
+        with: 
+          github_token: ${{ secrets.BOT_TOKEN || github.token }} # Bot Token is a PAT for a automation account.
+          comment_on_pr: false
+          theme: dark
+          proc_trace_sys_enable: true
+
+      # checks out the repository
+      - uses: actions/checkout@v4
+        with:
+          submodules: 'recursive'
+          token: ${{ secrets.BOT_TOKEN || github.token }} # Bot Token is a PAT for a automation account.
+
+      - uses: actions/setup-dotnet@3447fd6a9f9e57506b15f895c5b76d3b197dc7c2 # v3.2.0
+        with:
+          dotnet-version: |
+            5.0.x
+            6.0.x
+
+      # Run open source static analysis tools
+      - name: Run OSSAR
+        uses: github/ossar-action@v1
+        id: ossar
+
+        # Upload results to the Security tab
+      - name: Upload OSSAR results
+        uses: github/codeql-action/upload-sarif@1500a131381b66de0c52ac28abb13cd79f4b7ecc # v2.22.12
+        with:
+          sarif_file: ${{ steps.ossar.outputs.sarifFile }}
diff --git a/.github/workflows/security-scorecard.yml b/.github/workflows/security-scorecard.yml
new file mode 100644
index 000000000..1222d331c
--- /dev/null
+++ b/.github/workflows/security-scorecard.yml
@@ -0,0 +1,81 @@
+
+
+
+# This workflow uses actions that are not certified by GitHub. They are provided
+# by a third-party and are governed by separate terms of service, privacy
+# policy, and support documentation.
+
+name: Security - Scorecard supply-chain security
+on:
+  # For Branch-Protection check. Only the default branch is supported. See
+  # https://github.com/ossf/scorecard/blob/main/docs/checks.md#branch-protection
+  branch_protection_rule:
+  # To guarantee Maintained check is occasionally updated. See
+  # https://github.com/ossf/scorecard/blob/main/docs/checks.md#maintained
+  schedule:
+    - cron: '21 9 * * 6'
+  push:
+    branches:  
+    - main
+    - dev
+
+# Declare default permissions as read only.
+permissions: 
+ contents: read
+
+jobs:
+  analysis:
+    name: Scorecard analysis
+    runs-on: ubuntu-latest
+    permissions:
+      # Needed to upload the results to code-scanning dashboard.
+      security-events: write
+      # Needed to publish results and get a badge (see publish_results below).
+      id-token: write
+      # Uncomment the permissions below if installing in a private repository.
+      # contents: read
+      # actions: read
+
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 # v2.6.1
+        with:
+          egress-policy: audit
+
+      - name: Workflow Telemetry
+        uses: catchpoint/workflow-telemetry-action@6705383eabd01833acfe8412ec697384830e1455 # v1.8.7
+        with: 
+          github_token: ${{ secrets.BOT_TOKEN || github.token }} # Bot Token is a PAT for a automation account.
+          comment_on_pr: false
+          theme: dark
+          proc_trace_sys_enable: true
+
+      # checks out the repository
+      - uses: actions/checkout@v4
+        with:
+          submodules: 'recursive'
+          token: ${{ secrets.BOT_TOKEN || github.token }} # Bot Token is a PAT for a automation account.
+
+      - name: "Run analysis"
++       uses: ossf/scorecard-action@v2.1.2
+        uses: ossf/scorecard-action@e38b1902ae4f44df626f11ba0734b14fb91f8f86 # v2.1.2
+        with:
+          results_file: results.sarif
+          results_format: sarif
+          repo_token: ${{ secrets.BOT_TOKEN || github.token }} # Bot Token is a PAT for a automation account.
+          publish_results: true
+
+      # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
+      # format to the repository Actions tab.
+      - name: "Upload artifact"
+        uses: actions/upload-artifact@3cea5372237819ed00197afe530f5a7ea3e805c8 # v3.1.0
+        with:
+          name: SARIF file
+          path: results.sarif
+          retention-days: 5
+
+      # Upload the results to GitHub's code scanning dashboard.
+      - name: "Upload to code-scanning"
+        uses: github/codeql-action/upload-sarif@17573ee1cc1b9d061760f3a006fc4aac4f944fd5 # v2.2.4
+        with:
+          sarif_file: results.sarif