@anthusai/papyrus 5.12.0 → 5.13.0

package/infra/amplify-app-shell.js

@@ -4,7 +4,7 @@ import * as amplify from "aws-cdk-lib/aws-amplify";
 import * as secretsmanager from "aws-cdk-lib/aws-secretsmanager";
 import { GITHUB_OIDC_PROVIDER_HOST } from "./github-oidc-provider.js";
 import { cmsProductionBuildSpec, cmsStagingBuildSpec, readerBuildSpec } from "./build-specs.js";
-import { PROSPECTUS_PAPYRUS_SITE_ROUTES, hasCmsApp, isStagingEnabled, resolveRedirectSubDomainPrefix, resolveCmsHostName, resolveProspectusAccountsEndpoint, resolveRevalidateSecretParameterName, resolveStackName, resolveStagingDomainName, resolveStoragePreviewPrefix } from "./site-config.js";
+import { PROSPECTUS_PAPYRUS_SITE_ROUTES, hasCmsApp, isStagingEnabled, resolveRedirectSubDomainPrefix, resolveCmsHostName, githubOidcSubjects, resolveGithubRepository, resolveProspectusAccountsEndpoint, resolveRevalidateSecretParameterName, resolveStackName, resolveStagingDomainName, resolveStoragePreviewPrefix } from "./site-config.js";
 function environmentVariables(variables) {
     return Object.entries(variables).map(([name, value]) => ({ name, value }));
 }
@@ -68,6 +68,9 @@ export class AmplifyAppShellStack extends Stack {
             if (!config.reader)
                 throw new Error(`site ${config.siteId} has neither a cms section nor a reader`);
             this.readerAppId = this.addReaderApp(config, config.reader);
+            if (config.autoDeploy) {
+                this.addGithubDeployRole(config, [{ appId: this.readerAppId, branch: config.reader.branchName ?? "main" }]);
+            }
             return;
         }
         const cmsAppName = config.cms.appName ?? `${config.siteId}-cms`;
@@ -165,7 +168,8 @@ export class AmplifyAppShellStack extends Stack {
             appId: cmsApp.attrAppId,
             branchName: "main",
             stage: "PRODUCTION",
-            enableAutoBuild: true,
+            // Auto-build off when GitHub Actions starts the job on merge (autoDeploy): nothing may double-build.
+            enableAutoBuild: !config.autoDeploy,
             enablePerformanceMode: false,
             environmentVariables: environmentVariables({
                 ...config.cms.environment,
@@ -247,6 +251,12 @@ export class AmplifyAppShellStack extends Stack {
         }
         const amplifyAppIds = [cmsApp.attrAppId, ...(this.readerAppId ? [this.readerAppId] : [])];
         this.addAuthoringRole(config, cmsApp.attrAppId, amplifyAppIds);
+        if (config.autoDeploy) {
+            this.addGithubDeployRole(config, [
+                { appId: cmsApp.attrAppId, branch: "main" },
+                ...(this.readerAppId && config.reader ? [{ appId: this.readerAppId, branch: config.reader.branchName ?? "main" }] : []),
+            ]);
+        }
         if (config.github) {
             this.addGithubCiRole(config, config.github, cmsApp.attrAppId, amplifyAppIds);
         }
@@ -294,6 +304,46 @@ export class AmplifyAppShellStack extends Stack {
             description: `Role the Papyrus CLI assumes for ${config.siteId} (profile role_arn)`,
         });
     }
+    /**
+     * The merge-to-main deploy role: assumable only by a GitHub Actions run on `main` of the site's own
+     * repository (OIDC, no keys), and able to do exactly one thing: start and read Amplify jobs on the
+     * production branch of the site's apps.
+     */
+    addGithubDeployRole(config, targets) {
+        const { owner, repo } = resolveGithubRepository(config);
+        const provider = iam.OpenIdConnectProvider.fromOpenIdConnectProviderArn(this, "GithubDeployOidcProvider", this.formatArn({
+            service: "iam",
+            region: "",
+            resource: "oidc-provider",
+            resourceName: GITHUB_OIDC_PROVIDER_HOST,
+            arnFormat: ArnFormat.SLASH_RESOURCE_NAME,
+        }));
+        const deployRole = new iam.Role(this, "GithubDeployRole", {
+            roleName: `${config.siteId}-github-deploy`,
+            description: `Merge-to-main deploy for ${owner}/${repo}: GitHub OIDC on refs/heads/main only; amplify:StartJob and GetJob on the production branch of the site's apps only`,
+            maxSessionDuration: Duration.hours(1),
+            assumedBy: new iam.OpenIdConnectPrincipal(provider, {
+                StringEquals: {
+                    [`${GITHUB_OIDC_PROVIDER_HOST}:aud`]: "sts.amazonaws.com",
+                    [`${GITHUB_OIDC_PROVIDER_HOST}:sub`]: githubOidcSubjects(config, "main"),
+                },
+            }),
+        });
+        deployRole.addToPolicy(new iam.PolicyStatement({
+            sid: "StartAndReadProductionJobs",
+            actions: ["amplify:StartJob", "amplify:GetJob"],
+            resources: targets.map((target) => this.formatArn({
+                service: "amplify",
+                resource: "apps",
+                resourceName: `${target.appId}/branches/${target.branch}/jobs/*`,
+                arnFormat: ArnFormat.SLASH_RESOURCE_NAME,
+            })),
+        }));
+        new CfnOutput(this, "GithubDeployRoleArn", {
+            value: deployRole.roleArn,
+            description: `Role for the merge-to-main deploy workflow in ${owner}/${repo}`,
+        });
+    }
     addGithubCiRole(config, github, cmsAppId, amplifyAppIds) {
         const provider = iam.OpenIdConnectProvider.fromOpenIdConnectProviderArn(this, "GithubOidcProvider", this.formatArn({
             service: "iam",
@@ -309,7 +359,7 @@ export class AmplifyAppShellStack extends Stack {
             assumedBy: new iam.OpenIdConnectPrincipal(provider, {
                 StringEquals: { [`${GITHUB_OIDC_PROVIDER_HOST}:aud`]: "sts.amazonaws.com" },
                 StringLike: {
-                    [`${GITHUB_OIDC_PROVIDER_HOST}:sub`]: github.branches.map((branch) => `repo:${github.owner}/${github.repo}:ref:refs/heads/${branch}`),
+                    [`${GITHUB_OIDC_PROVIDER_HOST}:sub`]: github.branches.flatMap((branch) => githubOidcSubjects(config, branch)),
                 },
             }),
         });
@@ -361,7 +411,7 @@ export class AmplifyAppShellStack extends Stack {
             appId: readerApp.attrAppId,
             branchName: readerBranchName,
             stage: "PRODUCTION",
-            enableAutoBuild: true,
+            enableAutoBuild: !config.autoDeploy,
             environmentVariables: environmentVariables({
                 ...(reader.environment ?? {}),
                 PAPYRUS_SITE_BRAND: config.brand,

package/infra/amplify-app-shell.ts

@@ -5,7 +5,7 @@ import * as amplify from "aws-cdk-lib/aws-amplify";
 import * as secretsmanager from "aws-cdk-lib/aws-secretsmanager";
 import { GITHUB_OIDC_PROVIDER_HOST } from "./github-oidc-provider";
 import { cmsProductionBuildSpec, cmsStagingBuildSpec, readerBuildSpec } from "./build-specs";
-import { AmplifyAppShellSiteConfig, PROSPECTUS_PAPYRUS_SITE_ROUTES, ReaderCustomHeaderRule, hasCmsApp, isStagingEnabled, resolveRedirectSubDomainPrefix, resolveCmsHostName, resolveProspectusAccountsEndpoint, resolveRevalidateSecretParameterName, resolveStackName, resolveStagingDomainName, resolveStoragePreviewPrefix } from "./site-config";
+import { AmplifyAppShellSiteConfig, PROSPECTUS_PAPYRUS_SITE_ROUTES, ReaderCustomHeaderRule, hasCmsApp, isStagingEnabled, resolveRedirectSubDomainPrefix, resolveCmsHostName, githubOidcSubjects, resolveGithubRepository, resolveProspectusAccountsEndpoint, resolveRevalidateSecretParameterName, resolveStackName, resolveStagingDomainName, resolveStoragePreviewPrefix } from "./site-config";
 
 function environmentVariables(variables: Record<string, string>): amplify.CfnBranch.EnvironmentVariableProperty[] {
   return Object.entries(variables).map(([name, value]) => ({ name, value }));
@@ -72,6 +72,9 @@ export class AmplifyAppShellStack extends Stack {
     if (!hasCmsApp(config)) {
       if (!config.reader) throw new Error(`site ${config.siteId} has neither a cms section nor a reader`);
       this.readerAppId = this.addReaderApp(config, config.reader);
+      if (config.autoDeploy) {
+        this.addGithubDeployRole(config, [{ appId: this.readerAppId, branch: config.reader.branchName ?? "main" }]);
+      }
       return;
     }
 
@@ -185,7 +188,8 @@ export class AmplifyAppShellStack extends Stack {
       appId: cmsApp.attrAppId,
       branchName: "main",
       stage: "PRODUCTION",
-      enableAutoBuild: true,
+      // Auto-build off when GitHub Actions starts the job on merge (autoDeploy): nothing may double-build.
+      enableAutoBuild: !config.autoDeploy,
       enablePerformanceMode: false,
       environmentVariables: environmentVariables({
         ...config.cms.environment,
@@ -274,6 +278,13 @@ export class AmplifyAppShellStack extends Stack {
     const amplifyAppIds = [cmsApp.attrAppId, ...(this.readerAppId ? [this.readerAppId] : [])];
     this.addAuthoringRole(config, cmsApp.attrAppId, amplifyAppIds);
 
+    if (config.autoDeploy) {
+      this.addGithubDeployRole(config, [
+        { appId: cmsApp.attrAppId, branch: "main" },
+        ...(this.readerAppId && config.reader ? [{ appId: this.readerAppId, branch: config.reader.branchName ?? "main" }] : []),
+      ]);
+    }
+
     if (config.github) {
       this.addGithubCiRole(config, config.github, cmsApp.attrAppId, amplifyAppIds);
     }
@@ -326,6 +337,55 @@ export class AmplifyAppShellStack extends Stack {
     });
   }
 
+  /**
+   * The merge-to-main deploy role: assumable only by a GitHub Actions run on `main` of the site's own
+   * repository (OIDC, no keys), and able to do exactly one thing: start and read Amplify jobs on the
+   * production branch of the site's apps.
+   */
+  private addGithubDeployRole(config: AmplifyAppShellSiteConfig, targets: { appId: string; branch: string }[]): void {
+    const { owner, repo } = resolveGithubRepository(config);
+    const provider = iam.OpenIdConnectProvider.fromOpenIdConnectProviderArn(
+      this,
+      "GithubDeployOidcProvider",
+      this.formatArn({
+        service: "iam",
+        region: "",
+        resource: "oidc-provider",
+        resourceName: GITHUB_OIDC_PROVIDER_HOST,
+        arnFormat: ArnFormat.SLASH_RESOURCE_NAME,
+      }),
+    );
+    const deployRole = new iam.Role(this, "GithubDeployRole", {
+      roleName: `${config.siteId}-github-deploy`,
+      description: `Merge-to-main deploy for ${owner}/${repo}: GitHub OIDC on refs/heads/main only; amplify:StartJob and GetJob on the production branch of the site's apps only`,
+      maxSessionDuration: Duration.hours(1),
+      assumedBy: new iam.OpenIdConnectPrincipal(provider, {
+        StringEquals: {
+          [`${GITHUB_OIDC_PROVIDER_HOST}:aud`]: "sts.amazonaws.com",
+          [`${GITHUB_OIDC_PROVIDER_HOST}:sub`]: githubOidcSubjects(config, "main"),
+        },
+      }),
+    });
+    deployRole.addToPolicy(
+      new iam.PolicyStatement({
+        sid: "StartAndReadProductionJobs",
+        actions: ["amplify:StartJob", "amplify:GetJob"],
+        resources: targets.map((target) =>
+          this.formatArn({
+            service: "amplify",
+            resource: "apps",
+            resourceName: `${target.appId}/branches/${target.branch}/jobs/*`,
+            arnFormat: ArnFormat.SLASH_RESOURCE_NAME,
+          }),
+        ),
+      }),
+    );
+    new CfnOutput(this, "GithubDeployRoleArn", {
+      value: deployRole.roleArn,
+      description: `Role for the merge-to-main deploy workflow in ${owner}/${repo}`,
+    });
+  }
+
   private addGithubCiRole(
     config: AmplifyAppShellSiteConfig,
     github: NonNullable<AmplifyAppShellSiteConfig["github"]>,
@@ -351,9 +411,7 @@ export class AmplifyAppShellStack extends Stack {
       assumedBy: new iam.OpenIdConnectPrincipal(provider, {
         StringEquals: { [`${GITHUB_OIDC_PROVIDER_HOST}:aud`]: "sts.amazonaws.com" },
         StringLike: {
-          [`${GITHUB_OIDC_PROVIDER_HOST}:sub`]: github.branches.map(
-            (branch) => `repo:${github.owner}/${github.repo}:ref:refs/heads/${branch}`,
-          ),
+          [`${GITHUB_OIDC_PROVIDER_HOST}:sub`]: github.branches.flatMap((branch) => githubOidcSubjects(config, branch)),
         },
       }),
     });
@@ -420,7 +478,7 @@ export class AmplifyAppShellStack extends Stack {
       appId: readerApp.attrAppId,
       branchName: readerBranchName,
       stage: "PRODUCTION",
-      enableAutoBuild: true,
+      enableAutoBuild: !config.autoDeploy,
       environmentVariables: environmentVariables({
         ...(reader.environment ?? {}),
         PAPYRUS_SITE_BRAND: config.brand,

package/infra/site-config.js

@@ -2,6 +2,22 @@ export const READER_REDIRECT_STATUSES = ["301", "302", "200", "404", "404-200"];
 export function hasCmsApp(config) {
     return config.cms !== undefined;
 }
+export function resolveGithubRepository(config) {
+    if (config.github)
+        return { owner: config.github.owner, repo: config.github.repo };
+    const [owner, repo] = config.repository.replace("https://github.com/", "").split("/");
+    return { owner, repo };
+}
+/** The OIDC `sub` values a GitHub Actions run on `ref` of the site's repository can present. */
+export function githubOidcSubjects(config, ref) {
+    const { owner, repo } = resolveGithubRepository(config);
+    const subjects = [`repo:${owner}/${repo}:ref:refs/heads/${ref}`];
+    const { ownerId, repoId } = config.github ?? {};
+    if (ownerId !== undefined && repoId !== undefined) {
+        subjects.push(`repo:${owner}@${ownerId}/${repo}@${repoId}:ref:refs/heads/${ref}`);
+    }
+    return subjects;
+}
 export const DEFAULT_CI_BRANCHES = ["main", "staging"];
 const SITE_ID_PATTERN = /^[a-z][a-z0-9]*(-[a-z0-9]+)*$/;
 const REPOSITORY_PATTERN = /^https:\/\/github\.com\/[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/;
@@ -302,7 +318,7 @@ function validateOauthRedirectUrls(config) {
 }
 export function parseSiteConfig(raw) {
     const record = requireObject(raw, "site");
-    rejectUnknownKeys(record, ["siteId", "repository", "repositoryAccessTokenSecretArn", "brand", "frontend", "hostedZoneId", "stackName", "cms", "reader", "papyrusVersion", "storagePreviewPrefix", "github"], "site");
+    rejectUnknownKeys(record, ["siteId", "repository", "repositoryAccessTokenSecretArn", "brand", "frontend", "hostedZoneId", "stackName", "cms", "reader", "papyrusVersion", "storagePreviewPrefix", "autoDeploy", "github"], "site");
     const siteId = requireString(record.siteId, "siteId", SITE_ID_PATTERN, "kebab-case");
     const repository = requireString(record.repository, "repository", REPOSITORY_PATTERN, "https://github.com/<org>/<repo>");
     const repositoryAccessTokenSecretArn = record.repositoryAccessTokenSecretArn === undefined
@@ -352,12 +368,15 @@ export function parseSiteConfig(raw) {
     if (cms?.stagingPreview !== undefined && cms.staging === false) {
         fail("cms.stagingPreview", "must not be set when cms.staging is false");
     }
+    const autoDeploy = record.autoDeploy ?? true;
+    if (typeof autoDeploy !== "boolean")
+        fail("autoDeploy", "must be a boolean");
     let github;
     if (record.github !== undefined) {
         if (cms === undefined)
             fail("github", "requires cms (the CI role is scoped to the CMS app)");
         const githubRecord = requireObject(record.github, "github");
-        rejectUnknownKeys(githubRecord, ["owner", "repo", "branches", "ciCanDeployInfra"], "github");
+        rejectUnknownKeys(githubRecord, ["owner", "repo", "branches", "ciCanDeployInfra", "ownerId", "repoId"], "github");
         const owner = requireString(githubRecord.owner, "github.owner", GITHUB_OWNER_PATTERN, "plain GitHub login");
         const repo = requireString(githubRecord.repo, "github.repo", GITHUB_REPO_PATTERN);
         if (repository !== `https://github.com/${owner}/${repo}`) {
@@ -378,7 +397,18 @@ export function parseSiteConfig(raw) {
         const ciCanDeployInfra = githubRecord.ciCanDeployInfra ?? false;
         if (typeof ciCanDeployInfra !== "boolean")
             fail("github.ciCanDeployInfra", "must be a boolean");
-        github = { owner, repo, branches, ciCanDeployInfra: ciCanDeployInfra };
+        const optionalId = (value, name) => {
+            if (value === undefined)
+                return undefined;
+            if (typeof value !== "number" || !Number.isSafeInteger(value) || value <= 0)
+                fail(name, "must be a positive integer (GitHub numeric id)");
+            return value;
+        };
+        const ownerId = optionalId(githubRecord.ownerId, "github.ownerId");
+        const repoId = optionalId(githubRecord.repoId, "github.repoId");
+        if ((ownerId === undefined) !== (repoId === undefined))
+            fail("github", "ownerId and repoId must be set together");
+        github = { owner, repo, branches, ciCanDeployInfra: ciCanDeployInfra, ...(ownerId !== undefined ? { ownerId, repoId } : {}) };
     }
     const hasDomain = cms?.domainName !== undefined || reader?.domainName !== undefined;
     if (hasDomain && hostedZoneId === undefined) {
@@ -399,6 +429,7 @@ export function parseSiteConfig(raw) {
         reader,
         papyrusVersion,
         storagePreviewPrefix,
+        autoDeploy: autoDeploy,
         github,
     };
     if (hasCmsApp(config))

package/infra/site-config.ts

@@ -69,11 +69,25 @@ export type AmplifyAppShellSiteConfig = {
   };
   papyrusVersion: string;
   storagePreviewPrefix?: string;
+  /**
+   * Merge-to-main deploy from GitHub Actions through OIDC. When true (the default) the stack creates the
+   * `<siteId>-github-deploy` role and turns off Amplify's own auto-build on the production branches, so the
+   * public repository's workflow is the only trigger. Set false for a site whose repository is private:
+   * private repositories get no Actions minutes, so Amplify's own repository-connected auto-build stays on.
+   */
+  autoDeploy: boolean;
   github?: {
     owner: string;
     repo: string;
     branches: string[];
     ciCanDeployInfra: boolean;
+    /**
+     * GitHub's numeric ids of the owner and the repository. Repositories with the immutable OIDC subject
+     * (`repo:<owner>@<ownerId>/<repo>@<repoId>:ref:...`, see `gh api repos/<owner>/<repo>/actions/oidc/customization/sub`)
+     * present that form instead of `repo:<owner>/<repo>:ref:...`; with both ids set, roles trust both forms.
+     */
+    ownerId?: number;
+    repoId?: number;
   };
 };
 
@@ -83,6 +97,23 @@ export function hasCmsApp(config: AmplifyAppShellSiteConfig): config is CmsSiteC
   return config.cms !== undefined;
 }
 
+export function resolveGithubRepository(config: Pick<AmplifyAppShellSiteConfig, "repository" | "github">): { owner: string; repo: string } {
+  if (config.github) return { owner: config.github.owner, repo: config.github.repo };
+  const [owner, repo] = config.repository.replace("https://github.com/", "").split("/");
+  return { owner, repo };
+}
+
+/** The OIDC `sub` values a GitHub Actions run on `ref` of the site's repository can present. */
+export function githubOidcSubjects(config: Pick<AmplifyAppShellSiteConfig, "repository" | "github">, ref: string): string[] {
+  const { owner, repo } = resolveGithubRepository(config);
+  const subjects = [`repo:${owner}/${repo}:ref:refs/heads/${ref}`];
+  const { ownerId, repoId } = config.github ?? {};
+  if (ownerId !== undefined && repoId !== undefined) {
+    subjects.push(`repo:${owner}@${ownerId}/${repo}@${repoId}:ref:refs/heads/${ref}`);
+  }
+  return subjects;
+}
+
 export const DEFAULT_CI_BRANCHES = ["main", "staging"];
 
 const SITE_ID_PATTERN = /^[a-z][a-z0-9]*(-[a-z0-9]+)*$/;
@@ -399,7 +430,7 @@ export function parseSiteConfig(raw: unknown): AmplifyAppShellSiteConfig {
   const record = requireObject(raw, "site");
   rejectUnknownKeys(
     record,
-    ["siteId", "repository", "repositoryAccessTokenSecretArn", "brand", "frontend", "hostedZoneId", "stackName", "cms", "reader", "papyrusVersion", "storagePreviewPrefix", "github"],
+    ["siteId", "repository", "repositoryAccessTokenSecretArn", "brand", "frontend", "hostedZoneId", "stackName", "cms", "reader", "papyrusVersion", "storagePreviewPrefix", "autoDeploy", "github"],
     "site",
   );
 
@@ -452,11 +483,14 @@ export function parseSiteConfig(raw: unknown): AmplifyAppShellSiteConfig {
     fail("cms.stagingPreview", "must not be set when cms.staging is false");
   }
 
+  const autoDeploy = record.autoDeploy ?? true;
+  if (typeof autoDeploy !== "boolean") fail("autoDeploy", "must be a boolean");
+
   let github: AmplifyAppShellSiteConfig["github"];
   if (record.github !== undefined) {
     if (cms === undefined) fail("github", "requires cms (the CI role is scoped to the CMS app)");
     const githubRecord = requireObject(record.github, "github");
-    rejectUnknownKeys(githubRecord, ["owner", "repo", "branches", "ciCanDeployInfra"], "github");
+    rejectUnknownKeys(githubRecord, ["owner", "repo", "branches", "ciCanDeployInfra", "ownerId", "repoId"], "github");
     const owner = requireString(githubRecord.owner, "github.owner", GITHUB_OWNER_PATTERN, "plain GitHub login");
     const repo = requireString(githubRecord.repo, "github.repo", GITHUB_REPO_PATTERN);
     if (repository !== `https://github.com/${owner}/${repo}`) {
@@ -476,7 +510,15 @@ export function parseSiteConfig(raw: unknown): AmplifyAppShellSiteConfig {
     }
     const ciCanDeployInfra = githubRecord.ciCanDeployInfra ?? false;
     if (typeof ciCanDeployInfra !== "boolean") fail("github.ciCanDeployInfra", "must be a boolean");
-    github = { owner, repo, branches, ciCanDeployInfra: ciCanDeployInfra as boolean };
+    const optionalId = (value: unknown, name: string): number | undefined => {
+      if (value === undefined) return undefined;
+      if (typeof value !== "number" || !Number.isSafeInteger(value) || value <= 0) fail(name, "must be a positive integer (GitHub numeric id)");
+      return value as number;
+    };
+    const ownerId = optionalId(githubRecord.ownerId, "github.ownerId");
+    const repoId = optionalId(githubRecord.repoId, "github.repoId");
+    if ((ownerId === undefined) !== (repoId === undefined)) fail("github", "ownerId and repoId must be set together");
+    github = { owner, repo, branches, ciCanDeployInfra: ciCanDeployInfra as boolean, ...(ownerId !== undefined ? { ownerId, repoId } : {}) };
   }
 
   const hasDomain = cms?.domainName !== undefined || reader?.domainName !== undefined;
@@ -499,6 +541,7 @@ export function parseSiteConfig(raw: unknown): AmplifyAppShellSiteConfig {
     reader,
     papyrusVersion,
     storagePreviewPrefix,
+    autoDeploy: autoDeploy as boolean,
     github,
   };
 

package/package.json

@@ -406,7 +406,7 @@
       "optional": true
     }
   },
-  "version": "5.12.0",
+  "version": "5.13.0",
   "dependencies": {
     "@aws-amplify/adapter-nextjs": "^1.7.3",
     "@aws-crypto/sha256-js": "5.2.0",

package/routes.manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "5.12.0",
+  "version": "5.13.0",
   "routes": [
     {
       "file": "app/%5F_preview/[[...path]]/route.ts",