@everydaydevopsio/hail 0.0.0-stage → 0.1.2

package/dist/index.js

@@ -0,0 +1,141 @@
+import { randomBytes } from "node:crypto";
+import { setTimeout as delay } from "node:timers/promises";
+import { performance } from "node:perf_hooks";
+import { normalizeAddress, parseConfig } from "./config.js";
+import { EmailMessage, matches } from "./email.js";
+import { S3MailStore } from "./store.js";
+export * from "./config.js";
+export * from "./email.js";
+export * from "./store.js";
+export class EmailTimeoutError extends Error {
+    constructor(timeoutMs) {
+        super(`No matching email was observed within ${timeoutMs}ms. Check DNS, the active SES receipt rule, and the ingestion DLQ. Message contents are redacted.`);
+        this.name = "EmailTimeoutError";
+    }
+}
+function positive(value, name) {
+    if (!Number.isFinite(value) || value <= 0)
+        throw new Error(`${name} must be positive.`);
+    return value;
+}
+export class Inbox {
+    store;
+    consumed = new Set();
+    cache = new Map();
+    address;
+    constructor(address, store) {
+        this.store = store;
+        this.address = normalizeAddress(address);
+    }
+    async checkpoint() {
+        const startedAt = new Date();
+        const refs = await this.store.list(this.address, AbortSignal.timeout(20_000));
+        return { startedAt, seen: new Set(refs.map((ref) => ref.id)) };
+    }
+    async waitForEmail(options = {}) {
+        return (await this.waitForEmails(1, options))[0];
+    }
+    async waitForEmails(count, options = {}) {
+        if (!Number.isInteger(count) || count < 1)
+            throw new Error("Email count must be a positive integer.");
+        const timeoutMs = positive(options.timeoutMs ?? 60_000, "timeoutMs");
+        const interval = positive(options.pollIntervalMs ?? 500, "pollIntervalMs");
+        const after = options.after instanceof Date ? options.after : options.after?.startedAt;
+        if (after && !Number.isFinite(after.getTime()))
+            throw new Error("The email checkpoint must have a valid timestamp.");
+        const expiry = AbortSignal.timeout(Math.ceil(timeoutMs));
+        const signal = options.signal
+            ? AbortSignal.any([options.signal, expiry])
+            : expiry;
+        const start = performance.now();
+        try {
+            while (performance.now() - start < timeoutMs) {
+                signal.throwIfAborted();
+                const refs = await this.store.list(this.address, signal);
+                const seen = new Set();
+                const found = [];
+                for (const ref of refs) {
+                    signal.throwIfAborted();
+                    if (seen.has(ref.id) || this.consumed.has(ref.id))
+                        continue;
+                    seen.add(ref.id);
+                    if (options.after &&
+                        !(options.after instanceof Date) &&
+                        options.after.seen.has(ref.id))
+                        continue;
+                    let email = this.cache.get(ref.id);
+                    if (!email) {
+                        const stored = await this.store.get(ref, this.address, signal);
+                        if (stored.recipient !== this.address)
+                            throw new Error("Storage returned a message for a different recipient.");
+                        email = await EmailMessage.parse(stored);
+                        this.cache.set(ref.id, email);
+                    }
+                    signal.throwIfAborted();
+                    if (after && email.receivedAt < after)
+                        continue;
+                    if (matches(email.subject, options.subject) &&
+                        matches(email.from, options.from))
+                        found.push(email);
+                }
+                found.sort((a, b) => a.receivedAt.getTime() - b.receivedAt.getTime() ||
+                    a.id.localeCompare(b.id));
+                if (found.length >= count) {
+                    const result = found.slice(0, count);
+                    if (options.consume !== false)
+                        result.forEach((email) => this.consumed.add(email.id));
+                    return result;
+                }
+                await delay(Math.min(interval, Math.max(1, timeoutMs - (performance.now() - start))), undefined, { signal });
+            }
+        }
+        catch (error) {
+            if (options.signal?.aborted)
+                throw options.signal.reason;
+            if (!expiry.aborted ||
+                (error !== expiry.reason &&
+                    !(error instanceof Error &&
+                        error.name === "AbortError" &&
+                        signal.aborted)))
+                throw error;
+        }
+        throw new EmailTimeoutError(timeoutMs);
+    }
+    async expectNoEmail(options) {
+        try {
+            await this.waitForEmail({
+                ...options,
+                timeoutMs: options.forMs,
+                consume: false,
+            });
+        }
+        catch (error) {
+            if (error instanceof EmailTimeoutError)
+                return;
+            throw error;
+        }
+        throw new Error("Unexpected matching email arrived during the observation window. Contents are redacted.");
+    }
+}
+export class Hail {
+    config;
+    store;
+    constructor(config, store) {
+        this.config = parseConfig(config);
+        this.store = store ?? new S3MailStore(this.config);
+    }
+    createInbox(label = "test") {
+        const prefix = label
+            .toLowerCase()
+            .replace(/[^a-z0-9-]/g, "-")
+            .replace(/^-+/, "")
+            .slice(0, 20) || "test";
+        return this.inbox(`${prefix}-${randomBytes(16).toString("hex")}@${this.config.domain}`);
+    }
+    inbox(address) {
+        const normalized = normalizeAddress(address);
+        if (normalized.split("@")[1] !== this.config.domain)
+            throw new Error("Mailbox is outside the configured test domain.");
+        return new Inbox(normalized, this.store);
+    }
+}

package/dist/playwright.d.ts

@@ -0,0 +1,13 @@
+import { expect, type Page, type Response } from "@playwright/test";
+import { Hail, type HailConfig, type Inbox } from "./index.js";
+export interface HailOptions {
+    hailConfig: HailConfig | undefined;
+}
+export interface HailFixtures {
+    hail: Hail;
+    inbox: Inbox;
+}
+export declare const test: import("@playwright/test").TestType<import("@playwright/test").PlaywrightTestArgs & import("@playwright/test").PlaywrightTestOptions & HailOptions & HailFixtures, import("@playwright/test").PlaywrightWorkerArgs & import("@playwright/test").PlaywrightWorkerOptions>;
+export { expect };
+/** Prevent Playwright navigation errors from printing token-bearing URLs. */
+export declare function visitAuthLink(page: Page, url: string): Promise<Response | null>;

package/dist/playwright.js

@@ -0,0 +1,23 @@
+import { test as base, expect, } from "@playwright/test";
+import { Hail, loadConfig } from "./index.js";
+export const test = base.extend({
+    hailConfig: [undefined, { option: true }],
+    hail: async ({ hailConfig }, use) => {
+        await use(new Hail(hailConfig ?? (await loadConfig())));
+    },
+    inbox: async ({ hail }, use, testInfo) => {
+        const inbox = hail.createInbox(`w${testInfo.workerIndex}-r${testInfo.retry}`);
+        // Do not attach raw MIME, subjects, codes, or authentication URLs to reports.
+        await use(inbox);
+    },
+});
+export { expect };
+/** Prevent Playwright navigation errors from printing token-bearing URLs. */
+export async function visitAuthLink(page, url) {
+    try {
+        return await page.goto(url);
+    }
+    catch {
+        throw new Error("Authentication link navigation failed. URL is redacted.");
+    }
+}

package/dist/setup.d.ts

@@ -0,0 +1,17 @@
+export interface InitOptions {
+    dns: "cloudflare" | "route53" | "manual";
+    domain: string;
+    zoneName: string;
+    zoneId?: string;
+    region: string;
+    name: string;
+    out: string;
+    file?: string;
+    localModules?: boolean;
+    existingRuleSet?: string;
+    activateNewRuleSet?: boolean;
+}
+export declare function validateInit(options: InitOptions): InitOptions & {
+    file: string;
+};
+export declare function scaffold(input: InitOptions): Promise<string>;

package/dist/setup.js

@@ -0,0 +1,95 @@
+import { mkdir, cp, readFile, writeFile, lstat } from "node:fs/promises";
+import { resolve, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { normalizeDomain } from "./config.js";
+export function validateInit(options) {
+    const file = options.file ?? "main.tf";
+    if (!/^[A-Za-z0-9][A-Za-z0-9._-]*\.tf$/.test(file))
+        throw new Error("Choose a Terraform file name ending in .tf, without a path.");
+    if (!["cloudflare", "route53", "manual"].includes(options.dns))
+        throw new Error("Choose cloudflare, route53, or manual DNS.");
+    const domain = normalizeDomain(options.domain);
+    const zoneName = normalizeDomain(options.zoneName);
+    if (domain === zoneName || !domain.endsWith(`.${zoneName}`))
+        throw new Error("Use a dedicated subdomain inside the selected DNS zone, not its apex.");
+    if (options.dns !== "manual" && !options.zoneId)
+        throw new Error("Managed DNS requires --zone-id.");
+    if (!/^[a-z][a-z0-9-]{2,31}$/.test(options.name))
+        throw new Error("Resource name must be 3-32 lowercase characters.");
+    if (![
+        "us-east-1",
+        "us-east-2",
+        "us-west-2",
+        "ca-central-1",
+        "eu-west-1",
+    ].includes(options.region))
+        throw new Error("Choose a receiving region supported by this release.");
+    if (Boolean(options.existingRuleSet) === Boolean(options.activateNewRuleSet))
+        throw new Error("Choose exactly one: --existing-rule-set NAME or --activate-new-rule-set.");
+    return { ...options, domain, zoneName, file };
+}
+export async function scaffold(input) {
+    const options = validateInit(input);
+    const destination = resolve(options.out);
+    const templates = fileURLToPath(new URL("../terraform/", import.meta.url));
+    const parent = resolve(destination, "..");
+    await mkdir(parent, { recursive: true });
+    await mkdir(destination, { recursive: true });
+    const targets = [options.file, "terraform.tfvars.json", "example.spec.ts"];
+    if (options.localModules)
+        targets.push("modules");
+    for (const target of targets) {
+        try {
+            await lstat(join(destination, target));
+            throw Object.assign(new Error(`File already exists: ${target}`), {
+                code: "EEXIST",
+            });
+        }
+        catch (error) {
+            if (error.code !== "ENOENT")
+                throw error;
+        }
+    }
+    const template = await readFile(join(templates, "examples", options.dns, "main.tf"), "utf8");
+    const packageVersion = options.localModules
+        ? undefined
+        : JSON.parse(await readFile(fileURLToPath(new URL("../package.json", import.meta.url)), "utf8")).version;
+    const source = options.localModules
+        ? "./modules/receiver"
+        : `git::https://github.com/everydaydevopsio/hail.git//terraform/modules/receiver?ref=v${packageVersion}`;
+    await writeFile(join(destination, options.file), template.replace("../../modules/receiver", source), { flag: "wx" });
+    if (options.localModules)
+        await cp(join(templates, "modules", "receiver"), join(destination, "modules", "receiver"), {
+            recursive: true,
+            force: false,
+            errorOnExist: true,
+            filter: (path) => !path.includes(".terraform") &&
+                !path.includes("__pycache__") &&
+                !path.endsWith(".zip"),
+        });
+    const variables = {
+        name: options.name,
+        domain: options.domain,
+        zone_name: options.zoneName,
+        region: options.region,
+        ...(options.dns === "manual" ? {} : { zone_id: options.zoneId }),
+        existing_rule_set_name: options.existingRuleSet ?? null,
+        manage_rule_set_activation: options.activateNewRuleSet ?? false,
+        retention_days: 3,
+        reader_principal_arns: [],
+        external_indexer_role_arn: null,
+        external_reader_role_arn: null,
+        permissions_boundary_arn: null,
+        tags: {},
+    };
+    await writeFile(join(destination, "terraform.tfvars.json"), JSON.stringify(variables, null, 2) + "\n", { mode: 0o600, flag: "wx" });
+    try {
+        await writeFile(join(destination, ".gitignore"), ".terraform/\n*.tfstate*\n*.tfvars*\n*.tfplan\n**/lambda.zip\n", { flag: "wx" });
+    }
+    catch (error) {
+        if (error.code !== "EEXIST")
+            throw error;
+    }
+    await writeFile(join(destination, "example.spec.ts"), `import { test, expect, visitAuthLink } from '@everydaydevopsio/hail/playwright';\n\ntest('magic-link login', async ({ page, inbox }) => {\n  test.setTimeout(90_000);\n  await page.goto('/login');\n  const after = await inbox.checkpoint();\n  await page.getByLabel('Email').fill(inbox.address);\n  await page.getByRole('button', { name: /send magic link/i }).click();\n  const email = await inbox.waitForEmail({ after, subject: /sign in/i });\n  const origin = new URL(page.url()).origin;\n  await visitAuthLink(page, email.getLink({ text: /sign in/i, allowedOrigins: [origin] }));\n  await expect(page.getByTestId('current-user-email')).toHaveText(inbox.address);\n});\n`, { flag: "wx" });
+    return destination;
+}

package/dist/store.d.ts

@@ -0,0 +1,29 @@
+import { S3Client } from "@aws-sdk/client-s3";
+import { type HailConfig } from "./config.js";
+export interface MessageRef {
+    id: string;
+    key: string;
+    receivedAt: Date;
+}
+export interface StoredMail {
+    id: string;
+    recipient: string;
+    receivedAt: Date;
+    raw: Uint8Array | string;
+    delivery?: Record<string, string>;
+}
+export interface MailStore {
+    list(recipient: string, signal?: AbortSignal): Promise<MessageRef[]>;
+    get(ref: MessageRef, recipient: string, signal?: AbortSignal): Promise<StoredMail>;
+}
+export declare function awsCredentials(config: HailConfig): import("@aws-sdk/types").RuntimeConfigAwsCredentialIdentityProvider | undefined;
+export declare class S3MailStore implements MailStore {
+    readonly config: HailConfig;
+    private readonly maxMessageBytes;
+    private readonly client;
+    constructor(config: HailConfig, client?: S3Client, maxMessageBytes?: number);
+    private prefix;
+    list(recipient: string, signal?: AbortSignal): Promise<MessageRef[]>;
+    private read;
+    get(ref: MessageRef, recipient: string, signal?: AbortSignal): Promise<StoredMail>;
+}

package/dist/store.js

@@ -0,0 +1,119 @@
+import { S3Client, GetObjectCommand, ListObjectsV2Command, } from "@aws-sdk/client-s3";
+import { fromTemporaryCredentials } from "@aws-sdk/credential-providers";
+import { normalizeAddress } from "./config.js";
+export function awsCredentials(config) {
+    return config.roleArn
+        ? fromTemporaryCredentials({
+            clientConfig: { region: config.region },
+            params: {
+                RoleArn: config.roleArn,
+                RoleSessionName: "hail-email-reader",
+            },
+        })
+        : undefined;
+}
+export class S3MailStore {
+    config;
+    maxMessageBytes;
+    client;
+    constructor(config, client, maxMessageBytes = 16 * 1024 * 1024) {
+        this.config = config;
+        this.maxMessageBytes = maxMessageBytes;
+        this.client =
+            client ??
+                new S3Client({
+                    region: config.region,
+                    credentials: awsCredentials(config),
+                    maxAttempts: 3,
+                });
+    }
+    prefix(recipient) {
+        const address = normalizeAddress(recipient);
+        if (address.split("@")[1] !== this.config.domain)
+            throw new Error("Mailbox is outside the configured test domain.");
+        return this.config.layout === "legacy"
+            ? `${address}/`
+            : `index/${address}/`;
+    }
+    async list(recipient, signal) {
+        const prefix = this.prefix(recipient);
+        const messages = [];
+        let token;
+        do {
+            const response = await this.client.send(new ListObjectsV2Command({
+                Bucket: this.config.bucketName,
+                Prefix: prefix,
+                ContinuationToken: token,
+            }), { abortSignal: signal });
+            for (const object of response.Contents ?? []) {
+                const extension = this.config.layout === "legacy" ? ".eml" : ".json";
+                if (object.Key?.startsWith(prefix) && object.Key.endsWith(extension)) {
+                    messages.push({
+                        id: object.Key,
+                        key: object.Key,
+                        receivedAt: object.LastModified ?? new Date(0),
+                    });
+                }
+            }
+            if (response.IsTruncated &&
+                (!response.NextContinuationToken ||
+                    response.NextContinuationToken === token)) {
+                throw new Error("S3 returned an invalid pagination cursor.");
+            }
+            token = response.IsTruncated ? response.NextContinuationToken : undefined;
+        } while (token);
+        return messages.sort((a, b) => a.receivedAt.getTime() - b.receivedAt.getTime() ||
+            a.key.localeCompare(b.key));
+    }
+    async read(key, limit, signal) {
+        const response = await this.client.send(new GetObjectCommand({ Bucket: this.config.bucketName, Key: key }), { abortSignal: signal });
+        if (!response.Body)
+            throw new Error("Stored email has no content.");
+        if ((response.ContentLength ?? 0) > limit)
+            throw new Error("Stored email exceeds the configured size limit.");
+        const chunks = [];
+        let bytes = 0;
+        for await (const chunk of response.Body) {
+            signal?.throwIfAborted();
+            const buffer = Buffer.from(chunk);
+            bytes += buffer.length;
+            if (bytes > limit)
+                throw new Error("Stored email exceeds the configured size limit.");
+            chunks.push(buffer);
+        }
+        return Buffer.concat(chunks);
+    }
+    async get(ref, recipient, signal) {
+        const address = normalizeAddress(recipient);
+        const prefix = this.prefix(address);
+        if (!ref.key.startsWith(prefix) ||
+            ref.key.slice(prefix.length).includes("/"))
+            throw new Error("Message key is outside this mailbox.");
+        let rawKey = ref.key;
+        let receivedAt = ref.receivedAt;
+        let delivery;
+        if (this.config.layout === "indexed-v1") {
+            const metadata = JSON.parse((await this.read(ref.key, 64 * 1024, signal)).toString("utf8"));
+            if (metadata.schemaVersion !== 1 ||
+                metadata.recipient !== address ||
+                typeof metadata.rawKey !== "string" ||
+                !/^incoming\/[a-zA-Z0-9_-]+$/.test(metadata.rawKey) ||
+                typeof metadata.receivedAt !== "string")
+                throw new Error("Invalid mailbox metadata.");
+            rawKey = metadata.rawKey;
+            receivedAt = new Date(metadata.receivedAt);
+            if (!Number.isFinite(receivedAt.getTime()))
+                throw new Error("Invalid receipt timestamp.");
+            if (metadata.delivery && typeof metadata.delivery === "object") {
+                delivery = Object.fromEntries(Object.entries(metadata.delivery).filter((entry) => typeof entry[1] === "string"));
+            }
+        }
+        return {
+            id: ref.id,
+            recipient: address,
+            receivedAt,
+            delivery,
+            raw: await this.read(rawKey, this.maxMessageBytes, signal),
+        };
+    }
+}

package/package.json

@@ -1,6 +1,91 @@
 {
   "name": "@everydaydevopsio/hail",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.1.2",
+  "description": "Playwright-native testing for real application email workflows",
+  "type": "module",
+  "license": "ISC",
+  "engines": {
+    "node": ">=22"
+  },
+  "bin": {
+    "hail": "dist/cli.js"
+  },
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./playwright": {
+      "types": "./dist/playwright.d.ts",
+      "import": "./dist/playwright.js"
+    }
+  },
+  "files": [
+    "dist",
+    "terraform/examples/cloudflare/main.tf",
+    "terraform/examples/cloudflare/.terraform.lock.hcl",
+    "terraform/examples/route53/main.tf",
+    "terraform/examples/route53/.terraform.lock.hcl",
+    "terraform/examples/manual/main.tf",
+    "terraform/examples/manual/.terraform.lock.hcl",
+    "terraform/modules/receiver/main.tf",
+    "terraform/modules/receiver/variables.tf",
+    "terraform/modules/receiver/outputs.tf",
+    "terraform/modules/receiver/.terraform.lock.hcl",
+    "terraform/modules/receiver/lambda/handler.py",
+    "README.md",
+    "LICENSE"
+  ],
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "typecheck": "tsc --noEmit",
+    "test": "node --import tsx --test tests/unit/*.test.ts",
+    "test:python": "python3 -m unittest discover -s tests/python -v",
+    "test:e2e": "playwright test",
+    "test:live": "HAIL_LIVE=1 playwright test",
+    "test:package": "node scripts/check-package.mjs",
+    "format": "prettier --write src tests '*.json' '*.ts' README.md docs .github/workflows/ci.yml",
+    "prepack": "npm run build",
+    "test:live:full": "python3 scripts/live-run.py",
+    "lint": "eslint src tests scripts *.mjs *.ts",
+    "lint:fix": "npm run lint -- --fix",
+    "prettier": "prettier --check src tests scripts/*.mjs *.json *.ts *.mjs .github .pre-commit-config.yaml .trivyignore.yaml",
+    "prettier:fix": "npm run prettier -- --write",
+    "test:coverage": "node --import tsx --experimental-test-coverage --test-coverage-include=\"src/**/*.ts\" --test-coverage-lines=50 --test-coverage-functions=50 --test-coverage-branches=50 --test tests/unit/*.test.ts",
+    "test:smoke": "npm run build && node --import tsx --test tests/unit/cli.test.ts && npm run test:package",
+    "test:prepush": "npm run build && npm run typecheck && npm test && npm run test:smoke"
+  },
+  "dependencies": {
+    "@aws-sdk/client-s3": "^3.700.0",
+    "@aws-sdk/client-ses": "^3.700.0",
+    "@aws-sdk/credential-providers": "^3.700.0",
+    "@types/node": "22.20.4",
+    "cheerio": "^1.0.0",
+    "mailparser": "^3.7.0"
+  },
+  "peerDependencies": {
+    "@playwright/test": ">=1.55.0 <2"
+  },
+  "peerDependenciesMeta": {
+    "@playwright/test": {
+      "optional": true
+    }
+  },
+  "devDependencies": {
+    "@aws-sdk/client-sts": "3.1142.0",
+    "@aws-sdk/types": "3.974.6",
+    "@eslint/js": "^10.0.1",
+    "@playwright/test": "^1.55.0",
+    "@types/mailparser": "^3.4.6",
+    "eslint": "^10.12.0",
+    "globals": "^16.5.0",
+    "prettier": "^3.6.2",
+    "tsx": "^4.20.5",
+    "typescript": "^5.9.2",
+    "typescript-eslint": "^8.71.1"
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/everydaydevopsio/hail"
+  }
+}

package/terraform/examples/cloudflare/.terraform.lock.hcl

@@ -0,0 +1,64 @@
+# This file is maintained automatically by "terraform init".
+# Manual edits may be lost in future updates.
+
+provider "registry.terraform.io/cloudflare/cloudflare" {
+  version     = "5.26.0"
+  constraints = "~> 5.0"
+  hashes = [
+    "h1:cn9FioXphqL0gQ9ICt+nhylZm6GBWPm10v20nOQeqgg=",
+    "zh:5935d0ea1abc7cfeeb6f6c80b1b5c51c2d72f11e3d0ee273a9bd6267c0821e6d",
+    "zh:759bb1cc0e6daeb54def90f13357e8d09ed0ff7101d13726be9f42504d6ffad2",
+    "zh:7e109aa1e20dccef154b680363451e9197ed31ece5bd91b53b0a1a512943b852",
+    "zh:83b0b43e16d60926fd96227c5902ad104ab11c1b1c42465aaffb61a393d9c12b",
+    "zh:845c84b1ca907678515ed8843ea1d7a91b3442af4d8e047be754b9769a3eaf2e",
+    "zh:9012426308af3a651c2a1f612cb884774cab4009a29fef67b3e056fbf16e4c87",
+    "zh:c6cad449e522ccd4bad73d41671ab2c4461097d8506f44026a056320daf4a462",
+    "zh:f199deaba10e25a5d4ebd76bc1c5688ae35a38dab4162fbc7cdef20599e6b562",
+    "zh:f809ab383cca0a5f83072981c64208cbd7fa67e986a86ee02dd2c82333221e32",
+  ]
+}
+
+provider "registry.terraform.io/hashicorp/archive" {
+  version     = "2.8.1"
+  constraints = ">= 2.4.0, < 3.0.0"
+  hashes = [
+    "h1:KfIRyazppfpvRKIW5URe4sIVRPPdcbtt4ddkYd1Bw3Y=",
+    "zh:03de290604114a89fcd45c2e5bc7787d5a1ebfc5f964fb5989306bea7a4c79ec",
+    "zh:0a7d69dc9fbbc48960bc2f04588c8fb1bd92c78a8f306566b7fb17fc4a4f2058",
+    "zh:4df1f3981379c35f1757da957470f7f7724496b57219da3485177cf1647bdf59",
+    "zh:50f0e72ba53bfe6e11b03b7fc899e1f72536354381d302a743a274ae2a3f45f4",
+    "zh:5c4e15a04c98e2a8cafb1cd9632b48ad318051e8462d105b1153006277985c35",
+    "zh:66069e604bcf5c4af0278e15997d9e6bd755c54fb3801d78885838b889729c5f",
+    "zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3",
+    "zh:979765db3f42601870ab377104ba70befb029547b278337ec4ada980e3582de6",
+    "zh:b165254da774f49945a73fbccc3ef1b63d70ea00a98fa9e14716665ba80ecaad",
+    "zh:c0bb2697b525da9fec4511f569ed2bd2b42f25d5c1f9fa00f8f3645b50cfc2e9",
+    "zh:c48f6695d12df0d0fa5231f7c1b8d518a4feae91a733fdd35a5804af3a303831",
+    "zh:d589954c93f075180c9f4e2ce91780d5edcb56dfd0d3cda8ba08e13c10b52249",
+    "zh:f5792ed06da65d0daf7ca3711f5399ff78c7cb4400afe53fbce9a926fbde4477",
+  ]
+}
+
+provider "registry.terraform.io/hashicorp/aws" {
+  version     = "6.66.0"
+  constraints = ">= 5.50.0, < 7.0.0"
+  hashes = [
+    "h1:hBEaeBm9nm7A/u1nnD0nfolTPP55/BoKRFWk8zG8/fk=",
+    "zh:156fe7164a3d26ef6b35734c43e99fb198df90575ed897d1182b8e930b8cd523",
+    "zh:1af52b22b35be00f8d16e3ebebff9fa699ec4db2ef69e6032ba5c536f80c03d9",
+    "zh:2545a8478bd551fdc9694f6cc1a1ad24617f6736f8bde0ad6cae90987c65380f",
+    "zh:4070db1ee369ccb41cb610bfd887386bc0a9b9ecad60aeb4dbce58443d2519dd",
+    "zh:53da7d3c1840ef875c7d34e967732502a64fe677af0e78824773d4c15a8fe740",
+    "zh:576a93a28bf611a4de2a2e6ced697a41d5126b8fd31d30782b16797e410a9706",
+    "zh:58fed5fa9a033355b9d4f3092c817b70d934100e0d8678d6e4c93f3c9493d4e4",
+    "zh:6a9ca2f24e2ee9156dd785d159a850b35d190e9cf7eca21cb9582970c2db80cd",
+    "zh:729edd30f99cc16009deba5c013265b0c81eda261a3d0821cbd011d3287fd230",
+    "zh:7ae460049b75bd4aefee465ef7c53a01ac2df46d4d3e3ac00824afa8b5cb83fb",
+    "zh:9051fa85c8034ade8a57a5c6f232fd33da28f3800bb5aa40bc8625dbc5e27632",
+    "zh:906547e4319805e7acf7fbdf2bac28a4b1a7370790a2a430c7adb1b29bb934eb",
+    "zh:998f27410a66158a35ee5ed142c27e5b21fe8601941da55da2157f8042d6dcca",
+    "zh:9b12af85486a96aedd8d7984b0ff811a4b42e3d88dad1a3fb4c0b580d04fa425",
+    "zh:9c1804eff1dda0446dc2d215231015bb65a2fc6c3b7ba24584fe45f1ddd3fa9f",
+    "zh:b03ff5efdee310502aaaeb460144dc059bce72a0d8217e6b989099ef8aef9283",
+  ]
+}