@geekmidas/cloud 9.0.2 → 10.0.0-alpha.1

package/src/sst/aws/DatabaseBootstrap.ts

@@ -0,0 +1,309 @@
+import * as aws from '@pulumi/aws';
+import { secretsmanager } from '@pulumi/aws';
+import { RandomPassword } from '@pulumi/random';
+import type { BootstrapTenant } from './bootstrap/handler';
+import type { Database } from './Database';
+
+/**
+ * The roles a tenant needs, provisioned — and the function that creates them.
+ *
+ * Two halves that only make sense together. Pulumi can generate a password and
+ * store it; it cannot run `CREATE ROLE`. So the passwords are resources here and
+ * the DDL is a Lambda invoked once per deploy, inside the VPC, connecting as the
+ * cluster master — the only credential that exists before any role does.
+ *
+ * **One secret for the cluster, holding every role in it.** The obvious worry —
+ * that a shared secret lets anything holding it connect as any role — describes
+ * a read that does not happen. No function fetches a credential: each node's URL
+ * is carried in its own link (`getSSTLink` publishes `provides()` and nothing
+ * else), so a handler is *given* exactly its own role and has no IAM to read
+ * Secrets Manager at all. Splitting the secret would not narrow runtime
+ * privilege, because runtime never touches it.
+ *
+ * What the secret is actually for is out-of-band access — a person with
+ * break-glass, an external tool, a rotation job. That is where the case for
+ * splitting it lives, and it is a real one: per-tenant secrets are what let IAM
+ * grant somebody the reporting role's password without also handing them the
+ * auth schema's. Nothing here needs that yet, and one secret is one resource and
+ * one place to look, so it stays one until somebody has that second reader.
+ *
+ * :::caution
+ * Not verified against a live deploy. The shape is sound and every decision in
+ * it is asserted as data, but no stack has come up.
+ * :::
+ */
+export class DatabaseBootstrap {
+	/** The generated passwords, by role name. */
+	private readonly passwords = new Map<string, $util.Output<string>>();
+
+	/**
+	 * The cluster's credentials, for out-of-band use.
+	 *
+	 * Created by `run()` rather than by `add()`, because it holds every tenant
+	 * and there is no every-tenant until the last one is added.
+	 */
+	secret?: secretsmanager.Secret;
+
+	private readonly tenants: BootstrapTenant[] = [];
+
+	constructor(
+		private readonly name: string,
+		private readonly cluster: Database,
+	) {}
+
+	/**
+	 * Add a tenant to bootstrap, and provision its credentials.
+	 *
+	 * Returns the runtime password so the tenant's URL can carry it. The value is
+	 * a Pulumi output either way — it exists in state whether or not it is also
+	 * in Secrets Manager — so putting it in the URL adds no exposure the link did
+	 * not already have.
+	 */
+	add(tenant: {
+		id: string;
+		schema: string;
+		runtime: string;
+		owner: string;
+		reader?: string;
+	}): { runtime: $util.Output<string>; reader?: $util.Output<string> } {
+		const runtime = this.password(tenant.runtime);
+		const reader = tenant.reader ? this.password(tenant.reader) : undefined;
+
+		this.tenants.push({
+			id: tenant.id,
+			schema: tenant.schema,
+			runtime: tenant.runtime,
+			owner: tenant.owner,
+			...(tenant.reader ? { reader: tenant.reader } : {}),
+			// Filled in by `bootstrapEvent` once the outputs resolve. The function
+			// reads them straight out of its input and never fetches a secret, so
+			// it needs no IAM to read one.
+			passwords: { runtime: '', owner: '' },
+		});
+
+		return { runtime, ...(reader ? { reader } : {}) };
+	}
+
+	/**
+	 * The event this bootstrap should be invoked with.
+	 *
+	 * Kept as data rather than performed here, so the caller decides *when* — and
+	 * so the decision is assertable without Pulumi. Feed it to a function
+	 * invocation whose input changes when this changes, which is what makes a
+	 * re-deploy re-apply only when something actually moved.
+	 */
+	event(): $util.Output<string> {
+		// Every password, flat, so one `all` resolves them and the shape is put
+		// back together by a pure function that can be asserted without Pulumi.
+		const roles = [...this.passwords.keys()];
+
+		return $util
+			.all([
+				this.cluster.host as $util.Input<unknown>,
+				this.cluster.port,
+				this.cluster.database,
+				this.cluster.username,
+				this.cluster.password,
+				...roles.map((role) => this.passwords.get(role)!),
+			] as $util.Input<unknown>[])
+			.apply((resolved) => {
+				const [host, port, database, username, password, ...secrets] =
+					resolved as unknown as [
+						string,
+						number,
+						string,
+						string,
+						string,
+						...string[],
+					];
+
+				return bootstrapEvent(
+					{ host, port, database, username, password },
+					this.tenants,
+					new Map(roles.map((role, index) => [role, secrets[index] as string])),
+				);
+			});
+	}
+
+	/**
+	 * The read-only credential for a runtime role, once its tenant is added.
+	 *
+	 * Returns nothing where no reader was provisioned — a reader role is created
+	 * only where something points at one, so asking for one that was never asked
+	 * for is a question with a real answer rather than an error.
+	 */
+	readerFor(
+		runtime: string,
+	): { user: string; password: $util.Output<string> } | undefined {
+		const role = `${runtime}_reader`;
+		const password = this.passwords.get(role);
+
+		return password ? { user: role, password } : undefined;
+	}
+
+	/** Whether anything needs bootstrapping at all. */
+	get empty(): boolean {
+		return this.tenants.length === 0;
+	}
+
+	/**
+	 * Create the function and invoke it once for this deploy.
+	 *
+	 * The invocation's input is `event()`, so it re-runs when — and only when —
+	 * the roles, the schemas, or the cluster's address actually change. A deploy
+	 * that touched neither costs nothing, which is what makes running this on
+	 * every deploy acceptable rather than something to remember.
+	 *
+	 * @param vpc the database's VPC. The function has to reach the database, and
+	 * a database reachable from outside its VPC is the problem this avoids.
+	 *
+	 * The component rather than a component's `vpc` argument: a function in a VPC
+	 * needs subnets *and* security groups, and the two database components spell
+	 * their argument differently — a cluster asks for both, an instance asks only
+	 * for subnets. Naming the shared thing avoids inheriting whichever spelling
+	 * the database happens to use, which is how this came to be typed as
+	 * something that could not carry a security group.
+	 */
+	run(vpc: sst.aws.Vpc): void {
+		if (this.empty) return;
+
+		this.storeCredentials();
+
+		const fn = new sst.aws.Function(`${this.name}Bootstrap`, {
+			// Shipped by this package rather than by the application: the DDL is
+			// the framework's, and an app that had to carry a bootstrap handler
+			// could get it wrong.
+			handler: HANDLER,
+			runtime: 'nodejs24.x',
+			// Long enough for a database that is still coming up to answer —
+			// `min: 0 ACU` means the first connection of the day pays for a
+			// resume, and timing out there would leave a half-bootstrapped schema.
+			timeout: '5 minutes',
+			vpc,
+			nodejs: { install: ['pg'] },
+		});
+
+		new aws.lambda.Invocation(`${this.name}BootstrapRun`, {
+			functionName: fn.name,
+			input: this.event(),
+		});
+	}
+
+	/**
+	 * Write every role's password to one secret, for out-of-band use.
+	 *
+	 * Nothing at runtime reads this — a handler is given its own URL through its
+	 * link — so this exists for a person with break-glass, an external tool, or a
+	 * rotation job. Keyed by role name rather than by tenant, because a role name
+	 * is what somebody at a `psql` prompt actually has in hand.
+	 *
+	 * Note what this is *not*: the source of truth. The passwords are generated
+	 * here and this records them. Making the secret authoritative — read at
+	 * deploy, so rotating it in Secrets Manager propagates on the next deploy —
+	 * is a better rotation story and a different design: it needs a first-deploy
+	 * seed, and changing a value there does not change the role until the DDL
+	 * runs again.
+	 */
+	private storeCredentials(): void {
+		this.secret = new secretsmanager.Secret(`${this.name}Credentials`, {
+			// A name somebody can find. `namePrefix` was the first attempt and it
+			// produced `KitchenSink/roles/20260830202841251200000001` — unique,
+			// and useless to the person doing break-glass at 3am, which is the
+			// only reason this secret exists.
+			name: `${$app.name}/${$app.stage}/${this.name}/roles`,
+			description: `Database roles for ${this.name} (${$app.stage})`,
+			// Rotating a password *updates* this secret — a new version on the
+			// same resource — so none of this applies to normal operation. It
+			// applies to one flow: tearing a stage down and standing it back up.
+			// Secrets Manager holds a deleted secret for a recovery window and
+			// keeps its name reserved for the duration, so the recreate fails on
+			// a name pointing at something nobody can see. That flow is what a
+			// disposable stage *is*, so those waive the window; a retained app
+			// keeps the default, because there the recovery window is the point.
+			...($app.removal === 'remove' ? { recoveryWindowInDays: 0 } : {}),
+		});
+
+		const roles = [...this.passwords.keys()];
+
+		new secretsmanager.SecretVersion(`${this.name}CredentialsValue`, {
+			secretId: this.secret.id,
+			secretString: $util
+				.all(roles.map((role) => this.passwords.get(role)!))
+				.apply((values) =>
+					JSON.stringify(
+						Object.fromEntries(
+							roles.map((role, index) => [role, values[index]]),
+						),
+					),
+				),
+		});
+	}
+
+	private password(role: string): $util.Output<string> {
+		const existing = this.passwords.get(role);
+		if (existing) return existing;
+
+		const generated = new RandomPassword(`${this.name}${role}Password`, {
+			length: 32,
+			// Postgres accepts these in a password; a `'` would need escaping in
+			// DDL and a `/` breaks a URL's authority section, so neither is worth
+			// the risk for entropy this module has plenty of.
+			special: true,
+			overrideSpecial: '-_',
+		}).result;
+
+		this.passwords.set(role, generated);
+
+		return generated;
+	}
+}
+
+/**
+ * Where the bootstrap handler lives, from the application's root.
+ *
+ * A path into this package's own published files, so an app that installed
+ * `@geekmidas/cloud` gets the handler without copying it — and so a fix to the
+ * DDL reaches every app on the next upgrade rather than the next time somebody
+ * remembers.
+ *
+ * `src/`, not `dist/`: `src/sst/**` is published as raw TypeScript on purpose,
+ * because it extends ambient globals that only exist inside a consuming SST
+ * app. SST bundles the handler with esbuild at deploy, which is the same thing
+ * it does for the application's own handlers.
+ */
+const HANDLER =
+	'node_modules/@geekmidas/cloud/src/sst/aws/bootstrap/handler.handler';
+
+/**
+ * The bootstrap's input, assembled from resolved values.
+ *
+ * Pure, and separate from the component for the reason every decision in this
+ * package is: composing it needs no Pulumi, so what the function will be handed
+ * can be asserted without a deploy — including that it is exactly what
+ * `roleStatements` accepts, which is the contract between the two halves.
+ */
+export function bootstrapEvent(
+	master: {
+		host: string;
+		port: number;
+		database: string;
+		username: string;
+		password: string;
+	},
+	tenants: readonly BootstrapTenant[],
+	passwords: ReadonlyMap<string, string>,
+): string {
+	return JSON.stringify({
+		master,
+		tenants: tenants.map((tenant) => ({
+			...tenant,
+			passwords: {
+				runtime: passwords.get(tenant.runtime) ?? '',
+				owner: passwords.get(tenant.owner) ?? '',
+				...(tenant.reader
+					? { reader: passwords.get(tenant.reader) ?? '' }
+					: {}),
+			},
+		})),
+	});
+}

package/src/sst/aws/DerivedDatabase.ts

@@ -0,0 +1,117 @@
+import { type GkmLinkable, ResourceType } from '../Linkable';
+import type { Database } from './Database';
+
+/**
+ * The two database kinds that provision nothing: a reader, and a schema tenant.
+ *
+ * Neither is an AWS resource. A reader is an endpoint the cluster already has,
+ * and a tenant is a schema *inside* the parent's database, created by DDL that
+ * `gkm` runs rather than by anything Pulumi declares. What they contribute is a
+ * URL — a different endpoint, or the same one with a different `search_path` —
+ * and the identity that lets an edge point at them.
+ *
+ * That makes them the first `Provisioned`s that wrap no component. They are
+ * still linkable, because a function depending on one still needs its URL
+ * injected, and the link is what carries it.
+ */
+abstract class DerivedDatabase implements GkmLinkable {
+	readonly _id: string;
+
+	constructor(
+		id: string,
+		/**
+		 * Public because `fromManifest` walks it: a tenant may derive from another
+		 * tenant, and what both ultimately need is the cluster underneath.
+		 */
+		readonly parent: Database,
+	) {
+		this._id = id;
+	}
+
+	abstract get _type(): ResourceType;
+	abstract provides(): Record<string, $util.Input<string>>;
+
+	/**
+	 * A link carrying only this node's own URL.
+	 *
+	 * Deliberately *not* the parent's link. A handler depending on the reader
+	 * should receive the reader's URL and no other, which is the same
+	 * least-privilege rule edges get everywhere else — inheriting the parent's
+	 * properties would hand it the writer's address under a second key.
+	 */
+	getSSTLink() {
+		return { properties: { ...this.provides() } };
+	}
+}
+
+/**
+ * A read-only endpoint on an existing cluster.
+ *
+ * Nothing is provisioned. An RDS instance has one endpoint, so this resolves to
+ * the same address the writer uses — which is safe rather than a silently
+ * writable connection behind a name that says reader, because read-only is
+ * enforced by the role's grants and never by which endpoint was reached.
+ */
+export class DatabaseReader extends DerivedDatabase {
+	constructor(
+		id: string,
+		parent: Database,
+		/**
+		 * The read-only role, where one was provisioned.
+		 *
+		 * Absent under `roles: false`, where there is one credential and it is
+		 * the master's — and read-only then holds by convention rather than by
+		 * grant, which is exactly why that mode is a downgrade.
+		 */
+		private readonly role?: { user: string; password: $util.Input<string> },
+	) {
+		super(id, parent);
+	}
+
+	get _type() {
+		return ResourceType.SSTPostgres;
+	}
+
+	provides(): Record<string, $util.Input<string>> {
+		return {
+			url: this.parent.urlFor({
+				reader: true,
+				...(this.role ? { as: this.role } : {}),
+			}),
+		};
+	}
+}
+
+/**
+ * A second schema in the parent's database, with its own URL.
+ *
+ * The schema and its role are created by DDL, so what this contributes is the
+ * parent's connection pinned to a different `search_path`. Through the codec,
+ * because `?search_path=` is not a libpq parameter: a URL carrying it is
+ * accepted by every parser, ignored by the server, and produces a database that
+ * looks empty.
+ */
+export class DatabaseSchema extends DerivedDatabase {
+	constructor(
+		id: string,
+		parent: Database,
+		private readonly schema: string,
+		/** The tenant's runtime role, where one was provisioned. */
+		private readonly role?: { user: string; password: $util.Input<string> },
+	) {
+		super(id, parent);
+	}
+
+	get _type() {
+		return ResourceType.SSTPostgres;
+	}
+
+	provides(): Record<string, $util.Input<string>> {
+		return {
+			url: this.parent.urlFor({
+				schema: this.schema,
+				...(this.role ? { as: this.role } : {}),
+			}),
+		};
+	}
+}

package/src/sst/aws/Email.ts

@@ -0,0 +1,181 @@
+import { iam } from '@pulumi/aws';
+import { type GkmLinkable, ResourceType } from '../Linkable';
+import type { StackType } from '../Stack';
+import { sesSmtpUrl } from './ses';
+
+/**
+ * `Email` — outbound mail, and the infra half of the `email` kind.
+ *
+ * The kind whose backends differ least. Every one of them speaks SMTP, so the
+ * declaration's `smtp://` URL is true of all of them and the client never
+ * changes — Mailpit locally, Resend or SES or somebody's relay deployed. What
+ * differs is only who issues the credential, which is why the backend is config
+ * rather than a field on the construct.
+ *
+ * Two of the three are barely a component: `resend` and `smtp` compose a URL
+ * from a value you already hold. Only `ses` provisions anything, and it
+ * provisions a *chain* — an identity, a user, an access key, and a password
+ * derived from that key — because SES does not issue SMTP passwords, it issues
+ * IAM credentials and documents the arithmetic.
+ */
+export class Email<
+	TStage extends string = string,
+	TDomain extends string = string,
+> implements GkmLinkable
+{
+	readonly _id: string;
+
+	/** Composed once, in the constructor, so `provides` cannot drift from it. */
+	private readonly url: $util.Input<string>;
+
+	/**
+	 * The address mail is sent from.
+	 *
+	 * Required rather than defaulted: an unverified sender is rejected by every
+	 * provider, and a guess would be rejected at the first send rather than at
+	 * synth.
+	 */
+	private readonly from: $util.Input<string>;
+
+	get _type() {
+		return ResourceType.Email;
+	}
+
+	constructor(
+		_stack: StackType<TStage, TDomain>,
+		name: string,
+		props: EmailProps,
+	) {
+		this._id = name;
+
+		// A supplied URL wins over provisioning, for every backend including SES.
+		// Credentials that already exist are the common case — a sending identity
+		// set up once, by hand — and creating a second IAM user for it would be
+		// this deploy quietly adding another way into the account.
+		this.url = props.url ?? this.provision(name, props);
+		this.from = props.from;
+	}
+
+	/**
+	 * Mint a credential, for the one backend that can.
+	 *
+	 * @throws {EmailNeedsUrl} for the backends that cannot. Resend and a plain
+	 * relay *are* accounts somebody created, so a missing URL is a missing setup
+	 * step — and saying so at synth beats composing something that cannot
+	 * deliver and finding out at the first send.
+	 */
+	private provision(name: string, props: EmailProps): $util.Input<string> {
+		if (props.backend !== 'ses') throw new EmailNeedsUrl(name, props.backend);
+
+		return this.provisionSes(name, props);
+	}
+
+	/**
+	 * One key, the `smtp://` URL — and a second the app declared, the sending
+	 * identity, which is the one thing about mail that genuinely differs per
+	 * stage.
+	 */
+	provides(): Record<string, $util.Input<string>> {
+		return { url: this.url, from: this.from };
+	}
+
+	getSSTLink() {
+		return { properties: { ...this.provides() } };
+	}
+
+	/**
+	 * The SES chain: a user that may send, a key for it, and the derived password.
+	 *
+	 * A user of its own rather than the application's role, because SMTP is a
+	 * long-lived static credential and the execution role is not — there is no
+	 * way to hand a relay a rotating token. Scoped to `ses:SendRawEmail` and
+	 * nothing else, so a leaked SMTP password sends mail and does not read the
+	 * account's send statistics or verify new identities.
+	 */
+	private provisionSes(name: string, props: EmailProps): $util.Input<string> {
+		const user = new iam.User(`${name}SmtpUser`, {
+			path: '/gkm/ses/',
+		});
+
+		new iam.UserPolicy(`${name}SmtpPolicy`, {
+			user: user.name,
+			policy: JSON.stringify({
+				Version: '2012-10-17',
+				Statement: [
+					{ Effect: 'Allow', Action: 'ses:SendRawEmail', Resource: '*' },
+				],
+			}),
+		});
+
+		const key = new iam.AccessKey(`${name}SmtpKey`, { user: user.name });
+
+		return $util
+			.all([key.id, key.secret, props.region])
+			.apply(([accessKeyId, secretAccessKey, region]) =>
+				sesSmtpUrl({ accessKeyId, secretAccessKey, region }),
+			);
+	}
+}
+
+export interface EmailProps {
+	/** Who delivers the mail. Only `ses` provisions anything. */
+	backend: 'resend' | 'ses' | 'smtp';
+	/**
+	 * The `smtp://` URL, where the credentials already exist.
+	 *
+	 * Required for `resend` and `smtp`, which are accounts rather than
+	 * infrastructure. Optional for `ses`, and supplying it is the difference
+	 * between using the sending identity you have and provisioning a second one.
+	 */
+	url?: $util.Input<string>;
+	/** The region to derive SES credentials for. Required for `ses`. */
+	region?: $util.Input<string>;
+	/**
+	 * The identity mail is sent from — a verified address or domain.
+	 *
+	 * Stage-varying by nature, which is why it is here rather than on the
+	 * construct: `noreply@myapp.test` locally, a verified domain deployed.
+	 */
+	from: $util.Input<string>;
+}
+
+/**
+ * A backend that cannot mint its own credentials was given none.
+ *
+ * Resend and a plain relay are accounts somebody created, so there is nothing
+ * for a deploy to provision and a missing URL is a missing setup step.
+ */
+export class EmailNeedsUrl extends Error {
+	constructor(
+		readonly id: string,
+		readonly backend: string,
+	) {
+		super(
+			`'${id}' sends through ${backend}, which is an account rather than ` +
+				`something to provision, and no URL was supplied for it. Set it with ` +
+				`\`sst secret set\` and pass it through the deploy layer — ` +
+				`fromManifest(stack, manifest, { ${id}: { url } }).`,
+		);
+		this.name = 'EmailNeedsUrl';
+	}
+}
+
+/**
+ * Mail was declared and no sending identity was supplied.
+ *
+ * Not defaultable: every provider rejects an unverified sender, so a guess would
+ * deploy cleanly and fail at the first send. The address is also stage-varying
+ * by nature, which is why it belongs in the deploy layer rather than the
+ * construct.
+ */
+export class EmailNeedsSender extends Error {
+	constructor(readonly id: string) {
+		super(
+			`'${id}' sends mail and no sending identity was supplied. Pass one ` +
+				`through the deploy layer — ` +
+				`fromManifest(stack, manifest, { ${id}: { from: 'noreply@example.com' } }) ` +
+				`— and make sure it is verified with the provider.`,
+		);
+		this.name = 'EmailNeedsSender';
+	}
+}

package/src/sst/aws/FileServer.ts

@@ -0,0 +1,82 @@
+import { type GkmLinkable, ResourceType } from '../Linkable';
+import type { StackType } from '../Stack';
+
+/**
+ * `FileServer` — a CloudFront distribution over a bucket, and the infra half of
+ * the `file-server` kind.
+ *
+ * It owns the certificate and the DNS record, which is the whole reason the
+ * construct is its own rather than a flag on the bucket: a domain lifecycle has
+ * no business living inside an `objects` provisioner. It is also the same
+ * infrastructure a static site is — a distribution over an origin — with live
+ * bucket contents in place of a build output.
+ *
+ * The origin bucket must permit CloudFront to read it, which is set on the
+ * *bucket* rather than here: `fromManifest` gives a bucket `access:
+ * 'cloudfront'` when anything in the manifest serves it. That lookup is the cost
+ * this design named — the bucket alone no longer says whether it is served, so
+ * you find whoever points at it — paid once, in one place.
+ *
+ * What it does **not** do is signing. A CloudFront signed URL or signed cookie
+ * needs a key group and a private key, which is key material nothing declares
+ * yet; the construct's `signedUrl` is an S3 presign at the bucket instead. So
+ * open paths are served here, and a signed read goes to the bucket's own host.
+ * That is a real difference in hostname, and it is documented rather than hidden
+ * because a presign and a CloudFront signature share only the word "signed".
+ */
+export class FileServer<
+		TStage extends string = string,
+		TDomain extends string = string,
+	>
+	extends sst.aws.Router
+	implements GkmLinkable
+{
+	readonly _id!: string;
+
+	get _type() {
+		return ResourceType.FileServer;
+	}
+
+	constructor(
+		_stack: StackType<TStage, TDomain>,
+		name: string,
+		props: FileServerProps,
+	) {
+		const { origin, ...args } = props;
+
+		super(name, args);
+		this._id = name;
+
+		// Everything at the root, so a served path *is* a bucket key and the
+		// client's `url(key)` and `getUploadURL(key)` speak the same language.
+		// Several origins would cost exactly that, which is why multi-origin is
+		// deferred until something asks for it.
+		this.routeBucket('/*', origin);
+	}
+
+	/**
+	 * The one value this server resolves: where its objects answer.
+	 *
+	 * A custom domain when one is configured and the distribution's assigned
+	 * hostname otherwise — `Router.url` already prefers the former. The assigned
+	 * hostname is a fallback rather than a destination: it changes if the
+	 * distribution is replaced, which turns every URL anyone emailed or cached
+	 * into a dead one.
+	 */
+	provides(): Record<string, $util.Input<string>> {
+		return { url: this.url };
+	}
+
+	override getSSTLink() {
+		const link = super.getSSTLink();
+		return {
+			...link,
+			properties: { ...link.properties, ...this.provides() },
+		};
+	}
+}
+
+export interface FileServerProps extends sst.aws.RouterArgs {
+	/** The bucket whose objects this serves. */
+	origin: sst.aws.Bucket;
+}

package/src/sst/{Function.ts → aws/Function.ts}

@@ -4,9 +4,9 @@ import {
 	flattenManifestField,
 	type ManifestField,
 } from '@geekmidas/manifest';
-import { type GkmLinkable, ResourceType } from './Linkable';
-import { LinkedEnvironment } from './LinkedEnvironment';
-import type { StackType } from './Stack';
+import { type GkmLinkable, ResourceType } from '../Linkable';
+import { LinkedEnvironment } from '../LinkedEnvironment';
+import type { StackType } from '../Stack';
 
 /**
  * `Function` — wraps SST's `sst.aws.Function` with standard env defaults and