@substrat-run/control-plane-api 0.58.0 → 0.60.0

package/dist/api.d.ts

@@ -1,5 +1,5 @@
 import { Hono } from 'hono';
-import type { PlatformActorId } from '@substrat-run/contracts';
+import type { Connection, ConnectionActivity, ConnectionProbe, PlatformActorId } from '@substrat-run/contracts';
 import type { ScopeHost } from '@substrat-run/kernel';
 import type { PlatformActorAuth, BuilderAuth, Principal } from './auth.js';
 import { type VerticalClient } from './vertical-client.js';
@@ -10,6 +10,23 @@ import type { PlatformRuntime } from './platform-runtime.js';
 import { type DoNamespaceReader } from './do-namespaces.js';
 import type { DirectoryBackupStore, ScopeBackupStore } from './backups.js';
 import { type CustomHostnameProvisioner } from './custom-hostnames.js';
+/**
+ * What one provider can answer about a live connection (#605) — the seam behind
+ * `POST /tenants/:t/connections/:id/verify` and `GET …/activity`.
+ *
+ * Both halves take the connection ROW, never a credential: opening the secret is the
+ * connector's own act through `HostAdmin`, so the plaintext still never crosses this
+ * package. `probe` says whether the provider accepts the credential and whose account
+ * it is; `activity` projects the connector's dispatch ledger into the declared shape —
+ * a projection precisely because a raw ledger row may carry connector secrets (Scrive's
+ * callback capability token), and redaction has to be structural.
+ */
+export interface ConnectionInspector {
+    probe?: (host: ScopeHost, connection: Connection) => Promise<ConnectionProbe>;
+    activity?: (host: ScopeHost, connection: Connection, opts: {
+        live: boolean;
+    }) => Promise<ConnectionActivity>;
+}
 export interface ControlPlaneApiOptions {
     host: ScopeHost;
     /**
@@ -64,12 +81,15 @@ export interface ControlPlaneApiOptions {
      */
     fetchVerticalModules?: FetchVerticalModulesFn;
     /**
-     * Reads one static file back from a script's runtime-served assets (#578) — how a
-     * serving upload recovers asset bytes the stable script's upload session reports
-     * missing (the asset store dedups per script, so the push's upload to the archive
-     * script does not cover a re-serve). Host-injected like `fetchVerticalModules`.
-     * Absent ⇒ a re-serve of an asset-carrying version refuses when the runtime wants
-     * bytes (the pre-#578 behavior).
+     * Reads one static file's bytes back from a script in the namespace (#578) — the
+     * asset twin of `fetchVerticalModules`. The runtime's asset store dedupes per
+     * SCRIPT, not namespace-wide, so the first serve of an asset-carrying version onto
+     * the stable serving script always finds its hashes missing there; this seam is how
+     * the serve recovers the bytes the push uploaded to the version's archive script.
+     * Host-injected like `deployVertical` (on Cloudflare, a dispatch fetch — the archive
+     * script's edge serves its own assets without invoking the worker). Absent ⇒ a
+     * re-serve can only ride what the stable script already holds and refuses honestly
+     * otherwise.
      */
     fetchVerticalAsset?: FetchVerticalAssetFn;
     /**
@@ -121,6 +141,20 @@ export interface ControlPlaneApiOptions {
      * means forgetting that costs a feature, never a leak.
      */
     observability?: ObservabilityReader;
+    /**
+     * Per-provider connection **inspectors** (#605), keyed by provider slug — what makes
+     * an integration something an operator can interrogate rather than trust.
+     *
+     * Host-injected for the same reason `deployVertical` and `observability` are: this
+     * package holds no connector and must learn no provider's vocabulary. The host wires
+     * the same connector closure it already registers for dispatch and sweep (the
+     * `sweepers` idiom, `apps/control-plane/src/worker.ts`), and the routes below stay
+     * pure transport over a declared, provider-agnostic shape.
+     *
+     * An unregistered provider 501s rather than answering emptily — "this platform cannot
+     * verify a Fortnox key yet" is a true statement; "your Fortnox key is fine" is not.
+     */
+    connectionInspectors?: Record<string, ConnectionInspector>;
     /**
      * Where this platform's compute actually runs — the coordinates a staff surface needs
      * to hand an operator a link INTO the provider's own console (the right script, the

package/dist/api.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../src/api.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAiC5B,OAAO,KAAK,EAGV,eAAe,EAMhB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAmB,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAGvE,OAAO,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAC3E,OAAO,EAA4B,KAAK,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAgBrF,OAAO,KAAK,EAAe,gBAAgB,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAC/G,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAC;AAQtD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EAAuB,KAAK,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACjF,OAAO,KAAK,EAEV,oBAAoB,EAEpB,gBAAgB,EACjB,MAAM,cAAc,CAAC;AAEtB,OAAO,EAGL,KAAK,yBAAyB,EAC/B,MAAM,uBAAuB,CAAC;AAE/B,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,SAAS,CAAC;IAChB;;;;;;;OAOG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAC3C;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,KAAK,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IAChG;;;;;;;;;OASG;IACH,sBAAsB,CAAC,EAAE,CACvB,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,eAAe,KACnB,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IACzC;;;;;;;OAOG;IACH,kBAAkB,CAAC,EAAE,CAAC,aAAa,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IACpF;;;;;OAKG;IACH,cAAc,CAAC,EAAE,gBAAgB,CAAC;IAClC;;;;;OAKG;IACH,oBAAoB,CAAC,EAAE,sBAAsB,CAAC;IAC9C;;;;;;;OAOG;IACH,kBAAkB,CAAC,EAAE,oBAAoB,CAAC;IAC1C;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,qBAAqB,CAAC;IAC5C;;;;;;;;OAQG;IACH,sBAAsB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C;;;;OAIG;IACH,YAAY,EAAE,iBAAiB,CAAC;IAChC;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,WAAW,CAAC;IAClC;;;;;OAKG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,mBAAmB,CAAC;IACpC;;;;;;;;;OASG;IACH,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC;;;;;OAKG;IACH,YAAY,CAAC,EAAE,iBAAiB,CAAC;IACjC;;;;;;;;;;;;;OAaG;IACH,YAAY,CAAC,EAAE,gBAAgB,CAAC;IAChC;;;;;;;;;OASG;IACH,gBAAgB,CAAC,EAAE,oBAAoB,CAAC;IACxC;;;;;;;OAOG;IACH,iBAAiB,CAAC,EAAE,yBAAyB,CAAC;IAC9C;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;CAChC;AAKD,KAAK,IAAI,GAAG;IAAE,KAAK,EAAE,eAAe,CAAC;IAAC,SAAS,EAAE,SAAS,CAAA;CAAE,CAAC;AA2P7D;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,sBAAsB,GAAG,IAAI,CAAC;IAAE,SAAS,EAAE,IAAI,CAAA;CAAE,CAAC,CAyyGhG"}
+{"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../src/api.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAoC5B,OAAO,KAAK,EACV,UAAU,EACV,kBAAkB,EAClB,eAAe,EAGf,eAAe,EAMhB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAmB,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAGvE,OAAO,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAC3E,OAAO,EAA4B,KAAK,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAiBrF,OAAO,KAAK,EAEV,gBAAgB,EAChB,oBAAoB,EACpB,sBAAsB,EACvB,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAC;AAQtD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EAAuB,KAAK,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACjF,OAAO,KAAK,EAEV,oBAAoB,EAEpB,gBAAgB,EACjB,MAAM,cAAc,CAAC;AAEtB,OAAO,EAGL,KAAK,yBAAyB,EAC/B,MAAM,uBAAuB,CAAC;AAE/B;;;;;;;;;;GAUG;AACH,MAAM,WAAW,mBAAmB;IAClC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,KAAK,OAAO,CAAC,eAAe,CAAC,CAAC;IAC9E,QAAQ,CAAC,EAAE,CACT,IAAI,EAAE,SAAS,EACf,UAAU,EAAE,UAAU,EACtB,IAAI,EAAE;QAAE,IAAI,EAAE,OAAO,CAAA;KAAE,KACpB,OAAO,CAAC,kBAAkB,CAAC,CAAC;CAClC;AAED,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,SAAS,CAAC;IAChB;;;;;;;OAOG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAC3C;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,KAAK,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IAChG;;;;;;;;;OASG;IACH,sBAAsB,CAAC,EAAE,CACvB,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,eAAe,KACnB,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IACzC;;;;;;;OAOG;IACH,kBAAkB,CAAC,EAAE,CAAC,aAAa,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IACpF;;;;;OAKG;IACH,cAAc,CAAC,EAAE,gBAAgB,CAAC;IAClC;;;;;OAKG;IACH,oBAAoB,CAAC,EAAE,sBAAsB,CAAC;IAC9C;;;;;;;;;;OAUG;IACH,kBAAkB,CAAC,EAAE,oBAAoB,CAAC;IAC1C;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,qBAAqB,CAAC;IAC5C;;;;;;;;OAQG;IACH,sBAAsB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C;;;;OAIG;IACH,YAAY,EAAE,iBAAiB,CAAC;IAChC;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,WAAW,CAAC;IAClC;;;;;OAKG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,mBAAmB,CAAC;IACpC;;;;;;;;;;;;OAYG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;IAC3D;;;;;;;;;OASG;IACH,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC;;;;;OAKG;IACH,YAAY,CAAC,EAAE,iBAAiB,CAAC;IACjC;;;;;;;;;;;;;OAaG;IACH,YAAY,CAAC,EAAE,gBAAgB,CAAC;IAChC;;;;;;;;;OASG;IACH,gBAAgB,CAAC,EAAE,oBAAoB,CAAC;IACxC;;;;;;;OAOG;IACH,iBAAiB,CAAC,EAAE,yBAAyB,CAAC;IAC9C;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;CAChC;AAKD,KAAK,IAAI,GAAG;IAAE,KAAK,EAAE,eAAe,CAAC;IAAC,SAAS,EAAE,SAAS,CAAA;CAAE,CAAC;AA2P7D;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,sBAAsB,GAAG,IAAI,CAAC;IAAE,SAAS,EAAE,IAAI,CAAA;CAAE,CAAC,CAu5GhG"}

package/dist/api.js

@@ -1,8 +1,9 @@
 import { Hono } from 'hono';
-import { adminAction, ASSET_PART_PREFIX, assetHash, channelName, createTenantInput, entitlementGrantInput, hostname as hostnameSchema, hostnameRegion, hostnameStatus, identityLink, listPageQuery, pageOf, principalId as principalIdSchema, promotionAcknowledgement, provisionableJurisdiction, publishVersionInput, queryScopeInput, readScopeTableInput, registerVerticalInput, scopeDump, dataSubjectId as dataSubjectIdSchema, scopeId as scopeIdSchema, scopeStatus, storageShape, surfaceName, tenantId as tenantIdSchema, tenantStatus, versionOrigin, z, } from '@substrat-run/contracts';
+import { adminAction, ASSET_PART_PREFIX, assetHash, channelName, connectionActivity, connectionFilter, connectionProbe, createTenantInput, entitlementGrantInput, hostname as hostnameSchema, hostnameRegion, hostnameStatus, identityLink, listPageQuery, pageOf, principalId as principalIdSchema, promotionAcknowledgement, provisionableJurisdiction, publishVersionInput, queryScopeInput, readScopeTableInput, registerVerticalInput, scopeDump, dataSubjectId as dataSubjectIdSchema, scopeId as scopeIdSchema, scopeStatus, storageShape, surfaceName, tenantId as tenantIdSchema, tenantStatus, versionOrigin, z, } from '@substrat-run/contracts';
 import { migrationProgress, ulid } from '@substrat-run/kernel';
 import { TENANT_HEADER } from './auth.js';
 import { connectionGrantsForScope } from './vertical-client.js';
+import { ConnectionRelayError, relayConnectionUpsert } from './connection-relay.js';
 import { ControlPlaneError } from './client.js';
 import { provisionSiblingScope } from './platform-drain.js';
 import { mapError } from './errors.js';
@@ -617,6 +618,116 @@ export function createControlPlaneApi(options) {
         const tenantId = tenantIdSchema.parse(c.req.param('tenantId'));
         return c.json(await admin.listConnectionGrants(c.get('actor'), tenantId));
     });
+    // -- the connection store, tenant-scoped (connections.md §3.5) -------------
+    //
+    // The dashboard's door to the PLATFORM's connection store. The dashboard keeps its own
+    // directory (its GitHub App connections live there, consumed by the dashboard itself),
+    // but a provider credential a PLATFORM-run connector consumes (Scrive, Fortnox) must
+    // land in THIS directory — `connector:<provider>` dispatch opens connections here, and
+    // a row written anywhere else is invisible to it. Metadata only on the read: the
+    // `Connection` type cannot carry a secret (contract-tested), so listing is safe as-is.
+    // Not in BUILDER_ROUTES — service/staff only, fail-closed, same law as the identity
+    // mirror above.
+    app.get('/tenants/:tenantId/connections', async (c) => {
+        const filter = connectionFilter.parse({
+            tenantId: tenantIdSchema.parse(c.req.param('tenantId')),
+            vertical: c.req.query('vertical'),
+            provider: c.req.query('provider'),
+            includeRevoked: c.req.query('includeRevoked') === '1' ? true : undefined,
+        });
+        return c.json(await admin.listConnections(c.get('actor'), filter));
+    });
+    // The same upsert semantics as `/internal/connections/upsert` (§3.5.2) — create under a
+    // fresh id, or rotate the one live row in place so its grant tuples survive — behind
+    // platform-actor auth instead of the vertical-harness PLATFORM_SECRET. The tenant is
+    // the path's, never the body's: a body naming a different tenant is refused, not
+    // silently rewritten.
+    app.post('/tenants/:tenantId/connections', async (c) => {
+        const tenantId = tenantIdSchema.parse(c.req.param('tenantId'));
+        const raw = await c.req.json();
+        const body = typeof raw === 'object' && raw !== null ? raw : {};
+        if (body.tenantId !== undefined && body.tenantId !== tenantId) {
+            return c.json({ error: 'body tenantId disagrees with the route tenant' }, 400);
+        }
+        try {
+            return c.json(await relayConnectionUpsert(host, c.get('actor'), { ...body, tenantId }));
+        }
+        catch (err) {
+            if (err instanceof ConnectionRelayError)
+                return c.json({ error: err.message }, err.status);
+            throw err;
+        }
+    });
+    // Revoke — terminal (the sealed secret is deleted, grants tombstone; a replacement is a
+    // new connection). Tenant-scoped with K-3 existence hiding: a foreign tenant's
+    // connection id is indistinguishable from an absent one. Idempotent: revoking an
+    // already-revoked row is a 204 no-op, not an error.
+    app.delete('/tenants/:tenantId/connections/:id', async (c) => {
+        const tenantId = tenantIdSchema.parse(c.req.param('tenantId'));
+        const id = c.req.param('id');
+        const rows = await admin.listConnections(c.get('actor'), { tenantId, includeRevoked: true });
+        const row = rows.find((r) => r.id === id);
+        if (!row)
+            return c.json({ error: 'unknown connection' }, 404);
+        if (row.status !== 'revoked')
+            await admin.revokeConnection(c.get('actor'), row.id);
+        return c.body(null, 204);
+    });
+    /**
+     * The tenant-scoped connection lookup the two inspection routes share. Same K-3
+     * existence hiding as the revoke above — a foreign tenant's connection id reads
+     * exactly like an absent one — and revoked rows are excluded: a withdrawn credential
+     * has no secret left to probe with, so "revoked" is a 404 for these reads too.
+     */
+    const inspectableConnection = async (c) => {
+        const tenantId = tenantIdSchema.parse(c.req.param('tenantId'));
+        const id = c.req.param('id');
+        const rows = await admin.listConnections(c.get('actor'), { tenantId });
+        return rows.find((r) => r.id === id);
+    };
+    /**
+     * **Verify a credential against the provider** (#605) — the read that turns "stored"
+     * into "works, and for this account".
+     *
+     * A POST because it reaches out: it spends an authenticated call at the provider and
+     * writes health (`recordConnectionUse` rides the connector's sanctioned `fetch`), so
+     * it is not the safe, cacheable read a GET promises. Not audited — like every other
+     * connection USE, it is machine telemetry, and §3.4's rule is that the audit log
+     * records control-plane mutations, not outbound calls.
+     *
+     * A rejected credential is `200 { ok: false, error }`, not an HTTP error: the
+     * provider answered, and its answer is the payload. Only a platform fault (no
+     * inspector wired, an unopenable secret) is a non-200.
+     */
+    app.post('/tenants/:tenantId/connections/:id/verify', async (c) => {
+        const row = await inspectableConnection(c);
+        if (!row)
+            return c.json({ error: 'unknown connection' }, 404);
+        const probe = options.connectionInspectors?.[row.provider]?.probe;
+        if (!probe) {
+            return c.json({ error: `no probe registered for provider '${row.provider}'` }, 501);
+        }
+        return c.json(connectionProbe.parse(await probe(host, row)));
+    });
+    /**
+     * **What the connection has done** (#605) — the connector's dispatch ledger, projected.
+     *
+     * `?live=1` asks the provider for current state as well; the result says which it got
+     * (`live`), because presenting the ledger's view as the provider's would be inventing
+     * facts. The projection is the connector's, never this package's: a raw ledger row can
+     * carry connector secrets, so it is never serialized here.
+     */
+    app.get('/tenants/:tenantId/connections/:id/activity', async (c) => {
+        const row = await inspectableConnection(c);
+        if (!row)
+            return c.json({ error: 'unknown connection' }, 404);
+        const activity = options.connectionInspectors?.[row.provider]?.activity;
+        if (!activity) {
+            return c.json({ error: `no activity view registered for provider '${row.provider}'` }, 501);
+        }
+        const live = c.req.query('live') === '1';
+        return c.json(connectionActivity.parse(await activity(host, row, { live })));
+    });
     // -- the scope directory (§3.2/§4.2) ---------------------------------------
     app.get('/scopes', async (c) => {
         const p = c.get('principal');
@@ -2252,6 +2363,7 @@ export function createControlPlaneApi(options) {
         if (!version?.deploymentRef) {
             throw new ControlPlaneError(502, `version ${versionId} has no archive script to serve from`);
         }
+        const archiveRef = version.deploymentRef;
         const manifestJson = await admin.versionManifest(actor, slug, versionId);
         if (!manifestJson) {
             throw new ControlPlaneError(502, `version ${versionId} retained no manifest — pushed pre-#286; push it again to serve in place`);
@@ -2282,24 +2394,23 @@ export function createControlPlaneApi(options) {
             modules,
             doClasses: manifest.doClasses,
             bindings: [...manifest.bindings, ...storeBindings],
-            // #340: the version's static files travel with it onto the serving script — from
-            // the RETAINED manifest, with no bytes up front. The asset store dedups PER
-            // SCRIPT (#578), so hashes the push uploaded to the archive script are still
-            // missing for the stable script — each file therefore carries a `fetchContent`
-            // that reads the bytes back from the archive script's runtime-served assets,
-            // invoked (and hash-verified) only for hashes the upload session reports
-            // missing. The archive script gives back the modules (#286) AND the assets:
-            // nothing but the manifest is retained.
+            // #340/#578: the version's static files travel with it onto the serving script —
+            // from the RETAINED manifest, with no bytes. The runtime's asset store dedupes
+            // per SCRIPT (not namespace-wide — the #578 finding), so the serving script only
+            // skips hashes it has itself held before; everything else — every first serve of
+            // new content — is recovered on demand from the version's archive script, the
+            // same store the modules come back from (#286), and verified against its
+            // content-address before upload. This is why the manifest is retained rather
+            // than the bytes: the archive script gives back modules AND assets.
             ...(manifest.assets
                 ? {
                     assets: {
                         ...manifest.assets,
-                        files: manifest.assets.files.map((f) => ({
-                            ...f,
-                            ...(options.fetchVerticalAsset
-                                ? { fetchContent: () => options.fetchVerticalAsset(version.deploymentRef, f.path) }
-                                : {}),
-                        })),
+                        ...(options.fetchVerticalAsset
+                            ? {
+                                recoverContent: (asset) => options.fetchVerticalAsset(archiveRef, asset),
+                            }
+                            : {}),
                     },
                 }
                 : {}),