Where is unlocked package version metadata stored?

Question

Suppose we created 2 versions of a unlocked package. These two versions have assigned a package version ID in the Dev Hub org and are added to the sfdx-project.json:

  {
  "name": "NewTestProject",
  "namespace": "",
  "sfdcLoginUrl": "https://login.salesforce.com",
  "sourceApiVersion": "59.0",
  "packageDirectories": [
    {
      "path": "force-app",
      "default": true
    },
    {
      "path": "core/Account",
      "scopeProfiles": "true",
      "versionName": "v1.0.0",
      "dependencies": [],
      "default": false,
      "package": "Account Package1",
      "versionNumber": "0.1.0.NEXT",
      "versionDescription": ""
    }
  ],
  "packageAliases": {
    "Account Package1": "0Ho3X000000PBJZSA4",
    "Account [email protected]": "04t3X000003LSseQAG",
    "Account [email protected]": "04t3X000003LSsjQAG"
  }
}

Now we can install any of these two versions into any existing org using sf without having it's metadata stored in our local directory:

sf package install --package 04t3X000003LSseQAG --target-org [email protected] -k password123 -w 1

Where is the metadata stored? Are we retrieving it from Dev Hub using our package version ID? If so, does it mean that deleting our Dev Hub org deletes the metadata as well? Is this technicality documented somewhere? I was unable to find.

Answer 1

The actual metadata storage for packages is opaque to you as an end user: it is inside the Salesforce platform.

When you upload a package, you receive an 04t package version id. That id uniquely points to a snapshot of the package metadata taken during the upload operation and stored by the Salesforce platform.

Performing a package install does not retrieve metadata (or anything else) from your Dev Hub. The Dev Hub is completely out of the loop for package consumers, who only use that artifact you uploaded into the platform. However, the Dev Hub does play a role as the owner of the package.

It's technically possible for an org that owns a package to be deleted, although it doesn't happen often. This has consequences that are somewhat unpredictable, and I quite honestly don't know what they are for an Unlocked Package (I've only see it for a managed package). Note that you can can transfer Unlocked Packages to another Dev Hub if you need to.

Note: I am a Salesforce employee, but not part of the Packaging team.