Version: v5.7.0

opschain admin packs

Included from Basic tier

Manage the platform's installed pack store: signed pack bundles uploaded as whole versioned units. A bundle is the canonical offline distribution form of an action pack — a snapshot of the pack's tree plus a signed manifest carrying the pack's name, its semantic version, the entitlement it requires, the minimum platform version it runs on and a content digest for every file. The platform verifies all of that against its embedded keyring before a byte is stored, so a bundle downloaded to an air-gapped estate and carried in installs with no network at all.

The version inside the signed manifest is the authoritative one — the bundle's filename and any release tag are decoration. Versions are immutable: re-uploading an installed version with identical content is idempotent, re-uploading it with different content refuses, and a fix is always a new version. Prior versions stay installed side by side, so different template versions can pin different pack versions and run concurrently; rolling back is a re-pin, never a re-upload.

A template opts in to an installed pack through .opschain/packs.yaml:

packs:
  - name: infrastructure
    installed: opschain-pack-infrastructure
    version: 1.2.3   # optional — omit to track the store

With version: the declaration pins that exact installed version. Without it, the version is chosen when the template version resolves — the pack's pinned version if an administrator set one with pin, otherwise the highest installed semantic version — and that exact version is sealed into the template version, so runs stay reproducible and upgrades are a deliberate re-resolution. A declaration with version: is sealed by the file; one without seals the pin (else the highest installed) — the estate default — unless the template version carries an explicit per-version pin of its own (set with the pack option of opschain templates version upsert, kept across fetches of the revision); opschain templates re-resolve rolls the estate onto the default, or, when it names a version, writes that version as every cut version's explicit pin (opschain docs cli/templates-version-upsert, opschain docs cli/templates-re-resolve).

The same signed bundle file also mounts directly in a --local run with bundle: <path> in .opschain/packs.yaml — verified identically, no store involved — so one artefact serves both lanes (see opschain docs getting-started/2-4-using-packs).

Subcommand	Purpose
`install -f <file>`	Upload and install a signed bundle.
`list`	Installed versions: entitlement, platform floor, pin state.
`pin <pack> [<version>]`	Set (or `--clear`) the unversioned resolution target.
`delete <pack> <version>`	Remove one version (refuses while referenced).

Every verb rides the v2 PackStoreService and requires the /admin updatable determination; every write is audited (api:packs:* events).

Exit codes: 0 on success, 1 when a call fails or the token is rejected, 2 for usage errors.

See also​

See also