# swb packages

Configures a package tool to install from the class's package repository —
every Willdan package, and the public registries behind it — with a 12-hour
token vended to you as the person signed in. npm is the tool it configures,
and bun reads the same configuration. See
[Consume a package](/consume-a-package) for what the repository is.

## Synopsis

```
usage: swb packages login <tool>
```

## Arguments and flags

| Argument or flag | Takes | Default |
|---|---|---|
| `login <tool>` | The tool to configure. `npm` is the one served. Required. | — |
| `--help`, `-h` | Prints the command's help and exits. | off |

## What it writes

Your user-level npm configuration: the file `NPM_CONFIG_USERCONFIG` names,
else `~/.npmrc`. It writes the two lines `aws codeartifact login --tool npm`
writes — the repository's endpoint as `registry`, and the token as that
endpoint's `_authToken` — and removes any `registry` line and any CodeArtifact
credential line already there, so a second login replaces the first and every
other line stays where it was. A file it creates is readable by you alone. It
writes nothing into a repository's own `.npmrc`.

The token lasts 12 hours. When it expires, installs are refused until you run
the command again.

## What it prints

| Line | What it is |
|---|---|
| `registry` | The repository's npm endpoint, in the control plane's region. |
| `expires` | When the token expires, as CodeArtifact reported it, in UTC. |
| `written` | The configuration file it wrote. |

It never prints the token.

## The operation and the permission

`Mutation.vendPackageToken(format: NPM)`. It needs `swb.packages.read`, which
every role of Switchboard's carries, and it answers a person's own call alone:
a pipeline, a workload or an API key is refused whatever it holds, because a
build takes its token with its own role. The token is taken under the
package-reader role in your name, so the session names you.

## The same act in the console

None: the console has no screen that vends a package token.

## Refusals and exit status

Exit status is 0 on success and 1 on every refusal below.

| Refusal | When |
|---|---|
| `swb packages takes login <tool>` | The verb is missing or is not `login`. |
| `swb packages login takes <tool>: npm` | The tool is missing. |
| `swb packages login serves npm; <tool> is not a tool it configures` | A tool other than npm was named. Nothing is written. |
| `not signed in or token expired — run swb login` | There is no usable credential. |
| The API's own error text | The control plane refused — a person without `swb.packages.read`, or STS or CodeArtifact refusing the exchange, named by that service's own code and words. |

## Example

```console
$ swb packages login npm
registry  https://willdan-111122223333.d.codeartifact.us-west-2.amazonaws.com/npm/willdan/
expires   2026-10-07 04:00
written   /home/a.person/.npmrc
```