Consume a package

Every Willdan package — private and public, npm, PyPI, Maven, NuGet, Swift, Ruby, Cargo and generic — comes from one CodeArtifact repository: domain willdan, repository willdan, in the class's own account. Public registries (npmjs, pypi.org, Maven Central, nuget.org) are chained as upstreams, so the single index URL serves a private package and its public dependencies alike. You never add a second registry.

The class keeps the same registry in each of its two regions, under the same names, so a build in either region reads its packages from the registry beside it. Your tool is configured with the one in the control plane's region.

The owner is in the package name — the npm scope, the Maven groupId, the NuGet prefix — not in a repository of its own. Read authorization is per repository (ReadFromRepository), never per package.

The credential

Authentication is IAM: a 12-hour token that npm, pip and uv, Maven and NuGet all accept as a plain credential. There is no long-lived package secret to hold, and nothing in a repository's own source names the token or the endpoint.

Two places issue one, and no third:

• A build on the class's build fleet takes its token with its own role. A repository that consumes a Willdan package is a connected repository building on the fleet; a GitHub-hosted workflow gets no route into the registry.
• You, signed in to Switchboard, get yours from swb packages login. Switchboard checks you hold swb.packages.read, which every role carries, and takes the token in your name under the one role that may read the repository. On a machine with no swb yet, the console hands you the same login (below).

Wiring npm

Code
swb login https://console.switchboard.example
swb packages login npm

swb packages login npm writes the repository's endpoint as the registry and the token as its credential into your user-level npm configuration — ~/.npmrc, or the file NPM_CONFIG_USERCONFIG names — which bun reads too, replacing its registry, whoever set it, and any earlier login's token; every other line stays as it was. It prints the endpoint and when the token expires. When it expires, run it again.

npm is the tool swb packages login configures today. pip, uv, Maven and NuGet are not yet served.

A machine with no swb yet

Sign in to Switchboard's console in the Willdan Group / Switchboard account, the one account the Packages service is on for, open Packages from the Services menu, and on Connect a tool choose Get npm login. The page shows the two lines swb packages login npm would write, with a 12-hour token taken in your name the same way. Paste them into your user-level npm configuration — the file npm config get userconfig names, ~/.npmrc by default — in place of its registry= line and any earlier CodeArtifact credential. Then a command line published to the registry runs:

Code
npx @willdan/<cli>@<version>

The console writes nothing to your machine and keeps the token only while the page is open. When it expires, take a new login.

Publishing

A package reaches the repository from its repository's build on the class's build fleet, at its app's version, into both regions' registries, with the token that run takes for itself — never from a laptop or a GitHub-hosted workflow. The build's publish step is not yet built, so no package is published today. The schema service is one more publisher on this repository — see resolved at build.

What is not here

CloudFormation templates and config-as-code bundles are not packages. They live in the artifact buckets, where a build's own row and the catalog are already the index over them.