# Consume a package

Every Willdan package — private and public, npm, PyPI, Maven, NuGet,
Swift, Ruby, Cargo and generic — comes from **one CodeArtifact
repository**: domain `willdan`, repository `willdan`, in the class's own
account. Public registries (npmjs, pypi.org, Maven Central, nuget.org)
are chained as upstreams, so the single index URL serves a private
package and its public dependencies alike. You never add a second
registry.

The class keeps the same registry in each of its two regions, under the
same names, so a build in either region reads its packages from the
registry beside it. Your tool is configured with the one in the control
plane's region.

The owner is in the package name — the npm scope, the Maven groupId, the
NuGet prefix — not in a repository of its own. Read authorization is per
repository (`ReadFromRepository`), never per package.

## The credential

Authentication is IAM: a **12-hour token** that npm, pip and uv, Maven and
NuGet all accept as a plain credential. There is no long-lived package
secret to hold, and nothing in a repository's own source names the token
or the endpoint.

Two places issue one, and no third:

- **A build on the class's build fleet** takes its token with its own
  role. A repository that consumes a Willdan package is a connected
  repository building on the fleet; a GitHub-hosted workflow gets no route
  into the registry.
- **You, signed in to Switchboard**, get yours from
  [`swb packages login`](/command-line/packages). Switchboard checks you
  hold `swb.packages.read`, which every role carries, and takes the token
  in your name under the one role that may read the repository. On a
  machine with no `swb` yet, the console hands you the same login (below).

## Wiring npm

```sh
swb login https://console.switchboard.example
swb packages login npm
```

`swb packages login npm` writes the repository's endpoint as the registry
and the token as its credential into your user-level npm configuration —
`~/.npmrc`, or the file `NPM_CONFIG_USERCONFIG` names — which bun reads
too, replacing its registry, whoever set it, and any earlier login's
token; every other line stays as it was. It prints the endpoint
and when the token expires. When it expires, run it again.

npm is the tool `swb packages login` configures today. pip, uv, Maven and
NuGet are not yet served.

## A machine with no `swb` yet

Sign in to Switchboard's console in the Willdan Group / Switchboard
account, the one account the Packages service is on for, open
**Packages** from the Services menu, and on **Connect a tool** choose
**Get npm login**. The page shows
the two lines `swb packages login npm` would write, with a 12-hour token
taken in your name the same way. Paste them into your user-level npm
configuration — the file `npm config get userconfig` names, `~/.npmrc` by
default — in place of its `registry=` line and any earlier CodeArtifact
credential. Then a command line published to the registry runs:

```sh
npx @willdan/<cli>@<version>
```

The console writes nothing to your machine and keeps the token only while
the page is open. When it expires, take a new login.

## Publishing

A package reaches the repository from its repository's build on the
class's build fleet, at its app's version, into both regions' registries,
with the token that run takes for itself — never from a laptop or a
GitHub-hosted workflow. The build's publish step is not yet built, so no
package is published today. The schema service is one more publisher on
this repository — see [resolved at build](/resolved-at-build).

## What is not here

CloudFormation templates and config-as-code bundles are **not** packages.
They live in the artifact buckets, where a build's own row and the
catalog are already the index over them.