# Consume a package

Every Willdan package — private and public, npm, PyPI, Maven, NuGet,
Swift, Ruby, Cargo and generic — comes from **one CodeArtifact
repository**: domain `willdan`, repository `willdan`, in the devops
account. Public registries (npmjs, pypi.org, Maven Central, nuget.org)
are chained as upstreams, so the single index URL serves a private
package and its public dependencies alike. You never add a second
registry.

The owner is in the package name — the npm scope, the Maven groupId, the
NuGet prefix — not in a repository of its own. Read authorization is per
repository (`ReadFromRepository`), never per package.

## The credential

Authentication is IAM: a **12-hour token** from
`codeartifact get-authorization-token`, which npm, pip and uv, Maven and
NuGet all accept as a plain credential. There is no long-lived package
secret to hold.

Two ways to get one, depending on what you have:

**You have an AWS seat.** `aws sso login`, then ask CodeArtifact for the
token yourself:

```sh
aws codeartifact get-authorization-token \
  --domain willdan --query authorizationToken --output text
```

**You have only a Switchboard sign-in.** The console's **Packages →
Connect a tool** vends the same token: your session is exchanged through
the OIDC path for a package-reader role scoped by your
`swb.packages.read` grant, and CodeArtifact issues the token to that
role. A private Python package then installs with plain `uv add` — no
GitHub seat, no secret in your dotfiles.

Both paths end at the same 12-hour token against the same index URL. When
it expires, ask again.

## Wiring your toolchain

**Packages → Connect a tool** in the console prints the exact commands
for your tool with the repository's own endpoint filled in. The AWS CLI
also writes most of them for you:

```sh
aws codeartifact login --tool npm --domain willdan --repository willdan
aws codeartifact login --tool pip --domain willdan --repository willdan
```

For uv, Maven and NuGet, take the index URL and the token from the same
page and put them where that toolchain expects a registry credential.

## Publishing

Publishing is the ordinary command for the toolchain, pointed at the same
repository: `npm publish`, `uv publish`, `mvn deploy`,
`dotnet nuget push`. In CI it runs from the
[shared publish workflow](/build-and-publish) under the OIDC deploy role,
which gets its token the same way. The schema service is just one more
publisher on this repository — see
[resolved at build](/resolved-at-build).

## What is not here

CloudFormation templates and config-as-code bundles are **not** packages.
They live in the artifact buckets, where a build's own row and the
catalog are already the index over them.