Install the Blu packages
The packages are public on npm, in the horizonmedia organization. Code imports them as @blu/sdk and @blu/next-adapter; package.json aliases those names to the published packages.
package.json
Add to dependencies of each package that imports them (the front end, the API, or both):
"@blu/sdk": "npm:@horizonmedia/blu-sdk@^1.8.5"
For a Next.js app, also:
"@blu/next-adapter": "npm:@horizonmedia/blu-next-adapter@^1.2.1"
and vite (^7) in devDependencies. With npm: npm install @blu/sdk@npm:@horizonmedia/blu-sdk@^1.8.5. With pnpm and yarn, the alias syntax is the same in package.json.
Use the newest SDK version you can (the blu check that comes with it warns when the range allows older ones). Inside Blu, the shell provides its own copy of @blu/sdk to your front end, so you build against a version the shell supports.
No .npmrc or token
The packages are public on registry.npmjs.org: installing needs no .npmrc entry, login or token, on a developer's machine, in CI or in Docker builds.
If the repository's .npmrc still has @horizonmedia:registry=https://npm.pkg.github.com (from when the packages were on GitHub Packages, up to SDK 1.8.2), remove that line and any token set up for it, then reinstall so the lockfile points at registry.npmjs.org. blu check warns while it's there.
Python APIs: horizonmedia-blu-sdk (PyPI)
The Python SDK is public on PyPI as horizonmedia-blu-sdk. Code imports it as blu_sdk. No token or private index:
# pyproject.toml
dependencies = ["horizonmedia-blu-sdk[fastapi]~=1.2.3"]
Use [flask] or [django] instead of [fastapi] as fits. requirements.txt takes the same line, and Poetry poetry add "horizonmedia-blu-sdk[fastapi]@^1.2.3". Commit the lock file.
If the project still installs it from Git (blu-sdk @ git+https://github.com/HorizonMedia/blu-composable-experience@sdk-py-v…, before 1.2.3), replace that line with the one above and remove any token, insteadOf rewrite or Docker build secret that existed only to clone the Blu repository. blu check warns while the Git line is there.