Build your first module

End-to-end path from empty package to a module running on a sandbox tenant.

Artifact-first (default): pack a signed bundle and install via Control — no Core redeploy required.

1. Create modules/my-integration/ with package.json depending on @avanora/module-sdk.
2. Add module.manifest.json (v2) declaring key, permissions, navigation, apiRoutes, and configSchemaPath.
3. Add module.config.schema.json (JSON Schema) for the auto-rendered settings UI.
4. Implement src/index.ts exporting ModuleDefinition with install / upgrade / uninstall hooks.
5. Implement dist/routes.js handlers mounted at /api/v1/m/<module-key>/...
6. Run avanora-module validate, pack, and sign.
7. Upload in Control → Verify → Sandbox install on a dev tenant.
8. Verify RBAC: users without your permission keys receive 403 on module APIs.

Legacy builtin path

First-party core modules (CRM, Sales, …) still embed logic in apps/client-platform. Do not use that path for new marketplace modules — see extension registry.

Validate locally

Use avanora-module verify on your tarball and exercise endpoints with a tenant session against /api/v1/m/<key>/health. See sample endpoints and the sample manifest.

Next steps

Deep dives: manifest fields, lifecycle hooks, debug & sandbox.