Build & ship · Step 1
Build
Write your package against the building blocks NAOMS already gives you: identity, storage, groups, trust, agents. No backend, no database to run, no login screen to design.
Build is the step where a package’s code and its declared access are written together. A package is a self-contained project with one typed manifest naming its id, what shared history it reads or writes, and what operations it exposes; NAOMS reads that manifest before any of the package’s code runs. Reaching for anything outside the declared scope is refused immediately.
What a person notices
Your package shows up as its own tab inside the app they already use. There is nothing extra to download or sign up for separately.
When your package needs something from their data, they see a permission prompt naming exactly what it asked for.
Uninstalling your package removes it cleanly. It cannot leave background processes or leftover access running.
What you do as a developer
A package is a small, self-contained folder that lives inside the platform. NAOMS finds it, runs it and enforces its limits automatically. There is no central list of installed packages to edit by hand.
Decide whether it's a new package or an extension
A new package earns its own identity when it needs an independent signing path, an independent release, or an independent version number. Otherwise the work belongs inside an existing package rather than as a new one.
Write the manifest
Every package exports one typed constant declaring its id, name, version, category, what events it records to the shared history, and what operations it exposes. NAOMS reads this before any of your code is allowed to run.
Give it a screen, if it needs one
Point the manifest at a small script and the shell loads it as your package's own tab: a scoped area of the page to draw into, plus calls for when someone opens it, switches away from it, or removes it.
Write your handlers inside the scope you declared
A handler only ever sees the slice of the data and shared history your manifest named. Reaching for something you never declared is refused immediately, before it touches anything.
Run it locally
Your package's tests live next to its code and run through the platform's own test runner, enforcing the same consent and audit rules a running instance of NAOMS would. Restart NAOMS and it picks up your new package on its own.
Because the manifest is the single source of truth NAOMS checks, there is nothing else to wire up: no route table, no separate database schema, no auth middleware. Declaring is most of the work.
What each declared operation gives you
One entry in your manifest's operations list becomes four things at once: a typed method your own code calls, a message NAOMS accepts over its live connection, a tool an AI agent can call, and a terminal command. All four are generated from the same declaration, with nothing to keep in sync by hand.
Called from your own code
A typed method available inside your handlers, scoped to exactly the arguments and return shape you declared.
Called live
The same operation reachable as a message over an already-connected session, no separate route to add.
Called by an agent or from a terminal
An AI agent sees it as a listed tool, and a person can also call it as a terminal command. Both are generated automatically from the same declaration.