Changeset 0.38.0 (#233)

Co-authored-by: gobha <jasafpro@gmail.com>
Co-committed-by: gobha <jasafpro@gmail.com>

CHANGELOG.md

@@ -1,5 +1,66 @@
 # Changelog
 
+## [0.38.0.0] — 2026-03-25
+
+### Summary
+
+Multi-file Starlark packages. Promotes Starlark scripts from a single
+inline blob in the DB manifest to a proper file tree with `load()` support.
+Prerequisite for library packages (v0.38.2) and large extensions.
+
+### Changed
+
+- **Extraction:** `extractableRelPath()` now extracts `star/` directories
+  and bare `*.star` files alongside `js/`, `css/`, `assets/`. Starlark
+  scripts land on disk at install time instead of being serialized into
+  the manifest JSONB.
+  (`server/handlers/packages.go`)
+- **Sandbox:** New `ExecWithLoader()` accepts an optional `LoadFunc` for
+  resolving `load()` statements. `Exec()` is now a thin wrapper that
+  passes a nil loader (backward compatible).
+  (`server/sandbox/sandbox.go`)
+- **Runner:** Disk-first script loading via `loadScript()` — reads from
+  `{packagesDir}/{pkgID}/script.star` (or custom `entry_point`), falls
+  back to legacy `_starlark_script` manifest field. Package-scoped
+  `packageLoader()` enables `load()` within a package's directory with
+  path traversal protection, `.star`-only enforcement, and circular
+  dependency detection.
+  (`server/sandbox/runner.go`)
+- **Wiring:** `SetPackagesDir()` called at startup with
+  `cfg.StoragePath + "/packages"`. Build script includes `star/` in
+  archives.
+  (`server/main.go`, `packages/build.sh`)
+
+### Added
+
+- **Entry point validation:** Starlark-tier packages must include
+  `script.star` (or the manifest's `entry_point` value) in the archive.
+  Returns 400 if missing.
+- **`entry_point` manifest field:** Optional override for the default
+  entry script name (`script.star`).
+- **SDK test runner:** New `packages` domain with 6 tests covering
+  install validation (missing entry point, with star/, custom entry_point,
+  browser-tier bypass).
+  (`packages/sdk-test-runner/js/domains/packages.js`)
+
+### Removed
+
+- **`_starlark_script` injection:** The installer no longer reads
+  `script.star` from the archive and stuffs it into the manifest JSON.
+  Scripts are loaded from disk at runtime. Existing packages with
+  `_starlark_script` in their DB row continue to work (legacy fallback).
+
+### Documentation
+
+- **ICD:** Multi-file Starlark section added to `extensions.md` with
+  archive structure, `load()` constraints, and error codes.
+- **OpenAPI:** Install endpoint description updated with entry point
+  validation and `star/` directory extraction.
+- **Surfaces ICD:** Archive format updated to include `script.star` and
+  `star/` entries.
+
+---
+
 ## [0.37.19.0] — 2026-03-24
 
 ### Summary