V0.38.2 library packages (#235)

Co-authored-by: gobha <jasafpro@gmail.com>
Co-committed-by: gobha <jasafpro@gmail.com>

docs/ICD/extensions.md

@@ -414,6 +414,50 @@ config fields with secrets decrypted.
 
 ---
 
+### Library Packages (v0.38.2)
+
+Library packages (`type: "library"`) export Starlark functions for other
+packages to consume. Libraries run with their own permission context,
+isolating consumers from implementation details.
+
+**Manifest fields:**
+- `type: "library"` — required
+- `tier: "starlark"` — required (libraries are always starlark-tier)
+- `exports: ["fn_a", "fn_b"]` — required, names of globals to expose
+- `permissions: [...]` — the library's own permissions (not inherited by consumers)
+- `dependencies: {"other-lib": ">=1.0.0"}` — optional, libraries can depend on other libraries
+
+**Restrictions:** Libraries cannot have `tools`, `pipes`, or a `route`.
+
+**Consumer usage (Starlark):**
+
+Consumers declare dependencies in their manifest:
+```json
+{ "dependencies": { "gitea-client": ">=1.0.0" } }
+```
+
+Then load at runtime:
+```python
+gitea = lib.load("gitea-client")
+repos = gitea.get_repos(conn)
+```
+
+`lib.load()` validates the dependency record, loads the library's script
+with the library's own permissions, extracts the declared exports, and
+returns them as a frozen struct. Results are cached per invocation.
+
+**Admin endpoints:**
+
+| Method | Path | Description |
+|--------|------|-------------|
+| GET | `/api/v1/admin/packages/:id/dependencies` | Libraries this package depends on |
+| GET | `/api/v1/admin/packages/:id/consumers` | Packages that depend on this library |
+| GET | `/api/v1/admin/dependencies` | Full dependency graph |
+
+**Uninstall protection:** Libraries with active consumers return 409 on delete.
+
+---
+
 ### Builtin Seeding
 
 On startup, `SeedBuiltinExtensions()` scans `extensions/builtin/`