V0.38.4 full composition (#237)

Co-authored-by: gobha <jasafpro@gmail.com>
Co-committed-by: gobha <jasafpro@gmail.com>

docs/ICD/extensions.md

@@ -412,6 +412,65 @@ all  = connections.list("gitea")                    # all accessible
 Each returned dict contains `id`, `type`, `name`, `scope` plus all
 config fields with secrets decrypted.
 
+### Connection Type Discovery (v0.38.4)
+
+**Auth:** Authenticated user (no specific permission required)
+
+```
+GET /connection-types → {"data": [...connection type entries]}
+```
+
+Returns the merged set of connection types declared by all active packages.
+When multiple packages declare the same type name, library declarations
+take precedence over non-library declarations.
+
+**Response entry:**
+```json
+{
+  "type": "gitea",
+  "label": "Gitea Instance",
+  "package_id": "gitea-client",
+  "package_title": "Gitea API Client",
+  "fields": {
+    "base_url":  {"type": "url",    "required": "true",  "label": "Server URL"},
+    "api_token": {"type": "secret", "required": "true",  "label": "API Token"},
+    "org":       {"type": "string", "required": "false", "label": "Default Org"}
+  },
+  "scopes": ["global", "team", "personal"]
+}
+```
+
+Used by all three Connections management UIs (Settings, Admin, Team Admin)
+to populate the connection type dropdown. Replaces client-side manifest
+scanning which required admin permissions.
+
+---
+
+### Library Composition (v0.38.4)
+
+Libraries declare connection types in their manifest `connections[]` field.
+Consumers depend on the library and use its exported functions, passing
+connection dicts obtained from `connections.get()`.
+
+**End-to-end pattern:**
+
+1. Library declares `connections: [{ "type": "gitea", ... }]` in manifest
+2. Library exports functions that accept a `conn` parameter
+3. Admin installs library and grants permissions (`api.http`, `connections.read`, etc.)
+4. User creates a connection of the library's type via Settings > Connections
+5. Consumer declares `dependencies: { "gitea-client": ">=1.0.0" }` in manifest
+6. Consumer loads library: `gitea = lib.load("gitea-client")`
+7. Consumer resolves connection: `conn = connections.get("gitea")`
+8. Consumer calls library: `gitea.get_repos(conn)`
+
+The library function executes with the **library's** permission context.
+The consumer does not need `api.http` or `db.*` permissions — those are
+the library's concern.
+
+**Browser-side consumers** can also call the library's REST endpoints
+directly (`GET /s/gitea-client/api/repos`) without Starlark, enabling
+pure `type: "surface"` packages.
+
 ---
 
 ### Library Packages (v0.38.2)