datanotes 3.2.0 → 3.3.0

package/dist/docs/guides/read-and-write/automatic-links.md

@@ -98,7 +98,7 @@ Answer:
   "files_created": 1,
   "planned_creates": ["datanotes/main/public/film/Charade.md"],
   "commits": [{ "table": "main.public.film", "version": 2, "operation": "WRITE" }],
-  "migration_id": "20261019T040647-insert_row-insert-into-film-2",
+  "migration_id": "20261020T173837-insert_row-insert-into-film-2",
   "links_added": [
     {
       "path": "datanotes/main/public/film/Charade.md",
@@ -127,7 +127,7 @@ Answer:
 ```markdown
 ---
 table: main.public.film
-id: 01a15257-2f53-7dde-92fd-58531b7610ac
+id: 01a15a64-cc30-746d-8d56-2e96073a7f92
 title: Charade
 year: 1963
 ---
@@ -169,7 +169,7 @@ Answer:
     }
   ],
   "commits": [{ "table": "main.public.film", "version": 3, "operation": "UPDATE" }],
-  "migration_id": "20261019T040647-update_row-update-film",
+  "migration_id": "20261020T173837-update_row-update-film",
   "links_added": [
     {
       "path": "datanotes/main/public/film/Charade.md",
@@ -186,7 +186,7 @@ Answer:
 ```markdown
 ---
 table: main.public.film
-id: 01a15257-2f53-7dde-92fd-58531b7610ac
+id: 01a15a64-cc30-746d-8d56-2e96073a7f92
 title: Charade
 year: 1963
 ---
@@ -229,7 +229,7 @@ Answer:
     }
   ],
   "commits": [{ "table": "main.public.film", "version": 4, "operation": "UPDATE" }],
-  "migration_id": "20261019T040647-update_row-update-film-2",
+  "migration_id": "20261020T173837-update_row-update-film-2",
   "links_added": [
     {
       "path": "datanotes/main/public/film/Notorious.md",
@@ -287,7 +287,7 @@ Answer:
     }
   ],
   "commits": [{ "table": "main.public.film", "version": 5, "operation": "UPDATE" }],
-  "migration_id": "20261019T040647-update_row-update-film-3",
+  "migration_id": "20261020T173837-update_row-update-film-3",
   "links_added": [
     {
       "path": "datanotes/main/public/film/Notorious.md",
@@ -310,7 +310,7 @@ Answer:
 ```markdown
 ---
 table: main.public.film
-id: 01a15257-2f4c-79be-8415-be44a4b0a704
+id: 01a15a64-cc27-7889-830d-3f2630d43bc6
 title: Notorious
 year: 1946
 ---
@@ -373,7 +373,7 @@ Answer:
   "files_created": 1,
   "planned_creates": ["datanotes/main/public/film/Persona.md"],
   "commits": [{ "table": "main.public.film", "version": 6, "operation": "WRITE" }],
-  "migration_id": "20261019T040647-insert_row-insert-into-film-3",
+  "migration_id": "20261020T173837-insert_row-insert-into-film-3",
   "links_added": [
     {
       "path": "datanotes/main/public/film/Persona.md",
@@ -390,7 +390,7 @@ Answer:
 ```markdown
 ---
 table: main.public.film
-id: 01a15257-2f87-7ba7-aa6e-75809acf0984
+id: 01a15a64-cc67-77ea-a705-b2b8b3274155
 title: Persona
 year: 1966
 ---
@@ -472,7 +472,7 @@ Answer:
     }
   ],
   "commits": [{ "table": "main.public.film", "version": 7, "operation": "UPDATE" }],
-  "migration_id": "20261019T040647-update_row-update-film-4",
+  "migration_id": "20261020T173837-update_row-update-film-4",
   "links_added": [
     {
       "path": "datanotes/main/public/film/Persona.md",
@@ -489,7 +489,7 @@ Answer:
 ```markdown
 ---
 table: main.public.film
-id: 01a15257-2f87-7ba7-aa6e-75809acf0984
+id: 01a15a64-cc67-77ea-a705-b2b8b3274155
 title: Persona
 year: 1966
 ---
@@ -505,7 +505,7 @@ We watched it at [[2026-10-09T2100|Swedish night]].
 
 ```yaml
 # Metastore (Datanotes): catalogs, schemas, tables, columns, views.
-id: 01a15257-2f24-7fd9-a38b-535ca8cd7419
+id: 01a15a64-cbfe-7566-a13b-1628b83a1a00
 config:
   history: true
 
@@ -620,7 +620,7 @@ Answer:
   "files_created": 1,
   "planned_creates": ["datanotes/main/public/film/His Girl Friday.md"],
   "commits": [{ "table": "main.public.film", "version": 8, "operation": "WRITE" }],
-  "migration_id": "20261019T040647-insert_row-insert-into-film-4"
+  "migration_id": "20261020T173837-insert_row-insert-into-film-4"
 }
 ```
 
@@ -629,7 +629,7 @@ Answer:
 ```markdown
 ---
 table: main.public.film
-id: 01a15257-2fb4-7925-9829-2aab0ce3d7a7
+id: 01a15a64-cc94-72c6-a7d7-7f669c1d1869
 title: His Girl Friday
 year: 1940
 ---
@@ -663,7 +663,7 @@ Answer:
 
 ```yaml
 # Metastore (Datanotes): catalogs, schemas, tables, columns, views.
-id: 01a15257-2f24-7fd9-a38b-535ca8cd7419
+id: 01a15a64-cbfe-7566-a13b-1628b83a1a00
 config:
   history: true
   autolink: false

package/dist/docs/guides/read-and-write/import-notes.md

@@ -314,7 +314,7 @@ Answer:
   "op": "create_table",
   "planned_texts": ["datanotes/metastore.yaml"],
   "commits": [{ "table": "main.public.film", "version": 0, "operation": "CREATE TABLE" }],
-  "migration_id": "20261019T040648-create_table-create-table-main-public-film"
+  "migration_id": "20261020T173838-create_table-create-table-main-public-film"
 }
 ```
 
@@ -359,7 +359,7 @@ Answer (70 lines)
       "path": "Films/Charade.md",
       "set": {
         "table": "main.public.film",
-        "id": "01a15257-31b6-75a9-bb7e-06ebf5b385a4",
+        "id": "01a15a64-ce9f-7560-9add-1459237106c3",
         "director": "Stanley Donen",
         "title": "Charade"
       },
@@ -369,7 +369,7 @@ Answer (70 lines)
       "path": "Films/His Girl Friday.md",
       "set": {
         "table": "main.public.film",
-        "id": "01a15257-31b6-7aac-9ba1-16fb7e23aa0a",
+        "id": "01a15a64-ce9f-7172-abbb-020e612ede56",
         "director": "Howard Hawks",
         "title": "His Girl Friday"
       },
@@ -379,7 +379,7 @@ Answer (70 lines)
       "path": "Films/Metropolis.md",
       "set": {
         "table": "main.public.film",
-        "id": "01a15257-31b6-7d6a-998e-fd8f06c27786",
+        "id": "01a15a64-ce9f-7b50-990c-aa26f69b3ab6",
         "director": "Fritz Lang",
         "title": "Metropolis"
       },
@@ -389,7 +389,7 @@ Answer (70 lines)
       "path": "Films/Nosferatu.md",
       "set": {
         "table": "main.public.film",
-        "id": "01a15257-31b6-7a33-a502-afc11c66b564",
+        "id": "01a15a64-ce9f-7541-8429-fc436df30866",
         "director": "F. W. Murnau",
         "title": "Nosferatu"
       },
@@ -399,7 +399,7 @@ Answer (70 lines)
       "path": "Films/The Gold Rush.md",
       "set": {
         "table": "main.public.film",
-        "id": "01a15257-31b6-7124-9bc9-40a032066bd3",
+        "id": "01a15a64-ce9f-7cf2-8129-a75fb2745cc9",
         "director": "Charlie Chaplin",
         "title": "The Gold Rush"
       },
@@ -458,7 +458,7 @@ Answer (73 lines)
       "path": "Films/Charade.md",
       "set": {
         "table": "main.public.film",
-        "id": "01a15257-31bb-7a46-8ac7-181fa5bacea7",
+        "id": "01a15a64-cea3-7bf1-ada5-aeb2d9dbb4fd",
         "director": "Stanley Donen",
         "title": "Charade"
       },
@@ -468,7 +468,7 @@ Answer (73 lines)
       "path": "Films/His Girl Friday.md",
       "set": {
         "table": "main.public.film",
-        "id": "01a15257-31bb-7754-a84c-ada8c44c4f96",
+        "id": "01a15a64-cea3-777e-b51d-cfb871067faf",
         "director": "Howard Hawks",
         "title": "His Girl Friday"
       },
@@ -478,7 +478,7 @@ Answer (73 lines)
       "path": "Films/Metropolis.md",
       "set": {
         "table": "main.public.film",
-        "id": "01a15257-31bb-7113-b86a-5d6fdca79420",
+        "id": "01a15a64-cea3-776e-b81b-389706767aa1",
         "director": "Fritz Lang",
         "title": "Metropolis"
       },
@@ -488,7 +488,7 @@ Answer (73 lines)
       "path": "Films/Nosferatu.md",
       "set": {
         "table": "main.public.film",
-        "id": "01a15257-31bc-7f8b-b4a7-376f074e01cb",
+        "id": "01a15a64-cea3-7299-a73b-bb2b9eec0177",
         "director": "F. W. Murnau",
         "title": "Nosferatu"
       },
@@ -498,7 +498,7 @@ Answer (73 lines)
       "path": "Films/The Gold Rush.md",
       "set": {
         "table": "main.public.film",
-        "id": "01a15257-31bc-7554-a326-0e8b427aa5c6",
+        "id": "01a15a64-cea4-7624-b9be-0e6c6aeb6dfc",
         "director": "Charlie Chaplin",
         "title": "The Gold Rush"
       },
@@ -519,7 +519,7 @@ Answer (73 lines)
     }
   ],
   "commits": [{ "table": "main.public.film", "version": 1, "operation": "ADOPT ROWS" }],
-  "migration_id": "20261019T040648-adopt_rows-adopt-5-notes-into-film"
+  "migration_id": "20261020T173838-adopt_rows-adopt-5-notes-into-film"
 }
 ```
 
@@ -536,7 +536,7 @@ Answer:
 ```markdown
 ---
 table: main.public.film
-id: 01a15257-31bb-7a46-8ac7-181fa5bacea7
+id: 01a15a64-cea3-7bf1-ada5-aeb2d9dbb4fd
 year: 1963
 minutes: 113
 status: watched
@@ -623,7 +623,7 @@ Answer:
   "files_created": 1,
   "planned_creates": ["datanotes/main/public/film/Battleship Potemkin.md"],
   "commits": [{ "table": "main.public.film", "version": 2, "operation": "WRITE" }],
-  "migration_id": "20261019T040648-insert_row-insert-into-film"
+  "migration_id": "20261020T173838-insert_row-insert-into-film"
 }
 ```
 
@@ -655,7 +655,7 @@ Answer:
   "op": "add_column",
   "planned_texts": ["datanotes/metastore.yaml"],
   "commits": [{ "table": "main.public.film", "version": 4, "operation": "ADD COLUMNS" }],
-  "migration_id": "20261019T040650-add_column-add-column-added_by-to-film"
+  "migration_id": "20261020T173839-add_column-add-column-added_by-to-film"
 }
 ```
 
@@ -683,7 +683,7 @@ Answer:
   "files_created": 1,
   "planned_creates": ["datanotes/main/public/film/Night of the Living Dead.md"],
   "commits": [{ "table": "main.public.film", "version": 5, "operation": "WRITE" }],
-  "migration_id": "20261019T040650-insert_row-insert-into-film"
+  "migration_id": "20261020T173839-insert_row-insert-into-film"
 }
 ```
 
@@ -692,7 +692,7 @@ Answer:
 ```markdown
 ---
 table: main.public.film
-id: 01a15257-37bf-770c-a384-b360bb939197
+id: 01a15a64-d4a9-7905-af13-90c8506569c9
 director: George A. Romero
 minutes: 96
 status: to watch
@@ -734,7 +734,7 @@ Answer:
 ```markdown
 ---
 table: main.public.film
-id: 01a15257-3a49-7617-a437-430fcfdc292a
+id: 01a15a64-d731-7eff-804e-4148716ec5c3
 year: 1924
 minutes: 45
 status: to watch
@@ -762,7 +762,7 @@ Answer:
   "op": "alter_table",
   "planned_texts": ["datanotes/metastore.yaml"],
   "commits": [{ "table": "main.public.film", "version": 7, "operation": "ALTER TABLE" }],
-  "migration_id": "20261019T040652-alter_table-alter-table-main-public-film"
+  "migration_id": "20261020T173842-alter_table-alter-table-main-public-film"
 }
 ```
 
@@ -825,7 +825,7 @@ This is the table as you inferred, corrected and extended it on this page. Its d
 
 ```yaml
 # Metastore (Datanotes): catalogs, schemas, tables, columns, views.
-id: 01a15257-319e-7663-863b-41ff43d87deb
+id: 01a15a64-ce85-731f-bfea-eb573328eb39
 config:
   history: true
 

package/dist/docs/guides/read-and-write/joins-and-aggregates.md

@@ -100,9 +100,9 @@ Answer:
   "table": "main.public.watch",
   "total": 3,
   "rows": [
-    { "date(occurred_at)": "2026-10-14", "viewings": 1 },
-    { "date(occurred_at)": "2026-10-17", "viewings": 1 },
-    { "date(occurred_at)": "2026-10-18", "viewings": 1 }
+    { "date(occurred_at)": "2026-10-15", "viewings": 1 },
+    { "date(occurred_at)": "2026-10-18", "viewings": 1 },
+    { "date(occurred_at)": "2026-10-19", "viewings": 1 }
   ]
 }
 ```
@@ -138,10 +138,10 @@ Answer:
     {
       "path": "datanotes/main/public/film/Night of the Living Dead.md",
       "title": "Night of the Living Dead",
-      "watched_on": "2026-10-18",
+      "watched_on": "2026-10-19",
       "viewing": [
         {
-          "path": "datanotes/main/public/watch/2026-10-18T2200.md",
+          "path": "datanotes/main/public/watch/2026-10-19T2200.md",
           "where": "cinema",
           "with": "Oscar"
         }
@@ -150,10 +150,10 @@ Answer:
     {
       "path": "datanotes/main/public/film/The Gold Rush.md",
       "title": "The Gold Rush",
-      "watched_on": "2026-10-17",
+      "watched_on": "2026-10-18",
       "viewing": [
         {
-          "path": "datanotes/main/public/watch/2026-10-17T2030.md",
+          "path": "datanotes/main/public/watch/2026-10-18T2030.md",
           "where": "home",
           "with": "my sister"
         }

package/dist/docs/guides/read-and-write/read-and-filter.md

@@ -332,23 +332,23 @@ Answer:
   "total": 3,
   "rows": [
     {
-      "path": "datanotes/main/public/watch/2026-10-14T2115.md",
+      "path": "datanotes/main/public/watch/2026-10-15T2115.md",
       "film": "[[Charade]]",
-      "occurred_at": "2026-10-14T21:15",
+      "occurred_at": "2026-10-15T21:15",
       "where": "home",
       "place": "my living room"
     },
     {
-      "path": "datanotes/main/public/watch/2026-10-17T2030.md",
+      "path": "datanotes/main/public/watch/2026-10-18T2030.md",
       "film": "[[The Gold Rush]]",
-      "occurred_at": "2026-10-17T20:30",
+      "occurred_at": "2026-10-18T20:30",
       "where": "home",
       "place": "my living room"
     },
     {
-      "path": "datanotes/main/public/watch/2026-10-18T2200.md",
+      "path": "datanotes/main/public/watch/2026-10-19T2200.md",
       "film": "[[Night of the Living Dead]]",
-      "occurred_at": "2026-10-18T22:00",
+      "occurred_at": "2026-10-19T22:00",
       "where": "cinema",
       "place": "the film club downtown"
     }
@@ -459,12 +459,12 @@ Answer:
   "total": 7,
   "rows": [
     {
-      "path": "datanotes/main/public/watch/2026-10-14T2115.md",
-      "occurred_at": "2026-10-14T21:15"
+      "path": "datanotes/main/public/watch/2026-10-15T2115.md",
+      "occurred_at": "2026-10-15T21:15"
     },
     {
-      "path": "datanotes/main/public/watch/2026-10-10T2130.md",
-      "occurred_at": "2026-10-10T21:30"
+      "path": "datanotes/main/public/watch/2026-10-11T2130.md",
+      "occurred_at": "2026-10-11T21:30"
     }
   ]
 }

package/dist/docs/guides/read-and-write/write-rows.md

@@ -31,7 +31,7 @@ Answer:
   "files_created": 1,
   "planned_creates": ["datanotes/main/public/film/Metropolis.md"],
   "commits": [{ "table": "main.public.film", "version": 1, "operation": "WRITE" }],
-  "migration_id": "20261019T040638-insert_row-insert-into-film"
+  "migration_id": "20261020T173828-insert_row-insert-into-film"
 }
 ```
 
@@ -40,7 +40,7 @@ Answer:
 ```markdown
 ---
 table: main.public.film
-id: 01a15257-0a57-7094-a53c-2ffddb1a5284
+id: 01a15a64-a8b5-7df3-aef8-9d133af2ff28
 title: Metropolis
 year: 1927
 minutes: 153
@@ -103,7 +103,7 @@ Answer:
     }
   ],
   "commits": [{ "table": "main.public.film", "version": 6, "operation": "UPDATE" }],
-  "migration_id": "20261019T040643-update_row-update-film"
+  "migration_id": "20261020T173832-update_row-update-film"
 }
 ```
 
@@ -174,7 +174,7 @@ Answer:
     }
   ],
   "commits": [{ "table": "main.public.film", "version": 8, "operation": "UPDATE" }],
-  "migration_id": "20261019T040643-update_row-update-film-3",
+  "migration_id": "20261020T173833-update_row-update-film-2",
   "ambiguous_mentions": [
     {
       "path": "datanotes/main/public/film/Nosferatu.md",
@@ -193,7 +193,7 @@ Answer:
 ```markdown
 ---
 table: main.public.film
-id: 01a15257-1ca9-7d11-a4d0-bc403634a138
+id: 01a15a64-b97e-7825-b690-1c0bdc44583e
 title: Nosferatu
 year: 1922
 status: watched
@@ -246,7 +246,7 @@ Answer:
     }
   ],
   "commits": [{ "table": "main.public.film", "version": 9, "operation": "UPDATE" }],
-  "migration_id": "20261019T040643-update_row-update-film-4"
+  "migration_id": "20261020T173833-update_row-update-film-3"
 }
 ```
 
@@ -332,7 +332,7 @@ Answer:
     }
   ],
   "commits": [{ "table": "main.public.film", "version": 10, "operation": "UPDATE" }],
-  "migration_id": "20261019T040643-update_rows-update-film"
+  "migration_id": "20261020T173833-update_rows-update-film"
 }
 ```
 
@@ -370,7 +370,7 @@ Answer:
   ],
   "planned_creates": ["datanotes/main/public/film/Battleship Potemkin.md"],
   "commits": [{ "table": "main.public.film", "version": 11, "operation": "MERGE" }],
-  "migration_id": "20261019T040643-merge_rows-merge-2-rows-into-film"
+  "migration_id": "20261020T173833-merge_rows-merge-2-rows-into-film"
 }
 ```
 
@@ -431,7 +431,7 @@ Answer:
     }
   ],
   "commits": [{ "table": "main.public.film", "version": 12, "operation": "DELETE" }],
-  "migration_id": "20261019T040643-delete_rows-archive-1-rows-of-film"
+  "migration_id": "20261020T173833-delete_rows-archive-1-rows-of-film"
 }
 ```
 
@@ -568,6 +568,6 @@ Answer (51 lines)
     { "table": "main.public.film", "version": 22, "operation": "MOVE ROWS" },
     { "table": "main.public.watchlist", "version": 1, "operation": "MOVE ROWS" }
   ],
-  "migration_id": "20261019T040643-move_rows-move-4-rows-from-film-to-watch"
+  "migration_id": "20261020T173833-move_rows-move-4-rows-from-film-to-watch"
 }
 ```

package/dist/docs/guides/search/text.md

@@ -87,7 +87,7 @@ Answer (62 lines)
         {
           "start": 81,
           "end": 86,
-          "context": "-a8aa-d00b2c25ad08\nname: Cary Grant\n---\n\n"
+          "context": "-ad6c-b8dee1b7285e\nname: Cary Grant\n---\n\n"
         }
       ]
     },

package/dist/docs/guides/security/security-model.md

@@ -67,6 +67,18 @@ The owner creates a named token with `POST /datanotes/tokens/create/`, and the e
 
 A named token can’t create webhooks, manage tokens or read the engine’s status, and without `maintain` it can’t undo.
 
+### Extensions
+
+An extension adds tables and Model Context Protocol (MCP) tools from a git repository. Its code is trusted code that runs inside the MCP server’s process, not in a sandbox. Install only extensions you trust, and read the plan first.
+
+* **Pinned code**: the installer takes a version tag or a full commit id, and refuses a branch. It fetches the tag itself, even when a branch has the same name. It records the commit and the SHA-256 hashes of the manifest and the entry file. The server refuses cached code that differs.
+* **No install scripts**: the installer runs no script, no build and no `npm install`. The entry file may import only Node built-ins. The installer reads the imports in the file. Code that builds a module name at run time escapes this check.
+* **One token for each extension**: `ext-<name>` writes only the tables the manifest lists. It cannot change the schema or undo. The installer changes the schema with the owner’s token, after you confirm the plan.
+* **An invoker check**: before a tool that writes runs, the server checks the calling agent’s token. That token must be able to write the tool’s tables. A read-only client cannot write through an extension.
+* **The secret stays on one machine**: the token file sits under the data home with mode 0600. The registry in the engine’s store holds no secret.
+
+Known limits: extension code is not isolated from the MCP server’s process. Its token reads every table until read patterns ship. Migrations are declarative and run no code. [Install extensions](https://datanotes.dev/administration/extensions/) has the details.
+
 ### Who made each write
 
 The engine journals every write with its actor. The client sends the agent’s name, model and session, so they’re self-reported. The server sets the credential, `auth` (`owner`, or the named token’s name), and no client can claim another one.

package/dist/docs/reference/cli.md

@@ -3,7 +3,7 @@
 > The datanotes command and its options.
 
 ```text
-datanotes 3.2.0: Markdown notes as database tables, for you and your agents.
+datanotes 3.3.0: Markdown notes as database tables, for you and your agents.
 
 
 Usage:
@@ -15,6 +15,11 @@ Usage:
   datanotes store backup --database <folder>      show or set the store's git backup (--remote <url>, --off)
   datanotes store restore --from <url> --database <folder>   restore the store from its git backup
   datanotes store convert-log --to <files|segments> --database <folder>   rewrite the transaction log in that format
+  datanotes extension install <source> --database <folder>   install an extension: plan, confirm, write
+                                               (a git URL with #<tag>, owner/repo@<tag>, or a folder)
+  datanotes extension update | rollback | remove <name> --database <folder>   change an installed one
+  datanotes extension list --database <folder>    the installed extensions
+  datanotes extension check <folder>             check an extension's repository (for its authors)
   Every command takes --vault <folder> instead of --database for a vault holding the database.
   datanotes mcp --database <folder>            MCP server over stdio, on the engine running on the folder
                                                (or one it starts for the session)
@@ -103,6 +108,27 @@ Options of store:
   ~/.local/share/datanotes (Linux); DATANOTES_DATA_HOME moves it.
 
 
+Options of extension (every command but check works through the engine running on the database):
+  --database <folder>         the database folder (or DATANOTES_DATABASE; --vault <folder> for a vault)
+  --store <folder>            the engine's store, when serve was given one (or DATANOTES_STORE)
+  --settings <file>           settings file with the owner's token (or DATANOTES_SETTINGS;
+                              default settings.json in the store)
+  --url <url>                 an engine at an address (or DATANOTES_URL), with
+  --token-file <file>         a file holding the owner's token (or DATANOTES_TOKEN_FILE)
+  --map <list>                install, update: role=catalog.schema.table or role.column=column
+  --create <roles>            install, update: create these tables the extension depends on
+  --add <list>                install, update: add these role.column columns to matched tables
+  --catalog <name>            install: the catalog of the tables and views it creates
+  --schema <name>             install: the schema of the tables and views it creates
+  --to <ref>                  update: the version tag or commit to move to (default: the newest tag)
+  --from <source>             update: another source, such as the folder you develop in
+  --dry-run                   install, update: print the plan and write nothing
+  --yes                       write without asking (only once the user approved the plan)
+  --json                      print one JSON object (the plan or the result) and never ask
+  Lists (--map, --create, --add) are comma-separated. Exit codes: 0 done; 1 error; 2 the plan has
+  problems (nothing written); 3 confirmation needed (run again with --yes once the user approved)
+
+
 Options of mcp (stdio):
   --database <folder>         the database folder (or DATANOTES_DATABASE); acts with the owner's token,
                               and stops the engine it started when the client closes
@@ -128,6 +154,11 @@ Tools of mcp (both modes; default: every tool except create_webhook and delete_w
                               (or DATANOTES_MCP_OWNER_TOOLS=1)
 
 
+Extensions of mcp (both modes): the tools of the extensions installed in the database (datanotes
+extension install) come after the engine's tools; --profile read keeps only their read-only tools
+  --no-extensions             offer no extension tools (or DATANOTES_MCP_EXTENSIONS=0)
+
+
 Logs of mcp (both modes):
   --otlp-endpoint <url>       export logs over OTLP/HTTP, e.g. http://127.0.0.1:4318 (or the standard
                               OTEL_EXPORTER_OTLP_ENDPOINT, OTEL_EXPORTER_OTLP_HEADERS, OTEL_SERVICE_NAME)

package/dist/docs/reference/glossary.md

@@ -64,6 +64,10 @@ A UUID at the top of `metastore.yaml`, as `id`, that names the database. The eng
 
 The process that runs a vault as a database, `datanotes serve`. It checks and journals every write and serves the HTTP API. See [Run the engine as a service](https://datanotes.dev/administration/run-the-service/).
 
+## Extension
+
+A git repository that adds tables, views, bases, MCP tools and docs to a database. `datanotes extension install` pins and installs it. See [Install extensions](https://datanotes.dev/administration/extensions/).
+
 ## Front matter
 
 The YAML block at the top of a note, between two `---` lines. Each key of a row’s front matter holds the value of one column. See [How it works](https://datanotes.dev/start/how-it-works/).
@@ -112,6 +116,10 @@ A call the engine runs, such as `create_table`, `insert_row` or `select_rows`. E
 
 The token that can do everything, generated at the engine’s first start and kept in its settings file. See [Tokens and permissions](https://datanotes.dev/guides/security/tokens/).
 
+## Role (extension)
+
+The short name an extension’s manifest gives a table, such as `book`. The installer binds each role to a table of your database. See [Declare the tables](https://datanotes.dev/develop/write-an-extension/#declare-the-tables).
+
 ## Row
 
 A note whose front matter key `table` names a table, wherever it lives in the vault. Its front matter keys are the row’s columns. Each row has an `id` that never changes. See [Tables](https://datanotes.dev/guides/database-objects/tables/).

package/dist/docs/release-notes.md

@@ -4,6 +4,39 @@
 
 This page lists each version of Datanotes, newest first. Datanotes follows [semantic versioning](https://semver.org): a major version can break what you rely on, and its notes list those changes first. The package is on [npm](https://www.npmjs.com/package/datanotes), and each version has a [GitHub release](https://github.com/davidefornelli/datanotes/releases).
 
+## 3.3.0
+
+Datanotes 3.3.0 installs extensions: tables, views, bases and MCP tools from a git repository, pinned to a version. It only adds to 3.2: no operation, argument or setting goes away.
+
+### Extensions
+
+An extension is one git repository with a manifest, `datanotes-extension.json`. The manifest declares tables, CHECKs with hints, table instructions, views, bases, tools and the permissions the tools need. [Install extensions](https://datanotes.dev/administration/extensions/) and [Write an extension](https://datanotes.dev/develop/write-an-extension/) cover both sides.
+
+* **`datanotes extension install`**: fetches a version tag or a commit, prints a plan and asks you to confirm. Branches are refused. A plan lists the tables it creates, adopts or matches, the tools and the token. `--map`, `--create`, `--add`, `--catalog` and `--schema` carry your choices. `--dry-run` writes nothing.
+
+* **One batch**: the installer writes everything in one batch, so one `undo_migration` undoes it.
+
+* **Five more commands**:
+
+  * `update` moves an extension to a newer version.
+  * `rollback` undoes the last install or update.
+  * `remove` removes an extension and keeps its tables.
+  * `list` shows what is installed.
+  * `check` checks an extension’s repository, for its authors.
+
+* **A token for each extension**: `ext-<name>` writes only the extension’s tables and never changes the schema. The journal records it as `auth`.
+
+* **The registry**: the engine keeps the installation records in its store. Three routes serve them: `POST /datanotes/extensions/`, `/datanotes/extensions/record/` and `/datanotes/extensions/delete/`. The last two are for the owner.
+
+* **Exit codes**: 0 done, 1 error, 2 the plan has problems, 3 confirmation needed.
+
+### For MCP servers
+
+* **`datanotes mcp` loads extensions**: stdio and HTTP add the tools of every installed extension after the engine’s tools. A tool that writes is refused to a client token that may not write its tables. A restart loads a new install.
+* **`--no-extensions`**: leaves the extensions out. `DATANOTES_MCP_EXTENSIONS=0` does the same. `--profile read` keeps only their read-only tools.
+* **Docs**: `list_docs`, `read_docs` and `search_docs` serve each extension’s docs under `extensions/<name>/`.
+* **`datanotes/extensions`**: a new package subpath. It exports the manifest and module types, `defineExtension`, `ExtensionToolError` and the loader for MCP hosts. [Write an extension](https://datanotes.dev/develop/write-an-extension/#write-the-tools) shows it.
+
 ## 3.2.0
 
 Datanotes 3.2.0 keeps the links between rows of one table free of cycles. It also lets a table tell agents how to fill its rows. It only adds to 3.1: no operation, argument or setting goes away.

package/dist/docs/start/connect-agents.md

@@ -143,6 +143,17 @@ npx -y datanotes mcp serve --except undo_migration --owner-tools
 
 You can’t pass `--profile` and `--tools` together. An unknown tool name stops the command, and the error names the closest tool. A call to a tool the server doesn’t offer fails as an unknown tool. The engine still checks the token on every call, so a [named token](#give-each-agent-its-own-token) limits the agent too.
 
+## Tools of extensions
+
+An [installed extension](https://datanotes.dev/administration/extensions/) adds its own tools. `datanotes mcp` offers them after the engine’s tools, in stdio and in `serve`. The docs tools serve its docs under `extensions/<name>/`.
+
+* **After an install**: restart the MCP server, or the client that started it. A running server does not see a new extension.
+* **`--no-extensions`**: leaves the extension tools out. `DATANOTES_MCP_EXTENSIONS=0` does the same.
+* **`--profile read`**: keeps only the extensions’ tools that read.
+* **`--tools` and `--except`**: name engine and docs tools only.
+
+The engine still checks the token on every call. A tool that writes also needs a client token that may write its tables.
+
 ## Give each agent its own token
 
 A named token limits what an agent can do, and the journal records its name. It writes only the tables you allow in `write`, changes the schema only with `ddl`, and undoes changes only with `maintain`. Create one with the owner’s token: