@grepr/cli 1.10.8-29d55e4 → 1.10.8-5d73d6b

package/build/dist/docs-index/{a9c5d251-45a9-436a-bd26-3106f2ff4043.txt → 0a6b820c-907e-4bac-b323-b915954c160a.txt}

@@ -94,7 +94,7 @@ If you connect to Grepr through AWS PrivateLink, copy the private ingestion URL
 
 When you use the API, you can construct the ingestion URL using the following format:
 
-`https://<integration-id>-<org-id>.ingest.grepr.ai/otlp/<grepr-token>`
+`https://<integration-id>-<org-id>.ingest.grepr.ai/otlp`
 
 Replace `<integration-id>` with the identifier of the vendor integration used by your pipeline and replace `<org-id>` with the identifier for your organization.
 
@@ -102,7 +102,7 @@ To use the PrivateLink endpoint service, insert `.private` after the `ingest` ho
 
 Although all sources created from the same integration share the same ingestion URL, you can use a single integration to create sources for multiple pipelines. The Grepr platform ensures events are routed to the correct pipelines.
 
-Replace `<grepr-token>` with the token you saved after creating the OpenTelemetry integration in Step 1.
+Authenticate by sending the Grepr token in the `x-grepr-token` header. Replace `<grepr-token>` in the examples below with the token you saved after creating the OpenTelemetry integration in Step 1.
 
 To see more information and configuration examples, select the tab for your preferred log collector:
 
@@ -114,6 +114,8 @@ To configure the OpenTelemetry Collector to send logs to Grepr's ingestion endpo
 exporters:
   otlphttp:
     endpoint: <ingestion-url>
+    headers:
+      x-grepr-token: <grepr-token>
 
 service:
   pipelines:
@@ -123,7 +125,7 @@ service:
       exporters: [otlphttp]
 ```
 
-Replace `<ingestion-url>` with the full ingestion URL provided by the Grepr UI.
+Replace `<ingestion-url>` with the full ingestion URL provided by the Grepr UI, and `<grepr-token>` with your Grepr token.
 
 To learn more about OpenTelemetry Collector configuration, see the [OpenTelemetry Collector documentation](https://opentelemetry.io/docs/collector/).
 
@@ -131,6 +133,7 @@ Fluent Bit can forward logs to Grepr using the OpenTelemetry output plugin. To c
 
 * Set the `host` value using only the hostname of the ingestion URL from your OpenTelemetry integration, omitting the `https://` prefix and the path value.
 * Set the `logs_uri` value to the ingestion URL path and append `/v1/logs`.
+* Add a `header` entry that sends the Grepr token as `x-grepr-token`.
 
 The following is an example `OUTPUT` configuration for the OpenTelemetry plugin from a Fluent Bit configuration file (`fluent-bit.conf`):
 
@@ -140,7 +143,8 @@ The following is an example `OUTPUT` configuration for the OpenTelemetry plugin
   match                *
   host                 <integration-id>-<organization-id>.ingest.grepr.ai
   port                 443
-  logs_uri             /otlp/<grepr-token>/v1/logs
+  logs_uri             /otlp/v1/logs
+  header               x-grepr-token <grepr-token>
   tls                  On
   tls.verify           On
 ```

package/build/dist/docs-index/{4d77cfa2-ae3d-4705-b03c-dbe7f16e074b.txt → 1f416ed3-f20e-4afb-8df8-24bae41ff98b.txt}

@@ -10,13 +10,13 @@ Log Explorer's Analyze mode groups and aggregates the logs your search returns i
 2. Enter a search query to filter the logs you want to analyze. Analyze mode accepts the same [Datadog-like syntax](/queries/datadog) and [New Relic log query-like syntax](/queries/new-relic) as searching.
 3. Open the **Analyze...** drawer under the search controls.
 4. Under **SELECT**, enter one expression per result column, and name it in the **Alias** field beside it. An alias is optional; a column you leave unnamed is named for you, after the field or function it computes.
-5. Under **GROUP BY**, add the expressions whose distinct combinations you want as rows. Each one becomes a result column on its own, so it does not have to be repeated under SELECT. Without a grouping expression, an analysis made only of aggregates returns a single row.
+5. Under **GROUP BY**, add the expressions whose distinct combinations you want as rows. When you finish a new grouping expression, the builder adds a SELECT row for it and groups by that row's alias, so the expression is written once. Renaming the alias renames the grouping with it, and removing the column puts the expression back under GROUP BY. A GROUP BY row can name any SELECT alias. Without a grouping expression, an analysis made only of aggregates returns a single row.
 6. Under **HAVING**, enter a condition over the aggregates to keep only some of the groups. Leave it empty to keep every group.
 7. Under **ORDER BY**, add the expressions to sort by and pick ascending or descending for each one.
-8. Set **Row limit**, the maximum number of rows to return. An analysis returns 2,500 rows by default, and Log Explorer accepts a limit of up to 10,000 rows.
+8. Set **Row limit**, the maximum number of rows to return. An analysis returns 2,500 rows by default. The field stops at the largest limit your deployment allows, and a larger one is refused with a message naming that maximum.
 9. Set **Scan budget** to cap how much of the lake the query may read, then run the analysis.
 
-The drawer's clauses are the SQL ones, so an analysis reads the way the query does: SELECT computes, GROUP BY collapses, HAVING filters the groups, ORDER BY and the row limit choose which of them you see. HAVING and ORDER BY can refer to a result by its alias.
+The drawer's clauses are the SQL ones, so an analysis reads the way the query does: SELECT computes, GROUP BY collapses, HAVING filters the groups, ORDER BY and the row limit choose which of them you see. GROUP BY, HAVING and ORDER BY can refer to a result by its alias.
 
 ## Log fields
 
@@ -34,7 +34,13 @@ Expressions address the stored log columns by the following names:
 
 > These are the Grepr SQL column names, which use `snake_case`. They are not the camelCase field names of the log event JSON that the search and export APIs return.
 
-A tag holds an array of values, so index the value you want:
+A tag holds an array of values, so the suggestion for a tag key groups by the sorted, comma-joined set of its values — two events tagged with the same values in a different order land in one group. The suggestion shows this expression beside the key, so you can see what picking the key inserts:
+
+```sql
+ARRAY_TO_STRING(SORT_ARRAY(tags['service']), ',')
+```
+
+Index a single value with `[1]` when you want only the first:
 
 ```sql
 tags['service'][1]
@@ -72,14 +78,14 @@ A path segment is a name or a number, and the segments are separated by dots. An
 
 Expressions are Grepr SQL, so aggregates, `CASE`, `CAST` and scalar functions are all available.
 
-Every function an analysis can call is listed in the [Analyze function reference](/queries/analyze/functions), with its arguments and a worked example. Log Explorer offers the same set from the expression box: focus it and start typing, and it suggests every function, field, tag and attribute your dataset accepts.
+Every function an analysis can call is listed in the [Analyze function reference](/queries/analyze/functions), with its arguments and a worked example. Focus an expression box or start typing to find fields, functions, sampled tag and attribute keys, and result aliases. Suggestions match the text you type; they do not check whether each option fits the surrounding SQL. Typing a space closes the menu. Press the Down arrow key to open it again.
 
 > The [SQL transform function reference](/transforms/sql-transform/sql-functions) does **not** describe Analyze. A SQL transform runs inside a pipeline on Flink SQL; an analysis runs on the query engine over the data lake. The two support different functions, so a function listed there may not exist here, and the autocomplete offers functions that page does not list.
 
 ```sql
 -- Log count by service: the first line goes under SELECT, the second under GROUP BY
 COUNT(*)
-tags['service'][1]
+ARRAY_TO_STRING(SORT_ARRAY(tags['service']), ',')
 
 -- 95th percentile request duration by endpoint, the same way
 APPROX_PERCENTILE(@duration_ms, 0.95)
@@ -101,16 +107,17 @@ SEVERITY_TEXT(severity)
 
 ## Name the results
 
-Every SELECT column and every GROUP BY expression takes an optional alias, entered in the **Alias** field beside the expression. The alias becomes the result column's name. Leave it empty and Grepr names the column after the field or function the expression computes:
+Every SELECT column takes an optional alias, entered in the **Alias** field beside the expression. The alias becomes the result column's name. Pick a tag from the suggestions and the alias is filled in with the tag's own key, since the expression that reads a tag is a call wrapped around it. Leave the alias empty and Grepr names the column after the expression itself:
 
-| Expression | Alias you enter | Result column |
+| Expression | Alias | Result column |
 | --- | --- | --- |
 | `COUNT(*)` | empty | `count0` |
 | `APPROX_PERCENTILE(@duration_ms, 0.95)` | `p95` | `p95` |
-| `tags['service'][1]` | empty | `service` |
+| `ARRAY_TO_STRING(SORT_ARRAY(tags['service']), ',')` | `service`, filled in for you | `service` |
+| `severity` | empty | `severity` |
 | `@http.route` | `route` | `route` |
 
-An alias can then be referred to under HAVING or ORDER BY, anywhere inside that expression rather than only as the whole of it:
+An alias can then be referred to under GROUP BY, HAVING or ORDER BY, anywhere inside that expression rather than only as the whole of it:
 
 ```sql
 -- Under HAVING
@@ -122,7 +129,7 @@ p95 / 1000
 
 Aliases are lowercase, made of letters, digits and underscores, up to 128 characters, and a reference has to match exactly.
 
-> The alias goes in its own field, not in the expression: writing `AS p95` inside an expression is rejected. An alias is available to HAVING and ORDER BY, not to the other SELECT columns.
+> The alias goes in its own field, not in the expression: writing `AS p95` inside an expression is rejected. An alias is available to GROUP BY, HAVING and ORDER BY, and to the SELECT columns after the one that defines it.
 
 Reserved SQL words cannot be aliases, because the query engine would read them as syntax. Log Explorer refuses one and suggests an alternative, which is why the default first column is `count0` rather than `count`. The same rule applies to an alias Grepr derives for you: a derived name that lands on a reserved word gains a `0`.
 
@@ -130,7 +137,7 @@ Reserved SQL words cannot be aliases, because the query engine would read them a
 
 ## Window by time
 
-To see how an aggregate changes over time, add a time window under the grouping expressions. Every result row then carries a `window_start` and a `window_end` column, and the other grouping keys and aggregates are computed per window. Sort by `window_start` to read the results in time order.
+To see how an aggregate changes over time, add a time window under the grouping expressions. Every result row then carries a `window_start` and a `window_end` column, and the other grouping keys and aggregates are computed per window. The analysis is sorted by `window_start` descending, so the newest window leads.
 
 | Kind | Meaning |
 | --- | --- |
@@ -141,7 +148,7 @@ Each duration is a whole number of milliseconds, seconds, minutes, hours, or day
 
 Windows are aligned to the clock rather than to the start of your time range, so the first and last windows of a range can be partial.
 
-Setting a window puts `window_start` and `window_end` first among the result columns and sorts the analysis by `window_start` ascending, so the rows read in time order without any further setup. Both are yours to change: drag the columns elsewhere, or edit the sort. Removing the window removes the bound columns and drops the sorts that referred to them.
+Setting a window puts `window_start` and `window_end` first among the result columns and sorts the analysis by `window_start` descending, so the newest window leads without any further setup. Both are yours to change: drag the columns elsewhere, or edit the sort. Removing the window removes the bound columns and drops the sorts that referred to them.
 
 In the API, the window is the `window` object of the structured analytics query, with ISO-8601 durations:
 
@@ -161,7 +168,7 @@ Drag a header by its handle to move a column. From the keyboard, focus the handl
 
 ## Share an analysis
 
-The whole analysis lives in the page URL, so copying the link from the address bar is enough to share it. The link carries the dataset, the time range, the search query, every SELECT and GROUP BY expression with its alias, the HAVING condition, the sort, the time window, the row limit, the scan budget and the column order you arranged.
+The whole analysis lives in the page URL, so copying the link from the address bar is enough to share it. The link carries the dataset, the time range, the search query, every SELECT expression and its alias, every GROUP BY expression, the HAVING condition, the sort, the time window, the row limit, the scan budget and the column order you arranged.
 
 Opening such a link seats every control and runs the analysis once, so the recipient sees the rows rather than a filled-in form waiting for a click. Back and Forward move between analyses you have already run, restoring the controls without re-running and spending scan budget again.
 
@@ -190,7 +197,7 @@ Go to Log Explorer, select a dataset and time range, enter a search query, then
 
 ### What are the log field names in Grepr SQL?
 
-message, severity, event_timestamp, received_timestamp, id, tags, and attributes. Index a tag as tags\['service']\[1], and address an attribute as @http.status_code.
+message, severity, event_timestamp, received_timestamp, id, tags, and attributes. Read the whole set of a tag's values as ARRAY_TO_STRING(SORT_ARRAY(tags\['service']), ','), index a single value as tags\['service']\[1], and address an attribute as @http.status_code.
 
 ### How do I bucket an analysis by time?
 
@@ -198,7 +205,7 @@ Add a time window under the grouping expressions in Analyze mode. Choose tumblin
 
 ### How many rows can an analysis return?
 
-An analysis returns 2,500 rows by default. Log Explorer accepts a limit of up to 10,000 rows.
+An analysis returns 2,500 rows by default. The largest limit you can ask for is set by your deployment; asking for more is refused with a message naming the maximum.
 
 ### How do I share a Grepr analysis?
 

package/build/dist/docs-index/{de815c31-4224-4d05-9114-92b02a49f217.txt → 4b721c4f-2ddb-4b01-9769-4216e6f628ad.txt}

@@ -82,7 +82,7 @@ If you connect to Grepr through AWS PrivateLink, copy the private ingestion URL
 
 When you use the API, you can construct the ingestion URL using the following format:
 
-`https://<integration-id>-<org-id>.ingest.grepr.ai/otlp/<grepr-token>`
+`https://<integration-id>-<org-id>.ingest.grepr.ai/otlp`
 
 Replace `<integration-id>` with the identifier of the vendor integration used by your pipeline and replace `<org-id>` with the identifier for your organization.
 
@@ -90,9 +90,9 @@ To use the PrivateLink endpoint service, insert `.private` after the `ingest` ho
 
 Although all sources created from the same integration share the same ingestion URL, you can use a single integration to create sources for multiple pipelines. The Grepr platform ensures events are routed to the correct pipelines.
 
-Replace `<grepr-token>` with the token generated when you created the OpenTelemetry integration in Step 1. The token is part of the ingestion URL rather than a separate credential, so a collector or agent that sends to this URL needs no authentication header.
+Authenticate by sending the Grepr token in the `x-grepr-token` header. Replace `<grepr-token>` in the examples below with the token generated when you created the OpenTelemetry integration in Step 1. Every sender in the tabs below can set a custom header.
 
-Some senders take the ingestion URL as it is and append the path for each signal themselves. Others need the full path for one signal. For example, if your ingestion URL is `https://YWNQbQSarRBsa-<org-id>.ingest.grepr.ai/otlp/uUasjYpMJdpQZ9cNlLEtthuXNRp6n3ND_xND80PVXNk=`, then the endpoint for log events is that URL followed by `/v1/logs`, and the endpoint for spans is the same URL followed by `/v1/traces`. Each tab below states which form its sender expects.
+Some senders take the ingestion URL as it is and append the path for each signal themselves. Others need the full path for one signal. For example, if your ingestion URL is `https://YWNQbQSarRBsa-<org-id>.ingest.grepr.ai/otlp`, then the endpoint for log events is that URL followed by `/v1/logs`, and the endpoint for spans is the same URL followed by `/v1/traces`. Each tab below states which form its sender expects.
 
 To see configuration examples for sending data to Grepr, select the tab for your collector or coding agent:
 
@@ -102,6 +102,8 @@ The OpenTelemetry Collector can send logs to Grepr using the `otlphttp` exporter
 exporters:
   otlphttp:
     endpoint: <ingestion-url>
+    headers:
+      x-grepr-token: <grepr-token>
 
 service:
   pipelines:
@@ -111,7 +113,10 @@ service:
       exporters: [otlphttp]
 ```
 
-Replace `<ingestion-url>` with the ingestion URL from your OpenTelemetry integration.
+Replace:
+
+* `<ingestion-url>` with the ingestion URL from your OpenTelemetry integration.
+* `<grepr-token>` with the token from your OpenTelemetry integration.
 
 For dual shipping, you need to create two exporters: one to send logs to Grepr, and another to send logs directly to your vendor's platform. Your exporter for Grepr only includes Grepr's ingestion endpoint, with any needed headers configured in the Grepr UI. Your exporter for the vendor's platform includes the vendor's endpoint and the necessary headers.
 
@@ -119,6 +124,8 @@ For dual shipping, you need to create two exporters: one to send logs to Grepr,
 exporters:
   otlphttp/grepr:
     endpoint: <ingestion-url>
+    headers:
+      x-grepr-token: <grepr-token>
 
   otlphttp/vendor:
     endpoint: <vendor-otlp-endpoint>
@@ -136,6 +143,7 @@ service:
 Replace:
 
 * `<ingestion-url>` with the ingestion URL from your OpenTelemetry integration.
+* `<grepr-token>` with the token from your OpenTelemetry integration.
 * `<vendor-otlp-endpoint>` with your vendor's OTLP/HTTP endpoint URL.
 * `<vendor-token>` with your vendor's authentication token.
 
@@ -147,6 +155,8 @@ Similar to log forwarding, the OpenTelemetry Collector can send APM events to Gr
 exporters:
   otlphttp:
     endpoint: <ingestion-url>
+    headers:
+      x-grepr-token: <grepr-token>
 
 service:
   pipelines:
@@ -160,14 +170,18 @@ service:
       exporters: [otlphttp]
 ```
 
-Replace `<ingestion-url>` with the ingestion URL from your OpenTelemetry integration.
+Replace:
+
+* `<ingestion-url>` with the ingestion URL from your OpenTelemetry integration.
+* `<grepr-token>` with the token from your OpenTelemetry integration.
 
 Fluent Bit can forward logs to Grepr using the OpenTelemetry output plugin. To configure the plugin:
 
 * Set the `host` value using only the hostname of the ingestion URL from your OpenTelemetry integration, omitting the `https://` prefix and the path value.
 * Set the `logs_uri` value to the ingestion URL path and append `/v1/logs`.
+* Add a `header` entry that sends the Grepr token as `x-grepr-token`.
 
-For example, if your ingestion URL is `https://YWNQbQSarRBsa-<org-id>.ingest.grepr.ai/otlp/uUasjYpMJdpQZ9cNlLEtthuXNRp6n3ND_xND80PVXNk=`, set the `host` value to `YWNQbQSarRBsa-<org-id>.ingest.grepr.ai` and the `logs_uri` value to `/otlp/uUasjYpMJdpQZ9cNlLEtthuXNRp6n3ND_xND80PVXNk=/v1/logs`. The following is an example `OUTPUT` configuration for the OpenTelemetry plugin from a Fluent Bit configuration file (`fluent-bit.conf`):
+For example, if your ingestion URL is `https://YWNQbQSarRBsa-<org-id>.ingest.grepr.ai/otlp`, set the `host` value to `YWNQbQSarRBsa-<org-id>.ingest.grepr.ai` and the `logs_uri` value to `/otlp/v1/logs`. The following is an example `OUTPUT` configuration for the OpenTelemetry plugin from a Fluent Bit configuration file (`fluent-bit.conf`):
 
 ```fluent
 [OUTPUT]
@@ -175,7 +189,8 @@ For example, if your ingestion URL is `https://YWNQbQSarRBsa-<org-id>.ingest.gre
   match                *
   host                 <integration-id>-<organization-id>.ingest.grepr.ai
   port                 443
-  logs_uri             /otlp/<grepr-token>/v1/logs
+  logs_uri             /otlp/v1/logs
+  header               x-grepr-token <grepr-token>
   tls                  On
   tls.verify           On
 ```
@@ -189,6 +204,7 @@ Claude Code exports its own telemetry over OTLP. It reports prompts, assistant r
 * `OTEL_LOG_USER_PROMPTS`, `OTEL_LOG_ASSISTANT_RESPONSES`, and `OTEL_LOG_TOOL_DETAILS` record prompt text, response text, and tool arguments. Without them, Claude Code redacts the content and a transcript shows metadata only.
 * `OTEL_LOG_TOOL_CONTENT` records what each tool returned. Claude Code reports tool output only on a span event, so this setting requires spans.
 * `OTEL_EXPORTER_OTLP_LOGS_ENDPOINT` and `OTEL_EXPORTER_OTLP_TRACES_ENDPOINT` each take the full path for their signal, so append `/v1/logs` and `/v1/traces` to the ingestion URL.
+* `OTEL_EXPORTER_OTLP_HEADERS` carries the Grepr token and applies to both signals.
 * `OTEL_METRICS_EXPORTER` is set to `none` because an agent sessions pipeline reads logs and traces only.
 
 The following example exports the settings and then starts Claude Code:
@@ -203,6 +219,7 @@ export OTEL_EXPORTER_OTLP_LOGS_PROTOCOL=http/protobuf
 export OTEL_EXPORTER_OTLP_TRACES_PROTOCOL=http/protobuf
 export OTEL_EXPORTER_OTLP_LOGS_ENDPOINT=<ingestion-url>/v1/logs
 export OTEL_EXPORTER_OTLP_TRACES_ENDPOINT=<ingestion-url>/v1/traces
+export OTEL_EXPORTER_OTLP_HEADERS="x-grepr-token=<grepr-token>"
 export OTEL_LOG_USER_PROMPTS=1
 export OTEL_LOG_ASSISTANT_RESPONSES=1
 export OTEL_LOG_TOOL_DETAILS=1
@@ -211,7 +228,10 @@ export OTEL_LOG_TOOL_CONTENT=1
 claude
 ```
 
-Replace `<ingestion-url>` with the ingestion URL from your OpenTelemetry integration.
+Replace:
+
+* `<ingestion-url>` with the ingestion URL from your OpenTelemetry integration.
+* `<grepr-token>` with the token from your OpenTelemetry integration.
 
 > Claude Code truncates prompts, responses, and tool content at 60 KB. Grepr labels shortened content as a truncated capture in the transcript. To raise the limit, set `CLAUDE_CODE_OTEL_CONTENT_MAX_LENGTH` to a larger value.
 
@@ -238,13 +258,18 @@ metrics_exporter = "none"
 [otel.exporter.otlp-http]
 endpoint = "<ingestion-url>/v1/logs"
 protocol = "binary"
+headers = { "x-grepr-token" = "<grepr-token>" }
 
 [otel.trace_exporter.otlp-http]
 endpoint = "<ingestion-url>/v1/traces"
 protocol = "binary"
+headers = { "x-grepr-token" = "<grepr-token>" }
 ```
 
-Replace `<ingestion-url>` with the ingestion URL from your OpenTelemetry integration.
+Replace:
+
+* `<ingestion-url>` with the ingestion URL from your OpenTelemetry integration.
+* `<grepr-token>` with the token from your OpenTelemetry integration.
 
 > Codex reports a different service name for each of its binaries, `codex_exec` when you run `codex exec` and `codex_cli_rs` when you run the interactive CLI. Grepr recognizes both, so sessions from either binary appear together.
 
@@ -257,6 +282,7 @@ OpenCode reports agent activity through an OpenTelemetry plugin, which exports p
 * The `plugin` array in your OpenCode configuration loads `@devtheops/opencode-plugin-otel`. Pin the version so a later release cannot change what the plugin reports.
 * `OPENCODE_ENABLE_TELEMETRY` turns on the plugin's export and is required.
 * `OPENCODE_OTLP_ENDPOINT` is the ingestion URL without a signal path. The plugin appends the path itself.
+* `OPENCODE_OTLP_HEADERS` carries the Grepr token as a comma-separated list of `key=value` pairs.
 * `OPENCODE_DISABLE_LOGS` stops the plugin exporting log records. The plugin reports a whole session on spans, so its log records are not part of an agent session.
 * Leave the standard `OTEL_` variables unset. They turn on OpenCode's built-in instrumentation, which reports internal runtime operations such as `sql.execute` rather than agent activity.
 
@@ -271,13 +297,17 @@ JSON
 
 export OPENCODE_ENABLE_TELEMETRY=1
 export OPENCODE_OTLP_ENDPOINT=<ingestion-url>
+export OPENCODE_OTLP_HEADERS="x-grepr-token=<grepr-token>"
 export OPENCODE_OTLP_PROTOCOL=http/protobuf
 export OPENCODE_DISABLE_LOGS=1
 
 opencode
 ```
 
-Replace `<ingestion-url>` with the ingestion URL from your OpenTelemetry integration.
+Replace:
+
+* `<ingestion-url>` with the ingestion URL from your OpenTelemetry integration.
+* `<grepr-token>` with the token from your OpenTelemetry integration.
 
 > The plugin also exports metrics, which an agent sessions pipeline does not read. To stop exporting them, set `OPENCODE_DISABLE_METRICS` to a comma-separated list of the metric names you want to disable. The setting matches each name exactly and has no single value that disables all of them.
 
@@ -352,16 +382,17 @@ Grepr validates all headers you configure on an OpenTelemetry integration for po
 * Always use secret headers for sensitive information like API keys, tokens, or passwords.
 * Ensure endpoint URLs use HTTPS for secure data transmission.
 * Avoid using reserved headers. Some HTTP headers are reserved and cannot be set for security reasons.
+* Send the Grepr token in the `x-grepr-token` header rather than in the ingestion URL. Proxies, load balancers, and request logs commonly record full URLs, so a token in a URL can be retained well outside your control.
 
 ## Frequently Asked Questions
 
 ### How do I create an OpenTelemetry integration with Grepr?
 
-In the Grepr UI, go to Integrations and click Add new. Select OpenTelemetry, enter a name, and provide the URL for your vendor's OTLP/HTTP endpoint. Optionally add HTTP headers for authentication. After creation, Grepr generates a token that you must include in your collector configuration at the ingestion endpoint.
+In the Grepr UI, go to Integrations and click Add new. Select OpenTelemetry, enter a name, and provide the URL for your vendor's OTLP/HTTP endpoint. Optionally add HTTP headers for authentication. After creation, Grepr generates a token that your collector must send in the x-grepr-token header to the ingestion endpoint.
 
 ### What is the purpose of the Grepr token in OpenTelemetry integrations?
 
-The Grepr token is automatically generated during OpenTelemetry integration creation and is required for authentication. It ensures that only authorized collectors can send data to your Grepr pipeline. The token must be appended to the ingestion URL in the format: https\://\<integration-id>-\<org-id>.ingest.grepr.ai/otlp/\<grepr-token>
+The Grepr token is automatically generated during OpenTelemetry integration creation and is required for authentication. It ensures that only authorized collectors can send data to your Grepr pipeline. Send it in the x-grepr-token header on requests to your ingestion URL, https\://\<integration-id>-\<org-id>.ingest.grepr.ai/otlp.
 
 ### Can I use OpenTelemetry integration with any observability vendor?
 
@@ -369,7 +400,7 @@ Yes, the OpenTelemetry integration works with any vendor that accepts the OpenTe
 
 ### How do I configure the OpenTelemetry Collector to send logs to Grepr?
 
-Configure the otlphttp exporter in your collector.yaml with the Grepr ingestion endpoint. Set the endpoint to https\://\<integration-id>-\<org-id>.ingest.grepr.ai/otlp/\<grepr-token>. Add the exporter to your logs pipeline along with your receivers and processors.
+Configure the otlphttp exporter in your collector.yaml with the Grepr ingestion endpoint. Set the endpoint to https\://\<integration-id>-\<org-id>.ingest.grepr.ai/otlp and add a headers entry setting x-grepr-token to your Grepr token. Add the exporter to your logs pipeline along with your receivers and processors.
 
 ### How do I send traces to Grepr with an OpenTelemetry integration?
 

package/build/dist/docs-index/4d3e7c7b-356f-4724-991e-ee4e302e03ca.txt

@@ -0,0 +1,16 @@
+# AnalyticsDraftRequest
+
+**Type**: `object`
+
+## Properties
+
+- name: datasetId (optional)
+  type: string
+  description: Dataset the query reads. Supplying it checks the scan budget against that dataset's ceiling and requires VIEW permission on it.
+
+- name: query (required)
+  type: `StructuredAnalyticsQuery`
+
+- name: scanBudgetBytes (required)
+  type: integer
+  description: Bytes the run may scan, checked against the organization's ceiling. Zero stands for a budget field left empty and is reported as a diagnostic.

package/build/dist/docs-index/{077ee6c3-be1f-4967-9fa3-c402a779d426.txt → 4d6a2ae1-c9c7-4f47-80fa-46cb4362dbc6.txt}

@@ -10,6 +10,10 @@
 - name: functions (required)
   type: array of `AnalyticsFunction`
 
+- name: maxRowLimit (required)
+  type: integer
+  description: Largest number of result rows an analytics query may ask for. A builder uses it to bound its input; the server refuses a larger request whether or not the caller did.
+
 - name: maxScanBudgetBytes (optional)
   type: integer
   description: Largest scan budget, in bytes, an Athena analytics query over this dataset may request. Absent when no ceiling applies. Queries routed to a Trino query engine are not subject to it.

package/build/dist/docs-index/{c752bcf4-f267-44f9-aab4-4896a4801f38.txt → 4ff0316b-37bf-4d14-8f50-cf1271b4c1f4.txt}

@@ -1,7 +1,5 @@
 # AnalyticsProjection
 
-Expressions returned by the query.
-
 **Type**: `object`
 
 ## Properties

package/build/dist/docs-index/8d08b712-b6e1-4afd-aaaf-2d9163ca193e.txt

@@ -0,0 +1,15 @@
+# AnalyticsDiagnostic
+
+Request constraints, followed by the first SQL failure when the request is complete, at most one per field. Empty means no draft errors were found; execution still validates the query against its actual table and engine.
+
+**Type**: `object`
+
+## Properties
+
+- name: message (required)
+  type: string
+  description: What is wrong, as a finished sentence to show the person editing the query.
+
+- name: path (required)
+  type: string
+  description: Where the rule was broken, as a path into the request: 'select', 'select[1].expression', 'select[1].alias', 'groupBy[0]', 'window.size', 'window.slide', 'having', 'orderBy[2].expression', 'limit', 'scanBudgetBytes', 'predicate', or 'query' for a failure that names no single item.