@grepr/cli 1.10.8-5d73d6b → 1.10.8-692ca41

package/build/dist/docs-index/3b0e00a9-2221-42c1-85ad-042c89073ea3.txt

@@ -0,0 +1,33 @@
+# Get a vendor estimation run
+
+**GET** `/v1/integrations/{integrationId}/exceptions/vendor-estimation-runs/{runId}`
+
+**Operation ID**: `getVendorEstimationRun`
+**Summary**: Get a vendor estimation run
+Returns the run's current state and progress. Poll this while the run is non-terminal; results land incrementally and are readable throughout.
+
+## Tags
+- Integration Exceptions
+## Parameters
+
+- **integrationId** (required) - path
+  - Integration id
+  - Type: string
+- **runId** (required) - path
+  - Run id
+  - Type: string
+
+## Responses
+
+### 200
+
+Run retrieved
+
+- **Content-Type**: `application/json` / `VendorEstimationRun`
+### 401
+
+Unauthorized
+
+### 404
+
+Not Found - Integration or run not found.

package/build/dist/docs-index/452eabba-e2c5-468a-90ad-487920919cee.txt

@@ -0,0 +1,10 @@
+# VendorEstimatePending
+
+This exception is in the run but has not been counted yet.
+
+**Type**: `object`
+
+## Properties
+
+- name: type (required)
+  type: enum: `PENDING`

package/build/dist/docs-index/490b2496-ded2-47bb-932b-7d53ab119509.txt

@@ -0,0 +1,26 @@
+# VendorEstimate
+
+What a run says about one exception. The type field selects the variant.
+
+**Type**: `object`
+
+## One Of
+
+This schema accepts one of the following types:
+
+### Option 1
+`VendorEstimateCounted`
+
+### Option 2
+`VendorEstimatePending`
+
+### Option 3
+`VendorEstimateUnparseable`
+
+### Option 4
+`VendorEstimateError`
+
+## Properties
+
+- name: type (required)
+  type: string

package/build/dist/docs-index/5085e4d9-fed6-49ab-865b-ec768990fcdd.txt

@@ -0,0 +1,15 @@
+# UnparseableException
+
+Exceptions whose query could not be parsed at import and so cannot be counted, each with the parse error
+
+**Type**: `object`
+
+## Properties
+
+- name: exceptionId (required)
+  type: string
+  description: Composite exception id
+
+- name: message (required)
+  type: string
+  description: The parse error recorded when the exception was imported

package/build/dist/docs-index/56b9cc56-476e-40df-bdf2-6f95ce0687c2.txt

@@ -0,0 +1,44 @@
+# Start a vendor estimation run
+
+**POST** `/v1/integrations/{integrationId}/exceptions/vendor-estimation-runs`
+
+**Operation ID**: `createVendorEstimationRun`
+**Summary**: Start a vendor estimation run
+Creates a run over the given scope and window covering every exception the integration has imported, with one result row per distinct predicate, and queues its first slice. One non-terminal run per organization: starting a second returns 409 while the first is still in flight.
+
+## Tags
+- Integration Exceptions
+## Parameters
+
+- **integrationId** (required) - path
+  - Integration id
+  - Type: string
+
+## Request Body
+
+**Content-Type**: `application/json`
+
+**Schema**: `CreateVendorEstimationRunRequest`
+
+## Responses
+
+### 201
+
+Run created
+
+- **Content-Type**: `application/json` / `VendorEstimationRun`
+### 400
+
+Bad Request - Window is inverted or scope is invalid.
+
+### 401
+
+Unauthorized
+
+### 404
+
+Not Found - Integration not found.
+
+### 409
+
+Conflict - The organization already has a run that has not finished.

package/build/dist/docs-index/61fb254e-1059-429c-bf92-e34c42dfaf55.txt

@@ -0,0 +1,33 @@
+# Get vendor estimation results for a run
+
+**GET** `/v1/integrations/{integrationId}/exceptions/vendor-estimation-runs/{runId}/results`
+
+**Operation ID**: `getVendorEstimationRunResults`
+**Summary**: Get vendor estimation results for a run
+Returns the run's per-exception estimates keyed by composite exception id. Each entry is one of four variants selected by its type field, because an estimate can be pending, unparseable or failed as well as counted. An exception missing from the response was not in this run, which is not the same as matching nothing.
+
+## Tags
+- Integration Exceptions
+## Parameters
+
+- **integrationId** (required) - path
+  - Integration id
+  - Type: string
+- **runId** (required) - path
+  - Run id
+  - Type: string
+
+## Responses
+
+### 200
+
+Results retrieved
+
+- **Content-Type**: `application/json` / object
+### 401
+
+Unauthorized
+
+### 404
+
+Not Found - Integration or run not found.

package/build/dist/docs-index/{1f416ed3-f20e-4afb-8df8-24bae41ff98b.txt → 635ba807-f17e-4f53-8f93-e1981bb04d18.txt}

@@ -158,17 +158,13 @@ In the API, the window is the `window` object of the structured analytics query,
 
 ## Read the results table
 
-The results table sorts and arranges itself, and both are part of the analysis rather than a local view setting.
+Click a column header to sort the rows you already have. No second run happens and no scan budget is spent; Shift-click adds a second sort instead of replacing the first.
 
-Click a column header to sort by that column. Each click cycles it through descending, ascending and unsorted, and the header shows which way it is sorting. Shift-click a second header to sort by it as well instead of replacing the first sort; headers then carry a number showing which sort takes priority. Clicking a header edits the sort expressions in the builder, so the two never disagree.
-
-A sort takes effect on the next run, because the query engine does the sorting. Until then the table says the sort no longer matches the rows it is showing.
-
-Drag a header by its handle to move a column. From the keyboard, focus the handle, press Space to pick the column up, move it with the arrow keys, and press Space again to drop it. The order you arrange survives a re-run, a new column appears without disturbing it, and the CSV download follows the order you see rather than the order the query returned.
+When an analysis comes back at its row limit, the rows you have are only the top of the ranking, so sorting them on the page can put the wrong rows first. The table says so and offers **Sort on the server**, which puts the sort into ORDER BY and runs the analysis again so the engine ranks every matching row.
 
 ## Share an analysis
 
-The whole analysis lives in the page URL, so copying the link from the address bar is enough to share it. The link carries the dataset, the time range, the search query, every SELECT expression and its alias, every GROUP BY expression, the HAVING condition, the sort, the time window, the row limit, the scan budget and the column order you arranged.
+The whole analysis lives in the page URL, so copying the link from the address bar is enough to share it. The link carries the dataset, the time range, the search query, every SELECT expression and its alias, every GROUP BY expression, the HAVING condition, the ORDER BY, the time window, the row limit, the scan budget, and the way you arranged the results table — its column order, column widths and sort.
 
 Opening such a link seats every control and runs the analysis once, so the recipient sees the rows rather than a filled-in form waiting for a click. Back and Forward move between analyses you have already run, restoring the controls without re-running and spending scan budget again.
 
@@ -183,7 +179,7 @@ Each result row is a JSON object keyed by column name, so a column holds whateve
 * An analysis reads one dataset at a time. Joins across datasets are not supported.
 * Sorting by an attribute that you have not cast sorts it by its stored text, so `100` sorts before `99`. Cast the attribute to sort numerically, as in `CAST(@http.status_code AS BIGINT)`.
 * A result alias cannot be a reserved SQL word, and a reference to one has to match its lowercase spelling exactly.
-* A sort you set from the result headers applies on the next run, since the query engine sorts the rows.
+* A sort you set from the result headers sorts the rows already on the page. When the analysis returned its row limit, use **Sort on the server** to rank every matching row instead.
 * An analysis too long to fit in the address bar cannot be shared as a link.
 * An analysis can compute at most 128 values, group by at most 64 expressions, and sort by at most 64 expressions. Each expression can be at most 4,096 characters long.
 * A time window's size and slide are whole milliseconds, and a sliding window covers at most 100 slides. `window_start` and `window_end` cannot be used as result aliases while a window is set.
@@ -209,7 +205,7 @@ An analysis returns 2,500 rows by default. The largest limit you can ask for is
 
 ### How do I share a Grepr analysis?
 
-Copy the page URL. The link carries the dataset, time range, query, every expression and alias, the window, the row limit, the scan budget and the column order, and opening it runs the analysis once.
+Copy the page URL. The link carries the dataset, time range, query, every expression and alias, the window, the row limit, the scan budget and the column order, widths and sort, and opening it runs the analysis once.
 
 ### Why can't I name a result column count?
 
@@ -221,4 +217,4 @@ Use SEVERITY_TEXT(severity), which names the OpenTelemetry bucket: TRACE, DEBUG,
 
 ### How do I sort an analysis by a result column?
 
-Click the column header in the results table. Each click cycles descending, ascending and unsorted, and Shift-click adds a second column to the sort. The sort applies on the next run.
+Click the column header in the results table. The rows on the page reorder immediately, without a second run. If the analysis returned its row limit, the table offers Sort on the server, which puts the sort into ORDER BY and runs the analysis again.

package/build/dist/docs-index/6c79bdeb-67c9-4529-b4a0-f2dd332210c6.txt

@@ -0,0 +1,33 @@
+# Stop a vendor estimation run
+
+**DELETE** `/v1/integrations/{integrationId}/exceptions/vendor-estimation-runs/{runId}`
+
+**Operation ID**: `stopVendorEstimationRun`
+**Summary**: Stop a vendor estimation run
+Stops the run and keeps every count it has already made. The run ends partial, with a stop reason recording that a person stopped it. No rows are deleted; calling this on a run that has already finished is a no-op.
+
+## Tags
+- Integration Exceptions
+## Parameters
+
+- **integrationId** (required) - path
+  - Integration id
+  - Type: string
+- **runId** (required) - path
+  - Run id
+  - Type: string
+
+## Responses
+
+### 200
+
+Run stopped
+
+- **Content-Type**: `application/json` / `VendorEstimationRun`
+### 401
+
+Unauthorized
+
+### 404
+
+Not Found - Integration or run not found.

package/build/dist/docs-index/8432959c-2130-403e-8f0f-af319af276e9.txt

@@ -0,0 +1,40 @@
+# Preview a vendor estimation run
+
+**POST** `/v1/integrations/{integrationId}/exceptions/vendor-estimation-runs/preview`
+
+**Operation ID**: `previewVendorEstimationRun`
+**Summary**: Preview a vendor estimation run
+Classifies the exceptions a run would cover — every one the integration has imported — and returns how many distinct queries it would send to the vendor and which exceptions cannot be counted because their query never parsed. Writes nothing.
+
+## Tags
+- Integration Exceptions
+## Parameters
+
+- **integrationId** (required) - path
+  - Integration id
+  - Type: string
+
+## Request Body
+
+**Content-Type**: `application/json`
+
+**Schema**: `CreateVendorEstimationRunRequest`
+
+## Responses
+
+### 200
+
+Preview computed
+
+- **Content-Type**: `application/json` / `VendorEstimationRunPreview`
+### 400
+
+Bad Request - Window is inverted or scope is invalid.
+
+### 401
+
+Unauthorized
+
+### 404
+
+Not Found - Integration not found.

package/build/dist/docs-index/85006286-895e-4c76-b094-4f967256ebda.txt

@@ -0,0 +1,14 @@
+# VendorEstimateUnparseable
+
+The exception's query could not be parsed, so it was never counted.
+
+**Type**: `object`
+
+## Properties
+
+- name: message (required)
+  type: string
+  description: The parse error recorded when the exception was imported
+
+- name: type (required)
+  type: enum: `UNPARSEABLE`

package/build/dist/docs-index/875bdaee-bd87-448f-9fa6-33ebb13ebd5a.txt

@@ -0,0 +1,37 @@
+# Resume a stalled vendor estimation run
+
+**POST** `/v1/integrations/{integrationId}/exceptions/vendor-estimation-runs/{runId}/resume`
+
+**Operation ID**: `resumeVendorEstimationRun`
+**Summary**: Resume a stalled vendor estimation run
+Triggers another slice for a run that has been running without progress for longer than the configured stale threshold. Returns 409 for a run that is progressing normally, parked on a rate limit, or already finished.
+
+## Tags
+- Integration Exceptions
+## Parameters
+
+- **integrationId** (required) - path
+  - Integration id
+  - Type: string
+- **runId** (required) - path
+  - Run id
+  - Type: string
+
+## Responses
+
+### 200
+
+Slice triggered
+
+- **Content-Type**: `application/json` / `VendorEstimationRun`
+### 401
+
+Unauthorized
+
+### 404
+
+Not Found - Integration or run not found.
+
+### 409
+
+Conflict - The run is not eligible to be resumed.

package/build/dist/docs-index/8803c207-a0b7-4cf3-a609-c733e810f3a4.txt

@@ -0,0 +1,33 @@
+# List vendor estimation runs for an integration
+
+**GET** `/v1/integrations/{integrationId}/exceptions/vendor-estimation-runs`
+
+**Operation ID**: `listVendorEstimationRuns`
+**Summary**: List vendor estimation runs for an integration
+Returns the integration's estimation runs newest first, including failed and stopped ones. Scope and window identify a run: numbers from runs over different scopes or windows are not comparable.
+
+## Tags
+- Integration Exceptions
+## Parameters
+
+- **integrationId** (required) - path
+  - Integration id
+  - Type: string
+- **limit** (optional) - query
+  - Maximum runs to return
+  - Type: integer
+
+## Responses
+
+### 200
+
+Runs retrieved
+
+- **Content-Type**: `application/json` / array of `VendorEstimationRun`
+### 401
+
+Unauthorized
+
+### 404
+
+Not Found - Integration not found.

package/build/dist/docs-index/a708bc15-6649-4cd3-99f4-33f32426b74b.txt

@@ -0,0 +1,17 @@
+# CreateVendorEstimationRunRequest
+
+**Type**: `object`
+
+## Properties
+
+- name: scopeQuery (optional)
+  type: string
+  description: Vendor query limiting the estimate to part of the customer's traffic. Applied to both the matched count and the total. Leave empty for all logs.
+
+- name: windowEnd (required)
+  type: string
+  description: Absolute end of the window to count over; must be after the start
+
+- name: windowStart (required)
+  type: string
+  description: Absolute start of the window to count over

package/build/dist/docs-index/b5a7996b-abea-4963-9d75-00b56eec0ca6.txt

@@ -0,0 +1,14 @@
+# VendorEstimateError
+
+The count was attempted for this exception and failed.
+
+**Type**: `object`
+
+## Properties
+
+- name: message (required)
+  type: string
+  description: The vendor's rejection, or the failure the call ended on
+
+- name: type (required)
+  type: enum: `ERROR`

package/build/dist/docs-index/c63180ed-5254-4e9c-86a5-e9a5e2971ced.txt

@@ -0,0 +1,73 @@
+# VendorEstimationRun
+
+**Type**: `object`
+
+## Properties
+
+- name: createdAt (required)
+  type: string
+  description: When the run was created
+
+- name: failureReason (optional)
+  type: string
+  description: Why a FAILED run failed
+
+- name: id (required)
+  type: string
+  description: Run id
+
+- name: integrationId (required)
+  type: string
+  description: Integration whose imported exceptions this run estimates
+
+- name: predicatesDone (required)
+  type: integer
+  description: Predicates that have reached a non-pending status
+
+- name: predicatesTotal (required)
+  type: integer
+  description: Distinct predicates in the run, fixed at creation
+
+- name: queuedAhead (optional)
+  type: integer
+  description: Number of older runs still waiting for an active slot ahead of this one. Present only while the run is QUEUED.
+
+- name: requestedBy (optional)
+  type: string
+  description: Id of the user who started the run
+
+- name: resumeAfter (optional)
+  type: string
+  description: When a throttled run's next slice is scheduled to fire
+
+- name: scopeQuery (required)
+  type: string
+  description: Vendor query limiting the estimate to part of the customer's traffic, applied to both the matched count and the total. Empty means all logs.
+
+- name: scopeTotalCount (optional)
+  type: integer
+  description: Total events the scope matched over the window, the denominator
+
+- name: state (required)
+  type: enum: `QUEUED`, `RUNNING`, `THROTTLED`, `COMPLETE`, `PARTIAL`, `FAILED`
+  description: Current run state
+
+- name: stopReason (optional)
+  type: string
+  description: Why a PARTIAL run stopped early
+
+- name: updatedAt (required)
+  type: string
+  description: When the run was last written to
+
+- name: vendor (required)
+  type: enum: `DATADOG`
+  description: Vendor whose index the counts were made against
+
+- name: windowEnd (required)
+  type: string
+  description: Absolute end of the counted window, resolved at creation
+
+- name: windowStart (required)
+  type: string
+  description: Absolute start of the counted window, resolved at creation