For agents, on top of README.md, which they read first.

Notes for agents

Never print the token, and never put it in argv. It goes from op read into the request's header in memory. Errors print the API's answer, which does not echo it.

Column names come from events-schema.ts, not from here. A new event or field needs no change to this tool; adding one to the schema is enough.

Not yet exercised against the live API (2026-09-25): nothing had deployed with the EVENTS binding when it was written, so the dataset did not exist. The query shape follows Cloudflare's SQL API docs (read 2026-09-25: https://developers.cloudflare.com/analytics/analytics-engine/sql-api/). If the first run answers 403, the 1Password item's token lacks Account Analytics: Read.