Module events 

cellctl events [--formation NAME] [--follow] [--since SEQ] [--limit N]

Two delivery paths, same render:

• One-shot (no --follow) — HTTP GET /v1/events returns a bounded page of recent events from JetStream. Suitable for environments where WebSocket isn’t viable (corporate proxies, kubectl-style scripted pulls). Response shape mirrors the WS envelope so the wire is uniform: {events: [{seq, event}], cursor}.

• Follow (--follow) — WebSocket /ws/events. Live tail of CloudEvents as the server forwards them from JetStream. Optional --since resumes at a cursor without re-emitting frames the client has already seen (ADR-0015 §D3).

EVT-002 — WebSocket Bearer auth

Browsers can’t set custom WebSocket headers, so the web view’s WS path falls back to a localhost-proxy auth model (see ADR-0017). cellctl is a CLI — it CAN set headers, so it does: the upgrade request is built via IntoClientRequest::into_client_request and Authorization: Bearer <token> is installed directly. The Sec-WebSocket-Protocol: bearer.<token> subprotocol convention was considered and rejected — token-bearing subprotocols are a workaround for the browser limitation, not the right tool when you have a direct header path.

Functions

run