@axinom/mosaic-cli 0.58.0-rc.9 → 0.58.0

package/dist/esm/commands/hosting/service/runtime-logs/service-logs-command.d.ts

@@ -0,0 +1,3 @@
+import type { CommandModule } from 'yargs';
+import type { ServiceLogsOptions } from './service-logs-options.js';
+export declare const serviceLogs: CommandModule<unknown, ServiceLogsOptions>;

package/dist/esm/commands/hosting/service/runtime-logs/service-logs-command.js

@@ -0,0 +1,70 @@
+import chalk from 'chalk';
+import { getServiceLogs, validateServiceLogsArgs } from './service-logs.js';
+const { red, yellow } = chalk;
+export const serviceLogs = {
+    builder: (yargs) => {
+        return yargs
+            .option('serviceId', {
+            describe: 'Service ID to read runtime logs for',
+            alias: 'i',
+            string: true,
+            demandOption: true,
+        })
+            .option('tail', {
+            describe: 'Maximum number of log lines to show per replica',
+            alias: 't',
+            number: true,
+            default: 100,
+        })
+            .option('since', {
+            describe: 'Only show log lines newer than the given age, for example 30s, 5m, 2h or 1d. A plain number is read as seconds.',
+            string: true,
+        })
+            .option('timestamps', {
+            describe: 'Show the timestamp Kubernetes recorded for each line. Lines are ordered by it either way.',
+            boolean: true,
+        })
+            .option('json', {
+            describe: 'Emit one JSON object per line ({replicaName, timestamp, message}), in the same order as the normal output. Makes --prefix and --timestamps redundant.',
+            boolean: true,
+        })
+            .option('prefix', {
+            describe: 'Prefix each line with the replica it came from. On by default when the service has more than one replica. Use --no-prefix when piping the raw lines to tools such as grep or awk.',
+            boolean: true,
+        })
+            .option('mosaicHostingClientId', {
+            describe: 'Service Account Client ID to authenticate',
+            alias: 'c',
+            string: true,
+        })
+            .option('mosaicHostingClientSecret', {
+            describe: 'Service Account Client Secret to authenticate',
+            alias: 's',
+            string: true,
+        })
+            .option('idServiceAuthBaseURL', {
+            describe: 'ID Service Authentication Endpoint Base URL',
+            alias: 'a',
+            string: true,
+        })
+            .option('hostingServiceBaseURL', {
+            describe: 'Hosting Service Base URL',
+            alias: 'h',
+            string: true,
+        })
+            .example('$0 hosting service logs -i channel-service', 'Show the last 100 log lines of each replica')
+            .example('$0 hosting service logs -i channel-service --tail 500 > service.log', 'Write log lines to a file (status messages stay on stderr)');
+    },
+    handler: async (args) => {
+        const [validatedArgs, errorMessages] = validateServiceLogsArgs(args);
+        if (errorMessages.length > 0) {
+            process.stderr.write(red('Some required arguments are missing.\n'));
+            process.stderr.write(yellow(errorMessages.join('\n') + '\n'));
+            process.exit(1);
+        }
+        else {
+            await getServiceLogs(validatedArgs);
+        }
+    },
+};
+//# sourceMappingURL=service-logs-command.js.map

package/dist/esm/commands/hosting/service/runtime-logs/service-logs-command.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-logs-command.js","sourceRoot":"","sources":["../../../../../../src/commands/hosting/service/runtime-logs/service-logs-command.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAG1B,OAAO,EAAE,cAAc,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAE5E,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;AAE9B,MAAM,CAAC,MAAM,WAAW,GAA+C;IACrE,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;QACjB,OAAO,KAAK;aACT,MAAM,CAAC,WAAW,EAAE;YACnB,QAAQ,EAAE,qCAAqC;YAC/C,KAAK,EAAE,GAAG;YACV,MAAM,EAAE,IAAI;YACZ,YAAY,EAAE,IAAI;SACnB,CAAC;aACD,MAAM,CAAC,MAAM,EAAE;YACd,QAAQ,EAAE,iDAAiD;YAC3D,KAAK,EAAE,GAAG;YACV,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,GAAG;SACb,CAAC;aACD,MAAM,CAAC,OAAO,EAAE;YACf,QAAQ,EACN,iHAAiH;YACnH,MAAM,EAAE,IAAI;SACb,CAAC;aACD,MAAM,CAAC,YAAY,EAAE;YACpB,QAAQ,EACN,2FAA2F;YAC7F,OAAO,EAAE,IAAI;SACd,CAAC;aACD,MAAM,CAAC,MAAM,EAAE;YACd,QAAQ,EACN,uJAAuJ;YACzJ,OAAO,EAAE,IAAI;SACd,CAAC;aACD,MAAM,CAAC,QAAQ,EAAE;YAChB,QAAQ,EACN,mLAAmL;YACrL,OAAO,EAAE,IAAI;SACd,CAAC;aACD,MAAM,CAAC,uBAAuB,EAAE;YAC/B,QAAQ,EAAE,2CAA2C;YACrD,KAAK,EAAE,GAAG;YACV,MAAM,EAAE,IAAI;SACb,CAAC;aACD,MAAM,CAAC,2BAA2B,EAAE;YACnC,QAAQ,EAAE,+CAA+C;YACzD,KAAK,EAAE,GAAG;YACV,MAAM,EAAE,IAAI;SACb,CAAC;aACD,MAAM,CAAC,sBAAsB,EAAE;YAC9B,QAAQ,EAAE,6CAA6C;YACvD,KAAK,EAAE,GAAG;YACV,MAAM,EAAE,IAAI;SACb,CAAC;aACD,MAAM,CAAC,uBAAuB,EAAE;YAC/B,QAAQ,EAAE,0BAA0B;YACpC,KAAK,EAAE,GAAG;YACV,MAAM,EAAE,IAAI;SACb,CAAC;aACD,OAAO,CACN,4CAA4C,EAC5C,6CAA6C,CAC9C;aACA,OAAO,CACN,qEAAqE,EACrE,4DAA4D,CAC7D,CAAC;IACN,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QACtB,MAAM,CAAC,aAAa,EAAE,aAAa,CAAC,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC;QACrE,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,wCAAwC,CAAC,CAAC,CAAC;YACpE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;YAC9D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;aAAM,CAAC;YACN,MAAM,cAAc,CAClB,aAA2D,CAC5D,CAAC;QACJ,CAAC;IACH,CAAC;CACF,CAAC"}

package/dist/esm/commands/hosting/service/runtime-logs/service-logs-options.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Options for reading the runtime logs of a deployed service.
+ */
+export interface ServiceLogsOptions {
+    serviceId: string;
+    tail?: number;
+    since?: string;
+    json?: boolean;
+    prefix?: boolean;
+    timestamps?: boolean;
+    mosaicHostingClientId?: string;
+    mosaicHostingClientSecret?: string;
+    idServiceAuthBaseURL?: string;
+    hostingServiceBaseURL?: string;
+}

package/dist/esm/commands/hosting/service/runtime-logs/service-logs-options.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=service-logs-options.js.map

package/dist/esm/commands/hosting/service/runtime-logs/service-logs-options.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-logs-options.js","sourceRoot":"","sources":["../../../../../../src/commands/hosting/service/runtime-logs/service-logs-options.ts"],"names":[],"mappings":""}

package/dist/esm/commands/hosting/service/runtime-logs/service-logs.d.ts

@@ -0,0 +1,58 @@
+import type { ServiceLogsOptions } from './service-logs-options.js';
+/**
+ * The GraphQL shape returned by Hosting, which is deliberately declared here
+ * rather than imported: this package is published, and the SDU packages that
+ * own the equivalent REST DTO are private.
+ */
+export interface ServiceReplicaLog {
+    replicaName: string;
+    lines: string[];
+}
+/**
+ * Replica names are full K8s pod names, e.g.
+ * `d-8ip51mklekzyxmtk-5ihjg3ycvjkpnmb2-ax-media-service-bb9c8cfmfq`. Everything
+ * up to and including the service ID is identical across replicas of the
+ * service that was asked for, so only the trailing segment carries
+ * information -- and 60+ characters in front of every line is unreadable.
+ * `--json` keeps the full name.
+ */
+export declare const toShortReplicaName: (replicaName: string, serviceId: string) => string;
+/**
+ * Reads an age such as `30s`, `5m`, `2h` or `1d` into seconds, matching how
+ * `kubectl logs --since` and `docker logs --since` are written. A bare number
+ * is read as seconds. Returns undefined when the value cannot be read.
+ */
+export declare const parseSinceToSeconds: (since: string | undefined) => number | undefined;
+interface OrderedLine {
+    /** RFC3339 timestamp Kubernetes recorded for the line, used for ordering. */
+    sortKey: string;
+    replicaName: string;
+    timestamp: string;
+    message: string;
+}
+/**
+ * Pads the fractional seconds to a fixed width so timestamps can be ordered by
+ * plain string comparison.
+ *
+ * RFC3339Nano permits a variable-length fraction, and comparing those directly
+ * misorders them: `.12Z` is earlier than `.1201Z`, but sorts after it because
+ * `Z` compares above `0`. Padding avoids that while keeping the precision a
+ * `Date` would round away. A value that does not parse is returned unchanged
+ * and simply orders lexicographically.
+ */
+export declare const toTimestampSortKey: (timestamp: string) => string;
+/**
+ * Merges every replica's lines into one chronological stream.
+ *
+ * The keys are RFC3339 UTC strings of identical shape, so comparing them as
+ * strings orders them correctly and preserves the sub-millisecond precision
+ * that parsing into a `Date` would discard. Sorting is stable, so lines sharing
+ * a timestamp keep their original per-replica order.
+ */
+export declare const mergeReplicaLines: (replicas: ServiceReplicaLog[]) => OrderedLine[];
+export declare const getServiceLogs: (args: Required<Pick<ServiceLogsOptions, "serviceId">> & ServiceLogsOptions) => Promise<void>;
+/**
+ * Validate arguments for reading service logs.
+ */
+export declare const validateServiceLogsArgs: (args: ServiceLogsOptions) => [ServiceLogsOptions, string[]];
+export {};

package/dist/esm/commands/hosting/service/runtime-logs/service-logs.js

@@ -0,0 +1,252 @@
+import { getServiceAccountToken } from '@axinom/mosaic-id-link-be';
+import { isNullOrWhitespace } from '@axinom/mosaic-service-common';
+import axios, { AxiosError } from 'axios';
+import chalk from 'chalk';
+import { exitCode } from '../../../../common/index.js';
+const { red, dim } = chalk;
+/**
+ * Log lines go to stdout and nothing else does; status messages and errors go
+ * to stderr. This keeps `mosaic hosting service logs -i svc > out.log` a file
+ * of pure log output, and keeps `| grep` results free of decoration.
+ */
+const writeLogLine = (line) => {
+    process.stdout.write(line + '\n');
+};
+const writeStatus = (message) => {
+    process.stderr.write(message + '\n');
+};
+const getAxiosInstance = (hostingServiceBaseUrl, serviceAccountToken) => {
+    return axios.create({
+        baseURL: new URL(hostingServiceBaseUrl).toString(),
+        headers: {
+            Authorization: `Bearer ${serviceAccountToken}`,
+            'content-type': 'application/json',
+        },
+    });
+};
+/**
+ * Replica names are full K8s pod names, e.g.
+ * `d-8ip51mklekzyxmtk-5ihjg3ycvjkpnmb2-ax-media-service-bb9c8cfmfq`. Everything
+ * up to and including the service ID is identical across replicas of the
+ * service that was asked for, so only the trailing segment carries
+ * information -- and 60+ characters in front of every line is unreadable.
+ * `--json` keeps the full name.
+ */
+export const toShortReplicaName = (replicaName, serviceId) => {
+    const marker = `-${serviceId}-`;
+    const index = replicaName.lastIndexOf(marker);
+    if (index === -1) {
+        return replicaName;
+    }
+    const suffix = replicaName.slice(index + marker.length);
+    return suffix.length > 0 ? suffix : replicaName;
+};
+/**
+ * Drops the empty element left by the log's trailing newline, while preserving
+ * blank lines inside the log: a service not using
+ * `@axinom/mosaic-service-common` may emit plain multi-line text where blank
+ * lines are meaningful.
+ */
+const stripTrailingBlank = (lines) => {
+    const result = [...lines];
+    while (result.length > 0 && result[result.length - 1] === '') {
+        result.pop();
+    }
+    return result;
+};
+const SINCE_UNITS_IN_SECONDS = {
+    s: 1,
+    m: 60,
+    h: 60 * 60,
+    d: 24 * 60 * 60,
+};
+const SINCE_PATTERN = /^(\d+)(s|m|h|d)?$/;
+/**
+ * Reads an age such as `30s`, `5m`, `2h` or `1d` into seconds, matching how
+ * `kubectl logs --since` and `docker logs --since` are written. A bare number
+ * is read as seconds. Returns undefined when the value cannot be read.
+ */
+export const parseSinceToSeconds = (since) => {
+    if (since === undefined) {
+        return undefined;
+    }
+    const match = SINCE_PATTERN.exec(since.trim());
+    if (!match) {
+        return undefined;
+    }
+    const amount = Number(match[1]);
+    if (amount <= 0) {
+        return undefined;
+    }
+    return amount * SINCE_UNITS_IN_SECONDS[match[2] ?? 's'];
+};
+const TIMESTAMP_PATTERN = /^(\d{4}-\d{2}-\d{2}T\S+Z) (.*)$/s;
+const NANO_DIGITS = 9;
+const RFC3339_PATTERN = /^(\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2})(?:\.(\d+))?Z$/;
+/**
+ * Pads the fractional seconds to a fixed width so timestamps can be ordered by
+ * plain string comparison.
+ *
+ * RFC3339Nano permits a variable-length fraction, and comparing those directly
+ * misorders them: `.12Z` is earlier than `.1201Z`, but sorts after it because
+ * `Z` compares above `0`. Padding avoids that while keeping the precision a
+ * `Date` would round away. A value that does not parse is returned unchanged
+ * and simply orders lexicographically.
+ */
+export const toTimestampSortKey = (timestamp) => {
+    const match = RFC3339_PATTERN.exec(timestamp);
+    if (!match) {
+        return timestamp;
+    }
+    return `${match[1]}.${(match[2] ?? '').padEnd(NANO_DIGITS, '0')}Z`;
+};
+/**
+ * Splits the timestamp Kubernetes prefixed onto each line from the line itself.
+ *
+ * A line that does not carry one (which should not happen, but a malformed or
+ * truncated log could produce it) inherits the previous line's key so it stays
+ * next to the line it belongs with, instead of sorting to the top.
+ */
+const toOrderedLines = (replicaName, lines, previousKey = '') => {
+    let lastKey = previousKey;
+    return lines.map((line) => {
+        const match = TIMESTAMP_PATTERN.exec(line);
+        if (match) {
+            lastKey = toTimestampSortKey(match[1]);
+            return {
+                sortKey: lastKey,
+                replicaName,
+                timestamp: match[1],
+                message: match[2],
+            };
+        }
+        return { sortKey: lastKey, replicaName, timestamp: '', message: line };
+    });
+};
+/**
+ * Merges every replica's lines into one chronological stream.
+ *
+ * The keys are RFC3339 UTC strings of identical shape, so comparing them as
+ * strings orders them correctly and preserves the sub-millisecond precision
+ * that parsing into a `Date` would discard. Sorting is stable, so lines sharing
+ * a timestamp keep their original per-replica order.
+ */
+export const mergeReplicaLines = (replicas) => replicas
+    .flatMap((replica) => toOrderedLines(replica.replicaName, stripTrailingBlank(replica.lines)))
+    .sort((a, b) => a.sortKey < b.sortKey ? -1 : a.sortKey > b.sortKey ? 1 : 0);
+export const getServiceLogs = async (args) => {
+    const serviceAccountToken = await getServiceAccountToken(args.idServiceAuthBaseURL, args.mosaicHostingClientId, args.mosaicHostingClientSecret);
+    const axiosInstance = getAxiosInstance(args.hostingServiceBaseURL, serviceAccountToken.accessToken);
+    const query = `query GetServiceRuntimeLogs($serviceId: String!, $tailLines: Int, $sinceSeconds: Int) {
+    serviceRuntimeLogs(input: { serviceId: $serviceId, tailLines: $tailLines, sinceSeconds: $sinceSeconds }) {
+      replicas {
+        replicaName
+        lines
+      }
+    }
+  }`;
+    const payload = JSON.stringify({
+        query,
+        variables: {
+            serviceId: args.serviceId,
+            tailLines: args.tail,
+            sinceSeconds: parseSinceToSeconds(args.since),
+        },
+    });
+    try {
+        const response = await axiosInstance.post('graphql', payload);
+        if (response.data.errors !== undefined && response.data.errors.length > 0) {
+            writeStatus(red(`Failed to retrieve logs for service [${args.serviceId}].`));
+            writeStatus(red(response.data.errors[0].message));
+            process.exit(exitCode);
+        }
+        const replicas = response.data.data?.serviceRuntimeLogs?.replicas ?? [];
+        const merged = mergeReplicaLines(replicas);
+        // Newline-delimited JSON: the same ordering as the human output, one object
+        // per line so it streams into `jq` and friends. The replica and timestamp
+        // are always present as fields, which is why --prefix and --timestamps do
+        // not apply here.
+        if (args.json) {
+            for (const line of merged) {
+                writeLogLine(JSON.stringify({
+                    replicaName: line.replicaName,
+                    timestamp: line.timestamp,
+                    message: line.message,
+                }));
+            }
+            return;
+        }
+        if (replicas.length === 0) {
+            writeStatus(dim(`No running replicas found for service [${args.serviceId}].`));
+            return;
+        }
+        // With one replica the prefix is noise on every line; with several it is
+        // the only way to tell which replica said what.
+        const usePrefix = args.prefix ?? replicas.length > 1;
+        writeStatus(dim(`# ${args.serviceId}: ${replicas.length} replica(s)${args.tail ? `, last ${args.tail} line(s) each` : ''}`));
+        for (const line of merged) {
+            // The service's own text is emitted verbatim: it may be plain text
+            // rather than JSON, and any reformatting would corrupt it.
+            const prefix = usePrefix
+                ? `[${toShortReplicaName(line.replicaName, args.serviceId)}] `
+                : '';
+            const stamp = args.timestamps && line.timestamp ? `${line.timestamp} ` : '';
+            writeLogLine(`${prefix}${stamp}${line.message}`);
+        }
+    }
+    catch (error) {
+        const axiosError = error;
+        writeStatus(red(`Error while retrieving logs for service [${args.serviceId}].`));
+        writeStatus(red(`Error: ${axiosError.message}`));
+        if (axiosError.response) {
+            writeStatus(red(`Status: ${axiosError.response.status}`));
+            writeStatus(red(`Response: ${JSON.stringify(axiosError.response.data, null, 2)}`));
+        }
+        process.exit(exitCode);
+    }
+};
+/**
+ * Validate arguments for reading service logs.
+ */
+export const validateServiceLogsArgs = (args) => {
+    const errorMessages = [];
+    const idServiceAuthBaseURL = args.idServiceAuthBaseURL ?? process.env.ID_SERVICE_AUTH_BASE_URL ?? '';
+    const mosaicHostingClientId = args.mosaicHostingClientId ?? process.env.MOSAIC_HOSTING_CLIENT_ID ?? '';
+    const mosaicHostingClientSecret = args.mosaicHostingClientSecret ??
+        process.env.MOSAIC_HOSTING_CLIENT_SECRET ??
+        '';
+    const hostingServiceBaseURL = args.hostingServiceBaseURL ?? process.env.HOSTING_SERVICE_BASE_URL ?? '';
+    if (isNullOrWhitespace(idServiceAuthBaseURL)) {
+        errorMessages.push('[idServiceAuthBaseURL] is required.');
+    }
+    if (isNullOrWhitespace(mosaicHostingClientId)) {
+        errorMessages.push('[mosaicHostingClientId] is required.');
+    }
+    if (isNullOrWhitespace(mosaicHostingClientSecret)) {
+        errorMessages.push('[mosaicHostingClientSecret] is required.');
+    }
+    if (isNullOrWhitespace(hostingServiceBaseURL)) {
+        errorMessages.push('[hostingServiceBaseURL] is required.');
+    }
+    if (isNullOrWhitespace(args.serviceId)) {
+        errorMessages.push('[serviceId] is required.');
+    }
+    if (args.tail !== undefined && (args.tail < 1 || args.tail > 1000)) {
+        errorMessages.push('[tail] must be between 1 and 1000.');
+    }
+    if (args.since !== undefined &&
+        parseSinceToSeconds(args.since) === undefined) {
+        errorMessages.push('[since] must be a positive age such as 30s, 5m, 2h or 1d.');
+    }
+    return [
+        {
+            ...args,
+            idServiceAuthBaseURL,
+            mosaicHostingClientId,
+            mosaicHostingClientSecret,
+            hostingServiceBaseURL,
+        },
+        errorMessages,
+    ];
+};
+//# sourceMappingURL=service-logs.js.map

package/dist/esm/commands/hosting/service/runtime-logs/service-logs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-logs.js","sourceRoot":"","sources":["../../../../../../src/commands/hosting/service/runtime-logs/service-logs.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AACnE,OAAO,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AACnE,OAAO,KAAK,EAAE,EAAE,UAAU,EAAsB,MAAM,OAAO,CAAC;AAC9D,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,QAAQ,EAAE,MAAM,6BAA6B,CAAC;AAGvD,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,KAAK,CAAC;AAY3B;;;;GAIG;AACH,MAAM,YAAY,GAAG,CAAC,IAAY,EAAQ,EAAE;IAC1C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;AACpC,CAAC,CAAC;AACF,MAAM,WAAW,GAAG,CAAC,OAAe,EAAQ,EAAE;IAC5C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;AACvC,CAAC,CAAC;AAEF,MAAM,gBAAgB,GAAG,CACvB,qBAA6B,EAC7B,mBAA2B,EACZ,EAAE;IACjB,OAAO,KAAK,CAAC,MAAM,CAAC;QAClB,OAAO,EAAE,IAAI,GAAG,CAAC,qBAAqB,CAAC,CAAC,QAAQ,EAAE;QAClD,OAAO,EAAE;YACP,aAAa,EAAE,UAAU,mBAAmB,EAAE;YAC9C,cAAc,EAAE,kBAAkB;SACnC;KACF,CAAC,CAAC;AACL,CAAC,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAChC,WAAmB,EACnB,SAAiB,EACT,EAAE;IACV,MAAM,MAAM,GAAG,IAAI,SAAS,GAAG,CAAC;IAChC,MAAM,KAAK,GAAG,WAAW,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IAC9C,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;QACjB,OAAO,WAAW,CAAC;IACrB,CAAC;IACD,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IACxD,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC;AAClD,CAAC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,kBAAkB,GAAG,CAAC,KAAe,EAAY,EAAE;IACvD,MAAM,MAAM,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC;IAC1B,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;QAC7D,MAAM,CAAC,GAAG,EAAE,CAAC;IACf,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC;AAEF,MAAM,sBAAsB,GAA2B;IACrD,CAAC,EAAE,CAAC;IACJ,CAAC,EAAE,EAAE;IACL,CAAC,EAAE,EAAE,GAAG,EAAE;IACV,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE;CAChB,CAAC;AAEF,MAAM,aAAa,GAAG,mBAAmB,CAAC;AAE1C;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CACjC,KAAyB,EACL,EAAE;IACtB,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IAC/C,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAChC,IAAI,MAAM,IAAI,CAAC,EAAE,CAAC;QAChB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,MAAM,GAAG,sBAAsB,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC;AAC1D,CAAC,CAAC;AAUF,MAAM,iBAAiB,GAAG,kCAAkC,CAAC;AAE7D,MAAM,WAAW,GAAG,CAAC,CAAC;AACtB,MAAM,eAAe,GAAG,sDAAsD,CAAC;AAE/E;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,SAAiB,EAAU,EAAE;IAC9D,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC9C,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,WAAW,EAAE,GAAG,CAAC,GAAG,CAAC;AACrE,CAAC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,cAAc,GAAG,CACrB,WAAmB,EACnB,KAAe,EACf,WAAW,GAAG,EAAE,EACD,EAAE;IACjB,IAAI,OAAO,GAAG,WAAW,CAAC;IAC1B,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACxB,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3C,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YACvC,OAAO;gBACL,OAAO,EAAE,OAAO;gBAChB,WAAW;gBACX,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC;gBACnB,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;aAClB,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACzE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAC/B,QAA6B,EACd,EAAE,CACjB,QAAQ;KACL,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CACnB,cAAc,CAAC,OAAO,CAAC,WAAW,EAAE,kBAAkB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CACvE;KACA,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACb,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAC3D,CAAC;AAEN,MAAM,CAAC,MAAM,cAAc,GAAG,KAAK,EACjC,IAA0E,EAC3D,EAAE;IACjB,MAAM,mBAAmB,GAAG,MAAM,sBAAsB,CACtD,IAAI,CAAC,oBAA8B,EACnC,IAAI,CAAC,qBAA+B,EACpC,IAAI,CAAC,yBAAmC,CACzC,CAAC;IAEF,MAAM,aAAa,GAAkB,gBAAgB,CACnD,IAAI,CAAC,qBAA+B,EACpC,mBAAmB,CAAC,WAAW,CAChC,CAAC;IAEF,MAAM,KAAK,GAAG;;;;;;;IAOZ,CAAC;IAEH,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC;QAC7B,KAAK;QACL,SAAS,EAAE;YACT,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,CAAC,IAAI;YACpB,YAAY,EAAE,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC;SAC9C;KACF,CAAC,CAAC;IAEH,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAE9D,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1E,WAAW,CACT,GAAG,CAAC,wCAAwC,IAAI,CAAC,SAAS,IAAI,CAAC,CAChE,CAAC;YACF,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;YAClD,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACzB,CAAC;QAED,MAAM,QAAQ,GACZ,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,kBAAkB,EAAE,QAAQ,IAAI,EAAE,CAAC;QAEzD,MAAM,MAAM,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QAE3C,4EAA4E;QAC5E,0EAA0E;QAC1E,0EAA0E;QAC1E,kBAAkB;QAClB,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;gBAC1B,YAAY,CACV,IAAI,CAAC,SAAS,CAAC;oBACb,WAAW,EAAE,IAAI,CAAC,WAAW;oBAC7B,SAAS,EAAE,IAAI,CAAC,SAAS;oBACzB,OAAO,EAAE,IAAI,CAAC,OAAO;iBACtB,CAAC,CACH,CAAC;YACJ,CAAC;YACD,OAAO;QACT,CAAC;QAED,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,WAAW,CACT,GAAG,CAAC,0CAA0C,IAAI,CAAC,SAAS,IAAI,CAAC,CAClE,CAAC;YACF,OAAO;QACT,CAAC;QAED,yEAAyE;QACzE,gDAAgD;QAChD,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;QAErD,WAAW,CACT,GAAG,CACD,KAAK,IAAI,CAAC,SAAS,KAAK,QAAQ,CAAC,MAAM,cACrC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,IAAI,eAAe,CAAC,CAAC,CAAC,EACnD,EAAE,CACH,CACF,CAAC;QAEF,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;YAC1B,mEAAmE;YACnE,2DAA2D;YAC3D,MAAM,MAAM,GAAG,SAAS;gBACtB,CAAC,CAAC,IAAI,kBAAkB,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI;gBAC9D,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,KAAK,GACT,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAChE,YAAY,CAAC,GAAG,MAAM,GAAG,KAAK,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,UAAU,GAAG,KAAmB,CAAC;QACvC,WAAW,CACT,GAAG,CAAC,4CAA4C,IAAI,CAAC,SAAS,IAAI,CAAC,CACpE,CAAC;QACF,WAAW,CAAC,GAAG,CAAC,UAAU,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QAEjD,IAAI,UAAU,CAAC,QAAQ,EAAE,CAAC;YACxB,WAAW,CAAC,GAAG,CAAC,WAAW,UAAU,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;YAC1D,WAAW,CACT,GAAG,CAAC,aAAa,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,CACtE,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACzB,CAAC;AACH,CAAC,CAAC;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CACrC,IAAwB,EACQ,EAAE;IAClC,MAAM,aAAa,GAAa,EAAE,CAAC;IAEnC,MAAM,oBAAoB,GACxB,IAAI,CAAC,oBAAoB,IAAI,OAAO,CAAC,GAAG,CAAC,wBAAwB,IAAI,EAAE,CAAC;IAC1E,MAAM,qBAAqB,GACzB,IAAI,CAAC,qBAAqB,IAAI,OAAO,CAAC,GAAG,CAAC,wBAAwB,IAAI,EAAE,CAAC;IAC3E,MAAM,yBAAyB,GAC7B,IAAI,CAAC,yBAAyB;QAC9B,OAAO,CAAC,GAAG,CAAC,4BAA4B;QACxC,EAAE,CAAC;IACL,MAAM,qBAAqB,GACzB,IAAI,CAAC,qBAAqB,IAAI,OAAO,CAAC,GAAG,CAAC,wBAAwB,IAAI,EAAE,CAAC;IAE3E,IAAI,kBAAkB,CAAC,oBAAoB,CAAC,EAAE,CAAC;QAC7C,aAAa,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;IAC5D,CAAC;IACD,IAAI,kBAAkB,CAAC,qBAAqB,CAAC,EAAE,CAAC;QAC9C,aAAa,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAC;IAC7D,CAAC;IACD,IAAI,kBAAkB,CAAC,yBAAyB,CAAC,EAAE,CAAC;QAClD,aAAa,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC;IACjE,CAAC;IACD,IAAI,kBAAkB,CAAC,qBAAqB,CAAC,EAAE,CAAC;QAC9C,aAAa,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAC;IAC7D,CAAC;IACD,IAAI,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QACvC,aAAa,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;IACjD,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,IAAI,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;QACnE,aAAa,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC;IAC3D,CAAC;IACD,IACE,IAAI,CAAC,KAAK,KAAK,SAAS;QACxB,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,SAAS,EAC7C,CAAC;QACD,aAAa,CAAC,IAAI,CAChB,2DAA2D,CAC5D,CAAC;IACJ,CAAC;IAED,OAAO;QACL;YACE,GAAG,IAAI;YACP,oBAAoB;YACpB,qBAAqB;YACrB,yBAAyB;YACzB,qBAAqB;SACtB;QACD,aAAa;KACd,CAAC;AACJ,CAAC,CAAC"}

package/dist/esm/commands/hosting/service/service-commands.js

@@ -1,10 +1,11 @@
 import { serviceDeploy } from './deploy/service-deploy-command.js';
+import { serviceLogs } from './runtime-logs/service-logs-command.js';
 import { serviceUndeploy } from './undeploy/service-undeploy-command.js';
 export const serviceCommands = {
     builder: (yargs) => yargs
         .command('deploy', 'Deploy a service through Hosting Service.', serviceDeploy)
-        .demandCommand()
         .command('undeploy', 'Undeploy a service through Hosting Service.', serviceUndeploy)
+        .command('logs', 'Read the runtime logs of a deployed service.', serviceLogs)
         .demandCommand(),
     handler: () => {
         console.log('Please pick an action related to hosting service command.');

package/dist/esm/commands/hosting/service/service-commands.js.map

@@ -1 +1 @@
-{"version":3,"file":"service-commands.js","sourceRoot":"","sources":["../../../../../src/commands/hosting/service/service-commands.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,oCAAoC,CAAC;AACnE,OAAO,EAAE,eAAe,EAAE,MAAM,wCAAwC,CAAC;AAEzE,MAAM,CAAC,MAAM,eAAe,GAAoC;IAC9D,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CACjB,KAAK;SACF,OAAO,CACN,QAAQ,EACR,2CAA2C,EAC3C,aAAa,CACd;SACA,aAAa,EAAE;SACf,OAAO,CACN,UAAU,EACV,6CAA6C,EAC7C,eAAe,CAChB;SACA,aAAa,EAAE;IACpB,OAAO,EAAE,GAAG,EAAE;QACZ,OAAO,CAAC,GAAG,CAAC,2DAA2D,CAAC,CAAC;IAC3E,CAAC;CACF,CAAC"}
+{"version":3,"file":"service-commands.js","sourceRoot":"","sources":["../../../../../src/commands/hosting/service/service-commands.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,oCAAoC,CAAC;AACnE,OAAO,EAAE,WAAW,EAAE,MAAM,wCAAwC,CAAC;AACrE,OAAO,EAAE,eAAe,EAAE,MAAM,wCAAwC,CAAC;AAEzE,MAAM,CAAC,MAAM,eAAe,GAAoC;IAC9D,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CACjB,KAAK;SACF,OAAO,CACN,QAAQ,EACR,2CAA2C,EAC3C,aAAa,CACd;SACA,OAAO,CACN,UAAU,EACV,6CAA6C,EAC7C,eAAe,CAChB;SACA,OAAO,CACN,MAAM,EACN,8CAA8C,EAC9C,WAAW,CACZ;SACA,aAAa,EAAE;IACpB,OAAO,EAAE,GAAG,EAAE;QACZ,OAAO,CAAC,GAAG,CAAC,2DAA2D,CAAC,CAAC;IAC3E,CAAC;CACF,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@axinom/mosaic-cli",
-  "version": "0.58.0-rc.9",
+  "version": "0.58.0",
   "description": "The Axinom Mosaic CLI",
   "author": "Axinom",
   "license": "PROPRIETARY",
@@ -47,9 +47,9 @@
     "@asyncapi/diff": "^0.5.0",
     "@asyncapi/modelina": "^5.10.1",
     "@asyncapi/parser": "^3.6.0",
-    "@axinom/mosaic-id-link-be": "^0.41.0-rc.9",
-    "@axinom/mosaic-service-common": "^0.71.0-rc.9",
-    "@graphql-inspector/core": "^3.1.2",
+    "@axinom/mosaic-id-link-be": "^0.41.0",
+    "@axinom/mosaic-service-common": "^0.71.0",
+    "@graphql-inspector/core": "3.1.2",
     "@inquirer/confirm": "^3.1.0",
     "@inquirer/core": "^9.1.0",
     "@inquirer/input": "^2.1.0",
@@ -94,5 +94,5 @@
   "publishConfig": {
     "access": "public"
   },
-  "gitHead": "b80467d73b13298265d3b3c1365d7ce0d652ac79"
+  "gitHead": "c423aeda79f59de31422cd52d9821d1b8214c3df"
 }

package/src/commands/hosting/service/runtime-logs/service-logs-command.ts

@@ -0,0 +1,84 @@
+import chalk from 'chalk';
+import type { CommandModule } from 'yargs';
+import type { ServiceLogsOptions } from './service-logs-options.js';
+import { getServiceLogs, validateServiceLogsArgs } from './service-logs.js';
+
+const { red, yellow } = chalk;
+
+export const serviceLogs: CommandModule<unknown, ServiceLogsOptions> = {
+  builder: (yargs) => {
+    return yargs
+      .option('serviceId', {
+        describe: 'Service ID to read runtime logs for',
+        alias: 'i',
+        string: true,
+        demandOption: true,
+      })
+      .option('tail', {
+        describe: 'Maximum number of log lines to show per replica',
+        alias: 't',
+        number: true,
+        default: 100,
+      })
+      .option('since', {
+        describe:
+          'Only show log lines newer than the given age, for example 30s, 5m, 2h or 1d. A plain number is read as seconds.',
+        string: true,
+      })
+      .option('timestamps', {
+        describe:
+          'Show the timestamp Kubernetes recorded for each line. Lines are ordered by it either way.',
+        boolean: true,
+      })
+      .option('json', {
+        describe:
+          'Emit one JSON object per line ({replicaName, timestamp, message}), in the same order as the normal output. Makes --prefix and --timestamps redundant.',
+        boolean: true,
+      })
+      .option('prefix', {
+        describe:
+          'Prefix each line with the replica it came from. On by default when the service has more than one replica. Use --no-prefix when piping the raw lines to tools such as grep or awk.',
+        boolean: true,
+      })
+      .option('mosaicHostingClientId', {
+        describe: 'Service Account Client ID to authenticate',
+        alias: 'c',
+        string: true,
+      })
+      .option('mosaicHostingClientSecret', {
+        describe: 'Service Account Client Secret to authenticate',
+        alias: 's',
+        string: true,
+      })
+      .option('idServiceAuthBaseURL', {
+        describe: 'ID Service Authentication Endpoint Base URL',
+        alias: 'a',
+        string: true,
+      })
+      .option('hostingServiceBaseURL', {
+        describe: 'Hosting Service Base URL',
+        alias: 'h',
+        string: true,
+      })
+      .example(
+        '$0 hosting service logs -i channel-service',
+        'Show the last 100 log lines of each replica',
+      )
+      .example(
+        '$0 hosting service logs -i channel-service --tail 500 > service.log',
+        'Write log lines to a file (status messages stay on stderr)',
+      );
+  },
+  handler: async (args) => {
+    const [validatedArgs, errorMessages] = validateServiceLogsArgs(args);
+    if (errorMessages.length > 0) {
+      process.stderr.write(red('Some required arguments are missing.\n'));
+      process.stderr.write(yellow(errorMessages.join('\n') + '\n'));
+      process.exit(1);
+    } else {
+      await getServiceLogs(
+        validatedArgs as ServiceLogsOptions & { serviceId: string },
+      );
+    }
+  },
+};

package/src/commands/hosting/service/runtime-logs/service-logs-options.ts

@@ -0,0 +1,15 @@
+/**
+ * Options for reading the runtime logs of a deployed service.
+ */
+export interface ServiceLogsOptions {
+  serviceId: string;
+  tail?: number;
+  since?: string;
+  json?: boolean;
+  prefix?: boolean;
+  timestamps?: boolean;
+  mosaicHostingClientId?: string;
+  mosaicHostingClientSecret?: string;
+  idServiceAuthBaseURL?: string;
+  hostingServiceBaseURL?: string;
+}

package/src/commands/hosting/service/runtime-logs/service-logs.spec.ts

@@ -0,0 +1,178 @@
+import { describe, expect, it } from 'vitest';
+import {
+  mergeReplicaLines,
+  parseSinceToSeconds,
+  toShortReplicaName,
+  toTimestampSortKey,
+  type ServiceReplicaLog,
+} from './service-logs.js';
+
+const SERVICE_ID = 'channel-service';
+
+/**
+ * Builds a line in the shape SDU returns: the RFC3339 instant Kubernetes
+ * recorded, a space, then the container's own output.
+ */
+const k8sLine = (timestamp: string, text: string): string =>
+  `${timestamp} ${text}`;
+
+const replica = (suffix: string, lines: string[]): ServiceReplicaLog => ({
+  replicaName: `d-8ip51mklekzyxmtk-5ihjg3ycvjkpnmb2-${SERVICE_ID}-${suffix}`,
+  lines: [...lines, ''],
+});
+
+describe('toShortReplicaName', () => {
+  it('keeps only the segment that distinguishes one replica from another', () => {
+    expect(
+      toShortReplicaName(
+        `d-8ip51mklekzyxmtk-5ihjg3ycvjkpnmb2-${SERVICE_ID}-bb9c8cfmfq`,
+        SERVICE_ID,
+      ),
+    ).toBe('bb9c8cfmfq');
+  });
+
+  it('falls back to the full name when it does not follow the convention', () => {
+    expect(toShortReplicaName('some-other-pod', SERVICE_ID)).toBe(
+      'some-other-pod',
+    );
+  });
+});
+
+describe('mergeReplicaLines', () => {
+  it('orders lines from all replicas by the time Kubernetes recorded them', () => {
+    const merged = mergeReplicaLines([
+      replica('aaaaaaaaaa', [
+        k8sLine('2026-07-17T10:12:25.130421355Z', 'first'),
+        k8sLine('2026-07-17T10:12:27.000000000Z', 'third'),
+      ]),
+      replica('bbbbbbbbbb', [
+        k8sLine('2026-07-17T10:12:26.000000000Z', 'second'),
+        k8sLine('2026-07-17T10:12:28.000000000Z', 'fourth'),
+      ]),
+    ]);
+
+    expect(merged.map((l) => l.message)).toEqual([
+      'first',
+      'second',
+      'third',
+      'fourth',
+    ]);
+    expect(
+      merged.map((l) => toShortReplicaName(l.replicaName, SERVICE_ID)),
+    ).toEqual(['aaaaaaaaaa', 'bbbbbbbbbb', 'aaaaaaaaaa', 'bbbbbbbbbb']);
+  });
+
+  it('orders timestamps whose fractional part has a different length', () => {
+    // RFC3339Nano allows a variable-length fraction. `.12Z` is earlier than
+    // `.1201Z`, but compares after it as a plain string.
+    const merged = mergeReplicaLines([
+      replica('aaaaaaaaaa', [k8sLine('2026-07-17T10:12:25.1201Z', 'later')]),
+      replica('bbbbbbbbbb', [k8sLine('2026-07-17T10:12:25.12Z', 'earlier')]),
+    ]);
+
+    expect(merged.map((l) => l.message)).toEqual(['earlier', 'later']);
+  });
+
+  it('orders a timestamp with no fractional part before one within the same second', () => {
+    const merged = mergeReplicaLines([
+      replica('aaaaaaaaaa', [
+        k8sLine('2026-07-17T10:12:25.000000001Z', 'later'),
+      ]),
+      replica('bbbbbbbbbb', [k8sLine('2026-07-17T10:12:25Z', 'earlier')]),
+    ]);
+
+    expect(merged.map((l) => l.message)).toEqual(['earlier', 'later']);
+  });
+
+  it('orders sub-millisecond timestamps that a Date would collapse', () => {
+    const merged = mergeReplicaLines([
+      replica('aaaaaaaaaa', [
+        k8sLine('2026-07-17T10:12:25.000000900Z', 'later'),
+      ]),
+      replica('bbbbbbbbbb', [
+        k8sLine('2026-07-17T10:12:25.000000100Z', 'earlier'),
+      ]),
+    ]);
+
+    expect(merged.map((l) => l.message)).toEqual(['earlier', 'later']);
+  });
+
+  it('separates the timestamp from the service output without altering it', () => {
+    const json =
+      '{"logtime":"2026-07-17T10:12:25.130Z","loglevel":"INFO","message":"up"}';
+    const [line] = mergeReplicaLines([
+      replica('aaaaaaaaaa', [k8sLine('2026-07-17T10:12:25.130421355Z', json)]),
+    ]);
+
+    expect(line.timestamp).toBe('2026-07-17T10:12:25.130421355Z');
+    expect(line.message).toBe(json);
+  });
+
+  it('keeps a line without a timestamp beside the line it belongs to', () => {
+    // A service not using the Mosaic logger can emit output that arrives
+    // without a usable stamp; it must not sort to the top of the stream.
+    const merged = mergeReplicaLines([
+      replica('aaaaaaaaaa', [
+        k8sLine('2026-07-17T10:12:25.000000000Z', 'Traceback:'),
+        '  at line 2 of the stack',
+        k8sLine('2026-07-17T10:12:26.000000000Z', 'after'),
+      ]),
+    ]);
+
+    expect(merged.map((l) => l.message)).toEqual([
+      'Traceback:',
+      '  at line 2 of the stack',
+      'after',
+    ]);
+  });
+
+  it('preserves blank lines inside the log but drops the trailing newline', () => {
+    const merged = mergeReplicaLines([
+      replica('aaaaaaaaaa', [
+        k8sLine('2026-07-17T10:12:25.000000000Z', 'before'),
+        k8sLine('2026-07-17T10:12:25.500000000Z', ''),
+        k8sLine('2026-07-17T10:12:26.000000000Z', 'after'),
+      ]),
+    ]);
+
+    expect(merged.map((l) => l.message)).toEqual(['before', '', 'after']);
+  });
+});
+
+describe('parseSinceToSeconds', () => {
+  it.each([
+    ['45s', 45],
+    ['5m', 300],
+    ['2h', 7200],
+    ['1d', 86400],
+    ['90', 90],
+  ])('reads %s as %i seconds', (since, expected) => {
+    expect(parseSinceToSeconds(since)).toBe(expected);
+  });
+
+  it.each(['0', '0m', '-5m', '5 m', 'five minutes', '5w', '1.5h', ''])(
+    'rejects %s rather than silently sending a wrong window',
+    (since) => {
+      expect(parseSinceToSeconds(since)).toBeUndefined();
+    },
+  );
+
+  it('is undefined when not supplied, so no window is sent at all', () => {
+    expect(parseSinceToSeconds(undefined)).toBeUndefined();
+  });
+});
+
+describe('toTimestampSortKey', () => {
+  it.each([
+    ['2026-07-17T10:12:25.12Z', '2026-07-17T10:12:25.120000000Z'],
+    ['2026-07-17T10:12:25.1201Z', '2026-07-17T10:12:25.120100000Z'],
+    ['2026-07-17T10:12:25Z', '2026-07-17T10:12:25.000000000Z'],
+    ['2026-07-17T10:12:25.130421355Z', '2026-07-17T10:12:25.130421355Z'],
+  ])('pads %s to %s', (input, expected) => {
+    expect(toTimestampSortKey(input)).toBe(expected);
+  });
+
+  it('leaves a value it cannot parse untouched', () => {
+    expect(toTimestampSortKey('not-a-timestamp')).toBe('not-a-timestamp');
+  });
+});

package/src/commands/hosting/service/runtime-logs/service-logs.ts

@@ -0,0 +1,356 @@
+import { getServiceAccountToken } from '@axinom/mosaic-id-link-be';
+import { isNullOrWhitespace } from '@axinom/mosaic-service-common';
+import axios, { AxiosError, type AxiosInstance } from 'axios';
+import chalk from 'chalk';
+import { exitCode } from '../../../../common/index.js';
+import type { ServiceLogsOptions } from './service-logs-options.js';
+
+const { red, dim } = chalk;
+
+/**
+ * The GraphQL shape returned by Hosting, which is deliberately declared here
+ * rather than imported: this package is published, and the SDU packages that
+ * own the equivalent REST DTO are private.
+ */
+export interface ServiceReplicaLog {
+  replicaName: string;
+  lines: string[];
+}
+
+/**
+ * Log lines go to stdout and nothing else does; status messages and errors go
+ * to stderr. This keeps `mosaic hosting service logs -i svc > out.log` a file
+ * of pure log output, and keeps `| grep` results free of decoration.
+ */
+const writeLogLine = (line: string): void => {
+  process.stdout.write(line + '\n');
+};
+const writeStatus = (message: string): void => {
+  process.stderr.write(message + '\n');
+};
+
+const getAxiosInstance = (
+  hostingServiceBaseUrl: string,
+  serviceAccountToken: string,
+): AxiosInstance => {
+  return axios.create({
+    baseURL: new URL(hostingServiceBaseUrl).toString(),
+    headers: {
+      Authorization: `Bearer ${serviceAccountToken}`,
+      'content-type': 'application/json',
+    },
+  });
+};
+
+/**
+ * Replica names are full K8s pod names, e.g.
+ * `d-8ip51mklekzyxmtk-5ihjg3ycvjkpnmb2-ax-media-service-bb9c8cfmfq`. Everything
+ * up to and including the service ID is identical across replicas of the
+ * service that was asked for, so only the trailing segment carries
+ * information -- and 60+ characters in front of every line is unreadable.
+ * `--json` keeps the full name.
+ */
+export const toShortReplicaName = (
+  replicaName: string,
+  serviceId: string,
+): string => {
+  const marker = `-${serviceId}-`;
+  const index = replicaName.lastIndexOf(marker);
+  if (index === -1) {
+    return replicaName;
+  }
+  const suffix = replicaName.slice(index + marker.length);
+  return suffix.length > 0 ? suffix : replicaName;
+};
+
+/**
+ * Drops the empty element left by the log's trailing newline, while preserving
+ * blank lines inside the log: a service not using
+ * `@axinom/mosaic-service-common` may emit plain multi-line text where blank
+ * lines are meaningful.
+ */
+const stripTrailingBlank = (lines: string[]): string[] => {
+  const result = [...lines];
+  while (result.length > 0 && result[result.length - 1] === '') {
+    result.pop();
+  }
+  return result;
+};
+
+const SINCE_UNITS_IN_SECONDS: Record<string, number> = {
+  s: 1,
+  m: 60,
+  h: 60 * 60,
+  d: 24 * 60 * 60,
+};
+
+const SINCE_PATTERN = /^(\d+)(s|m|h|d)?$/;
+
+/**
+ * Reads an age such as `30s`, `5m`, `2h` or `1d` into seconds, matching how
+ * `kubectl logs --since` and `docker logs --since` are written. A bare number
+ * is read as seconds. Returns undefined when the value cannot be read.
+ */
+export const parseSinceToSeconds = (
+  since: string | undefined,
+): number | undefined => {
+  if (since === undefined) {
+    return undefined;
+  }
+  const match = SINCE_PATTERN.exec(since.trim());
+  if (!match) {
+    return undefined;
+  }
+  const amount = Number(match[1]);
+  if (amount <= 0) {
+    return undefined;
+  }
+  return amount * SINCE_UNITS_IN_SECONDS[match[2] ?? 's'];
+};
+
+interface OrderedLine {
+  /** RFC3339 timestamp Kubernetes recorded for the line, used for ordering. */
+  sortKey: string;
+  replicaName: string;
+  timestamp: string;
+  message: string;
+}
+
+const TIMESTAMP_PATTERN = /^(\d{4}-\d{2}-\d{2}T\S+Z) (.*)$/s;
+
+const NANO_DIGITS = 9;
+const RFC3339_PATTERN = /^(\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2})(?:\.(\d+))?Z$/;
+
+/**
+ * Pads the fractional seconds to a fixed width so timestamps can be ordered by
+ * plain string comparison.
+ *
+ * RFC3339Nano permits a variable-length fraction, and comparing those directly
+ * misorders them: `.12Z` is earlier than `.1201Z`, but sorts after it because
+ * `Z` compares above `0`. Padding avoids that while keeping the precision a
+ * `Date` would round away. A value that does not parse is returned unchanged
+ * and simply orders lexicographically.
+ */
+export const toTimestampSortKey = (timestamp: string): string => {
+  const match = RFC3339_PATTERN.exec(timestamp);
+  if (!match) {
+    return timestamp;
+  }
+  return `${match[1]}.${(match[2] ?? '').padEnd(NANO_DIGITS, '0')}Z`;
+};
+
+/**
+ * Splits the timestamp Kubernetes prefixed onto each line from the line itself.
+ *
+ * A line that does not carry one (which should not happen, but a malformed or
+ * truncated log could produce it) inherits the previous line's key so it stays
+ * next to the line it belongs with, instead of sorting to the top.
+ */
+const toOrderedLines = (
+  replicaName: string,
+  lines: string[],
+  previousKey = '',
+): OrderedLine[] => {
+  let lastKey = previousKey;
+  return lines.map((line) => {
+    const match = TIMESTAMP_PATTERN.exec(line);
+    if (match) {
+      lastKey = toTimestampSortKey(match[1]);
+      return {
+        sortKey: lastKey,
+        replicaName,
+        timestamp: match[1],
+        message: match[2],
+      };
+    }
+    return { sortKey: lastKey, replicaName, timestamp: '', message: line };
+  });
+};
+
+/**
+ * Merges every replica's lines into one chronological stream.
+ *
+ * The keys are RFC3339 UTC strings of identical shape, so comparing them as
+ * strings orders them correctly and preserves the sub-millisecond precision
+ * that parsing into a `Date` would discard. Sorting is stable, so lines sharing
+ * a timestamp keep their original per-replica order.
+ */
+export const mergeReplicaLines = (
+  replicas: ServiceReplicaLog[],
+): OrderedLine[] =>
+  replicas
+    .flatMap((replica) =>
+      toOrderedLines(replica.replicaName, stripTrailingBlank(replica.lines)),
+    )
+    .sort((a, b) =>
+      a.sortKey < b.sortKey ? -1 : a.sortKey > b.sortKey ? 1 : 0,
+    );
+
+export const getServiceLogs = async (
+  args: Required<Pick<ServiceLogsOptions, 'serviceId'>> & ServiceLogsOptions,
+): Promise<void> => {
+  const serviceAccountToken = await getServiceAccountToken(
+    args.idServiceAuthBaseURL as string,
+    args.mosaicHostingClientId as string,
+    args.mosaicHostingClientSecret as string,
+  );
+
+  const axiosInstance: AxiosInstance = getAxiosInstance(
+    args.hostingServiceBaseURL as string,
+    serviceAccountToken.accessToken,
+  );
+
+  const query = `query GetServiceRuntimeLogs($serviceId: String!, $tailLines: Int, $sinceSeconds: Int) {
+    serviceRuntimeLogs(input: { serviceId: $serviceId, tailLines: $tailLines, sinceSeconds: $sinceSeconds }) {
+      replicas {
+        replicaName
+        lines
+      }
+    }
+  }`;
+
+  const payload = JSON.stringify({
+    query,
+    variables: {
+      serviceId: args.serviceId,
+      tailLines: args.tail,
+      sinceSeconds: parseSinceToSeconds(args.since),
+    },
+  });
+
+  try {
+    const response = await axiosInstance.post('graphql', payload);
+
+    if (response.data.errors !== undefined && response.data.errors.length > 0) {
+      writeStatus(
+        red(`Failed to retrieve logs for service [${args.serviceId}].`),
+      );
+      writeStatus(red(response.data.errors[0].message));
+      process.exit(exitCode);
+    }
+
+    const replicas: ServiceReplicaLog[] =
+      response.data.data?.serviceRuntimeLogs?.replicas ?? [];
+
+    const merged = mergeReplicaLines(replicas);
+
+    // Newline-delimited JSON: the same ordering as the human output, one object
+    // per line so it streams into `jq` and friends. The replica and timestamp
+    // are always present as fields, which is why --prefix and --timestamps do
+    // not apply here.
+    if (args.json) {
+      for (const line of merged) {
+        writeLogLine(
+          JSON.stringify({
+            replicaName: line.replicaName,
+            timestamp: line.timestamp,
+            message: line.message,
+          }),
+        );
+      }
+      return;
+    }
+
+    if (replicas.length === 0) {
+      writeStatus(
+        dim(`No running replicas found for service [${args.serviceId}].`),
+      );
+      return;
+    }
+
+    // With one replica the prefix is noise on every line; with several it is
+    // the only way to tell which replica said what.
+    const usePrefix = args.prefix ?? replicas.length > 1;
+
+    writeStatus(
+      dim(
+        `# ${args.serviceId}: ${replicas.length} replica(s)${
+          args.tail ? `, last ${args.tail} line(s) each` : ''
+        }`,
+      ),
+    );
+
+    for (const line of merged) {
+      // The service's own text is emitted verbatim: it may be plain text
+      // rather than JSON, and any reformatting would corrupt it.
+      const prefix = usePrefix
+        ? `[${toShortReplicaName(line.replicaName, args.serviceId)}] `
+        : '';
+      const stamp =
+        args.timestamps && line.timestamp ? `${line.timestamp} ` : '';
+      writeLogLine(`${prefix}${stamp}${line.message}`);
+    }
+  } catch (error) {
+    const axiosError = error as AxiosError;
+    writeStatus(
+      red(`Error while retrieving logs for service [${args.serviceId}].`),
+    );
+    writeStatus(red(`Error: ${axiosError.message}`));
+
+    if (axiosError.response) {
+      writeStatus(red(`Status: ${axiosError.response.status}`));
+      writeStatus(
+        red(`Response: ${JSON.stringify(axiosError.response.data, null, 2)}`),
+      );
+    }
+    process.exit(exitCode);
+  }
+};
+
+/**
+ * Validate arguments for reading service logs.
+ */
+export const validateServiceLogsArgs = (
+  args: ServiceLogsOptions,
+): [ServiceLogsOptions, string[]] => {
+  const errorMessages: string[] = [];
+
+  const idServiceAuthBaseURL =
+    args.idServiceAuthBaseURL ?? process.env.ID_SERVICE_AUTH_BASE_URL ?? '';
+  const mosaicHostingClientId =
+    args.mosaicHostingClientId ?? process.env.MOSAIC_HOSTING_CLIENT_ID ?? '';
+  const mosaicHostingClientSecret =
+    args.mosaicHostingClientSecret ??
+    process.env.MOSAIC_HOSTING_CLIENT_SECRET ??
+    '';
+  const hostingServiceBaseURL =
+    args.hostingServiceBaseURL ?? process.env.HOSTING_SERVICE_BASE_URL ?? '';
+
+  if (isNullOrWhitespace(idServiceAuthBaseURL)) {
+    errorMessages.push('[idServiceAuthBaseURL] is required.');
+  }
+  if (isNullOrWhitespace(mosaicHostingClientId)) {
+    errorMessages.push('[mosaicHostingClientId] is required.');
+  }
+  if (isNullOrWhitespace(mosaicHostingClientSecret)) {
+    errorMessages.push('[mosaicHostingClientSecret] is required.');
+  }
+  if (isNullOrWhitespace(hostingServiceBaseURL)) {
+    errorMessages.push('[hostingServiceBaseURL] is required.');
+  }
+  if (isNullOrWhitespace(args.serviceId)) {
+    errorMessages.push('[serviceId] is required.');
+  }
+  if (args.tail !== undefined && (args.tail < 1 || args.tail > 1000)) {
+    errorMessages.push('[tail] must be between 1 and 1000.');
+  }
+  if (
+    args.since !== undefined &&
+    parseSinceToSeconds(args.since) === undefined
+  ) {
+    errorMessages.push(
+      '[since] must be a positive age such as 30s, 5m, 2h or 1d.',
+    );
+  }
+
+  return [
+    {
+      ...args,
+      idServiceAuthBaseURL,
+      mosaicHostingClientId,
+      mosaicHostingClientSecret,
+      hostingServiceBaseURL,
+    },
+    errorMessages,
+  ];
+};

package/src/commands/hosting/service/service-commands.ts

@@ -1,5 +1,6 @@
 import type { CommandModule } from 'yargs';
 import { serviceDeploy } from './deploy/service-deploy-command.js';
+import { serviceLogs } from './runtime-logs/service-logs-command.js';
 import { serviceUndeploy } from './undeploy/service-undeploy-command.js';
 
 export const serviceCommands: CommandModule<unknown, unknown> = {
@@ -10,12 +11,16 @@ export const serviceCommands: CommandModule<unknown, unknown> = {
         'Deploy a service through Hosting Service.',
         serviceDeploy,
       )
-      .demandCommand()
       .command(
         'undeploy',
         'Undeploy a service through Hosting Service.',
         serviceUndeploy,
       )
+      .command(
+        'logs',
+        'Read the runtime logs of a deployed service.',
+        serviceLogs,
+      )
       .demandCommand(),
   handler: () => {
     console.log('Please pick an action related to hosting service command.');