@logboard/cli 1.0.0

package/services/LogService.js

@@ -0,0 +1,1066 @@
+'use strict';
+const fs = require('fs');
+const fsP = require('fs').promises;
+const path = require('path');
+const readline = require('readline');
+const config = require('../config');
+const emitter = require('../lib/emitter');
+const logger = require('../lib/logger');
+const {
+	getToday,
+	sanitizeAppName,
+	sanitizeDate,
+	safeLogPath,
+	ensureDir,
+	formatBytes,
+} = require('../lib/utils');
+
+class LogService {
+	constructor (batchWriter, org) {
+		this.batchWriter  = batchWriter;
+		this._org     = org || null;
+		this._logsDir = (org && org.logsDir) ? org.logsDir : require('../config').LOG_BASE_DIR;
+	}
+
+	// ─── Ingest ──────────────────────────────────────────────────────────────
+
+	/**
+   * Normalise and ingest an array of raw log strings.
+   * Emits each log on the SSE emitter.
+   */
+	async ingest (rawLogs, defaultAppName = 'unknown') {
+		const today = getToday();
+		let written = 0;
+		const parsedBatch = [];
+
+		for (let i = 0; i < rawLogs.length; i++) {
+			const raw = rawLogs[i];
+			if (typeof raw !== 'string') {
+				throw Object.assign(new TypeError(`logs[${i}] must be a string`), {
+					status: 400,
+				});
+			}
+
+			// Resolve appName: line-level appName wins, but reserved names fall back to defaultAppName > param > 'unknown'
+			let appName = defaultAppName;
+			let parsed = null;
+			try {
+				parsed = JSON.parse(raw);
+				if (parsed) {
+					parsedBatch.push(parsed);
+				}
+				if (parsed?.appName) {
+					appName = parsed.appName;
+				}
+			} catch {}
+			try {
+				appName = sanitizeAppName(appName);
+			} catch {
+				appName = defaultAppName || '';
+			}
+			// Skip lines that would create reserved-name directories
+			const _RESV = [
+				'app',
+				'unknown',
+				'_archive',
+				'_tmp',
+				'logboard',
+				'system',
+			];
+			if (!appName || _RESV.includes(appName.toLowerCase())) {
+				appName = defaultAppName;
+			}
+			if (!appName || _RESV.includes(appName.toLowerCase())) {
+				continue;
+			}
+
+			// Handle nested api_request in data[] (some SDK versions wrap it)
+			// Extract and store separately in {appName}-requests/ folder
+			if (parsed && Array.isArray(parsed.data)) {
+				for (const item of parsed.data) {
+					if (item && item.type === 'api_request' && item.method && item.path) {
+						const reqAppName = appName.replace(/-requests$/, '') + '-requests';
+						const reqLine = JSON.stringify({
+							...item,
+							ts:      item.ts || parsed.ts || new Date().toISOString(),
+							level:   item.level || (item.statusCode >= 500 ? 'error' : item.statusCode >= 400 ? 'warn' : 'info'),
+							appName: reqAppName,
+						});
+						this.batchWriter.write(reqAppName, today, reqLine, this._logsDir);
+					}
+				}
+			}
+
+			// Auto-extract system_metrics into MetricsService
+			// Fix appName: old SDK sends 'app', override with resolved service name
+			if (parsed && parsed.type === 'system_metrics') {
+				if (!parsed.appName || parsed.appName === 'app') parsed.appName = appName;
+				try {
+					const MetricsService = require('./MetricsService');
+					new MetricsService(this._org).ingest(appName, {
+						ts: parsed.ts, cpuPct: parsed.cpu?.usedPct,
+						ramPct: parsed.ram?.usedPct, ramUsedMB: parsed.ram?.usedMB,
+						ramTotalMB: parsed.ram?.totalMB, diskPct: parsed.disk?.usedPct,
+						heapUsedMB: parsed.process?.heapUsedMB, heapTotalMB: parsed.process?.heapTotalMB,
+						heapPct: parsed.process?.heapUsedMB && parsed.process?.heapTotalMB
+							? Math.round(parsed.process.heapUsedMB / parsed.process.heapTotalMB * 100) : null,
+						rssMB: parsed.process?.rssMB, uptimeSec: parsed.process?.uptime,
+						nodeVersion: parsed.process?.version, hostname: parsed.hostname,
+					}).catch(() => {});
+				} catch {}
+			}
+			// Ensure structured JSON format on disk
+			const structured = parsed
+				? JSON.stringify({
+					ts: parsed.ts || new Date().toISOString(),
+					level: (parsed.level || 'info').toLowerCase(),
+					appName,
+					...parsed,
+				})
+				: JSON.stringify({
+					ts: new Date().toISOString(),
+					level: 'info',
+					appName,
+					message: raw,
+				});
+
+			this.batchWriter.write(appName, today, structured, this._logsDir);
+
+			// Alert on error level
+			const level = parsed?.level?.toLowerCase();
+			if (level === 'error' && config.WEBHOOK_URL) {
+				this._fireWebhook(structured).catch((err) =>
+					logger.warn(`[Alert] Webhook failed: ${err.message}`),
+				);
+			}
+
+			if (config.ENABLE_STREAM) {
+				emitter.emit('log', structured);
+			}
+			written++;
+		}
+		// Evaluate alert rules on the batch
+		if (parsedBatch.length) {
+			try {
+				const rules = require('./AlertRulesService');
+				const SettingsService = require('./SettingsService');
+				const settings = await new SettingsService(this._org).get();
+				rules.evaluate(parsedBatch, settings).catch(() => {});
+			} catch {}
+		}
+		return written;
+	}
+
+	async _fireWebhook (logStr) {
+		const axios = require('axios');
+		await axios.post(
+			config.WEBHOOK_URL,
+			{ alert: 'error_log', log: JSON.parse(logStr) },
+			{ timeout: 5000 },
+		);
+	}
+
+	// ─── List ─────────────────────────────────────────────────────────────────
+
+	async getServices () {
+		let dirs = [];
+		try {
+			dirs = await fsP.readdir(this._logsDir);
+		} catch (e) {
+			if (e.code !== 'ENOENT') {
+				throw e;
+			}
+		}
+		const results = [];
+		for (const app of dirs) {
+			const appPath = path.join(this._logsDir, app);
+			try {
+				const stat = await fsP.stat(appPath);
+				if (!stat.isDirectory()) {
+					continue;
+				}
+				const files = await fsP.readdir(appPath);
+				const dates = files
+					.filter((f) => /^\d{4}-\d{2}-\d{2}\.log$/.test(f))
+					.map((f) => f.slice(0, 10))
+					.sort()
+					.reverse();
+				let bytes = 0;
+				for (const f of files.filter((f) => f.endsWith('.log'))) {
+					try {
+						bytes += (await fsP.stat(path.join(appPath, f))).size;
+					} catch {}
+				}
+				// Skip reserved/internal appNames that should never appear in UI
+				if (
+					['app', 'unknown', '_archive', '_tmp', 'logboard', 'system'].includes(
+						app.toLowerCase(),
+					)
+				) {
+					continue;
+				}
+				// Skip reserved/internal names
+				const _reserved = [
+					'app',
+					'unknown',
+					'_archive',
+					'_tmp',
+					'logboard',
+					'system',
+				];
+				if (_reserved.includes(app.toLowerCase())) {
+					continue;
+				}
+				results.push({
+					appName: app,
+					dates,
+					bytes,
+					bytesHuman: formatBytes(bytes),
+				});
+			} catch {}
+		}
+		return results;
+	}
+
+	// ─── Tail ─────────────────────────────────────────────────────────────────
+
+	async tail (appName, date, lines = 100) {
+		appName = sanitizeAppName(appName);
+		date = sanitizeDate(date);
+		const filePath = safeLogPath(this._logsDir, appName, date);
+		if (!fs.existsSync(filePath)) {
+			return { appName, date, lines: [] };
+		}
+
+		return new Promise((resolve, reject) => {
+			const stream = fs.createReadStream(filePath, 'utf8');
+			const rl = readline.createInterface({
+				input: stream,
+				crlfDelay: Infinity,
+			});
+			const buffer = [];
+			rl.on('line', (l) => {
+				if (l.trim()) {
+					buffer.push(l);
+					if (buffer.length > lines) {
+						buffer.shift();
+					}
+				}
+			});
+			rl.on('close', () => resolve({ appName, date, lines: buffer }));
+			rl.on('error', reject);
+			stream.on('error', reject);
+		});
+	}
+
+	// ─── Search ───────────────────────────────────────────────────────────────
+
+	/**
+   * Search log files.
+   * @param {object} opts - { service, level, q, date, limit, offset }
+   */
+	async search ({ service, level, q, date, limit = 500, offset = 0 }) {
+		limit = Math.min(parseInt(limit, 10) || 500, 5000);
+		 
+		offset = Math.max(parseInt(offset, 10) || 0, 0);
+
+		// Determine which files to search
+		const filesToSearch = await this._resolveFiles(service, date);
+		const matches = [];
+		let scanned = 0;
+		let skipped = 0;
+
+		for (const { appName: svc, filePath } of filesToSearch) {
+			if (!fs.existsSync(filePath)) {
+				continue;
+			}
+			 
+			await new Promise((resolve, reject) => {
+				const stream = fs.createReadStream(filePath, 'utf8');
+				const rl = readline.createInterface({
+					input: stream,
+					crlfDelay: Infinity,
+				});
+				rl.on('line', (line) => {
+					if (!line.trim()) {
+						return;
+					}
+					scanned++;
+					try {
+						const parsed = JSON.parse(line);
+						if (level && parsed.level !== level) {
+							return;
+						}
+						if (q && !line.toLowerCase().includes(q.toLowerCase())) {
+							return;
+						}
+						if (skipped < offset) {
+							skipped++;
+							return;
+						}
+						if (matches.length < limit) {
+							matches.push({ ...parsed, _appName: svc });
+						}
+					} catch {
+						if (q && !line.toLowerCase().includes(q.toLowerCase())) {
+							return;
+						}
+						if (skipped < offset) {
+							skipped++;
+							return;
+						}
+						if (matches.length < limit) {
+							matches.push({ _raw: line, _appName: svc });
+						}
+					}
+				});
+				rl.on('close', resolve);
+				rl.on('error', reject);
+				stream.on('error', reject);
+			});
+			if (matches.length >= limit) {
+				break;
+			}
+		}
+		return { matches, total: matches.length, scanned, offset, limit };
+	}
+
+	// ─── Replay ───────────────────────────────────────────────────────────────
+
+	/** Return logs written in the last `minutes` minutes across all services */
+	async replay (minutes = 30) {
+		minutes = Math.min(parseInt(minutes, 10) || 30, 1440);
+		const cutoff = new Date(Date.now() - minutes * 60_000);
+		const today = getToday();
+		const results = [];
+
+		const services = await this.getServices();
+		for (const { appName } of services) {
+			const filePath = safeLogPath(this._logsDir, appName, today);
+			if (!fs.existsSync(filePath)) {
+				continue;
+			}
+			 
+			await new Promise((resolve) => {
+				const stream = fs.createReadStream(filePath, 'utf8');
+				const rl = readline.createInterface({
+					input: stream,
+					crlfDelay: Infinity,
+				});
+				rl.on('line', (line) => {
+					if (!line.trim()) {
+						return;
+					}
+					try {
+						const parsed = JSON.parse(line);
+						if (new Date(parsed.ts) >= cutoff) {
+							results.push({ ...parsed, _appName: appName });
+						}
+					} catch {}
+				});
+				rl.on('close', resolve);
+				rl.on('error', resolve);
+				stream.on('error', resolve);
+			});
+		}
+		results.sort((a, b) => new Date(a.ts) - new Date(b.ts));
+		return results;
+	}
+
+	// ─── Download (streamed, filtered) ───────────────────────────────────────
+
+	async download (appName, date, filters, res) {
+		appName = sanitizeAppName(appName);
+		 
+		date = sanitizeDate(date);
+		const filePath = safeLogPath(this._logsDir, appName, date);
+		if (!fs.existsSync(filePath)) {
+			throw Object.assign(new Error('Log file not found'), { status: 404 });
+		}
+
+		const { level, q } = filters;
+		res.setHeader(
+			'Content-Disposition',
+			`attachment; filename="${appName}-${date}.log"`,
+		);
+		res.setHeader('Content-Type', 'text/plain');
+
+		if (!level && !q) {
+			fs.createReadStream(filePath).pipe(res);
+			return;
+		}
+
+		const stream = fs.createReadStream(filePath, 'utf8');
+		const rl = readline.createInterface({ input: stream, crlfDelay: Infinity });
+		rl.on('line', (line) => {
+			if (!line.trim()) {
+				return;
+			}
+			try {
+				const p = JSON.parse(line);
+				if (level && p.level !== level) {
+					return;
+				}
+				if (q && !line.toLowerCase().includes(q.toLowerCase())) {
+					return;
+				}
+			} catch {
+				if (q && !line.toLowerCase().includes(q.toLowerCase())) {
+					return;
+				}
+			}
+			res.write(`${line}\n`);
+		});
+		rl.on('close', () => res.end());
+		rl.on('error', (err) => {
+			logger.error(`[Download] ${err.message}`);
+			res.end();
+		});
+		stream.on('error', (err) => {
+			logger.error(`[Download] ${err.message}`);
+			res.end();
+		});
+	}
+
+	// ─── Helpers ──────────────────────────────────────────────────────────────
+
+	async _resolveFiles (service, date) {
+		const files = [];
+		if (service && date) {
+			try {
+				sanitizeAppName(service);
+				sanitizeDate(date);
+			} catch {
+				return [];
+			}
+			files.push({
+				appName: service,
+				filePath: safeLogPath(this._logsDir, service, date),
+			});
+		} else if (service) {
+			try {
+				sanitizeAppName(service);
+			} catch {
+				return [];
+			}
+			const appDir = path.join(this._logsDir, service);
+			let allFiles = [];
+			try {
+				allFiles = await fsP.readdir(appDir);
+			} catch {}
+			for (const f of allFiles
+				 
+				.filter((f) => /^\d{4}-\d{2}-\d{2}\.log$/.test(f))
+				.sort()
+				.reverse()) {
+				files.push({ appName: service, filePath: path.join(appDir, f) });
+			}
+		} else {
+			const services = await this.getServices();
+			const targetDate = date || getToday();
+			for (const { appName } of services) {
+				try {
+					sanitizeDate(targetDate);
+					files.push({
+						appName,
+						filePath: safeLogPath(this._logsDir, appName, targetDate),
+					});
+				} catch {}
+			}
+		}
+		return files;
+	}
+
+	// ── Error clustering across a date range ─────────────────────────────────
+	async clusterErrorsRange (appName, fromDate, toDate) {
+		appName = sanitizeAppName(appName);
+		sanitizeDate(fromDate);
+		sanitizeDate(toDate);
+		const clusters = {};
+		const appDir = path.join(this._logsDir, appName);
+		let files = [];
+		try {
+			files = (await fsP.readdir(appDir)).filter((f) =>
+				/^\d{4}-\d{2}-\d{2}\.log$/.test(f),
+			);
+		} catch {}
+		const inRange = files
+			.filter((f) => {
+				const d = f.slice(0, 10);
+				return d >= fromDate && d <= toDate;
+			})
+			.sort();
+
+		for (const fname of inRange) {
+			const fp = path.join(appDir, fname);
+			 
+			await new Promise((resolve) => {
+				const rl = readline.createInterface({
+					input: fs.createReadStream(fp, 'utf8'),
+					crlfDelay: Infinity,
+				});
+				rl.on('line', (line) => {
+					if (!line.trim()) {
+						return;
+					}
+					try {
+						const p = JSON.parse(line);
+						if ((p.level || '').toLowerCase() !== 'error') {
+							return;
+						}
+						const norm = (p.message || line)
+							.replace(/[0-9a-f]{8}-[0-9a-f-]{27}/gi, '<uuid>')
+							.replace(/\d+/g, 'N')
+							.replace(/["'][^"']{20,}["']/g, '"<str>"')
+							.slice(0, 100);
+						if (!clusters[norm]) {
+							clusters[norm] = {
+								pattern: norm,
+								count: 0,
+								first: p.ts,
+								last: p.ts,
+								examples: [],
+							};
+						}
+						clusters[norm].count++;
+						if (p.ts > clusters[norm].last) {
+							clusters[norm].last = p.ts;
+						}
+						if (p.ts < clusters[norm].first) {
+							clusters[norm].first = p.ts;
+						}
+						if (clusters[norm].examples.length < 3) {
+							clusters[norm].examples.push(p.message || line);
+						}
+					} catch {}
+				});
+				rl.on('close', resolve);
+				rl.on('error', resolve);
+			});
+		}
+		return Object.values(clusters).sort((a, b) => b.count - a.count);
+	}
+
+	// ─── NEW: time-range search (local tz offset from client) ────────────────
+	async searchTimeRange (
+		appName,
+		date,
+		{ fromTime, toTime, level, q, tzOffset = 0, limit = 500 },
+	) {
+		const filePath = safeLogPath(this._logsDir, appName, date);
+		if (!fs.existsSync(filePath)) {
+			return { lines: [], total: 0 };
+		}
+
+		// tzOffset is in minutes (client's getTimezoneOffset() — note: sign is INVERTED in JS)
+		// To convert UTC log ts to local: local = UTC - tzOffset minutes
+		const fromMs = fromTime
+			? new Date(`${date}T${fromTime}:00Z`).getTime() + tzOffset * 60_000
+			: null;
+		const toMs = toTime
+			? new Date(`${date}T${toTime}:59Z`).getTime() + tzOffset * 60_000
+			: null;
+
+		const lines = [];
+		await new Promise((resolve) => {
+			const rl = readline.createInterface({
+				input: fs.createReadStream(filePath, 'utf8'),
+				crlfDelay: Infinity,
+			});
+			rl.on('line', (line) => {
+				if (!line.trim() || lines.length >= limit) {
+					return;
+				}
+				try {
+					const p = JSON.parse(line);
+					const ts = new Date(p.ts).getTime();
+					if (fromMs && ts < fromMs) {
+						return;
+					}
+					if (toMs && ts > toMs) {
+						return;
+					}
+					if (level && (p.level || '').toLowerCase() !== level) {
+						return;
+					}
+					if (q && !line.toLowerCase().includes(q.toLowerCase())) {
+						return;
+					}
+					lines.push(line);
+				} catch {
+					if (q && !line.toLowerCase().includes(q.toLowerCase())) {
+						return;
+					}
+					lines.push(line);
+				}
+			});
+			rl.on('close', resolve);
+			rl.on('error', resolve);
+		});
+		return { lines, total: lines.length };
+	}
+
+	// ─── NEW: context lines (N before + N after a line index) ────────────────
+	async getContext (appName, date, lineIndex, contextN = 10) {
+		const filePath = safeLogPath(this._logsDir, appName, date);
+		if (!fs.existsSync(filePath)) {
+			return [];
+		}
+		const allLines = [];
+		await new Promise((resolve) => {
+			const rl = readline.createInterface({
+				input: fs.createReadStream(filePath, 'utf8'),
+				crlfDelay: Infinity,
+			});
+			rl.on('line', (l) => {
+				if (l.trim()) {
+					allLines.push(l);
+				}
+			});
+			rl.on('close', resolve);
+			rl.on('error', resolve);
+		});
+		const start = Math.max(0, lineIndex - contextN);
+		const end = Math.min(allLines.length - 1, lineIndex + contextN);
+		return allLines.slice(start, end + 1).map((line, i) => ({
+			line,
+			index: start + i,
+			isFocus: start + i === lineIndex,
+		}));
+	}
+
+	// ─── NEW: download as .txt (human-readable, one line per log) ────────────
+	async downloadTxt (appName, date, filters, res) {
+		appName = sanitizeAppName(appName);
+		date = sanitizeDate(date);
+		const filePath = safeLogPath(this._logsDir, appName, date);
+		if (!fs.existsSync(filePath)) {
+			throw Object.assign(new Error('Log file not found'), { status: 404 });
+		}
+
+		const { level, q, fromTime, toTime, tzOffset = 0 } = filters;
+		const fromMs = fromTime
+			? new Date(`${date}T${fromTime}:00Z`).getTime()
+        + Number(tzOffset) * 60_000
+			: null;
+		const toMs = toTime
+			? new Date(`${date}T${toTime}:59Z`).getTime() + Number(tzOffset) * 60_000
+			: null;
+
+		res.setHeader(
+			'Content-Disposition',
+			`attachment; filename="${appName}-${date}.txt"`,
+		);
+		res.setHeader('Content-Type', 'text/plain; charset=utf-8');
+
+		const stream = fs.createReadStream(filePath, 'utf8');
+		const rl = readline.createInterface({ input: stream, crlfDelay: Infinity });
+		rl.on('line', (line) => {
+			if (!line.trim()) {
+				return;
+			}
+			try {
+				const p = JSON.parse(line);
+				const ts = new Date(p.ts).getTime();
+				if (fromMs && ts < fromMs) {
+					return;
+				}
+				if (toMs && ts > toMs) {
+					return;
+				}
+				if (level && (p.level || '').toLowerCase() !== level) {
+					return;
+				}
+				if (q && !line.toLowerCase().includes(q.toLowerCase())) {
+					return;
+				}
+				const localTs = p.ts ? new Date(p.ts).toLocaleString() : '';
+				const lvl = (p.level || 'INFO').toUpperCase().padEnd(5);
+				const msg = p.message || line;
+				res.write(`[${localTs}] [${lvl}] [${p.appName || appName}] ${msg}\n`);
+			} catch {
+				if (q && !line.toLowerCase().includes(q.toLowerCase())) {
+					return;
+				}
+				res.write(`${line}\n`);
+			}
+		});
+		rl.on('close', () => res.end());
+		rl.on('error', (err) => res.end());
+		stream.on('error', (err) => res.end());
+	}
+
+	// ── Multi-date search ────────────────────────────────────────────────────
+	async searchMultiDate (
+		appName,
+		fromDate,
+		toDate,
+		{ level, q, limit = 500 } = {},
+	) {
+		appName = sanitizeAppName(appName);
+		sanitizeDate(fromDate);
+		sanitizeDate(toDate);
+		const lines = [],
+			seen = new Set();
+		const appDir = path.join(this._logsDir, appName);
+		let allFiles = [];
+		try {
+			allFiles = await fsP.readdir(appDir);
+		} catch {}
+		const dateFiles = allFiles
+			.filter((f) => /^\d{4}-\d{2}-\d{2}\.log$/.test(f))
+			.filter((f) => {
+				const d = f.slice(0, 10);
+				return d >= fromDate && d <= toDate;
+			})
+			.sort();
+		for (const fname of dateFiles) {
+			if (lines.length >= limit) {
+				break;
+			}
+			const fp = path.join(appDir, fname);
+			await new Promise((resolve) => {
+				const rl = readline.createInterface({
+					input: fs.createReadStream(fp, 'utf8'),
+					crlfDelay: Infinity,
+				});
+				rl.on('line', (line) => {
+					if (!line.trim() || lines.length >= limit) {
+						return;
+					}
+					try {
+						const p = JSON.parse(line);
+						if (level && (p.level || '').toLowerCase() !== level) {
+							return;
+						}
+						if (q && !line.toLowerCase().includes(q.toLowerCase())) {
+							return;
+						}
+					} catch {
+						if (q && !line.toLowerCase().includes(q.toLowerCase())) {
+							return;
+						}
+					}
+					lines.push(line);
+				});
+				rl.on('close', resolve);
+				rl.on('error', resolve);
+			});
+		}
+		return { lines, total: lines.length, fromDate, toDate };
+	}
+
+	// ── Log diff ─────────────────────────────────────────────────────────────
+	async getDiff (appName, dateA, dateB) {
+		appName = sanitizeAppName(appName);
+		sanitizeDate(dateA);
+		sanitizeDate(dateB);
+		const countPatterns = async (date) => {
+			const fp = safeLogPath(this._logsDir, appName, date);
+			const patterns = {};
+			if (!fs.existsSync(fp)) {
+				return { patterns, total: 0, errors: 0 };
+			}
+			let total = 0,
+				errors = 0;
+			await new Promise((resolve) => {
+				const rl = readline.createInterface({
+					input: fs.createReadStream(fp, 'utf8'),
+					crlfDelay: Infinity,
+				});
+				rl.on('line', (line) => {
+					if (!line.trim()) {
+						return;
+					}
+					total++;
+					try {
+						const p = JSON.parse(line);
+						const lvl = (p.level || 'info').toLowerCase();
+						if (lvl === 'error' || lvl === 'fatal') {
+							errors++;
+							// Normalise message: strip numbers/uuids for grouping
+							const msg = (p.message || '')
+								.replace(/[0-9a-f]{8}-[0-9a-f-]{27}/gi, '<uuid>')
+								.replace(/\d+/g, 'N')
+								.slice(0, 120);
+							patterns[msg] = (patterns[msg] || 0) + 1;
+						}
+					} catch {}
+				});
+				rl.on('close', resolve);
+				rl.on('error', resolve);
+			});
+			return { patterns, total, errors };
+		};
+		const [a, b] = await Promise.all([
+			countPatterns(dateA),
+			countPatterns(dateB),
+		]);
+		const allKeys = new Set([
+			...Object.keys(a.patterns),
+			...Object.keys(b.patterns),
+		]);
+		const rows = [];
+		for (const msg of allKeys) {
+			const ca = a.patterns[msg] || 0,
+				cb = b.patterns[msg] || 0;
+			rows.push({
+				msg,
+				countA: ca,
+				countB: cb,
+				delta: cb - ca,
+				pct: ca === 0 ? null : Math.round(((cb - ca) / ca) * 100),
+			});
+		}
+		rows.sort((x, y) => Math.abs(y.delta) - Math.abs(x.delta));
+		return {
+			dateA,
+			dateB,
+			totalA: a.total,
+			totalB: b.total,
+			errorsA: a.errors,
+			errorsB: b.errors,
+			rows: rows.slice(0, 50),
+		};
+	}
+
+	// ── Service dependency map — requestId + name cross-referencing ───────────
+	async getServiceMap (date) {
+		sanitizeDate(date);
+		const services = await this.getServices();
+		const nodes = new Set();
+		const traceMap = {}; // traceId → [appName, ...]
+		const edges = {}; // "A→B" → count
+
+		// Pass 1: collect all requestIds per service
+		for (const { appName } of services) {
+			const fp = safeLogPath(this._logsDir, appName, date);
+			if (!fs.existsSync(fp)) {
+				continue;
+			}
+			nodes.add(appName);
+			await new Promise((resolve) => {
+				const rl = readline.createInterface({
+					input: fs.createReadStream(fp, 'utf8'),
+					crlfDelay: Infinity,
+				});
+				rl.on('line', (line) => {
+					if (!line.trim()) {
+						return;
+					}
+					try {
+						const p = JSON.parse(line);
+						// Use requestId, traceId, or correlationId for cross-service linking
+						const tid
+              = p.requestId || p.traceId || p.correlationId || p['x-request-id'];
+						if (tid && typeof tid === 'string' && tid.length > 4) {
+							if (!traceMap[tid]) {
+								traceMap[tid] = new Set();
+							}
+							traceMap[tid].add(appName);
+						}
+						// Fallback: name-in-log heuristic
+						const str = JSON.stringify(p);
+						for (const { appName: other } of services) {
+							if (other !== appName && str.includes(other)) {
+								const key = `${appName}→${other}`;
+								edges[key] = (edges[key] || 0) + 0.5; // lower weight than requestId
+							}
+						}
+					} catch {}
+				});
+				rl.on('close', resolve);
+				rl.on('error', resolve);
+			});
+		}
+
+		// Pass 2: build edges from shared requestIds
+		for (const [, svcs] of Object.entries(traceMap)) {
+			const arr = [...svcs];
+			for (let i = 0; i < arr.length; i++) {
+				for (let j = i + 1; j < arr.length; j++) {
+					const key = `${arr[i]}→${arr[j]}`;
+					edges[key] = (edges[key] || 0) + 1;
+				}
+			}
+		}
+
+		return {
+			nodes: [...nodes].map((n) => ({ id: n, label: n })),
+			edges: Object.entries(edges)
+				.filter(([, w]) => w >= 1)
+				.map(([k, w]) => {
+					const [s, t] = k.split('→');
+					return { source: s, target: t, weight: Math.round(w) };
+				})
+				.sort((a, b) => b.weight - a.weight),
+			traceCount: Object.keys(traceMap).length,
+		};
+	}
+
+	// ── Error clustering ─────────────────────────────────────────────────────
+	async clusterErrors (appName, date) {
+		appName = sanitizeAppName(appName);
+		sanitizeDate(date);
+		const fp = safeLogPath(this._logsDir, appName, date);
+		if (!fs.existsSync(fp)) {
+			return [];
+		}
+		const clusters = {};
+		await new Promise((resolve) => {
+			const rl = readline.createInterface({
+				input: fs.createReadStream(fp, 'utf8'),
+				crlfDelay: Infinity,
+			});
+			rl.on('line', (line) => {
+				if (!line.trim()) {
+					return;
+				}
+				try {
+					const p = JSON.parse(line);
+					if ((p.level || '').toLowerCase() !== 'error') {
+						return;
+					}
+					const norm = (p.message || line)
+						.replace(/[0-9a-f]{8}-[0-9a-f-]{27}/gi, '<uuid>')
+						.replace(/\d+/g, 'N')
+						.replace(/["'][^"']{20,}["']/g, '"<str>"')
+						.slice(0, 100);
+					if (!clusters[norm]) {
+						clusters[norm] = {
+							pattern: norm,
+							count: 0,
+							first: p.ts,
+							last: p.ts,
+							examples: [],
+						};
+					}
+					clusters[norm].count++;
+					clusters[norm].last = p.ts;
+					if (clusters[norm].examples.length < 3) {
+						clusters[norm].examples.push(p.message || line);
+					}
+				} catch {}
+			});
+			rl.on('close', resolve);
+			rl.on('error', resolve);
+		});
+		return Object.values(clusters).sort((a, b) => b.count - a.count);
+	}
+
+	// ── Anomaly detection ────────────────────────────────────────────────────
+	async detectAnomalies (appName) {
+		appName = sanitizeAppName(appName);
+		const today = getToday();
+		const appDir = path.join(this._logsDir, appName);
+		let files = [];
+		try {
+			files = (await fsP.readdir(appDir))
+				.filter((f) => /^\d{4}-\d{2}-\d{2}\.log$/.test(f))
+				.sort()
+				.slice(-30);
+		} catch {}
+		const dailyErrors = [];
+		for (const fname of files) {
+			const fp = path.join(appDir, fname);
+			const counts = await this._countLevels(fp).catch(() => ({
+				total: 0,
+				error: 0,
+			}));
+			dailyErrors.push({
+				date: fname.slice(0, 10),
+				errors: counts.error || 0,
+				total: counts.total || 0,
+			});
+		}
+		if (dailyErrors.length < 7) {
+			return { anomalies: [], baseline: 0, dailyErrors };
+		}
+		// Compute baseline mean + stddev (excluding last 1 day)
+		const baseline = dailyErrors.slice(0, -1);
+		const mean = baseline.reduce((a, b) => a + b.errors, 0) / baseline.length;
+		const stddev = Math.sqrt(
+			baseline.reduce((a, b) => a + Math.pow(b.errors - mean, 2), 0)
+        / baseline.length,
+		);
+		const threshold = mean + 2 * stddev;
+		const anomalies = dailyErrors.filter(
+			(d) => d.errors > threshold && d.errors > mean * 1.5,
+		);
+		return {
+			anomalies,
+			baseline: Math.round(mean),
+			stddev: Math.round(stddev),
+			threshold: Math.round(threshold),
+			dailyErrors,
+		};
+	}
+
+	// ── Trace ID linking ────────────────────────────────────────────────────
+	async findByTraceId (traceId, date) {
+		if (!traceId) {
+			throw Object.assign(new Error('traceId required'), { status: 400 });
+		}
+		date = date || getToday();
+		sanitizeDate(date);
+		const services = await this.getServices();
+		const results = [];
+		const clean = traceId.replace(/[^a-zA-Z0-9_\-]/g, '').slice(0, 128);
+		for (const { appName } of services) {
+			const fp = safeLogPath(this._logsDir, appName, date);
+			if (!fs.existsSync(fp)) {
+				continue;
+			}
+			await new Promise((resolve) => {
+				const rl = readline.createInterface({
+					input: fs.createReadStream(fp, 'utf8'),
+					crlfDelay: Infinity,
+				});
+				rl.on('line', (line) => {
+					if (line.includes(clean)) {
+						try {
+							results.push({ ...JSON.parse(line), _appName: appName });
+						} catch {
+							results.push({ raw: line, _appName: appName });
+						}
+					}
+				});
+				rl.on('close', resolve);
+				rl.on('error', resolve);
+			});
+		}
+		results.sort((a, b) => new Date(a.ts || 0) - new Date(b.ts || 0));
+		return results;
+	}
+
+	async _countLevels (filePath) {
+		const counts = { total: 0, error: 0, warn: 0, info: 0, debug: 0 };
+		if (!fs.existsSync(filePath)) {
+			return counts;
+		}
+		await new Promise((resolve) => {
+			const rl = readline.createInterface({
+				input: fs.createReadStream(filePath, 'utf8'),
+				crlfDelay: Infinity,
+			});
+			rl.on('line', (line) => {
+				if (!line.trim()) {
+					return;
+				}
+				counts.total++;
+				try {
+					const p = JSON.parse(line);
+					const l = (p.level || 'info').toLowerCase();
+					if (counts[l] !== undefined) {
+						counts[l]++;
+					}
+				} catch {}
+			});
+			rl.on('close', resolve);
+			rl.on('error', resolve);
+		});
+		return counts;
+	}
+}
+
+module.exports = LogService;