Command IDs are stored on the ledger, you can get it from the transaction service. However, they are only exposed to the submitting party. The transaction stream is replayable. You can supply a starting offset.
I’ve spun out the second question into Mapping ledger commands to user sessions that submitted them