stella inventory — Command Guide

Audience: compliance and platform operators who list, inspect, and export the tenant asset inventory for NIS2 reporting.

stella inventory exposes the NIS2 asset-inventory CLI surface over the shared Graph Asset Registry v1 schema. It runs either fully offline against a pinned asset-registry.v1 JSON file or live against the Graph asset runtime API.

Commands

stella inventory list --input asset-registry.json --format table
stella inventory list --input asset-registry.json --format json --tenant tenant-a
stella inventory show <asset-id> --input asset-registry.json --format json
stella inventory export --input asset-registry.json --format csv --output inventory.csv
stella inventory export --input asset-registry.json --format json --output inventory.json
stella inventory export --input asset-registry.json --format cyclonedx-bom --output inventory.cdx.json

stella inventory list --tenant tenant-a --format table
stella inventory show <asset-id> --tenant tenant-a --format json
stella inventory export --tenant tenant-a --format json --output inventory.json

When --input is present, the command reads only the supplied asset-registry.v1 JSON file and performs deterministic offline rendering. When --input is omitted, the command uses the configured backend client and the Graph asset runtime API:

• POST /graph/assets/query for inventory list
• GET /graph/assets/{assetId} for inventory show
• POST /graph/assets/export for inventory export

Live mode requires a configured backend URL, for example through STELLAOPS_BACKEND_URL or the active CLI profile. If no backend client/URL is available, the command fails closed with ERR_INVENTORY_BACKEND_UNCONFIGURED and does not fabricate inventory output.

Determinism

• Exports sort by tenantId, type, and assetId.
• exportedAt is derived from the newest asset lastSeen value, not wall-clock time.
• CSV and JSON output use stable field ordering and no machine-local paths.
• CycloneDX BOM serial numbers are derived from the sorted asset set.
• Live exports request Graph JSON and re-render through the same CLI CSV/JSON/CycloneDX pipeline used by offline input mode.

Fail-closed behavior

Both modes are deterministic — offline export from pinned asset-registry.v1 JSON input and live Graph asset registry list/show/export when --input is omitted. Runtime failures fail closed: unavailable backends, missing backend URLs, non-success Graph responses, schema mismatches, digest mismatches, and repeated cursors all exit non-zero rather than emitting placeholder data.

Related Documentation

• stella export — compliance bundle exports
• Output and exit codes