Stella CLI: export commands

Verified against commit 942a18727c (2026-09-26): BuildExportCommand in src/Cli/StellaOps.Cli/Commands/CommandFactory.cs and the command groups it adds. Re-verify with stella export --help.

The stella export command has two kinds of subcommands: offline producers that build and verify a signed bundle locally from files you supply, and service clients for the export plane that offlinekit-web serves under /api/offlinekit/v1/**.

1. Offline producers

These run without a backend and are the supported way to produce the assurance bundles on an air-gapped workstation. Each command verifies the bundle it wrote before reporting success.

The service-side equivalents are listed in profiles.md (Assurance export profile catalogue).

1.1 stella export nis2-soa

stella export nis2-soa \
  --since 2026-04-01 \
  --snapshot out/policy/nis2-control-register.json \
  --tenant tenant-a \
  --signing-key-file keys/offline-soa-hmac.key \
  --signing-key-id offline-soa-key \
  --evidence-locker-bundle-ref evidence-locker://bundles/sha256:... \
  --output out/nis2-soa.bundle.json \
  --json

• --snapshot must contain a nis2-control-register-v1 Policy snapshot.
• --tenant-profile may contain a local tenant-compliance-profile.v1 document with nis2 in regulatedRegimes. When it is omitted, the CLI resolves the tenant from --tenant, STELLAOPS_TENANT or the active CLI tenant profile and reads GET /api/v1/tenants/{tenantId}/compliance-profile from Authority, which requires STELLAOPS_AUTHORITY_URL and a token with authority:tenants.read.
• --signing-key-file supplies the deterministic HMAC key for the DSSE-shaped envelope. This is the file-backed offline slice, not production compliance signing; the service path signs through ICryptoProviderRegistry (see provenance-and-signing.md).
• --redact-internal-only removes internal descriptions and metadata from exported controls.

1.2 stella export nis2-effectiveness

stella export nis2-effectiveness \
  --month 2026-04 \
  --report out/platform/nis2-effectiveness-dashboard.json \
  --signing-key-file keys/nis2-effectiveness.hmac \
  --signing-key-id offline-nis2-effectiveness \
  --target-document-ref policy://target-documents/nis2/2026-04 \
  --control-register-snapshot-ref policy://control-registers/nis2/2026-04 \
  --policy-snapshot-ref policy://snapshots/nis2/2026-04 \
  --output out/nis2-effectiveness-tenant-a-202604.bundle.json \
  --json

The command consumes a local nis2-effectiveness-dashboard-v1 report (exactly 13 areas numbered 1 through 13) and writes the bundle with the normalized source report, the monthly nis2-effectiveness-report-v1 report, manifest entry hashes and an HMAC DSSE-shaped signature (--signing-key-file or STELLAOPS_NIS2_EFFECTIVENESS_HMAC_KEY). Missing refs are preserved as report blockers rather than synthesized. Verify offline with:

stella verify nis2-effectiveness \
  --bundle out/nis2-effectiveness-tenant-a-202604.bundle.json \
  --signing-key-file keys/nis2-effectiveness.hmac \
  --signing-key-id offline-nis2-effectiveness \
  --json

2. Service clients

These commands call the export plane that offlinekit-web serves under /api/offlinekit/v1/exports (see ../offlinekit/api-reference.md), through the gateway at the configured backend URL. The read commands request a token with export.viewer; export start requests export.operator export.viewer. Both carry the CLI’s tenant (STELLAOPS_AUTHORITY_TENANT first) in the token and in the tenant header.

The list commands page by offset: the server returns at most 100 items per page (50 by default), and the table output prints the --offset of the next page. export start starts a run from an active profile (POST .../profiles/{profileId}/runs); a draft, paused or archived profile is rejected, and the host can answer 429 when a tenant or profile concurrency limit is reached. export runs download fetches one artifact (GET .../runs/{runId}/artifacts/{artifactId}/download); take the artifact id from export runs show.

Carriers written by export runs are downloaded with stella airgap pull --run <runId> and imported on another estate with stella airgap import (see ../airgap/guides/importer.md).

3. Offline verification of an export kit

docs/modules/export-center/operations/verify-export-kit.sh <kit_dir> checks a kit directory’s manifest hash, rerun hash, integrity headers against OCI annotations, cross-tenant approval and quota blocks, and provenance log metadata. The fixture it is exercised against is src/OfflineKit/__fixtures/export-kit/. See determinism.md for what the service itself emits.

4. Related documentation

• Export profiles
• OfflineKit architecture
• Risk-bundle provider matrix

The design-era guide to export verbs (profile, run, download, manifest, provenance, verify), exit codes 10 to 30 and the GitHub Actions recipe described commands that do not exist in the CLI and was removed on 2026-09-26; git history holds it.