feat(cli): add export command to generate desired-state YAML from current state

[rohilsurana]

What

Adds frontier export <kind>, a top-level sibling of frontier reconcile. It reads the current state of one kind from the server through the admin API and prints it as a desired-state YAML document, the same format reconcile reads. Output goes to stdout only — redirect it to save a file. YAML is the only format.

$ frontier export platformuser --host <host> -H "Authorization:Basic <base64>" > platform-users.yaml
kind: PlatformUser
spec:
    - type: user
      ref: alice@example.org
      relation: admin

The reconcile command is unchanged. The kind argument is case-insensitive and accepts a plural, so platformusers finds PlatformUser. An unknown kind lists the available ones.

Both reconcile and export are now documented in the CLI reference (reconcile was missing from it).

Why

When an environment adopts the reconcile flow, its first desired-state file must match what already exists on the server. If it does not, the first apply makes unwanted changes. Writing that file by hand from list APIs is slow and easy to get wrong.

How

• New optional Exporter interface next to Reconciler in internal/reconcile. A kind that implements it can be exported. Kinds that do not implement it return a clear error.
• PlatformUser implements it: one entry per principal and relation — a user or service user holding both admin and member exports as two entries. Users are referenced by email when they have one, service users by id. The bootstrap service account is skipped, the same as in reconcile.
• Output is sorted, so re-running the export gives the same file and git diffs stay clean.
• An empty platform exports spec: [], which reconcile accepts as an intentional empty list.
• The kind registry moved to a shared helper, so new kinds register once for both reconcile and export.

Guarantees covered by tests

• Feeding the export output straight back into reconcile --dry-run reports no changes, including principals that hold both relations.
• Export of an empty platform round-trips the same way.
• Unknown kinds and kinds without export support fail with clear errors.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
frontier	Ready	Preview, Comment	Jul 3, 2026 10:26am

[coderabbitai]

Warning

Review limit reached

@rohilsurana, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 3 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: f077c78d-eec2-4ca0-92a7-88a7c31c993c

📥 Commits

Reviewing files that changed from the base of the PR and between 987ae62 and 5502e7c.

📒 Files selected for processing (9)

• cmd/export.go
• cmd/export_test.go
• cmd/reconcile.go
• cmd/root.go
• docs/content/docs/reference/cli.mdx
• internal/reconcile/platformuser_reconciler.go
• internal/reconcile/platformuser_reconciler_test.go
• internal/reconcile/reconcile.go
• internal/reconcile/reconcile_test.go

📝 Walkthrough

Walkthrough

Adds an export capability to the reconcile framework: an Exporter interface and Export function in internal/reconcile, a PlatformUserReconciler.Export implementation producing sorted specs, and a new frontier export <kind> CLI command replacing the previous reconcile registration wiring in root and reconcile commands.

Changes

Reconcile Export Feature

Layer / File(s)	Summary
Exporter interface and Export function internal/reconcile/reconcile.go, internal/reconcile/reconcile_test.go	Adds Exporter interface and Export(ctx, registry, kind) function marshaling a reconciler's spec into a YAML document, with error tests for unknown kind and unsupported export.
PlatformUserReconciler.Export implementation internal/reconcile/platformuser_reconciler.go, internal/reconcile/platformuser_reconciler_test.go	Implements Export producing one PlatformUserSpec per principal/relation, using email or ID as Ref, sorted by Type/Ref/Relation; tests cover sorting, bootstrap exclusion, email fallback, and reconcile idempotency after export.
Reconcile command registry refactor cmd/reconcile.go	Extracts inline registry construction into a reconcileRegistry helper, imports frontierv1beta1connect, and updates help text to reference frontier export.
Export command for printing current state cmd/export.go, cmd/root.go	Adds ExportCommand supporting --output and --header flags, case-insensitive resolveKind matching, and registers it in root in place of ReconcileCommand.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Possibly related PRs

• raystack/frontier#1720: Both PRs build the GitOps reconciliation framework around PlatformUserReconciler and internal/reconcile/reconcile.go, and this PR extends that codepath with Exporter/Export and the frontier export CLI.

Suggested reviewers: AmanGIT07, whoAbhishekSah, rsbh

🚥 Pre-merge checks | ✅ 2

✅ Passed checks (2 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 75607dba-a629-489d-b90a-5de555cb5f68

📥 Commits

Reviewing files that changed from the base of the PR and between 4a8d725 and 2ca9edd.

📒 Files selected for processing (5)

• cmd/reconcile.go
• internal/reconcile/platformuser_reconciler.go
• internal/reconcile/platformuser_reconciler_test.go
• internal/reconcile/reconcile.go
• internal/reconcile/reconcile_test.go

[coveralls]

Coverage Report for CI Build 28654562809

Coverage increased (+0.1%) to 44.962%

Details

• Coverage increased (+0.1%) from the base build.
• Patch coverage: 27 uncovered changes across 4 files (76 of 103 lines covered, 73.79%).
• No coverage regressions found.

Uncovered Changes

File	Changed	Covered	%
cmd/export.go	48	33	68.75%
cmd/reconcile.go	8	2	25.0%
internal/reconcile/reconcile.go	21	17	80.95%
internal/reconcile/platformuser_reconciler.go	25	23	92.0%
Total (5 files)	103	76	73.79%

Coverage Regressions

No coverage regressions found.

---

Coverage Stats

Relevant Lines:	37707
Covered Lines:	16954
Line Coverage:	44.96%
Coverage Strength:	12.59 hits per line

---

💛 - Coveralls

[coderabbitai]

Actionable comments posted: 1

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 025c0faa-f5bc-4b12-bf33-7bcc3ee2fbaa

📥 Commits

Reviewing files that changed from the base of the PR and between 2ca9edd and d553b7f.

📒 Files selected for processing (7)

• cmd/apply.go
• cmd/get.go
• cmd/root.go
• internal/reconcile/platformuser_reconciler.go
• internal/reconcile/platformuser_reconciler_test.go
• internal/reconcile/reconcile.go
• internal/reconcile/reconcile_test.go

✅ Files skipped from review due to trivial changes (1)

• internal/reconcile/reconcile.go

🚧 Files skipped from review as they are similar to previous changes (3)

• internal/reconcile/platformuser_reconciler.go
• internal/reconcile/platformuser_reconciler_test.go
• internal/reconcile/reconcile_test.go

[coderabbitai]

♻️ Duplicate comments (1)

cmd/export.go (1)

51-56: 🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win

Narrow output file permissions for exported PII.

The exported document contains per-principal emails; writing with 0o644 leaves it world-readable. Matches an already-flagged concern on a prior commit of this file.

🔒 Proposed fix

-			return os.WriteFile(output, out, 0o644)
+			return os.WriteFile(output, out, 0o600)

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 4ef1ccea-dab3-45ac-8fb9-8f03784960e8

📥 Commits

Reviewing files that changed from the base of the PR and between d553b7f and 987ae62.

📒 Files selected for processing (7)

• cmd/export.go
• cmd/reconcile.go
• cmd/root.go
• internal/reconcile/platformuser_reconciler.go
• internal/reconcile/platformuser_reconciler_test.go
• internal/reconcile/reconcile.go
• internal/reconcile/reconcile_test.go

🚧 Files skipped from review as they are similar to previous changes (4)

• internal/reconcile/reconcile_test.go
• internal/reconcile/reconcile.go
• internal/reconcile/platformuser_reconciler.go
• internal/reconcile/platformuser_reconciler_test.go