Fetch a published provider/model catalog, compare it with this management
plane, and report or apply the difference.
Reports without changing the catalog unless --apply is passed. A run never
deletes and never re-enables an entry an operator disabled; a model that has
left the catalog or reached its retirement date is disabled, not removed.
Every run -- report-only ones included -- records itself against the
management plane's catalog sync state, which is what `catalog status` reads.
That record is the one write a report-only run makes, and it needs the same
permission as the catalog writes; a run that cannot make it says so and
carries on.
Both sources accept an https URL or a local file path. The file form is the
air-gapped path: download the published catalog out of band and apply it with
the same command and the same semantics.
Usage:
tare api catalog sync [flags]
Examples:
# See what a sync would change.
tare api catalog sync --models https://example.invalid/catalog/models.json
# Apply it, providers included.
tare api catalog sync \
--providers https://example.invalid/catalog/providers.json \
--models https://example.invalid/catalog/models.json --apply
# Air-gapped: apply from files fetched out of band.
tare api catalog sync --providers ./providers.json --models ./models.json --apply
Flags:
--admin drive the admin catalogue surface (tars.admin.v1.AdminService) instead of the public one. Required when authenticating with a management plane's ADMIN key -- the public catalogue service is reachable only with a session token or an <address>.<body> API key, so an admin key fails there with "malformed api key". This is the shape a management-plane CronJob runs in
--allow-plaintext-http permit an http:// source. Off by default -- a plaintext catalogue can be rewritten in transit, and it decides the upstream URLs your provider credentials are sent to
--apply catalog status write the catalog changes (default is a dry run). A dry run still records the run against the plane's catalog sync state -- see catalog status
--disable-absent also disable enabled models that are not in the published catalog. Two ways to lose models with this: models you added yourself never appear in a published catalog, and a PARTIAL --models list makes every other provider's models look absent too -- pass every published document, or leave this off
--fetch-timeout duration per-document fetch timeout (default 1m0s)
--models stringArray published models document: https URL or file path. Repeatable -- the published catalog splits models per provider, so pass one --models per provider document
--models-sha256 stringArray expected sha256 of each --models document, in the same order. Repeatable, and all-or-nothing: pass one per --models or none. A document whose digest does not match is refused and nothing is written
--providers string published providers.json: https URL or file path
--providers-sha256 string expected sha256 of the --providers document. A mismatch refuses the run
Global Flags:
--base-url string override the active profile's base URL for this invocation
-o, --output string output format: json (default "json")
-p, --profile string credential profile (overrides AGENTROUTER_PROFILE / active)
-q, --quiet Suppress progress output; only errors and the final summary go to stderr
-v, --verbose Verbose output: plain-mode progress lines plus full per-blob chunk logs to stderr