tare api catalog sync

Fetch a published provider/model catalog, compare it with this management
plane, and report or apply the difference.

Reports without changing the catalog unless --apply is passed. A run never
deletes and never re-enables an entry an operator disabled; a model that has
left the catalog or reached its retirement date is disabled, not removed.

Every run -- report-only ones included -- records itself against the
management plane's catalog sync state, which is what `catalog status` reads.
That record is the one write a report-only run makes, and it needs the same
permission as the catalog writes; a run that cannot make it says so and
carries on.

Both sources accept an https URL or a local file path. The file form is the
air-gapped path: download the published catalog out of band and apply it with
the same command and the same semantics.

Usage:
  tare api catalog sync [flags]

Examples:
  # See what a sync would change.
  tetrate agentrouter api catalog sync --models https://example.invalid/catalog/models.json

  # Apply it, providers included.
  tetrate agentrouter api catalog sync \
      --providers https://example.invalid/catalog/providers.json \
      --models https://example.invalid/catalog/models.json --apply

  # Air-gapped: apply from files fetched out of band.
  tetrate agentrouter api catalog sync --providers ./providers.json --models ./models.json --apply

Flags:
      --admin                       drive the admin catalogue surface (tars.admin.v1.AdminService) instead of the public one. Required when authenticating with a management plane's ADMIN key -- the public catalogue service is reachable only with a session token or an <address>.<body> API key, so an admin credential fails there with "malformed api key". This is the shape a management-plane CronJob runs in
      --allow-plaintext-http        permit an http:// source. Off by default -- a plaintext catalogue can be rewritten in transit, and it decides the upstream URLs your provider credentials are sent to
      --apply catalog status        write the catalog changes (default is a dry run). A dry run still records the run against the plane's catalog sync state -- see catalog status
      --disable-absent              also disable enabled models that are not in the published catalog. Two ways to lose models with this: models you added yourself never appear in a published catalog, and a PARTIAL --models list makes every other provider's models look absent too -- pass every published document, or leave this off
      --fetch-timeout duration      per-document fetch timeout (default 1m0s)
      --models stringArray          published models document: https URL or file path. Repeatable -- the published catalog splits models per provider, so pass one --models per provider document
      --models-sha256 stringArray   expected sha256 of each --models document, in the same order. Repeatable, and all-or-nothing: pass one per --models or none. A document whose digest does not match is refused and nothing is written
      --providers string            published providers.json: https URL or file path
      --providers-sha256 string     expected sha256 of the --providers document. A mismatch refuses the run

Global Flags:
      --base-url string   override the active profile's base URL for this invocation
  -o, --output string     output format: json (default "json")
  -p, --profile string    credential profile (overrides AGENTROUTER_PROFILE / active)
  -q, --quiet             Suppress progress output; only errors and the final summary go to stderr
  -v, --verbose           Verbose output: plain-mode progress lines plus full per-blob chunk logs to stderr