install

npx @elizon/cli install <artifact.pkg> --yes [--target=<name>] [--project=<project-id>]
                       [--slot.<id>=<value> …] [--approver.<node>=<emails>] [--form-user.<node>=<username>]
                       [--rename.<node>=<name>] [--trust=<public-key.json>] [--non-interactive] [--json]
                       [--activate [--acknowledge-evaluation] [--schedule.<trigger>.cron=… --schedule.<trigger>.timezone=…]]

npx @elizon/cli install <artifact.pkg> --resume=<installation-id> --yes [--target=<name>]
npx @elizon/cli install --rollback=<installation-id> --yes [--target=<name>]
npx @elizon/cli install <artifact.pkg> --activate=<installation-id> --yes [--target=<name>] [the same --slot flags]

Installs a signed Package into an Organization. It does the same thing as the install wizard in Studio and runs on the same engine, but from a terminal or a CI job. That makes it the practical way to install one Package into many Organizations.

Needs a connected device and the package.install permission (Owner, Admin, Editor).

What happens

✓ signature verified — ed25519:4f2c9a…
  Self-signed by "Acme Ltd" (key ed25519:4f2c9a…). The name is the signer's own claim; no registry has counter-signed this Package.

✓ acme.triage-intake installed into acme (https://acme.internal:8443)
  installation:  0f0b1c2d-…
  status:        installed
  objects:       11

Activating

Installing creates everything, inert. Activating makes the Package live: it runs the evaluation suite, records the activation in the audit log, publishes the entry point Workflow when a trigger needs it, and arms the triggers: schedule timers, webhook addresses, api access, inbound-call phone routing, email and app polling, and knowledge-document triggers. A manual trigger needs no arming. See Triggers only fire when the Package is live. Add --activate to install and activate in one run:

npx @elizon/cli install acme-triage-1.0.0.pkg --yes --activate \
  --project=<project-id> --slot.reasoning=<llm-configuration-id> --slot.phone-line=<trunk-id>

Evaluation: PASSED — 4/4 passed (gate: must-pass, recorded, not enforced)
  ✓ active-failure-escalates  passed 5120 ms
  …
✓ activated — status installed
  ✓ after-hours-call (inbound-call): Answering on +359…
  ✓ run-manually (manual): Runs from Studio.

To activate a Package installed earlier without --activate, pass its installation id. Nothing is created again:

npx @elizon/cli install acme-triage-1.0.0.pkg --yes --activate=<installation-id> \
  --slot.reasoning=<llm-configuration-id> --slot.phone-line=<trunk-id>

• The same .pkg, and the same bindings. The organization never keeps the artifact or your answers, so activation needs them again. A different Package or version is refused.
• Evaluation results are acknowledged by a person. If the Package has a suite, its results are printed first. In a terminal you're asked to type yes; otherwise pass --acknowledge-evaluation, which states that you have read what this run prints. Without either, activation stops with EVALUATION_NOT_ACKNOWLEDGED. The Package stays installed and inactive, and the error gives the command to finish.
• Schedules run as the Package declares them unless you override them, both halves together: --schedule.<trigger-id>.cron="30 7 * * 1-5" --schedule.<trigger-id>.timezone=Europe/Sofia.
• Webhook addresses are generated at activation and printed with the trigger outcomes.
• A Package is activated once. Activating it again (from the CLI or Studio) is refused with INSTALL_STATE_INVALID. An update arms the new version itself.

You can also activate from Studio: a Package installed but not activated shows Activate on its page in Studio → Packages. See Installed Packages.

Binding Slots: --slot.<id>=<value>

A Package never carries models, credentials, documents or phone lines. It declares Slots, and you fill each one. The Slot's declared type decides what the value means:

A sip-trunk binding from the CLI carries no inbound number, so the Package's inbound-call triggers stay unwired until the line is bound with its number in Studio. See Voice and SIP → From the CLI.

Any Slot except llm accepts defer, which leaves it for later. The Package then installs as installed-incomplete and lists the Slot as outstanding. Finish it later with packages bind or Bind in Studio, which take the same values as this table; a knowledge-source Slot is finished by adding documents to its Knowledge Base. An LLM Slot can't be deferred, because nothing in a Package runs without a model.

OAuth credentials can't be completed in a terminal. A Slot with scheme: oauth2 fails with SLOT_OAUTH_REQUIRES_BROWSER. Retrying won't help: install through the Studio wizard, or defer the Slot and connect it in Studio afterwards.

Other options

When an install fails partway

The Organization records each object as it's created. If an install stops partway, it stays failed with a record of what exists, and nothing is left half-configured without a record. You choose what happens next, from the CLI or from Studio → Packages, whichever is handier:

# carry on from the object that failed (takes the artifact again)
npx @elizon/cli install acme-triage-1.0.0.pkg --resume=0f0b1c2d-… --yes

# remove everything this install created (takes no artifact)
npx @elizon/cli install --rollback=0f0b1c2d-… --yes

--resume and --rollback can't be combined. A rollback won't delete an object that something outside the Package now uses (INSTALL_ROLLBACK_BLOCKED). It's reported, and you decide.

Common errors

All codes: Error codes.

Example: one Package, three client Organizations

for client in client-a client-b client-c; do
  npx @elizon/cli install triage-1.2.0.pkg --target="$client" --yes --non-interactive \
    --activate --acknowledge-evaluation \
    --trust=./acme-signing-key.json \
    --project="$(cat "projects/$client")" \
    --slot.reasoning="$(cat "llm/$client")" \
    --slot.calendar-access='{{secret.CALENDAR}}' \
    --slot.phone-line=defer \
    --json > "install-$client.json"
done