target add / target ls / target key

Connect this machine to an Organization, list its connections, and export the signing key.

A target is an Elizon Organization this machine is connected to. sign, install, packages ls and packages bind all act on a target.

target add

npx @elizon/cli target add <host> [--name=<name>] [--org=<organization-id>] [--default] [--json]

Connects this machine through a device approval in your browser. The full walkthrough is in Connect a device.

Option	Effect
`<host>`	The Organization's address: `acme.elizon.example`, `acme.internal:8443`, `https://…`, or `http://localhost:3001`. HTTPS unless a scheme is given.
`--name=<name>`	How later commands refer to it (`--target=<name>`). Default: the host (see Several Organizations).
`--org=<organization-id>`	Asks the approval page to pre-select this Organization. Must be an Organization id (a UUID), as `target ls` shows it; anything else is refused before the browser step.
`--default`	Use this target when a command gets no `--target`. The first target is the default automatically.

target add accepts no credential of any kind. --token, --api-key, --secret, --password and similar flags, and credentials embedded in the host, are refused.

Choosing the Organization

The approval page shows which Organization the device is being connected to, by name, before the Approve button. If you belong to more than one, it's a picker. It starts on:

the Organization you asked for with --org, if you're a member of it;
otherwise the Organization that browser tab is in;
otherwise your first Organization.

Whatever you pick there is what the token is bound to. Picking doesn't switch the tab's Organization. --org is only a request: if you approve a different Organization, target add still succeeds and prints a note: naming both. If the CLI asked for an Organization you aren't a member of, the page says so and you choose one you belong to.

Several Organizations

One machine can hold a target for each Organization on the same host. With no --name:

the first target is named after the host;
connecting the same Organization again replaces it (a re-authentication);
connecting a different Organization on the same host keeps the first target and names the new one <host>-<first 8 characters of the Organization id>. The CLI prints the name.

npx @elizon/cli target add https://elizon.example --org=2f1c9d0e-…   # Org A → elizon.example
npx @elizon/cli target add https://elizon.example --org=7b3a51c4-…   # Org B → elizon.example-7b3a51c4
npx @elizon/cli install acme-triage.pkg --yes --target=elizon.example-7b3a51c4 --project=<Org B project id>

An explicit --name is always used as given, and replaces a target that already has that name.

Errors: CLI_TARGET_UNREACHABLE (wrong host), CLI_TARGET_ERROR (the gateway answered an HTTP error status, including a route it doesn't have), CLI_TARGET_APPROVAL_EXPIRED (nobody approved within 10 minutes), CLI_TARGET_APPROVAL_DENIED (someone chose Deny), CLI_TARGET_STORE_UNSAFE (the credential file would land inside the project; see where it's stored).

target ls

npx @elizon/cli target ls [--json]

Targets (credentials in /home/dev/.config/elizon/targets.json):
  acme                        https://acme.internal:8443        dev@acme.example  Acme GmbH (2f1c9d0e-…)  [default, active]
  client-b                    https://elizon.client-b.example   dev@acme.example  7b3a51c4-…  [expired]

Lists each target's name, address, the identity it acts as and its Organization (by name, when the platform supplied one when the target was added; otherwise its id), and marks the default and any expired tokens. It reads only the local credential file: no network, and no token is ever printed. Inside a project, it also warns about targets the project's .elizon/config.yaml mentions that this machine hasn't connected to.

target key

npx @elizon/cli target key --out=<file>.json [--all] [--force] [--target=<name>]
npx @elizon/cli target key --json

Exports the Organization's signing public key as an elizon.signing-public-key.v1 document. That's the file another Organization needs to trust Packages you sign: install --trust=<file>, or Add signer's public key in Studio. See Sharing across Organizations.

Option	Effect
`--out=<file>`	Where to write. Required unless `--json`, which returns the document in `data` and writes nothing.
`--all`	Every key the Organization has signed with, current and retired, as a JSON array (for `--trust`).
`--force`	Overwrite an existing file.

Read-only: it fetches public documents and asks for nothing private, so no --yes. Needs package.view. An Organization that has never signed has no key yet: sign a Package first.

Choosing a target in other commands

npx @elizon/cli packages ls --target=client-b

Without --target, commands use the default target (or, if none is marked default, the first one added).

Disconnecting a machine

To cut a machine off, revoke it in Studio → Settings → CLI Devices of that Organization (see CLI Devices). The device's next call fails with CLI_TARGET_TOKEN_REJECTED.

There's no command to delete an entry from this machine's list. The entry stays in targets.json until you reconnect it with target add (which replaces it) or delete that file.