antelope-cli 1.2.1 → 1.2.2

package/ansible/onboarding-ca/README.md

@@ -18,9 +18,19 @@ this role owns cloning, branching, committing, pushing and PR creation.
 
 - `git`, Node.js (engines `^16.20.2`) and `npx` on `PATH`.
 - An **SSH key authorized to push** to `xsitesinc/web-client-area` (push is over SSH).
-- A **Bitbucket API token** with pull-request write access (used only for the REST calls:
-  reviewer lookup + PR creation). Store it in Ansible Vault or pass via environment — never commit it.
-- `ansible.builtin.uri` needs Python `urllib` (standard). No extra collections required.
+- An **Atlassian API token** (`ATATT…`) for the account in `bitbucket_email`, carrying Bitbucket
+  scopes `read:user`, `read:repository`, `read:pullrequest`, `write:pullrequest`. Used only for the
+  REST calls (reviewer lookup + PR creation) via **HTTP Basic auth** (`email:token`) — these tokens
+  are **not** Bearer tokens. Create at <https://id.atlassian.com/manage-profile/security/api-tokens>.
+  Provide via `--extra-vars` / Ansible Vault, or leave it blank and let the playbook fetch it from
+  1Password (item `jenkins@xsites.co.il`, field `bitbucket_scoped_token`).
+- A **Consul token** with `read` scope on `version/*` (v2 cluster) — used to derive the destination
+  branches from the release train. Provide via `-e consul_token=…`, `$CONSUL_HTTP_TOKEN`, or leave it
+  blank and let the playbook fetch it from 1Password (item `New_Consul_Token`, field `password`).
+  Not needed when you pass an explicit `dest_branches` override.
+- A **signed-in `op` CLI** (`op signin`, or `OP_SERVICE_ACCOUNT_TOKEN`) if you rely on the 1Password
+  fallbacks above instead of passing the tokens explicitly.
+- The **`community.general`** collection (for the `dict_kv` filter): `ansible-galaxy collection install -r requirements.yml`.
 
 ## Usage
 
@@ -30,32 +40,55 @@ Interactive (prompts for the inputs):
 ansible-playbook onboard-ca.yml
 ```
 
-Non-interactive (for CI / wrapping playbooks) — extra-vars skip the prompts:
+Non-interactive (for CI / wrapping playbooks) — extra-vars skip the prompts. Destination
+branches are derived from Consul, and both tokens fall back to 1Password, so the minimal run is:
 
 ```bash
 ansible-playbook onboard-ca.yml \
   -e brand_name="Zenith Horizon Group" \
-  -e jira_key=ATLP-47067 \
+  -e jira_key_client_branding=ATLP-47067
+```
+
+Passing the tokens explicitly (skips the 1Password lookups) and pinning the branches:
+
+```bash
+ansible-playbook onboard-ca.yml \
+  -e brand_name="Zenith Horizon Group" \
+  -e jira_key_client_branding=ATLP-47067 \
   -e dest_branches=develop,master-26.9 \
+  -e consul_token="$CONSUL_HTTP_TOKEN" \
+  -e bitbucket_email=jenkins@xsites.co.il \
   -e bitbucket_token="$BITBUCKET_TOKEN"
 ```
 
+Note: pass token values literally (or via a shell variable as above). Do **not** prefix a raw
+`ATATT…` token with `$` — the shell would try to expand it as a variable and send an empty token.
+
 ## Inputs
 
 | var | required | example | notes |
 |-----|----------|---------|-------|
 | `brand_name` | yes | `Zenith Horizon Group` | display name → PR title |
-| `jira_key` | yes | `ATLP-47067` | PR title prefix + branch name |
-| `dest_branches` | yes | `develop,master-26.9` | comma-separated; **one PR per branch** |
-| `bitbucket_token` | yes | *(secret)* | Bearer token for the REST calls |
+| `jira_key_client_branding` | yes | `ATLP-47067` | PR title prefix + branch name |
+| `bitbucket_token` | no* | *(secret)* | Atlassian API token (`ATATT…`) for the REST calls; sent via Basic auth. *Blank ⇒ fetched from 1Password (`jenkins@xsites.co.il` / `bitbucket_scoped_token`)* |
+| `bitbucket_email` | yes | `jenkins@xsites.co.il` | account that owns the token (Basic-auth username); defaults to the Jenkins service account |
+| `dest_branches` | no | `develop,master-26.9` | comma-separated override; **blank ⇒ derived from Consul** (see below). **One PR per branch** |
+| `consul_token` | no* | *(secret)* | read scope on `version/*`. *Blank ⇒ `$CONSUL_HTTP_TOKEN`, else 1Password (`New_Consul_Token` / `password`)*. Unused when `dest_branches` is set |
 | `brand_assets_folder` | no | `zenithhorizongroup` | folder name → CLI `--brand_assets_folder`, branch name; prompted separately. Blank ⇒ derived from `brand_name` (lowercased, spaces removed) |
 | `reviewers` | no | *(auto)* | default: repo's Bitbucket default-reviewers (author excluded); override with `[{account_id: "..."}]` |
+| `consul_url` | no | `https://consul.xsites.xyz` | Consul base URL for the version lookup |
+| `onepassword_bitbucket_item` / `_field` | no | `jenkins@xsites.co.il` / `bitbucket_scoped_token` | 1Password source for the Bitbucket token |
+| `onepassword_consul_item` / `_field` | no | `New_Consul_Token` / `password` | 1Password source for the Consul token |
 | `antelope_cli_version` | no | `1.2.0` | pinned published CLI version |
 | `work_dir` | no | `/tmp/onboard-ca/web-client-area` | clone location |
 | `git_user_name` / `git_user_email` | no | | commit identity |
 
 ## Behavior notes
 
+- **Destination branches are derived from the release train in Consul** (unless `dest_branches`
+  is passed). `develop` is always onboarded; `master-<version/prod>` tracks the live release; and
+  while a new release is staged (`version/staging != version/prod`) its `master-<version/staging>`
+  is onboarded too. Once staging has shipped (`staging == prod`) there is a single master branch.
 - **One PR per destination branch.** `develop` → `feature/<jira>-onboarding-<folder>`;
   `master-*`/`release-*` → `hotfix/<jira>-onboarding-<folder>`. Each branch is based on its own
   destination so diverged histories don't bleed across PRs.

package/ansible/onboarding-ca/onboard-ca.yml

@@ -1,19 +1,27 @@
 ---
 # Onboard a Client Area brand into web-client-area and open the PR(s).
 #
+# Destination branches are derived from the release train in Consul (no manual input):
+#   develop is always onboarded; master-<version/prod> tracks the live release; while a
+#   new release is staged (version/staging != version/prod) its master-<version/staging>
+#   exists too and is onboarded as well. Pass -e dest_branches=... to override the lookup.
+#
 # Interactive:
 #   ansible-playbook onboard-ca.yml
 #
 # Non-interactive (e.g. from another playbook / CI), pass everything as extra-vars:
-#   ansible-playbook onboard-ca.yml \
-#     -e brand_name="Zenith Horizon Group" \
-#     -e brand_assets_folder=zenithhorizongroup \
-#     -e jira_key=ATLP-47067 \
-#     -e dest_branches=develop,master-26.9 \
-#     -e bitbucket_token="$BITBUCKET_TOKEN"
-#
+  # ansible-playbook onboard-ca.yml \
+  #   -e brand_name="Eldadtestbrand" \
+  #   -e brand_assets_folder=eldadtestbrand \
+  #   -e jira_key_client_branding=ATLP-47067 \
+  #   -e consul_token="$CONSUL_HTTP_TOKEN" \   # read scope on version/*; used to derive dest branches
+  #   -e bitbucket_email=jenkins@xsites.co.il \
+  #   -e bitbucket_token=ATATT3x...   # Atlassian API token WITHOUT a leading '$' (it is a literal, not a shell var)
+
 # Preconditions on the control node: git + Node (>=16) + npx, an SSH key authorized to
-# push to xsitesinc/web-client-area, and a Bitbucket API token with PR write access.
+# push to xsitesinc/web-client-area, and an Atlassian API token (ATATT…) owned by
+# bitbucket_email, carrying Bitbucket scopes read:user / read:repository /
+# read+write:pullrequest. The token is used via HTTP Basic auth (email:token).
 - name: Onboard a Client Area brand (web-client-area)
   hosts: localhost
   connection: local
@@ -27,14 +35,16 @@
       prompt: "Brand assets folder name — the src/assets/other/<folder> (e.g. zenithhorizongroup); leave blank to derive from the display name"
       default: ""
       private: false
-    - name: jira_key
+    - name: jira_key_client_branding
       prompt: "Jira key (e.g. ATLP-47067)"
       private: false
-    - name: dest_branches
-      prompt: "Destination branches, comma-separated (e.g. develop,master-26.9)"
+    - name: bitbucket_email
+      prompt: "Atlassian account email that owns the API token (Basic-auth username)"
+      default: "jenkins@xsites.co.il"
       private: false
     - name: bitbucket_token
-      prompt: "Bitbucket API token"
+      prompt: "Atlassian API token (ATATT…); leave blank to fetch from 1Password (item jenkins@xsites.co.il)"
+      default: ""
       private: true
 
   roles:

package/ansible/onboarding-ca/requirements.yml

@@ -0,0 +1,8 @@
+---
+# Ansible collection dependencies for the onboarding-ca playbook.
+# Install with:  ansible-galaxy collection install -r requirements.yml
+collections:
+  # Provides the community.general.dict_kv filter used to build the Bitbucket
+  # reviewers array (roles/onboard_ca/tasks/main.yml).
+  - name: community.general
+    version: ">=8.0.0"

package/ansible/onboarding-ca/roles/onboard_ca/defaults/main.yml

@@ -16,9 +16,34 @@ brand_assets_folder: ""
 reviewers: []
 
 # Identity used for the commit (control-node git may have no global config).
-git_user_name: "Antelope Onboarding Bot"
-git_user_email: "devops@antelopesystem.com"
+git_user_name: "Jenkins"
+git_user_email: "jenkins@xsites.co.il"
 
-# Bitbucket API token (Bearer) for the reviewer lookup + PR creation.
-# Provide via --extra-vars or Ansible Vault; never commit a real value.
+# Atlassian API token (ATATT…) for the reviewer lookup + PR creation. Sent via HTTP
+# Basic auth together with bitbucket_email — these tokens are NOT Bearer tokens and
+# must carry Bitbucket scopes (read:user, read:repository, read/write:pullrequest).
+# Empty => fetched from 1Password (see onepassword_bitbucket_* below). Provide via
+# --extra-vars or Ansible Vault to skip the lookup; never commit a real value.
 bitbucket_token: ""
+
+# Email of the Atlassian account that owns bitbucket_token (the Basic-auth username).
+# Defaults to the Jenkins service account; override via --extra-vars for a different account.
+bitbucket_email: "jenkins@xsites.co.il"
+
+# Consul token with read scope on version/* (v2 cluster). Used to derive the destination
+# branches from the release train (version/prod, version/staging). Empty => resolved from
+# $CONSUL_HTTP_TOKEN, else from 1Password (see onepassword_consul_* below). Not needed when
+# an explicit dest_branches override is passed. Never commit a real value.
+consul_token: ""
+
+# Explicit destination-branch override (comma-separated). Empty => derived from Consul:
+# develop + master-<version/prod> [+ master-<version/staging> while a release is staged].
+# Set this to bypass the Consul lookup entirely, e.g. dest_branches=develop,master-26.9.
+dest_branches: ""
+
+# 1Password fallbacks — used only when the corresponding token is not otherwise provided.
+# Require a signed-in `op` CLI on the control node (op signin, or OP_SERVICE_ACCOUNT_TOKEN).
+onepassword_bitbucket_item: "jenkins@xsites.co.il"
+onepassword_bitbucket_field: "bitbucket_scoped_token"
+onepassword_consul_item: "New_Consul_Token"
+onepassword_consul_field: "password"

package/ansible/onboarding-ca/roles/onboard_ca/tasks/main.yml

@@ -1,12 +1,80 @@
 ---
+# --- Resolve secrets: prefer the provided value, else fall back to 1Password (op CLI) ---
+# The op fallback needs a signed-in `op` on the control node (op signin, or
+# OP_SERVICE_ACCOUNT_TOKEN). A missing/failed op is tolerated here; the validate step
+# below reports the still-empty token with a clear message.
+- name: Fetch the Bitbucket API token from 1Password
+  when: (bitbucket_token | default('') | length) == 0
+  ansible.builtin.command:
+    argv:
+      - op
+      - item
+      - get
+      - "{{ onepassword_bitbucket_item }}"
+      - "--fields"
+      - "label={{ onepassword_bitbucket_field }}"
+      - "--reveal"
+  register: op_bitbucket
+  changed_when: false
+  failed_when: false
+  no_log: true
+
+- name: Adopt the 1Password Bitbucket token
+  when:
+    - (bitbucket_token | default('') | length) == 0
+    - op_bitbucket is not skipped
+    - (op_bitbucket.rc | default(1)) == 0
+    - (op_bitbucket.stdout | default('') | length) > 0
+  ansible.builtin.set_fact:
+    bitbucket_token: "{{ op_bitbucket.stdout | trim }}"
+  no_log: true
+
+# Consul token is only needed when destination branches are derived (no dest_branches override).
+- name: Resolve the Consul token from the environment
+  when: (consul_token | default('') | length) == 0
+  ansible.builtin.set_fact:
+    consul_token: "{{ lookup('env', 'CONSUL_HTTP_TOKEN') }}"
+  no_log: true
+
+- name: Fetch the Consul token from 1Password
+  when:
+    - (consul_token | default('') | length) == 0
+    - (dest_branches | default('') | length) == 0
+  ansible.builtin.command:
+    argv:
+      - op
+      - item
+      - get
+      - "{{ onepassword_consul_item }}"
+      - "--fields"
+      - "label={{ onepassword_consul_field }}"
+      - "--reveal"
+  register: op_consul
+  changed_when: false
+  failed_when: false
+  no_log: true
+
+- name: Adopt the 1Password Consul token
+  when:
+    - (consul_token | default('') | length) == 0
+    - op_consul is not skipped
+    - (op_consul.rc | default(1)) == 0
+    - (op_consul.stdout | default('') | length) > 0
+  ansible.builtin.set_fact:
+    consul_token: "{{ op_consul.stdout | trim }}"
+  no_log: true
+
 - name: Validate required inputs
   ansible.builtin.assert:
     that:
       - brand_name is defined and (brand_name | length) > 0
-      - jira_key is defined and (jira_key | length) > 0
-      - dest_branches is defined and (dest_branches | length) > 0
+      - jira_key_client_branding is defined and (jira_key_client_branding | length) > 0
       - bitbucket_token is defined and (bitbucket_token | length) > 0
-    fail_msg: "brand_name, jira_key, dest_branches and bitbucket_token are all required."
+      - bitbucket_email is defined and (bitbucket_email | length) > 0
+    fail_msg: >-
+      brand_name, jira_key_client_branding and bitbucket_email are required, and bitbucket_token must be
+      provided (via --extra-vars / prompt) or resolvable from 1Password item
+      '{{ onepassword_bitbucket_item }}' field '{{ onepassword_bitbucket_field }}' (op signin).
 
 - name: Compute effective brand assets folder
   ansible.builtin.set_fact:
@@ -15,10 +83,55 @@
          if (brand_assets_folder | default('') | length) > 0
          else (brand_name | lower | regex_replace(' ', '')) }}
 
-- name: Normalize destination branch list
+# --- Destination branches: derived from the release train in Consul ------------------
+# develop is always onboarded. master-<version/prod> tracks the live release; while a new
+# release is staged (version/staging != version/prod) its master-<version/staging> exists
+# too and is onboarded as well. Once staging == prod (the release has shipped) there is a
+# single master branch. An explicit dest_branches extra-var bypasses the lookup entirely.
+- name: Resolve destination branches from Consul
+  when: (dest_branches | default('') | length) == 0
+  block:
+    - name: Consul token is required to derive destination branches
+      ansible.builtin.assert:
+        that:
+          - consul_token is defined and (consul_token | length) > 0
+        fail_msg: >-
+          consul_token is required to read version/prod and version/staging. Provide it via
+          -e consul_token=..., $CONSUL_HTTP_TOKEN, or 1Password item '{{ onepassword_consul_item }}'
+          (op signin); or pass -e dest_branches=develop,master-XX.Y to bypass the Consul lookup.
+
+    - name: Read the prod release version from Consul
+      ansible.builtin.uri:
+        url: "{{ consul_url }}/v1/kv/version/prod?raw=1"
+        headers:
+          X-Consul-Token: "{{ consul_token }}"
+        return_content: true
+      register: consul_prod
+
+    - name: Read the staging release version from Consul
+      ansible.builtin.uri:
+        url: "{{ consul_url }}/v1/kv/version/staging?raw=1"
+        headers:
+          X-Consul-Token: "{{ consul_token }}"
+        return_content: true
+      register: consul_staging
+
+    - name: Derive the destination branch list from the release versions
+      ansible.builtin.set_fact:
+        dest_branch_list: >-
+          {{ ['develop', 'master-' + (consul_prod.content | trim)]
+             + (['master-' + (consul_staging.content | trim)]
+                if (consul_staging.content | trim) != (consul_prod.content | trim) else []) }}
+
+- name: Normalize destination branch list (explicit override)
+  when: (dest_branches | default('') | length) > 0
   ansible.builtin.set_fact:
     dest_branch_list: "{{ dest_branches.split(',') | map('trim') | reject('equalto', '') | list }}"
 
+- name: Show the resolved destination branches
+  ansible.builtin.debug:
+    msg: "Destination branches: {{ dest_branch_list }}"
+
 # --- Reviewers: pull from the repo's Bitbucket default-reviewers config -------------
 - name: Resolve reviewers from repo default-reviewers config
   when: (reviewers | length) == 0
@@ -26,29 +139,33 @@
     - name: Identify the authenticating Bitbucket account (PR author)
       ansible.builtin.uri:
         url: "{{ api_base }}/user"
-        headers:
-          Authorization: "Bearer {{ bitbucket_token }}"
+        url_username: "{{ bitbucket_email }}"
+        url_password: "{{ bitbucket_token }}"
+        force_basic_auth: true
         return_content: true
       register: bb_user
 
     - name: Fetch the repository default reviewers
       ansible.builtin.uri:
         url: "{{ api_base }}/repositories/{{ workspace }}/{{ repo_slug }}/default-reviewers?pagelen=100"
-        headers:
-          Authorization: "Bearer {{ bitbucket_token }}"
+        url_username: "{{ bitbucket_email }}"
+        url_password: "{{ bitbucket_token }}"
+        force_basic_auth: true
         return_content: true
       register: bb_default_reviewers
 
     # Bitbucket rejects a PR whose author is also a reviewer, so drop the authenticating account.
     # The REST API does not auto-apply default reviewers, so we pass them explicitly.
     # Bitbucket's PR-create reviewers array is keyed by uuid; exclude the author by account_id.
+    # Built in a single expression (not an accumulating set_fact loop, which is nondeterministic).
     - name: Build reviewers list (excluding the PR author)
       ansible.builtin.set_fact:
-        reviewers: "{{ reviewers + [{'uuid': item.uuid}] }}"
-      loop: "{{ bb_default_reviewers.json['values'] }}"
-      when: item.account_id != bb_user.json.account_id
-      loop_control:
-        label: "{{ item.display_name | default(item.uuid) }}"
+        reviewers: >-
+          {{ bb_default_reviewers.json['values']
+             | rejectattr('account_id', 'equalto', bb_user.json.account_id)
+             | map(attribute='uuid')
+             | map('community.general.dict_kv', 'uuid')
+             | list }}
 
 - name: Ensure clone parent directory exists
   ansible.builtin.file:

package/ansible/onboarding-ca/roles/onboard_ca/tasks/per_branch.yml

@@ -7,7 +7,7 @@
 
 - name: "[{{ dest_branch }}] Set source branch"
   ansible.builtin.set_fact:
-    source_branch: "{{ branch_prefix }}/{{ jira_key }}-onboarding-{{ brand_assets_folder }}"
+    source_branch: "{{ branch_prefix }}/{{ jira_key_client_branding }}-onboarding-{{ brand_assets_folder }}"
 
 - name: "[{{ dest_branch }}] Fetch all remote branches"
   ansible.builtin.command:
@@ -63,7 +63,7 @@
   ansible.builtin.command:
     cmd: >-
       git -c user.name="{{ git_user_name }}" -c user.email="{{ git_user_email }}"
-      commit -m "{{ jira_key }}: On-Boarding {{ brand_name }} Client Branding"
+      commit -m "{{ jira_key_client_branding }}: On-Boarding {{ brand_name }} Client Branding"
     chdir: "{{ work_dir }}"
   when: staged.rc == 1
 
@@ -77,12 +77,13 @@
   ansible.builtin.uri:
     url: "{{ api_base }}/repositories/{{ workspace }}/{{ repo_slug }}/pullrequests"
     method: POST
-    headers:
-      Authorization: "Bearer {{ bitbucket_token }}"
+    url_username: "{{ bitbucket_email }}"
+    url_password: "{{ bitbucket_token }}"
+    force_basic_auth: true
     body_format: json
     body:
-      title: "{{ jira_key }}: On-Boarding {{ brand_name }} Client Branding"
-      description: "{{ jira_key }}: On-Boarding {{ brand_name }} Client Branding"
+      title: "{{ jira_key_client_branding }}: On-Boarding {{ brand_name }} Client Branding"
+      description: "{{ jira_key_client_branding }}: On-Boarding {{ brand_name }} Client Branding"
       source:
         branch:
           name: "{{ source_branch }}"

package/ansible/onboarding-ca/roles/onboard_ca/vars/main.yml

@@ -4,3 +4,6 @@ api_base: "https://api.bitbucket.org/2.0"
 workspace: "xsitesinc"
 repo_slug: "web-client-area"
 repo_ssh_url: "git@bitbucket.org:xsitesinc/web-client-area.git"
+
+# Consul (v2 cluster) — source of the release train used to derive destination branches.
+consul_url: "https://consul.xsites.xyz"

package/onboarding-crm/brand.js

@@ -1,21 +1,22 @@
-let brand = {
-  brandName: '',
-  kebabCaseName: '',
-  connectedBrandName: '',
-  color: '',
-  languages: null,
-  favicon: '',
-  type: '',
-  FCMSenderId: '',
-  logo: ''
-};
-
-function updateBrand(updatedBrand) {
-  brand = { ...brand, ...updatedBrand };
-}
-
-function getBrand() {
-  return brand;
-}
-
-module.exports = { updateBrand, getBrand };
+let brand = {
+  brandId: '',
+  brandName: '',
+  connectedBrandName: '',
+  color: '',
+  logo: '',
+  languages: null,
+  favicon: '',
+  FCMSenderId: '',
+  type: '',
+  baseUrl: ''
+};
+
+function updateBrand(updatedBrand) {
+  brand = { ...brand, ...updatedBrand };
+}
+
+function getBrand() {
+  return brand;
+}
+
+module.exports = { updateBrand, getBrand };

package/onboarding-crm/brandLocations.js

@@ -0,0 +1,33 @@
+const fs = require('fs');
+const chalk = require('chalk');
+const brandModule = require('./brand.js');
+
+const brandLocationsPath = 'BRAND_LOCATIONS.md';
+
+// Append a sprint-tracking row "<brand_name> → <brand_id>" to BRAND_LOCATIONS.md,
+// mirroring the migrate-brand-to-id skill (today's date, QA sign-off left blank).
+function start() {
+  return new Promise((resolve, reject) => {
+    try {
+      if (!fs.existsSync(brandLocationsPath)) {
+        console.log(chalk.yellow(`${brandLocationsPath} not found — skipping tracking row.`));
+        return resolve(null);
+      }
+      const { brandName, brandId } = brandModule.getBrand();
+      const date = new Date().toISOString().slice(0, 10);
+      const cell = `${brandName} → ${brandId}`;
+      const row = `| ${date} | ${cell.padEnd(27)} |             |`;
+
+      let data = fs.readFileSync(brandLocationsPath, 'utf8');
+      if (!data.endsWith('\n')) data += '\n';
+      data += row + '\n';
+      fs.writeFileSync(brandLocationsPath, data, 'utf8');
+      console.log(chalk.cyan(`BRAND_LOCATIONS.md updated: ${cell}`));
+      resolve(null);
+    } catch (error) {
+      reject(error);
+    }
+  });
+}
+
+module.exports = { start };

package/onboarding-crm/createConfig.js

@@ -1,38 +1,40 @@
-const fs = require('fs');
-const brandModule = require('./brand.js');
-const chalk = require('chalk');
-const configsFilePath = 'src/configs/configs.ts';
-
-// Same output as onboarding/createConfig.js — FCMSenderId/type are resolved upfront (flags/prompt).
-function start() {
-  return new Promise((resolve, reject) => {
-    fs.writeFile(configsFilePath, updateConfigFile(), 'utf8', (error) => {
-      if (error) {
-        reject(error);
-      } else {
-        console.log(chalk.cyan('configs.ts file updated successfully!'));
-        resolve(null);
-      }
-    });
-  });
-}
-
-const updateConfigFile = () => {
-  const brand = brandModule.getBrand();
-  return `export const configs: WebCrmConfig = {
-    baseUrl: 'https://dev-apicrm.antelopesystem.com/SignalsCRM/',
-    appId: 0,
-    type: '${brand.type}',
-    defaultLanguage: 'en',
-    gaTrackingID: 'UA-70456753-2',
-    colorTheme: 'theme-${brand.connectedBrandName}',
-    templateTheme: 'theme-template-${brand.connectedBrandName}',
-    title: '${brand.brandName}',
-    favicon: '${brand.favicon}',
-    affiliatesApiUrl: '',
-    FCMSenderId: '${brand.FCMSenderId}',
-    brandAssetsFolder: '${brand.connectedBrandName}',
-  };`;
-};
-
-module.exports = { start };
+const fs = require('fs');
+const brandModule = require('./brand.js');
+const chalk = require('chalk');
+const configsFilePath = 'src/configs/configs.ts';
+
+// Writes configs.ts (devops copy-paste this into the env's Consul config).
+// Brand references use the Antelope ID (connectedBrandName = brand_id); baseUrl comes from the flag.
+function start() {
+  return new Promise((resolve, reject) => {
+    fs.mkdirSync('src/configs', { recursive: true });
+    fs.writeFile(configsFilePath, updateConfigFile(), 'utf8', (error) => {
+      if (error) {
+        reject(error);
+      } else {
+        console.log(chalk.cyan('configs.ts file updated successfully!'));
+        resolve(null);
+      }
+    });
+  });
+}
+
+const updateConfigFile = () => {
+  const brand = brandModule.getBrand();
+  return `export const configs: WebCrmConfig = {
+    baseUrl: '${brand.baseUrl}',
+    appId: 0,
+    type: '${brand.type}',
+    defaultLanguage: 'en',
+    gaTrackingID: 'UA-70456753-2',
+    colorTheme: 'theme-${brand.connectedBrandName}',
+    templateTheme: 'theme-template-${brand.connectedBrandName}',
+    title: '${brand.connectedBrandName}',
+    favicon: '${brand.favicon}',
+    affiliatesApiUrl: '',
+    FCMSenderId: '${brand.FCMSenderId}',
+    brandAssetsFolder: '${brand.connectedBrandName}',
+  };`;
+};
+
+module.exports = { start };

package/onboarding-crm/index.js

@@ -1,157 +1,171 @@
-const readline = require('readline');
-const chalk = require('chalk');
-const brandModule = require('./brand.js');
-const variablesColors = require('./variablesColors.js');
-const themes = require('./themes.js');
-const translations = require('./translations.js');
-const createConfig = require('./createConfig.js');
-
-const ALLOWED_TYPES = ['CORP_FL', 'IB_FL', 'CORP_AFF_FL', 'CORP_AFF_IB_PORTAL', 'CORP_AFF_MSQ'];
-
-const HELP = `
-Usage: ant-cli onboarding-crm --brand_name <name> [options]
-
-Onboards a CRM brand in the current web-crm checkout — same edits as "onboarding", but
-every value is taken from flags (interactive prompts are only a fallback in a TTY):
-  src/ng1/assets/css/sass/variables-colors.scss     (+ $colors entry and color shades)
-  src/ng1/assets/css/sass/materialism/themes.scss   (+ theme maps and .theme-template block)
-  src/assets/brands/<folder>/languages/<lang>.json  (one empty file per language)
-  src/configs/configs.ts                            (rewritten for the brand)
-
-Options:
-  --brand_name <name>          Display name → configs title, e.g. "Zenith Horizon Group" (required)
-  --brand_assets_folder <f>    Brand assets folder / connectedBrandName. Default: derived from
-                               --brand_name (lowercased, spaces removed)
-  --color <hex>                Brand hex color, e.g. "#1a2b3c". Empty ⇒ default palette ($corp)
-  --logo_url <url>             Logo image URL (black background) (required)
-  --favicon_url <url>          Favicon image URL (required)
-  --languages <csv>            2-letter language codes, comma-separated, e.g. "en,ar,de" (required)
-  --fcm_sender_id <id>         Firebase FCMSenderId (required)
-  --type <type>                One of: ${ALLOWED_TYPES.join(', ')} (required)
-  -h, --help                   Show this help
-
-Run from the root of a web-crm checkout — files are written relative to the current directory.
-`;
-
-const FLAGS = {
-  '--brand_name': 'brandName',
-  '--brand_assets_folder': 'brandAssetsFolder',
-  '--color': 'color',
-  '--logo_url': 'logo',
-  '--favicon_url': 'favicon',
-  '--languages': 'languages',
-  '--fcm_sender_id': 'fcmSenderId',
-  '--type': 'type'
-};
-
-function parseArgs(argv) {
-  const opts = {};
-  for (let i = 0; i < argv.length; i++) {
-    const a = argv[i];
-    if (a === '--help' || a === '-h') opts.help = true;
-    else if (FLAGS[a]) opts[FLAGS[a]] = argv[++i];
-  }
-  return opts;
-}
-
-const ask = (rl, question) => new Promise((resolve) => rl.question(question, (a) => resolve(a)));
-
-// Resolve a value: prefer the flag; otherwise prompt (interactive only). Returns undefined
-// when absent and non-interactive, so the caller can report it as a missing required field.
-async function resolve(opts, key, promptText, interactive, rl) {
-  if (opts[key] !== undefined) return opts[key];
-  if (interactive) return ask(rl, promptText);
-  return undefined;
-}
-
-async function run() {
-  const opts = parseArgs(process.argv.slice(3));
-  if (opts.help) {
-    console.log(HELP);
-    return;
-  }
-
-  console.log(chalk.underline(chalk.cyan('Antelope CRM on-boarding\n')));
-
-  // Interactive only in a real terminal and when not forced non-interactive (CI / Ansible).
-  const interactive = Boolean(process.stdin.isTTY) && !process.env.CI;
-  const rl = interactive ? readline.createInterface({ input: process.stdin, output: process.stdout }) : null;
-
-  try {
-    const brandName = await resolve(opts, 'brandName', "What is the new brand's name?\n", interactive, rl);
-    const kebabCaseName = brandName ? brandName.toLowerCase().replace(/ /g, '-') : '';
-    const connectedBrandName = opts.brandAssetsFolder
-      ? opts.brandAssetsFolder.trim().toLowerCase().replace(/ /g, '')
-      : (brandName ? brandName.toLowerCase().replace(/ /g, '') : '');
-
-    // Color is optional (empty ⇒ default palette).
-    const color = opts.color !== undefined
-      ? opts.color
-      : (interactive ? await ask(rl, `Please set a color for "${kebabCaseName}", use hex value, leave empty for default.\n`) : '');
-
-    const logo = await resolve(opts, 'logo', 'Please enter the URL to the logo image suitable for a black background:\n', interactive, rl);
-    const favicon = await resolve(opts, 'favicon', 'Please provide the url to your favicon image:\n', interactive, rl);
-    const languagesInput = await resolve(opts, 'languages', 'Enter the languages (2-letter codes) separated by commas:\n', interactive, rl);
-    const fcmSenderId = await resolve(opts, 'fcmSenderId', 'Enter the FCMSenderId value (see https://xsites.atlassian.net/wiki/spaces/IKB/pages/777650347/Onboarding+Branding+Manual+for+devs#Firebase): ', interactive, rl);
-    const typeInput = await resolve(opts, 'type', `Enter the type value (allowed values: ${ALLOWED_TYPES.join(', ')}): `, interactive, rl);
-
-    // Validate required fields.
-    const missing = [];
-    if (!brandName) missing.push('--brand_name');
-    if (!logo) missing.push('--logo_url');
-    if (!favicon) missing.push('--favicon_url');
-    if (!languagesInput) missing.push('--languages');
-    if (!fcmSenderId) missing.push('--fcm_sender_id');
-    if (!typeInput) missing.push('--type');
-    if (missing.length) {
-      console.error(chalk.red(`Error: missing required value(s): ${missing.join(', ')}`));
-      console.log(HELP);
-      process.exitCode = 1;
-      return;
-    }
-
-    const type = typeInput.toUpperCase();
-    if (!ALLOWED_TYPES.includes(type)) {
-      console.error(chalk.red(`Error: invalid --type "${typeInput}". Allowed: ${ALLOWED_TYPES.join(', ')}`));
-      process.exitCode = 1;
-      return;
-    }
-
-    const languages = languagesInput.trim().split(',').map((l) => l.trim()).filter(Boolean);
-    if (!languages.length) {
-      console.error(chalk.red('Error: --languages must contain at least one 2-letter code.'));
-      process.exitCode = 1;
-      return;
-    }
-
-    brandModule.updateBrand({
-      brandName,
-      kebabCaseName,
-      connectedBrandName,
-      color: color || '',
-      logo,
-      favicon,
-      languages,
-      FCMSenderId: fcmSenderId,
-      type
-    });
-
-    console.log(chalk.bold(chalk.yellow(`\nOnboarding "${brandName}" (folder: ${connectedBrandName})`)));
-    console.log(chalk.bold(chalk.yellow('\nStep 1: Add to variables-colors.scss')));
-    await variablesColors.start();
-    console.log(chalk.bold(chalk.yellow('\nStep 2: Add to themes.scss')));
-    await themes.start();
-    console.log(chalk.bold(chalk.yellow('\nStep 3: Adding translations')));
-    await translations.start();
-    console.log(chalk.bold(chalk.yellow('\nStep 4: Editing the config file')));
-    await createConfig.start();
-    console.log(chalk.green('\nCRM onboarding completed!'));
-  } catch (err) {
-    console.error(chalk.red(err) + '\n Please delete files and code added by this failed session.');
-    process.exitCode = 1;
-  } finally {
-    if (rl) rl.close();
-  }
-}
-
-run();
+const readline = require('readline');
+const chalk = require('chalk');
+const brandModule = require('./brand.js');
+const variablesColors = require('./variablesColors.js');
+const themes = require('./themes.js');
+const translations = require('./translations.js');
+const createConfig = require('./createConfig.js');
+const brandLocations = require('./brandLocations.js');
+
+const ALLOWED_TYPES = ['CORP_FL', 'IB_FL', 'CORP_AFF_FL', 'CORP_AFF_IB_PORTAL', 'CORP_AFF_MSQ'];
+const DEFAULT_BASE_URL = 'https://dev-apicrm.antelopesystem.com/SignalsCRM/';
+
+const HELP = `
+Usage: ant-cli onboarding-crm --brand_id <id> --brand_name <name> [options]
+
+Onboards a CRM brand in the current web-crm checkout, keyed by the brand's Antelope ID.
+All inputs come from flags (interactive prompts are only a fallback in a TTY):
+  src/ng1/assets/css/sass/variables-colors.scss     (+ $<id> shades and $colors entry)
+  src/ng1/assets/css/sass/materialism/themes.scss   (+ theme maps and .theme-template-<id> block)
+  src/assets/brands/<id>/languages/<lang>.json      (one empty file per language)
+  src/configs/configs.ts                            (rewritten for the brand — copy into Consul)
+  BRAND_LOCATIONS.md                                (+ sprint tracking row "<name> -> <id>")
+
+Options:
+  --brand_id <id>       Antelope unique ID, e.g. "xxxxx" — the code identifier used everywhere (required)
+  --brand_name <name>   Human brand name — recorded in the BRAND_LOCATIONS.md tracking row (required)
+  --color <hex>         Brand hex color, e.g. "#1a2b3c". Empty => default palette ($corp)
+  --logo_url <url>      Logo image URL (black background) (required)
+  --languages <csv>     2-letter language codes, comma-separated, e.g. "en,ar" (required)
+  --favicon_url <url>   Favicon image URL → configs.ts favicon (required)
+  --fcm_sender_id <id>  Firebase FCMSenderId → configs.ts (required)
+  --type <type>         One of: ${ALLOWED_TYPES.join(', ')} → configs.ts (required)
+  --base_url <url>      configs.ts baseUrl. Default: ${DEFAULT_BASE_URL}
+  -h, --help            Show this help
+
+Run from the root of a web-crm checkout — files are written relative to the current directory.
+`;
+
+const FLAGS = {
+  '--brand_id': 'brandId',
+  '--brand_name': 'brandName',
+  '--color': 'color',
+  '--logo_url': 'logo',
+  '--languages': 'languages',
+  '--favicon_url': 'favicon',
+  '--fcm_sender_id': 'fcmSenderId',
+  '--type': 'type',
+  '--base_url': 'baseUrl'
+};
+
+function parseArgs(argv) {
+  const opts = {};
+  for (let i = 0; i < argv.length; i++) {
+    const a = argv[i];
+    if (a === '--help' || a === '-h') opts.help = true;
+    else if (FLAGS[a]) opts[FLAGS[a]] = argv[++i];
+  }
+  return opts;
+}
+
+// Antelope IDs are lowercase alphanumeric; normalize defensively (trim, lowercase, drop spaces).
+const normalizeId = (value) => value.trim().toLowerCase().replace(/ /g, '');
+
+const ask = (rl, question) => new Promise((resolve) => rl.question(question, (a) => resolve(a)));
+
+// Resolve a value: prefer the flag; otherwise prompt (interactive only). Returns undefined
+// when absent and non-interactive, so the caller can report it as a missing required field.
+async function resolve(opts, key, promptText, interactive, rl) {
+  if (opts[key] !== undefined) return opts[key];
+  if (interactive) return ask(rl, promptText);
+  return undefined;
+}
+
+async function run() {
+  const opts = parseArgs(process.argv.slice(3));
+  if (opts.help) {
+    console.log(HELP);
+    return;
+  }
+
+  console.log(chalk.underline(chalk.cyan('Antelope CRM on-boarding\n')));
+
+  // Interactive only in a real terminal and when not forced non-interactive (CI / Ansible).
+  const interactive = Boolean(process.stdin.isTTY) && !process.env.CI;
+  const rl = interactive ? readline.createInterface({ input: process.stdin, output: process.stdout }) : null;
+
+  try {
+    const brandIdRaw = await resolve(opts, 'brandId', "Enter the brand's Antelope ID (e.g. xxxxx):\n", interactive, rl);
+    const brandName = await resolve(opts, 'brandName', "What is the new brand's name?\n", interactive, rl);
+    const connectedBrandName = brandIdRaw ? normalizeId(brandIdRaw) : '';
+
+    // Color is optional (empty => default palette).
+    const color = opts.color !== undefined
+      ? opts.color
+      : (interactive ? await ask(rl, `Please set a color for "${connectedBrandName}", use hex value, leave empty for default.\n`) : '');
+
+    const logo = await resolve(opts, 'logo', 'Please enter the URL to the logo image suitable for a black background:\n', interactive, rl);
+    const favicon = await resolve(opts, 'favicon', 'Please provide the url to your favicon image:\n', interactive, rl);
+    const languagesInput = await resolve(opts, 'languages', 'Enter the languages (2-letter codes) separated by commas:\n', interactive, rl);
+    const fcmSenderId = await resolve(opts, 'fcmSenderId', 'Enter the FCMSenderId value (see https://xsites.atlassian.net/wiki/spaces/IKB/pages/777650347/Onboarding+Branding+Manual+for+devs#Firebase): ', interactive, rl);
+    const typeInput = await resolve(opts, 'type', `Enter the type value (allowed values: ${ALLOWED_TYPES.join(', ')}): `, interactive, rl);
+
+    // baseUrl is optional (defaults to the dev URL).
+    const baseUrl = opts.baseUrl !== undefined && opts.baseUrl !== ''
+      ? opts.baseUrl
+      : (interactive ? (await ask(rl, `Enter the configs.ts baseUrl (leave empty for ${DEFAULT_BASE_URL}):\n`)) || DEFAULT_BASE_URL : DEFAULT_BASE_URL);
+
+    // Validate required fields.
+    const missing = [];
+    if (!connectedBrandName) missing.push('--brand_id');
+    if (!brandName) missing.push('--brand_name');
+    if (!logo) missing.push('--logo_url');
+    if (!favicon) missing.push('--favicon_url');
+    if (!languagesInput) missing.push('--languages');
+    if (!fcmSenderId) missing.push('--fcm_sender_id');
+    if (!typeInput) missing.push('--type');
+    if (missing.length) {
+      console.error(chalk.red(`Error: missing required value(s): ${missing.join(', ')}`));
+      console.log(HELP);
+      process.exitCode = 1;
+      return;
+    }
+
+    const type = typeInput.toUpperCase();
+    if (!ALLOWED_TYPES.includes(type)) {
+      console.error(chalk.red(`Error: invalid --type "${typeInput}". Allowed: ${ALLOWED_TYPES.join(', ')}`));
+      process.exitCode = 1;
+      return;
+    }
+
+    const languages = languagesInput.trim().split(',').map((l) => l.trim()).filter(Boolean);
+    if (!languages.length) {
+      console.error(chalk.red('Error: --languages must contain at least one 2-letter code.'));
+      process.exitCode = 1;
+      return;
+    }
+
+    brandModule.updateBrand({
+      brandId: connectedBrandName,
+      brandName,
+      connectedBrandName,
+      color: color || '',
+      logo,
+      languages,
+      favicon,
+      FCMSenderId: fcmSenderId,
+      type,
+      baseUrl
+    });
+
+    console.log(chalk.bold(chalk.yellow(`\nOnboarding "${brandName}" (id: ${connectedBrandName})`)));
+    console.log(chalk.bold(chalk.yellow('\nStep 1: Add to variables-colors.scss')));
+    await variablesColors.start();
+    console.log(chalk.bold(chalk.yellow('\nStep 2: Add to themes.scss')));
+    await themes.start();
+    console.log(chalk.bold(chalk.yellow('\nStep 3: Adding translations')));
+    await translations.start();
+    console.log(chalk.bold(chalk.yellow('\nStep 4: Editing the config file')));
+    await createConfig.start();
+    console.log(chalk.bold(chalk.yellow('\nStep 5: Recording in BRAND_LOCATIONS.md')));
+    await brandLocations.start();
+    console.log(chalk.green('\nCRM onboarding completed!'));
+  } catch (err) {
+    console.error(chalk.red(err) + '\n Please delete files and code added by this failed session.');
+    process.exitCode = 1;
+  } finally {
+    if (rl) rl.close();
+  }
+}
+
+run();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "antelope-cli",
-  "version": "1.2.1",
+  "version": "1.2.2",
   "description": "CLI-Tool for automating processes for Antelope-Systems ",
   "main": "index.js",
   "bin": {