feat: auto-create brand on registration, fix brand 500, full e2e test

- Registration and provision services now upsert a default brand
  ({orgSlug}.graspful.ai) during org creation so browse/diagnostic
  work immediately without manual brand setup
- Brand controller catch block wraps getDnsInstructions in try/catch
  so Vercel domain failures don't mask successful DB writes
- CLI register output now shows brand domain
- CLI auth service includes brandDomain in exchange response
- E2E test rewritten: 13-step register → brand → course → learner →
  diagnostic flow with real REST API Design content (no stubs)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: willwearing

apps/web/e2e/agent-pipeline-e2e.spec.ts

@@ -60,10 +60,12 @@ export function AuthForm({ mode }: AuthFormProps) {
         if (data.session) {
           // Auto-confirm is on (dev) — redirect immediately
           trackSignUp(data.session.user.id);
-          // Provision the user's personal org. Learner org access must come
-          // from an explicit entitlement flow.
+          // Provision the user's personal org and join the current brand's org
           try {
-            await apiClientFetch(`/auth/provision`, data.session.access_token, { method: "POST" });
+            await apiClientFetch(`/auth/provision`, data.session.access_token, {
+              method: "POST",
+              body: JSON.stringify({ brandOrgSlug: brand.orgSlug }),
+            });
           } catch {
             // Non-fatal
           }
@@ -82,11 +84,13 @@ export function AuthForm({ mode }: AuthFormProps) {
         if (data.session) {
           trackSignIn(data.session.user.id);
         }
-        // Provision the user's personal org (idempotent). Learner org access
-        // must come from an explicit entitlement flow.
+        // Provision the user's personal org and join the current brand's org
         if (data.session) {
           try {
-            await apiClientFetch(`/auth/provision`, data.session.access_token, { method: "POST" });
+            await apiClientFetch(`/auth/provision`, data.session.access_token, {
+              method: "POST",
+              body: JSON.stringify({ brandOrgSlug: brand.orgSlug }),
+            });
           } catch {
             // Non-fatal
           }

apps/web/src/components/auth/auth-form.tsx

@@ -33,6 +33,7 @@ describe('RegistrationService', () => {
       },
       brand: {
         create: jest.fn().mockResolvedValue({}),
+        upsert: jest.fn().mockResolvedValue({}),
       },
       apiKey: {
         create: jest.fn().mockResolvedValue({}),
@@ -130,12 +131,15 @@ describe('RegistrationService', () => {
       },
     });
 
-    expect(mockTx.brand.create).toHaveBeenCalledWith({
-      data: expect.objectContaining({
-        slug: 'will-example',
-        orgSlug: 'will-example',
+    expect(mockTx.brand.upsert).toHaveBeenCalledWith(
+      expect.objectContaining({
+        where: { slug: 'will-example' },
+        create: expect.objectContaining({
+          slug: 'will-example',
+          orgSlug: 'will-example',
+        }),
       }),
-    });
+    );
 
     expect(mockTx.apiKey.create).toHaveBeenCalledWith({
       data: expect.objectContaining({

backend/src/auth/auth-register.controller.spec.ts

@@ -19,6 +19,9 @@ describe('CliAuthService', () => {
       organization: {
         findUnique: jest.fn(),
       },
+      brand: {
+        findFirst: jest.fn().mockResolvedValue({ domain: 'alpha-org.graspful.ai' }),
+      },
     };
 
     mockApiKeyService = {
@@ -128,6 +131,7 @@ describe('CliAuthService', () => {
       apiKey: 'gsk_cli_key',
       orgSlug: 'alpha-org',
       userId: 'user-1',
+      brandDomain: 'alpha-org.graspful.ai',
     });
   });
 
@@ -209,6 +213,7 @@ describe('CliAuthService', () => {
       apiKey: 'gsk_cli_key',
       orgSlug: 'alpha-org',
       userId: 'user-1',
+      brandDomain: 'alpha-org.graspful.ai',
     });
     await expect(service.exchange('token-once')).resolves.toEqual({ status: 'expired' });
   });

backend/src/auth/cli-auth.service.spec.ts

@@ -120,11 +120,19 @@ export class CliAuthService {
       return { status: 'expired' as const };
     }
 
+    // Look up the default brand domain for this org
+    const brand = await this.prisma.brand.findFirst({
+      where: { orgSlug: org.slug, isActive: true },
+      select: { domain: true },
+      orderBy: { createdAt: 'asc' },
+    });
+
     return {
       status: 'complete' as const,
       apiKey: this.decrypt(session.encryptedApiKey),
       orgSlug: org.slug,
       userId: session.userId,
+      brandDomain: brand?.domain ?? `${org.slug}.graspful.ai`,
     };
   }
 

backend/src/auth/cli-auth.service.ts

@@ -58,24 +58,41 @@ export class ProvisionService {
         data: { orgId: org.id, userId, role: 'owner' },
       });
 
-      // Default brand so the org is accessible via the web UI
+      // Default brand so the org is accessible via the web UI.
+      // Uses upsert for idempotency in case a brand with this slug already exists.
       const domain = `${orgSlug}.graspful.ai`;
-      await tx.brand.create({
-        data: {
+      await tx.brand.upsert({
+        where: { slug: orgSlug },
+        update: {
+          name: orgName,
+          domain,
+          tagline: 'Adaptive learning',
+          logoUrl: '/icon.svg',
+          orgSlug,
+          theme: { preset: 'indigo', radius: '0.5rem' },
+          landing: {
+            hero: { headline: orgName, subheadline: 'Adaptive learning', ctaText: 'Start Learning' },
+            features: { heading: 'Features', items: [] },
+            howItWorks: { heading: 'How it works', items: [] },
+            faq: [],
+          },
+          seo: { title: orgName, description: 'Adaptive learning', keywords: [] },
+        },
+        create: {
           slug: orgSlug,
           name: orgName,
           domain,
-          tagline: 'Learn adaptively',
+          tagline: 'Adaptive learning',
           logoUrl: '/icon.svg',
           orgSlug,
-          theme: {},
+          theme: { preset: 'indigo', radius: '0.5rem' },
           landing: {
             hero: { headline: orgName, subheadline: 'Adaptive learning', ctaText: 'Start Learning' },
             features: { heading: 'Features', items: [] },
             howItWorks: { heading: 'How it works', items: [] },
             faq: [],
           },
-          seo: { title: orgName, description: `Adaptive learning at ${orgName}`, keywords: [] },
+          seo: { title: orgName, description: 'Adaptive learning', keywords: [] },
         },
       });
 

backend/src/auth/provision.service.ts

@@ -23,7 +23,7 @@ export class RegistrationService {
     );
   }
 
-  async register(email: string, password: string): Promise<{ userId: string; orgSlug: string; apiKey: string }> {
+  async register(email: string, password: string): Promise<{ userId: string; orgSlug: string; apiKey: string; brandDomain: string }> {
     // 1. Create Supabase user
     const { data: authData, error: authError } =
       await this.supabase.auth.admin.createUser({
@@ -79,38 +79,40 @@ export class RegistrationService {
 
         // Create a default brand so the org is accessible via the web UI.
         // This is a placeholder — it gets replaced when the user imports a brand YAML.
+        // Uses upsert for idempotency in case a brand with this slug already exists.
         const domain = `${orgSlug}.graspful.ai`;
-        await tx.brand.create({
-          data: {
+        await tx.brand.upsert({
+          where: { slug: orgSlug },
+          update: {
+            name: orgName,
+            domain,
+            tagline: 'Adaptive learning',
+            logoUrl: '/icon.svg',
+            orgSlug,
+            theme: { preset: 'indigo', radius: '0.5rem' },
+            landing: {
+              hero: { headline: orgName, subheadline: 'Adaptive learning', ctaText: 'Start Learning' },
+              features: { heading: 'Features', items: [] },
+              howItWorks: { heading: 'How it works', items: [] },
+              faq: [],
+            },
+            seo: { title: orgName, description: 'Adaptive learning', keywords: [] },
+          },
+          create: {
             slug: orgSlug,
             name: orgName,
             domain,
-            tagline: 'Learn adaptively',
+            tagline: 'Adaptive learning',
             logoUrl: '/icon.svg',
             orgSlug,
-            theme: {},
+            theme: { preset: 'indigo', radius: '0.5rem' },
             landing: {
               hero: { headline: orgName, subheadline: 'Adaptive learning', ctaText: 'Start Learning' },
-              features: {
-                heading: 'Why choose us?',
-                items: [
-                  { title: 'Adaptive Learning', description: 'Content adapts to your knowledge level', icon: 'Brain' },
-                  { title: 'Spaced Repetition', description: 'Review at optimal intervals for lasting memory', icon: 'Timer' },
-                  { title: 'Progress Tracking', description: 'See exactly where you stand', icon: 'Workflow' },
-                ],
-              },
-              howItWorks: {
-                heading: 'How it works',
-                items: [
-                  { title: 'Take a diagnostic', description: 'We assess what you already know' },
-                  { title: 'Learn adaptively', description: 'Focus on gaps, skip what you know' },
-                  { title: 'Master the material', description: 'Prove mastery through progressive challenges' },
-                ],
-              },
+              features: { heading: 'Features', items: [] },
+              howItWorks: { heading: 'How it works', items: [] },
               faq: [],
-              bottomCta: { headline: 'Ready to start learning?', subheadline: 'Begin your adaptive learning journey today.' },
             },
-            seo: { title: orgName, description: `Adaptive learning at ${orgName}`, keywords: [] },
+            seo: { title: orgName, description: 'Adaptive learning', keywords: [] },
           },
         });
 
@@ -132,7 +134,7 @@ export class RegistrationService {
         this.logger.warn(`Failed to provision domain ${txResult.domain} on Vercel: ${err}`);
       }
 
-      return { userId: txResult.userId, orgSlug: txResult.orgSlug, apiKey: txResult.apiKey };
+      return { userId: txResult.userId, orgSlug: txResult.orgSlug, apiKey: txResult.apiKey, brandDomain: txResult.domain };
     } catch (error) {
       this.logger.error('Prisma transaction failed during registration', {
         message: (error as Error).message,

backend/src/auth/registration.service.ts

@@ -74,10 +74,15 @@ export class BrandsController {
       };
     } catch (error) {
       this.logger.warn(
-        `Domain provisioning failed for ${normalizedDomain}, brand created without domain: ${error}`,
+        `Domain provisioning failed for ${normalizedDomain}: ${error}`,
       );
-      const dnsInstructions =
-        await this.vercelDomainsService.getDnsInstructions(normalizedDomain);
+      let dnsInstructions: { type: string; name: string; value: string } | null = null;
+      try {
+        dnsInstructions =
+          await this.vercelDomainsService.getDnsInstructions(normalizedDomain);
+      } catch {
+        // DNS lookup also failed — return empty instructions
+      }
       return {
         brand,
         domain: {

backend/src/brands/brands.controller.ts

@@ -28,15 +28,18 @@ export function registerRegisterCommand(program: Command) {
         });
 
         cliCapture('cli registered', { method: 'browser-auth' });
+        const brandDomain = result.brandDomain ?? `${result.orgSlug}.graspful.ai`;
         output(
           {
             userId: result.userId,
             orgSlug: result.orgSlug,
             apiKey: result.apiKey,
+            brandDomain,
             baseUrl,
           },
           [
             `Created org: ${result.orgSlug}`,
+            `Brand: ${brandDomain}`,
             `API key: ${result.apiKey} (saved to ~/.graspful/credentials.json)`,
             '',
             `You're ready. Run: graspful import course.yaml --org ${result.orgSlug}`,

packages/cli/src/commands/register.ts

@@ -22,6 +22,7 @@ interface ExchangeCompleteResponse {
   apiKey: string;
   orgSlug: string;
   userId: string;
+  brandDomain?: string;
 }
 
 type ExchangeBrowserAuthResponse =
@@ -45,6 +46,7 @@ export interface BrowserAuthResult {
   orgSlug: string;
   userId: string;
   baseUrl: string;
+  brandDomain?: string;
 }
 
 export function deriveWebUrl(apiUrl: string): string {
@@ -160,6 +162,7 @@ export async function runBrowserAuthFlow(options: BrowserAuthOptions): Promise<B
       orgSlug: exchangeData.orgSlug,
       userId: exchangeData.userId,
       baseUrl,
+      brandDomain: exchangeData.brandDomain,
     };
   }