feat(onboarding): add brand context storage, settings UI, and onboarding route

- Add brand_context column to organization_settings (migration 063)
- Implement OrganizationSettingsStorage get/upsert with brand context
- Add ORGANIZATION_SETTINGS_GET/UPDATE tools with brand context support
- Add Brand Context settings page under Settings > Context
- Add dynamic buildBrandContextPrompt() for decopilot prompt injection
- Add onboarding route with email detection and org creation flow

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: rafavalls

apps/mesh/migrations/063-brand-context.ts

@@ -0,0 +1,15 @@
+import { Kysely } from "kysely";
+
+export async function up(db: Kysely<unknown>): Promise<void> {
+  await db.schema
+    .alterTable("organization_settings")
+    .addColumn("brand_context", "text")
+    .execute();
+}
+
+export async function down(db: Kysely<unknown>): Promise<void> {
+  await db.schema
+    .alterTable("organization_settings")
+    .dropColumn("brand_context")
+    .execute();
+}

apps/mesh/migrations/index.ts

@@ -61,6 +61,7 @@ import * as migration059kv from "./059-kv.ts";
 import * as migration060memberindex from "./060-member-index.ts";
 import * as migration061downstreamtokenconnectionindex from "./061-downstream-token-connection-index.ts";
 import * as migration062privateregistry from "./062-private-registry.ts";
+import * as migration063brandcontext from "./063-brand-context.ts";
 
 /**
  * Core migrations for the Mesh application.
@@ -135,6 +136,7 @@ const migrations: Record<string, Migration> = {
   "061-downstream-token-connection-index":
     migration061downstreamtokenconnectionindex,
   "062-private-registry": migration062privateregistry,
+  "063-brand-context": migration063brandcontext,
 };
 
 export default migrations;

apps/mesh/src/api/routes/decopilot/constants.ts

@@ -143,6 +143,40 @@ Focus exclusively on:
 </scope>`;
 }
 
+/**
+ * Brand context prompt — org identity injected into every prompt.
+ * The model must never use tools to look this up; it is always present.
+ */
+export function buildBrandContextPrompt(
+  brand: {
+    name: string;
+    domain: string;
+    overview: string;
+    colors: { label: string; value: string }[];
+    fonts: { name: string; role: string }[];
+  } | null,
+): string {
+  if (!brand) return "";
+
+  const primaryColors = brand.colors
+    .map((c) => `${c.label}: ${c.value}`)
+    .join(", ");
+  const fonts = brand.fonts.map((f) => `${f.name} (${f.role})`).join(", ");
+
+  return `<brand-context>
+You are assisting the team at ${brand.name}. Always use this context to inform your responses — never call tools to look up information that is already provided here.
+
+Company: ${brand.name}
+Website: https://${brand.domain}
+Domain: ${brand.domain}
+Overview: ${brand.overview}
+Primary colors: ${primaryColors}
+Fonts: ${fonts}
+
+When the user mentions "my site", "our store", "the website", or "my URL", they are referring to https://${brand.domain}.
+</brand-context>`;
+}
+
 export const TITLE_GENERATOR_PROMPT = `Generate a concise, sentence-case title (3-7 words) that captures the main topic or goal of this session. Use sentence case: capitalize only the first word and proper nouns.
 
 Return JSON with a single "title" field.

apps/mesh/src/storage/organization-settings.ts

@@ -35,6 +35,11 @@ export class OrganizationSettingsStorage
           ? JSON.parse(record.registry_config)
           : record.registry_config
         : null,
+      brand_context: record.brand_context
+        ? typeof record.brand_context === "string"
+          ? JSON.parse(record.brand_context)
+          : record.brand_context
+        : null,
       createdAt: record.createdAt,
       updatedAt: record.updatedAt,
     };
@@ -45,7 +50,10 @@ export class OrganizationSettingsStorage
     data?: Partial<
       Pick<
         OrganizationSettings,
-        "sidebar_items" | "enabled_plugins" | "registry_config"
+        | "sidebar_items"
+        | "enabled_plugins"
+        | "registry_config"
+        | "brand_context"
       >
     >,
   ): Promise<OrganizationSettings> {
@@ -59,6 +67,9 @@ export class OrganizationSettingsStorage
     const registryConfigJson = data?.registry_config
       ? JSON.stringify(data.registry_config)
       : null;
+    const brandContextJson = data?.brand_context
+      ? JSON.stringify(data.brand_context)
+      : null;
 
     await this.db
       .insertInto("organization_settings")
@@ -67,6 +78,7 @@ export class OrganizationSettingsStorage
         sidebar_items: sidebarItemsJson,
         enabled_plugins: enabledPluginsJson,
         registry_config: registryConfigJson,
+        brand_context: brandContextJson,
         createdAt: now,
         updatedAt: now,
       })
@@ -75,6 +87,7 @@ export class OrganizationSettingsStorage
           sidebar_items: sidebarItemsJson ? sidebarItemsJson : undefined,
           enabled_plugins: enabledPluginsJson ? enabledPluginsJson : undefined,
           registry_config: registryConfigJson ? registryConfigJson : undefined,
+          brand_context: brandContextJson ? brandContextJson : undefined,
           updatedAt: now,
         }),
       )
@@ -88,6 +101,7 @@ export class OrganizationSettingsStorage
         sidebar_items: data?.sidebar_items ?? null,
         enabled_plugins: data?.enabled_plugins ?? null,
         registry_config: data?.registry_config ?? null,
+        brand_context: data?.brand_context ?? null,
         createdAt: now,
         updatedAt: now,
       };

apps/mesh/src/storage/ports.ts

@@ -131,7 +131,10 @@ export interface OrganizationSettingsStoragePort {
     data?: Partial<
       Pick<
         OrganizationSettings,
-        "sidebar_items" | "enabled_plugins" | "registry_config"
+        | "sidebar_items"
+        | "enabled_plugins"
+        | "registry_config"
+        | "brand_context"
       >
     >,
   ): Promise<OrganizationSettings>;

apps/mesh/src/storage/types.ts

@@ -131,11 +131,24 @@ export interface RegistryConfig {
   blockedMcps: string[];
 }
 
+export interface BrandContext {
+  name: string;
+  domain: string;
+  overview: string;
+  logo?: string;
+  favicon?: string;
+  ogImage?: string;
+  fonts?: Array<{ name: string; role: string }>;
+  colors?: Array<{ label: string; value: string }>;
+  images?: string[];
+}
+
 export interface OrganizationSettingsTable {
   organizationId: string;
   sidebar_items: JsonArray<SidebarItem[]> | null;
   enabled_plugins: JsonArray<string[]> | null;
   registry_config: JsonObject<RegistryConfig> | null;
+  brand_context: JsonObject<BrandContext> | null;
   createdAt: ColumnType<Date, Date | string, never>;
   updatedAt: ColumnType<Date, Date | string, Date | string>;
 }
@@ -145,6 +158,7 @@ export interface OrganizationSettings {
   sidebar_items: SidebarItem[] | null;
   enabled_plugins: string[] | null;
   registry_config: RegistryConfig | null;
+  brand_context: BrandContext | null;
   createdAt: Date | string;
   updatedAt: Date | string;
 }

apps/mesh/src/tools/organization/schema.ts

@@ -24,6 +24,22 @@ export type SidebarItem = z.infer<typeof SidebarItemSchema>;
  * Controls which registries are visible in the store and which individual MCPs are blocked.
  * When null/absent, defaults to Deco Store enabled with nothing blocked.
  */
+export const BrandContextSchema = z.object({
+  name: z.string(),
+  domain: z.string(),
+  overview: z.string(),
+  logo: z.string().optional(),
+  favicon: z.string().optional(),
+  ogImage: z.string().optional(),
+  fonts: z.array(z.object({ name: z.string(), role: z.string() })).optional(),
+  colors: z
+    .array(z.object({ label: z.string(), value: z.string() }))
+    .optional(),
+  images: z.array(z.string()).optional(),
+});
+
+export type BrandContext = z.infer<typeof BrandContextSchema>;
+
 export const RegistryConfigSchema = z.object({
   registries: z
     .record(z.string(), z.object({ enabled: z.boolean() }))

apps/mesh/src/tools/organization/settings-get.ts

@@ -1,7 +1,11 @@
 import { z } from "zod";
 import { defineTool } from "../../core/define-tool";
 import { requireAuth } from "../../core/mesh-context";
-import { SidebarItemSchema, RegistryConfigSchema } from "./schema.ts";
+import {
+  BrandContextSchema,
+  SidebarItemSchema,
+  RegistryConfigSchema,
+} from "./schema.ts";
 
 export const ORGANIZATION_SETTINGS_GET = defineTool({
   name: "ORGANIZATION_SETTINGS_GET",
@@ -21,6 +25,7 @@ export const ORGANIZATION_SETTINGS_GET = defineTool({
     sidebar_items: z.array(SidebarItemSchema).nullable().optional(),
     enabled_plugins: z.array(z.string()).nullable().optional(),
     registry_config: RegistryConfigSchema.nullable().optional(),
+    brand_context: BrandContextSchema.nullable().optional(),
     createdAt: z.string().datetime().optional().describe("ISO 8601 timestamp"),
     updatedAt: z.string().datetime().optional().describe("ISO 8601 timestamp"),
   }),

apps/mesh/src/tools/organization/settings-update.ts

@@ -1,7 +1,11 @@
 import { z } from "zod";
 import { defineTool } from "../../core/define-tool";
 import { requireAuth } from "../../core/mesh-context";
-import { SidebarItemSchema, RegistryConfigSchema } from "./schema.ts";
+import {
+  BrandContextSchema,
+  SidebarItemSchema,
+  RegistryConfigSchema,
+} from "./schema.ts";
 
 export const ORGANIZATION_SETTINGS_UPDATE = defineTool({
   name: "ORGANIZATION_SETTINGS_UPDATE",
@@ -19,13 +23,15 @@ export const ORGANIZATION_SETTINGS_UPDATE = defineTool({
     sidebar_items: z.array(SidebarItemSchema).optional(),
     enabled_plugins: z.array(z.string()).optional(),
     registry_config: RegistryConfigSchema.optional(),
+    brand_context: BrandContextSchema.optional(),
   }),
 
   outputSchema: z.object({
     organizationId: z.string(),
     sidebar_items: z.array(SidebarItemSchema).nullable().optional(),
     enabled_plugins: z.array(z.string()).nullable().optional(),
     registry_config: RegistryConfigSchema.nullable().optional(),
+    brand_context: BrandContextSchema.nullable().optional(),
     createdAt: z.string().datetime().describe("ISO 8601 timestamp"),
     updatedAt: z.string().datetime().describe("ISO 8601 timestamp"),
   }),
@@ -44,6 +50,7 @@ export const ORGANIZATION_SETTINGS_UPDATE = defineTool({
         sidebar_items: input.sidebar_items,
         enabled_plugins: input.enabled_plugins,
         registry_config: input.registry_config,
+        brand_context: input.brand_context,
       },
     );
 

apps/mesh/src/web/index.tsx

@@ -98,6 +98,12 @@ const storeInviteRoute = createRoute({
   ),
 });
 
+const onboardingRoute = createRoute({
+  getParentRoute: () => rootRoute,
+  path: "/onboarding",
+  component: lazyRouteComponent(() => import("./routes/onboarding.tsx")),
+});
+
 const oauthCallbackRoute = createRoute({
   getParentRoute: () => rootRoute,
   path: "/oauth/callback",
@@ -291,6 +297,14 @@ const settingsGeneralRoute = createRoute({
   ),
 });
 
+const settingsBrandContextRoute = createRoute({
+  getParentRoute: () => settingsLayout,
+  path: "/brand-context",
+  component: lazyRouteComponent(
+    () => import("./routes/orgs/settings/brand-context.tsx"),
+  ),
+});
+
 const settingsFeaturesRoute = createRoute({
   getParentRoute: () => settingsLayout,
   path: "/features",
@@ -527,6 +541,7 @@ const settingsWithChildren = settingsLayout.addChildren([
   collectionDetailRoute,
   monitoringRoute,
   settingsGeneralRoute,
+  settingsBrandContextRoute,
   settingsFeaturesRoute,
   settingsAiProvidersRoute,
   settingsMembersRoute,
@@ -571,6 +586,7 @@ const routeTree = rootRoute.addChildren([
   oauthCallbackRoute,
   oauthCallbackAiProviderRoute,
   storeInviteRoute,
+  onboardingRoute,
 ]);
 
 const router = createRouter({