@lukoweb/apitogo 0.2.54 → 0.2.57

package/dist/declarations/cli/platform/client/platform-api.d.ts

@@ -18,6 +18,11 @@ export interface ProjectModuleStateDto {
     type: string;
     status: string;
 }
+export type ProjectIdentityBrandingBody = {
+    name?: string;
+    logoUrl?: string;
+    color?: string;
+};
 export interface ProjectDto {
     id: string;
     ownerTenantId: string;
@@ -246,6 +251,27 @@ export interface DevPortalEmailDnsRecordDto {
     value: string;
     ttlSeconds?: number | null;
 }
+export interface PlatformPlanDto {
+    id: string;
+    displayName: string;
+    tagline: string;
+    priceAmount: string;
+    pricePeriod: string;
+    ctaLabel: string;
+    sortOrder: number;
+    highlights: string[];
+    entitlements: {
+        featureKey: string;
+        valueType: string;
+        value: string;
+    }[];
+}
+export interface BillingWebhookStatusDto {
+    webhookSecretConfigured: boolean;
+    lastEventAtUtc: string | null;
+    lastEventType: string | null;
+    eventCount: number;
+}
 export interface DevPortalBackendDto {
     fqdn: string | null;
     containerAppName: string;
@@ -560,6 +586,7 @@ export declare class PlatformApiClient {
     }): Promise<GatewayDryRunDto>;
     deleteGateway(projectId: string): Promise<GatewayTeardownAcceptedDto>;
     putProjectIdentity(projectId: string, body: ProjectIdentityRequestBody): Promise<ProjectIdentityDto>;
+    putProjectIdentityBranding(projectId: string, body: ProjectIdentityBrandingBody): Promise<void>;
     putProjectIdentityConnection(projectId: string, connectionId: string, body: ProjectIdentityConnectionBody): Promise<ProjectIdentityConnectionDto>;
     listProjectIdentityConnections(projectId: string): Promise<ProjectIdentityConnectionDto[]>;
     deleteProjectIdentityConnection(projectId: string, connectionId: string): Promise<void>;
@@ -573,6 +600,8 @@ export declare class PlatformApiClient {
         cancelUrl?: string;
     }): Promise<DevPortalBillingDto>;
     linkDevPortalIdentity(projectId: string): Promise<DevPortalIdentityLinkDto>;
+    listPlatformPlans(): Promise<PlatformPlanDto[]>;
+    getBillingWebhookStatus(projectId: string): Promise<BillingWebhookStatusDto | null>;
     getDevPortalBackend(projectId: string): Promise<DevPortalBackendDto | null>;
     getDevPortalSetupStatus(projectId: string): Promise<DevPortalSetupStatusDto>;
     getDevPortalSettings(projectId: string): Promise<DevPortalSettingsDto | null>;

package/dist/declarations/cli/platform/helpers/platform-plan-catalog.d.ts

@@ -1,3 +1,4 @@
+import type { PlatformPlanDto } from "../client/platform-api.js";
 import type { FreeProjectsQuota } from "./free-projects-quota.js";
 export type PlatformPlanId = "free" | "starter" | "professional";
 export interface PlatformPlanOption {
@@ -12,6 +13,11 @@ export interface PlatformPlanOption {
     limitations: string[];
 }
 export declare const PLATFORM_PLAN_CATALOG: PlatformPlanOption[];
+export type PlatformPlanDisplay = Pick<PlatformPlanOption, "displayName" | "priceLabel" | "summary" | "features" | "limitations"> & {
+    id: string;
+};
+export declare function toPlanDisplays(plans: readonly PlatformPlanDto[]): PlatformPlanDisplay[];
+export declare function loadPlanDisplays(listPlatformPlans: () => Promise<PlatformPlanDto[]>): Promise<PlatformPlanDisplay[]>;
 export declare const PLATFORM_PLAN_USER_PROMPT = "Which API ToGo platform plan do you want for this project \u2014 Free, Starter, or Professional?";
 export declare function formatFreeProjectsQuotaHint(quota: FreeProjectsQuota): string;
 export declare function buildPlatformPlanSelectionAgentInstruction(quota?: FreeProjectsQuota | null): string;

package/dist/declarations/config/validators/ZudokuConfig.d.ts

@@ -331,6 +331,7 @@ declare const AuthenticationSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
     redirectToAfterSignUp: z.ZodOptional<z.ZodString>;
     redirectToAfterSignIn: z.ZodOptional<z.ZodString>;
     redirectToAfterSignOut: z.ZodOptional<z.ZodString>;
+    tokenIdentity: z.ZodOptional<z.ZodBoolean>;
 }, z.core.$strip>, z.ZodObject<{
     type: z.ZodLiteral<"azureb2c">;
     basePath: z.ZodOptional<z.ZodString>;
@@ -6753,6 +6754,7 @@ export declare const ZudokuConfig: z.ZodObject<{
         redirectToAfterSignUp: z.ZodOptional<z.ZodString>;
         redirectToAfterSignIn: z.ZodOptional<z.ZodString>;
         redirectToAfterSignOut: z.ZodOptional<z.ZodString>;
+        tokenIdentity: z.ZodOptional<z.ZodBoolean>;
     }, z.core.$strip>, z.ZodObject<{
         type: z.ZodLiteral<"azureb2c">;
         basePath: z.ZodOptional<z.ZodString>;

package/dist/declarations/lib/authentication/providers/openid.d.ts

@@ -35,7 +35,8 @@ export declare class OpenIDAuthenticationProvider extends CoreAuthenticationPlug
     protected readonly redirectToAfterSignOut: string;
     private readonly audience?;
     private readonly scopes;
-    constructor({ issuer, audience, clientId, redirectToAfterSignUp, redirectToAfterSignIn, redirectToAfterSignOut, basePath, scopes, }: OpenIDAuthenticationConfig);
+    private readonly tokenIdentity;
+    constructor({ issuer, audience, clientId, redirectToAfterSignUp, redirectToAfterSignIn, redirectToAfterSignOut, basePath, scopes, tokenIdentity, }: OpenIDAuthenticationConfig);
     protected getAuthServer(): Promise<oauth.AuthorizationServer>;
     protected setTokensFromResponse(response: oauth.TokenEndpointResponse): void;
     signUp(_: {

package/dist/declarations/lib/plugins/markdown/index.d.ts

@@ -6,6 +6,7 @@ import type { ApitogoPlugin } from "../../core/plugins.js";
 export interface MarkdownPluginOptions extends ZudokuDocsConfig {
     basePath: string;
     fileImports: Record<string, () => Promise<MDXImport>>;
+    reservedPaths?: string[];
 }
 export type MarkdownPluginDefaultOptions = Pick<Frontmatter, "toc" | "disablePager" | "showLastModified" | "suggestEdit" | "copyPage">;
 export type Frontmatter = {
@@ -31,5 +32,5 @@ export type MDXImport = {
     __filepath: string;
     default: (props: MDXProps) => JSX.Element;
 };
-export declare const withIndexAliases: <T>(fileImports: Record<string, T>) => [string, T][];
+export declare const withIndexAliases: <T>(fileImports: Record<string, T>, reserved?: readonly string[]) => [string, T][];
 export declare const markdownPlugin: (options: MarkdownPluginOptions) => ApitogoPlugin;

package/dist/flat-config.d.ts

@@ -305,6 +305,7 @@ export interface FlatZudokuConfig {
     redirectToAfterSignUp?: string
     redirectToAfterSignIn?: string
     redirectToAfterSignOut?: string
+    tokenIdentity?: boolean
   } | {
     type: "azureb2c"
     basePath?: string

package/docs/cli/commands.md

@@ -12,25 +12,26 @@ same commands so agents and humans get identical behavior.
 
 | Command          | Role                                                                     |
 | ---------------- | ------------------------------------------------------------------------ |
-| `init`           | Scaffold portal (default `./dev-portal`; OpenAPI discovery + secrets)    |
+| `create`         | Guided setup in a new folder (`--template full` for every service)       |
+| `init`           | Create a project in the current folder                                   |
 | `config`         | Write or update `apitogo.config.json` (interactive or flags)             |
 | `run`            | Local preview server                                                     |
 | `build`          | Production build (`--preview` to serve locally)                          |
 | `check`          | Publish readiness (secrets, manifest, site validation)                   |
 | `project create` | Create the platform project (Free plan in version 2) and link the folder |
-| `deploy`         | Publish config to platform (apihub + portal)                             |
+| `project use`    | Move the folder to another existing project                              |
+| `deploy`         | Deploy the portal, gateway, sign-in and plans                            |
 | `status`         | Account, project, and live readiness                                     |
 | `teardown --yes` | Delete the linked platform project                                       |
 
 ## Scaffold and config
 
-| Command      | Role                                                                                                        |
-| ------------ | ----------------------------------------------------------------------------------------------------------- |
-| `init [dir]` | Folder (default `dev-portal`); `--name`, `--install` (default), `--overwrite`, `--json`, `--openapi-search` |
-| `config`     | Interactive on TTY; flags: `--openapi`, `--page-*`, `--plan`, `--backend`, `--theme`, `--patch`, `--json`   |
+| Command      | Role                                                                                                      |
+| ------------ | --------------------------------------------------------------------------------------------------------- |
+| `init [dir]` | Folder (default: the current one); `--name`, `--yes`, `--dry-run`, `--force`, `--json`                    |
+| `config`     | Interactive on TTY; flags: `--openapi`, `--page-*`, `--plan`, `--backend`, `--theme`, `--patch`, `--json` |
 
-`npx @lukoweb/apitogo@latest init` auto-wires nearby OpenAPI and `docs/`/`doc/` markdown after
-scaffold. See [Install the CLI](./setup.md#scaffold-options).
+`init` uses an existing `docs/` folder in place. See [Install the CLI](./setup.md#scaffold-options).
 
 See [Make config (CLI)](../configuration/make-config.mdx) for all `config` flags.
 
@@ -44,17 +45,17 @@ See [Make config (CLI)](../configuration/make-config.mdx) for all `config` flags
 
 ## Platform (requires API credentials)
 
-| Command                    | Role                                                                                                     |
-| -------------------------- | -------------------------------------------------------------------------------------------------------- |
-| `project create`           | Create the platform project only; version 2 also selects Free, waits for hosting and writes `project.id` |
-| `check`                    | Dry-run publish readiness                                                                                |
-| `deploy`                   | Full publish — project, plans, apihub, portal backend/frontend                                           |
-| `deploy --only <resource>` | Limit to `apihub`, `portal-backend`, or `portal-frontend`                                                |
-| `deploy --force`           | Redeploy selected resources even when healthy                                                            |
-| `deploy --platform-plan`   | Select Free / Starter / Professional hosting                                                             |
-| `deploy --resume-from`     | Resume interrupted publish                                                                               |
-| `status`                   | Whoami + project + live verification                                                                     |
-| `teardown --yes`           | Delete platform project (confirmation required)                                                          |
+| Command                   | Role                                                                                                  |
+| ------------------------- | ----------------------------------------------------------------------------------------------------- |
+| `project create`          | Create the platform project only: chooses the hosting plan, waits for hosting and writes `project.id` |
+| `project use <id>`        | Move the folder to another existing project                                                           |
+| `check`                   | Dry-run publish readiness                                                                             |
+| `deploy`                  | Deploy every service in the config (and create the project on the first run)                          |
+| `deploy --only <service>` | Limit to `portal`, `gateway`, `identity` or `plans`                                                   |
+| `deploy --force`          | Redeploy selected resources even when healthy                                                         |
+| `deploy --resume-from`    | Resume interrupted publish                                                                            |
+| `status`                  | Whoami + project + live verification                                                                  |
+| `teardown --yes`          | Delete platform project (confirmation required)                                                       |
 
 Env: `APITOGO_API_KEY_ID`, `APITOGO_API_SECRET`. Optional: `APITOGO_API_URL`.
 
@@ -100,15 +101,13 @@ none.
 | `--no-wait`             | Return before the hosting is ready                                 |
 | `--json`                | Print raw JSON only                                                |
 
-| `deploy` option   | In version 2                                               |
-| ----------------- | ---------------------------------------------------------- |
-| `--only`          | `portal`, `gateway`, `identity`, `plans` (comma-separated) |
-| `--env`           | Static Web App environment (default: production)           |
-| `--force`         | Redeploy even when nothing changed                         |
-| `--resume-from`   | Resume the publish ledger from a step id                   |
-| `--no-wait`       | Do not wait for long-running jobs                          |
-| `--platform-plan` | Ignored. The plan is chosen by `project create --plan`     |
-| `--project-name`  | Ignored. The name is `project.name`                        |
+| `deploy` option | In version 2                                               |
+| --------------- | ---------------------------------------------------------- |
+| `--only`        | `portal`, `gateway`, `identity`, `plans` (comma-separated) |
+| `--env`         | Static Web App environment (default: production)           |
+| `--force`       | Redeploy even when nothing changed                         |
+| `--resume-from` | Resume the publish ledger from a step id                   |
+| `--no-wait`     | Do not wait for long-running jobs                          |
 
 ### Selling paid plans needs Starter or Professional
 
@@ -134,12 +133,31 @@ This is what you pay APItoGo for hosting. What your customers pay you for your p
 
 See [Walkthrough: from an empty folder to a customer's first call](./walkthrough.md).
 
+### Move a folder to another project
+
+```bash
+npx apitogo project use fe3a12b0-fbaf-4315-b37f-b731d930ee57
+npx apitogo deploy
+```
+
+`project use <id>` points the folder at another project you own, for good. It checks that the
+project exists, writes its id into `project.id` and clears the folder's deploy record, so the next
+`deploy` sets up every service in the new project. The old project is left as it is (`teardown`
+deletes it).
+
+- A folder that already deploys to a project asks first. Pass `--yes` to skip the question, which
+  scripts and `--json` need.
+- Secrets, such as the Stripe keys, belong to each project: set them again with
+  `apitogo secrets set`.
+- The people who signed up to the old portal, and their API keys, stay with the old project.
+
 ## Hand-edit exceptions
 
-| Change            | Where                                                    |
-| ----------------- | -------------------------------------------------------- |
-| Home page content | `landing/LandingPage.tsx`                                |
-| Site footer       | `apitogo.config.json` → `modules.landing.content.footer` |
+| Change            | Where                                    |
+| ----------------- | ---------------------------------------- |
+| Home page content | `apitogo/portal/landing/LandingPage.tsx` |
+| Site footer       | `apitogo/portal/footer/Footer.tsx`       |
+| Colors and fonts  | `apitogo/portal/theme.json`              |
 
 There is no CLI command for arbitrary home page content.
 

package/docs/cli/go-live.md

@@ -1,135 +1,108 @@
 ---
 title: Go live with CLI
-description:
-  Publish an APIToGo developer portal with npx apitogo deploy — platform plans, secrets, and status.
+description: >-
+  Deploy your project with npx apitogo deploy: the hosting plan, the secrets deploy asks for, one
+  service at a time, and checking the result.
 sidebar_icon: rocket
 ---
 
-**Go live** publishes your shaped portal to APItoGo hosting, optionally deploys the backend, upserts
-gateway plans, and verifies the live site. `npx apitogo deploy` is the source of truth; MCP
-`publish_dev_portal` spawns the same CLI.
+**Go live** deploys everything in `apitogo.config.json` to APItoGo: the portal, the gateway, sign-in
+and plans.
 
-:::note
+## Before you deploy
 
-This page describes **config version 1** projects (the older `dev-portal` scaffold). A config
-version 2 project, which `npx @lukoweb/apitogo@latest init` creates by default, is published
-differently: run `npx apitogo project create`, then `npx apitogo deploy`. Its resources are
-`portal`, `gateway`, `identity` and `plans`, and the options `--platform-plan` and `--project-name`
-do not apply. See [Walkthrough: from an empty folder to a customer's first call](./walkthrough.md)
-and
-[Config version 2: create the project, then deploy](./commands.md#config-version-2-create-the-project-then-deploy).
+1. Sign in to APItoGo once on this computer:
 
-:::
-
-## Before you publish
-
-1. Confirm **gateway / API plans** in `apitogo.config.json`. Do not invent Free + Pro unless you
-   chose them.
-2. Save secrets in the site **`.env`** (never commit or paste into tickets):
-
-   ```sh
-   APITOGO_CONFIG_AUTHENTICATION__OIDC__AUTHORITY=https://login.example.com
-   APITOGO_CONFIG_AUTHENTICATION__OIDC__CLIENT_ID=your-client-id
-   APITOGO_CONFIG_AUTHENTICATION__OIDC__CLIENT_SECRET=your-client-secret
-   # Only when you have paid project plans:
-   APITOGO_CONFIG_AUTHENTICATION__STRIPE__SECRET_KEY=sk_test_...
-   APITOGO_CONFIG_AUTHENTICATION__STRIPE__WEBHOOK_SECRET=whsec_...
+   ```bash
+   npx apitogo login
    ```
 
-3. Export platform credentials and choose a **platform hosting** plan: **Free**, **Starter**, or
-   **Professional**. Starter and Professional use Stripe checkout on the platform.
+   In CI, set `APITOGO_API_KEY_ID` and `APITOGO_API_SECRET` (an API key from the dashboard) instead.
 
-   **Free** cannot publish **paid gateway plans** (`priceAmount > 0`) or attach a **custom domain**.
-   If your manifest has paid API tiers, use Starter or Professional — see
-   [Gateway plans](../configuration/plans.md).
+2. Check the config:
 
    ```bash
-   export APITOGO_API_KEY_ID=apk_...
-   export APITOGO_API_SECRET=...
+   npx apitogo check
    ```
 
-## Happy path
+## Deploy
 
 ```bash
-cd ./dev-portal
-npx apitogo deploy --platform-plan free
-npx apitogo status
+npx apitogo deploy
 ```
 
-`npx apitogo deploy`:
+On the first run, deploy creates the project: it asks for the hosting plan (**Free**, **Starter** or
+**Professional**) and writes the project's id into `apitogo.config.json`. Starter and Professional
+open the platform's checkout. To create the project without deploying, run
+`npx apitogo project create --plan <plan>`.
 
-- Creates or links the platform project
-- Provisions modules and syncs gateway plans
-- Deploys the API hub (when configured)
-- Updates the portal backend (including auth API URL in `.env`) and builds + deploys the portal
-  frontend
+Then it sets up each service and prints what it did:
+
+```
+identity: deployed (https://id.apitogo.com/<project>)
+gateway: deployed (https://<name>.api.apitogo.com/), 12 operation(s)
+plans: deployed, 2 plans, billing: stripe
+portal: deployed to production (https://<name>.apitogo.com)
+Deploy finished.
+```
 
-If deploy is blocked, fix the reported checklist (missing secrets, plan, OpenAPI). Do not invent
-credentials.
+A step whose input has not changed since the last deploy is skipped. `--force` runs it anyway.
 
-After success, register **`manualSteps.oidcRedirectUri`** in your IdP. When Stripe is required for
-paid gateway plans, create a webhook at `manualSteps.stripeWebhookUrl` for the listed events.
+## Secrets deploy asks for
 
-Do not treat warm-pool URLs as live until deploy and status succeed.
+Deploy asks, hidden, for the secrets the config needs and stores them as project secrets:
 
-## Target specific resources
+| When                                  | It asks for                                                    |
+| ------------------------------------- | -------------------------------------------------------------- |
+| `plans.json` has a plan with a price  | Your Stripe secret key, then the webhook signing secret        |
+| `identity.connections` has a provider | That provider's client secret, under the name the config gives |
+
+[Set up Stripe for paid plans](../guides/stripe-setup.mdx) shows where the Stripe values are. Set or
+change a secret yourself with `npx apitogo secrets set <NAME>`, and list them with
+`npx apitogo secrets list`.
+
+Selling paid plans and using a custom domain need **Starter** or **Professional**. On **Free**,
+deploy stops at a paid plan and says so.
+
+## One service at a time
 
 ```bash
-npx apitogo deploy --only apihub
-npx apitogo deploy --only portal-backend
-npx apitogo deploy --only portal-frontend
-npx apitogo deploy --only apihub,portal-frontend
-npx apitogo deploy --only portal-frontend --force
+npx apitogo deploy --only portal
+npx apitogo deploy --only gateway,plans
 ```
 
-| Resource          | What it updates                                  |
-| ----------------- | ------------------------------------------------ |
-| `apihub`          | Gateway plans/baseline, API hub package + deploy |
-| `portal-backend`  | Dev-portal module settings and plan catalog      |
-| `portal-frontend` | Site build + Static Web App deploy               |
+`--only` takes `portal`, `gateway`, `identity` and `plans`.
 
-Omit `--only` to apply all three. Use `--force` to redeploy even when hashes match.
+## Other flags
 
-## Other deploy flags
+| Flag           | Purpose                                                                  |
+| -------------- | ------------------------------------------------------------------------ |
+| `--force`      | Redeploy even when nothing changed                                       |
+| `--yes`        | Confirm a change that cannot be undone, such as another sign-in provider |
+| `--verbose`    | Show the build log and every platform step                               |
+| `--json`       | Print the result as JSON only                                            |
+| `--project-id` | Deploy to this project for this run only                                 |
 
-| Flag              | Purpose                               |
-| ----------------- | ------------------------------------- |
-| `--project-id`    | Override project GUID                 |
-| `--project-name`  | Display name when creating a project  |
-| `--platform-plan` | `free` \| `starter` \| `professional` |
-| `--resume-from`   | Resume publish ledger from step id    |
-| `--no-wait`       | Do not wait for long-running jobs     |
-| `--json`          | Print raw JSON result only            |
+To move the folder to another project for good, use `npx apitogo project use <id>` (see
+[Commands](./commands.md#move-a-folder-to-another-project)).
 
-Resume state is stored in `.apitogo/publish-state.json`.
-
-## After publish
+## After deploy
 
 ```bash
-npx apitogo status              # account + project + live checks
-npx apitogo status --skip-live  # skip live health probes
-npx apitogo teardown --yes      # delete the platform project
+npx apitogo status              # account, project and live checks
+npx apitogo teardown --yes      # delete the project and everything in it
 ```
 
-## Platform plan vs API plans
-
-| Kind             | Meaning                                     | How                                                                |
-| ---------------- | ------------------------------------------- | ------------------------------------------------------------------ |
-| Platform hosting | Free / Starter / Professional on APItoGo    | `--platform-plan`                                                  |
-| Gateway / API    | End-user SKUs and rate limits on `/pricing` | `apitogo.config.json` — [Gateway plans](../configuration/plans.md) |
-
-## CLI deploy vs MCP publish
+## Your plans and APItoGo's
 
-| Path                     | Use when                                     |
-| ------------------------ | -------------------------------------------- |
-| `npx apitogo deploy`     | Terminal, CI, scripts — full product go-live |
-| MCP `publish_dev_portal` | Agent-driven go-live with the same engine    |
+| Kind         | What it is                                        | Where                                                     |
+| ------------ | ------------------------------------------------- | --------------------------------------------------------- |
+| Hosting plan | What you pay APItoGo: Free, Starter, Professional | Chosen on the first deploy or `project create --plan`     |
+| Your plans   | What your users pay you for your API              | `apitogo/plans.json` ([Plans](../configuration/plans.md)) |
 
 ## Related
 
-- [Shape](./shape.md)
+- [Walkthrough](./walkthrough.md)
 - [Commands](./commands.md)
-- [Authentication](../configuration/authentication.md)
-- [Manifest](../configuration/manifest.md)
-- [Gateway plans](../configuration/plans.md)
+- [Configuration overview](../configuration/overview.md)
 - [MCP go live](../mcp/go-live.md)

package/docs/cli/overview.md

@@ -46,26 +46,27 @@ local files, preview with `npx apitogo run`, and publish to APItoGo hosting with
 
 Common CLI shape tasks:
 
-| Change                            | How                                                              |
-| --------------------------------- | ---------------------------------------------------------------- |
-| Backend runtime                   | `npx apitogo config` (backend)                                   |
-| OpenAPI files (`gateway.specs`)   | `npx apitogo config` (openapi)                                   |
-| Custom docs pages                 | `npx apitogo config` (page) or add under `apitogo/portal/pages/` |
-| Gateway / API plans               | `npx apitogo config` (plan) or edit `apitogo/plans.json`         |
-| Site title                        | `--title` or edit `apitogo.config.json`                          |
-| Theme, fonts, branding, projectId | Edit `apitogo.config.json`                                       |
-
-Home page content often lives in `landing/LandingPage.tsx`. Site footer can live under
-`modules.landing.content.footer` in `apitogo.config.json`.
+| Change                          | How                                                              |
+| ------------------------------- | ---------------------------------------------------------------- |
+| Backend runtime                 | `npx apitogo config` (backend)                                   |
+| OpenAPI files (`gateway.specs`) | `npx apitogo config` (openapi)                                   |
+| Custom docs pages               | `npx apitogo config` (page) or add under `apitogo/portal/pages/` |
+| Gateway / API plans             | `npx apitogo config` (plan) or edit `apitogo/plans.json`         |
+| Site title                      | `--title` or edit `apitogo.config.json`                          |
+| Theme and fonts                 | Edit `apitogo/portal/theme.json`                                 |
+
+The home page is `apitogo/portal/landing/LandingPage.tsx` and the footer
+`apitogo/portal/footer/Footer.tsx`, named by `portal.landing` and `portal.footer`.
 
 ## Config model (local site)
 
-| File                  | Role                                  |
-| --------------------- | ------------------------------------- |
-| `apitogo.config.json` | Site, modules, plans, auth type, apis |
-| `.env`                | `VITE_*` + `APITOGO_CONFIG_*` secrets |
+| File                  | Role                                           |
+| --------------------- | ---------------------------------------------- |
+| `apitogo.config.json` | The services: portal, gateway, identity, plans |
+| `apitogo/`            | Pages, plans, theme, OpenAPI files             |
 
-Details: [Manifest](../configuration/manifest.md).
+Secrets are project secrets (`npx apitogo secrets set`), never files. Details:
+[Configuration overview](../configuration/overview.md).
 
 ## CLI vs MCP
 
@@ -88,4 +89,4 @@ workflows.
 - [Install the CLI](./setup.md)
 - [Shape](./shape.md) · [Go live](./go-live.md) · [Commands](./commands.md)
 - [MCP overview](../mcp/overview.md) — agent-driven workflow
-- [Manifest](../configuration/manifest.md)
+- [Manifest](../configuration/overview.md)