The web app

The page is a web-assets component: static files a browser downloads. It declares no interfaces, because an interface is something others call and nothing calls a page.

kind = "web-assets"

links.todos    = "kong/api"
links.apps     = "kong/apps"
links.userinfo = "kong/userinfo"

absent-in = ["cluster"]
subdomain = "todo"

Every link is fronted

On other component kinds a link means I call this. On a web-assets component it means this answers under my origin, at its own prefix — so links.todos = "kong/api" puts the api at /api on the page's own host, and the page's generated client calls a relative path.

That one difference is what the arrangement is for. Because the browser never crosses an origin, the session cookie is first-party and can be SameSite=strict.

The same links produce both halves of it: in the dev loop the platform writes the dev server's proxy table from them, and when the site is published the same table becomes routing at the CDN edge. Your page code is identical either way.

The label it answers at

subdomain = "todo" asks for that label under the target's serving base, giving todo.gcp.bluetext.dev. It is honoured only by a deploy config that claims a name with deploy-name; a config without one mints a fresh segment per deploy instead, so a preview gets web--<token> and cannot take production's host.

Where it is absent

absent-in = ["cluster"] keeps this component out of that environment.

A component belongs to every environment its system declares unless it says otherwise, and every deploy config must bind a target for each component kind present in its environment. So a page left in an environment whose config binds no web-assets target is a validation error, naming the component and the config. absent-in is the answer when the component genuinely does not belong there; only-in states the same thing the other way round when a component belongs to one environment and not the rest.