diff --git a/catalogue/apps/io.pilot.didit/metadata.json b/catalogue/apps/io.pilot.didit/metadata.json
index 07c30918..98ae88d7 100644
--- a/catalogue/apps/io.pilot.didit/metadata.json
+++ b/catalogue/apps/io.pilot.didit/metadata.json
@@ -183,5 +183,55 @@
         "Published v 1.0.0"
       ]
     }
-  ]
+  ],
+  "product_demo": {
+    "skill": "io.pilot.didit",
+    "title": "Full usage demo",
+    "when_to_use": "When you need KYC/ID, liveness, face-match, AML, or email/phone OTP verification and want your own Didit key minted in one call with no email and no code.",
+    "metered": false,
+    "quickstart": {
+      "goal": "Mint your own Didit key in one call (no email, no code)",
+      "command": "pilotctl appstore call io.pilot.didit didit.signup '{}'",
+      "expect": "{\"signed_up\":true,\"email\":\"...@...\",\"api_key\":\"...\"}",
+      "note": "Run this ONCE. It caches your key locally; every other didit.* call then authenticates as you. Idempotent per Pilot identity, so a repeat call returns the same account."
+    },
+    "examples": [
+      {
+        "title": "Build a KYC workflow (ID + liveness + face match)",
+        "command": "pilotctl appstore call io.pilot.didit didit.create_workflow '{\"workflow_label\":\"KYC\",\"features\":[{\"feature\":\"OCR\"},{\"feature\":\"LIVENESS\",\"config\":{\"face_liveness_method\":\"PASSIVE\"}},{\"feature\":\"FACE_MATCH\"}]}'",
+        "expect": "{\"uuid\":\"wf_...\"}"
+      },
+      {
+        "title": "Start a hosted session and get the user URL",
+        "command": "pilotctl appstore call io.pilot.didit didit.create_session '{\"workflow_id\":\"wf_...\",\"vendor_data\":\"user-123\"}'",
+        "expect": "{\"session_id\":\"...\",\"url\":\"https://verify.didit.me/...\",\"status\":\"Not Started\"}",
+        "note": "Send the user to url; they complete verification there, so you never handle document images. Poll get_decision or set a webhook."
+      },
+      {
+        "title": "Read the decision + extracted data",
+        "command": "pilotctl appstore call io.pilot.didit didit.get_decision '{\"session_id\":\"...\"}'",
+        "expect": "{\"status\":\"Approved\",\"id_verifications\":[...],\"face_matches\":[...]}"
+      },
+      {
+        "title": "Standalone AML screening (no session)",
+        "command": "pilotctl appstore call io.pilot.didit didit.aml '{\"full_name\":\"Jane Doe\",\"entity_type\":\"person\",\"country\":\"USA\"}'",
+        "expect": "{\"matches\":[...],\"total_hits\":0}"
+      },
+      {
+        "title": "Check your Didit credit balance",
+        "command": "pilotctl appstore call io.pilot.didit didit.billing_balance '{}'",
+        "expect": "{\"balance\":12.50,\"auto_refill_enabled\":false}"
+      }
+    ],
+    "gotchas": [
+      "Run didit.signup once before anything else — every other method authenticates with the key it caches; a 401 means you skipped it.",
+      "Verification calls bill to YOUR own Didit account/balance (the key signup minted), not to Pilot — top up with didit.billing_topup (min $50); 500 full-KYC checks/month are free.",
+      "signup is idempotent per Pilot identity: a repeat call (or a fresh install) returns the SAME account, not a new one.",
+      "create_workflow takes a features ARRAY in completion order and uses a strict field whitelist — any undeclared key (e.g. workflow_type) is a 400.",
+      "Image-upload checks (ID scan, liveness, face match, PoA) run only via the hosted create_session flow, not as direct methods."
+    ],
+    "next": [
+      "io.pilot.didit didit.help '{}'"
+    ]
+  }
 }
diff --git a/catalogue/catalogue.json b/catalogue/catalogue.json
index f1fe2e3c..c26c7609 100644
--- a/catalogue/catalogue.json
+++ b/catalogue/catalogue.json
@@ -673,40 +673,6 @@
       },
       "publisher": "ed25519:cTZr4unmAHK/r8fS+TVQ4QiCIORimYe+y+bIdiUUfAY="
     },
-    {
-      "id": "io.pilot.didit",
-      "version": "1.0.0",
-      "description": "Full Didit identity-verification platform over one HTTPS app — KYC/ID, liveness, face match, AML, proof-of-address, database validation, email/phone OTP, plus hosted sessions, workflows, users, billing, blocklists, questionnaires and webhooks. didit.signup mints your own Didit API key in ONE call with no email and no code (Pilot's broker handles the whole signup), caches it locally, and then every method authenticates as you and bills to your own Didit balance (500 free full-KYC checks/month).",
-      "bundle_url": "https://pub-f09f9a4ea848491198d48e329ba030e3.r2.dev/bundles/io.pilot.didit/1.0.0/io.pilot.didit-1.0.0-linux-amd64.tar.gz",
-      "bundle_sha256": "57c63cf5c51c10871273126b408dae17e2c4cffc5330342d96c648ca95aa29d5",
-      "display_name": "Didit",
-      "vendor": "Didit",
-      "categories": [],
-      "bundle_size": 5130067,
-      "source_url": "https://github.com/pilot-protocol/app-template/tree/main/submissions/io.pilot.didit",
-      "license": "",
-      "metadata_url": "https://raw.githubusercontent.com/pilot-protocol/pilotprotocol/main/catalogue/apps/io.pilot.didit/metadata.json",
-      "metadata_sha256": "30ad4d9ac274e010c6c75de612a74021633d4fcb1e845d14923b391315246614",
-      "bundles": {
-        "linux/amd64": {
-          "bundle_url": "https://pub-f09f9a4ea848491198d48e329ba030e3.r2.dev/bundles/io.pilot.didit/1.0.0/io.pilot.didit-1.0.0-linux-amd64.tar.gz",
-          "bundle_sha256": "57c63cf5c51c10871273126b408dae17e2c4cffc5330342d96c648ca95aa29d5"
-        },
-        "linux/arm64": {
-          "bundle_url": "https://pub-f09f9a4ea848491198d48e329ba030e3.r2.dev/bundles/io.pilot.didit/1.0.0/io.pilot.didit-1.0.0-linux-arm64.tar.gz",
-          "bundle_sha256": "090b73c669f4df41e3994441edd261bfd4ec511c806899a28571d8d99a675c6c"
-        },
-        "darwin/amd64": {
-          "bundle_url": "https://pub-f09f9a4ea848491198d48e329ba030e3.r2.dev/bundles/io.pilot.didit/1.0.0/io.pilot.didit-1.0.0-darwin-amd64.tar.gz",
-          "bundle_sha256": "03275275e7838ca9b8be39d7355462271a8d23ad32a60ea4cb87b1f7b6cbf5a0"
-        },
-        "darwin/arm64": {
-          "bundle_url": "https://pub-f09f9a4ea848491198d48e329ba030e3.r2.dev/bundles/io.pilot.didit/1.0.0/io.pilot.didit-1.0.0-darwin-arm64.tar.gz",
-          "bundle_sha256": "5910ff8f2af94f8545d49fa6c0a179c75c4334bd54fb37a3feb7ee197ad551c5"
-        }
-      },
-      "publisher": "ed25519:ii6QAc8qZB4NvbOXqnLfnv+OhPqepuK0BISAv9jM5x0="
-    },
     {
       "id": "io.pilot.tldr",
       "version": "1.13.1",
@@ -776,6 +742,40 @@
         }
       },
       "publisher": "ed25519:BAsg7bdd2t0V9tFCkXRCWRgIdEuuWtJVEjjZp8HBgEg="
+    },
+    {
+      "id": "io.pilot.didit",
+      "version": "1.0.0",
+      "description": "Full Didit identity-verification platform over one HTTPS app — KYC/ID, liveness, face match, AML, proof-of-address, database validation, email/phone OTP, plus hosted sessions, workflows, users, billing, blocklists, questionnaires and webhooks. didit.signup mints your own Didit API key in ONE call with no email and no code (Pilot's broker handles the whole signup), caches it locally, and then every method authenticates as you and bills to your own Didit balance (500 free full-KYC checks/month).",
+      "bundle_url": "https://pub-f09f9a4ea848491198d48e329ba030e3.r2.dev/bundles/io.pilot.didit/1.0.0/io.pilot.didit-1.0.0-linux-amd64.tar.gz",
+      "bundle_sha256": "57c63cf5c51c10871273126b408dae17e2c4cffc5330342d96c648ca95aa29d5",
+      "display_name": "Didit",
+      "vendor": "Didit",
+      "categories": [],
+      "bundle_size": 5130067,
+      "source_url": "https://github.com/pilot-protocol/app-template/tree/main/submissions/io.pilot.didit",
+      "license": "",
+      "metadata_url": "https://raw.githubusercontent.com/pilot-protocol/pilotprotocol/main/catalogue/apps/io.pilot.didit/metadata.json",
+      "metadata_sha256": "5e73bc2c2b54efaf91b1b9ad354a5f9803afb5c505539b86326125c92f2cc86b",
+      "bundles": {
+        "linux/amd64": {
+          "bundle_url": "https://pub-f09f9a4ea848491198d48e329ba030e3.r2.dev/bundles/io.pilot.didit/1.0.0/io.pilot.didit-1.0.0-linux-amd64.tar.gz",
+          "bundle_sha256": "57c63cf5c51c10871273126b408dae17e2c4cffc5330342d96c648ca95aa29d5"
+        },
+        "linux/arm64": {
+          "bundle_url": "https://pub-f09f9a4ea848491198d48e329ba030e3.r2.dev/bundles/io.pilot.didit/1.0.0/io.pilot.didit-1.0.0-linux-arm64.tar.gz",
+          "bundle_sha256": "090b73c669f4df41e3994441edd261bfd4ec511c806899a28571d8d99a675c6c"
+        },
+        "darwin/amd64": {
+          "bundle_url": "https://pub-f09f9a4ea848491198d48e329ba030e3.r2.dev/bundles/io.pilot.didit/1.0.0/io.pilot.didit-1.0.0-darwin-amd64.tar.gz",
+          "bundle_sha256": "03275275e7838ca9b8be39d7355462271a8d23ad32a60ea4cb87b1f7b6cbf5a0"
+        },
+        "darwin/arm64": {
+          "bundle_url": "https://pub-f09f9a4ea848491198d48e329ba030e3.r2.dev/bundles/io.pilot.didit/1.0.0/io.pilot.didit-1.0.0-darwin-arm64.tar.gz",
+          "bundle_sha256": "5910ff8f2af94f8545d49fa6c0a179c75c4334bd54fb37a3feb7ee197ad551c5"
+        }
+      },
+      "publisher": "ed25519:ii6QAc8qZB4NvbOXqnLfnv+OhPqepuK0BISAv9jM5x0="
     }
   ]
 }
diff --git a/catalogue/catalogue.json.sig b/catalogue/catalogue.json.sig
index 1e892a3a..871e7b90 100644
--- a/catalogue/catalogue.json.sig
+++ b/catalogue/catalogue.json.sig
@@ -1 +1 @@
-IcWEYl+PRCPCU/osMH3fk+Xop6Hax+htirANCxPmpBcldHjWJwrnTZjBNy5/ueJEvLERAwFBuVrMvcIAv0QXCg==
+MY9EERQlgtHAsXHn4K/1mytXUiqu5EY6JXDeskLVTCw35kj4Q5ZZxMEu5fHxMvrbj9WT5nou2tNq7KtsB6PgCA==