Design System Console

/_admin/design-system draws the design system your config declares, at the values it actually renders with. The export endpoints and sovrium design-system hand the same content to a machine as text; this page is the version a person reads.

It is admin-gated and returns 404 to anyone else, and it is read-only. Nothing on it edits configuration — the console is an operational data console, and the design system is one of the things it reflects.

What the page shows

Three sections, each a live preview frame rendered by the real renderer with your real tokens.

Section	What it draws
Foundations	Every token the app renders with — colour, type, spacing, radius, breakpoints, durations — drawn at the value it resolves to in the scheme you are reading.
Tokens in use	The same tokens composed into surfaces, so a combination can be judged on sight rather than inferred from a list.
Voice and usage	The rules a writer follows here: the principles, how the app addresses a reader, the tone per moment, and what each colour is for.

Each frame has an Open full page link to /_admin/design-system/preview/{section} — foundations, ui-kit or voice. Add ?scheme=dark to any preview to read it in the dark palette; the values printed beside each swatch follow the scheme, so the page never labels a swatch with a colour it is not showing.

The component catalog

Below the sections, the catalog renders one specimen per component type, grouped by category. Each category has its own full page at /_admin/design-system/preview/components/{category}.

Category	Types	Drawn
form-controls	11	All of them.
data	10	One — data-table. The other nine are reported.
structural	2	All of them.
layout	10	Eight; modal and tab-panel are reported.

A type that is not drawn is named anyway, with the reason. That is the point of the catalog: a heading over an empty box would assert that the blank is the design. Three reasons appear:

• Reads records from one of your tables. Seven of the ten data types bind an operator table by construction, and a preview frame carries no operator data. data-table is the exception — its data source accepts the platform's own fixture endpoint, so it is drawn over rows that belong to nobody.
• Renders a live write control, or has no inline appearance. modal renders as a closed overlay with nothing to show inline. form and data-form are refused for a stronger reason, below.
• Accepted by the schema with no renderer behind it. tab-panel validates, and a page that uses it renders a bare div. The catalog reports the gap rather than drawing the consequence.

The share link

A design system's audience is wider than the people who have an account on your instance: designers, an agency, a client stakeholder. GET /s/design-system/{token} gives them the charter without giving them a login.

The Share link panel on the console mints one. The link is unlisted — it appears in no sitemap, no navigation and no page listing — and it is revocable.

Operation	Endpoint	Notes
Mint	POST /api/admin/design-system/shares	201 with the id, the creation time, the token and the URL.
List	GET /api/admin/design-system/shares	Live shares, metadata only — id and creation time.
Revoke	DELETE /api/admin/design-system/shares/{id}	200 once; 404 for an unknown or already-revoked id.
Read	GET /s/design-system/{token}	Anonymous. No login, no cookie, no account.

The token is shown exactly once, in the response to the mint. It is stored only as a SHA-256 digest, so nothing — not the list endpoint, not the audit log, not a log line — can hand it back. That is what makes revocation mean something: an operator who could re-read a link would never learn it had leaked. If you lose the link, revoke it and mint another.

Revoking is immediate and total. The reader gets the same 404 as an unknown or malformed token — never a "this link has been revoked", which is a different answer and exactly what an enumerator collects.

The reader page is a single self-contained document: no script, no form, no comment box, no upload. There is nothing on it to interact with, which is the strongest form of "the widest audience gets the weakest surface".

What the link publishes

Anyone holding the URL reads the whole design system, not just its tokens. Before you send one, know that it contains:

• your principles and your logo section, including its clear-space, minimum-size and misuse rules;
• your voice — personality, pronoun, what to prefer, what to avoid — and the tone instruction for each moment;
• every colour token with its value, its usage rule and the token it pairs with;
• the type scale, and the spacing, radius, breakpoint, font and duration tokens;
• your imagery rules and the icon set;
• the usage, when and don't guidance for each of your components;
• the values Sovrium kept outside the token tree, and anything you declared that it does not apply.

It contains no environment-variable value and no record data — the projection reads design and theme and nothing else, so there is no path on which a secret could arrive. But a brand charter is a document about your product, and a public link to it is a decision. Treat minting one as publishing.

Both mint and revoke write to the audit log — a mint at warning severity, because it is the entry an operator scans for when reconstructing when something became public. Neither entry records the token.

Related Pages

• Design System — the design key the console draws.
• Type Scale — the ladder the Foundations section renders.
• Admin Dashboard — the rest of the console, and the export endpoints.
• Activity Monitoring — where a mint and a revoke are recorded.
• Security Hardening — the 404-not-403 posture the share reader follows.