Vexlora, from first install to production integration.
This guide explains what Vexlora ships, where to edit it, how the 491 page routes (473 buyer-facing application screens, 17 foundation/reference screens and 1 redirect) and 19 dashboards relate, and where your own backend, payment, AI, authentication and data services connect. It is written for buyers who may be new to the codebase.
Start here
Vexlora is an admin-panel template, not a customer-facing storefront and not a production backend.
Buyer-facing application routes are counted separately from foundation/reference pages and redirects.
Each dashboard has a distinct operating story while sharing one shell and design system.
Databases, secrets, authentication, money movement and AI execution remain buyer-owned.
Vexlora illustrates administration UX, data contracts and integration handoffs. Replace sample/mock/browser state with your own server/API where production persistence, authorization or sensitive operations are required.
The generated registry currently contains 491 HTML pages: 473 application screens, 17 foundation/reference screens and 1 landing redirect. For marketplace wording, do not present all 491 routes as buyer-facing application screens.
Envato requires ThemeForest items to include beginner-friendly documentation covering installation, customization/use and asset credits, written in English as HTML or PDF. This offline portal is structured around those requirements. Official Envato guidance →
Recommended reading order
Open the compiled HTML directly, or use the Tailwind source workflow when you want to rebuild styles.
Change product identity, theme tokens and layout from shared config files.
Learn which domain owns business records, payments, finance, integrations and AI actions.
Swap the provider/storage layer without rewriting visual pages.
Build the Tailwind CSS, test the static pages and run the included quality checks before release.
Installation
Use the compiled HTML immediately, or install the optional Tailwind build dependencies when you want to customize and rebuild the CSS.
Requirements
- Modern browser for the compiled HTML package
- Node.js + npm only when rebuilding Tailwind CSS from source
- Modern Chromium, Firefox or Safari browser
- Git is optional but recommended for buyer changes
Included stack
HTML5, Tailwind CSS 4.3.3, Vanilla JavaScript, reusable UI components, charts, tables, forms and local assets.
Fresh install
# Option A — compiled package
Open index.html directly or serve the folder with any static server.
# Option B — customize Tailwind source
npm install
npm run dev
Open the included index.html. When using the optional development server, use the local URL printed by the build tool. The landing page links to the Executive dashboard.
Production verification
npm run build
# Then test the generated HTML/CSS/JS in current browsers.
You can use the compiled HTML/CSS/JS without installing packages. Use npm install only when you want to rebuild Tailwind CSS from the editable source.
Static configuration
For the HTML edition, update public endpoints and UI settings in the documented JavaScript configuration files. Never place production secrets or private API keys in browser-delivered JavaScript.
Project structure
The route layer stays thin; shared UI, business features, data adapters and configuration have separate ownership.
Keep repeated navigation, layout patterns and interactions consistent across HTML pages. Put shared behavior in reusable JavaScript modules and shared visual rules in the Tailwind source instead of duplicating custom code per page.
Customize safely
Most buyer changes have a central entry point. Start there before editing many pages.
Brand identity · one file
Edit assets/js/config/product.js to change the product name, admin name, company, tagline, logo path, export prefix and browser-storage prefix.
productConfig.name = "Your Admin"
productConfig.companyName = "Your Company"
productConfig.brand.logoSrc = "/brand/your-logo.svg"
Colors, radius, font
Use semantic tokens in src/css/tailwind.css and presets in assets/js/config/presentation.js . Avoid page-by-page hardcoded colors.
Default layout
Edit assets/js/config/layout-engine.js . Supported navigation: vertical/horizontal; sidebar: standard/compact/mini; content: boxed/full; header: sticky/fixed.
Topbar sample account
Replace launcher/user/notification sample data in assets/js/config/application-shell.js . The signed-in profile screen is separate from generic User Management.
Do
- Change semantic design tokens
- Reuse shared components and feature patterns
- Keep business data feature-owned
- Run quality gates after structural changes
Do not
- Add random page-specific CSS files
- Scatter API credentials through browser code
- Duplicate DataTable or chart engines per page
- Put production card/CVV or banking secrets in browser state
Shell & navigation
Sidebar, breadcrumbs, command discovery and much of the topbar are driven by shared registries.
Navigation
Edit the matching area file under assets/js/config/navigation/ . The composer is assets/js/config/navigation.js .
Shell
components/layout/ contains desktop/mobile navigation and topbar pieces.
Search
Global search flattens the same navigation tree, so labels and routes remain synchronized.
Add a permanent navigation item
Place it under
pages/(dashboard)/…/HTML page
.
Use the correct group file in
assets/js/config/navigation/
.
Run the registry and route gates.
npm run registry:generate
npm run check:routes
npm run check:screen-registry
Create, edit, details and preview screens usually should not become permanent sidebar destinations. Link to them from the owning workspace.
The 19 dashboards
Dashboards share shell/theme/responsive foundations, but their composition, charts and operating questions are deliberately different.
Executive
Leadership posture, board signals, growth quality and strategic decisions.
/dashboard/executiveSaaS
MRR, ARR, churn, retention, activation and subscription growth.
/dashboard/saaseCommerce
Sales, orders, conversion, fulfillment and commerce health.
/dashboard/ecommerceCRM
Pipeline, forecast, account health, activities and seller performance.
/dashboard/crmAnalytics
Traffic, engagement, conversion, attribution and realtime signals.
/dashboard/analyticsFinance
Treasury, cash flow, close readiness, receivables and spend.
/dashboard/financeProjects
Portfolio delivery, project capacity, milestones and blockers.
/dashboard/projectsMarketing
Campaign performance, channel mix, creative quality and growth.
/dashboard/marketingHR
Workforce, recruiting, attendance, payroll and learning.
/dashboard/hrSupport
Queues, SLA, agent operations, self-service and escalation.
/dashboard/supportLogistics
Shipments, carrier performance, network flow and exceptions.
/dashboard/logisticsInventory
Stock health, replenishment, aging, transfer and count controls.
/dashboard/inventoryERP
Procurement, suppliers, warehouse, MRP, sales and finance handoffs.
/dashboard/erpEnergy
Grid, demand, metering, storage, assets and sustainability.
/dashboard/energyConstruction
Portfolio, site operations, workforce, safety and cost.
/dashboard/constructionHospital
Patient flow, ICU, beds, theatre, staffing and revenue cycle.
/dashboard/hospitalEducation
Enrollment, attendance, learning outcomes, faculty and fees.
/dashboard/educationReal Estate
Portfolio, occupancy, leasing, listings, deals and cash flow.
/dashboard/real-estateAI
Models, agents, usage, cost, governance and business impact.
/dashboard/ai
Dashboard pages live under
pages/(dashboard)/dashboard/<name>/
; business data/charts live under
assets/js/modules/dashboards/
; shared chart behavior lives under
components/charts/
and
assets/js/config/chart-system.js
.
How the modules relate
Vexlora avoids duplicating ownership. A business domain owns why something happens; shared control planes own cross-cutting execution.
Commerce order to money and fulfillment
SaaS customer lifecycle
Outgoing obligation
AI operating layer
Finance Reports owns financial statements, eCommerce Reports owns commerce reports, CRM Reports owns sales/customer reporting, and Analytics Reports owns cross-module correlation.
Replace mock data with your API
Vexlora keeps presentation independent from a production database. Pages should depend on typed providers/repositories, not hardcoded fetch logic.
Default provider
assets/js/data/provider.js points to sample repositories.
REST example
assets/js/data/rest-provider.js and assets/js/lib/data/rest-repository.js illustrate the handoff.
Expected list shape
type PaginatedResult<T> = {
items: T[]
page: number
pageSize: number
total: number
totalPages: number
}
Authentication credentials, database URLs, payment secrets, AI provider secrets and signing keys belong in your backend/server environment, not in frontend source or browser storage.
eCommerce & Online Store
The eCommerce suite owns product/order/inventory/checkout/marketplace operations. Online Store is an admin-side content/navigation configurator for a buyer-owned storefront.
Core eCommerce
Products, Orders, Inventory, Checkout & Pricing, Marketplace, Reports and Commerce AI.
Online Store Studio
Overview, Menus & Navigation, Pages, Blog, Testimonials, Contact us and Popups.
Mega-menu flow
Static Pages
Use the Online Store Pages workspace for About, Privacy, Terms and other storefront pages. The HTML editor supports source/preview modes, inline/featured media, SEO and publication controls. Production HTML should be sanitized according to your backend policy.
Blog / media
Blog supports categories, archives, featured images, social-link handoff and Menu Builder sources. Browser image handling is sample-oriented; replace it with your media/CDN API for production.
The menu builder and content studio expose admin configuration. Your HTML + Tailwind storefront owns final navigation rendering, animation, routing, content delivery and consent/analytics behavior.
Payments & money movement
Payment Core is provider-neutral infrastructure. Finance remains the accounting/reconciliation owner; business domains own the document that explains why money moves.
Payment Core workspaces
Transactions, Methods, Providers, Accounts, Marketplace, Checkout, Routing, Refunds & Disputes, Payout Routing and Domain Flows.
Frontend can show
- provider capability and status
- masked method/account references
- routing and checkout configuration
- refund/dispute workflow presentation
Backend must own
- API secrets and tokens
- raw card/CVV handling through compliant provider surfaces
- webhook signature verification
- idempotency and amount validation
- actual money movement
See PAYMENT_CORE.md , PAYMENT_INFRASTRUCTURE_2026.md and ECOMMERCE_CHECKOUT_PAYMENTS.md .
AI platform
AI is a flagship operating layer with dedicated workspaces plus contextual copilots across business modules.
Build
Agents, automations, prompts, knowledge, models and media workflows.
Govern
Safety, approvals, identity/access, evaluation, policy and observability.
Operate
Runs, usage/cost, reliability, production operations and cross-module actions.
Contextual action model
The bundled template contains no production AI provider secret and does not execute privileged business writes. Connect your model gateway, RAG service and action API server-side.
Start with AI_FLAGSHIP.md , AI_CROSS_MODULE.md and the specialized AI engineering notes in docs/AI_*.md .
Authentication, users & RBAC
The template includes complete identity/admin presentations, but real session issuance and authorization must be integrated by the buyer.
Authentication screens
Sign in, registration, recovery, verification, OTP, 2FA, magic link and social-login presentation.
Administration
Users, profile/details, activity, sessions, login history, devices, API-key inventory, roles, permissions, teams and departments.
A frontend checkbox or hidden menu item is not a security boundary. Re-evaluate permissions on every sensitive backend request.
Reference: AUTH_RBAC.md and IDENTITY_ACCESS_2026.md .
Forms, tables & charts
Vexlora centralizes interaction engines so buyers change business content without forking foundations.
Forms
native HTML form controls + JavaScript validation patterns. Preserve labels, errors,
aria-invalid
and server revalidation.
Data tables
Shared pagination, sorting, selection, visibility and responsive patterns under components/data-table/ .
Charts
Chart components use shared chart tokens/config. Keep chart data feature-owned.
Engineering references: FORMS.md , DATA_TABLE.md , CHARTS.md .
Localization & RTL
Locale definitions and formatting are centralized. Direction uses logical start/end utilities so LTR and RTL share the same components.
Locale config
assets/js/config/i18n.js defines supported locale behavior.
Formatting
assets/js/lib/i18n/format.js owns number/date/currency formatting helpers.
npm run check:i18n-rtl
Prefer logical utilities such as start/end, ms/me and ps/pe instead of hardcoding left/right in reusable UI.
Responsive, accessibility & quality
Responsive adaptation is intentionally limited to 320–1280px. Above 1280px, preserve the original desktop composition; larger widths should be spot-checked for overflow or regressions without redesigning the layout.
Viewport verification matrix
From 320–1280px, apply only the minimum fixes needed for real responsive issues. Above 1280px, do not reorder blocks, change dashboard composition, make cards full-width, or alter established desktop card geometry.
Responsive checks
- No page-level horizontal overflow
- Charts/cards keep readable minimum geometry
- Tables use mobile cards or explicit overflow
- Dialogs remain usable at short viewport heights
- Topbar/sidebar actions remain reachable
Accessibility checks
- Keyboard-only navigation
- Visible focus states
- Named icon buttons and form controls
- 200%/400% zoom/reflow
- Screen-reader landmarks, dialogs and tables
npm run check:responsive
npm run check:accessibility
Security architecture
Vexlora includes defensive browser defaults and a buyer-facing Security Center, while clearly separating frontend safeguards from production security controls.
Included frontend defaults
CSP, nosniff, referrer policy, permissions policy, cross-origin opener policy, file preflight, client-side validation and masked credential presentations.
Buyer-owned production controls
Secret vaults, database authorization, WAF/rate limiting, webhook verification, malware scanning, server validation, session issuance and audit persistence.
CSP environment hooks
# Copy .env.example to .env.local, then configure only the keys you need.
# Keep the exact variable names shipped in .env.example.
This keeps the documentation accurate if the product prefix is renamed in a future release; .env.example remains authoritative.
The default frame-ancestor policy allows the ThemeForest preview parent while avoiding broad unrestricted embedding. Add only explicitly trusted origins.
Reference: HIGH_SECURITY.md .
Media, images & asset credits
Sample assets are isolated so buyers can replace them without rewriting page logic. Redistribution evidence must be handled carefully before marketplace submission.
Brand assets
Place buyer-owned logos under
assets/brand/
and reference them through
productConfig.brand.logoSrc
.
Sample imagery
Product, construction and real-estate images live under assets/images/ . See the dedicated credits page before redistribution.
The v1.0.0 source records the Pexels product-photo sources. Real Estate and Construction imagery still requires author-side replacement or retained redistribution/license evidence before final ThemeForest submission. Use the dedicated asset register as the release source of truth.
Add a new page or module
Use the existing route group and shared foundations; do not create a parallel admin shell.
pages/(dashboard)/your-area/HTML page
Put components, data, schemas and types under
assets/js/modules/your-area/
.
Use PageHeader, Card, DataTable, forms and chart primitives.
Update the correct file under
assets/js/config/navigation/
.
Run registry and quality checks.
npm run registry:generate
npm run check
npm run test:critical
npm run build
Build & deployment
Vexlora is a static HTML + Tailwind frontend. Deploy the compiled files to any standard static hosting or web server.
Static hosting
Upload the compiled HTML, CSS, JavaScript and assets. If you customize Tailwind source, run the production CSS build before uploading.
Static server / container
If you customize the Tailwind source, run npm run build, then serve the compiled HTML/CSS/JS with your preferred static web server, CDN or container.
npm install
npm run build
# Upload or serve the compiled static files
Replace sample storage and mock providers where durable data is required; integrate authentication/authorization; configure server secrets; verify CSP/API origins; and re-run accessibility, responsive and security checks.
Updates & upgrade safety
Keep buyer customization centralized and use version control so source upgrades can be merged predictably.
Recommended workflow
- Commit your current customization
- Read the new release notes
- Apply the new source in a separate branch/folder
- Reapply central config changes first
- Run upgrade cleanup/preflight gates
- Run build and browser-test the static package
Protected architecture
The project includes upgrade cleanup/preflight scripts that protect canonical routes and remove retired aliases/files during in-place upgrades.
npm run upgrade:preflight
npm run check:upgrade-preflight-safety
npm run check
Release QA & certification
The source includes project-specific quality checks plus the Tailwind production build and browser testing guidance.
Buyer release sequence
npm install
npm run build
npm run check
npm run test:critical
# Combined project certification gate
npm run certify
Source gates
Styles, architecture, responsive, accessibility, performance, buyer customization and maintainability.
Domain gates
eCommerce, payments, AI, CRM, Finance, HR, Hospital, Education, Real Estate and other suites.
Registry gates
Routes, navigation ownership, duplicates and critical page smoke tests.
A release is strongest when the Tailwind production build, static-page checks and project-specific quality gates pass in the buyer environment.
Troubleshooting
Start with the exact failing command and message. If the issue only affects the compiled HTML, first verify file paths, assets and browser-console errors before changing build dependencies.
| Problem | What to check | Recommended action |
|---|---|---|
| Fresh install mismatch | Node/npm version when rebuilding Tailwind, package-lock, partial node_modules |
Remove
node_modules
and run
npm install
again.
|
| Stale generated CSS/build cache |
dist/, generated CSS, or other local build output
|
Run
npm run clean
, then build/test again.
|
| Navigation gate fails | Route exists but registry/navigation is stale |
Run
npm run registry:generate
, then review the intended navigation owner.
|
| Browser-storage sample behaves strangely | Old sample state from an earlier release | Use the relevant reset action or clear the Vexlora sample storage for local testing. |
| CSP blocks an API | Production API/WebSocket origin is not allowed |
Add only the required API/WebSocket origin to the CSP connect-source variable defined in
.env.example
.
|
| Upload works in sample but must persist | Browser adapter is not a production media service | Connect the picker to your own upload/CDN API and store safe returned URLs/IDs. |
Frequently asked questions
Short answers to the questions buyers most often have when adapting a large admin template.
Does Vexlora include a backend?
No. It is a frontend-only admin template with mock/sample state and integration-ready contracts.
Can I use it with my existing storefront or backend?
Yes. The admin is intentionally isolated. Online Store exposes content/navigation configuration; your storefront owns customer-facing rendering.
Can I use a REST, GraphQL or different backend?
Yes. The visual layer is provider-neutral. Adapt the data/integration boundary to your backend.
Are payments live?
No. Payment Core is configuration/workflow UI. Connect actual providers and webhooks through secure server code.
Is AI required?
No. Core business workflows remain usable without an AI provider. AI is an optional flagship enhancement layer.
Where do I change the brand?
Start with assets/js/config/product.js , then update semantic theme tokens if needed.
Engineering references included with the source
The docs/ directory contains detailed architecture notes for AI, payments, eCommerce, CRM, data layer, security, accessibility, responsive behavior, settings, reporting, industry suites and more. This buyer portal summarizes those contracts; the Markdown files provide implementation depth.