@imgly/codesign-mcp 0.1.0

package/assets/docs/guide/rules/verify-properties-before-use.md

@@ -0,0 +1,78 @@
+# Verify Properties Before Use
+
+CE.SDK block types do **not** share a uniform property schema. Each block type — graphic, text, animation, fill, shape — has its own set of available properties. Never assume a property exists on a block; always verify first.
+
+## Rule
+
+Before getting or setting any property on a CE.SDK block, call `engine.block.findAllProperties()` and confirm the property exists. Accessing a non-existent property will throw an error.
+
+```ts
+const props = engine.block.findAllProperties(block);
+if (props.includes('animationEasing')) {
+  engine.block.setEnum(block, 'animationEasing', 'EaseInOut');
+}
+```
+
+## Why This Matters
+
+- `animationEasing` is **not** supported by `pop` or `typewriter_text` animations (and potentially others).
+- `textAnimationWritingStyle` only exists on some text animations (e.g., `baseline`). The `typewriter_text` animation uses `animation/typewriter_text/writingStyle` instead.
+- Fill blocks, shape blocks, and graphic blocks each expose different property sets.
+- New CE.SDK versions may add or remove properties from specific block types.
+
+## Pattern: Safe Property Access
+
+```ts
+function safeSetEnum(
+  engine: CreativeEngine,
+  block: number,
+  prop: string,
+  value: string
+): boolean {
+  const props = engine.block.findAllProperties(block);
+  if (props.includes(prop)) {
+    engine.block.setEnum(block, prop, value);
+    return true;
+  }
+  return false;
+}
+
+function safeGetFloat(
+  engine: CreativeEngine,
+  block: number,
+  prop: string
+): number | undefined {
+  const props = engine.block.findAllProperties(block);
+  if (props.includes(prop)) {
+    return engine.block.getFloat(block, prop);
+  }
+  return undefined;
+}
+```
+
+## Pattern: Animation Configuration
+
+When configuring animations, always check available properties per animation type:
+
+```ts
+const inAnim = engine.block.getInAnimation(block);
+if (inAnim !== null) {
+  const props = engine.block.findAllProperties(inAnim);
+
+  if (props.includes('animationEasing')) {
+    engine.block.setEnum(inAnim, 'animationEasing', opts.inEasing);
+  }
+  if (props.includes('animationDuration')) {
+    engine.block.setFloat(inAnim, 'animationDuration', opts.duration);
+  }
+}
+```
+
+## Debugging: Discover Available Properties
+
+Use `findAllProperties()` as the definitive source of truth for what properties a block supports — more reliable than documentation, which may not cover every block type's specifics:
+
+```ts
+const props = engine.block.findAllProperties(someBlock);
+console.log('Available properties:', props);
+```

package/assets/docs/guide/rules.md

@@ -0,0 +1,23 @@
+> This is one page of the CE.SDK Vanilla JS/TS documentation. For a complete overview, see the [Vanilla JS/TS Documentation Index](https://img.ly/docs/cesdk/js.md). For all docs in one file, see [llms-full.txt](./llms-full.txt.md).
+
+**Navigation:** [Guides](./guides.md) > [Rules](./rules.md)
+
+---
+
+---
+
+## Related Pages
+
+- [Overview](./rules/overview.md) - Define and enforce layout, branding, and safety rules to ensure consistent and compliant designs.
+- [Enforce Brand Guidelines](./rules/enforce-brand-guidelines.md) - Learn how to restrict users to approved brand assets and prevent unauthorized modifications to brand elements
+- [Lock Content](./rules/lock-content.md) - Lock design elements to prevent unwanted modifications using CE.SDK's scope-based permission system.
+- [Moderate Content](./rules/moderate-content.md) - Extract images and text from CE.SDK designs using engine APIs and integrate with third-party moderation services to detect inappropriate content
+
+---
+
+## More Resources
+
+- **[Vanilla JS/TS Documentation Index](https://img.ly/docs/cesdk/js.md)** - Browse all Vanilla JS/TS documentation
+- **[Complete Documentation](./llms-full.txt.md)** - Full documentation in one file (for LLMs)
+- **[Web Documentation](./js.md)** - Interactive documentation with examples
+- **[Support](mailto:support@img.ly)** - Contact IMG.LY support

package/assets/docs/guide/security.md

@@ -0,0 +1,199 @@
+> This is one page of the CE.SDK Vanilla JS/TS documentation. For a complete overview, see the [Vanilla JS/TS Documentation Index](https://img.ly/docs/cesdk/js.md). For all docs in one file, see [llms-full.txt](./llms-full.txt.md).
+
+**Navigation:** [Compatibility & Security](./compatibility.md) > [Security](./security.md)
+
+---
+
+This document provides a comprehensive overview of CE.SDK's security practices, focusing on data handling, privacy, and our commitment to maintaining the highest standards of security for our customers and their end users.
+
+## Key Security Features
+
+- **Client-Side Processing**: All image and design processing occurs directly on the user's device or your servers, not on our servers
+- **No Data Transmission**: Your content (e.g. images, designs, templates, videos, audio, etc.) is never uploaded to or processed on IMG.LY servers
+- **Minimal Data Collection**: We only collect device identifiers and count exports for licensing purposes
+- **GDPR Compliance**: Our data collection practices adhere to GDPR regulations
+- **Secure Licensing**: Enterprise licenses are secured with RSA SHA256 encryption
+
+## Data Protection & Access Controls
+
+### Data Collection
+
+CE.SDK requires minimal data to provide its services. The only potentially personally identifiable information (PII) collected includes device-specific identifiers such as `identifierForVendor` on iOS and `ANDROID_ID` on Android. These identifiers are:
+
+- Used solely for tracking monthly active users for our usage-based pricing models
+- Reset when the user reinstalls the app or resets their device
+- Collected under GDPR's legitimate interest provision (no explicit consent required as they are necessary for our licensing system)
+
+Additionally, we track export operations for billing purposes in usage-based pricing models.
+
+For enterprise customers who prefer more accurate tracking, integrators can provide their own userID. This allows for more precise measurement of usage without requiring additional device identifiers.
+
+### Data Storage & Encryption
+
+**We do not collect or store user data beyond the device identifiers and export counts mentioned above.** Since CE.SDK operates entirely client-side:
+
+- All content processing happens on the user's device
+- No images, designs, or user content is transmitted to IMG.LY servers
+- No content data is stored on IMG.LY infrastructure
+
+We use standard HTTPS (SSL/TLS) encryption for all communications between CE.SDK instances and our licensing backend.
+
+### Access Controls
+
+We are using established industry standard practices to handle sensitive customer data. Therefore access control concerns are minimized. The limited data we do handle is protected as follows:
+
+- Billing information is stored in Stripe and accessed only by members of our finance team and C-level executives
+- API keys and credentials are stored securely in 1Password or GitHub with granular access levels
+- All employees sign Confidentiality Agreements to protect customer information
+
+This refers to data of our direct customers, not their users or customers.
+
+## Licensing System
+
+CE.SDK uses a licensing system that works as follows:
+
+1. During instantiation, an API key is provided to the CE.SDK instance
+2. This API key is held in memory (never stored permanently on the device)
+3. The SDK validates the key with our licensing backend
+4. Upon successful validation, the backend returns a temporary local license
+5. This license is periodically refreshed to maintain valid usage
+
+For browser implementations, we protect licenses against misuse by pinning them to specific domains. For mobile applications, licenses are pinned to the application identifiers to prevent unauthorized use.
+
+For enterprise customers, we offer an alternative model:
+
+- A license file is passed directly to the instance
+- No communication with our licensing service is required
+- Licenses are secured using RSA SHA256 encryption
+
+### CE.SDK Renderer
+
+CE.SDK Renderer is a specialized variant of CE.SDK that consists of a native Linux binary bundled in a Docker container. It uses GPU acceleration and native code to render scenes and archives to various export formats.
+
+Due to bundled third-party codecs (mainly H.264 & H.265) and their associated patent requirements, CE.SDK Renderer implements additional licensing communication beyond the standard licensing handshake:
+
+1. **Initial License Validation**: The tool performs the standard license validation with our licensing backend
+2. **Periodic Heartbeats**: After successful validation, it sends periodic heartbeats to our licensing backend to track the number of active instances
+3. **Instance Limits**: We limit the maximum number of active instances per license based on the settings in your dashboard
+4. **Activation Control**: If the instance limit is exceeded, further activations (launches) of the tool will fail with a descriptive error message
+
+This additional communication allows us to ensure compliance with codec licensing requirements while providing transparent usage tracking for your organization. As with all CE.SDK products, no user data (images, videos, designs, or other content) is transmitted to IMG.LY servers - only device identifiers and instance counts are collected for licensing purposes.
+
+## Security Considerations for User Input
+
+As CE.SDK deals primarily with arbitrary user input, we've implemented specific security measures to handle data safely:
+
+- The CreativeEngine reads files from external resources to fetch images, fonts, structured data, and other sources for designs. These reads are safeguarded by platform-specific default measures.
+- The engine never loads executable code or attempts to execute any data acquired from dynamic content. It generally relies on provided mime types to decode image data or falls back to byte-level inspection to choose the appropriate decoder.
+- For data writing operations, we provide a callback that returns a pointer to the to-be-written data. The engine itself never unconditionally writes to an externally defined path. If it writes to files directly, these are part of internal directories and can't be modified externally.
+- Generated PDFs may have original image files embedded if the image was not altered via effects or blurs and the `exportPdfWithHighCompatibility` option was **not** enabled. This means a malicious image file could theoretically be included in the exported PDF.
+- Inline text-editing allows arbitrary input of strings by users. The engine uses platform-specific default inputs and APIs and doesn't apply additional sanitization. The acquired strings are stored and used exclusively for text rendering - they are neither executed nor used for file operations.
+
+## Security Infrastructure
+
+### Vulnerability Management
+
+We take a proactive approach to security vulnerability management:
+
+- We use GitHub to track dependency vulnerabilities
+- We regularly update affected dependencies
+- We don't maintain a private network, eliminating network vulnerability concerns in that context
+- We don't manually maintain servers or infrastructure, as we don't have live systems beyond those required for licensing
+- For storage and licensing, we use virtual instances in Google Cloud which are managed by the cloud provider
+- All security-related fixes are published in our public changelog at [https://img.ly/docs/cesdk/changelog/](https://img.ly/docs/cesdk/changelog/)
+
+### Security Development Practices
+
+Our development practices emphasize security:
+
+- We rely on established libraries with proven security track records
+- We don't directly process sensitive user data in our code
+- Secrets (auth tokens, passwords, API credentials, certificates) are stored in GitHub or 1Password with granular access levels
+- We use RSA SHA256 encryption for our enterprise licenses
+- We rely on platform-standard SSL implementations for HTTPS communications
+
+### API Key Management
+
+API keys for CE.SDK are handled securely:
+
+- Keys are passed during instantiation and held in memory only
+- Keys are never stored permanently on client devices
+- For web implementation, keys are pinned to specific domains to prevent unauthorized use
+- Enterprise licenses use a file-based approach that doesn't require API key validation
+
+## Compliance
+
+IMG.LY complies with the General Data Protection Regulation (GDPR) in all our operations, including CE.SDK. Our Privacy Policy is publicly available at [https://img.ly/privacy-policy](https://img.ly/privacy-policy).
+
+Our client-side approach to content processing significantly reduces privacy and compliance concerns, as user content never leaves their device environment for processing.
+
+## FAQ
+
+### Does CE.SDK upload my images or designs to IMG.LY servers?
+
+No. CE.SDK processes all content locally on the user's device. Your images, designs, and other content are never transmitted to IMG.LY servers.
+
+### What data does IMG.LY collect through CE.SDK?
+
+CE.SDK only collects device identifiers (such as identifierForVendor on iOS or ANDROID_ID on Android) for licensing purposes and export counts. No user content or personal information is collected.
+
+### How does IMG.LY protect API keys?
+
+API keys are never stored permanently; they are held in memory during SDK operation. For web implementations, keys are pinned to specific domains to prevent unauthorized use.
+
+### Has IMG.LY experienced any security breaches?
+
+No, IMG.LY has not been involved in any cybersecurity breaches in the last 12 months.
+
+### Does IMG.LY conduct security audits?
+
+As we don't store customer data directly, but rely on third parties to do so, we focus our security efforts on dependency tracking and vulnerability management through GitHub's security features. We don't conduct security audits.
+
+## Additional Information
+
+For more detailed information about our data collection practices, please refer to our Data Privacy and Retention information below.
+
+Should you have any additional questions regarding security practices or require more information, please contact our team at [support@img.ly](mailto:support@img.ly).
+
+## Data Privacy and Retention
+
+At IMG.LY, we prioritize your data privacy and ensure that apart from a minimal contractually stipulated set of interactions with our servers all other operations take place on your local device. Below is an overview of our data privacy and retention policies:
+
+### **Data Processing**
+
+All data processed by CE.SDK remains strictly on your device. We do not transfer your data to our servers for processing. This means that operations such as rendering, editing, and other in-app functionalities happen entirely locally, ensuring that sensitive project or personal data stays with you.
+
+### **Data Retention**
+
+We do not store any project-related data on our servers. Since all data operations occur locally, no information about your edits, images, or video content is retained by CE.SDK. The only data that interacts with our servers is related to license validation and telemetry related to usage tied to your pricing plan.
+
+### **License Validation**
+
+CE.SDK performs a license validation check with our servers once upon initialization to validate the software license being used. This interaction is minimal and does not involve the transfer of any personal, project, or media data.
+
+### **Event Tracking**
+
+While CE.SDK does not track user actions other than the exceptions listed below through telemetry or analytics by default, there are specific events tracked to manage customer usage, particularly for API key usage tracking. We gather the following information during these events:
+
+- **When the engine loads:** App identifier, platform, engine version, user ID (provided by the client), device ID (mobile only), and session ID.
+- **When a photo or video is exported:** User ID, device ID, session ID, media type (photo/video), resolution (width and height), FPS (video only), and duration (video only).
+
+This tracking is solely for ensuring accurate usage calculation and managing monthly active user billing. Enterprise clients can opt out of this tracking under specific agreements.
+
+### **Personal Identifiable Information (PII)**
+
+The only PII that is potentially collected includes device-specific identifiers such as `identifierForVendor` on iOS and `ANDROID_ID` on Android. These IDs are used for tracking purposes and are reset when the user reinstalls the app or resets the device. No consent is required for these identifiers because they are crucial for our usage-based pricing models. This is covered by the GDPR as legitimate interest.
+
+### **User Consent**
+
+As mentioned above, user consent is not required when solely using the CE.SDK. However, this may change depending on the specific enterprise agreement or additional regulatory requirements.
+IMG.LY is committed to maintaining compliance with **GDPR** and other applicable data protection laws, ensuring your privacy is respected at all times. For details consult our [privacy policy](https://img.ly/privacy-policy).
+
+---
+
+## More Resources
+
+- **[Vanilla JS/TS Documentation Index](https://img.ly/docs/cesdk/js.md)** - Browse all Vanilla JS/TS documentation
+- **[Complete Documentation](./llms-full.txt.md)** - Full documentation in one file (for LLMs)
+- **[Web Documentation](./js.md)** - Interactive documentation with examples
+- **[Support](mailto:support@img.ly)** - Contact IMG.LY support

package/assets/docs/guide/serve-assets.md

@@ -0,0 +1,332 @@
+> This is one page of the CE.SDK Vanilla JS/TS documentation. For a complete overview, see the [Vanilla JS/TS Documentation Index](https://img.ly/docs/cesdk/js.md). For all docs in one file, see [llms-full.txt](./llms-full.txt.md).
+
+**Navigation:** [Guides](./guides.md) > [Serve Assets](./serve-assets.md)
+
+---
+
+Configure CE.SDK to load engine and content assets from your own servers
+instead of the IMG.LY CDN for production deployments.
+
+Self-hosting assets is required for production use. The IMG.LY CDN is intended for development and prototyping only—you'll see a console warning when using the default CDN configuration. Hosting assets yourself gives you control over performance, availability, and compliance requirements.
+
+[Download Assets (v$UBQ\_VERSION$)](https://cdn.img.ly/packages/imgly/cesdk-js/$UBQ_VERSION$/imgly-assets.zip)
+
+This guide covers the asset categories CE.SDK uses, how to configure `baseURL` and asset source paths, and how to automate asset updates during SDK upgrades.
+
+## Quick Start
+
+Download and extract the essential assets for your SDK version:
+
+```bash
+# Download assets for current SDK version
+curl -O https://cdn.img.ly/packages/imgly/cesdk-js/$UBQ_VERSION$/imgly-assets.zip
+
+# Create versioned directory and extract assets
+mkdir -p public/cesdk/$UBQ_VERSION$
+unzip imgly-assets.zip -d public/cesdk/$UBQ_VERSION$/
+rm imgly-assets.zip
+```
+
+Then configure CE.SDK to use your self-hosted assets:
+
+```javascript
+import CreativeEditorSDK from '@cesdk/cesdk-js';
+import {
+  BlurAssetSource,
+  ColorPaletteAssetSource,
+  CropPresetsAssetSource,
+  DemoAssetSources,
+  EffectsAssetSource,
+  FiltersAssetSource,
+  PagePresetsAssetSource,
+  StickerAssetSource,
+  TextAssetSource,
+  TextComponentAssetSource,
+  TypefaceAssetSource,
+  UploadAssetSources,
+  VectorShapeAssetSource
+} from '@cesdk/cesdk-js/plugins';
+
+const config = {
+  license: 'YOUR_CESDK_LICENSE_KEY',
+  baseURL: `https://cdn.yourdomain.com/cesdk/${CreativeEditorSDK.version}/`
+};
+
+CreativeEditorSDK.create(container, config).then(async (cesdk) => {
+  const assetBaseURL = `https://cdn.yourdomain.com/cesdk/${CreativeEditorSDK.version}/`;
+
+  // Add default asset source plugins
+  await cesdk.addPlugin(new BlurAssetSource({ baseURL: assetBaseURL }));
+  await cesdk.addPlugin(new ColorPaletteAssetSource({ baseURL: assetBaseURL }));
+  await cesdk.addPlugin(new CropPresetsAssetSource({ baseURL: assetBaseURL }));
+  await cesdk.addPlugin(new EffectsAssetSource({ baseURL: assetBaseURL }));
+  await cesdk.addPlugin(new FiltersAssetSource({ baseURL: assetBaseURL }));
+  await cesdk.addPlugin(new PagePresetsAssetSource({ baseURL: assetBaseURL }));
+  await cesdk.addPlugin(new StickerAssetSource({ baseURL: assetBaseURL }));
+  await cesdk.addPlugin(new TextAssetSource({ baseURL: assetBaseURL }));
+  await cesdk.addPlugin(
+    new TextComponentAssetSource({ baseURL: assetBaseURL })
+  );
+  await cesdk.addPlugin(new TypefaceAssetSource({ baseURL: assetBaseURL }));
+  await cesdk.addPlugin(new VectorShapeAssetSource({ baseURL: assetBaseURL }));
+
+  // Add demo and upload sources
+  await cesdk.addPlugin(
+    new UploadAssetSources({ include: ['ly.img.image.upload'] })
+  );
+  await cesdk.addPlugin(
+    new DemoAssetSources({
+      include: [
+        'ly.img.templates.blank.*',
+        'ly.img.templates.presentation.*',
+        'ly.img.templates.print.*',
+        'ly.img.templates.social.*',
+        'ly.img.image.*'
+      ]
+    })
+  );
+});
+```
+
+> **Note:** **Versioned paths recommended**: Using version-specific paths like
+> `/cesdk/${CreativeEditorSDK.version}/` allows you to run multiple SDK versions in parallel,
+> simplifies rollbacks, and ensures clean cache invalidation during upgrades.
+
+## Understanding CE.SDK Assets
+
+CE.SDK assets are distributed in an `imgly-assets.zip` file available for download from the IMG.LY CDN. Understanding what's in this archive helps you decide which assets to host and how to keep them updated.
+
+### Asset Categories
+
+The ZIP file contains directories organized by function:
+
+| Directory                    | Contents                                               | Version-Locked? | Required?               |
+| ---------------------------- | ------------------------------------------------------ | --------------- | ----------------------- |
+| `core/`                      | WASM engine files (`.wasm`, `.data`, `worker-host.js`) | **Yes**         | **Yes**                 |
+| `ui/`                        | UI resources (audio waveform, fonts, stylesheets)      | **Yes**         | **Yes**                 |
+| `emoji/`                     | Emoji assets                                           | **Yes**         | **Yes**                 |
+| `fonts/`                     | System fonts                                           | **Yes**         | **Yes**                 |
+| `i18n/`                      | Translations                                           | **Yes**         | No (bundled in SDK)     |
+| `ly.img.sticker/`            | Stickers                                               | No              | If using default assets |
+| `ly.img.sticker.misc/`       | Additional stickers                                    | No              | If using default assets |
+| `ly.img.vector.shape/`       | Shapes and arrows                                      | No              | If using default assets |
+| `ly.img.typeface/`           | Font definitions                                       | No              | If using default assets |
+| `ly.img.filter/`             | Filter effects (LUT and duotone)                       | No              | If using default assets |
+| `ly.img.effect/`             | Visual effects                                         | No              | If using default assets |
+| `ly.img.blur/`               | Blur presets                                           | No              | If using default assets |
+| `ly.img.color.palette/`      | Color palettes                                         | No              | If using default assets |
+| `ly.img.crop.presets/`       | Crop aspect ratios                                     | No              | If using default assets |
+| `ly.img.page.presets/`       | Page format presets                                    | No              | If using default assets |
+| `ly.img.page.presets.video/` | Video page presets                                     | No              | If using default assets |
+| `ly.img.caption.presets/`    | Caption formatting presets                             | No              | If using default assets |
+| `ly.img.text.components/`    | Text components                                        | No              | If using default assets |
+| `ly.img.animation/`          | Animation presets                                      | No              | If using default assets |
+| `ly.img.animation.text/`     | Text animation presets                                 | No              | If using default assets |
+| `ly.img.image/`              | Sample images (demo content)                           | No              | No                      |
+| `ly.img.video/`              | Sample videos (demo content)                           | No              | No                      |
+| `ly.img.audio/`              | Sample audio (demo content)                            | No              | No                      |
+| `ly.img.template/`           | Design templates (demo content)                        | No              | No                      |
+| `ly.img.video.template/`     | Video templates (demo content)                         | No              | No                      |
+
+For most integrations, you need `core/`, `ui/`, `emoji/`, `fonts/`, and the `ly.img.*` asset sources you use.
+
+### Version-Locked vs. Independent Assets
+
+**Version-locked assets** (`core/`, `ui/`, `i18n/`) must match your SDK version. Mismatched versions cause load errors—the engine will fail to initialize if core files don't match.
+
+**Independent assets** (`ly.img.*` directories) can be updated separately. Configure these via asset source plugins (imported from `@cesdk/cesdk-js/plugins`), each of which accepts a `baseURL` option. Check the changelog when upgrading to see if asset versions have changed.
+
+### Default Asset Sources
+
+Adding the default asset source plugins registers these asset sources:
+
+- `ly.img.sticker` - Stickers
+- `ly.img.sticker.misc` - Additional stickers
+- `ly.img.vector.shape` - Shapes and arrows
+- `ly.img.typeface` - Font definitions
+- `ly.img.color.palette` - Color palettes
+- `ly.img.filter` - Filter effects
+- `ly.img.effect` - Visual effects
+- `ly.img.blur` - Blur presets
+- `ly.img.crop.presets` - Crop aspect ratios
+- `ly.img.page.presets` - Page format presets
+- `ly.img.page.presets.video` - Video page presets
+- `ly.img.caption.presets` - Caption formatting
+- `ly.img.text.components` - Text components
+- `ly.img.animation` - Animation presets
+- `ly.img.animation.text` - Text animation presets
+
+### Demo Asset Sources
+
+Adding the `DemoAssetSources` and `UploadAssetSources` plugins registers sample content sources for development:
+
+- `ly.img.image` - Sample images
+- `ly.img.video` - Sample videos
+- `ly.img.audio` - Sample audio
+- `ly.img.template` - Design templates
+- `ly.img.video.template` - Video templates
+- `ly.img.image.upload`, `ly.img.video.upload`, `ly.img.audio.upload` - Upload sources
+
+These are intended for development and prototyping—replace them with your own content in production.
+
+## Configuration Options
+
+Browser configuration involves three settings: `baseURL`, `core.baseURL`, and the `baseURL` option for asset sources.
+
+### Editor Configuration
+
+Pass configuration to `CreativeEditorSDK.create()`:
+
+```javascript
+import CreativeEditorSDK from '@cesdk/cesdk-js';
+
+const config = {
+  baseURL: `https://cdn.yourdomain.com/cesdk/${CreativeEditorSDK.version}/`,
+  core: {
+    baseURL: 'core/'
+  }
+};
+
+CreativeEditorSDK.create(container, config).then((cesdk) => {
+  // Editor initialized with self-hosted assets
+});
+```
+
+**`baseURL`** — Base path for all engine assets. Can be an absolute URL or a relative path. Relative paths resolve against `window.location.href`. Defaults to the IMG.LY CDN.
+
+**`core.baseURL`** — Path to WASM files. Defaults to `core/` relative to `baseURL`. Usually you don't need to change this unless hosting WASM files separately.
+
+### Asset Sources Configuration
+
+Configure asset sources after initializing the editor by adding individual asset source plugins:
+
+```javascript
+import {
+  BlurAssetSource,
+  ColorPaletteAssetSource,
+  CropPresetsAssetSource,
+  DemoAssetSources,
+  EffectsAssetSource,
+  FiltersAssetSource,
+  PagePresetsAssetSource,
+  StickerAssetSource,
+  TextAssetSource,
+  TextComponentAssetSource,
+  TypefaceAssetSource,
+  UploadAssetSources,
+  VectorShapeAssetSource
+} from '@cesdk/cesdk-js/plugins';
+
+CreativeEditorSDK.create(container, config).then(async (cesdk) => {
+  const assetBaseURL = `https://cdn.yourdomain.com/cesdk/${CreativeEditorSDK.version}/`;
+
+  // Point default assets to your server
+  await cesdk.addPlugin(new BlurAssetSource({ baseURL: assetBaseURL }));
+  await cesdk.addPlugin(new ColorPaletteAssetSource({ baseURL: assetBaseURL }));
+  await cesdk.addPlugin(new CropPresetsAssetSource({ baseURL: assetBaseURL }));
+  await cesdk.addPlugin(new EffectsAssetSource({ baseURL: assetBaseURL }));
+  await cesdk.addPlugin(new FiltersAssetSource({ baseURL: assetBaseURL }));
+  await cesdk.addPlugin(new PagePresetsAssetSource({ baseURL: assetBaseURL }));
+  await cesdk.addPlugin(new StickerAssetSource({ baseURL: assetBaseURL }));
+  await cesdk.addPlugin(new TextAssetSource({ baseURL: assetBaseURL }));
+  await cesdk.addPlugin(
+    new TextComponentAssetSource({ baseURL: assetBaseURL })
+  );
+  await cesdk.addPlugin(new TypefaceAssetSource({ baseURL: assetBaseURL }));
+  await cesdk.addPlugin(new VectorShapeAssetSource({ baseURL: assetBaseURL }));
+
+  // Optional: Add demo assets for development
+  await cesdk.addPlugin(
+    new UploadAssetSources({ include: ['ly.img.image.upload'] })
+  );
+  await cesdk.addPlugin(
+    new DemoAssetSources({
+      baseURL: assetBaseURL,
+      include: [
+        'ly.img.templates.blank.*',
+        'ly.img.templates.presentation.*',
+        'ly.img.templates.print.*',
+        'ly.img.templates.social.*',
+        'ly.img.image.*'
+      ]
+    })
+  );
+});
+```
+
+The `baseURL` for asset sources must be an absolute URL. The engine looks up asset definitions at `{baseURL}/{sourceId}/content.json` and references files like `{baseURL}/{sourceId}/images/example.png`.
+
+### Engine-Level Assets
+
+The engine uses additional assets for font fallback (Unicode character coverage) and emoji rendering. When you configure `baseURL` for self-hosting, the engine automatically uses the same location for these assets:
+
+- **Font fallback files** — Used when text contains characters not covered by the selected font. Located at `{baseURL}/fonts/font-{index}.ttf`.
+- **Emoji font** — The default emoji font (NotoColorEmoji.ttf). Located at `{baseURL}/emoji/NotoColorEmoji.ttf`.
+
+The `fonts/` and `emoji/` directories are already included in the `imgly-assets.zip` download, so no additional configuration is needed when self-hosting—just ensure these directories are present at your `baseURL` location.
+
+> **Note:** **Troubleshooting**: If you see 404 errors for font files when self-hosting, verify that the
+> `fonts/` and `emoji/` directories from `imgly-assets.zip` are properly extracted at your
+> `baseURL` location.
+
+## Excluding Unused Asset Sources
+
+If you only need a subset of default assets, simply omit the plugins you don't need. For example, to skip stickers and video page presets, add all plugins except `StickerAssetSource` and the video page presets:
+
+```javascript
+// Only add the plugins you need
+await cesdk.addPlugin(new BlurAssetSource());
+await cesdk.addPlugin(new ColorPaletteAssetSource());
+await cesdk.addPlugin(new CropPresetsAssetSource());
+await cesdk.addPlugin(new EffectsAssetSource());
+await cesdk.addPlugin(new FiltersAssetSource());
+await cesdk.addPlugin(new PagePresetsAssetSource());
+// StickerAssetSource omitted
+await cesdk.addPlugin(new TextAssetSource());
+await cesdk.addPlugin(new TextComponentAssetSource());
+await cesdk.addPlugin(new TypefaceAssetSource());
+await cesdk.addPlugin(new VectorShapeAssetSource());
+```
+
+This reduces initial load time by not fetching unused asset definitions.
+
+## Troubleshooting
+
+### WASM Load Errors
+
+If the engine fails to initialize with missing `.wasm` or `.data` errors, verify:
+
+1. The assets ZIP version matches your SDK version
+2. The `core.baseURL` points to the correct directory
+3. Your server returns correct MIME types for `.wasm` files (`application/wasm`)
+
+### 404 Errors for Assets
+
+If the console shows 404 errors for `content.json` files:
+
+1. Verify the `baseURL` passed to your asset source plugins is correct
+2. Check that asset directories exist at the expected paths
+3. Configure CORS headers if serving assets from a different domain
+
+### CDN Warning in Console
+
+The warning "You're using the IMG.LY CDN" appears when using default configuration. Set `baseURL` in your config to use self-hosted assets and remove the warning.
+
+## API Reference
+
+| Method/Config                                 | Purpose                                                     |
+| --------------------------------------------- | ----------------------------------------------------------- |
+| `CreativeEditorSDK.create(container, config)` | Initialize editor with configuration                        |
+| `config.baseURL`                              | Base path for all engine assets (including fonts and emoji) |
+| `config.core.baseURL`                         | Path to WASM/core files (relative to baseURL)               |
+| `cesdk.addPlugin(new XyzAssetSource())`       | Add individual asset source plugins                         |
+| `CreativeEditorSDK.version`                   | Get current SDK version string                              |
+
+---
+
+## More Resources
+
+- **[Vanilla JS/TS Documentation Index](https://img.ly/docs/cesdk/js.md)** - Browse all Vanilla JS/TS documentation
+- **[Complete Documentation](./llms-full.txt.md)** - Full documentation in one file (for LLMs)
+- **[Web Documentation](./js.md)** - Interactive documentation with examples
+- **[Support](mailto:support@img.ly)** - Contact IMG.LY support