@richscripts/richtexteditor 2.8.0 → 2.10.0

package/richtexteditor/plugins/all_plugins.js

@@ -208,6 +208,13 @@ function RTE_Plugin_AccessibilityChecker() {
             "@media (max-width: 1420px){.rte-a11y-shell{display:block;}.rte-a11y-panel{margin-top:12px;max-width:none;width:100%;}.rte-a11y-body{max-height:360px;}}"
         ].join("");
         hostDoc.head.appendChild(style);
+        // A <style> ELEMENT is governed by style-src: under a strict policy the browser
+        // drops its rules, leaving this plugin's UI unstyled. The element above stays
+        // the path everyone else takes; this re-injects through the CSSOM only when
+        // the policy actually emptied it.
+        if (editor && typeof editor.ensureStyleSheetLive === "function") {
+            editor.ensureStyleSheetLive(hostDoc, style, "rte-accessibility-checker-style", style.textContent);
+        }
     }
 
     function ensureShell() {
@@ -20910,6 +20917,13 @@ function RTE_Plugin_AutoEmbed() {
         st.id = "rte-autoembed-styles";
         st.appendChild(doc.createTextNode(css));
         (doc.head || doc.getElementsByTagName("head")[0] || doc.documentElement).appendChild(st);
+        // A <style> ELEMENT is governed by style-src: under a strict policy the browser
+        // drops its rules, leaving this plugin's UI unstyled. The element above stays
+        // the path everyone else takes; this re-injects through the CSSOM only when
+        // the policy actually emptied it.
+        if (editor && typeof editor.ensureStyleSheetLive === "function") {
+            editor.ensureStyleSheetLive(doc, st, "rte-autoembed-styles", st.textContent);
+        }
     }
 
     // Programmatic insert at caret (public editor.embedUrl API).
@@ -21091,6 +21105,13 @@ function RTE_Plugin_BlockTypes() {
                 st.setAttribute("data-rte-blocktypes", "1");
                 st.textContent = css;
                 head.appendChild(st);
+                // A <style> ELEMENT is governed by style-src: under a strict policy the browser
+                // drops its rules, leaving this plugin's UI unstyled. The element above stays
+                // the path everyone else takes; this re-injects through the CSSOM only when
+                // the policy actually emptied it.
+                if (editor && typeof editor.ensureStyleSheetLive === "function") {
+                    editor.ensureStyleSheetLive(editdoc, st, "rte-blocktypes-st", st.textContent);
+                }
             }
         } catch (e) { /* ignore */ }
     }
@@ -21329,6 +21350,13 @@ function RTE_Plugin_BookmarkCard() {
                 st.setAttribute("data-rte-bookmarkcard", "1");
                 st.textContent = css;
                 head.appendChild(st);
+                // A <style> ELEMENT is governed by style-src: under a strict policy the browser
+                // drops its rules, leaving this plugin's UI unstyled. The element above stays
+                // the path everyone else takes; this re-injects through the CSSOM only when
+                // the policy actually emptied it.
+                if (editor && typeof editor.ensureStyleSheetLive === "function") {
+                    editor.ensureStyleSheetLive(editdoc, st, "rte-bookmarkcard-st", st.textContent);
+                }
             }
         } catch (e) { /* ignore */ }
     }
@@ -21742,6 +21770,13 @@ function RTE_Plugin_CharLimit() {
         st.textContent = ".rte-charlimit-counter{position:absolute;right:10px;bottom:6px;z-index:5;font:11px -apple-system,Segoe UI,sans-serif;color:#64748b;background:rgba(255,255,255,.85);padding:1px 7px;border-radius:9px;pointer-events:none}" +
             ".rte-charlimit-counter.is-near{color:#b45309}.rte-charlimit-counter.is-over{color:#dc2626;font-weight:600}";
         (doc.head || doc.documentElement).appendChild(st);
+        // A <style> ELEMENT is governed by style-src: under a strict policy the browser
+        // drops its rules, leaving this plugin's UI unstyled. The element above stays
+        // the path everyone else takes; this re-injects through the CSSOM only when
+        // the policy actually emptied it.
+        if (editor && typeof editor.ensureStyleSheetLive === "function") {
+            editor.ensureStyleSheetLive(doc, st, "rte-charlimit-st", st.textContent);
+        }
     }
 
     function refresh() {
@@ -22398,6 +22433,13 @@ function RTE_Plugin_Comments() {
                 ".rte-comment-dark .rte-comment-quote{background:rgba(245,158,11,.12);color:#fcd34d}"
             ].join("\n");
             host.head.appendChild(style);
+            // A <style> ELEMENT is governed by style-src: under a strict policy the browser
+            // drops its rules, leaving this plugin's UI unstyled. The element above stays
+            // the path everyone else takes; this re-injects through the CSSOM only when
+            // the policy actually emptied it.
+            if (editor && typeof editor.ensureStyleSheetLive === "function") {
+                editor.ensureStyleSheetLive(host, style, "rte-comments-style", style.textContent);
+            }
         }
 
         var editdoc = editor.getDocument();
@@ -22411,6 +22453,13 @@ function RTE_Plugin_Comments() {
                 "@keyframes rte-comment-flash{0%{background:rgba(251,191,36,.9)}100%{background:" + config.commentHighlightBg + "}}"
             ].join("\n");
             editdoc.head.appendChild(iStyle);
+            // A <style> ELEMENT is governed by style-src: under a strict policy the browser
+            // drops its rules, leaving this plugin's UI unstyled. The element above stays
+            // the path everyone else takes; this re-injects through the CSSOM only when
+            // the policy actually emptied it.
+            if (editor && typeof editor.ensureStyleSheetLive === "function") {
+                editor.ensureStyleSheetLive(editdoc, iStyle, "rte-comments-iStyle", iStyle.textContent);
+            }
         }
     }
 
@@ -22545,6 +22594,13 @@ function RTE_Plugin_ContentMinimap() {
             "@media (max-width: 1100px){.rte-content-minimap-shell{display:block;}.rte-content-minimap-panel{margin-top:12px;max-width:none;width:100%;}.rte-content-minimap-body{max-height:280px;}}"
         ].join("");
         hostDoc.head.appendChild(style);
+        // A <style> ELEMENT is governed by style-src: under a strict policy the browser
+        // drops its rules, leaving this plugin's UI unstyled. The element above stays
+        // the path everyone else takes; this re-injects through the CSSOM only when
+        // the policy actually emptied it.
+        if (editor && typeof editor.ensureStyleSheetLive === "function") {
+            editor.ensureStyleSheetLive(hostDoc, style, "rte-content-minimap-style", style.textContent);
+        }
     }
 
     function ensureShell() {
@@ -23216,6 +23272,13 @@ function RTE_Plugin_CrossReference() {
         st.setAttribute("data-css", text);
         st.appendChild(doc.createTextNode(text));
         (doc.head || doc.getElementsByTagName("head")[0] || doc.documentElement).appendChild(st);
+        // A <style> ELEMENT is governed by style-src: under a strict policy the browser
+        // drops its rules, leaving this plugin's UI unstyled. The element above stays
+        // the path everyone else takes; this re-injects through the CSSOM only when
+        // the policy actually emptied it.
+        if (editor && typeof editor.ensureStyleSheetLive === "function") {
+            editor.ensureStyleSheetLive(doc, st, "rte-xref-styles", st.textContent);
+        }
     }
 }
 
@@ -23671,6 +23734,13 @@ function RTE_Plugin_Dictation() {
         style.setAttribute("data-rte-dictation", "1");
         style.appendChild(document.createTextNode(css));
         document.head.appendChild(style);
+        // A <style> ELEMENT is governed by style-src: under a strict policy the browser
+        // drops its rules, leaving this plugin's UI unstyled. The element above stays
+        // the path everyone else takes; this re-injects through the CSSOM only when
+        // the policy actually emptied it.
+        if (editor && typeof editor.ensureStyleSheetLive === "function") {
+            editor.ensureStyleSheetLive(document, style, "rte-dictation-style", style.textContent);
+        }
     }
 
     function normalize(text, isFinal) {
@@ -25116,9 +25186,7 @@ function RTE_Plugin_DocumentOutline() {
     function injectStyles() {
         var hostDoc = config.container.ownerDocument;
         if (hostDoc.getElementById("rte-document-outline-style")) return;
-        var style = hostDoc.createElement("style");
-        style.id = "rte-document-outline-style";
-        style.innerHTML = [
+        var csstext = [
             ".rte-document-outline-shell{display:flex;align-items:stretch;gap:10px;}",
             ".rte-document-outline-shell>.rte-document-outline-host{flex:1 1 auto;min-width:0;}",
             "/* 2026-07-12 navigation panel precision */",
@@ -25141,7 +25209,15 @@ function RTE_Plugin_DocumentOutline() {
             ".rte-document-outline-empty{margin:6px;padding:14px;color:#52657e;font-size:13px;font-weight:700;line-height:1.55;background:#fff;border:1px dashed rgba(148,163,184,.34);border-radius:8px;}",
             "@media (max-width: 1100px){.rte-document-outline-shell{display:block;}.rte-document-outline-panel{margin-top:12px;max-width:none;width:100%;}.rte-document-outline-body{max-height:320px;}}"
         ].join("");
+        var style = hostDoc.createElement("style");
+        style.id = "rte-document-outline-style";
+        style.appendChild(hostDoc.createTextNode(csstext));
         hostDoc.head.appendChild(style);
+        // A <style> element's rules are dropped under a strict style-src; this
+        // re-injects them through the CSSOM in that case only.
+        if (editor && typeof editor.ensureStyleSheetLive === "function") {
+            editor.ensureStyleSheetLive(hostDoc, style, "rte-document-outline-style", csstext);
+        }
     }
 
     function ensureShell() {
@@ -26704,6 +26780,13 @@ function RTE_Plugin_DragHandle() {
             ".rte-drag-active *{cursor:grabbing !important;}"
         ));
         (doc.head || doc.getElementsByTagName("head")[0] || doc.documentElement).appendChild(st);
+        // A <style> ELEMENT is governed by style-src: under a strict policy the browser
+        // drops its rules, leaving this plugin's UI unstyled. The element above stays
+        // the path everyone else takes; this re-injects through the CSSOM only when
+        // the policy actually emptied it.
+        if (editor && typeof editor.ensureStyleSheetLive === "function") {
+            editor.ensureStyleSheetLive(doc, st, "rte-drag-handle-styles", st.textContent);
+        }
     }
 }
 
@@ -27263,6 +27346,13 @@ function RTE_Plugin_FoldHeadings() {
         st.id = "rte-foldheadings-styles";
         st.appendChild(doc.createTextNode(css));
         (doc.head || doc.getElementsByTagName("head")[0] || doc.documentElement).appendChild(st);
+        // A <style> ELEMENT is governed by style-src: under a strict policy the browser
+        // drops its rules, leaving this plugin's UI unstyled. The element above stays
+        // the path everyone else takes; this re-injects through the CSSOM only when
+        // the policy actually emptied it.
+        if (editor && typeof editor.ensureStyleSheetLive === "function") {
+            editor.ensureStyleSheetLive(doc, st, "rte-foldheadings-styles", st.textContent);
+        }
     }
 
     // Strip fold classes for the duration of a serialization call so saved markup
@@ -27693,6 +27783,13 @@ function RTE_Plugin_Footnotes() {
         st.setAttribute("data-css", text);
         st.appendChild(doc.createTextNode(text));
         (doc.head || doc.getElementsByTagName("head")[0] || doc.documentElement).appendChild(st);
+        // A <style> ELEMENT is refused under `style-src 'self'` and its rules are
+        // dropped, so footnote markers and the separator rendered unstyled for any
+        // customer on a strict CSP. This re-injects through the CSSOM only in that
+        // case; the element above stays the path everyone else takes.
+        if (editor && typeof editor.ensureStyleSheetLive === "function") {
+            editor.ensureStyleSheetLive(doc, st, "rte-footnotes-styles", text);
+        }
     }
 }
 
@@ -27992,6 +28089,13 @@ function RTE_Plugin_FormatPainter() {
         st.id = "rte-format-painter-styles";
         st.appendChild(doc.createTextNode(css()));
         (doc.head || doc.getElementsByTagName("head")[0] || doc.documentElement).appendChild(st);
+        // A <style> ELEMENT is governed by style-src: under a strict policy the browser
+        // drops its rules, leaving this plugin's UI unstyled. The element above stays
+        // the path everyone else takes; this re-injects through the CSSOM only when
+        // the policy actually emptied it.
+        if (editor && typeof editor.ensureStyleSheetLive === "function") {
+            editor.ensureStyleSheetLive(doc, st, "rte-format-painter-styles", st.textContent);
+        }
     }
 }
 
@@ -28239,6 +28343,13 @@ function RTE_Plugin_FormattingMarks() {
         st.setAttribute("data-css", text);
         st.appendChild(doc.createTextNode(text));
         (doc.head || doc.getElementsByTagName("head")[0] || doc.documentElement).appendChild(st);
+        // A <style> ELEMENT is governed by style-src: under a strict policy the browser
+        // drops its rules, leaving this plugin's UI unstyled. The element above stays
+        // the path everyone else takes; this re-injects through the CSSOM only when
+        // the policy actually emptied it.
+        if (editor && typeof editor.ensureStyleSheetLive === "function") {
+            editor.ensureStyleSheetLive(doc, st, "rte-formatting-marks-styles", st.textContent);
+        }
     }
 }
 
@@ -28605,6 +28716,13 @@ function RTE_Plugin_GapCursor() {
         st.setAttribute("data-css", text);
         st.appendChild(doc.createTextNode(text));
         (doc.head || doc.getElementsByTagName("head")[0] || doc.documentElement).appendChild(st);
+        // A <style> ELEMENT is governed by style-src: under a strict policy the browser
+        // drops its rules, leaving this plugin's UI unstyled. The element above stays
+        // the path everyone else takes; this re-injects through the CSSOM only when
+        // the policy actually emptied it.
+        if (editor && typeof editor.ensureStyleSheetLive === "function") {
+            editor.ensureStyleSheetLive(doc, st, "rte-gapcursor-styles", st.textContent);
+        }
     }
 }
 
@@ -28874,6 +28992,13 @@ function RTE_Plugin_GhostComplete() {
         st.id = "rte-ghost-styles";
         st.appendChild(doc.createTextNode(css));
         (doc.head || doc.getElementsByTagName("head")[0] || doc.documentElement).appendChild(st);
+        // A <style> ELEMENT is governed by style-src: under a strict policy the browser
+        // drops its rules, leaving this plugin's UI unstyled. The element above stays
+        // the path everyone else takes; this re-injects through the CSSOM only when
+        // the policy actually emptied it.
+        if (editor && typeof editor.ensureStyleSheetLive === "function") {
+            editor.ensureStyleSheetLive(doc, st, "rte-ghost-styles", st.textContent);
+        }
     }
 
     function stripFor() {
@@ -32561,6 +32686,13 @@ function RTE_Plugin_LayoutTable() {
         st.setAttribute("data-css", text);
         st.appendChild(doc.createTextNode(text));
         (doc.head || doc.getElementsByTagName("head")[0] || doc.documentElement).appendChild(st);
+        // A <style> ELEMENT is governed by style-src: under a strict policy the browser
+        // drops its rules, leaving this plugin's UI unstyled. The element above stays
+        // the path everyone else takes; this re-injects through the CSSOM only when
+        // the policy actually emptied it.
+        if (editor && typeof editor.ensureStyleSheetLive === "function") {
+            editor.ensureStyleSheetLive(doc, st, "rte-layout-table-styles", st.textContent);
+        }
     }
 
     function fireChange() {
@@ -32919,6 +33051,13 @@ function RTE_Plugin_LineNumbers() {
         st.setAttribute("data-css", text);
         st.appendChild(doc.createTextNode(text));
         (doc.head || doc.getElementsByTagName("head")[0] || doc.documentElement).appendChild(st);
+        // A <style> ELEMENT is governed by style-src: under a strict policy the browser
+        // drops its rules, leaving this plugin's UI unstyled. The element above stays
+        // the path everyone else takes; this re-injects through the CSSOM only when
+        // the policy actually emptied it.
+        if (editor && typeof editor.ensureStyleSheetLive === "function") {
+            editor.ensureStyleSheetLive(doc, st, "rte-linenumber-styles", st.textContent);
+        }
     }
 }
 
@@ -33316,6 +33455,13 @@ function RTE_Plugin_LinkChecker() {
         st.setAttribute("data-css", text);
         st.appendChild(doc.createTextNode(text));
         (doc.head || doc.getElementsByTagName("head")[0] || doc.documentElement).appendChild(st);
+        // A <style> ELEMENT is governed by style-src: under a strict policy the browser
+        // drops its rules, leaving this plugin's UI unstyled. The element above stays
+        // the path everyone else takes; this re-injects through the CSSOM only when
+        // the policy actually emptied it.
+        if (editor && typeof editor.ensureStyleSheetLive === "function") {
+            editor.ensureStyleSheetLive(doc, st, "rte-link-checker-styles", st.textContent);
+        }
     }
 }
 
@@ -34319,6 +34465,13 @@ function RTE_Plugin_Mention() {
             ".rte-mention:hover{background:#e4edff}"
         ].join("\n");
         host.head.appendChild(style);
+        // A <style> ELEMENT is governed by style-src: under a strict policy the browser
+        // drops its rules, leaving this plugin's UI unstyled. The element above stays
+        // the path everyone else takes; this re-injects through the CSSOM only when
+        // the policy actually emptied it.
+        if (editor && typeof editor.ensureStyleSheetLive === "function") {
+            editor.ensureStyleSheetLive(host, style, "rte-mentionplugin-style", style.textContent);
+        }
 
         // Also inject mention-span styles inside the iframe so the pill looks right while editing.
         var editdoc = editor.getDocument();
@@ -34330,6 +34483,13 @@ function RTE_Plugin_Mention() {
                 ".rte-mention:hover{background:#e4edff}"
             ].join("\n");
             editdoc.head.appendChild(iStyle);
+            // A <style> ELEMENT is governed by style-src: under a strict policy the browser
+            // drops its rules, leaving this plugin's UI unstyled. The element above stays
+            // the path everyone else takes; this re-injects through the CSSOM only when
+            // the policy actually emptied it.
+            if (editor && typeof editor.ensureStyleSheetLive === "function") {
+                editor.ensureStyleSheetLive(editdoc, iStyle, "rte-mentionplugin-iStyle", iStyle.textContent);
+            }
         }
     }
 }
@@ -34660,6 +34820,13 @@ function RTE_Plugin_MergeFields() {
         st.setAttribute("data-css", text);
         st.appendChild(doc.createTextNode(text));
         (doc.head || doc.getElementsByTagName("head")[0] || doc.documentElement).appendChild(st);
+        // A <style> ELEMENT is governed by style-src: under a strict policy the browser
+        // drops its rules, leaving this plugin's UI unstyled. The element above stays
+        // the path everyone else takes; this re-injects through the CSSOM only when
+        // the policy actually emptied it.
+        if (editor && typeof editor.ensureStyleSheetLive === "function") {
+            editor.ensureStyleSheetLive(doc, st, "rte-merge-field-styles", st.textContent);
+        }
     }
 }
 
@@ -34793,6 +34960,13 @@ function RTE_Plugin_MermaidDiagram() {
         style.id = "rte-mermaid-styles";
         style.appendChild(doc.createTextNode(css));
         (doc.head || doc.getElementsByTagName("head")[0] || doc.documentElement).appendChild(style);
+        // A <style> ELEMENT is governed by style-src: under a strict policy the browser
+        // drops its rules, leaving this plugin's UI unstyled. The element above stays
+        // the path everyone else takes; this re-injects through the CSSOM only when
+        // the policy actually emptied it.
+        if (editor && typeof editor.ensureStyleSheetLive === "function") {
+            editor.ensureStyleSheetLive(doc, style, "rte-mermaid-styles", style.textContent);
+        }
     }
 
     function getMermaid(win) {
@@ -35093,6 +35267,13 @@ function RTE_Plugin_MultiLevelList() {
         st.setAttribute("data-css", text);
         st.appendChild(doc.createTextNode(text));
         (doc.head || doc.getElementsByTagName("head")[0] || doc.documentElement).appendChild(st);
+        // A <style> ELEMENT is governed by style-src: under a strict policy the browser
+        // drops its rules, leaving this plugin's UI unstyled. The element above stays
+        // the path everyone else takes; this re-injects through the CSSOM only when
+        // the policy actually emptied it.
+        if (editor && typeof editor.ensureStyleSheetLive === "function") {
+            editor.ensureStyleSheetLive(doc, st, "rte-legal-list-styles", st.textContent);
+        }
     }
 }
 
@@ -36266,6 +36447,13 @@ function RTE_Plugin_Pagination() {
         st.id = "rte-pagination-styles";
         st.appendChild(doc.createTextNode(css));
         (doc.head || doc.getElementsByTagName("head")[0] || doc.documentElement).appendChild(st);
+        // A <style> ELEMENT is governed by style-src: under a strict policy the browser
+        // drops its rules, leaving this plugin's UI unstyled. The element above stays
+        // the path everyone else takes; this re-injects through the CSSOM only when
+        // the policy actually emptied it.
+        if (editor && typeof editor.ensureStyleSheetLive === "function") {
+            editor.ensureStyleSheetLive(doc, st, "rte-pagination-styles", st.textContent);
+        }
     }
 
     // ---- serialization guard --------------------------------------------
@@ -38165,6 +38353,13 @@ function RTE_Plugin_RestrictedEditing() {
             "body.rte-restricted [" + editableAttr + "='true']{background:rgba(34,197,94,.16)}"
         ].join("\n");
         (doc.head || doc.getElementsByTagName("head")[0]).appendChild(s);
+        // A <style> ELEMENT is governed by style-src: under a strict policy the browser
+        // drops its rules, leaving this plugin's UI unstyled. The element above stays
+        // the path everyone else takes; this re-injects through the CSSOM only when
+        // the policy actually emptied it.
+        if (editor && typeof editor.ensureStyleSheetLive === "function") {
+            editor.ensureStyleSheetLive(doc, s, "__rte_restrictedediting_styles", s.textContent);
+        }
     }
 
     function enable() {
@@ -38975,6 +39170,13 @@ function RTE_Plugin_RevisionHistory() {
             ".rte-rev-dark .rte-rev-diff-del{background:rgba(244,63,94,.16);color:#fda4af}"
         ].join("\n");
         host.head.appendChild(style);
+        // A <style> ELEMENT is governed by style-src: under a strict policy the browser
+        // drops its rules, leaving this plugin's UI unstyled. The element above stays
+        // the path everyone else takes; this re-injects through the CSSOM only when
+        // the policy actually emptied it.
+        if (editor && typeof editor.ensureStyleSheetLive === "function") {
+            editor.ensureStyleSheetLive(host, style, "rte-revisionhistory-style", style.textContent);
+        }
     }
 }
 
@@ -39126,6 +39328,13 @@ function RTE_Plugin_RtlUi() {
         st.id = "rte-rtl-ui-styles";
         st.appendChild(doc.createTextNode(css()));
         (doc.head || doc.documentElement).appendChild(st);
+        // A <style> ELEMENT is governed by style-src: under a strict policy the browser
+        // drops its rules, leaving this plugin's UI unstyled. The element above stays
+        // the path everyone else takes; this re-injects through the CSSOM only when
+        // the policy actually emptied it.
+        if (editor && typeof editor.ensureStyleSheetLive === "function") {
+            editor.ensureStyleSheetLive(doc, st, "rte-rtl-ui-styles", st.textContent);
+        }
     }
 }
 
@@ -39231,6 +39440,12 @@ function RTE_Plugin_RubyAnnotation() {
             "@supports (display:ruby){.rte-ruby-annotated>rp{display:none;}}"
         ].join("");
         hostDoc.head.appendChild(style);
+        // A <style> element's rules are dropped under a strict style-src; this
+        // re-injects them through the CSSOM in that case only. Missed in 2.9.0,
+        // found by auditing the FULL bundle rather than a sample of plugins.
+        if (editor && typeof editor.ensureStyleSheetLive === "function") {
+            editor.ensureStyleSheetLive(hostDoc, style, "rte-ruby-style", style.textContent);
+        }
     }
 
     function editableRoot() {
@@ -41137,6 +41352,13 @@ function RTE_Plugin_SlashCommand() {
             ".rte-slash-popup-dark .rte-slash-empty{color:#94a3b8}"
         ].join("\n");
         host.head.appendChild(style);
+        // A <style> ELEMENT is governed by style-src: under a strict policy the browser
+        // drops its rules, leaving this plugin's UI unstyled. The element above stays
+        // the path everyone else takes; this re-injects through the CSSOM only when
+        // the policy actually emptied it.
+        if (editor && typeof editor.ensureStyleSheetLive === "function") {
+            editor.ensureStyleSheetLive(host, style, "rte-slashcommand-style", style.textContent);
+        }
     }
 
     // --- Icons (minimal inline SVGs) ---
@@ -41441,6 +41663,13 @@ function RTE_Plugin_SmartChips() {
                 st.setAttribute("data-rte-smartchips", "1");
                 st.textContent = css;
                 head.appendChild(st);
+                // A <style> ELEMENT is governed by style-src: under a strict policy the browser
+                // drops its rules, leaving this plugin's UI unstyled. The element above stays
+                // the path everyone else takes; this re-injects through the CSSOM only when
+                // the policy actually emptied it.
+                if (editor && typeof editor.ensureStyleSheetLive === "function") {
+                    editor.ensureStyleSheetLive(editdoc, st, "rte-smartchips-st", st.textContent);
+                }
             }
         } catch (e) { /* ignore */ }
     }
@@ -41626,6 +41855,13 @@ function RTE_Plugin_SpellCheck() {
                 st.setAttribute("data-rte-spellcheck", "1");
                 st.textContent = css;
                 (host.head || host.documentElement).appendChild(st);
+                // A <style> ELEMENT is governed by style-src: under a strict policy the browser
+                // drops its rules, leaving this plugin's UI unstyled. The element above stays
+                // the path everyone else takes; this re-injects through the CSSOM only when
+                // the policy actually emptied it.
+                if (editor && typeof editor.ensureStyleSheetLive === "function") {
+                    editor.ensureStyleSheetLive(host, st, "rte-spellcheck-st", st.textContent);
+                }
             }
         } catch (e) { /* ignore */ }
     }
@@ -42185,6 +42421,12 @@ function RTE_Plugin_StateInspector() {
             "@media (max-width: 1100px){.rte-state-inspector-shell{display:block;}.rte-state-inspector-panel{margin-top:12px;max-width:none;width:100%;}.rte-state-inspector-body{max-height:340px;}}"
         ].join("");
         hostDoc.head.appendChild(style);
+        // A <style> element's rules are dropped under a strict style-src; this
+        // re-injects them through the CSSOM in that case only. Missed in 2.9.0,
+        // found by auditing the FULL bundle rather than a sample of plugins.
+        if (editor && typeof editor.ensureStyleSheetLive === "function") {
+            editor.ensureStyleSheetLive(hostDoc, style, "rte-state-inspector-style", style.textContent);
+        }
     }
 
     function ensureShell() {
@@ -42849,6 +43091,13 @@ function RTE_Plugin_TableOfContents() {
         st.setAttribute("data-css", text);
         st.appendChild(doc.createTextNode(text));
         (doc.head || doc.getElementsByTagName("head")[0] || doc.documentElement).appendChild(st);
+        // A <style> ELEMENT is governed by style-src: under a strict policy the browser
+        // drops its rules, leaving this plugin's UI unstyled. The element above stays
+        // the path everyone else takes; this re-injects through the CSSOM only when
+        // the policy actually emptied it.
+        if (editor && typeof editor.ensureStyleSheetLive === "function") {
+            editor.ensureStyleSheetLive(doc, st, "rte-toc-styles", st.textContent);
+        }
     }
 }
 
@@ -43506,6 +43755,13 @@ function RTE_Plugin_TextDirection() {
         st.setAttribute("data-css", text);
         st.appendChild(doc.createTextNode(text));
         (doc.head || doc.getElementsByTagName("head")[0] || doc.documentElement).appendChild(st);
+        // A <style> ELEMENT is governed by style-src: under a strict policy the browser
+        // drops its rules, leaving this plugin's UI unstyled. The element above stays
+        // the path everyone else takes; this re-injects through the CSSOM only when
+        // the policy actually emptied it.
+        if (editor && typeof editor.ensureStyleSheetLive === "function") {
+            editor.ensureStyleSheetLive(doc, st, "rte-textdirection-styles", st.textContent);
+        }
     }
 }
 
@@ -44011,6 +44267,13 @@ function RTE_Plugin_TextPartLanguage() {
         st.setAttribute("data-css", text);
         st.appendChild(doc.createTextNode(text));
         (doc.head || doc.getElementsByTagName("head")[0] || doc.documentElement).appendChild(st);
+        // A <style> ELEMENT is governed by style-src: under a strict policy the browser
+        // drops its rules, leaving this plugin's UI unstyled. The element above stays
+        // the path everyone else takes; this re-injects through the CSSOM only when
+        // the policy actually emptied it.
+        if (editor && typeof editor.ensureStyleSheetLive === "function") {
+            editor.ensureStyleSheetLive(doc, st, "rte-textpartlanguage-styles", st.textContent);
+        }
     }
 }
 
@@ -44099,6 +44362,13 @@ function RTE_Plugin_TodoList() {
         st.id = "rte-todolist-styles";
         st.appendChild(doc.createTextNode(css));
         (doc.head || doc.getElementsByTagName("head")[0] || doc.documentElement).appendChild(st);
+        // A <style> ELEMENT is governed by style-src: under a strict policy the browser
+        // drops its rules, leaving this plugin's UI unstyled. The element above stays
+        // the path everyone else takes; this re-injects through the CSSOM only when
+        // the policy actually emptied it.
+        if (editor && typeof editor.ensureStyleSheetLive === "function") {
+            editor.ensureStyleSheetLive(doc, st, "rte-todolist-styles", st.textContent);
+        }
     }
 
     function makeCheckbox() {
@@ -44152,722 +44422,736 @@ function RTE_Plugin_TodoList() {
     };
 }
 
-if (!window.RTE_DefaultConfig) window.RTE_DefaultConfig = {};
-
-if (!RTE_DefaultConfig.svgCode_trackchanges) {
-    RTE_DefaultConfig.svgCode_trackchanges = '<svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.9" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M4 17l4-1 10-10-3-3L5 13l-1 4z"/><path d="M14 4l3 3"/><path d="M4 21h10"/></svg>';
-}
-
-RTE_DefaultConfig.plugin_trackedchanges = RTE_Plugin_TrackedChanges;
-
-function RTE_Plugin_TrackedChanges() {
-    var obj = this;
-    var config;
-    var editor;
-    var enabled = false;
-
-    obj.PluginName = "TrackedChanges";
-
-    obj.InitConfig = function (argconfig) {
-        config = argconfig;
-        if (config.trackChangesEnabled === false) return;
-
-        config.currentUser = config.currentUser || null;
-        config.trackChangesInsertClass = config.trackChangesInsertClass || "rte-tc rte-tc-insert";
-        config.trackChangesDeleteClass = config.trackChangesDeleteClass || "rte-tc rte-tc-delete";
-        // Optional application policy for accept/reject. Return false to keep a
-        // suggestion pending. The default remains permissive for compatibility.
-        config.reviewCanDecide = config.reviewCanDecide || null;
-        config.onReviewDecisionDenied = config.onReviewDecisionDenied || null;
-
-        // Toolbar command — only surfaces if the editor page adds it to a toolbar slot.
-        config.text_trackchanges = config.text_trackchanges || "Suggesting mode";
-        appendToolbarCommand("toolbar_default", "#{trackchanges}");
-        appendToolbarCommand("toolbar_full", "#{trackchanges}");
-        appendToolbarCommand("toolbar_mobile", "#{trackchanges}");
-
-        if ((config.controltoolbar_TEXT || "").indexOf("trackchanges") === -1) {
-            config.controltoolbar_TEXT = (config.controltoolbar_TEXT || "") + "|{trackchanges}";
-        }
-    };
-
-    obj.InitEditor = function (argeditor) {
-        editor = argeditor;
-        if (config.trackChangesEnabled === false) return;
-
-        editor.trackedChanges = {
-            enable: function (user) { enable(user); },
-            disable: function () { disable(); },
-            isEnabled: function () { return enabled; },
-            acceptAll: function (filter) { return acceptAll(filter); },
-            rejectAll: function (filter) { return rejectAll(filter); },
-            accept: function (id) { return acceptEntry(id); },
-            reject: function (id) { return rejectEntry(id); },
-            canDecide: function (id, action) {
-                var entry = editor.reviewLedger && editor.reviewLedger.get(id);
-                return !!entry && canDecide(entry, action || "accept");
-            },
-            list: function (opts) {
-                if (!editor.reviewLedger) return [];
-                // Default to the PENDING review queue (matches the internal
-                // accept/reject semantics). Pass {all:true} for full history
-                // including accepted/rejected entries (also via reviewLedger.list()).
-                var includeAll = opts && opts.all === true;
-                return editor.reviewLedger.list().filter(function (e) {
-                    if (e.changeType !== "insert" && e.changeType !== "delete") return false;
-                    return includeAll || e.status === "pending";
-                });
-            }
-        };
-
-        injectStyles();
-
-        editor.toolbarFactoryMap = editor.toolbarFactoryMap || {};
-        editor.toolbarFactoryMap["trackchanges"] = function (cmd) {
-            var btn = editor.createToolbarButton(cmd);
-            btn.__tcSync = function () {
-                if (enabled) btn.classList.add("rte-ui-active");
-                else btn.classList.remove("rte-ui-active");
-                btn.setAttribute("aria-pressed", enabled ? "true" : "false");
-                // WCAG 2.5.3 Label in Name: the visible label (this tooltip) must be
-                // contained in the accessible name. "Turn on suggesting mode" was not
-                // — the accessible name is "Suggesting mode" — so a speech-input user
-                // saying what they see did not match the control. State belongs in
-                // aria-pressed and the active styling, not in the visible label.
-                btn.setAttribute("title", config.text_trackchanges || "Suggesting mode");
-            };
-            btn.__tcSync();
-            return btn;
-        };
-
-        editor.attachEvent("exec_command_trackchanges", function (state) {
-            state.returnValue = true;
-            state.stopBubble = true;
-            if (enabled) disable();
-            else enable();
-        });
-
-        editor.getEditable().addEventListener("beforeinput", onBeforeInput, true);
-    };
-
-    function appendToolbarCommand(toolbar, item) {
-        if (!config[toolbar]) return;
-        if (config[toolbar].indexOf(item) !== -1) return;
-        config[toolbar] = config[toolbar] + item;
-    }
-
-    function enable(user) {
-        if (user) config.currentUser = user;
-        if (!config.currentUser) {
-            config.currentUser = { id: "user", name: "User", color: "#2563eb" };
-            console.warn("trackedchanges: no config.currentUser configured; defaulting to generic user.");
-        }
-        enabled = true;
-        syncToolbarButtons();
-    }
-
-    function disable() {
-        enabled = false;
-        syncToolbarButtons();
-    }
-
-    function syncToolbarButtons() {
-        var doc = editor.iframe && editor.iframe.ownerDocument || document;
-        var btns = doc.querySelectorAll(".rte_command_trackchanges");
-        for (var i = 0; i < btns.length; i++) {
-            if (btns[i].__tcSync) btns[i].__tcSync();
-        }
-    }
-
-    // --- beforeinput intercept ---
-
-    function onBeforeInput(e) {
-        if (!enabled) return;
-        if (!editor.reviewLedger) return; // No ledger => AI toolkit not loaded; do nothing.
-
-        var type = e.inputType;
-        if (!type) return;
-
-        if (type === "insertText" || type === "insertReplacementText") {
-            e.preventDefault();
-            handleInsertText(e.data || "");
-            return;
-        }
-        if (type === "deleteContentBackward" || type === "deleteContentForward" || type === "deleteByCut") {
-            e.preventDefault();
-            handleDelete(type);
-            return;
-        }
-        // insertParagraph, insertCompositionText, insertFromPaste, historyUndo/Redo: pass through for v1.
-    }
-
-    // --- insert tracking ---
-
-    function handleInsertText(text) {
-        if (!text) return;
-        var sel = editor.getSelection();
-        if (!sel || sel.rangeCount === 0) return;
-        var range = sel.getRangeAt(0);
-        if (!range.collapsed) {
-            // Selection replace: wrap selection as delete, then insert new text.
-            if (!wrapRangeAsDelete(range)) return;
-            // After wrapping, caret should be past the delete span; re-fetch selection.
-            range = sel.getRangeAt(0);
-            createInsertSpan(text, range);
-            return;
-        }
-
-        var mergeTarget = adjacentInsertSpan(range);
-        if (mergeTarget) {
-            appendToInsertSpan(mergeTarget, text);
-        } else {
-            createInsertSpan(text, range);
-        }
-    }
-
-    function adjacentInsertSpan(range) {
-        // If caret sits inside an insert span by the current user, or immediately after one, merge.
-        var node = range.startContainer;
-        if (node.nodeType === 3 && node.parentNode && isMyInsert(node.parentNode)) {
-            return node.parentNode;
-        }
-        // Caret just after an insert span (at an element boundary).
-        if (node.nodeType === 1 && range.startOffset > 0) {
-            var prev = node.childNodes[range.startOffset - 1];
-            if (prev && prev.nodeType === 1 && isMyInsert(prev)) return prev;
-        }
-        // Caret at the very beginning just before our span.
-        if (node.nodeType === 3 && node.previousSibling && isMyInsert(node.previousSibling) && range.startOffset === 0) {
-            return node.previousSibling;
-        }
-        return null;
-    }
-
-    function isMyInsert(el) {
-        if (!el || el.nodeType !== 1) return false;
-        if (!el.classList || !el.classList.contains("rte-tc-insert")) return false;
-        return el.getAttribute("data-tc-author") === config.currentUser.id;
-    }
-
-    // We preventDefault() the browser's own text insertion, which means we also
-    // lose the whitespace handling it does for free. A plain second space is
-    // collapsed by HTML rendering, so pressing space a second time moved nothing
-    // on screen and suggesting mode looked like it had stopped accepting input.
-    // Reproduce what contenteditable does: any space followed by another space,
-    // and any trailing space, becomes a non-breaking space. Recomputed from
-    // scratch each time so an NBSP reverts to a normal space once real text
-    // follows it (keeping word wrap and copied text clean). Only typed text
-    // reaches this path -- paste arrives as insertFromPaste and is passed
-    // through -- so this never rewrites an NBSP the user inserted deliberately.
-    function normalizeInsertWhitespace(node) {
-        if (!node || node.nodeType !== 3) return;
-        var v = node.nodeValue;
-        if (v.indexOf(" ") === -1 && v.indexOf("\u00a0") === -1) return;
-        v = v.replace(/\u00a0/g, " ");
-        v = v.replace(/ (?= )/g, "\u00a0");
-        v = v.replace(/ $/, "\u00a0");
-        if (v !== node.nodeValue) node.nodeValue = v;
-    }
-
-    function appendToInsertSpan(span, text) {
-        var editdoc = editor.getDocument();
-        // Append to the span's last text node (or create one).
-        var last = span.lastChild;
-        var node;
-        if (last && last.nodeType === 3) {
-            last.nodeValue = last.nodeValue + text;
-            node = last;
-        } else {
-            node = editdoc.createTextNode(text);
-            span.appendChild(node);
-        }
-        normalizeInsertWhitespace(node);
-        placeCaretAtEnd(node);
-        updateEntryForSpan(span);
-    }
-
-    function createInsertSpan(text, range) {
-        var editdoc = editor.getDocument();
-        var span = editdoc.createElement("span");
-        span.className = config.trackChangesInsertClass;
-        var user = config.currentUser;
-        var id = "tc-" + Date.now() + "-" + Math.floor(Math.random() * 10000);
-        span.setAttribute("data-tc-id", id);
-        span.setAttribute("data-tc-author", user.id);
-        span.setAttribute("data-tc-at", new Date().toISOString());
-        span.style.color = user.color;
-        span.style.textDecoration = "underline";
-        span.appendChild(editdoc.createTextNode(text));
-        range.insertNode(span);
-        normalizeInsertWhitespace(span.firstChild);
-        placeCaretAtEnd(span.firstChild);
-
-        editor.reviewLedger.add({
-            id: id,
-            changeType: "insert",
-            author: user,
-            text: text,
-            status: "pending",
-            sourceLabel: "Suggested insert",
-            createdAt: Date.now()
-        });
-    }
-
-    function updateEntryForSpan(span) {
-        var id = span.getAttribute("data-tc-id");
-        if (!id) return;
-        editor.reviewLedger.update(id, { text: span.textContent });
-    }
-
-    // --- delete tracking ---
-
-    function handleDelete(mode) {
-        var sel = editor.getSelection();
-        if (!sel || sel.rangeCount === 0) return;
-        var range = sel.getRangeAt(0);
-
-        if (!range.collapsed) {
-            wrapRangeAsDelete(range);
-            return;
-        }
-
-        // Collapsed: extend by one char in the appropriate direction, then wrap.
-        // The extended range covers only that one character — any delete spans between
-        // it and the caret should be SKIPPED, not re-wrapped.
-        var extended = editor.getDocument().createRange();
-        if (mode === "deleteContentBackward") {
-            var anchor = prevCharPoint(range.startContainer, range.startOffset);
-            if (!anchor) return;
-            extended.setStart(anchor.node, anchor.offset);
-            extended.setEnd(anchor.node, anchor.offset + 1);
-        } else {
-            var forward = nextCharPoint(range.startContainer, range.startOffset);
-            if (!forward) return;
-            extended.setStart(forward.node, forward.offset - 1);
-            extended.setEnd(forward.node, forward.offset);
-        }
-
-        // If that extended range sits entirely inside one of the current user's own
-        // insert spans, treat this as undoing their own typing — actually delete.
-        if (rangeInsideMyInsert(extended)) {
-            extended.deleteContents();
-            var sel2 = editor.getSelection();
-            sel2.removeAllRanges();
-            sel2.addRange(extended);
-            // If the insert span is now empty, remove it and its ledger entry.
-            cleanupEmptyInsertSpans();
-            return;
-        }
-
-        wrapRangeAsDelete(extended);
-    }
-
-    function isInsideDeleteSpan(node) {
-        var walk = node.nodeType === 1 ? node : node.parentNode;
-        while (walk && walk !== editor.getEditable()) {
-            if (walk.classList && walk.classList.contains("rte-tc-delete")) return true;
-            walk = walk.parentNode;
-        }
-        return false;
-    }
-
-    // Walk text leaves in the editable, skipping any that live inside an existing delete
-    // span (those characters have already been visually "deleted" — we shouldn't re-wrap them).
-    function liveTextLeaves() {
-        var editable = editor.getEditable();
-        var walker = editor.getDocument().createTreeWalker(editable, NodeFilter.SHOW_TEXT, {
-            acceptNode: function (n) { return isInsideDeleteSpan(n) ? NodeFilter.FILTER_REJECT : NodeFilter.FILTER_ACCEPT; }
-        });
-        var out = [], n;
-        while ((n = walker.nextNode())) out.push(n);
-        return out;
-    }
-
-    function prevCharPoint(node, offset) {
-        var leaves = liveTextLeaves();
-        if (!leaves.length) return null;
-        var idx = caretIndex(node, offset, leaves);
-        if (idx <= 0) return null;
-        return leafOffsetAt(idx - 1, leaves);
-    }
-
-    function nextCharPoint(node, offset) {
-        var leaves = liveTextLeaves();
-        if (!leaves.length) return null;
-        var total = 0;
-        for (var i = 0; i < leaves.length; i++) total += leaves[i].nodeValue.length;
-        var idx = caretIndex(node, offset, leaves);
-        if (idx >= total) return null;
-        return leafOffsetAt(idx + 1, leaves);
-    }
-
-    // How many live characters appear before the given caret position?
-    function caretIndex(node, offset, leaves) {
-        var r = editor.getDocument().createRange();
-        r.setStart(node, offset);
-        r.collapse(true);
-        var count = 0;
-        for (var i = 0; i < leaves.length; i++) {
-            var leaf = leaves[i];
-            // If the entire leaf is before the caret, add its length.
-            var cmpEnd = r.comparePoint(leaf, leaf.nodeValue.length);
-            if (cmpEnd <= 0) { count += leaf.nodeValue.length; continue; }
-            var cmpStart = r.comparePoint(leaf, 0);
-            if (cmpStart >= 0) break; // leaf starts at or after caret
-            // Caret falls inside this leaf — binary search the split point.
-            var lo = 0, hi = leaf.nodeValue.length;
-            while (lo < hi) {
-                var mid = (lo + hi) >> 1;
-                if (r.comparePoint(leaf, mid) < 0) lo = mid + 1;
-                else hi = mid;
-            }
-            count += lo;
-            break;
-        }
-        return count;
-    }
-
-    function leafOffsetAt(index, leaves) {
-        var remaining = index;
-        for (var i = 0; i < leaves.length; i++) {
-            if (remaining <= leaves[i].nodeValue.length) return { node: leaves[i], offset: remaining };
-            remaining -= leaves[i].nodeValue.length;
-        }
-        return null;
-    }
-
-    function firstTextLeaf(node) {
-        if (!node) return null;
-        if (node.nodeType === 3) return node;
-        var walker = editor.getDocument().createTreeWalker(node, NodeFilter.SHOW_TEXT);
-        return walker.nextNode();
-    }
-
-    function lastTextLeaf(node) {
-        if (!node) return null;
-        if (node.nodeType === 3) return node;
-        var walker = editor.getDocument().createTreeWalker(node, NodeFilter.SHOW_TEXT);
-        var last = null, n;
-        while ((n = walker.nextNode())) last = n;
-        return last;
-    }
-
-    function previousTextLeaf(node) {
-        var editable = editor.getEditable();
-        var walker = editor.getDocument().createTreeWalker(editable, NodeFilter.SHOW_TEXT);
-        var prev = null, cur;
-        while ((cur = walker.nextNode())) {
-            if (cur === node) return prev;
-            prev = cur;
-        }
-        return null;
-    }
-
-    function nextTextLeaf(node) {
-        var editable = editor.getEditable();
-        var walker = editor.getDocument().createTreeWalker(editable, NodeFilter.SHOW_TEXT);
-        var seen = false, cur;
-        while ((cur = walker.nextNode())) {
-            if (seen) return cur;
-            if (cur === node) seen = true;
-        }
-        return null;
-    }
-
-    function rangeInsideMyInsert(range) {
-        var span = range.startContainer.parentNode;
-        while (span && span !== editor.getEditable()) {
-            if (isMyInsert(span)) return range.endContainer.parentNode === span || span.contains(range.endContainer);
-            span = span.parentNode;
-        }
-        return false;
-    }
-
-    function wrapRangeAsDelete(range) {
-        if (range.collapsed) return false;
-        var editdoc = editor.getDocument();
-
-        var fragment = range.cloneContents();
-        if (!fragmentHasText(fragment)) return false;
-
-        // Find existing same-author delete spans adjacent to the range so we can merge
-        // sequential backspaces / forward deletes into one contiguous span.
-        var user = config.currentUser;
-        var mergeBefore = adjacentDeleteSpan(range, "before", user);
-        var mergeAfter = adjacentDeleteSpan(range, "after", user);
-
-        range.deleteContents();
-
-        if (mergeBefore) {
-            // Append the fragment's content to the existing "before" span.
-            appendFragmentToSpan(mergeBefore, fragment);
-            if (mergeAfter && mergeAfter !== mergeBefore) {
-                // Collapse both sides: move "after" span's children into "before" and drop it.
-                while (mergeAfter.firstChild) mergeBefore.appendChild(mergeAfter.firstChild);
-                var afterId = mergeAfter.getAttribute("data-tc-id");
-                mergeAfter.remove();
-                if (afterId && editor.reviewLedger) editor.reviewLedger.remove(afterId);
-            }
-            var rangeAfter = editdoc.createRange();
-            rangeAfter.setStartAfter(mergeBefore);
-            rangeAfter.collapse(true);
-            var sel = editor.getSelection();
-            sel.removeAllRanges();
-            sel.addRange(rangeAfter);
-            // 2026-05-28 Defense: if a customer pasted a delete-class span from
-            // outside this plugin, it may lack data-tc-id. Skip the ledger
-            // update instead of writing under a `null` key (would silently
-            // corrupt the ledger via the update("null", ...) coercion).
-            var beforeId = mergeBefore.getAttribute("data-tc-id");
-            if (beforeId && editor.reviewLedger) {
-                editor.reviewLedger.update(beforeId, { text: mergeBefore.textContent });
-            }
-            return true;
-        }
-
-        if (mergeAfter) {
-            prependFragmentToSpan(mergeAfter, fragment);
-            var rangeBefore = editdoc.createRange();
-            rangeBefore.setStartBefore(mergeAfter);
-            rangeBefore.collapse(true);
-            var sel2 = editor.getSelection();
-            sel2.removeAllRanges();
-            sel2.addRange(rangeBefore);
-            // Same defense as above (mergeAfter may lack data-tc-id).
-            var afterMergeId = mergeAfter.getAttribute("data-tc-id");
-            if (afterMergeId && editor.reviewLedger) {
-                editor.reviewLedger.update(afterMergeId, { text: mergeAfter.textContent });
-            }
-            return true;
-        }
-
-        var span = editdoc.createElement("span");
-        span.className = config.trackChangesDeleteClass;
-        var id = "tc-" + Date.now() + "-" + Math.floor(Math.random() * 10000);
-        span.setAttribute("data-tc-id", id);
-        span.setAttribute("data-tc-author", user.id);
-        span.setAttribute("data-tc-at", new Date().toISOString());
-        span.style.color = user.color;
-        span.style.textDecoration = "line-through";
-        span.appendChild(fragment);
-        range.insertNode(span);
-
-        var after = editdoc.createRange();
-        after.setStartAfter(span);
-        after.collapse(true);
-        var sel3 = editor.getSelection();
-        sel3.removeAllRanges();
-        sel3.addRange(after);
-
-        editor.reviewLedger.add({
-            id: id,
-            changeType: "delete",
-            author: user,
-            text: span.textContent,
-            originalHtml: span.innerHTML,
-            status: "pending",
-            sourceLabel: "Suggested delete",
-            createdAt: Date.now()
-        });
-        return true;
-    }
-
-    function adjacentDeleteSpan(range, side, user) {
-        // Find element immediately before or after the range boundaries at the container level.
-        var node = side === "before" ? range.startContainer : range.endContainer;
-        var offset = side === "before" ? range.startOffset : range.endOffset;
-        if (node.nodeType === 3) {
-            // Look at the sibling of the text node if we're at the text node's boundary.
-            if (side === "before" && offset === 0) {
-                var prev = node.previousSibling;
-                if (prev && isDeleteSpanByAuthor(prev, user)) return prev;
-            }
-            if (side === "after" && offset === node.nodeValue.length) {
-                var next = node.nextSibling;
-                if (next && isDeleteSpanByAuthor(next, user)) return next;
-            }
-            return null;
-        }
-        // Element container: look at children on either side of the offset.
-        if (side === "before" && offset > 0) {
-            var childBefore = node.childNodes[offset - 1];
-            if (childBefore && isDeleteSpanByAuthor(childBefore, user)) return childBefore;
-        }
-        if (side === "after" && offset < node.childNodes.length) {
-            var childAfter = node.childNodes[offset];
-            if (childAfter && isDeleteSpanByAuthor(childAfter, user)) return childAfter;
-        }
-        return null;
-    }
-
-    function isDeleteSpanByAuthor(el, user) {
-        if (!el || el.nodeType !== 1) return false;
-        if (!el.classList || !el.classList.contains("rte-tc-delete")) return false;
-        return el.getAttribute("data-tc-author") === user.id;
-    }
-
-    function appendFragmentToSpan(span, fragment) {
-        while (fragment.firstChild) span.appendChild(fragment.firstChild);
-    }
-
-    function prependFragmentToSpan(span, fragment) {
-        var first = span.firstChild;
-        while (fragment.firstChild) span.insertBefore(fragment.firstChild, first);
-    }
-
-    function fragmentHasText(fragment) {
-        var t = (fragment.textContent || "").replace(/\s+/g, "");
-        return !!t;
-    }
-
-    function cleanupEmptyInsertSpans() {
-        var spans = editor.getEditable().querySelectorAll("." + "rte-tc-insert");
-        for (var i = 0; i < spans.length; i++) {
-            var s = spans[i];
-            if (!s.textContent || !s.textContent.length) {
-                var id = s.getAttribute("data-tc-id");
-                if (id && editor.reviewLedger) editor.reviewLedger.remove(id);
-                s.remove();
-            } else {
-                updateEntryForSpan(s);
-            }
-        }
-    }
-
-    function placeCaretAtEnd(node) {
-        if (!node) return;
-        var editdoc = editor.getDocument();
-        var range = editdoc.createRange();
-        if (node.nodeType === 3) {
-            range.setStart(node, node.nodeValue.length);
-        } else {
-            range.setStart(node, node.childNodes.length);
-        }
-        range.collapse(true);
-        var sel = editor.getSelection();
-        sel.removeAllRanges();
-        sel.addRange(range);
-    }
-
-    // --- accept / reject ---
-
-    function decisionUser() {
-        return config.currentUser || { id: "user", name: "User", color: "#2563eb" };
-    }
-
-    function canDecide(entry, action) {
-        if (typeof config.reviewCanDecide !== "function") return true;
-        var allowed = false;
-        var user = decisionUser();
-        try { allowed = config.reviewCanDecide(entry, action, user, editor) !== false; }
-        catch (err) {
-            console.warn("trackedchanges: reviewCanDecide threw; denying decision.", err);
-        }
-        if (allowed) return true;
-        var detail = { entry: entry, action: action, user: user };
-        try { typeof config.onReviewDecisionDenied === "function" && config.onReviewDecisionDenied(detail); } catch (ignore) { }
-        try { typeof editor.fireEvent === "function" && editor.fireEvent("review_decision_denied", detail); } catch (ignore2) { }
-        return false;
-    }
-
-    function acceptEntry(id) {
-        var entry = editor.reviewLedger.get(id);
-        if (!entry) return false;
-        if (!canDecide(entry, "accept")) return false;
-        var span = editor.getEditable().querySelector('[data-tc-id="' + cssEscape(id) + '"]');
-        if (entry.changeType === "insert") {
-            if (span) unwrapKeepChildren(span);
-        } else if (entry.changeType === "delete") {
-            if (span) span.remove();
-        }
-        editor.reviewLedger.update(id, { status: "accepted", decidedAt: Date.now(), decidedBy: decisionUser() });
-        return true;
-    }
-
-    function rejectEntry(id) {
-        var entry = editor.reviewLedger.get(id);
-        if (!entry) return false;
-        if (!canDecide(entry, "reject")) return false;
-        var span = editor.getEditable().querySelector('[data-tc-id="' + cssEscape(id) + '"]');
-        if (entry.changeType === "insert") {
-            if (span) span.remove();
-        } else if (entry.changeType === "delete") {
-            if (span) unwrapKeepChildren(span);
-        }
-        editor.reviewLedger.update(id, { status: "rejected", decidedAt: Date.now(), decidedBy: decisionUser() });
-        return true;
-    }
-
-    function acceptAll(filter) {
-        var entries = editor.reviewLedger.list(filter).filter(function (e) {
-            return (e.changeType === "insert" || e.changeType === "delete") && e.status === "pending";
-        });
-        var accepted = 0;
-        for (var i = 0; i < entries.length; i++) if (acceptEntry(entries[i].id)) accepted++;
-        return accepted;
-    }
-
-    function rejectAll(filter) {
-        var entries = editor.reviewLedger.list(filter).filter(function (e) {
-            return (e.changeType === "insert" || e.changeType === "delete") && e.status === "pending";
-        });
-        var rejected = 0;
-        for (var i = 0; i < entries.length; i++) if (rejectEntry(entries[i].id)) rejected++;
-        return rejected;
-    }
-
-    function unwrapKeepChildren(el) {
-        var parent = el.parentNode;
-        if (!parent) return;
-        while (el.firstChild) parent.insertBefore(el.firstChild, el);
-        parent.removeChild(el);
-    }
-
-    // 2026-05-28 Prefer native CSS.escape — same hardening as comments.js.
-    // Defense-in-depth for customers who wire reviewLedger.add() with custom IDs
-    // containing punctuation (e.g. UUIDs with dashes, OAuth subject claims with
-    // colons, base64 IDs with `=` padding).
-    function cssEscape(s) {
-        var str = String(s);
-        if (typeof CSS !== "undefined" && typeof CSS.escape === "function") {
-            try { return CSS.escape(str); } catch (e) { /* fall through */ }
-        }
-        return str.replace(/["\\\]\[\(\)\{\}'#:;,<>=`~!@$%^&*+/?\s\x00-\x1F]/g, function (c) {
-            return "\\" + c;
-        });
-    }
-
-    // --- styles ---
-
-    function injectStyles() {
-        var host = (editor && editor.iframe && editor.iframe.ownerDocument) || document;
-        if (!host.querySelector("style[data-rte-trackchanges]")) {
-            var style = host.createElement("style");
-            style.setAttribute("data-rte-trackchanges", "1");
-            style.textContent = [
-                ".richtexteditor rte-toolbar-button.rte_command_trackchanges{position:relative;border-radius:8px;transition:background .14s ease,color .14s ease,box-shadow .14s ease}",
-                ".richtexteditor rte-toolbar-button.rte_command_trackchanges.rte-ui-active{background:linear-gradient(135deg,#e9f7ef,#eef5ff);color:#17633f;box-shadow:inset 0 0 0 1px rgba(34,132,82,.28),0 6px 14px rgba(34,132,82,.12)}",
-                ".richtexteditor rte-toolbar-button.rte_command_trackchanges.rte-ui-active:after{content:'';position:absolute;right:5px;top:5px;width:6px;height:6px;border-radius:50%;background:#22a66a;box-shadow:0 0 0 2px #fff}",
-                ".rte-tc{border-radius:4px;padding:0 2px;box-decoration-break:clone;-webkit-box-decoration-break:clone}",
-                ".rte-tc-insert{background:linear-gradient(180deg,rgba(232,248,239,.78),rgba(232,248,239,.38));color:#125b39;text-decoration:underline;text-decoration-color:#22a66a;text-decoration-thickness:2px;text-underline-offset:3px}",
-                ".rte-tc-delete{background:linear-gradient(180deg,rgba(255,240,240,.82),rgba(255,240,240,.42));color:#9f1d1d;text-decoration:line-through;text-decoration-color:#dc4c4c;text-decoration-thickness:2px;opacity:.92}"
-            ].join("\n");
-            host.head.appendChild(style);
-        }
-
-        var editdoc = editor.getDocument();
-        if (editdoc && editdoc.head && !editdoc.querySelector("style[data-rte-trackchanges-inline]")) {
-            var iStyle = editdoc.createElement("style");
-            iStyle.setAttribute("data-rte-trackchanges-inline", "1");
-            iStyle.textContent = [
-                ".rte-tc{border-radius:4px;padding:0 2px;box-decoration-break:clone;-webkit-box-decoration-break:clone}",
-                ".rte-tc-insert{background:linear-gradient(180deg,rgba(232,248,239,.78),rgba(232,248,239,.38));color:#125b39;text-decoration:underline;text-decoration-color:#22a66a;text-decoration-thickness:2px;text-underline-offset:3px}",
-                ".rte-tc-delete{background:linear-gradient(180deg,rgba(255,240,240,.82),rgba(255,240,240,.42));color:#9f1d1d;text-decoration:line-through;text-decoration-color:#dc4c4c;text-decoration-thickness:2px;opacity:.92}"
-            ].join("\n");
-            editdoc.head.appendChild(iStyle);
-        }
-    }
-}
+if (!window.RTE_DefaultConfig) window.RTE_DefaultConfig = {};
+
+if (!RTE_DefaultConfig.svgCode_trackchanges) {
+    RTE_DefaultConfig.svgCode_trackchanges = '<svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="1.9" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><path d="M4 17l4-1 10-10-3-3L5 13l-1 4z"/><path d="M14 4l3 3"/><path d="M4 21h10"/></svg>';
+}
+
+RTE_DefaultConfig.plugin_trackedchanges = RTE_Plugin_TrackedChanges;
+
+function RTE_Plugin_TrackedChanges() {
+    var obj = this;
+    var config;
+    var editor;
+    var enabled = false;
+
+    obj.PluginName = "TrackedChanges";
+
+    obj.InitConfig = function (argconfig) {
+        config = argconfig;
+        if (config.trackChangesEnabled === false) return;
+
+        config.currentUser = config.currentUser || null;
+        config.trackChangesInsertClass = config.trackChangesInsertClass || "rte-tc rte-tc-insert";
+        config.trackChangesDeleteClass = config.trackChangesDeleteClass || "rte-tc rte-tc-delete";
+        // Optional application policy for accept/reject. Return false to keep a
+        // suggestion pending. The default remains permissive for compatibility.
+        config.reviewCanDecide = config.reviewCanDecide || null;
+        config.onReviewDecisionDenied = config.onReviewDecisionDenied || null;
+
+        // Toolbar command — only surfaces if the editor page adds it to a toolbar slot.
+        config.text_trackchanges = config.text_trackchanges || "Suggesting mode";
+        appendToolbarCommand("toolbar_default", "#{trackchanges}");
+        appendToolbarCommand("toolbar_full", "#{trackchanges}");
+        appendToolbarCommand("toolbar_mobile", "#{trackchanges}");
+
+        if ((config.controltoolbar_TEXT || "").indexOf("trackchanges") === -1) {
+            config.controltoolbar_TEXT = (config.controltoolbar_TEXT || "") + "|{trackchanges}";
+        }
+    };
+
+    obj.InitEditor = function (argeditor) {
+        editor = argeditor;
+        if (config.trackChangesEnabled === false) return;
+
+        editor.trackedChanges = {
+            enable: function (user) { enable(user); },
+            disable: function () { disable(); },
+            isEnabled: function () { return enabled; },
+            acceptAll: function (filter) { return acceptAll(filter); },
+            rejectAll: function (filter) { return rejectAll(filter); },
+            accept: function (id) { return acceptEntry(id); },
+            reject: function (id) { return rejectEntry(id); },
+            canDecide: function (id, action) {
+                var entry = editor.reviewLedger && editor.reviewLedger.get(id);
+                return !!entry && canDecide(entry, action || "accept");
+            },
+            list: function (opts) {
+                if (!editor.reviewLedger) return [];
+                // Default to the PENDING review queue (matches the internal
+                // accept/reject semantics). Pass {all:true} for full history
+                // including accepted/rejected entries (also via reviewLedger.list()).
+                var includeAll = opts && opts.all === true;
+                return editor.reviewLedger.list().filter(function (e) {
+                    if (e.changeType !== "insert" && e.changeType !== "delete") return false;
+                    return includeAll || e.status === "pending";
+                });
+            }
+        };
+
+        injectStyles();
+
+        editor.toolbarFactoryMap = editor.toolbarFactoryMap || {};
+        editor.toolbarFactoryMap["trackchanges"] = function (cmd) {
+            var btn = editor.createToolbarButton(cmd);
+            btn.__tcSync = function () {
+                if (enabled) btn.classList.add("rte-ui-active");
+                else btn.classList.remove("rte-ui-active");
+                btn.setAttribute("aria-pressed", enabled ? "true" : "false");
+                // WCAG 2.5.3 Label in Name: the visible label (this tooltip) must be
+                // contained in the accessible name. "Turn on suggesting mode" was not
+                // — the accessible name is "Suggesting mode" — so a speech-input user
+                // saying what they see did not match the control. State belongs in
+                // aria-pressed and the active styling, not in the visible label.
+                btn.setAttribute("title", config.text_trackchanges || "Suggesting mode");
+            };
+            btn.__tcSync();
+            return btn;
+        };
+
+        editor.attachEvent("exec_command_trackchanges", function (state) {
+            state.returnValue = true;
+            state.stopBubble = true;
+            if (enabled) disable();
+            else enable();
+        });
+
+        editor.getEditable().addEventListener("beforeinput", onBeforeInput, true);
+    };
+
+    function appendToolbarCommand(toolbar, item) {
+        if (!config[toolbar]) return;
+        if (config[toolbar].indexOf(item) !== -1) return;
+        config[toolbar] = config[toolbar] + item;
+    }
+
+    function enable(user) {
+        if (user) config.currentUser = user;
+        if (!config.currentUser) {
+            config.currentUser = { id: "user", name: "User", color: "#2563eb" };
+            console.warn("trackedchanges: no config.currentUser configured; defaulting to generic user.");
+        }
+        enabled = true;
+        syncToolbarButtons();
+    }
+
+    function disable() {
+        enabled = false;
+        syncToolbarButtons();
+    }
+
+    function syncToolbarButtons() {
+        var doc = editor.iframe && editor.iframe.ownerDocument || document;
+        var btns = doc.querySelectorAll(".rte_command_trackchanges");
+        for (var i = 0; i < btns.length; i++) {
+            if (btns[i].__tcSync) btns[i].__tcSync();
+        }
+    }
+
+    // --- beforeinput intercept ---
+
+    function onBeforeInput(e) {
+        if (!enabled) return;
+        if (!editor.reviewLedger) return; // No ledger => AI toolkit not loaded; do nothing.
+
+        var type = e.inputType;
+        if (!type) return;
+
+        if (type === "insertText" || type === "insertReplacementText") {
+            e.preventDefault();
+            handleInsertText(e.data || "");
+            return;
+        }
+        if (type === "deleteContentBackward" || type === "deleteContentForward" || type === "deleteByCut") {
+            e.preventDefault();
+            handleDelete(type);
+            return;
+        }
+        // insertParagraph, insertCompositionText, insertFromPaste, historyUndo/Redo: pass through for v1.
+    }
+
+    // --- insert tracking ---
+
+    function handleInsertText(text) {
+        if (!text) return;
+        var sel = editor.getSelection();
+        if (!sel || sel.rangeCount === 0) return;
+        var range = sel.getRangeAt(0);
+        if (!range.collapsed) {
+            // Selection replace: wrap selection as delete, then insert new text.
+            if (!wrapRangeAsDelete(range)) return;
+            // After wrapping, caret should be past the delete span; re-fetch selection.
+            range = sel.getRangeAt(0);
+            createInsertSpan(text, range);
+            return;
+        }
+
+        var mergeTarget = adjacentInsertSpan(range);
+        if (mergeTarget) {
+            appendToInsertSpan(mergeTarget, text);
+        } else {
+            createInsertSpan(text, range);
+        }
+    }
+
+    function adjacentInsertSpan(range) {
+        // If caret sits inside an insert span by the current user, or immediately after one, merge.
+        var node = range.startContainer;
+        if (node.nodeType === 3 && node.parentNode && isMyInsert(node.parentNode)) {
+            return node.parentNode;
+        }
+        // Caret just after an insert span (at an element boundary).
+        if (node.nodeType === 1 && range.startOffset > 0) {
+            var prev = node.childNodes[range.startOffset - 1];
+            if (prev && prev.nodeType === 1 && isMyInsert(prev)) return prev;
+        }
+        // Caret at the very beginning just before our span.
+        if (node.nodeType === 3 && node.previousSibling && isMyInsert(node.previousSibling) && range.startOffset === 0) {
+            return node.previousSibling;
+        }
+        return null;
+    }
+
+    function isMyInsert(el) {
+        if (!el || el.nodeType !== 1) return false;
+        if (!el.classList || !el.classList.contains("rte-tc-insert")) return false;
+        return el.getAttribute("data-tc-author") === config.currentUser.id;
+    }
+
+    // We preventDefault() the browser's own text insertion, which means we also
+    // lose the whitespace handling it does for free. A plain second space is
+    // collapsed by HTML rendering, so pressing space a second time moved nothing
+    // on screen and suggesting mode looked like it had stopped accepting input.
+    // Reproduce what contenteditable does: any space followed by another space,
+    // and any trailing space, becomes a non-breaking space. Recomputed from
+    // scratch each time so an NBSP reverts to a normal space once real text
+    // follows it (keeping word wrap and copied text clean). Only typed text
+    // reaches this path -- paste arrives as insertFromPaste and is passed
+    // through -- so this never rewrites an NBSP the user inserted deliberately.
+    function normalizeInsertWhitespace(node) {
+        if (!node || node.nodeType !== 3) return;
+        var v = node.nodeValue;
+        if (v.indexOf(" ") === -1 && v.indexOf("\u00a0") === -1) return;
+        v = v.replace(/\u00a0/g, " ");
+        v = v.replace(/ (?= )/g, "\u00a0");
+        v = v.replace(/ $/, "\u00a0");
+        if (v !== node.nodeValue) node.nodeValue = v;
+    }
+
+    function appendToInsertSpan(span, text) {
+        var editdoc = editor.getDocument();
+        // Append to the span's last text node (or create one).
+        var last = span.lastChild;
+        var node;
+        if (last && last.nodeType === 3) {
+            last.nodeValue = last.nodeValue + text;
+            node = last;
+        } else {
+            node = editdoc.createTextNode(text);
+            span.appendChild(node);
+        }
+        normalizeInsertWhitespace(node);
+        placeCaretAtEnd(node);
+        updateEntryForSpan(span);
+    }
+
+    function createInsertSpan(text, range) {
+        var editdoc = editor.getDocument();
+        var span = editdoc.createElement("span");
+        span.className = config.trackChangesInsertClass;
+        var user = config.currentUser;
+        var id = "tc-" + Date.now() + "-" + Math.floor(Math.random() * 10000);
+        span.setAttribute("data-tc-id", id);
+        span.setAttribute("data-tc-author", user.id);
+        span.setAttribute("data-tc-at", new Date().toISOString());
+        span.style.color = user.color;
+        span.style.textDecoration = "underline";
+        span.appendChild(editdoc.createTextNode(text));
+        range.insertNode(span);
+        normalizeInsertWhitespace(span.firstChild);
+        placeCaretAtEnd(span.firstChild);
+
+        editor.reviewLedger.add({
+            id: id,
+            changeType: "insert",
+            author: user,
+            text: text,
+            status: "pending",
+            sourceLabel: "Suggested insert",
+            createdAt: Date.now()
+        });
+    }
+
+    function updateEntryForSpan(span) {
+        var id = span.getAttribute("data-tc-id");
+        if (!id) return;
+        editor.reviewLedger.update(id, { text: span.textContent });
+    }
+
+    // --- delete tracking ---
+
+    function handleDelete(mode) {
+        var sel = editor.getSelection();
+        if (!sel || sel.rangeCount === 0) return;
+        var range = sel.getRangeAt(0);
+
+        if (!range.collapsed) {
+            wrapRangeAsDelete(range);
+            return;
+        }
+
+        // Collapsed: extend by one char in the appropriate direction, then wrap.
+        // The extended range covers only that one character — any delete spans between
+        // it and the caret should be SKIPPED, not re-wrapped.
+        var extended = editor.getDocument().createRange();
+        if (mode === "deleteContentBackward") {
+            var anchor = prevCharPoint(range.startContainer, range.startOffset);
+            if (!anchor) return;
+            extended.setStart(anchor.node, anchor.offset);
+            extended.setEnd(anchor.node, anchor.offset + 1);
+        } else {
+            var forward = nextCharPoint(range.startContainer, range.startOffset);
+            if (!forward) return;
+            extended.setStart(forward.node, forward.offset - 1);
+            extended.setEnd(forward.node, forward.offset);
+        }
+
+        // If that extended range sits entirely inside one of the current user's own
+        // insert spans, treat this as undoing their own typing — actually delete.
+        if (rangeInsideMyInsert(extended)) {
+            extended.deleteContents();
+            var sel2 = editor.getSelection();
+            sel2.removeAllRanges();
+            sel2.addRange(extended);
+            // If the insert span is now empty, remove it and its ledger entry.
+            cleanupEmptyInsertSpans();
+            return;
+        }
+
+        wrapRangeAsDelete(extended);
+    }
+
+    function isInsideDeleteSpan(node) {
+        var walk = node.nodeType === 1 ? node : node.parentNode;
+        while (walk && walk !== editor.getEditable()) {
+            if (walk.classList && walk.classList.contains("rte-tc-delete")) return true;
+            walk = walk.parentNode;
+        }
+        return false;
+    }
+
+    // Walk text leaves in the editable, skipping any that live inside an existing delete
+    // span (those characters have already been visually "deleted" — we shouldn't re-wrap them).
+    function liveTextLeaves() {
+        var editable = editor.getEditable();
+        var walker = editor.getDocument().createTreeWalker(editable, NodeFilter.SHOW_TEXT, {
+            acceptNode: function (n) { return isInsideDeleteSpan(n) ? NodeFilter.FILTER_REJECT : NodeFilter.FILTER_ACCEPT; }
+        });
+        var out = [], n;
+        while ((n = walker.nextNode())) out.push(n);
+        return out;
+    }
+
+    function prevCharPoint(node, offset) {
+        var leaves = liveTextLeaves();
+        if (!leaves.length) return null;
+        var idx = caretIndex(node, offset, leaves);
+        if (idx <= 0) return null;
+        return leafOffsetAt(idx - 1, leaves);
+    }
+
+    function nextCharPoint(node, offset) {
+        var leaves = liveTextLeaves();
+        if (!leaves.length) return null;
+        var total = 0;
+        for (var i = 0; i < leaves.length; i++) total += leaves[i].nodeValue.length;
+        var idx = caretIndex(node, offset, leaves);
+        if (idx >= total) return null;
+        return leafOffsetAt(idx + 1, leaves);
+    }
+
+    // How many live characters appear before the given caret position?
+    function caretIndex(node, offset, leaves) {
+        var r = editor.getDocument().createRange();
+        r.setStart(node, offset);
+        r.collapse(true);
+        var count = 0;
+        for (var i = 0; i < leaves.length; i++) {
+            var leaf = leaves[i];
+            // If the entire leaf is before the caret, add its length.
+            var cmpEnd = r.comparePoint(leaf, leaf.nodeValue.length);
+            if (cmpEnd <= 0) { count += leaf.nodeValue.length; continue; }
+            var cmpStart = r.comparePoint(leaf, 0);
+            if (cmpStart >= 0) break; // leaf starts at or after caret
+            // Caret falls inside this leaf — binary search the split point.
+            var lo = 0, hi = leaf.nodeValue.length;
+            while (lo < hi) {
+                var mid = (lo + hi) >> 1;
+                if (r.comparePoint(leaf, mid) < 0) lo = mid + 1;
+                else hi = mid;
+            }
+            count += lo;
+            break;
+        }
+        return count;
+    }
+
+    function leafOffsetAt(index, leaves) {
+        var remaining = index;
+        for (var i = 0; i < leaves.length; i++) {
+            if (remaining <= leaves[i].nodeValue.length) return { node: leaves[i], offset: remaining };
+            remaining -= leaves[i].nodeValue.length;
+        }
+        return null;
+    }
+
+    function firstTextLeaf(node) {
+        if (!node) return null;
+        if (node.nodeType === 3) return node;
+        var walker = editor.getDocument().createTreeWalker(node, NodeFilter.SHOW_TEXT);
+        return walker.nextNode();
+    }
+
+    function lastTextLeaf(node) {
+        if (!node) return null;
+        if (node.nodeType === 3) return node;
+        var walker = editor.getDocument().createTreeWalker(node, NodeFilter.SHOW_TEXT);
+        var last = null, n;
+        while ((n = walker.nextNode())) last = n;
+        return last;
+    }
+
+    function previousTextLeaf(node) {
+        var editable = editor.getEditable();
+        var walker = editor.getDocument().createTreeWalker(editable, NodeFilter.SHOW_TEXT);
+        var prev = null, cur;
+        while ((cur = walker.nextNode())) {
+            if (cur === node) return prev;
+            prev = cur;
+        }
+        return null;
+    }
+
+    function nextTextLeaf(node) {
+        var editable = editor.getEditable();
+        var walker = editor.getDocument().createTreeWalker(editable, NodeFilter.SHOW_TEXT);
+        var seen = false, cur;
+        while ((cur = walker.nextNode())) {
+            if (seen) return cur;
+            if (cur === node) seen = true;
+        }
+        return null;
+    }
+
+    function rangeInsideMyInsert(range) {
+        var span = range.startContainer.parentNode;
+        while (span && span !== editor.getEditable()) {
+            if (isMyInsert(span)) return range.endContainer.parentNode === span || span.contains(range.endContainer);
+            span = span.parentNode;
+        }
+        return false;
+    }
+
+    function wrapRangeAsDelete(range) {
+        if (range.collapsed) return false;
+        var editdoc = editor.getDocument();
+
+        var fragment = range.cloneContents();
+        if (!fragmentHasText(fragment)) return false;
+
+        // Find existing same-author delete spans adjacent to the range so we can merge
+        // sequential backspaces / forward deletes into one contiguous span.
+        var user = config.currentUser;
+        var mergeBefore = adjacentDeleteSpan(range, "before", user);
+        var mergeAfter = adjacentDeleteSpan(range, "after", user);
+
+        range.deleteContents();
+
+        if (mergeBefore) {
+            // Append the fragment's content to the existing "before" span.
+            appendFragmentToSpan(mergeBefore, fragment);
+            if (mergeAfter && mergeAfter !== mergeBefore) {
+                // Collapse both sides: move "after" span's children into "before" and drop it.
+                while (mergeAfter.firstChild) mergeBefore.appendChild(mergeAfter.firstChild);
+                var afterId = mergeAfter.getAttribute("data-tc-id");
+                mergeAfter.remove();
+                if (afterId && editor.reviewLedger) editor.reviewLedger.remove(afterId);
+            }
+            var rangeAfter = editdoc.createRange();
+            rangeAfter.setStartAfter(mergeBefore);
+            rangeAfter.collapse(true);
+            var sel = editor.getSelection();
+            sel.removeAllRanges();
+            sel.addRange(rangeAfter);
+            // 2026-05-28 Defense: if a customer pasted a delete-class span from
+            // outside this plugin, it may lack data-tc-id. Skip the ledger
+            // update instead of writing under a `null` key (would silently
+            // corrupt the ledger via the update("null", ...) coercion).
+            var beforeId = mergeBefore.getAttribute("data-tc-id");
+            if (beforeId && editor.reviewLedger) {
+                editor.reviewLedger.update(beforeId, { text: mergeBefore.textContent });
+            }
+            return true;
+        }
+
+        if (mergeAfter) {
+            prependFragmentToSpan(mergeAfter, fragment);
+            var rangeBefore = editdoc.createRange();
+            rangeBefore.setStartBefore(mergeAfter);
+            rangeBefore.collapse(true);
+            var sel2 = editor.getSelection();
+            sel2.removeAllRanges();
+            sel2.addRange(rangeBefore);
+            // Same defense as above (mergeAfter may lack data-tc-id).
+            var afterMergeId = mergeAfter.getAttribute("data-tc-id");
+            if (afterMergeId && editor.reviewLedger) {
+                editor.reviewLedger.update(afterMergeId, { text: mergeAfter.textContent });
+            }
+            return true;
+        }
+
+        var span = editdoc.createElement("span");
+        span.className = config.trackChangesDeleteClass;
+        var id = "tc-" + Date.now() + "-" + Math.floor(Math.random() * 10000);
+        span.setAttribute("data-tc-id", id);
+        span.setAttribute("data-tc-author", user.id);
+        span.setAttribute("data-tc-at", new Date().toISOString());
+        span.style.color = user.color;
+        span.style.textDecoration = "line-through";
+        span.appendChild(fragment);
+        range.insertNode(span);
+
+        var after = editdoc.createRange();
+        after.setStartAfter(span);
+        after.collapse(true);
+        var sel3 = editor.getSelection();
+        sel3.removeAllRanges();
+        sel3.addRange(after);
+
+        editor.reviewLedger.add({
+            id: id,
+            changeType: "delete",
+            author: user,
+            text: span.textContent,
+            originalHtml: span.innerHTML,
+            status: "pending",
+            sourceLabel: "Suggested delete",
+            createdAt: Date.now()
+        });
+        return true;
+    }
+
+    function adjacentDeleteSpan(range, side, user) {
+        // Find element immediately before or after the range boundaries at the container level.
+        var node = side === "before" ? range.startContainer : range.endContainer;
+        var offset = side === "before" ? range.startOffset : range.endOffset;
+        if (node.nodeType === 3) {
+            // Look at the sibling of the text node if we're at the text node's boundary.
+            if (side === "before" && offset === 0) {
+                var prev = node.previousSibling;
+                if (prev && isDeleteSpanByAuthor(prev, user)) return prev;
+            }
+            if (side === "after" && offset === node.nodeValue.length) {
+                var next = node.nextSibling;
+                if (next && isDeleteSpanByAuthor(next, user)) return next;
+            }
+            return null;
+        }
+        // Element container: look at children on either side of the offset.
+        if (side === "before" && offset > 0) {
+            var childBefore = node.childNodes[offset - 1];
+            if (childBefore && isDeleteSpanByAuthor(childBefore, user)) return childBefore;
+        }
+        if (side === "after" && offset < node.childNodes.length) {
+            var childAfter = node.childNodes[offset];
+            if (childAfter && isDeleteSpanByAuthor(childAfter, user)) return childAfter;
+        }
+        return null;
+    }
+
+    function isDeleteSpanByAuthor(el, user) {
+        if (!el || el.nodeType !== 1) return false;
+        if (!el.classList || !el.classList.contains("rte-tc-delete")) return false;
+        return el.getAttribute("data-tc-author") === user.id;
+    }
+
+    function appendFragmentToSpan(span, fragment) {
+        while (fragment.firstChild) span.appendChild(fragment.firstChild);
+    }
+
+    function prependFragmentToSpan(span, fragment) {
+        var first = span.firstChild;
+        while (fragment.firstChild) span.insertBefore(fragment.firstChild, first);
+    }
+
+    function fragmentHasText(fragment) {
+        var t = (fragment.textContent || "").replace(/\s+/g, "");
+        return !!t;
+    }
+
+    function cleanupEmptyInsertSpans() {
+        var spans = editor.getEditable().querySelectorAll("." + "rte-tc-insert");
+        for (var i = 0; i < spans.length; i++) {
+            var s = spans[i];
+            if (!s.textContent || !s.textContent.length) {
+                var id = s.getAttribute("data-tc-id");
+                if (id && editor.reviewLedger) editor.reviewLedger.remove(id);
+                s.remove();
+            } else {
+                updateEntryForSpan(s);
+            }
+        }
+    }
+
+    function placeCaretAtEnd(node) {
+        if (!node) return;
+        var editdoc = editor.getDocument();
+        var range = editdoc.createRange();
+        if (node.nodeType === 3) {
+            range.setStart(node, node.nodeValue.length);
+        } else {
+            range.setStart(node, node.childNodes.length);
+        }
+        range.collapse(true);
+        var sel = editor.getSelection();
+        sel.removeAllRanges();
+        sel.addRange(range);
+    }
+
+    // --- accept / reject ---
+
+    function decisionUser() {
+        return config.currentUser || { id: "user", name: "User", color: "#2563eb" };
+    }
+
+    function canDecide(entry, action) {
+        if (typeof config.reviewCanDecide !== "function") return true;
+        var allowed = false;
+        var user = decisionUser();
+        try { allowed = config.reviewCanDecide(entry, action, user, editor) !== false; }
+        catch (err) {
+            console.warn("trackedchanges: reviewCanDecide threw; denying decision.", err);
+        }
+        if (allowed) return true;
+        var detail = { entry: entry, action: action, user: user };
+        try { typeof config.onReviewDecisionDenied === "function" && config.onReviewDecisionDenied(detail); } catch (ignore) { }
+        try { typeof editor.fireEvent === "function" && editor.fireEvent("review_decision_denied", detail); } catch (ignore2) { }
+        return false;
+    }
+
+    function acceptEntry(id) {
+        var entry = editor.reviewLedger.get(id);
+        if (!entry) return false;
+        if (!canDecide(entry, "accept")) return false;
+        var span = editor.getEditable().querySelector('[data-tc-id="' + cssEscape(id) + '"]');
+        if (entry.changeType === "insert") {
+            if (span) unwrapKeepChildren(span);
+        } else if (entry.changeType === "delete") {
+            if (span) span.remove();
+        }
+        editor.reviewLedger.update(id, { status: "accepted", decidedAt: Date.now(), decidedBy: decisionUser() });
+        return true;
+    }
+
+    function rejectEntry(id) {
+        var entry = editor.reviewLedger.get(id);
+        if (!entry) return false;
+        if (!canDecide(entry, "reject")) return false;
+        var span = editor.getEditable().querySelector('[data-tc-id="' + cssEscape(id) + '"]');
+        if (entry.changeType === "insert") {
+            if (span) span.remove();
+        } else if (entry.changeType === "delete") {
+            if (span) unwrapKeepChildren(span);
+        }
+        editor.reviewLedger.update(id, { status: "rejected", decidedAt: Date.now(), decidedBy: decisionUser() });
+        return true;
+    }
+
+    function acceptAll(filter) {
+        var entries = editor.reviewLedger.list(filter).filter(function (e) {
+            return (e.changeType === "insert" || e.changeType === "delete") && e.status === "pending";
+        });
+        var accepted = 0;
+        for (var i = 0; i < entries.length; i++) if (acceptEntry(entries[i].id)) accepted++;
+        return accepted;
+    }
+
+    function rejectAll(filter) {
+        var entries = editor.reviewLedger.list(filter).filter(function (e) {
+            return (e.changeType === "insert" || e.changeType === "delete") && e.status === "pending";
+        });
+        var rejected = 0;
+        for (var i = 0; i < entries.length; i++) if (rejectEntry(entries[i].id)) rejected++;
+        return rejected;
+    }
+
+    function unwrapKeepChildren(el) {
+        var parent = el.parentNode;
+        if (!parent) return;
+        while (el.firstChild) parent.insertBefore(el.firstChild, el);
+        parent.removeChild(el);
+    }
+
+    // 2026-05-28 Prefer native CSS.escape — same hardening as comments.js.
+    // Defense-in-depth for customers who wire reviewLedger.add() with custom IDs
+    // containing punctuation (e.g. UUIDs with dashes, OAuth subject claims with
+    // colons, base64 IDs with `=` padding).
+    function cssEscape(s) {
+        var str = String(s);
+        if (typeof CSS !== "undefined" && typeof CSS.escape === "function") {
+            try { return CSS.escape(str); } catch (e) { /* fall through */ }
+        }
+        return str.replace(/["\\\]\[\(\)\{\}'#:;,<>=`~!@$%^&*+/?\s\x00-\x1F]/g, function (c) {
+            return "\\" + c;
+        });
+    }
+
+    // --- styles ---
+
+    function injectStyles() {
+        var host = (editor && editor.iframe && editor.iframe.ownerDocument) || document;
+        if (!host.querySelector("style[data-rte-trackchanges]")) {
+            var style = host.createElement("style");
+            style.setAttribute("data-rte-trackchanges", "1");
+            style.textContent = [
+                ".richtexteditor rte-toolbar-button.rte_command_trackchanges{position:relative;border-radius:8px;transition:background .14s ease,color .14s ease,box-shadow .14s ease}",
+                ".richtexteditor rte-toolbar-button.rte_command_trackchanges.rte-ui-active{background:linear-gradient(135deg,#e9f7ef,#eef5ff);color:#17633f;box-shadow:inset 0 0 0 1px rgba(34,132,82,.28),0 6px 14px rgba(34,132,82,.12)}",
+                ".richtexteditor rte-toolbar-button.rte_command_trackchanges.rte-ui-active:after{content:'';position:absolute;right:5px;top:5px;width:6px;height:6px;border-radius:50%;background:#22a66a;box-shadow:0 0 0 2px #fff}",
+                ".rte-tc{border-radius:4px;padding:0 2px;box-decoration-break:clone;-webkit-box-decoration-break:clone}",
+                ".rte-tc-insert{background:linear-gradient(180deg,rgba(232,248,239,.78),rgba(232,248,239,.38));color:#125b39;text-decoration:underline;text-decoration-color:#22a66a;text-decoration-thickness:2px;text-underline-offset:3px}",
+                ".rte-tc-delete{background:linear-gradient(180deg,rgba(255,240,240,.82),rgba(255,240,240,.42));color:#9f1d1d;text-decoration:line-through;text-decoration-color:#dc4c4c;text-decoration-thickness:2px;opacity:.92}"
+            ].join("\n");
+            host.head.appendChild(style);
+            // A <style> ELEMENT is governed by style-src: under a strict policy the browser
+            // drops its rules, leaving this plugin's UI unstyled. The element above stays
+            // the path everyone else takes; this re-injects through the CSSOM only when
+            // the policy actually emptied it.
+            if (editor && typeof editor.ensureStyleSheetLive === "function") {
+                editor.ensureStyleSheetLive(host, style, "rte-trackedchanges-style", style.textContent);
+            }
+        }
+
+        var editdoc = editor.getDocument();
+        if (editdoc && editdoc.head && !editdoc.querySelector("style[data-rte-trackchanges-inline]")) {
+            var iStyle = editdoc.createElement("style");
+            iStyle.setAttribute("data-rte-trackchanges-inline", "1");
+            iStyle.textContent = [
+                ".rte-tc{border-radius:4px;padding:0 2px;box-decoration-break:clone;-webkit-box-decoration-break:clone}",
+                ".rte-tc-insert{background:linear-gradient(180deg,rgba(232,248,239,.78),rgba(232,248,239,.38));color:#125b39;text-decoration:underline;text-decoration-color:#22a66a;text-decoration-thickness:2px;text-underline-offset:3px}",
+                ".rte-tc-delete{background:linear-gradient(180deg,rgba(255,240,240,.82),rgba(255,240,240,.42));color:#9f1d1d;text-decoration:line-through;text-decoration-color:#dc4c4c;text-decoration-thickness:2px;opacity:.92}"
+            ].join("\n");
+            editdoc.head.appendChild(iStyle);
+            // A <style> ELEMENT is governed by style-src: under a strict policy the browser
+            // drops its rules, leaving this plugin's UI unstyled. The element above stays
+            // the path everyone else takes; this re-injects through the CSSOM only when
+            // the policy actually emptied it.
+            if (editor && typeof editor.ensureStyleSheetLive === "function") {
+                editor.ensureStyleSheetLive(editdoc, iStyle, "rte-trackedchanges-iStyle", iStyle.textContent);
+            }
+        }
+    }
+}
 
 if (!window.RTE_DefaultConfig) window.RTE_DefaultConfig = {};
 
@@ -45045,6 +45329,13 @@ function RTE_Plugin_Typewriter() {
         st.id = "rte-typewriter-styles";
         st.appendChild(doc.createTextNode(css));
         (doc.head || doc.getElementsByTagName("head")[0] || doc.documentElement).appendChild(st);
+        // A <style> ELEMENT is governed by style-src: under a strict policy the browser
+        // drops its rules, leaving this plugin's UI unstyled. The element above stays
+        // the path everyone else takes; this re-injects through the CSSOM only when
+        // the policy actually emptied it.
+        if (editor && typeof editor.ensureStyleSheetLive === "function") {
+            editor.ensureStyleSheetLive(doc, st, "rte-typewriter-styles", st.textContent);
+        }
     }
 
     // Strip the transient focus class around any serialize so saved markup never
@@ -45234,6 +45525,14 @@ function RTE_Plugin_Watermark() {
                 ? ""
                 : "@media print{[data-rte-watermark]{background-image:none !important;}" +
                   "[data-rte-watermark]::before{display:none !important;}}");
+        // Skipped by the scripted conversion on purpose: this element is reused
+        // and its text is rewritten on every watermark change, so the guard has to
+        // sit after the assignment rather than after the append. Same contract as
+        // everywhere else - the element stays primary, the CSSOM path fires only
+        // when a strict style-src emptied it.
+        if (editor && typeof editor.ensureStyleSheetLive === "function") {
+            editor.ensureStyleSheetLive(doc, st, "rte-watermark-dynamic", st.textContent);
+        }
     }
 
     // ---- serialization safety -------------------------------------------
@@ -45285,6 +45584,13 @@ function RTE_Plugin_Watermark() {
         st.id = "rte-watermark-styles";
         st.appendChild(doc.createTextNode("[data-rte-watermark]{position:relative;}"));
         (doc.head || doc.getElementsByTagName("head")[0] || doc.documentElement).appendChild(st);
+        // A <style> ELEMENT is governed by style-src: under a strict policy the browser
+        // drops its rules, leaving this plugin's UI unstyled. The element above stays
+        // the path everyone else takes; this re-injects through the CSSOM only when
+        // the policy actually emptied it.
+        if (editor && typeof editor.ensureStyleSheetLive === "function") {
+            editor.ensureStyleSheetLive(doc, st, "rte-watermark-styles", st.textContent);
+        }
     }
 }
 
@@ -46335,6 +46641,13 @@ function RTE_Plugin_YjsCollab() {
             ".rte-collab-presence-chip.is-self{outline:2px solid rgba(15,23,42,.25);outline-offset:1px}"
         ].join("\n");
         document.head.appendChild(style);
+        // A <style> ELEMENT is governed by style-src: under a strict policy the browser
+        // drops its rules, leaving this plugin's UI unstyled. The element above stays
+        // the path everyone else takes; this re-injects through the CSSOM only when
+        // the policy actually emptied it.
+        if (editor && typeof editor.ensureStyleSheetLive === "function") {
+            editor.ensureStyleSheetLive(document, style, "rte-yjscollab-style", style.textContent);
+        }
     }
 }