The indexer's note search is
  substring(decode(txn->'txn'->>'note','base64') from 1 for N) = $3
with N a per-request literal (7 in ~84% of cases, 3 and 6 next, tail up
to 34). PostgreSQL only matches an index when the indexed expression is a
direct operand of the operator, so no support function or opclass can
help here and the query never used an index for any N but the one baked
into an expression index.

note_prefix.c installs a planner_hook that rewrites such clauses against
any existing substring(x,1,K) btree expression index on the table:
  N > K   -> P = substring(B,1,K), original kept as recheck filter
  N = K   -> P = B (substr(), FROM 0 FOR K+1, reversed operands)
  N < K   -> P = B if len(B) < N, else B <= P < successor(B)
             (no upper bound when B is all 0xFF)
For N <= K the derived form is an exact three-valued equivalent and
replaces the clause, which keeps the row estimates honest. Works for
literals and for bound parameters in custom plans; generic plans get the
N >= K derivation only. Derived clauses are built from the query's own
expression so outer-join nulling rels are preserved. Runtime switch:
SET pg_algorand.prefix_rewrite = off. Needs the library preloaded
(shared_preload_libraries or session_preload_libraries); does nothing
otherwise.

Also adds the regression suite the Makefile already referenced (basic
function tests plus 30 plan/equivalence cases for the rewrite), the
2.0->2.1 upgrade script, and README docs for the index and the
CREATE STATISTICS object the planner needs alongside a partial index.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BAkGJyPG5VRajhBwFRPiQ2

Adds a plugin for buying mobile airtime and data top-ups in 150+ countries,
paid per order in USDC on Algorand via x402.

Everything an agent can currently buy over x402 is another API response. This
delivers a physical-world good to a phone number, which makes the merchant's
promises checkable rather than trusted: payment settles on chain before
anything is bought, a failed delivery refunds on chain automatically, every
terminal order carries an ed25519-signed receipt naming both transactions, and
the delivery ledger is public — including `stranded`, the count of payers who
were charged, received nothing, and could not be refunded. `topup_ledger` and
`verify_topup_receipt` exist so an agent can check that before trusting it.

The plugin holds no wallet. `buy_topup` returns the x402 payment challenge —
exact amount, asset, payTo, facilitator — for the host's own signer to settle,
so no key is ever custodied by the plugin. It is the only tool marked
`mutatesState`, because it is the step that precedes spending and should be
approval-gated; the other seven are queries.

Mainnet only: there is no testnet storefront, and serving one network's
catalogue to another network's agent would be worse than refusing.

No new dependencies — fetch and zod only. Not added to `defaultPlugins()`: a
merchant that spends real money should be opt-in.

Notes for reviewers, both pre-existing on main and unrelated to this change:
`bunx turbo run build typecheck test` fails in @initlabs/vibekit-tui only
because tmux is absent from the environment, and `verify:packed` fails because
packed-consumer asserts `defaultPlugins().length !== 4` while the preset now
returns five (web was added). @initlabs/vibekit itself is green: build,
typecheck, and 475 tests including the 11 added here.

Bumps [browserslist](https://github.com/browserslist/browserslist) from 4.23.0 to 4.28.8.
- [Release notes](https://github.com/browserslist/browserslist/releases)
- [Changelog](https://github.com/browserslist/browserslist/blob/main/CHANGELOG.md)
- [Commits](https://github.com/browserslist/browserslist/compare/4.23.0...4.28.8)

---
updated-dependencies:
- dependency-name: browserslist
  dependency-version: 4.28.8
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>