@aiquants/spreadsheet 0.8.0

package/src/clipboard/clipPayload.ts

@@ -0,0 +1,1242 @@
+/**
+ * @fileoverview Lossless clip wire format v1 (fixed leading keys), header scan, TOTAL validation,
+ * source detection, the single-quoted `data-aqsp-clip` attribute conventions, the copy-side
+ * dictionaries (format / validation interning) and the HTML table size estimator (v0.8, ADR-14).
+ * The package's own copy writes ONE JSON string — `serializeClipPayload` — into two carriers:
+ * the paste-event-only custom MIME `application/x-aqsp-clip` and the FIRST attribute of the
+ * interop `<table>` (`data-aqsp-clip='…'`, single-quoted so the JSON's double quotes stay raw
+ * and the header can be anchored without decoding). React-free and pure (spec 03 §3.1).
+ *
+ * Engine contract (each clause is load-bearing and mutation-gated):
+ * - WIRE FORMAT: `{"v":1,"rows":R,"cols":C,"clipId":"…",…}` — the four leading keys in this
+ *   FIXED order, then `formats`, `validations`, `cells`, `colWidths?`, `rowHeights?`,
+ *   `wholeRows`, `wholeCols`, `conditionalFormats`. Every nested object is emitted with a
+ *   DETERMINISTIC key order: cells `t, f, fmt, val, note, comments, link` (absent keys omitted),
+ *   comments `text, author, createdAt`, format dictionary entries through `canonicalizeFormat`
+ *   (sorted keys at every level, `{}` for an empty canonical form), validation rules and
+ *   conditional-format inputs with sorted keys — two payloads that are structurally equal
+ *   serialise to the identical string whatever the caller's insertion order.
+ * - HEADER SCAN: `readClipHeader` decodes at most the first 512 code units (raw or
+ *   entity-encoded) and anchors on the fixed keys — rows / cols are positive integers without
+ *   leading zeros, clipId a non-empty plain string — so the ADR-12 estimate (`rows × cols`) and
+ *   the clipId identity check never touch the body.
+ * - TOTAL VALIDATION: `parseClipPayload` is hand-rolled (no schema library) and returns null on
+ *   ANY malformed input — invalid JSON, a wrong root, a wrong `v`, non-positive dimensions,
+ *   `cells` not exactly rows × cols, a dictionary index outside its dictionary, a formula not
+ *   starting with `=`, an unknown key anywhere, a value outside the vocabularies of
+ *   `CellFormat` / `DataValidationRule` / `ConditionalFormatRuleInput`, a non-finite number, a
+ *   size list of the wrong length or with a negative entry, a rule range outside the clip
+ *   rectangle (ranges are origin-relative and must lie within `[0, rows) × [0, cols)`). Nothing
+ *   is ever substituted or partially accepted: a parsed payload is safe for every downstream
+ *   engine (the validation engine throws RangeError on an unknown rule type — hence the strict
+ *   vocabulary check here at the trust boundary). `serializeClipPayload` runs the SAME
+ *   validator and throws RangeError (an API surface: consumer input) instead of emitting a
+ *   string the parser would reject.
+ * - CLIP ID: `newClipId` = 128 random bits from `crypto.getRandomValues`, lower-case hex (32
+ *   chars). No capability branch, no counter, no `randomUUID` substitute: an environment
+ *   without `getRandomValues` is a RangeError. The id is the cut-move identity on BOTH channels.
+ * - ATTRIBUTE: the raw carrier is `data-aqsp-clip='<json with & → &amp; and ' → &#39;>'`; a
+ *   sanitising engine re-serialises it as `data-aqsp-clip="{&quot;v&quot;:1,…}"`.
+ *   `decodeClipAttribute` decodes exactly the closed entity set `&amp; &lt; &gt; &quot; &#39;
+ *   &nbsp;` in ONE pass (so `&amp;lt;` yields the literal `&lt;` the cell contained) and leaves
+ *   every other sequence verbatim; the carrier scan accepts either quote character.
+ * - DETECTION (ADR-14, design v5): event channel — `types` contains the custom MIME ⇒ `aqsp`
+ *   without reading any other flavour; otherwise (both channels) the first 16 KiB of
+ *   `text/html` is scanned for markers in the order `data-aqsp-clip=` ⇒ `aqsp`,
+ *   `<google-sheets-html-origin>` + `data-sheets-root="1"` ⇒ `sheets`, Excel (`<meta
+ *   name=Generator content="Microsoft Excel`, an `mso-` property or a `.xlNN {` rule) ⇒
+ *   `excel`; a marker kind and the plain `html` kind both require `<table` somewhere in the
+ *   FULL text (the full string is at hand on both channels — an `mso-` document without a table,
+ *   e.g. Word paragraphs, is not readable by any table reader and continues to `tsv`); then a
+ *   non-empty `text/plain` ⇒ `tsv`; else `none`. `getData` is called only for the flavours the
+ *   detection needs and never for a type absent from `types`. Detection never tries a reader.
+ * - CARRIER READS: `readClipSourceHeader` / `readClipPayload` read ONE carrier — the custom
+ *   MIME on the event channel when present, else the attribute — and never slide from a broken
+ *   carrier to the other one (a malformed carrier is null ⇒ `onClipboardUnavailable("unreadable")`).
+ * - ESTIMATOR: `estimateHtmlTableCells` is one byte-linear pass over the ASCII-case-folded text
+ *   (the DOM reads tag / attribute names case-insensitively, so a lowercase `<table` document
+ *   with `<TR>` / `<TD>` rows must never estimate to 0): `<tr` / `<td` / `<th` count only when
+ *   followed by whitespace, `>` or `/` (`<track`, `<thead`, `<textarea`, `<title` never count), a
+ *   `<td` before any `<tr` opens one implicit row, `</tr` (and `</table` / `</tbody` / `</thead` /
+ *   `</tfoot`) closes the row so a following `<td` opens another (the DOM inserts a row there),
+ *   `colspan` / `rowspan` are read as attributes when preceded by whitespace, `/` or a closing
+ *   quote (`mso-ignore:colspan` is not one; 0 / non-numeric = 1; clamped to the HTML caps the
+ *   reader applies), Σcolspan is summed per row, a `rowspan` carries its colspan into the next
+ *   `rowspan − 1` rows, and the result is rows × max(carried + Σcolspan) — an UPPER bound of the
+ *   reader's `rows × cols` (the HTML table model places a row's cells after the carried blanks;
+ *   a wide header colspan may reject an under-cap table; conservative like `countRangeCells`).
+ *   Every cursor (`<`, `>`, `colspan`, `rowspan`) only advances, so an unclosed tag or thousands
+ *   of non-attribute occurrences cost O(bytes), never O(tags × occurrences). What the estimator
+ *   cannot see (entity references inside attribute values, tokenizer corner cases) is fenced by
+ *   the reader's own cap (`parseHtmlTable(…, maxCells)`), the second wall of ADR-12.
+ * - INTERNING: `createFormatInterner` interns by identity (WeakMap) THEN by canonical JSON
+ *   (`JSON.stringify(canonicalizeFormat(f))`), storing the canonical object; an empty canonical
+ *   form yields no index (undefined). `createValidationInterner` interns by identity then by
+ *   sorted-key JSON, storing the first rule object seen.
+ *
+ * 自前 lossless wire format v1 (先頭キー固定)・ヘッダ走査・全域検証・ソース検出・単一引用
+ * `data-aqsp-clip` 属性規約・copy 側辞書 (書式 / 検証の intern)・HTML 表の規模見積もり (v0.8、
+ * ADR-14)。自前 copy は `serializeClipPayload` の JSON 1 本を 2 つの運搬体 — paste イベント専用の
+ * カスタム MIME `application/x-aqsp-clip` と相互運用 `<table>` の先頭属性 (`data-aqsp-clip='…'`、
+ * JSON の二重引用符を素のまま残しヘッダを復号なしで anchor できる単一引用) — へ書く。React 非依存
+ * の純関数 (spec 03 §3.1)。
+ *
+ * エンジン契約 (全て変異検証で封印): 先頭 4 キー固定順 + 全入れ子の決定的キー順 (構造等価な
+ * payload は挿入順に依らず同一文字列)、先頭 512 code unit の復号 + 固定キー anchor によるヘッダ走査
+ * (本文に触れず rows × cols と clipId を得る)、手書き全域検証 (不正 JSON・根の型・v・非正寸法・
+ * rows × cols 不一致・辞書範囲外の索引・`=` 非始まりの数式・未知キー・語彙外の値・非有限数・寸法配列
+ * の長さ / 負値・クリップ矩形外の規則レンジ — いずれも null、部分受理も代替もしない)、
+ * `serializeClipPayload` は同じ検証器で RangeError、`newClipId` は `crypto.getRandomValues` の
+ * 128 bit を hex 化 (能力分岐・カウンタ・randomUUID 代替なし、不在は RangeError)、閉じた実体集合の
+ * 1 パス復号と両クオート形の運搬体走査、ADR-14 の検出順 (custom MIME → 先頭 16 KiB のマーカー
+ * `aqsp` / `sheets` / `excel` → 全文 `<table` → 非空 text/plain → none。マーカー種も `<table` を
+ * 要し、無ければ tsv へ続く)、運搬体は 1 つだけ読み壊れていても他方へ滑らない、ASCII 大小を
+ * 折り畳んだ文字列に対するバイト線形 1 パス見積もり (トークン規則・暗黙行と `</tr` の閉じ・colspan
+ * 合計・rowspan の持越し・HTML 上限クランプ・reader の rows × cols の上限値 — 見積もりが見ない
+ * ものは reader 自身の上限 `parseHtmlTable(…, maxCells)` が第 2 の壁)、identity → 正準 JSON の
+ * 2 段 intern。
+ */
+
+import { MAX_TRACK_SIZE_PX } from "../header/resizeGates.ts"
+import type { CellRange } from "../model/cellCoord.ts"
+import { type CellAlign, type CellBorder, type CellBorderStyle, type CellBorders, type CellFormat, type CellValueFormat, type CellVerticalAlign, canonicalizeFormat } from "../model/cellFormat.ts"
+import type { CellValueCondition, CfTextOp, ColorScaleCondition, CompareOp, ConditionalFormatRuleInput, ConditionalFormatStyle, CustomFormulaCondition, EmptyCondition, NotEmptyCondition, ScalePoint, TextCondition } from "../model/conditionalFormat.ts"
+import type {
+    CheckboxValidationRule,
+    CustomValidationRule,
+    DataValidationRule,
+    DateValidationRule,
+    ListValidationRule,
+    NumberValidationRule,
+    TextLengthValidationRule,
+    TextValidationRule,
+    ValidationCompareOp,
+    ValidationRuleBase,
+    ValidationTextOp,
+} from "../model/dataValidation.ts"
+
+/** A comment on the wire — the consumer's `id` is stripped (every pasted comment is new). / wire 上のコメント — consumer の `id` は剥がされる (貼り付けられたコメントは全件新規)。 */
+export type ClipComment = { text: string; author: string; createdAt: string }
+
+/**
+ * One cell on the wire: `t` raw text, `f` the formula in origin-relative R1C1 (`=` leading),
+ * `fmt` / `val` indexes into the payload dictionaries, `note`, the id-less `comments` thread and
+ * the hyperlink `link`. Absent keys are absent aspects.
+ * wire 上のセル 1 つ: `t` 素の文字列、`f` 原点相対 R1C1 の数式 (`=` 始まり)、`fmt` / `val` は
+ * payload 辞書への索引、`note`、id を剥がした `comments` スレッド、リンク `link`。不在キー =
+ * 不在側面。
+ */
+export type ClipCell = { t: string; f?: string; fmt?: number; val?: number; note?: string; comments?: readonly ClipComment[]; link?: string }
+
+/**
+ * The lossless clip payload (wire format v1). The four leading keys are fixed in this order;
+ * `cells` is exactly `rows × cols`; `colWidths` / `rowHeights` travel only when the copy source
+ * was whole columns / whole rows; conditional-format inputs are origin-relative and clipped to
+ * the copied rectangle.
+ * lossless クリップ payload (wire format v1)。先頭 4 キーは固定順、`cells` は rows × cols ちょうど、
+ * `colWidths` / `rowHeights` は全列 / 全行 copy のときだけ、条件付き書式入力は原点相対でコピー
+ * 矩形に切り詰め済み。
+ */
+export type ClipPayload = {
+    v: 1
+    rows: number
+    cols: number
+    clipId: string
+    formats: readonly CellFormat[]
+    validations: readonly DataValidationRule[]
+    cells: readonly (readonly ClipCell[])[]
+    colWidths?: readonly number[]
+    rowHeights?: readonly number[]
+    wholeRows: boolean
+    wholeCols: boolean
+    conditionalFormats: readonly ConditionalFormatRuleInput[]
+}
+
+/** The fixed leading keys as a value — what `readClipHeader` returns without parsing the body. / 固定先頭キーの値 — `readClipHeader` が本文 parse なしで返すもの。 */
+export type ClipHeader = { v: 1; rows: number; cols: number; clipId: string }
+
+/** The detected clipboard source kind (ADR-14). / 検出されたクリップボードソース種別 (ADR-14)。 */
+export type ClipSource = "aqsp" | "sheets" | "excel" | "html" | "tsv" | "none"
+
+/** The channel a paste arrives on: the paste event (custom MIME available) or the async clipboard menu path. / 貼り付けの経路: paste イベント (カスタム MIME あり) か非同期クリップボードのメニュー経路。 */
+export type ClipChannel = "event" | "menu"
+
+/**
+ * The common input of both channels: the available flavour types and a reader for one type.
+ * `getData` is called only for a type present in `types` and only when detection needs it —
+ * callers should memoise it per gesture when the read is expensive (a paste event's `getData`
+ * re-materialises the string on every call).
+ * 両経路の共通入力: 利用可能なフレーバー種別と 1 種別の読み手。`getData` は `types` に在る種別に
+ * だけ、検出が要するときにだけ呼ばれる — 読みが高価なとき (paste イベントの `getData` は呼ぶ度に
+ * 文字列を再実体化する) は呼び手がジェスチャ毎に memo する。
+ */
+export type ClipFlavours = { types: readonly string[]; getData: (type: string) => string }
+
+/** The attribute carrying the JSON on the interop `<table>` (its FIRST attribute). / 相互運用 `<table>` で JSON を運ぶ属性 (先頭属性)。 */
+export const CLIP_ATTRIBUTE = "data-aqsp-clip"
+
+/** The paste-event-only custom flavour carrying the same JSON string. / 同じ JSON 文字列を運ぶ paste イベント専用のカスタムフレーバー。 */
+export const CLIP_MIME = "application/x-aqsp-clip"
+
+/** How much of a carrier `readClipHeader` decodes before anchoring (code units). / `readClipHeader` が anchor 前に復号する運搬体の長さ (code unit)。 */
+export const CLIP_HEADER_WINDOW_BYTES = 512
+
+/** How much of `text/html` the marker detection scans (code units). / マーカー検出が走査する `text/html` の長さ (code unit)。 */
+export const CLIP_DETECT_PREFIX_BYTES = 16 * 1024
+
+/** The marker literal the detection and the carrier scan look for. / 検出と運搬体走査が探すマーカー文字列。 */
+const CLIP_ATTRIBUTE_MARKER = `${CLIP_ATTRIBUTE}=`
+
+/** Random bytes per clip id (128 bits). / クリップ id 1 つの乱数バイト数 (128 bit)。 */
+const CLIP_ID_BYTES = 16
+
+/**
+ * Mints a clip id: 128 random bits from `crypto.getRandomValues`, lower-case hex (32 chars).
+ * There is no capability branch and no counter / `randomUUID` substitute by design — an
+ * environment without `getRandomValues` is a RangeError.
+ * クリップ id の採番: `crypto.getRandomValues` の 128 bit を小文字 hex (32 文字) へ。能力分岐も
+ * カウンタ / `randomUUID` 代替も設計上置かない — `getRandomValues` の無い環境は RangeError。
+ */
+export const newClipId = (): string => {
+    const api = globalThis.crypto
+    // 不在は fail-fast — カウンタや randomUUID へ黙って滑らない
+    if (api === undefined || typeof api.getRandomValues !== "function") {
+        throw new RangeError("[spreadsheet] newClipId requires crypto.getRandomValues — there is no counter or randomUUID substitute by design")
+    }
+    const bytes = api.getRandomValues(new Uint8Array(CLIP_ID_BYTES))
+    let hex = ""
+    // 1 バイト = 2 桁の小文字 hex
+    for (const byte of bytes) {
+        hex += byte.toString(16).padStart(2, "0")
+    }
+    return hex
+}
+
+// ---------------------------------------------------------------------------------------------
+// Structural validation (the ONE validator behind parse and serialize)
+// 構造検証 (parse と serialize が共有する唯一の検証器)
+// ---------------------------------------------------------------------------------------------
+
+/** A structural predicate over an unknown value. / 未知の値に対する構造述語。 */
+type Check = (value: unknown) => boolean
+
+/** An object shape: the closed key vocabulary with a predicate per key, and the keys that must be present. / object の形: 閉じたキー語彙 (キー毎の述語) と必須キー。 */
+type Shape = { readonly fields: ReadonlyMap<string, Check>; readonly required: readonly string[] }
+
+/** Plain-object guard (arrays and null are not records). / 素の object 判定 (配列と null は除外)。 */
+const isRecord = (value: unknown): value is Record<string, unknown> => typeof value === "object" && value !== null && !Array.isArray(value)
+
+/** String predicate. / 文字列述語。 */
+const isString: Check = (value) => typeof value === "string"
+
+/** Boolean predicate. / 真偽値述語。 */
+const isBoolean: Check = (value) => typeof value === "boolean"
+
+/** Finite number predicate (JSON cannot carry NaN / Infinity, but a serialiser input can). / 有限数述語 (JSON は NaN / Infinity を運べないが直列化入力は持ち得る)。 */
+const isFiniteNumber: Check = (value) => typeof value === "number" && Number.isFinite(value)
+
+/** Non-negative integer guard (indexes, coordinates). / 非負整数判定 (索引・座標)。 */
+const isNonNegativeInteger = (value: unknown): value is number => typeof value === "number" && Number.isInteger(value) && value >= 0
+
+/** Positive integer guard (dimensions — a clip is at least one cell). / 正整数判定 (寸法 — クリップは最低 1 セル)。 */
+const isPositiveInteger = (value: unknown): value is number => isNonNegativeInteger(value) && value >= 1
+
+/** Non-negative finite size (px) predicate, bounded by MAX_TRACK_SIZE_PX (a crafted payload must not carry a geometry-wedging width — same bound as the resize gate and the HTML reader). / 非負有限かつ MAX_TRACK_SIZE_PX 以下の寸法 (px) 述語 (細工 payload に幾何破壊幅を運ばせない — リサイズゲート / HTML reader と同一上限)。 */
+const isSize: Check = (value) => typeof value === "number" && Number.isFinite(value) && value >= 0 && value <= MAX_TRACK_SIZE_PX
+
+/** Builds a predicate accepting exactly the listed string literals. / 列挙した文字列リテラルだけを受ける述語。 */
+const oneOf = (values: readonly string[]): Check => {
+    const set = new Set<string>(values)
+    return (value) => typeof value === "string" && set.has(value)
+}
+
+/** Builds a predicate for an array whose every element satisfies `check`. / 全要素が `check` を満たす配列の述語。 */
+const arrayOf =
+    (check: Check): Check =>
+    (value) =>
+        Array.isArray(value) && value.every(check)
+
+/** Builds a Shape from a key → predicate table and the required keys. / キー → 述語表と必須キーから Shape を作る。 */
+const shape = (fields: Readonly<Record<string, Check>>, required: readonly string[]): Shape => ({ fields: new Map(Object.entries(fields)), required })
+
+/**
+ * Checks a value against a Shape: it must be a plain object, every present key (a key whose
+ * value is `undefined` counts as absent — a serialiser input may spell an omitted key that way)
+ * must be in the vocabulary and satisfy its predicate, and every required key must be present.
+ * Shape に対する検査: 素の object で、存在する全キー (値 `undefined` は不在扱い — 直列化入力は
+ * 省略キーをそう綴り得る) が語彙内かつ述語を満たし、必須キーが揃うこと。
+ */
+const conforms = (value: unknown, expected: Shape): value is Record<string, unknown> => {
+    if (!isRecord(value)) {
+        return false
+    }
+    for (const key of Object.keys(value)) {
+        const field = value[key]
+        // undefined は「省略」と同値 — JSON からは来ないが直列化入力は持ち得る
+        if (field === undefined) {
+            continue
+        }
+        const check = expected.fields.get(key)
+        // 語彙外キーも述語違反も丸ごと拒否
+        if (check === undefined || !check(field)) {
+            return false
+        }
+    }
+    for (const key of expected.required) {
+        if (value[key] === undefined) {
+            return false
+        }
+    }
+    return true
+}
+
+/** Builds a predicate for a `type`-tagged union: the tag selects the Shape. / `type` タグ付き union の述語: タグが Shape を選ぶ。 */
+const tagged =
+    (shapes: ReadonlyMap<string, Shape>): Check =>
+    (value) => {
+        if (!isRecord(value) || typeof value.type !== "string") {
+            return false
+        }
+        const expected = shapes.get(value.type)
+        return expected !== undefined && conforms(value, expected)
+    }
+
+/** Compile-time proof that a literal list covers a literal union exactly (a literal added to the type but not the list would be rejected at parse time). / リテラル一覧がリテラル union を過不足なく覆うことの型水準の証明 (型に増えたリテラルが一覧に無いと parse で拒否される)。 */
+type Covers<List extends readonly string[], Union extends string> = [Exclude<Union, List[number]>] extends [never] ? ([Exclude<List[number], Union>] extends [never] ? true : never) : never
+
+const CELL_ALIGNS = ["left", "center", "right"] as const
+const CELL_VERTICAL_ALIGNS = ["top", "middle", "bottom"] as const
+const BORDER_STYLES = ["thin", "medium", "thick", "dashed", "dotted", "double", "hair"] as const
+const VALIDATION_COMPARE_OPS = ["gt", "gte", "lt", "lte", "eq", "neq", "between", "notBetween"] as const
+const VALIDATION_TEXT_OPS = ["contains", "notContains", "startsWith", "endsWith", "isEmail", "isUrl"] as const
+const CF_COMPARE_OPS = ["eq", "neq", "gt", "gte", "lt", "lte", "between", "notBetween"] as const
+const CF_TEXT_OPS = ["contains", "notContains", "startsWith", "endsWith"] as const
+
+const vocabulariesCoverTheirTypes: [
+    Covers<typeof CELL_ALIGNS, CellAlign>,
+    Covers<typeof CELL_VERTICAL_ALIGNS, CellVerticalAlign>,
+    Covers<typeof BORDER_STYLES, CellBorderStyle>,
+    Covers<typeof VALIDATION_COMPARE_OPS, ValidationCompareOp>,
+    Covers<typeof VALIDATION_TEXT_OPS, ValidationTextOp>,
+    Covers<typeof CF_COMPARE_OPS, CompareOp>,
+    Covers<typeof CF_TEXT_OPS, CfTextOp>,
+] = [true, true, true, true, true, true, true]
+void vocabulariesCoverTheirTypes
+
+/** Local aliases of the value-format members (Extract stays private — api-extractor never sees it). / 値書式メンバーのローカル別名 (Extract は非公開に留める — api-extractor には見えない)。 */
+type NumberValueFormat = Extract<CellValueFormat, { type: "number" }>
+type PercentValueFormat = Extract<CellValueFormat, { type: "percent" }>
+type CurrencyValueFormat = Extract<CellValueFormat, { type: "currency" }>
+type ScientificValueFormat = Extract<CellValueFormat, { type: "scientific" }>
+type DateValueFormat = Extract<CellValueFormat, { type: "date" }>
+type TextValueFormat = Extract<CellValueFormat, { type: "text" }>
+
+/** The `CellValueFormat` vocabulary per type (every key of every member is listed — `satisfies` proves it). / 型毎の `CellValueFormat` 語彙 (全メンバーの全キーを列挙 — `satisfies` が証明)。 */
+const VALUE_SHAPES: ReadonlyMap<string, Shape> = new Map([
+    ["number", shape({ type: isString, decimals: isFiniteNumber, grouping: isBoolean, locale: isString } satisfies Record<keyof NumberValueFormat, Check>, ["type"])],
+    ["percent", shape({ type: isString, decimals: isFiniteNumber, scale: isBoolean, locale: isString } satisfies Record<keyof PercentValueFormat, Check>, ["type"])],
+    ["currency", shape({ type: isString, currency: isString, decimals: isFiniteNumber, locale: isString } satisfies Record<keyof CurrencyValueFormat, Check>, ["type", "currency"])],
+    ["scientific", shape({ type: isString, decimals: isFiniteNumber, locale: isString } satisfies Record<keyof ScientificValueFormat, Check>, ["type"])],
+    ["date", shape({ type: isString, pattern: isString } satisfies Record<keyof DateValueFormat, Check>, ["type"])],
+    ["text", shape({ type: isString } satisfies Record<keyof TextValueFormat, Check>, ["type"])],
+])
+
+/** One border side. / 罫線 1 辺。 */
+const BORDER_SHAPE = shape({ style: oneOf(BORDER_STYLES), color: isString } satisfies Record<keyof CellBorder, Check>, ["style"])
+
+/** Border side predicate. / 罫線辺の述語。 */
+const isBorder: Check = (value) => conforms(value, BORDER_SHAPE)
+
+/** The four sides. / 4 辺。 */
+const BORDERS_SHAPE = shape({ top: isBorder, right: isBorder, bottom: isBorder, left: isBorder } satisfies Record<keyof CellBorders, Check>, [])
+
+/** The full `CellFormat` vocabulary (values are checked for TYPE only — meaning stays with the fail-soft engines). / `CellFormat` の全語彙 (値は型だけ検査 — 意味は fail-soft エンジンの領分)。 */
+const FORMAT_SHAPE = shape(
+    {
+        value: tagged(VALUE_SHAPES),
+        align: oneOf(CELL_ALIGNS),
+        verticalAlign: oneOf(CELL_VERTICAL_ALIGNS),
+        wrap: isBoolean,
+        background: isString,
+        color: isString,
+        bold: isBoolean,
+        italic: isBoolean,
+        underline: isBoolean,
+        strikethrough: isBoolean,
+        fontFamily: isString,
+        fontSize: isFiniteNumber,
+        borders: (value) => conforms(value, BORDERS_SHAPE),
+    } satisfies Record<keyof CellFormat, Check>,
+    [],
+)
+
+/** Format dictionary entry predicate. / 書式辞書エントリの述語。 */
+const isCellFormat: Check = (value) => conforms(value, FORMAT_SHAPE)
+
+/** The three optional base keys every validation rule may carry. / 全検証規則が持ち得る任意の基底キー 3 つ。 */
+const VALIDATION_BASE = { strict: isBoolean, inputMessage: isString, errorMessage: isString } satisfies Record<keyof ValidationRuleBase, Check>
+
+/** The `DataValidationRule` vocabulary per type (base keys merged into each member). / 型毎の `DataValidationRule` 語彙 (基底キーを各メンバーへ併合)。 */
+const VALIDATION_SHAPES: ReadonlyMap<string, Shape> = new Map([
+    ["list", shape({ ...VALIDATION_BASE, type: isString, values: arrayOf(isString), showDropdown: isBoolean } satisfies Record<keyof (ValidationRuleBase & ListValidationRule), Check>, ["type", "values"])],
+    ["number", shape({ ...VALIDATION_BASE, type: isString, op: oneOf(VALIDATION_COMPARE_OPS), a: isString, b: isString } satisfies Record<keyof (ValidationRuleBase & NumberValidationRule), Check>, ["type", "op", "a"])],
+    ["textLength", shape({ ...VALIDATION_BASE, type: isString, op: oneOf(VALIDATION_COMPARE_OPS), a: isFiniteNumber, b: isFiniteNumber } satisfies Record<keyof (ValidationRuleBase & TextLengthValidationRule), Check>, ["type", "op", "a"])],
+    ["date", shape({ ...VALIDATION_BASE, type: isString, op: oneOf(VALIDATION_COMPARE_OPS), a: isString, b: isString } satisfies Record<keyof (ValidationRuleBase & DateValidationRule), Check>, ["type", "op", "a"])],
+    ["text", shape({ ...VALIDATION_BASE, type: isString, op: oneOf(VALIDATION_TEXT_OPS), value: isString } satisfies Record<keyof (ValidationRuleBase & TextValidationRule), Check>, ["type", "op"])],
+    ["checkbox", shape({ ...VALIDATION_BASE, type: isString, checked: isString, unchecked: isString } satisfies Record<keyof (ValidationRuleBase & CheckboxValidationRule), Check>, ["type"])],
+    ["custom", shape({ ...VALIDATION_BASE, type: isString, formula: isString } satisfies Record<keyof (ValidationRuleBase & CustomValidationRule), Check>, ["type", "formula"])],
+])
+
+/** Validation dictionary entry predicate. / 検証辞書エントリの述語。 */
+const isValidationRule: Check = tagged(VALIDATION_SHAPES)
+
+/** A cell range: four non-negative integers with start ≤ end on both axes (bounds are checked against the clip later). / セルレンジ: 非負整数 4 つ、両軸で start ≤ end (クリップ境界は後で検査)。 */
+const RANGE_SHAPE = shape({ startRow: isNonNegativeInteger, startCol: isNonNegativeInteger, endRow: isNonNegativeInteger, endCol: isNonNegativeInteger } satisfies Record<keyof CellRange, Check>, ["startRow", "startCol", "endRow", "endCol"])
+
+/** Range predicate (structure + ordering — the narrowing repeats the integer checks so no cast is needed). / レンジ述語 (構造 + 順序 — 絞り込みのため整数検査を繰り返し、キャストを置かない)。 */
+const isRange = (value: unknown): value is CellRange => {
+    if (!conforms(value, RANGE_SHAPE)) {
+        return false
+    }
+    const { startRow, startCol, endRow, endCol } = value
+    return isNonNegativeInteger(startRow) && isNonNegativeInteger(endRow) && isNonNegativeInteger(startCol) && isNonNegativeInteger(endCol) && startRow <= endRow && startCol <= endCol
+}
+
+/** A colour-scale point. / カラースケールの点。 */
+const SCALE_POINT_SHAPE = shape({ color: isString, value: isFiniteNumber } satisfies Record<keyof ScalePoint, Check>, ["color"])
+
+/** Scale point predicate. / スケール点の述語。 */
+const isScalePoint: Check = (value) => conforms(value, SCALE_POINT_SHAPE)
+
+/** The `CfCondition` vocabulary per type. / 型毎の `CfCondition` 語彙。 */
+const CONDITION_SHAPES: ReadonlyMap<string, Shape> = new Map([
+    ["cellValue", shape({ type: isString, op: oneOf(CF_COMPARE_OPS), a: isString, b: isString } satisfies Record<keyof CellValueCondition, Check>, ["type", "op", "a"])],
+    ["text", shape({ type: isString, op: oneOf(CF_TEXT_OPS), value: isString } satisfies Record<keyof TextCondition, Check>, ["type", "op", "value"])],
+    ["empty", shape({ type: isString } satisfies Record<keyof EmptyCondition, Check>, ["type"])],
+    ["notEmpty", shape({ type: isString } satisfies Record<keyof NotEmptyCondition, Check>, ["type"])],
+    ["colorScale", shape({ type: isString, min: isScalePoint, mid: isScalePoint, max: isScalePoint } satisfies Record<keyof ColorScaleCondition, Check>, ["type", "min", "max"])],
+    ["customFormula", shape({ type: isString, formula: isString } satisfies Record<keyof CustomFormulaCondition, Check>, ["type", "formula"])],
+])
+
+/** The `ConditionalFormatStyle` vocabulary. / `ConditionalFormatStyle` の語彙。 */
+const STYLE_SHAPE = shape({ background: isString, color: isString, bold: isBoolean, italic: isBoolean, underline: isBoolean, strikethrough: isBoolean } satisfies Record<keyof ConditionalFormatStyle, Check>, [])
+
+/** The `ConditionalFormatRuleInput` vocabulary. / `ConditionalFormatRuleInput` の語彙。 */
+const CF_INPUT_SHAPE = shape({ sourceRuleId: isString, ranges: Array.isArray, condition: tagged(CONDITION_SHAPES), style: (value) => conforms(value, STYLE_SHAPE), stopIfTrue: isBoolean } satisfies Record<keyof ConditionalFormatRuleInput, Check>, [
+    "sourceRuleId",
+    "ranges",
+    "condition",
+    "style",
+])
+
+/**
+ * Conditional-format input predicate: structure plus the origin-relative bound — every range
+ * must lie inside `[0, rows) × [0, cols)` (the copy side clips rules to the copied rectangle).
+ * 条件付き書式入力の述語: 構造 + 原点相対の境界 — 全レンジが `[0, rows) × [0, cols)` に収まる
+ * こと (copy 側は規則をコピー矩形へ切り詰める)。
+ */
+const isConditionalFormatInput = (value: unknown, rows: number, cols: number): value is ConditionalFormatRuleInput => {
+    if (!conforms(value, CF_INPUT_SHAPE)) {
+        return false
+    }
+    const ranges = value.ranges
+    if (!Array.isArray(ranges)) {
+        return false
+    }
+    // 各レンジは構造 + 順序 (isRange) + クリップ矩形内の境界
+    for (const range of ranges) {
+        if (!isRange(range) || range.endRow >= rows || range.endCol >= cols) {
+            return false
+        }
+    }
+    return true
+}
+
+/** A comment on the wire: exactly the three strings (an `id` is an unknown key — rejected). / wire 上のコメント: 3 つの文字列ちょうど (`id` は未知キー — 拒否)。 */
+const COMMENT_SHAPE = shape({ text: isString, author: isString, createdAt: isString } satisfies Record<keyof ClipComment, Check>, ["text", "author", "createdAt"])
+
+/** Comment predicate. / コメント述語。 */
+const isClipComment: Check = (value) => conforms(value, COMMENT_SHAPE)
+
+/**
+ * The per-cell check — the hot path (100k cells): hand-rolled switch over the seven keys, every
+ * other key rejected, dictionary indexes bounded by the dictionaries, formulas `=`-leading.
+ * セル毎の検査 — ホットパス (10 万セル): 7 キーの手書き switch、他キーは拒否、辞書索引は辞書
+ * 長で有界、数式は `=` 始まり。
+ */
+const isClipCell = (value: unknown, formatCount: number, validationCount: number): value is ClipCell => {
+    if (!isRecord(value) || typeof value.t !== "string") {
+        return false
+    }
+    for (const key of Object.keys(value)) {
+        const field = value[key]
+        // undefined は省略と同値
+        if (field === undefined) {
+            continue
+        }
+        switch (key) {
+            case "t":
+                break
+            case "f":
+                // 原点相対 R1C1 の数式 — getCellFormula と同じく `=` 始まりだけ
+                if (typeof field !== "string" || !field.startsWith("=")) {
+                    return false
+                }
+                break
+            case "fmt":
+                if (!isNonNegativeInteger(field) || field >= formatCount) {
+                    return false
+                }
+                break
+            case "val":
+                if (!isNonNegativeInteger(field) || field >= validationCount) {
+                    return false
+                }
+                break
+            case "note":
+            case "link":
+                if (typeof field !== "string") {
+                    return false
+                }
+                break
+            case "comments":
+                if (!(Array.isArray(field) && field.every(isClipComment))) {
+                    return false
+                }
+                break
+            default:
+                return false
+        }
+    }
+    return true
+}
+
+/** A size list (px) of exactly the expected length. / 期待長ちょうどの寸法配列 (px)。 */
+const isSizeList = (value: unknown, length: number): value is readonly number[] => Array.isArray(value) && value.length === length && value.every(isSize)
+
+/** The closed top-level key set. / 閉じた最上位キー集合。 */
+const PAYLOAD_KEYS: ReadonlySet<string> = new Set<keyof ClipPayload>(["v", "rows", "cols", "clipId", "formats", "validations", "cells", "colWidths", "rowHeights", "wholeRows", "wholeCols", "conditionalFormats"])
+
+/**
+ * The whole-payload structural check (TOTAL — every clause of the fileoverview's validation
+ * contract). Shared by `parseClipPayload` (null) and `serializeClipPayload` (RangeError).
+ * payload 全体の構造検査 (全域 — fileoverview の検証契約の全項)。`parseClipPayload` (null) と
+ * `serializeClipPayload` (RangeError) が共有。
+ */
+const isClipPayload = (value: unknown): value is ClipPayload => {
+    if (!isRecord(value)) {
+        return false
+    }
+    // 最上位キーは閉じた集合 (undefined 値は省略と同値)
+    for (const key of Object.keys(value)) {
+        if (value[key] !== undefined && !PAYLOAD_KEYS.has(key)) {
+            return false
+        }
+    }
+    if (value.v !== 1) {
+        return false
+    }
+    const rows = value.rows
+    const cols = value.cols
+    if (!(isPositiveInteger(rows) && isPositiveInteger(cols))) {
+        return false
+    }
+    if (typeof value.clipId !== "string" || value.clipId === "") {
+        return false
+    }
+    const formats = value.formats
+    if (!(Array.isArray(formats) && formats.every(isCellFormat))) {
+        return false
+    }
+    const validations = value.validations
+    if (!(Array.isArray(validations) && validations.every(isValidationRule))) {
+        return false
+    }
+    const cells = value.cells
+    if (!Array.isArray(cells) || cells.length !== rows) {
+        return false
+    }
+    // rows × cols ちょうど、各セルは辞書長で有界
+    for (const row of cells) {
+        if (!Array.isArray(row) || row.length !== cols) {
+            return false
+        }
+        for (const cell of row) {
+            if (!isClipCell(cell, formats.length, validations.length)) {
+                return false
+            }
+        }
+    }
+    if (value.colWidths !== undefined && !isSizeList(value.colWidths, cols)) {
+        return false
+    }
+    if (value.rowHeights !== undefined && !isSizeList(value.rowHeights, rows)) {
+        return false
+    }
+    if (typeof value.wholeRows !== "boolean" || typeof value.wholeCols !== "boolean") {
+        return false
+    }
+    const conditionalFormats = value.conditionalFormats
+    return Array.isArray(conditionalFormats) && conditionalFormats.every((rule) => isConditionalFormatInput(rule, rows, cols))
+}
+
+// ---------------------------------------------------------------------------------------------
+// Serialisation (fixed leading keys, deterministic key order)
+// 直列化 (先頭キー固定、決定的キー順)
+// ---------------------------------------------------------------------------------------------
+
+/**
+ * JSON with SORTED object keys at every level and `undefined`-valued keys dropped — the
+ * deterministic spelling of validation rules and conditional-format inputs (which have no
+ * canonicaliser of their own).
+ * 全階層でキーをソートし `undefined` 値キーを落とした JSON — 独自の正準化器を持たない検証規則と
+ * 条件付き書式入力の決定的な綴り。
+ */
+const stableJson = (value: unknown): string => {
+    if (Array.isArray(value)) {
+        return `[${value.map(stableJson).join(",")}]`
+    }
+    if (isRecord(value)) {
+        // キーは UTF-16 code unit 順 (canonicalizeFormat と同じ順序規則)
+        const keys = Object.keys(value)
+            .filter((key) => value[key] !== undefined)
+            .sort()
+        return `{${keys.map((key) => `${JSON.stringify(key)}:${stableJson(value[key])}`).join(",")}}`
+    }
+    return JSON.stringify(value)
+}
+
+/** A format dictionary entry: the canonical form (sorted keys), `{}` when nothing survives. / 書式辞書エントリ: 正準形 (ソート済みキー)、何も残らなければ `{}`。 */
+const serializeFormat = (format: CellFormat): string => {
+    const canonical = canonicalizeFormat(format)
+    return canonical === undefined ? "{}" : JSON.stringify(canonical)
+}
+
+/** One comment in the fixed key order `text, author, createdAt`. / 固定キー順 `text, author, createdAt` のコメント 1 件。 */
+const serializeComment = (comment: ClipComment): string => `{"text":${JSON.stringify(comment.text)},"author":${JSON.stringify(comment.author)},"createdAt":${JSON.stringify(comment.createdAt)}}`
+
+/** One cell in the fixed key order `t, f, fmt, val, note, comments, link` (absent keys omitted). / 固定キー順 `t, f, fmt, val, note, comments, link` のセル 1 つ (不在キーは省略)。 */
+const serializeCell = (cell: ClipCell): string => {
+    let out = `{"t":${JSON.stringify(cell.t)}`
+    if (cell.f !== undefined) {
+        out += `,"f":${JSON.stringify(cell.f)}`
+    }
+    if (cell.fmt !== undefined) {
+        out += `,"fmt":${cell.fmt}`
+    }
+    if (cell.val !== undefined) {
+        out += `,"val":${cell.val}`
+    }
+    if (cell.note !== undefined) {
+        out += `,"note":${JSON.stringify(cell.note)}`
+    }
+    if (cell.comments !== undefined) {
+        out += `,"comments":[${cell.comments.map(serializeComment).join(",")}]`
+    }
+    if (cell.link !== undefined) {
+        out += `,"link":${JSON.stringify(cell.link)}`
+    }
+    return `${out}}`
+}
+
+/**
+ * Serialises a payload with the FIXED leading key order `{"v":1,"rows":R,"cols":C,"clipId":"…",…}`
+ * and a deterministic key order everywhere below (fileoverview). A structurally malformed
+ * payload (the parser's validation contract) is a RangeError — the serialiser never emits a
+ * string `parseClipPayload` would reject.
+ * 固定先頭キー順 `{"v":1,"rows":R,"cols":C,"clipId":"…",…}` と以下全階層の決定的キー順で直列化
+ * (fileoverview)。構造的に不正な payload (parser の検証契約) は RangeError — `parseClipPayload`
+ * が拒む文字列を直列化器は決して出さない。
+ */
+export const serializeClipPayload = (payload: ClipPayload): string => {
+    if (!isClipPayload(payload)) {
+        throw new RangeError("[spreadsheet] serializeClipPayload received a payload outside the wire format v1 vocabulary")
+    }
+    const head = `{"v":1,"rows":${payload.rows},"cols":${payload.cols},"clipId":${JSON.stringify(payload.clipId)}`
+    const formats = payload.formats.map(serializeFormat).join(",")
+    const validations = payload.validations.map(stableJson).join(",")
+    const cells = payload.cells.map((row) => `[${row.map(serializeCell).join(",")}]`).join(",")
+    // 寸法配列は在るときだけ、cells と wholeRows の間
+    const colWidths = payload.colWidths === undefined ? "" : `,"colWidths":[${payload.colWidths.join(",")}]`
+    const rowHeights = payload.rowHeights === undefined ? "" : `,"rowHeights":[${payload.rowHeights.join(",")}]`
+    const conditionalFormats = payload.conditionalFormats.map(stableJson).join(",")
+    return `${head},"formats":[${formats}],"validations":[${validations}],"cells":[${cells}]${colWidths}${rowHeights},"wholeRows":${payload.wholeRows},"wholeCols":${payload.wholeCols},"conditionalFormats":[${conditionalFormats}]}`
+}
+
+/**
+ * Parses a wire-format string with TOTAL validation (fileoverview): null on any malformed input,
+ * never a partial payload, never a substituted value.
+ * wire format 文字列を全域検証つきで parse (fileoverview): 不正入力は全て null、部分 payload も
+ * 値の代替も無し。
+ */
+export const parseClipPayload = (json: string): ClipPayload | null => {
+    let value: unknown
+    try {
+        value = JSON.parse(json)
+    } catch {
+        // 不正 JSON は「読めない」— fail-soft の null (parse エンジンの全域性)
+        return null
+    }
+    return isClipPayload(value) ? value : null
+}
+
+// ---------------------------------------------------------------------------------------------
+// Attribute carrier + header scan
+// 属性運搬体 + ヘッダ走査
+// ---------------------------------------------------------------------------------------------
+
+/** The closed entity set of the attribute carrier (raw writer form + sanitised re-serialisation). / 属性運搬体の閉じた実体集合 (writer の生形 + サニタイズ再直列化形)。 */
+const ENTITY_RE = /&(?:amp|lt|gt|quot|#39|nbsp);/g
+
+/** Entity → character, exactly the six the regex matches. / 実体 → 文字、正規表現が当てる 6 つちょうど。 */
+const ENTITIES: Readonly<Record<string, string>> = Object.freeze({ "&amp;": "&", "&lt;": "<", "&gt;": ">", "&quot;": '"', "&#39;": "'", "&nbsp;": "\u00a0" })
+
+/**
+ * Decodes an attribute value in ONE pass over the closed entity set `&amp; &lt; &gt; &quot;
+ * &#39; &nbsp;` (so `&amp;lt;` yields the literal `&lt;` the cell contained); every other
+ * sequence stays verbatim. Both quote styles decode with the same table — the raw single-quoted
+ * writer form only ever holds `&amp;` / `&#39;` (and optionally `&lt;` / `&gt;`), a sanitising
+ * engine's double-quoted re-serialisation adds `&quot;` / `&nbsp;`. A value without `&` is
+ * returned as the same string instance.
+ * 閉じた実体集合 `&amp; &lt; &gt; &quot; &#39; &nbsp;` を 1 パスで復号 (`&amp;lt;` はセルが含んで
+ * いた文字通りの `&lt;` になる)。他の並びは全て原文のまま。両クオート形が同じ表で復号される —
+ * writer の生 (単一引用) 形は `&amp;` / `&#39;` (任意で `&lt;` / `&gt;`) しか持たず、サニタイズ
+ * エンジンの二重引用再直列化は `&quot;` / `&nbsp;` を足す。`&` の無い値は同一インスタンスを返す。
+ */
+export const decodeClipAttribute = (attributeValue: string): string => (attributeValue.includes("&") ? attributeValue.replace(ENTITY_RE, (entity) => ENTITIES[entity]) : attributeValue)
+
+/** The anchored header grammar: fixed keys, positive integers without leading zeros, a plain non-empty clipId. / anchor されたヘッダ文法: 固定キー、先頭 0 の無い正整数、素の非空 clipId。 */
+const HEADER_RE = /^\{"v":1,"rows":([1-9]\d{0,14}),"cols":([1-9]\d{0,14}),"clipId":"([^"\\]+)"/
+
+/**
+ * Reads the fixed leading keys from the start of a carrier (the JSON string or the attribute
+ * value, raw or entity-encoded): decodes at most the first CLIP_HEADER_WINDOW_BYTES code units
+ * and anchors on `{"v":1,"rows":R,"cols":C,"clipId":"…"`. Null when the carrier does not begin
+ * with a well-formed header (including a clipId whose closing quote lies beyond the window).
+ * 運搬体 (JSON 文字列か属性値、生 / 実体形) の先頭から固定先頭キーを読む: 先頭
+ * CLIP_HEADER_WINDOW_BYTES code unit までを復号し `{"v":1,"rows":R,"cols":C,"clipId":"…"` へ
+ * anchor。整形式のヘッダで始まらなければ null (閉じ引用が窓の外にある clipId を含む)。
+ */
+export const readClipHeader = (source: string): ClipHeader | null => {
+    // 窓の外は復号も走査もしない — 11 MB の運搬体でもヘッダのコストは定数
+    const window = source.length > CLIP_HEADER_WINDOW_BYTES ? source.slice(0, CLIP_HEADER_WINDOW_BYTES) : source
+    const match = HEADER_RE.exec(decodeClipAttribute(window))
+    if (match === null) {
+        return null
+    }
+    return { v: 1, rows: Number(match[1]), cols: Number(match[2]), clipId: match[3] }
+}
+
+/** Where the attribute value starts and which quote closes it. / 属性値の開始位置と閉じ引用符。 */
+type AttributeStart = { readonly start: number; readonly quote: string }
+
+/**
+ * Locates the `data-aqsp-clip=` carrier in an HTML string: the value must be quoted with `'`
+ * (raw writer form) or `"` (re-serialised form); an unquoted or absent value is null.
+ * HTML 文字列内の `data-aqsp-clip=` 運搬体の位置: 値は `'` (writer の生形) か `"` (再直列化形) で
+ * 引用されていること。非引用 / 不在は null。
+ */
+const findClipAttribute = (html: string): AttributeStart | null => {
+    const at = html.indexOf(CLIP_ATTRIBUTE_MARKER)
+    if (at === -1) {
+        return null
+    }
+    const quoteAt = at + CLIP_ATTRIBUTE_MARKER.length
+    const quote = html.charAt(quoteAt)
+    // JSON は空白 / 引用符を含み得るので非引用の属性値は運搬体になり得ない
+    if (quote !== "'" && quote !== '"') {
+        return null
+    }
+    return { start: quoteAt + 1, quote }
+}
+
+/** The one carrier a channel reads: the custom MIME's JSON, or the attribute inside the HTML. / 経路が読む唯一の運搬体: カスタム MIME の JSON か、HTML 内の属性。 */
+type ClipCarrier = { readonly kind: "mime"; readonly json: string } | { readonly kind: "attribute"; readonly html: string; readonly at: AttributeStart }
+
+/**
+ * Chooses the carrier: the custom MIME on the event channel when present (no other flavour is
+ * read), else the attribute in `text/html` (only when that type is present). Null when neither
+ * exists — a broken carrier never slides to the other one.
+ * 運搬体の選択: event 経路でカスタム MIME が在ればそれ (他フレーバーは読まない)、無ければ
+ * `text/html` の属性 (その種別が在るときだけ)。どちらも無ければ null — 壊れた運搬体から他方へは
+ * 滑らない。
+ */
+const locateClipCarrier = (flavours: ClipFlavours, channel: ClipChannel): ClipCarrier | null => {
+    if (channel === "event" && flavours.types.includes(CLIP_MIME)) {
+        return { kind: "mime", json: flavours.getData(CLIP_MIME) }
+    }
+    if (!flavours.types.includes("text/html")) {
+        return null
+    }
+    const html = flavours.getData("text/html")
+    const at = findClipAttribute(html)
+    return at === null ? null : { kind: "attribute", html, at }
+}
+
+/**
+ * The header (clipId, rows × cols) of an `aqsp` source WITHOUT parsing the body — the custom
+ * MIME's JSON head on the event channel, the attribute head otherwise. The identity check on
+ * both channels reads this; null when the carrier is absent or its head is malformed (callers
+ * treat null as "unreadable" — never as a foreign clip).
+ * `aqsp` ソースのヘッダ (clipId、rows × cols) を本文 parse なしで — event 経路はカスタム MIME の
+ * JSON 先頭、他は属性の先頭。両経路の同一性判定がこれを読む。運搬体不在 / 先頭不正は null (呼び手
+ * は null を「読めない」と扱う — 外来クリップ扱いにはしない)。
+ */
+export const readClipSourceHeader = (flavours: ClipFlavours, channel: ClipChannel): ClipHeader | null => {
+    const carrier = locateClipCarrier(flavours, channel)
+    if (carrier === null) {
+        return null
+    }
+    if (carrier.kind === "mime") {
+        return readClipHeader(carrier.json)
+    }
+    // 属性値の先頭 512 code unit だけを切り出す (閉じ引用の探索も本文の復号もしない)
+    return readClipHeader(carrier.html.slice(carrier.at.start, carrier.at.start + CLIP_HEADER_WINDOW_BYTES))
+}
+
+/**
+ * Extracts and parses the JSON of an `aqsp` source: the custom MIME on the event channel when
+ * present, else the attribute value up to its closing quote, entity-decoded. Not called on an
+ * identity hit. Null on a missing carrier, a missing closing quote or any validation failure.
+ * `aqsp` ソースの JSON 抽出 + parse: event 経路でカスタム MIME が在ればそれ、無ければ閉じ引用まで
+ * の属性値を実体復号。同一性ヒット時は呼ばれない。運搬体不在 / 閉じ引用不在 / 検証失敗は null。
+ */
+export const readClipPayload = (flavours: ClipFlavours, channel: ClipChannel): ClipPayload | null => {
+    const carrier = locateClipCarrier(flavours, channel)
+    if (carrier === null) {
+        return null
+    }
+    if (carrier.kind === "mime") {
+        return parseClipPayload(carrier.json)
+    }
+    const end = carrier.html.indexOf(carrier.at.quote, carrier.at.start)
+    // 閉じ引用が無い属性は切り詰められた運搬体 — 読めない
+    if (end === -1) {
+        return null
+    }
+    return parseClipPayload(decodeClipAttribute(carrier.html.slice(carrier.at.start, end)))
+}
+
+// ---------------------------------------------------------------------------------------------
+// Source detection (ADR-14)
+// ソース検出 (ADR-14)
+// ---------------------------------------------------------------------------------------------
+
+/** Google Sheets wrapper element (attributes tolerated). / Google Sheets のラッパー要素 (属性は許容)。 */
+const SHEETS_ORIGIN_RE = /<google-sheets-html-origin[\s>]/
+
+/** Google Sheets table root attribute. / Google Sheets の表ルート属性。 */
+const SHEETS_ROOT_MARKER = 'data-sheets-root="1"'
+
+/** Excel generator meta (raw `name=Generator` or re-serialised `name="Generator"`). / Excel の generator meta (生 `name=Generator` / 再直列化 `name="Generator"`)。 */
+const EXCEL_GENERATOR_RE = /<meta\s+name=["']?Generator["']?\s+content=["']?Microsoft Excel/
+
+/** Any Office `mso-` CSS property. / Office の `mso-` CSS プロパティ。 */
+const EXCEL_MSO_MARKER = "mso-"
+
+/** An Excel `.xlNN {` style rule. / Excel の `.xlNN {` スタイル規則。 */
+const EXCEL_XL_RULE_RE = /\.xl\d+\s*\{/
+
+/** The table test marker (lowercase — the serialisation Excel / Sheets / Chromium emit). / 表判定マーカー (小文字 — Excel / Sheets / Chromium が出す直列化)。 */
+const TABLE_MARKER = "<table"
+
+/** The marker-refined kind of an HTML flavour, or null when no marker is present. / HTML フレーバーのマーカー種別、マーカー無しは null。 */
+const detectHtmlMarker = (prefix: string): "aqsp" | "sheets" | "excel" | null => {
+    if (prefix.includes(CLIP_ATTRIBUTE_MARKER)) {
+        return "aqsp"
+    }
+    // Sheets は mso- も含むので excel より先に判定する
+    if (SHEETS_ORIGIN_RE.test(prefix) && prefix.includes(SHEETS_ROOT_MARKER)) {
+        return "sheets"
+    }
+    if (EXCEL_GENERATOR_RE.test(prefix) || prefix.includes(EXCEL_MSO_MARKER) || EXCEL_XL_RULE_RE.test(prefix)) {
+        return "excel"
+    }
+    return null
+}
+
+/**
+ * Detects the ONE source a paste reads (ADR-14, design v5): event channel — `types` contains
+ * the custom MIME ⇒ `aqsp` (nothing else is read); then, on both channels, the first
+ * CLIP_DETECT_PREFIX_BYTES of `text/html` are scanned for markers (`aqsp` → `sheets` → `excel`)
+ * and the FULL text is tested for `<table` — a marker refines the kind, `<table` alone is
+ * `html`, and an HTML flavour without any table is not a table source at all; then a non-empty
+ * `text/plain` ⇒ `tsv`; else `none`. Never tries a reader; `getData` is called only for the
+ * flavours the decision needs and never for a type absent from `types`.
+ * 貼り付けが読む唯一のソースを検出 (ADR-14、設計 v5): event 経路 — `types` にカスタム MIME が
+ * 在れば `aqsp` (他は読まない)。次に両経路で `text/html` の先頭 CLIP_DETECT_PREFIX_BYTES を
+ * マーカー走査 (`aqsp` → `sheets` → `excel`) し全文を `<table` で判定 — マーカーは種別を精密化、
+ * `<table` だけなら `html`、表の無い HTML フレーバーは表ソースにならない。次に非空 `text/plain` ⇒
+ * `tsv`、他は `none`。reader は試行しない。`getData` は判定が要するフレーバーにだけ、`types` に
+ * 無い種別には決して呼ばない。
+ */
+export const detectClipSource = (flavours: ClipFlavours, channel: ClipChannel): ClipSource => {
+    if (channel === "event" && flavours.types.includes(CLIP_MIME)) {
+        return "aqsp"
+    }
+    if (flavours.types.includes("text/html")) {
+        const html = flavours.getData("text/html")
+        const prefix = html.length > CLIP_DETECT_PREFIX_BYTES ? html.slice(0, CLIP_DETECT_PREFIX_BYTES) : html
+        const marker = detectHtmlMarker(prefix)
+        // 自前運搬体は属性そのものが reader の入力 — 表判定を要しない
+        if (marker === "aqsp") {
+            return "aqsp"
+        }
+        // 表判定は全文 (両経路とも全文が手元にあり無償) — マーカー種も表が無ければ読めない
+        if (html.includes(TABLE_MARKER)) {
+            return marker === null ? "html" : marker
+        }
+    }
+    if (flavours.types.includes("text/plain") && flavours.getData("text/plain") !== "") {
+        return "tsv"
+    }
+    return "none"
+}
+
+// ---------------------------------------------------------------------------------------------
+// HTML table size estimate (ADR-12, before any DOMParser)
+// HTML 表の規模見積もり (ADR-12、DOMParser 構築前)
+// ---------------------------------------------------------------------------------------------
+
+/** HTML clamp of `colspan` — shared by the estimator and the reader (`htmlInterop.ts`). / `colspan` の HTML 上限 — 見積もりと reader (`htmlInterop.ts`) が共有。 */
+export const HTML_COLSPAN_MAX = 1000
+
+/** HTML clamp of `rowspan` — shared by the estimator and the reader (`htmlInterop.ts`). / `rowspan` の HTML 上限 — 見積もりと reader (`htmlInterop.ts`) が共有。 */
+export const HTML_ROWSPAN_MAX = 65534
+
+const CODE_TAB = 0x09
+const CODE_LF = 0x0a
+const CODE_FF = 0x0c
+const CODE_CR = 0x0d
+const CODE_SPACE = 0x20
+const CODE_QUOTE = 0x22
+const CODE_APOS = 0x27
+const CODE_PLUS = 0x2b
+const CODE_SLASH = 0x2f
+const CODE_ZERO = 0x30
+const CODE_NINE = 0x39
+const CODE_EQUALS = 0x3d
+const CODE_GT = 0x3e
+const CODE_A = 0x61
+const CODE_B = 0x62
+const CODE_D = 0x64
+const CODE_F = 0x66
+const CODE_H = 0x68
+const CODE_R = 0x72
+const CODE_T = 0x74
+
+/** The end tags after `</t` that end the current row in the HTML parser (`</tr` is tested by code). / HTML パーサで現在行を終える `</t` 始まりの終了タグ (`</tr` はコード比較)。 */
+const ROW_CLOSER_TAILS: readonly string[] = ["able", "body", "head", "foot"]
+
+/** HTML whitespace. / HTML の空白。 */
+const isHtmlSpace = (code: number): boolean => code === CODE_SPACE || code === CODE_TAB || code === CODE_LF || code === CODE_CR || code === CODE_FF
+
+/** What may follow `<tr` / `<td` / `<th` for the token to count (NaN at end of input never does). / `<tr` / `<td` / `<th` が数えられるために続き得る文字 (入力末尾の NaN は該当しない)。 */
+const isTokenEnd = (code: number): boolean => code === CODE_GT || code === CODE_SLASH || isHtmlSpace(code)
+
+/**
+ * What may precede an attribute NAME inside a tag: whitespace, `/` (after a stray slash the
+ * tokenizer starts a new attribute — `<td/colspan=3>` is `colspan=3`) or the closing quote of the
+ * previous value (`x="1"colspan=3`). Anything else (`:` in `mso-ignore:colspan`) is not an attribute.
+ * タグ内で属性名の直前に来得る文字: 空白、`/` (孤立した斜線の後は新しい属性 — `<td/colspan=3>` は
+ * `colspan=3`)、前の値の閉じ引用 (`x="1"colspan=3`)。他 (`mso-ignore:colspan` の `:`) は属性でない。
+ */
+const isAttributeStart = (code: number): boolean => isHtmlSpace(code) || code === CODE_SLASH || code === CODE_QUOTE || code === CODE_APOS
+
+/**
+ * Reads a span attribute occurrence (`colspan` / `rowspan`, name length `length`) at `at`: null
+ * when it is not an attribute (see `isAttributeStart`); otherwise the HTML non-negative-integer
+ * reading of its value (optional quotes / whitespace / `+`, leading digits) with 0, a missing value
+ * or a non-numeric value reading as 1, clamped to `max` (the HTML cap the reader applies).
+ * 位置 `at` の span 属性 (`colspan` / `rowspan`、名前長 `length`) を読む: 属性でなければ
+ * (`isAttributeStart` 参照) null、属性なら値の HTML 非負整数読み (任意の引用符 / 空白 / `+`、先頭の
+ * 数字列)。0・値なし・非数は 1、`max` (reader が適用する HTML 上限) へクランプ。
+ */
+const readSpan = (text: string, at: number, length: number, max: number): number | null => {
+    if (at === 0 || !isAttributeStart(text.charCodeAt(at - 1))) {
+        return null
+    }
+    let k = at + length
+    while (isHtmlSpace(text.charCodeAt(k))) {
+        k += 1
+    }
+    // 裸の属性 (`=` 無し) は空値 = 1
+    if (text.charCodeAt(k) !== CODE_EQUALS) {
+        return 1
+    }
+    k += 1
+    while (isHtmlSpace(text.charCodeAt(k))) {
+        k += 1
+    }
+    const quote = text.charCodeAt(k)
+    if (quote === CODE_QUOTE || quote === CODE_APOS) {
+        k += 1
+    }
+    while (isHtmlSpace(text.charCodeAt(k))) {
+        k += 1
+    }
+    if (text.charCodeAt(k) === CODE_PLUS) {
+        k += 1
+    }
+    let span = 0
+    let digits = 0
+    // 先頭の数字列だけ (HTML の非負整数解析)
+    for (let code = text.charCodeAt(k); code >= CODE_ZERO && code <= CODE_NINE; code = text.charCodeAt(k)) {
+        span = span * 10 + (code - CODE_ZERO)
+        digits += 1
+        k += 1
+    }
+    if (digits === 0 || span === 0) {
+        return 1
+    }
+    return span > max ? max : span
+}
+
+/**
+ * A monotonic reader of ONE span attribute name over the folded text: `(from, limit)` yields the
+ * attribute's value for the tag whose attribute region is `[from, limit)`, or 1 when the region
+ * holds none. The shared occurrence cursor only advances: an occurrence that is not an attribute
+ * (`mso-ignore:colspan`) is examined once for the whole document, so the total cost is
+ * O(occurrences) however many tags share one region (an unclosed tag reaching the end of the
+ * text costs nothing extra).
+ * 折り畳み済み文字列上の span 属性名 1 つの単調 reader: `(from, limit)` は属性領域 `[from, limit)`
+ * を持つタグの属性値、無ければ 1。共有の出現カーソルは前進しかせず、属性でない出現
+ * (`mso-ignore:colspan`) は文書全体で 1 回しか調べない — 同じ領域を共有するタグが幾つあっても
+ * O(出現数) (末尾まで届く未閉鎖タグも追加費用なし)。
+ */
+const spanReader = (text: string, name: string, max: number): ((from: number, limit: number) => number) => {
+    let at = text.indexOf(name)
+    return (from, limit) => {
+        // 領域より前の出現は読み飛ばす (単調前進)
+        while (at !== -1 && at < from) {
+            at = text.indexOf(name, at + name.length)
+        }
+        // 領域内の候補を順に読み、属性でない出現は共有カーソルごと越える (再訪しない)
+        for (; at !== -1 && at < limit; at = text.indexOf(name, at + name.length)) {
+            const span = readSpan(text, at, name.length, max)
+            if (span !== null) {
+                return span
+            }
+        }
+        return 1
+    }
+}
+
+/**
+ * Whether the end tag at `i` (`</…`) ends the current row in the HTML parser: `</tr`, `</table`,
+ * `</tbody`, `</thead` or `</tfoot` followed by a token end (`</track` does not).
+ * 位置 `i` の終了タグ (`</…`) が HTML パーサで現在行を終えるか: `</tr` / `</table` / `</tbody` /
+ * `</thead` / `</tfoot` の直後がトークン末尾のとき (`</track` は該当しない)。
+ */
+const closesRow = (text: string, i: number): boolean => {
+    if (text.charCodeAt(i + 2) !== CODE_T) {
+        return false
+    }
+    const third = text.charCodeAt(i + 3)
+    if (third === CODE_R) {
+        return isTokenEnd(text.charCodeAt(i + 4))
+    }
+    // 3 文字目で絞ってから綴りを比べる (`</td` / `</th` の熱経路は比較なしで抜ける)
+    if (third !== CODE_A && third !== CODE_B && third !== CODE_H && third !== CODE_F) {
+        return false
+    }
+    for (const tail of ROW_CLOSER_TAILS) {
+        if (text.startsWith(tail, i + 3) && isTokenEnd(text.charCodeAt(i + 3 + tail.length))) {
+            return true
+        }
+    }
+    return false
+}
+
+/**
+ * One byte-linear pass upper-bound size of the table(s) in an HTML string (ADR-12 — computed
+ * BEFORE any DOMParser is built), over the ASCII-case-folded text because the DOM reads tag and
+ * attribute names case-insensitively: `<tr` / `<td` / `<th` count only when followed by
+ * whitespace, `>` or `/` (`<track` / `<thead` / `<textarea` / `<title` never count), a `<td` before
+ * any `<tr` opens one implicit row, `</tr` (`</table` / `</tbody` / `</thead` / `</tfoot`) closes
+ * the row so a following `<td` opens another, `colspan` is summed per row, a `rowspan` carries its
+ * colspan into the next `rowspan − 1` rows, and the result is rows × the maximum per-row
+ * (carried + Σcolspan) — an UPPER bound of the reader's `rows × cols` (a wide header colspan may
+ * reject an under-cap table). Spans are clamped to the HTML caps the reader applies. Every cursor
+ * only advances, so the cost is O(bytes) whatever the shape. `{ rows: 0, cols: 0 }` without a
+ * table.
+ * HTML 文字列内の表の規模のバイト線形 1 パス上限見積もり (ADR-12 — DOMParser 構築前に計算)。DOM は
+ * tag / 属性名を ASCII 大小無視で読むので折り畳んだ文字列を走査する: `<tr` / `<td` / `<th` は直後が
+ * 空白 / `>` / `/` のときだけ数え (`<track` / `<thead` / `<textarea` / `<title` は非該当)、`<tr` より
+ * 前の `<td` は暗黙行 1 つを開き、`</tr` (`</table` / `</tbody` / `</thead` / `</tfoot`) は行を閉じて
+ * 続く `<td` が次の行を開き、`colspan` を行毎に合計、`rowspan` はその colspan を次の `rowspan − 1`
+ * 行へ持ち越し、結果は rows × 行毎 (持越し + Σcolspan) の最大 — reader の `rows × cols` の上限値
+ * (幅広いヘッダ colspan は上限内の表を拒否し得る)。span は reader と同じ HTML 上限へクランプ。
+ * 全カーソルが前進しかしないので形に依らず O(bytes)。表が無ければ `{ rows: 0, cols: 0 }`。
+ */
+export const estimateHtmlTableCells = (html: string): { rows: number; cols: number } => {
+    // DOM は tag / 属性名を ASCII 大小無視で読む — 折り畳んだ写しを走査する (原文の索引へ戻らないので長さ変化は無害)
+    const text = html.toLowerCase()
+    const colspanOf = spanReader(text, "colspan", HTML_COLSPAN_MAX)
+    const rowspanOf = spanReader(text, "rowspan", HTML_ROWSPAN_MAX)
+    // タグ末尾 `>` の memo (単調前進、-1 は以後のタグが全て未閉鎖 = 末尾まで)
+    let tagEnd = 0
+    const limitOf = (from: number): number => {
+        if (tagEnd !== -1 && tagEnd < from) {
+            tagEnd = text.indexOf(">", from)
+        }
+        return tagEnd === -1 ? text.length : tagEnd
+    }
+    let rows = 0
+    let cols = 0
+    let current = 0
+    let carried = 0
+    let inRow = false
+    // rowspan の持越し幅の差分 (行索引 r で +幅、r + rowspan で −幅)
+    const carryDelta = new Map<number, number>()
+    const addCarry = (rowIndex: number, width: number): void => {
+        const previous = carryDelta.get(rowIndex)
+        carryDelta.set(rowIndex, previous === undefined ? width : previous + width)
+    }
+    const closeRow = (): void => {
+        // 行の幅 = 持ち越された列 + この行の Σcolspan
+        if (inRow && current + carried > cols) {
+            cols = current + carried
+        }
+        inRow = false
+    }
+    const openRow = (): void => {
+        closeRow()
+        rows += 1
+        inRow = true
+        current = 0
+        // この行索引へ入る持越し幅を加える
+        const delta = carryDelta.get(rows - 1)
+        if (delta !== undefined) {
+            carried += delta
+        }
+    }
+    for (let i = text.indexOf("<"); i !== -1; i = text.indexOf("<", i + 1)) {
+        const first = text.charCodeAt(i + 1)
+        if (first === CODE_SLASH) {
+            if (closesRow(text, i)) {
+                closeRow()
+            }
+            continue
+        }
+        if (first !== CODE_T || !isTokenEnd(text.charCodeAt(i + 3))) {
+            continue
+        }
+        const second = text.charCodeAt(i + 2)
+        if (second === CODE_R) {
+            openRow()
+        } else if (second === CODE_D || second === CODE_H) {
+            // `<tr` より前 / 閉じた行の後のセルは暗黙行を開く
+            if (!inRow) {
+                openRow()
+            }
+            const from = i + 3
+            const limit = limitOf(from)
+            const colspan = colspanOf(from, limit)
+            current += colspan
+            const rowspan = rowspanOf(from, limit)
+            // 次の rowspan − 1 行へこの幅を持ち越す
+            if (rowspan > 1) {
+                addCarry(rows, colspan)
+                addCarry(rows - 1 + rowspan, -colspan)
+            }
+        }
+    }
+    closeRow()
+    return { rows, cols }
+}
+
+// ---------------------------------------------------------------------------------------------
+// Copy-side dictionaries (identity → canonical JSON interning)
+// copy 側辞書 (identity → 正準 JSON の intern)
+// ---------------------------------------------------------------------------------------------
+
+/**
+ * The format dictionary builder of one copy: `intern` returns the dictionary index of a format
+ * (undefined when its canonical form is empty — the cell carries no `fmt`), `entries` is the live
+ * dictionary (canonical objects, sorted keys) to place in `ClipPayload.formats`.
+ * copy 1 回の書式辞書ビルダー: `intern` は書式の辞書索引 (正準形が空なら undefined — セルは `fmt`
+ * を持たない)、`entries` は `ClipPayload.formats` に置く生きた辞書 (正準 object、ソート済みキー)。
+ */
+export type ClipFormatInterner = { readonly intern: (format: CellFormat) => number | undefined; readonly entries: readonly CellFormat[] }
+
+/**
+ * The validation dictionary builder of one copy: `intern` returns the dictionary index of a rule
+ * (always defined — a rule is never empty), `entries` the live dictionary for
+ * `ClipPayload.validations`.
+ * copy 1 回の検証辞書ビルダー: `intern` は規則の辞書索引 (常に定義 — 規則が空になることはない)、
+ * `entries` は `ClipPayload.validations` 用の生きた辞書。
+ */
+export type ClipValidationInterner = { readonly intern: (rule: DataValidationRule) => number; readonly entries: readonly DataValidationRule[] }
+
+/**
+ * The key-stage dictionary shared by both interners: a string key per normalised value, one
+ * entry per distinct key (structurally equal fresh objects share it), entries in first-seen order.
+ * 両 interner が共有するキー段の辞書: 正規化値毎の文字列キー、キー毎に 1 エントリ (構造等価な別
+ * object は共有)、エントリは初出順。
+ */
+const createDictionary = <T>(keyOf: (value: T) => string): { intern: (value: T) => number; entries: T[] } => {
+    const entries: T[] = []
+    const byKey = new Map<string, number>()
+    const intern = (value: T): number => {
+        const key = keyOf(value)
+        const known = byKey.get(key)
+        if (known !== undefined) {
+            return known
+        }
+        // 新規キー — 末尾へ追加
+        const index = entries.length
+        entries.push(value)
+        byKey.set(key, index)
+        return index
+    }
+    return { intern, entries }
+}
+
+/**
+ * Creates the format interner of one copy: identity THEN `JSON.stringify(canonicalizeFormat(f))`
+ * (sorted keys at every level = the deterministic key); the dictionary stores the canonical
+ * object; an empty canonical form (e.g. `{ bold: false }`) yields undefined and no entry.
+ * copy 1 回の書式 interner: identity → `JSON.stringify(canonicalizeFormat(f))` (全階層ソート済み
+ * キー = 決定的キー)。辞書は正準 object を保持、空の正準形 (例 `{ bold: false }`) は undefined で
+ * エントリ無し。
+ */
+export const createFormatInterner = (): ClipFormatInterner => {
+    const byIdentity = new WeakMap<CellFormat, number | undefined>()
+    const dictionary = createDictionary<CellFormat>((canonical) => JSON.stringify(canonical))
+    const intern = (format: CellFormat): number | undefined => {
+        // 第 1 段: identity (空の答え undefined も登録済みなら再正準化しない)
+        if (byIdentity.has(format)) {
+            return byIdentity.get(format)
+        }
+        const canonical = canonicalizeFormat(format)
+        // 第 2 段: 正準 JSON (空の正準形はエントリ無し)
+        const index = canonical === undefined ? undefined : dictionary.intern(canonical)
+        byIdentity.set(format, index)
+        return index
+    }
+    return { intern, entries: dictionary.entries }
+}
+
+/**
+ * Creates the validation interner of one copy: identity THEN sorted-key JSON of the rule (key
+ * order independent); the dictionary stores the first rule object seen for each key.
+ * copy 1 回の検証 interner: identity → 規則のソート済みキー JSON (キー順非依存)。辞書はキー毎に
+ * 最初に見た規則 object を保持。
+ */
+export const createValidationInterner = (): ClipValidationInterner => {
+    const byIdentity = new WeakMap<DataValidationRule, number>()
+    const dictionary = createDictionary<DataValidationRule>(stableJson)
+    const intern = (rule: DataValidationRule): number => {
+        // 第 1 段: identity
+        const known = byIdentity.get(rule)
+        if (known !== undefined) {
+            return known
+        }
+        // 第 2 段: ソート済みキー JSON
+        const index = dictionary.intern(rule)
+        byIdentity.set(rule, index)
+        return index
+    }
+    return { intern, entries: dictionary.entries }
+}