fix(storage): escape SQL wildcards in KV prefix queries, log parse errors (#73)

C1: Escape `%`, `_`, and `\` in user-supplied prefix before building the
LIKE clause in `kvList`, and add `ESCAPE '\\'` to the query so wildcard
characters in key prefixes cannot bypass prefix-boundary filtering.

C3: Add `console.warn` in `parseJsonField` and `parseStringArray` so
corrupt stored values surface in Cloudflare Worker logs instead of
silently returning null / [].

Fixes #72.

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: secret-mars

src/durable-objects/StorageDO.ts

@@ -36,7 +36,8 @@ function parseJsonField(value: unknown): Record<string, unknown> | null {
   if (!value) return null;
   try {
     return JSON.parse(value as string);
-  } catch {
+  } catch (e) {
+    console.warn('parseJsonField: failed to parse stored JSON value', e);
     return null;
   }
 }
@@ -50,7 +51,8 @@ function parseStringArray(value: unknown): string[] {
   try {
     const parsed = JSON.parse(value as string);
     return Array.isArray(parsed) ? parsed : [];
-  } catch {
+  } catch (e) {
+    console.warn('parseStringArray: failed to parse stored JSON array value', e);
     return [];
   }
 }
@@ -258,8 +260,9 @@ export class StorageDO extends DurableObject<Env> {
     const params: unknown[] = [];
 
     if (options?.prefix) {
-      query += " WHERE key LIKE ?";
-      params.push(`${options.prefix}%`);
+      query += " WHERE key LIKE ? ESCAPE '\\'";
+      const escapedPrefix = options.prefix.replace(/[%_\\]/g, '\\$&');
+      params.push(`${escapedPrefix}%`);
     }
     query += " ORDER BY key LIMIT ?";
     params.push(limit);