[notsuhas]

Stacked on #18. Adds window.storage, the storage API Claude artifacts expose, so sandboxed pages can keep small values across visits.

await window.storage.set(key, value)   // -> { key, value, shared: false }
await window.storage.get(key)          // -> { key, value, shared: false }, throws if missing
await window.storage.delete(key)       // -> { key, deleted: true, shared: false }
await window.storage.list(prefix?)     // -> { keys }

Keys are private to each viewer. Claude's shared = true is refused with an error pointing at postplan.db; nothing is shared across viewers. Nothing is stored unless a page calls set, and rows go with the site and with the user.

• site_kv table (siteId, userId, key, value, bytes), both FKs cascade. Keys up to 200 chars with no spaces, slashes or control chars; values up to 1 MB; 5 MB and 1,000 keys per viewer per site, checked and written in one statement.
• /api/_data/_kv[/key] is its own terminal sub-app with its own capability table: reads need read, writes need create.
• list is a case-sensitive prefix match over the primary key, at most 1,000 keys.
• postplan.db collection names starting with _ are now reserved (prod has no documents, so nothing breaks).

Migration: 0036_site_kv — apply before deploying.

Testing

• bun run test: per-viewer isolation, quota by bytes and by key count, case-sensitive prefix list, user delete cascade, read-only token can't write, /_kv is terminal; broker mapping and validation tests. Typecheck, biome, dead-code clean.
• Local dev stack: a page counted visits across reloads (visits=2) and set(..., true) rejected.

🤖 Generated with Claude Code