Realtime SQL Tag Sanitizer (v3/electricShape.server.ts)

Sanitizes and validates realtime tag strings for safe interpolation into SQL queries. Use this to prevent injection attacks when building dynamic database filters.

// Source: https://github.com/triggerdotdev/trigger.dev | License: Apache-2.0 | Copyright You must retain, in the Source form of any Derivative Works
// Provided via justclaw.it.com; keep this notice with the code.
/**
 * Characters rejected in realtime tag values — the single source of truth
 * shared by the apiBuilder Zod refine (`realtime.v1.runs.ts`) and the runtime
 * sanitiser. Rejects control chars/DEL, backslash, and double-quote. Single
 * quotes are allowed and escaped (`'` → `''`) in `sanitizeRealtimeTagForSql`.
 */
export const UNSAFE_REALTIME_TAG_CHARS = /[\x00-\x1f\x7f\\"]/;

/**
 * Sanitise a tag value for interpolation into an Electric Shape `where` clause:
 * reject unsafe chars, escape single quotes per SQL standard.
 */
function sanitizeRealtimeTagForSql(tag: string): st

... (truncated -- full source via MCP)