fix(wl-sdk): escape SQL LIKE wildcards in one pass

[kilo-code-bot]

Summary

• Refactor escapeSqlLike to escape SQL LIKE wildcards in a single global replacement pass, addressing CodeQL alert 433 without changing the emitted escapes.
• Add coverage for repeated % and _ wildcards so the helper keeps escaping every occurrence.

Verification

N/A - security helper change with no manual UI flow.

Visual Changes

N/A

Reviewer Notes

Targets only CodeQL alert 433 (js/incomplete-sanitization) in packages/wl-sdk/src/commons/escape.ts.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Executive Summary

Minimal, correct security fix — replaces two sequential replace calls with a single-pass character-class replacement to address CodeQL alert 433 (js/incomplete-sanitization), with a matching regression test.

Files Reviewed (2 files)

• packages/wl-sdk/src/commons/escape.ts
• packages/wl-sdk/src/commons/escape.test.ts

---

_{Reviewed by claude-4.6-sonnet-20260217 · 254,411 tokens}

_{Review guidance: REVIEW.md from base branch main}