fix: schema hygiene and SQL parameterization (COW-997, COW-998)

[lgahdl]

Summary

Two small hygiene fixes from the grant review targeting dead schema and inconsistent SQL patterns.

Changes

• COW-997 [F4] src/application/handlers/setup.ts — remove the cow_cache.orderbook_cache CREATE TABLE block. The table had 0 rows and 0 reads/writes anywhere in the codebase; the live persistent cache is cow_cache.order_uid_cache. Also updated the file-level doc comment which referenced the removed table.
• COW-998 [F6] src/application/helpers/orderbookClient.ts — replace manual string interpolation ('${uid.replace(...)}' ) with sql.join(batch.map(uid => sql\${uid}`), sql`, `)ingetCachedUidStatuses`. Now consistent with the parameterized pattern used for cache writes in the same file.

How to Test

1. pnpm typecheck — no errors
2. pnpm test — all tests pass

Checklist

• Tests pass locally
• Linting passes
• Documentation updated (if needed)
• Breaking changes documented (if any)

Breaking Changes

None — orderbook_cache had no rows and no consumers. The sql.join produces semantically identical queries with bound parameters instead of interpolated strings.

Related Issues

Closes COW-997
Closes COW-998

[linear-code]

COW-997

COW-998

[lgahdl]

The SQL parameterization change in getCachedUidStatuses is the right fix. Replacing sql.raw(...) string-interpolation with sql.join(batch.map(uid => sql${uid}), sql, ) correctly delegates value binding to Drizzle/the driver so UIDs are passed as parameters, not interpolated literals — closing the injection risk that existed whenever a UID contained a single quote or other SQL metacharacter.

sql.join is part of Drizzle ORM's core tagged-template utilities and is available in the version Ponder 0.16.x bundles, so no compatibility concern there. The resulting SQL fragment slots directly into the WHERE ... IN (...) position in the surrounding sql...`` template, which is the supported usage pattern.

The legacy orderbook_cache table drop in setup.ts is a nice cleanup alongside this — good to remove dead DDL rather than let it accumulate. Approving.

[lgahdl]

Review: SQL parameterization + schema hygiene

sql.join compatibility — confirmed safe

Checked drizzle-orm 0.41.0 (the installed version via pnpm, pinned transitively by ponder 0.16.2). sql.join exists on the sql tag function, and ponder re-exports sql directly from drizzle-orm (export { sql, … } from "drizzle-orm"). The generated query is WHERE chain_id = $1 AND order_uid IN ($2, $3, …) — fully parameterized, no string interpolation. The pattern is safe and correct.

setup.ts — removal of cow_cache.orderbook_cache

The legacy table creation is removed. Since this is inside CREATE TABLE IF NOT EXISTS, existing deployments where the table already exists are unaffected. New deployments won't create the table. Make sure there are no remaining references to cow_cache.orderbook_cache anywhere in the codebase before merging — a stale query against a non-existent table would throw at runtime with no warning.

# Quick check
grep -r "orderbook_cache" src/

Everything else in the diff is clean. No other concerns.

[yvesfracari]

would prefer something like:

const rows = await context.db.sql
  .select({
    orderUid: orderUidCache.orderUid,
    status: orderUidCache.status,
    executedSellAmount: orderUidCache.executedSellAmount,
    executedBuyAmount: orderUidCache.executedBuyAmount,
  })
  .from(orderUidCache)
  .where(
    and(
      eq(orderUidCache.chainId, chainId),
      inArray(orderUidCache.orderUid, batch),
    ),
  );