1. dialects
prorm
  • prorm documentation
  • Known test gaps
  • Architecture
  • Core concepts
  • Database types & coverage
  • Getting started
  • Going further
  • compliance
    • Compliance
    • The security toolkit: `prorm audit`
    • Checklists by regulation
    • Declaring personal data
    • Evidence bundles
    • Evidence
    • Frameworks: `@Security`
    • Jurisdictions
    • Platform policies
    • Protecting data
    • The regulation dataset
    • Residency and cross-border transfers
    • Retention & integrity
    • Status
    • Subject rights
  • decorators
    • prorm with decorators
    • Models with decorators
    • Querying a decorated model
    • Relations with decorators
  • diagrams
    • Diagram generators
    • Chen diagram
    • Class diagram
    • Dependency diagram
    • ER diagram
    • Flow diagram
    • From your models to a diagram
    • Gantt diagram
    • Index diagram
    • Migration diagram
    • Model diagram
    • Package diagram
    • Crow’s-foot diagram
    • Schema documentation
    • Sequence diagram
    • State diagram
    • Tree diagram
  • dialects
    • SQL dialects
    • AlloyDB Dialect
    • AlloyDB Omni Dialect
    • Amazon Athena Dialect
    • Aurora DSQL Dialect
    • Amazon Aurora MySQL Dialect
    • Amazon Aurora PostgreSQL Dialect
    • Azure Database for MySQL Dialect
    • Azure Database for PostgreSQL Dialect
    • Azure SQL Database Dialect
    • Azure SQL Managed Instance Dialect
    • Google BigQuery Dialect
    • Citus Dialect
    • ClickHouse dialect
    • Cloud Authentication (`cloud-auth`)
    • Cloud SQL for SQL Server Dialect
    • Cloud SQL for MySQL Dialect
    • Cloud SQL for PostgreSQL Dialect
    • CockroachDB Dialect
    • Azure Cosmos DB for PostgreSQL Dialect
    • CrateDB Dialect
    • Cloudflare D1 Dialect
    • Databricks dialect
    • IBM Db2 Dialect
    • Dolt Dialect
    • Apache Doris Dialect
    • Druid Dialect
    • DuckDB Dialect
    • Exasol dialect
    • Microsoft Fabric Data Warehouse Dialect
    • Firebird Dialect
    • Greenplum Dialect
    • SAP HANA Dialect
    • MySQL HeatWave Dialect
    • Azure Data Explorer (Kusto) Dialect — T-SQL
    • MariaDB Dialect
    • Materialize Dialect
    • MonetDB Dialect
    • MotherDuck Dialect
    • Microsoft SQL Server Dialect
    • MySQL Dialect
    • Neon Dialect
    • OceanBase Dialect
    • openGauss Dialect
    • Oracle Dialect
    • Oracle Autonomous Database Dialect
    • ParadeDB Dialect
    • PolarDB Dialect
    • PostgreSQL Dialect
    • Presto Dialect
    • QuestDB Dialect
    • Aurora RDS Data API Dialect (`rdsdata`)
    • Amazon RDS for Db2 Dialect
    • Amazon RDS for MariaDB Dialect
    • Amazon RDS for SQL Server Dialect
    • Amazon RDS for MySQL Dialect
    • Amazon RDS for Oracle Dialect
    • Amazon RDS for PostgreSQL Dialect
    • Amazon Redshift
    • Amazon Redshift Data API Dialect
    • RisingWave Dialect
    • rqlite Dialect
    • SingleStore Dialect
    • Snowflake Dialect
    • Google Cloud Spanner Dialect
    • Spanner (PostgreSQL interface) Dialect
    • SQLite Dialect
    • StarRocks Dialect
    • Supabase Dialect
    • Azure Synapse Analytics (dedicated SQL pool)
    • Teradata Dialect
    • TiDB Dialect
    • TimescaleDB Dialect
    • Trino Dialect
    • Turso / libSQL Dialect
    • Vertica dialect
    • Vitess Dialect
    • Yellowbrick Dialect
    • YugabyteDB Dialect
  • guides
    • Access rules and behaviour profiles
    • ArangoDB (AQL)
    • Associations
    • Audit levels and escalation
    • Audit logging
    • In the browser
    • Bulk operations
    • Caching
    • Capabilities, tiers and team roles
    • CLI
    • Cloudflare
    • Compliance & data protection
    • Connection Pooling & Performance
    • Security in the console
    • Couchbase: structured N1QL queries
    • Data types
    • Decorators
    • Eager loading
    • Enums and constants
    • Error handling & error types
    • Extensions
    • External fields
    • Foreign data wrappers
    • Graph databases
    • Hooks & lifecycle events
    • Indexes & constraints
    • InfluxDB: structured Flux pipelines
    • klock-errors
    • klock — the `.klock` file
    • Local databases (`prorm db up`)
    • Structured log search — Splunk, Graylog, Papertrail, Sumo Logic
    • Logging
    • Grafana Loki: structured LogQL queries
    • MCP server
    • Migrate — the data transfer subsystem
    • Migrations & Schema Sync
    • Models from an existing database
    • Defining models
    • Multiple databases
    • OrientDB, Neptune and TigerGraph
    • Passwords
    • Importing a Prisma schema
    • Structured PromQL and MetricsQL
    • Query firewall
    • QueryInterface
    • Query operators reference
    • Query optimization
    • Composing find options with `pipe()` and `Q`
    • Query safety: the fail-closed WHERE guard
    • Querying
    • Raw Queries & Query Building
    • Read replicas
    • Schema diffing & migration generation
    • Views, triggers & other schema objects
    • Scopes & default scopes
    • Seeders
    • SPARQL / RDF triplestores
    • SQL constants
    • SQL features
    • SQL function builders
    • SQLite advanced features
    • StoreKey — a prod-orm database as the storage
    • Streaming results
    • Terraform
    • Transactions & Isolation Levels
    • Type mapping: legacy and modern
    • TypeScript types
    • Database users, roles & privileges
    • Validation & constraints
    • Virtual & Computed Fields
    • Writing docs
  • javascript
    • prorm in JavaScript
    • Models in JavaScript
    • Querying in JavaScript
    • Relations in JavaScript
  • runbooks
    • Operational runbooks
    • Connection failures
    • Credential rotation
    • Failover
    • Incident checklist
    • Deploying klock v2
    • Migration rollback
  • running-databases
    • Running databases in Docker
    • Running prorm under Bun in Docker
    • Running Cassandra in Docker with prorm
    • Running ClickHouse in Docker with prorm
    • Running CockroachDB in Docker with prorm
    • Running prorm under Deno in Docker
    • Running Elasticsearch in Docker with prorm
    • Running MariaDB in Docker with prorm
    • Running MongoDB in Docker with prorm
  • prorm control plane
    • Introduction
    • Authentication
    • Errors
    • Getting started
      • Service
        • Is it up
        • This description
    • Account
      • Sign-up and verification
        • Create an account
        • Exchange credentials for a token
        • Verify with the emailed code
        • Verify by clicking the emailed link
        • Name the parent or guardian
        • What a consent link is about
        • Give consent for a child's account
        • Ask the parent or guardian again
        • Send a new code and link
      • Family
        • Everyone this account is responsible for
        • One child, in detail
        • Turn a limit on or off
      • Profile
        • Who am I
        • Change the account
        • Every address on the account
        • Add an address
        • Confirm an address with the code mailed to it
        • Mail a fresh code to an unconfirmed address
        • Make an address primary
        • Remove an address
        • What this caller may do
    • Security
      • Sessions
        • Everywhere this account is signed in
        • Sign out everywhere else
        • Sign one out
        • A token for the CLI on a named machine
        • A token for the customer console, from the staff one
        • Park a sign-in for the CLI to collect
        • The CLI collecting its sign-in
        • The team's members' live sessions
        • Sign a member's session out
        • Sign an account out everywhere
        • Everywhere the account is signed in
        • Sign an account's session out
      • Single sign-on
        • Begin a single sign-on
        • The provider's return
        • Link the signed-in account to a team's provider
        • Which team an address signs in to
        • The team's single sign-on, as a member sees it
        • Set the team's OpenID Connect provider up, or change it
        • Remove the provider
        • The team's domain claims and the DNS record each needs
        • Prove a claimed domain
      • MFA and passwords
        • Start enrolling a second factor
        • Prove the app has it
        • Remove the second factor
        • Ask for a reset link
        • Set a new password with the emailed token
      • Klock
        • Open a device-bound klock session
        • Check in, for the next grant
        • Step up the session asking
        • Rotate the device key
        • Freeze a session
        • Unfreeze a session
        • A guest grant
        • The revocation feed
        • The published keyset
        • What this control plane supports
      • Devices
        • Your devices, or a team's
        • Approve a new device's pairing code
        • One device
        • Rename a device
        • Revoke a device
        • Suspend a device
        • Reinstate a suspended device
        • Wipe a device
        • Ask a device to rotate its key
        • The team's members' devices
        • Revoke a member's device
        • An account's devices
        • Revoke an account's device
        • Wipe an account's device
        • The device fleet
      • Access rules and behaviour
        • The access rules that bear on you
        • Add an access rule
        • This request, as the rules see it
        • One access rule
        • Remove an access rule
        • The behaviour profiles that bear on you
        • Add or change a behaviour profile
        • The profile presets
        • Your behaviour findings
        • Acknowledge a finding
        • One behaviour profile
        • Remove a behaviour profile
        • The team's access rules
        • Add a team access rule
        • Remove a team access rule
        • The team's behaviour profiles
        • Add or change a team behaviour profile
        • Remove a team behaviour profile
        • What the team's profiles caught
        • Acknowledge a team finding
      • Recovery and lockdown
        • Ask for a recovery link
        • Recover access with the emailed code
        • Is the account locked down
        • Lock the account down
        • Release a lockdown
        • Lock a member down
        • Release a member's lockdown
      • MCP tokens
        • Make a delegated token for one MCP client
        • The account's delegated tokens
        • Revoke a delegated token
        • What a delegated token may do now
        • Run one MCP tool with a delegated token
        • Run a device-signed MCP tool call relayed by the MCP Worker
      • Kerberos
        • Give the team its own Kerberos realm
        • The team's realm
        • Remove the team's realm
    • Logging and monitoring
      • Audit log
        • What has been done to the account
        • What has happened to this account
        • The account's audit trail
      • Operations
        • Everything that has been asked of this database
        • One, with its steps
        • Stop it
        • Put a failed one back in the queue
        • Every operation, across all accounts
      • Metrics and events
        • Every measurement, for a graph
        • Who did what to it
    • Billing
      • Plans and pricing
        • What the plans allow
        • The rate card
        • What one database would cost
        • What this account is paying for, itemised
      • Subscriptions and invoices
        • What this month's invoice will say
        • What this account is on
        • What it has been charged
        • Start a Stripe Checkout session
        • Open the customer portal
        • Stripe's events
        • Buy more connection pools
      • Team billing
        • The team's billing account
        • What the team has been charged
        • What this month's invoice will say
        • The team's cards
        • Add a card, through a Stripe-hosted setup session
        • Make a card the team's default
        • Remove a card
        • Start the team paying
        • Open the Stripe portal on the team's customer
        • Change the team's plan
        • Who receives the team's bills
        • How the team pays for transfers
    • Support
      • Support chat
        • My conversations
        • Start a conversation
        • Every support conversation, open first
        • A ticket for the socket
        • One conversation, with who is in it and who is connected
        • Rename a group; open or close a support conversation
        • The lines, oldest first
        • Say something
        • Add somebody
        • Mark read
    • Administration
      • Users
        • Every account
        • One account, with everything hanging off it
        • Grant or revoke admin
        • Verify an account by hand
        • Lock or unlock sign-in
        • Allow or hold provisioning
        • Send the verification mail again
        • Set the plan by hand
      • Platform
        • Every database and store, across all accounts
        • The counts worth putting on a dashboard
      • Staff and permissions
        • What kind of admin the caller is, and which scopes they hold
        • The admin presets
        • Every admin, and the scopes each resolves to
        • Make an account an admin of a kind
        • Change an admin's kind, or a custom admin's scopes
        • Revoke admin
      • Team administration
        • Every team, with its owner and size
        • One team in full — members with their accounts, and projects
        • Hand the team to another member
        • Put an account in the team, active at once
        • Change a member's role
        • Remove a member
      • Assumed identities
        • Assume an identity — act as a customer account
        • The identities the caller holds open
        • End an assumed identity
      • Support inbox
        • The platform's addresses
        • Add a platform address
        • One address, with its counts
        • Change an address's label, routing, or whether it accepts mail
        • Remove an address that holds no mail
        • Make, adopt or repair the address's routing rule
        • Every admin's personal address, made where missing
        • File a raw message, as if it had arrived
        • The inbox
        • One message, whole
        • Mark a message
        • Hand a message to an admin, or take it back
        • Leave an internal note
        • Reply, from the address the message came to
        • What is waiting
    • Databases
      • Databases
        • Data stores
          • Every data store on the account
          • Provision a data store
          • Change a data store that is already running
          • One data store
          • Deprovision it
          • Report what it is using
          • How to reach a data store
        • Connections and credentials
          • The api keys on a database
          • Issue a key
          • Revoke a key
          • The engine users we created
          • Create a user inside the database
          • Give a user a new password
          • Drop a user
          • How the database is reached
          • Set how it is reached
          • Revoke every api key on it
          • How to connect to it
          • The ssh keys that open its bastion
          • Add a key, or have one made
          • The private half of a generated key, once
          • Revoke an ssh key
        • Schema and objects
          • The SQL objects we put in it
          • Create one, and apply it
          • What is in the database, as the engine reports it
          • One table
          • What it would run, without running it
          • Redefine an object in place
          • Drop it
          • The extensions installed in it
        • Migrations
          • A plan compiled to statements, recording nothing
          • The migrations recorded for it
          • Record one
          • Apply everything recorded and not yet run
          • Apply everything pending, oldest version first
        • Lifecycle
          • Grow or shrink it
          • Stop it accepting connections
          • Start it again
          • Move it to another region
        • Backups and replicas
          • Take a backup
          • The backups it has
          • Restore one into it
          • What has been restored into it, and from where
          • Its read copies
          • Add one
        • Policies
          • The catalog
          • One policy
          • What this database is held to
          • Switch a policy on, or change its knobs
          • Switch it off
          • Mark the policies reviewed
          • Evaluate the periodic policies now
          • Who is behind a credential
        • Passwordless
          • The database's passwordless sessions
          • Issue a passwordless session (v1)
          • Revoke a passwordless session
          • Bind a session to a device key
          • Issue a v2 session for a host to bind
          • Redeem an enrolment ticket on the host
          • Check a passwordless credential
          • Run one described query under a passwordless credential
        • Database roles
          • The database's roles
          • Define a role
          • One role
          • Change what a role permits
          • Delete a role, and revoke every key granted it
          • Grant a role, which mints a key
          • Who holds a role
          • The api keys bound to a role
        • Pools
          • A database's connection pools, and how busy each is
          • Open another pool
          • Rename a pool or change its size
          • Close a pool
        • Data plane
          • Run a query against a database
          • Several statements, in order, over one connection
          • Is this database answering
          • What the proxy itself is holding
        • Transfers
          • The strategies this account's tier may use
          • Price a transfer without creating it
          • The account's transfer jobs, newest first
          • Create a transfer job
          • One job, and whether its certificate holds
          • Cancel an unfinished job
          • Start a created job, confirming its price
          • Report a job's status (the runner, or the owner's side of a local run)
        • Every database on the account
        • Provision a database
        • Change a database that is already running
        • One database
        • Deprovision it
        • Read or write it
        • Report what it is using
        • The engines this API will provision
        • Where a managed database can be put
    • Teams
      • Teams
        • Members
          • Who is on it
          • Invite somebody
          • Accept an invitation
          • Change somebody's role
          • Remove somebody
        • Projects
          • The projects a team runs
          • Start one
          • Rename a project, or move its environment
          • Delete a project
          • One project, and what is in it
          • Put a database or store in it
          • What is in a project
          • Take one out
        • The teams this account is on
        • Start one
        • The twelve roles, and what each may do
        • Rename a team
        • Close a team
        • One team
        • Hand the team to somebody else
        • Leave a team
    • Schemas
      • Error
      • ValidationErrors
      • Token
      • PolicyCategory
      • PolicySeverity
      • PolicyAction
      • PolicyTrigger
      • PolicyParam
      • Policy
      • PolicyCatalog
      • PolicyAssignment
      • PolicyOutcome
      • PolicyFiring
      • CredentialTrace
      • Relation
      • Restrictions
      • ChildSummary
      • SignupRequest
      • SigninRequest
      • UpdateMeRequest
      • User
      • Address
      • GeoPoint
      • D1Region
      • Usage
      • UsageReport
      • Resource
      • Database
      • DataStore
      • NewDatabase
      • NewDataStore
      • QueryRequest
      • DatabasePrivilege
      • ApiKey
      • DbUser
      • Access
      • AccessRequest
      • DatabaseObject
      • NewDatabaseObject
      • NewMigration
      • SchemaOperation
      • Migration
      • Operation
      • Session
      • AdminPowers
      • Admin
      • AuditEntry
      • TeamRole
      • Conversation
      • ChatMessage
      • TeamSso
      • Team
      • TeamMember
      • SshKey
      • ConnectionInfo
      • InboxAddress
      • InboxMailbox
      • InboxMessageSummary
      • InboxMessage
      • InboxNote
      • Page
      • Quote
      • Plan
      • ApiError
      • CapabilityRefusal
      • KlockErrorCode
      • PageWindow
      • SessionView
      • KlockStepUpRequest
      • KlockOpenRequest
      • KlockOpenedSession
      • UpdateMeResult
      • CapabilitiesView
      • SessionLimits
      • Device
      • DeviceListed
      • DeviceTeamRef
      • DeviceCommand
      • DeviceAuditLine
      • DeviceActionRequest
      • StaffActionRequest
      • ManagedSession
      • SessionRevoked
      • AccessRule
      • AccessRuleRequest
      • BehaviourProfile
      • BehaviourProfileRequest
      • BehaviourProfileSaved
      • BehaviourFinding
      • BehaviourFindingAck
      • StepUpProof
      • Removed
      • MemberLockdownRequest
      • McpClient
      • McpDelegatedView
      • McpToolCall
      • McpForwardRequest
      • PasswordlessScope
      • RoleScope
      • PasswordlessSession
      • PasswordlessTlsMaterial
      • PasswordlessKerberosMaterial
      • ServiceDeviceKeys
      • ServiceSession
      • DatabaseRole
      • TransferEndpoint
      • TransferJobRequest
      • TransferQuote
      • TransferStrategy
      • TransferJob
      • TransferJobAccess
      • Pool
      • PoolAllowance
      • BillingSubscription
      • Invoice
      • BillingContact
      • PaymentMethod
      • UpcomingCharges
      • TeamBilling
      • TeamKerberosRealm
      • TeamSsoDomain
      • TeamSsoResponse
      • StoreConnection
      • BatchFailure
      • ProxyStatus
  1. dialects

AlloyDB Dialect

Reference for the alloydb SQL dialect (Google Cloud AlloyDB for PostgreSQL).
Source: alloydb
Tests: alloydb

Overview#

AlloyDB is Google Cloud's managed,
PostgreSQL-compatible database (and AlloyDB Omni, its downloadable edition).
The query layer, wire protocol and client (pg on port 5432) are PostgreSQL's,
so AlloyDBDialect extends PostgresDialect and inherits the whole
surface — sequences, triggers, ON CONFLICT, partitioning, LISTEN/NOTIFY
— unchanged.
PropertyValue
Dialect namealloydb
ExtendsPostgresDialect
Driverpg
Default port5432
Cloud SDKgoogle-auth-library (IAM only)
Local runtimenone — hosted service only
What AlloyDB adds sits beside the PostgreSQL surface, as functions and
extensions:
Columnar engine — an in-memory column store the planner uses for
analytical scans, managed with google_columnar_engine_add / _drop /
_refresh / _estimate, and sized by google_columnar_engine_recommend.
Model integration (google_ml_integration) — embedding(model, text)
generates embeddings in SQL, ml_predict_row calls a model endpoint, and
google_ml.create_model registers one.
Vector search — pgvector plus AlloyDB's ScaNN index
(alloydb_scann, CREATE INDEX ... USING scann (col cosine)).
Every builder here is pure and synchronous. Where a statement can carry bind
parameters (queries, CALL) values come back as $n bindings; where it is
DDL, values are escaped with escape() and identifiers with escapeId(). No
builder accepts a raw SQL fragment from the caller.
Unlike some sibling dialects (e.g. Dolt, Presto),
AlloyDB is registered with Prorm: alloydb is a SqlDialect enum
member, has a loader in DIALECT_LOADERS (src/dialects/loaders.ts), a
default port entry in src/connection-url.ts, and is listed alongside Citus
and ParadeDB in src/schema-objects.ts as "PostgreSQL itself with extensions
or a distribution layer" for schema-introspection purposes. So it can be
reached either by name through Prorm, or by importing the class directly.

Quick start#

Install#

$ npm install ts-prorm-orm pg
$ pnpm add ts-prorm-orm pg
$ yarn add ts-prorm-orm pg
$ bun add ts-prorm-orm pg
pg is the same driver the postgres dialect uses. pg-copy-streams is optional: only the features that need it load it.

Connect#

import { Prorm } from 'ts-prorm-orm';

export const db = new Prorm({
  dialect: 'alloydb',
  host: '10.0.0.5',
  database: 'app',
  username: 'app',
  password: process.env.DB_PASSWORD,
});
import { Prorm } from 'ts-prorm-orm';

export const db = new Prorm({
  dialect: 'alloydb',
  url: 'alloydb://app:secret@10.0.0.5:5432/app',
});
A URL is folded into host, port, database, username and password before the dialect is built; any of those passed alongside it wins.

Define a model#

import { DataTypes } from 'ts-prorm-orm';

const User = db.define('User', {
  id: { type: DataTypes.INTEGER(), primaryKey: true, autoIncrement: true },
  email: { type: DataTypes.STRING(255), allowNull: false, unique: true },
  name: { type: DataTypes.STRING(100) },
  meta: { type: DataTypes.JSONB() },
});

await db.sync(); // CREATE TABLE — see Generated SQL below
meta is JSONB, which the containment query below needs.

Query#

import { Op } from 'ts-prorm-orm';

await User.create({ email: 'ada@example.com', name: 'Ada' });

const page = await User.findAll({
  where: { name: { [Op.like]: 'A%' } },
  order: [['id', 'ASC']],
  limit: 20,
  offset: 40,
});

Managed and cloud variants#

One tab per way of logging in. The token-based ones fetch a short-lived token for every new pooled connection, so a pool that outlives a token keeps working; Cloud authentication covers the providers, caching and TLS rules behind them.
import { Prorm } from 'ts-prorm-orm';

export const db = new Prorm({
  dialect: 'alloydb',
  host: '10.0.0.5',
  database: 'app',
  username: 'app',
  password: process.env.DB_PASSWORD,
});
import { Prorm } from 'ts-prorm-orm';

export const db = new Prorm({
  dialect: 'alloydb',
  host: '10.0.0.5',
  database: 'app',
  username: 'svc@my-project.iam.gserviceaccount.com', // suffix stripped for you
  dialectOptions: {
    iam: true, // Application Default Credentials
  },
});
Needs google-auth-library installed next to the driver.

Generated SQL#

Each block is the statement the model call above it hands the dialect's query(), captured with the driver stubbed out. The model layer inlines the values.

Create table#

db.sync() for the model in the Quick start:
CREATE TABLE

Insert, update and delete#

await User.create({ email: 'ada@example.com', name: 'Ada' });
await User.update({ name: 'Grace' }, { where: { email: 'ada@example.com' } });
await User.destroy({ where: { id: 1 } });

Upsert#

await User.upsert({ id: 1, email: 'ada@example.com', name: 'Ada Lovelace' });
upsert() also reads the row by primary key before and after the write, to return the instance.

Pagination#

await User.findAll({
  where: { name: { [Op.like]: 'A%' } },
  order: [['id', 'ASC']],
  limit: 20,
  offset: 40,
});

JSON#

Containment on the meta column:
import { Op } from 'ts-prorm-orm';

await User.findAll({ where: { meta: { [Op.contains]: { plan: 'pro' } } } });

Transaction with a savepoint#

await db.transaction(async (t) => {
  await User.create({ email: 'grace@example.com', name: 'Grace' }, { transaction: t });
  // A nested transaction is a SAVEPOINT; its failure undoes only its own work.
  await db
    .transaction(async (sp) => {
      await User.destroy({ where: { id: 1 }, transaction: sp });
      throw new Error('keep the row');
    }, { transaction: t })
    .catch(() => {});
});

Skip locked rows (SKIP LOCKED)#

A worker that claims rows from a queue table should pass over rows another transaction holds rather than wait for them. lock with skipLocked inside a transaction:
await db.transaction(async (t) => {
  await User.findAll({ where: { name: 'Ada' }, lock: { level: 'UPDATE', skipLocked: true }, transaction: t });
});
Type mapping for the portable descriptors: STRING → VARCHAR(255), auto-increment INTEGER → SERIAL, BOOLEAN → BOOLEAN, DATE → TIMESTAMP, UUID → UUID, JSON → JSON. The type comparison lines the major engines up side by side.

Connection#

import { Prorm } from 'ts-prorm-orm';
// or, constructed directly:

const orm = new Prorm({
  dialect: 'alloydb',
  host: 'localhost',
  // port defaults to 5432
  username: 'postgres',
  password: process.env.PG_PASSWORD,
  database: 'app',
});

// equivalently:
const d = new Prorm({
  dialect: 'alloydb',
  host: 'localhost',
  database: 'app',
});
AlloyDBDialectOptions is PostgresDialectOptions plus iam. The
constructor sets the default port and, when iam is set, builds the token
provider (no SDK is loaded and nothing touches the network until a connection
is opened).

IAM database authentication#

import { Prorm } from 'ts-prorm-orm';

const orm = new Prorm({
  dialect: 'alloydb',
  host: '10.0.0.5', // the instance's IP (direct connection)
  database: 'app',
  username: 'svc@my-project.iam.gserviceaccount.com', // suffix stripped for you
  dialectOptions: {
    iam: true, // Application Default Credentials
    // iam: { keyFilename: '/secrets/sa.json' } | { credentials } | { authClient }
    // iam: { tokenProvider }   // any TokenProvider; google-auth-library is not loaded
  },
});
With iam set, the dialect overrides the Postgres resolvePoolConfig hook:
password becomes pgAuth(googleIamTokenProvider({ target: 'alloydb' }))'s
async function, so every new pooled connection (and the LISTEN
client) gets a current OAuth 2.0 token for the alloydb.login scope;
user becomes googleIamDatabaseUser(username, 'postgres') — the email,
with a service account's .gserviceaccount.com removed;
ssl defaults to { rejectUnauthorized: false } when you give none.
The instance needs the alloydb.iam_authentication flag on, and the
principal must have been added to the cluster as an IAM database user (see
Google's "Manage IAM authentication" guide). google-auth-library is an
optional peer dependency, loaded on the first token request.
TLS. Direct AlloyDB connections are encrypted by default but do not
support verify-ca / verify-full, so a token sent over one travels over
TLS that does not verify the server. pgAuth logs this once (pass
iam: { logger } to route it). For verified transport, run the AlloyDB Auth
Proxy — it does mTLS, and with --auto-iam-authn performs the IAM login
itself, so you connect to it with the plain alloydb dialect and no iam.

TLS: default vs. strict#

By default (tls: 'prefer-verify', the implicit default) an IAM-authenticated
connection with no explicit ssl sends ssl: { rejectUnauthorized: false } —
encrypted, not certificate-verified — and logs a one-time warning per dialect
instance (through tlsLogger, default console.warn):
[prorm alloydb] Connection is encrypted but the server certificate is not verified
(ssl.rejectUnauthorized is false): AlloyDB direct connections don't support verify-ca.
To verify the server, connect through the AlloyDB Auth Proxy (mTLS) or pass your own
`ssl.ca`. To require verification instead of falling back, set tls: 'verify'.
Set tls: 'verify' to refuse that fallback: with IAM on and no explicit
ssl, connecting throws before any network I/O, naming ssl (via the Auth
Proxy or your own ssl.ca) as what to set. An explicit ssl always wins over
either mode, in both cases.
new Prorm({
  dialect: 'alloydb',
  username: 'svc@proj.iam.gserviceaccount.com',
  dialectOptions: {
    iam: true,
    tls: 'verify', // throws unless you also pass `ssl` yourself
  },
});
dialect.tlsPosture() reports the resulting posture without connecting —
'verified' (explicit ssl that verifies), 'unverified' (the default
fallback), or 'none' (IAM off, so no TLS default applies; or tls: 'verify'
would refuse the connection outright).
No Node.js connector. Google documents AlloyDB Language Connectors for
Java, Python and Go only. @google-cloud/alloydb-connector does not exist on
the npm registry (it returns 404), and this dialect does not load it.
Earlier versions of this page said otherwise; they were wrong.

What differs from Postgres#

AlloyDBDialect extends PostgresDialect (postgres) and
overrides 28 of its methods (Object.getOwnPropertyNames(AlloyDBDialect.prototype),
computed by the scratch test); everything else is inherited unchanged.
AreaOverridden
Connection and executionresolvePoolConfig
DDL and schemaaddIndex, buildCreateModelCall, buildCreateScannIndexSql, buildDropModelCall, buildPartialIndexSql, createExtension, createExtensionSQL
OtherbuildEmbedColumnUpdate, buildEmbeddingQuery, buildPredictRowByModelIdQuery, buildPredictRowQuery, buildScannSettingSql, buildSimilaritySearchQuery, columnList, columnarCall, columnarEngineAdd, columnarEngineAddIndex, columnarEngineDrop, columnarEngineDropIndex, columnarEngineEstimate, columnarEngineRecommend, columnarEngineRefresh, columnarEngineResetRecommendation, relation, tlsPosture, warnUnverifiedTlsOnce, whereAfter

Extensions#

d.createExtensionSQL('google_ml_integration');
// CREATE EXTENSION IF NOT EXISTS "google_ml_integration" CASCADE
d.createExtensionSQL('alloydb_scann'); // pulls in "vector"
// CREATE EXTENSION IF NOT EXISTS "alloydb_scann" CASCADE
createExtensionSQL only builds these three extension names
(google_ml_integration, alloydb_scann, vector); anything else throws and
points at createExtension().
createExtension(name, options) overrides the inherited PostgreSQL method to
refuse untrusted procedural languages before delegating:
await d.createExtension('plpython3u');
// throws: "AlloyDB cannot install 'plpython3u': untrusted procedural
// languages require a PostgreSQL superuser, and AlloyDB is managed — the
// highest role is alloydbsuperuser. Use a trusted language such as plpgsql..."

await d.createExtension('vector', { ifNotExists: true }); // delegates to Postgres
// CREATE EXTENSION IF NOT EXISTS "vector"
Refused (case-insensitive): plpython3u, plpythonu, plperlu, pltclu.

Columnar engine#

d.columnarEngineAdd('public.orders', ['total', 'placed_at']);
// SELECT google_columnar_engine_add(relation => 'public.orders', columns => 'total,placed_at')
d.columnarEngineAdd('orders');
// SELECT google_columnar_engine_add(relation => 'orders')

d.columnarEngineDrop('orders', ['total']);
// SELECT google_columnar_engine_drop(relation => 'orders', columns => 'total')
d.columnarEngineEstimate('orders');
// SELECT google_columnar_engine_estimate(relation => 'orders')
d.columnarEngineRefresh('orders');
// SELECT google_columnar_engine_refresh(relation => 'orders')

d.columnarEngineRecommend();
// SELECT google_columnar_engine_recommend()
d.columnarEngineRecommend('RECOMMEND_SIZE');
// SELECT * FROM google_columnar_engine_recommend(mode => 'RECOMMEND_SIZE')
d.columnarEngineResetRecommendation(true);
// SELECT google_columnar_engine_reset_recommendation(drop_columns => true)

d.columnarEngineAddIndex('docs_emb');
// SELECT google_columnar_engine_add_index(index => 'docs_emb')
d.columnarEngineDropIndex('docs_emb');
// SELECT google_columnar_engine_drop_index(index => 'docs_emb')
Relation names and column lists are escaped as string literals via escape()
(these are function arguments, not identifiers). A column list is
comma-joined, so a column name containing a comma is refused, as is an empty
column name or a blank relation name.

Model integration (google_ml_integration)#

d.buildEmbeddingQuery('text-embedding-005', 'waterproof boots');
// { sql: 'SELECT embedding($1, $2)::vector AS "embedding"', values: [...] }

d.buildEmbedColumnUpdate({
  tableName: 'docs',
  sourceColumn: 'body',
  targetColumn: 'emb',
  model: 'text-embedding-005',
  where: { lang: 'en' },
  onlyMissing: true,
});
// UPDATE "docs" SET "emb" = embedding($1, "body")::vector
//   WHERE "lang" = $2 AND "emb" IS NULL
// values: ['text-embedding-005', 'en']

d.buildPredictRowQuery('publishers/google/models/gemini-2.0-flash', { x: 1 });
// SELECT ml_predict_row($1, $2::json) AS "prediction"

d.buildPredictRowByModelIdQuery('my-model', { x: 1 });
// SELECT google_ml.predict_row(model_id => $1, request_body => $2::json) AS "prediction"

d.buildCreateModelCall({
  modelId: 'emb',
  provider: 'google',
  type: 'text_embedding',
  qualifiedName: 'text-embedding-005',
  authType: 'alloydb_service_agent_iam',
});
// CALL google_ml.create_model(model_id => $1, model_provider => $2,
//   model_type => $3, model_qualified_name => $4, model_auth_type => $5)

d.buildDropModelCall('emb');
// CALL google_ml.drop_model($1)
buildEmbedColumnUpdate's where clause values are renumbered to continue
after $1 (the model), via a private whereAfter() helper shared with
buildSimilaritySearchQuery. where must be a where-object — a raw SQL
string throws.

Similarity search (pgvector + ScaNN)#

buildSimilaritySearchQuery builds a nearest-neighbour SELECT, either
against a bound vector or a vector produced in SQL by embedding(model, text):
d.buildSimilaritySearchQuery({
  tableName: 'docs',
  column: 'emb',
  metric: 'cosine',
  text: 'waterproof boots',
  model: 'text-embedding-005',
  where: { lang: 'en' },
  attributes: ['id', 'title'],
  distanceAs: 'distance',
  limit: 5,
});
// SELECT "id", "title", "emb" <=> embedding($2, $3)::vector AS "distance"
//   FROM "docs" WHERE "lang" = $1
//   ORDER BY "emb" <=> embedding($2, $3)::vector LIMIT 5
// values: ['en', 'text-embedding-005', 'waterproof boots']

d.buildSimilaritySearchQuery({
  tableName: 'docs',
  column: 'emb',
  metric: 'l2',
  vector: [0.1, -2, 3e-4],
  limit: 10,
});
// SELECT * FROM "docs" ORDER BY "emb" <-> $1::vector LIMIT 10
// values: ['[0.1,-2,0.0003]']
metricpgvector operator
l2<->
inner_product<#>
cosine<=>
Exactly one of vector (a non-empty array of finite numbers) or text (with
model) must be given; limit must be a positive integer. Anything else
throws.

ScaNN vector indexes#

d.buildCreateScannIndexSql('docs', { name: 'docs_emb', column: 'emb', distance: 'cosine' });
// CREATE INDEX "docs_emb" ON "docs" USING scann ("emb" cosine)

d.buildCreateScannIndexSql('docs', {
  name: 'docs_emb',
  column: 'emb',
  distance: 'dot_product',
  numLeaves: 1000,
  quantizer: 'SQ8',
  maxNumLevels: 2,
  autoMaintenance: true,
});
// CREATE INDEX "docs_emb" ON "docs" USING scann ("emb" dot_product)
//   WITH (mode = 'MANUAL', num_leaves = 1000, quantizer = 'SQ8',
//         max_num_levels = 2, auto_maintenance = true)
Setting any of numLeaves, quantizer, maxNumLevels or autoMaintenance
implies mode: 'MANUAL'; combining them with an explicit mode: 'AUTO'
throws. distance is l2 | dot_product | cosine; quantizer is SQ8 |
AH | FLAT; maxNumLevels is 1 | 2 | 3. ifNotExists adds IF NOT EXISTS.
Query-time tuning:
d.buildScannSettingSql('scann.num_leaves_to_search', 20);
// SET scann.num_leaves_to_search = 20
Valid settings: scann.num_leaves_to_search, scann.pre_reordering_num_neighbors
(ALLOYDB_SCANN_SETTINGS). value must be a positive integer.

Partial indexes#

addIndex(tableName, indexName, fields, options) overrides the inherited
PostgreSQL method only to route a where predicate through a local builder
(the inherited one decides partial-index support by dialect name):
await d.addIndex('t', 'i', ['a'], { where: { b: { [Op.gte]: 5 } } });
// CREATE INDEX "i" ON "t" ("a") WHERE "b" >= 5
await d.addIndex('t', 'j', ['a']); // no predicate: delegates straight to PostgresDialect.addIndex
// CREATE INDEX "j" ON "t" ("a")
buildPartialIndexSql(tableName, indexName, fields, options) is the pure,
synchronous builder behind it — unique, using (validated as
/^[a-z_]+$/i), include, and a where where-object (a raw SQL string
throws) compiled with PostgreSQL's grammar via buildPartialIndexPredicate.

Type mapping#

Identical to the PostgreSQL dialect, including pgvector's
VECTOR(n) and SERIAL for autoIncrement.

Refused, by name#

CallWhy
createExtensionSQL(name) for anything other than google_ml_integration, alloydb_scann, vectorOnly builds the extensions its own builders depend on; use createExtension() for others.
createExtension('plpython3u' | 'plpythonu' | 'plperlu' | 'pltclu')Untrusted procedural languages need a true PostgreSQL superuser; AlloyDB's highest role is alloydbsuperuser. (Lifted in AlloyDB Omni, which has one.)
iam with no usernameThe IAM principal is the database user.
buildSimilaritySearchQuery with both/neither of vector/text, a non-finite vector, an empty vector, an unknown metric, or a non-positive limitMalformed search input.
buildCreateScannIndexSql with an unknown distance/quantizer/mode, a non-positive numLeaves, maxNumLevels outside 1–3, or manual params with mode: 'AUTO'Malformed ScaNN DDL.
buildScannSettingSql with an unknown setting or non-positive valueOnly the two documented ScaNN session settings are supported.
whereAfter / buildPartialIndexSql with where as a raw SQL stringBuilders take a where-object; no raw SQL fragment is accepted.
columnarEngineAdd/Drop/Estimate with a blank relation name or a column name containing a comma or emptyThe function's argument is a single comma-separated string literal.

Caveats / not-yet-verified#

All SQL above is asserted as strings in tests/dialects/alloydb.test.ts
without a database connection; execution against a live AlloyDB instance is
not exercised.
IAM database authentication is implemented with googleIamTokenProvider
pgAuth (see above) and covered with a mocked auth client and a mocked
pg.Pool; it has not been exercised against a live instance. There is no
AlloyDB Node.js connector (@google-cloud/alloydb-connector is not on npm);
alloyDbConnectorOptions() in cloud-auth still accepts a connector object
you bring. Read pool / instance-routing hints are not implemented.
Everything else — transactions, LISTEN/NOTIFY, triggers, partitioning,
ON CONFLICT — is inherited from PostgresDialect unchanged.

Capabilities#

Computed from the code — capabilitiesOf() (src/transaction-support.ts),
whereSupportOf() (src/query-builders/expression-render.ts),
sqlObjectCapabilitiesOf() (src/sql-objects/capabilities.ts) and the
builders — by the scratch test described in the
capability matrix.
Capabilityalloydb
Transactions atomicyes
Savepointsyes
Isolationup to SERIALIZABLE
Transaction modesread-only yes; deferrable yes; constraint deferral yes
RETURNINGRETURNING on INSERT
UpsertINSERT … ON CONFLICT (…) DO UPDATE
JSON columnJSON (JSONB → JSONB)
Vector columnVECTOR(3)
Array columnINTEGER[]
WHERE builder62 operator keys; $and/$or/$not; $exists: yes; $in subquery: yes; expression operands: yes
SQL objectsfamily postgres: triggers yes; procedures yes; functions multiStatement; materialized views native; sequences yes; enums named; RLS policy
StreamingqueryStream() present; LISTEN present; createExtension() present

Related reading#

All dialects
AlloyDB Omni dialect — the self-hosted edition
Cloud authentication — googleIamTokenProvider, pgAuth
Connect using IAM authentication
AlloyDB Language Connectors
PostgreSQL dialect — everything inherited
Manage columnar engine content manually
Columnar engine content recommendations
Work with embeddings
Invoke predictions
Create a ScaNN index
Modified at 2026-10-04 00:40:16
Previous
SQL dialects
Next
AlloyDB Omni Dialect
Built with