1. guides
prorm
  • prorm documentation
  • Known test gaps
  • Architecture
  • Core concepts
  • Database types & coverage
  • Getting started
  • Going further
  • compliance
    • Compliance
    • The security toolkit: `prorm audit`
    • Checklists by regulation
    • Declaring personal data
    • Evidence bundles
    • Evidence
    • Frameworks: `@Security`
    • Jurisdictions
    • Platform policies
    • Protecting data
    • The regulation dataset
    • Residency and cross-border transfers
    • Retention & integrity
    • Status
    • Subject rights
  • decorators
    • prorm with decorators
    • Models with decorators
    • Querying a decorated model
    • Relations with decorators
  • diagrams
    • Diagram generators
    • Chen diagram
    • Class diagram
    • Dependency diagram
    • ER diagram
    • Flow diagram
    • From your models to a diagram
    • Gantt diagram
    • Index diagram
    • Migration diagram
    • Model diagram
    • Package diagram
    • Crow’s-foot diagram
    • Schema documentation
    • Sequence diagram
    • State diagram
    • Tree diagram
  • dialects
    • SQL dialects
    • AlloyDB Dialect
    • AlloyDB Omni Dialect
    • Amazon Athena Dialect
    • Aurora DSQL Dialect
    • Amazon Aurora MySQL Dialect
    • Amazon Aurora PostgreSQL Dialect
    • Azure Database for MySQL Dialect
    • Azure Database for PostgreSQL Dialect
    • Azure SQL Database Dialect
    • Azure SQL Managed Instance Dialect
    • Google BigQuery Dialect
    • Citus Dialect
    • ClickHouse dialect
    • Cloud Authentication (`cloud-auth`)
    • Cloud SQL for SQL Server Dialect
    • Cloud SQL for MySQL Dialect
    • Cloud SQL for PostgreSQL Dialect
    • CockroachDB Dialect
    • Azure Cosmos DB for PostgreSQL Dialect
    • CrateDB Dialect
    • Cloudflare D1 Dialect
    • Databricks dialect
    • IBM Db2 Dialect
    • Dolt Dialect
    • Apache Doris Dialect
    • Druid Dialect
    • DuckDB Dialect
    • Exasol dialect
    • Microsoft Fabric Data Warehouse Dialect
    • Firebird Dialect
    • Greenplum Dialect
    • SAP HANA Dialect
    • MySQL HeatWave Dialect
    • Azure Data Explorer (Kusto) Dialect — T-SQL
    • MariaDB Dialect
    • Materialize Dialect
    • MonetDB Dialect
    • MotherDuck Dialect
    • Microsoft SQL Server Dialect
    • MySQL Dialect
    • Neon Dialect
    • OceanBase Dialect
    • openGauss Dialect
    • Oracle Dialect
    • Oracle Autonomous Database Dialect
    • ParadeDB Dialect
    • PolarDB Dialect
    • PostgreSQL Dialect
    • Presto Dialect
    • QuestDB Dialect
    • Aurora RDS Data API Dialect (`rdsdata`)
    • Amazon RDS for Db2 Dialect
    • Amazon RDS for MariaDB Dialect
    • Amazon RDS for SQL Server Dialect
    • Amazon RDS for MySQL Dialect
    • Amazon RDS for Oracle Dialect
    • Amazon RDS for PostgreSQL Dialect
    • Amazon Redshift
    • Amazon Redshift Data API Dialect
    • RisingWave Dialect
    • rqlite Dialect
    • SingleStore Dialect
    • Snowflake Dialect
    • Google Cloud Spanner Dialect
    • Spanner (PostgreSQL interface) Dialect
    • SQLite Dialect
    • StarRocks Dialect
    • Supabase Dialect
    • Azure Synapse Analytics (dedicated SQL pool)
    • Teradata Dialect
    • TiDB Dialect
    • TimescaleDB Dialect
    • Trino Dialect
    • Turso / libSQL Dialect
    • Vertica dialect
    • Vitess Dialect
    • Yellowbrick Dialect
    • YugabyteDB Dialect
  • guides
    • Access rules and behaviour profiles
    • ArangoDB (AQL)
    • Associations
    • Audit levels and escalation
    • Audit logging
    • In the browser
    • Bulk operations
    • Caching
    • Capabilities, tiers and team roles
    • CLI
    • Cloudflare
    • Compliance & data protection
    • Connection Pooling & Performance
    • Security in the console
    • Couchbase: structured N1QL queries
    • Data types
    • Decorators
    • Eager loading
    • Enums and constants
    • Error handling & error types
    • Extensions
    • External fields
    • Foreign data wrappers
    • Graph databases
    • Hooks & lifecycle events
    • Indexes & constraints
    • InfluxDB: structured Flux pipelines
    • klock-errors
    • klock — the `.klock` file
    • Local databases (`prorm db up`)
    • Structured log search — Splunk, Graylog, Papertrail, Sumo Logic
    • Logging
    • Grafana Loki: structured LogQL queries
    • MCP server
    • Migrate — the data transfer subsystem
    • Migrations & Schema Sync
    • Models from an existing database
    • Defining models
    • Multiple databases
    • OrientDB, Neptune and TigerGraph
    • Passwords
    • Importing a Prisma schema
    • Structured PromQL and MetricsQL
    • Query firewall
    • QueryInterface
    • Query operators reference
    • Query optimization
    • Composing find options with `pipe()` and `Q`
    • Query safety: the fail-closed WHERE guard
    • Querying
    • Raw Queries & Query Building
    • Read replicas
    • Schema diffing & migration generation
    • Views, triggers & other schema objects
    • Scopes & default scopes
    • Seeders
    • SPARQL / RDF triplestores
    • SQL constants
    • SQL features
    • SQL function builders
    • SQLite advanced features
    • StoreKey — a prod-orm database as the storage
    • Streaming results
    • Terraform
    • Transactions & Isolation Levels
    • Type mapping: legacy and modern
    • TypeScript types
    • Database users, roles & privileges
    • Validation & constraints
    • Virtual & Computed Fields
    • Writing docs
  • javascript
    • prorm in JavaScript
    • Models in JavaScript
    • Querying in JavaScript
    • Relations in JavaScript
  • runbooks
    • Operational runbooks
    • Connection failures
    • Credential rotation
    • Failover
    • Incident checklist
    • Deploying klock v2
    • Migration rollback
  • running-databases
    • Running databases in Docker
    • Running prorm under Bun in Docker
    • Running Cassandra in Docker with prorm
    • Running ClickHouse in Docker with prorm
    • Running CockroachDB in Docker with prorm
    • Running prorm under Deno in Docker
    • Running Elasticsearch in Docker with prorm
    • Running MariaDB in Docker with prorm
    • Running MongoDB in Docker with prorm
  • prorm control plane
    • Introduction
    • Authentication
    • Errors
    • Getting started
      • Service
        • Is it up
        • This description
    • Account
      • Sign-up and verification
        • Create an account
        • Exchange credentials for a token
        • Verify with the emailed code
        • Verify by clicking the emailed link
        • Name the parent or guardian
        • What a consent link is about
        • Give consent for a child's account
        • Ask the parent or guardian again
        • Send a new code and link
      • Family
        • Everyone this account is responsible for
        • One child, in detail
        • Turn a limit on or off
      • Profile
        • Who am I
        • Change the account
        • Every address on the account
        • Add an address
        • Confirm an address with the code mailed to it
        • Mail a fresh code to an unconfirmed address
        • Make an address primary
        • Remove an address
        • What this caller may do
    • Security
      • Sessions
        • Everywhere this account is signed in
        • Sign out everywhere else
        • Sign one out
        • A token for the CLI on a named machine
        • A token for the customer console, from the staff one
        • Park a sign-in for the CLI to collect
        • The CLI collecting its sign-in
        • The team's members' live sessions
        • Sign a member's session out
        • Sign an account out everywhere
        • Everywhere the account is signed in
        • Sign an account's session out
      • Single sign-on
        • Begin a single sign-on
        • The provider's return
        • Link the signed-in account to a team's provider
        • Which team an address signs in to
        • The team's single sign-on, as a member sees it
        • Set the team's OpenID Connect provider up, or change it
        • Remove the provider
        • The team's domain claims and the DNS record each needs
        • Prove a claimed domain
      • MFA and passwords
        • Start enrolling a second factor
        • Prove the app has it
        • Remove the second factor
        • Ask for a reset link
        • Set a new password with the emailed token
      • Klock
        • Open a device-bound klock session
        • Check in, for the next grant
        • Step up the session asking
        • Rotate the device key
        • Freeze a session
        • Unfreeze a session
        • A guest grant
        • The revocation feed
        • The published keyset
        • What this control plane supports
      • Devices
        • Your devices, or a team's
        • Approve a new device's pairing code
        • One device
        • Rename a device
        • Revoke a device
        • Suspend a device
        • Reinstate a suspended device
        • Wipe a device
        • Ask a device to rotate its key
        • The team's members' devices
        • Revoke a member's device
        • An account's devices
        • Revoke an account's device
        • Wipe an account's device
        • The device fleet
      • Access rules and behaviour
        • The access rules that bear on you
        • Add an access rule
        • This request, as the rules see it
        • One access rule
        • Remove an access rule
        • The behaviour profiles that bear on you
        • Add or change a behaviour profile
        • The profile presets
        • Your behaviour findings
        • Acknowledge a finding
        • One behaviour profile
        • Remove a behaviour profile
        • The team's access rules
        • Add a team access rule
        • Remove a team access rule
        • The team's behaviour profiles
        • Add or change a team behaviour profile
        • Remove a team behaviour profile
        • What the team's profiles caught
        • Acknowledge a team finding
      • Recovery and lockdown
        • Ask for a recovery link
        • Recover access with the emailed code
        • Is the account locked down
        • Lock the account down
        • Release a lockdown
        • Lock a member down
        • Release a member's lockdown
      • MCP tokens
        • Make a delegated token for one MCP client
        • The account's delegated tokens
        • Revoke a delegated token
        • What a delegated token may do now
        • Run one MCP tool with a delegated token
        • Run a device-signed MCP tool call relayed by the MCP Worker
      • Kerberos
        • Give the team its own Kerberos realm
        • The team's realm
        • Remove the team's realm
    • Logging and monitoring
      • Audit log
        • What has been done to the account
        • What has happened to this account
        • The account's audit trail
      • Operations
        • Everything that has been asked of this database
        • One, with its steps
        • Stop it
        • Put a failed one back in the queue
        • Every operation, across all accounts
      • Metrics and events
        • Every measurement, for a graph
        • Who did what to it
    • Billing
      • Plans and pricing
        • What the plans allow
        • The rate card
        • What one database would cost
        • What this account is paying for, itemised
      • Subscriptions and invoices
        • What this month's invoice will say
        • What this account is on
        • What it has been charged
        • Start a Stripe Checkout session
        • Open the customer portal
        • Stripe's events
        • Buy more connection pools
      • Team billing
        • The team's billing account
        • What the team has been charged
        • What this month's invoice will say
        • The team's cards
        • Add a card, through a Stripe-hosted setup session
        • Make a card the team's default
        • Remove a card
        • Start the team paying
        • Open the Stripe portal on the team's customer
        • Change the team's plan
        • Who receives the team's bills
        • How the team pays for transfers
    • Support
      • Support chat
        • My conversations
        • Start a conversation
        • Every support conversation, open first
        • A ticket for the socket
        • One conversation, with who is in it and who is connected
        • Rename a group; open or close a support conversation
        • The lines, oldest first
        • Say something
        • Add somebody
        • Mark read
    • Administration
      • Users
        • Every account
        • One account, with everything hanging off it
        • Grant or revoke admin
        • Verify an account by hand
        • Lock or unlock sign-in
        • Allow or hold provisioning
        • Send the verification mail again
        • Set the plan by hand
      • Platform
        • Every database and store, across all accounts
        • The counts worth putting on a dashboard
      • Staff and permissions
        • What kind of admin the caller is, and which scopes they hold
        • The admin presets
        • Every admin, and the scopes each resolves to
        • Make an account an admin of a kind
        • Change an admin's kind, or a custom admin's scopes
        • Revoke admin
      • Team administration
        • Every team, with its owner and size
        • One team in full — members with their accounts, and projects
        • Hand the team to another member
        • Put an account in the team, active at once
        • Change a member's role
        • Remove a member
      • Assumed identities
        • Assume an identity — act as a customer account
        • The identities the caller holds open
        • End an assumed identity
      • Support inbox
        • The platform's addresses
        • Add a platform address
        • One address, with its counts
        • Change an address's label, routing, or whether it accepts mail
        • Remove an address that holds no mail
        • Make, adopt or repair the address's routing rule
        • Every admin's personal address, made where missing
        • File a raw message, as if it had arrived
        • The inbox
        • One message, whole
        • Mark a message
        • Hand a message to an admin, or take it back
        • Leave an internal note
        • Reply, from the address the message came to
        • What is waiting
    • Databases
      • Databases
        • Data stores
          • Every data store on the account
          • Provision a data store
          • Change a data store that is already running
          • One data store
          • Deprovision it
          • Report what it is using
          • How to reach a data store
        • Connections and credentials
          • The api keys on a database
          • Issue a key
          • Revoke a key
          • The engine users we created
          • Create a user inside the database
          • Give a user a new password
          • Drop a user
          • How the database is reached
          • Set how it is reached
          • Revoke every api key on it
          • How to connect to it
          • The ssh keys that open its bastion
          • Add a key, or have one made
          • The private half of a generated key, once
          • Revoke an ssh key
        • Schema and objects
          • The SQL objects we put in it
          • Create one, and apply it
          • What is in the database, as the engine reports it
          • One table
          • What it would run, without running it
          • Redefine an object in place
          • Drop it
          • The extensions installed in it
        • Migrations
          • A plan compiled to statements, recording nothing
          • The migrations recorded for it
          • Record one
          • Apply everything recorded and not yet run
          • Apply everything pending, oldest version first
        • Lifecycle
          • Grow or shrink it
          • Stop it accepting connections
          • Start it again
          • Move it to another region
        • Backups and replicas
          • Take a backup
          • The backups it has
          • Restore one into it
          • What has been restored into it, and from where
          • Its read copies
          • Add one
        • Policies
          • The catalog
          • One policy
          • What this database is held to
          • Switch a policy on, or change its knobs
          • Switch it off
          • Mark the policies reviewed
          • Evaluate the periodic policies now
          • Who is behind a credential
        • Passwordless
          • The database's passwordless sessions
          • Issue a passwordless session (v1)
          • Revoke a passwordless session
          • Bind a session to a device key
          • Issue a v2 session for a host to bind
          • Redeem an enrolment ticket on the host
          • Check a passwordless credential
          • Run one described query under a passwordless credential
        • Database roles
          • The database's roles
          • Define a role
          • One role
          • Change what a role permits
          • Delete a role, and revoke every key granted it
          • Grant a role, which mints a key
          • Who holds a role
          • The api keys bound to a role
        • Pools
          • A database's connection pools, and how busy each is
          • Open another pool
          • Rename a pool or change its size
          • Close a pool
        • Data plane
          • Run a query against a database
          • Several statements, in order, over one connection
          • Is this database answering
          • What the proxy itself is holding
        • Transfers
          • The strategies this account's tier may use
          • Price a transfer without creating it
          • The account's transfer jobs, newest first
          • Create a transfer job
          • One job, and whether its certificate holds
          • Cancel an unfinished job
          • Start a created job, confirming its price
          • Report a job's status (the runner, or the owner's side of a local run)
        • Every database on the account
        • Provision a database
        • Change a database that is already running
        • One database
        • Deprovision it
        • Read or write it
        • Report what it is using
        • The engines this API will provision
        • Where a managed database can be put
    • Teams
      • Teams
        • Members
          • Who is on it
          • Invite somebody
          • Accept an invitation
          • Change somebody's role
          • Remove somebody
        • Projects
          • The projects a team runs
          • Start one
          • Rename a project, or move its environment
          • Delete a project
          • One project, and what is in it
          • Put a database or store in it
          • What is in a project
          • Take one out
        • The teams this account is on
        • Start one
        • The twelve roles, and what each may do
        • Rename a team
        • Close a team
        • One team
        • Hand the team to somebody else
        • Leave a team
    • Schemas
      • Error
      • ValidationErrors
      • Token
      • PolicyCategory
      • PolicySeverity
      • PolicyAction
      • PolicyTrigger
      • PolicyParam
      • Policy
      • PolicyCatalog
      • PolicyAssignment
      • PolicyOutcome
      • PolicyFiring
      • CredentialTrace
      • Relation
      • Restrictions
      • ChildSummary
      • SignupRequest
      • SigninRequest
      • UpdateMeRequest
      • User
      • Address
      • GeoPoint
      • D1Region
      • Usage
      • UsageReport
      • Resource
      • Database
      • DataStore
      • NewDatabase
      • NewDataStore
      • QueryRequest
      • DatabasePrivilege
      • ApiKey
      • DbUser
      • Access
      • AccessRequest
      • DatabaseObject
      • NewDatabaseObject
      • NewMigration
      • SchemaOperation
      • Migration
      • Operation
      • Session
      • AdminPowers
      • Admin
      • AuditEntry
      • TeamRole
      • Conversation
      • ChatMessage
      • TeamSso
      • Team
      • TeamMember
      • SshKey
      • ConnectionInfo
      • InboxAddress
      • InboxMailbox
      • InboxMessageSummary
      • InboxMessage
      • InboxNote
      • Page
      • Quote
      • Plan
      • ApiError
      • CapabilityRefusal
      • KlockErrorCode
      • PageWindow
      • SessionView
      • KlockStepUpRequest
      • KlockOpenRequest
      • KlockOpenedSession
      • UpdateMeResult
      • CapabilitiesView
      • SessionLimits
      • Device
      • DeviceListed
      • DeviceTeamRef
      • DeviceCommand
      • DeviceAuditLine
      • DeviceActionRequest
      • StaffActionRequest
      • ManagedSession
      • SessionRevoked
      • AccessRule
      • AccessRuleRequest
      • BehaviourProfile
      • BehaviourProfileRequest
      • BehaviourProfileSaved
      • BehaviourFinding
      • BehaviourFindingAck
      • StepUpProof
      • Removed
      • MemberLockdownRequest
      • McpClient
      • McpDelegatedView
      • McpToolCall
      • McpForwardRequest
      • PasswordlessScope
      • RoleScope
      • PasswordlessSession
      • PasswordlessTlsMaterial
      • PasswordlessKerberosMaterial
      • ServiceDeviceKeys
      • ServiceSession
      • DatabaseRole
      • TransferEndpoint
      • TransferJobRequest
      • TransferQuote
      • TransferStrategy
      • TransferJob
      • TransferJobAccess
      • Pool
      • PoolAllowance
      • BillingSubscription
      • Invoice
      • BillingContact
      • PaymentMethod
      • UpcomingCharges
      • TeamBilling
      • TeamKerberosRealm
      • TeamSsoDomain
      • TeamSsoResponse
      • StoreConnection
      • BatchFailure
      • ProxyStatus
  1. guides

Associations

Associations connect two models by a foreign key and generate a set of
instance helper methods (getX, setX, addX, createX, countX, hasX
and friends) on the source model. prorm supports four association types —
hasOne, hasMany, belongsTo, and belongsToMany — declared by calling the
matching method on a model returned from prorm.define(...).
Every association is registered on the source model so that later helpers,
eager loading (include), and foreign-key constraint generation during
sync() can all resolve it. This guide covers each type, the generated
mixin methods, junction tables for many-to-many, eager loading, and how
foreign keys are inferred and constrained.

The four shapes#

Which side holds the foreign key is the thing to get right, because it decides
which table is written when you set the association:
AssociationForeign key lives onExtra table
hasOnethe target—
hasManythe target—
belongsTothe source—
belongsToManyneithera join table
hasOne and belongsTo describe the same physical relationship from opposite
ends — declare both when you want traversal in both directions.
The blog schema used through the rest of this page, with its columns:

Defining associations#

Associations are defined after the models exist. Each call takes the target
model and an options object:
import { Prorm, DataTypes } from 'ts-prorm-orm';

const prorm = new Prorm({ dialect: 'sqlite', storage: ':memory:' });

const User = prorm.define('User', {
  id: { type: DataTypes.INTEGER(), primaryKey: true, autoIncrement: true },
  name: { type: DataTypes.STRING() },
});

const Post = prorm.define('Post', {
  id: { type: DataTypes.INTEGER(), primaryKey: true, autoIncrement: true },
  title: { type: DataTypes.STRING() },
  userId: { type: DataTypes.INTEGER() }, // foreign key column
});

User.hasMany(Post);   // a user has many posts
Post.belongsTo(User); // a post belongs to a user

await prorm.connect();
await prorm.sync();
[!IMPORTANT]
Declare every model and every association before the tables are created.
define() on a connection that is already open creates its table straight
away, before the association exists, and sync() then sees the table and
leaves it alone — so the REFERENCES clause is never emitted. The safe
order is: define models → declare associations → connect() → sync(), as
above.
With the blog models and Post.belongsTo(User, { foreignKey: 'userId', as: 'author' }),
sync() emits the foreign key inline on the column, or, on MySQL, MariaDB
and TiDB, as a table-level FOREIGN KEY:
[!NOTE]
InnoDB parses a column-level REFERENCES clause and then ignores it, so the
MySQL family writes the table-level form, which InnoDB enforces (in
CREATE TABLE and in ADD COLUMN). Before 4.9.2 these engines got the
column-level clause and created no foreign key at all; tables created by an
older release have none until you add it with addConstraint or a
migration.
The options accepted by every association type are:
OptionPurpose
asAlias for the association; drives the helper method names and the include key.
foreignKeyForeign key column name. A string, an array (composite key), or { name, allowNull }.
sourceKeyKey on the source model. Defaults to the primary key.
targetKeyKey on the target model. Defaults to id.
onDelete / onUpdateReferential action for the FOREIGN KEY constraint (CASCADE, SET NULL, RESTRICT, NO ACTION, SET DEFAULT). See Foreign keys and constraints.
constraintsWhether to emit the foreign-key constraint.
throughFor belongsToMany only: the junction table name, model, or { model, otherKey, ... }.

Alias and foreign-key defaults#

When you omit as, the alias is derived from the target model name:
hasOne / belongsTo use the lower-cased target name (User -> user).
hasMany / belongsToMany append s (Post -> posts).
When you omit foreignKey, it is inferred as a lowerCamelCase column name:
belongsTo and hasOne: <targetName>Id (e.g. Post.belongsTo(User) -> userId).
hasMany and belongsToMany: <sourceName>Id (e.g. User.hasMany(Post) -> userId).
Because the inferred name is always lowerCamelCase, define the matching
column with the same casing (userId, not UserId). For hasOne the
foreign key lives on the target table, so an explicit foreignKey is often
clearer than relying on the default.
[!TIP]
The inferred key follows the model name, not the alias:
Post.belongsTo(User, { as: 'author' }) still reads posts.userId
(SELECT * FROM "users" WHERE "id" = <post.userId>). If the column is really
called authorId, say so with foreignKey: 'authorId' on both ends.

belongsTo#

belongsTo places the foreign key on the source model. The source row
stores the target's primary key.
Post.belongsTo(User, { foreignKey: 'userId', as: 'author' });

const article = await Post.findByPk(1);

const author = await article.getAuthor();            // SELECT * FROM "users" WHERE "id" = 1 LIMIT 1
await article.setAuthor(user);                       // sets article.userId, saves
await article.unsetAuthor();                         // clears the foreign key
const created = await article.createAuthor({ name: 'Ada' }); // create + link
const has = await article.hasAuthor();               // boolean
const n = await article.countAuthor();               // 0 or 1
Generated methods (alias author): getAuthor, setAuthor, unsetAuthor,
createAuthor, hasAuthor, countAuthor. setAuthor accepts an instance,
a raw key value, or null (the same as unsetAuthor()).

hasOne#

hasOne is the inverse one-to-one: the foreign key lives on the target
model, pointing back at the source.
const Profile = prorm.define('Profile', {
  id: { type: DataTypes.INTEGER, primaryKey: true, autoIncrement: true },
  bio: DataTypes.STRING,
  userId: DataTypes.INTEGER,
});

User.hasOne(Profile, { foreignKey: 'userId' });

const ada = await User.findByPk(1);

const profile = await ada.getProfile();          // findOne on Profile
await ada.setProfile(profile);                    // updates Profile.userId
const created = await ada.createProfile({ bio: 'hi' });
const has = await ada.hasProfile();               // boolean
const n = await ada.countProfile();               // 0 or 1
Generated methods (alias profile): getProfile, setProfile,
createProfile, hasProfile, countProfile.

hasMany#

hasMany is one-to-many. The foreign key lives on the target, and the
helpers operate on collections.
User.hasMany(Post, { foreignKey: 'userId', as: 'posts' });

const ada = await User.findByPk(1);

const posts = await ada.getPosts();                 // findAll on Post
await ada.setPosts([postA, postB]);                 // replaces the whole set
await ada.addPosts([postC, postD]);                 // links additional rows
await ada.addPost(postE);                           // singular form
const post = await ada.createPost({ title: 'Hi' }); // create + link
const count = await ada.countPosts();
const any = await ada.hasPosts();                   // any linked?
const both = await ada.hasPosts([postC, postD]);    // all linked?
const one = await ada.hasPost(postE);               // singular form
Generated methods (alias posts): getPosts, setPosts, addPosts,
addPost, createPost, countPosts, hasPosts, hasPost. Singular forms
are derived by stripping a trailing s (or ies -> y).
The SQL each helper sends, on SQLite, for user 1:
CallSQL
user.getPosts()SELECT * FROM "posts" WHERE "userId" = 1;
user.createPost({ title: 'Four' })INSERT INTO "posts" ("title", "userId") VALUES ('Four', 1);
user.countPosts()SELECT COUNT(*) AS "count" FROM "posts" WHERE "userId" = 1;
user.setPosts([p1])UPDATE "posts" SET "userId" = NULL WHERE "userId" = 1;
UPDATE "posts" SET "userId" = 1 WHERE "id" = 1;
setPosts does not delete anything: it detaches every current post (nulling
its foreign key) and then attaches the ones you pass.
[!WARNING]
Because setPosts nulls the foreign key of the posts it drops, it fails if
posts.userId is NOT NULL — and on a nullable column it leaves orphaned
posts behind. When the children cannot exist without a parent, delete them
explicitly (Post.destroy({ where: { userId: ada.id, id: { [Op.notIn]: keep } } }))
instead of using setPosts.
There is no removePost/removePosts helper on a hasMany; detach one child
by clearing its key yourself:
await Post.update({ userId: null }, { where: { id: postA.id, userId: ada.id } });

belongsToMany#

belongsToMany is many-to-many, backed by a junction (through) table that
holds one row per link. The source's key is the foreignKey; the target's
key on the junction is the otherKey.
const Role = prorm.define('Role', {
  id: { type: DataTypes.INTEGER, primaryKey: true, autoIncrement: true },
  name: DataTypes.STRING,
});

User.belongsToMany(Role, {
  through: 'UserRoles',   // junction table name (or a model)
  foreignKey: 'userId',   // column on the junction pointing at User
  otherKey: 'roleId',     // column on the junction pointing at Role
});

const ada = await User.findByPk(1);

const roles = await ada.getRoles();               // two queries, via the junction
await ada.setRoles([roleA, roleB]);               // replace all links
await ada.addRoles([roleC]);                      // insert junction rows
await ada.addRole(roleD);                         // singular form
await ada.removeRole(roleB);                      // delete one junction row
const count = await ada.countRoles();             // counts junction rows
const one = await ada.hasRole(roleC);
Generated methods (alias roles): getRoles, setRoles, addRoles,
addRole, removeRole, countRoles, hasRole.
getRoles() reads the junction first and then the targets:
[!CAUTION]
addRole / addRoles insert a junction row every time they are called —
linking the same pair twice gives two rows, and getRoles() then returns the
role twice. Guard with hasRole() first, or give the junction a composite
unique key so the database refuses the duplicate:
export async function grantRole(user: any, role: any) {
  if (await ada.hasRole(role)) return false; // idempotent: already granted
  await ada.addRole(role);
  return true;
}

The through table#

through accepts three shapes:
// 1. A table name — a junction model is generated for you.
User.belongsToMany(Role, { through: 'UserRoles' });

// 2. A model you defined yourself (extra columns allowed).
const UserRole = prorm.define('UserRole', {
  userId: DataTypes.INTEGER,
  roleId: DataTypes.INTEGER,
  grantedAt: DataTypes.DATE,
});
User.belongsToMany(Role, { through: UserRole });

// 3. A ThroughOptions object.
User.belongsToMany(Role, {
  through: { model: UserRole, otherKey: 'roleId' },
});
When no through model is supplied, prorm synthesizes one whose table name
defaults to <Source><Target> (e.g. UserRole) with an id and the two key
columns — the foreignKey pointing at the source and the otherKey pointing
at the target. The otherKey defaults to <targetName>Id (e.g. roleId) and
can be set with the top-level otherKey option or through.otherKey. The
generated junction carries no REFERENCES and no unique key (see the CREATE TABLE "UserRoles" above); define the junction yourself when you want either.

Eager loading with include#

Instead of calling getX() per row, pass include to findAll /
findOne / findByPk to load associated rows in one pass. Each associated
result is attached under the association alias (and mirrored on
dataValues): a single object (or null) for belongsTo/hasOne, an
array for hasMany/belongsToMany.
const users = await User.findAll({
  include: [{ model: Post }],
});

for (const user of users) {
  console.log(user.name, user.posts); // Post[] under the `posts` alias
}
An include is not a JOIN. Prorm runs the parent query, collects the keys, and
fetches the children with one IN (…) query per level, then stitches the rows
together in memory:
{"id":1,"title":"One","published":true,"userId":1,"author":{"id":1,"name":"Ada"}}
Because the parent query runs on its own, limit / offset page the parents
exactly — there is no row multiplication to correct for.
Use as when a model is included under a custom alias, and where,
attributes, and order to shape the associated rows:
const users = await User.findAll({
  include: [
    {
      model: Post,
      as: 'posts',
      where: { published: true },        // filter associated rows
      attributes: ['id', 'title', 'userId'], // select a subset of columns
      order: [['createdAt', 'DESC']],    // order the associated rows
    },
  ],
});
where, attributes, and order are applied per-included association.
Top-level limit / offset still page the parent query.
An include with a where is required by default: it filters the parents
too, so only users with at least one matching post come back. Prorm finds the
matching children first, then loads just those parents. Pass
required: false to keep every parent and filter only the attached children.
Recorded on SQLite, with Ada (one published post), Grace (a draft) and Linus
(no posts):
With limit, the page is taken from the parents that survived the filter
(SELECT * FROM "users" WHERE "id" IN (1) LIMIT 10), so a page of ten users
really is ten users. Keep the foreign key in attributes when you narrow the
child columns: without userId Prorm cannot attach a child to its parent.

Nested includes#

Includes nest to any depth. Each level's fetched rows become the parent for
the next, so grandchildren load too:
const users = await User.findAll({
  include: [
    {
      model: Post,
      include: [{ model: Comment }],   // user -> posts -> comments
    },
  ],
});

Including belongsToMany#

Many-to-many includes resolve through the junction table automatically
using the association's foreignKey and otherKey. You can still narrow
the joined target rows with where, attributes, and order:
const users = await User.findAll({
  include: [
    {
      model: Role,
      where: { name: 'admin' },
    },
  ],
});
Unfiltered, that is three queries — parents, junction, targets:

Foreign keys and constraints#

During sync(), a belongsTo / hasOne / hasMany contributes a
REFERENCES clause to the column that holds the key, pointing at the
targetKey (default id), as shown in the CREATE TABLE tabs above:
Post.belongsTo(User, {
  foreignKey: 'userId',
  targetKey: 'id',
  onDelete: 'CASCADE',
  onUpdate: 'CASCADE',
});
[!IMPORTANT]
When both sides of a relationship declare the same key (User.hasMany(Post)
and Post.belongsTo(User)), the reference gets the actions either side
gives: onDelete from one and onUpdate from the other combine, and two
different values for the same action make sync() throw an
AssociationError rather than pick one. Until the release after 4.9.4, the
association declared first set the reference and the other side's actions
were dropped; before 4.9.2, no association's onDelete / onUpdate reached
the DDL. For a table created by an older release, add the constraint
yourself:
import { ConstraintType, ReferentialAction } from 'ts-prorm-orm';

await Post.addConstraint('posts_user_fk', {
  type: ConstraintType.ForeignKey,
  fields: ['userId'],
  references: { table: 'users', fields: ['id'] },
  onDelete: ReferentialAction.Cascade,
});
Composite foreign keys are supported by passing an array to foreignKey
(and, if needed, targetKey):
OrderItem.belongsTo(Order, {
  foreignKey: ['orderId', 'customerId'],
  targetKey: ['id', 'customerId'],
});
The object form of foreignKey carries constraint metadata such as
allowNull:
Post.belongsTo(User, {
  foreignKey: { name: 'userId', allowNull: false },
});

Custom primary keys#

The helpers resolve the source instance's key from the model's declared
primary key attribute — it does not have to be named id. A model keyed on
sku works the same way; the association reads whichever attribute is
marked primaryKey (falling back to id/uuid when none is declared).
const Product = prorm.define('Product', {
  sku: { type: DataTypes.STRING, primaryKey: true },
  name: DataTypes.STRING,
});

Product.hasMany(Review, { foreignKey: 'productSku' });

Next: Eager loading — fetching related rows without the N+1 problem.

Related reading#

Core concepts — the reading path these belong to
Going further — the specialised material
Modified at 2026-10-04 00:40:16
Previous
ArangoDB (AQL)
Next
Audit levels and escalation
Built with