1. guides
prorm
  • prorm documentation
  • Known test gaps
  • Architecture
  • Core concepts
  • Database types & coverage
  • Getting started
  • Going further
  • compliance
    • Compliance
    • The security toolkit: `prorm audit`
    • Checklists by regulation
    • Declaring personal data
    • Evidence bundles
    • Evidence
    • Frameworks: `@Security`
    • Jurisdictions
    • Platform policies
    • Protecting data
    • The regulation dataset
    • Residency and cross-border transfers
    • Retention & integrity
    • Status
    • Subject rights
  • decorators
    • prorm with decorators
    • Models with decorators
    • Querying a decorated model
    • Relations with decorators
  • diagrams
    • Diagram generators
    • Chen diagram
    • Class diagram
    • Dependency diagram
    • ER diagram
    • Flow diagram
    • From your models to a diagram
    • Gantt diagram
    • Index diagram
    • Migration diagram
    • Model diagram
    • Package diagram
    • Crow’s-foot diagram
    • Schema documentation
    • Sequence diagram
    • State diagram
    • Tree diagram
  • dialects
    • SQL dialects
    • AlloyDB Dialect
    • AlloyDB Omni Dialect
    • Amazon Athena Dialect
    • Aurora DSQL Dialect
    • Amazon Aurora MySQL Dialect
    • Amazon Aurora PostgreSQL Dialect
    • Azure Database for MySQL Dialect
    • Azure Database for PostgreSQL Dialect
    • Azure SQL Database Dialect
    • Azure SQL Managed Instance Dialect
    • Google BigQuery Dialect
    • Citus Dialect
    • ClickHouse dialect
    • Cloud Authentication (`cloud-auth`)
    • Cloud SQL for SQL Server Dialect
    • Cloud SQL for MySQL Dialect
    • Cloud SQL for PostgreSQL Dialect
    • CockroachDB Dialect
    • Azure Cosmos DB for PostgreSQL Dialect
    • CrateDB Dialect
    • Cloudflare D1 Dialect
    • Databricks dialect
    • IBM Db2 Dialect
    • Dolt Dialect
    • Apache Doris Dialect
    • Druid Dialect
    • DuckDB Dialect
    • Exasol dialect
    • Microsoft Fabric Data Warehouse Dialect
    • Firebird Dialect
    • Greenplum Dialect
    • SAP HANA Dialect
    • MySQL HeatWave Dialect
    • Azure Data Explorer (Kusto) Dialect — T-SQL
    • MariaDB Dialect
    • Materialize Dialect
    • MonetDB Dialect
    • MotherDuck Dialect
    • Microsoft SQL Server Dialect
    • MySQL Dialect
    • Neon Dialect
    • OceanBase Dialect
    • openGauss Dialect
    • Oracle Dialect
    • Oracle Autonomous Database Dialect
    • ParadeDB Dialect
    • PolarDB Dialect
    • PostgreSQL Dialect
    • Presto Dialect
    • QuestDB Dialect
    • Aurora RDS Data API Dialect (`rdsdata`)
    • Amazon RDS for Db2 Dialect
    • Amazon RDS for MariaDB Dialect
    • Amazon RDS for SQL Server Dialect
    • Amazon RDS for MySQL Dialect
    • Amazon RDS for Oracle Dialect
    • Amazon RDS for PostgreSQL Dialect
    • Amazon Redshift
    • Amazon Redshift Data API Dialect
    • RisingWave Dialect
    • rqlite Dialect
    • SingleStore Dialect
    • Snowflake Dialect
    • Google Cloud Spanner Dialect
    • Spanner (PostgreSQL interface) Dialect
    • SQLite Dialect
    • StarRocks Dialect
    • Supabase Dialect
    • Azure Synapse Analytics (dedicated SQL pool)
    • Teradata Dialect
    • TiDB Dialect
    • TimescaleDB Dialect
    • Trino Dialect
    • Turso / libSQL Dialect
    • Vertica dialect
    • Vitess Dialect
    • Yellowbrick Dialect
    • YugabyteDB Dialect
  • guides
    • Access rules and behaviour profiles
    • ArangoDB (AQL)
    • Associations
    • Audit levels and escalation
    • Audit logging
    • In the browser
    • Bulk operations
    • Caching
    • Capabilities, tiers and team roles
    • CLI
    • Cloudflare
    • Compliance & data protection
    • Connection Pooling & Performance
    • Security in the console
    • Couchbase: structured N1QL queries
    • Data types
    • Decorators
    • Eager loading
    • Enums and constants
    • Error handling & error types
    • Extensions
    • External fields
    • Foreign data wrappers
    • Graph databases
    • Hooks & lifecycle events
    • Indexes & constraints
    • InfluxDB: structured Flux pipelines
    • klock-errors
    • klock — the `.klock` file
    • Local databases (`prorm db up`)
    • Structured log search — Splunk, Graylog, Papertrail, Sumo Logic
    • Logging
    • Grafana Loki: structured LogQL queries
    • MCP server
    • Migrate — the data transfer subsystem
    • Migrations & Schema Sync
    • Models from an existing database
    • Defining models
    • Multiple databases
    • OrientDB, Neptune and TigerGraph
    • Passwords
    • Importing a Prisma schema
    • Structured PromQL and MetricsQL
    • Query firewall
    • QueryInterface
    • Query operators reference
    • Query optimization
    • Composing find options with `pipe()` and `Q`
    • Query safety: the fail-closed WHERE guard
    • Querying
    • Raw Queries & Query Building
    • Read replicas
    • Schema diffing & migration generation
    • Views, triggers & other schema objects
    • Scopes & default scopes
    • Seeders
    • SPARQL / RDF triplestores
    • SQL constants
    • SQL features
    • SQL function builders
    • SQLite advanced features
    • StoreKey — a prod-orm database as the storage
    • Streaming results
    • Terraform
    • Transactions & Isolation Levels
    • Type mapping: legacy and modern
    • TypeScript types
    • Database users, roles & privileges
    • Validation & constraints
    • Virtual & Computed Fields
    • Writing docs
  • javascript
    • prorm in JavaScript
    • Models in JavaScript
    • Querying in JavaScript
    • Relations in JavaScript
  • runbooks
    • Operational runbooks
    • Connection failures
    • Credential rotation
    • Failover
    • Incident checklist
    • Deploying klock v2
    • Migration rollback
  • running-databases
    • Running databases in Docker
    • Running prorm under Bun in Docker
    • Running Cassandra in Docker with prorm
    • Running ClickHouse in Docker with prorm
    • Running CockroachDB in Docker with prorm
    • Running prorm under Deno in Docker
    • Running Elasticsearch in Docker with prorm
    • Running MariaDB in Docker with prorm
    • Running MongoDB in Docker with prorm
  • prorm control plane
    • Introduction
    • Authentication
    • Errors
    • Getting started
      • Service
        • Is it up
        • This description
    • Account
      • Sign-up and verification
        • Create an account
        • Exchange credentials for a token
        • Verify with the emailed code
        • Verify by clicking the emailed link
        • Name the parent or guardian
        • What a consent link is about
        • Give consent for a child's account
        • Ask the parent or guardian again
        • Send a new code and link
      • Family
        • Everyone this account is responsible for
        • One child, in detail
        • Turn a limit on or off
      • Profile
        • Who am I
        • Change the account
        • Every address on the account
        • Add an address
        • Confirm an address with the code mailed to it
        • Mail a fresh code to an unconfirmed address
        • Make an address primary
        • Remove an address
        • What this caller may do
    • Security
      • Sessions
        • Everywhere this account is signed in
        • Sign out everywhere else
        • Sign one out
        • A token for the CLI on a named machine
        • A token for the customer console, from the staff one
        • Park a sign-in for the CLI to collect
        • The CLI collecting its sign-in
        • The team's members' live sessions
        • Sign a member's session out
        • Sign an account out everywhere
        • Everywhere the account is signed in
        • Sign an account's session out
      • Single sign-on
        • Begin a single sign-on
        • The provider's return
        • Link the signed-in account to a team's provider
        • Which team an address signs in to
        • The team's single sign-on, as a member sees it
        • Set the team's OpenID Connect provider up, or change it
        • Remove the provider
        • The team's domain claims and the DNS record each needs
        • Prove a claimed domain
      • MFA and passwords
        • Start enrolling a second factor
        • Prove the app has it
        • Remove the second factor
        • Ask for a reset link
        • Set a new password with the emailed token
      • Klock
        • Open a device-bound klock session
        • Check in, for the next grant
        • Step up the session asking
        • Rotate the device key
        • Freeze a session
        • Unfreeze a session
        • A guest grant
        • The revocation feed
        • The published keyset
        • What this control plane supports
      • Devices
        • Your devices, or a team's
        • Approve a new device's pairing code
        • One device
        • Rename a device
        • Revoke a device
        • Suspend a device
        • Reinstate a suspended device
        • Wipe a device
        • Ask a device to rotate its key
        • The team's members' devices
        • Revoke a member's device
        • An account's devices
        • Revoke an account's device
        • Wipe an account's device
        • The device fleet
      • Access rules and behaviour
        • The access rules that bear on you
        • Add an access rule
        • This request, as the rules see it
        • One access rule
        • Remove an access rule
        • The behaviour profiles that bear on you
        • Add or change a behaviour profile
        • The profile presets
        • Your behaviour findings
        • Acknowledge a finding
        • One behaviour profile
        • Remove a behaviour profile
        • The team's access rules
        • Add a team access rule
        • Remove a team access rule
        • The team's behaviour profiles
        • Add or change a team behaviour profile
        • Remove a team behaviour profile
        • What the team's profiles caught
        • Acknowledge a team finding
      • Recovery and lockdown
        • Ask for a recovery link
        • Recover access with the emailed code
        • Is the account locked down
        • Lock the account down
        • Release a lockdown
        • Lock a member down
        • Release a member's lockdown
      • MCP tokens
        • Make a delegated token for one MCP client
        • The account's delegated tokens
        • Revoke a delegated token
        • What a delegated token may do now
        • Run one MCP tool with a delegated token
        • Run a device-signed MCP tool call relayed by the MCP Worker
      • Kerberos
        • Give the team its own Kerberos realm
        • The team's realm
        • Remove the team's realm
    • Logging and monitoring
      • Audit log
        • What has been done to the account
        • What has happened to this account
        • The account's audit trail
      • Operations
        • Everything that has been asked of this database
        • One, with its steps
        • Stop it
        • Put a failed one back in the queue
        • Every operation, across all accounts
      • Metrics and events
        • Every measurement, for a graph
        • Who did what to it
    • Billing
      • Plans and pricing
        • What the plans allow
        • The rate card
        • What one database would cost
        • What this account is paying for, itemised
      • Subscriptions and invoices
        • What this month's invoice will say
        • What this account is on
        • What it has been charged
        • Start a Stripe Checkout session
        • Open the customer portal
        • Stripe's events
        • Buy more connection pools
      • Team billing
        • The team's billing account
        • What the team has been charged
        • What this month's invoice will say
        • The team's cards
        • Add a card, through a Stripe-hosted setup session
        • Make a card the team's default
        • Remove a card
        • Start the team paying
        • Open the Stripe portal on the team's customer
        • Change the team's plan
        • Who receives the team's bills
        • How the team pays for transfers
    • Support
      • Support chat
        • My conversations
        • Start a conversation
        • Every support conversation, open first
        • A ticket for the socket
        • One conversation, with who is in it and who is connected
        • Rename a group; open or close a support conversation
        • The lines, oldest first
        • Say something
        • Add somebody
        • Mark read
    • Administration
      • Users
        • Every account
        • One account, with everything hanging off it
        • Grant or revoke admin
        • Verify an account by hand
        • Lock or unlock sign-in
        • Allow or hold provisioning
        • Send the verification mail again
        • Set the plan by hand
      • Platform
        • Every database and store, across all accounts
        • The counts worth putting on a dashboard
      • Staff and permissions
        • What kind of admin the caller is, and which scopes they hold
        • The admin presets
        • Every admin, and the scopes each resolves to
        • Make an account an admin of a kind
        • Change an admin's kind, or a custom admin's scopes
        • Revoke admin
      • Team administration
        • Every team, with its owner and size
        • One team in full — members with their accounts, and projects
        • Hand the team to another member
        • Put an account in the team, active at once
        • Change a member's role
        • Remove a member
      • Assumed identities
        • Assume an identity — act as a customer account
        • The identities the caller holds open
        • End an assumed identity
      • Support inbox
        • The platform's addresses
        • Add a platform address
        • One address, with its counts
        • Change an address's label, routing, or whether it accepts mail
        • Remove an address that holds no mail
        • Make, adopt or repair the address's routing rule
        • Every admin's personal address, made where missing
        • File a raw message, as if it had arrived
        • The inbox
        • One message, whole
        • Mark a message
        • Hand a message to an admin, or take it back
        • Leave an internal note
        • Reply, from the address the message came to
        • What is waiting
    • Databases
      • Databases
        • Data stores
          • Every data store on the account
          • Provision a data store
          • Change a data store that is already running
          • One data store
          • Deprovision it
          • Report what it is using
          • How to reach a data store
        • Connections and credentials
          • The api keys on a database
          • Issue a key
          • Revoke a key
          • The engine users we created
          • Create a user inside the database
          • Give a user a new password
          • Drop a user
          • How the database is reached
          • Set how it is reached
          • Revoke every api key on it
          • How to connect to it
          • The ssh keys that open its bastion
          • Add a key, or have one made
          • The private half of a generated key, once
          • Revoke an ssh key
        • Schema and objects
          • The SQL objects we put in it
          • Create one, and apply it
          • What is in the database, as the engine reports it
          • One table
          • What it would run, without running it
          • Redefine an object in place
          • Drop it
          • The extensions installed in it
        • Migrations
          • A plan compiled to statements, recording nothing
          • The migrations recorded for it
          • Record one
          • Apply everything recorded and not yet run
          • Apply everything pending, oldest version first
        • Lifecycle
          • Grow or shrink it
          • Stop it accepting connections
          • Start it again
          • Move it to another region
        • Backups and replicas
          • Take a backup
          • The backups it has
          • Restore one into it
          • What has been restored into it, and from where
          • Its read copies
          • Add one
        • Policies
          • The catalog
          • One policy
          • What this database is held to
          • Switch a policy on, or change its knobs
          • Switch it off
          • Mark the policies reviewed
          • Evaluate the periodic policies now
          • Who is behind a credential
        • Passwordless
          • The database's passwordless sessions
          • Issue a passwordless session (v1)
          • Revoke a passwordless session
          • Bind a session to a device key
          • Issue a v2 session for a host to bind
          • Redeem an enrolment ticket on the host
          • Check a passwordless credential
          • Run one described query under a passwordless credential
        • Database roles
          • The database's roles
          • Define a role
          • One role
          • Change what a role permits
          • Delete a role, and revoke every key granted it
          • Grant a role, which mints a key
          • Who holds a role
          • The api keys bound to a role
        • Pools
          • A database's connection pools, and how busy each is
          • Open another pool
          • Rename a pool or change its size
          • Close a pool
        • Data plane
          • Run a query against a database
          • Several statements, in order, over one connection
          • Is this database answering
          • What the proxy itself is holding
        • Transfers
          • The strategies this account's tier may use
          • Price a transfer without creating it
          • The account's transfer jobs, newest first
          • Create a transfer job
          • One job, and whether its certificate holds
          • Cancel an unfinished job
          • Start a created job, confirming its price
          • Report a job's status (the runner, or the owner's side of a local run)
        • Every database on the account
        • Provision a database
        • Change a database that is already running
        • One database
        • Deprovision it
        • Read or write it
        • Report what it is using
        • The engines this API will provision
        • Where a managed database can be put
    • Teams
      • Teams
        • Members
          • Who is on it
          • Invite somebody
          • Accept an invitation
          • Change somebody's role
          • Remove somebody
        • Projects
          • The projects a team runs
          • Start one
          • Rename a project, or move its environment
          • Delete a project
          • One project, and what is in it
          • Put a database or store in it
          • What is in a project
          • Take one out
        • The teams this account is on
        • Start one
        • The twelve roles, and what each may do
        • Rename a team
        • Close a team
        • One team
        • Hand the team to somebody else
        • Leave a team
    • Schemas
      • Error
      • ValidationErrors
      • Token
      • PolicyCategory
      • PolicySeverity
      • PolicyAction
      • PolicyTrigger
      • PolicyParam
      • Policy
      • PolicyCatalog
      • PolicyAssignment
      • PolicyOutcome
      • PolicyFiring
      • CredentialTrace
      • Relation
      • Restrictions
      • ChildSummary
      • SignupRequest
      • SigninRequest
      • UpdateMeRequest
      • User
      • Address
      • GeoPoint
      • D1Region
      • Usage
      • UsageReport
      • Resource
      • Database
      • DataStore
      • NewDatabase
      • NewDataStore
      • QueryRequest
      • DatabasePrivilege
      • ApiKey
      • DbUser
      • Access
      • AccessRequest
      • DatabaseObject
      • NewDatabaseObject
      • NewMigration
      • SchemaOperation
      • Migration
      • Operation
      • Session
      • AdminPowers
      • Admin
      • AuditEntry
      • TeamRole
      • Conversation
      • ChatMessage
      • TeamSso
      • Team
      • TeamMember
      • SshKey
      • ConnectionInfo
      • InboxAddress
      • InboxMailbox
      • InboxMessageSummary
      • InboxMessage
      • InboxNote
      • Page
      • Quote
      • Plan
      • ApiError
      • CapabilityRefusal
      • KlockErrorCode
      • PageWindow
      • SessionView
      • KlockStepUpRequest
      • KlockOpenRequest
      • KlockOpenedSession
      • UpdateMeResult
      • CapabilitiesView
      • SessionLimits
      • Device
      • DeviceListed
      • DeviceTeamRef
      • DeviceCommand
      • DeviceAuditLine
      • DeviceActionRequest
      • StaffActionRequest
      • ManagedSession
      • SessionRevoked
      • AccessRule
      • AccessRuleRequest
      • BehaviourProfile
      • BehaviourProfileRequest
      • BehaviourProfileSaved
      • BehaviourFinding
      • BehaviourFindingAck
      • StepUpProof
      • Removed
      • MemberLockdownRequest
      • McpClient
      • McpDelegatedView
      • McpToolCall
      • McpForwardRequest
      • PasswordlessScope
      • RoleScope
      • PasswordlessSession
      • PasswordlessTlsMaterial
      • PasswordlessKerberosMaterial
      • ServiceDeviceKeys
      • ServiceSession
      • DatabaseRole
      • TransferEndpoint
      • TransferJobRequest
      • TransferQuote
      • TransferStrategy
      • TransferJob
      • TransferJobAccess
      • Pool
      • PoolAllowance
      • BillingSubscription
      • Invoice
      • BillingContact
      • PaymentMethod
      • UpcomingCharges
      • TeamBilling
      • TeamKerberosRealm
      • TeamSsoDomain
      • TeamSsoResponse
      • StoreConnection
      • BatchFailure
      • ProxyStatus
  1. guides

Enums and constants

Where an option's value must be one of a handful of words, there is an enum for
it.
import { ConstraintType, ReferentialAction, IsolationLevel } from 'ts-prorm-orm';

await Order.addConstraint('order_user_fk', {
  type: ConstraintType.ForeignKey,
  fields: ['userId'],
  references: { table: 'users', fields: ['id'] },
  onDelete: ReferentialAction.Cascade,
});
The statement that call sends:
SQLite has no ALTER TABLE … ADD CONSTRAINT. Only a UNIQUE constraint can be
added afterwards (as a unique index); declare foreign keys with references on
the attribute so they are part of the CREATE TABLE.
An enum autocompletes, survives a rename, and cannot be 'FORIEGN KEY' — a
typo a string union catches only if you spelled the type correctly too.
Moving existing code over is a mechanical change, and it can happen one call at
a time because both spellings are accepted:
- import { Prorm } from 'ts-prorm-orm';
+ import { Prorm, SqlDialect, ConstraintType, ReferentialAction } from 'ts-prorm-orm';

- const prorm = new Prorm({ dialect: 'postgres', database: 'shop' });
+ const prorm = new Prorm({ dialect: SqlDialect.Postgres, database: 'shop' });

  await Order.addConstraint('order_user_fk', {
-   type: 'FOREIGN KEY',
+   type: ConstraintType.ForeignKey,
    fields: ['userId'],
    references: { table: 'users', fields: ['id'] },
-   onDelete: 'CASCADE',
+   onDelete: ReferentialAction.Cascade,
  });
[!NOTE]
This page is about the TypeScript vocabulary — the values you pass
to the ORM. For the SQL statements that change session behaviour — PRAGMA,
sql_mode, search_path, isolation level as a statement — see
SQL constants.
[!TIP]
Every field still accepts the plain string. The enums are
string-valued and the option types were widened rather than replaced, so
{ type: 'UNIQUE' } and { type: ConstraintType.Unique } are the same value.
Existing code needs no change, and the two spellings mix freely.

Connecting#

SqlDialect#

The dialect a Prorm targets. This one is worth naming more than most: it is
the single configuration value that fails at connect time rather than at
compile time, because 'postgressql' is a perfectly good string.
import { Prorm, SqlDialect } from 'ts-prorm-orm';

const prorm = new Prorm({ dialect: SqlDialect.Postgres, database: 'shop' });
The enum has 77 members, one per dialect prorm ships (counted from the
SqlDialect declaration in src/dialect-names.ts; DIALECT_LOADERS in
src/dialects/loaders.ts is typed Record<SqlDialect, …>, so the two cannot
drift). Grouped by the SQL family each speaks:
GroupMembers
Core enginesPostgres, MySQL, MariaDB, SQLite, MSSQL, Oracle, Db2, HANA, Firebird, MonetDB, Teradata
PostgreSQL-compatibleCockroachDB, YugabyteDB, TimescaleDB, Greenplum, Redshift, OpenGauss, Citus, AlloyDB, AuroraDSQL, Yellowbrick, ParadeDB, Materialize, RisingWave, Neon, Supabase
MySQL-compatibleTiDB, SingleStore, OceanBase, PolarDB, Vitess, Dolt, Doris, StarRocks, HeatWave
SQLite-compatibleTurso, D1, Rqlite
Analytic / warehouseClickHouse, DuckDB, MotherDuck, Snowflake, Vertica, Exasol, Databricks, Trino, Presto, Athena, BigQuery, Synapse, Fabric, CrateDB, QuestDB, Druid, Kusto
Managed variants of an engineRdsPostgres, AuroraPostgres, RdsMySQL, AuroraMySQL, RdsMariaDB, RdsData, RedshiftData, RdsMSSQL, RdsOracle, RdsDb2, AzureSQL, AzureSQLMI, AzurePostgres, AzureMySQL, CosmosPostgres, CloudSQLPostgres, CloudSQLMySQL, CloudSQLMSSQL, AlloyDBOmni, OracleAutonomous
SpannerSpanner, SpannerPostgres
A managed variant is looked up as its engine wherever a feature is keyed by
engine (engineOf('cloudsqlpostgres') is 'postgres'); Neon, Supabase and
HeatWave are managed too but are listed with their families. See
Architecture.
SQL_DIALECTS is the same list as an array — what a CLI's choices or a
settings dropdown wants — and isSqlDialect(value) narrows an unknown string:
import { Prorm, SQL_DIALECTS, isSqlDialect } from 'ts-prorm-orm';

const dialect = process.env.DB_DIALECT ?? 'sqlite';
if (!isSqlDialect(dialect)) {
  // Fails at boot with the list of valid names, not at the first query.
  throw new Error(`DB_DIALECT must be one of: ${SQL_DIALECTS.join(', ')}`);
}

// `dialect` is narrowed to SqlDialect here, so no cast is needed.
export const prorm = new Prorm({
  dialect,
  storage: dialect === 'sqlite' ? './dev.sqlite' : undefined,
  database: process.env.DB_NAME,
});
The enum and the Dialect union are two declarations of the same list, so a
compile-time check in vocabulary.ts fails the build if they ever disagree —
the union stays plain strings because the dialect switch statements inside the
library rely on it for exhaustiveness checking.

Schema#

ConstraintType#

MemberSQLMeans
PrimaryKeyPRIMARY KEYThe row's identity. One per table, never null.
UniqueUNIQUENo two rows share these values. Nulls are exempt on most engines.
ForeignKeyFOREIGN KEYThe value must exist in another table.
CheckCHECKA predicate every row must satisfy.
ExcludeEXCLUDENo two rows overlap on the given operators — the general form of UNIQUE.
Exclude is PostgreSQL-only. Fields on engines that cannot emit it take
TableConstraintTypeLike, the same enum without that member, so asking MySQL
for an exclusion constraint is a type error rather than SQL the driver rejects.
Note: this enum reconciles two definitions that disagreed —
models/constraints.ts included EXCLUDE and models/indexes.ts did not, so
which members were legal depended on which module you imported the type from.

ReferentialAction#

What happens to referencing rows when the row they point at changes.
MemberMeans
CascadeApply the same change — delete the referencing rows, or follow the new key. The convenient one, and the one that silently removes data.
RestrictRefuse immediately, before other constraints are considered.
SetNullNull the referencing column. It must allow null.
NoActionRefuse, but only at end of statement — so a deferred constraint can still be satisfied by a later row. The SQL default.
SetDefaultSet the referencing column to its column default.
What deleting one users row does to the orders rows that point at it:
Restrict and NoAction differ only in when the check runs. That matters
exactly once: with a deferred constraint, NoAction lets a transaction fix
itself before committing and Restrict does not.

Deferrable#

When a constraint is checked.
MemberMeans
InitiallyDeferredAt the end of the transaction. Lets you insert rows that reference each other.
InitiallyImmediatePer statement, but can be deferred within a transaction.
NotDeferrablePer statement, always.

IndexMethod#

MemberGood forWhere
BTreeEquality, ranges, sorting, prefixesEverywhere; the default
HashEquality only, smaller than a B-tree for itPostgreSQL, MySQL (MEMORY)
GinArrays, JSONB, full-textPostgreSQL
GistGeometric and range typesPostgreSQL
SpGistData dividing into non-overlapping regions — points, text prefixesPostgreSQL
BrinVery large, naturally ordered tables; tiny indexesPostgreSQL

PartitionKind#

MemberDivides by
RangeA contiguous span of values. The usual choice for dates.
ListAn explicit set of values per partition.
HashA hash of the key — even distribution rather than meaning.

Queries#

SortDirection#

ASC and DESC. Worth knowing: null placement differs by engine — nulls sort
first on PostgreSQL and last on MySQL under ASC, and the placement inverts
with the direction. Use NullsOrder when it matters.

JoinType#

MemberKeeps
InnerOnly rows matching on both sides. The default.
LeftEvery row from the left, nulls where the right has no match.
RightEvery row from the right. A Left join with the sides swapped.
FullEvery row from both. Not supported by MySQL.
CrossEvery combination — left × right rows. Rarely intended.

AssociationType#

MemberForeign key lives on
HasOnethe other table
HasManythe other table
BelongsTothis table
BelongsToManya join table
If you are unsure which to use, the question is only ever "which table holds the
column?" — that table is the one that BelongsTo.

Transactions#

IsolationLevel#

MemberGuarantees
ReadUncommittedNothing; reads can see uncommitted changes. PostgreSQL accepts it and silently gives you ReadCommitted.
ReadCommittedEach statement sees committed data — but two statements in one transaction can see different data. PostgreSQL's default.
RepeatableReadEvery read sees one snapshot. MySQL's default. Does not rule out phantoms on every engine.
SerializableAs if transactions ran one at a time. The only level that rules out write skew.
[!WARNING]
Serializable makes serialisation failures a normal outcome, not
an error condition. Code using it must retry the transaction rather than
surface the failure — prorm.transaction(fn, { retry: { max: 3 } }) does
that; see Transactions.

SqliteTransactionType#

Deferred (SQLite's default: no lock until the first read or write),
Immediate (take the write lock at BEGIN) and Exclusive. This is the
type transaction option, and it is refused on every other engine except as
Deferred.

LockLevel#

MemberBlocks
KeyShareOnly changes to the key itself — rows referencing this one can still be inserted.
ShareWriters. Other readers are fine.
NoKeyUpdateOther writers, but not KeyShare readers.
UpdateEverything else.
Listed weakest to strongest. A foreign key check takes KeyShare implicitly,
which is why SELECT … FOR UPDATE on a parent row can block inserts into a
child table.

Schema objects#

TriggerTiming, TriggerEvent, TriggerForEach#

Covered with the rest of the trigger API in
Schema objects. TriggerEvent.Truncate is
PostgreSQL-only and statement-level by definition.

ParamMode, Volatility, RoutineLanguage#

For procedures and functions. Volatility names two families that are not
interchangeable: PostgreSQL takes Immutable / Stable / Volatile, MySQL
takes Deterministic / NotDeterministic. Naming them in one enum makes
picking the wrong one visible at the call site.

SqlCommand#

ALL, SELECT, INSERT, UPDATE, DELETE — for grants and row-level
security policies. On a policy, Insert is checked with withCheck rather
than using, because there is no existing row to test.

Hooks#

ModelHook and PrormHook#

ModelHook names every model lifecycle hook — the values Model.addHook(),
hook(), hasHook(), removeHook() and define(..., { hooks }) take:
BeforeValidate, AfterValidate, BeforeCreate, AfterCreate,
BeforeUpdate, AfterUpdate, BeforeDestroy, AfterDestroy, BeforeSave,
AfterSave, BeforeUpsert, AfterUpsert, BeforeFind, AfterFind,
BeforeCount, the six Before/After BulkCreate / BulkUpdate /
BulkDestroy hooks, BeforeReload and AfterReload. PrormHook names the
instance-level ones prorm.addHook() registers: BeforeDefine, AfterDefine,
BeforeSync, AfterSync, BeforeConnect, AfterConnect, BeforeDisconnect,
AfterDisconnect, and the destroy, upsert and reload hooks at instance level.
HookName and PrormHookName are the matching string unions. See
Hooks.
import { ModelHook, PrormHook } from 'ts-prorm-orm';

User.hook(ModelHook.BeforeCreate, (user) => {
  user.email = String(user.email).trim().toLowerCase();
});

prorm.addHook(PrormHook.AfterSync, () => {
  console.log('schema is in sync');
});

Queries, continued#

OrderDirection#

SortDirection is ASC / DESC. OrderDirection adds the null placement:
ASC_NULLS_FIRST, ASC_NULLS_LAST, DESC_NULLS_FIRST, DESC_NULLS_LAST,
for the engines that spell it in ORDER BY. isOrderDirection(value) narrows
a string and orderDirectionSuffix() renders the clause.
A "most recently shipped first, unshipped last" list is the usual case:
import { OrderDirection } from 'ts-prorm-orm';

const recentlyShipped = await Order.findAll({
  order: [['shippedAt', OrderDirection.DESC_NULLS_LAST]],
  limit: 20,
});
Before 4.9.2, SQL Server was sent NULLS LAST, which it rejects.

WindowFrameType, SetOperation, GroupingType#

EnumMembersUsed by
WindowFrameTypeRows, Range, Groups (PostgreSQL 11+, SQLite 3.28+)window function frames
SetOperationUnion, UnionAll, Except, Intersectcombining result sets
GroupingTypeRollup, Cube, Grouping (grouping sets), NoneGROUP BY extensions

TimeUnit#

Year, Quarter, Month, Week, Day, Hour, Minute, Second, for
dateTrunc, dateAdd, dateDiff, extract and scheduled events. The values
are lower-case because the function builders always took lower-case units.
dateAdd and extract have no quarter or week, so their parameter type is
BasicTimeUnitLike.

QueryTypes and ExplainFormat#

QueryTypes (SELECT, INSERT, UPDATE, DELETE, UPSERT, BULKINSERT,
BULKUPDATE, BULKDELETE, VERSION, SHOWTABLES, DESCRIBE, CALL, RAW)
is the type option of prorm.query(); ExplainFormat (TEXT, JSON,
XML, YAML, TREE) is the format option of an EXPLAIN. See
Raw queries and Query optimization.

Migrations and seeders#

EnumMembersMeans
MigrationStatePending, Up, Downthe status field of a migrator.status() record
SeedStatePending, Executedthe same for getSeedStatus()
MigrationStorageProrm, Table, Nonewhere the migrator records what has run
MigrationState rather than MigrationStatus because MigrationStatus is
already the name of the whole record. See Migrations.

Maintenance and compliance#

TableCheckLevel (Quick, Fast, Medium, Extended, Changed) is the
MySQL-family CHECK TABLE level. Severity — Low, Medium, High,
Critical — is how serious a finding is in the compliance modules; it is
exported from the package root as SeverityLevel, because the root's
Severity is the transfer guard's 'block' | 'warn' | 'info'.

Diagrams#

DiagramType names all fifteen generators (counted in
src/diagrams/diagram-type.ts), so a diagram can be chosen from a CLI flag or
a config file. See From your models to a diagram.

Importing them#

All of them come from the package root:
import {
  ConstraintType, ReferentialAction, Deferrable, IndexMethod, PartitionKind,
  SortDirection, OrderDirection, JoinType, AssociationType, LockLevel,
  SqlCommand, TriggerTiming, TriggerEvent, TriggerForEach,
  ParamMode, Volatility, RoutineLanguage, DiagramType,
  ModelHook, PrormHook, TimeUnit, WindowFrameType, SetOperation, GroupingType,
  IsolationLevel, SqliteTransactionType, MigrationState, SeedState, MigrationStorage,
  TableCheckLevel, SeverityLevel, QueryTypes,
} from 'ts-prorm-orm';
Each also has a …Like type — ConstraintTypeLike, ReferentialActionLike and
so on — which is the enum plus its string values. Option types use those, which
is what keeps the plain strings working.

Related reading#

Schema objects — where most of these are used
Query operators — the where vocabulary
Transactions — isolation levels in practice
Indexes & constraints
SQL constants — the session statements, which these are not
Modified at 2026-10-04 00:40:16
Previous
Eager loading
Next
Error handling & error types
Built with