1. guides
prorm
  • prorm documentation
  • Known test gaps
  • Architecture
  • Core concepts
  • Database types & coverage
  • Getting started
  • Going further
  • compliance
    • Compliance
    • The security toolkit: `prorm audit`
    • Checklists by regulation
    • Declaring personal data
    • Evidence bundles
    • Evidence
    • Frameworks: `@Security`
    • Jurisdictions
    • Platform policies
    • Protecting data
    • The regulation dataset
    • Residency and cross-border transfers
    • Retention & integrity
    • Status
    • Subject rights
  • decorators
    • prorm with decorators
    • Models with decorators
    • Querying a decorated model
    • Relations with decorators
  • diagrams
    • Diagram generators
    • Chen diagram
    • Class diagram
    • Dependency diagram
    • ER diagram
    • Flow diagram
    • From your models to a diagram
    • Gantt diagram
    • Index diagram
    • Migration diagram
    • Model diagram
    • Package diagram
    • Crow’s-foot diagram
    • Schema documentation
    • Sequence diagram
    • State diagram
    • Tree diagram
  • dialects
    • SQL dialects
    • AlloyDB Dialect
    • AlloyDB Omni Dialect
    • Amazon Athena Dialect
    • Aurora DSQL Dialect
    • Amazon Aurora MySQL Dialect
    • Amazon Aurora PostgreSQL Dialect
    • Azure Database for MySQL Dialect
    • Azure Database for PostgreSQL Dialect
    • Azure SQL Database Dialect
    • Azure SQL Managed Instance Dialect
    • Google BigQuery Dialect
    • Citus Dialect
    • ClickHouse dialect
    • Cloud Authentication (`cloud-auth`)
    • Cloud SQL for SQL Server Dialect
    • Cloud SQL for MySQL Dialect
    • Cloud SQL for PostgreSQL Dialect
    • CockroachDB Dialect
    • Azure Cosmos DB for PostgreSQL Dialect
    • CrateDB Dialect
    • Cloudflare D1 Dialect
    • Databricks dialect
    • IBM Db2 Dialect
    • Dolt Dialect
    • Apache Doris Dialect
    • Druid Dialect
    • DuckDB Dialect
    • Exasol dialect
    • Microsoft Fabric Data Warehouse Dialect
    • Firebird Dialect
    • Greenplum Dialect
    • SAP HANA Dialect
    • MySQL HeatWave Dialect
    • Azure Data Explorer (Kusto) Dialect — T-SQL
    • MariaDB Dialect
    • Materialize Dialect
    • MonetDB Dialect
    • MotherDuck Dialect
    • Microsoft SQL Server Dialect
    • MySQL Dialect
    • Neon Dialect
    • OceanBase Dialect
    • openGauss Dialect
    • Oracle Dialect
    • Oracle Autonomous Database Dialect
    • ParadeDB Dialect
    • PolarDB Dialect
    • PostgreSQL Dialect
    • Presto Dialect
    • QuestDB Dialect
    • Aurora RDS Data API Dialect (`rdsdata`)
    • Amazon RDS for Db2 Dialect
    • Amazon RDS for MariaDB Dialect
    • Amazon RDS for SQL Server Dialect
    • Amazon RDS for MySQL Dialect
    • Amazon RDS for Oracle Dialect
    • Amazon RDS for PostgreSQL Dialect
    • Amazon Redshift
    • Amazon Redshift Data API Dialect
    • RisingWave Dialect
    • rqlite Dialect
    • SingleStore Dialect
    • Snowflake Dialect
    • Google Cloud Spanner Dialect
    • Spanner (PostgreSQL interface) Dialect
    • SQLite Dialect
    • StarRocks Dialect
    • Supabase Dialect
    • Azure Synapse Analytics (dedicated SQL pool)
    • Teradata Dialect
    • TiDB Dialect
    • TimescaleDB Dialect
    • Trino Dialect
    • Turso / libSQL Dialect
    • Vertica dialect
    • Vitess Dialect
    • Yellowbrick Dialect
    • YugabyteDB Dialect
  • guides
    • Access rules and behaviour profiles
    • ArangoDB (AQL)
    • Associations
    • Audit levels and escalation
    • Audit logging
    • In the browser
    • Bulk operations
    • Caching
    • Capabilities, tiers and team roles
    • CLI
    • Cloudflare
    • Compliance & data protection
    • Connection Pooling & Performance
    • Security in the console
    • Couchbase: structured N1QL queries
    • Data types
    • Decorators
    • Eager loading
    • Enums and constants
    • Error handling & error types
    • Extensions
    • External fields
    • Foreign data wrappers
    • Graph databases
    • Hooks & lifecycle events
    • Indexes & constraints
    • InfluxDB: structured Flux pipelines
    • klock-errors
    • klock — the `.klock` file
    • Local databases (`prorm db up`)
    • Structured log search — Splunk, Graylog, Papertrail, Sumo Logic
    • Logging
    • Grafana Loki: structured LogQL queries
    • MCP server
    • Migrate — the data transfer subsystem
    • Migrations & Schema Sync
    • Models from an existing database
    • Defining models
    • Multiple databases
    • OrientDB, Neptune and TigerGraph
    • Passwords
    • Importing a Prisma schema
    • Structured PromQL and MetricsQL
    • Query firewall
    • QueryInterface
    • Query operators reference
    • Query optimization
    • Composing find options with `pipe()` and `Q`
    • Query safety: the fail-closed WHERE guard
    • Querying
    • Raw Queries & Query Building
    • Read replicas
    • Schema diffing & migration generation
    • Views, triggers & other schema objects
    • Scopes & default scopes
    • Seeders
    • SPARQL / RDF triplestores
    • SQL constants
    • SQL features
    • SQL function builders
    • SQLite advanced features
    • StoreKey — a prod-orm database as the storage
    • Streaming results
    • Terraform
    • Transactions & Isolation Levels
    • Type mapping: legacy and modern
    • TypeScript types
    • Database users, roles & privileges
    • Validation & constraints
    • Virtual & Computed Fields
    • Writing docs
  • javascript
    • prorm in JavaScript
    • Models in JavaScript
    • Querying in JavaScript
    • Relations in JavaScript
  • runbooks
    • Operational runbooks
    • Connection failures
    • Credential rotation
    • Failover
    • Incident checklist
    • Deploying klock v2
    • Migration rollback
  • running-databases
    • Running databases in Docker
    • Running prorm under Bun in Docker
    • Running Cassandra in Docker with prorm
    • Running ClickHouse in Docker with prorm
    • Running CockroachDB in Docker with prorm
    • Running prorm under Deno in Docker
    • Running Elasticsearch in Docker with prorm
    • Running MariaDB in Docker with prorm
    • Running MongoDB in Docker with prorm
  • prorm control plane
    • Introduction
    • Authentication
    • Errors
    • Getting started
      • Service
        • Is it up
        • This description
    • Account
      • Sign-up and verification
        • Create an account
        • Exchange credentials for a token
        • Verify with the emailed code
        • Verify by clicking the emailed link
        • Name the parent or guardian
        • What a consent link is about
        • Give consent for a child's account
        • Ask the parent or guardian again
        • Send a new code and link
      • Family
        • Everyone this account is responsible for
        • One child, in detail
        • Turn a limit on or off
      • Profile
        • Who am I
        • Change the account
        • Every address on the account
        • Add an address
        • Confirm an address with the code mailed to it
        • Mail a fresh code to an unconfirmed address
        • Make an address primary
        • Remove an address
        • What this caller may do
    • Security
      • Sessions
        • Everywhere this account is signed in
        • Sign out everywhere else
        • Sign one out
        • A token for the CLI on a named machine
        • A token for the customer console, from the staff one
        • Park a sign-in for the CLI to collect
        • The CLI collecting its sign-in
        • The team's members' live sessions
        • Sign a member's session out
        • Sign an account out everywhere
        • Everywhere the account is signed in
        • Sign an account's session out
      • Single sign-on
        • Begin a single sign-on
        • The provider's return
        • Link the signed-in account to a team's provider
        • Which team an address signs in to
        • The team's single sign-on, as a member sees it
        • Set the team's OpenID Connect provider up, or change it
        • Remove the provider
        • The team's domain claims and the DNS record each needs
        • Prove a claimed domain
      • MFA and passwords
        • Start enrolling a second factor
        • Prove the app has it
        • Remove the second factor
        • Ask for a reset link
        • Set a new password with the emailed token
      • Klock
        • Open a device-bound klock session
        • Check in, for the next grant
        • Step up the session asking
        • Rotate the device key
        • Freeze a session
        • Unfreeze a session
        • A guest grant
        • The revocation feed
        • The published keyset
        • What this control plane supports
      • Devices
        • Your devices, or a team's
        • Approve a new device's pairing code
        • One device
        • Rename a device
        • Revoke a device
        • Suspend a device
        • Reinstate a suspended device
        • Wipe a device
        • Ask a device to rotate its key
        • The team's members' devices
        • Revoke a member's device
        • An account's devices
        • Revoke an account's device
        • Wipe an account's device
        • The device fleet
      • Access rules and behaviour
        • The access rules that bear on you
        • Add an access rule
        • This request, as the rules see it
        • One access rule
        • Remove an access rule
        • The behaviour profiles that bear on you
        • Add or change a behaviour profile
        • The profile presets
        • Your behaviour findings
        • Acknowledge a finding
        • One behaviour profile
        • Remove a behaviour profile
        • The team's access rules
        • Add a team access rule
        • Remove a team access rule
        • The team's behaviour profiles
        • Add or change a team behaviour profile
        • Remove a team behaviour profile
        • What the team's profiles caught
        • Acknowledge a team finding
      • Recovery and lockdown
        • Ask for a recovery link
        • Recover access with the emailed code
        • Is the account locked down
        • Lock the account down
        • Release a lockdown
        • Lock a member down
        • Release a member's lockdown
      • MCP tokens
        • Make a delegated token for one MCP client
        • The account's delegated tokens
        • Revoke a delegated token
        • What a delegated token may do now
        • Run one MCP tool with a delegated token
        • Run a device-signed MCP tool call relayed by the MCP Worker
      • Kerberos
        • Give the team its own Kerberos realm
        • The team's realm
        • Remove the team's realm
    • Logging and monitoring
      • Audit log
        • What has been done to the account
        • What has happened to this account
        • The account's audit trail
      • Operations
        • Everything that has been asked of this database
        • One, with its steps
        • Stop it
        • Put a failed one back in the queue
        • Every operation, across all accounts
      • Metrics and events
        • Every measurement, for a graph
        • Who did what to it
    • Billing
      • Plans and pricing
        • What the plans allow
        • The rate card
        • What one database would cost
        • What this account is paying for, itemised
      • Subscriptions and invoices
        • What this month's invoice will say
        • What this account is on
        • What it has been charged
        • Start a Stripe Checkout session
        • Open the customer portal
        • Stripe's events
        • Buy more connection pools
      • Team billing
        • The team's billing account
        • What the team has been charged
        • What this month's invoice will say
        • The team's cards
        • Add a card, through a Stripe-hosted setup session
        • Make a card the team's default
        • Remove a card
        • Start the team paying
        • Open the Stripe portal on the team's customer
        • Change the team's plan
        • Who receives the team's bills
        • How the team pays for transfers
    • Support
      • Support chat
        • My conversations
        • Start a conversation
        • Every support conversation, open first
        • A ticket for the socket
        • One conversation, with who is in it and who is connected
        • Rename a group; open or close a support conversation
        • The lines, oldest first
        • Say something
        • Add somebody
        • Mark read
    • Administration
      • Users
        • Every account
        • One account, with everything hanging off it
        • Grant or revoke admin
        • Verify an account by hand
        • Lock or unlock sign-in
        • Allow or hold provisioning
        • Send the verification mail again
        • Set the plan by hand
      • Platform
        • Every database and store, across all accounts
        • The counts worth putting on a dashboard
      • Staff and permissions
        • What kind of admin the caller is, and which scopes they hold
        • The admin presets
        • Every admin, and the scopes each resolves to
        • Make an account an admin of a kind
        • Change an admin's kind, or a custom admin's scopes
        • Revoke admin
      • Team administration
        • Every team, with its owner and size
        • One team in full — members with their accounts, and projects
        • Hand the team to another member
        • Put an account in the team, active at once
        • Change a member's role
        • Remove a member
      • Assumed identities
        • Assume an identity — act as a customer account
        • The identities the caller holds open
        • End an assumed identity
      • Support inbox
        • The platform's addresses
        • Add a platform address
        • One address, with its counts
        • Change an address's label, routing, or whether it accepts mail
        • Remove an address that holds no mail
        • Make, adopt or repair the address's routing rule
        • Every admin's personal address, made where missing
        • File a raw message, as if it had arrived
        • The inbox
        • One message, whole
        • Mark a message
        • Hand a message to an admin, or take it back
        • Leave an internal note
        • Reply, from the address the message came to
        • What is waiting
    • Databases
      • Databases
        • Data stores
          • Every data store on the account
          • Provision a data store
          • Change a data store that is already running
          • One data store
          • Deprovision it
          • Report what it is using
          • How to reach a data store
        • Connections and credentials
          • The api keys on a database
          • Issue a key
          • Revoke a key
          • The engine users we created
          • Create a user inside the database
          • Give a user a new password
          • Drop a user
          • How the database is reached
          • Set how it is reached
          • Revoke every api key on it
          • How to connect to it
          • The ssh keys that open its bastion
          • Add a key, or have one made
          • The private half of a generated key, once
          • Revoke an ssh key
        • Schema and objects
          • The SQL objects we put in it
          • Create one, and apply it
          • What is in the database, as the engine reports it
          • One table
          • What it would run, without running it
          • Redefine an object in place
          • Drop it
          • The extensions installed in it
        • Migrations
          • A plan compiled to statements, recording nothing
          • The migrations recorded for it
          • Record one
          • Apply everything recorded and not yet run
          • Apply everything pending, oldest version first
        • Lifecycle
          • Grow or shrink it
          • Stop it accepting connections
          • Start it again
          • Move it to another region
        • Backups and replicas
          • Take a backup
          • The backups it has
          • Restore one into it
          • What has been restored into it, and from where
          • Its read copies
          • Add one
        • Policies
          • The catalog
          • One policy
          • What this database is held to
          • Switch a policy on, or change its knobs
          • Switch it off
          • Mark the policies reviewed
          • Evaluate the periodic policies now
          • Who is behind a credential
        • Passwordless
          • The database's passwordless sessions
          • Issue a passwordless session (v1)
          • Revoke a passwordless session
          • Bind a session to a device key
          • Issue a v2 session for a host to bind
          • Redeem an enrolment ticket on the host
          • Check a passwordless credential
          • Run one described query under a passwordless credential
        • Database roles
          • The database's roles
          • Define a role
          • One role
          • Change what a role permits
          • Delete a role, and revoke every key granted it
          • Grant a role, which mints a key
          • Who holds a role
          • The api keys bound to a role
        • Pools
          • A database's connection pools, and how busy each is
          • Open another pool
          • Rename a pool or change its size
          • Close a pool
        • Data plane
          • Run a query against a database
          • Several statements, in order, over one connection
          • Is this database answering
          • What the proxy itself is holding
        • Transfers
          • The strategies this account's tier may use
          • Price a transfer without creating it
          • The account's transfer jobs, newest first
          • Create a transfer job
          • One job, and whether its certificate holds
          • Cancel an unfinished job
          • Start a created job, confirming its price
          • Report a job's status (the runner, or the owner's side of a local run)
        • Every database on the account
        • Provision a database
        • Change a database that is already running
        • One database
        • Deprovision it
        • Read or write it
        • Report what it is using
        • The engines this API will provision
        • Where a managed database can be put
    • Teams
      • Teams
        • Members
          • Who is on it
          • Invite somebody
          • Accept an invitation
          • Change somebody's role
          • Remove somebody
        • Projects
          • The projects a team runs
          • Start one
          • Rename a project, or move its environment
          • Delete a project
          • One project, and what is in it
          • Put a database or store in it
          • What is in a project
          • Take one out
        • The teams this account is on
        • Start one
        • The twelve roles, and what each may do
        • Rename a team
        • Close a team
        • One team
        • Hand the team to somebody else
        • Leave a team
    • Schemas
      • Error
      • ValidationErrors
      • Token
      • PolicyCategory
      • PolicySeverity
      • PolicyAction
      • PolicyTrigger
      • PolicyParam
      • Policy
      • PolicyCatalog
      • PolicyAssignment
      • PolicyOutcome
      • PolicyFiring
      • CredentialTrace
      • Relation
      • Restrictions
      • ChildSummary
      • SignupRequest
      • SigninRequest
      • UpdateMeRequest
      • User
      • Address
      • GeoPoint
      • D1Region
      • Usage
      • UsageReport
      • Resource
      • Database
      • DataStore
      • NewDatabase
      • NewDataStore
      • QueryRequest
      • DatabasePrivilege
      • ApiKey
      • DbUser
      • Access
      • AccessRequest
      • DatabaseObject
      • NewDatabaseObject
      • NewMigration
      • SchemaOperation
      • Migration
      • Operation
      • Session
      • AdminPowers
      • Admin
      • AuditEntry
      • TeamRole
      • Conversation
      • ChatMessage
      • TeamSso
      • Team
      • TeamMember
      • SshKey
      • ConnectionInfo
      • InboxAddress
      • InboxMailbox
      • InboxMessageSummary
      • InboxMessage
      • InboxNote
      • Page
      • Quote
      • Plan
      • ApiError
      • CapabilityRefusal
      • KlockErrorCode
      • PageWindow
      • SessionView
      • KlockStepUpRequest
      • KlockOpenRequest
      • KlockOpenedSession
      • UpdateMeResult
      • CapabilitiesView
      • SessionLimits
      • Device
      • DeviceListed
      • DeviceTeamRef
      • DeviceCommand
      • DeviceAuditLine
      • DeviceActionRequest
      • StaffActionRequest
      • ManagedSession
      • SessionRevoked
      • AccessRule
      • AccessRuleRequest
      • BehaviourProfile
      • BehaviourProfileRequest
      • BehaviourProfileSaved
      • BehaviourFinding
      • BehaviourFindingAck
      • StepUpProof
      • Removed
      • MemberLockdownRequest
      • McpClient
      • McpDelegatedView
      • McpToolCall
      • McpForwardRequest
      • PasswordlessScope
      • RoleScope
      • PasswordlessSession
      • PasswordlessTlsMaterial
      • PasswordlessKerberosMaterial
      • ServiceDeviceKeys
      • ServiceSession
      • DatabaseRole
      • TransferEndpoint
      • TransferJobRequest
      • TransferQuote
      • TransferStrategy
      • TransferJob
      • TransferJobAccess
      • Pool
      • PoolAllowance
      • BillingSubscription
      • Invoice
      • BillingContact
      • PaymentMethod
      • UpcomingCharges
      • TeamBilling
      • TeamKerberosRealm
      • TeamSsoDomain
      • TeamSsoResponse
      • StoreConnection
      • BatchFailure
      • ProxyStatus
  1. guides

Query operators reference

Every non-trivial where clause in prorm is expressed with operators. Write one
by name, inside the condition object for a column:
User.findAll({ where: { age: { gte: 18 } } });
User.findAll({ where: { name: { like: 'A%' } } });
User.findAll({ where: { or: [{ age: { lt: 40 } }, { status: 'retired' }] } });
That is the form to reach for. Three others mean exactly the same thing and all
still work, so existing code needs no change:
User.findAll({ where: { age: { $gte: 18 } } });        // $-prefixed
User.findAll({ where: { age: { [Op.gte]: 18 } } });    // Op symbol
User.findAll({ where: gte('age', 18) });               // helper function
All four compile to the same SQL on every engine:
Op is exported from src/operators.ts (also
as Operators), alongside helper functions such as and, or, eq, like,
between.
The examples below use a small shop schema — users, orders, products —
defined in Querying. The SQL is what each engine's
builder produced for the call, with values escaped in the way a define()
model sends them.
A bare value is shorthand for equality: { name: 'John' } is identical to
{ name: { eq: 'John' } }.
Note: the tables below name each operator with its $ prefix, because that is
the canonical internal form. Drop the $ and you have the plain name — $gte
is gte, $notILike is notILike.

Where a name is read as an operator#

Inside a column's condition — the { … } after a column name — every key is an
operator, so any operator name is understood there.
At the top level of a where, keys are column names, so only the logical
operators and, or and not are read as operators. A column called
contains or like therefore keeps working:
Not every builder renders every operator below. One it does not render is
refused with UnsupportedWhereError before the statement is sent, naming the
operator and the dialect, rather than dropped from the SQL — see
Query safety.
User.findAll({ where: { contains: 'x' } });     // the column "contains"
User.findAll({ where: { and: [{ age: { gte: 18 } }, { active: true }] } }); // the AND operator
A column actually named and, or or not has to be reached another way —
they are SQL reserved words, so this is unlikely to come up.
[!NOTE]
Before this, a bare name was silently treated as a value —
{ age: { gte: 18 } } compiled to age = '{"gte":18}', a query that ran and
quietly matched nothing rather than raising an error. If you have a query that
mysteriously returned no rows, this may be why.

Engine support at a glance#

The portable core — comparisons, in / notIn, between, null checks,
like / notLike and the logical operators — renders on every SQL engine.
Past that, support varies, and the fail-closed guard turns a gap into an error
rather than a missing condition. Captured from the builders:
OperatorPostgreSQLMySQLSQLiteSQL Server
eq ne gt gte lt lte in notIn between isNull like notLikeyesyesyesyes
and or not (top level)yesyesyesyes
isDistinctFromIS DISTINCT FROMNOT (… <=> …)IS NOT(… IS NULL OR … <> …)
iLike notILikeILIKEthrowsLIKEthrows
startsWith endsWith substringILIKE … ESCAPELIKELIKE … ESCAPEthrows
regexp~REGEXPneeds a registered regexp functionthrows
iRegexp~*throwsthrowsthrows
not on a column!=!=!=<>
is: null / not: nullIS [NOT] NULLIS [NOT] NULLIS [NOT] NULLIS [NOT] NULL
col() / literal() as the valueyesthrowsyesthrows
exists notExists inSubqueryyesthrowsyesthrows
match@@ plainto_tsqueryMATCH … AGAINSTMATCH (FTS5)throws
contains (JSON)@>throwsjson_each subquerythrows
keyExists?throwsthrowsthrows
Op.json(path)#>>JSON_EXTRACTjson_extractJSON_VALUE
arrayContains arrayOverlaps arrayAny@> && = ANYthrowsthrowsthrows
"throws" means UnsupportedWhereError (or a dialect error naming the
operator) before anything reaches the database — see
Query safety.

Comparison operators#

The core comparison operators map directly to SQL comparison operators. Each takes a single value.
User.findAll({ where: { status: { [Op.eq]: 'active' } } });   // status = ?
User.findAll({ where: { status: { [Op.ne]: 'banned' } } });   // status != ?
User.findAll({ where: { age: { [Op.gt]: 18 } } });            // age > ?
User.findAll({ where: { age: { [Op.gte]: 18 } } });           // age >= ?
User.findAll({ where: { age: { [Op.lt]: 65 } } });            // age < ?
User.findAll({ where: { age: { [Op.lte]: 64 } } });           // age <= ?
Helper equivalents: eq, ne, gt, gte, lt, lte. Each is called as helper(column, value):
User.findAll({ where: and(gte('age', 18), lte('age', 64)) });
A realistic filter — "large orders that are not cancelled":
await Order.findAll({ where: { total: { gte: 500 }, status: { ne: 'cancelled' } } });
ne does not match NULL — in SQL, NULL != 'cancelled' is unknown, not
true. When the column is nullable and you want "anything but", use
isDistinctFrom, which each engine spells differently:
await Order.findAll({ where: { status: { [Op.isDistinctFrom]: 'paid' } } });
Any comparison value may be a column reference (col()) or a raw literal (Op.literal) instead of a bound value — see Column & literal references.
import { col } from 'ts-prorm-orm';

Product.findAll({ where: { stock: { lte: col('reorderLevel') } } });
// "stock" <= "reorderLevel"

Range & set operators#

in / notIn take an array of candidate values. between / notBetween take a two-element [start, end] tuple.
User.findAll({ where: { status: { [Op.in]: ['active', 'pending'] } } });      // status IN (?, ?)
User.findAll({ where: { status: { [Op.notIn]: ['banned', 'deleted'] } } });   // status NOT IN (?, ?)
User.findAll({ where: { age: { [Op.between]: [18, 65] } } });                  // age BETWEEN ? AND ?
User.findAll({ where: { age: { [Op.notBetween]: [13, 17] } } });              // age NOT BETWEEN ? AND ?
Helpers: inOp (exported as in), notIn, between(column, start, end), notBetween(column, start, end).
An empty list is legal and means what it says — in: [] matches nothing,
notIn: [] matches everything — rather than producing the invalid IN ():
await Order.findAll({ where: { status: { in: [] } } });     // WHERE FALSE   (1 = 0 on SQLite / SQL Server)
await Order.findAll({ where: { status: { notIn: [] } } });  // WHERE TRUE    (1 = 1 on SQLite / SQL Server)
import { in as inOp, notIn, between } from 'ts-prorm-orm';

User.findAll({ where: inOp('status', ['active', 'pending']) });
User.findAll({ where: between('age', 18, 65) });

NULL checks#

isNull and isNotNull emit IS NULL / IS NOT NULL. In symbol form pass true; the value is only used to pick the direction ({ [Op.isNull]: false } compiles to IS NOT NULL).
User.findAll({ where: { deletedAt: { [Op.isNull]: true } } });      // "deletedAt" IS NULL
User.findAll({ where: { email: { [Op.isNotNull]: true } } });      // "email" IS NOT NULL
Helpers isNull(column) and isNotNull(column) are the concise form:
User.findAll({ where: isNull('deletedAt') });
User.findAll({ where: isNotNull('email') });
A null value is also turned into IS NULL — { status: null } compiles to
"status" IS NULL, never = NULL, which would match nothing.
Op.is and Op.not also exist. { deletedAt: { [Op.is]: null } } is
"deletedAt" IS NULL and { deletedAt: { [Op.not]: null } } is
IS NOT NULL, on every engine in the table above. Op.not used as a field key
with a value negates equality ({ status: { [Op.not]: 'active' } } →
status != ?, <> on SQL Server); Op.not used as a top-level key negates a
whole condition (see Logical operators). Before 4.9.2,
MySQL and SQL Server refused is and not on a column with
UnsupportedWhereError.

Pattern matching (LIKE)#

like / notLike are case-sensitive; iLike / notILike are the case-insensitive (ILIKE) variants. In symbol form you supply the full pattern including % wildcards.
User.findAll({ where: { name: { [Op.like]: '%john%' } } });        // name LIKE '%john%'
User.findAll({ where: { name: { [Op.notLike]: 'test%' } } });      // name NOT LIKE 'test%'
User.findAll({ where: { email: { [Op.iLike]: '%@GMAIL.com' } } }); // email ILIKE '%@GMAIL.com'
The helper functions (like, notLike, iLike, notILike) wrap the value in %…% for you (contains matching), so you pass the bare term:
User.findAll({ where: like('name', 'john') });   // name LIKE '%john%'
User.findAll({ where: iLike('name', 'john') });  // name ILIKE '%john%'
Case-insensitive matching is where the engines split. PostgreSQL has ILIKE;
SQLite's LIKE is already case-insensitive for ASCII, so iLike becomes plain
LIKE; MySQL and SQL Server have no builder for it and refuse:
await User.findAll({ where: { email: { iLike: '%@GMAIL.com' } } });
UnsupportedWhereError: Cannot render WHERE condition at email.$iLike for mysql:
the operator '$iLike' is not implemented by its WHERE builder.
UnsupportedWhereError: Cannot render WHERE condition at email.$iLike for mssql:
the operator '$iLike' is not implemented by its WHERE builder.
On MySQL and SQL Server use plain like: their default collations are
case-insensitive already.

Affix helpers — startsWith / endsWith / contains#

These helpers build one-sided or two-sided LIKE patterns without you writing %:
import { startsWith, endsWith, substring, notStartsWith, notEndsWith } from 'ts-prorm-orm';

User.findAll({ where: startsWith('name', 'John') });      // name LIKE 'John%'
User.findAll({ where: endsWith('email', '@gmail.com') }); // email LIKE '%@gmail.com'
User.findAll({ where: substring('name', 'oh') });         // name LIKE '%oh%'
User.findAll({ where: notStartsWith('name', 'test') });   // name NOT LIKE 'test%'
User.findAll({ where: notEndsWith('file', '.tmp') });     // file NOT LIKE '%.tmp'
substring is the "contains" helper (identical to like). notSubstring is its negation.
Unlike like, the affix helpers treat the term as text, not a pattern: a %
or _ in it is escaped. "Products whose name mentions 50%":
await Product.findAll({ where: substring('name', '50%') });
UnsupportedWhereError: Cannot render WHERE condition at name.$substring for mssql:
the operator '$substring' is not implemented by its WHERE builder.
[!WARNING] The affix helpers are case-insensitive on PostgreSQL
startsWith, endsWith and substring compile to ILIKE on PostgreSQL but
LIKE elsewhere, so startsWith('sku', 'kb-') matches KB-01 there and —
under a case-sensitive collation — not on the others. Use { like: 'KB-%' }
when case must count.

Regular-expression operators#

regexp / notRegexp and their case-insensitive forms iRegexp / notIRegexp emit database-specific REGEXP clauses. Values may be a string or a RegExp.
User.findAll({ where: { name: { [Op.regexp]: '^[A-Z]' } } });     // name REGEXP '^[A-Z]'
User.findAll({ where: { name: { [Op.notRegexp]: '[0-9]' } } });   // name NOT REGEXP '[0-9]'
Helpers: regexp, notRegexp, iRegexp, notIRegexp — each helper(column, pattern).
"SKUs of the form KB- followed by digits":
await Product.findAll({ where: { sku: { regexp: '^KB-[0-9]+$' } } });
[ORM] sqlite: $regexp on "sku" needs a REGEXP function, and SQLite has none built in.
Register one on the connection — getConnection().function('regexp', { deterministic: true },
(pattern, value) => (new RegExp(pattern).test(value) ? 1 : 0)) — or create the dialect with
{ regexp: true } for an engine that ships one.
UnsupportedWhereError: Cannot render WHERE condition at sku.$regexp for mssql:
the operator '$regexp' is not implemented by its WHERE builder.
iRegexp renders only on PostgreSQL (~*).

Logical operators#

and, or, not combine or negate conditions. The helper functions are the ergonomic form: and(...conditions), or(...conditions), not(condition).
// AND — all must hold
User.findAll({ where: and({ status: 'active' }, gte('age', 18)) });

// OR — any may hold
User.findAll({ where: or({ role: 'admin' }, { role: 'moderator' }) });

// NOT — negate a nested condition
User.findAll({ where: not({ status: 'banned' }) });

// Nested combination
User.findAll({
  where: and(
    { status: 'active' },
    or(gte('age', 65), lt('age', 18)),
  ),
});
All four engines render the nested combination the same way apart from
quoting:
The where({ AND: [...] }) / where({ OR: [...] }) object form is also accepted and normalized to $and / $or. The Op.and / Op.or / Op.not symbols work as keys too, but the helper functions are clearer.

Existence & subquery operators#

exists / notExists wrap a correlated subquery (a SQL string or Op.literal). Useful for semi-joins and anti-joins.
import { exists, notExists, inSubquery, notInSubquery } from 'ts-prorm-orm';

// Users that have at least one order
User.findAll({ where: exists('SELECT 1 FROM orders WHERE orders.user_id = users.id') });

// Users with no orders (anti-join)
User.findAll({ where: notExists('SELECT 1 FROM orders WHERE orders.user_id = users.id') });
inSubquery(column, subquery) and notInSubquery(column, subquery) build IN (…) / NOT IN (…) against a subquery instead of a value array:
User.findAll({ where: inSubquery('id', 'SELECT user_id FROM orders') });
User.findAll({ where: notInSubquery('id', 'SELECT user_id FROM banned_users') });
On PostgreSQL and SQLite these compile as written:
MySQL and SQL Server refuse them with UnsupportedWhereError (their builders
do not render subquery predicates yet), so on those engines express the
semi-join as an include with required: true, or run
it through prorm.query().
[!CAUTION]
The subquery string is spliced into the statement verbatim — it is not
parameterised. Never build it from request input.
For join-based exclusion there are also antiJoin(model, options) and its alias exclude(model, options), used inside include.

Array operators (PostgreSQL)#

For PostgreSQL array columns:
import { arrayContains, arrayContainedBy, arrayOverlaps, arrayAny, arrayAll } from 'ts-prorm-orm';

Product.findAll({ where: { tags: { [Op.arrayContains]: ['electronics', 'sale'] } } });   // tags @> ARRAY[...]
Product.findAll({ where: { tags: { [Op.arrayContainedBy]: ['a', 'b', 'c'] } } });        // tags <@ ARRAY[...]
Product.findAll({ where: { tags: { [Op.arrayOverlaps]: ['electronics', 'sale'] } } });   // tags && ARRAY[...]
Product.findAll({ where: { tags: { [Op.arrayAny]: 'electronics' } } });                  // 'electronics' = ANY(tags)
Product.findAll({ where: { prices: { [Op.arrayAll]: { [Op.gt]: 100 } } } });             // 100 > ALL(prices)
With the values escaped in, the first compiles to
SELECT * FROM "products" WHERE "tags" @> ARRAY['electronics', 'sale']. The
other SQL engines have no array type and refuse these operators.
Each has a matching helper (arrayContains, arrayContainedBy, arrayOverlaps, arrayAny, arrayAll). The generic Op.any / Op.all symbols (helpers anyOp/allOp, exported as any/all) build = ANY(...) / = ALL(...) comparisons.

JSON / JSONB operators#

For JSON and JSONB columns. The most common are contains, containedBy, keyExists, and overlap:
User.findAll({ where: { preferences: { [Op.contains]: { theme: 'dark' } } } });             // @> (PG) / JSON_CONTAINS (MySQL)
User.findAll({ where: { settings: { [Op.containedBy]: { theme: 'dark', lang: 'en' } } } }); // <@
User.findAll({ where: { data: { [Op.keyExists]: 'role' } } });                              // key/index exists
User.findAll({ where: { tags: { [Op.overlap]: ['admin', 'vip'] } } });                      // && (arrays overlap)
"Users who chose the dark theme", by containment:
await User.findAll({ where: { preferences: { contains: { theme: 'dark' } } } });
UnsupportedWhereError: Cannot render WHERE condition at preferences.$contains for mysql:
the operator '$contains' is not implemented by its WHERE builder.
UnsupportedWhereError: Cannot render WHERE condition at preferences.$contains for mssql:
the operator '$contains' is not implemented by its WHERE builder.
To query a value at a JSON path, use Op.json(path) as a computed key. The
value can be a plain value, null, or an operator object such as
{ gt: 30 }, which then applies to the value at the path:
await User.findAll({ where: { preferences: { [Op.json('$.theme')]: 'dark' } } });
Where the engine extracts the value as text (PostgreSQL, SQL Server, DuckDB),
it is cast to match what you compare it with: a number compares as a number,
a boolean as a boolean. Oracle and CockroachDB refuse Op.json with
UnsupportedWhereError.
{ [Op.key]: { path, value } } is the same condition as
{ [Op.json(path)]: value }, and { [Op.key]: 'path' } matches rows where the
path holds a value. In TypeScript, write the key as [Op.key as any].
PostgreSQL-specific JSONB operators are also available as symbols: jsonContains (@>), jsonHasKey (?), jsonbExtract (->), jsonbExtractText (->>), jsonbExtractPath (#>), jsonbExtractPathText (#>>), jsonConcat (||), jsonDelete (-), jsonDeletePath (#-), jsonPathExists (@?), jsonPathQuery (@@), and jsonTypeOf (json_typeof). A legacy Op.$json symbol also exists.
User.findAll({ where: { data: { [Op.jsonHasKey]: 'role' } } });               // data ? 'role'
User.findAll({ where: { data: { [Op.jsonPathExists]: '$.address.city' } } }); // data @? '$.address.city'

Column & literal references#

Op.col(name) references another column; Op.literal(sql) embeds a raw SQL expression. Both are values, usable anywhere a comparison value is expected.
col() is exported from the package root (Op.col is the operator symbol,
not this function).
import { col, Op } from 'ts-prorm-orm';

// Compare two columns: products that need reordering
Product.findAll({ where: { stock: { [Op.lte]: col('reorderLevel') } } });
// "stock" <= "reorderLevel"

// Compare against a raw SQL expression
Order.findAll({ where: { createdAt: { [Op.lt]: Op.literal('CURRENT_TIMESTAMP') } } });
// "createdAt" < CURRENT_TIMESTAMP

// Set a column to a literal in an update
User.update({ lastLogin: Op.literal('NOW()') }, { where: { id: 1 } });
As an operand, col() and Op.literal() render on PostgreSQL and SQLite. The
MySQL and SQL Server builders would bind them as a JSON string, so the guard
refuses them there instead.
Op.where(column, value) or Op.where(column, operator, value) builds an explicit clause, accepting either a column name or col(...) and string operators ('=', '!=', '>', 'like', 'between', 'is null', …) or operator symbols:
import { col, Op } from 'ts-prorm-orm';

User.findAll({ where: Op.where(col('email'), 'ada@example.com') });  // "email" = 'ada@example.com'
Product.findAll({ where: Op.where(col('price'), '>', col('cost')) }); // "price" > "cost"
Used as the whole where, this form is rendered by the PostgreSQL builder
only; the others refuse it. The object form ({ price: { gt: col('cost') } })
is the portable spelling.

Full-text search#

Op.match / helper match(column, term) build a database-appropriate full-text clause. For MySQL, Op.matchAgainst(columns, { mode }) and Op.matchFulltext(columns) produce MATCH … AGAINST … keys; for PostgreSQL, Op.toTsvector(column, config) and Op.toTsquery(query, config) build to_tsvector / to_tsquery expressions.
Article.findAll({ where: match('body', 'javascript programming') });

Article.findAll({
  where: { [Op.matchAgainst(['title', 'body'], { mode: 'boolean' })]: '+mysql -oracle' },
});
The same match() against the product catalogue, per engine:
import { match } from 'ts-prorm-orm';

await Product.findAll({ where: match('name', 'wireless keyboard') });
UnsupportedWhereError: Cannot render WHERE condition at name.$match for mssql:
the operator '$match' is not implemented by its WHERE builder.
Each needs the engine's full-text machinery behind it: a FULLTEXT index on
MySQL, an FTS5 virtual table on SQLite, and ideally a tsvector index on
PostgreSQL — see SQL features.

Spatial / geometric operators#

Symbol operators for PostGIS / MySQL spatial columns: stDistance, stWithin, stContains, stIntersects, stDWithin, stCrosses, stOverlaps, stTouches, stEquals, stIsValid.
Place.findAll({
  where: {
    location: { [Op.stDWithin]: { from: 'POINT(-122.4 37.7)', distance: 1000, srid: 4326 } },
  },
});
Range/interval operators strictLeft, strictRight, noExtendRight, noExtendLeft, adj, notAdj are likewise available as symbols for PostgreSQL range types.

Expression & ordering helpers#

Op also carries expression builders used in attributes and order, not just where:
import { col, Op } from 'ts-prorm-orm';

Product.findAll({ attributes: [[Op.cast(col('price'), 'DECIMAL(10,2)'), 'priceDecimal']] });
Order.findAll({ attributes: [[Op.extract('createdAt', 'year'), 'year']] });  // EXTRACT(YEAR FROM ...)
User.findAll({ order: [Op.asc('name'), Op.desc('createdAt')] });             // ORDER BY "name" ASC, "createdAt" DESC
User.findAll({ order: [Op.random()], limit: 5 });                            // random sample
[!NOTE] How Op.extract is spelled per engine
PostgreSQL and MySQL render EXTRACT(YEAR FROM "createdAt"), SQL Server
DATEPART(year, [createdAt]), and SQLite
CAST(strftime('%Y', "createdAt") AS INTEGER). SQLite has no strftime()
form for millisecond, microsecond or isodow and refuses them.
Op.conv(value, from, to) builds a MySQL CONVERT / cast expression.

Cheat sheet#

Grouped rather than listed, so you can find the row you want. Every operator
below is documented in full further up this page.

Comparison#

OperatorSQL
Op.eq Op.ne= ? · != ?
Op.gt Op.gte> ? · >= ?
Op.lt Op.lte< ? · <= ?

Sets, ranges and null#

OperatorSQL
Op.in Op.notInIN (…) · NOT IN (…)
Op.between Op.notBetweenBETWEEN ? AND ? · NOT BETWEEN ? AND ?
Op.isNull Op.isNotNullIS NULL · IS NOT NULL

Pattern matching#

OperatorSQL
Op.like Op.notLikeLIKE ? · NOT LIKE ?
Op.iLike Op.notILikeILIKE ? · NOT ILIKE ? (PostgreSQL)
startsWith endsWith substringLIKE 'v%' · LIKE '%v' · LIKE '%v%'
Op.regexp Op.iRegexpREGEXP · case-insensitive REGEXP

Logic and subqueries#

OperatorSQL
Op.and Op.or Op.notAND · OR · NOT (…)
Op.exists Op.notExistsEXISTS · NOT EXISTS
inSubquery notInSubqueryIN (SELECT …) · NOT IN (SELECT …)

Arrays — PostgreSQL#

OperatorSQL
Op.arrayContains Op.arrayContainedBy@> · <@
Op.arrayOverlaps&&
Op.any Op.all= ANY(…) · ALL(…)

JSON#

OperatorSQL
Op.contains Op.containedBy@> · <@
Op.keyExists Op.overlapkey exists · &&
Op.json(path) Op.keypath extraction
Op.jsonHasKey Op.jsonbExtract Op.jsonPathExists? · -> · @? (PostgreSQL)

Expressions and ordering#

OperatorSQL
Op.col Op.literal Op.wherea column · raw SQL · a bare condition
Op.cast Op.extract Op.convCAST · EXTRACT · CONVERT
Op.asc Op.desc Op.randomORDER BY … ASC · DESC · RANDOM()
Op.match Op.matchAgainstMATCH … AGAINST · @@
Op.stWithin Op.stDWithin Op.stIntersectsthe ST_* spatial functions

Next: Associations — the four relationship shapes and which side owns the foreign key.

Related reading#

Querying — where these operators are used
SQL functions — fn(), col() and literal()
Modified at 2026-10-04 00:40:16
Previous
QueryInterface
Next
Query optimization
Built with