1. guides
prorm
  • prorm documentation
  • Known test gaps
  • Architecture
  • Core concepts
  • Database types & coverage
  • Getting started
  • Going further
  • compliance
    • Compliance
    • The security toolkit: `prorm audit`
    • Checklists by regulation
    • Declaring personal data
    • Evidence bundles
    • Evidence
    • Frameworks: `@Security`
    • Jurisdictions
    • Platform policies
    • Protecting data
    • The regulation dataset
    • Residency and cross-border transfers
    • Retention & integrity
    • Status
    • Subject rights
  • decorators
    • prorm with decorators
    • Models with decorators
    • Querying a decorated model
    • Relations with decorators
  • diagrams
    • Diagram generators
    • Chen diagram
    • Class diagram
    • Dependency diagram
    • ER diagram
    • Flow diagram
    • From your models to a diagram
    • Gantt diagram
    • Index diagram
    • Migration diagram
    • Model diagram
    • Package diagram
    • Crow’s-foot diagram
    • Schema documentation
    • Sequence diagram
    • State diagram
    • Tree diagram
  • dialects
    • SQL dialects
    • AlloyDB Dialect
    • AlloyDB Omni Dialect
    • Amazon Athena Dialect
    • Aurora DSQL Dialect
    • Amazon Aurora MySQL Dialect
    • Amazon Aurora PostgreSQL Dialect
    • Azure Database for MySQL Dialect
    • Azure Database for PostgreSQL Dialect
    • Azure SQL Database Dialect
    • Azure SQL Managed Instance Dialect
    • Google BigQuery Dialect
    • Citus Dialect
    • ClickHouse dialect
    • Cloud Authentication (`cloud-auth`)
    • Cloud SQL for SQL Server Dialect
    • Cloud SQL for MySQL Dialect
    • Cloud SQL for PostgreSQL Dialect
    • CockroachDB Dialect
    • Azure Cosmos DB for PostgreSQL Dialect
    • CrateDB Dialect
    • Cloudflare D1 Dialect
    • Databricks dialect
    • IBM Db2 Dialect
    • Dolt Dialect
    • Apache Doris Dialect
    • Druid Dialect
    • DuckDB Dialect
    • Exasol dialect
    • Microsoft Fabric Data Warehouse Dialect
    • Firebird Dialect
    • Greenplum Dialect
    • SAP HANA Dialect
    • MySQL HeatWave Dialect
    • Azure Data Explorer (Kusto) Dialect — T-SQL
    • MariaDB Dialect
    • Materialize Dialect
    • MonetDB Dialect
    • MotherDuck Dialect
    • Microsoft SQL Server Dialect
    • MySQL Dialect
    • Neon Dialect
    • OceanBase Dialect
    • openGauss Dialect
    • Oracle Dialect
    • Oracle Autonomous Database Dialect
    • ParadeDB Dialect
    • PolarDB Dialect
    • PostgreSQL Dialect
    • Presto Dialect
    • QuestDB Dialect
    • Aurora RDS Data API Dialect (`rdsdata`)
    • Amazon RDS for Db2 Dialect
    • Amazon RDS for MariaDB Dialect
    • Amazon RDS for SQL Server Dialect
    • Amazon RDS for MySQL Dialect
    • Amazon RDS for Oracle Dialect
    • Amazon RDS for PostgreSQL Dialect
    • Amazon Redshift
    • Amazon Redshift Data API Dialect
    • RisingWave Dialect
    • rqlite Dialect
    • SingleStore Dialect
    • Snowflake Dialect
    • Google Cloud Spanner Dialect
    • Spanner (PostgreSQL interface) Dialect
    • SQLite Dialect
    • StarRocks Dialect
    • Supabase Dialect
    • Azure Synapse Analytics (dedicated SQL pool)
    • Teradata Dialect
    • TiDB Dialect
    • TimescaleDB Dialect
    • Trino Dialect
    • Turso / libSQL Dialect
    • Vertica dialect
    • Vitess Dialect
    • Yellowbrick Dialect
    • YugabyteDB Dialect
  • guides
    • Access rules and behaviour profiles
    • ArangoDB (AQL)
    • Associations
    • Audit levels and escalation
    • Audit logging
    • In the browser
    • Bulk operations
    • Caching
    • Capabilities, tiers and team roles
    • CLI
    • Cloudflare
    • Compliance & data protection
    • Connection Pooling & Performance
    • Security in the console
    • Couchbase: structured N1QL queries
    • Data types
    • Decorators
    • Eager loading
    • Enums and constants
    • Error handling & error types
    • Extensions
    • External fields
    • Foreign data wrappers
    • Graph databases
    • Hooks & lifecycle events
    • Indexes & constraints
    • InfluxDB: structured Flux pipelines
    • klock-errors
    • klock — the `.klock` file
    • Local databases (`prorm db up`)
    • Structured log search — Splunk, Graylog, Papertrail, Sumo Logic
    • Logging
    • Grafana Loki: structured LogQL queries
    • MCP server
    • Migrate — the data transfer subsystem
    • Migrations & Schema Sync
    • Models from an existing database
    • Defining models
    • Multiple databases
    • OrientDB, Neptune and TigerGraph
    • Passwords
    • Importing a Prisma schema
    • Structured PromQL and MetricsQL
    • Query firewall
    • QueryInterface
    • Query operators reference
    • Query optimization
    • Composing find options with `pipe()` and `Q`
    • Query safety: the fail-closed WHERE guard
    • Querying
    • Raw Queries & Query Building
    • Read replicas
    • Schema diffing & migration generation
    • Views, triggers & other schema objects
    • Scopes & default scopes
    • Seeders
    • SPARQL / RDF triplestores
    • SQL constants
    • SQL features
    • SQL function builders
    • SQLite advanced features
    • StoreKey — a prod-orm database as the storage
    • Streaming results
    • Terraform
    • Transactions & Isolation Levels
    • Type mapping: legacy and modern
    • TypeScript types
    • Database users, roles & privileges
    • Validation & constraints
    • Virtual & Computed Fields
    • Writing docs
  • javascript
    • prorm in JavaScript
    • Models in JavaScript
    • Querying in JavaScript
    • Relations in JavaScript
  • runbooks
    • Operational runbooks
    • Connection failures
    • Credential rotation
    • Failover
    • Incident checklist
    • Deploying klock v2
    • Migration rollback
  • running-databases
    • Running databases in Docker
    • Running prorm under Bun in Docker
    • Running Cassandra in Docker with prorm
    • Running ClickHouse in Docker with prorm
    • Running CockroachDB in Docker with prorm
    • Running prorm under Deno in Docker
    • Running Elasticsearch in Docker with prorm
    • Running MariaDB in Docker with prorm
    • Running MongoDB in Docker with prorm
  • prorm control plane
    • Introduction
    • Authentication
    • Errors
    • Getting started
      • Service
        • Is it up
        • This description
    • Account
      • Sign-up and verification
        • Create an account
        • Exchange credentials for a token
        • Verify with the emailed code
        • Verify by clicking the emailed link
        • Name the parent or guardian
        • What a consent link is about
        • Give consent for a child's account
        • Ask the parent or guardian again
        • Send a new code and link
      • Family
        • Everyone this account is responsible for
        • One child, in detail
        • Turn a limit on or off
      • Profile
        • Who am I
        • Change the account
        • Every address on the account
        • Add an address
        • Confirm an address with the code mailed to it
        • Mail a fresh code to an unconfirmed address
        • Make an address primary
        • Remove an address
        • What this caller may do
    • Security
      • Sessions
        • Everywhere this account is signed in
        • Sign out everywhere else
        • Sign one out
        • A token for the CLI on a named machine
        • A token for the customer console, from the staff one
        • Park a sign-in for the CLI to collect
        • The CLI collecting its sign-in
        • The team's members' live sessions
        • Sign a member's session out
        • Sign an account out everywhere
        • Everywhere the account is signed in
        • Sign an account's session out
      • Single sign-on
        • Begin a single sign-on
        • The provider's return
        • Link the signed-in account to a team's provider
        • Which team an address signs in to
        • The team's single sign-on, as a member sees it
        • Set the team's OpenID Connect provider up, or change it
        • Remove the provider
        • The team's domain claims and the DNS record each needs
        • Prove a claimed domain
      • MFA and passwords
        • Start enrolling a second factor
        • Prove the app has it
        • Remove the second factor
        • Ask for a reset link
        • Set a new password with the emailed token
      • Klock
        • Open a device-bound klock session
        • Check in, for the next grant
        • Step up the session asking
        • Rotate the device key
        • Freeze a session
        • Unfreeze a session
        • A guest grant
        • The revocation feed
        • The published keyset
        • What this control plane supports
      • Devices
        • Your devices, or a team's
        • Approve a new device's pairing code
        • One device
        • Rename a device
        • Revoke a device
        • Suspend a device
        • Reinstate a suspended device
        • Wipe a device
        • Ask a device to rotate its key
        • The team's members' devices
        • Revoke a member's device
        • An account's devices
        • Revoke an account's device
        • Wipe an account's device
        • The device fleet
      • Access rules and behaviour
        • The access rules that bear on you
        • Add an access rule
        • This request, as the rules see it
        • One access rule
        • Remove an access rule
        • The behaviour profiles that bear on you
        • Add or change a behaviour profile
        • The profile presets
        • Your behaviour findings
        • Acknowledge a finding
        • One behaviour profile
        • Remove a behaviour profile
        • The team's access rules
        • Add a team access rule
        • Remove a team access rule
        • The team's behaviour profiles
        • Add or change a team behaviour profile
        • Remove a team behaviour profile
        • What the team's profiles caught
        • Acknowledge a team finding
      • Recovery and lockdown
        • Ask for a recovery link
        • Recover access with the emailed code
        • Is the account locked down
        • Lock the account down
        • Release a lockdown
        • Lock a member down
        • Release a member's lockdown
      • MCP tokens
        • Make a delegated token for one MCP client
        • The account's delegated tokens
        • Revoke a delegated token
        • What a delegated token may do now
        • Run one MCP tool with a delegated token
        • Run a device-signed MCP tool call relayed by the MCP Worker
      • Kerberos
        • Give the team its own Kerberos realm
        • The team's realm
        • Remove the team's realm
    • Logging and monitoring
      • Audit log
        • What has been done to the account
        • What has happened to this account
        • The account's audit trail
      • Operations
        • Everything that has been asked of this database
        • One, with its steps
        • Stop it
        • Put a failed one back in the queue
        • Every operation, across all accounts
      • Metrics and events
        • Every measurement, for a graph
        • Who did what to it
    • Billing
      • Plans and pricing
        • What the plans allow
        • The rate card
        • What one database would cost
        • What this account is paying for, itemised
      • Subscriptions and invoices
        • What this month's invoice will say
        • What this account is on
        • What it has been charged
        • Start a Stripe Checkout session
        • Open the customer portal
        • Stripe's events
        • Buy more connection pools
      • Team billing
        • The team's billing account
        • What the team has been charged
        • What this month's invoice will say
        • The team's cards
        • Add a card, through a Stripe-hosted setup session
        • Make a card the team's default
        • Remove a card
        • Start the team paying
        • Open the Stripe portal on the team's customer
        • Change the team's plan
        • Who receives the team's bills
        • How the team pays for transfers
    • Support
      • Support chat
        • My conversations
        • Start a conversation
        • Every support conversation, open first
        • A ticket for the socket
        • One conversation, with who is in it and who is connected
        • Rename a group; open or close a support conversation
        • The lines, oldest first
        • Say something
        • Add somebody
        • Mark read
    • Administration
      • Users
        • Every account
        • One account, with everything hanging off it
        • Grant or revoke admin
        • Verify an account by hand
        • Lock or unlock sign-in
        • Allow or hold provisioning
        • Send the verification mail again
        • Set the plan by hand
      • Platform
        • Every database and store, across all accounts
        • The counts worth putting on a dashboard
      • Staff and permissions
        • What kind of admin the caller is, and which scopes they hold
        • The admin presets
        • Every admin, and the scopes each resolves to
        • Make an account an admin of a kind
        • Change an admin's kind, or a custom admin's scopes
        • Revoke admin
      • Team administration
        • Every team, with its owner and size
        • One team in full — members with their accounts, and projects
        • Hand the team to another member
        • Put an account in the team, active at once
        • Change a member's role
        • Remove a member
      • Assumed identities
        • Assume an identity — act as a customer account
        • The identities the caller holds open
        • End an assumed identity
      • Support inbox
        • The platform's addresses
        • Add a platform address
        • One address, with its counts
        • Change an address's label, routing, or whether it accepts mail
        • Remove an address that holds no mail
        • Make, adopt or repair the address's routing rule
        • Every admin's personal address, made where missing
        • File a raw message, as if it had arrived
        • The inbox
        • One message, whole
        • Mark a message
        • Hand a message to an admin, or take it back
        • Leave an internal note
        • Reply, from the address the message came to
        • What is waiting
    • Databases
      • Databases
        • Data stores
          • Every data store on the account
          • Provision a data store
          • Change a data store that is already running
          • One data store
          • Deprovision it
          • Report what it is using
          • How to reach a data store
        • Connections and credentials
          • The api keys on a database
          • Issue a key
          • Revoke a key
          • The engine users we created
          • Create a user inside the database
          • Give a user a new password
          • Drop a user
          • How the database is reached
          • Set how it is reached
          • Revoke every api key on it
          • How to connect to it
          • The ssh keys that open its bastion
          • Add a key, or have one made
          • The private half of a generated key, once
          • Revoke an ssh key
        • Schema and objects
          • The SQL objects we put in it
          • Create one, and apply it
          • What is in the database, as the engine reports it
          • One table
          • What it would run, without running it
          • Redefine an object in place
          • Drop it
          • The extensions installed in it
        • Migrations
          • A plan compiled to statements, recording nothing
          • The migrations recorded for it
          • Record one
          • Apply everything recorded and not yet run
          • Apply everything pending, oldest version first
        • Lifecycle
          • Grow or shrink it
          • Stop it accepting connections
          • Start it again
          • Move it to another region
        • Backups and replicas
          • Take a backup
          • The backups it has
          • Restore one into it
          • What has been restored into it, and from where
          • Its read copies
          • Add one
        • Policies
          • The catalog
          • One policy
          • What this database is held to
          • Switch a policy on, or change its knobs
          • Switch it off
          • Mark the policies reviewed
          • Evaluate the periodic policies now
          • Who is behind a credential
        • Passwordless
          • The database's passwordless sessions
          • Issue a passwordless session (v1)
          • Revoke a passwordless session
          • Bind a session to a device key
          • Issue a v2 session for a host to bind
          • Redeem an enrolment ticket on the host
          • Check a passwordless credential
          • Run one described query under a passwordless credential
        • Database roles
          • The database's roles
          • Define a role
          • One role
          • Change what a role permits
          • Delete a role, and revoke every key granted it
          • Grant a role, which mints a key
          • Who holds a role
          • The api keys bound to a role
        • Pools
          • A database's connection pools, and how busy each is
          • Open another pool
          • Rename a pool or change its size
          • Close a pool
        • Data plane
          • Run a query against a database
          • Several statements, in order, over one connection
          • Is this database answering
          • What the proxy itself is holding
        • Transfers
          • The strategies this account's tier may use
          • Price a transfer without creating it
          • The account's transfer jobs, newest first
          • Create a transfer job
          • One job, and whether its certificate holds
          • Cancel an unfinished job
          • Start a created job, confirming its price
          • Report a job's status (the runner, or the owner's side of a local run)
        • Every database on the account
        • Provision a database
        • Change a database that is already running
        • One database
        • Deprovision it
        • Read or write it
        • Report what it is using
        • The engines this API will provision
        • Where a managed database can be put
    • Teams
      • Teams
        • Members
          • Who is on it
          • Invite somebody
          • Accept an invitation
          • Change somebody's role
          • Remove somebody
        • Projects
          • The projects a team runs
          • Start one
          • Rename a project, or move its environment
          • Delete a project
          • One project, and what is in it
          • Put a database or store in it
          • What is in a project
          • Take one out
        • The teams this account is on
        • Start one
        • The twelve roles, and what each may do
        • Rename a team
        • Close a team
        • One team
        • Hand the team to somebody else
        • Leave a team
    • Schemas
      • Error
      • ValidationErrors
      • Token
      • PolicyCategory
      • PolicySeverity
      • PolicyAction
      • PolicyTrigger
      • PolicyParam
      • Policy
      • PolicyCatalog
      • PolicyAssignment
      • PolicyOutcome
      • PolicyFiring
      • CredentialTrace
      • Relation
      • Restrictions
      • ChildSummary
      • SignupRequest
      • SigninRequest
      • UpdateMeRequest
      • User
      • Address
      • GeoPoint
      • D1Region
      • Usage
      • UsageReport
      • Resource
      • Database
      • DataStore
      • NewDatabase
      • NewDataStore
      • QueryRequest
      • DatabasePrivilege
      • ApiKey
      • DbUser
      • Access
      • AccessRequest
      • DatabaseObject
      • NewDatabaseObject
      • NewMigration
      • SchemaOperation
      • Migration
      • Operation
      • Session
      • AdminPowers
      • Admin
      • AuditEntry
      • TeamRole
      • Conversation
      • ChatMessage
      • TeamSso
      • Team
      • TeamMember
      • SshKey
      • ConnectionInfo
      • InboxAddress
      • InboxMailbox
      • InboxMessageSummary
      • InboxMessage
      • InboxNote
      • Page
      • Quote
      • Plan
      • ApiError
      • CapabilityRefusal
      • KlockErrorCode
      • PageWindow
      • SessionView
      • KlockStepUpRequest
      • KlockOpenRequest
      • KlockOpenedSession
      • UpdateMeResult
      • CapabilitiesView
      • SessionLimits
      • Device
      • DeviceListed
      • DeviceTeamRef
      • DeviceCommand
      • DeviceAuditLine
      • DeviceActionRequest
      • StaffActionRequest
      • ManagedSession
      • SessionRevoked
      • AccessRule
      • AccessRuleRequest
      • BehaviourProfile
      • BehaviourProfileRequest
      • BehaviourProfileSaved
      • BehaviourFinding
      • BehaviourFindingAck
      • StepUpProof
      • Removed
      • MemberLockdownRequest
      • McpClient
      • McpDelegatedView
      • McpToolCall
      • McpForwardRequest
      • PasswordlessScope
      • RoleScope
      • PasswordlessSession
      • PasswordlessTlsMaterial
      • PasswordlessKerberosMaterial
      • ServiceDeviceKeys
      • ServiceSession
      • DatabaseRole
      • TransferEndpoint
      • TransferJobRequest
      • TransferQuote
      • TransferStrategy
      • TransferJob
      • TransferJobAccess
      • Pool
      • PoolAllowance
      • BillingSubscription
      • Invoice
      • BillingContact
      • PaymentMethod
      • UpcomingCharges
      • TeamBilling
      • TeamKerberosRealm
      • TeamSsoDomain
      • TeamSsoResponse
      • StoreConnection
      • BatchFailure
      • ProxyStatus
  1. guides

Query optimization

src/query-optimizers is a set of opt-in performance tools: EXPLAIN plans
with recommendations, dialect-aware query hints, slow-query logging, batched
bulk writes, and two in-process caches. None of it is wired into Prorm,
Model or the dialect pipeline automatically
— you construct what you want
and call it explicitly. That is deliberate: these tools change how statements
run, and that should be a decision you make, not a default you inherit.
import { QueryOptimizer } from 'ts-prorm-orm';

const optimizer = new QueryOptimizer(prorm.getDialectInstance(), {
  enableExplain: true,
  slowQueryOptions: { threshold: 250 },
});
Everything below is also usable standalone — ExplainPlanGenerator,
QueryHintManager, SlowQueryLogger, BatchQueryOptimizer,
PreparedStatementCache — if you would rather not take the facade.

A practical order of attack#

The examples on this page use an orders table
(id, customer_id, status, total, created_at). The plans shown are real
SQLite output from an in-memory database.

Find the statements that are actually slow#

Turn on query logging with benchmark: true, or feed a
SlowQueryLogger, and rank by time. Optimise what the
numbers point at, not what looks expensive.

Read the plan#

import { QueryOptimizer } from 'ts-prorm-orm';

const optimizer = new QueryOptimizer(prorm.getDialectInstance(), { enableExplain: true });
const sql = 'SELECT * FROM orders WHERE customer_id = 42 ORDER BY created_at DESC';

const { plan, recommendations } = await optimizer.analyzeQuery(sql);
console.log(plan.parsedPlan);
// [ { operation: 'SCAN', table: 'orders', details: { detail: 'SCAN orders' } },
//   { operation: 'OPERATION', details: { detail: 'USE TEMP B-TREE FOR ORDER BY' } } ]
for (const r of recommendations) console.log(r.severity, r.type, r.message, r.table);
// HIGH INDEX Full table scan detected. orders
SCAN orders is a full table scan, and the ORDER BY is sorted in a
temporary B-tree.

Add the index the plan asks for#

One composite index covers both the filter and the sort:
Declare it on the model so migrations keep it — see
Indexes & constraints.

Re-check the plan#

const after = await optimizer.analyzeQuery(sql);
console.log(after.plan.plan.rows[0].detail);
// SEARCH orders USING INDEX idx_orders_customer_created (customer_id=?)
console.log(after.recommendations.length); // 0
SEARCH … USING INDEX replaces the scan, and the temporary sort is gone
because the index already yields rows in created_at order.

Only then reach for hints#

Hints are for when the planner still chooses badly with the right index in
place, and on most engines they are advisory. See Query hints.

Cache last#

A cache hides a slow query, it does not fix one. See
The two caches and, for a shared cache,
Caching.

EXPLAIN plans#

const plan = await optimizer.explainQuery(
  'SELECT * FROM users WHERE email = \'a@example.com\'',
  { analyze: true },
);

const { plan: p, recommendations } = await optimizer.analyzeQuery(sql);
for (const r of recommendations) {
  console.log(r.severity, r.type, r.message); // HIGH INDEX  "Full table scan detected."
}
The statement issued depends on the dialect. These are the statements
ExplainPlanGenerator sends for
SELECT * FROM orders WHERE customer_id = 7:
{ analyze: true } throws SQLite has no EXPLAIN ANALYZE; use a plain explain (EXPLAIN QUERY PLAN). and any format but text throws.
Three statements, which must run on one connection:
{ analyze: true } uses SET STATISTICS PROFILE ON / OFF instead, and the
formats are text and xml.
Oracle sends EXPLAIN PLAN SET STATEMENT_ID = '<id>' FOR <sql> followed by
SELECT PLAN_TABLE_OUTPUT FROM TABLE(DBMS_XPLAN.DISPLAY(NULL, '<id>', 'TYPICAL')).
[!IMPORTANT] SQL Server and Oracle need queryOnSession()
Their EXPLAIN is several statements that must share a connection. The
generator runs them through the dialect's
queryOnSession(statements: string[]); the SQL Server and Oracle dialects do
not implement it yet, so explain() there throws
[ORM] EXPLAIN on mssql needs several statements on one connection (…).
[!WARNING] analyze: true runs the statement
EXPLAIN ANALYZE executes what it explains. For a write (INSERT,
UPDATE, DELETE, DDL, CALL, SELECT … INTO) the generator refuses
unless it can wrap the statement in a transaction that is rolled back, or
you pass { allowWrite: true } and accept that the write is applied.
Plan parsing and recommendations exist only for MySQL/MariaDB, PostgreSQL
and SQLite. What each looks for:
DialectFlagged as a problem
MySQL / MariaDBtype: ALL scans, missing possible_keys/key, Using filesort, Using temporary
PostgreSQLSeq Scan nodes anywhere in the plan tree, nodes estimating PlanRows > 10000
SQLiteSCAN steps (as opposed to SEARCH, which means an index was used)
Each recommendation carries a type (INDEX, OPTIMIZATION, REWRITE,
STATISTICS) and a severity (HIGH, MEDIUM, LOW). They are heuristics
over the plan text, not a cost model — read them as prompts to investigate.
[!NOTE]
enableExplain defaults to process.env.NODE_ENV === 'development'. Set it
explicitly if you want plans in production.

Query hints#

import { FORCE_INDEX } from 'ts-prorm-orm';

const sql = optimizer.applyHints('SELECT * FROM users WHERE email = ?', [
  FORCE_INDEX('idx_users_email', 'users'),
]);
A hint is a QueryHint: { type: HintType, value?, tableName? }. The
exported helpers build the common ones: FORCE_INDEX(index, table?),
USE_INDEX(...), INDEX_HINT.IGNORE(...), JOIN_FIXED_ORDER, MERGE_HASH,
NO_MERGE, and on a QueryHintManager the methods forceIndex(),
useIndex(), ignoreIndex(), maxExecutionTime(seconds), sqlBigResult(),
sqlSmallResult() and sqlNoCache().
Hints are rendered only for hints the dialect supports; the rest are
dropped silently rather than producing SQL the engine rejects:
DialectSupported hintsRendered as
MySQL / MariaDBFORCE_INDEX, USE_INDEX, IGNORE_INDEX, JOIN_FIXED_ORDER, MAX_EXECUTION_TIME, SQL_BIG_RESULT, SQL_SMALL_RESULT, SQL_BUFFER_RESULT, SQL_CACHE, SQL_NO_CACHE, INDEX_MERGEa /*+ … */ comment after SELECT
PostgreSQLMAX_EXECUTION_TIME, SEQ_SCAN, NO_SEQ_SCAN, INDEX_SCAN, NO_INDEX_SCANa /*+ … */ comment, read only by the pg_hint_plan extension
SQLiteOPTIMIZE, QUERY_PLANa /*+ … */ comment
SQL ServerNESTED_LOOP, MERGE_HASH, NO_MERGEan OPTION (…) clause at the end
OracleNESTED_LOOP, MERGE_HASH, NO_MERGE/*+ USE_NL … USE_HASH … NO_MERGE */
Everything elsenonethe SQL unchanged
One hint list — force an index, a 5-second limit, fixed join order, nested
loop and hash join, and PostgreSQL's NO_SEQ_SCAN — applied to the same
statement on each dialect:
import { QueryHintManager, FORCE_INDEX, JOIN_FIXED_ORDER, MERGE_HASH, HintType } from 'ts-prorm-orm';

const hints = new QueryHintManager(prorm.getDialectInstance());
const sql = hints.applyHints(
  'SELECT o.id, c.email FROM orders o JOIN customers c ON c.id = o.customer_id WHERE o.status = ?',
  [
    FORCE_INDEX('idx_orders_status', 'orders'),
    hints.maxExecutionTime(5),
    JOIN_FIXED_ORDER,
    { type: HintType.NESTED_LOOP },
    MERGE_HASH,
    { type: HintType.NO_SEQ_SCAN, tableName: 'orders' },
  ],
);
No hint in the list is a SQLite one, so the statement is returned unchanged.
[!WARNING] Check that the engine took the hint
A hint comment the engine does not understand is ignored, not rejected. Run
the hinted statement through EXPLAIN before relying on it.
In particular:
maxExecutionTime(seconds) passes the number straight into MySQL's
MAX_EXECUTION_TIME(n), which MySQL reads as milliseconds; PostgreSQL's
rendering multiplies by 1000.
PostgreSQL ignores comments unless pg_hint_plan is installed, and a
SET LOCAL inside a comment sets nothing. For a real timeout run
SET LOCAL statement_timeout inside a transaction.
Oracle's USE_NL / USE_HASH take a table; pass tableName on the hint.
setEnabled(false) turns hint rendering off globally without changing call
sites.

Slow-query logging#

SlowQueryLogger is fed manually — it does not hook the query pipeline. If you
use optimizer.executeQuery() it is called for you; otherwise call
logQuery() yourself after timing a statement.
import { createSlowQueryLogger } from 'ts-prorm-orm';

const slow = createSlowQueryLogger({
  threshold: 500,          // ms; below this nothing is recorded
  logParams: true,
  maxEntries: 1000,        // ring buffer
  alertThreshold: 10,      // 10 slow queries…
  alertWindow: 60_000,     // …within a minute fires 'alert'
});

slow.on('slowQuery', (entry) => metrics.increment('db.slow', { sql: entry.sql }));
slow.on('alert', (entries) => pageOncall(entries));

const started = Date.now();
const rows = await prorm.query(sql);
slow.logQuery({ sql, duration: Date.now() - started, dialect: prorm.getDialect() });
Analysis helpers on the logger:
MethodReturns
getStatistics()count, avg/min/max, p50/p95/p99 duration
getSlowQueries()entries over the threshold
getQueriesByType()grouped by SELECT/INSERT/…
getQueriesOnTable(name)entries whose SQL mentions the table
findSimilarQueries()grouped after replacing literals with ?
exportLogs()JSON dump
For always-on logging of every query, use the connection's own
logging option instead — it is wired into the pipeline.

Batched bulk writes#

BatchQueryOptimizer chunks large arrays and emits one statement per chunk
instead of one per record.
import { optimizeBatchInsert } from 'ts-prorm-orm';

const result = await optimizeBatchInsert(dialect, 'users', records, {
  chunkSize: 1000,
  skipDuplicates: true,
  onProgress: ({ processed, total }) => console.log(`${processed}/${total}`),
});
result.success.length; result.failed.length; result.batches; result.duration;
OperationSQL per chunkDefault chunk
optimizeBatchInsertINSERT INTO t (…) VALUES (…), (…), …1000
optimizeBatchUpdateUPDATE t SET col = CASE … END WHERE id IN (…)500
optimizeBatchDeleteDELETE FROM t WHERE id IN (…)500
Values are always bound parameters, with the placeholder style each dialect
uses ($1, @p1, :1, ?) — never interpolated literals. If a chunk's
batched statement fails, the optimizer retries that chunk record-by-record so
one bad row does not lose the other 999; stopOnError: true rethrows instead,
and skipDuplicates swallows duplicate-key failures during the fallback.
The statements for two orders inserted and three deleted:
import { BatchQueryOptimizer } from 'ts-prorm-orm';

const batch = new BatchQueryOptimizer(prorm.getDialectInstance());
await batch.optimizeBatchInsert('orders', [
  { customer_id: 7, total: 120 },
  { customer_id: 9, total: 45.5 },
]);
await batch.optimizeBatchDelete('orders', [3, 4, 5]);
optimizeBatchUpdate keys its CASE by the identifier column. Updating order
1 to shipped and order 2 to cancelled sends one statement:
[!NOTE]
Before 4.9.2 the CASE was CASE WHEN ? THEN ? …, which never compared
anything with id (WHEN 1 is simply true), so every row in the IN list
took the first record's values while the call reported success. Rows
written by optimizeBatchUpdate on an older release may need checking.
For ordinary application writes, Model.bulkCreate() and Model.bulkUpdate()
are the simpler path — see Bulk operations.

The two caches#

Both live in prepared-statement-cache.ts and both are process-local
in-memory maps
— they are not shared between workers and do not survive a
restart. For a distributed cache see Caching.

PreparedStatementCache#

Despite the name, this does not hold driver-level prepared-statement
handles. It tracks statement shapes — how often a normalized SQL string has
been seen and executed — so you can find your hottest statements.
Keys are the SQL with whitespace collapsed, comments stripped and keywords
upper-cased (normalizeSql: true), so the same query with different literals
shares an entry. Supplying params appends them to the key instead.
LRU eviction by last use at maxSize (default 500), TTL expiry at 1 hour,
swept lazily on lookup or eagerly with prune().
getStats() gives size, hit rate, total execution time, evictions, and the
top ten statements by hit count.

QueryResultCache#

Caches actual result sets, default TTL 60 s. invalidateTable(name) evicts
every entry whose SQL text contains that table name — a substring match, not
a parse, so it is deliberately coarse: it over-invalidates rather than serving
stale rows.
It is not re-exported from the module barrel; import it from
ts-prorm-orm/dist/query-optimizers/prepared-statement-cache if you want it
standalone, or reach it via optimizer.getQueryResultCache().

Tying it together#

executeQuery() runs one statement through hints → result cache → statement
cache → slow-query log:
import { FORCE_INDEX } from 'ts-prorm-orm';

const { result, fromCache, duration } = await optimizer.executeQuery(sql, {
  useCache: true,
  usePreparedStatement: true,
  hint: [FORCE_INDEX('idx_users_email', 'users')],
});
Run twice, the second call is served from the result cache:
const first = await optimizer.executeQuery('SELECT COUNT(*) AS n FROM orders', { useCache: true });
const again = await optimizer.executeQuery('SELECT COUNT(*) AS n FROM orders', { useCache: true });
first.fromCache; // false
again.fromCache; // true
optimizer.invalidateTableCache('orders'); // 1 — the entry mentioning "orders"
[!WARNING]
The result cache is only consulted when the call supplies no params —
a parameterised call always goes to the database. params are bound to the
statement as its positional replacements
(executeQuery('SELECT * FROM orders WHERE id = ?', { params: [2] })), on
both the plain and the usePreparedStatement path. Before 4.9.2 they only
keyed the caches and the log, and the statement ran with nothing bound.
Nothing invalidates the result cache for you: a write through the model API
or prorm.query() leaves cached reads in place until their TTL or an
invalidateTableCache() call.
HousekeepingEffect
getStats()merged stats from the slow-query logger and both caches
clearCaches()empty both caches
pruneCaches()drop expired entries only
invalidateTableCache(table)evict result-cache entries mentioning the table

Related reading#

query-optimizers — internals, file by file
Logging — always-on query logging and slow-query events
Caching — the L1/L2 Redis cache
Indexes & constraints
Bulk operations
Modified at 2026-10-04 00:40:16
Previous
Query operators reference
Next
Composing find options with `pipe()` and `Q`
Built with