Sequelize 6

Apply the Node.js 24, TypeScript 7, and JavaScript ES2026 prompts first. These rules target the v6 line of the sequelize npm package and its v6 APIs, and were checked against 6.37.8. Upstream declares Node.js >=10 and TypeScript >=4.1 compatibility floors; use the included supported runtime baseline and verify the selected compiler, dialect driver, and database together. Do not substitute v7 @sequelize/core APIs or assume its transaction propagation behavior.

Models and write boundaries

• Construct write values from an endpoint-specific allowlist and pass trusted fields lists to create, update, save, and bulkCreate; assign ownership, tenant, role, and approval attributes on the server. Keep findOrCreate search values and creation defaults equally controlled.
• Set allowNull: false for required security attributes and install matching database constraints through migrations. Sequelize permits nulls by default and skips built-in attribute validators for allowed nulls; JavaScript validators do not enforce invariants on direct SQL or concurrent writers.
• Back uniqueness, ownership references, and state invariants with appropriate database unique, foreign-key, and check constraints. Include the tenant in keys where uniqueness or references must be tenant-specific; checking for an existing row before insertion is insufficient.
• Call bulkCreate(records, { validate: true, fields: [...] }) when model validation is required; validation is off by default for this API. Preserve validation on ordinary create, save, update, and upsert, and restrict