Omitting Fields

Control model truth, client defaults, and per-query projections

omit is the inverse of select: it returns every readable scalar except the ones you name.

const users = await client.user.findMany({
  omit: { passwordHash: true },
});
// { id: string; email: string; name: string }[]

Three owners

Model .omit()

Model omit is a hard public-schema exclusion. The field has no select or omit key and is not selected from the database:

const vault = s
  .model({ id: s.string().id(), label: s.string(), secret: s.string() })
  .omit({ secret: true });

Use this for fields that must never appear through the model API. It is still not a substitute for database authorization or complete RBAC.

Client defaultOmit()

defaultOmit() is the official extension for a derived client’s default projection. See Default omit for configuration, overrides, nested results, and extension ordering.

Query-level composition

Query omit works on operations returning model rows, including returning bulk writes. select first names the candidate result, then omit subtracts scalar fields. include adds relations, and every nested relation node owns its own projection:

await client.user.findMany({
  select: { id: true, email: true, passwordHash: true },
  omit: { passwordHash: true },
  include: {
    posts: { omit: { draftBody: true } },
  },
});

An omit that removes every readable field is refused. A widened boolean makes the corresponding result key optional because runtime decides whether it is present.

Security boundary

Query omit and defaultOmit() are presentation defaults and are intentionally overridable. Model .omit() is stronger model-surface truth, but none of the three proves row authorization, relation authorization, or raw-SQL policy. VibORM’s extension system is a foundation for a future graph-wide policy capability; it does not ship an RBAC helper today.