fix(zod): address PR review comments

- Skip @@Validate rules per-rule based on which fields are present in
  the resulting shape, instead of skipping all rules when any omit/select
  is used. Rules whose referenced fields are all present still apply.
- Handle widened boolean (not just literal true) in SelectEntryToZod to
  prevent field types resolving to never
- Validate options at runtime with a recursive Zod schema, enforcing
  that select/include and select/omit cannot be used together
- Rename 'Prisma-style' to 'ORM-style' in comments and docs"

Author: marcsigmund

packages/zod/src/factory.ts

@@ -39,6 +39,37 @@ type RawOptions = {
     omit?: Record<string, unknown>;
 };
 
+/**
+ * Recursive Zod schema that validates a `RawOptions` object at runtime,
+ * enforcing the same mutual-exclusion rules that the TypeScript union type
+ * enforces at compile time:
+ *  - `select` and `include` cannot be used together.
+ *  - `select` and `omit` cannot be used together.
+ * Nested relation options are validated with the same rules.
+ */
+const rawOptionsSchema: z.ZodType<RawOptions> = z.lazy(() =>
+    z
+        .object({
+            select: z.record(z.string(), z.union([z.boolean(), rawOptionsSchema])).optional(),
+            include: z.record(z.string(), z.union([z.boolean(), rawOptionsSchema])).optional(),
+            omit: z.record(z.string(), z.boolean()).optional(),
+        })
+        .superRefine((val, ctx) => {
+            if (val.select && val.include) {
+                ctx.addIssue({
+                    code: 'custom',
+                    message: '`select` and `include` cannot be used together',
+                });
+            }
+            if (val.select && val.omit) {
+                ctx.addIssue({
+                    code: 'custom',
+                    message: '`select` and `omit` cannot be used together',
+                });
+            }
+        }),
+);
+
 class SchemaFactory<Schema extends SchemaDef> {
     private readonly schema: SchemaAccessor<Schema>;
 
@@ -92,15 +123,18 @@ class SchemaFactory<Schema extends SchemaDef> {
         }
 
         // ── Options path ─────────────────────────────────────────────────────
-        const rawOptions = options as unknown as RawOptions;
+        const rawOptions = rawOptionsSchema.parse(options);
         const fields = this.buildFieldsWithOptions(model as string, rawOptions);
         const shape = z.strictObject(fields);
-        // @@validate expressions reference fields by name — when `select` is
-        // used only a subset of fields is present, so running @@validate would
-        // silently evaluate missing fields as null and produce false negatives.
-        // We therefore only apply model-level custom validation on the
-        // include/omit path where all scalar fields are still present.
-        const withValidation = rawOptions.select ? shape : addCustomValidation(shape, modelDef.attributes);
+        // @@validate expressions reference fields by name. When `select` or
+        // `omit` produces a partial shape, some fields referenced by @@validate
+        // may be absent. Applying those rules would cause false negatives (the
+        // field evaluates to null) or make the schema impossible to satisfy
+        // (strict parsing rejects a field the refinement needs).
+        // We therefore apply each @@validate rule only when every field it
+        // references is present in the resulting shape.
+        const presentFields = new Set(Object.keys(fields));
+        const withValidation = addCustomValidation(shape, modelDef.attributes, presentFields);
         return this.applyDescription(withValidation, modelDef.attributes) as unknown as z.ZodObject<
             GetModelSchemaShapeWithOptions<Schema, Model, Options>,
             z.core.$strict

packages/zod/src/types.ts

@@ -144,7 +144,7 @@ type ZodNullableIf<T extends z.ZodType, Condition extends boolean> = Condition e
 type ZodArrayIf<T extends z.ZodType, Condition extends boolean> = Condition extends true ? z.ZodArray<T> : T;
 
 // -------------------------------------------------------------------------
-// Query options types (Prisma-style include / select / omit)
+// Query options types (ORM-style include / select / omit)
 // -------------------------------------------------------------------------
 
 /**
@@ -176,7 +176,7 @@ type RelatedModel<
 > = GetModelFieldType<Schema, Model, Field> extends GetModels<Schema> ? GetModelFieldType<Schema, Model, Field> : never;
 
 /**
- * Prisma-style query options accepted by `makeModelSchema`.
+ * ORM-style query options accepted by `makeModelSchema`.
  *
  * Exactly mirrors the `select` / `include` / `omit` vocabulary:
  * - `select`  — pick specific fields (scalars and/or relations). Mutually
@@ -281,8 +281,11 @@ type SelectEntryToZod<
     Model extends GetModels<Schema>,
     Field extends GetModelFields<Schema, Model>,
     Value,
-> = Value extends true
-    ? // `true` — use the default shape for this field (scalar or relation)
+> = Value extends boolean
+    ? // `true` or widened `boolean` — use the default shape for this field.
+      // Handling `boolean` (not just literal `true`) prevents the type from
+      // collapsing to `never` when callers use a boolean variable instead of
+      // a literal (e.g. `const pick: boolean = true`).
       GetModelFieldsShape<Schema, Model>[FieldInShape<Schema, Model, Field>]
     : Value extends object
       ? // nested options — must be a relation field

packages/zod/src/utils.ts

@@ -261,9 +261,21 @@ export function addListValidation(
     return result;
 }
 
+/**
+ * Applies `@@validate` rules from `attributes` to `schema` as Zod refinements.
+ *
+ * When `presentFields` is provided, only rules whose referenced fields are all
+ * present in the set are applied. Rules that reference an absent field are
+ * silently skipped — they cannot be evaluated correctly against a partial
+ * payload (e.g. after `select` or `omit`), so skipping them is the safe choice.
+ *
+ * Omit `presentFields` (or pass `undefined`) to apply all rules unconditionally,
+ * which is the correct behaviour for full-model schemas.
+ */
 export function addCustomValidation(
     schema: z.ZodSchema,
     attributes: readonly AttributeApplication[] | undefined,
+    presentFields?: ReadonlySet<string>,
 ): z.ZodSchema {
     const attrs = attributes?.filter((a) => a.name === '@@validate');
     if (!attrs || attrs.length === 0) {
@@ -276,6 +288,15 @@ export function addCustomValidation(
         if (!expr) {
             continue;
         }
+
+        // Skip rules that reference fields absent from the resulting shape.
+        if (presentFields !== undefined) {
+            const referencedFields = collectFieldRefs(expr);
+            if ([...referencedFields].some((f) => !presentFields.has(f))) {
+                continue;
+            }
+        }
+
         const message = getArgValue<string>(attr.args?.[1]?.value);
         const pathExpr = attr.args?.[2]?.value;
         let path: string[] | undefined = undefined;
@@ -287,6 +308,40 @@ export function addCustomValidation(
     return result;
 }
 
+/**
+ * Recursively collects all field names referenced by `kind: 'field'` nodes
+ * inside an expression tree.
+ */
+export function collectFieldRefs(expr: Expression): Set<string> {
+    const refs = new Set<string>();
+    function walk(e: Expression): void {
+        switch (e.kind) {
+            case 'field':
+                refs.add(e.field);
+                break;
+            case 'unary':
+                walk(e.operand);
+                break;
+            case 'binary':
+                walk(e.left);
+                walk(e.right);
+                break;
+            case 'call':
+                e.args?.forEach(walk);
+                break;
+            case 'array':
+                e.items.forEach(walk);
+                break;
+            case 'member':
+                walk(e.receiver);
+                break;
+            // literal / null / this / binding — no field refs
+        }
+    }
+    walk(expr);
+    return refs;
+}
+
 function applyValidation(
     schema: z.ZodSchema,
     expr: Expression,

packages/zod/test/factory.test.ts

@@ -107,13 +107,13 @@ describe('SchemaFactory - makeModelSchema', () => {
             // scalar array
             expectTypeOf<Post['tags']>().toEqualTypeOf<string[]>();
 
-            const createPostSchema = factory.makeModelCreateSchema('Post');
-            type PostCreate = z.infer<typeof createPostSchema>;
+            const _createPostSchema = factory.makeModelCreateSchema('Post');
+            type PostCreate = z.infer<typeof _createPostSchema>;
 
             expectTypeOf<PostCreate['tags']>().toEqualTypeOf<string[]>();
 
-            const updatePostSchema = factory.makeModelUpdateSchema('Post');
-            type PostUpdate = z.infer<typeof updatePostSchema>;
+            const _updatePostSchema = factory.makeModelUpdateSchema('Post');
+            type PostUpdate = z.infer<typeof _updatePostSchema>;
 
             expectTypeOf<PostUpdate['tags']>().toEqualTypeOf<string[] | undefined>();
 
@@ -896,7 +896,7 @@ describe('SchemaFactory - delegate models', () => {
 });
 
 // ---------------------------------------------------------------------------
-// makeModelSchema — Prisma-style options (omit / include / select)
+// makeModelSchema — ORM-style options (omit / include / select)
 // ---------------------------------------------------------------------------
 
 // User without username (the omit use-case baseline)
@@ -1142,18 +1142,64 @@ describe('SchemaFactory - makeModelSchema with options', () => {
         });
     });
 
+    // ── invalid option combinations ───────────────────────────────────────────
+    describe('invalid option combinations', () => {
+        it('throws when select and include are used together', () => {
+            expect(() =>
+                factory.makeModelSchema('User', { select: { id: true }, include: { posts: true } } as any),
+            ).toThrow('`select` and `include` cannot be used together');
+        });
+
+        it('throws when select and omit are used together', () => {
+            expect(() =>
+                factory.makeModelSchema('User', { select: { id: true }, omit: { username: true } } as any),
+            ).toThrow('`select` and `omit` cannot be used together');
+        });
+
+        it('throws when select and include are used together in nested relation options', () => {
+            expect(() =>
+                factory.makeModelSchema('User', {
+                    include: { posts: { select: { id: true }, include: {} } as any },
+                }),
+            ).toThrow('`select` and `include` cannot be used together');
+        });
+    });
+
     // ── runtime error handling ────────────────────────────────────────────────
     describe('runtime validation still applies with options', () => {
-        it('@@validate still runs with omit options', () => {
+        it('@@validate still runs with omit when the referenced field is present in the shape', () => {
+            // omitting `username` leaves `age` in the shape, so @@validate(age >= 18) still fires
             const schema = factory.makeModelSchema('User', { omit: { username: true } });
-            // age: 16 still fails @@validate(age >= 18)
             expect(schema.safeParse({ ...validUserNoUsername, age: 16 }).success).toBe(false);
+            expect(schema.safeParse({ ...validUserNoUsername, age: 18 }).success).toBe(true);
+        });
+
+        it('@@validate is skipped when its referenced field is omitted', () => {
+            // omitting `age` removes the field that @@validate(age >= 18) references,
+            // so the rule is silently skipped — age: 16 is no longer validated
+            const { age: _, username: _u, ...validUserNoAgeOrUsername } = validUser;
+            const schema = factory.makeModelSchema('User', { omit: { age: true, username: true } });
+            expect(schema.safeParse(validUserNoAgeOrUsername).success).toBe(true);
         });
 
         it('field validation still runs with select options', () => {
             const schema = factory.makeModelSchema('User', { select: { email: true } });
             expect(schema.safeParse({ email: 'not-an-email' }).success).toBe(false);
             expect(schema.safeParse({ email: 'valid@example.com' }).success).toBe(true);
         });
+
+        it('@@validate is skipped with select when the referenced field is not selected', () => {
+            // selecting only `email` omits `age`, so @@validate(age >= 18) is skipped
+            const schema = factory.makeModelSchema('User', { select: { email: true } });
+            // would fail @@validate if age were present and < 18, but age isn't in the shape
+            expect(schema.safeParse({ email: 'valid@example.com' }).success).toBe(true);
+        });
+
+        it('@@validate still runs with select when the referenced field is selected', () => {
+            // selecting both `email` and `age` keeps the @@validate(age >= 18) rule active
+            const schema = factory.makeModelSchema('User', { select: { email: true, age: true } });
+            expect(schema.safeParse({ email: 'valid@example.com', age: 16 }).success).toBe(false);
+            expect(schema.safeParse({ email: 'valid@example.com', age: 18 }).success).toBe(true);
+        });
     });
 });