// the find
zenstackhq/zenstack
Modern data layer for TypeScript apps - type-safe ORM, built-in access control, automatic query services
ZenStack is a TypeScript ORM that extends Prisma's schema syntax to add access control rules, automatic CRUD APIs, and TanStack Query hooks. V3 dropped Prisma entirely in favor of a custom engine built on Kysely, making it a pure TypeScript stack with a Prisma-compatible query API. Aimed at full-stack TypeScript apps, especially SaaS where multi-tenant row-level security is a recurring headache.
- Ditching Prisma's Rust/WASM binary in V3 is the right call — pure TypeScript means no platform-specific build artifacts, faster cold starts, and the Kysely query builder as a typed escape hatch beats Prisma's `$queryRaw` significantly
- Access control rules live in the schema file next to the model they guard, which is the correct place for them — if you scatter authz across route handlers you will eventually miss one, and ZenStack makes that harder to do accidentally
- Auto-generated TanStack Query hooks that stay in sync with your schema changes eliminate an entire category of drift between client fetching code and server models
- Polymorphism support fills one of the most complained-about gaps in Prisma's data modeling without requiring junction tables or JSON columns as workarounds
- V3 replaced a battle-tested engine (Prisma) with a new one — the Kysely-based ORM handles the common cases fine but edge cases in complex transactions or unusual DB features haven't had years of production traffic to shake out bugs
- The `.zmodel` DSL is a custom file format that your existing tooling knows nothing about; you're betting on the VS Code extension and the ZenStack team's continued investment, and a project at ~3k stars is not yet past the 'could abandon' risk threshold
- When access control rules silently return empty results instead of throwing — which is the intended behavior — debugging why a query returns nothing becomes a puzzle that requires understanding the full policy evaluation chain rather than reading a stack trace
- Migrating an existing Prisma V2 codebase to ZenStack V3 is not a drop-in swap despite the API compatibility claims; the schema migration, the policy annotations, and any raw query usage all need attention simultaneously