ZenStack is an MIT-licensed TypeScript database toolkit that gives full-stack and backend Node.js and Bun applications a schema-first ORM, built-in access control, and automatic CRUD APIs from a single data model.

What it is

ZenStack is a modern data layer for TypeScript applications. It provides a unified data modeling and query solution centered on a schema-first ORM that stays compatible with Prisma's schema and API. ZenStack V3 is a major rewrite: it replaced the Prisma ORM with its own ORM engine built on top of Kysely while keeping a Prisma-compatible query API. The result is a toolkit that spans the whole data path, from a schema.zmodel model definition through generated Zod schemas and TanStack Query hooks to the CRUD web APIs the frontend talks to.

The concrete problem it solves is the fragmentation of that path. Prisma supplies an ORM but no native access control, so authorization logic gets scattered across route handlers; raw SQL escape hatches trade type safety for flexibility; and frontend CRUD needs hand-written API routes and query hooks kept in sync with the schema by hand. ZenStack folds access control and data validation into the schema itself, generates the CRUD web APIs through framework adapters, and emits the frontend query hooks, so the rules and the data model live in one place. In an existing Prisma stack it is positioned as a drop-in replacement at the query-API level.

Key capabilities

• Schema-first ORM compatible with Prisma's schema and API, with V3 swapping Prisma ORM for an own engine built on Kysely.
• Two query levels: high-level ORM queries plus a low-level Kysely query builder, presented as a fully-typed escape hatch against Prisma's raw queries and typed SQL.
• Built-in access control and data validation declared alongside the data model, covering ACL and authz use cases.
• Automatic CRUD web APIs generated through adapters for popular frameworks.
• Automatic TanStack Query hooks for straightforward CRUD from the frontend.
• Zod schema generation from the model definition.
• Advanced data modeling patterns such as polymorphism, with the toolkit designed for extensibility and flexibility.
• Pure TypeScript implementation with no Rust or WASM components, more type inference and less code generation.

Who uses it and how

• Full-stack teams running a Node.js or Bun backend beside a TypeScript frontend, using the generated TanStack Query hooks instead of maintaining a hand-written fetch layer.
• Backend services that need authorization enforced at the data layer, centralizing ACL and authz rules in the schema rather than distributing checks across route handlers.
• Next.js applications, one of the listed topics, where CRUD APIs are produced through framework adapters, with OpenAPI also among the topics indicating interest in a describable HTTP surface.
• Teams already standardized on a Prisma schema that want polymorphism, access control and validation without abandoning a Prisma-compatible model or query API.

Getting started

Scaffold a new project with npm create zenstack@latest my-project, or run npx @zenstackhq/cli@latest init inside an existing project. Manual setup installs @zenstackhq/cli as a dev dependency plus @zenstackhq/schema and @zenstackhq/orm, then creates a zenstack folder containing a schema.zmodel file; a StackBlitz quick start is linked from the README.

How it compares

The facts name no paid products, so the relevant comparison is Prisma, which ZenStack explicitly treats as its reference point. It keeps Prisma's schema and API while replacing the Rust and WASM ORM internals with a pure TypeScript engine layered on Kysely, and it adds schema-level access control, data validation and generated CRUD APIs that Prisma does not provide. Kysely itself sits underneath as the query-builder layer rather than competing with it, so teams get a typed low-level escape hatch without leaving the stack.

When to use it — and when not to

A self-hoster must run and operate the database the ORM targets, and because V3 is a major rewrite that replaced the Prisma ORM, projects built on earlier Prisma-based ZenStack versions should expect a migration rather than a drop-in upgrade. Teams outside TypeScript, or those wanting a fully managed backend with no ORM layer to operate, are poor fits. The project carries 182 open issues, so adopting it means tracking an actively changing codebase rather than a frozen one.

npm create zenstack@latest my-project

npx @zenstackhq/cli@latest init

npm install -D @zenstackhq/cli
npm install @zenstackhq/schema @zenstackhq/orm