zenstackhq/zenstack

Build scalable web apps with minimum code by defining authorization and validation rules inside the data schema, closer to the database.

Summary

ZenStack is a TypeScript database toolkit that combines a schema-first data model, a type-safe ORM, built-in access control, and automatic API/hook generation for full-stack and backend Node.js or Bun applications. Version 3 replaced the underlying Prisma engine with one built on Kysely while keeping a Prisma-compatible query API, so it can serve as a drop-in replacement written entirely in TypeScript without Rust or WASM components.

What it is useful for

ZenStack fits projects where the same data layer has to enforce rules in multiple contexts: a Next.js or other frontend app calling typed CRUD hooks, a backend service exposing REST/GraphQL endpoints, and background jobs running lower-level queries. The single .zmodel schema file defines entities, relations, and policies, and the toolkit generates Zod schemas, TanStack Query hooks, and CRUD web APIs through framework adapters. Access control features in the schema (RBAC/ACL/row-level filtering) mean authorization rules can travel with the model instead of being reimplemented in every handler.

It is also useful when a team wants Prisma-style ergonomics but needs a more capable escape hatch than prisma.$queryRaw, since the low-level Kysely query builder is fully typed and exposed through the same package.

How engineers can use it

The README documents three setup paths:

1. Scaffold a new project:

npm create zenstack@latest my-project

2. Add to an existing one with the CLI:

npx @zenstackhq/cli@latest init

3. Manual install:

npm install -D @zenstackhq/cli
npm install @zenstackhq/schema @zenstackhq/orm

After this, create a zenstack folder containing a schema.zmodel file that defines models, relations, and policy attributes such as @allow or @deny.

From there, the same client supports high-level calls like db.user.findMany() (Prisma-style) and lower-level Kysely-style queries when you need finer control. Framework adapters in the project generate CRUD HTTP endpoints and React/Vue hooks automatically from the schema. A live "Try It Now" StackBlitz is linked from the README for inspecting a starter project without local setup.

The README notes that ZenStack V3 is a major rewrite, so behavior, APIs, or upgrade steps from V2 may differ; for the most accurate details on framework-specific adapters, the policy DSL, and configuration options, consult the documentation at the link provided in the README. The project is MIT-licensed.