The actual cost of choosing an ORM

The ORM debate is religious in a way that obscures the actual trade-off. Both sides have good arguments and both sides ship working products. We picked a side, but the side is contextual.

Our default at Morlabs is no ORM. We use raw SQL through the Supabase client and let `supabase gen types` produce the row types. The reason is RLS. If you reason about row-level security in SQL, you should query in SQL. An ORM that tries to abstract over RLS either lies (and the queries break) or surfaces the SQL anyway (in which case why have the ORM).

Where Drizzle or Prisma still wins: complex relational migrations across many tables, codebases with junior contributors who haven't internalized SQL yet, projects with no RLS at all, and projects that need to swap database backends mid-year. If any of those describe your project, the ORM tax is paid back. If none do, you can probably skip it.

The wrong reason to use an ORM: "we always use one." That's not a reason. That's a commit message.