Plugin

policystack

Name: policystack
Author: jamiedavenport

Manage privacy policies and consent banners with PolicyStack – scaffold the configuration, audit validation errors, instrument data collection markers, and review jurisdiction posture for privacy-first apps.

security

code-quality

What's Inside

Skills4

policystack-audit

/policystack-audit

Audit a policystack.ts config: run `policystack validate --json`, explain each issue code, propose a minimal config fix, then re-validate until clean. Use when a PolicyStack config has validation errors or warnings.

policystack-init

/policystack-init

Scaffold PolicyStack in a project: run the @policystack/cli installer, then wire the single <PolicyStack> provider (policy + consent). Use when adding a privacy/cookie policy or a consent banner to a web app.

policystack-instrument

/policystack-instrument

Find un-annotated data collection and data egress in a codebase and add PolicyStack `collecting()` / `sharing()` / `thirdParty()` / `defineCookie()` call sites so the generated policy reflects what the code actually does.

policystack-jurisdiction

/policystack-jurisdiction

Explain the consent and policy-text posture (the §4.2 stance) implied by a set of declared PolicyStack `jurisdictions`. Use when choosing or reviewing the `jurisdictions` array in policystack.ts.

README

PolicyStack

Open-source, AI-first primitives for adding privacy policies and consent to your app. One typed config drives your privacy policy, your cookie policy, and the consent that gates the cookies they describe — all rendered directly into your React/Vue/Svelte/Solid/Angular app, never a third-party iframe.

Three building blocks

Policy — your privacy and cookie policy as a typed config, rendered as components or Markdown. A Vite plugin compiles it at build time and scans for undeclared third parties.
Consent — a headless consent state machine. Sub-4kb core, adapters for React, Vue, Solid, Svelte, and Angular, and a Vite plugin that fails the build on an ungated cookie. No bundled UI — you build the banner with your own components.
Cloud — an optional hosted control plane for versioning, audit trails, and consent analytics. It sits on top of the OSS pieces; you never need it to use them.

Everything except Cloud is Apache-2.0.

Quick start

bunx @policystack/cli init

init installs the right packages for your stack, writes a starter policystack.ts, and prints a prompt you can hand to a coding agent. See the quick start for the full walkthrough.

Packages

All packages publish under the @policystack/* scope and version together.

Package	What it is
`@policystack/sdk`	Public API — `defineConfig()`, `renderLlmsTxt()`
`@policystack/core`	Compilation engine + consent runtime (`./consent` subpath)
`@policystack/vite`	Vite plugin + opt-in consent scanner
`@policystack/cli`	Install / configure / validate CLI
`@policystack/renderers`	Shared Markdown / HTML / PDF render layer
`@policystack/scripts`	Consent-gated third-party script loaders
`@policystack/react`	React adapters — `./policy`, `./consent`, `./provider`
`@policystack/vue`	Vue adapters — `./policy`, `./consent`
`@policystack/svelte`	Svelte adapters — `./policy`, `./consent`
`@policystack/solid`	Solid adapter — `./consent`
`@policystack/angular`	Angular adapter — `./consent`

Contributing

See CONTRIBUTING.md for setup, the monorepo layout, and the release flow. Apache-2.0 — issues and PRs welcome.

Not legal advice. PolicyStack generates policy documents from your config. It does not provide legal advice. Have a lawyer review your policies before publication. See the legal notice.