PolicyStack is an open-source, AI-first toolkit that turns one typed TypeScript configuration into a privacy policy, a cookie policy and the consent state that gates the cookies those documents describe, rendering them inside a React, Vue, Svelte, Solid or Angular app rather than a third-party iframe, and it is built for front-end and product teams who need policy text and cookie consent to stay in sync with the code they actually ship.

What it is

PolicyStack is an open-source toolkit distributed as a monorepo of TypeScript packages published under the @policystack/* scope, all versioned together. It provides three building blocks. Policy is your privacy and cookie policy expressed as a typed config and rendered as components or Markdown. Consent is a headless consent state machine with a core under 4kb and adapters for React, Vue, Solid, Svelte and Angular. Cloud is an optional hosted control plane for versioning, audit trails and consent analytics that sits on top of the open-source pieces. Everything except Cloud is licensed under Apache-2.0. The project lives in the JavaScript and TypeScript web ecosystem, with the repository tagged for Astro, React, Vite and CLI use.

The concrete problem it solves is drift and outsourcing. Policies and cookie consent are normally maintained in a vendor dashboard or embedded through a third-party iframe, so the text that is published and the cookies the application sets can disagree without anyone noticing. PolicyStack replaces that arrangement by treating a single typed config as the source of truth for the policy, the cookie policy and the consent that gates the cookies. A Vite plugin compiles the config at build time and scans for undeclared third parties, and the consent scanner fails the build when it finds an ungated cookie, so a mismatch becomes a build error rather than a compliance problem discovered later.

Key capabilities

• One typed config drives the privacy policy, the cookie policy and the consent state that gates the cookies those documents describe.
• @policystack/sdk exposes the public API, including defineConfig() and renderLlmsTxt().
• @policystack/renderers provides a shared Markdown, HTML and PDF render layer for the generated documents.
• The consent runtime is a headless state machine with a core under 4kb, shipped through the ./consent subpath of @policystack/core.
• Framework adapters cover React (./policy, ./consent, ./provider), Vue (./policy, ./consent), Svelte (./policy, ./consent), Solid (./consent) and Angular (./consent).
• @policystack/vite compiles the config at build time, scans for undeclared third parties and fails the build on an ungated cookie.
• @policystack/scripts supplies consent-gated third-party script loaders, and @policystack/cli covers install, configure and validate.
• The optional Cloud control plane adds versioning, audit trails and consent analytics without being required for any of the open-source packages.

Who uses it and how

• Front-end teams on React, Vue, Svelte, Solid or Angular render policy components directly into the application, so no third-party iframe appears in the page.
• Teams already building with Vite or Astro adopt the plugin so policy compilation and the third-party scan run inside the existing build pipeline.
• Teams that want their own banner rather than a vendor's use the headless consent machine and build the interface from their own components, since no UI is bundled.
• Teams with audit or reporting requirements add the optional Cloud control plane for versioning, audit trails and consent analytics while keeping the open-source packages underneath.
• Contributors working in the monorepo follow CONTRIBUTING.md, which documents setup, layout and the release flow for the jointly versioned packages.

Getting started

Run bunx @policystack/cli init. It installs the right packages for your stack, writes a starter policystack.ts and prints a prompt you can hand to a coding agent, with the full walkthrough in the quick start documentation.

How it compares

This registry entry does not list competing commercial products, and the project documentation does not name comparable open-source alternatives. On the facts available, PolicyStack stands alone in this registry.

When to use it — and when not to

PolicyStack is a good fit when your application already lives in a TypeScript or JavaScript build, because the open-source packages need no server of your own — only the build toolchain that compiles the config and runs the consent scanner. Two honest limits apply. No consent banner UI is bundled, so you must build and style that interface yourself, and the hosted Cloud control plane is not covered by the Apache-2.0 licence that applies to everything else, so teams needing versioning, audit trails or consent analytics should confirm the terms of Cloud before depending on it. PolicyStack also states plainly that it does not provide legal advice, so a lawyer should review the generated policies before publication; teams without a TypeScript front-end, or those expecting a finished banner and ready-made legal text out of the box, should look elsewhere.

bunx @policystack/cli init