` and Metro will throw `View config getter callback for component "div" must be a function`. ```tsx import { Linking, Pressable, Text, View } from "react-native"; import { PrivacyPolicy, type PolicyComponents } from "@policystack/react/policy"; import policy from "./policy"; const components: PolicyComponents = { Root: ({ children }) => {children}, Section: ({ children }) => {children}, Heading: ({ node }) => ( {node.value} ), Paragraph: ({ children }) => {children}, List: ({ children }) => {children}, ListItem: ({ children }) => ( {"\u2022 "} {children} ), Text: ({ node }) => <>{node.value}, Bold: ({ node }) => {node.value}, Italic: ({ node }) => {node.value}, Link: ({ node }) => ( Linking.openURL(node.href)}> {node.value} ), }; export function PrivacyScreen() { return ; } ``` The `style` prop accepts any value (typed `unknown`) so you can pass an RN `ViewStyle` straight through to your custom `Root`. Override the `Table*` slots too if your config produces tables. --- # Render privacy policies in React Source: https://policystack.dev/docs/policy/react > **PolicyStack V1** — current documentation. [Supported capabilities and limitations](https://policystack.dev/docs/reference/support). React adapter for Policy. Renders your `policystack.ts` config as React components — a privacy policy, a cookie policy, or individual sections — with every element overridable. ## Install ```sh bun add @policystack/react @policystack/sdk ``` Peer dependencies: `react >= 18`. ## Setup There is **one** provider. Wrap your app with `` from `@policystack/react/provider` and pass it your whole `policystack.ts` config — it supplies both the policy context (`` / ``) and the consent store. There is no separate config and no conversion step. ```tsx import { PolicyStack } from "@policystack/react/provider"; import policy from "@/policystack"; export default function RootLayout({ children }: { children: React.ReactNode }) { return {children}; } ``` You can also skip the provider and pass `config` directly to a component (handy for a one-off page or React Native). ## Components ### `` / `` Render the document for the current config. Props: - `config?` — a `PolicyStackConfig`. Omit it to read the config from the nearest `` provider. - `components?` — a `PolicyComponents` map of slot overrides (see below). - `style?` — passed through to the `Root` slot. ```tsx import { PolicyStack } from "@policystack/react/provider"; import { PrivacyPolicy, CookiePolicy } from "@policystack/react/policy"; import policy from "@/policystack"; export function PrivacyPolicyPage() { return ( ); } ``` The privacy policy is emitted when the config has a `data` block; the cookie policy when it has `cookies`. See [Privacy policy](https://policystack.dev/docs/policy/policies/privacy) and [Cookie policy](https://policystack.dev/docs/policy/policies/cookies) for the config side. ## Custom renderers Components render unstyled by default. Pass a `components` prop to supply your own renderer for any slot — headings, paragraphs, lists, links, tables. The `PolicyComponents` type is the canonical slot contract; every key is optional and falls back to the default renderer. ```tsx import { PrivacyPolicy, type PolicyComponents } from "@policystack/react/policy"; import policy from "@/policystack"; const components: PolicyComponents = { Root: ({ children }) =>

{children}

, Heading: ({ node }) => node.level && node.level >= 3 ? (

{node.value}

) : (

{node.value}

), Link: ({ node }) => ( {node.value} ), }; export function PrivacyScreen() { return ; } ``` The default renderers (`DefaultRoot`, `DefaultHeading`, …) and the low-level `renderDocument` helper are exported too, if you want to wrap rather than replace a slot. ## React Native / Expo `` and `` work in React Native when you supply RN equivalents for every slot via `components` — including `Root`, or Metro throws on the default `

`. See the worked example in the [Quick Start](https://policystack.dev/docs/policy/policies/quick-start#react-native--expo). ## See also - [Quick Start](https://policystack.dev/docs/policy/policies/quick-start) — add policy pages to your app - [Configuration](https://policystack.dev/docs/policy/configuration) — the `policystack.ts` reference - [`@policystack/vue/policy`](https://policystack.dev/docs/policy/vue) · [`@policystack/svelte/policy`](https://policystack.dev/docs/policy/svelte) — other adapters - [Consent docs](https://policystack.dev/docs/consent) — the same config also drives the cookie banner ## License Apache-2.0 --- # Examples Source: https://policystack.dev/docs/policy/references/examples > **PolicyStack V1** — current documentation. [Supported capabilities and limitations](https://policystack.dev/docs/reference/support). Example projects live in the [GitHub repository](https://github.com/jamiedavenport/policystack/tree/main/examples). | Example | Stack | | ------------------------------------------------------------------------------------- | ---------------------------------------------------------- | | [TanStack](https://github.com/jamiedavenport/policystack/tree/main/examples/tanstack) | TanStack Start + `@policystack/react` + `@policystack/sdk` | The PolicyStack site itself ([`apps/web`](https://github.com/jamiedavenport/policystack/tree/main/apps/web)) is also a working reference: it dogfoods `@policystack/{react,sdk}`, rendering [`/privacy`](https://policystack.dev/privacy) from a typed `policystack.ts` and gating analytics behind a consent banner derived from the same config. --- # Supported jurisdictions Source: https://policystack.dev/docs/policy/references/jurisdictions > **PolicyStack V1** — current documentation. [Supported capabilities and limitations](https://policystack.dev/docs/reference/support). Policy uses lowercase-kebab region codes for the `jurisdictions` field in your `policystack.ts`. `JurisdictionId` includes seven top-level regions and all 50 US states. TypeScript accepts only these codes and the runtime validator rejects anything else; there is no second enum and no migration alias. There are no regulation-name aliases like `"gdpr"` or `"ccpa"` — use the region code the regulation applies to. The code for the EU/EEA is `"eea"`, not `"eu"`: GDPR applies EEA-wide. ## Codes Every supported region resolves to one of two tiers: - **`specific`** — hand-authored, jurisdiction-precise policy text and user rights. - **`equivalent`** — posture-correct (opt-in vs. opt-out) with parent-jurisdiction text, plus a suppressible `jurisdiction-generic-policy-text` validator warning so the honesty gap is visible. A legitimate, shippable tier — a member's tier may be upgraded post-1.0 without a breaking change. | Code | Region | Regulation(s) | Tier | | ------------ | ----------------------- | --------------------------- | ------------ | | `eea` | European Economic Area | GDPR | `specific` | | `uk` | United Kingdom | UK-GDPR + PECR | `specific` | | `us-ca` | California, USA | CCPA / CPRA | `specific` | | `ch` | Switzerland | revFADP | `equivalent` | | `br` | Brazil | LGPD | `equivalent` | | `ca` | Canada | PIPEDA (+ Quebec Law 25) | `equivalent` | | `us` | United States (federal) | Federal baseline, opt-out | `equivalent` | | `us-` | Any US state | State privacy law posture | `equivalent` | | `row` | Rest of world | Conservative opt-in default | `equivalent` | US privacy law is state-level. `"us"` is the federal opt-out baseline; use the lowercase ISO postal code for a state, such as `"us-ca"`, `"us-fl"`, or `"us-tx"`. All 50 state codes inherit text and posture from `"us"` as their parent. California is the only state currently upgraded to hand-authored `specific` policy text. ```text us-al us-ak us-az us-ar us-ca us-co us-ct us-de us-fl us-ga us-hi us-id us-il us-in us-ia us-ks us-ky us-la us-me us-md us-ma us-mi us-mn us-ms us-mo us-mt us-ne us-nv us-nh us-nj us-nm us-ny us-nc us-nd us-oh us-ok us-or us-pa us-ri us-sc us-sd us-tn us-tx us-ut us-vt us-va us-wa us-wv us-wi us-wy ``` For programmatic checks, core and the SDK export `US_STATE_JURISDICTION_IDS`, `USStateJurisdictionId`, and the `isUSStateJurisdictionId()` type guard. ## What each `specific` code adds ### `eea` — GDPR - **Legal basis** section (Article 13) - **GDPR supplemental disclosures** (data controller, transfer safeguards, complaint rights) - **User rights**: access, rectification, erasure, portability, restriction, objection - **Cookie policy**: European-user disclosure under ePrivacy + GDPR consent rules ### `uk` — UK-GDPR - **Legal basis** section (Article 13) - **UK-GDPR supplemental disclosures**: Information Commissioner's Office (ICO) named as the supervisory authority, link to the ICO complaint portal, Data Protection Act 2018 referenced as the implementing statute, UK international transfer safeguards - **User rights**: same six rights as GDPR - **Cookie policy**: UK-user disclosure under PECR + UK-GDPR consent rules ### `us-ca` — CCPA / CPRA - **California Privacy Rights** supplement (Right to Know, Right to Delete, Right to Opt-Out, Right to Non-Discrimination) - **User rights**: access, erasure, opt_out_sale, non_discrimination ## Combining codes When multiple codes apply, their content is combined — user rights are deduplicated and ordered canonically, and each jurisdiction-specific supplement renders once. For example: ```ts jurisdictions: ["eea", "uk", "us-ca"], ``` produces a policy with GDPR, UK-GDPR, and CCPA supplements, plus the union of all three rights sets. ## Validation The runtime validator rejects any code that isn't a member of the union with compact guidance: ``` Unknown jurisdiction "eu" — valid top-level codes: eea, uk, ch, br, ca, us, row; US states use us- (for example, us-ca or us-tx) ``` If you are upgrading from a pre-1.0 release, the common migration is `"eu"` → `"eea"`. The codes `"au"`, `"jp"`, and `"sg"` are not canonical jurisdictions and are rejected — declare `"row"` for a conservative opt-in fallback if you serve those regions. --- # Render privacy policies in Svelte Source: https://policystack.dev/docs/policy/svelte > **PolicyStack V1** — current documentation. [Supported capabilities and limitations](https://policystack.dev/docs/reference/support). Svelte 5 adapter for Policy. Renders your `policystack.ts` config as Svelte components, with every element overridable via snippets. ## Install ```sh bun add @policystack/svelte @policystack/sdk ``` Peer dependencies: `svelte >= 5` (the policy renderer is runes-based). ## Setup There is **one** provider, and for Svelte it ships from the same entry as the components: `@policystack/svelte/policy`. Wrap your app with `` and pass it your whole `policystack.ts` config — it supplies the policy context (`` / ``) and the consent store. (Consent hooks themselves import from `@policystack/svelte/consent`.) ```svelte {@render children()} ``` You can also skip the provider and pass `config` directly to a component. ## Components ### `` / `` Render the document for the current config. Props: - `config?` — a `PolicyStackConfig`. Omit it to read the config from the nearest ``. - `style?` — a CSS string, passed through to the `Root` slot. - One optional **snippet** per slot (`Root`, `Heading`, `Link`, …) — see below. ```svelte ``` The privacy policy is emitted when the config has a `data` block; the cookie policy when it has `cookies`. See [Privacy policy](https://policystack.dev/docs/policy/policies/privacy) and [Cookie policy](https://policystack.dev/docs/policy/policies/cookies) for the config side. ## Snippet overrides Unlike React/Vue (which take a `components` object), the Svelte adapter takes one snippet **prop per slot**. The `PolicyComponents` type maps each canonical slot to a `Snippet`; every slot receives its `node`, and container slots (`Root`, `Section`, `List`, table slots) additionally receive a `children` snippet. Anything you don't override falls back to the default renderer. ```svelte {#snippet Heading({ node })} = 3 ? "h3" : "h2"} class="font-medium"> {node.value} {/snippet} {#snippet Link({ node })} {node.value} {/snippet} ``` To wrap rather than replace the document shell, override `Root` and render its `children` snippet inside your own markup. The `Default*` slot components are exported too. ## See also - [Quick Start](https://policystack.dev/docs/policy/policies/quick-start) — add policy pages to your app - [Configuration](https://policystack.dev/docs/policy/configuration) — the `policystack.ts` reference - [`@policystack/react/policy`](https://policystack.dev/docs/policy/react) · [`@policystack/vue/policy`](https://policystack.dev/docs/policy/vue) — other adapters - [Consent docs](https://policystack.dev/docs/consent) — the same config also drives the cookie banner ## License Apache-2.0 --- # Render privacy policies in Vue Source: https://policystack.dev/docs/policy/vue > **PolicyStack V1** — current documentation. [Supported capabilities and limitations](https://policystack.dev/docs/reference/support). > **Vue 1.5.0 packaging limitation:** the published package omits `@policystack/vue/provider`. Provider examples below describe the repository implementation and require a release exporting `./provider`. Direct policy rendering with `config` remains available. [Support details](https://policystack.dev/docs/reference/support). Vue 3 adapter for Policy. Renders your `policystack.ts` config as Vue components, with every element overridable. The API mirrors the [React adapter](https://policystack.dev/docs/policy/react), translated to Vue idioms. ## Install ```sh bun add @policystack/vue @policystack/sdk ``` Peer dependencies: `vue >= 3`. ## Setup There is **one** provider. Wrap your app with `` from `@policystack/vue/provider` and pass it your whole `policystack.ts` config — it supplies both the policy context (`` / ``) and the consent store. No separate config, no conversion step. ```vue ``` You can also skip the provider and pass `:config` directly to a component. ## Components ### `` / `` Render the document for the current config. Props: - `config?` — a `PolicyStackConfig`. Omit it to read the config from the nearest `` provider. - `components?` — a `PolicyComponents` map of slot overrides (see below). - `style?` — a Vue `CSSProperties` object, passed through to the `Root` slot. ```vue ``` The privacy policy is emitted when the config has a `data` block; the cookie policy when it has `cookies`. See [Privacy policy](https://policystack.dev/docs/policy/policies/privacy) and [Cookie policy](https://policystack.dev/docs/policy/policies/cookies) for the config side. ## Custom renderers Components render unstyled by default. Pass a `components` prop to supply your own renderer for any slot. The `PolicyComponents` type is the canonical slot contract — keys are optional and fall back to the default renderer. ```vue ``` The default renderers (`DefaultRoot`, `DefaultHeading`, …) and the low-level `renderDocument` helper are exported too, if you want to wrap rather than replace a slot. ## See also - [Quick Start](https://policystack.dev/docs/policy/policies/quick-start) — add policy pages to your app - [Configuration](https://policystack.dev/docs/policy/configuration) — the `policystack.ts` reference - [`@policystack/react/policy`](https://policystack.dev/docs/policy/react) · [`@policystack/svelte/policy`](https://policystack.dev/docs/policy/svelte) — other adapters - [Consent docs](https://policystack.dev/docs/consent) — the same config also drives the cookie banner ## License Apache-2.0 --- # Add privacy policies and cookie consent to React Source: https://policystack.dev/docs/quickstart This PolicyStack V1 quickstart adds a privacy policy and a minimal consent choice UI to an existing React 18+ TypeScript application. PolicyStack supplies the state and renderers; you own the banner design and accessibility. ## Install the packages ```sh pnpm add @policystack/sdk@1 @policystack/core@1 @policystack/react@1 ``` Alternatively, `pnpm dlx @policystack/cli@1 init` scaffolds a starter config and an agent reference. The manual example below is complete and uses fictional company details: replace them with your reviewed disclosures. ## Define a shared configuration Create `policystack.ts`: ```ts import { ContractPrerequisite, defineConfig, LegalBases } from "@policystack/sdk"; export default defineConfig({ company: { name: "Acme", legalName: "Acme Ltd", address: "1 High Street, London", url: "https://acme.example", contact: { email: "privacy@acme.example" }, }, effectiveDate: "2026-09-06", jurisdictions: ["eea", "uk"], data: { collected: { Account: ["Email address"] }, context: { Account: { purpose: "Create and operate an account", lawfulBasis: LegalBases.Contract, retention: "Until account deletion", provision: ContractPrerequisite("An account cannot be created without it."), }, }, }, cookies: { used: { essential: true, analytics: true }, context: { essential: { lawfulBasis: LegalBases.LegalObligation }, analytics: { lawfulBasis: LegalBases.Consent }, }, }, }); ``` Company values are explicit: V1 does not populate them from `package.json`. Use [configuration guidance](https://policystack.dev/docs/policy/configuration) and validation to review jurisdiction-dependent disclosures before publishing. ## Render the policy and consent controls Create or replace `App.tsx`: ```tsx import { PolicyStack } from "@policystack/react/provider"; import { PrivacyPolicy } from "@policystack/react/policy"; import { ConsentGate, useConsent } from "@policystack/react/consent"; import policy from "./policystack"; function ConsentControls() { const { route, acceptAll, acceptNecessary, setRoute } = useConsent(); return (

{route === "cookie" ? ( <>

Allow optional analytics or use necessary cookies only.

) : ( )}

); } export default function App() { return ( Analytics is off.

Analytics consent has been granted.

); } ``` ## Verify the behaviour With no saved choice, the optional analytics gate is closed. Accept all opens it; necessary only keeps it closed. Change the choice to reject after accepting and the gate closes again. The privacy document renders from the same configuration. The example displays a consent state, not a tracking script. To load a real vendor, use [GatedScript and the script factories](https://policystack.dev/docs/consent/scripts). Closing a gate does not unload an already executed vendor script: implement the vendor's opt-out/reset behaviour where needed. See [storage and SSR](https://policystack.dev/docs/consent/core) when persisting choices or rendering on the server. ## Next steps - [Render a cookie policy or export Markdown](https://policystack.dev/docs/policy/policies/quick-start). - [Build a preferences panel with useCategory](https://policystack.dev/docs/consent/react). - [Detect ungated analytics in Vite](https://policystack.dev/docs/consent/vite). - [Validate your configuration and connect MCP](https://policystack.dev/docs/policy/cli). Implementation: [React consent bindings](https://github.com/jamiedavenport/policystack/tree/main/packages/react/src), [core consent store](https://github.com/jamiedavenport/policystack/tree/main/packages/core/src/consent). --- # V1 support matrix and limitations Source: https://policystack.dev/docs/reference/support PolicyStack V1 is a TypeScript-first library for policy generation and headless consent. This matrix describes the 1.5.0 release line and checked-in implementation, reviewed on 6 September 2026. Packaging differences are called out explicitly. ## Which frameworks does PolicyStack support? | Integration | Policy rendering | Consent bindings | GatedScript | | ---------------------- | ---------------- | ------------------------- | ------------------------- | | React 18+ | Yes | Yes | Yes | | Vue 3.5+ | Yes | Yes, see packaging caveat | Yes, see packaging caveat | | Svelte 5 | Yes | Yes, runes and stores | Yes | | Solid 1.8+ | No | Yes | Yes | | Angular 20+ | No | Yes | No | | Framework-neutral core | Document AST | Consent store | gateScript / gateScripts | The Vue 1.5.0 published export map omits `@policystack/vue/provider`, although this repository implements it. Direct policy rendering with a `config` prop works; shared-provider examples require a release whose export map includes `./provider`. Do not assume repository source is already published. Solid 1.5.0 exports TypeScript source, so the consuming toolchain must transpile dependency source. Svelte's store API is available, but the package requires Svelte 5; it is not a Svelte 4 compatibility guarantee. ## Which documents and output formats are supported? V1 generates **privacy and cookie policies**. The core compiles a renderer-neutral document AST. `@policystack/renderers` exports Markdown, HTML, and PDF; React, Vue, and Svelte provide policy components. Terms of service, DPAs, DPIAs, and data-subject request workflows are not included. A `data` or `children` declaration triggers privacy emission; `cookies` triggers cookie emission. `trackingTechnologies` alone does not auto-emit a cookie policy. An explicit `policies` selection controls emission. The privacy compiler currently requires non-empty collected data even though the validator permits an empty declaration with a warning. ## Does PolicyStack include a cookie banner? No finished banner or preferences UI ships with V1. PolicyStack is headless: the application supplies layout, copy, accessibility, and vendor integration. The [React quickstart](https://policystack.dev/docs/quickstart) demonstrates a minimal UI. ## Does PolicyStack automatically block every cookie? No. Vite analysis detects some ungated source usage. Runtime enforcement happens only where applications call the consent APIs or use gates. Static scanning is heuristic, cannot prove all data flows are covered, and skips unsupported dynamic declarations. Revoking consent does not undo earlier vendor actions or unload scripts that already ran. Seven vendor factories ship: GA4, Google Tag Manager, Meta Pixel, PostHog, Segment, Hotjar, and Microsoft Clarity. ## Which CLI and agent tools ship? `policystack init`, `policystack validate --json`, and `policystack mcp` are implemented. Consent-specific scan and sync shell commands are not implemented. Use the Vite scanner or MCP `scan_ungated` tool instead. The [agent guide](https://policystack.dev/docs/policy/agent-skills) links the generated SDK reference and four generated workflow skills. ## What jurisdiction and language coverage exists? Jurisdiction-specific policy text exists for `eea`, `uk`, and `us-ca`. Other supported jurisdiction IDs use generic text and emit `jurisdiction-generic-policy-text`; an accepted ID does not imply complete legal coverage. Consent posture and policy-text coverage are separate. Unknown countries fall back to conservative opt-in behaviour. Built-in boilerplate supports English, French, German, Dutch, and Spanish. User-supplied purposes, names, and retention statements are not translated. [Jurisdiction reference](https://policystack.dev/docs/policy/references/jurisdictions). ## Does V1 enforce consent in backend services? V1 provides cookie/header helpers and a generic HTTP storage adapter. It does not provide server middleware, identity-to-consent mapping, distributed revocation, Python/Go SDKs, or background-job enforcement. Applications must supply those integrations. ## What is planned for V2? A self-hostable control plane, privacy inventory, backend enforcement, and rights workflows are [planned V2 direction](https://policystack.dev/docs/roadmap), not shipped V1 capabilities. No availability date or price is committed here. ## Licensing and review Current V1 packages are Apache-2.0. Proposed V2 licensing is described separately on the roadmap and is subject to review. Generated documents and consent UX require human review; PolicyStack cannot determine your obligations or guarantee compliance. ## Implementation evidence - [Package manifests and source](https://github.com/jamiedavenport/policystack/tree/main/packages). - [Emission rules](https://github.com/jamiedavenport/policystack/blob/main/packages/core/src/emit.ts) and [compiler tests](https://github.com/jamiedavenport/policystack/tree/main/packages/core/src). - [CLI commands](https://github.com/jamiedavenport/policystack/blob/main/packages/cli/src/index.ts) and [MCP tools](https://github.com/jamiedavenport/policystack/blob/main/packages/cli/src/mcp/tools.ts).