policystack-init

---

name: policystack-init description: Scaffold PolicyStack in a project: run the @policystack/cli installer, then wire the single provider (policy + consent). Use when adding a privacy/cookie policy or a consent banner to a web app.

policystack-init

Set PolicyStack up in an existing project. PolicyStack generates a privacy policy, a cookie policy, and the consent runtime from one typed defineConfig() call. It is not legal advice — a lawyer should review the output before publication.

1. Run the installer

npx @policystack/cli@latest init

init detects the package manager and framework from package.json, installs @policystack/sdk plus the right framework integration, scaffolds a starter policystack.ts (src/policystack.ts when a src/ directory exists, else the project root), writes policystack.llms.txt next to it, and prints a setup prompt. Useful flags: --cwd, --pm, --skip-install, --dry-run, --yes, --out, --force.

If init cannot run, install by hand: @policystack/sdk always, plus @policystack/vite and the framework package (@policystack/react, …).

2. Fill in policystack.ts

Read the generated policystack.llms.txt — it is the type-accurate SDK reference (jurisdiction ids, lawful bases, presets) for this exact version. The canonical, commented reference config is examples/tanstack/src/policystack.ts.

jurisdictions is required and non-empty. Valid ids (frozen at 1.0): br, ca, ch, eea, row, uk, us, us-ca, us-co, us-ct, us-va. Any unlisted us-<state> falls back to us. Pick the codes that actually apply; policystack-jurisdiction explains the posture each implies.

3. Wire the provider

Wrap the app root once with the single provider — it supplies both the policy context and the consent store (derived from the same config):

import { PolicyStack } from "@policystack/react/provider";
import config from "./policystack";

export function App({ children }: { children: React.ReactNode }) {
	return <PolicyStack config={config}>{children}</PolicyStack>;
}

<PrivacyPolicy> / <CookiePolicy>, useConsent, and ConsentGate all read from it. Components ship unstyled and emit data-op-* attributes. For non-React frameworks use that framework's @policystack/<fw> package.

4. Verify

Run policystack-audit (policystack validate --json) and resolve every issue before shipping. Annotate real data flows with policystack-instrument so the policy reflects what the code actually does.