@policystack/vite

Vite plugin that scans source files for PolicyStack collecting(), thirdParty(), defineCookie(), and sharing() calls and populates the SDK's auto-collected registry at build time.

At buildStart the plugin walks your srcDir, extracts every collecting() / thirdParty() / defineCookie() / sharing() call from @policystack/sdk, and emits the merged result (dataCollected / thirdParties / cookies / sharing) into the on-disk policystack.gen.ts your config imports. sharing(key, recipient, value) marks personal data leaving to a third party at the egress point — the data-flow edge that feeds the CCPA/CPRA sell/share posture, distinct from thirdParty() which only declares that a vendor exists.

Install

bun add -D @policystack/vite
bun add @policystack/sdk
# or: npm install --save-dev @policystack/vite && npm install @policystack/sdk

Setup

// vite.config.ts
import { defineConfig } from "vite";
import { policyStack } from "@policystack/vite";

export default defineConfig({
	plugins: [policyStack()],
});

Astro users: add it the same way under vite.plugins in astro.config.mjs.

Options

| Option | Type | Default | Description | | ----------------------------- | ------------- | ----------------- | ----------------------------------------------------------------------------------------------------------------------------------------------- | | srcDir | string | "src" | Directory walked for collecting() / thirdParty() / defineCookie() / sharing() calls, relative to the Vite root. | | extensions | string[] | [".ts", ".tsx"] | File extensions to scan. | | ignore | string[] | [] | Extra directory basenames to skip (appended to the built-in list: node_modules, dist, .git, .next, .output, .svelte-kit, .cache). | | thirdParties.usePackageJson | boolean | false | Auto-detect third-party services from package.json dependencies against the built-in registry (Stripe, Sentry, PostHog, etc.). | | validate | boolean | true | Validate the resolved policystack.ts after each scan (see Validation). | | strict | boolean | false | Promote remaining warnings to errors, so they fail vite build like real errors. | | suppress | IssueCode[] | [] | Issue codes to drop entirely, at any level (errors included). Applied before strict. |

Validation

When validate is true, the plugin runs the single validate() from @policystack/core against your resolved config after every scan and reports each IssueCode once:

• In vite build, errors abort the build (PluginContext.error); warnings are reported (PluginContext.warn) but never block.
• In vite dev, both are logged through the dev-server logger and never crash HMR.

strict and suppress shape the issue list before that error/warn split, in this order:

1. suppress drops every issue whose code is listed, at any level — errors included. Use it to accept a known disclosure gap; because the list lives in vite.config.ts, the decision is committed and shows up in review. It does not silence config load/parse failures.
2. strict then promotes every remaining warning to an error. A suppressed code is gone before this step, so it is never promoted. In vite build the promoted issues now abort the build; in vite dev they log at error level but still never crash HMR.

policyStack({
	strict: true, // warnings now fail `vite build`
	suppress: ["company-dpo-undeclared"], // …except this one, which we accept
});

Documentation

policystack.dev/docs

Links

• GitHub
• policystack.dev
• npm