@tantainnovative/create-ndpr 0.1.0 → 0.4.0

package/README.md

@@ -1,6 +1,6 @@
 # create-ndpr
 
-CLI scaffolder for [NDPA](https://ndpr.gov.ng/) compliance using [`@tantainnovative/ndpr-toolkit`](https://github.com/tantainnovative/ndpr-toolkit).
+CLI scaffolder for Nigeria [NDPA 2023](https://ndpc.gov.ng/) / NDPC GAID 2025 compliance using [`@tantainnovative/ndpr-toolkit`](https://github.com/mr-tanta/ndpr-toolkit).
 
 ## Usage
 
@@ -43,11 +43,18 @@ Run this from the root of an existing project. The CLI detects your stack and ge
 | `pages/api/consent.ts` | Next.js Pages Router + consent |
 | `pages/api/dsr.ts` | Next.js Pages Router + dsr |
 | `pages/api/breach.ts` | Next.js Pages Router + breach |
-| `src/ndpr/index.ts` | Express |
+| `src/ndpr/index.ts` | Express (Prisma only) |
 | `src/ndpr/routes/consent.ts` | Express + consent module |
+| `ndpr.audit.json` | Always — config for the `ndpr audit` compliance gate |
+| `.github/workflows/ndpr-audit.yml` | Always — CI workflow that fails on a compliance regression |
 
 All generated files use `{{ORG_NAME}}` and `{{DPO_EMAIL}}` substituted with your answers.
 
+The generated breach route (`app/api/breach/route.ts`) returns an `ndpcReadiness`
+summary on every report — which GAID 2025 Article 33(5) notification fields are
+still missing, and how many hours remain on the 72-hour clock — so you know what
+to collect before filing with the NDPC.
+
 ## Modules
 
 | Module | NDPA reference | Description |
@@ -118,6 +125,22 @@ app.use(express.json());
 app.use('/api/ndpr', createNDPRRouter());
 ```
 
+### Compliance as code (GAID 2025)
+
+Every scaffold ships an `ndpr.audit.json` config and a GitHub Actions workflow
+that runs the toolkit's `ndpr audit` CLI. The audit scores your compliance
+posture (consent, DSR, DPIA, breach, policy, lawful basis, cross-border, RoPA)
+plus your GAID 2025 DCPMI registration tier, and **exits non-zero when the score
+drops below the threshold** — so a regression fails CI like a broken test.
+
+```bash
+# Run it locally any time:
+npx ndpr audit --min-score 70
+```
+
+Edit `ndpr.audit.json` to reflect your real posture, then raise `--min-score` as
+you close gaps. See the [audit CLI guide](https://ndprtoolkit.com.ng/docs/guides/audit-cli).
+
 ## Requirements
 
 - Node.js 18+
@@ -125,6 +148,6 @@ app.use('/api/ndpr', createNDPRRouter());
 
 ## Links
 
-- Toolkit docs: https://ndpr-toolkit.tantainnovative.com
-- GitHub: https://github.com/tantainnovative/ndpr-toolkit
-- NDPC: https://ndpr.gov.ng
+- Toolkit docs: https://ndprtoolkit.com.ng
+- GitHub: https://github.com/mr-tanta/ndpr-toolkit
+- NDPC: https://ndpc.gov.ng

package/bin/index.mjs

@@ -196,12 +196,49 @@ async function askYesNo(rl, question, defaultYes = true) {
 // Template rendering
 // ---------------------------------------------------------------------------
 
+/**
+ * Render a template with `{{KEY}}` variable substitution and minimal
+ * conditional-block support.
+ *
+ * Conditional syntax:
+ *
+ *   // {{#if ORM=prisma}}
+ *   import { PrismaClient } from '@prisma/client';
+ *   // {{/if}}
+ *
+ *   // {{#if ORM=drizzle}}
+ *   import { db } from '@/drizzle';
+ *   // {{/if}}
+ *
+ *   // {{#if ORM=none}}
+ *   // TODO: wire to your storage of choice
+ *   const store = new Map();
+ *   // {{/if}}
+ *
+ * The block is kept when `vars[KEY] === value` (e.g. `vars.ORM === 'prisma'`),
+ * otherwise the block and its markers are stripped. Marker comments (with
+ * optional leading `//` and any trailing whitespace) are always removed.
+ */
 function renderTemplate(templateName, vars) {
   const templatePath = join(TEMPLATES_DIR, templateName);
   if (!existsSync(templatePath)) {
     throw new Error(`Template not found: ${templateName}`);
   }
   let content = readFileSync(templatePath, 'utf8');
+
+  // Conditional blocks first (so variable substitution doesn't munge the
+  // marker syntax). Pattern allows an optional `// ` prefix on the markers
+  // so templates can comment them out and remain valid TypeScript.
+  const ifPattern =
+    /(?:[ \t]*\/\/[ \t]*)?\{\{#if[ \t]+([A-Z_]+)=([a-zA-Z0-9_-]+)\}\}\s*([\s\S]*?)(?:[ \t]*\/\/[ \t]*)?\{\{\/if\}\}[ \t]*\n?/g;
+  content = content.replace(ifPattern, (_match, key, expected, body) => {
+    if (vars[key] === expected) {
+      // Keep the body; strip a trailing newline if it leaves a blank line
+      return body.endsWith('\n') ? body : body + '\n';
+    }
+    return '';
+  });
+
   for (const [key, value] of Object.entries(vars)) {
     content = content.replaceAll(`{{${key}}}`, value);
   }
@@ -379,6 +416,10 @@ async function main() {
     const vars = {
       ORG_NAME: orgName,
       DPO_EMAIL: dpoEmail,
+      // Drives `{{#if ORM=prisma}}` / `{{#if ORM=drizzle}}` / `{{#if ORM=none}}`
+      // conditional blocks in the route templates.
+      ORM: orm,
+      FRAMEWORK: framework,
     };
 
     // .env.example
@@ -400,6 +441,40 @@ async function main() {
       }
     }
 
+    // Routes that already support all 3 ORMs via per-{{#if ORM=...}} blocks.
+    // Add a template to this set as it gets ORM-aware. Other route templates
+    // still hard-code Prisma, so we skip them when orm === 'none' to avoid
+    // emitting code with a broken `@prisma/client` import.
+    //
+    // All Next.js and Express route templates went ORM-aware in 3.6.2.
+    // The express-setup.ts wrapper still assumes Prisma — see the
+    // separate skip handling below.
+    const ORM_AWARE_TEMPLATES = new Set([
+      'nextjs-consent-route.ts',
+      'nextjs-dsr-route.ts',
+      'nextjs-breach-route.ts',
+      'nextjs-dpia-route.ts',
+      'nextjs-lawful-basis-route.ts',
+      'nextjs-cross-border-route.ts',
+      'express-consent-route.ts',
+      'express-dpia-route.ts',
+      'express-lawful-basis-route.ts',
+      'express-cross-border-route.ts',
+    ]);
+    const generateRoute = (dest, templateName) => {
+      if (orm === 'none' && !ORM_AWARE_TEMPLATES.has(templateName)) {
+        skip(
+          dest,
+          `template hardcodes Prisma; skipping because you chose ORM=none. ` +
+            `Re-run create-ndpr with ORM=prisma|drizzle or copy the template from ` +
+            `https://github.com/mr-tanta/ndpr-toolkit/tree/main/packages/create-ndpr/templates/${templateName} ` +
+            `and adapt it to your storage layer.`,
+        );
+        return;
+      }
+      generate(dest, templateName, vars);
+    };
+
     // Framework-specific files
     if (framework === 'nextjs-app') {
       const appDir = existsSync(join(CWD, 'src', 'app')) ? 'src/app' : 'app';
@@ -409,32 +484,86 @@ async function main() {
 
       // API routes per selected module
       if (selectedModules.includes('consent')) {
-        generate(`${appDir}/api/consent/route.ts`, 'nextjs-consent-route.ts', vars);
+        generateRoute(`${appDir}/api/consent/route.ts`, 'nextjs-consent-route.ts');
       }
       if (selectedModules.includes('dsr')) {
-        generate(`${appDir}/api/dsr/route.ts`, 'nextjs-dsr-route.ts', vars);
+        generateRoute(`${appDir}/api/dsr/route.ts`, 'nextjs-dsr-route.ts');
       }
       if (selectedModules.includes('breach')) {
-        generate(`${appDir}/api/breach/route.ts`, 'nextjs-breach-route.ts', vars);
+        generateRoute(`${appDir}/api/breach/route.ts`, 'nextjs-breach-route.ts');
+      }
+      if (selectedModules.includes('dpia')) {
+        generateRoute(`${appDir}/api/dpia/route.ts`, 'nextjs-dpia-route.ts');
+      }
+      if (selectedModules.includes('lawful-basis')) {
+        generateRoute(`${appDir}/api/lawful-basis/route.ts`, 'nextjs-lawful-basis-route.ts');
+      }
+      if (selectedModules.includes('cross-border')) {
+        generateRoute(`${appDir}/api/cross-border/route.ts`, 'nextjs-cross-border-route.ts');
       }
     } else if (framework === 'nextjs-pages') {
       console.log(yellow('  Note: Pages Router API routes generated under pages/api/'));
       if (selectedModules.includes('consent')) {
-        generate('pages/api/consent.ts', 'nextjs-consent-route.ts', vars);
+        generateRoute('pages/api/consent.ts', 'nextjs-consent-route.ts');
       }
       if (selectedModules.includes('dsr')) {
-        generate('pages/api/dsr.ts', 'nextjs-dsr-route.ts', vars);
+        generateRoute('pages/api/dsr.ts', 'nextjs-dsr-route.ts');
       }
       if (selectedModules.includes('breach')) {
-        generate('pages/api/breach.ts', 'nextjs-breach-route.ts', vars);
+        generateRoute('pages/api/breach.ts', 'nextjs-breach-route.ts');
+      }
+      if (selectedModules.includes('dpia')) {
+        generateRoute('pages/api/dpia.ts', 'nextjs-dpia-route.ts');
+      }
+      if (selectedModules.includes('lawful-basis')) {
+        generateRoute('pages/api/lawful-basis.ts', 'nextjs-lawful-basis-route.ts');
+      }
+      if (selectedModules.includes('cross-border')) {
+        generateRoute('pages/api/cross-border.ts', 'nextjs-cross-border-route.ts');
       }
     } else if (framework === 'express') {
-      generate('src/ndpr/index.ts', 'express-setup.ts', vars);
+      // express-setup.ts wires up a PrismaClient directly and is not yet
+      // ORM-aware, so it only produces working code for Prisma. Skip it (with
+      // a pointer) for Drizzle and None rather than emit a broken import.
+      if (orm === 'prisma') {
+        generate('src/ndpr/index.ts', 'express-setup.ts', vars);
+      } else {
+        skip(
+          'src/ndpr/index.ts',
+          `Express setup template currently assumes Prisma; skipping for ORM=${orm}. ` +
+            'See https://github.com/mr-tanta/ndpr-toolkit/tree/main/packages/create-ndpr/templates/express-setup.ts',
+        );
+      }
       if (selectedModules.includes('consent')) {
-        generate('src/ndpr/routes/consent.ts', 'express-consent-route.ts', vars);
+        generateRoute('src/ndpr/routes/consent.ts', 'express-consent-route.ts');
+      }
+      if (selectedModules.includes('dpia')) {
+        generateRoute('src/ndpr/routes/dpia.ts', 'express-dpia-route.ts');
+      }
+      if (selectedModules.includes('lawful-basis')) {
+        generateRoute('src/ndpr/routes/lawful-basis.ts', 'express-lawful-basis-route.ts');
+      }
+      if (selectedModules.includes('cross-border')) {
+        generateRoute('src/ndpr/routes/cross-border.ts', 'express-cross-border-route.ts');
       }
     }
 
+    // -------------------------------------------------------------------------
+    // Compliance-as-code: ndpr audit config + CI gate (GAID 2025)
+    // -------------------------------------------------------------------------
+    // Always scaffolded, regardless of framework/ORM — the audit runs against a
+    // declarative config, not your database, so it works for every project.
+    if (existsSync(join(CWD, 'ndpr.audit.json'))) {
+      skip('ndpr.audit.json', 'already exists — keep your edits');
+    } else {
+      generateRaw('ndpr.audit.json', readFileSync(join(TEMPLATES_DIR, 'ndpr-audit.json'), 'utf8'));
+    }
+    if (existsSync(join(CWD, '.github', 'workflows', 'ndpr-audit.yml'))) {
+      skip('.github/workflows/ndpr-audit.yml', 'already exists');
+    } else {
+      generate('.github/workflows/ndpr-audit.yml', 'github-ndpr-audit.yml', vars);
+    }
+
     // -------------------------------------------------------------------------
     // Summary
     // -------------------------------------------------------------------------
@@ -471,7 +600,7 @@ async function main() {
     }
 
     console.log(`  ${cyan(`${orm === 'none' ? '1' : '3'}`.padStart(1))}. Install the ndpr-toolkit:`);
-    console.log(dim('     pnpm add @tantainnovative/ndpr-toolkit'));
+    console.log(dim('     pnpm add @tantainnovative/ndpr-toolkit@^5.5.1'));
     console.log();
 
     if (framework === 'nextjs-app' || framework === 'nextjs-pages') {
@@ -488,8 +617,14 @@ async function main() {
       console.log();
     }
 
-    console.log(dim('  Documentation: https://ndpr-toolkit.tantainnovative.com'));
-    console.log(dim('  Repository:    https://github.com/tantainnovative/ndpr-toolkit'));
+    const auditStep = framework === 'none' ? (orm === 'none' ? 3 : 5) : orm === 'none' ? 3 : 5;
+    console.log(`  ${cyan(`${auditStep}`)}. Keep compliance from regressing — edit ${bold('ndpr.audit.json')} to match`);
+    console.log(dim('     your real posture, then run the audit (also wired into CI for you):'));
+    console.log(dim('     npx ndpr audit --min-score 70'));
+    console.log();
+
+    console.log(dim('  Documentation: https://ndprtoolkit.com.ng'));
+    console.log(dim('  Repository:    https://github.com/mr-tanta/ndpr-toolkit'));
     console.log();
 
   } finally {

package/package.json

@@ -1,22 +1,32 @@
 {
   "name": "@tantainnovative/create-ndpr",
-  "version": "0.1.0",
-  "description": "CLI scaffolder for NDPA compliance with @tantainnovative/ndpr-toolkit",
+  "version": "0.4.0",
+  "description": "CLI scaffolder for Nigeria NDPA 2023 / NDPC GAID 2025 compliance with @tantainnovative/ndpr-toolkit",
   "license": "MIT",
   "author": {
     "name": "Abraham Esandayinze Tanta",
     "url": "https://linkedin.com/in/mr-tanta"
   },
+  "homepage": "https://ndprtoolkit.com.ng",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/mr-tanta/ndpr-toolkit.git",
+    "directory": "packages/create-ndpr"
+  },
   "bin": {
-    "create-ndpr": "./bin/index.mjs"
+    "create-ndpr": "bin/index.mjs"
   },
   "files": [
     "bin/",
-    "templates/"
+    "templates/",
+    "README.md"
   ],
   "keywords": [
     "ndpa",
     "ndpr",
+    "gaid-2025",
+    "dcpmi",
+    "compliance-audit-return",
     "cli",
     "scaffold",
     "nigeria",

package/templates/drizzle-schema.ts

@@ -4,11 +4,14 @@
  * DPO: {{DPO_EMAIL}}
  *
  * Covers:
- *   - consentRecords     — NDPA §25–26 (consent & withdrawal)
- *   - dsrRequests        — NDPA Part IV §34–38 (data subject rights)
- *   - breachReports      — NDPA §40 (72-hour breach notification)
- *   - processingRecords  — ROPA (accountability principle)
- *   - auditLog           — §44 audit trail
+ *   - consentRecords              — NDPA §25–26 (consent & withdrawal)
+ *   - dsrRequests                — NDPA Part IV §34–38 (data subject rights)
+ *   - breachReports              — NDPA §40 (72-hour breach notification)
+ *   - processingRecords          — ROPA (accountability principle)
+ *   - dpiaRecords                — NDPA §34(3) (impact assessments)
+ *   - lawfulBasisRecords         — NDPA §25 (lawful basis register)
+ *   - crossBorderTransferRecords — NDPA §41–42 (cross-border transfers)
+ *   - auditLog                   — §44 audit trail
  *
  * Prerequisites: drizzle-orm, @paralleldrive/cuid2
  * Run `drizzle-kit push` to apply.
@@ -128,6 +131,82 @@ export const processingRecords = pgTable('ndpr_processing_records', {
   updatedAt:         timestamp('updated_at').defaultNow().notNull(),
 });
 
+// ---------------------------------------------------------------------------
+// ndpr_dpia_records — NDPA §34(3)
+// ---------------------------------------------------------------------------
+
+export const dpiaRecords = pgTable(
+  'ndpr_dpia_records',
+  {
+    id:          text('id').primaryKey().$defaultFn(() => createId()),
+    projectName: text('project_name').notNull(),
+    description: text('description').notNull(),
+    dpiaData:    json('dpia_data').notNull(),
+    overallRisk: text('overall_risk').notNull(),
+    score:       integer('score').notNull(),
+    status:      text('status').notNull().default('draft'),
+    conductedBy: text('conducted_by').notNull(),
+    approvedBy:  text('approved_by'),
+    createdAt:   timestamp('created_at').defaultNow().notNull(),
+    updatedAt:   timestamp('updated_at').defaultNow().notNull(),
+  },
+  (t) => ({
+    statusIdx:      index('dpia_status_idx').on(t.status),
+    conductedByIdx: index('dpia_conducted_by_idx').on(t.conductedBy),
+  }),
+);
+
+// ---------------------------------------------------------------------------
+// ndpr_lawful_basis_records — NDPA §25
+// ---------------------------------------------------------------------------
+
+export const lawfulBasisRecords = pgTable(
+  'ndpr_lawful_basis_records',
+  {
+    id:             text('id').primaryKey().$defaultFn(() => createId()),
+    activityName:   text('activity_name').notNull(),
+    lawfulBasis:    text('lawful_basis').notNull(),
+    justification:  text('justification').notNull(),
+    dataCategories: json('data_categories').notNull(),
+    purposes:       json('purposes').notNull(),
+    assessedBy:     text('assessed_by').notNull(),
+    assessedAt:     timestamp('assessed_at').defaultNow().notNull(),
+    reviewDate:     timestamp('review_date'),
+    createdAt:      timestamp('created_at').defaultNow().notNull(),
+    updatedAt:      timestamp('updated_at').defaultNow().notNull(),
+  },
+  (t) => ({
+    lawfulBasisIdx: index('lawful_basis_idx').on(t.lawfulBasis),
+    assessedByIdx:  index('lawful_basis_assessed_by_idx').on(t.assessedBy),
+  }),
+);
+
+// ---------------------------------------------------------------------------
+// ndpr_cross_border_transfer_records — NDPA §41–42
+// ---------------------------------------------------------------------------
+
+export const crossBorderTransferRecords = pgTable(
+  'ndpr_cross_border_transfer_records',
+  {
+    id:                    text('id').primaryKey().$defaultFn(() => createId()),
+    destinationCountry:    text('destination_country').notNull(),
+    recipientName:         text('recipient_name').notNull(),
+    transferMechanism:     text('transfer_mechanism').notNull(),
+    safeguards:            text('safeguards').notNull(),
+    dataCategories:        json('data_categories').notNull(),
+    adequacyStatus:        text('adequacy_status').notNull(),
+    ndpcApprovalRequired:  boolean('ndpc_approval_required').notNull().default(false),
+    ndpcApprovalReference: text('ndpc_approval_reference'),
+    riskLevel:             text('risk_level').notNull(),
+    createdAt:             timestamp('created_at').defaultNow().notNull(),
+    updatedAt:             timestamp('updated_at').defaultNow().notNull(),
+  },
+  (t) => ({
+    destinationCountryIdx: index('cross_border_destination_idx').on(t.destinationCountry),
+    riskLevelIdx:          index('cross_border_risk_level_idx').on(t.riskLevel),
+  }),
+);
+
 // ---------------------------------------------------------------------------
 // ndpr_audit_log — §44 accountability
 // ---------------------------------------------------------------------------
@@ -159,5 +238,11 @@ export type DSRRequest       = typeof dsrRequests.$inferSelect;
 export type NewDSRRequest    = typeof dsrRequests.$inferInsert;
 export type BreachReport     = typeof breachReports.$inferSelect;
 export type NewBreachReport  = typeof breachReports.$inferInsert;
-export type ProcessingRecord = typeof processingRecords.$inferSelect;
-export type AuditLogEntry    = typeof auditLog.$inferSelect;
+export type ProcessingRecord         = typeof processingRecords.$inferSelect;
+export type DPIARecord               = typeof dpiaRecords.$inferSelect;
+export type NewDPIARecord            = typeof dpiaRecords.$inferInsert;
+export type LawfulBasisRecord        = typeof lawfulBasisRecords.$inferSelect;
+export type NewLawfulBasisRecord     = typeof lawfulBasisRecords.$inferInsert;
+export type CrossBorderTransfer      = typeof crossBorderTransferRecords.$inferSelect;
+export type NewCrossBorderTransfer   = typeof crossBorderTransferRecords.$inferInsert;
+export type AuditLogEntry            = typeof auditLog.$inferSelect;

package/templates/express-consent-route.ts

@@ -16,9 +16,38 @@
  */
 
 import { Router } from 'express';
+// {{#if ORM=prisma}}
 import { PrismaClient } from '@prisma/client';
 
 const prisma = new PrismaClient();
+// {{/if}}
+// {{#if ORM=drizzle}}
+import { db } from '@/drizzle';
+import { consentRecords, complianceAuditLog } from '@/drizzle/ndpr-schema';
+import { eq, and, isNull, desc } from 'drizzle-orm';
+// {{/if}}
+// {{#if ORM=none}}
+// TODO ({{ORG_NAME}}): wire this to your persistent store of choice. The
+// in-memory map below is enough to develop against locally but DOES NOT
+// satisfy NDPA Section 44 (record-keeping) or the auditability NDPC asks
+// about. Replace `consentStore`/`auditLog` with your DB / KV / API.
+interface ConsentRecord {
+  id: string;
+  subjectId: string;
+  consents: Record<string, boolean>;
+  version: string;
+  method: string;
+  lawfulBasis: string | null;
+  ipAddress: string | null;
+  userAgent: string | null;
+  createdAt: Date;
+  revokedAt: Date | null;
+}
+const consentStore = new Map<string, ConsentRecord>();
+const auditLog: Array<{ id: string; module: string; action: string; entityId: string; at: Date }> = [];
+function newId() { return crypto.randomUUID(); }
+// {{/if}}
+
 export const consentRouter = Router();
 
 // GET /consent?subjectId=xxx
@@ -29,10 +58,25 @@ consentRouter.get('/', async (req, res) => {
     return res.status(400).json({ error: 'subjectId required' });
   }
 
+  // {{#if ORM=prisma}}
   const record = await prisma.consentRecord.findFirst({
     where: { subjectId, revokedAt: null },
     orderBy: { createdAt: 'desc' },
   });
+  // {{/if}}
+  // {{#if ORM=drizzle}}
+  const [record] = await db
+    .select()
+    .from(consentRecords)
+    .where(and(eq(consentRecords.subjectId, subjectId), isNull(consentRecords.revokedAt)))
+    .orderBy(desc(consentRecords.createdAt))
+    .limit(1);
+  // {{/if}}
+  // {{#if ORM=none}}
+  const record = [...consentStore.values()]
+    .filter((r) => r.subjectId === subjectId && r.revokedAt === null)
+    .sort((a, b) => b.createdAt.getTime() - a.createdAt.getTime())[0] ?? null;
+  // {{/if}}
 
   return res.json(record);
 });
@@ -45,6 +89,13 @@ consentRouter.post('/', async (req, res) => {
     return res.status(400).json({ error: 'subjectId, consents, and version are required' });
   }
 
+  const ipAddress =
+    (req.headers['x-forwarded-for'] as string)?.split(',')[0].trim() ??
+    req.socket.remoteAddress ??
+    null;
+  const userAgent = req.headers['user-agent'] ?? null;
+
+  // {{#if ORM=prisma}}
   // Revoke any previously active records (immutable-audit pattern — NDPA §44).
   await prisma.consentRecord.updateMany({
     where: { subjectId, revokedAt: null },
@@ -58,11 +109,8 @@ consentRouter.post('/', async (req, res) => {
       version,
       method: method ?? 'api',
       lawfulBasis: lawfulBasis ?? null,
-      ipAddress:
-        (req.headers['x-forwarded-for'] as string)?.split(',')[0].trim() ??
-        req.socket.remoteAddress ??
-        null,
-      userAgent: req.headers['user-agent'] ?? null,
+      ipAddress,
+      userAgent,
     },
   });
 
@@ -75,6 +123,47 @@ consentRouter.post('/', async (req, res) => {
       changes: { subjectId, version, consents },
     },
   });
+  // {{/if}}
+  // {{#if ORM=drizzle}}
+  await db.update(consentRecords).set({ revokedAt: new Date() }).where(and(eq(consentRecords.subjectId, subjectId), isNull(consentRecords.revokedAt)));
+
+  const [record] = await db.insert(consentRecords).values({
+    subjectId,
+    consents,
+    version,
+    method: method ?? 'api',
+    lawfulBasis: lawfulBasis ?? null,
+    ipAddress,
+    userAgent,
+  }).returning();
+
+  await db.insert(complianceAuditLog).values({
+    module: 'consent',
+    action: 'created',
+    entityId: record.id,
+    entityType: 'ConsentRecord',
+    changes: { subjectId, version, consents },
+  });
+  // {{/if}}
+  // {{#if ORM=none}}
+  for (const r of consentStore.values()) {
+    if (r.subjectId === subjectId && r.revokedAt === null) r.revokedAt = new Date();
+  }
+  const record: ConsentRecord = {
+    id: newId(),
+    subjectId,
+    consents,
+    version,
+    method: method ?? 'api',
+    lawfulBasis: lawfulBasis ?? null,
+    ipAddress,
+    userAgent,
+    createdAt: new Date(),
+    revokedAt: null,
+  };
+  consentStore.set(record.id, record);
+  auditLog.push({ id: newId(), module: 'consent', action: 'created', entityId: record.id, at: new Date() });
+  // {{/if}}
 
   return res.status(201).json(record);
 });
@@ -87,6 +176,7 @@ consentRouter.delete('/', async (req, res) => {
     return res.status(400).json({ error: 'subjectId required' });
   }
 
+  // {{#if ORM=prisma}}
   await prisma.consentRecord.updateMany({
     where: { subjectId, revokedAt: null },
     data: { revokedAt: new Date() },
@@ -100,6 +190,22 @@ consentRouter.delete('/', async (req, res) => {
       entityType: 'ConsentRecord',
     },
   });
+  // {{/if}}
+  // {{#if ORM=drizzle}}
+  await db.update(consentRecords).set({ revokedAt: new Date() }).where(and(eq(consentRecords.subjectId, subjectId), isNull(consentRecords.revokedAt)));
+  await db.insert(complianceAuditLog).values({
+    module: 'consent',
+    action: 'revoked',
+    entityId: subjectId,
+    entityType: 'ConsentRecord',
+  });
+  // {{/if}}
+  // {{#if ORM=none}}
+  for (const r of consentStore.values()) {
+    if (r.subjectId === subjectId && r.revokedAt === null) r.revokedAt = new Date();
+  }
+  auditLog.push({ id: newId(), module: 'consent', action: 'revoked', entityId: subjectId, at: new Date() });
+  // {{/if}}
 
   return res.json({ success: true });
 });