@tantainnovative/create-ndpr 0.1.0 → 0.4.0

package/templates/nextjs-breach-route.ts

@@ -11,9 +11,45 @@
  */
 
 import { NextRequest, NextResponse } from 'next/server';
+import { assessBreachNotification } from '@tantainnovative/ndpr-toolkit/server';
+// {{#if ORM=prisma}}
 import { PrismaClient } from '@prisma/client';
 
 const prisma = new PrismaClient();
+// {{/if}}
+// {{#if ORM=drizzle}}
+import { db } from '@/drizzle';
+import { breachReports, complianceAuditLog } from '@/drizzle/ndpr-schema';
+import { eq, desc } from 'drizzle-orm';
+// {{/if}}
+// {{#if ORM=none}}
+// TODO ({{ORG_NAME}}): wire this to your persistent store of choice. The
+// in-memory map below is enough to develop against locally but DOES NOT
+// satisfy NDPA Section 44 (record-keeping) or the 72-hour NDPC notification
+// requirement in Section 40. Replace `breachStore`/`auditLog` with your real
+// store and connect it to your incident-response tooling.
+interface BreachReport {
+  id: string;
+  title: string;
+  description: string;
+  category: string;
+  severity: 'critical' | 'high' | 'medium' | 'low';
+  status: string;
+  discoveredAt: Date;
+  occurredAt: Date | null;
+  reportedAt: Date;
+  reporterName: string;
+  reporterEmail: string;
+  reporterDepartment: string | null;
+  affectedSystems: string[];
+  dataTypes: string[];
+  estimatedAffected: number | null;
+  initialActions: string | null;
+}
+const breachStore = new Map<string, BreachReport>();
+const auditLog: Array<{ id: string; module: string; action: string; entityId: string; at: Date }> = [];
+function newId() { return crypto.randomUUID(); }
+// {{/if}}
 
 function calculateSeverity(
   category: string,
@@ -32,10 +68,22 @@ function calculateSeverity(
 export async function GET(req: NextRequest) {
   const status = req.nextUrl.searchParams.get('status');
 
+  // {{#if ORM=prisma}}
   const reports = await prisma.breachReport.findMany({
     where: status ? { status } : undefined,
     orderBy: { reportedAt: 'desc' },
   });
+  // {{/if}}
+  // {{#if ORM=drizzle}}
+  const reports = status
+    ? await db.select().from(breachReports).where(eq(breachReports.status, status)).orderBy(desc(breachReports.reportedAt))
+    : await db.select().from(breachReports).orderBy(desc(breachReports.reportedAt));
+  // {{/if}}
+  // {{#if ORM=none}}
+  const reports = [...breachStore.values()]
+    .filter((r) => (status ? r.status === status : true))
+    .sort((a, b) => b.reportedAt.getTime() - a.reportedAt.getTime());
+  // {{/if}}
 
   return NextResponse.json(reports);
 }
@@ -74,6 +122,7 @@ export async function POST(req: NextRequest) {
 
   const severity = calculateSeverity(category, estimatedAffected);
 
+  // {{#if ORM=prisma}}
   const report = await prisma.breachReport.create({
     data: {
       title,
@@ -102,6 +151,89 @@ export async function POST(req: NextRequest) {
       changes: { title, category, severity, status: 'ongoing' },
     },
   });
+  // {{/if}}
+  // {{#if ORM=drizzle}}
+  const [report] = await db.insert(breachReports).values({
+    title,
+    description,
+    category,
+    severity,
+    status: 'ongoing',
+    discoveredAt: new Date(discoveredAt),
+    occurredAt: occurredAt ? new Date(occurredAt) : null,
+    reporterName,
+    reporterEmail,
+    reporterDepartment: reporterDepartment ?? null,
+    affectedSystems,
+    dataTypes,
+    estimatedAffected: estimatedAffected ?? null,
+    initialActions: initialActions ?? null,
+  }).returning();
 
-  return NextResponse.json(report, { status: 201 });
+  await db.insert(complianceAuditLog).values({
+    module: 'breach',
+    action: 'reported',
+    entityId: report.id,
+    entityType: 'BreachReport',
+    changes: { title, category, severity, status: 'ongoing' },
+  });
+  // {{/if}}
+  // {{#if ORM=none}}
+  const report: BreachReport = {
+    id: newId(),
+    title,
+    description,
+    category,
+    severity,
+    status: 'ongoing',
+    discoveredAt: new Date(discoveredAt),
+    occurredAt: occurredAt ? new Date(occurredAt) : null,
+    reportedAt: new Date(),
+    reporterName,
+    reporterEmail,
+    reporterDepartment: reporterDepartment ?? null,
+    affectedSystems,
+    dataTypes,
+    estimatedAffected: estimatedAffected ?? null,
+    initialActions: initialActions ?? null,
+  };
+  breachStore.set(report.id, report);
+  auditLog.push({ id: newId(), module: 'breach', action: 'reported', entityId: report.id, at: new Date() });
+  // {{/if}}
+
+  // NDPC readiness — NDPA S.40 / GAID 2025 Art. 33(5). Advisory and
+  // non-blocking: you must record every incident, but this surfaces which
+  // mandated notification fields are still missing (and how long is left on
+  // the 72-hour clock) before you file with the Commission. Collect the
+  // missing fields — likely consequences, mitigation measures, data-subject
+  // categories, record count — as your investigation progresses.
+  const ndpcReadiness = assessBreachNotification({
+    id: report.id,
+    title,
+    description,
+    category,
+    discoveredAt: new Date(discoveredAt).getTime(),
+    occurredAt: occurredAt ? new Date(occurredAt).getTime() : undefined,
+    reportedAt: Date.now(),
+    reporter: { name: reporterName, email: reporterEmail, department: reporterDepartment ?? '' },
+    affectedSystems,
+    dataTypes,
+    estimatedAffectedSubjects: estimatedAffected ?? undefined,
+    initialActions: initialActions ?? undefined,
+    dpoContact: { name: '{{ORG_NAME}} DPO', email: '{{DPO_EMAIL}}' },
+    status: 'ongoing',
+  });
+
+  return NextResponse.json(
+    {
+      ...report,
+      ndpcReadiness: {
+        complete: ndpcReadiness.complete,
+        completeness: ndpcReadiness.completeness,
+        missing: ndpcReadiness.missing,
+        hoursRemaining: ndpcReadiness.timing.hoursRemaining,
+      },
+    },
+    { status: 201 },
+  );
 }

package/templates/nextjs-consent-route.ts

@@ -2,7 +2,8 @@
  * Next.js App Router — Consent API Route
  * Generated by create-ndpr for: {{ORG_NAME}}
  *
- * NDPA §25 (lawful basis) and §26 (right to withdraw consent).
+ * NDPA Section 26 (consent) and Section 25 (lawful basis). Records the
+ * subject's affirmative choice with the audit metadata NDPC asks for.
  *
  * Endpoints:
  *   GET    /api/consent?subjectId=xxx  — Load the active consent record
@@ -11,9 +12,37 @@
  */
 
 import { NextRequest, NextResponse } from 'next/server';
+// {{#if ORM=prisma}}
 import { PrismaClient } from '@prisma/client';
 
 const prisma = new PrismaClient();
+// {{/if}}
+// {{#if ORM=drizzle}}
+import { db } from '@/drizzle';
+import { consentRecords, complianceAuditLog } from '@/drizzle/ndpr-schema';
+import { eq, and, isNull, desc } from 'drizzle-orm';
+// {{/if}}
+// {{#if ORM=none}}
+// TODO ({{ORG_NAME}}): wire this to your persistent store of choice. The
+// in-memory map below is enough to develop against locally but DOES NOT
+// satisfy NDPA Section 44 (record-keeping) or the auditability NDPC asks
+// about. Replace `consentStore`/`auditLog` with your DB / KV / API.
+interface ConsentRecord {
+  id: string;
+  subjectId: string;
+  consents: Record<string, boolean>;
+  version: string;
+  method: string;
+  lawfulBasis: string | null;
+  ipAddress: string | null;
+  userAgent: string | null;
+  createdAt: Date;
+  revokedAt: Date | null;
+}
+const consentStore = new Map<string, ConsentRecord>();
+const auditLog: Array<{ id: string; module: string; action: string; entityId: string; at: Date }> = [];
+function newId() { return crypto.randomUUID(); }
+// {{/if}}
 
 // GET /api/consent?subjectId=xxx
 export async function GET(req: NextRequest) {
@@ -23,12 +52,27 @@ export async function GET(req: NextRequest) {
     return NextResponse.json({ error: 'subjectId required' }, { status: 400 });
   }
 
+  // {{#if ORM=prisma}}
   const record = await prisma.consentRecord.findFirst({
     where: { subjectId, revokedAt: null },
     orderBy: { createdAt: 'desc' },
   });
-
-  return NextResponse.json(record);
+  // {{/if}}
+  // {{#if ORM=drizzle}}
+  const [record] = await db
+    .select()
+    .from(consentRecords)
+    .where(and(eq(consentRecords.subjectId, subjectId), isNull(consentRecords.revokedAt)))
+    .orderBy(desc(consentRecords.createdAt))
+    .limit(1);
+  // {{/if}}
+  // {{#if ORM=none}}
+  const record = [...consentStore.values()]
+    .filter((r) => r.subjectId === subjectId && r.revokedAt === null)
+    .sort((a, b) => b.createdAt.getTime() - a.createdAt.getTime())[0];
+  // {{/if}}
+
+  return NextResponse.json(record ?? null);
 }
 
 // POST /api/consent
@@ -43,38 +87,53 @@ export async function POST(req: NextRequest) {
     );
   }
 
-  // Revoke any previously active consent records (immutable-audit pattern — NDPA §44).
+  const ipAddress = req.headers.get('x-forwarded-for');
+  const userAgent = req.headers.get('user-agent');
+
+  // {{#if ORM=prisma}}
+  // Revoke previously active records (immutable-audit pattern — Section 44).
   await prisma.consentRecord.updateMany({
     where: { subjectId, revokedAt: null },
     data: { revokedAt: new Date() },
   });
 
   const record = await prisma.consentRecord.create({
-    data: {
-      subjectId,
-      consents,
-      version,
-      method: method ?? 'api',
-      lawfulBasis: lawfulBasis ?? null,
-      ipAddress: req.headers.get('x-forwarded-for'),
-      userAgent: req.headers.get('user-agent'),
-    },
+    data: { subjectId, consents, version, method: method ?? 'api', lawfulBasis: lawfulBasis ?? null, ipAddress, userAgent },
   });
 
   await prisma.complianceAuditLog.create({
-    data: {
-      module: 'consent',
-      action: 'created',
-      entityId: record.id,
-      entityType: 'ConsentRecord',
-      changes: { subjectId, version, consents },
-    },
+    data: { module: 'consent', action: 'created', entityId: record.id, entityType: 'ConsentRecord', changes: { subjectId, version, consents } },
   });
+  // {{/if}}
+  // {{#if ORM=drizzle}}
+  await db.update(consentRecords).set({ revokedAt: new Date() }).where(and(eq(consentRecords.subjectId, subjectId), isNull(consentRecords.revokedAt)));
+
+  const [record] = await db.insert(consentRecords).values({
+    subjectId, consents, version, method: method ?? 'api', lawfulBasis: lawfulBasis ?? null, ipAddress, userAgent,
+  }).returning();
+
+  await db.insert(complianceAuditLog).values({
+    module: 'consent', action: 'created', entityId: record.id, entityType: 'ConsentRecord', changes: { subjectId, version, consents },
+  });
+  // {{/if}}
+  // {{#if ORM=none}}
+  // Revoke previously active records for this subject
+  for (const r of consentStore.values()) {
+    if (r.subjectId === subjectId && r.revokedAt === null) r.revokedAt = new Date();
+  }
+  const record: ConsentRecord = {
+    id: newId(), subjectId, consents, version, method: method ?? 'api',
+    lawfulBasis: lawfulBasis ?? null, ipAddress, userAgent,
+    createdAt: new Date(), revokedAt: null,
+  };
+  consentStore.set(record.id, record);
+  auditLog.push({ id: newId(), module: 'consent', action: 'created', entityId: record.id, at: new Date() });
+  // {{/if}}
 
   return NextResponse.json(record, { status: 201 });
 }
 
-// DELETE /api/consent?subjectId=xxx
+// DELETE /api/consent?subjectId=xxx — Section 26 withdrawal
 export async function DELETE(req: NextRequest) {
   const subjectId = req.nextUrl.searchParams.get('subjectId');
 
@@ -82,19 +141,25 @@ export async function DELETE(req: NextRequest) {
     return NextResponse.json({ error: 'subjectId required' }, { status: 400 });
   }
 
+  // {{#if ORM=prisma}}
   await prisma.consentRecord.updateMany({
     where: { subjectId, revokedAt: null },
     data: { revokedAt: new Date() },
   });
-
   await prisma.complianceAuditLog.create({
-    data: {
-      module: 'consent',
-      action: 'revoked',
-      entityId: subjectId,
-      entityType: 'ConsentRecord',
-    },
+    data: { module: 'consent', action: 'revoked', entityId: subjectId, entityType: 'ConsentRecord' },
   });
+  // {{/if}}
+  // {{#if ORM=drizzle}}
+  await db.update(consentRecords).set({ revokedAt: new Date() }).where(and(eq(consentRecords.subjectId, subjectId), isNull(consentRecords.revokedAt)));
+  await db.insert(complianceAuditLog).values({ module: 'consent', action: 'revoked', entityId: subjectId, entityType: 'ConsentRecord' });
+  // {{/if}}
+  // {{#if ORM=none}}
+  for (const r of consentStore.values()) {
+    if (r.subjectId === subjectId && r.revokedAt === null) r.revokedAt = new Date();
+  }
+  auditLog.push({ id: newId(), module: 'consent', action: 'revoked', entityId: subjectId, at: new Date() });
+  // {{/if}}
 
   return NextResponse.json({ success: true });
 }

package/templates/nextjs-cross-border-route.ts

@@ -0,0 +1,325 @@
+/**
+ * Next.js App Router — Cross-Border Transfer Route
+ * Generated by create-ndpr for: {{ORG_NAME}}
+ *
+ * NDPA §41–43 — transfers of personal data outside Nigeria require
+ * adequate safeguards and, in some cases, NDPC approval.
+ *
+ * Endpoints:
+ *   GET    /api/cross-border                  — List transfers (optional ?riskLevel= or ?destinationCountry= filter)
+ *   GET    /api/cross-border?id=xxx           — Get a single transfer record
+ *   POST   /api/cross-border                  — Register a new cross-border transfer
+ *   PUT    /api/cross-border                  — Update an existing transfer record
+ *   DELETE /api/cross-border?id=xxx           — Delete a transfer record
+ */
+
+import { NextRequest, NextResponse } from 'next/server';
+// {{#if ORM=prisma}}
+import { PrismaClient } from '@prisma/client';
+
+const prisma = new PrismaClient();
+// {{/if}}
+// {{#if ORM=drizzle}}
+import { db } from '@/drizzle';
+import { crossBorderTransferRecords, complianceAuditLog } from '@/drizzle/ndpr-schema';
+import { eq, and, desc, type SQL } from 'drizzle-orm';
+// {{/if}}
+// {{#if ORM=none}}
+// TODO ({{ORG_NAME}}): wire this to your persistent store of choice. The
+// in-memory map below is enough to develop against locally but DOES NOT
+// satisfy NDPA Section 44 (record-keeping) or the cross-border register
+// NDPC inspects under Sections 41–43. Replace `crossBorderStore`/`auditLog`
+// with your DB / KV / API.
+interface CrossBorderTransferRecord {
+  id: string;
+  destinationCountry: string;
+  recipientName: string;
+  transferMechanism: string;
+  safeguards: string;
+  dataCategories: string[];
+  adequacyStatus: string;
+  ndpcApprovalRequired: boolean;
+  ndpcApprovalReference: string | null;
+  riskLevel: string;
+  createdAt: Date;
+  updatedAt: Date;
+}
+const crossBorderStore = new Map<string, CrossBorderTransferRecord>();
+const auditLog: Array<{ id: string; module: string; action: string; entityId: string; at: Date }> = [];
+function newId() { return crypto.randomUUID(); }
+// {{/if}}
+
+// GET /api/cross-border?riskLevel=high  OR  /api/cross-border?id=xxx
+export async function GET(req: NextRequest) {
+  const id = req.nextUrl.searchParams.get('id');
+
+  if (id) {
+    // {{#if ORM=prisma}}
+    const record = await prisma.crossBorderTransferRecord.findUnique({ where: { id } });
+    // {{/if}}
+    // {{#if ORM=drizzle}}
+    const [record] = await db.select().from(crossBorderTransferRecords).where(eq(crossBorderTransferRecords.id, id)).limit(1);
+    // {{/if}}
+    // {{#if ORM=none}}
+    const record = crossBorderStore.get(id) ?? null;
+    // {{/if}}
+
+    if (!record) {
+      return NextResponse.json({ error: 'Cross-border transfer record not found' }, { status: 404 });
+    }
+    return NextResponse.json(record);
+  }
+
+  const riskLevel = req.nextUrl.searchParams.get('riskLevel');
+  const destinationCountry = req.nextUrl.searchParams.get('destinationCountry');
+
+  // {{#if ORM=prisma}}
+  const where: Record<string, string> = {};
+  if (riskLevel) where.riskLevel = riskLevel;
+  if (destinationCountry) where.destinationCountry = destinationCountry;
+
+  const records = await prisma.crossBorderTransferRecord.findMany({
+    where: Object.keys(where).length > 0 ? where : undefined,
+    orderBy: { createdAt: 'desc' },
+  });
+  // {{/if}}
+  // {{#if ORM=drizzle}}
+  const filters: SQL[] = [];
+  if (riskLevel) filters.push(eq(crossBorderTransferRecords.riskLevel, riskLevel));
+  if (destinationCountry) filters.push(eq(crossBorderTransferRecords.destinationCountry, destinationCountry));
+
+  const records = filters.length > 0
+    ? await db.select().from(crossBorderTransferRecords).where(and(...filters)).orderBy(desc(crossBorderTransferRecords.createdAt))
+    : await db.select().from(crossBorderTransferRecords).orderBy(desc(crossBorderTransferRecords.createdAt));
+  // {{/if}}
+  // {{#if ORM=none}}
+  const records = [...crossBorderStore.values()]
+    .filter((r) => (riskLevel ? r.riskLevel === riskLevel : true))
+    .filter((r) => (destinationCountry ? r.destinationCountry === destinationCountry : true))
+    .sort((a, b) => b.createdAt.getTime() - a.createdAt.getTime());
+  // {{/if}}
+
+  return NextResponse.json(records);
+}
+
+// POST /api/cross-border
+export async function POST(req: NextRequest) {
+  const body = await req.json();
+  const {
+    destinationCountry,
+    recipientName,
+    transferMechanism,
+    safeguards,
+    dataCategories,
+    adequacyStatus,
+    ndpcApprovalRequired,
+    ndpcApprovalReference,
+    riskLevel,
+  } = body;
+
+  if (
+    !destinationCountry ||
+    !recipientName ||
+    !transferMechanism ||
+    !safeguards ||
+    !dataCategories ||
+    !adequacyStatus ||
+    !riskLevel
+  ) {
+    return NextResponse.json(
+      {
+        error:
+          'destinationCountry, recipientName, transferMechanism, safeguards, dataCategories, adequacyStatus, and riskLevel are required',
+      },
+      { status: 400 },
+    );
+  }
+
+  if (!Array.isArray(dataCategories)) {
+    return NextResponse.json(
+      { error: 'dataCategories must be an array' },
+      { status: 400 },
+    );
+  }
+
+  // {{#if ORM=prisma}}
+  const record = await prisma.crossBorderTransferRecord.create({
+    data: {
+      destinationCountry,
+      recipientName,
+      transferMechanism,
+      safeguards,
+      dataCategories,
+      adequacyStatus,
+      ndpcApprovalRequired: ndpcApprovalRequired ?? false,
+      ndpcApprovalReference: ndpcApprovalReference ?? null,
+      riskLevel,
+    },
+  });
+
+  await prisma.complianceAuditLog.create({
+    data: {
+      module: 'cross-border',
+      action: 'created',
+      entityId: record.id,
+      entityType: 'CrossBorderTransferRecord',
+      changes: { destinationCountry, recipientName, riskLevel },
+    },
+  });
+  // {{/if}}
+  // {{#if ORM=drizzle}}
+  const [record] = await db.insert(crossBorderTransferRecords).values({
+    destinationCountry,
+    recipientName,
+    transferMechanism,
+    safeguards,
+    dataCategories,
+    adequacyStatus,
+    ndpcApprovalRequired: ndpcApprovalRequired ?? false,
+    ndpcApprovalReference: ndpcApprovalReference ?? null,
+    riskLevel,
+  }).returning();
+
+  await db.insert(complianceAuditLog).values({
+    module: 'cross-border',
+    action: 'created',
+    entityId: record.id,
+    entityType: 'CrossBorderTransferRecord',
+    changes: { destinationCountry, recipientName, riskLevel },
+  });
+  // {{/if}}
+  // {{#if ORM=none}}
+  const now = new Date();
+  const record: CrossBorderTransferRecord = {
+    id: newId(),
+    destinationCountry,
+    recipientName,
+    transferMechanism,
+    safeguards,
+    dataCategories,
+    adequacyStatus,
+    ndpcApprovalRequired: ndpcApprovalRequired ?? false,
+    ndpcApprovalReference: ndpcApprovalReference ?? null,
+    riskLevel,
+    createdAt: now,
+    updatedAt: now,
+  };
+  crossBorderStore.set(record.id, record);
+  auditLog.push({ id: newId(), module: 'cross-border', action: 'created', entityId: record.id, at: new Date() });
+  // {{/if}}
+
+  return NextResponse.json(record, { status: 201 });
+}
+
+// PUT /api/cross-border
+export async function PUT(req: NextRequest) {
+  const body = await req.json();
+  const { id, ...data } = body;
+
+  if (!id) {
+    return NextResponse.json({ error: 'id is required' }, { status: 400 });
+  }
+
+  // {{#if ORM=prisma}}
+  const existing = await prisma.crossBorderTransferRecord.findUnique({ where: { id } });
+  if (!existing) {
+    return NextResponse.json({ error: 'Cross-border transfer record not found' }, { status: 404 });
+  }
+
+  const record = await prisma.crossBorderTransferRecord.update({
+    where: { id },
+    data,
+  });
+
+  await prisma.complianceAuditLog.create({
+    data: {
+      module: 'cross-border',
+      action: 'updated',
+      entityId: record.id,
+      entityType: 'CrossBorderTransferRecord',
+      changes: data,
+    },
+  });
+  // {{/if}}
+  // {{#if ORM=drizzle}}
+  const [existing] = await db.select().from(crossBorderTransferRecords).where(eq(crossBorderTransferRecords.id, id)).limit(1);
+  if (!existing) {
+    return NextResponse.json({ error: 'Cross-border transfer record not found' }, { status: 404 });
+  }
+
+  const [record] = await db.update(crossBorderTransferRecords).set(data).where(eq(crossBorderTransferRecords.id, id)).returning();
+
+  await db.insert(complianceAuditLog).values({
+    module: 'cross-border',
+    action: 'updated',
+    entityId: record.id,
+    entityType: 'CrossBorderTransferRecord',
+    changes: data,
+  });
+  // {{/if}}
+  // {{#if ORM=none}}
+  const existing = crossBorderStore.get(id);
+  if (!existing) {
+    return NextResponse.json({ error: 'Cross-border transfer record not found' }, { status: 404 });
+  }
+  const record: CrossBorderTransferRecord = { ...existing, ...data, id, updatedAt: new Date() };
+  crossBorderStore.set(id, record);
+  auditLog.push({ id: newId(), module: 'cross-border', action: 'updated', entityId: record.id, at: new Date() });
+  // {{/if}}
+
+  return NextResponse.json(record);
+}
+
+// DELETE /api/cross-border?id=xxx
+export async function DELETE(req: NextRequest) {
+  const id = req.nextUrl.searchParams.get('id');
+
+  if (!id) {
+    return NextResponse.json({ error: 'id is required' }, { status: 400 });
+  }
+
+  // {{#if ORM=prisma}}
+  const existing = await prisma.crossBorderTransferRecord.findUnique({ where: { id } });
+  if (!existing) {
+    return NextResponse.json({ error: 'Cross-border transfer record not found' }, { status: 404 });
+  }
+
+  await prisma.crossBorderTransferRecord.delete({ where: { id } });
+
+  await prisma.complianceAuditLog.create({
+    data: {
+      module: 'cross-border',
+      action: 'deleted',
+      entityId: id,
+      entityType: 'CrossBorderTransferRecord',
+      changes: { destinationCountry: existing.destinationCountry, recipientName: existing.recipientName },
+    },
+  });
+  // {{/if}}
+  // {{#if ORM=drizzle}}
+  const [existing] = await db.select().from(crossBorderTransferRecords).where(eq(crossBorderTransferRecords.id, id)).limit(1);
+  if (!existing) {
+    return NextResponse.json({ error: 'Cross-border transfer record not found' }, { status: 404 });
+  }
+
+  await db.delete(crossBorderTransferRecords).where(eq(crossBorderTransferRecords.id, id));
+
+  await db.insert(complianceAuditLog).values({
+    module: 'cross-border',
+    action: 'deleted',
+    entityId: id,
+    entityType: 'CrossBorderTransferRecord',
+    changes: { destinationCountry: existing.destinationCountry, recipientName: existing.recipientName },
+  });
+  // {{/if}}
+  // {{#if ORM=none}}
+  const existing = crossBorderStore.get(id);
+  if (!existing) {
+    return NextResponse.json({ error: 'Cross-border transfer record not found' }, { status: 404 });
+  }
+  crossBorderStore.delete(id);
+  auditLog.push({ id: newId(), module: 'cross-border', action: 'deleted', entityId: id, at: new Date() });
+  // {{/if}}
+
+  return NextResponse.json({ success: true });
+}