@tantainnovative/create-ndpr 0.1.0 → 0.4.0

package/templates/nextjs-dpia-route.ts

@@ -0,0 +1,290 @@
+/**
+ * Next.js App Router — DPIA (Data Protection Impact Assessment) Route
+ * Generated by create-ndpr for: {{ORG_NAME}}
+ *
+ * NDPA §28 — a DPIA must be conducted where processing is likely
+ * to result in a high risk to the rights and freedoms of data subjects.
+ *
+ * Endpoints:
+ *   GET    /api/dpia               — List DPIA records (optional ?status= filter)
+ *   GET    /api/dpia?id=xxx        — Get a single DPIA record
+ *   POST   /api/dpia               — Create a new DPIA record
+ *   PUT    /api/dpia               — Update an existing DPIA record
+ *   DELETE /api/dpia?id=xxx        — Delete a DPIA record
+ */
+
+import { NextRequest, NextResponse } from 'next/server';
+// {{#if ORM=prisma}}
+import { PrismaClient } from '@prisma/client';
+
+const prisma = new PrismaClient();
+// {{/if}}
+// {{#if ORM=drizzle}}
+import { db } from '@/drizzle';
+import { dpiaRecords, complianceAuditLog } from '@/drizzle/ndpr-schema';
+import { eq, desc } from 'drizzle-orm';
+// {{/if}}
+// {{#if ORM=none}}
+// TODO ({{ORG_NAME}}): wire this to your persistent store of choice. The
+// in-memory map below is enough to develop against locally but DOES NOT
+// satisfy NDPA Section 44 (record-keeping) or the auditability NDPC asks
+// about. Replace `dpiaStore`/`auditLog` with your DB / KV / API.
+interface DPIARecord {
+  id: string;
+  projectName: string;
+  description: string;
+  dpiaData: unknown;
+  overallRisk: string;
+  score: number;
+  status: string;
+  conductedBy: string;
+  approvedBy: string | null;
+  createdAt: Date;
+  updatedAt: Date;
+}
+const dpiaStore = new Map<string, DPIARecord>();
+const auditLog: Array<{ id: string; module: string; action: string; entityId: string; at: Date }> = [];
+function newId() { return crypto.randomUUID(); }
+// {{/if}}
+
+// GET /api/dpia?status=draft  OR  /api/dpia?id=xxx
+export async function GET(req: NextRequest) {
+  const id = req.nextUrl.searchParams.get('id');
+
+  if (id) {
+    // {{#if ORM=prisma}}
+    const record = await prisma.dPIARecord.findUnique({ where: { id } });
+    // {{/if}}
+    // {{#if ORM=drizzle}}
+    const [record] = await db.select().from(dpiaRecords).where(eq(dpiaRecords.id, id)).limit(1);
+    // {{/if}}
+    // {{#if ORM=none}}
+    const record = dpiaStore.get(id) ?? null;
+    // {{/if}}
+
+    if (!record) {
+      return NextResponse.json({ error: 'DPIA record not found' }, { status: 404 });
+    }
+    return NextResponse.json(record);
+  }
+
+  const status = req.nextUrl.searchParams.get('status');
+
+  // {{#if ORM=prisma}}
+  const records = await prisma.dPIARecord.findMany({
+    where: status ? { status } : undefined,
+    orderBy: { createdAt: 'desc' },
+  });
+  // {{/if}}
+  // {{#if ORM=drizzle}}
+  const records = status
+    ? await db.select().from(dpiaRecords).where(eq(dpiaRecords.status, status)).orderBy(desc(dpiaRecords.createdAt))
+    : await db.select().from(dpiaRecords).orderBy(desc(dpiaRecords.createdAt));
+  // {{/if}}
+  // {{#if ORM=none}}
+  const records = [...dpiaStore.values()]
+    .filter((r) => (status ? r.status === status : true))
+    .sort((a, b) => b.createdAt.getTime() - a.createdAt.getTime());
+  // {{/if}}
+
+  return NextResponse.json(records);
+}
+
+// POST /api/dpia
+export async function POST(req: NextRequest) {
+  const body = await req.json();
+  const {
+    projectName,
+    description,
+    dpiaData,
+    overallRisk,
+    score,
+    conductedBy,
+    approvedBy,
+  } = body;
+
+  if (!projectName || !description || !dpiaData || !overallRisk || score == null || !conductedBy) {
+    return NextResponse.json(
+      { error: 'projectName, description, dpiaData, overallRisk, score, and conductedBy are required' },
+      { status: 400 },
+    );
+  }
+
+  // {{#if ORM=prisma}}
+  const record = await prisma.dPIARecord.create({
+    data: {
+      projectName,
+      description,
+      dpiaData,
+      overallRisk,
+      score,
+      status: 'draft',
+      conductedBy,
+      approvedBy: approvedBy ?? null,
+    },
+  });
+
+  await prisma.complianceAuditLog.create({
+    data: {
+      module: 'dpia',
+      action: 'created',
+      entityId: record.id,
+      entityType: 'DPIARecord',
+      changes: { projectName, overallRisk, score, status: 'draft' },
+    },
+  });
+  // {{/if}}
+  // {{#if ORM=drizzle}}
+  const [record] = await db.insert(dpiaRecords).values({
+    projectName,
+    description,
+    dpiaData,
+    overallRisk,
+    score,
+    status: 'draft',
+    conductedBy,
+    approvedBy: approvedBy ?? null,
+  }).returning();
+
+  await db.insert(complianceAuditLog).values({
+    module: 'dpia',
+    action: 'created',
+    entityId: record.id,
+    entityType: 'DPIARecord',
+    changes: { projectName, overallRisk, score, status: 'draft' },
+  });
+  // {{/if}}
+  // {{#if ORM=none}}
+  const now = new Date();
+  const record: DPIARecord = {
+    id: newId(),
+    projectName,
+    description,
+    dpiaData,
+    overallRisk,
+    score,
+    status: 'draft',
+    conductedBy,
+    approvedBy: approvedBy ?? null,
+    createdAt: now,
+    updatedAt: now,
+  };
+  dpiaStore.set(record.id, record);
+  auditLog.push({ id: newId(), module: 'dpia', action: 'created', entityId: record.id, at: new Date() });
+  // {{/if}}
+
+  return NextResponse.json(record, { status: 201 });
+}
+
+// PUT /api/dpia
+export async function PUT(req: NextRequest) {
+  const body = await req.json();
+  const { id, ...data } = body;
+
+  if (!id) {
+    return NextResponse.json({ error: 'id is required' }, { status: 400 });
+  }
+
+  // {{#if ORM=prisma}}
+  const existing = await prisma.dPIARecord.findUnique({ where: { id } });
+  if (!existing) {
+    return NextResponse.json({ error: 'DPIA record not found' }, { status: 404 });
+  }
+
+  const record = await prisma.dPIARecord.update({
+    where: { id },
+    data,
+  });
+
+  await prisma.complianceAuditLog.create({
+    data: {
+      module: 'dpia',
+      action: 'updated',
+      entityId: record.id,
+      entityType: 'DPIARecord',
+      changes: data,
+    },
+  });
+  // {{/if}}
+  // {{#if ORM=drizzle}}
+  const [existing] = await db.select().from(dpiaRecords).where(eq(dpiaRecords.id, id)).limit(1);
+  if (!existing) {
+    return NextResponse.json({ error: 'DPIA record not found' }, { status: 404 });
+  }
+
+  const [record] = await db.update(dpiaRecords).set(data).where(eq(dpiaRecords.id, id)).returning();
+
+  await db.insert(complianceAuditLog).values({
+    module: 'dpia',
+    action: 'updated',
+    entityId: record.id,
+    entityType: 'DPIARecord',
+    changes: data,
+  });
+  // {{/if}}
+  // {{#if ORM=none}}
+  const existing = dpiaStore.get(id);
+  if (!existing) {
+    return NextResponse.json({ error: 'DPIA record not found' }, { status: 404 });
+  }
+  const record: DPIARecord = { ...existing, ...data, id, updatedAt: new Date() };
+  dpiaStore.set(id, record);
+  auditLog.push({ id: newId(), module: 'dpia', action: 'updated', entityId: record.id, at: new Date() });
+  // {{/if}}
+
+  return NextResponse.json(record);
+}
+
+// DELETE /api/dpia?id=xxx
+export async function DELETE(req: NextRequest) {
+  const id = req.nextUrl.searchParams.get('id');
+
+  if (!id) {
+    return NextResponse.json({ error: 'id is required' }, { status: 400 });
+  }
+
+  // {{#if ORM=prisma}}
+  const existing = await prisma.dPIARecord.findUnique({ where: { id } });
+  if (!existing) {
+    return NextResponse.json({ error: 'DPIA record not found' }, { status: 404 });
+  }
+
+  await prisma.dPIARecord.delete({ where: { id } });
+
+  await prisma.complianceAuditLog.create({
+    data: {
+      module: 'dpia',
+      action: 'deleted',
+      entityId: id,
+      entityType: 'DPIARecord',
+      changes: { projectName: existing.projectName },
+    },
+  });
+  // {{/if}}
+  // {{#if ORM=drizzle}}
+  const [existing] = await db.select().from(dpiaRecords).where(eq(dpiaRecords.id, id)).limit(1);
+  if (!existing) {
+    return NextResponse.json({ error: 'DPIA record not found' }, { status: 404 });
+  }
+
+  await db.delete(dpiaRecords).where(eq(dpiaRecords.id, id));
+
+  await db.insert(complianceAuditLog).values({
+    module: 'dpia',
+    action: 'deleted',
+    entityId: id,
+    entityType: 'DPIARecord',
+    changes: { projectName: existing.projectName },
+  });
+  // {{/if}}
+  // {{#if ORM=none}}
+  const existing = dpiaStore.get(id);
+  if (!existing) {
+    return NextResponse.json({ error: 'DPIA record not found' }, { status: 404 });
+  }
+  dpiaStore.delete(id);
+  auditLog.push({ id: newId(), module: 'dpia', action: 'deleted', entityId: id, at: new Date() });
+  // {{/if}}
+
+  return NextResponse.json({ success: true });
+}

package/templates/nextjs-dsr-route.ts

@@ -2,9 +2,9 @@
  * Next.js App Router — DSR (Data Subject Rights) Route
  * Generated by create-ndpr for: {{ORG_NAME}}
  *
- * NDPA Part IV §34–38 — rights to access, rectification, erasure,
- * portability, and objection. All requests must be acknowledged
- * within 72 hours and fulfilled within 30 days.
+ * NDPA §34 — rights to access, rectification, erasure, portability, and
+ * objection. All requests must be acknowledged promptly and fulfilled
+ * within the statutory window (NDPC guidance: 30 days).
  *
  * Endpoints:
  *   GET  /api/dsr               — List DSR requests (optional ?status= filter)
@@ -12,18 +12,59 @@
  */
 
 import { NextRequest, NextResponse } from 'next/server';
+// {{#if ORM=prisma}}
 import { PrismaClient } from '@prisma/client';
 
 const prisma = new PrismaClient();
+// {{/if}}
+// {{#if ORM=drizzle}}
+import { db } from '@/drizzle';
+import { dsrRequests, complianceAuditLog } from '@/drizzle/ndpr-schema';
+import { eq, desc } from 'drizzle-orm';
+// {{/if}}
+// {{#if ORM=none}}
+// TODO ({{ORG_NAME}}): wire this to your persistent store of choice. The
+// in-memory map below is enough to develop against locally but DOES NOT
+// satisfy NDPA Section 44 (record-keeping) or the auditability NDPC asks
+// about. Replace `dsrStore`/`auditLog` with your DB / KV / API.
+interface DSRRequest {
+  id: string;
+  type: string;
+  subjectName: string;
+  subjectEmail: string;
+  subjectPhone: string | null;
+  identifierType: string;
+  identifierValue: string;
+  description: string | null;
+  status: string;
+  submittedAt: Date;
+  dueAt: Date;
+}
+const dsrStore = new Map<string, DSRRequest>();
+const auditLog: Array<{ id: string; module: string; action: string; entityId: string; at: Date }> = [];
+function newId() { return crypto.randomUUID(); }
+// {{/if}}
 
 // GET /api/dsr?status=pending
 export async function GET(req: NextRequest) {
   const status = req.nextUrl.searchParams.get('status');
 
+  // {{#if ORM=prisma}}
   const requests = await prisma.dSRRequest.findMany({
     where: status ? { status } : undefined,
     orderBy: { submittedAt: 'desc' },
   });
+  // {{/if}}
+  // {{#if ORM=drizzle}}
+  const requests = status
+    ? await db.select().from(dsrRequests).where(eq(dsrRequests.status, status)).orderBy(desc(dsrRequests.submittedAt))
+    : await db.select().from(dsrRequests).orderBy(desc(dsrRequests.submittedAt));
+  // {{/if}}
+  // {{#if ORM=none}}
+  const requests = [...dsrStore.values()]
+    .filter((r) => (status ? r.status === status : true))
+    .sort((a, b) => b.submittedAt.getTime() - a.submittedAt.getTime());
+  // {{/if}}
 
   return NextResponse.json(requests);
 }
@@ -52,6 +93,7 @@ export async function POST(req: NextRequest) {
   const dueAt = new Date();
   dueAt.setDate(dueAt.getDate() + 30);
 
+  // {{#if ORM=prisma}}
   const request = await prisma.dSRRequest.create({
     data: {
       type,
@@ -75,6 +117,45 @@ export async function POST(req: NextRequest) {
       changes: { type, subjectEmail, status: 'pending' },
     },
   });
+  // {{/if}}
+  // {{#if ORM=drizzle}}
+  const [request] = await db.insert(dsrRequests).values({
+    type,
+    subjectName,
+    subjectEmail,
+    subjectPhone: subjectPhone ?? null,
+    identifierType,
+    identifierValue,
+    description: description ?? null,
+    status: 'pending',
+    dueAt,
+  }).returning();
+
+  await db.insert(complianceAuditLog).values({
+    module: 'dsr',
+    action: 'submitted',
+    entityId: request.id,
+    entityType: 'DSRRequest',
+    changes: { type, subjectEmail, status: 'pending' },
+  });
+  // {{/if}}
+  // {{#if ORM=none}}
+  const request: DSRRequest = {
+    id: newId(),
+    type,
+    subjectName,
+    subjectEmail,
+    subjectPhone: subjectPhone ?? null,
+    identifierType,
+    identifierValue,
+    description: description ?? null,
+    status: 'pending',
+    submittedAt: new Date(),
+    dueAt,
+  };
+  dsrStore.set(request.id, request);
+  auditLog.push({ id: newId(), module: 'dsr', action: 'submitted', entityId: request.id, at: new Date() });
+  // {{/if}}
 
   return NextResponse.json(request, { status: 201 });
 }

package/templates/nextjs-lawful-basis-route.ts

@@ -0,0 +1,297 @@
+/**
+ * Next.js App Router — Lawful Basis Route
+ * Generated by create-ndpr for: {{ORG_NAME}}
+ *
+ * NDPA §25 — data processing must have a lawful basis. This route
+ * manages a register of processing activities and their lawful bases.
+ *
+ * Endpoints:
+ *   GET    /api/lawful-basis               — List lawful basis records (optional ?lawfulBasis= filter)
+ *   GET    /api/lawful-basis?id=xxx        — Get a single record
+ *   POST   /api/lawful-basis               — Create a new lawful basis record
+ *   PUT    /api/lawful-basis               — Update an existing record
+ *   DELETE /api/lawful-basis?id=xxx        — Delete a record
+ */
+
+import { NextRequest, NextResponse } from 'next/server';
+// {{#if ORM=prisma}}
+import { PrismaClient } from '@prisma/client';
+
+const prisma = new PrismaClient();
+// {{/if}}
+// {{#if ORM=drizzle}}
+import { db } from '@/drizzle';
+import { lawfulBasisRecords, complianceAuditLog } from '@/drizzle/ndpr-schema';
+import { eq, desc } from 'drizzle-orm';
+// {{/if}}
+// {{#if ORM=none}}
+// TODO ({{ORG_NAME}}): wire this to your persistent store of choice. The
+// in-memory map below is enough to develop against locally but DOES NOT
+// satisfy NDPA Section 44 (record-keeping). Replace `lawfulBasisStore`/
+// `auditLog` with your DB / KV / API.
+interface LawfulBasisRecord {
+  id: string;
+  activityName: string;
+  lawfulBasis: string;
+  justification: string;
+  dataCategories: string[];
+  purposes: string[];
+  assessedBy: string;
+  reviewDate: Date | null;
+  createdAt: Date;
+  updatedAt: Date;
+}
+const lawfulBasisStore = new Map<string, LawfulBasisRecord>();
+const auditLog: Array<{ id: string; module: string; action: string; entityId: string; at: Date }> = [];
+function newId() { return crypto.randomUUID(); }
+// {{/if}}
+
+// GET /api/lawful-basis?lawfulBasis=consent  OR  /api/lawful-basis?id=xxx
+export async function GET(req: NextRequest) {
+  const id = req.nextUrl.searchParams.get('id');
+
+  if (id) {
+    // {{#if ORM=prisma}}
+    const record = await prisma.lawfulBasisRecord.findUnique({ where: { id } });
+    // {{/if}}
+    // {{#if ORM=drizzle}}
+    const [record] = await db.select().from(lawfulBasisRecords).where(eq(lawfulBasisRecords.id, id)).limit(1);
+    // {{/if}}
+    // {{#if ORM=none}}
+    const record = lawfulBasisStore.get(id) ?? null;
+    // {{/if}}
+
+    if (!record) {
+      return NextResponse.json({ error: 'Lawful basis record not found' }, { status: 404 });
+    }
+    return NextResponse.json(record);
+  }
+
+  const lawfulBasis = req.nextUrl.searchParams.get('lawfulBasis');
+
+  // {{#if ORM=prisma}}
+  const records = await prisma.lawfulBasisRecord.findMany({
+    where: lawfulBasis ? { lawfulBasis } : undefined,
+    orderBy: { createdAt: 'desc' },
+  });
+  // {{/if}}
+  // {{#if ORM=drizzle}}
+  const records = lawfulBasis
+    ? await db.select().from(lawfulBasisRecords).where(eq(lawfulBasisRecords.lawfulBasis, lawfulBasis)).orderBy(desc(lawfulBasisRecords.createdAt))
+    : await db.select().from(lawfulBasisRecords).orderBy(desc(lawfulBasisRecords.createdAt));
+  // {{/if}}
+  // {{#if ORM=none}}
+  const records = [...lawfulBasisStore.values()]
+    .filter((r) => (lawfulBasis ? r.lawfulBasis === lawfulBasis : true))
+    .sort((a, b) => b.createdAt.getTime() - a.createdAt.getTime());
+  // {{/if}}
+
+  return NextResponse.json(records);
+}
+
+// POST /api/lawful-basis
+export async function POST(req: NextRequest) {
+  const body = await req.json();
+  const {
+    activityName,
+    lawfulBasis,
+    justification,
+    dataCategories,
+    purposes,
+    assessedBy,
+    reviewDate,
+  } = body;
+
+  if (!activityName || !lawfulBasis || !justification || !dataCategories || !purposes || !assessedBy) {
+    return NextResponse.json(
+      { error: 'activityName, lawfulBasis, justification, dataCategories, purposes, and assessedBy are required' },
+      { status: 400 },
+    );
+  }
+
+  if (!Array.isArray(dataCategories) || !Array.isArray(purposes)) {
+    return NextResponse.json(
+      { error: 'dataCategories and purposes must be arrays' },
+      { status: 400 },
+    );
+  }
+
+  // {{#if ORM=prisma}}
+  const record = await prisma.lawfulBasisRecord.create({
+    data: {
+      activityName,
+      lawfulBasis,
+      justification,
+      dataCategories,
+      purposes,
+      assessedBy,
+      reviewDate: reviewDate ? new Date(reviewDate) : null,
+    },
+  });
+
+  await prisma.complianceAuditLog.create({
+    data: {
+      module: 'lawful-basis',
+      action: 'created',
+      entityId: record.id,
+      entityType: 'LawfulBasisRecord',
+      changes: { activityName, lawfulBasis, assessedBy },
+    },
+  });
+  // {{/if}}
+  // {{#if ORM=drizzle}}
+  const [record] = await db.insert(lawfulBasisRecords).values({
+    activityName,
+    lawfulBasis,
+    justification,
+    dataCategories,
+    purposes,
+    assessedBy,
+    reviewDate: reviewDate ? new Date(reviewDate) : null,
+  }).returning();
+
+  await db.insert(complianceAuditLog).values({
+    module: 'lawful-basis',
+    action: 'created',
+    entityId: record.id,
+    entityType: 'LawfulBasisRecord',
+    changes: { activityName, lawfulBasis, assessedBy },
+  });
+  // {{/if}}
+  // {{#if ORM=none}}
+  const now = new Date();
+  const record: LawfulBasisRecord = {
+    id: newId(),
+    activityName,
+    lawfulBasis,
+    justification,
+    dataCategories,
+    purposes,
+    assessedBy,
+    reviewDate: reviewDate ? new Date(reviewDate) : null,
+    createdAt: now,
+    updatedAt: now,
+  };
+  lawfulBasisStore.set(record.id, record);
+  auditLog.push({ id: newId(), module: 'lawful-basis', action: 'created', entityId: record.id, at: new Date() });
+  // {{/if}}
+
+  return NextResponse.json(record, { status: 201 });
+}
+
+// PUT /api/lawful-basis
+export async function PUT(req: NextRequest) {
+  const body = await req.json();
+  const { id, ...data } = body;
+
+  if (!id) {
+    return NextResponse.json({ error: 'id is required' }, { status: 400 });
+  }
+
+  if (data.reviewDate) {
+    data.reviewDate = new Date(data.reviewDate);
+  }
+
+  // {{#if ORM=prisma}}
+  const existing = await prisma.lawfulBasisRecord.findUnique({ where: { id } });
+  if (!existing) {
+    return NextResponse.json({ error: 'Lawful basis record not found' }, { status: 404 });
+  }
+
+  const record = await prisma.lawfulBasisRecord.update({
+    where: { id },
+    data,
+  });
+
+  await prisma.complianceAuditLog.create({
+    data: {
+      module: 'lawful-basis',
+      action: 'updated',
+      entityId: record.id,
+      entityType: 'LawfulBasisRecord',
+      changes: data,
+    },
+  });
+  // {{/if}}
+  // {{#if ORM=drizzle}}
+  const [existing] = await db.select().from(lawfulBasisRecords).where(eq(lawfulBasisRecords.id, id)).limit(1);
+  if (!existing) {
+    return NextResponse.json({ error: 'Lawful basis record not found' }, { status: 404 });
+  }
+
+  const [record] = await db.update(lawfulBasisRecords).set(data).where(eq(lawfulBasisRecords.id, id)).returning();
+
+  await db.insert(complianceAuditLog).values({
+    module: 'lawful-basis',
+    action: 'updated',
+    entityId: record.id,
+    entityType: 'LawfulBasisRecord',
+    changes: data,
+  });
+  // {{/if}}
+  // {{#if ORM=none}}
+  const existing = lawfulBasisStore.get(id);
+  if (!existing) {
+    return NextResponse.json({ error: 'Lawful basis record not found' }, { status: 404 });
+  }
+  const record: LawfulBasisRecord = { ...existing, ...data, id, updatedAt: new Date() };
+  lawfulBasisStore.set(id, record);
+  auditLog.push({ id: newId(), module: 'lawful-basis', action: 'updated', entityId: record.id, at: new Date() });
+  // {{/if}}
+
+  return NextResponse.json(record);
+}
+
+// DELETE /api/lawful-basis?id=xxx
+export async function DELETE(req: NextRequest) {
+  const id = req.nextUrl.searchParams.get('id');
+
+  if (!id) {
+    return NextResponse.json({ error: 'id is required' }, { status: 400 });
+  }
+
+  // {{#if ORM=prisma}}
+  const existing = await prisma.lawfulBasisRecord.findUnique({ where: { id } });
+  if (!existing) {
+    return NextResponse.json({ error: 'Lawful basis record not found' }, { status: 404 });
+  }
+
+  await prisma.lawfulBasisRecord.delete({ where: { id } });
+
+  await prisma.complianceAuditLog.create({
+    data: {
+      module: 'lawful-basis',
+      action: 'deleted',
+      entityId: id,
+      entityType: 'LawfulBasisRecord',
+      changes: { activityName: existing.activityName },
+    },
+  });
+  // {{/if}}
+  // {{#if ORM=drizzle}}
+  const [existing] = await db.select().from(lawfulBasisRecords).where(eq(lawfulBasisRecords.id, id)).limit(1);
+  if (!existing) {
+    return NextResponse.json({ error: 'Lawful basis record not found' }, { status: 404 });
+  }
+
+  await db.delete(lawfulBasisRecords).where(eq(lawfulBasisRecords.id, id));
+
+  await db.insert(complianceAuditLog).values({
+    module: 'lawful-basis',
+    action: 'deleted',
+    entityId: id,
+    entityType: 'LawfulBasisRecord',
+    changes: { activityName: existing.activityName },
+  });
+  // {{/if}}
+  // {{#if ORM=none}}
+  const existing = lawfulBasisStore.get(id);
+  if (!existing) {
+    return NextResponse.json({ error: 'Lawful basis record not found' }, { status: 404 });
+  }
+  lawfulBasisStore.delete(id);
+  auditLog.push({ id: newId(), module: 'lawful-basis', action: 'deleted', entityId: id, at: new Date() });
+  // {{/if}}
+
+  return NextResponse.json({ success: true });
+}