@tantainnovative/create-ndpr 0.1.0 → 0.5.0

package/templates/express-consent-route.ts

@@ -1,105 +1,362 @@
-/**
- * Express — Consent Router
- * Generated by create-ndpr for: {{ORG_NAME}}
- * DPO: {{DPO_EMAIL}}
- *
- * NDPA §25 (lawful basis) and §26 (right to withdraw consent).
- *
- * Routes:
- *   GET    /consent?subjectId=xxx  — Load the active consent record
- *   POST   /consent                — Save new consent (revokes previous)
- *   DELETE /consent?subjectId=xxx  — Revoke all active consent
- *
- * Usage:
- *   import { consentRouter } from './routes/consent';
- *   app.use('/api/consent', consentRouter);
- */
-
+/** Express — tenant-scoped consent router for {{ORG_NAME_COMMENT}}. */
 import { Router } from 'express';
-import { PrismaClient } from '@prisma/client';
-
+import { getNDPRContextProblem, resolveNDPRRequestContext } from '{{NDPR_CONTEXT_IMPORT}}';
+// {{#if ORM=prisma}}
+import { Prisma, PrismaClient } from '@prisma/client';
 const prisma = new PrismaClient();
+// {{/if}}
+// {{#if ORM=drizzle}}
+import { db } from '{{NDPR_DB_IMPORT}}';
+import { complianceAuditLog, consentRecords } from '{{NDPR_SCHEMA_IMPORT}}';
+import { and, desc, eq, isNull } from 'drizzle-orm';
+// {{/if}}
+// {{#if ORM=none}}
+// DEVELOPMENT ONLY: replace both stores with one durable transactional store.
+interface ConsentRow {
+  id: string; tenantId: string; subjectId: string; activeSubjectKey: string | null;
+  consents: Record<string, boolean>; version: string; method: string;
+  hasInteracted: boolean; lawfulBasis: string | null;
+  ipAddress: string | null; userAgent: string | null; clientTimestamp: Date;
+  createdAt: Date; revokedAt: Date | null;
+}
+const consentStore = new Map<string, ConsentRow>();
+const auditLog: Array<{
+  id: string; tenantId: string; action: string; entityId: string;
+  performedBy: string | null; at: Date;
+}> = [];
+// {{/if}}
+
+interface ConsentSettings {
+  consents: Record<string, boolean>;
+  version: string;
+  method: string;
+  hasInteracted: boolean;
+  lawfulBasis?: string;
+  timestamp: number;
+}
+
 export const consentRouter = Router();
 
-// GET /consent?subjectId=xxx
 consentRouter.get('/', async (req, res) => {
-  const { subjectId } = req.query;
-
-  if (!subjectId || typeof subjectId !== 'string') {
-    return res.status(400).json({ error: 'subjectId required' });
-  }
+  const context = await resolveNDPRRequestContext(req);
+  const problem = getNDPRContextProblem(context, 'subject');
+  if (problem) return res.status(problem.status).json({ error: problem.error });
+  const subjectId = context.subjectId as string;
 
+  // {{#if ORM=prisma}}
   const record = await prisma.consentRecord.findFirst({
-    where: { subjectId, revokedAt: null },
+    where: { tenantId: context.tenantId, subjectId, revokedAt: null },
     orderBy: { createdAt: 'desc' },
   });
-
-  return res.json(record);
+  // {{/if}}
+  // {{#if ORM=drizzle}}
+  const [record] = await db.select().from(consentRecords).where(and(
+    eq(consentRecords.tenantId, context.tenantId),
+    eq(consentRecords.subjectId, subjectId),
+    isNull(consentRecords.revokedAt),
+  )).orderBy(desc(consentRecords.createdAt)).limit(1);
+  // {{/if}}
+  // {{#if ORM=none}}
+  const record = [...consentStore.values()]
+    .filter((row) => row.tenantId === context.tenantId && row.subjectId === subjectId && row.revokedAt === null)
+    .sort((a, b) => b.createdAt.getTime() - a.createdAt.getTime())[0] ?? null;
+  // {{/if}}
+  return res.json(record ? toConsentSettings(record) : null);
 });
 
-// POST /consent
 consentRouter.post('/', async (req, res) => {
-  const { subjectId, consents, version, method, lawfulBasis } = req.body;
+  const context = await resolveNDPRRequestContext(req);
+  const problem = getNDPRContextProblem(context, 'subject');
+  if (problem) return res.status(problem.status).json({ error: problem.error });
+  const subjectId = context.subjectId as string;
+  const validationError = validateConsentBody(req.body);
+  if (validationError) return res.status(400).json({ error: validationError });
+  const value = req.body as Omit<ConsentSettings, 'method'> & { method?: string };
+  const input: ConsentSettings = { ...value, method: value.method ?? 'api' };
 
-  if (!subjectId || !consents || !version) {
-    return res.status(400).json({ error: 'subjectId, consents, and version are required' });
-  }
+  const forwarded = req.get('x-forwarded-for');
+  const ipAddress = forwarded?.split(',')[0]?.trim() || req.socket.remoteAddress || null;
+  const userAgent = req.get('user-agent') ?? null;
+  const tenantId = context.tenantId;
+  const clientTimestamp = new Date(input.timestamp);
+  const activeSubjectKey = JSON.stringify([tenantId, subjectId]);
 
-  // Revoke any previously active records (immutable-audit pattern — NDPA §44).
-  await prisma.consentRecord.updateMany({
-    where: { subjectId, revokedAt: null },
-    data: { revokedAt: new Date() },
-  });
+  // {{#if ORM=prisma}}
+  const transactionResult = await prisma.$transaction(async (tx) => {
+    const replay = await tx.consentRecord.findFirst({
+      where: {
+        tenantId,
+        subjectId,
+        clientTimestamp,
+        version: input.version,
+        method: input.method,
+      },
+      orderBy: { createdAt: 'desc' },
+    });
+    if (replay) {
+      return sameConsentMutation(replay, input)
+        ? { kind: 'record' as const, record: replay }
+        : { kind: 'collision' as const };
+    }
 
-  const record = await prisma.consentRecord.create({
-    data: {
-      subjectId,
-      consents,
-      version,
-      method: method ?? 'api',
-      lawfulBasis: lawfulBasis ?? null,
-      ipAddress:
-        (req.headers['x-forwarded-for'] as string)?.split(',')[0].trim() ??
-        req.socket.remoteAddress ??
-        null,
-      userAgent: req.headers['user-agent'] ?? null,
-    },
+    await tx.consentRecord.updateMany({
+      where: { tenantId, subjectId, revokedAt: null },
+      data: { revokedAt: new Date(), activeSubjectKey: null },
+    });
+    const created = await tx.consentRecord.create({ data: {
+      tenantId, subjectId, activeSubjectKey, consents: input.consents,
+      version: input.version, method: input.method,
+      hasInteracted: input.hasInteracted, lawfulBasis: input.lawfulBasis ?? null,
+      ipAddress, userAgent, clientTimestamp,
+    } });
+    await tx.complianceAuditLog.create({ data: {
+      tenantId, module: 'consent', action: 'created', entityId: created.id,
+      entityType: 'ConsentRecord', performedBy: context.actorId,
+      changes: {
+        subjectId, version: input.version, method: input.method,
+        hasInteracted: input.hasInteracted,
+        consentCategories: Object.keys(input.consents),
+      },
+    } });
+    return { kind: 'record' as const, record: created };
+  }, {
+    isolationLevel: Prisma.TransactionIsolationLevel.Serializable,
+  }).catch((error: unknown) => {
+    if (isConcurrencyConflict(error)) return null;
+    throw error;
   });
+  if (!transactionResult) {
+    return res.status(409).json({
+      error: 'Concurrent consent update conflict; retry the same idempotent request.',
+    });
+  }
+  if (transactionResult.kind === 'collision') {
+    return res.status(409).json({
+      error: 'Idempotency collision: timestamp/version/method identify different consent data.',
+    });
+  }
+  const record = transactionResult.record;
+  // {{/if}}
+  // {{#if ORM=drizzle}}
+  const transactionResult = await db.transaction(async (tx) => {
+    const [replay] = await tx.select().from(consentRecords).where(and(
+      eq(consentRecords.tenantId, tenantId),
+      eq(consentRecords.subjectId, subjectId),
+      eq(consentRecords.clientTimestamp, clientTimestamp),
+      eq(consentRecords.version, input.version),
+      eq(consentRecords.method, input.method),
+    )).orderBy(desc(consentRecords.createdAt)).limit(1);
+    if (replay) {
+      return sameConsentMutation(replay, input)
+        ? { kind: 'record' as const, record: replay }
+        : { kind: 'collision' as const };
+    }
 
-  await prisma.complianceAuditLog.create({
-    data: {
-      module: 'consent',
-      action: 'created',
-      entityId: record.id,
-      entityType: 'ConsentRecord',
-      changes: { subjectId, version, consents },
-    },
+    await tx.update(consentRecords).set({
+      revokedAt: new Date(),
+      activeSubjectKey: null,
+    }).where(and(
+      eq(consentRecords.tenantId, tenantId),
+      eq(consentRecords.subjectId, subjectId),
+      isNull(consentRecords.revokedAt),
+    ));
+    const [created] = await tx.insert(consentRecords).values({
+      tenantId, subjectId, activeSubjectKey, consents: input.consents,
+      version: input.version, method: input.method,
+      hasInteracted: input.hasInteracted, lawfulBasis: input.lawfulBasis ?? null,
+      ipAddress, userAgent, clientTimestamp,
+    }).returning();
+    await tx.insert(complianceAuditLog).values({
+      tenantId, module: 'consent', action: 'created', entityId: created.id,
+      entityType: 'ConsentRecord', performedBy: context.actorId,
+      changes: {
+        subjectId, version: input.version, method: input.method,
+        hasInteracted: input.hasInteracted,
+        consentCategories: Object.keys(input.consents),
+      },
+    });
+    return { kind: 'record' as const, record: created };
+  }, { isolationLevel: 'serializable' }).catch((error: unknown) => {
+    if (isConcurrencyConflict(error)) return null;
+    throw error;
   });
-
-  return res.status(201).json(record);
+  if (!transactionResult) {
+    return res.status(409).json({
+      error: 'Concurrent consent update conflict; retry the same idempotent request.',
+    });
+  }
+  if (transactionResult.kind === 'collision') {
+    return res.status(409).json({
+      error: 'Idempotency collision: timestamp/version/method identify different consent data.',
+    });
+  }
+  const record = transactionResult.record;
+  // {{/if}}
+  // {{#if ORM=none}}
+  const replay = [...consentStore.values()].find((row) =>
+    row.tenantId === tenantId
+    && row.subjectId === subjectId
+    && row.clientTimestamp.getTime() === input.timestamp
+    && row.version === input.version
+    && row.method === input.method,
+  );
+  if (replay) {
+    if (!sameConsentMutation(replay, input)) {
+      return res.status(409).json({
+        error: 'Idempotency collision: timestamp/version/method identify different consent data.',
+      });
+    }
+    return res.status(201).json(toConsentSettings(replay));
+  }
+  const now = new Date();
+  for (const row of consentStore.values()) {
+    if (row.tenantId === tenantId && row.subjectId === subjectId && row.revokedAt === null) {
+      row.revokedAt = now;
+      row.activeSubjectKey = null;
+    }
+  }
+  const record: ConsentRow = {
+    id: crypto.randomUUID(), tenantId, subjectId, activeSubjectKey,
+    consents: input.consents, version: input.version, method: input.method,
+    hasInteracted: input.hasInteracted, lawfulBasis: input.lawfulBasis ?? null,
+    ipAddress, userAgent, clientTimestamp, createdAt: now, revokedAt: null,
+  };
+  consentStore.set(record.id, record);
+  auditLog.push({
+    id: crypto.randomUUID(), tenantId, action: 'created', entityId: record.id,
+    performedBy: context.actorId, at: now,
+  });
+  // {{/if}}
+  return res.status(201).json(toConsentSettings(record));
 });
 
-// DELETE /consent?subjectId=xxx
 consentRouter.delete('/', async (req, res) => {
-  const { subjectId } = req.query;
+  const context = await resolveNDPRRequestContext(req);
+  const problem = getNDPRContextProblem(context, 'subject');
+  if (problem) return res.status(problem.status).json({ error: problem.error });
+  const subjectId = context.subjectId as string;
+  const tenantId = context.tenantId;
+  const now = new Date();
 
-  if (!subjectId || typeof subjectId !== 'string') {
-    return res.status(400).json({ error: 'subjectId required' });
+  // {{#if ORM=prisma}}
+  const revoked = await prisma.$transaction(async (tx) => {
+    const result = await tx.consentRecord.updateMany({
+      where: { tenantId, subjectId, revokedAt: null },
+      data: { revokedAt: now, activeSubjectKey: null },
+    });
+    if (result.count > 0) {
+      await tx.complianceAuditLog.create({ data: {
+        tenantId, module: 'consent', action: 'revoked', entityId: subjectId,
+        entityType: 'ConsentRecord', performedBy: context.actorId,
+        changes: { subjectId, revokedRecords: result.count },
+      } });
+    }
+    return result.count;
+  });
+  // {{/if}}
+  // {{#if ORM=drizzle}}
+  const revoked = await db.transaction(async (tx) => {
+    const rows = await tx.update(consentRecords).set({
+      revokedAt: now,
+      activeSubjectKey: null,
+    }).where(and(
+      eq(consentRecords.tenantId, tenantId),
+      eq(consentRecords.subjectId, subjectId),
+      isNull(consentRecords.revokedAt),
+    )).returning({ id: consentRecords.id });
+    if (rows.length > 0) {
+      await tx.insert(complianceAuditLog).values({
+        tenantId, module: 'consent', action: 'revoked', entityId: subjectId,
+        entityType: 'ConsentRecord', performedBy: context.actorId,
+        changes: { subjectId, revokedRecords: rows.length },
+      });
+    }
+    return rows.length;
+  });
+  // {{/if}}
+  // {{#if ORM=none}}
+  let revoked = 0;
+  for (const row of consentStore.values()) {
+    if (row.tenantId === tenantId && row.subjectId === subjectId && row.revokedAt === null) {
+      row.revokedAt = now;
+      row.activeSubjectKey = null;
+      revoked += 1;
+    }
+  }
+  if (revoked > 0) {
+    auditLog.push({
+      id: crypto.randomUUID(), tenantId, action: 'revoked', entityId: subjectId,
+      performedBy: context.actorId, at: now,
+    });
   }
+  // {{/if}}
+  return res.json({ success: true, revoked });
+});
 
-  await prisma.consentRecord.updateMany({
-    where: { subjectId, revokedAt: null },
-    data: { revokedAt: new Date() },
-  });
+function validateConsentBody(body: unknown): string | null {
+  if (!body || typeof body !== 'object') return 'A JSON object is required';
+  const value = body as Record<string, unknown>;
+  if (!value.consents || typeof value.consents !== 'object' || Array.isArray(value.consents)) {
+    return 'consents must be an object';
+  }
+  if (Object.values(value.consents).some((consent) => typeof consent !== 'boolean')) {
+    return 'Every consent value must be boolean';
+  }
+  if (typeof value.version !== 'string' || !value.version.trim()) return 'version is required';
+  if (value.method !== undefined && (typeof value.method !== 'string' || !value.method.trim())) {
+    return 'method must be a non-empty string';
+  }
+  if (value.hasInteracted !== true && value.hasInteracted !== false) {
+    return 'hasInteracted must be boolean';
+  }
+  if (typeof value.timestamp !== 'number' || !Number.isSafeInteger(value.timestamp) || value.timestamp < 0
+      || !Number.isFinite(new Date(value.timestamp).getTime())) {
+    return 'timestamp must be a non-negative safe-integer epoch value within the valid Date range';
+  }
+  if (value.lawfulBasis !== undefined && typeof value.lawfulBasis !== 'string') {
+    return 'lawfulBasis must be a string';
+  }
+  return null;
+}
 
-  await prisma.complianceAuditLog.create({
-    data: {
-      module: 'consent',
-      action: 'revoked',
-      entityId: subjectId,
-      entityType: 'ConsentRecord',
-    },
-  });
+function toConsentSettings(record: {
+  consents: unknown;
+  version: string;
+  method: string;
+  hasInteracted: boolean;
+  lawfulBasis: string | null;
+  clientTimestamp: Date | null;
+  createdAt: Date;
+}): ConsentSettings {
+  return {
+    consents: record.consents as Record<string, boolean>,
+    timestamp: record.clientTimestamp?.getTime() ?? record.createdAt.getTime(),
+    version: record.version,
+    method: record.method,
+    hasInteracted: record.hasInteracted,
+    lawfulBasis: record.lawfulBasis ?? undefined,
+  };
+}
 
-  return res.json({ success: true });
-});
+function sameConsentMutation(
+  record: { consents: unknown; hasInteracted: boolean; lawfulBasis: string | null },
+  input: ConsentSettings,
+): boolean {
+  const storedConsents = record.consents as Record<string, boolean>;
+  return JSON.stringify(sortedConsentEntries(storedConsents))
+      === JSON.stringify(sortedConsentEntries(input.consents))
+    && record.hasInteracted === input.hasInteracted
+    && (record.lawfulBasis ?? undefined) === input.lawfulBasis;
+}
+
+function sortedConsentEntries(consents: Record<string, boolean>) {
+  return Object.entries(consents).sort(([left], [right]) => left.localeCompare(right));
+}
+
+function isConcurrencyConflict(error: unknown): boolean {
+  if (!error || typeof error !== 'object') return false;
+  const candidate = error as { code?: unknown; cause?: unknown };
+  const code = typeof candidate.code === 'string' ? candidate.code : '';
+  if (['P2002', 'P2034', '23505', '40001', '40P01'].includes(code)) return true;
+  return candidate.cause !== error && isConcurrencyConflict(candidate.cause);
+}

package/templates/express-cross-border-route.ts

@@ -0,0 +1,152 @@
+/** Express — staff-only, tenant-scoped cross-border transfer register for {{ORG_NAME_COMMENT}}. */
+import { Router } from 'express';
+import { getNDPRContextProblem, resolveNDPRRequestContext } from '{{NDPR_CONTEXT_IMPORT}}';
+// {{#if ORM=prisma}}
+import { PrismaClient } from '@prisma/client';
+const prisma = new PrismaClient();
+// {{/if}}
+// {{#if ORM=drizzle}}
+import { db } from '{{NDPR_DB_IMPORT}}';
+import { complianceAuditLog, crossBorderTransferRecords } from '{{NDPR_SCHEMA_IMPORT}}';
+import { and, desc, eq, isNull, type SQL } from 'drizzle-orm';
+// {{/if}}
+
+const TRANSFER_MECHANISMS = ['adequacy_decision', 'standard_clauses', 'binding_corporate_rules', 'ndpc_authorization', 'explicit_consent', 'contract_performance', 'public_interest', 'legal_claims', 'vital_interests'] as const;
+const ADEQUACY_STATUSES = ['adequate', 'inadequate', 'pending_review', 'unknown'] as const;
+const RISK_LEVELS = ['low', 'medium', 'high'] as const;
+const TRANSFER_STATUSES = ['active', 'suspended', 'terminated', 'pending_approval'] as const;
+type TransferMechanism = (typeof TRANSFER_MECHANISMS)[number];
+type AdequacyStatus = (typeof ADEQUACY_STATUSES)[number];
+type RiskLevel = (typeof RISK_LEVELS)[number];
+type TransferStatus = (typeof TRANSFER_STATUSES)[number];
+type Validation<T> = { ok: true; value: T } | { ok: false; error: string };
+interface TransferExisting { destinationCountry: string; recipientName: string; transferMechanism: string; safeguards: string; dataCategories: unknown; adequacyStatus: string; ndpcApprovalReference: string | null; status: string }
+interface TransferMutation { destinationCountry: string; recipientName: string; transferMechanism: TransferMechanism; safeguards: string; dataCategories: string[]; adequacyStatus: AdequacyStatus; ndpcApprovalRequired: boolean; ndpcApprovalReference: string | null; riskLevel: RiskLevel; status: TransferStatus; updatedAt: Date }
+
+// {{#if ORM=none}}
+// DEVELOPMENT ONLY: replace both stores with one durable transactional store.
+interface TransferRow extends TransferMutation { id: string; tenantId: string; createdAt: Date; removedAt: Date | null }
+const transferStore = new Map<string, TransferRow>();
+const auditLog: Array<{ id: string; tenantId: string; action: string; entityId: string; performedBy: string; changes?: unknown; at: Date }> = [];
+// {{/if}}
+
+function isRecord(value: unknown): value is Record<string, unknown> { return value !== null && typeof value === 'object' && !Array.isArray(value); }
+function hasOwn(value: Record<string, unknown>, key: string): boolean { return Object.prototype.hasOwnProperty.call(value, key); }
+function rejectUnknownFields(value: Record<string, unknown>, allowed: readonly string[]): string | null { const allowedSet = new Set(allowed); const unknown = Object.keys(value).filter((key) => !allowedSet.has(key)); return unknown.length > 0 ? `Unsupported field(s): ${unknown.join(', ')}` : null; }
+function nonEmptyText(value: unknown, field: string, maxLength = 10_000): Validation<string> { if (typeof value !== 'string' || !value.trim() || value.trim().length > maxLength) return { ok: false, error: `${field} must be non-empty text of at most ${maxLength} characters` }; return { ok: true, value: value.trim() }; }
+function nonEmptyStringArray(value: unknown, field: string): Validation<string[]> {
+  if (!Array.isArray(value) || value.length === 0 || value.length > 100) return { ok: false, error: `${field} must be a non-empty array with at most 100 items` };
+  const result: string[] = []; for (const item of value) { if (typeof item !== 'string' || !item.trim()) return { ok: false, error: `${field} must contain only non-empty strings` }; if (!result.includes(item.trim())) result.push(item.trim()); } return { ok: true, value: result };
+}
+function isMechanism(value: unknown): value is TransferMechanism { return typeof value === 'string' && (TRANSFER_MECHANISMS as readonly string[]).includes(value); }
+function isAdequacyStatus(value: unknown): value is AdequacyStatus { return typeof value === 'string' && (ADEQUACY_STATUSES as readonly string[]).includes(value); }
+function isRiskLevel(value: unknown): value is RiskLevel { return typeof value === 'string' && (RISK_LEVELS as readonly string[]).includes(value); }
+function isTransferStatus(value: unknown): value is TransferStatus { return typeof value === 'string' && (TRANSFER_STATUSES as readonly string[]).includes(value); }
+function approvalRequired(mechanism: TransferMechanism): boolean { return mechanism === 'binding_corporate_rules' || mechanism === 'ndpc_authorization'; }
+function deriveRiskLevel(adequacy: AdequacyStatus, mechanism: TransferMechanism, required: boolean, reference: string | null): RiskLevel {
+  if ((required && !reference) || adequacy === 'inadequate') return 'high';
+  const derogation = ['explicit_consent', 'contract_performance', 'public_interest', 'legal_claims', 'vital_interests'].includes(mechanism);
+  if (adequacy === 'unknown' || adequacy === 'pending_review' || derogation) return 'medium'; return 'low';
+}
+const STATUS_TRANSITIONS: Record<TransferStatus, readonly TransferStatus[]> = { active: ['active', 'suspended', 'terminated', 'pending_approval'], suspended: ['suspended', 'active', 'terminated', 'pending_approval'], pending_approval: ['pending_approval', 'active', 'suspended', 'terminated'], terminated: ['terminated'] };
+function buildTransferMutation(input: Record<string, unknown>, existing?: TransferExisting, now = new Date()): Validation<TransferMutation> {
+  const destination = hasOwn(input, 'destinationCountry') ? nonEmptyText(input.destinationCountry, 'destinationCountry', 200) : existing ? nonEmptyText(existing.destinationCountry, 'stored destinationCountry', 200) : { ok: false as const, error: 'destinationCountry is required' }; if (!destination.ok) return destination;
+  const recipient = hasOwn(input, 'recipientName') ? nonEmptyText(input.recipientName, 'recipientName', 500) : existing ? nonEmptyText(existing.recipientName, 'stored recipientName', 500) : { ok: false as const, error: 'recipientName is required' }; if (!recipient.ok) return recipient;
+  const mechanismValue = hasOwn(input, 'transferMechanism') ? input.transferMechanism : existing?.transferMechanism; if (!isMechanism(mechanismValue)) return { ok: false, error: 'transferMechanism is not supported by the NDPA transfer register' };
+  const safeguards = hasOwn(input, 'safeguards') ? nonEmptyText(input.safeguards, 'safeguards') : existing ? nonEmptyText(existing.safeguards, 'stored safeguards') : { ok: false as const, error: 'safeguards is required' }; if (!safeguards.ok) return safeguards;
+  const categories = nonEmptyStringArray(hasOwn(input, 'dataCategories') ? input.dataCategories : existing?.dataCategories, 'dataCategories'); if (!categories.ok) return categories;
+  const adequacyValue = hasOwn(input, 'adequacyStatus') ? input.adequacyStatus : existing?.adequacyStatus; if (!isAdequacyStatus(adequacyValue)) return { ok: false, error: 'adequacyStatus is not supported' };
+  if (mechanismValue === 'adequacy_decision' && adequacyValue !== 'adequate') return { ok: false, error: 'adequacy_decision can only be used for a destination marked adequate' };
+  let approvalReference: string | null; const referenceValue = hasOwn(input, 'ndpcApprovalReference') ? input.ndpcApprovalReference : existing?.ndpcApprovalReference ?? null;
+  if (referenceValue === null || referenceValue === '') approvalReference = null; else { const reference = nonEmptyText(referenceValue, 'ndpcApprovalReference', 500); if (!reference.ok) return reference; approvalReference = reference.value; }
+  const required = approvalRequired(mechanismValue); if (!required && approvalReference) return { ok: false, error: 'ndpcApprovalReference is only accepted for a mechanism that requires NDPC approval' };
+  const explicitStatus = hasOwn(input, 'status'); if (explicitStatus && !isTransferStatus(input.status)) return { ok: false, error: 'status is not supported' };
+  let status: TransferStatus;
+  if (isTransferStatus(input.status)) status = input.status; else if (required && !approvalReference) status = 'pending_approval'; else if (existing && isTransferStatus(existing.status) && existing.status !== 'pending_approval') status = existing.status; else status = 'active';
+  if (required && !approvalReference && status === 'active') return { ok: false, error: 'An approval-dependent transfer cannot be active without an NDPC approval reference' };
+  if (!required && status === 'pending_approval') return { ok: false, error: 'pending_approval is only valid when the selected mechanism requires NDPC approval' };
+  if (approvalReference && status === 'pending_approval') return { ok: false, error: 'A transfer with an NDPC approval reference cannot remain pending_approval' };
+  if (existing) { if (!isTransferStatus(existing.status)) return { ok: false, error: 'Stored transfer status is invalid' }; if (!STATUS_TRANSITIONS[existing.status].includes(status)) return { ok: false, error: `Transfer status cannot transition from ${existing.status} to ${status}` }; if (existing.status === 'terminated' && ['destinationCountry', 'recipientName', 'transferMechanism', 'safeguards', 'dataCategories', 'adequacyStatus', 'ndpcApprovalReference'].some((field) => hasOwn(input, field))) return { ok: false, error: 'A terminated transfer cannot have its compliance evidence changed' }; }
+  return { ok: true, value: { destinationCountry: destination.value, recipientName: recipient.value, transferMechanism: mechanismValue, safeguards: safeguards.value, dataCategories: categories.value, adequacyStatus: adequacyValue, ndpcApprovalRequired: required, ndpcApprovalReference: approvalReference, riskLevel: deriveRiskLevel(adequacyValue, mechanismValue, required, approvalReference), status, updatedAt: now } };
+}
+function auditChanges(data: TransferMutation) { return { destinationCountry: data.destinationCountry, recipientName: data.recipientName, transferMechanism: data.transferMechanism, adequacyStatus: data.adequacyStatus, ndpcApprovalRequired: data.ndpcApprovalRequired, riskLevel: data.riskLevel, status: data.status }; }
+
+export const crossBorderRouter = Router();
+
+crossBorderRouter.get('/', async (req, res) => {
+  const context = await resolveNDPRRequestContext(req); const problem = getNDPRContextProblem(context, 'staff'); if (problem) return res.status(problem.status).json({ error: problem.error });
+  const riskLevel = typeof req.query.riskLevel === 'string' ? req.query.riskLevel : undefined; const status = typeof req.query.status === 'string' ? req.query.status : undefined; const destinationCountry = typeof req.query.destinationCountry === 'string' ? req.query.destinationCountry.trim() : undefined;
+  if (riskLevel !== undefined && !isRiskLevel(riskLevel)) return res.status(400).json({ error: 'riskLevel filter is not supported' }); if (status !== undefined && !isTransferStatus(status)) return res.status(400).json({ error: 'status filter is not supported' }); if (typeof req.query.destinationCountry === 'string' && !destinationCountry) return res.status(400).json({ error: 'destinationCountry filter cannot be empty' });
+  // {{#if ORM=prisma}}
+  const records = await prisma.crossBorderTransferRecord.findMany({ where: { tenantId: context.tenantId, removedAt: null, ...(riskLevel ? { riskLevel } : {}), ...(status ? { status } : {}), ...(destinationCountry ? { destinationCountry } : {}) }, orderBy: { createdAt: 'desc' } });
+  // {{/if}}
+  // {{#if ORM=drizzle}}
+  const filters: SQL[] = [eq(crossBorderTransferRecords.tenantId, context.tenantId), isNull(crossBorderTransferRecords.removedAt)]; if (riskLevel) filters.push(eq(crossBorderTransferRecords.riskLevel, riskLevel)); if (status) filters.push(eq(crossBorderTransferRecords.status, status)); if (destinationCountry) filters.push(eq(crossBorderTransferRecords.destinationCountry, destinationCountry)); const records = await db.select().from(crossBorderTransferRecords).where(and(...filters)).orderBy(desc(crossBorderTransferRecords.createdAt));
+  // {{/if}}
+  // {{#if ORM=none}}
+  const records = [...transferStore.values()].filter((row) => row.tenantId === context.tenantId && row.removedAt === null && (!riskLevel || row.riskLevel === riskLevel) && (!status || row.status === status) && (!destinationCountry || row.destinationCountry === destinationCountry)).sort((a, b) => b.createdAt.getTime() - a.createdAt.getTime());
+  // {{/if}}
+  return res.json(records);
+});
+
+crossBorderRouter.get('/:id', async (req, res) => {
+  const context = await resolveNDPRRequestContext(req); const problem = getNDPRContextProblem(context, 'staff'); if (problem) return res.status(problem.status).json({ error: problem.error });
+  // {{#if ORM=prisma}}
+  const record = await prisma.crossBorderTransferRecord.findFirst({ where: { id: req.params.id, tenantId: context.tenantId, removedAt: null } });
+  // {{/if}}
+  // {{#if ORM=drizzle}}
+  const [record] = await db.select().from(crossBorderTransferRecords).where(and(eq(crossBorderTransferRecords.id, req.params.id), eq(crossBorderTransferRecords.tenantId, context.tenantId), isNull(crossBorderTransferRecords.removedAt))).limit(1);
+  // {{/if}}
+  // {{#if ORM=none}}
+  const candidate = transferStore.get(req.params.id); const record = candidate?.tenantId === context.tenantId && candidate.removedAt === null ? candidate : null;
+  // {{/if}}
+  return record ? res.json(record) : res.status(404).json({ error: 'Transfer record not found' });
+});
+
+crossBorderRouter.post('/', async (req, res) => {
+  const context = await resolveNDPRRequestContext(req); const problem = getNDPRContextProblem(context, 'staff'); if (problem) return res.status(problem.status).json({ error: problem.error }); const actorId = context.actorId as string;
+  if (!isRecord(req.body)) return res.status(400).json({ error: 'A JSON object is required' });
+  const unknown = rejectUnknownFields(req.body, ['destinationCountry', 'recipientName', 'transferMechanism', 'safeguards', 'dataCategories', 'adequacyStatus', 'ndpcApprovalReference', 'status']); if (unknown) return res.status(400).json({ error: unknown });
+  const normalized = buildTransferMutation(req.body); if (!normalized.ok) return res.status(400).json({ error: normalized.error }); const data = normalized.value;
+  // {{#if ORM=prisma}}
+  const record = await prisma.$transaction(async (tx) => { const created = await tx.crossBorderTransferRecord.create({ data: { ...data, tenantId: context.tenantId, removedAt: null } }); await tx.complianceAuditLog.create({ data: { tenantId: context.tenantId, module: 'cross-border', action: 'created', entityId: created.id, entityType: 'CrossBorderTransferRecord', performedBy: actorId, changes: auditChanges(data) } }); return created; });
+  // {{/if}}
+  // {{#if ORM=drizzle}}
+  const record = await db.transaction(async (tx) => { const [created] = await tx.insert(crossBorderTransferRecords).values({ ...data, tenantId: context.tenantId, removedAt: null }).returning(); await tx.insert(complianceAuditLog).values({ tenantId: context.tenantId, module: 'cross-border', action: 'created', entityId: created.id, entityType: 'CrossBorderTransferRecord', performedBy: actorId, changes: auditChanges(data) }); return created; });
+  // {{/if}}
+  // {{#if ORM=none}}
+  const record: TransferRow = { id: crypto.randomUUID(), ...data, tenantId: context.tenantId, createdAt: data.updatedAt, removedAt: null }; transferStore.set(record.id, record); auditLog.push({ id: crypto.randomUUID(), tenantId: context.tenantId, action: 'created', entityId: record.id, performedBy: actorId, changes: auditChanges(data), at: data.updatedAt });
+  // {{/if}}
+  return res.status(201).json(record);
+});
+
+crossBorderRouter.put('/:id', async (req, res) => {
+  const context = await resolveNDPRRequestContext(req); const problem = getNDPRContextProblem(context, 'staff'); if (problem) return res.status(problem.status).json({ error: problem.error }); const actorId = context.actorId as string;
+  if (!isRecord(req.body)) return res.status(400).json({ error: 'A JSON object is required' });
+  const fields = ['destinationCountry', 'recipientName', 'transferMechanism', 'safeguards', 'dataCategories', 'adequacyStatus', 'ndpcApprovalReference', 'status'] as const; const unknown = rejectUnknownFields(req.body, fields); if (unknown) return res.status(400).json({ error: unknown }); if (!fields.some((field) => hasOwn(req.body, field))) return res.status(400).json({ error: 'Provide at least one allowlisted transfer field to update' });
+  const id = req.params.id; let validationError: string | null = null;
+  // {{#if ORM=prisma}}
+  const record = await prisma.$transaction(async (tx) => { const existing = await tx.crossBorderTransferRecord.findFirst({ where: { id, tenantId: context.tenantId, removedAt: null } }); if (!existing) return null; const normalized = buildTransferMutation(req.body, existing); if (!normalized.ok) { validationError = normalized.error; return null; } const data = normalized.value; await tx.crossBorderTransferRecord.updateMany({ where: { id, tenantId: context.tenantId, removedAt: null }, data }); const updated = await tx.crossBorderTransferRecord.findFirstOrThrow({ where: { id, tenantId: context.tenantId, removedAt: null } }); await tx.complianceAuditLog.create({ data: { tenantId: context.tenantId, module: 'cross-border', action: 'updated', entityId: id, entityType: 'CrossBorderTransferRecord', performedBy: actorId, changes: auditChanges(data) } }); return updated; });
+  // {{/if}}
+  // {{#if ORM=drizzle}}
+  const record = await db.transaction(async (tx) => { const [existing] = await tx.select().from(crossBorderTransferRecords).where(and(eq(crossBorderTransferRecords.id, id), eq(crossBorderTransferRecords.tenantId, context.tenantId), isNull(crossBorderTransferRecords.removedAt))).limit(1); if (!existing) return null; const normalized = buildTransferMutation(req.body, existing); if (!normalized.ok) { validationError = normalized.error; return null; } const data = normalized.value; const [updated] = await tx.update(crossBorderTransferRecords).set(data).where(and(eq(crossBorderTransferRecords.id, id), eq(crossBorderTransferRecords.tenantId, context.tenantId), isNull(crossBorderTransferRecords.removedAt))).returning(); await tx.insert(complianceAuditLog).values({ tenantId: context.tenantId, module: 'cross-border', action: 'updated', entityId: id, entityType: 'CrossBorderTransferRecord', performedBy: actorId, changes: auditChanges(data) }); return updated; });
+  // {{/if}}
+  // {{#if ORM=none}}
+  const existing = transferStore.get(id); let record: TransferRow | null = null; if (existing?.tenantId === context.tenantId && existing.removedAt === null) { const normalized = buildTransferMutation(req.body, existing); if (!normalized.ok) validationError = normalized.error; else { record = { ...existing, ...normalized.value, id }; transferStore.set(id, record); auditLog.push({ id: crypto.randomUUID(), tenantId: context.tenantId, action: 'updated', entityId: id, performedBy: actorId, changes: auditChanges(normalized.value), at: normalized.value.updatedAt }); } }
+  // {{/if}}
+  if (validationError) return res.status(400).json({ error: validationError }); return record ? res.json(record) : res.status(404).json({ error: 'Transfer record not found' });
+});
+
+crossBorderRouter.delete('/:id', async (req, res) => {
+  const context = await resolveNDPRRequestContext(req); const problem = getNDPRContextProblem(context, 'staff'); if (problem) return res.status(problem.status).json({ error: problem.error }); const actorId = context.actorId as string; const id = req.params.id; const archivedAt = new Date();
+  // {{#if ORM=prisma}}
+  const archived = await prisma.$transaction(async (tx) => { const existing = await tx.crossBorderTransferRecord.findFirst({ where: { id, tenantId: context.tenantId, removedAt: null } }); if (!existing) return false; const result = await tx.crossBorderTransferRecord.updateMany({ where: { id, tenantId: context.tenantId, removedAt: null }, data: { removedAt: archivedAt, updatedAt: archivedAt } }); if (result.count !== 1) return false; await tx.complianceAuditLog.create({ data: { tenantId: context.tenantId, module: 'cross-border', action: 'archived', entityId: id, entityType: 'CrossBorderTransferRecord', performedBy: actorId, changes: { destinationCountry: existing.destinationCountry, recipientName: existing.recipientName, removedAt: archivedAt.toISOString() } } }); return true; });
+  // {{/if}}
+  // {{#if ORM=drizzle}}
+  const archived = await db.transaction(async (tx) => { const [existing] = await tx.select().from(crossBorderTransferRecords).where(and(eq(crossBorderTransferRecords.id, id), eq(crossBorderTransferRecords.tenantId, context.tenantId), isNull(crossBorderTransferRecords.removedAt))).limit(1); if (!existing) return false; const [updated] = await tx.update(crossBorderTransferRecords).set({ removedAt: archivedAt, updatedAt: archivedAt }).where(and(eq(crossBorderTransferRecords.id, id), eq(crossBorderTransferRecords.tenantId, context.tenantId), isNull(crossBorderTransferRecords.removedAt))).returning(); if (!updated) return false; await tx.insert(complianceAuditLog).values({ tenantId: context.tenantId, module: 'cross-border', action: 'archived', entityId: id, entityType: 'CrossBorderTransferRecord', performedBy: actorId, changes: { destinationCountry: existing.destinationCountry, recipientName: existing.recipientName, removedAt: archivedAt.toISOString() } }); return true; });
+  // {{/if}}
+  // {{#if ORM=none}}
+  const existing = transferStore.get(id); const archived = existing?.tenantId === context.tenantId && existing.removedAt === null; if (archived && existing) { transferStore.set(id, { ...existing, removedAt: archivedAt, updatedAt: archivedAt }); auditLog.push({ id: crypto.randomUUID(), tenantId: context.tenantId, action: 'archived', entityId: id, performedBy: actorId, changes: { destinationCountry: existing.destinationCountry, recipientName: existing.recipientName, removedAt: archivedAt.toISOString() }, at: archivedAt }); }
+  // {{/if}}
+  return archived ? res.json({ success: true, archived: true }) : res.status(404).json({ error: 'Transfer record not found' });
+});