feat(config): phase 7 — drop /ims basePath, update all hardcoded paths, refresh env spec

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.env.local.example

@@ -1,14 +1,23 @@
-# .env.local.example
+# Database (plain PostgreSQL — no Supabase)
-NEXT_PUBLIC_SUPABASE_URL=https://your-project-ref.supabase.co
+DATABASE_URL=postgres://app_user:<password>@127.0.0.1:5432/ims
-NEXT_PUBLIC_SUPABASE_ANON_KEY=your-anon-key-here
+DATABASE_URL_ADMIN=postgres://app_admin:<password>@127.0.0.1:5432/ims
-NEXT_PUBLIC_APP_URL=http://localhost:3000
+
+# Auth (custom JWT)
+JWT_SECRET=<generate with: openssl rand -hex 32>
+
+# App
+APP_URL=http://localhost:3000
 NEXT_PUBLIC_SITE_URL=http://localhost:3000
 CRON_SECRET=<generate with: openssl rand -hex 32>
 
-# Server-side only — never expose to the client
+# Evidence storage (local filesystem)
-SUPABASE_SERVICE_ROLE_KEY=<required for admin user invites (/admin)>
+EVIDENCE_DIR=/tmp/ims-evidence
-RESEND_API_KEY=re_...
+EVIDENCE_URL_SECRET=<generate with: openssl rand -hex 32>
-RESEND_FROM_EMAIL=alerts@yourdomain.com
+
+# Email (Brevo)
+BREVO_API_KEY=<your-brevo-api-key>
+BREVO_FROM_EMAIL=noreply@setia.com.my
+BREVO_FROM_NAME=Setia IMS
 
 # AI keys — optional here; preferred location is the app_settings table (/hse/settings)
 ANTHROPIC_API_KEY=sk-ant-...

app/(protected)/hse/dashboard/page.tsx

@@ -164,13 +164,13 @@ export default async function HseDashboardPage({
         <h1 className="text-2xl font-bold text-gray-900">Dashboard</h1>
         <div className="flex gap-3">
           <a
-            href="/ims/api/dashboard/export?role=hse"
+            href="/api/dashboard/export?role=hse"
             className="text-sm text-gray-500 hover:text-gray-700 border border-gray-200 rounded-lg px-3 py-1.5"
           >
             Export CSV
           </a>
           <a
-            href={`/ims/api/reports/jkkp8?year=${now.getFullYear()}`}
+            href={`/api/reports/jkkp8?year=${now.getFullYear()}`}
             className="text-sm text-gray-500 hover:text-gray-700 border border-gray-200 rounded-lg px-3 py-1.5"
           >
             JKKP 8
@@ -191,7 +191,7 @@ export default async function HseDashboardPage({
               <p className="text-sm text-amber-800">
                 <strong>JKKP 8 annual register due:</strong> the {now.getFullYear() - 1} register must be
                 submitted to DOSH before 31 January {now.getFullYear()}.{' '}
-                <a href={`/ims/api/reports/jkkp8?year=${now.getFullYear() - 1}`} className="underline font-medium">
+                <a href={`/api/reports/jkkp8?year=${now.getFullYear() - 1}`} className="underline font-medium">
                   Download {now.getFullYear() - 1} register
                 </a>
               </p>

app/(protected)/hse/incidents/[id]/page.tsx

@@ -173,14 +173,14 @@ export default async function HseIncidentDetailPage({ params }: Props) {
         {needsJkkp && (
           <div className="mt-4 flex gap-3 flex-wrap">
             <a
-              href={`/ims/api/incidents/${id}/jkkp-pdf?form=jkkp6`}
+              href={`/api/incidents/${id}/jkkp-pdf?form=jkkp6`}
               target="_blank"
               className="inline-block bg-gray-800 text-white rounded-lg px-4 py-2 text-sm font-semibold hover:bg-gray-900"
             >
               Download JKKP 6 (PDF)
             </a>
             <a
-              href={`/ims/api/incidents/${id}/jkkp-pdf?form=jkkp7`}
+              href={`/api/incidents/${id}/jkkp-pdf?form=jkkp7`}
               target="_blank"
               className="inline-block bg-gray-600 text-white rounded-lg px-4 py-2 text-sm font-semibold hover:bg-gray-700"
             >

app/(protected)/management/page.tsx

@@ -92,7 +92,7 @@ export default async function ManagementPage() {
       <div className="flex items-center justify-between mb-6">
         <h1 className="text-2xl font-bold text-gray-900">Management Dashboard</h1>
         <a
-          href="/ims/api/dashboard/export?role=management"
+          href="/api/dashboard/export?role=management"
           className="text-sm text-gray-500 hover:text-gray-700 border border-gray-200 rounded-lg px-3 py-1.5"
         >
           Export CSV

app/layout.tsx

@@ -33,7 +33,7 @@ export default async function RootLayout({
       className={`${geistSans.variable} ${geistMono.variable} h-full antialiased`}
     >
       <head>
-        <link rel="manifest" href="/ims/manifest.json" />
+        <link rel="manifest" href="/manifest.json" />
       </head>
       <body className="min-h-full flex flex-col">
         <I18nProvider messages={messages}>
@@ -41,7 +41,7 @@ export default async function RootLayout({
         </I18nProvider>
         <script
           dangerouslySetInnerHTML={{
-            __html: `if('serviceWorker'in navigator){navigator.serviceWorker.register('/ims/sw.js',{scope:'/ims/'}).catch(console.error)}`,
+            __html: `if('serviceWorker'in navigator){navigator.serviceWorker.register('/sw.js',{scope:'/'}).catch(console.error)}`,
           }}
         />
       </body>

components/admin/site-zone-manager.tsx

@@ -153,7 +153,7 @@ export function SiteZoneManager({ sites }: Props) {
                     <span>{z.name}</span>
                     <div className="flex items-center gap-3">
                       <a
-                        href={`/ims/report?zone=${z.qr_code_token}`}
+                        href={`/report?zone=${z.qr_code_token}`}
                         target="_blank"
                         className="text-xs text-blue-600 hover:underline"
                       >

components/admin/truck-manager.tsx

@@ -127,7 +127,7 @@ export function TruckManager({ trucks }: Props) {
                 </div>
                 <div className="flex items-center gap-3">
                   <a
-                    href={`/ims/report?truck_id=${tk.id}`}
+                    href={`/report?truck_id=${tk.id}`}
                     target="_blank"
                     className="text-xs text-blue-600 hover:underline"
                   >

components/admin/user-manager.tsx

@@ -51,7 +51,7 @@ export function UserManager({ users, sites }: Props) {
   const deleteUser = async (id: string) => {
     setBusyId(id)
     setError(null)
-    const res = await fetch(`/ims/api/admin/users?id=${encodeURIComponent(id)}`, { method: 'DELETE' })
+    const res = await fetch(`/api/admin/users?id=${encodeURIComponent(id)}`, { method: 'DELETE' })
     setBusyId(null)
     setConfirmDeleteId(null)
     if (!res.ok) {

components/capa/capa-owner-actions.tsx

@@ -15,7 +15,7 @@ export function CapaOwnerActions({ capaId, currentStatus }: Props) {
   async function updateStatus(status: string) {
     setLoading(true)
     try {
-      const res = await fetch(`/ims/api/capa/${capaId}`, {
+      const res = await fetch(`/api/capa/${capaId}`, {
         method: 'PATCH',
         headers: { 'Content-Type': 'application/json' },
         body: JSON.stringify({ status }),

components/capa/capa-owner-notes-form.tsx

@@ -17,7 +17,7 @@ export function CapaOwnerNotesForm({ capaId, initialNotes }: Props) {
     setSaving(true)
     setSaved(false)
     setError(null)
-    const res = await fetch(`/ims/api/capa/${capaId}`, {
+    const res = await fetch(`/api/capa/${capaId}`, {
       method: 'PATCH',
       headers: { 'Content-Type': 'application/json' },
       body: JSON.stringify({ owner_notes: notes }),

components/capa/close-capa-button.tsx

@@ -16,7 +16,7 @@ export function CloseCapaButton({ capaId }: Props) {
     if (!confirm('Close this CAPA? This marks it as fully resolved.')) return
     setLoading(true)
     setError(null)
-    const res = await fetch(`/ims/api/capa/${capaId}`, {
+    const res = await fetch(`/api/capa/${capaId}`, {
       method: 'PATCH',
       headers: { 'Content-Type': 'application/json' },
       body: JSON.stringify({ status: 'closed' }),

components/capa/verify-form.tsx

@@ -23,7 +23,7 @@ export function VerifyForm({ capaId }: Props) {
     }
     setSaving(true)
     setError(null)
-    const res = await fetch(`/ims/api/capa/${capaId}/verify`, {
+    const res = await fetch(`/api/capa/${capaId}/verify`, {
       method: 'POST',
       headers: { 'Content-Type': 'application/json' },
       body: JSON.stringify({ verdict, reopen_reason: reopenReason || null }),

components/incidents/closure-panel.tsx

@@ -28,7 +28,7 @@ export function ClosurePanel({ incidentId, status, canClose, canAddAddenda }: Pr
 
   useEffect(() => {
     if (!isClosed) return
-    fetch(`/ims/api/incidents/${incidentId}/addenda`)
+    fetch(`/api/incidents/${incidentId}/addenda`)
       .then(r => (r.ok ? r.json() : Promise.reject()))
       .then((data: Addendum[]) => setAddenda(Array.isArray(data) ? data : []))
       .catch(() => {})
@@ -38,7 +38,7 @@ export function ClosurePanel({ incidentId, status, canClose, canAddAddenda }: Pr
     if (!confirm('Close this incident? The record will be locked — only addenda can be added afterwards.')) return
     setBusy(true)
     setError(null)
-    const res = await fetch(`/ims/api/incidents/${incidentId}/close`, { method: 'POST' })
+    const res = await fetch(`/api/incidents/${incidentId}/close`, { method: 'POST' })
     setBusy(false)
     if (!res.ok) {
       const data = await res.json().catch(() => ({}))
@@ -53,7 +53,7 @@ export function ClosurePanel({ incidentId, status, canClose, canAddAddenda }: Pr
     if (!text) return
     setBusy(true)
     setError(null)
-    const res = await fetch(`/ims/api/incidents/${incidentId}/addenda`, {
+    const res = await fetch(`/api/incidents/${incidentId}/addenda`, {
       method: 'POST',
       headers: { 'Content-Type': 'application/json' },
       body: JSON.stringify({ body: text }),
@@ -65,7 +65,7 @@ export function ClosurePanel({ incidentId, status, canClose, canAddAddenda }: Pr
       return
     }
     setDraft('')
-    const list = await fetch(`/ims/api/incidents/${incidentId}/addenda`).then(r => r.json()).catch(() => [])
+    const list = await fetch(`/api/incidents/${incidentId}/addenda`).then(r => r.json()).catch(() => [])
     setAddenda(Array.isArray(list) ? list : [])
   }
 

components/incidents/investigation-form.tsx

@@ -64,7 +64,7 @@ export function InvestigationForm({ incidentId, existingInvestigationId }: Props
   async function getAiDraft() {
     setAiDraftLoading(true)
     try {
-      const res = await fetch(`/ims/api/incidents/${incidentId}/ai/rca-draft`, { method: 'POST' })
+      const res = await fetch(`/api/incidents/${incidentId}/ai/rca-draft`, { method: 'POST' })
       if (!res.ok) return
       const draft = await res.json() as {
         five_why_steps: Array<{ why: string; answer: string }>
@@ -106,13 +106,13 @@ export function InvestigationForm({ incidentId, existingInvestigationId }: Props
 
     let res: Response
     if (existingInvestigationId) {
-      res = await fetch(`/ims/api/incidents/${incidentId}/investigation`, {
+      res = await fetch(`/api/incidents/${incidentId}/investigation`, {
         method: 'PATCH',
         headers: { 'Content-Type': 'application/json' },
         body: JSON.stringify({ ...payload, investigation_id: existingInvestigationId, complete }),
       })
     } else {
-      res = await fetch(`/ims/api/incidents/${incidentId}/investigation`, {
+      res = await fetch(`/api/incidents/${incidentId}/investigation`, {
         method: 'POST',
         headers: { 'Content-Type': 'application/json' },
         body: JSON.stringify(payload),

components/incidents/similar-incidents-panel.tsx

@@ -31,7 +31,7 @@ export function SimilarIncidentsPanel({ incidentId }: Props) {
   const [error, setError] = useState(false)
 
   useEffect(() => {
-    fetch(`/ims/api/incidents/${incidentId}/similar`)
+    fetch(`/api/incidents/${incidentId}/similar`)
       .then(r => {
         if (!r.ok) throw new Error('failed')
         return r.json()

components/incidents/triage-form.tsx

@@ -42,7 +42,7 @@ export function TriageForm({ incidentId, currentSeverity }: Props) {
     setAiLoading(true)
     setAiRationale(null)
     try {
-      const res = await fetch(`/ims/api/incidents/${incidentId}/ai/triage-suggest`, { method: 'POST' })
+      const res = await fetch(`/api/incidents/${incidentId}/ai/triage-suggest`, { method: 'POST' })
       if (!res.ok) return
       const data = await res.json() as {
         severity: number
@@ -69,7 +69,7 @@ export function TriageForm({ incidentId, currentSeverity }: Props) {
     e.preventDefault()
     setSaving(true)
     setError(null)
-    const res = await fetch(`/ims/api/incidents/${incidentId}/triage`, {
+    const res = await fetch(`/api/incidents/${incidentId}/triage`, {
       method: 'PATCH',
       headers: { 'Content-Type': 'application/json' },
       body: JSON.stringify({

next.config.js

@@ -1,7 +1,6 @@
 /** @type {import('next').NextConfig} */
 const nextConfig = {
   output: 'standalone',
-  basePath: '/ims',
 }
 
 module.exports = nextConfig

public/manifest.json

@@ -2,14 +2,14 @@
   "name": "IMS — Incident Management",
   "short_name": "IMS",
   "description": "HSE Incident Management System — Setia Corporation",
-  "start_url": "/ims/report",
+  "start_url": "/report",
-  "scope": "/ims/",
+  "scope": "/",
   "display": "standalone",
   "background_color": "#ffffff",
   "theme_color": "#2563eb",
   "icons": [
     {
-      "src": "/ims/icons/icon.svg",
+      "src": "/icons/icon.svg",
       "sizes": "any",
       "type": "image/svg+xml",
       "purpose": "any maskable"