# IMS — Claude Code Instructions

## Project
HSE Incident Management System for Setia Corporation (3PL warehouse).
Replaces WhatsApp/Excel safety reporting. Client: Ms. Agnes, Mr. Terence, Mr. Yap, Mr. Jensen.

## Stack
- **Frontend + API routes:** Next.js (App Router)
- **DB + Auth + Storage:** Supabase (Postgres + RLS + pgvector)
- **Hosting:** VPS at `http://64.176.82.100/ims/` + Supabase cloud
- **AI:** Claude API — server-side only, never client-side
- **Email:** Resend
- **WhatsApp:** Meta WhatsApp Business Cloud API
- **PDF:** pdf-lib (JKKP form fill)
- **QR:** qrcode npm package

## Current Phase
**All phases (0–6) complete as of 2026-07-12.** Remaining work is ops: production env vars (`SUPABASE_SERVICE_ROLE_KEY`, Meta WhatsApp, Resend, `CRON_SECRET`), VPS cron registration (`docs/vps-cron.md`), optional Supabase Pro for image thumbnails.
See `[[phases]]` memory for full phase breakdown and deliverables.

## Dev Conventions
- Never commit `.env` or API keys. All secrets in env vars only.
- RLS enforced at DB level for every table — never rely on UI-only hiding.
- Claude API calls: server-side API routes only (`/app/api/...`).
- Incident reference format: `SITE-YYYYMM-####`
- Every DB mutation writes to `audit_log` (table, record_id, action, changed_by, changed_at, old/new value).
- Evidence files: never hard-delete; retain minimum 5 years (DOSH JKKP 8 requirement).
- AI suggestions logged to `audit_log` — capture what Claude suggested + what human chose.

## File Structure (target)
```
IMS/
├── docs/                    # PRD, tech spec, roadmap, specs — source of truth
├── app/                     # Next.js App Router pages + API routes
├── components/              # Shared UI components
├── lib/
│   ├── supabase/            # Supabase client + server helpers
│   ├── claude/              # Claude API wrappers (server-side)
│   └── notifications/       # Resend + WhatsApp senders
├── supabase/
│   └── migrations/          # SQL migration files
└── public/
```

## Deep Context (memory files — load instead of re-reading raw docs)
- `[[project_overview]]` — objectives, roles, success metrics
- `[[architecture]]` — module diagram, stack rationale, deployment
- `[[db_schema]]` — all 10 tables, fields, RLS, pgvector
- `[[phases]]` — 4 phases + deliverables, current phase
- `[[compliance]]` — NADOPOD 2004, JKKP 6/7/8 rules

## graphify
When graphify-out/graph.json exists:
- Run `graphify query "<question>"` before browsing source.
- Use `graphify path "<A>" "<B>"` for relationships.
- Use `graphify explain "<concept>"` for focused concepts.
- After code changes: `graphify update .`