feat: WhatsApp notifications — new incident alert and CAPA overdue escalation

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FFDuBhMKvoWjrWT3ZnGmmr

app/api/incidents/route.ts

@@ -3,6 +3,8 @@ import { createClient } from '@/lib/supabase/server'
 import { validateIncidentInput, type IncidentType, type MedicalStatus } from '@/lib/incidents/validate'
 import { uploadEvidenceFile, type EvidenceStage } from '@/lib/supabase/storage'
 import { sendNewIncidentEmail } from '@/lib/notifications/email'
+import { sendWhatsAppMessage } from '@/lib/notifications/whatsapp'
+import { getApiKey } from '@/lib/settings'
 
 export const dynamic = 'force-dynamic'
 
@@ -109,6 +111,35 @@ export async function POST(request: Request) {
   sendNewIncidentEmail(incident.id, zone.site_id, incident.reference_no ?? '', input.incident_type)
     .catch(err => console.error('email notification failed:', err))
 
+  // WhatsApp alert — fire-and-forget alongside email
+  ;(async () => {
+    try {
+      const phoneNumberId = await getApiKey(supabase, 'META_WHATSAPP_PHONE_NUMBER_ID')
+      const accessToken = await getApiKey(supabase, 'META_WHATSAPP_ACCESS_TOKEN')
+      const { data: siteData } = await supabase
+        .from('sites').select('name').eq('id', zone.site_id).single()
+      const siteName = (siteData as { name: string } | null)?.name ?? 'Unknown'
+      const { data: recipients } = await supabase
+        .from('users')
+        .select('phone')
+        .in('role', ['supervisor', 'hse'])
+        .eq('site_id', zone.site_id)
+      for (const r of recipients ?? []) {
+        const phone = (r as { phone: string | null }).phone ?? ''
+        if (!phone) continue
+        await sendWhatsAppMessage(
+          phone,
+          'ims_incident_alert',
+          [incident.reference_no ?? '', input.incident_type, siteName],
+          phoneNumberId,
+          accessToken,
+        )
+      }
+    } catch (err) {
+      console.error('WhatsApp incident alert error:', err)
+    }
+  })()
+
   // Embed description asynchronously for future similarity search
   const supabaseForEmbed = supabase
   import('@/lib/settings').then(({ getApiKey }) =>