feat: implement incident reporting and management system

- Add incident reporting routes and logic to handle creation, updating, and retrieval of incidents.
- Implement visibility rules for users based on roles (reporters, supervisors).
- Create tests for incident reporting functionality to ensure correctness and reliability.
- Introduce site and area management routes, including validation for area hierarchy.
- Establish user management routes with role-based access control for creating and updating users.
- Add setup routes for initializing the application with an organization and admin user.
- Implement shared enums and schemas for consistent validation and data handling across the application.
- Create a test helper for setting up an in-memory database and API client for testing.
- Add TypeScript configuration for server-side code with strict type checking and module resolution.

shared/enums.ts

@@ -0,0 +1,35 @@
+// Domain vocabularies shared by the server (database enums, validation) and the web app.
+
+/** Ordered from least to most privileged. */
+export const roles = ['reporter', 'supervisor', 'safety_manager', 'admin'] as const
+export type Role = (typeof roles)[number]
+
+export function hasRole(role: Role, minimum: Role): boolean {
+  return roles.indexOf(role) >= roles.indexOf(minimum)
+}
+
+export const incidentTypes = ['near_miss', 'hazard', 'injury', 'illness', 'property_damage', 'environmental'] as const
+export type IncidentType = (typeof incidentTypes)[number]
+
+export const severities = ['low', 'medium', 'high', 'critical'] as const
+export type Severity = (typeof severities)[number]
+
+/** Workflow: Reported → Triage → Investigation → Corrective actions → Verification → Closed. */
+export const incidentStatuses = ['reported', 'triage', 'investigation', 'actions', 'verification', 'closed'] as const
+export type IncidentStatus = (typeof incidentStatuses)[number]
+
+export const areaKinds = ['building', 'area', 'line', 'other'] as const
+export type AreaKind = (typeof areaKinds)[number]
+
+export const employmentTypes = ['employee', 'temporary', 'contractor', 'visitor'] as const
+
+export const treatmentLevels = ['none', 'first_aid', 'medical_treatment', 'hospitalized', 'fatality'] as const
+
+export const rcaMethods = ['five_whys', 'fishbone', 'other'] as const
+
+/** Fishbone (6M) categories. */
+export const rootCauseCategories = ['people', 'process', 'equipment', 'materials', 'environment', 'management'] as const
+
+export const actionKinds = ['corrective', 'preventive'] as const
+
+export const actionStatuses = ['open', 'in_progress', 'done', 'verified', 'cancelled'] as const

shared/format.ts

@@ -0,0 +1,4 @@
+/** Human-facing incident reference, e.g. `INC-0042`. */
+export function incidentReference(number: number): string {
+  return `INC-${String(number).padStart(4, '0')}`
+}

shared/schemas.ts

@@ -0,0 +1,60 @@
+// Request validation schemas, shared so the web app can validate forms with the same rules as the API.
+import { z } from 'zod'
+import { areaKinds, incidentStatuses, incidentTypes, roles, severities } from './enums.ts'
+
+const email = z.string().trim().toLowerCase().max(254).pipe(z.email())
+const password = z.string().min(10, 'Use at least 10 characters').max(256)
+const name = z.string().trim().min(1).max(200)
+const optionalText = (max: number) => z.string().trim().max(max).nullish()
+const isoDateTime = z.iso.datetime({ offset: true })
+
+export const setupSchema = z.object({ organizationName: name, name, email, password })
+
+export const loginSchema = z.object({ email, password: z.string().min(1).max(256) })
+
+export const changePasswordSchema = z.object({ currentPassword: z.string().min(1).max(256), newPassword: password })
+
+export const createUserSchema = z.object({ name, email, role: z.enum(roles), password })
+
+export const updateUserSchema = z.object({ name: name.optional(), role: z.enum(roles).optional(), active: z.boolean().optional() })
+
+export const createSiteSchema = z.object({ name, address: optionalText(500), timezone: z.string().trim().max(64).optional() })
+
+export const updateSiteSchema = createSiteSchema.partial().extend({ archived: z.boolean().optional() })
+
+export const createAreaSchema = z.object({ name, kind: z.enum(areaKinds).default('area'), parentId: z.uuid().nullish() })
+
+export const updateAreaSchema = z.object({ name: name.optional(), kind: z.enum(areaKinds).optional(), archived: z.boolean().optional() })
+
+export const createIncidentSchema = z.object({
+  title: name,
+  type: z.enum(incidentTypes),
+  severity: z.enum(severities),
+  occurredAt: isoDateTime,
+  siteId: z.uuid(),
+  areaId: z.uuid().nullish(),
+  locationDetail: optionalText(500),
+  description: optionalText(10_000),
+  immediateAction: optionalText(10_000),
+  anonymous: z.boolean().default(false),
+})
+
+export const updateIncidentSchema = createIncidentSchema
+  .omit({ anonymous: true })
+  .partial()
+  .extend({ status: z.enum(incidentStatuses).optional() })
+
+export const incidentListQuery = z.object({
+  page: z.coerce.number().int().min(1).default(1),
+  pageSize: z.coerce.number().int().min(1).max(100).default(25),
+  q: z.string().trim().max(200).optional(),
+  type: z.enum(incidentTypes).optional(),
+  severity: z.enum(severities).optional(),
+  status: z.enum(incidentStatuses).optional(),
+  siteId: z.uuid().optional(),
+})
+
+export type SetupInput = z.infer<typeof setupSchema>
+export type CreateIncidentInput = z.input<typeof createIncidentSchema>
+export type UpdateIncidentInput = z.infer<typeof updateIncidentSchema>
+export type IncidentListQuery = z.infer<typeof incidentListQuery>