feat: build collaboration workspaces

app/api/alerts/rules/[id]/route.ts

@@ -0,0 +1,74 @@
+import { jsonFailure, jsonSuccess, readJsonBody } from "@/modules/core/server/api";
+import { recordAuditLog } from "@/modules/core/server/audit";
+import { requirePermission } from "@/modules/core/server/auth";
+import { deleteAlertRule, isAlertMutationFailure, updateAlertRule } from "@/modules/alerts/server/operations";
+import { validateAlertRuleInput } from "@/modules/alerts/types";
+
+type RouteContext = {
+  params: Promise<{ id: string }>;
+};
+
+export async function PATCH(request: Request, context: RouteContext): Promise<Response> {
+  const { id } = await context.params;
+  const auth = await requirePermission("alert:manage", { action: "alert.rule.update", targetType: "alert_rule", targetId: id });
+  if (!auth.success) {
+    return auth.response;
+  }
+
+  const organizationId = auth.context.organization?.id;
+  if (!organizationId) {
+    return jsonFailure("请选择机构后维护规则", 400);
+  }
+
+  const input = validateAlertRuleInput(await readJsonBody(request));
+  if (!input.success) {
+    return jsonFailure(input.reason);
+  }
+
+  const rule = await updateAlertRule({ ...input.data, id, organizationId });
+  if (isAlertMutationFailure(rule)) {
+    return jsonFailure(rule.reason, rule.status);
+  }
+
+  await recordAuditLog({
+    actor: auth.context.account,
+    organizationId,
+    action: "alert.rule.update",
+    targetType: "alert_rule",
+    targetId: rule.id,
+    result: "success",
+    reason: `更新预警规则：${rule.name}`,
+  });
+
+  return jsonSuccess("预警规则已更新", { rule });
+}
+
+export async function DELETE(_request: Request, context: RouteContext): Promise<Response> {
+  const { id } = await context.params;
+  const auth = await requirePermission("alert:manage", { action: "alert.rule.delete", targetType: "alert_rule", targetId: id });
+  if (!auth.success) {
+    return auth.response;
+  }
+
+  const organizationId = auth.context.organization?.id;
+  if (!organizationId) {
+    return jsonFailure("请选择机构后维护规则", 400);
+  }
+
+  const rule = await deleteAlertRule({ id, organizationId });
+  if (isAlertMutationFailure(rule)) {
+    return jsonFailure(rule.reason, rule.status);
+  }
+
+  await recordAuditLog({
+    actor: auth.context.account,
+    organizationId,
+    action: "alert.rule.delete",
+    targetType: "alert_rule",
+    targetId: rule.id,
+    result: "success",
+    reason: `删除预警规则：${rule.name}`,
+  });
+
+  return jsonSuccess("预警规则已删除", { rule });
+}

app/api/alerts/rules/route.ts

@@ -0,0 +1,54 @@
+import { jsonFailure, jsonSuccess, readJsonBody } from "@/modules/core/server/api";
+import { recordAuditLog } from "@/modules/core/server/audit";
+import { requirePermission } from "@/modules/core/server/auth";
+import { createAlertRule, isAlertMutationFailure, listAlertCenterData } from "@/modules/alerts/server/operations";
+import { validateAlertRuleInput } from "@/modules/alerts/types";
+
+export async function GET(): Promise<Response> {
+  const auth = await requirePermission("alert:read", { action: "alert.rule.list", targetType: "alert_rule" });
+  if (!auth.success) {
+    return auth.response;
+  }
+
+  const organizationId = auth.context.organization?.id;
+  if (!organizationId) {
+    return jsonFailure("请选择机构后查看规则预警", 400);
+  }
+
+  const data = await listAlertCenterData(organizationId);
+  return jsonSuccess("规则预警已加载", { data });
+}
+
+export async function POST(request: Request): Promise<Response> {
+  const auth = await requirePermission("alert:manage", { action: "alert.rule.create", targetType: "alert_rule" });
+  if (!auth.success) {
+    return auth.response;
+  }
+
+  const organizationId = auth.context.organization?.id;
+  if (!organizationId) {
+    return jsonFailure("请选择机构后维护规则", 400);
+  }
+
+  const input = validateAlertRuleInput(await readJsonBody(request));
+  if (!input.success) {
+    return jsonFailure(input.reason);
+  }
+
+  const rule = await createAlertRule({ ...input.data, organizationId });
+  if (isAlertMutationFailure(rule)) {
+    return jsonFailure(rule.reason, rule.status);
+  }
+
+  await recordAuditLog({
+    actor: auth.context.account,
+    organizationId,
+    action: "alert.rule.create",
+    targetType: "alert_rule",
+    targetId: rule.id,
+    result: "success",
+    reason: `创建预警规则：${rule.name}`,
+  });
+
+  return jsonSuccess("预警规则已创建", { rule }, 201);
+}

app/api/alerts/triggers/[id]/route.ts

@@ -0,0 +1,74 @@
+import { jsonFailure, jsonSuccess, readJsonBody } from "@/modules/core/server/api";
+import { recordAuditLog } from "@/modules/core/server/audit";
+import { requirePermission } from "@/modules/core/server/auth";
+import { deleteAlertTrigger, isAlertMutationFailure, updateAlertTrigger } from "@/modules/alerts/server/operations";
+import { validateAlertTriggerInput } from "@/modules/alerts/types";
+
+type RouteContext = {
+  params: Promise<{ id: string }>;
+};
+
+export async function PATCH(request: Request, context: RouteContext): Promise<Response> {
+  const { id } = await context.params;
+  const auth = await requirePermission("alert:manage", { action: "alert.trigger.update", targetType: "alert_trigger", targetId: id });
+  if (!auth.success) {
+    return auth.response;
+  }
+
+  const organizationId = auth.context.organization?.id;
+  if (!organizationId) {
+    return jsonFailure("请选择机构后维护触发记录", 400);
+  }
+
+  const input = validateAlertTriggerInput(await readJsonBody(request));
+  if (!input.success) {
+    return jsonFailure(input.reason);
+  }
+
+  const trigger = await updateAlertTrigger({ ...input.data, id, organizationId, accountId: auth.context.account.id });
+  if (isAlertMutationFailure(trigger)) {
+    return jsonFailure(trigger.reason, trigger.status);
+  }
+
+  await recordAuditLog({
+    actor: auth.context.account,
+    organizationId,
+    action: "alert.trigger.update",
+    targetType: "alert_trigger",
+    targetId: trigger.id,
+    result: "success",
+    reason: `更新预警触发记录：${trigger.title}`,
+  });
+
+  return jsonSuccess("预警触发记录已更新", { trigger });
+}
+
+export async function DELETE(_request: Request, context: RouteContext): Promise<Response> {
+  const { id } = await context.params;
+  const auth = await requirePermission("alert:manage", { action: "alert.trigger.delete", targetType: "alert_trigger", targetId: id });
+  if (!auth.success) {
+    return auth.response;
+  }
+
+  const organizationId = auth.context.organization?.id;
+  if (!organizationId) {
+    return jsonFailure("请选择机构后维护触发记录", 400);
+  }
+
+  const trigger = await deleteAlertTrigger({ id, organizationId });
+  if (isAlertMutationFailure(trigger)) {
+    return jsonFailure(trigger.reason, trigger.status);
+  }
+
+  await recordAuditLog({
+    actor: auth.context.account,
+    organizationId,
+    action: "alert.trigger.delete",
+    targetType: "alert_trigger",
+    targetId: trigger.id,
+    result: "success",
+    reason: `删除预警触发记录：${trigger.title}`,
+  });
+
+  return jsonSuccess("预警触发记录已删除", { trigger });
+}

app/api/alerts/triggers/route.ts

@@ -0,0 +1,39 @@
+import { jsonFailure, jsonSuccess, readJsonBody } from "@/modules/core/server/api";
+import { recordAuditLog } from "@/modules/core/server/audit";
+import { requirePermission } from "@/modules/core/server/auth";
+import { createAlertTrigger, isAlertMutationFailure } from "@/modules/alerts/server/operations";
+import { validateAlertTriggerInput } from "@/modules/alerts/types";
+
+export async function POST(request: Request): Promise<Response> {
+  const auth = await requirePermission("alert:manage", { action: "alert.trigger.create", targetType: "alert_trigger" });
+  if (!auth.success) {
+    return auth.response;
+  }
+
+  const organizationId = auth.context.organization?.id;
+  if (!organizationId) {
+    return jsonFailure("请选择机构后维护触发记录", 400);
+  }
+
+  const input = validateAlertTriggerInput(await readJsonBody(request));
+  if (!input.success) {
+    return jsonFailure(input.reason);
+  }
+
+  const trigger = await createAlertTrigger({ ...input.data, organizationId, accountId: auth.context.account.id });
+  if (isAlertMutationFailure(trigger)) {
+    return jsonFailure(trigger.reason, trigger.status);
+  }
+
+  await recordAuditLog({
+    actor: auth.context.account,
+    organizationId,
+    action: "alert.trigger.create",
+    targetType: "alert_trigger",
+    targetId: trigger.id,
+    result: "success",
+    reason: `创建预警触发记录：${trigger.title}`,
+  });
+
+  return jsonSuccess("预警触发记录已创建", { trigger }, 201);
+}

app/api/collaboration-routes.test.ts

@@ -0,0 +1,336 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+import { recordAuditLog } from "@/modules/core/server/audit";
+import { requirePermission } from "@/modules/core/server/auth";
+import type { AuthContext } from "@/modules/core/types";
+import type { AlertCenterData, AlertRule } from "@/modules/alerts/types";
+import type { DeviceAsset, DeviceOperationsData } from "@/modules/devices/types";
+import type { FamilyContact, FamilyServiceData } from "@/modules/family/types";
+import type { Notice } from "@/modules/notices/types";
+import {
+  createAlertRule,
+  listAlertCenterData,
+  updateAlertTrigger,
+} from "@/modules/alerts/server/operations";
+import {
+  createDeviceAsset,
+  listDeviceOperationsData,
+  updateMaintenanceTicket,
+} from "@/modules/devices/server/operations";
+import {
+  createFamilyContact,
+  listFamilyServiceData,
+  updateFamilyVisit,
+} from "@/modules/family/server/operations";
+import {
+  createNotice,
+  listNoticeCenterData,
+  markNoticeRead,
+} from "@/modules/notices/server/operations";
+
+vi.mock("@/modules/core/server/auth", () => ({
+  requirePermission: vi.fn(),
+}));
+
+vi.mock("@/modules/core/server/audit", () => ({
+  recordAuditLog: vi.fn(),
+}));
+
+vi.mock("@/modules/devices/server/operations", () => ({
+  createDeviceAsset: vi.fn(),
+  isDeviceMutationFailure: vi.fn((value: unknown) => typeof value === "object" && value !== null && "success" in value && value.success === false),
+  listDeviceOperationsData: vi.fn(),
+  updateMaintenanceTicket: vi.fn(),
+}));
+
+vi.mock("@/modules/notices/server/operations", () => ({
+  createNotice: vi.fn(),
+  isNoticeMutationFailure: vi.fn((value: unknown) => typeof value === "object" && value !== null && "success" in value && value.success === false),
+  listNoticeCenterData: vi.fn(),
+  markNoticeRead: vi.fn(),
+}));
+
+vi.mock("@/modules/alerts/server/operations", () => ({
+  createAlertRule: vi.fn(),
+  isAlertMutationFailure: vi.fn((value: unknown) => typeof value === "object" && value !== null && "success" in value && value.success === false),
+  listAlertCenterData: vi.fn(),
+  updateAlertTrigger: vi.fn(),
+}));
+
+vi.mock("@/modules/family/server/operations", () => ({
+  createFamilyContact: vi.fn(),
+  isFamilyMutationFailure: vi.fn((value: unknown) => typeof value === "object" && value !== null && "success" in value && value.success === false),
+  listFamilyServiceData: vi.fn(),
+  updateFamilyVisit: vi.fn(),
+}));
+
+const account: AuthContext["account"] = {
+  id: "account-1",
+  name: "Admin",
+  email: "admin@example.com",
+  avatarUrl: "",
+  role: "org_admin",
+  status: "active",
+  createdAt: "2026-07-02T00:00:00.000Z",
+  updatedAt: "2026-07-02T00:00:00.000Z",
+};
+
+function createAuthContext(overrides: Partial<AuthContext> = {}): AuthContext {
+  return {
+    account,
+    organization: {
+      id: "org-1",
+      name: "Demo Org",
+      slug: "demo-org",
+      status: "active",
+      registrationEnabled: true,
+      oidcEnabled: false,
+      oidcIssuerUrl: "",
+      oidcClientId: "",
+      oidcHasClientSecret: false,
+      oidcScopes: "openid profile email",
+      oidcRedirectUri: "",
+      oidcAvatarClaim: "picture",
+      oidcAutoProvision: false,
+      createdAt: "2026-07-02T00:00:00.000Z",
+      updatedAt: "2026-07-02T00:00:00.000Z",
+    },
+    organizations: [],
+    permissions: ["device:read", "device:manage", "notice:read", "notice:manage", "alert:read", "alert:manage", "family:read", "family:manage"],
+    session: {
+      id: "session-1",
+      accountId: "account-1",
+      activeOrganizationId: "org-1",
+      createdAt: "2026-07-02T00:00:00.000Z",
+      expiresAt: "2026-07-09T00:00:00.000Z",
+    },
+    ...overrides,
+  };
+}
+
+const device: DeviceAsset = {
+  id: "device-1",
+  organizationId: "org-1",
+  name: "床头呼叫器",
+  code: "DEV-1",
+  category: "呼叫系统",
+  location: "A102",
+  status: "active",
+  lastInspectedAt: undefined,
+  notes: "",
+  createdAt: "2026-07-02T00:00:00.000Z",
+  updatedAt: "2026-07-02T00:00:00.000Z",
+};
+
+const deviceData: DeviceOperationsData = {
+  metrics: { activeDevices: 1, maintenanceDevices: 0, openTickets: 0, urgentTickets: 0 },
+  devices: [device],
+  tickets: [],
+};
+
+const notice: Notice = {
+  id: "notice-1",
+  organizationId: "org-1",
+  title: "探访安排",
+  content: "周六探访安排",
+  audience: "全体员工",
+  status: "published",
+  publishedAt: "2026-07-02T00:00:00.000Z",
+  createdByAccountId: "account-1",
+  createdByName: "Admin",
+  updatedByAccountId: "account-1",
+  updatedByName: "Admin",
+  readCount: 0,
+  hasRead: false,
+  createdAt: "2026-07-02T00:00:00.000Z",
+  updatedAt: "2026-07-02T00:00:00.000Z",
+};
+
+const alertRule: AlertRule = {
+  id: "rule-1",
+  organizationId: "org-1",
+  name: "血氧低值连续告警",
+  ruleType: "health",
+  severity: "critical",
+  status: "enabled",
+  conditionSummary: "血氧低于阈值",
+  suggestion: "通知医生",
+  createdAt: "2026-07-02T00:00:00.000Z",
+  updatedAt: "2026-07-02T00:00:00.000Z",
+};
+
+const alertData: AlertCenterData = {
+  metrics: { enabledRules: 1, openTriggers: 0, criticalTriggers: 0, resolvedTriggers: 0 },
+  rules: [alertRule],
+  triggers: [],
+};
+
+const familyContact: FamilyContact = {
+  id: "contact-1",
+  organizationId: "org-1",
+  elderId: "elder-1",
+  elderName: "王桂兰",
+  name: "张敏",
+  relationship: "女儿",
+  phone: "13800000001",
+  status: "active",
+  notes: "",
+  createdAt: "2026-07-02T00:00:00.000Z",
+  updatedAt: "2026-07-02T00:00:00.000Z",
+};
+
+const familyData: FamilyServiceData = {
+  metrics: { activeContacts: 1, pendingVisits: 0, openFeedback: 0, resolvedFeedback: 0 },
+  elderOptions: [{ id: "elder-1", name: "王桂兰" }],
+  contacts: [familyContact],
+  visits: [],
+  feedback: [],
+};
+
+function allowAuth(overrides: Partial<AuthContext> = {}): void {
+  vi.mocked(requirePermission).mockResolvedValue({ success: true, context: createAuthContext(overrides) });
+}
+
+function jsonRequest(body: Record<string, unknown>): Request {
+  return new Request("http://localhost/api/collaboration", {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify(body),
+  });
+}
+
+async function readJson(response: Response): Promise<Record<string, unknown>> {
+  return (await response.json()) as Record<string, unknown>;
+}
+
+beforeEach(() => {
+  vi.clearAllMocks();
+  allowAuth();
+});
+
+describe("collaboration API routes", () => {
+  it("loads device operations for the active organization", async () => {
+    vi.mocked(listDeviceOperationsData).mockResolvedValue(deviceData);
+
+    const { GET } = await import("./devices/assets/route");
+    const response = await GET();
+    const body = await readJson(response);
+
+    expect(response.status).toBe(200);
+    expect(body.data).toEqual(deviceData);
+    expect(listDeviceOperationsData).toHaveBeenCalledWith("org-1");
+  });
+
+  it("requires active organization before loading notices", async () => {
+    allowAuth({ organization: undefined });
+
+    const { GET } = await import("./notices/route");
+    const response = await GET();
+    const body = await readJson(response);
+
+    expect(response.status).toBe(400);
+    expect(body.reason).toBe("请选择机构后查看公告");
+    expect(listNoticeCenterData).not.toHaveBeenCalled();
+  });
+
+  it("creates a device asset and records audit", async () => {
+    vi.mocked(createDeviceAsset).mockResolvedValue(device);
+
+    const { POST } = await import("./devices/assets/route");
+    const response = await POST(jsonRequest({ name: "床头呼叫器", code: "DEV-1", status: "active" }));
+    const body = await readJson(response);
+
+    expect(response.status).toBe(201);
+    expect(body.success).toBe(true);
+    expect(createDeviceAsset).toHaveBeenCalledWith(expect.objectContaining({ organizationId: "org-1" }));
+    expect(recordAuditLog).toHaveBeenCalledWith(expect.objectContaining({ action: "device.asset.create" }));
+  });
+
+  it("updates a maintenance ticket and propagates cross-organization failures", async () => {
+    vi.mocked(updateMaintenanceTicket).mockResolvedValue({ success: false, reason: "维修工单不存在", status: 404 });
+
+    const { PATCH } = await import("./devices/tickets/[id]/route");
+    const response = await PATCH(jsonRequest({ title: "保养", priority: "normal", status: "open" }), {
+      params: Promise.resolve({ id: "ticket-from-other-org" }),
+    });
+    const body = await readJson(response);
+
+    expect(response.status).toBe(404);
+    expect(body.reason).toBe("维修工单不存在");
+    expect(recordAuditLog).not.toHaveBeenCalled();
+  });
+
+  it("creates and marks notices read", async () => {
+    vi.mocked(createNotice).mockResolvedValue(notice);
+    vi.mocked(markNoticeRead).mockResolvedValue({ ...notice, hasRead: true, readCount: 1 });
+
+    const { POST } = await import("./notices/route");
+    const createResponse = await POST(jsonRequest({ title: "探访安排", content: "周六探访安排", status: "published" }));
+    expect(createResponse.status).toBe(201);
+    expect(recordAuditLog).toHaveBeenCalledWith(expect.objectContaining({ action: "notice.create" }));
+
+    vi.clearAllMocks();
+    allowAuth();
+    const { POST: markReadPost } = await import("./notices/[id]/route");
+    const readResponse = await markReadPost(jsonRequest({}), { params: Promise.resolve({ id: "notice-1" }) });
+    expect(readResponse.status).toBe(200);
+    expect(markNoticeRead).toHaveBeenCalledWith({ accountId: "account-1", id: "notice-1", organizationId: "org-1" });
+  });
+
+  it("loads and creates alert rules", async () => {
+    vi.mocked(listAlertCenterData).mockResolvedValue(alertData);
+    vi.mocked(createAlertRule).mockResolvedValue(alertRule);
+
+    const { GET, POST } = await import("./alerts/rules/route");
+    const listResponse = await GET();
+    expect(listResponse.status).toBe(200);
+    expect(listAlertCenterData).toHaveBeenCalledWith("org-1");
+
+    const createResponse = await POST(jsonRequest({ name: "血氧低值连续告警", ruleType: "health", severity: "critical", status: "enabled" }));
+    expect(createResponse.status).toBe(201);
+    expect(recordAuditLog).toHaveBeenCalledWith(expect.objectContaining({ action: "alert.rule.create" }));
+  });
+
+  it("updates alert trigger failures without audit", async () => {
+    vi.mocked(updateAlertTrigger).mockResolvedValue({ success: false, reason: "预警触发记录不存在", status: 404 });
+
+    const { PATCH } = await import("./alerts/triggers/[id]/route");
+    const response = await PATCH(jsonRequest({ title: "触发", status: "resolved" }), { params: Promise.resolve({ id: "trigger-other-org" }) });
+    const body = await readJson(response);
+
+    expect(response.status).toBe(404);
+    expect(body.reason).toBe("预警触发记录不存在");
+    expect(recordAuditLog).not.toHaveBeenCalled();
+  });
+
+  it("loads family services and creates contacts", async () => {
+    vi.mocked(listFamilyServiceData).mockResolvedValue(familyData);
+    vi.mocked(createFamilyContact).mockResolvedValue(familyContact);
+
+    const { GET, POST } = await import("./family/contacts/route");
+    const listResponse = await GET();
+    expect(listResponse.status).toBe(200);
+    expect(listFamilyServiceData).toHaveBeenCalledWith("org-1");
+
+    const createResponse = await POST(
+      jsonRequest({ elderId: "elder-1", name: "张敏", relationship: "女儿", phone: "13800000001", status: "active" }),
+    );
+    expect(createResponse.status).toBe(201);
+    expect(recordAuditLog).toHaveBeenCalledWith(expect.objectContaining({ action: "family.contact.create" }));
+  });
+
+  it("updates family visit failures without audit", async () => {
+    vi.mocked(updateFamilyVisit).mockResolvedValue({ success: false, reason: "探访预约不存在", status: 404 });
+
+    const { PATCH } = await import("./family/visits/[id]/route");
+    const response = await PATCH(
+      jsonRequest({ elderId: "elder-1", scheduledAt: "2026-07-02T08:00:00.000Z", status: "approved" }),
+      { params: Promise.resolve({ id: "visit-other-org" }) },
+    );
+    const body = await readJson(response);
+
+    expect(response.status).toBe(404);
+    expect(body.reason).toBe("探访预约不存在");
+    expect(recordAuditLog).not.toHaveBeenCalled();
+  });
+});

app/api/devices/assets/[id]/route.ts

@@ -0,0 +1,74 @@
+import { jsonFailure, jsonSuccess, readJsonBody } from "@/modules/core/server/api";
+import { recordAuditLog } from "@/modules/core/server/audit";
+import { requirePermission } from "@/modules/core/server/auth";
+import { deleteDeviceAsset, isDeviceMutationFailure, updateDeviceAsset } from "@/modules/devices/server/operations";
+import { validateDeviceAssetInput } from "@/modules/devices/types";
+
+type RouteContext = {
+  params: Promise<{ id: string }>;
+};
+
+export async function PATCH(request: Request, context: RouteContext): Promise<Response> {
+  const { id } = await context.params;
+  const auth = await requirePermission("device:manage", { action: "device.asset.update", targetType: "device_asset", targetId: id });
+  if (!auth.success) {
+    return auth.response;
+  }
+
+  const organizationId = auth.context.organization?.id;
+  if (!organizationId) {
+    return jsonFailure("请选择机构后维护设备", 400);
+  }
+
+  const input = validateDeviceAssetInput(await readJsonBody(request));
+  if (!input.success) {
+    return jsonFailure(input.reason);
+  }
+
+  const device = await updateDeviceAsset({ ...input.data, id, organizationId });
+  if (isDeviceMutationFailure(device)) {
+    return jsonFailure(device.reason, device.status);
+  }
+
+  await recordAuditLog({
+    actor: auth.context.account,
+    organizationId,
+    action: "device.asset.update",
+    targetType: "device_asset",
+    targetId: device.id,
+    result: "success",
+    reason: `更新设备：${device.name}`,
+  });
+
+  return jsonSuccess("设备已更新", { device });
+}
+
+export async function DELETE(_request: Request, context: RouteContext): Promise<Response> {
+  const { id } = await context.params;
+  const auth = await requirePermission("device:manage", { action: "device.asset.delete", targetType: "device_asset", targetId: id });
+  if (!auth.success) {
+    return auth.response;
+  }
+
+  const organizationId = auth.context.organization?.id;
+  if (!organizationId) {
+    return jsonFailure("请选择机构后维护设备", 400);
+  }
+
+  const device = await deleteDeviceAsset({ id, organizationId });
+  if (isDeviceMutationFailure(device)) {
+    return jsonFailure(device.reason, device.status);
+  }
+
+  await recordAuditLog({
+    actor: auth.context.account,
+    organizationId,
+    action: "device.asset.delete",
+    targetType: "device_asset",
+    targetId: device.id,
+    result: "success",
+    reason: `删除设备：${device.name}`,
+  });
+
+  return jsonSuccess("设备已删除", { device });
+}

app/api/devices/assets/route.ts

@@ -0,0 +1,54 @@
+import { jsonFailure, jsonSuccess, readJsonBody } from "@/modules/core/server/api";
+import { recordAuditLog } from "@/modules/core/server/audit";
+import { requirePermission } from "@/modules/core/server/auth";
+import { createDeviceAsset, isDeviceMutationFailure, listDeviceOperationsData } from "@/modules/devices/server/operations";
+import { validateDeviceAssetInput } from "@/modules/devices/types";
+
+export async function GET(): Promise<Response> {
+  const auth = await requirePermission("device:read", { action: "device.asset.list", targetType: "device_asset" });
+  if (!auth.success) {
+    return auth.response;
+  }
+
+  const organizationId = auth.context.organization?.id;
+  if (!organizationId) {
+    return jsonFailure("请选择机构后查看设备运维", 400);
+  }
+
+  const data = await listDeviceOperationsData(organizationId);
+  return jsonSuccess("设备运维数据已加载", { data });
+}
+
+export async function POST(request: Request): Promise<Response> {
+  const auth = await requirePermission("device:manage", { action: "device.asset.create", targetType: "device_asset" });
+  if (!auth.success) {
+    return auth.response;
+  }
+
+  const organizationId = auth.context.organization?.id;
+  if (!organizationId) {
+    return jsonFailure("请选择机构后维护设备", 400);
+  }
+
+  const input = validateDeviceAssetInput(await readJsonBody(request));
+  if (!input.success) {
+    return jsonFailure(input.reason);
+  }
+
+  const device = await createDeviceAsset({ ...input.data, organizationId });
+  if (isDeviceMutationFailure(device)) {
+    return jsonFailure(device.reason, device.status);
+  }
+
+  await recordAuditLog({
+    actor: auth.context.account,
+    organizationId,
+    action: "device.asset.create",
+    targetType: "device_asset",
+    targetId: device.id,
+    result: "success",
+    reason: `创建设备：${device.name}`,
+  });
+
+  return jsonSuccess("设备已创建", { device }, 201);
+}

app/api/devices/tickets/[id]/route.ts

@@ -0,0 +1,74 @@
+import { jsonFailure, jsonSuccess, readJsonBody } from "@/modules/core/server/api";
+import { recordAuditLog } from "@/modules/core/server/audit";
+import { requirePermission } from "@/modules/core/server/auth";
+import { deleteMaintenanceTicket, isDeviceMutationFailure, updateMaintenanceTicket } from "@/modules/devices/server/operations";
+import { validateMaintenanceTicketInput } from "@/modules/devices/types";
+
+type RouteContext = {
+  params: Promise<{ id: string }>;
+};
+
+export async function PATCH(request: Request, context: RouteContext): Promise<Response> {
+  const { id } = await context.params;
+  const auth = await requirePermission("device:manage", { action: "device.ticket.update", targetType: "maintenance_ticket", targetId: id });
+  if (!auth.success) {
+    return auth.response;
+  }
+
+  const organizationId = auth.context.organization?.id;
+  if (!organizationId) {
+    return jsonFailure("请选择机构后维护工单", 400);
+  }
+
+  const input = validateMaintenanceTicketInput(await readJsonBody(request));
+  if (!input.success) {
+    return jsonFailure(input.reason);
+  }
+
+  const ticket = await updateMaintenanceTicket({ ...input.data, id, organizationId });
+  if (isDeviceMutationFailure(ticket)) {
+    return jsonFailure(ticket.reason, ticket.status);
+  }
+
+  await recordAuditLog({
+    actor: auth.context.account,
+    organizationId,
+    action: "device.ticket.update",
+    targetType: "maintenance_ticket",
+    targetId: ticket.id,
+    result: "success",
+    reason: `更新维修工单：${ticket.title}`,
+  });
+
+  return jsonSuccess("维修工单已更新", { ticket });
+}
+
+export async function DELETE(_request: Request, context: RouteContext): Promise<Response> {
+  const { id } = await context.params;
+  const auth = await requirePermission("device:manage", { action: "device.ticket.delete", targetType: "maintenance_ticket", targetId: id });
+  if (!auth.success) {
+    return auth.response;
+  }
+
+  const organizationId = auth.context.organization?.id;
+  if (!organizationId) {
+    return jsonFailure("请选择机构后维护工单", 400);
+  }
+
+  const ticket = await deleteMaintenanceTicket({ id, organizationId });
+  if (isDeviceMutationFailure(ticket)) {
+    return jsonFailure(ticket.reason, ticket.status);
+  }
+
+  await recordAuditLog({
+    actor: auth.context.account,
+    organizationId,
+    action: "device.ticket.delete",
+    targetType: "maintenance_ticket",
+    targetId: ticket.id,
+    result: "success",
+    reason: `删除维修工单：${ticket.title}`,
+  });
+
+  return jsonSuccess("维修工单已删除", { ticket });
+}

app/api/devices/tickets/route.ts

@@ -0,0 +1,39 @@
+import { jsonFailure, jsonSuccess, readJsonBody } from "@/modules/core/server/api";
+import { recordAuditLog } from "@/modules/core/server/audit";
+import { requirePermission } from "@/modules/core/server/auth";
+import { createMaintenanceTicket, isDeviceMutationFailure } from "@/modules/devices/server/operations";
+import { validateMaintenanceTicketInput } from "@/modules/devices/types";
+
+export async function POST(request: Request): Promise<Response> {
+  const auth = await requirePermission("device:manage", { action: "device.ticket.create", targetType: "maintenance_ticket" });
+  if (!auth.success) {
+    return auth.response;
+  }
+
+  const organizationId = auth.context.organization?.id;
+  if (!organizationId) {
+    return jsonFailure("请选择机构后维护工单", 400);
+  }
+
+  const input = validateMaintenanceTicketInput(await readJsonBody(request));
+  if (!input.success) {
+    return jsonFailure(input.reason);
+  }
+
+  const ticket = await createMaintenanceTicket({ ...input.data, organizationId });
+  if (isDeviceMutationFailure(ticket)) {
+    return jsonFailure(ticket.reason, ticket.status);
+  }
+
+  await recordAuditLog({
+    actor: auth.context.account,
+    organizationId,
+    action: "device.ticket.create",
+    targetType: "maintenance_ticket",
+    targetId: ticket.id,
+    result: "success",
+    reason: `创建维修工单：${ticket.title}`,
+  });
+
+  return jsonSuccess("维修工单已创建", { ticket }, 201);
+}

app/api/family/contacts/[id]/route.ts

@@ -0,0 +1,74 @@
+import { jsonFailure, jsonSuccess, readJsonBody } from "@/modules/core/server/api";
+import { recordAuditLog } from "@/modules/core/server/audit";
+import { requirePermission } from "@/modules/core/server/auth";
+import { deleteFamilyContact, isFamilyMutationFailure, updateFamilyContact } from "@/modules/family/server/operations";
+import { validateFamilyContactInput } from "@/modules/family/types";
+
+type RouteContext = {
+  params: Promise<{ id: string }>;
+};
+
+export async function PATCH(request: Request, context: RouteContext): Promise<Response> {
+  const { id } = await context.params;
+  const auth = await requirePermission("family:manage", { action: "family.contact.update", targetType: "family_contact", targetId: id });
+  if (!auth.success) {
+    return auth.response;
+  }
+
+  const organizationId = auth.context.organization?.id;
+  if (!organizationId) {
+    return jsonFailure("请选择机构后维护家属联系人", 400);
+  }
+
+  const input = validateFamilyContactInput(await readJsonBody(request));
+  if (!input.success) {
+    return jsonFailure(input.reason);
+  }
+
+  const contact = await updateFamilyContact({ ...input.data, id, organizationId });
+  if (isFamilyMutationFailure(contact)) {
+    return jsonFailure(contact.reason, contact.status);
+  }
+
+  await recordAuditLog({
+    actor: auth.context.account,
+    organizationId,
+    action: "family.contact.update",
+    targetType: "family_contact",
+    targetId: contact.id,
+    result: "success",
+    reason: `更新家属联系人：${contact.name}`,
+  });
+
+  return jsonSuccess("家属联系人已更新", { contact });
+}
+
+export async function DELETE(_request: Request, context: RouteContext): Promise<Response> {
+  const { id } = await context.params;
+  const auth = await requirePermission("family:manage", { action: "family.contact.delete", targetType: "family_contact", targetId: id });
+  if (!auth.success) {
+    return auth.response;
+  }
+
+  const organizationId = auth.context.organization?.id;
+  if (!organizationId) {
+    return jsonFailure("请选择机构后维护家属联系人", 400);
+  }
+
+  const contact = await deleteFamilyContact({ id, organizationId });
+  if (isFamilyMutationFailure(contact)) {
+    return jsonFailure(contact.reason, contact.status);
+  }
+
+  await recordAuditLog({
+    actor: auth.context.account,
+    organizationId,
+    action: "family.contact.delete",
+    targetType: "family_contact",
+    targetId: contact.id,
+    result: "success",
+    reason: `删除家属联系人：${contact.name}`,
+  });
+
+  return jsonSuccess("家属联系人已删除", { contact });
+}

app/api/family/contacts/route.ts

@@ -0,0 +1,54 @@
+import { jsonFailure, jsonSuccess, readJsonBody } from "@/modules/core/server/api";
+import { recordAuditLog } from "@/modules/core/server/audit";
+import { requirePermission } from "@/modules/core/server/auth";
+import { createFamilyContact, isFamilyMutationFailure, listFamilyServiceData } from "@/modules/family/server/operations";
+import { validateFamilyContactInput } from "@/modules/family/types";
+
+export async function GET(): Promise<Response> {
+  const auth = await requirePermission("family:read", { action: "family.contact.list", targetType: "family_contact" });
+  if (!auth.success) {
+    return auth.response;
+  }
+
+  const organizationId = auth.context.organization?.id;
+  if (!organizationId) {
+    return jsonFailure("请选择机构后查看家属服务", 400);
+  }
+
+  const data = await listFamilyServiceData(organizationId);
+  return jsonSuccess("家属服务已加载", { data });
+}
+
+export async function POST(request: Request): Promise<Response> {
+  const auth = await requirePermission("family:manage", { action: "family.contact.create", targetType: "family_contact" });
+  if (!auth.success) {
+    return auth.response;
+  }
+
+  const organizationId = auth.context.organization?.id;
+  if (!organizationId) {
+    return jsonFailure("请选择机构后维护家属联系人", 400);
+  }
+
+  const input = validateFamilyContactInput(await readJsonBody(request));
+  if (!input.success) {
+    return jsonFailure(input.reason);
+  }
+
+  const contact = await createFamilyContact({ ...input.data, organizationId });
+  if (isFamilyMutationFailure(contact)) {
+    return jsonFailure(contact.reason, contact.status);
+  }
+
+  await recordAuditLog({
+    actor: auth.context.account,
+    organizationId,
+    action: "family.contact.create",
+    targetType: "family_contact",
+    targetId: contact.id,
+    result: "success",
+    reason: `创建家属联系人：${contact.name}`,
+  });
+
+  return jsonSuccess("家属联系人已创建", { contact }, 201);
+}

app/api/family/feedback/[id]/route.ts

@@ -0,0 +1,74 @@
+import { jsonFailure, jsonSuccess, readJsonBody } from "@/modules/core/server/api";
+import { recordAuditLog } from "@/modules/core/server/audit";
+import { requirePermission } from "@/modules/core/server/auth";
+import { deleteFamilyFeedback, isFamilyMutationFailure, updateFamilyFeedback } from "@/modules/family/server/operations";
+import { validateFamilyFeedbackInput } from "@/modules/family/types";
+
+type RouteContext = {
+  params: Promise<{ id: string }>;
+};
+
+export async function PATCH(request: Request, context: RouteContext): Promise<Response> {
+  const { id } = await context.params;
+  const auth = await requirePermission("family:manage", { action: "family.feedback.update", targetType: "family_feedback", targetId: id });
+  if (!auth.success) {
+    return auth.response;
+  }
+
+  const organizationId = auth.context.organization?.id;
+  if (!organizationId) {
+    return jsonFailure("请选择机构后维护家属反馈", 400);
+  }
+
+  const input = validateFamilyFeedbackInput(await readJsonBody(request));
+  if (!input.success) {
+    return jsonFailure(input.reason);
+  }
+
+  const feedback = await updateFamilyFeedback({ ...input.data, id, organizationId, accountId: auth.context.account.id });
+  if (isFamilyMutationFailure(feedback)) {
+    return jsonFailure(feedback.reason, feedback.status);
+  }
+
+  await recordAuditLog({
+    actor: auth.context.account,
+    organizationId,
+    action: "family.feedback.update",
+    targetType: "family_feedback",
+    targetId: feedback.id,
+    result: "success",
+    reason: `更新家属反馈：${feedback.elderName}`,
+  });
+
+  return jsonSuccess("家属反馈已更新", { feedback });
+}
+
+export async function DELETE(_request: Request, context: RouteContext): Promise<Response> {
+  const { id } = await context.params;
+  const auth = await requirePermission("family:manage", { action: "family.feedback.delete", targetType: "family_feedback", targetId: id });
+  if (!auth.success) {
+    return auth.response;
+  }
+
+  const organizationId = auth.context.organization?.id;
+  if (!organizationId) {
+    return jsonFailure("请选择机构后维护家属反馈", 400);
+  }
+
+  const feedback = await deleteFamilyFeedback({ id, organizationId });
+  if (isFamilyMutationFailure(feedback)) {
+    return jsonFailure(feedback.reason, feedback.status);
+  }
+
+  await recordAuditLog({
+    actor: auth.context.account,
+    organizationId,
+    action: "family.feedback.delete",
+    targetType: "family_feedback",
+    targetId: feedback.id,
+    result: "success",
+    reason: `删除家属反馈：${feedback.elderName}`,
+  });
+
+  return jsonSuccess("家属反馈已删除", { feedback });
+}

app/api/family/feedback/route.ts

@@ -0,0 +1,39 @@
+import { jsonFailure, jsonSuccess, readJsonBody } from "@/modules/core/server/api";
+import { recordAuditLog } from "@/modules/core/server/audit";
+import { requirePermission } from "@/modules/core/server/auth";
+import { createFamilyFeedback, isFamilyMutationFailure } from "@/modules/family/server/operations";
+import { validateFamilyFeedbackInput } from "@/modules/family/types";
+
+export async function POST(request: Request): Promise<Response> {
+  const auth = await requirePermission("family:manage", { action: "family.feedback.create", targetType: "family_feedback" });
+  if (!auth.success) {
+    return auth.response;
+  }
+
+  const organizationId = auth.context.organization?.id;
+  if (!organizationId) {
+    return jsonFailure("请选择机构后维护家属反馈", 400);
+  }
+
+  const input = validateFamilyFeedbackInput(await readJsonBody(request));
+  if (!input.success) {
+    return jsonFailure(input.reason);
+  }
+
+  const feedback = await createFamilyFeedback({ ...input.data, organizationId, accountId: auth.context.account.id });
+  if (isFamilyMutationFailure(feedback)) {
+    return jsonFailure(feedback.reason, feedback.status);
+  }
+
+  await recordAuditLog({
+    actor: auth.context.account,
+    organizationId,
+    action: "family.feedback.create",
+    targetType: "family_feedback",
+    targetId: feedback.id,
+    result: "success",
+    reason: `创建家属反馈：${feedback.elderName}`,
+  });
+
+  return jsonSuccess("家属反馈已创建", { feedback }, 201);
+}

app/api/family/visits/[id]/route.ts

@@ -0,0 +1,74 @@
+import { jsonFailure, jsonSuccess, readJsonBody } from "@/modules/core/server/api";
+import { recordAuditLog } from "@/modules/core/server/audit";
+import { requirePermission } from "@/modules/core/server/auth";
+import { deleteFamilyVisit, isFamilyMutationFailure, updateFamilyVisit } from "@/modules/family/server/operations";
+import { validateFamilyVisitInput } from "@/modules/family/types";
+
+type RouteContext = {
+  params: Promise<{ id: string }>;
+};
+
+export async function PATCH(request: Request, context: RouteContext): Promise<Response> {
+  const { id } = await context.params;
+  const auth = await requirePermission("family:manage", { action: "family.visit.update", targetType: "family_visit", targetId: id });
+  if (!auth.success) {
+    return auth.response;
+  }
+
+  const organizationId = auth.context.organization?.id;
+  if (!organizationId) {
+    return jsonFailure("请选择机构后维护探访预约", 400);
+  }
+
+  const input = validateFamilyVisitInput(await readJsonBody(request));
+  if (!input.success) {
+    return jsonFailure(input.reason);
+  }
+
+  const visit = await updateFamilyVisit({ ...input.data, id, organizationId, accountId: auth.context.account.id });
+  if (isFamilyMutationFailure(visit)) {
+    return jsonFailure(visit.reason, visit.status);
+  }
+
+  await recordAuditLog({
+    actor: auth.context.account,
+    organizationId,
+    action: "family.visit.update",
+    targetType: "family_visit",
+    targetId: visit.id,
+    result: "success",
+    reason: `更新探访预约：${visit.elderName}`,
+  });
+
+  return jsonSuccess("探访预约已更新", { visit });
+}
+
+export async function DELETE(_request: Request, context: RouteContext): Promise<Response> {
+  const { id } = await context.params;
+  const auth = await requirePermission("family:manage", { action: "family.visit.delete", targetType: "family_visit", targetId: id });
+  if (!auth.success) {
+    return auth.response;
+  }
+
+  const organizationId = auth.context.organization?.id;
+  if (!organizationId) {
+    return jsonFailure("请选择机构后维护探访预约", 400);
+  }
+
+  const visit = await deleteFamilyVisit({ id, organizationId });
+  if (isFamilyMutationFailure(visit)) {
+    return jsonFailure(visit.reason, visit.status);
+  }
+
+  await recordAuditLog({
+    actor: auth.context.account,
+    organizationId,
+    action: "family.visit.delete",
+    targetType: "family_visit",
+    targetId: visit.id,
+    result: "success",
+    reason: `删除探访预约：${visit.elderName}`,
+  });
+
+  return jsonSuccess("探访预约已删除", { visit });
+}

app/api/family/visits/route.ts

@@ -0,0 +1,39 @@
+import { jsonFailure, jsonSuccess, readJsonBody } from "@/modules/core/server/api";
+import { recordAuditLog } from "@/modules/core/server/audit";
+import { requirePermission } from "@/modules/core/server/auth";
+import { createFamilyVisit, isFamilyMutationFailure } from "@/modules/family/server/operations";
+import { validateFamilyVisitInput } from "@/modules/family/types";
+
+export async function POST(request: Request): Promise<Response> {
+  const auth = await requirePermission("family:manage", { action: "family.visit.create", targetType: "family_visit" });
+  if (!auth.success) {
+    return auth.response;
+  }
+
+  const organizationId = auth.context.organization?.id;
+  if (!organizationId) {
+    return jsonFailure("请选择机构后维护探访预约", 400);
+  }
+
+  const input = validateFamilyVisitInput(await readJsonBody(request));
+  if (!input.success) {
+    return jsonFailure(input.reason);
+  }
+
+  const visit = await createFamilyVisit({ ...input.data, organizationId, accountId: auth.context.account.id });
+  if (isFamilyMutationFailure(visit)) {
+    return jsonFailure(visit.reason, visit.status);
+  }
+
+  await recordAuditLog({
+    actor: auth.context.account,
+    organizationId,
+    action: "family.visit.create",
+    targetType: "family_visit",
+    targetId: visit.id,
+    result: "success",
+    reason: `创建探访预约：${visit.elderName}`,
+  });
+
+  return jsonSuccess("探访预约已创建", { visit }, 201);
+}

app/api/notices/[id]/route.ts

@@ -0,0 +1,94 @@
+import { jsonFailure, jsonSuccess, readJsonBody } from "@/modules/core/server/api";
+import { recordAuditLog } from "@/modules/core/server/audit";
+import { requirePermission } from "@/modules/core/server/auth";
+import { deleteNotice, isNoticeMutationFailure, markNoticeRead, updateNotice } from "@/modules/notices/server/operations";
+import { validateNoticeInput } from "@/modules/notices/types";
+
+type RouteContext = {
+  params: Promise<{ id: string }>;
+};
+
+export async function PATCH(request: Request, context: RouteContext): Promise<Response> {
+  const { id } = await context.params;
+  const auth = await requirePermission("notice:manage", { action: "notice.update", targetType: "notice", targetId: id });
+  if (!auth.success) {
+    return auth.response;
+  }
+
+  const organizationId = auth.context.organization?.id;
+  if (!organizationId) {
+    return jsonFailure("请选择机构后维护公告", 400);
+  }
+
+  const input = validateNoticeInput(await readJsonBody(request));
+  if (!input.success) {
+    return jsonFailure(input.reason);
+  }
+
+  const notice = await updateNotice({ ...input.data, id, organizationId, accountId: auth.context.account.id });
+  if (isNoticeMutationFailure(notice)) {
+    return jsonFailure(notice.reason, notice.status);
+  }
+
+  await recordAuditLog({
+    actor: auth.context.account,
+    organizationId,
+    action: "notice.update",
+    targetType: "notice",
+    targetId: notice.id,
+    result: "success",
+    reason: `更新公告：${notice.title}`,
+  });
+
+  return jsonSuccess("公告已更新", { notice });
+}
+
+export async function POST(_request: Request, context: RouteContext): Promise<Response> {
+  const { id } = await context.params;
+  const auth = await requirePermission("notice:read", { action: "notice.read", targetType: "notice", targetId: id });
+  if (!auth.success) {
+    return auth.response;
+  }
+
+  const organizationId = auth.context.organization?.id;
+  if (!organizationId) {
+    return jsonFailure("请选择机构后查看公告", 400);
+  }
+
+  const notice = await markNoticeRead({ id, organizationId, accountId: auth.context.account.id });
+  if (isNoticeMutationFailure(notice)) {
+    return jsonFailure(notice.reason, notice.status);
+  }
+
+  return jsonSuccess("公告已标记已读", { notice });
+}
+
+export async function DELETE(_request: Request, context: RouteContext): Promise<Response> {
+  const { id } = await context.params;
+  const auth = await requirePermission("notice:manage", { action: "notice.delete", targetType: "notice", targetId: id });
+  if (!auth.success) {
+    return auth.response;
+  }
+
+  const organizationId = auth.context.organization?.id;
+  if (!organizationId) {
+    return jsonFailure("请选择机构后维护公告", 400);
+  }
+
+  const notice = await deleteNotice({ id, organizationId });
+  if (isNoticeMutationFailure(notice)) {
+    return jsonFailure(notice.reason, notice.status);
+  }
+
+  await recordAuditLog({
+    actor: auth.context.account,
+    organizationId,
+    action: "notice.delete",
+    targetType: "notice",
+    targetId: notice.id,
+    result: "success",
+    reason: `删除公告：${notice.title}`,
+  });
+
+  return jsonSuccess("公告已删除", { notice });
+}

app/api/notices/route.ts

@@ -0,0 +1,54 @@
+import { jsonFailure, jsonSuccess, readJsonBody } from "@/modules/core/server/api";
+import { recordAuditLog } from "@/modules/core/server/audit";
+import { requirePermission } from "@/modules/core/server/auth";
+import { createNotice, isNoticeMutationFailure, listNoticeCenterData } from "@/modules/notices/server/operations";
+import { validateNoticeInput } from "@/modules/notices/types";
+
+export async function GET(): Promise<Response> {
+  const auth = await requirePermission("notice:read", { action: "notice.list", targetType: "notice" });
+  if (!auth.success) {
+    return auth.response;
+  }
+
+  const organizationId = auth.context.organization?.id;
+  if (!organizationId) {
+    return jsonFailure("请选择机构后查看公告", 400);
+  }
+
+  const data = await listNoticeCenterData(organizationId, auth.context.account.id);
+  return jsonSuccess("公告通知已加载", { data });
+}
+
+export async function POST(request: Request): Promise<Response> {
+  const auth = await requirePermission("notice:manage", { action: "notice.create", targetType: "notice" });
+  if (!auth.success) {
+    return auth.response;
+  }
+
+  const organizationId = auth.context.organization?.id;
+  if (!organizationId) {
+    return jsonFailure("请选择机构后维护公告", 400);
+  }
+
+  const input = validateNoticeInput(await readJsonBody(request));
+  if (!input.success) {
+    return jsonFailure(input.reason);
+  }
+
+  const notice = await createNotice({ ...input.data, organizationId, accountId: auth.context.account.id });
+  if (isNoticeMutationFailure(notice)) {
+    return jsonFailure(notice.reason, notice.status);
+  }
+
+  await recordAuditLog({
+    actor: auth.context.account,
+    organizationId,
+    action: "notice.create",
+    targetType: "notice",
+    targetId: notice.id,
+    result: "success",
+    reason: `创建公告：${notice.title}`,
+  });
+
+  return jsonSuccess("公告已创建", { notice }, 201);
+}