@nocobase/app-template-default 1.0.0-beta.70 → 1.0.0-beta.72

package/AGENTS.md

@@ -109,7 +109,7 @@ For any UI work, start with [the frontend workflow](.agents/skills/nocobase-app-
 
 `client/routing/`, `client/layouts/`, `client/theme/`, the server entry points, the `package.json` scripts that call `nocobase`, and the tsconfigs are the scaffolding the template provides. It is still this application's own source — it shipped to the user and they may change it — but it is the part the template evolves, so an edit there is what a future upgrade has to reconcile.
 
-Prefer the mechanism the system already provides. Declare a page in `client/routes.ts` and add `navigation` when it needs a menu entry. Refine resources add no menu entries and, with no data provider registered, load nothing; pages load data through `useApiClient`. A page uses `authz` to restrict access; a plugin page is customized through an option or an override. Before editing the shell to add a menu, check the route and its `navigation` declaration.
+Prefer the mechanism the system already provides. Declare a page in `client/routes.ts` and add `navigation` when it needs a menu entry; pages load data through `useApiClient`. A page uses `authz` to restrict access; a plugin page is customized through an option or an override. Before editing the shell to add a menu, check the route and its `navigation` declaration.
 
 When the built-in mechanism genuinely cannot express what is being asked, changing this structure is a legitimate answer — not a last resort to apologize for. Do it deliberately, and leave the next agent enough to work with:
 

package/README.MD

@@ -1,6 +1,6 @@
 # NocoBase 3 Application
 
-A full-stack NocoBase 3 application. The server runs on `@nocobase/app-server` and the browser client is React with Refine, shadcn/ui, and Tailwind CSS.
+A full-stack NocoBase 3 application. The server runs on `@nocobase/app-server` and the browser client is React with shadcn/ui and Tailwind CSS.
 
 You own everything in this directory. Add pages, API routes, database tables, and business logic directly here — this is your application's source code, not a framework you extend from the outside.
 

package/client/components/permission-editor.tsx

@@ -126,7 +126,7 @@ function LevelControl({
   if (levels.length === 0) return null;
   if (levels.length === 1)
     return (
-      <span className='block truncate px-2.5 text-sm text-muted-foreground'>
+      <span className='flex min-h-7 min-w-0 items-center px-2 text-xs text-muted-foreground'>
         {levels[0]?.label}
       </span>
     );
@@ -141,7 +141,7 @@ function LevelControl({
     >
       <SelectTrigger
         size='sm'
-        className='h-6 w-auto max-w-48 gap-1 border-0 bg-muted/50 px-2 text-xs shadow-none'
+        className='h-7 w-full min-w-0 max-w-full flex-1 gap-1 border-0 bg-muted/50 px-2 text-xs shadow-none'
         aria-label={label}
       >
         <SelectValue />
@@ -162,6 +162,7 @@ function LevelControl({
 function PermissionRow({
   row,
   controlId,
+  showScopeLabels = false,
   readOnly,
   labels,
   onEnabledChange,
@@ -169,6 +170,7 @@ function PermissionRow({
 }: {
   readonly row: PermissionEditorRow;
   readonly controlId: string;
+  readonly showScopeLabels?: boolean;
   readonly readOnly: boolean;
   readonly labels: PermissionEditorLabels;
   readonly onEnabledChange: (rowId: string, enabled: boolean) => void;
@@ -179,7 +181,7 @@ function PermissionRow({
       data-slot='permission-row'
       className='flex min-w-0 flex-col gap-1 rounded-md px-2 py-1.5'
     >
-      <div className='flex min-h-6 min-w-0 flex-wrap items-center gap-2'>
+      <div className='grid min-h-6 min-w-0 grid-cols-[auto_auto_minmax(0,1fr)] items-center gap-x-2 @2xl:grid-cols-[auto_minmax(0,1fr)] gap-y-1'>
         <Checkbox
           id={controlId}
           checked={row.enabled}
@@ -189,35 +191,45 @@ function PermissionRow({
         />
         <label
           htmlFor={controlId}
-          className='min-w-0 cursor-pointer text-sm leading-5 font-medium break-words'
+          className='min-h-6 min-w-0 max-w-36 cursor-pointer text-sm leading-6 font-medium break-words @2xl:max-w-none'
         >
           {row.label}
         </label>
         {row.enabled && row.levels ? (
-          <LevelControl
-            label={labels.levelFor(row.label)}
-            levels={row.levels}
-            value={row.level ?? ''}
-            disabled={readOnly}
-            onChange={(level) => onLevelChange(row.id, level)}
-          />
+          <div className='col-start-3 min-w-0 @2xl:col-start-2'>
+            <LevelControl
+              label={labels.levelFor(row.label)}
+              levels={row.levels}
+              value={row.level ?? ''}
+              disabled={readOnly}
+              onChange={(level) => onLevelChange(row.id, level)}
+            />
+          </div>
         ) : null}
         {row.enabled &&
           row.scopes?.map((scope) => (
-            <div key={scope.id} className='flex min-w-0 items-center gap-1'>
-              {row.scopes && row.scopes.length > 1 && (
-                <span className='text-xs text-muted-foreground'>
+            <div
+              key={scope.id}
+              className={cn(
+                'col-start-3 grid min-w-0 gap-1 @2xl:col-start-2',
+                showScopeLabels && 'col-span-2 col-start-2 @2xl:col-span-1',
+              )}
+            >
+              {(showScopeLabels || (row.scopes && row.scopes.length > 1)) && (
+                <span className='text-xs leading-5 text-muted-foreground'>
                   {scope.label}
                 </span>
               )}
-              <LevelControl
-                label={labels.levelFor(`${row.label} · ${scope.label}`)}
-                levels={scope.levels}
-                value={scope.level ?? ''}
-                disabled={readOnly}
-                onChange={(level) => onLevelChange(scope.id, level)}
-              />
-              {scope.configuration}
+              <div className='flex min-h-7 min-w-0 items-center gap-1'>
+                <LevelControl
+                  label={labels.levelFor(`${row.label} · ${scope.label}`)}
+                  levels={scope.levels}
+                  value={scope.level ?? ''}
+                  disabled={readOnly}
+                  onChange={(level) => onLevelChange(scope.id, level)}
+                />
+                {scope.configuration}
+              </div>
             </div>
           ))}
       </div>
@@ -280,7 +292,7 @@ export function PermissionEditor({
   return (
     <div className='@container flex min-w-0 flex-col overflow-hidden rounded-xl border bg-card'>
       <div className='flex flex-wrap items-center gap-3 border-b p-3'>
-        <div className='relative min-w-0 flex-1'>
+        <div className='relative min-w-48 flex-1'>
           <SearchIcon
             aria-hidden
             className='pointer-events-none absolute top-1/2 left-3 size-4 -translate-y-1/2 text-muted-foreground'
@@ -296,7 +308,7 @@ export function PermissionEditor({
         </div>
         <label
           htmlFor={`${id}-enabled`}
-          className='flex items-center gap-2 text-sm'
+          className='flex shrink-0 items-center gap-2 text-sm whitespace-nowrap'
         >
           <Switch
             id={`${id}-enabled`}
@@ -322,7 +334,7 @@ export function PermissionEditor({
       <div className='flex max-h-128 min-w-0 flex-col overflow-auto @2xl:flex-row'>
         <nav
           aria-label={words.navigation}
-          className='flex shrink-0 gap-1 overflow-x-auto border-b bg-muted/25 p-2 @2xl:sticky @2xl:top-0 @2xl:max-h-128 @2xl:w-48 @2xl:self-start @2xl:flex-col @2xl:border-r @2xl:border-b-0'
+          className='flex shrink-0 gap-1 overflow-x-auto border-b bg-muted/25 p-2 @2xl:sticky @2xl:top-0 @2xl:max-h-128 @2xl:w-64 @2xl:self-start @2xl:flex-col @2xl:border-r @2xl:border-b-0'
         >
           {sections.map((section) => {
             const rows = section.groups.flatMap((group) => group.rows);
@@ -338,13 +350,18 @@ export function PermissionEditor({
                   setEnabledOnly(false);
                 }}
                 className={cn(
-                  'h-auto shrink-0 justify-between gap-4 px-3 py-2.5 text-left whitespace-normal',
+                  'h-auto shrink-0 justify-between gap-3 px-3 py-2 text-left whitespace-nowrap @2xl:w-full @2xl:min-w-0',
                   section.id === active &&
                     'bg-primary/10 text-primary hover:bg-primary/15',
                 )}
               >
-                <span>{section.title}</span>
-                <span className='rounded-md bg-background px-1.5 py-0.5 text-xs tabular-nums'>
+                <span
+                  className='min-w-0 @2xl:flex-1 @2xl:truncate'
+                  title={section.title}
+                >
+                  {section.title}
+                </span>
+                <span className='shrink-0 rounded-md bg-background px-1.5 py-0.5 text-xs tabular-nums'>
                   {rows.filter((row) => row.enabled).length}/{rows.length}
                 </span>
               </Button>
@@ -357,6 +374,9 @@ export function PermissionEditor({
               const original =
                 sections.find((item) => item.id === section.id) ?? section;
               const singleResource = original.groups.length === 1;
+              const showScopeLabels = original.groups.some((group) =>
+                group.rows.some((row) => (row.scopes?.length ?? 0) > 1),
+              );
               const keys = [
                 ...new Set(
                   original.groups
@@ -369,16 +389,30 @@ export function PermissionEditor({
                 ...common.filter((key) => keys.includes(key)),
                 ...keys.filter((key) => !common.includes(key)),
               ];
-              // Dense or unclassified catalogs keep the wrapping layout instead of hiding actions.
               const aligned =
                 columns.length > 0 &&
-                columns.length <= 7 &&
+                columns.length <= 4 &&
                 original.groups.every(
                   (group) =>
                     group.rows.every((row) => row.actionKey) &&
                     new Set(group.rows.map((row) => row.actionKey)).size ===
                       group.rows.length,
                 );
+              // Keep action columns only when each has room for its label and scope.
+              const alignment = [
+                '',
+                '@3xl:grid-cols-(--permission-columns)',
+                '@3xl:grid-cols-(--permission-columns)',
+                '@5xl:grid-cols-(--permission-columns)',
+                '@7xl:grid-cols-(--permission-columns)',
+              ][columns.length];
+              const placement = [
+                '',
+                '@3xl:col-start-(--permission-column) @3xl:row-start-1',
+                '@3xl:col-start-(--permission-column) @3xl:row-start-1',
+                '@5xl:col-start-(--permission-column) @5xl:row-start-1',
+                '@7xl:col-start-(--permission-column) @7xl:row-start-1',
+              ][columns.length];
               return (
                 <section
                   key={section.id}
@@ -430,11 +464,11 @@ export function PermissionEditor({
                       return (
                         <div
                           key={group.id}
-                          className='grid min-w-0 gap-2 p-3 @xl:grid-cols-[minmax(8rem,1fr)_minmax(0,4fr)]'
+                          className='grid min-w-0 gap-2 p-3 @3xl:grid-cols-[9rem_minmax(0,1fr)]'
                           data-slot='permission-resource'
                         >
-                          <div className='flex min-w-0 flex-col justify-center gap-1'>
-                            <h3 className='text-sm font-medium break-words'>
+                          <div className='flex min-w-0 flex-col gap-1 py-1.5'>
+                            <h3 className='min-h-6 text-sm leading-6 font-medium break-words'>
                               {group.title ?? section.title}
                             </h3>
                             {group.hint && (
@@ -442,7 +476,12 @@ export function PermissionEditor({
                                 {group.hint}
                               </p>
                             )}
-                            <div className='flex items-center gap-2 text-xs text-muted-foreground'>
+                            <div
+                              className={cn(
+                                'flex min-h-7 items-center gap-2 text-xs text-muted-foreground',
+                                showScopeLabels && '@3xl:mt-6',
+                              )}
+                            >
                               {onEnabledBatchChange &&
                                 totalRows.length > 1 &&
                                 selectable.length > 0 && (
@@ -514,9 +553,8 @@ export function PermissionEditor({
                           </div>
                           <div
                             className={cn(
-                              'flex min-w-0 flex-wrap items-start gap-x-3 gap-y-1',
-                              aligned &&
-                                '@4xl:grid @4xl:grid-cols-(--permission-columns) @4xl:gap-x-1',
+                              'grid min-w-0 grid-cols-[repeat(auto-fill,minmax(min(100%,14rem),1fr))] items-start gap-x-2 gap-y-1',
+                              aligned && alignment,
                             )}
                             style={
                               {
@@ -524,42 +562,42 @@ export function PermissionEditor({
                               } as CSSProperties
                             }
                           >
-                            {(aligned
-                              ? [...group.rows].sort(
-                                  (a, b) =>
-                                    columns.indexOf(a.actionKey ?? '') -
-                                    columns.indexOf(b.actionKey ?? ''),
-                                )
-                              : group.rows
-                            ).map((row) => (
-                              <div
-                                key={row.id}
-                                className={cn(
-                                  'min-w-0',
-                                  aligned &&
-                                    '@4xl:col-start-(--permission-column) @4xl:row-start-1',
-                                )}
-                                style={
-                                  {
-                                    '--permission-column':
-                                      columns.indexOf(row.actionKey ?? '') + 1,
-                                  } as CSSProperties
-                                }
-                              >
-                                <PermissionRow
-                                  controlId={`${id}-${row.id}`}
-                                  row={row}
-                                  readOnly={readOnly}
-                                  labels={words}
-                                  onEnabledChange={(rowId, on) => {
-                                    if (enabledOnly && !on)
-                                      searchRef.current?.focus();
-                                    onEnabledChange(rowId, on);
-                                  }}
-                                  onLevelChange={onLevelChange}
-                                />
-                              </div>
-                            ))}
+                            {[...group.rows]
+                              .sort(
+                                (a, b) =>
+                                  columns.indexOf(a.actionKey ?? '') -
+                                  columns.indexOf(b.actionKey ?? ''),
+                              )
+                              .map((row) => (
+                                <div
+                                  key={row.id}
+                                  className={cn(
+                                    'min-w-0',
+                                    aligned && placement,
+                                  )}
+                                  style={
+                                    {
+                                      '--permission-column':
+                                        columns.indexOf(row.actionKey ?? '') +
+                                        1,
+                                    } as CSSProperties
+                                  }
+                                >
+                                  <PermissionRow
+                                    controlId={`${id}-${row.id}`}
+                                    row={row}
+                                    showScopeLabels={showScopeLabels}
+                                    readOnly={readOnly}
+                                    labels={words}
+                                    onEnabledChange={(rowId, on) => {
+                                      if (enabledOnly && !on)
+                                        searchRef.current?.focus();
+                                      onEnabledChange(rowId, on);
+                                    }}
+                                    onLevelChange={onLevelChange}
+                                  />
+                                </div>
+                              ))}
                           </div>
                         </div>
                       );

package/client/locales/system/settings-en-US.ts

@@ -97,6 +97,7 @@ const settings = {
   selectAllPermissions: 'All',
   selectVisiblePermissions: 'Select visible permissions in {{name}}',
   permissionSummary: '{{enabled}} of {{total}} enabled',
+  preservedRecordScope: 'Keep existing configuration',
   noRecordScope: 'No records (not authorized)',
   permissionFilter: {
     limit: 'Up to 20 conditions',

package/client/locales/system/settings-zh-CN.ts

@@ -88,18 +88,19 @@ const settings = {
   total_other: '共 {{count}} 位用户',
   access: '访问',
   permissionSearch: '搜索分类、分组或权限',
-  enabledOnly: '仅看已开启',
+  enabledOnly: '仅显示已授权',
   noPermissions: '暂无可配置权限',
   permissionCategories: '权限分类',
   selectAllPermissions: '全选',
   selectVisiblePermissions: '选择“{{name}}”中显示的权限',
-  permissionSummary: '已开启 {{enabled}} / {{total}}',
-  noRecordScope: '无记录（未授权）',
+  permissionSummary: '已授权 {{enabled}} / {{total}}',
+  noRecordScope: '不允许访问数据',
+  preservedRecordScope: '保留现有配置',
   permissionFilter: {
     limit: '最多支持 20 个条件',
-    configure: '筛选条件',
-    title: '配置记录筛选',
-    description: '应用条件后还需保存角色，权限才会生效。',
+    configure: '设置条件',
+    title: '设置数据范围',
+    description: '仅允许访问符合以下条件的数据，保存角色后生效。',
     all: '满足全部条件',
     any: '满足任一条件',
     field: '字段',

package/client/pages/settings/page-permissions.ts

@@ -24,19 +24,28 @@ export function pagePermissionResources(
   titles: PagePermissionTitles,
   unnamed: (path: string) => string,
 ): CatalogResource[] {
-  return routes.flatMap((route) => [
-    ...(route.componentLoader &&
-    typeof route.authz === 'object' &&
-    route.authz.resource.type === 'page'
-      ? [
-          {
+  const resources = new Map<string, CatalogResource>();
+  const visit = (items: readonly AppClientRegisteredRoute[]): void => {
+    for (const route of items) {
+      if (
+        route.componentLoader &&
+        typeof route.authz === 'object' &&
+        route.authz.resource.type === 'page'
+      ) {
+        const id = route.authz.resource.id;
+        // Resolved child routes may inherit the parent's authorization resource.
+        // They share one grant, so showing independent checkboxes is misleading.
+        if (!resources.has(id))
+          resources.set(id, {
             type: 'page',
-            id: route.authz.resource.id,
+            id,
             title: pagePermissionTitle(route, titles) ?? unnamed(route.path),
             actions: [{ name: 'access', title: { key: 'settings.access' } }],
-          },
-        ]
-      : []),
-    ...pagePermissionResources(route.children ?? [], titles, unnamed),
-  ]);
+          });
+      }
+      visit(route.children ?? []);
+    }
+  };
+  visit(routes);
+  return [...resources.values()];
 }

package/client/pages/settings/permissions-model.ts

@@ -17,6 +17,15 @@ export function setPermission(
   action: string,
   enabled: boolean,
 ): readonly PermissionGrant[] {
+  const existing =
+    grants
+      .find(
+        (grant) =>
+          grant.resource.type === resource.type &&
+          grant.resource.id === resource.id,
+      )
+      ?.actions.some((entry) => entry.action === action) ?? false;
+  if (existing === enabled) return grants;
   const next = grants.map((grant) => ({
     ...grant,
     actions: [...grant.actions],
@@ -87,40 +96,55 @@ export function permissionSections(
             return {
               ...row,
               scopes: granted
-                ? (resource.dataScopes?.[action.name] ?? []).map((scope) => ({
-                    id: JSON.stringify([
-                      resource.type,
-                      resource.id,
-                      action.name,
-                      scope.key,
-                    ]),
-                    label: text(
-                      typeof scope.title === 'string' &&
-                        scope.title === scope.collection
-                        ? { key: 'settings.recordScope' }
-                        : scope.title,
-                    ),
-                    levels: [
-                      {
-                        value: '',
-                        label: text({ key: 'settings.noRecordScope' }),
-                      },
-                      ...scope.recordAccess.map((key) => ({
-                        value: key,
-                        label: text(
-                          catalog.recordAccess.find(
-                            (entry) => entry.key === key,
-                          )?.title ?? key,
-                        ),
-                      })),
-                    ],
-                    level: scopeSelectionKey(
+                ? (resource.dataScopes?.[action.name] ?? []).map((scope) => {
+                    const value = scopeSelectionKey(
                       granted.policy?.scopes &&
                         typeof granted.policy.scopes === 'object'
                         ? Reflect.get(granted.policy.scopes, scope.key)
                         : undefined,
-                    ),
-                  }))
+                    );
+                    const preserved =
+                      value !== '' && !scope.recordAccess.includes(value);
+                    return {
+                      id: JSON.stringify([
+                        resource.type,
+                        resource.id,
+                        action.name,
+                        scope.key,
+                      ]),
+                      label: text(
+                        typeof scope.title === 'string' &&
+                          scope.title === scope.collection
+                          ? { key: 'settings.recordScope' }
+                          : scope.title,
+                      ),
+                      levels: [
+                        ...(preserved
+                          ? [
+                              {
+                                value,
+                                label: text({
+                                  key: 'settings.preservedRecordScope',
+                                }),
+                              },
+                            ]
+                          : []),
+                        {
+                          value: '',
+                          label: text({ key: 'settings.noRecordScope' }),
+                        },
+                        ...scope.recordAccess.map((key) => ({
+                          value: key,
+                          label: text(
+                            catalog.recordAccess.find(
+                              (entry) => entry.key === key,
+                            )?.title ?? key,
+                          ),
+                        })),
+                      ],
+                      level: value,
+                    };
+                  })
                 : [],
             };
           }),
@@ -136,6 +160,11 @@ export function setScope(
   value: unknown,
 ): readonly PermissionGrant[] {
   const [type, id, action, scope] = JSON.parse(rowId) as string[];
+  if (
+    typeof value === 'string' &&
+    scopeSelectionKey(getScopeSelection(grants, rowId)) === value
+  )
+    return grants;
   return grants.map((grant) =>
     grant.resource.type !== type || grant.resource.id !== id
       ? grant
@@ -216,7 +245,7 @@ function scopeSelectionKey(value: unknown): string {
     typeof Reflect.get(value, 'key') === 'string'
   )
     return String(Reflect.get(value, 'key'));
-  return '';
+  return value == null || value === '' ? '' : '__preserved_scope__';
 }
 
 /** Legacy bare custom-filter keys require configuration before saving. */

package/client/service-provider.ts

@@ -19,7 +19,6 @@ export class DefaultClientServiceProvider extends ServiceProvider<ClientApplicat
       typeof configuredTitle === 'string' && configuredTitle.trim()
         ? configuredTitle.trim()
         : 'NocoBase';
-    this.app.refine.setOptions({ title: { text: title } });
     this.previousDocumentTitle = document.title;
     document.title = title;
     return Promise.resolve();

package/config.example.yml

@@ -22,6 +22,26 @@
 #     max: 600
 #     window: 1m
 
+# Realtime events are transient and local to this process. Clients refetch after subscription acknowledgement.
+# realtime:
+#   adapter: inMemory # Use redis for multiple application processes.
+#   redis:
+#     connection:
+#       host: 127.0.0.1
+#       port: 6379
+#   namespace: my-app # Defaults to the application name; keep applications isolated.
+#   authorizationTimeoutMs: 5000
+#   sessionCheckIntervalMs: 30000
+#   limits:
+#     maxConcurrentAuthorizations: 256
+#     maxPendingAuthorizations: 2048
+#     maxRecentEventIds: 10000
+#     maxConnections: 10000
+#     maxMessageBytes: 65536
+#     maxSubscriptionsPerConnection: 64
+#     maxBufferedBytesPerConnection: 1048576
+#     maxPendingMessagesPerConnection: 64
+
 # Values under client are public and embedded in the SPA HTML.
 client:
   app:

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@nocobase/app-template-default",
   "displayName": "Default Template",
-  "version": "1.0.0-beta.70",
+  "version": "1.0.0-beta.72",
   "type": "module",
   "prettier": "@nocobase/dev-config/prettier",
   "engines": {
@@ -9,7 +9,7 @@
   },
   "nocobase": {
     "templateKind": "app",
-    "defaultTemplateVersion": "1.0.0-beta.70"
+    "defaultTemplateVersion": "1.0.0-beta.72"
   },
   "devDependencies": {
     "@ai-sdk/react": "2.0.0",
@@ -17,11 +17,6 @@
     "@dicebear/core": "^9.4.3",
     "@hookform/resolvers": "^5.0.1",
     "@playwright/test": "^1.62.1",
-    "@refinedev/cli": "^2.16.48",
-    "@refinedev/core": "^5.0.8",
-    "@refinedev/react-hook-form": "^5.0.0",
-    "@refinedev/react-router": "^2.0.0",
-    "@refinedev/react-table": "^6.0.0",
     "@silurus/ooxml": "0.85.1",
     "@tailwindcss/postcss": "^4.1.4",
     "@tailwindcss/vite": "^4.1.8",
@@ -77,15 +72,15 @@
     "tar": "^7.5.22",
     "@xyflow/react": "^12.11.5",
     "elkjs": "^0.10.2",
-    "@nocobase/app-client": "^3.0.0-beta.2",
+    "@nocobase/app-client": "^4.0.0-beta.0",
     "@nocobase/app-plugin-template-print": "0.0.2-beta.2",
-    "@nocobase/app-skills": "0.1.0-beta.38",
-    "@nocobase/app-testing": "0.1.0-beta.4",
-    "@nocobase/app-websocket": "^0.0.2-beta.0",
-    "@nocobase/dev-config": "0.1.0-beta.23",
-    "@nocobase/drive": "^0.1.0-beta.6",
-    "@nocobase/session": "^0.1.0-beta.3",
-    "@nocobase/logging": "^0.1.0-beta.7"
+    "@nocobase/app-skills": "0.1.0-beta.40",
+    "@nocobase/app-testing": "0.1.0-beta.5",
+    "@nocobase/app-websocket": "^0.1.0-beta.1",
+    "@nocobase/dev-config": "0.1.0-beta.24",
+    "@nocobase/drive": "^0.1.0-beta.7",
+    "@nocobase/logging": "^0.1.0-beta.7",
+    "@nocobase/session": "^0.1.0-beta.3"
   },
   "files": [
     ".prettierignore",
@@ -144,35 +139,36 @@
     "@oclif/core": "^4.14.0",
     "better-auth": "1.7.5",
     "hono": "^4.13.2",
-    "@nocobase/app-plugin-api-keys": "^1.0.0-beta.17",
-    "@nocobase/app-plugin-authentication": "^2.0.0-beta.10",
-    "@nocobase/app-plugin-authorization": "^1.0.0-beta.28",
-    "@nocobase/app-plugin-database-explorer": "^1.0.0-beta.15",
-    "@nocobase/app-plugin-file": "^1.0.0-beta.24",
-    "@nocobase/app-plugin-i18n": "^1.0.0-beta.16",
-    "@nocobase/app-plugin-mail": "^1.0.0-beta.14",
-    "@nocobase/app-plugin-notification": "^1.0.0-beta.27",
-    "@nocobase/app-plugin-notification-in-app": "^1.0.0-beta.25",
-    "@nocobase/app-plugin-notification-providers": "^0.2.0-beta.12",
-    "@nocobase/app-plugin-scheduler": "^1.0.0-beta.17",
-    "@nocobase/app-plugin-users": "^2.0.0-beta.5",
-    "@nocobase/app-server": "^2.0.0-beta.8",
+    "@nocobase/app-plugin-api-keys": "^1.0.0-beta.18",
+    "@nocobase/app-plugin-authentication": "^2.0.0-beta.11",
+    "@nocobase/app-plugin-authorization": "^1.0.0-beta.29",
+    "@nocobase/app-plugin-database-explorer": "^1.0.0-beta.16",
+    "@nocobase/app-plugin-file": "^1.0.0-beta.25",
+    "@nocobase/app-plugin-i18n": "^1.0.0-beta.17",
+    "@nocobase/app-plugin-mail": "^1.0.0-beta.15",
+    "@nocobase/app-plugin-notification": "^1.0.0-beta.28",
+    "@nocobase/app-plugin-notification-in-app": "^1.0.0-beta.26",
+    "@nocobase/app-plugin-notification-providers": "^0.2.0-beta.13",
+    "@nocobase/app-plugin-scheduler": "^1.0.0-beta.18",
+    "@nocobase/app-plugin-users": "^2.0.0-beta.6",
+    "@nocobase/app-server": "^3.0.0-beta.0",
     "@nocobase/config": "^0.1.0-beta.3",
     "@nocobase/db": "^1.0.0-beta.21",
     "@nocobase/db-sqlite": "^0.1.0-beta.6",
     "@nocobase/service-provider": "^0.0.2-beta.2",
     "@nocobase/snowflake": "^1.0.0-beta.4",
-    "@nocobase/app-plugin-authz-default-access": "^1.0.0-beta.13",
-    "@nocobase/app-plugin-authz-sharing-rules": "^1.0.0-beta.13",
-    "@nocobase/app-plugin-authz-restriction-rules": "^1.0.0-beta.12",
+    "@nocobase/app-plugin-authz-default-access": "^1.0.0-beta.14",
+    "@nocobase/app-plugin-authz-sharing-rules": "^1.0.0-beta.14",
+    "@nocobase/app-plugin-authz-restriction-rules": "^1.0.0-beta.13",
     "@nocobase/authorization": "^1.0.0-beta.14",
     "@nocobase/queue": "^0.1.0-beta.9",
     "@nocobase/jobs": "^0.1.0-beta.3",
     "@nocobase/lifecycle": "^0.1.0-beta.2",
-    "@nocobase/i18n": "^1.0.0-beta.7",
+    "@nocobase/i18n": "^2.0.0-beta.0",
     "@nocobase/caching": "^0.1.0-beta.3",
     "@nocobase/repository-input": "^0.1.0-beta.3",
-    "@nocobase/app-cli": "^1.0.0-beta.24"
+    "@nocobase/app-cli": "^1.0.0-beta.25",
+    "@nocobase/realtime": "^0.1.0-beta.3"
   },
   "description": "NocoBase 3 application template with the standard product capabilities.",
   "imports": {

package/tests/components/app-title.test.tsx

@@ -17,9 +17,6 @@ describe('application title', () => {
 
     await app.start();
 
-    expect(app.refineConfig.options?.title).toEqual({
-      text: 'Configured application',
-    });
     expect(document.title).toBe('Configured application');
 
     await app.shutdown();
@@ -33,7 +30,6 @@ describe('application title', () => {
 
     await app.start();
 
-    expect(app.refineConfig.options?.title).toEqual({ text: 'NocoBase' });
     expect(document.title).toBe('NocoBase');
 
     await app.shutdown();

package/tests/components/inbox.test.tsx

@@ -20,7 +20,11 @@ vi.mock('@nocobase/app-plugin-authentication/client', () => ({
 vi.mock('@nocobase/app-client', async (importOriginal) => {
   const actual = await importOriginal<typeof import('@nocobase/app-client')>();
   const client = { request: mocks.request };
-  const realtime = { subscribe: () => vi.fn(), onOpen: () => vi.fn() };
+  const realtime = {
+    watch: () => ({ close: vi.fn() }),
+    subscribe: () => vi.fn(),
+    onOpen: () => vi.fn(),
+  };
   return {
     ...actual,
     useApiClient: () => client,

package/tests/components/permission-editor.test.tsx

@@ -475,3 +475,65 @@ it('aligns semantic actions across resources without dropping special or filtere
     view.container.querySelectorAll('[data-slot=permission-row]'),
   ).toHaveLength(1);
 });
+
+it('keeps scope captions consistent in a category with multiple data ranges, including when filtered', async () => {
+  const level = [{ value: 'all', label: 'All records' }];
+  render(
+    <PermissionEditor
+      sections={[
+        {
+          id: 'business',
+          title: 'Business',
+          groups: [
+            {
+              id: 'quotes',
+              title: 'Quotes',
+              rows: [
+                {
+                  id: 'view',
+                  label: 'View quotes',
+                  enabled: true,
+                  scopes: [
+                    {
+                      id: 'view-records',
+                      label: 'Visible quotes',
+                      level: 'all',
+                      levels: level,
+                    },
+                  ],
+                },
+                {
+                  id: 'submit',
+                  label: 'Submit quote',
+                  enabled: true,
+                  scopes: [
+                    {
+                      id: 'submit-projects',
+                      label: 'Linked projects',
+                      level: 'all',
+                      levels: level,
+                    },
+                    {
+                      id: 'submit-quotes',
+                      label: 'Allowed quotes',
+                      level: 'all',
+                      levels: level,
+                    },
+                  ],
+                },
+              ],
+            },
+          ],
+        },
+      ]}
+      onEnabledChange={vi.fn()}
+      onLevelChange={vi.fn()}
+    />,
+  );
+  expect(screen.getByText('Visible quotes')).toBeVisible();
+  expect(screen.getByText('Linked projects')).toBeVisible();
+  expect(screen.getByText('Allowed quotes')).toBeVisible();
+  await userEvent.type(screen.getByRole('textbox'), 'View quotes');
+  expect(screen.queryByText('Linked projects')).not.toBeInTheDocument();
+  expect(screen.getByText('Visible quotes')).toBeVisible();
+});

package/tests/fixtures/theme-tokens.tsx

@@ -2,7 +2,6 @@ import {
   createAppSidebarPreferenceStore,
   SidebarPreferenceProvider,
 } from '../../client/layouts/use-sidebar-preference.js';
-import { Refine } from '@refinedev/core';
 import { createRoot } from 'react-dom/client';
 import { MemoryRouter } from 'react-router';
 import { Loading } from '../../client/components/loading';
@@ -28,90 +27,88 @@ export default function Fixture() {
   return (
     <MemoryRouter>
       <AppThemeProvider>
-        <Refine options={{ disableTelemetry: true }}>
-          <AppSidebarProvider>
-            <AppSidebar label='Fixture sidebar'>
-              <div className='p-2'>
-                <Input aria-label='Sidebar content' />
-              </div>
-            </AppSidebar>
-            <main className='min-w-0 flex-1 space-y-6 overflow-y-auto p-6'>
-              <div className='flex flex-wrap gap-2'>
-                <ThemeSettings />
-                <AppSidebarToggle />
-              </div>
-              <h1 className='text-3xl'>Theme tokens · 主题样式</h1>
-              <section
-                className='flex h-32 items-center justify-center rounded-lg border bg-background'
-                aria-label='Brand loading preview'
-              >
-                <Loading label='Loading preview' />
-              </section>
-              <p data-testid='body'>Body text · 中文内容与 English text</p>
-              <p className='font-serif'>Serif text</p>
-              <code>const theme = 'compact';</code>
-              <div className='flex flex-wrap gap-2'>
-                <Button>Default action</Button>
-                <Button size='sm'>Small action</Button>
-                <Button size='xs'>Extra small</Button>
-                <Button variant='destructive'>Delete</Button>
-              </div>
-              <Input
-                aria-label='Example input'
-                placeholder='输入内容 / Enter text'
-              />
-              <Popover>
-                <PopoverTrigger render={<Button variant='outline' />}>
-                  Open popover
-                </PopoverTrigger>
-                <PopoverContent>
-                  <PopoverTitle>Portal heading</PopoverTitle>
-                  <p>Portal body · 浮层内容</p>
-                </PopoverContent>
-              </Popover>
-              <section className='rounded-xl border bg-card p-4 text-card-foreground shadow-md ring-1 ring-ring'>
-                <h2 className='text-xl'>Card heading</h2>
-                <p className='text-sm'>
-                  A long description that wraps without clipping when fonts and
-                  spacing change. 长文本应该正常换行，不应被控件裁切。
-                </p>
-              </section>
-              <svg
-                aria-label='Chart palette'
-                viewBox='0 0 120 30'
-                className='h-8'
-              >
-                {[1, 2, 3, 4, 5].map((i) => (
-                  <rect
-                    key={i}
-                    x={(i - 1) * 24}
-                    width='20'
-                    height='30'
-                    fill={`var(--chart-${i})`}
-                  />
-                ))}
-              </svg>
-              <div className='flex flex-wrap gap-2'>
-                <div className='rounded-sm border p-2'>sm</div>
-                <div className='rounded-md border p-2'>md</div>
-                <div className='rounded-lg border p-2'>lg</div>
-                <div className='rounded-xl border p-2'>xl</div>
-                <div className='rounded-2xl border p-2'>2xl</div>
-                <div className='rounded-3xl border p-2'>3xl</div>
-                <div className='rounded-4xl border p-2'>4xl</div>
-              </div>
-              <div className='flex flex-wrap gap-4'>
-                <div className='shadow-2xs p-2'>2xs</div>
-                <div className='shadow-xs p-2'>xs</div>
-                <div className='shadow-sm p-2'>sm</div>
-                <div className='shadow-md p-2'>md</div>
-                <div className='shadow-lg p-2'>lg</div>
-                <div className='shadow-xl p-2'>xl</div>
-                <div className='shadow-2xl p-2'>2xl</div>
-              </div>
-            </main>
-          </AppSidebarProvider>
-        </Refine>
+        <AppSidebarProvider>
+          <AppSidebar label='Fixture sidebar'>
+            <div className='p-2'>
+              <Input aria-label='Sidebar content' />
+            </div>
+          </AppSidebar>
+          <main className='min-w-0 flex-1 space-y-6 overflow-y-auto p-6'>
+            <div className='flex flex-wrap gap-2'>
+              <ThemeSettings />
+              <AppSidebarToggle />
+            </div>
+            <h1 className='text-3xl'>Theme tokens · 主题样式</h1>
+            <section
+              className='flex h-32 items-center justify-center rounded-lg border bg-background'
+              aria-label='Brand loading preview'
+            >
+              <Loading label='Loading preview' />
+            </section>
+            <p data-testid='body'>Body text · 中文内容与 English text</p>
+            <p className='font-serif'>Serif text</p>
+            <code>const theme = 'compact';</code>
+            <div className='flex flex-wrap gap-2'>
+              <Button>Default action</Button>
+              <Button size='sm'>Small action</Button>
+              <Button size='xs'>Extra small</Button>
+              <Button variant='destructive'>Delete</Button>
+            </div>
+            <Input
+              aria-label='Example input'
+              placeholder='输入内容 / Enter text'
+            />
+            <Popover>
+              <PopoverTrigger render={<Button variant='outline' />}>
+                Open popover
+              </PopoverTrigger>
+              <PopoverContent>
+                <PopoverTitle>Portal heading</PopoverTitle>
+                <p>Portal body · 浮层内容</p>
+              </PopoverContent>
+            </Popover>
+            <section className='rounded-xl border bg-card p-4 text-card-foreground shadow-md ring-1 ring-ring'>
+              <h2 className='text-xl'>Card heading</h2>
+              <p className='text-sm'>
+                A long description that wraps without clipping when fonts and
+                spacing change. 长文本应该正常换行，不应被控件裁切。
+              </p>
+            </section>
+            <svg
+              aria-label='Chart palette'
+              viewBox='0 0 120 30'
+              className='h-8'
+            >
+              {[1, 2, 3, 4, 5].map((i) => (
+                <rect
+                  key={i}
+                  x={(i - 1) * 24}
+                  width='20'
+                  height='30'
+                  fill={`var(--chart-${i})`}
+                />
+              ))}
+            </svg>
+            <div className='flex flex-wrap gap-2'>
+              <div className='rounded-sm border p-2'>sm</div>
+              <div className='rounded-md border p-2'>md</div>
+              <div className='rounded-lg border p-2'>lg</div>
+              <div className='rounded-xl border p-2'>xl</div>
+              <div className='rounded-2xl border p-2'>2xl</div>
+              <div className='rounded-3xl border p-2'>3xl</div>
+              <div className='rounded-4xl border p-2'>4xl</div>
+            </div>
+            <div className='flex flex-wrap gap-4'>
+              <div className='shadow-2xs p-2'>2xs</div>
+              <div className='shadow-xs p-2'>xs</div>
+              <div className='shadow-sm p-2'>sm</div>
+              <div className='shadow-md p-2'>md</div>
+              <div className='shadow-lg p-2'>lg</div>
+              <div className='shadow-xl p-2'>xl</div>
+              <div className='shadow-2xl p-2'>2xl</div>
+            </div>
+          </main>
+        </AppSidebarProvider>
       </AppThemeProvider>
     </MemoryRouter>
   );

package/tests/logic/app-server.test.ts

@@ -423,12 +423,13 @@ describe('app server', () => {
     expect(missingEvents).toBeNull();
   });
 
-  it('subscribes, publishes, and unsubscribes realtime messages', () => {
+  it('subscribes, publishes, and unsubscribes realtime messages', async () => {
     const realtime = createRealtimeService();
+    realtime.registerTopic(TEST_REALTIME_TOPIC, { audience: 'public' });
     const websocket = createTestWebSocket();
     const connection = realtime.connect(websocket);
 
-    realtime.handleClientMessage(
+    await realtime.handleClientMessage(
       connection,
       JSON.stringify({
         type: 'subscribe',
@@ -445,7 +446,7 @@ describe('app server', () => {
       subscriptionId: expect.any(String),
     });
 
-    realtime.publish(TEST_REALTIME_TOPIC, 'tick');
+    await realtime.publish(TEST_REALTIME_TOPIC, 'tick');
 
     expect(websocket.messages[1]).toMatchObject({
       type: 'event',
@@ -454,7 +455,7 @@ describe('app server', () => {
       publishedAt: expect.any(String),
     });
 
-    realtime.handleClientMessage(
+    await realtime.handleClientMessage(
       connection,
       JSON.stringify({
         type: 'unsubscribe',
@@ -463,7 +464,7 @@ describe('app server', () => {
           .subscriptionId,
       }),
     );
-    realtime.publish(TEST_REALTIME_TOPIC, 'after unsubscribe');
+    await realtime.publish(TEST_REALTIME_TOPIC, 'after unsubscribe');
 
     expect(websocket.messages[2]).toMatchObject({
       type: 'unsubscribed',
@@ -473,7 +474,7 @@ describe('app server', () => {
     });
     expect(websocket.messages).toHaveLength(3);
 
-    realtime.close();
+    await realtime.close();
   });
 
   it('registers embedded app resources with the scope', async () => {
@@ -791,6 +792,9 @@ describe('app server', () => {
     const app = trackCloseable(
       await createIsolatedStandaloneServer({ viteDevUrl: false }),
     );
+    app.application.container
+      .resolve(realtimeServiceToken)
+      .registerTopic(TEST_REALTIME_TOPIC, { audience: 'public' });
     const serverUrl = await startStandaloneTestServer(app);
     const websocket = new WebSocket(
       `${serverUrl}${app.application.publicBasePath}/ws`,

package/tests/logic/client-runtime.test.ts

@@ -1,6 +1,6 @@
 import { createApp } from '../../client/app.js';
 import { ServiceProvider } from '@nocobase/service-provider';
-import { describe, expect, it, vi } from 'vitest';
+import { describe, expect, it } from 'vitest';
 
 import { ClientApplication, toasterToken } from '@nocobase/app-client';
 import {
@@ -47,19 +47,18 @@ describe('app client runtime', () => {
     expect(calls).toEqual([]);
   });
 
-  it('runs provider lifecycle and exposes Refine config through ClientApplication', async () => {
-    const authProvider = {
-      check: vi.fn(),
-      getIdentity: vi.fn(),
-      login: vi.fn(),
-      logout: vi.fn(),
-      onError: vi.fn(),
-    };
+  it('runs provider lifecycle through ClientApplication', async () => {
+    const calls: string[] = [];
     class Provider extends ServiceProvider<ClientApplicationType> {
       public readonly name: string = '@example/provider';
 
       public override boot(): Promise<void> {
-        this.app.refine.setAuthProvider(authProvider);
+        calls.push('boot');
+        return Promise.resolve();
+      }
+
+      public override shutdown(): Promise<void> {
+        calls.push('shutdown');
         return Promise.resolve();
       }
     }
@@ -77,8 +76,9 @@ describe('app client runtime', () => {
     });
 
     await app.start();
-    expect(app.refineConfig.authProvider).toBe(authProvider);
+    expect(calls).toEqual(['boot']);
     await app.shutdown();
+    expect(calls).toEqual(['boot', 'shutdown']);
   });
 
   it('uses the default template Application and static plugin declarations', async () => {
@@ -90,16 +90,12 @@ describe('app client runtime', () => {
     expect(app).toBeInstanceOf(ClientApplication);
     await expect(app.start()).resolves.toBeUndefined();
     expect(app.config.get('app.title')).toBe('Configured application');
-    expect(app.refineConfig.options?.title).toEqual({
-      text: 'Configured application',
-    });
     // Plugins and pages report through the registered toaster, and the mounted Toaster renders what it forwards.
     // Without either half, toasts disappear.
     expect(app.services.has(toasterToken)).toBe(true);
     expect(runtime.reactProviders).toContainEqual(
       expect.objectContaining({ name: 'toaster', layer: 'application' }),
     );
-    expect(app.refineConfig.resources ?? []).toEqual([]);
     await app.shutdown();
   });
 

package/tests/logic/page-permission-titles.test.ts

@@ -1,6 +1,7 @@
 import { describe, expect, it } from 'vitest';
 import {
   resolveAppClientContributions,
+  defineAppRoutes,
   type AppClientRegisteredRoute,
 } from '@nocobase/app-client/plugins';
 import applicationRoutes from '../../client/routes.js';
@@ -70,7 +71,7 @@ describe('page permission labels', () => {
       expect(names.has(name), `Stale permission title: ${name}`).toBe(true);
   });
 
-  it('preserves the complete application page-resource identity list', () => {
+  it('preserves each unique application page-resource identity', () => {
     const expected = pages.map((route) => {
       if (typeof route.authz !== 'object')
         throw new Error('Expected page authorization');
@@ -86,7 +87,9 @@ describe('page permission labels', () => {
         id,
         actions: actions.map((action) => action.name),
       })),
-    ).toEqual(expected);
+    ).toEqual([
+      ...new Map(expected.map((resource) => [resource.id, resource])).values(),
+    ]);
   });
 
   const fixture = () =>
@@ -221,3 +224,80 @@ describe('page permission labels', () => {
     ).toEqual([]);
   });
 });
+
+it('lists inherited and repeated page resources once while retaining independent child grants', () => {
+  const input = resolveAppClientContributions([
+    {
+      packageName: 'shared-pages',
+      source: 'application',
+      routes: defineAppRoutes([
+        {
+          name: 'repairs',
+          path: '/repairs',
+          authz: {
+            resource: { type: 'page', id: 'repairs' },
+            action: 'access',
+          },
+          navigation: { title: 'repairs.mine' },
+          componentLoader: async () => ({ default: () => null }),
+          children: [
+            {
+              name: 'repairCreate',
+              path: 'create',
+              componentLoader: async () => ({ default: () => null }),
+            },
+            {
+              name: 'repairDetail',
+              path: ':id',
+              componentLoader: async () => ({ default: () => null }),
+              children: [
+                {
+                  name: 'repairConfirm',
+                  path: 'confirm',
+                  componentLoader: async () => ({ default: () => null }),
+                },
+              ],
+            },
+            {
+              name: 'repairAudit',
+              path: 'audit',
+              authz: {
+                resource: { type: 'page', id: 'repair-audit' },
+                action: 'access',
+              },
+              navigation: { title: 'repairs.audit' },
+              componentLoader: async () => ({ default: () => null }),
+            },
+          ],
+        },
+        {
+          name: 'repairsAlias',
+          path: '/repairs-alias',
+          authz: {
+            resource: { type: 'page', id: 'repairs' },
+            action: 'access',
+          },
+          componentLoader: async () => ({ default: () => null }),
+        },
+      ]),
+    },
+  ]);
+  const before = flatten(input.routes).map(({ id, name, authz }) => ({
+    id,
+    name,
+    authz,
+  }));
+  const result = pagePermissionResources(
+    input.routes,
+    {},
+    (path) => `Unnamed (${path})`,
+  );
+  expect(result.map(({ id }) => id)).toEqual(['repairs', 'repair-audit']);
+  expect(result[0]!.title).toEqual({ key: 'repairs.mine', ns: 'shared-pages' });
+  expect(
+    flatten(input.routes).map(({ id, name, authz }) => ({ id, name, authz })),
+  ).toEqual(before);
+  expect(
+    pagePermissionResources(input.routes, {}, (path) => `Unnamed (${path})`),
+  ).toEqual(result);
+});

package/tests/logic/settings-permissions.test.ts

@@ -166,3 +166,80 @@ it('replaces a raw collection scope caption with localized data-range text', ()
     'Record scope',
   );
 });
+
+it('preserves an existing policy when enabling the same permission again', () => {
+  const original = [
+    {
+      resource: { type: 'composite', id: 'orders' },
+      actions: [
+        {
+          action: 'edit',
+          policy: {
+            type: 'composite',
+            scopes: {
+              records: {
+                type: 'recordAccess',
+                key: 'mine',
+                params: { ownerField: 'assignee' },
+              },
+            },
+            extra: true,
+          },
+        },
+      ],
+    },
+  ];
+  expect(setPermission(original, resource, 'edit', true)).toBe(original);
+  expect(
+    setScope(
+      original,
+      JSON.stringify(['composite', 'orders', 'edit', 'records']),
+      'mine',
+    ),
+  ).toBe(original);
+});
+
+it.each(['retiredScope', { type: 'legacyPolicy', filter: { owner: 'me' } }])(
+  'shows a preserved selection for an unrecognized scope without rewriting it: %j',
+  (value) => {
+    const catalog = {
+      sections: [
+        {
+          name: 'business',
+          title: 'Business',
+          subsections: [
+            { name: 'orders', title: 'Orders', resources: [resource] },
+          ],
+        },
+      ],
+      recordAccess: [
+        { key: 'mine', title: 'Mine' },
+        { key: 'all', title: 'All' },
+      ],
+    } as unknown as Parameters<typeof permissionSections>[0];
+    const original = [
+      {
+        resource: { type: 'composite', id: 'orders' },
+        actions: [
+          {
+            action: 'edit',
+            policy: { type: 'composite', scopes: { records: value } },
+          },
+        ],
+      },
+    ];
+    const before = JSON.stringify(original);
+    const sections = permissionSections(catalog, original, (text) =>
+      typeof text === 'string' ? text : text.key,
+    );
+    const scope = sections[0]!.groups[0]!.rows[0]!.scopes![0]!;
+    expect(
+      scope.levels.find((level) => level.value === scope.level)?.label,
+    ).toBe('settings.preservedRecordScope');
+    expect(setScope(original, scope.id, scope.level!)).toBe(original);
+    expect(JSON.stringify(original)).toBe(before);
+    expect(
+      setScope(original, scope.id, 'all')[0]!.actions[0]!.policy!.scopes,
+    ).toEqual({ records: 'all' });
+  },
+);