@nocobase/utils 2.1.0-beta.9 → 2.1.1

package/lib/index.d.ts

@@ -44,4 +44,6 @@ export * from './variable-usage';
 export * from './wrap-middleware';
 export * from './run-sql';
 export * from './liquidjs';
+export * from './server-request';
+export * from './storage-path';
 export { lodash };

package/lib/index.js

@@ -80,6 +80,8 @@ __reExport(src_exports, require("./variable-usage"), module.exports);
 __reExport(src_exports, require("./wrap-middleware"), module.exports);
 __reExport(src_exports, require("./run-sql"), module.exports);
 __reExport(src_exports, require("./liquidjs"), module.exports);
+__reExport(src_exports, require("./server-request"), module.exports);
+__reExport(src_exports, require("./storage-path"), module.exports);
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   Schema,
@@ -119,5 +121,7 @@ __reExport(src_exports, require("./liquidjs"), module.exports);
   ...require("./variable-usage"),
   ...require("./wrap-middleware"),
   ...require("./run-sql"),
-  ...require("./liquidjs")
+  ...require("./liquidjs"),
+  ...require("./server-request"),
+  ...require("./storage-path")
 });

package/lib/parse-filter.js

@@ -128,6 +128,10 @@ function isDate(input) {
   return input instanceof Date || Object.prototype.toString.call(input) === "[object Date]";
 }
 __name(isDate, "isDate");
+function isDateFieldWithoutTimezone(field) {
+  return (field == null ? void 0 : field.type) === "dateOnly" || (field == null ? void 0 : field.type) === "datetimeNoTz" || (field == null ? void 0 : field.constructor.name) === "DateOnlyField" || (field == null ? void 0 : field.constructor.name) === "DatetimeNoTzField";
+}
+__name(isDateFieldWithoutTimezone, "isDateFieldWithoutTimezone");
 const dateValueWrapper = /* @__PURE__ */ __name((value, timezone) => {
   if (!value) {
     return null;
@@ -195,7 +199,7 @@ const parseFilter = /* @__PURE__ */ __name(async (filter, opts = {}) => {
       }
       if (isDateOperator(operator)) {
         const field = getField == null ? void 0 : getField(path);
-        if ((field == null ? void 0 : field.constructor.name) === "DateOnlyField" || (field == null ? void 0 : field.constructor.name) === "DatetimeNoTzField") {
+        if (isDateFieldWithoutTimezone(field)) {
           if (value.type) {
             return (0, import_dateRangeUtils.getDayRangeByParams)({ ...value, timezone: (field == null ? void 0 : field.timezone) || timezone });
           }

package/lib/server-request.d.ts

@@ -0,0 +1,36 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+import { AxiosRequestConfig, AxiosResponse } from 'axios';
+/**
+ * Match a hostname against a domain pattern.
+ * `*.example.com` matches exactly one subdomain level (e.g. `foo.example.com`)
+ * but not `example.com` itself or deeper levels like `a.b.example.com`.
+ */
+export declare function matchesDomainPattern(hostname: string, pattern: string): boolean;
+/**
+ * Validate a URL against the SERVER_REQUEST_WHITELIST environment variable.
+ *
+ * Throws an error if:
+ *   - The URL scheme is not http or https.
+ *   - SERVER_REQUEST_WHITELIST is set and the host does not match any entry.
+ *
+ * Silently returns for relative URLs (no scheme) so that internal API calls
+ * that use a relative path are not affected.
+ *
+ * Prefer using {@link serverRequest} over calling this directly.
+ */
+export declare function checkUrlAgainstWhitelist(url?: string): void;
+/**
+ * Drop-in replacement for `axios.request()` with built-in SSRF protection.
+ *
+ * Validates `config.url` against {@link checkUrlAgainstWhitelist} before
+ * forwarding to axios. Use this instead of calling axios directly for all
+ * server-initiated outbound HTTP requests.
+ */
+export declare function serverRequest<T = any>(config: AxiosRequestConfig): Promise<AxiosResponse<T>>;

package/lib/server-request.js

@@ -0,0 +1,128 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var server_request_exports = {};
+__export(server_request_exports, {
+  checkUrlAgainstWhitelist: () => checkUrlAgainstWhitelist,
+  matchesDomainPattern: () => matchesDomainPattern,
+  serverRequest: () => serverRequest
+});
+module.exports = __toCommonJS(server_request_exports);
+var import_ipaddr = __toESM(require("ipaddr.js"));
+var import_axios = __toESM(require("axios"));
+const ALLOWED_PROTOCOLS = /* @__PURE__ */ new Set(["http:", "https:"]);
+function matchesIpEntry(hostname, entry) {
+  try {
+    let addr = import_ipaddr.default.parse(hostname);
+    if (addr.kind() === "ipv6" && addr.isIPv4MappedAddress()) {
+      addr = addr.toIPv4Address();
+    }
+    if (entry.includes("/")) {
+      const cidr = import_ipaddr.default.parseCIDR(entry);
+      if (addr.kind() !== cidr[0].kind()) return false;
+      if (addr.kind() === "ipv4") {
+        return addr.match(cidr);
+      }
+      return addr.match(cidr);
+    }
+    let entryAddr = import_ipaddr.default.parse(entry);
+    if (entryAddr.kind() === "ipv6" && entryAddr.isIPv4MappedAddress()) {
+      entryAddr = entryAddr.toIPv4Address();
+    }
+    return addr.toString() === entryAddr.toString();
+  } catch {
+    return false;
+  }
+}
+__name(matchesIpEntry, "matchesIpEntry");
+function matchesDomainPattern(hostname, pattern) {
+  const h = hostname.toLowerCase();
+  const p = pattern.toLowerCase();
+  if (p.startsWith("*.")) {
+    const suffix = p.slice(1);
+    if (!h.endsWith(suffix) || h.length <= suffix.length) return false;
+    const prefix = h.slice(0, h.length - suffix.length);
+    return !prefix.includes(".");
+  }
+  return h === p;
+}
+__name(matchesDomainPattern, "matchesDomainPattern");
+function matchesEntry(hostname, entry) {
+  const e = entry.trim();
+  if (!e) return false;
+  return import_ipaddr.default.isValid(hostname) ? matchesIpEntry(hostname, e) : matchesDomainPattern(hostname, e);
+}
+__name(matchesEntry, "matchesEntry");
+function checkUrlAgainstWhitelist(url) {
+  if (!url) return;
+  if (!url.includes("://")) return;
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    return;
+  }
+  if (!ALLOWED_PROTOCOLS.has(parsed.protocol)) {
+    throw new Error(
+      `URL scheme "${parsed.protocol.replace(":", "")}" is not allowed. Only http and https are permitted.`
+    );
+  }
+  const whitelist = process.env.SERVER_REQUEST_WHITELIST;
+  if (!whitelist || !whitelist.trim()) return;
+  const entries = whitelist.split(",").map((e) => e.trim()).filter(Boolean);
+  if (entries.length === 0) return;
+  const { hostname } = parsed;
+  const host = hostname.startsWith("[") && hostname.endsWith("]") ? hostname.slice(1, -1) : hostname;
+  for (const entry of entries) {
+    if (matchesEntry(host, entry)) return;
+  }
+  throw new Error(
+    `Outbound request to "${host}" is blocked. Add it to SERVER_REQUEST_WHITELIST to allow this request.`
+  );
+}
+__name(checkUrlAgainstWhitelist, "checkUrlAgainstWhitelist");
+async function serverRequest(config) {
+  checkUrlAgainstWhitelist(config.url);
+  return import_axios.default.request(config);
+}
+__name(serverRequest, "serverRequest");
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  checkUrlAgainstWhitelist,
+  matchesDomainPattern,
+  serverRequest
+});

package/lib/storage-path.d.ts

@@ -0,0 +1,25 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+/**
+ * Absolute path to the application storage root (same rules as CLI `resolveStorageRoot` in `cli-v1/src/util.js`).
+ */
+export declare function resolveStorageRoot(): string;
+/**
+ * Join path segments under the application storage root.
+ * Resolution matches CLI `resolveStorageRoot()` / `initEnv`: use `STORAGE_PATH` when set
+ * (absolute or relative to cwd), otherwise `<cwd>/storage`.
+ *
+ * @example storagePathJoin('tmp')
+ * @example storagePathJoin('cache', 'apps', appName)
+ */
+export declare function storagePathJoin(...segments: string[]): string;
+/**
+ * Resolve plugin storage path: `PLUGIN_STORAGE_PATH` first, else `<STORAGE_PATH>/plugins`.
+ */
+export declare function resolvePluginStoragePath(): string;

package/lib/storage-path.js

@@ -0,0 +1,71 @@
+/**
+ * This file is part of the NocoBase (R) project.
+ * Copyright (c) 2020-2024 NocoBase Co., Ltd.
+ * Authors: NocoBase Team.
+ *
+ * This project is dual-licensed under AGPL-3.0 and NocoBase Commercial License.
+ * For more information, please refer to: https://www.nocobase.com/agreement.
+ */
+
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var storage_path_exports = {};
+__export(storage_path_exports, {
+  resolvePluginStoragePath: () => resolvePluginStoragePath,
+  resolveStorageRoot: () => resolveStorageRoot,
+  storagePathJoin: () => storagePathJoin
+});
+module.exports = __toCommonJS(storage_path_exports);
+var import_path = __toESM(require("path"));
+function resolveStorageRoot() {
+  const raw = process.env.STORAGE_PATH;
+  if (raw) {
+    return import_path.default.isAbsolute(raw) ? raw : import_path.default.resolve(process.cwd(), raw);
+  }
+  return import_path.default.resolve(process.cwd(), "storage");
+}
+__name(resolveStorageRoot, "resolveStorageRoot");
+function storagePathJoin(...segments) {
+  return import_path.default.join(resolveStorageRoot(), ...segments);
+}
+__name(storagePathJoin, "storagePathJoin");
+function resolvePluginStoragePath() {
+  if (process.env.PLUGIN_STORAGE_PATH) {
+    const pluginStoragePath = process.env.PLUGIN_STORAGE_PATH;
+    return import_path.default.isAbsolute(pluginStoragePath) ? pluginStoragePath : import_path.default.resolve(process.cwd(), pluginStoragePath);
+  }
+  return storagePathJoin("plugins");
+}
+__name(resolvePluginStoragePath, "resolvePluginStoragePath");
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  resolvePluginStoragePath,
+  resolveStorageRoot,
+  storagePathJoin
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nocobase/utils",
-  "version": "2.1.0-beta.9",
+  "version": "2.1.1",
   "main": "lib/index.js",
   "types": "./lib/index.d.ts",
   "license": "Apache-2.0",
@@ -8,16 +8,18 @@
     "@budibase/handlebars-helpers": "0.14.0",
     "@hapi/topo": "^6.0.0",
     "@rc-component/mini-decimal": "^1.1.0",
+    "axios": "^1.7.0",
     "dayjs": "^1.11.9",
     "deepmerge": "^4.2.2",
     "flat-to-nested": "^1.1.1",
     "fs-extra": "^11.1.1",
     "graphlib": "^2.1.8",
     "handlebars": "^4.7.8",
+    "ipaddr.js": "^1.9.1",
     "liquidjs": "^10.23.0",
     "multer": "^1.4.5-lts.2",
     "object-path": "^0.11.8",
     "ses": "^1.14.0"
   },
-  "gitHead": "c3a2875e4cbbb43b1f2361e6f9f5f84a7d3f3c3c"
+  "gitHead": "13ba59813dc5420e61cb403960d588f9ada7f28e"
 }

package/plugin-package.d.ts

@@ -0,0 +1,45 @@
+export interface PluginPackageInfo {
+  name: string;
+  packageName: string;
+  origins: string[];
+  resolvedPath: string;
+}
+
+export interface ParsePluginNameOptions {
+  nodeModulesPath?: string;
+  pluginPackagePrefixes?: string[];
+}
+
+export interface PresetPackageJsonLike {
+  dependencies?: Record<string, string>;
+  builtIn?: string[];
+  deprecated?: string[];
+}
+
+export declare const DEFAULT_PLUGIN_PACKAGE_PREFIXES: string[];
+export declare function splitPluginNames(value?: string): string[];
+export declare function getPluginPackagePrefixes(): string[];
+export declare function getPluginNameFromPackageName(packageName: string, prefixes?: string[]): string;
+export declare function isValidPackageName(packageName: string): boolean;
+export declare function looksLikePluginPackage(packageName: string, prefixes?: string[]): boolean;
+export declare function parsePluginName(
+  nameOrPkg: string,
+  options?: ParsePluginNameOptions,
+): Promise<{ name: string; packageName: string }>;
+export declare function getPresetNocoBasePackageJson(options?: {
+  nodeModulesPath?: string;
+  cwd?: string;
+}): Promise<PresetPackageJsonLike | null>;
+export declare function resolvePluginPackagePath(
+  packageName: string,
+  options?: {
+    nodeModulesPath?: string;
+    storagePluginsPath?: string;
+  },
+): Promise<string>;
+export declare function discoverPluginPackages(options?: {
+  nodeModulesPath?: string;
+  storagePluginsPath?: string;
+  cwd?: string;
+  pluginPackagePrefixes?: string[];
+}): Promise<PluginPackageInfo[]>;

package/plugin-package.js

@@ -0,0 +1,268 @@
+const fs = require('fs-extra');
+const path = require('path');
+const {
+  getPluginSourceRoots,
+  getStoragePluginNames,
+  resolvePluginSourcePath,
+  resolvePluginStoragePath,
+} = require('./plugin-symlink');
+
+const DEFAULT_PLUGIN_PACKAGE_PREFIXES = ['@nocobase/plugin-', '@nocobase/preset-'];
+const PRESET_PACKAGE_NAME = '@nocobase/preset-nocobase';
+
+function uniqStrings(values) {
+  return [...new Set(values.filter(Boolean))];
+}
+
+function splitPluginNames(value) {
+  return uniqStrings(
+    String(value || '')
+      .split(',')
+      .map((item) => item.trim())
+      .filter(Boolean),
+  );
+}
+
+function getPluginPackagePrefixes() {
+  const prefixes = splitPluginNames(process.env.PLUGIN_PACKAGE_PREFIX || DEFAULT_PLUGIN_PACKAGE_PREFIXES.join(','));
+  return prefixes.length > 0 ? prefixes : DEFAULT_PLUGIN_PACKAGE_PREFIXES;
+}
+
+function getPluginNameFromPackageName(packageName, prefixes = getPluginPackagePrefixes()) {
+  const prefix = prefixes.find((item) => packageName.startsWith(item));
+  return prefix ? packageName.slice(prefix.length) : packageName;
+}
+
+function isValidPackageName(packageName) {
+  if (!packageName || typeof packageName !== 'string') {
+    return false;
+  }
+
+  if (packageName.includes('\0')) {
+    return false;
+  }
+
+  if (path.isAbsolute(packageName)) {
+    return false;
+  }
+
+  if (packageName.includes('..') || packageName.includes('\\')) {
+    return false;
+  }
+
+  return /^(?:@[a-z0-9][a-z0-9._-]*\/)?[a-z0-9][a-z0-9._-]*$/i.test(packageName);
+}
+
+function looksLikePluginPackage(packageName) {
+  return isValidPackageName(packageName);
+}
+
+async function parsePluginName(nameOrPkg, options = {}) {
+  const input = String(nameOrPkg || '').trim();
+  const prefixes = options.pluginPackagePrefixes || getPluginPackagePrefixes();
+
+  if (!input) {
+    return { name: '', packageName: '' };
+  }
+
+  const matchedPrefix = prefixes.find((prefix) => input.startsWith(prefix));
+  if (matchedPrefix) {
+    return {
+      packageName: input,
+      name: input.slice(matchedPrefix.length),
+    };
+  }
+
+  const nodeModulesPath = String(options.nodeModulesPath || process.env.NODE_MODULES_PATH || '').trim();
+  if (nodeModulesPath) {
+    for (const prefix of prefixes) {
+      const candidate = `${prefix}${input}`;
+      if (await fs.pathExists(path.resolve(nodeModulesPath, candidate, 'package.json'))) {
+        return { name: input, packageName: candidate };
+      }
+    }
+  }
+
+  return { name: input, packageName: input };
+}
+
+function getPresetPackageJsonCandidates(options = {}) {
+  const candidates = [];
+  const nodeModulesPath = String(options.nodeModulesPath || process.env.NODE_MODULES_PATH || '').trim();
+
+  if (nodeModulesPath) {
+    candidates.push(path.resolve(nodeModulesPath, PRESET_PACKAGE_NAME, 'package.json'));
+  }
+
+  candidates.push(path.resolve(options.cwd || process.cwd(), 'packages/presets/nocobase/package.json'));
+  return uniqStrings(candidates);
+}
+
+async function getPresetNocoBasePackageJson(options = {}) {
+  for (const packageJsonPath of getPresetPackageJsonCandidates(options)) {
+    if (await fs.pathExists(packageJsonPath)) {
+      return fs.readJson(packageJsonPath);
+    }
+  }
+  return null;
+}
+
+async function getNodeModulesEntryType(linkPath) {
+  try {
+    const statResult = await fs.lstat(linkPath);
+    if (statResult.isSymbolicLink()) {
+      return 'symlink';
+    }
+    if (statResult.isDirectory()) {
+      return 'dir';
+    }
+    return 'other';
+  } catch (error) {
+    if (error.code === 'ENOENT') {
+      return 'missing';
+    }
+    return 'other';
+  }
+}
+
+async function resolvePluginPackagePath(packageName, options = {}) {
+  const normalizedPackageName = String(packageName || '').trim();
+  if (!normalizedPackageName) {
+    return '';
+  }
+
+  const nodeModulesPath = String(options.nodeModulesPath || process.env.NODE_MODULES_PATH || '').trim();
+  const storagePluginsPath = options.storagePluginsPath || resolvePluginStoragePath();
+  const nodeModulesPackagePath = nodeModulesPath ? path.resolve(nodeModulesPath, normalizedPackageName) : '';
+
+  if (nodeModulesPackagePath) {
+    const entryType = await getNodeModulesEntryType(nodeModulesPackagePath);
+    if (entryType === 'dir') {
+      return nodeModulesPackagePath;
+    }
+  }
+
+  const sourcePath = await resolvePluginSourcePath(normalizedPackageName, storagePluginsPath);
+  if (sourcePath) {
+    return sourcePath;
+  }
+
+  if (nodeModulesPackagePath && (await fs.pathExists(path.resolve(nodeModulesPackagePath, 'package.json')))) {
+    return nodeModulesPackagePath;
+  }
+
+  return '';
+}
+
+async function readPluginPackagesFromRoot(rootPath) {
+  if (!rootPath || !(await fs.pathExists(rootPath))) {
+    return [];
+  }
+
+  const relativePluginDirs = await getStoragePluginNames(rootPath);
+  const items = [];
+
+  for (const relativePluginDir of relativePluginDirs) {
+    const packageJsonPath = path.resolve(rootPath, relativePluginDir, 'package.json');
+    if (!(await fs.pathExists(packageJsonPath))) {
+      continue;
+    }
+    const packageJson = await fs.readJson(packageJsonPath);
+    const packageName = String(packageJson?.name || '').trim();
+
+    if (!looksLikePluginPackage(packageName)) {
+      continue;
+    }
+
+    items.push({
+      packageName,
+      packagePath: path.resolve(rootPath, relativePluginDir),
+      sourceRoot: rootPath,
+    });
+  }
+
+  return items;
+}
+
+function pushOrigin(targetMap, packageName, origin) {
+  if (!packageName) {
+    return;
+  }
+  if (!targetMap.has(packageName)) {
+    targetMap.set(packageName, new Set());
+  }
+  targetMap.get(packageName).add(origin);
+}
+
+async function discoverPluginPackages(options = {}) {
+  const nodeModulesPath = String(options.nodeModulesPath || process.env.NODE_MODULES_PATH || '').trim();
+  const storagePluginsPath = options.storagePluginsPath || resolvePluginStoragePath();
+  const prefixes = options.pluginPackagePrefixes || getPluginPackagePrefixes();
+  const originsByPackageName = new Map();
+
+  const presetPackageJson = await getPresetNocoBasePackageJson({ nodeModulesPath, cwd: options.cwd });
+  const presetDependencies = Object.keys(presetPackageJson?.dependencies || {}).filter((packageName) =>
+    packageName.startsWith('@nocobase/plugin-'),
+  );
+
+  for (const packageName of presetDependencies) {
+    pushOrigin(originsByPackageName, packageName, 'preset-dependency');
+  }
+
+  const sourceRoots = getPluginSourceRoots(storagePluginsPath);
+  for (const sourceRoot of sourceRoots) {
+    const packages = await readPluginPackagesFromRoot(sourceRoot);
+    for (const item of packages) {
+      pushOrigin(originsByPackageName, item.packageName, sourceRoot);
+    }
+  }
+
+  for (const packageNameOrName of splitPluginNames(process.env.APPEND_PRESET_BUILT_IN_PLUGINS)) {
+    const { packageName } = await parsePluginName(packageNameOrName, {
+      nodeModulesPath,
+      pluginPackagePrefixes: prefixes,
+    });
+    pushOrigin(originsByPackageName, packageName, 'append-built-in');
+  }
+
+  for (const packageNameOrName of splitPluginNames(process.env.APPEND_PRESET_LOCAL_PLUGINS)) {
+    const { packageName } = await parsePluginName(packageNameOrName, {
+      nodeModulesPath,
+      pluginPackagePrefixes: prefixes,
+    });
+    pushOrigin(originsByPackageName, packageName, 'append-local');
+  }
+
+  const items = [];
+  for (const [packageName, origins] of originsByPackageName.entries()) {
+    const resolvedPath = await resolvePluginPackagePath(packageName, {
+      nodeModulesPath,
+      storagePluginsPath,
+    });
+
+    if (!resolvedPath) {
+      continue;
+    }
+
+    const { name } = await parsePluginName(packageName, { nodeModulesPath, pluginPackagePrefixes: prefixes });
+    items.push({
+      name,
+      packageName,
+      origins: [...origins],
+      resolvedPath,
+    });
+  }
+
+  return items.sort((a, b) => a.packageName.localeCompare(b.packageName));
+}
+
+exports.DEFAULT_PLUGIN_PACKAGE_PREFIXES = DEFAULT_PLUGIN_PACKAGE_PREFIXES;
+exports.getPluginPackagePrefixes = getPluginPackagePrefixes;
+exports.getPluginNameFromPackageName = getPluginNameFromPackageName;
+exports.getPresetNocoBasePackageJson = getPresetNocoBasePackageJson;
+exports.isValidPackageName = isValidPackageName;
+exports.looksLikePluginPackage = looksLikePluginPackage;
+exports.parsePluginName = parsePluginName;
+exports.resolvePluginPackagePath = resolvePluginPackagePath;
+exports.discoverPluginPackages = discoverPluginPackages;
+exports.splitPluginNames = splitPluginNames;

package/plugin-symlink.d.ts

@@ -1,6 +1,9 @@
+export declare function resolvePluginStoragePath(): string;
 export declare function getStoragePluginNames(target: any): Promise<any[]>;
-export declare function fsExists(path: any): Promise<boolean>;
+export declare function getPluginSourceRoots(storagePluginsPath: string): string[];
+export declare function resolvePluginSourcePath(pluginName: string, storagePluginsPath: string): Promise<string>;
 export declare function createStoragePluginSymLink(pluginName: any): Promise<void>;
 export declare function createStoragePluginsSymlink(): Promise<void>;
 export declare function createDevPluginSymLink(pluginName: any): Promise<void>;
 export declare function createDevPluginsSymlink(): Promise<void>;
+export declare function syncPluginSymlinks(): Promise<void>;

package/plugin-symlink.js

@@ -1,6 +1,15 @@
-const { resolve } = require('path');
+const path = require('path');
+const { resolve } = path;
 const fs = require('fs-extra');
 
+function resolvePluginStoragePath() {
+  if (process.env.PLUGIN_STORAGE_PATH) {
+    const p = process.env.PLUGIN_STORAGE_PATH;
+    return path.isAbsolute(p) ? p : path.resolve(process.cwd(), p);
+  }
+  return path.join(process.env.STORAGE_PATH || path.resolve(process.cwd(), 'storage'), 'plugins');
+}
+
 /**
  * Recursively get plugin names from a directory
  * @param {string} target - Target directory to scan
@@ -28,6 +37,36 @@ async function getStoragePluginNames(target) {
   return plugins;
 }
 
+async function getPluginNamesFromSourceRoot(rootPath) {
+  if (!(await fs.pathExists(rootPath))) {
+    return [];
+  }
+  return await getStoragePluginNames(rootPath);
+}
+
+async function isValidPluginSourcePath(candidate) {
+  return await fs.pathExists(resolve(candidate, 'package.json'));
+}
+
+function getPluginSourceRoots(storagePluginsPath) {
+  return [
+    resolve(process.cwd(), 'packages/plugins'),
+    resolve(process.cwd(), 'packages/pro-plugins'),
+    storagePluginsPath,
+  ];
+}
+
+async function resolvePluginSourcePath(pluginName, storagePluginsPath) {
+  const sourceRoots = getPluginSourceRoots(storagePluginsPath);
+  for (const rootPath of sourceRoots) {
+    const candidate = resolve(rootPath, pluginName);
+    if (await isValidPluginSourcePath(candidate)) {
+      return candidate;
+    }
+  }
+  return '';
+}
+
 /**
  * Ensure the organization directory exists for scoped packages
  * @param {string} nodeModulesPath - Path to node_modules
@@ -43,22 +82,35 @@ async function ensureOrgDirectory(nodeModulesPath, pluginName) {
 }
 
 /**
- * Check if a symlink already points to the correct target
- * @param {string} linkPath - Path to the symlink
- * @param {string} targetPath - Expected target path
- * @returns {Promise<boolean>} True if symlink exists and points to target
+ * Check whether node_modules entry is a real directory, symlink, or missing
+ * @param {string} linkPath - Path inside node_modules
+ * @returns {Promise<'missing'|'dir'|'symlink'|'other'>}
  */
-async function isSymlinkValid(linkPath, targetPath) {
+async function getNodeModulesEntryType(linkPath) {
   try {
-    if (await fs.pathExists(linkPath)) {
-      const realPath = await fs.realpath(linkPath);
-      return realPath === targetPath;
+    const statResult = await fs.lstat(linkPath);
+    if (statResult.isSymbolicLink()) {
+      return 'symlink';
+    }
+    if (statResult.isDirectory()) {
+      return 'dir';
     }
+    return 'other';
   } catch (error) {
-    // If realpath fails, the symlink is invalid
+    if (error.code === 'ENOENT') {
+      return 'missing';
+    }
+    return 'other';
+  }
+}
+
+async function isSymlinkValid(linkPath, targetPath) {
+  try {
+    const realPath = await fs.realpath(linkPath);
+    return realPath === targetPath;
+  } catch {
     return false;
   }
-  return false;
 }
 
 /**
@@ -110,13 +162,18 @@ async function createPluginSymLink(pluginName, sourcePath, nodeModulesPath, plug
       return;
     }
 
+    const linkPath = resolve(nodeModulesPath, pluginName);
+    const entryType = await getNodeModulesEntryType(linkPath);
+
+    if (entryType === 'dir') {
+      return;
+    }
+
     // Ensure organization directory exists for scoped packages
     await ensureOrgDirectory(nodeModulesPath, pluginName);
 
-    const linkPath = resolve(nodeModulesPath, pluginName);
-
     // Check if symlink already points to the correct target
-    if (await isSymlinkValid(linkPath, targetPath)) {
+    if (entryType === 'symlink' && (await isSymlinkValid(linkPath, targetPath))) {
       return; // Symlink is already correct, no need to recreate
     }
 
@@ -133,10 +190,9 @@ async function createPluginSymLink(pluginName, sourcePath, nodeModulesPath, plug
 /**
  * Create a symlink for a storage plugin
  * @param {string} pluginName - Name of the plugin
- * @returns {Promise<void>}
  */
 async function createStoragePluginSymLink(pluginName) {
-  const storagePluginsPath = resolve(process.cwd(), 'storage/plugins');
+  const storagePluginsPath = resolvePluginStoragePath();
   const nodeModulesPath = process.env.NODE_MODULES_PATH;
   await createPluginSymLink(pluginName, storagePluginsPath, nodeModulesPath, 'storage');
 }
@@ -146,7 +202,7 @@ async function createStoragePluginSymLink(pluginName) {
  * @returns {Promise<void>}
  */
 async function createStoragePluginsSymlink() {
-  const storagePluginsPath = resolve(process.cwd(), 'storage/plugins');
+  const storagePluginsPath = resolvePluginStoragePath();
   if (!(await fs.pathExists(storagePluginsPath))) {
     return;
   }
@@ -178,7 +234,59 @@ async function createDevPluginsSymlink() {
   await Promise.all(pluginNames.map((pluginName) => createDevPluginSymLink(pluginName)));
 }
 
+/**
+ * Create symlinks for all plugins from all sources
+ * @returns {Promise<void>}
+ */
+async function syncPluginSymlinks() {
+  const nodeModulesPath = process.env.NODE_MODULES_PATH;
+  if (!nodeModulesPath) {
+    return;
+  }
+
+  const storagePluginsPath = resolvePluginStoragePath();
+  const sourceRoots = getPluginSourceRoots(storagePluginsPath);
+  const pluginNames = new Set();
+
+  for (const rootPath of sourceRoots) {
+    const names = await getPluginNamesFromSourceRoot(rootPath);
+    names.forEach((name) => pluginNames.add(name));
+  }
+
+  await Promise.all(
+    [...pluginNames].map(async (pluginName) => {
+      const linkPath = resolve(nodeModulesPath, pluginName);
+      const entryType = await getNodeModulesEntryType(linkPath);
+
+      if (entryType === 'dir') {
+        return;
+      }
+
+      const sourcePath = await resolvePluginSourcePath(pluginName, storagePluginsPath);
+      if (!sourcePath) {
+        if (entryType === 'symlink' || entryType === 'other') {
+          await removeExistingLink(linkPath, pluginName, 'plugin');
+        }
+        return;
+      }
+
+      if (entryType === 'symlink' && (await isSymlinkValid(linkPath, sourcePath))) {
+        return;
+      }
+
+      await ensureOrgDirectory(nodeModulesPath, pluginName);
+      await removeExistingLink(linkPath, pluginName, 'plugin');
+      await fs.symlink(sourcePath, linkPath, 'dir');
+    }),
+  );
+}
+
+exports.resolvePluginStoragePath = resolvePluginStoragePath;
+exports.getStoragePluginNames = getStoragePluginNames;
+exports.getPluginSourceRoots = getPluginSourceRoots;
+exports.resolvePluginSourcePath = resolvePluginSourcePath;
 exports.createStoragePluginSymLink = createStoragePluginSymLink;
 exports.createStoragePluginsSymlink = createStoragePluginsSymlink;
 exports.createDevPluginSymLink = createDevPluginSymLink;
 exports.createDevPluginsSymlink = createDevPluginsSymlink;
+exports.syncPluginSymlinks = syncPluginSymlinks;