@restforgejs/platform 5.3.6 → 5.3.9

package/cli/designer.js

@@ -1,3 +1,3 @@
 #!/usr/bin/env node
 
-'use strict';const a0_0x4847c4=a0_0x4fdf;(function(_0x6f86f,_0x115950){const _0x373e45=a0_0x4fdf,_0x582a23=_0x6f86f();while(!![]){try{const _0xcefdd=parseInt(_0x373e45(0x75))/0x1+parseInt(_0x373e45(0x6f))/0x2+-parseInt(_0x373e45(0x69))/0x3+-parseInt(_0x373e45(0x7b))/0x4+parseInt(_0x373e45(0x6b))/0x5*(-parseInt(_0x373e45(0x84))/0x6)+parseInt(_0x373e45(0x81))/0x7*(parseInt(_0x373e45(0x72))/0x8)+parseInt(_0x373e45(0x7e))/0x9*(parseInt(_0x373e45(0x79))/0xa);if(_0xcefdd===_0x115950)break;else _0x582a23['push'](_0x582a23['shift']());}catch(_0x3305cf){_0x582a23['push'](_0x582a23['shift']());}}}(a0_0x2899,0x96368));const os=require('os'),path=require(a0_0x4847c4(0x6a)),fs=require('fs'),{spawn}=require(a0_0x4847c4(0x80));function resolveBinaryPath(){const _0x30d11d=a0_0x4847c4,_0x436504={'AuxED':function(_0x24b112,_0x47a85b){return _0x24b112===_0x47a85b;},'vFysh':_0x30d11d(0x74)},_0x43d581=os[_0x30d11d(0x6e)](),_0x53d192=path['resolve'](__dirname,'..','bin');if(_0x436504['AuxED'](_0x43d581,'win32'))return path['join'](_0x53d192,_0x30d11d(0x83));if(_0x43d581==='linux')return path['join'](_0x53d192,_0x436504['vFysh']);return null;}const binaryPath=resolveBinaryPath();function a0_0x4fdf(_0x167a55,_0x3ce499){_0x167a55=_0x167a55-0x69;const _0x28999f=a0_0x2899();let _0x4fdf9a=_0x28999f[_0x167a55];if(a0_0x4fdf['rrGaHz']===undefined){var _0x28d676=function(_0xeb3c7b){const _0x3f2b3f='abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+/=';let _0x85087='',_0x3021aa='';for(let _0x4853ed=0x0,_0x59a60f,_0x5a7f54,_0x3a547d=0x0;_0x5a7f54=_0xeb3c7b['charAt'](_0x3a547d++);~_0x5a7f54&&(_0x59a60f=_0x4853ed%0x4?_0x59a60f*0x40+_0x5a7f54:_0x5a7f54,_0x4853ed++%0x4)?_0x85087+=String['fromCharCode'](0xff&_0x59a60f>>(-0x2*_0x4853ed&0x6)):0x0){_0x5a7f54=_0x3f2b3f['indexOf'](_0x5a7f54);}for(let _0x3f38fe=0x0,_0x53559b=_0x85087['length'];_0x3f38fe<_0x53559b;_0x3f38fe++){_0x3021aa+='%'+('00'+_0x85087['charCodeAt'](_0x3f38fe)['toString'](0x10))['slice'](-0x2);}return decodeURIComponent(_0x3021aa);};a0_0x4fdf['AwMHVE']=_0x28d676,a0_0x4fdf['TXxiWx']={},a0_0x4fdf['rrGaHz']=!![];}const _0x48e15a=_0x28999f[0x0],_0x22476f=_0x167a55+_0x48e15a,_0xd2ba0e=a0_0x4fdf['TXxiWx'][_0x22476f];return!_0xd2ba0e?(_0x4fdf9a=a0_0x4fdf['AwMHVE'](_0x4fdf9a),a0_0x4fdf['TXxiWx'][_0x22476f]=_0x4fdf9a):_0x4fdf9a=_0xd2ba0e,_0x4fdf9a;}!binaryPath&&(console['error'](a0_0x4847c4(0x6c)+os[a0_0x4847c4(0x6e)]()+').'),process['exit'](0x1));!fs[a0_0x4847c4(0x77)](binaryPath)&&(console['error'](a0_0x4847c4(0x70)+binaryPath+'.'),console[a0_0x4847c4(0x78)](a0_0x4847c4(0x7a)),process[a0_0x4847c4(0x73)](0x1));if(os['platform']()!==a0_0x4847c4(0x71))try{fs[a0_0x4847c4(0x7c)](binaryPath,0x1ed);}catch{}const child=spawn(binaryPath,process['argv'][a0_0x4847c4(0x7d)](0x2),{'stdio':a0_0x4847c4(0x7f)});function a0_0x2899(){const _0x27895d=['ndm3mduWBufyvgTw','CgLK','zxHPC3rZu3LUyW','zxjYB3i','mtu1otmXmfHetLLvra','sw5ZDgfSBcb1BgfUzYbaCMvZDgzVCMDLANmVCgXHDgzVCM0GDw50DwSGBwvUzgfWyxrRyw4GyMLUyxj5ihLHBMCGC2vZDwfPlG','mtC5mtyZmKDxDKLWqq','y2HTB2rtEw5J','C2XPy2u','owvlBhnzDq','Aw5OzxjPDa','y2HPBgrFChjVy2vZCW','n0LyBhDlBG','rxjYB3iGBwvUAMfSyw5Ryw4GCMvZDgzVCMDLlwrLC2LNBMvYoIa','CMvZDgzVCMDLlwrLC2LNBMvYlMv4zq','ndi3nJe3mgr3DvHuvq','mJK4ntu2nhLWv2PzBG','Cgf0Aa','nvvhDhfVrq','rxjYB3i6ihjLC3rMB3jNzs1KzxnPz25LCIb0AwrHAYbKAwr1A3vUzYbKAsbWBgf0zM9YBsbPBMKGka','uxHdueu','CgXHDgzVCM0','mtK1odqYmhzVrwHjvW','rxjYB3i6igjPBMfYEsbYzxn0zM9Yz2uTzgvZAwDUzxiGDgLKywSGzgL0zw11A2fUigrPia','D2LUmZi','otu5mdK3nLDutxrbvq','zxHPDa','CMvZDgzVCMDLlwrLC2LNBMvYlwXPBNv4'];a0_0x2899=function(){return _0x27895d;};return a0_0x2899();}child['on'](a0_0x4847c4(0x78),_0x302402=>{const _0x5b2ae5=a0_0x4847c4;console['error'](_0x5b2ae5(0x82)+_0x302402['message']),process[_0x5b2ae5(0x73)](0x1);}),child['on'](a0_0x4847c4(0x73),(_0x3fd68d,_0x418089)=>{const _0x2f4108=a0_0x4847c4,_0xe858e1={'QxCPE':function(_0x5af125,_0x190cc7){return _0x5af125??_0x190cc7;}};if(_0x418089)process['kill'](process[_0x2f4108(0x76)],_0x418089);else process['exit'](_0xe858e1[_0x2f4108(0x6d)](_0x3fd68d,0x0));});
+'use strict';const a0_0x4ba6d1=a0_0x432f;(function(_0x52d2c5,_0x541a5b){const _0x19578f=a0_0x432f,_0x513db3=_0x52d2c5();while(!![]){try{const _0x30c732=parseInt(_0x19578f(0x198))/0x1+parseInt(_0x19578f(0x192))/0x2+parseInt(_0x19578f(0x193))/0x3+parseInt(_0x19578f(0x18d))/0x4*(parseInt(_0x19578f(0x18c))/0x5)+parseInt(_0x19578f(0x19d))/0x6*(-parseInt(_0x19578f(0x194))/0x7)+-parseInt(_0x19578f(0x18f))/0x8+-parseInt(_0x19578f(0x19a))/0x9;if(_0x30c732===_0x541a5b)break;else _0x513db3['push'](_0x513db3['shift']());}catch(_0x27979b){_0x513db3['push'](_0x513db3['shift']());}}}(a0_0xff40,0x78bf4));function a0_0x432f(_0x2a88bd,_0x3d73de){_0x2a88bd=_0x2a88bd-0x18b;const _0xff40da=a0_0xff40();let _0x432f9d=_0xff40da[_0x2a88bd];if(a0_0x432f['iXVUhf']===undefined){var _0x59f6d6=function(_0x5eb74b){const _0x5bad87='abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+/=';let _0x201b56='',_0x4d4d53='';for(let _0xd8c081=0x0,_0x2661c0,_0x1b6a94,_0x3b3beb=0x0;_0x1b6a94=_0x5eb74b['charAt'](_0x3b3beb++);~_0x1b6a94&&(_0x2661c0=_0xd8c081%0x4?_0x2661c0*0x40+_0x1b6a94:_0x1b6a94,_0xd8c081++%0x4)?_0x201b56+=String['fromCharCode'](0xff&_0x2661c0>>(-0x2*_0xd8c081&0x6)):0x0){_0x1b6a94=_0x5bad87['indexOf'](_0x1b6a94);}for(let _0x1b7d08=0x0,_0x1e9f72=_0x201b56['length'];_0x1b7d08<_0x1e9f72;_0x1b7d08++){_0x4d4d53+='%'+('00'+_0x201b56['charCodeAt'](_0x1b7d08)['toString'](0x10))['slice'](-0x2);}return decodeURIComponent(_0x4d4d53);};a0_0x432f['EueaTq']=_0x59f6d6,a0_0x432f['IVlthe']={},a0_0x432f['iXVUhf']=!![];}const _0x1fad21=_0xff40da[0x0],_0x239d45=_0x2a88bd+_0x1fad21,_0x24600f=a0_0x432f['IVlthe'][_0x239d45];return!_0x24600f?(_0x432f9d=a0_0x432f['EueaTq'](_0x432f9d),a0_0x432f['IVlthe'][_0x239d45]=_0x432f9d):_0x432f9d=_0x24600f,_0x432f9d;}const os=require('os'),path=require('path'),fs=require('fs'),{spawn}=require(a0_0x4ba6d1(0x19e));function resolveBinaryPath(){const _0x459539=a0_0x4ba6d1,_0x17ac1b={'XUiEd':function(_0x3f3706,_0xb5c54e){return _0x3f3706===_0xb5c54e;},'bEZLI':_0x459539(0x191),'xrTiG':'linux'},_0x16574b=os['platform'](),_0x1efcd9=path['resolve'](__dirname,'..',_0x459539(0x19c));if(_0x17ac1b[_0x459539(0x199)](_0x16574b,_0x17ac1b[_0x459539(0x19f)]))return path['join'](_0x1efcd9,'restforge-designer.exe');if(_0x16574b===_0x17ac1b['xrTiG'])return path[_0x459539(0x19b)](_0x1efcd9,'restforge-designer-linux');return null;}const binaryPath=resolveBinaryPath();!binaryPath&&(console[a0_0x4ba6d1(0x18b)]('Error:\x20restforge-designer\x20tidak\x20didukung\x20di\x20platform\x20ini\x20('+os[a0_0x4ba6d1(0x195)]()+').'),process[a0_0x4ba6d1(0x18e)](0x1));function a0_0xff40(){const _0x4bd115=['n2rzuvjSsG','CgXHDgzVCM0','A2LSBa','rxjYB3iGBwvUAMfSyw5Ryw4GCMvZDgzVCMDLlwrLC2LNBMvYoIa','oteXnJKYr2rvBhHi','wfvPrwq','nZiWmZuYohjWCNj3Dq','AM9PBG','yMLU','mtq0mJC5nMvSA09Htq','y2HPBgrFChjVy2vZCW','yKvAteK','zxjYB3i','oda1mgDQs2rurq','mJa0q3LxBwzX','zxHPDa','ndq4ndi4mfzuB0rfBq','CgLK','D2LUmZi','mtq5nJyZmg5ur0jfEG','mta2mtu2oenmyKvRBq'];a0_0xff40=function(){return _0x4bd115;};return a0_0xff40();}!fs['existsSync'](binaryPath)&&(console[a0_0x4ba6d1(0x18b)]('Error:\x20binary\x20restforge-designer\x20tidak\x20ditemukan\x20di\x20'+binaryPath+'.'),console['error']('Install\x20ulang\x20@restforgejs/platform\x20untuk\x20mendapatkan\x20binary\x20yang\x20sesuai.'),process[a0_0x4ba6d1(0x18e)](0x1));if(os['platform']()!=='win32')try{fs['chmodSync'](binaryPath,0x1ed);}catch{}const child=spawn(binaryPath,process['argv']['slice'](0x2),{'stdio':'inherit'});child['on']('error',_0x5a904c=>{const _0xc7abf5=a0_0x4ba6d1;console[_0xc7abf5(0x18b)](_0xc7abf5(0x197)+_0x5a904c['message']),process[_0xc7abf5(0x18e)](0x1);}),child['on']('exit',(_0x3a2b86,_0x411211)=>{const _0x5af42e=a0_0x4ba6d1,_0x3e4d86={'KzkEJ':function(_0x4d7da3,_0x284b66){return _0x4d7da3??_0x284b66;}};if(_0x411211)process[_0x5af42e(0x196)](process[_0x5af42e(0x190)],_0x411211);else process['exit'](_0x3e4d86['KzkEJ'](_0x3a2b86,0x0));});

package/generators/cli/fast-track.js

@@ -54,7 +54,8 @@ const DEFAULTS = {
     DB_USER: 'postgres',
     DB_PASSWORD: 'postgres1234',
     DB_NAME: 'dbsandbox',
-    DB_FILE: './data/sandbox.db'
+    DB_FILE: './data/sandbox.db',
+    CORS_ENABLED: 'true'
 };
 
 const DEFAULT_CONFIG_FILE = 'db-connection.env';
@@ -208,6 +209,16 @@ function describeDatabase(cfg) {
     return `${cfg.DB_TYPE} @ ${cfg.DB_HOST}:${cfg.DB_PORT}/${cfg.DB_NAME}`;
 }
 
+/**
+ * Default CORS_ORIGINS diturunkan dari origin web server (frontend) yang sudah
+ * diinput, mis. SERVER_ADDRESS=127.0.0.1 + WEB_SERVER_PORT=8000 →
+ * `http://127.0.0.1:8000`. Origin frontend inilah yang harus di-whitelist CORS
+ * agar aplikasi web bisa memanggil REST API dari browser.
+ */
+function defaultCorsOrigins(cfg) {
+    return `http://${cfg.SERVER_ADDRESS}:${cfg.WEB_SERVER_PORT}`;
+}
+
 // ---------------------------------------------------------------------------
 // Pengumpulan data preview (read-only, tanpa efek samping)
 // ---------------------------------------------------------------------------
@@ -341,6 +352,34 @@ function resolveSourceConfig(cwd, explicitConfig) {
     return { configName, fileCfg: data || {} };
 }
 
+// ---------------------------------------------------------------------------
+// Normalisasi path file SQLite
+// ---------------------------------------------------------------------------
+
+/**
+ * Normalisasi input DB_FILE SQLite dari user menjadi path yang lengkap.
+ *
+ * Aturan:
+ *   - Tanpa komponen direktori (mis. "myapp" atau "myapp.db")
+ *     → dimasukkan ke folder ./data/ → "./data/myapp.db"
+ *   - Dengan direktori custom (mis. "./dataku/myapp")
+ *     → path-nya dihormati, hanya ekstensi yang ditambahkan → "./dataku/myapp.db"
+ *   - Ekstensi .db selalu ditambahkan jika belum ada.
+ *
+ * Contoh:
+ *   "myapp"            → "./data/myapp.db"
+ *   "myapp.db"         → "./data/myapp.db"
+ *   "./dataku/myapp"   → "./dataku/myapp.db"
+ *   "./data/myapp.db"  → "./data/myapp.db"  (tidak berubah)
+ */
+function normalizeDbFilePath(input) {
+    let result = input.trim();
+    if (!result.endsWith('.db')) result += '.db';
+    const hasDir = result.includes('/') || result.includes('\\');
+    if (!hasDir) result = './data/' + result;
+    return result;
+}
+
 // ---------------------------------------------------------------------------
 // Fase input konfigurasi (LICENSE + database), mengikuti fast-track.mjs
 // ---------------------------------------------------------------------------
@@ -375,6 +414,11 @@ async function collectConfig(args, ask, fileCfg = {}) {
     cfg.SERVER_PORT = await askField('REST_API_PORT', fileCfg.SERVER_PORT || DEFAULTS.SERVER_PORT);
     cfg.WEB_SERVER_PORT = await askField('WEB_SERVER_PORT', DEFAULTS.WEB_SERVER_PORT);
 
+    // CORS: CORS_ENABLED diikutkan apa adanya (default true, tidak diprompt edit);
+    // CORS_ORIGINS dapat diedit dengan default origin web server yang baru diisi.
+    cfg.CORS_ENABLED = fileCfg.CORS_ENABLED || DEFAULTS.CORS_ENABLED;
+    cfg.CORS_ORIGINS = await askField('CORS_ORIGINS', fileCfg.CORS_ORIGINS || defaultCorsOrigins(cfg));
+
     // DB_TYPE menentukan atribut yang diminta berikutnya.
     console.log('');
     console.log('  Available DB_TYPE: postgresql, mysql, oracle, sqlite');
@@ -387,7 +431,8 @@ async function collectConfig(args, ask, fileCfg = {}) {
         console.log('');
         // fileCfg.DB_NAME: file legacy hasil `restforge init` menyimpan path
         // sqlite di DB_NAME, bukan DB_FILE (lihat init.js & server.js runtime).
-        cfg.DB_FILE = await askField('DB_FILE (.db file path)', fileCfg.DB_FILE || fileCfg.DB_NAME || DEFAULTS.DB_FILE);
+        const dbFileRaw = await askField('DB_FILE (.db file path)', fileCfg.DB_FILE || fileCfg.DB_NAME || DEFAULTS.DB_FILE);
+        cfg.DB_FILE = normalizeDbFilePath(dbFileRaw);
         cfg.DB_NAME = cfg.DB_FILE;
     } else {
         const dbDef = DB_TYPE_DEFAULTS[cfg.DB_TYPE] || {};
@@ -414,6 +459,8 @@ function defaultCfgFromFile(args, fileCfg = {}) {
     cfg.SERVER_ADDRESS = fileCfg.SERVER_ADDRESS || DEFAULTS.SERVER_ADDRESS;
     cfg.SERVER_PORT = fileCfg.SERVER_PORT || DEFAULTS.SERVER_PORT;
     cfg.WEB_SERVER_PORT = DEFAULTS.WEB_SERVER_PORT;
+    cfg.CORS_ENABLED = fileCfg.CORS_ENABLED || DEFAULTS.CORS_ENABLED;
+    cfg.CORS_ORIGINS = fileCfg.CORS_ORIGINS || defaultCorsOrigins(cfg);
     cfg.DB_TYPE = (fileCfg.DB_TYPE || DEFAULTS.DB_TYPE).toLowerCase();
 
     if (cfg.DB_TYPE === 'sqlite') {
@@ -447,6 +494,8 @@ function printExistingConfigSummary({ project, schemaFlag, configName, cfg, over
     console.log(`  License    : ${maskLicense(cfg.LICENSE)}`);
     console.log(`  REST API   : ${cfg.SERVER_ADDRESS}:${cfg.SERVER_PORT}`);
     console.log(`  Web server : ${cfg.SERVER_ADDRESS}:${cfg.WEB_SERVER_PORT}`);
+    console.log(`  CORS       : ${cfg.CORS_ENABLED}`);
+    console.log(`  CORS Origin: ${cfg.CORS_ORIGINS}`);
     console.log(`  Mode       : ${overwrite ? 'overwrite' : 'sync'}`);
     console.log('');
     console.log('  Database Configuration');
@@ -909,6 +958,8 @@ function envValuesFromCfg(cfg) {
         SERVER_PORT: cfg.SERVER_PORT,
         DB_TYPE: cfg.DB_TYPE
     };
+    if (cfg.CORS_ENABLED !== undefined) v.CORS_ENABLED = cfg.CORS_ENABLED;
+    if (cfg.CORS_ORIGINS !== undefined) v.CORS_ORIGINS = cfg.CORS_ORIGINS;
     if (cfg.DB_TYPE === 'sqlite') {
         v.DB_FILE = cfg.DB_FILE;
         v.DB_NAME = cfg.DB_NAME;
@@ -1262,16 +1313,25 @@ function runFrontendPipeline(ctx) {
  * biasa membiarkan NODE_ENV kosong sehingga logger memakai pino-pretty (rapi).
  */
 function writeServerStartScript(ctx) {
-    const serveCmd = `npx restforge serve --project=${ctx.project} --config=${ctx.configFlag} --watch`;
     const isWin = process.platform === 'win32';
     const file = path.join(ctx.cwd, isWin ? 'server-start.bat' : 'server-start.sh');
     let content;
-    if (isWin) {
+    if (isWin && ctx.runMode === 'pm2') {
+        const appName = pm2Name(ctx.project, 'server');
+        content = [
+            '@echo off',
+            'REM Start RESTForge REST API via pm2. Generated by fast-track.',
+            'cd /d "%~dp0"',
+            `call pm2 delete ${appName} >nul 2>&1`,
+            `call pm2 start ecosystem.config.js --only ${appName}`,
+            ''
+        ].join('\r\n');
+    } else if (isWin) {
         content = [
             '@echo off',
             'REM Start RESTForge REST API (runtime server). Generated by fast-track.',
             'cd /d "%~dp0"',
-            `call ${serveCmd}`,
+            `call npx restforge serve --project=${ctx.project} --config=${ctx.configFlag} --watch`,
             ''
         ].join('\r\n');
     } else {
@@ -1280,7 +1340,7 @@ function writeServerStartScript(ctx) {
             '# Start RESTForge REST API (runtime server). Generated by fast-track.',
             'set -e',
             'cd "$(dirname "$0")"',
-            serveCmd,
+            `npx restforge serve --project=${ctx.project} --config=${ctx.configFlag} --watch`,
             ''
         ].join('\n');
     }
@@ -1297,17 +1357,26 @@ function writeServerStartScript(ctx) {
  * writeServerStartScript, dipakai juga sebagai target `pm2 start` di non-Windows.
  */
 function writeFrontendStartScript(ctx) {
-    const serveCmd = `npx serve . -l ${ctx.cfg.WEB_SERVER_PORT}`;
     const isWin = process.platform === 'win32';
     const appDir = path.join(ctx.cwd, 'frontend', 'apps', ctx.project);
     const file = path.join(appDir, isWin ? 'frontend-start.bat' : 'frontend-start.sh');
     let content;
-    if (isWin) {
+    if (isWin && ctx.runMode === 'pm2') {
+        const appName = pm2Name(ctx.project, 'frontend');
+        content = [
+            '@echo off',
+            'REM Start RESTForge frontend app via pm2. Generated by fast-track.',
+            'cd /d "%~dp0"',
+            `call pm2 delete ${appName} >nul 2>&1`,
+            `call pm2 start ecosystem.config.js --only ${appName}`,
+            ''
+        ].join('\r\n');
+    } else if (isWin) {
         content = [
             '@echo off',
             'REM Start RESTForge frontend app. Generated by fast-track.',
             'cd /d "%~dp0"',
-            `call ${serveCmd}`,
+            `call npx serve . -l ${ctx.cfg.WEB_SERVER_PORT}`,
             ''
         ].join('\r\n');
     } else {
@@ -1316,7 +1385,7 @@ function writeFrontendStartScript(ctx) {
             '# Start RESTForge frontend app. Generated by fast-track.',
             'set -e',
             'cd "$(dirname "$0")"',
-            serveCmd,
+            `npx serve . -l ${ctx.cfg.WEB_SERVER_PORT}`,
             ''
         ].join('\n');
     }
@@ -1342,15 +1411,144 @@ function pm2Name(project, kind) {
  * (silent, tolerant bila belum ada) supaya re-run fast-track tidak gagal
  * dengan "already launched". Return false bila pm2 tidak tersedia/gagal.
  */
-function pm2StartScript(name, scriptPath, cwd) {
+/**
+ * Start (ulang) satu app dari ecosystem.config.js via pm2. Idempotent: hapus
+ * instance lama dulu (silent) supaya re-run fast-track tidak gagal "already
+ * launched". Menggunakan `--only <name>` agar hanya app yang dimaksud yang
+ * di-start dari file ecosystem yang bisa berisi beberapa app.
+ *
+ * Pendekatan ecosystem + `interpreter: none` (dideklarasikan di
+ * writeEcosystemConfig) menghindari masalah pm2 default ke Node.js sebagai
+ * interpreter saat diberikan file .bat / .sh secara langsung.
+ */
+function pm2StartScript(name, ecosystemPath) {
     spawnSync(`pm2 delete ${name} --silent`, { shell: true, stdio: 'ignore' });
     const r = spawnSync(
-        `pm2 start "${scriptPath}" --name ${name} --cwd "${cwd}" --interpreter bash`,
+        `pm2 start "${ecosystemPath}" --only ${name}`,
         { shell: true, stdio: 'inherit' }
     );
     return !r.error && r.status === 0;
 }
 
+/**
+ * Generate ecosystem.config.js di root project. pm2 membaca file ini untuk
+ * mengetahui cara menjalankan tiap app tanpa bergantung pada file launcher
+ * (.bat / .sh) yang rentan salah interpreter.
+ *
+ * `script: "npx"` + `interpreter: "none"` + `args: "..."` adalah pola yang
+ * bekerja seragam di Windows dan Linux: pm2 memanggil npx langsung sebagai
+ * executable OS, bukan membungkusnya dengan Node.
+ */
+/**
+ * Tulis file launcher Node.js kecil untuk satu proses pm2.
+ *
+ * pm2 menjalankan file .js dengan `node` secara default — tidak perlu
+ * interpreter khusus. Launcher ini menggunakan spawn({ shell: true }) agar
+ * `npx` resolves dengan benar di Windows (npx.cmd) maupun Linux, tanpa
+ * membuka window terminal baru.
+ */
+function writeEcosystemConfig(ctx) {
+    const apps = [];
+
+    if (ctx.scope.backend) {
+        apps.push({
+            name: pm2Name(ctx.project, 'server'),
+            script: 'node_modules/@restforgejs/platform/server.js',
+            args: `serve --project=${ctx.project} --config=${ctx.configFlag} --watch`,
+            cwd: ctx.cwd,
+            instances: 1,
+            exec_mode: 'fork',
+            autorestart: true,
+            watch: false,
+            max_memory_restart: '1G',
+            node_args: '--max-old-space-size=4096',
+            kill_timeout: 3000,
+            windowsHide: true,
+            env: {
+                NODE_ENV: 'production',
+                PM2_USAGE_METRICS: 'false'
+            }
+        });
+    }
+
+    if (ctx.scope.frontend) {
+        // `serve` harus terinstall di node_modules project agar pm2 bisa
+        // menjalankannya langsung sebagai file JS (tanpa shell/npx).
+        const serveMain = path.join(ctx.cwd, 'node_modules', 'serve', 'build', 'main.js');
+        if (!fs.existsSync(serveMain)) {
+            console.log('\n  Installing serve (static file server for frontend)...');
+            const r = spawnSync('npm install serve --save-dev', { cwd: ctx.cwd, shell: true, stdio: 'inherit' });
+            if (r.error || r.status !== 0) {
+                console.log('  [WARN] serve install failed — frontend pm2 entry mungkin tidak jalan.');
+            }
+        }
+        apps.push({
+            name: pm2Name(ctx.project, 'frontend'),
+            script: 'node_modules/serve/build/main.js',
+            args: `./frontend/apps/${ctx.project} -l ${ctx.cfg.WEB_SERVER_PORT}`,
+            cwd: ctx.cwd,
+            instances: 1,
+            exec_mode: 'fork',
+            autorestart: true,
+            watch: false,
+            max_memory_restart: '512M',
+            kill_timeout: 3000,
+            windowsHide: true,
+            env: {
+                NODE_ENV: 'production',
+                PM2_USAGE_METRICS: 'false'
+            }
+        });
+    }
+
+    const content = 'module.exports = ' + JSON.stringify({ apps }, null, 2) + ';\n';
+    const filePath = path.join(ctx.cwd, 'ecosystem.config.js');
+    fs.writeFileSync(filePath, content);
+    return filePath;
+}
+
+// ---------------------------------------------------------------------------
+// Pemilihan mode run service (Windows only): terminal baru atau pm2
+// ---------------------------------------------------------------------------
+
+const RUN_MODE_MENU = [
+    { key: 'terminal', text: 'New terminal window' },
+    { key: 'pm2',      text: 'pm2 (process manager)' }
+];
+
+/**
+ * Dialog pemilihan mode run: hanya muncul di Windows. Linux selalu pakai pm2.
+ * Mengikuti pola arrowSelect (TTY) / numbered fallback (non-TTY) seperti
+ * selectScope dan selectConfigAction.
+ *
+ * @returns {Promise<'terminal'|'pm2'>}
+ */
+async function selectRunMode(prompter) {
+    if (!process.stdin.isTTY) {
+        console.log('');
+        console.log('  How to run the service?');
+        console.log('');
+        RUN_MODE_MENU.forEach((m, i) => console.log(`    ${i + 1}. ${m.text}`));
+        console.log('');
+        let choice = null;
+        while (!choice) {
+            const c = (await prompter.ask('  Choice (1-2) [1]: ')).trim() || '1';
+            const idx = parseInt(c, 10) - 1;
+            if (idx >= 0 && idx < RUN_MODE_MENU.length) choice = RUN_MODE_MENU[idx];
+            else console.log('  Invalid choice. Enter 1 or 2.');
+        }
+        return choice.key;
+    }
+
+    const chosen = await arrowSelect({
+        title: 'How to run the service?',
+        items: RUN_MODE_MENU.map((m) => m.text),
+        initialIndex: 0,
+        prompter
+    });
+    return RUN_MODE_MENU[chosen].key;
+}
+
 function printFinalSummary(ctx) {
     const parts = [];
     if (ctx.scope.backend) parts.push('REST API generated');
@@ -1380,7 +1578,7 @@ function printFinalSummary(ctx) {
  * REST API Only) maupun `maybeRunServerAndFrontend` (scope REST API +
  * Frontend, server harus start lebih dulu sebelum frontend).
  */
-async function startServerNow(ctx) {
+async function startServerNow(ctx, runMode = 'terminal') {
     // Samakan dengan pola server-start.bat: serve + --watch (auto-restart pada
     // perubahan src/). Format log rapi (pino-pretty) berasal dari NODE_ENV
     // development yang di-set saat spawn di bawah.
@@ -1395,20 +1593,32 @@ async function startServerNow(ctx) {
     const serveEnv = { ...process.env, NODE_ENV: 'development' };
 
     if (process.platform === 'win32') {
-        console.log(`\n  Opening new window: "${title}"`);
-        console.log(`#${serveCmd}`);
-        const r = spawnSync('cmd', ['/C', 'start', title, 'cmd', '/k', serveCmd], { cwd: ctx.cwd, stdio: 'inherit', env: serveEnv });
-        if (r.error) {
-            console.log(`  Failed to open server window: ${r.error.message}`);
-            return false;
+        if (runMode === 'pm2') {
+            console.log(`\n  Starting via pm2: "${title}"`);
+            const name = pm2Name(ctx.project, 'server');
+            const ok = pm2StartScript(name, ctx.ecosystemPath);
+            if (!ok) {
+                console.log('  Failed to start via pm2. Is pm2 installed? (npm install -g pm2)');
+                return false;
+            }
+            console.log(`  ✓ Server started via pm2 as "${name}".`);
+            console.log(`    pm2 logs ${name}   |   pm2 reload ${name}   |   pm2 stop ${name}`);
+        } else {
+            console.log(`\n  Opening new window: "${title}"`);
+            console.log(`#${serveCmd}`);
+            const r = spawnSync('cmd', ['/C', 'start', title, 'cmd', '/k', serveCmd], { cwd: ctx.cwd, stdio: 'inherit', env: serveEnv });
+            if (r.error) {
+                console.log(`  Failed to open server window: ${r.error.message}`);
+                return false;
+            }
+            console.log('  ✓ Server window opened. Keep it open. Stop with Ctrl+C.');
         }
-        console.log('  ✓ Server window opened. Keep it open. Stop with Ctrl+C.');
     } else {
         // Tidak ada konsep "window baru" di Linux/macOS (terutama session SSH headless) -
         // pakai pm2 supaya proses bisa dikelola normal (pm2 list/logs/reload/stop).
         console.log(`\n  Starting via pm2: "${title}"`);
         const name = pm2Name(ctx.project, 'server');
-        const ok = pm2StartScript(name, ctx.serverStartFile, ctx.cwd);
+        const ok = pm2StartScript(name, ctx.ecosystemPath);
         if (!ok) {
             console.log('  Failed to start via pm2. Is pm2 installed? (npm install -g pm2)');
             return false;
@@ -1432,16 +1642,16 @@ async function startServerNow(ctx) {
     return true;
 }
 
-/** Konfirmasi lalu jalankan runtime server di window CMD baru. Dipakai scope REST API Only. */
+/** Konfirmasi lalu jalankan runtime server. Dipakai scope REST API Only. */
 async function maybeRunServer(ctx, ask) {
     const serveCmd = `npx restforge serve --project=${ctx.project} --config=${ctx.configFlag} --watch`;
     console.log('');
-    const answer = (await ask('  Run Runtime Server now in a new window? (Y/n): ')).trim().toLowerCase();
+    const answer = (await ask('  Run Runtime Server now? (Y/n): ')).trim().toLowerCase();
     if (answer === 'n' || answer === 'no') {
         console.log(`  Skipped. Start later:  ${serveCmd}`);
         return;
     }
-    await startServerNow(ctx);
+    await startServerNow(ctx, ctx.runMode);
 }
 
 /**
@@ -1449,7 +1659,7 @@ async function maybeRunServer(ctx, ask) {
  * lalu otomatis buka browser default ke index.html agar user tidak perlu
  * membukanya manual. Eksekusi murni (tanpa prompt).
  */
-async function startFrontendNow(ctx) {
+async function startFrontendNow(ctx, runMode = 'terminal') {
     const appDir = path.join(ctx.cwd, 'frontend', 'apps', ctx.project);
     const webPort = ctx.cfg.WEB_SERVER_PORT;
     // Jalankan langsung `npx serve . -l <port>` (identik untuk Windows & Linux),
@@ -1465,18 +1675,30 @@ async function startFrontendNow(ctx) {
     const title = `RESTForge Frontend - ${ctx.project}`;
 
     if (process.platform === 'win32') {
-        console.log(`\n  Opening new window: "${title}"`);
-        console.log(`#${serveCmd}`);
-        const r = spawnSync('cmd', ['/C', 'start', title, 'cmd', '/k', serveCmd], { cwd: appDir, stdio: 'inherit' });
-        if (r.error) {
-            console.log(`  Failed to open frontend window: ${r.error.message}`);
-            return false;
+        if (runMode === 'pm2') {
+            console.log(`\n  Starting via pm2: "${title}"`);
+            const name = pm2Name(ctx.project, 'frontend');
+            const ok = pm2StartScript(name, ctx.ecosystemPath);
+            if (!ok) {
+                console.log('  Failed to start via pm2. Is pm2 installed? (npm install -g pm2)');
+                return false;
+            }
+            console.log(`  ✓ Frontend started via pm2 as "${name}" (WEB_SERVER_PORT ${webPort}).`);
+            console.log(`    pm2 logs ${name}   |   pm2 reload ${name}   |   pm2 stop ${name}`);
+        } else {
+            console.log(`\n  Opening new window: "${title}"`);
+            console.log(`#${serveCmd}`);
+            const r = spawnSync('cmd', ['/C', 'start', title, 'cmd', '/k', serveCmd], { cwd: appDir, stdio: 'inherit' });
+            if (r.error) {
+                console.log(`  Failed to open frontend window: ${r.error.message}`);
+                return false;
+            }
+            console.log(`  ✓ Frontend window opened (WEB_SERVER_PORT ${webPort}).`);
         }
-        console.log(`  ✓ Frontend window opened (WEB_SERVER_PORT ${webPort}).`);
     } else {
         console.log(`\n  Starting via pm2: "${title}"`);
         const name = pm2Name(ctx.project, 'frontend');
-        const ok = pm2StartScript(name, ctx.frontendStartFile, appDir);
+        const ok = pm2StartScript(name, ctx.ecosystemPath);
         if (!ok) {
             console.log('  Failed to start via pm2. Is pm2 installed? (npm install -g pm2)');
             return false;
@@ -1521,14 +1743,14 @@ async function maybeRunServerAndFrontend(ctx, ask) {
     const serveCmd = `npx restforge serve --project=${ctx.project} --config=${ctx.configFlag} --watch`;
     const frontendCmd = `npx serve . -l ${ctx.cfg.WEB_SERVER_PORT}`;
     console.log('');
-    const answer = (await ask('  Run Runtime Server and frontend application now in a new window? (Y/n): ')).trim().toLowerCase();
+    const answer = (await ask('  Run Runtime Server and frontend application now? (Y/n): ')).trim().toLowerCase();
     if (answer === 'n' || answer === 'no') {
         console.log(`  Skipped. Start later:  ${serveCmd}`);
         console.log(`  Skipped. Start later (in frontend/apps/${ctx.project}):  ${frontendCmd}`);
         return;
     }
-    await startServerNow(ctx);
-    await startFrontendNow(ctx);
+    await startServerNow(ctx, ctx.runMode);
+    await startFrontendNow(ctx, ctx.runMode);
 }
 
 // ---------------------------------------------------------------------------
@@ -1660,26 +1882,23 @@ module.exports = {
                 await confirmDefaultMode(ctx, prompter.ask);
             }
 
-            // 6) Eksekusi sesuai scope.
-            if (ctx.scope.backend) {
-                runBackendPipeline(ctx);
-                // Launcher start REST API mandiri (sesuai OS), di folder kerja.
-                ctx.serverStartFile = writeServerStartScript(ctx);
-            }
-            if (ctx.scope.frontend) {
-                runFrontendPipeline(ctx);
-                // Launcher start frontend mandiri (sesuai OS), dipakai juga sebagai
-                // target `pm2 start` di non-Windows.
-                ctx.frontendStartFile = writeFrontendStartScript(ctx);
-            }
+            // 6) Eksekusi pipeline.
+            if (ctx.scope.backend) runBackendPipeline(ctx);
+            if (ctx.scope.frontend) runFrontendPipeline(ctx);
+
+            // ecosystem.config.js dibuat setelah pipeline selesai.
+            ctx.ecosystemPath = writeEcosystemConfig(ctx);
+
+            // Pilih run mode di Windows sebelum menulis bat file agar konten bat
+            // sesuai pilihan (pm2 start ecosystem / npx langsung).
+            ctx.runMode = process.platform === 'win32' ? await selectRunMode(prompter) : 'pm2';
+
+            if (ctx.scope.backend) ctx.serverStartFile = writeServerStartScript(ctx);
+            if (ctx.scope.frontend) ctx.frontendStartFile = writeFrontendStartScript(ctx);
 
             printFinalSummary(ctx);
 
-            // 7) Tawarkan menjalankan service. Scope REST API + Frontend -> SATU
-            //    dialog konfirmasi gabungan, tapi eksekusi tetap wajib runtime
-            //    server lebih dulu baru frontend (frontend butuh API hidup).
-            //    Scope REST API Only -> dialog server saja (tidak ada frontend
-            //    yang di-generate, SCOPES tidak punya opsi frontend-only).
+            // 7) Tawarkan menjalankan service.
             if (ctx.scope.backend && ctx.scope.frontend) {
                 await maybeRunServerAndFrontend(ctx, prompter.ask);
             } else if (ctx.scope.backend) {

package/generators/cli/init.js

@@ -9,8 +9,9 @@
  * Dua mode operasi:
  *   1. Interaktif (default, hanya saat stdin TTY dan TANPA --force):
  *      dialog konfirmasi gaya fast-track. Meminta input LICENSE, tipe database
- *      beserta atributnya, dan nama file config (default db-connection.env, bisa
- *      di-custom). Nilai input di-patch ke template lalu ditulis.
+ *      beserta atributnya, CORS_ORIGINS (default '*'), dan nama file config
+ *      (default db-connection.env, bisa di-custom). Nilai input di-patch ke
+ *      template lalu ditulis.
  *   2. Non-interaktif (saat --force diberikan ATAU stdin bukan TTY):
  *      menulis template apa adanya ke config/db-connection.env (perilaku legacy).
  *      Jalur ini dipakai oleh orkestrator (fast-track) dan playbook yang
@@ -104,12 +105,35 @@ function dbDefaultsFor(dbType) {
     return { ...DB_DEFAULTS, ...override };
 }
 
+// Default CORS_ORIGINS: '*' (semua origin). Selaras dengan default template dan
+// perilaku backward-compatible middleware. Pengguna mengganti dengan daftar
+// origin frontend spesifik untuk production saat prompt.
+const DEFAULT_CORS_ORIGINS = '*';
+
 /** Representasi database untuk baris review, berdasarkan konfigurasi input. */
 function describeDatabase(cfg) {
     if (cfg.DB_TYPE === 'sqlite') return `sqlite @ ${cfg.DB_FILE}`;
     return `${cfg.DB_TYPE} @ ${cfg.DB_HOST}:${cfg.DB_PORT}/${cfg.DB_NAME}`;
 }
 
+/**
+ * Normalisasi input DB_FILE SQLite dari user menjadi path yang lengkap.
+ *
+ * Aturan:
+ *   - Tanpa komponen direktori (mis. "guestbook" atau "guestbook.db")
+ *     → dimasukkan ke ./data/ → "./data/guestbook.db"
+ *   - Dengan direktori custom (mis. "./dataku/guestbook")
+ *     → path dihormati, hanya ekstensi yang ditambahkan → "./dataku/guestbook.db"
+ *   - Ekstensi .db selalu ditambahkan jika belum ada.
+ */
+function normalizeDbFilePath(input) {
+    let result = input.trim();
+    if (!result.endsWith('.db')) result += '.db';
+    const hasDir = result.includes('/') || result.includes('\\');
+    if (!hasDir) result = './data/' + result;
+    return result;
+}
+
 /**
  * Fase input konfigurasi interaktif: LICENSE lalu tipe database beserta
  * atributnya. Mengembalikan objek cfg. `ask` di-inject agar dapat diuji.
@@ -139,7 +163,8 @@ async function collectConfig(ask) {
         console.log('  SQLite mode: DB_HOST, DB_PORT, DB_USER, DB_PASSWORD are ignored.');
         console.log('  The database file path is set in DB_NAME (via DB_FILE).');
         console.log('');
-        cfg.DB_FILE = await askField('DB_FILE (.db file path)', DB_DEFAULTS.DB_FILE);
+        const dbFileRaw = await askField('DB_FILE (.db file path)', DB_DEFAULTS.DB_FILE);
+        cfg.DB_FILE = normalizeDbFilePath(dbFileRaw);
     } else {
         const d = dbDefaultsFor(cfg.DB_TYPE);
         cfg.DB_HOST = await askField('DB_HOST', d.DB_HOST);
@@ -149,6 +174,13 @@ async function collectConfig(ask) {
         cfg.DB_NAME = await askField('DB_NAME', d.DB_NAME);
     }
 
+    // 3) CORS — origin frontend yang diizinkan mengakses API dari browser.
+    //    Default '*' (semua origin); isi daftar origin spesifik untuk production.
+    console.log('');
+    console.log('  CORS_ORIGINS: frontend origin(s) allowed to call the API');
+    console.log("  (comma-separated, or '*' for all origins).");
+    cfg.CORS_ORIGINS = await askField('CORS_ORIGINS', DEFAULT_CORS_ORIGINS);
+
     return cfg;
 }
 
@@ -158,6 +190,7 @@ function envValuesFromCfg(cfg) {
         LICENSE: cfg.LICENSE,
         DB_TYPE: cfg.DB_TYPE
     };
+    if (cfg.CORS_ORIGINS) v.CORS_ORIGINS = cfg.CORS_ORIGINS;
     if (cfg.DB_TYPE === 'sqlite') {
         // Untuk SQLite, path file disimpan pada DB_NAME (dikonsumsi runtime).
         v.DB_NAME = cfg.DB_FILE;
@@ -222,6 +255,7 @@ async function confirmWrite(ctx, ask) {
     console.log('====================================================');
     console.log(`  License   : ${maskLicense(ctx.cfg.LICENSE)}`);
     console.log(`  Database  : ${describeDatabase(ctx.cfg)}`);
+    console.log(`  CORS      : ${ctx.cfg.CORS_ORIGINS}`);
     const existsNote = ctx.exists ? '   (EXISTING — will be overwritten)' : '';
     console.log(`  Target    : config/${ctx.configFileName}${existsNote}`);
     console.log('');