@restforgejs/platform 5.3.7 → 5.3.10

package/cli/designer.js

@@ -1,3 +1,3 @@
 #!/usr/bin/env node
 
-'use strict';const a0_0x5c9a7d=a0_0x236a;(function(_0xd30869,_0x3fbe52){const _0x564c38=a0_0x236a,_0x103c81=_0xd30869();while(!![]){try{const _0x7b0e0=parseInt(_0x564c38(0x174))/0x1+parseInt(_0x564c38(0x15f))/0x2*(parseInt(_0x564c38(0x16f))/0x3)+parseInt(_0x564c38(0x164))/0x4*(-parseInt(_0x564c38(0x167))/0x5)+parseInt(_0x564c38(0x16c))/0x6+parseInt(_0x564c38(0x15c))/0x7+parseInt(_0x564c38(0x161))/0x8+-parseInt(_0x564c38(0x16e))/0x9;if(_0x7b0e0===_0x3fbe52)break;else _0x103c81['push'](_0x103c81['shift']());}catch(_0x5e04bc){_0x103c81['push'](_0x103c81['shift']());}}}(a0_0x21dd,0x72bb3));const os=require('os'),path=require(a0_0x5c9a7d(0x173)),fs=require('fs'),{spawn}=require('child_process');function resolveBinaryPath(){const _0x40e5af=a0_0x5c9a7d,_0x360cb6={'obiKl':function(_0xc94ff9,_0x14e727){return _0xc94ff9===_0x14e727;}},_0x3435e4=os['platform'](),_0x186c55=path[_0x40e5af(0x168)](__dirname,'..','bin');if(_0x360cb6['obiKl'](_0x3435e4,'win32'))return path[_0x40e5af(0x160)](_0x186c55,_0x40e5af(0x15b));if(_0x360cb6[_0x40e5af(0x16a)](_0x3435e4,_0x40e5af(0x165)))return path['join'](_0x186c55,_0x40e5af(0x172));return null;}const binaryPath=resolveBinaryPath();function a0_0x21dd(){const _0xf2ee89=['mtuXnZmXtM9QAu9y','C2XPy2u','CMvZDgzVCMDLlwrLC2LNBMvYlMv4zq','mtC4ntC0ou9vwu9TAG','Aw5OzxjPDa','zxjYB3i','nty3mJy4DxL1DeHZ','AM9PBG','nty3nZeYz0HiyNz4','zxHPC3rZu3LUyW','sw5ZDgfSBcb1BgfUzYbaCMvZDgzVCMDLANmVCgXHDgzVCM0GDw50DwSGBwvUzgfWyxrRyw4GyMLUyxj5ihLHBMCGC2vZDwfPlG','ofrxqwDsCG','BgLUDxG','y2HTB2rtEw5J','mJi3ndm2nuHszvvgAW','CMvZB2X2zq','rxjYB3i6ihjLC3rMB3jNzs1KzxnPz25LCIb0AwrHAYbKAwr1A3vUzYbKAsbWBgf0zM9YBsbPBMKGka','B2jPs2W','A2LSBa','mZCXmZe5mhrVthrryq','CgLK','ntu0nenmsen4CW','m0fIwKzkCq','BwvZC2fNzq','zxHPDa','CMvZDgzVCMDLlwrLC2LNBMvYlwXPBNv4','Cgf0Aa'];a0_0x21dd=function(){return _0xf2ee89;};return a0_0x21dd();}function a0_0x236a(_0x569c58,_0x5b0331){_0x569c58=_0x569c58-0x15a;const _0x21dd50=a0_0x21dd();let _0x236a0b=_0x21dd50[_0x569c58];if(a0_0x236a['wTJqNa']===undefined){var _0xcd6aa0=function(_0x5c2f71){const _0x3e09e3='abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+/=';let _0x4ab395='',_0x2132ac='';for(let _0x2538c7=0x0,_0x39be92,_0x41a3c7,_0x405ded=0x0;_0x41a3c7=_0x5c2f71['charAt'](_0x405ded++);~_0x41a3c7&&(_0x39be92=_0x2538c7%0x4?_0x39be92*0x40+_0x41a3c7:_0x41a3c7,_0x2538c7++%0x4)?_0x4ab395+=String['fromCharCode'](0xff&_0x39be92>>(-0x2*_0x2538c7&0x6)):0x0){_0x41a3c7=_0x3e09e3['indexOf'](_0x41a3c7);}for(let _0xa2141=0x0,_0x59b3ce=_0x4ab395['length'];_0xa2141<_0x59b3ce;_0xa2141++){_0x2132ac+='%'+('00'+_0x4ab395['charCodeAt'](_0xa2141)['toString'](0x10))['slice'](-0x2);}return decodeURIComponent(_0x2132ac);};a0_0x236a['wpZREI']=_0xcd6aa0,a0_0x236a['zVeeZR']={},a0_0x236a['wTJqNa']=!![];}const _0x1d6c11=_0x21dd50[0x0],_0x233368=_0x569c58+_0x1d6c11,_0x3b4ad9=a0_0x236a['zVeeZR'][_0x233368];return!_0x3b4ad9?(_0x236a0b=a0_0x236a['wpZREI'](_0x236a0b),a0_0x236a['zVeeZR'][_0x233368]=_0x236a0b):_0x236a0b=_0x3b4ad9,_0x236a0b;}!binaryPath&&(console[a0_0x5c9a7d(0x15e)](a0_0x5c9a7d(0x169)+os['platform']()+').'),process['exit'](0x1));!fs[a0_0x5c9a7d(0x162)](binaryPath)&&(console[a0_0x5c9a7d(0x15e)]('Error:\x20binary\x20restforge-designer\x20tidak\x20ditemukan\x20di\x20'+binaryPath+'.'),console['error'](a0_0x5c9a7d(0x163)),process[a0_0x5c9a7d(0x171)](0x1));if(os['platform']()!=='win32')try{fs[a0_0x5c9a7d(0x166)](binaryPath,0x1ed);}catch{}const child=spawn(binaryPath,process['argv'][a0_0x5c9a7d(0x15a)](0x2),{'stdio':a0_0x5c9a7d(0x15d)});child['on']('error',_0x1fb584=>{const _0xc2b3e8=a0_0x5c9a7d;console['error']('Error\x20menjalankan\x20restforge-designer:\x20'+_0x1fb584[_0xc2b3e8(0x170)]),process['exit'](0x1);}),child['on'](a0_0x5c9a7d(0x171),(_0x35f0bb,_0x216a00)=>{const _0x4404df=a0_0x5c9a7d,_0x5bfe6d={'ntiIm':function(_0x3b72fb,_0x1ce886){return _0x3b72fb??_0x1ce886;}};if(_0x216a00)process[_0x4404df(0x16b)](process[_0x4404df(0x16d)],_0x216a00);else process[_0x4404df(0x171)](_0x5bfe6d['ntiIm'](_0x35f0bb,0x0));});
+'use strict';const a0_0x230784=a0_0x216a;(function(_0x4e45da,_0x2cdfa3){const _0xf63be7=a0_0x216a,_0x174723=_0x4e45da();while(!![]){try{const _0x171e51=-parseInt(_0xf63be7(0x12b))/0x1*(parseInt(_0xf63be7(0x127))/0x2)+parseInt(_0xf63be7(0x12a))/0x3*(parseInt(_0xf63be7(0x131))/0x4)+-parseInt(_0xf63be7(0x12c))/0x5*(parseInt(_0xf63be7(0x129))/0x6)+-parseInt(_0xf63be7(0x13a))/0x7*(-parseInt(_0xf63be7(0x133))/0x8)+parseInt(_0xf63be7(0x125))/0x9+parseInt(_0xf63be7(0x134))/0xa+parseInt(_0xf63be7(0x130))/0xb*(-parseInt(_0xf63be7(0x132))/0xc);if(_0x171e51===_0x2cdfa3)break;else _0x174723['push'](_0x174723['shift']());}catch(_0x1f791b){_0x174723['push'](_0x174723['shift']());}}}(a0_0x12bb,0x4a02e));function a0_0x216a(_0x363aca,_0x4874f0){_0x363aca=_0x363aca-0x124;const _0x12bb6e=a0_0x12bb();let _0x216a13=_0x12bb6e[_0x363aca];if(a0_0x216a['OvGUrM']===undefined){var _0x3f73a2=function(_0x1184df){const _0x4f844d='abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+/=';let _0x537a67='',_0x1e9fde='';for(let _0x52eff1=0x0,_0x28f863,_0x4d8c9b,_0x1a77c5=0x0;_0x4d8c9b=_0x1184df['charAt'](_0x1a77c5++);~_0x4d8c9b&&(_0x28f863=_0x52eff1%0x4?_0x28f863*0x40+_0x4d8c9b:_0x4d8c9b,_0x52eff1++%0x4)?_0x537a67+=String['fromCharCode'](0xff&_0x28f863>>(-0x2*_0x52eff1&0x6)):0x0){_0x4d8c9b=_0x4f844d['indexOf'](_0x4d8c9b);}for(let _0x31c0e7=0x0,_0x2882f4=_0x537a67['length'];_0x31c0e7<_0x2882f4;_0x31c0e7++){_0x1e9fde+='%'+('00'+_0x537a67['charCodeAt'](_0x31c0e7)['toString'](0x10))['slice'](-0x2);}return decodeURIComponent(_0x1e9fde);};a0_0x216a['fQrvpc']=_0x3f73a2,a0_0x216a['vbuVwH']={},a0_0x216a['OvGUrM']=!![];}const _0x207509=_0x12bb6e[0x0],_0x4f07bf=_0x363aca+_0x207509,_0x51fd17=a0_0x216a['vbuVwH'][_0x4f07bf];return!_0x51fd17?(_0x216a13=a0_0x216a['fQrvpc'](_0x216a13),a0_0x216a['vbuVwH'][_0x4f07bf]=_0x216a13):_0x216a13=_0x51fd17,_0x216a13;}const os=require('os'),path=require('path'),fs=require('fs'),{spawn}=require(a0_0x230784(0x12d));function resolveBinaryPath(){const _0x1a7e3d=a0_0x230784,_0x26c228={'kRQGc':'bin','giueu':'win32','yAxDd':function(_0x154a70,_0x53ccda){return _0x154a70===_0x53ccda;},'iZskE':_0x1a7e3d(0x124)},_0x483547=os[_0x1a7e3d(0x13b)](),_0x275336=path['resolve'](__dirname,'..',_0x26c228[_0x1a7e3d(0x135)]);if(_0x483547===_0x26c228['giueu'])return path['join'](_0x275336,'restforge-designer.exe');if(_0x26c228['yAxDd'](_0x483547,_0x1a7e3d(0x12e)))return path[_0x1a7e3d(0x139)](_0x275336,_0x26c228[_0x1a7e3d(0x126)]);return null;}const binaryPath=resolveBinaryPath();!binaryPath&&(console['error']('Error:\x20restforge-designer\x20tidak\x20didukung\x20di\x20platform\x20ini\x20('+os['platform']()+').'),process['exit'](0x1));!fs['existsSync'](binaryPath)&&(console['error']('Error:\x20binary\x20restforge-designer\x20tidak\x20ditemukan\x20di\x20'+binaryPath+'.'),console['error']('Install\x20ulang\x20@restforgejs/platform\x20untuk\x20mendapatkan\x20binary\x20yang\x20sesuai.'),process[a0_0x230784(0x137)](0x1));function a0_0x12bb(){const _0x3847d3=['mvvND2jwuG','ntqZntvWCxjezfq','y2HPBgrFChjVy2vZCW','BgLUDxG','zxjYB3i','nJC2mZL3C0nqzem','mZu2q3Lkyvb2','mJC2qMTgA3nO','nda4BLj1wMvM','ndm2mZq5mgXgq2DAyG','A1jrr2m','Aw5OzxjPDa','zxHPDa','C2XPy2u','AM9PBG','mte2nJjzsNf2A2e','CgXHDgzVCM0','CMvZDgzVCMDLlwrLC2LNBMvYlwXPBNv4','nte0mZyXn05UBLrLrq','AvPZA0u','mtiWmZC4mLfVt214wa','D2LUmZi','nZHbwLburei','mZiWmvvWq3vHtq'];a0_0x12bb=function(){return _0x3847d3;};return a0_0x12bb();}if(os['platform']()!==a0_0x230784(0x128))try{fs['chmodSync'](binaryPath,0x1ed);}catch{}const child=spawn(binaryPath,process['argv'][a0_0x230784(0x138)](0x2),{'stdio':a0_0x230784(0x136)});child['on'](a0_0x230784(0x12f),_0xf76e73=>{console['error']('Error\x20menjalankan\x20restforge-designer:\x20'+_0xf76e73['message']),process['exit'](0x1);}),child['on'](a0_0x230784(0x137),(_0x38f8c1,_0x5ef93c)=>{const _0x1122e3=a0_0x230784;if(_0x5ef93c)process['kill'](process['pid'],_0x5ef93c);else process[_0x1122e3(0x137)](_0x38f8c1??0x0);});

package/generators/cli/fast-track.js

@@ -54,7 +54,8 @@ const DEFAULTS = {
     DB_USER: 'postgres',
     DB_PASSWORD: 'postgres1234',
     DB_NAME: 'dbsandbox',
-    DB_FILE: './data/sandbox.db'
+    DB_FILE: './data/sandbox.db',
+    CORS_ENABLED: 'true'
 };
 
 const DEFAULT_CONFIG_FILE = 'db-connection.env';
@@ -208,6 +209,16 @@ function describeDatabase(cfg) {
     return `${cfg.DB_TYPE} @ ${cfg.DB_HOST}:${cfg.DB_PORT}/${cfg.DB_NAME}`;
 }
 
+/**
+ * Default CORS_ORIGINS diturunkan dari origin web server (frontend) yang sudah
+ * diinput, mis. SERVER_ADDRESS=127.0.0.1 + WEB_SERVER_PORT=8000 →
+ * `http://127.0.0.1:8000`. Origin frontend inilah yang harus di-whitelist CORS
+ * agar aplikasi web bisa memanggil REST API dari browser.
+ */
+function defaultCorsOrigins(cfg) {
+    return `http://${cfg.SERVER_ADDRESS}:${cfg.WEB_SERVER_PORT}`;
+}
+
 // ---------------------------------------------------------------------------
 // Pengumpulan data preview (read-only, tanpa efek samping)
 // ---------------------------------------------------------------------------
@@ -341,6 +352,34 @@ function resolveSourceConfig(cwd, explicitConfig) {
     return { configName, fileCfg: data || {} };
 }
 
+// ---------------------------------------------------------------------------
+// Normalisasi path file SQLite
+// ---------------------------------------------------------------------------
+
+/**
+ * Normalisasi input DB_FILE SQLite dari user menjadi path yang lengkap.
+ *
+ * Aturan:
+ *   - Tanpa komponen direktori (mis. "myapp" atau "myapp.db")
+ *     → dimasukkan ke folder ./data/ → "./data/myapp.db"
+ *   - Dengan direktori custom (mis. "./dataku/myapp")
+ *     → path-nya dihormati, hanya ekstensi yang ditambahkan → "./dataku/myapp.db"
+ *   - Ekstensi .db selalu ditambahkan jika belum ada.
+ *
+ * Contoh:
+ *   "myapp"            → "./data/myapp.db"
+ *   "myapp.db"         → "./data/myapp.db"
+ *   "./dataku/myapp"   → "./dataku/myapp.db"
+ *   "./data/myapp.db"  → "./data/myapp.db"  (tidak berubah)
+ */
+function normalizeDbFilePath(input) {
+    let result = input.trim();
+    if (!result.endsWith('.db')) result += '.db';
+    const hasDir = result.includes('/') || result.includes('\\');
+    if (!hasDir) result = './data/' + result;
+    return result;
+}
+
 // ---------------------------------------------------------------------------
 // Fase input konfigurasi (LICENSE + database), mengikuti fast-track.mjs
 // ---------------------------------------------------------------------------
@@ -375,6 +414,11 @@ async function collectConfig(args, ask, fileCfg = {}) {
     cfg.SERVER_PORT = await askField('REST_API_PORT', fileCfg.SERVER_PORT || DEFAULTS.SERVER_PORT);
     cfg.WEB_SERVER_PORT = await askField('WEB_SERVER_PORT', DEFAULTS.WEB_SERVER_PORT);
 
+    // CORS: CORS_ENABLED diikutkan apa adanya (default true, tidak diprompt edit);
+    // CORS_ORIGINS dapat diedit dengan default origin web server yang baru diisi.
+    cfg.CORS_ENABLED = fileCfg.CORS_ENABLED || DEFAULTS.CORS_ENABLED;
+    cfg.CORS_ORIGINS = await askField('CORS_ORIGINS', fileCfg.CORS_ORIGINS || defaultCorsOrigins(cfg));
+
     // DB_TYPE menentukan atribut yang diminta berikutnya.
     console.log('');
     console.log('  Available DB_TYPE: postgresql, mysql, oracle, sqlite');
@@ -387,7 +431,8 @@ async function collectConfig(args, ask, fileCfg = {}) {
         console.log('');
         // fileCfg.DB_NAME: file legacy hasil `restforge init` menyimpan path
         // sqlite di DB_NAME, bukan DB_FILE (lihat init.js & server.js runtime).
-        cfg.DB_FILE = await askField('DB_FILE (.db file path)', fileCfg.DB_FILE || fileCfg.DB_NAME || DEFAULTS.DB_FILE);
+        const dbFileRaw = await askField('DB_FILE (.db file path)', fileCfg.DB_FILE || fileCfg.DB_NAME || DEFAULTS.DB_FILE);
+        cfg.DB_FILE = normalizeDbFilePath(dbFileRaw);
         cfg.DB_NAME = cfg.DB_FILE;
     } else {
         const dbDef = DB_TYPE_DEFAULTS[cfg.DB_TYPE] || {};
@@ -414,6 +459,8 @@ function defaultCfgFromFile(args, fileCfg = {}) {
     cfg.SERVER_ADDRESS = fileCfg.SERVER_ADDRESS || DEFAULTS.SERVER_ADDRESS;
     cfg.SERVER_PORT = fileCfg.SERVER_PORT || DEFAULTS.SERVER_PORT;
     cfg.WEB_SERVER_PORT = DEFAULTS.WEB_SERVER_PORT;
+    cfg.CORS_ENABLED = fileCfg.CORS_ENABLED || DEFAULTS.CORS_ENABLED;
+    cfg.CORS_ORIGINS = fileCfg.CORS_ORIGINS || defaultCorsOrigins(cfg);
     cfg.DB_TYPE = (fileCfg.DB_TYPE || DEFAULTS.DB_TYPE).toLowerCase();
 
     if (cfg.DB_TYPE === 'sqlite') {
@@ -447,6 +494,8 @@ function printExistingConfigSummary({ project, schemaFlag, configName, cfg, over
     console.log(`  License    : ${maskLicense(cfg.LICENSE)}`);
     console.log(`  REST API   : ${cfg.SERVER_ADDRESS}:${cfg.SERVER_PORT}`);
     console.log(`  Web server : ${cfg.SERVER_ADDRESS}:${cfg.WEB_SERVER_PORT}`);
+    console.log(`  CORS       : ${cfg.CORS_ENABLED}`);
+    console.log(`  CORS Origin: ${cfg.CORS_ORIGINS}`);
     console.log(`  Mode       : ${overwrite ? 'overwrite' : 'sync'}`);
     console.log('');
     console.log('  Database Configuration');
@@ -909,6 +958,8 @@ function envValuesFromCfg(cfg) {
         SERVER_PORT: cfg.SERVER_PORT,
         DB_TYPE: cfg.DB_TYPE
     };
+    if (cfg.CORS_ENABLED !== undefined) v.CORS_ENABLED = cfg.CORS_ENABLED;
+    if (cfg.CORS_ORIGINS !== undefined) v.CORS_ORIGINS = cfg.CORS_ORIGINS;
     if (cfg.DB_TYPE === 'sqlite') {
         v.DB_FILE = cfg.DB_FILE;
         v.DB_NAME = cfg.DB_NAME;
@@ -1262,16 +1313,25 @@ function runFrontendPipeline(ctx) {
  * biasa membiarkan NODE_ENV kosong sehingga logger memakai pino-pretty (rapi).
  */
 function writeServerStartScript(ctx) {
-    const serveCmd = `npx restforge serve --project=${ctx.project} --config=${ctx.configFlag} --watch`;
     const isWin = process.platform === 'win32';
     const file = path.join(ctx.cwd, isWin ? 'server-start.bat' : 'server-start.sh');
     let content;
-    if (isWin) {
+    if (isWin && ctx.runMode === 'pm2') {
+        const appName = pm2Name(ctx.project, 'server');
+        content = [
+            '@echo off',
+            'REM Start RESTForge REST API via pm2. Generated by fast-track.',
+            'cd /d "%~dp0"',
+            `call pm2 delete ${appName} >nul 2>&1`,
+            `call pm2 start ecosystem.config.js --only ${appName}`,
+            ''
+        ].join('\r\n');
+    } else if (isWin) {
         content = [
             '@echo off',
             'REM Start RESTForge REST API (runtime server). Generated by fast-track.',
             'cd /d "%~dp0"',
-            `call ${serveCmd}`,
+            `call npx restforge serve --project=${ctx.project} --config=${ctx.configFlag} --watch`,
             ''
         ].join('\r\n');
     } else {
@@ -1280,7 +1340,7 @@ function writeServerStartScript(ctx) {
             '# Start RESTForge REST API (runtime server). Generated by fast-track.',
             'set -e',
             'cd "$(dirname "$0")"',
-            serveCmd,
+            `npx restforge serve --project=${ctx.project} --config=${ctx.configFlag} --watch`,
             ''
         ].join('\n');
     }
@@ -1297,17 +1357,26 @@ function writeServerStartScript(ctx) {
  * writeServerStartScript, dipakai juga sebagai target `pm2 start` di non-Windows.
  */
 function writeFrontendStartScript(ctx) {
-    const serveCmd = `npx serve . -l ${ctx.cfg.WEB_SERVER_PORT}`;
     const isWin = process.platform === 'win32';
     const appDir = path.join(ctx.cwd, 'frontend', 'apps', ctx.project);
     const file = path.join(appDir, isWin ? 'frontend-start.bat' : 'frontend-start.sh');
     let content;
-    if (isWin) {
+    if (isWin && ctx.runMode === 'pm2') {
+        const appName = pm2Name(ctx.project, 'frontend');
+        content = [
+            '@echo off',
+            'REM Start RESTForge frontend app via pm2. Generated by fast-track.',
+            'cd /d "%~dp0"',
+            `call pm2 delete ${appName} >nul 2>&1`,
+            `call pm2 start ecosystem.config.js --only ${appName}`,
+            ''
+        ].join('\r\n');
+    } else if (isWin) {
         content = [
             '@echo off',
             'REM Start RESTForge frontend app. Generated by fast-track.',
             'cd /d "%~dp0"',
-            `call ${serveCmd}`,
+            `call npx serve . -l ${ctx.cfg.WEB_SERVER_PORT}`,
             ''
         ].join('\r\n');
     } else {
@@ -1316,7 +1385,7 @@ function writeFrontendStartScript(ctx) {
             '# Start RESTForge frontend app. Generated by fast-track.',
             'set -e',
             'cd "$(dirname "$0")"',
-            serveCmd,
+            `npx serve . -l ${ctx.cfg.WEB_SERVER_PORT}`,
             ''
         ].join('\n');
     }
@@ -1337,23 +1406,144 @@ function pm2Name(project, kind) {
     return `${project}-${kind}`;
 }
 
+/**
+ * Resolusi path entry executable `serve` yang BENAR-BENAR terpasang di
+ * node_modules project, version-agnostic. Membaca `bin` dari package.json serve
+ * (mis. serve v14 → `build/main.js`) lalu mengembalikan path absolut entry-nya.
+ *
+ * Mengembalikan null bila serve tidak resolvable (belum terpasang). Lebih andal
+ * daripada `fs.existsSync` pada path hardcoded: mendeteksi keberadaan paket yang
+ * sebenarnya (bukan sekadar asumsi struktur folder) dan ikut menyesuaikan bila
+ * versi serve mengubah lokasi entry.
+ */
+function resolveServeEntry(cwd) {
+    try {
+        const pkgPath = require.resolve('serve/package.json', { paths: [cwd] });
+        const pkg = require(pkgPath);
+        let bin = pkg.bin;
+        if (bin && typeof bin === 'object') bin = bin.serve || Object.values(bin)[0];
+        if (!bin || typeof bin !== 'string') return null;
+        const entry = path.resolve(path.dirname(pkgPath), bin);
+        return fs.existsSync(entry) ? entry : null;
+    } catch (_err) {
+        return null;
+    }
+}
+
 /**
  * Start (ulang) script launcher via pm2. Idempotent: hapus instance lama dulu
  * (silent, tolerant bila belum ada) supaya re-run fast-track tidak gagal
  * dengan "already launched". Return false bila pm2 tidak tersedia/gagal.
  */
-function pm2StartScript(name, scriptPath, cwd) {
+/**
+ * Start (ulang) satu app dari ecosystem.config.js via pm2. Idempotent: hapus
+ * instance lama dulu (silent) supaya re-run fast-track tidak gagal "already
+ * launched". Menggunakan `--only <name>` agar hanya app yang dimaksud yang
+ * di-start dari file ecosystem yang bisa berisi beberapa app.
+ *
+ * Pendekatan ecosystem + `interpreter: none` (dideklarasikan di
+ * writeEcosystemConfig) menghindari masalah pm2 default ke Node.js sebagai
+ * interpreter saat diberikan file .bat / .sh secara langsung.
+ */
+function pm2StartScript(name, ecosystemPath) {
     spawnSync(`pm2 delete ${name} --silent`, { shell: true, stdio: 'ignore' });
-    // Windows menjalankan .bat via cmd.exe secara otomatis; --interpreter bash
-    // hanya diperlukan untuk .sh di Linux/macOS.
-    const interpreterFlag = process.platform !== 'win32' ? ' --interpreter bash' : '';
     const r = spawnSync(
-        `pm2 start "${scriptPath}" --name ${name} --cwd "${cwd}"${interpreterFlag}`,
+        `pm2 start "${ecosystemPath}" --only ${name}`,
         { shell: true, stdio: 'inherit' }
     );
     return !r.error && r.status === 0;
 }
 
+/**
+ * Generate ecosystem.config.js di root project. pm2 membaca file ini untuk
+ * mengetahui cara menjalankan tiap app tanpa bergantung pada file launcher
+ * (.bat / .sh) yang rentan salah interpreter.
+ *
+ * `script: "npx"` + `interpreter: "none"` + `args: "..."` adalah pola yang
+ * bekerja seragam di Windows dan Linux: pm2 memanggil npx langsung sebagai
+ * executable OS, bukan membungkusnya dengan Node.
+ */
+/**
+ * Tulis file launcher Node.js kecil untuk satu proses pm2.
+ *
+ * pm2 menjalankan file .js dengan `node` secara default — tidak perlu
+ * interpreter khusus. Launcher ini menggunakan spawn({ shell: true }) agar
+ * `npx` resolves dengan benar di Windows (npx.cmd) maupun Linux, tanpa
+ * membuka window terminal baru.
+ */
+function writeEcosystemConfig(ctx) {
+    const apps = [];
+
+    if (ctx.scope.backend) {
+        apps.push({
+            name: pm2Name(ctx.project, 'server'),
+            script: 'node_modules/@restforgejs/platform/server.js',
+            args: `serve --project=${ctx.project} --config=${ctx.configFlag} --watch`,
+            cwd: ctx.cwd,
+            instances: 1,
+            exec_mode: 'fork',
+            autorestart: true,
+            watch: false,
+            max_memory_restart: '1G',
+            node_args: '--max-old-space-size=4096',
+            kill_timeout: 3000,
+            windowsHide: true,
+            env: {
+                NODE_ENV: 'production',
+                PM2_USAGE_METRICS: 'false'
+            }
+        });
+    }
+
+    if (ctx.scope.frontend) {
+        // `serve` ikut sebagai dependency @restforgejs/platform, jadi normalnya
+        // sudah ter-hoist di node_modules/serve setiap project yang memasang
+        // platform. resolveServeEntry mendeteksi keberadaannya secara
+        // version-agnostic. Install lazy di bawah hanya fallback untuk project
+        // lama yang ter-install sebelum serve ditambahkan ke deps platform.
+        let serveEntry = resolveServeEntry(ctx.cwd);
+        if (!serveEntry) {
+            console.log('\n  Installing serve (static file server for frontend)...');
+            const r = spawnSync('npm install serve', { cwd: ctx.cwd, shell: true, stdio: 'inherit' });
+            if (r.error || r.status !== 0) {
+                console.log('  [WARN] serve install failed — frontend pm2 entry mungkin tidak jalan.');
+            }
+            serveEntry = resolveServeEntry(ctx.cwd);
+        }
+        if (!serveEntry) {
+            console.log('  [WARN] serve entry not found after install — frontend pm2 app may fail to start.');
+            console.log('         Fallback: start frontend manually with `npx serve . -l ' + ctx.cfg.WEB_SERVER_PORT + '`.');
+        }
+        // Path script pm2 relatif ke cwd (forward slash), dari entry yang
+        // ter-resolve; fallback ke path kanonik serve v14 bila resolusi gagal.
+        const serveScript = serveEntry
+            ? path.relative(ctx.cwd, serveEntry).split(path.sep).join('/')
+            : 'node_modules/serve/build/main.js';
+        apps.push({
+            name: pm2Name(ctx.project, 'frontend'),
+            script: serveScript,
+            args: `./frontend/apps/${ctx.project} -l ${ctx.cfg.WEB_SERVER_PORT}`,
+            cwd: ctx.cwd,
+            instances: 1,
+            exec_mode: 'fork',
+            autorestart: true,
+            watch: false,
+            max_memory_restart: '512M',
+            kill_timeout: 3000,
+            windowsHide: true,
+            env: {
+                NODE_ENV: 'production',
+                PM2_USAGE_METRICS: 'false'
+            }
+        });
+    }
+
+    const content = 'module.exports = ' + JSON.stringify({ apps }, null, 2) + ';\n';
+    const filePath = path.join(ctx.cwd, 'ecosystem.config.js');
+    fs.writeFileSync(filePath, content);
+    return filePath;
+}
+
 // ---------------------------------------------------------------------------
 // Pemilihan mode run service (Windows only): terminal baru atau pm2
 // ---------------------------------------------------------------------------
@@ -1443,7 +1633,7 @@ async function startServerNow(ctx, runMode = 'terminal') {
         if (runMode === 'pm2') {
             console.log(`\n  Starting via pm2: "${title}"`);
             const name = pm2Name(ctx.project, 'server');
-            const ok = pm2StartScript(name, ctx.serverStartFile, ctx.cwd);
+            const ok = pm2StartScript(name, ctx.ecosystemPath);
             if (!ok) {
                 console.log('  Failed to start via pm2. Is pm2 installed? (npm install -g pm2)');
                 return false;
@@ -1465,7 +1655,7 @@ async function startServerNow(ctx, runMode = 'terminal') {
         // pakai pm2 supaya proses bisa dikelola normal (pm2 list/logs/reload/stop).
         console.log(`\n  Starting via pm2: "${title}"`);
         const name = pm2Name(ctx.project, 'server');
-        const ok = pm2StartScript(name, ctx.serverStartFile, ctx.cwd);
+        const ok = pm2StartScript(name, ctx.ecosystemPath);
         if (!ok) {
             console.log('  Failed to start via pm2. Is pm2 installed? (npm install -g pm2)');
             return false;
@@ -1490,7 +1680,7 @@ async function startServerNow(ctx, runMode = 'terminal') {
 }
 
 /** Konfirmasi lalu jalankan runtime server. Dipakai scope REST API Only. */
-async function maybeRunServer(ctx, ask, prompter) {
+async function maybeRunServer(ctx, ask) {
     const serveCmd = `npx restforge serve --project=${ctx.project} --config=${ctx.configFlag} --watch`;
     console.log('');
     const answer = (await ask('  Run Runtime Server now? (Y/n): ')).trim().toLowerCase();
@@ -1498,8 +1688,7 @@ async function maybeRunServer(ctx, ask, prompter) {
         console.log(`  Skipped. Start later:  ${serveCmd}`);
         return;
     }
-    const runMode = process.platform === 'win32' ? await selectRunMode(prompter) : 'pm2';
-    await startServerNow(ctx, runMode);
+    await startServerNow(ctx, ctx.runMode);
 }
 
 /**
@@ -1526,7 +1715,7 @@ async function startFrontendNow(ctx, runMode = 'terminal') {
         if (runMode === 'pm2') {
             console.log(`\n  Starting via pm2: "${title}"`);
             const name = pm2Name(ctx.project, 'frontend');
-            const ok = pm2StartScript(name, ctx.frontendStartFile, appDir);
+            const ok = pm2StartScript(name, ctx.ecosystemPath);
             if (!ok) {
                 console.log('  Failed to start via pm2. Is pm2 installed? (npm install -g pm2)');
                 return false;
@@ -1546,7 +1735,7 @@ async function startFrontendNow(ctx, runMode = 'terminal') {
     } else {
         console.log(`\n  Starting via pm2: "${title}"`);
         const name = pm2Name(ctx.project, 'frontend');
-        const ok = pm2StartScript(name, ctx.frontendStartFile, appDir);
+        const ok = pm2StartScript(name, ctx.ecosystemPath);
         if (!ok) {
             console.log('  Failed to start via pm2. Is pm2 installed? (npm install -g pm2)');
             return false;
@@ -1587,7 +1776,7 @@ async function startFrontendNow(ctx, runMode = 'terminal') {
  * butuh API sudah hidup), baru lanjut frontend setelah server window
  * terbuka + health check selesai.
  */
-async function maybeRunServerAndFrontend(ctx, ask, prompter) {
+async function maybeRunServerAndFrontend(ctx, ask) {
     const serveCmd = `npx restforge serve --project=${ctx.project} --config=${ctx.configFlag} --watch`;
     const frontendCmd = `npx serve . -l ${ctx.cfg.WEB_SERVER_PORT}`;
     console.log('');
@@ -1597,9 +1786,8 @@ async function maybeRunServerAndFrontend(ctx, ask, prompter) {
         console.log(`  Skipped. Start later (in frontend/apps/${ctx.project}):  ${frontendCmd}`);
         return;
     }
-    const runMode = process.platform === 'win32' ? await selectRunMode(prompter) : 'pm2';
-    await startServerNow(ctx, runMode);
-    await startFrontendNow(ctx, runMode);
+    await startServerNow(ctx, ctx.runMode);
+    await startFrontendNow(ctx, ctx.runMode);
 }
 
 // ---------------------------------------------------------------------------
@@ -1731,30 +1919,27 @@ module.exports = {
                 await confirmDefaultMode(ctx, prompter.ask);
             }
 
-            // 6) Eksekusi sesuai scope.
-            if (ctx.scope.backend) {
-                runBackendPipeline(ctx);
-                // Launcher start REST API mandiri (sesuai OS), di folder kerja.
-                ctx.serverStartFile = writeServerStartScript(ctx);
-            }
-            if (ctx.scope.frontend) {
-                runFrontendPipeline(ctx);
-                // Launcher start frontend mandiri (sesuai OS), dipakai juga sebagai
-                // target `pm2 start` di non-Windows.
-                ctx.frontendStartFile = writeFrontendStartScript(ctx);
-            }
+            // 6) Eksekusi pipeline.
+            if (ctx.scope.backend) runBackendPipeline(ctx);
+            if (ctx.scope.frontend) runFrontendPipeline(ctx);
+
+            // ecosystem.config.js dibuat setelah pipeline selesai.
+            ctx.ecosystemPath = writeEcosystemConfig(ctx);
+
+            // Pilih run mode di Windows sebelum menulis bat file agar konten bat
+            // sesuai pilihan (pm2 start ecosystem / npx langsung).
+            ctx.runMode = process.platform === 'win32' ? await selectRunMode(prompter) : 'pm2';
+
+            if (ctx.scope.backend) ctx.serverStartFile = writeServerStartScript(ctx);
+            if (ctx.scope.frontend) ctx.frontendStartFile = writeFrontendStartScript(ctx);
 
             printFinalSummary(ctx);
 
-            // 7) Tawarkan menjalankan service. Scope REST API + Frontend -> SATU
-            //    dialog konfirmasi gabungan, tapi eksekusi tetap wajib runtime
-            //    server lebih dulu baru frontend (frontend butuh API hidup).
-            //    Scope REST API Only -> dialog server saja (tidak ada frontend
-            //    yang di-generate, SCOPES tidak punya opsi frontend-only).
+            // 7) Tawarkan menjalankan service.
             if (ctx.scope.backend && ctx.scope.frontend) {
-                await maybeRunServerAndFrontend(ctx, prompter.ask, prompter);
+                await maybeRunServerAndFrontend(ctx, prompter.ask);
             } else if (ctx.scope.backend) {
-                await maybeRunServer(ctx, prompter.ask, prompter);
+                await maybeRunServer(ctx, prompter.ask);
             }
         } finally {
             prompter.close();

package/generators/cli/init.js

@@ -9,8 +9,9 @@
  * Dua mode operasi:
  *   1. Interaktif (default, hanya saat stdin TTY dan TANPA --force):
  *      dialog konfirmasi gaya fast-track. Meminta input LICENSE, tipe database
- *      beserta atributnya, dan nama file config (default db-connection.env, bisa
- *      di-custom). Nilai input di-patch ke template lalu ditulis.
+ *      beserta atributnya, CORS_ORIGINS (default '*'), dan nama file config
+ *      (default db-connection.env, bisa di-custom). Nilai input di-patch ke
+ *      template lalu ditulis.
  *   2. Non-interaktif (saat --force diberikan ATAU stdin bukan TTY):
  *      menulis template apa adanya ke config/db-connection.env (perilaku legacy).
  *      Jalur ini dipakai oleh orkestrator (fast-track) dan playbook yang
@@ -104,12 +105,35 @@ function dbDefaultsFor(dbType) {
     return { ...DB_DEFAULTS, ...override };
 }
 
+// Default CORS_ORIGINS: '*' (semua origin). Selaras dengan default template dan
+// perilaku backward-compatible middleware. Pengguna mengganti dengan daftar
+// origin frontend spesifik untuk production saat prompt.
+const DEFAULT_CORS_ORIGINS = '*';
+
 /** Representasi database untuk baris review, berdasarkan konfigurasi input. */
 function describeDatabase(cfg) {
     if (cfg.DB_TYPE === 'sqlite') return `sqlite @ ${cfg.DB_FILE}`;
     return `${cfg.DB_TYPE} @ ${cfg.DB_HOST}:${cfg.DB_PORT}/${cfg.DB_NAME}`;
 }
 
+/**
+ * Normalisasi input DB_FILE SQLite dari user menjadi path yang lengkap.
+ *
+ * Aturan:
+ *   - Tanpa komponen direktori (mis. "guestbook" atau "guestbook.db")
+ *     → dimasukkan ke ./data/ → "./data/guestbook.db"
+ *   - Dengan direktori custom (mis. "./dataku/guestbook")
+ *     → path dihormati, hanya ekstensi yang ditambahkan → "./dataku/guestbook.db"
+ *   - Ekstensi .db selalu ditambahkan jika belum ada.
+ */
+function normalizeDbFilePath(input) {
+    let result = input.trim();
+    if (!result.endsWith('.db')) result += '.db';
+    const hasDir = result.includes('/') || result.includes('\\');
+    if (!hasDir) result = './data/' + result;
+    return result;
+}
+
 /**
  * Fase input konfigurasi interaktif: LICENSE lalu tipe database beserta
  * atributnya. Mengembalikan objek cfg. `ask` di-inject agar dapat diuji.
@@ -139,7 +163,8 @@ async function collectConfig(ask) {
         console.log('  SQLite mode: DB_HOST, DB_PORT, DB_USER, DB_PASSWORD are ignored.');
         console.log('  The database file path is set in DB_NAME (via DB_FILE).');
         console.log('');
-        cfg.DB_FILE = await askField('DB_FILE (.db file path)', DB_DEFAULTS.DB_FILE);
+        const dbFileRaw = await askField('DB_FILE (.db file path)', DB_DEFAULTS.DB_FILE);
+        cfg.DB_FILE = normalizeDbFilePath(dbFileRaw);
     } else {
         const d = dbDefaultsFor(cfg.DB_TYPE);
         cfg.DB_HOST = await askField('DB_HOST', d.DB_HOST);
@@ -149,6 +174,13 @@ async function collectConfig(ask) {
         cfg.DB_NAME = await askField('DB_NAME', d.DB_NAME);
     }
 
+    // 3) CORS — origin frontend yang diizinkan mengakses API dari browser.
+    //    Default '*' (semua origin); isi daftar origin spesifik untuk production.
+    console.log('');
+    console.log('  CORS_ORIGINS: frontend origin(s) allowed to call the API');
+    console.log("  (comma-separated, or '*' for all origins).");
+    cfg.CORS_ORIGINS = await askField('CORS_ORIGINS', DEFAULT_CORS_ORIGINS);
+
     return cfg;
 }
 
@@ -158,6 +190,7 @@ function envValuesFromCfg(cfg) {
         LICENSE: cfg.LICENSE,
         DB_TYPE: cfg.DB_TYPE
     };
+    if (cfg.CORS_ORIGINS) v.CORS_ORIGINS = cfg.CORS_ORIGINS;
     if (cfg.DB_TYPE === 'sqlite') {
         // Untuk SQLite, path file disimpan pada DB_NAME (dikonsumsi runtime).
         v.DB_NAME = cfg.DB_FILE;
@@ -222,6 +255,7 @@ async function confirmWrite(ctx, ask) {
     console.log('====================================================');
     console.log(`  License   : ${maskLicense(ctx.cfg.LICENSE)}`);
     console.log(`  Database  : ${describeDatabase(ctx.cfg)}`);
+    console.log(`  CORS      : ${ctx.cfg.CORS_ORIGINS}`);
     const existsNote = ctx.exists ? '   (EXISTING — will be overwritten)' : '';
     console.log(`  Target    : config/${ctx.configFileName}${existsNote}`);
     console.log('');