@trops/dash-core 0.1.284 → 0.1.286

package/dist/electron/index.js

@@ -30,14 +30,15 @@ var require$$4$1 = require('url');
 var require$$2$3 = require('vm');
 var require$$1$5 = require('croner');
 var require$$1$6 = require('node-vibrant/node');
-var require$$0$a = require('http');
-var require$$0$d = require('events');
-var require$$3$6 = require('net');
+var require$$3$5 = require('http');
+var require$$0$c = require('events');
+var require$$3$7 = require('net');
 var require$$4$2 = require('tls');
-var require$$3$5 = require('crypto');
-var require$$0$b = require('zlib');
-var require$$0$c = require('buffer');
+var require$$3$6 = require('crypto');
+var require$$0$a = require('zlib');
+var require$$0$b = require('buffer');
 var require$$1$7 = require('http2');
+var require$$2$5 = require('node-forge');
 
 var commonjsGlobal = typeof globalThis !== 'undefined' ? globalThis : typeof window !== 'undefined' ? window : typeof global !== 'undefined' ? global : typeof self !== 'undefined' ? self : {};
 
@@ -1099,7 +1100,7 @@ var secureStoreController$1 = {
   getData: getData$1,
 };
 
-const path$h = require$$1$2;
+const path$i = require$$1$2;
 const {
   readFileSync,
   writeFileSync: writeFileSync$4,
@@ -1117,7 +1118,7 @@ const {
 function ensureDirectoryExistence$2(filePath) {
   try {
     // isDirectory
-    var dirname = path$h.dirname(filePath);
+    var dirname = path$i.dirname(filePath);
     // check if the directory exists...return true
     // if not, we can pass in the dirname as the filepath
     // and check each directory recursively.
@@ -1232,7 +1233,7 @@ function removeFilesFromDirectory(directory, excludeFiles = []) {
 
       for (const file of files) {
         if (!excludeFiles.includes(file)) {
-          unlinkSync(path$h.join(directory, file), (err) => {
+          unlinkSync(path$i.join(directory, file), (err) => {
             if (err) throw err;
           });
         }
@@ -1250,7 +1251,7 @@ var file = {
 };
 
 const { app: app$a } = require$$0$2;
-const path$g = require$$1$2;
+const path$h = require$$1$2;
 const { writeFileSync: writeFileSync$3 } = require$$0$3;
 const { getFileContents: getFileContents$7 } = file;
 
@@ -1297,7 +1298,7 @@ const workspaceController$3 = {
   saveWorkspaceForApplication: (win, appId, workspaceObject) => {
     try {
       // filename to the pages file (live pages)
-      const filename = path$g.join(
+      const filename = path$h.join(
         app$a.getPath("userData"),
         appName$7,
         appId,
@@ -1346,7 +1347,7 @@ const workspaceController$3 = {
   saveMenuItemsForApplication: (win, appId, menuItems) => {
     try {
       // filename to the workspaces file
-      const filename = path$g.join(
+      const filename = path$h.join(
         app$a.getPath("userData"),
         appName$7,
         appId,
@@ -1395,7 +1396,7 @@ const workspaceController$3 = {
    */
   deleteWorkspaceForApplication: (win, appId, workspaceId) => {
     try {
-      const filename = path$g.join(
+      const filename = path$h.join(
         app$a.getPath("userData"),
         appName$7,
         appId,
@@ -1429,7 +1430,7 @@ const workspaceController$3 = {
 
   listWorkspacesForApplication: (win, appId) => {
     try {
-      const filename = path$g.join(
+      const filename = path$h.join(
         app$a.getPath("userData"),
         appName$7,
         appId,
@@ -1457,7 +1458,7 @@ const workspaceController$3 = {
 
   listMenuItemsForApplication: (win, appId) => {
     try {
-      const filename = path$g.join(
+      const filename = path$h.join(
         app$a.getPath("userData"),
         appName$7,
         appId,
@@ -1502,7 +1503,7 @@ const workspaceController$3 = {
 var workspaceController_1 = workspaceController$3;
 
 const { app: app$9 } = require$$0$2;
-const path$f = require$$1$2;
+const path$g = require$$1$2;
 const { writeFileSync: writeFileSync$2 } = require$$0$3;
 const { getFileContents: getFileContents$6 } = file;
 
@@ -1522,7 +1523,7 @@ const themeController$5 = {
   saveThemeForApplication: (win, appId, name, obj) => {
     try {
       // filename to the pages file (live pages)
-      const filename = path$f.join(
+      const filename = path$g.join(
         app$9.getPath("userData"),
         appName$6,
         appId,
@@ -1568,7 +1569,7 @@ const themeController$5 = {
    */
   listThemesForApplication: (win, appId) => {
     try {
-      const filename = path$f.join(
+      const filename = path$g.join(
         app$9.getPath("userData"),
         appName$6,
         appId,
@@ -1610,7 +1611,7 @@ const themeController$5 = {
    */
   deleteThemeForApplication: (win, appId, themeKey) => {
     try {
-      const filename = path$f.join(
+      const filename = path$g.join(
         app$9.getPath("userData"),
         appName$6,
         appId,
@@ -1650,14 +1651,14 @@ var themeController_1 = themeController$5;
  * - CSV -> JSON
  */
 
-var fs$9 = require$$0$3;
+var fs$a = require$$0$3;
 var readline = require$$1$3;
 const xtreamer = require$$2;
 var xmlParser = require$$3$1;
 var JSONStream$1 = require$$4;
 const stream$2 = require$$0$4;
 var csv = require$$6;
-const path$e = require$$1$2;
+const path$f = require$$1$2;
 const { app: app$8 } = require$$0$2;
 const { ensureDirectoryExistence: ensureDirectoryExistence$1 } = file;
 
@@ -1706,7 +1707,7 @@ let Transform$1 = class Transform {
         let lineObject = [];
 
         const readInterface = readline.createInterface({
-          input: fs$9.createReadStream(filepath),
+          input: fs$a.createReadStream(filepath),
           output: process.stdout,
           console: false,
         });
@@ -1741,7 +1742,7 @@ let Transform$1 = class Transform {
     return new Promise((resolve, reject) => {
       try {
         const parser = JSONStream$1.parse("*");
-        const readStream = fs$9.createReadStream(file).pipe(parser);
+        const readStream = fs$a.createReadStream(file).pipe(parser);
 
         let count = 0;
 
@@ -1794,7 +1795,7 @@ let Transform$1 = class Transform {
   parseXMLStream = (filepath, outpath, start) => {
     return new Promise((resolve, reject) => {
       try {
-        const xmlFileReadStream = fs$9.createReadStream(filepath);
+        const xmlFileReadStream = fs$a.createReadStream(filepath);
 
         xmlFileReadStream.on("end", () => {
           writeStream.write("\n]");
@@ -1805,7 +1806,7 @@ let Transform$1 = class Transform {
           resolve("Read Finish");
         });
 
-        const writeStream = fs$9.createWriteStream(outpath);
+        const writeStream = fs$a.createWriteStream(outpath);
         writeStream.write("[\n");
 
         const options = {
@@ -1857,10 +1858,10 @@ let Transform$1 = class Transform {
   ) => {
     return new Promise((resolve, reject) => {
       try {
-        const readStream = fs$9
+        const readStream = fs$a
           .createReadStream(filepath)
           .pipe(csv({ separator: delimiter }));
-        const writeStream = fs$9.createWriteStream(outpath);
+        const writeStream = fs$a.createWriteStream(outpath);
 
         let canParse = true;
 
@@ -1946,18 +1947,18 @@ let Transform$1 = class Transform {
       }
 
       // Validate file paths are within app data directory
-      const appDataDir = path$e.join(app$8.getPath("userData"), TRANSFORM_APP_NAME);
-      const resolvedFilepath = path$e.resolve(filepath);
-      const resolvedOutFilepath = path$e.resolve(outFilepath);
+      const appDataDir = path$f.join(app$8.getPath("userData"), TRANSFORM_APP_NAME);
+      const resolvedFilepath = path$f.resolve(filepath);
+      const resolvedOutFilepath = path$f.resolve(outFilepath);
 
-      if (!resolvedFilepath.startsWith(appDataDir + path$e.sep)) {
+      if (!resolvedFilepath.startsWith(appDataDir + path$f.sep)) {
         return reject(
           new Error(
             "Input file path must be within the application data directory",
           ),
         );
       }
-      if (!resolvedOutFilepath.startsWith(appDataDir + path$e.sep)) {
+      if (!resolvedOutFilepath.startsWith(appDataDir + path$f.sep)) {
         return reject(
           new Error(
             "Output file path must be within the application data directory",
@@ -1968,14 +1969,14 @@ let Transform$1 = class Transform {
       // JSON parser
       var parser = JSONStream$1.parse("*");
 
-      if (fs$9.existsSync(resolvedFilepath)) {
+      if (fs$a.existsSync(resolvedFilepath)) {
         console.log("file exists ", resolvedFilepath);
         // create the readStream to parse the large file (json)
-        var readStream = fs$9.createReadStream(resolvedFilepath).pipe(parser);
+        var readStream = fs$a.createReadStream(resolvedFilepath).pipe(parser);
 
         ensureDirectoryExistence$1(resolvedOutFilepath);
 
-        var writeStream = fs$9.createWriteStream(resolvedOutFilepath);
+        var writeStream = fs$a.createWriteStream(resolvedOutFilepath);
 
         let sep = "";
         let count = 0;
@@ -3816,8 +3817,8 @@ async function extractColorsFromImageURL$2(url, toDirectory) {
 var color = { extractColorsFromImageURL: extractColorsFromImageURL$2 };
 
 const { app: app$7 } = require$$0$2;
-var fs$8 = require$$0$3;
-const path$d = require$$1$2;
+var fs$9 = require$$0$3;
+const path$e = require$$1$2;
 const events$5 = events$8;
 const { getFileContents: getFileContents$5, writeToFile: writeToFile$2 } = file;
 
@@ -3825,7 +3826,7 @@ const { getFileContents: getFileContents$5, writeToFile: writeToFile$2 } = file;
 const ObjectsToCsv = require$$5;
 const Transform = transform;
 const { extractColorsFromImageURL: extractColorsFromImageURL$1 } = color;
-const https$3 = require$$8;
+const https$4 = require$$8;
 const appName$5 = "Dashboard";
 
 const dataController$1 = {
@@ -3840,7 +3841,7 @@ const dataController$1 = {
   convertJsonToCsvFile: (win, appId, jsonObject, toFilename = "test.csv") => {
     try {
       // filename to the pages file (live pages)
-      const filename = path$d.join(
+      const filename = path$e.join(
         app$7.getPath("userData"),
         appName$5,
         appId,
@@ -3968,17 +3969,17 @@ const dataController$1 = {
       }
 
       // Validate toFilepath is within the app data directory
-      const appDataDir = path$d.join(app$7.getPath("userData"), appName$5);
-      const resolvedFilepath = path$d.resolve(toFilepath);
-      if (!resolvedFilepath.startsWith(appDataDir + path$d.sep)) {
+      const appDataDir = path$e.join(app$7.getPath("userData"), appName$5);
+      const resolvedFilepath = path$e.resolve(toFilepath);
+      if (!resolvedFilepath.startsWith(appDataDir + path$e.sep)) {
         throw new Error(
           "File path must be within the application data directory",
         );
       }
 
-      const writeStream = fs$8.createWriteStream(resolvedFilepath);
+      const writeStream = fs$9.createWriteStream(resolvedFilepath);
 
-      https$3
+      https$4
         .get(url, (resp) => {
           resp.on("data", (chunk) => {
             writeStream.write(chunk);
@@ -4117,7 +4118,7 @@ const dataController$1 = {
     try {
       if (data) {
         // filename to the pages file (live pages)
-        const toFilename = path$d.join(
+        const toFilename = path$e.join(
           app$7.getPath("userData"),
           appName$5,
           "data",
@@ -4199,7 +4200,7 @@ const dataController$1 = {
     try {
       if (filename) {
         // filename to the pages file (live pages)
-        const fromFilename = path$d.join(
+        const fromFilename = path$e.join(
           app$7.getPath("userData"),
           appName$5,
           "data",
@@ -4277,7 +4278,7 @@ const dataController$1 = {
     try {
       console.log(url);
       const fileExtension = ".jpg";
-      const filename = path$d.join(
+      const filename = path$e.join(
         app$7.getPath("userData"),
         appName$5,
         "@algolia/dash-electron",
@@ -4303,8 +4304,8 @@ var dataController_1 = dataController$1;
  */
 
 const { app: app$6 } = require$$0$2;
-const path$c = require$$1$2;
-const fs$7 = require$$0$3;
+const path$d = require$$1$2;
+const fs$8 = require$$0$3;
 const { getFileContents: getFileContents$4, writeToFile: writeToFile$1 } = file;
 
 const configFilename$3 = "settings.json";
@@ -4312,15 +4313,15 @@ const appName$4 = "Dashboard";
 
 // Helper function to recursively copy directory
 function copyDirectory(source, destination) {
-  if (!fs$7.existsSync(destination)) {
-    fs$7.mkdirSync(destination, { recursive: true });
+  if (!fs$8.existsSync(destination)) {
+    fs$8.mkdirSync(destination, { recursive: true });
   }
 
-  const files = fs$7.readdirSync(source);
+  const files = fs$8.readdirSync(source);
   for (const file of files) {
-    const srcPath = path$c.join(source, file);
-    const destPath = path$c.join(destination, file);
-    const stat = fs$7.lstatSync(srcPath);
+    const srcPath = path$d.join(source, file);
+    const destPath = path$d.join(destination, file);
+    const stat = fs$8.lstatSync(srcPath);
 
     // Skip symlinks to prevent following links to sensitive files
     if (stat.isSymbolicLink()) {
@@ -4331,7 +4332,7 @@ function copyDirectory(source, destination) {
     if (stat.isDirectory()) {
       copyDirectory(srcPath, destPath);
     } else {
-      fs$7.copyFileSync(srcPath, destPath);
+      fs$8.copyFileSync(srcPath, destPath);
     }
   }
 }
@@ -4347,7 +4348,7 @@ const settingsController$4 = {
     try {
       if (data) {
         // <appId>/settings.json
-        const filename = path$c.join(
+        const filename = path$d.join(
           app$6.getPath("userData"),
           appName$4,
           configFilename$3,
@@ -4383,7 +4384,7 @@ const settingsController$4 = {
   getSettingsForApplication: (win) => {
     try {
       // <appId>/settings.json
-      const filename = path$c.join(
+      const filename = path$d.join(
         app$6.getPath("userData"),
         appName$4,
         configFilename$3,
@@ -4414,7 +4415,7 @@ const settingsController$4 = {
    */
   getDataDirectory: (win) => {
     try {
-      const settingsPath = path$c.join(
+      const settingsPath = path$d.join(
         app$6.getPath("userData"),
         appName$4,
         configFilename$3,
@@ -4422,7 +4423,7 @@ const settingsController$4 = {
       const settings = getFileContents$4(settingsPath, {});
       const userDataDir =
         settings.userDataDirectory ||
-        path$c.join(app$6.getPath("userData"), appName$4);
+        path$d.join(app$6.getPath("userData"), appName$4);
 
       console.log("[settingsController] Data directory retrieved successfully");
       // Return the data for ipcMain.handle() - modern promise-based approach
@@ -4449,17 +4450,17 @@ const settingsController$4 = {
   setDataDirectory: (win, newPath) => {
     try {
       // Validate the path exists and is a directory
-      if (!fs$7.existsSync(newPath)) {
-        fs$7.mkdirSync(newPath, { recursive: true });
+      if (!fs$8.existsSync(newPath)) {
+        fs$8.mkdirSync(newPath, { recursive: true });
       }
 
-      const stats = fs$7.statSync(newPath);
+      const stats = fs$8.statSync(newPath);
       if (!stats.isDirectory()) {
         throw new Error("Path is not a directory");
       }
 
       // Update settings
-      const settingsPath = path$c.join(
+      const settingsPath = path$d.join(
         app$6.getPath("userData"),
         appName$4,
         configFilename$3,
@@ -4493,11 +4494,11 @@ const settingsController$4 = {
   migrateDataDirectory: (win, oldPath, newPath) => {
     try {
       // Resolve paths to prevent traversal
-      const resolvedOldPath = path$c.resolve(oldPath);
-      const resolvedNewPath = path$c.resolve(newPath);
+      const resolvedOldPath = path$d.resolve(oldPath);
+      const resolvedNewPath = path$d.resolve(newPath);
 
       // Validate oldPath is the current configured data directory
-      const settingsCheckPath = path$c.join(
+      const settingsCheckPath = path$d.join(
         app$6.getPath("userData"),
         appName$4,
         configFilename$3,
@@ -4505,8 +4506,8 @@ const settingsController$4 = {
       const currentSettings = getFileContents$4(settingsCheckPath, {});
       const currentDataDir =
         currentSettings.userDataDirectory ||
-        path$c.join(app$6.getPath("userData"), appName$4);
-      if (resolvedOldPath !== path$c.resolve(currentDataDir)) {
+        path$d.join(app$6.getPath("userData"), appName$4);
+      if (resolvedOldPath !== path$d.resolve(currentDataDir)) {
         throw new Error("Source path must be the current data directory");
       }
 
@@ -4530,19 +4531,19 @@ const settingsController$4 = {
       }
 
       // Validate paths
-      if (!fs$7.existsSync(resolvedOldPath)) {
+      if (!fs$8.existsSync(resolvedOldPath)) {
         throw new Error("Source directory does not exist");
       }
 
-      if (!fs$7.existsSync(resolvedNewPath)) {
-        fs$7.mkdirSync(resolvedNewPath, { recursive: true });
+      if (!fs$8.existsSync(resolvedNewPath)) {
+        fs$8.mkdirSync(resolvedNewPath, { recursive: true });
       }
 
       // Copy files
       copyDirectory(resolvedOldPath, resolvedNewPath);
 
       // Update settings to use new path
-      const settingsPath = path$c.join(
+      const settingsPath = path$d.join(
         app$6.getPath("userData"),
         appName$4,
         configFilename$3,
@@ -5174,7 +5175,7 @@ function requireProviderController () {
 }
 
 const { app: app$5 } = require$$0$2;
-const path$b = require$$1$2;
+const path$c = require$$1$2;
 const { writeFileSync: writeFileSync$1 } = require$$0$3;
 const events$4 = events$8;
 const { getFileContents: getFileContents$3 } = file;
@@ -5194,7 +5195,7 @@ const layoutController$1 = {
   saveLayoutForApplication: (win, appId, layoutObject) => {
     try {
       // filename to the pages file (live pages)
-      const filename = path$b.join(
+      const filename = path$c.join(
         app$5.getPath("userData"),
         appName$3,
         appId,
@@ -5227,7 +5228,7 @@ const layoutController$1 = {
    */
   listLayoutsForApplication: (win, appId) => {
     try {
-      const filename = path$b.join(
+      const filename = path$c.join(
         app$5.getPath("userData"),
         appName$3,
         appId,
@@ -26032,8 +26033,8 @@ const {
 const {
   StreamableHTTPClientTransport,
 } = streamableHttp$1;
-const path$a = require$$1$2;
-const fs$6 = require$$0$3;
+const path$b = require$$1$2;
+const fs$7 = require$$0$3;
 
 /**
  * Cached shell PATH result (resolved once, reused for all spawns).
@@ -26082,7 +26083,7 @@ function getShellPath$1() {
     fallbackDirs.push(`${home}/.nodenv/shims`);
     try {
       const nvmDir = `${home}/.nvm/versions/node`;
-      const versions = fs$6.readdirSync(nvmDir).sort();
+      const versions = fs$7.readdirSync(nvmDir).sort();
       if (versions.length > 0) {
         // Find the highest compatible version (v18/v20/v22)
         for (let i = versions.length - 1; i >= 0; i--) {
@@ -26218,15 +26219,15 @@ async function refreshGoogleOAuthToken(tokenRefresh) {
   const credPath = tokenRefresh.credentialsPath.replace(/^~/, home);
   const keysPath = tokenRefresh.oauthKeysPath.replace(/^~/, home);
 
-  if (!fs$6.existsSync(credPath) || !fs$6.existsSync(keysPath)) {
+  if (!fs$7.existsSync(credPath) || !fs$7.existsSync(keysPath)) {
     console.log(
       "[mcpController] Token refresh skipped: credential files not found",
     );
     return;
   }
 
-  const credentials = JSON.parse(fs$6.readFileSync(credPath, "utf8"));
-  const keysFile = JSON.parse(fs$6.readFileSync(keysPath, "utf8"));
+  const credentials = JSON.parse(fs$7.readFileSync(credPath, "utf8"));
+  const keysFile = JSON.parse(fs$7.readFileSync(keysPath, "utf8"));
   const keyData = keysFile.installed || keysFile.web;
 
   if (
@@ -26295,7 +26296,7 @@ async function refreshGoogleOAuthToken(tokenRefresh) {
     credentials.refresh_token = body.refresh_token;
   }
 
-  fs$6.writeFileSync(credPath, JSON.stringify(credentials, null, 2));
+  fs$7.writeFileSync(credPath, JSON.stringify(credentials, null, 2));
   console.log("[mcpController] Google OAuth token refreshed successfully");
 }
 
@@ -26449,7 +26450,7 @@ const mcpController$2 = {
           }
 
           // Interpolate {{MCP_DIR}} in args to resolve local MCP server scripts
-          const mcpDir = path$a.join(__dirname, "..", "mcp");
+          const mcpDir = path$b.join(__dirname, "..", "mcp");
           for (let i = 0; i < args.length; i++) {
             if (
               typeof args[i] === "string" &&
@@ -26824,20 +26825,20 @@ const mcpController$2 = {
    */
   getCatalog: (win) => {
     try {
-      const catalogPath = path$a.join(
+      const catalogPath = path$b.join(
         __dirname,
         "..",
         "mcp",
         "mcpServerCatalog.json",
       );
 
-      if (!fs$6.existsSync(catalogPath)) {
+      if (!fs$7.existsSync(catalogPath)) {
         return {
           catalog: [],
         };
       }
 
-      const catalogData = fs$6.readFileSync(catalogPath, "utf8");
+      const catalogData = fs$7.readFileSync(catalogPath, "utf8");
       const catalog = JSON.parse(catalogData);
 
       return {
@@ -26899,8 +26900,8 @@ const mcpController$2 = {
         const destPath = to.replace(/^~/, process.env.HOME || "");
         const destDir = require$$1$2.dirname(destPath);
         try {
-          fs$6.mkdirSync(destDir, { recursive: true });
-          fs$6.copyFileSync(sourcePath, destPath);
+          fs$7.mkdirSync(destDir, { recursive: true });
+          fs$7.copyFileSync(sourcePath, destPath);
         } catch (err) {
           return {
             error: true,
@@ -26936,7 +26937,7 @@ const mcpController$2 = {
     }
 
     // Interpolate {{MCP_DIR}} in authCommand args (same as startServer)
-    const mcpDir = path$a.join(__dirname, "..", "mcp");
+    const mcpDir = path$b.join(__dirname, "..", "mcp");
     const resolvedArgs = (authCommand.args || []).map((arg) =>
       typeof arg === "string" && arg.includes("{{MCP_DIR}}")
         ? arg.replace(/\{\{MCP_DIR\}\}/g, mcpDir)
@@ -27072,8 +27073,8 @@ var packageId = { toPackageId: toPackageId$1, parsePackageId };
  * - Support two-level browsing: packages (bundles) and widgets within packages
  */
 
-const path$9 = require$$1$2;
-const fs$5 = require$$0$3;
+const path$a = require$$1$2;
+const fs$6 = require$$0$3;
 const { toPackageId } = packageId;
 
 // Default registry API base URL
@@ -27089,7 +27090,7 @@ let cacheTimestamp = 0;
  * Get the local test registry path for dev mode
  */
 function getTestRegistryPath() {
-  return path$9.join(__dirname, "..", "registry", "test-registry-index.json");
+  return path$a.join(__dirname, "..", "registry", "test-registry-index.json");
 }
 
 /**
@@ -27125,12 +27126,12 @@ async function fetchRegistryIndex(forceRefresh = false) {
     if (isDev()) {
       // In dev mode, try local test file first
       const testPath = getTestRegistryPath();
-      if (fs$5.existsSync(testPath)) {
+      if (fs$6.existsSync(testPath)) {
         console.log(
           "[RegistryController] Loading test registry from:",
           testPath,
         );
-        const raw = fs$5.readFileSync(testPath, "utf8");
+        const raw = fs$6.readFileSync(testPath, "utf8");
         indexData = JSON.parse(raw);
       } else {
         // Fall back to API (supports DASH_REGISTRY_URL as full-URL override)
@@ -27448,10 +27449,10 @@ var registryController$3 = {
   checkUpdates,
 };
 
-var fs$4 = require$$0$3;
+var fs$5 = require$$0$3;
 var JSONStream = require$$4;
 const algoliasearch$1 = require$$2$2;
-const path$8 = require$$3$3;
+const path$9 = require$$3$3;
 const { ensureDirectoryExistence, checkDirectory } = file;
 
 let AlgoliaIndex$1 = class AlgoliaIndex {
@@ -27489,7 +27490,7 @@ let AlgoliaIndex$1 = class AlgoliaIndex {
       var batchNumber = 1;
 
       // create the readStream to parse the large file (json)
-      var readStream = fs$4.createReadStream(filepath).pipe(parser);
+      var readStream = fs$5.createReadStream(filepath).pipe(parser);
 
       var batch = [];
 
@@ -27503,7 +27504,7 @@ let AlgoliaIndex$1 = class AlgoliaIndex {
               // lets write to the batch file
               if (countForBatch === batchSize) {
                 // write to the batch file
-                var writeStream = fs$4.createWriteStream(
+                var writeStream = fs$5.createWriteStream(
                   batchFilepath + "/batch_" + batchNumber + ".json",
                 );
                 writeStream.write(JSON.stringify(batch));
@@ -27554,11 +27555,11 @@ let AlgoliaIndex$1 = class AlgoliaIndex {
     return new Promise((resolve, reject) => {
       try {
         checkDirectory(directoryPath);
-        fs$4.readdir(directoryPath, (err, files) => {
+        fs$5.readdir(directoryPath, (err, files) => {
           if (err) reject(err);
           if (files) {
             files.forEach((file) => {
-              fs$4.unlinkSync(path$8.join(directoryPath, file));
+              fs$5.unlinkSync(path$9.join(directoryPath, file));
             });
             resolve();
           }
@@ -27577,11 +27578,11 @@ let AlgoliaIndex$1 = class AlgoliaIndex {
   ) {
     try {
       // read the directory...
-      const files = await fs$4.readdirSync(batchFilepath);
+      const files = await fs$5.readdirSync(batchFilepath);
       let results = [];
       for (const fileIndex in files) {
         // for each file lets read the file and then push to algolia
-        const pathToBatch = path$8.join(batchFilepath, files[fileIndex]);
+        const pathToBatch = path$9.join(batchFilepath, files[fileIndex]);
         const fileContents = await this.readFile(pathToBatch);
         if (fileContents) {
           if ("data" in fileContents && "filepath" in fileContents) {
@@ -27606,7 +27607,7 @@ let AlgoliaIndex$1 = class AlgoliaIndex {
 
   async readFile(filepath) {
     return await new Promise((resolve, reject) => {
-      fs$4.readFile(filepath, "utf8", (err, data) => {
+      fs$5.readFile(filepath, "utf8", (err, data) => {
         if (err) {
           reject(err);
         }
@@ -27756,7 +27757,7 @@ var algolia = AlgoliaIndex$1;
 const algoliasearch = require$$2$2;
 const events$3 = events$8;
 const AlgoliaIndex = algolia;
-var fs$3 = require$$0$3;
+var fs$4 = require$$0$3;
 
 const algoliaController$1 = {
   /**
@@ -27864,7 +27865,7 @@ const algoliaController$1 = {
         // init the Algolia Index helper
         const a = new AlgoliaIndex(appId, apiKey, indexName);
         // create the write stream to store the hits
-        const writeStream = fs$3.createWriteStream(toFilename);
+        const writeStream = fs$4.createWriteStream(toFilename);
         writeStream.write("[");
 
         let sep = "";
@@ -28036,7 +28037,7 @@ const openaiController$1 = {
 var openaiController_1 = openaiController$1;
 
 const { app: app$4 } = require$$0$2;
-const path$7 = require$$1$2;
+const path$8 = require$$1$2;
 const { writeFileSync } = require$$0$3;
 const { getFileContents: getFileContents$2 } = file;
 
@@ -28047,7 +28048,7 @@ const menuItemsController$1 = {
   saveMenuItemForApplication: (win, appId, menuItem) => {
     try {
       // filename to the pages file (live pages)
-      const filename = path$7.join(
+      const filename = path$8.join(
         app$4.getPath("userData"),
         appName$2,
         appId,
@@ -28083,7 +28084,7 @@ const menuItemsController$1 = {
 
   listMenuItemsForApplication: (win, appId) => {
     try {
-      const filename = path$7.join(
+      const filename = path$8.join(
         app$4.getPath("userData"),
         appName$2,
         appId,
@@ -28109,13 +28110,13 @@ const menuItemsController$1 = {
 
 var menuItemsController_1 = menuItemsController$1;
 
-const path$6 = require$$1$2;
+const path$7 = require$$1$2;
 const { app: app$3 } = require$$0$2;
 
 const pluginController$1 = {
   install: (win, packageName, filepath) => {
     try {
-      const rootPath = path$6.join(
+      const rootPath = path$7.join(
         app$3.getPath("userData"),
         "plugins",
         packageName,
@@ -30491,8 +30492,8 @@ var dynamicWidgetLoader$2 = {exports: {}};
  * Runs in the Electron main process at widget install time.
  */
 
-const fs$2 = require$$0$3;
-const path$5 = require$$1$2;
+const fs$3 = require$$0$3;
+const path$6 = require$$1$2;
 
 /**
  * Find the widgets/ directory, handling nested ZIP extraction.
@@ -30507,26 +30508,26 @@ const path$5 = require$$1$2;
  * @returns {string|null} Path to the widgets/ directory, or null
  */
 function findWidgetsDir$1(widgetPath) {
-  const direct = path$5.join(widgetPath, "widgets");
-  if (fs$2.existsSync(direct)) {
+  const direct = path$6.join(widgetPath, "widgets");
+  if (fs$3.existsSync(direct)) {
     return direct;
   }
 
   // Check configs/widgets/ (packageZip.js nests .dash.js files here)
-  const configsWidgets = path$5.join(widgetPath, "configs", "widgets");
-  if (fs$2.existsSync(configsWidgets)) {
+  const configsWidgets = path$6.join(widgetPath, "configs", "widgets");
+  if (fs$3.existsSync(configsWidgets)) {
     return configsWidgets;
   }
 
   // Check configs/ directory (used by packageZip.js for distributed widgets)
-  const configs = path$5.join(widgetPath, "configs");
-  if (fs$2.existsSync(configs)) {
+  const configs = path$6.join(widgetPath, "configs");
+  if (fs$3.existsSync(configs)) {
     return configs;
   }
 
   // Check one level deeper for nested ZIP extraction
   try {
-    const entries = fs$2.readdirSync(widgetPath, { withFileTypes: true });
+    const entries = fs$3.readdirSync(widgetPath, { withFileTypes: true });
     const subdirs = entries.filter(
       (e) =>
         e.isDirectory() &&
@@ -30536,8 +30537,8 @@ function findWidgetsDir$1(widgetPath) {
     );
 
     for (const subdir of subdirs) {
-      const nested = path$5.join(widgetPath, subdir.name, "widgets");
-      if (fs$2.existsSync(nested)) {
+      const nested = path$6.join(widgetPath, subdir.name, "widgets");
+      if (fs$3.existsSync(nested)) {
         console.log(`[WidgetCompiler] Found nested widgets/ at ${nested}`);
         return nested;
       }
@@ -30571,7 +30572,7 @@ async function compileWidget(widgetPath) {
   }
 
   // Discover .dash.js config files
-  const files = fs$2.readdirSync(widgetsDir);
+  const files = fs$3.readdirSync(widgetsDir);
   const dashFiles = files.filter((f) => f.endsWith(".dash.js"));
 
   if (dashFiles.length === 0) {
@@ -30585,15 +30586,15 @@ async function compileWidget(widgetPath) {
   // Compute relative path from the entry file (in widgetPath) to widgetsDir,
   // since widgetsDir may be nested (e.g., ./weather-widget/widgets/).
   const relWidgetsDir =
-    "./" + path$5.relative(widgetPath, widgetsDir).split(path$5.sep).join("/");
+    "./" + path$6.relative(widgetPath, widgetsDir).split(path$6.sep).join("/");
   const imports = [];
   const exportParts = [];
 
   for (const dashFile of dashFiles) {
     const componentName = dashFile.replace(".dash.js", "");
     const componentFile = `${componentName}.js`;
-    const componentFilePath = path$5.join(widgetsDir, componentFile);
-    const hasComponent = fs$2.existsSync(componentFilePath);
+    const componentFilePath = path$6.join(widgetsDir, componentFile);
+    const hasComponent = fs$3.existsSync(componentFilePath);
 
     // Import the config (always)
     imports.push(
@@ -30619,17 +30620,17 @@ async function compileWidget(widgetPath) {
   const entryContent = [...imports, "", ...exportParts, ""].join("\n");
 
   // Write temporary entry file in the widget root
-  const entryPath = path$5.join(widgetPath, "__compile_entry.js");
-  const distDir = path$5.join(widgetPath, "dist");
-  const outPath = path$5.join(distDir, "index.cjs.js");
+  const entryPath = path$6.join(widgetPath, "__compile_entry.js");
+  const distDir = path$6.join(widgetPath, "dist");
+  const outPath = path$6.join(distDir, "index.cjs.js");
 
   try {
     // Ensure dist/ directory exists
-    if (!fs$2.existsSync(distDir)) {
-      fs$2.mkdirSync(distDir, { recursive: true });
+    if (!fs$3.existsSync(distDir)) {
+      fs$3.mkdirSync(distDir, { recursive: true });
     }
 
-    fs$2.writeFileSync(entryPath, entryContent, "utf8");
+    fs$3.writeFileSync(entryPath, entryContent, "utf8");
 
     console.log(
       `[WidgetCompiler] Compiling ${dashFiles.length} component(s) from ${widgetPath}`,
@@ -30670,8 +30671,8 @@ async function compileWidget(widgetPath) {
   } finally {
     // Clean up temporary entry file
     try {
-      if (fs$2.existsSync(entryPath)) {
-        fs$2.unlinkSync(entryPath);
+      if (fs$3.existsSync(entryPath)) {
+        fs$3.unlinkSync(entryPath);
       }
     } catch (cleanupError) {
       // Non-fatal
@@ -30697,8 +30698,8 @@ var widgetCompiler$1 = { compileWidget, findWidgetsDir: findWidgetsDir$1 };
  * Integrates with ComponentManager for automatic registration
  */
 
-const fs$1 = require$$0$3;
-const path$4 = require$$1$2;
+const fs$2 = require$$0$3;
+const path$5 = require$$1$2;
 const vm = require$$2$3;
 const { findWidgetsDir } = widgetCompiler$1;
 
@@ -30739,14 +30740,14 @@ class DynamicWidgetLoader {
       );
 
       const widgetsDir =
-        findWidgetsDir(widgetPath) || path$4.join(widgetPath, "widgets");
-      const componentPath = path$4.join(widgetsDir, `${componentName}.js`);
-      const configPath = path$4.join(widgetsDir, `${componentName}.dash.js`);
+        findWidgetsDir(widgetPath) || path$5.join(widgetPath, "widgets");
+      const componentPath = path$5.join(widgetsDir, `${componentName}.js`);
+      const configPath = path$5.join(widgetsDir, `${componentName}.dash.js`);
 
-      if (!fs$1.existsSync(componentPath)) {
+      if (!fs$2.existsSync(componentPath)) {
         throw new Error(`Component file not found: ${componentPath}`);
       }
-      if (!fs$1.existsSync(configPath)) {
+      if (!fs$2.existsSync(configPath)) {
         throw new Error(`Config file not found: ${configPath}`);
       }
 
@@ -30797,7 +30798,7 @@ class DynamicWidgetLoader {
    */
   async loadConfigFile(configPath) {
     try {
-      const source = fs$1.readFileSync(configPath, "utf8");
+      const source = fs$2.readFileSync(configPath, "utf8");
 
       let exportMatch = source.match(/export\s+default\s+({[\s\S]*});?\s*$/);
 
@@ -30852,7 +30853,7 @@ class DynamicWidgetLoader {
         return [];
       }
 
-      const files = fs$1.readdirSync(widgetsDir);
+      const files = fs$2.readdirSync(widgetsDir);
       const widgets = new Set();
 
       files.forEach((file) => {
@@ -32529,8 +32530,8 @@ var widgetRegistryExports = widgetRegistry$1.exports;
  * Handles publishing packages and generating registry URLs.
  */
 
-const fs = require$$0$3;
-const path$3 = require$$1$2;
+const fs$1 = require$$0$3;
+const path$4 = require$$1$2;
 const { getStoredToken: getStoredToken$2 } = registryAuthController$1;
 
 const REGISTRY_BASE_URL =
@@ -32556,14 +32557,14 @@ async function publishToRegistry$1(zipPath, manifest) {
 
   try {
     // Read the ZIP file
-    const zipBuffer = fs.readFileSync(zipPath);
+    const zipBuffer = fs$1.readFileSync(zipPath);
 
     // Create FormData with the ZIP and manifest
     const formData = new FormData();
     formData.append(
       "file",
       new Blob([zipBuffer], { type: "application/zip" }),
-      path$3.basename(zipPath),
+      path$4.basename(zipPath),
     );
     formData.append("manifest", JSON.stringify(manifest));
 
@@ -32627,7 +32628,7 @@ var registryApiController$2 = {
  * Mirrors dashboardConfigController patterns for ZIP creation, manifest generation,
  * and registry interaction.
  */
-const path$2 = require$$1$2;
+const path$3 = require$$1$2;
 const { app: app$2, dialog: dialog$1 } = require$$0$2;
 const AdmZip$1 = require$$3$4;
 
@@ -33071,7 +33072,7 @@ async function installThemeFromRegistry$1(win, appId, packageName) {
       // Validate entry path (security: prevent path traversal)
       if (
         themeEntry.entryName.includes("..") ||
-        path$2.isAbsolute(themeEntry.entryName)
+        path$3.isAbsolute(themeEntry.entryName)
       ) {
         return {
           success: false,
@@ -33197,7 +33198,7 @@ var themeRegistryController$1 = {
  */
 
 const { app: app$1, dialog } = require$$0$2;
-const path$1 = require$$1$2;
+const path$2 = require$$1$2;
 const AdmZip = require$$3$4;
 const { getFileContents: getFileContents$1 } = file;
 const {
@@ -33240,7 +33241,7 @@ async function exportDashboardConfig$1(
 ) {
   try {
     // 1. Read workspace from workspaces.json
-    const filename = path$1.join(
+    const filename = path$2.join(
       app$1.getPath("userData"),
       appName$1,
       appId,
@@ -33334,7 +33335,7 @@ async function exportDashboardConfig$1(
 
     const { canceled, filePath } = await dialog.showSaveDialog(win, {
       title: "Export Dashboard as ZIP",
-      defaultPath: path$1.join(
+      defaultPath: path$2.join(
         app$1.getPath("desktop"),
         `dashboard-${sanitizedName}.zip`,
       ),
@@ -33400,7 +33401,7 @@ async function selectDashboardFile$1(win) {
 
     // Extract and validate
     const zip = new AdmZip(zipPath);
-    const tempDir = path$1.join(app$1.getPath("temp"), "dash-import");
+    const tempDir = path$2.join(app$1.getPath("temp"), "dash-import");
     const { validateZipEntries } = widgetRegistryExports;
     validateZipEntries(zip, tempDir);
 
@@ -33510,7 +33511,7 @@ async function importDashboardConfig$1(
     const zip = new AdmZip(zipPath);
 
     // Validate ZIP entries for path traversal
-    const tempDir = path$1.join(app$1.getPath("temp"), "dash-import");
+    const tempDir = path$2.join(app$1.getPath("temp"), "dash-import");
     const { validateZipEntries } = widgetRegistryExports;
     validateZipEntries(zip, tempDir);
 
@@ -34109,7 +34110,7 @@ async function installDashboardFromRegistry$1(
     const zip = new AdmZip(zipBuffer);
 
     // 3. Validate ZIP entries
-    const tempDir = path$1.join(app$1.getPath("temp"), "dash-registry-import");
+    const tempDir = path$2.join(app$1.getPath("temp"), "dash-registry-import");
     const { validateZipEntries } = widgetRegistryExports;
     validateZipEntries(zip, tempDir);
 
@@ -34253,7 +34254,7 @@ async function prepareDashboardForPublish$1(
     } = dashboardConfigUtils$1;
 
     // 1. Read workspace
-    const filename = path$1.join(
+    const filename = path$2.join(
       app$1.getPath("userData"),
       appName$1,
       appId,
@@ -34433,7 +34434,7 @@ async function prepareDashboardForPublish$1(
     const sanitizedName = manifest.name;
     const { canceled, filePath } = await dialog.showSaveDialog(win, {
       title: "Save Dashboard Package for Registry",
-      defaultPath: path$1.join(
+      defaultPath: path$2.join(
         app$1.getPath("desktop"),
         `dashboard-${sanitizedName}-v${manifest.version}.zip`,
       ),
@@ -34572,7 +34573,7 @@ async function checkDashboardUpdatesForApp$1(appId) {
   const { fetchRegistryIndex } = registryController$3;
 
   try {
-    const filename = path$1.join(
+    const filename = path$2.join(
       app$1.getPath("userData"),
       appName$1,
       appId,
@@ -34643,7 +34644,7 @@ function getProviderSetupManifest$1(appId, requiredProviders = []) {
  */
 function getDashboardPublishPreview$1(appId, workspaceId, widgetRegistry = null) {
   try {
-    const filename = path$1.join(
+    const filename = path$2.join(
       app$1.getPath("userData"),
       appName$1,
       appId,
@@ -40136,8 +40137,8 @@ var themeFromUrlErrors$1 = {
 
 const css = css$1;
 const { Vibrant } = require$$1$6;
-const https$2 = require$$8;
-const http$4 = require$$0$a;
+const https$3 = require$$8;
+const http$3 = require$$3$5;
 const { URL: URL$2 } = require$$4$1;
 const {
   UrlUnreachableError,
@@ -40538,7 +40539,7 @@ function fetchBuffer(url, maxRedirects = 5, _redirectCount = 0) {
       return;
     }
     const parsedUrl = new URL$2(url);
-    const client = parsedUrl.protocol === "https:" ? https$2 : http$4;
+    const client = parsedUrl.protocol === "https:" ? https$3 : http$3;
     const request = client.get(
       url,
       { timeout: 10000, headers: { "User-Agent": "Dash/1.0" } },
@@ -41760,7 +41761,7 @@ let Limiter$1 = class Limiter {
 
 var limiter = Limiter$1;
 
-const zlib = require$$0$b;
+const zlib = require$$0$a;
 
 const bufferUtil = bufferUtilExports;
 const Limiter = limiter;
@@ -42291,7 +42292,7 @@ var validation$2 = {exports: {}};
 
 var isValidUTF8_1;
 
-const { isUtf8 } = require$$0$c;
+const { isUtf8 } = require$$0$b;
 
 const { hasBlob } = constants;
 
@@ -43150,7 +43151,7 @@ let Receiver$1 = class Receiver extends Writable {
 var receiver = Receiver$1;
 
 /* eslint no-unused-vars: ["error", { "varsIgnorePattern": "^Duplex" }] */
-const { randomFillSync } = require$$3$5;
+const { randomFillSync } = require$$3$6;
 
 const PerMessageDeflate$2 = permessageDeflate;
 const { EMPTY_BUFFER: EMPTY_BUFFER$1, kWebSocket: kWebSocket$2, NOOP: NOOP$1 } = constants;
@@ -44243,12 +44244,12 @@ var extension$1 = { format: format$4, parse: parse$4 };
 
 /* eslint no-unused-vars: ["error", { "varsIgnorePattern": "^Duplex|Readable$", "caughtErrors": "none" }] */
 
-const EventEmitter$1 = require$$0$d;
-const https$1 = require$$8;
-const http$3 = require$$0$a;
-const net = require$$3$6;
+const EventEmitter$1 = require$$0$c;
+const https$2 = require$$8;
+const http$2 = require$$3$5;
+const net = require$$3$7;
 const tls = require$$4$2;
-const { randomBytes, createHash: createHash$1 } = require$$3$5;
+const { randomBytes, createHash: createHash$1 } = require$$3$6;
 const { URL: URL$1 } = require$$4$1;
 
 const PerMessageDeflate$1 = permessageDeflate;
@@ -44973,7 +44974,7 @@ function initAsClient(websocket, address, protocols, options) {
 
   const defaultPort = isSecure ? 443 : 80;
   const key = randomBytes(16).toString('base64');
-  const request = isSecure ? https$1.request : http$3.request;
+  const request = isSecure ? https$2.request : http$2.request;
   const protocolSet = new Set();
   let perMessageDeflate;
 
@@ -45854,9 +45855,9 @@ var subprotocol$1 = { parse: parse$2 };
 
 /* eslint no-unused-vars: ["error", { "varsIgnorePattern": "^Duplex$", "caughtErrors": "none" }] */
 
-const EventEmitter = require$$0$d;
-const http$2 = require$$0$a;
-const { createHash } = require$$3$5;
+const EventEmitter = require$$0$c;
+const http$1 = require$$3$5;
+const { createHash } = require$$3$6;
 
 const extension = extension$1;
 const PerMessageDeflate = permessageDeflate;
@@ -45945,8 +45946,8 @@ class WebSocketServer extends EventEmitter {
     }
 
     if (options.port != null) {
-      this._server = http$2.createServer((req, res) => {
-        const body = http$2.STATUS_CODES[426];
+      this._server = http$1.createServer((req, res) => {
+        const body = http$1.STATUS_CODES[426];
 
         res.writeHead(426, {
           'Content-Length': body.length,
@@ -46354,7 +46355,7 @@ function abortHandshake(socket, code, message, headers) {
   // call to `socket.end()` below, which triggers an `'error'` event that in
   // turn causes the socket to be destroyed.
   //
-  message = message || http$2.STATUS_CODES[code];
+  message = message || http$1.STATUS_CODES[code];
   headers = {
     Connection: 'close',
     'Content-Type': 'text/html',
@@ -46365,7 +46366,7 @@ function abortHandshake(socket, code, message, headers) {
   socket.once('finish', socket.destroy);
 
   socket.end(
-    `HTTP/1.1 ${code} ${http$2.STATUS_CODES[code]}\r\n` +
+    `HTTP/1.1 ${code} ${http$1.STATUS_CODES[code]}\r\n` +
       Object.keys(headers)
         .map((h) => `${h}: ${headers[h]}`)
         .join('\r\n') +
@@ -60133,16 +60134,16 @@ function urnuuidSerialize (uuidComponent) {
   return urnComponent
 }
 
-const http$1 = /** @type {SchemeHandler} */ ({
+const http = /** @type {SchemeHandler} */ ({
   scheme: 'http',
   domainHost: true,
   parse: httpParse,
   serialize: httpSerialize
 });
 
-const https = /** @type {SchemeHandler} */ ({
+const https$1 = /** @type {SchemeHandler} */ ({
   scheme: 'https',
-  domainHost: http$1.domainHost,
+  domainHost: http.domainHost,
   parse: httpParse,
   serialize: httpSerialize
 });
@@ -60176,8 +60177,8 @@ const urnuuid = /** @type {SchemeHandler} */ ({
 });
 
 const SCHEMES$1 = /** @type {Record<SchemeName, SchemeHandler>} */ ({
-  http: http$1,
-  https,
+  http,
+  https: https$1,
   ws,
   wss,
   urn,
@@ -65793,7 +65794,7 @@ __export(src_exports, {
 var dist = __toCommonJS(src_exports);
 
 // src/server.ts
-var import_node_http = require$$0$a;
+var import_node_http = require$$3$5;
 
 // src/listener.ts
 var import_node_http22 = require$$1$7;
@@ -66122,7 +66123,7 @@ var buildOutgoingHttpHeaders = (headers) => {
 var X_ALREADY_SENT = "x-hono-already-sent";
 
 // src/globals.ts
-var import_node_crypto = __toESM(require$$3$5);
+var import_node_crypto = __toESM(require$$3$6);
 if (typeof commonjsGlobal.crypto === "undefined") {
   commonjsGlobal.crypto = import_node_crypto.default;
 }
@@ -67293,6 +67294,113 @@ let StreamableHTTPServerTransport$1 = class StreamableHTTPServerTransport {
 };
 streamableHttp.StreamableHTTPServerTransport = StreamableHTTPServerTransport$1;
 
+/**
+ * tlsCert.js
+ *
+ * Generates and caches a self-signed TLS certificate for the MCP Dash Server.
+ * Uses node-forge (already in the dependency tree) to create a cert valid for
+ * 127.0.0.1 and localhost, stored in the app's userData directory.
+ *
+ * Usage:
+ *   const { getOrCreateCert } = require('./tlsCert');
+ *   const { cert, key } = getOrCreateCert(certsDir);
+ *   https.createServer({ key, cert }, handler);
+ */
+
+const fs = require$$0$3;
+const path$1 = require$$1$2;
+const forge = require$$2$5;
+
+/**
+ * Get or create a self-signed TLS certificate for localhost.
+ * @param {string} certsDir - Directory to store cert.pem and key.pem
+ * @returns {{ cert: string, key: string }} PEM-encoded certificate and private key
+ */
+function getOrCreateCert$1(certsDir) {
+  const certPath = path$1.join(certsDir, "cert.pem");
+  const keyPath = path$1.join(certsDir, "key.pem");
+
+  // Return existing cert if valid
+  if (fs.existsSync(certPath) && fs.existsSync(keyPath)) {
+    try {
+      const cert = fs.readFileSync(certPath, "utf8");
+      const key = fs.readFileSync(keyPath, "utf8");
+      // Verify cert is not expired
+      const parsed = forge.pki.certificateFromPem(cert);
+      if (parsed.validity.notAfter > new Date()) {
+        return { cert, key };
+      }
+      console.log("[tlsCert] Existing certificate expired, regenerating...");
+    } catch (e) {
+      console.log("[tlsCert] Existing certificate invalid, regenerating...");
+    }
+  }
+
+  console.log("[tlsCert] Generating self-signed certificate for localhost...");
+
+  // Generate 2048-bit RSA key pair
+  const keys = forge.pki.rsa.generateKeyPair(2048);
+
+  // Create certificate
+  const cert = forge.pki.createCertificate();
+  cert.publicKey = keys.publicKey;
+  cert.serialNumber = "01";
+
+  // Valid for 10 years
+  cert.validity.notBefore = new Date();
+  cert.validity.notAfter = new Date();
+  cert.validity.notAfter.setFullYear(
+    cert.validity.notBefore.getFullYear() + 10,
+  );
+
+  // Subject and issuer (self-signed)
+  const attrs = [
+    { name: "commonName", value: "Dash MCP Server" },
+    { name: "organizationName", value: "Dash" },
+  ];
+  cert.setSubject(attrs);
+  cert.setIssuer(attrs);
+
+  // Subject Alternative Names (SAN) — required for modern TLS clients
+  cert.setExtensions([
+    { name: "basicConstraints", cA: false },
+    {
+      name: "keyUsage",
+      digitalSignature: true,
+      keyEncipherment: true,
+    },
+    {
+      name: "extKeyUsage",
+      serverAuth: true,
+    },
+    {
+      name: "subjectAltName",
+      altNames: [
+        { type: 7, ip: "127.0.0.1" }, // IP SAN
+        { type: 2, value: "localhost" }, // DNS SAN
+      ],
+    },
+  ]);
+
+  // Self-sign with SHA-256
+  cert.sign(keys.privateKey, forge.md.sha256.create());
+
+  // Convert to PEM
+  const certPem = forge.pki.certificateToPem(cert);
+  const keyPem = forge.pki.privateKeyToPem(keys.privateKey);
+
+  // Write to disk
+  fs.mkdirSync(certsDir, { recursive: true });
+  fs.writeFileSync(certPath, certPem, { mode: 0o644 });
+  fs.writeFileSync(keyPath, keyPem, { mode: 0o600 });
+
+  console.log(`[tlsCert] Certificate saved to ${certsDir}`);
+
+  return { cert: certPem, key: keyPem };
+}
+
+var tlsCert = { getOrCreateCert: getOrCreateCert$1 };
+
 /**
  * mcpDashServerController.js
  *
@@ -67303,25 +67411,27 @@ streamableHttp.StreamableHTTPServerTransport = StreamableHTTPServerTransport$1;
  * MCP *client* that connects to external tool servers for widgets.
  *
  * Architecture:
- *   - Node http server bound to 127.0.0.1 (localhost only)
+ *   - Node https server bound to 127.0.0.1 (localhost only)
+ *   - Auto-generated self-signed TLS certificate for localhost
  *   - StreamableHTTPServerTransport from @modelcontextprotocol/sdk
  *   - McpServer registers tools and resources
  *   - Bearer token authentication on all requests
  *   - Rate limiting via token bucket (60 req/min)
  */
 
-const http = require$$0$a;
-const { randomUUID } = require$$3$5;
+const https = require$$8;
+const { randomUUID } = require$$3$6;
 const { McpServer } = mcp;
 const {
   StreamableHTTPServerTransport,
 } = streamableHttp;
 
 const settingsController$3 = settingsController_1;
+const { getOrCreateCert } = tlsCert;
 
 // --- State ---
 let mcpServer = null;
-let httpServer = null;
+let httpsServer = null;
 let transport = null;
 let startTime = null;
 let connectionCount = 0;
@@ -67484,7 +67594,7 @@ const mcpDashServerController$4 = {
    * @param {Object} options - { port?: number }
    */
   startServer: async (win, options = {}) => {
-    if (httpServer) {
+    if (httpsServer) {
       return {
         success: false,
         error: "Server is already running",
@@ -67503,74 +67613,89 @@ const mcpDashServerController$4 = {
         version: "1.0.0",
       });
 
+      // Generate or load TLS certificate
+      const { app } = require("electron");
+      const path = require("path");
+      const certsDir = path.join(app.getPath("userData"), "certs");
+      const tlsCert = getOrCreateCert(certsDir);
+
       // Apply registered tools and resources
       applyRegistrations(mcpServer);
 
-      // Create HTTP server with auth and rate limiting
-      httpServer = http.createServer(async (req, res) => {
-        const ip = req.socket.remoteAddress || req.connection.remoteAddress;
+      // Create HTTPS server with auth and rate limiting
+      httpsServer = https.createServer(
+        { key: tlsCert.key, cert: tlsCert.cert },
+        async (req, res) => {
+          const ip = req.socket.remoteAddress || req.connection.remoteAddress;
 
-        // Rate limiting
-        if (isRateLimited(ip)) {
-          res.writeHead(429, { "Content-Type": "application/json" });
-          res.end(JSON.stringify({ error: "Rate limit exceeded" }));
-          return;
-        }
+          // Rate limiting
+          if (isRateLimited(ip)) {
+            res.writeHead(429, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({ error: "Rate limit exceeded" }));
+            return;
+          }
 
-        // Bearer token auth
-        const authHeader = req.headers.authorization;
-        if (!authHeader || authHeader !== `Bearer ${token}`) {
-          res.writeHead(401, { "Content-Type": "application/json" });
-          res.end(JSON.stringify({ error: "Unauthorized" }));
-          return;
-        }
+          // Bearer token auth
+          const authHeader = req.headers.authorization;
+          if (!authHeader || authHeader !== `Bearer ${token}`) {
+            res.writeHead(401, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({ error: "Unauthorized" }));
+            return;
+          }
 
-        // Handle MCP requests on /mcp path
-        if (req.url === "/mcp" || req.url?.startsWith("/mcp")) {
-          try {
-            transport = new StreamableHTTPServerTransport({
-              sessionIdGenerator: undefined,
-            });
-            await mcpServer.connect(transport);
-            connectionCount++;
-            await transport.handleRequest(req, res);
-          } catch (err) {
-            console.error("[mcpDashServer] Error handling MCP request:", err);
-            if (!res.headersSent) {
-              res.writeHead(500, {
+          // Handle MCP requests on /mcp path
+          if (req.url === "/mcp" || req.url?.startsWith("/mcp")) {
+            try {
+              // Stateless mode: create a fresh server + transport per request
+              const reqServer = new McpServer({
+                name: "dash-electron",
+                version: "1.0.0",
+              });
+              applyRegistrations(reqServer);
+              const reqTransport = new StreamableHTTPServerTransport({
+                sessionIdGenerator: undefined,
+              });
+              await reqServer.connect(reqTransport);
+              connectionCount++;
+              await reqTransport.handleRequest(req, res);
+            } catch (err) {
+              console.error("[mcpDashServer] Error handling MCP request:", err);
+              if (!res.headersSent) {
+                res.writeHead(500, {
+                  "Content-Type": "application/json",
+                });
+                res.end(
+                  JSON.stringify({
+                    error: "Internal server error",
+                  }),
+                );
+              }
+            }
+          } else {
+            // Health check endpoint
+            if (req.url === "/health" && req.method === "GET") {
+              res.writeHead(200, {
                 "Content-Type": "application/json",
               });
               res.end(
                 JSON.stringify({
-                  error: "Internal server error",
+                  status: "ok",
+                  server: "dash-electron-mcp",
+                  version: "1.0.0",
                 }),
               );
+              return;
             }
+            res.writeHead(404, { "Content-Type": "application/json" });
+            res.end(JSON.stringify({ error: "Not found" }));
           }
-        } else {
-          // Health check endpoint
-          if (req.url === "/health" && req.method === "GET") {
-            res.writeHead(200, {
-              "Content-Type": "application/json",
-            });
-            res.end(
-              JSON.stringify({
-                status: "ok",
-                server: "dash-electron-mcp",
-                version: "1.0.0",
-              }),
-            );
-            return;
-          }
-          res.writeHead(404, { "Content-Type": "application/json" });
-          res.end(JSON.stringify({ error: "Not found" }));
-        }
-      });
+        },
+      );
 
       // Bind to localhost only
       await new Promise((resolve, reject) => {
-        httpServer.on("error", (err) => {
-          httpServer = null;
+        httpsServer.on("error", (err) => {
+          httpsServer = null;
           mcpServer = null;
           if (err.code === "EADDRINUSE") {
             reject(
@@ -67582,7 +67707,7 @@ const mcpDashServerController$4 = {
             reject(err);
           }
         });
-        httpServer.listen(port, "127.0.0.1", () => {
+        httpsServer.listen(port, "127.0.0.1", () => {
           resolve();
         });
       });
@@ -67601,17 +67726,17 @@ const mcpDashServerController$4 = {
       });
 
       console.log(
-        `[mcpDashServer] Server started on http://127.0.0.1:${port}/mcp`,
+        `[mcpDashServer] Server started on https://127.0.0.1:${port}/mcp`,
       );
 
       return {
         success: true,
         port,
-        url: `http://127.0.0.1:${port}/mcp`,
+        url: `https://127.0.0.1:${port}/mcp`,
       };
     } catch (err) {
       console.error("[mcpDashServer] Failed to start server:", err);
-      httpServer = null;
+      httpsServer = null;
       mcpServer = null;
       return {
         success: false,
@@ -67624,7 +67749,7 @@ const mcpDashServerController$4 = {
    * Stop the MCP Dash server.
    */
   stopServer: async (win) => {
-    if (!httpServer) {
+    if (!httpsServer) {
       return { success: true, message: "Server was not running" };
     }
 
@@ -67632,7 +67757,7 @@ const mcpDashServerController$4 = {
       stopCleanup();
 
       await new Promise((resolve) => {
-        httpServer.close(() => resolve());
+        httpsServer.close(() => resolve());
         // Force close after 5 seconds
         setTimeout(() => resolve(), 5000);
       });
@@ -67645,7 +67770,7 @@ const mcpDashServerController$4 = {
         }
       }
 
-      httpServer = null;
+      httpsServer = null;
       mcpServer = null;
       transport = null;
       startTime = null;
@@ -67683,7 +67808,7 @@ const mcpDashServerController$4 = {
   getStatus: (win) => {
     const serverSettings = getMcpServerSettings(win);
     return {
-      running: !!httpServer,
+      running: !!httpsServer,
       enabled: serverSettings.enabled || false,
       port: serverSettings.port || 3141,
       connectionCount,