chore: lock the plugin boundary and remove 2.9.0 leftovers

src/backend/tls/certificate.ts

@@ -26,7 +26,7 @@ const PEM_CERT =
   /-----BEGIN CERTIFICATE-----[\s\S]+?-----END CERTIFICATE-----/g;
 
 /** The leaf is the first certificate in a full chain. */
-export function splitPemChain(pem: string): string[] {
+function splitPemChain(pem: string): string[] {
   return pem.match(PEM_CERT) ?? [];
 }
 
@@ -51,7 +51,7 @@ function isSelfSigned(cert: X509Certificate): boolean {
   }
 }
 
-export function describeCertificate(cert: X509Certificate): TlsCertificateInfo {
+function describeCertificate(cert: X509Certificate): TlsCertificateInfo {
   return {
     subject: cert.subject.replace(/\n/g, ", "),
     issuer: cert.issuer.replace(/\n/g, ", "),

src/backend/tls/tls-service.ts

@@ -127,7 +127,7 @@ export function registerTlsRenewer(renewer: TlsRenewer): () => void {
   };
 }
 
-export function currentTlsRenewer(): TlsRenewer | null {
+function currentTlsRenewer(): TlsRenewer | null {
   const first = renewers.values().next();
   return first.done ? null : first.value.renewer;
 }