//! Certificate files are control-plane inputs; handshakes only use immutable,
//! prevalidated rustls configurations. Private key bytes accepted by authenticated
//! deploy operations are bounded, zeroized by callers, never returned, and never
//! written to audit/API response payloads.

include!("tls/types.rs");
include!("tls/external_paths.rs");
include!("tls/server_config.rs");
include!("tls/certificates.rs");

#[cfg(test)]
include!("tls/tests.rs");
#[cfg(test)]
include!("tls/tests/acme.rs");