The ESM entry awaited the certificate at the top level and exported the result,
so `import httpsOptions from 'backloop.dev'` performed a network request merely
by being imported. That is where the broken Vite builds came from: Node refuses
require() on a graph containing a top-level await, and Vite loads vite.config.js
with require(), so a config importing this could not be loaded at all. A
production build that needs no certificate also downloaded one, and since 4.0.0
that meant it needed a secret to build.

It now exports the three functions, like the CommonJS entry, and nothing happens
until one is called. The default export holds the same three, so ESM and CJS
finally look alike.

Breaking, hence 5.0.0 — and breaking quietly would be worse than breaking. Code
that hands the default export to https.createServer used to get a working
options object; it would now get a module and start a server with no
certificate, failing somewhere far from the cause. Reading key, cert or ca
therefore throws a message naming the replacement.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>