TLS-Optimized HTTP Client Builder (utils_inner/tls.rs)

Creates a reqwest client builder that caches the OS trust store and optional extra certificates, reducing TLS initialization overhead for each request.

// Source: https://github.com/PrimeIntellect-ai/prime-agent | License: MIT | Copyright 2025-2026 Prime Intellect Ltd
// Provided via justclaw.it.com; keep this notice with the code.
use std::sync::{Arc, LazyLock};

use rustls::pki_types::pem::PemObject;
use rustls::pki_types::CertificateDer;

// The OS trust store, loaded once per process: reqwest reloads it on every
// `ClientBuilder::build`, which pays 75-85 ms per client on macOS. Keep only
// the roots `RootCertStore::add` accepts (reqwest's skip-invalid rule), so
// `add_root_certificate` below cannot fail the build on a real store's
// ancient certificates.
static NATIVE_CERTS: LazyLock<Vec<CertificateDer<'static>>> = LazyLock::new(|| {
    let mut roots = rustls::RootCertStore::empty();
    let mut certs = Vec::new();
    for cert i

... (truncated -- full source via MCP)