//! The rustls crypto provider for outbound HTTP.
//!
//! reqwest is compiled `rustls-no-provider` to keep aws-lc-rs (a C backend) out
//! of the tree, which means a client cannot be built until a provider has been
//! installed process-wide. Every outbound client therefore comes from
//! [`builder`], so the two cannot get out of order.

/// Install ring as the process-wide rustls crypto provider. Idempotent (guarded
/// by a `Once`), and a no-op if the process already installed one.
pub fn install_crypto_provider() {
    static INSTALLED: std::sync::Once = std::sync::Once::new();
    INSTALLED.call_once(|| {
        let _ = rustls::crypto::ring::default_provider().install_default();
    });
}

/// A `reqwest` client builder with a provider guaranteed to be installed.
/// Callers add their own timeouts and policy, then `.build()`.
pub fn builder() -> reqwest::ClientBuilder {
    install_crypto_provider();
    reqwest::Client::builder()
}