from __future__ import annotations

import ssl
from functools import lru_cache
from pathlib import Path

import certifi


@lru_cache(maxsize=1)
def trusted_tls_context() -> ssl.SSLContext:
    """Build a strict TLS context from the pinned application CA bundle."""
    bundle = Path(certifi.where()).resolve(strict=True)
    if not bundle.is_file():
        raise RuntimeError("De vertrouwde CA-bundel ontbreekt.")
    return ssl.create_default_context(cafile=str(bundle))