"""Environment-only network policy shared by model calls and credential checks."""

from typing import Any

import httpx

from artemis.config.settings import settings


def model_http_options() -> dict[str, Any]:
    return {
        "trust_env": settings.OPENAI_USE_SYSTEM_PROXY,
        # Proxy opt-out must not disable configured CA certificates or TLS checks.
        "verify": httpx.create_ssl_context(trust_env=True),
    }