<?xml version="1.0" encoding="utf-8"?>
<!--
  DEBUG-ONLY network security config.

  Lives under `src/debug/res/xml/`, so the manifest merger only applies this
  config to debug builds. Release builds (flutter build apk release,
  Play Store uploads) fall back to the Android platform default: cleartext
  HTTP is BLOCKED, and only HTTPS to trusted CAs is allowed.

  These cleartext exemptions exist solely so a debug APK on a phone can talk
  to a dev backend running on the dev machine's LAN. DO NOT add a production
  host here. If you find yourself wanting to, run the backend behind HTTPS
  (caddy / ngrok / cloudflare tunnel) instead.
-->
<network-security-config>
    <!-- Allow cleartext HTTP for explicit dev-only hosts. -->
    <domain-config cleartextTrafficPermitted="true">
        <!-- Dev machine's LAN IP — physical phone on same WiFi. -->
        <domain includeSubdomains="false">192.168.1.106</domain>
        <domain includeSubdomains="false">192.168.1.103</domain>
        <!-- Android emulator host-loopback (maps to localhost on the Mac). -->
        <domain includeSubdomains="false">10.0.2.2</domain>
        <!-- Local development. -->
        <domain includeSubdomains="false">localhost</domain>
        <domain includeSubdomains="false">127.0.0.1</domain>
    </domain-config>
</network-security-config>
