<?xml version="1.0" encoding="utf-8"?>
<network-security-config>
    <!-- Production: Only trust system CAs -->
    <base-config cleartextTrafficPermitted="false">
        <trust-anchors>
            <certificates src="system"/>
        </trust-anchors>
    </base-config>

    <!-- Debug: Trust user-installed CAs (for ngrok/Charles/etc) -->
    <debug-overrides>
        <trust-anchors>
            <certificates src="system"/>
            <certificates src="user"/>
        </trust-anchors>
    </debug-overrides>

    <!-- Allow try.buyerkiosk.com for development -->
    <domain-config cleartextTrafficPermitted="false">
        <domain includeSubdomains="true">buyerkiosk.com</domain>
        <trust-anchors>
            <certificates src="system"/>
            <certificates src="user"/>
        </trust-anchors>
    </domain-config>
</network-security-config>
