NuGet.config

<?xml version="1.0" encoding="utf-8"?>
<configuration>

  <packageSources>
    <!--
      Primary source: nuget.org
      All public packages (Avalonia, Nodify, CommunityToolkit, etc.) come from here.
    -->
    <add key="nuget.org" value="https://api.nuget.org/v3/index.json" protocolVersion="3" />

    <!--
      Optional: private feed for GoAffPro.Client and internal packages.
      Uncomment and replace the URL when you set up your private NuGet feed.
      Recommended: GitHub Packages, Azure Artifacts, or BaGet self-hosted.
    -->
    <!-- <add key="streamweaver-private" value="https://nuget.pkg.github.com/{your-org}/index.json" /> -->
    <!--<add key="local" value="./nupkgs" />-->
  </packageSources>

  <packageSourceMapping>
    <!--
      Package source mapping: restricts each package to a specific source.
      This prevents dependency confusion attacks — public packages must come
      from nuget.org, private packages must come from the private feed.

      Add a <packageSource name="streamweaver-private"> block here when the
      private feed is configured.
    -->
    <packageSource key="nuget.org">
      <package pattern="*" />
    </packageSource>
  </packageSourceMapping>

  <config>
    <!-- Disable package restore from cache for CI (use -\-no-cache flag instead) -->
    <!-- <add key="globalPackagesFolder" value=".nuget/packages" /> -->
  </config>

</configuration>