@trustchex/react-native-sdk 1.475.1 → 1.478.7

package/src/Shared/Components/IdentityDocumentCamera.tsx

@@ -127,6 +127,11 @@ const IdentityDocumentCamera = ({
   const [status, setStatus] = useState<
     'SEARCHING' | 'SCANNING' | 'SCANNED' | 'INCORRECT'
   >('SEARCHING');
+  // True once the multi-frame voted MRZ consensus is STABLE + valid (the same
+  // reading matched across `stabilityTarget` consecutive frames, with a clear
+  // vote margin on contested cells). Drives the green "GO" signal — we never show
+  // green on an early/transient valid read, only on a reliably-detected MRZ.
+  const [mrzReliable, setMrzReliable] = useState(false);
   const [nextStep, setNextStep] = useState<
     'SCAN_ID_FRONT_OR_PASSPORT' | 'SCAN_ID_BACK' | 'SCAN_HOLOGRAM' | 'COMPLETED'
   >('SCAN_ID_FRONT_OR_PASSPORT');
@@ -148,7 +153,10 @@ const IdentityDocumentCamera = ({
   // Multi-frame per-character voting: fuses OCR across frames so a single-frame
   // misread (B↔8, S↔5, <↔K, dropped/inserted digit) is outvoted instead of
   // resetting progress. Drives the same `parsedMRZData`/stability the flow uses.
-  const mrzAggregator = useRef(new MRZFrameAggregator({ stabilityTarget: 2 }));
+  // stabilityTarget: 3 — the voted consensus must read the SAME valid MRZ across
+  // 3 consecutive contributing frames before we accept, so a transient look-alike
+  // misread (e.g. OCR-B "4" vs "A") can never lock in on one or two early frames.
+  const mrzAggregator = useRef(new MRZFrameAggregator({ stabilityTarget: 3 }));
 
   // Document type stability tracking - require consistent detections from good quality frames
   const lastDetectedDocType = useRef<
@@ -283,6 +291,7 @@ const IdentityDocumentCamera = ({
       lastValidMRZFields.current = null;
       validMRZConsecutiveCount.current = 0;
       mrzAggregator.current.reset();
+      setMrzReliable(false);
       cachedBarcode.current = null;
       isCompletionCallbackInvoked.current = false;
       isStepTransitionInProgress.current = false;
@@ -609,6 +618,7 @@ const IdentityDocumentCamera = ({
         lastValidMRZFields.current = null;
         // New MRZ expected on the back — start voting fresh.
         mrzAggregator.current.reset();
+        setMrzReliable(false);
       }
       validMRZConsecutiveCount.current = 0;
       cachedBarcode.current = null; // Clear cached barcode on step change
@@ -1009,15 +1019,6 @@ const IdentityDocumentCamera = ({
         // During SCAN_HOLOGRAM, allow processing even if text is not readable
       }
 
-      // Capture test mode data
-      if (testMode && text && text.includes('<')) {
-        const mrzOnlyText = scannedText?.mrzOnlyText || text;
-        setTestModeData({
-          mrzText: mrzOnlyText,
-          timestamp: Date.now(),
-        });
-      }
-
       // MRZ stability: require consistent valid reads across frames
       // Skip during SCAN_HOLOGRAM - document type already locked
       const mrzHasRequiredFields = hasRequiredMRZFields(parsedMRZData?.fields);
@@ -1041,14 +1042,39 @@ const IdentityDocumentCamera = ({
       }
       // else: Invalid/no MRZ - skip frame without resetting (allows temporary OCR noise)
 
-      // Check if we have enough consistent valid reads
+      // Accept ONLY when the multi-frame voted consensus is stable.
+      //
+      // Early frames can OCR an ambiguous glyph wrongly yet still produce a
+      // check-digit-VALID reading — e.g. a Turkish document number "A53032352"
+      // misread as "453032352" (the OCR-B 4 looks like A, and 453032352 also
+      // passes its check digit). The old code also accepted on a legacy path of
+      // "N identical valid single-frame reads", which those transient frames
+      // satisfy — locking in the WRONG number before the voted consensus settles
+      // on the correct one. We now require `consensus.stable`: the per-character
+      // vote must be unchanged across `stabilityTarget` consecutive contributing
+      // frames, which is exactly the "only accept once stable" guarantee.
+      // `addFrame` runs for every frame above, so the consensus is always current.
       const mrzStableAndValid =
-        // Either: the multi-frame voted consensus has converged (valid + stable),
-        (consensus.stable && parsedMRZData?.valid === true) ||
-        // or the legacy N-identical-reads path is satisfied.
-        (validMRZConsecutiveCount.current >= REQUIRED_CONSISTENT_MRZ_READS &&
-          parsedMRZData?.valid === true &&
-          areMRZFieldsEqual(lastValidMRZFields.current, parsedMRZData?.fields));
+        consensus.stable && parsedMRZData?.valid === true;
+
+      // Surface the reliable-detection signal to the render so the UI can show a
+      // green "GO" the moment (and only once) the consensus is stable + valid.
+      // Never flips green on an early/transient valid read.
+      setMrzReliable((prev) => (prev === mrzStableAndValid ? prev : mrzStableAndValid));
+
+      // Test-mode panel: show the MRZ ONLY once it is stable + valid (the same
+      // consensus matched across `stabilityTarget` consecutive frames). Showing
+      // the raw per-frame OCR here would flash transient, possibly mis-converted
+      // readings (e.g. a momentary "4" for "A") before the vote settles — the
+      // opposite of what the screen should convey. We display the corrected,
+      // check-digit-valid consensus and never an unstable intermediate.
+      if (testMode && mrzStableAndValid && mrzText) {
+        setTestModeData((prev) =>
+          prev?.mrzText === mrzText
+            ? prev
+            : { mrzText, timestamp: Date.now() }
+        );
+      }
 
       // ============================================================================
       // SCAN_ID_BACK STEP - Validate MRZ + barcode on back of ID card
@@ -2430,8 +2456,11 @@ const IdentityDocumentCamera = ({
             style={[
               styles.topZoneText,
               // Priority order for coloring (later styles override earlier ones)
-              // 1. Success (green) - scan completed
-              nextStep === 'COMPLETED' && styles.topZoneTextSuccess,
+              // 1. Success/GO (green) - scan completed OR MRZ reliably detected
+              //    (stable consensus). This is the "GO" signal; never shown on a
+              //    transient/early valid read.
+              (nextStep === 'COMPLETED' || mrzReliable) &&
+                styles.topZoneTextSuccess,
               // 2. Error (red) - wrong side - with flash opacity
               status === 'INCORRECT' && styles.topZoneTextError,
               status === 'INCORRECT' && {
@@ -2457,7 +2486,8 @@ const IdentityDocumentCamera = ({
               isFrameBlurry,
               allElementsDetected,
               elementsOutsideScanArea,
-              t
+              t,
+              mrzReliable
             )}
           </AnimatedText>
         </View>
@@ -2469,7 +2499,9 @@ const IdentityDocumentCamera = ({
             styles.scanArea,
             {
               borderColor:
-                nextStep === 'COMPLETED'
+                // Green once the scan is done OR the MRZ is reliably detected
+                // (stable consensus) — the "GO" signal. Never green before that.
+                nextStep === 'COMPLETED' || mrzReliable
                   ? '#4CAF50'
                   : status === 'INCORRECT'
                     ? '#f44336'
@@ -2478,7 +2510,8 @@ const IdentityDocumentCamera = ({
                       : isBrightnessLow || isFrameBlurry
                         ? '#FFC107'
                         : 'white',
-              borderWidth: status === 'SCANNING' ? 3 : 2,
+              borderWidth:
+                mrzReliable || status === 'SCANNING' ? 3 : 2,
             },
           ]}
         >

package/src/Shared/Components/IdentityDocumentCamera.utils.ts

@@ -96,12 +96,20 @@ export function getStatusMessage(
   isFrameBlurry: boolean,
   allElementsDetected: boolean,
   elementsOutsideScanArea: string[],
-  t: (key: string, params?: Record<string, unknown>) => string
+  t: (key: string, params?: Record<string, unknown>) => string,
+  mrzReliable: boolean = false
 ): string {
   if (nextStep === 'COMPLETED') {
     return t('identityDocumentCamera.scanCompleted');
   }
 
+  // MRZ reliably detected (stable consensus) — the green "GO" message. Ranks
+  // above the in-progress states so the user gets a clear positive signal the
+  // moment the reading has settled, but never on an early/transient valid read.
+  if (mrzReliable) {
+    return t('identityDocumentCamera.mrzDetected');
+  }
+
   if (status === 'INCORRECT') {
     if (nextStep === 'SCAN_ID_FRONT_OR_PASSPORT') {
       return t('identityDocumentCamera.alignIDFront');

package/src/Shared/EIDReader/eidReader.ts

@@ -8,6 +8,7 @@ import { FaceImageInfo } from './lds/iso19794/faceImageInfo';
 import { Buffer } from 'buffer';
 import { MRZInfo } from './lds/icao/mrzInfo';
 import { InputStream } from './java/inputStream';
+import { debugLog } from '../Libs/debug.utils';
 
 // --- Minimal PNG encoder (pure JS, no native deps) ---
 // Uses deflate stored (uncompressed) blocks for O(n) encoding speed.
@@ -161,14 +162,15 @@ function convertJP2IfNeeded(
     return { base64: imageBuffer.toString('base64'), mimeType };
   }
 
-  console.debug('[EID] Face image is JP2, attempting conversion…');
+  debugLog('EID', '[EID] Face image is JP2, attempting conversion…');
   try {
     // Lazy-load jpeg2000 to avoid crashing if it fails to import
     const { JpxImage } = require('jpeg2000');
     const jpx = new JpxImage();
     jpx.parse(imageBuffer);
     const tile = jpx.tiles[0];
-    console.debug(
+    debugLog(
+      'EID',
       `[EID] JP2 decoded: ${tile.width}x${tile.height}, ${jpx.componentsCount} channels, ${tile.items.length} bytes`
     );
     const pngBytes = pixelsToPng(
@@ -178,12 +180,13 @@ function convertJP2IfNeeded(
       jpx.componentsCount
     );
     const pngBase64 = Buffer.from(pngBytes).toString('base64');
-    console.debug(
+    debugLog(
+      'EID',
       `[EID] Converted JP2 → PNG (${pngBytes.length} bytes, ${pngBase64.length} base64 chars)`
     );
     return { base64: pngBase64, mimeType: 'image/png' };
   } catch (err) {
-    console.debug('[EID] JP2 conversion failed:', err);
+    debugLog('EID', '[EID] JP2 conversion failed:', err);
     return { base64: imageBuffer.toString('base64'), mimeType };
   }
 }
@@ -319,10 +322,11 @@ const eidReader = async (
 
     try {
       await passportService.sendSelectMF();
-      console.debug('[EID] SELECT MF OK');
+      debugLog('EID', '[EID] SELECT MF OK');
     } catch (mfErr) {
       const mfMsg = mfErr instanceof Error ? mfErr.message : String(mfErr);
-      console.debug(
+      debugLog(
+        'EID',
         `[EID] SELECT MF failed (${mfMsg}), continuing with SFI read anyway`
       );
     }
@@ -346,13 +350,15 @@ const eidReader = async (
         buf[i] = await cardAccessStream.read();
       }
       cardAccessBuf = buf;
-      console.debug(
+      debugLog(
+        'EID',
         `[EID] EF.CardAccess read OK: ${cardAccessLen} bytes = ${cardAccessBuf.toString('hex')}`
       );
     } catch (readErr) {
       const readMsg =
         readErr instanceof Error ? readErr.message : String(readErr);
-      console.debug(
+      debugLog(
+        'EID',
         `[EID] EF.CardAccess read FAILED: ${readMsg} — falling back to BAC`
       );
     }
@@ -368,7 +374,8 @@ const eidReader = async (
         const paceInfo = parsePACEInfoFromCardAccess(cardAccessBuf);
 
         if (paceInfo) {
-          console.debug(
+          debugLog(
+            'EID',
             `[EID] PACE available: oid=${paceInfo.oid} parameterId=${paceInfo.parameterId}`
           );
           // PACE is available - derive key from MRZ and perform PACE
@@ -387,9 +394,10 @@ const eidReader = async (
             progressCallback
           );
           hasPACESucceeded = true;
-          console.debug('[EID] PACE succeeded');
+          debugLog('EID', '[EID] PACE succeeded');
         } else {
-          console.debug(
+          debugLog(
+            'EID',
             '[EID] EF.CardAccess read OK but no PACE SecurityInfo found — document does not support PACE, falling back to BAC'
           );
         }
@@ -397,11 +405,12 @@ const eidReader = async (
         // PACE protocol exchange failed — fall back to BAC
         const msg =
           paceError instanceof Error ? paceError.message : String(paceError);
-        console.debug(
+        debugLog(
+          'EID',
           `[EID] PACE protocol failed (${msg}), falling back to BAC`
         );
         if (paceError instanceof Error && paceError.stack) {
-          console.debug('[EID] PACE error stack:', paceError.stack);
+          debugLog('EID', '[EID] PACE error stack:', paceError.stack);
         }
       }
     }
@@ -490,7 +499,7 @@ const eidReader = async (
       mimeType: mimeType,
     };
   } catch (error) {
-    console.debug('Error reading passport data', error);
+    debugLog('EID', 'Error reading passport data', error);
   } finally {
     await passportService.close();
   }

package/src/Shared/Libs/MRZ_KNOWN_ISSUES.md

@@ -56,6 +56,40 @@ primary safeguard. A single noisy frame is not trusted; the consensus is.
 
 ---
 
+## 2a. Turkish e-ID document numbers: leading serial LETTER must be preserved
+
+**Issue.** Turkish identity cards put a **serial letter** at the start of the
+9-char document number (e.g. `A53032352`, `A49M38410`). Empirically — verified
+against real cards — **Türkiye computes the document-number check digit over the
+number with the LEADING letter EXCLUDED** (interior letters are kept), which
+diverges from strict ICAO 9303 (where `A`=10 is weighted in). So a genuine card
+`A53032352` (printed check digit `5`) **fails** the strict ICAO check (which
+wants `7`), even though the card is valid — `icaoCheckDigit("53032352") === "5"`.
+The TD1 **composite** on these cards is likewise non-standard (no interpretation
+of the leading letter reproduces it), so it is **not** a reliable anchor.
+
+**Why it matters.** The leading letter is **real** and **must be preserved**: the
+**NFC eID chip derives its BAC/PACE access key from the document number exactly
+as stored** (with the letter). Rewriting `A53032352`→`453032352` — as the
+ambiguous-char recovery would, to satisfy strict ICAO — makes the **chip read
+FAIL**. (The OCR-B `4` glyph closely resembles `A`, which is why the recovery
+used to "correct" it.)
+
+**Mitigation.** `acceptsTurkishLetterPrefix` (in `mrz.utils.ts`; ported to
+`mrz_utils.dart`) accepts a TUR TD1 whose only failing checks are
+document-number/composite **when** the document number starts with a letter
+**and** `icaoCheckDigit(documentNumber.slice(1))` matches the printed
+document-number check digit. The parse is then accepted **as-is**, preserving the
+letter; the composite is deliberately not required. The subsequent **NFC read is
+the authoritative confirmation** — it only succeeds with the correct
+(letter-preserving) number. Contrast `A49M38410`, whose letters validate under
+*standard* ICAO and so are kept by the normal path.
+
+Covered by the "Turkish e-ID … leading serial LETTER" tests in
+`mrz.ambiguous.test.ts` (RN) and `mrz_ambiguous_test.dart` (Flutter).
+
+---
+
 ## 3. Filler-letter normalisation is conservative in name fields (by design)
 
 **Issue.** The `<` filler is frequently OCR'd as a letter (`K`, and under glare

package/src/Shared/Libs/SignalingClient.ts

@@ -1,4 +1,5 @@
 import EventSource, { type EventSourceListener } from 'react-native-sse';
+import { debugLog } from './debug.utils';
 
 export type SignalingMessageType =
   | 'offer'
@@ -51,7 +52,7 @@ export class SignalingClient {
     }
     const url = `${this.baseUrl}/api/app/mobile/video-sessions/${this.sessionId}/signaling/stream?${urlParams.toString()}`;
 
-    console.log('[SignalingClient] Connecting to SSE:', url);
+    debugLog('SignalingClient', '[SignalingClient] Connecting to SSE:', url);
 
     this.eventSource = new EventSource(url, {
       pollingInterval: 0, // 0 means default/no polling if SSE is real
@@ -59,7 +60,7 @@ export class SignalingClient {
 
     const listener: EventSourceListener = (event) => {
       if (event.type === 'open') {
-        console.log('[SignalingClient] Connected');
+        debugLog('SignalingClient', '[SignalingClient] Connected');
         this.onConnected?.();
       } else if (event.type === 'error') {
         console.error(
@@ -108,8 +109,8 @@ export class SignalingClient {
     };
 
     // Ping handler - server sends pings to keep connection alive
-    const pingListener = (event: any) => {
-      console.log('[SignalingClient] Received ping');
+    const pingListener = (_event: any) => {
+      debugLog('SignalingClient', '[SignalingClient] Received ping');
       // Just acknowledge by doing nothing, server-side heartbeat keeps connection alive
     };
 
@@ -117,7 +118,11 @@ export class SignalingClient {
     const sessionEndedListener = (event: any) => {
       try {
         const data = JSON.parse(event.data || '{}');
-        console.log('[SignalingClient] Session ended:', data.state);
+        debugLog(
+          'SignalingClient',
+          '[SignalingClient] Session ended:',
+          data.state
+        );
         if (this.onSessionEnded) {
           this.onSessionEnded(data.state);
         }

package/src/Shared/Libs/crypto.utils.ts

@@ -3,21 +3,56 @@ import { Buffer } from 'buffer';
 import { gcm } from '@noble/ciphers/aes';
 import { randomBytes } from '@noble/ciphers/webcrypto';
 import { secp256k1 } from '@noble/curves/secp256k1';
-import httpClient from './http-client';
+import { hkdf } from '@noble/hashes/hkdf';
+import { sha256 } from '@noble/hashes/sha2';
+import httpClient, { setSessionToken } from './http-client';
+
+// Must stay byte-for-byte identical to the backend derivation
+// (web-app/src/lib/crypto-utils.ts).
+const SESSION_KEY_KDF_INFO = 'trustchex-session-key-v2';
+const SESSION_KEY_KDF_VERSION = 2;
+
+type AuthResponse = {
+  serverPublicKey: string;
+  kdfVersion?: number;
+  sessionToken?: string;
+};
 
 const getSessionKey = async (apiUrl: string, sessionId: string) => {
   const clientPrivateKey = secp256k1.utils.randomPrivateKey();
   const clientPublicKey = secp256k1.getPublicKey(clientPrivateKey);
   const serverResponse = await httpClient.post<
-    { serverPublicKey: string },
-    { clientPublicKey: string }
+    AuthResponse,
+    { clientPublicKey: string; kdfVersion: number }
   >(`${apiUrl}/verification-sessions/${sessionId}/auth`, {
     clientPublicKey: Buffer.from(clientPublicKey).toString('hex'),
+    kdfVersion: SESSION_KEY_KDF_VERSION,
   });
+
+  if (serverResponse.sessionToken) {
+    setSessionToken(serverResponse.sessionToken);
+  }
+
   const sharedKey = secp256k1.getSharedSecret(
     clientPrivateKey,
     Buffer.from(serverResponse.serverPublicKey, 'hex').toString('hex')
   );
+
+  // The server echoes the kdfVersion it actually used; older backends don't
+  // send the field and derive the legacy key.
+  if (serverResponse.kdfVersion === SESSION_KEY_KDF_VERSION) {
+    // sharedKey is a compressed secp256k1 point; byte 0 is the 0x02/0x03
+    // parity prefix and carries no secret entropy.
+    const derived = hkdf(
+      sha256,
+      Buffer.from(sharedKey).subarray(1),
+      Buffer.from(sessionId, 'utf-8'),
+      SESSION_KEY_KDF_INFO,
+      32
+    );
+    return Buffer.from(derived).toString('hex');
+  }
+
   const sessionKey = (
     Buffer.from(new Date().getUTCDate().toString(), 'utf-8').toString('hex') +
     Buffer.from(sharedKey).toString('hex')
@@ -27,7 +62,9 @@ const getSessionKey = async (apiUrl: string, sessionId: string) => {
 };
 
 const encryptWithAes = (data: string, key: string) => {
-  const nonce = randomBytes(32);
+  // Standard 96-bit GCM IV; the backend reads the nonce from the payload, so
+  // this stays compatible with servers that previously saw 32-byte nonces.
+  const nonce = randomBytes(12);
   const dataBytes = Buffer.from(data, 'utf-8');
   const aes = gcm(Buffer.from(key, 'hex'), nonce);
   const ciphertext = aes.encrypt(dataBytes);

package/src/Shared/Libs/deeplink.utils.ts

@@ -1,9 +1,29 @@
-import { debugLog } from './debug.utils';
+import { debugLog, logWarn } from './debug.utils';
+
+// Hostname (optionally with port) — rejects paths, credentials, and other
+// URL components smuggled into the app-url segment.
+const HOST_PATTERN = /^[a-zA-Z0-9][a-zA-Z0-9.-]*(:\d{1,5})?$/;
+
+const getUrlScheme = (url: string): string => {
+  const match = url.match(/^([a-zA-Z][a-zA-Z0-9+.-]*):\/\//);
+  return match ? match[1].toLowerCase() : '';
+};
+
+// The SDK uploads identity documents and biometrics to the derived baseUrl, so
+// cleartext destinations are only allowed in development builds.
+const isAllowedScheme = (scheme: string): boolean => {
+  return scheme === 'https' || (__DEV__ && scheme === 'http');
+};
+
+export const getUrlHost = (url: string): string => {
+  const withoutScheme = url.replace(/^[a-zA-Z][a-zA-Z0-9+.-]*:\/\//, '');
+  return (withoutScheme.split('/')[0] ?? '').toLowerCase();
+};
 
 const handleDeepLink = ({ url }: { url: string }) => {
   debugLog('handleDeepLink', 'Received URL:', url);
-  const isHttps = url.includes('https');
-  const route = url.replace(/http(s)?(:)?(\/\/)?/g, '');
+  const scheme = getUrlScheme(url);
+  const route = scheme ? url.slice(`${scheme}://`.length) : url;
   const segments = route.split('/');
   debugLog('handleDeepLink', 'Parsed segments:', segments);
   let baseUrl = '';
@@ -17,16 +37,28 @@ const handleDeepLink = ({ url }: { url: string }) => {
       sessionId = segments[i + 1] ?? '';
       debugLog('handleDeepLink', 'Found sessionId:', sessionId);
     } else if (segments[i] === 'app-url') {
-      baseUrl = `${isHttps ? 'https' : 'http'}://${segments[i + 1]}`;
+      const host = segments[i + 1] ?? '';
+      if (!HOST_PATTERN.test(host)) {
+        logWarn('handleDeepLink', 'Rejected invalid app-url host');
+        continue;
+      }
+      const hostScheme = scheme === 'http' ? 'http' : 'https';
+      if (!isAllowedScheme(hostScheme)) {
+        logWarn('handleDeepLink', 'Rejected non-HTTPS app-url');
+        continue;
+      }
+      baseUrl = `${hostScheme}://${host}`;
       debugLog('handleDeepLink', 'Found baseUrl:', baseUrl);
     }
   }
 
   // If no app-url segment found, derive baseUrl from the URL itself
   if (!baseUrl && sessionId) {
-    const match = url.match(/^(https?:\/\/[^/]+)/);
-    if (match) {
-      baseUrl = match[1];
+    const match = url.match(/^(https?):\/\/([^/]+)/);
+    if (match && isAllowedScheme(match[1].toLowerCase())) {
+      baseUrl = `${match[1].toLowerCase()}://${match[2]}`;
+    } else if (match) {
+      logWarn('handleDeepLink', 'Rejected non-HTTPS deep link URL');
     }
   }
 

package/src/Shared/Libs/http-client.ts

@@ -1,4 +1,5 @@
 import { trackApiCall, trackError } from './analytics.utils';
+import { debugLog } from './debug.utils';
 
 interface ErrorResponse {
   message: string;
@@ -46,6 +47,17 @@ export class InternalServerError extends HttpClientError {
   }
 }
 
+// Short-lived per-verification token issued by the backend during the session
+// key exchange; sent on every subsequent call. Older backends don't issue one,
+// in which case requests go out without the header (backwards compatible).
+let sessionToken: string | null = null;
+
+export const setSessionToken = (token: string | null) => {
+  sessionToken = token;
+};
+
+export const getSessionToken = () => sessionToken;
+
 const request = async <TResponse, TBody>(
   httpMethod: 'GET' | 'POST' | 'PUT' | 'DELETE',
   url: string,
@@ -64,10 +76,11 @@ const request = async <TResponse, TBody>(
   let statusCode = 0;
   let success = false;
 
-  console.log(`[HTTP] ${httpMethod} ${url}`);
+  debugLog('HTTP', `${httpMethod} ${url}`);
   if (body) {
-    console.log(
-      '[HTTP] Request body:',
+    debugLog(
+      'HTTP',
+      'Request body:',
       JSON.stringify(body).substring(0, 200) + '...'
     );
   }
@@ -77,14 +90,16 @@ const request = async <TResponse, TBody>(
       method: httpMethod,
       headers: {
         'Content-Type': 'application/json',
+        ...(sessionToken ? { 'X-Session-Token': sessionToken } : {}),
       },
       body: body ? JSON.stringify(body) : undefined,
     });
 
     statusCode = response.status;
     success = response.ok;
-    console.log(
-      `[HTTP] Response status: ${statusCode} ${response.ok ? '✓' : '✗'}`
+    debugLog(
+      'HTTP',
+      `Response status: ${statusCode} ${response.ok ? '✓' : '✗'}`
     );
 
     let responseJson = null;
@@ -92,14 +107,15 @@ const request = async <TResponse, TBody>(
     try {
       responseJson = await response.json();
       if (responseJson) {
-        console.log(
-          '[HTTP] Response body:',
+        debugLog(
+          'HTTP',
+          'Response body:',
           JSON.stringify(responseJson).substring(0, 200) + '...'
         );
       }
     } catch (error) {
       // Invalid JSON response
-      console.log('[HTTP] Response body: (non-JSON)');
+      debugLog('HTTP', 'Response body: (non-JSON)');
     }
 
     // Track API call performance (non-blocking)