@nihinmedia/medgen-react-native 1.0.12

package/LICENSE

@@ -0,0 +1,62 @@
+MedGen Japan React Native SDK — Partner License Agreement
+
+Copyright (c) 2026 Nihin Media K. K., Ltd. All rights reserved.
+
+This software ("SDK") is licensed, not sold, to organisations ("Partner") that
+hold a current written integration agreement with Nihin Media K. K., Ltd.
+("MedGen JAPAN"). If you do not hold such an agreement, you have no licence to this
+SDK and must not use, copy or distribute it.
+
+1. GRANT
+   Subject to the integration agreement and to these terms, MedGen JAPAN grants
+   Partner a non-exclusive, non-transferable, revocable licence to install and
+   use the SDK solely to embed the MedGen JAPAN clinical assistant inside Partner's
+   own applications.
+
+2. RESTRICTIONS
+   Partner must not:
+   (a) sublicense, resell, or redistribute the SDK on its own, whether or not
+       for a fee, except as embedded within Partner's own application;
+   (b) reverse engineer, decompile or disassemble the SDK, except to the extent
+       that restriction is prohibited by applicable law;
+   (c) remove or obscure MedGen JAPAN attribution, except where the
+       `hide_attribution` capability has been granted in writing;
+   (d) use the SDK to build a competing clinical question-answering service; or
+   (e) use the SDK other than through its documented public interface.
+
+3. CREDENTIALS AND KEYS
+   Partner is responsible for the security of its signing keys and must keep
+   the assertion signing key on Partner-controlled servers. Signing keys must
+   never be embedded in an application binary. Partner must notify MedGen JAPAN
+   without undue delay on becoming aware of any compromise.
+
+4. DATA PROTECTION
+   The SDK transmits clinical queries and identity assertions to MedGen JAPAN.
+   Partner must ensure it has the lawful basis and any consents required to do
+   so, and must comply with the Act on the Protection of Personal Information
+   (APPI) and any other applicable law. Handling of personal data between the
+   parties is governed by the integration agreement.
+
+5. NO WARRANTY
+   THE SDK IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+   IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+   FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. THE SDK IS NOT A
+   MEDICAL DEVICE AND MUST NOT BE RELIED ON AS THE SOLE BASIS FOR ANY CLINICAL
+   DECISION.
+
+6. LIMITATION OF LIABILITY
+   TO THE MAXIMUM EXTENT PERMITTED BY LAW, MEDGEN JAPAN SHALL NOT BE LIABLE FOR ANY
+   INDIRECT, INCIDENTAL, SPECIAL OR CONSEQUENTIAL DAMAGES, OR FOR LOST PROFITS
+   OR DATA, ARISING OUT OF OR RELATING TO THE SDK. Nothing in this licence
+   excludes liability that cannot lawfully be excluded.
+
+7. TERMINATION
+   This licence terminates automatically on termination of the integration
+   agreement, or on Partner's breach of these terms. On termination Partner
+   must cease distributing applications containing the SDK in new releases.
+
+8. GOVERNING LAW
+   This licence is governed by the laws of Japan, with exclusive jurisdiction
+   in the Tokyo District Court.
+
+Contact: partners@nihinmedia.jp

package/README.md

@@ -0,0 +1,221 @@
+# @nihinmedia/medgen-react-native
+
+Embed MedGen's clinical assistant inside your React Native app. Your users
+reach MedGen without creating a separate account: your backend signs a short
+assertion, MedGen exchanges it for its own session.
+
+> **New here?** The quick start below gets the surface open, but you also need
+> a server-side endpoint that signs the assertion. Ask your MedGen
+> representative for the full integration guide, which covers that endpoint,
+> every error code and a pre-launch checklist.
+
+## Install
+
+```sh
+npm install @nihinmedia/medgen-react-native react-native-webview react-native-keychain
+cd ios && pod install
+```
+
+The package is public on npm, but **use requires a current integration
+agreement with Nihin Media**. You also need partner
+credentials (a `partnerId` and a key pair) before the SDK will do anything:
+without them every exchange fails with `PARTNER_NOT_ENABLED`.
+
+## Quick start
+
+```tsx
+import { MedGen, MedGenHost, MedGenEnvironment } from '@nihinmedia/medgen-react-native';
+
+MedGen.initialize({
+  partnerId: 'your-partner-id',
+  environment: MedGenEnvironment.Production,
+  // Must call YOUR server. Never sign in the app.
+  assertionProvider: async () => {
+    const res = await fetch('https://your-api.example.com/medgen/assertion', {
+      headers: { Authorization: `Bearer ${yourSessionToken}` },
+    });
+    const { assertion } = await res.json();
+    return assertion;
+  },
+});
+
+// Mount once, near the root.
+export default function App() {
+  return (
+    <>
+      <YourApp />
+      <MedGenHost />
+    </>
+  );
+}
+
+// Open the surface.
+await MedGen.present();
+```
+
+## The one rule that matters
+
+**Never ship the private key in the app.** A key inside an app binary can be
+extracted and must be assumed public. `assertionProvider` exists so signing
+stays on your server, where the key is.
+
+Assertions are **single-use**. Return a fresh one every call — a cached
+assertion fails with `ASSERTION_REPLAYED`.
+
+## Sign out
+
+```tsx
+await MedGen.signOut();   // call this from YOUR logout
+```
+
+Skipping it leaves a valid MedGen session on the device. On a shared clinical
+device the next user reaches the previous doctor's account and history.
+
+## Capabilities
+
+MedGen grants capabilities per partner. Read them rather than assuming:
+
+```tsx
+MedGen.initialize({
+  /* ... */
+  onEvent: (e) => {
+    if (e.name === 'exchange.succeeded') analytics.track('medgen_opened');
+  },
+});
+```
+
+The surface hides controls it has no native support for, so a feature you have
+not wired up does not appear as a dead button.
+
+## Native features
+
+The SDK performs share, copy and PDF export itself — but it cannot load the
+native modules those need, because they are *your* peer dependencies and
+Metro resolves a `require` relative to the package containing it. Pass in the
+ones you installed:
+
+```bash
+npm install @react-native-clipboard/clipboard react-native-share \
+            react-native-blob-util
+npm install react-native-html-to-pdf@^0.12.0   # NOT 1.x on the old architecture
+```
+
+```tsx
+MedGen.initialize({
+  /* ... */
+  nativeModules: {
+    clipboard: require('@react-native-clipboard/clipboard'),
+    share:     require('react-native-share'),
+    htmlToPdf: require('react-native-html-to-pdf'),
+    blobUtil:  require('react-native-blob-util'),
+  },
+});
+```
+
+Omit any you have not installed; the matching control then reports
+`UNAVAILABLE` rather than failing.
+
+`nativeHandlers` remains, as an **override** — use it to take an action over,
+for example filing the PDF into your own records system instead of offering
+the share sheet:
+
+```tsx
+nativeHandlers: {
+  onSavePdf: async ({ html, fileName }) => fileIntoRecords(html, fileName),
+}
+```
+
+### Platform configuration
+
+iOS — the surface's share menu composes mail, and since iOS 9 `canOpenURL`
+returns `NO` for any undeclared scheme:
+
+```xml
+<key>LSApplicationQueriesSchemes</key>
+<array>
+    <string>mailto</string>
+</array>
+```
+
+Android 11+ filters which apps yours can see, so `canOpenURL` returns false
+for `mailto:` without these. Package visibility, not a permission:
+
+```xml
+<queries>
+    <intent><action android:name="android.intent.action.SENDTO" />
+            <data android:scheme="mailto" /></intent>
+    <intent><action android:name="android.intent.action.VIEW" />
+            <data android:scheme="https" /></intent>
+</queries>
+```
+
+Android — only for `download_to_device`, and only on API 28 and below:
+
+```xml
+<uses-permission android:name="android.permission.WRITE_EXTERNAL_STORAGE"
+                 android:maxSdkVersion="28" />
+```
+
+### Known limitations
+
+- `rich_clipboard` has no effect: `@react-native-clipboard/clipboard` has no
+  HTML flavour on either platform, so copy is always plain text.
+- iOS has no public Downloads folder. `download_to_device` is Android-only;
+  on iOS the share sheet's **Save to Files** is the equivalent.
+
+## Attestation
+
+Required only if MedGen has enabled it for you:
+
+```tsx
+attestationProvider: async (challenge) => {
+  // iOS: DCAppAttestService attestation object, base64
+  // Android: Play Integrity token
+  return await YourAttestationModule.getToken(challenge);
+},
+```
+
+`challenge` is the assertion JWT itself, which binds the attestation to this
+exchange — a captured token cannot be replayed against a different one. Pass it
+to the platform API **unchanged**; the server hashes it itself, so hashing or
+re-encoding it here breaks verification.
+
+## Errors
+
+Every failure is a `MedGenError` with a `code` and a `retryable` flag:
+
+```tsx
+try {
+  await MedGen.present();
+} catch (e) {
+  if (e.code === 'EMAIL_COLLISION_PENDING') { /* not an error — see below */ }
+  else if (e.retryable) showRetry();
+  else showSupport(e.supportReference);
+}
+```
+
+**`emailCollisionPending` is a success, not a failure.** It means the asserted
+email already belongs to a MedGen account you did not create. The session is
+valid and the doctor can use MedGen immediately; MedGen offers account linking
+from inside the surface. Do not block on it.
+
+## Requirements
+
+| | |
+|---|---|
+| React Native | ≥ 0.71 |
+| iOS | 13.4+ |
+| Android | API 24+ |
+
+## Support
+
+Contact your MedGen representative with the `supportReference` from any error,
+or email **contact@nihinmedia.jp**.
+
+Security reports go to the same address. Please report privately rather than in
+any public forum.
+
+## Licence
+
+Proprietary — Nihin Media Co., Ltd. Use requires a current integration
+agreement. The full terms are in the `LICENSE` file inside this package.

package/SECURITY.md

@@ -0,0 +1,101 @@
+# Security Policy
+
+## Reporting a vulnerability
+
+Email **contact@nihinmedia.jp** with `[MedGen RN SDK]` in the subject.
+Please report privately by email rather than in any public forum.
+
+Include where you can: affected SDK version, platform (iOS/Android), a
+description of the issue, and the steps or proof-of-concept needed to
+reproduce it.
+
+| | |
+|---|---|
+| Acknowledgement | within 2 business days |
+| Initial assessment | within 5 business days |
+| Fix target — critical / high | 7 / 30 days |
+
+We will keep you updated through triage and tell you when a fix ships. We are
+happy to credit you in the release notes unless you would rather stay
+anonymous. Please give us a reasonable window to release a fix before any
+public disclosure.
+
+## Supported versions
+
+| Version | Supported |
+|---|---|
+| 1.x | ✅ |
+| < 1.0 | ❌ |
+
+## Security model — what the SDK guarantees, and what you must do
+
+The SDK is one half of the security boundary. Several properties depend on the
+partner's own integration, and no SDK change can enforce them for you.
+
+### The SDK's side
+
+- **Assertion signing never happens in the app.** The SDK has no signing key
+  and cannot mint an assertion; it can only call your `assertionProvider`.
+- **Credentials are stored in the platform secure store** (Keychain /
+  Android Keystore, via `react-native-keychain`), with
+  `AFTER_FIRST_UNLOCK_THIS_DEVICE_ONLY` so a session cannot travel to another
+  device in a cloud backup.
+- **Session tokens never appear in a URL.** Only the single-use, ~30-second
+  handoff code is put in the embed URL, because URLs leak into logs, history
+  and `Referer` headers.
+- **The WebView is locked to MedGen origins.** External links — citations,
+  references — are handed to the system browser rather than rendered inside
+  the authenticated surface.
+- **The native bridge is an allowlist.** Only the documented methods are
+  dispatched; anything else is ignored, so a compromised page cannot reach
+  arbitrary native functionality. Capability-gated methods additionally check
+  the grants returned by the server.
+- **Local file access is disabled** in the WebView, along with mixed content
+  and automatic window opening.
+
+### Your side
+
+- **Keep the signing key on your server.** A private key inside an app binary
+  can be extracted and must be assumed public. This is the single most
+  important rule in the integration.
+- **Authenticate the user before minting an assertion.** Your assertion
+  endpoint asserts an identity to MedGen; if it can be called without a valid
+  session of your own, anyone can impersonate any of your users.
+- **Return a fresh assertion every call.** They are single-use and live 120
+  seconds.
+- **Call `MedGen.signOut()` from your own logout.** Skipping it leaves a valid
+  MedGen session on the device — a real exposure on shared clinical devices,
+  where the next user would reach the previous doctor's account and history.
+- **Do not point `apiBaseUrl` / `embedBaseUrl` at a non-MedGen host** in a
+  production build. They exist for MedGen-supplied test environments. They
+  also relax nothing on their own — but a host you do not control receives the
+  assertion.
+- **Keep the SDK up to date**, and treat `react-native-webview` updates as
+  security updates.
+
+## Requirements on the MedGen embed host
+
+These are MedGen's own obligations, recorded here because the SDK's guarantees
+depend on them:
+
+- **Emit lowercase host URLs.** `react-native-webview` matches its origin
+  whitelist case-sensitively while normalising elsewhere, so a mixed-case
+  redirect can cause the library to open the authenticated surface in the
+  system browser before the SDK's handler runs.
+- **Do not embed cross-origin iframes in the surface.** The bridge nonce is
+  injected main-frame-only and a subframe cannot reach it, but a hostile frame
+  remains an unnecessary foothold.
+- **Treat the handoff code as single-use with a short TTL.**
+
+## Audit
+
+The SDK was independently audited before its first partner release. All
+findings were remediated prior to publication. Partners under an integration
+agreement can request the full report from their MedGen representative.
+
+## Handling of clinical data
+
+Queries typed into the surface are transmitted to MedGen for answering. The
+SDK itself persists no clinical content on the device; the chat history lives
+in the MedGen session. Your obligations for personal data are set out in your
+integration agreement and in APPI.

package/lib/commonjs/MedGenWebView.js

@@ -0,0 +1,201 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+
+exports.originOf = exports.isSameOrigin = exports.decideNavigation = exports.MedGenWebView = void 0;
+
+var _react = _interopRequireWildcard(require("react"));
+
+var _reactNative = require("react-native");
+
+var _reactNativeWebview = require("react-native-webview");
+
+var _bridge = require("./bridge");
+
+var _client = require("./client");
+
+function _interopRequireWildcard(e, t) {
+  if ("function" == typeof WeakMap) var r = new WeakMap, n = new WeakMap;
+  return (_interopRequireWildcard = function(e, t) {
+    if (!t && e && e.__esModule) return e;
+    var o, i, f = {
+      __proto__: null,
+      default: e
+    };
+    if (null === e || "object" != typeof e && "function" != typeof e) return f;
+    if (o = t ? n : r) {
+      if (o.has(e)) return o.get(e);
+      o.set(e, f);
+    }
+    for (const t in e) "default" !== t && {}.hasOwnProperty.call(e, t) && ((i = (o = Object.defineProperty) && Object.getOwnPropertyDescriptor(e, t)) && (i.get || i.set) ? o(f, t, i) : f[t] = e[t]);
+    return f;
+  })(e, t);
+}
+
+const WebView = _reactNativeWebview.WebView;
+
+const originOf = u => {
+  const m = /^[a-z][a-z0-9+.-]*:\/\/[^/?#]+/i.exec(u);
+  return m ? m[0].toLowerCase() : "";
+};
+
+exports.originOf = originOf;
+
+const decideNavigation = (url, base, isTopFrame) => {
+  if (isSameOrigin(url, base)) return "load";
+  if (isTopFrame === false) return "block";
+  if (/^(mailto|tel|sms):/i.test(url)) return "external";
+  if (!/^https?:\/\//i.test(url)) return "block";
+  return "external";
+};
+
+exports.decideNavigation = decideNavigation;
+
+const openExternally = async url => {
+  try {
+    if (!await _reactNative.Linking.canOpenURL(url)) {
+      (0, _client.emit)("surface.externalLinkFailed", {
+        url: url,
+        reason: "unsupported"
+      });
+      return false;
+    }
+    await _reactNative.Linking.openURL(url);
+    (0, _client.emit)("surface.externalLinkOpened", {
+      url: url
+    });
+    return true;
+  } catch (error) {
+    (0, _client.emit)("surface.externalLinkFailed", {
+      url: url,
+      reason: error instanceof Error ? error.message : "unknown"
+    });
+    return false;
+  }
+};
+
+const makeNonce = () => `${Date.now().toString(36)}.${Math.random().toString(36).slice(2)}${Math.random().toString(36).slice(2)}`;
+
+const isSameOrigin = (target, base) => {
+  if (target === "about:blank") return true;
+  const b = originOf(base);
+  return b !== "" && originOf(target) === b;
+};
+
+exports.isSameOrigin = isSameOrigin;
+
+const MedGenWebView = ({url: url, handlers: handlers, capabilities: capabilities, onClose: onClose}) => {
+  const ref = (0, _react.useRef)(null);
+  const nonce = (0, _react.useMemo)(() => makeNonce(), [ url ]);
+  const isMedGenOrigin = (0, _react.useCallback)(target => isSameOrigin(target, (0, 
+  _client.embedBase)()), []);
+  const onShouldStartLoadWithRequest = (0, _react.useCallback)(req => {
+    const decision = decideNavigation(req.url, (0, _client.embedBase)(), req.isTopFrame);
+    if (decision === "load") return true;
+    if (decision === "external") void openExternally(req.url);
+    return false;
+  }, [ isMedGenOrigin ]);
+  const onMessage = (0, _react.useCallback)(event => {
+    if (typeof __DEV__ !== "undefined" && __DEV__) {
+      try {
+        const probe = JSON.parse(event.nativeEvent.data);
+        if (probe?.__medgenLog) {
+          const {level: level = "log", args: args = []} = probe.__medgenLog;
+          console[level === "error" ? "error" : "warn"]("[MedGen surface]", ...args);
+          return;
+        }
+      } catch {}
+    }
+    if (!isMedGenOrigin(event.nativeEvent.url)) {
+      if (typeof __DEV__ !== "undefined" && __DEV__) {
+        console.warn("[MedGen] message rejected — origin not allowed:", event.nativeEvent.url);
+      }
+      return;
+    }
+    void (0, _bridge.handleBridgeMessage)(event.nativeEvent.data, replyJson => {
+      const safe = JSON.stringify(replyJson).replace(/\u2028/g, "\\u2028").replace(/\u2029/g, "\\u2029");
+      ref.current?.injectJavaScript(`window.__medgen && window.__medgen.receive(${safe}); true;`);
+    }, {
+      handlers: handlers,
+      capabilities: capabilities,
+      onClose: onClose,
+      nonce: nonce
+    });
+  }, [ isMedGenOrigin, handlers, capabilities, onClose, nonce ]);
+  return _react.default.createElement(WebView, {
+    ref: ref,
+    source: {
+      uri: url
+    },
+    style: styles.web,
+    injectedJavaScriptBeforeContentLoaded: `window.__medgenNonce=${JSON.stringify(nonce)};` + (typeof __DEV__ !== "undefined" && __DEV__ ? `(function(){var p=window.ReactNativeWebView&&window.ReactNativeWebView.postMessage;` + `if(!p)return;['log','warn','error'].forEach(function(l){var o=console[l];` + `console[l]=function(){try{p.call(window.ReactNativeWebView,JSON.stringify(` + `{__medgenLog:{level:l,args:Array.prototype.slice.call(arguments).map(String)}}));}` + `catch(e){}o&&o.apply(console,arguments);};});})();` : "") + `true;`,
+    injectedJavaScriptBeforeContentLoadedForMainFrameOnly: true,
+    originWhitelist: [ originOf((0, _client.embedBase)()) ],
+    onShouldStartLoadWithRequest: onShouldStartLoadWithRequest,
+    onMessage: onMessage,
+    allowFileAccess: false,
+    allowUniversalAccessFromFileURLs: false,
+    mixedContentMode: "never",
+    javaScriptCanOpenWindowsAutomatically: false,
+    setSupportMultipleWindows: false,
+    onOpenWindow: event => {
+      const url = event?.nativeEvent?.targetUrl;
+      if (!url) return;
+      const decision = decideNavigation(url, (0, _client.embedBase)(), true);
+      if (decision === "load") {
+        ref.current?.injectJavaScript(`window.location.assign(${JSON.stringify(url)});true;`);
+      } else if (decision === "external") {
+        void openExternally(url);
+      }
+    },
+    onError: event => {
+      (0, _client.emit)("surface.loadFailed", {
+        description: event?.nativeEvent?.description,
+        code: event?.nativeEvent?.code
+      });
+    },
+    onHttpError: event => {
+      (0, _client.emit)("surface.loadFailed", {
+        statusCode: event?.nativeEvent?.statusCode
+      });
+    },
+    automaticallyAdjustContentInsets: false,
+    contentInsetAdjustmentBehavior: "never",
+    keyboardDisplayRequiresUserAction: false,
+    androidLayerType: "hardware",
+    onContentProcessDidTerminate: () => {
+      (0, _client.emit)("surface.loadFailed", {
+        reason: "content_process_terminated"
+      });
+      ref.current?.reload();
+    },
+    allowsInlineMediaPlayback: true,
+    allowsLinkPreview: false,
+    applicationNameForUserAgent: `MedGenSDK/${_client.SDK_VERSION}`,
+    sharedCookiesEnabled: true,
+    thirdPartyCookiesEnabled: false,
+    startInLoadingState: true,
+    renderLoading: () => _react.default.createElement(_reactNative.View, {
+      style: styles.loading
+    }, _react.default.createElement(_reactNative.ActivityIndicator, {
+      size: "large"
+    })),
+    bounces: false,
+    overScrollMode: "never"
+  });
+};
+
+exports.MedGenWebView = MedGenWebView;
+
+const styles = _reactNative.StyleSheet.create({
+  web: {
+    flex: 1
+  },
+  loading: {
+    ..._reactNative.StyleSheet.absoluteFillObject,
+    alignItems: "center",
+    justifyContent: "center"
+  }
+});