收紧移动事件注入边界

要求 Expo 壳事件注入先校验共享 HostBridge 事件名

保留统一 message script 的 origin 和 source 约束

同步移动壳事件注入边界记录

apps/mobile-shell/src/shell/ShellApp.tsx

@@ -19,6 +19,7 @@ import {
   type HostBridgeEventName,
   HOST_BRIDGE_PROTOCOL,
   HOST_BRIDGE_VERSION,
+  isHostBridgeEventName,
 } from '../../../../packages/shared/src/contracts/hostBridge';
 import {
   configureMobileHostBridgeNavigation,
@@ -59,6 +60,19 @@ function buildHostBridgeMessageScript(message: unknown) {
   )}, origin: window.location.origin, source: window })); true;`;
 }
 
+function buildHostBridgeEventScript(event: HostBridgeEventName, payload: unknown) {
+  if (!isHostBridgeEventName(event)) {
+    throw new Error(`unsupported HostBridge event ${event}`);
+  }
+
+  return buildHostBridgeMessageScript({
+    bridge: HOST_BRIDGE_PROTOCOL,
+    version: HOST_BRIDGE_VERSION,
+    event,
+    payload,
+  });
+}
+
 type MobileWebViewLoadErrorEvent = {
   nativeEvent: {
     url: string;
@@ -103,12 +117,7 @@ export default function ShellApp() {
   const injectHostBridgeEvent = useCallback(
     (event: HostBridgeEventName, payload: unknown) => {
       webViewRef.current?.injectJavaScript(
-        buildHostBridgeMessageScript({
-          bridge: HOST_BRIDGE_PROTOCOL,
-          version: HOST_BRIDGE_VERSION,
-          event,
-          payload,
-        }),
+        buildHostBridgeEventScript(event, payload),
       );
     },
     [],