收口宿主事件白名单

新增共享 HostBridge event 白名单与类型守卫

让 H5、Expo 和 Tauri 只分发白名单宿主事件

补齐移动端、桌面端和根级原生壳门禁

更新宿主壳方案文档和项目决策记录

packages/shared/src/contracts/hostBridge.test.ts

@@ -9,8 +9,10 @@ import {
   HOST_BRIDGE_PUBLIC_WEB_URL,
   HOST_BRIDGE_TAURI_COMMAND,
   HOST_BRIDGE_CAPABILITIES,
+  HOST_BRIDGE_EVENTS,
   isHostBridgeMethod,
   isHostBridgeCapability,
+  isHostBridgeEventName,
   normalizeHostBridgeBadgeCount,
   normalizeHostBridgeClipboardText,
   normalizeHostBridgeColorScheme,
@@ -95,6 +97,23 @@ describe('HostBridge shared contract helpers', () => {
     expect(isHostBridgeCapability(null)).toBe(false);
   });
 
+  test('识别 HostBridge 事件白名单', () => {
+    expect(HOST_BRIDGE_EVENTS).toEqual([
+      'app.lifecycle',
+      'network.statusChanged',
+      'navigation.canGoBack',
+      'file.imageDropped',
+    ]);
+    for (const eventName of HOST_BRIDGE_EVENTS) {
+      expect(isHostBridgeEventName(eventName)).toBe(true);
+      expect(isHostBridgeCapability(eventName)).toBe(true);
+      expect(isHostBridgeMethod(eventName)).toBe(false);
+    }
+    expect(isHostBridgeEventName('host.getRuntime')).toBe(false);
+    expect(isHostBridgeEventName('unknown.event')).toBe(false);
+    expect(isHostBridgeEventName(null)).toBe(false);
+  });
+
   test('原生壳 capability profile 来自共享白名单', () => {
     const profiles = [
       HOST_BRIDGE_EXPO_MOBILE_BASE_CAPABILITIES,

packages/shared/src/contracts/hostBridge.ts

@@ -195,10 +195,28 @@ export type HostBridgeResponse<Result = unknown> = {
     }
 );
 
+export const HOST_BRIDGE_EVENTS = [
+  'app.lifecycle',
+  'network.statusChanged',
+  'navigation.canGoBack',
+  'file.imageDropped',
+] as const;
+
+export type HostBridgeEventName = (typeof HOST_BRIDGE_EVENTS)[number];
+
+export function isHostBridgeEventName(
+  value: unknown,
+): value is HostBridgeEventName {
+  return (
+    typeof value === 'string' &&
+    HOST_BRIDGE_EVENTS.includes(value as HostBridgeEventName)
+  );
+}
+
 export type HostBridgeEvent<Payload = unknown> = {
   bridge: typeof HOST_BRIDGE_PROTOCOL;
   version: typeof HOST_BRIDGE_VERSION;
-  event: string;
+  event: HostBridgeEventName;
   payload?: Payload;
 };