feat(ios-prebuild): embed React.framework's non-header resources for prebuilt/SwiftPM

Source builds get React-Core's non-header resources from the podspec
resource_bundles, but in the prebuilt path the source pods aren't installed
(CocoaPods facades) / not present (SwiftPM), so they were lost. Reproduce them in
the artifact at compose time via scripts/ios-prebuild/framework-resources.js:

  - Privacy manifest: merge the PrivacyInfo.xcprivacy of the pods baked into
    React.framework into one manifest at the framework root, where Xcode's
    privacy-report aggregation picks it up (React.framework is dynamic; no runtime).
  - RCTI18nStrings: rebuild RCTI18nStrings.bundle from React/I18n/strings/*.lproj
    inside React.framework, resolved at runtime by the framework-aware loader.

RCTLocalizedString.mm now resolves the strings bundle from the code's own bundle
first (React.framework when prebuilt/SwiftPM) with a main-bundle fallback (static
source builds), keeping the graceful nil -> default behaviour.

React-Core.podspec declares RCTI18nStrings and React-Core_privacy in one
resource_bundles map (a later resource_bundles= had silently overwritten the
first), so source builds ship both again. The RNCore facade no longer carries
React-Core_privacy: the prebuilt artifact owns these resources now.

Red/green unit + integration tests in __tests__/framework-resources-test.js.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: chrfalch

packages/react-native/React-Core.podspec

@@ -51,7 +51,6 @@ Pod::Spec.new do |s|
   s.author                 = "Meta Platforms, Inc. and its affiliates"
   s.platforms              = min_supported_versions
   s.source                 = source
-  s.resource_bundle        = { "RCTI18nStrings" => ["React/I18n/strings/*.lproj"]}
   s.compiler_flags         = js_engine_flags()
   s.header_dir             = "React"
   s.weak_framework         = "JavaScriptCore"
@@ -122,7 +121,15 @@ Pod::Spec.new do |s|
     s.dependency "React-hermes"
   end
 
-  s.resource_bundles = {'React-Core_privacy' => 'React/Resources/PrivacyInfo.xcprivacy'}
+  # Both bundles in one declaration: a second `resource_bundle(s) =` would replace
+  # (not merge) the first. RCTI18nStrings holds React-Core's localized strings
+  # (loaded by RCTLocalizedString); React-Core_privacy is the privacy manifest.
+  # (Prebuilt/SwiftPM get both from inside React.xcframework instead — see
+  # scripts/ios-prebuild/{i18n,privacy}.js — but source builds ship them here.)
+  s.resource_bundles = {
+    'RCTI18nStrings' => ['React/I18n/strings/*.lproj'],
+    'React-Core_privacy' => 'React/Resources/PrivacyInfo.xcprivacy',
+  }
 
   add_dependency(s, "React-runtimeexecutor", :additional_framework_paths => ["platform/ios"])
   add_dependency(s, "React-jsinspector", :framework_name => 'jsinspector_modern')

packages/react-native/React/I18n/RCTLocalizedString.mm

@@ -9,6 +9,29 @@
 
 #if !defined(WITH_FBI18N) || !(WITH_FBI18N)
 
+// Anchors resource lookups to the bundle that contains this code: React.framework
+// when React Native is consumed prebuilt / via SwiftPM, or the app's main bundle
+// for static source builds.
+@interface RCTI18nStringsAnchor : NSObject
+@end
+@implementation RCTI18nStringsAnchor
+@end
+
+// Resolves RCTI18nStrings.bundle wherever it ships: the code's own bundle first
+// (prebuilt/SwiftPM embed it inside React.framework), then the app's main bundle
+// (source builds copy it there via the podspec resource_bundles). Returns nil
+// when absent, so the caller falls back to the untranslated default value.
+static NSBundle *RCTI18nStringsBundle(void)
+{
+  NSBundle *codeBundle = [NSBundle bundleForClass:[RCTI18nStringsAnchor class]];
+  NSURL *url = [codeBundle URLForResource:@"RCTI18nStrings" withExtension:@"bundle"];
+  if (url != nil) {
+    return [NSBundle bundleWithURL:url];
+  }
+  NSString *mainPath = [[NSBundle mainBundle] pathForResource:@"RCTI18nStrings" ofType:@"bundle"];
+  return mainPath != nil ? [NSBundle bundleWithPath:mainPath] : nil;
+}
+
 extern "C" {
 
 static NSString *FBTStringByConvertingIntegerToBase64(uint64_t number)
@@ -33,8 +56,7 @@
 
 NSString *RCTLocalizedStringFromKey(uint64_t key, NSString *defaultValue)
 {
-  static NSBundle *bundle = [NSBundle bundleWithPath:[[NSBundle mainBundle] pathForResource:@"RCTI18nStrings"
-                                                                                     ofType:@"bundle"]];
+  static NSBundle *bundle = RCTI18nStringsBundle();
   if (bundle == nil) {
     return defaultValue;
   } else {

packages/react-native/scripts/cocoapods/rncore_facades.rb

@@ -103,18 +103,18 @@ def self.facade?(name)
     # call once per `pod install`.
     #
     # `react_native_path` locates the real podspecs we mirror. version + subspecs +
-    # default_subspecs + resources are all DERIVED from the real spec so the facade
-    # stays graph- and resource-equivalent to the source pod. A facaded pod whose
-    # real podspec can't be read is a hard error (see load_real_spec) — silently
-    # shipping an empty facade would hide exactly the drift this guards against.
+    # default_subspecs are DERIVED from the real spec so the facade stays
+    # graph-equivalent to the source pod (resources are NOT carried — they live in
+    # the prebuilt artifact; see the note in the loop). A facaded pod whose real
+    # podspec can't be read is a hard error (see load_real_spec) — silently shipping
+    # an empty facade would hide exactly the drift this guards against.
     def self.generate(react_native_path, install_root, version, ios_version)
         @@install_root = install_root.to_s
         abs_base = File.join(@@install_root, FACADE_RELDIR)
         FileUtils.mkdir_p(abs_base)
         FACADE_PODS.each do |name, podspec_rel_path|
             podspec_path = File.join(react_native_path.to_s, podspec_rel_path)
             real = load_real_spec(podspec_path, name)
-            podspec_dir = File.dirname(podspec_path)
             dir = File.join(abs_base, name)
             FileUtils.mkdir_p(dir)
 
@@ -133,17 +133,11 @@ def self.generate(react_native_path, install_root, version, ios_version)
                 "dependencies" => { "React-Core-prebuilt" => [] },
             }
 
-            # Preserve non-code RESOURCES (privacy manifest, i18n bundles, ...). They
-            # don't shadow headers, and React-Core-prebuilt doesn't vend them, so the
-            # facade must carry them or prebuilt installs lose them. The matched
-            # files are COPIED into the facade dir (like the re-exposed headers):
-            # CocoaPods file accessors only match globs against files under the pod
-            # root, so a `..`-escaping glob back into the source tree would silently
-            # match nothing and the bundles would ship empty.
-            resource_bundles = derive_resource_bundles(real, podspec_dir, dir)
-            spec["resource_bundles"] = resource_bundles unless resource_bundles.empty?
-            resources = derive_resources(real, podspec_dir, dir)
-            spec["resources"] = resources unless resources.empty?
+            # NOTE: the facade carries NO resources. The pods' non-code resources
+            # (e.g. the privacy manifest) are embedded directly in the prebuilt
+            # React.xcframework by the ios-prebuild compose (see ios-prebuild/privacy.js),
+            # so they reach both CocoaPods-prebuilt and SwiftPM from the artifact —
+            # the facade only needs to declare the React-Core-prebuilt dependency.
 
             # Re-vend the narrow set of angle-only framework headers that community
             # modules quote-import (see FACADE_REEXPOSED_HEADERS). The header is
@@ -190,8 +184,8 @@ def self.facade_path(name)
 
     # Loads the real podspec so we can mirror its structure. A facaded pod MUST have
     # a readable real podspec — if it's missing or unparseable we raise rather than
-    # ship an empty facade, since that would silently drop subspecs/resources (the
-    # very drift this mechanism exists to prevent).
+    # ship an empty facade, since that would silently drop subspecs (the very drift
+    # this mechanism exists to prevent).
     def self.load_real_spec(path, name)
         unless File.exist?(path)
             raise "[RNCoreFacades] Real podspec for facaded pod '#{name}' not found at #{path}. " \
@@ -212,22 +206,6 @@ def self.derive_subspecs(real)
     end
     private_class_method :derive_subspecs
 
-    # Effective resource_bundles of the real spec (e.g. React-Core_privacy),
-    # copied into the facade dir under resources/<bundle>/. Unions the
-    # `resource_bundle` (singular) and `resource_bundles` (plural) DSL forms.
-    def self.derive_resource_bundles(real, podspec_dir, facade_dir)
-        out = {}
-        [real.attributes_hash["resource_bundle"], real.attributes_hash["resource_bundles"]].each do |rb|
-            next unless rb.is_a?(Hash)
-            rb.each do |bundle, globs|
-                copied = copy_resources(Array(globs), podspec_dir, facade_dir, File.join("resources", bundle))
-                out[bundle] = copied unless copied.empty?
-            end
-        end
-        out
-    end
-    private_class_method :derive_resource_bundles
-
     # Copy the re-exposed header(s) into the facade dir (flat) and return the
     # facade-relative source_files entries. `globs` are resolved against the real
     # podspec dir. A glob that matches nothing is a hard error: the whole point is
@@ -250,33 +228,4 @@ def self.copy_reexposed_headers(globs, podspec_dir, facade_dir, name)
         copied.uniq
     end
     private_class_method :copy_reexposed_headers
-
-    # Loose `resources` of the real spec, copied into the facade dir.
-    def self.derive_resources(real, podspec_dir, facade_dir)
-        copy_resources(Array(real.attributes_hash["resources"]), podspec_dir, facade_dir, "resources")
-    end
-    private_class_method :derive_resources
-
-    # Copies everything the resource globs match (files or whole directories,
-    # e.g. *.lproj bundles) into `<facade_dir>/<subdir>/` and returns
-    # facade-relative paths for the copies. Globs resolve against the real
-    # podspec dir. A glob that matches nothing is tolerated — the source pod
-    # would ship nothing for it either, so the facade stays equivalent.
-    # rm_rf-before-cp_r keeps the snapshot fresh across repeated `pod install`s.
-    def self.copy_resources(globs, podspec_dir, facade_dir, subdir)
-        copied = []
-        globs.each do |g|
-            matches = Dir.glob(File.expand_path(g, podspec_dir))
-            next if matches.empty?
-            dest_dir = File.join(facade_dir, subdir)
-            FileUtils.mkdir_p(dest_dir)
-            matches.each do |src|
-                FileUtils.rm_rf(File.join(dest_dir, File.basename(src)))
-                FileUtils.cp_r(src, dest_dir)
-                copied << File.join(subdir, File.basename(src))
-            end
-        end
-        copied.uniq
-    end
-    private_class_method :copy_resources
 end

packages/react-native/scripts/ios-prebuild/__tests__/framework-resources-test.js

@@ -0,0 +1,215 @@
+/**
+ * Copyright (c) Meta Platforms, Inc. and affiliates.
+ *
+ * This source code is licensed under the MIT license found in the
+ * LICENSE file in the root directory of this source tree.
+ *
+ * @format
+ * @noflow
+ */
+
+'use strict';
+
+const {
+  buildI18nStringsBundle,
+  buildReactPrivacyManifest,
+  collectLprojDirs,
+  collectReactPrivacyManifestPaths,
+  i18nBundleInfoPlist,
+  mergePrivacyManifests,
+} = require('../framework-resources');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+
+// react-native package root (…/scripts/ios-prebuild/__tests__ -> …)
+const RN_PATH = path.resolve(__dirname, '..', '..', '..');
+
+// Apple privacy manifest fixtures mirroring the real ones shipped by the pods
+// baked into React.framework.
+const reactCore = {
+  NSPrivacyAccessedAPITypes: [
+    {
+      NSPrivacyAccessedAPIType: 'NSPrivacyAccessedAPICategoryFileTimestamp',
+      NSPrivacyAccessedAPITypeReasons: ['C617.1'],
+    },
+    {
+      NSPrivacyAccessedAPIType: 'NSPrivacyAccessedAPICategoryUserDefaults',
+      NSPrivacyAccessedAPITypeReasons: ['CA92.1'],
+    },
+  ],
+  NSPrivacyCollectedDataTypes: [],
+  NSPrivacyTracking: false,
+};
+
+const cxxreact = {
+  NSPrivacyAccessedAPITypes: [
+    {
+      NSPrivacyAccessedAPIType: 'NSPrivacyAccessedAPICategoryFileTimestamp',
+      NSPrivacyAccessedAPITypeReasons: ['C617.1'],
+    },
+  ],
+  NSPrivacyCollectedDataTypes: [],
+  NSPrivacyTracking: false,
+};
+
+describe('mergePrivacyManifests', () => {
+  it('returns a valid empty manifest for no inputs', () => {
+    expect(mergePrivacyManifests([])).toEqual({
+      NSPrivacyAccessedAPITypes: [],
+      NSPrivacyCollectedDataTypes: [],
+      NSPrivacyTracking: false,
+    });
+  });
+
+  it('passes a single manifest through unchanged (by value)', () => {
+    expect(mergePrivacyManifests([reactCore])).toEqual(reactCore);
+  });
+
+  it('unions accessed-API categories, deduping reasons per category', () => {
+    const merged = mergePrivacyManifests([reactCore, cxxreact]);
+    const byType = Object.fromEntries(
+      merged.NSPrivacyAccessedAPITypes.map(e => [
+        e.NSPrivacyAccessedAPIType,
+        e.NSPrivacyAccessedAPITypeReasons,
+      ]),
+    );
+    // FileTimestamp appears in both -> single entry, reason deduped.
+    expect(merged.NSPrivacyAccessedAPITypes).toHaveLength(2);
+    expect(byType.NSPrivacyAccessedAPICategoryFileTimestamp).toEqual([
+      'C617.1',
+    ]);
+    expect(byType.NSPrivacyAccessedAPICategoryUserDefaults).toEqual(['CA92.1']);
+  });
+
+  it('unions reasons across manifests for the same category', () => {
+    const a = {
+      NSPrivacyAccessedAPITypes: [
+        {
+          NSPrivacyAccessedAPIType: 'NSPrivacyAccessedAPICategoryUserDefaults',
+          NSPrivacyAccessedAPITypeReasons: ['CA92.1'],
+        },
+      ],
+    };
+    const b = {
+      NSPrivacyAccessedAPITypes: [
+        {
+          NSPrivacyAccessedAPIType: 'NSPrivacyAccessedAPICategoryUserDefaults',
+          NSPrivacyAccessedAPITypeReasons: ['1C8F.1'],
+        },
+      ],
+    };
+    const merged = mergePrivacyManifests([a, b]);
+    expect(merged.NSPrivacyAccessedAPITypes).toHaveLength(1);
+    expect(
+      merged.NSPrivacyAccessedAPITypes[0].NSPrivacyAccessedAPITypeReasons.sort(),
+    ).toEqual(['1C8F.1', 'CA92.1']);
+  });
+
+  it('ORs NSPrivacyTracking and unions tracking domains', () => {
+    const a = {NSPrivacyTracking: false, NSPrivacyTrackingDomains: ['a.com']};
+    const b = {
+      NSPrivacyTracking: true,
+      NSPrivacyTrackingDomains: ['a.com', 'b.com'],
+    };
+    const merged = mergePrivacyManifests([a, b]);
+    expect(merged.NSPrivacyTracking).toBe(true);
+    expect(merged.NSPrivacyTrackingDomains.sort()).toEqual(['a.com', 'b.com']);
+  });
+
+  it('unions collected data types, deduping structurally-equal entries', () => {
+    const entry = {
+      NSPrivacyCollectedDataType: 'NSPrivacyCollectedDataTypeCrashData',
+      NSPrivacyCollectedDataTypeLinked: false,
+    };
+    const merged = mergePrivacyManifests([
+      {NSPrivacyCollectedDataTypes: [entry]},
+      {NSPrivacyCollectedDataTypes: [{...entry}]},
+    ]);
+    expect(merged.NSPrivacyCollectedDataTypes).toHaveLength(1);
+  });
+});
+
+describe('buildReactPrivacyManifest (against the real source tree)', () => {
+  it('discovers React-core PrivacyInfo.xcprivacy files (not third-party deps)', () => {
+    const paths = collectReactPrivacyManifestPaths(RN_PATH);
+    expect(paths.length).toBeGreaterThan(0);
+    // third-party-podspecs manifests belong to ReactNativeDependencies, not React.framework
+    expect(paths.some(p => p.includes('third-party-podspecs'))).toBe(false);
+    // React-Core's manifest is the canonical one that must be present
+    expect(
+      paths.some(p => p.endsWith('React/Resources/PrivacyInfo.xcprivacy')),
+    ).toBe(true);
+  });
+
+  it('merges them into one manifest covering the known React-core API usages', () => {
+    const merged = buildReactPrivacyManifest(RN_PATH);
+    expect(merged).not.toBeNull();
+    const categories = (merged?.NSPrivacyAccessedAPITypes ?? []).map(
+      e => e.NSPrivacyAccessedAPIType,
+    );
+    // FileTimestamp + UserDefaults are declared by React-Core; both must survive the merge.
+    expect(categories).toContain('NSPrivacyAccessedAPICategoryFileTimestamp');
+    expect(categories).toContain('NSPrivacyAccessedAPICategoryUserDefaults');
+    // No category should be duplicated after merging.
+    expect(new Set(categories).size).toBe(categories.length);
+  });
+});
+
+describe('i18nBundleInfoPlist', () => {
+  it('is a valid resource-bundle Info.plist dict', () => {
+    const info = i18nBundleInfoPlist();
+    expect(info.CFBundlePackageType).toBe('BNDL');
+    expect(info.CFBundleName).toBe('RCTI18nStrings');
+    expect(typeof info.CFBundleIdentifier).toBe('string');
+    expect(info.CFBundleIdentifier.length).toBeGreaterThan(0);
+    expect(typeof info.CFBundleDevelopmentRegion).toBe('string');
+  });
+});
+
+describe('collectLprojDirs (against the real source tree)', () => {
+  it('finds the React i18n .lproj locale dirs', () => {
+    const dirs = collectLprojDirs(RN_PATH);
+    expect(dirs.length).toBeGreaterThan(0);
+    expect(dirs.every(d => d.endsWith('.lproj'))).toBe(true);
+    // English is the canonical base locale and must be present.
+    expect(dirs.some(d => path.basename(d) === 'en.lproj')).toBe(true);
+  });
+});
+
+describe('buildI18nStringsBundle', () => {
+  let tmp;
+
+  beforeEach(() => {
+    tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'i18n-bundle-'));
+  });
+
+  afterEach(() => {
+    fs.rmSync(tmp, {recursive: true, force: true});
+  });
+
+  it('builds RCTI18nStrings.bundle with the .lproj dirs and an Info.plist', () => {
+    const out = path.join(tmp, 'RCTI18nStrings.bundle');
+    const count = buildI18nStringsBundle(RN_PATH, out);
+
+    expect(count).toBeGreaterThan(0);
+    expect(fs.existsSync(path.join(out, 'Info.plist'))).toBe(true);
+    expect(fs.existsSync(path.join(out, 'en.lproj'))).toBe(true);
+    // the copied locale carries its actual strings file(s)
+    expect(fs.readdirSync(path.join(out, 'en.lproj')).length).toBeGreaterThan(
+      0,
+    );
+    // count matches the number of .lproj dirs copied
+    const copied = fs.readdirSync(out).filter(e => e.endsWith('.lproj'));
+    expect(copied.length).toBe(count);
+  });
+
+  it('returns 0 and writes nothing when there are no .lproj dirs', () => {
+    const emptyRn = fs.mkdtempSync(path.join(os.tmpdir(), 'empty-rn-'));
+    const out = path.join(tmp, 'RCTI18nStrings.bundle');
+    const count = buildI18nStringsBundle(emptyRn, out);
+    expect(count).toBe(0);
+    expect(fs.existsSync(out)).toBe(false);
+    fs.rmSync(emptyRn, {recursive: true, force: true});
+  });
+});