fix(ios-prebuild): address review on prebuilt framework resources

Review feedback on embedding React.framework's non-header resources:

- Privacy-manifest merge no longer fabricates an empty NSPrivacyAccessedAPITypeReasons
  key when a source omitted it (tracks per-category key presence), so a single
  manifest truly passes through unchanged.
- NSPrivacyCollectedDataTypes dedup canonicalizes (recursively sorts) keys before
  hashing, so two pods declaring the same dict in different key order dedup.
- RCTI18nStrings.bundle is now built ONCE into a temp stage and cloned into each
  slice (mirrors the privacy manifest) instead of rebuilt inside the slice loop;
  i18nLocales is computed once.
- i18n bundle Info.plist gains CFBundleShortVersionString / CFBundleVersion so
  Apple validation tooling doesn't warn on a version-less bundle.
- Fixed stale "see" pointers ios-prebuild/{i18n,privacy}.js -> framework-resources.js
  (React-Core.podspec + rncore_facades.rb).
- Tests: serialize->readPrivacyManifest round-trip, order-insensitive collected-type
  dedup, omitted-reasons-key regression, CFBundleVersion presence, and an
  emitReactFrameworkHeaders integration test asserting PrivacyInfo.xcprivacy +
  RCTI18nStrings.bundle land in EVERY slice.

Note: resources are written after _CodeSignature is stripped (R7 — signed after
compose), so no signature invalidation; readdirSync({recursive})/cpSync are safe on
the repo's Node >=22 engine.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: chrfalch

packages/react-native/React-Core.podspec

@@ -125,7 +125,7 @@ Pod::Spec.new do |s|
   # (not merge) the first. RCTI18nStrings holds React-Core's localized strings
   # (loaded by RCTLocalizedString); React-Core_privacy is the privacy manifest.
   # (Prebuilt/SwiftPM get both from inside React.xcframework instead — see
-  # scripts/ios-prebuild/{i18n,privacy}.js — but source builds ship them here.)
+  # scripts/ios-prebuild/framework-resources.js — but source builds ship them here.)
   s.resource_bundles = {
     'RCTI18nStrings' => ['React/I18n/strings/*.lproj'],
     'React-Core_privacy' => 'React/Resources/PrivacyInfo.xcprivacy',

packages/react-native/scripts/cocoapods/rncore_facades.rb

@@ -136,7 +136,7 @@ def self.generate(react_native_path, install_root, version, ios_version)
 
             # NOTE: the facade carries NO resources. The pods' non-code resources
             # (e.g. the privacy manifest) are embedded directly in the prebuilt
-            # React.xcframework by the ios-prebuild compose (see ios-prebuild/privacy.js),
+            # React.xcframework by the ios-prebuild compose (see ios-prebuild/framework-resources.js),
             # so they reach both CocoaPods-prebuilt and SwiftPM from the artifact —
             # the facade only needs to declare the React-Core-prebuilt dependency.
 

packages/react-native/scripts/ios-prebuild/__tests__/framework-resources-test.js

@@ -17,7 +17,10 @@ const {
   collectReactPrivacyManifestPaths,
   i18nBundleInfoPlist,
   mergePrivacyManifests,
+  readPrivacyManifest,
+  serializePrivacyManifest,
 } = require('../framework-resources');
+const {emitReactFrameworkHeaders} = require('../headers-compose');
 const fs = require('fs');
 const os = require('os');
 const path = require('path');
@@ -128,6 +131,57 @@ describe('mergePrivacyManifests', () => {
     ]);
     expect(merged.NSPrivacyCollectedDataTypes).toHaveLength(1);
   });
+
+  it('dedups collected data types regardless of source key order', () => {
+    // Same dict, different key order (order comes from each plist) must dedup.
+    const merged = mergePrivacyManifests([
+      {
+        NSPrivacyCollectedDataTypes: [
+          {
+            NSPrivacyCollectedDataType: 'NSPrivacyCollectedDataTypeCrashData',
+            NSPrivacyCollectedDataTypeLinked: false,
+          },
+        ],
+      },
+      {
+        NSPrivacyCollectedDataTypes: [
+          {
+            NSPrivacyCollectedDataTypeLinked: false,
+            NSPrivacyCollectedDataType: 'NSPrivacyCollectedDataTypeCrashData',
+          },
+        ],
+      },
+    ]);
+    expect(merged.NSPrivacyCollectedDataTypes).toHaveLength(1);
+  });
+
+  it('does not fabricate a reasons key when the source omitted it', () => {
+    const merged = mergePrivacyManifests([
+      {
+        NSPrivacyAccessedAPITypes: [
+          {NSPrivacyAccessedAPIType: 'NSPrivacyAccessedAPICategoryOther'},
+        ],
+      },
+    ]);
+    const entry = merged.NSPrivacyAccessedAPITypes[0];
+    expect(entry.NSPrivacyAccessedAPIType).toBe(
+      'NSPrivacyAccessedAPICategoryOther',
+    );
+    expect('NSPrivacyAccessedAPITypeReasons' in entry).toBe(false);
+  });
+});
+
+describe('serialize/read privacy-manifest round-trip', () => {
+  it('serialize -> readPrivacyManifest yields the same object (guards the plist.build byte shape)', () => {
+    const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'privacy-rt-'));
+    const file = path.join(tmp, 'PrivacyInfo.xcprivacy');
+    try {
+      fs.writeFileSync(file, serializePrivacyManifest(reactCore));
+      expect(readPrivacyManifest(file)).toEqual(reactCore);
+    } finally {
+      fs.rmSync(tmp, {recursive: true, force: true});
+    }
+  });
 });
 
 describe('buildReactPrivacyManifest (against the real source tree)', () => {
@@ -164,6 +218,9 @@ describe('i18nBundleInfoPlist', () => {
     expect(typeof info.CFBundleIdentifier).toBe('string');
     expect(info.CFBundleIdentifier.length).toBeGreaterThan(0);
     expect(typeof info.CFBundleDevelopmentRegion).toBe('string');
+    // Versioned so Apple validation tooling doesn't warn on a version-less bundle.
+    expect(info.CFBundleShortVersionString).toBeDefined();
+    expect(info.CFBundleVersion).toBeDefined();
   });
 });
 
@@ -213,3 +270,65 @@ describe('buildI18nStringsBundle', () => {
     fs.rmSync(emptyRn, {recursive: true, force: true});
   });
 });
+
+describe('emitReactFrameworkHeaders resource landing (integration)', () => {
+  let tmp;
+  let rnRoot;
+  let xcfw;
+
+  beforeEach(() => {
+    tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'emit-res-'));
+
+    // Minimal fake source tree: one privacy manifest + one locale.
+    rnRoot = path.join(tmp, 'rn');
+    const privacyDir = path.join(rnRoot, 'React', 'Resources');
+    fs.mkdirSync(privacyDir, {recursive: true});
+    fs.writeFileSync(
+      path.join(privacyDir, 'PrivacyInfo.xcprivacy'),
+      serializePrivacyManifest(reactCore),
+    );
+    const lproj = path.join(rnRoot, 'React', 'I18n', 'strings', 'en.lproj');
+    fs.mkdirSync(lproj, {recursive: true});
+    fs.writeFileSync(
+      path.join(lproj, 'Localizable.strings'),
+      '"key" = "value";\n',
+    );
+
+    // Two-slice xcframework, each carrying an empty React.framework.
+    xcfw = path.join(tmp, 'React.xcframework');
+    for (const slice of ['ios-arm64', 'ios-arm64_x86_64-simulator']) {
+      fs.mkdirSync(path.join(xcfw, slice, 'React.framework'), {
+        recursive: true,
+      });
+    }
+  });
+
+  afterEach(() => {
+    fs.rmSync(tmp, {recursive: true, force: true});
+  });
+
+  it('lands PrivacyInfo.xcprivacy and RCTI18nStrings.bundle into EVERY slice', () => {
+    // Empty header plan — this test targets the non-header resources only.
+    emitReactFrameworkHeaders(
+      xcfw,
+      {
+        react: [],
+        umbrella: [],
+        privateReactHeaders: {modular: [], textual: []},
+      },
+      rnRoot,
+    );
+
+    for (const slice of ['ios-arm64', 'ios-arm64_x86_64-simulator']) {
+      const fwk = path.join(xcfw, slice, 'React.framework');
+      expect(fs.existsSync(path.join(fwk, 'PrivacyInfo.xcprivacy'))).toBe(true);
+      const bundle = path.join(fwk, 'RCTI18nStrings.bundle');
+      expect(fs.existsSync(path.join(bundle, 'Info.plist'))).toBe(true);
+      expect(fs.existsSync(path.join(bundle, 'en.lproj'))).toBe(true);
+      // The composed module map is present too (proves the slice was rewritten).
+      expect(fs.existsSync(path.join(fwk, 'Modules', 'module.modulemap'))).toBe(
+        true,
+      );
+    }
+  });
+});

packages/react-native/scripts/ios-prebuild/framework-resources.js

@@ -55,6 +55,22 @@ type PrivacyManifest = {
 // Privacy manifest
 // ---------------------------------------------------------------------------
 
+// Recursively sorts object keys so structurally-equal values serialize
+// identically regardless of source key order (arrays keep their order).
+function canonicalize(value /*: mixed */) /*: mixed */ {
+  if (Array.isArray(value)) {
+    return value.map(canonicalize);
+  }
+  if (value != null && typeof value === 'object') {
+    const out /*: {[string]: mixed} */ = {};
+    for (const k of Object.keys(value).sort()) {
+      out[k] = canonicalize(value[k]);
+    }
+    return out;
+  }
+  return value;
+}
+
 /**
  * Merges Apple privacy manifests into one. Pure; operates on parsed plist
  * objects. Semantics:
@@ -67,6 +83,10 @@ function mergePrivacyManifests(
   manifests /*: Array<?PrivacyManifest> */,
 ) /*: PrivacyManifest */ {
   const reasonsByType /*: Map<string, Array<string>> */ = new Map();
+  // Categories where at least one source actually declared the reasons key, so
+  // a source that omitted it doesn't get a fabricated empty-array key on the way
+  // out (keeps "a single manifest passes through unchanged" honest).
+  const typeHadReasonsKey /*: Set<string> */ = new Set();
   const typeOrder /*: Array<string> */ = [];
   const trackingDomains /*: Set<string> */ = new Set();
   const collected /*: Array<unknown> */ = [];
@@ -83,11 +103,14 @@ function mergePrivacyManifests(
         reasonsByType.set(category, []);
         typeOrder.push(category);
       }
-      const reasons = reasonsByType.get(category);
-      if (reasons != null) {
-        for (const reason of entry.NSPrivacyAccessedAPITypeReasons ?? []) {
-          if (!reasons.includes(reason)) {
-            reasons.push(reason);
+      if (entry.NSPrivacyAccessedAPITypeReasons != null) {
+        typeHadReasonsKey.add(category);
+        const reasons = reasonsByType.get(category);
+        if (reasons != null) {
+          for (const reason of entry.NSPrivacyAccessedAPITypeReasons) {
+            if (!reasons.includes(reason)) {
+              reasons.push(reason);
+            }
           }
         }
       }
@@ -96,7 +119,9 @@ function mergePrivacyManifests(
       trackingDomains.add(domain);
     }
     for (const dataType of manifest.NSPrivacyCollectedDataTypes ?? []) {
-      const key = JSON.stringify(dataType) ?? '';
+      // Canonicalize (sort object keys recursively) before keying so two pods
+      // declaring the same data-type dict in different key order still dedup.
+      const key = JSON.stringify(canonicalize(dataType)) ?? '';
       if (!collectedSeen.has(key)) {
         collectedSeen.add(key);
         collected.push(dataType);
@@ -108,10 +133,16 @@ function mergePrivacyManifests(
   }
 
   const merged /*: PrivacyManifest */ = {
-    NSPrivacyAccessedAPITypes: typeOrder.map(category => ({
-      NSPrivacyAccessedAPIType: category,
-      NSPrivacyAccessedAPITypeReasons: reasonsByType.get(category) ?? [],
-    })),
+    NSPrivacyAccessedAPITypes: typeOrder.map(category => {
+      const entry /*: AccessedAPIType */ = {
+        NSPrivacyAccessedAPIType: category,
+      };
+      if (typeHadReasonsKey.has(category)) {
+        entry.NSPrivacyAccessedAPITypeReasons =
+          reasonsByType.get(category) ?? [];
+      }
+      return entry;
+    }),
     NSPrivacyCollectedDataTypes: collected,
     NSPrivacyTracking: tracking,
   };
@@ -182,6 +213,9 @@ function i18nBundleInfoPlist() /*: {[string]: string} */ {
     CFBundleInfoDictionaryVersion: '6.0',
     CFBundleName: 'RCTI18nStrings',
     CFBundlePackageType: 'BNDL',
+    // Present so Apple validation tooling doesn't warn on a version-less bundle.
+    CFBundleShortVersionString: '1.0',
+    CFBundleVersion: '1',
   };
 }
 

packages/react-native/scripts/ios-prebuild/headers-compose.js

@@ -145,7 +145,15 @@ function emitReactFrameworkHeaders(
   // for both CocoaPods-prebuilt and SwiftPM (source builds get them from the
   // podspecs instead). Built once, embedded per slice.
   const privacyManifest = buildReactPrivacyManifest(rnRoot);
-  let i18nLocales = 0;
+
+  // Build RCTI18nStrings.bundle ONCE into a temp stage, then clone it into each
+  // slice below — mirrors the privacy manifest (computed once, embedded per
+  // slice) instead of rebuilding the bundle inside the slice loop.
+  const i18nStage = fs.mkdtempSync(
+    path.join(path.dirname(xcfwPath), '.i18n-stage-'),
+  );
+  const i18nBundleStage = path.join(i18nStage, 'RCTI18nStrings.bundle');
+  const i18nLocales = buildI18nStringsBundle(rnRoot, i18nBundleStage);
 
   for (const slice of slices) {
     const fwk = path.join(xcfwPath, slice, 'React.framework');
@@ -163,14 +171,16 @@ function emitReactFrameworkHeaders(
         serializePrivacyManifest(privacyManifest),
       );
     }
-    // Embed React-Core's localized strings as RCTI18nStrings.bundle so the
-    // framework-aware RCTLocalizedString loader resolves them in prebuilt/SPM.
-    i18nLocales = buildI18nStringsBundle(
-      rnRoot,
-      path.join(fwk, 'RCTI18nStrings.bundle'),
-    );
+    // Clone the prebuilt RCTI18nStrings.bundle so the framework-aware
+    // RCTLocalizedString loader resolves React-Core's strings in prebuilt/SPM.
+    if (i18nLocales > 0) {
+      const dest = path.join(fwk, 'RCTI18nStrings.bundle');
+      fs.rmSync(dest, {recursive: true, force: true});
+      execFileSync('/bin/cp', ['-Rc', i18nBundleStage, dest]);
+    }
   }
   fs.rmSync(stage, {recursive: true, force: true});
+  fs.rmSync(i18nStage, {recursive: true, force: true});
   console.log(
     `headers-compose: React.framework spec layout -> ${slices.join(', ')} ` +
       `(${plan.react.length} headers, umbrella ${plan.umbrella.length}` +