refactor(iOS): include resources like bundles into the precompiled XCFrameworks (#57305)

Summary:
**Depends on #57285

In source builds, `React-Core` ships non-header resources — its privacy manifest (`PrivacyInfo.xcprivacy`) and its localized strings (RCTI18nStrings) — via the podspec's resource_bundles. In the prebuilt path those source pods aren't installed (CocoaPods facades) or aren't present at all (SwiftPM), so these resources were silently dropped: prebuilt/SwiftPM apps shipped no React Native privacy manifest, and localized strings were unavailable.

This embeds them in React.framework at prebuild time so they ship uniformly across CocoaPods-prebuilt and SwiftPM, with source builds unchanged:

- **Privacy manifest** — the PrivacyInfo.xcprivacy of the pods baked into React.framework are merged into one manifest at the framework root. React.framework is a dynamic framework, so Xcode's privacy-report aggregation picks it up automatically (no runtime involvement).
- **RCTI18nStrings** — rebuilt as RCTI18nStrings.bundle inside React.framework. RCTLocalizedString.mm now resolves the bundle from its own framework first (bundleForClass:), falling back to the app's main bundle for static source builds.

It also fixes a latent bug in `React-Core.podspec`: a later resource_bundles = was overwriting the earlier resource_bundle =, so source builds had stopped shipping RCTI18nStrings. Both bundles are now declared together. With the artifact owning these resources, the prebuilt RNCore facade no longer carries them.

## Changelog:

[IOS][FIXED] - Ship React-Core's privacy manifest and localized strings (RCTI18nStrings) inside the prebuilt React.xcframework, so CocoaPods-prebuilt and SwiftPM apps include them

Pull Request resolved: #57305

Test Plan:
- ✅ yarn jest packages/react-native/scripts/ios-prebuild — unit + integration tests for the merge/discovery/bundle-build logic (red/green).
- ✅ Built React.xcframework from this branch and confirmed each slice's React.framework carries the merged PrivacyInfo.xcprivacy and RCTI18nStrings.bundle (37 locales).
- ✅ Cold-built rn-tester in prebuilt mode and verified the app bundle contains Frameworks/React.framework/{PrivacyInfo.xcprivacy, RCTI18nStrings.bundle}.
- ✅ Confirmed React-Core.podspec now reports both resource bundles (RCTI18nStrings, React-Core_privacy) for source builds.

Reviewed By: fabriziocucci

Differential Revision: D111448862

Pulled By: cipolleschi

fbshipit-source-id: a95360f51cc1131510ef03f7e48c689575d1c22d

Author: chrfalch

packages/react-native/React-Core.podspec

@@ -51,7 +51,6 @@ Pod::Spec.new do |s|
   s.author                 = "Meta Platforms, Inc. and its affiliates"
   s.platforms              = min_supported_versions
   s.source                 = source
-  s.resource_bundle        = { "RCTI18nStrings" => ["React/I18n/strings/*.lproj"]}
   s.compiler_flags         = js_engine_flags()
   s.header_dir             = "React"
   s.weak_framework         = "JavaScriptCore"
@@ -122,7 +121,15 @@ Pod::Spec.new do |s|
     s.dependency "React-hermes"
   end
 
-  s.resource_bundles = {'React-Core_privacy' => 'React/Resources/PrivacyInfo.xcprivacy'}
+  # Both bundles in one declaration: a second `resource_bundle(s) =` would replace
+  # (not merge) the first. RCTI18nStrings holds React-Core's localized strings
+  # (loaded by RCTLocalizedString); React-Core_privacy is the privacy manifest.
+  # (Prebuilt/SwiftPM get both from inside React.xcframework instead — see
+  # scripts/ios-prebuild/framework-resources.js — but source builds ship them here.)
+  s.resource_bundles = {
+    'RCTI18nStrings' => ['React/I18n/strings/*.lproj'],
+    'React-Core_privacy' => 'React/Resources/PrivacyInfo.xcprivacy',
+  }
 
   add_dependency(s, "React-runtimeexecutor", :additional_framework_paths => ["platform/ios"])
   add_dependency(s, "React-jsinspector", :framework_name => 'jsinspector_modern')

packages/react-native/React/I18n/RCTLocalizedString.mm

@@ -7,8 +7,45 @@
 
 #import "RCTLocalizedString.h"
 
+#import <React/RCTLog.h>
+
 #if !defined(WITH_FBI18N) || !(WITH_FBI18N)
 
+// Anchors resource lookups to the bundle that contains this code: React.framework
+// when React Native is consumed prebuilt / via SwiftPM, or the app's main bundle
+// for static source builds.
+@interface RCTI18nStringsAnchor : NSObject
+@end
+@implementation RCTI18nStringsAnchor
+@end
+
+// Resolves RCTI18nStrings.bundle wherever it ships: the code's own bundle first
+// (prebuilt/SwiftPM embed it inside React.framework), then the app's main bundle
+// (source builds copy it there via the podspec resource_bundles). Returns nil
+// when absent, so the caller falls back to the untranslated default value.
+static NSBundle *RCTI18nStringsBundle(void)
+{
+  NSBundle *codeBundle = [NSBundle bundleForClass:[RCTI18nStringsAnchor class]];
+  NSURL *url = [codeBundle URLForResource:@"RCTI18nStrings" withExtension:@"bundle"];
+  if (url != nil) {
+    return [NSBundle bundleWithURL:url];
+  }
+  NSString *mainPath = [[NSBundle mainBundle] pathForResource:@"RCTI18nStrings" ofType:@"bundle"];
+  if (mainPath != nil) {
+    return [NSBundle bundleWithPath:mainPath];
+  }
+#if RCT_DEV
+  // Missing resources are otherwise silent (every lookup falls back to the
+  // untranslated default and the privacy manifest quietly drops out of the
+  // app's aggregated privacy report). Called once — the caller caches.
+  RCTLogWarn(
+      @"RCTI18nStrings.bundle not found in React.framework or the app bundle. Localized strings will use their "
+      @"untranslated defaults, and React's PrivacyInfo.xcprivacy may be missing from the app's privacy report. "
+      @"When consuming the prebuilt React.framework, verify it is embedded into the app with its resources intact.");
+#endif
+  return nil;
+}
+
 extern "C" {
 
 static NSString *FBTStringByConvertingIntegerToBase64(uint64_t number)
@@ -33,8 +70,7 @@
 
 NSString *RCTLocalizedStringFromKey(uint64_t key, NSString *defaultValue)
 {
-  static NSBundle *bundle = [NSBundle bundleWithPath:[[NSBundle mainBundle] pathForResource:@"RCTI18nStrings"
-                                                                                     ofType:@"bundle"]];
+  static NSBundle *bundle = RCTI18nStringsBundle();
   if (bundle == nil) {
     return defaultValue;
   } else {

packages/react-native/scripts/cocoapods/rncore_facades.rb

@@ -103,18 +103,19 @@ def self.facade?(name)
     # call once per `pod install`.
     #
     # `react_native_path` locates the real podspecs we mirror. version + subspecs +
-    # default_subspecs + resources are all DERIVED from the real spec so the facade
-    # stays graph- and resource-equivalent to the source pod. A facaded pod whose
-    # real podspec can't be read is a hard error (see load_real_spec) — silently
-    # shipping an empty facade would hide exactly the drift this guards against.
+    # default_subspecs are DERIVED from the real spec so the facade stays
+    # graph-equivalent to the source pod (resources are NOT carried — they live in
+    # the prebuilt artifact; see the note in the loop). A facaded pod whose real
+    # podspec can't be read is a hard error (see load_real_spec) — silently shipping
+    # an empty facade would hide exactly the drift this guards against.
     def self.generate(react_native_path, install_root, version, ios_version)
         @@install_root = install_root.to_s
         abs_base = File.join(@@install_root, FACADE_RELDIR)
         FileUtils.mkdir_p(abs_base)
         FACADE_PODS.each do |name, podspec_rel_path|
             podspec_path = File.join(react_native_path.to_s, podspec_rel_path)
-            real = load_real_spec(podspec_path, name)
             podspec_dir = File.dirname(podspec_path)
+            real = load_real_spec(podspec_path, name)
             dir = File.join(abs_base, name)
             FileUtils.mkdir_p(dir)
 
@@ -133,17 +134,11 @@ def self.generate(react_native_path, install_root, version, ios_version)
                 "dependencies" => { "React-Core-prebuilt" => [] },
             }
 
-            # Preserve non-code RESOURCES (privacy manifest, i18n bundles, ...). They
-            # don't shadow headers, and React-Core-prebuilt doesn't vend them, so the
-            # facade must carry them or prebuilt installs lose them. The matched
-            # files are COPIED into the facade dir (like the re-exposed headers):
-            # CocoaPods file accessors only match globs against files under the pod
-            # root, so a `..`-escaping glob back into the source tree would silently
-            # match nothing and the bundles would ship empty.
-            resource_bundles = derive_resource_bundles(real, podspec_dir, dir)
-            spec["resource_bundles"] = resource_bundles unless resource_bundles.empty?
-            resources = derive_resources(real, podspec_dir, dir)
-            spec["resources"] = resources unless resources.empty?
+            # NOTE: the facade carries NO resources. The pods' non-code resources
+            # (e.g. the privacy manifest) are embedded directly in the prebuilt
+            # React.xcframework by the ios-prebuild compose (see ios-prebuild/framework-resources.js),
+            # so they reach both CocoaPods-prebuilt and SwiftPM from the artifact —
+            # the facade only needs to declare the React-Core-prebuilt dependency.
 
             # Re-vend the narrow set of angle-only framework headers that community
             # modules quote-import (see FACADE_REEXPOSED_HEADERS). The header is
@@ -190,8 +185,8 @@ def self.facade_path(name)
 
     # Loads the real podspec so we can mirror its structure. A facaded pod MUST have
     # a readable real podspec — if it's missing or unparseable we raise rather than
-    # ship an empty facade, since that would silently drop subspecs/resources (the
-    # very drift this mechanism exists to prevent).
+    # ship an empty facade, since that would silently drop subspecs (the very drift
+    # this mechanism exists to prevent).
     def self.load_real_spec(path, name)
         unless File.exist?(path)
             raise "[RNCoreFacades] Real podspec for facaded pod '#{name}' not found at #{path}. " \
@@ -212,22 +207,6 @@ def self.derive_subspecs(real)
     end
     private_class_method :derive_subspecs
 
-    # Effective resource_bundles of the real spec (e.g. React-Core_privacy),
-    # copied into the facade dir under resources/<bundle>/. Unions the
-    # `resource_bundle` (singular) and `resource_bundles` (plural) DSL forms.
-    def self.derive_resource_bundles(real, podspec_dir, facade_dir)
-        out = {}
-        [real.attributes_hash["resource_bundle"], real.attributes_hash["resource_bundles"]].each do |rb|
-            next unless rb.is_a?(Hash)
-            rb.each do |bundle, globs|
-                copied = copy_resources(Array(globs), podspec_dir, facade_dir, File.join("resources", bundle))
-                out[bundle] = copied unless copied.empty?
-            end
-        end
-        out
-    end
-    private_class_method :derive_resource_bundles
-
     # Copy the re-exposed header(s) into the facade dir (flat) and return the
     # facade-relative source_files entries. `globs` are resolved against the real
     # podspec dir. A glob that matches nothing is a hard error: the whole point is
@@ -250,36 +229,4 @@ def self.copy_reexposed_headers(globs, podspec_dir, facade_dir, name)
         copied.uniq
     end
     private_class_method :copy_reexposed_headers
-
-    # Loose `resources` of the real spec, copied into the facade dir.
-    def self.derive_resources(real, podspec_dir, facade_dir)
-        copy_resources(Array(real.attributes_hash["resources"]), podspec_dir, facade_dir, "resources")
-    end
-    private_class_method :derive_resources
-
-    # Copies everything the resource globs match (files or whole directories,
-    # e.g. *.lproj bundles) into `<facade_dir>/<subdir>/` and returns
-    # facade-relative paths for the copies. Globs resolve against the real
-    # podspec dir. A glob that matches nothing is a hard error: the real spec
-    # declared a resource, so silently dropping it would make the facade drift.
-    # rm_rf-before-cp_r keeps the snapshot fresh across repeated `pod install`s.
-    def self.copy_resources(globs, podspec_dir, facade_dir, subdir)
-        copied = []
-        globs.each do |g|
-            matches = Dir.glob(File.expand_path(g, podspec_dir))
-            if matches.empty?
-                raise "[RNCoreFacades] Resource glob '#{g}' matched no files under #{podspec_dir}. " \
-                      "Update the facade resource derivation if the podspec layout changed."
-            end
-            dest_dir = File.join(facade_dir, subdir)
-            FileUtils.mkdir_p(dest_dir)
-            matches.each do |src|
-                FileUtils.rm_rf(File.join(dest_dir, File.basename(src)))
-                FileUtils.cp_r(src, dest_dir)
-                copied << File.join(subdir, File.basename(src))
-            end
-        end
-        copied.uniq
-    end
-    private_class_method :copy_resources
 end