@capgo/capacitor-ssl-pinning 8.0.0

package/ios/Sources/SSLPinningPlugin/SSLPinningSupport.swift

@@ -0,0 +1,314 @@
+import Capacitor
+import Foundation
+import Security
+
+struct SSLPinningConfiguration {
+    let certs: [String]
+    let excludedDomains: [String]
+
+    static let empty = SSLPinningConfiguration(certs: [], excludedDomains: [])
+
+    var configured: Bool {
+        !certs.isEmpty
+    }
+
+    var asJSObject: [String: Any] {
+        [
+            "configured": configured,
+            "certs": certs,
+            "excludedDomains": excludedDomains
+        ]
+    }
+
+    static func from(_ pluginConfig: PluginConfig) -> SSLPinningConfiguration {
+        let certs = (pluginConfig.getArray("certs") as? [String]) ?? []
+        let excludedDomains = (pluginConfig.getArray("excludedDomains") as? [String]) ?? []
+        return SSLPinningConfiguration(certs: certs, excludedDomains: excludedDomains)
+    }
+}
+
+enum SSLPinningMatcher {
+    static func isExcluded(url: URL, excludedDomains: [String]) -> Bool {
+        for rawValue in excludedDomains where !rawValue.trimmingCharacters(in: .whitespacesAndNewlines).isEmpty {
+            guard let excludedURL = URL(string: rawValue) else {
+                if url.absoluteString.hasPrefix(rawValue) {
+                    return true
+                }
+                continue
+            }
+
+            guard excludedURL.scheme?.caseInsensitiveCompare(url.scheme ?? "") == .orderedSame else {
+                continue
+            }
+            guard excludedURL.host?.caseInsensitiveCompare(url.host ?? "") == .orderedSame else {
+                continue
+            }
+
+            let excludedPort = excludedURL.port ?? excludedURL.defaultPort
+            let requestPort = url.port ?? url.defaultPort
+            guard excludedPort == requestPort else {
+                continue
+            }
+
+            let excludedPath = excludedURL.path
+            if excludedPath.isEmpty || excludedPath == "/" {
+                return true
+            }
+
+            if url.path.hasPrefix(excludedPath) {
+                return true
+            }
+        }
+
+        return false
+    }
+}
+
+final class SSLPinningCertificateStore {
+    static let shared = SSLPinningCertificateStore()
+
+    private var cachedPaths: [String] = []
+    private var cachedCertificates: [SecCertificate] = []
+
+    private init() {}
+
+    func certificates(for configuredPaths: [String]) throws -> [SecCertificate] {
+        if configuredPaths == cachedPaths {
+            return cachedCertificates
+        }
+
+        let loadedCertificates = try configuredPaths.map(loadCertificate)
+        cachedPaths = configuredPaths
+        cachedCertificates = loadedCertificates
+        return loadedCertificates
+    }
+
+    private func loadCertificate(from configuredPath: String) throws -> SecCertificate {
+        let fileName = URL(fileURLWithPath: configuredPath).lastPathComponent
+        guard let resourceURL = Bundle.main.resourceURL?.appendingPathComponent("public/certs/\(fileName)"),
+              let certificateData = try? Data(contentsOf: resourceURL),
+              let certificate = SecCertificateCreateWithData(nil, certificateData as CFData)
+        else {
+            throw NSError(
+                domain: "SSLPinning",
+                code: -1,
+                userInfo: [NSLocalizedDescriptionKey: "Missing bundled certificate \(fileName)"]
+            )
+        }
+
+        return certificate
+    }
+}
+
+enum SSLPinningTrustEvaluator {
+    static func evaluate(
+        challenge: URLAuthenticationChallenge,
+        configuration: SSLPinningConfiguration
+    ) -> (URLSession.AuthChallengeDisposition, URLCredential?) {
+        guard challenge.protectionSpace.authenticationMethod == NSURLAuthenticationMethodServerTrust,
+              let trust = challenge.protectionSpace.serverTrust
+        else {
+            return (.performDefaultHandling, nil)
+        }
+
+        if let url = url(from: challenge.protectionSpace),
+           SSLPinningMatcher.isExcluded(url: url, excludedDomains: configuration.excludedDomains) {
+            return (.performDefaultHandling, nil)
+        }
+
+        do {
+            let certificates = try SSLPinningCertificateStore.shared.certificates(for: configuration.certs)
+            SecTrustSetAnchorCertificates(trust, certificates as CFArray)
+            SecTrustSetAnchorCertificatesOnly(trust, true)
+
+            var evaluationError: CFError?
+            if SecTrustEvaluateWithError(trust, &evaluationError) {
+                return (.useCredential, URLCredential(trust: trust))
+            }
+
+            return (.cancelAuthenticationChallenge, nil)
+        } catch {
+            return (.cancelAuthenticationChallenge, nil)
+        }
+    }
+
+    private static func url(from protectionSpace: URLProtectionSpace) -> URL? {
+        guard let host = protectionSpace.host.addingPercentEncoding(withAllowedCharacters: .urlHostAllowed) else {
+            return nil
+        }
+        let scheme = (protectionSpace.protocol ?? "https").lowercased()
+        let port = protectionSpace.port > 0 ? ":\(protectionSpace.port)" : ""
+        return URL(string: "\(scheme)://\(host)\(port)")
+    }
+}
+
+final class SSLPinningURLSessionDelegate: NSObject, URLSessionDelegate, URLSessionTaskDelegate {
+    private let configuration: SSLPinningConfiguration
+    private let disableRedirects: Bool
+
+    init(configuration: SSLPinningConfiguration, disableRedirects: Bool) {
+        self.configuration = configuration
+        self.disableRedirects = disableRedirects
+    }
+
+    func urlSession(
+        _ session: URLSession,
+        didReceive challenge: URLAuthenticationChallenge,
+        completionHandler: @escaping (URLSession.AuthChallengeDisposition, URLCredential?) -> Void
+    ) {
+        let result = SSLPinningTrustEvaluator.evaluate(challenge: challenge, configuration: configuration)
+        completionHandler(result.0, result.1)
+    }
+
+    func urlSession(
+        _ session: URLSession,
+        task: URLSessionTask,
+        willPerformHTTPRedirection response: HTTPURLResponse,
+        newRequest request: URLRequest,
+        completionHandler: @escaping (URLRequest?) -> Void
+    ) {
+        completionHandler(disableRedirects ? nil : request)
+    }
+}
+
+private extension URL {
+    var defaultPort: Int? {
+        switch scheme?.lowercased() {
+        case "http":
+            return 80
+        case "https":
+            return 443
+        default:
+            return nil
+        }
+    }
+}
+
+private struct SSLPinningRequestOptions {
+    let call: CAPPluginCall
+    let configuration: SSLPinningConfiguration
+    let config: InstanceConfiguration?
+    let httpMethod: String?
+    let urlString: String
+    let method: String
+    let params: [String: Any]
+    let responseType: String
+    let timeoutMs: Double
+    let shouldEncodeUrlParams: Bool
+    let dataType: String
+    let disableRedirects: Bool
+    let headers: [String: Any]
+
+    static func make(
+        from payload: NSDictionary
+    ) throws -> SSLPinningRequestOptions? {
+        guard let call = payload["call"] as? CAPPluginCall else {
+            return nil
+        }
+
+        let httpMethod = payload["httpMethod"] as? String
+        let config = payload["config"] as? InstanceConfiguration
+        let configuration = config.map { SSLPinningConfiguration.from($0.getPluginConfig("SSLPinning")) } ?? .empty
+
+        guard configuration.configured else {
+            try HttpRequestHandler.request(call, httpMethod, config)
+            return nil
+        }
+
+        guard var urlString = call.getString("url") else {
+            throw URLError(.badURL)
+        }
+        if urlString == urlString.removingPercentEncoding {
+            guard let encodedUrlString = urlString.addingPercentEncoding(withAllowedCharacters: .urlQueryAllowed) else {
+                throw URLError(.badURL)
+            }
+            urlString = encodedUrlString
+        }
+
+        guard let rawURL = URL(string: urlString) else {
+            throw URLError(.badURL)
+        }
+        if SSLPinningMatcher.isExcluded(url: rawURL, excludedDomains: configuration.excludedDomains) {
+            try HttpRequestHandler.request(call, httpMethod, config)
+            return nil
+        }
+
+        var headers = (call.getObject("headers") ?? [:]) as [String: Any]
+        if let userAgentString = config?.overridenUserAgentString,
+           headers["User-Agent"] == nil,
+           headers["user-agent"] == nil {
+            headers["User-Agent"] = userAgentString
+        }
+
+        return SSLPinningRequestOptions(
+            call: call,
+            configuration: configuration,
+            config: config,
+            httpMethod: httpMethod,
+            urlString: urlString,
+            method: httpMethod ?? call.getString("method", "GET"),
+            params: (call.getObject("params") ?? [:]) as [String: Any],
+            responseType: call.getString("responseType") ?? "text",
+            timeoutMs: call.getDouble("connectTimeout") ?? call.getDouble("readTimeout") ?? 600000.0,
+            shouldEncodeUrlParams: call.getBool("shouldEncodeUrlParams", true),
+            dataType: call.getString("dataType") ?? "any",
+            disableRedirects: call.getBool("disableRedirects") ?? false,
+            headers: headers
+        )
+    }
+}
+
+@objc(SSLPinningHttpRequestHandlerClass)
+public final class SSLPinningHttpRequestHandlerClass: NSObject {
+    @objc public static func request(_ payload: NSDictionary) {
+        do {
+            guard let options = try SSLPinningRequestOptions.make(from: payload) else {
+                return
+            }
+
+            let requestBuilder = try buildRequest(options: options)
+            let delegate = SSLPinningURLSessionDelegate(configuration: options.configuration, disableRedirects: options.disableRedirects)
+            let session = URLSession(configuration: .default, delegate: delegate, delegateQueue: nil)
+            let task = session.dataTask(with: requestBuilder.getUrlRequest()) { data, response, error in
+                session.invalidateAndCancel()
+
+                if let error {
+                    options.call.reject(error.localizedDescription, (error as NSError).domain, error, nil)
+                    return
+                }
+
+                guard let httpResponse = response as? HTTPURLResponse else {
+                    options.call.reject("Missing HTTP response")
+                    return
+                }
+
+                HttpRequestHandler.setCookiesFromResponse(httpResponse, options.config)
+                let resolvedResponseType = ResponseType(rawValue: options.responseType) ?? .default
+                options.call.resolve(HttpRequestHandler.buildResponse(data, httpResponse, responseType: resolvedResponseType))
+            }
+
+            task.resume()
+        } catch {
+            let call = payload["call"] as? CAPPluginCall
+            call?.reject(error.localizedDescription, (error as NSError).domain, error, nil)
+        }
+    }
+
+    private static func buildRequest(options: SSLPinningRequestOptions) throws -> CapacitorUrlRequest {
+        let requestBuilder = try HttpRequestHandler.CapacitorHttpRequestBuilder()
+            .setUrl(options.urlString)
+            .setMethod(options.method)
+            .setUrlParams(options.params, options.shouldEncodeUrlParams)
+            .openConnection()
+            .build()
+
+        requestBuilder.setRequestHeaders(options.headers)
+        requestBuilder.setTimeout(options.timeoutMs / 1000.0)
+
+        if let data = options.call.options["data"] as? JSValue {
+            try requestBuilder.setRequestBody(data, options.dataType)
+        }
+
+        return requestBuilder
+    }
+}

package/ios/Tests/SSLPinningPluginTests/SSLPinningPluginTests.swift

@@ -0,0 +1,22 @@
+import XCTest
+@testable import SSLPinningPlugin
+
+final class SSLPinningPluginTests: XCTestCase {
+    func testExcludedOriginMatchesWithoutPath() {
+        guard let url = URL(string: "https://analytics.google.com/collect?v=2") else {
+            XCTFail("Expected valid URL")
+            return
+        }
+        XCTAssertTrue(SSLPinningMatcher.isExcluded(url: url, excludedDomains: ["https://analytics.google.com"]))
+    }
+
+    func testExcludedPathRequiresPrefixMatch() {
+        guard let allowedURL = URL(string: "https://api.example.com/v2/users"),
+              let excludedURL = URL(string: "https://api.example.com/v1/users") else {
+            XCTFail("Expected valid URLs")
+            return
+        }
+        XCTAssertFalse(SSLPinningMatcher.isExcluded(url: allowedURL, excludedDomains: ["https://api.example.com/v1"]))
+        XCTAssertTrue(SSLPinningMatcher.isExcluded(url: excludedURL, excludedDomains: ["https://api.example.com/v1"]))
+    }
+}

package/package.json

@@ -0,0 +1,95 @@
+{
+  "name": "@capgo/capacitor-ssl-pinning",
+  "version": "8.0.0",
+  "description": "Capacitor SSL pinning plugin for Android and iOS that integrates with CapacitorHttp.",
+  "main": "dist/plugin.cjs.js",
+  "module": "dist/esm/index.js",
+  "types": "dist/esm/index.d.ts",
+  "unpkg": "dist/plugin.js",
+  "files": [
+    "android/src/main/",
+    "android/build.gradle",
+    "dist/",
+    "ios/Sources",
+    "ios/Tests",
+    "scripts/",
+    "Package.swift",
+    "CapgoCapacitorSslPinning.podspec"
+  ],
+  "author": "Martin Donadieu <martin@capgo.app>",
+  "license": "MPL-2.0",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Cap-go/capacitor-ssl-pinning.git"
+  },
+  "bugs": {
+    "url": "https://github.com/Cap-go/capacitor-ssl-pinning/issues"
+  },
+  "homepage": "https://capgo.app/docs/plugins/ssl-pinning/",
+  "keywords": [
+    "capacitor",
+    "plugin",
+    "ssl",
+    "pinning",
+    "https",
+    "http",
+    "security"
+  ],
+  "scripts": {
+    "verify": "bun run verify:ios && bun run verify:android && bun run verify:web",
+    "verify:ios": "xcodebuild -scheme CapgoCapacitorSslPinning -destination generic/platform=iOS",
+    "verify:android": "cd android && ./gradlew clean build test && cd ..",
+    "verify:web": "bun run build",
+    "lint": "bun run eslint && bun run prettier -- --check && bun run swiftlint -- lint",
+    "fmt": "bun run eslint -- --fix && bun run prettier -- --write && bun run swiftlint -- --fix --format",
+    "eslint": "eslint . --ext .ts",
+    "prettier": "prettier-pretty-check \"**/*.{css,html,ts,js,java,mjs,json}\" --plugin=prettier-plugin-java",
+    "swiftlint": "node-swiftlint",
+    "docgen": "docgen --api SSLPinningPlugin --output-readme README.md --output-json dist/docs.json",
+    "build": "bun run clean && bun run docgen && tsc && rollup -c rollup.config.mjs",
+    "clean": "rimraf ./dist",
+    "watch": "tsc --watch",
+    "prepublishOnly": "bun run build",
+    "check:wiring": "node scripts/check-capacitor-plugin-wiring.mjs",
+    "prepare:certs": "bun run scripts/prepare-certs.mjs",
+    "capacitor:sync:before": "bun run prepare:certs",
+    "capacitor:update:before": "bun run prepare:certs"
+  },
+  "devDependencies": {
+    "@capacitor/android": "^8.0.0",
+    "@capacitor/cli": "^8.0.0",
+    "@capacitor/core": "^8.0.0",
+    "@capacitor/docgen": "^0.3.1",
+    "@capacitor/ios": "^8.0.0",
+    "@ionic/eslint-config": "^0.4.0",
+    "@ionic/prettier-config": "^4.0.0",
+    "@ionic/swiftlint-config": "^2.0.0",
+    "@types/node": "^24.10.1",
+    "eslint": "^8.57.1",
+    "eslint-plugin-import": "^2.31.0",
+    "husky": "^9.1.7",
+    "prettier": "^3.6.2",
+    "prettier-pretty-check": "^0.2.0",
+    "prettier-plugin-java": "^2.7.7",
+    "rimraf": "^6.1.0",
+    "rollup": "^4.53.2",
+    "swiftlint": "^2.0.0",
+    "typescript": "^5.9.3"
+  },
+  "peerDependencies": {
+    "@capacitor/core": ">=8.0.0"
+  },
+  "prettier": "@ionic/prettier-config",
+  "swiftlint": "@ionic/swiftlint-config",
+  "eslintConfig": {
+    "extends": "@ionic/eslint-config/recommended"
+  },
+  "capacitor": {
+    "ios": {
+      "src": "ios"
+    },
+    "android": {
+      "src": "android"
+    }
+  }
+}

package/scripts/check-capacitor-plugin-wiring.mjs

@@ -0,0 +1,255 @@
+#!/usr/bin/env node
+/**
+ * Capacitor plugin wiring/name checker.
+ *
+ * Enforces that runtime plugin name matches across:
+ * - JS: registerPlugin('Name')
+ * - Android: @CapacitorPlugin(name = "Name")
+ * - iOS: CAPBridgedPlugin jsName = "Name"
+ *
+ * And (when iOS is declared in package.json capacitor config):
+ * - CocoaPods podspec s.name matches SwiftPM Package(name: ...) and .library(name: ...)
+ *
+ * Usage:
+ *   node scripts/check-capacitor-plugin-wiring.mjs            # checks current working dir
+ *   node scripts/check-capacitor-plugin-wiring.mjs --dir path # checks given plugin dir
+ */
+
+import fs from 'node:fs';
+import path from 'node:path';
+
+const SKIP_DIRS = new Set([
+  'node_modules',
+  'dist',
+  'build',
+  '.build',
+  '.gradle',
+  'Pods',
+  'DerivedData',
+  '.swiftpm',
+  '.git',
+]);
+
+function readText(p) {
+  try {
+    return fs.readFileSync(p, 'utf8');
+  } catch {
+    return '';
+  }
+}
+
+function exists(p) {
+  try {
+    fs.accessSync(p);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+function walkFiles(rootDir, exts) {
+  const out = [];
+  const stack = [rootDir];
+  while (stack.length) {
+    const dir = stack.pop();
+    let entries;
+    try {
+      entries = fs.readdirSync(dir, { withFileTypes: true });
+    } catch {
+      continue;
+    }
+    for (const e of entries) {
+      if (e.isDirectory()) {
+        if (SKIP_DIRS.has(e.name)) continue;
+        stack.push(path.join(dir, e.name));
+        continue;
+      }
+      if (!e.isFile()) continue;
+      for (const ext of exts) {
+        if (e.name.endsWith(ext)) {
+          out.push(path.join(dir, e.name));
+          break;
+        }
+      }
+    }
+  }
+  out.sort();
+  return out;
+}
+
+function uniq(arr) {
+  const out = [];
+  for (const x of arr) {
+    if (!x) continue;
+    if (!out.includes(x)) out.push(x);
+  }
+  return out;
+}
+
+function parseArgs(argv) {
+  const out = { dir: process.cwd() };
+  for (let i = 2; i < argv.length; i++) {
+    const a = argv[i];
+    if (a === '--dir' || a === '--pluginDir') {
+      out.dir = path.resolve(argv[++i] || '.');
+      continue;
+    }
+  }
+  return out;
+}
+
+const args = parseArgs(process.argv);
+const pluginDir = args.dir;
+const pkgPath = path.join(pluginDir, 'package.json');
+
+if (!exists(pkgPath)) {
+  console.error(`[wiring] ERROR: missing package.json in ${pluginDir}`);
+  process.exit(2);
+}
+
+let pkg;
+try {
+  pkg = JSON.parse(readText(pkgPath));
+} catch (e) {
+  console.error(`[wiring] ERROR: invalid package.json (${pkgPath}): ${e?.message || e}`);
+  process.exit(2);
+}
+
+const cap = typeof pkg.capacitor === 'object' && pkg.capacitor ? pkg.capacitor : {};
+const supportsAndroid = typeof cap.android === 'object' && cap.android;
+const supportsIos = typeof cap.ios === 'object' && cap.ios;
+
+// Not a Capacitor plugin package (e.g. meta/workspace package).
+// We only enforce wiring rules for actual plugin packages declaring a `capacitor` config.
+if (!supportsAndroid && !supportsIos) {
+  process.exit(0);
+}
+
+// ---------------- JS (registerPlugin) ----------------
+const jsSrcDir = path.join(pluginDir, 'src');
+let jsName = '';
+if (exists(jsSrcDir)) {
+  const jsFiles = walkFiles(jsSrcDir, ['.ts', '.js']);
+  const reRegister = /registerPlugin(?:<[^>]*>)?\(\s*['"]([^'"]+)['"]/;
+  for (const f of jsFiles) {
+    const m = reRegister.exec(readText(f));
+    if (m) {
+      jsName = m[1];
+      break;
+    }
+  }
+}
+
+// ---------------- Android (@CapacitorPlugin) ----------------
+let androidNames = [];
+if (supportsAndroid) {
+  const androidMain = path.join(pluginDir, 'android', 'src', 'main');
+  const files = walkFiles(androidMain, ['.java', '.kt']);
+  const foundAnnotations = [];
+  for (const f of files) {
+    const txt = readText(f);
+    if (!txt.includes('@CapacitorPlugin')) continue;
+    foundAnnotations.push(f);
+    const m =
+      /@CapacitorPlugin\(\s*name\s*=\s*"([^"]+)"/.exec(txt) ||
+      /@CapacitorPlugin\(\s*name\s*=\s*([A-Za-z0-9_]+)\b/.exec(txt);
+    if (m) androidNames.push(m[1]);
+  }
+  androidNames = uniq(androidNames);
+
+  // Enforce explicit name attribute to prevent silent class-name drift.
+  if (foundAnnotations.length && !androidNames.length) {
+    console.error(
+      `[wiring] ERROR: Android has @CapacitorPlugin but none specify name = \"...\". Add an explicit name to the plugin class.`,
+    );
+    process.exit(1);
+  }
+}
+
+// ---------------- iOS (jsName) ----------------
+let iosJsNames = [];
+if (supportsIos) {
+  const iosDir = path.join(pluginDir, 'ios');
+  const scanRoot = exists(path.join(iosDir, 'Sources')) ? path.join(iosDir, 'Sources') : iosDir;
+  const swiftFiles = walkFiles(scanRoot, ['.swift']);
+  const reJsName = /\bjsName\s*=\s*"([^"]+)"/g;
+  for (const f of swiftFiles) {
+    const txt = readText(f);
+    if (!txt.includes('jsName')) continue;
+    let m;
+    while ((m = reJsName.exec(txt))) iosJsNames.push(m[1]);
+  }
+  iosJsNames = uniq(iosJsNames);
+}
+
+// ---------------- Podspec/SPM ----------------
+function parsePodspecName(podspecPath) {
+  const txt = readText(podspecPath);
+  const m = /\bs\.name\s*=\s*'([^']+)'/.exec(txt);
+  return m ? m[1] : '';
+}
+
+function parseSpmNames(packageSwiftPath) {
+  const txt = readText(packageSwiftPath);
+  const pkg = /Package\(\s*name\s*:\s*"([^"]+)"/.exec(txt)?.[1] || '';
+  const libs = [];
+  const reLib = /\.library\(\s*name\s*:\s*"([^"]+)"/g;
+  let m;
+  while ((m = reLib.exec(txt))) libs.push(m[1]);
+  return { pkgName: pkg, libNames: uniq(libs) };
+}
+
+// ---------------- Validate ----------------
+const errors = [];
+
+if (!jsName) {
+  errors.push("JS: no registerPlugin('...') found under src/");
+}
+
+if (supportsAndroid) {
+  if (!androidNames.length) errors.push('Android: missing @CapacitorPlugin(name = "...")');
+  if (jsName && androidNames.length && androidNames.some((n) => n !== jsName)) {
+    errors.push(`Android: @CapacitorPlugin(name)=${JSON.stringify(androidNames)} != JS registerPlugin=${jsName}`);
+  }
+}
+
+if (supportsIos) {
+  if (!iosJsNames.length) errors.push('iOS: missing jsName = "..." in Swift sources');
+  if (jsName && iosJsNames.length && iosJsNames.some((n) => n !== jsName)) {
+    errors.push(`iOS: jsName=${JSON.stringify(iosJsNames)} != JS registerPlugin=${jsName}`);
+  }
+
+  const podspecs = fs
+    .readdirSync(pluginDir, { withFileTypes: true })
+    .filter((e) => e.isFile() && e.name.endsWith('.podspec'))
+    .map((e) => path.join(pluginDir, e.name))
+    .sort();
+  if (!podspecs.length) errors.push('iOS: missing *.podspec at plugin root');
+  if (podspecs.length > 1)
+    errors.push(`iOS: multiple podspecs at plugin root: ${podspecs.map((p) => path.basename(p))}`);
+
+  const pkgSwift = path.join(pluginDir, 'Package.swift');
+  if (!exists(pkgSwift)) {
+    errors.push('iOS: missing Package.swift at plugin root');
+  } else if (podspecs.length) {
+    const podName = parsePodspecName(podspecs[0]);
+    const { pkgName, libNames } = parseSpmNames(pkgSwift);
+    if (!podName) errors.push("Podspec: missing s.name = '...'");
+    if (!pkgName) errors.push('SPM: missing Package(name: "...")');
+    if (podName && pkgName && podName !== pkgName) {
+      errors.push(`Podspec: s.name=${podName} != Package(name)=${pkgName}`);
+    }
+    if (pkgName && libNames.length && !libNames.includes(pkgName)) {
+      errors.push(`SPM: Package(name)=${pkgName} not present in .library(name) list ${JSON.stringify(libNames)}`);
+    }
+  }
+}
+
+if (errors.length) {
+  const relDir = path.relative(process.cwd(), pluginDir) || '.';
+  console.error(`[wiring] FAIL in ${relDir}`);
+  for (const e of errors) console.error(`- ${e}`);
+  process.exit(1);
+}
+
+process.exit(0);