@scalebun-release/react-native 2.5.0

package/ios/Engage/ScaleBunEngageModule.swift

@@ -0,0 +1,250 @@
+import Foundation
+import React
+import UIKit
+import CoreMotion
+import StoreKit
+
+/**
+ * React Native bridge for Engage push-token acquisition (iOS / APNs).
+ *
+ * The genuinely-native piece of the Engage foundation (D4): registers for remote
+ * notifications, captures the APNs device token, and surfaces it (initial + any
+ * re-registration) to JS, which uploads it via the JS transport layer
+ * (`registerDeviceToken`) — the SDK does NOT open a second native HTTP stack.
+ *
+ * Method:
+ *   getPushToken()  — registers for remote notifications and resolves
+ *                     { token, platform:'ios' } once APNs returns a token, or null
+ *                     (fail-soft) when push capability is unavailable.
+ *
+ * Event (RCTEventEmitter → JS NativeEventEmitter):
+ *   ScaleBunEngageTokenRefresh  — { token, platform:'ios' } on re-registration
+ *
+ * The host AppDelegate forwards APNs callbacks by calling the static handlers
+ * `didRegisterForRemoteNotifications(deviceToken:)` /
+ * `didFailToRegisterForRemoteNotifications(error:)`. Absent that wiring (or push
+ * capability), `getPushToken` resolves null after a short wait — never crashes.
+ *
+ * `platform` is always reported as 'ios' (routing source of truth, D5).
+ */
+@objc(ScaleBunEngage)
+class ScaleBunEngageModule: RCTEventEmitter {
+
+    // Shared instance so the host AppDelegate's APNs callbacks can reach the live
+    // module (RCTEventEmitter instances are created by the bridge).
+    private static weak var shared: ScaleBunEngageModule?
+
+    // A pending getPushToken() resolve awaiting the APNs callback.
+    private static var pendingResolve: RCTPromiseResolveBlock?
+    private static var hasListeners = false
+
+    // ─── Shake detection (Engage `shake_device` trigger) ────────────────────
+    // CoreMotion accelerometer; emits `ScaleBunEngageShake` when total acceleration
+    // magnitude crosses the threshold (with a cooldown). Self-contained — no
+    // responder-chain / motionEnded wiring needed in the host AppDelegate.
+    private let motionManager = CMMotionManager()
+    private var lastShakeTs: TimeInterval = 0
+    private static let shakeThresholdG = 2.3      // total |a| in g
+    private static let shakeCooldownSec = 1.5
+
+    override init() {
+        super.init()
+        ScaleBunEngageModule.shared = self
+        // Bridge the native notification surface (UNUserNotificationCenter) to JS.
+        // The presenter owns permission + foreground/open/cold-start; we only forward
+        // its normalized events. install() claims the delegate (idempotent) so taps are
+        // captured even before the first permission request.
+        ScaleBunPushNotificationCenter.shared.emitter = { [weak self] name, body in
+            guard ScaleBunEngageModule.hasListeners else { return }
+            self?.sendEvent(withName: name, body: body)
+        }
+        ScaleBunPushNotificationCenter.shared.install()
+    }
+
+    override static func moduleName() -> String! { "ScaleBunEngage" }
+
+    @objc override static func requiresMainQueueSetup() -> Bool { true }
+
+    /// Resolve the foreground window's safe-area insets in React Native layout
+    /// units (UIKit points). Missing/inactive windows fail soft with null.
+    @objc func getWindowInsets(_ resolve: @escaping RCTPromiseResolveBlock,
+                              rejecter reject: @escaping RCTPromiseRejectBlock) {
+        DispatchQueue.main.async {
+            guard let window = WindowResolver.keyWindow() else {
+                resolve(nil)
+                return
+            }
+            let insets = window.safeAreaInsets
+            resolve([
+                "top": Double(insets.top),
+                "right": Double(insets.right),
+                "bottom": Double(insets.bottom),
+                "left": Double(insets.left),
+            ])
+        }
+    }
+
+    override func supportedEvents() -> [String]! {
+        return [
+            "ScaleBunEngageTokenRefresh",
+            "ScaleBunEngageShake",
+            ScaleBunPushNotificationCenter.foregroundEvent,
+            ScaleBunPushNotificationCenter.openedEvent,
+        ]
+    }
+
+    // ─── Shake detection bridge ─────────────────────────────────────────────
+
+    @objc func startShakeDetection(_ resolve: @escaping RCTPromiseResolveBlock,
+                                   rejecter reject: @escaping RCTPromiseRejectBlock) {
+        DispatchQueue.main.async {
+            guard self.motionManager.isAccelerometerAvailable else {
+                resolve(false) // fail-soft: no accelerometer (e.g. simulator)
+                return
+            }
+            if self.motionManager.isAccelerometerActive {
+                resolve(true)
+                return
+            }
+            self.motionManager.accelerometerUpdateInterval = 0.05 // 20 Hz
+            self.motionManager.startAccelerometerUpdates(to: .main) { [weak self] data, _ in
+                guard let self = self, let a = data?.acceleration else { return }
+                let magnitude = sqrt(a.x * a.x + a.y * a.y + a.z * a.z)
+                if magnitude >= ScaleBunEngageModule.shakeThresholdG {
+                    let now = Date().timeIntervalSince1970
+                    if now - self.lastShakeTs < ScaleBunEngageModule.shakeCooldownSec { return }
+                    self.lastShakeTs = now
+                    if ScaleBunEngageModule.hasListeners {
+                        self.sendEvent(withName: "ScaleBunEngageShake", body: ["platform": "ios"])
+                    }
+                }
+            }
+            resolve(true)
+        }
+    }
+
+    @objc func stopShakeDetection(_ resolve: @escaping RCTPromiseResolveBlock,
+                                  rejecter reject: @escaping RCTPromiseRejectBlock) {
+        DispatchQueue.main.async {
+            if self.motionManager.isAccelerometerActive {
+                self.motionManager.stopAccelerometerUpdates()
+            }
+            resolve(true)
+        }
+    }
+
+    override func startObserving() {
+        ScaleBunEngageModule.hasListeners = true
+        ScaleBunPushNotificationCenter.shared.isListening = true
+    }
+
+    override func stopObserving() {
+        ScaleBunEngageModule.hasListeners = false
+        ScaleBunPushNotificationCenter.shared.isListening = false
+    }
+
+    // ─── Notification permission + cold-start (UNUserNotificationCenter) ─────
+
+    /// Request notification authorization natively (alert/badge/sound). Resolves a
+    /// normalized status: "granted" | "provisional" | "denied".
+    @objc func requestPushPermission(_ resolve: @escaping RCTPromiseResolveBlock,
+                                     rejecter reject: @escaping RCTPromiseRejectBlock) {
+        ScaleBunPushNotificationCenter.shared.requestAuthorization { status in
+            resolve(status)
+        }
+    }
+
+    /// Drain the cold-start "opened from notification" payload once (null if none).
+    @objc func consumeInitialNotification(_ resolve: @escaping RCTPromiseResolveBlock,
+                                          rejecter reject: @escaping RCTPromiseRejectBlock) {
+        resolve(ScaleBunPushNotificationCenter.shared.consumeInitialNotification())
+    }
+
+    // ─── In-app review (rating funnel D5) ───────────────────────────────────
+    // SKStoreReviewController in-app review prompt. iOS itself decides whether to
+    // actually show the sheet (it rate-limits to ~3×/year) — there is no completion
+    // callback, so "requested" is the strongest honest signal. We resolve true once
+    // the request is issued on a valid scene, which the funnel treats as
+    // `store_redirect_clicked` (CONTRACT §1.1). Resolves false when no active scene
+    // is available (fail-soft).
+    @objc func requestReview(_ resolve: @escaping RCTPromiseResolveBlock,
+                             rejecter reject: @escaping RCTPromiseRejectBlock) {
+        DispatchQueue.main.async {
+            if #available(iOS 14.0, *) {
+                let scene = UIApplication.shared.connectedScenes
+                    .first { $0.activationState == .foregroundActive } as? UIWindowScene
+                    ?? UIApplication.shared.connectedScenes.first as? UIWindowScene
+                guard let windowScene = scene else {
+                    resolve(false) // fail-soft: no active window scene
+                    return
+                }
+                SKStoreReviewController.requestReview(in: windowScene)
+                resolve(true)
+            } else {
+                SKStoreReviewController.requestReview()
+                resolve(true)
+            }
+        }
+    }
+
+    @objc func getPushToken(_ resolve: @escaping RCTPromiseResolveBlock,
+                            rejecter reject: @escaping RCTPromiseRejectBlock) {
+        // Stash the resolver; the APNs callback (forwarded by the host AppDelegate)
+        // fulfills it. If push is not enabled, no callback arrives — resolve null
+        // after a short grace period so JS is never left hanging (fail-soft).
+        ScaleBunEngageModule.pendingResolve = resolve
+
+        DispatchQueue.main.async {
+            UIApplication.shared.registerForRemoteNotifications()
+        }
+
+        DispatchQueue.main.asyncAfter(deadline: .now() + 5.0) {
+            if let pending = ScaleBunEngageModule.pendingResolve {
+                ScaleBunEngageModule.pendingResolve = nil
+                pending(nil)
+            }
+        }
+    }
+
+    // ─── Host AppDelegate forwarding hooks ──────────────────────────────────
+
+    /**
+     * Forward `application(_:didRegisterForRemoteNotificationsWithDeviceToken:)`.
+     * Resolves any pending getPushToken() and emits a refresh event for rotations.
+     */
+    @objc static func didRegisterForRemoteNotifications(deviceToken: Data) {
+        let token = deviceToken.map { String(format: "%02x", $0) }.joined()
+        let payload: [String: Any] = ["token": token, "platform": "ios"]
+
+        if let pending = pendingResolve {
+            pendingResolve = nil
+            pending(payload)
+        }
+        if hasListeners {
+            shared?.sendEvent(withName: "ScaleBunEngageTokenRefresh", body: payload)
+        }
+    }
+
+    /**
+     * Forward `application(_:didFailToRegisterForRemoteNotificationsWithError:)`.
+     * Resolves any pending getPushToken() with null (fail-soft).
+     */
+    @objc static func didFailToRegisterForRemoteNotifications(error: Error) {
+        if let pending = pendingResolve {
+            pendingResolve = nil
+            pending(nil)
+        }
+    }
+
+    /**
+     * Forward `application(_:didFinishLaunchingWithOptions:)` so a notification that
+     * cold-started the app is captured for `consumeInitialNotification()`. Pass the
+     * launch options' remote-notification payload (or the full launchOptions — both
+     * are handled). Also installs the notification-center delegate early.
+     */
+    @objc static func didFinishLaunching(launchOptions: [AnyHashable: Any]?) {
+        ScaleBunPushNotificationCenter.shared.install()
+        let remote = launchOptions?[UIApplication.LaunchOptionsKey.remoteNotification] as? [AnyHashable: Any]
+        ScaleBunPushNotificationCenter.shared.captureLaunchNotification(remote)
+    }
+}

package/ios/Engage/ScaleBunPushNotificationCenter.swift

@@ -0,0 +1,185 @@
+import Foundation
+import UserNotifications
+import UIKit
+
+/**
+ * ScaleBun native iOS notification surface — framework-only (NO Notifee, NO
+ * Firebase required). This is the iOS analog of the Android
+ * `ScaleBunNotificationPresenter`: it owns the `UNUserNotificationCenter` delegate so
+ * the SDK can, using ONLY `UserNotifications` APIs:
+ *   1. request notification permission,
+ *   2. present notifications while the app is foregrounded,
+ *   3. surface notification taps (open / deep-link),
+ *   4. capture the cold-start launch notification.
+ *
+ * It is a self-contained singleton so a future native iOS SDK or a Flutter
+ * wrapper can reuse the exact same model. The RN module (`ScaleBunEngageModule`) only
+ * bridges these events to JS via a small `emitter` closure — the normalized event
+ * shape (`{ title, body, data }`) mirrors the Android event model so the JS push
+ * adapter is platform-agnostic.
+ *
+ * Direct APNs: this layer is independent of Firebase. The raw APNs device token is
+ * captured separately in `ScaleBunEngageModule` from the host AppDelegate's
+ * `didRegisterForRemoteNotificationsWithDeviceToken` callback.
+ */
+@objc(ScaleBunPushNotificationCenter)
+public final class ScaleBunPushNotificationCenter: NSObject, UNUserNotificationCenterDelegate {
+
+    @objc public static let shared = ScaleBunPushNotificationCenter()
+
+    /// RN event names (mirror Android `ScaleBunEngageModule` events).
+    static let foregroundEvent = "ScaleBunEngageForegroundNotification"
+    static let openedEvent = "ScaleBunEngageNotificationOpened"
+
+    /// Set by the RN module; forwards a normalized event body to JS.
+    public var emitter: ((_ name: String, _ body: [String: Any]) -> Void)?
+
+    /// True while JS has an active NativeEventEmitter subscription. When false, an
+    /// "opened" tap is buffered as the cold-start notification so it is not lost.
+    public var isListening = false
+
+    private var initialNotification: [String: Any]?
+    private var initialConsumed = false
+    private let lock = NSLock()
+
+    private override init() { super.init() }
+
+    /// Install as the notification-center delegate. Idempotent. Call early (e.g.
+    /// from the host AppDelegate or on first permission request) so cold-start taps
+    /// are captured. Only claims the delegate when no ScaleBun delegate is set yet,
+    /// so re-entry is safe.
+    @objc public func install() {
+        let center = UNUserNotificationCenter.current()
+        if !(center.delegate is ScaleBunPushNotificationCenter) {
+            center.delegate = self
+        }
+    }
+
+    /// Request notification authorization (alert/badge/sound) using native iOS APIs
+    /// and resolve a normalized status string: granted | provisional | denied.
+    @objc public func requestAuthorization(_ completion: @escaping (String) -> Void) {
+        install()
+        let center = UNUserNotificationCenter.current()
+        center.requestAuthorization(options: [.alert, .badge, .sound]) { granted, _ in
+            center.getNotificationSettings { settings in
+                completion(Self.statusString(settings.authorizationStatus, granted: granted))
+            }
+        }
+    }
+
+    private static func statusString(_ status: UNAuthorizationStatus, granted: Bool) -> String {
+        switch status {
+        case .authorized: return "granted"
+        case .provisional: return "provisional"
+        case .ephemeral: return "granted"
+        case .denied: return "denied"
+        case .notDetermined: return granted ? "granted" : "denied"
+        @unknown default: return granted ? "granted" : "denied"
+        }
+    }
+
+    /// Capture a cold-start launch notification from the AppDelegate's
+    /// `didFinishLaunchingWithOptions` launch options (UIApplication.LaunchOptionsKey.remoteNotification).
+    @objc public func captureLaunchNotification(_ userInfo: [AnyHashable: Any]?) {
+        guard let userInfo = userInfo else { return }
+        let payload = Self.normalize(userInfo, content: nil)
+        lock.lock()
+        if initialNotification == nil { initialNotification = payload }
+        lock.unlock()
+    }
+
+    /// Drain the cold-start "opened from notification" payload once. Returns nil
+    /// when there was none or it has already been consumed.
+    @objc public func consumeInitialNotification() -> [String: Any]? {
+        lock.lock(); defer { lock.unlock() }
+        if initialConsumed { return nil }
+        initialConsumed = true
+        let n = initialNotification
+        initialNotification = nil
+        return n
+    }
+
+    // ─── UNUserNotificationCenterDelegate ────────────────────────────────────
+
+    public func userNotificationCenter(
+        _ center: UNUserNotificationCenter,
+        willPresent notification: UNNotification,
+        withCompletionHandler completionHandler: @escaping (UNNotificationPresentationOptions) -> Void
+    ) {
+        let body = Self.normalize(
+            notification.request.content.userInfo,
+            content: notification.request.content
+        )
+        if isListening { emitter?(Self.foregroundEvent, body) }
+        if #available(iOS 14.0, *) {
+            completionHandler([.banner, .list, .sound])
+        } else {
+            completionHandler([.alert, .sound])
+        }
+    }
+
+    public func userNotificationCenter(
+        _ center: UNUserNotificationCenter,
+        didReceive response: UNNotificationResponse,
+        withCompletionHandler completionHandler: @escaping () -> Void
+    ) {
+        let body = Self.normalize(
+            response.notification.request.content.userInfo,
+            content: response.notification.request.content
+        )
+        if isListening, let emit = emitter {
+            emit(Self.openedEvent, body)
+        } else {
+            // Tap before JS subscribed (cold start) — buffer as the initial notification.
+            lock.lock()
+            if initialNotification == nil { initialNotification = body }
+            lock.unlock()
+        }
+        completionHandler()
+    }
+
+    // ─── Normalization (APNs userInfo → cross-platform { title, body, data }) ──
+
+    static func normalize(
+        _ userInfo: [AnyHashable: Any],
+        content: UNNotificationContent?
+    ) -> [String: Any] {
+        var data: [String: String] = [:]
+        for (rawKey, value) in userInfo {
+            guard let key = rawKey as? String, key != "aps" else { continue }
+            data[key] = stringify(value)
+        }
+
+        var title: String?
+        var body: String?
+        if let content = content {
+            title = content.title.isEmpty ? nil : content.title
+            body = content.body.isEmpty ? nil : content.body
+        }
+        if title == nil || body == nil,
+           let aps = userInfo["aps"] as? [AnyHashable: Any] {
+            if let alert = aps["alert"] as? [AnyHashable: Any] {
+                title = title ?? (alert["title"] as? String)
+                body = body ?? (alert["body"] as? String)
+            } else if let alert = aps["alert"] as? String {
+                body = body ?? alert
+            }
+        }
+
+        var out: [String: Any] = ["data": data, "platform": "ios"]
+        if let title = title { out["title"] = title }
+        if let body = body { out["body"] = body }
+        return out
+    }
+
+    private static func stringify(_ value: Any) -> String {
+        if let s = value as? String { return s }
+        if let n = value as? NSNumber { return n.stringValue }
+        if JSONSerialization.isValidJSONObject(value),
+           let d = try? JSONSerialization.data(withJSONObject: value),
+           let s = String(data: d, encoding: .utf8) {
+            return s
+        }
+        return String(describing: value)
+    }
+}

package/ios/Ota/BsPatch.swift

@@ -0,0 +1,203 @@
+import Foundation
+import Compression
+
+/// bspatch — reconstructs a bundle from a previous bundle plus a delta.
+///
+/// WHAT WAS WRONG. `stagePatch` resolved `false` unconditionally on both
+/// platforms, so the whole delta pipeline was decorative: the server generated
+/// patches, the check response advertised them, the orchestrator asked for
+/// them, and the device always fell back to a full download.
+///
+/// FORMAT (produced by the backend's `bsdiff.ts`; all integers little-endian):
+///
+///     0   8   magic "SBDIFF01"
+///     8   4   target size — the exact number of bytes this must produce
+///     12  4   deflated control-block length
+///     16  4   inflated control-block length
+///     20  4   deflated diff-block length
+///     24  4   inflated diff-block length
+///     28  4   deflated extra-block length
+///     32  4   inflated extra-block length
+///     36  .   deflate(control) ++ deflate(diff) ++ deflate(extra)
+///
+/// Control is a run of (addLen, extraLen, seek) Int32 triples. `addLen` bytes
+/// are read from the diff block and added, bytewise mod 256, to the source at
+/// the current read cursor; `extraLen` bytes are copied verbatim from the extra
+/// block; then the source cursor moves by the signed `seek`.
+///
+/// WHY COMPRESSION_ZLIB. Apple's `COMPRESSION_ZLIB` is raw DEFLATE (RFC 1951)
+/// with no zlib wrapper, which is exactly what Node's `deflateRawSync` writes
+/// and what Android's `Inflater(nowrap: true)` reads. No third-party dependency
+/// on any platform. `compression_decode_buffer` needs the output size up front,
+/// which is why the inflated lengths ride in the header.
+///
+/// EVERY FIELD HERE IS UNTRUSTED. The patch arrives over the network, so a
+/// malformed or hostile one must fail cleanly rather than read out of bounds.
+/// Each run is bounds-checked against all four buffers before use, and the
+/// caller still verifies the SHA-256 of the result before anything is promoted.
+enum BsPatch {
+
+    enum PatchError: Error, CustomStringConvertible {
+        case malformed(String)
+
+        var description: String {
+            switch self {
+            case .malformed(let why): return why
+            }
+        }
+    }
+
+    private static let magic = "SBDIFF01"
+    private static let headerBytes = 36
+
+    /// Refuse absurd allocations from a corrupt header (bundles are single-digit MB). 50 MB is the
+    /// server's finalize cap and the downloader's limit; the old 256 MB — per block, four blocks —
+    /// was enough to get the host app killed by jetsam before a single check ran.
+    private static let maxTargetBytes = 50 * 1024 * 1024
+
+    private static func u32(_ b: [UInt8], _ off: Int) -> UInt32 {
+        UInt32(b[off]) | (UInt32(b[off + 1]) << 8) | (UInt32(b[off + 2]) << 16) | (UInt32(b[off + 3]) << 24)
+    }
+
+    private static func i32(_ b: [UInt8], _ off: Int) -> Int32 {
+        Int32(bitPattern: u32(b, off))
+    }
+
+    /// Raw DEFLATE decode into an exactly-sized buffer.
+    private static func inflateRaw(_ src: [UInt8], _ offset: Int, _ length: Int, _ rawSize: Int) throws -> [UInt8] {
+        if rawSize == 0 { return [] }
+        var out = [UInt8](repeating: 0, count: rawSize)
+        let produced: Int = out.withUnsafeMutableBufferPointer { dst in
+            src.withUnsafeBufferPointer { s in
+                compression_decode_buffer(
+                    dst.baseAddress!, rawSize,
+                    s.baseAddress!.advanced(by: offset), length,
+                    nil, COMPRESSION_ZLIB
+                )
+            }
+        }
+        // Zero means failure; anything other than the declared size means the
+        // stream disagrees with the header, which is corruption either way.
+        guard produced == rawSize else {
+            throw PatchError.malformed("compressed block decoded to \(produced) bytes, declared \(rawSize)")
+        }
+        return out
+    }
+
+    /// Apply `patch` to `source`, returning the reconstructed bundle.
+    ///
+    /// Throws `PatchError.malformed` if the patch is malformed, truncated, or
+    /// inconsistent with `source`. Callers treat this as "fall back to a full
+    /// download", never as a fatal error.
+    /// - Parameter expectedTargetSize: the size the result MUST have — for a signed release, the
+    ///   signed `artifactSize`. Checked against the header before anything is allocated.
+    static func apply(source: [UInt8], patch: [UInt8], expectedTargetSize: Int? = nil) throws -> [UInt8] {
+        guard patch.count >= headerBytes else {
+            throw PatchError.malformed("patch too short")
+        }
+        let gotMagic = String(bytes: patch[0..<8], encoding: .isoLatin1) ?? ""
+        guard gotMagic == magic else {
+            throw PatchError.malformed("bad patch magic '\(gotMagic)'")
+        }
+
+        let targetSize64 = Int(u32(patch, 8))
+        let cLen = Int(u32(patch, 12))
+        let cRaw = Int(u32(patch, 16))
+        let dLen = Int(u32(patch, 20))
+        let dRaw = Int(u32(patch, 24))
+        let eLen = Int(u32(patch, 28))
+        let eRaw = Int(u32(patch, 32))
+
+        guard targetSize64 <= maxTargetBytes else {
+            throw PatchError.malformed("declared target size is implausible")
+        }
+        if let expected = expectedTargetSize, expected != targetSize64 {
+            throw PatchError.malformed("patch builds \(targetSize64) bytes, the signed release is \(expected)")
+        }
+        // The same bounds as Android (BsPatch.kt), all checked BEFORE any buffer is allocated:
+        // diff and extra bytes each land in the output at most once, every control triple advances
+        // it, and the output can never exceed diff + extra. The decoder writes exactly the declared
+        // sizes (produced == rawSize is required), so these declared numbers ARE the allocations.
+        guard dRaw <= targetSize64, eRaw <= targetSize64 else {
+            throw PatchError.malformed("declared diff/extra block is larger than the target")
+        }
+        guard cRaw <= 12 * (targetSize64 + 1) else {
+            throw PatchError.malformed("declared control block is larger than the target allows")
+        }
+        guard targetSize64 <= dRaw + eRaw else {
+            throw PatchError.malformed("target is larger than the diff and extra blocks can produce")
+        }
+        guard headerBytes + cLen + dLen + eLen == patch.count else {
+            throw PatchError.malformed("block lengths do not match patch size")
+        }
+        let targetSize = targetSize64
+
+        var off = headerBytes
+        let control = try inflateRaw(patch, off, cLen, cRaw); off += cLen
+        let diff = try inflateRaw(patch, off, dLen, dRaw); off += dLen
+        let extra = try inflateRaw(patch, off, eLen, eRaw)
+
+        guard control.count % 12 == 0 else {
+            throw PatchError.malformed("control block is not a whole number of triples")
+        }
+
+        var out = [UInt8](repeating: 0, count: targetSize)
+        var newpos = 0
+        var oldpos = 0
+        var dpos = 0
+        var epos = 0
+
+        var c = 0
+        while c < control.count {
+            let addLen = Int(i32(control, c))
+            let extraLen = Int(i32(control, c + 4))
+            let seek = Int(i32(control, c + 8))
+            c += 12
+
+            guard addLen >= 0, extraLen >= 0 else {
+                throw PatchError.malformed("negative run length")
+            }
+            guard newpos + addLen <= targetSize else {
+                throw PatchError.malformed("add run overruns target")
+            }
+            guard dpos + addLen <= diff.count else {
+                throw PatchError.malformed("add run overruns diff block")
+            }
+            guard oldpos >= 0, oldpos + addLen <= source.count else {
+                throw PatchError.malformed("add run overruns source")
+            }
+
+            if addLen > 0 {
+                for i in 0..<addLen {
+                    out[newpos + i] = diff[dpos + i] &+ source[oldpos + i]
+                }
+            }
+            newpos += addLen
+            oldpos += addLen
+            dpos += addLen
+
+            guard newpos + extraLen <= targetSize else {
+                throw PatchError.malformed("extra run overruns target")
+            }
+            guard epos + extraLen <= extra.count else {
+                throw PatchError.malformed("extra run overruns extra block")
+            }
+            if extraLen > 0 {
+                out.replaceSubrange(newpos..<(newpos + extraLen), with: extra[epos..<(epos + extraLen)])
+            }
+            newpos += extraLen
+            epos += extraLen
+
+            oldpos += seek
+            // A cursor far outside any plausible range can never be used again; stop now.
+            guard oldpos > -(1 << 32), oldpos < (1 << 32) else {
+                throw PatchError.malformed("seek moved the source cursor out of range")
+            }
+        }
+
+        guard newpos == targetSize else {
+            throw PatchError.malformed("patch produced \(newpos) bytes, declared \(targetSize)")
+        }
+        return out
+    }
+}