@tempivo/sensor-beacon 1.1.2 → 1.1.5

package/android-aar/library/src/main/java/com/tempivo/sensor/beacon/EfentoRawConfigTransfer.kt

@@ -0,0 +1,780 @@
+package com.tempivo.sensor.beacon
+
+import android.annotation.SuppressLint
+import android.bluetooth.BluetoothAdapter
+import android.bluetooth.BluetoothDevice
+import android.bluetooth.BluetoothGatt
+import android.bluetooth.BluetoothGattCallback
+import android.bluetooth.BluetoothGattCharacteristic
+import android.bluetooth.BluetoothGattDescriptor
+import android.bluetooth.BluetoothManager
+import android.bluetooth.BluetoothProfile
+import android.content.Context
+import android.os.Build
+import android.os.Handler
+import android.os.HandlerThread
+import java.util.UUID
+import java.util.concurrent.CountDownLatch
+import java.util.concurrent.TimeUnit
+import java.util.concurrent.atomic.AtomicReference
+
+/**
+ * Wire-level ProtoConfig transfer (get 0x0C / set 0x0D) via Android [BluetoothGatt].
+ *
+ * Mirrors iOS `EfentoRawConfigTransfer`: one persistent GATT link reused across commands.
+ * Disconnect the vendor SDK session before calling.
+ *
+ * Important Android details:
+ * - GATT work runs on a dedicated [HandlerThread] (not the main looper). Blocking the main
+ *   thread while posting `connectGatt` there deadlocks until timeout.
+ * - Service discovery starts on connect. Do not wait for `onMtuChanged` (often never fires).
+ */
+internal object EfentoRawConfigTransfer {
+    private val TRANSFER_SERVICE = UUID.fromString("6E20F700-6126-4FCD-99C1-EB8A182501A2")
+    private val TRANSFER_WRITE = UUID.fromString("6E20F701-6126-4FCD-99C1-EB8A182501A2")
+    private val TRANSFER_NOTIFY = UUID.fromString("6E20F702-6126-4FCD-99C1-EB8A182501A2")
+    private val PRIMARY_SERVICE = UUID.fromString("69E1F600-BC3C-4DC0-8127-CFCDD295C7F7")
+    private val PRIMARY_WRITE = UUID.fromString("69E1F601-BC3C-4DC0-8127-CFCDD295C7F7")
+    private val PRIMARY_NOTIFY = UUID.fromString("69E1F602-BC3C-4DC0-8127-CFCDD295C7F7")
+    private val CCCD = UUID.fromString("00002902-0000-1000-8000-00805f9b34fb")
+
+    private const val HDR_REQ: Byte = 0xAA.toByte()
+    private const val HDR_RSP: Byte = 0x55
+    private const val CMD_GET: Byte = 0x0C
+    private const val CMD_SET: Byte = 0x0D
+    private const val NOTIFY_CONFIGURATION: Byte = 0x03
+
+    private val link = Link()
+
+    @SuppressLint("MissingPermission")
+    fun readProtoConfig(
+        context: Context,
+        address: String,
+        bluetoothMac: String,
+        pin: String,
+        timeoutMs: Long = 40_000L,
+    ): ByteArray =
+        link.runCommand(
+            context = context.applicationContext,
+            address = address,
+            bluetoothMac = bluetoothMac,
+            pin = pin,
+            writeProto = null,
+            timeoutMs = timeoutMs,
+        )
+
+    @SuppressLint("MissingPermission")
+    fun writeProtoConfig(
+        context: Context,
+        address: String,
+        bluetoothMac: String,
+        pin: String,
+        proto: ByteArray,
+        timeoutMs: Long = 40_000L,
+    ) {
+        link.runCommand(
+            context = context.applicationContext,
+            address = address,
+            bluetoothMac = bluetoothMac,
+            pin = pin,
+            writeProto = proto,
+            timeoutMs = timeoutMs,
+        )
+    }
+
+    fun closeLink() {
+        link.close()
+    }
+
+    @SuppressLint("MissingPermission")
+    private class Link {
+        /** Dedicated BLE looper so connectGatt/callbacks never depend on the app main thread. */
+        private val bleThread =
+            HandlerThread("tempivo-raw-config-ble").apply { start() }
+        private val handler = Handler(bleThread.looper)
+        private val lock = Any()
+
+        private var gatt: BluetoothGatt? = null
+        private var writeChar: BluetoothGattCharacteristic? = null
+        private var notifyChar: BluetoothGattCharacteristic? = null
+        private var usingTransfer = true
+        private var discoveryStarted = false
+        private var connectedAddress: String? = null
+        private var negotiatedMtu = 23
+        private var mtuRequested = false
+        private var awaitingMtu = false
+        private var mtuAttempts = 0
+
+        private var bluetoothMac = ""
+        private var pin = ""
+        private var writeProto: ByteArray? = null
+        private var notifyChunks = ArrayList<ByteArray>()
+        private var startResponse: ByteArray? = null
+        private var commandSent = false
+        private var finished = true
+        private var commandToken = 0L
+        private var doneLatch: CountDownLatch? = null
+        private var resultRef = AtomicReference<Result<ByteArray>?>(null)
+
+        private val cmd: Byte
+            get() = if (writeProto == null) CMD_GET else CMD_SET
+
+        fun runCommand(
+            context: Context,
+            address: String,
+            bluetoothMac: String,
+            pin: String,
+            writeProto: ByteArray?,
+            timeoutMs: Long,
+        ): ByteArray {
+            var last: Throwable? = null
+            repeat(3) { attempt ->
+                try {
+                    return attemptCommand(context, address, bluetoothMac, pin, writeProto, timeoutMs)
+                } catch (e: Throwable) {
+                    last = e
+                    close()
+                    if (attempt < 2) Thread.sleep(2_000L * (attempt + 1))
+                }
+            }
+            throw last ?: TempivoSensorException(TempivoSensorException.Code.UNKNOWN, "Raw config transfer failed.")
+        }
+
+        fun close() {
+            synchronized(lock) {
+                finished = true
+                runCatching { gatt?.disconnect() }
+                runCatching { gatt?.close() }
+                gatt = null
+                writeChar = null
+                notifyChar = null
+                discoveryStarted = false
+                connectedAddress = null
+                negotiatedMtu = 23
+                mtuRequested = false
+                awaitingMtu = false
+                mtuAttempts = 0
+                doneLatch = null
+                resultRef.set(null)
+            }
+        }
+
+        private fun attemptCommand(
+            context: Context,
+            address: String,
+            bluetoothMac: String,
+            pin: String,
+            writeProto: ByteArray?,
+            timeoutMs: Long,
+        ): ByteArray {
+            val latch = CountDownLatch(1)
+            val token: Long
+            val macKey = normalizeAddress(bluetoothMac.ifBlank { address })
+            synchronized(lock) {
+                token = System.nanoTime()
+                commandToken = token
+                this.bluetoothMac = bluetoothMac
+                this.pin = pin
+                this.writeProto = writeProto
+                notifyChunks = ArrayList()
+                startResponse = null
+                commandSent = false
+                finished = false
+                doneLatch = latch
+                resultRef.set(null)
+                mtuAttempts = 0
+
+                val existing = gatt
+                val sameLink =
+                    existing != null &&
+                        connectedAddress != null &&
+                        normalizeAddress(connectedAddress!!) == macKey &&
+                        writeChar != null &&
+                        notifyChar != null
+                if (sameLink) {
+                    // Re-request MTU on reused links if a large write is pending.
+                    mtuRequested = negotiatedMtu >= 100
+                    handler.post { advance() }
+                } else {
+                    runCatching { existing?.disconnect() }
+                    runCatching { existing?.close() }
+                    gatt = null
+                    writeChar = null
+                    notifyChar = null
+                    discoveryStarted = false
+                    negotiatedMtu = 23
+                    mtuRequested = false
+                    awaitingMtu = false
+                    mtuAttempts = 0
+                    val adapter = bluetoothAdapter(context)
+                        ?: throw TempivoSensorException(
+                            TempivoSensorException.Code.RUNTIME_UNAVAILABLE,
+                            "Bluetooth is not available.",
+                        )
+                    if (!adapter.isEnabled) {
+                        throw TempivoSensorException(
+                            TempivoSensorException.Code.RUNTIME_UNAVAILABLE,
+                            "Bluetooth is not powered on.",
+                        )
+                    }
+                    // Always connect with the public Bluetooth MAC (CRC + stack). Avoid opaque SDK ids.
+                    val connectAddress = macKey
+                    val device =
+                        try {
+                            adapter.getRemoteDevice(connectAddress)
+                        } catch (e: IllegalArgumentException) {
+                            throw TempivoSensorException(
+                                TempivoSensorException.Code.CONNECT_FAILED,
+                                "Invalid BLE address.",
+                                e,
+                            )
+                        }
+                    connectedAddress = connectAddress
+                    handler.post {
+                        val g =
+                            if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.M) {
+                                device.connectGatt(context, false, callback, BluetoothDevice.TRANSPORT_LE)
+                            } else {
+                                @Suppress("DEPRECATION")
+                                device.connectGatt(context, false, callback)
+                            }
+                        synchronized(lock) {
+                            gatt = g
+                        }
+                    }
+                }
+            }
+
+            val ok = latch.await(timeoutMs, TimeUnit.MILLISECONDS)
+            if (!ok) {
+                fail(
+                    TempivoSensorException(
+                        TempivoSensorException.Code.UNKNOWN,
+                        "Raw config BLE timeout (no GATT response).",
+                    ),
+                )
+                latch.await(500, TimeUnit.MILLISECONDS)
+            }
+            val result =
+                resultRef.get()
+                    ?: throw TempivoSensorException(
+                        TempivoSensorException.Code.UNKNOWN,
+                        "Raw config BLE timeout (no GATT response).",
+                    )
+            return result.getOrThrow()
+        }
+
+        private fun requestMtuThenAdvance(g: BluetoothGatt) {
+            // Kept for callers: at most one MTU request per connection (Android 14+ ignores more).
+            if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.LOLLIPOP && !mtuRequested) {
+                mtuRequested = true
+                awaitingMtu = true
+                val ok = runCatching { g.requestMtu(517) }.getOrDefault(false)
+                if (ok) {
+                    handler.postDelayed({
+                        synchronized(lock) {
+                            if (!finished && awaitingMtu) {
+                                awaitingMtu = false
+                                advance()
+                            }
+                        }
+                    }, 1_500)
+                    return
+                }
+                awaitingMtu = false
+            }
+            advance()
+        }
+
+        private fun advance() {
+            synchronized(lock) {
+                if (finished) return
+                if (awaitingMtu) return
+                val g = gatt ?: return
+                val w = writeChar
+                val n = notifyChar
+                if (w == null || n == null) {
+                    if (!discoveryStarted) {
+                        discoveryStarted = true
+                        g.discoverServices()
+                    }
+                    return
+                }
+                if (!commandSent) {
+                    commandSent = true
+                    sendCommand(g, w)
+                }
+            }
+        }
+
+        private fun sendCommand(g: BluetoothGatt, write: BluetoothGattCharacteristic) {
+            val pinBytes =
+                pinPayloadBe3(pin)
+                    ?: run {
+                        fail(TempivoSensorException(TempivoSensorException.Code.INVALID_PIN, "PIN must be numeric (be3)."))
+                        return
+                    }
+            val payload =
+                if (writeProto != null) {
+                    pinBytes + writeProto!!
+                } else {
+                    // Get 0x0C: empty PIN payload after SDK pairing.
+                    ByteArray(0)
+                }
+            val frame = buildCommandFrame(bluetoothMac, cmd, payload)
+            // Never gate on negotiatedMtu. This HC7 answers MTU 23 on Android (even when we
+            // request 517; Android 14+ also ignores later requestMtu on the same link).
+            // WRITE_TYPE_DEFAULT lets the stack use ATT Prepare Write / Execute (long write)
+            // for frames larger than ATT payload, which is what set (0x0D) needs (~237 B).
+            write.writeType = BluetoothGattCharacteristic.WRITE_TYPE_DEFAULT
+            if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.TIRAMISU) {
+                g.writeCharacteristic(write, frame, BluetoothGattCharacteristic.WRITE_TYPE_DEFAULT)
+            } else {
+                @Suppress("DEPRECATION")
+                write.value = frame
+                @Suppress("DEPRECATION")
+                g.writeCharacteristic(write)
+            }
+            // Do not read yet: long writes (237 B at MTU 23) finish asynchronously.
+            // onCharacteristicWrite schedules the follow-up read / assemble.
+        }
+
+        private fun afterCommandWriteAck() {
+            val token = commandToken
+            val delayMs = if (writeProto != null) 200L else 100L
+            handler.postDelayed({
+                synchronized(lock) {
+                    if (finished || commandToken != token) return@synchronized
+                    val w = writeChar ?: return@synchronized
+                    val gg = gatt ?: return@synchronized
+                    if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.TIRAMISU) {
+                        gg.readCharacteristic(w)
+                    } else {
+                        @Suppress("DEPRECATION")
+                        gg.readCharacteristic(w)
+                    }
+                }
+            }, delayMs)
+            if (writeProto != null) {
+                handler.postDelayed({
+                    synchronized(lock) {
+                        if (commandToken == token) finishWriteIfReady()
+                    }
+                }, 1_500)
+            } else {
+                handler.postDelayed({
+                    synchronized(lock) {
+                        if (commandToken == token) tryAssemble()
+                    }
+                }, 1_200)
+            }
+        }
+
+        private fun succeed(data: ByteArray) {
+            if (finished) return
+            finished = true
+            resultRef.set(Result.success(data))
+            doneLatch?.countDown()
+        }
+
+        private fun fail(error: Throwable) {
+            if (finished) return
+            finished = true
+            resultRef.set(Result.failure(error))
+            doneLatch?.countDown()
+        }
+
+        private val callback =
+            object : BluetoothGattCallback() {
+                override fun onConnectionStateChange(g: BluetoothGatt, status: Int, newState: Int) {
+                    if (newState == BluetoothProfile.STATE_CONNECTED) {
+                        synchronized(lock) {
+                            writeChar = null
+                            notifyChar = null
+                            discoveryStarted = false
+                            negotiatedMtu = 23
+                            mtuRequested = false
+                            awaitingMtu = false
+                        }
+                        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.LOLLIPOP) {
+                            runCatching {
+                                g.requestConnectionPriority(BluetoothGatt.CONNECTION_PRIORITY_HIGH)
+                            }
+                        }
+                        // Delay after connect before the first (and only) requestMtu so the host
+                        // controller can stabilize the ACL link (typical guidance: 300–600 ms).
+                        // Android 14+ often applies ~517 on that first request and ignores later ones.
+                        // Peripheral may still answer 23; set then relies on ATT long write, not a
+                        // hardcoded 20/185 B gate. Max single ATT PDU is negotiatedMtu - 3 (≤514).
+                        awaitingMtu = true
+                        handler.postDelayed({
+                            synchronized(lock) {
+                                if (finished || gatt !== g) return@synchronized
+                                if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.LOLLIPOP && !mtuRequested) {
+                                    mtuRequested = true
+                                    val ok = runCatching { g.requestMtu(517) }.getOrDefault(false)
+                                    if (ok) {
+                                        handler.postDelayed({
+                                            synchronized(lock) {
+                                                if (!finished && awaitingMtu) {
+                                                    awaitingMtu = false
+                                                    advance()
+                                                }
+                                            }
+                                        }, 1_500)
+                                        return@synchronized
+                                    }
+                                }
+                                awaitingMtu = false
+                                advance()
+                            }
+                        }, 600)
+                    } else if (newState == BluetoothProfile.STATE_DISCONNECTED) {
+                        synchronized(lock) {
+                            writeChar = null
+                            notifyChar = null
+                            discoveryStarted = false
+                            if (!finished) {
+                                val msg =
+                                    if (status == 133) {
+                                        "Config GATT connect failed (status 133). Retrying."
+                                    } else {
+                                        "Sensor dropped the config link."
+                                    }
+                                fail(
+                                    TempivoSensorException(
+                                        TempivoSensorException.Code.CONNECT_FAILED,
+                                        msg,
+                                    ),
+                                )
+                            }
+                        }
+                    }
+                }
+
+                override fun onMtuChanged(g: BluetoothGatt, mtu: Int, status: Int) {
+                    synchronized(lock) {
+                        if (status == BluetoothGatt.GATT_SUCCESS && mtu > 0) {
+                            negotiatedMtu = mtu
+                        }
+                        awaitingMtu = false
+                    }
+                    // Start or continue discovery / command after MTU.
+                    advance()
+                }
+
+                override fun onServicesDiscovered(g: BluetoothGatt, status: Int) {
+                    if (status != BluetoothGatt.GATT_SUCCESS) {
+                        fail(TempivoSensorException(TempivoSensorException.Code.UNKNOWN, "GATT service discovery failed."))
+                        return
+                    }
+                    val transfer = g.getService(TRANSFER_SERVICE)
+                    val primary = g.getService(PRIMARY_SERVICE)
+                    val service = transfer ?: primary
+                    if (service == null) {
+                        fail(
+                            TempivoSensorException(
+                                TempivoSensorException.Code.UNSUPPORTED_COMMAND,
+                                "No sensor config GATT service.",
+                            ),
+                        )
+                        return
+                    }
+                    usingTransfer = transfer != null
+                    val writeUuid = if (usingTransfer) TRANSFER_WRITE else PRIMARY_WRITE
+                    val notifyUuid = if (usingTransfer) TRANSFER_NOTIFY else PRIMARY_NOTIFY
+                    val write = service.getCharacteristic(writeUuid)
+                    val notify = service.getCharacteristic(notifyUuid)
+                    if (write == null || notify == null) {
+                        fail(
+                            TempivoSensorException(
+                                TempivoSensorException.Code.UNSUPPORTED_COMMAND,
+                                "Missing write/notify characteristics.",
+                            ),
+                        )
+                        return
+                    }
+                    synchronized(lock) {
+                        writeChar = write
+                        notifyChar = notify
+                    }
+                    g.setCharacteristicNotification(notify, true)
+                    // Write char may also notify the start response on some FW.
+                    if ((write.properties and BluetoothGattCharacteristic.PROPERTY_NOTIFY) != 0 ||
+                        (write.properties and BluetoothGattCharacteristic.PROPERTY_INDICATE) != 0
+                    ) {
+                        g.setCharacteristicNotification(write, true)
+                    }
+                    val cccd = notify.getDescriptor(CCCD)
+                    if (cccd != null) {
+                        val enable = BluetoothGattDescriptor.ENABLE_NOTIFICATION_VALUE
+                        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.TIRAMISU) {
+                            g.writeDescriptor(cccd, enable)
+                        } else {
+                            @Suppress("DEPRECATION")
+                            cccd.value = enable
+                            @Suppress("DEPRECATION")
+                            g.writeDescriptor(cccd)
+                        }
+                    } else {
+                        advance()
+                    }
+                }
+
+                override fun onDescriptorWrite(
+                    g: BluetoothGatt,
+                    descriptor: BluetoothGattDescriptor,
+                    status: Int,
+                ) {
+                    if (status != BluetoothGatt.GATT_SUCCESS) {
+                        fail(TempivoSensorException(TempivoSensorException.Code.UNKNOWN, "Notify enable failed."))
+                        return
+                    }
+                    // Do not call requestMtu again here. Android 14+ ignores subsequent MTU
+                    // requests on the same connection; HC7 often stays at 23 anyway.
+                    advance()
+                }
+
+                override fun onCharacteristicWrite(
+                    g: BluetoothGatt,
+                    characteristic: BluetoothGattCharacteristic,
+                    status: Int,
+                ) {
+                    if (status != BluetoothGatt.GATT_SUCCESS) {
+                        fail(TempivoSensorException(TempivoSensorException.Code.UNKNOWN, "Config write failed ($status)."))
+                        return
+                    }
+                    afterCommandWriteAck()
+                }
+
+                @Deprecated("Deprecated in Java")
+                override fun onCharacteristicChanged(
+                    g: BluetoothGatt,
+                    characteristic: BluetoothGattCharacteristic,
+                ) {
+                    @Suppress("DEPRECATION")
+                    val value = characteristic.value ?: return
+                    onNotifyOrRead(characteristic.uuid, value, fromNotify = true)
+                }
+
+                override fun onCharacteristicChanged(
+                    g: BluetoothGatt,
+                    characteristic: BluetoothGattCharacteristic,
+                    value: ByteArray,
+                ) {
+                    onNotifyOrRead(characteristic.uuid, value, fromNotify = true)
+                }
+
+                @Deprecated("Deprecated in Java")
+                override fun onCharacteristicRead(
+                    g: BluetoothGatt,
+                    characteristic: BluetoothGattCharacteristic,
+                    status: Int,
+                ) {
+                    if (status != BluetoothGatt.GATT_SUCCESS) return
+                    @Suppress("DEPRECATION")
+                    val value = characteristic.value ?: return
+                    onNotifyOrRead(characteristic.uuid, value, fromNotify = false)
+                }
+
+                override fun onCharacteristicRead(
+                    g: BluetoothGatt,
+                    characteristic: BluetoothGattCharacteristic,
+                    value: ByteArray,
+                    status: Int,
+                ) {
+                    if (status != BluetoothGatt.GATT_SUCCESS) return
+                    onNotifyOrRead(characteristic.uuid, value, fromNotify = false)
+                }
+            }
+
+        private fun onNotifyOrRead(uuid: UUID, value: ByteArray, fromNotify: Boolean) {
+            synchronized(lock) {
+                if (finished || value.isEmpty()) return
+                val writeUuid = writeChar?.uuid
+                val notifyUuid = notifyChar?.uuid
+                // iOS accepts start response on the write characteristic for both read and notify.
+                if (uuid == writeUuid) {
+                    startResponse = value
+                    if (writeProto != null) finishWriteIfReady()
+                    return
+                }
+                if (writeProto == null && uuid == notifyUuid) {
+                    notifyChunks.add(value)
+                    tryAssemble()
+                }
+            }
+        }
+
+        private fun finishWriteIfReady() {
+            val resp = startResponse ?: return
+            if (writeProto == null) return
+            try {
+                parseStartResponse(bluetoothMac, cmd, resp)
+                succeed(ByteArray(0))
+            } catch (e: Throwable) {
+                fail(e)
+            }
+        }
+
+        private fun tryAssemble() {
+            startResponse?.let { resp ->
+                runCatching { parseStartResponse(bluetoothMac, cmd, resp) }
+            }
+            try {
+                val merged = assemble(bluetoothMac, notifyChunks, preferCode03 = usingTransfer)
+                if (merged.isNotEmpty()) succeed(merged)
+            } catch (_: Throwable) {
+                // Wait for more chunks until timeout.
+            }
+        }
+    }
+
+    private fun bluetoothAdapter(context: Context): BluetoothAdapter? {
+        val mgr = context.getSystemService(Context.BLUETOOTH_SERVICE) as? BluetoothManager
+        return mgr?.adapter
+    }
+
+    private fun normalizeAddress(address: String): String {
+        val h = address.replace(":", "").replace("-", "").trim()
+        if (h.length == 12 && h.all { it.isDigit() || it in 'a'..'f' || it in 'A'..'F' }) {
+            return h.chunked(2).joinToString(":") { it.uppercase() }
+        }
+        return address.uppercase()
+    }
+
+    private fun pinPayloadBe3(pin: String): ByteArray? {
+        val digits = pin.trim()
+        val n = digits.toLongOrNull() ?: return null
+        if (n < 0 || n > 0xFFFFFF) return null
+        return byteArrayOf(
+            ((n shr 16) and 0xFF).toByte(),
+            ((n shr 8) and 0xFF).toByte(),
+            (n and 0xFF).toByte(),
+        )
+    }
+
+    private fun macBytes(mac: String): ByteArray {
+        val h = mac.replace(":", "").replace("-", "").trim().lowercase()
+        if (h.length != 12 || !h.all { it in '0'..'9' || it in 'a'..'f' }) {
+            throw TempivoSensorException(TempivoSensorException.Code.INVALID_QR, "Invalid Bluetooth MAC.")
+        }
+        return ByteArray(6) { i ->
+            h.substring(i * 2, i * 2 + 2).toInt(16).toByte()
+        }
+    }
+
+    private fun crc16Ccitt(data: ByteArray): Int {
+        var crc = 0xFFFF
+        for (byte in data) {
+            val b = byte.toInt() and 0xFF
+            for (bit in 0 until 8) {
+                val inp = ((b shr (7 - bit)) and 1) == 1
+                val cbit = ((crc shr 15) and 1) == 1
+                crc = (crc shl 1) and 0xFFFF
+                if (cbit != inp) crc = crc xor 0x1021
+            }
+        }
+        return crc and 0xFFFF
+    }
+
+    private fun buildCommandFrame(mac: String, cmd: Byte, payload: ByteArray): ByteArray {
+        val m = runCatching { macBytes(mac) }.getOrElse { ByteArray(6) }
+        val body = ByteArray(2 + payload.size + 2)
+        body[0] = HDR_REQ
+        body[1] = cmd
+        System.arraycopy(payload, 0, body, 2, payload.size)
+        val crc = crc16Ccitt(m + body.copyOf(2 + payload.size))
+        body[body.size - 2] = ((crc shr 8) and 0xFF).toByte()
+        body[body.size - 1] = (crc and 0xFF).toByte()
+        return body
+    }
+
+    private fun parseStartResponse(mac: String, cmd: Byte, frame: ByteArray): ByteArray {
+        if (frame.size < 5) {
+            throw TempivoSensorException(TempivoSensorException.Code.UNKNOWN, "Short config response.")
+        }
+        if (frame[0] == 0x66.toByte()) {
+            throw TempivoSensorException(TempivoSensorException.Code.UNKNOWN, "Encrypted config response (key required).")
+        }
+        if (frame[0] != HDR_RSP) {
+            throw TempivoSensorException(TempivoSensorException.Code.UNKNOWN, "Unexpected config response header.")
+        }
+        if (frame[1] != cmd) {
+            throw TempivoSensorException(TempivoSensorException.Code.UNKNOWN, "Config command echo mismatch.")
+        }
+        val m = macBytes(mac)
+        val expect = crc16Ccitt(m + frame.copyOf(frame.size - 2))
+        val got = ((frame[frame.size - 2].toInt() and 0xFF) shl 8) or (frame[frame.size - 1].toInt() and 0xFF)
+        if (expect != got) {
+            throw TempivoSensorException(TempivoSensorException.Code.UNKNOWN, "Config response CRC mismatch.")
+        }
+        val st = frame[2].toInt() and 0xFF
+        if (st != 0) {
+            throw TempivoSensorException(TempivoSensorException.Code.INVALID_PIN, "Config command status $st.")
+        }
+        return frame.copyOfRange(3, frame.size - 2)
+    }
+
+    private fun assemble(mac: String, chunks: List<ByteArray>, preferCode03: Boolean): ByteArray {
+        val m = macBytes(mac)
+        var buf = ByteArray(0)
+        var merged = ByteArray(0)
+        var complete = false
+
+        fun crcValid(frame: ByteArray): Boolean {
+            if (frame.size < 4) return false
+            val expect = crc16Ccitt(m + frame.copyOf(frame.size - 2))
+            val got = ((frame[frame.size - 2].toInt() and 0xFF) shl 8) or (frame[frame.size - 1].toInt() and 0xFF)
+            return expect == got
+        }
+
+        fun feed(payload: ByteArray) {
+            var off = 0
+            val inc = payload
+            while (off < inc.size || (buf.size >= 2 && !complete)) {
+                if (buf.size < 2) {
+                    val need = 2 - buf.size
+                    val take = minOf(need, inc.size - off)
+                    if (take <= 0) break
+                    buf += inc.copyOfRange(off, off + take)
+                    off += take
+                    if (buf.size < 2) break
+                }
+                val flen = ((buf[0].toInt() and 0xFF) shl 8) or (buf[1].toInt() and 0xFF)
+                if (flen == 0) {
+                    complete = true
+                    buf = ByteArray(0)
+                    return
+                }
+                val missing = flen - buf.size
+                if (missing > 0) {
+                    val take = minOf(missing, inc.size - off)
+                    if (take <= 0) break
+                    buf += inc.copyOfRange(off, off + take)
+                    off += take
+                    if (buf.size < flen) continue
+                }
+                val frame = buf.copyOfRange(0, flen)
+                buf = if (buf.size > flen) buf.copyOfRange(flen, buf.size) else ByteArray(0)
+                if (!crcValid(frame)) continue
+                if (flen >= 4) {
+                    merged += frame.copyOfRange(2, flen - 2)
+                }
+            }
+        }
+
+        for (raw in chunks) {
+            if (raw.size >= 2 && raw[0] == NOTIFY_CONFIGURATION) {
+                feed(raw.copyOfRange(1, raw.size))
+            } else if (raw.size >= 4) {
+                feed(raw)
+            }
+            if (complete && merged.isNotEmpty()) break
+        }
+        if (!complete || merged.isEmpty()) {
+            throw TempivoSensorException(TempivoSensorException.Code.UNKNOWN, "Incomplete config transfer.")
+        }
+        return merged
+    }
+}