ble_link_kit 1.0.0

Flutter BLE connection framework for multi-protocol scanning, generic GATT transfer, framed channels, provisioning, and resumable OTA.

1.0.0 - 2026-07-20

P4 — Secure handoff

• Added transport-neutral secure handoff models and performHandoff for Wi-Fi, IP endpoint, and size-bounded custom descriptors over the existing P2 secure channel.
• Strictly validate IP ports as integers in 0..65535; custom blobs default to a configurable 4 KiB limit.

BREAKING

• Raised the package major version because platform-interface implementers must add session, secure-channel, security-policy, and event-stream members, and exhaustive BleErrorCode switches must handle all new values.

• Secure handoff now always requires an authenticated owner token with handoff scope. Empty/missing target capabilities are unsupported.

• Signed-advertisement HMAC input now binds profile and carrier; truncated tags must be 8–32 bytes. Firmware using the old unbound input must migrate.

• Native token envelopes now use schema version 1, reject corruption, and serialize mutations across all plugin instances in the process.

• Native security requirements persist across plugin recreation and process restart until an explicitly confirmed downgrade clears them.

• Malformed native byte responses and events now fail with stable protocolError values instead of being silently truncated or treated as an empty payload.

• Kept MethodChannelBleProvision internal-only and exposed only the neutral OpaqueTransportRoute contract for platform implementers. Native Android/iOS code now owns a per-device security gate for BLE/SPP provisioning and every payload-bearing raw write or framed send while symmetric security is required.

• setSecurityRequirement now only raises policy to requireSymmetric and returns a Future. Passing legacyAllowed is an error; downgrade requires clearSecurityRequirement(..., confirmInsecureDowngrade: true) and is synchronized to the native gate.

• Removed the public raw-key SecureSession.client and SecureSession.device factories. Sessions are created by authenticated secure-channel negotiation so callers cannot restart a nonce sequence with reused traffic keys.

• Removed the public MethodChannelBleProvision export and the global BleProvisionPlatform.instance registration path. They allowed direct native provision()/sppProvision() calls that bypassed facade security policy. Migrate application calls to BleLinkKit; tests can inject an abstract BleProvisionPlatform via BleLinkKit(platform: ...).

• Removed credential-aware provision(WifiCredentials) and sppProvision(...) from BleProvisionPlatform and its MethodChannel implementation. Existing BleLinkKit callers are unaffected. Platform-interface implementers must implement neutral sendOpaquePayload(OpaqueTransportRoute, Uint8List); credential wire encoding now belongs exclusively to the facade.

P3 — Identity & binding

• Added symmetric owner/guest binding-token models, lifecycle APIs, secure token storage boundary, stable identity errors, HMAC validation, revocation checks, and the P2-secured identity wire contract.

• Authenticated token kind and device binding, added persistent local revocation checks, and serialized secure identity request/response routing.

• Added Android Keystore-backed encrypted token persistence and iOS WhenUnlockedThisDeviceOnly Keychain persistence, both covering owner records and revocation state without exporting the device owner key.

• Added additive session-open capability and protocol-version negotiation on Dart, Android, and iOS.

• Added structured device descriptors, immutable session contexts, session lifecycle events, and the stable incompatibleProtocol error.

• Kept session-open itself plaintext: securityTier reports device capability, while P2 establishes authenticated encryption for symmetric devices.

0.4.0

Fixed

• Made empty-condition ScanProfile values explicit match-all profiles on Dart, Android, and iOS, and documented the catch-all payload use case.
• Snapshotted Android scan profiles at scan start; profile updates during a scan now take effect on the next scan.
• Added source-carried responseTimeout and otaChecksumMismatch failures for firmware/OTA operations and classified Android SPP failures without message inference.
• Persisted iOS restoration scan deadlines and duty-cycle parameters so restored scans continue only for their remaining wall-clock duration.
• Persisted iOS PowerProfile values with schema validation for restoration and cold starts.

BREAKING

• Added BleErrorCode.responseTimeout. Exhaustive switches over BleErrorCode must handle the new enum value.

0.3.0

• Added independent ScanProfile registration and multi-profile matching; after scan profiles are registered, scan events include raw advertisement service UUID, manufacturer data, service data, and transmit-power fields.
• Added generic GATT service discovery, characteristic read/write/subscribe APIs, value events, and negotiated-MTU queries.
• Added optional fragmented framed channels over arbitrary characteristic pairs using the existing reassembly and CRC16 codec.
• Decoupled scan, connect, disconnect, and raw GATT operations from ProvisionProtocolProfile; provisioning and OTA continue to require it.
• Preserved 0.2.0 source and runtime behavior when no scan profiles are registered; existing provisioning, OTA, power-profile, and Android SPP APIs remain backward compatible.

0.2.0

• Renamed from ble_provision_ota to ble_link_kit; 0.1.0 users must update the dependency name and imports.
• Added global and per-operation PowerProfile policies for scan power, connection priority, and preferred PHY.
• Added Android native scan modes, connection-priority requests, PHY selection, and connection-parameter update events.
• Added iOS software scan duty cycling; connection priority and PHY remain firmware/CoreBluetooth controlled.
• Extended capability reporting for PHY control, connection-priority control, and opportunistic scanning.
• Documented platform power differences and recommended firmware connection parameters.

0.1.0

• Initial cross-platform BLE Wi-Fi provisioning API for Android and iOS.
• Parameterized GATT UUIDs, device filters, and protocol operation/event names.
• Framed transport with CRC16, reconnect backoff, and resumable CRC32 OTA.
• iOS state restoration and Android connected-device foreground service.
• Android-only RFCOMM Serial Port Profile fallback.

Known issues: see the "Known issues (0.1.0)" section in README.md.