Warn for prometheus too, stub the runtime key methods under a yaml key, build the offer on esp32 idf

esphome/components/api/api_server.h

@@ -79,6 +79,17 @@ class APIServer final : public Component,
 #ifndef USE_API_NOISE_PSK_FROM_YAML
   bool save_noise_psk(noise::psk_t psk, bool make_active = true);
   bool clear_noise_psk(bool make_active = true);
+#else
+  // Stubs so a lambda calling these with a yaml key gets a clear error; only
+  // fire if instantiated
+  template<bool B = false> bool save_noise_psk(noise::psk_t, bool = true) {
+    static_assert(B, "save_noise_psk() needs a runtime provisioned key; remove the 'key' from 'api: encryption:'");
+    return false;
+  }
+  template<bool B = false> bool clear_noise_psk(bool = true) {
+    static_assert(B, "clear_noise_psk() needs a runtime provisioned key; remove the 'key' from 'api: encryption:'");
+    return false;
+  }
 #endif
   /// psk points at 32 bytes that live in flash for the life of the program
   void set_noise_psk(const uint8_t *psk) { this->noise_ctx_.set_psk(psk); }

esphome/components/esphome/ota/__init__.py

@@ -165,10 +165,10 @@ def ota_esphome_final_validate(config: ConfigType) -> None:
                 CONF_OTA,
                 CONF_PASSWORD,
             )
-    # Only the web_server component keeps the listener up; the captive
-    # portal's copy is the recovery path
+    # web_server and prometheus keep the shared listener up; the captive
+    # portal's copy only exists on the fallback AP and is the recovery path
     if (
-        CONF_WEB_SERVER in full_conf
+        (CONF_WEB_SERVER in full_conf or "prometheus" in full_conf)
         and any(conf.get(CONF_PLATFORM) == CONF_WEB_SERVER for conf in full_ota_conf)
         and any(
             CONF_ENCRYPTION in conf

esphome/espota2.py

@@ -240,6 +240,7 @@ class _EncryptionAttempt:
         self.plaintext_fallback = False
 
 
+# Remove before 2027.3.0: only the fallback decision needs this distinction
 class OTAHandshakeNetworkError(OTANetworkError):
     """A transport failure inside the noise handshake; retrying encrypted may succeed."""
 

tests/component_tests/ota/test_esphome_ota.py

@@ -266,13 +266,14 @@ def test_encryption_explicit_key_with_runtime_provisioned_api_accepted() -> None
         fv.full_config.reset(token)
 
 
+@pytest.mark.parametrize("component", ["web_server", "prometheus"])
 def test_encryption_with_web_server_ota_warns(
-    caplog: pytest.LogCaptureFixture,
+    caplog: pytest.LogCaptureFixture, component: str
 ) -> None:
-    """With the web_server component the plaintext /update endpoint is always
-    on; the combination validates with a warning."""
+    """web_server and prometheus keep the shared listener up, so the
+    plaintext /update endpoint is always on and the combination warns."""
     full_conf = {
-        "web_server": {},
+        component: {},
         CONF_OTA: [
             _make_ota_config(port=3232, **{CONF_ENCRYPTION: {CONF_KEY: OTHER_KEY}}),
             {CONF_PLATFORM: "web_server", CONF_ID: ID("ota_ws", is_manual=False)},

tests/components/ota/test-api_key_offer.esp32-idf.yaml

@@ -0,0 +1,2 @@
+packages:
+  ota: !include api_key_offer.yaml