Merge branch 'time-filter-posix-tz' into time-filter-posix-tz-cpptest

[time] Use add_define in the benchmark override too
[time] Touch posix_tz test to run the C++ unit tests in CI
2026-09-04 12:06:01 +00:00 · 2026-08-23 21:56:54 -05:00 · 2026-08-23 21:56:10 -05:00 · 2026-08-23 21:48:09 -05:00 · 2026-08-23 21:42:18 -05:00 · 2026-08-23 21:00:37 -05:00
1398 changed files with 16794 additions and 7105 deletions
@@ -32,7 +32,7 @@ runs:
      # detects the activated venv via ``VIRTUAL_ENV`` so the venv layout
      # downstream jobs rely on is preserved.
      if: steps.cache-venv.outputs.cache-hit != 'true'
-      uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+      uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
      with:
        enable-cache: true
        # Pull request saves land in per-PR scopes nothing else can
@@ -49,7 +49,7 @@ runs:
        python -m venv venv
        source venv/bin/activate
        python --version
-        uv pip install -r requirements.txt -r requirements_test.txt
+        uv pip install -r requirements.txt -r requirements_dev.txt -r requirements_test.txt
        uv pip install -e .
    - name: Create Python virtual environment
      if: steps.cache-venv.outputs.cache-hit != 'true' && runner.os == 'Windows'
@@ -58,5 +58,5 @@ runs:
        python -m venv venv
        source ./venv/Scripts/activate
        python --version
-        uv pip install -r requirements.txt -r requirements_test.txt
+        uv pip install -r requirements.txt -r requirements_dev.txt -r requirements_test.txt
        uv pip install -e .
@@ -70,6 +70,7 @@ async function isStackedPr(github, context) {
 async function detectMergeBranch(github, context) {
  const labels = new Set();
  const baseRef = context.payload.pull_request.base.ref;
+  const defaultBranch = context.payload.repository.default_branch;

  if (baseRef === 'release') {
    labels.add('merging-to-release');
@@ -78,7 +79,7 @@ async function detectMergeBranch(github, context) {
  } else if (await isStackedPr(github, context)) {
    // GitHub manages the merge order for a stack, so these are not blocked.
    labels.add('stacked-pr');
-  } else if (baseRef !== 'dev') {
+  } else if (baseRef !== defaultBranch) {
    // A chain built by hand: it must not merge until its base branch does.
    labels.add('chained-pr');
  }
@@ -43,14 +43,14 @@ const WITHOUT_SCHEMA = 'CODEOWNERS = ["@esphome/core"]';

 // Builds a fresh context for detectMergeBranch tests instead of mutating the
 // shared CONTEXT fixture above (which other describe blocks rely on).
-function makeMergeContext(baseRef, { stack } = {}) {
+function makeMergeContext(baseRef, { stack, defaultBranch = 'dev' } = {}) {
  const pull_request = { number: 1, base: { ref: baseRef } };
  if (stack !== undefined) {
    pull_request.stack = stack;
  }
  return {
    repo: { owner: 'esphome', repo: 'esphome' },
-    payload: { pull_request }
+    payload: { pull_request, repository: { default_branch: defaultBranch } }
  };
 }

@@ -136,6 +136,21 @@ describe('detectMergeBranch', () => {
    assert.deepEqual(Array.from(labels).sort(), ['chained-pr']);
    assert.equal(state.calls, 1);
  });
+
+  it('base ref matches default branch adds no labels', async () => {
+    const { github } = makeStackGithub({ stack: null });
+    const context = makeMergeContext('other', { defaultBranch: 'other' });
+    const labels = await detectMergeBranch(github, context);
+    assert.deepEqual(Array.from(labels).sort(), []);
+  });
+
+  it('base ref dev when the default branch is main adds chained-pr', async () => {
+    const { github } = makeStackGithub({ stack: null });
+    const context = makeMergeContext('dev', { defaultBranch: 'main' });
+    const labels = await detectMergeBranch(github, context);
+    assert.deepEqual(Array.from(labels).sort(), ['chained-pr']);
+  });
+
 });

 // ---------------------------------------------------------------------------
@@ -29,7 +29,7 @@ jobs:
      - name: Set up uv
        # ``--system`` (below) installs into the setup-python interpreter;
        # no venv is created or restored by this workflow.
-        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
        with:
          enable-cache: true
          # Pull-request-only workflow: a save could never be shared and
@@ -41,10 +41,32 @@ jobs:
          version: "0.11.15"

      - name: Install apt dependencies
+        # PR-only workflow, so nothing on dev could seed a shared apt cache
+        # entry; the cached apt action would save one copy per PR. Plain apt
+        # with every call bounded: the apt.conf.d timeouts make a dead
+        # mirror fail over in seconds, and timeout runs under sudo so it can
+        # kill apt-get itself. Install without update first: image lists are
+        # fresh, and the index refresh is what a congested mirror makes slow.
+        timeout-minutes: 15
        run: |
-          sudo apt update
-          sudo apt-cache show protobuf-compiler
-          sudo apt install -y protobuf-compiler
+          sudo tee /etc/apt/apt.conf.d/99ci-acquire-timeouts >/dev/null <<'EOF'
+          Acquire::Retries "1";
+          Acquire::http::Timeout "15";
+          Acquire::https::Timeout "15";
+          EOF
+          # Common path: the image's package lists are fresh enough.
+          if sudo DEBIAN_FRONTEND=noninteractive timeout -k 15 90 \
+              apt-get install -y protobuf-compiler; then
+            protoc --version
+            exit 0
+          fi
+          # Rescue path: refresh the lists once with a generous bound; the
+          # apt config already fails a stalled mirror over quickly.
+          sudo DEBIAN_FRONTEND=noninteractive timeout -k 10 30 \
+            dpkg --configure -a || true
+          sudo timeout -k 15 300 apt-get update
+          sudo DEBIAN_FRONTEND=noninteractive timeout -k 15 300 \
+            apt-get install -y protobuf-compiler
          protoc --version
      - name: Install python dependencies
        run: uv pip install --system aioesphomeapi -c requirements.txt -r requirements_dev.txt
@@ -67,7 +67,7 @@ jobs:
        with:
          python-version: "3.12"
      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0

      - name: Determine tag and whether to push
        id: tag
@@ -153,7 +153,7 @@ jobs:
        with:
          python-version: "3.12"
      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0

      - name: Log in to the GitHub container registry
        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
@@ -49,7 +49,7 @@ jobs:
        # detects the activated venv via ``VIRTUAL_ENV`` so downstream jobs
        # that ``. venv/bin/activate`` see an identical layout.
        if: steps.cache-venv.outputs.cache-hit != 'true'
-        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
        with:
          enable-cache: true
          # Pull request saves land in per-PR scopes nothing else can
@@ -68,6 +68,22 @@ jobs:
          uv pip install -r requirements.txt -r requirements_dev.txt -r requirements_test.txt
          uv pip install -e .

+  seed-apt-cache:
+    name: Seed apt package cache
+    runs-on: ubuntu-24.04
+    # PR-branch cache saves are invisible to other PRs, so dev/beta/release
+    # pushes seed the one shared entry PR jobs restore. The key is derived
+    # only from the package list and version; keep both identical in every
+    # step that restores it. In ci-status needs so a broken seed fails dev.
+    if: github.event_name == 'push'
+    timeout-minutes: 10
+    steps:
+      - name: Install apt packages (cached)
+        uses: awalsh128/cache-apt-pkgs-action@553a35bb8ebd9fcabcb1c9451aa4c98e1b4ca8a9 # v1.6.3
+        with:
+          packages: libsdl2-dev ccache
+          version: 1.1
+
  determine-jobs:
    name: Determine which jobs to run
    runs-on: ubuntu-24.04
@@ -179,6 +195,7 @@ jobs:
          . venv/bin/activate
          script/ci-custom.py
          script/build_codeowners.py --check
+          script/build_alias_registry.py --check
          script/build_language_schema.py --check
          script/generate-esp32-boards.py --check
          script/generate-rp2-boards.py --check
@@ -322,7 +339,8 @@ jobs:

  integration-tests:
    name: Run integration tests (${{ matrix.bucket.name }})
-    runs-on: ubuntu-latest
+    # Must match seed-apt-cache's image: the apt cache key has no OS in it.
+    runs-on: ubuntu-24.04
    needs:
      - common
      - determine-jobs
@@ -334,24 +352,16 @@ jobs:
    steps:
      - name: Check out code from GitHub
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - name: Install ccache
-        # Speeds up the host compiles: tests in a bucket compile overlapping
-        # component sets, so later tests reuse earlier tests' objects.
-        run: |
-          sudo apt-get update -qq
-          sudo apt-get install -y --no-install-recommends ccache
-      - name: Restore ccache (restore-only)
-        # esphome stores the PlatformIO ccache under the machine-global cache
-        # dir (see _ccache_env() in esphome/platformio/toolchain.py). The
-        # bucket-name prefix prefers a same-bucket seed; the bare prefix falls
-        # back to any seed when the bucket layout differs from dev.
-        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+      - name: Install apt packages (cached)
+        # ccache speeds up the host compiles. A cache hit never touches apt
+        # (mirror outages cannot hang the job); the timeout bounds the cold
+        # path. Packages and version must match seed-apt-cache exactly;
+        # libsdl2-dev is unused here and carried only for cache-key parity.
+        timeout-minutes: 10
+        uses: awalsh128/cache-apt-pkgs-action@553a35bb8ebd9fcabcb1c9451aa4c98e1b4ca8a9 # v1.6.3
        with:
-          path: ~/.cache/esphome/platformio-ccache
-          key: integration-ccache-${{ matrix.bucket.name }}-${{ github.sha }}
-          restore-keys: |
-            integration-ccache-${{ matrix.bucket.name }}-
-            integration-ccache-
+          packages: libsdl2-dev ccache
+          version: 1.1
      - name: Set up Python 3.13
        id: python
        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
@@ -366,7 +376,7 @@ jobs:
      - name: Set up uv
        # Only needed on cache miss to populate the venv.
        if: steps.cache-venv.outputs.cache-hit != 'true'
-        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
        with:
          enable-cache: true
          # Pull request saves land in per-PR scopes nothing else can
@@ -400,14 +410,6 @@ jobs:
        # esphome stores the PlatformIO ccache under the machine-global cache
        # dir (see _ccache_env() in esphome/platformio/toolchain.py).
        run: CCACHE_DIR="$HOME/.cache/esphome/platformio-ccache" ccache -s
-      - name: Save ccache
-        # Pull request saves land in per-PR scopes nothing else can reuse;
-        # dev pushes seed the shared copy instead.
-        if: github.event_name != 'pull_request'
-        uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: ~/.cache/esphome/platformio-ccache
-          key: integration-ccache-${{ matrix.bucket.name }}-${{ github.sha }}

  import-time:
    name: Check import esphome.__main__ time
@@ -440,12 +442,17 @@ jobs:
  benchmarks:
    name: Run CodSpeed benchmarks
    runs-on: ubuntu-24.04
+    timeout-minutes: 30
    needs:
      - common
      - determine-jobs
    if: >-
-      (github.event_name == 'push' && github.ref_name == 'dev') ||
-      (github.event_name == 'pull_request' && needs.determine-jobs.outputs.benchmarks == 'true')
+      github.repository == 'esphome/esphome' && (
+        (github.event_name == 'push' && github.ref_name == 'dev') ||
+        (github.event_name == 'pull_request' && needs.determine-jobs.outputs.benchmarks == 'true')
+      )
+    # CodSpeed benchmarks require a CodSpeed account linked to the repository to run
+    # (https://codspeed.io) -- disabled on forks that aren't esphome/esphome itself.
    steps:
      - name: Check out code from GitHub
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -459,12 +466,58 @@ jobs:
      - name: Build benchmarks
        id: build
        run: |
+          # pipefail: without it a failed build is masked by the grep/cut
+          # pipeline below, leaving BINARY empty and silently dropping every
+          # C++ benchmark from the run while the job still reports success.
+          set -o pipefail
          . venv/bin/activate
-          export BENCHMARK_LIB_CONFIG=$(python script/setup_codspeed_lib.py)
-          # --build-only prints BUILD_BINARY=<path> to stdout
-          BINARY=$(script/cpp_benchmark.py --all --build-only | grep '^BUILD_BINARY=' | tail -1 | cut -d= -f2-)
+          BENCHMARK_LIB_CONFIG=$(python script/setup_codspeed_lib.py)
+          export BENCHMARK_LIB_CONFIG
+          # --build-only prints BUILD_BINARY=<path> to stdout; the grep is
+          # non-fatal so a missing marker reaches the check below instead of
+          # tripping errexit at this assignment
+          BINARY=$(script/cpp_benchmark.py --all --build-only | { grep '^BUILD_BINARY=' || true; } | tail -1 | cut -d= -f2-)
+          if [ -z "$BINARY" ]; then
+            echo "::error::Benchmark build did not report a binary path"
+            exit 1
+          fi
          echo "binary=$BINARY" >> $GITHUB_OUTPUT

+      - name: Bound apt fetches and pre-install libc6-dbg
+        # The CodSpeed runner installs valgrind + libc6-dbg via its own
+        # unbounded apt-get update; per-invocation apt options cannot reach
+        # it. The apt.conf.d timeouts below bound every later apt call in
+        # this job, the runner's included. Pre-installing libc6-dbg lets the
+        # runner skip apt once its valgrind cache is restored (it checks
+        # ``dpkg -s libc6-dbg``, so the cache action's unregistered restores
+        # would not count). Install without update first: image lists are
+        # fresh, and the index refresh is what a congested mirror makes
+        # slow. Best effort; the job timeout is the last backstop.
+        timeout-minutes: 15
+        continue-on-error: true
+        run: |
+          sudo tee /etc/apt/apt.conf.d/99ci-acquire-timeouts >/dev/null <<'EOF'
+          Acquire::Retries "1";
+          Acquire::http::Timeout "15";
+          Acquire::https::Timeout "15";
+          EOF
+          if dpkg -s libc6-dbg >/dev/null 2>&1; then
+            echo "libc6-dbg already installed"
+            exit 0
+          fi
+          # Common path: the image's package lists are fresh enough.
+          if sudo DEBIAN_FRONTEND=noninteractive timeout -k 15 90 \
+              apt-get install -y libc6-dbg; then
+            exit 0
+          fi
+          # Rescue path: refresh the lists once with a generous bound; the
+          # apt config already fails a stalled mirror over quickly.
+          sudo DEBIAN_FRONTEND=noninteractive timeout -k 10 30 \
+            dpkg --configure -a || true
+          sudo timeout -k 15 300 apt-get update
+          sudo DEBIAN_FRONTEND=noninteractive timeout -k 15 300 \
+            apt-get install -y libc6-dbg
+
      - name: Run CodSpeed benchmarks
        uses: CodSpeedHQ/action@4296e51e7041e24dadb86d1d6e8b9320d223dbe8 # v5.0.3
        with:
@@ -549,24 +602,29 @@ jobs:
          fetch-depth: 2

      - name: Restore Python
+        id: restore-python
        uses: ./.github/actions/restore-python
        with:
          python-version: ${{ env.DEFAULT_PYTHON }}
          cache-key: ${{ needs.common.outputs.cache-key }}

+      # Key on the exact Python version as well: LibreTiny creates a venv under
+      # ~/.platformio/penv whose interpreter is a symlink into the runner's
+      # hosted toolcache, so a cache saved on an older runner image breaks once
+      # a new image ships a newer patch release and drops the old interpreter.
      - name: Cache platformio
        if: github.ref == 'refs/heads/dev' && matrix.pio_cache_key
        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: ~/.platformio
-          key: platformio-${{ matrix.pio_cache_key }}-${{ hashFiles('platformio.ini') }}
+          key: platformio-${{ matrix.pio_cache_key }}-${{ steps.restore-python.outputs.python-version }}-${{ hashFiles('platformio.ini') }}

      - name: Cache platformio
        if: github.ref != 'refs/heads/dev' && matrix.pio_cache_key
        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: ~/.platformio
-          key: platformio-${{ matrix.pio_cache_key }}-${{ hashFiles('platformio.ini') }}
+          key: platformio-${{ matrix.pio_cache_key }}-${{ steps.restore-python.outputs.python-version }}-${{ hashFiles('platformio.ini') }}

      - name: Cache ESP-IDF install
        if: matrix.cache_idf
@@ -883,12 +941,17 @@ jobs:
      - name: List components
        run: echo ${{ matrix.batch.components }}

-      - name: Install apt packages
-        # Not cached: this job is pull-request-only, so a cache save could
-        # never be shared and would only consume quota.
-        run: |
-          sudo apt-get update -qq
-          sudo apt-get install -y --no-install-recommends libsdl2-dev ccache
+      - name: Install apt packages (cached)
+        # A cache hit (seeded on dev by seed-apt-cache) never touches apt,
+        # so mirror outages cannot hang this PR-only job; the timeout bounds
+        # the cold path. Packages and version must match seed-apt-cache
+        # exactly. The action has no --no-install-recommends; same package
+        # set this job used before #17463.
+        timeout-minutes: 10
+        uses: awalsh128/cache-apt-pkgs-action@553a35bb8ebd9fcabcb1c9451aa4c98e1b4ca8a9 # v1.6.3
+        with:
+          packages: libsdl2-dev ccache
+          version: 1.1

      - name: Check out code from GitHub
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -1090,7 +1153,7 @@ jobs:
        # install step (order-of-magnitude faster on cold boots,
        # with its own wheel cache). actions/setup-python still
        # provides the interpreter.
-        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
        with:
          enable-cache: true
          # Pull request saves land in per-PR scopes nothing else can
@@ -1423,6 +1486,7 @@ jobs:
    # this check.
    needs:
      - common
+      - seed-apt-cache
      - determine-jobs
      - ci-custom
      - pylint
@@ -56,7 +56,7 @@ jobs:

      # Initializes the CodeQL tools for scanning.
      - name: Initialize CodeQL
-        uses: github/codeql-action/init@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
+        uses: github/codeql-action/init@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
        with:
          languages: ${{ matrix.language }}
          build-mode: ${{ matrix.build-mode }}
@@ -84,6 +84,6 @@ jobs:
          exit 1

      - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
+        uses: github/codeql-action/analyze@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
        with:
          category: "/language:${{matrix.language}}"
@@ -14,4 +14,4 @@ jobs:
    permissions:
      issues: write         # issues.lock on closed issues
      pull-requests: write  # issues.lock on closed pull requests
-    uses: esphome/workflows/.github/workflows/lock.yml@9f6577fd37b5cf773ab1b9be929714a0dcd15661  # 2026.7.0
+    uses: esphome/workflows/.github/workflows/lock.yml@0fdd5e311b7e744069166696072a1a9cbc5fbeb6  # 2026.8.1
@@ -123,7 +123,7 @@ jobs:
          python-version: "3.12"

      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0

      - name: Log in to docker hub
        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
@@ -202,7 +202,7 @@ jobs:
          merge-multiple: true

      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0

      - name: Log in to docker hub
        if: matrix.registry == 'dockerhub'
@@ -16,7 +16,7 @@ jobs:
    # No GITHUB_TOKEN permissions: the reusable workflow mints an ESPHome
    # GitHub App token so the labels, comments and closures come from
    # esphome[bot] instead of github-actions[bot].
-    uses: esphome/workflows/.github/workflows/stale.yml@61fd37a044cad4e9aa4303027b2a61b6a34da855  # main
+    uses: esphome/workflows/.github/workflows/stale.yml@a1c1485ab46ef41a84a6a9d8abd7fa4b7628fd70  # main
    secrets:
      ESPHOME_GITHUB_APP_PRIVATE_KEY: ${{ secrets.ESPHOME_GITHUB_APP_PRIVATE_KEY }}
    with:
@@ -47,7 +47,7 @@ jobs:
        # setup-python interpreter so subsequent ``prek`` /
        # ``script/run-in-env.py`` steps find the deps without a
        # ``uv run`` prefix.
-        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
        with:
          enable-cache: true
          # Pin uv version so the action does not have to fetch the
@@ -11,7 +11,7 @@ ci:
 repos:
  - repo: https://github.com/astral-sh/ruff-pre-commit
    # Ruff version.
-    rev: v0.16.0
+    rev: v0.16.3
    hooks:
      # Run the linter.
      - id: ruff
@@ -763,3 +763,13 @@ The project uses English for non-code content. When drafting documentation, code
 PR descriptions, and similar text, avoid technical jargon. Instead, express concepts in plain English,
 using standard technical terms only when required. Ensure the text is readily comprehensible to a wide
 audience, including non-native English speakers.
+
+## 10. Code Comments
+
+Code comments on individual lines should be used only where necessary to flag issues that may not be obvious
+on a simple reading of the code. Keep them short (e.g. 1 or 2 lines).
+
+Function and method comment blocks may include more detail as required to make
+calling contracts clear and document parameter usage, but should still be kept concise.
+
+Avoid redundancy and repetition; comments should never simply restate what the code already says.
@@ -381,6 +381,7 @@ esphome/components/nextion/switch/* @senexcrenshaw
 esphome/components/nextion/text_sensor/* @senexcrenshaw
 esphome/components/nfc/* @jesserockz @kbx81
 esphome/components/noblex/* @AGalfra
+esphome/components/noise/* @esphome/core
 esphome/components/npi19/* @bakerkj
 esphome/components/nrf52/* @tomaszduda23
 esphome/components/number/* @esphome/core
@@ -48,7 +48,7 @@ PROJECT_NAME           = ESPHome
 # could be handy for archiving the generated documentation or if some version
 # control system is used.

-PROJECT_NUMBER         = 2026.8.0b2
+PROJECT_NUMBER         = 2026.9.0-dev

 # Using the PROJECT_BRIEF tag one can provide an optional one line description
 # for a project that appears at the top of each page and should give viewer a
@@ -22,7 +22,7 @@ RUN \
    -r /requirements.txt

 # Install the ESPHome Device Builder dashboard.
-RUN uv pip install --no-cache-dir esphome-device-builder==1.9.6
+RUN uv pip install --no-cache-dir esphome-device-builder==1.12.4

 RUN \
    platformio settings set enable_telemetry No \
@@ -762,9 +762,11 @@ def _wrap_to_code(name, comp, yaml_util):
    async def wrapped(conf):
        cg.add(cg.LineComment(f"{name}:"))
        if comp.config_schema is not None:
-            conf_str = yaml_util.dump(conf)
+            # sort_keys: voluptuous fills defaults in set order, so an
+            # unsorted dump would churn main.cpp and relink every run
+            conf_str = yaml_util.dump(conf, sort_keys=True)
            conf_str = conf_str.replace("//", "")
-            # remove tailing \ to avoid multi-line comment warning
+            # remove trailing \ to avoid multi-line comment warning
            conf_str = conf_str.replace("\\\n", "\n")
            cg.add(cg.LineComment(indent(conf_str)))
        await coro(conf)
@@ -2732,7 +2734,8 @@ def run_esphome(argv):
                conf_path.name,
            )

-    if config is None:
+    cache_missed = config is None
+    if cache_missed:
        from esphome.config import read_config

        config = read_config(
@@ -2741,26 +2744,25 @@ def run_esphome(argv):
            # Snapshot only needed by `esphome config --no-defaults`.
            snapshot_user_config=getattr(args, "no_defaults", False),
        )
-        # Refresh the cache so the next upload/logs hits the fast path
-        # instead of re-running read_config. Skip when the storage
-        # sidecar is absent (no compile has run): the cache would
-        # never be loaded back, so writing secrets to disk is wasted.
-        if cache_eligible and config is not None:
-            from esphome.compiled_config import save_compiled_config
-            from esphome.storage_json import ext_storage_path
-
-            if ext_storage_path(conf_path.name).exists():
-                save_compiled_config(config)
-    if config is None:
-        return 2
+        if config is None:
+            return 2
    CORE.config = config

    # Fallback for platforms whose validators didn't set the toolchain
    # (only the esp32 component reads esp32.framework.toolchain). All
-    # other platforms only support PlatformIO today.
+    # other platforms only support PlatformIO today. Must run before the
+    # cache refresh below so its sidecar records the same toolchain a
+    # compile would.
    if CORE.toolchain is None:
        CORE.toolchain = Toolchain.PLATFORMIO

+    # Refresh the cache so the next upload/logs hits the fast path
+    # instead of re-running read_config.
+    if cache_eligible and cache_missed:
+        from esphome.compiled_config import save_compiled_config_and_sidecar
+
+        save_compiled_config_and_sidecar(config)
+
    if args.command not in POST_CONFIG_ACTIONS:
        safe_print(f"Unknown command {args.command}")
        return 1
@@ -3,7 +3,12 @@
 import json
 from pathlib import Path

-from esphome.components.esp32 import get_esp32_variant, idf_version
+from esphome.components.esp32 import (
+    get_esp32_variant,
+    get_excluded_builtin_components,
+    get_managed_component_require_names,
+    idf_version,
+)
 import esphome.config_validation as cv
 from esphome.core import CORE
 from esphome.framework_helpers import (
@@ -67,6 +72,13 @@ def has_discovered_components() -> bool:
    return get_available_components() is not None


+def _cmake_quote(value: str) -> str:
+    """Quote a cmake arg value for a set() line. add_cmake_arg rejects
+    whitespace, quotes, and '$', so only backslashes need escaping."""
+    escaped = value.replace("\\", "\\\\")
+    return f'"{escaped}"'
+
+
 def get_project_cmakelists(minimal: bool = False) -> str:
    """Generate the top-level CMakeLists.txt for ESP-IDF project.

@@ -109,6 +121,15 @@ def get_project_cmakelists(minimal: bool = False) -> str:
        else ""
    )

+    # CMake variables registered via cg.add_cmake_arg(). Emitted before
+    # include(project.cmake) so values like EXCLUDE_COMPONENTS are already
+    # set when project.cmake seeds the component list, and on minimal
+    # (discovery) writes too so excluded components never register.
+    cmake_args = "\n".join(
+        f"set({name} {_cmake_quote(value)})"
+        for name, value in sorted(CORE.cmake_args.items())
+    )
+
    # Per-project list exposed as a CMake variable so converted PIO libs
    # can reference ${ESPHOME_PROJECT_MANAGED_COMPONENTS} without baking
    # project-specific names into their cached CMakeLists.
@@ -119,8 +140,6 @@ def get_project_cmakelists(minimal: bool = False) -> str:
    # runs as a separate CMake script invocation that doesn't load the
    # project's top-level CMakeLists; without this, ${ESPHOME_PROJECT_
    # MANAGED_COMPONENTS} in a converted-lib REQUIRES expands to empty).
-    from esphome.components.esp32 import get_managed_component_require_names
-
    managed_components_property = "\n".join(
        f"idf_build_set_property(ESPHOME_PROJECT_MANAGED_COMPONENTS {name} APPEND)"
        for name in get_managed_component_require_names()
@@ -131,12 +150,22 @@ def get_project_cmakelists(minimal: bool = False) -> str:
    # component's REQUIRES including real IDF components). Referenced by
    # src/CMakeLists and by each converted PIO lib's CMakeLists. Skipped
    # on minimal writes because project_description.json may be stale.
+    # Excluded components are dropped here as well: a stale
+    # project_description.json from a build without exclusions may still
+    # list them, and requiring an excluded component pulls it back into
+    # the build (IDF requirement expansion overrides EXCLUDE_COMPONENTS).
+    # Derived from the EXCLUDE_COMPONENTS cmake arg emitted above so the
+    # two can never disagree within one generated file.
    builtin_components_property = (
        ""
        if minimal
        else "\n".join(
            f"idf_build_set_property(ESPHOME_PROJECT_BUILTIN_COMPONENTS {name} APPEND)"
-            for name in sorted(get_available_components() or [])
+            for name in sorted(
+                set(get_available_components() or []).difference(
+                    CORE.cmake_args.get("EXCLUDE_COMPONENTS", "").split(";")
+                )
+            )
        )
    )

@@ -163,6 +192,8 @@ set(CMAKE_NINJA_FORCE_RESPONSE_FILE 1)
 set(IDF_TARGET {idf_target})
 set(EXTRA_COMPONENT_DIRS ${{CMAKE_SOURCE_DIR}}/src)

+{cmake_args}
+
 include($ENV{{IDF_PATH}}/tools/cmake/project.cmake)

 {cpp_standard_options}
@@ -264,3 +295,13 @@ def write_project(minimal: bool = False) -> None:
        CORE.relative_src_path("CMakeLists.txt"),
        get_component_cmakelists(),
    )
+
+    # Snapshot the exclusion set so has_outdated_files() can trigger a
+    # discovery reconfigure when it changes. Excluded components never
+    # register in project_description.json, so re-including one (e.g. a
+    # config gains mqtt) requires a fresh discovery pass before the
+    # ESPHOME_PROJECT_BUILTIN_COMPONENTS property can list it.
+    write_file_if_changed(
+        CORE.relative_build_path("exclude_components.esphomeinternal"),
+        ";".join(get_excluded_builtin_components()),
+    )
@@ -63,6 +63,17 @@ def get_ini_content():
    # Add extra script for C++ flags
    CORE.add_platformio_option("extra_scripts", [f"pre:{CXX_FLAGS_FILE_NAME}"])

+    # Add CMake args. A user-supplied value (str or list) is deliberately
+    # replaced; this option was always overwritten at FINAL priority.
+    if CORE.cmake_args:
+        CORE.add_platformio_option(
+            "board_build.cmake_extra_args",
+            " ".join(
+                f"-D{name}={value}" for name, value in sorted(CORE.cmake_args.items())
+            ),
+            replace=True,
+        )
+
    content = "[platformio]\n"
    content += f"description = ESPHome {__version__}\n"

@@ -25,6 +25,7 @@ from esphome.cpp_generator import (  # noqa: F401
    add,
    add_build_flag,
    add_build_unflag,
+    add_cmake_arg,
    add_cxx_build_flag,
    add_define,
    add_global,
@@ -18,9 +18,9 @@ from pathlib import Path
 from typing import Any

 from esphome.const import __version__ as ESPHOME_VERSION
-from esphome.core import CORE, Lambda
+from esphome.core import CORE, EsphomeError, Lambda
 from esphome.helpers import write_file
-from esphome.storage_json import StorageJSON, ext_storage_path
+from esphome.storage_json import StorageJSON, ext_storage_path, storage_path
 from esphome.types import ConfigType

 _LOGGER = logging.getLogger(__name__)
@@ -65,7 +65,71 @@ def save_compiled_config(config: ConfigType) -> None:
        # non-basic dict key), so every upload/logs pays the slow path.
        _LOGGER.warning("Cannot cache the validated config: %s", err)
    except Exception as err:  # noqa: BLE001  # pylint: disable=broad-except
-        _LOGGER.debug("Skipping compiled config cache write: %s", err)
+        # Likely persistent (permissions, full disk): every upload/logs
+        # pays the slow path until it clears, so surface it.
+        _LOGGER.warning("Skipping compiled config cache write: %s", err)
+
+
+def save_compiled_config_and_sidecar(config: ConfigType) -> None:
+    """Refresh the cache from the upload/logs fallback (CORE.config must be set).
+
+    The cache is only written when a complete sidecar is on disk:
+    load_compiled_config can't use it otherwise, and it holds resolved
+    secrets.
+    """
+    if _refresh_sidecar():
+        save_compiled_config(config)
+
+
+def _refresh_sidecar() -> bool:
+    """Ensure a complete sidecar is on disk; True when one is.
+
+    Writes one (without claiming a build) when missing or wizard-only.
+    Failures are non-fatal; the next upload/logs pays the slow path again.
+    """
+    try:
+        path = storage_path()
+        try:
+            old = StorageJSON.load_strict(path)
+        except Exception as err:  # noqa: BLE001  # pylint: disable=broad-except
+            # Present but unreadable: it may hold a real build's metadata,
+            # and a fresh rewrite would also stop the next compile from
+            # cleaning a possibly incoherent build tree.
+            _LOGGER.warning(
+                "Not caching: storage sidecar %s is unreadable (%s)", path, err
+            )
+            return False
+        if old is not None and old.can_apply_to_core():
+            # Compile-written; nothing to refresh.
+            return True
+        if CORE.build_path is not None and CORE.build_path.exists():
+            # An unvalidated build tree: its absent or mismatched sidecar
+            # is what makes the next compile wipe it, so don't vouch for
+            # a build this run never saw.
+            _LOGGER.warning(
+                "Not caching: build tree %s has no matching sidecar; "
+                "'esphome compile' will settle it",
+                CORE.build_path,
+            )
+            return False
+        new = StorageJSON.from_esphome_core(CORE, old, claim_build=False)
+        if not new.can_apply_to_core():
+            _LOGGER.warning("Not caching: rebuilt storage sidecar is still incomplete")
+            return False
+        new.save(path)
+        return True
+    except (OSError, EsphomeError) as err:
+        # write_file wraps OSError into EsphomeError. Persistent
+        # (unwritable storage dir), so surface that every upload/logs
+        # pays the slow path.
+        _LOGGER.warning("Could not refresh the storage sidecar: %s", err)
+    except Exception:  # noqa: BLE001  # pylint: disable=broad-except
+        # A structural bug; keep the traceback so it isn't mistaken
+        # for the I/O failure above.
+        _LOGGER.warning(
+            "Unexpected error refreshing the storage sidecar", exc_info=True
+        )
+    return False


 def load_compiled_config(conf_path: Path) -> ConfigType | None:
@@ -98,11 +162,8 @@ def load_compiled_config(conf_path: Path) -> ConfigType | None:
        return None

    storage = StorageJSON.load(ext_storage_path(conf_path.name))
-    if storage is None:
-        return None
-    # apply_to_core assumes a real compile wrote the sidecar; wizard-only
-    # sidecars leave both of these unset and can't drive upload/logs.
-    if not storage.core_platform and not storage.target_platform:
+    if storage is None or not storage.can_apply_to_core():
+        _LOGGER.debug("Ignoring compiled config cache: sidecar missing or incomplete")
        return None
    storage.apply_to_core()
    return config
@@ -0,0 +1,10 @@
+"""Component alias registry.
+
+Generated by script/build_alias_registry.py - do not edit manually.
+See the component-alias section of esphome/loader.py.
+"""
+
+# alias -> (canonical component, removal version or None)
+COMPONENT_ALIASES: dict[str, tuple[str, str | None]] = {
+    "rp2040": ("rp2", "2027.7.0"),
+}
@@ -6,6 +6,7 @@ from esphome.const import (
    STATE_CLASS_MEASUREMENT,
    UNIT_METER,
 )
+from esphome.types import ConfigType

 CODEOWNERS = ["@MrSuicideParrot"]
 DEPENDENCIES = ["uart"]
@@ -35,7 +36,7 @@ FINAL_VALIDATE_SCHEMA = uart.final_validate_device_schema(
 )


-async def to_code(config):
+async def to_code(config: ConfigType) -> None:
    var = await sensor.new_sensor(config)
    await cg.register_component(var, config)
    await uart.register_uart_device(var, config)
@@ -6,6 +6,7 @@ from esphome.const import (
    STATE_CLASS_MEASUREMENT,
    UNIT_MILLIMETER,
 )
+from esphome.types import ConfigType

 CODEOWNERS = ["@TH-Braemer"]
 DEPENDENCIES = ["uart"]
@@ -35,7 +36,7 @@ FINAL_VALIDATE_SCHEMA = uart.final_validate_device_schema(
 )


-async def to_code(config):
+async def to_code(config: ConfigType) -> None:
    var = await sensor.new_sensor(config)
    await cg.register_component(var, config)
    await uart.register_uart_device(var, config)
@@ -3,6 +3,7 @@ import esphome.codegen as cg
 from esphome.components import stepper
 import esphome.config_validation as cv
 from esphome.const import CONF_DIR_PIN, CONF_ID, CONF_SLEEP_PIN, CONF_STEP_PIN
+from esphome.types import ConfigType

 a4988_ns = cg.esphome_ns.namespace("a4988")
 A4988 = a4988_ns.class_("A4988", stepper.Stepper, cg.Component)
@@ -17,7 +18,7 @@ CONFIG_SCHEMA = stepper.STEPPER_SCHEMA.extend(
 ).extend(cv.COMPONENT_SCHEMA)


-async def to_code(config):
+async def to_code(config: ConfigType) -> None:
    var = cg.new_Pvariable(config[CONF_ID])
    await cg.register_component(var, config)
    await stepper.register_stepper(var, config)
@@ -9,6 +9,7 @@ from esphome.const import (
    STATE_CLASS_MEASUREMENT,
    UNIT_GRAMS_PER_CUBIC_METER,
 )
+from esphome.types import ConfigType

 absolute_humidity_ns = cg.esphome_ns.namespace("absolute_humidity")
 AbsoluteHumidityComponent = absolute_humidity_ns.class_(
@@ -43,7 +44,7 @@ CONFIG_SCHEMA = (
 )


-async def to_code(config):
+async def to_code(config: ConfigType) -> None:
    var = await sensor.new_sensor(config)
    await cg.register_component(var, config)

@@ -4,6 +4,7 @@ from esphome.components import output
 import esphome.config_validation as cv
 from esphome.const import CONF_ID, CONF_METHOD, CONF_MIN_POWER
 from esphome.core import CORE
+from esphome.types import ConfigType

 CODEOWNERS = ["@glmnet"]

@@ -48,7 +49,13 @@ CONFIG_SCHEMA = cv.All(
 )


-async def to_code(config):
+async def to_code(config: ConfigType) -> None:
+    if CORE.is_esp32:
+        from esphome.components.esp32 import include_builtin_idf_component
+
+        # Re-enable the gptimer driver (excluded by default to save compile time)
+        include_builtin_idf_component("esp_driver_gptimer")
+
    if CORE.is_esp8266:
        # ac_dimmer uses setTimer1Callback which requires the waveform generator
        from esphome.components.esp8266.const import require_waveform
@@ -4,6 +4,9 @@ from esphome.components.light.effects import register_addressable_effect
 from esphome.components.light.types import AddressableLightEffect
 import esphome.config_validation as cv
 from esphome.const import CONF_NAME, CONF_UART_ID
+from esphome.core import ID
+from esphome.cpp_generator import MockObj
+from esphome.types import ConfigType

 DEPENDENCIES = ["uart"]

@@ -21,7 +24,7 @@ CONFIG_SCHEMA = cv.Schema({})
    "Adalight",
    {cv.GenerateID(CONF_UART_ID): cv.use_id(uart.UARTComponent)},
 )
-async def adalight_light_effect_to_code(config, effect_id):
+async def adalight_light_effect_to_code(config: ConfigType, effect_id: ID) -> MockObj:
    effect = cg.new_Pvariable(effect_id, config[CONF_NAME])
    await uart.register_uart_device(effect, config)
    return effect
@@ -1,3 +1,5 @@
+from typing import Any
+
 from esphome import pins
 import esphome.codegen as cg
 from esphome.components.esp32 import (
@@ -16,6 +18,7 @@ from esphome.components.esp32 import (
 import esphome.config_validation as cv
 from esphome.const import CONF_ANALOG, CONF_INPUT, CONF_NUMBER, PLATFORM_ESP8266
 from esphome.core import CORE
+from esphome.types import ConfigType

 CODEOWNERS = ["@esphome/core"]

@@ -225,7 +228,7 @@ ESP32_VARIANT_ADC2_PIN_TO_CHANNEL = {
 }


-def validate_adc_pin(value):
+def validate_adc_pin(value: Any) -> ConfigType | str:
    if str(value).upper() == "VCC":
        if CORE.is_rp2:
            return pins.internal_gpio_input_pin_schema(29)
@@ -3,7 +3,7 @@

 namespace esphome::adc {

-static const char *const TAG = "adc.common";
+static const char *const TAG = "adc";

 const LogString *sampling_mode_to_str(SamplingMode mode) {
  switch (mode) {
@@ -6,7 +6,7 @@

 namespace esphome::adc {

-static const char *const TAG = "adc.esp32";
+static const char *const TAG = "adc";

 adc_oneshot_unit_handle_t ADCSensor::shared_adc_handles[2] = {nullptr, nullptr};

@@ -13,7 +13,7 @@ ADC_MODE(ADC_VCC)

 namespace esphome::adc {

-static const char *const TAG = "adc.esp8266";
+static const char *const TAG = "adc";

 void ADCSensor::setup() {
 #ifndef USE_ADC_SENSOR_VCC
@@ -5,7 +5,7 @@

 namespace esphome::adc {

-static const char *const TAG = "adc.libretiny";
+static const char *const TAG = "adc";

 void ADCSensor::setup() {
 #ifndef USE_ADC_SENSOR_VCC
@@ -17,7 +17,7 @@

 namespace esphome::adc {

-static const char *const TAG = "adc.rp2";
+static const char *const TAG = "adc";

 // The on-die temperature sensor sits on the last ADC channel: input 4 on RP2040
 // and RP2350A, but input 8 on RP2350B, which has eight external channels rather
@@ -7,7 +7,7 @@

 namespace esphome::adc {

-static const char *const TAG = "adc.zephyr";
+static const char *const TAG = "adc";

 void ADCSensor::setup() {
  if (!adc_is_ready_dt(this->channel_)) {
@@ -52,7 +52,7 @@ _attenuation = cv.enum(ATTENUATION_MODES, lower=True)
 _sampling_mode = cv.enum(SAMPLING_MODES, lower=True)


-def validate_config(config):
+def validate_config(config: ConfigType) -> ConfigType:
    if config[CONF_RAW] and config.get(CONF_ATTENUATION, None) == "auto":
        raise cv.Invalid("Automatic attenuation cannot be used when raw output is set")

@@ -120,7 +120,7 @@ CONFIG_SCHEMA = cv.All(
 CONF_ADC_CHANNEL_ID = "adc_channel_id"


-def _overlay_io_channels():
+def _overlay_io_channels() -> str:
    channel_count = CORE.data[CONF_ADC_CHANNEL_ID]
    entries = ", ".join(f"<&adc {channel_id}>" for channel_id in range(channel_count))
    return f"""
@@ -132,7 +132,7 @@ def _overlay_io_channels():
            """


-async def to_code(config):
+async def to_code(config: ConfigType) -> None:
    var = cg.new_Pvariable(config[CONF_ID])
    await cg.register_component(var, config)
    await sensor.register_sensor(var, config)
@@ -2,6 +2,7 @@ import esphome.codegen as cg
 from esphome.components import spi
 import esphome.config_validation as cv
 from esphome.const import CONF_ID
+from esphome.types import ConfigType

 DEPENDENCIES = ["spi"]
 MULTI_CONF = True
@@ -17,7 +18,7 @@ CONFIG_SCHEMA = cv.Schema(
 ).extend(spi.spi_device_schema(cs_pin_required=True))


-async def to_code(config):
+async def to_code(config: ConfigType) -> None:
    var = cg.new_Pvariable(config[CONF_ID])
    await cg.register_component(var, config)
    await spi.register_spi_device(var, config)
@@ -2,6 +2,7 @@ import esphome.codegen as cg
 from esphome.components import sensor, voltage_sampler
 import esphome.config_validation as cv
 from esphome.const import CONF_CHANNEL, CONF_ID
+from esphome.types import ConfigType

 from .. import ADC128S102, adc128s102_ns

@@ -28,7 +29,7 @@ CONFIG_SCHEMA = (
 )


-async def to_code(config):
+async def to_code(config: ConfigType) -> None:
    var = cg.new_Pvariable(
        config[CONF_ID],
        config[CONF_CHANNEL],
@@ -11,6 +11,7 @@ from esphome.const import (
    CONF_UPDATE_INTERVAL,
    CONF_WIDTH,
 )
+from esphome.types import ConfigType

 CODEOWNERS = ["@justfalter"]

@@ -38,7 +39,7 @@ CONFIG_SCHEMA = cv.All(
 )


-async def to_code(config):
+async def to_code(config: ConfigType) -> None:
    var = cg.new_Pvariable(config[CONF_ID])
    wrapped_light = await cg.get_variable(config[CONF_ADDRESSABLE_LIGHT_ID])
    cg.add(var.set_width(config[CONF_WIDTH]))
@@ -36,6 +36,7 @@ from esphome.const import (
    UNIT_WATT,
    UNIT_WATT_HOURS,
 )
+from esphome.cpp_generator import MockObj
 from esphome.types import ConfigType

 DEPENDENCIES = ["i2c"]
@@ -243,7 +244,7 @@ CONFIG_SCHEMA = cv.All(
 )


-async def neutral_channel(config):
+async def neutral_channel(config: ConfigType) -> MockObj:
    var = cg.new_Pvariable(config[CONF_ID])

    current = config[CONF_CURRENT]
@@ -257,7 +258,7 @@ async def neutral_channel(config):
    return var


-async def power_channel(config):
+async def power_channel(config: ConfigType) -> MockObj:
    var = cg.new_Pvariable(config[CONF_ID])

    for sensor_type in POWER_SENSOR_TYPES:
@@ -280,7 +281,7 @@ async def power_channel(config):
    return var


-async def to_code(config):
+async def to_code(config: ConfigType) -> None:
    var = cg.new_Pvariable(config[CONF_ID])
    await cg.register_component(var, config)
    await i2c.register_i2c_device(var, config)
@@ -23,6 +23,8 @@ from esphome.const import (
    UNIT_VOLT_AMPS_REACTIVE,
    UNIT_WATT,
 )
+from esphome.cpp_generator import MockObj
+from esphome.types import ConfigType

 CODEOWNERS = ["@angelnu"]

@@ -163,7 +165,7 @@ ADE7953_CONFIG_SCHEMA = cv.Schema(
 ).extend(cv.polling_component_schema("60s"))


-async def register_ade7953(var, config):
+async def register_ade7953(var: MockObj, config: ConfigType) -> None:
    await cg.register_component(var, config)

    if irq_pin_config := config.get(CONF_IRQ_PIN):
@@ -2,6 +2,7 @@ import esphome.codegen as cg
 from esphome.components import ade7953_base, i2c
 import esphome.config_validation as cv
 from esphome.const import CONF_ID
+from esphome.types import ConfigType

 DEPENDENCIES = ["i2c"]
 AUTO_LOAD = ["ade7953_base"]
@@ -20,7 +21,7 @@ CONFIG_SCHEMA = (
 )


-async def to_code(config):
+async def to_code(config: ConfigType) -> None:
    var = cg.new_Pvariable(config[CONF_ID])
    await i2c.register_i2c_device(var, config)
    await ade7953_base.register_ade7953(var, config)
@@ -2,6 +2,7 @@ import esphome.codegen as cg
 from esphome.components import ade7953_base, spi
 import esphome.config_validation as cv
 from esphome.const import CONF_ID
+from esphome.types import ConfigType

 DEPENDENCIES = ["spi"]
 AUTO_LOAD = ["ade7953_base"]
@@ -20,7 +21,7 @@ CONFIG_SCHEMA = (
 )


-async def to_code(config):
+async def to_code(config: ConfigType) -> None:
    var = cg.new_Pvariable(config[CONF_ID])
    await spi.register_spi_device(var, config)
    await ade7953_base.register_ade7953(var, config)
@@ -2,6 +2,7 @@ import esphome.codegen as cg
 from esphome.components import i2c
 import esphome.config_validation as cv
 from esphome.const import CONF_ID
+from esphome.types import ConfigType

 DEPENDENCIES = ["i2c"]
 MULTI_CONF = True
@@ -24,7 +25,7 @@ CONFIG_SCHEMA = (
 )


-async def to_code(config):
+async def to_code(config: ConfigType) -> None:
    var = cg.new_Pvariable(config[CONF_ID])
    await cg.register_component(var, config)
    await i2c.register_i2c_device(var, config)
@@ -11,6 +11,7 @@ from esphome.const import (
    STATE_CLASS_MEASUREMENT,
    UNIT_VOLT,
 )
+from esphome.types import ConfigType

 from .. import CONF_ADS1115_ID, ADS1115Component, ads1115_ns

@@ -86,7 +87,7 @@ CONFIG_SCHEMA = (
 )


-async def to_code(config):
+async def to_code(config: ConfigType) -> None:
    var = cg.new_Pvariable(config[CONF_ID])
    await sensor.register_sensor(var, config)
    await cg.register_component(var, config)
@@ -2,6 +2,7 @@ import esphome.codegen as cg
 from esphome.components import spi
 import esphome.config_validation as cv
 from esphome.const import CONF_ID
+from esphome.types import ConfigType

 CODEOWNERS = ["@solomondg1"]
 DEPENDENCIES = ["spi"]
@@ -23,7 +24,7 @@ CONFIG_SCHEMA = (
 )


-async def to_code(config):
+async def to_code(config: ConfigType) -> None:
    var = cg.new_Pvariable(config[CONF_ID])
    await cg.register_component(var, config)
    await spi.register_spi_device(var, config)
@@ -11,6 +11,7 @@ from esphome.const import (
    UNIT_CELSIUS,
    UNIT_VOLT,
 )
+from esphome.types import ConfigType

 from .. import ADS1118, CONF_ADS1118_ID, ads1118_ns

@@ -86,7 +87,7 @@ CONFIG_SCHEMA = cv.typed_schema(
 )


-async def to_code(config):
+async def to_code(config: ConfigType) -> None:
    var = await sensor.new_sensor(config)
    await cg.register_component(var, config)
    await cg.register_parented(var, config[CONF_ADS1118_ID])
@@ -17,6 +17,9 @@ from esphome.const import (
    UNIT_OHM,
    UNIT_PARTS_PER_BILLION,
 )
+from esphome.core import ID
+from esphome.cpp_generator import MockObj, TemplateArgsType
+from esphome.types import ConfigType

 CONF_RESISTANCE = "resistance"

@@ -62,7 +65,7 @@ CONFIG_SCHEMA = (
 FINAL_VALIDATE_SCHEMA = i2c.final_validate_device_schema("ags10", max_frequency="15khz")


-async def to_code(config):
+async def to_code(config: ConfigType) -> None:
    var = cg.new_Pvariable(config[CONF_ID])
    await cg.register_component(var, config)
    await i2c.register_i2c_device(var, config)
@@ -94,7 +97,12 @@ AGS10_NEW_I2C_ADDRESS_SCHEMA = cv.maybe_simple_value(
    AGS10_NEW_I2C_ADDRESS_SCHEMA,
    synchronous=True,
 )
-async def ags10newi2caddress_to_code(config, action_id, template_arg, args):
+async def ags10newi2caddress_to_code(
+    config: ConfigType,
+    action_id: ID,
+    template_arg: cg.TemplateArguments,
+    args: TemplateArgsType,
+) -> MockObj:
    var = cg.new_Pvariable(action_id, template_arg)
    await cg.register_parented(var, config[CONF_ID])
    address = await cg.templatable(config[CONF_ADDRESS], args, cg.uint8)
@@ -126,7 +134,12 @@ AGS10_SET_ZERO_POINT_SCHEMA = cv.Schema(
    AGS10_SET_ZERO_POINT_SCHEMA,
    synchronous=True,
 )
-async def ags10setzeropoint_to_code(config, action_id, template_arg, args):
+async def ags10setzeropoint_to_code(
+    config: ConfigType,
+    action_id: ID,
+    template_arg: cg.TemplateArguments,
+    args: TemplateArgsType,
+) -> MockObj:
    var = cg.new_Pvariable(action_id, template_arg)
    await cg.register_parented(var, config[CONF_ID])
    mode = await cg.templatable(
@@ -12,6 +12,7 @@ from esphome.const import (
    UNIT_CELSIUS,
    UNIT_PERCENT,
 )
+from esphome.types import ConfigType

 DEPENDENCIES = ["i2c"]

@@ -50,7 +51,7 @@ CONFIG_SCHEMA = (
 )


-async def to_code(config):
+async def to_code(config: ConfigType) -> None:
    var = cg.new_Pvariable(config[CONF_ID])
    await cg.register_component(var, config)
    await i2c.register_i2c_device(var, config)
@@ -4,6 +4,9 @@ from esphome.components import i2c
 from esphome.components.audio_dac import AudioDac
 import esphome.config_validation as cv
 from esphome.const import CONF_ID, CONF_MODE
+from esphome.core import ID
+from esphome.cpp_generator import MockObj, TemplateArgsType
+from esphome.types import ConfigType

 CODEOWNERS = ["@kbx81"]
 DEPENDENCIES = ["i2c"]
@@ -39,7 +42,12 @@ SET_AUTO_MUTE_ACTION_SCHEMA = cv.maybe_simple_value(
    SET_AUTO_MUTE_ACTION_SCHEMA,
    synchronous=True,
 )
-async def aic3204_set_volume_to_code(config, action_id, template_arg, args):
+async def aic3204_set_volume_to_code(
+    config: ConfigType,
+    action_id: ID,
+    template_arg: cg.TemplateArguments,
+    args: TemplateArgsType,
+) -> MockObj:
    paren = await cg.get_variable(config[CONF_ID])
    var = cg.new_Pvariable(action_id, template_arg, paren)

@@ -49,7 +57,7 @@ async def aic3204_set_volume_to_code(config, action_id, template_arg, args):
    return var


-async def to_code(config):
+async def to_code(config: ConfigType) -> None:
    var = cg.new_Pvariable(config[CONF_ID])
    await cg.register_component(var, config)
    await i2c.register_i2c_device(var, config)
@@ -2,6 +2,7 @@ import esphome.codegen as cg
 from esphome.components import ble_device_base
 import esphome.config_validation as cv
 from esphome.const import CONF_ID
+from esphome.types import ConfigType

 AUTO_LOAD = ["ble_device_base"]
 CODEOWNERS = ["@jeromelaban"]
@@ -21,6 +22,6 @@ CONFIG_SCHEMA = cv.All(
 )


-async def to_code(config):
+async def to_code(config: ConfigType) -> None:
    var = cg.new_Pvariable(config[CONF_ID])
    await ble_device_base.register_ble_device(var, config)
@@ -20,6 +20,8 @@ from esphome.const import (
    UNIT_PERCENT,
    UNIT_VOLT,
 )
+from esphome.cpp_generator import MockObj
+from esphome.types import ConfigType

 CODEOWNERS = ["@ncareau", "@jeromelaban"]

@@ -78,7 +80,7 @@ BASE_SCHEMA = (
 )


-async def wave_base_to_code(var, config):
+async def wave_base_to_code(var: MockObj, config: ConfigType) -> None:
    await cg.register_component(var, config)

    await ble_client.register_ble_node(var, config)
@@ -2,6 +2,7 @@ import esphome.codegen as cg
 from esphome.components import airthings_wave_base
 import esphome.config_validation as cv
 from esphome.const import CONF_ID
+from esphome.types import ConfigType

 DEPENDENCIES = airthings_wave_base.DEPENDENCIES

@@ -20,6 +21,6 @@ CONFIG_SCHEMA = airthings_wave_base.BASE_SCHEMA.extend(
 )


-async def to_code(config):
+async def to_code(config: ConfigType) -> None:
    var = cg.new_Pvariable(config[CONF_ID])
    await airthings_wave_base.wave_base_to_code(var, config)
@@ -83,7 +83,7 @@ CONFIG_SCHEMA = cv.All(
 )


-async def to_code(config):
+async def to_code(config: ConfigType) -> None:
    var = cg.new_Pvariable(config[CONF_ID])
    await airthings_wave_base.wave_base_to_code(var, config)

@@ -20,6 +20,7 @@ from esphome.const import (
    UNIT_VOLT,
    UNIT_WATT,
 )
+from esphome.types import ConfigType

 alpha3_ns = cg.esphome_ns.namespace("alpha3")
 Alpha3 = alpha3_ns.class_("Alpha3", ble_client.BLEClientNode, cg.PollingComponent)
@@ -68,7 +69,7 @@ CONFIG_SCHEMA = (
 )


-async def to_code(config):
+async def to_code(config: ConfigType) -> None:
    var = cg.new_Pvariable(config[CONF_ID])
    await cg.register_component(var, config)
    await ble_client.register_ble_node(var, config)
@@ -11,6 +11,7 @@ from esphome.const import (
    UNIT_CELSIUS,
    UNIT_PERCENT,
 )
+from esphome.types import ConfigType

 DEPENDENCIES = ["i2c"]

@@ -40,7 +41,7 @@ CONFIG_SCHEMA = (
 )


-async def to_code(config):
+async def to_code(config: ConfigType) -> None:
    var = cg.new_Pvariable(config[CONF_ID])
    await cg.register_component(var, config)
    await i2c.register_i2c_device(var, config)
@@ -11,6 +11,7 @@ from esphome.const import (
    UNIT_CELSIUS,
    UNIT_PERCENT,
 )
+from esphome.types import ConfigType

 DEPENDENCIES = ["i2c"]

@@ -42,7 +43,7 @@ CONFIG_SCHEMA = (
 )


-async def to_code(config):
+async def to_code(config: ConfigType) -> None:
    var = cg.new_Pvariable(config[CONF_ID])
    await cg.register_component(var, config)
    await i2c.register_i2c_device(var, config)
@@ -2,6 +2,7 @@ import esphome.codegen as cg
 from esphome.components import ble_client, cover
 import esphome.config_validation as cv
 from esphome.const import CONF_PIN
+from esphome.types import ConfigType

 CODEOWNERS = ["@buxtronix"]
 DEPENDENCIES = ["ble_client"]
@@ -27,7 +28,7 @@ CONFIG_SCHEMA = (
 )


-async def to_code(config):
+async def to_code(config: ConfigType) -> None:
    var = await cover.new_cover(config)
    cg.add(var.set_pin(config[CONF_PIN]))
    cg.add(var.set_invert_position(config[CONF_INVERT_POSITION]))
@@ -11,6 +11,7 @@ from esphome.const import (
    STATE_CLASS_MEASUREMENT,
    UNIT_PERCENT,
 )
+from esphome.types import ConfigType

 AUTO_LOAD = ["am43"]
 CODEOWNERS = ["@buxtronix"]
@@ -42,7 +43,7 @@ CONFIG_SCHEMA = (
 )


-async def to_code(config):
+async def to_code(config: ConfigType) -> None:
    var = cg.new_Pvariable(config[CONF_ID])
    await cg.register_component(var, config)
    await ble_client.register_ble_node(var, config)
@@ -2,6 +2,7 @@ import esphome.codegen as cg
 from esphome.components import binary_sensor, sensor
 import esphome.config_validation as cv
 from esphome.const import CONF_SENSOR_ID, CONF_THRESHOLD
+from esphome.types import ConfigType

 analog_threshold_ns = cg.esphome_ns.namespace("analog_threshold")

@@ -32,7 +33,7 @@ CONFIG_SCHEMA = (
 )


-async def to_code(config):
+async def to_code(config: ConfigType) -> None:
    var = await binary_sensor.new_binary_sensor(config)
    await cg.register_component(var, config)

@@ -6,6 +6,8 @@ from esphome.components.file.image import image_schema, write_image
 from esphome.components.image import Image_, validate_settings
 import esphome.config_validation as cv
 from esphome.const import CONF_ID, CONF_REPEAT
+from esphome.core import ID
+from esphome.cpp_generator import MockObj, TemplateArgsType
 from esphome.types import ConfigType

 CODEOWNERS = ["@syndlex"]
@@ -79,7 +81,12 @@ SET_FRAME_SCHEMA = cv.Schema(
@automation.register_action(
    "animation.set_frame", SetFrameAction, SET_FRAME_SCHEMA, synchronous=True
 )
-async def animation_action_to_code(config, action_id, template_arg, args):
+async def animation_action_to_code(
+    config: ConfigType,
+    action_id: ID,
+    template_arg: cg.TemplateArguments,
+    args: TemplateArgsType,
+) -> MockObj:
    paren = await cg.get_variable(config[CONF_ID])
    var = cg.new_Pvariable(action_id, template_arg, paren)

@@ -2,6 +2,7 @@ import esphome.codegen as cg
 from esphome.components import ble_client, climate
 import esphome.config_validation as cv
 from esphome.const import CONF_UNIT_OF_MEASUREMENT
+from esphome.types import ConfigType

 UNITS = {
    "f": "f",
@@ -28,7 +29,7 @@ CONFIG_SCHEMA = (
 )


-async def to_code(config):
+async def to_code(config: ConfigType) -> None:
    var = await climate.new_climate(config)
    await cg.register_component(var, config)
    await ble_client.register_ble_node(var, config)
@@ -1,6 +1,8 @@
 # Based on this datasheet:
 # https://www.mouser.ca/datasheet/2/678/AVGO_S_A0002854364_1-2574547.pdf

+from typing import Any
+
 import esphome.codegen as cg
 from esphome.components import i2c, sensor
 import esphome.config_validation as cv
@@ -11,6 +13,8 @@ from esphome.const import (
    STATE_CLASS_MEASUREMENT,
    UNIT_LUX,
 )
+from esphome.cpp_generator import MockObj
+from esphome.types import ConfigType

 DEPENDENCIES = ["i2c"]

@@ -55,7 +59,7 @@ AMBIENT_LIGHT_GAINS = {
 }


-def _validate_measurement_rate(value):
+def _validate_measurement_rate(value: Any) -> MockObj:
    value = cv.positive_time_period_milliseconds(value)
    return cv.enum(MEASUREMENT_RATES, int=True)(value.total_milliseconds)

@@ -85,7 +89,7 @@ CONFIG_SCHEMA = (
 )


-async def to_code(config):
+async def to_code(config: ConfigType) -> None:
    var = await sensor.new_sensor(config)
    await cg.register_component(var, config)
    await i2c.register_i2c_device(var, config)
@@ -2,6 +2,7 @@ import esphome.codegen as cg
 from esphome.components import i2c
 import esphome.config_validation as cv
 from esphome.const import CONF_ID
+from esphome.types import ConfigType

 DEPENDENCIES = ["i2c"]
 MULTI_CONF = True
@@ -57,7 +58,7 @@ CONFIG_SCHEMA = (
 )


-async def to_code(config):
+async def to_code(config: ConfigType) -> None:
    var = cg.new_Pvariable(config[CONF_ID])
    await cg.register_component(var, config)
    await i2c.register_i2c_device(var, config)
@@ -2,6 +2,7 @@ import esphome.codegen as cg
 from esphome.components import binary_sensor
 import esphome.config_validation as cv
 from esphome.const import CONF_DIRECTION, DEVICE_CLASS_MOVING
+from esphome.types import ConfigType

 from . import APDS9960, CONF_APDS9960_ID

@@ -19,7 +20,7 @@ CONFIG_SCHEMA = binary_sensor.binary_sensor_schema(
 )


-async def to_code(config):
+async def to_code(config: ConfigType) -> None:
    hub = await cg.get_variable(config[CONF_APDS9960_ID])
    var = await binary_sensor.new_binary_sensor(config)
    func = getattr(hub, f"set_{config[CONF_DIRECTION]}_direction_binary_sensor")
@@ -7,6 +7,7 @@ from esphome.const import (
    STATE_CLASS_MEASUREMENT,
    UNIT_PERCENT,
 )
+from esphome.types import ConfigType

 from . import APDS9960, CONF_APDS9960_ID

@@ -27,7 +28,7 @@ CONFIG_SCHEMA = sensor.sensor_schema(
 )


-async def to_code(config):
+async def to_code(config: ConfigType) -> None:
    hub = await cg.get_variable(config[CONF_APDS9960_ID])
    var = await sensor.new_sensor(config)
    func = getattr(hub, f"set_{config[CONF_TYPE]}_sensor")
@@ -1,11 +1,20 @@
-import base64
 import logging
+from typing import Any

 from esphome import automation
 from esphome.automation import Condition
 import esphome.codegen as cg
 from esphome.components.logger import request_log_listener
-from esphome.config_helpers import get_logger_level
+
+# ENCRYPTION_SCHEMA and validate_encryption_key are re-exported for external
+# components and downstream consumers that import them from api
+from esphome.components.noise import (  # noqa: F401
+    ENCRYPTION_SCHEMA,
+    decode_encryption_key,
+    encryption_schema,
+    validate_encryption_key,
+)
+from esphome.config_helpers import filter_source_files_from_defines, get_logger_level
 import esphome.config_validation as cv
 from esphome.const import (
    CONF_ACTION,
@@ -37,6 +46,10 @@ from esphome.core import CORE, ID, CoroPriority, EsphomeError, coroutine_with_pr
 from esphome.cpp_generator import MockObj, TemplateArgsType
 from esphome.types import ConfigFragmentType, ConfigType

+# Compat alias: downstream consumers (e.g. device-builder) referenced the
+# schema by its old private name before it moved to the noise component
+_encryption_schema = encryption_schema
+
 _LOGGER = logging.getLogger(__name__)

 DOMAIN = "api"
@@ -45,9 +58,15 @@ CODEOWNERS = ["@esphome/core"]


 def AUTO_LOAD(config: ConfigType) -> list[str]:
-    """Conditionally auto-load json only when capture_response is used."""
+    """Conditionally auto-load noise (encryption) and json (capture_response)."""
    base = ["socket"]

+    # A falsy config is a tooling probe for the maximal set (None from
+    # dependency resolution, {} from the components-graph platform probe);
+    # a validated config always carries defaults, never empty
+    if not config or CONF_ENCRYPTION in config:
+        base = base + ["noise"]
+
    # Check if any homeassistant.action/homeassistant.service has capture_response: true
    # This flag is set during config validation in _validate_response_config
    if not config or CORE.data.get(DOMAIN, {}).get(CONF_CAPTURE_RESPONSE, False):
@@ -129,20 +148,6 @@ def _register_provisioning_source(config: ConfigType) -> ConfigType:
    return config


-def validate_encryption_key(value):
-    value = cv.string_strict(value)
-    try:
-        decoded = base64.b64decode(value, validate=True)
-    except ValueError as err:
-        raise cv.Invalid("Invalid key format, please check it's using base64") from err
-
-    if len(decoded) != 32:
-        raise cv.Invalid("Encryption key must be base64 and 32 bytes long")
-
-    # Return original data for roundtrip conversion
-    return value
-
-
 CONF_SUPPORTS_RESPONSE = "supports_response"

 # Enum values in api::enums namespace
@@ -217,7 +222,7 @@ def _auto_detect_supports_response(config: ConfigType) -> ConfigType:
    return config


-def _validate_supports_response(value):
+def _validate_supports_response(value: Any) -> str:
    """Validate supports_response after auto-detection has set the value."""
    return cv.enum(SUPPORTS_RESPONSE_OPTIONS, lower=True)(value)

@@ -249,18 +254,6 @@ ACTIONS_SCHEMA = automation.validate_automation(
    ),
 )

-ENCRYPTION_SCHEMA = cv.Schema(
-    {
-        cv.Optional(CONF_KEY): cv.sensitive(validate_encryption_key),
-    }
-)
-
-
-def _encryption_schema(config):
-    if config is None:
-        config = {}
-    return ENCRYPTION_SCHEMA(config)
-

 def _consume_api_sockets(config: ConfigType) -> ConfigType:
    """Register socket needs for API component."""
@@ -296,7 +289,7 @@ CONFIG_SCHEMA = cv.All(
                CONF_SERVICES, group_of_exclusion=CONF_ACTIONS
            ): ACTIONS_SCHEMA,
            cv.Exclusive(CONF_ACTIONS, group_of_exclusion=CONF_ACTIONS): ACTIONS_SCHEMA,
-            cv.Optional(CONF_ENCRYPTION): _encryption_schema,
+            cv.Optional(CONF_ENCRYPTION): encryption_schema,
            cv.Optional(CONF_BATCH_DELAY, default="100ms"): cv.All(
                cv.positive_time_period_milliseconds,
                cv.Range(max=cv.TimePeriod(milliseconds=65535)),
@@ -393,7 +386,7 @@ async def to_code(config: ConfigType) -> None:

    if actions := config.get(CONF_ACTIONS, []):
        # Collect all triggers first, then register all at once with initializer_list
-        triggers: list[cg.Pvariable] = []
+        triggers: list[cg.MockObj] = []
        for conf in actions:
            func_args: list[tuple[MockObj, str]] = []
            service_template_args: list[MockObj] = []  # User service argument types
@@ -483,7 +476,7 @@ async def to_code(config: ConfigType) -> None:

    if (encryption_config := config.get(CONF_ENCRYPTION, None)) is not None:
        if key := encryption_config.get(CONF_KEY):
-            decoded = base64.b64decode(key)
+            decoded = decode_encryption_key(key)
            cg.add(var.set_noise_psk(list(decoded)))
            cg.add_define("USE_API_NOISE_PSK_FROM_YAML")
        else:
@@ -497,10 +490,6 @@ async def to_code(config: ConfigType) -> None:
            # and plaintext disabled. Only a factory reset can remove it.
            cg.add_define("USE_API_PLAINTEXT")
        cg.add_define("USE_API_NOISE")
-        cg.add_library("esphome/noise-c", "0.1.11")
-        # Enable optimized memzero/memcmp in libsodium instead of volatile byte loops
-        cg.add_build_flag("-DHAVE_WEAK_SYMBOLS=1")
-        cg.add_build_flag("-DHAVE_INLINE_ASM=1")
    else:
        cg.add_define("USE_API_PLAINTEXT")

@@ -581,7 +570,7 @@ async def homeassistant_service_to_code(
    action_id: ID,
    template_arg: cg.TemplateArguments,
    args: TemplateArgsType,
-):
+) -> MockObj:
    cg.add_define("USE_API_HOMEASSISTANT_SERVICES")
    serv = await cg.get_variable(config[CONF_ID])
    var = cg.new_Pvariable(action_id, template_arg, serv, False)
@@ -647,7 +636,7 @@ async def homeassistant_service_to_code(
    return var


-def validate_homeassistant_event(value):
+def validate_homeassistant_event(value: Any) -> str:
    value = cv.string(value)
    if not value.startswith("esphome."):
        raise cv.Invalid(
@@ -676,7 +665,12 @@ HOMEASSISTANT_EVENT_ACTION_SCHEMA = cv.Schema(
    HOMEASSISTANT_EVENT_ACTION_SCHEMA,
    synchronous=True,
 )
-async def homeassistant_event_to_code(config, action_id, template_arg, args):
+async def homeassistant_event_to_code(
+    config: ConfigType,
+    action_id: ID,
+    template_arg: cg.TemplateArguments,
+    args: TemplateArgsType,
+) -> MockObj:
    cg.add_define("USE_API_HOMEASSISTANT_SERVICES")
    serv = await cg.get_variable(config[CONF_ID])
    var = cg.new_Pvariable(action_id, template_arg, serv, True)
@@ -724,7 +718,12 @@ HOMEASSISTANT_TAG_SCANNED_ACTION_SCHEMA = cv.maybe_simple_value(
    HOMEASSISTANT_TAG_SCANNED_ACTION_SCHEMA,
    synchronous=True,
 )
-async def homeassistant_tag_scanned_to_code(config, action_id, template_arg, args):
+async def homeassistant_tag_scanned_to_code(
+    config: ConfigType,
+    action_id: ID,
+    template_arg: cg.TemplateArguments,
+    args: TemplateArgsType,
+) -> MockObj:
    cg.add_define("USE_API_HOMEASSISTANT_SERVICES")
    serv = await cg.get_variable(config[CONF_ID])
    var = cg.new_Pvariable(action_id, template_arg, serv, True)
@@ -740,7 +739,7 @@ CONF_SUCCESS = "success"
 CONF_ERROR_MESSAGE = "error_message"


-def _validate_api_respond_data(config):
+def _validate_api_respond_data(config: ConfigType) -> ConfigType:
    """Set flag during validation so AUTO_LOAD can include json component."""
    if CONF_DATA in config:
        CORE.data.setdefault(DOMAIN, {})[CONF_CAPTURE_RESPONSE] = True
@@ -824,18 +823,32 @@ API_CONNECTED_CONDITION_SCHEMA = cv.Schema(
@automation.register_condition(
    "api.connected", APIConnectedCondition, API_CONNECTED_CONDITION_SCHEMA
 )
-async def api_connected_to_code(config, condition_id, template_arg, args):
+async def api_connected_to_code(
+    config: ConfigType,
+    condition_id: ID,
+    template_arg: cg.TemplateArguments,
+    args: TemplateArgsType,
+) -> MockObj:
    var = cg.new_Pvariable(condition_id, template_arg)
    templ = await cg.templatable(config[CONF_STATE_SUBSCRIPTION_ONLY], args, cg.bool_)
    cg.add(var.set_state_subscription_only(templ))
    return var


+# user_services.cpp is only needed when user defined actions exist; the
+# frame helpers are fully #ifdef'd on the protocol defines set in to_code
+# (both are set when encryption is configured without a key).
+_define_filter = filter_source_files_from_defines(
+    {
+        "user_services.cpp": "USE_API_USER_DEFINED_ACTIONS",
+        "api_frame_helper_noise.cpp": "USE_API_NOISE",
+        "api_frame_helper_plaintext.cpp": "USE_API_PLAINTEXT",
+    }
+)
+
+
 def FILTER_SOURCE_FILES() -> list[str]:
-    """Filter out api_pb2_dump.cpp when proto message dumping is not enabled,
-    user_services.cpp when no services are defined, and protocol-specific
-    implementations based on encryption configuration."""
-    files_to_filter: list[str] = []
+    files_to_filter = _define_filter()

    # api_pb2_dump.cpp is only needed when HAS_PROTO_MESSAGE_DUMP is defined
    # This is a particularly large file that still needs to be opened and read
@@ -846,21 +859,4 @@ def FILTER_SOURCE_FILES() -> list[str]:
    if get_logger_level() != "VERY_VERBOSE":
        files_to_filter.append("api_pb2_dump.cpp")

-    # user_services.cpp is only needed when services are defined
-    config = CORE.config.get(DOMAIN, {})
-    if config and not config.get(CONF_ACTIONS) and not config[CONF_CUSTOM_SERVICES]:
-        files_to_filter.append("user_services.cpp")
-
-    # Filter protocol-specific implementations based on encryption configuration
-    encryption_config = config.get(CONF_ENCRYPTION) if config else None
-
-    # If encryption is not configured at all, we only need plaintext
-    if encryption_config is None:
-        files_to_filter.append("api_frame_helper_noise.cpp")
-    # If encryption is configured with a key, we only need noise
-    elif encryption_config.get(CONF_KEY):
-        files_to_filter.append("api_frame_helper_plaintext.cpp")
-    # If encryption is configured but no key is provided, we need both
-    # (this allows a plaintext client to provide a noise key)
-
    return files_to_filter
@@ -1002,8 +1002,12 @@ message GetTimeResponse {
  option (no_delay) = true;

  fixed32 epoch_seconds = 1;
-  string timezone = 2;
-  ParsedTimezone parsed_timezone = 3;
+  // Deprecated in 2026.9.0: clients still send this string for older firmware,
+  // but new firmware only reads parsed_timezone. Clients older than Home
+  // Assistant 2026.3.0 that send only the string leave the device on its
+  // codegen-configured timezone (or UTC).
+  string timezone = 2 [deprecated = true];
+  ParsedTimezone parsed_timezone = 3 [(track_presence) = true];
 }

 // ==================== USER-DEFINES SERVICES ====================
@@ -160,11 +160,6 @@ APIConnection::APIConnection(std::unique_ptr<socket::Socket> sock, APIServer *pa
 #else
 #error "No frame helper defined"
 #endif
-#ifdef USE_CAMERA
-  if (camera::Camera::instance() != nullptr) {
-    this->image_reader_ = std::unique_ptr<camera::CameraImageReader>{camera::Camera::instance()->create_image_reader()};
-  }
-#endif
 }

 void APIConnection::start() {
@@ -417,15 +412,15 @@ void APIConnection::finalize_iterator_sync_() {
 }

 void APIConnection::process_iterator_batch_(ComponentIterator &iterator) {
-  size_t initial_size = this->deferred_batch_.size();
-  size_t max_batch = MAX_INITIAL_PER_BATCH;
-  while (!iterator.completed() && (this->deferred_batch_.size() - initial_size) < max_batch) {
-    iterator.advance();
-  }
+  // Budget by remaining batch capacity so a pass cannot overfill the batch;
+  // stops early on a refused send and resumes next loop pass
+  size_t batch_size = this->deferred_batch_.size();
+  if (batch_size < MAX_INITIAL_BATCH_SIZE)
+    iterator.try_advance(MAX_INITIAL_BATCH_SIZE - batch_size);

-  // If the batch is full, process it immediately
-  // Note: iterator.advance() already calls schedule_batch_() via schedule_message_()
-  if (this->deferred_batch_.size() >= max_batch) {
+  // Flush immediately once enough is queued (not guaranteed every pass);
+  // partial batches go out via the batch timer or finalize_iterator_sync_()
+  if (this->deferred_batch_.size() >= MAX_INITIAL_BATCH_SIZE) {
    this->process_batch_();
  }
 }
@@ -448,7 +443,7 @@ void APIConnection::on_disconnect_response() {
 uint16_t APIConnection::fill_and_encode_entity_state(EntityBase *entity, StateResponseProtoMessage &msg,
                                                     CalculateSizeFn size_fn, MessageEncodeFn encode_fn,
                                                     APIConnection *conn, uint32_t remaining_size) {
-  msg.key = entity->get_entity_key();
+  msg.key = entity->get_object_id_hash();
 #ifdef USE_DEVICES
  msg.device_id = entity->get_device_id();
 #endif
@@ -459,7 +454,7 @@ uint16_t APIConnection::fill_and_encode_entity_info(EntityBase *entity, InfoResp
                                                    CalculateSizeFn size_fn, MessageEncodeFn encode_fn,
                                                    APIConnection *conn, uint32_t remaining_size) {
  // Set common fields that are shared by all entity types
-  msg.key = entity->get_entity_key();
+  msg.key = entity->get_object_id_hash();

  if (entity->has_own_name()) {
    msg.name = entity->get_name();
@@ -1140,6 +1135,7 @@ void APIConnection::try_send_camera_image_() {
  if (!this->image_reader_)
    return;

+  const auto *cam = camera::Camera::instance();
  // Send as many chunks as possible without blocking
  while (this->image_reader_->available()) {
    if (!this->helper_->can_write_without_blocking())
@@ -1149,11 +1145,11 @@ void APIConnection::try_send_camera_image_() {
    bool done = this->image_reader_->available() == to_send;

    CameraImageResponse msg;
-    msg.key = camera::Camera::instance()->get_entity_key();
+    msg.key = cam->get_object_id_hash();
    msg.set_data(this->image_reader_->peek_data_buffer(), to_send);
    msg.done = done;
 #ifdef USE_DEVICES
-    msg.device_id = camera::Camera::instance()->get_device_id();
+    msg.device_id = cam->get_device_id();
 #endif

    if (!this->send_message(msg)) {
@@ -1169,15 +1165,19 @@ void APIConnection::try_send_camera_image_() {
 void APIConnection::set_camera_state(std::shared_ptr<camera::CameraImage> image) {
  if (!this->flags_.state_subscription)
    return;
-  if (!this->image_reader_)
+  if (this->image_reader_ && this->image_reader_->available())
    return;
-  if (this->image_reader_->available())
+  if (!image->was_requested_by(esphome::camera::API_REQUESTER) && !image->was_requested_by(esphome::camera::IDLE))
    return;
-  if (image->was_requested_by(esphome::camera::API_REQUESTER) || image->was_requested_by(esphome::camera::IDLE)) {
-    this->image_reader_->set_image(std::move(image));
-    // Try to send immediately to reduce latency
-    this->try_send_camera_image_();
+  if (!this->image_reader_) {
+    // Created on the first image this connection will send, so connections
+    // that never receive one never pay for a reader. Only a registered
+    // camera's listener can reach this, so instance() is non-null here.
+    this->image_reader_ = std::unique_ptr<camera::CameraImageReader>{camera::Camera::instance()->create_image_reader()};
  }
+  this->image_reader_->set_image(std::move(image));
+  // Try to send immediately to reduce latency
+  this->try_send_camera_image_();
 }
 uint16_t APIConnection::try_send_camera_info(EntityBase *entity, APIConnection *conn, uint32_t remaining_size) {
  auto *camera = static_cast<camera::Camera *>(entity);
@@ -1204,31 +1204,28 @@ void APIConnection::on_get_time_response(const GetTimeResponse &value) {
  if (homeassistant::global_homeassistant_time != nullptr) {
    homeassistant::global_homeassistant_time->set_epoch_time(value.epoch_seconds);
 #if defined(USE_HOMEASSISTANT_TIMEZONE) && defined(USE_TIME_TIMEZONE)
-    if (!value.timezone.empty()) {
-      // Check if the sender provided pre-parsed timezone data.
-      // If std_offset is non-zero or DST rules are present, the parsed data was populated.
-      // For UTC (all zeros), string parsing produces the same result, so the fallback is equivalent.
+    // Apply only if the sender provided pre-parsed timezone data (Home Assistant 2026.3.0
+    // and newer); field presence distinguishes a genuine all-zero UTC timezone from an
+    // absent field. Older clients send only the deprecated timezone string, which is no
+    // longer decoded; for them the device keeps its codegen-configured timezone.
+    if (value.has_parsed_timezone) {
      const auto &pt = value.parsed_timezone;
-      if (pt.std_offset_seconds != 0 || pt.dst_start.type != enums::DST_RULE_TYPE_NONE) {
-        time::ParsedTimezone tz{};
-        tz.std_offset_seconds = pt.std_offset_seconds;
-        tz.dst_offset_seconds = pt.dst_offset_seconds;
-        tz.dst_start.time_seconds = pt.dst_start.time_seconds;
-        tz.dst_start.day = static_cast<uint16_t>(pt.dst_start.day);
-        tz.dst_start.type = static_cast<time::DSTRuleType>(pt.dst_start.type);
-        tz.dst_start.month = static_cast<uint8_t>(pt.dst_start.month);
-        tz.dst_start.week = static_cast<uint8_t>(pt.dst_start.week);
-        tz.dst_start.day_of_week = static_cast<uint8_t>(pt.dst_start.day_of_week);
-        tz.dst_end.time_seconds = pt.dst_end.time_seconds;
-        tz.dst_end.day = static_cast<uint16_t>(pt.dst_end.day);
-        tz.dst_end.type = static_cast<time::DSTRuleType>(pt.dst_end.type);
-        tz.dst_end.month = static_cast<uint8_t>(pt.dst_end.month);
-        tz.dst_end.week = static_cast<uint8_t>(pt.dst_end.week);
-        tz.dst_end.day_of_week = static_cast<uint8_t>(pt.dst_end.day_of_week);
-        time::set_global_tz(tz);
-      } else {
-        homeassistant::global_homeassistant_time->set_timezone(value.timezone.c_str(), value.timezone.size());
-      }
+      time::ParsedTimezone tz{};
+      tz.std_offset_seconds = pt.std_offset_seconds;
+      tz.dst_offset_seconds = pt.dst_offset_seconds;
+      tz.dst_start.time_seconds = pt.dst_start.time_seconds;
+      tz.dst_start.day = static_cast<uint16_t>(pt.dst_start.day);
+      tz.dst_start.type = static_cast<time::DSTRuleType>(pt.dst_start.type);
+      tz.dst_start.month = static_cast<uint8_t>(pt.dst_start.month);
+      tz.dst_start.week = static_cast<uint8_t>(pt.dst_start.week);
+      tz.dst_start.day_of_week = static_cast<uint8_t>(pt.dst_start.day_of_week);
+      tz.dst_end.time_seconds = pt.dst_end.time_seconds;
+      tz.dst_end.day = static_cast<uint16_t>(pt.dst_end.day);
+      tz.dst_end.type = static_cast<time::DSTRuleType>(pt.dst_end.type);
+      tz.dst_end.month = static_cast<uint8_t>(pt.dst_end.month);
+      tz.dst_end.week = static_cast<uint8_t>(pt.dst_end.week);
+      tz.dst_end.day_of_week = static_cast<uint8_t>(pt.dst_end.day_of_week);
+      time::set_global_tz(tz);
    }
 #endif
  }
@@ -2130,7 +2127,7 @@ bool APIConnection::send_noise_encryption_set_key_response_(const NoiseEncryptio
  }
 #endif

-  psk_t psk{};
+  noise::psk_t psk{};
  if (msg.key_len == 0) {
    if (this->parent_->clear_noise_psk(true)) {
      resp.success = true;
@@ -2139,7 +2136,7 @@ bool APIConnection::send_noise_encryption_set_key_response_(const NoiseEncryptio
    }
  } else if (base64_decode(msg.key, msg.key_len, psk.data(), psk.size()) != psk.size()) {
    ESP_LOGW(TAG, "Invalid encryption key length");
-  } else if (APINoiseContext::is_all_zeros(psk)) {
+  } else if (noise::NoiseContext::is_all_zeros(psk)) {
    // Accepting the reserved provisioning PSK would report success without
    // enabling encryption (or silently clear an existing key)
    ESP_LOGW(TAG, "Rejecting all-zero encryption key");
@@ -53,11 +53,11 @@ void log_dropped_message(const char *tag, int line, const LogString *what);

 // Keepalive timeout in milliseconds
 static constexpr uint32_t KEEPALIVE_TIMEOUT_MS = 60000;
-// Maximum number of entities to process in a single batch during initial state/info sending
-static constexpr size_t MAX_INITIAL_PER_BATCH = 34;
+// Deferred batch size cap during initial state/info sync
+static constexpr size_t MAX_INITIAL_BATCH_SIZE = 34;
 // Verify MAX_MESSAGES_PER_BATCH (defined in api_frame_helper.h) can hold the initial batch
-static_assert(MAX_MESSAGES_PER_BATCH >= MAX_INITIAL_PER_BATCH,
-              "MAX_MESSAGES_PER_BATCH must be >= MAX_INITIAL_PER_BATCH");
+static_assert(MAX_MESSAGES_PER_BATCH >= MAX_INITIAL_BATCH_SIZE,
+              "MAX_MESSAGES_PER_BATCH must be >= MAX_INITIAL_BATCH_SIZE");

 #ifdef USE_BENCHMARK
 class APIConnection;
@@ -36,7 +36,7 @@ static constexpr uint16_t MAX_MESSAGE_SIZE = 32768;  // 32 KiB for ESP32 and oth
 static constexpr uint16_t RX_BUF_NULL_TERMINATOR = 1;

 // Maximum number of messages to batch in a single write operation
-// Must be >= MAX_INITIAL_PER_BATCH in api_connection.h (enforced by static_assert there)
+// Must be >= MAX_INITIAL_BATCH_SIZE in api_connection.h (enforced by static_assert there)
 static constexpr size_t MAX_MESSAGES_PER_BATCH = 34;

 // Max client name length (e.g., "Home Assistant 2026.1.0.dev0" = 28 chars)
@@ -2,9 +2,9 @@
 #ifdef USE_API
 #ifdef USE_API_NOISE
 #include "api_connection.h"  // For ClientInfo struct
+#include "esphome/components/noise/noise.h"
 #include "esphome/core/application.h"
 #include "esphome/core/entity_base.h"
-#include "esphome/core/hal.h"
 #include "esphome/core/helpers.h"
 #include "esphome/core/log.h"
 #include "proto.h"
@@ -17,6 +17,14 @@

 namespace esphome::api {

+using noise::noise_err_to_logstr;
+
+// api_frame_helper.h keeps its own MAX_HANDSHAKE_SIZE because that header is
+// also compiled in plaintext-only builds without the noise component; keep
+// the two definitions from drifting apart.
+static_assert(MAX_HANDSHAKE_SIZE == noise::MAX_HANDSHAKE_SIZE,
+              "api and noise component handshake size limits must match");
+
 static const char *const TAG = "api.noise";
 #ifdef USE_ESP8266
 static constexpr char PROLOGUE_INIT[] PROGMEM = "NoiseAPIInit";
@@ -51,45 +59,6 @@ static constexpr size_t API_MAX_LOG_BYTES = 168;
 #define LOG_PACKET_RECEIVED(buffer) ((void) 0)
 #endif

-/// Convert a noise error code to a readable error
-const LogString *noise_err_to_logstr(int err) {
-  if (err == NOISE_ERROR_NO_MEMORY)
-    return LOG_STR("NO_MEMORY");
-  if (err == NOISE_ERROR_UNKNOWN_ID)
-    return LOG_STR("UNKNOWN_ID");
-  if (err == NOISE_ERROR_UNKNOWN_NAME)
-    return LOG_STR("UNKNOWN_NAME");
-  if (err == NOISE_ERROR_MAC_FAILURE)
-    return LOG_STR("MAC_FAILURE");
-  if (err == NOISE_ERROR_NOT_APPLICABLE)
-    return LOG_STR("NOT_APPLICABLE");
-  if (err == NOISE_ERROR_SYSTEM)
-    return LOG_STR("SYSTEM");
-  if (err == NOISE_ERROR_REMOTE_KEY_REQUIRED)
-    return LOG_STR("REMOTE_KEY_REQUIRED");
-  if (err == NOISE_ERROR_LOCAL_KEY_REQUIRED)
-    return LOG_STR("LOCAL_KEY_REQUIRED");
-  if (err == NOISE_ERROR_PSK_REQUIRED)
-    return LOG_STR("PSK_REQUIRED");
-  if (err == NOISE_ERROR_INVALID_LENGTH)
-    return LOG_STR("INVALID_LENGTH");
-  if (err == NOISE_ERROR_INVALID_PARAM)
-    return LOG_STR("INVALID_PARAM");
-  if (err == NOISE_ERROR_INVALID_STATE)
-    return LOG_STR("INVALID_STATE");
-  if (err == NOISE_ERROR_INVALID_NONCE)
-    return LOG_STR("INVALID_NONCE");
-  if (err == NOISE_ERROR_INVALID_PRIVATE_KEY)
-    return LOG_STR("INVALID_PRIVATE_KEY");
-  if (err == NOISE_ERROR_INVALID_PUBLIC_KEY)
-    return LOG_STR("INVALID_PUBLIC_KEY");
-  if (err == NOISE_ERROR_INVALID_FORMAT)
-    return LOG_STR("INVALID_FORMAT");
-  if (err == NOISE_ERROR_INVALID_SIGNATURE)
-    return LOG_STR("INVALID_SIGNATURE");
-  return LOG_STR("UNKNOWN");
-}
-
 /// Initialize the frame helper, returns OK if successful.
 APIError APINoiseFrameHelper::init() {
  APIError err = init_common_();
@@ -194,9 +163,9 @@ APIError APINoiseFrameHelper::loop() {
 */
 APIError APINoiseFrameHelper::try_read_frame_() {
  // read header
-  if (rx_header_buf_len_ < 3) {
+  if (rx_header_buf_len_ < noise::FRAME_HEADER_SIZE) {
    // no header information yet
-    uint8_t to_read = 3 - rx_header_buf_len_;
+    uint8_t to_read = static_cast<uint8_t>(noise::FRAME_HEADER_SIZE) - rx_header_buf_len_;
    ssize_t received = this->socket_->read(&rx_header_buf_[rx_header_buf_len_], to_read);
    APIError err = handle_socket_read_result_(received);
    if (err != APIError::OK) {
@@ -208,7 +177,7 @@ APIError APINoiseFrameHelper::try_read_frame_() {
      return APIError::WOULD_BLOCK;
    }

-    if (rx_header_buf_[0] != 0x01) {
+    if (rx_header_buf_[0] != noise::FRAME_INDICATOR) {
      state_ = State::FAILED;
      HELPER_LOG("Bad indicator byte %u", rx_header_buf_[0]);
      return APIError::BAD_INDICATOR;
@@ -348,15 +317,15 @@ APIError APINoiseFrameHelper::state_action_server_hello_() {
  return APIError::OK;
 }
 APIError APINoiseFrameHelper::state_action_handshake_() {
-  int action = noise_handshakestate_get_action(this->handshake_);
-  if (action == NOISE_ACTION_READ_MESSAGE) {
+  noise::NoiseResponderHandshake::Action action = this->handshake_.action();
+  if (action == noise::NoiseResponderHandshake::Action::ACTION_READ) {
    return this->state_action_handshake_read_();
-  } else if (action == NOISE_ACTION_WRITE_MESSAGE) {
+  } else if (action == noise::NoiseResponderHandshake::Action::ACTION_WRITE) {
    return this->state_action_handshake_write_();
  }
  // bad state for action
  this->state_ = State::FAILED;
-  HELPER_LOG("Bad action for handshake: %d", action);
+  HELPER_LOG("Bad action for handshake: %d", (int) action);
  return APIError::HANDSHAKESTATE_BAD_STATE;
 }
 APIError APINoiseFrameHelper::state_action_handshake_read_() {
@@ -368,20 +337,16 @@ APIError APINoiseFrameHelper::state_action_handshake_read_() {
  if (this->rx_buf_.empty()) {
    this->send_explicit_handshake_reject_(LOG_STR("Empty handshake message"));
    return APIError::BAD_HANDSHAKE_ERROR_BYTE;
-  } else if (this->rx_buf_[0] != 0x00) {
+  } else if (this->rx_buf_[0] != noise::HANDSHAKE_STATUS_OK) {
    HELPER_LOG("Bad handshake error byte: %u", this->rx_buf_[0]);
    this->send_explicit_handshake_reject_(LOG_STR("Bad handshake error byte"));
    return APIError::BAD_HANDSHAKE_ERROR_BYTE;
  }

-  NoiseBuffer mbuf;
-  noise_buffer_init(mbuf);
-  noise_buffer_set_input(mbuf, this->rx_buf_.data() + 1, this->rx_buf_.size() - 1);
-  int err = noise_handshakestate_read_message(this->handshake_, &mbuf, nullptr);
+  int err = this->handshake_.read_message(this->rx_buf_.data() + 1, this->rx_buf_.size() - 1);
  if (err != 0) {
    // Special handling for MAC failure
-    this->send_explicit_handshake_reject_(err == NOISE_ERROR_MAC_FAILURE ? LOG_STR("Handshake MAC failure")
-                                                                         : LOG_STR("Handshake error"));
+    this->send_explicit_handshake_reject_(noise::reject_reason_for(err));
    return this->handle_noise_error_(err, LOG_STR("noise_handshakestate_read_message"),
                                     APIError::HANDSHAKESTATE_READ_FAILED);
  }
@@ -390,18 +355,16 @@ APIError APINoiseFrameHelper::state_action_handshake_read_() {
 }
 APIError APINoiseFrameHelper::state_action_handshake_write_() {
  uint8_t buffer[65];
-  NoiseBuffer mbuf;
-  noise_buffer_init(mbuf);
-  noise_buffer_set_output(mbuf, buffer + 1, sizeof(buffer) - 1);
+  size_t msg_len = 0;

-  int err = noise_handshakestate_write_message(this->handshake_, &mbuf, nullptr);
+  int err = this->handshake_.write_message(buffer + 1, sizeof(buffer) - 1, msg_len);
  APIError aerr = this->handle_noise_error_(err, LOG_STR("noise_handshakestate_write_message"),
                                            APIError::HANDSHAKESTATE_WRITE_FAILED);
  if (aerr != APIError::OK)
    return aerr;
-  buffer[0] = 0x00;  // success
+  buffer[0] = noise::HANDSHAKE_STATUS_OK;

-  aerr = this->write_frame_(buffer, mbuf.size + 1);
+  aerr = this->write_frame_(buffer, msg_len + 1);
  if (aerr != APIError::OK)
    return aerr;
  return this->check_handshake_finished_();
@@ -409,33 +372,22 @@ APIError APINoiseFrameHelper::state_action_handshake_write_() {
 void APINoiseFrameHelper::send_explicit_handshake_reject_(const LogString *reason) {
  // Max reject message: "Bad handshake packet len" (24) + 1 (failure byte) = 25 bytes
  uint8_t data[32];
-  data[0] = 0x01;  // failure
-
-#ifdef USE_STORE_LOG_STR_IN_FLASH
-  // On ESP8266 with flash strings, we need to use PROGMEM-aware functions
-  size_t reason_len = strlen_P(reinterpret_cast<PGM_P>(reason));
-  reason_len = std::min(reason_len, sizeof(data) - 1);
-  if (reason_len > 0) {
-    memcpy_P(data + 1, reinterpret_cast<PGM_P>(reason), reason_len);
-  }
-#else
-  // Normal memory access
-  const char *reason_str = LOG_STR_ARG(reason);
-  size_t reason_len = strlen(reason_str);
-  reason_len = std::min(reason_len, sizeof(data) - 1);
-  if (reason_len > 0) {
-    // NOLINTNEXTLINE(bugprone-not-null-terminated-result) - binary protocol, not a C string
-    std::memcpy(data + 1, reason_str, reason_len);
-  }
-#endif
-
-  size_t data_size = reason_len + 1;
+  static_assert(sizeof(data) >= noise::MAC_FAILURE_PAYLOAD_SIZE,
+                "reject buffer must fit the MAC failure wire contract");
+  size_t data_size = noise::format_reject_payload(data, sizeof(data), reason);

  // temporarily remove failed state
  auto orig_state = state_;
  state_ = State::EXPLICIT_REJECT;
-  write_frame_(data, data_size);
-  state_ = orig_state;
+  APIError aerr = write_frame_(data, data_size);
+  if (aerr != APIError::OK) {
+    // Best effort; the reject reason is a diagnosis aid, not a protocol step
+    ESP_LOGW(TAG, "Sending handshake reject failed: %d", (int) aerr);
+  }
+  if (state_ == State::EXPLICIT_REJECT) {
+    // write_frame_ may have moved the state to FAILED; keep that decision
+    state_ = orig_state;
+  }
 }
 APIError APINoiseFrameHelper::read_packet(ReadPacketBuffer *buffer) {
  APIError aerr = this->check_data_state_();
@@ -492,12 +444,10 @@ APIError APINoiseFrameHelper::read_packet(ReadPacketBuffer *buffer) {
 // Returns APIError::OK on success.
 APIError APINoiseFrameHelper::encrypt_noise_message_(uint8_t *buf_start, uint16_t payload_size, uint8_t message_type,
                                                     uint16_t &encrypted_len_out) {
-  // Write noise header
-  buf_start[0] = 0x01;  // indicator
-  // buf_start[1], buf_start[2] to be set after encryption
+  // The noise frame header is written after encryption, when the size is known

  // Write message header (to be encrypted)
-  constexpr uint8_t msg_offset = 3;
+  constexpr uint8_t msg_offset = noise::FRAME_HEADER_SIZE;
  buf_start[msg_offset] = static_cast<uint8_t>(message_type >> 8);      // type high byte
  buf_start[msg_offset + 1] = static_cast<uint8_t>(message_type);       // type low byte
  buf_start[msg_offset + 2] = static_cast<uint8_t>(payload_size >> 8);  // data_len high byte
@@ -515,11 +465,10 @@ APIError APINoiseFrameHelper::encrypt_noise_message_(uint8_t *buf_start, uint16_
  if (aerr != APIError::OK)
    return aerr;

-  // Fill in the encrypted size
-  buf_start[1] = static_cast<uint8_t>(mbuf.size >> 8);
-  buf_start[2] = static_cast<uint8_t>(mbuf.size);
+  // Fill in the frame header now that the encrypted size is known
+  noise::write_frame_header(buf_start, static_cast<uint16_t>(mbuf.size));

-  encrypted_len_out = static_cast<uint16_t>(3 + mbuf.size);  // indicator + size + encrypted data
+  encrypted_len_out = static_cast<uint16_t>(noise::FRAME_HEADER_SIZE + mbuf.size);
  return APIError::OK;
 }

@@ -568,21 +517,19 @@ APIError APINoiseFrameHelper::write_protobuf_messages(ProtoWriteBuffer buffer, s
 }

 APIError APINoiseFrameHelper::write_frame_(const uint8_t *data, uint16_t len) {
-  uint8_t header[3];
-  header[0] = 0x01;  // indicator
-  header[1] = (uint8_t) (len >> 8);
-  header[2] = (uint8_t) len;
+  uint8_t header[noise::FRAME_HEADER_SIZE];
+  noise::write_frame_header(header, len);

  if (len == 0) {
-    return this->write_raw_buf_(header, 3);
+    return this->write_raw_buf_(header, noise::FRAME_HEADER_SIZE);
  }
  struct iovec iov[2];
  iov[0].iov_base = header;
-  iov[0].iov_len = 3;
+  iov[0].iov_len = noise::FRAME_HEADER_SIZE;
  iov[1].iov_base = const_cast<uint8_t *>(data);
  iov[1].iov_len = len;

-  return this->write_raw_iov_(iov, 2, 3 + len);
+  return this->write_raw_iov_(iov, 2, noise::FRAME_HEADER_SIZE + len);
 }

 /** Initiate the data structures for the handshake.
@@ -590,42 +537,12 @@ APIError APINoiseFrameHelper::write_frame_(const uint8_t *data, uint16_t len) {
 * @return 0 on success, -1 on error (check errno)
 */
 APIError APINoiseFrameHelper::init_handshake_() {
-  int err;
-  memset(&nid_, 0, sizeof(nid_));
-  // const char *proto = "Noise_NNpsk0_25519_ChaChaPoly_SHA256";
-  // err = noise_protocol_name_to_id(&nid_, proto, strlen(proto));
-  nid_.pattern_id = NOISE_PATTERN_NN;
-  nid_.cipher_id = NOISE_CIPHER_CHACHAPOLY;
-  nid_.dh_id = NOISE_DH_CURVE25519;
-  nid_.prefix_id = NOISE_PREFIX_STANDARD;
-  nid_.hybrid_id = NOISE_DH_NONE;
-  nid_.hash_id = NOISE_HASH_SHA256;
-  nid_.modifier_ids[0] = NOISE_MODIFIER_PSK0;
-
-  err = noise_handshakestate_new_by_id(&handshake_, &nid_, NOISE_ROLE_RESPONDER);
-  APIError aerr =
-      handle_noise_error_(err, LOG_STR("noise_handshakestate_new_by_id"), APIError::HANDSHAKESTATE_SETUP_FAILED);
+  int err = this->handshake_.init(this->ctx_.get_psk(), prologue_.data(), prologue_.size());
+  APIError aerr = handle_noise_error_(err, LOG_STR("noise_handshake_init"), APIError::HANDSHAKESTATE_SETUP_FAILED);
  if (aerr != APIError::OK)
    return aerr;
-
-  const auto &psk = this->ctx_.get_psk();
-  err = noise_handshakestate_set_pre_shared_key(handshake_, psk.data(), psk.size());
-  aerr = handle_noise_error_(err, LOG_STR("noise_handshakestate_set_pre_shared_key"),
-                             APIError::HANDSHAKESTATE_SETUP_FAILED);
-  if (aerr != APIError::OK)
-    return aerr;
-
-  err = noise_handshakestate_set_prologue(handshake_, prologue_.data(), prologue_.size());
-  aerr = handle_noise_error_(err, LOG_STR("noise_handshakestate_set_prologue"), APIError::HANDSHAKESTATE_SETUP_FAILED);
-  if (aerr != APIError::OK)
-    return aerr;
-  // set_prologue copies it into handshakestate, so we can get rid of it now
+  // init copies the prologue into the handshakestate, so we can get rid of it now
  prologue_.release();
-
-  err = noise_handshakestate_start(handshake_);
-  aerr = handle_noise_error_(err, LOG_STR("noise_handshakestate_start"), APIError::HANDSHAKESTATE_SETUP_FAILED);
-  if (aerr != APIError::OK)
-    return aerr;
  return APIError::OK;
 }

@@ -634,15 +551,17 @@ APIError APINoiseFrameHelper::check_handshake_finished_() {
  assert(state_ == State::HANDSHAKE);
 #endif

-  int action = noise_handshakestate_get_action(handshake_);
-  if (action == NOISE_ACTION_READ_MESSAGE || action == NOISE_ACTION_WRITE_MESSAGE)
+  noise::NoiseResponderHandshake::Action action = this->handshake_.action();
+  if (action == noise::NoiseResponderHandshake::Action::ACTION_READ ||
+      action == noise::NoiseResponderHandshake::Action::ACTION_WRITE)
    return APIError::OK;
-  if (action != NOISE_ACTION_SPLIT) {
+  if (action != noise::NoiseResponderHandshake::Action::ACTION_SPLIT) {
    state_ = State::FAILED;
-    HELPER_LOG("Bad action for handshake: %d", action);
+    HELPER_LOG("Bad action for handshake: %d", (int) action);
    return APIError::HANDSHAKESTATE_BAD_STATE;
  }
-  int err = noise_handshakestate_split(handshake_, &send_cipher_, &recv_cipher_);
+  // split() also frees the handshake state
+  int err = this->handshake_.split(send_cipher_, recv_cipher_);
  APIError aerr =
      handle_noise_error_(err, LOG_STR("noise_handshakestate_split"), APIError::HANDSHAKESTATE_SPLIT_FAILED);
  if (aerr != APIError::OK)
@@ -651,17 +570,11 @@ APIError APINoiseFrameHelper::check_handshake_finished_() {
  this->frame_footer_size_ = noise_cipherstate_get_mac_length(send_cipher_);

  HELPER_LOG("Handshake complete!");
-  noise_handshakestate_free(handshake_);
-  handshake_ = nullptr;
  state_ = State::DATA;
  return APIError::OK;
 }

 APINoiseFrameHelper::~APINoiseFrameHelper() {
-  if (handshake_ != nullptr) {
-    noise_handshakestate_free(handshake_);
-    handshake_ = nullptr;
-  }
  if (send_cipher_ != nullptr) {
    noise_cipherstate_free(send_cipher_);
    send_cipher_ = nullptr;
@@ -672,16 +585,6 @@ APINoiseFrameHelper::~APINoiseFrameHelper() {
  }
 }

-extern "C" {
-// declare how noise generates random bytes (here with a good HWRNG based on the RF system)
-void noise_rand_bytes(void *output, size_t len) {
-  if (!esphome::random_bytes(reinterpret_cast<uint8_t *>(output), len)) {
-    ESP_LOGE(TAG, "Acquiring random bytes failed; rebooting");
-    arch_restart();
-  }
-}
-}
-
 }  // namespace esphome::api
 #endif  // USE_API_NOISE
 #endif  // USE_API
@@ -3,7 +3,7 @@
 #ifdef USE_API
 #ifdef USE_API_NOISE
 #include "noise/protocol.h"
-#include "api_noise_context.h"
+#include "esphome/components/noise/noise_handshake.h"

 namespace esphome::api {

@@ -14,9 +14,9 @@ class APINoiseFrameHelper final : public APIFrameHelper {
  // Pos 1-2: encrypted payload size (16-bit big-endian)
  // Pos 3-6: encrypted type (16-bit) + data_len (16-bit)
  // Pos 7+: actual payload data
-  static constexpr uint8_t HEADER_PADDING = 1 + 2 + 2 + 2;  // indicator + size + type + data_len
+  static constexpr uint8_t HEADER_PADDING = noise::FRAME_HEADER_SIZE + 2 + 2;  // frame header + type + data_len

-  APINoiseFrameHelper(std::unique_ptr<socket::Socket> socket, APINoiseContext &ctx)
+  APINoiseFrameHelper(std::unique_ptr<socket::Socket> socket, noise::NoiseContext &ctx)
      : APIFrameHelper(std::move(socket)), ctx_(ctx) {
    frame_header_padding_ = HEADER_PADDING;
  }
@@ -52,25 +52,22 @@ class APINoiseFrameHelper final : public APIFrameHelper {
  APIError handle_handshake_frame_error_(APIError aerr);
  APIError handle_noise_error_(int err, const LogString *func_name, APIError api_err);

-  // Pointers first (4 bytes each)
-  NoiseHandshakeState *handshake_{nullptr};
+  // Pointers first (4 bytes each; the handshake wrapper holds one pointer)
+  noise::NoiseResponderHandshake handshake_;
  NoiseCipherState *send_cipher_{nullptr};
  NoiseCipherState *recv_cipher_{nullptr};

  // Reference to noise context (4 bytes on 32-bit)
-  APINoiseContext &ctx_;
+  noise::NoiseContext &ctx_;

  // Buffer for noise handshake prologue (released after handshake)
  APIBuffer prologue_;

-  // NoiseProtocolId (size depends on implementation)
-  NoiseProtocolId nid_;
-
  // Group small types together
  // Fixed-size header buffer for noise protocol:
  // 1 byte for indicator + 2 bytes for message size (16-bit value, not varint)
  // Note: Maximum message size is UINT16_MAX (65535), with a limit of 128 bytes during handshake phase
-  uint8_t rx_header_buf_[3];
+  uint8_t rx_header_buf_[noise::FRAME_HEADER_SIZE];
  uint8_t rx_header_buf_len_ = 0;
  // 4 bytes total, no padding
 };
@@ -1,37 +0,0 @@
-#pragma once
-#include <array>
-#include <cstdint>
-#include "esphome/core/defines.h"
-
-namespace esphome::api {
-
-#ifdef USE_API_NOISE
-using psk_t = std::array<uint8_t, 32>;
-
-class APINoiseContext {
- public:
-  // The all-zeros PSK is reserved: it marks the device as unprovisioned and
-  // doubles as the well-known provisioning PSK that unprovisioned devices
-  // accept for Noise handshakes (passive-sniffing protection only, no
-  // authentication). It is never a valid real key.
-  static bool is_all_zeros(const psk_t &psk) {
-    uint8_t acc = 0;
-    for (uint8_t b : psk) {
-      acc |= b;
-    }
-    return acc == 0;
-  }
-  void set_psk(psk_t psk) {
-    this->psk_ = psk;
-    this->has_psk_ = !is_all_zeros(psk);
-  }
-  const psk_t &get_psk() const { return this->psk_; }
-  bool has_psk() const { return this->has_psk_; }
-
- protected:
-  psk_t psk_{};
-  bool has_psk_{false};
-};
-#endif  // USE_API_NOISE
-
-}  // namespace esphome::api
@@ -116,4 +116,10 @@ extend google.protobuf.FieldOptions {
    // the per-byte loop when the upper bits are non-zero (the common case
    // for real MAC addresses, since OUIs occupy the top 24 bits).
    optional bool mac_address = 50019 [default=false];
+
+    // track_presence: Track whether this message-typed field was present on the wire.
+    // Generates a `bool has_<field>{false};` member on the decoding side that is set
+    // to true when the field arrives, so an all-default submessage can be told apart
+    // from an absent one (e.g. a UTC ParsedTimezone, which is all zeros).
+    optional bool track_presence = 50020 [default=false];
 }
@@ -1249,12 +1249,9 @@ bool ParsedTimezone::decode_length(uint32_t field_id, ProtoLengthDelimited value
 }
 bool GetTimeResponse::decode_length(uint32_t field_id, ProtoLengthDelimited value) {
  switch (field_id) {
-    case 2: {
-      this->timezone = StringRef(reinterpret_cast<const char *>(value.data()), value.size());
-      break;
-    }
    case 3:
      value.decode_to_message(this->parsed_timezone);
+      this->has_parsed_timezone = true;
      break;
    default:
      return false;
@@ -1283,13 +1283,13 @@ class ParsedTimezone final : public ProtoDecodableMessage {
 class GetTimeResponse final : public ProtoDecodableMessage {
 public:
  static constexpr uint8_t MESSAGE_TYPE = 37;
-  static constexpr uint8_t ESTIMATED_SIZE = 31;
+  static constexpr uint8_t ESTIMATED_SIZE = 22;
 #ifdef HAS_PROTO_MESSAGE_DUMP
  const LogString *message_name() const override { return LOG_STR("get_time_response"); }
 #endif
  uint32_t epoch_seconds{0};
-  StringRef timezone{};
  ParsedTimezone parsed_timezone{};
+  bool has_parsed_timezone{false};
 #ifdef HAS_PROTO_MESSAGE_DUMP
  const char *dump_to(DumpBuffer &out) const override;
 #endif
@@ -1468,7 +1468,7 @@ const char *ParsedTimezone::dump_to(DumpBuffer &out) const {
 const char *GetTimeResponse::dump_to(DumpBuffer &out) const {
  MessageDumpHelper helper(out, ESPHOME_PSTR("GetTimeResponse"));
  dump_field(out, ESPHOME_PSTR("epoch_seconds"), this->epoch_seconds);
-  dump_field(out, ESPHOME_PSTR("timezone"), this->timezone);
+  dump_field(out, ESPHOME_PSTR("has_parsed_timezone"), this->has_parsed_timezone);
  out.append(2, ' ').append_p(ESPHOME_PSTR("parsed_timezone")).append(": ");
  this->parsed_timezone.dump_to(out);
  out.append("\n");
@@ -423,12 +423,6 @@ void APIServer::send_infrared_rf_receive_event([[maybe_unused]] uint32_t device_
 API_DISPATCH_UPDATE(alarm_control_panel::AlarmControlPanel, alarm_control_panel)
 #endif

-float APIServer::get_setup_priority() const { return setup_priority::AFTER_WIFI; }
-
-void APIServer::set_port(uint16_t port) { this->port_ = port; }
-
-void APIServer::set_batch_delay(uint16_t batch_delay) { this->batch_delay_ = batch_delay; }
-
 #ifdef USE_API_HOMEASSISTANT_SERVICES
 void APIServer::send_homeassistant_action(const HomeassistantActionRequest &call) {
  bool has_subscriber = false;
@@ -553,10 +547,6 @@ const std::vector<APIServer::HomeAssistantStateSubscription> &APIServer::get_sta
 }
 #endif

-uint16_t APIServer::get_port() const { return this->port_; }
-
-void APIServer::set_reboot_timeout(uint32_t reboot_timeout) { this->reboot_timeout_ = reboot_timeout; }
-
 #ifdef USE_API_NOISE
 bool APIServer::update_noise_psk_(const SavedNoisePsk &new_psk, const LogString *save_log_msg,
                                  const LogString *fail_log_msg, bool make_active) {
@@ -598,7 +588,7 @@ bool APIServer::load_and_apply_noise_psk_() {
  return true;
 }

-bool APIServer::save_noise_psk(psk_t psk, bool make_active) {
+bool APIServer::save_noise_psk(noise::psk_t psk, bool make_active) {
 #ifdef USE_API_NOISE_PSK_FROM_YAML
  // When PSK is set from YAML, this function should never be called
  // but if it is, reject the change
@@ -5,7 +5,10 @@
 #include "api_buffer.h"
 // Must precede clients_ so APIConnection is complete for default_delete (libc++).
 #include "api_connection.h"
-#include "api_noise_context.h"
+#ifdef USE_API_NOISE
+// Only present in the build when the noise component is loaded
+#include "esphome/components/noise/noise.h"
+#endif
 #include "api_pb2.h"
 #include "api_pb2_service.h"
 #include "esphome/components/socket/socket.h"
@@ -37,7 +40,7 @@ class UserServiceDescriptor;

 #ifdef USE_API_NOISE
 struct SavedNoisePsk {
-  psk_t psk;
+  noise::psk_t psk;
 } PACKED;  // NOLINT
 #endif

@@ -51,8 +54,8 @@ class APIServer final : public Component,
 public:
  APIServer();
  void setup() override;
-  uint16_t get_port() const;
-  float get_setup_priority() const override;
+  uint16_t get_port() const { return this->port_; }
+  float get_setup_priority() const override { return setup_priority::AFTER_WIFI; }
  void loop() override;
  void dump_config() override;
  void on_shutdown() override;
@@ -63,9 +66,9 @@ class APIServer final : public Component,
 #ifdef USE_CAMERA
  void on_camera_image(const std::shared_ptr<camera::CameraImage> &image) override;
 #endif
-  void set_port(uint16_t port);
-  void set_reboot_timeout(uint32_t reboot_timeout);
-  void set_batch_delay(uint16_t batch_delay);
+  void set_port(uint16_t port) { this->port_ = port; }
+  void set_reboot_timeout(uint32_t reboot_timeout) { this->reboot_timeout_ = reboot_timeout; }
+  void set_batch_delay(uint16_t batch_delay) { this->batch_delay_ = batch_delay; }
  uint16_t get_batch_delay() const { return batch_delay_; }
  void set_listen_backlog(uint8_t listen_backlog) { this->listen_backlog_ = listen_backlog; }

@@ -73,10 +76,10 @@ class APIServer final : public Component,
  APIBuffer &get_shared_buffer_ref() { return shared_write_buffer_; }

 #ifdef USE_API_NOISE
-  bool save_noise_psk(psk_t psk, bool make_active = true);
+  bool save_noise_psk(noise::psk_t psk, bool make_active = true);
  bool clear_noise_psk(bool make_active = true);
-  void set_noise_psk(psk_t psk) { this->noise_ctx_.set_psk(psk); }
-  APINoiseContext &get_noise_ctx() { return this->noise_ctx_; }
+  void set_noise_psk(noise::psk_t psk) { this->noise_ctx_.set_psk(psk); }
+  noise::NoiseContext &get_noise_ctx() { return this->noise_ctx_; }
 #endif  // USE_API_NOISE

  void handle_disconnect(APIConnection *conn);
@@ -354,7 +357,7 @@ class APIServer final : public Component,
 #endif

 #ifdef USE_API_NOISE
-  APINoiseContext noise_ctx_;
+  noise::NoiseContext noise_ctx_;
  ESPPreferenceObject noise_pref_;
 #endif  // USE_API_NOISE
 };
@@ -95,9 +95,17 @@ bool ListEntitiesIterator::on_end() { return this->client_->send_list_info_done(
 ListEntitiesIterator::ListEntitiesIterator(APIConnection *client) : client_(client) {}

 #ifdef USE_API_USER_DEFINED_ACTIONS
+// Yield after every Nth service; bounds direct (non-batched) writes per loop pass
+static constexpr uint8_t SERVICE_YIELD_INTERVAL = 3;
+
 bool ListEntitiesIterator::on_service(UserServiceDescriptor *service) {
  auto resp = service->encode_list_service_response();
-  return this->client_->send_message(resp);
+  if (!this->client_->send_message(resp))
+    return false;
+  // at_ is this service's index
+  if ((this->at_ + 1) % SERVICE_YIELD_INTERVAL == 0)
+    this->yield_after_step_();
+  return true;
 }
 #endif

@@ -7,6 +7,7 @@ from esphome.const import (
    DEVICE_CLASS_AQI,
    STATE_CLASS_MEASUREMENT,
 )
+from esphome.types import ConfigType

 from . import AQI_CALCULATION_TYPE, CONF_CALCULATION_TYPE, CONF_EXTENDED_RANGE, aqi_ns

@@ -16,7 +17,7 @@ DEPENDENCIES = ["sensor"]
 AQISensor = aqi_ns.class_("AQISensor", sensor.Sensor, cg.Component)


-def _validate_extended_range(config):
+def _validate_extended_range(config: ConfigType) -> ConfigType:
    if CONF_EXTENDED_RANGE in config and config[CONF_CALCULATION_TYPE] == "CAQI":
        raise cv.Invalid(
            f"'{CONF_EXTENDED_RANGE}' is not supported with 'calculation_type: CAQI'. "
@@ -48,7 +49,7 @@ CONFIG_SCHEMA = cv.All(
 )


-async def to_code(config):
+async def to_code(config: ConfigType) -> None:
    var = await sensor.new_sensor(config)
    await cg.register_component(var, config)

@@ -14,6 +14,8 @@ from esphome.const import (
    CONF_TUNE_ANTENNA,
    CONF_WATCHDOG_THRESHOLD,
 )
+from esphome.cpp_generator import MockObj
+from esphome.types import ConfigType

 MULTI_CONF = True

@@ -42,7 +44,7 @@ AS3935_SCHEMA = cv.Schema(
 )


-async def setup_as3935(var, config):
+async def setup_as3935(var: MockObj, config: ConfigType) -> None:
    await cg.register_component(var, config)

    irq_pin = await cg.gpio_pin_expression(config[CONF_IRQ_PIN])
@@ -1,6 +1,7 @@
 import esphome.codegen as cg
 from esphome.components import binary_sensor
 import esphome.config_validation as cv
+from esphome.types import ConfigType

 from . import AS3935, CONF_AS3935_ID

@@ -13,7 +14,7 @@ CONFIG_SCHEMA = binary_sensor.binary_sensor_schema().extend(
 )


-async def to_code(config):
+async def to_code(config: ConfigType) -> None:
    hub = await cg.get_variable(config[CONF_AS3935_ID])
    var = await binary_sensor.new_binary_sensor(config)
    cg.add(hub.set_thunder_alert_binary_sensor(var))
@@ -9,6 +9,7 @@ from esphome.const import (
    STATE_CLASS_MEASUREMENT,
    UNIT_KILOMETER,
 )
+from esphome.types import ConfigType

 from . import AS3935, CONF_AS3935_ID

@@ -31,7 +32,7 @@ CONFIG_SCHEMA = cv.Schema(
 )


-async def to_code(config):
+async def to_code(config: ConfigType) -> None:
    hub = await cg.get_variable(config[CONF_AS3935_ID])

    if distance_config := config.get(CONF_DISTANCE):
@@ -2,6 +2,7 @@ import esphome.codegen as cg
 from esphome.components import as3935, i2c
 import esphome.config_validation as cv
 from esphome.const import CONF_ID
+from esphome.types import ConfigType

 AUTO_LOAD = ["as3935"]
 DEPENDENCIES = ["i2c"]
@@ -20,7 +21,7 @@ CONFIG_SCHEMA = cv.All(
 )


-async def to_code(config):
+async def to_code(config: ConfigType) -> None:
    var = cg.new_Pvariable(config[CONF_ID])
    await as3935.setup_as3935(var, config)
    await i2c.register_i2c_device(var, config)
@@ -2,6 +2,7 @@ import esphome.codegen as cg
 from esphome.components import as3935, spi
 import esphome.config_validation as cv
 from esphome.const import CONF_ID
+from esphome.types import ConfigType

 AUTO_LOAD = ["as3935"]
 DEPENDENCIES = ["spi"]
@@ -20,7 +21,7 @@ CONFIG_SCHEMA = cv.All(
 )


-async def to_code(config):
+async def to_code(config: ConfigType) -> None:
    var = cg.new_Pvariable(config[CONF_ID])
    await as3935.setup_as3935(var, config)
    await spi.register_spi_device(var, config)
@@ -1,3 +1,6 @@
+from collections.abc import Callable
+from typing import Any
+
 from esphome import pins
 import esphome.codegen as cg
 from esphome.components import i2c
@@ -11,6 +14,7 @@ from esphome.const import (
    CONF_RANGE,
    CONF_WATCHDOG,
 )
+from esphome.types import ConfigType

 CODEOWNERS = ["@ammmze"]
 DEPENDENCIES = ["i2c"]
@@ -72,13 +76,13 @@ POSITION_TO_ANGLE = 360 / RESOLUTION
 MIN_RANGE = round(18 * ANGLE_TO_POSITION)


-def angle(min=-360, max=360):
+def angle(min: float = -360, max: float = 360) -> Callable[[Any], Any]:
    return cv.All(
        cv.float_with_unit("angle", "(°|deg)"), cv.float_range(min=min, max=max)
    )


-def angle_to_position(value, min=-360, max=360):
+def angle_to_position(value: Any, min: float = -360, max: float = 360) -> int:
    try:
        value = angle(min=min, max=max)(value)
        return (RESOLUTION + round(value * ANGLE_TO_POSITION)) % RESOLUTION
@@ -86,17 +90,17 @@ def angle_to_position(value, min=-360, max=360):
        raise cv.Invalid(f"When using angle, {e.error_message}") from e


-def percent_to_position(value):
+def percent_to_position(value: Any) -> int:
    value = cv.possibly_negative_percentage(value)
    return (RESOLUTION + round(value * RESOLUTION)) % RESOLUTION


-def position(min=-MAX_POSITION, max=MAX_POSITION):
+def position(min: int = -MAX_POSITION, max: int = MAX_POSITION) -> Callable[[Any], Any]:
    """Validate that the config option is a position.
    Accepts integers, degrees, or percentage (of 360 degrees).
    """

-    def validator(value):
+    def validator(value: Any) -> int:
        if isinstance(value, str) and value.endswith("%"):
            value = percent_to_position(value)

@@ -112,7 +116,7 @@ def position(min=-MAX_POSITION, max=MAX_POSITION):
    return validator


-def position_range():
+def position_range() -> Callable[[Any], Any]:
    """Validate that value given is a valid range for the device.
    A valid range is one of the following:
    - a value of 0 (meaning full range)
@@ -129,7 +133,7 @@ def position_range():
        zero_validator,
    )

-    def validator(value):
+    def validator(value: Any) -> Any:
        is_negative_str = isinstance(value, str) and value.startswith("-")
        is_negative_num = isinstance(value, (float, int)) and value < 0
        if is_negative_str or is_negative_num:
@@ -139,13 +143,13 @@ def position_range():
    return validator


-def has_valid_range_config():
+def has_valid_range_config() -> Callable[[ConfigType], ConfigType]:
    """Validate that that the config start + end position results in a valid
    positional range, which must be >= 18degrees
    """
    range_validator = position_range()

-    def validator(config):
+    def validator(config: ConfigType) -> ConfigType:
        # if we don't have an end position, then there is nothing to do
        if CONF_END_POSITION not in config:
            return config
@@ -203,7 +207,7 @@ CONFIG_SCHEMA = cv.All(
 )


-async def to_code(config):
+async def to_code(config: ConfigType) -> None:
    var = cg.new_Pvariable(config[CONF_ID])
    await cg.register_component(var, config)
    await i2c.register_i2c_device(var, config)
@@ -11,6 +11,7 @@ from esphome.const import (
    ICON_ROTATE_RIGHT,
    STATE_CLASS_MEASUREMENT,
 )
+from esphome.types import ConfigType

 from .. import AS5600Component, as5600_ns

@@ -77,7 +78,7 @@ CONFIG_SCHEMA = (
 )


-async def to_code(config):
+async def to_code(config: ConfigType) -> None:
    var = cg.new_Pvariable(config[CONF_ID])
    await cg.register_parented(var, config[CONF_AS5600_ID])
    await cg.register_component(var, config)
@@ -9,6 +9,7 @@ from esphome.const import (
    ICON_BRIGHTNESS_5,
    STATE_CLASS_MEASUREMENT,
 )
+from esphome.types import ConfigType

 CODEOWNERS = ["@mrgnr"]
 DEPENDENCIES = ["i2c"]
@@ -96,7 +97,7 @@ SENSORS = {
 }


-async def to_code(config):
+async def to_code(config: ConfigType) -> None:
    var = cg.new_Pvariable(config[CONF_ID])
    await cg.register_component(var, config)
    await i2c.register_i2c_device(var, config)
@@ -2,6 +2,7 @@
 import esphome.codegen as cg
 import esphome.config_validation as cv
 from esphome.core import CORE, CoroPriority, coroutine_with_priority
+from esphome.types import ConfigType

 CODEOWNERS = ["@esphome/core"]
 DEPENDENCIES = ["network"]
@@ -25,7 +26,7 @@ CONFIG_SCHEMA = cv.Schema({})


@coroutine_with_priority(CoroPriority.NETWORK_TRANSPORT)
-async def to_code(config):
+async def to_code(config: ConfigType) -> None:
    if CORE.is_esp32:
        # https://github.com/ESP32Async/AsyncTCP
        from esphome.components.esp32 import add_idf_component
@@ -4,6 +4,9 @@ import esphome.codegen as cg
 from esphome.components import i2c
 import esphome.config_validation as cv
 from esphome.const import CONF_FREQUENCY, CONF_ID
+from esphome.core import ID
+from esphome.cpp_generator import MockObj, TemplateArgsType
+from esphome.types import ConfigType

 CODEOWNERS = ["@X-Ryl669"]
 DEPENDENCIES = ["i2c"]
@@ -70,7 +73,7 @@ CONFIG_SCHEMA = cv.All(
 )


-async def to_code(config):
+async def to_code(config: ConfigType) -> None:
    var = cg.new_Pvariable(config[CONF_ID])
    await cg.register_component(var, config)
    await i2c.register_i2c_device(var, config)
@@ -91,7 +94,12 @@ AT581XSettingsAction = at581x_ns.class_("AT581XSettingsAction", automation.Actio
    ),
    synchronous=True,
 )
-async def at581x_reset_to_code(config, action_id, template_arg, args):
+async def at581x_reset_to_code(
+    config: ConfigType,
+    action_id: ID,
+    template_arg: cg.TemplateArguments,
+    args: TemplateArgsType,
+) -> MockObj:
    var = cg.new_Pvariable(action_id, template_arg)
    await cg.register_parented(var, config[CONF_ID])

@@ -163,7 +171,12 @@ RADAR_SETTINGS_SCHEMA = cv.Schema(
    RADAR_SETTINGS_SCHEMA,
    synchronous=True,
 )
-async def at581x_settings_to_code(config, action_id, template_arg, args):
+async def at581x_settings_to_code(
+    config: ConfigType,
+    action_id: ID,
+    template_arg: cg.TemplateArguments,
+    args: TemplateArgsType,
+) -> MockObj:
    var = cg.new_Pvariable(action_id, template_arg)
    await cg.register_parented(var, config[CONF_ID])

@@ -2,6 +2,7 @@ import esphome.codegen as cg
 from esphome.components import switch
 import esphome.config_validation as cv
 from esphome.const import DEVICE_CLASS_SWITCH, ICON_WIFI
+from esphome.types import ConfigType

 from .. import CONF_AT581X_ID, AT581XComponent, at581x_ns

@@ -22,7 +23,7 @@ CONFIG_SCHEMA = switch.switch_schema(
 )


-async def to_code(config):
+async def to_code(config: ConfigType) -> None:
    at581x_component = await cg.get_variable(config[CONF_AT581X_ID])
    s = await switch.new_switch(config)
    await cg.register_parented(s, config[CONF_AT581X_ID])
@@ -21,6 +21,7 @@ from esphome.const import (
    UNIT_PERCENT,
    UNIT_VOLT,
 )
+from esphome.types import ConfigType

 CODEOWNERS = ["@ahpohl"]

@@ -77,7 +78,7 @@ CONFIG_SCHEMA = cv.All(
 )


-async def to_code(config):
+async def to_code(config: ConfigType) -> None:
    var = cg.new_Pvariable(config[CONF_ID])
    await cg.register_component(var, config)
    await ble_device_base.register_ble_device(var, config)
@@ -30,6 +30,7 @@ from esphome.const import (
    UNIT_WATT,
    UNIT_WATT_HOURS,
 )
+from esphome.types import ConfigType

 CONF_METER_CONSTANT = "meter_constant"
 CONF_PL_CONST = "pl_const"
@@ -123,7 +124,7 @@ CONFIG_SCHEMA = (
 )


-async def to_code(config):
+async def to_code(config: ConfigType) -> None:
    var = cg.new_Pvariable(config[CONF_ID])
    await cg.register_component(var, config)
    await spi.register_spi_device(var, config)
@@ -2,6 +2,7 @@ import esphome.codegen as cg
 from esphome.components import button
 import esphome.config_validation as cv
 from esphome.const import CONF_ID, ENTITY_CATEGORY_CONFIG, ICON_SCALE
+from esphome.types import ConfigType

 from .. import atm90e32_ns
 from ..sensor import ATM90E32Component
@@ -67,7 +68,7 @@ CONFIG_SCHEMA = {
 }


-async def to_code(config):
+async def to_code(config: ConfigType) -> None:
    parent = await cg.get_variable(config[CONF_ID])

    if run_gain := config.get(CONF_RUN_GAIN_CALIBRATION):
@@ -15,6 +15,7 @@ from esphome.const import (
    UNIT_AMPERE,
    UNIT_VOLT,
 )
+from esphome.types import ConfigType

 from .. import atm90e32_ns
 from ..sensor import ATM90E32Component
@@ -90,7 +91,7 @@ CONFIG_SCHEMA = cv.Schema(
 )


-async def to_code(config):
+async def to_code(config: ConfigType) -> None:
    parent = await cg.get_variable(config[CONF_ID])

    if voltage_cfg := config.get(CONF_REFERENCE_VOLTAGE):
@@ -41,6 +41,7 @@ from esphome.const import (
    UNIT_WATT,
    UNIT_WATT_HOURS,
 )
+from esphome.types import ConfigType

 from . import atm90e32_ns

@@ -191,7 +192,7 @@ CONFIG_SCHEMA = (
 )


-async def to_code(config):
+async def to_code(config: ConfigType) -> None:
    var = cg.new_Pvariable(config[CONF_ID])
    cg.add(var.set_instance_id(str(config[CONF_ID])))
    await cg.register_component(var, config)
@@ -2,6 +2,7 @@ import esphome.codegen as cg
 from esphome.components import text_sensor
 import esphome.config_validation as cv
 from esphome.const import CONF_ID, CONF_PHASE_A, CONF_PHASE_B, CONF_PHASE_C
+from esphome.types import ConfigType

 from ..sensor import ATM90E32Component

@@ -34,7 +35,7 @@ CONFIG_SCHEMA = cv.Schema(
 )


-async def to_code(config):
+async def to_code(config: ConfigType) -> None:
    parent = await cg.get_variable(config[CONF_ID])

    if phase_cfg := config.get(CONF_PHASE_STATUS):
@@ -1,4 +1,6 @@
+from collections.abc import Callable
 from dataclasses import dataclass, field
+from typing import Any

 import esphome.codegen as cg
 from esphome.components.esp32 import (
@@ -15,6 +17,7 @@ from esphome.const import (
 )
 from esphome.core import CORE
 import esphome.final_validate as fv
+from esphome.types import ConfigType

 AUTO_LOAD = ["ring_buffer"]
 CODEOWNERS = ["@kahrendt"]
@@ -125,10 +128,10 @@ CONF_THREADSAFE = "threadsafe"
 _MEMORY_LOCATION_VALIDATOR = cv.one_of(*MEMORY_LOCATIONS, lower=True)


-def _maybe_empty_codec(schema):
+def _maybe_empty_codec(schema: cv.Schema) -> Callable[[Any], Any]:
    """Wrap a codec dict schema so that a bare key (None value) is treated as an empty dict."""

-    def validator(value):
+    def validator(value: Any) -> Any:
        if value is None:
            value = {}
        return schema(value)
@@ -200,14 +203,14 @@ def set_stream_limits(
    max_channels: int = cv.UNDEFINED,
    min_sample_rate: int = cv.UNDEFINED,
    max_sample_rate: int = cv.UNDEFINED,
-):
+) -> Callable[[ConfigType], None]:
    """Sets the limits for the audio stream that audio component can handle

    When the component sinks audio (e.g., a speaker), these indicate the limits to the audio it can receive.
    When the component sources audio (e.g., a microphone), these indicate the limits to the audio it can send.
    """

-    def set_limits_in_config(config):
+    def set_limits_in_config(config: ConfigType) -> None:
        if min_bits_per_sample is not cv.UNDEFINED:
            config[CONF_MIN_BITS_PER_SAMPLE] = min_bits_per_sample
        if max_bits_per_sample is not cv.UNDEFINED:
@@ -233,7 +236,7 @@ def final_validate_audio_schema(
    sample_rate: int = cv.UNDEFINED,
    enabled_channels: list[int] = cv.UNDEFINED,
    audio_device_issue: bool = False,
-):
+) -> cv.Schema:
    """Validates audio compatibility when passed between different components.

    The component derived from ``AUDIO_COMPONENT_SCHEMA`` should call ``set_stream_limits`` in a validator to specify its compatible settings
@@ -251,7 +254,7 @@ def final_validate_audio_schema(
        audio_device_issue (bool, optional): Format the error message to indicate the problem is in the configuration for the ``audio_device`` component. Defaults to False.
    """

-    def validate_audio_compatiblity(audio_config):
+    def validate_audio_compatiblity(audio_config: ConfigType) -> ConfigType:
        audio_schema = {}

        if bits_per_sample is not cv.UNDEFINED:
@@ -329,7 +332,7 @@ def _emit_memory_pair(value: str | None, psram_key: str, internal_key: str) -> N
        add_idf_sdkconfig_option(internal_key, True)


-async def to_code(config):
+async def to_code(config: ConfigType) -> None:
    # Re-enable ESP-IDF's HTTP client (excluded by default to save compile time)
    include_builtin_idf_component("esp_http_client")

--- a/Show More
+++ b/Show More