Merge remote-tracking branch 'upstream/dev' into neutral-ble-client

Emit the materializer define only for the backend that has one
The registry entry now carries its materializer gate, so rp2 builds stop receiving a Bluedroid define. Also: parent before the capacity check in register_gatt_node (neutral parity) and BluedroidServiceTable is non-copyable (owning raw pointer).
2026-08-23 22:56:19 +00:00 · 2026-08-20 00:45:33 -05:00 · 2026-08-19 10:30:43 -05:00 · 2026-08-19 09:15:17 -05:00 · 2026-08-19 09:14:17 -05:00 · 2026-08-19 09:10:05 -05:00
720 changed files with 5345 additions and 11032 deletions
@@ -67,7 +67,7 @@ jobs:
        with:
          python-version: "3.12"
      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0

      - name: Determine tag and whether to push
        id: tag
@@ -153,7 +153,7 @@ jobs:
        with:
          python-version: "3.12"
      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0

      - name: Log in to the GitHub container registry
        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
@@ -123,7 +123,7 @@ jobs:
          python-version: "3.12"

      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0

      - name: Log in to docker hub
        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
@@ -202,7 +202,7 @@ jobs:
          merge-multiple: true

      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0

      - name: Log in to docker hub
        if: matrix.registry == 'dockerhub'
@@ -381,7 +381,6 @@ esphome/components/nextion/switch/* @senexcrenshaw
 esphome/components/nextion/text_sensor/* @senexcrenshaw
 esphome/components/nfc/* @jesserockz @kbx81
 esphome/components/noblex/* @AGalfra
-esphome/components/noise/* @esphome/core
 esphome/components/npi19/* @bakerkj
 esphome/components/nrf52/* @tomaszduda23
 esphome/components/number/* @esphome/core
@@ -23,8 +23,7 @@ For this repository there are two trusted inputs by design:
 1. **The configuration.** Anyone who can supply or edit a YAML config is trusted
   (see below).
 2. **Authenticated peers of a running device** — clients holding the device's
-   API/OTA encryption key, API password, OTA password, or web server
-   credentials.
+   API encryption key / password, OTA password, or web server credentials.

 The security boundary is therefore **unauthenticated network traffic vs. those
 trusted inputs.** A bug that lets an unauthenticated attacker cross it is a
@@ -77,8 +76,8 @@ These *are* security bugs in this repo, and we want to hear about them privately
  captive portal, etc.) **without** valid credentials.
 - Authentication or encryption bypass on the device — reaching API calls, OTA
  updates, or the web server without the configured key/password.
- Flaws that weaken the device's API or OTA encryption (Noise), OTA auth, or
-  web server auth below their documented guarantees.
+- Flaws that weaken the device's API encryption (Noise), OTA, or web server auth
+  below their documented guarantees.

 ## The web server is an open HTTP API by design

@@ -122,38 +121,6 @@ and any memory-safety or protocol bug in the server reachable without credential
 This section documents the current design and scope; it is not a judgment that the
 design is optimal or that it will not change.

-## OTA update encryption
-
-The `esphome` OTA platform optionally encrypts updates with the same Noise
-`NNpsk0` pattern the native API uses; one key protects the device. With an
-`encryption:` block configured the guarantees are: the firmware image is
-confidential in transit, the uploader is authenticated by the pre-shared key,
-and the plaintext negotiation preceding the handshake is bound into the
-handshake prologue, so stripping or tampering with it fails the first MAC.
-Both ends fail closed with no override: a device built with a key refuses
-plaintext uploads, and the CLI refuses to send plaintext when a key is
-configured.
-
-Defeating any of that without the key is in scope: a keyed device accepting a
-plaintext or downgraded upload, getting past the MAC, or recovering image
-contents from captured traffic.
-
-The following are **not** vulnerabilities, by design:
-
- Plaintext OTA on a device with no `encryption:` block. That is the
-  documented default, authenticated (if at all) by the OTA password.
- The enablement window: turning encryption on takes one last upload of the
-  encryption-enabled firmware over the existing plaintext channel, with the
-  pre-existing plaintext exposure.
- The captive portal's update endpoint. `captive_portal:` auto-loads the web
-  OTA platform, and while the fallback AP is active its plaintext `/update`
-  endpoint is reachable on that AP; validation warns about the combination.
-  Combining `encryption:` with the always-on `web_server` component is a
-  config error instead.
- CLI retry behavior on transport or MAC failures; every attempt renegotiates
-  a fresh handshake with fresh ephemerals, so retrying does not weaken
-  authentication.
-
 ## Explicitly out of scope

 - Local attackers who already have shell access on the host that runs `esphome`.
@@ -22,7 +22,7 @@ RUN \
    -r /requirements.txt

 # Install the ESPHome Device Builder dashboard.
-RUN uv pip install --no-cache-dir esphome-device-builder==1.12.4
+RUN uv pip install --no-cache-dir esphome-device-builder==1.12.1

 RUN \
    platformio settings set enable_telemetry No \
@@ -26,9 +26,7 @@ from esphome.const import (
    CONF_DEASSERT_RTS_DTR,
    CONF_DISABLED,
    CONF_DISCOVER_IP,
-    CONF_ENCRYPTION,
    CONF_ESPHOME,
-    CONF_KEY,
    CONF_LEVEL,
    CONF_LOG,
    CONF_LOG_TOPIC,
@@ -764,11 +762,9 @@ def _wrap_to_code(name, comp, yaml_util):
    async def wrapped(conf):
        cg.add(cg.LineComment(f"{name}:"))
        if comp.config_schema is not None:
-            # sort_keys: voluptuous fills defaults in set order, so an
-            # unsorted dump would churn main.cpp and relink every run
-            conf_str = yaml_util.dump(conf, sort_keys=True)
+            conf_str = yaml_util.dump(conf)
            conf_str = conf_str.replace("//", "")
-            # remove trailing \ to avoid multi-line comment warning
+            # remove tailing \ to avoid multi-line comment warning
            conf_str = conf_str.replace("\\\n", "\n")
            cg.add(cg.LineComment(indent(conf_str)))
        await coro(conf)
@@ -1325,17 +1321,6 @@ def _upload_via_native_api(

    remote_port = int(ota_conf[CONF_PORT])
    password = ota_conf.get(CONF_PASSWORD)
-    # Final validate resolved a bare `encryption:` block to the api key.
-    # Fail closed: if the block is present but no key was resolved, never
-    # fall back to a plaintext upload of an image that carries credentials.
-    noise_psk = None
-    if (encryption_conf := ota_conf.get(CONF_ENCRYPTION)) is not None:
-        noise_psk = encryption_conf.get(CONF_KEY)
-        if not noise_psk:
-            raise EsphomeError(
-                "OTA encryption is configured but no key was resolved; "
-                "set the key under 'ota: encryption:' or 'api: encryption:'"
-            )

    def check_partition_access(option_string: str) -> None:
        if not ota_conf.get("allow_partition_access"):
@@ -1366,9 +1351,7 @@ def _upload_via_native_api(
    if ota_type == espota2.OTA_TYPE_UPDATE_BOOTLOADER:
        _validate_bootloader_binary(binary)

-    return espota2.run_ota(
-        network_devices, remote_port, password, binary, ota_type, noise_psk
-    )
+    return espota2.run_ota(network_devices, remote_port, password, binary, ota_type)


 def _upload_via_web_server(
@@ -1377,16 +1360,6 @@ def _upload_via_web_server(
    from esphome import web_server_ota
    from esphome.web_server_helpers import get_web_server_connection

-    if any(
-        ota_item.get(CONF_PLATFORM) == CONF_ESPHOME
-        and ota_item.get(CONF_ENCRYPTION) is not None
-        for ota_item in config.get(CONF_OTA, [])
-    ):
-        _LOGGER.warning(
-            "This config has OTA encryption, but the web_server OTA path sends "
-            "the image over plaintext HTTP; use the esphome OTA platform to "
-            "keep it confidential"
-        )
    remote_port, username, password = get_web_server_connection(config)
    return web_server_ota.run_ota(
        network_devices, remote_port, username, password, binary
@@ -3,12 +3,7 @@
 import json
 from pathlib import Path

-from esphome.components.esp32 import (
-    get_esp32_variant,
-    get_excluded_builtin_components,
-    get_managed_component_require_names,
-    idf_version,
-)
+from esphome.components.esp32 import get_esp32_variant, idf_version
 import esphome.config_validation as cv
 from esphome.core import CORE
 from esphome.framework_helpers import (
@@ -72,13 +67,6 @@ def has_discovered_components() -> bool:
    return get_available_components() is not None


-def _cmake_quote(value: str) -> str:
-    """Quote a cmake arg value for a set() line. add_cmake_arg rejects
-    whitespace, quotes, and '$', so only backslashes need escaping."""
-    escaped = value.replace("\\", "\\\\")
-    return f'"{escaped}"'
-
-
 def get_project_cmakelists(minimal: bool = False) -> str:
    """Generate the top-level CMakeLists.txt for ESP-IDF project.

@@ -121,15 +109,6 @@ def get_project_cmakelists(minimal: bool = False) -> str:
        else ""
    )

-    # CMake variables registered via cg.add_cmake_arg(). Emitted before
-    # include(project.cmake) so values like EXCLUDE_COMPONENTS are already
-    # set when project.cmake seeds the component list, and on minimal
-    # (discovery) writes too so excluded components never register.
-    cmake_args = "\n".join(
-        f"set({name} {_cmake_quote(value)})"
-        for name, value in sorted(CORE.cmake_args.items())
-    )
-
    # Per-project list exposed as a CMake variable so converted PIO libs
    # can reference ${ESPHOME_PROJECT_MANAGED_COMPONENTS} without baking
    # project-specific names into their cached CMakeLists.
@@ -140,6 +119,8 @@ def get_project_cmakelists(minimal: bool = False) -> str:
    # runs as a separate CMake script invocation that doesn't load the
    # project's top-level CMakeLists; without this, ${ESPHOME_PROJECT_
    # MANAGED_COMPONENTS} in a converted-lib REQUIRES expands to empty).
+    from esphome.components.esp32 import get_managed_component_require_names
+
    managed_components_property = "\n".join(
        f"idf_build_set_property(ESPHOME_PROJECT_MANAGED_COMPONENTS {name} APPEND)"
        for name in get_managed_component_require_names()
@@ -150,22 +131,12 @@ def get_project_cmakelists(minimal: bool = False) -> str:
    # component's REQUIRES including real IDF components). Referenced by
    # src/CMakeLists and by each converted PIO lib's CMakeLists. Skipped
    # on minimal writes because project_description.json may be stale.
-    # Excluded components are dropped here as well: a stale
-    # project_description.json from a build without exclusions may still
-    # list them, and requiring an excluded component pulls it back into
-    # the build (IDF requirement expansion overrides EXCLUDE_COMPONENTS).
-    # Derived from the EXCLUDE_COMPONENTS cmake arg emitted above so the
-    # two can never disagree within one generated file.
    builtin_components_property = (
        ""
        if minimal
        else "\n".join(
            f"idf_build_set_property(ESPHOME_PROJECT_BUILTIN_COMPONENTS {name} APPEND)"
-            for name in sorted(
-                set(get_available_components() or []).difference(
-                    CORE.cmake_args.get("EXCLUDE_COMPONENTS", "").split(";")
-                )
-            )
+            for name in sorted(get_available_components() or [])
        )
    )

@@ -192,8 +163,6 @@ set(CMAKE_NINJA_FORCE_RESPONSE_FILE 1)
 set(IDF_TARGET {idf_target})
 set(EXTRA_COMPONENT_DIRS ${{CMAKE_SOURCE_DIR}}/src)

-{cmake_args}
-
 include($ENV{{IDF_PATH}}/tools/cmake/project.cmake)

 {cpp_standard_options}
@@ -295,13 +264,3 @@ def write_project(minimal: bool = False) -> None:
        CORE.relative_src_path("CMakeLists.txt"),
        get_component_cmakelists(),
    )
-
-    # Snapshot the exclusion set so has_outdated_files() can trigger a
-    # discovery reconfigure when it changes. Excluded components never
-    # register in project_description.json, so re-including one (e.g. a
-    # config gains mqtt) requires a fresh discovery pass before the
-    # ESPHOME_PROJECT_BUILTIN_COMPONENTS property can list it.
-    write_file_if_changed(
-        CORE.relative_build_path("exclude_components.esphomeinternal"),
-        ";".join(get_excluded_builtin_components()),
-    )
@@ -63,17 +63,6 @@ def get_ini_content():
    # Add extra script for C++ flags
    CORE.add_platformio_option("extra_scripts", [f"pre:{CXX_FLAGS_FILE_NAME}"])

-    # Add CMake args. A user-supplied value (str or list) is deliberately
-    # replaced; this option was always overwritten at FINAL priority.
-    if CORE.cmake_args:
-        CORE.add_platformio_option(
-            "board_build.cmake_extra_args",
-            " ".join(
-                f"-D{name}={value}" for name, value in sorted(CORE.cmake_args.items())
-            ),
-            replace=True,
-        )
-
    content = "[platformio]\n"
    content += f"description = ESPHome {__version__}\n"

@@ -25,7 +25,6 @@ from esphome.cpp_generator import (  # noqa: F401
    add,
    add_build_flag,
    add_build_unflag,
-    add_cmake_arg,
    add_cxx_build_flag,
    add_define,
    add_global,
@@ -49,12 +49,6 @@ CONFIG_SCHEMA = cv.All(


 async def to_code(config):
-    if CORE.is_esp32:
-        from esphome.components.esp32 import include_builtin_idf_component
-
-        # Re-enable the gptimer driver (excluded by default to save compile time)
-        include_builtin_idf_component("esp_driver_gptimer")
-
    if CORE.is_esp8266:
        # ac_dimmer uses setTimer1Callback which requires the waveform generator
        from esphome.components.esp8266.const import require_waveform
@@ -1,5 +1,3 @@
-from typing import Any
-
 from esphome import pins
 import esphome.codegen as cg
 from esphome.components.esp32 import (
@@ -18,7 +16,6 @@ from esphome.components.esp32 import (
 import esphome.config_validation as cv
 from esphome.const import CONF_ANALOG, CONF_INPUT, CONF_NUMBER, PLATFORM_ESP8266
 from esphome.core import CORE
-from esphome.types import ConfigType

 CODEOWNERS = ["@esphome/core"]

@@ -228,7 +225,7 @@ ESP32_VARIANT_ADC2_PIN_TO_CHANNEL = {
 }


-def validate_adc_pin(value: Any) -> ConfigType | str:
+def validate_adc_pin(value):
    if str(value).upper() == "VCC":
        if CORE.is_rp2:
            return pins.internal_gpio_input_pin_schema(29)
@@ -52,7 +52,7 @@ _attenuation = cv.enum(ATTENUATION_MODES, lower=True)
 _sampling_mode = cv.enum(SAMPLING_MODES, lower=True)


-def validate_config(config: ConfigType) -> ConfigType:
+def validate_config(config):
    if config[CONF_RAW] and config.get(CONF_ATTENUATION, None) == "auto":
        raise cv.Invalid("Automatic attenuation cannot be used when raw output is set")

@@ -120,7 +120,7 @@ CONFIG_SCHEMA = cv.All(
 CONF_ADC_CHANNEL_ID = "adc_channel_id"


-def _overlay_io_channels() -> str:
+def _overlay_io_channels():
    channel_count = CORE.data[CONF_ADC_CHANNEL_ID]
    entries = ", ".join(f"<&adc {channel_id}>" for channel_id in range(channel_count))
    return f"""
@@ -132,7 +132,7 @@ def _overlay_io_channels() -> str:
            """


-async def to_code(config: ConfigType) -> None:
+async def to_code(config):
    var = cg.new_Pvariable(config[CONF_ID])
    await cg.register_component(var, config)
    await sensor.register_sensor(var, config)
@@ -17,9 +17,6 @@ from esphome.const import (
    UNIT_OHM,
    UNIT_PARTS_PER_BILLION,
 )
-from esphome.core import ID
-from esphome.cpp_generator import MockObj, TemplateArgsType
-from esphome.types import ConfigType

 CONF_RESISTANCE = "resistance"

@@ -65,7 +62,7 @@ CONFIG_SCHEMA = (
 FINAL_VALIDATE_SCHEMA = i2c.final_validate_device_schema("ags10", max_frequency="15khz")


-async def to_code(config: ConfigType) -> None:
+async def to_code(config):
    var = cg.new_Pvariable(config[CONF_ID])
    await cg.register_component(var, config)
    await i2c.register_i2c_device(var, config)
@@ -97,12 +94,7 @@ AGS10_NEW_I2C_ADDRESS_SCHEMA = cv.maybe_simple_value(
    AGS10_NEW_I2C_ADDRESS_SCHEMA,
    synchronous=True,
 )
-async def ags10newi2caddress_to_code(
-    config: ConfigType,
-    action_id: ID,
-    template_arg: cg.TemplateArguments,
-    args: TemplateArgsType,
-) -> MockObj:
+async def ags10newi2caddress_to_code(config, action_id, template_arg, args):
    var = cg.new_Pvariable(action_id, template_arg)
    await cg.register_parented(var, config[CONF_ID])
    address = await cg.templatable(config[CONF_ADDRESS], args, cg.uint8)
@@ -134,12 +126,7 @@ AGS10_SET_ZERO_POINT_SCHEMA = cv.Schema(
    AGS10_SET_ZERO_POINT_SCHEMA,
    synchronous=True,
 )
-async def ags10setzeropoint_to_code(
-    config: ConfigType,
-    action_id: ID,
-    template_arg: cg.TemplateArguments,
-    args: TemplateArgsType,
-) -> MockObj:
+async def ags10setzeropoint_to_code(config, action_id, template_arg, args):
    var = cg.new_Pvariable(action_id, template_arg)
    await cg.register_parented(var, config[CONF_ID])
    mode = await cg.templatable(
@@ -4,9 +4,6 @@ from esphome.components import i2c
 from esphome.components.audio_dac import AudioDac
 import esphome.config_validation as cv
 from esphome.const import CONF_ID, CONF_MODE
-from esphome.core import ID
-from esphome.cpp_generator import MockObj, TemplateArgsType
-from esphome.types import ConfigType

 CODEOWNERS = ["@kbx81"]
 DEPENDENCIES = ["i2c"]
@@ -42,12 +39,7 @@ SET_AUTO_MUTE_ACTION_SCHEMA = cv.maybe_simple_value(
    SET_AUTO_MUTE_ACTION_SCHEMA,
    synchronous=True,
 )
-async def aic3204_set_volume_to_code(
-    config: ConfigType,
-    action_id: ID,
-    template_arg: cg.TemplateArguments,
-    args: TemplateArgsType,
-) -> MockObj:
+async def aic3204_set_volume_to_code(config, action_id, template_arg, args):
    paren = await cg.get_variable(config[CONF_ID])
    var = cg.new_Pvariable(action_id, template_arg, paren)

@@ -57,7 +49,7 @@ async def aic3204_set_volume_to_code(
    return var


-async def to_code(config: ConfigType) -> None:
+async def to_code(config):
    var = cg.new_Pvariable(config[CONF_ID])
    await cg.register_component(var, config)
    await i2c.register_i2c_device(var, config)
@@ -6,8 +6,6 @@ from esphome.components.file.image import image_schema, write_image
 from esphome.components.image import Image_, validate_settings
 import esphome.config_validation as cv
 from esphome.const import CONF_ID, CONF_REPEAT
-from esphome.core import ID
-from esphome.cpp_generator import MockObj, TemplateArgsType
 from esphome.types import ConfigType

 CODEOWNERS = ["@syndlex"]
@@ -81,12 +79,7 @@ SET_FRAME_SCHEMA = cv.Schema(
@automation.register_action(
    "animation.set_frame", SetFrameAction, SET_FRAME_SCHEMA, synchronous=True
 )
-async def animation_action_to_code(
-    config: ConfigType,
-    action_id: ID,
-    template_arg: cg.TemplateArguments,
-    args: TemplateArgsType,
-) -> MockObj:
+async def animation_action_to_code(config, action_id, template_arg, args):
    paren = await cg.get_variable(config[CONF_ID])
    var = cg.new_Pvariable(action_id, template_arg, paren)

@@ -2,7 +2,6 @@ import esphome.codegen as cg
 from esphome.components import i2c
 import esphome.config_validation as cv
 from esphome.const import CONF_ID
-from esphome.types import ConfigType

 DEPENDENCIES = ["i2c"]
 MULTI_CONF = True
@@ -58,7 +57,7 @@ CONFIG_SCHEMA = (
 )


-async def to_code(config: ConfigType) -> None:
+async def to_code(config):
    var = cg.new_Pvariable(config[CONF_ID])
    await cg.register_component(var, config)
    await i2c.register_i2c_device(var, config)
@@ -2,7 +2,6 @@ import esphome.codegen as cg
 from esphome.components import binary_sensor
 import esphome.config_validation as cv
 from esphome.const import CONF_DIRECTION, DEVICE_CLASS_MOVING
-from esphome.types import ConfigType

 from . import APDS9960, CONF_APDS9960_ID

@@ -20,7 +19,7 @@ CONFIG_SCHEMA = binary_sensor.binary_sensor_schema(
 )


-async def to_code(config: ConfigType) -> None:
+async def to_code(config):
    hub = await cg.get_variable(config[CONF_APDS9960_ID])
    var = await binary_sensor.new_binary_sensor(config)
    func = getattr(hub, f"set_{config[CONF_DIRECTION]}_direction_binary_sensor")
@@ -7,7 +7,6 @@ from esphome.const import (
    STATE_CLASS_MEASUREMENT,
    UNIT_PERCENT,
 )
-from esphome.types import ConfigType

 from . import APDS9960, CONF_APDS9960_ID

@@ -28,7 +27,7 @@ CONFIG_SCHEMA = sensor.sensor_schema(
 )


-async def to_code(config: ConfigType) -> None:
+async def to_code(config):
    hub = await cg.get_variable(config[CONF_APDS9960_ID])
    var = await sensor.new_sensor(config)
    func = getattr(hub, f"set_{config[CONF_TYPE]}_sensor")
@@ -1,19 +1,10 @@
+import base64
 import logging
-from typing import Any

 from esphome import automation
 from esphome.automation import Condition
 import esphome.codegen as cg
 from esphome.components.logger import request_log_listener
-
-# ENCRYPTION_SCHEMA and validate_encryption_key are re-exported for external
-# components and downstream consumers that import them from api
-from esphome.components.noise import (  # noqa: F401
-    ENCRYPTION_SCHEMA,
-    decode_encryption_key,
-    encryption_schema,
-    validate_encryption_key,
-)
 from esphome.config_helpers import get_logger_level
 import esphome.config_validation as cv
 from esphome.const import (
@@ -46,10 +37,6 @@ from esphome.core import CORE, ID, CoroPriority, EsphomeError, coroutine_with_pr
 from esphome.cpp_generator import MockObj, TemplateArgsType
 from esphome.types import ConfigFragmentType, ConfigType

-# Compat alias: downstream consumers (e.g. device-builder) referenced the
-# schema by its old private name before it moved to the noise component
-_encryption_schema = encryption_schema
-
 _LOGGER = logging.getLogger(__name__)

 DOMAIN = "api"
@@ -58,15 +45,9 @@ CODEOWNERS = ["@esphome/core"]


 def AUTO_LOAD(config: ConfigType) -> list[str]:
-    """Conditionally auto-load noise (encryption) and json (capture_response)."""
+    """Conditionally auto-load json only when capture_response is used."""
    base = ["socket"]

-    # A falsy config is a tooling probe for the maximal set (None from
-    # dependency resolution, {} from the components-graph platform probe);
-    # a validated config always carries defaults, never empty
-    if not config or CONF_ENCRYPTION in config:
-        base = base + ["noise"]
-
    # Check if any homeassistant.action/homeassistant.service has capture_response: true
    # This flag is set during config validation in _validate_response_config
    if not config or CORE.data.get(DOMAIN, {}).get(CONF_CAPTURE_RESPONSE, False):
@@ -148,6 +129,20 @@ def _register_provisioning_source(config: ConfigType) -> ConfigType:
    return config


+def validate_encryption_key(value):
+    value = cv.string_strict(value)
+    try:
+        decoded = base64.b64decode(value, validate=True)
+    except ValueError as err:
+        raise cv.Invalid("Invalid key format, please check it's using base64") from err
+
+    if len(decoded) != 32:
+        raise cv.Invalid("Encryption key must be base64 and 32 bytes long")
+
+    # Return original data for roundtrip conversion
+    return value
+
+
 CONF_SUPPORTS_RESPONSE = "supports_response"

 # Enum values in api::enums namespace
@@ -222,7 +217,7 @@ def _auto_detect_supports_response(config: ConfigType) -> ConfigType:
    return config


-def _validate_supports_response(value: Any) -> str:
+def _validate_supports_response(value):
    """Validate supports_response after auto-detection has set the value."""
    return cv.enum(SUPPORTS_RESPONSE_OPTIONS, lower=True)(value)

@@ -254,6 +249,18 @@ ACTIONS_SCHEMA = automation.validate_automation(
    ),
 )

+ENCRYPTION_SCHEMA = cv.Schema(
+    {
+        cv.Optional(CONF_KEY): cv.sensitive(validate_encryption_key),
+    }
+)
+
+
+def _encryption_schema(config):
+    if config is None:
+        config = {}
+    return ENCRYPTION_SCHEMA(config)
+

 def _consume_api_sockets(config: ConfigType) -> ConfigType:
    """Register socket needs for API component."""
@@ -289,7 +296,7 @@ CONFIG_SCHEMA = cv.All(
                CONF_SERVICES, group_of_exclusion=CONF_ACTIONS
            ): ACTIONS_SCHEMA,
            cv.Exclusive(CONF_ACTIONS, group_of_exclusion=CONF_ACTIONS): ACTIONS_SCHEMA,
-            cv.Optional(CONF_ENCRYPTION): encryption_schema,
+            cv.Optional(CONF_ENCRYPTION): _encryption_schema,
            cv.Optional(CONF_BATCH_DELAY, default="100ms"): cv.All(
                cv.positive_time_period_milliseconds,
                cv.Range(max=cv.TimePeriod(milliseconds=65535)),
@@ -386,7 +393,7 @@ async def to_code(config: ConfigType) -> None:

    if actions := config.get(CONF_ACTIONS, []):
        # Collect all triggers first, then register all at once with initializer_list
-        triggers: list[cg.MockObj] = []
+        triggers: list[cg.Pvariable] = []
        for conf in actions:
            func_args: list[tuple[MockObj, str]] = []
            service_template_args: list[MockObj] = []  # User service argument types
@@ -476,7 +483,7 @@ async def to_code(config: ConfigType) -> None:

    if (encryption_config := config.get(CONF_ENCRYPTION, None)) is not None:
        if key := encryption_config.get(CONF_KEY):
-            decoded = decode_encryption_key(key)
+            decoded = base64.b64decode(key)
            cg.add(var.set_noise_psk(list(decoded)))
            cg.add_define("USE_API_NOISE_PSK_FROM_YAML")
        else:
@@ -490,6 +497,10 @@ async def to_code(config: ConfigType) -> None:
            # and plaintext disabled. Only a factory reset can remove it.
            cg.add_define("USE_API_PLAINTEXT")
        cg.add_define("USE_API_NOISE")
+        cg.add_library("esphome/noise-c", "0.1.21")
+        # Enable optimized memzero/memcmp in libsodium instead of volatile byte loops
+        cg.add_build_flag("-DHAVE_WEAK_SYMBOLS=1")
+        cg.add_build_flag("-DHAVE_INLINE_ASM=1")
    else:
        cg.add_define("USE_API_PLAINTEXT")

@@ -570,7 +581,7 @@ async def homeassistant_service_to_code(
    action_id: ID,
    template_arg: cg.TemplateArguments,
    args: TemplateArgsType,
-) -> MockObj:
+):
    cg.add_define("USE_API_HOMEASSISTANT_SERVICES")
    serv = await cg.get_variable(config[CONF_ID])
    var = cg.new_Pvariable(action_id, template_arg, serv, False)
@@ -636,7 +647,7 @@ async def homeassistant_service_to_code(
    return var


-def validate_homeassistant_event(value: Any) -> str:
+def validate_homeassistant_event(value):
    value = cv.string(value)
    if not value.startswith("esphome."):
        raise cv.Invalid(
@@ -665,12 +676,7 @@ HOMEASSISTANT_EVENT_ACTION_SCHEMA = cv.Schema(
    HOMEASSISTANT_EVENT_ACTION_SCHEMA,
    synchronous=True,
 )
-async def homeassistant_event_to_code(
-    config: ConfigType,
-    action_id: ID,
-    template_arg: cg.TemplateArguments,
-    args: TemplateArgsType,
-) -> MockObj:
+async def homeassistant_event_to_code(config, action_id, template_arg, args):
    cg.add_define("USE_API_HOMEASSISTANT_SERVICES")
    serv = await cg.get_variable(config[CONF_ID])
    var = cg.new_Pvariable(action_id, template_arg, serv, True)
@@ -718,12 +724,7 @@ HOMEASSISTANT_TAG_SCANNED_ACTION_SCHEMA = cv.maybe_simple_value(
    HOMEASSISTANT_TAG_SCANNED_ACTION_SCHEMA,
    synchronous=True,
 )
-async def homeassistant_tag_scanned_to_code(
-    config: ConfigType,
-    action_id: ID,
-    template_arg: cg.TemplateArguments,
-    args: TemplateArgsType,
-) -> MockObj:
+async def homeassistant_tag_scanned_to_code(config, action_id, template_arg, args):
    cg.add_define("USE_API_HOMEASSISTANT_SERVICES")
    serv = await cg.get_variable(config[CONF_ID])
    var = cg.new_Pvariable(action_id, template_arg, serv, True)
@@ -739,7 +740,7 @@ CONF_SUCCESS = "success"
 CONF_ERROR_MESSAGE = "error_message"


-def _validate_api_respond_data(config: ConfigType) -> ConfigType:
+def _validate_api_respond_data(config):
    """Set flag during validation so AUTO_LOAD can include json component."""
    if CONF_DATA in config:
        CORE.data.setdefault(DOMAIN, {})[CONF_CAPTURE_RESPONSE] = True
@@ -823,12 +824,7 @@ API_CONNECTED_CONDITION_SCHEMA = cv.Schema(
@automation.register_condition(
    "api.connected", APIConnectedCondition, API_CONNECTED_CONDITION_SCHEMA
 )
-async def api_connected_to_code(
-    config: ConfigType,
-    condition_id: ID,
-    template_arg: cg.TemplateArguments,
-    args: TemplateArgsType,
-) -> MockObj:
+async def api_connected_to_code(config, condition_id, template_arg, args):
    var = cg.new_Pvariable(condition_id, template_arg)
    templ = await cg.templatable(config[CONF_STATE_SUBSCRIPTION_ONLY], args, cg.bool_)
    cg.add(var.set_state_subscription_only(templ))
@@ -412,15 +412,15 @@ void APIConnection::finalize_iterator_sync_() {
 }

 void APIConnection::process_iterator_batch_(ComponentIterator &iterator) {
-  // Budget by remaining batch capacity so a pass cannot overfill the batch;
-  // stops early on a refused send and resumes next loop pass
-  size_t batch_size = this->deferred_batch_.size();
-  if (batch_size < MAX_INITIAL_BATCH_SIZE)
-    iterator.try_advance(MAX_INITIAL_BATCH_SIZE - batch_size);
+  size_t initial_size = this->deferred_batch_.size();
+  size_t max_batch = MAX_INITIAL_PER_BATCH;
+  while (!iterator.completed() && (this->deferred_batch_.size() - initial_size) < max_batch) {
+    iterator.advance();
+  }

-  // Flush immediately once enough is queued (not guaranteed every pass);
-  // partial batches go out via the batch timer or finalize_iterator_sync_()
-  if (this->deferred_batch_.size() >= MAX_INITIAL_BATCH_SIZE) {
+  // If the batch is full, process it immediately
+  // Note: iterator.advance() already calls schedule_batch_() via schedule_message_()
+  if (this->deferred_batch_.size() >= max_batch) {
    this->process_batch_();
  }
 }
@@ -2130,7 +2130,7 @@ bool APIConnection::send_noise_encryption_set_key_response_(const NoiseEncryptio
  }
 #endif

-  noise::psk_t psk{};
+  psk_t psk{};
  if (msg.key_len == 0) {
    if (this->parent_->clear_noise_psk(true)) {
      resp.success = true;
@@ -2139,7 +2139,7 @@ bool APIConnection::send_noise_encryption_set_key_response_(const NoiseEncryptio
    }
  } else if (base64_decode(msg.key, msg.key_len, psk.data(), psk.size()) != psk.size()) {
    ESP_LOGW(TAG, "Invalid encryption key length");
-  } else if (noise::NoiseContext::is_all_zeros(psk)) {
+  } else if (APINoiseContext::is_all_zeros(psk)) {
    // Accepting the reserved provisioning PSK would report success without
    // enabling encryption (or silently clear an existing key)
    ESP_LOGW(TAG, "Rejecting all-zero encryption key");
@@ -53,11 +53,11 @@ void log_dropped_message(const char *tag, int line, const LogString *what);

 // Keepalive timeout in milliseconds
 static constexpr uint32_t KEEPALIVE_TIMEOUT_MS = 60000;
-// Deferred batch size cap during initial state/info sync
-static constexpr size_t MAX_INITIAL_BATCH_SIZE = 34;
+// Maximum number of entities to process in a single batch during initial state/info sending
+static constexpr size_t MAX_INITIAL_PER_BATCH = 34;
 // Verify MAX_MESSAGES_PER_BATCH (defined in api_frame_helper.h) can hold the initial batch
-static_assert(MAX_MESSAGES_PER_BATCH >= MAX_INITIAL_BATCH_SIZE,
-              "MAX_MESSAGES_PER_BATCH must be >= MAX_INITIAL_BATCH_SIZE");
+static_assert(MAX_MESSAGES_PER_BATCH >= MAX_INITIAL_PER_BATCH,
+              "MAX_MESSAGES_PER_BATCH must be >= MAX_INITIAL_PER_BATCH");

 #ifdef USE_BENCHMARK
 class APIConnection;
@@ -36,7 +36,7 @@ static constexpr uint16_t MAX_MESSAGE_SIZE = 32768;  // 32 KiB for ESP32 and oth
 static constexpr uint16_t RX_BUF_NULL_TERMINATOR = 1;

 // Maximum number of messages to batch in a single write operation
-// Must be >= MAX_INITIAL_BATCH_SIZE in api_connection.h (enforced by static_assert there)
+// Must be >= MAX_INITIAL_PER_BATCH in api_connection.h (enforced by static_assert there)
 static constexpr size_t MAX_MESSAGES_PER_BATCH = 34;

 // Max client name length (e.g., "Home Assistant 2026.1.0.dev0" = 28 chars)
@@ -2,9 +2,9 @@
 #ifdef USE_API
 #ifdef USE_API_NOISE
 #include "api_connection.h"  // For ClientInfo struct
-#include "esphome/components/noise/noise.h"
 #include "esphome/core/application.h"
 #include "esphome/core/entity_base.h"
+#include "esphome/core/hal.h"
 #include "esphome/core/helpers.h"
 #include "esphome/core/log.h"
 #include "proto.h"
@@ -17,14 +17,6 @@

 namespace esphome::api {

-using noise::noise_err_to_logstr;
-
-// api_frame_helper.h keeps its own MAX_HANDSHAKE_SIZE because that header is
-// also compiled in plaintext-only builds without the noise component; keep
-// the two definitions from drifting apart.
-static_assert(MAX_HANDSHAKE_SIZE == noise::MAX_HANDSHAKE_SIZE,
-              "api and noise component handshake size limits must match");
-
 static const char *const TAG = "api.noise";
 #ifdef USE_ESP8266
 static constexpr char PROLOGUE_INIT[] PROGMEM = "NoiseAPIInit";
@@ -59,6 +51,45 @@ static constexpr size_t API_MAX_LOG_BYTES = 168;
 #define LOG_PACKET_RECEIVED(buffer) ((void) 0)
 #endif

+/// Convert a noise error code to a readable error
+const LogString *noise_err_to_logstr(int err) {
+  if (err == NOISE_ERROR_NO_MEMORY)
+    return LOG_STR("NO_MEMORY");
+  if (err == NOISE_ERROR_UNKNOWN_ID)
+    return LOG_STR("UNKNOWN_ID");
+  if (err == NOISE_ERROR_UNKNOWN_NAME)
+    return LOG_STR("UNKNOWN_NAME");
+  if (err == NOISE_ERROR_MAC_FAILURE)
+    return LOG_STR("MAC_FAILURE");
+  if (err == NOISE_ERROR_NOT_APPLICABLE)
+    return LOG_STR("NOT_APPLICABLE");
+  if (err == NOISE_ERROR_SYSTEM)
+    return LOG_STR("SYSTEM");
+  if (err == NOISE_ERROR_REMOTE_KEY_REQUIRED)
+    return LOG_STR("REMOTE_KEY_REQUIRED");
+  if (err == NOISE_ERROR_LOCAL_KEY_REQUIRED)
+    return LOG_STR("LOCAL_KEY_REQUIRED");
+  if (err == NOISE_ERROR_PSK_REQUIRED)
+    return LOG_STR("PSK_REQUIRED");
+  if (err == NOISE_ERROR_INVALID_LENGTH)
+    return LOG_STR("INVALID_LENGTH");
+  if (err == NOISE_ERROR_INVALID_PARAM)
+    return LOG_STR("INVALID_PARAM");
+  if (err == NOISE_ERROR_INVALID_STATE)
+    return LOG_STR("INVALID_STATE");
+  if (err == NOISE_ERROR_INVALID_NONCE)
+    return LOG_STR("INVALID_NONCE");
+  if (err == NOISE_ERROR_INVALID_PRIVATE_KEY)
+    return LOG_STR("INVALID_PRIVATE_KEY");
+  if (err == NOISE_ERROR_INVALID_PUBLIC_KEY)
+    return LOG_STR("INVALID_PUBLIC_KEY");
+  if (err == NOISE_ERROR_INVALID_FORMAT)
+    return LOG_STR("INVALID_FORMAT");
+  if (err == NOISE_ERROR_INVALID_SIGNATURE)
+    return LOG_STR("INVALID_SIGNATURE");
+  return LOG_STR("UNKNOWN");
+}
+
 /// Initialize the frame helper, returns OK if successful.
 APIError APINoiseFrameHelper::init() {
  APIError err = init_common_();
@@ -163,9 +194,9 @@ APIError APINoiseFrameHelper::loop() {
 */
 APIError APINoiseFrameHelper::try_read_frame_() {
  // read header
-  if (rx_header_buf_len_ < noise::FRAME_HEADER_SIZE) {
+  if (rx_header_buf_len_ < 3) {
    // no header information yet
-    uint8_t to_read = static_cast<uint8_t>(noise::FRAME_HEADER_SIZE) - rx_header_buf_len_;
+    uint8_t to_read = 3 - rx_header_buf_len_;
    ssize_t received = this->socket_->read(&rx_header_buf_[rx_header_buf_len_], to_read);
    APIError err = handle_socket_read_result_(received);
    if (err != APIError::OK) {
@@ -177,7 +208,7 @@ APIError APINoiseFrameHelper::try_read_frame_() {
      return APIError::WOULD_BLOCK;
    }

-    if (rx_header_buf_[0] != noise::FRAME_INDICATOR) {
+    if (rx_header_buf_[0] != 0x01) {
      state_ = State::FAILED;
      HELPER_LOG("Bad indicator byte %u", rx_header_buf_[0]);
      return APIError::BAD_INDICATOR;
@@ -317,15 +348,15 @@ APIError APINoiseFrameHelper::state_action_server_hello_() {
  return APIError::OK;
 }
 APIError APINoiseFrameHelper::state_action_handshake_() {
-  noise::NoiseResponderHandshake::Action action = this->handshake_.action();
-  if (action == noise::NoiseResponderHandshake::Action::ACTION_READ) {
+  int action = noise_handshakestate_get_action(this->handshake_);
+  if (action == NOISE_ACTION_READ_MESSAGE) {
    return this->state_action_handshake_read_();
-  } else if (action == noise::NoiseResponderHandshake::Action::ACTION_WRITE) {
+  } else if (action == NOISE_ACTION_WRITE_MESSAGE) {
    return this->state_action_handshake_write_();
  }
  // bad state for action
  this->state_ = State::FAILED;
-  HELPER_LOG("Bad action for handshake: %d", (int) action);
+  HELPER_LOG("Bad action for handshake: %d", action);
  return APIError::HANDSHAKESTATE_BAD_STATE;
 }
 APIError APINoiseFrameHelper::state_action_handshake_read_() {
@@ -337,16 +368,20 @@ APIError APINoiseFrameHelper::state_action_handshake_read_() {
  if (this->rx_buf_.empty()) {
    this->send_explicit_handshake_reject_(LOG_STR("Empty handshake message"));
    return APIError::BAD_HANDSHAKE_ERROR_BYTE;
-  } else if (this->rx_buf_[0] != noise::HANDSHAKE_STATUS_OK) {
+  } else if (this->rx_buf_[0] != 0x00) {
    HELPER_LOG("Bad handshake error byte: %u", this->rx_buf_[0]);
    this->send_explicit_handshake_reject_(LOG_STR("Bad handshake error byte"));
    return APIError::BAD_HANDSHAKE_ERROR_BYTE;
  }

-  int err = this->handshake_.read_message(this->rx_buf_.data() + 1, this->rx_buf_.size() - 1);
+  NoiseBuffer mbuf;
+  noise_buffer_init(mbuf);
+  noise_buffer_set_input(mbuf, this->rx_buf_.data() + 1, this->rx_buf_.size() - 1);
+  int err = noise_handshakestate_read_message(this->handshake_, &mbuf, nullptr);
  if (err != 0) {
    // Special handling for MAC failure
-    this->send_explicit_handshake_reject_(noise::reject_reason_for(err));
+    this->send_explicit_handshake_reject_(err == NOISE_ERROR_MAC_FAILURE ? LOG_STR("Handshake MAC failure")
+                                                                         : LOG_STR("Handshake error"));
    return this->handle_noise_error_(err, LOG_STR("noise_handshakestate_read_message"),
                                     APIError::HANDSHAKESTATE_READ_FAILED);
  }
@@ -355,16 +390,18 @@ APIError APINoiseFrameHelper::state_action_handshake_read_() {
 }
 APIError APINoiseFrameHelper::state_action_handshake_write_() {
  uint8_t buffer[65];
-  size_t msg_len = 0;
+  NoiseBuffer mbuf;
+  noise_buffer_init(mbuf);
+  noise_buffer_set_output(mbuf, buffer + 1, sizeof(buffer) - 1);

-  int err = this->handshake_.write_message(buffer + 1, sizeof(buffer) - 1, msg_len);
+  int err = noise_handshakestate_write_message(this->handshake_, &mbuf, nullptr);
  APIError aerr = this->handle_noise_error_(err, LOG_STR("noise_handshakestate_write_message"),
                                            APIError::HANDSHAKESTATE_WRITE_FAILED);
  if (aerr != APIError::OK)
    return aerr;
-  buffer[0] = noise::HANDSHAKE_STATUS_OK;
+  buffer[0] = 0x00;  // success

-  aerr = this->write_frame_(buffer, msg_len + 1);
+  aerr = this->write_frame_(buffer, mbuf.size + 1);
  if (aerr != APIError::OK)
    return aerr;
  return this->check_handshake_finished_();
@@ -372,22 +409,33 @@ APIError APINoiseFrameHelper::state_action_handshake_write_() {
 void APINoiseFrameHelper::send_explicit_handshake_reject_(const LogString *reason) {
  // Max reject message: "Bad handshake packet len" (24) + 1 (failure byte) = 25 bytes
  uint8_t data[32];
-  static_assert(sizeof(data) >= noise::MAC_FAILURE_PAYLOAD_SIZE,
-                "reject buffer must fit the MAC failure wire contract");
-  size_t data_size = noise::format_reject_payload(data, sizeof(data), reason);
+  data[0] = 0x01;  // failure
+
+#ifdef USE_STORE_LOG_STR_IN_FLASH
+  // On ESP8266 with flash strings, we need to use PROGMEM-aware functions
+  size_t reason_len = strlen_P(reinterpret_cast<PGM_P>(reason));
+  reason_len = std::min(reason_len, sizeof(data) - 1);
+  if (reason_len > 0) {
+    memcpy_P(data + 1, reinterpret_cast<PGM_P>(reason), reason_len);
+  }
+#else
+  // Normal memory access
+  const char *reason_str = LOG_STR_ARG(reason);
+  size_t reason_len = strlen(reason_str);
+  reason_len = std::min(reason_len, sizeof(data) - 1);
+  if (reason_len > 0) {
+    // NOLINTNEXTLINE(bugprone-not-null-terminated-result) - binary protocol, not a C string
+    std::memcpy(data + 1, reason_str, reason_len);
+  }
+#endif
+
+  size_t data_size = reason_len + 1;

  // temporarily remove failed state
  auto orig_state = state_;
  state_ = State::EXPLICIT_REJECT;
-  APIError aerr = write_frame_(data, data_size);
-  if (aerr != APIError::OK) {
-    // Best effort; the reject reason is a diagnosis aid, not a protocol step
-    ESP_LOGW(TAG, "Sending handshake reject failed: %d", (int) aerr);
-  }
-  if (state_ == State::EXPLICIT_REJECT) {
-    // write_frame_ may have moved the state to FAILED; keep that decision
-    state_ = orig_state;
-  }
+  write_frame_(data, data_size);
+  state_ = orig_state;
 }
 APIError APINoiseFrameHelper::read_packet(ReadPacketBuffer *buffer) {
  APIError aerr = this->check_data_state_();
@@ -444,10 +492,12 @@ APIError APINoiseFrameHelper::read_packet(ReadPacketBuffer *buffer) {
 // Returns APIError::OK on success.
 APIError APINoiseFrameHelper::encrypt_noise_message_(uint8_t *buf_start, uint16_t payload_size, uint8_t message_type,
                                                     uint16_t &encrypted_len_out) {
-  // The noise frame header is written after encryption, when the size is known
+  // Write noise header
+  buf_start[0] = 0x01;  // indicator
+  // buf_start[1], buf_start[2] to be set after encryption

  // Write message header (to be encrypted)
-  constexpr uint8_t msg_offset = noise::FRAME_HEADER_SIZE;
+  constexpr uint8_t msg_offset = 3;
  buf_start[msg_offset] = static_cast<uint8_t>(message_type >> 8);      // type high byte
  buf_start[msg_offset + 1] = static_cast<uint8_t>(message_type);       // type low byte
  buf_start[msg_offset + 2] = static_cast<uint8_t>(payload_size >> 8);  // data_len high byte
@@ -465,10 +515,11 @@ APIError APINoiseFrameHelper::encrypt_noise_message_(uint8_t *buf_start, uint16_
  if (aerr != APIError::OK)
    return aerr;

-  // Fill in the frame header now that the encrypted size is known
-  noise::write_frame_header(buf_start, static_cast<uint16_t>(mbuf.size));
+  // Fill in the encrypted size
+  buf_start[1] = static_cast<uint8_t>(mbuf.size >> 8);
+  buf_start[2] = static_cast<uint8_t>(mbuf.size);

-  encrypted_len_out = static_cast<uint16_t>(noise::FRAME_HEADER_SIZE + mbuf.size);
+  encrypted_len_out = static_cast<uint16_t>(3 + mbuf.size);  // indicator + size + encrypted data
  return APIError::OK;
 }

@@ -517,19 +568,21 @@ APIError APINoiseFrameHelper::write_protobuf_messages(ProtoWriteBuffer buffer, s
 }

 APIError APINoiseFrameHelper::write_frame_(const uint8_t *data, uint16_t len) {
-  uint8_t header[noise::FRAME_HEADER_SIZE];
-  noise::write_frame_header(header, len);
+  uint8_t header[3];
+  header[0] = 0x01;  // indicator
+  header[1] = (uint8_t) (len >> 8);
+  header[2] = (uint8_t) len;

  if (len == 0) {
-    return this->write_raw_buf_(header, noise::FRAME_HEADER_SIZE);
+    return this->write_raw_buf_(header, 3);
  }
  struct iovec iov[2];
  iov[0].iov_base = header;
-  iov[0].iov_len = noise::FRAME_HEADER_SIZE;
+  iov[0].iov_len = 3;
  iov[1].iov_base = const_cast<uint8_t *>(data);
  iov[1].iov_len = len;

-  return this->write_raw_iov_(iov, 2, noise::FRAME_HEADER_SIZE + len);
+  return this->write_raw_iov_(iov, 2, 3 + len);
 }

 /** Initiate the data structures for the handshake.
@@ -537,12 +590,45 @@ APIError APINoiseFrameHelper::write_frame_(const uint8_t *data, uint16_t len) {
 * @return 0 on success, -1 on error (check errno)
 */
 APIError APINoiseFrameHelper::init_handshake_() {
-  int err = this->handshake_.init(this->ctx_.get_psk(), prologue_.data(), prologue_.size());
-  APIError aerr = handle_noise_error_(err, LOG_STR("noise_handshake_init"), APIError::HANDSHAKESTATE_SETUP_FAILED);
+  int err;
+  // Noise_NNpsk0_25519_ChaChaPoly_SHA256, built on the stack:
+  // noise_handshakestate_new_by_id copies it, so a member would waste
+  // 104 bytes per connection, and a static const would sit in RAM on
+  // ESP8266 (.rodata is DRAM there).
+  const NoiseProtocolId nid = {
+      .prefix_id = NOISE_PREFIX_STANDARD,
+      .pattern_id = NOISE_PATTERN_NN,
+      .modifier_ids = {NOISE_MODIFIER_PSK0},
+      .dh_id = NOISE_DH_CURVE25519,
+      .cipher_id = NOISE_CIPHER_CHACHAPOLY,
+      .hash_id = NOISE_HASH_SHA256,
+      .hybrid_id = NOISE_DH_NONE,
+  };
+
+  err = noise_handshakestate_new_by_id(&handshake_, &nid, NOISE_ROLE_RESPONDER);
+  APIError aerr =
+      handle_noise_error_(err, LOG_STR("noise_handshakestate_new_by_id"), APIError::HANDSHAKESTATE_SETUP_FAILED);
  if (aerr != APIError::OK)
    return aerr;
-  // init copies the prologue into the handshakestate, so we can get rid of it now
+
+  const auto &psk = this->ctx_.get_psk();
+  err = noise_handshakestate_set_pre_shared_key(handshake_, psk.data(), psk.size());
+  aerr = handle_noise_error_(err, LOG_STR("noise_handshakestate_set_pre_shared_key"),
+                             APIError::HANDSHAKESTATE_SETUP_FAILED);
+  if (aerr != APIError::OK)
+    return aerr;
+
+  err = noise_handshakestate_set_prologue(handshake_, prologue_.data(), prologue_.size());
+  aerr = handle_noise_error_(err, LOG_STR("noise_handshakestate_set_prologue"), APIError::HANDSHAKESTATE_SETUP_FAILED);
+  if (aerr != APIError::OK)
+    return aerr;
+  // set_prologue copies it into handshakestate, so we can get rid of it now
  prologue_.release();
+
+  err = noise_handshakestate_start(handshake_);
+  aerr = handle_noise_error_(err, LOG_STR("noise_handshakestate_start"), APIError::HANDSHAKESTATE_SETUP_FAILED);
+  if (aerr != APIError::OK)
+    return aerr;
  return APIError::OK;
 }

@@ -551,17 +637,15 @@ APIError APINoiseFrameHelper::check_handshake_finished_() {
  assert(state_ == State::HANDSHAKE);
 #endif

-  noise::NoiseResponderHandshake::Action action = this->handshake_.action();
-  if (action == noise::NoiseResponderHandshake::Action::ACTION_READ ||
-      action == noise::NoiseResponderHandshake::Action::ACTION_WRITE)
+  int action = noise_handshakestate_get_action(handshake_);
+  if (action == NOISE_ACTION_READ_MESSAGE || action == NOISE_ACTION_WRITE_MESSAGE)
    return APIError::OK;
-  if (action != noise::NoiseResponderHandshake::Action::ACTION_SPLIT) {
+  if (action != NOISE_ACTION_SPLIT) {
    state_ = State::FAILED;
-    HELPER_LOG("Bad action for handshake: %d", (int) action);
+    HELPER_LOG("Bad action for handshake: %d", action);
    return APIError::HANDSHAKESTATE_BAD_STATE;
  }
-  // split() also frees the handshake state
-  int err = this->handshake_.split(send_cipher_, recv_cipher_);
+  int err = noise_handshakestate_split(handshake_, &send_cipher_, &recv_cipher_);
  APIError aerr =
      handle_noise_error_(err, LOG_STR("noise_handshakestate_split"), APIError::HANDSHAKESTATE_SPLIT_FAILED);
  if (aerr != APIError::OK)
@@ -570,11 +654,17 @@ APIError APINoiseFrameHelper::check_handshake_finished_() {
  this->frame_footer_size_ = noise_cipherstate_get_mac_length(send_cipher_);

  HELPER_LOG("Handshake complete!");
+  noise_handshakestate_free(handshake_);
+  handshake_ = nullptr;
  state_ = State::DATA;
  return APIError::OK;
 }

 APINoiseFrameHelper::~APINoiseFrameHelper() {
+  if (handshake_ != nullptr) {
+    noise_handshakestate_free(handshake_);
+    handshake_ = nullptr;
+  }
  if (send_cipher_ != nullptr) {
    noise_cipherstate_free(send_cipher_);
    send_cipher_ = nullptr;
@@ -585,6 +675,16 @@ APINoiseFrameHelper::~APINoiseFrameHelper() {
  }
 }

+extern "C" {
+// declare how noise generates random bytes (here with a good HWRNG based on the RF system)
+void noise_rand_bytes(void *output, size_t len) {
+  if (!esphome::random_bytes(reinterpret_cast<uint8_t *>(output), len)) {
+    ESP_LOGE(TAG, "Acquiring random bytes failed; rebooting");
+    arch_restart();
+  }
+}
+}
+
 }  // namespace esphome::api
 #endif  // USE_API_NOISE
 #endif  // USE_API
@@ -3,7 +3,7 @@
 #ifdef USE_API
 #ifdef USE_API_NOISE
 #include "noise/protocol.h"
-#include "esphome/components/noise/noise_handshake.h"
+#include "api_noise_context.h"

 namespace esphome::api {

@@ -14,9 +14,9 @@ class APINoiseFrameHelper final : public APIFrameHelper {
  // Pos 1-2: encrypted payload size (16-bit big-endian)
  // Pos 3-6: encrypted type (16-bit) + data_len (16-bit)
  // Pos 7+: actual payload data
-  static constexpr uint8_t HEADER_PADDING = noise::FRAME_HEADER_SIZE + 2 + 2;  // frame header + type + data_len
+  static constexpr uint8_t HEADER_PADDING = 1 + 2 + 2 + 2;  // indicator + size + type + data_len

-  APINoiseFrameHelper(std::unique_ptr<socket::Socket> socket, noise::NoiseContext &ctx)
+  APINoiseFrameHelper(std::unique_ptr<socket::Socket> socket, APINoiseContext &ctx)
      : APIFrameHelper(std::move(socket)), ctx_(ctx) {
    frame_header_padding_ = HEADER_PADDING;
  }
@@ -52,13 +52,13 @@ class APINoiseFrameHelper final : public APIFrameHelper {
  APIError handle_handshake_frame_error_(APIError aerr);
  APIError handle_noise_error_(int err, const LogString *func_name, APIError api_err);

-  // Pointers first (4 bytes each; the handshake wrapper holds one pointer)
-  noise::NoiseResponderHandshake handshake_;
+  // Pointers first (4 bytes each)
+  NoiseHandshakeState *handshake_{nullptr};
  NoiseCipherState *send_cipher_{nullptr};
  NoiseCipherState *recv_cipher_{nullptr};

  // Reference to noise context (4 bytes on 32-bit)
-  noise::NoiseContext &ctx_;
+  APINoiseContext &ctx_;

  // Buffer for noise handshake prologue (released after handshake)
  APIBuffer prologue_;
@@ -67,7 +67,7 @@ class APINoiseFrameHelper final : public APIFrameHelper {
  // Fixed-size header buffer for noise protocol:
  // 1 byte for indicator + 2 bytes for message size (16-bit value, not varint)
  // Note: Maximum message size is UINT16_MAX (65535), with a limit of 128 bytes during handshake phase
-  uint8_t rx_header_buf_[noise::FRAME_HEADER_SIZE];
+  uint8_t rx_header_buf_[3];
  uint8_t rx_header_buf_len_ = 0;
  // 4 bytes total, no padding
 };
@@ -0,0 +1,37 @@
+#pragma once
+#include <array>
+#include <cstdint>
+#include "esphome/core/defines.h"
+
+namespace esphome::api {
+
+#ifdef USE_API_NOISE
+using psk_t = std::array<uint8_t, 32>;
+
+class APINoiseContext {
+ public:
+  // The all-zeros PSK is reserved: it marks the device as unprovisioned and
+  // doubles as the well-known provisioning PSK that unprovisioned devices
+  // accept for Noise handshakes (passive-sniffing protection only, no
+  // authentication). It is never a valid real key.
+  static bool is_all_zeros(const psk_t &psk) {
+    uint8_t acc = 0;
+    for (uint8_t b : psk) {
+      acc |= b;
+    }
+    return acc == 0;
+  }
+  void set_psk(psk_t psk) {
+    this->psk_ = psk;
+    this->has_psk_ = !is_all_zeros(psk);
+  }
+  const psk_t &get_psk() const { return this->psk_; }
+  bool has_psk() const { return this->has_psk_; }
+
+ protected:
+  psk_t psk_{};
+  bool has_psk_{false};
+};
+#endif  // USE_API_NOISE
+
+}  // namespace esphome::api
@@ -423,6 +423,12 @@ void APIServer::send_infrared_rf_receive_event([[maybe_unused]] uint32_t device_
 API_DISPATCH_UPDATE(alarm_control_panel::AlarmControlPanel, alarm_control_panel)
 #endif

+float APIServer::get_setup_priority() const { return setup_priority::AFTER_WIFI; }
+
+void APIServer::set_port(uint16_t port) { this->port_ = port; }
+
+void APIServer::set_batch_delay(uint16_t batch_delay) { this->batch_delay_ = batch_delay; }
+
 #ifdef USE_API_HOMEASSISTANT_SERVICES
 void APIServer::send_homeassistant_action(const HomeassistantActionRequest &call) {
  bool has_subscriber = false;
@@ -547,6 +553,10 @@ const std::vector<APIServer::HomeAssistantStateSubscription> &APIServer::get_sta
 }
 #endif

+uint16_t APIServer::get_port() const { return this->port_; }
+
+void APIServer::set_reboot_timeout(uint32_t reboot_timeout) { this->reboot_timeout_ = reboot_timeout; }
+
 #ifdef USE_API_NOISE
 bool APIServer::update_noise_psk_(const SavedNoisePsk &new_psk, const LogString *save_log_msg,
                                  const LogString *fail_log_msg, bool make_active) {
@@ -588,7 +598,7 @@ bool APIServer::load_and_apply_noise_psk_() {
  return true;
 }

-bool APIServer::save_noise_psk(noise::psk_t psk, bool make_active) {
+bool APIServer::save_noise_psk(psk_t psk, bool make_active) {
 #ifdef USE_API_NOISE_PSK_FROM_YAML
  // When PSK is set from YAML, this function should never be called
  // but if it is, reject the change
@@ -5,10 +5,7 @@
 #include "api_buffer.h"
 // Must precede clients_ so APIConnection is complete for default_delete (libc++).
 #include "api_connection.h"
-#ifdef USE_API_NOISE
-// Only present in the build when the noise component is loaded
-#include "esphome/components/noise/noise.h"
-#endif
+#include "api_noise_context.h"
 #include "api_pb2.h"
 #include "api_pb2_service.h"
 #include "esphome/components/socket/socket.h"
@@ -40,7 +37,7 @@ class UserServiceDescriptor;

 #ifdef USE_API_NOISE
 struct SavedNoisePsk {
-  noise::psk_t psk;
+  psk_t psk;
 } PACKED;  // NOLINT
 #endif

@@ -54,8 +51,8 @@ class APIServer final : public Component,
 public:
  APIServer();
  void setup() override;
-  uint16_t get_port() const { return this->port_; }
-  float get_setup_priority() const override { return setup_priority::AFTER_WIFI; }
+  uint16_t get_port() const;
+  float get_setup_priority() const override;
  void loop() override;
  void dump_config() override;
  void on_shutdown() override;
@@ -66,9 +63,9 @@ class APIServer final : public Component,
 #ifdef USE_CAMERA
  void on_camera_image(const std::shared_ptr<camera::CameraImage> &image) override;
 #endif
-  void set_port(uint16_t port) { this->port_ = port; }
-  void set_reboot_timeout(uint32_t reboot_timeout) { this->reboot_timeout_ = reboot_timeout; }
-  void set_batch_delay(uint16_t batch_delay) { this->batch_delay_ = batch_delay; }
+  void set_port(uint16_t port);
+  void set_reboot_timeout(uint32_t reboot_timeout);
+  void set_batch_delay(uint16_t batch_delay);
  uint16_t get_batch_delay() const { return batch_delay_; }
  void set_listen_backlog(uint8_t listen_backlog) { this->listen_backlog_ = listen_backlog; }

@@ -76,10 +73,10 @@ class APIServer final : public Component,
  APIBuffer &get_shared_buffer_ref() { return shared_write_buffer_; }

 #ifdef USE_API_NOISE
-  bool save_noise_psk(noise::psk_t psk, bool make_active = true);
+  bool save_noise_psk(psk_t psk, bool make_active = true);
  bool clear_noise_psk(bool make_active = true);
-  void set_noise_psk(noise::psk_t psk) { this->noise_ctx_.set_psk(psk); }
-  noise::NoiseContext &get_noise_ctx() { return this->noise_ctx_; }
+  void set_noise_psk(psk_t psk) { this->noise_ctx_.set_psk(psk); }
+  APINoiseContext &get_noise_ctx() { return this->noise_ctx_; }
 #endif  // USE_API_NOISE

  void handle_disconnect(APIConnection *conn);
@@ -357,7 +354,7 @@ class APIServer final : public Component,
 #endif

 #ifdef USE_API_NOISE
-  noise::NoiseContext noise_ctx_;
+  APINoiseContext noise_ctx_;
  ESPPreferenceObject noise_pref_;
 #endif  // USE_API_NOISE
 };
@@ -95,17 +95,9 @@ bool ListEntitiesIterator::on_end() { return this->client_->send_list_info_done(
 ListEntitiesIterator::ListEntitiesIterator(APIConnection *client) : client_(client) {}

 #ifdef USE_API_USER_DEFINED_ACTIONS
-// Yield after every Nth service; bounds direct (non-batched) writes per loop pass
-static constexpr uint8_t SERVICE_YIELD_INTERVAL = 3;
-
 bool ListEntitiesIterator::on_service(UserServiceDescriptor *service) {
  auto resp = service->encode_list_service_response();
-  if (!this->client_->send_message(resp))
-    return false;
-  // at_ is this service's index
-  if ((this->at_ + 1) % SERVICE_YIELD_INTERVAL == 0)
-    this->yield_after_step_();
-  return true;
+  return this->client_->send_message(resp);
 }
 #endif

@@ -14,8 +14,6 @@ from esphome.const import (
    CONF_TUNE_ANTENNA,
    CONF_WATCHDOG_THRESHOLD,
 )
-from esphome.cpp_generator import MockObj
-from esphome.types import ConfigType

 MULTI_CONF = True

@@ -44,7 +42,7 @@ AS3935_SCHEMA = cv.Schema(
 )


-async def setup_as3935(var: MockObj, config: ConfigType) -> None:
+async def setup_as3935(var, config):
    await cg.register_component(var, config)

    irq_pin = await cg.gpio_pin_expression(config[CONF_IRQ_PIN])
@@ -1,7 +1,6 @@
 import esphome.codegen as cg
 from esphome.components import binary_sensor
 import esphome.config_validation as cv
-from esphome.types import ConfigType

 from . import AS3935, CONF_AS3935_ID

@@ -14,7 +13,7 @@ CONFIG_SCHEMA = binary_sensor.binary_sensor_schema().extend(
 )


-async def to_code(config: ConfigType) -> None:
+async def to_code(config):
    hub = await cg.get_variable(config[CONF_AS3935_ID])
    var = await binary_sensor.new_binary_sensor(config)
    cg.add(hub.set_thunder_alert_binary_sensor(var))
@@ -9,7 +9,6 @@ from esphome.const import (
    STATE_CLASS_MEASUREMENT,
    UNIT_KILOMETER,
 )
-from esphome.types import ConfigType

 from . import AS3935, CONF_AS3935_ID

@@ -32,7 +31,7 @@ CONFIG_SCHEMA = cv.Schema(
 )


-async def to_code(config: ConfigType) -> None:
+async def to_code(config):
    hub = await cg.get_variable(config[CONF_AS3935_ID])

    if distance_config := config.get(CONF_DISTANCE):
@@ -1,6 +1,3 @@
-from collections.abc import Callable
-from typing import Any
-
 from esphome import pins
 import esphome.codegen as cg
 from esphome.components import i2c
@@ -14,7 +11,6 @@ from esphome.const import (
    CONF_RANGE,
    CONF_WATCHDOG,
 )
-from esphome.types import ConfigType

 CODEOWNERS = ["@ammmze"]
 DEPENDENCIES = ["i2c"]
@@ -76,13 +72,13 @@ POSITION_TO_ANGLE = 360 / RESOLUTION
 MIN_RANGE = round(18 * ANGLE_TO_POSITION)


-def angle(min: float = -360, max: float = 360) -> Callable[[Any], Any]:
+def angle(min=-360, max=360):
    return cv.All(
        cv.float_with_unit("angle", "(°|deg)"), cv.float_range(min=min, max=max)
    )


-def angle_to_position(value: Any, min: float = -360, max: float = 360) -> int:
+def angle_to_position(value, min=-360, max=360):
    try:
        value = angle(min=min, max=max)(value)
        return (RESOLUTION + round(value * ANGLE_TO_POSITION)) % RESOLUTION
@@ -90,17 +86,17 @@ def angle_to_position(value: Any, min: float = -360, max: float = 360) -> int:
        raise cv.Invalid(f"When using angle, {e.error_message}") from e


-def percent_to_position(value: Any) -> int:
+def percent_to_position(value):
    value = cv.possibly_negative_percentage(value)
    return (RESOLUTION + round(value * RESOLUTION)) % RESOLUTION


-def position(min: int = -MAX_POSITION, max: int = MAX_POSITION) -> Callable[[Any], Any]:
+def position(min=-MAX_POSITION, max=MAX_POSITION):
    """Validate that the config option is a position.
    Accepts integers, degrees, or percentage (of 360 degrees).
    """

-    def validator(value: Any) -> int:
+    def validator(value):
        if isinstance(value, str) and value.endswith("%"):
            value = percent_to_position(value)

@@ -116,7 +112,7 @@ def position(min: int = -MAX_POSITION, max: int = MAX_POSITION) -> Callable[[Any
    return validator


-def position_range() -> Callable[[Any], Any]:
+def position_range():
    """Validate that value given is a valid range for the device.
    A valid range is one of the following:
    - a value of 0 (meaning full range)
@@ -133,7 +129,7 @@ def position_range() -> Callable[[Any], Any]:
        zero_validator,
    )

-    def validator(value: Any) -> Any:
+    def validator(value):
        is_negative_str = isinstance(value, str) and value.startswith("-")
        is_negative_num = isinstance(value, (float, int)) and value < 0
        if is_negative_str or is_negative_num:
@@ -143,13 +139,13 @@ def position_range() -> Callable[[Any], Any]:
    return validator


-def has_valid_range_config() -> Callable[[ConfigType], ConfigType]:
+def has_valid_range_config():
    """Validate that that the config start + end position results in a valid
    positional range, which must be >= 18degrees
    """
    range_validator = position_range()

-    def validator(config: ConfigType) -> ConfigType:
+    def validator(config):
        # if we don't have an end position, then there is nothing to do
        if CONF_END_POSITION not in config:
            return config
@@ -207,7 +203,7 @@ CONFIG_SCHEMA = cv.All(
 )


-async def to_code(config: ConfigType) -> None:
+async def to_code(config):
    var = cg.new_Pvariable(config[CONF_ID])
    await cg.register_component(var, config)
    await i2c.register_i2c_device(var, config)
@@ -11,7 +11,6 @@ from esphome.const import (
    ICON_ROTATE_RIGHT,
    STATE_CLASS_MEASUREMENT,
 )
-from esphome.types import ConfigType

 from .. import AS5600Component, as5600_ns

@@ -78,7 +77,7 @@ CONFIG_SCHEMA = (
 )


-async def to_code(config: ConfigType) -> None:
+async def to_code(config):
    var = cg.new_Pvariable(config[CONF_ID])
    await cg.register_parented(var, config[CONF_AS5600_ID])
    await cg.register_component(var, config)
@@ -4,9 +4,6 @@ import esphome.codegen as cg
 from esphome.components import i2c
 import esphome.config_validation as cv
 from esphome.const import CONF_FREQUENCY, CONF_ID
-from esphome.core import ID
-from esphome.cpp_generator import MockObj, TemplateArgsType
-from esphome.types import ConfigType

 CODEOWNERS = ["@X-Ryl669"]
 DEPENDENCIES = ["i2c"]
@@ -73,7 +70,7 @@ CONFIG_SCHEMA = cv.All(
 )


-async def to_code(config: ConfigType) -> None:
+async def to_code(config):
    var = cg.new_Pvariable(config[CONF_ID])
    await cg.register_component(var, config)
    await i2c.register_i2c_device(var, config)
@@ -94,12 +91,7 @@ AT581XSettingsAction = at581x_ns.class_("AT581XSettingsAction", automation.Actio
    ),
    synchronous=True,
 )
-async def at581x_reset_to_code(
-    config: ConfigType,
-    action_id: ID,
-    template_arg: cg.TemplateArguments,
-    args: TemplateArgsType,
-) -> MockObj:
+async def at581x_reset_to_code(config, action_id, template_arg, args):
    var = cg.new_Pvariable(action_id, template_arg)
    await cg.register_parented(var, config[CONF_ID])

@@ -171,12 +163,7 @@ RADAR_SETTINGS_SCHEMA = cv.Schema(
    RADAR_SETTINGS_SCHEMA,
    synchronous=True,
 )
-async def at581x_settings_to_code(
-    config: ConfigType,
-    action_id: ID,
-    template_arg: cg.TemplateArguments,
-    args: TemplateArgsType,
-) -> MockObj:
+async def at581x_settings_to_code(config, action_id, template_arg, args):
    var = cg.new_Pvariable(action_id, template_arg)
    await cg.register_parented(var, config[CONF_ID])

@@ -2,7 +2,6 @@ import esphome.codegen as cg
 from esphome.components import switch
 import esphome.config_validation as cv
 from esphome.const import DEVICE_CLASS_SWITCH, ICON_WIFI
-from esphome.types import ConfigType

 from .. import CONF_AT581X_ID, AT581XComponent, at581x_ns

@@ -23,7 +22,7 @@ CONFIG_SCHEMA = switch.switch_schema(
 )


-async def to_code(config: ConfigType) -> None:
+async def to_code(config):
    at581x_component = await cg.get_variable(config[CONF_AT581X_ID])
    s = await switch.new_switch(config)
    await cg.register_parented(s, config[CONF_AT581X_ID])
@@ -2,7 +2,6 @@ import esphome.codegen as cg
 from esphome.components import button
 import esphome.config_validation as cv
 from esphome.const import CONF_ID, ENTITY_CATEGORY_CONFIG, ICON_SCALE
-from esphome.types import ConfigType

 from .. import atm90e32_ns
 from ..sensor import ATM90E32Component
@@ -68,7 +67,7 @@ CONFIG_SCHEMA = {
 }


-async def to_code(config: ConfigType) -> None:
+async def to_code(config):
    parent = await cg.get_variable(config[CONF_ID])

    if run_gain := config.get(CONF_RUN_GAIN_CALIBRATION):
@@ -15,7 +15,6 @@ from esphome.const import (
    UNIT_AMPERE,
    UNIT_VOLT,
 )
-from esphome.types import ConfigType

 from .. import atm90e32_ns
 from ..sensor import ATM90E32Component
@@ -91,7 +90,7 @@ CONFIG_SCHEMA = cv.Schema(
 )


-async def to_code(config: ConfigType) -> None:
+async def to_code(config):
    parent = await cg.get_variable(config[CONF_ID])

    if voltage_cfg := config.get(CONF_REFERENCE_VOLTAGE):
@@ -41,7 +41,6 @@ from esphome.const import (
    UNIT_WATT,
    UNIT_WATT_HOURS,
 )
-from esphome.types import ConfigType

 from . import atm90e32_ns

@@ -192,7 +191,7 @@ CONFIG_SCHEMA = (
 )


-async def to_code(config: ConfigType) -> None:
+async def to_code(config):
    var = cg.new_Pvariable(config[CONF_ID])
    cg.add(var.set_instance_id(str(config[CONF_ID])))
    await cg.register_component(var, config)
@@ -2,7 +2,6 @@ import esphome.codegen as cg
 from esphome.components import text_sensor
 import esphome.config_validation as cv
 from esphome.const import CONF_ID, CONF_PHASE_A, CONF_PHASE_B, CONF_PHASE_C
-from esphome.types import ConfigType

 from ..sensor import ATM90E32Component

@@ -35,7 +34,7 @@ CONFIG_SCHEMA = cv.Schema(
 )


-async def to_code(config: ConfigType) -> None:
+async def to_code(config):
    parent = await cg.get_variable(config[CONF_ID])

    if phase_cfg := config.get(CONF_PHASE_STATUS):
@@ -1,6 +1,4 @@
-from collections.abc import Callable
 from dataclasses import dataclass, field
-from typing import Any

 import esphome.codegen as cg
 from esphome.components.esp32 import (
@@ -17,7 +15,6 @@ from esphome.const import (
 )
 from esphome.core import CORE
 import esphome.final_validate as fv
-from esphome.types import ConfigType

 AUTO_LOAD = ["ring_buffer"]
 CODEOWNERS = ["@kahrendt"]
@@ -128,10 +125,10 @@ CONF_THREADSAFE = "threadsafe"
 _MEMORY_LOCATION_VALIDATOR = cv.one_of(*MEMORY_LOCATIONS, lower=True)


-def _maybe_empty_codec(schema: cv.Schema) -> Callable[[Any], Any]:
+def _maybe_empty_codec(schema):
    """Wrap a codec dict schema so that a bare key (None value) is treated as an empty dict."""

-    def validator(value: Any) -> Any:
+    def validator(value):
        if value is None:
            value = {}
        return schema(value)
@@ -203,14 +200,14 @@ def set_stream_limits(
    max_channels: int = cv.UNDEFINED,
    min_sample_rate: int = cv.UNDEFINED,
    max_sample_rate: int = cv.UNDEFINED,
-) -> Callable[[ConfigType], None]:
+):
    """Sets the limits for the audio stream that audio component can handle

    When the component sinks audio (e.g., a speaker), these indicate the limits to the audio it can receive.
    When the component sources audio (e.g., a microphone), these indicate the limits to the audio it can send.
    """

-    def set_limits_in_config(config: ConfigType) -> None:
+    def set_limits_in_config(config):
        if min_bits_per_sample is not cv.UNDEFINED:
            config[CONF_MIN_BITS_PER_SAMPLE] = min_bits_per_sample
        if max_bits_per_sample is not cv.UNDEFINED:
@@ -236,7 +233,7 @@ def final_validate_audio_schema(
    sample_rate: int = cv.UNDEFINED,
    enabled_channels: list[int] = cv.UNDEFINED,
    audio_device_issue: bool = False,
-) -> cv.Schema:
+):
    """Validates audio compatibility when passed between different components.

    The component derived from ``AUDIO_COMPONENT_SCHEMA`` should call ``set_stream_limits`` in a validator to specify its compatible settings
@@ -254,7 +251,7 @@ def final_validate_audio_schema(
        audio_device_issue (bool, optional): Format the error message to indicate the problem is in the configuration for the ``audio_device`` component. Defaults to False.
    """

-    def validate_audio_compatiblity(audio_config: ConfigType) -> ConfigType:
+    def validate_audio_compatiblity(audio_config):
        audio_schema = {}

        if bits_per_sample is not cv.UNDEFINED:
@@ -332,7 +329,7 @@ def _emit_memory_pair(value: str | None, psram_key: str, internal_key: str) -> N
        add_idf_sdkconfig_option(internal_key, True)


-async def to_code(config: ConfigType) -> None:
+async def to_code(config):
    # Re-enable ESP-IDF's HTTP client (excluded by default to save compile time)
    include_builtin_idf_component("esp_http_client")

@@ -86,7 +86,7 @@ AudioFileType detect_audio_file_type(const char *content_type, const char *url)
    // Match "audio/ogg" with a codecs parameter containing "opus"
    // Valid forms: audio/ogg;codecs=opus, audio/ogg; codecs="opus", etc.
    // Plain "audio/ogg" without opus is not matched (almost always Ogg Vorbis)
-    if (strncasecmp(content_type, "audio/ogg", 9) == 0 && str_contains_ignore_case(content_type + 9, "opus")) {
+    if (strncasecmp(content_type, "audio/ogg", 9) == 0 && strcasestr(content_type + 9, "opus") != nullptr) {
      return AudioFileType::OPUS;
    }
 #endif
@@ -2,9 +2,7 @@ from esphome import automation
 import esphome.codegen as cg
 import esphome.config_validation as cv
 from esphome.const import CONF_ID, CONF_MIC_GAIN
-from esphome.core import ID, CoroPriority, coroutine_with_priority
-from esphome.cpp_generator import MockObj, TemplateArgsType
-from esphome.types import ConfigType
+from esphome.core import CoroPriority, coroutine_with_priority

 CODEOWNERS = ["@kbx81"]
 IS_PLATFORM_COMPONENT = True
@@ -30,12 +28,7 @@ SET_MIC_GAIN_ACTION_SCHEMA = cv.maybe_simple_value(
    SET_MIC_GAIN_ACTION_SCHEMA,
    synchronous=True,
 )
-async def audio_adc_set_mic_gain_to_code(
-    config: ConfigType,
-    action_id: ID,
-    template_arg: cg.TemplateArguments,
-    args: TemplateArgsType,
-) -> MockObj:
+async def audio_adc_set_mic_gain_to_code(config, action_id, template_arg, args):
    paren = await cg.get_variable(config[CONF_ID])
    var = cg.new_Pvariable(action_id, template_arg, paren)

@@ -46,6 +39,6 @@ async def audio_adc_set_mic_gain_to_code(


@coroutine_with_priority(CoroPriority.CORE)
-async def to_code(config: ConfigType) -> None:
+async def to_code(config):
    cg.add_define("USE_AUDIO_ADC")
    cg.add_global(audio_adc_ns.using)
@@ -3,9 +3,7 @@ from esphome.automation import maybe_simple_id
 import esphome.codegen as cg
 import esphome.config_validation as cv
 from esphome.const import CONF_ID, CONF_VOLUME
-from esphome.core import ID, CoroPriority, coroutine_with_priority
-from esphome.cpp_generator import MockObj, TemplateArgsType
-from esphome.types import ConfigType
+from esphome.core import CoroPriority, coroutine_with_priority

 CODEOWNERS = ["@kbx81"]
 IS_PLATFORM_COMPONENT = True
@@ -39,12 +37,7 @@ SET_VOLUME_ACTION_SCHEMA = cv.maybe_simple_value(
@automation.register_action(
    "audio_dac.mute_on", MuteOnAction, MUTE_ACTION_SCHEMA, synchronous=True
 )
-async def audio_dac_mute_action_to_code(
-    config: ConfigType,
-    action_id: ID,
-    template_arg: cg.TemplateArguments,
-    args: TemplateArgsType,
-) -> MockObj:
+async def audio_dac_mute_action_to_code(config, action_id, template_arg, args):
    paren = await cg.get_variable(config[CONF_ID])
    return cg.new_Pvariable(action_id, template_arg, paren)

@@ -55,12 +48,7 @@ async def audio_dac_mute_action_to_code(
    SET_VOLUME_ACTION_SCHEMA,
    synchronous=True,
 )
-async def audio_dac_set_volume_to_code(
-    config: ConfigType,
-    action_id: ID,
-    template_arg: cg.TemplateArguments,
-    args: TemplateArgsType,
-) -> MockObj:
+async def audio_dac_set_volume_to_code(config, action_id, template_arg, args):
    paren = await cg.get_variable(config[CONF_ID])
    var = cg.new_Pvariable(action_id, template_arg, paren)

@@ -71,6 +59,6 @@ async def audio_dac_set_volume_to_code(


@coroutine_with_priority(CoroPriority.CORE)
-async def to_code(config: ConfigType) -> None:
+async def to_code(config):
    cg.add_define("USE_AUDIO_DAC")
    cg.add_global(audio_dac_ns.using)
@@ -2,8 +2,6 @@ import esphome.codegen as cg
 from esphome.components import ble_client, time
 import esphome.config_validation as cv
 from esphome.const import CONF_ID, CONF_RECEIVE_TIMEOUT, CONF_TIME_ID
-from esphome.cpp_generator import MockObj
-from esphome.types import ConfigType

 CODEOWNERS = ["@jhansche"]
 DEPENDENCIES = ["ble_client"]
@@ -34,12 +32,12 @@ BEDJET_CLIENT_SCHEMA = cv.Schema(
 )


-async def register_bedjet_child(var: MockObj, config: ConfigType) -> None:
+async def register_bedjet_child(var, config):
    parent = await cg.get_variable(config[CONF_BEDJET_ID])
    cg.add(parent.register_child(var))


-async def to_code(config: ConfigType) -> None:
+async def to_code(config):
    var = cg.new_Pvariable(config[CONF_ID])
    await cg.register_component(var, config)
    await ble_client.register_ble_node(var, config)
@@ -2,7 +2,6 @@ import esphome.codegen as cg
 from esphome.components import climate
 import esphome.config_validation as cv
 from esphome.const import CONF_HEAT_MODE, CONF_TEMPERATURE_SOURCE
-from esphome.types import ConfigType

 from .. import BEDJET_CLIENT_SCHEMA, bedjet_ns, register_bedjet_child

@@ -38,7 +37,7 @@ CONFIG_SCHEMA = (
 )


-async def to_code(config: ConfigType) -> None:
+async def to_code(config):
    var = await climate.new_climate(config)
    await cg.register_component(var, config)
    await register_bedjet_child(var, config)
@@ -1,7 +1,6 @@
 import esphome.codegen as cg
 from esphome.components import fan
 import esphome.config_validation as cv
-from esphome.types import ConfigType

 from .. import BEDJET_CLIENT_SCHEMA, bedjet_ns, register_bedjet_child

@@ -17,7 +16,7 @@ CONFIG_SCHEMA = (
 )


-async def to_code(config: ConfigType) -> None:
+async def to_code(config):
    var = await fan.new_fan(config)
    await cg.register_component(var, config)
    await register_bedjet_child(var, config)
@@ -9,7 +9,6 @@ from esphome.const import (
    STATE_CLASS_MEASUREMENT,
    UNIT_CELSIUS,
 )
-from esphome.types import ConfigType

 from .. import BEDJET_CLIENT_SCHEMA, bedjet_ns, register_bedjet_child

@@ -39,7 +38,7 @@ CONFIG_SCHEMA = cv.Schema(
 ).extend(BEDJET_CLIENT_SCHEMA)


-async def to_code(config: ConfigType) -> None:
+async def to_code(config):
    var = cg.new_Pvariable(config[CONF_ID])
    await cg.register_component(var, config)
    await register_bedjet_child(var, config)
@@ -5,7 +5,6 @@ from esphome.automation import Condition, maybe_simple_id
 import esphome.codegen as cg
 from esphome.components import mqtt, web_server, zigbee
 from esphome.components.const import CONF_ON_STATE_CHANGE
-from esphome.config_helpers import filter_source_files_from_defines
 import esphome.config_validation as cv
 from esphome.const import (
    CONF_DELAY,
@@ -561,11 +560,6 @@ _CALLBACK_AUTOMATIONS = (
 async def _build_binary_sensor_automations(var, config):
    await automation.build_callback_automations(var, config, _CALLBACK_AUTOMATIONS)

-    if config.get(CONF_ON_CLICK) or config.get(CONF_ON_DOUBLE_CLICK):
-        cg.add_define("USE_BINARY_SENSOR_CLICK_TRIGGER")
-    if config.get(CONF_ON_MULTI_CLICK):
-        cg.add_define("USE_BINARY_SENSOR_MULTI_CLICK_TRIGGER")
-
    for conf in config.get(CONF_ON_CLICK, []):
        trigger = cg.new_Pvariable(
            conf[CONF_TRIGGER_ID], var, conf[CONF_MIN_LENGTH], conf[CONF_MAX_LENGTH]
@@ -679,15 +673,3 @@ async def to_code(config):
 async def binary_sensor_invalidate_state_to_code(config, action_id, template_arg, args):
    paren = await cg.get_variable(config[CONF_ID])
    return cg.new_Pvariable(action_id, template_arg, paren)
-
-
-# automation.cpp only implements the click/double_click/multi_click triggers
-FILTER_SOURCE_FILES = filter_source_files_from_defines(
-    {
-        "automation.cpp": (
-            "USE_BINARY_SENSOR_CLICK_TRIGGER",
-            "USE_BINARY_SENSOR_MULTI_CLICK_TRIGGER",
-        ),
-        "filter.cpp": "USE_BINARY_SENSOR_FILTER",
-    }
-)
@@ -1,13 +1,8 @@
-#include "esphome/core/defines.h"
-#if defined(USE_BINARY_SENSOR_CLICK_TRIGGER) || defined(USE_BINARY_SENSOR_MULTI_CLICK_TRIGGER)
-
 #include "automation.h"
 #include "esphome/core/log.h"

 namespace esphome::binary_sensor {

-#ifdef USE_BINARY_SENSOR_MULTI_CLICK_TRIGGER
-
 static const char *const TAG = "binary_sensor.automation";

 // MultiClickTrigger timeout IDs.
@@ -125,9 +120,6 @@ void MultiClickTriggerBase::trigger_() {
  this->trigger();
 }

-#endif  // USE_BINARY_SENSOR_MULTI_CLICK_TRIGGER
-
-#ifdef USE_BINARY_SENSOR_CLICK_TRIGGER
 bool match_interval(uint32_t min_length, uint32_t max_length, uint32_t length) {
  if (max_length == 0) {
    return length >= min_length;
@@ -135,8 +127,4 @@ bool match_interval(uint32_t min_length, uint32_t max_length, uint32_t length) {
    return length >= min_length && length <= max_length;
  }
 }
-#endif  // USE_BINARY_SENSOR_CLICK_TRIGGER
-
 }  // namespace esphome::binary_sensor
-
-#endif  // USE_BINARY_SENSOR_CLICK_TRIGGER || USE_BINARY_SENSOR_MULTI_CLICK_TRIGGER
@@ -4,12 +4,9 @@ The platform analog of esp32_ble / rp2040_ble: owns the Beken BDK BLE stack
 bring-up and the controller BLE address. Consumers (bk72xx_ble_tracker) build
 on this component and contain no SDK calls of their own.

-Supported SoCs (BLE 5.x): BK7231N/BK7236 (BLE 5.1), BK7252N/BK7253 (BLE 5.2),
-and any future BLE-5.x SoC. BK7238 (BLE 5.2) is blocked for now: with BLE
-compiled in, the Beken SDK erases the bootloader flash sector at boot because
-LibreTiny's partition table has no BLE bonding entry (esphome#18646,
-libretiny-eu/libretiny#408). Known non-5.x families and BK7238 are rejected in
-to_code. Unknown families are capability-checked at compile time via
+Supported SoCs (BLE 5.x): BK7231N/BK7236 (BLE 5.1), BK7238/BK7252N/BK7253
+(BLE 5.2), and any future BLE-5.x SoC. Known non-5.x families are rejected in
+to_code; unknown families are capability-checked at compile time via
 `__has_include("app_ble.h")`, a header only on the BLE 5.x include path
 (ble_api.h ships for every SoC, so it cannot be the probe). A non-5.x build
 fails with a clear #error.
@@ -68,14 +65,6 @@ def _unsupported_family_message(family: str) -> str | None:
        )
    if family == FAMILY_BK7231Q:
        return "bk72xx_ble does not support BK7231Q: this SoC has no BLE"
-    if family == FAMILY_BK7238:
-        return (
-            "bk72xx_ble is disabled on BK7238: with BLE compiled in, the Beken SDK "
-            "erases the bootloader flash sector at boot and the device can no longer "
-            "start (see https://github.com/esphome/esphome/issues/18646); support "
-            "returns once the LibreTiny partition table fix "
-            "(libretiny-eu/libretiny#408) is released"
-        )
    return None


@@ -124,7 +113,18 @@ async def to_code(config: ConfigType) -> None:
    # BK7231N, but NOT on BK7238 (its BLE stack has no such symbol; the address is
    # derived from the WiFi MAC instead — the BDK's own fallback). Tell the C++
    # which path is available so it doesn't reference a missing symbol.
-    if libretiny.get_libretiny_family() == FAMILY_BK7231N:
+    family = libretiny.get_libretiny_family()
+    if family == FAMILY_BK7231N:
        cg.add_define("BK72XX_BLE_HAS_COMMON_BDADDR")
+    elif family == FAMILY_BK7238:
+        # ESPHome's LibreTiny disables BLE on BK7238 because the SDK can hang at
+        # WiFi STA startup when BLE init runs. This component re-enables BLE, so
+        # warn loudly: BK7238 is accepted but not hardware-verified and may be
+        # WiFi-unstable with BLE on.
+        _LOGGER.warning(
+            "bk72xx_ble on BK7238: enabling BLE is known to risk a WiFi STA startup "
+            "hang on this family and is not yet hardware-verified. Expect possible "
+            "instability."
+        )

    cg.add_define("USE_BK72XX_BLE")
@@ -32,9 +32,6 @@ from esphome.const import (
    UNIT_VOLT,
    UNIT_WATT,
 )
-from esphome.core import ID
-from esphome.cpp_generator import MockObj, TemplateArgsType
-from esphome.types import ConfigType

 # Import ICONS not included in esphome's const.py, from the local components const.py
 from .const import ICON_ENERGY, ICON_FREQUENCY, ICON_VOLTAGE
@@ -148,18 +145,13 @@ FINAL_VALIDATE_SCHEMA = uart.final_validate_device_schema(
    ),
    synchronous=True,
 )
-async def reset_energy_to_code(
-    config: ConfigType,
-    action_id: ID,
-    template_arg: cg.TemplateArguments,
-    args: TemplateArgsType,
-) -> MockObj:
+async def reset_energy_to_code(config, action_id, template_arg, args):
    var = cg.new_Pvariable(action_id, template_arg)
    await cg.register_parented(var, config[CONF_ID])
    return var


-async def to_code(config: ConfigType) -> None:
+async def to_code(config):
    var = cg.new_Pvariable(config[CONF_ID])
    await cg.register_component(var, config)
    await uart.register_uart_device(var, config)
@@ -2,7 +2,6 @@ import esphome.codegen as cg
 from esphome.components import button
 import esphome.config_validation as cv
 from esphome.const import ENTITY_CATEGORY_CONFIG, ICON_RESTART
-from esphome.types import ConfigType

 from .. import CONF_BL0940_ID, bl0940_ns
 from ..sensor import BL0940
@@ -22,7 +21,7 @@ CONFIG_SCHEMA = cv.All(
 )


-async def to_code(config: ConfigType) -> None:
+async def to_code(config):
    var = await button.new_button(config)
    await cg.register_component(var, config)
    await cg.register_parented(var, config[CONF_BL0940_ID])
@@ -10,7 +10,6 @@ from esphome.const import (
    ENTITY_CATEGORY_CONFIG,
    UNIT_PERCENT,
 )
-from esphome.types import ConfigType

 from .. import CONF_BL0940_ID, bl0940_ns
 from ..sensor import BL0940
@@ -28,7 +27,7 @@ CalibrationNumber = bl0940_ns.class_(
 )


-def validate_min_max(config: ConfigType) -> ConfigType:
+def validate_min_max(config):
    if config[CONF_MAX_VALUE] <= config[CONF_MIN_VALUE]:
        raise cv.Invalid("max_value must be greater than min_value")
    return config
@@ -70,7 +69,7 @@ CONFIG_SCHEMA = cv.Schema(
 )


-async def to_code(config: ConfigType) -> None:
+async def to_code(config):
    # Get the BL0940 component instance
    bl0940 = await cg.get_variable(config[CONF_BL0940_ID])

@@ -23,7 +23,6 @@ from esphome.const import (
    UNIT_VOLT,
    UNIT_WATT,
 )
-from esphome.types import ConfigType

 from . import bl0940_ns

@@ -70,29 +69,27 @@ DEFAULT_BL0940_LEGACY_EREF = 3.6e6 / 297


 # methods to calculate voltage and current reference values
-def calculate_voltage_reference(vref: float, r_one: float, r_two: float) -> float:
+def calculate_voltage_reference(vref, r_one, r_two):
    # formula: 79931 / Vref * (R1 * 1000) / (R1 + R2)
    return 79931 / vref * (r_one * 1000) / (r_one + r_two)


-def calculate_current_reference(vref: float, r_shunt: float) -> float:
+def calculate_current_reference(vref, r_shunt):
    # formula: 324004 * RL / Vref
    return 324004 * r_shunt / vref


-def calculate_power_reference(
-    voltage_reference: float, current_reference: float
-) -> float:
+def calculate_power_reference(voltage_reference, current_reference):
    # calculate power reference based on voltage and current reference
    return voltage_reference * current_reference * 4046 / 324004 / 79931


-def calculate_energy_reference(power_reference: float) -> float:
+def calculate_energy_reference(power_reference):
    # formula: power_reference * 3600000 / (1638.4 * 256)
    return power_reference * 3600000 / (1638.4 * 256)


-def validate_legacy_mode(config: ConfigType) -> ConfigType:
+def validate_legacy_mode(config):
    # Only allow schematic calibration options if legacy_mode is False
    if config.get(CONF_LEGACY_MODE, True):
        forbidden = [
@@ -109,7 +106,7 @@ def validate_legacy_mode(config: ConfigType) -> ConfigType:
    return config


-def set_command_defaults(config: ConfigType) -> ConfigType:
+def set_command_defaults(config):
    # Set defaults for read_command and write_command based on legacy_mode
    legacy = config.get(CONF_LEGACY_MODE, True)
    if legacy:
@@ -121,7 +118,7 @@ def set_command_defaults(config: ConfigType) -> ConfigType:
    return config


-def set_reference_values(config: ConfigType) -> ConfigType:
+def set_reference_values(config):
    # Set default reference values based on legacy_mode
    if config.get(CONF_LEGACY_MODE, True):
        config.setdefault(CONF_VOLTAGE_REFERENCE, DEFAULT_BL0940_LEGACY_UREF)
@@ -226,7 +223,7 @@ FINAL_VALIDATE_SCHEMA = uart.final_validate_device_schema(
 )


-async def to_code(config: ConfigType) -> None:
+async def to_code(config):
    var = cg.new_Pvariable(config[CONF_ID])
    await cg.register_component(var, config)
    await uart.register_uart_device(var, config)
@@ -1,8 +1,23 @@
+from collections.abc import Callable
+import functools
+from typing import Any
+
 from esphome import automation
 from esphome.automation import maybe_simple_id
 import esphome.codegen as cg
-from esphome.components import esp32_ble, esp32_ble_client, esp32_ble_tracker
-from esphome.components.esp32_ble import BTLoggers
+from esphome.components import ble_device_base, bluetooth_connection
+from esphome.components.ble_device_base import (
+    BT_UUID16_FORMAT as bt_uuid16_format,
+    BT_UUID32_FORMAT as bt_uuid32_format,
+    BT_UUID128_FORMAT as bt_uuid128_format,
+    as_hex,
+    as_reversed_hex_array,
+    bt_uuid,
+)
+from esphome.config_helpers import (
+    filter_source_files_from_platform,
+    frameworks_for_platforms,
+)
 import esphome.config_validation as cv
 from esphome.const import (
    CONF_CHARACTERISTIC_UUID,
@@ -15,13 +30,53 @@ from esphome.const import (
    CONF_SERVICE_UUID,
    CONF_TRIGGER_ID,
    CONF_VALUE,
+    PLATFORM_ESP32,
+    PlatformFramework,
 )
-from esphome.core import ID
+from esphome.core import CORE, ID
+from esphome.enum import StrEnum
+from esphome.schema_extractors import SCHEMA_EXTRACT, schema_extractor
 from esphome.types import ConfigType

-AUTO_LOAD = ["esp32_ble_client"]
+# The esp32 BLE stack (esp32_ble, esp32_ble_tracker) is imported lazily inside
+# the esp32 schema/codegen arms: importing those modules registers esp32-only
+# automations as a side effect, which must not leak into the neutral
+# platforms' registries (the bluetooth_proxy pattern).
+
+
+def _legacy_engine() -> bool:
+    """True when the build uses the legacy raw-gattc engine - one line to
+    flip when esp32 moves to the neutral engine (with
+    USE_BLE_CLIENT_LEGACY_ENGINE in _to_code_esp32)."""
+    return CORE.is_esp32
+
+
+def AUTO_LOAD() -> list[str]:
+    """The engine's closure per platform: the legacy esp32 engine builds on
+    esp32_ble_client plus bluetooth_connection (the shared service-table
+    materializer; its sources compile empty in builds without a neutral
+    node), the neutral engine on the bluetooth_connection backend. The
+    platform-less arm is the union for manifest-resolving tooling."""
+    if _legacy_engine() or CORE.target_platform is None:
+        return ["bluetooth_connection", "esp32_ble_client"]
+    return ["bluetooth_connection"]
+
+
 CODEOWNERS = ["@buxtronix", "@clydebarrow"]
-DEPENDENCIES = ["esp32_ble_tracker"]
+
+FILTER_SOURCE_FILES = filter_source_files_from_platform(
+    {
+        "ble_client.cpp": {
+            PlatformFramework.ESP32_ARDUINO,
+            PlatformFramework.ESP32_IDF,
+        },
+        # Every framework of every non-esp32 registry platform: a platform
+        # that validates the neutral arm must also compile the neutral engine.
+        "ble_client_gatt.cpp": frameworks_for_platforms(
+            set(bluetooth_connection.GATT_CLIENT_PLATFORMS) - {PLATFORM_ESP32}
+        ),
+    }
+)

 CONF_DESCRIPTOR_UUID = "descriptor_uuid"
 CONF_ON_NOTIFY = "on_notify"
@@ -58,7 +113,9 @@ def notify_from_on_notify(config: ConfigType) -> ConfigType:


 ble_client_ns = cg.esphome_ns.namespace("ble_client")
-BLEClient = ble_client_ns.class_("BLEClient", esp32_ble_client.BLEClientBase)
+# One codegen class for both engines: the exclusively-gated headers resolve
+# the name to exactly one C++ definition per build.
+BLEClient = ble_client_ns.class_("BLEClient", cg.Component)
 BLEClientNode = ble_client_ns.class_("BLEClientNode")
 BLEClientNodeConstRef = BLEClientNode.operator("ref").operator("const")
 # Triggers
@@ -105,62 +162,179 @@ CONF_AUTO_CONNECT = "auto_connect"

 MULTI_CONF = True

-CONFIG_SCHEMA = cv.All(
-    cv.Schema(
-        {
-            cv.GenerateID(): cv.declare_id(BLEClient),
-            cv.Required(CONF_MAC_ADDRESS): cv.mac_address,
-            cv.Optional(CONF_NAME): cv.string,
-            cv.Optional(CONF_AUTO_CONNECT, default=True): cv.boolean,
-            cv.Optional(CONF_ON_CONNECT): automation.validate_automation(
-                {
-                    cv.GenerateID(CONF_TRIGGER_ID): cv.declare_id(
-                        BLEClientConnectTrigger
-                    ),
-                }
-            ),
-            cv.Optional(CONF_ON_DISCONNECT): automation.validate_automation(
-                {
-                    cv.GenerateID(CONF_TRIGGER_ID): cv.declare_id(
-                        BLEClientDisconnectTrigger
-                    ),
-                }
-            ),
-            cv.Optional(CONF_ON_PASSKEY_REQUEST): automation.validate_automation(
-                {
-                    cv.GenerateID(CONF_TRIGGER_ID): cv.declare_id(
-                        BLEClientPasskeyRequestTrigger
-                    ),
-                }
-            ),
-            cv.Optional(CONF_ON_PASSKEY_NOTIFICATION): automation.validate_automation(
-                {
-                    cv.GenerateID(CONF_TRIGGER_ID): cv.declare_id(
-                        BLEClientPasskeyNotificationTrigger
-                    ),
-                }
-            ),
-            cv.Optional(
-                CONF_ON_NUMERIC_COMPARISON_REQUEST
-            ): automation.validate_automation(
-                {
-                    cv.GenerateID(CONF_TRIGGER_ID): cv.declare_id(
-                        BLEClientNumericComparisonRequestTrigger
-                    ),
-                }
-            ),
-        }
+# Keys shared by both engines' schemas.
+_COMMON_SCHEMA = cv.Schema(
+    {
+        cv.GenerateID(): cv.declare_id(BLEClient),
+        cv.Required(CONF_MAC_ADDRESS): cv.mac_address,
+        cv.Optional(CONF_AUTO_CONNECT, default=True): cv.boolean,
+        cv.Optional(CONF_ON_CONNECT): automation.validate_automation(
+            {
+                cv.GenerateID(CONF_TRIGGER_ID): cv.declare_id(BLEClientConnectTrigger),
+            }
+        ),
+        cv.Optional(CONF_ON_DISCONNECT): automation.validate_automation(
+            {
+                cv.GenerateID(CONF_TRIGGER_ID): cv.declare_id(
+                    BLEClientDisconnectTrigger
+                ),
+            }
+        ),
+    }
+).extend(cv.COMPONENT_SCHEMA)
+
+
+@functools.cache
+def _esp32_config_schema() -> cv.All:
+    """The legacy engine's schema, byte-compatible with what esp32 always had
+    (including the Bluedroid security triggers)."""
+    from esphome.components import esp32_ble_tracker
+
+    return cv.All(
+        _COMMON_SCHEMA.extend(
+            {
+                # Accepted-but-unused legacy key; not propagated to the
+                # neutral schema.
+                cv.Optional(CONF_NAME): cv.string,
+                cv.Optional(CONF_ON_PASSKEY_REQUEST): automation.validate_automation(
+                    {
+                        cv.GenerateID(CONF_TRIGGER_ID): cv.declare_id(
+                            BLEClientPasskeyRequestTrigger
+                        ),
+                    }
+                ),
+                cv.Optional(
+                    CONF_ON_PASSKEY_NOTIFICATION
+                ): automation.validate_automation(
+                    {
+                        cv.GenerateID(CONF_TRIGGER_ID): cv.declare_id(
+                            BLEClientPasskeyNotificationTrigger
+                        ),
+                    }
+                ),
+                cv.Optional(
+                    CONF_ON_NUMERIC_COMPARISON_REQUEST
+                ): automation.validate_automation(
+                    {
+                        cv.GenerateID(CONF_TRIGGER_ID): cv.declare_id(
+                            BLEClientNumericComparisonRequestTrigger
+                        ),
+                    }
+                ),
+            }
+        ).extend(esp32_ble_tracker.ESP_BLE_DEVICE_SCHEMA),
+        bluetooth_connection.consume_gatt_slot("ble_client"),
    )
-    .extend(cv.COMPONENT_SCHEMA)
-    .extend(esp32_ble_tracker.ESP_BLE_DEVICE_SCHEMA),
-    esp32_ble.consume_connection_slots(1, "ble_client"),
-)
+
+
+@functools.cache
+def _gatt_config_schema(platform: str) -> cv.All:
+    """The neutral engine's schema: the shared keys plus the hub reference
+    (parsed-advertisement sightings) and the GATT backend declaration.
+    Keyed by platform - the backend fragment differs per platform."""
+    return cv.All(
+        _COMMON_SCHEMA.extend(ble_device_base.BLE_DEVICE_SCHEMA).extend(
+            bluetooth_connection.gatt_client_schema(platform)
+        ),
+        bluetooth_connection.consume_gatt_slot("ble_client"),
+    )
+
+
+@schema_extractor("schema")
+def _validate_platform(config: ConfigType) -> ConfigType:
+    if config is SCHEMA_EXTRACT:
+        # Deliberate gap (the bluetooth_proxy pattern): the dumper gets only
+        # this shape, so the neutral arm's ble_hub_id is absent from editor
+        # schemas and the esp32-only keys are advertised on every platform.
+        # The language-schema dumper runs without a platform; expose the
+        # esp32 (legacy-engine) shape.
+        return _esp32_config_schema()
+    if _legacy_engine():
+        return _esp32_config_schema()(config)
+    if CORE.target_platform in bluetooth_connection.GATT_CLIENT_PLATFORMS:
+        return _gatt_config_schema(CORE.target_platform)(config)
+    raise cv.Invalid(f"ble_client is not supported on {CORE.target_platform}")
+
+
+CONFIG_SCHEMA = _validate_platform

 CONF_BLE_CLIENT_ID = "ble_client_id"

+
+class BLEClientFeatures(StrEnum):
+    """Per-platform engine capabilities consumers declare against."""
+
+    # The platform-neutral node interface (on_connected/table + completion
+    # callbacks) - every platform with a ble_client engine.
+    GATT_NODE = "gatt_node"
+    # The raw esp32 GATT client event stream (gattc/gap handlers,
+    # node_state) - the legacy engine only.
+    RAW_GATTC = "raw_gattc"
+    # Pairing dialog replies and bond management (Bluedroid GAP/SMP).
+    SECURITY = "security"
+
+
+def _engine_features() -> set[BLEClientFeatures]:
+    """Features the validated platform's engine provides."""
+    if _legacy_engine():
+        return {
+            BLEClientFeatures.GATT_NODE,
+            BLEClientFeatures.RAW_GATTC,
+            BLEClientFeatures.SECURITY,
+        }
+    if CORE.target_platform in bluetooth_connection.GATT_CLIENT_PLATFORMS:
+        return {BLEClientFeatures.GATT_NODE}
+    return set()
+
+
+def requires_feature(
+    feature: BLEClientFeatures, description: str
+) -> Callable[[Any], Any]:
+    """Validator gating a consumer to platforms whose engine provides
+    `feature`, naming the missing capability in the error."""
+
+    def validator(value: Any) -> Any:
+        features = _engine_features()
+        if feature not in features:
+            available = (
+                f"; this platform's engine provides: {', '.join(sorted(features))}"
+                if features
+                else ""
+            )
+            raise cv.Invalid(
+                f"{description} requires the ble_client '{feature}' feature, "
+                f"which {CORE.target_platform} does not provide{available}"
+            )
+        return value
+
+    return validator
+
+
+# The one choke point for every node component still on the raw esp32 event
+# stream; migrating to the neutral interface (NODE_BLE_CLIENT_SCHEMA +
+# register_gatt_node) lifts it.
+_legacy_engine_only = requires_feature(
+    BLEClientFeatures.RAW_GATTC,
+    "This component drives the raw ESP32 GATT client events and has not "
+    "been migrated to the platform-neutral node interface yet; it",
+)
+
 BLE_CLIENT_SCHEMA = cv.Schema(
    {
-        cv.GenerateID(CONF_BLE_CLIENT_ID): cv.use_id(BLEClient),
+        cv.GenerateID(CONF_BLE_CLIENT_ID): cv.All(
+            cv.use_id(BLEClient), _legacy_engine_only
+        ),
+    }
+)
+
+# For node components on the neutral interface: valid wherever ble_client
+# itself is.
+NODE_BLE_CLIENT_SCHEMA = cv.Schema(
+    {
+        cv.GenerateID(CONF_BLE_CLIENT_ID): cv.All(
+            cv.use_id(BLEClient),
+            requires_feature(BLEClientFeatures.GATT_NODE, "This component"),
+        ),
    }
 )

@@ -170,11 +344,31 @@ async def register_ble_node(var, config):
    cg.add(parent.register_ble_node(var))


+def _request_gatt_node_build() -> None:
+    """Node storage and the one define meaning "the neutral node surface is
+    compiled in", plus the esp32 bridge/materializer defines."""
+    _request_node_slot()
+    cg.add_define("USE_BLE_CLIENT_GATT_NODES")
+    if _legacy_engine():
+        # Deliberately not ble_device_base.request_gatt_client(): that would
+        # claim a phantom backend slot on combined proxy builds.
+        cg.add_define("USE_BLE_GATT_CLIENT")
+        cg.add_define("USE_BLE_GATT_BACKEND_BLUEDROID")
+        cg.add_define("USE_BLUEDROID_GATT_SERVICE_TABLE")
+
+
+async def register_gatt_node(var, config):
+    """Register a node on the platform-neutral interface (both engines)."""
+    parent = await cg.get_variable(config[CONF_BLE_CLIENT_ID])
+    _request_gatt_node_build()
+    cg.add(parent.register_gatt_node(var))
+
+
 BLE_WRITE_ACTION_SCHEMA = cv.Schema(
    {
        cv.GenerateID(CONF_ID): cv.use_id(BLEClient),
-        cv.Required(CONF_SERVICE_UUID): esp32_ble_tracker.bt_uuid,
-        cv.Required(CONF_CHARACTERISTIC_UUID): esp32_ble_tracker.bt_uuid,
+        cv.Required(CONF_SERVICE_UUID): bt_uuid,
+        cv.Required(CONF_CHARACTERISTIC_UUID): bt_uuid,
        cv.Required(CONF_VALUE): cv.templatable(cv.ensure_list(cv.hex_uint8_t)),
    }
 )
@@ -185,25 +379,34 @@ BLE_CONNECT_ACTION_SCHEMA = maybe_simple_id(
    }
 )

-BLE_NUMERIC_COMPARISON_REPLY_ACTION_SCHEMA = cv.Schema(
-    {
-        cv.GenerateID(CONF_ID): cv.use_id(BLEClient),
-        cv.Required(CONF_ACCEPT): cv.templatable(cv.boolean),
-    }
+BLE_NUMERIC_COMPARISON_REPLY_ACTION_SCHEMA = cv.All(
+    requires_feature(BLEClientFeatures.SECURITY, "This action"),
+    cv.Schema(
+        {
+            cv.GenerateID(CONF_ID): cv.use_id(BLEClient),
+            cv.Required(CONF_ACCEPT): cv.templatable(cv.boolean),
+        }
+    ),
 )

-BLE_PASSKEY_REPLY_ACTION_SCHEMA = cv.Schema(
-    {
-        cv.GenerateID(CONF_ID): cv.use_id(BLEClient),
-        cv.Required(CONF_PASSKEY): cv.templatable(cv.int_range(min=0, max=999999)),
-    }
+BLE_PASSKEY_REPLY_ACTION_SCHEMA = cv.All(
+    requires_feature(BLEClientFeatures.SECURITY, "This action"),
+    cv.Schema(
+        {
+            cv.GenerateID(CONF_ID): cv.use_id(BLEClient),
+            cv.Required(CONF_PASSKEY): cv.templatable(cv.int_range(min=0, max=999999)),
+        }
+    ),
 )


-BLE_REMOVE_BOND_ACTION_SCHEMA = cv.Schema(
-    {
-        cv.GenerateID(CONF_ID): cv.use_id(BLEClient),
-    }
+BLE_REMOVE_BOND_ACTION_SCHEMA = cv.All(
+    requires_feature(BLEClientFeatures.SECURITY, "This action"),
+    cv.Schema(
+        {
+            cv.GenerateID(CONF_ID): cv.use_id(BLEClient),
+        }
+    ),
 )


@@ -237,6 +440,8 @@ async def ble_connect_to_code(config, action_id, template_arg, args):
 )
 async def ble_write_to_code(config, action_id, template_arg, args):
    parent = await cg.get_variable(config[CONF_ID])
+    # The action registers itself as a neutral node in its constructor.
+    _request_gatt_node_build()
    var = cg.new_Pvariable(action_id, template_arg, parent)

    value = config[CONF_VALUE]
@@ -251,38 +456,20 @@ async def ble_write_to_code(config, action_id, template_arg, args):
        arr = cg.static_const_array(arr_id, cg.ArrayInitializer(*value))
        cg.add(var.set_value_simple(arr, len(value)))

-    if len(config[CONF_SERVICE_UUID]) == len(esp32_ble_tracker.bt_uuid16_format):
-        cg.add(
-            var.set_service_uuid16(esp32_ble_tracker.as_hex(config[CONF_SERVICE_UUID]))
-        )
-    elif len(config[CONF_SERVICE_UUID]) == len(esp32_ble_tracker.bt_uuid32_format):
-        cg.add(
-            var.set_service_uuid32(esp32_ble_tracker.as_hex(config[CONF_SERVICE_UUID]))
-        )
-    elif len(config[CONF_SERVICE_UUID]) == len(esp32_ble_tracker.bt_uuid128_format):
-        uuid128 = esp32_ble_tracker.as_reversed_hex_array(config[CONF_SERVICE_UUID])
+    if len(config[CONF_SERVICE_UUID]) == len(bt_uuid16_format):
+        cg.add(var.set_service_uuid16(as_hex(config[CONF_SERVICE_UUID])))
+    elif len(config[CONF_SERVICE_UUID]) == len(bt_uuid32_format):
+        cg.add(var.set_service_uuid32(as_hex(config[CONF_SERVICE_UUID])))
+    elif len(config[CONF_SERVICE_UUID]) == len(bt_uuid128_format):
+        uuid128 = as_reversed_hex_array(config[CONF_SERVICE_UUID])
        cg.add(var.set_service_uuid128(uuid128))

-    if len(config[CONF_CHARACTERISTIC_UUID]) == len(esp32_ble_tracker.bt_uuid16_format):
-        cg.add(
-            var.set_char_uuid16(
-                esp32_ble_tracker.as_hex(config[CONF_CHARACTERISTIC_UUID])
-            )
-        )
-    elif len(config[CONF_CHARACTERISTIC_UUID]) == len(
-        esp32_ble_tracker.bt_uuid32_format
-    ):
-        cg.add(
-            var.set_char_uuid32(
-                esp32_ble_tracker.as_hex(config[CONF_CHARACTERISTIC_UUID])
-            )
-        )
-    elif len(config[CONF_CHARACTERISTIC_UUID]) == len(
-        esp32_ble_tracker.bt_uuid128_format
-    ):
-        uuid128 = esp32_ble_tracker.as_reversed_hex_array(
-            config[CONF_CHARACTERISTIC_UUID]
-        )
+    if len(config[CONF_CHARACTERISTIC_UUID]) == len(bt_uuid16_format):
+        cg.add(var.set_char_uuid16(as_hex(config[CONF_CHARACTERISTIC_UUID])))
+    elif len(config[CONF_CHARACTERISTIC_UUID]) == len(bt_uuid32_format):
+        cg.add(var.set_char_uuid32(as_hex(config[CONF_CHARACTERISTIC_UUID])))
+    elif len(config[CONF_CHARACTERISTIC_UUID]) == len(bt_uuid128_format):
+        uuid128 = as_reversed_hex_array(config[CONF_CHARACTERISTIC_UUID])
        cg.add(var.set_char_uuid128(uuid128))

    return var
@@ -339,14 +526,45 @@ async def remove_bond_to_code(config, action_id, template_arg, args):
    return cg.new_Pvariable(action_id, template_arg, parent)


-async def to_code(config):
+async def _to_code_esp32(config: ConfigType) -> cg.MockObj:
+    from esphome.components import esp32_ble, esp32_ble_tracker
+    from esphome.components.esp32_ble import BTLoggers
+
    # Register the loggers this component needs
    esp32_ble.register_bt_logger(BTLoggers.GATT, BTLoggers.SMP)
    cg.add_define("USE_ESP32_BLE_UUID")
+    cg.add_define("USE_BLE_CLIENT_LEGACY_ENGINE")

    var = cg.new_Pvariable(config[CONF_ID])
    await cg.register_component(var, config)
    await esp32_ble_tracker.register_client(var, config)
+    return var
+
+
+# Sizes the neutral client's node storage; the client itself requests a
+# baseline slot so the define exists on every build that compiles the engine.
+_request_node_slot = cg.slot_counter("ESPHOME_BLE_CLIENT_MAX_NODES")
+
+
+async def _to_code_gatt(config: ConfigType) -> cg.MockObj:
+    # The engine always carries the node surface (the client itself owns the
+    # baseline slot).
+    _request_gatt_node_build()
+    backend = await bluetooth_connection.new_gatt_backend(config)
+    var = cg.new_Pvariable(config[CONF_ID])
+    await cg.register_component(var, config)
+    cg.add(var.set_backend(backend))
+    # Sighting-gated connects: the client listens for the peer's parsed
+    # advertisements through the hub.
+    await ble_device_base.register_ble_device(var, config)
+    return var
+
+
+async def to_code(config: ConfigType) -> None:
+    if _legacy_engine():
+        var = await _to_code_esp32(config)
+    else:
+        var = await _to_code_gatt(config)
    cg.add(var.set_address(config[CONF_MAC_ADDRESS].as_hex))
    cg.add(var.set_auto_connect(config[CONF_AUTO_CONNECT]))
    for conf in config.get(CONF_ON_CONNECT, []):
@@ -1,11 +0,0 @@
-#ifdef USE_ESP32
-
-#include "automation.h"
-
-namespace esphome::ble_client {
-
-const char *const Automation::TAG = "ble_client.automation";
-
-}  // namespace esphome::ble_client
-
-#endif
@@ -1,27 +1,14 @@
 #pragma once

-#ifdef USE_ESP32
+#include "esphome/core/defines.h"

-#include <utility>
-#include <vector>
+#ifdef USE_BLE_CLIENT_LEGACY_ENGINE

 #include "esphome/core/automation.h"
 #include "esphome/components/ble_client/ble_client.h"
-#include "esphome/core/helpers.h"
-#include "esphome/core/log.h"
-
-// Maximum bytes to log in hex format for BLE writes (many logging buffers are 256 chars)
-static constexpr size_t BLE_WRITE_MAX_LOG_BYTES = 64;

 namespace esphome::ble_client {

-// placeholder class for static TAG .
-class Automation {
- public:
-  // could be made inline with C++17
-  static const char *const TAG;
-};
-
 // implement on_connect automation.
 class BLEClientConnectTrigger final : public Trigger<>, public BLEClientNode {
 public:
@@ -93,144 +80,6 @@ class BLEClientNumericComparisonRequestTrigger final : public Trigger<uint32_t>,
  }
 };

-// implement the ble_client.ble_write action.
-template<typename... Ts> class BLEClientWriteAction final : public Action<Ts...>, public BLEClientNode {
- public:
-  BLEClientWriteAction(BLEClient *ble_client) {
-    ble_client->register_ble_node(this);
-    ble_client_ = ble_client;
-  }
-
-  void set_service_uuid16(uint16_t uuid) { this->service_uuid_ = espbt::ESPBTUUID::from_uint16(uuid); }
-  void set_service_uuid32(uint32_t uuid) { this->service_uuid_ = espbt::ESPBTUUID::from_uint32(uuid); }
-  void set_service_uuid128(uint8_t *uuid) { this->service_uuid_ = espbt::ESPBTUUID::from_raw(uuid); }
-
-  void set_char_uuid16(uint16_t uuid) { this->char_uuid_ = espbt::ESPBTUUID::from_uint16(uuid); }
-  void set_char_uuid32(uint32_t uuid) { this->char_uuid_ = espbt::ESPBTUUID::from_uint32(uuid); }
-  void set_char_uuid128(uint8_t *uuid) { this->char_uuid_ = espbt::ESPBTUUID::from_raw(uuid); }
-
-  void set_value_template(std::vector<uint8_t> (*func)(Ts...)) {
-    this->value_.func = func;
-    this->len_ = -1;  // Sentinel value indicates template mode
-  }
-
-  // Store pointer to static data in flash (no RAM copy)
-  void set_value_simple(const uint8_t *data, size_t len) {
-    this->value_.data = data;
-    this->len_ = len;  // Length >= 0 indicates static mode
-  }
-
-  void play(const Ts &...x) override {}
-
-  void play_complex(const Ts &...x) override {
-    this->num_running_++;
-    this->var_ = std::make_tuple(x...);
-
-    bool result;
-    if (this->len_ >= 0) {
-      // Static mode: write directly from flash pointer
-      result = this->write(this->value_.data, this->len_);
-    } else {
-      // Template mode: call function and write the vector
-      std::vector<uint8_t> value = this->value_.func(x...);
-      result = this->write(value);
-    }
-
-    // on write failure, continue the automation chain rather than stopping so that e.g. disconnect can work.
-    if (!result)
-      this->play_next_(x...);
-  }
-
-  /**
-   * Note about logging: the esph_log_X macros are used here because the CI checks complain about use of the ESP LOG
-   * macros in header files (Can't even write it in a comment!)
-   * Not sure why, because they seem to work just fine.
-   * The problem is that the implementation of a templated class can't be placed in a .cpp file when using C++ less than
-   * 17, so the methods have to be here.  The esph_log_X macros are equivalent in function, but don't trigger the CI
-   * errors.
-   */
-  // initiate the write. Return true if all went well, will be followed by a WRITE_CHAR event.
-  bool write(const uint8_t *data, size_t len) {
-    if (this->node_state != espbt::ClientState::ESTABLISHED) {
-      esph_log_w(Automation::TAG, "Cannot write to BLE characteristic - not connected");
-      return false;
-    }
-#if ESPHOME_LOG_LEVEL >= ESPHOME_LOG_LEVEL_VERY_VERBOSE
-    char hex_buf[format_hex_pretty_size(BLE_WRITE_MAX_LOG_BYTES)];
-    esph_log_vv(Automation::TAG, "Will write %d bytes: %s", len, format_hex_pretty_to(hex_buf, data, len));
-#endif
-    esp_err_t err =
-        esp_ble_gattc_write_char(this->parent()->get_gattc_if(), this->parent()->get_conn_id(), this->char_handle_, len,
-                                 const_cast<uint8_t *>(data), this->write_type_, ESP_GATT_AUTH_REQ_NONE);
-    if (err != ESP_OK) {
-      esph_log_e(Automation::TAG, "Error writing to characteristic: %s!", esp_err_to_name(err));
-      return false;
-    }
-    return true;
-  }
-
-  bool write(const std::vector<uint8_t> &value) { return this->write(value.data(), value.size()); }
-
-  void gattc_event_handler(esp_gattc_cb_event_t event, esp_gatt_if_t gattc_if,
-                           esp_ble_gattc_cb_param_t *param) override {
-    switch (event) {
-      case ESP_GATTC_WRITE_CHAR_EVT:
-        // upstream code checked the MAC address, verify the characteristic.
-        if (param->write.handle == this->char_handle_)
-          this->parent()->run_later([this]() { this->play_next_tuple_(this->var_); });
-        break;
-      case ESP_GATTC_DISCONNECT_EVT:
-        if (this->num_running_ != 0)
-          this->stop_complex();
-        break;
-      case ESP_GATTC_SEARCH_CMPL_EVT: {
-        auto *chr = this->parent()->get_characteristic(this->service_uuid_, this->char_uuid_);
-        if (chr == nullptr) {
-          char char_buf[esp32_ble::UUID_STR_LEN];
-          char service_buf[esp32_ble::UUID_STR_LEN];
-          esph_log_w("ble_write_action", "Characteristic %s was not found in service %s",
-                     this->char_uuid_.to_str(char_buf), this->service_uuid_.to_str(service_buf));
-          break;
-        }
-        this->char_handle_ = chr->handle;
-        this->char_props_ = chr->properties;
-        if (this->char_props_ & ESP_GATT_CHAR_PROP_BIT_WRITE) {
-          this->write_type_ = ESP_GATT_WRITE_TYPE_RSP;
-          esph_log_d(Automation::TAG, "Write type: ESP_GATT_WRITE_TYPE_RSP");
-        } else if (this->char_props_ & ESP_GATT_CHAR_PROP_BIT_WRITE_NR) {
-          this->write_type_ = ESP_GATT_WRITE_TYPE_NO_RSP;
-          esph_log_d(Automation::TAG, "Write type: ESP_GATT_WRITE_TYPE_NO_RSP");
-        } else {
-          char char_buf[esp32_ble::UUID_STR_LEN];
-          esph_log_e(Automation::TAG, "Characteristic %s does not allow writing", this->char_uuid_.to_str(char_buf));
-          break;
-        }
-        this->node_state = espbt::ClientState::ESTABLISHED;
-        char char_buf[esp32_ble::UUID_STR_LEN];
-        esph_log_d(Automation::TAG, "Found characteristic %s on device %s", this->char_uuid_.to_str(char_buf),
-                   ble_client_->address_str());
-        break;
-      }
-      default:
-        break;
-    }
-  }
-
- private:
-  BLEClient *ble_client_;
-  ssize_t len_{-1};  // -1 = template mode, >=0 = static mode with length
-  union Value {
-    std::vector<uint8_t> (*func)(Ts...);  // Function pointer (stateless lambdas)
-    const uint8_t *data;                  // Pointer to static data in flash
-  } value_;
-  espbt::ESPBTUUID service_uuid_;
-  espbt::ESPBTUUID char_uuid_;
-  std::tuple<Ts...> var_{};
-  uint16_t char_handle_{};
-  esp_gatt_char_prop_t char_props_{};
-  esp_gatt_write_type_t write_type_{};
-};
-
 template<typename... Ts> class BLEClientPasskeyReplyAction final : public Action<Ts...> {
 public:
  BLEClientPasskeyReplyAction(BLEClient *ble_client) { parent_ = ble_client; }
@@ -0,0 +1,118 @@
+// Neutral twins of the shared ble_client automations. Class names, namespace,
+// and codegen-visible signatures are IDENTICAL to automation.h so generated
+// main.cpp compiles against whichever engine the build gates in; only the
+// internals differ (client callbacks and the neutral node interface instead
+// of raw gattc events). The Bluedroid-security automations (passkey, numeric
+// comparison, remove bond) have no neutral equivalent and stay esp32-only.
+
+#pragma once
+
+#include "esphome/core/defines.h"
+
+#if defined(USE_BLE_GATT_CLIENT) && !defined(USE_BLE_CLIENT_LEGACY_ENGINE)
+
+#include <tuple>
+
+#include "ble_client_gatt.h"
+#include "esphome/core/automation.h"
+
+namespace esphome::ble_client {
+
+class BLEClientConnectTrigger final : public Trigger<> {
+ public:
+  explicit BLEClientConnectTrigger(BLEClient *parent) {
+    parent->add_on_connect_callback([this]() { this->trigger(); });
+  }
+};
+
+class BLEClientDisconnectTrigger final : public Trigger<> {
+ public:
+  explicit BLEClientDisconnectTrigger(BLEClient *parent) {
+    // Fires only after a completed connection (never for failed attempts),
+    // matching the legacy CLOSE_EVT semantics.
+    parent->add_on_disconnect_callback([this]() { this->trigger(); });
+  }
+};
+
+template<typename... Ts> class BLEClientConnectAction final : public Action<Ts...> {
+ public:
+  BLEClientConnectAction(BLEClient *ble_client) {
+    ble_client_ = ble_client;
+    ble_client->add_on_connect_callback([this]() {
+      if (this->num_running_ != 0)
+        this->play_next_tuple_(this->var_);
+    });
+    // A connect attempt that dies (or a later disconnect) terminates the
+    // chain, mirroring the legacy DISCONNECT_EVT handling.
+    ble_client->add_on_connect_failed_callback([this]() {
+      if (this->num_running_ != 0)
+        this->stop_complex();
+    });
+    ble_client->add_on_disconnect_callback([this]() {
+      if (this->num_running_ != 0)
+        this->stop_complex();
+    });
+  }
+
+  // not used since we override play_complex_
+  void play(const Ts &...x) override {}
+
+  void play_complex(const Ts &...x) override {
+    // it makes no sense to have multiple instances of this running at the
+    // same time; cancel a re-trigger while still running.
+    if (this->num_running_ != 0) {
+      this->stop_complex();
+      return;
+    }
+    this->num_running_++;
+    if (this->ble_client_->connected()) {
+      this->play_next_(x...);
+    } else {
+      this->var_ = std::make_tuple(x...);
+      // No-op while already connecting; the callback resolves the wait.
+      this->ble_client_->connect();
+    }
+  }
+
+ private:
+  BLEClient *ble_client_;
+  std::tuple<Ts...> var_{};
+};
+
+template<typename... Ts> class BLEClientDisconnectAction final : public Action<Ts...> {
+ public:
+  BLEClientDisconnectAction(BLEClient *ble_client) {
+    ble_client_ = ble_client;
+    // Both terminal outcomes resolve the wait: a completed teardown and a
+    // connect attempt that died on the way down.
+    ble_client->add_on_disconnect_callback([this]() {
+      if (this->num_running_ != 0)
+        this->play_next_tuple_(this->var_);
+    });
+    ble_client->add_on_connect_failed_callback([this]() {
+      if (this->num_running_ != 0)
+        this->play_next_tuple_(this->var_);
+    });
+  }
+
+  // not used since we override play_complex_
+  void play(const Ts &...x) override {}
+
+  void play_complex(const Ts &...x) override {
+    this->num_running_++;
+    if (this->ble_client_->idle()) {
+      this->play_next_(x...);
+    } else {
+      this->var_ = std::make_tuple(x...);
+      this->ble_client_->disconnect();
+    }
+  }
+
+ private:
+  BLEClient *ble_client_;
+  std::tuple<Ts...> var_{};
+};
+
+}  // namespace esphome::ble_client
+
+#endif  // USE_BLE_GATT_CLIENT && !USE_BLE_CLIENT_LEGACY_ENGINE
@@ -2,10 +2,16 @@
 #include "esphome/components/esp32_ble_client/ble_client_base.h"
 #include "esphome/components/esp32_ble_tracker/esp32_ble_tracker.h"
 #include "esphome/core/application.h"
+#include "esphome/core/hal.h"
 #include "esphome/core/helpers.h"
 #include "esphome/core/log.h"

-#ifdef USE_ESP32
+#ifdef USE_BLE_CLIENT_LEGACY_ENGINE
+
+#ifdef USE_BLE_CLIENT_GATT_NODES
+#include "esphome/components/bluetooth_connection/bluetooth_connection.h"
+#include "esphome/components/bluetooth_connection/gatt_service_table_bluedroid.h"
+#endif

 namespace esphome::ble_client {

@@ -30,6 +36,10 @@ void BLEClient::dump_config() {
 bool BLEClient::parse_device(const espbt::ESPBTDevice &device) {
  if (!this->enabled)
    return false;
+#ifdef USE_BLE_CLIENT_GATT_NODES
+  if (device.address_uint64() == this->address_ && this->gatt_backoff_.holding_off())
+    return false;
+#endif
  return BLEClientBase::parse_device(device);
 }

@@ -40,24 +50,60 @@ void BLEClient::set_enabled(bool enabled) {
  if (!enabled) {
    ESP_LOGI(TAG, "[%s] Disabling BLE client.", this->address_str());
    this->disconnect();
+    return;
  }
+#ifdef USE_BLE_CLIENT_GATT_NODES
+  // A re-enable clears the backoff (neutral-engine parity).
+  this->gatt_backoff_.reset();
+#endif
 }

 bool BLEClient::gattc_event_handler(esp_gattc_cb_event_t event, esp_gatt_if_t esp_gattc_if,
                                    esp_ble_gattc_cb_param_t *param) {
+#ifdef USE_BLE_CLIENT_GATT_NODES
+  // Bridge-initiated registrations bypass the base's REG_FOR_NOTIFY handling:
+  // its automatic CCCD write would double the node's own.
+  // Handle-keyed: mixed legacy/neutral subscriptions to one characteristic
+  // are unsupported during the migration window.
+  if (event == ESP_GATTC_REG_FOR_NOTIFY_EVT && esp_gattc_if == this->gattc_if_ &&
+      this->take_pending_gatt_reg_(param->reg_for_notify.handle)) {
+    if (this->pending_notify_regs_ > 0)
+      this->pending_notify_regs_--;
+    int err = param->reg_for_notify.status == ESP_GATT_OK ? 0 : param->reg_for_notify.status;
+    this->notify_state_to_gatt_nodes_(param->reg_for_notify.handle, true, err);
+    // A retiring last registration must still release the cache.
+    this->maybe_release_services_();
+    return true;
+  }
+#endif
  if (!BLEClientBase::gattc_event_handler(event, esp_gattc_if, param))
    return false;

+#ifdef USE_BLE_CLIENT_GATT_NODES
+  // Before the legacy fan-out so gatt nodes resolve before any trigger fires.
+  if (!this->gatt_nodes_.empty()) {
+    if (event == ESP_GATTC_SEARCH_CMPL_EVT) {
+      // A failed discovery tears the link down; the on_connect trigger must
+      // not fire into the teardown.
+      if (!this->handle_gatt_search_cmpl_(param->search_cmpl.status))
+        return true;
+    } else {
+      this->dispatch_gatt_event_(event, param);
+    }
+  }
+#endif
  for (auto *node : this->nodes_)
    node->gattc_event_handler(event, esp_gattc_if, param);
+  this->maybe_release_services_();
+  return true;
+}

+void BLEClient::maybe_release_services_() {
  // The release frees the GATT cache that BLEClientBase's CCCD lookup still needs.
-  // The last REG_FOR_NOTIFY event clears the counter before node dispatch, so the release still runs here.
  if (!this->services_.empty() && !this->notify_registration_pending() && this->all_nodes_established_()) {
    this->release_services();
    ESP_LOGD(TAG, "All clients established, services released");
  }
-  return true;
 }

 void BLEClient::gap_event_handler(esp_gap_ble_cb_event_t event, esp_ble_gap_cb_param_t *param) {
@@ -65,10 +111,19 @@ void BLEClient::gap_event_handler(esp_gap_ble_cb_event_t event, esp_ble_gap_cb_p

  for (auto *node : this->nodes_)
    node->gap_event_handler(event, param);
+#ifdef USE_BLE_CLIENT_GATT_NODES
+  if (event == ESP_GAP_BLE_AUTH_CMPL_EVT && this->check_addr(param->ble_security.auth_cmpl.bd_addr)) {
+    int status = param->ble_security.auth_cmpl.success ? 0 : param->ble_security.auth_cmpl.fail_reason;
+    for (auto *node : this->gatt_nodes_)
+      node->on_pairing_result(status);
+  }
+#endif
 }

 void BLEClient::set_state(espbt::ClientState state) {
  BLEClientBase::set_state(state);
+  // ESTABLISHED never flows through here; gatt nodes are promoted after the
+  // on_connected fan-out.
  for (auto &node : nodes_)
    node->node_state = state;
 }
@@ -83,6 +138,218 @@ bool BLEClient::all_nodes_established_() {
  return true;
 }

+#ifdef USE_BLE_CLIENT_GATT_NODES
+
+void BLEClient::register_gatt_node(BLEClientNode *node) {
+  // Parent before the capacity check so a dropped node still has a usable
+  // parent() (neutral-engine parity).
+  node->set_ble_client_parent(this);
+  if (this->gatt_nodes_.size() == ESPHOME_BLE_CLIENT_MAX_NODES) {
+    // push_back past capacity is a silent no-op; an undersized slot count
+    // must be loud at boot, not an unresolvable node at runtime.
+    ESP_LOGE(TAG, "[%s] Node capacity exceeded; node dropped", this->address_str());
+    this->status_set_error(LOG_STR("node capacity exceeded"));
+    return;
+  }
+  this->gatt_nodes_.push_back(node);
+  // nodes_ covers the shared state bookkeeping; gatt_nodes_ is the neutral
+  // fan-out subset.
+  this->register_ble_node(node);
+}
+
+int BLEClient::find_pending_gatt_reg_(uint16_t handle) const {
+  for (uint8_t i = 0; i < this->pending_gatt_reg_count_; i++) {
+    if (this->pending_gatt_regs_[i] == handle)
+      return i;
+  }
+  return -1;
+}
+
+bool BLEClient::take_pending_gatt_reg_(uint16_t handle) {
+  int i = this->find_pending_gatt_reg_(handle);
+  if (i < 0)
+    return false;
+  // No duplicates (notify_characteristic refuses a re-push); swap-with-last.
+  this->pending_gatt_regs_[i] = this->pending_gatt_regs_[--this->pending_gatt_reg_count_];
+  return true;
+}
+
+void BLEClient::notify_state_to_gatt_nodes_(uint16_t handle, bool enabled, int error) {
+  if (error != 0) {
+    ESP_LOGW(TAG, "[%s] Notify %s on handle 0x%04x failed, status=%d", this->address_str(),
+             enabled ? "enable" : "disable", handle, error);
+  }
+  for (auto *node : this->gatt_nodes_)
+    node->on_notify_state(handle, enabled, error);
+}
+
+void BLEClient::dispatch_gatt_event_(esp_gattc_cb_event_t event, esp_ble_gattc_cb_param_t *param) {
+  switch (event) {
+    case ESP_GATTC_READ_CHAR_EVT:
+    case ESP_GATTC_READ_DESCR_EVT: {
+      bool ok = param->read.status == ESP_GATT_OK;
+      if (!ok) {
+        // Breadcrumb even when no node claims the handle.
+        ESP_LOGD(TAG, "[%s] Read on handle 0x%04x completed with status %d", this->address_str(), param->read.handle,
+                 param->read.status);
+      }
+      for (auto *node : this->gatt_nodes_) {
+        node->on_read_result(param->read.handle, ok ? param->read.value : nullptr, ok ? param->read.value_len : 0,
+                             ok ? 0 : param->read.status);
+      }
+      break;
+    }
+    case ESP_GATTC_WRITE_CHAR_EVT:
+    case ESP_GATTC_WRITE_DESCR_EVT:
+      if (param->write.status != ESP_GATT_OK) {
+        // Breadcrumb even when no node claims the handle.
+        ESP_LOGD(TAG, "[%s] Write on handle 0x%04x completed with status %d", this->address_str(), param->write.handle,
+                 param->write.status);
+      }
+      for (auto *node : this->gatt_nodes_) {
+        node->on_write_result(param->write.handle, param->write.status == ESP_GATT_OK ? 0 : param->write.status);
+      }
+      break;
+    case ESP_GATTC_NOTIFY_EVT:
+      for (auto *node : this->gatt_nodes_) {
+        node->on_notify(param->notify.handle, param->notify.value, param->notify.value_len);
+      }
+      break;
+    case ESP_GATTC_UNREG_FOR_NOTIFY_EVT:
+      // The base does no CCCD work for unregister; no interception needed.
+      this->notify_state_to_gatt_nodes_(
+          param->unreg_for_notify.handle, false,
+          param->unreg_for_notify.status == ESP_GATT_OK ? 0 : param->unreg_for_notify.status);
+      break;
+    default:
+      break;
+  }
+}
+
+bool BLEClient::handle_gatt_search_cmpl_(esp_gatt_status_t status) {
+  // The base ignores the search status; the neutral contract must not.
+  uint16_t service_total = 0;
+  bool counted = status == ESP_GATT_OK && bluetooth_connection::BluedroidServiceTable::count_services(
+                                              this->gattc_if_, this->conn_id_, &service_total);
+  if (!counted || service_total == 0) {
+    // A failed search poisons the whole discovery, legacy nodes included.
+    ESP_LOGW(TAG, "[%s] Discovery failed (status=%d, services=%u)", this->address_str(), status, service_total);
+    this->gatt_backoff_.register_failure(this->address_str());
+    this->disconnect();
+    return false;
+  }
+  // Stack-owned; nodes copy their handles during on_connected().
+  bluetooth_connection::BluedroidServiceTable table;
+  if (!table.build(this->gattc_if_, this->conn_id_, service_total, this->connection_index_)) {
+    if (!this->has_legacy_nodes_()) {
+      ESP_LOGW(TAG, "[%s] Service table build failed; treating as failed discovery", this->address_str());
+      this->gatt_backoff_.register_failure(this->address_str());
+      this->disconnect();
+      return false;
+    }
+    // Only the table build failed; legacy nodes read the base's services_
+    // and keep the link. Gatt nodes catch the next connection.
+    ESP_LOGW(TAG, "[%s] Service table build failed; gatt nodes skip this connection", this->address_str());
+    this->status_set_warning(LOG_STR("gatt nodes inactive: service table build failed"));
+  } else {
+    this->gatt_connected_ = true;
+    auto view = table.view();
+    for (auto *node : this->gatt_nodes_) {
+      node->on_connected(view);
+      if (this->state() != espbt::ClientState::ESTABLISHED) {
+        // The node tore the link down; remaining nodes get on_disconnected
+        // with no preceding on_connected, so leave a trace of why.
+        ESP_LOGW(TAG, "[%s] A node aborted the connection during setup", this->address_str());
+        return false;
+      }
+    }
+    this->gatt_backoff_.reset();
+    this->status_clear_warning();
+  }
+  // Promote so the legacy release condition can fire.
+  for (auto *node : this->gatt_nodes_)
+    node->node_state = espbt::ClientState::ESTABLISHED;
+  return true;
+}
+
+void BLEClient::on_disconnect_complete(esp_err_t reason) {
+  this->pending_gatt_reg_count_ = 0;
+  if (!this->gatt_connected_)
+    return;  // Never-established links report nothing (neutral parity).
+  this->gatt_connected_ = false;
+  for (auto *node : this->gatt_nodes_)
+    node->on_disconnected();
+}
+
+int BLEClient::check_and_log_error_(const char *operation, esp_err_t err) {
+  if (err != ESP_OK)
+    this->log_gattc_warning_(operation, err);
+  return err;
+}
+
+int BLEClient::write_characteristic(uint16_t handle, const uint8_t *data, uint16_t len, bool response) {
+  if (this->conn_id_ == UNSET_CONN_ID)
+    return ble_device_base::GATT_ERR_NOT_CONNECTED;
+  return this->check_and_log_error_(
+      "esp_ble_gattc_write_char",
+      esp_ble_gattc_write_char(this->gattc_if_, this->conn_id_, handle, len, const_cast<uint8_t *>(data),
+                               response ? ESP_GATT_WRITE_TYPE_RSP : ESP_GATT_WRITE_TYPE_NO_RSP,
+                               ESP_GATT_AUTH_REQ_NONE));
+}
+
+int BLEClient::read_characteristic(uint16_t handle) {
+  if (this->conn_id_ == UNSET_CONN_ID)
+    return ble_device_base::GATT_ERR_NOT_CONNECTED;
+  return this->check_and_log_error_("esp_ble_gattc_read_char", esp_ble_gattc_read_char(this->gattc_if_, this->conn_id_,
+                                                                                       handle, ESP_GATT_AUTH_REQ_NONE));
+}
+
+int BLEClient::read_descriptor(uint16_t handle) {
+  if (this->conn_id_ == UNSET_CONN_ID)
+    return ble_device_base::GATT_ERR_NOT_CONNECTED;
+  return this->check_and_log_error_(
+      "esp_ble_gattc_read_char_descr",
+      esp_ble_gattc_read_char_descr(this->gattc_if_, this->conn_id_, handle, ESP_GATT_AUTH_REQ_NONE));
+}
+
+int BLEClient::write_descriptor(uint16_t handle, const uint8_t *data, uint16_t len) {
+  if (this->conn_id_ == UNSET_CONN_ID)
+    return ble_device_base::GATT_ERR_NOT_CONNECTED;
+  return this->check_and_log_error_(
+      "esp_ble_gattc_write_char_descr",
+      esp_ble_gattc_write_char_descr(this->gattc_if_, this->conn_id_, handle, len, const_cast<uint8_t *>(data),
+                                     ESP_GATT_WRITE_TYPE_RSP, ESP_GATT_AUTH_REQ_NONE));
+}
+
+int BLEClient::notify_characteristic(uint16_t handle, bool enable) {
+  if (this->conn_id_ == UNSET_CONN_ID)
+    return ble_device_base::GATT_ERR_NOT_CONNECTED;
+  if (enable) {
+    if (this->find_pending_gatt_reg_(handle) >= 0) {
+      // ESP_OK: the in-flight registration's completion fans out to all nodes.
+      ESP_LOGW(TAG, "[%s] Notify registration already pending for handle 0x%04x", this->address_str(), handle);
+      return ESP_OK;
+    }
+    if (this->pending_gatt_reg_count_ == MAX_PENDING_NOTIFY_REGS) {
+      // An untracked registration would let the base's auto-CCCD through.
+      ESP_LOGE(TAG, "[%s] Too many pending notify registrations", this->address_str());
+      return ble_device_base::GATT_ERR_NO_MEMORY;
+    }
+    // The base helper's pending count holds the service-release until the
+    // (intercepted) completion.
+    esp_err_t err = this->register_for_notify(handle);
+    if (err == ESP_OK)
+      this->pending_gatt_regs_[this->pending_gatt_reg_count_++] = handle;
+    return this->check_and_log_error_("esp_ble_gattc_register_for_notify", err);
+  }
+  return this->check_and_log_error_("esp_ble_gattc_unregister_for_notify",
+                                    esp_ble_gattc_unregister_for_notify(this->gattc_if_, this->remote_bda_, handle));
+}
+
+int BLEClient::unpair() { return bluetooth_connection::unpair_device(this->get_address()); }
+
+#endif  // USE_BLE_CLIENT_GATT_NODES
+
 }  // namespace esphome::ble_client

 #endif
@@ -1,18 +1,20 @@
 #pragma once

+#include "esphome/core/defines.h"
+
+#ifdef USE_BLE_CLIENT_LEGACY_ENGINE
+
+#include "ble_client_node.h"
+#include "connect_backoff.h"
 #include "esphome/components/esp32_ble_client/ble_client_base.h"
 #include "esphome/components/esp32_ble_tracker/esp32_ble_tracker.h"
 #include "esphome/core/component.h"
 #include "esphome/core/helpers.h"

-#ifdef USE_ESP32
-
 #include <esp_bt_defs.h>
 #include <esp_gap_ble_api.h>
 #include <esp_gatt_common_api.h>
 #include <esp_gattc_api.h>
-#include <array>
-#include <string>
 #include <vector>

 namespace esphome::ble_client {
@@ -21,34 +23,6 @@ namespace espbt = esphome::esp32_ble_tracker;

 using namespace esp32_ble_client;

-class BLEClient;
-
-class BLEClientNode {
- public:
-  virtual void gattc_event_handler(esp_gattc_cb_event_t event, esp_gatt_if_t gattc_if,
-                                   esp_ble_gattc_cb_param_t *param){};
-  virtual void gap_event_handler(esp_gap_ble_cb_event_t event, esp_ble_gap_cb_param_t *param) {}
-  virtual void loop() {}
-  void set_address(uint64_t address) { address_ = address; }
-  espbt::ESPBTClient *client;
-  // This should be transitioned to Established once the node no longer needs
-  // the services/descriptors/characteristics of the parent client. This will
-  // allow some memory to be freed.
-  // The parent frees the peer's GATT cache once every node reports Established.
-  // Never report Established while an operation that reads that cache is outstanding.
-  // - esp_ble_gattc_register_for_notify() completes asynchronously.
-  // - Register from ESP_GATTC_SEARCH_CMPL_EVT, then set this from ESP_GATTC_REG_FOR_NOTIFY_EVT.
-  // - BLEClientBase::register_for_notify() holds the release until the registration completes.
-  espbt::ClientState node_state;
-
-  BLEClient *parent() { return this->parent_; }
-  void set_ble_client_parent(BLEClient *parent) { this->parent_ = parent; }
-
- protected:
-  BLEClient *parent_;
-  uint64_t address_;
-};
-
 class BLEClient final : public BLEClientBase {
 public:
  void setup() override;
@@ -64,7 +38,6 @@ class BLEClient final : public BLEClientBase {
  void set_enabled(bool enabled);

  void register_ble_node(BLEClientNode *node) {
-    node->client = this;
    node->set_ble_client_parent(this);
    this->nodes_.push_back(node);
  }
@@ -73,10 +46,57 @@ class BLEClient final : public BLEClientBase {

  void set_state(espbt::ClientState state) override;

+#ifdef USE_BLE_CLIENT_GATT_NODES
+  // ---- the neutral node surface (signatures shared with the non-esp32
+  // engine, so nodes on the neutral interface compile against either) ----
+  void register_gatt_node(BLEClientNode *node);
+
+  bool idle() const { return this->state() == espbt::ClientState::IDLE; }
+
+  int write_characteristic(uint16_t handle, const uint8_t *data, uint16_t len, bool response);
+  int read_characteristic(uint16_t handle);
+  int read_descriptor(uint16_t handle);
+  int write_descriptor(uint16_t handle, const uint8_t *data, uint16_t len);
+  /// Local registration only; per the neutral contract the CCCD write is the
+  /// node's job (the legacy auto-CCCD is suppressed for these handles).
+  int notify_characteristic(uint16_t handle, bool enable);
+  // pair() comes from BLEClientBase, matching the neutral engine's.
+  int unpair();
+#endif
+
 protected:
  bool all_nodes_established_();
+  void maybe_release_services_();
+#ifdef USE_BLE_CLIENT_GATT_NODES
+  int check_and_log_error_(const char *operation, esp_err_t err);
+  int find_pending_gatt_reg_(uint16_t handle) const;
+  void notify_state_to_gatt_nodes_(uint16_t handle, bool enabled, int error);
+  void dispatch_gatt_event_(esp_gattc_cb_event_t event, esp_ble_gattc_cb_param_t *param);
+  // False = failed discovery: the link comes down and the caller suppresses
+  // the legacy fan-out.
+  bool handle_gatt_search_cmpl_(esp_gatt_status_t status);
+  bool take_pending_gatt_reg_(uint16_t handle);
+  void on_disconnect_complete(esp_err_t reason) override;
+#endif

  std::vector<BLEClientNode *> nodes_;
+#ifdef USE_BLE_CLIENT_GATT_NODES
+  // Raise if a migrated node needs more concurrent registrations.
+  static constexpr uint8_t MAX_PENDING_NOTIFY_REGS = 4;
+
+  // Nodes on the neutral surface; fed the translated callbacks and
+  // auto-established after the on_connected fan-out. Every gatt node is
+  // also in nodes_ (registration pushes into both).
+  StaticVector<BLEClientNode *, ESPHOME_BLE_CLIENT_MAX_NODES> gatt_nodes_;
+  bool has_legacy_nodes_() const { return this->nodes_.size() > this->gatt_nodes_.size(); }
+  // Reconnect backoff after materializer failures.
+  ConnectBackoff gatt_backoff_;
+  // Bridge-initiated notify registrations awaiting REG_FOR_NOTIFY_EVT.
+  uint16_t pending_gatt_regs_[MAX_PENDING_NOTIFY_REGS];
+  uint8_t pending_gatt_reg_count_{0};
+  // on_connected fan-out started; on_disconnected is owed at teardown.
+  bool gatt_connected_{false};
+#endif
 };

 }  // namespace esphome::ble_client
@@ -0,0 +1,249 @@
+#include "ble_client_gatt.h"
+
+#if defined(USE_BLE_GATT_CLIENT) && !defined(USE_BLE_CLIENT_LEGACY_ENGINE)
+
+#include "esphome/core/hal.h"
+#include "esphome/core/log.h"
+
+namespace esphome::ble_client {
+
+static const char *const TAG = "ble_client";
+
+void BLEClient::register_ble_node(BLEClientNode *node) {
+  node->set_ble_client_parent(this);
+  if (this->nodes_.size() == ESPHOME_BLE_CLIENT_MAX_NODES) {
+    // push_back past capacity is a silent no-op; an undersized slot count
+    // must be loud at boot, not an unresolvable node at runtime.
+    ESP_LOGE(TAG, "[%s] Node capacity exceeded; node dropped", this->address_str_);
+    this->status_set_error(LOG_STR("node capacity exceeded"));
+    return;
+  }
+  this->nodes_.push_back(node);
+}
+
+void BLEClient::set_address(uint64_t address) {
+  this->address_ = address;
+  uint8_t mac[6];
+  ble_device_base::uint64_to_mac_msb_first(address, mac);
+  format_mac_addr_upper(mac, this->address_str_);
+}
+
+void BLEClient::set_enabled(bool enabled) {
+  if (enabled == this->enabled)
+    return;
+  ESP_LOGI(TAG, "[%s] %s", this->address_str_, enabled ? "Enabled" : "Disabled");
+  this->enabled = enabled;
+  if (!enabled) {
+    this->disconnect();
+    return;
+  }
+  // A re-enable clears the backoff; the next sighting connects (legacy
+  // parity: enabling does not itself connect).
+  this->backoff_.reset();
+}
+
+bool BLEClient::parse_device(const ble_device_base::ESPBTDevice &device) {
+  if (device.address_uint64() != this->address_)
+    return false;
+  // The sighting is the source of truth for the address type.
+  this->address_type_ = device.get_address_type();
+  this->address_type_known_ = true;
+  if (!this->enabled || !this->auto_connect_ || this->state_ != State::IDLE)
+    return true;
+  if (this->backoff_.holding_off())
+    return true;
+  this->attempt_connect_();
+  return true;
+}
+
+void BLEClient::connect() {
+  if (this->state_ != State::IDLE) {
+    ESP_LOGD(TAG, "[%s] Connect requested while busy, ignoring", this->address_str_);
+    return;
+  }
+  // An absent peer can inhibit scanning for the backend's full connect
+  // timeout, so this is worth a breadcrumb - but it is a supported action.
+  ESP_LOGI(TAG, "[%s] Connecting on request", this->address_str_);
+  if (!this->address_type_known_) {
+    // Legacy parity: without a sighting the address type defaults to
+    // public, which never matches a random-static peer.
+    ESP_LOGW(TAG, "[%s] No sighting yet; assuming a public address type", this->address_str_);
+  }
+  this->attempt_connect_();
+}
+
+void BLEClient::attempt_connect_() {
+  int err = this->backend_->connect(this->address_, this->address_type_);
+  if (err != 0) {
+    // A refused connect never produces a callback: stay idle, charge the
+    // backoff, and resolve any waiting connect action through the failure
+    // path so its chain terminates.
+    ESP_LOGW(TAG, "[%s] Connect refused, err=%d", this->address_str_, err);
+    this->backoff_.register_failure(this->address_str_);
+    this->defer([this]() { this->connect_failed_callbacks_.call(); });
+    return;
+  }
+  ESP_LOGD(TAG, "[%s] Connecting", this->address_str_);
+  this->state_ = State::CONNECTING;
+}
+
+void BLEClient::disconnect() {
+  if (this->state_ == State::IDLE) {
+    ESP_LOGD(TAG, "[%s] Disconnect requested while idle, ignoring", this->address_str_);
+    return;
+  }
+  // A deliberate teardown's failure report must not feed the backoff.
+  this->cancel_requested_ = true;
+  int err = this->backend_->gatt_disconnect();
+  if (err != 0) {
+    // Refused synchronously: backend and client disagree about the link
+    // state. Warn, then settle through the deliberate-cancel path.
+    ESP_LOGW(TAG, "[%s] Disconnect refused, err=%d; settling locally", this->address_str_, err);
+    this->on_connection_state(false, 0, err);
+  }
+}
+
+void BLEClient::on_connection_state(bool connected, uint16_t mtu, int error) {
+  if (connected) {
+    this->state_ = State::DISCOVERING;
+    int discover_err = this->backend_->discover_services();
+    if (discover_err != 0) {
+      // Synchronous refusal: no discovery completion will follow.
+      ESP_LOGW(TAG, "[%s] Service discovery refused, err=%d", this->address_str_, discover_err);
+      this->backoff_.register_failure(this->address_str_);
+      // Deliberate teardown: its report must not charge the backoff again.
+      this->disconnect();
+    }
+    return;
+  }
+  bool was_connected = this->state_ == State::CONNECTED;
+  bool cancelled = this->cancel_requested_;
+  this->cancel_requested_ = false;
+  this->state_ = State::IDLE;
+  if (was_connected) {
+    ESP_LOGI(TAG, "[%s] Disconnected, status=%d", this->address_str_, error);
+    for (auto *node : this->nodes_) {
+      node->on_disconnected();
+    }
+    // Continuations leave the backend's event-drain stack first.
+    this->defer([this]() { this->disconnect_callbacks_.call(); });
+  } else {
+    if (cancelled) {
+      // status carries the refusal code when the teardown settled
+      // synchronously; 0 on a backend-completed cancel.
+      ESP_LOGD(TAG, "[%s] Connect attempt cancelled, status=%d", this->address_str_, error);
+    } else {
+      ESP_LOGW(TAG, "[%s] Connect failed, status=%d", this->address_str_, error);
+      this->backoff_.register_failure(this->address_str_);
+    }
+    this->defer([this]() { this->connect_failed_callbacks_.call(); });
+  }
+}
+
+void BLEClient::on_service_discovery_done(int error) {
+  if (error != 0) {
+    ESP_LOGW(TAG, "[%s] Service discovery failed, status=%d", this->address_str_, error);
+    this->backoff_.register_failure(this->address_str_);
+    // The teardown is deliberate: do not charge the backoff again for its
+    // connection report.
+    this->disconnect();
+    return;
+  }
+  ble_device_base::GattServiceTable table{};
+  if (!this->nodes_.empty()) {
+    // Materialize only when a node will read it: a client with no nodes
+    // would pay the build/free cycle on every (re)connect for nothing.
+    table = this->backend_->get_service_table();
+    if (table.service_count == 0) {
+      // A failed materialization is indistinguishable from a service-less
+      // peer, and a real GATT peer always exposes at least GAP/GATT: fail
+      // the discovery before CONNECTED so the teardown resolves through
+      // connect_failed, never a spurious on_disconnect.
+      ESP_LOGW(TAG, "[%s] Service table is empty; treating as failed discovery", this->address_str_);
+      this->backend_->release_services();
+      this->backoff_.register_failure(this->address_str_);
+      this->disconnect();
+      return;
+    }
+  }
+  // CONNECTED before the fan-out so nodes may consult connected() from
+  // their own on_connected().
+  this->state_ = State::CONNECTED;
+  for (auto *node : this->nodes_) {
+    node->on_connected(table);
+    if (this->state_ != State::CONNECTED || this->cancel_requested_) {
+      // A node tore the link down mid-fan-out: on_disconnect fires with no
+      // preceding on_connect, so leave a trace of why.
+      ESP_LOGW(TAG, "[%s] A node aborted the connection during setup", this->address_str_);
+      this->backend_->release_services();
+      return;
+    }
+  }
+  this->backend_->release_services();
+  this->backoff_.reset();
+  ESP_LOGI(TAG, "[%s] Connected", this->address_str_);
+  this->defer([this]() { this->connect_callbacks_.call(); });
+}
+
+void BLEClient::on_write_result(uint16_t handle, int error) {
+  if (error != 0) {
+    // Breadcrumb even when no node claims the handle.
+    ESP_LOGD(TAG, "[%s] Write on handle 0x%04x completed with status %d", this->address_str_, handle, error);
+  }
+  for (auto *node : this->nodes_) {
+    node->on_write_result(handle, error);
+  }
+}
+
+void BLEClient::on_read_result(uint16_t handle, const uint8_t *data, uint16_t len, int error) {
+  if (error != 0) {
+    // Breadcrumb even when no node claims the handle.
+    ESP_LOGD(TAG, "[%s] Read on handle 0x%04x completed with status %d", this->address_str_, handle, error);
+  }
+  for (auto *node : this->nodes_) {
+    node->on_read_result(handle, data, len, error);
+  }
+}
+
+void BLEClient::on_notify_data(uint16_t handle, const uint8_t *data, uint16_t len) {
+  // Every node sees every notification and filters by handle (legacy parity).
+  for (auto *node : this->nodes_) {
+    node->on_notify(handle, data, len);
+  }
+}
+
+void BLEClient::on_notify_state(uint16_t handle, bool enabled, int error) {
+  if (error != 0) {
+    ESP_LOGW(TAG, "[%s] Notify %s on handle 0x%04x failed, status=%d", this->address_str_,
+             enabled ? "enable" : "disable", handle, error);
+  }
+  for (auto *node : this->nodes_) {
+    node->on_notify_state(handle, enabled, error);
+  }
+}
+
+void BLEClient::on_pairing_result(int status) {
+  if (status != 0) {
+    ESP_LOGW(TAG, "[%s] Pairing failed, status=%d", this->address_str_, status);
+  } else {
+    ESP_LOGI(TAG, "[%s] Paired", this->address_str_);
+  }
+  for (auto *node : this->nodes_) {
+    node->on_pairing_result(status);
+  }
+}
+
+void BLEClient::dump_config() {
+  ESP_LOGCONFIG(TAG,
+                "BLE Client:\n"
+                "  Address: %s\n"
+                "  Auto connect: %s",
+                this->address_str_, YESNO(this->auto_connect_));
+  if (this->enabled && this->state_ == State::IDLE) {
+    ESP_LOGCONFIG(TAG, "  Waiting for an advertisement from the device");
+  }
+}
+
+}  // namespace esphome::ble_client
+
+#endif  // USE_BLE_GATT_CLIENT && !USE_BLE_CLIENT_LEGACY_ENGINE
@@ -0,0 +1,149 @@
+// Platform-neutral ble_client engine on the ble_device_base GATT contract.
+//
+// Compiled on every platform with a GATT backend except esp32, which keeps
+// the legacy BLEClientBase engine (ble_client.h) until its raw-gattc node
+// family migrates - the exclusive gates make the same class names resolve to
+// exactly one definition per build, so codegen is shared.
+//
+// Connects are sighting-gated like the legacy engine: the client is a parsed
+// advertisement listener, captures the peer's address type from the sighting,
+// and asks the backend to connect only when enabled and idle.
+
+#pragma once
+
+#include "esphome/core/defines.h"
+
+#if defined(USE_BLE_GATT_CLIENT) && !defined(USE_BLE_CLIENT_LEGACY_ENGINE)
+
+#include "ble_client_node.h"
+#include "connect_backoff.h"
+#include "esphome/components/ble_device_base/ble_device.h"
+#include "esphome/components/ble_device_base/ble_gatt_client.h"
+#include "esphome/components/bluetooth_connection/bluetooth_connection.h"
+#include "esphome/components/bluetooth_connection/bluetooth_connection_gatt_backend.h"
+#include "esphome/core/component.h"
+#include "esphome/core/helpers.h"
+
+#include <cstdint>
+#include <functional>
+
+namespace esphome::ble_client {
+
+class BLEClient : public Component,
+                  public ble_device_base::ESPBTDeviceListener,
+                  public ble_device_base::GattClientListener {
+ public:
+  void dump_config() override;
+
+  // Public field for legacy parity (the switch platform republishes it).
+  bool enabled{true};
+
+  void set_backend(ble_device_base::BLEGattConnection *backend) {
+    this->backend_ = backend;
+    backend->set_listener(this);
+  }
+  void set_address(uint64_t address);
+  void set_auto_connect(bool auto_connect) { this->auto_connect_ = auto_connect; }
+  void set_enabled(bool enabled);
+  const char *address_str() const { return this->address_str_; }
+
+  void register_ble_node(BLEClientNode *node);
+  // One registration spelling shared with the esp32 engine's bridge.
+  void register_gatt_node(BLEClientNode *node) { this->register_ble_node(node); }
+
+  bool connected() const { return this->state_ == State::CONNECTED; }
+  bool idle() const { return this->state_ == State::IDLE; }
+
+  /// Action-initiated connect (no sighting needed; uses the last captured
+  /// address type, public until a sighting arrives). No-op unless idle.
+  void connect();
+  void disconnect();
+
+  /// Legacy-named deferral used by the automation twins: neutral listener
+  /// callbacks run inside the backend's event drain, so automation chain
+  /// continuations must leave that stack first.
+  void run_later(std::function<void()> &&f) { this->defer(std::move(f)); }  // NOLINT
+
+  // Backend ops for nodes and actions - the frozen node-facing surface.
+  // Only write_characteristic has an in-tree caller; subscribing means
+  // notify_characteristic plus a CCCD write_descriptor (the caller's job
+  // per the contract).
+  int write_characteristic(uint16_t handle, const uint8_t *data, uint16_t len, bool response) {
+    return this->backend_->write_characteristic(handle, data, len, response);
+  }
+  int read_characteristic(uint16_t handle) { return this->backend_->read_characteristic(handle); }
+  int read_descriptor(uint16_t handle) { return this->backend_->read_descriptor(handle); }
+  int write_descriptor(uint16_t handle, const uint8_t *data, uint16_t len) {
+    return this->backend_->write_descriptor(handle, data, len);
+  }
+  int notify_characteristic(uint16_t handle, bool enable) {
+    return this->backend_->notify_characteristic(handle, enable);
+  }
+  int pair() { return this->backend_->pair(); }
+  int unpair() { return bluetooth_connection::unpair_device(this->address_); }
+
+  // Automation callback registration.
+  template<typename F> void add_on_connect_callback(F &&callback) {
+    this->connect_callbacks_.add(std::forward<F>(callback));
+  }
+  template<typename F> void add_on_disconnect_callback(F &&callback) {
+    this->disconnect_callbacks_.add(std::forward<F>(callback));
+  }
+  // Fired when a connect attempt dies before being established; the user
+  // on_disconnect trigger deliberately does NOT fire here (legacy parity).
+  template<typename F> void add_on_connect_failed_callback(F &&callback) {
+    this->connect_failed_callbacks_.add(std::forward<F>(callback));
+  }
+
+  // ---- ble_device_base::ESPBTDeviceListener ----
+  bool parse_device(const ble_device_base::ESPBTDevice &device) override;
+
+  // ---- ble_device_base::GattClientListener ----
+  void on_connection_state(bool connected, uint16_t mtu, int error) override;
+  void on_service_discovery_done(int error) override;
+  void on_read_result(uint16_t handle, const uint8_t *data, uint16_t len, int error) override;
+  void on_write_result(uint16_t handle, int error) override;
+  void on_notify_data(uint16_t handle, const uint8_t *data, uint16_t len) override;
+  void on_notify_state(uint16_t handle, bool enabled, int error) override;
+  void on_pairing_result(int status) override;
+
+ protected:
+  enum class State : uint8_t { IDLE, CONNECTING, DISCOVERING, CONNECTED };
+
+  void attempt_connect_();
+
+  // Group 1: pointers / containers
+  ble_device_base::BLEGattConnection *backend_{nullptr};
+  // Codegen-sized (ESPHOME_BLE_CLIENT_MAX_NODES); filled during setup.
+  StaticVector<BLEClientNode *, ESPHOME_BLE_CLIENT_MAX_NODES> nodes_;
+
+  // Group 2: 8-byte types
+  uint64_t address_{0};
+
+  // Group 3: callback managers (pointer-sized when empty)
+  LazyCallbackManager<void()> connect_callbacks_;
+  LazyCallbackManager<void()> disconnect_callbacks_;
+  LazyCallbackManager<void()> connect_failed_callbacks_;
+
+  // Group 4: 4-byte types
+  // Backoff so an undiscoverable database or a dead peer cannot produce a
+  // battery-draining connect loop.
+  ConnectBackoff backoff_;
+
+  // Group 5: arrays
+  char address_str_[MAC_ADDRESS_PRETTY_BUFFER_SIZE]{};
+
+  // Group 6: 1-byte types
+  State state_{State::IDLE};
+  uint8_t address_type_{0};  // BLE_ADDR_TYPE_*, captured from the sighting
+  // Distinguishes a captured public type from the never-sighted default.
+  bool address_type_known_{false};
+  bool auto_connect_{true};
+  // A user-initiated teardown in flight; its failure report is not a
+  // connect failure and must not feed the backoff.
+  bool cancel_requested_{false};
+};
+
+}  // namespace esphome::ble_client
+
+#endif  // USE_BLE_GATT_CLIENT && !USE_BLE_CLIENT_LEGACY_ENGINE
@@ -0,0 +1,68 @@
+// The single BLEClientNode both ble_client engines share. The neutral
+// callback surface is the one interface node components build on; the raw
+// esp32 surface below it remains for components that have not migrated yet.
+
+#pragma once
+
+#include "esphome/core/defines.h"
+
+#ifdef USE_BLE_GATT_CLIENT
+#include "esphome/components/ble_device_base/ble_gatt_client.h"
+#endif
+#ifdef USE_BLE_CLIENT_LEGACY_ENGINE
+#include "esphome/components/esp32_ble_tracker/esp32_ble_tracker.h"
+
+#include <esp_gap_ble_api.h>
+#include <esp_gattc_api.h>
+#endif
+
+#include <cstdint>
+
+namespace esphome::ble_client {
+
+class BLEClient;
+
+class BLEClientNode {
+ public:
+#ifdef USE_BLE_CLIENT_GATT_NODES
+  // Neutral surface, delivered by both engines. The table is borrowed: copy
+  // handles during on_connected(). All nodes see all completions; filter by
+  // handle.
+  // A node that disconnects from inside on_connected() aborts the fan-out;
+  // the user's on_disconnect may then fire without a preceding on_connect.
+  virtual void on_connected(const ble_device_base::GattServiceTable &table) {}
+  virtual void on_disconnected() {}
+  virtual void on_notify(uint16_t handle, const uint8_t *data, uint16_t len) {}
+  // One in-flight registration per handle; its completion fans out to every
+  // node, so a refused duplicate request still sees on_notify_state.
+  virtual void on_notify_state(uint16_t handle, bool enabled, int error) {}
+  virtual void on_read_result(uint16_t handle, const uint8_t *data, uint16_t len, int error) {}
+  virtual void on_write_result(uint16_t handle, int error) {}
+  virtual void on_pairing_result(int status) {}
+#endif
+#ifdef USE_BLE_CLIENT_LEGACY_ENGINE
+  // Legacy raw surface; components overriding these need the legacy engine
+  // until migrated to the neutral surface above.
+  virtual void gattc_event_handler(esp_gattc_cb_event_t event, esp_gatt_if_t gattc_if,
+                                   esp_ble_gattc_cb_param_t *param) {}
+  virtual void gap_event_handler(esp_gap_ble_cb_event_t event, esp_ble_gap_cb_param_t *param) {}
+  virtual void loop() {}
+  // This should be transitioned to Established once the node no longer needs
+  // the services/descriptors/characteristics of the parent client. This will
+  // allow some memory to be freed.
+  // The parent frees the peer's GATT cache once every node reports Established.
+  // Never report Established while an operation that reads that cache is outstanding.
+  // - esp_ble_gattc_register_for_notify() completes asynchronously.
+  // - Register from ESP_GATTC_SEARCH_CMPL_EVT, then set this from ESP_GATTC_REG_FOR_NOTIFY_EVT.
+  // - BLEClientBase::register_for_notify() holds the release until the registration completes.
+  esp32_ble_tracker::ClientState node_state;
+#endif
+
+  BLEClient *parent() const { return this->parent_; }
+  void set_ble_client_parent(BLEClient *parent) { this->parent_ = parent; }
+
+ protected:
+  BLEClient *parent_{nullptr};
+};
+
+}  // namespace esphome::ble_client
@@ -0,0 +1,168 @@
+// The ble_client.ble_write action: a node on the platform-neutral interface,
+// so one implementation serves both engines (the esp32 bridge and the
+// neutral engine).
+
+#pragma once
+
+#include "esphome/core/defines.h"
+
+#ifdef USE_BLE_CLIENT_GATT_NODES
+
+#include <tuple>
+#include <vector>
+
+// One of the two engine headers resolves per build.
+#include "ble_client.h"
+#include "ble_client_gatt.h"
+#include "ble_client_node.h"
+#include "esphome/core/automation.h"
+#include "esphome/core/helpers.h"
+#include "esphome/core/log.h"
+
+namespace esphome::ble_client {
+
+static const char *const BLE_WRITE_TAG = "ble_client.automation";
+
+// Maximum bytes to log in hex format for BLE writes (many logging buffers are 256 chars)
+static constexpr size_t BLE_WRITE_MAX_LOG_BYTES = 64;
+
+template<typename... Ts> class BLEClientWriteAction final : public Action<Ts...>, public BLEClientNode {
+ public:
+  BLEClientWriteAction(BLEClient *ble_client) {
+    ble_client->register_gatt_node(this);
+    ble_client_ = ble_client;
+  }
+
+  void set_service_uuid16(uint16_t uuid) { this->service_uuid_ = ble_device_base::ESPBTUUID::from_uint16(uuid); }
+  void set_service_uuid32(uint32_t uuid) { this->service_uuid_ = ble_device_base::ESPBTUUID::from_uint32(uuid); }
+  void set_service_uuid128(uint8_t *uuid) { this->service_uuid_ = ble_device_base::ESPBTUUID::from_raw(uuid); }
+
+  void set_char_uuid16(uint16_t uuid) { this->char_uuid_ = ble_device_base::ESPBTUUID::from_uint16(uuid); }
+  void set_char_uuid32(uint32_t uuid) { this->char_uuid_ = ble_device_base::ESPBTUUID::from_uint32(uuid); }
+  void set_char_uuid128(uint8_t *uuid) { this->char_uuid_ = ble_device_base::ESPBTUUID::from_raw(uuid); }
+
+  void set_value_template(std::vector<uint8_t> (*func)(Ts...)) {
+    this->value_.func = func;
+    this->len_ = -1;  // Sentinel value indicates template mode
+  }
+
+  // Store pointer to static data in flash (no RAM copy)
+  void set_value_simple(const uint8_t *data, size_t len) {
+    this->value_.data = data;
+    this->len_ = len;  // Length >= 0 indicates static mode
+  }
+
+  void play(const Ts &...x) override {}
+
+  void play_complex(const Ts &...x) override {
+    this->num_running_++;
+    this->var_ = std::make_tuple(x...);
+
+    bool result;
+    if (this->len_ >= 0) {
+      result = this->write(this->value_.data, this->len_);
+    } else {
+      std::vector<uint8_t> value = this->value_.func(x...);
+      result = this->write(value.data(), value.size());
+    }
+
+    // on write failure, continue the automation chain rather than stopping so
+    // that e.g. disconnect can work.
+    if (!result)
+      this->play_next_(x...);
+  }
+
+  // Initiate the write; the completion arrives in on_write_result. The
+  // response-less path can complete synchronously inside the call, so the
+  // handle is armed before the backend is touched.
+  bool write(const uint8_t *data, size_t len) {
+    if (!this->ble_client_->connected()) {
+      esph_log_w(BLE_WRITE_TAG, "Cannot write to BLE characteristic - not connected");
+      return false;
+    }
+    if (!this->resolved_) {
+      esph_log_w(BLE_WRITE_TAG, "Cannot write to BLE characteristic - characteristic was not resolved");
+      return false;
+    }
+#if ESPHOME_LOG_LEVEL >= ESPHOME_LOG_LEVEL_VERY_VERBOSE
+    char hex_buf[format_hex_pretty_size(BLE_WRITE_MAX_LOG_BYTES)];
+    esph_log_vv(BLE_WRITE_TAG, "Will write %d bytes: %s", len, format_hex_pretty_to(hex_buf, data, len));
+#endif
+    int err = this->ble_client_->write_characteristic(this->char_handle_, data, len, this->write_response_);
+    if (err != 0) {
+      esph_log_e(BLE_WRITE_TAG, "Error writing to characteristic: %d!", err);
+      return false;
+    }
+    return true;
+  }
+
+  void on_connected(const ble_device_base::GattServiceTable &table) override {
+    const auto *service = ble_device_base::find_service(table, this->service_uuid_);
+    const auto *chr =
+        service == nullptr ? nullptr : ble_device_base::find_characteristic(table, *service, this->char_uuid_);
+    if (chr == nullptr) {
+      char char_buf[ble_device_base::UUID_STR_LEN];
+      char service_buf[ble_device_base::UUID_STR_LEN];
+      esph_log_w(BLE_WRITE_TAG, "Characteristic %s was not found in service %s", this->char_uuid_.to_str(char_buf),
+                 this->service_uuid_.to_str(service_buf));
+      return;
+    }
+    if (chr->properties & ble_device_base::GATT_CHAR_PROP_WRITE) {
+      this->write_response_ = true;
+    } else if (chr->properties & ble_device_base::GATT_CHAR_PROP_WRITE_NO_RSP) {
+      this->write_response_ = false;
+    } else {
+      char char_buf[ble_device_base::UUID_STR_LEN];
+      esph_log_e(BLE_WRITE_TAG, "Characteristic %s does not allow writing", this->char_uuid_.to_str(char_buf));
+      return;
+    }
+    this->char_handle_ = chr->value_handle;
+    this->resolved_ = true;
+    char char_buf[ble_device_base::UUID_STR_LEN];
+    esph_log_d(BLE_WRITE_TAG, "Found characteristic %s on device %s", this->char_uuid_.to_str(char_buf),
+               this->ble_client_->address_str());
+  }
+
+  void on_disconnected() override {
+    this->resolved_ = false;
+    this->char_handle_ = 0;
+    if (this->num_running_ != 0)
+      this->stop_complex();
+  }
+
+  void on_write_result(uint16_t handle, int error) override {
+    if (this->num_running_ == 0) {
+      return;
+    }
+    if (!this->resolved_ || handle != this->char_handle_) {
+      // A parked chain waiting on a completion that never matches would
+      // otherwise stall silently until disconnect.
+      esph_log_d(BLE_WRITE_TAG, "Write result for handle 0x%04x ignored, waiting on 0x%04x", handle,
+                 this->char_handle_);
+      return;
+    }
+    if (error != 0) {
+      // Continue the chain (legacy parity) but leave a breadcrumb.
+      esph_log_w(BLE_WRITE_TAG, "Write completed with status %d", error);
+    }
+    this->ble_client_->run_later([this]() { this->play_next_tuple_(this->var_); });
+  }
+
+ private:
+  BLEClient *ble_client_;
+  ssize_t len_{-1};  // -1 = template mode, >=0 = static mode with length
+  union Value {
+    std::vector<uint8_t> (*func)(Ts...);  // Function pointer (stateless lambdas)
+    const uint8_t *data;                  // Pointer to static data in flash
+  } value_;
+  ble_device_base::ESPBTUUID service_uuid_;
+  ble_device_base::ESPBTUUID char_uuid_;
+  std::tuple<Ts...> var_{};
+  uint16_t char_handle_{};
+  bool write_response_{false};
+  bool resolved_{false};
+};
+
+}  // namespace esphome::ble_client
+
+#endif  // USE_BLE_CLIENT_GATT_NODES
@@ -0,0 +1,43 @@
+#pragma once
+
+#include "esphome/core/defines.h"
+
+#ifdef USE_BLE_GATT_CLIENT
+
+#include "esphome/core/hal.h"
+#include "esphome/core/log.h"
+
+#include <cstdint>
+
+namespace esphome::ble_client {
+
+/// Reconnect backoff after repeated connect/discovery failures, shared by
+/// both engines. 256 ms ticks in a uint16_t keep it 4 bytes; the ~4.7 h tick
+/// wrap can at worst reinstate one stale hold-off of a minute.
+class ConnectBackoff {
+ public:
+  bool holding_off() const {
+    return this->failures_ != 0 && static_cast<uint16_t>(now() - this->start_) < this->failures_ * STEP_TICKS;
+  }
+  void register_failure(const char *address_str) {
+    if (this->failures_ < MAX_STEPS)
+      this->failures_++;
+    this->start_ = now();
+    esph_log_w("ble_client", "[%s] Holding off reconnect for %u s", address_str, this->failures_ * 10u);
+  }
+  void reset() { this->failures_ = 0; }
+
+ private:
+  // ~10 s per consecutive failure, capped so a flapping peer retries within
+  // a minute at worst.
+  static constexpr uint16_t STEP_TICKS = 40;  // x 256 ms
+  static constexpr uint8_t MAX_STEPS = 6;
+  static uint16_t now() { return static_cast<uint16_t>(millis() >> 8); }
+
+  uint16_t start_{0};
+  uint8_t failures_{0};
+};
+
+}  // namespace esphome::ble_client
+
+#endif  // USE_BLE_GATT_CLIENT
@@ -206,36 +206,32 @@ def validate_scan_parameters(config: ConfigType) -> ConfigType:
    interval = config[CONF_INTERVAL]
    window = config[CONF_WINDOW]

-    # Labels are reused in every error below; the optional one names its key.
-    windows = [("Scan window", window)]
-    if (connection_window := config.get(CONF_CONNECTION_SCAN_WINDOW)) is not None:
-        windows.append((CONF_CONNECTION_SCAN_WINDOW, connection_window))
-
-    for name, value in windows:
-        if value > interval:
-            raise cv.Invalid(
-                f"{name} ({value}) needs to be smaller than scan interval ({interval})"
-            )
+    if window > interval:
+        raise cv.Invalid(
+            f"Scan window ({window}) needs to be smaller than scan interval ({interval})"
+        )

    # BLE scan interval/window are programmed in 0.625 ms units as a 16-bit value; the
    # controller only accepts 2.5 ms .. 10240 ms (0x0004 .. 0x4000). Reject out-of-range
    # values here instead of letting the unit conversion silently overflow.
-    for name, value in (("Scan interval", interval), *windows):
+    for name, value in (("interval", interval), ("window", window)):
        if value.total_microseconds < 2500 or value.total_microseconds > 10_240_000:
-            raise cv.Invalid(f"{name} ({value}) must be between 2.5 ms and 10240 ms")
+            raise cv.Invalid(
+                f"Scan {name} ({value}) must be between 2.5 ms and 10240 ms"
+            )

    # Validate what actually reaches the controller: both values are truncated to
    # whole 0.625 ms units, so a window/interval pair that differs by less than one
    # unit collapses to the same value — silently programming a 100 % duty cycle
    # (radio permanently on) from a config that asked for less.
    interval_units = to_ble_units(interval)
-    for name, value in windows:
-        if to_ble_units(value) == interval_units and value < interval:
-            raise cv.Invalid(
-                f"{name} ({value}) and interval ({interval}) both truncate to "
-                f"{interval_units} x 0.625 ms, which the controller scans at a 100 % duty "
-                f"cycle. Separate them by at least 0.625 ms."
-            )
+    window_units = to_ble_units(window)
+    if window_units == interval_units and window < interval:
+        raise cv.Invalid(
+            f"Scan window ({window}) and interval ({interval}) both truncate to "
+            f"{interval_units} x 0.625 ms, which the controller scans at a 100 % duty "
+            f"cycle. Separate them by at least 0.625 ms."
+        )

    if interval.total_microseconds * 3 > duration.total_microseconds:
        raise cv.Invalid(
@@ -251,14 +247,11 @@ def validate_scan_parameters(config: ConfigType) -> ConfigType:
 # their own; also the fallback for esp32's conditional default.
 DEFAULT_SCAN_WINDOW = "30ms"

-CONF_CONNECTION_SCAN_WINDOW = "connection_scan_window"
-

 def scan_parameters_schema(
    interval_default: str,
    *,
    window_default: str | Callable[[], TimePeriod] = DEFAULT_SCAN_WINDOW,
-    connection_window: bool = False,
 ) -> cv.All:
    """Build the scan_parameters value schema shared by all BLE trackers.

@@ -270,9 +263,7 @@ def scan_parameters_schema(
    can adjust it once sibling keys are resolved). The `active` option
    (default on) is unconditional: active scanning is part of the tracker
    contract — every current proxy client assumes it, so a passive-only
-    tracker must not share this schema. connection_window opts in to the
-    `connection_scan_window` option for trackers that can fall back to a
-    smaller window while a GATT connection is active.
+    tracker must not share this schema.
    """
    schema = {
        cv.Optional(CONF_DURATION, default="5min"): cv.positive_time_period_seconds,
@@ -281,8 +272,6 @@ def scan_parameters_schema(
        cv.Optional(CONF_CONTINUOUS, default=True): cv.boolean,
        cv.Optional(CONF_ACTIVE, default=True): cv.boolean,
    }
-    if connection_window:
-        schema[cv.Optional(CONF_CONNECTION_SCAN_WINDOW)] = cv.positive_time_period
    return cv.All(cv.Schema(schema), validate_scan_parameters)


@@ -0,0 +1,48 @@
+#include "ble_gatt_client.h"
+
+#ifdef USE_BLE_GATT_CLIENT
+
+#include "esphome/core/log.h"
+
+namespace esphome::ble_device_base {
+
+static const char *const TAG = "ble_gatt_client";
+
+const GattCharacteristic *find_characteristic(const GattServiceTable &table, const GattService &service,
+                                              const ESPBTUUID &uuid) {
+  // 32-bit range math: a corrupt first/count pair cannot wrap past the check.
+  uint32_t end = uint32_t(service.first_characteristic) + service.characteristic_count;
+  if (end > table.characteristic_count) {
+    ESP_LOGW(TAG, "characteristic range out of bounds");
+    return nullptr;
+  }
+  for (uint32_t i = service.first_characteristic; i < end; i++) {
+    if (table.characteristics[i].uuid == uuid)
+      return &table.characteristics[i];
+  }
+  return nullptr;
+}
+
+const GattDescriptor *find_descriptor(const GattServiceTable &table, const GattCharacteristic &characteristic,
+                                      const ESPBTUUID &uuid) {
+  uint32_t end = uint32_t(characteristic.first_descriptor) + characteristic.descriptor_count;
+  if (end > table.descriptor_count) {
+    // Corrupt range, not a missing descriptor.
+    ESP_LOGW(TAG, "descriptor range out of bounds");
+    return nullptr;
+  }
+  for (uint32_t i = characteristic.first_descriptor; i < end; i++) {
+    if (table.descriptors[i].uuid == uuid)
+      return &table.descriptors[i];
+  }
+  return nullptr;
+}
+
+uint16_t find_cccd(const GattServiceTable &table, const GattCharacteristic &characteristic) {
+  const GattDescriptor *desc = find_descriptor(table, characteristic, ESPBTUUID::from_uint16(CCCD_UUID));
+  return desc != nullptr ? desc->handle : 0;
+}
+
+}  // namespace esphome::ble_device_base
+
+#endif  // USE_BLE_GATT_CLIENT
@@ -11,13 +11,16 @@
 // interface. All listener calls are delivered on the ESPHome main loop;
 // borrowed data pointers are valid only for the duration of the call.
 //
-// Error domain (plain int, forwarded to the API without translation):
+// Error domain (plain int, forwarded to the API without translation, so the
+// values are wire-frozen - API clients interpret them):
 //   0            success
-//   1..0x11      ATT error codes (Bluetooth spec; BTstack and Bluedroid agree)
+//   1..0x11      ATT error codes (Bluetooth spec) - reserved; a backend whose
+//                native error codes land in this window must remap them out
 //   GATT_ERR_NOT_CONNECTED (-1)  no connection to the peer (on esp32 a raw
 //                ESP_FAIL from the stack shares this value; both read as a
 //                failed, unusable connection on the client side)
 //   GATT_ERR_NO_MEMORY (-2)      backend storage exhausted
+//   -1..-15      reserved for future contract sentinels
 //   anything else: platform stack error/status code, surfaced opaquely.
 // Connection events carry HCI status/disconnect reason codes (same code
 // space on every controller).
@@ -99,9 +102,18 @@ class GattClientListener {
 // The BLEGattConnection op surface, asserted where the alias binds
 // (bluetooth_connection_gatt_backend.h). Operations return 0 when accepted (completion arrives
 // through the listener) or a synchronous error (busy, not connected, stack
-// rejection); one operation may be outstanding at a time. Semantics beyond
-// the signatures:
+// rejection); one operation may be outstanding at a time. An accepted
+// operation's completion is delivered from the event loop, NEVER
+// synchronously from inside the op call - a synchronous terminal
+// on_connection_state from within gatt_disconnect() would re-enter the
+// consumer mid-teardown. Semantics beyond the signatures:
 // - connect: addr_type is a BLE_ADDR_TYPE_* constant (ble_device.h).
+//   Returning 0 means the request is accepted, not that the radio acted: the
+//   backend owns integration with its platform's scan/connect arbitration
+//   (Bluedroid parks the request for the tracker's promote loop, which owns
+//   scan-stop/coex/one-connect-at-a-time; the rp2 backend opens immediately
+//   and relies on sighting-gated consumers). Consumers must not assume
+//   connect timing.
 // - gatt_disconnect: also cancels a connect in progress (named to coexist
 //   with a platform stack's own void disconnect() on one backend class).
 //   Nonzero means nothing to tear down and no completion will follow; an
@@ -143,6 +155,41 @@ concept BLEGattConnectionContract = requires(T conn, GattClientListener *listene
  { conn.set_connection_type(ConnectionType{}) } -> std::same_as<void>;
 };

+// ---- service table lookup helpers ----
+//
+// Neutral, bounds-checked walks over a materialized GattServiceTable for
+// direct consumers that resolve a known device's handles by UUID (streaming
+// consumers forward the raw database and never need these). Linear search:
+// the table exists only between discovery and release_services(), for one
+// small known device.
+
+/// Client Characteristic Configuration descriptor UUID (Bluetooth spec).
+static constexpr uint16_t CCCD_UUID = 0x2902;
+
+// Characteristic property bits (the Bluetooth-spec declaration byte carried
+// in GattCharacteristic::properties; the ESP-IDF macros for these do not
+// exist on the other platforms).
+static constexpr uint8_t GATT_CHAR_PROP_WRITE_NO_RSP = 0x04;
+static constexpr uint8_t GATT_CHAR_PROP_WRITE = 0x08;
+
+inline const GattService *find_service(const GattServiceTable &table, const ESPBTUUID &uuid) {
+  for (uint16_t i = 0; i < table.service_count; i++) {
+    if (table.services[i].uuid == uuid)
+      return &table.services[i];
+  }
+  return nullptr;
+}
+
+const GattCharacteristic *find_characteristic(const GattServiceTable &table, const GattService &service,
+                                              const ESPBTUUID &uuid);
+
+const GattDescriptor *find_descriptor(const GattServiceTable &table, const GattCharacteristic &characteristic,
+                                      const ESPBTUUID &uuid);
+
+/// Handle of the characteristic's Client Characteristic Configuration
+/// descriptor (0x2902), or 0 when it has none.
+uint16_t find_cccd(const GattServiceTable &table, const GattCharacteristic &characteristic);
+
 }  // namespace esphome::ble_device_base

 #endif  // USE_BLE_GATT_CLIENT
@@ -1,12 +1,14 @@
 """Per-platform GATT connection backends and the helpers to embed one.

-Backends: esp32 Bluedroid, rp2 BTstack. No user-facing configuration; the
-Bluetooth proxy's codegen declares and registers the backend instances
-through gatt_client_schema()/hub_connection_schema() + new_gatt_backend().
+Backends: esp32 Bluedroid, rp2 BTstack. No user-facing configuration; a
+consumer's codegen declares and registers the backend instances — the
+Bluetooth proxy through its per-slot connection wrappers (a streaming
+consumer), and the neutral ble_client through gatt_client_schema() +
+new_gatt_backend().
 """

 from collections.abc import Awaitable, Callable
-from dataclasses import dataclass
+from dataclasses import dataclass, field

 import esphome.codegen as cg
 from esphome.components import rp2040_ble
@@ -23,7 +25,8 @@ from esphome.types import ConfigType
 def AUTO_LOAD() -> list[str]:
    """ble_device_base plus the platform BLE stack the build's backend
    registers with (the Bluedroid header includes the tracker's), so
-    consumers need not know. The platform-less arm serves manifest tooling."""
+    consumers stay platform-blind. The platform-less arm serves tooling that
+    resolves the manifest without a target."""
    if CORE.is_esp32:
        return ["ble_device_base", "esp32_ble_tracker"]
    if CORE.is_rp2:
@@ -63,6 +66,8 @@ DOMAIN = "bluetooth_connection"
@dataclass
 class _ConnectionData:
    rp2_backend_count: int = 0
+    # GATT connection slots claimed this run, for the platform cap check.
+    slot_consumers: list[str] = field(default_factory=list)


 def _get_data() -> _ConnectionData:
@@ -119,6 +124,10 @@ class _PlatformBackend:
    backend_class: cg.MockObjClass
    schema_fragment: Callable[[], cv.Schema]
    register: Callable[[cg.MockObj, ConfigType], Awaitable[None]]
+    # Selects the backend's alias-ladder arm (order-independent arms).
+    define: str
+    # The backend's on-demand materializer gate, when it has one.
+    materializer_define: str | None = None


 # The single registry of platforms with a GATT client backend; a platform
@@ -126,11 +135,20 @@ class _PlatformBackend:
 # platform's arm.
 _PLATFORM_BACKENDS: dict[str, _PlatformBackend] = {
    PLATFORM_ESP32: _PlatformBackend(
-        BluedroidGattClient, _esp32_schema_fragment, _esp32_register
+        BluedroidGattClient,
+        _esp32_schema_fragment,
+        _esp32_register,
+        "USE_BLE_GATT_BACKEND_BLUEDROID",
+        materializer_define="USE_BLUEDROID_GATT_SERVICE_TABLE",
+    ),
+    PLATFORM_RP2: _PlatformBackend(
+        RP2GattClient, _rp2_schema_fragment, _rp2_register, "USE_BLE_GATT_BACKEND_RP2"
    ),
-    PLATFORM_RP2: _PlatformBackend(RP2GattClient, _rp2_schema_fragment, _rp2_register),
 }

+# Gates dedicated-backend consumers (cv.only_on).
+GATT_CLIENT_PLATFORMS = list(_PLATFORM_BACKENDS)
+

 def _backend_entry(platform: str | None = None) -> _PlatformBackend:
    key = platform if platform is not None else CORE.target_platform
@@ -165,21 +183,89 @@ def hub_connection_schema(platform: str | None = None) -> cv.Schema:
    )


-async def new_gatt_backend(config: ConfigType) -> cg.MockObj:
+def consume_gatt_slot(
+    consumer: str, count: int = 1
+) -> Callable[[ConfigType], ConfigType]:
+    """Validator claiming GATT connection slots - the one spelling for every
+    claimant. Platforms whose BLE stack owns a connection budget (esp32, rp2)
+    are charged there and their stack's final validation reports an
+    overcommit; the neutral ledger covers any future backend platform without
+    one (the cap check in FINAL_VALIDATE_SCHEMA)."""
+
+    def validator(config: ConfigType) -> ConfigType:
+        _get_data().slot_consumers.extend([consumer] * count)
+        if CORE.is_esp32:
+            from esphome.components import esp32_ble
+
+            esp32_ble.consume_connection_slots(count, consumer)(config)
+        elif CORE.target_platform == PLATFORM_RP2:
+            rp2040_ble.consume_connection_slots(count, consumer)(config)
+        return config
+
+    return validator
+
+
+# Platforms whose BLE stack owns its own connection budget: consume_gatt_slot
+# charges it there, and the stack's final validation is the one place an
+# overcommit is reported (never two messages for one misconfiguration).
+_STACK_BUDGET_PLATFORMS = {PLATFORM_ESP32, PLATFORM_RP2}
+
+
+def _validate_slot_totals(config: ConfigType) -> ConfigType:
+    # Skipped in testing mode so grouped component builds can co-exist
+    # (mirrors esp32_ble.validate_connection_slots).
+    if CORE.testing_mode:
+        return config
+    if CORE.target_platform in _STACK_BUDGET_PLATFORMS:
+        return config
+    if (cap := HUB_MAX_CONNECTIONS.get(CORE.target_platform)) is None:
+        # Any backend platform without a stack budget must carry a cap here
+        # or fail loudly, never fail open.
+        if CORE.target_platform in _PLATFORM_BACKENDS:
+            raise cv.Invalid(
+                f"{CORE.target_platform} has a GATT backend but no slot cap "
+                "in HUB_MAX_CONNECTIONS"
+            )
+        return config
+    claimed = _get_data().slot_consumers
+    if len(claimed) > cap:
+        raise cv.Invalid(
+            f"{CORE.target_platform} supports at most {cap} GATT client "
+            f"connection(s); {len(claimed)} requested by: {', '.join(claimed)}"
+        )
+    return config
+
+
+FINAL_VALIDATE_SCHEMA = _validate_slot_totals
+
+
+async def new_gatt_backend(
+    config: ConfigType, *, service_table: bool = True
+) -> cg.MockObj:
    """Instantiate the backend declared by gatt_client_schema() and register
    it with its platform stack. The connection slot is claimed at validation
-    (the proxy's slot validators), not here.
+    (the consume_gatt_slot validators), not here.
+
+    service_table is honored by the Bluedroid backend only: forward
+    scaffolding for the first esp32 direct consumer, load-bearing on no
+    current build (rp2 ignores the define and always materializes - its
+    proxy hub streams through get_service_table(), so it must keep the
+    materializer regardless of the flag).
    """
    from esphome.components import ble_device_base

+    entry = _backend_entry()
    ble_device_base.request_gatt_client()
+    cg.add_define(entry.define)
+    if service_table and entry.materializer_define is not None:
+        cg.add_define(entry.materializer_define)
    backend = cg.new_Pvariable(config[CONF_BACKEND_ID])
    # The backend is the slot's real Component: component keys from the
    # connection entry (setup_priority, ...) apply to it. Consumers whose own
    # schema carries keys that register_component would misapply to the
    # backend (e.g. a polling interval) must not put them in this config.
    await cg.register_component(backend, config)
-    await _backend_entry().register(backend, config)
+    await entry.register(backend, config)
    return backend


@@ -187,6 +273,7 @@ async def new_gatt_backend(config: ConfigType) -> cg.MockObj:
 # list (this module cannot import bluetooth_proxy to derive it).
 SOURCE_FILE_FRAMEWORKS: dict[str, set[PlatformFramework]] = {
    "bluetooth_connection_bluedroid.cpp": frameworks_for_platforms([PLATFORM_ESP32]),
+    "gatt_service_table_bluedroid.cpp": frameworks_for_platforms([PLATFORM_ESP32]),
    # Every hub platform the proxy admits (the file compiles empty where
    # USE_BLE_GATT_CLIENT is not defined), so a platform gaining a backend
    # cannot hit a missing-symbol trap here.
@@ -46,7 +46,7 @@ BatchClose close_service_batch(api::BluetoothGATTGetServicesResponse &resp, size

 #endif  // USE_BLUETOOTH_PROXY_CONNECTIONS

-#if defined(USE_ESP32) && defined(USE_BLE_GATT_CLIENT)
+#if defined(USE_ESP32_BLE) && defined(USE_BLE_GATT_CLIENT)
 namespace esphome::bluetooth_connection {

 // Address-scoped Bluedroid maintenance. Gated with the connection surface:
@@ -65,4 +65,4 @@ conn_err_t clear_gatt_cache(uint64_t address) {
 }

 }  // namespace esphome::bluetooth_connection
-#endif  // USE_ESP32 && USE_BLE_GATT_CLIENT
+#endif  // USE_ESP32_BLE && USE_BLE_GATT_CLIENT
@@ -48,15 +48,16 @@ static constexpr conn_err_t CONN_OK = 0;
 // GATT contract so backend and wrapper cannot drift.
 static constexpr conn_err_t GATT_NOT_CONNECTED = ble_device_base::GATT_ERR_NOT_CONNECTED;

-// What the platform's connection backend supports beyond GATT operations;
-// the proxy derives its feature flags and legacy version from these.
-#if defined(USE_ESP32)
+// What the build's connection backend supports beyond GATT operations; the
+// proxy derives its feature flags and legacy version from these. Keyed on
+// the backend define, never the platform, so a second backend on one
+// platform carries its own facts.
+#if defined(USE_BLE_GATT_BACKEND_BLUEDROID)
 static constexpr bool SUPPORTS_PAIRING = true;
 static constexpr bool SUPPORTS_CACHE_CLEARING = true;
-#elif defined(USE_RP2040_BLE) && defined(USE_BLE_GATT_CLIENT)
+#elif defined(USE_BLE_GATT_BACKEND_RP2)
 // The rp2 BTstack backend pairs (just works + bonding); it has no service
-// cache to clear. Keyed on the backend, not the generic client define, so a
-// future backend without pairing keeps the stub arm below.
+// cache to clear.
 static constexpr bool SUPPORTS_PAIRING = true;
 static constexpr bool SUPPORTS_CACHE_CLEARING = false;
 #else
@@ -64,13 +65,14 @@ static constexpr bool SUPPORTS_PAIRING = false;
 static constexpr bool SUPPORTS_CACHE_CLEARING = false;
 #endif

-// Address-scoped (not connection-scoped) maintenance requests.
-#if (defined(USE_ESP32) || defined(USE_RP2040_BLE)) && defined(USE_BLE_GATT_CLIENT)
+// Address-scoped (not connection-scoped) maintenance requests; keyed on the
+// stack (the calls need no backend instance).
+#if (defined(USE_ESP32_BLE) || defined(USE_RP2040_BLE)) && defined(USE_BLE_GATT_CLIENT)
 conn_err_t unpair_device(uint64_t address);
 #else
 inline conn_err_t unpair_device(uint64_t) { return GATT_NOT_CONNECTED; }
 #endif
-#if defined(USE_ESP32) && defined(USE_BLE_GATT_CLIENT)
+#if defined(USE_ESP32_BLE) && defined(USE_BLE_GATT_CLIENT)
 conn_err_t clear_gatt_cache(uint64_t address);
 #else
 inline conn_err_t clear_gatt_cache(uint64_t) { return GATT_NOT_CONNECTED; }
@@ -2,10 +2,11 @@

 #if defined(USE_ESP32_BLE) && defined(USE_BLE_GATT_CLIENT)

+#include "bluetooth_connection.h"
+
 // The in-place streamer serves the proxy's service-discovery API; backend-only
 // builds compile without the proxy headers or the streamer.
 #ifdef USE_BLUETOOTH_PROXY_CONNECTIONS
-#include "bluetooth_connection.h"
 #include "bluetooth_connection_hub.h"

 #include "esphome/components/bluetooth_proxy/bluetooth_proxy.h"
@@ -300,6 +301,9 @@ int BluedroidGattClient::update_connection_params(uint16_t min_interval, uint16_

 void BluedroidGattClient::release_services() {
  this->service_total_ = 0;
+#ifdef USE_BLUEDROID_GATT_SERVICE_TABLE
+  this->table_.free();
+#endif
  // Always set: terminates any in-flight stream on every cache config.
  this->services_released_ = true;
 #ifndef CONFIG_BT_GATTC_CACHE_NVS_FLASH
@@ -312,6 +316,24 @@ void BluedroidGattClient::release_services() {
 #endif
 }

+#ifdef USE_BLUEDROID_GATT_SERVICE_TABLE
+ble_device_base::GattServiceTable BluedroidGattClient::get_service_table() {
+  // Lifetime: every teardown path (CLOSE_EVT, the safety timeout, stack-down,
+  // passive DISCONNECT) routes through release_services(), so a materialized
+  // table cannot outlive its link.
+  if (this->table_.empty() &&
+      (this->services_released_ || this->service_total_ == 0 ||
+       !this->table_.build(this->gattc_if_, this->conn_id_, this->service_total_, this->connection_index_))) {
+    // Released / no services / failed build all collapse to empty; the
+    // build failures warned above, log the quiet two.
+    ESP_LOGD(TAG, "[%d] No service table (released=%d, services=%u)", this->connection_index_, this->services_released_,
+             this->service_total_);
+    return {};
+  }
+  return this->table_.view();
+}
+#endif  // USE_BLUEDROID_GATT_SERVICE_TABLE
+
 // ---- internals ----

 bool BluedroidGattClient::check_addr_(const esp_bd_addr_t &addr) const {
@@ -358,6 +380,11 @@ void BluedroidGattClient::log_gattc_warning_(const char *operation, int code) {
 // ---- service streaming ----

 int BluedroidGattClient::handle_search_cmpl_(esp_gatt_status_t status) {
+#ifdef USE_BLUEDROID_GATT_SERVICE_TABLE
+  // Re-discovery moves the counts the table view derives offsets from; free
+  // the stale table.
+  this->table_.free();
+#endif
  // Step down from the fast discovery params.
  this->update_conn_params_(MEDIUM_MIN_CONN_INTERVAL, MEDIUM_MAX_CONN_INTERVAL, 0, MEDIUM_CONN_TIMEOUT, "medium");
  if (status != ESP_GATT_OK) {
@@ -11,6 +11,9 @@

 #if defined(USE_ESP32_BLE) && defined(USE_BLE_GATT_CLIENT)

+#include "bluetooth_connection.h"
+#include "gatt_service_table_bluedroid.h"
+
 #include "esphome/components/ble_device_base/ble_gatt_client.h"
 #include "esphome/components/esp32_ble_tracker/esp32_ble_tracker.h"
 #include "esphome/core/component.h"
@@ -72,11 +75,16 @@ class BluedroidGattClient final : public esp32_ble_tracker::ESPBTClient, public
  int notify_characteristic(uint16_t handle, bool enable);
  int pair();
  int update_connection_params(uint16_t min_interval, uint16_t max_interval, uint16_t latency, uint16_t timeout);
-  // Contract stub: the proxy streams in place; the on-demand materializer
-  // for direct consumers lands with #18205. NOTE: a direct consumer reaching
-  // this stub gets an empty table indistinguishable from a service-less
-  // peer - do not ship one against this backend before the materializer.
+  // On-demand table for direct consumers; the proxy streams instead, so the
+  // materializer compiles only under USE_BLUEDROID_GATT_SERVICE_TABLE (emitted by
+  // direct-consumer codegen, never by the proxy).
+#ifdef USE_BLUEDROID_GATT_SERVICE_TABLE
+  ble_device_base::GattServiceTable get_service_table();
+#else
+  // A direct consumer reaching this stub misconfigured its codegen
+  // (service_table=False): the empty table reads as a service-less peer.
  ble_device_base::GattServiceTable get_service_table() { return {}; }
+#endif
  void release_services();

 #ifdef USE_BLUETOOTH_PROXY_CONNECTIONS
@@ -105,6 +113,9 @@ class BluedroidGattClient final : public esp32_ble_tracker::ESPBTClient, public

  // Group 1: pointers / composed objects
  ble_device_base::GattClientListener *listener_{nullptr};
+#ifdef USE_BLUEDROID_GATT_SERVICE_TABLE
+  BluedroidServiceTable table_;
+#endif
  // Group 2: 4-byte types
  uint32_t disconnecting_started_{0};

@@ -12,10 +12,12 @@

 #include "esphome/components/ble_device_base/ble_gatt_client.h"

-#if defined(USE_RP2040_BLE)
+// Arms are keyed on codegen-emitted per-backend defines (_PLATFORM_BACKENDS
+// in __init__.py), so they are order-independent.
+#if defined(USE_BLE_GATT_BACKEND_RP2)
 #include "bluetooth_connection_rp2.h"
 #define ESPHOME_BLE_GATT_CONNECTION_TYPE bluetooth_connection::RP2GattClient
-#elif defined(USE_ESP32_BLE)
+#elif defined(USE_BLE_GATT_BACKEND_BLUEDROID)
 #include "bluetooth_connection_bluedroid.h"
 #define ESPHOME_BLE_GATT_CONNECTION_TYPE bluetooth_connection::BluedroidGattClient
 #elif defined(USE_BLE_GATT_CLIENT_STUB_BACKEND)
@@ -0,0 +1,198 @@
+#include "gatt_service_table_bluedroid.h"
+
+#if defined(USE_ESP32_BLE) && defined(USE_BLE_GATT_CLIENT) && defined(USE_BLUEDROID_GATT_SERVICE_TABLE)
+
+#include "esphome/core/log.h"
+
+namespace esphome::bluetooth_connection {
+
+static const char *const TAG = "gatt_service_table";
+
+// A stack that never reports end-of-range would otherwise walk forever.
+static constexpr uint16_t MAX_DESCRIPTORS_PER_CHARACTERISTIC = 64;
+
+// Shared enumeration for both build passes: an identical walk order is what
+// lets the counting pass size the block the filling pass fills.
+// INVALID_OFFSET/NOT_FOUND mean end-of-range; anything else is a failure.
+template<typename ServiceFn, typename CharFn, typename DescFn>
+bool BluedroidServiceTable::walk_(ServiceFn &&on_service, CharFn &&on_char, DescFn &&on_desc) {
+  for (uint16_t s = 0; s < this->service_total_; s++) {
+    esp_gattc_service_elem_t svc;
+    uint16_t svc_count = 1;
+    auto svc_status = esp_ble_gattc_get_service(this->gattc_if_, this->conn_id_, nullptr, &svc, &svc_count, s);
+    if (svc_status != ESP_GATT_OK || svc_count == 0) {
+      this->log_walk_warning_("esp_ble_gattc_get_service", svc_status);
+      return false;
+    }
+    if (!on_service(s, svc)) {
+      return false;
+    }
+    uint16_t svc_chars = 0;
+    auto count_status = esp_ble_gattc_get_attr_count(this->gattc_if_, this->conn_id_, ESP_GATT_DB_CHARACTERISTIC,
+                                                     svc.start_handle, svc.end_handle, 0, &svc_chars);
+    if (count_status != ESP_GATT_OK) {
+      this->log_walk_warning_("esp_ble_gattc_get_attr_count", count_status);
+      return false;
+    }
+    for (uint16_t c = 0; c < svc_chars; c++) {
+      esp_gattc_char_elem_t chr;
+      uint16_t char_count = 1;
+      auto status = esp_ble_gattc_get_all_char(this->gattc_if_, this->conn_id_, svc.start_handle, svc.end_handle, &chr,
+                                               &char_count, c);
+      if (status != ESP_GATT_OK || char_count == 0) {
+        // An early terminator contradicts svc_chars from the same cache;
+        // never build a silently truncated table.
+        this->log_walk_warning_("esp_ble_gattc_get_all_char", status);
+        return false;
+      }
+      if (!on_char(svc, chr)) {
+        return false;
+      }
+      for (uint16_t d = 0;; d++) {
+        if (d == MAX_DESCRIPTORS_PER_CHARACTERISTIC) {
+          // A stack that never reports end-of-range; fail like every other
+          // inconsistency instead of truncating the table silently.
+          ESP_LOGW(TAG, "[%d] Descriptor walk exceeded %u entries", this->log_index_,
+                   MAX_DESCRIPTORS_PER_CHARACTERISTIC);
+          return false;
+        }
+        esp_gattc_descr_elem_t desc;
+        uint16_t desc_count = 1;
+        auto desc_status =
+            esp_ble_gattc_get_all_descr(this->gattc_if_, this->conn_id_, chr.char_handle, &desc, &desc_count, d);
+        if (desc_status == ESP_GATT_INVALID_OFFSET || desc_status == ESP_GATT_NOT_FOUND) {
+          break;
+        }
+        if (desc_status != ESP_GATT_OK || desc_count == 0) {
+          this->log_walk_warning_("esp_ble_gattc_get_all_descr", desc_status);
+          return false;
+        }
+        if (!on_desc(chr, desc)) {
+          return false;
+        }
+      }
+    }
+  }
+  return true;
+}
+
+bool BluedroidServiceTable::count_services(esp_gatt_if_t gattc_if, uint16_t conn_id, uint16_t *total) {
+  uint16_t primary = 0;
+  uint16_t secondary = 0;
+  if (esp_ble_gattc_get_attr_count(gattc_if, conn_id, ESP_GATT_DB_PRIMARY_SERVICE, 0x0001, 0xFFFF, 0, &primary) !=
+          ESP_GATT_OK ||
+      esp_ble_gattc_get_attr_count(gattc_if, conn_id, ESP_GATT_DB_SECONDARY_SERVICE, 0x0001, 0xFFFF, 0, &secondary) !=
+          ESP_GATT_OK) {
+    // A failed count must not read as an authoritative empty database.
+    return false;
+  }
+  *total = primary + secondary;
+  return true;
+}
+
+bool BluedroidServiceTable::build(esp_gatt_if_t gattc_if, uint16_t conn_id, uint16_t service_total, uint8_t log_index) {
+  this->free();
+  this->gattc_if_ = gattc_if;
+  this->conn_id_ = conn_id;
+  this->service_total_ = service_total;
+  this->log_index_ = log_index;
+
+  // Pass 1: count, so one exact-size block holds the whole table.
+  uint16_t char_total = 0;
+  uint16_t desc_total = 0;
+  bool counted = this->walk_([](uint16_t, const esp_gattc_service_elem_t &) { return true; },
+                             [&](const esp_gattc_service_elem_t &, const esp_gattc_char_elem_t &) {
+                               char_total++;
+                               return true;
+                             },
+                             [&](const esp_gattc_char_elem_t &, const esp_gattc_descr_elem_t &) {
+                               desc_total++;
+                               return true;
+                             });
+  if (!counted) {
+    ESP_LOGW(TAG, "[%d] Service table walk failed during count", this->log_index_);
+    this->free();
+    return false;
+  }
+
+  // The arrays share one block; carving stays aligned because each struct's
+  // strictest member is the UUID and array sizes are multiples of it.
+  static_assert(alignof(ble_device_base::GattService) >= alignof(ble_device_base::GattCharacteristic) &&
+                alignof(ble_device_base::GattCharacteristic) >= alignof(ble_device_base::GattDescriptor));
+  size_t svc_bytes = this->service_total_ * sizeof(ble_device_base::GattService);
+  size_t char_bytes = char_total * sizeof(ble_device_base::GattCharacteristic);
+  size_t total_bytes = svc_bytes + char_bytes + desc_total * sizeof(ble_device_base::GattDescriptor);
+  RAMAllocator<uint8_t> allocator(RAMAllocator<uint8_t>::ALLOC_INTERNAL);
+  this->storage_ = allocator.allocate(total_bytes);
+  if (this->storage_ == nullptr) {
+    ESP_LOGW(TAG, "[%d] Service table allocation failed (%u bytes)", this->log_index_,
+             static_cast<unsigned>(total_bytes));
+    this->free();
+    return false;
+  }
+  auto *services = reinterpret_cast<ble_device_base::GattService *>(this->storage_);
+  auto *characteristics = reinterpret_cast<ble_device_base::GattCharacteristic *>(this->storage_ + svc_bytes);
+  auto *descriptors = reinterpret_cast<ble_device_base::GattDescriptor *>(this->storage_ + svc_bytes + char_bytes);
+
+  // Pass 2: fill, bounded by the pass-1 totals. A bound trip or a shortfall
+  // means the cached database changed between the passes; fail the build
+  // rather than serve an inconsistent table (the consumer retries).
+  uint16_t char_index = 0;
+  uint16_t desc_index = 0;
+  ble_device_base::GattService *cur_service = nullptr;
+  ble_device_base::GattCharacteristic *cur_char = nullptr;
+  bool filled = this->walk_(
+      [&](uint16_t s, const esp_gattc_service_elem_t &svc) {
+        cur_service = &services[s];
+        cur_service->uuid = ble_device_base::ESPBTUUID::from_uuid(svc.uuid);
+        cur_service->start_handle = svc.start_handle;
+        cur_service->end_handle = svc.end_handle;
+        cur_service->first_characteristic = char_index;
+        cur_service->characteristic_count = 0;
+        return true;
+      },
+      [&](const esp_gattc_service_elem_t &svc, const esp_gattc_char_elem_t &chr) {
+        if (char_index >= char_total) {
+          return false;
+        }
+        cur_char = &characteristics[char_index++];
+        cur_char->uuid = ble_device_base::ESPBTUUID::from_uuid(chr.uuid);
+        cur_char->value_handle = chr.char_handle;
+        // Bluedroid addresses descriptors by characteristic handle, so the
+        // table's end_handle only needs the service-bounded upper bound.
+        cur_char->end_handle = svc.end_handle;
+        cur_char->properties = chr.properties;
+        cur_char->first_descriptor = desc_index;
+        cur_char->descriptor_count = 0;
+        cur_service->characteristic_count++;
+        return true;
+      },
+      [&](const esp_gattc_char_elem_t &, const esp_gattc_descr_elem_t &desc) {
+        if (desc_index >= desc_total) {
+          return false;
+        }
+        descriptors[desc_index].uuid = ble_device_base::ESPBTUUID::from_uuid(desc.uuid);
+        descriptors[desc_index].handle = desc.handle;
+        desc_index++;
+        cur_char->descriptor_count++;
+        return true;
+      });
+  if (!filled || char_index != char_total || desc_index != desc_total) {
+    // Walk error or the database changed between passes; better an empty
+    // table than a corrupt one.
+    ESP_LOGW(TAG, "[%d] Service table walk mismatch, discarding", this->log_index_);
+    this->free();
+    return false;
+  }
+  this->char_total_ = char_total;
+  this->desc_total_ = desc_total;
+  return true;
+}
+
+void BluedroidServiceTable::log_walk_warning_(const char *operation, int code) {
+  ESP_LOGW(TAG, "[%d] %s failed, status=%d", this->log_index_, operation, code);
+}
+
+}  // namespace esphome::bluetooth_connection
+
+#endif  // USE_ESP32_BLE && USE_BLE_GATT_CLIENT && USE_BLUEDROID_GATT_SERVICE_TABLE
@@ -0,0 +1,80 @@
+// Owning two-pass materializer of one Bluedroid GATT database snapshot into
+// the neutral GattServiceTable layout, shared by the BluedroidGattClient
+// backend and ble_client's esp32 engine.
+
+#pragma once
+
+#include "esphome/core/defines.h"
+
+#if defined(USE_ESP32_BLE) && defined(USE_BLE_GATT_CLIENT) && defined(USE_BLUEDROID_GATT_SERVICE_TABLE)
+
+#include "esphome/components/ble_device_base/ble_gatt_client.h"
+#include "esphome/core/helpers.h"
+
+#include <esp_gattc_api.h>
+
+namespace esphome::bluetooth_connection {
+
+class BluedroidServiceTable {
+ public:
+  ~BluedroidServiceTable() { this->free(); }
+  // Owns storage_; a copy would double-free.
+  BluedroidServiceTable() = default;
+  BluedroidServiceTable(const BluedroidServiceTable &) = delete;
+  BluedroidServiceTable &operator=(const BluedroidServiceTable &) = delete;
+
+  /// The service count build() requires: the stack's PRIMARY+SECONDARY
+  /// attribute totals, never the SEARCH_RES event count.
+  static bool count_services(esp_gatt_if_t gattc_if, uint16_t conn_id, uint16_t *total);
+
+  /// Two-pass build from the stack's cached database (service_total from
+  /// count_services()). log_index labels warnings. Frees any previous table
+  /// first; on failure the table is left empty.
+  bool build(esp_gatt_if_t gattc_if, uint16_t conn_id, uint16_t service_total, uint8_t log_index);
+
+  // The view is carved from the storage block and the counts on each call
+  // (a cold path) rather than cached, saving a per-instance table member.
+  ble_device_base::GattServiceTable view() const {
+    size_t svc_bytes = this->service_total_ * sizeof(ble_device_base::GattService);
+    size_t char_bytes = this->char_total_ * sizeof(ble_device_base::GattCharacteristic);
+    return {reinterpret_cast<const ble_device_base::GattService *>(this->storage_),
+            reinterpret_cast<const ble_device_base::GattCharacteristic *>(this->storage_ + svc_bytes),
+            reinterpret_cast<const ble_device_base::GattDescriptor *>(this->storage_ + svc_bytes + char_bytes),
+            this->service_total_,
+            this->char_total_,
+            this->desc_total_};
+  }
+
+  // Always resets the counts: a failed build must never leave a non-zero
+  // service_total_ behind a null table.
+  void free() {
+    if (this->storage_ != nullptr) {
+      RAMAllocator<uint8_t> allocator(RAMAllocator<uint8_t>::ALLOC_INTERNAL);
+      allocator.deallocate(this->storage_, 0);
+      this->storage_ = nullptr;
+    }
+    this->service_total_ = 0;
+    this->char_total_ = 0;
+    this->desc_total_ = 0;
+  }
+
+  bool empty() const { return this->storage_ == nullptr; }
+
+ private:
+  template<typename ServiceFn, typename CharFn, typename DescFn>
+  bool walk_(ServiceFn &&on_service, CharFn &&on_char, DescFn &&on_desc);
+  void log_walk_warning_(const char *operation, int code);
+
+  uint8_t *storage_{nullptr};
+  uint16_t service_total_{0};
+  uint16_t char_total_{0};
+  uint16_t desc_total_{0};
+  // Walk context, set by build().
+  uint16_t conn_id_{0};
+  esp_gatt_if_t gattc_if_{};  // uint8_t width
+  uint8_t log_index_{0};
+};
+
+}  // namespace esphome::bluetooth_connection
+
+#endif  // USE_ESP32_BLE && USE_BLE_GATT_CLIENT && USE_BLUEDROID_GATT_SERVICE_TABLE
@@ -98,9 +98,15 @@ def _esp32_config_schema() -> cv.All:
                raise cv.Invalid(
                    "Connections can only be used if the proxy is set to active"
                )
+            # Explicit entries claim slots like the generated ones; dev
+            # historically skipped this, letting an explicit-connections
+            # config evade the controller budget.
+            bluetooth_connection.consume_gatt_slot(
+                "bluetooth_proxy", len(config[CONF_CONNECTIONS])
+            )(config)
        elif config[CONF_ACTIVE]:
            connection_slots: int = config[CONF_CONNECTION_SLOTS]
-            esp32_ble.consume_connection_slots(connection_slots, "bluetooth_proxy")(
+            bluetooth_connection.consume_gatt_slot("bluetooth_proxy", connection_slots)(
                config
            )

@@ -157,14 +163,14 @@ def _rp2_config_schema() -> cv.All:
    connection_schema = bluetooth_connection.hub_connection_schema(PLATFORM_RP2)

    def populate_connections(config: ConfigType) -> ConfigType:
-        from esphome.components import rp2040_ble
-
        # One wrapper + backend pair per slot, declared during validation so
        # their ids exist for codegen (the esp32 arm's `connections` pattern).
        if not config[CONF_ACTIVE]:
            return config
        connection_slots: int = config[CONF_CONNECTION_SLOTS]
-        rp2040_ble.consume_connection_slots(connection_slots, "bluetooth_proxy")(config)
+        bluetooth_connection.consume_gatt_slot("bluetooth_proxy", connection_slots)(
+            config
+        )
        return {
            **config,
            CONF_CONNECTIONS: [connection_schema({}) for _ in range(connection_slots)],
@@ -214,7 +220,9 @@ async def _connections_to_code(var: cg.MockObj, config: ConfigType) -> None:
        # sends those requests and their handlers and encoders are dead.
        cg.add_define("USE_BLUETOOTH_PROXY_CONNECTIONS")
    for connection_conf in connections:
-        backend = await bluetooth_connection.new_gatt_backend(connection_conf)
+        backend = await bluetooth_connection.new_gatt_backend(
+            connection_conf, service_table=False
+        )
        connection = cg.new_Pvariable(connection_conf[CONF_ID])
        cg.add(connection.set_backend(backend))
        cg.add(var.register_connection(connection))
@@ -3,9 +3,6 @@ import esphome.codegen as cg
 from esphome.components import i2c, time
 import esphome.config_validation as cv
 from esphome.const import CONF_DURATION, CONF_ID
-from esphome.core import ID
-from esphome.cpp_generator import MockObj, TemplateArgsType
-from esphome.types import ConfigType

 DEPENDENCIES = ["i2c"]

@@ -38,12 +35,7 @@ CONFIG_SCHEMA = (
    ),
    synchronous=True,
 )
-async def bm8563_write_time_to_code(
-    config: ConfigType,
-    action_id: ID,
-    template_arg: cg.TemplateArguments,
-    args: TemplateArgsType,
-) -> MockObj:
+async def bm8563_write_time_to_code(config, action_id, template_arg, args):
    var = cg.new_Pvariable(action_id, template_arg)
    await cg.register_parented(var, config[CONF_ID])
    return var
@@ -60,12 +52,7 @@ async def bm8563_write_time_to_code(
    ),
    synchronous=True,
 )
-async def bm8563_start_timer_to_code(
-    config: ConfigType,
-    action_id: ID,
-    template_arg: cg.TemplateArguments,
-    args: TemplateArgsType,
-) -> MockObj:
+async def bm8563_start_timer_to_code(config, action_id, template_arg, args):
    var = cg.new_Pvariable(action_id, template_arg)
    await cg.register_parented(var, config[CONF_ID])
    template_ = await cg.templatable(config[CONF_DURATION], args, cg.uint32)
@@ -83,18 +70,13 @@ async def bm8563_start_timer_to_code(
    ),
    synchronous=True,
 )
-async def bm8563_read_time_to_code(
-    config: ConfigType,
-    action_id: ID,
-    template_arg: cg.TemplateArguments,
-    args: TemplateArgsType,
-) -> MockObj:
+async def bm8563_read_time_to_code(config, action_id, template_arg, args):
    var = cg.new_Pvariable(action_id, template_arg)
    await cg.register_parented(var, config[CONF_ID])
    return var


-async def to_code(config: ConfigType) -> None:
+async def to_code(config):
    var = cg.new_Pvariable(config[CONF_ID])
    await cg.register_component(var, config)
    await i2c.register_i2c_device(var, config)
@@ -3,7 +3,6 @@ from esphome.components import esp32, i2c
 from esphome.components.const import CONF_STATE_SAVE_INTERVAL
 import esphome.config_validation as cv
 from esphome.const import CONF_ID, CONF_SAMPLE_RATE, CONF_TEMPERATURE_OFFSET, Framework
-from esphome.types import ConfigType

 CODEOWNERS = ["@trvrnrth"]
 DEPENDENCIES = ["i2c"]
@@ -77,7 +76,7 @@ CONFIG_SCHEMA = cv.All(
 )


-async def to_code(config: ConfigType) -> None:
+async def to_code(config):
    var = cg.new_Pvariable(config[CONF_ID])
    await cg.register_component(var, config)
    await i2c.register_i2c_device(var, config)
@@ -29,8 +29,6 @@ from esphome.const import (
    UNIT_PARTS_PER_MILLION,
    UNIT_PERCENT,
 )
-from esphome.cpp_generator import MockObj
-from esphome.types import ConfigType

 from . import CONF_BME680_BSEC_ID, SAMPLE_RATE_OPTIONS, BME680BSECComponent

@@ -112,7 +110,7 @@ CONFIG_SCHEMA = cv.Schema(
 )


-async def setup_conf(config: ConfigType, key: str, hub: MockObj) -> None:
+async def setup_conf(config, key, hub):
    if sensor_config := config.get(key):
        sens = await sensor.new_sensor(sensor_config)
        cg.add(getattr(hub, f"set_{key}_sensor")(sens))
@@ -122,7 +120,7 @@ async def setup_conf(config: ConfigType, key: str, hub: MockObj) -> None:
            )


-async def to_code(config: ConfigType) -> None:
+async def to_code(config):
    hub = await cg.get_variable(config[CONF_BME680_BSEC_ID])
    for key in TYPES:
        await setup_conf(config, key, hub)
@@ -2,8 +2,6 @@ import esphome.codegen as cg
 from esphome.components import text_sensor
 import esphome.config_validation as cv
 from esphome.const import CONF_IAQ_ACCURACY
-from esphome.cpp_generator import MockObj
-from esphome.types import ConfigType

 from . import CONF_BME680_BSEC_ID, BME680BSECComponent

@@ -23,13 +21,13 @@ CONFIG_SCHEMA = cv.Schema(
 )


-async def setup_conf(config: ConfigType, key: str, hub: MockObj) -> None:
+async def setup_conf(config, key, hub):
    if sensor_config := config.get(key):
        sens = await text_sensor.new_text_sensor(sensor_config)
        cg.add(getattr(hub, f"set_{key}_text_sensor")(sens))


-async def to_code(config: ConfigType) -> None:
+async def to_code(config):
    hub = await cg.get_variable(config[CONF_BME680_BSEC_ID])
    for key in TYPES:
        await setup_conf(config, key, hub)
@@ -11,7 +11,6 @@ from esphome.const import (
    CONF_SAMPLE_RATE,
    CONF_TEMPERATURE_OFFSET,
 )
-from esphome.cpp_generator import MockObj
 from esphome.external_files import RemoteFile
 from esphome.types import ConfigType

@@ -95,7 +94,7 @@ def _compute_url(config: dict) -> str:
    return f"https://raw.githubusercontent.com/boschsensortec/Bosch-BSEC2-Library/{BSEC2_LIBRARY_VERSION}/src/config/{model}/{model}_{algo}_{volts}_{sample_rate}_{operating_age}/{filename}.txt"


-def download_bme68x_blob(config: ConfigType) -> ConfigType:
+def download_bme68x_blob(config):
    url = _compute_url(config)
    path = _compute_local_file_path(url)
    external_files.download_content(url, path)
@@ -139,7 +138,7 @@ def _extract_blob_ref(entry: ConfigType) -> RemoteFile | None:
 PREFETCH_FILES = external_files.single_stage_prefetch(_extract_blob_ref)


-def validate_bme68x(config: ConfigType) -> ConfigType:
+def validate_bme68x(config):
    if CONF_ALGORITHM_OUTPUT not in config:
        return config

@@ -179,7 +178,7 @@ CONFIG_SCHEMA_BASE = (
 )


-async def to_code_base(config: ConfigType) -> MockObj:
+async def to_code_base(config):
    var = cg.new_Pvariable(config[CONF_ID])
    await cg.register_component(var, config)

@@ -29,8 +29,6 @@ from esphome.const import (
    UNIT_PARTS_PER_MILLION,
    UNIT_PERCENT,
 )
-from esphome.cpp_generator import MockObj
-from esphome.types import ConfigType

 from . import CONF_BME68X_BSEC2_ID, SAMPLE_RATE_OPTIONS, BME68xBSEC2Component

@@ -121,7 +119,7 @@ CONFIG_SCHEMA = cv.Schema(
 )


-async def setup_conf(config: ConfigType, key: str, hub: MockObj) -> None:
+async def setup_conf(config, key, hub):
    if conf := config.get(key):
        sens = await sensor.new_sensor(conf)
        cg.add(getattr(hub, f"set_{key}_sensor")(sens))
@@ -129,7 +127,7 @@ async def setup_conf(config: ConfigType, key: str, hub: MockObj) -> None:
            cg.add(getattr(hub, f"set_{key}_sample_rate")(sample_rate))


-async def to_code(config: ConfigType) -> None:
+async def to_code(config):
    hub = await cg.get_variable(config[CONF_BME68X_BSEC2_ID])
    for key in TYPES:
        await setup_conf(config, key, hub)
@@ -2,8 +2,6 @@ import esphome.codegen as cg
 from esphome.components import text_sensor
 import esphome.config_validation as cv
 from esphome.const import CONF_IAQ_ACCURACY
-from esphome.cpp_generator import MockObj
-from esphome.types import ConfigType

 from . import CONF_BME68X_BSEC2_ID, BME68xBSEC2Component

@@ -23,13 +21,13 @@ CONFIG_SCHEMA = cv.Schema(
 )


-async def setup_conf(config: ConfigType, key: str, hub: MockObj) -> None:
+async def setup_conf(config, key, hub):
    if conf := config.get(key):
        sens = await text_sensor.new_text_sensor(conf)
        cg.add(getattr(hub, f"set_{key}_text_sensor")(sens))


-async def to_code(config: ConfigType) -> None:
+async def to_code(config):
    hub = await cg.get_variable(config[CONF_BME68X_BSEC2_ID])
    for key in TYPES:
        await setup_conf(config, key, hub)
@@ -3,8 +3,6 @@ from esphome.components import ble_device_base
 import esphome.config_validation as cv
 from esphome.const import CONF_BINDKEY, CONF_ID, CONF_MAC_ADDRESS
 from esphome.core import HexInt
-from esphome.cpp_generator import MockObj
-from esphome.types import ConfigType

 CODEOWNERS = ["@nagyrobi"]
 AUTO_LOAD = ["ble_device_base"]
@@ -16,9 +14,7 @@ BTHomeMiThermometer = bthome_mithermometer_ns.class_(
 )


-def bthome_mithermometer_base_schema(
-    extra_schema: cv.Schema | dict | None = None,
-) -> cv.All:
+def bthome_mithermometer_base_schema(extra_schema=None):
    if extra_schema is None:
        extra_schema = {}
    return cv.All(
@@ -36,7 +32,7 @@ def bthome_mithermometer_base_schema(
    )


-async def setup_bthome_mithermometer(var: MockObj, config: ConfigType) -> None:
+async def setup_bthome_mithermometer(var, config):
    await cg.register_component(var, config)
    await ble_device_base.register_ble_device(var, config)
    cg.add(var.set_address(config[CONF_MAC_ADDRESS].as_hex))
@@ -20,7 +20,6 @@ from esphome.const import (
    UNIT_PERCENT,
    UNIT_VOLT,
 )
-from esphome.types import ConfigType

 from . import bthome_mithermometer_base_schema, setup_bthome_mithermometer

@@ -68,7 +67,7 @@ CONFIG_SCHEMA = bthome_mithermometer_base_schema(
 )


-async def to_code(config: ConfigType) -> None:
+async def to_code(config):
    var = cg.new_Pvariable(config[CONF_ID])
    await setup_bthome_mithermometer(var, config)

@@ -16,15 +16,14 @@ from esphome.const import (
    DEVICE_CLASS_RESTART,
    DEVICE_CLASS_UPDATE,
 )
-from esphome.core import CORE, ID, CoroPriority, coroutine_with_priority
+from esphome.core import CORE, CoroPriority, coroutine_with_priority
 from esphome.core.entity_helpers import (
    entity_duplicate_validator,
    queue_entity_register,
    setup_device_class,
    setup_entity,
 )
-from esphome.cpp_generator import MockObj, MockObjClass, TemplateArgsType
-from esphome.types import ConfigType, SafeExpType
+from esphome.cpp_generator import MockObjClass

 CODEOWNERS = ["@esphome/core"]
 IS_PLATFORM_COMPONENT = True
@@ -89,7 +88,7 @@ _CALLBACK_AUTOMATIONS = (


@setup_entity("button")
-async def setup_button_core_(var: MockObj, config: ConfigType) -> None:
+async def setup_button_core_(var, config):
    await automation.build_callback_automations(var, config, _CALLBACK_AUTOMATIONS)

    setup_device_class(config)
@@ -102,7 +101,7 @@ async def setup_button_core_(var: MockObj, config: ConfigType) -> None:
        await web_server.add_entity_config(var, web_server_config)


-async def register_button(var: MockObj, config: ConfigType) -> None:
+async def register_button(var, config):
    if not CORE.has_id(config[CONF_ID]):
        var = cg.Pvariable(config[CONF_ID], var)
    queue_entity_register("button", config)
@@ -110,7 +109,7 @@ async def register_button(var: MockObj, config: ConfigType) -> None:
    await setup_button_core_(var, config)


-async def new_button(config: ConfigType, *args: SafeExpType) -> MockObj:
+async def new_button(config, *args):
    var = cg.new_Pvariable(config[CONF_ID], *args)
    await register_button(var, config)
    return var
@@ -126,16 +125,11 @@ BUTTON_PRESS_SCHEMA = maybe_simple_id(
@automation.register_action(
    "button.press", PressAction, BUTTON_PRESS_SCHEMA, synchronous=True
 )
-async def button_press_to_code(
-    config: ConfigType,
-    action_id: ID,
-    template_arg: cg.TemplateArguments,
-    args: TemplateArgsType,
-) -> MockObj:
+async def button_press_to_code(config, action_id, template_arg, args):
    paren = await cg.get_variable(config[CONF_ID])
    return cg.new_Pvariable(action_id, template_arg, paren)


@coroutine_with_priority(CoroPriority.CORE)
-async def to_code(config: ConfigType) -> None:
+async def to_code(config):
    cg.add_global(button_ns.using)
@@ -1,13 +1,10 @@
 import re
-from typing import Any

 from esphome import automation
 import esphome.codegen as cg
 import esphome.config_validation as cv
 from esphome.const import CONF_DATA, CONF_ID, CONF_TRIGGER_ID
 from esphome.core import CORE, ID
-from esphome.cpp_generator import MockObj, TemplateArgsType
-from esphome.types import ConfigType

 CODEOWNERS = ["@mvturnho", "@danielschramm"]
 IS_PLATFORM_COMPONENT = True
@@ -21,7 +18,7 @@ CONF_BIT_RATE = "bit_rate"
 CONF_ON_FRAME = "on_frame"


-def validate_id(config: ConfigType) -> ConfigType:
+def validate_id(config):
    if CONF_CAN_ID in config:
        can_id = config[CONF_CAN_ID]
        id_ext = config[CONF_USE_EXTENDED_ID]
@@ -30,7 +27,7 @@ def validate_id(config: ConfigType) -> ConfigType:
    return config


-def validate_raw_data(value: Any) -> bytes | list:
+def validate_raw_data(value):
    if isinstance(value, str):
        return value.encode("utf-8")
    if isinstance(value, list):
@@ -74,7 +71,7 @@ CAN_SPEEDS = {
 }


-def get_rate(value: str) -> int:
+def get_rate(value):
    match = re.match(r"(\d+)(?:K(\d+)?)?BPS", value, re.IGNORECASE)
    if not match:
        raise ValueError(f"Invalid rate format: {value}")
@@ -106,7 +103,7 @@ CANBUS_SCHEMA = cv.Schema(
 CANBUS_SCHEMA.add_extra(validate_id)


-async def setup_canbus_core_(var: MockObj, config: ConfigType) -> None:
+async def setup_canbus_core_(var, config):
    await cg.register_component(var, config)
    cg.add(var.set_can_id([config[CONF_CAN_ID]]))
    cg.add(var.set_use_extended_id([config[CONF_USE_EXTENDED_ID]]))
@@ -137,7 +134,7 @@ async def setup_canbus_core_(var: MockObj, config: ConfigType) -> None:
        )


-async def register_canbus(var: MockObj, config: ConfigType) -> None:
+async def register_canbus(var, config):
    if not CORE.has_id(config[CONF_ID]):
        var = cg.new_Pvariable(config[CONF_ID], var)
    await setup_canbus_core_(var, config)
@@ -160,12 +157,7 @@ async def register_canbus(var: MockObj, config: ConfigType) -> None:
    ),
    synchronous=True,
 )
-async def canbus_action_to_code(
-    config: ConfigType,
-    action_id: ID,
-    template_arg: cg.TemplateArguments,
-    args: TemplateArgsType,
-) -> MockObj:
+async def canbus_action_to_code(config, action_id, template_arg, args):
    var = cg.new_Pvariable(action_id, template_arg)
    await cg.register_parented(var, config[CONF_CANBUS_ID])

@@ -6,7 +6,6 @@
 #include "esphome/core/string_ref.h"
 #include "esphome/components/wifi/wifi_component.h"
 #include "captive_index.h"
-#include "scan_list.h"

 namespace esphome::captive_portal {

@@ -34,10 +33,8 @@ void CaptivePortal::handle_config(AsyncWebServerRequest *request) {
    // Invariant: only bounded in-memory work under the lock; the network send
    // happens later in request->send()
    wifi::ScanResultsLock lock(wifi::global_wifi_component);
-    const auto &results = wifi::global_wifi_component->get_scan_result();
-    for (const auto &scan : results) {
-      bool with_auth = false;
-      if (!should_show_scan_entry(results, scan, with_auth))
+    for (const auto &scan : wifi::global_wifi_component->get_scan_result()) {
+      if (scan.get_is_hidden())
        continue;

      json_escape_into_buffer(escaped_ssid, scan.get_ssid());
@@ -47,10 +44,10 @@ void CaptivePortal::handle_config(AsyncWebServerRequest *request) {
      stream->print(ESPHOME_F("\",\"rssi\":"));
      stream->print(scan.get_rssi());
      stream->print(ESPHOME_F(",\"lock\":"));
-      stream->print(with_auth);
+      stream->print(scan.get_with_auth());
      stream->print(ESPHOME_F("}"));
 #else
-      stream->printf(R"(,{"ssid":"%s","rssi":%d,"lock":%d})", escaped_ssid, scan.get_rssi(), with_auth);
+      stream->printf(R"(,{"ssid":"%s","rssi":%d,"lock":%d})", escaped_ssid, scan.get_rssi(), scan.get_with_auth());
 #endif
    }
  }
@@ -1,28 +0,0 @@
-#pragma once
-#include <cstdint>
-
-namespace esphome::captive_portal {
-
-// A scan lists every BSSID, so one SSID can appear several times. Returns true for
-// the strongest entry per SSID (earliest on ties), never for hidden entries. scan
-// must be an element of results. with_auth is written only when returning true and
-// is set if any entry with that SSID needs a key. Templated for host tests.
-template<typename Results, typename Entry>
-bool should_show_scan_entry(const Results &results, const Entry &scan, bool &with_auth) {
-  if (scan.get_is_hidden())
-    return false;
-  const int8_t rssi = scan.get_rssi();
-  bool any_auth = false;
-  for (const auto &other : results) {
-    if (other.get_is_hidden() || !other.ssid_equals(scan))
-      continue;
-    // Same array, so address order is index order. scan fails both checks against itself.
-    if (other.get_rssi() > rssi || (other.get_rssi() == rssi && &other < &scan))
-      return false;
-    any_auth |= other.get_with_auth();
-  }
-  with_auth = any_auth;
-  return true;
-}
-
-}  // namespace esphome::captive_portal
@@ -1,5 +1,3 @@
-from typing import Any
-
 from esphome import automation
 import esphome.codegen as cg
 from esphome.components import mqtt, web_server
@@ -50,19 +48,13 @@ from esphome.const import (
    CONF_VISUAL,
    CONF_WEB_SERVER,
 )
-from esphome.core import CORE, ID, CoroPriority, Lambda, coroutine_with_priority
+from esphome.core import CORE, CoroPriority, Lambda, coroutine_with_priority
 from esphome.core.entity_helpers import (
    entity_duplicate_validator,
    queue_entity_register,
    setup_entity,
 )
-from esphome.cpp_generator import (
-    LambdaExpression,
-    MockObj,
-    MockObjClass,
-    TemplateArgsType,
-)
-from esphome.types import ConfigType, SafeExpType
+from esphome.cpp_generator import LambdaExpression, MockObjClass

 IS_PLATFORM_COMPONENT = True

@@ -140,7 +132,7 @@ VISUAL_TEMPERATURE_STEP_SCHEMA = cv.Schema(
 )


-def visual_temperature_step(value: Any) -> ConfigType:
+def visual_temperature_step(value):
    # Allow defining target/current temperature steps separately
    if isinstance(value, dict):
        return VISUAL_TEMPERATURE_STEP_SCHEMA(value)
@@ -281,7 +273,7 @@ def climate_schema(


@setup_entity("climate")
-async def setup_climate_core_(var: MockObj, config: ConfigType) -> None:
+async def setup_climate_core_(var, config):
    visual = config.get(CONF_VISUAL, {})
    if (min_temp := visual.get(CONF_MIN_TEMPERATURE)) is not None:
        cg.add_define("USE_CLIMATE_VISUAL_OVERRIDES")
@@ -451,7 +443,7 @@ async def setup_climate_core_(var: MockObj, config: ConfigType) -> None:
        await web_server.add_entity_config(var, web_server_config)


-async def register_climate(var: MockObj, config: ConfigType) -> None:
+async def register_climate(var, config):
    if not CORE.has_id(config[CONF_ID]):
        var = cg.Pvariable(config[CONF_ID], var)
    queue_entity_register("climate", config)
@@ -459,7 +451,7 @@ async def register_climate(var: MockObj, config: ConfigType) -> None:
    await setup_climate_core_(var, config)


-async def new_climate(config: ConfigType, *args: SafeExpType) -> MockObj:
+async def new_climate(config, *args):
    var = cg.new_Pvariable(config[CONF_ID], *args)
    await register_climate(var, config)
    return var
@@ -493,12 +485,7 @@ CLIMATE_CONTROL_ACTION_SCHEMA = cv.Schema(
    CLIMATE_CONTROL_ACTION_SCHEMA,
    synchronous=True,
 )
-async def climate_control_to_code(
-    config: ConfigType,
-    action_id: ID,
-    template_arg: cg.TemplateArguments,
-    args: TemplateArgsType,
-) -> MockObj:
+async def climate_control_to_code(config, action_id, template_arg, args):
    paren = await cg.get_variable(config[CONF_ID])

    # All configured fields are folded into a single stateless lambda whose
@@ -562,5 +549,5 @@ async def climate_control_to_code(


@coroutine_with_priority(CoroPriority.CORE)
-async def to_code(config: ConfigType) -> None:
+async def to_code(config):
    cg.add_global(climate_ns.using)
@@ -511,6 +511,29 @@ ClimateTraits Climate::get_traits() {
  return traits;
 }

+#ifdef USE_CLIMATE_VISUAL_OVERRIDES
+void Climate::set_visual_min_temperature_override(float visual_min_temperature_override) {
+  this->visual_min_temperature_override_ = visual_min_temperature_override;
+}
+
+void Climate::set_visual_max_temperature_override(float visual_max_temperature_override) {
+  this->visual_max_temperature_override_ = visual_max_temperature_override;
+}
+
+void Climate::set_visual_temperature_step_override(float target, float current) {
+  this->visual_target_temperature_step_override_ = target;
+  this->visual_current_temperature_step_override_ = current;
+}
+
+void Climate::set_visual_min_humidity_override(float visual_min_humidity_override) {
+  this->visual_min_humidity_override_ = visual_min_humidity_override;
+}
+
+void Climate::set_visual_max_humidity_override(float visual_max_humidity_override) {
+  this->visual_max_humidity_override_ = visual_max_humidity_override;
+}
+#endif
+
 ClimateCall Climate::make_call() { return ClimateCall(this); }

 ClimateCall ClimateDeviceRestoreState::to_call(Climate *climate) {
@@ -228,22 +228,11 @@ class Climate : public EntityBase {
  ClimateTraits get_traits();

 #ifdef USE_CLIMATE_VISUAL_OVERRIDES
-  void set_visual_min_temperature_override(float visual_min_temperature_override) {
-    this->visual_min_temperature_override_ = visual_min_temperature_override;
-  }
-  void set_visual_max_temperature_override(float visual_max_temperature_override) {
-    this->visual_max_temperature_override_ = visual_max_temperature_override;
-  }
-  void set_visual_temperature_step_override(float target, float current) {
-    this->visual_target_temperature_step_override_ = target;
-    this->visual_current_temperature_step_override_ = current;
-  }
-  void set_visual_min_humidity_override(float visual_min_humidity_override) {
-    this->visual_min_humidity_override_ = visual_min_humidity_override;
-  }
-  void set_visual_max_humidity_override(float visual_max_humidity_override) {
-    this->visual_max_humidity_override_ = visual_max_humidity_override;
-  }
+  void set_visual_min_temperature_override(float visual_min_temperature_override);
+  void set_visual_max_temperature_override(float visual_max_temperature_override);
+  void set_visual_temperature_step_override(float target, float current);
+  void set_visual_min_humidity_override(float visual_min_humidity_override);
+  void set_visual_max_humidity_override(float visual_max_humidity_override);
 #endif

  /// Set the supported custom fan modes (stored on Climate, referenced by ClimateTraits).
@@ -13,9 +13,6 @@ from esphome.const import (
    STATE_CLASS_MEASUREMENT,
    UNIT_PARTS_PER_MILLION,
 )
-from esphome.core import ID
-from esphome.cpp_generator import MockObj, TemplateArgsType
-from esphome.types import ConfigType

 DEPENDENCIES = ["uart"]
 CODEOWNERS = ["@andrewjswan"]
@@ -47,7 +44,7 @@ CONFIG_SCHEMA = (
 )


-async def to_code(config: ConfigType) -> None:
+async def to_code(config) -> None:
    """Code generation entry point."""
    var = cg.new_Pvariable(config[CONF_ID])
    await cg.register_component(var, config)
@@ -70,12 +67,7 @@ CALIBRATION_ACTION_SCHEMA = maybe_simple_id(
    CALIBRATION_ACTION_SCHEMA,
    synchronous=True,
 )
-async def cm1106_calibration_to_code(
-    config: ConfigType,
-    action_id: ID,
-    template_arg: cg.TemplateArguments,
-    args: TemplateArgsType,
-) -> MockObj:
+async def cm1106_calibration_to_code(config, action_id, template_arg, args) -> None:
    """Service code generation entry point."""
    paren = await cg.get_variable(config[CONF_ID])
    return cg.new_Pvariable(action_id, template_arg, paren)
@@ -1,8 +1,5 @@
-from typing import Any
-
 from esphome import codegen as cg, config_validation as cv
 from esphome.const import CONF_BLUE, CONF_GREEN, CONF_ID, CONF_RED, CONF_WHITE
-from esphome.types import ConfigType

 ColorStruct = cg.esphome_ns.struct("Color")

@@ -17,7 +14,7 @@ CONF_WHITE_INT = "white_int"
 CONF_HEX = "hex"


-def hex_color(value: Any) -> tuple[int, int, int]:
+def hex_color(value):
    if isinstance(value, int):
        value = str(value)
    if not isinstance(value, str):
@@ -42,7 +39,7 @@ components = {
 }


-def validate_color(config: ConfigType) -> ConfigType:
+def validate_color(config):
    has_components = set(config) & components
    has_hex = CONF_HEX in config
    if has_hex and has_components:
@@ -71,7 +68,7 @@ CONFIG_SCHEMA = cv.All(
 )


-def from_rgbw(config: ConfigType) -> tuple[int, int, int, int]:
+def from_rgbw(config):
    r = 0
    if CONF_RED in config:
        r = int(config[CONF_RED] * 255)
@@ -99,7 +96,7 @@ def from_rgbw(config: ConfigType) -> tuple[int, int, int, int]:
    return (r, g, b, w)


-async def to_code(config: ConfigType) -> None:
+async def to_code(config):
    if CONF_HEX in config:
        r, g, b = config[CONF_HEX]
        w = 0
@@ -8,7 +8,6 @@ from esphome.const import (
    CONF_SOURCE_ID,
 )
 from esphome.core.entity_helpers import inherit_property_from
-from esphome.types import ConfigType

 from .. import copy_ns

@@ -34,7 +33,7 @@ FINAL_VALIDATE_SCHEMA = cv.All(
 )


-async def to_code(config: ConfigType) -> None:
+async def to_code(config):
    var = await binary_sensor.new_binary_sensor(config)
    await cg.register_component(var, config)

@@ -9,7 +9,6 @@ from esphome.const import (
    CONF_SOURCE_ID,
 )
 from esphome.core.entity_helpers import inherit_property_from
-from esphome.types import ConfigType

 from .. import copy_ns

@@ -33,7 +32,7 @@ FINAL_VALIDATE_SCHEMA = cv.All(
 )


-async def to_code(config: ConfigType) -> None:
+async def to_code(config):
    var = cg.new_Pvariable(config[CONF_ID])
    await button.register_button(var, config)
    await cg.register_component(var, config)
@@ -8,7 +8,6 @@ from esphome.const import (
    CONF_SOURCE_ID,
 )
 from esphome.core.entity_helpers import inherit_property_from
-from esphome.types import ConfigType

 from .. import copy_ns

@@ -32,7 +31,7 @@ FINAL_VALIDATE_SCHEMA = cv.All(
 )


-async def to_code(config: ConfigType) -> None:
+async def to_code(config):
    var = await cover.new_cover(config)
    await cg.register_component(var, config)

@@ -3,7 +3,6 @@ from esphome.components import fan
 import esphome.config_validation as cv
 from esphome.const import CONF_ENTITY_CATEGORY, CONF_ICON, CONF_SOURCE_ID
 from esphome.core.entity_helpers import inherit_property_from
-from esphome.types import ConfigType

 from .. import copy_ns

@@ -26,7 +25,7 @@ FINAL_VALIDATE_SCHEMA = cv.All(
 )


-async def to_code(config: ConfigType) -> None:
+async def to_code(config):
    var = await fan.new_fan(config)
    await cg.register_component(var, config)

@@ -3,7 +3,6 @@ from esphome.components import lock
 import esphome.config_validation as cv
 from esphome.const import CONF_ENTITY_CATEGORY, CONF_ICON, CONF_SOURCE_ID
 from esphome.core.entity_helpers import inherit_property_from
-from esphome.types import ConfigType

 from .. import copy_ns

@@ -26,7 +25,7 @@ FINAL_VALIDATE_SCHEMA = cv.All(
 )


-async def to_code(config: ConfigType) -> None:
+async def to_code(config):
    var = await lock.new_lock(config)
    await cg.register_component(var, config)

--- a/Show More
+++ b/Show More