Merge branch 'dev' into ota-encryption-offer-api-key

Co-authored-by: pre-commit-ci-lite[bot] <117423508+pre-commit-ci-lite[bot]@users.noreply.github.com>
Co-authored-by: Claude <noreply@anthropic.com>

.github/workflows/ci.yml

@@ -374,8 +374,9 @@ jobs:
       - name: Install apt packages (cached)
         # ccache speeds up the host compiles. A cache hit never touches apt
         # (mirror outages cannot hang the job); the timeout bounds the cold
-        # path. Packages and version must match seed-apt-cache exactly;
-        # libsdl2-dev is unused here and carried only for cache-key parity.
+        # path. Packages and version must match seed-apt-cache exactly.
+        # libsdl2-dev is needed by the headless display tests, which capture
+        # screenshots.
         timeout-minutes: 10
         uses: awalsh128/cache-apt-pkgs-action@553a35bb8ebd9fcabcb1c9451aa4c98e1b4ca8a9 # v1.6.3
         with:
@@ -438,6 +439,16 @@ jobs:
           echo "Bucket ${{ matrix.bucket.name }}: running ${#test_files[@]} integration tests"
           pytest -vv --no-cov --tb=native --durations=30 -n auto --dist worksteal \
             --junitxml=junit-integration.xml "${test_files[@]}"
+      - name: Upload test artifacts
+        # Tests that compare rendered output write the image they actually got here, so a
+        # failure can be looked at without reproducing the whole build locally.
+        if: failure()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: integration-test-artifacts-${{ matrix.bucket.name }}
+          path: test_artifacts/
+          if-no-files-found: ignore
+          retention-days: 7
       - name: Upload junit timings
         # Consumed by sync-integration-durations.yml through
         # script/update_integration_test_durations.py; only full matrix dev

.gitignore

@@ -137,6 +137,8 @@ config/
 !tests/component_tests/**/config/
 tests/build/
 tests/.esphome/
+# Output kept by failing tests for inspection; uploaded by CI
+test_artifacts/
 /.temp-clang-tidy.cpp
 /.temp/
 .pio/

AGENTS.md

@@ -553,6 +553,7 @@ file does, and it is the authority when they disagree. The most useful starting
     4.  **Lint:** Run `prek` to ensure code is compliant.
     5.  **Commit:** Commit your changes. There is no strict format for commit messages.
     6.  **Pull Request:** Submit a PR against the `dev` branch. The Pull Request title must start with a `[tag]` prefix. For component work, use the component name (e.g., `[display] Fix bug`, `[abc123] Add new component`); for changes to shared/core code that isn't tied to a single component, use `[core]` (e.g., `[core] Add validator`). Update documentation, examples, and add `CODEOWNERS` entries as needed. Pull requests should always be made using the `.github/PULL_REQUEST_TEMPLATE.md` template - fill out all sections completely without removing any parts of the template.
+    7.  **Comments:** When commenting on GitHub PRs or issues, don't tag contributors, especially bots. Avoid referring to list items (e.g. from reviews) with the form #nn - this will be interpreted by GitHub as a reference to issue or PR nn. Keep comments short and exclude irrelevant details, backstories, restatement of previous comments and anything that is already obvious to the reader.
 
 *   **Documentation Contributions:**
     *   Documentation is hosted in the separate `esphome/esphome.io` repository.

CODEOWNERS

@@ -496,6 +496,7 @@ esphome/components/sm2335/* @Cossid
 esphome/components/sml/* @alengwenus
 esphome/components/smt100/* @piechade
 esphome/components/sn74hc165/* @jesserockz
+esphome/components/snapshot/* @clydebarrow
 esphome/components/socket/* @esphome/core
 esphome/components/sonoff_d1/* @anatoly-savchenkov
 esphome/components/sound_level/* @kahrendt

Doxyfile

@@ -48,7 +48,7 @@ PROJECT_NAME           = ESPHome
 # could be handy for archiving the generated documentation or if some version
 # control system is used.
 
-PROJECT_NUMBER         = 2026.9.0-dev
+PROJECT_NUMBER         = 2026.10.0-dev
 
 # Using the PROJECT_BRIEF tag one can provide an optional one line description
 # for a project that appears at the top of each page and should give viewer a

THREAT_MODEL.md

@@ -125,30 +125,47 @@ design is optimal or that it will not change.
 ## OTA update encryption
 
 The `esphome` OTA platform optionally encrypts updates with the same Noise
-`NNpsk0` pattern the native API uses; one key protects the device. With an
-`encryption:` block configured the guarantees are: the firmware image is
-confidential in transit, the uploader is authenticated by the pre-shared key,
-and the plaintext negotiation preceding the handshake is bound into the
-handshake prologue, so stripping or tampering with it fails the first MAC.
-Both ends fail closed with no override: a device built with a key refuses
+`NNpsk0` pattern the native API uses; one key protects the device. A device
+whose `api:` block has an encryption key, static in the YAML or provisioned at
+runtime, compiles in the transport and offers it on every OTA connection once
+it holds a key, so an uploader presenting that key gets the guarantees below
+even without an `ota: encryption:` block; only that block makes the device
+require encryption. The guarantees are: the firmware image is confidential in
+transit, the uploader is authenticated by the pre-shared key, and the plaintext
+negotiation preceding the handshake is bound into the handshake prologue, so
+stripping or tampering with it fails the first MAC. With `ota: encryption:`
+configured both ends fail closed with no override: the device refuses
 plaintext uploads, and the CLI refuses to send plaintext when a key is
-configured.
+configured. Without that block the CLI tries a static api key when the device
+offers and, until 2027.3.0, falls back to plaintext with a warning when the
+offer is missing or the handshake fails; a runtime provisioned key never
+reaches the CLI, so those uploads stay plaintext.
 
-Defeating any of that without the key is in scope: a keyed device accepting a
-plaintext or downgraded upload, getting past the MAC, or recovering image
-contents from captured traffic.
+Defeating any of that without the key is in scope: a device that requires
+encryption accepting a plaintext or downgraded upload, getting past the MAC,
+or recovering image contents from captured traffic.
 
 The following are **not** vulnerabilities, by design:
 
-- Plaintext OTA on a device with no `encryption:` block. That is the
-  documented default, authenticated (if at all) by the OTA password.
-- The enablement window: turning encryption on takes one last upload of the
-  encryption-enabled firmware over the existing plaintext channel, with the
-  pre-existing plaintext exposure.
-- The web OTA `/update` endpoint alongside encryption. The `web_server`
-  component keeps it always reachable, and `captive_portal:` auto-loads it
-  for the fallback AP window; validation warns about both combinations, and
-  the operator keeps the recovery path.
+- Plaintext OTA on a device with no `ota: encryption:` block, including one
+  that offers encryption because it has an api key. That is the documented
+  default, authenticated (if at all) by the OTA password. An uploader that
+  takes the offer skips the password; the key authenticates it. With a
+  runtime provisioned key and no `provisioning:` window, whoever provisions
+  the key gains that upload path too; validation warns about the pair.
+- The CLI plaintext fallback until 2027.3.0: without `ota: encryption:` an
+  active attacker who strips the offer or breaks the handshake can make a
+  keyed CLI upload plaintext, with the pre-existing plaintext exposure. A
+  device that requires encryption still refuses that upload.
+- The enablement window: firmware built with a static api key already offers
+  encryption, so turning on `ota: encryption:` is itself an encrypted upload.
+  Older firmware needs one last plaintext upload of an offering build, with
+  the pre-existing plaintext exposure.
+- The web OTA `/update` endpoint alongside encryption. With the `web_server`
+  or `prometheus` component the shared listener is always up, so the endpoint
+  stays reachable and validation warns about that combination;
+  `captive_portal:` alone brings the listener up only for the fallback AP
+  window, which is the intended recovery path, so that is not warned about.
 - CLI retry behavior on transport or MAC failures; every attempt renegotiates
   a fresh handshake with fresh ephemerals, so retrying does not weaken
   authentication.

docker/Dockerfile

@@ -22,7 +22,7 @@ RUN \
     -r /requirements.txt
 
 # Install the ESPHome Device Builder dashboard.
-RUN uv pip install --no-cache-dir esphome-device-builder==1.13.1
+RUN uv pip install --no-cache-dir esphome-device-builder==1.14.2
 
 RUN \
     platformio settings set enable_telemetry No \

esphome/__main__.py

@@ -1335,12 +1335,14 @@ def _upload_via_native_api(
             break
 
     from esphome import espota2
+    from esphome.components.noise import static_encryption_key
 
     remote_port = int(ota_conf[CONF_PORT])
     password = ota_conf.get(CONF_PASSWORD)
     # Fail closed: an encryption block whose key did not resolve must never
     # fall back to a plaintext upload
     noise_psk = None
+    plaintext_fallback = False
     if (encryption_conf := ota_conf.get(CONF_ENCRYPTION)) is not None:
         noise_psk = encryption_conf.get(CONF_KEY)
         if not noise_psk:
@@ -1351,6 +1353,10 @@ def _upload_via_native_api(
         # Ensure the key is a string, as required by the underlying OTA implementation.
         # It arrives here as a SensitiveStr which aioesphomeapi rejects.
         noise_psk = str(noise_psk)
+    elif api_key := static_encryption_key(config.get(CONF_API) or {}):
+        # Remove before 2027.3.0: the api key is tried, falling back to plaintext
+        noise_psk = str(api_key)
+        plaintext_fallback = True
 
     def check_partition_access(option_string: str) -> None:
         if not ota_conf.get("allow_partition_access"):
@@ -1382,7 +1388,13 @@ def _upload_via_native_api(
         _validate_bootloader_binary(binary)
 
     return espota2.run_ota(
-        network_devices, remote_port, password, binary, ota_type, noise_psk
+        network_devices,
+        remote_port,
+        password,
+        binary,
+        ota_type,
+        noise_psk,
+        plaintext_fallback=plaintext_fallback,
     )
 
 

esphome/arduino8266/framework.py

@@ -44,8 +44,7 @@ def get_arduino8266_tools_path() -> Path:
     return tools_cache_path(*ARDUINO8266_TOOLS_CACHE)
 
 
-# 3.1.1 rather than 3.1.0: the registry has no package for 3.1.0, and the
-# encoder below cannot name 3.0.0/3.0.1 either (see its docstring)
+# 3.1.1 rather than 3.1.0: the registry has no packages for 3.0.0, 3.0.1 or 3.1.0
 MIN_FRAMEWORK_VERSION = Version(3, 1, 1)
 
 
@@ -53,20 +52,16 @@ def framework_package_version(ver: Version) -> str:
     """Map an Arduino core version to its registry package version (3.1.2 ->
     3.30102.0; the leading 3 is the package major).
 
-    Exact registry names only for cores > 2.6.2 and >= 3.0.2; callers floor
-    at MIN_FRAMEWORK_VERSION.
+    Exact registry names for 3.x cores; callers floor at MIN_FRAMEWORK_VERSION.
     """
     if ver.major > 3:
         raise EsphomeError(
             f"Arduino core {ver} is not supported yet; "
             "the newest known core series is 3.x"
         )
-    if ver <= Version(2, 6, 2):
-        # Cores <= 2.6.2 use the older 1.x/2.x package-major encodings (same
-        # boundary as _format_framework_arduino_version's era guard)
+    if ver.major < 3:
         raise EsphomeError(
-            f"Arduino core {ver} uses an older package encoding than this "
-            "helper implements (newer than 2.6.2)"
+            f"Arduino core {ver} is not supported; ESPHome requires core 3.x"
         )
     return f"3.{ver.major}{ver.minor:02d}{ver.patch:02d}.0"
 

esphome/components/api/__init__.py

@@ -14,6 +14,7 @@ from esphome.components.noise import (  # noqa: F401
     ENCRYPTION_SCHEMA,
     decode_encryption_key,
     encryption_schema,
+    new_psk_progmem,
     validate_encryption_key,
 )
 from esphome.config_helpers import filter_source_files_from_defines, get_logger_level
@@ -589,8 +590,7 @@ async def to_code(config: ConfigType) -> None:
 
     if (encryption_config := config.get(CONF_ENCRYPTION, None)) is not None:
         if key := encryption_config.get(CONF_KEY):
-            decoded = decode_encryption_key(key)
-            cg.add(var.set_noise_psk(list(decoded)))
+            cg.add(var.set_noise_psk(new_psk_progmem(config[CONF_ID], key)))
             cg.add_define("USE_API_NOISE_PSK_FROM_YAML")
         else:
             # No key provided, but encryption desired

esphome/components/api/api_connection.cpp

@@ -2161,7 +2161,10 @@ void APIConnection::on_homeassistant_action_response(const HomeassistantActionRe
 bool APIConnection::send_noise_encryption_set_key_response_(const NoiseEncryptionSetKeyRequest &msg) {
   NoiseEncryptionSetKeyResponse resp;
   resp.success = false;
-
+#ifdef USE_API_NOISE_PSK_FROM_YAML
+  // A yaml key cannot be changed at runtime, so no decode or save path is built
+  ESP_LOGW(TAG, "Key set in YAML");
+#else
 #ifdef USE_PROVISIONING
   // Refuse to set a key once the provisioning window has closed (defense in depth;
   // such connections are already rejected at hello).
@@ -2196,6 +2199,7 @@ bool APIConnection::send_noise_encryption_set_key_response_(const NoiseEncryptio
     }
 #endif
   }
+#endif  // USE_API_NOISE_PSK_FROM_YAML
 
   return this->send_message(resp);
 }

esphome/components/api/api_frame_helper_noise.cpp

@@ -548,7 +548,7 @@ APIError APINoiseFrameHelper::write_frame_(const uint8_t *data, uint16_t len) {
  * @return 0 on success, -1 on error (check errno)
  */
 APIError APINoiseFrameHelper::init_handshake_() {
-  int err = this->handshake_.init(this->ctx_.get_psk(), prologue_.data(), prologue_.size());
+  int err = this->handshake_.init(this->ctx_, prologue_.data(), prologue_.size());
   APIError aerr = handle_noise_error_(err, LOG_STR("noise_handshake_init"), APIError::HANDSHAKESTATE_SETUP_FAILED);
   if (aerr != APIError::OK)
     return aerr;

esphome/components/api/api_server.cpp

@@ -41,13 +41,13 @@ void APIServer::setup() {
   ControllerRegistry::register_controller(this);
 
 #ifdef USE_API_NOISE
+  // Always reserve the slot: flash preferences are positional on esp8266, so
+  // a yaml key build must keep the layout of a runtime key build
   uint32_t hash = 88491486UL;
-
   this->noise_pref_ = global_preferences->make_preference<SavedNoisePsk>(hash, true);
-
 #ifndef USE_API_NOISE_PSK_FROM_YAML
-  // Only load saved PSK if not set from YAML
-  if (this->load_and_apply_noise_psk_()) {
+  // A cleared record loads fine but holds no key
+  if (this->load_and_apply_noise_psk_() && this->noise_ctx_.has_psk()) {
     ESP_LOGD(TAG, "Loaded saved Noise PSK");
   }
 #endif
@@ -550,6 +550,7 @@ const std::vector<APIServer::HomeAssistantStateSubscription> &APIServer::get_sta
 #endif
 
 #ifdef USE_API_NOISE
+#ifndef USE_API_NOISE_PSK_FROM_YAML
 bool APIServer::update_noise_psk_(const SavedNoisePsk &new_psk, const LogString *save_log_msg,
                                   const LogString *fail_log_msg, bool make_active) {
   if (!this->noise_pref_.save(&new_psk)) {
@@ -583,22 +584,19 @@ bool APIServer::update_noise_psk_(const SavedNoisePsk &new_psk, const LogString
 }
 
 bool APIServer::load_and_apply_noise_psk_() {
-  SavedNoisePsk saved{};
-  if (!this->noise_pref_.load(&saved))
+  // Load into a temp so a failed read cannot disturb the key in use
+  SavedNoisePsk loaded{};
+  if (!this->noise_pref_.load(&loaded))
     return false;
-  this->set_noise_psk(saved.psk);
+  this->saved_psk_ = loaded;
+  // An unprovisioned device stores the reserved all-zeros key, which is no key
+  const bool has_key = !noise::NoiseContext::is_all_zeros(this->saved_psk_.psk);
+  this->noise_ctx_.set_psk(has_key ? this->saved_psk_.psk.data() : nullptr);
   return true;
 }
 
 bool APIServer::save_noise_psk(noise::psk_t psk, bool make_active) {
-#ifdef USE_API_NOISE_PSK_FROM_YAML
-  // When PSK is set from YAML, this function should never be called
-  // but if it is, reject the change
-  ESP_LOGW(TAG, "Key set in YAML");
-  return false;
-#else
-  auto &old_psk = this->noise_ctx_.get_psk();
-  if (std::equal(old_psk.begin(), old_psk.end(), psk.begin())) {
+  if (this->saved_psk_.psk == psk) {
     ESP_LOGW(TAG, "New PSK matches old");
     return true;
   }
@@ -614,15 +612,8 @@ bool APIServer::save_noise_psk(noise::psk_t psk, bool make_active) {
   }
 #endif
   return result;
-#endif
 }
 bool APIServer::clear_noise_psk(bool make_active) {
-#ifdef USE_API_NOISE_PSK_FROM_YAML
-  // When PSK is set from YAML, this function should never be called
-  // but if it is, reject the change
-  ESP_LOGW(TAG, "Key set in YAML");
-  return false;
-#else
   SavedNoisePsk empty_psk{};
   bool result = this->update_noise_psk_(empty_psk, LOG_STR("Noise PSK cleared"), LOG_STR("Failed to clear Noise PSK"),
                                         make_active);
@@ -634,8 +625,8 @@ bool APIServer::clear_noise_psk(bool make_active) {
   }
 #endif
   return result;
-#endif
 }
+#endif  // USE_API_NOISE_PSK_FROM_YAML
 #endif
 
 #ifdef USE_HOMEASSISTANT_TIME

esphome/components/api/api_server.h

@@ -76,9 +76,14 @@ class APIServer final : public Component,
   APIBuffer &get_shared_buffer_ref() { return shared_write_buffer_; }
 
 #ifdef USE_API_NOISE
+#ifndef USE_API_NOISE_PSK_FROM_YAML
+  // Runtime key changes exist for the provisioning path only (not lambdas);
+  // with a yaml key they compile out
   bool save_noise_psk(noise::psk_t psk, bool make_active = true);
   bool clear_noise_psk(bool make_active = true);
-  void set_noise_psk(noise::psk_t psk) { this->noise_ctx_.set_psk(psk); }
+#endif
+  /// psk points at 32 bytes that live in flash for the life of the program
+  void set_noise_psk(const uint8_t *psk) { this->noise_ctx_.set_psk(psk); }
   noise::NoiseContext &get_noise_ctx() { return this->noise_ctx_; }
 #endif  // USE_API_NOISE
 
@@ -275,10 +280,12 @@ class APIServer final : public Component,
 #endif
 
 #ifdef USE_API_NOISE
+#ifndef USE_API_NOISE_PSK_FROM_YAML
   bool update_noise_psk_(const SavedNoisePsk &new_psk, const LogString *save_log_msg, const LogString *fail_log_msg,
                          bool make_active);
   // Load saved PSK from preferences and apply it. Returns true on success.
   bool load_and_apply_noise_psk_();
+#endif  // USE_API_NOISE_PSK_FROM_YAML
 #endif  // USE_API_NOISE
 #ifdef USE_API_HOMEASSISTANT_STATES
   // Helper methods to reduce code duplication
@@ -358,6 +365,9 @@ class APIServer final : public Component,
 
 #ifdef USE_API_NOISE
   noise::NoiseContext noise_ctx_;
+#ifndef USE_API_NOISE_PSK_FROM_YAML
+  SavedNoisePsk saved_psk_{};  // backs noise_ctx_ for a runtime provisioned key
+#endif
   ESPPreferenceObject noise_pref_;
 #endif  // USE_API_NOISE
 };

esphome/components/ble_client/__init__.py

@@ -1,23 +1,8 @@
-from collections.abc import Callable
-import functools
-from typing import Any
-
 from esphome import automation
 from esphome.automation import maybe_simple_id
 import esphome.codegen as cg
-from esphome.components import ble_device_base, bluetooth_connection
-from esphome.components.ble_device_base import (
-    BT_UUID16_FORMAT as bt_uuid16_format,
-    BT_UUID32_FORMAT as bt_uuid32_format,
-    BT_UUID128_FORMAT as bt_uuid128_format,
-    as_hex,
-    as_reversed_hex_array,
-    bt_uuid,
-)
-from esphome.config_helpers import (
-    filter_source_files_from_platform,
-    frameworks_for_platforms,
-)
+from esphome.components import esp32_ble, esp32_ble_client, esp32_ble_tracker
+from esphome.components.esp32_ble import BTLoggers
 import esphome.config_validation as cv
 from esphome.const import (
     CONF_CHARACTERISTIC_UUID,
@@ -30,53 +15,13 @@ from esphome.const import (
     CONF_SERVICE_UUID,
     CONF_TRIGGER_ID,
     CONF_VALUE,
-    PLATFORM_ESP32,
-    PlatformFramework,
 )
-from esphome.core import CORE, ID
-from esphome.enum import StrEnum
-from esphome.schema_extractors import SCHEMA_EXTRACT, schema_extractor
+from esphome.core import ID
 from esphome.types import ConfigType
 
-# The esp32 BLE stack (esp32_ble, esp32_ble_tracker) is imported lazily inside
-# the esp32 schema/codegen arms: importing those modules registers esp32-only
-# automations as a side effect, which must not leak into the neutral
-# platforms' registries (the bluetooth_proxy pattern).
-
-
-def _legacy_engine() -> bool:
-    """True when the build uses the legacy raw-gattc engine - one line to
-    flip when esp32 moves to the neutral engine (with
-    USE_BLE_CLIENT_LEGACY_ENGINE in _to_code_esp32)."""
-    return CORE.is_esp32
-
-
-def AUTO_LOAD() -> list[str]:
-    """The engine's closure per platform: the legacy esp32 engine builds on
-    esp32_ble_client plus bluetooth_connection (the shared service-table
-    materializer; its sources compile empty in builds without a neutral
-    node), the neutral engine on the bluetooth_connection backend. The
-    platform-less arm is the union for manifest-resolving tooling."""
-    if _legacy_engine() or CORE.target_platform is None:
-        return ["bluetooth_connection", "esp32_ble_client"]
-    return ["bluetooth_connection"]
-
-
+AUTO_LOAD = ["esp32_ble_client"]
 CODEOWNERS = ["@buxtronix", "@clydebarrow"]
-
-FILTER_SOURCE_FILES = filter_source_files_from_platform(
-    {
-        "ble_client.cpp": {
-            PlatformFramework.ESP32_ARDUINO,
-            PlatformFramework.ESP32_IDF,
-        },
-        # Every framework of every non-esp32 registry platform: a platform
-        # that validates the neutral arm must also compile the neutral engine.
-        "ble_client_gatt.cpp": frameworks_for_platforms(
-            set(bluetooth_connection.GATT_CLIENT_PLATFORMS) - {PLATFORM_ESP32}
-        ),
-    }
-)
+DEPENDENCIES = ["esp32_ble_tracker"]
 
 CONF_DESCRIPTOR_UUID = "descriptor_uuid"
 CONF_ON_NOTIFY = "on_notify"
@@ -113,9 +58,7 @@ def notify_from_on_notify(config: ConfigType) -> ConfigType:
 
 
 ble_client_ns = cg.esphome_ns.namespace("ble_client")
-# One codegen class for both engines: the exclusively-gated headers resolve
-# the name to exactly one C++ definition per build.
-BLEClient = ble_client_ns.class_("BLEClient", cg.Component)
+BLEClient = ble_client_ns.class_("BLEClient", esp32_ble_client.BLEClientBase)
 BLEClientNode = ble_client_ns.class_("BLEClientNode")
 BLEClientNodeConstRef = BLEClientNode.operator("ref").operator("const")
 # Triggers
@@ -162,179 +105,62 @@ CONF_AUTO_CONNECT = "auto_connect"
 
 MULTI_CONF = True
 
-# Keys shared by both engines' schemas.
-_COMMON_SCHEMA = cv.Schema(
-    {
-        cv.GenerateID(): cv.declare_id(BLEClient),
-        cv.Required(CONF_MAC_ADDRESS): cv.mac_address,
-        cv.Optional(CONF_AUTO_CONNECT, default=True): cv.boolean,
-        cv.Optional(CONF_ON_CONNECT): automation.validate_automation(
-            {
-                cv.GenerateID(CONF_TRIGGER_ID): cv.declare_id(BLEClientConnectTrigger),
-            }
-        ),
-        cv.Optional(CONF_ON_DISCONNECT): automation.validate_automation(
-            {
-                cv.GenerateID(CONF_TRIGGER_ID): cv.declare_id(
-                    BLEClientDisconnectTrigger
-                ),
-            }
-        ),
-    }
-).extend(cv.COMPONENT_SCHEMA)
-
-
-@functools.cache
-def _esp32_config_schema() -> cv.All:
-    """The legacy engine's schema, byte-compatible with what esp32 always had
-    (including the Bluedroid security triggers)."""
-    from esphome.components import esp32_ble_tracker
-
-    return cv.All(
-        _COMMON_SCHEMA.extend(
-            {
-                # Accepted-but-unused legacy key; not propagated to the
-                # neutral schema.
-                cv.Optional(CONF_NAME): cv.string,
-                cv.Optional(CONF_ON_PASSKEY_REQUEST): automation.validate_automation(
-                    {
-                        cv.GenerateID(CONF_TRIGGER_ID): cv.declare_id(
-                            BLEClientPasskeyRequestTrigger
-                        ),
-                    }
-                ),
-                cv.Optional(
-                    CONF_ON_PASSKEY_NOTIFICATION
-                ): automation.validate_automation(
-                    {
-                        cv.GenerateID(CONF_TRIGGER_ID): cv.declare_id(
-                            BLEClientPasskeyNotificationTrigger
-                        ),
-                    }
-                ),
-                cv.Optional(
-                    CONF_ON_NUMERIC_COMPARISON_REQUEST
-                ): automation.validate_automation(
-                    {
-                        cv.GenerateID(CONF_TRIGGER_ID): cv.declare_id(
-                            BLEClientNumericComparisonRequestTrigger
-                        ),
-                    }
-                ),
-            }
-        ).extend(esp32_ble_tracker.ESP_BLE_DEVICE_SCHEMA),
-        bluetooth_connection.consume_gatt_slot("ble_client"),
+CONFIG_SCHEMA = cv.All(
+    cv.Schema(
+        {
+            cv.GenerateID(): cv.declare_id(BLEClient),
+            cv.Required(CONF_MAC_ADDRESS): cv.mac_address,
+            cv.Optional(CONF_NAME): cv.string,
+            cv.Optional(CONF_AUTO_CONNECT, default=True): cv.boolean,
+            cv.Optional(CONF_ON_CONNECT): automation.validate_automation(
+                {
+                    cv.GenerateID(CONF_TRIGGER_ID): cv.declare_id(
+                        BLEClientConnectTrigger
+                    ),
+                }
+            ),
+            cv.Optional(CONF_ON_DISCONNECT): automation.validate_automation(
+                {
+                    cv.GenerateID(CONF_TRIGGER_ID): cv.declare_id(
+                        BLEClientDisconnectTrigger
+                    ),
+                }
+            ),
+            cv.Optional(CONF_ON_PASSKEY_REQUEST): automation.validate_automation(
+                {
+                    cv.GenerateID(CONF_TRIGGER_ID): cv.declare_id(
+                        BLEClientPasskeyRequestTrigger
+                    ),
+                }
+            ),
+            cv.Optional(CONF_ON_PASSKEY_NOTIFICATION): automation.validate_automation(
+                {
+                    cv.GenerateID(CONF_TRIGGER_ID): cv.declare_id(
+                        BLEClientPasskeyNotificationTrigger
+                    ),
+                }
+            ),
+            cv.Optional(
+                CONF_ON_NUMERIC_COMPARISON_REQUEST
+            ): automation.validate_automation(
+                {
+                    cv.GenerateID(CONF_TRIGGER_ID): cv.declare_id(
+                        BLEClientNumericComparisonRequestTrigger
+                    ),
+                }
+            ),
+        }
     )
-
-
-@functools.cache
-def _gatt_config_schema(platform: str) -> cv.All:
-    """The neutral engine's schema: the shared keys plus the hub reference
-    (parsed-advertisement sightings) and the GATT backend declaration.
-    Keyed by platform - the backend fragment differs per platform."""
-    return cv.All(
-        _COMMON_SCHEMA.extend(ble_device_base.BLE_DEVICE_SCHEMA).extend(
-            bluetooth_connection.gatt_client_schema(platform)
-        ),
-        bluetooth_connection.consume_gatt_slot("ble_client"),
-    )
-
-
-@schema_extractor("schema")
-def _validate_platform(config: ConfigType) -> ConfigType:
-    if config is SCHEMA_EXTRACT:
-        # Deliberate gap (the bluetooth_proxy pattern): the dumper gets only
-        # this shape, so the neutral arm's ble_hub_id is absent from editor
-        # schemas and the esp32-only keys are advertised on every platform.
-        # The language-schema dumper runs without a platform; expose the
-        # esp32 (legacy-engine) shape.
-        return _esp32_config_schema()
-    if _legacy_engine():
-        return _esp32_config_schema()(config)
-    if CORE.target_platform in bluetooth_connection.GATT_CLIENT_PLATFORMS:
-        return _gatt_config_schema(CORE.target_platform)(config)
-    raise cv.Invalid(f"ble_client is not supported on {CORE.target_platform}")
-
-
-CONFIG_SCHEMA = _validate_platform
+    .extend(cv.COMPONENT_SCHEMA)
+    .extend(esp32_ble_tracker.ESP_BLE_DEVICE_SCHEMA),
+    esp32_ble.consume_connection_slots(1, "ble_client"),
+)
 
 CONF_BLE_CLIENT_ID = "ble_client_id"
 
-
-class BLEClientFeatures(StrEnum):
-    """Per-platform engine capabilities consumers declare against."""
-
-    # The platform-neutral node interface (on_connected/table + completion
-    # callbacks) - every platform with a ble_client engine.
-    GATT_NODE = "gatt_node"
-    # The raw esp32 GATT client event stream (gattc/gap handlers,
-    # node_state) - the legacy engine only.
-    RAW_GATTC = "raw_gattc"
-    # Pairing dialog replies and bond management (Bluedroid GAP/SMP).
-    SECURITY = "security"
-
-
-def _engine_features() -> set[BLEClientFeatures]:
-    """Features the validated platform's engine provides."""
-    if _legacy_engine():
-        return {
-            BLEClientFeatures.GATT_NODE,
-            BLEClientFeatures.RAW_GATTC,
-            BLEClientFeatures.SECURITY,
-        }
-    if CORE.target_platform in bluetooth_connection.GATT_CLIENT_PLATFORMS:
-        return {BLEClientFeatures.GATT_NODE}
-    return set()
-
-
-def requires_feature(
-    feature: BLEClientFeatures, description: str
-) -> Callable[[Any], Any]:
-    """Validator gating a consumer to platforms whose engine provides
-    `feature`, naming the missing capability in the error."""
-
-    def validator(value: Any) -> Any:
-        features = _engine_features()
-        if feature not in features:
-            available = (
-                f"; this platform's engine provides: {', '.join(sorted(features))}"
-                if features
-                else ""
-            )
-            raise cv.Invalid(
-                f"{description} requires the ble_client '{feature}' feature, "
-                f"which {CORE.target_platform} does not provide{available}"
-            )
-        return value
-
-    return validator
-
-
-# The one choke point for every node component still on the raw esp32 event
-# stream; migrating to the neutral interface (NODE_BLE_CLIENT_SCHEMA +
-# register_gatt_node) lifts it.
-_legacy_engine_only = requires_feature(
-    BLEClientFeatures.RAW_GATTC,
-    "This component drives the raw ESP32 GATT client events and has not "
-    "been migrated to the platform-neutral node interface yet; it",
-)
-
 BLE_CLIENT_SCHEMA = cv.Schema(
     {
-        cv.GenerateID(CONF_BLE_CLIENT_ID): cv.All(
-            cv.use_id(BLEClient), _legacy_engine_only
-        ),
-    }
-)
-
-# For node components on the neutral interface: valid wherever ble_client
-# itself is.
-NODE_BLE_CLIENT_SCHEMA = cv.Schema(
-    {
-        cv.GenerateID(CONF_BLE_CLIENT_ID): cv.All(
-            cv.use_id(BLEClient),
-            requires_feature(BLEClientFeatures.GATT_NODE, "This component"),
-        ),
+        cv.GenerateID(CONF_BLE_CLIENT_ID): cv.use_id(BLEClient),
     }
 )
 
@@ -344,31 +170,11 @@ async def register_ble_node(var, config):
     cg.add(parent.register_ble_node(var))
 
 
-def _request_gatt_node_build() -> None:
-    """Node storage and the one define meaning "the neutral node surface is
-    compiled in", plus the esp32 bridge/materializer defines."""
-    _request_node_slot()
-    cg.add_define("USE_BLE_CLIENT_GATT_NODES")
-    if _legacy_engine():
-        # Deliberately not ble_device_base.request_gatt_client(): that would
-        # claim a phantom backend slot on combined proxy builds.
-        cg.add_define("USE_BLE_GATT_CLIENT")
-        cg.add_define("USE_BLE_GATT_BACKEND_BLUEDROID")
-        cg.add_define("USE_BLUEDROID_GATT_SERVICE_TABLE")
-
-
-async def register_gatt_node(var, config):
-    """Register a node on the platform-neutral interface (both engines)."""
-    parent = await cg.get_variable(config[CONF_BLE_CLIENT_ID])
-    _request_gatt_node_build()
-    cg.add(parent.register_gatt_node(var))
-
-
 BLE_WRITE_ACTION_SCHEMA = cv.Schema(
     {
         cv.GenerateID(CONF_ID): cv.use_id(BLEClient),
-        cv.Required(CONF_SERVICE_UUID): bt_uuid,
-        cv.Required(CONF_CHARACTERISTIC_UUID): bt_uuid,
+        cv.Required(CONF_SERVICE_UUID): esp32_ble_tracker.bt_uuid,
+        cv.Required(CONF_CHARACTERISTIC_UUID): esp32_ble_tracker.bt_uuid,
         cv.Required(CONF_VALUE): cv.templatable(cv.ensure_list(cv.hex_uint8_t)),
     }
 )
@@ -379,34 +185,25 @@ BLE_CONNECT_ACTION_SCHEMA = maybe_simple_id(
     }
 )
 
-BLE_NUMERIC_COMPARISON_REPLY_ACTION_SCHEMA = cv.All(
-    requires_feature(BLEClientFeatures.SECURITY, "This action"),
-    cv.Schema(
-        {
-            cv.GenerateID(CONF_ID): cv.use_id(BLEClient),
-            cv.Required(CONF_ACCEPT): cv.templatable(cv.boolean),
-        }
-    ),
+BLE_NUMERIC_COMPARISON_REPLY_ACTION_SCHEMA = cv.Schema(
+    {
+        cv.GenerateID(CONF_ID): cv.use_id(BLEClient),
+        cv.Required(CONF_ACCEPT): cv.templatable(cv.boolean),
+    }
 )
 
-BLE_PASSKEY_REPLY_ACTION_SCHEMA = cv.All(
-    requires_feature(BLEClientFeatures.SECURITY, "This action"),
-    cv.Schema(
-        {
-            cv.GenerateID(CONF_ID): cv.use_id(BLEClient),
-            cv.Required(CONF_PASSKEY): cv.templatable(cv.int_range(min=0, max=999999)),
-        }
-    ),
+BLE_PASSKEY_REPLY_ACTION_SCHEMA = cv.Schema(
+    {
+        cv.GenerateID(CONF_ID): cv.use_id(BLEClient),
+        cv.Required(CONF_PASSKEY): cv.templatable(cv.int_range(min=0, max=999999)),
+    }
 )
 
 
-BLE_REMOVE_BOND_ACTION_SCHEMA = cv.All(
-    requires_feature(BLEClientFeatures.SECURITY, "This action"),
-    cv.Schema(
-        {
-            cv.GenerateID(CONF_ID): cv.use_id(BLEClient),
-        }
-    ),
+BLE_REMOVE_BOND_ACTION_SCHEMA = cv.Schema(
+    {
+        cv.GenerateID(CONF_ID): cv.use_id(BLEClient),
+    }
 )
 
 
@@ -440,8 +237,6 @@ async def ble_connect_to_code(config, action_id, template_arg, args):
 )
 async def ble_write_to_code(config, action_id, template_arg, args):
     parent = await cg.get_variable(config[CONF_ID])
-    # The action registers itself as a neutral node in its constructor.
-    _request_gatt_node_build()
     var = cg.new_Pvariable(action_id, template_arg, parent)
 
     value = config[CONF_VALUE]
@@ -456,20 +251,38 @@ async def ble_write_to_code(config, action_id, template_arg, args):
         arr = cg.static_const_array(arr_id, cg.ArrayInitializer(*value))
         cg.add(var.set_value_simple(arr, len(value)))
 
-    if len(config[CONF_SERVICE_UUID]) == len(bt_uuid16_format):
-        cg.add(var.set_service_uuid16(as_hex(config[CONF_SERVICE_UUID])))
-    elif len(config[CONF_SERVICE_UUID]) == len(bt_uuid32_format):
-        cg.add(var.set_service_uuid32(as_hex(config[CONF_SERVICE_UUID])))
-    elif len(config[CONF_SERVICE_UUID]) == len(bt_uuid128_format):
-        uuid128 = as_reversed_hex_array(config[CONF_SERVICE_UUID])
+    if len(config[CONF_SERVICE_UUID]) == len(esp32_ble_tracker.bt_uuid16_format):
+        cg.add(
+            var.set_service_uuid16(esp32_ble_tracker.as_hex(config[CONF_SERVICE_UUID]))
+        )
+    elif len(config[CONF_SERVICE_UUID]) == len(esp32_ble_tracker.bt_uuid32_format):
+        cg.add(
+            var.set_service_uuid32(esp32_ble_tracker.as_hex(config[CONF_SERVICE_UUID]))
+        )
+    elif len(config[CONF_SERVICE_UUID]) == len(esp32_ble_tracker.bt_uuid128_format):
+        uuid128 = esp32_ble_tracker.as_reversed_hex_array(config[CONF_SERVICE_UUID])
         cg.add(var.set_service_uuid128(uuid128))
 
-    if len(config[CONF_CHARACTERISTIC_UUID]) == len(bt_uuid16_format):
-        cg.add(var.set_char_uuid16(as_hex(config[CONF_CHARACTERISTIC_UUID])))
-    elif len(config[CONF_CHARACTERISTIC_UUID]) == len(bt_uuid32_format):
-        cg.add(var.set_char_uuid32(as_hex(config[CONF_CHARACTERISTIC_UUID])))
-    elif len(config[CONF_CHARACTERISTIC_UUID]) == len(bt_uuid128_format):
-        uuid128 = as_reversed_hex_array(config[CONF_CHARACTERISTIC_UUID])
+    if len(config[CONF_CHARACTERISTIC_UUID]) == len(esp32_ble_tracker.bt_uuid16_format):
+        cg.add(
+            var.set_char_uuid16(
+                esp32_ble_tracker.as_hex(config[CONF_CHARACTERISTIC_UUID])
+            )
+        )
+    elif len(config[CONF_CHARACTERISTIC_UUID]) == len(
+        esp32_ble_tracker.bt_uuid32_format
+    ):
+        cg.add(
+            var.set_char_uuid32(
+                esp32_ble_tracker.as_hex(config[CONF_CHARACTERISTIC_UUID])
+            )
+        )
+    elif len(config[CONF_CHARACTERISTIC_UUID]) == len(
+        esp32_ble_tracker.bt_uuid128_format
+    ):
+        uuid128 = esp32_ble_tracker.as_reversed_hex_array(
+            config[CONF_CHARACTERISTIC_UUID]
+        )
         cg.add(var.set_char_uuid128(uuid128))
 
     return var
@@ -526,45 +339,14 @@ async def remove_bond_to_code(config, action_id, template_arg, args):
     return cg.new_Pvariable(action_id, template_arg, parent)
 
 
-async def _to_code_esp32(config: ConfigType) -> cg.MockObj:
-    from esphome.components import esp32_ble, esp32_ble_tracker
-    from esphome.components.esp32_ble import BTLoggers
-
+async def to_code(config):
     # Register the loggers this component needs
     esp32_ble.register_bt_logger(BTLoggers.GATT, BTLoggers.SMP)
     cg.add_define("USE_ESP32_BLE_UUID")
-    cg.add_define("USE_BLE_CLIENT_LEGACY_ENGINE")
 
     var = cg.new_Pvariable(config[CONF_ID])
     await cg.register_component(var, config)
     await esp32_ble_tracker.register_client(var, config)
-    return var
-
-
-# Sizes the neutral client's node storage; the client itself requests a
-# baseline slot so the define exists on every build that compiles the engine.
-_request_node_slot = cg.slot_counter("ESPHOME_BLE_CLIENT_MAX_NODES")
-
-
-async def _to_code_gatt(config: ConfigType) -> cg.MockObj:
-    # The engine always carries the node surface (the client itself owns the
-    # baseline slot).
-    _request_gatt_node_build()
-    backend = await bluetooth_connection.new_gatt_backend(config)
-    var = cg.new_Pvariable(config[CONF_ID])
-    await cg.register_component(var, config)
-    cg.add(var.set_backend(backend))
-    # Sighting-gated connects: the client listens for the peer's parsed
-    # advertisements through the hub.
-    await ble_device_base.register_ble_device(var, config)
-    return var
-
-
-async def to_code(config: ConfigType) -> None:
-    if _legacy_engine():
-        var = await _to_code_esp32(config)
-    else:
-        var = await _to_code_gatt(config)
     cg.add(var.set_address(config[CONF_MAC_ADDRESS].as_hex))
     cg.add(var.set_auto_connect(config[CONF_AUTO_CONNECT]))
     for conf in config.get(CONF_ON_CONNECT, []):

esphome/components/ble_client/automation.cpp

@@ -0,0 +1,11 @@
+#ifdef USE_ESP32
+
+#include "automation.h"
+
+namespace esphome::ble_client {
+
+const char *const Automation::TAG = "ble_client.automation";
+
+}  // namespace esphome::ble_client
+
+#endif

esphome/components/ble_client/automation.h

@@ -1,14 +1,27 @@
 #pragma once
 
-#include "esphome/core/defines.h"
+#ifdef USE_ESP32
 
-#ifdef USE_BLE_CLIENT_LEGACY_ENGINE
+#include <utility>
+#include <vector>
 
 #include "esphome/core/automation.h"
 #include "esphome/components/ble_client/ble_client.h"
+#include "esphome/core/helpers.h"
+#include "esphome/core/log.h"
+
+// Maximum bytes to log in hex format for BLE writes (many logging buffers are 256 chars)
+static constexpr size_t BLE_WRITE_MAX_LOG_BYTES = 64;
 
 namespace esphome::ble_client {
 
+// placeholder class for static TAG .
+class Automation {
+ public:
+  // could be made inline with C++17
+  static const char *const TAG;
+};
+
 // implement on_connect automation.
 class BLEClientConnectTrigger final : public Trigger<>, public BLEClientNode {
  public:
@@ -80,6 +93,144 @@ class BLEClientNumericComparisonRequestTrigger final : public Trigger<uint32_t>,
   }
 };
 
+// implement the ble_client.ble_write action.
+template<typename... Ts> class BLEClientWriteAction final : public Action<Ts...>, public BLEClientNode {
+ public:
+  BLEClientWriteAction(BLEClient *ble_client) {
+    ble_client->register_ble_node(this);
+    ble_client_ = ble_client;
+  }
+
+  void set_service_uuid16(uint16_t uuid) { this->service_uuid_ = espbt::ESPBTUUID::from_uint16(uuid); }
+  void set_service_uuid32(uint32_t uuid) { this->service_uuid_ = espbt::ESPBTUUID::from_uint32(uuid); }
+  void set_service_uuid128(uint8_t *uuid) { this->service_uuid_ = espbt::ESPBTUUID::from_raw(uuid); }
+
+  void set_char_uuid16(uint16_t uuid) { this->char_uuid_ = espbt::ESPBTUUID::from_uint16(uuid); }
+  void set_char_uuid32(uint32_t uuid) { this->char_uuid_ = espbt::ESPBTUUID::from_uint32(uuid); }
+  void set_char_uuid128(uint8_t *uuid) { this->char_uuid_ = espbt::ESPBTUUID::from_raw(uuid); }
+
+  void set_value_template(std::vector<uint8_t> (*func)(Ts...)) {
+    this->value_.func = func;
+    this->len_ = -1;  // Sentinel value indicates template mode
+  }
+
+  // Store pointer to static data in flash (no RAM copy)
+  void set_value_simple(const uint8_t *data, size_t len) {
+    this->value_.data = data;
+    this->len_ = len;  // Length >= 0 indicates static mode
+  }
+
+  void play(const Ts &...x) override {}
+
+  void play_complex(const Ts &...x) override {
+    this->num_running_++;
+    this->var_ = std::make_tuple(x...);
+
+    bool result;
+    if (this->len_ >= 0) {
+      // Static mode: write directly from flash pointer
+      result = this->write(this->value_.data, this->len_);
+    } else {
+      // Template mode: call function and write the vector
+      std::vector<uint8_t> value = this->value_.func(x...);
+      result = this->write(value);
+    }
+
+    // on write failure, continue the automation chain rather than stopping so that e.g. disconnect can work.
+    if (!result)
+      this->play_next_(x...);
+  }
+
+  /**
+   * Note about logging: the esph_log_X macros are used here because the CI checks complain about use of the ESP LOG
+   * macros in header files (Can't even write it in a comment!)
+   * Not sure why, because they seem to work just fine.
+   * The problem is that the implementation of a templated class can't be placed in a .cpp file when using C++ less than
+   * 17, so the methods have to be here.  The esph_log_X macros are equivalent in function, but don't trigger the CI
+   * errors.
+   */
+  // initiate the write. Return true if all went well, will be followed by a WRITE_CHAR event.
+  bool write(const uint8_t *data, size_t len) {
+    if (this->node_state != espbt::ClientState::ESTABLISHED) {
+      esph_log_w(Automation::TAG, "Cannot write to BLE characteristic - not connected");
+      return false;
+    }
+#if ESPHOME_LOG_LEVEL >= ESPHOME_LOG_LEVEL_VERY_VERBOSE
+    char hex_buf[format_hex_pretty_size(BLE_WRITE_MAX_LOG_BYTES)];
+    esph_log_vv(Automation::TAG, "Will write %d bytes: %s", len, format_hex_pretty_to(hex_buf, data, len));
+#endif
+    esp_err_t err =
+        esp_ble_gattc_write_char(this->parent()->get_gattc_if(), this->parent()->get_conn_id(), this->char_handle_, len,
+                                 const_cast<uint8_t *>(data), this->write_type_, ESP_GATT_AUTH_REQ_NONE);
+    if (err != ESP_OK) {
+      esph_log_e(Automation::TAG, "Error writing to characteristic: %s!", esp_err_to_name(err));
+      return false;
+    }
+    return true;
+  }
+
+  bool write(const std::vector<uint8_t> &value) { return this->write(value.data(), value.size()); }
+
+  void gattc_event_handler(esp_gattc_cb_event_t event, esp_gatt_if_t gattc_if,
+                           esp_ble_gattc_cb_param_t *param) override {
+    switch (event) {
+      case ESP_GATTC_WRITE_CHAR_EVT:
+        // upstream code checked the MAC address, verify the characteristic.
+        if (param->write.handle == this->char_handle_)
+          this->parent()->run_later([this]() { this->play_next_tuple_(this->var_); });
+        break;
+      case ESP_GATTC_DISCONNECT_EVT:
+        if (this->num_running_ != 0)
+          this->stop_complex();
+        break;
+      case ESP_GATTC_SEARCH_CMPL_EVT: {
+        auto *chr = this->parent()->get_characteristic(this->service_uuid_, this->char_uuid_);
+        if (chr == nullptr) {
+          char char_buf[esp32_ble::UUID_STR_LEN];
+          char service_buf[esp32_ble::UUID_STR_LEN];
+          esph_log_w("ble_write_action", "Characteristic %s was not found in service %s",
+                     this->char_uuid_.to_str(char_buf), this->service_uuid_.to_str(service_buf));
+          break;
+        }
+        this->char_handle_ = chr->handle;
+        this->char_props_ = chr->properties;
+        if (this->char_props_ & ESP_GATT_CHAR_PROP_BIT_WRITE) {
+          this->write_type_ = ESP_GATT_WRITE_TYPE_RSP;
+          esph_log_d(Automation::TAG, "Write type: ESP_GATT_WRITE_TYPE_RSP");
+        } else if (this->char_props_ & ESP_GATT_CHAR_PROP_BIT_WRITE_NR) {
+          this->write_type_ = ESP_GATT_WRITE_TYPE_NO_RSP;
+          esph_log_d(Automation::TAG, "Write type: ESP_GATT_WRITE_TYPE_NO_RSP");
+        } else {
+          char char_buf[esp32_ble::UUID_STR_LEN];
+          esph_log_e(Automation::TAG, "Characteristic %s does not allow writing", this->char_uuid_.to_str(char_buf));
+          break;
+        }
+        this->node_state = espbt::ClientState::ESTABLISHED;
+        char char_buf[esp32_ble::UUID_STR_LEN];
+        esph_log_d(Automation::TAG, "Found characteristic %s on device %s", this->char_uuid_.to_str(char_buf),
+                   ble_client_->address_str());
+        break;
+      }
+      default:
+        break;
+    }
+  }
+
+ private:
+  BLEClient *ble_client_;
+  ssize_t len_{-1};  // -1 = template mode, >=0 = static mode with length
+  union Value {
+    std::vector<uint8_t> (*func)(Ts...);  // Function pointer (stateless lambdas)
+    const uint8_t *data;                  // Pointer to static data in flash
+  } value_;
+  espbt::ESPBTUUID service_uuid_;
+  espbt::ESPBTUUID char_uuid_;
+  std::tuple<Ts...> var_{};
+  uint16_t char_handle_{};
+  esp_gatt_char_prop_t char_props_{};
+  esp_gatt_write_type_t write_type_{};
+};
+
 template<typename... Ts> class BLEClientPasskeyReplyAction final : public Action<Ts...> {
  public:
   BLEClientPasskeyReplyAction(BLEClient *ble_client) { parent_ = ble_client; }

esphome/components/ble_client/automation_gatt.h

@@ -1,118 +0,0 @@
-// Neutral twins of the shared ble_client automations. Class names, namespace,
-// and codegen-visible signatures are IDENTICAL to automation.h so generated
-// main.cpp compiles against whichever engine the build gates in; only the
-// internals differ (client callbacks and the neutral node interface instead
-// of raw gattc events). The Bluedroid-security automations (passkey, numeric
-// comparison, remove bond) have no neutral equivalent and stay esp32-only.
-
-#pragma once
-
-#include "esphome/core/defines.h"
-
-#if defined(USE_BLE_GATT_CLIENT) && !defined(USE_BLE_CLIENT_LEGACY_ENGINE)
-
-#include <tuple>
-
-#include "ble_client_gatt.h"
-#include "esphome/core/automation.h"
-
-namespace esphome::ble_client {
-
-class BLEClientConnectTrigger final : public Trigger<> {
- public:
-  explicit BLEClientConnectTrigger(BLEClient *parent) {
-    parent->add_on_connect_callback([this]() { this->trigger(); });
-  }
-};
-
-class BLEClientDisconnectTrigger final : public Trigger<> {
- public:
-  explicit BLEClientDisconnectTrigger(BLEClient *parent) {
-    // Fires only after a completed connection (never for failed attempts),
-    // matching the legacy CLOSE_EVT semantics.
-    parent->add_on_disconnect_callback([this]() { this->trigger(); });
-  }
-};
-
-template<typename... Ts> class BLEClientConnectAction final : public Action<Ts...> {
- public:
-  BLEClientConnectAction(BLEClient *ble_client) {
-    ble_client_ = ble_client;
-    ble_client->add_on_connect_callback([this]() {
-      if (this->num_running_ != 0)
-        this->play_next_tuple_(this->var_);
-    });
-    // A connect attempt that dies (or a later disconnect) terminates the
-    // chain, mirroring the legacy DISCONNECT_EVT handling.
-    ble_client->add_on_connect_failed_callback([this]() {
-      if (this->num_running_ != 0)
-        this->stop_complex();
-    });
-    ble_client->add_on_disconnect_callback([this]() {
-      if (this->num_running_ != 0)
-        this->stop_complex();
-    });
-  }
-
-  // not used since we override play_complex_
-  void play(const Ts &...x) override {}
-
-  void play_complex(const Ts &...x) override {
-    // it makes no sense to have multiple instances of this running at the
-    // same time; cancel a re-trigger while still running.
-    if (this->num_running_ != 0) {
-      this->stop_complex();
-      return;
-    }
-    this->num_running_++;
-    if (this->ble_client_->connected()) {
-      this->play_next_(x...);
-    } else {
-      this->var_ = std::make_tuple(x...);
-      // No-op while already connecting; the callback resolves the wait.
-      this->ble_client_->connect();
-    }
-  }
-
- private:
-  BLEClient *ble_client_;
-  std::tuple<Ts...> var_{};
-};
-
-template<typename... Ts> class BLEClientDisconnectAction final : public Action<Ts...> {
- public:
-  BLEClientDisconnectAction(BLEClient *ble_client) {
-    ble_client_ = ble_client;
-    // Both terminal outcomes resolve the wait: a completed teardown and a
-    // connect attempt that died on the way down.
-    ble_client->add_on_disconnect_callback([this]() {
-      if (this->num_running_ != 0)
-        this->play_next_tuple_(this->var_);
-    });
-    ble_client->add_on_connect_failed_callback([this]() {
-      if (this->num_running_ != 0)
-        this->play_next_tuple_(this->var_);
-    });
-  }
-
-  // not used since we override play_complex_
-  void play(const Ts &...x) override {}
-
-  void play_complex(const Ts &...x) override {
-    this->num_running_++;
-    if (this->ble_client_->idle()) {
-      this->play_next_(x...);
-    } else {
-      this->var_ = std::make_tuple(x...);
-      this->ble_client_->disconnect();
-    }
-  }
-
- private:
-  BLEClient *ble_client_;
-  std::tuple<Ts...> var_{};
-};
-
-}  // namespace esphome::ble_client
-
-#endif  // USE_BLE_GATT_CLIENT && !USE_BLE_CLIENT_LEGACY_ENGINE

esphome/components/ble_client/ble_client.cpp

@@ -2,16 +2,10 @@
 #include "esphome/components/esp32_ble_client/ble_client_base.h"
 #include "esphome/components/esp32_ble_tracker/esp32_ble_tracker.h"
 #include "esphome/core/application.h"
-#include "esphome/core/hal.h"
 #include "esphome/core/helpers.h"
 #include "esphome/core/log.h"
 
-#ifdef USE_BLE_CLIENT_LEGACY_ENGINE
-
-#ifdef USE_BLE_CLIENT_GATT_NODES
-#include "esphome/components/bluetooth_connection/bluetooth_connection.h"
-#include "esphome/components/bluetooth_connection/gatt_service_table_bluedroid.h"
-#endif
+#ifdef USE_ESP32
 
 namespace esphome::ble_client {
 
@@ -36,10 +30,6 @@ void BLEClient::dump_config() {
 bool BLEClient::parse_device(const espbt::ESPBTDevice &device) {
   if (!this->enabled)
     return false;
-#ifdef USE_BLE_CLIENT_GATT_NODES
-  if (device.address_uint64() == this->address_ && this->gatt_backoff_.holding_off())
-    return false;
-#endif
   return BLEClientBase::parse_device(device);
 }
 
@@ -50,60 +40,24 @@ void BLEClient::set_enabled(bool enabled) {
   if (!enabled) {
     ESP_LOGI(TAG, "[%s] Disabling BLE client.", this->address_str());
     this->disconnect();
-    return;
   }
-#ifdef USE_BLE_CLIENT_GATT_NODES
-  // A re-enable clears the backoff (neutral-engine parity).
-  this->gatt_backoff_.reset();
-#endif
 }
 
 bool BLEClient::gattc_event_handler(esp_gattc_cb_event_t event, esp_gatt_if_t esp_gattc_if,
                                     esp_ble_gattc_cb_param_t *param) {
-#ifdef USE_BLE_CLIENT_GATT_NODES
-  // Bridge-initiated registrations bypass the base's REG_FOR_NOTIFY handling:
-  // its automatic CCCD write would double the node's own.
-  // Handle-keyed: mixed legacy/neutral subscriptions to one characteristic
-  // are unsupported during the migration window.
-  if (event == ESP_GATTC_REG_FOR_NOTIFY_EVT && esp_gattc_if == this->gattc_if_ &&
-      this->take_pending_gatt_reg_(param->reg_for_notify.handle)) {
-    if (this->pending_notify_regs_ > 0)
-      this->pending_notify_regs_--;
-    int err = param->reg_for_notify.status == ESP_GATT_OK ? 0 : param->reg_for_notify.status;
-    this->notify_state_to_gatt_nodes_(param->reg_for_notify.handle, true, err);
-    // A retiring last registration must still release the cache.
-    this->maybe_release_services_();
-    return true;
-  }
-#endif
   if (!BLEClientBase::gattc_event_handler(event, esp_gattc_if, param))
     return false;
 
-#ifdef USE_BLE_CLIENT_GATT_NODES
-  // Before the legacy fan-out so gatt nodes resolve before any trigger fires.
-  if (!this->gatt_nodes_.empty()) {
-    if (event == ESP_GATTC_SEARCH_CMPL_EVT) {
-      // A failed discovery tears the link down; the on_connect trigger must
-      // not fire into the teardown.
-      if (!this->handle_gatt_search_cmpl_(param->search_cmpl.status))
-        return true;
-    } else {
-      this->dispatch_gatt_event_(event, param);
-    }
-  }
-#endif
   for (auto *node : this->nodes_)
     node->gattc_event_handler(event, esp_gattc_if, param);
-  this->maybe_release_services_();
-  return true;
-}
 
-void BLEClient::maybe_release_services_() {
   // The release frees the GATT cache that BLEClientBase's CCCD lookup still needs.
+  // The last REG_FOR_NOTIFY event clears the counter before node dispatch, so the release still runs here.
   if (!this->services_.empty() && !this->notify_registration_pending() && this->all_nodes_established_()) {
     this->release_services();
     ESP_LOGD(TAG, "All clients established, services released");
   }
+  return true;
 }
 
 void BLEClient::gap_event_handler(esp_gap_ble_cb_event_t event, esp_ble_gap_cb_param_t *param) {
@@ -111,19 +65,10 @@ void BLEClient::gap_event_handler(esp_gap_ble_cb_event_t event, esp_ble_gap_cb_p
 
   for (auto *node : this->nodes_)
     node->gap_event_handler(event, param);
-#ifdef USE_BLE_CLIENT_GATT_NODES
-  if (event == ESP_GAP_BLE_AUTH_CMPL_EVT && this->check_addr(param->ble_security.auth_cmpl.bd_addr)) {
-    int status = param->ble_security.auth_cmpl.success ? 0 : param->ble_security.auth_cmpl.fail_reason;
-    for (auto *node : this->gatt_nodes_)
-      node->on_pairing_result(status);
-  }
-#endif
 }
 
 void BLEClient::set_state(espbt::ClientState state) {
   BLEClientBase::set_state(state);
-  // ESTABLISHED never flows through here; gatt nodes are promoted after the
-  // on_connected fan-out.
   for (auto &node : nodes_)
     node->node_state = state;
 }
@@ -138,218 +83,6 @@ bool BLEClient::all_nodes_established_() {
   return true;
 }
 
-#ifdef USE_BLE_CLIENT_GATT_NODES
-
-void BLEClient::register_gatt_node(BLEClientNode *node) {
-  // Parent before the capacity check so a dropped node still has a usable
-  // parent() (neutral-engine parity).
-  node->set_ble_client_parent(this);
-  if (this->gatt_nodes_.size() == ESPHOME_BLE_CLIENT_MAX_NODES) {
-    // push_back past capacity is a silent no-op; an undersized slot count
-    // must be loud at boot, not an unresolvable node at runtime.
-    ESP_LOGE(TAG, "[%s] Node capacity exceeded; node dropped", this->address_str());
-    this->status_set_error(LOG_STR("node capacity exceeded"));
-    return;
-  }
-  this->gatt_nodes_.push_back(node);
-  // nodes_ covers the shared state bookkeeping; gatt_nodes_ is the neutral
-  // fan-out subset.
-  this->register_ble_node(node);
-}
-
-int BLEClient::find_pending_gatt_reg_(uint16_t handle) const {
-  for (uint8_t i = 0; i < this->pending_gatt_reg_count_; i++) {
-    if (this->pending_gatt_regs_[i] == handle)
-      return i;
-  }
-  return -1;
-}
-
-bool BLEClient::take_pending_gatt_reg_(uint16_t handle) {
-  int i = this->find_pending_gatt_reg_(handle);
-  if (i < 0)
-    return false;
-  // No duplicates (notify_characteristic refuses a re-push); swap-with-last.
-  this->pending_gatt_regs_[i] = this->pending_gatt_regs_[--this->pending_gatt_reg_count_];
-  return true;
-}
-
-void BLEClient::notify_state_to_gatt_nodes_(uint16_t handle, bool enabled, int error) {
-  if (error != 0) {
-    ESP_LOGW(TAG, "[%s] Notify %s on handle 0x%04x failed, status=%d", this->address_str(),
-             enabled ? "enable" : "disable", handle, error);
-  }
-  for (auto *node : this->gatt_nodes_)
-    node->on_notify_state(handle, enabled, error);
-}
-
-void BLEClient::dispatch_gatt_event_(esp_gattc_cb_event_t event, esp_ble_gattc_cb_param_t *param) {
-  switch (event) {
-    case ESP_GATTC_READ_CHAR_EVT:
-    case ESP_GATTC_READ_DESCR_EVT: {
-      bool ok = param->read.status == ESP_GATT_OK;
-      if (!ok) {
-        // Breadcrumb even when no node claims the handle.
-        ESP_LOGD(TAG, "[%s] Read on handle 0x%04x completed with status %d", this->address_str(), param->read.handle,
-                 param->read.status);
-      }
-      for (auto *node : this->gatt_nodes_) {
-        node->on_read_result(param->read.handle, ok ? param->read.value : nullptr, ok ? param->read.value_len : 0,
-                             ok ? 0 : param->read.status);
-      }
-      break;
-    }
-    case ESP_GATTC_WRITE_CHAR_EVT:
-    case ESP_GATTC_WRITE_DESCR_EVT:
-      if (param->write.status != ESP_GATT_OK) {
-        // Breadcrumb even when no node claims the handle.
-        ESP_LOGD(TAG, "[%s] Write on handle 0x%04x completed with status %d", this->address_str(), param->write.handle,
-                 param->write.status);
-      }
-      for (auto *node : this->gatt_nodes_) {
-        node->on_write_result(param->write.handle, param->write.status == ESP_GATT_OK ? 0 : param->write.status);
-      }
-      break;
-    case ESP_GATTC_NOTIFY_EVT:
-      for (auto *node : this->gatt_nodes_) {
-        node->on_notify(param->notify.handle, param->notify.value, param->notify.value_len);
-      }
-      break;
-    case ESP_GATTC_UNREG_FOR_NOTIFY_EVT:
-      // The base does no CCCD work for unregister; no interception needed.
-      this->notify_state_to_gatt_nodes_(
-          param->unreg_for_notify.handle, false,
-          param->unreg_for_notify.status == ESP_GATT_OK ? 0 : param->unreg_for_notify.status);
-      break;
-    default:
-      break;
-  }
-}
-
-bool BLEClient::handle_gatt_search_cmpl_(esp_gatt_status_t status) {
-  // The base ignores the search status; the neutral contract must not.
-  uint16_t service_total = 0;
-  bool counted = status == ESP_GATT_OK && bluetooth_connection::BluedroidServiceTable::count_services(
-                                              this->gattc_if_, this->conn_id_, &service_total);
-  if (!counted || service_total == 0) {
-    // A failed search poisons the whole discovery, legacy nodes included.
-    ESP_LOGW(TAG, "[%s] Discovery failed (status=%d, services=%u)", this->address_str(), status, service_total);
-    this->gatt_backoff_.register_failure(this->address_str());
-    this->disconnect();
-    return false;
-  }
-  // Stack-owned; nodes copy their handles during on_connected().
-  bluetooth_connection::BluedroidServiceTable table;
-  if (!table.build(this->gattc_if_, this->conn_id_, service_total, this->connection_index_)) {
-    if (!this->has_legacy_nodes_()) {
-      ESP_LOGW(TAG, "[%s] Service table build failed; treating as failed discovery", this->address_str());
-      this->gatt_backoff_.register_failure(this->address_str());
-      this->disconnect();
-      return false;
-    }
-    // Only the table build failed; legacy nodes read the base's services_
-    // and keep the link. Gatt nodes catch the next connection.
-    ESP_LOGW(TAG, "[%s] Service table build failed; gatt nodes skip this connection", this->address_str());
-    this->status_set_warning(LOG_STR("gatt nodes inactive: service table build failed"));
-  } else {
-    this->gatt_connected_ = true;
-    auto view = table.view();
-    for (auto *node : this->gatt_nodes_) {
-      node->on_connected(view);
-      if (this->state() != espbt::ClientState::ESTABLISHED) {
-        // The node tore the link down; remaining nodes get on_disconnected
-        // with no preceding on_connected, so leave a trace of why.
-        ESP_LOGW(TAG, "[%s] A node aborted the connection during setup", this->address_str());
-        return false;
-      }
-    }
-    this->gatt_backoff_.reset();
-    this->status_clear_warning();
-  }
-  // Promote so the legacy release condition can fire.
-  for (auto *node : this->gatt_nodes_)
-    node->node_state = espbt::ClientState::ESTABLISHED;
-  return true;
-}
-
-void BLEClient::on_disconnect_complete(esp_err_t reason) {
-  this->pending_gatt_reg_count_ = 0;
-  if (!this->gatt_connected_)
-    return;  // Never-established links report nothing (neutral parity).
-  this->gatt_connected_ = false;
-  for (auto *node : this->gatt_nodes_)
-    node->on_disconnected();
-}
-
-int BLEClient::check_and_log_error_(const char *operation, esp_err_t err) {
-  if (err != ESP_OK)
-    this->log_gattc_warning_(operation, err);
-  return err;
-}
-
-int BLEClient::write_characteristic(uint16_t handle, const uint8_t *data, uint16_t len, bool response) {
-  if (this->conn_id_ == UNSET_CONN_ID)
-    return ble_device_base::GATT_ERR_NOT_CONNECTED;
-  return this->check_and_log_error_(
-      "esp_ble_gattc_write_char",
-      esp_ble_gattc_write_char(this->gattc_if_, this->conn_id_, handle, len, const_cast<uint8_t *>(data),
-                               response ? ESP_GATT_WRITE_TYPE_RSP : ESP_GATT_WRITE_TYPE_NO_RSP,
-                               ESP_GATT_AUTH_REQ_NONE));
-}
-
-int BLEClient::read_characteristic(uint16_t handle) {
-  if (this->conn_id_ == UNSET_CONN_ID)
-    return ble_device_base::GATT_ERR_NOT_CONNECTED;
-  return this->check_and_log_error_("esp_ble_gattc_read_char", esp_ble_gattc_read_char(this->gattc_if_, this->conn_id_,
-                                                                                       handle, ESP_GATT_AUTH_REQ_NONE));
-}
-
-int BLEClient::read_descriptor(uint16_t handle) {
-  if (this->conn_id_ == UNSET_CONN_ID)
-    return ble_device_base::GATT_ERR_NOT_CONNECTED;
-  return this->check_and_log_error_(
-      "esp_ble_gattc_read_char_descr",
-      esp_ble_gattc_read_char_descr(this->gattc_if_, this->conn_id_, handle, ESP_GATT_AUTH_REQ_NONE));
-}
-
-int BLEClient::write_descriptor(uint16_t handle, const uint8_t *data, uint16_t len) {
-  if (this->conn_id_ == UNSET_CONN_ID)
-    return ble_device_base::GATT_ERR_NOT_CONNECTED;
-  return this->check_and_log_error_(
-      "esp_ble_gattc_write_char_descr",
-      esp_ble_gattc_write_char_descr(this->gattc_if_, this->conn_id_, handle, len, const_cast<uint8_t *>(data),
-                                     ESP_GATT_WRITE_TYPE_RSP, ESP_GATT_AUTH_REQ_NONE));
-}
-
-int BLEClient::notify_characteristic(uint16_t handle, bool enable) {
-  if (this->conn_id_ == UNSET_CONN_ID)
-    return ble_device_base::GATT_ERR_NOT_CONNECTED;
-  if (enable) {
-    if (this->find_pending_gatt_reg_(handle) >= 0) {
-      // ESP_OK: the in-flight registration's completion fans out to all nodes.
-      ESP_LOGW(TAG, "[%s] Notify registration already pending for handle 0x%04x", this->address_str(), handle);
-      return ESP_OK;
-    }
-    if (this->pending_gatt_reg_count_ == MAX_PENDING_NOTIFY_REGS) {
-      // An untracked registration would let the base's auto-CCCD through.
-      ESP_LOGE(TAG, "[%s] Too many pending notify registrations", this->address_str());
-      return ble_device_base::GATT_ERR_NO_MEMORY;
-    }
-    // The base helper's pending count holds the service-release until the
-    // (intercepted) completion.
-    esp_err_t err = this->register_for_notify(handle);
-    if (err == ESP_OK)
-      this->pending_gatt_regs_[this->pending_gatt_reg_count_++] = handle;
-    return this->check_and_log_error_("esp_ble_gattc_register_for_notify", err);
-  }
-  return this->check_and_log_error_("esp_ble_gattc_unregister_for_notify",
-                                    esp_ble_gattc_unregister_for_notify(this->gattc_if_, this->remote_bda_, handle));
-}
-
-int BLEClient::unpair() { return bluetooth_connection::unpair_device(this->get_address()); }
-
-#endif  // USE_BLE_CLIENT_GATT_NODES
-
 }  // namespace esphome::ble_client
 
 #endif

esphome/components/ble_client/ble_client.h

@@ -1,20 +1,18 @@
 #pragma once
 
-#include "esphome/core/defines.h"
-
-#ifdef USE_BLE_CLIENT_LEGACY_ENGINE
-
-#include "ble_client_node.h"
-#include "connect_backoff.h"
 #include "esphome/components/esp32_ble_client/ble_client_base.h"
 #include "esphome/components/esp32_ble_tracker/esp32_ble_tracker.h"
 #include "esphome/core/component.h"
 #include "esphome/core/helpers.h"
 
+#ifdef USE_ESP32
+
 #include <esp_bt_defs.h>
 #include <esp_gap_ble_api.h>
 #include <esp_gatt_common_api.h>
 #include <esp_gattc_api.h>
+#include <array>
+#include <string>
 #include <vector>
 
 namespace esphome::ble_client {
@@ -23,6 +21,34 @@ namespace espbt = esphome::esp32_ble_tracker;
 
 using namespace esp32_ble_client;
 
+class BLEClient;
+
+class BLEClientNode {
+ public:
+  virtual void gattc_event_handler(esp_gattc_cb_event_t event, esp_gatt_if_t gattc_if,
+                                   esp_ble_gattc_cb_param_t *param){};
+  virtual void gap_event_handler(esp_gap_ble_cb_event_t event, esp_ble_gap_cb_param_t *param) {}
+  virtual void loop() {}
+  void set_address(uint64_t address) { address_ = address; }
+  espbt::ESPBTClient *client;
+  // This should be transitioned to Established once the node no longer needs
+  // the services/descriptors/characteristics of the parent client. This will
+  // allow some memory to be freed.
+  // The parent frees the peer's GATT cache once every node reports Established.
+  // Never report Established while an operation that reads that cache is outstanding.
+  // - esp_ble_gattc_register_for_notify() completes asynchronously.
+  // - Register from ESP_GATTC_SEARCH_CMPL_EVT, then set this from ESP_GATTC_REG_FOR_NOTIFY_EVT.
+  // - BLEClientBase::register_for_notify() holds the release until the registration completes.
+  espbt::ClientState node_state;
+
+  BLEClient *parent() { return this->parent_; }
+  void set_ble_client_parent(BLEClient *parent) { this->parent_ = parent; }
+
+ protected:
+  BLEClient *parent_;
+  uint64_t address_;
+};
+
 class BLEClient final : public BLEClientBase {
  public:
   void setup() override;
@@ -38,6 +64,7 @@ class BLEClient final : public BLEClientBase {
   void set_enabled(bool enabled);
 
   void register_ble_node(BLEClientNode *node) {
+    node->client = this;
     node->set_ble_client_parent(this);
     this->nodes_.push_back(node);
   }
@@ -46,57 +73,10 @@ class BLEClient final : public BLEClientBase {
 
   void set_state(espbt::ClientState state) override;
 
-#ifdef USE_BLE_CLIENT_GATT_NODES
-  // ---- the neutral node surface (signatures shared with the non-esp32
-  // engine, so nodes on the neutral interface compile against either) ----
-  void register_gatt_node(BLEClientNode *node);
-
-  bool idle() const { return this->state() == espbt::ClientState::IDLE; }
-
-  int write_characteristic(uint16_t handle, const uint8_t *data, uint16_t len, bool response);
-  int read_characteristic(uint16_t handle);
-  int read_descriptor(uint16_t handle);
-  int write_descriptor(uint16_t handle, const uint8_t *data, uint16_t len);
-  /// Local registration only; per the neutral contract the CCCD write is the
-  /// node's job (the legacy auto-CCCD is suppressed for these handles).
-  int notify_characteristic(uint16_t handle, bool enable);
-  // pair() comes from BLEClientBase, matching the neutral engine's.
-  int unpair();
-#endif
-
  protected:
   bool all_nodes_established_();
-  void maybe_release_services_();
-#ifdef USE_BLE_CLIENT_GATT_NODES
-  int check_and_log_error_(const char *operation, esp_err_t err);
-  int find_pending_gatt_reg_(uint16_t handle) const;
-  void notify_state_to_gatt_nodes_(uint16_t handle, bool enabled, int error);
-  void dispatch_gatt_event_(esp_gattc_cb_event_t event, esp_ble_gattc_cb_param_t *param);
-  // False = failed discovery: the link comes down and the caller suppresses
-  // the legacy fan-out.
-  bool handle_gatt_search_cmpl_(esp_gatt_status_t status);
-  bool take_pending_gatt_reg_(uint16_t handle);
-  void on_disconnect_complete(esp_err_t reason) override;
-#endif
 
   std::vector<BLEClientNode *> nodes_;
-#ifdef USE_BLE_CLIENT_GATT_NODES
-  // Raise if a migrated node needs more concurrent registrations.
-  static constexpr uint8_t MAX_PENDING_NOTIFY_REGS = 4;
-
-  // Nodes on the neutral surface; fed the translated callbacks and
-  // auto-established after the on_connected fan-out. Every gatt node is
-  // also in nodes_ (registration pushes into both).
-  StaticVector<BLEClientNode *, ESPHOME_BLE_CLIENT_MAX_NODES> gatt_nodes_;
-  bool has_legacy_nodes_() const { return this->nodes_.size() > this->gatt_nodes_.size(); }
-  // Reconnect backoff after materializer failures.
-  ConnectBackoff gatt_backoff_;
-  // Bridge-initiated notify registrations awaiting REG_FOR_NOTIFY_EVT.
-  uint16_t pending_gatt_regs_[MAX_PENDING_NOTIFY_REGS];
-  uint8_t pending_gatt_reg_count_{0};
-  // on_connected fan-out started; on_disconnected is owed at teardown.
-  bool gatt_connected_{false};
-#endif
 };
 
 }  // namespace esphome::ble_client

esphome/components/ble_client/ble_client_gatt.cpp

@@ -1,249 +0,0 @@
-#include "ble_client_gatt.h"
-
-#if defined(USE_BLE_GATT_CLIENT) && !defined(USE_BLE_CLIENT_LEGACY_ENGINE)
-
-#include "esphome/core/hal.h"
-#include "esphome/core/log.h"
-
-namespace esphome::ble_client {
-
-static const char *const TAG = "ble_client";
-
-void BLEClient::register_ble_node(BLEClientNode *node) {
-  node->set_ble_client_parent(this);
-  if (this->nodes_.size() == ESPHOME_BLE_CLIENT_MAX_NODES) {
-    // push_back past capacity is a silent no-op; an undersized slot count
-    // must be loud at boot, not an unresolvable node at runtime.
-    ESP_LOGE(TAG, "[%s] Node capacity exceeded; node dropped", this->address_str_);
-    this->status_set_error(LOG_STR("node capacity exceeded"));
-    return;
-  }
-  this->nodes_.push_back(node);
-}
-
-void BLEClient::set_address(uint64_t address) {
-  this->address_ = address;
-  uint8_t mac[6];
-  ble_device_base::uint64_to_mac_msb_first(address, mac);
-  format_mac_addr_upper(mac, this->address_str_);
-}
-
-void BLEClient::set_enabled(bool enabled) {
-  if (enabled == this->enabled)
-    return;
-  ESP_LOGI(TAG, "[%s] %s", this->address_str_, enabled ? "Enabled" : "Disabled");
-  this->enabled = enabled;
-  if (!enabled) {
-    this->disconnect();
-    return;
-  }
-  // A re-enable clears the backoff; the next sighting connects (legacy
-  // parity: enabling does not itself connect).
-  this->backoff_.reset();
-}
-
-bool BLEClient::parse_device(const ble_device_base::ESPBTDevice &device) {
-  if (device.address_uint64() != this->address_)
-    return false;
-  // The sighting is the source of truth for the address type.
-  this->address_type_ = device.get_address_type();
-  this->address_type_known_ = true;
-  if (!this->enabled || !this->auto_connect_ || this->state_ != State::IDLE)
-    return true;
-  if (this->backoff_.holding_off())
-    return true;
-  this->attempt_connect_();
-  return true;
-}
-
-void BLEClient::connect() {
-  if (this->state_ != State::IDLE) {
-    ESP_LOGD(TAG, "[%s] Connect requested while busy, ignoring", this->address_str_);
-    return;
-  }
-  // An absent peer can inhibit scanning for the backend's full connect
-  // timeout, so this is worth a breadcrumb - but it is a supported action.
-  ESP_LOGI(TAG, "[%s] Connecting on request", this->address_str_);
-  if (!this->address_type_known_) {
-    // Legacy parity: without a sighting the address type defaults to
-    // public, which never matches a random-static peer.
-    ESP_LOGW(TAG, "[%s] No sighting yet; assuming a public address type", this->address_str_);
-  }
-  this->attempt_connect_();
-}
-
-void BLEClient::attempt_connect_() {
-  int err = this->backend_->connect(this->address_, this->address_type_);
-  if (err != 0) {
-    // A refused connect never produces a callback: stay idle, charge the
-    // backoff, and resolve any waiting connect action through the failure
-    // path so its chain terminates.
-    ESP_LOGW(TAG, "[%s] Connect refused, err=%d", this->address_str_, err);
-    this->backoff_.register_failure(this->address_str_);
-    this->defer([this]() { this->connect_failed_callbacks_.call(); });
-    return;
-  }
-  ESP_LOGD(TAG, "[%s] Connecting", this->address_str_);
-  this->state_ = State::CONNECTING;
-}
-
-void BLEClient::disconnect() {
-  if (this->state_ == State::IDLE) {
-    ESP_LOGD(TAG, "[%s] Disconnect requested while idle, ignoring", this->address_str_);
-    return;
-  }
-  // A deliberate teardown's failure report must not feed the backoff.
-  this->cancel_requested_ = true;
-  int err = this->backend_->gatt_disconnect();
-  if (err != 0) {
-    // Refused synchronously: backend and client disagree about the link
-    // state. Warn, then settle through the deliberate-cancel path.
-    ESP_LOGW(TAG, "[%s] Disconnect refused, err=%d; settling locally", this->address_str_, err);
-    this->on_connection_state(false, 0, err);
-  }
-}
-
-void BLEClient::on_connection_state(bool connected, uint16_t mtu, int error) {
-  if (connected) {
-    this->state_ = State::DISCOVERING;
-    int discover_err = this->backend_->discover_services();
-    if (discover_err != 0) {
-      // Synchronous refusal: no discovery completion will follow.
-      ESP_LOGW(TAG, "[%s] Service discovery refused, err=%d", this->address_str_, discover_err);
-      this->backoff_.register_failure(this->address_str_);
-      // Deliberate teardown: its report must not charge the backoff again.
-      this->disconnect();
-    }
-    return;
-  }
-  bool was_connected = this->state_ == State::CONNECTED;
-  bool cancelled = this->cancel_requested_;
-  this->cancel_requested_ = false;
-  this->state_ = State::IDLE;
-  if (was_connected) {
-    ESP_LOGI(TAG, "[%s] Disconnected, status=%d", this->address_str_, error);
-    for (auto *node : this->nodes_) {
-      node->on_disconnected();
-    }
-    // Continuations leave the backend's event-drain stack first.
-    this->defer([this]() { this->disconnect_callbacks_.call(); });
-  } else {
-    if (cancelled) {
-      // status carries the refusal code when the teardown settled
-      // synchronously; 0 on a backend-completed cancel.
-      ESP_LOGD(TAG, "[%s] Connect attempt cancelled, status=%d", this->address_str_, error);
-    } else {
-      ESP_LOGW(TAG, "[%s] Connect failed, status=%d", this->address_str_, error);
-      this->backoff_.register_failure(this->address_str_);
-    }
-    this->defer([this]() { this->connect_failed_callbacks_.call(); });
-  }
-}
-
-void BLEClient::on_service_discovery_done(int error) {
-  if (error != 0) {
-    ESP_LOGW(TAG, "[%s] Service discovery failed, status=%d", this->address_str_, error);
-    this->backoff_.register_failure(this->address_str_);
-    // The teardown is deliberate: do not charge the backoff again for its
-    // connection report.
-    this->disconnect();
-    return;
-  }
-  ble_device_base::GattServiceTable table{};
-  if (!this->nodes_.empty()) {
-    // Materialize only when a node will read it: a client with no nodes
-    // would pay the build/free cycle on every (re)connect for nothing.
-    table = this->backend_->get_service_table();
-    if (table.service_count == 0) {
-      // A failed materialization is indistinguishable from a service-less
-      // peer, and a real GATT peer always exposes at least GAP/GATT: fail
-      // the discovery before CONNECTED so the teardown resolves through
-      // connect_failed, never a spurious on_disconnect.
-      ESP_LOGW(TAG, "[%s] Service table is empty; treating as failed discovery", this->address_str_);
-      this->backend_->release_services();
-      this->backoff_.register_failure(this->address_str_);
-      this->disconnect();
-      return;
-    }
-  }
-  // CONNECTED before the fan-out so nodes may consult connected() from
-  // their own on_connected().
-  this->state_ = State::CONNECTED;
-  for (auto *node : this->nodes_) {
-    node->on_connected(table);
-    if (this->state_ != State::CONNECTED || this->cancel_requested_) {
-      // A node tore the link down mid-fan-out: on_disconnect fires with no
-      // preceding on_connect, so leave a trace of why.
-      ESP_LOGW(TAG, "[%s] A node aborted the connection during setup", this->address_str_);
-      this->backend_->release_services();
-      return;
-    }
-  }
-  this->backend_->release_services();
-  this->backoff_.reset();
-  ESP_LOGI(TAG, "[%s] Connected", this->address_str_);
-  this->defer([this]() { this->connect_callbacks_.call(); });
-}
-
-void BLEClient::on_write_result(uint16_t handle, int error) {
-  if (error != 0) {
-    // Breadcrumb even when no node claims the handle.
-    ESP_LOGD(TAG, "[%s] Write on handle 0x%04x completed with status %d", this->address_str_, handle, error);
-  }
-  for (auto *node : this->nodes_) {
-    node->on_write_result(handle, error);
-  }
-}
-
-void BLEClient::on_read_result(uint16_t handle, const uint8_t *data, uint16_t len, int error) {
-  if (error != 0) {
-    // Breadcrumb even when no node claims the handle.
-    ESP_LOGD(TAG, "[%s] Read on handle 0x%04x completed with status %d", this->address_str_, handle, error);
-  }
-  for (auto *node : this->nodes_) {
-    node->on_read_result(handle, data, len, error);
-  }
-}
-
-void BLEClient::on_notify_data(uint16_t handle, const uint8_t *data, uint16_t len) {
-  // Every node sees every notification and filters by handle (legacy parity).
-  for (auto *node : this->nodes_) {
-    node->on_notify(handle, data, len);
-  }
-}
-
-void BLEClient::on_notify_state(uint16_t handle, bool enabled, int error) {
-  if (error != 0) {
-    ESP_LOGW(TAG, "[%s] Notify %s on handle 0x%04x failed, status=%d", this->address_str_,
-             enabled ? "enable" : "disable", handle, error);
-  }
-  for (auto *node : this->nodes_) {
-    node->on_notify_state(handle, enabled, error);
-  }
-}
-
-void BLEClient::on_pairing_result(int status) {
-  if (status != 0) {
-    ESP_LOGW(TAG, "[%s] Pairing failed, status=%d", this->address_str_, status);
-  } else {
-    ESP_LOGI(TAG, "[%s] Paired", this->address_str_);
-  }
-  for (auto *node : this->nodes_) {
-    node->on_pairing_result(status);
-  }
-}
-
-void BLEClient::dump_config() {
-  ESP_LOGCONFIG(TAG,
-                "BLE Client:\n"
-                "  Address: %s\n"
-                "  Auto connect: %s",
-                this->address_str_, YESNO(this->auto_connect_));
-  if (this->enabled && this->state_ == State::IDLE) {
-    ESP_LOGCONFIG(TAG, "  Waiting for an advertisement from the device");
-  }
-}
-
-}  // namespace esphome::ble_client
-
-#endif  // USE_BLE_GATT_CLIENT && !USE_BLE_CLIENT_LEGACY_ENGINE

esphome/components/ble_client/ble_client_gatt.h

@@ -1,149 +0,0 @@
-// Platform-neutral ble_client engine on the ble_device_base GATT contract.
-//
-// Compiled on every platform with a GATT backend except esp32, which keeps
-// the legacy BLEClientBase engine (ble_client.h) until its raw-gattc node
-// family migrates - the exclusive gates make the same class names resolve to
-// exactly one definition per build, so codegen is shared.
-//
-// Connects are sighting-gated like the legacy engine: the client is a parsed
-// advertisement listener, captures the peer's address type from the sighting,
-// and asks the backend to connect only when enabled and idle.
-
-#pragma once
-
-#include "esphome/core/defines.h"
-
-#if defined(USE_BLE_GATT_CLIENT) && !defined(USE_BLE_CLIENT_LEGACY_ENGINE)
-
-#include "ble_client_node.h"
-#include "connect_backoff.h"
-#include "esphome/components/ble_device_base/ble_device.h"
-#include "esphome/components/ble_device_base/ble_gatt_client.h"
-#include "esphome/components/bluetooth_connection/bluetooth_connection.h"
-#include "esphome/components/bluetooth_connection/bluetooth_connection_gatt_backend.h"
-#include "esphome/core/component.h"
-#include "esphome/core/helpers.h"
-
-#include <cstdint>
-#include <functional>
-
-namespace esphome::ble_client {
-
-class BLEClient : public Component,
-                  public ble_device_base::ESPBTDeviceListener,
-                  public ble_device_base::GattClientListener {
- public:
-  void dump_config() override;
-
-  // Public field for legacy parity (the switch platform republishes it).
-  bool enabled{true};
-
-  void set_backend(ble_device_base::BLEGattConnection *backend) {
-    this->backend_ = backend;
-    backend->set_listener(this);
-  }
-  void set_address(uint64_t address);
-  void set_auto_connect(bool auto_connect) { this->auto_connect_ = auto_connect; }
-  void set_enabled(bool enabled);
-  const char *address_str() const { return this->address_str_; }
-
-  void register_ble_node(BLEClientNode *node);
-  // One registration spelling shared with the esp32 engine's bridge.
-  void register_gatt_node(BLEClientNode *node) { this->register_ble_node(node); }
-
-  bool connected() const { return this->state_ == State::CONNECTED; }
-  bool idle() const { return this->state_ == State::IDLE; }
-
-  /// Action-initiated connect (no sighting needed; uses the last captured
-  /// address type, public until a sighting arrives). No-op unless idle.
-  void connect();
-  void disconnect();
-
-  /// Legacy-named deferral used by the automation twins: neutral listener
-  /// callbacks run inside the backend's event drain, so automation chain
-  /// continuations must leave that stack first.
-  void run_later(std::function<void()> &&f) { this->defer(std::move(f)); }  // NOLINT
-
-  // Backend ops for nodes and actions - the frozen node-facing surface.
-  // Only write_characteristic has an in-tree caller; subscribing means
-  // notify_characteristic plus a CCCD write_descriptor (the caller's job
-  // per the contract).
-  int write_characteristic(uint16_t handle, const uint8_t *data, uint16_t len, bool response) {
-    return this->backend_->write_characteristic(handle, data, len, response);
-  }
-  int read_characteristic(uint16_t handle) { return this->backend_->read_characteristic(handle); }
-  int read_descriptor(uint16_t handle) { return this->backend_->read_descriptor(handle); }
-  int write_descriptor(uint16_t handle, const uint8_t *data, uint16_t len) {
-    return this->backend_->write_descriptor(handle, data, len);
-  }
-  int notify_characteristic(uint16_t handle, bool enable) {
-    return this->backend_->notify_characteristic(handle, enable);
-  }
-  int pair() { return this->backend_->pair(); }
-  int unpair() { return bluetooth_connection::unpair_device(this->address_); }
-
-  // Automation callback registration.
-  template<typename F> void add_on_connect_callback(F &&callback) {
-    this->connect_callbacks_.add(std::forward<F>(callback));
-  }
-  template<typename F> void add_on_disconnect_callback(F &&callback) {
-    this->disconnect_callbacks_.add(std::forward<F>(callback));
-  }
-  // Fired when a connect attempt dies before being established; the user
-  // on_disconnect trigger deliberately does NOT fire here (legacy parity).
-  template<typename F> void add_on_connect_failed_callback(F &&callback) {
-    this->connect_failed_callbacks_.add(std::forward<F>(callback));
-  }
-
-  // ---- ble_device_base::ESPBTDeviceListener ----
-  bool parse_device(const ble_device_base::ESPBTDevice &device) override;
-
-  // ---- ble_device_base::GattClientListener ----
-  void on_connection_state(bool connected, uint16_t mtu, int error) override;
-  void on_service_discovery_done(int error) override;
-  void on_read_result(uint16_t handle, const uint8_t *data, uint16_t len, int error) override;
-  void on_write_result(uint16_t handle, int error) override;
-  void on_notify_data(uint16_t handle, const uint8_t *data, uint16_t len) override;
-  void on_notify_state(uint16_t handle, bool enabled, int error) override;
-  void on_pairing_result(int status) override;
-
- protected:
-  enum class State : uint8_t { IDLE, CONNECTING, DISCOVERING, CONNECTED };
-
-  void attempt_connect_();
-
-  // Group 1: pointers / containers
-  ble_device_base::BLEGattConnection *backend_{nullptr};
-  // Codegen-sized (ESPHOME_BLE_CLIENT_MAX_NODES); filled during setup.
-  StaticVector<BLEClientNode *, ESPHOME_BLE_CLIENT_MAX_NODES> nodes_;
-
-  // Group 2: 8-byte types
-  uint64_t address_{0};
-
-  // Group 3: callback managers (pointer-sized when empty)
-  LazyCallbackManager<void()> connect_callbacks_;
-  LazyCallbackManager<void()> disconnect_callbacks_;
-  LazyCallbackManager<void()> connect_failed_callbacks_;
-
-  // Group 4: 4-byte types
-  // Backoff so an undiscoverable database or a dead peer cannot produce a
-  // battery-draining connect loop.
-  ConnectBackoff backoff_;
-
-  // Group 5: arrays
-  char address_str_[MAC_ADDRESS_PRETTY_BUFFER_SIZE]{};
-
-  // Group 6: 1-byte types
-  State state_{State::IDLE};
-  uint8_t address_type_{0};  // BLE_ADDR_TYPE_*, captured from the sighting
-  // Distinguishes a captured public type from the never-sighted default.
-  bool address_type_known_{false};
-  bool auto_connect_{true};
-  // A user-initiated teardown in flight; its failure report is not a
-  // connect failure and must not feed the backoff.
-  bool cancel_requested_{false};
-};
-
-}  // namespace esphome::ble_client
-
-#endif  // USE_BLE_GATT_CLIENT && !USE_BLE_CLIENT_LEGACY_ENGINE

esphome/components/ble_client/ble_client_node.h

@@ -1,68 +0,0 @@
-// The single BLEClientNode both ble_client engines share. The neutral
-// callback surface is the one interface node components build on; the raw
-// esp32 surface below it remains for components that have not migrated yet.
-
-#pragma once
-
-#include "esphome/core/defines.h"
-
-#ifdef USE_BLE_GATT_CLIENT
-#include "esphome/components/ble_device_base/ble_gatt_client.h"
-#endif
-#ifdef USE_BLE_CLIENT_LEGACY_ENGINE
-#include "esphome/components/esp32_ble_tracker/esp32_ble_tracker.h"
-
-#include <esp_gap_ble_api.h>
-#include <esp_gattc_api.h>
-#endif
-
-#include <cstdint>
-
-namespace esphome::ble_client {
-
-class BLEClient;
-
-class BLEClientNode {
- public:
-#ifdef USE_BLE_CLIENT_GATT_NODES
-  // Neutral surface, delivered by both engines. The table is borrowed: copy
-  // handles during on_connected(). All nodes see all completions; filter by
-  // handle.
-  // A node that disconnects from inside on_connected() aborts the fan-out;
-  // the user's on_disconnect may then fire without a preceding on_connect.
-  virtual void on_connected(const ble_device_base::GattServiceTable &table) {}
-  virtual void on_disconnected() {}
-  virtual void on_notify(uint16_t handle, const uint8_t *data, uint16_t len) {}
-  // One in-flight registration per handle; its completion fans out to every
-  // node, so a refused duplicate request still sees on_notify_state.
-  virtual void on_notify_state(uint16_t handle, bool enabled, int error) {}
-  virtual void on_read_result(uint16_t handle, const uint8_t *data, uint16_t len, int error) {}
-  virtual void on_write_result(uint16_t handle, int error) {}
-  virtual void on_pairing_result(int status) {}
-#endif
-#ifdef USE_BLE_CLIENT_LEGACY_ENGINE
-  // Legacy raw surface; components overriding these need the legacy engine
-  // until migrated to the neutral surface above.
-  virtual void gattc_event_handler(esp_gattc_cb_event_t event, esp_gatt_if_t gattc_if,
-                                   esp_ble_gattc_cb_param_t *param) {}
-  virtual void gap_event_handler(esp_gap_ble_cb_event_t event, esp_ble_gap_cb_param_t *param) {}
-  virtual void loop() {}
-  // This should be transitioned to Established once the node no longer needs
-  // the services/descriptors/characteristics of the parent client. This will
-  // allow some memory to be freed.
-  // The parent frees the peer's GATT cache once every node reports Established.
-  // Never report Established while an operation that reads that cache is outstanding.
-  // - esp_ble_gattc_register_for_notify() completes asynchronously.
-  // - Register from ESP_GATTC_SEARCH_CMPL_EVT, then set this from ESP_GATTC_REG_FOR_NOTIFY_EVT.
-  // - BLEClientBase::register_for_notify() holds the release until the registration completes.
-  esp32_ble_tracker::ClientState node_state;
-#endif
-
-  BLEClient *parent() const { return this->parent_; }
-  void set_ble_client_parent(BLEClient *parent) { this->parent_ = parent; }
-
- protected:
-  BLEClient *parent_{nullptr};
-};
-
-}  // namespace esphome::ble_client

esphome/components/ble_client/ble_write_action.h

@@ -1,168 +0,0 @@
-// The ble_client.ble_write action: a node on the platform-neutral interface,
-// so one implementation serves both engines (the esp32 bridge and the
-// neutral engine).
-
-#pragma once
-
-#include "esphome/core/defines.h"
-
-#ifdef USE_BLE_CLIENT_GATT_NODES
-
-#include <tuple>
-#include <vector>
-
-// One of the two engine headers resolves per build.
-#include "ble_client.h"
-#include "ble_client_gatt.h"
-#include "ble_client_node.h"
-#include "esphome/core/automation.h"
-#include "esphome/core/helpers.h"
-#include "esphome/core/log.h"
-
-namespace esphome::ble_client {
-
-static const char *const BLE_WRITE_TAG = "ble_client.automation";
-
-// Maximum bytes to log in hex format for BLE writes (many logging buffers are 256 chars)
-static constexpr size_t BLE_WRITE_MAX_LOG_BYTES = 64;
-
-template<typename... Ts> class BLEClientWriteAction final : public Action<Ts...>, public BLEClientNode {
- public:
-  BLEClientWriteAction(BLEClient *ble_client) {
-    ble_client->register_gatt_node(this);
-    ble_client_ = ble_client;
-  }
-
-  void set_service_uuid16(uint16_t uuid) { this->service_uuid_ = ble_device_base::ESPBTUUID::from_uint16(uuid); }
-  void set_service_uuid32(uint32_t uuid) { this->service_uuid_ = ble_device_base::ESPBTUUID::from_uint32(uuid); }
-  void set_service_uuid128(uint8_t *uuid) { this->service_uuid_ = ble_device_base::ESPBTUUID::from_raw(uuid); }
-
-  void set_char_uuid16(uint16_t uuid) { this->char_uuid_ = ble_device_base::ESPBTUUID::from_uint16(uuid); }
-  void set_char_uuid32(uint32_t uuid) { this->char_uuid_ = ble_device_base::ESPBTUUID::from_uint32(uuid); }
-  void set_char_uuid128(uint8_t *uuid) { this->char_uuid_ = ble_device_base::ESPBTUUID::from_raw(uuid); }
-
-  void set_value_template(std::vector<uint8_t> (*func)(Ts...)) {
-    this->value_.func = func;
-    this->len_ = -1;  // Sentinel value indicates template mode
-  }
-
-  // Store pointer to static data in flash (no RAM copy)
-  void set_value_simple(const uint8_t *data, size_t len) {
-    this->value_.data = data;
-    this->len_ = len;  // Length >= 0 indicates static mode
-  }
-
-  void play(const Ts &...x) override {}
-
-  void play_complex(const Ts &...x) override {
-    this->num_running_++;
-    this->var_ = std::make_tuple(x...);
-
-    bool result;
-    if (this->len_ >= 0) {
-      result = this->write(this->value_.data, this->len_);
-    } else {
-      std::vector<uint8_t> value = this->value_.func(x...);
-      result = this->write(value.data(), value.size());
-    }
-
-    // on write failure, continue the automation chain rather than stopping so
-    // that e.g. disconnect can work.
-    if (!result)
-      this->play_next_(x...);
-  }
-
-  // Initiate the write; the completion arrives in on_write_result. The
-  // response-less path can complete synchronously inside the call, so the
-  // handle is armed before the backend is touched.
-  bool write(const uint8_t *data, size_t len) {
-    if (!this->ble_client_->connected()) {
-      esph_log_w(BLE_WRITE_TAG, "Cannot write to BLE characteristic - not connected");
-      return false;
-    }
-    if (!this->resolved_) {
-      esph_log_w(BLE_WRITE_TAG, "Cannot write to BLE characteristic - characteristic was not resolved");
-      return false;
-    }
-#if ESPHOME_LOG_LEVEL >= ESPHOME_LOG_LEVEL_VERY_VERBOSE
-    char hex_buf[format_hex_pretty_size(BLE_WRITE_MAX_LOG_BYTES)];
-    esph_log_vv(BLE_WRITE_TAG, "Will write %d bytes: %s", len, format_hex_pretty_to(hex_buf, data, len));
-#endif
-    int err = this->ble_client_->write_characteristic(this->char_handle_, data, len, this->write_response_);
-    if (err != 0) {
-      esph_log_e(BLE_WRITE_TAG, "Error writing to characteristic: %d!", err);
-      return false;
-    }
-    return true;
-  }
-
-  void on_connected(const ble_device_base::GattServiceTable &table) override {
-    const auto *service = ble_device_base::find_service(table, this->service_uuid_);
-    const auto *chr =
-        service == nullptr ? nullptr : ble_device_base::find_characteristic(table, *service, this->char_uuid_);
-    if (chr == nullptr) {
-      char char_buf[ble_device_base::UUID_STR_LEN];
-      char service_buf[ble_device_base::UUID_STR_LEN];
-      esph_log_w(BLE_WRITE_TAG, "Characteristic %s was not found in service %s", this->char_uuid_.to_str(char_buf),
-                 this->service_uuid_.to_str(service_buf));
-      return;
-    }
-    if (chr->properties & ble_device_base::GATT_CHAR_PROP_WRITE) {
-      this->write_response_ = true;
-    } else if (chr->properties & ble_device_base::GATT_CHAR_PROP_WRITE_NO_RSP) {
-      this->write_response_ = false;
-    } else {
-      char char_buf[ble_device_base::UUID_STR_LEN];
-      esph_log_e(BLE_WRITE_TAG, "Characteristic %s does not allow writing", this->char_uuid_.to_str(char_buf));
-      return;
-    }
-    this->char_handle_ = chr->value_handle;
-    this->resolved_ = true;
-    char char_buf[ble_device_base::UUID_STR_LEN];
-    esph_log_d(BLE_WRITE_TAG, "Found characteristic %s on device %s", this->char_uuid_.to_str(char_buf),
-               this->ble_client_->address_str());
-  }
-
-  void on_disconnected() override {
-    this->resolved_ = false;
-    this->char_handle_ = 0;
-    if (this->num_running_ != 0)
-      this->stop_complex();
-  }
-
-  void on_write_result(uint16_t handle, int error) override {
-    if (this->num_running_ == 0) {
-      return;
-    }
-    if (!this->resolved_ || handle != this->char_handle_) {
-      // A parked chain waiting on a completion that never matches would
-      // otherwise stall silently until disconnect.
-      esph_log_d(BLE_WRITE_TAG, "Write result for handle 0x%04x ignored, waiting on 0x%04x", handle,
-                 this->char_handle_);
-      return;
-    }
-    if (error != 0) {
-      // Continue the chain (legacy parity) but leave a breadcrumb.
-      esph_log_w(BLE_WRITE_TAG, "Write completed with status %d", error);
-    }
-    this->ble_client_->run_later([this]() { this->play_next_tuple_(this->var_); });
-  }
-
- private:
-  BLEClient *ble_client_;
-  ssize_t len_{-1};  // -1 = template mode, >=0 = static mode with length
-  union Value {
-    std::vector<uint8_t> (*func)(Ts...);  // Function pointer (stateless lambdas)
-    const uint8_t *data;                  // Pointer to static data in flash
-  } value_;
-  ble_device_base::ESPBTUUID service_uuid_;
-  ble_device_base::ESPBTUUID char_uuid_;
-  std::tuple<Ts...> var_{};
-  uint16_t char_handle_{};
-  bool write_response_{false};
-  bool resolved_{false};
-};
-
-}  // namespace esphome::ble_client
-
-#endif  // USE_BLE_CLIENT_GATT_NODES

esphome/components/ble_client/connect_backoff.h

@@ -1,43 +0,0 @@
-#pragma once
-
-#include "esphome/core/defines.h"
-
-#ifdef USE_BLE_GATT_CLIENT
-
-#include "esphome/core/hal.h"
-#include "esphome/core/log.h"
-
-#include <cstdint>
-
-namespace esphome::ble_client {
-
-/// Reconnect backoff after repeated connect/discovery failures, shared by
-/// both engines. 256 ms ticks in a uint16_t keep it 4 bytes; the ~4.7 h tick
-/// wrap can at worst reinstate one stale hold-off of a minute.
-class ConnectBackoff {
- public:
-  bool holding_off() const {
-    return this->failures_ != 0 && static_cast<uint16_t>(now() - this->start_) < this->failures_ * STEP_TICKS;
-  }
-  void register_failure(const char *address_str) {
-    if (this->failures_ < MAX_STEPS)
-      this->failures_++;
-    this->start_ = now();
-    esph_log_w("ble_client", "[%s] Holding off reconnect for %u s", address_str, this->failures_ * 10u);
-  }
-  void reset() { this->failures_ = 0; }
-
- private:
-  // ~10 s per consecutive failure, capped so a flapping peer retries within
-  // a minute at worst.
-  static constexpr uint16_t STEP_TICKS = 40;  // x 256 ms
-  static constexpr uint8_t MAX_STEPS = 6;
-  static uint16_t now() { return static_cast<uint16_t>(millis() >> 8); }
-
-  uint16_t start_{0};
-  uint8_t failures_{0};
-};
-
-}  // namespace esphome::ble_client
-
-#endif  // USE_BLE_GATT_CLIENT

esphome/components/ble_device_base/ble_gatt_client.cpp

@@ -1,48 +0,0 @@
-#include "ble_gatt_client.h"
-
-#ifdef USE_BLE_GATT_CLIENT
-
-#include "esphome/core/log.h"
-
-namespace esphome::ble_device_base {
-
-static const char *const TAG = "ble_gatt_client";
-
-const GattCharacteristic *find_characteristic(const GattServiceTable &table, const GattService &service,
-                                              const ESPBTUUID &uuid) {
-  // 32-bit range math: a corrupt first/count pair cannot wrap past the check.
-  uint32_t end = uint32_t(service.first_characteristic) + service.characteristic_count;
-  if (end > table.characteristic_count) {
-    ESP_LOGW(TAG, "characteristic range out of bounds");
-    return nullptr;
-  }
-  for (uint32_t i = service.first_characteristic; i < end; i++) {
-    if (table.characteristics[i].uuid == uuid)
-      return &table.characteristics[i];
-  }
-  return nullptr;
-}
-
-const GattDescriptor *find_descriptor(const GattServiceTable &table, const GattCharacteristic &characteristic,
-                                      const ESPBTUUID &uuid) {
-  uint32_t end = uint32_t(characteristic.first_descriptor) + characteristic.descriptor_count;
-  if (end > table.descriptor_count) {
-    // Corrupt range, not a missing descriptor.
-    ESP_LOGW(TAG, "descriptor range out of bounds");
-    return nullptr;
-  }
-  for (uint32_t i = characteristic.first_descriptor; i < end; i++) {
-    if (table.descriptors[i].uuid == uuid)
-      return &table.descriptors[i];
-  }
-  return nullptr;
-}
-
-uint16_t find_cccd(const GattServiceTable &table, const GattCharacteristic &characteristic) {
-  const GattDescriptor *desc = find_descriptor(table, characteristic, ESPBTUUID::from_uint16(CCCD_UUID));
-  return desc != nullptr ? desc->handle : 0;
-}
-
-}  // namespace esphome::ble_device_base
-
-#endif  // USE_BLE_GATT_CLIENT

esphome/components/ble_device_base/ble_gatt_client.h

@@ -11,16 +11,13 @@
 // interface. All listener calls are delivered on the ESPHome main loop;
 // borrowed data pointers are valid only for the duration of the call.
 //
-// Error domain (plain int, forwarded to the API without translation, so the
-// values are wire-frozen - API clients interpret them):
+// Error domain (plain int, forwarded to the API without translation):
 //   0            success
-//   1..0x11      ATT error codes (Bluetooth spec) - reserved; a backend whose
-//                native error codes land in this window must remap them out
+//   1..0x11      ATT error codes (Bluetooth spec; BTstack and Bluedroid agree)
 //   GATT_ERR_NOT_CONNECTED (-1)  no connection to the peer (on esp32 a raw
 //                ESP_FAIL from the stack shares this value; both read as a
 //                failed, unusable connection on the client side)
 //   GATT_ERR_NO_MEMORY (-2)      backend storage exhausted
-//   -1..-15      reserved for future contract sentinels
 //   anything else: platform stack error/status code, surfaced opaquely.
 // Connection events carry HCI status/disconnect reason codes (same code
 // space on every controller).
@@ -102,18 +99,9 @@ class GattClientListener {
 // The BLEGattConnection op surface, asserted where the alias binds
 // (bluetooth_connection_gatt_backend.h). Operations return 0 when accepted (completion arrives
 // through the listener) or a synchronous error (busy, not connected, stack
-// rejection); one operation may be outstanding at a time. An accepted
-// operation's completion is delivered from the event loop, NEVER
-// synchronously from inside the op call - a synchronous terminal
-// on_connection_state from within gatt_disconnect() would re-enter the
-// consumer mid-teardown. Semantics beyond the signatures:
+// rejection); one operation may be outstanding at a time. Semantics beyond
+// the signatures:
 // - connect: addr_type is a BLE_ADDR_TYPE_* constant (ble_device.h).
-//   Returning 0 means the request is accepted, not that the radio acted: the
-//   backend owns integration with its platform's scan/connect arbitration
-//   (Bluedroid parks the request for the tracker's promote loop, which owns
-//   scan-stop/coex/one-connect-at-a-time; the rp2 backend opens immediately
-//   and relies on sighting-gated consumers). Consumers must not assume
-//   connect timing.
 // - gatt_disconnect: also cancels a connect in progress (named to coexist
 //   with a platform stack's own void disconnect() on one backend class).
 //   Nonzero means nothing to tear down and no completion will follow; an
@@ -155,41 +143,6 @@ concept BLEGattConnectionContract = requires(T conn, GattClientListener *listene
   { conn.set_connection_type(ConnectionType{}) } -> std::same_as<void>;
 };
 
-// ---- service table lookup helpers ----
-//
-// Neutral, bounds-checked walks over a materialized GattServiceTable for
-// direct consumers that resolve a known device's handles by UUID (streaming
-// consumers forward the raw database and never need these). Linear search:
-// the table exists only between discovery and release_services(), for one
-// small known device.
-
-/// Client Characteristic Configuration descriptor UUID (Bluetooth spec).
-static constexpr uint16_t CCCD_UUID = 0x2902;
-
-// Characteristic property bits (the Bluetooth-spec declaration byte carried
-// in GattCharacteristic::properties; the ESP-IDF macros for these do not
-// exist on the other platforms).
-static constexpr uint8_t GATT_CHAR_PROP_WRITE_NO_RSP = 0x04;
-static constexpr uint8_t GATT_CHAR_PROP_WRITE = 0x08;
-
-inline const GattService *find_service(const GattServiceTable &table, const ESPBTUUID &uuid) {
-  for (uint16_t i = 0; i < table.service_count; i++) {
-    if (table.services[i].uuid == uuid)
-      return &table.services[i];
-  }
-  return nullptr;
-}
-
-const GattCharacteristic *find_characteristic(const GattServiceTable &table, const GattService &service,
-                                              const ESPBTUUID &uuid);
-
-const GattDescriptor *find_descriptor(const GattServiceTable &table, const GattCharacteristic &characteristic,
-                                      const ESPBTUUID &uuid);
-
-/// Handle of the characteristic's Client Characteristic Configuration
-/// descriptor (0x2902), or 0 when it has none.
-uint16_t find_cccd(const GattServiceTable &table, const GattCharacteristic &characteristic);
-
 }  // namespace esphome::ble_device_base
 
 #endif  // USE_BLE_GATT_CLIENT

esphome/components/bluetooth_connection/__init__.py

@@ -1,14 +1,12 @@
 """Per-platform GATT connection backends and the helpers to embed one.
 
-Backends: esp32 Bluedroid, rp2 BTstack. No user-facing configuration; a
-consumer's codegen declares and registers the backend instances — the
-Bluetooth proxy through its per-slot connection wrappers (a streaming
-consumer), and the neutral ble_client through gatt_client_schema() +
-new_gatt_backend().
+Backends: esp32 Bluedroid, rp2 BTstack. No user-facing configuration; the
+Bluetooth proxy's codegen declares and registers the backend instances
+through gatt_client_schema()/hub_connection_schema() + new_gatt_backend().
 """
 
 from collections.abc import Awaitable, Callable
-from dataclasses import dataclass, field
+from dataclasses import dataclass
 
 import esphome.codegen as cg
 from esphome.components import rp2040_ble
@@ -25,8 +23,7 @@ from esphome.types import ConfigType
 def AUTO_LOAD() -> list[str]:
     """ble_device_base plus the platform BLE stack the build's backend
     registers with (the Bluedroid header includes the tracker's), so
-    consumers stay platform-blind. The platform-less arm serves tooling that
-    resolves the manifest without a target."""
+    consumers need not know. The platform-less arm serves manifest tooling."""
     if CORE.is_esp32:
         return ["ble_device_base", "esp32_ble_tracker"]
     if CORE.is_rp2:
@@ -66,8 +63,6 @@ DOMAIN = "bluetooth_connection"
 @dataclass
 class _ConnectionData:
     rp2_backend_count: int = 0
-    # GATT connection slots claimed this run, for the platform cap check.
-    slot_consumers: list[str] = field(default_factory=list)
 
 
 def _get_data() -> _ConnectionData:
@@ -124,10 +119,6 @@ class _PlatformBackend:
     backend_class: cg.MockObjClass
     schema_fragment: Callable[[], cv.Schema]
     register: Callable[[cg.MockObj, ConfigType], Awaitable[None]]
-    # Selects the backend's alias-ladder arm (order-independent arms).
-    define: str
-    # The backend's on-demand materializer gate, when it has one.
-    materializer_define: str | None = None
 
 
 # The single registry of platforms with a GATT client backend; a platform
@@ -135,20 +126,11 @@ class _PlatformBackend:
 # platform's arm.
 _PLATFORM_BACKENDS: dict[str, _PlatformBackend] = {
     PLATFORM_ESP32: _PlatformBackend(
-        BluedroidGattClient,
-        _esp32_schema_fragment,
-        _esp32_register,
-        "USE_BLE_GATT_BACKEND_BLUEDROID",
-        materializer_define="USE_BLUEDROID_GATT_SERVICE_TABLE",
-    ),
-    PLATFORM_RP2: _PlatformBackend(
-        RP2GattClient, _rp2_schema_fragment, _rp2_register, "USE_BLE_GATT_BACKEND_RP2"
+        BluedroidGattClient, _esp32_schema_fragment, _esp32_register
     ),
+    PLATFORM_RP2: _PlatformBackend(RP2GattClient, _rp2_schema_fragment, _rp2_register),
 }
 
-# Gates dedicated-backend consumers (cv.only_on).
-GATT_CLIENT_PLATFORMS = list(_PLATFORM_BACKENDS)
-
 
 def _backend_entry(platform: str | None = None) -> _PlatformBackend:
     key = platform if platform is not None else CORE.target_platform
@@ -183,89 +165,21 @@ def hub_connection_schema(platform: str | None = None) -> cv.Schema:
     )
 
 
-def consume_gatt_slot(
-    consumer: str, count: int = 1
-) -> Callable[[ConfigType], ConfigType]:
-    """Validator claiming GATT connection slots - the one spelling for every
-    claimant. Platforms whose BLE stack owns a connection budget (esp32, rp2)
-    are charged there and their stack's final validation reports an
-    overcommit; the neutral ledger covers any future backend platform without
-    one (the cap check in FINAL_VALIDATE_SCHEMA)."""
-
-    def validator(config: ConfigType) -> ConfigType:
-        _get_data().slot_consumers.extend([consumer] * count)
-        if CORE.is_esp32:
-            from esphome.components import esp32_ble
-
-            esp32_ble.consume_connection_slots(count, consumer)(config)
-        elif CORE.target_platform == PLATFORM_RP2:
-            rp2040_ble.consume_connection_slots(count, consumer)(config)
-        return config
-
-    return validator
-
-
-# Platforms whose BLE stack owns its own connection budget: consume_gatt_slot
-# charges it there, and the stack's final validation is the one place an
-# overcommit is reported (never two messages for one misconfiguration).
-_STACK_BUDGET_PLATFORMS = {PLATFORM_ESP32, PLATFORM_RP2}
-
-
-def _validate_slot_totals(config: ConfigType) -> ConfigType:
-    # Skipped in testing mode so grouped component builds can co-exist
-    # (mirrors esp32_ble.validate_connection_slots).
-    if CORE.testing_mode:
-        return config
-    if CORE.target_platform in _STACK_BUDGET_PLATFORMS:
-        return config
-    if (cap := HUB_MAX_CONNECTIONS.get(CORE.target_platform)) is None:
-        # Any backend platform without a stack budget must carry a cap here
-        # or fail loudly, never fail open.
-        if CORE.target_platform in _PLATFORM_BACKENDS:
-            raise cv.Invalid(
-                f"{CORE.target_platform} has a GATT backend but no slot cap "
-                "in HUB_MAX_CONNECTIONS"
-            )
-        return config
-    claimed = _get_data().slot_consumers
-    if len(claimed) > cap:
-        raise cv.Invalid(
-            f"{CORE.target_platform} supports at most {cap} GATT client "
-            f"connection(s); {len(claimed)} requested by: {', '.join(claimed)}"
-        )
-    return config
-
-
-FINAL_VALIDATE_SCHEMA = _validate_slot_totals
-
-
-async def new_gatt_backend(
-    config: ConfigType, *, service_table: bool = True
-) -> cg.MockObj:
+async def new_gatt_backend(config: ConfigType) -> cg.MockObj:
     """Instantiate the backend declared by gatt_client_schema() and register
     it with its platform stack. The connection slot is claimed at validation
-    (the consume_gatt_slot validators), not here.
-
-    service_table is honored by the Bluedroid backend only: forward
-    scaffolding for the first esp32 direct consumer, load-bearing on no
-    current build (rp2 ignores the define and always materializes - its
-    proxy hub streams through get_service_table(), so it must keep the
-    materializer regardless of the flag).
+    (the proxy's slot validators), not here.
     """
     from esphome.components import ble_device_base
 
-    entry = _backend_entry()
     ble_device_base.request_gatt_client()
-    cg.add_define(entry.define)
-    if service_table and entry.materializer_define is not None:
-        cg.add_define(entry.materializer_define)
     backend = cg.new_Pvariable(config[CONF_BACKEND_ID])
     # The backend is the slot's real Component: component keys from the
     # connection entry (setup_priority, ...) apply to it. Consumers whose own
     # schema carries keys that register_component would misapply to the
     # backend (e.g. a polling interval) must not put them in this config.
     await cg.register_component(backend, config)
-    await entry.register(backend, config)
+    await _backend_entry().register(backend, config)
     return backend
 
 
@@ -273,7 +187,6 @@ async def new_gatt_backend(
 # list (this module cannot import bluetooth_proxy to derive it).
 SOURCE_FILE_FRAMEWORKS: dict[str, set[PlatformFramework]] = {
     "bluetooth_connection_bluedroid.cpp": frameworks_for_platforms([PLATFORM_ESP32]),
-    "gatt_service_table_bluedroid.cpp": frameworks_for_platforms([PLATFORM_ESP32]),
     # Every hub platform the proxy admits (the file compiles empty where
     # USE_BLE_GATT_CLIENT is not defined), so a platform gaining a backend
     # cannot hit a missing-symbol trap here.

esphome/components/bluetooth_connection/bluetooth_connection.cpp

@@ -46,7 +46,7 @@ BatchClose close_service_batch(api::BluetoothGATTGetServicesResponse &resp, size
 
 #endif  // USE_BLUETOOTH_PROXY_CONNECTIONS
 
-#if defined(USE_ESP32_BLE) && defined(USE_BLE_GATT_CLIENT)
+#if defined(USE_ESP32) && defined(USE_BLE_GATT_CLIENT)
 namespace esphome::bluetooth_connection {
 
 // Address-scoped Bluedroid maintenance. Gated with the connection surface:
@@ -65,4 +65,4 @@ conn_err_t clear_gatt_cache(uint64_t address) {
 }
 
 }  // namespace esphome::bluetooth_connection
-#endif  // USE_ESP32_BLE && USE_BLE_GATT_CLIENT
+#endif  // USE_ESP32 && USE_BLE_GATT_CLIENT

esphome/components/bluetooth_connection/bluetooth_connection.h

@@ -48,16 +48,15 @@ static constexpr conn_err_t CONN_OK = 0;
 // GATT contract so backend and wrapper cannot drift.
 static constexpr conn_err_t GATT_NOT_CONNECTED = ble_device_base::GATT_ERR_NOT_CONNECTED;
 
-// What the build's connection backend supports beyond GATT operations; the
-// proxy derives its feature flags and legacy version from these. Keyed on
-// the backend define, never the platform, so a second backend on one
-// platform carries its own facts.
-#if defined(USE_BLE_GATT_BACKEND_BLUEDROID)
+// What the platform's connection backend supports beyond GATT operations;
+// the proxy derives its feature flags and legacy version from these.
+#if defined(USE_ESP32)
 static constexpr bool SUPPORTS_PAIRING = true;
 static constexpr bool SUPPORTS_CACHE_CLEARING = true;
-#elif defined(USE_BLE_GATT_BACKEND_RP2)
+#elif defined(USE_RP2040_BLE) && defined(USE_BLE_GATT_CLIENT)
 // The rp2 BTstack backend pairs (just works + bonding); it has no service
-// cache to clear.
+// cache to clear. Keyed on the backend, not the generic client define, so a
+// future backend without pairing keeps the stub arm below.
 static constexpr bool SUPPORTS_PAIRING = true;
 static constexpr bool SUPPORTS_CACHE_CLEARING = false;
 #else
@@ -65,14 +64,13 @@ static constexpr bool SUPPORTS_PAIRING = false;
 static constexpr bool SUPPORTS_CACHE_CLEARING = false;
 #endif
 
-// Address-scoped (not connection-scoped) maintenance requests; keyed on the
-// stack (the calls need no backend instance).
-#if (defined(USE_ESP32_BLE) || defined(USE_RP2040_BLE)) && defined(USE_BLE_GATT_CLIENT)
+// Address-scoped (not connection-scoped) maintenance requests.
+#if (defined(USE_ESP32) || defined(USE_RP2040_BLE)) && defined(USE_BLE_GATT_CLIENT)
 conn_err_t unpair_device(uint64_t address);
 #else
 inline conn_err_t unpair_device(uint64_t) { return GATT_NOT_CONNECTED; }
 #endif
-#if defined(USE_ESP32_BLE) && defined(USE_BLE_GATT_CLIENT)
+#if defined(USE_ESP32) && defined(USE_BLE_GATT_CLIENT)
 conn_err_t clear_gatt_cache(uint64_t address);
 #else
 inline conn_err_t clear_gatt_cache(uint64_t) { return GATT_NOT_CONNECTED; }

esphome/components/bluetooth_connection/bluetooth_connection_bluedroid.cpp

@@ -2,11 +2,10 @@
 
 #if defined(USE_ESP32_BLE) && defined(USE_BLE_GATT_CLIENT)
 
-#include "bluetooth_connection.h"
-
 // The in-place streamer serves the proxy's service-discovery API; backend-only
 // builds compile without the proxy headers or the streamer.
 #ifdef USE_BLUETOOTH_PROXY_CONNECTIONS
+#include "bluetooth_connection.h"
 #include "bluetooth_connection_hub.h"
 
 #include "esphome/components/bluetooth_proxy/bluetooth_proxy.h"
@@ -301,9 +300,6 @@ int BluedroidGattClient::update_connection_params(uint16_t min_interval, uint16_
 
 void BluedroidGattClient::release_services() {
   this->service_total_ = 0;
-#ifdef USE_BLUEDROID_GATT_SERVICE_TABLE
-  this->table_.free();
-#endif
   // Always set: terminates any in-flight stream on every cache config.
   this->services_released_ = true;
 #ifndef CONFIG_BT_GATTC_CACHE_NVS_FLASH
@@ -316,24 +312,6 @@ void BluedroidGattClient::release_services() {
 #endif
 }
 
-#ifdef USE_BLUEDROID_GATT_SERVICE_TABLE
-ble_device_base::GattServiceTable BluedroidGattClient::get_service_table() {
-  // Lifetime: every teardown path (CLOSE_EVT, the safety timeout, stack-down,
-  // passive DISCONNECT) routes through release_services(), so a materialized
-  // table cannot outlive its link.
-  if (this->table_.empty() &&
-      (this->services_released_ || this->service_total_ == 0 ||
-       !this->table_.build(this->gattc_if_, this->conn_id_, this->service_total_, this->connection_index_))) {
-    // Released / no services / failed build all collapse to empty; the
-    // build failures warned above, log the quiet two.
-    ESP_LOGD(TAG, "[%d] No service table (released=%d, services=%u)", this->connection_index_, this->services_released_,
-             this->service_total_);
-    return {};
-  }
-  return this->table_.view();
-}
-#endif  // USE_BLUEDROID_GATT_SERVICE_TABLE
-
 // ---- internals ----
 
 bool BluedroidGattClient::check_addr_(const esp_bd_addr_t &addr) const {
@@ -380,11 +358,6 @@ void BluedroidGattClient::log_gattc_warning_(const char *operation, int code) {
 // ---- service streaming ----
 
 int BluedroidGattClient::handle_search_cmpl_(esp_gatt_status_t status) {
-#ifdef USE_BLUEDROID_GATT_SERVICE_TABLE
-  // Re-discovery moves the counts the table view derives offsets from; free
-  // the stale table.
-  this->table_.free();
-#endif
   // Step down from the fast discovery params.
   this->update_conn_params_(MEDIUM_MIN_CONN_INTERVAL, MEDIUM_MAX_CONN_INTERVAL, 0, MEDIUM_CONN_TIMEOUT, "medium");
   if (status != ESP_GATT_OK) {

esphome/components/bluetooth_connection/bluetooth_connection_bluedroid.h

@@ -11,9 +11,6 @@
 
 #if defined(USE_ESP32_BLE) && defined(USE_BLE_GATT_CLIENT)
 
-#include "bluetooth_connection.h"
-#include "gatt_service_table_bluedroid.h"
-
 #include "esphome/components/ble_device_base/ble_gatt_client.h"
 #include "esphome/components/esp32_ble_tracker/esp32_ble_tracker.h"
 #include "esphome/core/component.h"
@@ -75,16 +72,11 @@ class BluedroidGattClient final : public esp32_ble_tracker::ESPBTClient, public
   int notify_characteristic(uint16_t handle, bool enable);
   int pair();
   int update_connection_params(uint16_t min_interval, uint16_t max_interval, uint16_t latency, uint16_t timeout);
-  // On-demand table for direct consumers; the proxy streams instead, so the
-  // materializer compiles only under USE_BLUEDROID_GATT_SERVICE_TABLE (emitted by
-  // direct-consumer codegen, never by the proxy).
-#ifdef USE_BLUEDROID_GATT_SERVICE_TABLE
-  ble_device_base::GattServiceTable get_service_table();
-#else
-  // A direct consumer reaching this stub misconfigured its codegen
-  // (service_table=False): the empty table reads as a service-less peer.
+  // Contract stub: the proxy streams in place; the on-demand materializer
+  // for direct consumers lands with #18205. NOTE: a direct consumer reaching
+  // this stub gets an empty table indistinguishable from a service-less
+  // peer - do not ship one against this backend before the materializer.
   ble_device_base::GattServiceTable get_service_table() { return {}; }
-#endif
   void release_services();
 
 #ifdef USE_BLUETOOTH_PROXY_CONNECTIONS
@@ -113,9 +105,6 @@ class BluedroidGattClient final : public esp32_ble_tracker::ESPBTClient, public
 
   // Group 1: pointers / composed objects
   ble_device_base::GattClientListener *listener_{nullptr};
-#ifdef USE_BLUEDROID_GATT_SERVICE_TABLE
-  BluedroidServiceTable table_;
-#endif
   // Group 2: 4-byte types
   uint32_t disconnecting_started_{0};
 

esphome/components/bluetooth_connection/bluetooth_connection_gatt_backend.h

@@ -12,12 +12,10 @@
 
 #include "esphome/components/ble_device_base/ble_gatt_client.h"
 
-// Arms are keyed on codegen-emitted per-backend defines (_PLATFORM_BACKENDS
-// in __init__.py), so they are order-independent.
-#if defined(USE_BLE_GATT_BACKEND_RP2)
+#if defined(USE_RP2040_BLE)
 #include "bluetooth_connection_rp2.h"
 #define ESPHOME_BLE_GATT_CONNECTION_TYPE bluetooth_connection::RP2GattClient
-#elif defined(USE_BLE_GATT_BACKEND_BLUEDROID)
+#elif defined(USE_ESP32_BLE)
 #include "bluetooth_connection_bluedroid.h"
 #define ESPHOME_BLE_GATT_CONNECTION_TYPE bluetooth_connection::BluedroidGattClient
 #elif defined(USE_BLE_GATT_CLIENT_STUB_BACKEND)

esphome/components/bluetooth_connection/gatt_service_table_bluedroid.cpp

@@ -1,198 +0,0 @@
-#include "gatt_service_table_bluedroid.h"
-
-#if defined(USE_ESP32_BLE) && defined(USE_BLE_GATT_CLIENT) && defined(USE_BLUEDROID_GATT_SERVICE_TABLE)
-
-#include "esphome/core/log.h"
-
-namespace esphome::bluetooth_connection {
-
-static const char *const TAG = "gatt_service_table";
-
-// A stack that never reports end-of-range would otherwise walk forever.
-static constexpr uint16_t MAX_DESCRIPTORS_PER_CHARACTERISTIC = 64;
-
-// Shared enumeration for both build passes: an identical walk order is what
-// lets the counting pass size the block the filling pass fills.
-// INVALID_OFFSET/NOT_FOUND mean end-of-range; anything else is a failure.
-template<typename ServiceFn, typename CharFn, typename DescFn>
-bool BluedroidServiceTable::walk_(ServiceFn &&on_service, CharFn &&on_char, DescFn &&on_desc) {
-  for (uint16_t s = 0; s < this->service_total_; s++) {
-    esp_gattc_service_elem_t svc;
-    uint16_t svc_count = 1;
-    auto svc_status = esp_ble_gattc_get_service(this->gattc_if_, this->conn_id_, nullptr, &svc, &svc_count, s);
-    if (svc_status != ESP_GATT_OK || svc_count == 0) {
-      this->log_walk_warning_("esp_ble_gattc_get_service", svc_status);
-      return false;
-    }
-    if (!on_service(s, svc)) {
-      return false;
-    }
-    uint16_t svc_chars = 0;
-    auto count_status = esp_ble_gattc_get_attr_count(this->gattc_if_, this->conn_id_, ESP_GATT_DB_CHARACTERISTIC,
-                                                     svc.start_handle, svc.end_handle, 0, &svc_chars);
-    if (count_status != ESP_GATT_OK) {
-      this->log_walk_warning_("esp_ble_gattc_get_attr_count", count_status);
-      return false;
-    }
-    for (uint16_t c = 0; c < svc_chars; c++) {
-      esp_gattc_char_elem_t chr;
-      uint16_t char_count = 1;
-      auto status = esp_ble_gattc_get_all_char(this->gattc_if_, this->conn_id_, svc.start_handle, svc.end_handle, &chr,
-                                               &char_count, c);
-      if (status != ESP_GATT_OK || char_count == 0) {
-        // An early terminator contradicts svc_chars from the same cache;
-        // never build a silently truncated table.
-        this->log_walk_warning_("esp_ble_gattc_get_all_char", status);
-        return false;
-      }
-      if (!on_char(svc, chr)) {
-        return false;
-      }
-      for (uint16_t d = 0;; d++) {
-        if (d == MAX_DESCRIPTORS_PER_CHARACTERISTIC) {
-          // A stack that never reports end-of-range; fail like every other
-          // inconsistency instead of truncating the table silently.
-          ESP_LOGW(TAG, "[%d] Descriptor walk exceeded %u entries", this->log_index_,
-                   MAX_DESCRIPTORS_PER_CHARACTERISTIC);
-          return false;
-        }
-        esp_gattc_descr_elem_t desc;
-        uint16_t desc_count = 1;
-        auto desc_status =
-            esp_ble_gattc_get_all_descr(this->gattc_if_, this->conn_id_, chr.char_handle, &desc, &desc_count, d);
-        if (desc_status == ESP_GATT_INVALID_OFFSET || desc_status == ESP_GATT_NOT_FOUND) {
-          break;
-        }
-        if (desc_status != ESP_GATT_OK || desc_count == 0) {
-          this->log_walk_warning_("esp_ble_gattc_get_all_descr", desc_status);
-          return false;
-        }
-        if (!on_desc(chr, desc)) {
-          return false;
-        }
-      }
-    }
-  }
-  return true;
-}
-
-bool BluedroidServiceTable::count_services(esp_gatt_if_t gattc_if, uint16_t conn_id, uint16_t *total) {
-  uint16_t primary = 0;
-  uint16_t secondary = 0;
-  if (esp_ble_gattc_get_attr_count(gattc_if, conn_id, ESP_GATT_DB_PRIMARY_SERVICE, 0x0001, 0xFFFF, 0, &primary) !=
-          ESP_GATT_OK ||
-      esp_ble_gattc_get_attr_count(gattc_if, conn_id, ESP_GATT_DB_SECONDARY_SERVICE, 0x0001, 0xFFFF, 0, &secondary) !=
-          ESP_GATT_OK) {
-    // A failed count must not read as an authoritative empty database.
-    return false;
-  }
-  *total = primary + secondary;
-  return true;
-}
-
-bool BluedroidServiceTable::build(esp_gatt_if_t gattc_if, uint16_t conn_id, uint16_t service_total, uint8_t log_index) {
-  this->free();
-  this->gattc_if_ = gattc_if;
-  this->conn_id_ = conn_id;
-  this->service_total_ = service_total;
-  this->log_index_ = log_index;
-
-  // Pass 1: count, so one exact-size block holds the whole table.
-  uint16_t char_total = 0;
-  uint16_t desc_total = 0;
-  bool counted = this->walk_([](uint16_t, const esp_gattc_service_elem_t &) { return true; },
-                             [&](const esp_gattc_service_elem_t &, const esp_gattc_char_elem_t &) {
-                               char_total++;
-                               return true;
-                             },
-                             [&](const esp_gattc_char_elem_t &, const esp_gattc_descr_elem_t &) {
-                               desc_total++;
-                               return true;
-                             });
-  if (!counted) {
-    ESP_LOGW(TAG, "[%d] Service table walk failed during count", this->log_index_);
-    this->free();
-    return false;
-  }
-
-  // The arrays share one block; carving stays aligned because each struct's
-  // strictest member is the UUID and array sizes are multiples of it.
-  static_assert(alignof(ble_device_base::GattService) >= alignof(ble_device_base::GattCharacteristic) &&
-                alignof(ble_device_base::GattCharacteristic) >= alignof(ble_device_base::GattDescriptor));
-  size_t svc_bytes = this->service_total_ * sizeof(ble_device_base::GattService);
-  size_t char_bytes = char_total * sizeof(ble_device_base::GattCharacteristic);
-  size_t total_bytes = svc_bytes + char_bytes + desc_total * sizeof(ble_device_base::GattDescriptor);
-  RAMAllocator<uint8_t> allocator(RAMAllocator<uint8_t>::ALLOC_INTERNAL);
-  this->storage_ = allocator.allocate(total_bytes);
-  if (this->storage_ == nullptr) {
-    ESP_LOGW(TAG, "[%d] Service table allocation failed (%u bytes)", this->log_index_,
-             static_cast<unsigned>(total_bytes));
-    this->free();
-    return false;
-  }
-  auto *services = reinterpret_cast<ble_device_base::GattService *>(this->storage_);
-  auto *characteristics = reinterpret_cast<ble_device_base::GattCharacteristic *>(this->storage_ + svc_bytes);
-  auto *descriptors = reinterpret_cast<ble_device_base::GattDescriptor *>(this->storage_ + svc_bytes + char_bytes);
-
-  // Pass 2: fill, bounded by the pass-1 totals. A bound trip or a shortfall
-  // means the cached database changed between the passes; fail the build
-  // rather than serve an inconsistent table (the consumer retries).
-  uint16_t char_index = 0;
-  uint16_t desc_index = 0;
-  ble_device_base::GattService *cur_service = nullptr;
-  ble_device_base::GattCharacteristic *cur_char = nullptr;
-  bool filled = this->walk_(
-      [&](uint16_t s, const esp_gattc_service_elem_t &svc) {
-        cur_service = &services[s];
-        cur_service->uuid = ble_device_base::ESPBTUUID::from_uuid(svc.uuid);
-        cur_service->start_handle = svc.start_handle;
-        cur_service->end_handle = svc.end_handle;
-        cur_service->first_characteristic = char_index;
-        cur_service->characteristic_count = 0;
-        return true;
-      },
-      [&](const esp_gattc_service_elem_t &svc, const esp_gattc_char_elem_t &chr) {
-        if (char_index >= char_total) {
-          return false;
-        }
-        cur_char = &characteristics[char_index++];
-        cur_char->uuid = ble_device_base::ESPBTUUID::from_uuid(chr.uuid);
-        cur_char->value_handle = chr.char_handle;
-        // Bluedroid addresses descriptors by characteristic handle, so the
-        // table's end_handle only needs the service-bounded upper bound.
-        cur_char->end_handle = svc.end_handle;
-        cur_char->properties = chr.properties;
-        cur_char->first_descriptor = desc_index;
-        cur_char->descriptor_count = 0;
-        cur_service->characteristic_count++;
-        return true;
-      },
-      [&](const esp_gattc_char_elem_t &, const esp_gattc_descr_elem_t &desc) {
-        if (desc_index >= desc_total) {
-          return false;
-        }
-        descriptors[desc_index].uuid = ble_device_base::ESPBTUUID::from_uuid(desc.uuid);
-        descriptors[desc_index].handle = desc.handle;
-        desc_index++;
-        cur_char->descriptor_count++;
-        return true;
-      });
-  if (!filled || char_index != char_total || desc_index != desc_total) {
-    // Walk error or the database changed between passes; better an empty
-    // table than a corrupt one.
-    ESP_LOGW(TAG, "[%d] Service table walk mismatch, discarding", this->log_index_);
-    this->free();
-    return false;
-  }
-  this->char_total_ = char_total;
-  this->desc_total_ = desc_total;
-  return true;
-}
-
-void BluedroidServiceTable::log_walk_warning_(const char *operation, int code) {
-  ESP_LOGW(TAG, "[%d] %s failed, status=%d", this->log_index_, operation, code);
-}
-
-}  // namespace esphome::bluetooth_connection
-
-#endif  // USE_ESP32_BLE && USE_BLE_GATT_CLIENT && USE_BLUEDROID_GATT_SERVICE_TABLE

esphome/components/bluetooth_connection/gatt_service_table_bluedroid.h

@@ -1,80 +0,0 @@
-// Owning two-pass materializer of one Bluedroid GATT database snapshot into
-// the neutral GattServiceTable layout, shared by the BluedroidGattClient
-// backend and ble_client's esp32 engine.
-
-#pragma once
-
-#include "esphome/core/defines.h"
-
-#if defined(USE_ESP32_BLE) && defined(USE_BLE_GATT_CLIENT) && defined(USE_BLUEDROID_GATT_SERVICE_TABLE)
-
-#include "esphome/components/ble_device_base/ble_gatt_client.h"
-#include "esphome/core/helpers.h"
-
-#include <esp_gattc_api.h>
-
-namespace esphome::bluetooth_connection {
-
-class BluedroidServiceTable {
- public:
-  ~BluedroidServiceTable() { this->free(); }
-  // Owns storage_; a copy would double-free.
-  BluedroidServiceTable() = default;
-  BluedroidServiceTable(const BluedroidServiceTable &) = delete;
-  BluedroidServiceTable &operator=(const BluedroidServiceTable &) = delete;
-
-  /// The service count build() requires: the stack's PRIMARY+SECONDARY
-  /// attribute totals, never the SEARCH_RES event count.
-  static bool count_services(esp_gatt_if_t gattc_if, uint16_t conn_id, uint16_t *total);
-
-  /// Two-pass build from the stack's cached database (service_total from
-  /// count_services()). log_index labels warnings. Frees any previous table
-  /// first; on failure the table is left empty.
-  bool build(esp_gatt_if_t gattc_if, uint16_t conn_id, uint16_t service_total, uint8_t log_index);
-
-  // The view is carved from the storage block and the counts on each call
-  // (a cold path) rather than cached, saving a per-instance table member.
-  ble_device_base::GattServiceTable view() const {
-    size_t svc_bytes = this->service_total_ * sizeof(ble_device_base::GattService);
-    size_t char_bytes = this->char_total_ * sizeof(ble_device_base::GattCharacteristic);
-    return {reinterpret_cast<const ble_device_base::GattService *>(this->storage_),
-            reinterpret_cast<const ble_device_base::GattCharacteristic *>(this->storage_ + svc_bytes),
-            reinterpret_cast<const ble_device_base::GattDescriptor *>(this->storage_ + svc_bytes + char_bytes),
-            this->service_total_,
-            this->char_total_,
-            this->desc_total_};
-  }
-
-  // Always resets the counts: a failed build must never leave a non-zero
-  // service_total_ behind a null table.
-  void free() {
-    if (this->storage_ != nullptr) {
-      RAMAllocator<uint8_t> allocator(RAMAllocator<uint8_t>::ALLOC_INTERNAL);
-      allocator.deallocate(this->storage_, 0);
-      this->storage_ = nullptr;
-    }
-    this->service_total_ = 0;
-    this->char_total_ = 0;
-    this->desc_total_ = 0;
-  }
-
-  bool empty() const { return this->storage_ == nullptr; }
-
- private:
-  template<typename ServiceFn, typename CharFn, typename DescFn>
-  bool walk_(ServiceFn &&on_service, CharFn &&on_char, DescFn &&on_desc);
-  void log_walk_warning_(const char *operation, int code);
-
-  uint8_t *storage_{nullptr};
-  uint16_t service_total_{0};
-  uint16_t char_total_{0};
-  uint16_t desc_total_{0};
-  // Walk context, set by build().
-  uint16_t conn_id_{0};
-  esp_gatt_if_t gattc_if_{};  // uint8_t width
-  uint8_t log_index_{0};
-};
-
-}  // namespace esphome::bluetooth_connection
-
-#endif  // USE_ESP32_BLE && USE_BLE_GATT_CLIENT && USE_BLUEDROID_GATT_SERVICE_TABLE

esphome/components/bluetooth_proxy/__init__.py

@@ -98,15 +98,9 @@ def _esp32_config_schema() -> cv.All:
                 raise cv.Invalid(
                     "Connections can only be used if the proxy is set to active"
                 )
-            # Explicit entries claim slots like the generated ones; dev
-            # historically skipped this, letting an explicit-connections
-            # config evade the controller budget.
-            bluetooth_connection.consume_gatt_slot(
-                "bluetooth_proxy", len(config[CONF_CONNECTIONS])
-            )(config)
         elif config[CONF_ACTIVE]:
             connection_slots: int = config[CONF_CONNECTION_SLOTS]
-            bluetooth_connection.consume_gatt_slot("bluetooth_proxy", connection_slots)(
+            esp32_ble.consume_connection_slots(connection_slots, "bluetooth_proxy")(
                 config
             )
 
@@ -163,14 +157,14 @@ def _rp2_config_schema() -> cv.All:
     connection_schema = bluetooth_connection.hub_connection_schema(PLATFORM_RP2)
 
     def populate_connections(config: ConfigType) -> ConfigType:
+        from esphome.components import rp2040_ble
+
         # One wrapper + backend pair per slot, declared during validation so
         # their ids exist for codegen (the esp32 arm's `connections` pattern).
         if not config[CONF_ACTIVE]:
             return config
         connection_slots: int = config[CONF_CONNECTION_SLOTS]
-        bluetooth_connection.consume_gatt_slot("bluetooth_proxy", connection_slots)(
-            config
-        )
+        rp2040_ble.consume_connection_slots(connection_slots, "bluetooth_proxy")(config)
         return {
             **config,
             CONF_CONNECTIONS: [connection_schema({}) for _ in range(connection_slots)],
@@ -220,9 +214,7 @@ async def _connections_to_code(var: cg.MockObj, config: ConfigType) -> None:
         # sends those requests and their handlers and encoders are dead.
         cg.add_define("USE_BLUETOOTH_PROXY_CONNECTIONS")
     for connection_conf in connections:
-        backend = await bluetooth_connection.new_gatt_backend(
-            connection_conf, service_table=False
-        )
+        backend = await bluetooth_connection.new_gatt_backend(connection_conf)
         connection = cg.new_Pvariable(connection_conf[CONF_ID])
         cg.add(connection.set_backend(backend))
         cg.add(var.register_connection(connection))

esphome/components/climate/climate.cpp

@@ -368,8 +368,8 @@ optional<ClimateDeviceRestoreState> Climate::restore_state_() {
 }
 
 void Climate::save_state_(const ClimateTraits &traits) {
-#if (defined(USE_ESP32) || (defined(USE_ESP8266) && USE_ARDUINO_VERSION_CODE >= VERSION_CODE(3, 0, 0))) && \
-    !defined(CLANG_TIDY)
+#if (defined(USE_ESP32) || defined(USE_ESP8266)) && !defined(CLANG_TIDY)
+#pragma GCC diagnostic push
 #pragma GCC diagnostic ignored "-Wclass-memaccess"
 #define TEMP_IGNORE_MEMACCESS
 #endif

esphome/components/cm1106/cm1106.cpp

@@ -100,7 +100,6 @@ bool CM1106Component::cm1106_write_command_(const uint8_t *command, size_t comma
 void CM1106Component::dump_config() {
   ESP_LOGCONFIG(TAG, "CM1106:");
   LOG_SENSOR("  ", "CO2", this->co2_sensor_);
-  this->check_uart_settings(9600);
   if (this->is_failed()) {
     ESP_LOGE(TAG, ESP_LOG_MSG_COMM_FAIL);
   }

esphome/components/cm1106/sensor.py

@@ -46,6 +46,14 @@ CONFIG_SCHEMA = (
     .extend(uart.UART_DEVICE_SCHEMA)
 )
 
+FINAL_VALIDATE_SCHEMA = uart.final_validate_device_schema(
+    "cm1106",
+    baud_rate=9600,
+    data_bits=8,
+    parity="NONE",
+    stop_bits=1,
+)
+
 
 async def to_code(config: ConfigType) -> None:
     """Code generation entry point."""

esphome/components/cse7761/cse7761.cpp

@@ -58,7 +58,6 @@ void CSE7761Component::dump_config() {
     ESP_LOGE(TAG, ESP_LOG_MSG_COMM_FAIL);
   }
   LOG_UPDATE_INTERVAL(this);
-  this->check_uart_settings(38400, 1, uart::UART_CONFIG_PARITY_EVEN, 8);
 }
 
 void CSE7761Component::update() {

esphome/components/cse7761/sensor.py

@@ -68,7 +68,13 @@ CONFIG_SCHEMA = (
 )
 
 FINAL_VALIDATE_SCHEMA = uart.final_validate_device_schema(
-    "cse7761", baud_rate=38400, require_rx=True, require_tx=True
+    "cse7761",
+    baud_rate=38400,
+    require_rx=True,
+    require_tx=True,
+    data_bits=8,
+    parity="EVEN",
+    stop_bits=1,
 )
 
 

esphome/components/cse7766/cse7766.cpp

@@ -255,7 +255,6 @@ void CSE7766Component::dump_config() {
   LOG_SENSOR("  ", "Apparent Power", this->apparent_power_sensor_);
   LOG_SENSOR("  ", "Reactive Power", this->reactive_power_sensor_);
   LOG_SENSOR("  ", "Power Factor", this->power_factor_sensor_);
-  this->check_uart_settings(4800, 1, uart::UART_CONFIG_PARITY_EVEN);
 }
 
 }  // namespace esphome::cse7766

esphome/components/cse7766/sensor.py

@@ -84,7 +84,12 @@ CONFIG_SCHEMA = (
     .extend(cv.COMPONENT_SCHEMA)
 )
 FINAL_VALIDATE_SCHEMA = uart.final_validate_device_schema(
-    "cse7766", baud_rate=4800, parity="EVEN", require_rx=True
+    "cse7766",
+    baud_rate=4800,
+    require_rx=True,
+    data_bits=8,
+    parity="EVEN",
+    stop_bits=1,
 )
 
 

esphome/components/daly_bms/__init__.py

@@ -26,6 +26,14 @@ CONFIG_SCHEMA = (
     .extend(cv.polling_component_schema("30s"))
 )
 
+FINAL_VALIDATE_SCHEMA = uart.final_validate_device_schema(
+    "daly_bms",
+    baud_rate=9600,
+    data_bits=8,
+    parity="NONE",
+    stop_bits=1,
+)
+
 
 async def to_code(config: ConfigType) -> None:
     var = cg.new_Pvariable(config[CONF_ID])

esphome/components/daly_bms/daly_bms.cpp

@@ -22,10 +22,7 @@ static const uint8_t DALY_REQUEST_TEMPERATURE = 0x96;
 
 void DalyBmsComponent::setup() { this->next_request_ = 1; }
 
-void DalyBmsComponent::dump_config() {
-  ESP_LOGCONFIG(TAG, "Daly BMS:");
-  this->check_uart_settings(9600);
-}
+void DalyBmsComponent::dump_config() { ESP_LOGCONFIG(TAG, "Daly BMS:"); }
 
 void DalyBmsComponent::update() {
   this->trigger_next_ = true;

esphome/components/debug/debug_component.cpp

@@ -22,9 +22,9 @@ void DebugComponent::dump_config() {
   LOG_SENSOR("  ", "Free space on heap", this->free_sensor_);
   LOG_SENSOR("  ", "Largest free heap block", this->block_sensor_);
   LOG_SENSOR("  ", "CPU frequency", this->cpu_frequency_sensor_);
-#if defined(USE_ESP8266) && USE_ARDUINO_VERSION_CODE >= VERSION_CODE(2, 5, 2)
+#ifdef USE_ESP8266
   LOG_SENSOR("  ", "Heap fragmentation", this->fragmentation_sensor_);
-#endif  // defined(USE_ESP8266) && USE_ARDUINO_VERSION_CODE >= VERSION_CODE(2, 5, 2)
+#endif  // USE_ESP8266
 #endif  // USE_SENSOR
 
   char device_info_buffer[DEVICE_INFO_BUFFER_SIZE];

esphome/components/debug/debug_component.h

@@ -35,7 +35,7 @@ class DebugComponent final : public PollingComponent {
 #ifdef USE_SENSOR
   void set_free_sensor(sensor::Sensor *free_sensor) { free_sensor_ = free_sensor; }
   void set_block_sensor(sensor::Sensor *block_sensor) { block_sensor_ = block_sensor; }
-#if (defined(USE_ESP8266) && USE_ARDUINO_VERSION_CODE >= VERSION_CODE(2, 5, 2)) || defined(USE_ESP32)
+#if defined(USE_ESP8266) || defined(USE_ESP32)
   void set_fragmentation_sensor(sensor::Sensor *fragmentation_sensor) { fragmentation_sensor_ = fragmentation_sensor; }
 #endif
 #if defined(USE_ESP32) || defined(USE_LIBRETINY)
@@ -61,7 +61,7 @@ class DebugComponent final : public PollingComponent {
 
   sensor::Sensor *free_sensor_{nullptr};
   sensor::Sensor *block_sensor_{nullptr};
-#if (defined(USE_ESP8266) && USE_ARDUINO_VERSION_CODE >= VERSION_CODE(2, 5, 2)) || defined(USE_ESP32)
+#if defined(USE_ESP8266) || defined(USE_ESP32)
   sensor::Sensor *fragmentation_sensor_{nullptr};
 #endif
 #if defined(USE_ESP32) || defined(USE_LIBRETINY)

esphome/components/debug/debug_esp8266.cpp

@@ -159,12 +159,10 @@ void DebugComponent::update_platform_() {
     // NOLINTNEXTLINE(readability-static-accessed-through-instance)
     this->block_sensor_->publish_state(ESP.getMaxFreeBlockSize());
   }
-#if USE_ARDUINO_VERSION_CODE >= VERSION_CODE(2, 5, 2)
   if (this->fragmentation_sensor_ != nullptr) {
     // NOLINTNEXTLINE(readability-static-accessed-through-instance)
     this->fragmentation_sensor_->publish_state(ESP.getHeapFragmentation());
   }
-#endif
 
 #endif
 }

esphome/components/debug/sensor.py

@@ -52,12 +52,9 @@ CONFIG_SCHEMA = {
     ),
     cv.Optional(CONF_FRAGMENTATION): cv.All(
         cv.Any(
-            cv.All(
-                cv.only_on_esp8266,
-                cv.require_framework_version(esp8266_arduino=cv.Version(2, 5, 2)),
-            ),
+            cv.only_on_esp8266,
             cv.only_on_esp32,
-            msg="This feature is only available on ESP8266 (Arduino 2.5.2+) and ESP32",
+            msg="This feature is only available on ESP8266 and ESP32",
         ),
         sensor.sensor_schema(
             unit_of_measurement=UNIT_PERCENT,

esphome/components/dfplayer/__init__.py

@@ -60,7 +60,12 @@ CONFIG_SCHEMA = cv.All(
     ).extend(uart.UART_DEVICE_SCHEMA)
 )
 FINAL_VALIDATE_SCHEMA = uart.final_validate_device_schema(
-    "dfplayer", baud_rate=9600, require_tx=True
+    "dfplayer",
+    baud_rate=9600,
+    require_tx=True,
+    data_bits=8,
+    parity="NONE",
+    stop_bits=1,
 )
 
 

esphome/components/dfplayer/dfplayer.cpp

@@ -277,9 +277,6 @@ void DFPlayer::loop() {
     }
   }
 }
-void DFPlayer::dump_config() {
-  ESP_LOGCONFIG(TAG, "DFPlayer:");
-  this->check_uart_settings(9600);
-}
+void DFPlayer::dump_config() { ESP_LOGCONFIG(TAG, "DFPlayer:"); }
 
 }  // namespace esphome::dfplayer

esphome/components/esp32_ble/ble.cpp

@@ -100,21 +100,38 @@ void ESP32BLE::disable() {
 #ifdef USE_ESP32_BLE_ADVERTISING
 void ESP32BLE::advertising_start() {
   this->advertising_init_();
-  if (!this->is_active())
+  this->advertising_ref_count_++;
+  this->advertising_refresh();
+}
+
+void ESP32BLE::advertising_stop() {
+  if (this->advertising_ref_count_ == 0)
     return;
-  this->advertising_->start();
+  this->advertising_ref_count_--;
+  this->advertising_refresh();
+}
+
+void ESP32BLE::advertising_refresh() {
+  if (this->advertising_ == nullptr || !this->is_active())
+    return;
+  // Advertise while any component still needs it, otherwise stop
+  if (this->advertising_ref_count_ == 0) {
+    this->advertising_->stop();
+  } else {
+    this->advertising_->start();
+  }
 }
 
 void ESP32BLE::advertising_set_service_data(const std::vector<uint8_t> &data) {
   this->advertising_init_();
   this->advertising_->set_service_data(data);
-  this->advertising_start();
+  this->advertising_refresh();
 }
 
 void ESP32BLE::advertising_set_manufacturer_data(const std::vector<uint8_t> &data) {
   this->advertising_init_();
   this->advertising_->set_manufacturer_data(data);
-  this->advertising_start();
+  this->advertising_refresh();
 }
 
 void ESP32BLE::advertising_set_service_data_and_name(std::span<const uint8_t> data, bool include_name) {
@@ -136,7 +153,7 @@ void ESP32BLE::advertising_set_service_data_and_name(std::span<const uint8_t> da
     this->advertising_->set_service_data(data);
   }
 
-  this->advertising_start();
+  this->advertising_refresh();
 }
 
 void ESP32BLE::advertising_register_raw_advertisement_callback(std::function<void(bool)> &&callback) {
@@ -147,13 +164,13 @@ void ESP32BLE::advertising_register_raw_advertisement_callback(std::function<voi
 void ESP32BLE::advertising_add_service_uuid(ESPBTUUID uuid) {
   this->advertising_init_();
   this->advertising_->add_service_uuid(uuid);
-  this->advertising_start();
+  this->advertising_refresh();
 }
 
 void ESP32BLE::advertising_remove_service_uuid(ESPBTUUID uuid) {
   this->advertising_init_();
   this->advertising_->remove_service_uuid(uuid);
-  this->advertising_start();
+  this->advertising_refresh();
 }
 #endif
 
@@ -575,6 +592,10 @@ void ESP32BLE::loop_handle_state_transition_not_active_() {
     }
 
     this->state_ = BLE_COMPONENT_STATE_ACTIVE;
+#ifdef USE_ESP32_BLE_ADVERTISING
+    // Requests made before the stack was up (or before it was re-enabled) take effect now
+    this->advertising_refresh();
+#endif
   }
 }
 

esphome/components/esp32_ble/ble.h

@@ -114,7 +114,17 @@ class ESP32BLE final : public Component {
   void set_name(const char *name) { this->name_ = name; }
 
 #ifdef USE_ESP32_BLE_ADVERTISING
+  /** Request advertising on behalf of a component.
+   *
+   * Requests are reference counted: advertising runs until every component that called
+   * advertising_start() has released it again with advertising_stop(). Each component must
+   * pair its calls, so nothing advertises until something actually asks for it.
+   */
   void advertising_start();
+  /// Release a request made with advertising_start(); advertising stops at the last release.
+  void advertising_stop();
+  /// Apply the current payload and request count: advertise while requested, otherwise stop.
+  void advertising_refresh();
   void advertising_set_service_data(const std::vector<uint8_t> &data);
   void advertising_set_manufacturer_data(const std::vector<uint8_t> &data);
   void advertising_set_appearance(uint16_t appearance) { this->appearance_ = appearance; }
@@ -226,6 +236,9 @@ class ESP32BLE final : public Component {
   // 1-byte aligned members (grouped together to minimize padding)
   BLEComponentState state_{BLE_COMPONENT_STATE_OFF};  // 1 byte (uint8_t enum)
   bool enable_on_boot_{};                             // 1 byte
+#ifdef USE_ESP32_BLE_ADVERTISING
+  uint8_t advertising_ref_count_{0};  // 1 byte, number of components requesting advertising
+#endif
 
 #ifdef ESPHOME_ESP32_BLE_EXTENDED_AUTH_PARAMS
   optional<esp_ble_auth_req_t> auth_req_mode_;

esphome/components/esp32_ble_beacon/esp32_ble_beacon.cpp

@@ -67,6 +67,8 @@ void ESP32BLEBeacon::setup() {
       this->on_advertise_();
     }
   });
+  // A beacon always needs the device to advertise, and never releases the request
+  global_ble->advertising_start();
 }
 
 void ESP32BLEBeacon::on_advertise_() {

esphome/components/esp32_ble_server/__init__.py

@@ -596,6 +596,18 @@ async def to_code(config):
     cg.add(var.set_parent(parent))
     cg.add(parent.advertising_set_appearance(config[CONF_APPEARANCE]))
     cg.add(var.set_max_clients(config[CONF_MAX_CLIENTS]))
+    # Only advertise for the server itself when the configuration gives clients something to
+    # find. A server that is auto-loaded purely to host a runtime service (esp32_improv) stays
+    # silent until that service asks for advertising.
+    cg.add(
+        var.set_advertising_required(
+            CONF_MANUFACTURER_DATA in config
+            or any(
+                not uuid_is(service_config[CONF_UUID], DEVICE_INFORMATION_SERVICE_UUID)
+                for service_config in config[CONF_SERVICES]
+            )
+        )
+    )
     if CONF_MANUFACTURER_DATA in config:
         cg.add(var.set_manufacturer_data(config[CONF_MANUFACTURER_DATA]))
     for service_config in config[CONF_SERVICES]:

esphome/components/esp32_ble_server/ble_server.cpp

@@ -81,6 +81,7 @@ void BLEServer::loop() {
       if (this->device_information_service_->is_running()) {
         this->state_ = RUNNING;
         this->restart_advertising_();
+        this->request_advertising_();
         ESP_LOGD(TAG, "BLE server setup successfully");
       } else if (this->device_information_service_->is_created()) {
         this->device_information_service_->start();
@@ -98,6 +99,20 @@ void BLEServer::restart_advertising_() {
   }
 }
 
+void BLEServer::request_advertising_() {
+  if (!this->advertising_required_ || this->advertising_requested_)
+    return;
+  this->advertising_requested_ = true;
+  this->parent_->advertising_start();
+}
+
+void BLEServer::release_advertising_() {
+  if (!this->advertising_requested_)
+    return;
+  this->advertising_requested_ = false;
+  this->parent_->advertising_stop();
+}
+
 BLEService *BLEServer::create_service(ESPBTUUID uuid, bool advertise, uint16_t num_handles) {
 #if ESPHOME_LOG_LEVEL >= ESPHOME_LOG_LEVEL_VERBOSE
   char uuid_buf[esp32_ble::UUID_STR_LEN];
@@ -170,7 +185,7 @@ void BLEServer::gatts_event_handler(esp_gatts_cb_event_t event, esp_gatt_if_t ga
       this->add_client_(param->connect.conn_id);
       // Resume advertising so additional clients can discover and connect
       if (this->client_count_ < this->max_clients_) {
-        this->parent_->advertising_start();
+        this->parent_->advertising_refresh();
       }
       this->dispatch_callbacks_(CallbackType::ON_CONNECT, param->connect.conn_id);
       break;
@@ -178,7 +193,7 @@ void BLEServer::gatts_event_handler(esp_gatts_cb_event_t event, esp_gatt_if_t ga
     case ESP_GATTS_DISCONNECT_EVT: {
       ESP_LOGD(TAG, "BLE Client disconnected");
       this->remove_client_(param->disconnect.conn_id);
-      this->parent_->advertising_start();
+      this->parent_->advertising_refresh();
       this->dispatch_callbacks_(CallbackType::ON_DISCONNECT, param->disconnect.conn_id);
       break;
     }
@@ -226,6 +241,8 @@ void BLEServer::remove_client_(uint16_t conn_id) {
 }
 
 void BLEServer::ble_before_disabled_event_handler() {
+  // Advertising is re-requested once the server is running again after BLE is re-enabled
+  this->release_advertising_();
   // Delete all clients
   this->client_count_ = 0;
   // Delete all services

esphome/components/esp32_ble_server/ble_server.h

@@ -38,6 +38,13 @@ class BLEServer final : public Component, public Parented<ESP32BLE> {
     this->restart_advertising_();
   }
 
+  /** Whether this server needs the device to advertise so clients can find and connect to it.
+   *
+   * False for a server that only hosts services created at runtime (e.g. esp32_improv), which
+   * request advertising themselves for as long as they need it.
+   */
+  void set_advertising_required(bool required) { this->advertising_required_ = required; }
+
   void set_max_clients(uint8_t max_clients) { this->max_clients_ = max_clients; }
   uint8_t get_max_clients() const { return this->max_clients_; }
 
@@ -82,6 +89,8 @@ class BLEServer final : public Component, public Parented<ESP32BLE> {
   };
 
   void restart_advertising_();
+  void request_advertising_();
+  void release_advertising_();
 
   int8_t find_client_index_(uint16_t conn_id) const;
   void add_client_(uint16_t conn_id);
@@ -93,6 +102,8 @@ class BLEServer final : public Component, public Parented<ESP32BLE> {
   std::vector<uint8_t> manufacturer_data_{};
   esp_gatt_if_t gatts_if_{0};
   bool registered_{false};
+  bool advertising_required_{true};
+  bool advertising_requested_{false};
 
   uint16_t clients_[USE_ESP32_BLE_MAX_CONNECTIONS]{};
   uint8_t client_count_{0};

esphome/components/esp32_improv/esp32_improv_component.cpp

@@ -112,6 +112,7 @@ void ESP32ImprovComponent::loop() {
       this->state_callback_.call(this->state_, this->error_state_);
 #endif
     }
+    this->release_advertising_();
     this->incoming_data_.clear();
     return;
   }
@@ -143,8 +144,9 @@ void ESP32ImprovComponent::loop() {
           ESP_LOGV(TAG, "Starting with device name advertising");
           this->advertising_device_name_ = true;
           this->last_name_adv_time_ = App.get_loop_component_start_time();
+          // Set the payload before requesting, so advertising starts exactly once
           esp32_ble::global_ble->advertising_set_service_data_and_name(std::span<const uint8_t>{}, true);
-          esp32_ble::global_ble->advertising_start();
+          this->request_advertising_();
 
           // Set initial state based on whether we have an authorizer
           this->set_state_(this->get_initial_state_(), false);
@@ -326,6 +328,8 @@ void ESP32ImprovComponent::stop() {
   this->set_timeout("end-service", STOP_ADVERTISING_DELAY, [this] {
     if (this->state_ == improv::STATE_STOPPED || this->service_ == nullptr)
       return;
+    // Release first so removing the service UUID does not restart advertising on the way out
+    this->release_advertising_();
     this->service_->stop();
     this->set_state_(improv::STATE_STOPPED);
   });
@@ -520,6 +524,20 @@ void ESP32ImprovComponent::update_advertising_type_() {
   }
 }
 
+void ESP32ImprovComponent::request_advertising_() {
+  if (this->advertising_requested_)
+    return;
+  this->advertising_requested_ = true;
+  esp32_ble::global_ble->advertising_start();
+}
+
+void ESP32ImprovComponent::release_advertising_() {
+  if (!this->advertising_requested_)
+    return;
+  this->advertising_requested_ = false;
+  esp32_ble::global_ble->advertising_stop();
+}
+
 improv::State ESP32ImprovComponent::get_initial_state_() const {
 #ifdef USE_BINARY_SENSOR
   // If we have an authorizer, start in awaiting authorization state

esphome/components/esp32_improv/esp32_improv_component.h

@@ -104,8 +104,11 @@ class ESP32ImprovComponent final : public Component, public improv_base::ImprovB
   bool status_indicator_state_{false};
   uint32_t last_name_adv_time_{0};
   bool advertising_device_name_{false};
+  bool advertising_requested_{false};
   void set_status_indicator_state_(bool state);
   void update_advertising_type_();
+  void request_advertising_();
+  void release_advertising_();
 
   void set_state_(improv::State state, bool update_advertising = true);
   void set_error_(improv::Error error);

esphome/components/esp8266/__init__.py

@@ -35,7 +35,7 @@ from esphome.platformio.toolchain import copy_ccache_script
 from esphome.storage_json import StorageJSON
 from esphome.types import ConfigType
 
-from .boards import BOARDS, ESP8266_LD_SCRIPTS, board_ld_script
+from .boards import BOARDS, board_ld_script
 from .const import (
     CONF_EARLY_PIN_INIT,
     CONF_ENABLE_SERIAL,
@@ -43,8 +43,6 @@ from .const import (
     CONF_RESTORE_FROM_FLASH,
     KEY_BOARD,
     KEY_ESP8266,
-    KEY_FLASH_SIZE,
-    KEY_LDSCRIPT,
     KEY_PIN_INITIAL_STATES,
     KEY_SERIAL1_REQUIRED,
     KEY_SERIAL_REQUIRED,
@@ -133,10 +131,6 @@ def _format_framework_arduino_version(ver: cv.Version) -> str:
     # format the given arduino (https://github.com/esp8266/Arduino/releases) version to
     # a PIO platformio/framework-arduinoespressif8266 value
     # List of package versions: https://api.registry.platformio.org/v3/packages/platformio/tool/framework-arduinoespressif8266
-    if ver <= cv.Version(2, 4, 1):
-        return f"~1.{ver.major}{ver.minor:02d}{ver.patch:02d}.0"
-    if ver <= cv.Version(2, 6, 2):
-        return f"~2.{ver.major}{ver.minor:02d}{ver.patch:02d}.0"
     # Same encoding the native toolchain uses for its package download, so a
     # version bump cannot drift between the two paths.
     from esphome.arduino8266.framework import framework_package_version
@@ -159,11 +153,9 @@ def _format_framework_arduino_version(ver: cv.Version) -> str:
 #  - https://github.com/esp8266/Arduino/releases
 #  - https://api.registry.platformio.org/v3/packages/platformio/tool/framework-arduinoespressif8266
 RECOMMENDED_ARDUINO_FRAMEWORK_VERSION = cv.Version(3, 1, 2)
-# The platformio/espressif8266 version to use for arduino 2 framework versions
+# The platformio/espressif8266 version to use for arduino 3 framework versions
 #  - https://github.com/platformio/platform-espressif8266/releases
 #  - https://api.registry.platformio.org/v3/packages/platformio/platform/espressif8266
-ARDUINO_2_PLATFORM_VERSION = cv.Version(2, 6, 3)
-# for arduino 3 framework versions
 ARDUINO_3_PLATFORM_VERSION = cv.Version(3, 2, 0)
 # for arduino 4 framework versions
 ARDUINO_4_PLATFORM_VERSION = cv.Version(4, 2, 1)
@@ -188,6 +180,14 @@ def _arduino_check_versions(value: ConfigType) -> ConfigType:
         version = cv.Version.parse(cv.version_number(value[CONF_VERSION]))
         source = value.get(CONF_SOURCE, None)
 
+    if version < cv.Version(3, 0, 0):
+        raise cv.Invalid(
+            f"Arduino framework {version} is no longer supported; ESPHome requires "
+            f"C++20, which needs Arduino core 3.x. Use the recommended version "
+            f"({RECOMMENDED_ARDUINO_FRAMEWORK_VERSION}).",
+            path=[CONF_VERSION],
+        )
+
     value[CONF_VERSION] = str(version)
     value[CONF_SOURCE] = source or _format_framework_arduino_version(version)
 
@@ -195,12 +195,8 @@ def _arduino_check_versions(value: ConfigType) -> ConfigType:
     if platform_version is None:
         if version >= cv.Version(3, 1, 0):
             platform_version = _parse_platform_version(str(ARDUINO_4_PLATFORM_VERSION))
-        elif version >= cv.Version(3, 0, 0):
-            platform_version = _parse_platform_version(str(ARDUINO_3_PLATFORM_VERSION))
-        elif version >= cv.Version(2, 5, 0):
-            platform_version = _parse_platform_version(str(ARDUINO_2_PLATFORM_VERSION))
         else:
-            platform_version = _parse_platform_version(str(cv.Version(1, 8, 0)))
+            platform_version = _parse_platform_version(str(ARDUINO_3_PLATFORM_VERSION))
     value[CONF_PLATFORM_VERSION] = platform_version
 
     if version != RECOMMENDED_ARDUINO_FRAMEWORK_VERSION:
@@ -289,29 +285,11 @@ def check_rosetta() -> None:
         )
 
 
-def _choose_ld_script(board: str, ver: cv.Version) -> str | None:
-    """The flash ld to pin for this board and core, or None for cores
-    without ld-script support."""
-    board_data = BOARDS[board]
-    ld_scripts = ESP8266_LD_SCRIPTS[board_data[KEY_FLASH_SIZE]]
-    if ver <= cv.Version(2, 3, 0):
-        # No ld script support
-        return None
-    if ver <= cv.Version(2, 4, 2):
-        # Old ld script path; the modern per-board override names do not
-        # exist in this core's SDK, so the override cannot be honored.
-        # Substituting the size default would move _FS_end and the
-        # preferences sector, wiping flash-backed state on flash.
-        if KEY_LDSCRIPT in board_data:
-            raise EsphomeError(
-                f"Board {board} requires its {board_data[KEY_LDSCRIPT]} "
-                f"flash layout, which Arduino core {ver} cannot honor; "
-                "use a core newer than 2.4.2"
-            )
-        return ld_scripts[0]
+def _choose_ld_script(board: str) -> str:
+    """The flash ld to pin for this board."""
     # A per-board override preserves a layout the board shipped with
     # (see d1_wroom_02 in boards.py)
-    return board_ld_script(board_data)
+    return board_ld_script(BOARDS[board])
 
 
 @coroutine_with_priority(CoroPriority.PLATFORM)
@@ -435,10 +413,9 @@ async def to_code(config: ConfigType) -> None:
     )
 
     if config[CONF_BOARD] in BOARDS:
-        ld_script = _choose_ld_script(config[CONF_BOARD], ver)
-
-        if ld_script is not None:
-            cg.add_platformio_option("board_build.ldscript", ld_script)
+        cg.add_platformio_option(
+            "board_build.ldscript", _choose_ld_script(config[CONF_BOARD])
+        )
 
     CORE.add_job(add_pin_initial_states_array)
     CORE.add_job(finalize_waveform_config)

esphome/components/esphome/ota/__init__.py

@@ -2,12 +2,12 @@ import logging
 
 import esphome.codegen as cg
 from esphome.components.noise import (
-    decode_encryption_key,
     encryption_schema,
-    is_reserved_key,
+    new_psk_progmem,
+    static_encryption_key,
 )
 from esphome.components.ota import BASE_OTA_SCHEMA, OTAComponent, ota_to_code
-from esphome.config_helpers import merge_config
+from esphome.config_helpers import filter_source_files_from_defines, merge_config
 import esphome.config_validation as cv
 from esphome.const import (
     CONF_API,
@@ -31,7 +31,6 @@ import esphome.final_validate as fv
 from esphome.types import ConfigType
 
 CONF_ALLOW_PARTITION_ACCESS = "allow_partition_access"
-CONF_CAPTIVE_PORTAL = "captive_portal"
 
 _LOGGER = logging.getLogger(__name__)
 
@@ -41,11 +40,10 @@ DEPENDENCIES = ["network"]
 
 
 def AUTO_LOAD(config: ConfigType) -> list[str]:
-    """Auto-load noise only when encryption is configured."""
+    """Auto-load noise only when encryption is configured; the api key offer
+    inherits it from the api component."""
     base = ["sha256", "socket"]
-    # A falsy config is a tooling probe for the maximal set (None from
-    # dependency resolution, {} from the components-graph platform probe);
-    # a validated config always carries defaults, never empty
+    # A falsy config is a tooling probe for the maximal set
     if not config or CONF_ENCRYPTION in config:
         return base + ["noise"]
     return base
@@ -132,12 +130,56 @@ def ota_esphome_final_validate(config: ConfigType) -> None:
         _validate_no_password_with_encryption(ota_conf)
         if (encryption_conf := ota_conf.get(CONF_ENCRYPTION)) is not None:
             _resolve_encryption_key(encryption_conf, api_conf)
-    if any(
-        conf.get(CONF_PLATFORM) == CONF_WEB_SERVER for conf in full_ota_conf
-    ) and any(
-        CONF_ENCRYPTION in conf for conf in merged_ota_esphome_configs_by_port.values()
+        elif CONF_PASSWORD in ota_conf and static_encryption_key(api_conf) is not None:
+            _LOGGER.warning(
+                "'%s' %s wastes significant flash and RAM (about 3.5 KB and 60 "
+                "bytes plus the password on the heap): the device already offers "
+                "encryption with the '%s' %s %s, which authenticates any uploader "
+                "that takes it, and a password only matters for uploaders without "
+                "encryption support; remove '%s' and add '%s' under '%s' so "
+                "uploads use the key and encryption is required",
+                CONF_OTA,
+                CONF_PASSWORD,
+                CONF_API,
+                CONF_ENCRYPTION,
+                CONF_KEY,
+                CONF_PASSWORD,
+                CONF_ENCRYPTION,
+                CONF_OTA,
+            )
+        elif (
+            CONF_PASSWORD in ota_conf
+            and CONF_ENCRYPTION in api_conf
+            and not api_conf[CONF_ENCRYPTION].get(CONF_KEY)
+        ):
+            # The CLI still needs the password; whoever provisions the key skips it
+            _LOGGER.warning(
+                "The '%s' %s %s provisioned at runtime also authenticates OTA "
+                "uploads once provisioned; '%s' %s then only guards plaintext "
+                "uploads. Whoever provisions the key can upload firmware "
+                "without the password, so add a 'provisioning:' block to limit "
+                "when that is possible",
+                CONF_API,
+                CONF_ENCRYPTION,
+                CONF_KEY,
+                CONF_OTA,
+                CONF_PASSWORD,
+            )
+    # web_server and prometheus keep the shared listener up; the captive
+    # portal's copy only exists on the fallback AP and is the recovery path
+    if (
+        (CONF_WEB_SERVER in full_conf or "prometheus" in full_conf)
+        and any(conf.get(CONF_PLATFORM) == CONF_WEB_SERVER for conf in full_ota_conf)
+        and any(
+            CONF_ENCRYPTION in conf
+            for conf in merged_ota_esphome_configs_by_port.values()
+        )
     ):
-        _warn_web_server_ota(full_conf)
+        _LOGGER.warning(
+            "OTA encryption does not cover the %s OTA platform; its "
+            "plaintext /update endpoint accepts the same image",
+            CONF_WEB_SERVER,
+        )
 
     full_conf[CONF_OTA] = new_ota_conf
     fv.full_config.set(full_conf)
@@ -152,33 +194,11 @@ def ota_esphome_final_validate(config: ConfigType) -> None:
         )
 
 
-def _warn_web_server_ota(full_conf: ConfigType) -> None:
-    """The web_server ota platform accepts the same image over plaintext HTTP
-    with basic auth, bypassing the encryption; warn rather than fail so the
-    operator keeps the recovery path."""
-    if CONF_CAPTIVE_PORTAL in full_conf and CONF_WEB_SERVER not in full_conf:
-        # The captive_portal auto-load: the endpoint only exists while the
-        # fallback AP is active
-        _LOGGER.warning(
-            "OTA encryption does not cover the %s OTA platform (auto-loaded "
-            "by captive_portal); the plaintext /update endpoint stays "
-            "reachable while the fallback AP is active",
-            CONF_WEB_SERVER,
-        )
-    else:
-        _LOGGER.warning(
-            "OTA encryption does not cover the %s OTA platform; its "
-            "plaintext /update endpoint accepts the same image",
-            CONF_WEB_SERVER,
-        )
-
-
 def _resolve_encryption_key(encryption_conf: ConfigType, api_conf: ConfigType) -> None:
     """Resolve the one encryption key per device into the ota block.
 
     An explicit ota key must match the api key, a bare block inherits it,
-    a runtime provisioned api key cannot be inherited, and the all-zeros
-    provisioning sentinel is rejected (the device treats it as no key).
+    a runtime provisioned api key cannot be inherited.
     """
     api_key = api_conf.get(CONF_ENCRYPTION, {}).get(CONF_KEY)
     if ota_key := encryption_conf.get(CONF_KEY):
@@ -201,11 +221,6 @@ def _resolve_encryption_key(encryption_conf: ConfigType, api_conf: ConfigType) -
         )
     else:
         encryption_conf[CONF_KEY] = api_key
-    if is_reserved_key(encryption_conf[CONF_KEY]):
-        raise cv.Invalid(
-            f"The all-zeros {CONF_KEY} is reserved and provides no protection; "
-            f"generate a real key with: openssl rand -base64 32"
-        )
 
 
 # Also called on merged same-port configs in final validate, where schemas
@@ -267,15 +282,9 @@ CONFIG_SCHEMA = cv.All(
 FINAL_VALIDATE_SCHEMA = ota_esphome_final_validate
 
 
-def FILTER_SOURCE_FILES() -> list[str]:
-    """Filter out the noise transport when no ota entry configures encryption."""
-    for ota_conf in CORE.config.get(CONF_OTA, []):
-        if (
-            ota_conf.get(CONF_PLATFORM) == CONF_ESPHOME
-            and ota_conf.get(CONF_ENCRYPTION) is not None
-        ):
-            return []
-    return ["ota_esphome_noise.cpp"]
+FILTER_SOURCE_FILES = filter_source_files_from_defines(
+    {"ota_esphome_noise.cpp": "USE_OTA_ENCRYPTION"}
+)
 
 
 @coroutine_with_priority(CoroPriority.OTA_UPDATES)
@@ -296,11 +305,24 @@ async def to_code(config: ConfigType) -> None:
     if config.get(CONF_ALLOW_PARTITION_ACCESS):
         cg.add_define("USE_OTA_PARTITIONS")
 
-    if (encryption_conf := config.get(CONF_ENCRYPTION)) is not None:
-        # A missing key was resolved from the api component in final validate.
-        key = encryption_conf[CONF_KEY]
+    # One key per device: an api encryption block supplies it (static or
+    # runtime) and offers; the ota block only adds the requirement
+    api_conf = CORE.config.get(CONF_API) or {}
+    encryption_conf = config.get(CONF_ENCRYPTION)
+    own_key = None
+    if encryption_conf is not None and static_encryption_key(api_conf) is None:
+        own_key = encryption_conf[CONF_KEY]
+    if own_key is not None:
         cg.add_define("USE_OTA_ENCRYPTION")
-        cg.add(var.set_noise_psk(list(decode_encryption_key(key))))
+        cg.add(var.set_noise_psk(new_psk_progmem(config[CONF_ID], own_key)))
+    elif CONF_ENCRYPTION in api_conf:
+        cg.add_define("USE_OTA_ENCRYPTION")
+        cg.add_define("USE_OTA_ENCRYPTION_FROM_API")
+        if static_encryption_key(api_conf) is None:
+            # The key arrives at runtime, so the offer has to look for it
+            cg.add_define("USE_OTA_ENCRYPTION_PROVISIONED")
+    if encryption_conf is not None:
+        cg.add_define("USE_OTA_ENCRYPTION_REQUIRED")
 
     # Build flag so lwip_fast_select.c (a .c file that can't include defines.h) sees it.
     cg.add_build_flag("-DUSE_OTA_PLATFORM_ESPHOME")

esphome/components/esphome/ota/ota_esphome.cpp

@@ -1,4 +1,7 @@
 #include "ota_esphome.h"
+#ifdef USE_OTA_ENCRYPTION_FROM_API
+#include "esphome/components/api/api_server.h"
+#endif
 #ifdef USE_OTA
 #ifdef USE_OTA_PASSWORD
 #include "esphome/components/sha256/sha256.h"
@@ -26,6 +29,16 @@
 namespace esphome {
 
 static const char *const TAG = "esphome.ota";
+
+#ifdef USE_OTA_ENCRYPTION
+const noise::NoiseContext &ESPHomeOTAComponent::noise_context_() const {
+#ifdef USE_OTA_ENCRYPTION_FROM_API
+  return api::global_api_server->get_noise_ctx();
+#else
+  return this->noise_ctx_;
+#endif
+}
+#endif
 static constexpr uint16_t OTA_BLOCK_SIZE = 8192;
 static constexpr uint32_t OTA_SOCKET_TIMEOUT_HANDSHAKE = 20000;  // milliseconds for initial handshake
 static constexpr uint32_t OTA_SOCKET_TIMEOUT_DATA = 90000;       // milliseconds for data transfer
@@ -97,18 +110,30 @@ void ESPHomeOTAComponent::dump_config() {
   ESP_LOGCONFIG(TAG,
                 "Over-The-Air updates:\n"
                 "  Address: %s:%u\n"
-                "  Version: %d",
-                network::get_use_address_to(addr_buf), this->port_, USE_OTA_VERSION);
+                "  Version: %d"
+#ifdef USE_OTA_ENCRYPTION
+                "\n  Encryption: %s"
+#endif
+                ,
+                network::get_use_address_to(addr_buf), this->port_, USE_OTA_VERSION
+#ifdef USE_OTA_ENCRYPTION_REQUIRED
+                ,
+                LOG_STR_LITERAL("required")
+#elif defined(USE_OTA_ENCRYPTION_PROVISIONED)
+                // A runtime provisioned key may not exist yet
+                ,
+                this->noise_context_().has_psk() ? LOG_STR_LITERAL("offered, plaintext accepted")
+                                                 : LOG_STR_LITERAL("offered once the api key is provisioned")
+#elif defined(USE_OTA_ENCRYPTION)
+                ,
+                LOG_STR_LITERAL("offered, plaintext accepted")
+#endif
+  );
 #ifdef USE_OTA_PASSWORD
   if (!this->password_.empty()) {
     ESP_LOGCONFIG(TAG, "  Password configured");
   }
 #endif
-#ifdef USE_OTA_ENCRYPTION
-  if (this->noise_ctx_.has_psk()) {
-    ESP_LOGCONFIG(TAG, "  Encryption configured");
-  }
-#endif
 #ifdef USE_OTA_PARTITIONS
   ESP_LOGCONFIG(TAG,
                 "  Partition access allowed\n"
@@ -154,10 +179,22 @@ static constexpr uint8_t CLIENT_FEATURE_SUPPORTS_COMPRESSION = 0x01;
 static constexpr uint8_t CLIENT_FEATURE_SUPPORTS_SHA256_AUTH = 0x02;
 static constexpr uint8_t CLIENT_FEATURE_SUPPORTS_EXTENDED_PROTOCOL = 0x04;
 static constexpr uint8_t CLIENT_FEATURE_SUPPORTS_NOISE = 0x08;
+// Noise needs the extended protocol: the prologue binds the 2-byte feature ack
+static constexpr uint8_t CLIENT_NOISE_FEATURES =
+    CLIENT_FEATURE_SUPPORTS_NOISE | CLIENT_FEATURE_SUPPORTS_EXTENDED_PROTOCOL;
 static constexpr uint8_t SERVER_FEATURE_SUPPORTS_COMPRESSION = 0x01;
 static constexpr uint8_t SERVER_FEATURE_SUPPORTS_PARTITION_ACCESS = 0x02;
 static constexpr uint8_t SERVER_FEATURE_SUPPORTS_NOISE = 0x04;
 
+inline bool ESPHomeOTAComponent::extended_proto_() const {
+#ifdef USE_OTA_ENCRYPTION_REQUIRED
+  // FEATURE_READ already refused every client without the extended protocol
+  return true;
+#else
+  return (this->ota_features_ & CLIENT_FEATURE_SUPPORTS_EXTENDED_PROTOCOL) != 0;
+#endif
+}
+
 void ESPHomeOTAComponent::handle_handshake_() {
   /// Handle the OTA handshake and authentication.
   ///
@@ -241,12 +278,9 @@ void ESPHomeOTAComponent::handle_handshake_() {
       this->ota_features_ = this->handshake_buf_[0];
       ESP_LOGV(TAG, "Features: 0x%02X", this->ota_features_);
 
-#ifdef USE_OTA_ENCRYPTION
-      // Fail closed: with a PSK configured the client must negotiate encryption
-      // (which requires the extended protocol); refuse plaintext uploads.
-      static constexpr uint8_t NOISE_REQUIRED_FEATURES =
-          CLIENT_FEATURE_SUPPORTS_NOISE | CLIENT_FEATURE_SUPPORTS_EXTENDED_PROTOCOL;
-      if (this->noise_ctx_.has_psk() && (this->ota_features_ & NOISE_REQUIRED_FEATURES) != NOISE_REQUIRED_FEATURES) {
+#ifdef USE_OTA_ENCRYPTION_REQUIRED
+      // `ota: encryption:` requires the client to negotiate encryption
+      if ((this->ota_features_ & CLIENT_NOISE_FEATURES) != CLIENT_NOISE_FEATURES) {
         ESP_LOGW(TAG, "Client does not support encryption");
         this->send_error_and_cleanup_(ota::OTA_RESPONSE_ERROR_ENCRYPTION_REQUIRED);
         return;
@@ -261,18 +295,21 @@ void ESPHomeOTAComponent::handle_handshake_() {
       // Compose the feature-ack response. When the client negotiates the extended protocol we emit
       // a 2-byte response (marker + server feature flags); otherwise we emit the single-byte
       // legacy response.
-      this->extended_proto_ = (this->ota_features_ & CLIENT_FEATURE_SUPPORTS_EXTENDED_PROTOCOL) != 0;
-      if (this->extended_proto_) {
+      if (this->extended_proto_()) {
         static_assert(HANDSHAKE_BUF_SIZE >= 2, "handshake_buf_ must hold the 2-byte extended-protocol feature ack");
         this->handshake_buf_[0] = ota::OTA_RESPONSE_FEATURE_FLAGS;
         this->handshake_buf_[1] = (supports_compression ? SERVER_FEATURE_SUPPORTS_COMPRESSION : 0);
 #ifdef USE_OTA_PARTITIONS
         this->handshake_buf_[1] |= SERVER_FEATURE_SUPPORTS_PARTITION_ACCESS;
 #endif
-#ifdef USE_OTA_ENCRYPTION
-        if (this->noise_ctx_.has_psk()) {
+#ifdef USE_OTA_ENCRYPTION_PROVISIONED
+        // A runtime provisioned key may not exist yet
+        if (this->noise_context_().has_psk()) {
           this->handshake_buf_[1] |= SERVER_FEATURE_SUPPORTS_NOISE;
         }
+#elif defined(USE_OTA_ENCRYPTION)
+        // A yaml key always exists: validation rejects the all-zeros key
+        this->handshake_buf_[1] |= SERVER_FEATURE_SUPPORTS_NOISE;
 #endif
       } else {
         this->handshake_buf_[0] =
@@ -284,15 +321,15 @@ void ESPHomeOTAComponent::handle_handshake_() {
     case OTAState::FEATURE_ACK: {
       static constexpr size_t STANDARD_PROTO_ACK_SIZE = 1;
       static constexpr size_t EXTENDED_PROTO_ACK_SIZE = 2;
-      const size_t ack_size = this->extended_proto_ ? EXTENDED_PROTO_ACK_SIZE : STANDARD_PROTO_ACK_SIZE;
+      const size_t ack_size = this->extended_proto_() ? EXTENDED_PROTO_ACK_SIZE : STANDARD_PROTO_ACK_SIZE;
       if (!this->try_write_(ack_size, LOG_STR("ack feature"))) {
         return;
       }
 #ifdef USE_OTA_ENCRYPTION
-      // With a PSK configured the rest of the session runs inside the noise
-      // transport; the client sends the first handshake frame next, so there
-      // is nothing to do until data arrives.
-      if (this->noise_ctx_.has_psk()) {
+      // Latch the offer actually sent: a key activating between the two
+      // states must not start a session the client never expects
+      if ((this->handshake_buf_[1] & SERVER_FEATURE_SUPPORTS_NOISE) != 0 &&
+          (this->ota_features_ & CLIENT_NOISE_FEATURES) == CLIENT_NOISE_FEATURES) {
         // handshake_buf_ still holds the feature ack composed above; a
         // would-block re-entry lands here without rebuilding it
         if (!this->noise_start_session_(this->handshake_buf_[1])) {
@@ -412,7 +449,7 @@ void ESPHomeOTAComponent::handle_data_() {
   // Acknowledge auth OK - 1 byte
   this->data_write_byte_(ota::OTA_RESPONSE_AUTH_OK);
 
-  if (this->extended_proto_) {
+  if (this->extended_proto_()) {
     // Read ota type, 1 byte
     if (!this->data_readall_(buf, 1)) {
       this->log_read_error_(LOG_STR("OTA type"));

esphome/components/esphome/ota/ota_esphome.h

@@ -44,8 +44,9 @@ class ESPHomeOTAComponent final : public ota::OTAComponent {
   }
 #endif  // USE_OTA_PASSWORD
 
-#ifdef USE_OTA_ENCRYPTION
-  void set_noise_psk(noise::psk_t psk) { this->noise_ctx_.set_psk(psk); }
+#if defined(USE_OTA_ENCRYPTION) && !defined(USE_OTA_ENCRYPTION_FROM_API)
+  /// psk points at 32 bytes that live in flash for the life of the program
+  void set_noise_psk(const uint8_t *psk) { this->noise_ctx_.set_psk(psk); }
 #endif
 
   /// Manually set the port OTA should listen on
@@ -85,9 +86,12 @@ class ESPHomeOTAComponent final : public ota::OTAComponent {
     bool writing{false};    // a produced handshake frame is still being flushed
     uint8_t frame_buf[noise::FRAME_HEADER_SIZE + 1 + noise::MAX_HANDSHAKE_SIZE];
   };
+  // The api server's live context when the api has encryption, else our own
+  const noise::NoiseContext &noise_context_() const;
   bool noise_start_session_(uint8_t server_feature_flags);
   bool handle_noise_handshake_();
   bool noise_try_read_frame_();
+  size_t noise_frame_payload_len_(const uint8_t *header, size_t min_len, size_t max_len);
   bool noise_try_write_frame_();
   void noise_send_reject_(const LogString *reason);
   ssize_t noise_decrypt_(uint8_t *buf, size_t len);
@@ -144,7 +148,9 @@ class ESPHomeOTAComponent final : public ota::OTAComponent {
   std::unique_ptr<uint8_t[]> auth_buf_;
 #endif  // USE_OTA_PASSWORD
 #ifdef USE_OTA_ENCRYPTION
+#ifndef USE_OTA_ENCRYPTION_FROM_API
   noise::NoiseContext noise_ctx_;
+#endif
   std::unique_ptr<NoiseSession> noise_;
 #endif  // USE_OTA_ENCRYPTION
 
@@ -166,6 +172,8 @@ class ESPHomeOTAComponent final : public ota::OTAComponent {
                 "OTA_BUFFER_SIZE must fit a full encrypted data frame");
 #endif
   static constexpr uint8_t MAGIC_BYTES[5] = {0x6C, 0x26, 0xF7, 0x5C, 0x45};
+  // Derived from the feature byte; storing it would pad the trailing bytes
+  bool extended_proto_() const;
 #ifdef USE_OTA_PARTITIONS
   uint32_t running_app_offset_{0};
   size_t running_app_size_{0};
@@ -179,7 +187,6 @@ class ESPHomeOTAComponent final : public ota::OTAComponent {
   uint8_t auth_buf_pos_{0};
   uint8_t auth_type_{0};  // Store auth type to know which hasher to use
 #endif                    // USE_OTA_PASSWORD
-  bool extended_proto_{false};
 };
 
 }  // namespace esphome

esphome/components/esphome/ota/ota_esphome_noise.cpp

@@ -3,6 +3,7 @@
 #ifdef USE_OTA_ENCRYPTION
 #include "esphome/components/noise/noise.h"
 #include "esphome/components/ota/ota_backend.h"
+#include "esphome/core/hal.h"
 #include "esphome/core/log.h"
 
 #include <cstring>
@@ -40,24 +41,17 @@ ESPHomeOTAComponent::NoiseSession::~NoiseSession() {
  *   "NoiseOTAInit" | magic(5) | OK,version | client_features | FEATURE_FLAGS,server_flags
  */
 bool ESPHomeOTAComponent::noise_start_session_(uint8_t server_feature_flags) {
+  // A provisioned key cleared between the offer and here is not guarded: the
+  // session runs on the zero key load_psk fills in and fails the client's MAC.
+  // Default-init: the frame buffer is written before it is read
   // NOLINTNEXTLINE(clang-analyzer-cplusplus.NewDeleteLeaks)
-  this->noise_ = std::unique_ptr<NoiseSession>(new (std::nothrow) NoiseSession());
-  if (this->noise_ == nullptr) {
-    ESP_LOGW(TAG, "Session allocation failed");
-    this->cleanup_connection_();
-    return false;
-  }
-
+  this->noise_ = std::unique_ptr<NoiseSession>(new (std::nothrow) NoiseSession);
   static constexpr size_t PROLOGUE_ACK_LEN = 2;  // OTA_RESPONSE_OK + version
   static constexpr size_t PROLOGUE_CLIENT_FEATURES_LEN = 1;
   static constexpr size_t PROLOGUE_FEATURE_ACK_LEN = 2;  // OTA_RESPONSE_FEATURE_FLAGS + server flags
   uint8_t prologue[OTA_NOISE_PROLOGUE_INIT_LEN + sizeof(MAGIC_BYTES) + PROLOGUE_ACK_LEN + PROLOGUE_CLIENT_FEATURES_LEN +
                    PROLOGUE_FEATURE_ACK_LEN];
-#ifdef USE_ESP8266
-  memcpy_P(prologue, OTA_NOISE_PROLOGUE_INIT, OTA_NOISE_PROLOGUE_INIT_LEN);
-#else
-  std::memcpy(prologue, OTA_NOISE_PROLOGUE_INIT, OTA_NOISE_PROLOGUE_INIT_LEN);
-#endif
+  progmem_memcpy(prologue, OTA_NOISE_PROLOGUE_INIT, OTA_NOISE_PROLOGUE_INIT_LEN);
   uint8_t *p = prologue + OTA_NOISE_PROLOGUE_INIT_LEN;
   // Magic bytes, already validated in MAGIC_READ
   std::memcpy(p, MAGIC_BYTES, sizeof(MAGIC_BYTES));
@@ -71,9 +65,13 @@ bool ESPHomeOTAComponent::noise_start_session_(uint8_t server_feature_flags) {
   *p++ = ota::OTA_RESPONSE_FEATURE_FLAGS;
   *p++ = server_feature_flags;
 
-  int err = this->noise_->handshake.init(this->noise_ctx_.get_psk(), prologue, sizeof(prologue));
+  // The caller only starts a session when the context holds a key
+  int err = this->noise_ == nullptr ? NOISE_ERROR_NO_MEMORY
+                                    : this->noise_->handshake.init(this->noise_context_(), prologue, sizeof(prologue));
   if (err != 0) {
-    ESP_LOGW(TAG, "Handshake init: %s", LOG_STR_ARG(noise::noise_err_to_logstr(err)));
+    // Raw noise codes throughout: the name table would cost flash in builds
+    // where only the OTA uses noise
+    ESP_LOGW(TAG, "Session init: %d", err);
     this->cleanup_connection_();
     return false;
   }
@@ -105,14 +103,16 @@ bool ESPHomeOTAComponent::handle_noise_handshake_() {
         s.frame_pos = 0;
         s.frame_len = 0;
         if (s.frame_buf[noise::FRAME_HEADER_SIZE] != noise::HANDSHAKE_STATUS_OK) {
-          ESP_LOGW(TAG, "Bad handshake error byte: %u", s.frame_buf[noise::FRAME_HEADER_SIZE]);
+          ESP_LOGW(TAG, "Client rejected the handshake: %u", s.frame_buf[noise::FRAME_HEADER_SIZE]);
           this->cleanup_connection_();
           return false;
         }
         int err = s.handshake.read_message(s.frame_buf + noise::FRAME_HEADER_SIZE + 1, payload_len - 1);
         if (err != 0) {
-          ESP_LOGW(TAG, "Handshake read: %s", LOG_STR_ARG(noise::noise_err_to_logstr(err)));
-          this->noise_send_reject_(noise::reject_reason_for(err));
+          // A MAC failure here almost always means the uploader has a different key
+          const LogString *reason = noise::reject_reason_for(err);
+          ESP_LOGW(TAG, "Handshake read: %s (%d)", LOG_STR_ARG(reason), err);
+          this->noise_send_reject_(reason);
           this->cleanup_connection_();
           return false;
         }
@@ -123,7 +123,7 @@ bool ESPHomeOTAComponent::handle_noise_handshake_() {
         int err =
             s.handshake.write_message(s.frame_buf + noise::FRAME_HEADER_SIZE + 1, noise::MAX_HANDSHAKE_SIZE, msg_len);
         if (err != 0) {
-          ESP_LOGW(TAG, "Handshake write: %s", LOG_STR_ARG(noise::noise_err_to_logstr(err)));
+          ESP_LOGW(TAG, "Handshake write: %d", err);
           this->cleanup_connection_();
           return false;
         }
@@ -138,7 +138,7 @@ bool ESPHomeOTAComponent::handle_noise_handshake_() {
       case noise::NoiseResponderHandshake::Action::ACTION_SPLIT: {
         int err = s.handshake.split(s.send_cipher, s.recv_cipher);
         if (err != 0) {
-          ESP_LOGW(TAG, "Handshake split: %s", LOG_STR_ARG(noise::noise_err_to_logstr(err)));
+          ESP_LOGW(TAG, "Handshake split: %d", err);
           this->cleanup_connection_();
           return false;
         }
@@ -154,33 +154,41 @@ bool ESPHomeOTAComponent::handle_noise_handshake_() {
   }
 }
 
+/// Payload length from a frame header, or 0 (logged) when the indicator or
+/// the length is out of range. Callers pass min_len >= 1 so 0 is never valid.
+size_t ESPHomeOTAComponent::noise_frame_payload_len_(const uint8_t *header, size_t min_len, size_t max_len) {
+  const size_t payload_len = encode_uint16(header[1], header[2]);
+  if (header[0] != noise::FRAME_INDICATOR || payload_len < min_len || payload_len > max_len) {
+    ESP_LOGW(TAG, "Bad frame: 0x%02X, %zu bytes", header[0], payload_len);
+    return 0;
+  }
+  return payload_len;
+}
+
 /// Non-blocking read of one handshake frame into the session buffer.
 bool ESPHomeOTAComponent::noise_try_read_frame_() {
   NoiseSession &s = *this->noise_;
-  while (s.frame_pos < noise::FRAME_HEADER_SIZE) {
-    ssize_t read = this->client_->read(s.frame_buf + s.frame_pos, noise::FRAME_HEADER_SIZE - s.frame_pos);
-    if (!this->handle_read_error_(read, LOG_STR("read noise header"))) {
-      return false;
+  while (true) {
+    // The header first, then the body once the header says how long it is
+    const uint16_t want = s.frame_len == 0 ? noise::FRAME_HEADER_SIZE : s.frame_len;
+    if (s.frame_pos < want) {
+      ssize_t read = this->client_->read(s.frame_buf + s.frame_pos, want - s.frame_pos);
+      if (!this->handle_read_error_(read, LOG_STR("read noise"))) {
+        return false;
+      }
+      s.frame_pos += read;
+      continue;
     }
-    s.frame_pos += read;
-  }
-  if (s.frame_len == 0) {
-    const uint16_t payload_len = encode_uint16(s.frame_buf[1], s.frame_buf[2]);
-    if (s.frame_buf[0] != noise::FRAME_INDICATOR || payload_len < 1 || payload_len > 1 + noise::MAX_HANDSHAKE_SIZE) {
-      ESP_LOGW(TAG, "Bad handshake frame: 0x%02X, %u bytes", s.frame_buf[0], payload_len);
+    if (s.frame_len != 0) {
+      return true;
+    }
+    const size_t payload_len = this->noise_frame_payload_len_(s.frame_buf, 1, 1 + noise::MAX_HANDSHAKE_SIZE);
+    if (payload_len == 0) {
       this->cleanup_connection_();
       return false;
     }
     s.frame_len = noise::FRAME_HEADER_SIZE + payload_len;
   }
-  while (s.frame_pos < s.frame_len) {
-    ssize_t read = this->client_->read(s.frame_buf + s.frame_pos, s.frame_len - s.frame_pos);
-    if (!this->handle_read_error_(read, LOG_STR("read noise frame"))) {
-      return false;
-    }
-    s.frame_pos += read;
-  }
-  return true;
 }
 
 /// Non-blocking write of the pending session-buffer frame.
@@ -214,7 +222,7 @@ ssize_t ESPHomeOTAComponent::noise_decrypt_(uint8_t *buf, size_t len) {
   noise_buffer_set_inout(mbuf, buf, len, len);
   int err = noise_cipherstate_decrypt(this->noise_->recv_cipher, &mbuf);
   if (err != 0) {
-    ESP_LOGW(TAG, "Decrypt: %s", LOG_STR_ARG(noise::noise_err_to_logstr(err)));
+    ESP_LOGW(TAG, "Decrypt: %d", err);
     return -1;
   }
   return mbuf.size;
@@ -229,9 +237,8 @@ ssize_t ESPHomeOTAComponent::noise_read_frame_blocking_(uint8_t *buf, size_t min
   if (!this->readall_(header, sizeof(header))) {
     return -1;
   }
-  const size_t ciphertext_len = encode_uint16(header[1], header[2]);
-  if (header[0] != noise::FRAME_INDICATOR || ciphertext_len < min_ciphertext || ciphertext_len > max_ciphertext) {
-    ESP_LOGW(TAG, "Bad frame: 0x%02X, %zu bytes", header[0], ciphertext_len);
+  const size_t ciphertext_len = this->noise_frame_payload_len_(header, min_ciphertext, max_ciphertext);
+  if (ciphertext_len == 0) {
     return -1;
   }
   if (!this->readall_(buf, ciphertext_len)) {
@@ -267,7 +274,7 @@ bool ESPHomeOTAComponent::noise_write_byte_(uint8_t byte) {
   noise_buffer_set_inout(mbuf, frame + noise::FRAME_HEADER_SIZE, 1, 1 + noise::MAC_SIZE);
   int err = noise_cipherstate_encrypt(this->noise_->send_cipher, &mbuf);
   if (err != 0) {
-    ESP_LOGW(TAG, "Encrypt: %s", LOG_STR_ARG(noise::noise_err_to_logstr(err)));
+    ESP_LOGW(TAG, "Encrypt: %d", err);
     return false;
   }
   noise::write_frame_header(frame, mbuf.size);

esphome/components/hc8/hc8.cpp

@@ -96,7 +96,6 @@ void HC8Component::dump_config() {
                 "  Warmup time: %" PRIu32 " s",
                 this->warmup_seconds_);
   LOG_SENSOR("  ", "CO2", this->co2_sensor_);
-  this->check_uart_settings(9600);
 }
 
 }  // namespace esphome::hc8

esphome/components/hc8/sensor.py

@@ -47,6 +47,9 @@ FINAL_VALIDATE_SCHEMA = uart.final_validate_device_schema(
     baud_rate=9600,
     require_rx=True,
     require_tx=True,
+    data_bits=8,
+    parity="NONE",
+    stop_bits=1,
 )
 
 

esphome/components/he60r/he60r.cpp

@@ -38,7 +38,6 @@ CoverTraits HE60rCover::get_traits() {
 
 void HE60rCover::dump_config() {
   LOG_COVER("", "HE60R Cover", this);
-  this->check_uart_settings(1200, 1, uart::UART_CONFIG_PARITY_EVEN, 8);
   ESP_LOGCONFIG(TAG,
                 "  Open Duration: %.1fs\n"
                 "  Close Duration: %.1fs",

esphome/components/hrxl_maxsonar_wr/hrxl_maxsonar_wr.cpp

@@ -68,8 +68,6 @@ void HrxlMaxsonarWrComponent::check_buffer_() {
 void HrxlMaxsonarWrComponent::dump_config() {
   ESP_LOGCONFIG(TAG, "HRXL MaxSonar WR Sensor:");
   LOG_SENSOR("  ", "Distance", this);
-  // As specified in the sensor's data sheet
-  this->check_uart_settings(9600, 1, esphome::uart::UART_CONFIG_PARITY_NONE, 8);
 }
 
 }  // namespace esphome::hrxl_maxsonar_wr

esphome/components/hrxl_maxsonar_wr/sensor.py

@@ -23,6 +23,14 @@ CONFIG_SCHEMA = sensor.sensor_schema(
     state_class=STATE_CLASS_MEASUREMENT,
 ).extend(uart.UART_DEVICE_SCHEMA)
 
+FINAL_VALIDATE_SCHEMA = uart.final_validate_device_schema(
+    "hrxl_maxsonar_wr",
+    baud_rate=9600,
+    data_bits=8,
+    parity="NONE",
+    stop_bits=1,
+)
+
 
 async def to_code(config: ConfigType) -> None:
     var = await sensor.new_sensor(config)

esphome/components/hydreon_rgxx/hydreon_rgxx.cpp

@@ -11,7 +11,6 @@ static const char *const PROTOCOL_NAMES[] = {HYDREON_RGXX_PROTOCOL_LIST(, HYDREO
 static const char *const IGNORE_STRINGS[] = {HYDREON_RGXX_IGNORE_LIST(, HYDREON_RGXX_COMMA)};
 
 void HydreonRGxxComponent::dump_config() {
-  this->check_uart_settings(9600, 1, esphome::uart::UART_CONFIG_PARITY_NONE, 8);
   ESP_LOGCONFIG(TAG, "hydreon_rgxx:");
   if (this->is_failed()) {
     ESP_LOGE(TAG, "Connection with hydreon_rgxx failed!");

esphome/components/hydreon_rgxx/sensor.py

@@ -130,6 +130,14 @@ CONFIG_SCHEMA = cv.All(
     _validate,
 )
 
+FINAL_VALIDATE_SCHEMA = uart.final_validate_device_schema(
+    "hydreon_rgxx",
+    baud_rate=9600,
+    data_bits=8,
+    parity="NONE",
+    stop_bits=1,
+)
+
 
 async def to_code(config: ConfigType) -> None:
     var = cg.new_Pvariable(config[CONF_ID])

esphome/components/kamstrup_kmp/kamstrup_kmp.cpp

@@ -26,8 +26,6 @@ void KamstrupKMPComponent::dump_config() {
     LOG_SENSOR("  ", "Custom Sensor", this->custom_sensors_[i]);
     ESP_LOGCONFIG(TAG, "    Command: 0x%04X", this->custom_commands_[i]);
   }
-
-  this->check_uart_settings(1200, 2, uart::UART_CONFIG_PARITY_NONE, 8);
 }
 
 void KamstrupKMPComponent::update() {

esphome/components/kamstrup_kmp/sensor.py

@@ -102,7 +102,13 @@ CONFIG_SCHEMA = (
 )
 
 FINAL_VALIDATE_SCHEMA = uart.final_validate_device_schema(
-    "kamstrup_kmp", baud_rate=1200, require_rx=True, require_tx=True
+    "kamstrup_kmp",
+    baud_rate=1200,
+    require_rx=True,
+    require_tx=True,
+    data_bits=8,
+    parity="NONE",
+    stop_bits=2,
 )
 
 

esphome/components/mhz19/mhz19.cpp

@@ -143,8 +143,6 @@ void MHZ19Component::dump_config() {
   ESP_LOGCONFIG(TAG, "MH-Z19:");
   LOG_SENSOR("  ", "CO2", this->co2_sensor_);
   LOG_SENSOR("  ", "Temperature", this->temperature_sensor_);
-  this->check_uart_settings(9600);
-
   if (this->abc_boot_logic_ == MHZ19_ABC_ENABLED) {
     ESP_LOGCONFIG(TAG, "  Automatic baseline calibration enabled on boot");
   } else if (this->abc_boot_logic_ == MHZ19_ABC_DISABLED) {

esphome/components/mhz19/sensor.py

@@ -80,6 +80,14 @@ CONFIG_SCHEMA = (
     .extend(uart.UART_DEVICE_SCHEMA)
 )
 
+FINAL_VALIDATE_SCHEMA = uart.final_validate_device_schema(
+    "mhz19",
+    baud_rate=9600,
+    data_bits=8,
+    parity="NONE",
+    stop_bits=1,
+)
+
 
 async def to_code(config: ConfigType) -> None:
     var = cg.new_Pvariable(config[CONF_ID])

esphome/components/mk2pvrouter/mk2pvrouter.cpp

@@ -163,10 +163,7 @@ void Mk2PVRouter::publish_value_(const char *tag, const char *val) {
 #endif
 }
 
-void Mk2PVRouter::dump_config() {
-  ESP_LOGCONFIG(TAG, "Mk2PVRouter:");
-  this->check_uart_settings(BAUD_RATE, 1, uart::UART_CONFIG_PARITY_EVEN, 7);
-}
+void Mk2PVRouter::dump_config() { ESP_LOGCONFIG(TAG, "Mk2PVRouter:"); }
 
 #ifdef MK2PVROUTER_LISTENER_COUNT
 void Mk2PVRouter::register_mk2pvrouter_listener(Mk2PVRouterListener *listener) {

esphome/components/mk2pvrouter/mk2pvrouter.h

@@ -43,7 +43,6 @@ class Mk2PVRouter final : public Component, public uart::UARTDevice {
 
  protected:
   static constexpr size_t CRC_SUFFIX_LEN = 1;
-  static constexpr uint32_t BAUD_RATE = 9600;
 
   enum class State : uint8_t {
     WAITING_FOR_START,

esphome/components/nextion/nextion_upload_arduino.cpp

@@ -209,14 +209,8 @@ bool Nextion::upload_tft(uint32_t baud_rate, bool exit_reparse) {
   http_client.setTimeout(this->tft_upload_http_timeout_);
 
   bool begin_status = false;
-#if USE_ARDUINO_VERSION_CODE >= VERSION_CODE(2, 7, 0)
   http_client.setFollowRedirects(HTTPC_STRICT_FOLLOW_REDIRECTS);
-#elif USE_ARDUINO_VERSION_CODE >= VERSION_CODE(2, 6, 0)
-  http_client.setFollowRedirects(true);
-#endif
-#if USE_ARDUINO_VERSION_CODE >= VERSION_CODE(2, 6, 0)
   http_client.setRedirectLimit(3);
-#endif
   begin_status = http_client.begin(*this->get_wifi_client_(), this->tft_url_.c_str());
   if (!begin_status) {
     this->connection_state_.is_updating_ = false;

esphome/components/noise/__init__.py

@@ -4,7 +4,9 @@ from typing import Any
 
 import esphome.codegen as cg
 import esphome.config_validation as cv
-from esphome.const import CONF_KEY
+from esphome.const import CONF_ENCRYPTION, CONF_KEY
+from esphome.core import ID
+from esphome.cpp_generator import MockObj
 from esphome.types import ConfigType
 
 CODEOWNERS = ["@esphome/core"]
@@ -23,6 +25,14 @@ def validate_encryption_key(value: Any) -> str:
 
     if len(decoded) != 32:
         raise cv.Invalid("Encryption key must be base64 and 32 bytes long")
+    if not any(decoded):
+        # The device treats the all-zeros key as no key at all (it is the
+        # provisioning sentinel), so it must never reach a build
+        raise cv.Invalid(
+            f"The all-zeros {CONF_KEY} is reserved and provides no protection; "
+            f"omit the {CONF_KEY} to provision it at runtime, or generate a real "
+            "key with: openssl rand -base64 32"
+        )
 
     # Return original data for roundtrip conversion
     return value
@@ -45,15 +55,6 @@ def decode_encryption_key(value: str) -> bytes:
     return decoded
 
 
-def is_reserved_key(value: str) -> bool:
-    """Whether the key is the reserved all-zeros provisioning sentinel.
-
-    The device treats it as no key configured, so consumers that require a
-    real key must reject it.
-    """
-    return not any(decode_encryption_key(value))
-
-
 ENCRYPTION_SCHEMA = cv.Schema(
     {
         cv.Optional(CONF_KEY): cv.sensitive(validate_encryption_key),
@@ -61,6 +62,21 @@ ENCRYPTION_SCHEMA = cv.Schema(
 )
 
 
+def static_encryption_key(conf: ConfigType) -> str | None:
+    """The build time key of a component config; None without one or when
+    the key is provisioned at runtime."""
+    return (conf.get(CONF_ENCRYPTION) or {}).get(CONF_KEY) or None
+
+
+def new_psk_progmem(parent_id: ID, key: str) -> MockObj:
+    """Emit the decoded key as a PROGMEM array; the component keeps a pointer
+    so the key never occupies RAM."""
+    return cg.progmem_array(
+        ID(f"{parent_id.id}_psk", is_declaration=True, type=cg.uint8),
+        list(decode_encryption_key(key)),
+    )
+
+
 def encryption_schema(config: ConfigType | None) -> ConfigType:
     # A bare `encryption:` block is valid; a missing key means the consumer
     # falls back to its keyless behavior (api provisioning, ota inheriting

esphome/components/noise/noise.cpp

@@ -1,5 +1,6 @@
 #include "noise.h"
 #ifdef USE_NOISE
+#include "esphome/core/hal.h"
 #include "esphome/core/log.h"
 
 #include <algorithm>
@@ -15,6 +16,14 @@ namespace esphome::noise {
 
 static const char *const TAG = "noise";
 
+void NoiseContext::load_psk(psk_t &out) const {
+  if (this->psk_ == nullptr) {
+    out.fill(0);
+    return;
+  }
+  progmem_memcpy(out.data(), this->psk_, out.size());
+}
+
 const LogString *noise_err_to_logstr(int err) {
   if (err == NOISE_ERROR_NO_MEMORY)
     return LOG_STR("NO_MEMORY");

esphome/components/noise/noise.h

@@ -23,16 +23,16 @@ class NoiseContext {
     }
     return acc == 0;
   }
-  void set_psk(psk_t psk) {
-    this->psk_ = psk;
-    this->has_psk_ = !is_all_zeros(psk);
-  }
-  const psk_t &get_psk() const { return this->psk_; }
-  bool has_psk() const { return this->has_psk_; }
+  /// psk points at 32 bytes that outlive the context (PROGMEM or caller owned
+  /// RAM); nullptr means no key. Runtime callers map the all-zeros key to
+  /// nullptr themselves; validation keeps it out of yaml.
+  void set_psk(const uint8_t *psk) { this->psk_ = psk; }
+  /// Copy the key out (flash-aware on ESP8266); all zeros when none is set.
+  void load_psk(psk_t &out) const;
+  bool has_psk() const { return this->psk_ != nullptr; }
 
  protected:
-  psk_t psk_{};
-  bool has_psk_{false};
+  const uint8_t *psk_{nullptr};
 };
 
 /// Convert a noise error code to a readable error

esphome/components/noise/noise_handshake.cpp

@@ -20,7 +20,7 @@ NoiseResponderHandshake::~NoiseResponderHandshake() {
   }
 }
 
-int NoiseResponderHandshake::init(const psk_t &psk, const uint8_t *prologue, size_t prologue_len) {
+int NoiseResponderHandshake::init(const NoiseContext &ctx, const uint8_t *prologue, size_t prologue_len) {
   if (this->handshake_ != nullptr) {
     noise_handshakestate_free(this->handshake_);
     this->handshake_ = nullptr;
@@ -44,6 +44,9 @@ int NoiseResponderHandshake::init(const psk_t &psk, const uint8_t *prologue, siz
     HANDSHAKE_STEP_LOG("noise_handshakestate_new_by_id", err);
     return err;
   }
+  // noise-c keeps its own copy, so the key only passes through the stack here
+  psk_t psk;
+  ctx.load_psk(psk);
   err = noise_handshakestate_set_pre_shared_key(this->handshake_, psk.data(), psk.size());
   if (err != 0) {
     HANDSHAKE_STEP_LOG("noise_handshakestate_set_pre_shared_key", err);

esphome/components/noise/noise_handshake.h

@@ -36,9 +36,9 @@ class NoiseResponderHandshake {
   NoiseResponderHandshake(const NoiseResponderHandshake &) = delete;
   NoiseResponderHandshake &operator=(const NoiseResponderHandshake &) = delete;
 
-  /// Create and start the handshake with the given PSK and prologue. A
-  /// repeated call frees the previous handshake state and starts over.
-  [[nodiscard]] int init(const psk_t &psk, const uint8_t *prologue, size_t prologue_len);
+  /// Create and start the handshake with the context's PSK and the prologue.
+  /// A repeated call frees the previous handshake state and starts over.
+  [[nodiscard]] int init(const NoiseContext &ctx, const uint8_t *prologue, size_t prologue_len);
   /// ACTION_FAILED is the catch-all: returned before init(), after split()
   /// has released the state, and when noise-c reports a failed handshake.
   [[nodiscard]] Action action() const;

esphome/components/pm1006/pm1006.cpp

@@ -16,7 +16,6 @@ void PM1006Component::dump_config() {
   ESP_LOGCONFIG(TAG, "PM1006:");
   LOG_SENSOR("  ", "PM2.5", this->pm_2_5_sensor_);
   LOG_UPDATE_INTERVAL(this);
-  this->check_uart_settings(9600);
 }
 
 void PM1006Component::update() {

esphome/components/pm1006/sensor.py

@@ -48,6 +48,9 @@ def validate_interval_uart(config: ConfigType) -> None:
         baud_rate=9600,
         require_rx=True,
         require_tx=interval.total_milliseconds != SCHEDULER_DONT_RUN,
+        data_bits=8,
+        parity="NONE",
+        stop_bits=1,
     )(config)
 
 

esphome/components/pmsx003/pmsx003.cpp

@@ -46,8 +46,6 @@ void PMSX003Component::dump_config() {
   } else {
     ESP_LOGCONFIG(TAG, "  Mode: passive with sleep/wake cycles");
   }
-
-  this->check_uart_settings(9600);
 }
 
 void PMSX003Component::loop() {

esphome/components/pmsx003/sensor.py

@@ -302,7 +302,13 @@ CONFIG_SCHEMA = cv.All(
 def final_validate(config: ConfigType) -> None:
     require_tx = config[CONF_UPDATE_INTERVAL] > cv.time_period("0s")
     schema = uart.final_validate_device_schema(
-        "pmsx003", baud_rate=9600, require_rx=True, require_tx=require_tx
+        "pmsx003",
+        baud_rate=9600,
+        require_rx=True,
+        require_tx=require_tx,
+        data_bits=8,
+        parity="NONE",
+        stop_bits=1,
     )
     schema(config)
 

esphome/components/pylontech/__init__.py

@@ -41,6 +41,14 @@ CONFIG_SCHEMA = cv.All(
     .extend(uart.UART_DEVICE_SCHEMA)
 )
 
+FINAL_VALIDATE_SCHEMA = uart.final_validate_device_schema(
+    "pylontech",
+    baud_rate=115200,
+    data_bits=8,
+    parity="NONE",
+    stop_bits=1,
+)
+
 
 async def to_code(config: ConfigType) -> None:
     var = cg.new_Pvariable(config[CONF_ID])

esphome/components/pylontech/pylontech.cpp

@@ -33,7 +33,6 @@ static const uint8_t ASCII_LF = 0x0A;
 PylontechComponent::PylontechComponent() {}
 
 void PylontechComponent::dump_config() {
-  this->check_uart_settings(115200, 1, esphome::uart::UART_CONFIG_PARITY_NONE, 8);
   ESP_LOGCONFIG(TAG, "pylontech:");
   if (this->is_failed()) {
     ESP_LOGE(TAG, "Connection with pylontech failed!");

esphome/components/radon_eye_rd200/radon_eye_rd200.cpp

@@ -1,150 +1,123 @@
 #include "radon_eye_rd200.h"
-
-#ifdef USE_BLE_CLIENT_GATT_NODES
-
-#include "esphome/core/helpers.h"
-#include "esphome/core/log.h"
+#include "esphome/components/esp32_ble/ble_uuid.h"
 
 #include <cstring>
 
+#ifdef USE_ESP32
+
 namespace esphome::radon_eye_rd200 {
 
 static const char *const TAG = "radon_eye_rd200";
 
-using ble_device_base::ESPBTUUID;
-
-// V1 (RD200 firmware < 2.0) exposes a vendor service; V2 (>= 2.0) moved to
-// Bluetooth-base (16-bit) UUIDs with a different command byte and payload
-// layout.
-static const char *const SERVICE_UUID_V1 = "00001523-1212-efde-1523-785feabcd123";
-static const char *const WRITE_CHARACTERISTIC_UUID_V1 = "00001524-1212-efde-1523-785feabcd123";
-static const char *const READ_CHARACTERISTIC_UUID_V1 = "00001525-1212-efde-1523-785feabcd123";
+static const esp32_ble_tracker::ESPBTUUID SERVICE_UUID_V1 =
+    esp32_ble_tracker::ESPBTUUID::from_raw("00001523-1212-efde-1523-785feabcd123");
+static const esp32_ble_tracker::ESPBTUUID WRITE_CHARACTERISTIC_UUID_V1 =
+    esp32_ble_tracker::ESPBTUUID::from_raw("00001524-1212-efde-1523-785feabcd123");
+static const esp32_ble_tracker::ESPBTUUID READ_CHARACTERISTIC_UUID_V1 =
+    esp32_ble_tracker::ESPBTUUID::from_raw("00001525-1212-efde-1523-785feabcd123");
 static const uint8_t WRITE_COMMAND_V1 = 0x50;
 
-static const uint16_t SERVICE_UUID_V2 = 0x1523;
-static const uint16_t WRITE_CHARACTERISTIC_UUID_V2 = 0x1524;
-static const uint16_t READ_CHARACTERISTIC_UUID_V2 = 0x1525;
+static const esp32_ble_tracker::ESPBTUUID SERVICE_UUID_V2 =
+    esp32_ble_tracker::ESPBTUUID::from_raw("00001523-0000-1000-8000-00805f9b34fb");
+static const esp32_ble_tracker::ESPBTUUID WRITE_CHARACTERISTIC_UUID_V2 =
+    esp32_ble_tracker::ESPBTUUID::from_raw("00001524-0000-1000-8000-00805f9b34fb");
+static const esp32_ble_tracker::ESPBTUUID READ_CHARACTERISTIC_UUID_V2 =
+    esp32_ble_tracker::ESPBTUUID::from_raw("00001525-0000-1000-8000-00805f9b34fb");
 static const uint8_t WRITE_COMMAND_V2 = 0x40;
 
-// Minimum notification payload carrying all three measurements.
-static const uint16_t MESSAGE_MIN_LEN_V1 = 20;
-static const uint16_t MESSAGE_MIN_LEN_V2 = 68;
-
-RadonEyeRD200::RadonEyeRD200() : PollingComponent(10000) {}
-
-void RadonEyeRD200::update() {
-  if (this->parent()->connected())
-    return;
-  if (!this->parent()->enabled) {
-    ESP_LOGW(TAG, "Reconnecting to device");
-    this->parent()->set_enabled(true);
-  } else {
-    ESP_LOGW(TAG, "Connection in progress");
-  }
-}
-
-void RadonEyeRD200::on_connected(const ble_device_base::GattServiceTable &table) {
-  if (!this->resolve_handles_(table)) {
-    // Retried on the next poll (update() re-enables the client).
-    this->parent()->set_enabled(false);
-    return;
-  }
-  // Local notification registration; the CCCD write follows in
-  // on_notify_state (the contract leaves the CCCD to the node).
-  if (this->parent()->notify_characteristic(this->read_handle_, true) != 0) {
-    this->parent()->set_enabled(false);
-  }
-}
-
-bool RadonEyeRD200::resolve_handles_(const ble_device_base::GattServiceTable &table) {
-  struct Variant {
-    ESPBTUUID service;
-    ESPBTUUID write_chr;
-    ESPBTUUID read_chr;
-    uint8_t command;
-  };
-  // Built on the stack per (cold) discovery so the UUID objects stay out of
-  // static RAM; the V1 strings live in flash.
-  const Variant variants[] = {
-      {ESPBTUUID::from_raw(SERVICE_UUID_V1), ESPBTUUID::from_raw(WRITE_CHARACTERISTIC_UUID_V1),
-       ESPBTUUID::from_raw(READ_CHARACTERISTIC_UUID_V1), WRITE_COMMAND_V1},
-      {ESPBTUUID::from_uint16(SERVICE_UUID_V2), ESPBTUUID::from_uint16(WRITE_CHARACTERISTIC_UUID_V2),
-       ESPBTUUID::from_uint16(READ_CHARACTERISTIC_UUID_V2), WRITE_COMMAND_V2},
-  };
-  for (const auto &variant : variants) {
-    const auto *service = ble_device_base::find_service(table, variant.service);
-    if (service == nullptr) {
-      continue;
+void RadonEyeRD200::gattc_event_handler(esp_gattc_cb_event_t event, esp_gatt_if_t gattc_if,
+                                        esp_ble_gattc_cb_param_t *param) {
+  switch (event) {
+    case ESP_GATTC_OPEN_EVT: {
+      if (param->open.status == ESP_GATT_OK) {
+        ESP_LOGI(TAG, "Connected successfully!");
+      }
+      break;
     }
-    const auto *read_chr = ble_device_base::find_characteristic(table, *service, variant.read_chr);
-    const auto *write_chr = ble_device_base::find_characteristic(table, *service, variant.write_chr);
-    if (read_chr == nullptr || write_chr == nullptr) {
-      ESP_LOGW(TAG, "Service found but a sensor characteristic is missing");
-      return false;
+
+    case ESP_GATTC_DISCONNECT_EVT: {
+      ESP_LOGW(TAG, "Disconnected!");
+      break;
     }
-    this->cccd_handle_ = ble_device_base::find_cccd(table, *read_chr);
-    if (this->cccd_handle_ == 0) {
-      ESP_LOGW(TAG, "Sensor read characteristic has no CCCD");
-      return false;
+
+    case ESP_GATTC_SEARCH_CMPL_EVT: {
+      if (this->parent()->get_service(SERVICE_UUID_V1) != nullptr) {
+        service_uuid_ = SERVICE_UUID_V1;
+        sensors_write_characteristic_uuid_ = WRITE_CHARACTERISTIC_UUID_V1;
+        sensors_read_characteristic_uuid_ = READ_CHARACTERISTIC_UUID_V1;
+        write_command_ = WRITE_COMMAND_V1;
+      } else if (this->parent()->get_service(SERVICE_UUID_V2) != nullptr) {
+        service_uuid_ = SERVICE_UUID_V2;
+        sensors_write_characteristic_uuid_ = WRITE_CHARACTERISTIC_UUID_V2;
+        sensors_read_characteristic_uuid_ = READ_CHARACTERISTIC_UUID_V2;
+        write_command_ = WRITE_COMMAND_V2;
+      } else {
+        ESP_LOGW(TAG, "No supported device has been found, disconnecting");
+        parent()->set_enabled(false);
+        break;
+      }
+
+      this->read_handle_ = 0;
+      auto *chr = this->parent()->get_characteristic(service_uuid_, sensors_read_characteristic_uuid_);
+      if (chr == nullptr) {
+        char service_buf[esp32_ble::UUID_STR_LEN];
+        char char_buf[esp32_ble::UUID_STR_LEN];
+        ESP_LOGW(TAG, "No sensor read characteristic found at service %s char %s", service_uuid_.to_str(service_buf),
+                 sensors_read_characteristic_uuid_.to_str(char_buf));
+        break;
+      }
+      this->read_handle_ = chr->handle;
+
+      auto *write_chr = this->parent()->get_characteristic(service_uuid_, sensors_write_characteristic_uuid_);
+      if (write_chr == nullptr) {
+        char service_buf[esp32_ble::UUID_STR_LEN];
+        char char_buf[esp32_ble::UUID_STR_LEN];
+        ESP_LOGW(TAG, "No sensor write characteristic found at service %s char %s", service_uuid_.to_str(service_buf),
+                 sensors_write_characteristic_uuid_.to_str(char_buf));
+        break;
+      }
+      this->write_handle_ = write_chr->handle;
+
+      esp_err_t status =
+          esp_ble_gattc_register_for_notify(gattc_if, this->parent()->get_remote_bda(), this->read_handle_);
+      if (status) {
+        ESP_LOGW(TAG, "Error registering for sensor notify, status=%d", status);
+      }
+      break;
     }
-    this->read_handle_ = read_chr->value_handle;
-    this->write_handle_ = write_chr->value_handle;
-    this->write_command_ = variant.command;
-    return true;
-  }
-  ESP_LOGW(TAG, "No supported device has been found, disconnecting");
-  return false;
-}
 
-void RadonEyeRD200::on_notify_state(uint16_t handle, bool enabled, int error) {
-  if (handle != this->read_handle_) {
-    return;
-  }
-  if (error != 0) {
-    ESP_LOGW(TAG, "Error registering for sensor notify, status=%d", error);
-    this->parent()->set_enabled(false);
-    return;
-  }
-  if (!enabled) {
-    return;
-  }
-  static const uint8_t ENABLE_NOTIFY[2] = {0x01, 0x00};
-  if (this->parent()->write_descriptor(this->cccd_handle_, ENABLE_NOTIFY, sizeof(ENABLE_NOTIFY)) != 0) {
-    this->parent()->set_enabled(false);
+    case ESP_GATTC_WRITE_DESCR_EVT: {
+      if (param->write.status != ESP_GATT_OK) {
+        ESP_LOGE(TAG, "write descr failed, error status = %x", param->write.status);
+        break;
+      }
+      ESP_LOGV(TAG, "Write descr success, writing 0x%02X at write_handle=%d", this->write_command_,
+               this->write_handle_);
+      esp_err_t status =
+          esp_ble_gattc_write_char(gattc_if, this->parent()->get_conn_id(), this->write_handle_, sizeof(write_command_),
+                                   (uint8_t *) &write_command_, ESP_GATT_WRITE_TYPE_NO_RSP, ESP_GATT_AUTH_REQ_NONE);
+      if (status) {
+        ESP_LOGW(TAG, "Error writing 0x%02x command, status=%d", write_command_, status);
+      }
+      break;
+    }
+
+    case ESP_GATTC_NOTIFY_EVT: {
+      if (param->notify.is_notify) {
+        ESP_LOGV(TAG, "ESP_GATTC_NOTIFY_EVT, receive notify value, %d bytes", param->notify.value_len);
+      } else {
+        ESP_LOGV(TAG, "ESP_GATTC_NOTIFY_EVT, receive indicate value, %d bytes", param->notify.value_len);
+      }
+      read_sensors_(param->notify.value, param->notify.value_len);
+      break;
+    }
+
+    default:
+      break;
   }
 }
 
-void RadonEyeRD200::on_write_result(uint16_t handle, int error) {
-  // The command write (no response) also lands here; only the CCCD
-  // completion advances the sequence.
-  if (handle != this->cccd_handle_) {
-    return;
-  }
-  if (error != 0) {
-    ESP_LOGE(TAG, "write descr failed, error status = %x", error);
-    this->parent()->set_enabled(false);
-    return;
-  }
-  ESP_LOGV(TAG, "Write descr success, writing 0x%02X at write_handle=%d", this->write_command_, this->write_handle_);
-  if (this->parent()->write_characteristic(this->write_handle_, &this->write_command_, sizeof(this->write_command_),
-                                           false) != 0) {
-    ESP_LOGW(TAG, "Error writing 0x%02x command", this->write_command_);
-    this->parent()->set_enabled(false);
-  }
-}
-
-void RadonEyeRD200::on_notify(uint16_t handle, const uint8_t *data, uint16_t len) {
-  if (handle != this->read_handle_) {
-    return;
-  }
-  ESP_LOGV(TAG, "Received notify value, %d bytes", len);
-  this->read_sensors_(data, len);
-  // This instance must not stay connected so other clients can connect to it
-  // (e.g. the mobile app).
-  this->parent()->set_enabled(false);
-}
-
-void RadonEyeRD200::read_sensors_(const uint8_t *value, uint16_t value_len) {
+void RadonEyeRD200::read_sensors_(uint8_t *value, uint16_t value_len) {
   if (value_len < 1) {
     ESP_LOGW(TAG, "Unexpected empty message");
     return;
@@ -152,8 +125,7 @@ void RadonEyeRD200::read_sensors_(const uint8_t *value, uint16_t value_len) {
 
   uint8_t command = value[0];
 
-  if ((command == WRITE_COMMAND_V1 && value_len < MESSAGE_MIN_LEN_V1) ||
-      (command == WRITE_COMMAND_V2 && value_len < MESSAGE_MIN_LEN_V2)) {
+  if ((command == WRITE_COMMAND_V1 && value_len < 20) || (command == WRITE_COMMAND_V2 && value_len < 68)) {
     ESP_LOGW(TAG, "Unexpected command 0x%02X message length %d", command, value_len);
     return;
   }
@@ -162,11 +134,8 @@ void RadonEyeRD200::read_sensors_(const uint8_t *value, uint16_t value_len) {
   // 501085EBB9400000000000000000220025000000
   // Example data V2:
   // 4042323230313033525532303338330652443230304e56322e302e3200014a00060a00080000000300010079300000e01108001c00020000003822005c8f423fa4709d3f
-#if ESPHOME_LOG_LEVEL >= ESPHOME_LOG_LEVEL_VERBOSE
-  // Sized for the longest supported message; format_hex_to truncates longer.
-  char hex_buf[format_hex_size(MESSAGE_MIN_LEN_V2)];
-  ESP_LOGV(TAG, "radon sensors raw bytes: %s", format_hex_to(hex_buf, value, value_len));
-#endif
+  ESP_LOGV(TAG, "radon sensors raw bytes");
+  ESP_LOG_BUFFER_HEX_LEVEL(TAG, value, value_len, ESP_LOG_VERBOSE);
 
   // Convert from pCi/L to Bq/m³
   constexpr float convert_to_bwpm3 = 37.0;
@@ -216,6 +185,22 @@ void RadonEyeRD200::read_sensors_(const uint8_t *value, uint16_t value_len) {
            "  Measurements (pCi/L) now: %0.03f, day: %0.03f, month: %0.03f",
            radon_now, radon_day, radon_month, radon_now / convert_to_bwpm3, radon_day / convert_to_bwpm3,
            radon_month / convert_to_bwpm3);
+
+  // This instance must not stay connected
+  // so other clients can connect to it (e.g. the
+  // mobile app).
+  parent()->set_enabled(false);
+}
+
+void RadonEyeRD200::update() {
+  if (this->node_state != esp32_ble_tracker::ClientState::ESTABLISHED) {
+    if (!parent()->enabled) {
+      ESP_LOGW(TAG, "Reconnecting to device");
+      parent()->set_enabled(true);
+    } else {
+      ESP_LOGW(TAG, "Connection in progress");
+    }
+  }
 }
 
 void RadonEyeRD200::dump_config() {
@@ -223,6 +208,8 @@ void RadonEyeRD200::dump_config() {
   LOG_SENSOR("  ", "Radon Long Term", this->radon_long_term_sensor_);
 }
 
+RadonEyeRD200::RadonEyeRD200() : PollingComponent(10000) {}
+
 }  // namespace esphome::radon_eye_rd200
 
-#endif  // USE_BLE_CLIENT_GATT_NODES
+#endif  // USE_ESP32

esphome/components/radon_eye_rd200/radon_eye_rd200.h

@@ -1,29 +1,15 @@
-// RD200 radon sensor on the platform-neutral ble_client node interface -
-// one implementation for every platform with a GATT client engine (esp32
-// and rp2 / Pico W today).
-//
-// Poll cycle: enable the client (it connects on the peer's next sighting) →
-// resolve the V1/V2 variant and handles from the service table during
-// on_connected() → local notify registration → explicit CCCD write (the
-// contract makes the CCCD the node's job) → write the read command → parse
-// the notification → disable. The link is dropped after every reading so the
-// vendor mobile app can connect between polls.
-
 #pragma once
 
-#include "esphome/core/defines.h"
+#ifdef USE_ESP32
 
-#ifdef USE_BLE_CLIENT_GATT_NODES
-
-#include "esphome/components/ble_client/ble_client_node.h"
+#include <esp_gattc_api.h>
+#include <algorithm>
+#include <iterator>
+#include "esphome/components/ble_client/ble_client.h"
+#include "esphome/components/esp32_ble_tracker/esp32_ble_tracker.h"
 #include "esphome/components/sensor/sensor.h"
 #include "esphome/core/component.h"
-
-#ifdef USE_ESP32
-#include "esphome/components/ble_client/ble_client.h"
-#else
-#include "esphome/components/ble_client/ble_client_gatt.h"
-#endif
+#include "esphome/core/log.h"
 
 namespace esphome::radon_eye_rd200 {
 
@@ -34,28 +20,26 @@ class RadonEyeRD200 final : public PollingComponent, public ble_client::BLEClien
   void dump_config() override;
   void update() override;
 
-  void set_radon(sensor::Sensor *radon) { this->radon_sensor_ = radon; }
-  void set_radon_long_term(sensor::Sensor *radon_long_term) { this->radon_long_term_sensor_ = radon_long_term; }
+  void gattc_event_handler(esp_gattc_cb_event_t event, esp_gatt_if_t gattc_if,
+                           esp_ble_gattc_cb_param_t *param) override;
 
-  // ---- ble_client::BLEClientNode (unused events keep the no-op defaults) ----
-  void on_connected(const ble_device_base::GattServiceTable &table) override;
-  void on_notify(uint16_t handle, const uint8_t *data, uint16_t len) override;
-  void on_notify_state(uint16_t handle, bool enabled, int error) override;
-  void on_write_result(uint16_t handle, int error) override;
+  void set_radon(sensor::Sensor *radon) { radon_sensor_ = radon; }
+  void set_radon_long_term(sensor::Sensor *radon_long_term) { radon_long_term_sensor_ = radon_long_term; }
 
  protected:
-  bool resolve_handles_(const ble_device_base::GattServiceTable &table);
-  void read_sensors_(const uint8_t *value, uint16_t value_len);
+  void read_sensors_(uint8_t *value, uint16_t value_len);
 
   sensor::Sensor *radon_sensor_{nullptr};
   sensor::Sensor *radon_long_term_sensor_{nullptr};
 
-  uint16_t read_handle_{0};
-  uint16_t write_handle_{0};
-  uint16_t cccd_handle_{0};
-  uint8_t write_command_{0};
+  uint8_t write_command_;
+  uint16_t read_handle_;
+  uint16_t write_handle_;
+  esp32_ble_tracker::ESPBTUUID service_uuid_;
+  esp32_ble_tracker::ESPBTUUID sensors_write_characteristic_uuid_;
+  esp32_ble_tracker::ESPBTUUID sensors_read_characteristic_uuid_;
 };
 
 }  // namespace esphome::radon_eye_rd200
 
-#endif  // USE_BLE_CLIENT_GATT_NODES
+#endif  // USE_ESP32

esphome/components/radon_eye_rd200/sensor.py

@@ -37,7 +37,7 @@ CONFIG_SCHEMA = cv.All(
         }
     )
     .extend(cv.polling_component_schema("5min"))
-    .extend(ble_client.NODE_BLE_CLIENT_SCHEMA),
+    .extend(ble_client.BLE_CLIENT_SCHEMA),
 )
 
 
@@ -45,7 +45,7 @@ async def to_code(config: ConfigType) -> None:
     var = cg.new_Pvariable(config[CONF_ID])
     await cg.register_component(var, config)
 
-    await ble_client.register_gatt_node(var, config)
+    await ble_client.register_ble_node(var, config)
 
     if CONF_RADON in config:
         sens = await sensor.new_sensor(config[CONF_RADON])

esphome/components/remote_transmitter/__init__.py

@@ -4,11 +4,7 @@ from esphome import automation, pins
 import esphome.codegen as cg
 from esphome.components import esp32, esp32_rmt, remote_base
 from esphome.components.libretiny import get_libretiny_family
-from esphome.components.libretiny.const import (
-    FAMILY_BK7231N,
-    FAMILY_BK7238,
-    FAMILY_RTL8720C,
-)
+from esphome.components.libretiny.const import FAMILY_BK7238, FAMILY_RTL8720C
 from esphome.config_helpers import filter_source_files_from_platform
 import esphome.config_validation as cv
 from esphome.const import (
@@ -49,7 +45,9 @@ DigitalWriteAction = remote_transmitter_ns.class_(
 )
 
 
-_NON_BLOCKING_LIBRETINY_FAMILIES = (FAMILY_RTL8720C, FAMILY_BK7231N, FAMILY_BK7238)
+# Keep in sync with the USE_LIBRETINY_VARIANT_RTL8720C / REMOTE_TRANSMITTER_BK_PWM gates in
+# remote_transmitter.h, which decide where set_non_blocking() is declared
+_NON_BLOCKING_LIBRETINY_FAMILIES = (FAMILY_RTL8720C, FAMILY_BK7238)
 
 
 def _validate_non_blocking_platform(value: bool) -> bool:
@@ -59,9 +57,7 @@ def _validate_non_blocking_platform(value: bool) -> bool:
         return cv.boolean(value)
     if CORE.is_libretiny and get_libretiny_family() in _NON_BLOCKING_LIBRETINY_FAMILIES:
         return cv.boolean(value)
-    raise cv.Invalid(
-        "non_blocking is only supported on ESP32, RTL8720C, BK7231N and BK7238"
-    )
+    raise cv.Invalid("non_blocking is only supported on ESP32, RTL8720C and BK7238")
 
 
 MULTI_CONF = True

esphome/components/remote_transmitter/remote_transmitter.h

@@ -12,10 +12,11 @@
 #endif  // SOC_RMT_SUPPORTED
 #endif  // USE_ESP32
 
-// The BK7231N-style PWM block (hardware shadow-load duty updates) enables the ISR-driven
-// transmitter on these families; family-level proxy for the SDK's CFG_SOC_NAME gate.
-// See remote_transmitter_bk72xx.cpp.
-#if defined(USE_LIBRETINY_VARIANT_BK7231N) || defined(USE_LIBRETINY_VARIANT_BK7238)
+// Enables the ISR-driven transmitter on Beken. Gated on BK7238 alone: the shadow-load PWM
+// block is shared with BK7231N, but LibreTiny builds that family against an older BDK whose
+// PWM driver has no pwm_init_param()/pwm_start(). See remote_transmitter_bk72xx.cpp.
+// Keep in sync with _NON_BLOCKING_LIBRETINY_FAMILIES in __init__.py.
+#ifdef USE_LIBRETINY_VARIANT_BK7238
 #define REMOTE_TRANSMITTER_BK_PWM
 #endif
 

esphome/components/remote_transmitter/remote_transmitter_bk72xx.cpp

@@ -9,10 +9,13 @@
 // with the core's fixes for type-name collisions between the two
 #include <ArduinoPrivate.h>
 
-// Only the BK7231N-style PWM block (shadow registers with a hardware CFG_UPDATA load bit)
-// supports glitch-free per-edge duty updates; older SoCs compile the generic bit-bang
-// implementation (remote_transmitter.cpp) instead, and this file compiles to nothing.
-// REMOTE_TRANSMITTER_BK_PWM is set per-family in remote_transmitter.h.
+// Needs the BK7231N-style PWM block (shadow registers with a hardware CFG_UPDATA load bit)
+// for glitch-free per-edge duty updates, and an SDK exposing pwm_init_param()/pwm_start().
+// BK7231N has the block but LibreTiny builds it against an older BDK offering only the
+// sddev_control API (CMD_PWM_INIT_PARAM), so it stays on the generic bit-bang path until
+// someone can add and validate that path on real hardware. Every other Beken SoC lacks the
+// block. REMOTE_TRANSMITTER_BK_PWM is set per-family in remote_transmitter.h; when it is
+// unset this file compiles to nothing and remote_transmitter.cpp is used instead.
 
 namespace esphome::remote_transmitter {
 

esphome/components/remote_transmitter/remote_transmitter_libretiny_isr.cpp

@@ -3,11 +3,11 @@
 #include "esphome/core/hal.h"
 #include "esphome/core/log.h"
 
-// Envelope chain shared by the LibreTiny families that pace transmission from a hardware
-// timer interrupt: RTL8720C (gtimer) and the BK7231N-style PWM block (BKTIMER1). Everything
-// platform-specific sits behind five hooks implemented in the per-family files -- carrier
-// setup, duty writes, one-shot arming and timer stop. Families without a usable timer keep
-// the generic bit-bang implementation and compile none of this.
+// Envelope chain shared by the LibreTiny families that pace transmission from a hardware timer
+// interrupt: RTL8720C (gtimer) and BK7238 (BKTIMER1). Everything platform-specific sits behind
+// five hooks implemented in the per-family files -- carrier setup, duty writes, one-shot arming
+// and timer stop. Families without a usable timer keep the generic bit-bang implementation and
+// compile none of this.
 #if defined(USE_LIBRETINY_VARIANT_RTL8720C) || defined(REMOTE_TRANSMITTER_BK_PWM)
 
 namespace esphome::remote_transmitter {

esphome/components/sdl/__init__.py

@@ -1 +1,254 @@
+import esphome.codegen as cg
+
 CODEOWNERS = ["@clydebarrow"]
+
+SDL_KeyCode = cg.global_ns.enum("SDL_KeyCode")
+
+SDL_KEYS = (
+    "SDLK_UNKNOWN",
+    "SDLK_RETURN",
+    "SDLK_ESCAPE",
+    "SDLK_BACKSPACE",
+    "SDLK_TAB",
+    "SDLK_SPACE",
+    "SDLK_EXCLAIM",
+    "SDLK_QUOTEDBL",
+    "SDLK_HASH",
+    "SDLK_PERCENT",
+    "SDLK_DOLLAR",
+    "SDLK_AMPERSAND",
+    "SDLK_QUOTE",
+    "SDLK_LEFTPAREN",
+    "SDLK_RIGHTPAREN",
+    "SDLK_ASTERISK",
+    "SDLK_PLUS",
+    "SDLK_COMMA",
+    "SDLK_MINUS",
+    "SDLK_PERIOD",
+    "SDLK_SLASH",
+    "SDLK_0",
+    "SDLK_1",
+    "SDLK_2",
+    "SDLK_3",
+    "SDLK_4",
+    "SDLK_5",
+    "SDLK_6",
+    "SDLK_7",
+    "SDLK_8",
+    "SDLK_9",
+    "SDLK_COLON",
+    "SDLK_SEMICOLON",
+    "SDLK_LESS",
+    "SDLK_EQUALS",
+    "SDLK_GREATER",
+    "SDLK_QUESTION",
+    "SDLK_AT",
+    "SDLK_LEFTBRACKET",
+    "SDLK_BACKSLASH",
+    "SDLK_RIGHTBRACKET",
+    "SDLK_CARET",
+    "SDLK_UNDERSCORE",
+    "SDLK_BACKQUOTE",
+    "SDLK_a",
+    "SDLK_b",
+    "SDLK_c",
+    "SDLK_d",
+    "SDLK_e",
+    "SDLK_f",
+    "SDLK_g",
+    "SDLK_h",
+    "SDLK_i",
+    "SDLK_j",
+    "SDLK_k",
+    "SDLK_l",
+    "SDLK_m",
+    "SDLK_n",
+    "SDLK_o",
+    "SDLK_p",
+    "SDLK_q",
+    "SDLK_r",
+    "SDLK_s",
+    "SDLK_t",
+    "SDLK_u",
+    "SDLK_v",
+    "SDLK_w",
+    "SDLK_x",
+    "SDLK_y",
+    "SDLK_z",
+    "SDLK_CAPSLOCK",
+    "SDLK_F1",
+    "SDLK_F2",
+    "SDLK_F3",
+    "SDLK_F4",
+    "SDLK_F5",
+    "SDLK_F6",
+    "SDLK_F7",
+    "SDLK_F8",
+    "SDLK_F9",
+    "SDLK_F10",
+    "SDLK_F11",
+    "SDLK_F12",
+    "SDLK_PRINTSCREEN",
+    "SDLK_SCROLLLOCK",
+    "SDLK_PAUSE",
+    "SDLK_INSERT",
+    "SDLK_HOME",
+    "SDLK_PAGEUP",
+    "SDLK_DELETE",
+    "SDLK_END",
+    "SDLK_PAGEDOWN",
+    "SDLK_RIGHT",
+    "SDLK_LEFT",
+    "SDLK_DOWN",
+    "SDLK_UP",
+    "SDLK_NUMLOCKCLEAR",
+    "SDLK_KP_DIVIDE",
+    "SDLK_KP_MULTIPLY",
+    "SDLK_KP_MINUS",
+    "SDLK_KP_PLUS",
+    "SDLK_KP_ENTER",
+    "SDLK_KP_1",
+    "SDLK_KP_2",
+    "SDLK_KP_3",
+    "SDLK_KP_4",
+    "SDLK_KP_5",
+    "SDLK_KP_6",
+    "SDLK_KP_7",
+    "SDLK_KP_8",
+    "SDLK_KP_9",
+    "SDLK_KP_0",
+    "SDLK_KP_PERIOD",
+    "SDLK_APPLICATION",
+    "SDLK_POWER",
+    "SDLK_KP_EQUALS",
+    "SDLK_F13",
+    "SDLK_F14",
+    "SDLK_F15",
+    "SDLK_F16",
+    "SDLK_F17",
+    "SDLK_F18",
+    "SDLK_F19",
+    "SDLK_F20",
+    "SDLK_F21",
+    "SDLK_F22",
+    "SDLK_F23",
+    "SDLK_F24",
+    "SDLK_EXECUTE",
+    "SDLK_HELP",
+    "SDLK_MENU",
+    "SDLK_SELECT",
+    "SDLK_STOP",
+    "SDLK_AGAIN",
+    "SDLK_UNDO",
+    "SDLK_CUT",
+    "SDLK_COPY",
+    "SDLK_PASTE",
+    "SDLK_FIND",
+    "SDLK_MUTE",
+    "SDLK_VOLUMEUP",
+    "SDLK_VOLUMEDOWN",
+    "SDLK_KP_COMMA",
+    "SDLK_KP_EQUALSAS400",
+    "SDLK_ALTERASE",
+    "SDLK_SYSREQ",
+    "SDLK_CANCEL",
+    "SDLK_CLEAR",
+    "SDLK_PRIOR",
+    "SDLK_RETURN2",
+    "SDLK_SEPARATOR",
+    "SDLK_OUT",
+    "SDLK_OPER",
+    "SDLK_CLEARAGAIN",
+    "SDLK_CRSEL",
+    "SDLK_EXSEL",
+    "SDLK_KP_00",
+    "SDLK_KP_000",
+    "SDLK_THOUSANDSSEPARATOR",
+    "SDLK_DECIMALSEPARATOR",
+    "SDLK_CURRENCYUNIT",
+    "SDLK_CURRENCYSUBUNIT",
+    "SDLK_KP_LEFTPAREN",
+    "SDLK_KP_RIGHTPAREN",
+    "SDLK_KP_LEFTBRACE",
+    "SDLK_KP_RIGHTBRACE",
+    "SDLK_KP_TAB",
+    "SDLK_KP_BACKSPACE",
+    "SDLK_KP_A",
+    "SDLK_KP_B",
+    "SDLK_KP_C",
+    "SDLK_KP_D",
+    "SDLK_KP_E",
+    "SDLK_KP_F",
+    "SDLK_KP_XOR",
+    "SDLK_KP_POWER",
+    "SDLK_KP_PERCENT",
+    "SDLK_KP_LESS",
+    "SDLK_KP_GREATER",
+    "SDLK_KP_AMPERSAND",
+    "SDLK_KP_DBLAMPERSAND",
+    "SDLK_KP_VERTICALBAR",
+    "SDLK_KP_DBLVERTICALBAR",
+    "SDLK_KP_COLON",
+    "SDLK_KP_HASH",
+    "SDLK_KP_SPACE",
+    "SDLK_KP_AT",
+    "SDLK_KP_EXCLAM",
+    "SDLK_KP_MEMSTORE",
+    "SDLK_KP_MEMRECALL",
+    "SDLK_KP_MEMCLEAR",
+    "SDLK_KP_MEMADD",
+    "SDLK_KP_MEMSUBTRACT",
+    "SDLK_KP_MEMMULTIPLY",
+    "SDLK_KP_MEMDIVIDE",
+    "SDLK_KP_PLUSMINUS",
+    "SDLK_KP_CLEAR",
+    "SDLK_KP_CLEARENTRY",
+    "SDLK_KP_BINARY",
+    "SDLK_KP_OCTAL",
+    "SDLK_KP_DECIMAL",
+    "SDLK_KP_HEXADECIMAL",
+    "SDLK_LCTRL",
+    "SDLK_LSHIFT",
+    "SDLK_LALT",
+    "SDLK_LGUI",
+    "SDLK_RCTRL",
+    "SDLK_RSHIFT",
+    "SDLK_RALT",
+    "SDLK_RGUI",
+    "SDLK_MODE",
+    "SDLK_AUDIONEXT",
+    "SDLK_AUDIOPREV",
+    "SDLK_AUDIOSTOP",
+    "SDLK_AUDIOPLAY",
+    "SDLK_AUDIOMUTE",
+    "SDLK_MEDIASELECT",
+    "SDLK_WWW",
+    "SDLK_MAIL",
+    "SDLK_CALCULATOR",
+    "SDLK_COMPUTER",
+    "SDLK_AC_SEARCH",
+    "SDLK_AC_HOME",
+    "SDLK_AC_BACK",
+    "SDLK_AC_FORWARD",
+    "SDLK_AC_STOP",
+    "SDLK_AC_REFRESH",
+    "SDLK_AC_BOOKMARKS",
+    "SDLK_BRIGHTNESSDOWN",
+    "SDLK_BRIGHTNESSUP",
+    "SDLK_DISPLAYSWITCH",
+    "SDLK_KBDILLUMTOGGLE",
+    "SDLK_KBDILLUMDOWN",
+    "SDLK_KBDILLUMUP",
+    "SDLK_EJECT",
+    "SDLK_SLEEP",
+    "SDLK_APP1",
+    "SDLK_APP2",
+    "SDLK_AUDIOREWIND",
+    "SDLK_AUDIOFASTFORWARD",
+    "SDLK_SOFTLEFT",
+    "SDLK_SOFTRIGHT",
+    "SDLK_CALL",
+    "SDLK_ENDCALL",
+)
+
+SDL_KEYMAP = {key: getattr(SDL_KeyCode, key) for key in SDL_KEYS}

esphome/components/sdl/binary_sensor.py

@@ -7,262 +7,15 @@ from esphome.core import Lambda
 from esphome.cpp_generator import ExpressionStatement, RawExpression
 from esphome.types import ConfigType
 
-from .display import CONF_SDL_ID, Sdl
+from . import SDL_KEYMAP
+from .display import CONF_SDL_ID, Sdl, headless_final_validate
 
 CODEOWNERS = ["@bdm310"]
 
 STATE_ARG = "state"
 
-SDL_KeyCode = cg.global_ns.enum("SDL_KeyCode")
+FINAL_VALIDATE_SCHEMA = headless_final_validate("binary_sensor")
 
-SDL_KEYS = (
-    "SDLK_UNKNOWN",
-    "SDLK_RETURN",
-    "SDLK_ESCAPE",
-    "SDLK_BACKSPACE",
-    "SDLK_TAB",
-    "SDLK_SPACE",
-    "SDLK_EXCLAIM",
-    "SDLK_QUOTEDBL",
-    "SDLK_HASH",
-    "SDLK_PERCENT",
-    "SDLK_DOLLAR",
-    "SDLK_AMPERSAND",
-    "SDLK_QUOTE",
-    "SDLK_LEFTPAREN",
-    "SDLK_RIGHTPAREN",
-    "SDLK_ASTERISK",
-    "SDLK_PLUS",
-    "SDLK_COMMA",
-    "SDLK_MINUS",
-    "SDLK_PERIOD",
-    "SDLK_SLASH",
-    "SDLK_0",
-    "SDLK_1",
-    "SDLK_2",
-    "SDLK_3",
-    "SDLK_4",
-    "SDLK_5",
-    "SDLK_6",
-    "SDLK_7",
-    "SDLK_8",
-    "SDLK_9",
-    "SDLK_COLON",
-    "SDLK_SEMICOLON",
-    "SDLK_LESS",
-    "SDLK_EQUALS",
-    "SDLK_GREATER",
-    "SDLK_QUESTION",
-    "SDLK_AT",
-    "SDLK_LEFTBRACKET",
-    "SDLK_BACKSLASH",
-    "SDLK_RIGHTBRACKET",
-    "SDLK_CARET",
-    "SDLK_UNDERSCORE",
-    "SDLK_BACKQUOTE",
-    "SDLK_a",
-    "SDLK_b",
-    "SDLK_c",
-    "SDLK_d",
-    "SDLK_e",
-    "SDLK_f",
-    "SDLK_g",
-    "SDLK_h",
-    "SDLK_i",
-    "SDLK_j",
-    "SDLK_k",
-    "SDLK_l",
-    "SDLK_m",
-    "SDLK_n",
-    "SDLK_o",
-    "SDLK_p",
-    "SDLK_q",
-    "SDLK_r",
-    "SDLK_s",
-    "SDLK_t",
-    "SDLK_u",
-    "SDLK_v",
-    "SDLK_w",
-    "SDLK_x",
-    "SDLK_y",
-    "SDLK_z",
-    "SDLK_CAPSLOCK",
-    "SDLK_F1",
-    "SDLK_F2",
-    "SDLK_F3",
-    "SDLK_F4",
-    "SDLK_F5",
-    "SDLK_F6",
-    "SDLK_F7",
-    "SDLK_F8",
-    "SDLK_F9",
-    "SDLK_F10",
-    "SDLK_F11",
-    "SDLK_F12",
-    "SDLK_PRINTSCREEN",
-    "SDLK_SCROLLLOCK",
-    "SDLK_PAUSE",
-    "SDLK_INSERT",
-    "SDLK_HOME",
-    "SDLK_PAGEUP",
-    "SDLK_DELETE",
-    "SDLK_END",
-    "SDLK_PAGEDOWN",
-    "SDLK_RIGHT",
-    "SDLK_LEFT",
-    "SDLK_DOWN",
-    "SDLK_UP",
-    "SDLK_NUMLOCKCLEAR",
-    "SDLK_KP_DIVIDE",
-    "SDLK_KP_MULTIPLY",
-    "SDLK_KP_MINUS",
-    "SDLK_KP_PLUS",
-    "SDLK_KP_ENTER",
-    "SDLK_KP_1",
-    "SDLK_KP_2",
-    "SDLK_KP_3",
-    "SDLK_KP_4",
-    "SDLK_KP_5",
-    "SDLK_KP_6",
-    "SDLK_KP_7",
-    "SDLK_KP_8",
-    "SDLK_KP_9",
-    "SDLK_KP_0",
-    "SDLK_KP_PERIOD",
-    "SDLK_APPLICATION",
-    "SDLK_POWER",
-    "SDLK_KP_EQUALS",
-    "SDLK_F13",
-    "SDLK_F14",
-    "SDLK_F15",
-    "SDLK_F16",
-    "SDLK_F17",
-    "SDLK_F18",
-    "SDLK_F19",
-    "SDLK_F20",
-    "SDLK_F21",
-    "SDLK_F22",
-    "SDLK_F23",
-    "SDLK_F24",
-    "SDLK_EXECUTE",
-    "SDLK_HELP",
-    "SDLK_MENU",
-    "SDLK_SELECT",
-    "SDLK_STOP",
-    "SDLK_AGAIN",
-    "SDLK_UNDO",
-    "SDLK_CUT",
-    "SDLK_COPY",
-    "SDLK_PASTE",
-    "SDLK_FIND",
-    "SDLK_MUTE",
-    "SDLK_VOLUMEUP",
-    "SDLK_VOLUMEDOWN",
-    "SDLK_KP_COMMA",
-    "SDLK_KP_EQUALSAS400",
-    "SDLK_ALTERASE",
-    "SDLK_SYSREQ",
-    "SDLK_CANCEL",
-    "SDLK_CLEAR",
-    "SDLK_PRIOR",
-    "SDLK_RETURN2",
-    "SDLK_SEPARATOR",
-    "SDLK_OUT",
-    "SDLK_OPER",
-    "SDLK_CLEARAGAIN",
-    "SDLK_CRSEL",
-    "SDLK_EXSEL",
-    "SDLK_KP_00",
-    "SDLK_KP_000",
-    "SDLK_THOUSANDSSEPARATOR",
-    "SDLK_DECIMALSEPARATOR",
-    "SDLK_CURRENCYUNIT",
-    "SDLK_CURRENCYSUBUNIT",
-    "SDLK_KP_LEFTPAREN",
-    "SDLK_KP_RIGHTPAREN",
-    "SDLK_KP_LEFTBRACE",
-    "SDLK_KP_RIGHTBRACE",
-    "SDLK_KP_TAB",
-    "SDLK_KP_BACKSPACE",
-    "SDLK_KP_A",
-    "SDLK_KP_B",
-    "SDLK_KP_C",
-    "SDLK_KP_D",
-    "SDLK_KP_E",
-    "SDLK_KP_F",
-    "SDLK_KP_XOR",
-    "SDLK_KP_POWER",
-    "SDLK_KP_PERCENT",
-    "SDLK_KP_LESS",
-    "SDLK_KP_GREATER",
-    "SDLK_KP_AMPERSAND",
-    "SDLK_KP_DBLAMPERSAND",
-    "SDLK_KP_VERTICALBAR",
-    "SDLK_KP_DBLVERTICALBAR",
-    "SDLK_KP_COLON",
-    "SDLK_KP_HASH",
-    "SDLK_KP_SPACE",
-    "SDLK_KP_AT",
-    "SDLK_KP_EXCLAM",
-    "SDLK_KP_MEMSTORE",
-    "SDLK_KP_MEMRECALL",
-    "SDLK_KP_MEMCLEAR",
-    "SDLK_KP_MEMADD",
-    "SDLK_KP_MEMSUBTRACT",
-    "SDLK_KP_MEMMULTIPLY",
-    "SDLK_KP_MEMDIVIDE",
-    "SDLK_KP_PLUSMINUS",
-    "SDLK_KP_CLEAR",
-    "SDLK_KP_CLEARENTRY",
-    "SDLK_KP_BINARY",
-    "SDLK_KP_OCTAL",
-    "SDLK_KP_DECIMAL",
-    "SDLK_KP_HEXADECIMAL",
-    "SDLK_LCTRL",
-    "SDLK_LSHIFT",
-    "SDLK_LALT",
-    "SDLK_LGUI",
-    "SDLK_RCTRL",
-    "SDLK_RSHIFT",
-    "SDLK_RALT",
-    "SDLK_RGUI",
-    "SDLK_MODE",
-    "SDLK_AUDIONEXT",
-    "SDLK_AUDIOPREV",
-    "SDLK_AUDIOSTOP",
-    "SDLK_AUDIOPLAY",
-    "SDLK_AUDIOMUTE",
-    "SDLK_MEDIASELECT",
-    "SDLK_WWW",
-    "SDLK_MAIL",
-    "SDLK_CALCULATOR",
-    "SDLK_COMPUTER",
-    "SDLK_AC_SEARCH",
-    "SDLK_AC_HOME",
-    "SDLK_AC_BACK",
-    "SDLK_AC_FORWARD",
-    "SDLK_AC_STOP",
-    "SDLK_AC_REFRESH",
-    "SDLK_AC_BOOKMARKS",
-    "SDLK_BRIGHTNESSDOWN",
-    "SDLK_BRIGHTNESSUP",
-    "SDLK_DISPLAYSWITCH",
-    "SDLK_KBDILLUMTOGGLE",
-    "SDLK_KBDILLUMDOWN",
-    "SDLK_KBDILLUMUP",
-    "SDLK_EJECT",
-    "SDLK_SLEEP",
-    "SDLK_APP1",
-    "SDLK_APP2",
-    "SDLK_AUDIOREWIND",
-    "SDLK_AUDIOFASTFORWARD",
-    "SDLK_SOFTLEFT",
-    "SDLK_SOFTRIGHT",
-    "SDLK_CALL",
-    "SDLK_ENDCALL",
-)
-
-SDL_KEYMAP = {key: getattr(SDL_KeyCode, key) for key in SDL_KEYS}
 
 CONFIG_SCHEMA = (
     binary_sensor.binary_sensor_schema(BinarySensor)

esphome/components/sdl/display.py

@@ -4,6 +4,7 @@ from typing import Any
 
 import esphome.codegen as cg
 from esphome.components import display
+from esphome.components.snapshot import Snapshot, register_snapshot
 import esphome.config_validation as cv
 from esphome.const import (
     CONF_DIMENSIONS,
@@ -16,14 +17,21 @@ from esphome.const import (
     CONF_Y,
     PLATFORM_HOST,
 )
+import esphome.final_validate as fv
 from esphome.types import ConfigType
 
+from . import SDL_KEYMAP
+
+AUTO_LOAD = ["snapshot"]
+
 sdl_ns = cg.esphome_ns.namespace("sdl")
-Sdl = sdl_ns.class_("Sdl", display.Display, cg.Component)
+Sdl = sdl_ns.class_("Sdl", display.Display, cg.Component, Snapshot)
 sdl_window_flags = cg.global_ns.enum("SDL_WindowFlags")
 
 
 CONF_CENTERED_ON_DISPLAY = "centered_on_display"
+CONF_HEADLESS = "headless"
+CONF_SNAPSHOT_KEY = "snapshot_key"
 CONF_SDL_OPTIONS = "sdl_options"
 CONF_SDL_ID = "sdl_id"
 CONF_WINDOW_OPTIONS = "window_options"
@@ -67,12 +75,29 @@ def _validate_position(config: dict) -> dict:
     raise cv.Invalid("Must specify either 'x' and 'y' or 'centered_on_display'")
 
 
+def _validate_headless(config: ConfigType) -> ConfigType:
+    if not config[CONF_HEADLESS]:
+        return config
+    if CONF_WINDOW_OPTIONS in config:
+        raise cv.Invalid(
+            f"'{CONF_WINDOW_OPTIONS}' has no effect when '{CONF_HEADLESS}' is set - there is no window"
+        )
+    if CONF_SNAPSHOT_KEY in config:
+        raise cv.Invalid(
+            f"'{CONF_SNAPSHOT_KEY}' cannot be used when '{CONF_HEADLESS}' is set - "
+            f"there is no keyboard. Use the 'snapshot.take' action instead"
+        )
+    return config
+
+
 CONFIG_SCHEMA = cv.All(
     display.FULL_DISPLAY_SCHEMA.extend(
         cv.Schema(
             {
                 cv.GenerateID(): cv.declare_id(Sdl),
                 cv.Optional(CONF_SDL_OPTIONS, default=""): get_sdl_options,
+                cv.Optional(CONF_HEADLESS, default=False): cv.boolean,
+                cv.Optional(CONF_SNAPSHOT_KEY): cv.enum(SDL_KEYMAP),
                 cv.Required(CONF_DIMENSIONS): cv.Any(
                     cv.dimensions,
                     cv.Schema(
@@ -99,16 +124,42 @@ CONFIG_SCHEMA = cv.All(
             }
         )
     ),
+    _validate_headless,
     cv.only_on(PLATFORM_HOST),
 )
 
 
+def headless_final_validate(platform: str) -> cv.Schema:
+    """Build a FINAL_VALIDATE_SCHEMA rejecting a platform whose sdl display is headless.
+
+    Mouse and keyboard platforms are driven by window events, so under a headless display they
+    would never report anything.
+    """
+
+    def validate_display(display_config: ConfigType) -> ConfigType:
+        if display_config.get(CONF_HEADLESS):
+            raise cv.Invalid(
+                f"The sdl {platform} platform needs a window, but its display has "
+                f"'{CONF_HEADLESS}' set"
+            )
+        return display_config
+
+    return cv.Schema(
+        {cv.Required(CONF_SDL_ID): fv.id_declaration_match_schema(validate_display)},
+        extra=cv.ALLOW_EXTRA,
+    )
+
+
 async def to_code(config: ConfigType) -> None:
     for option in config[CONF_SDL_OPTIONS].split():
         cg.add_build_flag(option)
     cg.add_build_flag("-DSDL_BYTEORDER=4321")
     var = cg.new_Pvariable(config[CONF_ID])
     await display.register_display(var, config)
+    await register_snapshot(var, config)
+    cg.add(var.set_headless(config[CONF_HEADLESS]))
+    if (key := config.get(CONF_SNAPSHOT_KEY)) is not None:
+        cg.add(var.set_snapshot_key(key))
 
     dimensions = config[CONF_DIMENSIONS]
     if isinstance(dimensions, dict):

esphome/components/sdl/sdl_esphome.cpp

@@ -2,8 +2,17 @@
 #include "sdl_esphome.h"
 #include "esphome/components/display/display_color_utils.h"
 
+#include <cstdlib>
+
 namespace esphome::sdl {
 
+namespace {
+
+// Key under which each window keeps a pointer back to its Sdl instance.
+constexpr const char *const WINDOW_DATA_KEY = "esphome_sdl";
+
+}  // namespace
+
 int Sdl::get_width() {
   switch (this->rotation_) {
     case display::DISPLAY_ROTATION_90_DEGREES:
@@ -28,17 +37,96 @@ int Sdl::get_height() {
   }
 }
 
-void Sdl::setup() {
-  SDL_Init(SDL_INIT_VIDEO);
-  this->window_ = SDL_CreateWindow(App.get_name().c_str(), this->pos_x_, this->pos_y_, this->width_, this->height_,
-                                   this->window_options_);
-  this->renderer_ = SDL_CreateRenderer(this->window_, -1, SDL_RENDERER_SOFTWARE);
-  SDL_RenderSetLogicalSize(this->renderer_, this->width_, this->height_);
+void Sdl::destroy_renderer_() {
+  // Reverse order of creation: the renderer refers to the window or surface it was made from.
+  if (this->shot_target_ != nullptr) {
+    SDL_DestroyTexture(this->shot_target_);
+    this->shot_target_ = nullptr;
+  }
+  if (this->texture_ != nullptr) {
+    SDL_DestroyTexture(this->texture_);
+    this->texture_ = nullptr;
+  }
+  if (this->renderer_ != nullptr) {
+    SDL_DestroyRenderer(this->renderer_);
+    this->renderer_ = nullptr;
+  }
+  if (this->window_ != nullptr) {
+    SDL_DestroyWindow(this->window_);
+    this->window_ = nullptr;
+  }
+  if (this->surface_ != nullptr) {
+    SDL_FreeSurface(this->surface_);
+    this->surface_ = nullptr;
+  }
+}
+
+bool Sdl::setup_failed_(const char *what) {
+  ESP_LOGE(TAG, "%s: %s", what, SDL_GetError());
+  // Give back whatever was created before the failure. Without this a half set up display leaves an
+  // empty window on screen for the life of the process, still registered as an event target.
+  this->destroy_renderer_();
+  return false;
+}
+
+bool Sdl::setup_renderer_() {
+  SDL_SetMainReady();
+  if (this->headless_) {
+    // SDL_INIT_VIDEO is deliberately not requested: a software renderer bound to a surface needs no
+    // video device, so this works on a machine with no display server at all.
+    if (SDL_Init(0) != 0)
+      return this->setup_failed_("SDL_Init failed");
+    this->surface_ = SDL_CreateRGBSurfaceWithFormat(0, this->width_, this->height_, 16, SDL_PIXELFORMAT_RGB565);
+    if (this->surface_ == nullptr)
+      return this->setup_failed_("Could not create offscreen surface");
+    this->renderer_ = SDL_CreateSoftwareRenderer(this->surface_);
+  } else {
+    if (SDL_Init(SDL_INIT_VIDEO) != 0)
+      return this->setup_failed_("SDL_Init failed");
+    this->window_ = SDL_CreateWindow(App.get_name().c_str(), this->pos_x_, this->pos_y_, this->width_, this->height_,
+                                     this->window_options_);
+    if (this->window_ == nullptr)
+      return this->setup_failed_("Could not create window");
+    // Lets loop() find the display an event belongs to, so one display does not act on another's
+    // input when several windows are open.
+    SDL_SetWindowData(this->window_, WINDOW_DATA_KEY, this);
+    this->renderer_ = SDL_CreateRenderer(this->window_, -1, SDL_RENDERER_SOFTWARE);
+  }
+  if (this->renderer_ == nullptr)
+    return this->setup_failed_("Could not create renderer");
+  if (SDL_RenderSetLogicalSize(this->renderer_, this->width_, this->height_) != 0)
+    return this->setup_failed_("Could not set renderer logical size");
   this->texture_ =
       SDL_CreateTexture(this->renderer_, SDL_PIXELFORMAT_RGB565, SDL_TEXTUREACCESS_STATIC, this->width_, this->height_);
-  SDL_SetTextureBlendMode(this->texture_, SDL_BLENDMODE_BLEND);
+  if (this->texture_ == nullptr)
+    return this->setup_failed_("Could not create texture");
+  // The texture has no alpha channel, so blending is pointless. Headless it would also force a
+  // different software blit path onto the 16 bit target surface.
+  if (SDL_SetTextureBlendMode(this->texture_, this->headless_ ? SDL_BLENDMODE_NONE : SDL_BLENDMODE_BLEND) != 0)
+    return this->setup_failed_("Could not set texture blend mode");
+  return true;
 }
+
+void Sdl::setup() {
+  if (!this->setup_renderer_()) {
+    this->mark_failed();
+    return;
+  }
+  if (this->headless_) {
+    // Nothing generates events, so there is nothing for loop() to do.
+    this->disable_loop();
+  } else if (this->snapshot_key_ != 0) {
+    this->add_key_listener(this->snapshot_key_, [this](bool down) {
+      if (down && !this->take_snapshot(nullptr)) {
+        ESP_LOGW(TAG, "snapshot key did not write a file");
+      }
+    });
+  }
+}
+
 void Sdl::update() {
+  if (this->texture_ == nullptr)
+    return;
   this->do_update_();
   if ((this->x_high_ < this->x_low_) || (this->y_high_ < this->y_low_))
     return;
@@ -51,12 +139,19 @@ void Sdl::update() {
 }
 
 void Sdl::redraw_(SDL_Rect &rect) {
+  // Nothing to present when headless - a snapshot blits the whole texture when it needs it, so
+  // doing it here as well would just burn CPU. draw_pixels_at() calls this on every partial
+  // update, so it is worth skipping.
+  if (this->headless_)
+    return;
   SDL_RenderCopy(this->renderer_, this->texture_, &rect, &rect);
   SDL_RenderPresent(this->renderer_);
 }
 
 void Sdl::draw_pixels_at(int x_start, int y_start, int w, int h, const uint8_t *ptr, display::ColorOrder order,
                          display::ColorBitness bitness, bool big_endian, int x_offset, int y_offset, int x_pad) {
+  if (this->texture_ == nullptr)
+    return;
   SDL_Rect rect{x_start, y_start, w, h};
   if (this->rotation_ != display::DISPLAY_ROTATION_0_DEGREES || bitness != display::COLOR_BITNESS_565 || big_endian) {
     Display::draw_pixels_at(x_start, y_start, w, h, ptr, order, bitness, big_endian, x_offset, y_offset, x_pad);
@@ -69,7 +164,7 @@ void Sdl::draw_pixels_at(int x_start, int y_start, int w, int h, const uint8_t *
 }
 
 void Sdl::draw_pixel_at(int x, int y, Color color) {
-  if (!this->get_clipping().inside(x, y))
+  if (this->texture_ == nullptr || !this->get_clipping().inside(x, y))
     return;
 
   if (this->rotation_ == display::DISPLAY_ROTATION_180_DEGREES) {
@@ -104,61 +199,148 @@ void Sdl::process_key(uint32_t keycode, bool down) {
     callback->second(down);
 }
 
+Sdl *Sdl::instance_for_window_(uint32_t window_id) {
+  SDL_Window *window = SDL_GetWindowFromID(window_id);
+  if (window == nullptr)
+    return nullptr;
+  return static_cast<Sdl *>(SDL_GetWindowData(window, WINDOW_DATA_KEY));
+}
+
+void Sdl::handle_event_(const SDL_Event &event) {
+  switch (event.type) {
+    case SDL_MOUSEBUTTONDOWN:
+    case SDL_MOUSEBUTTONUP:
+      if (event.button.button == 1) {
+        this->mouse_x = event.button.x;
+        this->mouse_y = event.button.y;
+        this->mouse_down = event.button.state != 0;
+      }
+      break;
+
+    case SDL_MOUSEMOTION:
+      if (event.motion.state & 1) {
+        this->mouse_x = event.motion.x;
+        this->mouse_y = event.motion.y;
+        this->mouse_down = true;
+      } else {
+        this->mouse_down = false;
+      }
+      break;
+
+    case SDL_KEYDOWN:
+      // Ignore auto-repeat, otherwise holding a key floods the listeners.
+      if (event.key.repeat != 0)
+        break;
+      ESP_LOGD(TAG, "keydown %d", event.key.keysym.sym);
+      this->process_key(event.key.keysym.sym, true);
+      break;
+
+    case SDL_KEYUP:
+      ESP_LOGD(TAG, "keyup %d", event.key.keysym.sym);
+      this->process_key(event.key.keysym.sym, false);
+      break;
+
+    case SDL_WINDOWEVENT:
+      switch (event.window.event) {
+        case SDL_WINDOWEVENT_SIZE_CHANGED:
+        case SDL_WINDOWEVENT_EXPOSED:
+        case SDL_WINDOWEVENT_RESIZED: {
+          SDL_Rect rect{0, 0, this->width_, this->height_};
+          this->redraw_(rect);
+          break;
+        }
+        default:
+          break;
+      }
+      break;
+
+    default:
+      break;
+  }
+}
+
 void Sdl::loop() {
   SDL_Event e;
-  if (SDL_PollEvent(&e)) {
-    switch (e.type) {
-      case SDL_QUIT:
-        exit(0);
+  // Take everything that is waiting, not one event per loop. A touch drag produces a burst of
+  // motion events, and consuming them one at a time lets the queue grow without bound, so the
+  // pointer ends up acting on input from further and further in the past. Draining collapses a
+  // burst to the position it ended at, which is the one the user is asking for anyway.
+  while (SDL_PollEvent(&e)) {
+    if (e.type == SDL_QUIT)
+      exit(0);
 
+    // Events carry the window they happened in, so send each one to the display that owns it.
+    uint32_t window_id;
+    switch (e.type) {
       case SDL_MOUSEBUTTONDOWN:
       case SDL_MOUSEBUTTONUP:
-        if (e.button.button == 1) {
-          this->mouse_x = e.button.x;
-          this->mouse_y = e.button.y;
-          this->mouse_down = e.button.state != 0;
-        }
+        window_id = e.button.windowID;
         break;
-
       case SDL_MOUSEMOTION:
-        if (e.motion.state & 1) {
-          this->mouse_x = e.button.x;
-          this->mouse_y = e.button.y;
-          this->mouse_down = true;
-        } else {
-          this->mouse_down = false;
-        }
+        window_id = e.motion.windowID;
         break;
-
       case SDL_KEYDOWN:
-        ESP_LOGD(TAG, "keydown %d", e.key.keysym.sym);
-        this->process_key(e.key.keysym.sym, true);
-        break;
-
       case SDL_KEYUP:
-        ESP_LOGD(TAG, "keyup %d", e.key.keysym.sym);
-        this->process_key(e.key.keysym.sym, false);
+        window_id = e.key.windowID;
         break;
-
       case SDL_WINDOWEVENT:
-        switch (e.window.event) {
-          case SDL_WINDOWEVENT_SIZE_CHANGED:
-          case SDL_WINDOWEVENT_EXPOSED:
-          case SDL_WINDOWEVENT_RESIZED: {
-            SDL_Rect rect{0, 0, this->width_, this->height_};
-            this->redraw_(rect);
-            break;
-          }
-          default:
-            break;
-        }
+        window_id = e.window.windowID;
         break;
-
       default:
+        // Anything else, including the touch events SDL reports alongside the mouse events it
+        // synthesises from them, is not used here.
         ESP_LOGV(TAG, "Event %d", e.type);
-        break;
+        continue;
+    }
+
+    Sdl *target = instance_for_window_(window_id);
+    if (target == nullptr) {
+      // Nothing to route this to: the window has gone, or it is not one of ours. Say so, otherwise
+      // input that stops working leaves no trace at all.
+      ESP_LOGV(TAG, "Event %d for unknown window %u", e.type, window_id);
+      continue;
+    }
+    target->handle_event_(e);
+  }
+}
+
+bool Sdl::capture_bgr(uint8_t *dest, size_t row_stride) {
+  if (this->texture_ == nullptr || this->renderer_ == nullptr) {
+    ESP_LOGE(TAG, "Snapshot requested but SDL is not set up");
+    return false;
+  }
+  if (this->shot_target_ == nullptr) {
+    this->shot_target_ = SDL_CreateTexture(this->renderer_, SDL_PIXELFORMAT_RGB565, SDL_TEXTUREACCESS_TARGET,
+                                           this->width_, this->height_);
+    if (this->shot_target_ == nullptr) {
+      ESP_LOGE(TAG, "Could not create capture texture: %s", SDL_GetError());
+      return false;
+    }
+    SDL_SetTextureBlendMode(this->shot_target_, SDL_BLENDMODE_NONE);
+  }
+
+  // Render into an offscreen target first. SDL_RenderReadPixels works in physical output pixels and
+  // ignores the logical size, so reading straight off a resizable window would read more pixels than
+  // there is room for.
+  // Every step is checked: a failed clear or copy would otherwise be read back as a blank or stale
+  // picture, written out, and reported as a snapshot that worked.
+  bool ok = false;
+  if (SDL_SetRenderTarget(this->renderer_, this->shot_target_) == 0) {
+    ok = SDL_SetRenderDrawColor(this->renderer_, 0, 0, 0, SDL_ALPHA_OPAQUE) == 0 &&
+         SDL_RenderClear(this->renderer_) == 0 &&
+         SDL_RenderCopy(this->renderer_, this->texture_, nullptr, nullptr) == 0 &&
+         SDL_RenderReadPixels(this->renderer_, nullptr, SDL_PIXELFORMAT_BGR24, dest, static_cast<int>(row_stride)) == 0;
+    if (SDL_SetRenderTarget(this->renderer_, nullptr) != 0) {
+      // Stuck rendering into shot_target_ from here on, so there's no point continuing.
+      ESP_LOGE(TAG, "Could not restore the render target: %s", SDL_GetError());
+      this->mark_failed();
+      return false;
     }
   }
+  if (!ok) {
+    ESP_LOGE(TAG, "Could not capture the screen: %s", SDL_GetError());
+  }
+  return ok;
 }
 
 }  // namespace esphome::sdl