Note that IDF's aligned_alloc has no size multiple requirement

Guard that libstdc++'s aligned delete frees with free()
Merge branch 'dev' into esp32-operator-new
2026-10-14 18:22:48 +00:00 · 2026-10-09 12:37:23 -10:00 · 2026-10-09 12:08:34 -10:00 · 2026-10-09 11:52:42 -10:00 · 2026-10-09 11:46:32 -10:00 · 2026-10-09 11:35:45 -10:00
2710 changed files with 34934 additions and 7828 deletions
@@ -53,7 +53,7 @@ module.exports = async ({ github, context }) => {
  });
  const currentLabels = currentLabelsData.map(label => label.name);
  const managedLabels = currentLabels.filter(label =>
-    label.startsWith('component: ') || MANAGED_LABELS.includes(label)
+    label.startsWith('component: ') || label.startsWith('platform: ') || MANAGED_LABELS.includes(label)
  );

  // Check for mega-PR early - if present, skip most automatic labeling
@@ -286,7 +286,7 @@ jobs:
          fi
          echo "version=$version" >> "$GITHUB_OUTPUT"
      - name: Run prek
-        uses: j178/prek-action@4e14d07f9231acabce116ccfca13b13dd9755ece # v3.0.0
+        uses: j178/prek-action@1382ad72dea72f9d53832f2bcb65b3e87a947204 # v3.0.1
        with:
          prek-version: ${{ steps.prek.outputs.version }}
          # This job only runs on pull requests, so nothing ever populates
@@ -299,7 +299,7 @@ jobs:
      # Pushes any fixes the hooks made back to the pull request. This step
      # must keep its default name: the GitHub App that performs the push
      # locates the workflow run by that name.
-      - uses: pre-commit-ci/lite-action@5d6cc0eb514c891a40562a58a8e71576c5c7fb43 # v1.1.0
+      - uses: pre-commit-ci/lite-action@062bca0919bc9d6e66755cc05074b70c77e111fc # v1.2.0
        if: always()
        with:
          msg: apply automatic formatting fixes
@@ -626,7 +626,7 @@ jobs:
            apt-get install -y libc6-dbg

      - name: Run CodSpeed benchmarks
-        uses: CodSpeedHQ/action@373d6868929f444bc08d901fd0eb0ad52a8875ea # v5.2.1
+        uses: CodSpeedHQ/action@c4fd08a3a159bd0cc208da1e0edf32b8c47d75e5 # v5.4.0
        with:
          run: |
            . venv/bin/activate
@@ -893,14 +893,20 @@ jobs:
      matrix:
        include:
          - id: clang-tidy
-            name: Run script/clang-tidy for ESP32 IDF 1/3
-            options: --environment esp32-idf-tidy --split-num 3 --split-at 1
+            name: Run script/clang-tidy for ESP32 IDF 1/5
+            options: --environment esp32-idf-tidy --split-num 5 --split-at 1
          - id: clang-tidy
-            name: Run script/clang-tidy for ESP32 IDF 2/3
-            options: --environment esp32-idf-tidy --split-num 3 --split-at 2
+            name: Run script/clang-tidy for ESP32 IDF 2/5
+            options: --environment esp32-idf-tidy --split-num 5 --split-at 2
          - id: clang-tidy
-            name: Run script/clang-tidy for ESP32 IDF 3/3
-            options: --environment esp32-idf-tidy --split-num 3 --split-at 3
+            name: Run script/clang-tidy for ESP32 IDF 3/5
+            options: --environment esp32-idf-tidy --split-num 5 --split-at 3
+          - id: clang-tidy
+            name: Run script/clang-tidy for ESP32 IDF 4/5
+            options: --environment esp32-idf-tidy --split-num 5 --split-at 4
+          - id: clang-tidy
+            name: Run script/clang-tidy for ESP32 IDF 5/5
+            options: --environment esp32-idf-tidy --split-num 5 --split-at 5

    steps:
      - name: Check out code from GitHub
@@ -1416,31 +1422,27 @@ jobs:
            echo "::warning::ci_memory_impact_extract.py not found on target branch, skipping memory impact analysis"
          fi

-      # Check if test files exist on the target branch for the requested
-      # components and platform. When a PR adds new test files for a platform,
-      # the target branch won't have them yet, so skip instead of failing.
-      # This check must be done here (not in determine-jobs.py) because
-      # determine-jobs runs on the PR branch and cannot see what the target
-      # branch has.
+      # The build below uses --base-only, so skip unless the target branch has
+      # test.<platform>.yaml for every requested component (test-*.yaml
+      # variants alone compile nothing, and a partial set would compare a
+      # smaller target build against the PR build). Checked here, not in
+      # determine-jobs.py, because determine-jobs runs on the PR branch and
+      # cannot see the target branch.
      - name: Check for test files on target branch
        id: check-tests
        if: steps.check-script.outputs.skip != 'true'
        run: |
          components='${{ toJSON(fromJSON(needs.determine-jobs.outputs.memory_impact).components) }}'
          platform="${{ fromJSON(needs.determine-jobs.outputs.memory_impact).platform }}"
-          found=false
+          missing=""
          for component in $(echo "$components" | jq -r '.[]'); do
-            # Check for test files matching the platform (test.platform.yaml or test-*.platform.yaml)
-            for f in tests/components/${component}/test*.${platform}.yaml; do
-              if [ -f "$f" ]; then
-                found=true
-                break 2
-              fi
-            done
+            if [ ! -f "tests/components/${component}/test.${platform}.yaml" ]; then
+              missing="${missing} ${component}"
+            fi
          done
-          if [ "$found" = false ]; then
+          if [ -n "$missing" ]; then
            echo "skip=true" >> $GITHUB_OUTPUT
-            echo "::warning::No test files found on target branch for platform ${platform}, skipping memory impact analysis"
+            echo "::warning::No test.${platform}.yaml on target branch for${missing}, skipping memory impact analysis"
          else
            echo "skip=false" >> $GITHUB_OUTPUT
          fi
@@ -125,14 +125,20 @@ jobs:
            }

            async function getEsphomeAndComponentChanges(github, owner, repo, prNumber) {
-                const changedFiles = await github.rest.pulls.listFiles({
-                    owner: owner,
-                    repo: repo,
-                    pull_number: prNumber,
-                });
+                const changedFiles = await github.paginate(
+                    github.rest.pulls.listFiles,
+                    {
+                        owner: owner,
+                        repo: repo,
+                        pull_number: prNumber,
+                        per_page: 100,
+                    }
+                );

-                const esphomeChanges = changedFiles.data
-                    .filter(file => file.filename !== "esphome/core/defines.h" && file.filename.startsWith('esphome/'))
+                // Files used only for development and CI, which do not affect use as an external component
+                const ignoredFiles = ["esphome/core/defines.h", "esphome/idf_component.yml"];
+                const esphomeChanges = changedFiles
+                    .filter(file => !ignoredFiles.includes(file.filename) && file.filename.startsWith('esphome/'))
                    .map(file => {
                        const match = file.filename.match(/esphome\/([^/]+)/);
                        return match ? match[1] : null;
@@ -144,7 +150,7 @@ jobs:
                }

                const uniqueEsphomeChanges = [...new Set(esphomeChanges)];
-                const componentChanges = changedFiles.data
+                const componentChanges = changedFiles
                    .filter(file => file.filename.startsWith('esphome/components/'))
                    .map(file => {
                        const match = file.filename.match(/esphome\/components\/([^/]+)\//);
@@ -7,10 +7,6 @@ on:
 permissions:
  pull-requests: read  # issues.listLabelsOnIssue to detect blocking labels (needs-docs, needs-developer-docs, merge-after-release, chained-pr)

-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
-  cancel-in-progress: true
-
 jobs:
  check:
    name: Check blocking labels
@@ -15,6 +15,8 @@ on:
  # base branch checkout, so fork code never runs with the token.
  pull_request_target:
    types: [opened, synchronize, reopened]
+    branches:
+      - dev
    paths:
      - requirements_dev.txt
      - requirements_test.txt
@@ -10,7 +10,7 @@ ci:
 repos:
  - repo: https://github.com/astral-sh/ruff-pre-commit
    # Ruff version.
-    rev: v0.16.9
+    rev: v0.16.10
    hooks:
      # Run the linter.
      - id: ruff
@@ -177,6 +177,13 @@ file does, and it is the authority when they disagree. The most useful starting
        Pick the primitive by cadence: under 250 ms use a gated `loop()`; 500 ms and above use
        `set_interval`. Full reasoning, including why `set_interval` costs more below 500 ms:
        https://developers.esphome.io/architecture/components/advanced/#quick-rule-of-thumb
+    *   **Scheduler ids:** name a timer only when it must be cancelled or replaced, and use a
+        `static constexpr uint32_t` id, never a string. Ids are per component instance and cannot clash with other
+        components, so number them from 0 and keep all of a component's ids together in one place.
+        ```cpp
+        static constexpr uint32_t READ_TIMEOUT_ID = 0;
+        this->set_timeout(READ_TIMEOUT_ID, 50, [this]() { this->read_(); });
+        ```
    *   **Don't override a default with the same value:** if a base class method already returns what you
        want, do not override it. `Component::get_setup_priority()` returns `setup_priority::DATA`, so a
        component that wants `DATA` should simply leave it alone.
@@ -230,6 +237,10 @@ file does, and it is the authority when they disagree. The most useful starting
        ```

    *   **Component Metadata:**
+        - `DOMAIN`: Required in every component's `__init__.py`, set to the component's own name as a plain
+          string (e.g. `DOMAIN = "my_component"`). Other code refers to the component through it, e.g.
+          `from esphome.components.my_component import DOMAIN`. Keep it in alphabetical order with the other
+          metadata constants. CI (`lint_component_domain`) fails without it.
        - `DEPENDENCIES`: List of required components
        - `AUTO_LOAD`: Components to automatically load
        - `CONFLICTS_WITH`: Incompatible components
@@ -243,6 +254,7 @@ file does, and it is the authority when they disagree. The most useful starting
        import esphome.config_validation as cv
        from esphome.const import CONF_KEY, CONF_ID

+        DOMAIN = "my_component"
        CONF_PARAM = "param"  # A constant that does not yet exist in esphome/const.py

        my_component_ns = cg.esphome_ns.namespace("my_component")
@@ -384,6 +396,25 @@ file does, and it is the authority when they disagree. The most useful starting
                )
        ```

+        When the callback's parameters differ from the automation's arguments, or the trigger should only
+        fire for some values, pass `params`, `forward` and `when`; the helper then generates a capture-less
+        lambda (stored inline, nothing allocated). Name the parent with `automation.parent_ref(var)` and build
+        `forward` from `MockObj` calls, not f-strings of C++:
+        ```python
+        parent = automation.parent_ref(var)
+        index = cg.RawExpression("index")
+        await automation.build_callback_automation(
+            var,
+            "add_on_state_callback",
+            [(cg.StringRef, "x"), (cg.size_t, "i")],
+            conf,
+            params=[(cg.size_t, "index")],
+            forward=[cg.StringRef(parent.option_at(index)), index],
+        )
+        ```
+        `build_parent_callback_automation`, `build_trigger_callback`, `build_callback_automations` and
+        `build_trigger_automations` cover the other shapes; see their docstrings in `esphome/automation.py`.
+
        **C++ -- no trigger class needed.** The callback registration method must be templatized to accept both `std::function` and lightweight forwarder structs (which avoid heap allocation):
        ```cpp
        class MyComponent : public Component {
@@ -187,10 +187,13 @@ esphome/components/esp32_rmt/* @jesserockz
 esphome/components/esp32_rmt_led_strip/* @jesserockz
 esphome/components/esp8266/* @esphome/core
 esphome/components/esp_ldo/* @clydebarrow
+esphome/components/espectre/* @francescopace
+esphome/components/esphome/ota/* @esphome/core
 esphome/components/espnow/* @jesserockz
 esphome/components/espnow/packet_transport/* @EasilyBoredEngineer
 esphome/components/ethernet_info/* @gtjadsonsantos
 esphome/components/event/* @nohat
+esphome/components/exponential_moving_average/* @clydebarrow
 esphome/components/exposure_notifications/* @OttoWinter
 esphome/components/ezo/* @ssieb
 esphome/components/ezo_pmp/* @carlos-sarmiento
@@ -245,8 +248,11 @@ esphome/components/hmac_md5/* @dwmw2
 esphome/components/hmac_sha256/* @dwmw2
 esphome/components/hoermann_hcp/* @zweckj
 esphome/components/homeassistant/* @esphome/core @OttoWinter
+esphome/components/homeassistant/button/* @jesserockz
 esphome/components/homeassistant/number/* @landonr
+esphome/components/homeassistant/select/* @jesserockz
 esphome/components/homeassistant/switch/* @Links2004
+esphome/components/homeassistant/text/* @jesserockz
 esphome/components/honeywell_hih_i2c/* @Benichou34
 esphome/components/honeywellabp/* @RubyBailey
 esphome/components/honeywellabp2_i2c/* @jpfaff
@@ -282,6 +288,7 @@ esphome/components/inkplate/* @jesserockz @JosipKuci
 esphome/components/integration/* @OttoWinter
 esphome/components/internal_temperature/* @Mat931
 esphome/components/interval/* @esphome/core
+esphome/components/ir_rf_base/* @bdraco @kbx81
 esphome/components/ir_rf_proxy/* @kbx81
 esphome/components/it8951/* @koosoli @limengdu @Passific
 esphome/components/jsn_sr04t/* @Mafus1
@@ -512,6 +519,7 @@ esphome/components/sound_level/* @kahrendt
 esphome/components/spa06_base/* @danielkent-net
 esphome/components/spa06_i2c/* @danielkent-net
 esphome/components/spa06_spi/* @danielkent-net
+esphome/components/spd2010/* @grischard
 esphome/components/speaker/* @jesserockz @kahrendt
 esphome/components/speaker/media_player/* @kahrendt @synesthesiam
 esphome/components/speaker_source/* @kahrendt
@@ -560,6 +568,7 @@ esphome/components/tc74/* @sethgirvan
 esphome/components/tca9548a/* @andreashergert1984
 esphome/components/tca9555/* @mobrembski
 esphome/components/tcl112/* @glmnet
+esphome/components/tcp_uart/* @Bascht74
 esphome/components/tee501/* @Stock-M
 esphome/components/teleinfo/* @0hax
 esphome/components/tem3200/* @bakerkj
@@ -601,11 +610,13 @@ esphome/components/uart/button/* @ssieb
 esphome/components/uart/event/* @eoasmxd
 esphome/components/uart/packet_transport/* @clydebarrow
 esphome/components/uart_mux/* @kbx81
+esphome/components/uart_tcp/* @Bascht74
 esphome/components/udp/* @clydebarrow
 esphome/components/ufire_ec/* @pvizeli
 esphome/components/ufire_ise/* @pvizeli
 esphome/components/ufm01/* @ljungqvist
 esphome/components/ultrasonic/* @ssieb @swoboda1337
+esphome/components/unicode/* @esphome/core
 esphome/components/update/* @jesserockz
 esphome/components/uponor_smatrix/* @kroimon
 esphome/components/usb_cdc_acm/* @kbx81
@@ -649,6 +660,7 @@ esphome/components/xiaomi_body_scale/* @dckiller51
 esphome/components/xiaomi_hhccjcy10/* @fariouche
 esphome/components/xiaomi_lywsd02mmc/* @juanluss31
 esphome/components/xiaomi_lywsd03mmc/* @ahpohl
+esphome/components/xiaomi_mccgq02hl/* @ahpohl @morph027
 esphome/components/xiaomi_mhoc303/* @drug123
 esphome/components/xiaomi_mhoc401/* @vevsvevs
 esphome/components/xiaomi_rtcgq02lm/* @jesserockz
@@ -48,7 +48,7 @@ PROJECT_NAME           = ESPHome
 # could be handy for archiving the generated documentation or if some version
 # control system is used.

-PROJECT_NUMBER         = 2026.10.0-dev
+PROJECT_NUMBER         = 2026.11.0-dev

 # Using the PROJECT_BRIEF tag one can provide an optional one line description
 # for a project that appears at the top of each page and should give viewer a
@@ -22,7 +22,7 @@ RUN \
    -r /requirements.txt

 # Install the ESPHome Device Builder dashboard.
-RUN uv pip install --no-cache-dir esphome-device-builder==1.19.0
+RUN uv pip install --no-cache-dir esphome-device-builder==1.23.0

 RUN \
    platformio settings set enable_telemetry No \
@@ -7,6 +7,7 @@ import importlib
 import logging
 import os
 from pathlib import Path
+import platform
 import re
 import sys
 import time
@@ -54,7 +55,7 @@ from esphome.const import (
 )
 from esphome.core import CORE, EsphomeError, coroutine
 from esphome.enum import StrEnum
-from esphome.helpers import get_bool_env, indent, is_ip_address
+from esphome.helpers import IS_MACOS, get_bool_env, indent, is_ip_address
 from esphome.log import AnsiFore, color, setup_log
 from esphome.stacktrace import LogLineProcessor
 from esphome.types import ConfigType
@@ -829,9 +830,9 @@ def write_cpp_file() -> int:

 def compile_program(args: ArgsProtocol, config: ConfigType) -> int:
    if CORE.skip_bootloader and not (CORE.is_esp32 and CORE.using_toolchain_esp_idf):
-        # Info, not a warning: an orchestrator cannot see YAML toolchain
-        # overrides, this is its expected no-op, and a full build is safe.
-        _LOGGER.info(
+        # Debug only: an orchestrator cannot see YAML toolchain overrides,
+        # so this is its expected no-op, and a full build is safe.
+        _LOGGER.debug(
            "--skip-bootloader ignored: only supported on ESP32 with the "
            "esp-idf toolchain"
        )
@@ -1300,10 +1301,9 @@ def _choose_ota_platform(config: ConfigType, requested: str | None) -> str:
    The native API uses challenge-response auth with MD5/SHA256 hashing of a
    server-issued nonce, so the password is never sent over the wire; the
    ``web_server`` path uses HTTP Basic auth which transmits credentials in
-    cleartext over the LAN. (The native path also supports gzip compression
-    on ESP8266, where flash space is tight; on ESP32/RP2040/LibreTiny the
-    backend reports ``supports_compression() == false`` and the firmware is
-    sent uncompressed regardless of which platform is used.) Falls back to
+    cleartext over the LAN. (The native path also compresses the upload:
+    gzip on ESP8266 and RP2040, which inflate it at reboot, and a deflate
+    stream on ESP32/LibreTiny, which inflate it as it arrives.) Falls back to
    ``web_server`` only when that is the only available platform.
    """
    # Use a dict (insertion-ordered) instead of a list so error messages and
@@ -1312,9 +1312,9 @@ def _choose_ota_platform(config: ConfigType, requested: str | None) -> str:
    # platform's final-validate hook merges duplicates anyway.
    available: dict[str, None] = {}
    for ota_item in config.get(CONF_OTA, []):
-        platform = ota_item.get(CONF_PLATFORM)
-        if platform in (CONF_ESPHOME, CONF_WEB_SERVER):
-            available[platform] = None
+        ota_platform = ota_item.get(CONF_PLATFORM)
+        if ota_platform in (CONF_ESPHOME, CONF_WEB_SERVER):
+            available[ota_platform] = None

    if not available:
        raise EsphomeError(
@@ -1946,7 +1946,10 @@ def run_multiple_configs(
        safe_print()

        cmd = command_builder(f)
-        rc = run_external_process(*cmd)
+        # The parent already logged the Intel macOS warning; children skip it.
+        rc = run_external_process(
+            *cmd, env={**os.environ, _INTEL_MACOS_WARNED_ENV: "1"}
+        )

        if rc == 0:
            print_bar(f"[{color(AnsiFore.BOLD_GREEN, 'SUCCESS')}] {str(f)}")
@@ -2615,6 +2618,27 @@ def _warn_if_source_tree_mismatch() -> None:
    )


+_INTEL_MACOS_REMOVAL = "2027.6.0"
+_INTEL_MACOS_WARNED_ENV = "ESPHOME_INTEL_MACOS_WARNED"
+
+
+def _warn_if_intel_macos() -> None:
+    """Warn that Intel (x86_64) Python on macOS loses support by _INTEL_MACOS_REMOVAL."""
+    if (
+        not IS_MACOS
+        or platform.machine() != "x86_64"
+        or _INTEL_MACOS_WARNED_ENV in os.environ
+    ):
+        return
+    _LOGGER.warning(
+        "Support for Intel Macs will end in ESPHome %s or earlier. The Python "
+        "packages ESPHome depends on have stopped publishing Intel macOS builds, "
+        "so future releases will not install on this machine. On an Apple "
+        "Silicon Mac, switch to a native arm64 Python.",
+        _INTEL_MACOS_REMOVAL,
+    )
+
+
 def run_esphome(argv):
    from esphome.address_cache import AddressCache

@@ -2634,6 +2658,7 @@ def run_esphome(argv):

    setup_log(log_level=args.log_level)
    _warn_if_source_tree_mismatch()
+    _warn_if_intel_macos()

    if args.command in PRE_CONFIG_ACTIONS:
        try:
@@ -49,40 +49,40 @@ class FrameworkRelease(NamedTuple):
 # Arduino core version -> its build in esphome-libs/arduino-esp8266
 FRAMEWORK_RELEASES: dict[Version, FrameworkRelease] = {
    Version(3, 1, 2): FrameworkRelease(
-        "3.1.2-esphome.1",
-        "e80751e3123676b967143e39c61f2d8693946db4c7806f2a83dcaaf797ecd582",
-        37189311,
+        "3.1.2-esphome.3",
+        "3af533a85163804e164500a5b254dc23b922080e25ecb7dc37b3dd8ac84651db",
+        37185650,
    ),
 }

 TOOLCHAIN_PACKAGE = "toolchain-xtensa-lx106-elf"
 # gcc 10.3, the toolchain Arduino core 3.x builds with; the build
 # generator's compile flags are tuned to it.
-TOOLCHAIN_VERSION = "10.3.0-esphome.2"
+TOOLCHAIN_VERSION = "10.3.0-esphome.3"
 _TOOLCHAIN_RELEASES = (
    "https://github.com/esphome-libs/xtensa-lx106-elf-toolchain/releases/"
 )
 # Registry system tag -> (sha256, size) of that host's archive
 TOOLCHAIN_BUILDS: dict[str, tuple[str, int]] = {
    "darwin_arm64": (
-        "849cede44d4d5c6ea0f14099783239f559f46327bea314281814f2652b486201",
-        60830321,
+        "ad0ea929238d9b527c43e0d20257acc2a5680bdb0d2b1cf8f2c99169786217e9",
+        60747260,
    ),
    "darwin_x86_64": (
-        "ca69904daabf0c5983b372423e5e62f49182a793e992c052e94666852470c897",
-        64149487,
+        "997090cac80c8eb59604ec52b73fb3568e5f2d9b2971f83c3f2a5c545c9c949c",
+        64065752,
    ),
    "linux_aarch64": (
-        "60a49a4f082bf246544bd409a9517dbbcab19bb30ac9decbee544b896aaccbd6",
-        67573397,
+        "403f14d0d5755682fcd6eaea1e4c457a1d8cad30690e52fb0c804d8db266b908",
+        67487067,
    ),
    "linux_x86_64": (
-        "1fba33ca1494ec79f2776e0e37eca93282d30f8bb9992f5f4f9a655d6fff1db4",
-        68431336,
+        "64f21fa3ba736b363dc8c234dbbb39e005e574e33de08a78e9a00c55a64ae706",
+        68343668,
    ),
    "windows_amd64": (
-        "af9066b0e5bf036f04f2bd9d08b89b81a7f183c57dac0abcaff71dd861cf5f3b",
-        67664137,
+        "1e62abf8df041ce5158f5770dffef955f2f981ce7f7adee88fcd5a8197705aa6",
+        67536405,
    ),
 }

@@ -1,4 +1,4 @@
-from collections.abc import Callable
+from collections.abc import Callable, Sequence
 from dataclasses import dataclass, field
 import logging
 import string
@@ -21,9 +21,9 @@ from esphome.const import (
    CONF_TYPE_ID,
    CONF_UPDATE_INTERVAL,
 )
-from esphome.core import CORE, ID, EsphomeError, Lambda
+from esphome.core import CORE, ID, EsphomeError, HexInt, Lambda
 from esphome.cpp_generator import (
-    FlashStringLiteral,
+    Expression,
    LambdaExpression,
    MockObj,
    MockObjClass,
@@ -35,6 +35,32 @@ from esphome.types import ConfigType, SafeExpType
 from esphome.util import Registry


+def progmem_bytes(name: str, data: bytes | list[int]) -> MockObj:
+    """Shared PROGMEM table for constant bytes; equal payloads share one, empty is nullptr."""
+    if not data:
+        return cg.nullptr
+    return cg.shared_progmem_array(
+        name, cg.uint8, cg.ArrayInitializer(*(HexInt(x) for x in data))
+    )
+
+
+async def templatable_bytes(
+    value: Any,
+    args: TemplateArgsType,
+    set_template: MockObj,
+    set_static: MockObj,
+    table_name: str,
+) -> None:
+    """Set a TemplatableBytes: a lambda via set_template, constant bytes via set_static."""
+    if cg.is_template(value):
+        fn = await cg.templatable(value, args, cg.std_vector.template(cg.uint8))
+        cg.add(set_template(fn))
+    elif len(value) > 0xFFFF:
+        raise EsphomeError(f"Byte payload is {len(value)} bytes; the maximum is 65535")
+    else:
+        cg.add(set_static(progmem_bytes(table_name, value), len(value)))
+
+
 def maybe_simple_id(*validators):
    """Allow a raw ID to be specified in place of a config block.
    If the value that's being validated is a dictionary, it's passed as-is to the specified validators. Otherwise, it's
@@ -219,9 +245,7 @@ ApplyCondition = cg.esphome_ns.class_("ApplyCondition", Condition)

 def flash_string(config: ConfigType, value: str) -> str:
    """Default renderer for ``std::string`` constants; copies the literal out of flash on ESP8266."""
-    if CORE.is_esp8266:
-        return f"progmem_string({FlashStringLiteral(value)})"
-    return str(cg.safe_exp(value))
+    return str(cg.progmem_string(value))


 def literal_with_length(config: ConfigType, value: str) -> str:
@@ -233,6 +257,13 @@ def literal_with_length(config: ConfigType, value: str) -> str:
    return f"{cg.safe_exp(value)}, {len(value.encode('utf-8'))}"


+def string_ref_literal(config: ConfigType, value: str) -> str:
+    """Renderer for a ``StringRef`` comparison: a flash literal on ESP8266, else ``StringRef(literal, length)``."""
+    if CORE.is_esp8266:
+        return str(cg.FlashStringLiteral(value))
+    return f"StringRef({literal_with_length(config, value)})"
+
+
@dataclass(frozen=True)
 class ApplyCall:
    """One statement from config keys, e.g. ``"set_range({}, {})"`` with ``((CONF_LOW, cg.float_), ...)``.
@@ -339,9 +370,16 @@ def _check_key_in_schema(
        schema = schema.schema[markers[part]]


+def parent_ref(var: MockObj) -> MockObj:
+    """``var`` named from global scope, so a trigger argument cannot shadow it.
+
+    Also how a generated callback names its Automation.
+    """
+    return MockObj(f"::{var}", "->")
+
+
 async def _apply_parent(config: ConfigType, id_key: str = CONF_ID) -> str:
-    # Global-scope qualified so a trigger arg named like the id cannot shadow it.
-    return f"::{await cg.get_variable(config[id_key])}"
+    return str(parent_ref(await cg.get_variable(config[id_key])))


 def _apply_lambda_args(args: TemplateArgsType) -> TemplateArgsType:
@@ -373,7 +411,7 @@ async def _render_values(
    members: list[tuple[Any, Any, Any]],
    values: list[Any],
    config: ConfigType,
-    parent: str,
+    parent: str | None,
    lambda_args: TemplateArgsType,
    compare: bool = False,
 ) -> list[str]:
@@ -451,7 +489,7 @@ def register_apply_action(
        statements: list[str] = []
        for target, members in statements_spec:
            values = _apply_values(config, members)
-            if members and all(value is None for value in values):
+            if not _apply_call_active(members, values):
                continue
            exprs = await _render_values(
                name, target, members, values, config, parent, lambda_args
@@ -470,6 +508,27 @@ def register_apply_action(
    register_action(name, ApplyAction, schema, synchronous=True)(builder)


+def _apply_call_active(members: list[tuple[Any, Any, Any]], values: list[Any]) -> bool:
+    """An ``ApplyCall`` is emitted unless it has keys and none of them is set."""
+    return not members or any(value is not None for value in values)
+
+
+async def _render_check(
+    name: str,
+    target: str,
+    members: list[tuple[Any, Any, Any]],
+    values: list[Any],
+    config: ConfigType,
+    parent: str | None,
+    lambda_args: TemplateArgsType,
+) -> str:
+    """Render a boolean check with ``values`` compared against config."""
+    exprs = await _render_values(
+        name, target, members, values, config, parent, lambda_args, compare=True
+    )
+    return target.format(*exprs)
+
+
 def register_apply_condition(
    name: str, schema: cv.Schema, check: str | ApplyCall, id_key: str = CONF_ID
 ) -> None:
@@ -495,22 +554,16 @@ def register_apply_condition(
    ) -> MockObj:
        parent = await _apply_parent(config, id_key)
        lambda_args = _apply_lambda_args(args)
-        exprs = await _render_values(
-            name,
-            call.target,
-            members,
-            _apply_values(config, members),
-            config,
-            parent,
-            lambda_args,
-            compare=True,
+        values = _apply_values(config, members)
+        check = await _render_check(
+            name, call.target, members, values, config, parent, lambda_args
        )
        return _apply_function(
            condition_id,
            cg.bool_,
            template_arg,
            lambda_args,
-            [f"return {parent}->{call.target.format(*exprs)};"],
+            [f"return {parent}->{check};"],
        )

    register_condition(name, ApplyCondition, schema)(builder)
@@ -646,52 +699,20 @@ XorCondition = cg.esphome_ns.class_("XorCondition", Condition)


@register_condition("and", AndCondition, validate_condition_list)
-async def and_condition_to_code(
-    config: ConfigType,
-    condition_id: ID,
-    template_arg: cg.TemplateArguments,
-    args: TemplateArgsType,
-) -> MockObj:
-    conditions = await build_condition_list(config, template_arg, args)
-    return cg.new_Pvariable(
-        condition_id, cg.TemplateArguments(len(conditions), *template_arg), conditions
-    )
-
-
-@register_condition("or", OrCondition, validate_condition_list)
-async def or_condition_to_code(
-    config: ConfigType,
-    condition_id: ID,
-    template_arg: cg.TemplateArguments,
-    args: TemplateArgsType,
-) -> MockObj:
-    conditions = await build_condition_list(config, template_arg, args)
-    return cg.new_Pvariable(
-        condition_id, cg.TemplateArguments(len(conditions), *template_arg), conditions
-    )
-
-
@register_condition("all", AndCondition, validate_condition_list)
-async def all_condition_to_code(
-    config: ConfigType,
-    condition_id: ID,
-    template_arg: cg.TemplateArguments,
-    args: TemplateArgsType,
-) -> MockObj:
-    conditions = await build_condition_list(config, template_arg, args)
-    return cg.new_Pvariable(
-        condition_id, cg.TemplateArguments(len(conditions), *template_arg), conditions
-    )
-
-
+@register_condition("or", OrCondition, validate_condition_list)
@register_condition("any", OrCondition, validate_condition_list)
-async def any_condition_to_code(
+@register_condition("xor", XorCondition, validate_condition_list)
+async def condition_group_to_code(
    config: ConfigType,
    condition_id: ID,
    template_arg: cg.TemplateArguments,
    args: TemplateArgsType,
 ) -> MockObj:
    conditions = await build_condition_list(config, template_arg, args)
+    # A group of one is that condition for and, or and xor; skip the wrapper.
+    if len(conditions) == 1:
+        return conditions[0]
    return cg.new_Pvariable(
        condition_id, cg.TemplateArguments(len(conditions), *template_arg), conditions
    )
@@ -708,19 +729,6 @@ async def not_condition_to_code(
    return cg.new_Pvariable(condition_id, template_arg, condition)


-@register_condition("xor", XorCondition, validate_condition_list)
-async def xor_condition_to_code(
-    config: ConfigType,
-    condition_id: ID,
-    template_arg: cg.TemplateArguments,
-    args: TemplateArgsType,
-) -> MockObj:
-    conditions = await build_condition_list(config, template_arg, args)
-    return cg.new_Pvariable(
-        condition_id, cg.TemplateArguments(len(conditions), *template_arg), conditions
-    )
-
-
@register_condition("lambda", LambdaCondition, cv.returning_lambda)
 async def lambda_condition_to_code(
    config: ConfigType,
@@ -1030,23 +1038,77 @@ def has_non_synchronous_actions(actions: ConfigType) -> bool:
    return False


-async def build_automation(
-    trigger: MockObj, args: TemplateArgsType, config: ConfigType
+async def _new_automation(
+    args: TemplateArgsType, config: ConfigType, *ctor_args: MockObj
 ) -> MockObj:
-    arg_types = [arg[0] for arg in args]
-    templ = cg.TemplateArguments(*arg_types)
-    obj = cg.new_Pvariable(config[CONF_AUTOMATION_ID], templ, trigger)
+    """Create the Automation for ``config`` with its actions."""
+    templ = cg.TemplateArguments(*(arg[0] for arg in args))
+    obj = cg.new_Pvariable(config[CONF_AUTOMATION_ID], templ, *ctor_args)
    actions = await build_action_list(config[CONF_THEN], templ, args)
    cg.add(obj.add_actions(actions))
    return obj


+async def build_automation(
+    trigger: MockObj, args: TemplateArgsType, config: ConfigType
+) -> MockObj:
+    return await _new_automation(args, config, trigger)
+
+
+async def build_trigger_callback(
+    args: TemplateArgsType,
+    config: ConfigType,
+    params: TemplateArgsType,
+    forward: Sequence[str | Expression] | None = None,
+    when: str | ApplyCall | None = None,
+) -> LambdaExpression:
+    """Build the Automation for ``config`` and return a stateless callback that triggers it.
+
+    ``params`` are the parent callback's parameters, ``forward`` the expressions passed to
+    ``trigger()`` (default: the parameter names; write the parent as ``parent_ref(var)``),
+    ``when`` a filter the callback returns early on, skipped like any ``ApplyCall`` when none
+    of its keys is set.
+    """
+    members: list[tuple[Any, Any, Any]] = []
+    if when is not None:
+        call = when if isinstance(when, ApplyCall) else ApplyCall(when)
+        members = call.members
+        # A trigger callback has no parent for a str type to name.
+        if any(isinstance(t, str) and "{parent}" in t for _, t, _ in members):
+            raise ValueError(f"trigger filter {call.target!r}: a type names {{parent}}")
+    obj = await _new_automation(args, config)
+    lambda_args = _apply_lambda_args(params)
+    statements: list[str] = []
+    if when is not None:
+        values = _apply_values(config, members)
+        if _apply_call_active(members, values):
+            check = await _render_check(
+                "trigger filter",
+                call.target,
+                members,
+                values,
+                config,
+                None,
+                lambda_args,
+            )
+            statements.append(f"if (!({check}))\n  return;")
+    if forward is None:
+        forward = [name for _, name in params]
+    statements.append(f"{parent_ref(obj)}->trigger({', '.join(map(str, forward))});")
+    return LambdaExpression(
+        ["\n".join(statements)], lambda_args, capture="", return_type=cg.void
+    )
+
+
 async def build_callback_automation(
    parent: MockObj,
    callback_method: str,
    args: TemplateArgsType,
    config: ConfigType,
    forwarder: MockObj | MockObjClass | None = None,
+    params: TemplateArgsType | None = None,
+    forward: Sequence[str | Expression] | None = None,
+    when: str | ApplyCall | None = None,
 ) -> None:
    """Build an Automation and register it as a callback on the parent.

@@ -1058,6 +1120,9 @@ async def build_callback_automation(
    pointer-sized (single Automation* field) to fit inline in Callback::ctx_
    and avoid heap allocation.

+    With ``params``, ``forward`` or ``when`` the callback is instead the stateless
+    lambda of ``build_trigger_callback``; ``forwarder`` cannot be combined with them.
+
    :param parent: The component object (e.g., button, sensor).
    :param callback_method: Name of the callback method (e.g., "add_on_press_callback").
    :param args: Automation template args as list of (type, name) tuples.
@@ -1066,22 +1131,56 @@ async def build_callback_automation(
        TriggerForwarder<Ts...>. Pass any struct type whose aggregate init takes
        a single Automation pointer (e.g., TriggerOnTrueForwarder).
    """
-    arg_types = [arg[0] for arg in args]
-    templ = cg.TemplateArguments(*arg_types)
-    obj = cg.new_Pvariable(config[CONF_AUTOMATION_ID], templ)
-    actions = await build_action_list(config[CONF_THEN], templ, args)
-    cg.add(obj.add_actions(actions))
+    if params is not None or forward is not None or when is not None:
+        if forwarder is not None:
+            raise ValueError(
+                "forwarder cannot be combined with params, forward or when"
+            )
+        callback = await build_trigger_callback(
+            args, config, args if params is None else params, forward, when
+        )
+        cg.add(getattr(parent, callback_method)(callback))
+        return
+    obj = await _new_automation(args, config)
    # Use template forwarder structs for deduplication. The compiler generates
    # one operator() per forwarder type; different automation pointers are just
    # data in the struct.
    if forwarder is None:
-        forwarder = TriggerForwarder.template(templ)
+        forwarder = TriggerForwarder.template(*(arg[0] for arg in args))
    # RawExpression for aggregate init — both forwarder and obj are codegen
    # MockObjs (not user input), and there's no Expression type for positional
    # aggregate initialization (StructInitializer uses named fields).
    cg.add(getattr(parent, callback_method)(cg.RawExpression(f"{forwarder}{{{obj}}}")))


+async def build_parent_callback_automation(
+    parent: MockObj, callback_method: str, arg: tuple[Any, str], config: ConfigType
+) -> None:
+    """Register an Automation that receives ``parent`` from a callback that carries nothing.
+
+    ``arg`` is the automation's ``(type, name)``, e.g. ``(Fan.operator("ptr"), "x")``.
+    """
+    await build_callback_automation(
+        parent, callback_method, [arg], config, params=[], forward=[parent_ref(parent)]
+    )
+
+
+async def build_trigger_automations(
+    parent: MockObj | None,
+    config: ConfigType,
+    entries: tuple[tuple[str, TemplateArgsType], ...],
+) -> None:
+    """Instantiate each entry's Trigger class, with ``parent`` when given, and build its automations.
+
+    ``entries`` are ``(conf_key, args)`` pairs; the class comes from the entry's ``CONF_TRIGGER_ID``.
+    """
+    ctor_args = () if parent is None else (parent,)
+    for conf_key, args in entries:
+        for conf in config.get(conf_key, []):
+            trigger = cg.new_Pvariable(conf[CONF_TRIGGER_ID], *ctor_args)
+            await build_automation(trigger, args, conf)
+
+
@dataclass(frozen=True, slots=True)
 class CallbackAutomation:
    """A single callback automation entry for build_callback_automations."""
@@ -1090,6 +1189,9 @@ class CallbackAutomation:
    callback_method: str
    args: TemplateArgsType = field(default_factory=list)
    forwarder: MockObj | MockObjClass | None = None
+    params: TemplateArgsType | None = None
+    forward: Sequence[str | Expression] | None = None
+    when: str | ApplyCall | None = None


 async def build_callback_automations(
@@ -1111,4 +1213,7 @@ async def build_callback_automations(
                entry.args,
                conf,
                forwarder=entry.forwarder,
+                params=entry.params,
+                forward=entry.forward,
+                when=entry.when,
            )
@@ -54,6 +54,7 @@ from esphome.components.esp8266.const import (
    KEY_ESP8266,
    KEY_FLASH_SIZE,
    KEY_SCANF_FLOAT,
+    THROW_STUBS_HEADER,
 )
 from esphome.core import CORE, EsphomeError
 from esphome.framework_helpers import get_project_cxx_compile_flags
@@ -1087,32 +1088,8 @@ def write_project(paths: InstalledPaths, ccache: str | None) -> bool:
    if "USE_ESP8266_WAVEFORM_STUBS" in flag_defines:
        core_exclude |= _CORE_EXCLUDE_WAVEFORM

-    archives = []
-    # variant_dir existence was already enforced with the include dirs
-    variant_sources = collect_sources(variant_dir)
-    if variant_sources:
-        objs = compile_edges(lines, variant_sources, variant_dir, "variant")
-        lines.append(f"build libFrameworkArduinoVariant.a: ar {' '.join(objs)}")
-        archives.append("libFrameworkArduinoVariant.a")
-
-    core_objs = compile_edges(
-        lines, collect_sources(core_dir, core_exclude), core_dir, "core"
-    )
-    if not core_objs:
-        # An empty archive would link into a wall of undefined references
-        # (app_entry, the exception vectors) far from the cause
-        raise EsphomeError(
-            f"{_INCOMPLETE_INSTALL}: no core sources in {core_dir}; {_CLEAN_HINT}"
-        )
-    lines.append(f"build libFrameworkArduino.a: ar {' '.join(core_objs)}")
-    archives.append("libFrameworkArduino.a")
-
-    lib_archives, direct_objs = library_edges(lines, libraries)
-    archives += lib_archives
-
-    # One source of truth with the PlatformIO path: esp8266/__init__ pins
-    # build_src_flags (the throw_stubs force-include); -include paths
-    # resolve against the source root
+    # esp8266/__init__ pins build_src_flags (the throw_stubs force-include), as on
+    # the PlatformIO path; -include paths resolve against the source root
    src_other: list[str] = []
    src_includes: list[str] = []
    src_it = iter(
@@ -1131,7 +1108,45 @@ def write_project(paths: InstalledPaths, ccache: str | None) -> bool:
            src_includes.append(tok[len("-include") :])
        else:
            src_other.append(_shell_token(tok))
+    # The throw stubs abort: none anywhere with exceptions on, else the core and
+    # libraries get them too (src keeps them after its pch include)
+    if config.exceptions:
+        src_includes = [h for h in src_includes if h != THROW_STUBS_HEADER]
    include_flags = [f"-include {_q(src_dir / h)}" for h in src_includes]
+    framework_flags = ""
+    if THROW_STUBS_HEADER in src_includes:
+        stubs_flag = include_flags[src_includes.index(THROW_STUBS_HEADER)]
+        lines.append(f"frameworkflags = {stubs_flag}")
+        framework_flags = "$frameworkflags"
+    archives = []
+    # variant_dir existence was already enforced with the include dirs
+    variant_sources = collect_sources(variant_dir)
+    if variant_sources:
+        objs = compile_edges(
+            lines, variant_sources, variant_dir, "variant", flags=framework_flags
+        )
+        lines.append(f"build libFrameworkArduinoVariant.a: ar {' '.join(objs)}")
+        archives.append("libFrameworkArduinoVariant.a")
+
+    core_objs = compile_edges(
+        lines,
+        collect_sources(core_dir, core_exclude),
+        core_dir,
+        "core",
+        flags=framework_flags,
+    )
+    if not core_objs:
+        # An empty archive would link into a wall of undefined references
+        # (app_entry, the exception vectors) far from the cause
+        raise EsphomeError(
+            f"{_INCOMPLETE_INSTALL}: no core sources in {core_dir}; {_CLEAN_HINT}"
+        )
+    lines.append(f"build libFrameworkArduino.a: ar {' '.join(core_objs)}")
+    archives.append("libFrameworkArduino.a")
+
+    lib_archives, direct_objs = library_edges(lines, libraries, framework_flags)
+    archives += lib_archives
+
    # One shared variable instead of repeating the flags line on every src
    # edge (hundreds of edges in a real project)
    lines.append(f"srcflags = {' '.join(src_other + include_flags)}")
@@ -66,6 +66,43 @@ else()
        "app edits will regenerate sections.ld.")
 endif()"""

+# lwip sources that compile to empty objects with the option off (their own
+# #if guard). (option, regex valid for both Python and CMake); a source is
+# only dropped when its option is defined and off, so a renamed option
+# keeps it.
+LWIP_EMPTY_SOURCES: tuple[tuple[str, str], ...] = (
+    ("CONFIG_LWIP_PPP_SUPPORT", "/netif/ppp/"),
+    ("CONFIG_LWIP_IPV6", "/core/ipv6/"),
+    ("CONFIG_LWIP_AUTOIP", "/core/ipv4/autoip[.]c$"),
+    ("CONFIG_LWIP_STATS", "/core/stats[.]c$"),
+)
+# Drift guard only: keep every lwip source.
+LWIP_FULL_SOURCES_ENV = "ESPHOME_LWIP_FULL_SOURCES"
+
+# Drops the empty objects after project(), once the lwip target exists.
+_LWIP_EMPTY_SOURCES_FILTER = f"""\
+idf_build_get_property(esphome_build_components BUILD_COMPONENTS)
+if(lwip IN_LIST esphome_build_components AND NOT DEFINED ENV{{{LWIP_FULL_SOURCES_ENV}}})
+    idf_component_get_property(esphome_lwip_lib lwip COMPONENT_LIB)
+    get_target_property(esphome_lwip_srcs ${{esphome_lwip_lib}} SOURCES)
+@FILTERS@
+    set_property(TARGET ${{esphome_lwip_lib}} PROPERTY SOURCES ${{esphome_lwip_srcs}})
+endif()"""
+
+
+def lwip_empty_source_gate(option: str, regex: str) -> str:
+    return (
+        f"    if(DEFINED {option} AND NOT {option})\n"
+        f'        list(FILTER esphome_lwip_srcs EXCLUDE REGEX "{regex}")\n'
+        "    endif()"
+    )
+
+
+def _lwip_empty_sources_filter() -> str:
+    gates = "\n".join(lwip_empty_source_gate(*entry) for entry in LWIP_EMPTY_SOURCES)
+    return _LWIP_EMPTY_SOURCES_FILTER.replace("@FILTERS@", gates)
+
+
 # Runs after project() so the walk has happened; catches the remaining
 # silent path where the top-level out-var was renamed.
 _LDGEN_OVERRIDE_CHECK = """\
@@ -123,7 +160,7 @@ def _cmake_quote(value: str) -> str:

 # CONFIG_APP_BUILD_BOOTLOADER is hidden and force-selected, so it can only be
 # cleared at the CMake level (the same state IDF's RAM-app build type uses).
-# The macro is IDF's __build_process_project_includes plus two added lines;
+# The macro is IDF's __build_process_project_includes plus a few added lines;
 # the flag is ignored and the bootloader builds as usual if IDF changes it.
 IDF_BOOTLOADER_OVERRIDE = """\
 # ESPHome bootloader skip switch; see esphome/espidf/toolchain.py.
@@ -136,6 +173,9 @@ if(ESPHOME_SKIP_BOOTLOADER)
        # skipped) bootloader project_include leaks; keep it defined, or
        # its empty TARGET_SRC_NAME sends file(GLOB_RECURSE) across /.
        idf_build_get_property(idf_target IDF_TARGET)
+        # partition_table's V1 ECDSA signing reads this key, which the
+        # skipped bootloader project_include also sets.
+        get_filename_component(SECURE_BOOT_SIGNING_KEY "${CONFIG_SECURE_BOOT_SIGNING_KEY}" ABSOLUTE BASE_DIR "${project_dir}")
        idf_build_get_property(build_properties __BUILD_PROPERTIES)
        foreach(build_property ${build_properties})
            idf_build_get_property(val ${build_property})
@@ -161,6 +201,10 @@ endif()
 BOOTLOADER_OVERRIDE_ADDED_LINES = (
    'set(CONFIG_APP_BUILD_BOOTLOADER "")',
    "idf_build_get_property(idf_target IDF_TARGET)",
+    (
+        "get_filename_component(SECURE_BOOT_SIGNING_KEY"
+        ' "${CONFIG_SECURE_BOOT_SIGNING_KEY}" ABSOLUTE BASE_DIR "${project_dir}")'
+    ),
 )

 _MACRO = re.compile(
@@ -193,6 +237,35 @@ def idf_macro_matches(idf_path: Path) -> bool:
    return live == _EXPECTED_MACRO


+def _cmake_args_for_write(minimal: bool) -> dict[str, str]:
+    """The cg.add_cmake_arg() values for one project write.
+
+    The discovery (minimal) write lets every built-in component register so
+    the list it finds, cached per target, serves any exclusion set; the full
+    write drops the excluded names from that list and passes all of them to
+    IDF. Names outside the framework's components directory (managed
+    components) stay excluded on the discovery write too, since the list
+    only holds built-in ones. A checkout supplied through IDF_PATH caches
+    nothing, so its discovery keeps every exclusion.
+    """
+    from esphome.espidf.toolchain import _esphome_manages_idf, _get_idf_path
+
+    args = dict(CORE.cmake_args)
+    if (
+        not minimal
+        or not _esphome_manages_idf()
+        or not (excluded := args.get("EXCLUDE_COMPONENTS"))
+    ):
+        return args
+    root = _get_idf_path() / "components"
+    outside = [name for name in excluded.split(";") if not (root / name).is_dir()]
+    if outside:
+        args["EXCLUDE_COMPONENTS"] = ";".join(outside)
+    else:
+        del args["EXCLUDE_COMPONENTS"]
+    return args
+
+
 def get_project_cmakelists(
    minimal: bool = False, builtin_components: list[str] | None = None
 ) -> str:
@@ -256,11 +329,10 @@ def get_project_cmakelists(

    # CMake variables registered via cg.add_cmake_arg(). Emitted before
    # include(project.cmake) so values like EXCLUDE_COMPONENTS are already
-    # set when project.cmake seeds the component list, and on minimal
-    # (discovery) writes too so excluded components never register.
+    # set when project.cmake seeds the component list.
    cmake_args = "\n".join(
        f"set({name} {_cmake_quote(value)})"
-        for name, value in sorted(CORE.cmake_args.items())
+        for name, value in sorted(_cmake_args_for_write(minimal).items())
    )

    # Per-project list exposed as a CMake variable so converted PIO libs
@@ -283,10 +355,10 @@ def get_project_cmakelists(
    # component's REQUIRES including real IDF components). Referenced by
    # src/CMakeLists and by each converted PIO lib's CMakeLists. Skipped
    # on minimal writes because project_description.json may be stale.
-    # Excluded components are dropped here as well: a stale
-    # project_description.json from a build without exclusions may still
-    # list them, and requiring an excluded component pulls it back into
-    # the build (IDF requirement expansion overrides EXCLUDE_COMPONENTS).
+    # Excluded components are dropped here as well: the discovery list
+    # (cached per target) still holds them, and requiring an excluded
+    # component pulls it back into the build (IDF requirement expansion
+    # overrides EXCLUDE_COMPONENTS).
    # Derived from the EXCLUDE_COMPONENTS cmake arg emitted above so the
    # two can never disagree within one generated file.
    builtin_components_property = (
@@ -348,6 +420,8 @@ project({CORE.name})

 {ldgen_override_check}

+{_lwip_empty_sources_filter()}
+
 # Emit per-memory-type JSON size data for ESPHome to read post-build.
 # json2 stays small; raw dumps every symbol (~2s on a large map) and
 # this command runs inside the link edge, blocking everything downstream.
@@ -508,10 +582,9 @@ def write_project(
    )

    # Snapshot the exclusion set so has_outdated_files() can trigger a
-    # discovery reconfigure when it changes. Excluded components never
-    # register in project_description.json, so re-including one (e.g. a
-    # config gains mqtt) requires a fresh discovery pass before the
-    # ESPHOME_PROJECT_BUILTIN_COMPONENTS property can list it.
+    # reconfigure when it changes. The ESPHOME_PROJECT_BUILTIN_COMPONENTS
+    # property drops excluded names, so re-including one (e.g. a config
+    # gains mqtt) needs a reconfigure to rebuild it from the discovery list.
    write_file_if_changed(
        CORE.relative_build_path("exclude_components.esphomeinternal"),
        ";".join(get_excluded_builtin_components()),
@@ -207,10 +207,12 @@ def compile_edges(


 def library_edges(
-    lines: list[str], libraries: list[ArduinoLibrary]
+    lines: list[str], libraries: list[ArduinoLibrary], extra_flags: str = ""
 ) -> tuple[list[str], list[str]]:
    """Emit every library's compile and archive edges.

+    ``extra_flags`` (raw ninja text) precede each library's own flags.
+
    Returns the archive names and the objects that link directly. A
    library's own include dirs lead its compile lines, as PlatformIO searched
    them first: the include path is one global list, so another library's
@@ -232,7 +234,7 @@ def library_edges(
            lib.sources,
            common_parent(lib.sources),
            f"lib/{lib.name}",
-            flags=" ".join(_shell_token(f) for f in lib.flags),
+            flags=" ".join(filter(None, [extra_flags, *map(_shell_token, lib.flags)])),
            own_includes=" ".join(f"-I{_q(d)}" for d in lib.include_dirs),
        )
        if not lib.lib_archive:
@@ -31,6 +31,7 @@ from esphome.cpp_generator import (  # noqa: F401
    add_global,
    add_library,
    add_platformio_option,
+    extern_progmem_array,
    get_variable,
    get_variable_with_full_id,
    is_template,
@@ -38,8 +39,10 @@ from esphome.cpp_generator import (  # noqa: F401
    new_variable,
    process_lambda,
    progmem_array,
+    progmem_string,
    safe_exp,
    set_cpp_standard,
+    shared_progmem_array,
    statement,
    static_const_array,
    static_function,
@@ -1 +1,2 @@
 CODEOWNERS = ["@MrSuicideParrot"]
+DOMAIN = "a01nyub"
@@ -6,7 +6,7 @@

 namespace esphome::a01nyub {

-static const char *const TAG = "a01nyub.sensor";
+ESPHOME_LOG_TAG(TAG, "a01nyub.sensor");

 void A01nyubComponent::loop() {
  uint8_t data;
@@ -1 +1,2 @@
 CODEOWNERS = ["@TH-Braemer"]
+DOMAIN = "a02yyuw"
@@ -6,7 +6,7 @@

 namespace esphome::a02yyuw {

-static const char *const TAG = "a02yyuw.sensor";
+ESPHOME_LOG_TAG(TAG, "a02yyuw.sensor");

 void A02yyuwComponent::loop() {
  uint8_t data;
@@ -0,0 +1 @@
+DOMAIN = "a4988"
@@ -3,7 +3,7 @@

 namespace esphome::a4988 {

-static const char *const TAG = "a4988.stepper";
+ESPHOME_LOG_TAG(TAG, "a4988.stepper");

 void A4988::setup() {
  if (this->sleep_pin_ != nullptr) {
@@ -1 +1,2 @@
 CODEOWNERS = ["@DAVe3283"]
+DOMAIN = "absolute_humidity"
@@ -3,7 +3,7 @@

 namespace esphome::absolute_humidity {

-static const char *const TAG{"absolute_humidity.sensor"};
+ESPHOME_LOG_TAG(TAG, "absolute_humidity.sensor");

 void AbsoluteHumidityComponent::setup() {
  this->temperature_sensor_->add_on_state_callback([this](float state) {
@@ -0,0 +1 @@
+DOMAIN = "ac_dimmer"
@@ -14,7 +14,7 @@

 namespace esphome::ac_dimmer {

-static const char *const TAG = "ac_dimmer";
+ESPHOME_LOG_TAG(TAG, "ac_dimmer");

 // Global array to store dimmer objects
 static AcDimmerDataStore *all_dimmers[32];  // NOLINT(cppcoreguidelines-avoid-non-const-global-variables)
@@ -9,7 +9,7 @@
 #include "esp_clk_tree.h"
 #include "soc/clk_tree_defs.h"

-static const char *const TAG = "hw_timer_esp_idf";
+ESPHOME_LOG_TAG(TAG, "hw_timer_esp_idf");

 namespace esphome::ac_dimmer {

@@ -9,6 +9,7 @@ from esphome.cpp_generator import MockObj
 from esphome.types import ConfigType

 DEPENDENCIES = ["uart"]
+DOMAIN = "adalight"

 adalight_ns = cg.esphome_ns.namespace("adalight")
 AdalightLightEffect = adalight_ns.class_(
@@ -3,7 +3,7 @@

 namespace esphome::adalight {

-static const char *const TAG = "adalight_light_effect";
+ESPHOME_LOG_TAG(TAG, "adalight_light_effect");

 static const uint32_t ADALIGHT_ACK_INTERVAL = 1000;
 static const uint32_t ADALIGHT_RECEIVE_TIMEOUT = 1000;
@@ -22,6 +22,7 @@ from esphome.core import CORE
 from esphome.types import ConfigType

 CODEOWNERS = ["@esphome/core"]
+DOMAIN = "adc"

 adc_ns = cg.esphome_ns.namespace("adc")

@@ -3,7 +3,7 @@

 namespace esphome::adc {

-static const char *const TAG = "adc";
+ESPHOME_LOG_TAG(TAG, "adc");

 const LogString *sampling_mode_to_str(SamplingMode mode) {
  switch (mode) {
@@ -6,7 +6,7 @@

 namespace esphome::adc {

-static const char *const TAG = "adc";
+ESPHOME_LOG_TAG(TAG, "adc");

 adc_oneshot_unit_handle_t ADCSensor::shared_adc_handles[2] = {nullptr, nullptr};

@@ -13,7 +13,7 @@ ADC_MODE(ADC_VCC)

 namespace esphome::adc {

-static const char *const TAG = "adc";
+ESPHOME_LOG_TAG(TAG, "adc");

 void ADCSensor::setup() {
 #ifndef USE_ADC_SENSOR_VCC
@@ -5,7 +5,7 @@

 namespace esphome::adc {

-static const char *const TAG = "adc";
+ESPHOME_LOG_TAG(TAG, "adc");

 void ADCSensor::setup() {
 #ifndef USE_ADC_SENSOR_VCC
@@ -17,7 +17,7 @@

 namespace esphome::adc {

-static const char *const TAG = "adc";
+ESPHOME_LOG_TAG(TAG, "adc");

 // The on-die temperature sensor sits on the last ADC channel: input 4 on RP2040
 // and RP2350A, but input 8 on RP2350B, which has eight external channels rather
@@ -7,7 +7,7 @@

 namespace esphome::adc {

-static const char *const TAG = "adc";
+ESPHOME_LOG_TAG(TAG, "adc");

 void ADCSensor::setup() {
  if (!adc_is_ready_dt(this->channel_)) {
@@ -5,6 +5,7 @@ from esphome.const import CONF_ID
 from esphome.types import ConfigType

 DEPENDENCIES = ["spi"]
+DOMAIN = "adc128s102"
 MULTI_CONF = True
 CODEOWNERS = ["@DeerMaximum"]

@@ -3,7 +3,7 @@

 namespace esphome::adc128s102 {

-static const char *const TAG = "adc128s102";
+ESPHOME_LOG_TAG(TAG, "adc128s102");

 float ADC128S102::get_setup_priority() const { return setup_priority::HARDWARE; }

@@ -4,7 +4,7 @@

 namespace esphome::adc128s102 {

-static const char *const TAG = "adc128s102.sensor";
+ESPHOME_LOG_TAG(TAG, "adc128s102.sensor");

 ADC128S102Sensor::ADC128S102Sensor(uint8_t channel) : channel_(channel) {}

@@ -0,0 +1 @@
+DOMAIN = "addressable_light"
@@ -3,7 +3,7 @@

 namespace esphome::addressable_light {

-static const char *const TAG = "addressable_light.display";
+ESPHOME_LOG_TAG(TAG, "addressable_light.display");

 int AddressableLightDisplay::get_width_internal() { return this->width_; }
 int AddressableLightDisplay::get_height_internal() { return this->height_; }
@@ -0,0 +1 @@
+DOMAIN = "ade7880"
@@ -15,7 +15,7 @@

 namespace esphome::ade7880 {

-static const char *const TAG = "ade7880";
+ESPHOME_LOG_TAG(TAG, "ade7880");

 void IRAM_ATTR ADE7880Store::gpio_intr(ADE7880Store *arg) { arg->reset_done = true; }

@@ -1 +1,2 @@
 CODEOWNERS = ["@angelnu"]
+DOMAIN = "ade7953"
@@ -27,6 +27,7 @@ from esphome.cpp_generator import MockObj
 from esphome.types import ConfigType

 CODEOWNERS = ["@angelnu"]
+DOMAIN = "ade7953_base"

 CONF_CURRENT_A = "current_a"
 CONF_CURRENT_B = "current_b"
@@ -5,7 +5,7 @@

 namespace esphome::ade7953_base {

-static const char *const TAG = "ade7953";
+ESPHOME_LOG_TAG(TAG, "ade7953");

 constexpr uint16_t CONFIG_DEFAULT = 0x8004u;
 constexpr uint16_t CONFIG_LOCK_BIT = 0x8000u;
@@ -1 +1,2 @@
 CODEOWNERS = ["@angelnu"]
+DOMAIN = "ade7953_i2c"
@@ -4,7 +4,7 @@

 namespace esphome::ade7953_i2c {

-static const char *const TAG = "ade7953";
+ESPHOME_LOG_TAG(TAG, "ade7953");

 void AdE7953I2c::dump_config() {
  ESP_LOGCONFIG(TAG, "ADE7953_i2c:");
@@ -1 +1,2 @@
 CODEOWNERS = ["@angelnu"]
+DOMAIN = "ade7953_spi"
@@ -4,7 +4,7 @@

 namespace esphome::ade7953_spi {

-static const char *const TAG = "ade7953";
+ESPHOME_LOG_TAG(TAG, "ade7953");

 // Datasheet requires at least 1.2µs after clearing CONFIG LOCK_BIT before raising CS
 constexpr uint8_t CONFIG_LOCK_SETTLE_US = 2;
@@ -5,6 +5,7 @@ from esphome.const import CONF_ID
 from esphome.types import ConfigType

 DEPENDENCIES = ["i2c"]
+DOMAIN = "ads1115"
 MULTI_CONF = True

 ads1115_ns = cg.esphome_ns.namespace("ads1115")
@@ -4,7 +4,7 @@

 namespace esphome::ads1115 {

-static const char *const TAG = "ads1115";
+ESPHOME_LOG_TAG(TAG, "ads1115");
 static const uint8_t ADS1115_REGISTER_CONVERSION = 0x00;
 static const uint8_t ADS1115_REGISTER_CONFIG = 0x01;

@@ -4,7 +4,7 @@

 namespace esphome::ads1115 {

-static const char *const TAG = "ads1115.sensor";
+ESPHOME_LOG_TAG(TAG, "ads1115.sensor");

 float ADS1115Sensor::sample() {
  return this->parent_->request_measurement(this->multiplexer_, this->gain_, this->resolution_, this->samplerate_);
@@ -6,6 +6,7 @@ from esphome.types import ConfigType

 CODEOWNERS = ["@solomondg1"]
 DEPENDENCIES = ["spi"]
+DOMAIN = "ads1118"
 MULTI_CONF = True

 CONF_ADS1118_ID = "ads1118_id"
@@ -4,7 +4,7 @@

 namespace esphome::ads1118 {

-static const char *const TAG = "ads1118";
+ESPHOME_LOG_TAG(TAG, "ads1118");
 static const uint8_t ADS1118_DATA_RATE_860_SPS = 0b111;

 void ADS1118::setup() {
@@ -4,7 +4,7 @@

 namespace esphome::ads1118 {

-static const char *const TAG = "ads1118.sensor";
+ESPHOME_LOG_TAG(TAG, "ads1118.sensor");

 void ADS1118Sensor::dump_config() {
  LOG_SENSOR("  ", "ADS1118 Sensor", this);
@@ -1 +1,2 @@
 CODEOWNERS = ["@mak-42"]
+DOMAIN = "ags10"
@@ -4,7 +4,7 @@
 #include <cinttypes>

 namespace esphome::ags10 {
-static const char *const TAG = "ags10";
+ESPHOME_LOG_TAG(TAG, "ags10");

 // Data acquisition.
 static const uint8_t REG_TVOC = 0x00;
@@ -62,16 +62,10 @@ async def to_code(config: ConfigType) -> None:
    await cg.register_component(var, config)
    await i2c.register_i2c_device(var, config)

-    sens = await sensor.new_sensor(config[CONF_TVOC])
-    cg.add(var.set_tvoc(sens))
-
-    if version_config := config.get(CONF_VERSION):
-        sens = await sensor.new_sensor(version_config)
-        cg.add(var.set_version(sens))
-
-    if resistance_config := config.get(CONF_RESISTANCE):
-        sens = await sensor.new_sensor(resistance_config)
-        cg.add(var.set_resistance(sens))
+    sensors = sensor.sub_sensors(config)
+    await sensors(CONF_TVOC, var.set_tvoc)
+    await sensors(CONF_VERSION, var.set_version)
+    await sensors(CONF_RESISTANCE, var.set_resistance)


 AGS10_NEW_I2C_ADDRESS_SCHEMA = cv.maybe_simple_value(
@@ -0,0 +1 @@
+DOMAIN = "aht10"
@@ -19,7 +19,7 @@

 namespace esphome::aht10 {

-static const char *const TAG = "aht10";
+ESPHOME_LOG_TAG(TAG, "aht10");
 static const uint8_t AHT10_INITIALIZE_CMD[] = {0xE1, 0x08, 0x00};
 static const uint8_t AHT20_INITIALIZE_CMD[] = {0xBE, 0x08, 0x00};
 static const uint8_t AHT10_MEASURE_CMD[] = {0xAC, 0x33, 0x00};
@@ -57,10 +57,6 @@ async def to_code(config: ConfigType) -> None:
    await i2c.register_i2c_device(var, config)
    cg.add(var.set_variant(config[CONF_VARIANT]))

-    if temperature := config.get(CONF_TEMPERATURE):
-        sens = await sensor.new_sensor(temperature)
-        cg.add(var.set_temperature_sensor(sens))
-
-    if humidity := config.get(CONF_HUMIDITY):
-        sens = await sensor.new_sensor(humidity)
-        cg.add(var.set_humidity_sensor(sens))
+    sensors = sensor.sub_sensors(config)
+    await sensors(CONF_TEMPERATURE, var.set_temperature_sensor)
+    await sensors(CONF_HUMIDITY, var.set_humidity_sensor)
@@ -0,0 +1 @@
+DOMAIN = "aic3204"
@@ -6,7 +6,7 @@

 namespace esphome::aic3204 {

-static const char *const TAG = "aic3204";
+ESPHOME_LOG_TAG(TAG, "aic3204");

 #define ERROR_CHECK(err, msg) \
  if (!(err)) { \
@@ -6,6 +6,7 @@ from esphome.types import ConfigType

 AUTO_LOAD = ["ble_device_base"]
 CODEOWNERS = ["@jeromelaban"]
+DOMAIN = "airthings_ble"

 airthings_ble_ns = cg.esphome_ns.namespace("airthings_ble")
 AirthingsListener = airthings_ble_ns.class_(
@@ -4,7 +4,7 @@

 namespace esphome::airthings_ble {

-static const char *const TAG = "airthings_ble";
+ESPHOME_LOG_TAG(TAG, "airthings_ble");

 bool AirthingsListener::parse_device(const ble_device_base::ESPBTDevice &device) {
  for (auto &it : device.get_manufacturer_datas()) {
@@ -24,6 +24,7 @@ from esphome.cpp_generator import MockObj
 from esphome.types import ConfigType

 CODEOWNERS = ["@ncareau", "@jeromelaban"]
+DOMAIN = "airthings_wave_base"

 DEPENDENCIES = ["ble_client"]

@@ -8,7 +8,10 @@

 namespace esphome::airthings_wave_base {

-static const char *const TAG = "airthings_wave_base";
+ESPHOME_LOG_TAG(TAG, "airthings_wave_base");
+
+static constexpr uint32_t BATTERY_READ_TIMEOUT_ID = 0;
+static constexpr uint32_t RESPONSE_TIMEOUT_ID = 1;

 void AirthingsWaveBase::gattc_event_handler(esp_gattc_cb_event_t event, esp_gatt_if_t gattc_if,
                                            esp_ble_gattc_cb_param_t *param) {
@@ -181,7 +184,7 @@ void AirthingsWaveBase::read_battery_(uint8_t *raw_value, uint16_t value_len) {
    // read the battery again at the configured update interval
    if (this->battery_update_interval_ != this->update_interval_) {
      this->read_battery_next_update_ = false;
-      this->set_timeout("battery", this->battery_update_interval_,
+      this->set_timeout(BATTERY_READ_TIMEOUT_ID, this->battery_update_interval_,
                        [this]() { this->read_battery_next_update_ = true; });
    }
  }
@@ -204,7 +207,7 @@ void AirthingsWaveBase::response_received_() {
 }

 void AirthingsWaveBase::set_response_timeout_() {
-  this->set_timeout("response_timeout", 30 * 1000, [this]() {
+  this->set_timeout(RESPONSE_TIMEOUT_ID, 30 * 1000, [this]() {
    this->responses_pending_ = 1;
    this->response_received_();
  });
@@ -1 +1,2 @@
 CODEOWNERS = ["@ncareau"]
+DOMAIN = "airthings_wave_mini"
@@ -4,7 +4,7 @@

 namespace esphome::airthings_wave_mini {

-static const char *const TAG = "airthings_wave_mini";
+ESPHOME_LOG_TAG(TAG, "airthings_wave_mini");

 void AirthingsWaveMini::read_sensors(uint8_t *raw_value, uint16_t value_len) {
  auto *value = (WaveMiniReadings *) raw_value;
@@ -1 +1,2 @@
 CODEOWNERS = ["@jeromelaban", "@precurse"]
+DOMAIN = "airthings_wave_plus"
@@ -4,7 +4,7 @@

 namespace esphome::airthings_wave_plus {

-static const char *const TAG = "airthings_wave_plus";
+ESPHOME_LOG_TAG(TAG, "airthings_wave_plus");

 void AirthingsWavePlus::read_sensors(uint8_t *raw_value, uint16_t value_len) {
  auto *value = (WavePlusReadings *) raw_value;
@@ -21,6 +21,7 @@ from esphome.core.entity_helpers import (
 from esphome.cpp_generator import MockObjClass

 CODEOWNERS = ["@grahambrown11", "@hwstar"]
+DOMAIN = "alarm_control_panel"
 IS_PLATFORM_COMPONENT = True

 CONF_ON_TRIGGERED = "on_triggered"
@@ -10,7 +10,7 @@

 namespace esphome::alarm_control_panel {

-static const char *const TAG = "alarm_control_panel";
+ESPHOME_LOG_TAG(TAG, "alarm_control_panel");

 AlarmControlPanelCall AlarmControlPanel::make_call() { return AlarmControlPanelCall(this); }

@@ -6,7 +6,7 @@

 namespace esphome::alarm_control_panel {

-static const char *const TAG = "alarm_control_panel";
+ESPHOME_LOG_TAG(TAG, "alarm_control_panel");

 AlarmControlPanelCall::AlarmControlPanelCall(AlarmControlPanel *parent) : parent_(parent) {}

@@ -1 +1,2 @@
 CODEOWNERS = ["@jan-hofmeier"]
+DOMAIN = "alpha3"
@@ -7,7 +7,7 @@

 namespace esphome::alpha3 {

-static const char *const TAG = "alpha3";
+ESPHOME_LOG_TAG(TAG, "alpha3");

 void Alpha3::dump_config() {
  ESP_LOGCONFIG(TAG, "ALPHA3");
@@ -1 +1,2 @@
 CODEOWNERS = ["@swoboda1337"]
+DOMAIN = "am2315c"
@@ -26,7 +26,7 @@

 namespace esphome::am2315c {

-static const char *const TAG = "am2315c";
+ESPHOME_LOG_TAG(TAG, "am2315c");

 bool AM2315C::reset_register_(uint8_t reg) {
  //  code based on demo code sent by www.aosong.com
@@ -46,10 +46,6 @@ async def to_code(config: ConfigType) -> None:
    await cg.register_component(var, config)
    await i2c.register_i2c_device(var, config)

-    if temperature_config := config.get(CONF_TEMPERATURE):
-        sens = await sensor.new_sensor(temperature_config)
-        cg.add(var.set_temperature_sensor(sens))
-
-    if humidity_config := config.get(CONF_HUMIDITY):
-        sens = await sensor.new_sensor(humidity_config)
-        cg.add(var.set_humidity_sensor(sens))
+    sensors = sensor.sub_sensors(config)
+    await sensors(CONF_TEMPERATURE, var.set_temperature_sensor)
+    await sensors(CONF_HUMIDITY, var.set_humidity_sensor)
@@ -0,0 +1 @@
+DOMAIN = "am2320"
@@ -10,7 +10,7 @@

 namespace esphome::am2320 {

-static const char *const TAG = "am2320";
+ESPHOME_LOG_TAG(TAG, "am2320");

 void AM2320Component::update() {
  uint8_t data[8];
@@ -48,10 +48,6 @@ async def to_code(config: ConfigType) -> None:
    await cg.register_component(var, config)
    await i2c.register_i2c_device(var, config)

-    if temperature_config := config.get(CONF_TEMPERATURE):
-        sens = await sensor.new_sensor(temperature_config)
-        cg.add(var.set_temperature_sensor(sens))
-
-    if humidity_config := config.get(CONF_HUMIDITY):
-        sens = await sensor.new_sensor(humidity_config)
-        cg.add(var.set_humidity_sensor(sens))
+    sensors = sensor.sub_sensors(config)
+    await sensors(CONF_TEMPERATURE, var.set_temperature_sensor)
+    await sensors(CONF_HUMIDITY, var.set_humidity_sensor)
@@ -1 +1,2 @@
 CODEOWNERS = ["@buxtronix"]
+DOMAIN = "am43"
@@ -5,7 +5,7 @@

 namespace esphome::am43 {

-static const char *const TAG = "am43_cover";
+ESPHOME_LOG_TAG(TAG, "am43_cover");

 using namespace esphome::cover;

@@ -48,10 +48,6 @@ async def to_code(config: ConfigType) -> None:
    await cg.register_component(var, config)
    await ble_client.register_ble_node(var, config)

-    if battery_level_config := config.get(CONF_BATTERY_LEVEL):
-        sens = await sensor.new_sensor(battery_level_config)
-        cg.add(var.set_battery(sens))
-
-    if illuminance_config := config.get(CONF_ILLUMINANCE):
-        sens = await sensor.new_sensor(illuminance_config)
-        cg.add(var.set_illuminance(sens))
+    sensors = sensor.sub_sensors(config)
+    await sensors(CONF_BATTERY_LEVEL, var.set_battery)
+    await sensors(CONF_ILLUMINANCE, var.set_illuminance)
@@ -6,7 +6,7 @@

 namespace esphome::am43 {

-static const char *const TAG = "am43";
+ESPHOME_LOG_TAG(TAG, "am43");

 void Am43::dump_config() {
  ESP_LOGCONFIG(TAG, "AM43");
@@ -1 +1,2 @@
 CODEOWNERS = ["@ianchi"]
+DOMAIN = "analog_threshold"
@@ -3,7 +3,7 @@

 namespace esphome::analog_threshold {

-static const char *const TAG = "analog_threshold.binary_sensor";
+ESPHOME_LOG_TAG(TAG, "analog_threshold.binary_sensor");

 void AnalogThresholdBinarySensor::setup() {
  float sensor_value = this->sensor_->get_state();
@@ -0,0 +1 @@
+DOMAIN = "anova"
@@ -5,7 +5,7 @@

 namespace esphome::anova {

-static const char *const TAG = "anova";
+ESPHOME_LOG_TAG(TAG, "anova");

 using namespace esphome::climate;

@@ -2,3 +2,4 @@
 # https://www.mouser.ca/datasheet/2/678/AVGO_S_A0002854364_1-2574547.pdf

 CODEOWNERS = ["@aodrenah"]
+DOMAIN = "apds9306"
@@ -7,7 +7,7 @@

 namespace esphome::apds9306 {

-static const char *const TAG = "apds9306";
+ESPHOME_LOG_TAG(TAG, "apds9306");

 enum {  // APDS9306 registers
  APDS9306_MAIN_CTRL = 0x00,
@@ -5,6 +5,7 @@ from esphome.const import CONF_ID
 from esphome.types import ConfigType

 DEPENDENCIES = ["i2c"]
+DOMAIN = "apds9960"
 MULTI_CONF = True

 CONF_APDS9960_ID = "apds9960_id"
@@ -4,7 +4,7 @@

 namespace esphome::apds9960 {

-static const char *const TAG = "apds9960";
+ESPHOME_LOG_TAG(TAG, "apds9960");

 #define APDS9960_ERROR_CHECK(func) \
  if (!(func)) { \
@@ -1,3 +1,4 @@
+from ipaddress import IPv4Address, IPv6Address
 import logging
 import re
 from typing import Any
@@ -5,8 +6,9 @@ from typing import Any
 from esphome import automation
 from esphome.automation import Condition
 import esphome.codegen as cg
-from esphome.components.const import CONF_DESCRIPTION
+from esphome.components.const import CONF_DESCRIPTION, CONF_HOST
 from esphome.components.logger import request_log_listener
+from esphome.components.network import DOMAIN as NETWORK_DOMAIN

 # ENCRYPTION_SCHEMA and validate_encryption_key are re-exported for external
 # components and downstream consumers that import them from api
@@ -26,6 +28,8 @@ from esphome.const import (
    CONF_CAPTURE_RESPONSE,
    CONF_DATA,
    CONF_DATA_TEMPLATE,
+    CONF_DELAY,
+    CONF_ENABLE_IPV6,
    CONF_ENCRYPTION,
    CONF_EVENT,
    CONF_ID,
@@ -48,10 +52,14 @@ from esphome.const import (
    CONF_VARIABLES,
 )
 from esphome.core import CORE, ID, CoroPriority, EsphomeError, coroutine_with_priority
-from esphome.cpp_generator import MockObj, TemplateArgsType
-from esphome.helpers import fnv1_hash
+from esphome.cpp_generator import Expression, MockObj, TemplateArgsType
+import esphome.final_validate as fv
+from esphome.helpers import cpp_string_escape, fnv1_hash
+from esphome.schema_extractors import SCHEMA_EXTRACT, schema_extractor
 from esphome.types import ConfigFragmentType, ConfigType

+from . import wizard
+
 # Compat alias: downstream consumers (e.g. device-builder) referenced the
 # schema by its old private name before it moved to the noise component
 _encryption_schema = encryption_schema
@@ -86,6 +94,7 @@ APIServer = api_ns.class_("APIServer", cg.Component)
 HomeAssistantServiceCallAction = api_ns.class_(
    "HomeAssistantServiceCallAction", automation.Action
 )
+HomeAssistantField = api_ns.struct("HomeAssistantField")
 ActionResponse = api_ns.class_("ActionResponse")
 HomeAssistantActionResponseTrigger = api_ns.class_(
    "HomeAssistantActionResponseTrigger", automation.Trigger
@@ -135,6 +144,7 @@ CONF_HOMEASSISTANT_SERVICES = "homeassistant_services"
 CONF_HOMEASSISTANT_STATES = "homeassistant_states"
 CONF_LISTEN_BACKLOG = "listen_backlog"
 CONF_MAX_SEND_QUEUE = "max_send_queue"
+CONF_OUTGOING_CONNECTION = "outgoing_connection"
 CONF_STATE_SUBSCRIPTION_ONLY = "state_subscription_only"

 # Schema defaults that also match the C++ initializers in api_server.h; codegen
@@ -142,6 +152,7 @@ CONF_STATE_SUBSCRIPTION_ONLY = "state_subscription_only"
 DEFAULT_PORT = 6053
 DEFAULT_REBOOT_TIMEOUT = "15min"
 DEFAULT_BATCH_DELAY = "100ms"
+DEFAULT_LISTEN_BACKLOG = 4


 def _register_provisioning_source(config: ConfigType) -> ConfigType:
@@ -292,9 +303,72 @@ def _consume_api_sockets(config: ConfigType) -> ConfigType:
    # (not max_connections, which is the upper limit rarely reached)
    socket.consume_sockets(3, "api")(config)
    socket.consume_sockets(1, "api", socket.SocketType.TCP_LISTEN)(config)
+    if CONF_OUTGOING_CONNECTION in config:
+        socket.consume_sockets(1, "api_outgoing_connection")(config)
    return config


+def _validate_outgoing_connection(config: ConfigType) -> ConfigType:
+    if (outgoing := config.get(CONF_OUTGOING_CONNECTION)) is None:
+        return config
+    if CONF_ENCRYPTION not in config:
+        raise cv.Invalid(
+            "outgoing_connection requires 'encryption' so the peer is verified by key",
+            path=[CONF_OUTGOING_CONNECTION],
+        )
+    # A device with no client reboots once reboot_timeout passes, so a delay that
+    # reaches it would reboot the device before it ever dials
+    reboot_timeout = config[CONF_REBOOT_TIMEOUT]
+    delay = outgoing[CONF_DELAY]
+    if reboot_timeout.total_milliseconds and delay >= reboot_timeout:
+        raise cv.Invalid(
+            f"delay must be shorter than reboot_timeout ({reboot_timeout}), "
+            "otherwise the device reboots before it dials",
+            path=[CONF_OUTGOING_CONNECTION, CONF_DELAY],
+        )
+    return config
+
+
+def _validate_outgoing_host(value: str) -> IPv4Address | IPv6Address:
+    """Only accept an address the device itself can parse.
+
+    Python accepts a scope id, which neither `inet_pton` nor lwIP's `inet6_aton`
+    takes, and a v4-mapped address is dialed as plain IPv4, needing no IPv6 build.
+    """
+    address = cv.ipaddress(value)
+    if isinstance(address, IPv6Address):
+        if address.scope_id is not None:
+            raise cv.Invalid(
+                f"{value} carries a scope id, which the device cannot parse; "
+                "give the address without the '%' part"
+            )
+        if (mapped := address.ipv4_mapped) is not None:
+            return mapped
+    return address
+
+
+_OUTGOING_CONNECTION_SCHEMA = cv.Schema(
+    {
+        cv.Optional(CONF_HOST): _validate_outgoing_host,
+        cv.Optional(CONF_PORT, default=6054): cv.port,
+        # Bounded against reboot_timeout in _validate_outgoing_connection
+        cv.Optional(CONF_DELAY, default="60s"): cv.positive_time_period_milliseconds,
+    }
+)
+
+
+@schema_extractor("schema")
+def _outgoing_connection_schema(config: ConfigType | None) -> ConfigType:
+    # A bare `outgoing_connection:` block is valid; without a host the device
+    # dials the remembered last dial-back client
+    if config is SCHEMA_EXTRACT:
+        # Let the language-schema dumper walk host, port and delay
+        return _OUTGOING_CONNECTION_SCHEMA
+    if config is None:
+        config = {}
+    return _OUTGOING_CONNECTION_SCHEMA(config)
+
+
 CONFIG_SCHEMA = cv.All(
    cv.Schema(
        {
@@ -319,6 +393,8 @@ CONFIG_SCHEMA = cv.All(
            ): ACTIONS_SCHEMA,
            cv.Exclusive(CONF_ACTIONS, group_of_exclusion=CONF_ACTIONS): ACTIONS_SCHEMA,
            cv.Optional(CONF_ENCRYPTION): encryption_schema,
+            cv.Optional(wizard.CONF_WIZARD): wizard.WIZARD_SCHEMA,
+            cv.Optional(CONF_OUTGOING_CONNECTION): _outgoing_connection_schema,
            cv.Optional(CONF_BATCH_DELAY, default=DEFAULT_BATCH_DELAY): cv.All(
                cv.positive_time_period_milliseconds,
                cv.Range(max=cv.TimePeriod(milliseconds=65535)),
@@ -374,6 +450,7 @@ CONFIG_SCHEMA = cv.All(
        }
    ).extend(cv.COMPONENT_SCHEMA),
    cv.rename_key(CONF_SERVICES, CONF_ACTIONS),
+    _validate_outgoing_connection,
    _consume_api_sockets,
    _register_provisioning_source,
 )
@@ -430,7 +507,34 @@ def _validate_esp8266_action_strings(config: ConfigType) -> ConfigType:
    return config


-FINAL_VALIDATE_SCHEMA = _validate_esp8266_action_strings
+def _validate_outgoing_host_ipv6(config: ConfigType) -> ConfigType:
+    """An IPv6 host can never be parsed, so never dialed, without IPv6."""
+    if (
+        (outgoing := config.get(CONF_OUTGOING_CONNECTION)) is None
+        or (host := outgoing.get(CONF_HOST)) is None
+        or host.version != 6
+    ):
+        return config
+    network_conf = fv.full_config.get().get(NETWORK_DOMAIN) or {}
+    if not network_conf.get(CONF_ENABLE_IPV6):
+        raise cv.Invalid(
+            "outgoing_connection host is an IPv6 address but IPv6 is not "
+            "enabled; set 'network: enable_ipv6: true'",
+            path=[CONF_OUTGOING_CONNECTION, CONF_HOST],
+        )
+    return config
+
+
+def _validate_wizard(config: ConfigType) -> ConfigType:
+    wizard.final_validate(config)
+    return config
+
+
+FINAL_VALIDATE_SCHEMA = cv.All(
+    _validate_esp8266_action_strings,
+    _validate_outgoing_host_ipv6,
+    _validate_wizard,
+)


 def _add_action_strings(
@@ -477,8 +581,10 @@ async def to_code(config: ConfigType) -> None:
        cg.add(var.set_reboot_timeout(reboot_timeout))
    if (batch_delay := config[CONF_BATCH_DELAY]) != cv.time_period(DEFAULT_BATCH_DELAY):
        cg.add(var.set_batch_delay(batch_delay))
-    if CONF_LISTEN_BACKLOG in config:
-        cg.add(var.set_listen_backlog(config[CONF_LISTEN_BACKLOG]))
+    if (
+        listen_backlog := config.get(CONF_LISTEN_BACKLOG)
+    ) is not None and listen_backlog != DEFAULT_LISTEN_BACKLOG:
+        cg.add(var.set_listen_backlog(listen_backlog))
    cg.add_define("MAX_API_CONNECTIONS", config[CONF_MAX_CONNECTIONS])
    cg.add_define("API_MAX_SEND_QUEUE", config[CONF_MAX_SEND_QUEUE])

@@ -583,6 +689,9 @@ async def to_code(config: ConfigType) -> None:
        # Stack buffer that list-entities copies PROGMEM strings into, sized for the largest action
        cg.add_define("API_USER_ACTION_STRINGS_SCRATCH_SIZE", max(scratch_size, 1))

+    if (wizard_config := config.get(wizard.CONF_WIZARD)) is not None:
+        await wizard.to_code(wizard_config)
+
    if CONF_ON_CLIENT_CONNECTED in config:
        cg.add_define("USE_API_CLIENT_CONNECTED_TRIGGER")
        await automation.build_automation(
@@ -601,7 +710,7 @@ async def to_code(config: ConfigType) -> None:

    if (encryption_config := config.get(CONF_ENCRYPTION, None)) is not None:
        if key := encryption_config.get(CONF_KEY):
-            cg.add(var.set_noise_psk(new_psk_progmem(config[CONF_ID], key)))
+            cg.add(var.set_noise_psk(new_psk_progmem(key)))
            cg.add_define("USE_API_NOISE_PSK_FROM_YAML")
        else:
            # No key provided, but encryption desired
@@ -618,6 +727,13 @@ async def to_code(config: ConfigType) -> None:
    else:
        cg.add_define("USE_API_PLAINTEXT")

+    if (outgoing := config.get(CONF_OUTGOING_CONNECTION)) is not None:
+        cg.add_define("USE_API_OUTGOING_CONNECTION")
+        if (host := outgoing.get(CONF_HOST)) is not None:
+            cg.add_define("API_OUTGOING_CONNECTION_HOST", str(host))
+        cg.add_define("API_OUTGOING_CONNECTION_PORT", outgoing[CONF_PORT])
+        cg.add_define("API_OUTGOING_CONNECTION_DELAY", outgoing[CONF_DELAY])
+
    cg.add_define("USE_API")
    cg.add_global(api_ns.using)

@@ -658,6 +774,11 @@ VARIABLES_SCHEMA = cv.Schema(
    {cv.string: cv.All(_coerce_implicit_lambda, cv.templatable(cv.string_strict))}
 )

+# The action stores each map's entry count in a uint8_t
+_FIELD_MAP_MAX = 255
+DATA_FIELDS_SCHEMA = cv.All(KEY_VALUE_SCHEMA, cv.Length(max=_FIELD_MAP_MAX))
+VARIABLES_FIELDS_SCHEMA = cv.All(VARIABLES_SCHEMA, cv.Length(max=_FIELD_MAP_MAX))
+

 def _validate_response_config(config: ConfigType) -> ConfigType:
    # Validate dependencies:
@@ -692,9 +813,9 @@ HOMEASSISTANT_ACTION_ACTION_SCHEMA = cv.All(
            cv.Exclusive(CONF_ACTION, group_of_exclusion=CONF_ACTION): cv.templatable(
                cv.string
            ),
-            cv.Optional(CONF_DATA, default={}): KEY_VALUE_SCHEMA,
-            cv.Optional(CONF_DATA_TEMPLATE, default={}): KEY_VALUE_SCHEMA,
-            cv.Optional(CONF_VARIABLES, default={}): VARIABLES_SCHEMA,
+            cv.Optional(CONF_DATA, default={}): DATA_FIELDS_SCHEMA,
+            cv.Optional(CONF_DATA_TEMPLATE, default={}): DATA_FIELDS_SCHEMA,
+            cv.Optional(CONF_VARIABLES, default={}): VARIABLES_FIELDS_SCHEMA,
            cv.Optional(CONF_RESPONSE_TEMPLATE): cv.templatable(cv.string),
            cv.Optional(CONF_CAPTURE_RESPONSE, default=False): cv.boolean,
            cv.Optional(CONF_ON_SUCCESS): automation.validate_automation(single=True),
@@ -707,6 +828,62 @@ HOMEASSISTANT_ACTION_ACTION_SCHEMA = cv.All(
 )


+def _field_string(value: str) -> Expression:
+    # ESP8266 can only keep a string in flash as its own PROGMEM array
+    literal = cg.RawExpression(cpp_string_escape(value))
+    if CORE.is_esp8266:
+        return cg.shared_progmem_array("ha_field_str", cg.char, literal)
+    return literal
+
+
+async def _new_service_call_action(
+    server_id: ID,
+    action_id: ID,
+    template_arg: cg.TemplateArguments,
+    args: TemplateArgsType,
+    is_event: bool,
+    service: Any,
+    data: dict[str, Any],
+    data_template: dict[str, Any],
+    variables: dict[str, Any],
+) -> MockObj:
+    """Create the action with its name and fields in one shared flash table."""
+    cg.add_define("USE_API_HOMEASSISTANT_SERVICES")
+    serv = await cg.get_variable(server_id)
+    field_type = HomeAssistantField.template(template_arg)
+    groups = [data, data_template, variables]
+    # A lambda may keep static state, so a table with lambdas is never shared
+    has_lambda = cg.is_template(service) or any(
+        cg.is_template(value) for group in groups for value in group.values()
+    )
+
+    async def field(key: str | None, value: Any, output_type: Any = None) -> Expression:
+        key_exp = cg.nullptr if key is None else _field_string(key)
+        if cg.is_template(value):
+            # output_type=None lets lambdas return numbers or char pointers; C++ converts them
+            lam = await cg.process_lambda(value, args, return_type=output_type)
+            return cg.RawExpression(f"{field_type}::from_lambda({key_exp}, {lam})")
+        return cg.ArrayInitializer(key_exp, _field_string(value), cg.nullptr)
+
+    entries = [await field(None, service, cg.std_string)]
+    for group in groups:
+        for key, value in group.items():
+            entries.append(await field(key, value))
+    table = cg.shared_progmem_array(
+        "ha_action_fields",
+        field_type,
+        cg.ArrayInitializer(*entries, multiline=True),
+        share=not has_lambda,
+    )
+    return cg.new_Pvariable(
+        action_id, template_arg, serv, is_event, table, *(len(g) for g in groups)
+    )
+
+
+def _service_call_fields(config: ConfigType) -> tuple[dict[str, Any], ...]:
+    return config[CONF_DATA], config[CONF_DATA_TEMPLATE], config[CONF_VARIABLES]
+
+
 # synchronous=False: when on_success/on_error is configured, play() stores the
 # trigger args until the HomeassistantActionResponse arrives, so non-owning args
 # (StringRef into the API receive buffer) must not be used.
@@ -728,36 +905,15 @@ async def homeassistant_service_to_code(
    template_arg: cg.TemplateArguments,
    args: TemplateArgsType,
 ) -> MockObj:
-    cg.add_define("USE_API_HOMEASSISTANT_SERVICES")
-    serv = await cg.get_variable(config[CONF_ID])
-    var = cg.new_Pvariable(action_id, template_arg, serv, False)
-    templ = await cg.templatable(config[CONF_ACTION], args, cg.std_string)
-    cg.add(var.set_service(templ))
-
-    # Initialize FixedVectors with exact sizes from config
-    cg.add(var.init_data(len(config[CONF_DATA])))
-    for key, value in config[CONF_DATA].items():
-        # output_type=None because lambdas can return non-string types (int,
-        # float, char*) that TemplatableStringValue converts via to_string.
-        # Static strings are manually wrapped for PROGMEM on ESP8266.
-        templ = await cg.templatable(value, args, None)
-        if isinstance(templ, str):
-            templ = cg.FlashStringLiteral(templ)
-        cg.add(var.add_data(cg.FlashStringLiteral(key), templ))
-
-    cg.add(var.init_data_template(len(config[CONF_DATA_TEMPLATE])))
-    for key, value in config[CONF_DATA_TEMPLATE].items():
-        templ = await cg.templatable(value, args, None)
-        if isinstance(templ, str):
-            templ = cg.FlashStringLiteral(templ)
-        cg.add(var.add_data_template(cg.FlashStringLiteral(key), templ))
-
-    cg.add(var.init_variables(len(config[CONF_VARIABLES])))
-    for key, value in config[CONF_VARIABLES].items():
-        templ = await cg.templatable(value, args, None)
-        if isinstance(templ, str):
-            templ = cg.FlashStringLiteral(templ)
-        cg.add(var.add_variable(cg.FlashStringLiteral(key), templ))
+    var = await _new_service_call_action(
+        config[CONF_ID],
+        action_id,
+        template_arg,
+        args,
+        False,
+        config[CONF_ACTION],
+        *_service_call_fields(config),
+    )

    if on_error := config.get(CONF_ON_ERROR):
        cg.add_define("USE_API_HOMEASSISTANT_ACTION_RESPONSES")
@@ -809,9 +965,9 @@ HOMEASSISTANT_EVENT_ACTION_SCHEMA = cv.Schema(
    {
        cv.GenerateID(): cv.use_id(APIServer),
        cv.Required(CONF_EVENT): validate_homeassistant_event,
-        cv.Optional(CONF_DATA, default={}): KEY_VALUE_SCHEMA,
-        cv.Optional(CONF_DATA_TEMPLATE, default={}): KEY_VALUE_SCHEMA,
-        cv.Optional(CONF_VARIABLES, default={}): VARIABLES_SCHEMA,
+        cv.Optional(CONF_DATA, default={}): DATA_FIELDS_SCHEMA,
+        cv.Optional(CONF_DATA_TEMPLATE, default={}): DATA_FIELDS_SCHEMA,
+        cv.Optional(CONF_VARIABLES, default={}): VARIABLES_FIELDS_SCHEMA,
    }
 )

@@ -830,38 +986,15 @@ async def homeassistant_event_to_code(
    template_arg: cg.TemplateArguments,
    args: TemplateArgsType,
 ) -> MockObj:
-    cg.add_define("USE_API_HOMEASSISTANT_SERVICES")
-    serv = await cg.get_variable(config[CONF_ID])
-    var = cg.new_Pvariable(action_id, template_arg, serv, True)
-    templ = await cg.templatable(config[CONF_EVENT], args, cg.std_string)
-    cg.add(var.set_service(templ))
-
-    # Initialize FixedVectors with exact sizes from config
-    cg.add(var.init_data(len(config[CONF_DATA])))
-    for key, value in config[CONF_DATA].items():
-        # output_type=None because lambdas can return non-string types (int,
-        # float, char*) that TemplatableStringValue converts via to_string.
-        # Static strings are manually wrapped for PROGMEM on ESP8266.
-        templ = await cg.templatable(value, args, None)
-        if isinstance(templ, str):
-            templ = cg.FlashStringLiteral(templ)
-        cg.add(var.add_data(cg.FlashStringLiteral(key), templ))
-
-    cg.add(var.init_data_template(len(config[CONF_DATA_TEMPLATE])))
-    for key, value in config[CONF_DATA_TEMPLATE].items():
-        templ = await cg.templatable(value, args, None)
-        if isinstance(templ, str):
-            templ = cg.FlashStringLiteral(templ)
-        cg.add(var.add_data_template(cg.FlashStringLiteral(key), templ))
-
-    cg.add(var.init_variables(len(config[CONF_VARIABLES])))
-    for key, value in config[CONF_VARIABLES].items():
-        templ = await cg.templatable(value, args, None)
-        if isinstance(templ, str):
-            templ = cg.FlashStringLiteral(templ)
-        cg.add(var.add_variable(cg.FlashStringLiteral(key), templ))
-
-    return var
+    return await _new_service_call_action(
+        config[CONF_ID],
+        action_id,
+        template_arg,
+        args,
+        True,
+        config[CONF_EVENT],
+        *_service_call_fields(config),
+    )


 HOMEASSISTANT_TAG_SCANNED_ACTION_SCHEMA = cv.maybe_simple_value(
@@ -885,15 +1018,17 @@ async def homeassistant_tag_scanned_to_code(
    template_arg: cg.TemplateArguments,
    args: TemplateArgsType,
 ) -> MockObj:
-    cg.add_define("USE_API_HOMEASSISTANT_SERVICES")
-    serv = await cg.get_variable(config[CONF_ID])
-    var = cg.new_Pvariable(action_id, template_arg, serv, True)
-    cg.add(var.set_service(cg.FlashStringLiteral("esphome.tag_scanned")))
-    # Initialize FixedVector with exact size (1 data field)
-    cg.add(var.init_data(1))
-    templ = await cg.templatable(config[CONF_TAG], args, cg.std_string)
-    cg.add(var.add_data(cg.FlashStringLiteral("tag_id"), templ))
-    return var
+    return await _new_service_call_action(
+        config[CONF_ID],
+        action_id,
+        template_arg,
+        args,
+        True,
+        "esphome.tag_scanned",
+        {"tag_id": config[CONF_TAG]},
+        {},
+        {},
+    )


 CONF_SUCCESS = "success"
@@ -1004,6 +1139,8 @@ _define_filter = filter_source_files_from_defines(
        "user_services.cpp": "USE_API_USER_DEFINED_ACTIONS",
        "api_frame_helper_noise.cpp": "USE_API_NOISE",
        "api_frame_helper_plaintext.cpp": "USE_API_PLAINTEXT",
+        "api_wizard.cpp": "USE_API_WIZARD",
+        "api_outgoing_connection.cpp": "USE_API_OUTGOING_CONNECTION",
    }
 )

@@ -20,6 +20,8 @@ service APIConnection {
    option (needs_authentication) = false;
  }
  rpc device_capabilities (DeviceCapabilitiesRequest) returns (DeviceCapabilitiesResponse) {}
+  rpc device_wizard (DeviceWizardRequest) returns (DeviceWizardResponse) {}
+  rpc wizard_input_set (WizardInputSetRequest) returns (void) {}
  rpc list_entities (ListEntitiesRequest) returns (void) {}
  rpc subscribe_states (SubscribeStatesRequest) returns (void) {}
  rpc subscribe_logs (SubscribeLogsRequest) returns (void) {}
@@ -76,8 +78,11 @@ service APIConnection {
  rpc serial_proxy_write(SerialProxyWriteRequest) returns (void) {}
  rpc serial_proxy_set_modem_pins(SerialProxySetModemPinsRequest) returns (void) {}
  rpc serial_proxy_get_modem_pins(SerialProxyGetModemPinsRequest) returns (void) {}
+  rpc subscribe_serial_proxy_identity(SubscribeSerialProxyIdentityRequest) returns (void) {}
  rpc serial_proxy_request(SerialProxyRequest) returns (void) {}
  rpc serial_proxy_set_mode(SerialProxySetModeRequest) returns (void) {}
+
+  rpc sendspin_pairing_token(SendspinPairingTokenRequest) returns (SendspinPairingTokenResponse) {}
 }


@@ -113,6 +118,11 @@ message HelloRequest {
  string client_info = 1;
  uint32 api_version_major = 2;
  uint32 api_version_minor = 3;
+
+  // Set by clients that can accept connections the device opens to them
+  // (see api: outgoing_connection:). The device remembers this client's
+  // address as the target to dial when no such client is connected.
+  bool outgoing_connection_target = 4 [(field_ifdef) = "USE_API_OUTGOING_CONNECTION"];
 }

 // Confirmation of successful connection request.
@@ -228,6 +238,7 @@ enum SerialProxyPortType {
  SERIAL_PROXY_PORT_TYPE_TTL = 0;
  SERIAL_PROXY_PORT_TYPE_RS232 = 1;
  SERIAL_PROXY_PORT_TYPE_RS485 = 2;
+  SERIAL_PROXY_PORT_TYPE_USB_SERIAL = 3;  // since API 1.18
 }

 message SerialProxyInfo {
@@ -332,6 +343,10 @@ message DeviceInfoResponse {
  // all-zeros PSK, so the api encryption key can be provisioned without being
  // sent in plaintext (protects against passive sniffing, not active MITM)
  bool api_encryption_provisionable = 26 [(field_ifdef) = "USE_API_NOISE"];
+
+  // Device is built with the api outgoing_connection option and can open
+  // the TCP connection to a dial-back target itself
+  bool api_outgoing_connection_supported = 27 [(field_ifdef) = "USE_API_OUTGOING_CONNECTION"];
 }

 // ==================== DEVICE CAPABILITIES ====================
@@ -380,6 +395,16 @@ message ZWaveProxyCapabilities {
  uint32 home_id = 2;
 }

+message WizardCapabilities {
+  // True when the device has a wizard configured, so DeviceWizardRequest will be answered
+  bool configured = 1;
+}
+
+message SendspinCapabilities {
+  // Bitmask of the Sendspin features this device supports
+  uint32 feature_flags = 1;
+}
+
 message DeviceCapabilitiesResponse {
  option (id) = 150;
  option (source) = SOURCE_SERVER;
@@ -389,6 +414,89 @@ message DeviceCapabilitiesResponse {
  ZWaveProxyCapabilities zwave_proxy = 3 [(field_ifdef) = "USE_ZWAVE_PROXY"];
  repeated SerialProxyInfo serial_proxies = 4
      [(field_ifdef) = "USE_SERIAL_PROXY", (fixed_array_size_define) = "SERIAL_PROXY_COUNT"];
+  WizardCapabilities wizard = 5 [(field_ifdef) = "USE_API_WIZARD"];
+  SendspinCapabilities sendspin = 6 [(field_ifdef) = "USE_SENDSPIN"];
+}
+
+// ==================== DEVICE WIZARD ====================
+
+// Asks the device for the onboarding wizard that Home Assistant presents when the
+// device is added.
+//
+// The wizard is read once, when the device is added, whereas capabilities are read
+// on every connect, so it is a separate message rather than part of
+// DeviceCapabilitiesResponse. It is only served on an authenticated connection.
+//
+// A device without a wizard does not have this message at all and never answers it,
+// as a device ignores messages it does not know. Clients therefore check
+// DeviceCapabilitiesResponse.wizard.configured before sending it.
+message DeviceWizardRequest {
+  option (id) = 156;
+  option (source) = SOURCE_CLIENT;
+  option (ifdef) = "USE_API_WIZARD";
+  // Empty
+}
+
+// The wizard, as UTF-8 JSON compressed into a single zstd frame. The device builds it
+// when it is compiled and sends it unchanged, so its size varies with the wizard and
+// its format can grow without new fields here. Clients decompress it, then read:
+//
+//   {"version": 1,
+//    "pages": [{"title": "...", "description": "...",
+//      "entities": [{"key": 123, "device_id": 456, "description": "..."}],
+//      "inputs": [{"key": 789, "description": "...",
+//        "entity_filters": [{"integration": "...", "domain": ["..."],
+//                            "device_class": ["..."], "supported_features": ["..."]}]}]}]}
+//
+// Values that are empty or unset are left out, and so are empty lists. Strings may be
+// Home Assistant translation placeholders such as "[%key:component::domain::name%]",
+// passed through verbatim. The pages are shown in the order listed. A client that does
+// not know the version must not use the wizard.
+//
+// An entity is an entity of this device that the page shows to the user (for example to
+// turn it on or off). Its key is the key ListEntitiesResponse sends for it. Its
+// device_id is the device_id ListEntitiesResponse sends, and is left out when that is 0.
+//
+// An input is filled in by the user with the id of a Home Assistant entity. It either
+// stands for one entity of the device's homeassistant platform (sensor, binary_sensor,
+// text_sensor, number, switch, text, select or button) that sets no entity_id of its own,
+// as Home Assistant supplies it, or it is a standalone input that only stores the entity
+// id for the device's own automations. Its key is the FNV-1 hash
+// of the input's ESPHome id, not an entity key. The client sends the chosen entity id to
+// the device with a WizardInputSetRequest. entity_filters says which Home Assistant
+// entities the user may choose, and mirrors Home Assistant's EntityFilterSelectorConfig:
+// an entity matches a filter when it satisfies every field that is set, and an entity
+// that matches any one of the filters is accepted.
+//
+// The device keeps the entity id of an input in RAM only and does not store it across
+// restarts. The client therefore stores the choice itself and, after every connection
+// and before it sends SubscribeHomeAssistantStatesRequest, sends a WizardInputSetRequest
+// for each input. It sends one again whenever the user changes the choice.
+message DeviceWizardResponse {
+  option (id) = 157;
+  option (source) = SOURCE_SERVER;
+  option (ifdef) = "USE_API_WIZARD";
+
+  // The data is in flash, and the device sends it from there
+  bytes data = 1 [(pointer_to_buffer) = true, (progmem) = true];
+}
+
+// Sets the entity id of a wizard input (see WizardInputField.key). Clients send
+// this only when DeviceCapabilitiesResponse.wizard.configured is set. There is no
+// reply. The device ignores a request whose key matches no input or whose entity_id
+// is empty, longer than 255 bytes or has no '.'. Otherwise it keeps the id in RAM,
+// not across restarts, and when the input belongs to a homeassistant platform entity
+// it subscribes to that entity's state. Clients send this for every input right
+// after connecting, before SubscribeHomeAssistantStatesRequest. A request that
+// arrives later still works: the device then sends the affected state subscriptions
+// again.
+message WizardInputSetRequest {
+  option (id) = 158;
+  option (source) = SOURCE_CLIENT;
+  option (ifdef) = "USE_API_WIZARD_INPUTS";
+
+  fixed32 key = 1;
+  string entity_id = 2 [(max_data_length) = 255];
 }

 message ListEntitiesRequest {
@@ -1439,7 +1547,7 @@ message ListEntitiesSelectResponse {
  reserved 4; // Deprecated: was string unique_id

  string icon = 5 [(field_ifdef) = "USE_ENTITY_ICON", (max_data_length) = 63];
-  repeated string options = 6 [(container_pointer_no_template) = "FixedVector<const char *>"];
+  repeated string options = 6 [(container_pointer_no_template) = "std::span<const char *const>"];
  bool disabled_by_default = 7;
  EntityCategory entity_category = 8;
  uint32 device_id = 9 [(field_ifdef) = "USE_DEVICES"];
@@ -2683,7 +2791,7 @@ message ListEntitiesInfraredResponse {
 message InfraredRFTransmitRawTimingsRequest {
  option (id) = 136;
  option (source) = SOURCE_CLIENT;
-  option (ifdef) = "USE_IR_RF || USE_RADIO_FREQUENCY";
+  option (ifdef) = "USE_IR_RF";

  uint32 device_id = 1 [(field_ifdef) = "USE_DEVICES"];
  fixed32 key = 2 [(force) = true];     // Key identifying the transmitter instance
@@ -2697,7 +2805,7 @@ message InfraredRFTransmitRawTimingsRequest {
 message InfraredRFReceiveEvent {
  option (id) = 137;
  option (source) = SOURCE_SERVER;
-  option (ifdef) = "USE_IR_RF || USE_RADIO_FREQUENCY";
+  option (ifdef) = "USE_IR_RF";
  option (no_delay) = true;
  option (speed_optimized) = true;

@@ -2706,6 +2814,28 @@ message InfraredRFReceiveEvent {
  repeated sint32 timings = 3 [packed = true, (container_pointer_no_template) = "std::vector<int32_t>"];  // Raw timings in microseconds (zigzag-encoded): alternating mark/space periods
 }

+// Sent only to the client that issued an InfraredRFTransmitRawTimingsRequest, once the
+// transmitter reports that the transmission (all repeats) has finished, or immediately with
+// success=false if it was refused before reaching the transmitter (unknown key, no transmitter,
+// no or invalid timings) or the transmitter could not send it (not set up, hardware error).
+// success=false also answers a request superseded by a newer request on the same entity, from
+// any client, and a transmit that reported nothing within 30 s past its expected air time, so a
+// client should not retry on it blindly. The device serializes transmits per transmitter and
+// several entities may share one, so a client should keep at most one transmit outstanding per
+// device, not per entity. A reply for an unknown key or a refused request is sent once and can be lost
+// when the device's send buffer is full, so a client should also stop waiting on its own after the
+// expected air time plus a margin. Lets clients pace requests instead of estimating durations (since API 1.18)
+message InfraredRFTransmitCompleteResponse {
+  option (id) = 153;
+  option (source) = SOURCE_SERVER;
+  option (ifdef) = "USE_IR_RF";
+  option (no_delay) = true;
+
+  uint32 device_id = 1 [(field_ifdef) = "USE_DEVICES"];
+  fixed32 key = 2 [(force) = true];  // Key of the transmitter entity from the request
+  bool success = 3;                  // false if the request was refused, not sent, superseded, or never reported
+}
+
 // ==================== RADIO FREQUENCY ====================

 // Lists available radio frequency entity instances
@@ -2876,6 +3006,56 @@ message SerialProxySetModeRequest {
  SerialProxyMode mode = 2;
 }

+// Subscribe to the identity of every serial proxy port. The device answers with one
+// SerialProxyIdentity per port, then sends another whenever a port's identity changes,
+// for the life of the connection (since API 1.18).
+message SubscribeSerialProxyIdentityRequest {
+  option (id) = 154;
+  option (source) = SOURCE_CLIENT;
+  option (ifdef) = "USE_SERIAL_PROXY";
+}
+
+// Where a port's identity comes from
+enum SerialProxyIdentitySource {
+  SERIAL_PROXY_IDENTITY_SOURCE_NONE = 0;        // The port carries no identity
+  SERIAL_PROXY_IDENTITY_SOURCE_CONFIGURED = 1;  // Reserved for identities stated in the device configuration; not sent yet
+  SERIAL_PROXY_IDENTITY_SOURCE_USB = 2;         // Read from the descriptors of the USB device behind the port;
+                                                // changes when a device is attached or removed
+}
+
+enum SerialProxyIdentityFlag {
+  SERIAL_PROXY_IDENTITY_FLAG_NONE = 0;
+  SERIAL_PROXY_IDENTITY_FLAG_CONNECTED = 1;  // The backend believes the device is present and usable on this port
+  SERIAL_PROXY_IDENTITY_FLAG_ERROR = 2;      // The USB host stack refused the descriptor query; the strings and
+                                             // IDs below are empty
+}
+
+// The descriptor fields of a USB device as seen by the host stack
+message UsbDeviceDescriptor {
+  uint32 vendor_id = 1;
+  uint32 product_id = 2;
+  uint32 bcd_device = 3;
+  uint32 interface_number = 4;   // bInterfaceNumber the host driver binds to
+}
+
+// The identity of the device behind a port. Identifies one physical device among others of
+// the same kind, so a client matches on manufacturer and product regardless of source. The
+// strings are empty for source NONE, and for source USB while nothing is connected
+// (since API 1.18).
+message SerialProxyIdentity {
+  option (id) = 155;
+  option (source) = SOURCE_SERVER;
+  option (ifdef) = "USE_SERIAL_PROXY";
+
+  uint32 instance = 1;
+  SerialProxyIdentitySource source = 2;
+  uint32 flags = 3;               // Bitmask of SerialProxyIdentityFlag
+  string manufacturer = 4;
+  string product = 5;
+  string serial_number = 6;
+  UsbDeviceDescriptor usb = 7;    // Only sent for source USB
+}
+
 // ==================== BLUETOOTH CONNECTION PARAMS ====================
 message BluetoothSetConnectionParamsRequest {
  option (id) = 145;
@@ -2897,3 +3077,34 @@ message BluetoothSetConnectionParamsResponse {
  uint64 address = 1;
  int32 error = 2;
 }
+
+// ==================== SENDSPIN ====================
+enum SendspinPairingTokenStatus {
+  // The Sendspin client has not started yet, so the token does not exist yet. Ask again later.
+  SENDSPIN_PAIRING_TOKEN_STATUS_NOT_READY = 0;
+  SENDSPIN_PAIRING_TOKEN_STATUS_OK = 1;
+  // The device has no API encryption key, so it will not send the token. Ask again once a key is set.
+  SENDSPIN_PAIRING_TOKEN_STATUS_ENCRYPTION_REQUIRED = 2;
+  // Sendspin is turned off and has not started since boot, so the token does not exist yet.
+  SENDSPIN_PAIRING_TOKEN_STATUS_DISABLED = 3;
+  // The Sendspin client failed to start, and will not start until the device reboots.
+  SENDSPIN_PAIRING_TOKEN_STATUS_FAILED = 4;
+}
+
+// Requests the Sendspin pairing token, which a Sendspin server uses to pair with this device
+message SendspinPairingTokenRequest {
+  option (id) = 159;
+  option (source) = SOURCE_CLIENT;
+  option (ifdef) = "USE_SENDSPIN";
+  // Empty
+}
+
+message SendspinPairingTokenResponse {
+  option (id) = 160;
+  option (source) = SOURCE_SERVER;
+  option (ifdef) = "USE_SENDSPIN";
+
+  SendspinPairingTokenStatus status = 1;
+  // The pairing token (Sendspin pairing.md "Pairing Token"). Set only when status is OK.
+  string token = 2 [(max_data_length) = 127];
+}
@@ -48,6 +48,9 @@
 #ifdef USE_ZWAVE_PROXY
 #include "esphome/components/zwave_proxy/zwave_proxy.h"
 #endif
+#if defined(USE_SENDSPIN) && defined(USE_ESP_IDF)
+#include "esphome/components/sendspin/sendspin_hub.h"
+#endif
 #ifdef USE_WATER_HEATER
 #include "esphome/components/water_heater/water_heater.h"
 #endif
@@ -88,7 +91,7 @@ static_assert(sizeof(ESPHOME_VERSION) - 1 <= 32, "Update max_data_length for esp
 static_assert(ESPHOME_DEVICE_NAME_MAX_LEN <= 31, "Update max_data_length for name in api.proto");
 static_assert(ESPHOME_FRIENDLY_NAME_MAX_LEN <= 120, "Update max_data_length for friendly_name in api.proto");

-static const char *const TAG = "api.connection";
+ESPHOME_LOG_TAG(TAG, "api.connection");

 #if ESPHOME_LOG_LEVEL >= ESPHOME_LOG_LEVEL_WARN
 void log_dropped_message(const char *tag, int line, const LogString *what) {
@@ -198,6 +201,17 @@ APIConnection::~APIConnection() {
      proxy->serial_proxy_request(this, enums::SERIAL_PROXY_REQUEST_TYPE_UNSUBSCRIBE);
    }
  }
+#endif
+  // entities holding a transmit reply for this client must not answer into a freed connection
+#ifdef USE_INFRARED
+  for (auto *infrared : App.get_infrareds()) {
+    infrared->on_api_connection_closed(this);
+  }
+#endif
+#ifdef USE_RADIO_FREQUENCY
+  for (auto *radio_frequency : App.get_radio_frequencies()) {
+    radio_frequency->on_api_connection_closed(this);
+  }
 #endif
 }

@@ -990,7 +1004,9 @@ uint16_t APIConnection::try_send_select_state(EntityBase *entity, APIConnection
 uint16_t APIConnection::try_send_select_info(EntityBase *entity, APIConnection *conn, uint32_t remaining_size) {
  auto *select = static_cast<select::Select *>(entity);
  ListEntitiesSelectResponse msg;
-  msg.options = &select->traits.get_options();
+  const auto &opts = select->traits.get_options();
+  const std::span<const char *const> options(opts.data(), opts.size());
+  msg.options = &options;
  return fill_and_encode_entity_info(select, msg, conn, remaining_size);
 }
 void APIConnection::on_select_command_request(const SelectCommandRequest &msg) {
@@ -1389,6 +1405,40 @@ void APIConnection::on_z_wave_proxy_request(const ZWaveProxyRequest &msg) {
 }
 #endif

+#if defined(USE_SENDSPIN) && defined(USE_ESP_IDF)
+bool APIConnection::send_sendspin_pairing_token_response_() {
+  SendspinPairingTokenResponse resp;
+#ifdef USE_API_NOISE
+  // has_psk() stands in for "this session proved the key": with a key active, plaintext and zero-key sessions
+  // never reach hello, and activating a key closes every session opened before it.
+  if (!this->parent_->get_noise_ctx().has_psk()) {
+    resp.status = enums::SENDSPIN_PAIRING_TOKEN_STATUS_ENCRYPTION_REQUIRED;
+    return this->send_message(resp);
+  }
+  auto token = sendspin_::global_sendspin_hub->get_pairing_token();
+  if (token.has_value()) {
+    resp.status = enums::SENDSPIN_PAIRING_TOKEN_STATUS_OK;
+    resp.token = StringRef(*token);
+  } else if (sendspin_::global_sendspin_hub->status_has_error()) {
+    resp.status = enums::SENDSPIN_PAIRING_TOKEN_STATUS_FAILED;
+  } else if (sendspin_::global_sendspin_hub->is_disabled()) {
+    resp.status = enums::SENDSPIN_PAIRING_TOKEN_STATUS_DISABLED;
+  } else {
+    resp.status = enums::SENDSPIN_PAIRING_TOKEN_STATUS_NOT_READY;
+  }
+#else
+  resp.status = enums::SENDSPIN_PAIRING_TOKEN_STATUS_ENCRYPTION_REQUIRED;
+#endif
+  return this->send_message(resp);
+}
+
+void APIConnection::on_sendspin_pairing_token_request() {
+  if (!this->send_sendspin_pairing_token_response_()) {
+    this->on_fatal_error();
+  }
+}
+#endif
+
 #ifdef USE_ALARM_CONTROL_PANEL
 bool APIConnection::send_alarm_control_panel_state(alarm_control_panel::AlarmControlPanel *a_alarm_control_panel) {
  return this->send_message_smart_(a_alarm_control_panel, AlarmControlPanelStateResponse::MESSAGE_TYPE,
@@ -1515,8 +1565,10 @@ uint16_t APIConnection::try_send_event_info(EntityBase *entity, APIConnection *c
 }
 #endif

-#if defined(USE_IR_RF) || defined(USE_RADIO_FREQUENCY)
+#ifdef USE_IR_RF
 void APIConnection::on_infrared_rf_transmit_raw_timings_request(const InfraredRFTransmitRawTimingsRequest &msg) {
+  // Clients on API 1.18+ are told when the frame has left the transmitter; the entity owns that reply
+  const bool want_reply = this->client_supports_api_version(1, 18);
  // Dispatch by key: infrared entities are checked first, then radio frequency entities.
  // The key is unique across all entity instances on a device, so at most one lookup will succeed.
 #ifdef USE_INFRARED
@@ -1526,6 +1578,7 @@ void APIConnection::on_infrared_rf_transmit_raw_timings_request(const InfraredRF
    call.set_carrier_frequency(msg.carrier_frequency);
    call.set_raw_timings_packed(msg.timings_data_, msg.timings_length_, msg.timings_count_);
    call.set_repeat_count(msg.repeat_count);
+    call.set_api_connection(want_reply ? this : nullptr);
    call.perform();
    return;
  }
@@ -1538,13 +1591,38 @@ void APIConnection::on_infrared_rf_transmit_raw_timings_request(const InfraredRF
    call.set_modulation(static_cast<radio_frequency::RadioFrequencyModulation>(msg.modulation));
    call.set_repeat_count(msg.repeat_count);
    call.set_raw_timings_packed(msg.timings_data_, msg.timings_length_, msg.timings_count_);
+    call.set_api_connection(want_reply ? this : nullptr);
    call.perform();
+    return;
  }
 #endif
+  ESP_LOGW(TAG, "IR/RF transmit for unknown key %" PRIu32, msg.key);
+  if (want_reply) {
+    // nothing will ever report for an unknown key, so answer as not started right away
+#ifdef USE_DEVICES
+    const uint32_t device_id = msg.device_id;
+#else
+    const uint32_t device_id = 0;
+#endif
+    if (!this->send_infrared_rf_transmit_complete(device_id, msg.key, false)) {
+      API_LOG_MSG_DROPPED(TAG, "IR/RF reply");
+    }
+  }
+}
+
+bool APIConnection::send_infrared_rf_transmit_complete([[maybe_unused]] uint32_t device_id, uint32_t key,
+                                                       bool success) {
+  InfraredRFTransmitCompleteResponse resp{};
+#ifdef USE_DEVICES
+  resp.device_id = device_id;
+#endif
+  resp.key = key;
+  resp.success = success;
+  return this->send_message(resp);
 }
 #endif

-#if defined(USE_IR_RF) || defined(USE_RADIO_FREQUENCY)
+#ifdef USE_IR_RF
 void APIConnection::send_infrared_rf_receive_event(const InfraredRFReceiveEvent &msg) {
  if (!this->send_message(msg)) {
    // V: fires per decoded frame with no subscription gate, so a warning
@@ -1552,6 +1630,7 @@ void APIConnection::send_infrared_rf_receive_event(const InfraredRFReceiveEvent
    ESP_LOGV(TAG, "IR/RF event dropped, TCP buffer full");
  }
 }
+
 #endif

 #ifdef USE_SERIAL_PROXY
@@ -1643,6 +1722,22 @@ void APIConnection::on_serial_proxy_get_modem_pins_request(const SerialProxyGetM
  }
 }

+void APIConnection::on_subscribe_serial_proxy_identity_request() {
+#ifdef USE_SERIAL_PROXY_USB_IDENTITY
+  // Only USB ports change identity after this snapshot
+  this->flags_.serial_proxy_identity_subscription = true;
+#endif
+  for (auto *proxy : App.get_serial_proxies()) {
+    proxy->send_identity(this);
+  }
+}
+
+void APIConnection::send_serial_proxy_identity(const SerialProxyIdentity &msg) {
+  if (!this->send_message(msg)) {
+    API_LOG_MSG_DROPPED(TAG, "Serial proxy identity");
+  }
+}
+
 void APIConnection::on_serial_proxy_request(const SerialProxyRequest &msg) {
  auto &proxies = App.get_serial_proxies();
  if (msg.instance >= proxies.size()) {
@@ -1814,7 +1909,7 @@ bool APIConnection::send_hello_response_(const HelloRequest &msg) {

  HelloResponse resp;
  resp.api_version_major = 1;
-  resp.api_version_minor = 17;
+  resp.api_version_minor = 19;
  // Send only the version string - the client only logs this for debugging and doesn't use it otherwise
  resp.server_info = ESPHOME_VERSION_REF;
  resp.name = StringRef(App.get_name());
@@ -1837,6 +1932,19 @@ bool APIConnection::send_hello_response_(const HelloRequest &msg) {
  // Auto-authenticate - password auth was removed in ESPHome 2026.1.0
  this->complete_authentication_();

+#ifdef USE_API_OUTGOING_CONNECTION
+  // With a PSK set only key-verified transports reach hello: plaintext and
+  // zero-PSK are rejected, and pre-activation sessions are force-closed
+  if (msg.outgoing_connection_target && !this->flags_.outgoing_connection_target) {
+    if (this->parent_->get_noise_ctx().has_psk()) {
+      this->flags_.outgoing_connection_target = true;
+      this->parent_->on_outgoing_target_client(this);
+    } else {
+      this->log_client_(ESPHOME_LOG_LEVEL_WARN, LOG_STR("Dial-back target refused; no key active"));
+    }
+  }
+#endif
+
  return this->send_message(resp);
 }

@@ -1959,6 +2067,9 @@ bool APIConnection::send_device_info_response_() {
  // one) so this advertisement survives the plaintext removal in 2027.2.0.
  resp.api_encryption_provisionable = !this->parent_->get_noise_ctx().has_psk();
 #endif
+#ifdef USE_API_OUTGOING_CONNECTION
+  resp.api_outgoing_connection_supported = true;
+#endif
 #endif
 #ifdef USE_DEVICES
  size_t device_index = 0;
@@ -2011,6 +2122,12 @@ bool APIConnection::send_device_capabilities_response_() {
    info.port_type = proxy->get_port_type();
    info.configured_line_states = proxy->get_configured_modem_pins();
  }
+#endif
+#ifdef USE_API_WIZARD
+  resp.wizard.configured = true;
+#endif
+#if defined(USE_SENDSPIN) && defined(USE_ESP_IDF)
+  resp.sendspin.feature_flags = sendspin_::global_sendspin_hub->get_feature_flags();
 #endif
  return this->send_message(resp);
 }
@@ -2225,7 +2342,13 @@ void APIConnection::on_noise_encryption_set_key_request(const NoiseEncryptionSet
 }
 #endif
 #ifdef USE_API_HOMEASSISTANT_STATES
-void APIConnection::on_subscribe_home_assistant_states_request() { state_subs_at_ = 0; }
+void APIConnection::on_subscribe_home_assistant_states_request() {
+#ifdef USE_API_WIZARD_LINKED_INPUTS
+  // Remember it, as a client that subscribed also gets the subscriptions again when a wizard input is set
+  this->flags_.home_assistant_states = true;
+#endif
+  state_subs_at_ = 0;
+}
 #endif
 bool APIConnection::try_to_clear_buffer_slow_(bool log_out_of_space) {
  delay(0);
@@ -2269,8 +2392,7 @@ bool APIConnection::send_message_(uint32_t payload_size, uint16_t message_type,
 #endif
  // Capacity reserved above, cannot fail
  (void) shared_buf.resize(write_start + payload_size);
-  ProtoWriteBuffer buffer{&shared_buf, write_start};
-  uint8_t *end = encode_fn(msg, buffer PROTO_ENCODE_DEBUG_INIT(&shared_buf));
+  uint8_t *end = encode_fn(msg, shared_buf.data() + write_start PROTO_ENCODE_DEBUG_INIT(&shared_buf));
 #ifdef ESPHOME_DEBUG_API
  proto_check_encode_end(end, shared_buf.data() + shared_buf.size());
 #else
@@ -2668,6 +2790,13 @@ void APIConnection::process_state_subscriptions_() {
  }

  const auto &it = subs[this->state_subs_at_];
+#ifdef USE_API_WIZARD_LINKED_INPUTS
+  // An entity id that is not set yet (a wizard input) has nothing to subscribe to; it is sent once it is set
+  if (it.entity_id[0] == '\0') {
+    this->state_subs_at_++;
+    return;
+  }
+#endif
  SubscribeHomeAssistantStateResponse resp;
  resp.entity_id = StringRef(it.entity_id);

@@ -223,6 +223,10 @@ class APIConnection final : public APIServerConnectionBase {
  void on_z_wave_proxy_request(const ZWaveProxyRequest &msg);
 #endif

+#if defined(USE_SENDSPIN) && defined(USE_ESP_IDF)
+  void on_sendspin_pairing_token_request();
+#endif
+
 #ifdef USE_ALARM_CONTROL_PANEL
  bool send_alarm_control_panel_state(alarm_control_panel::AlarmControlPanel *a_alarm_control_panel);
  void on_alarm_control_panel_command_request(const AlarmControlPanelCommandRequest &msg);
@@ -233,9 +237,12 @@ class APIConnection final : public APIServerConnectionBase {
  void on_water_heater_command_request(const WaterHeaterCommandRequest &msg);
 #endif

-#if defined(USE_IR_RF) || defined(USE_RADIO_FREQUENCY)
+#ifdef USE_IR_RF
  void on_infrared_rf_transmit_raw_timings_request(const InfraredRFTransmitRawTimingsRequest &msg);
  void send_infrared_rf_receive_event(const InfraredRFReceiveEvent &msg);
+  // Reply to an InfraredRFTransmitRawTimingsRequest (API 1.18+); false when the TCP buffer is
+  // full, the entity that owns the reply retries it then
+  [[nodiscard]] bool send_infrared_rf_transmit_complete(uint32_t device_id, uint32_t key, bool success);
 #endif

 #ifdef USE_SERIAL_PROXY
@@ -243,6 +250,9 @@ class APIConnection final : public APIServerConnectionBase {
  void on_serial_proxy_write_request(const SerialProxyWriteRequest &msg);
  void on_serial_proxy_set_modem_pins_request(const SerialProxySetModemPinsRequest &msg);
  void on_serial_proxy_get_modem_pins_request(const SerialProxyGetModemPinsRequest &msg);
+  void on_subscribe_serial_proxy_identity_request();
+  /// Send a port identity to this client
+  void send_serial_proxy_identity(const SerialProxyIdentity &msg);
  void on_serial_proxy_request(const SerialProxyRequest &msg);
  void on_serial_proxy_set_mode_request(const SerialProxySetModeRequest &msg);
  void send_serial_proxy_data(const SerialProxyDataReceived &msg);
@@ -273,6 +283,12 @@ class APIConnection final : public APIServerConnectionBase {
  void on_ping_request();
  void on_device_info_request();
  void on_device_capabilities_request();
+#ifdef USE_API_WIZARD
+  void on_device_wizard_request();
+#endif
+#ifdef USE_API_WIZARD_INPUTS
+  void on_wizard_input_set_request(const WizardInputSetRequest &msg);
+#endif
  void on_list_entities_request() { this->begin_iterator_(ActiveIterator::LIST_ENTITIES); }
  void on_subscribe_states_request() {
    this->flags_.state_subscription = true;
@@ -302,6 +318,10 @@ class APIConnection final : public APIServerConnectionBase {
 #endif
 #ifdef USE_API_HOMEASSISTANT_STATES
  void on_subscribe_home_assistant_states_request();
+#ifdef USE_API_WIZARD_LINKED_INPUTS
+  /// Tell this client about the subscriptions whose entity id is stored in the given buffer, as the buffer changed
+  void resend_state_subscriptions(const char *entity_id);
+#endif
 #endif
 #ifdef USE_API_USER_DEFINED_ACTIONS
  void on_execute_service_request(const ExecuteServiceRequest &msg);
@@ -345,7 +365,7 @@ class APIConnection final : public APIServerConnectionBase {
  void on_no_setup_connection();

  // Function pointer type for type-erased message encoding
-  using MessageEncodeFn = uint8_t *(*) (const void *, ProtoWriteBuffer &PROTO_ENCODE_DEBUG_PARAM);
+  using MessageEncodeFn = ProtoEncodeFn;
  // Function pointer type for type-erased size calculation
  using CalculateSizeFn = uint32_t (*)(const void *);

@@ -378,6 +398,23 @@ class APIConnection final : public APIServerConnectionBase {
    return this->helper_->get_peername_to(buf);
  }

+#ifdef USE_API_OUTGOING_CONNECTION
+  /// Get the peer address itself, for remembering a dial-back target
+  int getpeername(struct sockaddr *addr, socklen_t *addrlen) const { return this->helper_->getpeername(addr, addrlen); }
+  /// Outgoing connection: send our server hello immediately so the peer can
+  /// pick the matching key. Outgoing connections are only dialed when a PSK
+  /// is set, so the helper is always the noise helper. Call after start().
+  void mark_outgoing() {
+    if (this->flags_.remove) {
+      return;  // start() failed; the connection is already being torn down
+    }
+    APIError err = static_cast<APINoiseFrameHelper *>(this->helper_.get())->send_server_hello_first();
+    if (err != APIError::OK) {
+      this->fatal_error_with_log_(LOG_STR("Server hello failed"), err);
+    }
+  }
+#endif
+
 protected:
  bool try_to_clear_buffer_slow_(bool log_out_of_space);

@@ -399,6 +436,9 @@ class APIConnection final : public APIServerConnectionBase {
 #ifdef USE_VOICE_ASSISTANT
  bool send_voice_assistant_get_configuration_response_(const VoiceAssistantConfigurationRequest &msg);
 #endif
+#if defined(USE_SENDSPIN) && defined(USE_ESP_IDF)
+  bool send_sendspin_pairing_token_response_();
+#endif

 #ifdef USE_CAMERA
  void try_send_camera_image_();
@@ -734,12 +774,21 @@ class APIConnection final : public APIServerConnectionBase {
    uint8_t batch_first_message : 1;          // For batch buffer allocation
    uint8_t should_try_send_immediately : 1;  // True after initial states are sent
    uint8_t may_have_remaining_data : 1;      // Read loop hit limit, retry without ready check
+#ifdef USE_API_WIZARD_LINKED_INPUTS
+    uint8_t home_assistant_states : 1;  // Client subscribed to Home Assistant states
+#endif
+#ifdef USE_API_OUTGOING_CONNECTION
+    uint8_t outgoing_connection_target : 1;  // Client declared itself a dial-back target in its hello
+#endif
 #ifdef HAS_PROTO_MESSAGE_DUMP
    uint8_t log_only_mode : 1;
 #endif
-  } flags_{};  // 2 bytes total
+#ifdef USE_SERIAL_PROXY_USB_IDENTITY
+    uint8_t serial_proxy_identity_subscription : 1;
+#endif
+  } flags_{};  // 2 bytes; 3 with HAS_PROTO_MESSAGE_DUMP + USE_API_OUTGOING_CONNECTION + USE_SERIAL_PROXY_USB_IDENTITY

-  // 2-byte type immediately after flags_ (no padding between them)
+  // 2-byte type immediately after flags_ (one padding byte when flags_ is 3 bytes)
  uint16_t batch_message_type_{0};  // Current message type during batch encoding
  // 1-byte types to fill remaining space before next 4-byte boundary
  // Client API versions are clamped to 255 on receive (see send_hello_response_)
--- a/Show More
+++ b/Show More