Mark stub-only private symbols as @type_check_only in third-party stubs (#14545)

stubs/paramiko/paramiko/agent.pyi

@@ -4,13 +4,14 @@ from collections.abc import Mapping
 from logging import _ExcInfoType
 from socket import _RetAddress, socket
 from threading import Thread
-from typing import Final, Protocol
+from typing import Final, Protocol, type_check_only
 
 from paramiko.channel import Channel
 from paramiko.message import Message, _LikeBytes
 from paramiko.pkey import PKey
 from paramiko.transport import Transport
 
+@type_check_only
 class _AgentProxy(Protocol):
     def connect(self) -> None: ...
     def close(self) -> None: ...

stubs/paramiko/paramiko/client.pyi

@@ -1,6 +1,6 @@
 from _typeshed import FileDescriptorOrPath
 from collections.abc import Iterable, Mapping
-from typing import NoReturn, Protocol
+from typing import NoReturn, Protocol, type_check_only
 
 from paramiko.auth_strategy import AuthStrategy
 from paramiko.channel import Channel, ChannelFile, ChannelStderrFile, ChannelStdinFile
@@ -10,6 +10,7 @@ from paramiko.sftp_client import SFTPClient
 from paramiko.transport import Transport, _SocketLike
 from paramiko.util import ClosingContextManager
 
+@type_check_only
 class _TransportFactory(Protocol):
     def __call__(
         self,

stubs/paramiko/paramiko/hostkeys.pyi

@@ -1,11 +1,13 @@
 from _typeshed import FileDescriptorOrPath
 from collections.abc import Iterator, Mapping, MutableMapping
+from typing import type_check_only
 from typing_extensions import Self
 
 from paramiko.pkey import PKey
 
+# Internal to HostKeys.lookup(). Calls itself "SubDict".
+@type_check_only
 class _SubDict(MutableMapping[str, PKey]):
-    # Internal to HostKeys.lookup()
     def __init__(self, hostname: str, entries: list[HostKeyEntry], hostkeys: HostKeys) -> None: ...
     def __iter__(self) -> Iterator[str]: ...
     def __len__(self) -> int: ...

stubs/paramiko/paramiko/message.pyi

@@ -1,9 +1,10 @@
 from _typeshed import ReadableBuffer
 from collections.abc import Iterable
 from io import BytesIO
-from typing import Any, Protocol
+from typing import Any, Protocol, type_check_only
 from typing_extensions import TypeAlias
 
+@type_check_only
 class _SupportsAsBytes(Protocol):
     def asbytes(self) -> bytes: ...
 

stubs/paramiko/paramiko/pipe.pyi

@@ -1,9 +1,11 @@
-from typing import Protocol
+from typing import Protocol, type_check_only
 
+@type_check_only
 class _BasePipe(Protocol):
     def clear(self) -> None: ...
     def set(self) -> None: ...
 
+@type_check_only
 class _Pipe(_BasePipe, Protocol):
     def close(self) -> None: ...
     def fileno(self) -> int: ...

stubs/paramiko/paramiko/transport.pyi

@@ -4,7 +4,7 @@ from logging import Logger
 from socket import socket
 from threading import Condition, Event, Lock, Thread
 from types import ModuleType
-from typing import Any, Protocol
+from typing import Any, Protocol, type_check_only
 from typing_extensions import TypeAlias
 
 from paramiko.auth_handler import AuthHandler, AuthOnlyHandler, _InteractiveCallback
@@ -21,6 +21,7 @@ from paramiko.util import ClosingContextManager
 _Addr: TypeAlias = tuple[str, int]
 _SocketLike: TypeAlias = str | _Addr | socket | Channel | ProxyCommand
 
+@type_check_only
 class _KexEngine(Protocol):
     def start_kex(self) -> None: ...
     def parse_next(self, ptype: int, m: Message) -> None: ...