We can actually enable mypy --strict for this module now :)

Typing decorators correctly is notoriously hard and you need some pretty advanced concepts, but this does the trick. I have checked and both pyright and mypy consider this to be the correct type for all call sites to guarded.
The rest is pretty straightforward. The changes outside of the module are because mypy --strict doesn't allow calls to untyped functions, which I therefore had to fix.