bitranox-template-py-cli 1.5.2__tar.gz → 1.5.4__tar.gz

{bitranox_template_py_cli-1.5.2 → bitranox_template_py_cli-1.5.4}/.github/workflows/default_cicd_public.yml

@@ -11,24 +11,27 @@ on:
 
 jobs:
   setup:
-    name: Extract Python versions from pyproject.toml
+    name: Extract Python versions and OS matrix from pyproject.toml
     runs-on: ubuntu-latest
     outputs:
-      python-versions: ${{ steps.versions.outputs.python-versions }}
-      python-latest: ${{ steps.versions.outputs.python-latest }}
+      python-versions: ${{ steps.metadata.outputs.python-versions }}
+      python-latest: ${{ steps.metadata.outputs.python-latest }}
+      os-matrix: ${{ steps.metadata.outputs.os-matrix }}
     steps:
       - uses: actions/checkout@v6
       - uses: actions/setup-python@v6
         with:
           python-version: "3.x"
-      - name: Parse classifiers for Python versions
-        id: versions
+      - name: Parse pyproject.toml for Python versions and OS matrix
+        id: metadata
         shell: python
         run: |
           import json, os, tomllib
 
           with open("pyproject.toml", "rb") as f:
               data = tomllib.load(f)
+
+          # Python versions from classifiers
           classifiers = data.get("project", {}).get("classifiers", [])
           prefix = "Programming Language :: Python :: "
           versions = [
@@ -38,9 +41,15 @@ jobs:
           ]
           if not versions:
               raise SystemExit("No Python X.Y versions found in classifiers")
+
+          # OS matrix from [tool.ci]
+          ci_config = data.get("tool", {}).get("ci", {})
+          os_list = ci_config.get("os", ["ubuntu-latest"])
+
           with open(os.environ["GITHUB_OUTPUT"], "a") as fh:
               fh.write(f"python-versions={json.dumps(versions)}\n")
               fh.write(f"python-latest={versions[-1]}\n")
+              fh.write(f"os-matrix={json.dumps(os_list)}\n")
 
   test:
     name: Tests (Python ${{ matrix.python }}, ${{ matrix.os }})
@@ -49,7 +58,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [ubuntu-latest, macos-latest, windows-latest]
+        os: ${{ fromJSON(needs.setup.outputs.os-matrix) }}
         python: ${{ fromJSON(needs.setup.outputs.python-versions) }}
     env:
       PYO3_USE_ABI3_FORWARD_COMPATIBILITY: "1"
@@ -77,23 +86,83 @@ jobs:
         id: metadata
         uses: ./.github/actions/extract-metadata
 
-      - name: Install journald prerequisites
+      - name: Install CI system dependencies (Ubuntu)
         if: runner.os == 'Linux'
-        shell: bash
+        shell: python
         run: |
-          sudo apt-get update
-          sudo apt-get install -y python3-systemd
+          import subprocess
+          try:
+              import tomllib
+          except ModuleNotFoundError:
+              import pip._vendor.tomli as tomllib
+          with open("pyproject.toml", "rb") as f:
+              data = tomllib.load(f)
+          deps = data.get("tool", {}).get("ci", {}).get("system-dependencies-ubuntu", [])
+          if deps:
+              print(f"Installing system packages: {' '.join(deps)}")
+              subprocess.check_call(["sudo", "apt-get", "update"])
+              subprocess.check_call(["sudo", "apt-get", "install", "-y", *deps])
+          else:
+              print("No CI system dependencies configured for Ubuntu.")
+
+      - name: Install CI system dependencies (macOS)
+        if: runner.os == 'macOS'
+        shell: python
+        run: |
+          import subprocess
+          try:
+              import tomllib
+          except ModuleNotFoundError:
+              import pip._vendor.tomli as tomllib
+          with open("pyproject.toml", "rb") as f:
+              data = tomllib.load(f)
+          deps = data.get("tool", {}).get("ci", {}).get("system-dependencies-macos", [])
+          if deps:
+              print(f"Installing system packages: {' '.join(deps)}")
+              subprocess.check_call(["brew", "install", *deps])
+          else:
+              print("No CI system dependencies configured for macOS.")
 
       - name: Install dev deps
         shell: bash
         run: |
           uv pip install -e .[dev] --system
 
-      - name: Install Windows Event Log prerequisites
+      - name: Install CI system dependencies (Windows/choco)
         if: runner.os == 'Windows'
-        shell: bash
+        shell: python
         run: |
-          uv pip install pywin32 --system
+          import subprocess
+          try:
+              import tomllib
+          except ModuleNotFoundError:
+              import pip._vendor.tomli as tomllib
+          with open("pyproject.toml", "rb") as f:
+              data = tomllib.load(f)
+          deps = data.get("tool", {}).get("ci", {}).get("system-dependencies-windows-choco", [])
+          if deps:
+              print(f"Installing choco packages: {' '.join(deps)}")
+              subprocess.check_call(["choco", "install", "-y", *deps])
+          else:
+              print("No CI choco dependencies configured for Windows.")
+
+      - name: Install CI pip dependencies (Windows)
+        if: runner.os == 'Windows'
+        shell: python
+        run: |
+          import subprocess
+          try:
+              import tomllib
+          except ModuleNotFoundError:
+              import pip._vendor.tomli as tomllib
+          with open("pyproject.toml", "rb") as f:
+              data = tomllib.load(f)
+          deps = data.get("tool", {}).get("ci", {}).get("system-dependencies-windows-pip", [])
+          if deps:
+              print(f"Installing pip packages: {' '.join(deps)}")
+              subprocess.check_call(["uv", "pip", "install", *deps, "--system"])
+          else:
+              print("No CI pip dependencies configured for Windows.")
 
       # Self-hosted runners persist ruff cache via RUFF_CACHE_DIR volume mount,
       # so actions/cache is only needed on GitHub-hosted runners.
@@ -145,7 +214,7 @@ jobs:
           && steps.pytest.outcome == 'success'
           && matrix.os == 'ubuntu-latest'
           && matrix.python == needs.setup.outputs.python-latest
-        uses: codecov/codecov-action@v5
+        uses: codecov/codecov-action@v7
         with:
           files: ${{ env.COV_REPORT_FILE }}
           fail_ci_if_error: false
@@ -201,8 +270,7 @@ jobs:
             exit 1
           fi
           if [[ "${{ steps.pipaudit.outcome }}" != "success" ]]; then
-            echo "::error::pip-audit vulnerability scan failed"
-            exit 1
+            echo "::warning::pip-audit vulnerability scan failed"
           fi
           echo "All checks passed!"
 

{bitranox_template_py_cli-1.5.2 → bitranox_template_py_cli-1.5.4}/CHANGELOG.md

@@ -6,6 +6,22 @@ the [Keep a Changelog](https://keepachangelog.com/) format.
 
 ## [Unreleased]
 
+## [1.5.4] 2026-06-14
+
+### Changed
+- Added a `typed_click.py` facade wrapping rich-click's `option` / `version_option` decorators behind explicit, fully-known signatures, keeping the CLI strict-clean under pyright 1.1.410 (`reportUnknownMemberType`) without disabling the rule (ignore isolated to the facade).
+- Bumped internal dependency floors: `lib_cli_exit_tools>=2.3.2`, `lib_log_rich>=6.3.5`, `lib_layered_config>=5.5.2`, `btx_lib_mail>=1.3.2`.
+
+## [1.5.3] - 2026-03-30
+
+### Changed
+- Bumped Codecov GitHub Action to V6
+- Updated CVE exclusion list: removed stale entries, added inline documentation for remaining exclusions
+- pip-audit set to warning-only to reduce CI noise
+
+### Fixed
+- Email transport: minor improvements to SMTP handling
+
 ## [1.5.2] - 2026-03-05
 
 ### Fixed

{bitranox_template_py_cli-1.5.2 → bitranox_template_py_cli-1.5.4}/Makefile

@@ -1,4 +1,4 @@
-# BMK MAKEFILE 2.9.0
+# BMK MAKEFILE 2.9.4
 # do not alter this file - it might be overwritten on new versions of BMK
 # if You want to alter it, remove the first line # BMK MAKEFILE 1.0 - then it is a custom makefile and will not be overwritten
 # bmk Makefile — thin wrapper using `uv tool install` for persistent bmk

{bitranox_template_py_cli-1.5.2 → bitranox_template_py_cli-1.5.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: bitranox_template_py_cli
-Version: 1.5.2
+Version: 1.5.4
 Summary: Template CLI application with configuration management and structured logging
 Project-URL: Homepage, https://github.com/bitranox/bitranox_template_py_cli
 Project-URL: Repository, https://github.com/bitranox/bitranox_template_py_cli.git
@@ -21,33 +21,33 @@ Classifier: Programming Language :: Python :: 3.13
 Classifier: Programming Language :: Python :: 3.14
 Classifier: Typing :: Typed
 Requires-Python: >=3.10
-Requires-Dist: btx-lib-mail>=1.3.1
-Requires-Dist: lib-cli-exit-tools>=2.3.0
-Requires-Dist: lib-layered-config>=5.5.0
-Requires-Dist: lib-log-rich>=6.3.3
+Requires-Dist: btx-lib-mail>=1.3.2
+Requires-Dist: lib-cli-exit-tools>=2.3.2
+Requires-Dist: lib-layered-config>=5.5.2
+Requires-Dist: lib-log-rich>=6.3.5
 Requires-Dist: orjson>=3.11.7
 Requires-Dist: pydantic>=2.12.5
 Requires-Dist: rich-click>=1.9.7
 Provides-Extra: dev
 Requires-Dist: bandit>=1.9.4; extra == 'dev'
-Requires-Dist: build>=1.4.0; extra == 'dev'
-Requires-Dist: codecov-cli>=11.2.6; extra == 'dev'
-Requires-Dist: httpx>=0.28.1; extra == 'dev'
-Requires-Dist: hypothesis>=6.151.9; extra == 'dev'
-Requires-Dist: import-linter>=2.10; extra == 'dev'
-Requires-Dist: jaraco-context>=6.1.0; extra == 'dev'
+Requires-Dist: build>=1.4.2; extra == 'dev'
+Requires-Dist: codecov-cli>=11.2.8; extra == 'dev'
+Requires-Dist: httpx2>=2.2.0; extra == 'dev'
+Requires-Dist: hypothesis>=6.151.10; extra == 'dev'
+Requires-Dist: import-linter>=2.11; extra == 'dev'
+Requires-Dist: jaraco-context>=6.1.2; extra == 'dev'
 Requires-Dist: pip-audit>=2.10.0; extra == 'dev'
 Requires-Dist: pynacl>=1.6.2; extra == 'dev'
 Requires-Dist: pyright[nodejs]>=1.1.408; extra == 'dev'
-Requires-Dist: pytest-cov>=7.0.0; extra == 'dev'
+Requires-Dist: pytest-cov>=7.1.0; extra == 'dev'
 Requires-Dist: pytest>=9.0.2; extra == 'dev'
 Requires-Dist: python-multipart>=0.0.22; extra == 'dev'
 Requires-Dist: rtoml>=0.13.0; extra == 'dev'
-Requires-Dist: ruff>=0.15.4; extra == 'dev'
-Requires-Dist: textual>=8.0.2; extra == 'dev'
+Requires-Dist: ruff>=0.15.8; extra == 'dev'
+Requires-Dist: textual>=8.2.1; extra == 'dev'
 Requires-Dist: twine>=6.2.0; extra == 'dev'
 Requires-Dist: urllib3>=2.6.3; extra == 'dev'
-Requires-Dist: virtualenv>=21.1.0; extra == 'dev'
+Requires-Dist: virtualenv>=21.2.0; extra == 'dev'
 Requires-Dist: wheel>=0.46.3; extra == 'dev'
 Description-Content-Type: text/markdown
 
@@ -63,7 +63,6 @@ Description-Content-Type: text/markdown
 [![Code Style: Ruff](https://img.shields.io/badge/Code%20Style-Ruff-46A3FF?logo=ruff&labelColor=000)](https://docs.astral.sh/ruff/)
 [![codecov](https://codecov.io/gh/bitranox/bitranox_template_py_cli/graph/badge.svg?token=UFBaUDIgRk)](https://codecov.io/gh/bitranox/bitranox_template_py_cli)
 [![Maintainability](https://qlty.sh/badges/041ba2c1-37d6-40bb-85a0-ec5a8a0aca0c/maintainability.svg)](https://qlty.sh/gh/bitranox/projects/bitranox_template_py_cli)
-[![Known Vulnerabilities](https://snyk.io/test/github/bitranox/bitranox_template_py_cli/badge.svg)](https://snyk.io/test/github/bitranox/bitranox_template_py_cli)
 [![security: bandit](https://img.shields.io/badge/security-bandit-yellow.svg)](https://github.com/PyCQA/bandit)
 
 
@@ -95,6 +94,14 @@ Description-Content-Type: text/markdown
 ```bash
 # macOS/Linux
 curl -LsSf https://astral.sh/uv/install.sh | sh
+
+# Copy the actual binaries
+cp /root/.local/bin/uv /usr/local/bin/uv
+cp /root/.local/bin/uvx /usr/local/bin/uvx
+
+# Ensure world-executable
+chmod 755 /usr/local/bin/uv /usr/local/bin/uvx
+
 # Windows (PowerShell)
 powershell -ExecutionPolicy ByPass -c "irm https://astral.sh/uv/install.ps1 | iex"
 ```
@@ -159,6 +166,9 @@ uv tool install bitranox_template_py_cli
 # Verify
 bitranox-template-py-cli --version
 
+# deploy config files
+bitranox-template-py-cli deploy-config --target app
+
 # Try it out
 bitranox-template-py-cli hello
 bitranox-template-py-cli info

{bitranox_template_py_cli-1.5.2 → bitranox_template_py_cli-1.5.4}/README.md

@@ -10,7 +10,6 @@
 [![Code Style: Ruff](https://img.shields.io/badge/Code%20Style-Ruff-46A3FF?logo=ruff&labelColor=000)](https://docs.astral.sh/ruff/)
 [![codecov](https://codecov.io/gh/bitranox/bitranox_template_py_cli/graph/badge.svg?token=UFBaUDIgRk)](https://codecov.io/gh/bitranox/bitranox_template_py_cli)
 [![Maintainability](https://qlty.sh/badges/041ba2c1-37d6-40bb-85a0-ec5a8a0aca0c/maintainability.svg)](https://qlty.sh/gh/bitranox/projects/bitranox_template_py_cli)
-[![Known Vulnerabilities](https://snyk.io/test/github/bitranox/bitranox_template_py_cli/badge.svg)](https://snyk.io/test/github/bitranox/bitranox_template_py_cli)
 [![security: bandit](https://img.shields.io/badge/security-bandit-yellow.svg)](https://github.com/PyCQA/bandit)
 
 
@@ -42,6 +41,14 @@
 ```bash
 # macOS/Linux
 curl -LsSf https://astral.sh/uv/install.sh | sh
+
+# Copy the actual binaries
+cp /root/.local/bin/uv /usr/local/bin/uv
+cp /root/.local/bin/uvx /usr/local/bin/uvx
+
+# Ensure world-executable
+chmod 755 /usr/local/bin/uv /usr/local/bin/uvx
+
 # Windows (PowerShell)
 powershell -ExecutionPolicy ByPass -c "irm https://astral.sh/uv/install.ps1 | iex"
 ```
@@ -106,6 +113,9 @@ uv tool install bitranox_template_py_cli
 # Verify
 bitranox-template-py-cli --version
 
+# deploy config files
+bitranox-template-py-cli deploy-config --target app
+
 # Try it out
 bitranox-template-py-cli hello
 bitranox-template-py-cli info

{bitranox_template_py_cli-1.5.2 → bitranox_template_py_cli-1.5.4}/pyproject.toml

@@ -1,15 +1,15 @@
 [project]
 name = "bitranox_template_py_cli"
-version = "1.5.2"
+version = "1.5.4"
 description = "Template CLI application with configuration management and structured logging"
 readme = "README.md"
 requires-python = ">=3.10"
 dependencies = [
     "rich-click>=1.9.7",
-    "lib_cli_exit_tools>=2.3.0",
-    "lib_log_rich>=6.3.3",
-    "lib_layered_config>=5.5.0",
-    "btx_lib_mail>=1.3.1",
+    "lib_cli_exit_tools>=2.3.2",
+    "lib_log_rich>=6.3.5",
+    "lib_layered_config>=5.5.2",
+    "btx_lib_mail>=1.3.2",
     "pydantic>=2.12.5",
     "orjson>=3.11.7",
 ]
@@ -30,6 +30,15 @@ classifiers = [
   "Typing :: Typed",
 ]
 
+# System packages required for CI runners (read by GitHub Actions workflow template)
+# Format: "apt_package_name" for Ubuntu, future: {"apt": "...", "brew": "...", "choco": "..."}
+[tool.ci]
+system-dependencies-ubuntu = []
+system-dependencies-macos = []
+system-dependencies-windows-pip = []
+system-dependencies-windows-choco = []
+os = ["ubuntu-latest", "windows-latest", "macos-latest"]
+
 [project.urls]
 Homepage = "https://github.com/bitranox/bitranox_template_py_cli"
 Repository = "https://github.com/bitranox/bitranox_template_py_cli.git"
@@ -38,26 +47,26 @@ Issues = "https://github.com/bitranox/bitranox_template_py_cli/issues"
 [project.optional-dependencies]
 dev = [
   "pytest>=9.0.2",
-  "pytest-cov>=7.0.0",
-  "hypothesis>=6.151.9",
-  "ruff>=0.15.4",
+  "pytest-cov>=7.1.0",
+  "hypothesis>=6.151.10",
+  "ruff>=0.15.8",
   "pyright[nodejs]>=1.1.408",
   "bandit>=1.9.4",
-  "build>=1.4.0",
+  "build>=1.4.2",
   "twine>=6.2.0",
-  "codecov-cli>=11.2.6",
+  "codecov-cli>=11.2.8",
   "pip-audit>=2.10.0",
-  "textual>=8.0.2",
-  "import-linter>=2.10",
+  "textual>=8.2.1",
+  "import-linter>=2.11",
   "rtoml>=0.13.0",
-  "httpx>=0.28.1",
+  "httpx2>=2.2.0",
   # Transitive CVE pins
-  "jaraco-context>=6.1.0",       # CVE-2025-23949
+  "jaraco-context>=6.1.2",       # CVE-2025-23949
   "python-multipart>=0.0.22",    # CVE-2025-24486
   "wheel>=0.46.3",               # CVE-2025-24049
   "pynacl>=1.6.2",               # CVE-2025-69277
   "urllib3>=2.6.3",              # CVE-2025-66471, CVE-2025-66418
-  "virtualenv>=21.1.0",         # CVE-2025-22702
+  "virtualenv>=21.2.0",         # CVE-2025-22702
 ]
 
 [project.scripts]
@@ -248,14 +257,10 @@ layers = [
 # PYSEC-2022-42969: py library ReDoS — py 1.11.0 is installed in the development
 #   environment but is not a dependency of this project; no fix available.
 ignore-vulns = [
-  "PYSEC-2022-42969",
-  "PYSEC-2022-43012",  # setuptools 65.5.0 — env-only, not a project dependency
-  "PYSEC-2025-49",     # setuptools 65.5.0 — env-only, not a project dependency
-  "CVE-2024-6345",     # setuptools 65.5.0 — env-only, not a project dependency
-  "CVE-2025-8869",   # pip 24.3.1 — env-only, not a project dependency
-  "CVE-2026-1703",
-  "CVE-2026-25990",
-  "CVE-2026-26007",
+  "PYSEC-2022-42969",  # py 1.11.0 — ReDoS, env-only, no fix available
+  "CVE-2025-8869",     # pip 24.3.1 — env-only, not a project dependency
+  "CVE-2026-1703",     # pip 24.3.1 — env-only, not a project dependency
+  "CVE-2026-25990",    # pillow 12.0.0 — env-only, fix in 12.1.1
 ]
 
 [tool.bashate]

{bitranox_template_py_cli-1.5.2 → bitranox_template_py_cli-1.5.4}/src/bitranox_template_py_cli/__init__conf__.py

@@ -40,7 +40,7 @@ name = "bitranox_template_py_cli"
 #: Human-readable summary shown in CLI help output.
 title = "Template CLI application with configuration management and structured logging"
 #: Current release version pulled from ``pyproject.toml`` by automation.
-version = "1.5.2"
+version = "1.5.4"
 #: Repository homepage presented to users.
 homepage = "https://github.com/bitranox/bitranox_template_py_cli"
 #: Author attribution surfaced in CLI output.

{bitranox_template_py_cli-1.5.2 → bitranox_template_py_cli-1.5.4}/src/bitranox_template_py_cli/adapters/cli/commands/config.py

@@ -25,25 +25,26 @@ from bitranox_template_py_cli.domain.enums import DeployTarget, OutputFormat
 from ..constants import CLICK_CONTEXT_SETTINGS
 from ..context import CLIContext, get_cli_context
 from ..exit_codes import ExitCode
+from ..typed_click import option
 
 logger = logging.getLogger(__name__)
 
 
 @click.command("config", context_settings=CLICK_CONTEXT_SETTINGS)
-@click.option(
+@option(
     "--format",
     "output_format",
     type=click.Choice([f.value for f in OutputFormat], case_sensitive=False),
     default=OutputFormat.HUMAN.value,
     help="Output format (human-readable or JSON)",
 )
-@click.option(
+@option(
     "--section",
     type=str,
     default=None,
     help="Show only a specific configuration section (e.g., 'lib_log_rich')",
 )
-@click.option(
+@option(
     "--profile",
     type=str,
     default=None,
@@ -134,7 +135,7 @@ def _parse_octal_mode(ctx: click.Context, param: click.Parameter, value: str | N
 
 
 @click.command("config-deploy", context_settings=CLICK_CONTEXT_SETTINGS)
-@click.option(
+@option(
     "--target",
     "targets",
     type=click.Choice([t.value for t in DeployTarget], case_sensitive=False),
@@ -142,32 +143,32 @@ def _parse_octal_mode(ctx: click.Context, param: click.Parameter, value: str | N
     required=True,
     help="Target configuration layer(s) to deploy to (can specify multiple)",
 )
-@click.option(
+@option(
     "--force",
     is_flag=True,
     default=False,
     help="Overwrite existing configuration files",
 )
-@click.option(
+@option(
     "--profile",
     type=str,
     default=None,
     help="Override profile from root command (e.g., 'production', 'test')",
 )
-@click.option(
+@option(
     "--permissions/--no-permissions",
     "set_permissions",
     default=None,
     help="Set Unix permissions (755/644 for app/host, 700/600 for user). Default: enabled.",
 )
-@click.option(
+@option(
     "--dir-mode",
     type=str,
     default=None,
     callback=_parse_octal_mode,
     help="Override directory mode (octal, e.g., 750 or 0o750)",
 )
-@click.option(
+@option(
     "--file-mode",
     type=str,
     default=None,
@@ -290,8 +291,8 @@ def _report_deployment_result(deployed_paths: list[Path], profile: str | None, s
 
 
 @click.command("config-generate-examples", context_settings=CLICK_CONTEXT_SETTINGS)
-@click.option("--destination", type=click.Path(file_okay=False), required=True, help="Directory to write example files")
-@click.option("--force", is_flag=True, default=False, help="Overwrite existing files")
+@option("--destination", type=click.Path(file_okay=False), required=True, help="Directory to write example files")
+@option("--force", is_flag=True, default=False, help="Overwrite existing files")
 @click.pass_context
 def cli_config_generate_examples(ctx: click.Context, destination: str, force: bool) -> None:
     """Generate example configuration files in a target directory.

{bitranox_template_py_cli-1.5.2 → bitranox_template_py_cli-1.5.4}/src/bitranox_template_py_cli/adapters/cli/commands/email/_common.py

@@ -22,6 +22,7 @@ from bitranox_template_py_cli.application.ports import LoadEmailConfigFromDict
 from bitranox_template_py_cli.domain.errors import ConfigurationError, DeliveryError
 
 from ...exit_codes import ExitCode
+from ...typed_click import option
 
 logger = logging.getLogger(__name__)
 
@@ -80,23 +81,23 @@ def smtp_config_options(func: Callable[..., Any]) -> Callable[..., Any]:
     can be overridden at invocation time.
     """
     options = [
-        click.option(
+        option(
             "--smtp-host",
             "smtp_hosts",
             multiple=True,
             default=(),
             help="Override SMTP host (can specify multiple; format host:port)",
         ),
-        click.option("--smtp-username", default=None, help="Override SMTP authentication username"),
-        click.option("--smtp-password", default=None, help="Override SMTP authentication password"),
-        click.option("--use-starttls/--no-use-starttls", default=None, help="Override STARTTLS setting"),
-        click.option("--timeout", "timeout", type=float, default=None, help="Override socket timeout in seconds"),
-        click.option(
+        option("--smtp-username", default=None, help="Override SMTP authentication username"),
+        option("--smtp-password", default=None, help="Override SMTP authentication password"),
+        option("--use-starttls/--no-use-starttls", default=None, help="Override STARTTLS setting"),
+        option("--timeout", "timeout", type=float, default=None, help="Override socket timeout in seconds"),
+        option(
             "--raise-on-missing-attachments/--no-raise-on-missing-attachments",
             default=None,
             help="Override missing attachment handling",
         ),
-        click.option(
+        option(
             "--raise-on-invalid-recipient/--no-raise-on-invalid-recipient",
             default=None,
             help="Override invalid recipient handling",

{bitranox_template_py_cli-1.5.2 → bitranox_template_py_cli-1.5.4}/src/bitranox_template_py_cli/adapters/cli/commands/email/send_email.py

@@ -15,6 +15,7 @@ from pydantic import ValidationError
 
 from ...constants import CLICK_CONTEXT_SETTINGS
 from ...context import get_cli_context
+from ...typed_click import option
 from ._common import (
     apply_validated_overrides,
     execute_with_email_error_handling,
@@ -53,20 +54,18 @@ def _log_send_email_start(
 
 
 @click.command("send-email", context_settings=CLICK_CONTEXT_SETTINGS)
-@click.option(
+@option(
     "--to",
     "recipients",
     multiple=True,
     required=False,
     help="Recipient email address (can specify multiple; uses config default if not specified)",
 )
-@click.option("--subject", required=True, help="Email subject line")
-@click.option("--body", default="", help="Plain-text email body")
-@click.option("--body-html", default="", help="HTML email body (sent as multipart with plain text)")
-@click.option(
-    "--from", "from_address", default=None, help="Override sender address (uses config default if not specified)"
-)
-@click.option(
+@option("--subject", required=True, help="Email subject line")
+@option("--body", default="", help="Plain-text email body")
+@option("--body-html", default="", help="HTML email body (sent as multipart with plain text)")
+@option("--from", "from_address", default=None, help="Override sender address (uses config default if not specified)")
+@option(
     "--attachment",
     "attachments",
     multiple=True,

{bitranox_template_py_cli-1.5.2 → bitranox_template_py_cli-1.5.4}/src/bitranox_template_py_cli/adapters/cli/commands/email/send_notification.py

@@ -14,6 +14,7 @@ from pydantic import ValidationError
 
 from ...constants import CLICK_CONTEXT_SETTINGS
 from ...context import get_cli_context
+from ...typed_click import option
 from ._common import (
     apply_validated_overrides,
     execute_with_email_error_handling,
@@ -27,18 +28,16 @@ logger = logging.getLogger(__name__)
 
 
 @click.command("send-notification", context_settings=CLICK_CONTEXT_SETTINGS)
-@click.option(
+@option(
     "--to",
     "recipients",
     multiple=True,
     required=False,
     help="Recipient email address (can specify multiple; uses config default if not specified)",
 )
-@click.option("--subject", required=True, help="Notification subject line")
-@click.option("--message", required=True, help="Notification message (plain text)")
-@click.option(
-    "--from", "from_address", default=None, help="Override sender address (uses config default if not specified)"
-)
+@option("--subject", required=True, help="Notification subject line")
+@option("--message", required=True, help="Notification message (plain text)")
+@option("--from", "from_address", default=None, help="Override sender address (uses config default if not specified)")
 @smtp_config_options
 @click.pass_context
 def cli_send_notification(

{bitranox_template_py_cli-1.5.2 → bitranox_template_py_cli-1.5.4}/src/bitranox_template_py_cli/adapters/cli/commands/logging.py

@@ -11,10 +11,11 @@ from __future__ import annotations
 import rich_click as click
 
 from ..constants import CLICK_CONTEXT_SETTINGS
+from ..typed_click import option
 
 
 @click.command("logdemo", context_settings=CLICK_CONTEXT_SETTINGS)
-@click.option("--theme", default="classic", help="Logging theme to preview")
+@option("--theme", default="classic", help="Logging theme to preview")
 @click.pass_context
 def cli_logdemo(ctx: click.Context, theme: str) -> None:
     """Run a logging demonstration to preview log output."""

{bitranox_template_py_cli-1.5.2 → bitranox_template_py_cli-1.5.4}/src/bitranox_template_py_cli/adapters/cli/root.py

@@ -19,6 +19,7 @@ from bitranox_template_py_cli.adapters.config.overrides import apply_overrides
 
 from .constants import CLICK_CONTEXT_SETTINGS
 from .context import apply_traceback_preferences, store_cli_context
+from .typed_click import option, version_option
 
 if TYPE_CHECKING:
     from bitranox_template_py_cli.composition import AppServices
@@ -49,24 +50,24 @@ def _apply_cli_overrides(config: Config, set_overrides: tuple[str, ...]) -> Conf
     context_settings=CLICK_CONTEXT_SETTINGS,
     invoke_without_command=True,
 )
-@click.version_option(
+@version_option(
     version=__init__conf__.version,
     prog_name=__init__conf__.shell_command,
     message=f"{__init__conf__.shell_command} version {__init__conf__.version}",
 )
-@click.option(
+@option(
     "--traceback/--no-traceback",
     is_flag=True,
     default=False,
     help="Show full Python traceback on errors",
 )
-@click.option(
+@option(
     "--profile",
     type=str,
     default=None,
     help="Load configuration from a named profile (e.g., 'production', 'test')",
 )
-@click.option(
+@option(
     "--set",
     "set_overrides",
     multiple=True,
@@ -74,7 +75,7 @@ def _apply_cli_overrides(config: Config, set_overrides: tuple[str, ...]) -> Conf
     metavar="SECTION.KEY=VALUE",
     help="Override a configuration setting (repeatable).",
 )
-@click.option(
+@option(
     "--env-file",
     "env_file",
     type=click.Path(exists=True, file_okay=True, dir_okay=False, readable=True),

bitranox_template_py_cli-1.5.4/src/bitranox_template_py_cli/adapters/cli/typed_click.py

@@ -0,0 +1,37 @@
+"""Strictly-typed wrappers for the rich_click decorators with unknown types.
+
+rich_click ships ``py.typed``, but it re-exports click's ``option`` and
+``version_option`` decorators, whose ``type: ParamType[Unknown]`` parameter makes
+pyright (strict mode) report ``reportUnknownMemberType`` at every call site.
+Wrapping the two affected decorators here behind explicit, fully-known
+signatures keeps the rest of the CLI layer strict-clean without disabling the
+rule. This module is the single boundary that touches the untyped surface, so
+the only ``# pyright: ignore`` for this third-party gap lives here.
+
+Other click members (``command``, ``group``, ``echo``, ``Context``, ``Path`` …)
+type cleanly and are still used directly as ``click.X`` at call sites.
+"""
+
+from collections.abc import Callable
+from typing import Any
+
+import rich_click as click
+
+# Click decorators turn a command function (or another decorator's result) into
+# a wrapped callable. ``Any`` is fully known to pyright (unlike ``Unknown``), so
+# this alias is strict-clean and works both as ``@option(...)`` and as a value
+# collected into a list (see email/_common.py's shared-options pattern).
+_CommandDecorator = Callable[[Callable[..., Any]], Callable[..., Any]]
+
+
+def option(*param_decls: str, **attrs: Any) -> _CommandDecorator:
+    """Typed wrapper over :func:`rich_click.option`. See module docstring."""
+    return click.option(*param_decls, **attrs)  # pyright: ignore[reportUnknownMemberType]
+
+
+def version_option(*param_decls: str, **attrs: Any) -> _CommandDecorator:
+    """Typed wrapper over :func:`rich_click.version_option`. See module docstring."""
+    return click.version_option(*param_decls, **attrs)  # pyright: ignore[reportUnknownMemberType]
+
+
+__all__ = ["option", "version_option"]

{bitranox_template_py_cli-1.5.2 → bitranox_template_py_cli-1.5.4}/src/bitranox_template_py_cli/adapters/email/transport.py

@@ -22,13 +22,15 @@ logger = logging.getLogger(__name__)
 # Keywords that may indicate sensitive data in exception messages
 _SENSITIVE_KEYWORDS = frozenset(
     {
-        "password",
-        "credential",
+        "api_key",
         "auth",
-        "secret",
-        "token",
+        "bearer",
+        "credential",
         "key",
         "login",
+        "password",
+        "secret",
+        "token",
     }
 )
 

{bitranox_template_py_cli-1.5.2 → bitranox_template_py_cli-1.5.4}/tests/test_module_entry.py

@@ -111,7 +111,7 @@ def test_module_entry_subprocess_help() -> None:
     This tests the true CLI invocation path that end-users would experience,
     complementing the runpy-based tests that run in-process.
     """
-    result = subprocess.run(  # noqa: S603
+    result = subprocess.run(
         [sys.executable, "-m", "bitranox_template_py_cli", "--help"],
         capture_output=True,
         timeout=30,
@@ -128,7 +128,7 @@ def test_module_entry_subprocess_help() -> None:
 @pytest.mark.os_agnostic
 def test_module_entry_subprocess_version() -> None:
     """Verify `python -m bitranox_template_py_cli --version` outputs version."""
-    result = subprocess.run(  # noqa: S603
+    result = subprocess.run(
         [sys.executable, "-m", "bitranox_template_py_cli", "--version"],
         capture_output=True,
         timeout=30,