Inferring parameter types and return type of a `type[T]`

From this discussion at @microsoft/pyright:

(playground)

@dataclass(kw_only = True)
class User:
    id: int
    name: str

class HasCls[**P, T](Protocol):
    cls: Callable[P, T]

class Repository[T]:
    cls: type[T]

    def __init__(self, cls: type[T]) -> None: ...
    def create[**P](self: HasCls[P, T], *args: P.args, **kwargs: P.kwargs) -> T: ...

class UserDatabase(Repository[User]):
    def __init__(self) -> None: ...

Expected:

user = UserDatabase().create(id = 1, name = 'foo')  # fine

reveal_type(UserDatabase().create)  # (*, id: int, name: str) -> User
reveal_type(user)                   # User

Actual:

# error: Invalid self argument "UserDatabase" to attribute function "create" with type "Callable[[HasCls[P, T], **P], T]" [misc]
user = UserDatabase().create(id = 1, name = 'foo')

reveal_type(UserDatabase().create)  # (*args: Never, **kwargs: Never) -> User
reveal_type(user)                   # User

The pattern above is supported by Pyright, if not for a bug that this snippet helped discovering (which has since been fixed).

Start with the linked minimal Python reproducer and compare mypy's strict-mode output with the expected reveal_type results for UserDatabase().create and user. The work is done when the type checker accepts the create call and infers the keyword-only constructor parameters and User return type without the invalid-self error.