fix(client): Client.bind accepts secrets and at_unit/at_value

bind() hard-coded secrets=None and had no time-travel parameters, though
_make_bind_request supports all three and table_function passes them. A
caller discovering a function's output schema could therefore not bind a
secret-backed function, nor see a versioned table's historical schema.
bind() now takes secrets, at_unit and at_value and forwards them.

Found by vgi-polars (time-travel scans skipped filter pushdown when the
live bind's schema differed from the versioned one).

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

Author: rustyconover

tests/test_bind_request_at_clause.py

@@ -13,10 +13,14 @@
 
 from __future__ import annotations
 
+from types import SimpleNamespace
+
 import pyarrow as pa
 import pyarrow.ipc as ipc
+import pytest
 
 from vgi.arguments import Arguments
+from vgi.client.client import Client
 from vgi.invocation import FunctionType
 from vgi.protocol import BindRequest, InitRequest
 from vgi.table_function import BindParams, ProcessParams, ResolvedSecrets
@@ -108,3 +112,31 @@ def test_process_params_accessor_none_when_no_init_call() -> None:
     )
     assert params.at_unit is None
     assert params.at_value is None
+
+
+def test_client_bind_forwards_at_clause_and_secrets(monkeypatch: pytest.MonkeyPatch) -> None:
+    """``Client.bind`` carries at_unit/at_value and secrets onto its BindRequest, as table_function does."""
+    captured: list[BindRequest] = []
+    client = Client("unused-worker")
+    client._primary = SimpleNamespace(proxy=None)  # type: ignore[assignment]
+
+    def fake_do_bind(_proxy: object, request: BindRequest, _callback: object) -> object:
+        captured.append(request)
+        return SimpleNamespace()
+
+    monkeypatch.setattr(client, "_do_bind", fake_do_bind)
+    client.bind(
+        function_name="sequence",
+        schema_path=["main"],
+        at_unit="VERSION",
+        at_value="3",
+        secrets={"token": "s3cr3t"},
+    )
+    (request,) = captured
+    assert (request.at_unit, request.at_value) == ("VERSION", "3")
+    assert request.secrets is not None
+
+    captured.clear()
+    client.bind(function_name="sequence", schema_path=["main"])
+    (request,) = captured
+    assert (request.at_unit, request.at_value, request.secrets) == (None, None, None)

vgi/client/client.py

@@ -2757,7 +2757,10 @@ def bind(
         arguments: Arguments | None = None,
         function_type: FunctionType = FunctionType.TABLE,
         settings: dict[str, Any] | None = None,
+        secrets: dict[str, Any] | None = None,
         transaction_opaque_data: bytes | None = None,
+        at_unit: str | None = None,
+        at_value: str | None = None,
     ) -> BindResponse:
         """Resolve a function's bind response without running init()/process().
 
@@ -2789,8 +2792,16 @@ def bind(
             settings: Optional dictionary of settings/pragmas — some
                 functions' output schema depends on setting values (see
                 `Meta.required_settings`).
+            secrets: Optional dictionary of secret name to value pairs, as for
+                `table_function` — a function whose bind resolves secrets
+                (e.g. a secret-backed source) needs them here too.
             transaction_opaque_data: Optional unique identifier for the
                 DuckDB transaction.
+            at_unit: Optional time travel unit (e.g. 'timestamp', 'version'):
+                bind the function as of a past point, as `table_function`'s
+                `at_unit` does, so a versioned table's historical schema can be
+                discovered. `None` binds live.
+            at_value: Optional time travel value, paired with `at_unit`.
 
         Returns:
             [`BindResponse`][] with `output_schema` and any opaque bind data —
@@ -2814,8 +2825,10 @@ def bind(
                 arguments=arguments,
                 function_type=function_type,
                 settings=settings,
-                secrets=None,
+                secrets=secrets,
                 transaction_opaque_data=transaction_opaque_data,
+                at_unit=at_unit,
+                at_value=at_value,
             )
             return self._do_bind(self._primary.proxy, bind_request, None)
         except ClientError as e: