fix(ci): satisfy mypy/ruff/pydoclint/docs gates for copy-from/to + secrets

The copy-from/to + scope/type-aware-secrets batch landed with several quality
gates red:

- mypy: ProcessParams/InitParams.secrets were typed as a plain dict, so the
  fixtures' params.secrets.of_type()/for_scope_of_type() calls failed
  [attr-defined]; they are ResolvedSecrets at runtime. Type the field as
  ResolvedSecrets, parameterize ResolvedSecrets(dict[str, dict[str, Any]]), and
  construct the empty-secrets ProcessParams with ResolvedSecrets().
- ruff B905: add strict=True to zip(*rows) in the example_lines COPY-FROM reader
  (rows are pre-validated to ncols).
- pydoclint DOC601/603: document BindRequest.copy_from / copy_to.
- docs --strict: export CopyFromFormatInfo from vgi.catalog so the
  CopyFromFormatsResponse cross-reference resolves.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: rustyconover

vgi/_test_fixtures/copy_from.py

@@ -91,7 +91,7 @@ def read(
 
         # Column-major string arrays, NULL where the cell equals null_string,
         # then cast each column to the target type (DuckDB inserts no cast).
-        columns = list(zip(*rows)) if rows else [() for _ in range(ncols)]
+        columns = list(zip(*rows, strict=True)) if rows else [() for _ in range(ncols)]
         arrays = []
         for idx, field in enumerate(expected_schema):
             raw = [None if v == options.null_string else v for v in columns[idx]]

vgi/catalog/__init__.py

@@ -15,6 +15,7 @@
     CatalogInterface,
     CatalogObject,
     CatalogSchemaObject,
+    CopyFromFormatInfo,
     FunctionInfo,
     FunctionType,
     IndexConstraintType,
@@ -67,6 +68,7 @@
     "TableInfo",
     "ViewInfo",
     "FunctionInfo",
+    "CopyFromFormatInfo",
     "ScanBranch",
     "ScanBranchesResult",
     "ScanFunctionResult",

vgi/protocol.py

@@ -196,6 +196,10 @@ class BindRequest(ArrowSerializableDataclass):
             accessor), not at on_bind.
         at_value: Value of the time-travel ``AT`` clause for this scan; ``None`` when
             the scan has no AT clause. See ``at_unit`` for the inline-bind caveat.
+        copy_from: The ``COPY ... FROM`` context (source format + path); ``None``
+            unless this bind/init opens a COPY-FROM scan.
+        copy_to: The ``COPY ... TO`` context (destination format + path); ``None``
+            unless this bind/init opens a COPY-TO sink.
     """
 
     function_name: str

vgi/table_function.py

@@ -300,7 +300,7 @@ def _secret_scalar_str(v: Any) -> str:
     return "" if py is None else str(py)
 
 
-class ResolvedSecrets(dict):
+class ResolvedSecrets(dict[str, dict[str, Any]]):
     """Resolved secrets keyed by secret name, with type- and scope-aware lookup.
 
     A plain ``dict`` (so ``secrets[name]`` and ``secrets.get(name)`` still work)
@@ -514,7 +514,7 @@ class InitParams[TArgs]:
     output_schema: pa.Schema
 
     settings: dict[str, pa.Scalar[Any]]
-    secrets: dict[str, dict[str, pa.Scalar[Any]]]
+    secrets: ResolvedSecrets
 
     storage: BoundStorage
     auth_context: AuthContext = AuthContext.anonymous()
@@ -569,7 +569,7 @@ class ProcessParams[TArgs]:
     output_schema: pa.Schema
 
     settings: dict[str, pa.Scalar[Any]]
-    secrets: dict[str, dict[str, pa.Scalar[Any]]]
+    secrets: ResolvedSecrets
 
     storage: BoundStorage
     auth_context: AuthContext = AuthContext.anonymous()

vgi/worker.py

@@ -146,6 +146,7 @@ class MyWorker(Worker):
 )
 from vgi.table_function import (
     ProcessParams,
+    ResolvedSecrets,
     SecretsAccessor,
     TableCardinality,
     TableFunctionBase,
@@ -2407,7 +2408,7 @@ def aggregate_update(
             init_response=None,
             output_schema=pa.schema([]),
             settings={},
-            secrets={},
+            secrets=ResolvedSecrets(),
             storage=storage,
             auth_context=ctx.auth,
         )
@@ -2513,7 +2514,7 @@ def aggregate_combine(
             init_response=None,
             output_schema=pa.schema([]),
             settings={},
-            secrets={},
+            secrets=ResolvedSecrets(),
             storage=storage,
             auth_context=ctx.auth,
         )
@@ -2576,7 +2577,7 @@ def aggregate_finalize(
             init_response=None,
             output_schema=request.output_schema,
             settings={},
-            secrets={},
+            secrets=ResolvedSecrets(),
             storage=storage,
             auth_context=ctx.auth,
         )
@@ -2815,7 +2816,7 @@ def aggregate_window_init(
             init_response=None,
             output_schema=request.output_schema,
             settings={},
-            secrets={},
+            secrets=ResolvedSecrets(),
             storage=storage,
             auth_context=ctx.auth,
         )
@@ -2912,7 +2913,7 @@ def aggregate_window(
             init_response=None,
             output_schema=output_schema,
             settings={},
-            secrets={},
+            secrets=ResolvedSecrets(),
             storage=storage,
             auth_context=ctx.auth,
         )
@@ -3027,7 +3028,7 @@ def aggregate_window_batch(
             init_response=None,
             output_schema=output_schema,
             settings={},
-            secrets={},
+            secrets=ResolvedSecrets(),
             storage=storage,
             auth_context=ctx.auth,
         )
@@ -3121,7 +3122,7 @@ def aggregate_streaming_open(
             init_response=None,
             output_schema=request.output_schema,
             settings=_batch_to_scalar_dict(request.settings),
-            secrets={},
+            secrets=ResolvedSecrets(),
             storage=storage,
             auth_context=ctx.auth,
         )
@@ -3187,7 +3188,7 @@ def aggregate_streaming_chunk(
             init_response=None,
             output_schema=session.output_schema,
             settings={},
-            secrets={},
+            secrets=ResolvedSecrets(),
             storage=storage,
             auth_context=ctx.auth,
         )
@@ -3280,7 +3281,7 @@ def aggregate_streaming_close(
             init_response=None,
             output_schema=session.output_schema,
             settings={},
-            secrets={},
+            secrets=ResolvedSecrets(),
             storage=storage,
             auth_context=ctx.auth,
         )