Merge branch 'rightlib' into merge-libs-250425-0050

60 files changed, 460 insertions, 63 deletions

diff --git a/build/conf/java.conf b/build/conf/java.conf
index 8bf508fa5ad..31a84a38eca 100644
--- a/build/conf/java.conf
+++ b/build/conf/java.conf
@@ -181,6 +181,7 @@ multimodule JUNIT5 {
             PEERDIR+=devtools/jtest-annotations/junit5
         }
         SET(MODULE_TYPE JUNIT5)
+        SET(_SEM_JAR_TARGET junit5)
 
         when ($OPENSOURCE == "yes" && $AUTOCHECK == "yes") {
             # FIXME: Replace AUTOCHECK == yes with _not a host platform_ check after YMAKE-218
@@ -230,6 +231,7 @@ multimodule JTEST {
         .SEM=_BUILD_JUNIT4_JAR_SEM
         .IGNORED=JUNIT_TESTS_JAR
 
+        SET(_SEM_JAR_TARGET junit4)
         SET(MODULE_TYPE JTEST)
         DEPENDS(contrib/java/org/sonarsource/scanner/cli/sonar-scanner-cli/2.8)
 
@@ -978,9 +980,11 @@ _DO_GRADLE_EXPORT_PUBLISHING_SEM= \
     && publish_group $MAVEN_EXPORT_GROUP_ID \
     && publish_version $PUBLISH_MAVEN_VERSION
 
+_SEM_JAR_TARGET=jar
+
 _BUILD_JAR_SEM= \
     ${hide:TARGET} ${hide:AUTO_INPUT} ${hide:APPLIED_EXCLUDES} \
-    jar $MODDIR $REALPRJNAME \
+    $_SEM_JAR_TARGET $MODDIR $REALPRJNAME \
     && consumer-classpath $EXPORT_GRADLE_CLASSPATH \
     && consumer-jar ${MODDIR}/${REALPRJNAME}.jar \
     && consumer-type library \
diff --git a/build/export_generators/gradle/generator.toml b/build/export_generators/gradle/generator.toml
index 219ce56c108..be72a215542 100644
--- a/build/export_generators/gradle/generator.toml
+++ b/build/export_generators/gradle/generator.toml
@@ -16,6 +16,16 @@ template="build.gradle.kts.jinja"
 [targets.jar_proto]
 template={ path="build.gradle.kts.proto.jinja", dest="build.gradle.kts" }
 
+[targets.junit4]
+template="build.gradle.kts.jinja"
+is_test = true
+is_extra_target = true
+
+[targets.junit5]
+template="build.gradle.kts.jinja"
+is_test = true
+is_extra_target = true
+
 [attrs.target]
 # DEPRECATED
 annotation_processors="list"
diff --git a/build/export_generators/ide-gradle/generator.toml b/build/export_generators/ide-gradle/generator.toml
index e673c546993..e085cd71b68 100644
--- a/build/export_generators/ide-gradle/generator.toml
+++ b/build/export_generators/ide-gradle/generator.toml
@@ -19,6 +19,16 @@ template="build.gradle.kts.jinja"
 [targets.jar_proto]
 template={ path="build.gradle.kts.proto.jinja", dest="build.gradle.kts" }
 
+[targets.junit4]
+template="build.gradle.kts.jinja"
+is_test = true
+is_extra_target = true
+
+[targets.junit5]
+template="build.gradle.kts.jinja"
+is_test = true
+is_extra_target = true
+
 [attrs.target]
 # DEPRECATED
 annotation_processors="list"
diff --git a/build/mapping.conf.json b/build/mapping.conf.json
index e33ea5bba1b..8b25a45f0b0 100644
--- a/build/mapping.conf.json
+++ b/build/mapping.conf.json
@@ -533,6 +533,7 @@
         "8444524403": "{registry_endpoint}/8444524403",
         "8533025565": "{registry_endpoint}/8533025565",
         "8546855765": "{registry_endpoint}/8546855765",
+        "8580453620": "{registry_endpoint}/8580453620",
         "5486731632": "{registry_endpoint}/5486731632",
         "5514350352": "{registry_endpoint}/5514350352",
         "5514360398": "{registry_endpoint}/5514360398",
@@ -1913,6 +1914,7 @@
         "8444524403": "devtools/ya/test/programs/test_tool/bin/test_tool for linux",
         "8533025565": "devtools/ya/test/programs/test_tool/bin/test_tool for linux",
         "8546855765": "devtools/ya/test/programs/test_tool/bin/test_tool for linux",
+        "8580453620": "devtools/ya/test/programs/test_tool/bin/test_tool for linux",
         "5486731632": "devtools/ya/test/programs/test_tool/bin3/test_tool3 for linux",
         "5514350352": "devtools/ya/test/programs/test_tool/bin3/test_tool3 for linux",
         "5514360398": "devtools/ya/test/programs/test_tool/bin3/test_tool3 for linux",
diff --git a/build/platform/test_tool/host.ya.make.inc b/build/platform/test_tool/host.ya.make.inc
index 8c86c777b57..5501fadf6ae 100644
--- a/build/platform/test_tool/host.ya.make.inc
+++ b/build/platform/test_tool/host.ya.make.inc
@@ -1,12 +1,12 @@
 IF (HOST_OS_DARWIN AND HOST_ARCH_X86_64)
-    DECLARE_EXTERNAL_RESOURCE(TEST_TOOL_HOST sbr:8546878689)
+    DECLARE_EXTERNAL_RESOURCE(TEST_TOOL_HOST sbr:8580477217)
 ELSEIF (HOST_OS_DARWIN AND HOST_ARCH_ARM64)
-    DECLARE_EXTERNAL_RESOURCE(TEST_TOOL_HOST sbr:8546877294)
+    DECLARE_EXTERNAL_RESOURCE(TEST_TOOL_HOST sbr:8580474424)
 ELSEIF (HOST_OS_LINUX AND HOST_ARCH_X86_64)
-    DECLARE_EXTERNAL_RESOURCE(TEST_TOOL_HOST sbr:8546879788)
+    DECLARE_EXTERNAL_RESOURCE(TEST_TOOL_HOST sbr:8580481367)
 ELSEIF (HOST_OS_LINUX AND HOST_ARCH_AARCH64)
-    DECLARE_EXTERNAL_RESOURCE(TEST_TOOL_HOST sbr:8546876196)
+    DECLARE_EXTERNAL_RESOURCE(TEST_TOOL_HOST sbr:8580472105)
 ELSEIF (HOST_OS_WINDOWS AND HOST_ARCH_X86_64)
-    DECLARE_EXTERNAL_RESOURCE(TEST_TOOL_HOST sbr:8546879229)
+    DECLARE_EXTERNAL_RESOURCE(TEST_TOOL_HOST sbr:8580479319)
 
 ENDIF()
diff --git a/build/platform/test_tool/host_os.ya.make.inc b/build/platform/test_tool/host_os.ya.make.inc
index 756f227bae8..4882dfcfda5 100644
--- a/build/platform/test_tool/host_os.ya.make.inc
+++ b/build/platform/test_tool/host_os.ya.make.inc
@@ -1,12 +1,12 @@
 IF (HOST_OS_DARWIN AND HOST_ARCH_X86_64)
-    DECLARE_EXTERNAL_RESOURCE(TEST_TOOL_HOST sbr:8546854512)
+    DECLARE_EXTERNAL_RESOURCE(TEST_TOOL_HOST sbr:8580449857)
 ELSEIF (HOST_OS_DARWIN AND HOST_ARCH_ARM64)
-    DECLARE_EXTERNAL_RESOURCE(TEST_TOOL_HOST sbr:8546853960)
+    DECLARE_EXTERNAL_RESOURCE(TEST_TOOL_HOST sbr:8580447807)
 ELSEIF (HOST_OS_LINUX AND HOST_ARCH_X86_64)
-    DECLARE_EXTERNAL_RESOURCE(TEST_TOOL_HOST sbr:8546855765)
+    DECLARE_EXTERNAL_RESOURCE(TEST_TOOL_HOST sbr:8580453620)
 ELSEIF (HOST_OS_LINUX AND HOST_ARCH_AARCH64)
-    DECLARE_EXTERNAL_RESOURCE(TEST_TOOL_HOST sbr:8546853616)
+    DECLARE_EXTERNAL_RESOURCE(TEST_TOOL_HOST sbr:8580445392)
 ELSEIF (HOST_OS_WINDOWS AND HOST_ARCH_X86_64)
-    DECLARE_EXTERNAL_RESOURCE(TEST_TOOL_HOST sbr:8546854990)
+    DECLARE_EXTERNAL_RESOURCE(TEST_TOOL_HOST sbr:8580451778)
 
 ENDIF()
diff --git a/build/ymake_conf.py b/build/ymake_conf.py
index e3a2195ab19..cd4df284e8a 100755
--- a/build/ymake_conf.py
+++ b/build/ymake_conf.py
@@ -2525,7 +2525,7 @@ class CuDNN(object):
         self.cudnn_version = Setting('CUDNN_VERSION', auto=self.auto_cudnn_version)
 
     def have_cudnn(self):
-        return self.cudnn_version.value in ('7.6.5', '8.0.5', '8.6.0')
+        return self.cudnn_version.value in ('7.6.5', '8.0.5', '8.6.0', '8.9.7')
 
     def auto_cudnn_version(self):
         return '8.6.0'
diff --git a/library/cpp/yt/memory/ref_counted.h b/library/cpp/yt/memory/ref_counted.h
index 6abef3bf053..cd36b8a4044 100644
--- a/library/cpp/yt/memory/ref_counted.h
+++ b/library/cpp/yt/memory/ref_counted.h
@@ -63,7 +63,7 @@ public:
     bool WeakUnref() const;
 
 private:
-    // NB: Must we 64 bit as TAtomicIntrusivePtr grabs refs in 64K batches.
+    // NB: Must be 64 bit as TAtomicIntrusivePtr grabs refs in 64K batches.
     using TRefCount = i64;
     mutable std::atomic<TRefCount> StrongCount_ = 1;
     mutable std::atomic<TRefCount> WeakCount_ = 1;
diff --git a/util/generic/algorithm_ut.cpp b/util/generic/algorithm_ut.cpp
index 8609026797c..ee918233da8 100644
--- a/util/generic/algorithm_ut.cpp
+++ b/util/generic/algorithm_ut.cpp
@@ -754,7 +754,9 @@ Y_UNIT_TEST_SUITE(TAlgorithm) {
 
     Y_UNIT_TEST(MinMaxElementMovableKeys) {
         const TString strings[] = {"one", "two", "three", "four"};
-        struct TMoveOnlyKey: TString, TMoveOnly {
+        struct TMoveOnlyKey
+            : TString,
+              TMoveOnly {
             using TString::TString;
         };
         auto keyFn = [](TString s) { return TMoveOnlyKey{std::move(s)}; };
diff --git a/ya b/ya
index 08fd5ada2c3..234f34d8dc7 100755
--- a/ya
+++ b/ya
@@ -39,33 +39,33 @@ REGISTRY_ENDPOINT = os.environ.get("YA_REGISTRY_ENDPOINT", "https://devtools-reg
 PLATFORM_MAP = {
     "data": {
         "win32": {
-            "md5": "608b241c9a65c68179807b1e5ec1f71e",
+            "md5": "a25d0321d9337d096b82a83a2e2440d1",
             "urls": [
-                f"{REGISTRY_ENDPOINT}/8546858187"
+                f"{REGISTRY_ENDPOINT}/8580481207"
             ]
         },
         "darwin": {
-            "md5": "19e94413b5eb46a5d9517125efdeced8",
+            "md5": "6f0880ae22d26ce2d4c779817f28c419",
             "urls": [
-                f"{REGISTRY_ENDPOINT}/8546857643"
+                f"{REGISTRY_ENDPOINT}/8580479378"
             ]
         },
         "darwin-arm64": {
-            "md5": "b9b6f539ca6c791d66deec1f0d9bf0c9",
+            "md5": "38e18dd605e99f2bcb261a46c76eb7cb",
             "urls": [
-                f"{REGISTRY_ENDPOINT}/8546856435"
+                f"{REGISTRY_ENDPOINT}/8580477551"
             ]
         },
         "linux-aarch64": {
-            "md5": "0abf255a8dbd333461c70b6bbd805165",
+            "md5": "51967510c77ba3c7e2e3631cfd46f7f7",
             "urls": [
-                f"{REGISTRY_ENDPOINT}/8546855138"
+                f"{REGISTRY_ENDPOINT}/8580475435"
             ]
         },
         "linux": {
-            "md5": "c6e879a4d545de17ba013c247148e64b",
+            "md5": "24ab5119e2f04f84e0bcfdbf2679fc87",
             "urls": [
-                f"{REGISTRY_ENDPOINT}/8546858664"
+                f"{REGISTRY_ENDPOINT}/8580483288"
             ]
         }
     }
diff --git a/yql/essentials/cfg/tests/gateways-experimental.conf b/yql/essentials/cfg/tests/gateways-experimental.conf
index d1c09423481..391199eccd2 100644
--- a/yql/essentials/cfg/tests/gateways-experimental.conf
+++ b/yql/essentials/cfg/tests/gateways-experimental.conf
@@ -78,6 +78,11 @@ Yt {
         Name: "DQRPCReaderTimeout"
         Value: "600s"
     }
+
+    DefaultSettings {
+        Name: "_ForbidSensitiveDataInOperationSpec"
+        Value: "true"
+    }
 }
 
 Dq {
@@ -91,6 +96,7 @@ YqlCore {
     Flags {
         Name: "OptimizerFlags"
         Args: [
+            "EmitPruneKeys",
             "MemberNthOverFlatMap",
             "ExtractMembersSplitOnOptional",
             "FilterNullMembersOverJust",
diff --git a/yql/essentials/core/common_opt/yql_co_finalizers.cpp b/yql/essentials/core/common_opt/yql_co_finalizers.cpp
index c1fce215cf2..0e616abd9c1 100644
--- a/yql/essentials/core/common_opt/yql_co_finalizers.cpp
+++ b/yql/essentials/core/common_opt/yql_co_finalizers.cpp
@@ -300,7 +300,7 @@ bool AllConsumersAreUnordered(const TExprNode::TPtr& node, const TParentsMap& pa
 bool OptimizeForUnorderedConsumers(const TExprNode::TPtr& node, TNodeOnNodeOwnedMap& toOptimize, TExprContext& ctx, TOptimizeContext& optCtx) {
     static const char optName[] = "UnorderedOverSortImproved";
     YQL_ENSURE(optCtx.Types);
-    const bool optEnabled = IsOptimizerEnabled<optName>(*optCtx.Types) && !IsOptimizerDisabled<optName>(*optCtx.Types);
+    const bool optEnabled = !IsOptimizerDisabled<optName>(*optCtx.Types);
     if (!optEnabled) {
         return false;
     }
diff --git a/yql/essentials/core/common_opt/yql_co_flow2.cpp b/yql/essentials/core/common_opt/yql_co_flow2.cpp
index 8a7c25ddfe9..1bd95745579 100644
--- a/yql/essentials/core/common_opt/yql_co_flow2.cpp
+++ b/yql/essentials/core/common_opt/yql_co_flow2.cpp
@@ -2995,7 +2995,7 @@ void RegisterCoFlowCallables2(TCallableOptimizerMap& map) {
 
         static const char optName[] = "UnorderedOverSortImproved";
         YQL_ENSURE(optCtx.Types);
-        const bool optEnabled = IsOptimizerEnabled<optName>(*optCtx.Types) && !IsOptimizerDisabled<optName>(*optCtx.Types);
+        const bool optEnabled = !IsOptimizerDisabled<optName>(*optCtx.Types);
 
         if (!optEnabled && node->Head().IsCallable({"Sort", "AssumeSorted"})) {
             // if optEnabled this action is performed in yql_co_simple1.cpp (without multiusage check)
diff --git a/yql/essentials/core/common_opt/yql_co_simple1.cpp b/yql/essentials/core/common_opt/yql_co_simple1.cpp
index 1275e4e4d3b..f109c4fb289 100644
--- a/yql/essentials/core/common_opt/yql_co_simple1.cpp
+++ b/yql/essentials/core/common_opt/yql_co_simple1.cpp
@@ -4002,7 +4002,7 @@ void RegisterCoSimpleCallables1(TCallableOptimizerMap& map) {
     map["FilterNullMembers"] = [](const TExprNode::TPtr& node, TExprContext& ctx, TOptimizeContext& optCtx) {
         YQL_ENSURE(optCtx.Types);
         static const char optName[] = "FilterNullMembersOverJust";
-        if (!IsOptimizerEnabled<optName>(*optCtx.Types) || IsOptimizerDisabled<optName>(*optCtx.Types)) {
+        if (IsOptimizerDisabled<optName>(*optCtx.Types)) {
             return node;
         }
         const auto self = TCoFilterNullMembers(node);
@@ -6229,7 +6229,7 @@ void RegisterCoSimpleCallables1(TCallableOptimizerMap& map) {
 
         static const char optName[] = "UnorderedOverSortImproved";
         YQL_ENSURE(optCtx.Types);
-        const bool optEnabled = IsOptimizerEnabled<optName>(*optCtx.Types) && !IsOptimizerDisabled<optName>(*optCtx.Types);
+        const bool optEnabled = !IsOptimizerDisabled<optName>(*optCtx.Types);
         if (optEnabled) {
             if (node->Head().IsCallable(node->Content()) ||
                 node->Head().IsCallable("Sort") && node->IsCallable("Unordered"))
diff --git a/yql/essentials/core/issue/protos/issue_id.proto b/yql/essentials/core/issue/protos/issue_id.proto
index a84eb6fac3a..47d09e2c823 100644
--- a/yql/essentials/core/issue/protos/issue_id.proto
+++ b/yql/essentials/core/issue/protos/issue_id.proto
@@ -113,6 +113,7 @@ message TIssuesIds {
         YT_MISSING_PROTO_FIELD = 3017;
         YT_FOLDER_INPUT_IS_NOT_A_FOLDER = 3018;
         YT_SECURE_DATA_IN_COMMON_TMP = 3019;
+        YT_OP_SPEC_CONTAINS_SECRETS = 3020;
 
 // yql parser warnings
         YQL_PRAGMA_WARNING_MSG = 4500;
diff --git a/yql/essentials/core/issue/yql_issue.txt b/yql/essentials/core/issue/yql_issue.txt
index 08e3cfb2e61..a2ac582aa64 100644
--- a/yql/essentials/core/issue/yql_issue.txt
+++ b/yql/essentials/core/issue/yql_issue.txt
@@ -644,6 +644,10 @@ ids {
   severity: S_ERROR
 }
 ids {
+  code: YT_OP_SPEC_CONTAINS_SECRETS
+  severity: S_ERROR
+}
+ids {
   code: YQL_OFFSET_WITHOUT_SORT
   severity: S_WARNING
 }
diff --git a/yql/essentials/docs/en/syntax/insert_into.md b/yql/essentials/docs/en/syntax/insert_into.md
index 36b1287cdd7..c99f77e6795 100644
--- a/yql/essentials/docs/en/syntax/insert_into.md
+++ b/yql/essentials/docs/en/syntax/insert_into.md
@@ -9,13 +9,13 @@ The table is searched by name in the database specified by the [USE](use.md) ope
 * Adding constant values using [`VALUES`](values.md).
 
   ```yql
-  INSERT INTO my_table (Key1, Key2, Value1, Value2)
+  INSERT INTO my_table (Column1, Column2, Column3, Column4)
   VALUES (345987,'ydb', 'Pied piper', 1414);
   COMMIT;
   ```
 
   ```yql
-  INSERT INTO my_table (key, value)
+  INSERT INTO my_table (Column1, Column2)
   VALUES ("foo", 1), ("bar", 2);
   ```
 
@@ -23,11 +23,16 @@ The table is searched by name in the database specified by the [USE](use.md) ope
 
   ```yql
   INSERT INTO my_table
-  SELECT Key AS Key1, "Empty" AS Key2, Value AS Value1
-  FROM my_table1;
+  SELECT SourceTableColumn1 AS MyTableColumn1, "Empty" AS MyTableColumn2, SourceTableColumn2 AS MyTableColumn3
+  FROM source_table;
   ```
 
+## Using modifiers
+
 Inserts can be made with one or more modifiers. A modifier is specified after the `WITH` keyword following the table name: `INSERT INTO ... WITH SOME_HINT`.
-If a modifier has a value, it's indicated after the `=` sign: `INSERT INTO ... WITH SOME_HINT=value`.
-If necessary, specify multiple modifiers, they should be enclosed in parentheses: `INSERT INTO ... WITH (SOME_HINT1=value, SOME_HINT2, SOME_HINT3=value)`.
+
+The following rules apply when working with modifiers:
+
+- If a modifier has a value, it's indicated after the `=` sign: `INSERT INTO ... WITH SOME_HINT=value`.
+- If necessary, specify multiple modifiers, they should be enclosed in parentheses: `INSERT INTO ... WITH (SOME_HINT1=value, SOME_HINT2, SOME_HINT3=value)`.
 
diff --git a/yql/essentials/docs/ru/syntax/insert_into.md b/yql/essentials/docs/ru/syntax/insert_into.md
index 717bc051f98..d9dbc479c06 100644
--- a/yql/essentials/docs/ru/syntax/insert_into.md
+++ b/yql/essentials/docs/ru/syntax/insert_into.md
@@ -3,31 +3,35 @@
 
 Добавляет строки в таблицу.
 
-Таблица по имени ищется в базе данных, заданной оператором [USE](use.md).
+Таблица ищется по имени в базе данных, заданной оператором [USE](use.md).
 
 `INSERT INTO` позволяет выполнять следующие операции:
 
-* Добавление константных значений с помощью [`VALUES`](values.md).
+* Добавлять константные значения с помощью [`VALUES`](values.md).
 
   ```yql
-  INSERT INTO my_table (Key1, Key2, Value1, Value2)
+  INSERT INTO my_table (Column1, Column2, Column3, Column4)
   VALUES (345987,'ydb', 'Яблочный край', 1414);
   COMMIT;
   ```
 
   ```yql
-  INSERT INTO my_table (key, value)
+  INSERT INTO my_table (Column1, Column2)
   VALUES ("foo", 1), ("bar", 2);
   ```
 
-* Сохранение результата выборки `SELECT`.
+* Сохранять результаты выборки `SELECT`.
 
   ```yql
   INSERT INTO my_table
-  SELECT Key AS Key1, "Empty" AS Key2, Value AS Value1
-  FROM my_table1;
+  SELECT SourceTableColumn1 AS MyTableColumn1, "Empty" AS MyTableColumn2, SourceTableColumn2 AS MyTableColumn3
+  FROM source_table;
   ```
 
+## Использование модификаторов
+
 Запись может выполняться с одним или несколькими модификаторами. Модификатор указывается после ключевого слова `WITH` после имени таблицы: `INSERT INTO ... WITH SOME_HINT`.
-Если у модификатора есть значение, то оно указывается после знака `=`: `INSERT INTO ... WITH SOME_HINT=value`.
-Если необходимо указать несколько модификаторов, то они заключаются в круглые скобки: `INSERT INTO ... WITH (SOME_HINT1=value, SOME_HINT2, SOME_HINT3=value)`.
+
+Действуют следующие правила:
+- Если у модификатора есть значение, то оно указывается после знака `=`: `INSERT INTO ... WITH SOME_HINT=value`.
+- Если необходимо указать несколько модификаторов, то они заключаются в круглые скобки: `INSERT INTO ... WITH (SOME_HINT1=value, SOME_HINT2, SOME_HINT3=value)`.
diff --git a/yql/essentials/minikql/benchmark/pack_num/metrics/ya.make b/yql/essentials/minikql/benchmark/pack_num/metrics/ya.make
index 2573d870dd0..6b0630785c3 100644
--- a/yql/essentials/minikql/benchmark/pack_num/metrics/ya.make
+++ b/yql/essentials/minikql/benchmark/pack_num/metrics/ya.make
@@ -16,6 +16,5 @@ DEPENDS(
     yql/essentials/minikql/benchmark/pack_num
 )
 
-INCLUDE(${ARCADIA_ROOT}/devtools/large_on_multi_slots.inc)
 
 END()
diff --git a/yql/essentials/minikql/benchmark/pack_num/ya.make b/yql/essentials/minikql/benchmark/pack_num/ya.make
index 32397ee8e13..d0247fd9db9 100644
--- a/yql/essentials/minikql/benchmark/pack_num/ya.make
+++ b/yql/essentials/minikql/benchmark/pack_num/ya.make
@@ -16,6 +16,5 @@ SRCS(
     pack_num_bench.cpp
 )
 
-INCLUDE(${ARCADIA_ROOT}/devtools/large_on_multi_slots.inc)
 
 END()
diff --git a/yql/essentials/minikql/mkql_type_builder.cpp b/yql/essentials/minikql/mkql_type_builder.cpp
index 59c00d17ebc..f6e529a4a37 100644
--- a/yql/essentials/minikql/mkql_type_builder.cpp
+++ b/yql/essentials/minikql/mkql_type_builder.cpp
@@ -1660,6 +1660,12 @@ bool ConvertArrowTypeImpl(TType* itemType, std::shared_ptr<arrow::DataType>& typ
         return true;
     }
 
+    if (itemType->IsTagged()) {
+        auto taggedType = AS_TYPE(TTaggedType, itemType);
+        auto baseType = taggedType->GetBaseType();
+        return ConvertArrowTypeImpl(baseType, type, onFail, output);
+    }
+
     if (IsSingularType(unpacked)) {
         type = arrow::null();
         return true;
@@ -2562,6 +2568,11 @@ size_t CalcMaxBlockItemSize(const TType* type) {
         return 0;
     }
 
+    if (type->IsTagged()) {
+        auto taggedType = AS_TYPE(TTaggedType, type);
+        return CalcMaxBlockItemSize(taggedType->GetBaseType());
+    }
+
     if (type->IsData()) {
         auto slot = *AS_TYPE(TDataType, type)->GetDataSlot();
         switch (slot) {
diff --git a/yql/essentials/minikql/mkql_type_builder_ut.cpp b/yql/essentials/minikql/mkql_type_builder_ut.cpp
index 95d47795df7..f74808e4651 100644
--- a/yql/essentials/minikql/mkql_type_builder_ut.cpp
+++ b/yql/essentials/minikql/mkql_type_builder_ut.cpp
@@ -40,6 +40,7 @@ private:
         UNIT_TEST(TestDataTypeFormat);
         UNIT_TEST(TestBlockTypeFormat);
         UNIT_TEST(TestArrowType);
+        UNIT_TEST(TestArrowTaggedType);
     UNIT_TEST_SUITE_END();
 
     TString FormatType(NUdf::TType* t) {
@@ -148,8 +149,8 @@ private:
 
     void TestTaggedTypeFormat() {
         {
-            auto s = FormatType(FunctionTypeInfoBuilder.Tagged(FunctionTypeInfoBuilder.SimpleType<i8>(), "my_resource"));
-            UNIT_ASSERT_VALUES_EQUAL(s, "Tagged<Int8,'my_resource'>");
+            auto s = FormatType(FunctionTypeInfoBuilder.Tagged(FunctionTypeInfoBuilder.SimpleType<i8>(), "my_tag"));
+            UNIT_ASSERT_VALUES_EQUAL(s, "Tagged<Int8,'my_tag'>");
         }
     }
 
@@ -348,6 +349,17 @@ private:
         auto atype2 = TypeInfoHelper->ImportArrowType(&s);
         UNIT_ASSERT_VALUES_EQUAL(static_cast<TArrowType*>(atype2.Get())->GetType()->ToString(), std::string("uint64"));
     }
+
+    void TestArrowTaggedType() {
+        auto type = FunctionTypeInfoBuilder.Tagged(FunctionTypeInfoBuilder.SimpleType<ui64>(), "my_tag");
+        auto atype1 = TypeInfoHelper->MakeArrowType(type);
+        UNIT_ASSERT(atype1);
+        UNIT_ASSERT_VALUES_EQUAL(static_cast<TArrowType*>(atype1.Get())->GetType()->ToString(), std::string("uint64"));
+        ArrowSchema s;
+        atype1->Export(&s);
+        auto atype2 = TypeInfoHelper->ImportArrowType(&s);
+        UNIT_ASSERT_VALUES_EQUAL(static_cast<TArrowType*>(atype2.Get())->GetType()->ToString(), std::string("uint64"));
+    }
 };
 
 UNIT_TEST_SUITE_REGISTRATION(TMiniKQLTypeBuilderTest);
diff --git a/yql/essentials/parser/pg_wrapper/test/ya.make b/yql/essentials/parser/pg_wrapper/test/ya.make
index 22ee755f7c3..01a9249fd90 100644
--- a/yql/essentials/parser/pg_wrapper/test/ya.make
+++ b/yql/essentials/parser/pg_wrapper/test/ya.make
@@ -10,7 +10,6 @@ IF (SANITIZER_TYPE OR WITH_VALGRIND)
     TIMEOUT(1800)
     SIZE(LARGE)
     TAG(ya:fat sb:ttl=2)
-    INCLUDE(${ARCADIA_ROOT}/devtools/large_on_multi_slots.inc)
 ELSE()
     TIMEOUT(600)
     SIZE(MEDIUM)
diff --git a/yql/essentials/public/udf/arrow/dispatch_traits.h b/yql/essentials/public/udf/arrow/dispatch_traits.h
index 87c25b93f56..93d7084296e 100644
--- a/yql/essentials/public/udf/arrow/dispatch_traits.h
+++ b/yql/essentials/public/udf/arrow/dispatch_traits.h
@@ -84,8 +84,9 @@ std::unique_ptr<typename TTraits::TResult> DispatchByArrowTraits(const ITypeInfo
         isOptional = true;
     }
 
+    unpacked = SkipTaggedType(typeInfoHelper, unpacked);
+
     TOptionalTypeInspector unpackedOpt(typeInfoHelper, unpacked);
-    TPgTypeInspector unpackedPg(typeInfoHelper, unpacked);
     if (unpackedOpt || (typeOpt && NeedWrapWithExternalOptional(typeInfoHelper, unpacked))) {
         ui32 nestLevel = 0;
         auto currentType = type;
@@ -97,6 +98,9 @@ std::unique_ptr<typename TTraits::TResult> DispatchByArrowTraits(const ITypeInfo
             types.push_back(currentType);
             TOptionalTypeInspector currentOpt(typeInfoHelper, currentType);
             currentType = currentOpt.GetItemType();
+
+            currentType = SkipTaggedType(typeInfoHelper, currentType);
+
             TOptionalTypeInspector nexOpt(typeInfoHelper, currentType);
             if (!nexOpt) {
                 break;
diff --git a/yql/essentials/public/udf/arrow/ut/array_builder_ut.cpp b/yql/essentials/public/udf/arrow/ut/array_builder_ut.cpp
index d0851c5e869..117ebad40c7 100644
--- a/yql/essentials/public/udf/arrow/ut/array_builder_ut.cpp
+++ b/yql/essentials/public/udf/arrow/ut/array_builder_ut.cpp
@@ -56,6 +56,57 @@ Y_UNIT_TEST_SUITE(TArrayBuilderTest) {
             "Expected equal values after building array");
     }
 
+    Y_UNIT_TEST(TestTaggedTypeBuilder) {
+        TArrayBuilderTestData data;
+        const auto intType = data.PgmBuilder.NewDataType(NUdf::EDataSlot::Int32, false);
+        const auto taggedType = data.PgmBuilder.NewTaggedType(intType, "tag");
+
+        const auto arrayBuilder = MakeArrayBuilder(NMiniKQL::TTypeInfoHelper(), taggedType, *data.ArrowPool, MAX_BLOCK_SIZE, /*pgBuilder=*/nullptr);
+
+        TUnboxedValue testData = TUnboxedValuePod(123);
+
+        arrayBuilder->Add(testData);
+
+        auto datum = arrayBuilder->Build(true);
+
+        UNIT_ASSERT(datum.is_array());
+        UNIT_ASSERT_VALUES_EQUAL(datum.length(), 1);
+
+        auto value = datum.array()->buffers[1];
+
+        UNIT_ASSERT_VALUES_EQUAL(*reinterpret_cast<int32_t*>(value->address()), 123);
+    }
+
+    Y_UNIT_TEST(TestTaggedTypeReader) {
+        TArrayBuilderTestData data;
+        const auto intType = data.PgmBuilder.NewDataType(NUdf::EDataSlot::Int32, false);
+        const auto taggedType = data.PgmBuilder.NewTaggedType(intType, "tag");
+
+        const auto arrayBuilder = MakeArrayBuilder(NMiniKQL::TTypeInfoHelper(), taggedType, *data.ArrowPool, MAX_BLOCK_SIZE, /*pgBuilder=*/nullptr);
+
+        TUnboxedValue first = TUnboxedValuePod(123);
+        TUnboxedValue second = TUnboxedValuePod(456);
+
+        arrayBuilder->Add(first);
+        arrayBuilder->Add(second);
+
+        auto datum = arrayBuilder->Build(true);
+
+        UNIT_ASSERT(datum.is_array());
+        UNIT_ASSERT_VALUES_EQUAL(datum.length(), 2);
+
+        const auto blockReader = MakeBlockReader(NMiniKQL::TTypeInfoHelper(), taggedType);
+
+        const auto item1AfterRead = blockReader->GetItem(*datum.array(), 0);
+        const auto item2AfterRead = blockReader->GetItem(*datum.array(), 1);
+
+        UNIT_ASSERT_C(item1AfterRead.HasValue(), "Expected not null");
+        UNIT_ASSERT_C(item2AfterRead.HasValue(), "Expected not null");
+
+        UNIT_ASSERT_VALUES_EQUAL(item1AfterRead.Get<int>(), 123);
+        UNIT_ASSERT_VALUES_EQUAL(item2AfterRead.Get<int>(), 456);
+    }
+
     extern const char ResourceName[] = "Resource.Name";
     Y_UNIT_TEST(TestDtorCall) {
         TArrayBuilderTestData data;
diff --git a/yql/essentials/public/udf/arrow/util.cpp b/yql/essentials/public/udf/arrow/util.cpp
index 169a809d0b6..7fa2103bfd4 100644
--- a/yql/essentials/public/udf/arrow/util.cpp
+++ b/yql/essentials/public/udf/arrow/util.cpp
@@ -169,5 +169,15 @@ ui64 GetSizeOfArrowExecBatchInBytes(const arrow::compute::ExecBatch& batch) {
 
     return size;
 }
+
+const TType* SkipTaggedType(const ITypeInfoHelper& typeInfoHelper, const TType* type) {
+    TTaggedTypeInspector typeTagged(typeInfoHelper, type);
+    while (typeTagged) {
+        type = typeTagged.GetBaseType();
+        typeTagged = TTaggedTypeInspector(typeInfoHelper, type);
+    }
+
+    return type;
+}
 }
 }
diff --git a/yql/essentials/public/udf/arrow/util.h b/yql/essentials/public/udf/arrow/util.h
index ea9033b35c6..a4e430aa4ad 100644
--- a/yql/essentials/public/udf/arrow/util.h
+++ b/yql/essentials/public/udf/arrow/util.h
@@ -248,7 +248,11 @@ inline bool IsSingularType(const ITypeInfoHelper& typeInfoHelper, const TType* t
            kind == ETypeKind::EmptyList;
 }
 
+const TType* SkipTaggedType(const ITypeInfoHelper& typeInfoHelper, const TType* type);
+
 inline bool NeedWrapWithExternalOptional(const ITypeInfoHelper& typeInfoHelper, const TType* type) {
+    type = SkipTaggedType(typeInfoHelper, type);
+
     return TPgTypeInspector(typeInfoHelper, type) || IsSingularType(typeInfoHelper, type);
 }
 
diff --git a/yql/essentials/tests/s-expressions/minirun/pure.make b/yql/essentials/tests/s-expressions/minirun/pure.make
index 64002f529d1..591583714cb 100644
--- a/yql/essentials/tests/s-expressions/minirun/pure.make
+++ b/yql/essentials/tests/s-expressions/minirun/pure.make
@@ -16,7 +16,6 @@ IF (SANITIZER_TYPE OR WITH_VALGRIND)
     TAG(
         ya:fat
         sb:ttl=2
-        ya:large_tests_on_multi_slots
     )
 ELSE()
     TIMEOUT(600)
diff --git a/yql/essentials/tests/sql/minirun/part4/canondata/result.json b/yql/essentials/tests/sql/minirun/part4/canondata/result.json
index d789b72b125..214ceb66734 100644
--- a/yql/essentials/tests/sql/minirun/part4/canondata/result.json
+++ b/yql/essentials/tests/sql/minirun/part4/canondata/result.json
@@ -1074,9 +1074,9 @@
     ],
     "test.test[pg-join_brackets2-default.txt-Debug]": [
         {
-            "checksum": "762758513e739959f8275294a2dd1130",
-            "size": 11674,
-            "uri": "https://{canondata_backend}/1942100/9612d32b93424452bb3f40592b19e89f4235ecdc/resource.tar.gz#test.test_pg-join_brackets2-default.txt-Debug_/opt.yql"
+            "checksum": "1709dd973da95e580dd2744f8b2eace7",
+            "size": 11516,
+            "uri": "https://{canondata_backend}/1814674/0145682e1eceb2f221036f5a70c8223fb5e71378/resource.tar.gz#test.test_pg-join_brackets2-default.txt-Debug_/opt.yql"
         }
     ],
     "test.test[pg-join_brackets2-default.txt-Results]": [
diff --git a/yql/essentials/tests/sql/minirun/part8/canondata/result.json b/yql/essentials/tests/sql/minirun/part8/canondata/result.json
index 43ee13546b2..594491392db 100644
--- a/yql/essentials/tests/sql/minirun/part8/canondata/result.json
+++ b/yql/essentials/tests/sql/minirun/part8/canondata/result.json
@@ -929,6 +929,20 @@
             "uri": "https://{canondata_backend}/1600758/e19ffc8677d8f7ce11076554c3082ee5be112fdb/resource.tar.gz#test.test_flexible_types-group_by-default.txt-Results_/results.txt"
         }
     ],
+    "test.test[join-yql-19731-default.txt-Debug]": [
+        {
+            "checksum": "176315e3d36000d21b5d5b939996e7f4",
+            "size": 2888,
+            "uri": "https://{canondata_backend}/1937001/da1ea5a7d11a19173bf93def1ae0c375e45eef7f/resource.tar.gz#test.test_join-yql-19731-default.txt-Debug_/opt.yql"
+        }
+    ],
+    "test.test[join-yql-19731-default.txt-Results]": [
+        {
+            "checksum": "48966be23efcb73a79c9225652701052",
+            "size": 696,
+            "uri": "https://{canondata_backend}/1937001/da1ea5a7d11a19173bf93def1ae0c375e45eef7f/resource.tar.gz#test.test_join-yql-19731-default.txt-Results_/results.txt"
+        }
+    ],
     "test.test[join-yql-6297-default.txt-Debug]": [
         {
             "checksum": "33b8328c188e492433bc52ac8b82f26f",
diff --git a/yql/essentials/tests/sql/minirun/part9/canondata/result.json b/yql/essentials/tests/sql/minirun/part9/canondata/result.json
index bb5e04c3a37..35ae2060bec 100644
--- a/yql/essentials/tests/sql/minirun/part9/canondata/result.json
+++ b/yql/essentials/tests/sql/minirun/part9/canondata/result.json
@@ -767,9 +767,9 @@
     ],
     "test.test[join-left_join_with_self_aggr-default.txt-Debug]": [
         {
-            "checksum": "ff7d2593dd011f79c32819748d958e79",
-            "size": 1857,
-            "uri": "https://{canondata_backend}/1881367/b447b7877567a6d1a91f839b5ff599806e6ee35f/resource.tar.gz#test.test_join-left_join_with_self_aggr-default.txt-Debug_/opt.yql"
+            "checksum": "f7815acd195d1009991c6589bc3a2683",
+            "size": 1760,
+            "uri": "https://{canondata_backend}/1880306/48d8cfd19549a271ec38ba49caef6a03a74f487e/resource.tar.gz#test.test_join-left_join_with_self_aggr-default.txt-Debug_/opt.yql"
         }
     ],
     "test.test[join-left_join_with_self_aggr-default.txt-Results]": [
diff --git a/yql/essentials/tests/sql/minirun/pure.make b/yql/essentials/tests/sql/minirun/pure.make
index 9045ab914a8..e76272da52d 100644
--- a/yql/essentials/tests/sql/minirun/pure.make
+++ b/yql/essentials/tests/sql/minirun/pure.make
@@ -14,7 +14,6 @@ IF (SANITIZER_TYPE OR WITH_VALGRIND)
     TIMEOUT(1800)
     SIZE(LARGE)
     TAG(ya:fat sb:ttl=2)
-    INCLUDE(${ARCADIA_ROOT}/devtools/large_on_multi_slots.inc)
 ELSE()
     TIMEOUT(600)
     SIZE(MEDIUM)
diff --git a/yql/essentials/tests/sql/sql2yql/canondata/result.json b/yql/essentials/tests/sql/sql2yql/canondata/result.json
index a346e609f65..dd80cad3ba4 100644
--- a/yql/essentials/tests/sql/sql2yql/canondata/result.json
+++ b/yql/essentials/tests/sql/sql2yql/canondata/result.json
@@ -3961,6 +3961,13 @@
             "uri": "https://{canondata_backend}/1937367/af84d06d0fb3153f82b596e7db07f2186d2ec3a2/resource.tar.gz#test_sql2yql.test_join-yql-19192_/sql.yql"
         }
     ],
+    "test_sql2yql.test[join-yql-19731]": [
+        {
+            "checksum": "4406d74deb57924adc9bbc0657e68c53",
+            "size": 3584,
+            "uri": "https://{canondata_backend}/212715/e102f70d9232d825c746de10ca1c287eb99f76ad/resource.tar.gz#test_sql2yql.test_join-yql-19731_/sql.yql"
+        }
+    ],
     "test_sql2yql.test[join-yql-6199]": [
         {
             "checksum": "5421f92ec269e5d76133e1ca54b6d0d0",
@@ -10284,6 +10291,11 @@
             "uri": "file://test_sql_format.test_join-yql-19192_/formatted.sql"
         }
     ],
+    "test_sql_format.test[join-yql-19731]": [
+        {
+            "uri": "file://test_sql_format.test_join-yql-19731_/formatted.sql"
+        }
+    ],
     "test_sql_format.test[join-yql-6199]": [
         {
             "uri": "file://test_sql_format.test_join-yql-6199_/formatted.sql"
diff --git a/yql/essentials/tests/sql/sql2yql/canondata/test_sql_format.test_join-yql-19731_/formatted.sql b/yql/essentials/tests/sql/sql2yql/canondata/test_sql_format.test_join-yql-19731_/formatted.sql
new file mode 100644
index 00000000000..3da4098d5ac
--- /dev/null
+++ b/yql/essentials/tests/sql/sql2yql/canondata/test_sql_format.test_join-yql-19731_/formatted.sql
@@ -0,0 +1,45 @@
+PRAGMA FilterPushdownOverJoinOptionalSide;
+
+$data = AsList(
+    AsStruct(Just('aaa') AS key),
+    AsStruct(Just('bbb') AS key),
+    AsStruct(NULL AS key)
+);
+
+$t1 = (
+    SELECT
+        data.key AS t1_key,
+        1 AS t1_value
+    FROM
+        AS_TABLE($data) AS data
+);
+
+$t2 = (
+    SELECT
+        data.key AS t2_key
+    FROM
+        AS_TABLE($data) AS data
+);
+
+$t3 = (
+    SELECT
+        data.key AS t3_key
+    FROM
+        AS_TABLE($data) AS data
+);
+
+SELECT
+    t1_value
+FROM
+    $t1 AS t1
+LEFT JOIN
+    $t2 AS t2
+ON
+    (t2.t2_key == t1.t1_key)
+LEFT JOIN
+    $t3 AS t3
+ON
+    (t3.t3_key == t1.t1_key)
+WHERE
+    t1.t1_key == 'aaa' AND t2.t2_key == 'aaa' AND t3.t3_key == 'aaa'
+;
diff --git a/yql/essentials/tests/sql/sql2yql/ya.make b/yql/essentials/tests/sql/sql2yql/ya.make
index fd234dd8219..cff97cecd9e 100644
--- a/yql/essentials/tests/sql/sql2yql/ya.make
+++ b/yql/essentials/tests/sql/sql2yql/ya.make
@@ -15,7 +15,6 @@ IF (SANITIZER_TYPE)
     TIMEOUT(1800)
     SIZE(LARGE)
     TAG(ya:fat sb:ttl=2)
-    INCLUDE(${ARCADIA_ROOT}/devtools/large_on_multi_slots.inc)
 ELSE()
     TIMEOUT(600)
     SIZE(MEDIUM)
diff --git a/yql/essentials/tests/sql/suites/join/yql-19731.sql b/yql/essentials/tests/sql/suites/join/yql-19731.sql
new file mode 100644
index 00000000000..0555622112c
--- /dev/null
+++ b/yql/essentials/tests/sql/suites/join/yql-19731.sql
@@ -0,0 +1,45 @@
+PRAGMA FilterPushdownOverJoinOptionalSide;
+
+$data = AsList(
+    AsStruct(Just("aaa") AS key),
+    AsStruct(Just("bbb") AS key),
+    AsStruct(NULL AS key)
+);
+
+
+$t1 = (
+    SELECT
+        data.key AS t1_key,
+        1 AS t1_value
+    FROM
+        AS_TABLE($data) AS data
+);
+
+$t2 = (
+    SELECT
+        data.key AS t2_key
+    FROM
+        AS_TABLE($data) AS data
+);
+
+$t3 = (
+    SELECT
+        data.key AS t3_key
+    FROM
+        AS_TABLE($data) AS data
+);
+
+SELECT
+    t1_value
+FROM
+    $t1 AS t1
+LEFT JOIN
+    $t2 AS t2
+ON
+    (t2.t2_key == t1.t1_key)
+LEFT JOIN
+    $t3 AS t3
+ON
+    (t3.t3_key == t1.t1_key)
+WHERE
+    t1.t1_key == "aaa" AND t2.t2_key == "aaa" AND t3.t3_key == "aaa";
diff --git a/yql/essentials/types/binary_json/ut_benchmark/ya.make b/yql/essentials/types/binary_json/ut_benchmark/ya.make
index 01e22c5ac05..b4b94af4ecd 100644
--- a/yql/essentials/types/binary_json/ut_benchmark/ya.make
+++ b/yql/essentials/types/binary_json/ut_benchmark/ya.make
@@ -27,6 +27,5 @@ PEERDIR(
 
 YQL_LAST_ABI_VERSION()
 
-INCLUDE(${ARCADIA_ROOT}/devtools/large_on_multi_slots.inc)
 
 END()
diff --git a/yt/yql/providers/yt/common/yql_configuration.h b/yt/yql/providers/yt/common/yql_configuration.h
index 083504924e0..99bde583d47 100644
--- a/yt/yql/providers/yt/common/yql_configuration.h
+++ b/yt/yql/providers/yt/common/yql_configuration.h
@@ -134,4 +134,7 @@ constexpr bool DEFAULT_ALLOW_REMOTE_CLUSTER_INPUT = false;
 constexpr bool DEFAULT_USE_COLUMN_GROUPS_FROM_INPUT_TABLE = false;
 
 constexpr bool DEFAULT_USE_NATIVE_DYNAMIC_TABLE_READ = false;
+
+constexpr bool DEFAULT_FORBID_SENSITIVE_DATA_IN_OPERATION_SPEC = false;
+
 } // NYql
diff --git a/yt/yql/providers/yt/common/yql_yt_settings.cpp b/yt/yql/providers/yt/common/yql_yt_settings.cpp
index c6d0cb8dec9..a5d888f6d77 100644
--- a/yt/yql/providers/yt/common/yql_yt_settings.cpp
+++ b/yt/yql/providers/yt/common/yql_yt_settings.cpp
@@ -557,6 +557,7 @@ TYtConfiguration::TYtConfiguration(TTypeAnnotationContext& typeCtx)
     REGISTER_SETTING(*this, _AllowRemoteClusterInput);
     REGISTER_SETTING(*this, UseColumnGroupsFromInputTables);
     REGISTER_SETTING(*this, UseNativeDynamicTableRead);
+    REGISTER_SETTING(*this, _ForbidSensitiveDataInOperationSpec);
 }
 
 EReleaseTempDataMode GetReleaseTempDataMode(const TYtSettings& settings) {
diff --git a/yt/yql/providers/yt/common/yql_yt_settings.h b/yt/yql/providers/yt/common/yql_yt_settings.h
index 677472ecb5d..6b8d99fbd86 100644
--- a/yt/yql/providers/yt/common/yql_yt_settings.h
+++ b/yt/yql/providers/yt/common/yql_yt_settings.h
@@ -123,6 +123,7 @@ struct TYtSettings {
     NCommon::TConfSetting<bool, false> ForceTmpSecurity;
     NCommon::TConfSetting<ERuntimeClusterSelectionMode, false> RuntimeClusterSelection;
     NCommon::TConfSetting<TString, false> DefaultRuntimeCluster;
+    NCommon::TConfSetting<bool, false> _ForbidSensitiveDataInOperationSpec;
 
     // Job runtime
     NCommon::TConfSetting<TString, true> Pool;
diff --git a/yt/yql/providers/yt/gateway/native/ut/ya.make b/yt/yql/providers/yt/gateway/native/ut/ya.make
index 8dd7c9a3a7d..2c68c61ab7f 100644
--- a/yt/yql/providers/yt/gateway/native/ut/ya.make
+++ b/yt/yql/providers/yt/gateway/native/ut/ya.make
@@ -9,6 +9,7 @@ PEERDIR(
     yt/yql/providers/yt/gateway/file
     yt/yql/providers/yt/codec/codegen
     yt/yql/providers/yt/comp_nodes/llvm16
+    yt/yql/providers/yt/lib/secret_masker/dummy
     yt/yql/providers/yt/lib/ut_common
     library/cpp/testing/mock_server
     library/cpp/testing/common
@@ -21,4 +22,3 @@ PEERDIR(
 YQL_LAST_ABI_VERSION()
 
 END()
-
diff --git a/yt/yql/providers/yt/gateway/native/ut/yql_yt_native_folders_ut.cpp b/yt/yql/providers/yt/gateway/native/ut/yql_yt_native_folders_ut.cpp
index b08db52a500..e767b3237b9 100644
--- a/yt/yql/providers/yt/gateway/native/ut/yql_yt_native_folders_ut.cpp
+++ b/yt/yql/providers/yt/gateway/native/ut/yql_yt_native_folders_ut.cpp
@@ -1,5 +1,6 @@
 #include "library/cpp/testing/unittest/registar.h"
 #include <library/cpp/yson/node/node_io.h>
+#include <yt/yql/providers/yt/lib/secret_masker/dummy/dummy_secret_masker.h>
 #include <yt/yql/providers/yt/lib/ut_common/yql_ut_common.h>
 #include <library/cpp/testing/common/network.h>
 #include <library/cpp/testing/mock_server/server.h>
@@ -190,6 +191,7 @@ std::pair<TIntrusivePtr<TYtState>, IYtGateway::TPtr> InitTest(const NTesting::TP
     auto gatewaysConfig = MakeGatewaysConfig(port);
     nativeServices.Config = std::make_shared<TYtGatewayConfig>(gatewaysConfig.GetYt());
     nativeServices.FileStorage = CreateFileStorage(TFileStorageConfig{});
+    nativeServices.SecretMasker = CreateDummySecretMasker();
 
     auto ytGateway = CreateYtNativeGateway(nativeServices);
     auto ytState = MakeIntrusive<TYtState>(types);
diff --git a/yt/yql/providers/yt/gateway/native/ya.make b/yt/yql/providers/yt/gateway/native/ya.make
index c0bad18eebf..967557d118b 100644
--- a/yt/yql/providers/yt/gateway/native/ya.make
+++ b/yt/yql/providers/yt/gateway/native/ya.make
@@ -52,6 +52,7 @@ PEERDIR(
     yt/yql/providers/yt/lib/mkql_helpers
     yt/yql/providers/yt/lib/res_pull
     yt/yql/providers/yt/lib/schema
+    yt/yql/providers/yt/lib/secret_masker
     yt/yql/providers/yt/lib/skiff
     yt/yql/providers/yt/lib/url_mapper
     yt/yql/providers/yt/lib/yson_helpers
diff --git a/yt/yql/providers/yt/gateway/native/yql_yt_exec_ctx.cpp b/yt/yql/providers/yt/gateway/native/yql_yt_exec_ctx.cpp
index 9209cf86e67..6164b07004f 100644
--- a/yt/yql/providers/yt/gateway/native/yql_yt_exec_ctx.cpp
+++ b/yt/yql/providers/yt/gateway/native/yql_yt_exec_ctx.cpp
@@ -45,6 +45,7 @@ TExecContextBase::TExecContextBase(const TYtNativeServices& services,
     : FunctionRegistry_(services.FunctionRegistry)
     , FileStorage_(services.FileStorage)
     , Config_(services.Config)
+    , SecretMasker(services.SecretMasker)
     , Clusters_(clusters)
     , MkqlCompiler_(mkqlCompiler)
     , Session_(session)
diff --git a/yt/yql/providers/yt/gateway/native/yql_yt_exec_ctx.h b/yt/yql/providers/yt/gateway/native/yql_yt_exec_ctx.h
index 70459783d26..059af11397f 100644
--- a/yt/yql/providers/yt/gateway/native/yql_yt_exec_ctx.h
+++ b/yt/yql/providers/yt/gateway/native/yql_yt_exec_ctx.h
@@ -154,6 +154,7 @@ public:
     const NKikimr::NMiniKQL::IFunctionRegistry* FunctionRegistry_ = nullptr;
     TFileStoragePtr FileStorage_;
     TYtGatewayConfigPtr Config_;
+    ISecretMasker::TPtr SecretMasker;
     TConfigClusters::TPtr Clusters_;
     TIntrusivePtr<NCommon::TMkqlCommonCallableCompiler> MkqlCompiler_;
     TSession::TPtr Session_;
diff --git a/yt/yql/providers/yt/gateway/native/yql_yt_native.cpp b/yt/yql/providers/yt/gateway/native/yql_yt_native.cpp
index 5467508a59a..6a65dadebb8 100644
--- a/yt/yql/providers/yt/gateway/native/yql_yt_native.cpp
+++ b/yt/yql/providers/yt/gateway/native/yql_yt_native.cpp
@@ -2852,6 +2852,7 @@ private:
                 }
 
                 FillSpec(spec, *execCtx, entry, 0., Nothing(), flags);
+                CheckSpecForSecrets(spec, execCtx);
 
                 if (combineChunks) {
                     mergeSpec.CombineChunks(true);
@@ -3258,6 +3259,7 @@ private:
         NYT::TNode spec = execCtx->Session_->CreateSpecWithDesc(execCtx->CodeSnippets_);
         FillSpec(spec, *execCtx, entry, 0., Nothing(), EYtOpProp::WithMapper);
         spec["job_count"] = 1;
+        CheckSpecForSecrets(spec, execCtx);
 
         TOperationOptions opOpts;
         FillOperationOptions(opOpts, execCtx, entry);
@@ -3734,6 +3736,7 @@ private:
                 if (hasNonStrict) {
                     spec["schema_inference_mode"] = "from_output"; // YTADMINREQ-17692
                 }
+                CheckSpecForSecrets(spec, execCtx);
 
                 return execCtx->RunOperation([entry, sortOpSpec = std::move(sortOpSpec), spec = std::move(spec)](){
                     return entry->Tx->Sort(sortOpSpec, TOperationOptions().StartOperationMode(TOperationOptions::EStartOperationMode::AsyncPrepare).Spec(spec));
@@ -3818,6 +3821,7 @@ private:
                 }
 
                 PrepareInputQueryForMerge(spec, mergeOpSpec.Inputs_, inputQueryExpr, execCtx->Options_.Config());
+                CheckSpecForSecrets(spec, execCtx);
 
                 return execCtx->RunOperation([entry, mergeOpSpec = std::move(mergeOpSpec), spec = std::move(spec)](){
                     return entry->Tx->Merge(mergeOpSpec, TOperationOptions().StartOperationMode(TOperationOptions::EStartOperationMode::AsyncPrepare).Spec(spec));
@@ -4009,6 +4013,7 @@ private:
             }
 
             PrepareInputQueryForMap(spec, mapOpSpec, inputQueryExpr, execCtx->Options_.Config(), /*useSystemColumns*/ useSkiff);
+            CheckSpecForSecrets(spec, execCtx);
 
             TOperationOptions opOpts;
             FillOperationOptions(opOpts, execCtx, entry);
@@ -4220,6 +4225,7 @@ private:
             if (maxDataSizePerJob) {
                 spec["max_data_size_per_job"] = static_cast<i64>(*maxDataSizePerJob);
             }
+            CheckSpecForSecrets(spec, execCtx);
 
             TOperationOptions opOpts;
             FillOperationOptions(opOpts, execCtx, entry);
@@ -4516,6 +4522,7 @@ private:
             }
 
             PrepareInputQueryForMap(spec, mapReduceOpSpec, inputQueryExpr, execCtx->Options_.Config(), /*useSystemColumns*/ useSkiff);
+            CheckSpecForSecrets(spec, execCtx);
 
             TOperationOptions opOpts;
             FillOperationOptions(opOpts, execCtx, entry);
@@ -4666,6 +4673,7 @@ private:
             }
 
             PrepareInputQueryForMap(spec, mapReduceOpSpec, inputQueryExpr, execCtx->Options_.Config(), /*useSystemColumns*/ useSkiff);
+            CheckSpecForSecrets(spec, execCtx);
 
             TOperationOptions opOpts;
             FillOperationOptions(opOpts, execCtx, entry);
@@ -4998,6 +5006,7 @@ private:
             NYT::TNode spec = execCtx->Session_->CreateSpecWithDesc(execCtx->CodeSnippets_);
             FillSpec(spec, *execCtx, entry, extraUsage.Cpu, Nothing(),
                 EYtOpProp::TemporaryAutoMerge | EYtOpProp::WithMapper | EYtOpProp::WithUserJobs);
+            CheckSpecForSecrets(spec, execCtx);
 
             TOperationOptions opOpts;
             FillOperationOptions(opOpts, execCtx, entry);
@@ -5620,6 +5629,7 @@ private:
                 }
                 NYT::TNode spec = execCtx->Session_->CreateSpecWithDesc(execCtx->CodeSnippets_);
                 FillSpec(spec, *execCtx, entry, extraUsage.Cpu, Nothing(), EYtOpProp::WithMapper);
+                CheckSpecForSecrets(spec, execCtx);
 
                 PrepareTempDestination(tmpTable, execCtx, entry, entry->Tx);
 
diff --git a/yt/yql/providers/yt/gateway/native/yql_yt_native.h b/yt/yql/providers/yt/gateway/native/yql_yt_native.h
index 4ae23ac55da..81668c72884 100644
--- a/yt/yql/providers/yt/gateway/native/yql_yt_native.h
+++ b/yt/yql/providers/yt/gateway/native/yql_yt_native.h
@@ -1,6 +1,7 @@
 #pragma once
 
 #include <yt/yql/providers/yt/provider/yql_yt_gateway.h>
+#include <yt/yql/providers/yt/lib/secret_masker/secret_masker.h>
 
 #include <yql/essentials/core/file_storage/file_storage.h>
 #include <yql/essentials/minikql/mkql_function_registry.h>
@@ -21,6 +22,7 @@ struct TYtNativeServices {
     // allow anonymous access for tests
     bool DisableAnonymousClusterAccess = false;
     IMetricsRegistryPtr Metrics;
+    ISecretMasker::TPtr SecretMasker;
 };
 
 IYtGateway::TPtr CreateYtNativeGateway(const TYtNativeServices& services);
diff --git a/yt/yql/providers/yt/gateway/native/yql_yt_spec.cpp b/yt/yql/providers/yt/gateway/native/yql_yt_spec.cpp
index dae30d87341..96bb073c780 100644
--- a/yt/yql/providers/yt/gateway/native/yql_yt_spec.cpp
+++ b/yt/yql/providers/yt/gateway/native/yql_yt_spec.cpp
@@ -532,6 +532,33 @@ void FillSpec(NYT::TNode& spec,
     }
 }
 
+void CheckSpecForSecretsImpl(
+    const NYT::TNode& spec,
+    const ISecretMasker::TPtr& secretMasker,
+    const TYtSettings::TConstPtr& settings
+) {
+    if (!settings->_ForbidSensitiveDataInOperationSpec.Get().GetOrElse(DEFAULT_FORBID_SENSITIVE_DATA_IN_OPERATION_SPEC)) {
+        return;
+    }
+
+    YQL_ENSURE(secretMasker);
+
+    auto maskedSpecStr = NYT::NodeToYsonString(spec);
+    auto secrets = secretMasker->Mask(maskedSpecStr);
+    if (!secrets.empty()) {
+        auto maskedSpecStrBuf = TStringBuf(maskedSpecStr);
+
+        TVector<TString> maskedSecrets;
+        for (auto& secret : secrets) {
+            maskedSecrets.push_back(TStringBuilder() << "\"" << maskedSpecStrBuf.substr(secret.From, secret.Len) << "\"");
+        }
+
+        YQL_LOG_CTX_THROW TErrorException(TIssuesIds::YT_OP_SPEC_CONTAINS_SECRETS)
+            << "YT operation spec contains sensitive data (masked): "
+            << JoinSeq(", ", maskedSecrets);
+    }
+}
+
 void FillSecureVault(NYT::TNode& spec, const IYtGateway::TSecureParams& secureParams) {
     if (secureParams.empty()) {
         return;
diff --git a/yt/yql/providers/yt/gateway/native/yql_yt_spec.h b/yt/yql/providers/yt/gateway/native/yql_yt_spec.h
index 7e7941508e0..57132d2e57b 100644
--- a/yt/yql/providers/yt/gateway/native/yql_yt_spec.h
+++ b/yt/yql/providers/yt/gateway/native/yql_yt_spec.h
@@ -49,6 +49,12 @@ void FillSpec(NYT::TNode& spec,
     EYtOpProps opProps = 0,
     const TSet<TString>& addSecTags = {});
 
+void CheckSpecForSecretsImpl(
+    const NYT::TNode& spec,
+    const ISecretMasker::TPtr& secretMasker,
+    const TYtSettings::TConstPtr& settings
+);
+
 void FillSecureVault(NYT::TNode& spec, const IYtGateway::TSecureParams& secureParams);
 
 void FillUserJobSpecImpl(NYT::TUserJobSpec& spec,
@@ -124,6 +130,11 @@ inline void FillOperationOptions(NYT::TOperationOptions& opOpts,
     FillOperationOptionsImpl(opOpts, execCtx->Options_.Config(), entry);
 }
 
+template <class TExecParamsPtr>
+inline void CheckSpecForSecrets(const NYT::TNode& spec, const TExecParamsPtr& execCtx) {
+    CheckSpecForSecretsImpl(spec, execCtx->SecretMasker, execCtx->Options_.Config());
+}
+
 } // NNative
 
 } // NYql
diff --git a/yt/yql/providers/yt/lib/secret_masker/dummy/dummy_secret_masker.cpp b/yt/yql/providers/yt/lib/secret_masker/dummy/dummy_secret_masker.cpp
new file mode 100644
index 00000000000..40b8e139ec6
--- /dev/null
+++ b/yt/yql/providers/yt/lib/secret_masker/dummy/dummy_secret_masker.cpp
@@ -0,0 +1,22 @@
+#include "dummy_secret_masker.h"
+
+namespace NYql {
+
+class TDummySecretMasker : public ISecretMasker {
+public:
+    TSecretList Search(TStringBuf) override {
+        // Do nothing
+        return {};
+    }
+
+    TSecretList Mask(TString&) override {
+        // Do nothing
+        return {};
+    }
+};
+
+ISecretMasker::TPtr CreateDummySecretMasker() {
+    return MakeIntrusive<TDummySecretMasker>();
+}
+
+} // namespace NYql
diff --git a/yt/yql/providers/yt/lib/secret_masker/dummy/dummy_secret_masker.h b/yt/yql/providers/yt/lib/secret_masker/dummy/dummy_secret_masker.h
new file mode 100644
index 00000000000..f91f2358fa6
--- /dev/null
+++ b/yt/yql/providers/yt/lib/secret_masker/dummy/dummy_secret_masker.h
@@ -0,0 +1,9 @@
+#pragma once
+
+#include <yt/yql/providers/yt/lib/secret_masker/secret_masker.h>
+
+namespace NYql {
+
+ISecretMasker::TPtr CreateDummySecretMasker();
+
+} // namespace NYql
diff --git a/yt/yql/providers/yt/lib/secret_masker/dummy/ya.make b/yt/yql/providers/yt/lib/secret_masker/dummy/ya.make
new file mode 100644
index 00000000000..a3823c82b80
--- /dev/null
+++ b/yt/yql/providers/yt/lib/secret_masker/dummy/ya.make
@@ -0,0 +1,11 @@
+LIBRARY()
+
+SRCS(
+    dummy_secret_masker.cpp
+)
+
+PEERDIR(
+    yt/yql/providers/yt/lib/secret_masker
+)
+
+END()
diff --git a/yt/yql/providers/yt/lib/secret_masker/secret_masker.h b/yt/yql/providers/yt/lib/secret_masker/secret_masker.h
new file mode 100644
index 00000000000..993b0faef5f
--- /dev/null
+++ b/yt/yql/providers/yt/lib/secret_masker/secret_masker.h
@@ -0,0 +1,25 @@
+#pragma once
+
+#include <util/generic/ptr.h>
+#include <util/generic/string.h>
+#include <util/generic/vector.h>
+
+namespace NYql {
+
+struct TSecretPos {
+    size_t From;
+    size_t Len;
+};
+
+using TSecretList = TVector<TSecretPos>;
+
+class ISecretMasker : public TThrRefBase {
+public:
+    using TPtr = TIntrusivePtr<ISecretMasker>;
+
+    virtual ~ISecretMasker() = default;
+    virtual TSecretList Search(TStringBuf data) = 0;
+    virtual TSecretList Mask(TString& data) = 0;
+};
+
+} // namespace NYql
diff --git a/yt/yql/providers/yt/lib/secret_masker/ya.make b/yt/yql/providers/yt/lib/secret_masker/ya.make
new file mode 100644
index 00000000000..dec13ca568a
--- /dev/null
+++ b/yt/yql/providers/yt/lib/secret_masker/ya.make
@@ -0,0 +1,10 @@
+LIBRARY()
+END()
+
+RECURSE(
+    dummy
+)
+
+IF (NOT OPENSOURCE)
+    INCLUDE(ya_non_opensource.inc)
+ENDIF()
diff --git a/yt/yql/providers/yt/provider/yql_yt_physical_finalizing.cpp b/yt/yql/providers/yt/provider/yql_yt_physical_finalizing.cpp
index a24102fd0c2..7fb50451cfd 100644
--- a/yt/yql/providers/yt/provider/yql_yt_physical_finalizing.cpp
+++ b/yt/yql/providers/yt/provider/yql_yt_physical_finalizing.cpp
@@ -3013,7 +3013,7 @@ private:
                                 if (!groups.empty()) {
                                     groupSpec = NYT::TNode::CreateMap();
                                     // If we keep all groups then use the group with max size as default
-                                    if (allGroups && maxGrpIt != groups.end()) {
+                                    if (allGroups && maxGrpIt != groups.end() && (groups.size() > 1 || usage.FullUsage[i])) {
                                         groupSpec["default"] = NYT::TNode::CreateEntity();
                                         groups.erase(maxGrpIt);
                                     }
diff --git a/yt/yql/tools/ytrun/lib/ya.make b/yt/yql/tools/ytrun/lib/ya.make
index fc10024b330..8211271e01d 100644
--- a/yt/yql/tools/ytrun/lib/ya.make
+++ b/yt/yql/tools/ytrun/lib/ya.make
@@ -13,6 +13,7 @@ PEERDIR(
     yt/yql/providers/yt/lib/yt_download
     yt/yql/providers/yt/lib/yt_url_lister
     yt/yql/providers/yt/lib/log
+    yt/yql/providers/yt/lib/secret_masker/dummy
 
     yql/essentials/providers/common/provider
     yql/essentials/core/cbo
diff --git a/yt/yql/tools/ytrun/lib/ytrun_lib.cpp b/yt/yql/tools/ytrun/lib/ytrun_lib.cpp
index 25bda1b40fc..64eb2116908 100644
--- a/yt/yql/tools/ytrun/lib/ytrun_lib.cpp
+++ b/yt/yql/tools/ytrun/lib/ytrun_lib.cpp
@@ -6,6 +6,7 @@
 #include <yt/yql/providers/yt/lib/yt_download/yt_download.h>
 #include <yt/yql/providers/yt/lib/yt_url_lister/yt_url_lister.h>
 #include <yt/yql/providers/yt/lib/log/yt_logger.h>
+#include <yt/yql/providers/yt/lib/secret_masker/dummy/dummy_secret_masker.h>
 #include <yt/yql/providers/yt/gateway/native/yql_yt_native.h>
 #include <yt/yql/providers/yt/gateway/fmr/yql_yt_fmr.h>
 #include <yt/yql/providers/yt/fmr/fmr_tool_lib/yql_yt_fmr_initializer.h>
@@ -186,6 +187,7 @@ IYtGateway::TPtr TYtRunTool::CreateYtGateway() {
     services.FunctionRegistry = GetFuncRegistry().Get();
     services.FileStorage = GetFileStorage();
     services.Config = std::make_shared<TYtGatewayConfig>(GetRunOptions().GatewaysConfig->GetYt());
+    services.SecretMasker = CreateSecretMasker();
     auto ytGateway = CreateYtNativeGateway(services);
     if (!GetRunOptions().GatewayTypes.contains(NFmr::FastMapReduceGatewayName)) {
         return ytGateway;
@@ -204,6 +206,10 @@ IDqHelper::TPtr TYtRunTool::CreateDqHelper() {
     return {};
 }
 
+ISecretMasker::TPtr TYtRunTool::CreateSecretMasker() {
+    return CreateDummySecretMasker();
+}
+
 int TYtRunTool::DoMain(int argc, const char *argv[]) {
     // Init MR/YT for proper work of embedded agent
     NYT::Initialize(argc, argv);
diff --git a/yt/yql/tools/ytrun/lib/ytrun_lib.h b/yt/yql/tools/ytrun/lib/ytrun_lib.h
index b90fddcb6ba..36563b742ed 100644
--- a/yt/yql/tools/ytrun/lib/ytrun_lib.h
+++ b/yt/yql/tools/ytrun/lib/ytrun_lib.h
@@ -2,6 +2,7 @@
 
 #include <yt/yql/providers/yt/provider/yql_yt_gateway.h>
 #include <yt/yql/providers/yt/fmr/worker/impl/yql_yt_worker_impl.h>
+#include <yt/yql/providers/yt/lib/secret_masker/secret_masker.h>
 
 #include <yql/essentials/tools/yql_facade_run/yql_facade_run.h>
 #include <yql/essentials/core/cbo/cbo_optimizer_new.h>
@@ -24,6 +25,7 @@ protected:
     virtual IYtGateway::TPtr CreateYtGateway();
     virtual IOptimizerFactory::TPtr CreateCboFactory();
     virtual IDqHelper::TPtr CreateDqHelper();
+    virtual ISecretMasker::TPtr CreateSecretMasker();
 
 protected:
     TString MrJobBin_;
diff --git a/yt/yt/client/chunk_client/config.h b/yt/yt/client/chunk_client/config.h
index fffeac0b808..a9b899118bc 100644
--- a/yt/yt/client/chunk_client/config.h
+++ b/yt/yt/client/chunk_client/config.h
@@ -244,6 +244,8 @@ struct TReplicationReaderConfig
     //! Use request batcher to reduce the number of get blocks requests.
     bool UseReadBlocksBatcher;
 
+    std::optional<i64> BlockSetSubrequestThreshold;
+
     REGISTER_YSON_STRUCT(TReplicationReaderConfig);
 
     static void Register(TRegistrar registrar);
diff --git a/yt/yt/library/auth/credentials_injecting_channel.cpp b/yt/yt/library/auth/credentials_injecting_channel.cpp
index a08bd501468..d28f5207d52 100644
--- a/yt/yt/library/auth/credentials_injecting_channel.cpp
+++ b/yt/yt/library/auth/credentials_injecting_channel.cpp
@@ -272,8 +272,8 @@ public:
     }
 
 private:
-    IChannelFactoryPtr UnderlyingFactory_;
-    IServiceTicketAuthPtr ServiceTicketAuth_;
+    const IChannelFactoryPtr UnderlyingFactory_;
+    const IServiceTicketAuthPtr ServiceTicketAuth_;
 };
 
 ////////////////////////////////////////////////////////////////////////////////