deepline 0.3.124 → 0.3.126

package/dist/bundling-sources/shared_libs/play-runtime/runtime-telemetry.ts

@@ -1,4 +1,7 @@
-import { createTelemetry } from '../observability/telemetry';
+import {
+  createTelemetry,
+  TELEMETRY_TRIAGE_SCHEMA_VERSION,
+} from '../observability/telemetry';
 
 type PlayRuntimeTelemetryInput = {
   phase: string;
@@ -19,6 +22,123 @@ const playRuntimeTelemetry = createTelemetry({
 
 type PlayTelemetryLevel = 'debug' | 'info' | 'warn' | 'error';
 
+export type PlayRunLaunchConflictTriggerSource =
+  | 'api'
+  | 'webhook'
+  | 'cron'
+  | 'sql_listener'
+  | 'async_child'
+  | null
+  | undefined;
+
+export type PlayRunLaunchConflictTelemetryInput = {
+  orgId?: string | null;
+  runId: string;
+  playName?: string | null;
+  triggerSource?: PlayRunLaunchConflictTriggerSource;
+  workflowFamilyKey?: string | null;
+  revisionId?: string | null;
+  artifactHash?: string | null;
+  graphHash?: string | null;
+  inputSha256?: string | null;
+  error?: unknown;
+};
+
+export type PlayRunLaunchConflictTelemetryDetails = {
+  level: 'warn' | 'error';
+  conflictKind: 'caller' | 'internal' | 'unknown';
+  triggerSource: string;
+  launchFingerprint: string;
+  fields: Record<string, unknown>;
+};
+
+function launchConflictKindForTriggerSource(
+  triggerSource: PlayRunLaunchConflictTriggerSource,
+): PlayRunLaunchConflictTelemetryDetails['conflictKind'] {
+  if (triggerSource === 'api') return 'caller';
+  if (triggerSource) return 'internal';
+  return 'unknown';
+}
+
+function launchFingerprint(input: PlayRunLaunchConflictTelemetryInput): string {
+  // Fingerprint only durable, non-secret launch metadata. In particular, do
+  // not serialize the input payload or executor/coordinator credentials. Keep
+  // this a small pure-JS hash because this module is also bundled into the
+  // Worker runtime, where importing node:crypto is not portable.
+  const durableFields = [
+    input.orgId ?? '',
+    input.runId,
+    input.playName ?? '',
+    input.triggerSource ?? '',
+    input.workflowFamilyKey ?? '',
+    input.revisionId ?? '',
+    input.artifactHash ?? '',
+    input.graphHash ?? '',
+    input.inputSha256 ?? '',
+  ].join('\u001f');
+  let first = 0x811c9dc5;
+  let second = 0x9e3779b9;
+  for (let index = 0; index < durableFields.length; index += 1) {
+    const code = durableFields.charCodeAt(index);
+    first = Math.imul(first ^ code, 0x01000193);
+    second = Math.imul(second ^ code, 0x85ebca6b);
+  }
+  return `${(first >>> 0).toString(16).padStart(8, '0')}${(second >>> 0)
+    .toString(16)
+    .padStart(8, '0')}`;
+}
+
+export function buildPlayRunLaunchConflictTelemetry(
+  input: PlayRunLaunchConflictTelemetryInput,
+): PlayRunLaunchConflictTelemetryDetails {
+  const conflictKind = launchConflictKindForTriggerSource(input.triggerSource);
+  const level = conflictKind === 'caller' ? 'warn' : 'error';
+  const triggerSource = input.triggerSource ?? 'unknown';
+  return {
+    level,
+    conflictKind,
+    triggerSource,
+    launchFingerprint: launchFingerprint(input),
+    fields: {
+      orgId: input.orgId ?? null,
+      runId: input.runId,
+      playName: input.playName ?? null,
+      triggerSource,
+      conflictKind,
+      code: 'PLAY_RUN_LAUNCH_CONFLICT',
+      httpStatus: 409,
+      retryable: false,
+      launchFingerprint: launchFingerprint(input),
+      workflowFamilyKey: input.workflowFamilyKey ?? null,
+      revisionId: input.revisionId ?? null,
+      artifactHash: input.artifactHash ?? null,
+      graphHash: input.graphHash ?? null,
+      triage:
+        level === 'error'
+          ? {
+              schema_version: TELEMETRY_TRIAGE_SCHEMA_VERSION,
+              reportable: true,
+              class: 'play_run_launch_conflict',
+            }
+          : undefined,
+    },
+  };
+}
+
+/** Emit the single structured event for a durable run-id/launch conflict. */
+export function emitPlayRunLaunchConflictTelemetry(
+  input: PlayRunLaunchConflictTelemetryInput,
+): void {
+  const details = buildPlayRunLaunchConflictTelemetry(input);
+  emitPlayTelemetry({
+    level: details.level,
+    event: 'play.run.admission_conflict',
+    tag: '[play.run.admission_conflict]',
+    ...(details.level === 'error' && input.error ? { error: input.error } : {}),
+    fields: details.fields,
+  });
+}
+
 function stringField(
   fields: Record<string, unknown>,
   ...keys: readonly string[]

package/dist/bundling-sources/shared_libs/play-runtime/scheduler-backends/absurd-play-deploy-task.ts

@@ -1,11 +1,15 @@
-import type { RetryStrategy } from '@deepline/absurd/sdk';
+import { ABSURD_WAKE_CHANNEL, type RetryStrategy } from '@deepline/absurd/sdk';
 import {
   createAbsurdRuntimeClient,
   resolveAbsurdPoolOptions,
   resolveAbsurdQueueSuffix,
 } from './absurd-shared';
 import { ensureAbsurdSchema } from './postgres';
-import { withRuntimeSchedulerClient } from './postgres-pool';
+import {
+  acquirePgNotifyHub,
+  withRuntimeSchedulerClient,
+  type PgNotifyHubLease,
+} from './postgres-pool';
 
 /**
  * GitHub deploy-on-push build tasks ride their own fixed Absurd queue,
@@ -48,6 +52,91 @@ export const PLAY_DEPLOY_RETRY_STRATEGY: RetryStrategy = {
 export const PLAY_DEPLOY_CLEANUP_TTL = '6 hours';
 export const PLAY_DEPLOY_CLEANUP_LIMIT = 1_000;
 
+/**
+ * Durable idle poll for the deploy worker. `spawn_task` emits a transactional
+ * NOTIFY on `absurd_wake` for this queue, so a healthy listener claims a new
+ * deploy within one round-trip; this interval only bounds how late a missed
+ * notification or a retry with a future `available_at` is discovered.
+ *
+ * The SDK default (250ms) is meant for a busy queue. Against the production
+ * runtime Postgres it made one idle worker the single largest
+ * `absurd.claim_task` caller: four claims per second, each running the
+ * cancellation sweep, the expired-lease sweep, and the fair-claim ranking
+ * over an empty queue.
+ */
+export const PLAY_DEPLOY_IDLE_POLL_INTERVAL_SECONDS = 30;
+/** Durable poll while no LISTEN session is available (connecting/down). */
+export const PLAY_DEPLOY_WAKE_UNAVAILABLE_POLL_INTERVAL_MS = 5_000;
+
+export type PlayDeployWakeHook = ((wake: () => void) => (() => void) | void) & {
+  isListening: () => boolean;
+};
+
+/**
+ * Wire the deploy worker's poll loop to the engine's `absurd_wake` channel.
+ * There is at most one deploy worker machine (two during a rolling deploy),
+ * so no leader election is needed: each process holds one direct LISTEN
+ * session. A missing hub degrades to the durable poll, never to a spin.
+ */
+export function createPlayDeployWakeHook(input: {
+  url: string;
+  queue: string;
+  acquireNotifyHub?: (input: {
+    url: string;
+    channel: string;
+    applicationName?: string;
+  }) => PgNotifyHubLease | null;
+}): PlayDeployWakeHook {
+  let listening = false;
+  const hook: PlayDeployWakeHook = (wake) => {
+    const acquireNotifyHub =
+      input.acquireNotifyHub ??
+      ((notifyInput: {
+        url: string;
+        channel: string;
+        applicationName?: string;
+      }) => acquirePgNotifyHub(notifyInput, { idleMs: 0 }));
+    const lease = acquireNotifyHub({
+      url: input.url,
+      channel: ABSURD_WAKE_CHANNEL,
+      applicationName: 'deepline-deploy-worker-wake',
+    });
+    if (!lease) return;
+    const unsubscribeNotify = lease.hub.subscribe((payload) => {
+      if (payload === input.queue) wake();
+    });
+    // A freshly connected listener rechecks durable state so a task spawned
+    // between the last poll and LISTEN taking effect is not missed.
+    const unsubscribeState = lease.hub.subscribeState((state) => {
+      const wasListening = listening;
+      listening = state === 'listening';
+      if (listening || wasListening) wake();
+    });
+    return () => {
+      unsubscribeNotify();
+      unsubscribeState();
+      listening = false;
+      lease.release();
+    };
+  };
+  hook.isListening = () => listening;
+  return hook;
+}
+
+/**
+ * Idle poll policy for the deploy worker. Unlike the runs lanes, the deploy
+ * queue keeps a durable poll even while listening: retries are scheduled with
+ * a future `available_at` and no later NOTIFY, and the worker reads no
+ * next-due hint (that read is itself queue-wide work).
+ */
+export function resolvePlayDeployIdlePollFallbackMs(
+  hook: Pick<PlayDeployWakeHook, 'isListening'> | undefined,
+): number {
+  return hook?.isListening() === true
+    ? PLAY_DEPLOY_IDLE_POLL_INTERVAL_SECONDS * 1000
+    : PLAY_DEPLOY_WAKE_UNAVAILABLE_POLL_INTERVAL_MS;
+}
+
 /**
  * Task payload stays tiny (32 KiB control-plane cap): the deploy token plus
  * addressing. The worker fetches everything else — repo, commit, project

package/dist/bundling-sources/shared_libs/play-runtime/scheduler-backends/absurd-runtime-worker.ts

@@ -23,6 +23,7 @@
 import { hostname } from 'node:os';
 import { randomUUID } from 'node:crypto';
 import { setTimeout as sleep } from 'node:timers/promises';
+import { createRateLimitedRuntimeLogger } from '../../observability/runtime-console';
 import {
   ABSURD_WAKE_CHANNEL,
   CancelledTask,
@@ -32,6 +33,7 @@ import {
   TimeoutError,
   type Absurd,
   type TaskContext,
+  type WorkerOptions,
 } from '@deepline/absurd/sdk';
 import {
   AppRuntimeApiResponseError,
@@ -333,6 +335,21 @@ export const ABSURD_IDLE_POLL_INTERVAL_SECONDS = 30;
  * may add latency but must not invent a terminal result outside that policy.
  */
 export const ABSURD_WAKE_UNAVAILABLE_POLL_INTERVAL_MS = 1_000;
+/**
+ * An adopted (retired) lane is served by durable polling only. Its parked
+ * sleeps and event waits already tolerate the adoption rotation (minutes), so
+ * a 30-second discovery bound costs nothing customer-visible, while a direct
+ * LISTEN session per adopted queue did: with `ABSURD_LANE_ADOPTION_MAX_QUEUES`
+ * queues rotating every discovery pass on every Machine, each attach opened a
+ * fresh direct Postgres session (plus its advisory-lock election) and each
+ * detach closed one, and any adopted lane that lost the election or the
+ * process-wide hub budget fell back to `ABSURD_WAKE_UNAVAILABLE_POLL_INTERVAL_MS`
+ * — one `claim_task` plus one next-due read per second per lane. On a
+ * 25-connection primary that churn is where the "remaining connection slots
+ * are reserved" rejections came from.
+ */
+export const ABSURD_ADOPTED_LANE_POLL_INTERVAL_MS =
+  ABSURD_IDLE_POLL_INTERVAL_SECONDS * 1000;
 /** Heartbeat throttle: keep the lease well ahead of expiry (leaseTimeout / 3). */
 const HEARTBEAT_THROTTLE_MS = (HEARTBEAT_CLAIM_TIMEOUT_SECONDS * 1000) / 3;
 const HEARTBEAT_TIMEOUT_RETRY_DELAY_MS = 1_000;
@@ -5324,6 +5341,41 @@ export function selectAbsurdAdoptionQueues(input: {
   };
 }
 
+/**
+ * Poll-loop options for one adopted (retired) lane. Exported so the durable
+ * polling contract is asserted without a Fly Machine or a live engine.
+ *
+ * - No `onWake`: an adopted queue never opens a direct LISTEN session (see
+ *   `ABSURD_ADOPTED_LANE_POLL_INTERVAL_MS`).
+ * - `idlePollFallbackMs` is the 30-second durable bound, never the one-second
+ *   "listener unavailable" cadence meant for the active lane's standby.
+ * - `nextPollDelayMs` still shortens the wait to the lane's next indexed due
+ *   transition, so an already-due parked wake is claimed on the next pass.
+ */
+export function absurdAdoptedLaneWorkerOptions(input: {
+  workerBase: string;
+  queue: string;
+  nextPollDelayMs: () => Promise<number | null>;
+  onError: (error: Error) => void;
+}): WorkerOptions {
+  return {
+    // The `:continuations` suffix is the engine-side half of the adoption
+    // rule: `claim_task` admits this worker only for runs still sleeping
+    // or carrying an event-wake payload.
+    workerId: absurdContinuationWorkerId({
+      workerBase: input.workerBase,
+      queue: input.queue,
+    }),
+    concurrency: ABSURD_LANE_ADOPTION_SLOTS,
+    claimTimeout: HEARTBEAT_CLAIM_TIMEOUT_SECONDS,
+    pollInterval: ABSURD_IDLE_POLL_INTERVAL_SECONDS,
+    nextPollDelayMs: input.nextPollDelayMs,
+    idlePollFallbackMs: () => ABSURD_ADOPTED_LANE_POLL_INTERVAL_MS,
+    fatalOnLeaseTimeout: false,
+    onError: input.onError,
+  };
+}
+
 /**
  * Continuously attach the queues of retired lanes that still hold adoptable
  * parked waits, and detach a queue as soon as it stops qualifying (its lane was
@@ -5661,6 +5713,9 @@ export async function runPostgresSchedulerComputeBillingController(input: {
   );
   const wait = input.sleep ?? ((ms: number) => sleep(ms));
   const active = new Set<Promise<void>>();
+  const reportPollFailure = createRateLimitedRuntimeLogger({
+    log: (...args) => console.warn(...args),
+  });
   const startJob = (job: PostgresSchedulerComputeBillingJob): void => {
     const task = processPostgresSchedulerComputeBillingJob({
       job,
@@ -5725,7 +5780,7 @@ export async function runPostgresSchedulerComputeBillingController(input: {
           continue;
         }
       } catch (error) {
-        console.warn(
+        reportPollFailure(
           '[absurd-runtime.worker] durable_compute_billing_poll_failed',
           {
             error: error instanceof Error ? error.message : String(error),
@@ -6333,6 +6388,12 @@ export async function runPostgresSchedulerSandboxCleanupController(input: {
   );
   const timeoutMs = ABSURD_SANDBOX_GC_TIMEOUT_MS;
   const active = new Set<Promise<void>>();
+  const reportPollFailure = createRateLimitedRuntimeLogger({
+    log: (...args) => console.warn(...args),
+  });
+  const reportReconciliationPollFailure = createRateLimitedRuntimeLogger({
+    log: (...args) => console.warn(...args),
+  });
 
   const startJob = (job: PostgresSchedulerSandboxCleanupJob): void => {
     const task = processPostgresSchedulerSandboxCleanupJob({
@@ -6394,7 +6455,7 @@ export async function runPostgresSchedulerSandboxCleanupController(input: {
           );
         }
       } catch (error) {
-        console.warn(
+        reportReconciliationPollFailure(
           '[absurd-runtime.worker] modal_create_reconciliation_poll_failed',
           {
             error: error instanceof Error ? error.message : String(error),
@@ -6427,7 +6488,7 @@ export async function runPostgresSchedulerSandboxCleanupController(input: {
           continue;
         }
       } catch (error) {
-        console.warn(
+        reportPollFailure(
           '[absurd-runtime.worker] durable_sandbox_cleanup_poll_failed',
           {
             error: error instanceof Error ? error.message : String(error),
@@ -6747,6 +6808,9 @@ export async function startRuntimeWorkerHost(
     );
     await reconcileDeadlineCancellations();
   };
+  const reportQueueError = createRateLimitedRuntimeLogger({
+    log: (...args) => console.error(...args),
+  });
   const worker = await absurdClient.startWorker({
     workerId: `${workerBase}:${queue}`,
     concurrency: slots,
@@ -6773,7 +6837,7 @@ export async function startRuntimeWorkerHost(
     onWake,
     fatalOnLeaseTimeout: false,
     onError: (error) =>
-      console.error('[absurd-runtime.worker] queue_error', { queue, error }),
+      reportQueueError('[absurd-runtime.worker] queue_error', { queue, error }),
   });
   // Compute settlement and cleanup each have their own controller and
   // database lease. Neither consumes an ordinary play slot or competes with
@@ -6872,47 +6936,29 @@ export async function startRuntimeWorkerHost(
           adoptedQueue,
         );
         createAbsurdRuntimeTasks(adoptedClient, workerDeps, adoptedQueue);
-        const adoptedWake = createAbsurdWorkerWakeHook({
-          poolOptions,
-          queue: adoptedQueue,
-          // The adopted lane has no other claimant, and the wake election is
-          // keyed per queue, so listening here never competes with the active
-          // lane's own session. A parked HITL resume keeps its low latency.
-          draining: false,
-          useDirectNotify: shouldUseRuntimeSchedulerDirectNotify(
-            schedulerOptions.schema,
-          ),
+        const reportAdoptedQueueError = createRateLimitedRuntimeLogger({
+          log: (...args) => console.error(...args),
         });
-        const adoptedWorker = await adoptedClient.startWorker({
-          // The `:continuations` suffix is the engine-side half of the adoption
-          // rule: `claim_task` admits this worker only for runs still sleeping
-          // or carrying an event-wake payload.
-          workerId: absurdContinuationWorkerId({
+        const adoptedWorker = await adoptedClient.startWorker(
+          absurdAdoptedLaneWorkerOptions({
             workerBase,
             queue: adoptedQueue,
+            nextPollDelayMs: () =>
+              withRuntimeSchedulerClient(poolOptions, async (client) => {
+                const nextDue = await readAbsurdQueueNextDue(
+                  client,
+                  adoptedQueue,
+                );
+                if (!nextDue.dueAt) return null;
+                return nextDue.dueAt.getTime() - Date.now();
+              }),
+            onError: (error) =>
+              reportAdoptedQueueError(
+                '[absurd-runtime.worker] adopted_queue_error',
+                { queue: adoptedQueue, error },
+              ),
           }),
-          concurrency: ABSURD_LANE_ADOPTION_SLOTS,
-          claimTimeout: HEARTBEAT_CLAIM_TIMEOUT_SECONDS,
-          pollInterval: ABSURD_IDLE_POLL_INTERVAL_SECONDS,
-          nextPollDelayMs: () =>
-            withRuntimeSchedulerClient(poolOptions, async (client) => {
-              const nextDue = await readAbsurdQueueNextDue(
-                client,
-                adoptedQueue,
-              );
-              if (!nextDue.dueAt) return null;
-              return nextDue.dueAt.getTime() - Date.now();
-            }),
-          idlePollFallbackMs: () =>
-            resolveAbsurdIdlePollFallbackMs(adoptedWake),
-          onWake: adoptedWake,
-          fatalOnLeaseTimeout: false,
-          onError: (error) =>
-            console.error('[absurd-runtime.worker] adopted_queue_error', {
-              queue: adoptedQueue,
-              error,
-            }),
-        });
+        );
         return {
           queue: adoptedQueue,
           close: () => adoptedWorker.close(),

package/dist/bundling-sources/shared_libs/play-runtime/scheduler-backends/postgres-pool.ts

@@ -105,6 +105,8 @@ export function isKnownPooledRuntimePostgresUrl(url: string): boolean {
 }
 
 export class RuntimeSchedulerDirectDatabaseUrlError extends Error {
+  readonly code = 'RUNTIME_SCHEDULER_DIRECT_DATABASE_URL';
+
   constructor() {
     super(
       'WORKFLOW_RUNTIME_POSTGRES points at PlanetScale direct Postgres (port 5432). ' +
@@ -194,6 +196,8 @@ export type RuntimeSchedulerQueryClient = {
 };
 
 export class RuntimeSchedulerCircuitOpenError extends Error {
+  readonly code = 'RUNTIME_SCHEDULER_UNAVAILABLE';
+
   constructor(cause: string) {
     super(
       `Runtime scheduler DB circuit breaker is open after repeated connection failures: ${cause}`,

package/dist/bundling-sources/shared_libs/play-runtime/scheduler-backends/scheduler-capacity.ts

@@ -1,4 +1,5 @@
 export class RuntimeSchedulerSaturatedError extends Error {
+  readonly code = 'RUNTIME_SCHEDULER_SATURATED';
   readonly queueDepth: number;
 
   constructor(queueDepth: number) {
@@ -13,6 +14,7 @@ export class RuntimeSchedulerSaturatedError extends Error {
 
 /** Scheduler admission is temporarily full, not broken. */
 export class RuntimeSchedulerCapacityError extends Error {
+  readonly code: string = 'RUNTIME_SCHEDULER_CAPACITY';
   readonly retryAfterMs: number;
 
   constructor(message: string, retryAfterMs: number) {
@@ -23,6 +25,8 @@ export class RuntimeSchedulerCapacityError extends Error {
 }
 
 export class RuntimeSchedulerPgBouncerCapacityError extends RuntimeSchedulerCapacityError {
+  override readonly code = 'RUNTIME_SCHEDULER_PGBOUNCER_CAPACITY';
+
   constructor(cause: string) {
     super(
       `Runtime scheduler PgBouncer is at connection capacity: ${cause}`,
@@ -39,6 +43,7 @@ export class RuntimeSchedulerPgBouncerCapacityError extends RuntimeSchedulerCapa
  * atomic launch transaction commits.
  */
 export class RuntimeSchedulerSubmissionAdmissionError extends RuntimeSchedulerCapacityError {
+  override readonly code = 'RUNTIME_SCHEDULER_SUBMISSION_ADMISSION';
   readonly reason: 'full' | 'timed_out';
 
   constructor(reason: 'full' | 'timed_out', queueDepth: number) {

package/dist/bundling-sources/shared_libs/plays/authoring-contract.ts

@@ -140,6 +140,7 @@ export const PLAY_AUTHORING_CONTRACT_ISSUE_CODES = [
   'play_authoring_fetch_http_error_branch',
   'play_authoring_tool_deprecated',
   'play_authoring_replay_unsafe_nondeterminism',
+  'play_authoring_row_sleep_unsupported',
   'play_authoring_binding_invalid',
   'play_authoring_input_schema_unresolved',
   'tool_response_raw_access',

package/dist/bundling-sources/shared_libs/security/secret-redaction.ts

@@ -2,7 +2,7 @@ const REDACTED_VALUE = '[REDACTED]';
 
 type SecretRedactionOptions = {
   redactHighEntropy?: boolean;
-  /** Preserve only known pagination cursor fields in authenticated result data. */
+  /** Preserve pagination cursors and signed transfer URLs in authenticated results. */
   keyPolicy?: 'strict' | 'public-result';
   /** Replace sample cursor values with a non-capability-bearing placeholder. */
   placeholderContinuationValues?: boolean;
@@ -121,6 +121,59 @@ const SAFE_IDENTIFIER_KEYS = new Set([
   'snowflake_query_ids',
 ]);
 
+// Transfer URLs are bearer capabilities. Only return them in authenticated
+// results; keep logs, errors, and generated samples redacted.
+const PUBLIC_RESULT_TRANSFER_URL_KEYS = new Set([
+  'uploadUrl',
+  'upload_url',
+  'downloadUrl',
+  'download_url',
+]);
+const TRANSFER_SIGNING_PARAM =
+  /^(?:sig|signature|x-amz-(?:algorithm|credential|date|expires|signedheaders|signature|security-token)|x-goog-(?:algorithm|credential|date|expires|signedheaders|signature))$/i;
+
+function isPublicResultTransferUrl(
+  value: string,
+  key: string | undefined,
+  options: SecretRedactionOptions,
+): boolean {
+  if (
+    !key ||
+    !PUBLIC_RESULT_TRANSFER_URL_KEYS.has(key) ||
+    options.keyPolicy !== 'public-result' ||
+    options.placeholderContinuationValues
+  )
+    return false;
+  let url: URL;
+  try {
+    url = new URL(value);
+  } catch {
+    return false;
+  }
+  if (
+    url.protocol !== 'https:' ||
+    url.username ||
+    url.password ||
+    url.hash ||
+    /\s/.test(value)
+  )
+    return false;
+  let signed = false;
+  for (const [name, paramValue] of url.searchParams) {
+    if (
+      SENSITIVE_URL_PARAM_KEY_PATTERN.test(name) &&
+      !TRANSFER_SIGNING_PARAM.test(name)
+    )
+      return false;
+    if (
+      /^(?:sig|signature|x-amz-signature|x-goog-signature)$/i.test(name) &&
+      paramValue
+    )
+      signed = true;
+  }
+  return signed;
+}
+
 const EXPLICIT_SECRET_VALUE_PATTERNS = [
   /\bnapi_[a-z0-9]{20,}\b/i,
   /\bgh[opsu]_[A-Za-z0-9_]{20,}\b/,
@@ -254,6 +307,7 @@ export function redactSecretsInValue<T>(
     if (EXPLICIT_SECRET_VALUE_PATTERNS.some((pattern) => pattern.test(value))) {
       return REDACTED_VALUE as T;
     }
+    if (isPublicResultTransferUrl(value, parentKey, options)) return value as T;
     if (parentKey && SAFE_IDENTIFIER_KEYS.has(parentKey)) {
       return value as T;
     }
@@ -297,6 +351,7 @@ export function redactSecretsInValue<T>(
     if (EXPLICIT_SECRET_VALUE_PATTERNS.some((pattern) => pattern.test(item))) {
       return REDACTED_VALUE;
     }
+    if (isPublicResultTransferUrl(item, itemParentKey, options)) return item;
     if (itemParentKey && SAFE_IDENTIFIER_KEYS.has(itemParentKey)) return item;
     if (itemParentKey && shouldRedactKey(itemParentKey)) {
       return REDACTED_VALUE;