/**
 * Masks credential-bearing `token` query parameters before a URL reaches
 * the request log (issue #191): feed tokens travel in the query string
 * because feed readers cannot send headers, and the api's own log must
 * not become the place where that long-lived credential is stored.
 */
export function maskTokenParam<T extends string | undefined>(url: T): T {
  return url?.replace(/([?&]token=)[^&#]*/gi, '$1[redacted]') as T;
}