(new): expand runtime APIs

(fix): harden concurrent lifecycle
(tests): add regression coverage
(doc): update v1.2 guidance

tgapi/log_redaction.go

@@ -2,7 +2,9 @@ package tgapi
 
 import (
 	"encoding/json"
+	"errors"
 	"fmt"
+	"net/url"
 	"strings"
 )
 
@@ -55,3 +57,30 @@ func redactLogValue(value any) {
 func responseLogSummary(method string, size int) string {
 	return fmt.Sprintf("method=%s bytes=%d body=omitted", method, size)
 }
+
+type redactedError struct {
+	err    error
+	secret string
+}
+
+func (e *redactedError) Error() string {
+	return strings.ReplaceAll(e.err.Error(), e.secret, redactedLogValue)
+}
+
+func (e *redactedError) Unwrap() error { return e.err }
+
+func redactHTTPError(err error, token string) error {
+	if err == nil || token == "" || !strings.Contains(err.Error(), token) {
+		return err
+	}
+
+	var urlErr *url.Error
+	if !errors.As(err, &urlErr) {
+		return &redactedError{err: err, secret: token}
+	}
+
+	redactedURL := *urlErr
+	redactedURL.URL = strings.ReplaceAll(redactedURL.URL, token, redactedLogValue)
+	redactedURL.Err = &redactedError{err: urlErr.Err, secret: token}
+	return &redactedURL
+}