Fluxion::PublicUrl

Strips the parts of a URL that must never be persisted or displayed.

Query strings carry signed-request parameters and tokens; user-info carries credentials outright. Both are legitimate on the wire, so they stay on the download request — but plans, events, failure messages, state files, and phase fingerprints all get this form instead.