[SDK] Address stack review feedback (#11389)

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

src/lib/lexClient.ts

@@ -40,7 +40,12 @@ export function createLexClient(
  * Requests use PLAIN `fetch`, not `networkAwareFetch`: the host is untrusted
  * input, and a typo'd or dead service must not be reported as the app losing
  * network reachability.
+ *
+ * `appLabelers: null` suppresses the global `Client.appLabelers` static: these
+ * are `com.atproto.server` calls to a host the user typed, which have no use
+ * for moderation labels, and the header would disclose the app's configured
+ * moderation authorities to an arbitrary third-party server.
  */
 export function createServiceClient(service: string): Client {
-  return createLexClient({service})
+  return createLexClient({service}, {appLabelers: null})
 }

src/lib/strings/url-helpers.ts

@@ -27,6 +27,15 @@ const TRUSTED_REGEX = new RegExp(
   )})|/|#)`,
 )
 
+export function canParseUrl(url: string | URL, base?: string | URL): boolean {
+  try {
+    new URL(url, base)
+    return true
+  } catch {
+    return false
+  }
+}
+
 export function isValidDomain(str: string): boolean {
   return !!TLDs.find(tld => {
     let i = str.lastIndexOf(tld)