refactor(url): parse URLs as values instead of catching TypeErrors

[Makisuo]

Sixth of the stack, based on #725.

new URL(...) throws a TypeError the type system cannot see, and every catch answering it flattens "not a URL" together with whatever else the block could fail on. Eight sites were spelling that out by hand, each with its own copy of the recovery.

@maple/domain/url holds the three shapes they wanted — parseUrl (Option), parseUrlWithBase for the relative form, and urlPathname, whose empty string is exactly what the request predicates in worker.ts were expressing as catch { return false }. The existing local copies in pull-request-ref and github-hosts use it too, so there is one implementation rather than four.

Converted: apps/api worker route predicates (×3), WorkersAiHttpClient, GithubProvider avatar derivation, PlanetScaleDiscoveryService, query-engine's hostOf, and url-validator.

Two behaviour changes fall out of the sweep

safeFetch could throw a raw TypeError out of the SSRF guard. It resolved a redirect's Location with a bare new URL(location, validated). That header is whatever the far end sent, so a malformed one escaped as neither a rejection callers can handle nor a response. It is a UrlValidationError now, with a regression test verified to fail against the old code.

validateExternalUrlSync threw UrlValidationError — a Schema.TaggedError, thrown, which validateExternalUrl then had to re-recognise with instanceof on the way back out. The check is now validateExternalUrlResult returning a Result, validateExternalUrl is Effect.fromResult over it, and both callers read the failure rather than catching it. All 69 existing guard cases are preserved as Result assertions — none dropped, none loosened.

safeFetch itself stays a Promise. Moving it onto HttpClient means rewriting the redirect and credential-stripping loop that #717 just landed, which is not a parsing change and wants its own PR.

Unrelated fix in the first commit

IngestAttributeMappingForbiddenError shipped with the admin gate (#713) but was never regenerated into ANTICIPATED_ERROR_IDENTIFIER_LIST, so the drift test comparing that list against reflection has been failing on main since it merged. The first commit is the regenerated output. Beyond the red suite, an ordinary 403 was being recorded as an error event rather than an anticipated 4xx.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[github-actions]

🍁 Maple PR preview

Warning

Preview cleanup could not be confirmed. The Alchemy teardown outcome was skipped.

Final commit a6ae916 · View workflow run