test: improve code coverage from 94.49% to 99.20%

Add comprehensive tests for injection validation, PurlBuilder factory
methods, and edge cases across validate/strings/url-converter/compare.

- Add purl-injection-nothrow.test.mts: 78 tests covering per-type
  validate() with throws=false for injection chars, empty namespace
  validation, required field validation, and throw path verification
- Add purl-builder-types.test.mts: 26 tests covering all PurlBuilder
  static factory methods
- Add edge-case tests for Docker Hub/MetaCPAN unrecognized paths,
  encodeQualifiers non-object input
- Convert c8 ignore comments to v8 ignore across 24 source files
  (vitest v8 provider uses v8 ignore, not c8 ignore)
- Add v8 ignore for unreachable npm validation branches where
  injection validator catches characters before type-specific checks

Author: jdalton

src/compare.ts

@@ -29,7 +29,7 @@ export function _registerPackageURL(ctor: typeof PackageURL): void {
 
 function toCanonicalString(input: PurlInput): string {
   if (typeof input === 'string') {
-    /* c8 ignore next 5 -- PackageURL is always registered at module load time. */
+    /* v8 ignore next 5 -- PackageURL is always registered at module load time. */
     if (!_PackageURL) {
       throw new Error(
         'PackageURL not registered. Import PackageURL before using string comparison.',

src/exists.ts

@@ -11,7 +11,7 @@
  * ```
  */
 
-/* c8 ignore start - Re-export only file, no logic to test */
+/* v8 ignore start - Re-export only file, no logic to test */
 
 export { cargoExists } from './purl-types/cargo.js'
 export { cocoapodsExists } from './purl-types/cocoapods.js'
@@ -33,4 +33,4 @@ export { pypiExists } from './purl-types/pypi.js'
 export { vscodeExtensionExists } from './purl-types/vscode-extension.js'
 export type { ExistsOptions, ExistsResult } from './purl-types/npm.js'
 
-/* c8 ignore stop */
+/* v8 ignore stop */

src/index.ts

@@ -40,7 +40,7 @@ SOFTWARE.
  * - Parsers: Modular parsers for ecosystem-specific package specifiers
  */
 
-/* c8 ignore start - Re-export only file, no logic to test */
+/* v8 ignore start - Re-export only file, no logic to test */
 
 export type { PURLString } from '@socketsecurity/lib/types'
 // ============================================================================
@@ -105,4 +105,4 @@ export { stringify, stringifySpec } from './stringify.js'
 export { Vers } from './vers.js'
 export type { VersComparator, VersConstraint, VersWildcard } from './vers.js'
 
-/* c8 ignore stop */
+/* v8 ignore stop */

src/package-url.ts

@@ -655,7 +655,7 @@ class PackageURL {
     // Split the remainder once from left on ':'
     const colonIndex = StringPrototypeIndexOf(purlStr, ':')
     // Use WHATWG URL to split up the purl string
-    /* c8 ignore next 3 -- Comment lines don't need coverage. */
+    /* v8 ignore next 3 -- Comment lines don't need coverage. */
     //   - Split the purl string once from right on '#'
     //   - Split the remainder once from right on '?'
     //   - Split the remainder once from left on ':'
@@ -675,7 +675,7 @@ class PackageURL {
         // When leading slashes were trimmed, the original string had an authority
         // section (e.g., pkg://user:pass@host/...). Detect `@` in the authority
         // by checking between the `//` and the next `/`.
-        /* c8 ignore next 8 -- V8 coverage sees multiple branch paths that can't all be tested. */
+        /* v8 ignore next 8 -- V8 coverage sees multiple branch paths that can't all be tested. */
         if (afterColon.length !== trimmedAfterColon.length) {
           // afterColon starts with slashes — find the authority section
           const authorityStart = StringPrototypeIndexOf(afterColon, '//') + 2
@@ -697,11 +697,11 @@ class PackageURL {
       }
     }
     // The scheme is a constant with the value "pkg"
-    /* c8 ignore next -- Tested: colonIndex === -1 (url undefined) case, but V8 can't see both branches. */ if (
+    /* v8 ignore next -- Tested: colonIndex === -1 (url undefined) case, but V8 can't see both branches. */ if (
       url?.protocol !== 'pkg:'
     ) {
       throw new PurlError('missing required "pkg" scheme component')
-      /* c8 ignore next -- Unreachable code after throw. */
+      /* v8 ignore next -- Unreachable code after throw. */
     }
     // A purl must NOT contain a URL Authority i.e. there is no support for
     // username, password, host and port components
@@ -723,14 +723,14 @@ class PackageURL {
 
     let rawVersion: string | undefined
     // Both branches of this ternary are tested, but V8 reports phantom branch combinations
-    /* c8 ignore start -- npm vs non-npm path logic both tested but V8 sees extra branches. */
+    /* v8 ignore start -- npm vs non-npm path logic both tested but V8 sees extra branches. */
     // Deviate from the specification to handle a special npm purl type case for
     // pnpm ids such as 'pkg:npm/next@14.2.10(react-dom@18.3.1(react@18.3.1))(react@18.3.1)'
     let atSignIndex =
       rawType === 'npm'
         ? StringPrototypeIndexOf(pathname, '@', firstSlashIndex + 2)
         : StringPrototypeLastIndexOf(pathname, '@')
-    /* c8 ignore stop */
+    /* v8 ignore stop */
     // When a forward slash ('/') is directly preceding an '@' symbol,
     // then the '@' symbol is NOT considered a version separator
     if (
@@ -790,7 +790,7 @@ class PackageURL {
           )
           // Use URLSearchParams#append to preserve plus signs
           // https://developer.mozilla.org/en-US/docs/Web/API/URLSearchParams#preserving_plus_signs
-          /* c8 ignore next -- URLSearchParams.append has internal V8 branches we can't control. */ searchParams.append(
+          /* v8 ignore next -- URLSearchParams.append has internal V8 branches we can't control. */ searchParams.append(
             key,
             value,
           )

src/purl-types/cargo.ts

@@ -117,9 +117,9 @@ export async function cargoExists(
       }
       return result
     } catch (e) {
-      /* c8 ignore start */
+      /* v8 ignore start */
       const error = e instanceof Error ? e.message : String(e)
-      /* c8 ignore stop */
+      /* v8 ignore stop */
       return {
         exists: false,
         error: StringPrototypeIncludes(error, '404')

src/purl-types/cocoapods.ts

@@ -105,7 +105,7 @@ export async function cocoapodsExists(
       }
       return result
     } catch (e) {
-      /* c8 ignore next - httpJson typically throws Error; String(e) is defensive programming */
+      /* v8 ignore next - httpJson typically throws Error; String(e) is defensive programming */
       const error = e instanceof Error ? e.message : String(e)
       return {
         exists: false,

src/purl-types/composer.ts

@@ -131,7 +131,7 @@ export async function packagistExists(
       }
       return result
     } catch (e) {
-      /* c8 ignore next - httpJson typically throws Error; String(e) is defensive programming */
+      /* v8 ignore next - httpJson typically throws Error; String(e) is defensive programming */
       const error = e instanceof Error ? e.message : String(e)
       return {
         exists: false,

src/purl-types/conda.ts

@@ -149,9 +149,9 @@ export async function condaExists(
       }
       return result
     } catch (e) {
-      /* c8 ignore start */
+      /* v8 ignore start */
       const error = e instanceof Error ? e.message : String(e)
-      /* c8 ignore stop */
+      /* v8 ignore stop */
       return {
         exists: false,
         error: StringPrototypeIncludes(error, '404')

src/purl-types/cpan.ts

@@ -98,7 +98,7 @@ export async function cpanExists(
       }
       return result
     } catch (e) {
-      /* c8 ignore next - httpJson typically throws Error; String(e) is defensive programming */
+      /* v8 ignore next - httpJson typically throws Error; String(e) is defensive programming */
       const error = e instanceof Error ? e.message : String(e)
       return {
         exists: false,

src/purl-types/cran.ts

@@ -100,7 +100,7 @@ export async function cranExists(
       }
       return result
     } catch (e) {
-      /* c8 ignore next - httpJson typically throws Error; String(e) is defensive programming */
+      /* v8 ignore next - httpJson typically throws Error; String(e) is defensive programming */
       const error = e instanceof Error ? e.message : String(e)
       return {
         exists: false,