Fix end-of-validity computation: don't add validityDuration to explicit end-of-validity fields

validityDuration is the duration of the dynamic ticket (level2), not an
offset to add to endOfValidityYear/Day/Time. Only use validityDuration
in the v1 fallback path (issuingTime + duration).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: chtitux

src/time-helpers.ts

@@ -49,7 +49,8 @@ export function getIssuingTime(ticket: UicBarcodeTicket): Date | undefined {
  * Compute the end-of-validity timestamp as a UTC Date.
  *
  * - **v2 headers**: `endOfValidityYear` + `endOfValidityDay` +
- *   `endOfValidityTime` (minutes) + `validityDuration` (seconds).
+ *   `endOfValidityTime` (minutes).  `validityDuration` is ignored
+ *   when explicit end-of-validity fields are present.
  * - **v1 headers**: issuing time + `validityDuration` (seconds).
  *
  * Returns `undefined` when required fields are missing.
@@ -59,8 +60,7 @@ export function getEndOfValidityTime(ticket: UicBarcodeTicket): Date | undefined
 
   if (headerVersion(ticket) >= 2 && l1.endOfValidityYear != null && l1.endOfValidityDay != null) {
     return new Date(
-      Date.UTC(l1.endOfValidityYear, 0, l1.endOfValidityDay, 0, l1.endOfValidityTime ?? 0)
-      + (l1.validityDuration ?? 0) * 1000,
+      Date.UTC(l1.endOfValidityYear, 0, l1.endOfValidityDay, 0, l1.endOfValidityTime ?? 0),
     );
   }
 

tests/time-helpers.test.ts

@@ -139,8 +139,8 @@ describe('getEndOfValidityTime', () => {
     const decoded = decodeTicket(bytesToHex(encoded));
     const time = getEndOfValidityTime(decoded);
     expect(time).toBeDefined();
-    // Day 200 of 2025 = July 19, 12:00 + 3600s = 13:00
-    expect(time!.toISOString()).toBe('2025-07-19T13:00:00.000Z');
+    // Day 200 of 2025 = July 19, 12:00 — validityDuration is NOT added
+    expect(time!.toISOString()).toBe('2025-07-19T12:00:00.000Z');
   });
 
   it('computes v2 end-of-validity from issuing time + validityDuration only', () => {