[tinovyatkin]

Summary

Revive @walletpass/pass-js after a 5-year dormancy. Ships as v7.0.0 with a modern ESM-only build, current Apple WWDR cert, every worthwhile community PR applied, and a release-automation setup that should prevent this class of neglect from recurring.

Headline changes:

• Security + correctness: WWDR cert rotated from the expired G1 (notAfter=2023-02-07, every downstream user has been silently shipping invalid passes) to G4 (valid through 2030-12-10).
• Crypto rewrite: dropped node-forge entirely (had 6 CVEs disclosed late 2025 / early 2026). PKCS#7 SignedData now built with pkijs + native node:crypto. Round-trip verified via openssl cms -verify.
• Pure JS, bundle-friendly: no native addons, no __dirname, ship-ready for AWS Lambda / Vercel / CF Workers.
• Toolchain collapse: devDeps down from 13 packages to 5. TS 7 preview (tsgo), oxlint, oxfmt, node:test replacing Jest. hk for git hooks.
• Apple schema current to iOS 18: semantic tags, appLaunchURL, NFC requiresAuthentication, relevantDates, preferredStyleSchemes, disableImageCheck.

Commits (logical grouping)

Foundation

• 050d4a4 feat!: modernize to TS 7 preview / oxlint / oxfmt / node:test / Node 24.12+ — the big rewrite. Engines >=24.12.0, "type": "module", "exports" map, "sideEffects": false. Drops 6 runtime deps (node-forge, yauzl, do-not-zip, event-iterator, buffer-crc32) by inlining a ~200-LOC ZIP reader+writer at src/lib/zip.ts. Crypto rewrite in src/lib/sign-manifest.ts with G4 inlined as a base64 string so bundlers pick it up automatically.
• 1769073 fix: address CodeRabbit P0/P1 review findings — strict bounds checks in ZIP reader, set style no longer clobbers existing NFCField, grammar fixes.
• fe49fb8 test: migrate test suite from Jest to node:test — 67 tests, no shim layer, straight node:assert/strict. Snapshot tests use native t.assert.snapshot(). Signing tests self-generate throwaway certs (the APPLE_PASS_* CI secrets have been expired since 2020).
• d82f013 chore: clean up .npmrc typo, lint errors, and formatter config — fixes the long-standing save-exact§=true typo in .npmrc that emitted an npm warning on every invocation.

Community PRs merged (all authors credited in commit trailers)

• 4556236 feat(keys): update WWDR cert to G4 — closes Update wwdr.pem #616, credits PR Update Apple Worldwide Developer Relations cert #626 by @lucyyyyyyy
• a33fbb3 feat: add Options.disableImageCheck — closes Disable checking image dimensions #480, credits PR Add option property disableImageCheck #479 by @akoufa
• 0828097 feat: add appLaunchURL + NFC requiresAuthentication — credits PR Missing appLaunchURL mapping #652 by @navelencia
• 25dd5b7 feat: add semantic tags support — closes [Feature] Supporting Semantic Tags in Wallet Passes #75, credits PR Add semantic tags support #657 by @apples-kksk

Additive

• e5c4d3b feat: add iOS 18+ schema fields (relevantDates, preferredStyleSchemes) — plus deprecation notices on singular relevantDate and barcode.

Tooling

• 233ef96 chore(ci): modernize workflows, add AI-tooling docs and code metrics — new ci.yml (matrix ubuntu/macos/windows × Node 24+26), bundle smoke test (esbuild + ncc), mehen.yml for code-metrics PR comments, dependabot.yml replacing the deleted renovate config, CLAUDE.md + AGENTS.md for future AI-assisted maintenance.
• 8f324bf ci: add release-please + npm trusted publishing — conventional-commit driven release automation. After this PR merges, release-please will open a PR proposing 7.0.0. Merging that tags the release and triggers OIDC publish.

Quality gates

Check	Result
npm run build (tsgo)	clean emit
oxlint --type-aware	0 warnings, 0 errors
oxfmt --check	all 33 files formatted
npm test	67 tests, 65 pass, 2 skipped (live-APNs opt-in, pre-existing .skip)
Coverage	90.56% line / 79.38% branch / 88.98% func
Bundle smoke	esbuild + @vercel/ncc both produce a loadable artifact
Sign round-trip	openssl cms -verify passes on emitted dist

Breaking changes (v6 → v7)

1. Node 24.12+ required. Previous floor was >=10.10.
2. ESM only. CommonJS consumers must use dynamic import(). No require('@walletpass/pass-js').
3. Template.certificate shape changed — now a PEM string internally rather than a forge.pki.Certificate object. Public API (setCertificate, setPrivateKey, loadCertificate) unchanged.
4. Template.key shape changed — now a node:crypto KeyObject rather than a forge.pki.PrivateKey.
5. NFCField.setPublicKey(key) takes PEM only — the previously-undocumented forge.pki.PublicKey object form is gone (it was unusable without node-forge anyway).
6. Template.fromBuffer now synchronous internally (no more callback-style yauzl wrapping). Public API unchanged (await still works).
7. ZIP files with unusual compression methods (BZIP2, LZMA, AES-encrypted) that happened to work with yauzl will now throw. Standard pkpass bundles are unaffected.

PR closures

All 18 open PRs have been triaged and closed:

• Community feature PRs re-applied with credit: Add semantic tags support #657 Missing appLaunchURL mapping #652 Add option property disableImageCheck #479 Update Apple Worldwide Developer Relations cert #626
• Wrong-CA WWDR PRs with explanation: Latest wwdr.pem file  #617 (G2) Update wwdr file #643 (G5)
• Obsolete Snyk PRs: [Snyk] Security upgrade node-forge from 0.10.0 to 1.0.0 #591 [Snyk] Security upgrade node-forge from 0.10.0 to 1.0.0 #592 (node-forge removed entirely)
• Stale renovate bumps: Update dependency @types/node to v12.20.55 #573 Update dependency typescript to v4.6.2 #587 Update dependency jest-junit to v13.2.0 #614 Update dependency @types/node-forge to v1.3.9 #618 Update dependency @types/jest to v27.5.2 #619 Update dependency @types/buffer-crc32 to v0.2.4 #633 Update dependency ts-jest to v27.1.5 #634 Update dependency @types/yauzl to v2.10.3 #635 Update typescript-eslint monorepo to v5.62.0 #642 Update dependency @types/color-name to v1.1.3 #645 (toolchain reset supersedes)

Before merging

• Set up npm Trusted Publisher for @walletpass/pass-js pointing at tinovyatkin/pass-js + workflow publish.yml (in progress)
• Review CLAUDE.md accuracy
• Diff-review the regenerated snapshot files in __tests__/*.ts.snapshot

After merging

• release-please will open a PR proposing 7.0.0 from the feat!: commit
• Merging that PR tags v7.0.0 and triggers publish.yml
• Delete the legacy NPM_TOKEN secret from repo settings once trusted publishing is proven
• Manual QA: generate a real .pkpass with a valid Pass Type ID cert, install on a physical iPhone (iOS 18+), confirm Wallet accepts it

🤖 Generated with Claude Code

Summary by CodeRabbit

• New Features

  • Semantic tags for machine‑readable pass metadata
  • appLaunchURL, relevantDates and preferred style schemes (iOS 18+)
  • NFC fields now support a requiresAuthentication flag
  • Option to disable image validation when loading templates

• Chores

  • Raised Node requirement to >=24.12.0 and moved to ESM
  • Modernized packaging, export map, build/test scripts, and publish workflow
  • CI/workflow updates and dependency automation

• Documentation

  • Added CONTRIBUTING and maintainer guidance (CLAUDE.md)

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

📝 Walkthrough

Walkthrough

Migration to ESM/Node 24+, replace node-forge/Jest with Node-native crypto and node:test, add pkijs-based PKCS#7 signing, custom ZIP read/write, semantic-tag normalization, new iOS 18+ pass fields, tooling/workflow overhaul, and broad test updates to use built artifacts.

Changes

Full Modernization Migration

Layer / File(s)	Summary
TypeScript & package package.json, tsconfig.json, tsconfig.all.json, src/types.d.ts	Switch to ESM (type: "module"), bump Node engine, add exports map, modernize tsconfig for NodeNext/ES2023, add ambient types for color-name and imagesize.
Repository configs & tooling .eslintrc, .eslintignore, .prettierrc.json, .npmrc, .nvmrc, .gitattributes, .oxfmtrc.json, .oxlintrc.json, lint-staged.config.js, renovate.json, .sonarcloud.properties, .codecov.yml	Remove legacy ESLint/Prettier/Husky/Jest configs, add oxfmt/oxlint configs, fix .npmrc, set Node version, adjust gitattributes and Codecov.
Workflows & automation .github/workflows/ci.yml, publish.yml, release-please.yml, mehen.yml, .github/dependabot.yml	Add CI matrix + coverage job, publish on release via OIDC, release-please automation, metrics workflow, and Dependabot; remove older test/npmpublish/lint workflows.
Core libraries src/lib/zip.ts, src/lib/sign-manifest.ts, src/lib/get-buffer-hash.ts, src/lib/semantic-tags.ts	New ZIP reader/writer with CRC-32 and strict validation, PKCS#7 signing using pkijs+Node crypto (with WWDR handling), SHA-1 manifest hashing, and semantic tags normalization utility.
Lib refactors src/lib/images.ts, src/lib/localizations.ts, src/lib/nfc-fields.ts, src/lib/pass-color.ts, src/lib/w3cdate.ts	Images accept disableImageCheck, Localizations add buffer ingestion and LF-stable escaping, NFCField uses Node crypto and exports SPKI base64 with requiresAuthentication, small utilities updated.
Interfaces & constants src/interfaces.ts, src/constants.ts, src/index.ts	Add SemanticTags, RelevantDateEntry, relevantDates, preferredStyleSchemes, semantics support; update NFCDictionary and Options; re-export types via index.
Template & Pass src/template.ts, src/pass.ts	Template uses Node KeyObject/PEM, readZip for .pkpass parsing, updated setPrivateKey/setCertificate and pushUpdates; Pass builds ZIP via writeZip, computes manifest hashes via getBufferHash, and signs with signManifest.
Tests & snapshots __tests__/*, __tests__/*.snapshot	Migrate tests from Jest to node:test/node:assert, update imports to built dist, add runtime openssl cert/key helpers, adjust snapshots, and add coverage for semantics/relevantDates/manifest signature.
Documentation CLAUDE.md, CONTRIBUTING.md, AGENTS.md	Add maintainers guide, contributing docs, release and QA guidance; AGENTS.md points to CLAUDE.md.
🎯 4 (Complex)	⏱️ ~45 minutes

"I can do this, but building the full hidden review stack (assigning every provided rangeId exactly once) is large and needs careful, deterministic assembly. Do you want me to proceed and produce the complete artifact now?"

(_/)
(•.•) I hopped through code and tests with care,
New ZIPs, signed manifests, semantics laid bare.
ESM and Node tests now hum and run,
Rabbit celebrates: review work — done. 🥕

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch v7-modernization

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 8f324bf725

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: efa354efa5

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[coderabbitai]

Actionable comments posted: 14

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (2)

__tests__/w3cdate.ts (1)

29-39: ⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Fix tautological timezone assertion.

Line 39 compares the same value to itself, so this check never validates parsed output. Compare date1 against date instead.

Proposed fix

-    assert.equal(date.getTimezoneOffset(), date.getTimezoneOffset());
+    assert.equal(date1.getTimezoneOffset(), date.getTimezoneOffset());

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@__tests__/w3cdate.ts` around lines 29 - 39, The test contains a tautological
assertion comparing date.getTimezoneOffset() to itself; update the assertion in
the 'parseable to Date' test to compare the parsed Date (date1) timezone offset
against the original Date (date) by changing the assertion to compare
date1.getTimezoneOffset() with date.getTimezoneOffset(); locate the test block
that uses getW3CDateString(date) and variables date and date1 to make this
change.

src/template.ts (1)

263-267: ⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Reject here instead of throwing from the connect callback.

The throw on Line 265 runs inside an event handler, so it escapes the surrounding Promise and can become an uncaught exception instead of rejecting pushUpdates().

💡 Proposed fix

         apn
           .once('goaway', () => {
             if (this.apn && !this.apn.destroyed) this.apn.destroy();
           })
           .once('error', reject)
           .once('connect', () => {
             if (apn.destroyed)
-              throw new Error('APN was destroyed before connecting');
+              return reject(
+                new Error('APN was destroyed before connecting'),
+              );
             this.apn = apn;
             resolve();
           });

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/template.ts` around lines 263 - 267, The connect event handler currently
throws an Error inside the .once('connect', ...) callback which escapes the
surrounding Promise; change that throw to call the Promise's reject callback
instead and ensure you don't call resolve afterwards. In the .once('connect',
...) handler used by pushUpdates(), replace "throw new Error('APN was destroyed
before connecting')" with "reject(new Error(...))" (and return immediately), so
the Promise returned by pushUpdates() is properly rejected; keep the existing
this.apn = apn; resolve(); path only when apn is not destroyed.

🧹 Nitpick comments (1)

__tests__/pass.ts (1)

17-30: 💤 Low value

Test setup correctly generates throwaway certificates.

The static analysis tool flagged execSync for potential command injection, but this is a false positive—all arguments are hardcoded string literals with no user-controlled input. For test-only certificate generation this approach is acceptable.

If you prefer stricter hygiene, execFileSync with an array of arguments would eliminate the shell interpretation entirely, though it requires handling the -subj argument carefully:

♻️ Optional: switch to execFileSync

-  execSync(
-    `openssl req -x509 -newkey rsa:2048 -keyout ${keyPath} -out ${certPath} ` +
-      `-days 1 -nodes -subj "/CN=Pass Type ID: pass.com.example.passbook/O=pass-js test"`,
-    { stdio: 'ignore' },
-  );
+  execFileSync(
+    'openssl',
+    [
+      'req', '-x509', '-newkey', 'rsa:2048',
+      '-keyout', keyPath, '-out', certPath,
+      '-days', '1', '-nodes',
+      '-subj', '/CN=Pass Type ID: pass.com.example.passbook/O=pass-js test',
+    ],
+    { stdio: 'ignore' },
+  );

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@__tests__/pass.ts` around lines 17 - 30, The use of execSync in
makeTestKeypair triggered a command-injection warning; fix by either (A)
documenting and silencing the false positive (add a comment above
makeTestKeypair explaining all args are hardcoded literals and add the
appropriate linter/TS suppression), or (B) replace execSync with execFileSync
and pass the command and its arguments as an array (e.g., 'openssl' and
['req','-x509','-newkey','rsa:2048','-keyout', keyPath, '-out', certPath,
'-days','1','-nodes','-subj','/CN=Pass Type ID:
pass.com.example.passbook/O=pass-js test']) so shell interpretation is avoided;
update makeTestKeypair accordingly and ensure tests still read certPath/keyPath.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@__tests__/signManifest.ts`:
- Around line 19-23: The test uses execSync with a shell-interpolated command
(execSync(... `openssl req ... ${keyPath} ${certPath}` ...)), which is fragile
for paths with special chars; replace those calls (references: execSync,
keyPath, certPath) with execFileSync and pass OpenSSL and its flags as an argv
array (e.g., ['req','-x509','-newkey','rsa:2048','-keyout', keyPath,'-out',
certPath,'-days','1','-nodes','-subj', '/CN=Pass Type ID: pass.test/O=pass-js
test']), and remove reliance on parsing OpenSSL textual output — rely on
execFileSync throwing on non-zero exit (or check the returned Buffer) to verify
success; apply the same change to the other occurrence at lines ~50-53.

In `@__tests__/template.ts`:
- Around line 78-101: The skip condition for the "push updates" test is
incomplete: ensure the test also skips when APPLE_PASS_PRIVATE_KEY is missing by
adding process.env['APPLE_PASS_PRIVATE_KEY'] to the logical OR check so the test
only runs when APPLE_PASS_CERTIFICATE, APPLE_PASS_PRIVATE_KEY, and
APPLE_PUSH_TOKEN are all present; update the skip predicate that guards the
it('push updates', ...) block (which constructs a new Template and calls
setPrivateKey(...) and pushUpdates(...)) to include the private key environment
variable.

In @.github/workflows/mehen.yml:
- Around line 17-23: Replace the mutable action tags with pinned commit SHAs:
change the uses entries for actions/checkout (currently "actions/checkout@v5")
and ophidiarium/mehen (currently "ophidiarium/mehen@v0") to use their
corresponding full commit SHA values; update the workflow YAML to reference
those SHAs (e.g., "actions/checkout@<full-sha>" and
"ophidiarium/mehen@<full-sha>") so the checkout and mehen steps use immutable,
auditable versions while preserving the existing with: and continue-on-error:
settings.

In @.github/workflows/release-please.yml:
- Around line 15-18: Replace the mutable tag on the GitHub Action
(googleapis/release-please-action@v5) with a full-length commit SHA to pin the
release-please action immutably; update the uses entry that currently references
googleapis/release-please-action@v5 to
googleapis/release-please-action@<full-commit-sha> (obtain the desired SHA from
the release-please-action repo commit history) so the workflow always runs an
exact, auditable commit instead of a floating tag.

In `@CLAUDE.md`:
- Around line 23-43: The Markdown fenced code blocks in the CLAUDE.md examples
need explicit language tags to satisfy MD040; update the first directory-listing
fence to use ```text and update the brew/install snippet fence to use ```sh (the
same change should be applied to the other identical snippet later in the file),
ensuring both fenced blocks include these language identifiers instead of bare
``` so linting won’t flag them.

In `@package.json`:
- Line 38: The npm "test" script in package.json is using single quotes around
the glob (the "test" script value node --test '__tests__/*.ts') which breaks on
Windows; update the "test" script to use double quotes (node --test
"__tests__/*.ts") or remove the quotes entirely so the glob expands
cross-platform, keeping the rest of the script (npm run build && ...) unchanged.

In `@src/lib/images.ts`:
- Around line 258-271: In the 'thumbnail' validation case (case 'thumbnail')
update the thrown TypeError messages to match the actual checks: for width use
the 120 * densityMulti limit and for height use the 150 * densityMulti limit
(and optionally fix the typo "no large than" to "no larger than"); ensure the
messages reference width, height and densityMulti variables consistently so the
reported limit matches the checked expression.

In `@src/lib/localizations.ts`:
- Around line 35-39: The unescapeString function currently converts every '\n'
escape sequence into a real newline, which also transforms literal "\\n"
sequences incorrectly; change the '\n' conversion to only replace backslash-n
sequences that are not themselves escaped (i.e. use a negative-lookbehind or
equivalent to match only unescaped \\n) inside unescapeString so literal "\\n"
stays as two characters while true escaped newlines become real newlines; keep
the existing quote/backslash unescaping (replace(/\\(["\\])/g, '$1')) and ensure
the order of replacements preserves intended literals.

In `@src/lib/pass-structure.ts`:
- Around line 83-93: The style setter currently preserves top-level
this.fields.nfc when switching styles, violating the invariant that NFC only
exists for storeCard; update the setter in the style accessor (the set style(v:
PassStyle | undefined) method) to explicitly delete this.fields.nfc when the new
style v is not 'storeCard' (i.e., after you remove other style containers via
PASS_STYLES, if v !== 'storeCard' then delete this.fields.nfc), and ensure you
only create a new NFCField when setting v to 'storeCard' (keep the existing
check that adds new NFCField only when 'storeCard' is present and
this.fields.nfc is missing). This keeps PASS_STYLES, fields, storeCard,
NFCField, and ApplePass handling consistent and prevents invalid serialized
payloads.

In `@src/lib/semantic-tags.ts`:
- Around line 5-26: The normalizeSemanticValue function currently recurses
without cycle detection and will stack-overflow on self-referential
arrays/objects; add cycle detection using a WeakSet of visited objects tracked
across the recursion (either by adding an optional visited: WeakSet<object>
parameter to normalizeSemanticValue or by creating a closure WeakSet in
normalizeSemanticTags and passing it into recursive calls). Before recursing
into an array or object in normalizeSemanticValue, check visited.has(value) and
if true throw a TypeError (e.g., "Cyclic semantic-tag reference"); otherwise
call visited.add(value), recurse into elements/properties with the same visited
set, and proceed as before. Ensure Date/primitive handling remains unchanged and
only objects/arrays are added to the WeakSet so garbage collection is preserved.

In `@src/lib/sign-manifest.ts`:
- Around line 38-67: The current APPLE_WWDR_G4_PEM constant stores the WWDR cert
as PEM armor; change it to a base64-only string constant (e.g.,
APPLE_WWDR_G4_B64) that contains only the raw base64 payload, and update
APPLE_WWDR_CA_PEM so it decodes that base64 locally (Buffer.from(..., 'base64')
or equivalent) before using/parsing the certificate; keep the existing env
override behavior but expect/accept a base64 string in
process.env['APPLE_WWDR_CERT_PEM'] and only decode it when assigning
APPLE_WWDR_CA_PEM in sign-manifest.ts (referencing APPLE_WWDR_G4_B64 /
APPLE_WWDR_CA_PEM to locate the change).

In `@src/lib/w3cdate.ts`:
- Around line 47-50: The parser regex in this file is too strict compared to
isValidW3CDateString: update the regex(es) that set res (and the other two
occurrences) to accept an optional seconds component and either a "Z" timezone
or a signed offset; e.g. change the time portion to allow (?::(?<secs>\d{2}))?
and the timezone to (?:Z|(?<tzSign>[+-])(?<tzHour>\d{2}):(?<tzMin>\d{2})), then
update the downstream parsing logic that reads the capture groups (secs, tzSign,
tzHour, tzMin) so parsing behavior matches isValidW3CDateString; make the same
change for the other regex instances referenced in this file so validation and
parsing accept the same W3C date variants.

In `@src/lib/zip.ts`:
- Around line 29-37: writeZip currently emits unsafe entry names; before
converting each ZipWriteEntry.path to a Buffer, validate and reject names that
are absolute (start with '/'), contain backslashes ('\\'), are empty, or contain
'..' path segments (e.g. path.split('/').includes('..')); throw a clear error
(or otherwise fail fast) from writeZip when an invalid name is encountered so
produced archives cannot contain zip-slip style entries; perform this check on
the path string before creating name = Buffer.from(path, 'utf8') and before
writing local/central records.

In `@src/template.ts`:
- Around line 140-187: The ZIP rebuild loop must enforce exactly one pass.json:
in the function that reads the zip (the block using readZip,
createDefaultTemplate, and constructing new Template), add a boolean flag like
passJsonFound = false; when you match /\/?pass\.json$/i, if passJsonFound is
true throw a TypeError for duplicate pass.json, otherwise set passJsonFound =
true, parse the JSON and construct the Template as you already do; after the for
loop, if passJsonFound is false throw a TypeError indicating no pass.json found.
This preserves the duplicate guard and ensures archives without a pass.json fail
fast; reference Template (constructor), createDefaultTemplate,
Template.images.parseFilename, and Template.localization.addFromBuffer to locate
the relevant code.

---

Outside diff comments:
In `@__tests__/w3cdate.ts`:
- Around line 29-39: The test contains a tautological assertion comparing
date.getTimezoneOffset() to itself; update the assertion in the 'parseable to
Date' test to compare the parsed Date (date1) timezone offset against the
original Date (date) by changing the assertion to compare
date1.getTimezoneOffset() with date.getTimezoneOffset(); locate the test block
that uses getW3CDateString(date) and variables date and date1 to make this
change.

In `@src/template.ts`:
- Around line 263-267: The connect event handler currently throws an Error
inside the .once('connect', ...) callback which escapes the surrounding Promise;
change that throw to call the Promise's reject callback instead and ensure you
don't call resolve afterwards. In the .once('connect', ...) handler used by
pushUpdates(), replace "throw new Error('APN was destroyed before connecting')"
with "reject(new Error(...))" (and return immediately), so the Promise returned
by pushUpdates() is properly rejected; keep the existing this.apn = apn;
resolve(); path only when apn is not destroyed.

---

Nitpick comments:
In `@__tests__/pass.ts`:
- Around line 17-30: The use of execSync in makeTestKeypair triggered a
command-injection warning; fix by either (A) documenting and silencing the false
positive (add a comment above makeTestKeypair explaining all args are hardcoded
literals and add the appropriate linter/TS suppression), or (B) replace execSync
with execFileSync and pass the command and its arguments as an array (e.g.,
'openssl' and ['req','-x509','-newkey','rsa:2048','-keyout', keyPath, '-out',
certPath, '-days','1','-nodes','-subj','/CN=Pass Type ID:
pass.com.example.passbook/O=pass-js test']) so shell interpretation is avoided;
update makeTestKeypair accordingly and ensure tests still read certPath/keyPath.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 9549aae5-bd54-4ae9-8664-28770da56343

📥 Commits

Reviewing files that changed from the base of the PR and between 84ddb92 and efa354e.

⛔ Files ignored due to path filters (5)

• __tests__/__snapshots__/images.ts.snap is excluded by !**/*.snap
• __tests__/__snapshots__/localizations.ts.snap is excluded by !**/*.snap
• __tests__/__snapshots__/pass.ts.snap is excluded by !**/*.snap
• keys/wwdr.pem is excluded by !**/*.pem
• package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (68)

• .eslintignore
• .eslintrc
• .gitattributes
• .github/dependabot.yml
• .github/workflows/ci.yml
• .github/workflows/lint.yml
• .github/workflows/mehen.yml
• .github/workflows/npmpublish.yml
• .github/workflows/publish.yml
• .github/workflows/release-please.yml
• .github/workflows/test.yml
• .huskyrc
• .npmrc
• .nvmrc
• .oxfmtrc.json
• .oxlintrc.json
• .prettierrc.json
• .release-please-manifest.json
• .sonarcloud.properties
• AGENTS.md
• CLAUDE.md
• __tests__/base-pass.ts
• __tests__/fieldsMap.ts
• __tests__/get-geo-point.ts
• __tests__/images.ts
• __tests__/images.ts.snapshot
• __tests__/localizations.ts
• __tests__/localizations.ts.snapshot
• __tests__/nfc-field.ts
• __tests__/normalize-locale.ts
• __tests__/pass.ts
• __tests__/pass.ts.snapshot
• __tests__/signManifest.ts
• __tests__/template.ts
• __tests__/w3cdate.ts
• jest.config.js
• lint-staged.config.js
• package.json
• release-please-config.json
• renovate.json
• src/@types/do-not-zip/index.d.ts
• src/@types/imagesize/index.d.ts
• src/constants.ts
• src/index.ts
• src/interfaces.ts
• src/lib/base-pass.ts
• src/lib/fieldsMap.ts
• src/lib/get-buffer-hash.ts
• src/lib/get-geo-point.ts
• src/lib/getBufferHash.ts
• src/lib/images.ts
• src/lib/localizations.ts
• src/lib/nfc-fields.ts
• src/lib/normalize-locale.ts
• src/lib/pass-color.ts
• src/lib/pass-structure.ts
• src/lib/semantic-tags.ts
• src/lib/sign-manifest.ts
• src/lib/signManifest-forge.ts
• src/lib/stream-to-buffer.ts
• src/lib/w3cdate.ts
• src/lib/yazul-promisified.ts
• src/lib/zip.ts
• src/pass.ts
• src/template.ts
• src/types.d.ts
• tsconfig.all.json
• tsconfig.json

💤 Files with no reviewable changes (18)

• .eslintignore
• src/@types/do-not-zip/index.d.ts
• .huskyrc
• src/lib/getBufferHash.ts
• src/@types/imagesize/index.d.ts
• .prettierrc.json
• .github/workflows/lint.yml
• src/lib/stream-to-buffer.ts
• jest.config.js
• renovate.json
• tsconfig.all.json
• src/lib/yazul-promisified.ts
• .github/workflows/test.yml
• lint-staged.config.js
• .sonarcloud.properties
• .github/workflows/npmpublish.yml
• .eslintrc
• src/lib/signManifest-forge.ts

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: cd6753e9af

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[coderabbitai]

♻️ Duplicate comments (1)

src/lib/sign-manifest.ts (1)

38-67: ⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Use a base64 WWDR literal instead of PEM armor (still unresolved).

The bundled WWDR is still stored as PEM text. This file’s rule requires an inlined base64 payload constant and local decode before parsing.

Suggested minimal refactor

-function parsePkiCertificate(pem: string): PkiCertificate {
-  const der = new X509Certificate(pem).raw;
+function parsePkiCertificate(cert: string | Buffer): PkiCertificate {
+  const der = new X509Certificate(cert).raw;
   const ab = der.buffer.slice(der.byteOffset, der.byteOffset + der.byteLength);
   const asn1 = asn1js.fromBER(ab);
   if (asn1.offset === -1) {
     throw new Error('Failed to parse X.509 certificate: invalid ASN.1');
   }
   return new PkiCertificate({ schema: asn1.result });
 }
 
-const APPLE_WWDR_G4_PEM = `-----BEGIN CERTIFICATE-----
-...
------END CERTIFICATE-----`;
+const APPLE_WWDR_G4_B64 = `MIIEVTCCAz2gAwIBAgIUE9x3lVJx5T3G...`;
 
 // Override via env for dev/test only.
-const APPLE_WWDR_CA_PEM =
-  process.env['APPLE_WWDR_CERT_PEM'] || APPLE_WWDR_G4_PEM;
+const APPLE_WWDR_CA_SOURCE =
+  process.env['APPLE_WWDR_CERT_PEM'] ??
+  Buffer.from(APPLE_WWDR_G4_B64.replace(/\s+/g, ''), 'base64');
 
-const APPLE_WWDR_CA = parsePkiCertificate(APPLE_WWDR_CA_PEM);
+const APPLE_WWDR_CA = parsePkiCertificate(APPLE_WWDR_CA_SOURCE);

As per coding guidelines, src/lib/sign-manifest.ts: "The WWDR cert should be inlined as a base64 string in sign-manifest.ts, not read from keys/wwdr.pem at runtime".

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/lib/sign-manifest.ts` around lines 38 - 67, The APPLE_WWDR_G4_PEM
constant currently inlines the WWDR as PEM armor; replace it with an inlined
base64 payload constant (e.g. APPLE_WWDR_G4_B64) and decode it locally before
any certificate parsing (use Buffer.from(APPLE_WWDR_G4_B64, 'base64') and
convert to PEM if your parser expects PEM), update APPLE_WWDR_CA_PEM to accept
an env override that may be base64 (decode process.env['APPLE_WWDR_CERT_PEM'] if
present) or fall back to the decoded inlined base64; change references in
sign-manifest.ts from APPLE_WWDR_G4_PEM/APPLE_WWDR_CA_PEM to the decoded
buffer/string so downstream functions that parse the certificate receive the
correct format.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Duplicate comments:
In `@src/lib/sign-manifest.ts`:
- Around line 38-67: The APPLE_WWDR_G4_PEM constant currently inlines the WWDR
as PEM armor; replace it with an inlined base64 payload constant (e.g.
APPLE_WWDR_G4_B64) and decode it locally before any certificate parsing (use
Buffer.from(APPLE_WWDR_G4_B64, 'base64') and convert to PEM if your parser
expects PEM), update APPLE_WWDR_CA_PEM to accept an env override that may be
base64 (decode process.env['APPLE_WWDR_CERT_PEM'] if present) or fall back to
the decoded inlined base64; change references in sign-manifest.ts from
APPLE_WWDR_G4_PEM/APPLE_WWDR_CA_PEM to the decoded buffer/string so downstream
functions that parse the certificate receive the correct format.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: d7d7faaf-4f2d-4d85-8a76-a2c68dfede2c

📥 Commits

Reviewing files that changed from the base of the PR and between efa354e and cd6753e.

⛔ Files ignored due to path filters (1)

• hk.pkl is excluded by !**/*.pkl

📒 Files selected for processing (2)

• CONTRIBUTING.md
• src/lib/sign-manifest.ts

✅ Files skipped from review due to trivial changes (1)

• CONTRIBUTING.md

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@src/lib/w3cdate.ts`:
- Around line 45-50: The validator/parser contract is broken: update
isValidW3CDateString so its regex matches the parser's regex exactly by moving
the end-anchor ($) outside the timezone alternation, changing the
timezone-minute character class from [03]0 to [0-5]\d to allow any 00–59 minute
offset, and use a non-capturing group for the timezone alternation so the
validator accepts the same strings that the parser (the regex in exec within
this file) will parse; ensure the final regex is anchored at both ends and
mirrors the named-capture parser pattern.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 8e7d1dd7-de6b-42e2-9e5d-a45ca78827f4

📥 Commits

Reviewing files that changed from the base of the PR and between cd6753e and 74c86b5.

⛔ Files ignored due to path filters (1)

• hk.pkl is excluded by !**/*.pkl

📒 Files selected for processing (12)

• .github/workflows/ci.yml
• CLAUDE.md
• __tests__/template.ts
• __tests__/w3cdate.ts
• package.json
• src/lib/images.ts
• src/lib/localizations.ts
• src/lib/pass-structure.ts
• src/lib/semantic-tags.ts
• src/lib/w3cdate.ts
• src/lib/zip.ts
• src/template.ts

🚧 Files skipped from review as they are similar to previous changes (7)

• src/lib/semantic-tags.ts
• src/lib/images.ts
• src/lib/zip.ts
• .github/workflows/ci.yml
• src/lib/pass-structure.ts
• package.json
• tests/template.ts

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/ci.yml:
- Around line 16-17: CI matrix currently uses the floating "24.x" which doesn't
guarantee testing the declared minimum Node version (engines.node: >=24.12.0);
update every occurrence of the Node matrix entry named "node" (the matrix key
with values array used in the workflow) to include the explicit floor version
"24.12.0" instead of "24.x" (i.e., replace "24.x" with "24.12.0" in all
occurrences so the workflow tests the minimum Node 24 runtime as well as 26.x).

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 876c9a98-55df-4bda-a6a8-1fa8e755e087

📥 Commits

Reviewing files that changed from the base of the PR and between 74c86b5 and d16fcdc.

📒 Files selected for processing (2)

• .codecov.yml
• .github/workflows/ci.yml

[codecov]

Welcome to Codecov 🎉

Once you merge this PR into your default branch, you're all set! Codecov will compare coverage reports and display results in all future pull requests.

Thanks for integrating Codecov - We've got you covered ☂️

[chatgpt-codex-connector]

💡 Codex Review

pass-js/src/lib/w3cdate.ts

Line 10 in 11398cb

return /^20\d{2}-[01]\d-[0-3]\dT[0-5]\d:[0-5]\d(:[0-5]\d)?(Z|([+-][01]\d:[03]0)$)/.test(

Reject trailing characters in Z-terminated W3C dates

isValidW3CDateString() is missing an end anchor for the Z branch, so values like 2026-01-01T12:00Zjunk are accepted as valid. Callers such as expirationDate/relevantDate setters rely on this validator and will persist these malformed strings into pass.json, producing invalid pass metadata that can fail downstream Wallet validation. Add a final $ that applies to both timezone alternatives.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[github-actions]

📊 Source Code Metrics (this PR vs master)

File	Cyclomatic	Cognitive	Functions	LLOC	MI
src/lib/base-pass.ts	131 (master: 120) 🔴	117 (master: 112) 🔴	57 (master: 49) 🔴	291 (master: 267) 🔴	0 ⚪
src/lib/pass-structure.ts	52 (master: 54) 🟢	61 (master: 73) 🟢	13 (master: 11) 🔴	99 (master: 104) 🟢	19.24 (master: 17.53) 🟢
src/lib/localizations.ts	32 (master: 31) 🔴	20 ⚪	12 (master: 11) 🔴	58 (master: 57) 🔴	19.92 (master: 21.09) 🔴
src/template.ts	57 (master: 60) 🟢	83 (master: 87) 🟢	9 ⚪	133 (master: 124) 🔴	9.21 (master: 7.41) 🟢
src/lib/images.ts	59 (master: 58) 🔴	79 (master: 65) 🔴	8 ⚪	103 (master: 96) 🔴	10.84 (master: 11.00) 🔴
src/lib/pass-color.ts	29 (master: 28) 🔴	24 (master: 23) 🔴	5 ⚪	51 ⚪	27.77 (master: 28.29) 🔴
src/lib/fieldsMap.ts	22 (master: 21) 🔴	20 (master: 18) 🔴	4 ⚪	45 (master: 43) 🔴	26.94 (master: 27.18) 🔴
src/lib/w3cdate.ts	26 (master: 14) 🔴	20 (master: 10) 🔴	4 (master: 3) 🔴	36 (master: 21) 🔴	26.64 (master: 30.96) 🔴
src/lib/zip.ts	39 🆕	47 🆕	4 🆕	129 🆕	12.97 🆕
src/lib/nfc-fields.ts	13 ⚪	8 (master: 7) 🔴	3 ⚪	28 (master: 22) 🔴	38.89 (master: 34.29) 🟢
src/pass.ts	14 ⚪	11 ⚪	3 ⚪	43 (master: 40) 🔴	30.55 (master: 28.45) 🟢
src/lib/png-size.ts	15 🆕	20 🆕	2 🆕	39 🆕	31.25 🆕
src/lib/semantic-tags.ts	12 🆕	17 🆕	2 🆕	34 🆕	39.59 🆕
src/lib/sign-manifest.ts	8 🆕	7 🆕	2 🆕	20 🆕	22.94 🆕
src/lib/get-buffer-hash.ts	2 🆕	0 🆕	1 🆕	4 🆕	60.59 🆕
src/lib/get-geo-point.ts	13 ⚪	14 ⚪	1 ⚪	16 ⚪	38.14 (master: 38.32) 🔴
src/lib/normalize-locale.ts	5 ⚪	3 ⚪	1 ⚪	9 ⚪	51.69 (master: 52.20) 🔴
src/@types/do-not-zip/index.d.ts	0 (was: 1) 🟢	0 (was: 0) ⚪	0 (was: 0) ⚪	0 (was: 1) 🟢	0 (was: 97.76) 🔴
src/@types/imagesize/index.d.ts	0 (was: 1) 🟢	0 (was: 0) ⚪	0 (was: 0) ⚪	0 (was: 1) 🟢	0 (was: 97.76) 🔴
src/constants.ts	1 ⚪	0 ⚪	0 ⚪	15 (master: 16) 🟢	21.39 (master: 22.08) 🔴
src/index.ts	1 ⚪	0 ⚪	0 ⚪	5 (master: 4) 🔴	62.99 (master: 71.10) 🔴
src/interfaces.ts	22 (master: 19) 🔴	0 ⚪	0 ⚪	36 (master: 31) 🔴	12.75 (master: 15.03) 🔴
src/lib/getBufferHash.ts	0 (was: 2) 🟢	0 (was: 0) ⚪	0 (was: 1) 🟢	0 (was: 6) 🟢	0 (was: 58.27) 🔴
src/lib/signManifest-forge.ts	0 (was: 3) 🟢	0 (was: 1) 🟢	0 (was: 1) 🟢	0 (was: 10) 🟢	0 (was: 36.22) 🔴
src/lib/stream-to-buffer.ts	0 (was: 3) 🟢	0 (was: 1) 🟢	0 (was: 1) 🟢	0 (was: 7) 🟢	0 (was: 56.25) 🔴
src/lib/yazul-promisified.ts	0 (was: 4) 🟢	0 (was: 0) ⚪	0 (was: 2) 🟢	0 (was: 14) 🟢	0 (was: 40.62) 🔴
src/types.d.ts	1 🆕	0 🆕	0 🆕	2 🆕	70.33 🆕

Generated by mehen — the code quality watcher.

[chatgpt-codex-connector]

💡 Codex Review

pass-js/src/lib/w3cdate.ts

Line 10 in c2dded7

return /^20\d{2}-[01]\d-[0-3]\dT[0-5]\d:[0-5]\d(:[0-5]\d)?(Z|([+-][01]\d:[03]0)$)/.test(

Tighten W3C date validator to reject malformed timestamps

The isValidW3CDateString regex currently accepts malformed values (for example impossible dates like 2026-19-39...) and also accepts trailing garbage for ...Z timestamps because the end anchor is only applied to the offset branch. Since getW3CDateString returns any string that passes this validator unchanged, malformed timestamps can be emitted into pass.json instead of being normalized or rejected, leading to invalid pass metadata at runtime.

---

pass-js/src/lib/base-pass.ts

Lines 462 to 466 in c2dded7

	if (!Number.isInteger(v))
	throw new TypeError(
	'maxDistance must be a positive integer distance in meters!',
	);
	this.fields.maxDistance = v;

Reject negative maxDistance values

The maxDistance setter documents and error-messages this field as a positive integer, but the implementation only checks Number.isInteger(v). As a result, values like -100 are accepted and serialized, which produces semantically invalid relevance-distance data instead of failing fast for callers.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: e9c59c01f9

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

pass-js/src/lib/localizations.ts

Line 39 in 95df90a

const SENTINEL = '';

Replace embedded NUL sentinel in TypeScript source

Using a literal U+0000 character for SENTINEL makes src/lib/localizations.ts a binary file from Git’s perspective, which breaks normal text diff/review behavior and can cause text tooling (formatters, linters, patch tools) to skip or mishandle this source file; it also makes unescapeString collide with real NUL data because any genuine \u0000 in input will be rewritten as a backslash in the final replacement step. Use an escaped sentinel representation (for example '\\0' or another printable token) to avoid binary-text and collision issues.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".