fix: subscription delegation reuse startdate

[tuna1207]

Explanation

SubscriptionDelegationService was reusing a stored cash-subscription delegation whenever its period startDate was already in the past. The Subscription API only accepts a stored startDate inside a window around the start date this checkout would sign: 14 days before that date through 5 minutes after it. A live permission older than 14 days still matched on the client, so POST /subscriptions/crypto failed with E214 (Delegation startDate must be between …).

The fingerprint now takes the checkout's computed startDate as expectedStartDate and reuses a stored permission only when its period startDate is inside that same window. A non-positive startDate is rejected. When the checkout start is still in the future (a trial), a live permission also fails the trial floor (now + 1), so a redeemable permission cannot satisfy a trial checkout. Both prepareDelegation and startSubscriptionWithDelegation already share this predicate, so both paths sign a new delegation when every stored match is outside the window.

The skew constants match va-mmcx-subscription-api (START_DATE_PAST_SKEW_SECONDS = 14 days, START_DATE_FUTURE_SKEW_SECONDS = 5 minutes). Trial length is unchanged and still comes from getDelegationStartDate. isTrialDeferred is gone from the internal fingerprint type; that type is not a package export, so this is not a consumer-facing signature change.

References

• Incident: POST /v1/subscriptions/crypto returned SubscriptionServiceError / errorCode: E214 / httpStatus: 400, with bounds spanning exactly 14 days + 5 minutes (non-trial, trialPeriodDays === 0).
• Server rule: va-mmcx-subscription-api src/delegation/caveat-enforcers/validate.ts.

Checklist

• I've updated the test suite for new or updated code as appropriate
• I've updated documentation (JSDoc, Markdown, etc.) for new or updated code as appropriate
• I've communicated my changes to consumers by updating changelogs for packages I've changed
• I've introduced breaking changes in this PR and have prepared draft pull requests for clients and consumer packages to resolve them

Test plan

• yarn workspace @metamask/subscription-controller run test (100% coverage on the package)
• yarn changelog:validate
• Confirm a checkout with a stored delegation older than 14 days signs a new permission instead of resubmitting the stale hash
• Confirm a stored delegation inside the 14-day window is still reused
• Confirm a trial checkout does not reuse an immediately redeemable delegation

---

Note

Medium Risk
Changes subscription checkout delegation reuse logic for crypto payments; incorrect window math could cause extra signing or missed reuse, but aligns client behavior with the API and fixes production E214 failures.

Overview
Fixes E214 on crypto subscription checkout by tightening when stored cash-subscription delegations can be reused.

Delegation fingerprinting no longer treats any past startDate as reusable. It passes the checkout’s computed expectedStartDate and only reuses a stored permission if its period startDate lies in the Subscription API window (14 days before through 5 minutes after that date, aligned with va-mmcx-subscription-api). Trial checkouts also enforce a floor so an immediately redeemable permission cannot satisfy a future start. Stale permissions outside the window cause prepareDelegation and startSubscriptionWithDelegation to sign and register a new delegation instead of resubmitting an old hash.

Tests and changelog cover the >14-day stale case and window boundary behavior.

^{Reviewed by Cursor Bugbot for commit eb39452. Bugbot is set up for automated code reviews on this repo. Configure here.}