feat(auth): verify delegated company signatures from eVault history and build delegated sign requests

[coodos]

Description of change

PR 4 of 5 for company signing delegation: what platforms call. The eVault stays a plain store; this reads it and decides.

• verifyDelegatedSignature({ payload, signature, registryBaseUrl, platformToken }):

  1. parses the w3ds-sign/v1 payload,
  2. checks the delegate's signature (verifyEnameSignature),
  3. resolves the company's eVault and takes its Company record from /whois (type: company, pinned manifest),
  4. pages metaEnvelopeHistory (100 per page, bounded) with the platform token,
  5. runs evaluateFromHistory + checkDelegatedSignature from @metastate-foundation/delegation.

  Returns { valid, companyEName, title, scopes, appLimits[], chain } or { valid: false, error, detail }. Never throws. Grant checks are memoised per verification.

• buildDelegatedSignRequest: the w3ds://sign URI whose session is the payload, with data.message "Signing as <title> for ". No wallet changes. Non-ASCII is \u-escaped so the wallet's atob + JSON.parse shows names correctly.

• buildGrantSignRequest: the same for a director/delegate approving a Company, Role, Delegation or Shareholding record under a pre-chosen id; returns payload and signedAt to assemble authorization.

• verifyLoginSignature rejects any w3ds- session (reserved_payload), so a company or grant signature is never a login.

Issue Number

Type of change

• New (a change which implements a new feature)

How the change has been tested

delegated-signature.spec.ts (11): real P-256 wallets, Registry-signed key binding certificates and a mocked Registry + eVault serving paginated metaEnvelopeHistory, with records signed through buildGrantSignRequest. Covers a valid signature; forged signer; uncovered scope; plain login string; revoked delegation; outsider-written board ignored; history across pages (150+ versions); non-company eVault; URI shape and wallet-side decoding of non-ASCII; grant payload parity with the delegation package; login refusing reserved sessions. Full packages/auth suite 91/91, tsc clean, built dist imported from plain Node ESM.

Not covered here: a run against a live evault-core. The query fields were checked against typedefs.ts (MetaEnvelopeVersion, PageInfo).

Change checklist

• I have ensured that the CI Checks pass locally
• I have removed any unnecessary logic
• My code is well documented
• I have signed my commits
• My code follows the pattern of the application
• I have self reviewed my code

[coodos]

@codex review

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: f35a012a-c4e0-49ee-8c1e-af5b95e8125d

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-08T11:33:41.413386Z	783ceb5	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 717a2f7aa6

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[coodos]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 622f9ec061

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 783ceb5c6a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".