feat(kilo-pass): disallow duplicate card fingerprints across Kilo Pas…

…s subscriptions (#3309)

* feat(kilo-pass): add card fingerprint gate for Kilo Pass subscriptions

* fix(kilo-pass): remove unused imports and fix formatting in card-fingerprint-gate test

* fix(kilo-pass): break circular dependency by moving findActiveKiloPassByCardFingerprint to card-fingerprint-gate

* fix(kilo-pass): pass dbOrTx to checkDuplicateCardFingerprintGate for transaction-safe audit logs

* fix(kilo-pass): only use dbOrTx for audit log, keep email/fingerprint lookups on db

* fix(kilo-pass): mock email sender in card-fingerprint-gate tests so email_log markers persist

* fix(kilo-pass): simplify email mock to fix TS2698 spread type error

* fix(kilo-pass): move email notification after transaction commit so marker persists

* fix(kilo-pass): use invoice.id instead of gateResult.stripeInvoiceId for blockedGateResult

* fix(kilo-pass): rename blockedGateResult to blockedEmailParams and use invoice.id

* fix(kilo-pass): fix tsgo type error and replace raw SQL NOT IN with notInArray

- Return blockedEmailParams from db.transaction instead of mutating
  outer variable, fixing tsgo narrowing the type to 'never' because
  it doesn't track mutations across async closures.
- Replace raw sql`NOT IN` with Drizzle's notInArray for type safety.

* fix(kilo-pass): regenerate migration after rebase onto main

* fix(kilo-pass): regenerate migration after rebase onto main

* fix(kilo-pass): clear affiliate sale context when card fingerprint gate blocks subscription

* fix(kilo-pass): regenerate migration to fix corrupted snapshot with merge conflict markers

The 0141_snapshot.json had unresolved merge conflict markers from a
previous rebase. Deleted branch-local migration files and regenerated
a clean migration (0142) using pnpm drizzle generate.

* fix(kilo-pass): regenerate migration after rebase onto main

Rename branch migration from 0142 to 0143 since main added 0142_dashing_blue_marvel.
Restore main's 0142 snapshot and journal, regenerate clean migration.

* fix(kilo-pass): regenerate migration after rebase onto main

* fix(kilo-pass): clean up email dedup marker when user has no email

When user.google_user_email is falsy in maybeSendDuplicateCardCanceledEmail,
the transactional_email_log marker was left in the DB permanently. This
suppressed future email sends even if the user later acquired an email.
Now the marker is deleted before returning, consistent with the error-path
cleanup logic.

* feat(kilo-pass): block user when duplicate card fingerprint gate triggers

When the card fingerprint gate detects a duplicate card across users,
the offending user's account is now blocked (blocked_reason set to
'kilo_pass_duplicate_card') in addition to the existing cancel + refund.
Does not overwrite an existing blocked_reason. Follows the same pattern
as cancel-and-refund.ts.

* style(kilo-pass): fix oxfmt formatting in card-fingerprint-gate.ts

* fix(kilo-pass): move audit log and user blocking from gate to handler to fix FK violation

The checkDuplicateCardFingerprintGate function was passing dbOrTx through
a parameter to appendKiloPassAuditLog, but the FK constraint on
kilo_pass_audit_log.kilo_pass_subscription_id was being violated inside
the transaction. Move the audit log insert and user-blocking update into
the handler where tx is used directly. Also fix the catch block to omit
kiloPassSubscriptionId when the transaction may have rolled back, and
wrap the failure audit log in a try-catch so it doesn't mask the original
error.

* style(kilo-pass): fix oxfmt formatting

* fix(kilo-pass): add migration for duplicate_card_subscription_canceled check constraint

fix(kiloclaw): mark OpenClaw update as upgrade required (#3577)

fix(github): repair renamed installation login metadata (#3523)

Revert "Reorder preferred providers for Claude models" (#3513)

Revert "Reorder preferred providers for Claude models (#3495)"

This reverts commit 148ca12.

fix(gitlab): restore glab oauth mode (#3478)

* fix(gitlab): restore glab oauth mode

* fix(gitlab): gate glab oauth mode

chore(model-eval): retrigger ingest worker deploy (#3434)

feat(kiloclaw): expire organization trial compute safely (#3324)

* feat(kiloclaw): enforce organization trial entitlement

* feat(kiloclaw): add organization lifecycle notices

* feat(kiloclaw): enforce org trial expiry lifecycle

* feat(kiloclaw): add org trial expiry inventory

* chore(kiloclaw): refresh org trial branch metadata

* docs(kiloclaw): fix unentitled terminology

* fix(kiloclaw): recheck org entitlement before lifecycle actions

fix(code-reviews): retry failed attempts (#3224)

* fix(code-reviews): improve metric and session log displays

* fix(code-reviews): retry failed review attempts

* fix(code-review): queue fresh retry

* fix(code-review): guard terminal attempt

* fix(code-review): serialize infra retry

* fix(code-review): widen status helper

* fix(code-review): isolate retry attempts in fresh durable objects

* fix(review): persist retry guard

* fix(code-review): cancel superseded pending reviews

* fix(review): guard retry session

* fix(review): mirror terminal dispatch

* fix(review): restart sandbox retry

* fix(gitlab): reuse status token

* fix(review): keep attempt session

* refactor(review): share do name

* fix(admin): use attempt dates

* test(review): mock attempt dispatch

* test(review): expect sandbox restart

* test(review): expect retry run

* test(review): expect terminal mirror

fix(code-reviews): improve metric and session log displays (#3204)

refactor(ai-gateway): rename kilo-auto folder to auto-model (#3179)

Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
Co-authored-by: Christiaan Arnoldus <christiaan@kilocode.ai>