fix(ci): reformat generated ProcessEnv union to eliminate recurring merge conflicts

[JSONbored]

Summary

• While clearing merge conflicts on two open PRs from the recent roadmap(selfhost): harden review stack and reduce hosted cost #1667 incident-followup wave (feat(review): add hourly sweep-liveness watchdog with self-heal re-enqueue #3835, feat(review): add fast open-PR reconciliation to catch silently-lost webhooks #3840), both conflicted in exactly the same place — worker-configuration.d.ts — even though the underlying feature changes didn't overlap at all. Root cause: wrangler types packs every declared env var into ONE long single-line Pick<Cloudflare.Env, "A" | "B" | ...>> union in the generated ProcessEnv interface. Two independent PRs that each add a different new var to wrangler.jsonc's vars both regenerate that same line with their own insertion; git's line-based 3-way merge sees "the same line changed differently in both branches" and reports a real conflict, even though the two additions are logically unrelated. Everything else in the file (the plain per-line __BaseEnv_Env interface body, wrangler.jsonc, src/env.d.ts, etc.) already merges cleanly — this one packed-union line was the sole recurring offender.
• scripts/gen-cf-typegen.mjs still regenerates via the real wrangler types CLI (so the committed file can never silently drift from wrangler's own output), then reformats just that one union onto one sorted entry per line — the same shape every other interface body in this file already has. Two PRs adding different vars now land on different, non-adjacent lines and merge cleanly.
• cf-typegen:check is rebuilt on the same script (regenerates to a temp path, applies the identical reformatting, and string-compares against the committed file) rather than wrangler's own --check flag, which has no way to see the extra reformatting step and would otherwise always report a false mismatch.
• Includes a regression test (test/unit/ci-cf-typegen.test.ts) that reproduces the original conflict via a real git merge-file invocation on the raw single-line format (confirmed it conflicts) and confirms the reformatted version of the exact same two additions merges cleanly with zero conflict markers.

I also rebased and pushed fixes for the two already-open PRs that hit this (#3835, #3840) — both are MERGEABLE again now.

Scope

• The PR title follows type(scope): short summary Conventional Commit format, for example fix(api): restore profile access checks.
• This PR is focused and does not mix unrelated backend, UI, MCP, docs, dependency, and deploy changes.
• This follows CONTRIBUTING.md and does not reintroduce GitHub Pages, VitePress, site/, or CNAME.
• I linked an issue, or this is small enough that the summary explains why an issue is not needed.

Validation

• git diff --check
• npm run actionlint
• npm run typecheck
• npm run test:coverage locally; codecov/patch requires ≥99% coverage of the lines AND branches you changed (aim for 100% on your diff so CI variance does not fail near the threshold). Global coverage is a non-blocking trend with a loose 90% backstop, not the gate.
• npm run test:workers
• npm run build:mcp
• npm run test:mcp-pack
• npm run ui:openapi:check
• npm run ui:lint
• npm run ui:typecheck
• npm run ui:build
• npm audit --audit-level=moderate
• New or changed behavior has unit/integration tests for new branches, fallback paths, and sanitizer boundaries

All run via npm run test:ci (full local gate, green) plus a standalone npm audit --audit-level=moderate (0 vulnerabilities). scripts/** is Codecov-exempt (not src/**), but I verified cf-typegen/cf-typegen:check both round-trip correctly by hand: ran cf-typegen, confirmed cf-typegen:check reports clean; temporarily added a throwaway var to wrangler.jsonc without regenerating and confirmed cf-typegen:check correctly fails (exit 1) before reverting. Also updated the existing test/unit/ci-cf-typegen-check.test.ts structural guard (added in #2557) to assert the new script invocation instead of the literal old wrangler types --check string — its CI-wiring/ordering assertions were untouched and still pass.

Safety

• No secrets, wallet details, hotkeys, coldkeys, user PATs, private keys, raw trust scores, private rankings, or private maintainer evidence are exposed.
• Public GitHub text stays sanitized, low-noise, and does not imply compensation guarantees or optimization tactics.
• Auth, cookie, CORS, GitHub App, Cloudflare, or session changes include negative-path tests.
• API/OpenAPI/MCP behavior is updated and tested where needed.
• UI changes use live API data or real empty/error/loading states, not production mock/demo fallbacks.
• Visible UI changes include a UI Evidence section below with JPG/JPEG or PNG screenshots arranged as organized, captioned, clickable thumbnails.
• Public docs/changelogs are updated where needed; changelogs are only edited for release-prep PRs.

Build-tooling-only change: no auth/CORS/session surface, no interactive app UI, no behavioral change to the deployed Worker (the generated types are semantically identical, only reformatted).

UI Evidence

N/A — no app UI surface changed; this only affects a generated TypeScript declaration file's formatting.

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.57%. Comparing base (8503c71) to head (0a4b8cb).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #3871   +/-   ##
=======================================
  Coverage   93.57%   93.57%           
=======================================
  Files         340      340           
  Lines       33508    33508           
  Branches    12255    12255           
=======================================
  Hits        31355    31355           
  Misses       1528     1528           
  Partials      625      625           

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[loopover-orb]

Important

🟪🟪🟪🟪🟪🟪🟪🟪🟪🟪🟪🟪

🔍 Gittensory is reviewing…

AI analysis is in progress. This comment will update when the review is complete.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed · 🟪 Reviewing}

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	gittensory-ui	ff442f9	Commit Preview URL Branch Preview URL	Jul 07 2026, 01:38 AM