better-ship 0.24.0 → 0.26.0

package/dist/stripe/client.js

@@ -1,20 +1,3 @@
-import Stripe from "stripe";
+import { n as createStripeClient, t as STRIPE_REQUEST_OPTIONS } from "../client-Dv1Ch7yY.js";
 
-//#region src/infrastructure/stripe/client.ts
-/** Default SDK retries; client configuration and individual requests can override this value. */
-const STRIPE_REQUEST_OPTIONS = Object.freeze({ maxNetworkRetries: 2 });
-/**
-* Construct a native Stripe client with fetch transport and two SDK retries by default.
-* Native configuration overrides these defaults. Inject the client into application services.
-*/
-function createStripeClient(secretKey, options = {}) {
-	return new Stripe(secretKey, {
-		httpClient: Stripe.createFetchHttpClient(),
-		...STRIPE_REQUEST_OPTIONS,
-		...options
-	});
-}
-
-//#endregion
-export { STRIPE_REQUEST_OPTIONS, createStripeClient };
-//# sourceMappingURL=client.js.map
+export { STRIPE_REQUEST_OPTIONS, createStripeClient };

package/dist/stripe/payment-service.d.ts

@@ -1,51 +1,2 @@
-import Stripe from "stripe";
-//#region src/infrastructure/stripe/payment-service.d.ts
-/** Supply the same key and parameters when repeating one durable payment attempt. */
-export type PaymentRequestOptions = Stripe.RequestOptions & Required<Pick<Stripe.RequestOptions, 'idempotencyKey'>>;
-/** Native Checkout parameters; the service selects payment or setup mode. */
-export type CheckoutInput = Omit<Stripe.Checkout.SessionCreateParams, 'mode'>;
-/** A saved customer method; the service confirms the payment off-session. */
-export type SavedMethodCharge = Omit<Stripe.PaymentIntentCreateParams, 'confirm' | 'off_session'> & Required<Pick<Stripe.PaymentIntentCreateParams, 'customer' | 'payment_method'>>;
-/** Native customer response, including Stripe request metadata. */
-export type CustomerResult = Awaited<ReturnType<Stripe['customers']['create']>>;
-/** Native Checkout response. Its URL can be null; this does not confirm payment. */
-export type CheckoutResult = Awaited<ReturnType<Stripe['checkout']['sessions']['create']>>;
-/** Native PaymentIntent response. Applications decide what each status permits. */
-export type PaymentResult = Awaited<ReturnType<Stripe['paymentIntents']['create']>>;
-/**
- * Stripe payment operations, with native types and stable keys for mutations.
- * Rejects with PaymentServiceError for Stripe failures; non-Stripe failures propagate unchanged.
- */
-export interface IPaymentService {
-  /** Create a customer; the application owns persistence and reuse of the customer link. */
-  createCustomer(input: Stripe.CustomerCreateParams, options: PaymentRequestOptions): Promise<CustomerResult>;
-  /** Create one-time payment checkout; application fulfillment requires verified payment confirmation. */
-  createCheckout(input: CheckoutInput, options: PaymentRequestOptions): Promise<CheckoutResult>;
-  /** Create checkout in setup mode. The application records consent and verifies the saved method's owner. */
-  setupPaymentMethod(input: CheckoutInput, options: PaymentRequestOptions): Promise<CheckoutResult>;
-  /** Confirm a saved method off-session. PaymentServiceError retains card errors in cause. */
-  chargeSavedMethod(input: SavedMethodCharge, options: PaymentRequestOptions): Promise<PaymentResult>;
-  /** Retrieve an existing payment without starting another payment attempt. */
-  getPayment(paymentId: string, params?: Stripe.PaymentIntentRetrieveParams, options?: Stripe.RequestOptions): Promise<PaymentResult>;
-}
-/**
- * Ported from Typist's StripeClient request boundary; the native SDK now owns retries.
- * The injected client owns retry and timeout defaults. Native request options can override them.
- */
-export declare class StripePaymentService implements IPaymentService {
-  private readonly stripe;
-  /** Inject a native SDK instance; its transport, credentials, and API version remain caller-owned. */
-  constructor(stripe: Stripe);
-  /** Create a customer with a stable application key and preserve the native response. */
-  createCustomer(input: Stripe.CustomerCreateParams, options: PaymentRequestOptions): Promise<CustomerResult>;
-  /** Force payment mode after caller parameters; return the native Checkout Session. */
-  createCheckout(input: CheckoutInput, options: PaymentRequestOptions): Promise<CheckoutResult>;
-  /** Force setup mode after caller parameters; this operation does not charge the customer. */
-  setupPaymentMethod(input: CheckoutInput, options: PaymentRequestOptions): Promise<CheckoutResult>;
-  /** Force confirmation and off-session use; retain native card failures in PaymentServiceError.cause. */
-  chargeSavedMethod(input: SavedMethodCharge, options: PaymentRequestOptions): Promise<PaymentResult>;
-  /** Preserve every native status and response field when reconciling an existing payment. */
-  getPayment(paymentId: string, params?: Stripe.PaymentIntentRetrieveParams, options?: Stripe.RequestOptions): Promise<PaymentResult>;
-}
-//#endregion
-//# sourceMappingURL=payment-service.d.ts.map
+import { a as PaymentRequestOptions, c as StripePaymentService, i as IPaymentService, n as CheckoutResult, o as PaymentResult, r as CustomerResult, s as SavedMethodCharge, t as CheckoutInput } from "../payment-service-DUYd3Itt.js";
+export { CheckoutInput, CheckoutResult, CustomerResult, IPaymentService, PaymentRequestOptions, PaymentResult, SavedMethodCharge, StripePaymentService };

package/dist/stripe/payment-service.error.js

@@ -1,30 +1,3 @@
-import { nt as AppError } from "../core-BiN6S_cm.js";
-import Stripe from "stripe";
+import { t as PaymentServiceError } from "../payment-service.error-CqF7GkNp.js";
 
-//#region src/infrastructure/stripe/payment-service.error.ts
-/** A final Stripe request failure. The caller logs once; native details remain in cause. */
-var PaymentServiceError = class extends AppError {
-	operation;
-	_tag = "PaymentServiceError";
-	classification;
-	/** Classify the final SDK error without scheduling another payment attempt. */
-	constructor(operation, cause) {
-		super(`Stripe request failed: ${operation}`, { cause });
-		this.operation = operation;
-		this.classification = classifyStripeError(cause);
-	}
-};
-function classifyStripeError(error) {
-	if (error.headers?.["stripe-should-retry"] === "false") return "terminal";
-	const status = error.statusCode;
-	if (status !== void 0 && status >= 400 && status < 500 && status !== 409 && status !== 429) return "terminal";
-	if (error instanceof Stripe.errors.StripeAuthenticationError || error instanceof Stripe.errors.StripePermissionError || error instanceof Stripe.errors.StripeInvalidRequestError || error instanceof Stripe.errors.StripeIdempotencyError || error instanceof Stripe.errors.StripeCardError) return "terminal";
-	if (error.headers?.["stripe-should-retry"] === "true") return "transient";
-	if (status === 409 || status === 429 || status !== void 0 && status >= 500) return "transient";
-	if (error instanceof Stripe.errors.StripeConnectionError || error instanceof Stripe.errors.StripeAPIError || error instanceof Stripe.errors.StripeRateLimitError) return "transient";
-	return "unknown";
-}
-
-//#endregion
-export { PaymentServiceError };
-//# sourceMappingURL=payment-service.error.js.map
+export { PaymentServiceError };

package/dist/stripe/payment-service.js

@@ -1,4 +1,4 @@
-import { stripeRequest } from "./request.js";
+import { t as stripeRequest } from "../request-4vJEWxyZ.js";
 
 //#region src/infrastructure/stripe/payment-service.ts
 /**

package/dist/stripe/request.js

@@ -1,21 +1,3 @@
-import { PaymentServiceError } from "./payment-service.error.js";
-import Stripe from "stripe";
+import { t as stripeRequest } from "../request-4vJEWxyZ.js";
 
-//#region src/infrastructure/stripe/request.ts
-/**
-* Invoke one SDK operation; the SDK owns retries configured on its client or request.
-* Convert every Stripe error to PaymentServiceError without logging; preserve the original error in cause.
-* Non-Stripe failures propagate unchanged.
-*/
-async function stripeRequest(operation, work) {
-	try {
-		return await work();
-	} catch (cause) {
-		if (!(cause instanceof Stripe.errors.StripeError)) throw cause;
-		throw new PaymentServiceError(operation, cause);
-	}
-}
-
-//#endregion
-export { stripeRequest };
-//# sourceMappingURL=request.js.map
+export { stripeRequest };

package/dist/stripe-fixture-yFUknTJO.js

@@ -0,0 +1,33 @@
+import { n as createStripeClient } from "./client-Dv1Ch7yY.js";
+import Stripe from "stripe";
+
+//#region src/infrastructure/testing/stripe-fixture.ts
+/**
+* Construct the real SDK with a fake fetch transport and an ordered record of HTTP attempts.
+* The responder receives an unread request. The shared client factory supplies retry defaults.
+*/
+function stripeFixture(respond) {
+	const requests = [];
+	return {
+		stripe: createStripeClient("sk_test_fixture", { httpClient: Stripe.createFetchHttpClient(async (input, init) => {
+			const request = new Request(input, init);
+			const url = new URL(request.url);
+			const call = {
+				method: request.method,
+				path: url.pathname,
+				query: url.searchParams,
+				body: new URLSearchParams(),
+				headers: new Headers(request.headers)
+			};
+			requests.push(call);
+			const body = new TextDecoder().decode(await request.clone().arrayBuffer());
+			for (const [key, value] of new URLSearchParams(body)) call.body.append(key, value);
+			return respond(request);
+		}) }),
+		requests
+	};
+}
+
+//#endregion
+export { stripeFixture as t };
+//# sourceMappingURL=stripe-fixture-yFUknTJO.js.map

package/dist/stripe-fixture-yFUknTJO.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"stripe-fixture-yFUknTJO.js","names":[],"sources":["../src/infrastructure/testing/stripe-fixture.ts"],"sourcesContent":["import Stripe from 'stripe'\n\nimport { createStripeClient } from '../stripe/client.ts'\n\n/** One SDK HTTP attempt; query and body expose Stripe's URL-encoded parameters. */\nexport type StripeCall = {\n  readonly method: string\n  readonly path: string\n  readonly query: URLSearchParams\n  readonly body: URLSearchParams\n  readonly headers: Headers\n}\n\ntype StripeFixture = { stripe: Stripe; requests: readonly StripeCall[] }\n\n/**\n * Construct the real SDK with a fake fetch transport and an ordered record of HTTP attempts.\n * The responder receives an unread request. The shared client factory supplies retry defaults.\n */\nexport function stripeFixture(\n  respond: (request: Request) => Response | Promise<Response>,\n): StripeFixture {\n  const requests: StripeCall[] = []\n  const stripe = createStripeClient('sk_test_fixture', {\n    httpClient: Stripe.createFetchHttpClient(async (input, init) => {\n      const request = new Request(input, init)\n      const url = new URL(request.url)\n      const call: StripeCall = {\n        method: request.method,\n        path: url.pathname,\n        query: url.searchParams,\n        body: new URLSearchParams(),\n        headers: new Headers(request.headers),\n      }\n      requests.push(call)\n      const body = new TextDecoder().decode(await request.clone().arrayBuffer())\n      for (const [key, value] of new URLSearchParams(body)) call.body.append(key, value)\n      return respond(request)\n    }),\n  })\n  return { stripe, requests }\n}\n"],"mappings":";;;;;;;;AAmBA,SAAgB,cACd,SACe;CACf,MAAM,WAAyB,CAAC;CAkBhC,OAAO;EAAE,QAjBM,mBAAmB,mBAAmB,EACnD,YAAY,OAAO,sBAAsB,OAAO,OAAO,SAAS;GAC9D,MAAM,UAAU,IAAI,QAAQ,OAAO,IAAI;GACvC,MAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;GAC/B,MAAM,OAAmB;IACvB,QAAQ,QAAQ;IAChB,MAAM,IAAI;IACV,OAAO,IAAI;IACX,MAAM,IAAI,gBAAgB;IAC1B,SAAS,IAAI,QAAQ,QAAQ,OAAO;GACtC;GACA,SAAS,KAAK,IAAI;GAClB,MAAM,OAAO,IAAI,YAAY,CAAC,CAAC,OAAO,MAAM,QAAQ,MAAM,CAAC,CAAC,YAAY,CAAC;GACzE,KAAK,MAAM,CAAC,KAAK,UAAU,IAAI,gBAAgB,IAAI,GAAG,KAAK,KAAK,OAAO,KAAK,KAAK;GACjF,OAAO,QAAQ,OAAO;EACxB,CAAC,EACH,CACc;EAAG;CAAS;AAC5B"}

package/dist/testing/outbox-repository.d.ts

@@ -1,5 +1,5 @@
 import { W as DomainEvent } from "../index-DUFS0SJ_.js";
-import { A as IOutboxRepository } from "../index-tNZHSCpJ.js";
+import { A as IOutboxRepository } from "../index-lS_g1olK.js";
 //#region src/infrastructure/testing/outbox-repository-contract.d.ts
 /** Stored fields observed by the adapter contract, independent of a database library. */
 export type OutboxContractRow = {

package/dist/testing/payment-service.d.ts

@@ -1,4 +1,4 @@
-import { IPaymentService } from "../stripe/payment-service.js";
+import { i as IPaymentService } from "../payment-service-DUYd3Itt.js";
 import Stripe from "stripe";
 //#region src/infrastructure/testing/payment-service-contract.d.ts
 /**

package/dist/testing/payment-service.js

@@ -1,5 +1,5 @@
-import { PaymentServiceError } from "../stripe/payment-service.error.js";
-import { stripeFixture } from "./stripe.js";
+import { t as PaymentServiceError } from "../payment-service.error-CqF7GkNp.js";
+import { t as stripeFixture } from "../stripe-fixture-yFUknTJO.js";
 import Stripe from "stripe";
 import { deepStrictEqual, equal, ok, rejects } from "node:assert/strict";
 

package/dist/testing/stripe.js

@@ -1,33 +1,3 @@
-import { createStripeClient } from "../stripe/client.js";
-import Stripe from "stripe";
+import { t as stripeFixture } from "../stripe-fixture-yFUknTJO.js";
 
-//#region src/infrastructure/testing/stripe-fixture.ts
-/**
-* Construct the real SDK with a fake fetch transport and an ordered record of HTTP attempts.
-* The responder receives an unread request. The shared client factory supplies retry defaults.
-*/
-function stripeFixture(respond) {
-	const requests = [];
-	return {
-		stripe: createStripeClient("sk_test_fixture", { httpClient: Stripe.createFetchHttpClient(async (input, init) => {
-			const request = new Request(input, init);
-			const url = new URL(request.url);
-			const call = {
-				method: request.method,
-				path: url.pathname,
-				query: url.searchParams,
-				body: new URLSearchParams(),
-				headers: new Headers(request.headers)
-			};
-			requests.push(call);
-			const body = new TextDecoder().decode(await request.clone().arrayBuffer());
-			for (const [key, value] of new URLSearchParams(body)) call.body.append(key, value);
-			return respond(request);
-		}) }),
-		requests
-	};
-}
-
-//#endregion
-export { stripeFixture };
-//# sourceMappingURL=stripe.js.map
+export { stripeFixture };

package/package.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://www.schemastore.org/package.json",
   "name": "better-ship",
-  "version": "0.24.0",
+  "version": "0.26.0",
   "description": "Foundation for applications on Cloudflare Workers: logger, errors, message bus, infrastructure adapters, and UI primitives",
   "license": "Apache-2.0",
   "repository": {
@@ -9,6 +9,9 @@
     "url": "git+https://github.com/alexander-zuev/better-ship.git",
     "directory": "packages/better-ship"
   },
+  "bin": {
+    "better-ship-notify-ci": "./dist/bin/notify-ci.js"
+  },
   "files": [
     "dist",
     "src"
@@ -23,6 +26,7 @@
     "./better-auth/secondary-storage": "./dist/better-auth/secondary-storage.js",
     "./better-auth/stripe": "./dist/better-auth/stripe.js",
     "./billing/client": "./dist/billing/client.js",
+    "./bin/notify-ci": "./dist/bin/notify-ci.js",
     "./cloudflare": "./dist/cloudflare.js",
     "./cloudflare/auth-secondary-storage": "./dist/cloudflare/auth-secondary-storage.js",
     "./cloudflare/durable-object-client": "./dist/cloudflare/durable-object-client.js",
@@ -46,6 +50,7 @@
     "./sentry/server": "./dist/sentry/server.js",
     "./sentry/tanstack": "./dist/sentry/tanstack.js",
     "./sentry/vite": "./dist/sentry/vite.js",
+    "./slack": "./dist/slack.js",
     "./stripe/client": "./dist/stripe/client.js",
     "./stripe/event-map": "./dist/stripe/event-map.js",
     "./stripe/payment-service": "./dist/stripe/payment-service.js",

package/src/application/email-service.ts

@@ -35,6 +35,23 @@ export type OutboundEmail = {
 /** Received email headers, without the body or attachments. */
 export type ReceivedEmail = { readonly headers: Readonly<Record<string, string>> }
 
+/** One attachment of a received email. `downloadUrl` is a signed link that stops working at `expiresAt`. */
+export type ReceivedAttachment = {
+  readonly filename: string | null
+  readonly contentType: string
+  readonly size: number
+  readonly downloadUrl: string
+  readonly expiresAt: string
+}
+
+/** A received email's sender, plain text body, and attachments, for an application that reads mail it receives. */
+export type ReceivedContent = {
+  /** The sender as the email states it, for example "Display Name <address@domain.com>". */
+  readonly from: string
+  readonly text: string | null
+  readonly attachments: readonly ReceivedAttachment[]
+}
+
 /** The provider accepted the email and assigned its id. */
 export type EmailAccepted = { readonly providerId: string }
 

package/src/application/index.ts

@@ -20,6 +20,8 @@ export {
   type MimeType,
   type EmailAccepted,
   type ReceivedEmail,
+  type ReceivedContent,
+  type ReceivedAttachment,
 } from './email-service.ts'
 export {
   recordEmailEvent,

package/src/infrastructure/resend/resend-email-service.ts

@@ -7,6 +7,7 @@ import type {
   EmailAttachment,
   IEmailService,
   OutboundEmail,
+  ReceivedContent,
   ReceivedEmail,
 } from '@/application'
 import { EmailServiceError, type EmailSendFailureReason } from '@/core'
@@ -62,6 +63,20 @@ function retryAfterSeconds(value: string | undefined): number | null {
   return Number.isSafeInteger(seconds) ? seconds : null
 }
 
+function receivingError(
+  error: ErrorResponse,
+  headers: Record<string, string> | null,
+): EmailServiceError {
+  return new EmailServiceError({
+    reason: reasonFromResend(error),
+    provider: 'resend',
+    providerCode: error.name,
+    statusCode: error.statusCode,
+    retryAfter: retryAfterSeconds(headers?.['retry-after']),
+    cause: error,
+  })
+}
+
 function toAttachment(attachment: EmailAttachment): Attachment {
   const result: Attachment = {
     filename: attachment.filename,
@@ -139,6 +154,30 @@ export class ResendEmailService implements IEmailService {
     return { headers: result.data.headers ?? {} }
   }
 
+  /**
+   * Retrieve the sender, plain text body, and attachments by the received email's provider ID.
+   * Each attachment carries a signed download link. Provider failures throw EmailServiceError.
+   */
+  async getReceivedContent(emailId: string): Promise<ReceivedContent> {
+    const client = await this.getClient()
+    const email = await client.emails.receiving.get(emailId)
+    if (email.error !== null) throw receivingError(email.error, email.headers)
+    // One page of 100, the API maximum, holds the attachments of any received email.
+    const files = await client.emails.receiving.attachments.list({ emailId, limit: 100 })
+    if (files.error !== null) throw receivingError(files.error, files.headers)
+    return {
+      from: email.data.from,
+      text: email.data.text,
+      attachments: files.data.data.map((file) => ({
+        filename: file.filename ?? null,
+        contentType: file.content_type,
+        size: file.size,
+        downloadUrl: file.download_url,
+        expiresAt: file.expires_at,
+      })),
+    }
+  }
+
   private async getClient(): Promise<Resend> {
     if (this.client === undefined) {
       const { Resend } = await import('resend')

package/src/infrastructure/slack/ci-message.ts

@@ -0,0 +1,276 @@
+import { z } from 'zod'
+
+/** The result of one CI job or step, in GitHub Actions terms. */
+export type CiOutcome = 'success' | 'failure' | 'cancelled' | 'skipped'
+
+/** What the run delivers after its checks pass. */
+export type CiTarget =
+  | { readonly kind: 'check' }
+  | {
+      readonly kind: 'deploy'
+      readonly accountId: string
+      readonly worker: string
+      readonly siteUrl: string
+      /** Absent when the run reached no deploy, such as a pull request. */
+      readonly versionId: string | undefined
+    }
+  | {
+      readonly kind: 'publish'
+      readonly packageName: string
+      /** Absent when npm already has the package version. */
+      readonly version: string | undefined
+    }
+
+/** One CI run, parsed from the environment that the workflow sets. */
+export interface CiRun {
+  readonly repository: string
+  readonly commitSha: string
+  readonly ref:
+    | { readonly kind: 'branch'; readonly name: string }
+    | {
+        readonly kind: 'pullRequest'
+        readonly number: number
+        readonly url: string
+        readonly title: string
+      }
+  readonly runUrl: string
+  readonly jobs: ReadonlyArray<CiStepResult>
+  readonly steps: ReadonlyArray<CiStepResult>
+  readonly target: CiTarget
+}
+
+/** A named job or step and its outcome. */
+export interface CiStepResult {
+  readonly name: string
+  readonly outcome: CiOutcome
+}
+
+/** The commit facts that only git knows. */
+export interface CiCommit {
+  readonly subject: string
+  readonly author: string
+}
+
+/** A Slack incoming-webhook payload. */
+export interface SlackMessage {
+  readonly text: string
+  readonly blocks: ReadonlyArray<SlackBlock>
+}
+
+type SlackElement =
+  | { readonly type: 'mrkdwn'; readonly text: string }
+  | { readonly type: 'image'; readonly image_url: string; readonly alt_text: string }
+
+type SlackBlock =
+  | { readonly type: 'section'; readonly text: { readonly type: 'mrkdwn'; readonly text: string } }
+  | { readonly type: 'context'; readonly elements: ReadonlyArray<SlackElement> }
+
+/** The CI environment could not be parsed. `issues` names each invalid variable. */
+export class CiRunParseError extends Error {
+  readonly _tag = 'CiRunParseError' as const
+
+  constructor(
+    readonly issues: ReadonlyArray<string>,
+    override readonly cause: unknown,
+  ) {
+    super(`Invalid CI environment: ${issues.join(', ')}`)
+  }
+}
+
+const OutcomeSchema = z.enum(['success', 'failure', 'cancelled', 'skipped'])
+
+const jsonRecord = <T extends z.ZodType>(value: T) =>
+  z
+    .string()
+    .transform((text, context) => {
+      try {
+        const value: unknown = JSON.parse(text)
+        return value
+      } catch {
+        context.addIssue({ code: 'custom', message: 'Invalid JSON' })
+        return z.NEVER
+      }
+    })
+    .pipe(z.record(z.string(), value))
+
+const CiEnvSchema = z.object({
+  REPO: z.string().regex(/^[\w.-]+\/[\w.-]+$/),
+  COMMIT_SHA: z.string().regex(/^[0-9a-f]{40}$/),
+  BRANCH: z.string().min(1),
+  RUN_URL: z.httpUrl(),
+  JOBS_JSON: jsonRecord(z.object({ result: OutcomeSchema })).optional(),
+  STEPS_JSON: jsonRecord(z.object({ outcome: OutcomeSchema })).optional(),
+  PR_NUMBER: z.coerce.number().int().positive().optional(),
+  PR_URL: z.httpUrl().optional(),
+  PR_TITLE: z.string().min(1).optional(),
+  ACTION: z.enum(['check', 'deploy', 'publish']).default('check'),
+  CLOUDFLARE_ACCOUNT_ID: z.string().min(1).optional(),
+  CLOUDFLARE_WORKER: z.string().min(1).optional(),
+  SITE_URL: z.httpUrl().optional(),
+  DEPLOY_VERSION_ID: z.string().min(1).optional(),
+  NPM_PACKAGE: z.string().min(1).optional(),
+  NPM_VERSION: z.string().min(1).optional(),
+})
+
+type CiEnv = z.infer<typeof CiEnvSchema>
+
+/**
+ * Parse the variables that a workflow passes to the notifier. GitHub expressions render a
+ * missing value as an empty string, so an empty variable counts as unset.
+ * @throws {CiRunParseError} when a variable is missing or invalid.
+ */
+export function parseCiRun(env: Readonly<Record<string, string | undefined>>): CiRun {
+  const present = Object.fromEntries(Object.entries(env).filter(([, value]) => value !== ''))
+  const parsed = CiEnvSchema.safeParse(present)
+  if (!parsed.success) {
+    const issues = parsed.error.issues.map((issue) => issue.path.join('.'))
+    throw new CiRunParseError(issues, parsed.error)
+  }
+  return toCiRun(parsed.data)
+}
+
+function toCiRun(env: CiEnv): CiRun {
+  const ref: CiRun['ref'] =
+    env.PR_NUMBER !== undefined && env.PR_URL !== undefined && env.PR_TITLE !== undefined
+      ? { kind: 'pullRequest', number: env.PR_NUMBER, url: env.PR_URL, title: env.PR_TITLE }
+      : { kind: 'branch', name: env.BRANCH }
+  return {
+    repository: env.REPO,
+    commitSha: env.COMMIT_SHA,
+    ref,
+    runUrl: env.RUN_URL,
+    jobs: Object.entries(env.JOBS_JSON ?? {}).map(([id, job]) => ({
+      name: displayName(id),
+      outcome: job.result,
+    })),
+    steps: Object.entries(env.STEPS_JSON ?? {}).map(([id, step]) => ({
+      name: displayName(id),
+      outcome: step.outcome,
+    })),
+    target: toTarget(env),
+  }
+}
+
+function toTarget(env: CiEnv): CiTarget {
+  switch (env.ACTION) {
+    case 'check':
+      return { kind: 'check' }
+    case 'deploy': {
+      const { CLOUDFLARE_ACCOUNT_ID: accountId, CLOUDFLARE_WORKER: worker, SITE_URL: siteUrl } = env
+      if (accountId === undefined || worker === undefined || siteUrl === undefined) {
+        throw new CiRunParseError(
+          ['CLOUDFLARE_ACCOUNT_ID', 'CLOUDFLARE_WORKER', 'SITE_URL'],
+          undefined,
+        )
+      }
+      return { kind: 'deploy', accountId, worker, siteUrl, versionId: env.DEPLOY_VERSION_ID }
+    }
+    case 'publish':
+      if (env.NPM_PACKAGE === undefined) throw new CiRunParseError(['NPM_PACKAGE'], undefined)
+      return { kind: 'publish', packageName: env.NPM_PACKAGE, version: env.NPM_VERSION }
+  }
+}
+
+// A job or step id such as `check-and-build` reads as "Check and build".
+function displayName(id: string): string {
+  const words = id.replaceAll(/[-_]/g, ' ')
+  return words.charAt(0).toUpperCase() + words.slice(1)
+}
+
+const logos = {
+  depot: 'https://avatars.githubusercontent.com/u/68166601?s=64',
+  github: 'https://avatars.githubusercontent.com/u/9919?s=64',
+  cloudflare: 'https://avatars.githubusercontent.com/u/314135?s=64',
+  npm: 'https://avatars.githubusercontent.com/u/6078720?s=64',
+} as const
+
+/** Build the four-line CI message: result, change, links, and identity. */
+export function buildCiMessage(run: CiRun, commit: CiCommit): SlackMessage {
+  const headline = headlineFor(run)
+  const change = run.ref.kind === 'pullRequest' ? run.ref.title : commit.subject
+  return {
+    text: `${headline} — ${change}`,
+    blocks: [
+      { type: 'section', text: { type: 'mrkdwn', text: `*${headline}*\n${escape(change)}` } },
+      { type: 'context', elements: linkElements(run) },
+      { type: 'context', elements: [{ type: 'mrkdwn', text: identityLine(run, commit) }] },
+    ],
+  }
+}
+
+function headlineFor(run: CiRun): string {
+  const failedJobs = namesWith(run.jobs, 'failure')
+  if (failedJobs) return `:x: CI failed: ${failedJobs}`
+  const cancelledJobs = namesWith(run.jobs, 'cancelled')
+  if (cancelledJobs) return `:white_circle: CI cancelled: ${cancelledJobs}`
+  const failedSteps = namesWith(run.steps, 'failure')
+  const { target } = run
+  switch (target.kind) {
+    case 'check':
+      return failedSteps ? `:x: CI failed: ${failedSteps}` : ':white_check_mark: CI passed'
+    case 'deploy':
+      if (failedSteps) return `:x: Deploy failed: ${failedSteps}`
+      return target.versionId === undefined
+        ? ':white_check_mark: CI passed'
+        : ':white_check_mark: Deployed to production'
+    case 'publish':
+      if (failedSteps) return `:x: Publish failed: ${failedSteps}`
+      return target.version === undefined
+        ? ':white_check_mark: CI passed, nothing to publish'
+        : `:white_check_mark: Published ${target.packageName} ${target.version}`
+  }
+}
+
+function namesWith(results: ReadonlyArray<CiStepResult>, outcome: CiOutcome): string {
+  return results
+    .filter((result) => result.outcome === outcome)
+    .map((result) => result.name)
+    .join(', ')
+}
+
+function linkElements(run: CiRun): ReadonlyArray<SlackElement> {
+  const runHost = new URL(run.runUrl).hostname
+  const runLogo = runHost.endsWith('github.com') ? logos.github : logos.depot
+  const elements: SlackElement[] = [
+    { type: 'image', image_url: runLogo, alt_text: runHost },
+    { type: 'mrkdwn', text: `<${run.runUrl}|CI run>` },
+  ]
+  const { target } = run
+  if (target.kind === 'deploy' && target.versionId !== undefined) {
+    const dashboard = `https://dash.cloudflare.com/${target.accountId}/workers/services/view/${target.worker}/production/deployments`
+    const site = new URL(target.siteUrl)
+    elements.push(
+      { type: 'mrkdwn', text: '·' },
+      { type: 'image', image_url: logos.cloudflare, alt_text: 'Cloudflare' },
+      { type: 'mrkdwn', text: `<${dashboard}|Version \`${target.versionId.slice(0, 8)}\`>` },
+      { type: 'mrkdwn', text: `·  :globe_with_meridians: <${site.origin}|${site.host}>` },
+    )
+  }
+  if (target.kind === 'publish' && target.version !== undefined) {
+    const npm = `https://www.npmjs.com/package/${target.packageName}/v/${target.version}`
+    elements.push(
+      { type: 'mrkdwn', text: '·' },
+      { type: 'image', image_url: logos.npm, alt_text: 'npm' },
+      { type: 'mrkdwn', text: `<${npm}|${target.packageName}@${target.version}>` },
+    )
+  }
+  return elements
+}
+
+function identityLine(run: CiRun, commit: CiCommit): string {
+  const repository = run.repository.split('/').at(-1) ?? run.repository
+  const ref =
+    run.ref.kind === 'pullRequest' ? `<${run.ref.url}|PR #${run.ref.number}>` : run.ref.name
+  const commitUrl = `https://github.com/${run.repository}/commit/${run.commitSha}`
+  return [
+    repository,
+    ref,
+    `<${commitUrl}|\`${run.commitSha.slice(0, 7)}\`>`,
+    escape(commit.author),
+  ].join('  ·  ')
+}
+
+// Slack mrkdwn treats these three characters as markup.
+function escape(text: string): string {
+  return text.replaceAll('&', '&amp;').replaceAll('<', '&lt;').replaceAll('>', '&gt;')
+}

package/src/infrastructure/slack/index.ts

@@ -0,0 +1,10 @@
+export { buildCiMessage, CiRunParseError, parseCiRun } from './ci-message.ts'
+export type {
+  CiCommit,
+  CiOutcome,
+  CiRun,
+  CiStepResult,
+  CiTarget,
+  SlackMessage,
+} from './ci-message.ts'
+export { postSlackMessage, SlackWebhookError } from './slack-webhook.ts'