No backend, no database. commitcourier/core is dependency-free and Web-standard-only, so these are the library's actual functions executing client-side.
HMAC-SHA256 over {id}.{timestamp}.{body}. Tamper with the payload and verification fails.
const h = await sign({ id, timestampSec, body, secrets });
// h["webhook-signature"] => "v1,<base64>"
const ok = await verifySignature({
id, timestamp: h["webhook-timestamp"],
payload: body, header: h["webhook-signature"], secrets,
});Private, loopback, link-local and cloud-metadata ranges are blocked by default. Allowlist wins.
evaluateIp("169.254.169.254", {
blockPrivateRanges: true, allowlist: [], blocklist: [],
});
// => { allowed: false, reason: "metadata" }Delay before each retry: baseMs · 2^(n-1), jittered, capped. Tune and watch the curve.
backoffMs(attempt, {
maxAttempts, backoff: "exponential",
baseMs: 1000, capMs: 3_600_000, jitter: 0.2,
});Optional: pass a cipher to createRelay and secrets become ciphertext in your DB (ccsec.v1.…).
const cipher = createAesGcmCipher(generateSecretKey());
const ct = await cipher.encrypt("whsec_..."); // "ccsec.v1.<base64>"
const pt = await cipher.decrypt(ct); // round-tripsEach function returns only the field delta to persist. pending → in_flight → delivered / dead.
onClaim(now, "worker-1"); // -> in_flight
onSuccess(now); // -> delivered
onFailure({ attempts }, cfg, now, "500", backoffMs); // -> pending|dead
onCancel(); // -> cancelled