# Give me an exact-runtime standards audit of this Node.js 24 webhook and worker implementation. Find reliability, concurrency, cancellation, and modernization issues, prioritize production-impacting findings, and provide updated code techniques. Ground every high-priority finding in the supplied code and preserve file and line locations. Use exact authoritative documentation sections for AbortSignal.any(), AbortSignal.timeout(), timers/promises, Promise rejection behavior, fetch response cleanup, and explicit resource management rather than generic specification or documentation homepages. Treat lease fencing and at-least-once delivery as engineering inferences from the visible owner/token protocol unless a directly relevant authoritative source is found. Do not attach an unrelated citation merely to fill a citation slot, and do not emit unsupported technique categories.

**Mode:** default  
**Runtime:** Node.js 24  
**Language:** TypeScript

## Direct answer

Highest priority: `deliverWebhook()` leaves response bodies unread (lines 473–478), which can impair connection reuse; consume or cancel them. The detached `task.finally(...)` promise (lines 377–380) can become unhandled when execution or failure recording rejects. Lease fencing and at-least-once delivery remain engineering inferences because the store’s atomicity and token checks are unspecified.

## Findings

### Webhook body is fully buffered without an explicit size limit.

**Priority:** high  
**Location:** node-webhook-worker.ts:316  
**Evidence:** `const body = new Uint8Array(await request.arrayBuffer())`

A large request is buffered before signature validation, allowing memory consumption before rejection.

**Recommendation:** Apply gateway and application size limits, reject oversized bodies with 413, and preserve raw bytes for HMAC verification. Sources: citation undiscovered.

### Tenant isolation depends on unspecified resolver and store invariants.

**Priority:** high  
**Location:** node-webhook-worker.ts:324  
**Evidence:** `const tenantId = await dependencies.resolveTenant(request, event)`

The submitted code does not show authentication binding or database constraints connecting the request to the tenant.

**Recommendation:** Bind tenant identity to authenticated context and enforce tenant-scoped uniqueness and transition checks. Sources: citation undiscovered.

### Fetch response cleanup can reduce connection reuse.

**Priority:** high  
**Location:** node-webhook-worker.ts:566  
**Evidence:** `return { status: response.status, deliveredAt: new Date().toISOString() }`

Neither success nor failure consumes or cancels the response body. This can delay stream cleanup and degrade reuse under load.

**Recommendation:** Consume small bodies or call `response.body?.cancel()` when discarding them; bound diagnostic reads on errors. Sources: WEB-6.

### Heartbeat renewals can overlap.

**Priority:** medium  
**Location:** node-webhook-worker.ts:381  
**Evidence:** `void this.tick().catch((error) => {`

The native interval starts another asynchronous renewal without waiting for the prior one.

**Recommendation:** Serialize renewals with an in-flight promise or use an abortable `timers/promises` interval. Sources: WEB-2.

## Upgrade path

### Fix response and promise ownership.

- Cancel or boundedly consume every Fetch response body.
- Replace the detached `finally()` chain with rejection-safe cleanup.
- Add a terminal execution boundary that separately handles failure-recording errors. Sources: WEB-3, WEB-6.

### Serialize heartbeat renewal and strengthen cancellation.

- Track one in-flight renewal at a time.
- Abort the heartbeat controller during async disposal.
- Await the active renewal before disposal returns.
- Propagate request cancellation into tenant and persistence work where supported. Sources: WEB-1, WEB-2, WEB-5, WEB-7.

### Specify distributed-delivery guarantees.

- Require atomic owner/token/unexpired-lease predicates for transitions.
- Document at-least-once delivery as an engineering inference.
- Require durable destination deduplication using the idempotency key.
- Test expiry, takeover, renewal latency, and completion races. Sources: S5.

## Sources

- [S3: ECMAScript Explicit Resource Management](https://tc39.es/proposal-explicit-resource-management/) — Ecma TC39
- [S5: CockroachDB replication layer](https://www.cockroachlabs.com/docs/stable/architecture/replication-layer) — Cockroach Labs
- [S11: Stripe webhook documentation](https://docs.stripe.com/webhooks) — Stripe
- [S12: TypeScript Handbook](https://www.typescriptlang.org/docs/handbook/intro.html) — Microsoft
- [WEB-1: Node.js v24 Global objects: AbortSignal.any() and AbortSignal.timeout()](https://nodejs.org/download/release/latest-v24.x/docs/api/globals.html) — nodejs.org
- [WEB-2: Node.js timers: timers/promises](https://nodejs.org/api/timers.html) — nodejs.org
- [WEB-3: Node.js process: unhandledRejection](https://nodejs.org/api/process.html) — nodejs.org
- [WEB-4: Node.js v24 Global objects: fetch](https://nodejs.org/docs/latest/api/globals.html) — nodejs.org
- [WEB-5: Node.js v24 HTTP: request.signal](https://nodejs.org/download/release/latest-v24.x/docs/api/http.html) — nodejs.org
- [WEB-6: Node.js Web Streams: ReadableStream.cancel()](https://nodejs.org/api/webstreams.html) — nodejs.org
- [WEB-7: ECMAScript Async Explicit Resource Management](https://tc39.es/proposal-async-explicit-resource-management/) — tc39.es