Skip to content
Code Recycle

Component · for humans & their agents

Retry After Verdict

verified · first-partyactively maintained$0 during beta (was $49)

A wrong retry-wait does not throw. It returns a plausible number, and the loop either hammers a server that asked for hours or sleeps through the window.

by ringbuffer · Code Recycle admin

Get it free — beta

Every claim on this page is refundable if it is untrue — refund policy.

Verified: 126 tests

Computes how long to wait from a server's Retry-After, RateLimit-Reset or X-RateLimit-Reset header, per RFC 9110 10.2.3 and 5.6.7 and draft-ietf-httpapi-ratelimit-headers-03 5.3 -- without guessing a vendor's epoch-versus-delta convention.

Computes how long to wait from a server's Retry-After, RateLimit-Reset or X-RateLimit-Reset header, per RFC 9110 10.2.3 and 5.6.7 and draft-ietf-httpapi-ratelimit-headers-03 5.3 -- without guessing a vendor's epoch-versus-delta convention.

THE SILENT FAILURE. The value `1700000000` is either 'wait 54 years' or 'wait until this Unix timestamp', and the header alone does not say which. Guess wrong in one direction and the client hammers a server that asked for a long backoff; guess wrong in the other and it sleeps for hours through a window that reopened in thirty seconds. Neither raises an exception. Both look like a working retry loop in the code review.

IT NAMES THE AMBIGUITY INSTEAD OF RESOLVING IT SILENTLY. Where the convention is genuinely undecidable from the value, the verdict says so and names what would decide it -- the vendor, a companion header, a stated epoch -- rather than picking the more common reading and being confidently wrong for the other half of the internet.

IT ALSO HANDLES THE PARTS PEOPLE SKIP: HTTP-date in all three formats RFC 9110 requires a recipient to parse, including the obsolete ones; negative and past deltas; values large enough to overflow a naive milliseconds conversion; and the difference between a header that is absent and one that is present and unparseable.

VERIFICATION. An independent reviewer rebuilt this package from the README and the RFCs alone. Their rival passed the suite unchanged, and the suite caught a naive implementation -- the documented contract was complete enough to rebuild from.

VERIFIED: 126 tests, measured by running the suite, every mutation observed FAILING before restore.

DELIVERY: signed download of a hash-verified tarball, immediately on purchase. Permissive licence: unlimited products, unlimited clients, unlimited seats, no attribution, perpetual and irrevocable. One restriction, do not republish the source as source.

Interface

What you call, and what comes back. Types and signatures only — the implementation ships with the source.

  export function trimOws(raw: string): string;
  export function parseDelaySeconds(raw: string): number | null;
  export function evaluateRetryAfter(query: RetryAfterQuery): RetryAfterVerdict;
  export function parseHttpDate(value: string): HttpDateParseResult;
  export type HttpDateBasis = "http-date-imf-fixdate" | "http-date-rfc850" | "http-date-asctime";
  export type HttpDateParseResult = | { ok: true;
  export type RetryHeaderName = "retry-after" | "ratelimit-reset" | "x-ratelimit-reset";
  export type RetryAfterQuery = | { header: "retry-after";
  export type RetryAfterVerdict = RetryAfterOk | RetryAfterNotDeterminable;

01Capabilities

Does

  • + Reliability
  • + Retry and backoff policy

Doesn’t

  • No exclusions declared

02Requirements & stack

Depends on

No declared dependencies

Credentials needed

None declared

Stack

typescript

03Community

No endorsements yet

No verified confirmations yet — be the first.

Confirmations come from verified purchasers, installers, vetted reviewers, or an installation outcome your org reported through the agent tools. They grade quality — security is verified separately, and community votes can never override the security gate.

Open an issue

Sign in to confirm — weight comes from verified usage, not vote count.

0 open · 0 answered · 0 fixed · 1 said it worked

04Trust Passport

Full passport →
–/100

0/0 automated components pass. An automated score is never a security guarantee.

✓ Verified · first-partyreviewed Sep 20, 2026 · re-verification due Dec 19, 2026
  • publisher identity Publisher status verified; 1 verification(s) on file
  • malicious pattern scan No known malicious-behavior patterns across 16 source file(s) plus listing text
  • capability contract All 0 observed capability reference(s) match the declared manifest
  • agent safety scan No injection patterns in agent-readable content
  • provenance No release signature or provenance attestation
  • behavioral sandbox Not performed in this environment — requires the production isolated runner (docs/sandbox-requirements.md). No untrusted code is ever executed on the application host.

Every listing must pass this review before it can be sold, and it is re-run on every release. Verification describes what we checked — it is not a guarantee that the software is safe.

VersionChannelReleasedNotes
1.0.0stableAug 6, 2026First public release.