fix(client): strict numeric validation and past-date guard in parseRetryAfter

Author: oritwoen

src/core/client.ts

@@ -19,14 +19,15 @@ const DEFAULT_USER_AGENT = "regxa/0.1.0";
  */
 export function parseRetryAfter(header: string | null | undefined): number {
   if (!header) return 60;
+  const trimmed = header.trim();
+  if (!trimmed) return 60;
 
-  const numeric = Number.parseInt(header, 10);
-  if (!Number.isNaN(numeric) && numeric >= 0) return numeric;
+  if (/^\d+$/.test(trimmed)) return Number(trimmed);
 
-  const timestamp = Date.parse(header);
+  const timestamp = /[a-z]/i.test(trimmed) ? Date.parse(trimmed) : NaN;
   if (!Number.isNaN(timestamp)) {
     const seconds = Math.ceil((timestamp - Date.now()) / 1000);
-    return seconds > 0 ? seconds : 60;
+    return Math.max(seconds, 0);
   }
 
   return 60;

test/unit/client.test.ts

@@ -28,8 +28,8 @@ describe("parseRetryAfter", () => {
     expect(result).toBeLessThanOrEqual(90);
   });
 
-  it("falls back to 60 for HTTP-date in the past", () => {
-    expect(parseRetryAfter("Wed, 21 Oct 2015 07:28:00 GMT")).toBe(60);
+  it("returns 0 for HTTP-date in the past", () => {
+    expect(parseRetryAfter("Wed, 21 Oct 2015 07:28:00 GMT")).toBe(0);
   });
 
   it("returns 60 for garbage input", () => {
@@ -39,4 +39,16 @@ describe("parseRetryAfter", () => {
   it("handles large numeric values", () => {
     expect(parseRetryAfter("3600")).toBe(3600);
   });
+
+  it("rejects partial numeric like '120s'", () => {
+    expect(parseRetryAfter("120s")).toBe(60);
+  });
+
+  it("rejects decimal like '1.5'", () => {
+    expect(parseRetryAfter("1.5")).toBe(60);
+  });
+
+  it("returns 60 for whitespace-only", () => {
+    expect(parseRetryAfter("   ")).toBe(60);
+  });
 });