From 5232d89f1aa971e683decf0738e014bd13226c14 Mon Sep 17 00:00:00 2001
From: Matthew Berman <748450+mberman84@users.noreply.github.com>
Date: Mon, 22 Jun 2026 11:15:51 -0700
Subject: [PATCH] Rebase Retry-After fix onto database-backed site

---
 site/agents/index.html    |  2 +-
 site/index.html           |  2 +-
 site/learn/index.html     |  2 +-
 site/script.js            | 24 +++++++++++++++++++++---
 worker/src/index.js       |  1 +
 worker/test/index.test.js |  4 ++++
 6 files changed, 29 insertions(+), 6 deletions(-)
diff --git a/site/agents/index.html b/site/agents/index.html
index 89f0029..bcfc09a 100644
--- a/site/agents/index.html
+++ b/site/agents/index.html
@@ -77,7 +77,7 @@
     />
     <link rel="icon" type="image/png" href="../assets/favicon.png" />
     <link rel="stylesheet" href="../styles.css?v=20260621-author-byline" />
-    <script src="../script.js?v=20260621-author-byline" defer></script>
+    <script src="../script.js?v=20260622-retry-after" defer></script>
     <script type="application/ld+json">
       {
         "@context": "https://schema.org",
diff --git a/site/index.html b/site/index.html
index 31ada4c..79b0188 100644
--- a/site/index.html
+++ b/site/index.html
@@ -198,7 +198,7 @@
   ]
 }
     </script>
-    <script src="./script.js?v=20260621-author-byline" defer></script>
+    <script src="./script.js?v=20260622-retry-after" defer></script>
     <title>Loop Library: Repeatable AI Agent Workflows | Forward Future</title>
   </head>
   <body>
diff --git a/site/learn/index.html b/site/learn/index.html
index 63dbd88..9a29e85 100644
--- a/site/learn/index.html
+++ b/site/learn/index.html
@@ -75,7 +75,7 @@
     />
     <link rel="icon" type="image/png" href="../assets/favicon.png" />
     <link rel="stylesheet" href="../styles.css?v=20260621-author-byline" />
-    <script src="../script.js?v=20260621-author-byline" defer></script>
+    <script src="../script.js?v=20260622-retry-after" defer></script>
     <script type="application/ld+json">
       {
         "@context": "https://schema.org",
diff --git a/site/script.js b/site/script.js
index d589be7..3628bc7 100644
--- a/site/script.js
+++ b/site/script.js
@@ -677,6 +677,20 @@ async function initializeFormProtection() {
   }
 }
 
+function formatRetryHint(seconds) {
+  if (!Number.isFinite(seconds) || seconds <= 0) {
+    return "";
+  }
+
+  if (seconds < 90) {
+    const rounded = Math.max(1, Math.ceil(seconds));
+    return ` Try again in about ${rounded} second${rounded === 1 ? "" : "s"}.`;
+  }
+
+  const minutes = Math.max(1, Math.ceil(seconds / 60));
+  return ` Try again in about ${minutes} minute${minutes === 1 ? "" : "s"}.`;
+}
+
 async function postProtectedForm(path, body, fallbackMessage) {
   const response = await fetch(`${FORM_API_ORIGIN}${path}`, {
     method: "POST",
@@ -695,9 +709,13 @@ async function postProtectedForm(path, body, fallbackMessage) {
   }
 
   if (!response.ok) {
-    throw new Error(
-      responseBody.error || fallbackMessage,
-    );
+    let message = responseBody.error || fallbackMessage;
+
+    if (response.status === 429) {
+      message += formatRetryHint(Number(response.headers.get("Retry-After")));
+    }
+
+    throw new Error(message);
   }
 }
 
diff --git a/worker/src/index.js b/worker/src/index.js
index a7cde2f..f95b1c0 100644
--- a/worker/src/index.js
+++ b/worker/src/index.js
@@ -345,6 +345,7 @@ function getCorsHeaders(origin, env) {
 
   return {
     "Access-Control-Allow-Origin": origin,
+    "Access-Control-Expose-Headers": "Retry-After",
     "Cache-Control": "no-store",
     Vary: "Origin",
   };
diff --git a/worker/test/index.test.js b/worker/test/index.test.js
index 6261e38..6755db0 100644
--- a/worker/test/index.test.js
+++ b/worker/test/index.test.js
@@ -370,6 +370,10 @@ test("rate limits invalid-token floods before calling Siteverify", async () => {
 
   assert.equal(response.status, 429);
   assert.equal(response.headers.get("Retry-After"), "60");
+  assert.equal(
+    response.headers.get("Access-Control-Expose-Headers"),
+    "Retry-After",
+  );
   assert.equal(body.code, "rate_limited");
   assert.deepEqual(rateLimitCalls, ["suggestions:203.0.113.10"]);
   assert.equal(calls.turnstile.length, 0);
