Release 0.2.1: say how long to wait between SMS codes

Pressing Send Code again inside Supabase's 60s resend window showed
"Failed to send verification code. Please try again later.", which read as
SMS being broken again. It now answers 429 "A code was just sent. Please
wait N seconds..." with Retry-After. Also ships #275 (codes via Telnyx
Verify, since carriers refuse our long code with 40010).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Author: ralyodio

package.json

@@ -1,7 +1,7 @@
 {
   "name": "qryptchat-web",
   "private": true,
-  "version": "0.2.0",
+  "version": "0.2.1",
   "type": "module",
   "bin": {
     "qc": "./bin/qc.js",

src/app/api/auth/send-sms/route.js

@@ -160,6 +160,21 @@ export async function POST(request, { params } = {}) {
 				logs: logger.getLogsAsString()
 			});
 
+			// GoTrue's resend window ("...only request this after 33 seconds"): say
+			// how long to wait instead of a failure that sounds like a broken service.
+			const wait = /after (\d+) seconds?/i.exec(String(smsError.message || ''));
+			if (wait) {
+				const seconds = Number(wait[1]);
+				return NextResponse.json(
+					{
+						error: `A code was just sent. Please wait ${seconds} second${seconds === 1 ? '' : 's'} before requesting another.`,
+						code: 'SMS_RESEND_TOO_SOON',
+						retryAfter: seconds
+					},
+					{ status: 429, headers: { 'Retry-After': String(seconds) } }
+				);
+			}
+
 			// Determine HTTP status code
 			let statusCode = 500;
 			if (smsError.status === 429) {

src/app/api/auth/send-sms/route.test.js

@@ -64,4 +64,20 @@ describe('POST /api/auth/send-sms', () => {
 		expect(mocks.checkDestination).not.toHaveBeenCalled();
 		expect(mocks.createSupabaseServerClient).not.toHaveBeenCalled();
 	});
+
+	it("says how long to wait when Supabase's resend window refuses a second code", async () => {
+		const error = Object.assign(new Error('For security purposes, you can only request this after 33 seconds.'), { status: 429 });
+		mocks.createSupabaseServerClient.mockResolvedValue({ auth: { signInWithOtp: vi.fn().mockResolvedValue({ error }) } });
+		const { POST } = await import('./route.js');
+		const response = await POST({
+			headers: new Headers(),
+			json: vi.fn().mockResolvedValue({ phoneNumber: '+14155550123' })
+		});
+		const body = await response.json();
+
+		expect(response.status).toBe(429);
+		expect(response.headers.get('Retry-After')).toBe('33');
+		expect(body).toMatchObject({ code: 'SMS_RESEND_TOO_SOON', retryAfter: 33 });
+		expect(body.error).toBe('A code was just sent. Please wait 33 seconds before requesting another.');
+	});
 });