@umec/core 0.1.0-alpha.10 → 0.1.0-alpha.12

package/registry/disclosure/files/src/lib/disclosure-request.ts

@@ -0,0 +1,818 @@
+import { Resend } from 'resend';
+import { getServerEnv } from './env';
+import {
+  countRequestsByEmailSince,
+  countRequestsByIpSince,
+  countRequestsSince,
+  incrementSendAttempts,
+  insertDisclosureRequest,
+  listRetryableUndisclosed,
+  listUndisclosedForReminder,
+  markDisclosed,
+  markOperatorNotified,
+  type DisclosureRequestRow,
+} from './disclosure-db';
+import type { ShopDatabase } from '@umec/core/db';
+
+export const EMAIL_PATTERN = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+export const DISCLOSURE_RETRY_CRON = '*/15 * * * *';
+export const DISCLOSURE_RETRY_MIN_AGE_MS = 5 * 60 * 1000;
+export const DEFAULT_RATE_PER_EMAIL = 3;
+export const DEFAULT_RATE_PER_IP = 10;
+export const DEFAULT_RATE_GLOBAL = 50;
+export const DEFAULT_RETRY_MAX = 3;
+export const TURNSTILE_SITEVERIFY_URL = 'https://challenges.cloudflare.com/turnstile/v0/siteverify';
+
+const DAY_MS = 24 * 60 * 60 * 1000;
+const USER_AGENT_MAX_LENGTH = 512;
+const IMMEDIATE_SEND_ATTEMPTS = 2;
+
+export type TokushohoDisplayMode = 'full-omission' | 'name-visible';
+export type DisclosureMode = 'auto' | 'manual';
+
+export type DisclosurePayload = {
+  sellerName: string;
+  operatorName: string;
+  address: string;
+  phone: string;
+  email: string;
+};
+
+export type DisclosureEnv = {
+  DB?: ShopDatabase;
+  RESEND_API_KEY?: string;
+  DISCLOSURE_PAYLOAD?: string;
+  DISCLOSURE_MODE?: string;
+  DISCLOSURE_NOTIFY_TO?: string;
+  DISCLOSURE_RATE_PER_EMAIL?: string;
+  DISCLOSURE_RATE_PER_IP?: string;
+  DISCLOSURE_RATE_GLOBAL?: string;
+  DISCLOSURE_IP_SALT?: string;
+  DISCLOSURE_RETRY_MAX?: string;
+  TURNSTILE_SECRET_KEY?: string;
+  PUBLIC_TURNSTILE_SITE_KEY?: string;
+};
+
+export type DisclosureBrandContext = {
+  brandName: string;
+  brandUrl: string;
+  emailFrom: string;
+  emailReplyTo?: string;
+  notifyFallback?: string;
+};
+
+export type DisclosureHandlerOptions = DisclosureBrandContext & {
+  isProduction: boolean;
+  now?: () => number;
+  createId?: () => string;
+  fetchImpl?: typeof fetch;
+};
+
+export type DisclosureMailCopy = {
+  requesterSubject: string;
+  operatorSubject: string;
+  exhaustedSubject: string;
+  globalLimitSubject: string;
+  staleReminderSubject: string;
+};
+
+function jsonError(error: string, status: number) {
+  return new Response(JSON.stringify({ error }), {
+    status,
+    headers: { 'Content-Type': 'application/json' },
+  });
+}
+
+function jsonOk() {
+  return new Response(JSON.stringify({ ok: true }), {
+    status: 200,
+    headers: { 'Content-Type': 'application/json' },
+  });
+}
+
+function asDisclosureEnv(env: unknown): DisclosureEnv {
+  return env as DisclosureEnv;
+}
+
+export function parsePositiveInt(value: string | undefined, fallback: number): number {
+  if (!value) return fallback;
+  const parsed = Number(value);
+  return Number.isFinite(parsed) && parsed > 0 ? parsed : fallback;
+}
+
+export function resolveDisclosureMode(value: string | undefined): DisclosureMode {
+  return value === 'manual' ? 'manual' : 'auto';
+}
+
+export function resolveTokushohoDisplayMode(value: string | undefined): TokushohoDisplayMode {
+  return value === 'name-visible' ? 'name-visible' : 'full-omission';
+}
+
+export function resolveDisclosureNotifyTo(
+  env: Pick<DisclosureEnv, 'DISCLOSURE_NOTIFY_TO'>,
+  fallback?: string,
+): string | null {
+  if (typeof env.DISCLOSURE_NOTIFY_TO === 'string' && env.DISCLOSURE_NOTIFY_TO.trim()) {
+    return env.DISCLOSURE_NOTIFY_TO.trim();
+  }
+  if (typeof fallback === 'string' && fallback.trim()) return fallback.trim();
+  return null;
+}
+
+export function parseDisclosurePayload(raw: string | undefined): DisclosurePayload | null {
+  if (!raw || !raw.trim()) return null;
+  try {
+    const parsed: unknown = JSON.parse(raw);
+    if (typeof parsed !== 'object' || parsed === null) return null;
+    const value = parsed as Record<string, unknown>;
+    const sellerName = typeof value.sellerName === 'string' ? value.sellerName.trim() : '';
+    const address = typeof value.address === 'string' ? value.address.trim() : '';
+    const phone = typeof value.phone === 'string' ? value.phone.trim() : '';
+    const email = typeof value.email === 'string' ? value.email.trim() : '';
+    const operatorName = typeof value.operatorName === 'string' ? value.operatorName.trim() : '';
+    if (!sellerName || !address || !phone || !email) return null;
+    return { sellerName, operatorName, address, phone, email };
+  } catch {
+    return null;
+  }
+}
+
+export function createDisclosureRequestId(): string {
+  return crypto.randomUUID();
+}
+
+export function getClientIp(request: Request, clientAddress?: string): string {
+  const cf = request.headers.get('CF-Connecting-IP')?.trim();
+  if (cf) return cf;
+  const forwarded = request.headers.get('X-Forwarded-For')?.split(',')[0]?.trim();
+  if (forwarded) return forwarded;
+  return clientAddress?.trim() ?? '';
+}
+
+export async function hashIp(ip: string, salt: string): Promise<string> {
+  const data = new TextEncoder().encode(`${ip}${salt}`);
+  const digest = await crypto.subtle.digest('SHA-256', data);
+  return [...new Uint8Array(digest)].map((byte) => byte.toString(16).padStart(2, '0')).join('');
+}
+
+export async function verifyTurnstileToken(input: {
+  secret: string;
+  token: string;
+  ip?: string;
+  fetchImpl?: typeof fetch;
+}): Promise<boolean> {
+  const body = new URLSearchParams();
+  body.set('secret', input.secret);
+  body.set('response', input.token);
+  if (input.ip) body.set('remoteip', input.ip);
+
+  try {
+    const fetchImpl = input.fetchImpl ?? fetch;
+    const response = await fetchImpl(TURNSTILE_SITEVERIFY_URL, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+      body,
+    });
+    if (!response.ok) return false;
+    const payload: unknown = await response.json();
+    return (
+      typeof payload === 'object' &&
+      payload !== null &&
+      (payload as { success?: unknown }).success === true
+    );
+  } catch {
+    return false;
+  }
+}
+
+function escapeHtml(value: string) {
+  return value
+    .replaceAll('&', '&amp;')
+    .replaceAll('<', '&lt;')
+    .replaceAll('>', '&gt;')
+    .replaceAll('"', '&quot;')
+    .replaceAll("'", '&#39;');
+}
+
+export function formatReceivedAt(ms: number): string {
+  return `${new Intl.DateTimeFormat('ja-JP', {
+    timeZone: 'Asia/Tokyo',
+    year: 'numeric',
+    month: '2-digit',
+    day: '2-digit',
+    hour: '2-digit',
+    minute: '2-digit',
+    second: '2-digit',
+    hour12: false,
+  }).format(new Date(ms))} (JST)`;
+}
+
+function adminDisclosureUrl(brandUrl: string): string {
+  return `${brandUrl.replace(/\/$/, '')}/admin/disclosure`;
+}
+
+export function defaultDisclosureMailCopy(brandName: string, requestId?: string): DisclosureMailCopy {
+  // TODO: 文言確定待ち（ヒューマンゲート）。件名は設計書 §3.1 / §3.2 の案文。
+  return {
+    requesterSubject: `【${brandName}】特定商取引法に基づく表示事項の開示`,
+    operatorSubject: requestId
+      ? `【${brandName}】特商法 開示請求を受付（請求番号 ${requestId}）`
+      : `【${brandName}】特商法 開示請求を受付`,
+    exhaustedSubject: `【${brandName}】特商法 開示メールの自動送信が上限に達しました`,
+    globalLimitSubject: `【${brandName}】特商法 開示請求が1日の上限に達しました`,
+    staleReminderSubject: `【${brandName}】特商法 未開示の請求があります`,
+  };
+}
+
+export function renderRequesterDisclosureMail(input: {
+  brandName: string;
+  requestId: string;
+  receivedAtMs: number;
+  payload: DisclosurePayload;
+  copy?: Pick<DisclosureMailCopy, 'requesterSubject'>;
+}): { subject: string; text: string; html: string } {
+  // TODO: 文言確定待ち（ヒューマンゲート）。本文構成は設計書 §3.1。
+  const copy = input.copy ?? defaultDisclosureMailCopy(input.brandName);
+  const receivedAt = formatReceivedAt(input.receivedAtMs);
+  const operatorLine = input.payload.operatorName
+    ? `運営責任者名: ${input.payload.operatorName}`
+    : '運営責任者名: （個人事業主のため販売事業者名に同じ）';
+  const text = [
+    '特定商取引法に基づく表示事項の開示請求を受け付けました。',
+    '',
+    `請求番号: ${input.requestId}`,
+    `受付日時: ${receivedAt}`,
+    '',
+    '【開示事項】',
+    `販売事業者名: ${input.payload.sellerName}`,
+    operatorLine,
+    `所在地: ${input.payload.address}`,
+    `電話番号: ${input.payload.phone}`,
+    `メールアドレス: ${input.payload.email}`,
+    '',
+    'このメールは、特定商取引法に基づく開示請求への回答として送信しています。',
+  ].join('\n');
+
+  const html = `<!DOCTYPE html>
+<html lang="ja">
+<head><meta charset="UTF-8"></head>
+<body style="font-family:sans-serif;color:#222;max-width:600px;margin:0 auto;padding:32px 16px;">
+  <p style="font-size:13px;letter-spacing:0.2em;color:#888;margin-bottom:24px;">${escapeHtml(input.brandName)}</p>
+  <p style="font-size:14px;line-height:1.8;color:#555;">
+    特定商取引法に基づく表示事項の開示請求を受け付けました。
+  </p>
+  <p style="font-size:14px;line-height:1.8;color:#555;">
+    請求番号: ${escapeHtml(input.requestId)}<br>
+    受付日時: ${escapeHtml(receivedAt)}
+  </p>
+  <h2 style="font-size:13px;letter-spacing:0.2em;color:#888;margin:32px 0 12px;">開示事項</h2>
+  <table style="width:100%;border-collapse:collapse;font-size:14px;">
+    <tr><th style="text-align:left;padding:8px 0;border-bottom:1px solid #eee;color:#888;width:40%;">販売事業者名</th><td style="padding:8px 0;border-bottom:1px solid #eee;">${escapeHtml(input.payload.sellerName)}</td></tr>
+    <tr><th style="text-align:left;padding:8px 0;border-bottom:1px solid #eee;color:#888;">運営責任者名</th><td style="padding:8px 0;border-bottom:1px solid #eee;">${escapeHtml(input.payload.operatorName || '（個人事業主のため販売事業者名に同じ）')}</td></tr>
+    <tr><th style="text-align:left;padding:8px 0;border-bottom:1px solid #eee;color:#888;">所在地</th><td style="padding:8px 0;border-bottom:1px solid #eee;">${escapeHtml(input.payload.address)}</td></tr>
+    <tr><th style="text-align:left;padding:8px 0;border-bottom:1px solid #eee;color:#888;">電話番号</th><td style="padding:8px 0;border-bottom:1px solid #eee;">${escapeHtml(input.payload.phone)}</td></tr>
+    <tr><th style="text-align:left;padding:8px 0;border-bottom:1px solid #eee;color:#888;">メールアドレス</th><td style="padding:8px 0;border-bottom:1px solid #eee;">${escapeHtml(input.payload.email)}</td></tr>
+  </table>
+  <p style="font-size:13px;line-height:1.8;color:#888;margin-top:40px;padding-top:24px;border-top:1px solid #eee;">
+    このメールは、特定商取引法に基づく開示請求への回答として送信しています。
+  </p>
+</body>
+</html>`;
+
+  return { subject: copy.requesterSubject, text, html };
+}
+
+export function renderOperatorNotificationMail(input: {
+  brandName: string;
+  brandUrl: string;
+  requestId: string;
+  receivedAtMs: number;
+  requesterEmail: string;
+  disclosureSendResult: 'success' | 'retry' | 'manual' | 'exhausted';
+  copy?: Pick<DisclosureMailCopy, 'operatorSubject' | 'exhaustedSubject'>;
+}): { subject: string; text: string; html: string } {
+  // TODO: 文言確定待ち（ヒューマンゲート）。本文は設計書 §3.2。
+  const copy = input.copy ?? defaultDisclosureMailCopy(input.brandName, input.requestId);
+  const receivedAt = formatReceivedAt(input.receivedAtMs);
+  const resultLabel =
+    input.disclosureSendResult === 'success'
+      ? '成功'
+      : input.disclosureSendResult === 'retry'
+        ? 'リトライ委譲'
+        : input.disclosureSendResult === 'exhausted'
+          ? '自動送信上限超過'
+          : '手動開示待ち';
+  const adminUrl = adminDisclosureUrl(input.brandUrl);
+  const subject =
+    input.disclosureSendResult === 'exhausted' ? copy.exhaustedSubject : copy.operatorSubject;
+  const text = [
+    '特商法の開示請求を受け付けました。',
+    '',
+    `請求番号: ${input.requestId}`,
+    `請求者メールアドレス: ${input.requesterEmail}`,
+    `受付日時: ${receivedAt}`,
+    `開示メール送信結果: ${resultLabel}`,
+    '',
+    `管理画面: ${adminUrl}`,
+  ].join('\n');
+  const html = `<!DOCTYPE html>
+<html lang="ja">
+<head><meta charset="UTF-8"></head>
+<body style="font-family:sans-serif;color:#222;max-width:600px;margin:0 auto;padding:32px 16px;">
+  <p style="font-size:14px;line-height:1.8;">特商法の開示請求を受け付けました。</p>
+  <p style="font-size:14px;line-height:1.8;">
+    請求番号: ${escapeHtml(input.requestId)}<br>
+    請求者メールアドレス: ${escapeHtml(input.requesterEmail)}<br>
+    受付日時: ${escapeHtml(receivedAt)}<br>
+    開示メール送信結果: ${escapeHtml(resultLabel)}
+  </p>
+  <p style="font-size:14px;line-height:1.8;">
+    管理画面: <a href="${escapeHtml(adminUrl)}">${escapeHtml(adminUrl)}</a>
+  </p>
+</body>
+</html>`;
+  return { subject, text, html };
+}
+
+export function renderStaleDisclosureReminderMail(input: {
+  brandName: string;
+  brandUrl: string;
+  rows: DisclosureRequestRow[];
+  copy?: Pick<DisclosureMailCopy, 'staleReminderSubject'>;
+}): { subject: string; text: string; html: string } {
+  // TODO: 文言確定待ち（ヒューマンゲート）。日次未開示一覧は設計書 §5.3。
+  const copy = input.copy ?? defaultDisclosureMailCopy(input.brandName);
+  const adminUrl = adminDisclosureUrl(input.brandUrl);
+  const count = input.rows.length;
+  const subject = `${copy.staleReminderSubject}（${count}件）`;
+  const text = [
+    `未開示の特商法開示請求が ${count} 件あります。`,
+    '自動リトライと別に、日次の確認としてお送りしています。',
+    '',
+    ...input.rows.map(
+      (row) =>
+        `請求番号: ${row.id} / 請求者: ${row.requester_email} / 受付日時: ${formatReceivedAt(row.received_at)} / 送信試行: ${row.send_attempts}`,
+    ),
+    '',
+    `管理画面: ${adminUrl}`,
+  ].join('\n');
+  const rowsHtml = input.rows
+    .map(
+      (row) => `<tr>
+        <td style="padding:8px;border-bottom:1px solid #eee;">${escapeHtml(row.id)}</td>
+        <td style="padding:8px;border-bottom:1px solid #eee;">${escapeHtml(row.requester_email)}</td>
+        <td style="padding:8px;border-bottom:1px solid #eee;">${escapeHtml(formatReceivedAt(row.received_at))}</td>
+        <td style="padding:8px;border-bottom:1px solid #eee;text-align:right;">${escapeHtml(String(row.send_attempts))}</td>
+      </tr>`,
+    )
+    .join('');
+  const html = `<!DOCTYPE html>
+<html lang="ja">
+<head><meta charset="UTF-8"></head>
+<body style="font-family:sans-serif;color:#222;max-width:720px;margin:0 auto;padding:32px 16px;">
+  <p style="font-size:14px;line-height:1.8;">未開示の特商法開示請求が ${count} 件あります。</p>
+  <p style="font-size:13px;line-height:1.8;color:#555;">自動リトライと別に、日次の確認としてお送りしています。</p>
+  <table style="width:100%;border-collapse:collapse;font-size:14px;">
+    <thead>
+      <tr>
+        <th style="padding:8px;border-bottom:2px solid #222;text-align:left;">請求番号</th>
+        <th style="padding:8px;border-bottom:2px solid #222;text-align:left;">請求者</th>
+        <th style="padding:8px;border-bottom:2px solid #222;text-align:left;">受付日時</th>
+        <th style="padding:8px;border-bottom:2px solid #222;text-align:right;">送信試行</th>
+      </tr>
+    </thead>
+    <tbody>${rowsHtml}</tbody>
+  </table>
+  <p style="font-size:14px;line-height:1.8;margin-top:24px;">
+    管理画面: <a href="${escapeHtml(adminUrl)}">${escapeHtml(adminUrl)}</a>
+  </p>
+</body>
+</html>`;
+  return { subject, text, html };
+}
+
+type SendEmailInput = {
+  apiKey: string;
+  from: string;
+  to: string;
+  subject: string;
+  text: string;
+  html: string;
+  replyTo?: string;
+};
+
+async function sendResendEmail(input: SendEmailInput): Promise<{ id: string } | { error: unknown }> {
+  const resend = new Resend(input.apiKey);
+  const { data, error } = await resend.emails.send({
+    from: input.from,
+    to: input.to,
+    subject: input.subject,
+    text: input.text,
+    html: input.html,
+    ...(input.replyTo ? { replyTo: input.replyTo } : {}),
+  });
+  if (error || !data?.id) {
+    return { error: error ?? new Error('Resend did not return an email id') };
+  }
+  return { id: data.id };
+}
+
+async function notifyOperator(input: {
+  env: DisclosureEnv;
+  brand: DisclosureBrandContext;
+  requestId: string;
+  receivedAtMs: number;
+  requesterEmail: string;
+  disclosureSendResult: 'success' | 'retry' | 'manual' | 'exhausted';
+}): Promise<boolean> {
+  const notifyTo = resolveDisclosureNotifyTo(input.env, input.brand.notifyFallback);
+  if (!notifyTo) {
+    console.error('[disclosure] DISCLOSURE_NOTIFY_TO (or email.bcc) is not configured');
+    return false;
+  }
+  if (!input.env.RESEND_API_KEY) {
+    console.error('[disclosure] RESEND_API_KEY is not configured; operator notify skipped');
+    return false;
+  }
+
+  const mail = renderOperatorNotificationMail({
+    brandName: input.brand.brandName,
+    brandUrl: input.brand.brandUrl,
+    requestId: input.requestId,
+    receivedAtMs: input.receivedAtMs,
+    requesterEmail: input.requesterEmail,
+    disclosureSendResult: input.disclosureSendResult,
+  });
+
+  try {
+    const result = await sendResendEmail({
+      apiKey: input.env.RESEND_API_KEY,
+      from: input.brand.emailFrom,
+      to: notifyTo,
+      subject: mail.subject,
+      text: mail.text,
+      html: mail.html,
+      replyTo: input.brand.emailReplyTo,
+    });
+    if ('error' in result) {
+      console.error('[disclosure] operator notify failed');
+      return false;
+    }
+    return true;
+  } catch {
+    console.error('[disclosure] operator notify threw');
+    return false;
+  }
+}
+
+async function sendDisclosureToRequester(input: {
+  env: DisclosureEnv;
+  brand: DisclosureBrandContext;
+  payload: DisclosurePayload;
+  requestId: string;
+  receivedAtMs: number;
+  requesterEmail: string;
+}): Promise<{ id: string } | { error: unknown }> {
+  if (!input.env.RESEND_API_KEY) {
+    return { error: new Error('RESEND_API_KEY is not configured') };
+  }
+  const mail = renderRequesterDisclosureMail({
+    brandName: input.brand.brandName,
+    requestId: input.requestId,
+    receivedAtMs: input.receivedAtMs,
+    payload: input.payload,
+  });
+  return sendResendEmail({
+    apiKey: input.env.RESEND_API_KEY,
+    from: input.brand.emailFrom,
+    to: input.requesterEmail,
+    subject: mail.subject,
+    text: mail.text,
+    html: mail.html,
+    replyTo: input.brand.emailReplyTo,
+  });
+}
+
+function configuredForProduction(env: DisclosureEnv): boolean {
+  return Boolean(env.DB && env.RESEND_API_KEY && parseDisclosurePayload(env.DISCLOSURE_PAYLOAD) && env.TURNSTILE_SECRET_KEY);
+}
+
+function configuredForDevProcessing(env: DisclosureEnv): boolean {
+  return Boolean(env.DB && env.RESEND_API_KEY && parseDisclosurePayload(env.DISCLOSURE_PAYLOAD));
+}
+
+export function createDisclosureRequestHandler(options: DisclosureHandlerOptions) {
+  return async ({
+    request,
+    clientAddress,
+  }: {
+    request: Request;
+    clientAddress?: string;
+  }): Promise<Response> => {
+    const contentType = request.headers.get('content-type') ?? '';
+    if (!contentType.toLowerCase().includes('application/json')) {
+      return jsonError('Invalid request body', 400);
+    }
+
+    let body: unknown;
+    try {
+      body = await request.json();
+    } catch {
+      return jsonError('Invalid request body', 400);
+    }
+
+    if (typeof body !== 'object' || body === null) {
+      return jsonError('Invalid request body', 400);
+    }
+
+    const { email, turnstileToken } = body as Record<string, unknown>;
+    if (typeof email !== 'string' || !EMAIL_PATTERN.test(email.trim())) {
+      return jsonError('Invalid email', 400);
+    }
+    const requesterEmail = email.trim().toLowerCase();
+
+    const env = asDisclosureEnv(getServerEnv());
+    const ready = options.isProduction
+      ? configuredForProduction(env)
+      : configuredForDevProcessing(env);
+
+    if (!ready) {
+      if (options.isProduction) {
+        console.error('[disclosure] required env missing in production');
+        return jsonError('Disclosure service unavailable', 503);
+      }
+      console.log('[disclosure] env not set (dev), skipping');
+      return jsonOk();
+    }
+
+    const db = env.DB;
+    const payload = parseDisclosurePayload(env.DISCLOSURE_PAYLOAD);
+    if (!db || !payload || !env.RESEND_API_KEY) {
+      if (options.isProduction) return jsonError('Disclosure service unavailable', 503);
+      console.log('[disclosure] env not set (dev), skipping');
+      return jsonOk();
+    }
+
+    const now = options.now?.() ?? Date.now();
+    const ip = getClientIp(request, clientAddress);
+    const fetchImpl = options.fetchImpl ?? fetch;
+
+    if (env.TURNSTILE_SECRET_KEY) {
+      const token = typeof turnstileToken === 'string' ? turnstileToken.trim() : '';
+      if (!token) return jsonError('Verification failed', 400);
+      const ok = await verifyTurnstileToken({
+        secret: env.TURNSTILE_SECRET_KEY,
+        token,
+        ip: ip || undefined,
+        fetchImpl,
+      });
+      if (!ok) return jsonError('Verification failed', 400);
+    } else if (options.isProduction) {
+      console.error('[disclosure] TURNSTILE_SECRET_KEY missing in production');
+      return jsonError('Disclosure service unavailable', 503);
+    }
+
+    const salt = typeof env.DISCLOSURE_IP_SALT === 'string' ? env.DISCLOSURE_IP_SALT : '';
+    if (!salt) {
+      console.warn('[disclosure] DISCLOSURE_IP_SALT is not set; IP hashing is weaker');
+    }
+    const ipHash = ip ? await hashIp(ip, salt) : null;
+
+    const since = now - DAY_MS;
+    const perEmail = parsePositiveInt(env.DISCLOSURE_RATE_PER_EMAIL, DEFAULT_RATE_PER_EMAIL);
+    const perIp = parsePositiveInt(env.DISCLOSURE_RATE_PER_IP, DEFAULT_RATE_PER_IP);
+    const perGlobal = parsePositiveInt(env.DISCLOSURE_RATE_GLOBAL, DEFAULT_RATE_GLOBAL);
+
+    const emailCount = await countRequestsByEmailSince(db, requesterEmail, since);
+    if (emailCount >= perEmail) {
+      return jsonError('Too many requests', 429);
+    }
+    if (ipHash) {
+      const ipCount = await countRequestsByIpSince(db, ipHash, since);
+      if (ipCount >= perIp) {
+        return jsonError('Too many requests', 429);
+      }
+    }
+    const globalCount = await countRequestsSince(db, since);
+    if (globalCount >= perGlobal) {
+      try {
+        const notifyTo = resolveDisclosureNotifyTo(env, options.notifyFallback);
+        if (notifyTo && env.RESEND_API_KEY) {
+          const copy = defaultDisclosureMailCopy(options.brandName);
+          await sendResendEmail({
+            apiKey: env.RESEND_API_KEY,
+            from: options.emailFrom,
+            to: notifyTo,
+            subject: copy.globalLimitSubject,
+            text: '開示請求フォームのインスタンス全体の1日上限に達しました。',
+            html: '<p>開示請求フォームのインスタンス全体の1日上限に達しました。</p>',
+            replyTo: options.emailReplyTo,
+          });
+        }
+      } catch {
+        console.error('[disclosure] global rate-limit notify failed');
+      }
+      return jsonError('Too many requests', 429);
+    }
+
+    const requestId = options.createId?.() ?? createDisclosureRequestId();
+    const userAgentRaw = request.headers.get('user-agent');
+    const userAgent = userAgentRaw ? userAgentRaw.slice(0, USER_AGENT_MAX_LENGTH) : null;
+
+    await insertDisclosureRequest(db, {
+      id: requestId,
+      requesterEmail,
+      receivedAt: now,
+      ipHash,
+      userAgent,
+    });
+
+    const mode = resolveDisclosureMode(env.DISCLOSURE_MODE);
+    let disclosureSendResult: 'success' | 'retry' | 'manual' = 'manual';
+
+    if (mode === 'auto') {
+      let lastError: unknown;
+      let sentId: string | null = null;
+      for (let attempt = 0; attempt < IMMEDIATE_SEND_ATTEMPTS; attempt += 1) {
+        try {
+          const result = await sendDisclosureToRequester({
+            env,
+            brand: options,
+            payload,
+            requestId,
+            receivedAtMs: now,
+            requesterEmail,
+          });
+          await incrementSendAttempts(db, requestId);
+          if ('id' in result) {
+            sentId = result.id;
+            break;
+          }
+          lastError = result.error;
+        } catch (error) {
+          await incrementSendAttempts(db, requestId);
+          lastError = error;
+        }
+      }
+
+      if (sentId) {
+        await markDisclosed(db, requestId, {
+          disclosedAt: options.now?.() ?? Date.now(),
+          disclosureEmailId: sentId,
+        });
+        disclosureSendResult = 'success';
+      } else {
+        disclosureSendResult = 'retry';
+        if (lastError) {
+          console.error('[disclosure] disclosure email failed; delegated to retry cron');
+        }
+      }
+    } else {
+      console.warn('[disclosure] DISCLOSURE_MODE=manual; auto-send skipped (PaF-2 fallback path)');
+    }
+
+    const notified = await notifyOperator({
+      env,
+      brand: options,
+      requestId,
+      receivedAtMs: now,
+      requesterEmail,
+      disclosureSendResult,
+    });
+    if (notified) {
+      await markOperatorNotified(db, requestId, options.now?.() ?? Date.now());
+    }
+
+    return jsonOk();
+  };
+}
+
+export async function retryDisclosureEmails(
+  env: DisclosureEnv,
+  brand: DisclosureBrandContext,
+  now = Date.now(),
+): Promise<void> {
+  if (!env.DB) {
+    console.error('[scheduled/disclosure] DB binding is not available');
+    return;
+  }
+  if (!env.RESEND_API_KEY) {
+    console.error('[scheduled/disclosure] RESEND_API_KEY is not configured');
+    return;
+  }
+
+  const payload = parseDisclosurePayload(env.DISCLOSURE_PAYLOAD);
+  if (!payload) {
+    console.error('[scheduled/disclosure] DISCLOSURE_PAYLOAD is missing or invalid');
+    return;
+  }
+
+  const maxAttempts = parsePositiveInt(env.DISCLOSURE_RETRY_MAX, DEFAULT_RETRY_MAX);
+  const rows = await listRetryableUndisclosed(env.DB, {
+    maxAttempts,
+    receivedAtOnOrBefore: now - DISCLOSURE_RETRY_MIN_AGE_MS,
+  });
+  if (rows.length === 0) return;
+
+  for (const row of rows) {
+    await retryOneDisclosureEmail(env, brand, payload, row, now, maxAttempts);
+  }
+}
+
+async function retryOneDisclosureEmail(
+  env: DisclosureEnv,
+  brand: DisclosureBrandContext,
+  payload: DisclosurePayload,
+  row: DisclosureRequestRow,
+  now: number,
+  maxAttempts: number,
+): Promise<void> {
+  const db = env.DB;
+  if (!db) return;
+
+  try {
+    const result = await sendDisclosureToRequester({
+      env,
+      brand,
+      payload,
+      requestId: row.id,
+      receivedAtMs: row.received_at,
+      requesterEmail: row.requester_email,
+    });
+    const attempts = await incrementSendAttempts(db, row.id);
+    if ('id' in result) {
+      await markDisclosed(db, row.id, { disclosedAt: now, disclosureEmailId: result.id });
+      return;
+    }
+    if (attempts >= maxAttempts) {
+      await notifyOperator({
+        env,
+        brand,
+        requestId: row.id,
+        receivedAtMs: row.received_at,
+        requesterEmail: row.requester_email,
+        disclosureSendResult: 'exhausted',
+      });
+    }
+  } catch {
+    const attempts = await incrementSendAttempts(db, row.id);
+    console.error('[scheduled/disclosure] retry send threw');
+    if (attempts >= maxAttempts) {
+      await notifyOperator({
+        env,
+        brand,
+        requestId: row.id,
+        receivedAtMs: row.received_at,
+        requesterEmail: row.requester_email,
+        disclosureSendResult: 'exhausted',
+      });
+    }
+  }
+}
+
+export async function alertStaleDisclosureRequests(
+  env: DisclosureEnv,
+  brand: DisclosureBrandContext,
+): Promise<void> {
+  if (!env.DB) {
+    console.error('[scheduled/disclosure] DB binding is not available');
+    return;
+  }
+
+  const alertTo = resolveDisclosureNotifyTo(env, brand.notifyFallback);
+  if (!alertTo) {
+    console.error('[scheduled/disclosure] DISCLOSURE_NOTIFY_TO (or email.bcc) is not configured');
+    return;
+  }
+
+  const rows = await listUndisclosedForReminder(env.DB);
+  if (rows.length === 0) return;
+
+  if (!env.RESEND_API_KEY) {
+    console.error('[scheduled/disclosure] RESEND_API_KEY is not configured');
+    return;
+  }
+
+  const mail = renderStaleDisclosureReminderMail({
+    brandName: brand.brandName,
+    brandUrl: brand.brandUrl,
+    rows,
+  });
+
+  try {
+    const result = await sendResendEmail({
+      apiKey: env.RESEND_API_KEY,
+      from: brand.emailFrom,
+      to: alertTo,
+      subject: mail.subject,
+      text: mail.text,
+      html: mail.html,
+      replyTo: brand.emailReplyTo,
+    });
+    if ('error' in result) {
+      console.error('[scheduled/disclosure] stale reminder notify failed');
+    }
+  } catch {
+    console.error('[scheduled/disclosure] stale reminder notify threw');
+  }
+}