From 4585c192cb676d33ffbe9f1e8215e06b4f20dcbb Mon Sep 17 00:00:00 2001
From: Pato Perpetua <patoperpetua@gmail.com>
Date: Tue, 25 Aug 2026 00:45:03 +1000
Subject: [PATCH 1/2] feat(api): add POST /emails/send template endpoint

Wire TenantResolver, TemplateStore, Handlebars rendering, and EmailProvider with injectable deps and PostKitErrorResponse telemetry.

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 apps/api/package.json               |   3 +-
 apps/api/src/functions/send.spec.ts | 256 +++++++++++++++++++++++
 apps/api/src/functions/send.ts      | 312 ++++++++++++++++++++++++++++
 apps/api/src/index.ts               |   1 +
 pnpm-lock.yaml                      |   3 +
 5 files changed, 574 insertions(+), 1 deletion(-)
 create mode 100644 apps/api/src/functions/send.spec.ts
 create mode 100644 apps/api/src/functions/send.ts

diff --git a/apps/api/package.json b/apps/api/package.json
index aa000bc..1b47c1e 100644
--- a/apps/api/package.json
+++ b/apps/api/package.json
@@ -16,7 +16,8 @@
     "@azure/keyvault-secrets": "^4.11.2",
     "@azure/storage-blob": "^12.33.0",
     "@singleton-sd/post-kit-email": "workspace:*",
-    "@singleton-sd/post-kit-types": "workspace:^"
+    "@singleton-sd/post-kit-types": "workspace:^",
+    "handlebars": "^4.7.8"
   },
   "devDependencies": {
     "@types/node": "^22.10.2",
diff --git a/apps/api/src/functions/send.spec.ts b/apps/api/src/functions/send.spec.ts
new file mode 100644
index 0000000..36ad799
--- /dev/null
+++ b/apps/api/src/functions/send.spec.ts
@@ -0,0 +1,256 @@
+import assert from 'node:assert/strict';
+import { describe, it } from 'node:test';
+import type { HttpRequest, InvocationContext } from '@azure/functions';
+import type {
+  EmailProvider,
+  EmailSendRequest,
+  EmailSendResult,
+} from '@singleton-sd/post-kit-email';
+import {
+  PostKitErrorCode,
+  TEMPLATE_SCHEMA_VERSION,
+  type CompiledTemplate,
+  type TenantContext,
+} from '@singleton-sd/post-kit-types';
+import { TenantResolverError, type TenantResolver } from '../tenant';
+import { TemplateStoreError, type TemplateStore } from '../templates';
+import { createSendHandler } from './send';
+
+const TENANT: TenantContext = { tenantId: 'inkads', environment: 'development' };
+
+const COMPILED: CompiledTemplate = {
+  templateHtml: '<p>Hello {{name}}</p>',
+  metadata: {
+    key: 'marketing.contact-us',
+    name: 'Contact Us',
+    subject: 'Hi {{name}}',
+    variables: ['name'],
+    schemaVersion: TEMPLATE_SCHEMA_VERSION,
+  },
+  manifest: {
+    key: 'marketing.contact-us',
+    schemaVersion: TEMPLATE_SCHEMA_VERSION,
+    compiledAt: '2026-01-01T00:00:00.000Z',
+    sourceCommit: '',
+    variables: ['name'],
+    contentHash: 'abc',
+  },
+};
+
+function fakeRequest(options: { headers?: Record<string, string>; json?: unknown }): HttpRequest {
+  const headers = new Headers(options.headers);
+  return {
+    method: 'POST',
+    headers: { get: (name: string) => headers.get(name) },
+    json: async () => options.json ?? null,
+  } as unknown as HttpRequest;
+}
+
+function fakeContext(): InvocationContext {
+  return { error: () => undefined } as unknown as InvocationContext;
+}
+
+function fakeResolver(ok = true): TenantResolver {
+  return {
+    resolve: async () => {
+      if (!ok) {
+        throw new TenantResolverError('missing', PostKitErrorCode.UNAUTHENTICATED);
+      }
+      return TENANT;
+    },
+  };
+}
+
+function fakeStore(result: CompiledTemplate | TemplateStoreError): TemplateStore {
+  return {
+    load: async () => {
+      if (result instanceof TemplateStoreError) throw result;
+      return result;
+    },
+  };
+}
+
+function fakeProvider(capture?: EmailSendRequest[]): EmailProvider {
+  return {
+    name: 'development',
+    isConfigured: () => true,
+    send: async (request): Promise<EmailSendResult> => {
+      capture?.push(request);
+      return { providerMessageId: 'msg-1', accepted: true };
+    },
+  };
+}
+
+describe('sendHandler', () => {
+  it('sends a template email and returns SendResponse', async () => {
+    const sent: EmailSendRequest[] = [];
+    const handler = createSendHandler({
+      tenantResolver: fakeResolver(),
+      templateStore: fakeStore(COMPILED),
+      emailProvider: fakeProvider(sent),
+      fromAddress: () => 'noreply@example.com',
+      fromName: () => 'PostKit',
+    });
+
+    const response = await handler(
+      fakeRequest({
+        headers: { authorization: 'Bearer tok', 'x-correlation-id': 'corr-send-01' },
+        json: {
+          template: 'marketing.contact-us',
+          to: 'user@example.com',
+          variables: { name: 'Ada' },
+        },
+      }),
+      fakeContext(),
+    );
+
+    assert.equal(response.status, 200);
+    assert.deepEqual(response.jsonBody, { id: 'corr-send-01', status: 'sent' });
+    assert.equal(sent[0]?.subject, 'Hi Ada');
+    assert.equal(sent[0]?.html, '<p>Hello Ada</p>');
+  });
+
+  it('HTML-escapes variables in the body', async () => {
+    const sent: EmailSendRequest[] = [];
+    const handler = createSendHandler({
+      tenantResolver: fakeResolver(),
+      templateStore: fakeStore(COMPILED),
+      emailProvider: fakeProvider(sent),
+      fromAddress: () => 'noreply@example.com',
+    });
+
+    await handler(
+      fakeRequest({
+        json: {
+          template: 'marketing.contact-us',
+          to: 'user@example.com',
+          variables: { name: '<script>alert(1)</script>' },
+        },
+      }),
+      fakeContext(),
+    );
+
+    assert.ok(sent[0]?.html?.includes('&lt;script&gt;'));
+    assert.ok(!sent[0]?.html?.includes('<script>'));
+  });
+
+  it('returns 401 UNAUTHENTICATED', async () => {
+    const handler = createSendHandler({
+      tenantResolver: fakeResolver(false),
+      templateStore: fakeStore(COMPILED),
+      emailProvider: fakeProvider(),
+      fromAddress: () => 'noreply@example.com',
+    });
+    const response = await handler(fakeRequest({ json: {} }), fakeContext());
+    assert.equal(response.status, 401);
+    assert.equal((response.jsonBody as { code: string }).code, PostKitErrorCode.UNAUTHENTICATED);
+    assert.equal(typeof (response.jsonBody as { correlationId: string }).correlationId, 'string');
+  });
+
+  it('returns 403 UNAUTHORIZED', async () => {
+    const handler = createSendHandler({
+      tenantResolver: {
+        resolve: async () => {
+          throw new TenantResolverError('unknown', PostKitErrorCode.UNAUTHORIZED);
+        },
+      },
+      templateStore: fakeStore(COMPILED),
+      emailProvider: fakeProvider(),
+      fromAddress: () => 'noreply@example.com',
+    });
+    const response = await handler(fakeRequest({ json: validBody() }), fakeContext());
+    assert.equal(response.status, 403);
+    assert.equal((response.jsonBody as { code: string }).code, PostKitErrorCode.UNAUTHORIZED);
+  });
+
+  it('returns 404 TEMPLATE_NOT_FOUND', async () => {
+    const handler = createSendHandler({
+      tenantResolver: fakeResolver(),
+      templateStore: fakeStore(
+        new TemplateStoreError('missing', PostKitErrorCode.TEMPLATE_NOT_FOUND),
+      ),
+      emailProvider: fakeProvider(),
+      fromAddress: () => 'noreply@example.com',
+    });
+    const response = await handler(fakeRequest({ json: validBody() }), fakeContext());
+    assert.equal(response.status, 404);
+    assert.equal((response.jsonBody as { code: string }).code, PostKitErrorCode.TEMPLATE_NOT_FOUND);
+  });
+
+  it('returns 400 INVALID_TEMPLATE from store', async () => {
+    const handler = createSendHandler({
+      tenantResolver: fakeResolver(),
+      templateStore: fakeStore(new TemplateStoreError('bad', PostKitErrorCode.INVALID_TEMPLATE)),
+      emailProvider: fakeProvider(),
+      fromAddress: () => 'noreply@example.com',
+    });
+    const response = await handler(fakeRequest({ json: validBody() }), fakeContext());
+    assert.equal(response.status, 400);
+    assert.equal((response.jsonBody as { code: string }).code, PostKitErrorCode.INVALID_TEMPLATE);
+  });
+
+  it('returns 400 MISSING_VARIABLES', async () => {
+    const handler = createSendHandler({
+      tenantResolver: fakeResolver(),
+      templateStore: fakeStore(COMPILED),
+      emailProvider: fakeProvider(),
+      fromAddress: () => 'noreply@example.com',
+    });
+    const response = await handler(
+      fakeRequest({
+        json: { template: 'marketing.contact-us', to: 'user@example.com', variables: {} },
+      }),
+      fakeContext(),
+    );
+    assert.equal(response.status, 400);
+    assert.equal((response.jsonBody as { code: string }).code, PostKitErrorCode.MISSING_VARIABLES);
+  });
+
+  it('returns 400 INVALID_RECIPIENT', async () => {
+    const handler = createSendHandler({
+      tenantResolver: fakeResolver(),
+      templateStore: fakeStore(COMPILED),
+      emailProvider: fakeProvider(),
+      fromAddress: () => 'noreply@example.com',
+    });
+    const response = await handler(
+      fakeRequest({
+        json: { template: 'marketing.contact-us', to: 'not-an-email', variables: { name: 'Ada' } },
+      }),
+      fakeContext(),
+    );
+    assert.equal(response.status, 400);
+    assert.equal((response.jsonBody as { code: string }).code, PostKitErrorCode.INVALID_RECIPIENT);
+  });
+
+  it('returns PROVIDER_FAILURE when the provider throws', async () => {
+    const { EmailProviderError } = await import('@singleton-sd/post-kit-email');
+    const handler = createSendHandler({
+      tenantResolver: fakeResolver(),
+      templateStore: fakeStore(COMPILED),
+      emailProvider: {
+        name: 'development',
+        isConfigured: () => true,
+        send: async () => {
+          throw new EmailProviderError({
+            message: 'boom',
+            kind: 'permanent',
+            provider: 'development',
+          });
+        },
+      },
+      fromAddress: () => 'noreply@example.com',
+    });
+    const response = await handler(fakeRequest({ json: validBody() }), fakeContext());
+    assert.equal(response.status, 502);
+    assert.equal((response.jsonBody as { code: string }).code, PostKitErrorCode.PROVIDER_FAILURE);
+  });
+});
+
+function validBody() {
+  return {
+    template: 'marketing.contact-us',
+    to: 'user@example.com',
+    variables: { name: 'Ada' },
+  };
+}
diff --git a/apps/api/src/functions/send.ts b/apps/api/src/functions/send.ts
new file mode 100644
index 0000000..81a9889
--- /dev/null
+++ b/apps/api/src/functions/send.ts
@@ -0,0 +1,312 @@
+import { app, HttpRequest, HttpResponseInit, InvocationContext } from '@azure/functions';
+import Handlebars from 'handlebars';
+import {
+  createEmailProvider,
+  EmailProviderError,
+  type EmailProvider,
+} from '@singleton-sd/post-kit-email';
+import {
+  PostKitErrorCode,
+  type PostKitErrorResponse,
+  type SendRequest,
+  type SendResponse,
+  type TenantBranding,
+  type TemplateVariables,
+} from '@singleton-sd/post-kit-types';
+import { ensureAppConfiguration } from '../config/app-configuration';
+import { createLogger, resolveCorrelationId, type Logger } from '../telemetry';
+import {
+  ApiKeyTenantResolver,
+  TenantResolverError,
+  type TenantKeyMap,
+  type TenantResolver,
+} from '../tenant';
+import { BlobTemplateStore, TemplateStoreError, type TemplateStore } from '../templates';
+
+const BASIC_EMAIL = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+
+export interface SendHandlerDependencies {
+  tenantResolver: TenantResolver;
+  templateStore: TemplateStore;
+  emailProvider: EmailProvider;
+  branding?: TenantBranding;
+  createLogger?: typeof createLogger;
+  fromAddress?: () => string;
+  fromName?: () => string | undefined;
+}
+
+function parseTenantKeyMap(raw: string | undefined): TenantKeyMap {
+  if (!raw?.trim()) return {};
+  try {
+    return JSON.parse(raw) as TenantKeyMap;
+  } catch {
+    return {};
+  }
+}
+
+export function createDefaultSendDependencies(
+  templateStore: TemplateStore,
+): SendHandlerDependencies {
+  return {
+    tenantResolver: new ApiKeyTenantResolver(parseTenantKeyMap(process.env.TENANT_KEY_MAP)),
+    templateStore,
+    emailProvider: createEmailProvider(process.env),
+    branding: {},
+    fromAddress: () => process.env.EMAIL_FROM_ADDRESS ?? '',
+    fromName: () => process.env.EMAIL_FROM_NAME,
+  };
+}
+
+export function createSendHandler(deps: SendHandlerDependencies) {
+  return async function sendHandler(
+    request: HttpRequest,
+    context: InvocationContext,
+  ): Promise<HttpResponseInit> {
+    const startMs = Date.now();
+    const correlationId = resolveCorrelationId(
+      request.headers.get('x-correlation-id') ?? undefined,
+    );
+    const logger: Logger = (deps.createLogger ?? createLogger)(correlationId);
+
+    logger.info('send.request.received');
+
+    const headers = {
+      'Content-Type': 'application/json',
+      'X-Correlation-Id': correlationId,
+    };
+
+    const errorResponse = (
+      status: number,
+      code: PostKitErrorCode,
+      error: string,
+      outcome: 'failed' | 'validation_error' | 'auth_error' = 'failed',
+      extra?: { tenantId?: string; templateKey?: string },
+    ): HttpResponseInit => {
+      const durationMs = Date.now() - startMs;
+      logger.error('send.request.failed', {
+        outcome,
+        errorCode: code,
+        durationMs,
+        tenantId: extra?.tenantId,
+        templateKey: extra?.templateKey,
+      });
+      const body: PostKitErrorResponse = { error, code, correlationId };
+      return { status, headers, jsonBody: body };
+    };
+
+    try {
+      await ensureAppConfiguration();
+    } catch (error) {
+      context.error('app configuration load failed', {
+        name: error instanceof Error ? error.name : 'Error',
+      });
+      return errorResponse(
+        503,
+        PostKitErrorCode.STORAGE_FAILURE,
+        'Service configuration is temporarily unavailable.',
+      );
+    }
+
+    let tenantId: string | undefined;
+    let templateKey: string | undefined;
+
+    try {
+      const tenant = await deps.tenantResolver.resolve(request);
+      tenantId = tenant.tenantId;
+
+      const body = await request.json().catch(() => null);
+      const parsed = parseSendRequest(body);
+      if (!parsed.ok) {
+        return errorResponse(400, parsed.code, parsed.error, 'validation_error', { tenantId });
+      }
+      const sendRequest = parsed.value;
+      templateKey = sendRequest.template;
+
+      let compiled;
+      try {
+        compiled = await deps.templateStore.load(tenant, sendRequest.template);
+      } catch (err) {
+        if (err instanceof TemplateStoreError) {
+          const status =
+            err.code === PostKitErrorCode.TEMPLATE_NOT_FOUND
+              ? 404
+              : err.code === PostKitErrorCode.INVALID_TEMPLATE
+                ? 400
+                : 500;
+          return errorResponse(status, err.code, err.message, 'failed', {
+            tenantId,
+            templateKey,
+          });
+        }
+        throw err;
+      }
+
+      const missing = compiled.metadata.variables.filter(
+        (name) => !Object.prototype.hasOwnProperty.call(sendRequest.variables, name),
+      );
+      if (missing.length > 0) {
+        return errorResponse(
+          400,
+          PostKitErrorCode.MISSING_VARIABLES,
+          `Missing required variables: ${missing.join(', ')}`,
+          'validation_error',
+          { tenantId, templateKey },
+        );
+      }
+
+      const variables: TemplateVariables = {
+        ...(deps.branding ?? {}),
+        ...sendRequest.variables,
+      };
+
+      const subject = Handlebars.compile(compiled.metadata.subject, { noEscape: false })(variables);
+      const html = Handlebars.compile(compiled.templateHtml, { noEscape: false })(variables);
+
+      const fromAddress = (deps.fromAddress ?? (() => process.env.EMAIL_FROM_ADDRESS ?? ''))();
+      if (!fromAddress) {
+        return errorResponse(
+          503,
+          PostKitErrorCode.PROVIDER_FAILURE,
+          'Email sender is not configured.',
+          'failed',
+          { tenantId, templateKey },
+        );
+      }
+
+      const provider = deps.emailProvider;
+      const result = await provider.send({
+        to: sendRequest.to,
+        from: fromAddress,
+        fromName: (deps.fromName ?? (() => process.env.EMAIL_FROM_NAME))(),
+        subject,
+        html,
+        correlationId,
+      });
+
+      const durationMs = Date.now() - startMs;
+      logger.info('send.request.completed', {
+        outcome: 'sent',
+        durationMs,
+        tenantId,
+        templateKey,
+        providerMessageId: result.providerMessageId,
+      });
+
+      const response: SendResponse = { id: correlationId, status: 'sent' };
+      return { status: 200, headers, jsonBody: response };
+    } catch (error) {
+      if (error instanceof TenantResolverError) {
+        const status =
+          error.code === PostKitErrorCode.UNAUTHENTICATED
+            ? 401
+            : error.code === PostKitErrorCode.UNAUTHORIZED
+              ? 403
+              : 401;
+        return errorResponse(status, error.code, error.message, 'auth_error', {
+          tenantId,
+          templateKey,
+        });
+      }
+
+      if (error instanceof EmailProviderError) {
+        context.error('send provider failed', {
+          kind: error.kind,
+          statusCode: error.statusCode,
+          correlationId,
+        });
+        return errorResponse(
+          error.kind === 'configuration' ||
+            error.kind === 'transient' ||
+            error.kind === 'rate_limit'
+            ? 503
+            : 502,
+          PostKitErrorCode.PROVIDER_FAILURE,
+          'Email provider failed to send the message.',
+          'failed',
+          { tenantId, templateKey },
+        );
+      }
+
+      context.error('send failed', {
+        name: error instanceof Error ? error.name : 'Error',
+        correlationId,
+      });
+      return errorResponse(
+        500,
+        PostKitErrorCode.PROVIDER_FAILURE,
+        'We could not send your message. Please try again shortly.',
+        'failed',
+        { tenantId, templateKey },
+      );
+    }
+  };
+}
+
+function parseSendRequest(
+  body: unknown,
+): { ok: true; value: SendRequest } | { ok: false; code: PostKitErrorCode; error: string } {
+  if (body === null || typeof body !== 'object' || Array.isArray(body)) {
+    return {
+      ok: false,
+      code: PostKitErrorCode.INVALID_RECIPIENT,
+      error: 'Request body must be a JSON object.',
+    };
+  }
+  const obj = body as Record<string, unknown>;
+  if (typeof obj['template'] !== 'string' || !obj['template'].trim()) {
+    return { ok: false, code: PostKitErrorCode.INVALID_TEMPLATE, error: 'template is required.' };
+  }
+  if (typeof obj['to'] !== 'string' || !BASIC_EMAIL.test(obj['to'])) {
+    return {
+      ok: false,
+      code: PostKitErrorCode.INVALID_RECIPIENT,
+      error: 'to must be a valid email address.',
+    };
+  }
+  if (
+    obj['variables'] === null ||
+    typeof obj['variables'] !== 'object' ||
+    Array.isArray(obj['variables'])
+  ) {
+    return {
+      ok: false,
+      code: PostKitErrorCode.MISSING_VARIABLES,
+      error: 'variables must be an object of string values.',
+    };
+  }
+  const variables: Record<string, string> = {};
+  for (const [key, value] of Object.entries(obj['variables'] as Record<string, unknown>)) {
+    if (typeof value !== 'string') {
+      return {
+        ok: false,
+        code: PostKitErrorCode.MISSING_VARIABLES,
+        error: `variables.${key} must be a string.`,
+      };
+    }
+    variables[key] = value;
+  }
+
+  return {
+    ok: true,
+    value: {
+      template: obj['template'],
+      to: obj['to'],
+      variables,
+    },
+  };
+}
+
+const productionHandler = createSendHandler(
+  createDefaultSendDependencies({
+    load: async (tenant, key) => (await BlobTemplateStore.fromEnv()).load(tenant, key),
+  }),
+);
+
+app.http('emailsSend', {
+  methods: ['POST'],
+  authLevel: 'anonymous',
+  route: 'emails/send',
+  handler: productionHandler,
+});
+
+export { productionHandler as sendHandler };
diff --git a/apps/api/src/index.ts b/apps/api/src/index.ts
index afa58ca..0cbda63 100644
--- a/apps/api/src/index.ts
+++ b/apps/api/src/index.ts
@@ -1,2 +1,3 @@
 import './functions/contact';
 import './functions/health';
+import './functions/send';
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index a589f4c..ef2f311 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -59,6 +59,9 @@ importers:
       '@singleton-sd/post-kit-types':
         specifier: workspace:^
         version: link:../../packages/post-kit-types
+      handlebars:
+        specifier: ^4.7.8
+        version: 4.7.9
     devDependencies:
       '@types/node':
         specifier: ^22.10.2

From bb3367f6dbe3d892b767cd904dccd5e83413ba68 Mon Sep 17 00:00:00 2001
From: Pato Perpetua <patoperpetua@gmail.com>
Date: Tue, 25 Aug 2026 09:13:17 +1000
Subject: [PATCH 2/2] fix(api): harden send handler auth, branding, and
 template keys

Create the email provider after App Configuration, merge branding before variable validation, and reject unsafe template keys before TemplateStore load.

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 apps/api/src/functions/send.spec.ts | 60 +++++++++++++++++++++++++++++
 apps/api/src/functions/send.ts      | 57 +++++++++++++++++++++------
 2 files changed, 106 insertions(+), 11 deletions(-)

diff --git a/apps/api/src/functions/send.spec.ts b/apps/api/src/functions/send.spec.ts
index 36ad799..7788d29 100644
--- a/apps/api/src/functions/send.spec.ts
+++ b/apps/api/src/functions/send.spec.ts
@@ -223,6 +223,66 @@ describe('sendHandler', () => {
     assert.equal((response.jsonBody as { code: string }).code, PostKitErrorCode.INVALID_RECIPIENT);
   });
 
+  it('rejects unsafe template keys before loading the store', async () => {
+    let loaded = false;
+    const handler = createSendHandler({
+      tenantResolver: fakeResolver(),
+      templateStore: {
+        load: async () => {
+          loaded = true;
+          return COMPILED;
+        },
+      },
+      emailProvider: fakeProvider(),
+      fromAddress: () => 'noreply@example.com',
+    });
+    const response = await handler(
+      fakeRequest({
+        json: { template: '../etc/passwd', to: 'user@example.com', variables: { name: 'Ada' } },
+      }),
+      fakeContext(),
+    );
+    assert.equal(response.status, 400);
+    assert.equal((response.jsonBody as { code: string }).code, PostKitErrorCode.INVALID_TEMPLATE);
+    assert.equal(loaded, false);
+  });
+
+  it('allows branding defaults to satisfy required variables', async () => {
+    const sent: EmailSendRequest[] = [];
+    const withBrandingVar: CompiledTemplate = {
+      ...COMPILED,
+      templateHtml: '<p>{{companyName}}</p>',
+      metadata: {
+        ...COMPILED.metadata,
+        subject: 'From {{companyName}}',
+        variables: ['companyName'],
+      },
+      manifest: { ...COMPILED.manifest, variables: ['companyName'] },
+    };
+    const handler = createSendHandler({
+      tenantResolver: fakeResolver(),
+      templateStore: fakeStore(withBrandingVar),
+      emailProvider: fakeProvider(sent),
+      resolveBranding: async () => ({ companyName: 'InkAds' }),
+      fromAddress: () => 'noreply@example.com',
+    });
+
+    const response = await handler(
+      fakeRequest({
+        json: {
+          template: 'marketing.contact-us',
+          to: 'user@example.com',
+          variables: {},
+        },
+      }),
+      fakeContext(),
+    );
+
+    assert.equal(response.status, 200);
+    assert.equal(sent[0]?.subject, 'From InkAds');
+    assert.equal(sent[0]?.html, '<p>InkAds</p>');
+  });
+
   it('returns PROVIDER_FAILURE when the provider throws', async () => {
     const { EmailProviderError } = await import('@singleton-sd/post-kit-email');
     const handler = createSendHandler({
diff --git a/apps/api/src/functions/send.ts b/apps/api/src/functions/send.ts
index 81a9889..df883bf 100644
--- a/apps/api/src/functions/send.ts
+++ b/apps/api/src/functions/send.ts
@@ -11,6 +11,7 @@ import {
   type SendRequest,
   type SendResponse,
   type TenantBranding,
+  type TenantContext,
   type TemplateVariables,
 } from '@singleton-sd/post-kit-types';
 import { ensureAppConfiguration } from '../config/app-configuration';
@@ -24,11 +25,22 @@ import {
 import { BlobTemplateStore, TemplateStoreError, type TemplateStore } from '../templates';
 
 const BASIC_EMAIL = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+/** Same allowlist as BlobTemplateStore — reject path traversal before load. */
+const SAFE_TEMPLATE_KEY = /^[a-zA-Z0-9._-]+$/;
 
 export interface SendHandlerDependencies {
   tenantResolver: TenantResolver;
   templateStore: TemplateStore;
-  emailProvider: EmailProvider;
+  /** Prefer injecting a factory so App Configuration can populate env first. */
+  createEmailProvider?: () => EmailProvider;
+  /** Direct provider injection for unit tests. */
+  emailProvider?: EmailProvider;
+  /**
+   * Resolve tenant branding defaults after auth. Merged before required-variable
+   * validation so branding can satisfy template variables.
+   */
+  resolveBranding?: (tenant: TenantContext) => Promise<TenantBranding> | TenantBranding;
+  /** Static branding for tests (applied after resolveBranding). */
   branding?: TenantBranding;
   createLogger?: typeof createLogger;
   fromAddress?: () => string;
@@ -48,10 +60,13 @@ export function createDefaultSendDependencies(
   templateStore: TemplateStore,
 ): SendHandlerDependencies {
   return {
-    tenantResolver: new ApiKeyTenantResolver(parseTenantKeyMap(process.env.TENANT_KEY_MAP)),
+    // Re-read env after App Configuration in the handler via factories.
+    get tenantResolver(): TenantResolver {
+      return new ApiKeyTenantResolver(parseTenantKeyMap(process.env.TENANT_KEY_MAP));
+    },
     templateStore,
-    emailProvider: createEmailProvider(process.env),
-    branding: {},
+    createEmailProvider: () => createEmailProvider(process.env),
+    resolveBranding: async () => ({}),
     fromAddress: () => process.env.EMAIL_FROM_ADDRESS ?? '',
     fromName: () => process.env.EMAIL_FROM_NAME,
   };
@@ -141,8 +156,15 @@ export function createSendHandler(deps: SendHandlerDependencies) {
         throw err;
       }
 
+      const resolvedBranding = deps.resolveBranding ? await deps.resolveBranding(tenant) : {};
+      const variables: TemplateVariables = {
+        ...resolvedBranding,
+        ...(deps.branding ?? {}),
+        ...sendRequest.variables,
+      };
+
       const missing = compiled.metadata.variables.filter(
-        (name) => !Object.prototype.hasOwnProperty.call(sendRequest.variables, name),
+        (name) => !Object.prototype.hasOwnProperty.call(variables, name),
       );
       if (missing.length > 0) {
         return errorResponse(
@@ -154,11 +176,6 @@ export function createSendHandler(deps: SendHandlerDependencies) {
         );
       }
 
-      const variables: TemplateVariables = {
-        ...(deps.branding ?? {}),
-        ...sendRequest.variables,
-      };
-
       const subject = Handlebars.compile(compiled.metadata.subject, { noEscape: false })(variables);
       const html = Handlebars.compile(compiled.templateHtml, { noEscape: false })(variables);
 
@@ -173,7 +190,9 @@ export function createSendHandler(deps: SendHandlerDependencies) {
         );
       }
 
-      const provider = deps.emailProvider;
+      const provider =
+        deps.emailProvider ??
+        (deps.createEmailProvider ?? (() => createEmailProvider(process.env)))();
       const result = await provider.send({
         to: sendRequest.to,
         from: fromAddress,
@@ -242,6 +261,15 @@ export function createSendHandler(deps: SendHandlerDependencies) {
   };
 }
 
+function isSafeTemplateKey(templateKey: string): boolean {
+  return (
+    Boolean(templateKey) &&
+    templateKey !== '.' &&
+    templateKey !== '..' &&
+    SAFE_TEMPLATE_KEY.test(templateKey)
+  );
+}
+
 function parseSendRequest(
   body: unknown,
 ): { ok: true; value: SendRequest } | { ok: false; code: PostKitErrorCode; error: string } {
@@ -256,6 +284,13 @@ function parseSendRequest(
   if (typeof obj['template'] !== 'string' || !obj['template'].trim()) {
     return { ok: false, code: PostKitErrorCode.INVALID_TEMPLATE, error: 'template is required.' };
   }
+  if (!isSafeTemplateKey(obj['template'])) {
+    return {
+      ok: false,
+      code: PostKitErrorCode.INVALID_TEMPLATE,
+      error: 'template key contains unsafe path characters.',
+    };
+  }
   if (typeof obj['to'] !== 'string' || !BASIC_EMAIL.test(obj['to'])) {
     return {
       ok: false,