[pumfleet]

Summary

Imports from Resend, SendGrid and Postmark, dashboard only (an environment's Developers → Import page, plus a link in "Get started"). The customer pastes the old provider's API key; coss.com reads the account and brings over what they choose:

• Domains: added to the organization (DNS records to add; Domain Connect where available). Created by the dashboard's start action, since only its IAM policy may create SES identities and tenants.
• Templates: converted from SendGrid Handlebars, Postmark Mustachio (layouts merged) and Resend to the template language. Published only when the conversion is exact; otherwise left as drafts with warnings by line and column. SendGrid templates keep their d-… id as the alias.
• Contacts and lists: custom fields → contact properties, lists/segments → audiences, unsubscribe groups/topics → topics, with each contact's topic choices.
• Suppressions: keep the provider's reason and date. Unsubscribe-group members become topic opt-outs, or category-scoped suppressions when they aren't contacts.
• Webhook endpoints: events mapped to coss.com's; created disabled with new signing secrets.

How it works

• New package @coss/migrate:
  • Provider sources: fixed hosts, throttled below providers' shared limits, retries honoring Retry-After; SendGrid's contact exports are downloaded through a public-address-pinned, size-capped fetch.
  • Template converters.
  • The worker's new migrations loop: leased, resumable phases.
• Every unit of work is checkpointed with its cursor and counts, fenced on the lease. This makes cancels stop the import, retries never duplicate or double-count, and what already exists is left alone.
• A report lists what was imported, what needs review (drafts, variable renames, disabled endpoints) and the next steps.

Supporting changes

• importSuppressions takes a reason and date per entry, importContacts per-entry topic choices (opt-ins never undo an opt-out), and createWebhookEndpoint an enabled: false. API and CSV imports are unchanged.
• Tables migration / migration_item (migration 0087).
• The provider key is encrypted with WEBHOOK_SECRETS_KEY and covered by reencryptWebhookSecrets. It is deleted when the import finishes or is canceled; unstarted imports are purged after a day and reports after 90 days (new retention rule).
• Sentry scrubbing masks Resend/SendGrid keys and Postmark token headers.
• dashboard.migration_connections limits key checks per organization (20/day), so coss.com can't be used to test stolen keys.
• Docs at /docs/migrate, with a page per provider.

No new env vars or infra; the migrations loop runs in the existing worker.

Testing

• bun run lint && bun run typecheck && bun run test && bun run build green.
• @coss/migrate's 83 tests:
  • the runner against a fake provider: full import, resuming in short steps, re-runs finding what exists, cancel mid-step, failed steps resuming without double counts, interrupted template publication, plan limits, topic caps, revoked keys, rate limits, held organizations, purges;
  • each source against recorded API responses;
  • the template converters.
• Email/webhooks tests cover the import extensions, re-encryption of the stored keys and the scrubbing patterns.
• In the dashboard (browser): connect, inventory, start (with domains), progress and the report, at desktop and phone width. A run against SendGrid's real API with an invalid key failed cleanly and deleted the key.
• Not yet verified against real provider accounts: SendGrid export file format and columns, SendGrid event-webhook field names, Resend triple-brace escaping, Postmark's suggested template model. Worth a run per provider before announcing.

Review

Codex reviewed the branch in 19 rounds; rounds 16, 17 (after rebasing on main) and 19 were clean.

Round	Fixed
1	Writes fenced against cancel or lease loss (fenced per-unit checkpoints); throttle race; double counts on retries
2	Domain creation retried before queueing; Postmark domains paged; page loops stop at the step deadline
3	An inline Handlebars default with bare uses keeps the template a draft
4	Interrupted template publication resumed; counts recovered on replay; SendGrid suppressions without unsubscribe-group access
6	Resend topic choices paged; domain creation stops on cancel
7	Plan limit on the property-free retry stops only the contacts phase
8	Postmark templates with sections stay drafts when its validation fails
9	An incomplete contact count of 0 doesn't disable contacts
10	Inventory isolates unreadable kinds (all providers)
11	Existing fields, topics and lists found at the environment's caps
12	~ whitespace control keeps the template a draft
13	Webhook URLs normalized before dedupe
14	Resend segment members read from /segments/{id}/contacts (raised in round 5, re-raised with Resend's SDK as evidence)
15	Webhooks sharing a URL merged into one endpoint
CI	The spacing test failed on a loaded runner: requests now take turns, spaced from the previous one's actual start
18	A retried item no longer reserves a name it never stores

Rejected:

Round	Finding	Why
5	Resend /contacts has no segment_id filter	Rejected at first, because Resend's List Contacts reference documents the filter (the user agreed). Codex brought new evidence in round 14 (the official SDK uses /segments/{id}/contacts), so it was then fixed.
8	Postmark GET /webhooks returns only the outbound stream's	Postmark's reference for List webhooks: "If no stream is provided, will return all webhooks for the server." The outbound default is only for creating one.

🤖 Generated with Claude Code

[linear-code]

ENG-6500