Migrate from Hook0

import { Event, Hook0Client } from "hook0-client";

const hook0 = new Hook0Client("https://app.hook0.com/api/v1", process.env.HOOK0_APPLICATION_ID!, process.env.HOOK0_TOKEN!);

await hook0.sendEvent(
  new Event(
    "billing.invoice.paid",
    JSON.stringify({ invoice_id: "inv_123", amount: 4900 }),
    "application/json",
    { tenant_id: "customer_42" },
  ),
);

import { WebhookRelay } from "@webhookrelay/sdk";

const relay = new WebhookRelay(); // reads RELAY_KEY and RELAY_SECRET

await relay.outbound.messages.publish(
  { consumer: "customer_42", eventType: "billing.invoice.paid", payload: { invoice_id: "inv_123", amount: 4900 } },
  { idempotencyKey: "invoice-paid:inv_123" },
);

// Before
body, _ := json.Marshal(map[string]any{
    "application_id":       os.Getenv("HOOK0_APPLICATION_ID"),
    "event_type":           "billing.invoice.paid",
    "labels":               map[string]string{"tenant_id": "customer_42"},
    "occurred_at":          time.Now().UTC().Format(time.RFC3339),
    "payload":              `{"invoice_id":"inv_123","amount":4900}`,
    "payload_content_type": "application/json",
})
req, _ := http.NewRequest(http.MethodPost, "https://app.hook0.com/api/v1/event/", bytes.NewReader(body))
req.Header.Set("Authorization", "Bearer "+os.Getenv("HOOK0_TOKEN"))
req.Header.Set("Content-Type", "application/json")
_, err := http.DefaultClient.Do(req)

// After
_, err = api.PublishOutboundMessage(&webhookrelay.OutboundMessagePublishOptions{
    Consumer:       "customer_42",
    EventType:      "billing.invoice.paid",
    Payload:        map[string]interface{}{"invoice_id": "inv_123", "amount": 4900},
    IdempotencyKey: "invoice-paid:inv_123",
})

# Before
curl -X POST https://app.hook0.com/api/v1/event/ \
  -H "Authorization: Bearer $HOOK0_TOKEN" -H 'Content-Type: application/json' \
  -d "{\"application_id\":\"$HOOK0_APPLICATION_ID\",\"event_type\":\"billing.invoice.paid\",\"labels\":{\"tenant_id\":\"customer_42\"},\"occurred_at\":\"2026-10-11T09:00:00Z\",\"payload\":\"{\\\"invoice_id\\\":\\\"inv_123\\\"}\",\"payload_content_type\":\"application/json\"}"

# After
curl --user "$RELAY_KEY:$RELAY_SECRET" -X POST https://my.webhookrelay.com/v1/outbound/messages \
  -H 'Content-Type: application/json' -H 'Idempotency-Key: invoice-paid:inv_123' \
  -d '{"consumer":"customer_42","event_type":"billing.invoice.paid","payload":{"invoice_id":"inv_123","amount":4900}}'

await relay.outbound.consumers.upsert("customer_42", { name: "Acme" });
const endpoint = await relay.outbound.endpoints.create("customer_42", {
  url: "https://acme.example/webhooks",
  eventTypes: ["billing.invoice.paid"],
  autoDisable: true,
});
// endpoint.secret is the customer's new whsec_ secret. Store it like a password.

import { verifyWebhookSignature } from "hook0-client";
import { verifyWebhook } from "./verify-webhook.js"; // Standard Webhooks check from the receiving guide

export function verify(rawBody, headers) {
  if (headers["webhook-signature"]) {
    return verifyWebhook(rawBody, headers, process.env.WEBHOOK_SECRET_RELAY);
  }
  if (headers["x-hook0-signature"]) {
    try {
      // The receiver's existing Hook0 check; it throws on an invalid signature.
      return verifyWebhookSignature(headers["x-hook0-signature"], rawBody, new Headers(headers), process.env.WEBHOOK_SECRET_HOOK0, 300);
    } catch {
      return false;
    }
  }
  return false;
}

// migrate-hook0.mts
// Env: HOOK0_API_URL (default https://app.hook0.com/api/v1), HOOK0_TOKEN, HOOK0_APPLICATION_ID,
//      HOOK0_CONSUMER_LABEL (e.g. tenant_id), RELAY_KEY, RELAY_SECRET ("Outbound: manage"), DRY_RUN=false to write.
import { existsSync, readFileSync, writeFileSync } from "node:fs";
import { WebhookRelay, WebhookRelayAPIError } from "@webhookrelay/sdk";

const HOOK0_API = process.env.HOOK0_API_URL ?? "https://app.hook0.com/api/v1";
const APP = process.env.HOOK0_APPLICATION_ID!;
const LABEL = process.env.HOOK0_CONSUMER_LABEL!;
const DRY_RUN = process.env.DRY_RUN !== "false";
const STATE_FILE = "migration-state.json"; // source subscription ID -> Webhook Relay endpoint ID. Never secrets.
const ID = /^[a-zA-Z0-9][a-zA-Z0-9_.:-]{0,127}$/;
const RESERVED = /^(webhook-|host$|content-length$|transfer-encoding$|connection$)/i;

const relay = new WebhookRelay();

type PlanEndpoint = {
  sourceId: string; url: string; eventTypes: string[]; description?: string;
  headers?: Record<string, string>; rate?: number; disabledAtSource?: boolean;
};
type Plan = {
  eventTypes: { name: string; description?: string; deprecated?: boolean }[];
  consumers: { id: string; name?: string; endpoints: PlanEndpoint[] }[];
  warnings: string[];
};

// ---- 1. Export from Hook0 (read-only) ----
async function hook0<T>(path: string): Promise<T> {
  const res = await fetch(`${HOOK0_API}${path}?application_id=${APP}`, {
    headers: { Authorization: `Bearer ${process.env.HOOK0_TOKEN}` },
  });
  if (!res.ok) throw new Error(`Hook0 GET ${path}: ${res.status} ${await res.text()}`);
  return res.json() as Promise<T>;
}

async function exportPlan(): Promise<Plan> {
  const plan: Plan = { eventTypes: [], consumers: [], warnings: [] };
  plan.eventTypes = (await hook0<any[]>("/event_types/")).map((et) => ({ name: et.event_type_name }));
  const consumers = new Map<string, Plan["consumers"][number]>();
  for (const sub of await hook0<any[]>("/subscriptions/")) {
    // sub.secret is deliberately ignored: Hook0 secrets are UUIDs, which don't fit the
    // Standard Webhooks secret format, so Webhook Relay generates a new whsec_ secret.
    const labels: Record<string, string> = sub.labels ?? (sub.label_key ? { [sub.label_key]: sub.label_value } : {});
    const consumerId = labels[LABEL];
    if (!consumerId) {
      plan.warnings.push(`subscription ${sub.subscription_id} (${sub.target?.url}) has no "${LABEL}" label; skipped`);
      continue;
    }
    if (Object.keys(labels).length > 1) plan.warnings.push(`${consumerId} ${sub.target.url}: extra labels ${JSON.stringify(labels)} are not carried over`);
    if (sub.target.type !== "http") { plan.warnings.push(`${consumerId}: target type ${sub.target.type} skipped`); continue; }
    if (sub.target.method && sub.target.method.toUpperCase() !== "POST")
      plan.warnings.push(`${consumerId} ${sub.target.url}: uses ${sub.target.method}; deliveries will be POST`);
    const headers = Object.fromEntries(Object.entries(sub.target.headers ?? {}).filter(([k]) => !RESERVED.test(k))) as Record<string, string>;
    const consumer = consumers.get(consumerId) ?? { id: consumerId, endpoints: [] as PlanEndpoint[] };
    consumer.endpoints.push({
      sourceId: sub.subscription_id, url: sub.target.url,
      eventTypes: sub.event_types?.length ? sub.event_types : ["*"],
      description: sub.description || undefined, headers, disabledAtSource: !sub.is_enabled,
    });
    consumers.set(consumerId, consumer);
  }
  plan.consumers = [...consumers.values()];
  return plan;
}

// ---- 2. Check access and limits before writing anything ----
async function checkPlan(plan: Plan) {
  const auth = Buffer.from(`${process.env.RELAY_KEY}:${process.env.RELAY_SECRET}`).toString("base64");
  const res = await fetch("https://my.webhookrelay.com/v1/outbound/access", { headers: { Authorization: `Basic ${auth}` } });
  const access = await res.json();
  if (!access.enabled) throw new Error("The Outbound Gateway needs a Basic, Business or Pro plan: upgrade at https://my.webhookrelay.com/account.");
  const limits = access.limits as { consumers: number; endpoints_per_consumer: number; event_types: number };

  const haveConsumers = new Set((await relay.outbound.consumers.list()).map((c) => c.id));
  const haveTypes = new Set((await relay.outbound.eventTypes.list()).map((e) => e.name));
  const consumers = new Set([...haveConsumers, ...plan.consumers.map((c) => c.id)]).size;
  const types = new Set([...haveTypes, ...plan.eventTypes.map((e) => e.name)]).size;

  const problems: string[] = [];
  if (consumers > limits.consumers) problems.push(`${consumers} consumers exceed the limit of ${limits.consumers}`);
  if (types > limits.event_types) problems.push(`${types} event types exceed the limit of ${limits.event_types}`);
  for (const et of plan.eventTypes) if (!ID.test(et.name)) problems.push(`event type "${et.name}" is not a valid name`);
  for (const c of plan.consumers) {
    if (!ID.test(c.id)) problems.push(`consumer "${c.id}" is not a valid ID: map it to your own customer ID`);
    if (c.endpoints.length > limits.endpoints_per_consumer)
      problems.push(`${c.id} has ${c.endpoints.length} endpoints, the limit is ${limits.endpoints_per_consumer}`);
    for (const e of c.endpoints) {
      if (!e.url.startsWith("https://")) problems.push(`${c.id} ${e.url}: endpoints must be public HTTPS`);
      if (e.eventTypes.length > 100) problems.push(`${c.id} ${e.url}: more than 100 event types`);
    }
  }
  for (const w of plan.warnings) console.warn(`warning: ${w}`);
  if (problems.length) {
    console.error(`Not importing:\n- ${problems.join("\n- ")}`);
    process.exit(1);
  }
}

// ---- 3. Import into Webhook Relay ----
const state: Record<string, string> = existsSync(STATE_FILE) ? JSON.parse(readFileSync(STATE_FILE, "utf8")) : {};

async function step<T>(what: string, fn: () => Promise<T>): Promise<T> {
  for (let attempt = 1; ; attempt++) {
    try {
      return await fn();
    } catch (err) {
      if (err instanceof WebhookRelayAPIError && err.status === 429 && attempt < 5) {
        await new Promise((r) => setTimeout(r, attempt * 2000));
        continue;
      }
      console.error(`Stopped at ${what}: ${err instanceof Error ? err.message : String(err)}`);
      console.error(`Progress is saved in ${STATE_FILE}. Fix the cause and run the script again.`);
      process.exit(1);
    }
  }
}

async function importPlan(plan: Plan) {
  for (const et of plan.eventTypes) {
    await step(`event type ${et.name}`, () =>
      relay.outbound.eventTypes.upsert(et.name, { description: et.description, deprecated: et.deprecated }));
  }
  for (const c of plan.consumers) {
    await step(`consumer ${c.id}`, () => relay.outbound.consumers.upsert(c.id, { name: c.name }));
    for (const e of c.endpoints) {
      if (state[e.sourceId]) continue; // imported on an earlier run
      const { id, created } = await step(`endpoint ${c.id} ${e.url}`, async () => {
        try {
          const ep = await relay.outbound.endpoints.create(c.id, {
            url: e.url, eventTypes: e.eventTypes, description: e.description, headers: e.headers, rate: e.rate,
          });
          return { id: ep.id, created: true }; // ep.secret is intentionally not logged or stored
        } catch (err) {
          if (err instanceof WebhookRelayAPIError && err.status === 409) {
            const existing = (await relay.outbound.endpoints.list(c.id)).find((x) => x.url === e.url);
            if (existing) return { id: existing.id, created: false }; // already there: leave its state alone
          }
          throw err;
        }
      });
      if (created) await step(`pause ${id}`, () => relay.outbound.endpoints.pause(id));
      state[e.sourceId] = id;
      writeFileSync(STATE_FILE, JSON.stringify(state, null, 2));
      console.log(`${c.id}: ${e.url} -> ${id} ${created ? "(created, paused)" : "(already existed, unchanged)"}${e.disabledAtSource ? " [disabled at Hook0]" : ""}`);
    }
  }
}

const plan = await exportPlan();
await checkPlan(plan);
const endpoints = plan.consumers.reduce((n, c) => n + c.endpoints.length, 0);
console.log(`Plan: ${plan.eventTypes.length} event types, ${plan.consumers.length} consumers, ${endpoints} endpoints.`);
if (DRY_RUN) console.log("Dry run: nothing was written. Run again with DRY_RUN=false to import.");
else await importPlan(plan);