Migrate from Svix

import { Svix } from "svix";

const svix = new Svix(process.env.SVIX_TOKEN!);

await svix.message.create(
  "customer_42",
  { eventType: "invoice.paid", eventId: "evt_9001", payload: { invoice_id: "inv_123", amount: 4900 } },
  { idempotencyKey: "invoice-paid:inv_123" },
);

import { WebhookRelay } from "@webhookrelay/sdk";

const relay = new WebhookRelay(); // reads RELAY_KEY and RELAY_SECRET

await relay.outbound.messages.publish(
  { consumer: "customer_42", eventType: "invoice.paid", eventId: "evt_9001", payload: { invoice_id: "inv_123", amount: 4900 } },
  { idempotencyKey: "invoice-paid:inv_123" },
);

// Before
_, err := svixClient.Message.Create(ctx, "customer_42", models.MessageIn{
    EventType: "invoice.paid",
    Payload:   map[string]any{"invoice_id": "inv_123", "amount": 4900},
}, nil)

// After
_, err := api.PublishOutboundMessage(&webhookrelay.OutboundMessagePublishOptions{
    Consumer:       "customer_42",
    EventType:      "invoice.paid",
    EventID:        "evt_9001",
    Payload:        map[string]interface{}{"invoice_id": "inv_123", "amount": 4900},
    IdempotencyKey: "invoice-paid:inv_123",
})

# Before
curl -X POST "https://api.us.svix.com/api/v1/app/customer_42/msg" \
  -H "Authorization: Bearer $SVIX_TOKEN" -H 'Content-Type: application/json' \
  -H 'idempotency-key: invoice-paid:inv_123' \
  -d '{"eventType":"invoice.paid","payload":{"invoice_id":"inv_123","amount":4900}}'

# After
curl --user "$RELAY_KEY:$RELAY_SECRET" -X POST https://my.webhookrelay.com/v1/outbound/messages \
  -H 'Content-Type: application/json' -H 'Idempotency-Key: invoice-paid:inv_123' \
  -d '{"consumer":"customer_42","event_type":"invoice.paid","payload":{"invoice_id":"inv_123","amount":4900}}'

// Before
await svix.application.create({ name: "Acme", uid: "customer_42" });
await svix.endpoint.create("customer_42", { url: "https://acme.example/webhooks", eventTypes: ["invoice.paid"] });

// After: import an existing Svix endpoint with its current secret.
await relay.outbound.consumers.upsert("customer_42", { name: "Acme" });
const { key } = await svix.endpoint.getSecret("customer_42", svixEndpointId); // "whsec_…"

const auth = Buffer.from(`${process.env.RELAY_KEY}:${process.env.RELAY_SECRET}`).toString("base64");
const res = await fetch("https://my.webhookrelay.com/v1/outbound/consumers/customer_42/endpoints", {
  method: "POST",
  headers: { Authorization: `Basic ${auth}`, "Content-Type": "application/json" },
  body: JSON.stringify({ url: "https://acme.example/webhooks", event_types: ["invoice.paid"], auto_disable: true, secret: key }),
});
if (!res.ok) throw new Error(`create endpoint: ${res.status}`); // errors never echo the secret
const { id } = await res.json();

// New customers after the migration: let Webhook Relay generate the secret.
const endpoint = await relay.outbound.endpoints.create("customer_43", {
  url: "https://globex.example/webhooks",
  eventTypes: ["invoice.paid"],
  autoDisable: true,
});
// endpoint.secret is the new whsec_ secret. Store it like a password.

import { Webhook } from "svix";

// Old Svix key and new Webhook Relay secret. Only needed for endpoints whose secret couldn't be imported.
const verifiers = [process.env.WEBHOOK_SECRET_RELAY, process.env.WEBHOOK_SECRET_SVIX]
  .filter(Boolean)
  .map((secret) => new Webhook(secret));

export function verify(rawBody, headers) {
  for (const wh of verifiers) {
    try {
      return wh.verify(rawBody, headers); // accepts svix-* or webhook-* headers
    } catch {}
  }
  throw new Error("invalid signature");
}

// migrate-svix.mts
// Env: SVIX_TOKEN, SVIX_API_URL (your region, e.g. https://api.us.svix.com or https://api.eu.svix.com),
//      RELAY_KEY, RELAY_SECRET (token with "Outbound: manage"), DRY_RUN=false to write.
import { existsSync, readFileSync, writeFileSync } from "node:fs";
import { WebhookRelay, WebhookRelayAPIError } from "@webhookrelay/sdk";

const SVIX_API = process.env.SVIX_API_URL ?? "https://api.us.svix.com";
const RELAY_API = "https://my.webhookrelay.com";
const RELAY_AUTH = `Basic ${Buffer.from(`${process.env.RELAY_KEY}:${process.env.RELAY_SECRET}`).toString("base64")}`;
const DRY_RUN = process.env.DRY_RUN !== "false";
const STATE_FILE = "migration-state.json"; // source endpoint ID -> Webhook Relay endpoint ID. Never secrets.
const ID = /^[a-zA-Z0-9][a-zA-Z0-9_.:-]{0,127}$/;
const RESERVED = /^(webhook-|host$|content-length$|transfer-encoding$|connection$)/i;
// Svix's own symmetric secret format, which Webhook Relay accepts as is. Asymmetric whsk_ keys don't match.
const IMPORTABLE = /^(whsec_)?[A-Za-z0-9+/=]{32,100}$/;

const relay = new WebhookRelay();

type PlanEndpoint = {
  sourceId: string; url: string; eventTypes: string[]; description?: string;
  headers?: Record<string, string>; rate?: number; disabledAtSource?: boolean;
  secret?: string; // held in memory only
};
type Plan = {
  eventTypes: { name: string; description?: string; deprecated?: boolean }[];
  consumers: { id: string; name?: string; endpoints: PlanEndpoint[] }[];
  warnings: string[];
};

// ---- 1. Export from Svix (read-only) ----
async function svix<T>(path: string, query: Record<string, string> = {}): Promise<T> {
  const url = new URL(path, SVIX_API);
  for (const [k, v] of Object.entries(query)) url.searchParams.set(k, v);
  const res = await fetch(url, { headers: { Authorization: `Bearer ${process.env.SVIX_TOKEN}` } });
  if (!res.ok) throw new Error(`Svix GET ${path}: ${res.status}`); // no body: the secret route's body is the secret
  return res.json() as Promise<T>;
}

async function* svixList<T>(path: string): AsyncGenerator<T> {
  let iterator: string | undefined;
  for (;;) {
    const page = await svix<{ data: T[]; done: boolean; iterator: string }>(path, {
      limit: "100", ...(iterator ? { iterator } : {}),
    });
    yield* page.data;
    if (page.done) return;
    iterator = page.iterator;
  }
}

async function exportPlan(): Promise<Plan> {
  const plan: Plan = { eventTypes: [], consumers: [], warnings: [] };
  for await (const et of svixList<any>("/api/v1/event-type")) {
    if (!et.archived) plan.eventTypes.push({ name: et.name, description: et.description, deprecated: et.deprecated });
  }
  for await (const app of svixList<any>("/api/v1/app")) {
    const consumer = { id: app.uid ?? app.id, name: app.name, endpoints: [] as PlanEndpoint[] };
    for await (const ep of svixList<any>(`/api/v1/app/${app.id}/endpoint`)) {
      const h = await svix<{ headers: Record<string, string>; sensitive: string[] }>(
        `/api/v1/app/${app.id}/endpoint/${ep.id}/headers`);
      const headers = Object.fromEntries(Object.entries(h.headers).filter(([k]) => !RESERVED.test(k)));
      if (h.sensitive.length) plan.warnings.push(`${consumer.id} ${ep.url}: re-enter redacted headers by hand: ${h.sensitive.join(", ")}`);
      if (ep.channels?.length) plan.warnings.push(`${consumer.id} ${ep.url}: channels ${ep.channels.join(", ")} have no equivalent`);

      const { key } = await svix<{ key: string }>(`/api/v1/app/${app.id}/endpoint/${ep.id}/secret`);
      const secret = IMPORTABLE.test(key) ? key : undefined;
      if (!secret) plan.warnings.push(`${consumer.id} endpoint ${ep.id}: asymmetric key, gets a NEW secret (receiver must accept both)`);

      consumer.endpoints.push({
        sourceId: ep.id, url: ep.url,
        eventTypes: ep.eventTypes?.length ? ep.eventTypes : ["*"],
        description: ep.description || undefined, headers,
        rate: ep.throttleRate ? Math.min(ep.throttleRate, 1000) : undefined,
        disabledAtSource: ep.disabled, secret,
      });
    }
    plan.consumers.push(consumer);
  }
  return plan;
}

// ---- 2. Check access and limits before writing anything ----
async function checkPlan(plan: Plan) {
  const res = await fetch(`${RELAY_API}/v1/outbound/access`, { headers: { Authorization: RELAY_AUTH } });
  const access = await res.json();
  if (!access.enabled) throw new Error("The Outbound Gateway needs a Basic, Business or Pro plan: upgrade at https://my.webhookrelay.com/account");
  const limits = access.limits as { consumers: number; endpoints_per_consumer: number; event_types: number };

  const haveConsumers = new Set((await relay.outbound.consumers.list()).map((c) => c.id));
  const haveTypes = new Set((await relay.outbound.eventTypes.list()).map((e) => e.name));
  const consumers = new Set([...haveConsumers, ...plan.consumers.map((c) => c.id)]).size;
  const types = new Set([...haveTypes, ...plan.eventTypes.map((e) => e.name)]).size;

  const problems: string[] = [];
  if (consumers > limits.consumers) problems.push(`${consumers} consumers exceed the limit of ${limits.consumers}`);
  if (types > limits.event_types) problems.push(`${types} event types exceed the limit of ${limits.event_types}`);
  for (const et of plan.eventTypes) if (!ID.test(et.name)) problems.push(`event type "${et.name}" is not a valid name`);
  for (const c of plan.consumers) {
    if (!ID.test(c.id)) problems.push(`consumer "${c.id}" is not a valid ID: map it to your own customer ID`);
    if (c.endpoints.length > limits.endpoints_per_consumer)
      problems.push(`${c.id} has ${c.endpoints.length} endpoints, the limit is ${limits.endpoints_per_consumer}`);
    for (const e of c.endpoints) {
      if (!e.url.startsWith("https://")) problems.push(`${c.id} ${e.url}: endpoints must be public HTTPS`);
      if (e.eventTypes.length > 100) problems.push(`${c.id} ${e.url}: more than 100 event types`);
    }
  }
  for (const w of plan.warnings) console.warn(`warning: ${w}`);
  if (problems.length) {
    console.error(`Not importing:\n- ${problems.join("\n- ")}`);
    process.exit(1);
  }
}

// ---- 3. Import into Webhook Relay ----
const state: Record<string, string> = existsSync(STATE_FILE) ? JSON.parse(readFileSync(STATE_FILE, "utf8")) : {};

class RelayError extends Error {
  constructor(readonly status: number, message: string) { super(message); }
}

// REST create, because the SDKs expose `secret` only from their next release. Errors never echo the secret.
async function createEndpoint(consumer: string, e: PlanEndpoint): Promise<string> {
  const res = await fetch(`${RELAY_API}/v1/outbound/consumers/${encodeURIComponent(consumer)}/endpoints`, {
    method: "POST",
    headers: { Authorization: RELAY_AUTH, "Content-Type": "application/json" },
    body: JSON.stringify({
      url: e.url, event_types: e.eventTypes, description: e.description, headers: e.headers, rate: e.rate,
      ...(e.secret ? { secret: e.secret } : {}),
    }),
  });
  if (!res.ok) throw new RelayError(res.status, `create endpoint: ${res.status} ${await res.text()}`);
  const { id } = (await res.json()) as { id: string }; // the response also carries the secret: don't log or store it
  return id;
}

async function step<T>(what: string, fn: () => Promise<T>): Promise<T> {
  for (let attempt = 1; ; attempt++) {
    try {
      return await fn();
    } catch (err) {
      const status = err instanceof WebhookRelayAPIError || err instanceof RelayError ? err.status : 0;
      if (status === 429 && attempt < 5) {
        await new Promise((r) => setTimeout(r, attempt * 2000));
        continue;
      }
      console.error(`Stopped at ${what}: ${err instanceof Error ? err.message : String(err)}`);
      console.error(`Progress is saved in ${STATE_FILE}. Fix the cause and run the script again.`);
      process.exit(1);
    }
  }
}

async function importPlan(plan: Plan) {
  for (const et of plan.eventTypes) {
    await step(`event type ${et.name}`, () =>
      relay.outbound.eventTypes.upsert(et.name, { description: et.description, deprecated: et.deprecated }));
  }
  for (const c of plan.consumers) {
    await step(`consumer ${c.id}`, () => relay.outbound.consumers.upsert(c.id, { name: c.name }));
    for (const e of c.endpoints) {
      if (state[e.sourceId]) continue; // imported on an earlier run
      const { id, created } = await step(`endpoint ${c.id} ${e.url}`, async () => {
        try {
          return { id: await createEndpoint(c.id, e), created: true };
        } catch (err) {
          if (err instanceof RelayError && err.status === 409) {
            const existing = (await relay.outbound.endpoints.list(c.id)).find((x) => x.url === e.url);
            if (existing) return { id: existing.id, created: false }; // already there: leave its state alone
          }
          throw err;
        }
      });
      if (created) await step(`pause ${id}`, () => relay.outbound.endpoints.pause(id));
      state[e.sourceId] = id;
      writeFileSync(STATE_FILE, JSON.stringify(state, null, 2));
      const secretNote = !created ? "" : e.secret ? " secret imported" : " NEW secret";
      console.log(`${c.id}: ${e.url} -> ${id} ${created ? "(created, paused)" : "(already existed, unchanged)"}${secretNote}${e.disabledAtSource ? " [disabled at Svix]" : ""}`);
    }
  }
}

const plan = await exportPlan();
await checkPlan(plan);
const endpoints = plan.consumers.flatMap((c) => c.endpoints);
const imported = endpoints.filter((e) => e.secret).length;
console.log(`Plan: ${plan.eventTypes.length} event types, ${plan.consumers.length} consumers, ${endpoints.length} endpoints (${imported} with imported secrets).`);
if (DRY_RUN) console.log("Dry run: nothing was written. Run again with DRY_RUN=false to import.");
else await importPlan(plan);