scrapely 1.2.3 → 1.2.4

package/dist/charging_client.d.ts

@@ -0,0 +1,18 @@
+import type { ApifyClientOptions, PpeAwarePushDataContext } from 'scrapely-client';
+import { ApifyClient, USES_PUSH_DATA_INTERCEPTION, pushDataChargingContext } from 'scrapely-client';
+import { type ChargingManager } from './charging.js';
+import type { Configuration } from './configuration.js';
+export { USES_PUSH_DATA_INTERCEPTION, pushDataChargingContext };
+export type { PpeAwarePushDataContext };
+/**
+ * Returns a `scrapely-client` `ApifyClient` configured with the SDK's charging
+ * hooks, so pushes to the run's default dataset are intercepted and charged
+ * pay-per-event by the client itself (no subclassing).
+ *
+ * `defaultDatasetId` is captured from the configuration at construction time;
+ * the pricing check happens lazily on every `dataset()` call.
+ */
+export declare function createChargingClient(options: ApifyClientOptions, actor: {
+    config: Configuration;
+    getChargingManager: () => ChargingManager;
+}): ApifyClient;

package/dist/charging_client.js

@@ -0,0 +1,49 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.pushDataChargingContext = exports.USES_PUSH_DATA_INTERCEPTION = void 0;
+exports.createChargingClient = createChargingClient;
+const scrapely_client_1 = require("scrapely-client");
+Object.defineProperty(exports, "USES_PUSH_DATA_INTERCEPTION", { enumerable: true, get: function () { return scrapely_client_1.USES_PUSH_DATA_INTERCEPTION; } });
+Object.defineProperty(exports, "pushDataChargingContext", { enumerable: true, get: function () { return scrapely_client_1.pushDataChargingContext; } });
+const charging_js_1 = require("./charging.js");
+/**
+ * Adapts the SDK's {@link ChargingManager} to `scrapely-client`'s
+ * {@link ChargingHooks} protocol. The client only routes `pushItems()`
+ * through these hooks for the run's default dataset; all pricing/budget/ledger
+ * decisions stay in the SDK.
+ */
+function createChargingHooks(actor) {
+    return {
+        // Called by the client at `dataset()` time, so pricing is consulted
+        // lazily — same timing as the former subclass override.
+        shouldChargeDatasetPushes() {
+            return (0, charging_js_1.hasDefaultDatasetItemEventInPricing)(actor.getChargingManager().getPricingInfo().perEventPrices);
+        },
+        async pushAndCharge({ items, eventName, pushFn }) {
+            return (0, charging_js_1.pushDataAndCharge)({
+                chargingManager: actor.getChargingManager(),
+                items,
+                eventName,
+                // The client only intercepts the default dataset.
+                isDefaultDataset: true,
+                pushFn: async (limitedItems) => pushFn(limitedItems),
+            });
+        },
+        mergeChargeResults: charging_js_1.mergeChargeResults,
+    };
+}
+/**
+ * Returns a `scrapely-client` `ApifyClient` configured with the SDK's charging
+ * hooks, so pushes to the run's default dataset are intercepted and charged
+ * pay-per-event by the client itself (no subclassing).
+ *
+ * `defaultDatasetId` is captured from the configuration at construction time;
+ * the pricing check happens lazily on every `dataset()` call.
+ */
+function createChargingClient(options, actor) {
+    return new scrapely_client_1.ApifyClient({
+        ...options,
+        defaultDatasetId: actor.config.get('defaultDatasetId'),
+        charging: createChargingHooks(actor),
+    });
+}

package/dist/configuration.d.ts

@@ -0,0 +1,121 @@
+import type { ConfigurationOptions as CoreConfigurationOptions } from '@crawlee/core';
+import { Configuration as CoreConfiguration } from '@crawlee/core';
+export interface ConfigurationOptions extends CoreConfigurationOptions {
+    metamorphAfterSleepMillis?: number;
+    actorEventsWsUrl?: string;
+    token?: string;
+    actorId?: string;
+    actorRunId?: string;
+    actorTaskId?: string;
+    apiBaseUrl?: string;
+    apiPublicBaseUrl?: string;
+    containerPort?: number;
+    containerUrl?: string;
+    proxyHostname?: string;
+    proxyPassword?: string;
+    proxyPort?: number;
+    proxyStatusUrl?: string;
+    /** @deprecated use `containerPort` instead */
+    standbyPort?: number;
+    standbyUrl?: string;
+    isAtHome?: boolean;
+    userId?: string;
+    inputSecretsPrivateKeyPassphrase?: string;
+    inputSecretsPrivateKeyFile?: string;
+    maxTotalChargeUsd?: number;
+    metaOrigin?: string;
+    testPayPerEvent?: boolean;
+    useChargingLogDataset?: boolean;
+    actorPricingInfo?: string;
+    chargedEventCounts?: string;
+    actorStoragesJson?: string;
+    actorPermissionLevel?: string;
+    userIsPaying?: boolean;
+}
+export declare class Configuration extends CoreConfiguration {
+    static globalConfig?: Configuration;
+    protected static ENV_MAP: {
+        APIFY_AVAILABLE_MEMORY_RATIO: string;
+        APIFY_PURGE_ON_START: string;
+        APIFY_MEMORY_MBYTES: string;
+        APIFY_DEFAULT_DATASET_ID: string;
+        APIFY_DEFAULT_KEY_VALUE_STORE_ID: string;
+        APIFY_DEFAULT_REQUEST_QUEUE_ID: string;
+        APIFY_INPUT_KEY: string;
+        APIFY_PERSIST_STATE_INTERVAL_MILLIS: string;
+        APIFY_HEADLESS: string;
+        APIFY_XVFB: string;
+        APIFY_CHROME_EXECUTABLE_PATH: string;
+        APIFY_DEFAULT_BROWSER_PATH: string;
+        APIFY_DISABLE_BROWSER_SANDBOX: string;
+        APIFY_TOKEN: string;
+        APIFY_METAMORPH_AFTER_SLEEP_MILLIS: string;
+        APIFY_TEST_PERSIST_INTERVAL_MILLIS: string;
+        APIFY_ACTOR_EVENTS_WS_URL: string;
+        APIFY_ACTOR_ID: string;
+        APIFY_API_BASE_URL: string;
+        APIFY_API_PUBLIC_BASE_URL: string;
+        APIFY_IS_AT_HOME: string;
+        APIFY_ACTOR_RUN_ID: string;
+        APIFY_ACTOR_TASK_ID: string;
+        APIFY_CONTAINER_PORT: string;
+        APIFY_CONTAINER_URL: string;
+        APIFY_USER_ID: string;
+        APIFY_USER_IS_PAYING: string;
+        APIFY_PROXY_HOSTNAME: string;
+        APIFY_PROXY_PASSWORD: string;
+        APIFY_PROXY_STATUS_URL: string;
+        APIFY_PROXY_PORT: string;
+        APIFY_INPUT_SECRETS_PRIVATE_KEY_FILE: string;
+        APIFY_INPUT_SECRETS_PRIVATE_KEY_PASSPHRASE: string;
+        APIFY_META_ORIGIN: string;
+        SCRAPELY_TOKEN: string;
+        SCRAPELY_API_URL: string;
+        SCRAPELY_IS_AT_HOME: string;
+        ACTOR_DEFAULT_DATASET_ID: string;
+        ACTOR_DEFAULT_KEY_VALUE_STORE_ID: string;
+        ACTOR_DEFAULT_REQUEST_QUEUE_ID: string;
+        ACTOR_EVENTS_WEBSOCKET_URL: string;
+        ACTOR_ID: string;
+        ACTOR_INPUT_KEY: string;
+        ACTOR_MEMORY_MBYTES: string;
+        ACTOR_PERMISSION_LEVEL: string;
+        ACTOR_RUN_ID: string;
+        ACTOR_STANDBY_PORT: string;
+        ACTOR_STANDBY_URL: string;
+        ACTOR_TASK_ID: string;
+        ACTOR_WEB_SERVER_PORT: string;
+        ACTOR_WEB_SERVER_URL: string;
+        ACTOR_MAX_TOTAL_CHARGE_USD: string;
+        ACTOR_TEST_PAY_PER_EVENT: string;
+        ACTOR_USE_CHARGING_LOG_DATASET: string;
+        APIFY_ACTOR_PRICING_INFO: string;
+        APIFY_CHARGED_ACTOR_EVENT_COUNTS: string;
+        ACTOR_STORAGES_JSON: string;
+        ACTOR_META_ORIGIN: string;
+    };
+    protected static INTEGER_VARS: string[];
+    protected static BOOLEAN_VARS: string[];
+    protected static DEFAULTS: {
+        defaultKeyValueStoreId: string;
+        defaultDatasetId: string;
+        defaultRequestQueueId: string;
+        inputKey: string;
+        apiBaseUrl: string;
+        apiPublicBaseUrl: string;
+        proxyStatusUrl: string;
+        proxyHostname: string;
+        proxyPort: number;
+        containerPort: number;
+        containerUrl: string;
+        standbyPort: number;
+        metamorphAfterSleepMillis: number;
+        persistStateIntervalMillis: number;
+        testPayPerEvent: boolean;
+        useChargingLogDataset: boolean;
+    };
+    get<T extends keyof ConfigurationOptions, U extends ConfigurationOptions[T]>(key: T, defaultValue?: U): U;
+    set(key: keyof ConfigurationOptions, value?: any): void;
+    static getGlobalConfig(): Configuration;
+    static resetGlobalState(): void;
+}

package/dist/configuration.js

@@ -0,0 +1,128 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Configuration = void 0;
+const core_1 = require("@crawlee/core");
+class Configuration extends core_1.Configuration {
+    static globalConfig;
+    static ENV_MAP = {
+        ...core_1.Configuration.ENV_MAP,
+        APIFY_AVAILABLE_MEMORY_RATIO: 'availableMemoryRatio',
+        APIFY_PURGE_ON_START: 'purgeOnStart',
+        APIFY_MEMORY_MBYTES: 'memoryMbytes',
+        APIFY_DEFAULT_DATASET_ID: 'defaultDatasetId',
+        APIFY_DEFAULT_KEY_VALUE_STORE_ID: 'defaultKeyValueStoreId',
+        APIFY_DEFAULT_REQUEST_QUEUE_ID: 'defaultRequestQueueId',
+        APIFY_INPUT_KEY: 'inputKey',
+        APIFY_PERSIST_STATE_INTERVAL_MILLIS: 'persistStateIntervalMillis',
+        APIFY_HEADLESS: 'headless',
+        APIFY_XVFB: 'xvfb',
+        APIFY_CHROME_EXECUTABLE_PATH: 'chromeExecutablePath',
+        APIFY_DEFAULT_BROWSER_PATH: 'defaultBrowserPath',
+        APIFY_DISABLE_BROWSER_SANDBOX: 'disableBrowserSandbox',
+        APIFY_TOKEN: 'token',
+        APIFY_METAMORPH_AFTER_SLEEP_MILLIS: 'metamorphAfterSleepMillis',
+        APIFY_TEST_PERSIST_INTERVAL_MILLIS: 'persistStateIntervalMillis',
+        APIFY_ACTOR_EVENTS_WS_URL: 'actorEventsWsUrl',
+        APIFY_ACTOR_ID: 'actorId',
+        APIFY_API_BASE_URL: 'apiBaseUrl',
+        APIFY_API_PUBLIC_BASE_URL: 'apiPublicBaseUrl',
+        APIFY_IS_AT_HOME: 'isAtHome',
+        APIFY_ACTOR_RUN_ID: 'actorRunId',
+        APIFY_ACTOR_TASK_ID: 'actorTaskId',
+        APIFY_CONTAINER_PORT: 'containerPort',
+        APIFY_CONTAINER_URL: 'containerUrl',
+        APIFY_USER_ID: 'userId',
+        APIFY_USER_IS_PAYING: 'userIsPaying',
+        APIFY_PROXY_HOSTNAME: 'proxyHostname',
+        APIFY_PROXY_PASSWORD: 'proxyPassword',
+        APIFY_PROXY_STATUS_URL: 'proxyStatusUrl',
+        APIFY_PROXY_PORT: 'proxyPort',
+        APIFY_INPUT_SECRETS_PRIVATE_KEY_FILE: 'inputSecretsPrivateKeyFile',
+        APIFY_INPUT_SECRETS_PRIVATE_KEY_PASSPHRASE: 'inputSecretsPrivateKeyPassphrase',
+        APIFY_META_ORIGIN: 'metaOrigin',
+        SCRAPELY_TOKEN: 'token',
+        SCRAPELY_API_URL: 'apiBaseUrl',
+        SCRAPELY_IS_AT_HOME: 'isAtHome',
+        ACTOR_DEFAULT_DATASET_ID: 'defaultDatasetId',
+        ACTOR_DEFAULT_KEY_VALUE_STORE_ID: 'defaultKeyValueStoreId',
+        ACTOR_DEFAULT_REQUEST_QUEUE_ID: 'defaultRequestQueueId',
+        ACTOR_EVENTS_WEBSOCKET_URL: 'actorEventsWsUrl',
+        ACTOR_ID: 'actorId',
+        ACTOR_INPUT_KEY: 'inputKey',
+        ACTOR_MEMORY_MBYTES: 'memoryMbytes',
+        ACTOR_PERMISSION_LEVEL: 'actorPermissionLevel',
+        ACTOR_RUN_ID: 'actorRunId',
+        ACTOR_STANDBY_PORT: 'standbyPort',
+        ACTOR_STANDBY_URL: 'standbyUrl',
+        ACTOR_TASK_ID: 'actorTaskId',
+        ACTOR_WEB_SERVER_PORT: 'containerPort',
+        ACTOR_WEB_SERVER_URL: 'containerUrl',
+        ACTOR_MAX_TOTAL_CHARGE_USD: 'maxTotalChargeUsd',
+        ACTOR_TEST_PAY_PER_EVENT: 'testPayPerEvent',
+        ACTOR_USE_CHARGING_LOG_DATASET: 'useChargingLogDataset',
+        APIFY_ACTOR_PRICING_INFO: 'actorPricingInfo',
+        APIFY_CHARGED_ACTOR_EVENT_COUNTS: 'chargedEventCounts',
+        ACTOR_STORAGES_JSON: 'actorStoragesJson',
+        ACTOR_META_ORIGIN: 'metaOrigin',
+    };
+    static INTEGER_VARS = [
+        ...core_1.Configuration.INTEGER_VARS,
+        'proxyPort',
+        'containerPort',
+        'standbyPort',
+        'metamorphAfterSleepMillis',
+        'maxTotalChargeUsd',
+    ];
+    static BOOLEAN_VARS = [
+        ...core_1.Configuration.BOOLEAN_VARS,
+        'isAtHome',
+        'testPayPerEvent',
+        'useChargingLogDataset',
+        'userIsPaying',
+    ];
+    static DEFAULTS = {
+        ...core_1.Configuration.DEFAULTS,
+        defaultKeyValueStoreId: 'default',
+        defaultDatasetId: 'default',
+        defaultRequestQueueId: 'default',
+        inputKey: 'INPUT',
+        apiBaseUrl: 'https://api-staging.scrape.ly',
+        apiPublicBaseUrl: 'https://api-staging.scrape.ly',
+        proxyStatusUrl: 'http://proxy.scrape.ly',
+        proxyHostname: 'proxy.scrape.ly',
+        proxyPort: 8000,
+        containerPort: 4321,
+        containerUrl: 'http://localhost:4321',
+        standbyPort: 4321,
+        metamorphAfterSleepMillis: 300e3,
+        persistStateIntervalMillis: 60e3,
+        testPayPerEvent: false,
+        useChargingLogDataset: false,
+    };
+    get(key, defaultValue) {
+        return super.get(key, defaultValue);
+    }
+    set(key, value) {
+        super.set(key, value);
+    }
+    static getGlobalConfig() {
+        if (Configuration.storage.getStore()) {
+            return Configuration.storage.getStore();
+        }
+        Configuration.globalConfig ??= new Configuration();
+        return Configuration.globalConfig;
+    }
+    static resetGlobalState() {
+        delete this.globalConfig;
+    }
+}
+exports.Configuration = Configuration;
+core_1.Configuration.getGlobalConfig = Configuration.getGlobalConfig;
+// @ts-expect-error protected property
+core_1.Configuration.ENV_MAP = Configuration.ENV_MAP;
+// @ts-expect-error protected property
+core_1.Configuration.INTEGER_VARS = Configuration.INTEGER_VARS;
+// @ts-expect-error protected property
+core_1.Configuration.BOOLEAN_VARS = Configuration.BOOLEAN_VARS;
+// @ts-expect-error protected property
+core_1.Configuration.DEFAULTS = Configuration.DEFAULTS;

package/dist/crypto/secrets.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Read the private key file from disk and decrypt it with the run passphrase.
+ * The private key file is encrypted with AES-256-GCM using a key derived from the passphrase.
+ *
+ * @param privateKeyFilePath - Path to the encrypted private key file (e.g., /run/secrets/private_key.pem)
+ * @param passphrase - The run passphrase from APIFY_INPUT_SECRETS_PRIVATE_KEY_PASSPHRASE
+ * @returns The decrypted private key as a PEM string
+ */
+export declare function decryptPrivateKeyFile(privateKeyFilePath: string, passphrase: string): string;
+/**
+ * Decrypt a single secret value encrypted with RSA-OAEP.
+ *
+ * @param encryptedBase64 - Base64-encoded encrypted data
+ * @param privateKeyPem - The decrypted private key PEM
+ * @returns The decrypted plaintext value
+ */
+export declare function decryptSecretValue(encryptedBase64: string, privateKeyPem: string): any;
+/**
+ * Decrypt all secret values from the encrypted input payload.
+ *
+ * @param encryptedSecrets - Map of field name → base64 encrypted value
+ * @param privateKeyPem - The decrypted private key PEM
+ * @returns Map of field name → decrypted value
+ */
+export declare function decryptAllSecrets(encryptedSecrets: Record<string, string>, privateKeyPem: string): Record<string, any>;
+/**
+ * Merge decrypted secret values into the original input object.
+ * Supports nested paths like "credentials.apiKey" or "database.password".
+ *
+ * @param input - The original input object (with secrets stripped/masked)
+ * @param decryptedSecrets - Map of field name → decrypted value
+ * @returns A new input object with secrets populated
+ */
+export declare function mergeDecryptedInput(input: Record<string, any>, decryptedSecrets: Record<string, any>): Record<string, any>;
+/**
+ * Full decryption flow: read private key from file, decrypt it with passphrase,
+ * then decrypt all secrets and merge into input.
+ *
+ * This is called from Actor.init() when APIFY_INPUT_SECRETS_PRIVATE_KEY_FILE is set.
+ *
+ * @param input - Current actor input object
+ * @returns The input object with decrypted secret values merged in
+ */
+export declare function decryptSecretInputs(input: Record<string, any>): Record<string, any>;

package/dist/crypto/secrets.js

@@ -0,0 +1,164 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.decryptPrivateKeyFile = decryptPrivateKeyFile;
+exports.decryptSecretValue = decryptSecretValue;
+exports.decryptAllSecrets = decryptAllSecrets;
+exports.mergeDecryptedInput = mergeDecryptedInput;
+exports.decryptSecretInputs = decryptSecretInputs;
+const crypto_1 = __importDefault(require("crypto"));
+const fs_1 = require("fs");
+// ─── Constants ────────────────────────────────────────────────────────────────
+const RSA_PADDING = crypto_1.default.constants.RSA_PKCS1_OAEP_PADDING;
+const RSA_OAEP_HASH = 'sha256';
+const AES_ALGORITHM = 'aes-256-gcm';
+const IV_LENGTH = 12;
+const AUTH_TAG_LENGTH = 16;
+const PBKDF2_ITERATIONS = 100_000;
+const PBKDF2_HASH = 'sha256';
+const SALT_LENGTH = 32;
+const KEY_LENGTH = 32;
+// ─── Private Key Decryption ───────────────────────────────────────────────────
+/**
+ * Read the private key file from disk and decrypt it with the run passphrase.
+ * The private key file is encrypted with AES-256-GCM using a key derived from the passphrase.
+ *
+ * @param privateKeyFilePath - Path to the encrypted private key file (e.g., /run/secrets/private_key.pem)
+ * @param passphrase - The run passphrase from APIFY_INPUT_SECRETS_PRIVATE_KEY_PASSPHRASE
+ * @returns The decrypted private key as a PEM string
+ */
+function decryptPrivateKeyFile(privateKeyFilePath, passphrase) {
+    const encryptedData = (0, fs_1.readFileSync)(privateKeyFilePath);
+    const salt = encryptedData.subarray(0, SALT_LENGTH);
+    const iv = encryptedData.subarray(SALT_LENGTH, SALT_LENGTH + IV_LENGTH);
+    const authTag = encryptedData.subarray(SALT_LENGTH + IV_LENGTH, SALT_LENGTH + IV_LENGTH + AUTH_TAG_LENGTH);
+    const encrypted = encryptedData.subarray(SALT_LENGTH + IV_LENGTH + AUTH_TAG_LENGTH);
+    // Derive key from passphrase
+    const key = crypto_1.default.pbkdf2Sync(passphrase, salt, PBKDF2_ITERATIONS, KEY_LENGTH, PBKDF2_HASH);
+    // Decrypt
+    const decipher = crypto_1.default.createDecipheriv(AES_ALGORITHM, key, iv);
+    decipher.setAuthTag(authTag);
+    const decrypted = Buffer.concat([
+        decipher.update(encrypted),
+        decipher.final(),
+    ]);
+    return decrypted.toString('utf8');
+}
+// ─── Secret Value Decryption ──────────────────────────────────────────────────
+/**
+ * Decrypt a single secret value encrypted with RSA-OAEP.
+ *
+ * @param encryptedBase64 - Base64-encoded encrypted data
+ * @param privateKeyPem - The decrypted private key PEM
+ * @returns The decrypted plaintext value
+ */
+function decryptSecretValue(encryptedBase64, privateKeyPem) {
+    const encrypted = Buffer.from(encryptedBase64, 'base64');
+    const decryptedData = crypto_1.default.privateDecrypt({
+        key: privateKeyPem,
+        padding: RSA_PADDING,
+        oaepHash: RSA_OAEP_HASH,
+    }, encrypted);
+    const plaintext = decryptedData.toString('utf8');
+    // Try to parse as JSON (for objects, arrays, numbers, booleans)
+    try {
+        return JSON.parse(plaintext);
+    }
+    catch {
+        // Return as plain string
+        return plaintext;
+    }
+}
+/**
+ * Decrypt all secret values from the encrypted input payload.
+ *
+ * @param encryptedSecrets - Map of field name → base64 encrypted value
+ * @param privateKeyPem - The decrypted private key PEM
+ * @returns Map of field name → decrypted value
+ */
+function decryptAllSecrets(encryptedSecrets, privateKeyPem) {
+    const decrypted = {};
+    for (const [fieldName, encryptedBase64] of Object.entries(encryptedSecrets)) {
+        try {
+            decrypted[fieldName] = decryptSecretValue(encryptedBase64, privateKeyPem);
+        }
+        catch (err) {
+            console.warn(`[Scrapely] Failed to decrypt secret field "${fieldName}": ${err.message}`);
+        }
+    }
+    return decrypted;
+}
+/**
+ * Merge decrypted secret values into the original input object.
+ * Supports nested paths like "credentials.apiKey" or "database.password".
+ *
+ * @param input - The original input object (with secrets stripped/masked)
+ * @param decryptedSecrets - Map of field name → decrypted value
+ * @returns A new input object with secrets populated
+ */
+function mergeDecryptedInput(input, decryptedSecrets) {
+    const merged = { ...input };
+    for (const [fieldName, value] of Object.entries(decryptedSecrets)) {
+        if (fieldName.includes('.')) {
+            // Handle nested paths
+            const parts = fieldName.split('.');
+            let current = merged;
+            for (let i = 0; i < parts.length - 1; i++) {
+                if (!current[parts[i]] || typeof current[parts[i]] !== 'object') {
+                    current[parts[i]] = {};
+                }
+                current = current[parts[i]];
+            }
+            current[parts[parts.length - 1]] = value;
+        }
+        else {
+            merged[fieldName] = value;
+        }
+    }
+    return merged;
+}
+// ─── Full Decryption Flow ─────────────────────────────────────────────────────
+/**
+ * Full decryption flow: read private key from file, decrypt it with passphrase,
+ * then decrypt all secrets and merge into input.
+ *
+ * This is called from Actor.init() when APIFY_INPUT_SECRETS_PRIVATE_KEY_FILE is set.
+ *
+ * @param input - Current actor input object
+ * @returns The input object with decrypted secret values merged in
+ */
+function decryptSecretInputs(input) {
+    const privateKeyFile = process.env.APIFY_INPUT_SECRETS_PRIVATE_KEY_FILE;
+    const passphrase = process.env.APIFY_INPUT_SECRETS_PRIVATE_KEY_PASSPHRASE;
+    if (!privateKeyFile || !passphrase) {
+        return input; // No secrets to decrypt
+    }
+    console.log('[Scrapely] Decrypting secret inputs...');
+    try {
+        // 1. Read and decrypt the private key file
+        const privateKeyPem = decryptPrivateKeyFile(privateKeyFile, passphrase);
+        console.log('[Scrapely] Private key decrypted successfully');
+        // 2. Get the encrypted secrets from the input
+        // The encrypted secrets are stored in a special __encrypted property
+        const encryptedSecrets = input.__encrypted_secrets;
+        if (!encryptedSecrets || Object.keys(encryptedSecrets).length === 0) {
+            console.log('[Scrapely] No encrypted secrets found in input');
+            return input;
+        }
+        // 3. Decrypt all secret values
+        const decryptedSecrets = decryptAllSecrets(encryptedSecrets, privateKeyPem);
+        console.log(`[Scrapely] Decrypted ${Object.keys(decryptedSecrets).length} secret field(s)`);
+        // 4. Merge decrypted values into input and remove the __encrypted_secrets key
+        const merged = mergeDecryptedInput(input, decryptedSecrets);
+        delete merged.__encrypted_secrets;
+        delete merged.__encrypted_secret_fields;
+        return merged;
+    }
+    catch (err) {
+        console.error(`[Scrapely] Failed to decrypt secret inputs: ${err.message}`);
+        // Return input as-is - secrets won't be available but actor can still run
+        return input;
+    }
+}

package/dist/events/events-client.d.ts

@@ -0,0 +1,59 @@
+import { EventEmitter } from 'node:events';
+/**
+ * System event received from the Scrapely platform via WebSocket.
+ * Matches the format documented for ACTOR_EVENTS_WEBSOCKET_URL.
+ */
+export interface SystemEvent {
+    name: 'systemInfo' | 'cpuInfo' | 'aborting' | 'persistState' | 'migrating';
+    createdAt: string;
+    data: Record<string, unknown>;
+}
+export interface SystemInfoData {
+    createdAt: string;
+    isCpuOverloaded: boolean;
+    cpuCurrentUsage: number;
+    cpuAvgUsage: number;
+    cpuMaxUsage: number;
+    memCurrentBytes: number;
+    memAvgBytes: number;
+    memMaxBytes: number;
+}
+export interface CpuInfoData {
+    isCpuOverloaded: boolean;
+}
+export interface PersistStateData {
+    isMigrating: boolean;
+}
+declare const events: EventEmitter<any>;
+/**
+ * Connect to the Scrapely events WebSocket server.
+ * Called during Actor.init().
+ *
+ * @param eventsWsUrl - The ACTOR_EVENTS_WEBSOCKET_URL env var value
+ * @param token - The SCRAPELY_TOKEN for authentication
+ * @param runId - The ACTOR_RUN_ID
+ */
+export declare function connectEvents(eventsWsUrl: string, token: string, runId: string): void;
+/**
+ * Disconnect from the events WebSocket server.
+ * Called during Actor.exit().
+ */
+export declare function disconnectEvents(): void;
+/**
+ * Check if the events WebSocket is connected.
+ */
+export declare function isEventsConnected(): boolean;
+/**
+ * Subscribe to system events.
+ * Use in conjunction with Actor.on() to receive typed events.
+ */
+export declare function onSystemEvent(listener: (event: SystemEvent) => void): void;
+/**
+ * Subscribe to specific system event types.
+ */
+export declare function onEvent(name: SystemEvent['name'], listener: (data: Record<string, unknown>) => void): void;
+/**
+ * Remove a specific event listener.
+ */
+export declare function offEvent(name: SystemEvent['name'], listener: (...args: any[]) => void): void;
+export { events };