@cloudsnorkel/cdk-github-runners 0.11.3 → 0.11.5

package/assets/setup.lambda/index.js

@@ -10429,13 +10429,13 @@ var fs = __toESM(require("fs"));
 var import_rest = __toESM(require_dist_node12());
 
 // src/lambda-helpers.ts
-var AWS = __toESM(require("aws-sdk"));
-var sm = new AWS.SecretsManager();
+var import_client_secrets_manager = require("@aws-sdk/client-secrets-manager");
+var sm = new import_client_secrets_manager.SecretsManagerClient();
 async function getSecretValue(arn) {
   if (!arn) {
     throw new Error("Missing secret ARN");
   }
-  const secret = await sm.getSecretValue({ SecretId: arn }).promise();
+  const secret = await sm.send(new import_client_secrets_manager.GetSecretValueCommand({ SecretId: arn }));
   if (!secret.SecretString) {
     throw new Error(`No SecretString in ${arn}`);
   }
@@ -10448,7 +10448,7 @@ async function updateSecretValue(arn, value) {
   if (!arn) {
     throw new Error("Missing secret ARN");
   }
-  await sm.updateSecret({ SecretId: arn, SecretString: value }).promise();
+  await sm.send(new import_client_secrets_manager.UpdateSecretCommand({ SecretId: arn, SecretString: value }));
 }
 
 // src/lambda-github.ts
@@ -10495,8 +10495,12 @@ async function handleDomain(event) {
   if (!body.domain) {
     return response(400, "Invalid domain");
   }
+  if (body.runnerLevel !== "repo" && body.runnerLevel !== "org") {
+    return response(400, "Invalid runner registration level");
+  }
   const githubSecrets = await getSecretJsonValue(process.env.GITHUB_SECRET_ARN);
   githubSecrets.domain = body.domain;
+  githubSecrets.runnerLevel = body.runnerLevel;
   await updateSecretValue(process.env.GITHUB_SECRET_ARN, JSON.stringify(githubSecrets));
   return response(200, "Domain set");
 }
@@ -10508,7 +10512,8 @@ async function handlePat(event) {
   await updateSecretValue(process.env.GITHUB_SECRET_ARN, JSON.stringify({
     domain: body.domain,
     appId: -1,
-    personalAuthToken: body.pat
+    personalAuthToken: body.pat,
+    runnerLevel: "repo"
   }));
   await updateSecretValue(process.env.SETUP_SECRET_ARN, JSON.stringify({ token: "" }));
   return response(200, "Personal access token set");
@@ -10524,11 +10529,10 @@ async function handleNewApp(event) {
   const githubSecrets = await getSecretJsonValue(process.env.GITHUB_SECRET_ARN);
   const baseUrl = baseUrlFromDomain(githubSecrets.domain);
   const newApp = await new import_rest.Octokit({ baseUrl }).rest.apps.createFromManifest({ code });
-  await updateSecretValue(process.env.GITHUB_SECRET_ARN, JSON.stringify({
-    domain: new URL(newApp.data.html_url).host,
-    appId: newApp.data.id,
-    personalAuthToken: ""
-  }));
+  githubSecrets.appId = newApp.data.id;
+  githubSecrets.domain = new URL(newApp.data.html_url).host;
+  githubSecrets.personalAuthToken = "";
+  await updateSecretValue(process.env.GITHUB_SECRET_ARN, JSON.stringify(githubSecrets));
   await updateSecretValue(process.env.GITHUB_PRIVATE_KEY_SECRET_ARN, newApp.data.pem);
   await updateSecretValue(process.env.WEBHOOK_SECRET_ARN, JSON.stringify({
     webhookSecret: newApp.data.webhook_secret
@@ -10538,13 +10542,14 @@ async function handleNewApp(event) {
 }
 async function handleExistingApp(event) {
   const body = decodeBody(event);
-  if (!body.appid || !body.pk || !body.domain) {
+  if (!body.appid || !body.pk || !body.domain || body.runnerLevel !== "repo" && body.runnerLevel !== "org") {
     return response(400, "Missing fields");
   }
   await updateSecretValue(process.env.GITHUB_SECRET_ARN, JSON.stringify({
     domain: body.domain,
     appId: body.appid,
-    personalAuthToken: ""
+    personalAuthToken: "",
+    runnerLevel: body.runnerLevel
   }));
   await updateSecretValue(process.env.GITHUB_PRIVATE_KEY_SECRET_ARN, body.pk);
   await updateSecretValue(process.env.SETUP_SECRET_ARN, JSON.stringify({ token: "" }));

package/assets/status.lambda/index.js

@@ -12865,7 +12865,6 @@ var require_cjs = __commonJS({
     };
     var AC = globalThis.AbortController;
     var AS = globalThis.AbortSignal;
-    var _a;
     if (typeof AC === "undefined") {
       AS = class AbortSignal {
         onabort;
@@ -12882,7 +12881,6 @@ var require_cjs = __commonJS({
         }
         signal = new AS();
         abort(reason) {
-          var _a2, _b;
           if (this.signal.aborted)
             return;
           this.signal.reason = reason;
@@ -12890,10 +12888,10 @@ var require_cjs = __commonJS({
           for (const fn of this.signal._onabort) {
             fn(reason);
           }
-          (_b = (_a2 = this.signal).onabort) == null ? void 0 : _b.call(_a2, reason);
+          this.signal.onabort?.(reason);
         }
       };
-      let printACPolyfillWarning = ((_a = PROCESS.env) == null ? void 0 : _a.LRU_CACHE_IGNORE_AC_WARNING) !== "1";
+      let printACPolyfillWarning = PROCESS.env?.LRU_CACHE_IGNORE_AC_WARNING !== "1";
       const warnACPolyfill = () => {
         if (!printACPolyfillWarning)
           return;
@@ -13548,7 +13546,6 @@ var require_cjs = __commonJS({
        * {@link LRUCache#delete}
        */
       set(k, v, setOptions = {}) {
-        var _a2, _b, _c;
         if (v === void 0) {
           this.delete(k);
           return this;
@@ -13586,10 +13583,10 @@ var require_cjs = __commonJS({
               oldVal.__abortController.abort(new Error("replaced"));
             } else if (!noDisposeOnSet) {
               if (this.#hasDispose) {
-                (_a2 = this.#dispose) == null ? void 0 : _a2.call(this, oldVal, k, "set");
+                this.#dispose?.(oldVal, k, "set");
               }
               if (this.#hasDisposeAfter) {
-                (_b = this.#disposed) == null ? void 0 : _b.push([oldVal, k, "set"]);
+                this.#disposed?.push([oldVal, k, "set"]);
               }
             }
             this.#removeItemSize(index);
@@ -13618,8 +13615,8 @@ var require_cjs = __commonJS({
         if (!noDisposeOnSet && this.#hasDisposeAfter && this.#disposed) {
           const dt = this.#disposed;
           let task;
-          while (task = dt == null ? void 0 : dt.shift()) {
-            (_c = this.#disposeAfter) == null ? void 0 : _c.call(this, ...task);
+          while (task = dt?.shift()) {
+            this.#disposeAfter?.(...task);
           }
         }
         return this;
@@ -13629,7 +13626,6 @@ var require_cjs = __commonJS({
        * `undefined` if cache is empty.
        */
       pop() {
-        var _a2;
         try {
           while (this.#size) {
             const val = this.#valList[this.#head];
@@ -13646,14 +13642,13 @@ var require_cjs = __commonJS({
           if (this.#hasDisposeAfter && this.#disposed) {
             const dt = this.#disposed;
             let task;
-            while (task = dt == null ? void 0 : dt.shift()) {
-              (_a2 = this.#disposeAfter) == null ? void 0 : _a2.call(this, ...task);
+            while (task = dt?.shift()) {
+              this.#disposeAfter?.(...task);
             }
           }
         }
       }
       #evict(free) {
-        var _a2, _b;
         const head = this.#head;
         const k = this.#keyList[head];
         const v = this.#valList[head];
@@ -13661,10 +13656,10 @@ var require_cjs = __commonJS({
           v.__abortController.abort(new Error("evicted"));
         } else if (this.#hasDispose || this.#hasDisposeAfter) {
           if (this.#hasDispose) {
-            (_a2 = this.#dispose) == null ? void 0 : _a2.call(this, v, k, "evict");
+            this.#dispose?.(v, k, "evict");
           }
           if (this.#hasDisposeAfter) {
-            (_b = this.#disposed) == null ? void 0 : _b.push([v, k, "evict"]);
+            this.#disposed?.push([v, k, "evict"]);
           }
         }
         this.#removeItemSize(head);
@@ -13739,7 +13734,7 @@ var require_cjs = __commonJS({
         }
         const ac = new AC();
         const { signal } = options;
-        signal == null ? void 0 : signal.addEventListener("abort", () => ac.abort(signal.reason), {
+        signal?.addEventListener("abort", () => ac.abort(signal.reason), {
           signal: ac.signal
         });
         const fetchOpts = {
@@ -13810,8 +13805,7 @@ var require_cjs = __commonJS({
           }
         };
         const pcall = (res, rej) => {
-          var _a2;
-          const fmp = (_a2 = this.#fetchMethod) == null ? void 0 : _a2.call(this, k, v, fetchOpts);
+          const fmp = this.#fetchMethod?.(k, v, fetchOpts);
           if (fmp && fmp instanceof Promise) {
             fmp.then((v2) => res(v2), rej);
           }
@@ -14000,7 +13994,6 @@ var require_cjs = __commonJS({
        * Returns true if the key was deleted, false otherwise.
        */
       delete(k) {
-        var _a2, _b, _c, _d;
         let deleted = false;
         if (this.#size !== 0) {
           const index = this.#keyMap.get(k);
@@ -14015,10 +14008,10 @@ var require_cjs = __commonJS({
                 v.__abortController.abort(new Error("deleted"));
               } else if (this.#hasDispose || this.#hasDisposeAfter) {
                 if (this.#hasDispose) {
-                  (_a2 = this.#dispose) == null ? void 0 : _a2.call(this, v, k, "delete");
+                  this.#dispose?.(v, k, "delete");
                 }
                 if (this.#hasDisposeAfter) {
-                  (_b = this.#disposed) == null ? void 0 : _b.push([v, k, "delete"]);
+                  this.#disposed?.push([v, k, "delete"]);
                 }
               }
               this.#keyMap.delete(k);
@@ -14037,11 +14030,11 @@ var require_cjs = __commonJS({
             }
           }
         }
-        if (this.#hasDisposeAfter && ((_c = this.#disposed) == null ? void 0 : _c.length)) {
+        if (this.#hasDisposeAfter && this.#disposed?.length) {
           const dt = this.#disposed;
           let task;
-          while (task = dt == null ? void 0 : dt.shift()) {
-            (_d = this.#disposeAfter) == null ? void 0 : _d.call(this, ...task);
+          while (task = dt?.shift()) {
+            this.#disposeAfter?.(...task);
           }
         }
         return deleted;
@@ -14050,7 +14043,6 @@ var require_cjs = __commonJS({
        * Clear the cache entirely, throwing away all values.
        */
       clear() {
-        var _a2, _b, _c;
         for (const index of this.#rindexes({ allowStale: true })) {
           const v = this.#valList[index];
           if (this.#isBackgroundFetch(v)) {
@@ -14058,10 +14050,10 @@ var require_cjs = __commonJS({
           } else {
             const k = this.#keyList[index];
             if (this.#hasDispose) {
-              (_a2 = this.#dispose) == null ? void 0 : _a2.call(this, v, k, "delete");
+              this.#dispose?.(v, k, "delete");
             }
             if (this.#hasDisposeAfter) {
-              (_b = this.#disposed) == null ? void 0 : _b.push([v, k, "delete"]);
+              this.#disposed?.push([v, k, "delete"]);
             }
           }
         }
@@ -14083,8 +14075,8 @@ var require_cjs = __commonJS({
         if (this.#hasDisposeAfter && this.#disposed) {
           const dt = this.#disposed;
           let task;
-          while (task = dt == null ? void 0 : dt.shift()) {
-            (_c = this.#disposeAfter) == null ? void 0 : _c.call(this, ...task);
+          while (task = dt?.shift()) {
+            this.#disposeAfter?.(...task);
           }
         }
       }
@@ -15058,18 +15050,21 @@ __export(status_lambda_exports, {
   handler: () => handler
 });
 module.exports = __toCommonJS(status_lambda_exports);
+var import_client_cloudformation = require("@aws-sdk/client-cloudformation");
+var import_client_ec2 = require("@aws-sdk/client-ec2");
+var import_client_ecr = require("@aws-sdk/client-ecr");
+var import_client_sfn = require("@aws-sdk/client-sfn");
 var import_auth_app = __toESM(require_dist_node12());
 var import_core = __toESM(require_dist_node15());
-var AWS2 = __toESM(require("aws-sdk"));
 
 // src/lambda-helpers.ts
-var AWS = __toESM(require("aws-sdk"));
-var sm = new AWS.SecretsManager();
+var import_client_secrets_manager = require("@aws-sdk/client-secrets-manager");
+var sm = new import_client_secrets_manager.SecretsManagerClient();
 async function getSecretValue(arn) {
   if (!arn) {
     throw new Error("Missing secret ARN");
   }
-  const secret = await sm.getSecretValue({ SecretId: arn }).promise();
+  const secret = await sm.send(new import_client_secrets_manager.GetSecretValueCommand({ SecretId: arn }));
   if (!secret.SecretString) {
     throw new Error(`No SecretString in ${arn}`);
   }
@@ -15088,10 +15083,10 @@ function baseUrlFromDomain(domain) {
 }
 
 // src/status.lambda.ts
-var cfn = new AWS2.CloudFormation();
-var ec2 = new AWS2.EC2();
-var ecr = new AWS2.ECR();
-var sf = new AWS2.StepFunctions();
+var cfn = new import_client_cloudformation.CloudFormationClient();
+var ec2 = new import_client_ec2.EC2Client();
+var ecr = new import_client_ecr.ECRClient();
+var sf = new import_client_sfn.SFNClient();
 function secretArnToUrl(arn) {
   const parts = arn.split(":");
   const region = parts[3];
@@ -15116,23 +15111,21 @@ function stepFunctionArnToUrl(arn) {
   return `https://${region}.console.aws.amazon.com/states/home?region=${region}#/statemachines/view/${arn}`;
 }
 async function generateProvidersStatus(stack, logicalId) {
-  var _a;
-  const resource = await cfn.describeStackResource({ StackName: stack, LogicalResourceId: logicalId }).promise();
-  const providers = JSON.parse(((_a = resource.StackResourceDetail) == null ? void 0 : _a.Metadata) ?? "{}").providers;
+  const resource = await cfn.send(new import_client_cloudformation.DescribeStackResourceCommand({ StackName: stack, LogicalResourceId: logicalId }));
+  const providers = JSON.parse(resource.StackResourceDetail?.Metadata ?? "{}").providers;
   if (!providers) {
     return {};
   }
   return Promise.all(providers.map(async (p) => {
-    var _a2, _b, _c, _d, _e;
-    if ((_b = (_a2 = p.image) == null ? void 0 : _a2.imageRepository) == null ? void 0 : _b.match(/[0-9]+\.dkr\.ecr\.[a-z0-9\-]+\.amazonaws\.com\/.+/)) {
-      const tags = await ecr.describeImages({
+    if (p.image?.imageRepository?.match(/[0-9]+\.dkr\.ecr\.[a-z0-9\-]+\.amazonaws\.com\/.+/)) {
+      const tags = await ecr.send(new import_client_ecr.DescribeImagesCommand({
         repositoryName: p.image.imageRepository.split("/")[1],
         filter: {
           tagStatus: "TAGGED"
         },
         maxResults: 1
-      }).promise();
-      if (tags.imageDetails && ((_c = tags.imageDetails) == null ? void 0 : _c.length) >= 1) {
+      }));
+      if (tags.imageDetails && tags.imageDetails?.length >= 1) {
         p.image.latestImage = {
           tags: tags.imageDetails[0].imageTags,
           digest: tags.imageDetails[0].imageDigest,
@@ -15140,13 +15133,13 @@ async function generateProvidersStatus(stack, logicalId) {
         };
       }
     }
-    if ((_d = p.ami) == null ? void 0 : _d.launchTemplate) {
-      const versions = await ec2.describeLaunchTemplateVersions({
+    if (p.ami?.launchTemplate) {
+      const versions = await ec2.send(new import_client_ec2.DescribeLaunchTemplateVersionsCommand({
         LaunchTemplateId: p.ami.launchTemplate,
         Versions: ["$Default"]
-      }).promise();
+      }));
       if (versions.LaunchTemplateVersions && versions.LaunchTemplateVersions.length >= 1) {
-        p.ami.latestAmi = (_e = versions.LaunchTemplateVersions[0].LaunchTemplateData) == null ? void 0 : _e.ImageId;
+        p.ami.latestAmi = versions.LaunchTemplateVersions[0].LaunchTemplateData?.ImageId;
       }
     }
     return p;
@@ -15177,6 +15170,7 @@ async function handler(event) {
         secretUrl: secretArnToUrl(process.env.SETUP_SECRET_ARN)
       },
       domain: "Unknown",
+      runnerLevel: "Unknown",
       webhook: {
         url: process.env.WEBHOOK_URL,
         status: "Unable to check",
@@ -15221,18 +15215,18 @@ async function handler(event) {
     status.github.setup.status = "Disabled";
   }
   try {
-    const executions = await sf.listExecutions({
+    const executions = await sf.send(new import_client_sfn.ListExecutionsCommand({
       stateMachineArn: process.env.STEP_FUNCTION_ARN,
       maxResults: 10
-    }).promise();
-    for (const execution of executions.executions) {
-      const executionDetails = await sf.describeExecution({
+    }));
+    for (const execution of executions.executions ?? []) {
+      const executionDetails = await sf.send(new import_client_sfn.DescribeExecutionCommand({
         executionArn: execution.executionArn
-      }).promise();
+      }));
       const input = JSON.parse(executionDetails.input || "{}");
       status.troubleshooting.recentRuns.push({
         executionArn: execution.executionArn,
-        status: execution.status,
+        status: execution.status ?? "<unknown>",
         owner: input.owner,
         repo: input.repo,
         jobId: input.jobId
@@ -15257,6 +15251,7 @@ async function handler(event) {
   }
   let baseUrl = baseUrlFromDomain(githubSecrets.domain);
   status.github.domain = githubSecrets.domain;
+  status.github.runnerLevel = githubSecrets.runnerLevel ?? "repo";
   if (githubSecrets.personalAuthToken) {
     status.github.auth.type = "Personal Access Token";
     status.github.auth.personalAuthToken = "*redacted*";

package/assets/token-retriever.lambda/index.js

@@ -12865,7 +12865,6 @@ var require_cjs = __commonJS({
     };
     var AC = globalThis.AbortController;
     var AS = globalThis.AbortSignal;
-    var _a;
     if (typeof AC === "undefined") {
       AS = class AbortSignal {
         onabort;
@@ -12882,7 +12881,6 @@ var require_cjs = __commonJS({
         }
         signal = new AS();
         abort(reason) {
-          var _a2, _b;
           if (this.signal.aborted)
             return;
           this.signal.reason = reason;
@@ -12890,10 +12888,10 @@ var require_cjs = __commonJS({
           for (const fn of this.signal._onabort) {
             fn(reason);
           }
-          (_b = (_a2 = this.signal).onabort) == null ? void 0 : _b.call(_a2, reason);
+          this.signal.onabort?.(reason);
         }
       };
-      let printACPolyfillWarning = ((_a = PROCESS.env) == null ? void 0 : _a.LRU_CACHE_IGNORE_AC_WARNING) !== "1";
+      let printACPolyfillWarning = PROCESS.env?.LRU_CACHE_IGNORE_AC_WARNING !== "1";
       const warnACPolyfill = () => {
         if (!printACPolyfillWarning)
           return;
@@ -13548,7 +13546,6 @@ var require_cjs = __commonJS({
        * {@link LRUCache#delete}
        */
       set(k, v, setOptions = {}) {
-        var _a2, _b, _c;
         if (v === void 0) {
           this.delete(k);
           return this;
@@ -13586,10 +13583,10 @@ var require_cjs = __commonJS({
               oldVal.__abortController.abort(new Error("replaced"));
             } else if (!noDisposeOnSet) {
               if (this.#hasDispose) {
-                (_a2 = this.#dispose) == null ? void 0 : _a2.call(this, oldVal, k, "set");
+                this.#dispose?.(oldVal, k, "set");
               }
               if (this.#hasDisposeAfter) {
-                (_b = this.#disposed) == null ? void 0 : _b.push([oldVal, k, "set"]);
+                this.#disposed?.push([oldVal, k, "set"]);
               }
             }
             this.#removeItemSize(index);
@@ -13618,8 +13615,8 @@ var require_cjs = __commonJS({
         if (!noDisposeOnSet && this.#hasDisposeAfter && this.#disposed) {
           const dt = this.#disposed;
           let task;
-          while (task = dt == null ? void 0 : dt.shift()) {
-            (_c = this.#disposeAfter) == null ? void 0 : _c.call(this, ...task);
+          while (task = dt?.shift()) {
+            this.#disposeAfter?.(...task);
           }
         }
         return this;
@@ -13629,7 +13626,6 @@ var require_cjs = __commonJS({
        * `undefined` if cache is empty.
        */
       pop() {
-        var _a2;
         try {
           while (this.#size) {
             const val = this.#valList[this.#head];
@@ -13646,14 +13642,13 @@ var require_cjs = __commonJS({
           if (this.#hasDisposeAfter && this.#disposed) {
             const dt = this.#disposed;
             let task;
-            while (task = dt == null ? void 0 : dt.shift()) {
-              (_a2 = this.#disposeAfter) == null ? void 0 : _a2.call(this, ...task);
+            while (task = dt?.shift()) {
+              this.#disposeAfter?.(...task);
             }
           }
         }
       }
       #evict(free) {
-        var _a2, _b;
         const head = this.#head;
         const k = this.#keyList[head];
         const v = this.#valList[head];
@@ -13661,10 +13656,10 @@ var require_cjs = __commonJS({
           v.__abortController.abort(new Error("evicted"));
         } else if (this.#hasDispose || this.#hasDisposeAfter) {
           if (this.#hasDispose) {
-            (_a2 = this.#dispose) == null ? void 0 : _a2.call(this, v, k, "evict");
+            this.#dispose?.(v, k, "evict");
           }
           if (this.#hasDisposeAfter) {
-            (_b = this.#disposed) == null ? void 0 : _b.push([v, k, "evict"]);
+            this.#disposed?.push([v, k, "evict"]);
           }
         }
         this.#removeItemSize(head);
@@ -13739,7 +13734,7 @@ var require_cjs = __commonJS({
         }
         const ac = new AC();
         const { signal } = options;
-        signal == null ? void 0 : signal.addEventListener("abort", () => ac.abort(signal.reason), {
+        signal?.addEventListener("abort", () => ac.abort(signal.reason), {
           signal: ac.signal
         });
         const fetchOpts = {
@@ -13810,8 +13805,7 @@ var require_cjs = __commonJS({
           }
         };
         const pcall = (res, rej) => {
-          var _a2;
-          const fmp = (_a2 = this.#fetchMethod) == null ? void 0 : _a2.call(this, k, v, fetchOpts);
+          const fmp = this.#fetchMethod?.(k, v, fetchOpts);
           if (fmp && fmp instanceof Promise) {
             fmp.then((v2) => res(v2), rej);
           }
@@ -14000,7 +13994,6 @@ var require_cjs = __commonJS({
        * Returns true if the key was deleted, false otherwise.
        */
       delete(k) {
-        var _a2, _b, _c, _d;
         let deleted = false;
         if (this.#size !== 0) {
           const index = this.#keyMap.get(k);
@@ -14015,10 +14008,10 @@ var require_cjs = __commonJS({
                 v.__abortController.abort(new Error("deleted"));
               } else if (this.#hasDispose || this.#hasDisposeAfter) {
                 if (this.#hasDispose) {
-                  (_a2 = this.#dispose) == null ? void 0 : _a2.call(this, v, k, "delete");
+                  this.#dispose?.(v, k, "delete");
                 }
                 if (this.#hasDisposeAfter) {
-                  (_b = this.#disposed) == null ? void 0 : _b.push([v, k, "delete"]);
+                  this.#disposed?.push([v, k, "delete"]);
                 }
               }
               this.#keyMap.delete(k);
@@ -14037,11 +14030,11 @@ var require_cjs = __commonJS({
             }
           }
         }
-        if (this.#hasDisposeAfter && ((_c = this.#disposed) == null ? void 0 : _c.length)) {
+        if (this.#hasDisposeAfter && this.#disposed?.length) {
           const dt = this.#disposed;
           let task;
-          while (task = dt == null ? void 0 : dt.shift()) {
-            (_d = this.#disposeAfter) == null ? void 0 : _d.call(this, ...task);
+          while (task = dt?.shift()) {
+            this.#disposeAfter?.(...task);
           }
         }
         return deleted;
@@ -14050,7 +14043,6 @@ var require_cjs = __commonJS({
        * Clear the cache entirely, throwing away all values.
        */
       clear() {
-        var _a2, _b, _c;
         for (const index of this.#rindexes({ allowStale: true })) {
           const v = this.#valList[index];
           if (this.#isBackgroundFetch(v)) {
@@ -14058,10 +14050,10 @@ var require_cjs = __commonJS({
           } else {
             const k = this.#keyList[index];
             if (this.#hasDispose) {
-              (_a2 = this.#dispose) == null ? void 0 : _a2.call(this, v, k, "delete");
+              this.#dispose?.(v, k, "delete");
             }
             if (this.#hasDisposeAfter) {
-              (_b = this.#disposed) == null ? void 0 : _b.push([v, k, "delete"]);
+              this.#disposed?.push([v, k, "delete"]);
             }
           }
         }
@@ -14083,8 +14075,8 @@ var require_cjs = __commonJS({
         if (this.#hasDisposeAfter && this.#disposed) {
           const dt = this.#disposed;
           let task;
-          while (task = dt == null ? void 0 : dt.shift()) {
-            (_c = this.#disposeAfter) == null ? void 0 : _c.call(this, ...task);
+          while (task = dt?.shift()) {
+            this.#disposeAfter?.(...task);
           }
         }
       }
@@ -17502,13 +17494,13 @@ var import_auth_app = __toESM(require_dist_node12());
 var import_rest = __toESM(require_dist_node19());
 
 // src/lambda-helpers.ts
-var AWS = __toESM(require("aws-sdk"));
-var sm = new AWS.SecretsManager();
+var import_client_secrets_manager = require("@aws-sdk/client-secrets-manager");
+var sm = new import_client_secrets_manager.SecretsManagerClient();
 async function getSecretValue(arn) {
   if (!arn) {
     throw new Error("Missing secret ARN");
   }
-  const secret = await sm.getSecretValue({ SecretId: arn }).promise();
+  const secret = await sm.send(new import_client_secrets_manager.GetSecretValueCommand({ SecretId: arn }));
   if (!secret.SecretString) {
     throw new Error(`No SecretString in ${arn}`);
   }
@@ -17590,20 +17582,40 @@ async function handler(event) {
       githubSecrets,
       octokit
     } = await getOctokit(event.installationId);
-    const response = await octokit.rest.actions.createRegistrationTokenForRepo({
-      owner: event.owner,
-      repo: event.repo
-    });
+    let token;
+    let registrationUrl;
+    if (githubSecrets.runnerLevel === "repo" || githubSecrets.runnerLevel === void 0) {
+      token = await getRegistrationTokenForRepo(octokit, event.owner, event.repo);
+      registrationUrl = `https://${githubSecrets.domain}/${event.owner}/${event.repo}`;
+    } else if (githubSecrets.runnerLevel === "org") {
+      token = await getRegistrationTokenForOrg(octokit, event.owner);
+      registrationUrl = `https://${githubSecrets.domain}/${event.owner}`;
+    } else {
+      throw new RunnerTokenError("Invalid runner level");
+    }
     return {
       domain: githubSecrets.domain,
-      token: response.data.token
+      token,
+      registrationUrl
     };
   } catch (error) {
     console.error(error);
-    const reqError = error;
-    throw new RunnerTokenError(reqError.message);
+    throw new RunnerTokenError(error.message);
   }
 }
+async function getRegistrationTokenForOrg(octokit, owner) {
+  const response = await octokit.rest.actions.createRegistrationTokenForOrg({
+    org: owner
+  });
+  return response.data.token;
+}
+async function getRegistrationTokenForRepo(octokit, owner, repo) {
+  const response = await octokit.rest.actions.createRegistrationTokenForRepo({
+    owner,
+    repo
+  });
+  return response.data.token;
+}
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   handler