@composurecdk/bedrock 0.10.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Jason Duffett
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,115 @@
+# @composurecdk/bedrock
+
+Amazon Bedrock model access for [ComposureCDK](../../README.md): references to foundation models and cross-Region inference profiles, the IAM grants to invoke them, and CloudWatch alarms on their metrics.
+
+It builds on the stable [`aws-cdk-lib/aws-bedrock`](https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_bedrock-readme.html) module. Amazon Bedrock AgentCore is a separate service and is not covered here.
+
+```ts
+import { FoundationModelIdentifier } from "aws-cdk-lib/aws-bedrock";
+import { compose } from "@composurecdk/core";
+import { createFunctionBuilder } from "@composurecdk/lambda";
+import { createModelAlarmBuilder, inferenceProfile, modelGrants } from "@composurecdk/bedrock";
+
+const haiku = inferenceProfile.geographic({
+  model: FoundationModelIdentifier.ANTHROPIC_CLAUDE_HAIKU_4_5_20251001_V1_0,
+  geography: "eu",
+  routingRegions: [
+    "eu-central-1",
+    "eu-north-1",
+    "eu-south-1",
+    "eu-south-2",
+    "eu-west-1",
+    "eu-west-3",
+  ],
+});
+
+compose(
+  {
+    handler: createFunctionBuilder()
+      // runtime, handler, code …
+      .environment({ MODEL_ID: haiku.profileId })
+      .grant(modelGrants.invoke(haiku)),
+    modelAlarms: createModelAlarmBuilder().model(haiku),
+  },
+  { handler: [], modelAlarms: [] },
+);
+```
+
+## Model references
+
+`modelGrants` and `createModelAlarmBuilder` take an `InferenceTarget`:
+
+| Target                               | Invokes                                                                            |
+| ------------------------------------ | ---------------------------------------------------------------------------------- |
+| `FoundationModelIdentifier`          | A foundation model in the stack's Region                                           |
+| `inferenceProfile.geographic({ … })` | A cross-Region profile that stays within one geography (`us`, `eu`, `apac`, …)     |
+| `inferenceProfile.global(model)`     | A cross-Region profile that routes to any supported commercial Region              |
+| `IModel`                             | Any model by ARN, e.g. `ProvisionedModel.fromProvisionedModelArn(…)` (grants only) |
+
+A profile's id is derived from its model, so the id a caller invokes and the model it is granted cannot drift apart. Use `new FoundationModelIdentifier("…")` for a model newer than the installed CDK's constants.
+
+`routingRegions` are the Regions a geographic profile routes to from your source Region. They vary by source Region and are not derivable from the geography, so they are supplied rather than guessed: take them from the model's page in the Bedrock user guide or from `aws bedrock get-inference-profile`. The source Region is always included.
+
+For an id that arrives as a string, such as from an environment variable:
+
+```ts
+const profile = inferenceProfile.parse(
+  "eu.anthropic.claude-haiku-4-5-20251001-v1:0",
+  routingRegions,
+);
+foundationModelFor(profile.profileId).modelId; // "anthropic.claude-haiku-4-5-20251001-v1:0"
+```
+
+`parse` and `foundationModelFor` throw on an id without a known geography or `global` prefix (`INFERENCE_PROFILE_GEOGRAPHIES`), rather than mistake a provider such as `anthropic.` for one.
+
+## Grants
+
+`modelGrants.invoke(target)` grants `bedrock:InvokeModel` and `bedrock:InvokeModelWithResponseStream`, which together cover `InvokeModel`, `Converse` and their streaming variants. Pass it to any grantee builder's `grant(...)`.
+
+| Target     | Statements                                                                                                                                                                                                   |
+| ---------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| Model      | The foundation model in the source Region                                                                                                                                                                    |
+| Geographic | The profile; the foundation model in the source Region and every routing Region, conditioned on `bedrock:InferenceProfileArn`                                                                                |
+| Global     | The profile; the foundation model in the source Region; the Region-less foundation model ARN with `aws:RequestedRegion: unspecified`. Both model statements are conditioned on `bedrock:InferenceProfileArn` |
+
+These follow the policies in the Bedrock user guide for [geographic](https://docs.aws.amazon.com/bedrock/latest/userguide/geographic-cross-region-inference.html#geographic-cris-iam-setup) and [global](https://docs.aws.amazon.com/bedrock/latest/userguide/global-cross-region-inference.html#global-cris-iam-setup) cross-Region inference. The `bedrock:InferenceProfileArn` condition makes the foundation models reachable only through the profile ([GENSEC01-BP01](https://docs.aws.amazon.com/wellarchitected/latest/generative-ai-lens/gensec01-bp01.html)); to also call a model directly, grant it separately.
+
+`invocationArns(target, scope)` returns the same resource ARNs for policies you write yourself, such as service control policies.
+
+## Alarms
+
+`createModelAlarmBuilder()` creates alarms on the `AWS/Bedrock` metrics of one model. Those metrics are per model per account and Region, across every caller, so create one builder per model in each Region that invokes it — not one per caller. For a cross-Region profile the metrics are emitted in the source Region.
+
+AWS publishes no recommended alarm thresholds for Bedrock. The [Generative AI Lens](https://docs.aws.amazon.com/wellarchitected/latest/generative-ai-lens/genops02-bp02.html) names the signals to alarm on; the thresholds below are this library's, shaped after AWS's recommended Lambda `Errors` and `Throttles` alarms.
+
+| Alarm                    | Metric (statistic)             | Default                                |
+| ------------------------ | ------------------------------ | -------------------------------------- |
+| `invocationThrottles`    | `InvocationThrottles` (Sum)    | on, > 0 in 3 of 5 minutes              |
+| `invocationServerErrors` | `InvocationServerErrors` (Sum) | on, > 0 in 3 of 5 minutes              |
+| `invocationClientErrors` | `InvocationClientErrors` (Sum) | on, > 0 in 3 of 5 minutes              |
+| `invocationLatency`      | `InvocationLatency` (p90)      | opt-in, threshold required             |
+| `timeToFirstToken`       | `TimeToFirstToken` (p90)       | opt-in, threshold required             |
+| `estimatedTpmQuotaUsage` | `EstimatedTPMQuotaUsage` (Max) | opt-in, `quota` required; 80% of quota |
+
+`invocationClientErrors` includes `AccessDenied`, so it catches an under-granted routing Region, which fails only for requests routed there. Missing data is not breaching. Defaults are exported as `MODEL_ALARM_DEFAULTS`.
+
+```ts
+createModelAlarmBuilder()
+  .model(haiku)
+  .recommendedAlarms({
+    invocationLatency: { threshold: 10_000 },
+    estimatedTpmQuotaUsage: { quota: 400_000 },
+  })
+  .addAlarm("outputTokens", (a) =>
+    a.metric((m) => m.metric("OutputTokenCount", { statistic: "Sum" })).threshold(1_000_000),
+  );
+```
+
+No alarm actions are configured; route them with `alarmActionsPolicy`.
+
+## Not yet covered
+
+- **Model invocation logging** ([GENSEC01-BP04](https://docs.aws.amazon.com/wellarchitected/latest/generative-ai-lens/gensec01-bp04.html)). An account-wide, per-Region setting with no CloudFormation resource.
+- **Guardrails** ([GENSEC02-BP01](https://docs.aws.amazon.com/wellarchitected/latest/generative-ai-lens/gensec02-bp01.html)).
+- **Application inference profiles**, for cost allocation tags.
+- **Private connectivity** ([GENSEC01-BP02](https://docs.aws.amazon.com/wellarchitected/latest/generative-ai-lens/gensec01-bp02.html)): a `bedrock-runtime` interface endpoint, built with `@composurecdk/ec2`.

package/dist/commonjs/grants.d.ts

@@ -0,0 +1,27 @@
+import { type IGrantable } from "aws-cdk-lib/aws-iam";
+import { type Grant, type Resolvable } from "@composurecdk/core";
+import { type InferenceTarget } from "./inference-target.js";
+/**
+ * Consumer-side grant helpers for invoking Amazon Bedrock models. Pass one to
+ * a grantee builder's `grant(...)` — e.g.
+ * `createFunctionBuilder().grant(modelGrants.invoke(profile))`.
+ *
+ * A model is not a construct, so there is no native `grant*` method to
+ * delegate to; the statements are those the Bedrock user guide prescribes
+ * (ADR-0013 addendum).
+ */
+export declare const modelGrants: {
+    /**
+     * Invoke the target through `InvokeModel`, `Converse` or their streaming
+     * variants.
+     *
+     * For a cross-Region profile this also grants the foundation model in the
+     * source Region and every Region the profile routes to, conditioned on
+     * `bedrock:InferenceProfileArn` so those models are reachable only through
+     * the profile.
+     *
+     * @see https://docs.aws.amazon.com/wellarchitected/latest/generative-ai-lens/gensec01-bp01.html
+     */
+    invoke: (target: Resolvable<InferenceTarget>) => Grant<IGrantable>;
+};
+//# sourceMappingURL=grants.d.ts.map

package/dist/commonjs/grants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"grants.d.ts","sourceRoot":"","sources":["../../src/grants.ts"],"names":[],"mappings":"AAAA,OAAO,EAAqB,KAAK,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACzE,OAAO,EAAE,KAAK,KAAK,EAAY,KAAK,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAC3E,OAAO,EAAE,KAAK,eAAe,EAAiC,MAAM,uBAAuB,CAAC;AAU5F;;;;;;;;GAQG;AACH,eAAO,MAAM,WAAW;IACtB;;;;;;;;;;OAUG;qBACc,UAAU,CAAC,eAAe,CAAC,KAAG,KAAK,CAAC,UAAU,CAAC;CAOjE,CAAC"}

package/dist/commonjs/grants.js

@@ -0,0 +1,42 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.modelGrants = void 0;
+const aws_iam_1 = require("aws-cdk-lib/aws-iam");
+const core_1 = require("@composurecdk/core");
+const inference_target_js_1 = require("./inference-target.js");
+/**
+ * Streaming operations (`InvokeModelWithResponseStream`, `ConverseStream`)
+ * require both actions.
+ *
+ * @see https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonbedrock.html
+ */
+const INVOKE_ACTIONS = ["bedrock:InvokeModel", "bedrock:InvokeModelWithResponseStream"];
+/**
+ * Consumer-side grant helpers for invoking Amazon Bedrock models. Pass one to
+ * a grantee builder's `grant(...)` — e.g.
+ * `createFunctionBuilder().grant(modelGrants.invoke(profile))`.
+ *
+ * A model is not a construct, so there is no native `grant*` method to
+ * delegate to; the statements are those the Bedrock user guide prescribes
+ * (ADR-0013 addendum).
+ */
+exports.modelGrants = {
+    /**
+     * Invoke the target through `InvokeModel`, `Converse` or their streaming
+     * variants.
+     *
+     * For a cross-Region profile this also grants the foundation model in the
+     * source Region and every Region the profile routes to, conditioned on
+     * `bedrock:InferenceProfileArn` so those models are reachable only through
+     * the profile.
+     *
+     * @see https://docs.aws.amazon.com/wellarchitected/latest/generative-ai-lens/gensec01-bp01.html
+     */
+    invoke: (target) => (0, core_1.grantVia)(target, (resolved, grantee) => {
+        const statements = (0, inference_target_js_1.invocationStatements)(resolved, (0, inference_target_js_1.scopeOf)(grantee.grantPrincipal));
+        for (const { resourceArns, conditions } of statements) {
+            aws_iam_1.Grant.addToPrincipal({ grantee, actions: INVOKE_ACTIONS, resourceArns, conditions });
+        }
+    }),
+};
+//# sourceMappingURL=grants.js.map

package/dist/commonjs/grants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"grants.js","sourceRoot":"","sources":["../../src/grants.ts"],"names":[],"mappings":";;;AAAA,iDAAyE;AACzE,6CAA2E;AAC3E,+DAA4F;AAE5F;;;;;GAKG;AACH,MAAM,cAAc,GAAG,CAAC,qBAAqB,EAAE,uCAAuC,CAAC,CAAC;AAExF;;;;;;;;GAQG;AACU,QAAA,WAAW,GAAG;IACzB;;;;;;;;;;OAUG;IACH,MAAM,EAAE,CAAC,MAAmC,EAAqB,EAAE,CACjE,IAAA,eAAQ,EAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,OAAmB,EAAE,EAAE;QACjD,MAAM,UAAU,GAAG,IAAA,0CAAoB,EAAC,QAAQ,EAAE,IAAA,6BAAO,EAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC;QACnF,KAAK,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,IAAI,UAAU,EAAE,CAAC;YACtD,eAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,UAAU,EAAE,CAAC,CAAC;QAC1F,CAAC;IACH,CAAC,CAAC;CACL,CAAC"}

package/dist/commonjs/index.d.ts

@@ -0,0 +1,8 @@
+export { foundationModelFor, type GeographicInferenceProfile, type GeographicInferenceProfileOptions, type GlobalInferenceProfile, INFERENCE_PROFILE_GEOGRAPHIES, type InferenceProfile, type InferenceProfileGeography, inferenceProfile, } from "./inference-profile.js";
+export { type InferenceTarget, invocationArns } from "./inference-target.js";
+export { modelGrants } from "./grants.js";
+export { createModelAlarmBuilder, type IModelAlarmBuilder, type ModelAlarmBuilderProps, type ModelAlarmBuilderResult, } from "./model-alarm-builder.js";
+export { type ModelAlarmConfig, type QuotaAlarmConfig } from "./model-alarm-config.js";
+export { MODEL_ALARM_DEFAULTS } from "./model-alarm-defaults.js";
+export { type ModelAlarmTarget, type ModelMetrics, modelMetrics } from "./model-alarms.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/commonjs/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kBAAkB,EAClB,KAAK,0BAA0B,EAC/B,KAAK,iCAAiC,EACtC,KAAK,sBAAsB,EAC3B,6BAA6B,EAC7B,KAAK,gBAAgB,EACrB,KAAK,yBAAyB,EAC9B,gBAAgB,GACjB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,KAAK,eAAe,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC7E,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EACL,uBAAuB,EACvB,KAAK,kBAAkB,EACvB,KAAK,sBAAsB,EAC3B,KAAK,uBAAuB,GAC7B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,KAAK,gBAAgB,EAAE,KAAK,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AACvF,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAE,KAAK,gBAAgB,EAAE,KAAK,YAAY,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC"}

package/dist/commonjs/index.js

@@ -0,0 +1,18 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.modelMetrics = exports.MODEL_ALARM_DEFAULTS = exports.createModelAlarmBuilder = exports.modelGrants = exports.invocationArns = exports.inferenceProfile = exports.INFERENCE_PROFILE_GEOGRAPHIES = exports.foundationModelFor = void 0;
+var inference_profile_js_1 = require("./inference-profile.js");
+Object.defineProperty(exports, "foundationModelFor", { enumerable: true, get: function () { return inference_profile_js_1.foundationModelFor; } });
+Object.defineProperty(exports, "INFERENCE_PROFILE_GEOGRAPHIES", { enumerable: true, get: function () { return inference_profile_js_1.INFERENCE_PROFILE_GEOGRAPHIES; } });
+Object.defineProperty(exports, "inferenceProfile", { enumerable: true, get: function () { return inference_profile_js_1.inferenceProfile; } });
+var inference_target_js_1 = require("./inference-target.js");
+Object.defineProperty(exports, "invocationArns", { enumerable: true, get: function () { return inference_target_js_1.invocationArns; } });
+var grants_js_1 = require("./grants.js");
+Object.defineProperty(exports, "modelGrants", { enumerable: true, get: function () { return grants_js_1.modelGrants; } });
+var model_alarm_builder_js_1 = require("./model-alarm-builder.js");
+Object.defineProperty(exports, "createModelAlarmBuilder", { enumerable: true, get: function () { return model_alarm_builder_js_1.createModelAlarmBuilder; } });
+var model_alarm_defaults_js_1 = require("./model-alarm-defaults.js");
+Object.defineProperty(exports, "MODEL_ALARM_DEFAULTS", { enumerable: true, get: function () { return model_alarm_defaults_js_1.MODEL_ALARM_DEFAULTS; } });
+var model_alarms_js_1 = require("./model-alarms.js");
+Object.defineProperty(exports, "modelMetrics", { enumerable: true, get: function () { return model_alarms_js_1.modelMetrics; } });
+//# sourceMappingURL=index.js.map

package/dist/commonjs/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":";;;AAAA,+DASgC;AAR9B,0HAAA,kBAAkB,OAAA;AAIlB,qIAAA,6BAA6B,OAAA;AAG7B,wHAAA,gBAAgB,OAAA;AAElB,6DAA6E;AAA9C,qHAAA,cAAc,OAAA;AAC7C,yCAA0C;AAAjC,wGAAA,WAAW,OAAA;AACpB,mEAKkC;AAJhC,iIAAA,uBAAuB,OAAA;AAMzB,qEAAiE;AAAxD,+HAAA,oBAAoB,OAAA;AAC7B,qDAA2F;AAAxC,+GAAA,YAAY,OAAA"}

package/dist/commonjs/inference-profile.d.ts

@@ -0,0 +1,88 @@
+import { FoundationModelIdentifier } from "aws-cdk-lib/aws-bedrock";
+/**
+ * Geography prefixes of Amazon Bedrock's system-defined cross-Region inference
+ * profiles, e.g. the `eu` in `eu.anthropic.claude-haiku-4-5-20251001-v1:0`.
+ *
+ * {@link inferenceProfile.parse} recognises a profile id by one of these
+ * prefixes. {@link inferenceProfile.geographic} also accepts a geography not
+ * yet listed here.
+ *
+ * @see https://docs.aws.amazon.com/bedrock/latest/userguide/geographic-cross-region-inference.html
+ */
+export declare const INFERENCE_PROFILE_GEOGRAPHIES: readonly ["us", "eu", "apac", "jp", "au", "us-gov"];
+/** A known geography prefix. See {@link INFERENCE_PROFILE_GEOGRAPHIES}. */
+export type InferenceProfileGeography = (typeof INFERENCE_PROFILE_GEOGRAPHIES)[number];
+/**
+ * A system-defined inference profile that routes requests to Regions within
+ * one geography.
+ *
+ * @see https://docs.aws.amazon.com/bedrock/latest/userguide/geographic-cross-region-inference.html
+ */
+export interface GeographicInferenceProfile {
+    readonly kind: "geographic";
+    readonly geography: InferenceProfileGeography | (string & {});
+    /** The foundation model the profile serves. */
+    readonly model: FoundationModelIdentifier;
+    /** The id to invoke, e.g. `eu.anthropic.claude-haiku-4-5-20251001-v1:0`. */
+    readonly profileId: string;
+    /**
+     * Every Region the profile may route to from the source Region, as listed
+     * by `aws bedrock get-inference-profile` or the model's page in the Bedrock
+     * user guide. The source Region is always granted, listed or not.
+     */
+    readonly routingRegions: readonly string[];
+}
+/**
+ * A system-defined inference profile that routes requests to any supported
+ * commercial Region.
+ *
+ * @see https://docs.aws.amazon.com/bedrock/latest/userguide/global-cross-region-inference.html
+ */
+export interface GlobalInferenceProfile {
+    readonly kind: "global";
+    /** The foundation model the profile serves. */
+    readonly model: FoundationModelIdentifier;
+    /** The id to invoke, e.g. `global.anthropic.claude-haiku-4-5-20251001-v1:0`. */
+    readonly profileId: string;
+}
+/** A system-defined cross-Region inference profile. */
+export type InferenceProfile = GeographicInferenceProfile | GlobalInferenceProfile;
+/** Options for {@link inferenceProfile.geographic}. */
+export type GeographicInferenceProfileOptions = Pick<GeographicInferenceProfile, "model" | "geography" | "routingRegions">;
+declare function geographic(options: GeographicInferenceProfileOptions): GeographicInferenceProfile;
+declare function global(model: FoundationModelIdentifier): GlobalInferenceProfile;
+declare function parse(profileId: string): GlobalInferenceProfile;
+declare function parse(profileId: string, routingRegions: readonly string[]): InferenceProfile;
+/**
+ * Factories for {@link InferenceProfile} values.
+ *
+ * @example
+ * ```ts
+ * const haiku = inferenceProfile.geographic({
+ *   model: FoundationModelIdentifier.ANTHROPIC_CLAUDE_HAIKU_4_5_20251001_V1_0,
+ *   geography: "eu",
+ *   routingRegions: ["eu-central-1", "eu-north-1", "eu-south-1", "eu-south-2", "eu-west-1", "eu-west-3"],
+ * });
+ * haiku.profileId; // "eu.anthropic.claude-haiku-4-5-20251001-v1:0"
+ * ```
+ */
+export declare const inferenceProfile: {
+    /** A profile routing within one geography. */
+    geographic: typeof geographic;
+    /** A profile routing to any supported commercial Region. */
+    global: typeof global;
+    /**
+     * Reads a profile id such as `eu.anthropic.claude-haiku-4-5-20251001-v1:0`.
+     * Throws unless the id starts with a known geography or `global`. A
+     * geographic id needs its `routingRegions`; a global id takes none.
+     */
+    parse: typeof parse;
+};
+/**
+ * The foundation model a system-defined inference profile serves:
+ * `eu.anthropic.x` → `anthropic.x`. Throws unless the id starts with a known
+ * geography or `global`.
+ */
+export declare function foundationModelFor(profileId: string): FoundationModelIdentifier;
+export {};
+//# sourceMappingURL=inference-profile.d.ts.map

package/dist/commonjs/inference-profile.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"inference-profile.d.ts","sourceRoot":"","sources":["../../src/inference-profile.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAC;AAEpE;;;;;;;;;GASG;AACH,eAAO,MAAM,6BAA6B,qDAAsD,CAAC;AAEjG,2EAA2E;AAC3E,MAAM,MAAM,yBAAyB,GAAG,CAAC,OAAO,6BAA6B,CAAC,CAAC,MAAM,CAAC,CAAC;AAIvF;;;;;GAKG;AACH,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,yBAAyB,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;IAC9D,+CAA+C;IAC/C,QAAQ,CAAC,KAAK,EAAE,yBAAyB,CAAC;IAC1C,4EAA4E;IAC5E,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;;;OAIG;IACH,QAAQ,CAAC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;CAC5C;AAED;;;;;GAKG;AACH,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,+CAA+C;IAC/C,QAAQ,CAAC,KAAK,EAAE,yBAAyB,CAAC;IAC1C,gFAAgF;IAChF,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,uDAAuD;AACvD,MAAM,MAAM,gBAAgB,GAAG,0BAA0B,GAAG,sBAAsB,CAAC;AAEnF,uDAAuD;AACvD,MAAM,MAAM,iCAAiC,GAAG,IAAI,CAClD,0BAA0B,EAC1B,OAAO,GAAG,WAAW,GAAG,gBAAgB,CACzC,CAAC;AA4CF,iBAAS,UAAU,CAAC,OAAO,EAAE,iCAAiC,GAAG,0BAA0B,CAiB1F;AAED,iBAAS,MAAM,CAAC,KAAK,EAAE,yBAAyB,GAAG,sBAAsB,CAGxE;AAaD,iBAAS,KAAK,CAAC,SAAS,EAAE,MAAM,GAAG,sBAAsB,CAAC;AAC1D,iBAAS,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,cAAc,EAAE,SAAS,MAAM,EAAE,GAAG,gBAAgB,CAAC;AAkBvF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,gBAAgB;IAC3B,8CAA8C;;IAE9C,4DAA4D;;IAE5D;;;;OAIG;;CAEJ,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,yBAAyB,CAE/E"}

package/dist/commonjs/inference-profile.js

@@ -0,0 +1,125 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.inferenceProfile = exports.INFERENCE_PROFILE_GEOGRAPHIES = void 0;
+exports.foundationModelFor = foundationModelFor;
+const aws_cdk_lib_1 = require("aws-cdk-lib");
+const aws_bedrock_1 = require("aws-cdk-lib/aws-bedrock");
+/**
+ * Geography prefixes of Amazon Bedrock's system-defined cross-Region inference
+ * profiles, e.g. the `eu` in `eu.anthropic.claude-haiku-4-5-20251001-v1:0`.
+ *
+ * {@link inferenceProfile.parse} recognises a profile id by one of these
+ * prefixes. {@link inferenceProfile.geographic} also accepts a geography not
+ * yet listed here.
+ *
+ * @see https://docs.aws.amazon.com/bedrock/latest/userguide/geographic-cross-region-inference.html
+ */
+exports.INFERENCE_PROFILE_GEOGRAPHIES = ["us", "eu", "apac", "jp", "au", "us-gov"];
+const GLOBAL_PREFIX = "global";
+const GEOGRAPHY_PATTERN = /^[a-z]+(-[a-z]+)*$/;
+const REGION_PATTERN = /^[a-z]{2}(-[a-z]+)+-\d+$/;
+function isProfilePrefix(prefix) {
+    return (prefix === GLOBAL_PREFIX ||
+        exports.INFERENCE_PROFILE_GEOGRAPHIES.includes(prefix));
+}
+function prefixOf(id) {
+    const dot = id.indexOf(".");
+    return dot > 0 ? id.slice(0, dot) : undefined;
+}
+function assertModel(model) {
+    const { modelId } = model;
+    if (aws_cdk_lib_1.Token.isUnresolved(modelId) || modelId === "") {
+        throw new Error("Inference profile model id must be a non-empty literal string.");
+    }
+    const prefix = prefixOf(modelId);
+    if (prefix !== undefined && isProfilePrefix(prefix)) {
+        throw new Error(`"${modelId}" is an inference profile id, not a foundation model id. ` +
+            `Use inferenceProfile.parse("${modelId}", …) instead.`);
+    }
+}
+function assertRoutingRegions(profileId, regions) {
+    if (regions.length === 0) {
+        throw new Error(`Inference profile "${profileId}": routingRegions must not be empty.`);
+    }
+    for (const region of regions) {
+        if (aws_cdk_lib_1.Token.isUnresolved(region) || !REGION_PATTERN.test(region)) {
+            throw new Error(`Inference profile "${profileId}": "${region}" is not a literal AWS Region code.`);
+        }
+    }
+}
+function geographic(options) {
+    const { model, geography } = options;
+    assertModel(model);
+    if (geography === GLOBAL_PREFIX || !GEOGRAPHY_PATTERN.test(geography)) {
+        throw new Error(`"${geography}" is not a geography prefix. Use inferenceProfile.global() for a global profile.`);
+    }
+    const profileId = `${geography}.${model.modelId}`;
+    assertRoutingRegions(profileId, options.routingRegions);
+    return Object.freeze({
+        kind: "geographic",
+        geography,
+        model,
+        profileId,
+        routingRegions: Object.freeze([...new Set(options.routingRegions)]),
+    });
+}
+function global(model) {
+    assertModel(model);
+    return Object.freeze({ kind: "global", model, profileId: `${GLOBAL_PREFIX}.${model.modelId}` });
+}
+function splitProfileId(profileId) {
+    const prefix = prefixOf(profileId);
+    if (prefix === undefined || !isProfilePrefix(prefix)) {
+        throw new Error(`"${profileId}" is not a system-defined inference profile id. Expected one of the ` +
+            `prefixes: ${[GLOBAL_PREFIX, ...exports.INFERENCE_PROFILE_GEOGRAPHIES].join(", ")}.`);
+    }
+    return { prefix, modelId: profileId.slice(prefix.length + 1) };
+}
+function parse(profileId, routingRegions) {
+    const { prefix, modelId } = splitProfileId(profileId);
+    const model = new aws_bedrock_1.FoundationModelIdentifier(modelId);
+    if (prefix === GLOBAL_PREFIX) {
+        if (routingRegions !== undefined) {
+            throw new Error(`Inference profile "${profileId}" is global and routes to every supported Region; omit routingRegions.`);
+        }
+        return global(model);
+    }
+    if (routingRegions === undefined) {
+        throw new Error(`Inference profile "${profileId}" is geographic and needs its routingRegions.`);
+    }
+    return geographic({ model, geography: prefix, routingRegions });
+}
+/**
+ * Factories for {@link InferenceProfile} values.
+ *
+ * @example
+ * ```ts
+ * const haiku = inferenceProfile.geographic({
+ *   model: FoundationModelIdentifier.ANTHROPIC_CLAUDE_HAIKU_4_5_20251001_V1_0,
+ *   geography: "eu",
+ *   routingRegions: ["eu-central-1", "eu-north-1", "eu-south-1", "eu-south-2", "eu-west-1", "eu-west-3"],
+ * });
+ * haiku.profileId; // "eu.anthropic.claude-haiku-4-5-20251001-v1:0"
+ * ```
+ */
+exports.inferenceProfile = {
+    /** A profile routing within one geography. */
+    geographic,
+    /** A profile routing to any supported commercial Region. */
+    global,
+    /**
+     * Reads a profile id such as `eu.anthropic.claude-haiku-4-5-20251001-v1:0`.
+     * Throws unless the id starts with a known geography or `global`. A
+     * geographic id needs its `routingRegions`; a global id takes none.
+     */
+    parse,
+};
+/**
+ * The foundation model a system-defined inference profile serves:
+ * `eu.anthropic.x` → `anthropic.x`. Throws unless the id starts with a known
+ * geography or `global`.
+ */
+function foundationModelFor(profileId) {
+    return new aws_bedrock_1.FoundationModelIdentifier(splitProfileId(profileId).modelId);
+}
+//# sourceMappingURL=inference-profile.js.map

package/dist/commonjs/inference-profile.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"inference-profile.js","sourceRoot":"","sources":["../../src/inference-profile.ts"],"names":[],"mappings":";;;AA+LA,gDAEC;AAjMD,6CAAoC;AACpC,yDAAoE;AAEpE;;;;;;;;;GASG;AACU,QAAA,6BAA6B,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAU,CAAC;AAKjG,MAAM,aAAa,GAAG,QAAQ,CAAC;AA8C/B,MAAM,iBAAiB,GAAG,oBAAoB,CAAC;AAC/C,MAAM,cAAc,GAAG,0BAA0B,CAAC;AAElD,SAAS,eAAe,CAAC,MAAc;IACrC,OAAO,CACL,MAAM,KAAK,aAAa;QACvB,qCAAmD,CAAC,QAAQ,CAAC,MAAM,CAAC,CACtE,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,EAAU;IAC1B,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC5B,OAAO,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAChD,CAAC;AAED,SAAS,WAAW,CAAC,KAAgC;IACnD,MAAM,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;IAC1B,IAAI,mBAAK,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,OAAO,KAAK,EAAE,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;IACpF,CAAC;IACD,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IACjC,IAAI,MAAM,KAAK,SAAS,IAAI,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CACb,IAAI,OAAO,2DAA2D;YACpE,+BAA+B,OAAO,gBAAgB,CACzD,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,SAAiB,EAAE,OAA0B;IACzE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,sBAAsB,SAAS,sCAAsC,CAAC,CAAC;IACzF,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,mBAAK,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YAC/D,MAAM,IAAI,KAAK,CACb,sBAAsB,SAAS,OAAO,MAAM,qCAAqC,CAClF,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,OAA0C;IAC5D,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC;IACrC,WAAW,CAAC,KAAK,CAAC,CAAC;IACnB,IAAI,SAAS,KAAK,aAAa,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QACtE,MAAM,IAAI,KAAK,CACb,IAAI,SAAS,kFAAkF,CAChG,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,GAAG,SAAS,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;IAClD,oBAAoB,CAAC,SAAS,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;IACxD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,IAAI,EAAE,YAAY;QAClB,SAAS;QACT,KAAK;QACL,SAAS;QACT,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC;KACpE,CAAC,CAAC;AACL,CAAC;AAED,SAAS,MAAM,CAAC,KAAgC;IAC9C,WAAW,CAAC,KAAK,CAAC,CAAC;IACnB,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,aAAa,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;AAClG,CAAC;AAED,SAAS,cAAc,CAAC,SAAiB;IACvC,MAAM,MAAM,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC;IACnC,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,KAAK,CACb,IAAI,SAAS,sEAAsE;YACjF,aAAa,CAAC,aAAa,EAAE,GAAG,qCAA6B,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAC/E,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC;AACjE,CAAC;AAID,SAAS,KAAK,CAAC,SAAiB,EAAE,cAAkC;IAClE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC;IACtD,MAAM,KAAK,GAAG,IAAI,uCAAyB,CAAC,OAAO,CAAC,CAAC;IACrD,IAAI,MAAM,KAAK,aAAa,EAAE,CAAC;QAC7B,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CACb,sBAAsB,SAAS,wEAAwE,CACxG,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IACD,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,sBAAsB,SAAS,+CAA+C,CAAC,CAAC;IAClG,CAAC;IACD,OAAO,UAAU,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;AAClE,CAAC;AAED;;;;;;;;;;;;GAYG;AACU,QAAA,gBAAgB,GAAG;IAC9B,8CAA8C;IAC9C,UAAU;IACV,4DAA4D;IAC5D,MAAM;IACN;;;;OAIG;IACH,KAAK;CACN,CAAC;AAEF;;;;GAIG;AACH,SAAgB,kBAAkB,CAAC,SAAiB;IAClD,OAAO,IAAI,uCAAyB,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,CAAC;AAC1E,CAAC"}

package/dist/commonjs/inference-target.d.ts

@@ -0,0 +1,41 @@
+import type { FoundationModelIdentifier, IModel } from "aws-cdk-lib/aws-bedrock";
+import { type IConstruct } from "constructs";
+import type { InferenceProfile } from "./inference-profile.js";
+/**
+ * Anything a caller can invoke: an in-Region foundation model, a
+ * system-defined inference profile, or any {@link IModel} (a provisioned
+ * model, or `{ modelArn }` for a model ARN from elsewhere).
+ */
+export type InferenceTarget = FoundationModelIdentifier | InferenceProfile | IModel;
+/** @internal */
+export declare function isInferenceProfile(target: InferenceTarget): target is InferenceProfile;
+/** One IAM statement's resources and conditions for invoking a target. @internal */
+export interface InvocationStatement {
+    readonly resourceArns: string[];
+    readonly conditions?: Record<string, Record<string, unknown>>;
+}
+/**
+ * The statements the Bedrock user guide prescribes for invoking `target` from
+ * the Region `scope` deploys to.
+ *
+ * @see https://docs.aws.amazon.com/bedrock/latest/userguide/geographic-cross-region-inference.html#geographic-cris-iam-setup
+ * @see https://docs.aws.amazon.com/bedrock/latest/userguide/global-cross-region-inference.html#global-cris-iam-setup
+ * @internal
+ */
+export declare function invocationStatements(target: InferenceTarget, scope?: IConstruct): InvocationStatement[];
+/**
+ * Every resource ARN a caller in `scope`'s Region must be allowed to invoke to
+ * use `target`. For a cross-Region profile that is the profile plus the
+ * foundation model in the source Region and in each Region it routes to.
+ *
+ * {@link modelGrants.invoke} applies these with the conditions the Bedrock
+ * user guide prescribes; use this list where you write a policy yourself,
+ * such as a service control policy.
+ *
+ * @param scope - Resolves partition, Region and account from its stack. Omit
+ *   for the `AWS::` pseudo-parameters.
+ */
+export declare function invocationArns(target: InferenceTarget, scope?: IConstruct): string[];
+/** @internal */
+export declare function scopeOf(principal: unknown): IConstruct | undefined;
+//# sourceMappingURL=inference-target.d.ts.map

package/dist/commonjs/inference-target.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"inference-target.d.ts","sourceRoot":"","sources":["../../src/inference-target.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AACjF,OAAO,EAAa,KAAK,UAAU,EAAE,MAAM,YAAY,CAAC;AACxD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAE/D;;;;GAIG;AACH,MAAM,MAAM,eAAe,GAAG,yBAAyB,GAAG,gBAAgB,GAAG,MAAM,CAAC;AAEpF,gBAAgB;AAChB,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,eAAe,GAAG,MAAM,IAAI,gBAAgB,CAEtF;AAMD,oFAAoF;AACpF,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAChC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CAC/D;AA4BD;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,eAAe,EACvB,KAAK,CAAC,EAAE,UAAU,GACjB,mBAAmB,EAAE,CAuDvB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,eAAe,EAAE,KAAK,CAAC,EAAE,UAAU,GAAG,MAAM,EAAE,CAEpF;AAED,gBAAgB;AAChB,wBAAgB,OAAO,CAAC,SAAS,EAAE,OAAO,GAAG,UAAU,GAAG,SAAS,CAElE"}

package/dist/commonjs/inference-target.js

@@ -0,0 +1,104 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isInferenceProfile = isInferenceProfile;
+exports.invocationStatements = invocationStatements;
+exports.invocationArns = invocationArns;
+exports.scopeOf = scopeOf;
+const aws_cdk_lib_1 = require("aws-cdk-lib");
+const constructs_1 = require("constructs");
+/** @internal */
+function isInferenceProfile(target) {
+    return "kind" in target;
+}
+function isModel(target) {
+    return "modelArn" in target;
+}
+function environmentOf(scope) {
+    return scope === undefined
+        ? { partition: aws_cdk_lib_1.Aws.PARTITION, region: aws_cdk_lib_1.Aws.REGION, account: aws_cdk_lib_1.Aws.ACCOUNT_ID }
+        : aws_cdk_lib_1.Stack.of(scope);
+}
+function bedrockArn(partition, resource, resourceName, region, account = "") {
+    return aws_cdk_lib_1.Arn.format({
+        partition,
+        service: "bedrock",
+        region,
+        account,
+        resource,
+        resourceName,
+        arnFormat: aws_cdk_lib_1.ArnFormat.SLASH_RESOURCE_NAME,
+    });
+}
+/**
+ * The statements the Bedrock user guide prescribes for invoking `target` from
+ * the Region `scope` deploys to.
+ *
+ * @see https://docs.aws.amazon.com/bedrock/latest/userguide/geographic-cross-region-inference.html#geographic-cris-iam-setup
+ * @see https://docs.aws.amazon.com/bedrock/latest/userguide/global-cross-region-inference.html#global-cris-iam-setup
+ * @internal
+ */
+function invocationStatements(target, scope) {
+    if (isModel(target))
+        return [{ resourceArns: [target.modelArn] }];
+    const { partition, region: sourceRegion, account } = environmentOf(scope);
+    const modelArn = (modelId, region) => bedrockArn(partition, "foundation-model", modelId, region);
+    if (!isInferenceProfile(target)) {
+        return [{ resourceArns: [modelArn(target.modelId, sourceRegion)] }];
+    }
+    const profileArn = bedrockArn(partition, "inference-profile", target.profileId, sourceRegion, account);
+    const { modelId } = target.model;
+    if (target.kind === "geographic") {
+        const regions = [...new Set([sourceRegion, ...target.routingRegions])];
+        return [
+            { resourceArns: [profileArn] },
+            {
+                resourceArns: regions.map((region) => modelArn(modelId, region)),
+                conditions: { StringEquals: { "bedrock:InferenceProfileArn": profileArn } },
+            },
+        ];
+    }
+    return [
+        {
+            resourceArns: [profileArn],
+            conditions: { StringEquals: { "aws:RequestedRegion": sourceRegion } },
+        },
+        {
+            resourceArns: [modelArn(modelId, sourceRegion)],
+            conditions: {
+                StringEquals: {
+                    "aws:RequestedRegion": sourceRegion,
+                    "bedrock:InferenceProfileArn": profileArn,
+                },
+            },
+        },
+        {
+            resourceArns: [modelArn(modelId, "")],
+            conditions: {
+                StringEquals: {
+                    "aws:RequestedRegion": "unspecified",
+                    "bedrock:InferenceProfileArn": profileArn,
+                },
+            },
+        },
+    ];
+}
+/**
+ * Every resource ARN a caller in `scope`'s Region must be allowed to invoke to
+ * use `target`. For a cross-Region profile that is the profile plus the
+ * foundation model in the source Region and in each Region it routes to.
+ *
+ * {@link modelGrants.invoke} applies these with the conditions the Bedrock
+ * user guide prescribes; use this list where you write a policy yourself,
+ * such as a service control policy.
+ *
+ * @param scope - Resolves partition, Region and account from its stack. Omit
+ *   for the `AWS::` pseudo-parameters.
+ */
+function invocationArns(target, scope) {
+    return invocationStatements(target, scope).flatMap((s) => s.resourceArns);
+}
+/** @internal */
+function scopeOf(principal) {
+    return constructs_1.Construct.isConstruct(principal) ? principal : undefined;
+}
+//# sourceMappingURL=inference-target.js.map

package/dist/commonjs/inference-target.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"inference-target.js","sourceRoot":"","sources":["../../src/inference-target.ts"],"names":[],"mappings":";;AAaA,gDAEC;AA8CD,oDA0DC;AAcD,wCAEC;AAGD,0BAEC;AA5ID,6CAAyD;AAEzD,2CAAwD;AAUxD,gBAAgB;AAChB,SAAgB,kBAAkB,CAAC,MAAuB;IACxD,OAAO,MAAM,IAAI,MAAM,CAAC;AAC1B,CAAC;AAED,SAAS,OAAO,CAAC,MAAuB;IACtC,OAAO,UAAU,IAAI,MAAM,CAAC;AAC9B,CAAC;AAUD,SAAS,aAAa,CAAC,KAA6B;IAClD,OAAO,KAAK,KAAK,SAAS;QACxB,CAAC,CAAC,EAAE,SAAS,EAAE,iBAAG,CAAC,SAAS,EAAE,MAAM,EAAE,iBAAG,CAAC,MAAM,EAAE,OAAO,EAAE,iBAAG,CAAC,UAAU,EAAE;QAC3E,CAAC,CAAC,mBAAK,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC;AACtB,CAAC;AAED,SAAS,UAAU,CACjB,SAAiB,EACjB,QAAgB,EAChB,YAAoB,EACpB,MAAc,EACd,OAAO,GAAG,EAAE;IAEZ,OAAO,iBAAG,CAAC,MAAM,CAAC;QAChB,SAAS;QACT,OAAO,EAAE,SAAS;QAClB,MAAM;QACN,OAAO;QACP,QAAQ;QACR,YAAY;QACZ,SAAS,EAAE,uBAAS,CAAC,mBAAmB;KACzC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,oBAAoB,CAClC,MAAuB,EACvB,KAAkB;IAElB,IAAI,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,CAAC,EAAE,YAAY,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAElE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IAC1E,MAAM,QAAQ,GAAG,CAAC,OAAe,EAAE,MAAc,EAAE,EAAE,CACnD,UAAU,CAAC,SAAS,EAAE,kBAAkB,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IAE7D,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC;QAChC,OAAO,CAAC,EAAE,YAAY,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,EAAE,CAAC,CAAC;IACtE,CAAC;IAED,MAAM,UAAU,GAAG,UAAU,CAC3B,SAAS,EACT,mBAAmB,EACnB,MAAM,CAAC,SAAS,EAChB,YAAY,EACZ,OAAO,CACR,CAAC;IACF,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC;IAEjC,IAAI,MAAM,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;QACjC,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,YAAY,EAAE,GAAG,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC;QACvE,OAAO;YACL,EAAE,YAAY,EAAE,CAAC,UAAU,CAAC,EAAE;YAC9B;gBACE,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;gBAChE,UAAU,EAAE,EAAE,YAAY,EAAE,EAAE,6BAA6B,EAAE,UAAU,EAAE,EAAE;aAC5E;SACF,CAAC;IACJ,CAAC;IAED,OAAO;QACL;YACE,YAAY,EAAE,CAAC,UAAU,CAAC;YAC1B,UAAU,EAAE,EAAE,YAAY,EAAE,EAAE,qBAAqB,EAAE,YAAY,EAAE,EAAE;SACtE;QACD;YACE,YAAY,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;YAC/C,UAAU,EAAE;gBACV,YAAY,EAAE;oBACZ,qBAAqB,EAAE,YAAY;oBACnC,6BAA6B,EAAE,UAAU;iBAC1C;aACF;SACF;QACD;YACE,YAAY,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YACrC,UAAU,EAAE;gBACV,YAAY,EAAE;oBACZ,qBAAqB,EAAE,aAAa;oBACpC,6BAA6B,EAAE,UAAU;iBAC1C;aACF;SACF;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAgB,cAAc,CAAC,MAAuB,EAAE,KAAkB;IACxE,OAAO,oBAAoB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;AAC5E,CAAC;AAED,gBAAgB;AAChB,SAAgB,OAAO,CAAC,SAAkB;IACxC,OAAO,sBAAS,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;AAClE,CAAC"}