@composurecdk/bedrock 0.11.1 → 0.12.0

package/dist/commonjs/inference-profile.js

@@ -1,6 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.inferenceProfile = exports.INFERENCE_PROFILE_GEOGRAPHIES = void 0;
+exports.idPrefix = idPrefix;
+exports.assertLiteralId = assertLiteralId;
 exports.foundationModelFor = foundationModelFor;
 const aws_cdk_lib_1 = require("aws-cdk-lib");
 const aws_bedrock_1 = require("aws-cdk-lib/aws-bedrock");
@@ -14,32 +16,48 @@ const aws_bedrock_1 = require("aws-cdk-lib/aws-bedrock");
  *
  * @see https://docs.aws.amazon.com/bedrock/latest/userguide/geographic-cross-region-inference.html
  */
-exports.INFERENCE_PROFILE_GEOGRAPHIES = ["us", "eu", "apac", "jp", "au", "us-gov"];
+exports.INFERENCE_PROFILE_GEOGRAPHIES = [
+    "us",
+    "eu",
+    "apac",
+    "jp",
+    "au",
+    "in",
+    "us-gov",
+];
 const GLOBAL_PREFIX = "global";
+const PROFILE_PREFIXES = [GLOBAL_PREFIX, ...exports.INFERENCE_PROFILE_GEOGRAPHIES];
 const GEOGRAPHY_PATTERN = /^[a-z]+(-[a-z]+)*$/;
 const REGION_PATTERN = /^[a-z]{2}(-[a-z]+)+-\d+$/;
-function isProfilePrefix(prefix) {
-    return (prefix === GLOBAL_PREFIX ||
-        exports.INFERENCE_PROFILE_GEOGRAPHIES.includes(prefix));
-}
-function prefixOf(id) {
+/**
+ * The segment of `id` before its first dot, and whether it marks a
+ * system-defined profile id. Undefined when `id` has no such segment.
+ * @internal
+ */
+function idPrefix(id) {
     const dot = id.indexOf(".");
-    return dot > 0 ? id.slice(0, dot) : undefined;
+    if (dot <= 0)
+        return undefined;
+    const prefix = id.slice(0, dot);
+    return { prefix, isProfile: PROFILE_PREFIXES.includes(prefix) };
+}
+/** Throws unless `id` is a non-empty literal string. @internal */
+function assertLiteralId(id, label) {
+    if (aws_cdk_lib_1.Token.isUnresolved(id) || id === "") {
+        throw new Error(`${label} must be a non-empty literal string.`);
+    }
 }
 function assertModel(model) {
     const { modelId } = model;
-    if (aws_cdk_lib_1.Token.isUnresolved(modelId) || modelId === "") {
-        throw new Error("Inference profile model id must be a non-empty literal string.");
-    }
-    const prefix = prefixOf(modelId);
-    if (prefix !== undefined && isProfilePrefix(prefix)) {
+    assertLiteralId(modelId, "Inference profile model id");
+    if (idPrefix(modelId)?.isProfile) {
         throw new Error(`"${modelId}" is an inference profile id, not a foundation model id. ` +
-            `Use inferenceProfile.parse("${modelId}", …) instead.`);
+            `Use inferenceProfile.parse("${modelId}") instead.`);
     }
 }
 function assertRoutingRegions(profileId, regions) {
     if (regions.length === 0) {
-        throw new Error(`Inference profile "${profileId}": routingRegions must not be empty.`);
+        throw new Error(`Inference profile "${profileId}": routingRegions must not be empty; omit it to grant every Region.`);
     }
     for (const region of regions) {
         if (aws_cdk_lib_1.Token.isUnresolved(region) || !REGION_PATTERN.test(region)) {
@@ -48,19 +66,20 @@ function assertRoutingRegions(profileId, regions) {
     }
 }
 function geographic(options) {
-    const { model, geography } = options;
+    const { model, geography, routingRegions } = options;
     assertModel(model);
     if (geography === GLOBAL_PREFIX || !GEOGRAPHY_PATTERN.test(geography)) {
         throw new Error(`"${geography}" is not a geography prefix. Use inferenceProfile.global() for a global profile.`);
     }
     const profileId = `${geography}.${model.modelId}`;
-    assertRoutingRegions(profileId, options.routingRegions);
+    if (routingRegions !== undefined)
+        assertRoutingRegions(profileId, routingRegions);
     return Object.freeze({
         kind: "geographic",
         geography,
         model,
         profileId,
-        routingRegions: Object.freeze([...new Set(options.routingRegions)]),
+        ...(routingRegions && { routingRegions: Object.freeze([...new Set(routingRegions)]) }),
     });
 }
 function global(model) {
@@ -68,11 +87,12 @@ function global(model) {
     return Object.freeze({ kind: "global", model, profileId: `${GLOBAL_PREFIX}.${model.modelId}` });
 }
 function splitProfileId(profileId) {
-    const prefix = prefixOf(profileId);
-    if (prefix === undefined || !isProfilePrefix(prefix)) {
+    const parsed = idPrefix(profileId);
+    if (!parsed?.isProfile) {
         throw new Error(`"${profileId}" is not a system-defined inference profile id. Expected one of the ` +
-            `prefixes: ${[GLOBAL_PREFIX, ...exports.INFERENCE_PROFILE_GEOGRAPHIES].join(", ")}.`);
+            `prefixes: ${PROFILE_PREFIXES.join(", ")}.`);
     }
+    const { prefix } = parsed;
     return { prefix, modelId: profileId.slice(prefix.length + 1) };
 }
 function parse(profileId, routingRegions) {
@@ -84,9 +104,6 @@ function parse(profileId, routingRegions) {
         }
         return global(model);
     }
-    if (routingRegions === undefined) {
-        throw new Error(`Inference profile "${profileId}" is geographic and needs its routingRegions.`);
-    }
     return geographic({ model, geography: prefix, routingRegions });
 }
 /**
@@ -97,7 +114,6 @@ function parse(profileId, routingRegions) {
  * const haiku = inferenceProfile.geographic({
  *   model: FoundationModelIdentifier.ANTHROPIC_CLAUDE_HAIKU_4_5_20251001_V1_0,
  *   geography: "eu",
- *   routingRegions: ["eu-central-1", "eu-north-1", "eu-south-1", "eu-south-2", "eu-west-1", "eu-west-3"],
  * });
  * haiku.profileId; // "eu.anthropic.claude-haiku-4-5-20251001-v1:0"
  * ```
@@ -110,7 +126,7 @@ exports.inferenceProfile = {
     /**
      * Reads a profile id such as `eu.anthropic.claude-haiku-4-5-20251001-v1:0`.
      * Throws unless the id starts with a known geography or `global`. A
-     * geographic id needs its `routingRegions`; a global id takes none.
+     * geographic id may take its `routingRegions`; a global id takes none.
      */
     parse,
 };

package/dist/commonjs/inference-profile.js.map

@@ -1 +1 @@
-{"version":3,"file":"inference-profile.js","sourceRoot":"","sources":["../../src/inference-profile.ts"],"names":[],"mappings":";;;AAmNA,gDAEC;AArND,6CAAoC;AACpC,yDAAoE;AAEpE;;;;;;;;;GASG;AACU,QAAA,6BAA6B,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAU,CAAC;AAKjG,MAAM,aAAa,GAAG,QAAQ,CAAC;AAkE/B,MAAM,iBAAiB,GAAG,oBAAoB,CAAC;AAC/C,MAAM,cAAc,GAAG,0BAA0B,CAAC;AAElD,SAAS,eAAe,CAAC,MAAc;IACrC,OAAO,CACL,MAAM,KAAK,aAAa;QACvB,qCAAmD,CAAC,QAAQ,CAAC,MAAM,CAAC,CACtE,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,EAAU;IAC1B,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC5B,OAAO,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAChD,CAAC;AAED,SAAS,WAAW,CAAC,KAAgC;IACnD,MAAM,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;IAC1B,IAAI,mBAAK,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,OAAO,KAAK,EAAE,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;IACpF,CAAC;IACD,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IACjC,IAAI,MAAM,KAAK,SAAS,IAAI,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CACb,IAAI,OAAO,2DAA2D;YACpE,+BAA+B,OAAO,gBAAgB,CACzD,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,SAAiB,EAAE,OAA0B;IACzE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,sBAAsB,SAAS,sCAAsC,CAAC,CAAC;IACzF,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,mBAAK,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YAC/D,MAAM,IAAI,KAAK,CACb,sBAAsB,SAAS,OAAO,MAAM,qCAAqC,CAClF,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,OAA0C;IAC5D,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC;IACrC,WAAW,CAAC,KAAK,CAAC,CAAC;IACnB,IAAI,SAAS,KAAK,aAAa,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QACtE,MAAM,IAAI,KAAK,CACb,IAAI,SAAS,kFAAkF,CAChG,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,GAAG,SAAS,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;IAClD,oBAAoB,CAAC,SAAS,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;IACxD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,IAAI,EAAE,YAAY;QAClB,SAAS;QACT,KAAK;QACL,SAAS;QACT,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC;KACpE,CAAC,CAAC;AACL,CAAC;AAED,SAAS,MAAM,CAAC,KAAgC;IAC9C,WAAW,CAAC,KAAK,CAAC,CAAC;IACnB,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,aAAa,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;AAClG,CAAC;AAED,SAAS,cAAc,CAAC,SAAiB;IACvC,MAAM,MAAM,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC;IACnC,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,KAAK,CACb,IAAI,SAAS,sEAAsE;YACjF,aAAa,CAAC,aAAa,EAAE,GAAG,qCAA6B,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAC/E,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC;AACjE,CAAC;AAID,SAAS,KAAK,CAAC,SAAiB,EAAE,cAAkC;IAClE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC;IACtD,MAAM,KAAK,GAAG,IAAI,uCAAyB,CAAC,OAAO,CAAC,CAAC;IACrD,IAAI,MAAM,KAAK,aAAa,EAAE,CAAC;QAC7B,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CACb,sBAAsB,SAAS,wEAAwE,CACxG,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IACD,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,sBAAsB,SAAS,+CAA+C,CAAC,CAAC;IAClG,CAAC;IACD,OAAO,UAAU,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;AAClE,CAAC;AAED;;;;;;;;;;;;GAYG;AACU,QAAA,gBAAgB,GAAG;IAC9B,8CAA8C;IAC9C,UAAU;IACV,4DAA4D;IAC5D,MAAM;IACN;;;;OAIG;IACH,KAAK;CACN,CAAC;AAEF;;;;GAIG;AACH,SAAgB,kBAAkB,CAAC,SAAiB;IAClD,OAAO,IAAI,uCAAyB,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,CAAC;AAC1E,CAAC"}
+{"version":3,"file":"inference-profile.js","sourceRoot":"","sources":["../../src/inference-profile.ts"],"names":[],"mappings":";;;AA6GA,4BAKC;AAGD,0CAIC;AA4GD,gDAEC;AAvOD,6CAAoC;AACpC,yDAAoE;AAEpE;;;;;;;;;GASG;AACU,QAAA,6BAA6B,GAAG;IAC3C,IAAI;IACJ,IAAI;IACJ,MAAM;IACN,IAAI;IACJ,IAAI;IACJ,IAAI;IACJ,QAAQ;CACA,CAAC;AAKX,MAAM,aAAa,GAAG,QAAQ,CAAC;AAE/B,MAAM,gBAAgB,GAAsB,CAAC,aAAa,EAAE,GAAG,qCAA6B,CAAC,CAAC;AAyE9F,MAAM,iBAAiB,GAAG,oBAAoB,CAAC;AAC/C,MAAM,cAAc,GAAG,0BAA0B,CAAC;AAElD;;;;GAIG;AACH,SAAgB,QAAQ,CAAC,EAAU;IACjC,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC5B,IAAI,GAAG,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IAC/B,MAAM,MAAM,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAChC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,gBAAgB,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;AAClE,CAAC;AAED,kEAAkE;AAClE,SAAgB,eAAe,CAAC,EAAU,EAAE,KAAa;IACvD,IAAI,mBAAK,CAAC,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,sCAAsC,CAAC,CAAC;IAClE,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,KAAgC;IACnD,MAAM,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;IAC1B,eAAe,CAAC,OAAO,EAAE,4BAA4B,CAAC,CAAC;IACvD,IAAI,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CACb,IAAI,OAAO,2DAA2D;YACpE,+BAA+B,OAAO,aAAa,CACtD,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,SAAiB,EAAE,OAA0B;IACzE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CACb,sBAAsB,SAAS,qEAAqE,CACrG,CAAC;IACJ,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,mBAAK,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YAC/D,MAAM,IAAI,KAAK,CACb,sBAAsB,SAAS,OAAO,MAAM,qCAAqC,CAClF,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,OAA0C;IAC5D,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,GAAG,OAAO,CAAC;IACrD,WAAW,CAAC,KAAK,CAAC,CAAC;IACnB,IAAI,SAAS,KAAK,aAAa,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QACtE,MAAM,IAAI,KAAK,CACb,IAAI,SAAS,kFAAkF,CAChG,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,GAAG,SAAS,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;IAClD,IAAI,cAAc,KAAK,SAAS;QAAE,oBAAoB,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;IAClF,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,IAAI,EAAE,YAAY;QAClB,SAAS;QACT,KAAK;QACL,SAAS;QACT,GAAG,CAAC,cAAc,IAAI,EAAE,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC;KACvF,CAAC,CAAC;AACL,CAAC;AAED,SAAS,MAAM,CAAC,KAAgC;IAC9C,WAAW,CAAC,KAAK,CAAC,CAAC;IACnB,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,aAAa,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;AAClG,CAAC;AAED,SAAS,cAAc,CAAC,SAAiB;IACvC,MAAM,MAAM,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC;IACnC,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,IAAI,SAAS,sEAAsE;YACjF,aAAa,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAC9C,CAAC;IACJ,CAAC;IACD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC;IAC1B,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC;AACjE,CAAC;AAED,SAAS,KAAK,CAAC,SAAiB,EAAE,cAAkC;IAClE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC;IACtD,MAAM,KAAK,GAAG,IAAI,uCAAyB,CAAC,OAAO,CAAC,CAAC;IACrD,IAAI,MAAM,KAAK,aAAa,EAAE,CAAC;QAC7B,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CACb,sBAAsB,SAAS,wEAAwE,CACxG,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,UAAU,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;AAClE,CAAC;AAED;;;;;;;;;;;GAWG;AACU,QAAA,gBAAgB,GAAG;IAC9B,8CAA8C;IAC9C,UAAU;IACV,4DAA4D;IAC5D,MAAM;IACN;;;;OAIG;IACH,KAAK;CACN,CAAC;AAEF;;;;GAIG;AACH,SAAgB,kBAAkB,CAAC,SAAiB;IAClD,OAAO,IAAI,uCAAyB,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,CAAC;AAC1E,CAAC"}

package/dist/commonjs/inference-target.d.ts

@@ -1,6 +1,6 @@
-import type { FoundationModelIdentifier, IModel } from "aws-cdk-lib/aws-bedrock";
+import { FoundationModelIdentifier, type IModel } from "aws-cdk-lib/aws-bedrock";
 import { type IConstruct } from "constructs";
-import type { ApplicationInferenceProfile, InferenceProfile } from "./inference-profile.js";
+import { type ApplicationInferenceProfile, type InferenceProfile } from "./inference-profile.js";
 /**
  * Anything a caller can invoke: an in-Region foundation model, a
  * system-defined or application inference profile, or any {@link IModel} (a
@@ -17,7 +17,9 @@ export interface InvocationStatement {
 /**
  * The statements for invoking `target` from the Region `scope` deploys to:
  * those the Bedrock user guide prescribes, and for an application profile the
- * shape verified against live IAM.
+ * shape verified against live IAM. A geographic profile without
+ * `routingRegions` grants the model in every Region rather than an
+ * enumerated list, still only through the profile (#628).
  *
  * @see https://docs.aws.amazon.com/bedrock/latest/userguide/geographic-cross-region-inference.html#geographic-cris-iam-setup
  * @see https://docs.aws.amazon.com/bedrock/latest/userguide/global-cross-region-inference.html#global-cris-iam-setup
@@ -37,7 +39,9 @@ export declare function sourceArn(source: FoundationModelIdentifier | InferenceP
  *
  * {@link modelGrants.invoke} applies these with the conditions the Bedrock
  * user guide prescribes; use this list where you write a policy yourself,
- * such as a service control policy.
+ * such as a service control policy. A geographic profile without
+ * `routingRegions` yields one Region-wildcard model ARN, so list the Regions
+ * on the profile when the policy must name each one.
  *
  * @param scope - Resolves partition, Region and account from its stack. Omit
  *   for the `AWS::` pseudo-parameters.
@@ -45,4 +49,38 @@ export declare function sourceArn(source: FoundationModelIdentifier | InferenceP
 export declare function invocationArns(target: InferenceTarget, scope?: IConstruct): string[];
 /** @internal */
 export declare function scopeOf(principal: unknown): IConstruct | undefined;
+/** Options for {@link inferenceTarget.fromId}. */
+export interface InferenceTargetIdOptions {
+    /** For a geographic profile id: see {@link GeographicInferenceProfile.routingRegions}. */
+    readonly routingRegions?: readonly string[];
+}
+/**
+ * Resolves an id that arrives as a string, such as from configuration, to the
+ * target it names:
+ *
+ * - `anthropic.claude-…` → a `FoundationModelIdentifier`;
+ * - `eu.anthropic.claude-…` or `global.anthropic.claude-…` → a system-defined
+ *   profile, via {@link inferenceProfile.parse};
+ * - a provisioned-model ARN → `{ modelArn }`.
+ *
+ * A two-segment id with an unknown first segment throws rather than being
+ * taken for a model named after a geography. A system-defined or application
+ * profile ARN throws too: the model it routes to cannot be read from it, and
+ * a grant on the ARN alone would be incomplete. Pass the profile value instead.
+ */
+declare function fromId(id: string, options?: InferenceTargetIdOptions): InferenceTarget;
+/**
+ * Factories for {@link InferenceTarget} values.
+ *
+ * @example
+ * ```ts
+ * const ids = ["anthropic.claude-sonnet-5-5", "us.anthropic.claude-haiku-4-5-20251001-v1:0"];
+ * createFunctionBuilder().grant(...ids.map((id) => modelGrants.invoke(inferenceTarget.fromId(id))));
+ * ```
+ */
+export declare const inferenceTarget: {
+    /** Resolves a model id, system-defined profile id or provisioned-model ARN. */
+    fromId: typeof fromId;
+};
+export {};
 //# sourceMappingURL=inference-target.d.ts.map

package/dist/commonjs/inference-target.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"inference-target.d.ts","sourceRoot":"","sources":["../../src/inference-target.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AACjF,OAAO,EAAa,KAAK,UAAU,EAAE,MAAM,YAAY,CAAC;AACxD,OAAO,KAAK,EAAE,2BAA2B,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAE5F;;;;GAIG;AACH,MAAM,MAAM,eAAe,GACzB,yBAAyB,GAAG,gBAAgB,GAAG,2BAA2B,GAAG,MAAM,CAAC;AAEtF,gBAAgB;AAChB,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,eAAe,GAAG,MAAM,IAAI,gBAAgB,CAEtF;AAUD,oFAAoF;AACpF,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAChC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CAC/D;AA4BD;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,eAAe,EACvB,KAAK,CAAC,EAAE,UAAU,GACjB,mBAAmB,EAAE,CASvB;AA4DD;;;GAGG;AACH,wBAAgB,SAAS,CACvB,MAAM,EAAE,yBAAyB,GAAG,gBAAgB,EACpD,KAAK,EAAE,UAAU,GAAG,SAAS,GAC5B,MAAM,CAKR;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,eAAe,EAAE,KAAK,CAAC,EAAE,UAAU,GAAG,MAAM,EAAE,CAEpF;AAED,gBAAgB;AAChB,wBAAgB,OAAO,CAAC,SAAS,EAAE,OAAO,GAAG,UAAU,GAAG,SAAS,CAElE"}
+{"version":3,"file":"inference-target.d.ts","sourceRoot":"","sources":["../../src/inference-target.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,KAAK,MAAM,EAAE,MAAM,yBAAyB,CAAC;AACjF,OAAO,EAAa,KAAK,UAAU,EAAE,MAAM,YAAY,CAAC;AAExD,OAAO,EACL,KAAK,2BAA2B,EAChC,KAAK,gBAAgB,EAKtB,MAAM,wBAAwB,CAAC;AAEhC;;;;GAIG;AACH,MAAM,MAAM,eAAe,GACzB,yBAAyB,GAAG,gBAAgB,GAAG,2BAA2B,GAAG,MAAM,CAAC;AAEtF,gBAAgB;AAChB,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,eAAe,GAAG,MAAM,IAAI,gBAAgB,CAEtF;AAUD,oFAAoF;AACpF,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAChC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CAC/D;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,eAAe,EACvB,KAAK,CAAC,EAAE,UAAU,GACjB,mBAAmB,EAAE,CASvB;AA6DD;;;GAGG;AACH,wBAAgB,SAAS,CACvB,MAAM,EAAE,yBAAyB,GAAG,gBAAgB,EACpD,KAAK,EAAE,UAAU,GAAG,SAAS,GAC5B,MAAM,CAKR;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,eAAe,EAAE,KAAK,CAAC,EAAE,UAAU,GAAG,MAAM,EAAE,CAEpF;AAED,gBAAgB;AAChB,wBAAgB,OAAO,CAAC,SAAS,EAAE,OAAO,GAAG,UAAU,GAAG,SAAS,CAElE;AAED,kDAAkD;AAClD,MAAM,WAAW,wBAAwB;IACvC,0FAA0F;IAC1F,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC7C;AAID;;;;;;;;;;;;;GAaG;AACH,iBAAS,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,GAAE,wBAA6B,GAAG,eAAe,CA6BnF;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,eAAe;IAC1B,+EAA+E;;CAEhF,CAAC"}

package/dist/commonjs/inference-target.js

@@ -1,12 +1,15 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.inferenceTarget = void 0;
 exports.isInferenceProfile = isInferenceProfile;
 exports.invocationStatements = invocationStatements;
 exports.sourceArn = sourceArn;
 exports.invocationArns = invocationArns;
 exports.scopeOf = scopeOf;
-const aws_cdk_lib_1 = require("aws-cdk-lib");
+const aws_bedrock_1 = require("aws-cdk-lib/aws-bedrock");
 const constructs_1 = require("constructs");
+const arn_js_1 = require("./arn.js");
+const inference_profile_js_1 = require("./inference-profile.js");
 /** @internal */
 function isInferenceProfile(target) {
     return "kind" in target && (target.kind === "geographic" || target.kind === "global");
@@ -17,26 +20,12 @@ function isApplicationProfile(target) {
 function isModel(target) {
     return "modelArn" in target;
 }
-function environmentOf(scope) {
-    return scope === undefined
-        ? { partition: aws_cdk_lib_1.Aws.PARTITION, region: aws_cdk_lib_1.Aws.REGION, account: aws_cdk_lib_1.Aws.ACCOUNT_ID }
-        : aws_cdk_lib_1.Stack.of(scope);
-}
-function bedrockArn(partition, resource, resourceName, region, account = "") {
-    return aws_cdk_lib_1.Arn.format({
-        partition,
-        service: "bedrock",
-        region,
-        account,
-        resource,
-        resourceName,
-        arnFormat: aws_cdk_lib_1.ArnFormat.SLASH_RESOURCE_NAME,
-    });
-}
 /**
  * The statements for invoking `target` from the Region `scope` deploys to:
  * those the Bedrock user guide prescribes, and for an application profile the
- * shape verified against live IAM.
+ * shape verified against live IAM. A geographic profile without
+ * `routingRegions` grants the model in every Region rather than an
+ * enumerated list, still only through the profile (#628).
  *
  * @see https://docs.aws.amazon.com/bedrock/latest/userguide/geographic-cross-region-inference.html#geographic-cris-iam-setup
  * @see https://docs.aws.amazon.com/bedrock/latest/userguide/global-cross-region-inference.html#global-cris-iam-setup
@@ -60,8 +49,8 @@ function invocationStatements(target, scope) {
  * itself (verified live for a global source), so none is granted.
  */
 function sourceStatements(target, scope, viaProfile) {
-    const { partition, region: sourceRegion } = environmentOf(scope);
-    const modelArn = (modelId, region) => bedrockArn(partition, "foundation-model", modelId, region);
+    const { partition, region: sourceRegion } = (0, arn_js_1.environmentOf)(scope);
+    const modelArn = (modelId, region) => (0, arn_js_1.bedrockArn)(partition, "foundation-model", modelId, region);
     const through = (arn) => ({ "bedrock:InferenceProfileArn": arn });
     if (!isInferenceProfile(target)) {
         return [
@@ -83,7 +72,9 @@ function sourceStatements(target, scope, viaProfile) {
     const models = target.kind === "geographic"
         ? [
             {
-                resourceArns: [...new Set([sourceRegion, ...target.routingRegions])].map((region) => modelArn(modelId, region)),
+                resourceArns: (target.routingRegions
+                    ? [...new Set([sourceRegion, ...target.routingRegions])]
+                    : ["*"]).map((region) => modelArn(modelId, region)),
                 conditions: { StringEquals: via },
             },
         ]
@@ -104,10 +95,10 @@ function sourceStatements(target, scope, viaProfile) {
  * or the system-defined profile. @internal
  */
 function sourceArn(source, scope) {
-    const { partition, region, account } = environmentOf(scope);
+    const { partition, region, account } = (0, arn_js_1.environmentOf)(scope);
     return isInferenceProfile(source)
-        ? bedrockArn(partition, "inference-profile", source.profileId, region, account)
-        : bedrockArn(partition, "foundation-model", source.modelId, region);
+        ? (0, arn_js_1.bedrockArn)(partition, "inference-profile", source.profileId, region, account)
+        : (0, arn_js_1.bedrockArn)(partition, "foundation-model", source.modelId, region);
 }
 /**
  * Every resource ARN a caller in `scope`'s Region must be allowed to invoke to
@@ -117,7 +108,9 @@ function sourceArn(source, scope) {
  *
  * {@link modelGrants.invoke} applies these with the conditions the Bedrock
  * user guide prescribes; use this list where you write a policy yourself,
- * such as a service control policy.
+ * such as a service control policy. A geographic profile without
+ * `routingRegions` yields one Region-wildcard model ARN, so list the Regions
+ * on the profile when the policy must name each one.
  *
  * @param scope - Resolves partition, Region and account from its stack. Omit
  *   for the `AWS::` pseudo-parameters.
@@ -129,4 +122,58 @@ function invocationArns(target, scope) {
 function scopeOf(principal) {
     return constructs_1.Construct.isConstruct(principal) ? principal : undefined;
 }
+const PROVISIONED_MODEL_ARN = ":provisioned-model/";
+/**
+ * Resolves an id that arrives as a string, such as from configuration, to the
+ * target it names:
+ *
+ * - `anthropic.claude-…` → a `FoundationModelIdentifier`;
+ * - `eu.anthropic.claude-…` or `global.anthropic.claude-…` → a system-defined
+ *   profile, via {@link inferenceProfile.parse};
+ * - a provisioned-model ARN → `{ modelArn }`.
+ *
+ * A two-segment id with an unknown first segment throws rather than being
+ * taken for a model named after a geography. A system-defined or application
+ * profile ARN throws too: the model it routes to cannot be read from it, and
+ * a grant on the ARN alone would be incomplete. Pass the profile value instead.
+ */
+function fromId(id, options = {}) {
+    (0, inference_profile_js_1.assertLiteralId)(id, "Inference target id");
+    if (id.startsWith("arn:")) {
+        if (id.includes(PROVISIONED_MODEL_ARN))
+            return { modelArn: id };
+        throw new Error(`"${id}" is an ARN. inferenceTarget.fromId resolves foundation-model and system-defined ` +
+            `profile ids, and provisioned-model ARNs. For an inference profile pass its id, or an ` +
+            `ApplicationInferenceProfile value, so the model it routes to is granted as well.`);
+    }
+    const parsed = (0, inference_profile_js_1.idPrefix)(id);
+    if (!parsed) {
+        throw new Error(`"${id}" is not a foundation model or inference profile id.`);
+    }
+    const { prefix, isProfile } = parsed;
+    if (isProfile)
+        return inference_profile_js_1.inferenceProfile.parse(id, options.routingRegions);
+    if (id.includes(".", prefix.length + 1)) {
+        throw new Error(`"${id}" looks like an inference profile id, but "${prefix}" is neither global nor one ` +
+            `of INFERENCE_PROFILE_GEOGRAPHIES (${inference_profile_js_1.INFERENCE_PROFILE_GEOGRAPHIES.join(", ")}). ` +
+            `For a new geography use inferenceProfile.geographic().`);
+    }
+    if (options.routingRegions !== undefined) {
+        throw new Error(`"${id}" is a foundation model id; routingRegions apply to a geographic profile.`);
+    }
+    return new aws_bedrock_1.FoundationModelIdentifier(id);
+}
+/**
+ * Factories for {@link InferenceTarget} values.
+ *
+ * @example
+ * ```ts
+ * const ids = ["anthropic.claude-sonnet-5-5", "us.anthropic.claude-haiku-4-5-20251001-v1:0"];
+ * createFunctionBuilder().grant(...ids.map((id) => modelGrants.invoke(inferenceTarget.fromId(id))));
+ * ```
+ */
+exports.inferenceTarget = {
+    /** Resolves a model id, system-defined profile id or provisioned-model ARN. */
+    fromId,
+};
 //# sourceMappingURL=inference-target.js.map

package/dist/commonjs/inference-target.js.map

@@ -1 +1 @@
-{"version":3,"file":"inference-target.js","sourceRoot":"","sources":["../../src/inference-target.ts"],"names":[],"mappings":";;AAcA,gDAEC;AAmDD,oDAYC;AAgED,8BAQC;AAeD,wCAEC;AAGD,0BAEC;AA7KD,6CAAyD;AAEzD,2CAAwD;AAWxD,gBAAgB;AAChB,SAAgB,kBAAkB,CAAC,MAAuB;IACxD,OAAO,MAAM,IAAI,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,YAAY,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;AACxF,CAAC;AAED,SAAS,oBAAoB,CAAC,MAAuB;IACnD,OAAO,MAAM,IAAI,MAAM,IAAI,MAAM,CAAC,IAAI,KAAK,aAAa,CAAC;AAC3D,CAAC;AAED,SAAS,OAAO,CAAC,MAAuB;IACtC,OAAO,UAAU,IAAI,MAAM,CAAC;AAC9B,CAAC;AAUD,SAAS,aAAa,CAAC,KAA6B;IAClD,OAAO,KAAK,KAAK,SAAS;QACxB,CAAC,CAAC,EAAE,SAAS,EAAE,iBAAG,CAAC,SAAS,EAAE,MAAM,EAAE,iBAAG,CAAC,MAAM,EAAE,OAAO,EAAE,iBAAG,CAAC,UAAU,EAAE;QAC3E,CAAC,CAAC,mBAAK,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC;AACtB,CAAC;AAED,SAAS,UAAU,CACjB,SAAiB,EACjB,QAAgB,EAChB,YAAoB,EACpB,MAAc,EACd,OAAO,GAAG,EAAE;IAEZ,OAAO,iBAAG,CAAC,MAAM,CAAC;QAChB,SAAS;QACT,OAAO,EAAE,SAAS;QAClB,MAAM;QACN,OAAO;QACP,QAAQ;QACR,YAAY;QACZ,SAAS,EAAE,uBAAS,CAAC,mBAAmB;KACzC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;GAQG;AACH,SAAgB,oBAAoB,CAClC,MAAuB,EACvB,KAAkB;IAElB,IAAI,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,CAAC,EAAE,YAAY,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAClE,IAAI,oBAAoB,CAAC,MAAM,CAAC,EAAE,CAAC;QACjC,OAAO;YACL,EAAE,YAAY,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE;YACrC,GAAG,gBAAgB,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,UAAU,CAAC;SAC7D,CAAC;IACJ,CAAC;IACD,OAAO,gBAAgB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;AACzC,CAAC;AAED;;;;;GAKG;AACH,SAAS,gBAAgB,CACvB,MAAoD,EACpD,KAA6B,EAC7B,UAAmB;IAEnB,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACjE,MAAM,QAAQ,GAAG,CAAC,OAAe,EAAE,MAAc,EAAE,EAAE,CACnD,UAAU,CAAC,SAAS,EAAE,kBAAkB,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IAC7D,MAAM,OAAO,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,CAAC,EAAE,6BAA6B,EAAE,GAAG,EAAE,CAAC,CAAC;IAE1E,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC;QAChC,OAAO;YACL;gBACE,YAAY,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;gBACtD,GAAG,CAAC,UAAU,IAAI,EAAE,UAAU,EAAE,EAAE,YAAY,EAAE,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;aACzE;SACF,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC5C,MAAM,GAAG,GAAG,OAAO,CAAC,UAAU,IAAI,UAAU,CAAC,CAAC;IAC9C,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC;IAEjC,MAAM,UAAU,GAAwB;QACtC,YAAY,EAAE,CAAC,UAAU,CAAC;QAC1B,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI;YAC9B,UAAU,EAAE,EAAE,YAAY,EAAE,EAAE,qBAAqB,EAAE,YAAY,EAAE,EAAE;SACtE,CAAC;KACH,CAAC;IACF,MAAM,MAAM,GACV,MAAM,CAAC,IAAI,KAAK,YAAY;QAC1B,CAAC,CAAC;YACE;gBACE,YAAY,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,YAAY,EAAE,GAAG,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAClF,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,CAC1B;gBACD,UAAU,EAAE,EAAE,YAAY,EAAE,GAAG,EAAE;aAClC;SACF;QACH,CAAC,CAAC;YACE;gBACE,YAAY,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;gBAC/C,UAAU,EAAE,EAAE,YAAY,EAAE,EAAE,qBAAqB,EAAE,YAAY,EAAE,GAAG,GAAG,EAAE,EAAE;aAC9E;YACD;gBACE,YAAY,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;gBACrC,UAAU,EAAE,EAAE,YAAY,EAAE,EAAE,qBAAqB,EAAE,aAAa,EAAE,GAAG,GAAG,EAAE,EAAE;aAC/E;SACF,CAAC;IACR,OAAO,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,GAAG,MAAM,CAAC,CAAC;AACvD,CAAC;AAED;;;GAGG;AACH,SAAgB,SAAS,CACvB,MAAoD,EACpD,KAA6B;IAE7B,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IAC5D,OAAO,kBAAkB,CAAC,MAAM,CAAC;QAC/B,CAAC,CAAC,UAAU,CAAC,SAAS,EAAE,mBAAmB,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC;QAC/E,CAAC,CAAC,UAAU,CAAC,SAAS,EAAE,kBAAkB,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;AACxE,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAgB,cAAc,CAAC,MAAuB,EAAE,KAAkB;IACxE,OAAO,oBAAoB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;AAC5E,CAAC;AAED,gBAAgB;AAChB,SAAgB,OAAO,CAAC,SAAkB;IACxC,OAAO,sBAAS,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;AAClE,CAAC"}
+{"version":3,"file":"inference-target.js","sourceRoot":"","sources":["../../src/inference-target.ts"],"names":[],"mappings":";;;AAqBA,gDAEC;AA2BD,oDAYC;AAiED,8BAQC;AAiBD,wCAEC;AAGD,0BAEC;AA/JD,yDAAiF;AACjF,2CAAwD;AACxD,qCAAqD;AACrD,iEAOgC;AAUhC,gBAAgB;AAChB,SAAgB,kBAAkB,CAAC,MAAuB;IACxD,OAAO,MAAM,IAAI,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,YAAY,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;AACxF,CAAC;AAED,SAAS,oBAAoB,CAAC,MAAuB;IACnD,OAAO,MAAM,IAAI,MAAM,IAAI,MAAM,CAAC,IAAI,KAAK,aAAa,CAAC;AAC3D,CAAC;AAED,SAAS,OAAO,CAAC,MAAuB;IACtC,OAAO,UAAU,IAAI,MAAM,CAAC;AAC9B,CAAC;AAQD;;;;;;;;;;GAUG;AACH,SAAgB,oBAAoB,CAClC,MAAuB,EACvB,KAAkB;IAElB,IAAI,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,CAAC,EAAE,YAAY,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAClE,IAAI,oBAAoB,CAAC,MAAM,CAAC,EAAE,CAAC;QACjC,OAAO;YACL,EAAE,YAAY,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE;YACrC,GAAG,gBAAgB,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,UAAU,CAAC;SAC7D,CAAC;IACJ,CAAC;IACD,OAAO,gBAAgB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;AACzC,CAAC;AAED;;;;;GAKG;AACH,SAAS,gBAAgB,CACvB,MAAoD,EACpD,KAA6B,EAC7B,UAAmB;IAEnB,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,IAAA,sBAAa,EAAC,KAAK,CAAC,CAAC;IACjE,MAAM,QAAQ,GAAG,CAAC,OAAe,EAAE,MAAc,EAAE,EAAE,CACnD,IAAA,mBAAU,EAAC,SAAS,EAAE,kBAAkB,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IAC7D,MAAM,OAAO,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,CAAC,EAAE,6BAA6B,EAAE,GAAG,EAAE,CAAC,CAAC;IAE1E,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC;QAChC,OAAO;YACL;gBACE,YAAY,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;gBACtD,GAAG,CAAC,UAAU,IAAI,EAAE,UAAU,EAAE,EAAE,YAAY,EAAE,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;aACzE;SACF,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC5C,MAAM,GAAG,GAAG,OAAO,CAAC,UAAU,IAAI,UAAU,CAAC,CAAC;IAC9C,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC;IAEjC,MAAM,UAAU,GAAwB;QACtC,YAAY,EAAE,CAAC,UAAU,CAAC;QAC1B,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI;YAC9B,UAAU,EAAE,EAAE,YAAY,EAAE,EAAE,qBAAqB,EAAE,YAAY,EAAE,EAAE;SACtE,CAAC;KACH,CAAC;IACF,MAAM,MAAM,GACV,MAAM,CAAC,IAAI,KAAK,YAAY;QAC1B,CAAC,CAAC;YACE;gBACE,YAAY,EAAE,CAAC,MAAM,CAAC,cAAc;oBAClC,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,YAAY,EAAE,GAAG,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC;oBACxD,CAAC,CAAC,CAAC,GAAG,CAAC,CACR,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;gBAC5C,UAAU,EAAE,EAAE,YAAY,EAAE,GAAG,EAAE;aAClC;SACF;QACH,CAAC,CAAC;YACE;gBACE,YAAY,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;gBAC/C,UAAU,EAAE,EAAE,YAAY,EAAE,EAAE,qBAAqB,EAAE,YAAY,EAAE,GAAG,GAAG,EAAE,EAAE;aAC9E;YACD;gBACE,YAAY,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;gBACrC,UAAU,EAAE,EAAE,YAAY,EAAE,EAAE,qBAAqB,EAAE,aAAa,EAAE,GAAG,GAAG,EAAE,EAAE;aAC/E;SACF,CAAC;IACR,OAAO,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,GAAG,MAAM,CAAC,CAAC;AACvD,CAAC;AAED;;;GAGG;AACH,SAAgB,SAAS,CACvB,MAAoD,EACpD,KAA6B;IAE7B,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,IAAA,sBAAa,EAAC,KAAK,CAAC,CAAC;IAC5D,OAAO,kBAAkB,CAAC,MAAM,CAAC;QAC/B,CAAC,CAAC,IAAA,mBAAU,EAAC,SAAS,EAAE,mBAAmB,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC;QAC/E,CAAC,CAAC,IAAA,mBAAU,EAAC,SAAS,EAAE,kBAAkB,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;AACxE,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,SAAgB,cAAc,CAAC,MAAuB,EAAE,KAAkB;IACxE,OAAO,oBAAoB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;AAC5E,CAAC;AAED,gBAAgB;AAChB,SAAgB,OAAO,CAAC,SAAkB;IACxC,OAAO,sBAAS,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;AAClE,CAAC;AAQD,MAAM,qBAAqB,GAAG,qBAAqB,CAAC;AAEpD;;;;;;;;;;;;;GAaG;AACH,SAAS,MAAM,CAAC,EAAU,EAAE,UAAoC,EAAE;IAChE,IAAA,sCAAe,EAAC,EAAE,EAAE,qBAAqB,CAAC,CAAC;IAC3C,IAAI,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1B,IAAI,EAAE,CAAC,QAAQ,CAAC,qBAAqB,CAAC;YAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CACb,IAAI,EAAE,mFAAmF;YACvF,uFAAuF;YACvF,kFAAkF,CACrF,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,IAAA,+BAAQ,EAAC,EAAE,CAAC,CAAC;IAC5B,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,IAAI,EAAE,sDAAsD,CAAC,CAAC;IAChF,CAAC;IACD,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,CAAC;IACrC,IAAI,SAAS;QAAE,OAAO,uCAAgB,CAAC,KAAK,CAAC,EAAE,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;IACzE,IAAI,EAAE,CAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CACb,IAAI,EAAE,8CAA8C,MAAM,8BAA8B;YACtF,qCAAqC,oDAA6B,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK;YAClF,wDAAwD,CAC3D,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CACb,IAAI,EAAE,2EAA2E,CAClF,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,uCAAyB,CAAC,EAAE,CAAC,CAAC;AAC3C,CAAC;AAED;;;;;;;;GAQG;AACU,QAAA,eAAe,GAAG;IAC7B,+EAA+E;IAC/E,MAAM;CACP,CAAC"}

package/dist/esm/arn.d.ts

@@ -0,0 +1,12 @@
+import { Stack } from "aws-cdk-lib";
+import type { IConstruct } from "constructs";
+type Environment = Pick<Stack, "partition" | "region" | "account">;
+/**
+ * The partition, Region and account of `scope`'s stack, or the `AWS::`
+ * pseudo-parameters without a scope. @internal
+ */
+export declare function environmentOf(scope: IConstruct | undefined): Environment;
+/** A `bedrock` ARN with a slash-separated resource name. @internal */
+export declare function bedrockArn(partition: string, resource: string, resourceName: string, region: string, account?: string): string;
+export {};
+//# sourceMappingURL=arn.d.ts.map

package/dist/esm/arn.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"arn.d.ts","sourceRoot":"","sources":["../../src/arn.ts"],"names":[],"mappings":"AAAA,OAAO,EAAuB,KAAK,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE7C,KAAK,WAAW,GAAG,IAAI,CAAC,KAAK,EAAE,WAAW,GAAG,QAAQ,GAAG,SAAS,CAAC,CAAC;AAEnE;;;GAGG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,UAAU,GAAG,SAAS,GAAG,WAAW,CAIxE;AAED,sEAAsE;AACtE,wBAAgB,UAAU,CACxB,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,MAAM,EACd,OAAO,SAAK,GACX,MAAM,CAUR"}

package/dist/esm/arn.js

@@ -0,0 +1,23 @@
+import { Arn, ArnFormat, Aws, Stack } from "aws-cdk-lib";
+/**
+ * The partition, Region and account of `scope`'s stack, or the `AWS::`
+ * pseudo-parameters without a scope. @internal
+ */
+export function environmentOf(scope) {
+    return scope === undefined
+        ? { partition: Aws.PARTITION, region: Aws.REGION, account: Aws.ACCOUNT_ID }
+        : Stack.of(scope);
+}
+/** A `bedrock` ARN with a slash-separated resource name. @internal */
+export function bedrockArn(partition, resource, resourceName, region, account = "") {
+    return Arn.format({
+        partition,
+        service: "bedrock",
+        region,
+        account,
+        resource,
+        resourceName,
+        arnFormat: ArnFormat.SLASH_RESOURCE_NAME,
+    });
+}
+//# sourceMappingURL=arn.js.map

package/dist/esm/arn.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"arn.js","sourceRoot":"","sources":["../../src/arn.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAKzD;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,KAA6B;IACzD,OAAO,KAAK,KAAK,SAAS;QACxB,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,UAAU,EAAE;QAC3E,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC;AACtB,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,UAAU,CACxB,SAAiB,EACjB,QAAgB,EAChB,YAAoB,EACpB,MAAc,EACd,OAAO,GAAG,EAAE;IAEZ,OAAO,GAAG,CAAC,MAAM,CAAC;QAChB,SAAS;QACT,OAAO,EAAE,SAAS;QAClB,MAAM;QACN,OAAO;QACP,QAAQ;QACR,YAAY;QACZ,SAAS,EAAE,SAAS,CAAC,mBAAmB;KACzC,CAAC,CAAC;AACL,CAAC"}

package/dist/esm/grants.d.ts

@@ -5,13 +5,25 @@ import { type InferenceTarget } from "./inference-target.js";
 /** Options for {@link modelGrants.invoke}. */
 export interface ModelInvokeGrantOptions {
     /**
-     * Requires every invocation to apply this guardrail version. The allow is
-     * conditioned on `bedrock:GuardrailIdentifier`, an explicit deny refuses
-     * calls without it, and the grantee may apply the guardrail.
+     * Requires every invocation to apply a guardrail. The allow is conditioned
+     * on `bedrock:GuardrailIdentifier`, an explicit deny refuses calls without
+     * it, and the grantee may apply the guardrail.
+     *
+     * A reference requires that guardrail version. `"any"` requires some
+     * guardrail in the grantee's account and Region, for a workload that picks
+     * its guardrail at run time; prefer a reference where the guardrail is
+     * known at synth.
      *
      * @see https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-permissions-id.html
      */
-    requireGuardrail?: Resolvable<GuardrailReference>;
+    requireGuardrail?: Resolvable<GuardrailReference | "any">;
+    /**
+     * Whether to grant `bedrock:InvokeModelWithResponseStream` alongside
+     * `bedrock:InvokeModel`. Set `false` for a caller that never streams.
+     *
+     * @default true
+     */
+    streaming?: boolean;
 }
 /**
  * Consumer-side grant helpers for invoking Amazon Bedrock models. Pass one to
@@ -27,14 +39,14 @@ export declare const modelGrants: {
      * Invoke the target through `InvokeModel`, `Converse` or their streaming
      * variants.
      *
-     * For a cross-Region profile this also grants the foundation model in the
-     * source Region and every Region the profile routes to, conditioned on
-     * `bedrock:InferenceProfileArn` so those models are reachable only through
-     * the profile.
+     * For a cross-Region profile this also grants the foundation model, in
+     * every Region or in the profile's listed `routingRegions`, conditioned on
+     * `bedrock:InferenceProfileArn` so the model is reachable only through the
+     * profile.
      *
      * @see https://docs.aws.amazon.com/wellarchitected/latest/generative-ai-lens/gensec01-bp01.html
      */
-    invoke: (target: Resolvable<InferenceTarget>, { requireGuardrail }?: ModelInvokeGrantOptions) => Grant<IGrantable>;
+    invoke: (target: Resolvable<InferenceTarget>, { requireGuardrail, streaming }?: ModelInvokeGrantOptions) => Grant<IGrantable>;
 };
 /**
  * Consumer-side grant helpers for Amazon Bedrock guardrails.
@@ -47,5 +59,11 @@ export declare const guardrailGrants: {
      * `ApplyGuardrail` API or a model invocation that names it.
      */
     apply: (guardrail: Resolvable<GuardrailReference>) => Grant<IGrantable>;
+    /**
+     * Apply any guardrail in the grantee's account and Region, for a caller
+     * that may name one at run time. Where the guardrail is known, `apply` it;
+     * where every call must carry one, `modelGrants.invoke(…, { requireGuardrail })`.
+     */
+    applyAny: () => Grant<IGrantable>;
 };
 //# sourceMappingURL=grants.d.ts.map

package/dist/esm/grants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"grants.d.ts","sourceRoot":"","sources":["../../src/grants.ts"],"names":[],"mappings":"AAAA,OAAO,EAA6B,KAAK,UAAU,EAAmB,MAAM,qBAAqB,CAAC;AAClG,OAAO,EAAW,KAAK,KAAK,EAAY,KAAK,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACpF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,EAAE,KAAK,eAAe,EAAiC,MAAM,uBAAuB,CAAC;AAU5F,8CAA8C;AAC9C,MAAM,WAAW,uBAAuB;IACtC;;;;;;OAMG;IACH,gBAAgB,CAAC,EAAE,UAAU,CAAC,kBAAkB,CAAC,CAAC;CACnD;AAmDD;;;;;;;;GAQG;AACH,eAAO,MAAM,WAAW;IACtB;;;;;;;;;;OAUG;qBAEO,UAAU,CAAC,eAAe,CAAC,yBACb,uBAAuB,KAC5C,KAAK,CAAC,UAAU,CAAC;CAOrB,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,eAAe;IAC1B;;;OAGG;uBACgB,UAAU,CAAC,kBAAkB,CAAC,KAAG,KAAK,CAAC,UAAU,CAAC;CAItE,CAAC"}
+{"version":3,"file":"grants.d.ts","sourceRoot":"","sources":["../../src/grants.ts"],"names":[],"mappings":"AAAA,OAAO,EAA6B,KAAK,UAAU,EAAmB,MAAM,qBAAqB,CAAC;AAElG,OAAO,EAAW,KAAK,KAAK,EAAY,KAAK,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACpF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAEjE,OAAO,EACL,KAAK,eAAe,EAIrB,MAAM,uBAAuB,CAAC;AAY/B,8CAA8C;AAC9C,MAAM,WAAW,uBAAuB;IACtC;;;;;;;;;;;OAWG;IACH,gBAAgB,CAAC,EAAE,UAAU,CAAC,kBAAkB,GAAG,KAAK,CAAC,CAAC;IAC1D;;;;;OAKG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AA8FD;;;;;;;;GAQG;AACH,eAAO,MAAM,WAAW;IACtB;;;;;;;;;;OAUG;qBAEO,UAAU,CAAC,eAAe,CAAC,oCACK,uBAAuB,KAC9D,KAAK,CAAC,UAAU,CAAC;CAOrB,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,eAAe;IAC1B;;;OAGG;uBACgB,UAAU,CAAC,kBAAkB,CAAC,KAAG,KAAK,CAAC,UAAU,CAAC;IAIrE;;;;OAIG;oBAGW,KAAK,CAAC,UAAU,CAAC;CAKhC,CAAC"}