@composurecdk/bedrock 0.10.1 → 0.10.2

package/dist/esm/application-inference-profile-builder.d.ts

@@ -0,0 +1,44 @@
+import { CfnApplicationInferenceProfile, type CfnApplicationInferenceProfileProps } from "aws-cdk-lib/aws-bedrock";
+import type { IConstruct } from "constructs";
+import { type Lifecycle, type Resolvable } from "@composurecdk/core";
+import { type ITaggedBuilder } from "@composurecdk/cloudformation";
+import type { ApplicationInferenceProfile } from "./inference-profile.js";
+/** Configuration properties for {@link createApplicationInferenceProfileBuilder}. */
+export interface ApplicationInferenceProfileBuilderProps extends Omit<CfnApplicationInferenceProfileProps, "modelSource" | "tags"> {
+    /** The foundation model or system-defined profile to route to. Required. */
+    source: Resolvable<ApplicationInferenceProfile["source"]>;
+}
+/** The build output of an {@link IApplicationInferenceProfileBuilder}. */
+export interface ApplicationInferenceProfileBuilderResult {
+    applicationInferenceProfile: CfnApplicationInferenceProfile;
+    /** The profile as an invocation target, for grants and callers. */
+    profile: ApplicationInferenceProfile;
+}
+/**
+ * A fluent builder for an Amazon Bedrock application inference profile.
+ *
+ * @see {@link createApplicationInferenceProfileBuilder}
+ */
+export type IApplicationInferenceProfileBuilder = ITaggedBuilder<ApplicationInferenceProfileBuilderProps, ApplicationInferenceProfileBuilder>;
+declare class ApplicationInferenceProfileBuilder implements Lifecycle<ApplicationInferenceProfileBuilderResult> {
+    props: Partial<ApplicationInferenceProfileBuilderProps>;
+    build(scope: IConstruct, id: string, context?: Record<string, object>): ApplicationInferenceProfileBuilderResult;
+}
+/**
+ * Creates a builder for an {@link ApplicationInferenceProfile}, which carries
+ * the builder's tags. Pass the result's `profile` to `modelGrants.invoke`, and
+ * its `profileArn` to callers as the model id.
+ *
+ * @example
+ * ```ts
+ * createApplicationInferenceProfileBuilder()
+ *   .inferenceProfileName("support-assistant")
+ *   .source(haiku)
+ *   .tag("CostCentre", "support");
+ * ```
+ *
+ * @see https://docs.aws.amazon.com/bedrock/latest/userguide/inference-profiles-create.html
+ */
+export declare function createApplicationInferenceProfileBuilder(): IApplicationInferenceProfileBuilder;
+export {};
+//# sourceMappingURL=application-inference-profile-builder.d.ts.map

package/dist/esm/application-inference-profile-builder.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"application-inference-profile-builder.d.ts","sourceRoot":"","sources":["../../src/application-inference-profile-builder.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,8BAA8B,EAC9B,KAAK,mCAAmC,EACzC,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,EAAE,KAAK,SAAS,EAAW,KAAK,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAC9E,OAAO,EAAE,KAAK,cAAc,EAAiB,MAAM,8BAA8B,CAAC;AAClF,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,wBAAwB,CAAC;AAG1E,qFAAqF;AACrF,MAAM,WAAW,uCAAwC,SAAQ,IAAI,CACnE,mCAAmC,EACnC,aAAa,GAAG,MAAM,CACvB;IACC,4EAA4E;IAC5E,MAAM,EAAE,UAAU,CAAC,2BAA2B,CAAC,QAAQ,CAAC,CAAC,CAAC;CAC3D;AAED,0EAA0E;AAC1E,MAAM,WAAW,wCAAwC;IACvD,2BAA2B,EAAE,8BAA8B,CAAC;IAC5D,mEAAmE;IACnE,OAAO,EAAE,2BAA2B,CAAC;CACtC;AAED;;;;GAIG;AACH,MAAM,MAAM,mCAAmC,GAAG,cAAc,CAC9D,uCAAuC,EACvC,kCAAkC,CACnC,CAAC;AAEF,cAAM,kCAAmC,YAAW,SAAS,CAAC,wCAAwC,CAAC;IACrG,KAAK,EAAE,OAAO,CAAC,uCAAuC,CAAC,CAAM;IAE7D,KAAK,CACH,KAAK,EAAE,UAAU,EACjB,EAAE,EAAE,MAAM,EACV,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM,GACnC,wCAAwC;CAwB5C;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,wCAAwC,IAAI,mCAAmC,CAI9F"}

package/dist/esm/application-inference-profile-builder.js

@@ -0,0 +1,48 @@
+import { CfnApplicationInferenceProfile, } from "aws-cdk-lib/aws-bedrock";
+import { resolve } from "@composurecdk/core";
+import { taggedBuilder } from "@composurecdk/cloudformation";
+import { sourceArn } from "./inference-target.js";
+class ApplicationInferenceProfileBuilder {
+    props = {};
+    build(scope, id, context = {}) {
+        const { source: sourceRef, inferenceProfileName, ...rest } = this.props;
+        if (!inferenceProfileName || sourceRef === undefined) {
+            throw new Error(`ApplicationInferenceProfileBuilder "${id}" requires an inferenceProfileName and a ` +
+                `source. Call .inferenceProfileName() and .source().`);
+        }
+        const source = resolve(sourceRef, context);
+        const applicationInferenceProfile = new CfnApplicationInferenceProfile(scope, id, {
+            ...rest,
+            inferenceProfileName,
+            modelSource: { copyFrom: sourceArn(source, scope) },
+        });
+        return {
+            applicationInferenceProfile,
+            profile: {
+                kind: "application",
+                profileArn: applicationInferenceProfile.attrInferenceProfileArn,
+                profileId: applicationInferenceProfile.attrInferenceProfileId,
+                source,
+            },
+        };
+    }
+}
+/**
+ * Creates a builder for an {@link ApplicationInferenceProfile}, which carries
+ * the builder's tags. Pass the result's `profile` to `modelGrants.invoke`, and
+ * its `profileArn` to callers as the model id.
+ *
+ * @example
+ * ```ts
+ * createApplicationInferenceProfileBuilder()
+ *   .inferenceProfileName("support-assistant")
+ *   .source(haiku)
+ *   .tag("CostCentre", "support");
+ * ```
+ *
+ * @see https://docs.aws.amazon.com/bedrock/latest/userguide/inference-profiles-create.html
+ */
+export function createApplicationInferenceProfileBuilder() {
+    return taggedBuilder(ApplicationInferenceProfileBuilder);
+}
+//# sourceMappingURL=application-inference-profile-builder.js.map

package/dist/esm/application-inference-profile-builder.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"application-inference-profile-builder.js","sourceRoot":"","sources":["../../src/application-inference-profile-builder.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,8BAA8B,GAE/B,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EAAkB,OAAO,EAAmB,MAAM,oBAAoB,CAAC;AAC9E,OAAO,EAAuB,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAElF,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AA4BlD,MAAM,kCAAkC;IACtC,KAAK,GAAqD,EAAE,CAAC;IAE7D,KAAK,CACH,KAAiB,EACjB,EAAU,EACV,UAAkC,EAAE;QAEpC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,oBAAoB,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC;QACxE,IAAI,CAAC,oBAAoB,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YACrD,MAAM,IAAI,KAAK,CACb,uCAAuC,EAAE,2CAA2C;gBAClF,qDAAqD,CACxD,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAC3C,MAAM,2BAA2B,GAAG,IAAI,8BAA8B,CAAC,KAAK,EAAE,EAAE,EAAE;YAChF,GAAG,IAAI;YACP,oBAAoB;YACpB,WAAW,EAAE,EAAE,QAAQ,EAAE,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE;SACpD,CAAC,CAAC;QACH,OAAO;YACL,2BAA2B;YAC3B,OAAO,EAAE;gBACP,IAAI,EAAE,aAAa;gBACnB,UAAU,EAAE,2BAA2B,CAAC,uBAAuB;gBAC/D,SAAS,EAAE,2BAA2B,CAAC,sBAAsB;gBAC7D,MAAM;aACP;SACF,CAAC;IACJ,CAAC;CACF;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,wCAAwC;IACtD,OAAO,aAAa,CAClB,kCAAkC,CACnC,CAAC;AACJ,CAAC"}

package/dist/esm/grants.d.ts

@@ -1,6 +1,18 @@
 import { type IGrantable } from "aws-cdk-lib/aws-iam";
 import { type Grant, type Resolvable } from "@composurecdk/core";
+import type { GuardrailReference } from "./guardrail-builder.js";
 import { type InferenceTarget } from "./inference-target.js";
+/** Options for {@link modelGrants.invoke}. */
+export interface ModelInvokeGrantOptions {
+    /**
+     * Requires every invocation to apply this guardrail version. The allow is
+     * conditioned on `bedrock:GuardrailIdentifier`, an explicit deny refuses
+     * calls without it, and the grantee may apply the guardrail.
+     *
+     * @see https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-permissions-id.html
+     */
+    requireGuardrail?: Resolvable<GuardrailReference>;
+}
 /**
  * Consumer-side grant helpers for invoking Amazon Bedrock models. Pass one to
  * a grantee builder's `grant(...)` — e.g.
@@ -22,6 +34,18 @@ export declare const modelGrants: {
      *
      * @see https://docs.aws.amazon.com/wellarchitected/latest/generative-ai-lens/gensec01-bp01.html
      */
-    invoke: (target: Resolvable<InferenceTarget>) => Grant<IGrantable>;
+    invoke: (target: Resolvable<InferenceTarget>, { requireGuardrail }?: ModelInvokeGrantOptions) => Grant<IGrantable>;
+};
+/**
+ * Consumer-side grant helpers for Amazon Bedrock guardrails.
+ *
+ * @see https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-permissions-id.html
+ */
+export declare const guardrailGrants: {
+    /**
+     * Apply the guardrail (`bedrock:ApplyGuardrail`), through the
+     * `ApplyGuardrail` API or a model invocation that names it.
+     */
+    apply: (guardrail: Resolvable<GuardrailReference>) => Grant<IGrantable>;
 };
 //# sourceMappingURL=grants.d.ts.map

package/dist/esm/grants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"grants.d.ts","sourceRoot":"","sources":["../../src/grants.ts"],"names":[],"mappings":"AAAA,OAAO,EAAqB,KAAK,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACzE,OAAO,EAAE,KAAK,KAAK,EAAY,KAAK,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAC3E,OAAO,EAAE,KAAK,eAAe,EAAiC,MAAM,uBAAuB,CAAC;AAU5F;;;;;;;;GAQG;AACH,eAAO,MAAM,WAAW;IACtB;;;;;;;;;;OAUG;qBACc,UAAU,CAAC,eAAe,CAAC,KAAG,KAAK,CAAC,UAAU,CAAC;CAOjE,CAAC"}
+{"version":3,"file":"grants.d.ts","sourceRoot":"","sources":["../../src/grants.ts"],"names":[],"mappings":"AAAA,OAAO,EAA6B,KAAK,UAAU,EAAmB,MAAM,qBAAqB,CAAC;AAClG,OAAO,EAAW,KAAK,KAAK,EAAY,KAAK,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACpF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,EAAE,KAAK,eAAe,EAAiC,MAAM,uBAAuB,CAAC;AAU5F,8CAA8C;AAC9C,MAAM,WAAW,uBAAuB;IACtC;;;;;;OAMG;IACH,gBAAgB,CAAC,EAAE,UAAU,CAAC,kBAAkB,CAAC,CAAC;CACnD;AAmDD;;;;;;;;GAQG;AACH,eAAO,MAAM,WAAW;IACtB;;;;;;;;;;OAUG;qBAEO,UAAU,CAAC,eAAe,CAAC,yBACb,uBAAuB,KAC5C,KAAK,CAAC,UAAU,CAAC;CAOrB,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,eAAe;IAC1B;;;OAGG;uBACgB,UAAU,CAAC,kBAAkB,CAAC,KAAG,KAAK,CAAC,UAAU,CAAC;CAItE,CAAC"}

package/dist/esm/grants.js

@@ -1,5 +1,5 @@
-import { Grant as IamGrant } from "aws-cdk-lib/aws-iam";
-import { grantVia } from "@composurecdk/core";
+import { Effect, Grant as IamGrant, PolicyStatement } from "aws-cdk-lib/aws-iam";
+import { combine, grantVia } from "@composurecdk/core";
 import { invocationStatements, scopeOf } from "./inference-target.js";
 /**
  * Streaming operations (`InvokeModelWithResponseStream`, `ConverseStream`)
@@ -8,6 +8,46 @@ import { invocationStatements, scopeOf } from "./inference-target.js";
  * @see https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonbedrock.html
  */
 const INVOKE_ACTIONS = ["bedrock:InvokeModel", "bedrock:InvokeModelWithResponseStream"];
+/** The versioned identifier `bedrock:GuardrailIdentifier` carries. */
+function identifierOf(guardrail) {
+    return `${guardrail.guardrailArn}:${guardrail.version}`;
+}
+function grantInvoke(target, grantee, guardrail) {
+    const statements = invocationStatements(target, scopeOf(grantee.grantPrincipal));
+    const identifier = guardrail && identifierOf(guardrail);
+    for (const { resourceArns, conditions } of statements) {
+        IamGrant.addToPrincipal({
+            grantee,
+            actions: INVOKE_ACTIONS,
+            resourceArns,
+            conditions: identifier
+                ? {
+                    ...conditions,
+                    StringEquals: {
+                        ...conditions?.StringEquals,
+                        "bedrock:GuardrailIdentifier": identifier,
+                    },
+                }
+                : conditions,
+        });
+    }
+    if (!guardrail)
+        return;
+    grantee.grantPrincipal.addToPrincipalPolicy(new PolicyStatement({
+        effect: Effect.DENY,
+        actions: INVOKE_ACTIONS,
+        resources: statements.flatMap((s) => s.resourceArns),
+        conditions: { StringNotEquals: { "bedrock:GuardrailIdentifier": identifierOf(guardrail) } },
+    }));
+    grantApply(guardrail, grantee);
+}
+function grantApply(guardrail, grantee) {
+    IamGrant.addToPrincipal({
+        grantee,
+        actions: ["bedrock:ApplyGuardrail"],
+        resourceArns: [guardrail.guardrailArn],
+    });
+}
 /**
  * Consumer-side grant helpers for invoking Amazon Bedrock models. Pass one to
  * a grantee builder's `grant(...)` — e.g.
@@ -29,11 +69,22 @@ export const modelGrants = {
      *
      * @see https://docs.aws.amazon.com/wellarchitected/latest/generative-ai-lens/gensec01-bp01.html
      */
-    invoke: (target) => grantVia(target, (resolved, grantee) => {
-        const statements = invocationStatements(resolved, scopeOf(grantee.grantPrincipal));
-        for (const { resourceArns, conditions } of statements) {
-            IamGrant.addToPrincipal({ grantee, actions: INVOKE_ACTIONS, resourceArns, conditions });
-        }
+    invoke: (target, { requireGuardrail } = {}) => grantVia(combine({ target, guardrail: requireGuardrail }), ({ target: resolved, guardrail }, grantee) => {
+        grantInvoke(resolved, grantee, guardrail);
+    }),
+};
+/**
+ * Consumer-side grant helpers for Amazon Bedrock guardrails.
+ *
+ * @see https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-permissions-id.html
+ */
+export const guardrailGrants = {
+    /**
+     * Apply the guardrail (`bedrock:ApplyGuardrail`), through the
+     * `ApplyGuardrail` API or a model invocation that names it.
+     */
+    apply: (guardrail) => grantVia(guardrail, (resolved, grantee) => {
+        grantApply(resolved, grantee);
     }),
 };
 //# sourceMappingURL=grants.js.map

package/dist/esm/grants.js.map

@@ -1 +1 @@
-{"version":3,"file":"grants.js","sourceRoot":"","sources":["../../src/grants.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,IAAI,QAAQ,EAAmB,MAAM,qBAAqB,CAAC;AACzE,OAAO,EAAc,QAAQ,EAAmB,MAAM,oBAAoB,CAAC;AAC3E,OAAO,EAAwB,oBAAoB,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAE5F;;;;;GAKG;AACH,MAAM,cAAc,GAAG,CAAC,qBAAqB,EAAE,uCAAuC,CAAC,CAAC;AAExF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB;;;;;;;;;;OAUG;IACH,MAAM,EAAE,CAAC,MAAmC,EAAqB,EAAE,CACjE,QAAQ,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,OAAmB,EAAE,EAAE;QACjD,MAAM,UAAU,GAAG,oBAAoB,CAAC,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC;QACnF,KAAK,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,IAAI,UAAU,EAAE,CAAC;YACtD,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,UAAU,EAAE,CAAC,CAAC;QAC1F,CAAC;IACH,CAAC,CAAC;CACL,CAAC"}
+{"version":3,"file":"grants.js","sourceRoot":"","sources":["../../src/grants.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,KAAK,IAAI,QAAQ,EAAmB,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAClG,OAAO,EAAE,OAAO,EAAc,QAAQ,EAAmB,MAAM,oBAAoB,CAAC;AAEpF,OAAO,EAAwB,oBAAoB,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAE5F;;;;;GAKG;AACH,MAAM,cAAc,GAAG,CAAC,qBAAqB,EAAE,uCAAuC,CAAC,CAAC;AAcxF,sEAAsE;AACtE,SAAS,YAAY,CAAC,SAA6B;IACjD,OAAO,GAAG,SAAS,CAAC,YAAY,IAAI,SAAS,CAAC,OAAO,EAAE,CAAC;AAC1D,CAAC;AAED,SAAS,WAAW,CAClB,MAAuB,EACvB,OAAmB,EACnB,SAAyC;IAEzC,MAAM,UAAU,GAAG,oBAAoB,CAAC,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC;IACjF,MAAM,UAAU,GAAG,SAAS,IAAI,YAAY,CAAC,SAAS,CAAC,CAAC;IACxD,KAAK,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,IAAI,UAAU,EAAE,CAAC;QACtD,QAAQ,CAAC,cAAc,CAAC;YACtB,OAAO;YACP,OAAO,EAAE,cAAc;YACvB,YAAY;YACZ,UAAU,EAAE,UAAU;gBACpB,CAAC,CAAC;oBACE,GAAG,UAAU;oBACb,YAAY,EAAE;wBACZ,GAAG,UAAU,EAAE,YAAY;wBAC3B,6BAA6B,EAAE,UAAU;qBAC1C;iBACF;gBACH,CAAC,CAAC,UAAU;SACf,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,SAAS;QAAE,OAAO;IAEvB,OAAO,CAAC,cAAc,CAAC,oBAAoB,CACzC,IAAI,eAAe,CAAC;QAClB,MAAM,EAAE,MAAM,CAAC,IAAI;QACnB,OAAO,EAAE,cAAc;QACvB,SAAS,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC;QACpD,UAAU,EAAE,EAAE,eAAe,EAAE,EAAE,6BAA6B,EAAE,YAAY,CAAC,SAAS,CAAC,EAAE,EAAE;KAC5F,CAAC,CACH,CAAC;IACF,UAAU,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;AACjC,CAAC;AAED,SAAS,UAAU,CAAC,SAA6B,EAAE,OAAmB;IACpE,QAAQ,CAAC,cAAc,CAAC;QACtB,OAAO;QACP,OAAO,EAAE,CAAC,wBAAwB,CAAC;QACnC,YAAY,EAAE,CAAC,SAAS,CAAC,YAAY,CAAC;KACvC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB;;;;;;;;;;OAUG;IACH,MAAM,EAAE,CACN,MAAmC,EACnC,EAAE,gBAAgB,KAA8B,EAAE,EAC/B,EAAE,CACrB,QAAQ,CACN,OAAO,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,gBAAgB,EAAE,CAAC,EAChD,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,OAAmB,EAAE,EAAE;QACvD,WAAW,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IAC5C,CAAC,CACF;CACJ,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B;;;OAGG;IACH,KAAK,EAAE,CAAC,SAAyC,EAAqB,EAAE,CACtE,QAAQ,CAAC,SAAS,EAAE,CAAC,QAAQ,EAAE,OAAmB,EAAE,EAAE;QACpD,UAAU,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAChC,CAAC,CAAC;CACL,CAAC"}

package/dist/esm/guardrail-alarms.d.ts

@@ -0,0 +1,40 @@
+import { Metric, type MetricOptions } from "aws-cdk-lib/aws-cloudwatch";
+import type { AlarmConfig, AlarmDefinition } from "@composurecdk/cloudwatch";
+import type { GuardrailReference } from "./guardrail-builder.js";
+/** `AWS/Bedrock/Guardrails` metrics for one guardrail version. */
+export interface GuardrailMetrics {
+    /** A metric dimensioned by the guardrail's ARN and version. */
+    metric(metricName: string, options?: MetricOptions): Metric;
+}
+/** Returns the `AWS/Bedrock/Guardrails` metrics for `guardrail`. */
+export declare function guardrailMetrics(guardrail: GuardrailReference): GuardrailMetrics;
+/**
+ * Controls the recommended alarms for a guardrail. Both are opt-in and need a
+ * threshold: what counts as normal depends on the workload.
+ *
+ * @see https://docs.aws.amazon.com/bedrock/latest/userguide/monitoring-guardrails-cw-metrics.html
+ */
+export interface GuardrailAlarmConfig {
+    /**
+     * Master switch: set to `false` to disable all recommended alarms.
+     * @default true
+     */
+    enabled?: boolean;
+    /**
+     * Alarm when the guardrail intervenes more often than the threshold, e.g.
+     * a spike in prompt attacks or a filter set too strictly.
+     *
+     * Metric: `InvocationsIntervened`, statistic Sum. Opt-in; threshold required.
+     */
+    invocationsIntervened?: AlarmConfig | false;
+    /**
+     * Alarm when evaluating the guardrail takes longer than the threshold, in
+     * milliseconds.
+     *
+     * Metric: `InvocationLatency`, statistic p90. Opt-in; threshold required.
+     */
+    invocationLatency?: AlarmConfig | false;
+}
+/** Resolves the recommended guardrail alarms. */
+export declare function resolveGuardrailAlarmDefinitions(metrics: GuardrailMetrics, config: GuardrailAlarmConfig | false | undefined): AlarmDefinition[];
+//# sourceMappingURL=guardrail-alarms.d.ts.map

package/dist/esm/guardrail-alarms.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"guardrail-alarms.d.ts","sourceRoot":"","sources":["../../src/guardrail-alarms.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,KAAK,aAAa,EAAE,MAAM,4BAA4B,CAAC;AACxE,OAAO,KAAK,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAE7E,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAEjE,kEAAkE;AAClE,MAAM,WAAW,gBAAgB;IAC/B,+DAA+D;IAC/D,MAAM,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,MAAM,CAAC;CAC7D;AAED,oEAAoE;AACpE,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,kBAAkB,GAAG,gBAAgB,CAchF;AAED;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACnC;;;OAGG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAElB;;;;;OAKG;IACH,qBAAqB,CAAC,EAAE,WAAW,GAAG,KAAK,CAAC;IAE5C;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,WAAW,GAAG,KAAK,CAAC;CACzC;AAkBD,iDAAiD;AACjD,wBAAgB,gCAAgC,CAC9C,OAAO,EAAE,gBAAgB,EACzB,MAAM,EAAE,oBAAoB,GAAG,KAAK,GAAG,SAAS,GAC/C,eAAe,EAAE,CAKnB"}

package/dist/esm/guardrail-alarms.js

@@ -0,0 +1,37 @@
+import { Duration } from "aws-cdk-lib";
+import { Metric } from "aws-cdk-lib/aws-cloudwatch";
+import { resolveThresholdAlarms } from "./alarm-definition.js";
+/** Returns the `AWS/Bedrock/Guardrails` metrics for `guardrail`. */
+export function guardrailMetrics(guardrail) {
+    return {
+        metric: (metricName, options) => new Metric({
+            namespace: "AWS/Bedrock/Guardrails",
+            metricName,
+            dimensionsMap: {
+                GuardrailArn: guardrail.guardrailArn,
+                GuardrailVersion: guardrail.version,
+            },
+            period: Duration.minutes(1),
+            ...options,
+        }),
+    };
+}
+const GUARDRAIL_ALARMS = {
+    invocationsIntervened: {
+        metricName: "InvocationsIntervened",
+        statistic: "Sum",
+        describe: (t) => `The guardrail is intervening more than ${String(t)} times a minute.`,
+    },
+    invocationLatency: {
+        metricName: "InvocationLatency",
+        statistic: "p90",
+        describe: (t) => `p90 guardrail evaluation latency exceeds ${String(t)} ms.`,
+    },
+};
+/** Resolves the recommended guardrail alarms. */
+export function resolveGuardrailAlarmDefinitions(metrics, config) {
+    if (config === false || config?.enabled === false)
+        return [];
+    return resolveThresholdAlarms(GUARDRAIL_ALARMS, config, (metricName, statistic) => metrics.metric(metricName, { statistic }));
+}
+//# sourceMappingURL=guardrail-alarms.js.map

package/dist/esm/guardrail-alarms.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"guardrail-alarms.js","sourceRoot":"","sources":["../../src/guardrail-alarms.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,MAAM,EAAsB,MAAM,4BAA4B,CAAC;AAExE,OAAO,EAAE,sBAAsB,EAA2B,MAAM,uBAAuB,CAAC;AASxF,oEAAoE;AACpE,MAAM,UAAU,gBAAgB,CAAC,SAA6B;IAC5D,OAAO;QACL,MAAM,EAAE,CAAC,UAAU,EAAE,OAAO,EAAE,EAAE,CAC9B,IAAI,MAAM,CAAC;YACT,SAAS,EAAE,wBAAwB;YACnC,UAAU;YACV,aAAa,EAAE;gBACb,YAAY,EAAE,SAAS,CAAC,YAAY;gBACpC,gBAAgB,EAAE,SAAS,CAAC,OAAO;aACpC;YACD,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;YAC3B,GAAG,OAAO;SACX,CAAC;KACL,CAAC;AACJ,CAAC;AAgCD,MAAM,gBAAgB,GAGlB;IACF,qBAAqB,EAAE;QACrB,UAAU,EAAE,uBAAuB;QACnC,SAAS,EAAE,KAAK;QAChB,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,0CAA0C,MAAM,CAAC,CAAC,CAAC,kBAAkB;KACvF;IACD,iBAAiB,EAAE;QACjB,UAAU,EAAE,mBAAmB;QAC/B,SAAS,EAAE,KAAK;QAChB,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,4CAA4C,MAAM,CAAC,CAAC,CAAC,MAAM;KAC7E;CACF,CAAC;AAEF,iDAAiD;AACjD,MAAM,UAAU,gCAAgC,CAC9C,OAAyB,EACzB,MAAgD;IAEhD,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,EAAE,OAAO,KAAK,KAAK;QAAE,OAAO,EAAE,CAAC;IAC7D,OAAO,sBAAsB,CAAC,gBAAgB,EAAE,MAAM,EAAE,CAAC,UAAU,EAAE,SAAS,EAAE,EAAE,CAChF,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,CAAC,CAC1C,CAAC;AACJ,CAAC"}

package/dist/esm/guardrail-builder.d.ts

@@ -0,0 +1,70 @@
+import { CfnGuardrail, type CfnGuardrailProps, CfnGuardrailVersion } from "aws-cdk-lib/aws-bedrock";
+import type { Alarm } from "aws-cdk-lib/aws-cloudwatch";
+import type { IConstruct } from "constructs";
+import { COPY_STATE, type Lifecycle, type Resolvable } from "@composurecdk/core";
+import { type ITaggedBuilder } from "@composurecdk/cloudformation";
+import { AlarmDefinitionBuilder } from "@composurecdk/cloudwatch";
+import { type GuardrailAlarmConfig, type GuardrailMetrics } from "./guardrail-alarms.js";
+/** A guardrail's ARN and published version. */
+export interface GuardrailReference {
+    /** The guardrail's ARN, without a version. */
+    readonly guardrailArn: string;
+    /** The published version, e.g. `"1"`. */
+    readonly version: string;
+}
+/** Configuration properties for {@link createGuardrailBuilder}. */
+export interface GuardrailBuilderProps extends Omit<CfnGuardrailProps, "tags" | "kmsKeyArn"> {
+    /** A customer managed key to encrypt the guardrail with. */
+    kmsKeyArn?: Resolvable<NonNullable<CfnGuardrailProps["kmsKeyArn"]>>;
+    /**
+     * Configuration for the recommended alarms, which are all opt-in. Set to
+     * `false` to disable them; alarms added with `addAlarm()` are unaffected.
+     */
+    recommendedAlarms?: GuardrailAlarmConfig | false;
+}
+/** The build output of an {@link IGuardrailBuilder}. */
+export interface GuardrailBuilderResult {
+    guardrail: CfnGuardrail;
+    /** The published version callers should use, rather than the working draft. */
+    version: CfnGuardrailVersion;
+    /** The guardrail's ARN and published version, for grants and invocations. */
+    reference: GuardrailReference;
+    /** The CloudWatch alarms created, keyed by alarm key. */
+    alarms: Record<string, Alarm>;
+}
+/**
+ * A fluent builder for an Amazon Bedrock guardrail.
+ *
+ * @see {@link createGuardrailBuilder}
+ */
+export type IGuardrailBuilder = ITaggedBuilder<GuardrailBuilderProps, GuardrailBuilder>;
+declare class GuardrailBuilder implements Lifecycle<GuardrailBuilderResult> {
+    #private;
+    props: Partial<GuardrailBuilderProps>;
+    /**
+     * Adds a custom alarm. The metric factory receives the guardrail version's
+     * {@link GuardrailMetrics}.
+     */
+    addAlarm(key: string, configure: (alarm: AlarmDefinitionBuilder<GuardrailMetrics>) => AlarmDefinitionBuilder<GuardrailMetrics>): this;
+    /** @internal — see ADR-0005. */
+    [COPY_STATE](target: GuardrailBuilder): void;
+    build(scope: IConstruct, id: string, context?: Record<string, object>): GuardrailBuilderResult;
+}
+/**
+ * Creates a builder for an Amazon Bedrock guardrail and a published version
+ * of it ([GENSEC02-BP01](https://docs.aws.amazon.com/wellarchitected/latest/generative-ai-lens/gensec02-bp01.html)).
+ *
+ * By default it filters every harmful-content category and prompt attacks at
+ * `HIGH` ({@link GUARDRAIL_DEFAULTS}). Pass its `reference` to
+ * `modelGrants.invoke(target, { requireGuardrail })` to make callers use it.
+ *
+ * @example
+ * ```ts
+ * createGuardrailBuilder()
+ *   .name("support-assistant")
+ *   .topicPolicyConfig({ topicsConfig: [{ name: "Legal", definition: "Legal advice.", type: "DENY" }] });
+ * ```
+ */
+export declare function createGuardrailBuilder(): IGuardrailBuilder;
+export {};
+//# sourceMappingURL=guardrail-builder.d.ts.map

package/dist/esm/guardrail-builder.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"guardrail-builder.d.ts","sourceRoot":"","sources":["../../src/guardrail-builder.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,KAAK,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AACpG,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,4BAA4B,CAAC;AACxD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,EAAE,UAAU,EAAE,KAAK,SAAS,EAAW,KAAK,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAC1F,OAAO,EAAE,KAAK,cAAc,EAAiB,MAAM,8BAA8B,CAAC;AAClF,OAAO,EAAE,sBAAsB,EAAgB,MAAM,0BAA0B,CAAC;AAChF,OAAO,EACL,KAAK,oBAAoB,EACzB,KAAK,gBAAgB,EAGtB,MAAM,uBAAuB,CAAC;AAG/B,+CAA+C;AAC/C,MAAM,WAAW,kBAAkB;IACjC,8CAA8C;IAC9C,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,yCAAyC;IACzC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,mEAAmE;AACnE,MAAM,WAAW,qBAAsB,SAAQ,IAAI,CAAC,iBAAiB,EAAE,MAAM,GAAG,WAAW,CAAC;IAC1F,4DAA4D;IAC5D,SAAS,CAAC,EAAE,UAAU,CAAC,WAAW,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IAEpE;;;OAGG;IACH,iBAAiB,CAAC,EAAE,oBAAoB,GAAG,KAAK,CAAC;CAClD;AAED,wDAAwD;AACxD,MAAM,WAAW,sBAAsB;IACrC,SAAS,EAAE,YAAY,CAAC;IACxB,+EAA+E;IAC/E,OAAO,EAAE,mBAAmB,CAAC;IAC7B,6EAA6E;IAC7E,SAAS,EAAE,kBAAkB,CAAC;IAC9B,yDAAyD;IACzD,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;CAC/B;AAED;;;;GAIG;AACH,MAAM,MAAM,iBAAiB,GAAG,cAAc,CAAC,qBAAqB,EAAE,gBAAgB,CAAC,CAAC;AAWxF,cAAM,gBAAiB,YAAW,SAAS,CAAC,sBAAsB,CAAC;;IACjE,KAAK,EAAE,OAAO,CAAC,qBAAqB,CAAC,CAAM;IAG3C;;;OAGG;IACH,QAAQ,CACN,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,CACT,KAAK,EAAE,sBAAsB,CAAC,gBAAgB,CAAC,KAC5C,sBAAsB,CAAC,gBAAgB,CAAC,GAC5C,IAAI;IAKP,gCAAgC;IAChC,CAAC,UAAU,CAAC,CAAC,MAAM,EAAE,gBAAgB,GAAG,IAAI;IAI5C,KAAK,CACH,KAAK,EAAE,UAAU,EACjB,EAAE,EAAE,MAAM,EACV,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM,GACnC,sBAAsB;CA4B1B;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,sBAAsB,IAAI,iBAAiB,CAE1D"}

package/dist/esm/guardrail-builder.js

@@ -0,0 +1,75 @@
+import { Stack } from "aws-cdk-lib";
+import { CfnGuardrail, CfnGuardrailVersion } from "aws-cdk-lib/aws-bedrock";
+import { COPY_STATE, resolve } from "@composurecdk/core";
+import { taggedBuilder } from "@composurecdk/cloudformation";
+import { AlarmDefinitionBuilder, createAlarms } from "@composurecdk/cloudwatch";
+import { guardrailMetrics, resolveGuardrailAlarmDefinitions, } from "./guardrail-alarms.js";
+import { GUARDRAIL_DEFAULTS } from "./guardrail-defaults.js";
+/** 32-bit FNV-1a, as 8 hex digits. */
+function fnv1a(value) {
+    let hash = 0x811c9dc5;
+    for (let i = 0; i < value.length; i++) {
+        hash = Math.imul(hash ^ value.charCodeAt(i), 0x01000193) >>> 0;
+    }
+    return hash.toString(16).padStart(8, "0");
+}
+class GuardrailBuilder {
+    props = {};
+    #customAlarms = [];
+    /**
+     * Adds a custom alarm. The metric factory receives the guardrail version's
+     * {@link GuardrailMetrics}.
+     */
+    addAlarm(key, configure) {
+        this.#customAlarms.push(configure(new AlarmDefinitionBuilder(key)));
+        return this;
+    }
+    /** @internal — see ADR-0005. */
+    [COPY_STATE](target) {
+        target.#customAlarms.push(...this.#customAlarms);
+    }
+    build(scope, id, context = {}) {
+        const { kmsKeyArn, recommendedAlarms, ...rest } = this.props;
+        if (!rest.name) {
+            throw new Error(`GuardrailBuilder "${id}" requires a name. Call .name().`);
+        }
+        const props = {
+            ...GUARDRAIL_DEFAULTS,
+            ...rest,
+            name: rest.name,
+            ...(kmsKeyArn !== undefined && { kmsKeyArn: resolve(kmsKeyArn, context) }),
+        };
+        const guardrail = new CfnGuardrail(scope, id, props);
+        // A version is a snapshot, so a configuration change publishes a new one.
+        const fingerprint = fnv1a(JSON.stringify(Stack.of(scope).resolve(props)));
+        const version = new CfnGuardrailVersion(scope, `${id}Version${fingerprint}`, {
+            guardrailIdentifier: guardrail.attrGuardrailId,
+        });
+        const reference = { guardrailArn: guardrail.attrGuardrailArn, version: version.attrVersion };
+        const metrics = guardrailMetrics(reference);
+        const alarms = createAlarms(scope, id, [
+            ...resolveGuardrailAlarmDefinitions(metrics, recommendedAlarms),
+            ...this.#customAlarms.map((b) => b.resolve(metrics)),
+        ]);
+        return { guardrail, version, reference, alarms };
+    }
+}
+/**
+ * Creates a builder for an Amazon Bedrock guardrail and a published version
+ * of it ([GENSEC02-BP01](https://docs.aws.amazon.com/wellarchitected/latest/generative-ai-lens/gensec02-bp01.html)).
+ *
+ * By default it filters every harmful-content category and prompt attacks at
+ * `HIGH` ({@link GUARDRAIL_DEFAULTS}). Pass its `reference` to
+ * `modelGrants.invoke(target, { requireGuardrail })` to make callers use it.
+ *
+ * @example
+ * ```ts
+ * createGuardrailBuilder()
+ *   .name("support-assistant")
+ *   .topicPolicyConfig({ topicsConfig: [{ name: "Legal", definition: "Legal advice.", type: "DENY" }] });
+ * ```
+ */
+export function createGuardrailBuilder() {
+    return taggedBuilder(GuardrailBuilder);
+}
+//# sourceMappingURL=guardrail-builder.js.map

package/dist/esm/guardrail-builder.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"guardrail-builder.js","sourceRoot":"","sources":["../../src/guardrail-builder.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AACpC,OAAO,EAAE,YAAY,EAA0B,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAGpG,OAAO,EAAE,UAAU,EAAkB,OAAO,EAAmB,MAAM,oBAAoB,CAAC;AAC1F,OAAO,EAAuB,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAClF,OAAO,EAAE,sBAAsB,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAChF,OAAO,EAGL,gBAAgB,EAChB,gCAAgC,GACjC,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAwC7D,sCAAsC;AACtC,SAAS,KAAK,CAAC,KAAa;IAC1B,IAAI,IAAI,GAAG,UAAU,CAAC;IACtB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AAC5C,CAAC;AAED,MAAM,gBAAgB;IACpB,KAAK,GAAmC,EAAE,CAAC;IAClC,aAAa,GAA+C,EAAE,CAAC;IAExE;;;OAGG;IACH,QAAQ,CACN,GAAW,EACX,SAE6C;QAE7C,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,sBAAsB,CAAmB,GAAG,CAAC,CAAC,CAAC,CAAC;QACtF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,gCAAgC;IAChC,CAAC,UAAU,CAAC,CAAC,MAAwB;QACnC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,aAAa,CAAC,CAAC;IACnD,CAAC;IAED,KAAK,CACH,KAAiB,EACjB,EAAU,EACV,UAAkC,EAAE;QAEpC,MAAM,EAAE,SAAS,EAAE,iBAAiB,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC;QAC7D,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,qBAAqB,EAAE,kCAAkC,CAAC,CAAC;QAC7E,CAAC;QACD,MAAM,KAAK,GAAsB;YAC/B,GAAG,kBAAkB;YACrB,GAAG,IAAI;YACP,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,GAAG,CAAC,SAAS,KAAK,SAAS,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,CAAC;SAC3E,CAAC;QACF,MAAM,SAAS,GAAG,IAAI,YAAY,CAAC,KAAK,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC;QAErD,0EAA0E;QAC1E,MAAM,WAAW,GAAG,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC1E,MAAM,OAAO,GAAG,IAAI,mBAAmB,CAAC,KAAK,EAAE,GAAG,EAAE,UAAU,WAAW,EAAE,EAAE;YAC3E,mBAAmB,EAAE,SAAS,CAAC,eAAe;SAC/C,CAAC,CAAC;QAEH,MAAM,SAAS,GAAG,EAAE,YAAY,EAAE,SAAS,CAAC,gBAAgB,EAAE,OAAO,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC;QAC7F,MAAM,OAAO,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAC;QAC5C,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,EAAE,EAAE,EAAE;YACrC,GAAG,gCAAgC,CAAC,OAAO,EAAE,iBAAiB,CAAC;YAC/D,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;SACrD,CAAC,CAAC;QAEH,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;IACnD,CAAC;CACF;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,sBAAsB;IACpC,OAAO,aAAa,CAA0C,gBAAgB,CAAC,CAAC;AAClF,CAAC"}

package/dist/esm/guardrail-defaults.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Defaults for {@link createGuardrailBuilder}.
+ *
+ * @see https://docs.aws.amazon.com/wellarchitected/latest/generative-ai-lens/gensec02-bp01.html
+ */
+export declare const GUARDRAIL_DEFAULTS: {
+    blockedInputMessaging: string;
+    blockedOutputsMessaging: string;
+    /**
+     * Every harmful-content category and prompt attacks, at `HIGH`. AWS
+     * recommends no strengths; `HIGH` blocks the most, and a category that
+     * blocks legitimate content can be lowered. Prompt attacks only apply to
+     * input, so their output strength must be `NONE`.
+     *
+     * @see https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-content-filters.html
+     */
+    contentPolicyConfig: {
+        filtersConfig: {
+            type: string;
+            inputStrength: string;
+            outputStrength: string;
+        }[];
+    };
+};
+//# sourceMappingURL=guardrail-defaults.d.ts.map

package/dist/esm/guardrail-defaults.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"guardrail-defaults.d.ts","sourceRoot":"","sources":["../../src/guardrail-defaults.ts"],"names":[],"mappings":"AAOA;;;;GAIG;AACH,eAAO,MAAM,kBAAkB;;;IAI7B;;;;;;;OAOG;;;;;;;;CAOiC,CAAC"}

package/dist/esm/guardrail-defaults.js

@@ -0,0 +1,27 @@
+const HARMFUL_CONTENT = ["SEXUAL", "VIOLENCE", "HATE", "INSULTS", "MISCONDUCT"];
+/** The Bedrock console's default message for a blocked prompt or response. */
+const BLOCKED_MESSAGE = "Sorry, the model cannot answer this question.";
+/**
+ * Defaults for {@link createGuardrailBuilder}.
+ *
+ * @see https://docs.aws.amazon.com/wellarchitected/latest/generative-ai-lens/gensec02-bp01.html
+ */
+export const GUARDRAIL_DEFAULTS = {
+    blockedInputMessaging: BLOCKED_MESSAGE,
+    blockedOutputsMessaging: BLOCKED_MESSAGE,
+    /**
+     * Every harmful-content category and prompt attacks, at `HIGH`. AWS
+     * recommends no strengths; `HIGH` blocks the most, and a category that
+     * blocks legitimate content can be lowered. Prompt attacks only apply to
+     * input, so their output strength must be `NONE`.
+     *
+     * @see https://docs.aws.amazon.com/bedrock/latest/userguide/guardrails-content-filters.html
+     */
+    contentPolicyConfig: {
+        filtersConfig: [
+            ...HARMFUL_CONTENT.map((type) => ({ type, inputStrength: "HIGH", outputStrength: "HIGH" })),
+            { type: "PROMPT_ATTACK", inputStrength: "HIGH", outputStrength: "NONE" },
+        ],
+    },
+};
+//# sourceMappingURL=guardrail-defaults.js.map

package/dist/esm/guardrail-defaults.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"guardrail-defaults.js","sourceRoot":"","sources":["../../src/guardrail-defaults.ts"],"names":[],"mappings":"AAEA,MAAM,eAAe,GAAG,CAAC,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC;AAEhF,8EAA8E;AAC9E,MAAM,eAAe,GAAG,+CAA+C,CAAC;AAExE;;;;GAIG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,qBAAqB,EAAE,eAAe;IACtC,uBAAuB,EAAE,eAAe;IAExC;;;;;;;OAOG;IACH,mBAAmB,EAAE;QACnB,aAAa,EAAE;YACb,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,CAAC,CAAC;YAC3F,EAAE,IAAI,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE;SACzE;KACF;CACmC,CAAC"}

package/dist/esm/index.d.ts

@@ -1,8 +1,14 @@
-export { foundationModelFor, type GeographicInferenceProfile, type GeographicInferenceProfileOptions, type GlobalInferenceProfile, INFERENCE_PROFILE_GEOGRAPHIES, type InferenceProfile, type InferenceProfileGeography, inferenceProfile, } from "./inference-profile.js";
+export { type ApplicationInferenceProfileBuilderProps, type ApplicationInferenceProfileBuilderResult, createApplicationInferenceProfileBuilder, type IApplicationInferenceProfileBuilder, } from "./application-inference-profile-builder.js";
+export { type ApplicationInferenceProfile, foundationModelFor, type GeographicInferenceProfile, type GeographicInferenceProfileOptions, type GlobalInferenceProfile, INFERENCE_PROFILE_GEOGRAPHIES, type InferenceProfile, type InferenceProfileGeography, inferenceProfile, } from "./inference-profile.js";
 export { type InferenceTarget, invocationArns } from "./inference-target.js";
-export { modelGrants } from "./grants.js";
+export { guardrailGrants, type ModelInvokeGrantOptions, modelGrants } from "./grants.js";
+export { createGuardrailBuilder, type GuardrailBuilderProps, type GuardrailBuilderResult, type GuardrailReference, type IGuardrailBuilder, } from "./guardrail-builder.js";
+export { GUARDRAIL_DEFAULTS } from "./guardrail-defaults.js";
+export { type GuardrailAlarmConfig, type GuardrailMetrics, guardrailMetrics, } from "./guardrail-alarms.js";
 export { createModelAlarmBuilder, type IModelAlarmBuilder, type ModelAlarmBuilderProps, type ModelAlarmBuilderResult, } from "./model-alarm-builder.js";
 export { type ModelAlarmConfig, type QuotaAlarmConfig } from "./model-alarm-config.js";
 export { MODEL_ALARM_DEFAULTS } from "./model-alarm-defaults.js";
 export { type ModelAlarmTarget, type ModelMetrics, modelMetrics } from "./model-alarms.js";
+export { createModelInvocationLoggingBuilder, type IModelInvocationLoggingBuilder, MODEL_INVOCATION_LOGGING_DEFAULTS, type ModelInvocationLoggingBuilderProps, type ModelInvocationLoggingBuilderResult, type ModelInvocationLoggingModalities, } from "./model-invocation-logging-builder.js";
+export { MODEL_INVOCATION_LOGGING_ALARM_DEFAULTS, type ModelInvocationLoggingAlarmConfig, } from "./model-invocation-logging-alarms.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/esm/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kBAAkB,EAClB,KAAK,0BAA0B,EAC/B,KAAK,iCAAiC,EACtC,KAAK,sBAAsB,EAC3B,6BAA6B,EAC7B,KAAK,gBAAgB,EACrB,KAAK,yBAAyB,EAC9B,gBAAgB,GACjB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,KAAK,eAAe,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC7E,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EACL,uBAAuB,EACvB,KAAK,kBAAkB,EACvB,KAAK,sBAAsB,EAC3B,KAAK,uBAAuB,GAC7B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,KAAK,gBAAgB,EAAE,KAAK,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AACvF,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAE,KAAK,gBAAgB,EAAE,KAAK,YAAY,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,uCAAuC,EAC5C,KAAK,wCAAwC,EAC7C,wCAAwC,EACxC,KAAK,mCAAmC,GACzC,MAAM,4CAA4C,CAAC;AACpD,OAAO,EACL,KAAK,2BAA2B,EAChC,kBAAkB,EAClB,KAAK,0BAA0B,EAC/B,KAAK,iCAAiC,EACtC,KAAK,sBAAsB,EAC3B,6BAA6B,EAC7B,KAAK,gBAAgB,EACrB,KAAK,yBAAyB,EAC9B,gBAAgB,GACjB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,KAAK,eAAe,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC7E,OAAO,EAAE,eAAe,EAAE,KAAK,uBAAuB,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACzF,OAAO,EACL,sBAAsB,EACtB,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC3B,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,GACvB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EACL,KAAK,oBAAoB,EACzB,KAAK,gBAAgB,EACrB,gBAAgB,GACjB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,uBAAuB,EACvB,KAAK,kBAAkB,EACvB,KAAK,sBAAsB,EAC3B,KAAK,uBAAuB,GAC7B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,KAAK,gBAAgB,EAAE,KAAK,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AACvF,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAE,KAAK,gBAAgB,EAAE,KAAK,YAAY,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAC3F,OAAO,EACL,mCAAmC,EACnC,KAAK,8BAA8B,EACnC,iCAAiC,EACjC,KAAK,kCAAkC,EACvC,KAAK,mCAAmC,EACxC,KAAK,gCAAgC,GACtC,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EACL,uCAAuC,EACvC,KAAK,iCAAiC,GACvC,MAAM,sCAAsC,CAAC"}

package/dist/esm/index.js

@@ -1,7 +1,13 @@
+export { createApplicationInferenceProfileBuilder, } from "./application-inference-profile-builder.js";
 export { foundationModelFor, INFERENCE_PROFILE_GEOGRAPHIES, inferenceProfile, } from "./inference-profile.js";
 export { invocationArns } from "./inference-target.js";
-export { modelGrants } from "./grants.js";
+export { guardrailGrants, modelGrants } from "./grants.js";
+export { createGuardrailBuilder, } from "./guardrail-builder.js";
+export { GUARDRAIL_DEFAULTS } from "./guardrail-defaults.js";
+export { guardrailMetrics, } from "./guardrail-alarms.js";
 export { createModelAlarmBuilder, } from "./model-alarm-builder.js";
 export { MODEL_ALARM_DEFAULTS } from "./model-alarm-defaults.js";
 export { modelMetrics } from "./model-alarms.js";
+export { createModelInvocationLoggingBuilder, MODEL_INVOCATION_LOGGING_DEFAULTS, } from "./model-invocation-logging-builder.js";
+export { MODEL_INVOCATION_LOGGING_ALARM_DEFAULTS, } from "./model-invocation-logging-alarms.js";
 //# sourceMappingURL=index.js.map

package/dist/esm/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kBAAkB,EAIlB,6BAA6B,EAG7B,gBAAgB,GACjB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAwB,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC7E,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EACL,uBAAuB,GAIxB,MAAM,0BAA0B,CAAC;AAElC,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAA4C,YAAY,EAAE,MAAM,mBAAmB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,wCAAwC,GAEzC,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAEL,kBAAkB,EAIlB,6BAA6B,EAG7B,gBAAgB,GACjB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAwB,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC7E,OAAO,EAAE,eAAe,EAAgC,WAAW,EAAE,MAAM,aAAa,CAAC;AACzF,OAAO,EACL,sBAAsB,GAKvB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAGL,gBAAgB,GACjB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,uBAAuB,GAIxB,MAAM,0BAA0B,CAAC;AAElC,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAA4C,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAC3F,OAAO,EACL,mCAAmC,EAEnC,iCAAiC,GAIlC,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EACL,uCAAuC,GAExC,MAAM,sCAAsC,CAAC"}

package/dist/esm/inference-profile.d.ts

@@ -47,6 +47,25 @@ export interface GlobalInferenceProfile {
 }
 /** A system-defined cross-Region inference profile. */
 export type InferenceProfile = GeographicInferenceProfile | GlobalInferenceProfile;
+/**
+ * An application inference profile: an account-owned profile, tagged for
+ * cost allocation, that routes to a foundation model or a system-defined
+ * profile. Build one with `createApplicationInferenceProfileBuilder()`.
+ *
+ * @see https://docs.aws.amazon.com/bedrock/latest/userguide/inference-profiles-create.html
+ */
+export interface ApplicationInferenceProfile {
+    readonly kind: "application";
+    /** The profile's ARN, which callers pass as the model id. */
+    readonly profileArn: string;
+    /**
+     * The profile's id, the last segment of {@link profileArn}: the `ModelId`
+     * its invocation metrics are reported under.
+     */
+    readonly profileId: string;
+    /** What the profile routes to. */
+    readonly source: FoundationModelIdentifier | InferenceProfile;
+}
 /** Options for {@link inferenceProfile.geographic}. */
 export type GeographicInferenceProfileOptions = Pick<GeographicInferenceProfile, "model" | "geography" | "routingRegions">;
 declare function geographic(options: GeographicInferenceProfileOptions): GeographicInferenceProfile;