@composurecdk/bedrock 0.10.1 → 0.10.3

package/dist/esm/inference-profile.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"inference-profile.d.ts","sourceRoot":"","sources":["../../src/inference-profile.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAC;AAEpE;;;;;;;;;GASG;AACH,eAAO,MAAM,6BAA6B,qDAAsD,CAAC;AAEjG,2EAA2E;AAC3E,MAAM,MAAM,yBAAyB,GAAG,CAAC,OAAO,6BAA6B,CAAC,CAAC,MAAM,CAAC,CAAC;AAIvF;;;;;GAKG;AACH,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,yBAAyB,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;IAC9D,+CAA+C;IAC/C,QAAQ,CAAC,KAAK,EAAE,yBAAyB,CAAC;IAC1C,4EAA4E;IAC5E,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;;;OAIG;IACH,QAAQ,CAAC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;CAC5C;AAED;;;;;GAKG;AACH,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,+CAA+C;IAC/C,QAAQ,CAAC,KAAK,EAAE,yBAAyB,CAAC;IAC1C,gFAAgF;IAChF,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,uDAAuD;AACvD,MAAM,MAAM,gBAAgB,GAAG,0BAA0B,GAAG,sBAAsB,CAAC;AAEnF,uDAAuD;AACvD,MAAM,MAAM,iCAAiC,GAAG,IAAI,CAClD,0BAA0B,EAC1B,OAAO,GAAG,WAAW,GAAG,gBAAgB,CACzC,CAAC;AA4CF,iBAAS,UAAU,CAAC,OAAO,EAAE,iCAAiC,GAAG,0BAA0B,CAiB1F;AAED,iBAAS,MAAM,CAAC,KAAK,EAAE,yBAAyB,GAAG,sBAAsB,CAGxE;AAaD,iBAAS,KAAK,CAAC,SAAS,EAAE,MAAM,GAAG,sBAAsB,CAAC;AAC1D,iBAAS,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,cAAc,EAAE,SAAS,MAAM,EAAE,GAAG,gBAAgB,CAAC;AAkBvF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,gBAAgB;IAC3B,8CAA8C;;IAE9C,4DAA4D;;IAE5D;;;;OAIG;;CAEJ,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,yBAAyB,CAE/E"}
+{"version":3,"file":"inference-profile.d.ts","sourceRoot":"","sources":["../../src/inference-profile.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAC;AAEpE;;;;;;;;;GASG;AACH,eAAO,MAAM,6BAA6B,qDAAsD,CAAC;AAEjG,2EAA2E;AAC3E,MAAM,MAAM,yBAAyB,GAAG,CAAC,OAAO,6BAA6B,CAAC,CAAC,MAAM,CAAC,CAAC;AAIvF;;;;;GAKG;AACH,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,yBAAyB,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;IAC9D,+CAA+C;IAC/C,QAAQ,CAAC,KAAK,EAAE,yBAAyB,CAAC;IAC1C,4EAA4E;IAC5E,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;;;OAIG;IACH,QAAQ,CAAC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;CAC5C;AAED;;;;;GAKG;AACH,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,+CAA+C;IAC/C,QAAQ,CAAC,KAAK,EAAE,yBAAyB,CAAC;IAC1C,gFAAgF;IAChF,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,uDAAuD;AACvD,MAAM,MAAM,gBAAgB,GAAG,0BAA0B,GAAG,sBAAsB,CAAC;AAEnF;;;;;;GAMG;AACH,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,6DAA6D;IAC7D,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B;;;OAGG;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,kCAAkC;IAClC,QAAQ,CAAC,MAAM,EAAE,yBAAyB,GAAG,gBAAgB,CAAC;CAC/D;AAED,uDAAuD;AACvD,MAAM,MAAM,iCAAiC,GAAG,IAAI,CAClD,0BAA0B,EAC1B,OAAO,GAAG,WAAW,GAAG,gBAAgB,CACzC,CAAC;AA4CF,iBAAS,UAAU,CAAC,OAAO,EAAE,iCAAiC,GAAG,0BAA0B,CAiB1F;AAED,iBAAS,MAAM,CAAC,KAAK,EAAE,yBAAyB,GAAG,sBAAsB,CAGxE;AAaD,iBAAS,KAAK,CAAC,SAAS,EAAE,MAAM,GAAG,sBAAsB,CAAC;AAC1D,iBAAS,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,cAAc,EAAE,SAAS,MAAM,EAAE,GAAG,gBAAgB,CAAC;AAkBvF;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,gBAAgB;IAC3B,8CAA8C;;IAE9C,4DAA4D;;IAE5D;;;;OAIG;;CAEJ,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,yBAAyB,CAE/E"}

package/dist/esm/inference-profile.js.map

@@ -1 +1 @@
-{"version":3,"file":"inference-profile.js","sourceRoot":"","sources":["../../src/inference-profile.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AACpC,OAAO,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAC;AAEpE;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAU,CAAC;AAKjG,MAAM,aAAa,GAAG,QAAQ,CAAC;AA8C/B,MAAM,iBAAiB,GAAG,oBAAoB,CAAC;AAC/C,MAAM,cAAc,GAAG,0BAA0B,CAAC;AAElD,SAAS,eAAe,CAAC,MAAc;IACrC,OAAO,CACL,MAAM,KAAK,aAAa;QACvB,6BAAmD,CAAC,QAAQ,CAAC,MAAM,CAAC,CACtE,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,EAAU;IAC1B,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC5B,OAAO,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAChD,CAAC;AAED,SAAS,WAAW,CAAC,KAAgC;IACnD,MAAM,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;IAC1B,IAAI,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,OAAO,KAAK,EAAE,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;IACpF,CAAC;IACD,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IACjC,IAAI,MAAM,KAAK,SAAS,IAAI,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CACb,IAAI,OAAO,2DAA2D;YACpE,+BAA+B,OAAO,gBAAgB,CACzD,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,SAAiB,EAAE,OAA0B;IACzE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,sBAAsB,SAAS,sCAAsC,CAAC,CAAC;IACzF,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YAC/D,MAAM,IAAI,KAAK,CACb,sBAAsB,SAAS,OAAO,MAAM,qCAAqC,CAClF,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,OAA0C;IAC5D,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC;IACrC,WAAW,CAAC,KAAK,CAAC,CAAC;IACnB,IAAI,SAAS,KAAK,aAAa,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QACtE,MAAM,IAAI,KAAK,CACb,IAAI,SAAS,kFAAkF,CAChG,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,GAAG,SAAS,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;IAClD,oBAAoB,CAAC,SAAS,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;IACxD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,IAAI,EAAE,YAAY;QAClB,SAAS;QACT,KAAK;QACL,SAAS;QACT,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC;KACpE,CAAC,CAAC;AACL,CAAC;AAED,SAAS,MAAM,CAAC,KAAgC;IAC9C,WAAW,CAAC,KAAK,CAAC,CAAC;IACnB,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,aAAa,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;AAClG,CAAC;AAED,SAAS,cAAc,CAAC,SAAiB;IACvC,MAAM,MAAM,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC;IACnC,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,KAAK,CACb,IAAI,SAAS,sEAAsE;YACjF,aAAa,CAAC,aAAa,EAAE,GAAG,6BAA6B,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAC/E,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC;AACjE,CAAC;AAID,SAAS,KAAK,CAAC,SAAiB,EAAE,cAAkC;IAClE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC;IACtD,MAAM,KAAK,GAAG,IAAI,yBAAyB,CAAC,OAAO,CAAC,CAAC;IACrD,IAAI,MAAM,KAAK,aAAa,EAAE,CAAC;QAC7B,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CACb,sBAAsB,SAAS,wEAAwE,CACxG,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IACD,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,sBAAsB,SAAS,+CAA+C,CAAC,CAAC;IAClG,CAAC;IACD,OAAO,UAAU,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;AAClE,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,8CAA8C;IAC9C,UAAU;IACV,4DAA4D;IAC5D,MAAM;IACN;;;;OAIG;IACH,KAAK;CACN,CAAC;AAEF;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,SAAiB;IAClD,OAAO,IAAI,yBAAyB,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,CAAC;AAC1E,CAAC"}
+{"version":3,"file":"inference-profile.js","sourceRoot":"","sources":["../../src/inference-profile.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AACpC,OAAO,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAC;AAEpE;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAU,CAAC;AAKjG,MAAM,aAAa,GAAG,QAAQ,CAAC;AAkE/B,MAAM,iBAAiB,GAAG,oBAAoB,CAAC;AAC/C,MAAM,cAAc,GAAG,0BAA0B,CAAC;AAElD,SAAS,eAAe,CAAC,MAAc;IACrC,OAAO,CACL,MAAM,KAAK,aAAa;QACvB,6BAAmD,CAAC,QAAQ,CAAC,MAAM,CAAC,CACtE,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,EAAU;IAC1B,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC5B,OAAO,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAChD,CAAC;AAED,SAAS,WAAW,CAAC,KAAgC;IACnD,MAAM,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;IAC1B,IAAI,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,OAAO,KAAK,EAAE,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;IACpF,CAAC;IACD,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IACjC,IAAI,MAAM,KAAK,SAAS,IAAI,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CACb,IAAI,OAAO,2DAA2D;YACpE,+BAA+B,OAAO,gBAAgB,CACzD,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,SAAiB,EAAE,OAA0B;IACzE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,sBAAsB,SAAS,sCAAsC,CAAC,CAAC;IACzF,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YAC/D,MAAM,IAAI,KAAK,CACb,sBAAsB,SAAS,OAAO,MAAM,qCAAqC,CAClF,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,OAA0C;IAC5D,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC;IACrC,WAAW,CAAC,KAAK,CAAC,CAAC;IACnB,IAAI,SAAS,KAAK,aAAa,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QACtE,MAAM,IAAI,KAAK,CACb,IAAI,SAAS,kFAAkF,CAChG,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,GAAG,SAAS,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;IAClD,oBAAoB,CAAC,SAAS,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;IACxD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,IAAI,EAAE,YAAY;QAClB,SAAS;QACT,KAAK;QACL,SAAS;QACT,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC;KACpE,CAAC,CAAC;AACL,CAAC;AAED,SAAS,MAAM,CAAC,KAAgC;IAC9C,WAAW,CAAC,KAAK,CAAC,CAAC;IACnB,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,aAAa,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;AAClG,CAAC;AAED,SAAS,cAAc,CAAC,SAAiB;IACvC,MAAM,MAAM,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC;IACnC,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,KAAK,CACb,IAAI,SAAS,sEAAsE;YACjF,aAAa,CAAC,aAAa,EAAE,GAAG,6BAA6B,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAC/E,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC;AACjE,CAAC;AAID,SAAS,KAAK,CAAC,SAAiB,EAAE,cAAkC;IAClE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC;IACtD,MAAM,KAAK,GAAG,IAAI,yBAAyB,CAAC,OAAO,CAAC,CAAC;IACrD,IAAI,MAAM,KAAK,aAAa,EAAE,CAAC;QAC7B,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CACb,sBAAsB,SAAS,wEAAwE,CACxG,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IACD,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,sBAAsB,SAAS,+CAA+C,CAAC,CAAC;IAClG,CAAC;IACD,OAAO,UAAU,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;AAClE,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,8CAA8C;IAC9C,UAAU;IACV,4DAA4D;IAC5D,MAAM;IACN;;;;OAIG;IACH,KAAK;CACN,CAAC;AAEF;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,SAAiB;IAClD,OAAO,IAAI,yBAAyB,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,CAAC;AAC1E,CAAC"}

package/dist/esm/inference-target.d.ts

@@ -1,12 +1,12 @@
 import type { FoundationModelIdentifier, IModel } from "aws-cdk-lib/aws-bedrock";
 import { type IConstruct } from "constructs";
-import type { InferenceProfile } from "./inference-profile.js";
+import type { ApplicationInferenceProfile, InferenceProfile } from "./inference-profile.js";
 /**
  * Anything a caller can invoke: an in-Region foundation model, a
- * system-defined inference profile, or any {@link IModel} (a provisioned
- * model, or `{ modelArn }` for a model ARN from elsewhere).
+ * system-defined or application inference profile, or any {@link IModel} (a
+ * provisioned model, or `{ modelArn }` for a model ARN from elsewhere).
  */
-export type InferenceTarget = FoundationModelIdentifier | InferenceProfile | IModel;
+export type InferenceTarget = FoundationModelIdentifier | InferenceProfile | ApplicationInferenceProfile | IModel;
 /** @internal */
 export declare function isInferenceProfile(target: InferenceTarget): target is InferenceProfile;
 /** One IAM statement's resources and conditions for invoking a target. @internal */
@@ -15,18 +15,25 @@ export interface InvocationStatement {
     readonly conditions?: Record<string, Record<string, unknown>>;
 }
 /**
- * The statements the Bedrock user guide prescribes for invoking `target` from
- * the Region `scope` deploys to.
+ * The statements for invoking `target` from the Region `scope` deploys to:
+ * those the Bedrock user guide prescribes, and for an application profile the
+ * shape verified against live IAM.
  *
  * @see https://docs.aws.amazon.com/bedrock/latest/userguide/geographic-cross-region-inference.html#geographic-cris-iam-setup
  * @see https://docs.aws.amazon.com/bedrock/latest/userguide/global-cross-region-inference.html#global-cris-iam-setup
  * @internal
  */
 export declare function invocationStatements(target: InferenceTarget, scope?: IConstruct): InvocationStatement[];
+/**
+ * The ARN that identifies `source` in `scope`'s Region: the foundation model
+ * or the system-defined profile. @internal
+ */
+export declare function sourceArn(source: FoundationModelIdentifier | InferenceProfile, scope: IConstruct | undefined): string;
 /**
  * Every resource ARN a caller in `scope`'s Region must be allowed to invoke to
  * use `target`. For a cross-Region profile that is the profile plus the
- * foundation model in the source Region and in each Region it routes to.
+ * foundation model in the source Region and in each Region it routes to; for
+ * an application profile, the profile plus its source's foundation models.
  *
  * {@link modelGrants.invoke} applies these with the conditions the Bedrock
  * user guide prescribes; use this list where you write a policy yourself,

package/dist/esm/inference-target.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"inference-target.d.ts","sourceRoot":"","sources":["../../src/inference-target.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AACjF,OAAO,EAAa,KAAK,UAAU,EAAE,MAAM,YAAY,CAAC;AACxD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAE/D;;;;GAIG;AACH,MAAM,MAAM,eAAe,GAAG,yBAAyB,GAAG,gBAAgB,GAAG,MAAM,CAAC;AAEpF,gBAAgB;AAChB,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,eAAe,GAAG,MAAM,IAAI,gBAAgB,CAEtF;AAMD,oFAAoF;AACpF,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAChC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CAC/D;AA4BD;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,eAAe,EACvB,KAAK,CAAC,EAAE,UAAU,GACjB,mBAAmB,EAAE,CAuDvB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,eAAe,EAAE,KAAK,CAAC,EAAE,UAAU,GAAG,MAAM,EAAE,CAEpF;AAED,gBAAgB;AAChB,wBAAgB,OAAO,CAAC,SAAS,EAAE,OAAO,GAAG,UAAU,GAAG,SAAS,CAElE"}
+{"version":3,"file":"inference-target.d.ts","sourceRoot":"","sources":["../../src/inference-target.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AACjF,OAAO,EAAa,KAAK,UAAU,EAAE,MAAM,YAAY,CAAC;AACxD,OAAO,KAAK,EAAE,2BAA2B,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAE5F;;;;GAIG;AACH,MAAM,MAAM,eAAe,GACzB,yBAAyB,GAAG,gBAAgB,GAAG,2BAA2B,GAAG,MAAM,CAAC;AAEtF,gBAAgB;AAChB,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,eAAe,GAAG,MAAM,IAAI,gBAAgB,CAEtF;AAUD,oFAAoF;AACpF,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,YAAY,EAAE,MAAM,EAAE,CAAC;IAChC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CAC/D;AA4BD;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,eAAe,EACvB,KAAK,CAAC,EAAE,UAAU,GACjB,mBAAmB,EAAE,CASvB;AA4DD;;;GAGG;AACH,wBAAgB,SAAS,CACvB,MAAM,EAAE,yBAAyB,GAAG,gBAAgB,EACpD,KAAK,EAAE,UAAU,GAAG,SAAS,GAC5B,MAAM,CAKR;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,eAAe,EAAE,KAAK,CAAC,EAAE,UAAU,GAAG,MAAM,EAAE,CAEpF;AAED,gBAAgB;AAChB,wBAAgB,OAAO,CAAC,SAAS,EAAE,OAAO,GAAG,UAAU,GAAG,SAAS,CAElE"}

package/dist/esm/inference-target.js

@@ -2,7 +2,10 @@ import { Arn, ArnFormat, Aws, Stack } from "aws-cdk-lib";
 import { Construct } from "constructs";
 /** @internal */
 export function isInferenceProfile(target) {
-    return "kind" in target;
+    return "kind" in target && (target.kind === "geographic" || target.kind === "global");
+}
+function isApplicationProfile(target) {
+    return "kind" in target && target.kind === "application";
 }
 function isModel(target) {
     return "modelArn" in target;
@@ -24,8 +27,9 @@ function bedrockArn(partition, resource, resourceName, region, account = "") {
     });
 }
 /**
- * The statements the Bedrock user guide prescribes for invoking `target` from
- * the Region `scope` deploys to.
+ * The statements for invoking `target` from the Region `scope` deploys to:
+ * those the Bedrock user guide prescribes, and for an application profile the
+ * shape verified against live IAM.
  *
  * @see https://docs.aws.amazon.com/bedrock/latest/userguide/geographic-cross-region-inference.html#geographic-cris-iam-setup
  * @see https://docs.aws.amazon.com/bedrock/latest/userguide/global-cross-region-inference.html#global-cris-iam-setup
@@ -34,52 +38,75 @@ function bedrockArn(partition, resource, resourceName, region, account = "") {
 export function invocationStatements(target, scope) {
     if (isModel(target))
         return [{ resourceArns: [target.modelArn] }];
-    const { partition, region: sourceRegion, account } = environmentOf(scope);
+    if (isApplicationProfile(target)) {
+        return [
+            { resourceArns: [target.profileArn] },
+            ...sourceStatements(target.source, scope, target.profileArn),
+        ];
+    }
+    return sourceStatements(target, scope);
+}
+/**
+ * Statements for a foundation model or system-defined profile. Through an
+ * application profile (`viaProfile`), Bedrock checks only that profile's ARN
+ * in `bedrock:InferenceProfileArn` and needs no access to the source profile
+ * itself (verified live for a global source), so none is granted.
+ */
+function sourceStatements(target, scope, viaProfile) {
+    const { partition, region: sourceRegion } = environmentOf(scope);
     const modelArn = (modelId, region) => bedrockArn(partition, "foundation-model", modelId, region);
+    const through = (arn) => ({ "bedrock:InferenceProfileArn": arn });
     if (!isInferenceProfile(target)) {
-        return [{ resourceArns: [modelArn(target.modelId, sourceRegion)] }];
-    }
-    const profileArn = bedrockArn(partition, "inference-profile", target.profileId, sourceRegion, account);
-    const { modelId } = target.model;
-    if (target.kind === "geographic") {
-        const regions = [...new Set([sourceRegion, ...target.routingRegions])];
         return [
-            { resourceArns: [profileArn] },
             {
-                resourceArns: regions.map((region) => modelArn(modelId, region)),
-                conditions: { StringEquals: { "bedrock:InferenceProfileArn": profileArn } },
+                resourceArns: [modelArn(target.modelId, sourceRegion)],
+                ...(viaProfile && { conditions: { StringEquals: through(viaProfile) } }),
             },
         ];
     }
-    return [
-        {
-            resourceArns: [profileArn],
+    const profileArn = sourceArn(target, scope);
+    const via = through(viaProfile ?? profileArn);
+    const { modelId } = target.model;
+    const ownProfile = {
+        resourceArns: [profileArn],
+        ...(target.kind === "global" && {
             conditions: { StringEquals: { "aws:RequestedRegion": sourceRegion } },
-        },
-        {
-            resourceArns: [modelArn(modelId, sourceRegion)],
-            conditions: {
-                StringEquals: {
-                    "aws:RequestedRegion": sourceRegion,
-                    "bedrock:InferenceProfileArn": profileArn,
-                },
+        }),
+    };
+    const models = target.kind === "geographic"
+        ? [
+            {
+                resourceArns: [...new Set([sourceRegion, ...target.routingRegions])].map((region) => modelArn(modelId, region)),
+                conditions: { StringEquals: via },
             },
-        },
-        {
-            resourceArns: [modelArn(modelId, "")],
-            conditions: {
-                StringEquals: {
-                    "aws:RequestedRegion": "unspecified",
-                    "bedrock:InferenceProfileArn": profileArn,
-                },
+        ]
+        : [
+            {
+                resourceArns: [modelArn(modelId, sourceRegion)],
+                conditions: { StringEquals: { "aws:RequestedRegion": sourceRegion, ...via } },
+            },
+            {
+                resourceArns: [modelArn(modelId, "")],
+                conditions: { StringEquals: { "aws:RequestedRegion": "unspecified", ...via } },
             },
-        },
-    ];
+        ];
+    return viaProfile ? models : [ownProfile, ...models];
+}
+/**
+ * The ARN that identifies `source` in `scope`'s Region: the foundation model
+ * or the system-defined profile. @internal
+ */
+export function sourceArn(source, scope) {
+    const { partition, region, account } = environmentOf(scope);
+    return isInferenceProfile(source)
+        ? bedrockArn(partition, "inference-profile", source.profileId, region, account)
+        : bedrockArn(partition, "foundation-model", source.modelId, region);
 }
 /**
  * Every resource ARN a caller in `scope`'s Region must be allowed to invoke to
  * use `target`. For a cross-Region profile that is the profile plus the
- * foundation model in the source Region and in each Region it routes to.
+ * foundation model in the source Region and in each Region it routes to; for
+ * an application profile, the profile plus its source's foundation models.
  *
  * {@link modelGrants.invoke} applies these with the conditions the Bedrock
  * user guide prescribes; use this list where you write a policy yourself,

package/dist/esm/inference-target.js.map

@@ -1 +1 @@
-{"version":3,"file":"inference-target.js","sourceRoot":"","sources":["../../src/inference-target.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAEzD,OAAO,EAAE,SAAS,EAAmB,MAAM,YAAY,CAAC;AAUxD,gBAAgB;AAChB,MAAM,UAAU,kBAAkB,CAAC,MAAuB;IACxD,OAAO,MAAM,IAAI,MAAM,CAAC;AAC1B,CAAC;AAED,SAAS,OAAO,CAAC,MAAuB;IACtC,OAAO,UAAU,IAAI,MAAM,CAAC;AAC9B,CAAC;AAUD,SAAS,aAAa,CAAC,KAA6B;IAClD,OAAO,KAAK,KAAK,SAAS;QACxB,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,UAAU,EAAE;QAC3E,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC;AACtB,CAAC;AAED,SAAS,UAAU,CACjB,SAAiB,EACjB,QAAgB,EAChB,YAAoB,EACpB,MAAc,EACd,OAAO,GAAG,EAAE;IAEZ,OAAO,GAAG,CAAC,MAAM,CAAC;QAChB,SAAS;QACT,OAAO,EAAE,SAAS;QAClB,MAAM;QACN,OAAO;QACP,QAAQ;QACR,YAAY;QACZ,SAAS,EAAE,SAAS,CAAC,mBAAmB;KACzC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAClC,MAAuB,EACvB,KAAkB;IAElB,IAAI,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,CAAC,EAAE,YAAY,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAElE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IAC1E,MAAM,QAAQ,GAAG,CAAC,OAAe,EAAE,MAAc,EAAE,EAAE,CACnD,UAAU,CAAC,SAAS,EAAE,kBAAkB,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IAE7D,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC;QAChC,OAAO,CAAC,EAAE,YAAY,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,EAAE,CAAC,CAAC;IACtE,CAAC;IAED,MAAM,UAAU,GAAG,UAAU,CAC3B,SAAS,EACT,mBAAmB,EACnB,MAAM,CAAC,SAAS,EAChB,YAAY,EACZ,OAAO,CACR,CAAC;IACF,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC;IAEjC,IAAI,MAAM,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;QACjC,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,YAAY,EAAE,GAAG,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC;QACvE,OAAO;YACL,EAAE,YAAY,EAAE,CAAC,UAAU,CAAC,EAAE;YAC9B;gBACE,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;gBAChE,UAAU,EAAE,EAAE,YAAY,EAAE,EAAE,6BAA6B,EAAE,UAAU,EAAE,EAAE;aAC5E;SACF,CAAC;IACJ,CAAC;IAED,OAAO;QACL;YACE,YAAY,EAAE,CAAC,UAAU,CAAC;YAC1B,UAAU,EAAE,EAAE,YAAY,EAAE,EAAE,qBAAqB,EAAE,YAAY,EAAE,EAAE;SACtE;QACD;YACE,YAAY,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;YAC/C,UAAU,EAAE;gBACV,YAAY,EAAE;oBACZ,qBAAqB,EAAE,YAAY;oBACnC,6BAA6B,EAAE,UAAU;iBAC1C;aACF;SACF;QACD;YACE,YAAY,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YACrC,UAAU,EAAE;gBACV,YAAY,EAAE;oBACZ,qBAAqB,EAAE,aAAa;oBACpC,6BAA6B,EAAE,UAAU;iBAC1C;aACF;SACF;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,cAAc,CAAC,MAAuB,EAAE,KAAkB;IACxE,OAAO,oBAAoB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;AAC5E,CAAC;AAED,gBAAgB;AAChB,MAAM,UAAU,OAAO,CAAC,SAAkB;IACxC,OAAO,SAAS,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;AAClE,CAAC"}
+{"version":3,"file":"inference-target.js","sourceRoot":"","sources":["../../src/inference-target.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAEzD,OAAO,EAAE,SAAS,EAAmB,MAAM,YAAY,CAAC;AAWxD,gBAAgB;AAChB,MAAM,UAAU,kBAAkB,CAAC,MAAuB;IACxD,OAAO,MAAM,IAAI,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,YAAY,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;AACxF,CAAC;AAED,SAAS,oBAAoB,CAAC,MAAuB;IACnD,OAAO,MAAM,IAAI,MAAM,IAAI,MAAM,CAAC,IAAI,KAAK,aAAa,CAAC;AAC3D,CAAC;AAED,SAAS,OAAO,CAAC,MAAuB;IACtC,OAAO,UAAU,IAAI,MAAM,CAAC;AAC9B,CAAC;AAUD,SAAS,aAAa,CAAC,KAA6B;IAClD,OAAO,KAAK,KAAK,SAAS;QACxB,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,UAAU,EAAE;QAC3E,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC;AACtB,CAAC;AAED,SAAS,UAAU,CACjB,SAAiB,EACjB,QAAgB,EAChB,YAAoB,EACpB,MAAc,EACd,OAAO,GAAG,EAAE;IAEZ,OAAO,GAAG,CAAC,MAAM,CAAC;QAChB,SAAS;QACT,OAAO,EAAE,SAAS;QAClB,MAAM;QACN,OAAO;QACP,QAAQ;QACR,YAAY;QACZ,SAAS,EAAE,SAAS,CAAC,mBAAmB;KACzC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB,CAClC,MAAuB,EACvB,KAAkB;IAElB,IAAI,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,CAAC,EAAE,YAAY,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAClE,IAAI,oBAAoB,CAAC,MAAM,CAAC,EAAE,CAAC;QACjC,OAAO;YACL,EAAE,YAAY,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE;YACrC,GAAG,gBAAgB,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,UAAU,CAAC;SAC7D,CAAC;IACJ,CAAC;IACD,OAAO,gBAAgB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;AACzC,CAAC;AAED;;;;;GAKG;AACH,SAAS,gBAAgB,CACvB,MAAoD,EACpD,KAA6B,EAC7B,UAAmB;IAEnB,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACjE,MAAM,QAAQ,GAAG,CAAC,OAAe,EAAE,MAAc,EAAE,EAAE,CACnD,UAAU,CAAC,SAAS,EAAE,kBAAkB,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IAC7D,MAAM,OAAO,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,CAAC,EAAE,6BAA6B,EAAE,GAAG,EAAE,CAAC,CAAC;IAE1E,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC;QAChC,OAAO;YACL;gBACE,YAAY,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;gBACtD,GAAG,CAAC,UAAU,IAAI,EAAE,UAAU,EAAE,EAAE,YAAY,EAAE,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;aACzE;SACF,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC5C,MAAM,GAAG,GAAG,OAAO,CAAC,UAAU,IAAI,UAAU,CAAC,CAAC;IAC9C,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC;IAEjC,MAAM,UAAU,GAAwB;QACtC,YAAY,EAAE,CAAC,UAAU,CAAC;QAC1B,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI;YAC9B,UAAU,EAAE,EAAE,YAAY,EAAE,EAAE,qBAAqB,EAAE,YAAY,EAAE,EAAE;SACtE,CAAC;KACH,CAAC;IACF,MAAM,MAAM,GACV,MAAM,CAAC,IAAI,KAAK,YAAY;QAC1B,CAAC,CAAC;YACE;gBACE,YAAY,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,YAAY,EAAE,GAAG,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAClF,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,CAC1B;gBACD,UAAU,EAAE,EAAE,YAAY,EAAE,GAAG,EAAE;aAClC;SACF;QACH,CAAC,CAAC;YACE;gBACE,YAAY,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;gBAC/C,UAAU,EAAE,EAAE,YAAY,EAAE,EAAE,qBAAqB,EAAE,YAAY,EAAE,GAAG,GAAG,EAAE,EAAE;aAC9E;YACD;gBACE,YAAY,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;gBACrC,UAAU,EAAE,EAAE,YAAY,EAAE,EAAE,qBAAqB,EAAE,aAAa,EAAE,GAAG,GAAG,EAAE,EAAE;aAC/E;SACF,CAAC;IACR,OAAO,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,GAAG,MAAM,CAAC,CAAC;AACvD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,SAAS,CACvB,MAAoD,EACpD,KAA6B;IAE7B,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IAC5D,OAAO,kBAAkB,CAAC,MAAM,CAAC;QAC/B,CAAC,CAAC,UAAU,CAAC,SAAS,EAAE,mBAAmB,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC;QAC/E,CAAC,CAAC,UAAU,CAAC,SAAS,EAAE,kBAAkB,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;AACxE,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,cAAc,CAAC,MAAuB,EAAE,KAAkB;IACxE,OAAO,oBAAoB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;AAC5E,CAAC;AAED,gBAAgB;AAChB,MAAM,UAAU,OAAO,CAAC,SAAkB;IACxC,OAAO,SAAS,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;AAClE,CAAC"}

package/dist/esm/model-alarm-defaults.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"model-alarm-defaults.d.ts","sourceRoot":"","sources":["../../src/model-alarm-defaults.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAYpE,UAAU,kBAAkB;IAC1B,OAAO,EAAE,IAAI,CAAC;IACd,mBAAmB,EAAE,mBAAmB,CAAC;IACzC,sBAAsB,EAAE,mBAAmB,CAAC;IAC5C,sBAAsB,EAAE,mBAAmB,CAAC;IAC5C,2EAA2E;IAC3E,KAAK,EAAE,IAAI,CAAC,mBAAmB,EAAE,WAAW,CAAC,CAAC;IAC9C,sBAAsB,EAAE;QAAE,gBAAgB,EAAE,MAAM,CAAA;KAAE,CAAC;CACtD;AAED;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,EAAE,kBAQlC,CAAC"}
+{"version":3,"file":"model-alarm-defaults.d.ts","sourceRoot":"","sources":["../../src/model-alarm-defaults.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAGpE,UAAU,kBAAkB;IAC1B,OAAO,EAAE,IAAI,CAAC;IACd,mBAAmB,EAAE,mBAAmB,CAAC;IACzC,sBAAsB,EAAE,mBAAmB,CAAC;IAC5C,sBAAsB,EAAE,mBAAmB,CAAC;IAC5C,2EAA2E;IAC3E,KAAK,EAAE,IAAI,CAAC,mBAAmB,EAAE,WAAW,CAAC,CAAC;IAC9C,sBAAsB,EAAE;QAAE,gBAAgB,EAAE,MAAM,CAAA;KAAE,CAAC;CACtD;AAED;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,EAAE,kBAQlC,CAAC"}

package/dist/esm/model-alarm-defaults.js

@@ -1,13 +1,4 @@
-import { TreatMissingData } from "aws-cdk-lib/aws-cloudwatch";
-/**
- * 3 breaching minutes out of 5: SDK retries absorb isolated throttles and
- * transient errors, so a single datapoint is noise. No traffic emits no data.
- */
-const SUSTAINED = {
-    evaluationPeriods: 5,
-    datapointsToAlarm: 3,
-    treatMissingData: TreatMissingData.NOT_BREACHING,
-};
+import { SUSTAINED } from "./alarm-definition.js";
 /**
  * Default alarm configuration for a Bedrock model. AWS publishes no Bedrock
  * thresholds; these follow the shape of AWS's recommended Lambda `Errors` and

package/dist/esm/model-alarm-defaults.js.map

@@ -1 +1 @@
-{"version":3,"file":"model-alarm-defaults.js","sourceRoot":"","sources":["../../src/model-alarm-defaults.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAG9D;;;GAGG;AACH,MAAM,SAAS,GAAG;IAChB,iBAAiB,EAAE,CAAC;IACpB,iBAAiB,EAAE,CAAC;IACpB,gBAAgB,EAAE,gBAAgB,CAAC,aAAa;CACjD,CAAC;AAYF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAuB;IACtD,OAAO,EAAE,IAAI;IACb,mBAAmB,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,GAAG,SAAS,EAAE;IACnD,sBAAsB,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,GAAG,SAAS,EAAE;IACtD,sBAAsB,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,GAAG,SAAS,EAAE;IACtD,KAAK,EAAE,SAAS;IAChB,gEAAgE;IAChE,sBAAsB,EAAE,EAAE,gBAAgB,EAAE,GAAG,EAAE;CAClD,CAAC"}
+{"version":3,"file":"model-alarm-defaults.js","sourceRoot":"","sources":["../../src/model-alarm-defaults.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAYlD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAuB;IACtD,OAAO,EAAE,IAAI;IACb,mBAAmB,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,GAAG,SAAS,EAAE;IACnD,sBAAsB,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,GAAG,SAAS,EAAE;IACtD,sBAAsB,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,GAAG,SAAS,EAAE;IACtD,KAAK,EAAE,SAAS;IAChB,gEAAgE;IAChE,sBAAsB,EAAE,EAAE,gBAAgB,EAAE,GAAG,EAAE;CAClD,CAAC"}

package/dist/esm/model-alarms.d.ts

@@ -2,10 +2,10 @@ import type { FoundationModelIdentifier } from "aws-cdk-lib/aws-bedrock";
 import { Metric, type MetricOptions } from "aws-cdk-lib/aws-cloudwatch";
 import type { IConstruct } from "constructs";
 import type { AlarmDefinition } from "@composurecdk/cloudwatch";
-import type { InferenceProfile } from "./inference-profile.js";
+import type { ApplicationInferenceProfile, InferenceProfile } from "./inference-profile.js";
 import type { ModelAlarmConfig } from "./model-alarm-config.js";
 /** A model whose `AWS/Bedrock` metrics an alarm can read. */
-export type ModelAlarmTarget = FoundationModelIdentifier | InferenceProfile;
+export type ModelAlarmTarget = FoundationModelIdentifier | InferenceProfile | ApplicationInferenceProfile;
 /** `AWS/Bedrock` metrics for one model, for alarms added with `addAlarm()`. */
 export interface ModelMetrics {
     /** The `ModelId` dimension value: the model or inference profile id invoked. */

package/dist/esm/model-alarms.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"model-alarms.d.ts","sourceRoot":"","sources":["../../src/model-alarms.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAC;AACzE,OAAO,EAAsB,MAAM,EAAE,KAAK,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC5F,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,KAAK,EAEV,eAAe,EAEhB,MAAM,0BAA0B,CAAC;AAElC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAE/D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAGhE,6DAA6D;AAC7D,MAAM,MAAM,gBAAgB,GAAG,yBAAyB,GAAG,gBAAgB,CAAC;AAE5E,+EAA+E;AAC/E,MAAM,WAAW,YAAY;IAC3B,gFAAgF;IAChF,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,8DAA8D;IAC9D,MAAM,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,MAAM,CAAC;CAC7D;AAID,sDAAsD;AACtD,wBAAgB,YAAY,CAAC,MAAM,EAAE,gBAAgB,GAAG,YAAY,CAanE;AA6GD,0EAA0E;AAC1E,wBAAgB,4BAA4B,CAC1C,KAAK,EAAE,UAAU,EACjB,OAAO,EAAE,YAAY,EACrB,MAAM,EAAE,gBAAgB,GAAG,SAAS,GACnC,eAAe,EAAE,CA6BnB"}
+{"version":3,"file":"model-alarms.d.ts","sourceRoot":"","sources":["../../src/model-alarms.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAC;AACzE,OAAO,EAAE,MAAM,EAAE,KAAK,aAAa,EAAE,MAAM,4BAA4B,CAAC;AACxE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAOhE,OAAO,KAAK,EAAE,2BAA2B,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC5F,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAGhE,6DAA6D;AAC7D,MAAM,MAAM,gBAAgB,GAC1B,yBAAyB,GAAG,gBAAgB,GAAG,2BAA2B,CAAC;AAE7E,+EAA+E;AAC/E,MAAM,WAAW,YAAY;IAC3B,gFAAgF;IAChF,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,8DAA8D;IAC9D,MAAM,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,MAAM,CAAC;CAC7D;AAID,sDAAsD;AACtD,wBAAgB,YAAY,CAAC,MAAM,EAAE,gBAAgB,GAAG,YAAY,CAanE;AAoFD,0EAA0E;AAC1E,wBAAgB,4BAA4B,CAC1C,KAAK,EAAE,UAAU,EACjB,OAAO,EAAE,YAAY,EACrB,MAAM,EAAE,gBAAgB,GAAG,SAAS,GACnC,eAAe,EAAE,CAUnB"}

package/dist/esm/model-alarms.js

@@ -1,12 +1,12 @@
 import { Duration } from "aws-cdk-lib";
-import { ComparisonOperator, Metric } from "aws-cdk-lib/aws-cloudwatch";
+import { Metric } from "aws-cdk-lib/aws-cloudwatch";
 import { resolveAlarmConfig, resolveAlarmThresholdBasis } from "@composurecdk/cloudwatch";
-import { isInferenceProfile } from "./inference-target.js";
+import { resolveThresholdAlarms, toDefinition, } from "./alarm-definition.js";
 import { MODEL_ALARM_DEFAULTS } from "./model-alarm-defaults.js";
 const PERIOD = Duration.minutes(1);
 /** Returns the `AWS/Bedrock` metrics for `target`. */
 export function modelMetrics(target) {
-    const modelId = isInferenceProfile(target) ? target.profileId : target.modelId;
+    const modelId = "profileId" in target ? target.profileId : target.modelId;
     return {
         modelId,
         metric: (metricName, options) => new Metric({
@@ -18,49 +18,38 @@ export function modelMetrics(target) {
         }),
     };
 }
-const THRESHOLD_ALARMS = {
-    invocationThrottles: {
-        metricName: "InvocationThrottles",
-        statistic: "Sum",
-        defaults: MODEL_ALARM_DEFAULTS.invocationThrottles,
-        describe: (id, t) => `Bedrock is throttling requests to ${id}; the account's quota for the model is exhausted. ` +
-            `Threshold: > ${String(t)} per minute.`,
-    },
-    invocationServerErrors: {
-        metricName: "InvocationServerErrors",
-        statistic: "Sum",
-        defaults: MODEL_ALARM_DEFAULTS.invocationServerErrors,
-        describe: (id, t) => `Bedrock is returning server errors for ${id}. Threshold: > ${String(t)} per minute.`,
-    },
-    invocationClientErrors: {
-        metricName: "InvocationClientErrors",
-        statistic: "Sum",
-        defaults: MODEL_ALARM_DEFAULTS.invocationClientErrors,
-        describe: (id, t) => `Requests to ${id} are failing with client errors, such as AccessDenied or validation ` +
-            `errors. Threshold: > ${String(t)} per minute.`,
-    },
-    invocationLatency: {
-        metricName: "InvocationLatency",
-        statistic: "p90",
-        describe: (id, t) => `p90 invocation latency for ${id} exceeds ${String(t)} ms.`,
-    },
-    timeToFirstToken: {
-        metricName: "TimeToFirstToken",
-        statistic: "p90",
-        describe: (id, t) => `p90 time to first token for ${id} exceeds ${String(t)} ms.`,
-    },
-};
-function toDefinition(key, metric, cfg, description) {
+function thresholdAlarms(modelId) {
     return {
-        key,
-        alarmName: cfg.alarmName,
-        metric,
-        threshold: cfg.threshold,
-        comparisonOperator: ComparisonOperator.GREATER_THAN_THRESHOLD,
-        evaluationPeriods: cfg.evaluationPeriods,
-        datapointsToAlarm: cfg.datapointsToAlarm,
-        treatMissingData: cfg.treatMissingData,
-        description,
+        invocationThrottles: {
+            metricName: "InvocationThrottles",
+            statistic: "Sum",
+            defaults: MODEL_ALARM_DEFAULTS.invocationThrottles,
+            describe: (t) => `Bedrock is throttling requests to ${modelId}; the account's quota for the model is ` +
+                `exhausted. Threshold: > ${String(t)} per minute.`,
+        },
+        invocationServerErrors: {
+            metricName: "InvocationServerErrors",
+            statistic: "Sum",
+            defaults: MODEL_ALARM_DEFAULTS.invocationServerErrors,
+            describe: (t) => `Bedrock is returning server errors for ${modelId}. Threshold: > ${String(t)} per minute.`,
+        },
+        invocationClientErrors: {
+            metricName: "InvocationClientErrors",
+            statistic: "Sum",
+            defaults: MODEL_ALARM_DEFAULTS.invocationClientErrors,
+            describe: (t) => `Requests to ${modelId} are failing with client errors, such as AccessDenied or ` +
+                `validation errors. Threshold: > ${String(t)} per minute.`,
+        },
+        invocationLatency: {
+            metricName: "InvocationLatency",
+            statistic: "p90",
+            describe: (t) => `p90 invocation latency for ${modelId} exceeds ${String(t)} ms.`,
+        },
+        timeToFirstToken: {
+            metricName: "TimeToFirstToken",
+            statistic: "p90",
+            describe: (t) => `p90 time to first token for ${modelId} exceeds ${String(t)} ms.`,
+        },
     };
 }
 function quotaAlarm(scope, metrics, config) {
@@ -93,19 +82,7 @@ function quotaAlarm(scope, metrics, config) {
 export function resolveModelAlarmDefinitions(scope, metrics, config) {
     if (config?.enabled === false)
         return [];
-    const definitions = Object.entries(THRESHOLD_ALARMS).flatMap(([key, spec]) => {
-        const userConfig = config?.[key];
-        if (userConfig === false || (userConfig === undefined && !spec.defaults))
-            return [];
-        if (!spec.defaults && userConfig?.threshold === undefined) {
-            throw new Error(`The "${key}" alarm has no default threshold. Supply one, e.g. ` +
-                `recommendedAlarms({ ${key}: { threshold: … } }).`);
-        }
-        const cfg = resolveAlarmConfig(userConfig, spec.defaults ?? { ...MODEL_ALARM_DEFAULTS.optIn, threshold: 0 });
-        return [
-            toDefinition(key, metrics.metric(spec.metricName, { statistic: spec.statistic }), cfg, spec.describe(metrics.modelId, cfg.threshold)),
-        ];
-    });
+    const definitions = resolveThresholdAlarms(thresholdAlarms(metrics.modelId), config, (metricName, statistic) => metrics.metric(metricName, { statistic }));
     return [...definitions, ...quotaAlarm(scope, metrics, config?.estimatedTpmQuotaUsage)];
 }
 //# sourceMappingURL=model-alarms.js.map

package/dist/esm/model-alarms.js.map

@@ -1 +1 @@
-{"version":3,"file":"model-alarms.js","sourceRoot":"","sources":["../../src/model-alarms.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAEvC,OAAO,EAAE,kBAAkB,EAAE,MAAM,EAAsB,MAAM,4BAA4B,CAAC;AAO5F,OAAO,EAAE,kBAAkB,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AAE1F,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAE3D,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAajE,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAEnC,sDAAsD;AACtD,MAAM,UAAU,YAAY,CAAC,MAAwB;IACnD,MAAM,OAAO,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;IAC/E,OAAO;QACL,OAAO;QACP,MAAM,EAAE,CAAC,UAAU,EAAE,OAAO,EAAE,EAAE,CAC9B,IAAI,MAAM,CAAC;YACT,SAAS,EAAE,aAAa;YACxB,UAAU;YACV,aAAa,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE;YACnC,MAAM,EAAE,MAAM;YACd,GAAG,OAAO;SACX,CAAC;KACL,CAAC;AACJ,CAAC;AAYD,MAAM,gBAAgB,GAAyC;IAC7D,mBAAmB,EAAE;QACnB,UAAU,EAAE,qBAAqB;QACjC,SAAS,EAAE,KAAK;QAChB,QAAQ,EAAE,oBAAoB,CAAC,mBAAmB;QAClD,QAAQ,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,CAClB,qCAAqC,EAAE,oDAAoD;YAC3F,gBAAgB,MAAM,CAAC,CAAC,CAAC,cAAc;KAC1C;IACD,sBAAsB,EAAE;QACtB,UAAU,EAAE,wBAAwB;QACpC,SAAS,EAAE,KAAK;QAChB,QAAQ,EAAE,oBAAoB,CAAC,sBAAsB;QACrD,QAAQ,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,CAClB,0CAA0C,EAAE,kBAAkB,MAAM,CAAC,CAAC,CAAC,cAAc;KACxF;IACD,sBAAsB,EAAE;QACtB,UAAU,EAAE,wBAAwB;QACpC,SAAS,EAAE,KAAK;QAChB,QAAQ,EAAE,oBAAoB,CAAC,sBAAsB;QACrD,QAAQ,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,CAClB,eAAe,EAAE,sEAAsE;YACvF,wBAAwB,MAAM,CAAC,CAAC,CAAC,cAAc;KAClD;IACD,iBAAiB,EAAE;QACjB,UAAU,EAAE,mBAAmB;QAC/B,SAAS,EAAE,KAAK;QAChB,QAAQ,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,8BAA8B,EAAE,YAAY,MAAM,CAAC,CAAC,CAAC,MAAM;KACjF;IACD,gBAAgB,EAAE;QAChB,UAAU,EAAE,kBAAkB;QAC9B,SAAS,EAAE,KAAK;QAChB,QAAQ,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,+BAA+B,EAAE,YAAY,MAAM,CAAC,CAAC,CAAC,MAAM;KAClF;CACF,CAAC;AAEF,SAAS,YAAY,CACnB,GAAW,EACX,MAAc,EACd,GAAwB,EACxB,WAAmB;IAEnB,OAAO;QACL,GAAG;QACH,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,MAAM;QACN,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,kBAAkB,EAAE,kBAAkB,CAAC,sBAAsB;QAC7D,iBAAiB,EAAE,GAAG,CAAC,iBAAiB;QACxC,iBAAiB,EAAE,GAAG,CAAC,iBAAiB;QACxC,gBAAgB,EAAE,GAAG,CAAC,gBAAgB;QACtC,WAAW;KACZ,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CACjB,KAAiB,EACjB,OAAqB,EACrB,MAAkD;IAElD,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,CAAC;IACvB,MAAM,KAAK,GAAG,0BAA0B,CAAC;QACvC,KAAK;QACL,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACjB,SAAS,EAAE,6CAA6C;QACxD,UAAU,EAAE,mCAAmC;QAC/C,YAAY,EAAE,sDAAsD;KACrE,CAAC,CAAC;IACH,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACnC,MAAM,OAAO,GACX,MAAM,CAAC,gBAAgB,IAAI,oBAAoB,CAAC,sBAAsB,CAAC,gBAAgB,CAAC;IAC1F,IAAI,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CACb,gEAAgE,MAAM,CAAC,KAAK,CAAC,GAAG,CACjF,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,CAAC,OAAO,GAAG,CAAC,IAAI,OAAO,IAAI,CAAC,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CACb,mEAAmE,MAAM,CAAC,OAAO,CAAC,GAAG,CACtF,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,kBAAkB,CAC5B,EAAE,GAAG,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,OAAO,CAAC,EAAE,EACrD,EAAE,GAAG,oBAAoB,CAAC,KAAK,EAAE,SAAS,EAAE,CAAC,EAAE,CAChD,CAAC;IACF,OAAO;QACL,YAAY,CACV,wBAAwB,EACxB,OAAO,CAAC,MAAM,CAAC,wBAAwB,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,EAClE,GAAG,EACH,6BAA6B,OAAO,CAAC,OAAO,YAAY,MAAM,CAAC,OAAO,GAAG,GAAG,CAAC,WAAW;YACtF,GAAG,MAAM,CAAC,KAAK,CAAC,2BAA2B,CAC9C;KACF,CAAC;AACJ,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,4BAA4B,CAC1C,KAAiB,EACjB,OAAqB,EACrB,MAAoC;IAEpC,IAAI,MAAM,EAAE,OAAO,KAAK,KAAK;QAAE,OAAO,EAAE,CAAC;IAEzC,MAAM,WAAW,GACf,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAChC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE;QACxB,MAAM,UAAU,GAAG,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,UAAU,KAAK,KAAK,IAAI,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC;YAAE,OAAO,EAAE,CAAC;QACpF,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,UAAU,EAAE,SAAS,KAAK,SAAS,EAAE,CAAC;YAC1D,MAAM,IAAI,KAAK,CACb,QAAQ,GAAG,qDAAqD;gBAC9D,uBAAuB,GAAG,wBAAwB,CACrD,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,GAAG,kBAAkB,CAC5B,UAAU,EACV,IAAI,CAAC,QAAQ,IAAI,EAAE,GAAG,oBAAoB,CAAC,KAAK,EAAE,SAAS,EAAE,CAAC,EAAE,CACjE,CAAC;QACF,OAAO;YACL,YAAY,CACV,GAAG,EACH,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,EAC9D,GAAG,EACH,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,SAAS,CAAC,CAC9C;SACF,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,OAAO,CAAC,GAAG,WAAW,EAAE,GAAG,UAAU,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,sBAAsB,CAAC,CAAC,CAAC;AACzF,CAAC"}
+{"version":3,"file":"model-alarms.js","sourceRoot":"","sources":["../../src/model-alarms.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAEvC,OAAO,EAAE,MAAM,EAAsB,MAAM,4BAA4B,CAAC;AAGxE,OAAO,EAAE,kBAAkB,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AAC1F,OAAO,EACL,sBAAsB,EAEtB,YAAY,GACb,MAAM,uBAAuB,CAAC;AAG/B,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAcjE,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAEnC,sDAAsD;AACtD,MAAM,UAAU,YAAY,CAAC,MAAwB;IACnD,MAAM,OAAO,GAAG,WAAW,IAAI,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;IAC1E,OAAO;QACL,OAAO;QACP,MAAM,EAAE,CAAC,UAAU,EAAE,OAAO,EAAE,EAAE,CAC9B,IAAI,MAAM,CAAC;YACT,SAAS,EAAE,aAAa;YACxB,UAAU;YACV,aAAa,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE;YACnC,MAAM,EAAE,MAAM;YACd,GAAG,OAAO;SACX,CAAC;KACL,CAAC;AACJ,CAAC;AAID,SAAS,eAAe,CAAC,OAAe;IACtC,OAAO;QACL,mBAAmB,EAAE;YACnB,UAAU,EAAE,qBAAqB;YACjC,SAAS,EAAE,KAAK;YAChB,QAAQ,EAAE,oBAAoB,CAAC,mBAAmB;YAClD,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CACd,qCAAqC,OAAO,yCAAyC;gBACrF,2BAA2B,MAAM,CAAC,CAAC,CAAC,cAAc;SACrD;QACD,sBAAsB,EAAE;YACtB,UAAU,EAAE,wBAAwB;YACpC,SAAS,EAAE,KAAK;YAChB,QAAQ,EAAE,oBAAoB,CAAC,sBAAsB;YACrD,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CACd,0CAA0C,OAAO,kBAAkB,MAAM,CAAC,CAAC,CAAC,cAAc;SAC7F;QACD,sBAAsB,EAAE;YACtB,UAAU,EAAE,wBAAwB;YACpC,SAAS,EAAE,KAAK;YAChB,QAAQ,EAAE,oBAAoB,CAAC,sBAAsB;YACrD,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CACd,eAAe,OAAO,2DAA2D;gBACjF,mCAAmC,MAAM,CAAC,CAAC,CAAC,cAAc;SAC7D;QACD,iBAAiB,EAAE;YACjB,UAAU,EAAE,mBAAmB;YAC/B,SAAS,EAAE,KAAK;YAChB,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,8BAA8B,OAAO,YAAY,MAAM,CAAC,CAAC,CAAC,MAAM;SAClF;QACD,gBAAgB,EAAE;YAChB,UAAU,EAAE,kBAAkB;YAC9B,SAAS,EAAE,KAAK;YAChB,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,+BAA+B,OAAO,YAAY,MAAM,CAAC,CAAC,CAAC,MAAM;SACnF;KACF,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CACjB,KAAiB,EACjB,OAAqB,EACrB,MAAkD;IAElD,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,CAAC;IACvB,MAAM,KAAK,GAAG,0BAA0B,CAAC;QACvC,KAAK;QACL,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACjB,SAAS,EAAE,6CAA6C;QACxD,UAAU,EAAE,mCAAmC;QAC/C,YAAY,EAAE,sDAAsD;KACrE,CAAC,CAAC;IACH,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACnC,MAAM,OAAO,GACX,MAAM,CAAC,gBAAgB,IAAI,oBAAoB,CAAC,sBAAsB,CAAC,gBAAgB,CAAC;IAC1F,IAAI,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CACb,gEAAgE,MAAM,CAAC,KAAK,CAAC,GAAG,CACjF,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,CAAC,OAAO,GAAG,CAAC,IAAI,OAAO,IAAI,CAAC,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CACb,mEAAmE,MAAM,CAAC,OAAO,CAAC,GAAG,CACtF,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,kBAAkB,CAC5B,EAAE,GAAG,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,OAAO,CAAC,EAAE,EACrD,EAAE,GAAG,oBAAoB,CAAC,KAAK,EAAE,SAAS,EAAE,CAAC,EAAE,CAChD,CAAC;IACF,OAAO;QACL,YAAY,CACV,wBAAwB,EACxB,OAAO,CAAC,MAAM,CAAC,wBAAwB,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,EAClE,GAAG,EACH,6BAA6B,OAAO,CAAC,OAAO,YAAY,MAAM,CAAC,OAAO,GAAG,GAAG,CAAC,WAAW;YACtF,GAAG,MAAM,CAAC,KAAK,CAAC,2BAA2B,CAC9C;KACF,CAAC;AACJ,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,4BAA4B,CAC1C,KAAiB,EACjB,OAAqB,EACrB,MAAoC;IAEpC,IAAI,MAAM,EAAE,OAAO,KAAK,KAAK;QAAE,OAAO,EAAE,CAAC;IAEzC,MAAM,WAAW,GAAG,sBAAsB,CACxC,eAAe,CAAC,OAAO,CAAC,OAAO,CAAC,EAChC,MAAM,EACN,CAAC,UAAU,EAAE,SAAS,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,CAAC,CACrE,CAAC;IAEF,OAAO,CAAC,GAAG,WAAW,EAAE,GAAG,UAAU,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,sBAAsB,CAAC,CAAC,CAAC;AACzF,CAAC"}

package/dist/esm/model-invocation-logging-alarms.d.ts

@@ -0,0 +1,42 @@
+import type { AlarmConfig, AlarmConfigDefaults, AlarmDefinition } from "@composurecdk/cloudwatch";
+/**
+ * Controls the recommended alarms for model invocation logging. Set an alarm
+ * to `false` to disable it, or provide a config to tune it.
+ *
+ * The delivery metrics are account-wide for the Region, in the `AWS/Bedrock`
+ * namespace with no dimensions.
+ *
+ * @see https://docs.aws.amazon.com/bedrock/latest/userguide/monitoring-runtime-metrics.html
+ */
+export interface ModelInvocationLoggingAlarmConfig {
+    /**
+     * Master switch: set to `false` to disable all recommended alarms.
+     * @default true
+     */
+    enabled?: boolean;
+    /**
+     * Alarm when invocation logs fail to reach the log group.
+     *
+     * Metric: `ModelInvocationLogsCloudWatchDeliveryFailure`, statistic Sum.
+     */
+    cloudWatchDeliveryFailure?: AlarmConfig | false;
+    /**
+     * Alarm when large or binary bodies fail to reach the large-data bucket.
+     * Created only when a large-data bucket is configured.
+     *
+     * Metric: `ModelInvocationLargeDataS3DeliveryFailure`, statistic Sum.
+     */
+    largeDataS3DeliveryFailure?: AlarmConfig | false;
+}
+type DeliveryAlarmKey = Exclude<keyof ModelInvocationLoggingAlarmConfig, "enabled">;
+/**
+ * Default alarm configuration for model invocation logging. AWS publishes no
+ * Bedrock thresholds.
+ *
+ * @see https://docs.aws.amazon.com/wellarchitected/latest/generative-ai-lens/gensec01-bp04.html
+ */
+export declare const MODEL_INVOCATION_LOGGING_ALARM_DEFAULTS: Record<DeliveryAlarmKey, AlarmConfigDefaults>;
+/** Resolves the recommended delivery-failure alarms. */
+export declare function resolveModelInvocationLoggingAlarmDefinitions(config: ModelInvocationLoggingAlarmConfig | false | undefined, hasLargeDataBucket: boolean): AlarmDefinition[];
+export {};
+//# sourceMappingURL=model-invocation-logging-alarms.d.ts.map

package/dist/esm/model-invocation-logging-alarms.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"model-invocation-logging-alarms.d.ts","sourceRoot":"","sources":["../../src/model-invocation-logging-alarms.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAIlG;;;;;;;;GAQG;AACH,MAAM,WAAW,iCAAiC;IAChD;;;OAGG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAElB;;;;OAIG;IACH,yBAAyB,CAAC,EAAE,WAAW,GAAG,KAAK,CAAC;IAEhD;;;;;OAKG;IACH,0BAA0B,CAAC,EAAE,WAAW,GAAG,KAAK,CAAC;CAClD;AAED,KAAK,gBAAgB,GAAG,OAAO,CAAC,MAAM,iCAAiC,EAAE,SAAS,CAAC,CAAC;AAUpF;;;;;GAKG;AACH,eAAO,MAAM,uCAAuC,EAAE,MAAM,CAC1D,gBAAgB,EAChB,mBAAmB,CAIpB,CAAC;AAkBF,wDAAwD;AACxD,wBAAgB,6CAA6C,CAC3D,MAAM,EAAE,iCAAiC,GAAG,KAAK,GAAG,SAAS,EAC7D,kBAAkB,EAAE,OAAO,GAC1B,eAAe,EAAE,CA4BnB"}

package/dist/esm/model-invocation-logging-alarms.js

@@ -0,0 +1,55 @@
+import { Duration } from "aws-cdk-lib";
+import { Metric, TreatMissingData } from "aws-cdk-lib/aws-cloudwatch";
+import { resolveAlarmConfig } from "@composurecdk/cloudwatch";
+import { toDefinition } from "./alarm-definition.js";
+/** A failed delivery is an invocation missing from the audit record. */
+const ANY_FAILURE = {
+    threshold: 0,
+    evaluationPeriods: 1,
+    datapointsToAlarm: 1,
+    treatMissingData: TreatMissingData.NOT_BREACHING,
+};
+/**
+ * Default alarm configuration for model invocation logging. AWS publishes no
+ * Bedrock thresholds.
+ *
+ * @see https://docs.aws.amazon.com/wellarchitected/latest/generative-ai-lens/gensec01-bp04.html
+ */
+export const MODEL_INVOCATION_LOGGING_ALARM_DEFAULTS = {
+    cloudWatchDeliveryFailure: ANY_FAILURE,
+    largeDataS3DeliveryFailure: ANY_FAILURE,
+};
+const DELIVERY_ALARMS = {
+    cloudWatchDeliveryFailure: {
+        metricName: "ModelInvocationLogsCloudWatchDeliveryFailure",
+        destination: "the log group",
+        requiresBucket: false,
+    },
+    largeDataS3DeliveryFailure: {
+        metricName: "ModelInvocationLargeDataS3DeliveryFailure",
+        destination: "the large-data bucket",
+        requiresBucket: true,
+    },
+};
+/** Resolves the recommended delivery-failure alarms. */
+export function resolveModelInvocationLoggingAlarmDefinitions(config, hasLargeDataBucket) {
+    if (config === false || config?.enabled === false)
+        return [];
+    return Object.entries(DELIVERY_ALARMS).flatMap(([key, spec]) => {
+        const userConfig = config?.[key];
+        if (userConfig === false || (spec.requiresBucket && !hasLargeDataBucket))
+            return [];
+        const cfg = resolveAlarmConfig(userConfig, MODEL_INVOCATION_LOGGING_ALARM_DEFAULTS[key]);
+        const metric = new Metric({
+            namespace: "AWS/Bedrock",
+            metricName: spec.metricName,
+            statistic: "Sum",
+            period: Duration.minutes(1),
+        });
+        return [
+            toDefinition(key, metric, cfg, `Bedrock model invocation logs are failing to reach ${spec.destination}; ` +
+                `invocations are missing from the audit record. Threshold: > ${String(cfg.threshold)} per minute.`),
+        ];
+    });
+}
+//# sourceMappingURL=model-invocation-logging-alarms.js.map

package/dist/esm/model-invocation-logging-alarms.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"model-invocation-logging-alarms.js","sourceRoot":"","sources":["../../src/model-invocation-logging-alarms.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAEtE,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAoCrD,wEAAwE;AACxE,MAAM,WAAW,GAAwB;IACvC,SAAS,EAAE,CAAC;IACZ,iBAAiB,EAAE,CAAC;IACpB,iBAAiB,EAAE,CAAC;IACpB,gBAAgB,EAAE,gBAAgB,CAAC,aAAa;CACjD,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,uCAAuC,GAGhD;IACF,yBAAyB,EAAE,WAAW;IACtC,0BAA0B,EAAE,WAAW;CACxC,CAAC;AAEF,MAAM,eAAe,GAGjB;IACF,yBAAyB,EAAE;QACzB,UAAU,EAAE,8CAA8C;QAC1D,WAAW,EAAE,eAAe;QAC5B,cAAc,EAAE,KAAK;KACtB;IACD,0BAA0B,EAAE;QAC1B,UAAU,EAAE,2CAA2C;QACvD,WAAW,EAAE,uBAAuB;QACpC,cAAc,EAAE,IAAI;KACrB;CACF,CAAC;AAEF,wDAAwD;AACxD,MAAM,UAAU,6CAA6C,CAC3D,MAA6D,EAC7D,kBAA2B;IAE3B,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,EAAE,OAAO,KAAK,KAAK;QAAE,OAAO,EAAE,CAAC;IAE7D,OACE,MAAM,CAAC,OAAO,CAAC,eAAe,CAI/B,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE;QACxB,MAAM,UAAU,GAAG,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,UAAU,KAAK,KAAK,IAAI,CAAC,IAAI,CAAC,cAAc,IAAI,CAAC,kBAAkB,CAAC;YAAE,OAAO,EAAE,CAAC;QACpF,MAAM,GAAG,GAAG,kBAAkB,CAAC,UAAU,EAAE,uCAAuC,CAAC,GAAG,CAAC,CAAC,CAAC;QACzF,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC;YACxB,SAAS,EAAE,aAAa;YACxB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,SAAS,EAAE,KAAK;YAChB,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;SAC5B,CAAC,CAAC;QACH,OAAO;YACL,YAAY,CACV,GAAG,EACH,MAAM,EACN,GAAG,EACH,sDAAsD,IAAI,CAAC,WAAW,IAAI;gBACxE,+DAA+D,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,cAAc,CACrG;SACF,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/esm/model-invocation-logging-builder.d.ts

@@ -0,0 +1,84 @@
+import type { Alarm } from "aws-cdk-lib/aws-cloudwatch";
+import { type IRole } from "aws-cdk-lib/aws-iam";
+import type { ILogGroup } from "aws-cdk-lib/aws-logs";
+import type { IBucket } from "aws-cdk-lib/aws-s3";
+import { type AwsCustomResource } from "aws-cdk-lib/custom-resources";
+import type { IConstruct } from "constructs";
+import { type Lifecycle, type Resolvable } from "@composurecdk/core";
+import { type ITaggedBuilder } from "@composurecdk/cloudformation";
+import { type ILogGroupBuilder } from "@composurecdk/logs";
+import { type ModelInvocationLoggingAlarmConfig } from "./model-invocation-logging-alarms.js";
+/** Which request and response modalities are logged. */
+export interface ModelInvocationLoggingModalities {
+    textDataDeliveryEnabled?: boolean;
+    imageDataDeliveryEnabled?: boolean;
+    embeddingDataDeliveryEnabled?: boolean;
+    videoDataDeliveryEnabled?: boolean;
+}
+/** Configuration properties for {@link createModelInvocationLoggingBuilder}. */
+export interface ModelInvocationLoggingBuilderProps extends ModelInvocationLoggingModalities {
+    /** The log group the builder creates, from `@composurecdk/logs`' defaults. */
+    logGroup?: {
+        /** Customises the log group sub-builder. */
+        configure?: (builder: ILogGroupBuilder) => ILogGroupBuilder;
+    };
+    /**
+     * Receives bodies over 100 KB and binary data, such as images, which
+     * CloudWatch Logs cannot hold; without it, those bodies are not logged. The
+     * builder adds the bucket and key policy statements Bedrock needs to write.
+     */
+    largeDataBucket?: Resolvable<IBucket>;
+    /** Key prefix within {@link largeDataBucket}. */
+    largeDataKeyPrefix?: string;
+    /**
+     * Configuration for the recommended delivery-failure alarms. Set to
+     * `false` to disable them.
+     */
+    recommendedAlarms?: ModelInvocationLoggingAlarmConfig | false;
+}
+/** The build output of an {@link IModelInvocationLoggingBuilder}. */
+export interface ModelInvocationLoggingBuilderResult {
+    /** The log group invocation logs are delivered to. */
+    logGroup: ILogGroup;
+    /** The role Bedrock assumes to write to {@link logGroup}. */
+    role: IRole;
+    /** The custom resource that applies the account's logging configuration. */
+    configuration: AwsCustomResource;
+    /** The CloudWatch alarms created, keyed by alarm key. */
+    alarms: Record<string, Alarm>;
+}
+/**
+ * A fluent builder for Amazon Bedrock model invocation logging.
+ *
+ * @see {@link createModelInvocationLoggingBuilder}
+ */
+export type IModelInvocationLoggingBuilder = ITaggedBuilder<ModelInvocationLoggingBuilderProps, ModelInvocationLoggingBuilder>;
+/**
+ * Every modality is logged, so the record covers every invocation.
+ *
+ * @see https://docs.aws.amazon.com/wellarchitected/latest/generative-ai-lens/gensec01-bp04.html
+ */
+export declare const MODEL_INVOCATION_LOGGING_DEFAULTS: Required<ModelInvocationLoggingModalities>;
+declare class ModelInvocationLoggingBuilder implements Lifecycle<ModelInvocationLoggingBuilderResult> {
+    props: Partial<ModelInvocationLoggingBuilderProps>;
+    build(scope: IConstruct, id: string, context?: Record<string, object>): ModelInvocationLoggingBuilderResult;
+}
+/**
+ * Creates a builder that turns on Amazon Bedrock model invocation logging for
+ * the account in the stack's Region, delivering to a log group it creates.
+ *
+ * Account-wide per Region: build it once. A second one overwrites the first,
+ * and deleting either stack turns logging off.
+ *
+ * @example
+ * ```ts
+ * createModelInvocationLoggingBuilder()
+ *   .largeDataBucket(ref("audit", (r: BucketBuilderResult) => r.bucket));
+ * ```
+ *
+ * @see https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html
+ * @see https://docs.aws.amazon.com/wellarchitected/latest/generative-ai-lens/gensec01-bp04.html
+ */
+export declare function createModelInvocationLoggingBuilder(): IModelInvocationLoggingBuilder;
+export {};
+//# sourceMappingURL=model-invocation-logging-builder.d.ts.map