fix(project): tie evaluator model ARN validation to each resource type's account format

src/projectSchemas/evaluator.test.ts

@@ -32,7 +32,8 @@ describe("evaluator custom validation", () => {
   it("validates model identifiers and KMS key ARNs through owned helpers", () => {
     expect(isValidBedrockModelId("anthropic.claude-v2:1")).toBe(true);
     expect(isValidBedrockModelId("us.anthropic.claude-sonnet-4-5-20250929-v1:0")).toBe(true);
-    // foundation-model ARNs omit the account segment; inference-profile ARNs carry it.
+    // foundation-model ARNs omit the account segment; (application-)inference-profile
+    // ARNs carry it. Each type must match only its documented shape.
     expect(
       isValidBedrockModelId("arn:aws:bedrock:us-east-1::foundation-model/anthropic.claude-v2"),
     ).toBe(true);
@@ -41,6 +42,16 @@ describe("evaluator custom validation", () => {
         "arn:aws:bedrock:us-east-1:123456789012:inference-profile/us.anthropic.claude-v2",
       ),
     ).toBe(true);
+    expect(
+      isValidBedrockModelId(
+        "arn:aws:bedrock:us-east-1:123456789012:application-inference-profile/my-profile",
+      ),
+    ).toBe(true);
+    // Wrong account format for the resource type is rejected.
+    expect(isValidBedrockModelId("arn:aws:bedrock:us-east-1:123456789012:foundation-model/x")).toBe(
+      false,
+    );
+    expect(isValidBedrockModelId("arn:aws:bedrock:us-east-1::inference-profile/x")).toBe(false);
     expect(isValidBedrockModelId("not a model")).toBe(false);
     expect(
       isValidKmsKeyArn(

src/projectSchemas/evaluator.ts

@@ -36,11 +36,12 @@ export const RatingScaleSchema = z
   );
 export type RatingScale = z.infer<typeof RatingScaleSchema>;
 const BEDROCK_MODEL_ID_PATTERN = /^[a-z][a-z0-9-]*\.[a-zA-Z0-9._-]+(:[0-9]+)?$/;
-// The account segment is optional: foundation-model ARNs omit it
-// (arn:aws:bedrock:us-east-1::foundation-model/...), while inference-profile
-// ARNs carry it (arn:aws:bedrock:us-east-1:123456789012:inference-profile/...).
+// Each resource type is tied to its documented account format: foundation-model
+// ARNs omit the account (arn:aws:bedrock:us-east-1::foundation-model/...), while
+// (application-)inference-profile ARNs carry it
+// (arn:aws:bedrock:us-east-1:123456789012:inference-profile/...).
 const BEDROCK_ARN_PATTERN =
-  /^arn:aws[a-z-]*:bedrock:[a-z0-9-]+:(\d{12})?:(inference-profile|foundation-model)\/.+$/;
+  /^arn:aws[a-z-]*:bedrock:[a-z0-9-]+:(?:\d{12}:(?:application-)?inference-profile|:foundation-model)\/.+$/;
 export function isValidBedrockModelId(value: string): boolean {
   return BEDROCK_MODEL_ID_PATTERN.test(value) || BEDROCK_ARN_PATTERN.test(value);
 }