@cat-factory/app 0.101.1 → 0.103.0

package/app/components/layout/AccountDeploymentSettings.vue

@@ -129,7 +129,11 @@ async function saveStorage() {
       ...(cs.forcePathStyle ? { forcePathStyle: true } : {}),
     }
   }
-  const input: Parameters<typeof store.save>[1] = { config: { contentStorage: config } }
+  // `config` fully REPLACES the stored non-secret config, so carry the rest forward
+  // (e.g. the model-family policy) — only `contentStorage` is edited here.
+  const input: Parameters<typeof store.save>[1] = {
+    config: { ...store.view?.config, contentStorage: config },
+  }
   if (backend === 's3') {
     const id = cs.accessKeyId.trim()
     const key = cs.secretAccessKey.trim()

package/app/components/layout/AccountModelPolicySettings.vue

@@ -0,0 +1,247 @@
+<script setup lang="ts">
+import { computed, onMounted, ref, watch } from 'vue'
+import { MODEL_FAMILY_POLICY_PRESETS } from '@cat-factory/contracts'
+import type {
+  AccountRegion,
+  ModelFamily,
+  ModelFamilyPolicy,
+  ModelPolicyMode,
+} from '~/types/accountSettings'
+
+// Account-wide model-family allow/block policy (admin only). Constrains which LLM families
+// the account's teams may run; a residency-guaranteed route (`trustedProviders`) can exempt
+// an otherwise-blocked family. Region-grouped built-in presets are one-click templates the
+// admin applies into the editable policy. Mounted only where the deployment supports it
+// (hosted / mothership — never plain local mode), gated by the parent on the infra flag.
+const props = defineProps<{ accountId: string }>()
+
+const store = useAccountSettingsStore()
+const toast = useToast()
+const { t } = useI18n()
+
+// The family / region / mode / trusted-provider domains, pinned to the contract unions so a
+// new enum member fails the typecheck here (via the exhaustive label maps below).
+const FAMILIES = [
+  'claude',
+  'openai',
+  'gemini',
+  'llama',
+  'qwen',
+  'kimi',
+  'deepseek',
+  'glm',
+] as const satisfies readonly ModelFamily[]
+const REGIONS = ['usa', 'europe', 'china', 'other'] as const satisfies readonly AccountRegion[]
+const MODES = ['off', 'blocklist', 'allowlist'] as const satisfies readonly ModelPolicyMode[]
+const TRUSTED_PROVIDERS = ['bedrock'] as const
+
+// Exhaustive enum→key maps (drift guard): every member resolves to a static literal `t()`
+// key, so adding a family/region/mode without a label fails the typecheck on the Record.
+const familyLabels = computed<Record<ModelFamily, string>>(() => ({
+  claude: t('settings.modelPolicy.families.claude'),
+  openai: t('settings.modelPolicy.families.openai'),
+  gemini: t('settings.modelPolicy.families.gemini'),
+  llama: t('settings.modelPolicy.families.llama'),
+  qwen: t('settings.modelPolicy.families.qwen'),
+  kimi: t('settings.modelPolicy.families.kimi'),
+  deepseek: t('settings.modelPolicy.families.deepseek'),
+  glm: t('settings.modelPolicy.families.glm'),
+}))
+const regionLabels = computed<Record<AccountRegion, string>>(() => ({
+  usa: t('settings.modelPolicy.regions.usa'),
+  europe: t('settings.modelPolicy.regions.europe'),
+  china: t('settings.modelPolicy.regions.china'),
+  other: t('settings.modelPolicy.regions.other'),
+}))
+const modeLabels = computed<Record<ModelPolicyMode, string>>(() => ({
+  off: t('settings.modelPolicy.modes.off'),
+  blocklist: t('settings.modelPolicy.modes.blocklist'),
+  allowlist: t('settings.modelPolicy.modes.allowlist'),
+}))
+const providerLabels = computed<Record<(typeof TRUSTED_PROVIDERS)[number], string>>(() => ({
+  bedrock: t('settings.modelPolicy.providers.bedrock'),
+}))
+
+const modeItems = computed(() => MODES.map((m) => ({ label: modeLabels.value[m], value: m })))
+const regionItems = computed(() => REGIONS.map((r) => ({ label: regionLabels.value[r], value: r })))
+
+// Editable local state (hydrated from the stored policy).
+const mode = ref<ModelPolicyMode>('off')
+const region = ref<AccountRegion>('other')
+const families = ref<ModelFamily[]>([])
+const trusted = ref<string[]>([])
+const saving = ref(false)
+
+function hydrate() {
+  const p = store.view?.config?.modelPolicy
+  mode.value = p?.mode ?? 'off'
+  region.value = p?.region ?? 'other'
+  families.value = [...(p?.families ?? [])]
+  trusted.value = [...(p?.trustedProviders ?? [])]
+}
+
+// The presets offered for the currently-selected region.
+const regionPresets = computed(() =>
+  MODEL_FAMILY_POLICY_PRESETS.filter((preset) => preset.region === region.value),
+)
+
+function toggleFamily(fam: ModelFamily) {
+  families.value = families.value.includes(fam)
+    ? families.value.filter((x) => x !== fam)
+    : [...families.value, fam]
+}
+function toggleTrusted(provider: string) {
+  trusted.value = trusted.value.includes(provider)
+    ? trusted.value.filter((x) => x !== provider)
+    : [...trusted.value, provider]
+}
+
+function applyPreset(policy: ModelFamilyPolicy) {
+  mode.value = policy.mode
+  families.value = [...policy.families]
+  trusted.value = [...policy.trustedProviders]
+}
+
+onMounted(async () => {
+  // The sibling deployment-settings panel loads the store on mount too; guard against a
+  // double-load being unnecessary by only loading when the view isn't present yet.
+  if (!store.view && store.available !== false) {
+    try {
+      await store.load(props.accountId)
+    } catch {
+      // The deployment-settings panel surfaces the load error; stay quiet here.
+    }
+  }
+  hydrate()
+})
+watch(() => store.view, hydrate)
+
+async function save() {
+  const policy: ModelFamilyPolicy = {
+    mode: mode.value,
+    // Families are irrelevant when the policy is off; keep them so a later re-enable
+    // restores the admin's selection rather than silently emptying it.
+    families: families.value,
+    trustedProviders: trusted.value,
+    region: region.value,
+  }
+  saving.value = true
+  try {
+    // `config` fully replaces the stored non-secret config, so carry the rest forward.
+    await store.save(props.accountId, { config: { ...store.view?.config, modelPolicy: policy } })
+    toast.add({
+      title: t('settings.modelPolicy.saved'),
+      icon: 'i-lucide-check',
+      color: 'success',
+    })
+  } catch (e) {
+    toast.add({
+      title: t('settings.modelPolicy.saveFailed'),
+      description: e instanceof Error ? e.message : String(e),
+      color: 'error',
+    })
+  } finally {
+    saving.value = false
+  }
+}
+</script>
+
+<template>
+  <section
+    v-if="store.available !== false"
+    data-testid="account-model-policy"
+    class="space-y-3 border-t border-slate-800 pt-6"
+  >
+    <div>
+      <h4 class="text-sm font-semibold text-slate-200">{{ t('settings.modelPolicy.title') }}</h4>
+      <p class="text-[11px] text-slate-400">{{ t('settings.modelPolicy.description') }}</p>
+    </div>
+
+    <!-- Region + apply-preset templates -->
+    <div class="space-y-2">
+      <label class="text-[11px] font-medium text-slate-300">
+        {{ t('settings.modelPolicy.regionLabel') }}
+      </label>
+      <div class="grid grid-cols-1 gap-2 sm:grid-cols-2">
+        <USelect v-model="region" :items="regionItems" value-key="value" size="sm" />
+      </div>
+      <div v-if="regionPresets.length" class="flex flex-wrap items-center gap-2">
+        <span class="text-[11px] text-slate-400">{{ t('settings.modelPolicy.applyPreset') }}</span>
+        <UButton
+          v-for="preset in regionPresets"
+          :key="preset.id"
+          color="neutral"
+          variant="subtle"
+          size="xs"
+          icon="i-lucide-wand-2"
+          :title="t(`settings.modelPolicy.presets.${preset.id}.description`)"
+          @click="applyPreset(preset.policy)"
+        >
+          {{ t(`settings.modelPolicy.presets.${preset.id}.label`) }}
+        </UButton>
+      </div>
+    </div>
+
+    <!-- Mode -->
+    <div class="space-y-2">
+      <label class="text-[11px] font-medium text-slate-300">
+        {{ t('settings.modelPolicy.modeLabel') }}
+      </label>
+      <div class="grid grid-cols-1 gap-2 sm:grid-cols-2">
+        <USelect v-model="mode" :items="modeItems" value-key="value" size="sm" />
+      </div>
+    </div>
+
+    <!-- Families -->
+    <div v-if="mode !== 'off'" class="space-y-2">
+      <label class="text-[11px] font-medium text-slate-300">
+        {{
+          mode === 'blocklist'
+            ? t('settings.modelPolicy.familiesBlockLabel')
+            : t('settings.modelPolicy.familiesAllowLabel')
+        }}
+      </label>
+      <div class="grid grid-cols-2 gap-1 sm:grid-cols-4">
+        <UCheckbox
+          v-for="fam in FAMILIES"
+          :key="fam"
+          :model-value="families.includes(fam)"
+          :label="familyLabels[fam]"
+          size="sm"
+          @update:model-value="toggleFamily(fam)"
+        />
+      </div>
+    </div>
+
+    <!-- Trusted (residency-guaranteed) routes -->
+    <div v-if="mode !== 'off'" class="space-y-2">
+      <label class="text-[11px] font-medium text-slate-300">
+        {{ t('settings.modelPolicy.trustedLabel') }}
+      </label>
+      <p class="text-[11px] text-slate-400">{{ t('settings.modelPolicy.trustedHint') }}</p>
+      <div class="grid grid-cols-2 gap-1 sm:grid-cols-4">
+        <UCheckbox
+          v-for="provider in TRUSTED_PROVIDERS"
+          :key="provider"
+          :model-value="trusted.includes(provider)"
+          :label="providerLabels[provider]"
+          size="sm"
+          @update:model-value="toggleTrusted(provider)"
+        />
+      </div>
+    </div>
+
+    <div class="flex gap-2">
+      <UButton
+        color="primary"
+        size="xs"
+        icon="i-lucide-save"
+        :loading="saving"
+        data-testid="account-model-policy-save"
+        @click="save"
+      >
+        {{ t('common.save') }}
+      </UButton>
+    </div>
+  </section>
+</template>

package/app/components/layout/AccountTeamSettings.vue

@@ -4,6 +4,7 @@ import { apiErrorEnvelope } from '~/composables/api/errors'
 import type { AccountRole } from '~/types/domain'
 import type { InvitationStatus } from '@cat-factory/contracts'
 import AccountDeploymentSettings from '~/components/layout/AccountDeploymentSettings.vue'
+import AccountModelPolicySettings from '~/components/layout/AccountModelPolicySettings.vue'
 import SecretInput from '~/components/common/SecretInput.vue'
 
 // Team settings for an org account: the member roster (with combinable admin /
@@ -13,11 +14,16 @@ import SecretInput from '~/components/common/SecretInput.vue'
 const props = defineProps<{ accountId: string }>()
 
 const accounts = useAccountsStore()
+const auth = useAuthStore()
 const toast = useToast()
 const { t, te } = useI18n()
 const { confirmAction, toastDone } = useConfirmAction()
 const busy = ref(false)
 
+// The account-wide model-family policy is a hosted / mothership-only control (the backend
+// reports `false` in plain local mode, where there is no account admin to govern).
+const modelPolicySupported = computed(() => auth.infrastructure?.modelPolicy?.supported ?? false)
+
 const ROLE_ITEMS = computed<{ label: string; value: AccountRole }[]>(() => [
   { label: t('layout.accountTeam.roles.admin'), value: 'admin' },
   { label: t('layout.accountTeam.roles.developer'), value: 'developer' },
@@ -326,5 +332,10 @@ async function disconnectEmail() {
     <section v-if="isAdmin">
       <AccountDeploymentSettings :account-id="accountId" />
     </section>
+
+    <!-- account-wide model-family allow/block policy (admin-only; hosted/mothership only) -->
+    <section v-if="isAdmin && modelPolicySupported">
+      <AccountModelPolicySettings :account-id="accountId" />
+    </section>
   </div>
 </template>

package/app/components/settings/SharedStacksPanel.vue

@@ -6,7 +6,11 @@
 // they succeed only on the local facade (elsewhere the backend returns a clear error surfaced as
 // a toast). Renders inline inside the Infrastructure window's "Shared stacks" tab.
 import { computed, reactive, ref } from 'vue'
-import type { SharedStack, SharedStackStatus } from '~/types/sharedStacks'
+import type {
+  SharedStack,
+  SharedStackRecommendation,
+  SharedStackStatus,
+} from '~/types/sharedStacks'
 
 const { t } = useI18n()
 const store = useSharedStacksStore()
@@ -16,6 +20,7 @@ const { confirmAction, toastDone } = useConfirmAction()
 const stacks = computed(() => store.stacks)
 const busyId = ref<string | null>(null)
 const saving = ref(false)
+const detecting = ref(false)
 // null ⇒ the form is in "add" mode; a stack id ⇒ editing that stack's definition in place.
 const editingId = ref<string | null>(null)
 
@@ -23,12 +28,20 @@ const form = reactive({
   name: '',
   cloneUrl: '',
   gitRef: '',
+  // Subdirectory the compose stack lives in (monorepo) — a detect-time hint only, NOT persisted:
+  // the resolved `composeFiles` already carry the prefix. Absent ⇒ the repo root is scanned.
+  directory: '',
   composeFiles: '',
   composeProfiles: '',
   managedNetworks: '',
   allowHostCommands: false,
 })
 
+// Env/config templates (`*-dist` → gitignored target) the autodetect scan surfaced. The form has no
+// editor for them, so we carry the detected (or, on edit, the stack's existing) set through to the
+// save payload rather than silently dropping them — they're materialized before `up`.
+const detectedEnvFiles = ref<SharedStack['envFiles']>([])
+
 /** Status → badge colour. */
 const STATUS_COLOR: Record<SharedStackStatus, 'neutral' | 'warning' | 'success' | 'error'> = {
   stopped: 'neutral',
@@ -72,10 +85,12 @@ function resetForm() {
   form.name = ''
   form.cloneUrl = ''
   form.gitRef = ''
+  form.directory = ''
   form.composeFiles = ''
   form.composeProfiles = ''
   form.managedNetworks = ''
   form.allowHostCommands = false
+  detectedEnvFiles.value = []
 }
 
 /** Load a stack's definition into the form for in-place editing. */
@@ -84,10 +99,59 @@ function startEdit(stack: SharedStack) {
   form.name = stack.name
   form.cloneUrl = stack.cloneUrl
   form.gitRef = stack.gitRef ?? ''
+  form.directory = ''
   form.composeFiles = stack.composeFiles.join(', ')
   form.composeProfiles = stack.composeProfiles.join(', ')
   form.managedNetworks = stack.managedNetworks.join(', ')
   form.allowHostCommands = stack.allowHostCommands
+  // Preserve the stack's existing env templates so a save (or a later re-detect) doesn't drop them.
+  detectedEnvFiles.value = stack.envFiles
+}
+
+const canDetect = computed(() => Boolean(form.cloneUrl.trim()) && !detecting.value)
+
+/**
+ * Read the repo at the entered clone URL (checkout-free, via the workspace's VCS connection) and
+ * PREFILL the compose-shaped fields from the recommendation. Non-binding: the user reviews + edits
+ * before saving. A SUCCESSFUL detection is authoritative for the compose-shaped fields — it
+ * overwrites them wholesale, including clearing a field the scan found empty (so re-detecting a
+ * different repo can't leave a stale managed network / profile behind). Manual entries survive only
+ * a `detected:false` result, which returns early and touches nothing. The name is suggested only
+ * when still blank (it's a user label, not a repo-derived fact).
+ */
+async function autodetect() {
+  detecting.value = true
+  try {
+    const rec = await store.detect({
+      cloneUrl: form.cloneUrl.trim(),
+      ...(form.gitRef.trim() ? { gitRef: form.gitRef.trim() } : {}),
+      ...(form.directory.trim() ? { directory: form.directory.trim() } : {}),
+    })
+    if (!rec.detected) {
+      toast.add({
+        title: t('settings.sharedStacks.detect.nothing'),
+        description: rec.notes[0]?.message ?? '',
+        icon: 'i-lucide-info',
+        color: 'warning',
+      })
+      return
+    }
+    if (rec.name && !form.name.trim()) form.name = rec.name
+    form.composeFiles = rec.composeFiles.join(', ')
+    form.composeProfiles = rec.composeProfiles.join(', ')
+    form.managedNetworks = rec.managedNetworks.join(', ')
+    detectedEnvFiles.value = rec.envFiles
+    toast.add({
+      title: t('settings.sharedStacks.detect.detected'),
+      description: t('settings.sharedStacks.detect.detectedBody'),
+      icon: 'i-lucide-wand-sparkles',
+      color: 'success',
+    })
+  } catch (e) {
+    notifyError(t('settings.sharedStacks.detect.failed'), e)
+  } finally {
+    detecting.value = false
+  }
 }
 
 function notifyError(title: string, e: unknown) {
@@ -110,6 +174,7 @@ async function saveStack() {
     composeFiles: tokens(form.composeFiles),
     composeProfiles: tokens(form.composeProfiles),
     managedNetworks: tokens(form.managedNetworks),
+    envFiles: detectedEnvFiles.value,
     allowHostCommands: form.allowHostCommands,
   }
   try {
@@ -300,6 +365,42 @@ async function remove(stack: SharedStack) {
         />
       </UFormField>
 
+      <UFormField
+        :label="t('settings.sharedStacks.add.directory')"
+        :help="t('settings.sharedStacks.add.directoryHelp')"
+      >
+        <UInput
+          v-model="form.directory"
+          placeholder="shared"
+          class="w-full"
+          data-testid="shared-stack-directory"
+        />
+      </UFormField>
+
+      <div class="flex items-center gap-2">
+        <UButton
+          icon="i-lucide-wand-sparkles"
+          size="sm"
+          variant="soft"
+          :loading="detecting"
+          :disabled="!canDetect"
+          data-testid="shared-stack-autodetect"
+          @click="autodetect"
+        >
+          {{ t('settings.sharedStacks.detect.button') }}
+        </UButton>
+        <span class="text-[11px] text-slate-500">{{ t('settings.sharedStacks.detect.hint') }}</span>
+      </div>
+
+      <p
+        v-if="detectedEnvFiles.length"
+        class="text-[11px] text-slate-500"
+        data-testid="shared-stack-env-files"
+      >
+        {{ t('settings.sharedStacks.detect.envFiles') }}
+        {{ detectedEnvFiles.map((f) => `${f.template} → ${f.target}`).join(', ') }}
+      </p>
+
       <UFormField
         :label="t('settings.sharedStacks.add.composeFiles')"
         :help="t('settings.sharedStacks.add.composeFilesHelp')"

package/app/composables/api/sharedStacks.ts

@@ -1,12 +1,13 @@
 import {
   createSharedStackContract,
   deleteSharedStackContract,
+  detectSharedStackContract,
   ensureSharedStackUpContract,
   listSharedStacksContract,
   teardownSharedStackContract,
   updateSharedStackContract,
 } from '@cat-factory/contracts'
-import type { UpdateSharedStackInput } from '~/types/sharedStacks'
+import type { DetectSharedStackInput, UpdateSharedStackInput } from '~/types/sharedStacks'
 import type { SendParams } from './client'
 import type { ApiContext } from './context'
 
@@ -23,6 +24,9 @@ export function sharedStacksApi({ send, ws }: ApiContext) {
     createSharedStack: (workspaceId: string, body: CreateSharedStackBody) =>
       send(createSharedStackContract, { pathPrefix: ws(workspaceId), body }),
 
+    detectSharedStack: (workspaceId: string, body: DetectSharedStackInput) =>
+      send(detectSharedStackContract, { pathPrefix: ws(workspaceId), body }),
+
     updateSharedStack: (workspaceId: string, stackId: string, body: UpdateSharedStackInput) =>
       send(updateSharedStackContract, {
         pathPrefix: ws(workspaceId),

package/app/composables/usePipelineErrorToast.ts

@@ -48,6 +48,8 @@ const CONFLICT_TITLE_KEYS: Record<
   provision_type_unhandled: 'errors.conflict.title.provision_type_unhandled',
   preset_unsatisfiable: 'errors.conflict.title.preset_unsatisfiable',
   visual_pipeline_no_frontend: 'errors.conflict.title.visual_pipeline_no_frontend',
+  model_policy_blocked: 'errors.conflict.title.model_policy_blocked',
+  model_policy_unsupported: 'errors.conflict.title.model_policy_unsupported',
   deployer_required_before_tester: 'errors.conflict.title.deployer_required_before_tester',
 }
 

package/app/stores/sharedStacks.ts

@@ -1,6 +1,10 @@
 import { defineStore } from 'pinia'
 import { ref } from 'vue'
-import type { SharedStack, UpdateSharedStackInput } from '~/types/sharedStacks'
+import type {
+  DetectSharedStackInput,
+  SharedStack,
+  UpdateSharedStackInput,
+} from '~/types/sharedStacks'
 import { useWorkspaceStore } from '~/stores/workspace'
 
 /**
@@ -34,6 +38,11 @@ export const useSharedStacksStore = defineStore('sharedStacks', () => {
     return created
   }
 
+  async function detect(input: DetectSharedStackInput) {
+    const ws = useWorkspaceStore()
+    return api.detectSharedStack(ws.requireId(), input)
+  }
+
   async function update(stackId: string, patchInput: UpdateSharedStackInput) {
     const ws = useWorkspaceStore()
     const updated = await api.updateSharedStack(ws.requireId(), stackId, patchInput)
@@ -61,5 +70,5 @@ export const useSharedStacksStore = defineStore('sharedStacks', () => {
     return updated
   }
 
-  return { stacks, hydrate, create, update, remove, ensureUp, teardown }
+  return { stacks, hydrate, create, detect, update, remove, ensureUp, teardown }
 })

package/app/types/accountSettings.ts

@@ -15,4 +15,9 @@ export type {
   ContentStorageConfig,
   ContentStorageSummary,
   ContentStorageCapability,
+  // Account-wide model-family allow/block policy.
+  ModelFamily,
+  ModelFamilyPolicy,
+  ModelPolicyMode,
+  AccountRegion,
 } from '@cat-factory/contracts'

package/app/types/sharedStacks.ts

@@ -5,4 +5,6 @@ export type {
   SharedStackStatus,
   CreateSharedStackInput,
   UpdateSharedStackInput,
+  DetectSharedStackInput,
+  SharedStackRecommendation,
 } from '@cat-factory/contracts'

package/i18n/locales/de.json

@@ -530,6 +530,8 @@
         "cloneUrl": "Clone-URL des Repositorys",
         "cloneUrlHelp": "Das Git-Repository, in dem die Compose-Dateien des Stacks liegen.",
         "gitRef": "Branch oder Tag (optional)",
+        "directory": "Unterverzeichnis (optional)",
+        "directoryHelp": "Wird nur von der automatischen Erkennung verwendet: das Monorepo-Unterverzeichnis, in dem der Compose-Stack liegt.",
         "composeFiles": "Compose-Dateien",
         "composeFilesHelp": "Kommagetrennt, repo-relativ, in Override-Reihenfolge.",
         "composeProfiles": "Compose-Profile (optional)",
@@ -538,6 +540,15 @@
         "allowHostCommands": "Host-Command-Setup-Schritte erlauben",
         "save": "Stack hinzufügen"
       },
+      "detect": {
+        "button": "Automatisch erkennen",
+        "hint": "Das Repository lesen und Compose-Dateien, Profile und Netzwerke vorausfüllen.",
+        "detected": "Stack-Konfiguration erkannt",
+        "detectedBody": "Aus dem Repository vorausgefüllt. Überprüfen Sie die Felder vor dem Speichern.",
+        "nothing": "Nichts automatisch zu erkennen",
+        "failed": "Automatische Erkennung fehlgeschlagen",
+        "envFiles": "Env-Vorlagen, die vor dem Start materialisiert werden:"
+      },
       "edit": {
         "heading": "Gemeinsamen Stack bearbeiten",
         "save": "Änderungen speichern",
@@ -734,6 +745,65 @@
         "title": "Diesen Runner entfernen?",
         "body": "\"{name}\" wird entfernt. Dies kann nicht rückgängig gemacht werden."
       }
+    },
+    "modelPolicy": {
+      "title": "Modellzugriffsrichtlinie",
+      "description": "Beschränkt, welche Modellfamilien die Teams dieses Kontos ausführen dürfen. Das Datenresidenz-Risiko hängt von der Bereitstellungsroute ab, daher kann eine vertrauenswürdige (residenzgarantierte) Route eine andernfalls blockierte Familie freigeben.",
+      "regionLabel": "Betriebsregion",
+      "applyPreset": "Vorlage anwenden:",
+      "modeLabel": "Richtlinienmodus",
+      "modes": {
+        "off": "Keine Einschränkung",
+        "blocklist": "Aufgeführte Familien blockieren",
+        "allowlist": "Nur aufgeführte Familien zulassen"
+      },
+      "familiesBlockLabel": "Blockierte Familien",
+      "familiesAllowLabel": "Zugelassene Familien",
+      "trustedLabel": "Vertrauenswürdige (residenzgarantierte) Routen",
+      "trustedHint": "Eine blockierte Familie bleibt verfügbar, wenn sie über eine dieser Routen bereitgestellt wird.",
+      "families": {
+        "claude": "Claude (Anthropic)",
+        "openai": "OpenAI / ChatGPT",
+        "gemini": "Gemini (Google)",
+        "llama": "Llama (Meta)",
+        "qwen": "Qwen (Alibaba)",
+        "kimi": "Kimi (Moonshot)",
+        "deepseek": "DeepSeek",
+        "glm": "GLM (Z.ai)"
+      },
+      "regions": {
+        "usa": "Vereinigte Staaten",
+        "europe": "Europa",
+        "china": "China",
+        "other": "Andere"
+      },
+      "providers": {
+        "bedrock": "AWS Bedrock"
+      },
+      "presets": {
+        "us-block-cn": {
+          "label": "In China gehostete Familien blockieren",
+          "description": "Blockiert DeepSeek, Qwen, Kimi und GLM; erlaubt sie nur über eine residenzgarantierte Route (z. B. Bedrock)."
+        },
+        "eu-block-cn": {
+          "label": "EU: in China gehostete Familien blockieren",
+          "description": "Blockiert DeepSeek, Qwen, Kimi und GLM; eine residenzgarantierte EU-Route (z. B. Bedrock) bleibt zulässig."
+        },
+        "eu-guaranteed-only": {
+          "label": "EU: nur residenzgarantierte Routen",
+          "description": "Erlaubt ein Modell nur, wenn es über eine residenzgarantierte Route bereitgestellt wird."
+        },
+        "cn-prefer-domestic": {
+          "label": "In China gehostete Familien bevorzugen",
+          "description": "Erlaubt in China gehostete Familien (plus Llama) und jede residenzgarantierte Route."
+        },
+        "other-block-cn": {
+          "label": "In China gehostete Familien blockieren",
+          "description": "Blockiert DeepSeek, Qwen, Kimi und GLM; erlaubt sie nur über eine residenzgarantierte Route."
+        }
+      },
+      "saved": "Modellzugriffsrichtlinie gespeichert",
+      "saveFailed": "Modellzugriffsrichtlinie konnte nicht gespeichert werden"
     }
   },
   "inspector": {
@@ -3580,6 +3650,8 @@
         "provision_type_unhandled": "Kein Handler für diesen Bereitstellungstyp",
         "preset_unsatisfiable": "Modell-Preset kann diese Pipeline nicht ausführen",
         "visual_pipeline_no_frontend": "Kein Frontend zum Testen",
+        "model_policy_blocked": "Modell durch Kontorichtlinie blockiert",
+        "model_policy_unsupported": "Modellrichtlinie hier nicht verfügbar",
         "deployer_required_before_tester": "Füge einen Deployer vor dem Tester hinzu"
       },
       "fallbackMessage": "Diese Aktion steht im Konflikt mit dem aktuellen Zustand.",