@cat-factory/app 0.102.0 → 0.103.0

package/app/components/layout/AccountDeploymentSettings.vue

@@ -129,7 +129,11 @@ async function saveStorage() {
       ...(cs.forcePathStyle ? { forcePathStyle: true } : {}),
     }
   }
-  const input: Parameters<typeof store.save>[1] = { config: { contentStorage: config } }
+  // `config` fully REPLACES the stored non-secret config, so carry the rest forward
+  // (e.g. the model-family policy) — only `contentStorage` is edited here.
+  const input: Parameters<typeof store.save>[1] = {
+    config: { ...store.view?.config, contentStorage: config },
+  }
   if (backend === 's3') {
     const id = cs.accessKeyId.trim()
     const key = cs.secretAccessKey.trim()

package/app/components/layout/AccountModelPolicySettings.vue

@@ -0,0 +1,247 @@
+<script setup lang="ts">
+import { computed, onMounted, ref, watch } from 'vue'
+import { MODEL_FAMILY_POLICY_PRESETS } from '@cat-factory/contracts'
+import type {
+  AccountRegion,
+  ModelFamily,
+  ModelFamilyPolicy,
+  ModelPolicyMode,
+} from '~/types/accountSettings'
+
+// Account-wide model-family allow/block policy (admin only). Constrains which LLM families
+// the account's teams may run; a residency-guaranteed route (`trustedProviders`) can exempt
+// an otherwise-blocked family. Region-grouped built-in presets are one-click templates the
+// admin applies into the editable policy. Mounted only where the deployment supports it
+// (hosted / mothership — never plain local mode), gated by the parent on the infra flag.
+const props = defineProps<{ accountId: string }>()
+
+const store = useAccountSettingsStore()
+const toast = useToast()
+const { t } = useI18n()
+
+// The family / region / mode / trusted-provider domains, pinned to the contract unions so a
+// new enum member fails the typecheck here (via the exhaustive label maps below).
+const FAMILIES = [
+  'claude',
+  'openai',
+  'gemini',
+  'llama',
+  'qwen',
+  'kimi',
+  'deepseek',
+  'glm',
+] as const satisfies readonly ModelFamily[]
+const REGIONS = ['usa', 'europe', 'china', 'other'] as const satisfies readonly AccountRegion[]
+const MODES = ['off', 'blocklist', 'allowlist'] as const satisfies readonly ModelPolicyMode[]
+const TRUSTED_PROVIDERS = ['bedrock'] as const
+
+// Exhaustive enum→key maps (drift guard): every member resolves to a static literal `t()`
+// key, so adding a family/region/mode without a label fails the typecheck on the Record.
+const familyLabels = computed<Record<ModelFamily, string>>(() => ({
+  claude: t('settings.modelPolicy.families.claude'),
+  openai: t('settings.modelPolicy.families.openai'),
+  gemini: t('settings.modelPolicy.families.gemini'),
+  llama: t('settings.modelPolicy.families.llama'),
+  qwen: t('settings.modelPolicy.families.qwen'),
+  kimi: t('settings.modelPolicy.families.kimi'),
+  deepseek: t('settings.modelPolicy.families.deepseek'),
+  glm: t('settings.modelPolicy.families.glm'),
+}))
+const regionLabels = computed<Record<AccountRegion, string>>(() => ({
+  usa: t('settings.modelPolicy.regions.usa'),
+  europe: t('settings.modelPolicy.regions.europe'),
+  china: t('settings.modelPolicy.regions.china'),
+  other: t('settings.modelPolicy.regions.other'),
+}))
+const modeLabels = computed<Record<ModelPolicyMode, string>>(() => ({
+  off: t('settings.modelPolicy.modes.off'),
+  blocklist: t('settings.modelPolicy.modes.blocklist'),
+  allowlist: t('settings.modelPolicy.modes.allowlist'),
+}))
+const providerLabels = computed<Record<(typeof TRUSTED_PROVIDERS)[number], string>>(() => ({
+  bedrock: t('settings.modelPolicy.providers.bedrock'),
+}))
+
+const modeItems = computed(() => MODES.map((m) => ({ label: modeLabels.value[m], value: m })))
+const regionItems = computed(() => REGIONS.map((r) => ({ label: regionLabels.value[r], value: r })))
+
+// Editable local state (hydrated from the stored policy).
+const mode = ref<ModelPolicyMode>('off')
+const region = ref<AccountRegion>('other')
+const families = ref<ModelFamily[]>([])
+const trusted = ref<string[]>([])
+const saving = ref(false)
+
+function hydrate() {
+  const p = store.view?.config?.modelPolicy
+  mode.value = p?.mode ?? 'off'
+  region.value = p?.region ?? 'other'
+  families.value = [...(p?.families ?? [])]
+  trusted.value = [...(p?.trustedProviders ?? [])]
+}
+
+// The presets offered for the currently-selected region.
+const regionPresets = computed(() =>
+  MODEL_FAMILY_POLICY_PRESETS.filter((preset) => preset.region === region.value),
+)
+
+function toggleFamily(fam: ModelFamily) {
+  families.value = families.value.includes(fam)
+    ? families.value.filter((x) => x !== fam)
+    : [...families.value, fam]
+}
+function toggleTrusted(provider: string) {
+  trusted.value = trusted.value.includes(provider)
+    ? trusted.value.filter((x) => x !== provider)
+    : [...trusted.value, provider]
+}
+
+function applyPreset(policy: ModelFamilyPolicy) {
+  mode.value = policy.mode
+  families.value = [...policy.families]
+  trusted.value = [...policy.trustedProviders]
+}
+
+onMounted(async () => {
+  // The sibling deployment-settings panel loads the store on mount too; guard against a
+  // double-load being unnecessary by only loading when the view isn't present yet.
+  if (!store.view && store.available !== false) {
+    try {
+      await store.load(props.accountId)
+    } catch {
+      // The deployment-settings panel surfaces the load error; stay quiet here.
+    }
+  }
+  hydrate()
+})
+watch(() => store.view, hydrate)
+
+async function save() {
+  const policy: ModelFamilyPolicy = {
+    mode: mode.value,
+    // Families are irrelevant when the policy is off; keep them so a later re-enable
+    // restores the admin's selection rather than silently emptying it.
+    families: families.value,
+    trustedProviders: trusted.value,
+    region: region.value,
+  }
+  saving.value = true
+  try {
+    // `config` fully replaces the stored non-secret config, so carry the rest forward.
+    await store.save(props.accountId, { config: { ...store.view?.config, modelPolicy: policy } })
+    toast.add({
+      title: t('settings.modelPolicy.saved'),
+      icon: 'i-lucide-check',
+      color: 'success',
+    })
+  } catch (e) {
+    toast.add({
+      title: t('settings.modelPolicy.saveFailed'),
+      description: e instanceof Error ? e.message : String(e),
+      color: 'error',
+    })
+  } finally {
+    saving.value = false
+  }
+}
+</script>
+
+<template>
+  <section
+    v-if="store.available !== false"
+    data-testid="account-model-policy"
+    class="space-y-3 border-t border-slate-800 pt-6"
+  >
+    <div>
+      <h4 class="text-sm font-semibold text-slate-200">{{ t('settings.modelPolicy.title') }}</h4>
+      <p class="text-[11px] text-slate-400">{{ t('settings.modelPolicy.description') }}</p>
+    </div>
+
+    <!-- Region + apply-preset templates -->
+    <div class="space-y-2">
+      <label class="text-[11px] font-medium text-slate-300">
+        {{ t('settings.modelPolicy.regionLabel') }}
+      </label>
+      <div class="grid grid-cols-1 gap-2 sm:grid-cols-2">
+        <USelect v-model="region" :items="regionItems" value-key="value" size="sm" />
+      </div>
+      <div v-if="regionPresets.length" class="flex flex-wrap items-center gap-2">
+        <span class="text-[11px] text-slate-400">{{ t('settings.modelPolicy.applyPreset') }}</span>
+        <UButton
+          v-for="preset in regionPresets"
+          :key="preset.id"
+          color="neutral"
+          variant="subtle"
+          size="xs"
+          icon="i-lucide-wand-2"
+          :title="t(`settings.modelPolicy.presets.${preset.id}.description`)"
+          @click="applyPreset(preset.policy)"
+        >
+          {{ t(`settings.modelPolicy.presets.${preset.id}.label`) }}
+        </UButton>
+      </div>
+    </div>
+
+    <!-- Mode -->
+    <div class="space-y-2">
+      <label class="text-[11px] font-medium text-slate-300">
+        {{ t('settings.modelPolicy.modeLabel') }}
+      </label>
+      <div class="grid grid-cols-1 gap-2 sm:grid-cols-2">
+        <USelect v-model="mode" :items="modeItems" value-key="value" size="sm" />
+      </div>
+    </div>
+
+    <!-- Families -->
+    <div v-if="mode !== 'off'" class="space-y-2">
+      <label class="text-[11px] font-medium text-slate-300">
+        {{
+          mode === 'blocklist'
+            ? t('settings.modelPolicy.familiesBlockLabel')
+            : t('settings.modelPolicy.familiesAllowLabel')
+        }}
+      </label>
+      <div class="grid grid-cols-2 gap-1 sm:grid-cols-4">
+        <UCheckbox
+          v-for="fam in FAMILIES"
+          :key="fam"
+          :model-value="families.includes(fam)"
+          :label="familyLabels[fam]"
+          size="sm"
+          @update:model-value="toggleFamily(fam)"
+        />
+      </div>
+    </div>
+
+    <!-- Trusted (residency-guaranteed) routes -->
+    <div v-if="mode !== 'off'" class="space-y-2">
+      <label class="text-[11px] font-medium text-slate-300">
+        {{ t('settings.modelPolicy.trustedLabel') }}
+      </label>
+      <p class="text-[11px] text-slate-400">{{ t('settings.modelPolicy.trustedHint') }}</p>
+      <div class="grid grid-cols-2 gap-1 sm:grid-cols-4">
+        <UCheckbox
+          v-for="provider in TRUSTED_PROVIDERS"
+          :key="provider"
+          :model-value="trusted.includes(provider)"
+          :label="providerLabels[provider]"
+          size="sm"
+          @update:model-value="toggleTrusted(provider)"
+        />
+      </div>
+    </div>
+
+    <div class="flex gap-2">
+      <UButton
+        color="primary"
+        size="xs"
+        icon="i-lucide-save"
+        :loading="saving"
+        data-testid="account-model-policy-save"
+        @click="save"
+      >
+        {{ t('common.save') }}
+      </UButton>
+    </div>
+  </section>
+</template>

package/app/components/layout/AccountTeamSettings.vue

@@ -4,6 +4,7 @@ import { apiErrorEnvelope } from '~/composables/api/errors'
 import type { AccountRole } from '~/types/domain'
 import type { InvitationStatus } from '@cat-factory/contracts'
 import AccountDeploymentSettings from '~/components/layout/AccountDeploymentSettings.vue'
+import AccountModelPolicySettings from '~/components/layout/AccountModelPolicySettings.vue'
 import SecretInput from '~/components/common/SecretInput.vue'
 
 // Team settings for an org account: the member roster (with combinable admin /
@@ -13,11 +14,16 @@ import SecretInput from '~/components/common/SecretInput.vue'
 const props = defineProps<{ accountId: string }>()
 
 const accounts = useAccountsStore()
+const auth = useAuthStore()
 const toast = useToast()
 const { t, te } = useI18n()
 const { confirmAction, toastDone } = useConfirmAction()
 const busy = ref(false)
 
+// The account-wide model-family policy is a hosted / mothership-only control (the backend
+// reports `false` in plain local mode, where there is no account admin to govern).
+const modelPolicySupported = computed(() => auth.infrastructure?.modelPolicy?.supported ?? false)
+
 const ROLE_ITEMS = computed<{ label: string; value: AccountRole }[]>(() => [
   { label: t('layout.accountTeam.roles.admin'), value: 'admin' },
   { label: t('layout.accountTeam.roles.developer'), value: 'developer' },
@@ -326,5 +332,10 @@ async function disconnectEmail() {
     <section v-if="isAdmin">
       <AccountDeploymentSettings :account-id="accountId" />
     </section>
+
+    <!-- account-wide model-family allow/block policy (admin-only; hosted/mothership only) -->
+    <section v-if="isAdmin && modelPolicySupported">
+      <AccountModelPolicySettings :account-id="accountId" />
+    </section>
   </div>
 </template>

package/app/composables/usePipelineErrorToast.ts

@@ -48,6 +48,8 @@ const CONFLICT_TITLE_KEYS: Record<
   provision_type_unhandled: 'errors.conflict.title.provision_type_unhandled',
   preset_unsatisfiable: 'errors.conflict.title.preset_unsatisfiable',
   visual_pipeline_no_frontend: 'errors.conflict.title.visual_pipeline_no_frontend',
+  model_policy_blocked: 'errors.conflict.title.model_policy_blocked',
+  model_policy_unsupported: 'errors.conflict.title.model_policy_unsupported',
   deployer_required_before_tester: 'errors.conflict.title.deployer_required_before_tester',
 }
 

package/app/types/accountSettings.ts

@@ -15,4 +15,9 @@ export type {
   ContentStorageConfig,
   ContentStorageSummary,
   ContentStorageCapability,
+  // Account-wide model-family allow/block policy.
+  ModelFamily,
+  ModelFamilyPolicy,
+  ModelPolicyMode,
+  AccountRegion,
 } from '@cat-factory/contracts'

package/i18n/locales/de.json

@@ -745,6 +745,65 @@
         "title": "Diesen Runner entfernen?",
         "body": "\"{name}\" wird entfernt. Dies kann nicht rückgängig gemacht werden."
       }
+    },
+    "modelPolicy": {
+      "title": "Modellzugriffsrichtlinie",
+      "description": "Beschränkt, welche Modellfamilien die Teams dieses Kontos ausführen dürfen. Das Datenresidenz-Risiko hängt von der Bereitstellungsroute ab, daher kann eine vertrauenswürdige (residenzgarantierte) Route eine andernfalls blockierte Familie freigeben.",
+      "regionLabel": "Betriebsregion",
+      "applyPreset": "Vorlage anwenden:",
+      "modeLabel": "Richtlinienmodus",
+      "modes": {
+        "off": "Keine Einschränkung",
+        "blocklist": "Aufgeführte Familien blockieren",
+        "allowlist": "Nur aufgeführte Familien zulassen"
+      },
+      "familiesBlockLabel": "Blockierte Familien",
+      "familiesAllowLabel": "Zugelassene Familien",
+      "trustedLabel": "Vertrauenswürdige (residenzgarantierte) Routen",
+      "trustedHint": "Eine blockierte Familie bleibt verfügbar, wenn sie über eine dieser Routen bereitgestellt wird.",
+      "families": {
+        "claude": "Claude (Anthropic)",
+        "openai": "OpenAI / ChatGPT",
+        "gemini": "Gemini (Google)",
+        "llama": "Llama (Meta)",
+        "qwen": "Qwen (Alibaba)",
+        "kimi": "Kimi (Moonshot)",
+        "deepseek": "DeepSeek",
+        "glm": "GLM (Z.ai)"
+      },
+      "regions": {
+        "usa": "Vereinigte Staaten",
+        "europe": "Europa",
+        "china": "China",
+        "other": "Andere"
+      },
+      "providers": {
+        "bedrock": "AWS Bedrock"
+      },
+      "presets": {
+        "us-block-cn": {
+          "label": "In China gehostete Familien blockieren",
+          "description": "Blockiert DeepSeek, Qwen, Kimi und GLM; erlaubt sie nur über eine residenzgarantierte Route (z. B. Bedrock)."
+        },
+        "eu-block-cn": {
+          "label": "EU: in China gehostete Familien blockieren",
+          "description": "Blockiert DeepSeek, Qwen, Kimi und GLM; eine residenzgarantierte EU-Route (z. B. Bedrock) bleibt zulässig."
+        },
+        "eu-guaranteed-only": {
+          "label": "EU: nur residenzgarantierte Routen",
+          "description": "Erlaubt ein Modell nur, wenn es über eine residenzgarantierte Route bereitgestellt wird."
+        },
+        "cn-prefer-domestic": {
+          "label": "In China gehostete Familien bevorzugen",
+          "description": "Erlaubt in China gehostete Familien (plus Llama) und jede residenzgarantierte Route."
+        },
+        "other-block-cn": {
+          "label": "In China gehostete Familien blockieren",
+          "description": "Blockiert DeepSeek, Qwen, Kimi und GLM; erlaubt sie nur über eine residenzgarantierte Route."
+        }
+      },
+      "saved": "Modellzugriffsrichtlinie gespeichert",
+      "saveFailed": "Modellzugriffsrichtlinie konnte nicht gespeichert werden"
     }
   },
   "inspector": {
@@ -3591,6 +3650,8 @@
         "provision_type_unhandled": "Kein Handler für diesen Bereitstellungstyp",
         "preset_unsatisfiable": "Modell-Preset kann diese Pipeline nicht ausführen",
         "visual_pipeline_no_frontend": "Kein Frontend zum Testen",
+        "model_policy_blocked": "Modell durch Kontorichtlinie blockiert",
+        "model_policy_unsupported": "Modellrichtlinie hier nicht verfügbar",
         "deployer_required_before_tester": "Füge einen Deployer vor dem Tester hinzu"
       },
       "fallbackMessage": "Diese Aktion steht im Konflikt mit dem aktuellen Zustand.",

package/i18n/locales/en.json

@@ -439,6 +439,8 @@
         "provision_type_unhandled": "No handler for this provision type",
         "preset_unsatisfiable": "Model preset can't run this pipeline",
         "visual_pipeline_no_frontend": "No frontend to test",
+        "model_policy_blocked": "Model blocked by account policy",
+        "model_policy_unsupported": "Model policy not available here",
         "deployer_required_before_tester": "Add a Deployer before the Tester"
       },
       "fallbackMessage": "This action conflicts with the current state.",
@@ -2442,6 +2444,65 @@
         "title": "Remove this runner?",
         "body": "\"{name}\" will be removed. This can't be undone."
       }
+    },
+    "modelPolicy": {
+      "title": "Model access policy",
+      "description": "Restrict which model families this account’s teams can run. Data-residency risk depends on the serving route, so a trusted (residency-guaranteed) route can exempt an otherwise-blocked family.",
+      "regionLabel": "Operating region",
+      "applyPreset": "Apply preset:",
+      "modeLabel": "Policy mode",
+      "modes": {
+        "off": "No restriction",
+        "blocklist": "Block listed families",
+        "allowlist": "Allow only listed families"
+      },
+      "familiesBlockLabel": "Blocked families",
+      "familiesAllowLabel": "Allowed families",
+      "trustedLabel": "Trusted (residency-guaranteed) routes",
+      "trustedHint": "A blocked family stays available when it is served over one of these routes.",
+      "families": {
+        "claude": "Claude (Anthropic)",
+        "openai": "OpenAI / ChatGPT",
+        "gemini": "Gemini (Google)",
+        "llama": "Llama (Meta)",
+        "qwen": "Qwen (Alibaba)",
+        "kimi": "Kimi (Moonshot)",
+        "deepseek": "DeepSeek",
+        "glm": "GLM (Z.ai)"
+      },
+      "regions": {
+        "usa": "United States",
+        "europe": "Europe",
+        "china": "China",
+        "other": "Other"
+      },
+      "providers": {
+        "bedrock": "AWS Bedrock"
+      },
+      "presets": {
+        "us-block-cn": {
+          "label": "Block China-hosted families",
+          "description": "Block DeepSeek, Qwen, Kimi and GLM; allow them only over a residency-guaranteed route (e.g. Bedrock)."
+        },
+        "eu-block-cn": {
+          "label": "EU: block China-hosted families",
+          "description": "Block DeepSeek, Qwen, Kimi and GLM; a residency-guaranteed EU route (e.g. Bedrock) stays allowed."
+        },
+        "eu-guaranteed-only": {
+          "label": "EU: residency-guaranteed routes only",
+          "description": "Allow a model only when it is served over a residency-guaranteed route."
+        },
+        "cn-prefer-domestic": {
+          "label": "Prefer China-hosted families",
+          "description": "Allow China-hosted families (plus Llama) and any residency-guaranteed route."
+        },
+        "other-block-cn": {
+          "label": "Block China-hosted families",
+          "description": "Block DeepSeek, Qwen, Kimi and GLM; allow them only over a residency-guaranteed route."
+        }
+      },
+      "saved": "Model access policy saved",
+      "saveFailed": "Could not save the model access policy"
     }
   },
   "providers": {

package/i18n/locales/es.json

@@ -399,6 +399,8 @@
         "bootstrap_reference_missing": "La arquitectura de referencia ha desaparecido",
         "preset_unsatisfiable": "El preajuste de modelo no puede ejecutar esta canalización",
         "visual_pipeline_no_frontend": "No hay frontend que probar",
+        "model_policy_blocked": "Modelo bloqueado por la política de la cuenta",
+        "model_policy_unsupported": "La política de modelos no está disponible aquí",
         "deployer_required_before_tester": "Añade un Deployer antes del Tester"
       },
       "fallbackMessage": "Esta acción entra en conflicto con el estado actual.",
@@ -2375,6 +2377,65 @@
         "kubeOverrideNoun": "la anulación de Kubernetes",
         "customNoun": "este controlador"
       }
+    },
+    "modelPolicy": {
+      "title": "Política de acceso a modelos",
+      "description": "Restringe qué familias de modelos pueden usar los equipos de esta cuenta. El riesgo de residencia de datos depende de la ruta de servicio, por lo que una ruta de confianza (con residencia garantizada) puede eximir a una familia que de otro modo estaría bloqueada.",
+      "regionLabel": "Región de operación",
+      "applyPreset": "Aplicar preajuste:",
+      "modeLabel": "Modo de la política",
+      "modes": {
+        "off": "Sin restricción",
+        "blocklist": "Bloquear las familias listadas",
+        "allowlist": "Permitir solo las familias listadas"
+      },
+      "familiesBlockLabel": "Familias bloqueadas",
+      "familiesAllowLabel": "Familias permitidas",
+      "trustedLabel": "Rutas de confianza (con residencia garantizada)",
+      "trustedHint": "Una familia bloqueada sigue disponible cuando se sirve a través de una de estas rutas.",
+      "families": {
+        "claude": "Claude (Anthropic)",
+        "openai": "OpenAI / ChatGPT",
+        "gemini": "Gemini (Google)",
+        "llama": "Llama (Meta)",
+        "qwen": "Qwen (Alibaba)",
+        "kimi": "Kimi (Moonshot)",
+        "deepseek": "DeepSeek",
+        "glm": "GLM (Z.ai)"
+      },
+      "regions": {
+        "usa": "Estados Unidos",
+        "europe": "Europa",
+        "china": "China",
+        "other": "Otra"
+      },
+      "providers": {
+        "bedrock": "AWS Bedrock"
+      },
+      "presets": {
+        "us-block-cn": {
+          "label": "Bloquear familias alojadas en China",
+          "description": "Bloquea DeepSeek, Qwen, Kimi y GLM; permítelas solo a través de una ruta con residencia garantizada (p. ej. Bedrock)."
+        },
+        "eu-block-cn": {
+          "label": "UE: bloquear familias alojadas en China",
+          "description": "Bloquea DeepSeek, Qwen, Kimi y GLM; una ruta de la UE con residencia garantizada (p. ej. Bedrock) sigue permitida."
+        },
+        "eu-guaranteed-only": {
+          "label": "UE: solo rutas con residencia garantizada",
+          "description": "Permite un modelo solo cuando se sirve a través de una ruta con residencia garantizada."
+        },
+        "cn-prefer-domestic": {
+          "label": "Preferir familias alojadas en China",
+          "description": "Permite las familias alojadas en China (más Llama) y cualquier ruta con residencia garantizada."
+        },
+        "other-block-cn": {
+          "label": "Bloquear familias alojadas en China",
+          "description": "Bloquea DeepSeek, Qwen, Kimi y GLM; permítelas solo a través de una ruta con residencia garantizada."
+        }
+      },
+      "saved": "Política de acceso a modelos guardada",
+      "saveFailed": "No se pudo guardar la política de acceso a modelos"
     }
   },
   "providers": {

package/i18n/locales/fr.json

@@ -399,6 +399,8 @@
         "bootstrap_reference_missing": "L’architecture de référence a disparu",
         "preset_unsatisfiable": "Le préréglage de modèle ne peut pas exécuter ce pipeline",
         "visual_pipeline_no_frontend": "Aucun frontend à tester",
+        "model_policy_blocked": "Modèle bloqué par la politique du compte",
+        "model_policy_unsupported": "La politique de modèles n'est pas disponible ici",
         "deployer_required_before_tester": "Ajoutez un Deployer avant le Testeur"
       },
       "fallbackMessage": "Cette action est en conflit avec l’état actuel.",
@@ -2375,6 +2377,65 @@
         "kubeOverrideNoun": "le remplacement Kubernetes",
         "customNoun": "ce gestionnaire"
       }
+    },
+    "modelPolicy": {
+      "title": "Politique d'accès aux modèles",
+      "description": "Restreint les familles de modèles que les équipes de ce compte peuvent utiliser. Le risque lié à la résidence des données dépend de la route de service : une route de confiance (à résidence garantie) peut donc exempter une famille autrement bloquée.",
+      "regionLabel": "Région d'exploitation",
+      "applyPreset": "Appliquer un préréglage :",
+      "modeLabel": "Mode de la politique",
+      "modes": {
+        "off": "Aucune restriction",
+        "blocklist": "Bloquer les familles listées",
+        "allowlist": "Autoriser uniquement les familles listées"
+      },
+      "familiesBlockLabel": "Familles bloquées",
+      "familiesAllowLabel": "Familles autorisées",
+      "trustedLabel": "Routes de confiance (à résidence garantie)",
+      "trustedHint": "Une famille bloquée reste disponible lorsqu'elle est servie via l'une de ces routes.",
+      "families": {
+        "claude": "Claude (Anthropic)",
+        "openai": "OpenAI / ChatGPT",
+        "gemini": "Gemini (Google)",
+        "llama": "Llama (Meta)",
+        "qwen": "Qwen (Alibaba)",
+        "kimi": "Kimi (Moonshot)",
+        "deepseek": "DeepSeek",
+        "glm": "GLM (Z.ai)"
+      },
+      "regions": {
+        "usa": "États-Unis",
+        "europe": "Europe",
+        "china": "Chine",
+        "other": "Autre"
+      },
+      "providers": {
+        "bedrock": "AWS Bedrock"
+      },
+      "presets": {
+        "us-block-cn": {
+          "label": "Bloquer les familles hébergées en Chine",
+          "description": "Bloque DeepSeek, Qwen, Kimi et GLM ; ne les autorise que via une route à résidence garantie (p. ex. Bedrock)."
+        },
+        "eu-block-cn": {
+          "label": "UE : bloquer les familles hébergées en Chine",
+          "description": "Bloque DeepSeek, Qwen, Kimi et GLM ; une route UE à résidence garantie (p. ex. Bedrock) reste autorisée."
+        },
+        "eu-guaranteed-only": {
+          "label": "UE : routes à résidence garantie uniquement",
+          "description": "N'autorise un modèle que lorsqu'il est servi via une route à résidence garantie."
+        },
+        "cn-prefer-domestic": {
+          "label": "Préférer les familles hébergées en Chine",
+          "description": "Autorise les familles hébergées en Chine (plus Llama) et toute route à résidence garantie."
+        },
+        "other-block-cn": {
+          "label": "Bloquer les familles hébergées en Chine",
+          "description": "Bloque DeepSeek, Qwen, Kimi et GLM ; ne les autorise que via une route à résidence garantie."
+        }
+      },
+      "saved": "Politique d'accès aux modèles enregistrée",
+      "saveFailed": "Impossible d'enregistrer la politique d'accès aux modèles"
     }
   },
   "providers": {

package/i18n/locales/he.json

@@ -399,6 +399,8 @@
         "bootstrap_reference_missing": "ארכיטקטורת ההפניה נעלמה",
         "preset_unsatisfiable": "קדם‑הגדרת המודל אינה יכולה להריץ צנרת זו",
         "visual_pipeline_no_frontend": "אין frontend לבדיקה",
+        "model_policy_blocked": "המודל נחסם על ידי מדיניות החשבון",
+        "model_policy_unsupported": "מדיניות המודלים אינה זמינה כאן",
         "deployer_required_before_tester": "הוסף Deployer לפני ה-Tester"
       },
       "fallbackMessage": "פעולה זו מתנגשת עם המצב הנוכחי.",
@@ -2386,6 +2388,65 @@
         "title": "להסיר את ה־runner הזה?",
         "body": "\"{name}\" יימחק. לא ניתן לבטל פעולה זו."
       }
+    },
+    "modelPolicy": {
+      "title": "מדיניות גישה למודלים",
+      "description": "מגבילה אילו משפחות מודלים הצוותים של חשבון זה יכולים להריץ. סיכון תושבוּת הנתונים תלוי בנתיב השירות, ולכן נתיב מהימן (עם תושבוּת מובטחת) יכול לפטור משפחה שאחרת הייתה חסומה.",
+      "regionLabel": "אזור הפעילות",
+      "applyPreset": "החל תבנית:",
+      "modeLabel": "מצב המדיניות",
+      "modes": {
+        "off": "ללא הגבלה",
+        "blocklist": "חסום את המשפחות ברשימה",
+        "allowlist": "אפשר רק את המשפחות ברשימה"
+      },
+      "familiesBlockLabel": "משפחות חסומות",
+      "familiesAllowLabel": "משפחות מותרות",
+      "trustedLabel": "נתיבים מהימנים (עם תושבוּת מובטחת)",
+      "trustedHint": "משפחה חסומה נשארת זמינה כאשר היא מוגשת דרך אחד מהנתיבים האלה.",
+      "families": {
+        "claude": "Claude (Anthropic)",
+        "openai": "OpenAI / ChatGPT",
+        "gemini": "Gemini (Google)",
+        "llama": "Llama (Meta)",
+        "qwen": "Qwen (Alibaba)",
+        "kimi": "Kimi (Moonshot)",
+        "deepseek": "DeepSeek",
+        "glm": "GLM (Z.ai)"
+      },
+      "regions": {
+        "usa": "ארצות הברית",
+        "europe": "אירופה",
+        "china": "סין",
+        "other": "אחר"
+      },
+      "providers": {
+        "bedrock": "AWS Bedrock"
+      },
+      "presets": {
+        "us-block-cn": {
+          "label": "חסום משפחות המתארחות בסין",
+          "description": "חוסם את DeepSeek, Qwen, Kimi ו-GLM; מתיר אותן רק דרך נתיב עם תושבוּת מובטחת (למשל Bedrock)."
+        },
+        "eu-block-cn": {
+          "label": "האיחוד האירופי: חסום משפחות המתארחות בסין",
+          "description": "חוסם את DeepSeek, Qwen, Kimi ו-GLM; נתיב של האיחוד האירופי עם תושבוּת מובטחת (למשל Bedrock) נשאר מותר."
+        },
+        "eu-guaranteed-only": {
+          "label": "האיחוד האירופי: רק נתיבים עם תושבוּת מובטחת",
+          "description": "מתיר מודל רק כאשר הוא מוגש דרך נתיב עם תושבוּת מובטחת."
+        },
+        "cn-prefer-domestic": {
+          "label": "העדף משפחות המתארחות בסין",
+          "description": "מתיר משפחות המתארחות בסין (וגם Llama) וכל נתיב עם תושבוּת מובטחת."
+        },
+        "other-block-cn": {
+          "label": "חסום משפחות המתארחות בסין",
+          "description": "חוסם את DeepSeek, Qwen, Kimi ו-GLM; מתיר אותן רק דרך נתיב עם תושבוּת מובטחת."
+        }
+      },
+      "saved": "מדיניות הגישה למודלים נשמרה",
+      "saveFailed": "לא ניתן היה לשמור את מדיניות הגישה למודלים"
     }
   },
   "providers": {

package/i18n/locales/it.json

@@ -745,6 +745,65 @@
         "title": "Rimuovere questo runner?",
         "body": "\"{name}\" verra rimosso. Questa operazione non puo essere annullata."
       }
+    },
+    "modelPolicy": {
+      "title": "Policy di accesso ai modelli",
+      "description": "Limita quali famiglie di modelli possono usare i team di questo account. Il rischio di residenza dei dati dipende dalla rotta di servizio, quindi una rotta attendibile (con residenza garantita) può esentare una famiglia altrimenti bloccata.",
+      "regionLabel": "Regione operativa",
+      "applyPreset": "Applica preset:",
+      "modeLabel": "Modalità della policy",
+      "modes": {
+        "off": "Nessuna restrizione",
+        "blocklist": "Blocca le famiglie elencate",
+        "allowlist": "Consenti solo le famiglie elencate"
+      },
+      "familiesBlockLabel": "Famiglie bloccate",
+      "familiesAllowLabel": "Famiglie consentite",
+      "trustedLabel": "Rotte attendibili (con residenza garantita)",
+      "trustedHint": "Una famiglia bloccata resta disponibile quando viene servita tramite una di queste rotte.",
+      "families": {
+        "claude": "Claude (Anthropic)",
+        "openai": "OpenAI / ChatGPT",
+        "gemini": "Gemini (Google)",
+        "llama": "Llama (Meta)",
+        "qwen": "Qwen (Alibaba)",
+        "kimi": "Kimi (Moonshot)",
+        "deepseek": "DeepSeek",
+        "glm": "GLM (Z.ai)"
+      },
+      "regions": {
+        "usa": "Stati Uniti",
+        "europe": "Europa",
+        "china": "Cina",
+        "other": "Altro"
+      },
+      "providers": {
+        "bedrock": "AWS Bedrock"
+      },
+      "presets": {
+        "us-block-cn": {
+          "label": "Blocca le famiglie ospitate in Cina",
+          "description": "Blocca DeepSeek, Qwen, Kimi e GLM; consentile solo tramite una rotta con residenza garantita (es. Bedrock)."
+        },
+        "eu-block-cn": {
+          "label": "UE: blocca le famiglie ospitate in Cina",
+          "description": "Blocca DeepSeek, Qwen, Kimi e GLM; una rotta UE con residenza garantita (es. Bedrock) resta consentita."
+        },
+        "eu-guaranteed-only": {
+          "label": "UE: solo rotte con residenza garantita",
+          "description": "Consente un modello solo quando è servito tramite una rotta con residenza garantita."
+        },
+        "cn-prefer-domestic": {
+          "label": "Preferisci le famiglie ospitate in Cina",
+          "description": "Consente le famiglie ospitate in Cina (più Llama) e qualsiasi rotta con residenza garantita."
+        },
+        "other-block-cn": {
+          "label": "Blocca le famiglie ospitate in Cina",
+          "description": "Blocca DeepSeek, Qwen, Kimi e GLM; consentile solo tramite una rotta con residenza garantita."
+        }
+      },
+      "saved": "Policy di accesso ai modelli salvata",
+      "saveFailed": "Impossibile salvare la policy di accesso ai modelli"
     }
   },
   "inspector": {
@@ -3591,6 +3650,8 @@
         "provision_type_unhandled": "Nessun gestore per questo tipo di provisioning",
         "preset_unsatisfiable": "Il preset del modello non può eseguire questa pipeline",
         "visual_pipeline_no_frontend": "Nessun frontend da testare",
+        "model_policy_blocked": "Modello bloccato dalla policy dell'account",
+        "model_policy_unsupported": "Policy dei modelli non disponibile qui",
         "deployer_required_before_tester": "Aggiungi un Deployer prima del Tester"
       },
       "fallbackMessage": "Questa azione è in conflitto con lo stato attuale.",

package/i18n/locales/ja.json

@@ -399,6 +399,8 @@
         "bootstrap_reference_missing": "リファレンスアーキテクチャが見つかりません",
         "preset_unsatisfiable": "モデルプリセットではこのパイプラインを実行できません",
         "visual_pipeline_no_frontend": "テスト対象のフロントエンドがありません",
+        "model_policy_blocked": "アカウントのポリシーによりモデルがブロックされています",
+        "model_policy_unsupported": "モデルポリシーはここでは利用できません",
         "deployer_required_before_tester": "テスターの前にDeployerを追加してください"
       },
       "fallbackMessage": "この操作は現在の状態と競合します。",
@@ -2387,6 +2389,65 @@
         "title": "このランナーを削除しますか？",
         "body": "「{name}」が削除されます。 この操作は取り消せません。"
       }
+    },
+    "modelPolicy": {
+      "title": "モデルアクセスポリシー",
+      "description": "このアカウントのチームが実行できるモデルファミリーを制限します。データレジデンシーのリスクは提供経路に依存するため、信頼された（レジデンシー保証済みの）経路であれば、通常はブロックされるファミリーを除外できます。",
+      "regionLabel": "運用リージョン",
+      "applyPreset": "プリセットを適用:",
+      "modeLabel": "ポリシーモード",
+      "modes": {
+        "off": "制限なし",
+        "blocklist": "リストされたファミリーをブロック",
+        "allowlist": "リストされたファミリーのみ許可"
+      },
+      "familiesBlockLabel": "ブロックするファミリー",
+      "familiesAllowLabel": "許可するファミリー",
+      "trustedLabel": "信頼された（レジデンシー保証済みの）経路",
+      "trustedHint": "ブロックされたファミリーでも、これらの経路のいずれかで提供される場合は利用可能なままです。",
+      "families": {
+        "claude": "Claude (Anthropic)",
+        "openai": "OpenAI / ChatGPT",
+        "gemini": "Gemini (Google)",
+        "llama": "Llama (Meta)",
+        "qwen": "Qwen (Alibaba)",
+        "kimi": "Kimi (Moonshot)",
+        "deepseek": "DeepSeek",
+        "glm": "GLM (Z.ai)"
+      },
+      "regions": {
+        "usa": "アメリカ合衆国",
+        "europe": "ヨーロッパ",
+        "china": "中国",
+        "other": "その他"
+      },
+      "providers": {
+        "bedrock": "AWS Bedrock"
+      },
+      "presets": {
+        "us-block-cn": {
+          "label": "中国でホストされるファミリーをブロック",
+          "description": "DeepSeek、Qwen、Kimi、GLM をブロックし、レジデンシー保証済みの経路（例: Bedrock）経由でのみ許可します。"
+        },
+        "eu-block-cn": {
+          "label": "EU: 中国でホストされるファミリーをブロック",
+          "description": "DeepSeek、Qwen、Kimi、GLM をブロックしますが、レジデンシー保証済みの EU 経路（例: Bedrock）は許可されたままです。"
+        },
+        "eu-guaranteed-only": {
+          "label": "EU: レジデンシー保証済みの経路のみ",
+          "description": "レジデンシー保証済みの経路で提供される場合にのみモデルを許可します。"
+        },
+        "cn-prefer-domestic": {
+          "label": "中国でホストされるファミリーを優先",
+          "description": "中国でホストされるファミリー（および Llama）と、レジデンシー保証済みの任意の経路を許可します。"
+        },
+        "other-block-cn": {
+          "label": "中国でホストされるファミリーをブロック",
+          "description": "DeepSeek、Qwen、Kimi、GLM をブロックし、レジデンシー保証済みの経路経由でのみ許可します。"
+        }
+      },
+      "saved": "モデルアクセスポリシーを保存しました",
+      "saveFailed": "モデルアクセスポリシーを保存できませんでした"
     }
   },
   "providers": {

package/i18n/locales/pl.json

@@ -399,6 +399,8 @@
         "bootstrap_reference_missing": "Architektura referencyjna zniknęła",
         "preset_unsatisfiable": "Ten zestaw modeli nie może uruchomić tego potoku",
         "visual_pipeline_no_frontend": "Brak frontendu do przetestowania",
+        "model_policy_blocked": "Model zablokowany przez politykę konta",
+        "model_policy_unsupported": "Polityka modeli jest tu niedostępna",
         "deployer_required_before_tester": "Dodaj Deployer przed Testerem"
       },
       "fallbackMessage": "Ta akcja jest sprzeczna z bieżącym stanem.",
@@ -2375,6 +2377,65 @@
         "kubeOverrideNoun": "nadpisanie Kubernetes",
         "customNoun": "tę obsługę"
       }
+    },
+    "modelPolicy": {
+      "title": "Polityka dostępu do modeli",
+      "description": "Ogranicza, które rodziny modeli mogą uruchamiać zespoły tego konta. Ryzyko rezydencji danych zależy od trasy obsługi, więc zaufana trasa (z gwarantowaną rezydencją) może zwolnić rodzinę, która w innym przypadku byłaby zablokowana.",
+      "regionLabel": "Region działania",
+      "applyPreset": "Zastosuj szablon:",
+      "modeLabel": "Tryb polityki",
+      "modes": {
+        "off": "Bez ograniczeń",
+        "blocklist": "Blokuj wymienione rodziny",
+        "allowlist": "Zezwól tylko na wymienione rodziny"
+      },
+      "familiesBlockLabel": "Zablokowane rodziny",
+      "familiesAllowLabel": "Dozwolone rodziny",
+      "trustedLabel": "Zaufane trasy (z gwarantowaną rezydencją)",
+      "trustedHint": "Zablokowana rodzina pozostaje dostępna, gdy jest obsługiwana przez jedną z tych tras.",
+      "families": {
+        "claude": "Claude (Anthropic)",
+        "openai": "OpenAI / ChatGPT",
+        "gemini": "Gemini (Google)",
+        "llama": "Llama (Meta)",
+        "qwen": "Qwen (Alibaba)",
+        "kimi": "Kimi (Moonshot)",
+        "deepseek": "DeepSeek",
+        "glm": "GLM (Z.ai)"
+      },
+      "regions": {
+        "usa": "Stany Zjednoczone",
+        "europe": "Europa",
+        "china": "Chiny",
+        "other": "Inny"
+      },
+      "providers": {
+        "bedrock": "AWS Bedrock"
+      },
+      "presets": {
+        "us-block-cn": {
+          "label": "Blokuj rodziny hostowane w Chinach",
+          "description": "Blokuje DeepSeek, Qwen, Kimi i GLM; zezwala na nie tylko przez trasę z gwarantowaną rezydencją (np. Bedrock)."
+        },
+        "eu-block-cn": {
+          "label": "UE: blokuj rodziny hostowane w Chinach",
+          "description": "Blokuje DeepSeek, Qwen, Kimi i GLM; trasa UE z gwarantowaną rezydencją (np. Bedrock) pozostaje dozwolona."
+        },
+        "eu-guaranteed-only": {
+          "label": "UE: tylko trasy z gwarantowaną rezydencją",
+          "description": "Zezwala na model tylko wtedy, gdy jest obsługiwany przez trasę z gwarantowaną rezydencją."
+        },
+        "cn-prefer-domestic": {
+          "label": "Preferuj rodziny hostowane w Chinach",
+          "description": "Zezwala na rodziny hostowane w Chinach (oraz Llama) i dowolną trasę z gwarantowaną rezydencją."
+        },
+        "other-block-cn": {
+          "label": "Blokuj rodziny hostowane w Chinach",
+          "description": "Blokuje DeepSeek, Qwen, Kimi i GLM; zezwala na nie tylko przez trasę z gwarantowaną rezydencją."
+        }
+      },
+      "saved": "Zapisano politykę dostępu do modeli",
+      "saveFailed": "Nie udało się zapisać polityki dostępu do modeli"
     }
   },
   "providers": {

package/i18n/locales/tr.json

@@ -399,6 +399,8 @@
         "bootstrap_reference_missing": "Referans mimari kayıp",
         "preset_unsatisfiable": "Model ön ayarı bu ardışık düzeni çalıştıramıyor",
         "visual_pipeline_no_frontend": "Test edilecek bir frontend yok",
+        "model_policy_blocked": "Model, hesap politikası tarafından engellendi",
+        "model_policy_unsupported": "Model politikası burada kullanılamıyor",
         "deployer_required_before_tester": "Tester’dan önce bir Deployer ekleyin"
       },
       "fallbackMessage": "Bu eylem mevcut durumla çelişiyor.",
@@ -2387,6 +2389,65 @@
         "title": "Bu runner kaldırılsın mı?",
         "body": "\"{name}\" kaldırılacak. Bu işlem geri alınamaz."
       }
+    },
+    "modelPolicy": {
+      "title": "Model erişim politikası",
+      "description": "Bu hesabın ekiplerinin hangi model ailelerini çalıştırabileceğini kısıtlar. Veri yerleşimi riski hizmet rotasına bağlıdır; bu nedenle güvenilir (yerleşimi garantili) bir rota, aksi takdirde engellenmiş bir aileyi muaf tutabilir.",
+      "regionLabel": "Çalışma bölgesi",
+      "applyPreset": "Ön ayarı uygula:",
+      "modeLabel": "Politika modu",
+      "modes": {
+        "off": "Kısıtlama yok",
+        "blocklist": "Listelenen aileleri engelle",
+        "allowlist": "Yalnızca listelenen ailelere izin ver"
+      },
+      "familiesBlockLabel": "Engellenen aileler",
+      "familiesAllowLabel": "İzin verilen aileler",
+      "trustedLabel": "Güvenilir (yerleşimi garantili) rotalar",
+      "trustedHint": "Engellenen bir aile, bu rotalardan biri üzerinden sunulduğunda kullanılabilir kalır.",
+      "families": {
+        "claude": "Claude (Anthropic)",
+        "openai": "OpenAI / ChatGPT",
+        "gemini": "Gemini (Google)",
+        "llama": "Llama (Meta)",
+        "qwen": "Qwen (Alibaba)",
+        "kimi": "Kimi (Moonshot)",
+        "deepseek": "DeepSeek",
+        "glm": "GLM (Z.ai)"
+      },
+      "regions": {
+        "usa": "Amerika Birleşik Devletleri",
+        "europe": "Avrupa",
+        "china": "Çin",
+        "other": "Diğer"
+      },
+      "providers": {
+        "bedrock": "AWS Bedrock"
+      },
+      "presets": {
+        "us-block-cn": {
+          "label": "Çin'de barındırılan aileleri engelle",
+          "description": "DeepSeek, Qwen, Kimi ve GLM'yi engeller; bunlara yalnızca yerleşimi garantili bir rota üzerinden izin verir (ör. Bedrock)."
+        },
+        "eu-block-cn": {
+          "label": "AB: Çin'de barındırılan aileleri engelle",
+          "description": "DeepSeek, Qwen, Kimi ve GLM'yi engeller; yerleşimi garantili bir AB rotası (ör. Bedrock) izinli kalır."
+        },
+        "eu-guaranteed-only": {
+          "label": "AB: yalnızca yerleşimi garantili rotalar",
+          "description": "Bir modele yalnızca yerleşimi garantili bir rota üzerinden sunulduğunda izin verir."
+        },
+        "cn-prefer-domestic": {
+          "label": "Çin'de barındırılan aileleri tercih et",
+          "description": "Çin'de barındırılan ailelere (ve Llama'ya) ve yerleşimi garantili herhangi bir rotaya izin verir."
+        },
+        "other-block-cn": {
+          "label": "Çin'de barındırılan aileleri engelle",
+          "description": "DeepSeek, Qwen, Kimi ve GLM'yi engeller; bunlara yalnızca yerleşimi garantili bir rota üzerinden izin verir."
+        }
+      },
+      "saved": "Model erişim politikası kaydedildi",
+      "saveFailed": "Model erişim politikası kaydedilemedi"
     }
   },
   "providers": {

package/i18n/locales/uk.json

@@ -399,6 +399,8 @@
         "bootstrap_reference_missing": "Еталонна архітектура зникла",
         "preset_unsatisfiable": "Пресет моделі не може запустити цей конвеєр",
         "visual_pipeline_no_frontend": "Немає фронтенду для тестування",
+        "model_policy_blocked": "Модель заблоковано політикою облікового запису",
+        "model_policy_unsupported": "Політика моделей тут недоступна",
         "deployer_required_before_tester": "Додайте Deployer перед Tester"
       },
       "fallbackMessage": "Ця дія суперечить поточному стану.",
@@ -2375,6 +2377,65 @@
         "kubeOverrideNoun": "перевизначення Kubernetes",
         "customNoun": "цей обробник"
       }
+    },
+    "modelPolicy": {
+      "title": "Політика доступу до моделей",
+      "description": "Обмежує, які родини моделей можуть запускати команди цього облікового запису. Ризик резидентності даних залежить від маршруту обслуговування, тож довірений маршрут (із гарантованою резидентністю) може звільнити родину, яку інакше було б заблоковано.",
+      "regionLabel": "Регіон роботи",
+      "applyPreset": "Застосувати шаблон:",
+      "modeLabel": "Режим політики",
+      "modes": {
+        "off": "Без обмежень",
+        "blocklist": "Блокувати перелічені родини",
+        "allowlist": "Дозволити лише перелічені родини"
+      },
+      "familiesBlockLabel": "Заблоковані родини",
+      "familiesAllowLabel": "Дозволені родини",
+      "trustedLabel": "Довірені маршрути (із гарантованою резидентністю)",
+      "trustedHint": "Заблокована родина залишається доступною, коли обслуговується через один із цих маршрутів.",
+      "families": {
+        "claude": "Claude (Anthropic)",
+        "openai": "OpenAI / ChatGPT",
+        "gemini": "Gemini (Google)",
+        "llama": "Llama (Meta)",
+        "qwen": "Qwen (Alibaba)",
+        "kimi": "Kimi (Moonshot)",
+        "deepseek": "DeepSeek",
+        "glm": "GLM (Z.ai)"
+      },
+      "regions": {
+        "usa": "Сполучені Штати",
+        "europe": "Європа",
+        "china": "Китай",
+        "other": "Інше"
+      },
+      "providers": {
+        "bedrock": "AWS Bedrock"
+      },
+      "presets": {
+        "us-block-cn": {
+          "label": "Блокувати родини, розміщені в Китаї",
+          "description": "Блокує DeepSeek, Qwen, Kimi та GLM; дозволяє їх лише через маршрут із гарантованою резидентністю (напр. Bedrock)."
+        },
+        "eu-block-cn": {
+          "label": "ЄС: блокувати родини, розміщені в Китаї",
+          "description": "Блокує DeepSeek, Qwen, Kimi та GLM; маршрут ЄС із гарантованою резидентністю (напр. Bedrock) залишається дозволеним."
+        },
+        "eu-guaranteed-only": {
+          "label": "ЄС: лише маршрути з гарантованою резидентністю",
+          "description": "Дозволяє модель лише тоді, коли вона обслуговується через маршрут із гарантованою резидентністю."
+        },
+        "cn-prefer-domestic": {
+          "label": "Надавати перевагу родинам, розміщеним у Китаї",
+          "description": "Дозволяє родини, розміщені в Китаї (а також Llama), і будь-який маршрут із гарантованою резидентністю."
+        },
+        "other-block-cn": {
+          "label": "Блокувати родини, розміщені в Китаї",
+          "description": "Блокує DeepSeek, Qwen, Kimi та GLM; дозволяє їх лише через маршрут із гарантованою резидентністю."
+        }
+      },
+      "saved": "Політику доступу до моделей збережено",
+      "saveFailed": "Не вдалося зберегти політику доступу до моделей"
     }
   },
   "providers": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cat-factory/app",
-  "version": "0.102.0",
+  "version": "0.103.0",
   "description": "Reusable Nuxt layer for the Agent Architecture Board SPA (components, stores, composables, pages). Consume it from a thin deployment app via `extends: ['@cat-factory/app']` and point it at your backend with NUXT_PUBLIC_API_BASE. See deploy/frontend for an example.",
   "repository": {
     "type": "git",
@@ -34,7 +34,7 @@
     "valibot": "^1.4.2",
     "vue": "3.5.39",
     "wretch": "^3.0.9",
-    "@cat-factory/contracts": "0.112.0"
+    "@cat-factory/contracts": "0.113.0"
   },
   "devDependencies": {
     "@toad-contracts/testing": "0.3.2",