@cat-factory/app 0.102.0 → 0.104.0

package/app/components/auth/AuthGate.vue

@@ -1,5 +1,6 @@
 <script setup lang="ts">
 import { computed } from 'vue'
+import BackendMisconfiguredScreen from '~/components/auth/BackendMisconfiguredScreen.vue'
 import LoginScreen from '~/components/auth/LoginScreen.vue'
 
 // Resolves auth state once on mount, then either renders the app (auth off, or
@@ -25,6 +26,8 @@ onMounted(() => auth.bootstrap())
     <span class="text-sm">{{ t('auth.gate.loading') }}</span>
   </div>
 
+  <BackendMisconfiguredScreen v-else-if="auth.isMisconfigured" />
+
   <slot v-else-if="isPublicRoute" />
 
   <LoginScreen v-else-if="auth.needsLogin" />

package/app/components/auth/BackendMisconfiguredScreen.vue

@@ -0,0 +1,55 @@
+<script setup lang="ts">
+import type { ConfigProblem } from '@cat-factory/contracts'
+
+// Shown when the backend booted into its misconfiguration fallback: it couldn't start normally
+// because one or more mandatory environment variables / bindings are missing or invalid. We list
+// each one with what it is for and how to fill it, so the developer can fix their env and reload
+// rather than staring at a generic "can't reach the backend" panel. The `problems` never carry a
+// secret value — only the variable name, its meaning, and the remedy.
+const auth = useAuthStore()
+const { t } = useI18n()
+
+const problems = computed<ConfigProblem[]>(() => auth.misconfigured?.problems ?? [])
+
+function reload() {
+  window.location.reload()
+}
+</script>
+
+<template>
+  <div
+    class="flex h-screen w-screen flex-col items-center justify-center bg-slate-950 p-6 text-slate-200"
+  >
+    <div class="w-full max-w-2xl">
+      <div class="mb-6 text-center">
+        <UIcon name="i-lucide-server-cog" class="mx-auto mb-3 h-10 w-10 text-amber-400" />
+        <h1 class="text-lg font-semibold">{{ t('app.misconfigured.title') }}</h1>
+        <p class="mx-auto mt-2 max-w-lg text-sm text-slate-400">
+          {{ t('app.misconfigured.intro') }}
+        </p>
+      </div>
+
+      <ul class="space-y-3">
+        <li
+          v-for="problem in problems"
+          :key="problem.key"
+          class="rounded-lg border border-slate-800 bg-slate-900/60 p-4"
+        >
+          <code class="text-sm font-semibold text-amber-300">{{ problem.key }}</code>
+          <p class="mt-1 text-sm text-slate-300">{{ problem.summary }}</p>
+          <p class="mt-2 text-sm text-slate-400">
+            <span class="font-medium text-slate-300">{{ t('app.misconfigured.howToFix') }}</span>
+            {{ problem.remedy }}
+          </p>
+        </li>
+      </ul>
+
+      <div class="mt-6 flex items-center justify-center gap-3">
+        <UButton color="primary" icon="i-lucide-rotate-ccw" @click="reload">
+          {{ t('app.misconfigured.reload') }}
+        </UButton>
+      </div>
+      <p class="mt-4 text-center text-xs text-slate-500">{{ t('app.misconfigured.hint') }}</p>
+    </div>
+  </div>
+</template>

package/app/components/layout/AccountDeploymentSettings.vue

@@ -129,7 +129,11 @@ async function saveStorage() {
       ...(cs.forcePathStyle ? { forcePathStyle: true } : {}),
     }
   }
-  const input: Parameters<typeof store.save>[1] = { config: { contentStorage: config } }
+  // `config` fully REPLACES the stored non-secret config, so carry the rest forward
+  // (e.g. the model-family policy) — only `contentStorage` is edited here.
+  const input: Parameters<typeof store.save>[1] = {
+    config: { ...store.view?.config, contentStorage: config },
+  }
   if (backend === 's3') {
     const id = cs.accessKeyId.trim()
     const key = cs.secretAccessKey.trim()

package/app/components/layout/AccountModelPolicySettings.vue

@@ -0,0 +1,247 @@
+<script setup lang="ts">
+import { computed, onMounted, ref, watch } from 'vue'
+import { MODEL_FAMILY_POLICY_PRESETS } from '@cat-factory/contracts'
+import type {
+  AccountRegion,
+  ModelFamily,
+  ModelFamilyPolicy,
+  ModelPolicyMode,
+} from '~/types/accountSettings'
+
+// Account-wide model-family allow/block policy (admin only). Constrains which LLM families
+// the account's teams may run; a residency-guaranteed route (`trustedProviders`) can exempt
+// an otherwise-blocked family. Region-grouped built-in presets are one-click templates the
+// admin applies into the editable policy. Mounted only where the deployment supports it
+// (hosted / mothership — never plain local mode), gated by the parent on the infra flag.
+const props = defineProps<{ accountId: string }>()
+
+const store = useAccountSettingsStore()
+const toast = useToast()
+const { t } = useI18n()
+
+// The family / region / mode / trusted-provider domains, pinned to the contract unions so a
+// new enum member fails the typecheck here (via the exhaustive label maps below).
+const FAMILIES = [
+  'claude',
+  'openai',
+  'gemini',
+  'llama',
+  'qwen',
+  'kimi',
+  'deepseek',
+  'glm',
+] as const satisfies readonly ModelFamily[]
+const REGIONS = ['usa', 'europe', 'china', 'other'] as const satisfies readonly AccountRegion[]
+const MODES = ['off', 'blocklist', 'allowlist'] as const satisfies readonly ModelPolicyMode[]
+const TRUSTED_PROVIDERS = ['bedrock'] as const
+
+// Exhaustive enum→key maps (drift guard): every member resolves to a static literal `t()`
+// key, so adding a family/region/mode without a label fails the typecheck on the Record.
+const familyLabels = computed<Record<ModelFamily, string>>(() => ({
+  claude: t('settings.modelPolicy.families.claude'),
+  openai: t('settings.modelPolicy.families.openai'),
+  gemini: t('settings.modelPolicy.families.gemini'),
+  llama: t('settings.modelPolicy.families.llama'),
+  qwen: t('settings.modelPolicy.families.qwen'),
+  kimi: t('settings.modelPolicy.families.kimi'),
+  deepseek: t('settings.modelPolicy.families.deepseek'),
+  glm: t('settings.modelPolicy.families.glm'),
+}))
+const regionLabels = computed<Record<AccountRegion, string>>(() => ({
+  usa: t('settings.modelPolicy.regions.usa'),
+  europe: t('settings.modelPolicy.regions.europe'),
+  china: t('settings.modelPolicy.regions.china'),
+  other: t('settings.modelPolicy.regions.other'),
+}))
+const modeLabels = computed<Record<ModelPolicyMode, string>>(() => ({
+  off: t('settings.modelPolicy.modes.off'),
+  blocklist: t('settings.modelPolicy.modes.blocklist'),
+  allowlist: t('settings.modelPolicy.modes.allowlist'),
+}))
+const providerLabels = computed<Record<(typeof TRUSTED_PROVIDERS)[number], string>>(() => ({
+  bedrock: t('settings.modelPolicy.providers.bedrock'),
+}))
+
+const modeItems = computed(() => MODES.map((m) => ({ label: modeLabels.value[m], value: m })))
+const regionItems = computed(() => REGIONS.map((r) => ({ label: regionLabels.value[r], value: r })))
+
+// Editable local state (hydrated from the stored policy).
+const mode = ref<ModelPolicyMode>('off')
+const region = ref<AccountRegion>('other')
+const families = ref<ModelFamily[]>([])
+const trusted = ref<string[]>([])
+const saving = ref(false)
+
+function hydrate() {
+  const p = store.view?.config?.modelPolicy
+  mode.value = p?.mode ?? 'off'
+  region.value = p?.region ?? 'other'
+  families.value = [...(p?.families ?? [])]
+  trusted.value = [...(p?.trustedProviders ?? [])]
+}
+
+// The presets offered for the currently-selected region.
+const regionPresets = computed(() =>
+  MODEL_FAMILY_POLICY_PRESETS.filter((preset) => preset.region === region.value),
+)
+
+function toggleFamily(fam: ModelFamily) {
+  families.value = families.value.includes(fam)
+    ? families.value.filter((x) => x !== fam)
+    : [...families.value, fam]
+}
+function toggleTrusted(provider: string) {
+  trusted.value = trusted.value.includes(provider)
+    ? trusted.value.filter((x) => x !== provider)
+    : [...trusted.value, provider]
+}
+
+function applyPreset(policy: ModelFamilyPolicy) {
+  mode.value = policy.mode
+  families.value = [...policy.families]
+  trusted.value = [...policy.trustedProviders]
+}
+
+onMounted(async () => {
+  // The sibling deployment-settings panel loads the store on mount too; guard against a
+  // double-load being unnecessary by only loading when the view isn't present yet.
+  if (!store.view && store.available !== false) {
+    try {
+      await store.load(props.accountId)
+    } catch {
+      // The deployment-settings panel surfaces the load error; stay quiet here.
+    }
+  }
+  hydrate()
+})
+watch(() => store.view, hydrate)
+
+async function save() {
+  const policy: ModelFamilyPolicy = {
+    mode: mode.value,
+    // Families are irrelevant when the policy is off; keep them so a later re-enable
+    // restores the admin's selection rather than silently emptying it.
+    families: families.value,
+    trustedProviders: trusted.value,
+    region: region.value,
+  }
+  saving.value = true
+  try {
+    // `config` fully replaces the stored non-secret config, so carry the rest forward.
+    await store.save(props.accountId, { config: { ...store.view?.config, modelPolicy: policy } })
+    toast.add({
+      title: t('settings.modelPolicy.saved'),
+      icon: 'i-lucide-check',
+      color: 'success',
+    })
+  } catch (e) {
+    toast.add({
+      title: t('settings.modelPolicy.saveFailed'),
+      description: e instanceof Error ? e.message : String(e),
+      color: 'error',
+    })
+  } finally {
+    saving.value = false
+  }
+}
+</script>
+
+<template>
+  <section
+    v-if="store.available !== false"
+    data-testid="account-model-policy"
+    class="space-y-3 border-t border-slate-800 pt-6"
+  >
+    <div>
+      <h4 class="text-sm font-semibold text-slate-200">{{ t('settings.modelPolicy.title') }}</h4>
+      <p class="text-[11px] text-slate-400">{{ t('settings.modelPolicy.description') }}</p>
+    </div>
+
+    <!-- Region + apply-preset templates -->
+    <div class="space-y-2">
+      <label class="text-[11px] font-medium text-slate-300">
+        {{ t('settings.modelPolicy.regionLabel') }}
+      </label>
+      <div class="grid grid-cols-1 gap-2 sm:grid-cols-2">
+        <USelect v-model="region" :items="regionItems" value-key="value" size="sm" />
+      </div>
+      <div v-if="regionPresets.length" class="flex flex-wrap items-center gap-2">
+        <span class="text-[11px] text-slate-400">{{ t('settings.modelPolicy.applyPreset') }}</span>
+        <UButton
+          v-for="preset in regionPresets"
+          :key="preset.id"
+          color="neutral"
+          variant="subtle"
+          size="xs"
+          icon="i-lucide-wand-2"
+          :title="t(`settings.modelPolicy.presets.${preset.id}.description`)"
+          @click="applyPreset(preset.policy)"
+        >
+          {{ t(`settings.modelPolicy.presets.${preset.id}.label`) }}
+        </UButton>
+      </div>
+    </div>
+
+    <!-- Mode -->
+    <div class="space-y-2">
+      <label class="text-[11px] font-medium text-slate-300">
+        {{ t('settings.modelPolicy.modeLabel') }}
+      </label>
+      <div class="grid grid-cols-1 gap-2 sm:grid-cols-2">
+        <USelect v-model="mode" :items="modeItems" value-key="value" size="sm" />
+      </div>
+    </div>
+
+    <!-- Families -->
+    <div v-if="mode !== 'off'" class="space-y-2">
+      <label class="text-[11px] font-medium text-slate-300">
+        {{
+          mode === 'blocklist'
+            ? t('settings.modelPolicy.familiesBlockLabel')
+            : t('settings.modelPolicy.familiesAllowLabel')
+        }}
+      </label>
+      <div class="grid grid-cols-2 gap-1 sm:grid-cols-4">
+        <UCheckbox
+          v-for="fam in FAMILIES"
+          :key="fam"
+          :model-value="families.includes(fam)"
+          :label="familyLabels[fam]"
+          size="sm"
+          @update:model-value="toggleFamily(fam)"
+        />
+      </div>
+    </div>
+
+    <!-- Trusted (residency-guaranteed) routes -->
+    <div v-if="mode !== 'off'" class="space-y-2">
+      <label class="text-[11px] font-medium text-slate-300">
+        {{ t('settings.modelPolicy.trustedLabel') }}
+      </label>
+      <p class="text-[11px] text-slate-400">{{ t('settings.modelPolicy.trustedHint') }}</p>
+      <div class="grid grid-cols-2 gap-1 sm:grid-cols-4">
+        <UCheckbox
+          v-for="provider in TRUSTED_PROVIDERS"
+          :key="provider"
+          :model-value="trusted.includes(provider)"
+          :label="providerLabels[provider]"
+          size="sm"
+          @update:model-value="toggleTrusted(provider)"
+        />
+      </div>
+    </div>
+
+    <div class="flex gap-2">
+      <UButton
+        color="primary"
+        size="xs"
+        icon="i-lucide-save"
+        :loading="saving"
+        data-testid="account-model-policy-save"
+        @click="save"
+      >
+        {{ t('common.save') }}
+      </UButton>
+    </div>
+  </section>
+</template>

package/app/components/layout/AccountTeamSettings.vue

@@ -4,6 +4,7 @@ import { apiErrorEnvelope } from '~/composables/api/errors'
 import type { AccountRole } from '~/types/domain'
 import type { InvitationStatus } from '@cat-factory/contracts'
 import AccountDeploymentSettings from '~/components/layout/AccountDeploymentSettings.vue'
+import AccountModelPolicySettings from '~/components/layout/AccountModelPolicySettings.vue'
 import SecretInput from '~/components/common/SecretInput.vue'
 
 // Team settings for an org account: the member roster (with combinable admin /
@@ -13,11 +14,16 @@ import SecretInput from '~/components/common/SecretInput.vue'
 const props = defineProps<{ accountId: string }>()
 
 const accounts = useAccountsStore()
+const auth = useAuthStore()
 const toast = useToast()
 const { t, te } = useI18n()
 const { confirmAction, toastDone } = useConfirmAction()
 const busy = ref(false)
 
+// The account-wide model-family policy is a hosted / mothership-only control (the backend
+// reports `false` in plain local mode, where there is no account admin to govern).
+const modelPolicySupported = computed(() => auth.infrastructure?.modelPolicy?.supported ?? false)
+
 const ROLE_ITEMS = computed<{ label: string; value: AccountRole }[]>(() => [
   { label: t('layout.accountTeam.roles.admin'), value: 'admin' },
   { label: t('layout.accountTeam.roles.developer'), value: 'developer' },
@@ -326,5 +332,10 @@ async function disconnectEmail() {
     <section v-if="isAdmin">
       <AccountDeploymentSettings :account-id="accountId" />
     </section>
+
+    <!-- account-wide model-family allow/block policy (admin-only; hosted/mothership only) -->
+    <section v-if="isAdmin && modelPolicySupported">
+      <AccountModelPolicySettings :account-id="accountId" />
+    </section>
   </div>
 </template>

package/app/composables/usePipelineErrorToast.ts

@@ -48,6 +48,8 @@ const CONFLICT_TITLE_KEYS: Record<
   provision_type_unhandled: 'errors.conflict.title.provision_type_unhandled',
   preset_unsatisfiable: 'errors.conflict.title.preset_unsatisfiable',
   visual_pipeline_no_frontend: 'errors.conflict.title.visual_pipeline_no_frontend',
+  model_policy_blocked: 'errors.conflict.title.model_policy_blocked',
+  model_policy_unsupported: 'errors.conflict.title.model_policy_unsupported',
   deployer_required_before_tester: 'errors.conflict.title.deployer_required_before_tester',
 }
 

package/app/stores/auth.ts

@@ -1,4 +1,8 @@
-import type { InfrastructureCapabilities, LocalModeConfig } from '@cat-factory/contracts'
+import type {
+  BackendMisconfigured,
+  InfrastructureCapabilities,
+  LocalModeConfig,
+} from '@cat-factory/contracts'
 import { defineStore } from 'pinia'
 import { computed, ref } from 'vue'
 import type { AuthUser } from '~/types/domain'
@@ -60,6 +64,14 @@ export const useAuthStore = defineStore(
     const autoLoginProvider = ref<'github' | 'gitlab' | null>(null)
     /** True once the initial auth handshake has settled. */
     const ready = ref(false)
+    /**
+     * Set when the backend answered its boot handshake but reported that it is MISCONFIGURED — it
+     * failed to start normally because a mandatory env var / binding is missing, and is serving the
+     * fallback backend that lists the problems (each carries only a name + meaning + remedy, never a
+     * secret). Present ⇒ the SPA renders the dedicated misconfiguration screen instead of the
+     * login/board. Null on a normally-booted backend.
+     */
+    const misconfigured = ref<BackendMisconfigured | null>(null)
     /**
      * Mothership mode: the last mothership sign-in failure (node unreachable / rejected session),
      * or null. Set when the post-OAuth connect exchange fails, so the login screen can tell the
@@ -84,6 +96,9 @@ export const useAuthStore = defineStore(
     /** May the app render? True when auth is off, or on with a known user. */
     const isAuthenticated = computed(() => !required.value || user.value !== null)
 
+    /** Whether the backend reported itself misconfigured (drives the dedicated error screen). */
+    const isMisconfigured = computed(() => misconfigured.value !== null)
+
     /**
      * Whether the SPA must show the login screen before the board.
      *
@@ -176,7 +191,14 @@ export const useAuthStore = defineStore(
         testingNoAuth.value = config.testingNoAuth ?? false
         localMode.value = config.localMode ?? null
         infrastructure.value = config.infrastructure ?? null
+        misconfigured.value = config.misconfigured ?? null
         configLoaded.value = true
+        // A misconfigured backend serves only the fallback app; there's no session/board to
+        // resolve, so settle here and let the SPA render the misconfiguration screen.
+        if (misconfigured.value) {
+          ready.value = true
+          return
+        }
       } catch {
         // Backend unreachable — let the board's own error UI handle it (configLoaded stays
         // false, so we never mistake this for an unauthenticated session and gate it).
@@ -335,8 +357,10 @@ export const useAuthStore = defineStore(
       ready,
       mothershipError,
       configLoaded,
+      misconfigured,
       isLocalFacade,
       isAuthenticated,
+      isMisconfigured,
       needsLogin,
       bootstrap,
       login,

package/app/types/accountSettings.ts

@@ -15,4 +15,9 @@ export type {
   ContentStorageConfig,
   ContentStorageSummary,
   ContentStorageCapability,
+  // Account-wide model-family allow/block policy.
+  ModelFamily,
+  ModelFamilyPolicy,
+  ModelPolicyMode,
+  AccountRegion,
 } from '@cat-factory/contracts'

package/i18n/locales/de.json

@@ -745,6 +745,65 @@
         "title": "Diesen Runner entfernen?",
         "body": "\"{name}\" wird entfernt. Dies kann nicht rückgängig gemacht werden."
       }
+    },
+    "modelPolicy": {
+      "title": "Modellzugriffsrichtlinie",
+      "description": "Beschränkt, welche Modellfamilien die Teams dieses Kontos ausführen dürfen. Das Datenresidenz-Risiko hängt von der Bereitstellungsroute ab, daher kann eine vertrauenswürdige (residenzgarantierte) Route eine andernfalls blockierte Familie freigeben.",
+      "regionLabel": "Betriebsregion",
+      "applyPreset": "Vorlage anwenden:",
+      "modeLabel": "Richtlinienmodus",
+      "modes": {
+        "off": "Keine Einschränkung",
+        "blocklist": "Aufgeführte Familien blockieren",
+        "allowlist": "Nur aufgeführte Familien zulassen"
+      },
+      "familiesBlockLabel": "Blockierte Familien",
+      "familiesAllowLabel": "Zugelassene Familien",
+      "trustedLabel": "Vertrauenswürdige (residenzgarantierte) Routen",
+      "trustedHint": "Eine blockierte Familie bleibt verfügbar, wenn sie über eine dieser Routen bereitgestellt wird.",
+      "families": {
+        "claude": "Claude (Anthropic)",
+        "openai": "OpenAI / ChatGPT",
+        "gemini": "Gemini (Google)",
+        "llama": "Llama (Meta)",
+        "qwen": "Qwen (Alibaba)",
+        "kimi": "Kimi (Moonshot)",
+        "deepseek": "DeepSeek",
+        "glm": "GLM (Z.ai)"
+      },
+      "regions": {
+        "usa": "Vereinigte Staaten",
+        "europe": "Europa",
+        "china": "China",
+        "other": "Andere"
+      },
+      "providers": {
+        "bedrock": "AWS Bedrock"
+      },
+      "presets": {
+        "us-block-cn": {
+          "label": "In China gehostete Familien blockieren",
+          "description": "Blockiert DeepSeek, Qwen, Kimi und GLM; erlaubt sie nur über eine residenzgarantierte Route (z. B. Bedrock)."
+        },
+        "eu-block-cn": {
+          "label": "EU: in China gehostete Familien blockieren",
+          "description": "Blockiert DeepSeek, Qwen, Kimi und GLM; eine residenzgarantierte EU-Route (z. B. Bedrock) bleibt zulässig."
+        },
+        "eu-guaranteed-only": {
+          "label": "EU: nur residenzgarantierte Routen",
+          "description": "Erlaubt ein Modell nur, wenn es über eine residenzgarantierte Route bereitgestellt wird."
+        },
+        "cn-prefer-domestic": {
+          "label": "In China gehostete Familien bevorzugen",
+          "description": "Erlaubt in China gehostete Familien (plus Llama) und jede residenzgarantierte Route."
+        },
+        "other-block-cn": {
+          "label": "In China gehostete Familien blockieren",
+          "description": "Blockiert DeepSeek, Qwen, Kimi und GLM; erlaubt sie nur über eine residenzgarantierte Route."
+        }
+      },
+      "saved": "Modellzugriffsrichtlinie gespeichert",
+      "saveFailed": "Modellzugriffsrichtlinie konnte nicht gespeichert werden"
     }
   },
   "inspector": {
@@ -3493,7 +3552,14 @@
     "loadingBoard": "Board wird geladen…",
     "backendUnreachable": "Backend nicht erreichbar",
     "reconnecting": "Verbindung wird wiederhergestellt…",
-    "offline": "Keine Live-Updates"
+    "offline": "Keine Live-Updates",
+    "misconfigured": {
+      "title": "Backend nicht konfiguriert",
+      "intro": "Der Server wurde gestartet, kann aber erst laufen, wenn die folgenden Einstellungen vorhanden sind. Ergänze die fehlenden Werte in deiner Umgebung und lade neu.",
+      "howToFix": "So behebst du es:",
+      "reload": "Neu laden",
+      "hint": "Hier werden nur Variablennamen und deren Einrichtung angezeigt, niemals geheime Werte."
+    }
   },
   "language": {
     "switcher": "Sprache",
@@ -3591,6 +3657,8 @@
         "provision_type_unhandled": "Kein Handler für diesen Bereitstellungstyp",
         "preset_unsatisfiable": "Modell-Preset kann diese Pipeline nicht ausführen",
         "visual_pipeline_no_frontend": "Kein Frontend zum Testen",
+        "model_policy_blocked": "Modell durch Kontorichtlinie blockiert",
+        "model_policy_unsupported": "Modellrichtlinie hier nicht verfügbar",
         "deployer_required_before_tester": "Füge einen Deployer vor dem Tester hinzu"
       },
       "fallbackMessage": "Diese Aktion steht im Konflikt mit dem aktuellen Zustand.",

package/i18n/locales/en.json

@@ -4,7 +4,14 @@
     "loadingBoard": "Loading board…",
     "backendUnreachable": "Can't reach the backend",
     "reconnecting": "Reconnecting…",
-    "offline": "Not receiving live updates"
+    "offline": "Not receiving live updates",
+    "misconfigured": {
+      "title": "Backend not configured",
+      "intro": "The server started but can't run until the settings below are provided. Add the missing values to your environment, then reload.",
+      "howToFix": "How to fix:",
+      "reload": "Reload",
+      "hint": "Only variable names and how to set them are shown here, never any secret values."
+    }
   },
   "language": {
     "switcher": "Language",
@@ -439,6 +446,8 @@
         "provision_type_unhandled": "No handler for this provision type",
         "preset_unsatisfiable": "Model preset can't run this pipeline",
         "visual_pipeline_no_frontend": "No frontend to test",
+        "model_policy_blocked": "Model blocked by account policy",
+        "model_policy_unsupported": "Model policy not available here",
         "deployer_required_before_tester": "Add a Deployer before the Tester"
       },
       "fallbackMessage": "This action conflicts with the current state.",
@@ -2442,6 +2451,65 @@
         "title": "Remove this runner?",
         "body": "\"{name}\" will be removed. This can't be undone."
       }
+    },
+    "modelPolicy": {
+      "title": "Model access policy",
+      "description": "Restrict which model families this account’s teams can run. Data-residency risk depends on the serving route, so a trusted (residency-guaranteed) route can exempt an otherwise-blocked family.",
+      "regionLabel": "Operating region",
+      "applyPreset": "Apply preset:",
+      "modeLabel": "Policy mode",
+      "modes": {
+        "off": "No restriction",
+        "blocklist": "Block listed families",
+        "allowlist": "Allow only listed families"
+      },
+      "familiesBlockLabel": "Blocked families",
+      "familiesAllowLabel": "Allowed families",
+      "trustedLabel": "Trusted (residency-guaranteed) routes",
+      "trustedHint": "A blocked family stays available when it is served over one of these routes.",
+      "families": {
+        "claude": "Claude (Anthropic)",
+        "openai": "OpenAI / ChatGPT",
+        "gemini": "Gemini (Google)",
+        "llama": "Llama (Meta)",
+        "qwen": "Qwen (Alibaba)",
+        "kimi": "Kimi (Moonshot)",
+        "deepseek": "DeepSeek",
+        "glm": "GLM (Z.ai)"
+      },
+      "regions": {
+        "usa": "United States",
+        "europe": "Europe",
+        "china": "China",
+        "other": "Other"
+      },
+      "providers": {
+        "bedrock": "AWS Bedrock"
+      },
+      "presets": {
+        "us-block-cn": {
+          "label": "Block China-hosted families",
+          "description": "Block DeepSeek, Qwen, Kimi and GLM; allow them only over a residency-guaranteed route (e.g. Bedrock)."
+        },
+        "eu-block-cn": {
+          "label": "EU: block China-hosted families",
+          "description": "Block DeepSeek, Qwen, Kimi and GLM; a residency-guaranteed EU route (e.g. Bedrock) stays allowed."
+        },
+        "eu-guaranteed-only": {
+          "label": "EU: residency-guaranteed routes only",
+          "description": "Allow a model only when it is served over a residency-guaranteed route."
+        },
+        "cn-prefer-domestic": {
+          "label": "Prefer China-hosted families",
+          "description": "Allow China-hosted families (plus Llama) and any residency-guaranteed route."
+        },
+        "other-block-cn": {
+          "label": "Block China-hosted families",
+          "description": "Block DeepSeek, Qwen, Kimi and GLM; allow them only over a residency-guaranteed route."
+        }
+      },
+      "saved": "Model access policy saved",
+      "saveFailed": "Could not save the model access policy"
     }
   },
   "providers": {