@kya-os/cli 2.0.0 → 2.0.2

package/node_modules/@kya-os/contracts/dist/policy/schemas.d.ts

@@ -0,0 +1,3839 @@
+/**
+ * Policy Configuration Schemas
+ *
+ * Zod schemas for agent detection policy configuration.
+ * These schemas define how MCP-I servers and AgentShield enforce
+ * access control based on detected agent characteristics.
+ *
+ * @module @kya-os/contracts/policy
+ */
+import { z } from 'zod';
+/**
+ * Available enforcement actions
+ *
+ * - `allow` - Allow the request to proceed
+ * - `block` - Block the request (return 403)
+ * - `redirect` - Redirect to a configured URL
+ * - `challenge` - Present a challenge (CAPTCHA, proof-of-work, etc.)
+ * - `log` - Allow but log for monitoring
+ */
+export declare const EnforcementActionSchema: z.ZodEnum<["allow", "block", "redirect", "challenge", "log"]>;
+export type EnforcementAction = z.infer<typeof EnforcementActionSchema>;
+/**
+ * Threshold-based enforcement settings
+ *
+ * These thresholds determine automatic enforcement based on
+ * detection confidence and reputation scores.
+ */
+export declare const ThresholdConfigSchema: z.ZodObject<{
+    /**
+     * Detection confidence threshold (0-100)
+     * Agents detected with confidence >= this value trigger the configured action
+     * @default 80
+     */
+    confidenceThreshold: z.ZodDefault<z.ZodNumber>;
+    /**
+     * Action to take when confidence threshold is exceeded
+     * @default 'block'
+     */
+    confidenceAction: z.ZodDefault<z.ZodEnum<["allow", "block", "redirect", "challenge", "log"]>>;
+    /**
+     * Minimum reputation score (0-100) required to allow access
+     * Agents with reputation < this value may be blocked/challenged
+     * Set to 0 to disable reputation-based enforcement
+     * @default 0
+     */
+    minReputationScore: z.ZodDefault<z.ZodNumber>;
+    /**
+     * Action to take when reputation is below threshold
+     * @default 'challenge'
+     */
+    lowReputationAction: z.ZodDefault<z.ZodEnum<["allow", "block", "redirect", "challenge", "log"]>>;
+    /**
+     * High reputation score threshold (0-100)
+     * Agents with reputation >= this value are trusted and bypass other checks
+     * @default 90
+     */
+    trustedReputationThreshold: z.ZodDefault<z.ZodNumber>;
+    /**
+     * Whether cryptographically signed requests (MCP-I verified) bypass thresholds
+     * @default true
+     */
+    trustSignedRequests: z.ZodDefault<z.ZodBoolean>;
+}, "strip", z.ZodTypeAny, {
+    confidenceThreshold: number;
+    confidenceAction: "challenge" | "allow" | "block" | "redirect" | "log";
+    minReputationScore: number;
+    lowReputationAction: "challenge" | "allow" | "block" | "redirect" | "log";
+    trustedReputationThreshold: number;
+    trustSignedRequests: boolean;
+}, {
+    confidenceThreshold?: number | undefined;
+    confidenceAction?: "challenge" | "allow" | "block" | "redirect" | "log" | undefined;
+    minReputationScore?: number | undefined;
+    lowReputationAction?: "challenge" | "allow" | "block" | "redirect" | "log" | undefined;
+    trustedReputationThreshold?: number | undefined;
+    trustSignedRequests?: boolean | undefined;
+}>;
+export type ThresholdConfig = z.infer<typeof ThresholdConfigSchema>;
+/**
+ * Entry in the deny list for blocking specific agents
+ *
+ * At least one identifier must be provided: clientDid, agentDid, or clientName
+ */
+export declare const DenyListEntrySchema: z.ZodEffects<z.ZodObject<{
+    /** MCP-I client DID (e.g., "did:key:z6Mk...") */
+    clientDid: z.ZodOptional<z.ZodString>;
+    /** Agent DID from MCP-I identity */
+    agentDid: z.ZodOptional<z.ZodString>;
+    /** Human-readable client name (e.g., "Perplexity", "ChatGPT") */
+    clientName: z.ZodOptional<z.ZodString>;
+    /** Agent type to block (e.g., "ai_agent", "bot", "scraper") */
+    agentType: z.ZodOptional<z.ZodString>;
+    /** Reason for denial (shown to user/logged) */
+    reason: z.ZodOptional<z.ZodString>;
+    /** ISO 8601 timestamp when entry was added */
+    blockedAt: z.ZodOptional<z.ZodString>;
+    /** Who added this entry (user ID or "system") */
+    addedBy: z.ZodOptional<z.ZodString>;
+    /** Whether this entry is currently active */
+    active: z.ZodDefault<z.ZodBoolean>;
+    /** Optional expiration date for temporary blocks */
+    expiresAt: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    active: boolean;
+    agentDid?: string | undefined;
+    clientDid?: string | undefined;
+    expiresAt?: string | undefined;
+    reason?: string | undefined;
+    clientName?: string | undefined;
+    agentType?: string | undefined;
+    blockedAt?: string | undefined;
+    addedBy?: string | undefined;
+}, {
+    agentDid?: string | undefined;
+    clientDid?: string | undefined;
+    expiresAt?: string | undefined;
+    reason?: string | undefined;
+    active?: boolean | undefined;
+    clientName?: string | undefined;
+    agentType?: string | undefined;
+    blockedAt?: string | undefined;
+    addedBy?: string | undefined;
+}>, {
+    active: boolean;
+    agentDid?: string | undefined;
+    clientDid?: string | undefined;
+    expiresAt?: string | undefined;
+    reason?: string | undefined;
+    clientName?: string | undefined;
+    agentType?: string | undefined;
+    blockedAt?: string | undefined;
+    addedBy?: string | undefined;
+}, {
+    agentDid?: string | undefined;
+    clientDid?: string | undefined;
+    expiresAt?: string | undefined;
+    reason?: string | undefined;
+    active?: boolean | undefined;
+    clientName?: string | undefined;
+    agentType?: string | undefined;
+    blockedAt?: string | undefined;
+    addedBy?: string | undefined;
+}>;
+export type DenyListEntry = z.infer<typeof DenyListEntrySchema>;
+/**
+ * Entry in the allow list for exempting specific agents from all checks
+ *
+ * At least one identifier must be provided: clientDid, agentDid, clientName, or agentType
+ */
+export declare const AllowListEntrySchema: z.ZodEffects<z.ZodObject<{
+    /** MCP-I client DID (e.g., "did:key:z6Mk...") */
+    clientDid: z.ZodOptional<z.ZodString>;
+    /** Agent DID from MCP-I identity */
+    agentDid: z.ZodOptional<z.ZodString>;
+    /** Human-readable client name (e.g., "Perplexity", "ChatGPT") */
+    clientName: z.ZodOptional<z.ZodString>;
+    /** Agent type to allow (e.g., "ai_agent", "verified_bot") */
+    agentType: z.ZodOptional<z.ZodString>;
+    /** Reason for allowing (documentation) */
+    reason: z.ZodOptional<z.ZodString>;
+    /** ISO 8601 timestamp when entry was added */
+    addedAt: z.ZodOptional<z.ZodString>;
+    /** Who added this entry */
+    addedBy: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    agentDid?: string | undefined;
+    clientDid?: string | undefined;
+    reason?: string | undefined;
+    clientName?: string | undefined;
+    agentType?: string | undefined;
+    addedBy?: string | undefined;
+    addedAt?: string | undefined;
+}, {
+    agentDid?: string | undefined;
+    clientDid?: string | undefined;
+    reason?: string | undefined;
+    clientName?: string | undefined;
+    agentType?: string | undefined;
+    addedBy?: string | undefined;
+    addedAt?: string | undefined;
+}>, {
+    agentDid?: string | undefined;
+    clientDid?: string | undefined;
+    reason?: string | undefined;
+    clientName?: string | undefined;
+    agentType?: string | undefined;
+    addedBy?: string | undefined;
+    addedAt?: string | undefined;
+}, {
+    agentDid?: string | undefined;
+    clientDid?: string | undefined;
+    reason?: string | undefined;
+    clientName?: string | undefined;
+    agentType?: string | undefined;
+    addedBy?: string | undefined;
+    addedAt?: string | undefined;
+}>;
+export type AllowListEntry = z.infer<typeof AllowListEntrySchema>;
+/**
+ * Condition for matching requests in a policy rule
+ */
+export declare const PolicyConditionSchema: z.ZodObject<{
+    /** Field to match against */
+    field: z.ZodEnum<["agentType", "agentName", "agentVendor", "clientDid", "agentDid", "confidence", "reputationScore", "riskLevel", "path", "method", "origin", "userAgent", "signatureVerified", "isAuthenticated", "hasValidDelegation"]>;
+    /** Comparison operator */
+    operator: z.ZodEnum<["equals", "notEquals", "contains", "notContains", "startsWith", "endsWith", "greaterThan", "lessThan", "greaterThanOrEquals", "lessThanOrEquals", "matches", "in", "notIn"]>;
+    /** Value to compare against */
+    value: z.ZodUnion<[z.ZodString, z.ZodNumber, z.ZodBoolean, z.ZodArray<z.ZodString, "many">]>;
+    /** Whether this condition is case-insensitive (for string comparisons) */
+    caseInsensitive: z.ZodOptional<z.ZodBoolean>;
+}, "strip", z.ZodTypeAny, {
+    value: string | number | boolean | string[];
+    field: "path" | "agentDid" | "clientDid" | "method" | "confidence" | "agentType" | "agentName" | "agentVendor" | "reputationScore" | "riskLevel" | "origin" | "userAgent" | "signatureVerified" | "isAuthenticated" | "hasValidDelegation";
+    operator: "equals" | "notEquals" | "contains" | "notContains" | "startsWith" | "endsWith" | "greaterThan" | "lessThan" | "greaterThanOrEquals" | "lessThanOrEquals" | "matches" | "in" | "notIn";
+    caseInsensitive?: boolean | undefined;
+}, {
+    value: string | number | boolean | string[];
+    field: "path" | "agentDid" | "clientDid" | "method" | "confidence" | "agentType" | "agentName" | "agentVendor" | "reputationScore" | "riskLevel" | "origin" | "userAgent" | "signatureVerified" | "isAuthenticated" | "hasValidDelegation";
+    operator: "equals" | "notEquals" | "contains" | "notContains" | "startsWith" | "endsWith" | "greaterThan" | "lessThan" | "greaterThanOrEquals" | "lessThanOrEquals" | "matches" | "in" | "notIn";
+    caseInsensitive?: boolean | undefined;
+}>;
+export type PolicyCondition = z.infer<typeof PolicyConditionSchema>;
+/**
+ * A single policy rule that maps conditions to an action
+ */
+export declare const PolicyRuleSchema: z.ZodEffects<z.ZodObject<{
+    /** Unique identifier for this rule */
+    id: z.ZodString;
+    /** Human-readable name */
+    name: z.ZodString;
+    /** Description of what this rule does */
+    description: z.ZodOptional<z.ZodString>;
+    /** Priority (lower = higher priority, evaluated first) */
+    priority: z.ZodDefault<z.ZodNumber>;
+    /**
+     * Conditions that must ALL match for this rule to apply (AND logic)
+     * For OR logic, create multiple rules with same action
+     */
+    conditions: z.ZodArray<z.ZodObject<{
+        /** Field to match against */
+        field: z.ZodEnum<["agentType", "agentName", "agentVendor", "clientDid", "agentDid", "confidence", "reputationScore", "riskLevel", "path", "method", "origin", "userAgent", "signatureVerified", "isAuthenticated", "hasValidDelegation"]>;
+        /** Comparison operator */
+        operator: z.ZodEnum<["equals", "notEquals", "contains", "notContains", "startsWith", "endsWith", "greaterThan", "lessThan", "greaterThanOrEquals", "lessThanOrEquals", "matches", "in", "notIn"]>;
+        /** Value to compare against */
+        value: z.ZodUnion<[z.ZodString, z.ZodNumber, z.ZodBoolean, z.ZodArray<z.ZodString, "many">]>;
+        /** Whether this condition is case-insensitive (for string comparisons) */
+        caseInsensitive: z.ZodOptional<z.ZodBoolean>;
+    }, "strip", z.ZodTypeAny, {
+        value: string | number | boolean | string[];
+        field: "path" | "agentDid" | "clientDid" | "method" | "confidence" | "agentType" | "agentName" | "agentVendor" | "reputationScore" | "riskLevel" | "origin" | "userAgent" | "signatureVerified" | "isAuthenticated" | "hasValidDelegation";
+        operator: "equals" | "notEquals" | "contains" | "notContains" | "startsWith" | "endsWith" | "greaterThan" | "lessThan" | "greaterThanOrEquals" | "lessThanOrEquals" | "matches" | "in" | "notIn";
+        caseInsensitive?: boolean | undefined;
+    }, {
+        value: string | number | boolean | string[];
+        field: "path" | "agentDid" | "clientDid" | "method" | "confidence" | "agentType" | "agentName" | "agentVendor" | "reputationScore" | "riskLevel" | "origin" | "userAgent" | "signatureVerified" | "isAuthenticated" | "hasValidDelegation";
+        operator: "equals" | "notEquals" | "contains" | "notContains" | "startsWith" | "endsWith" | "greaterThan" | "lessThan" | "greaterThanOrEquals" | "lessThanOrEquals" | "matches" | "in" | "notIn";
+        caseInsensitive?: boolean | undefined;
+    }>, "many">;
+    /** Action to take when conditions match */
+    action: z.ZodEnum<["allow", "block", "redirect", "challenge", "log"]>;
+    /** Redirect URL (required if action is 'redirect') */
+    redirectUrl: z.ZodOptional<z.ZodString>;
+    /** Custom message to show/log */
+    message: z.ZodOptional<z.ZodString>;
+    /** Whether this rule is currently active */
+    enabled: z.ZodDefault<z.ZodBoolean>;
+    /** Metadata for auditing */
+    metadata: z.ZodOptional<z.ZodObject<{
+        createdAt: z.ZodOptional<z.ZodString>;
+        updatedAt: z.ZodOptional<z.ZodString>;
+        createdBy: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        createdAt?: string | undefined;
+        updatedAt?: string | undefined;
+        createdBy?: string | undefined;
+    }, {
+        createdAt?: string | undefined;
+        updatedAt?: string | undefined;
+        createdBy?: string | undefined;
+    }>>;
+}, "strip", z.ZodTypeAny, {
+    name: string;
+    id: string;
+    enabled: boolean;
+    action: "challenge" | "allow" | "block" | "redirect" | "log";
+    priority: number;
+    conditions: {
+        value: string | number | boolean | string[];
+        field: "path" | "agentDid" | "clientDid" | "method" | "confidence" | "agentType" | "agentName" | "agentVendor" | "reputationScore" | "riskLevel" | "origin" | "userAgent" | "signatureVerified" | "isAuthenticated" | "hasValidDelegation";
+        operator: "equals" | "notEquals" | "contains" | "notContains" | "startsWith" | "endsWith" | "greaterThan" | "lessThan" | "greaterThanOrEquals" | "lessThanOrEquals" | "matches" | "in" | "notIn";
+        caseInsensitive?: boolean | undefined;
+    }[];
+    message?: string | undefined;
+    metadata?: {
+        createdAt?: string | undefined;
+        updatedAt?: string | undefined;
+        createdBy?: string | undefined;
+    } | undefined;
+    description?: string | undefined;
+    redirectUrl?: string | undefined;
+}, {
+    name: string;
+    id: string;
+    action: "challenge" | "allow" | "block" | "redirect" | "log";
+    conditions: {
+        value: string | number | boolean | string[];
+        field: "path" | "agentDid" | "clientDid" | "method" | "confidence" | "agentType" | "agentName" | "agentVendor" | "reputationScore" | "riskLevel" | "origin" | "userAgent" | "signatureVerified" | "isAuthenticated" | "hasValidDelegation";
+        operator: "equals" | "notEquals" | "contains" | "notContains" | "startsWith" | "endsWith" | "greaterThan" | "lessThan" | "greaterThanOrEquals" | "lessThanOrEquals" | "matches" | "in" | "notIn";
+        caseInsensitive?: boolean | undefined;
+    }[];
+    message?: string | undefined;
+    metadata?: {
+        createdAt?: string | undefined;
+        updatedAt?: string | undefined;
+        createdBy?: string | undefined;
+    } | undefined;
+    enabled?: boolean | undefined;
+    description?: string | undefined;
+    priority?: number | undefined;
+    redirectUrl?: string | undefined;
+}>, {
+    name: string;
+    id: string;
+    enabled: boolean;
+    action: "challenge" | "allow" | "block" | "redirect" | "log";
+    priority: number;
+    conditions: {
+        value: string | number | boolean | string[];
+        field: "path" | "agentDid" | "clientDid" | "method" | "confidence" | "agentType" | "agentName" | "agentVendor" | "reputationScore" | "riskLevel" | "origin" | "userAgent" | "signatureVerified" | "isAuthenticated" | "hasValidDelegation";
+        operator: "equals" | "notEquals" | "contains" | "notContains" | "startsWith" | "endsWith" | "greaterThan" | "lessThan" | "greaterThanOrEquals" | "lessThanOrEquals" | "matches" | "in" | "notIn";
+        caseInsensitive?: boolean | undefined;
+    }[];
+    message?: string | undefined;
+    metadata?: {
+        createdAt?: string | undefined;
+        updatedAt?: string | undefined;
+        createdBy?: string | undefined;
+    } | undefined;
+    description?: string | undefined;
+    redirectUrl?: string | undefined;
+}, {
+    name: string;
+    id: string;
+    action: "challenge" | "allow" | "block" | "redirect" | "log";
+    conditions: {
+        value: string | number | boolean | string[];
+        field: "path" | "agentDid" | "clientDid" | "method" | "confidence" | "agentType" | "agentName" | "agentVendor" | "reputationScore" | "riskLevel" | "origin" | "userAgent" | "signatureVerified" | "isAuthenticated" | "hasValidDelegation";
+        operator: "equals" | "notEquals" | "contains" | "notContains" | "startsWith" | "endsWith" | "greaterThan" | "lessThan" | "greaterThanOrEquals" | "lessThanOrEquals" | "matches" | "in" | "notIn";
+        caseInsensitive?: boolean | undefined;
+    }[];
+    message?: string | undefined;
+    metadata?: {
+        createdAt?: string | undefined;
+        updatedAt?: string | undefined;
+        createdBy?: string | undefined;
+    } | undefined;
+    enabled?: boolean | undefined;
+    description?: string | undefined;
+    priority?: number | undefined;
+    redirectUrl?: string | undefined;
+}>;
+export type PolicyRule = z.infer<typeof PolicyRuleSchema>;
+/**
+ * Complete policy configuration for a project
+ *
+ * Policy evaluation order:
+ * 1. Allow list (exempt agents, always allowed)
+ * 2. Deny list (blocked agents, always blocked)
+ * 3. Threshold checks (confidence, reputation)
+ * 4. Custom rules (evaluated by priority, first match wins)
+ * 5. Default action (if no rules match)
+ */
+export declare const PolicyConfigSchema: z.ZodEffects<z.ZodObject<{
+    /** Schema version for migrations */
+    version: z.ZodDefault<z.ZodString>;
+    /** Whether policy enforcement is enabled */
+    enabled: z.ZodDefault<z.ZodBoolean>;
+    /** Default action when no rules match */
+    defaultAction: z.ZodDefault<z.ZodEnum<["allow", "block", "redirect", "challenge", "log"]>>;
+    /** Default redirect URL for redirect actions */
+    redirectUrl: z.ZodOptional<z.ZodString>;
+    /** Threshold-based enforcement settings */
+    thresholds: z.ZodDefault<z.ZodObject<{
+        /**
+         * Detection confidence threshold (0-100)
+         * Agents detected with confidence >= this value trigger the configured action
+         * @default 80
+         */
+        confidenceThreshold: z.ZodDefault<z.ZodNumber>;
+        /**
+         * Action to take when confidence threshold is exceeded
+         * @default 'block'
+         */
+        confidenceAction: z.ZodDefault<z.ZodEnum<["allow", "block", "redirect", "challenge", "log"]>>;
+        /**
+         * Minimum reputation score (0-100) required to allow access
+         * Agents with reputation < this value may be blocked/challenged
+         * Set to 0 to disable reputation-based enforcement
+         * @default 0
+         */
+        minReputationScore: z.ZodDefault<z.ZodNumber>;
+        /**
+         * Action to take when reputation is below threshold
+         * @default 'challenge'
+         */
+        lowReputationAction: z.ZodDefault<z.ZodEnum<["allow", "block", "redirect", "challenge", "log"]>>;
+        /**
+         * High reputation score threshold (0-100)
+         * Agents with reputation >= this value are trusted and bypass other checks
+         * @default 90
+         */
+        trustedReputationThreshold: z.ZodDefault<z.ZodNumber>;
+        /**
+         * Whether cryptographically signed requests (MCP-I verified) bypass thresholds
+         * @default true
+         */
+        trustSignedRequests: z.ZodDefault<z.ZodBoolean>;
+    }, "strip", z.ZodTypeAny, {
+        confidenceThreshold: number;
+        confidenceAction: "challenge" | "allow" | "block" | "redirect" | "log";
+        minReputationScore: number;
+        lowReputationAction: "challenge" | "allow" | "block" | "redirect" | "log";
+        trustedReputationThreshold: number;
+        trustSignedRequests: boolean;
+    }, {
+        confidenceThreshold?: number | undefined;
+        confidenceAction?: "challenge" | "allow" | "block" | "redirect" | "log" | undefined;
+        minReputationScore?: number | undefined;
+        lowReputationAction?: "challenge" | "allow" | "block" | "redirect" | "log" | undefined;
+        trustedReputationThreshold?: number | undefined;
+        trustSignedRequests?: boolean | undefined;
+    }>>;
+    /** Deny list entries (checked after allow list, before rules) */
+    denyList: z.ZodDefault<z.ZodArray<z.ZodEffects<z.ZodObject<{
+        /** MCP-I client DID (e.g., "did:key:z6Mk...") */
+        clientDid: z.ZodOptional<z.ZodString>;
+        /** Agent DID from MCP-I identity */
+        agentDid: z.ZodOptional<z.ZodString>;
+        /** Human-readable client name (e.g., "Perplexity", "ChatGPT") */
+        clientName: z.ZodOptional<z.ZodString>;
+        /** Agent type to block (e.g., "ai_agent", "bot", "scraper") */
+        agentType: z.ZodOptional<z.ZodString>;
+        /** Reason for denial (shown to user/logged) */
+        reason: z.ZodOptional<z.ZodString>;
+        /** ISO 8601 timestamp when entry was added */
+        blockedAt: z.ZodOptional<z.ZodString>;
+        /** Who added this entry (user ID or "system") */
+        addedBy: z.ZodOptional<z.ZodString>;
+        /** Whether this entry is currently active */
+        active: z.ZodDefault<z.ZodBoolean>;
+        /** Optional expiration date for temporary blocks */
+        expiresAt: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        active: boolean;
+        agentDid?: string | undefined;
+        clientDid?: string | undefined;
+        expiresAt?: string | undefined;
+        reason?: string | undefined;
+        clientName?: string | undefined;
+        agentType?: string | undefined;
+        blockedAt?: string | undefined;
+        addedBy?: string | undefined;
+    }, {
+        agentDid?: string | undefined;
+        clientDid?: string | undefined;
+        expiresAt?: string | undefined;
+        reason?: string | undefined;
+        active?: boolean | undefined;
+        clientName?: string | undefined;
+        agentType?: string | undefined;
+        blockedAt?: string | undefined;
+        addedBy?: string | undefined;
+    }>, {
+        active: boolean;
+        agentDid?: string | undefined;
+        clientDid?: string | undefined;
+        expiresAt?: string | undefined;
+        reason?: string | undefined;
+        clientName?: string | undefined;
+        agentType?: string | undefined;
+        blockedAt?: string | undefined;
+        addedBy?: string | undefined;
+    }, {
+        agentDid?: string | undefined;
+        clientDid?: string | undefined;
+        expiresAt?: string | undefined;
+        reason?: string | undefined;
+        active?: boolean | undefined;
+        clientName?: string | undefined;
+        agentType?: string | undefined;
+        blockedAt?: string | undefined;
+        addedBy?: string | undefined;
+    }>, "many">>;
+    /** Allow list entries (exempt from all checks) */
+    allowList: z.ZodDefault<z.ZodArray<z.ZodEffects<z.ZodObject<{
+        /** MCP-I client DID (e.g., "did:key:z6Mk...") */
+        clientDid: z.ZodOptional<z.ZodString>;
+        /** Agent DID from MCP-I identity */
+        agentDid: z.ZodOptional<z.ZodString>;
+        /** Human-readable client name (e.g., "Perplexity", "ChatGPT") */
+        clientName: z.ZodOptional<z.ZodString>;
+        /** Agent type to allow (e.g., "ai_agent", "verified_bot") */
+        agentType: z.ZodOptional<z.ZodString>;
+        /** Reason for allowing (documentation) */
+        reason: z.ZodOptional<z.ZodString>;
+        /** ISO 8601 timestamp when entry was added */
+        addedAt: z.ZodOptional<z.ZodString>;
+        /** Who added this entry */
+        addedBy: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        agentDid?: string | undefined;
+        clientDid?: string | undefined;
+        reason?: string | undefined;
+        clientName?: string | undefined;
+        agentType?: string | undefined;
+        addedBy?: string | undefined;
+        addedAt?: string | undefined;
+    }, {
+        agentDid?: string | undefined;
+        clientDid?: string | undefined;
+        reason?: string | undefined;
+        clientName?: string | undefined;
+        agentType?: string | undefined;
+        addedBy?: string | undefined;
+        addedAt?: string | undefined;
+    }>, {
+        agentDid?: string | undefined;
+        clientDid?: string | undefined;
+        reason?: string | undefined;
+        clientName?: string | undefined;
+        agentType?: string | undefined;
+        addedBy?: string | undefined;
+        addedAt?: string | undefined;
+    }, {
+        agentDid?: string | undefined;
+        clientDid?: string | undefined;
+        reason?: string | undefined;
+        clientName?: string | undefined;
+        agentType?: string | undefined;
+        addedBy?: string | undefined;
+        addedAt?: string | undefined;
+    }>, "many">>;
+    /** Custom policy rules (evaluated by priority after threshold checks) */
+    rules: z.ZodDefault<z.ZodArray<z.ZodEffects<z.ZodObject<{
+        /** Unique identifier for this rule */
+        id: z.ZodString;
+        /** Human-readable name */
+        name: z.ZodString;
+        /** Description of what this rule does */
+        description: z.ZodOptional<z.ZodString>;
+        /** Priority (lower = higher priority, evaluated first) */
+        priority: z.ZodDefault<z.ZodNumber>;
+        /**
+         * Conditions that must ALL match for this rule to apply (AND logic)
+         * For OR logic, create multiple rules with same action
+         */
+        conditions: z.ZodArray<z.ZodObject<{
+            /** Field to match against */
+            field: z.ZodEnum<["agentType", "agentName", "agentVendor", "clientDid", "agentDid", "confidence", "reputationScore", "riskLevel", "path", "method", "origin", "userAgent", "signatureVerified", "isAuthenticated", "hasValidDelegation"]>;
+            /** Comparison operator */
+            operator: z.ZodEnum<["equals", "notEquals", "contains", "notContains", "startsWith", "endsWith", "greaterThan", "lessThan", "greaterThanOrEquals", "lessThanOrEquals", "matches", "in", "notIn"]>;
+            /** Value to compare against */
+            value: z.ZodUnion<[z.ZodString, z.ZodNumber, z.ZodBoolean, z.ZodArray<z.ZodString, "many">]>;
+            /** Whether this condition is case-insensitive (for string comparisons) */
+            caseInsensitive: z.ZodOptional<z.ZodBoolean>;
+        }, "strip", z.ZodTypeAny, {
+            value: string | number | boolean | string[];
+            field: "path" | "agentDid" | "clientDid" | "method" | "confidence" | "agentType" | "agentName" | "agentVendor" | "reputationScore" | "riskLevel" | "origin" | "userAgent" | "signatureVerified" | "isAuthenticated" | "hasValidDelegation";
+            operator: "equals" | "notEquals" | "contains" | "notContains" | "startsWith" | "endsWith" | "greaterThan" | "lessThan" | "greaterThanOrEquals" | "lessThanOrEquals" | "matches" | "in" | "notIn";
+            caseInsensitive?: boolean | undefined;
+        }, {
+            value: string | number | boolean | string[];
+            field: "path" | "agentDid" | "clientDid" | "method" | "confidence" | "agentType" | "agentName" | "agentVendor" | "reputationScore" | "riskLevel" | "origin" | "userAgent" | "signatureVerified" | "isAuthenticated" | "hasValidDelegation";
+            operator: "equals" | "notEquals" | "contains" | "notContains" | "startsWith" | "endsWith" | "greaterThan" | "lessThan" | "greaterThanOrEquals" | "lessThanOrEquals" | "matches" | "in" | "notIn";
+            caseInsensitive?: boolean | undefined;
+        }>, "many">;
+        /** Action to take when conditions match */
+        action: z.ZodEnum<["allow", "block", "redirect", "challenge", "log"]>;
+        /** Redirect URL (required if action is 'redirect') */
+        redirectUrl: z.ZodOptional<z.ZodString>;
+        /** Custom message to show/log */
+        message: z.ZodOptional<z.ZodString>;
+        /** Whether this rule is currently active */
+        enabled: z.ZodDefault<z.ZodBoolean>;
+        /** Metadata for auditing */
+        metadata: z.ZodOptional<z.ZodObject<{
+            createdAt: z.ZodOptional<z.ZodString>;
+            updatedAt: z.ZodOptional<z.ZodString>;
+            createdBy: z.ZodOptional<z.ZodString>;
+        }, "strip", z.ZodTypeAny, {
+            createdAt?: string | undefined;
+            updatedAt?: string | undefined;
+            createdBy?: string | undefined;
+        }, {
+            createdAt?: string | undefined;
+            updatedAt?: string | undefined;
+            createdBy?: string | undefined;
+        }>>;
+    }, "strip", z.ZodTypeAny, {
+        name: string;
+        id: string;
+        enabled: boolean;
+        action: "challenge" | "allow" | "block" | "redirect" | "log";
+        priority: number;
+        conditions: {
+            value: string | number | boolean | string[];
+            field: "path" | "agentDid" | "clientDid" | "method" | "confidence" | "agentType" | "agentName" | "agentVendor" | "reputationScore" | "riskLevel" | "origin" | "userAgent" | "signatureVerified" | "isAuthenticated" | "hasValidDelegation";
+            operator: "equals" | "notEquals" | "contains" | "notContains" | "startsWith" | "endsWith" | "greaterThan" | "lessThan" | "greaterThanOrEquals" | "lessThanOrEquals" | "matches" | "in" | "notIn";
+            caseInsensitive?: boolean | undefined;
+        }[];
+        message?: string | undefined;
+        metadata?: {
+            createdAt?: string | undefined;
+            updatedAt?: string | undefined;
+            createdBy?: string | undefined;
+        } | undefined;
+        description?: string | undefined;
+        redirectUrl?: string | undefined;
+    }, {
+        name: string;
+        id: string;
+        action: "challenge" | "allow" | "block" | "redirect" | "log";
+        conditions: {
+            value: string | number | boolean | string[];
+            field: "path" | "agentDid" | "clientDid" | "method" | "confidence" | "agentType" | "agentName" | "agentVendor" | "reputationScore" | "riskLevel" | "origin" | "userAgent" | "signatureVerified" | "isAuthenticated" | "hasValidDelegation";
+            operator: "equals" | "notEquals" | "contains" | "notContains" | "startsWith" | "endsWith" | "greaterThan" | "lessThan" | "greaterThanOrEquals" | "lessThanOrEquals" | "matches" | "in" | "notIn";
+            caseInsensitive?: boolean | undefined;
+        }[];
+        message?: string | undefined;
+        metadata?: {
+            createdAt?: string | undefined;
+            updatedAt?: string | undefined;
+            createdBy?: string | undefined;
+        } | undefined;
+        enabled?: boolean | undefined;
+        description?: string | undefined;
+        priority?: number | undefined;
+        redirectUrl?: string | undefined;
+    }>, {
+        name: string;
+        id: string;
+        enabled: boolean;
+        action: "challenge" | "allow" | "block" | "redirect" | "log";
+        priority: number;
+        conditions: {
+            value: string | number | boolean | string[];
+            field: "path" | "agentDid" | "clientDid" | "method" | "confidence" | "agentType" | "agentName" | "agentVendor" | "reputationScore" | "riskLevel" | "origin" | "userAgent" | "signatureVerified" | "isAuthenticated" | "hasValidDelegation";
+            operator: "equals" | "notEquals" | "contains" | "notContains" | "startsWith" | "endsWith" | "greaterThan" | "lessThan" | "greaterThanOrEquals" | "lessThanOrEquals" | "matches" | "in" | "notIn";
+            caseInsensitive?: boolean | undefined;
+        }[];
+        message?: string | undefined;
+        metadata?: {
+            createdAt?: string | undefined;
+            updatedAt?: string | undefined;
+            createdBy?: string | undefined;
+        } | undefined;
+        description?: string | undefined;
+        redirectUrl?: string | undefined;
+    }, {
+        name: string;
+        id: string;
+        action: "challenge" | "allow" | "block" | "redirect" | "log";
+        conditions: {
+            value: string | number | boolean | string[];
+            field: "path" | "agentDid" | "clientDid" | "method" | "confidence" | "agentType" | "agentName" | "agentVendor" | "reputationScore" | "riskLevel" | "origin" | "userAgent" | "signatureVerified" | "isAuthenticated" | "hasValidDelegation";
+            operator: "equals" | "notEquals" | "contains" | "notContains" | "startsWith" | "endsWith" | "greaterThan" | "lessThan" | "greaterThanOrEquals" | "lessThanOrEquals" | "matches" | "in" | "notIn";
+            caseInsensitive?: boolean | undefined;
+        }[];
+        message?: string | undefined;
+        metadata?: {
+            createdAt?: string | undefined;
+            updatedAt?: string | undefined;
+            createdBy?: string | undefined;
+        } | undefined;
+        enabled?: boolean | undefined;
+        description?: string | undefined;
+        priority?: number | undefined;
+        redirectUrl?: string | undefined;
+    }>, "many">>;
+    /** Paths to exclude from policy enforcement (glob patterns supported) */
+    excludedPaths: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    /** Paths to include (if set, only these paths are enforced) */
+    includedPaths: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    /** Metadata for the policy configuration */
+    metadata: z.ZodOptional<z.ZodObject<{
+        lastUpdated: z.ZodOptional<z.ZodString>;
+        updatedBy: z.ZodOptional<z.ZodString>;
+        policyId: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        lastUpdated?: string | undefined;
+        updatedBy?: string | undefined;
+        policyId?: string | undefined;
+    }, {
+        lastUpdated?: string | undefined;
+        updatedBy?: string | undefined;
+        policyId?: string | undefined;
+    }>>;
+}, "strip", z.ZodTypeAny, {
+    version: string;
+    enabled: boolean;
+    defaultAction: "challenge" | "allow" | "block" | "redirect" | "log";
+    thresholds: {
+        confidenceThreshold: number;
+        confidenceAction: "challenge" | "allow" | "block" | "redirect" | "log";
+        minReputationScore: number;
+        lowReputationAction: "challenge" | "allow" | "block" | "redirect" | "log";
+        trustedReputationThreshold: number;
+        trustSignedRequests: boolean;
+    };
+    denyList: {
+        active: boolean;
+        agentDid?: string | undefined;
+        clientDid?: string | undefined;
+        expiresAt?: string | undefined;
+        reason?: string | undefined;
+        clientName?: string | undefined;
+        agentType?: string | undefined;
+        blockedAt?: string | undefined;
+        addedBy?: string | undefined;
+    }[];
+    allowList: {
+        agentDid?: string | undefined;
+        clientDid?: string | undefined;
+        reason?: string | undefined;
+        clientName?: string | undefined;
+        agentType?: string | undefined;
+        addedBy?: string | undefined;
+        addedAt?: string | undefined;
+    }[];
+    rules: {
+        name: string;
+        id: string;
+        enabled: boolean;
+        action: "challenge" | "allow" | "block" | "redirect" | "log";
+        priority: number;
+        conditions: {
+            value: string | number | boolean | string[];
+            field: "path" | "agentDid" | "clientDid" | "method" | "confidence" | "agentType" | "agentName" | "agentVendor" | "reputationScore" | "riskLevel" | "origin" | "userAgent" | "signatureVerified" | "isAuthenticated" | "hasValidDelegation";
+            operator: "equals" | "notEquals" | "contains" | "notContains" | "startsWith" | "endsWith" | "greaterThan" | "lessThan" | "greaterThanOrEquals" | "lessThanOrEquals" | "matches" | "in" | "notIn";
+            caseInsensitive?: boolean | undefined;
+        }[];
+        message?: string | undefined;
+        metadata?: {
+            createdAt?: string | undefined;
+            updatedAt?: string | undefined;
+            createdBy?: string | undefined;
+        } | undefined;
+        description?: string | undefined;
+        redirectUrl?: string | undefined;
+    }[];
+    excludedPaths: string[];
+    metadata?: {
+        lastUpdated?: string | undefined;
+        updatedBy?: string | undefined;
+        policyId?: string | undefined;
+    } | undefined;
+    redirectUrl?: string | undefined;
+    includedPaths?: string[] | undefined;
+}, {
+    metadata?: {
+        lastUpdated?: string | undefined;
+        updatedBy?: string | undefined;
+        policyId?: string | undefined;
+    } | undefined;
+    version?: string | undefined;
+    enabled?: boolean | undefined;
+    redirectUrl?: string | undefined;
+    defaultAction?: "challenge" | "allow" | "block" | "redirect" | "log" | undefined;
+    thresholds?: {
+        confidenceThreshold?: number | undefined;
+        confidenceAction?: "challenge" | "allow" | "block" | "redirect" | "log" | undefined;
+        minReputationScore?: number | undefined;
+        lowReputationAction?: "challenge" | "allow" | "block" | "redirect" | "log" | undefined;
+        trustedReputationThreshold?: number | undefined;
+        trustSignedRequests?: boolean | undefined;
+    } | undefined;
+    denyList?: {
+        agentDid?: string | undefined;
+        clientDid?: string | undefined;
+        expiresAt?: string | undefined;
+        reason?: string | undefined;
+        active?: boolean | undefined;
+        clientName?: string | undefined;
+        agentType?: string | undefined;
+        blockedAt?: string | undefined;
+        addedBy?: string | undefined;
+    }[] | undefined;
+    allowList?: {
+        agentDid?: string | undefined;
+        clientDid?: string | undefined;
+        reason?: string | undefined;
+        clientName?: string | undefined;
+        agentType?: string | undefined;
+        addedBy?: string | undefined;
+        addedAt?: string | undefined;
+    }[] | undefined;
+    rules?: {
+        name: string;
+        id: string;
+        action: "challenge" | "allow" | "block" | "redirect" | "log";
+        conditions: {
+            value: string | number | boolean | string[];
+            field: "path" | "agentDid" | "clientDid" | "method" | "confidence" | "agentType" | "agentName" | "agentVendor" | "reputationScore" | "riskLevel" | "origin" | "userAgent" | "signatureVerified" | "isAuthenticated" | "hasValidDelegation";
+            operator: "equals" | "notEquals" | "contains" | "notContains" | "startsWith" | "endsWith" | "greaterThan" | "lessThan" | "greaterThanOrEquals" | "lessThanOrEquals" | "matches" | "in" | "notIn";
+            caseInsensitive?: boolean | undefined;
+        }[];
+        message?: string | undefined;
+        metadata?: {
+            createdAt?: string | undefined;
+            updatedAt?: string | undefined;
+            createdBy?: string | undefined;
+        } | undefined;
+        enabled?: boolean | undefined;
+        description?: string | undefined;
+        priority?: number | undefined;
+        redirectUrl?: string | undefined;
+    }[] | undefined;
+    excludedPaths?: string[] | undefined;
+    includedPaths?: string[] | undefined;
+}>, {
+    version: string;
+    enabled: boolean;
+    defaultAction: "challenge" | "allow" | "block" | "redirect" | "log";
+    thresholds: {
+        confidenceThreshold: number;
+        confidenceAction: "challenge" | "allow" | "block" | "redirect" | "log";
+        minReputationScore: number;
+        lowReputationAction: "challenge" | "allow" | "block" | "redirect" | "log";
+        trustedReputationThreshold: number;
+        trustSignedRequests: boolean;
+    };
+    denyList: {
+        active: boolean;
+        agentDid?: string | undefined;
+        clientDid?: string | undefined;
+        expiresAt?: string | undefined;
+        reason?: string | undefined;
+        clientName?: string | undefined;
+        agentType?: string | undefined;
+        blockedAt?: string | undefined;
+        addedBy?: string | undefined;
+    }[];
+    allowList: {
+        agentDid?: string | undefined;
+        clientDid?: string | undefined;
+        reason?: string | undefined;
+        clientName?: string | undefined;
+        agentType?: string | undefined;
+        addedBy?: string | undefined;
+        addedAt?: string | undefined;
+    }[];
+    rules: {
+        name: string;
+        id: string;
+        enabled: boolean;
+        action: "challenge" | "allow" | "block" | "redirect" | "log";
+        priority: number;
+        conditions: {
+            value: string | number | boolean | string[];
+            field: "path" | "agentDid" | "clientDid" | "method" | "confidence" | "agentType" | "agentName" | "agentVendor" | "reputationScore" | "riskLevel" | "origin" | "userAgent" | "signatureVerified" | "isAuthenticated" | "hasValidDelegation";
+            operator: "equals" | "notEquals" | "contains" | "notContains" | "startsWith" | "endsWith" | "greaterThan" | "lessThan" | "greaterThanOrEquals" | "lessThanOrEquals" | "matches" | "in" | "notIn";
+            caseInsensitive?: boolean | undefined;
+        }[];
+        message?: string | undefined;
+        metadata?: {
+            createdAt?: string | undefined;
+            updatedAt?: string | undefined;
+            createdBy?: string | undefined;
+        } | undefined;
+        description?: string | undefined;
+        redirectUrl?: string | undefined;
+    }[];
+    excludedPaths: string[];
+    metadata?: {
+        lastUpdated?: string | undefined;
+        updatedBy?: string | undefined;
+        policyId?: string | undefined;
+    } | undefined;
+    redirectUrl?: string | undefined;
+    includedPaths?: string[] | undefined;
+}, {
+    metadata?: {
+        lastUpdated?: string | undefined;
+        updatedBy?: string | undefined;
+        policyId?: string | undefined;
+    } | undefined;
+    version?: string | undefined;
+    enabled?: boolean | undefined;
+    redirectUrl?: string | undefined;
+    defaultAction?: "challenge" | "allow" | "block" | "redirect" | "log" | undefined;
+    thresholds?: {
+        confidenceThreshold?: number | undefined;
+        confidenceAction?: "challenge" | "allow" | "block" | "redirect" | "log" | undefined;
+        minReputationScore?: number | undefined;
+        lowReputationAction?: "challenge" | "allow" | "block" | "redirect" | "log" | undefined;
+        trustedReputationThreshold?: number | undefined;
+        trustSignedRequests?: boolean | undefined;
+    } | undefined;
+    denyList?: {
+        agentDid?: string | undefined;
+        clientDid?: string | undefined;
+        expiresAt?: string | undefined;
+        reason?: string | undefined;
+        active?: boolean | undefined;
+        clientName?: string | undefined;
+        agentType?: string | undefined;
+        blockedAt?: string | undefined;
+        addedBy?: string | undefined;
+    }[] | undefined;
+    allowList?: {
+        agentDid?: string | undefined;
+        clientDid?: string | undefined;
+        reason?: string | undefined;
+        clientName?: string | undefined;
+        agentType?: string | undefined;
+        addedBy?: string | undefined;
+        addedAt?: string | undefined;
+    }[] | undefined;
+    rules?: {
+        name: string;
+        id: string;
+        action: "challenge" | "allow" | "block" | "redirect" | "log";
+        conditions: {
+            value: string | number | boolean | string[];
+            field: "path" | "agentDid" | "clientDid" | "method" | "confidence" | "agentType" | "agentName" | "agentVendor" | "reputationScore" | "riskLevel" | "origin" | "userAgent" | "signatureVerified" | "isAuthenticated" | "hasValidDelegation";
+            operator: "equals" | "notEquals" | "contains" | "notContains" | "startsWith" | "endsWith" | "greaterThan" | "lessThan" | "greaterThanOrEquals" | "lessThanOrEquals" | "matches" | "in" | "notIn";
+            caseInsensitive?: boolean | undefined;
+        }[];
+        message?: string | undefined;
+        metadata?: {
+            createdAt?: string | undefined;
+            updatedAt?: string | undefined;
+            createdBy?: string | undefined;
+        } | undefined;
+        enabled?: boolean | undefined;
+        description?: string | undefined;
+        priority?: number | undefined;
+        redirectUrl?: string | undefined;
+    }[] | undefined;
+    excludedPaths?: string[] | undefined;
+    includedPaths?: string[] | undefined;
+}>;
+/** Partial policy config for updates (refinements applied after merge) */
+export declare const PolicyConfigPartialSchema: z.ZodObject<{
+    version: z.ZodOptional<z.ZodDefault<z.ZodString>>;
+    enabled: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+    defaultAction: z.ZodOptional<z.ZodDefault<z.ZodEnum<["allow", "block", "redirect", "challenge", "log"]>>>;
+    redirectUrl: z.ZodOptional<z.ZodOptional<z.ZodString>>;
+    thresholds: z.ZodOptional<z.ZodDefault<z.ZodObject<{
+        /**
+         * Detection confidence threshold (0-100)
+         * Agents detected with confidence >= this value trigger the configured action
+         * @default 80
+         */
+        confidenceThreshold: z.ZodDefault<z.ZodNumber>;
+        /**
+         * Action to take when confidence threshold is exceeded
+         * @default 'block'
+         */
+        confidenceAction: z.ZodDefault<z.ZodEnum<["allow", "block", "redirect", "challenge", "log"]>>;
+        /**
+         * Minimum reputation score (0-100) required to allow access
+         * Agents with reputation < this value may be blocked/challenged
+         * Set to 0 to disable reputation-based enforcement
+         * @default 0
+         */
+        minReputationScore: z.ZodDefault<z.ZodNumber>;
+        /**
+         * Action to take when reputation is below threshold
+         * @default 'challenge'
+         */
+        lowReputationAction: z.ZodDefault<z.ZodEnum<["allow", "block", "redirect", "challenge", "log"]>>;
+        /**
+         * High reputation score threshold (0-100)
+         * Agents with reputation >= this value are trusted and bypass other checks
+         * @default 90
+         */
+        trustedReputationThreshold: z.ZodDefault<z.ZodNumber>;
+        /**
+         * Whether cryptographically signed requests (MCP-I verified) bypass thresholds
+         * @default true
+         */
+        trustSignedRequests: z.ZodDefault<z.ZodBoolean>;
+    }, "strip", z.ZodTypeAny, {
+        confidenceThreshold: number;
+        confidenceAction: "challenge" | "allow" | "block" | "redirect" | "log";
+        minReputationScore: number;
+        lowReputationAction: "challenge" | "allow" | "block" | "redirect" | "log";
+        trustedReputationThreshold: number;
+        trustSignedRequests: boolean;
+    }, {
+        confidenceThreshold?: number | undefined;
+        confidenceAction?: "challenge" | "allow" | "block" | "redirect" | "log" | undefined;
+        minReputationScore?: number | undefined;
+        lowReputationAction?: "challenge" | "allow" | "block" | "redirect" | "log" | undefined;
+        trustedReputationThreshold?: number | undefined;
+        trustSignedRequests?: boolean | undefined;
+    }>>>;
+    denyList: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodEffects<z.ZodObject<{
+        /** MCP-I client DID (e.g., "did:key:z6Mk...") */
+        clientDid: z.ZodOptional<z.ZodString>;
+        /** Agent DID from MCP-I identity */
+        agentDid: z.ZodOptional<z.ZodString>;
+        /** Human-readable client name (e.g., "Perplexity", "ChatGPT") */
+        clientName: z.ZodOptional<z.ZodString>;
+        /** Agent type to block (e.g., "ai_agent", "bot", "scraper") */
+        agentType: z.ZodOptional<z.ZodString>;
+        /** Reason for denial (shown to user/logged) */
+        reason: z.ZodOptional<z.ZodString>;
+        /** ISO 8601 timestamp when entry was added */
+        blockedAt: z.ZodOptional<z.ZodString>;
+        /** Who added this entry (user ID or "system") */
+        addedBy: z.ZodOptional<z.ZodString>;
+        /** Whether this entry is currently active */
+        active: z.ZodDefault<z.ZodBoolean>;
+        /** Optional expiration date for temporary blocks */
+        expiresAt: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        active: boolean;
+        agentDid?: string | undefined;
+        clientDid?: string | undefined;
+        expiresAt?: string | undefined;
+        reason?: string | undefined;
+        clientName?: string | undefined;
+        agentType?: string | undefined;
+        blockedAt?: string | undefined;
+        addedBy?: string | undefined;
+    }, {
+        agentDid?: string | undefined;
+        clientDid?: string | undefined;
+        expiresAt?: string | undefined;
+        reason?: string | undefined;
+        active?: boolean | undefined;
+        clientName?: string | undefined;
+        agentType?: string | undefined;
+        blockedAt?: string | undefined;
+        addedBy?: string | undefined;
+    }>, {
+        active: boolean;
+        agentDid?: string | undefined;
+        clientDid?: string | undefined;
+        expiresAt?: string | undefined;
+        reason?: string | undefined;
+        clientName?: string | undefined;
+        agentType?: string | undefined;
+        blockedAt?: string | undefined;
+        addedBy?: string | undefined;
+    }, {
+        agentDid?: string | undefined;
+        clientDid?: string | undefined;
+        expiresAt?: string | undefined;
+        reason?: string | undefined;
+        active?: boolean | undefined;
+        clientName?: string | undefined;
+        agentType?: string | undefined;
+        blockedAt?: string | undefined;
+        addedBy?: string | undefined;
+    }>, "many">>>;
+    allowList: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodEffects<z.ZodObject<{
+        /** MCP-I client DID (e.g., "did:key:z6Mk...") */
+        clientDid: z.ZodOptional<z.ZodString>;
+        /** Agent DID from MCP-I identity */
+        agentDid: z.ZodOptional<z.ZodString>;
+        /** Human-readable client name (e.g., "Perplexity", "ChatGPT") */
+        clientName: z.ZodOptional<z.ZodString>;
+        /** Agent type to allow (e.g., "ai_agent", "verified_bot") */
+        agentType: z.ZodOptional<z.ZodString>;
+        /** Reason for allowing (documentation) */
+        reason: z.ZodOptional<z.ZodString>;
+        /** ISO 8601 timestamp when entry was added */
+        addedAt: z.ZodOptional<z.ZodString>;
+        /** Who added this entry */
+        addedBy: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        agentDid?: string | undefined;
+        clientDid?: string | undefined;
+        reason?: string | undefined;
+        clientName?: string | undefined;
+        agentType?: string | undefined;
+        addedBy?: string | undefined;
+        addedAt?: string | undefined;
+    }, {
+        agentDid?: string | undefined;
+        clientDid?: string | undefined;
+        reason?: string | undefined;
+        clientName?: string | undefined;
+        agentType?: string | undefined;
+        addedBy?: string | undefined;
+        addedAt?: string | undefined;
+    }>, {
+        agentDid?: string | undefined;
+        clientDid?: string | undefined;
+        reason?: string | undefined;
+        clientName?: string | undefined;
+        agentType?: string | undefined;
+        addedBy?: string | undefined;
+        addedAt?: string | undefined;
+    }, {
+        agentDid?: string | undefined;
+        clientDid?: string | undefined;
+        reason?: string | undefined;
+        clientName?: string | undefined;
+        agentType?: string | undefined;
+        addedBy?: string | undefined;
+        addedAt?: string | undefined;
+    }>, "many">>>;
+    rules: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodEffects<z.ZodObject<{
+        /** Unique identifier for this rule */
+        id: z.ZodString;
+        /** Human-readable name */
+        name: z.ZodString;
+        /** Description of what this rule does */
+        description: z.ZodOptional<z.ZodString>;
+        /** Priority (lower = higher priority, evaluated first) */
+        priority: z.ZodDefault<z.ZodNumber>;
+        /**
+         * Conditions that must ALL match for this rule to apply (AND logic)
+         * For OR logic, create multiple rules with same action
+         */
+        conditions: z.ZodArray<z.ZodObject<{
+            /** Field to match against */
+            field: z.ZodEnum<["agentType", "agentName", "agentVendor", "clientDid", "agentDid", "confidence", "reputationScore", "riskLevel", "path", "method", "origin", "userAgent", "signatureVerified", "isAuthenticated", "hasValidDelegation"]>;
+            /** Comparison operator */
+            operator: z.ZodEnum<["equals", "notEquals", "contains", "notContains", "startsWith", "endsWith", "greaterThan", "lessThan", "greaterThanOrEquals", "lessThanOrEquals", "matches", "in", "notIn"]>;
+            /** Value to compare against */
+            value: z.ZodUnion<[z.ZodString, z.ZodNumber, z.ZodBoolean, z.ZodArray<z.ZodString, "many">]>;
+            /** Whether this condition is case-insensitive (for string comparisons) */
+            caseInsensitive: z.ZodOptional<z.ZodBoolean>;
+        }, "strip", z.ZodTypeAny, {
+            value: string | number | boolean | string[];
+            field: "path" | "agentDid" | "clientDid" | "method" | "confidence" | "agentType" | "agentName" | "agentVendor" | "reputationScore" | "riskLevel" | "origin" | "userAgent" | "signatureVerified" | "isAuthenticated" | "hasValidDelegation";
+            operator: "equals" | "notEquals" | "contains" | "notContains" | "startsWith" | "endsWith" | "greaterThan" | "lessThan" | "greaterThanOrEquals" | "lessThanOrEquals" | "matches" | "in" | "notIn";
+            caseInsensitive?: boolean | undefined;
+        }, {
+            value: string | number | boolean | string[];
+            field: "path" | "agentDid" | "clientDid" | "method" | "confidence" | "agentType" | "agentName" | "agentVendor" | "reputationScore" | "riskLevel" | "origin" | "userAgent" | "signatureVerified" | "isAuthenticated" | "hasValidDelegation";
+            operator: "equals" | "notEquals" | "contains" | "notContains" | "startsWith" | "endsWith" | "greaterThan" | "lessThan" | "greaterThanOrEquals" | "lessThanOrEquals" | "matches" | "in" | "notIn";
+            caseInsensitive?: boolean | undefined;
+        }>, "many">;
+        /** Action to take when conditions match */
+        action: z.ZodEnum<["allow", "block", "redirect", "challenge", "log"]>;
+        /** Redirect URL (required if action is 'redirect') */
+        redirectUrl: z.ZodOptional<z.ZodString>;
+        /** Custom message to show/log */
+        message: z.ZodOptional<z.ZodString>;
+        /** Whether this rule is currently active */
+        enabled: z.ZodDefault<z.ZodBoolean>;
+        /** Metadata for auditing */
+        metadata: z.ZodOptional<z.ZodObject<{
+            createdAt: z.ZodOptional<z.ZodString>;
+            updatedAt: z.ZodOptional<z.ZodString>;
+            createdBy: z.ZodOptional<z.ZodString>;
+        }, "strip", z.ZodTypeAny, {
+            createdAt?: string | undefined;
+            updatedAt?: string | undefined;
+            createdBy?: string | undefined;
+        }, {
+            createdAt?: string | undefined;
+            updatedAt?: string | undefined;
+            createdBy?: string | undefined;
+        }>>;
+    }, "strip", z.ZodTypeAny, {
+        name: string;
+        id: string;
+        enabled: boolean;
+        action: "challenge" | "allow" | "block" | "redirect" | "log";
+        priority: number;
+        conditions: {
+            value: string | number | boolean | string[];
+            field: "path" | "agentDid" | "clientDid" | "method" | "confidence" | "agentType" | "agentName" | "agentVendor" | "reputationScore" | "riskLevel" | "origin" | "userAgent" | "signatureVerified" | "isAuthenticated" | "hasValidDelegation";
+            operator: "equals" | "notEquals" | "contains" | "notContains" | "startsWith" | "endsWith" | "greaterThan" | "lessThan" | "greaterThanOrEquals" | "lessThanOrEquals" | "matches" | "in" | "notIn";
+            caseInsensitive?: boolean | undefined;
+        }[];
+        message?: string | undefined;
+        metadata?: {
+            createdAt?: string | undefined;
+            updatedAt?: string | undefined;
+            createdBy?: string | undefined;
+        } | undefined;
+        description?: string | undefined;
+        redirectUrl?: string | undefined;
+    }, {
+        name: string;
+        id: string;
+        action: "challenge" | "allow" | "block" | "redirect" | "log";
+        conditions: {
+            value: string | number | boolean | string[];
+            field: "path" | "agentDid" | "clientDid" | "method" | "confidence" | "agentType" | "agentName" | "agentVendor" | "reputationScore" | "riskLevel" | "origin" | "userAgent" | "signatureVerified" | "isAuthenticated" | "hasValidDelegation";
+            operator: "equals" | "notEquals" | "contains" | "notContains" | "startsWith" | "endsWith" | "greaterThan" | "lessThan" | "greaterThanOrEquals" | "lessThanOrEquals" | "matches" | "in" | "notIn";
+            caseInsensitive?: boolean | undefined;
+        }[];
+        message?: string | undefined;
+        metadata?: {
+            createdAt?: string | undefined;
+            updatedAt?: string | undefined;
+            createdBy?: string | undefined;
+        } | undefined;
+        enabled?: boolean | undefined;
+        description?: string | undefined;
+        priority?: number | undefined;
+        redirectUrl?: string | undefined;
+    }>, {
+        name: string;
+        id: string;
+        enabled: boolean;
+        action: "challenge" | "allow" | "block" | "redirect" | "log";
+        priority: number;
+        conditions: {
+            value: string | number | boolean | string[];
+            field: "path" | "agentDid" | "clientDid" | "method" | "confidence" | "agentType" | "agentName" | "agentVendor" | "reputationScore" | "riskLevel" | "origin" | "userAgent" | "signatureVerified" | "isAuthenticated" | "hasValidDelegation";
+            operator: "equals" | "notEquals" | "contains" | "notContains" | "startsWith" | "endsWith" | "greaterThan" | "lessThan" | "greaterThanOrEquals" | "lessThanOrEquals" | "matches" | "in" | "notIn";
+            caseInsensitive?: boolean | undefined;
+        }[];
+        message?: string | undefined;
+        metadata?: {
+            createdAt?: string | undefined;
+            updatedAt?: string | undefined;
+            createdBy?: string | undefined;
+        } | undefined;
+        description?: string | undefined;
+        redirectUrl?: string | undefined;
+    }, {
+        name: string;
+        id: string;
+        action: "challenge" | "allow" | "block" | "redirect" | "log";
+        conditions: {
+            value: string | number | boolean | string[];
+            field: "path" | "agentDid" | "clientDid" | "method" | "confidence" | "agentType" | "agentName" | "agentVendor" | "reputationScore" | "riskLevel" | "origin" | "userAgent" | "signatureVerified" | "isAuthenticated" | "hasValidDelegation";
+            operator: "equals" | "notEquals" | "contains" | "notContains" | "startsWith" | "endsWith" | "greaterThan" | "lessThan" | "greaterThanOrEquals" | "lessThanOrEquals" | "matches" | "in" | "notIn";
+            caseInsensitive?: boolean | undefined;
+        }[];
+        message?: string | undefined;
+        metadata?: {
+            createdAt?: string | undefined;
+            updatedAt?: string | undefined;
+            createdBy?: string | undefined;
+        } | undefined;
+        enabled?: boolean | undefined;
+        description?: string | undefined;
+        priority?: number | undefined;
+        redirectUrl?: string | undefined;
+    }>, "many">>>;
+    excludedPaths: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodString, "many">>>;
+    includedPaths: z.ZodOptional<z.ZodOptional<z.ZodArray<z.ZodString, "many">>>;
+    metadata: z.ZodOptional<z.ZodOptional<z.ZodObject<{
+        lastUpdated: z.ZodOptional<z.ZodString>;
+        updatedBy: z.ZodOptional<z.ZodString>;
+        policyId: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        lastUpdated?: string | undefined;
+        updatedBy?: string | undefined;
+        policyId?: string | undefined;
+    }, {
+        lastUpdated?: string | undefined;
+        updatedBy?: string | undefined;
+        policyId?: string | undefined;
+    }>>>;
+}, "strip", z.ZodTypeAny, {
+    metadata?: {
+        lastUpdated?: string | undefined;
+        updatedBy?: string | undefined;
+        policyId?: string | undefined;
+    } | undefined;
+    version?: string | undefined;
+    enabled?: boolean | undefined;
+    redirectUrl?: string | undefined;
+    defaultAction?: "challenge" | "allow" | "block" | "redirect" | "log" | undefined;
+    thresholds?: {
+        confidenceThreshold: number;
+        confidenceAction: "challenge" | "allow" | "block" | "redirect" | "log";
+        minReputationScore: number;
+        lowReputationAction: "challenge" | "allow" | "block" | "redirect" | "log";
+        trustedReputationThreshold: number;
+        trustSignedRequests: boolean;
+    } | undefined;
+    denyList?: {
+        active: boolean;
+        agentDid?: string | undefined;
+        clientDid?: string | undefined;
+        expiresAt?: string | undefined;
+        reason?: string | undefined;
+        clientName?: string | undefined;
+        agentType?: string | undefined;
+        blockedAt?: string | undefined;
+        addedBy?: string | undefined;
+    }[] | undefined;
+    allowList?: {
+        agentDid?: string | undefined;
+        clientDid?: string | undefined;
+        reason?: string | undefined;
+        clientName?: string | undefined;
+        agentType?: string | undefined;
+        addedBy?: string | undefined;
+        addedAt?: string | undefined;
+    }[] | undefined;
+    rules?: {
+        name: string;
+        id: string;
+        enabled: boolean;
+        action: "challenge" | "allow" | "block" | "redirect" | "log";
+        priority: number;
+        conditions: {
+            value: string | number | boolean | string[];
+            field: "path" | "agentDid" | "clientDid" | "method" | "confidence" | "agentType" | "agentName" | "agentVendor" | "reputationScore" | "riskLevel" | "origin" | "userAgent" | "signatureVerified" | "isAuthenticated" | "hasValidDelegation";
+            operator: "equals" | "notEquals" | "contains" | "notContains" | "startsWith" | "endsWith" | "greaterThan" | "lessThan" | "greaterThanOrEquals" | "lessThanOrEquals" | "matches" | "in" | "notIn";
+            caseInsensitive?: boolean | undefined;
+        }[];
+        message?: string | undefined;
+        metadata?: {
+            createdAt?: string | undefined;
+            updatedAt?: string | undefined;
+            createdBy?: string | undefined;
+        } | undefined;
+        description?: string | undefined;
+        redirectUrl?: string | undefined;
+    }[] | undefined;
+    excludedPaths?: string[] | undefined;
+    includedPaths?: string[] | undefined;
+}, {
+    metadata?: {
+        lastUpdated?: string | undefined;
+        updatedBy?: string | undefined;
+        policyId?: string | undefined;
+    } | undefined;
+    version?: string | undefined;
+    enabled?: boolean | undefined;
+    redirectUrl?: string | undefined;
+    defaultAction?: "challenge" | "allow" | "block" | "redirect" | "log" | undefined;
+    thresholds?: {
+        confidenceThreshold?: number | undefined;
+        confidenceAction?: "challenge" | "allow" | "block" | "redirect" | "log" | undefined;
+        minReputationScore?: number | undefined;
+        lowReputationAction?: "challenge" | "allow" | "block" | "redirect" | "log" | undefined;
+        trustedReputationThreshold?: number | undefined;
+        trustSignedRequests?: boolean | undefined;
+    } | undefined;
+    denyList?: {
+        agentDid?: string | undefined;
+        clientDid?: string | undefined;
+        expiresAt?: string | undefined;
+        reason?: string | undefined;
+        active?: boolean | undefined;
+        clientName?: string | undefined;
+        agentType?: string | undefined;
+        blockedAt?: string | undefined;
+        addedBy?: string | undefined;
+    }[] | undefined;
+    allowList?: {
+        agentDid?: string | undefined;
+        clientDid?: string | undefined;
+        reason?: string | undefined;
+        clientName?: string | undefined;
+        agentType?: string | undefined;
+        addedBy?: string | undefined;
+        addedAt?: string | undefined;
+    }[] | undefined;
+    rules?: {
+        name: string;
+        id: string;
+        action: "challenge" | "allow" | "block" | "redirect" | "log";
+        conditions: {
+            value: string | number | boolean | string[];
+            field: "path" | "agentDid" | "clientDid" | "method" | "confidence" | "agentType" | "agentName" | "agentVendor" | "reputationScore" | "riskLevel" | "origin" | "userAgent" | "signatureVerified" | "isAuthenticated" | "hasValidDelegation";
+            operator: "equals" | "notEquals" | "contains" | "notContains" | "startsWith" | "endsWith" | "greaterThan" | "lessThan" | "greaterThanOrEquals" | "lessThanOrEquals" | "matches" | "in" | "notIn";
+            caseInsensitive?: boolean | undefined;
+        }[];
+        message?: string | undefined;
+        metadata?: {
+            createdAt?: string | undefined;
+            updatedAt?: string | undefined;
+            createdBy?: string | undefined;
+        } | undefined;
+        enabled?: boolean | undefined;
+        description?: string | undefined;
+        priority?: number | undefined;
+        redirectUrl?: string | undefined;
+    }[] | undefined;
+    excludedPaths?: string[] | undefined;
+    includedPaths?: string[] | undefined;
+}>;
+export type PolicyConfig = z.infer<typeof PolicyConfigSchema>;
+export type PolicyConfigPartial = z.infer<typeof PolicyConfigPartialSchema>;
+/**
+ * Request to get policy configuration
+ */
+export declare const GetPolicyRequestSchema: z.ZodObject<{
+    projectId: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    projectId: string;
+}, {
+    projectId: string;
+}>;
+export type GetPolicyRequest = z.infer<typeof GetPolicyRequestSchema>;
+/**
+ * Response with policy configuration
+ */
+export declare const GetPolicyResponseSchema: z.ZodObject<{
+    success: z.ZodBoolean;
+    data: z.ZodObject<{
+        policy: z.ZodEffects<z.ZodObject<{
+            /** Schema version for migrations */
+            version: z.ZodDefault<z.ZodString>;
+            /** Whether policy enforcement is enabled */
+            enabled: z.ZodDefault<z.ZodBoolean>;
+            /** Default action when no rules match */
+            defaultAction: z.ZodDefault<z.ZodEnum<["allow", "block", "redirect", "challenge", "log"]>>;
+            /** Default redirect URL for redirect actions */
+            redirectUrl: z.ZodOptional<z.ZodString>;
+            /** Threshold-based enforcement settings */
+            thresholds: z.ZodDefault<z.ZodObject<{
+                /**
+                 * Detection confidence threshold (0-100)
+                 * Agents detected with confidence >= this value trigger the configured action
+                 * @default 80
+                 */
+                confidenceThreshold: z.ZodDefault<z.ZodNumber>;
+                /**
+                 * Action to take when confidence threshold is exceeded
+                 * @default 'block'
+                 */
+                confidenceAction: z.ZodDefault<z.ZodEnum<["allow", "block", "redirect", "challenge", "log"]>>;
+                /**
+                 * Minimum reputation score (0-100) required to allow access
+                 * Agents with reputation < this value may be blocked/challenged
+                 * Set to 0 to disable reputation-based enforcement
+                 * @default 0
+                 */
+                minReputationScore: z.ZodDefault<z.ZodNumber>;
+                /**
+                 * Action to take when reputation is below threshold
+                 * @default 'challenge'
+                 */
+                lowReputationAction: z.ZodDefault<z.ZodEnum<["allow", "block", "redirect", "challenge", "log"]>>;
+                /**
+                 * High reputation score threshold (0-100)
+                 * Agents with reputation >= this value are trusted and bypass other checks
+                 * @default 90
+                 */
+                trustedReputationThreshold: z.ZodDefault<z.ZodNumber>;
+                /**
+                 * Whether cryptographically signed requests (MCP-I verified) bypass thresholds
+                 * @default true
+                 */
+                trustSignedRequests: z.ZodDefault<z.ZodBoolean>;
+            }, "strip", z.ZodTypeAny, {
+                confidenceThreshold: number;
+                confidenceAction: "challenge" | "allow" | "block" | "redirect" | "log";
+                minReputationScore: number;
+                lowReputationAction: "challenge" | "allow" | "block" | "redirect" | "log";
+                trustedReputationThreshold: number;
+                trustSignedRequests: boolean;
+            }, {
+                confidenceThreshold?: number | undefined;
+                confidenceAction?: "challenge" | "allow" | "block" | "redirect" | "log" | undefined;
+                minReputationScore?: number | undefined;
+                lowReputationAction?: "challenge" | "allow" | "block" | "redirect" | "log" | undefined;
+                trustedReputationThreshold?: number | undefined;
+                trustSignedRequests?: boolean | undefined;
+            }>>;
+            /** Deny list entries (checked after allow list, before rules) */
+            denyList: z.ZodDefault<z.ZodArray<z.ZodEffects<z.ZodObject<{
+                /** MCP-I client DID (e.g., "did:key:z6Mk...") */
+                clientDid: z.ZodOptional<z.ZodString>;
+                /** Agent DID from MCP-I identity */
+                agentDid: z.ZodOptional<z.ZodString>;
+                /** Human-readable client name (e.g., "Perplexity", "ChatGPT") */
+                clientName: z.ZodOptional<z.ZodString>;
+                /** Agent type to block (e.g., "ai_agent", "bot", "scraper") */
+                agentType: z.ZodOptional<z.ZodString>;
+                /** Reason for denial (shown to user/logged) */
+                reason: z.ZodOptional<z.ZodString>;
+                /** ISO 8601 timestamp when entry was added */
+                blockedAt: z.ZodOptional<z.ZodString>;
+                /** Who added this entry (user ID or "system") */
+                addedBy: z.ZodOptional<z.ZodString>;
+                /** Whether this entry is currently active */
+                active: z.ZodDefault<z.ZodBoolean>;
+                /** Optional expiration date for temporary blocks */
+                expiresAt: z.ZodOptional<z.ZodString>;
+            }, "strip", z.ZodTypeAny, {
+                active: boolean;
+                agentDid?: string | undefined;
+                clientDid?: string | undefined;
+                expiresAt?: string | undefined;
+                reason?: string | undefined;
+                clientName?: string | undefined;
+                agentType?: string | undefined;
+                blockedAt?: string | undefined;
+                addedBy?: string | undefined;
+            }, {
+                agentDid?: string | undefined;
+                clientDid?: string | undefined;
+                expiresAt?: string | undefined;
+                reason?: string | undefined;
+                active?: boolean | undefined;
+                clientName?: string | undefined;
+                agentType?: string | undefined;
+                blockedAt?: string | undefined;
+                addedBy?: string | undefined;
+            }>, {
+                active: boolean;
+                agentDid?: string | undefined;
+                clientDid?: string | undefined;
+                expiresAt?: string | undefined;
+                reason?: string | undefined;
+                clientName?: string | undefined;
+                agentType?: string | undefined;
+                blockedAt?: string | undefined;
+                addedBy?: string | undefined;
+            }, {
+                agentDid?: string | undefined;
+                clientDid?: string | undefined;
+                expiresAt?: string | undefined;
+                reason?: string | undefined;
+                active?: boolean | undefined;
+                clientName?: string | undefined;
+                agentType?: string | undefined;
+                blockedAt?: string | undefined;
+                addedBy?: string | undefined;
+            }>, "many">>;
+            /** Allow list entries (exempt from all checks) */
+            allowList: z.ZodDefault<z.ZodArray<z.ZodEffects<z.ZodObject<{
+                /** MCP-I client DID (e.g., "did:key:z6Mk...") */
+                clientDid: z.ZodOptional<z.ZodString>;
+                /** Agent DID from MCP-I identity */
+                agentDid: z.ZodOptional<z.ZodString>;
+                /** Human-readable client name (e.g., "Perplexity", "ChatGPT") */
+                clientName: z.ZodOptional<z.ZodString>;
+                /** Agent type to allow (e.g., "ai_agent", "verified_bot") */
+                agentType: z.ZodOptional<z.ZodString>;
+                /** Reason for allowing (documentation) */
+                reason: z.ZodOptional<z.ZodString>;
+                /** ISO 8601 timestamp when entry was added */
+                addedAt: z.ZodOptional<z.ZodString>;
+                /** Who added this entry */
+                addedBy: z.ZodOptional<z.ZodString>;
+            }, "strip", z.ZodTypeAny, {
+                agentDid?: string | undefined;
+                clientDid?: string | undefined;
+                reason?: string | undefined;
+                clientName?: string | undefined;
+                agentType?: string | undefined;
+                addedBy?: string | undefined;
+                addedAt?: string | undefined;
+            }, {
+                agentDid?: string | undefined;
+                clientDid?: string | undefined;
+                reason?: string | undefined;
+                clientName?: string | undefined;
+                agentType?: string | undefined;
+                addedBy?: string | undefined;
+                addedAt?: string | undefined;
+            }>, {
+                agentDid?: string | undefined;
+                clientDid?: string | undefined;
+                reason?: string | undefined;
+                clientName?: string | undefined;
+                agentType?: string | undefined;
+                addedBy?: string | undefined;
+                addedAt?: string | undefined;
+            }, {
+                agentDid?: string | undefined;
+                clientDid?: string | undefined;
+                reason?: string | undefined;
+                clientName?: string | undefined;
+                agentType?: string | undefined;
+                addedBy?: string | undefined;
+                addedAt?: string | undefined;
+            }>, "many">>;
+            /** Custom policy rules (evaluated by priority after threshold checks) */
+            rules: z.ZodDefault<z.ZodArray<z.ZodEffects<z.ZodObject<{
+                /** Unique identifier for this rule */
+                id: z.ZodString;
+                /** Human-readable name */
+                name: z.ZodString;
+                /** Description of what this rule does */
+                description: z.ZodOptional<z.ZodString>;
+                /** Priority (lower = higher priority, evaluated first) */
+                priority: z.ZodDefault<z.ZodNumber>;
+                /**
+                 * Conditions that must ALL match for this rule to apply (AND logic)
+                 * For OR logic, create multiple rules with same action
+                 */
+                conditions: z.ZodArray<z.ZodObject<{
+                    /** Field to match against */
+                    field: z.ZodEnum<["agentType", "agentName", "agentVendor", "clientDid", "agentDid", "confidence", "reputationScore", "riskLevel", "path", "method", "origin", "userAgent", "signatureVerified", "isAuthenticated", "hasValidDelegation"]>;
+                    /** Comparison operator */
+                    operator: z.ZodEnum<["equals", "notEquals", "contains", "notContains", "startsWith", "endsWith", "greaterThan", "lessThan", "greaterThanOrEquals", "lessThanOrEquals", "matches", "in", "notIn"]>;
+                    /** Value to compare against */
+                    value: z.ZodUnion<[z.ZodString, z.ZodNumber, z.ZodBoolean, z.ZodArray<z.ZodString, "many">]>;
+                    /** Whether this condition is case-insensitive (for string comparisons) */
+                    caseInsensitive: z.ZodOptional<z.ZodBoolean>;
+                }, "strip", z.ZodTypeAny, {
+                    value: string | number | boolean | string[];
+                    field: "path" | "agentDid" | "clientDid" | "method" | "confidence" | "agentType" | "agentName" | "agentVendor" | "reputationScore" | "riskLevel" | "origin" | "userAgent" | "signatureVerified" | "isAuthenticated" | "hasValidDelegation";
+                    operator: "equals" | "notEquals" | "contains" | "notContains" | "startsWith" | "endsWith" | "greaterThan" | "lessThan" | "greaterThanOrEquals" | "lessThanOrEquals" | "matches" | "in" | "notIn";
+                    caseInsensitive?: boolean | undefined;
+                }, {
+                    value: string | number | boolean | string[];
+                    field: "path" | "agentDid" | "clientDid" | "method" | "confidence" | "agentType" | "agentName" | "agentVendor" | "reputationScore" | "riskLevel" | "origin" | "userAgent" | "signatureVerified" | "isAuthenticated" | "hasValidDelegation";
+                    operator: "equals" | "notEquals" | "contains" | "notContains" | "startsWith" | "endsWith" | "greaterThan" | "lessThan" | "greaterThanOrEquals" | "lessThanOrEquals" | "matches" | "in" | "notIn";
+                    caseInsensitive?: boolean | undefined;
+                }>, "many">;
+                /** Action to take when conditions match */
+                action: z.ZodEnum<["allow", "block", "redirect", "challenge", "log"]>;
+                /** Redirect URL (required if action is 'redirect') */
+                redirectUrl: z.ZodOptional<z.ZodString>;
+                /** Custom message to show/log */
+                message: z.ZodOptional<z.ZodString>;
+                /** Whether this rule is currently active */
+                enabled: z.ZodDefault<z.ZodBoolean>;
+                /** Metadata for auditing */
+                metadata: z.ZodOptional<z.ZodObject<{
+                    createdAt: z.ZodOptional<z.ZodString>;
+                    updatedAt: z.ZodOptional<z.ZodString>;
+                    createdBy: z.ZodOptional<z.ZodString>;
+                }, "strip", z.ZodTypeAny, {
+                    createdAt?: string | undefined;
+                    updatedAt?: string | undefined;
+                    createdBy?: string | undefined;
+                }, {
+                    createdAt?: string | undefined;
+                    updatedAt?: string | undefined;
+                    createdBy?: string | undefined;
+                }>>;
+            }, "strip", z.ZodTypeAny, {
+                name: string;
+                id: string;
+                enabled: boolean;
+                action: "challenge" | "allow" | "block" | "redirect" | "log";
+                priority: number;
+                conditions: {
+                    value: string | number | boolean | string[];
+                    field: "path" | "agentDid" | "clientDid" | "method" | "confidence" | "agentType" | "agentName" | "agentVendor" | "reputationScore" | "riskLevel" | "origin" | "userAgent" | "signatureVerified" | "isAuthenticated" | "hasValidDelegation";
+                    operator: "equals" | "notEquals" | "contains" | "notContains" | "startsWith" | "endsWith" | "greaterThan" | "lessThan" | "greaterThanOrEquals" | "lessThanOrEquals" | "matches" | "in" | "notIn";
+                    caseInsensitive?: boolean | undefined;
+                }[];
+                message?: string | undefined;
+                metadata?: {
+                    createdAt?: string | undefined;
+                    updatedAt?: string | undefined;
+                    createdBy?: string | undefined;
+                } | undefined;
+                description?: string | undefined;
+                redirectUrl?: string | undefined;
+            }, {
+                name: string;
+                id: string;
+                action: "challenge" | "allow" | "block" | "redirect" | "log";
+                conditions: {
+                    value: string | number | boolean | string[];
+                    field: "path" | "agentDid" | "clientDid" | "method" | "confidence" | "agentType" | "agentName" | "agentVendor" | "reputationScore" | "riskLevel" | "origin" | "userAgent" | "signatureVerified" | "isAuthenticated" | "hasValidDelegation";
+                    operator: "equals" | "notEquals" | "contains" | "notContains" | "startsWith" | "endsWith" | "greaterThan" | "lessThan" | "greaterThanOrEquals" | "lessThanOrEquals" | "matches" | "in" | "notIn";
+                    caseInsensitive?: boolean | undefined;
+                }[];
+                message?: string | undefined;
+                metadata?: {
+                    createdAt?: string | undefined;
+                    updatedAt?: string | undefined;
+                    createdBy?: string | undefined;
+                } | undefined;
+                enabled?: boolean | undefined;
+                description?: string | undefined;
+                priority?: number | undefined;
+                redirectUrl?: string | undefined;
+            }>, {
+                name: string;
+                id: string;
+                enabled: boolean;
+                action: "challenge" | "allow" | "block" | "redirect" | "log";
+                priority: number;
+                conditions: {
+                    value: string | number | boolean | string[];
+                    field: "path" | "agentDid" | "clientDid" | "method" | "confidence" | "agentType" | "agentName" | "agentVendor" | "reputationScore" | "riskLevel" | "origin" | "userAgent" | "signatureVerified" | "isAuthenticated" | "hasValidDelegation";
+                    operator: "equals" | "notEquals" | "contains" | "notContains" | "startsWith" | "endsWith" | "greaterThan" | "lessThan" | "greaterThanOrEquals" | "lessThanOrEquals" | "matches" | "in" | "notIn";
+                    caseInsensitive?: boolean | undefined;
+                }[];
+                message?: string | undefined;
+                metadata?: {
+                    createdAt?: string | undefined;
+                    updatedAt?: string | undefined;
+                    createdBy?: string | undefined;
+                } | undefined;
+                description?: string | undefined;
+                redirectUrl?: string | undefined;
+            }, {
+                name: string;
+                id: string;
+                action: "challenge" | "allow" | "block" | "redirect" | "log";
+                conditions: {
+                    value: string | number | boolean | string[];
+                    field: "path" | "agentDid" | "clientDid" | "method" | "confidence" | "agentType" | "agentName" | "agentVendor" | "reputationScore" | "riskLevel" | "origin" | "userAgent" | "signatureVerified" | "isAuthenticated" | "hasValidDelegation";
+                    operator: "equals" | "notEquals" | "contains" | "notContains" | "startsWith" | "endsWith" | "greaterThan" | "lessThan" | "greaterThanOrEquals" | "lessThanOrEquals" | "matches" | "in" | "notIn";
+                    caseInsensitive?: boolean | undefined;
+                }[];
+                message?: string | undefined;
+                metadata?: {
+                    createdAt?: string | undefined;
+                    updatedAt?: string | undefined;
+                    createdBy?: string | undefined;
+                } | undefined;
+                enabled?: boolean | undefined;
+                description?: string | undefined;
+                priority?: number | undefined;
+                redirectUrl?: string | undefined;
+            }>, "many">>;
+            /** Paths to exclude from policy enforcement (glob patterns supported) */
+            excludedPaths: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+            /** Paths to include (if set, only these paths are enforced) */
+            includedPaths: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            /** Metadata for the policy configuration */
+            metadata: z.ZodOptional<z.ZodObject<{
+                lastUpdated: z.ZodOptional<z.ZodString>;
+                updatedBy: z.ZodOptional<z.ZodString>;
+                policyId: z.ZodOptional<z.ZodString>;
+            }, "strip", z.ZodTypeAny, {
+                lastUpdated?: string | undefined;
+                updatedBy?: string | undefined;
+                policyId?: string | undefined;
+            }, {
+                lastUpdated?: string | undefined;
+                updatedBy?: string | undefined;
+                policyId?: string | undefined;
+            }>>;
+        }, "strip", z.ZodTypeAny, {
+            version: string;
+            enabled: boolean;
+            defaultAction: "challenge" | "allow" | "block" | "redirect" | "log";
+            thresholds: {
+                confidenceThreshold: number;
+                confidenceAction: "challenge" | "allow" | "block" | "redirect" | "log";
+                minReputationScore: number;
+                lowReputationAction: "challenge" | "allow" | "block" | "redirect" | "log";
+                trustedReputationThreshold: number;
+                trustSignedRequests: boolean;
+            };
+            denyList: {
+                active: boolean;
+                agentDid?: string | undefined;
+                clientDid?: string | undefined;
+                expiresAt?: string | undefined;
+                reason?: string | undefined;
+                clientName?: string | undefined;
+                agentType?: string | undefined;
+                blockedAt?: string | undefined;
+                addedBy?: string | undefined;
+            }[];
+            allowList: {
+                agentDid?: string | undefined;
+                clientDid?: string | undefined;
+                reason?: string | undefined;
+                clientName?: string | undefined;
+                agentType?: string | undefined;
+                addedBy?: string | undefined;
+                addedAt?: string | undefined;
+            }[];
+            rules: {
+                name: string;
+                id: string;
+                enabled: boolean;
+                action: "challenge" | "allow" | "block" | "redirect" | "log";
+                priority: number;
+                conditions: {
+                    value: string | number | boolean | string[];
+                    field: "path" | "agentDid" | "clientDid" | "method" | "confidence" | "agentType" | "agentName" | "agentVendor" | "reputationScore" | "riskLevel" | "origin" | "userAgent" | "signatureVerified" | "isAuthenticated" | "hasValidDelegation";
+                    operator: "equals" | "notEquals" | "contains" | "notContains" | "startsWith" | "endsWith" | "greaterThan" | "lessThan" | "greaterThanOrEquals" | "lessThanOrEquals" | "matches" | "in" | "notIn";
+                    caseInsensitive?: boolean | undefined;
+                }[];
+                message?: string | undefined;
+                metadata?: {
+                    createdAt?: string | undefined;
+                    updatedAt?: string | undefined;
+                    createdBy?: string | undefined;
+                } | undefined;
+                description?: string | undefined;
+                redirectUrl?: string | undefined;
+            }[];
+            excludedPaths: string[];
+            metadata?: {
+                lastUpdated?: string | undefined;
+                updatedBy?: string | undefined;
+                policyId?: string | undefined;
+            } | undefined;
+            redirectUrl?: string | undefined;
+            includedPaths?: string[] | undefined;
+        }, {
+            metadata?: {
+                lastUpdated?: string | undefined;
+                updatedBy?: string | undefined;
+                policyId?: string | undefined;
+            } | undefined;
+            version?: string | undefined;
+            enabled?: boolean | undefined;
+            redirectUrl?: string | undefined;
+            defaultAction?: "challenge" | "allow" | "block" | "redirect" | "log" | undefined;
+            thresholds?: {
+                confidenceThreshold?: number | undefined;
+                confidenceAction?: "challenge" | "allow" | "block" | "redirect" | "log" | undefined;
+                minReputationScore?: number | undefined;
+                lowReputationAction?: "challenge" | "allow" | "block" | "redirect" | "log" | undefined;
+                trustedReputationThreshold?: number | undefined;
+                trustSignedRequests?: boolean | undefined;
+            } | undefined;
+            denyList?: {
+                agentDid?: string | undefined;
+                clientDid?: string | undefined;
+                expiresAt?: string | undefined;
+                reason?: string | undefined;
+                active?: boolean | undefined;
+                clientName?: string | undefined;
+                agentType?: string | undefined;
+                blockedAt?: string | undefined;
+                addedBy?: string | undefined;
+            }[] | undefined;
+            allowList?: {
+                agentDid?: string | undefined;
+                clientDid?: string | undefined;
+                reason?: string | undefined;
+                clientName?: string | undefined;
+                agentType?: string | undefined;
+                addedBy?: string | undefined;
+                addedAt?: string | undefined;
+            }[] | undefined;
+            rules?: {
+                name: string;
+                id: string;
+                action: "challenge" | "allow" | "block" | "redirect" | "log";
+                conditions: {
+                    value: string | number | boolean | string[];
+                    field: "path" | "agentDid" | "clientDid" | "method" | "confidence" | "agentType" | "agentName" | "agentVendor" | "reputationScore" | "riskLevel" | "origin" | "userAgent" | "signatureVerified" | "isAuthenticated" | "hasValidDelegation";
+                    operator: "equals" | "notEquals" | "contains" | "notContains" | "startsWith" | "endsWith" | "greaterThan" | "lessThan" | "greaterThanOrEquals" | "lessThanOrEquals" | "matches" | "in" | "notIn";
+                    caseInsensitive?: boolean | undefined;
+                }[];
+                message?: string | undefined;
+                metadata?: {
+                    createdAt?: string | undefined;
+                    updatedAt?: string | undefined;
+                    createdBy?: string | undefined;
+                } | undefined;
+                enabled?: boolean | undefined;
+                description?: string | undefined;
+                priority?: number | undefined;
+                redirectUrl?: string | undefined;
+            }[] | undefined;
+            excludedPaths?: string[] | undefined;
+            includedPaths?: string[] | undefined;
+        }>, {
+            version: string;
+            enabled: boolean;
+            defaultAction: "challenge" | "allow" | "block" | "redirect" | "log";
+            thresholds: {
+                confidenceThreshold: number;
+                confidenceAction: "challenge" | "allow" | "block" | "redirect" | "log";
+                minReputationScore: number;
+                lowReputationAction: "challenge" | "allow" | "block" | "redirect" | "log";
+                trustedReputationThreshold: number;
+                trustSignedRequests: boolean;
+            };
+            denyList: {
+                active: boolean;
+                agentDid?: string | undefined;
+                clientDid?: string | undefined;
+                expiresAt?: string | undefined;
+                reason?: string | undefined;
+                clientName?: string | undefined;
+                agentType?: string | undefined;
+                blockedAt?: string | undefined;
+                addedBy?: string | undefined;
+            }[];
+            allowList: {
+                agentDid?: string | undefined;
+                clientDid?: string | undefined;
+                reason?: string | undefined;
+                clientName?: string | undefined;
+                agentType?: string | undefined;
+                addedBy?: string | undefined;
+                addedAt?: string | undefined;
+            }[];
+            rules: {
+                name: string;
+                id: string;
+                enabled: boolean;
+                action: "challenge" | "allow" | "block" | "redirect" | "log";
+                priority: number;
+                conditions: {
+                    value: string | number | boolean | string[];
+                    field: "path" | "agentDid" | "clientDid" | "method" | "confidence" | "agentType" | "agentName" | "agentVendor" | "reputationScore" | "riskLevel" | "origin" | "userAgent" | "signatureVerified" | "isAuthenticated" | "hasValidDelegation";
+                    operator: "equals" | "notEquals" | "contains" | "notContains" | "startsWith" | "endsWith" | "greaterThan" | "lessThan" | "greaterThanOrEquals" | "lessThanOrEquals" | "matches" | "in" | "notIn";
+                    caseInsensitive?: boolean | undefined;
+                }[];
+                message?: string | undefined;
+                metadata?: {
+                    createdAt?: string | undefined;
+                    updatedAt?: string | undefined;
+                    createdBy?: string | undefined;
+                } | undefined;
+                description?: string | undefined;
+                redirectUrl?: string | undefined;
+            }[];
+            excludedPaths: string[];
+            metadata?: {
+                lastUpdated?: string | undefined;
+                updatedBy?: string | undefined;
+                policyId?: string | undefined;
+            } | undefined;
+            redirectUrl?: string | undefined;
+            includedPaths?: string[] | undefined;
+        }, {
+            metadata?: {
+                lastUpdated?: string | undefined;
+                updatedBy?: string | undefined;
+                policyId?: string | undefined;
+            } | undefined;
+            version?: string | undefined;
+            enabled?: boolean | undefined;
+            redirectUrl?: string | undefined;
+            defaultAction?: "challenge" | "allow" | "block" | "redirect" | "log" | undefined;
+            thresholds?: {
+                confidenceThreshold?: number | undefined;
+                confidenceAction?: "challenge" | "allow" | "block" | "redirect" | "log" | undefined;
+                minReputationScore?: number | undefined;
+                lowReputationAction?: "challenge" | "allow" | "block" | "redirect" | "log" | undefined;
+                trustedReputationThreshold?: number | undefined;
+                trustSignedRequests?: boolean | undefined;
+            } | undefined;
+            denyList?: {
+                agentDid?: string | undefined;
+                clientDid?: string | undefined;
+                expiresAt?: string | undefined;
+                reason?: string | undefined;
+                active?: boolean | undefined;
+                clientName?: string | undefined;
+                agentType?: string | undefined;
+                blockedAt?: string | undefined;
+                addedBy?: string | undefined;
+            }[] | undefined;
+            allowList?: {
+                agentDid?: string | undefined;
+                clientDid?: string | undefined;
+                reason?: string | undefined;
+                clientName?: string | undefined;
+                agentType?: string | undefined;
+                addedBy?: string | undefined;
+                addedAt?: string | undefined;
+            }[] | undefined;
+            rules?: {
+                name: string;
+                id: string;
+                action: "challenge" | "allow" | "block" | "redirect" | "log";
+                conditions: {
+                    value: string | number | boolean | string[];
+                    field: "path" | "agentDid" | "clientDid" | "method" | "confidence" | "agentType" | "agentName" | "agentVendor" | "reputationScore" | "riskLevel" | "origin" | "userAgent" | "signatureVerified" | "isAuthenticated" | "hasValidDelegation";
+                    operator: "equals" | "notEquals" | "contains" | "notContains" | "startsWith" | "endsWith" | "greaterThan" | "lessThan" | "greaterThanOrEquals" | "lessThanOrEquals" | "matches" | "in" | "notIn";
+                    caseInsensitive?: boolean | undefined;
+                }[];
+                message?: string | undefined;
+                metadata?: {
+                    createdAt?: string | undefined;
+                    updatedAt?: string | undefined;
+                    createdBy?: string | undefined;
+                } | undefined;
+                enabled?: boolean | undefined;
+                description?: string | undefined;
+                priority?: number | undefined;
+                redirectUrl?: string | undefined;
+            }[] | undefined;
+            excludedPaths?: string[] | undefined;
+            includedPaths?: string[] | undefined;
+        }>;
+    }, "strip", z.ZodTypeAny, {
+        policy: {
+            version: string;
+            enabled: boolean;
+            defaultAction: "challenge" | "allow" | "block" | "redirect" | "log";
+            thresholds: {
+                confidenceThreshold: number;
+                confidenceAction: "challenge" | "allow" | "block" | "redirect" | "log";
+                minReputationScore: number;
+                lowReputationAction: "challenge" | "allow" | "block" | "redirect" | "log";
+                trustedReputationThreshold: number;
+                trustSignedRequests: boolean;
+            };
+            denyList: {
+                active: boolean;
+                agentDid?: string | undefined;
+                clientDid?: string | undefined;
+                expiresAt?: string | undefined;
+                reason?: string | undefined;
+                clientName?: string | undefined;
+                agentType?: string | undefined;
+                blockedAt?: string | undefined;
+                addedBy?: string | undefined;
+            }[];
+            allowList: {
+                agentDid?: string | undefined;
+                clientDid?: string | undefined;
+                reason?: string | undefined;
+                clientName?: string | undefined;
+                agentType?: string | undefined;
+                addedBy?: string | undefined;
+                addedAt?: string | undefined;
+            }[];
+            rules: {
+                name: string;
+                id: string;
+                enabled: boolean;
+                action: "challenge" | "allow" | "block" | "redirect" | "log";
+                priority: number;
+                conditions: {
+                    value: string | number | boolean | string[];
+                    field: "path" | "agentDid" | "clientDid" | "method" | "confidence" | "agentType" | "agentName" | "agentVendor" | "reputationScore" | "riskLevel" | "origin" | "userAgent" | "signatureVerified" | "isAuthenticated" | "hasValidDelegation";
+                    operator: "equals" | "notEquals" | "contains" | "notContains" | "startsWith" | "endsWith" | "greaterThan" | "lessThan" | "greaterThanOrEquals" | "lessThanOrEquals" | "matches" | "in" | "notIn";
+                    caseInsensitive?: boolean | undefined;
+                }[];
+                message?: string | undefined;
+                metadata?: {
+                    createdAt?: string | undefined;
+                    updatedAt?: string | undefined;
+                    createdBy?: string | undefined;
+                } | undefined;
+                description?: string | undefined;
+                redirectUrl?: string | undefined;
+            }[];
+            excludedPaths: string[];
+            metadata?: {
+                lastUpdated?: string | undefined;
+                updatedBy?: string | undefined;
+                policyId?: string | undefined;
+            } | undefined;
+            redirectUrl?: string | undefined;
+            includedPaths?: string[] | undefined;
+        };
+    }, {
+        policy: {
+            metadata?: {
+                lastUpdated?: string | undefined;
+                updatedBy?: string | undefined;
+                policyId?: string | undefined;
+            } | undefined;
+            version?: string | undefined;
+            enabled?: boolean | undefined;
+            redirectUrl?: string | undefined;
+            defaultAction?: "challenge" | "allow" | "block" | "redirect" | "log" | undefined;
+            thresholds?: {
+                confidenceThreshold?: number | undefined;
+                confidenceAction?: "challenge" | "allow" | "block" | "redirect" | "log" | undefined;
+                minReputationScore?: number | undefined;
+                lowReputationAction?: "challenge" | "allow" | "block" | "redirect" | "log" | undefined;
+                trustedReputationThreshold?: number | undefined;
+                trustSignedRequests?: boolean | undefined;
+            } | undefined;
+            denyList?: {
+                agentDid?: string | undefined;
+                clientDid?: string | undefined;
+                expiresAt?: string | undefined;
+                reason?: string | undefined;
+                active?: boolean | undefined;
+                clientName?: string | undefined;
+                agentType?: string | undefined;
+                blockedAt?: string | undefined;
+                addedBy?: string | undefined;
+            }[] | undefined;
+            allowList?: {
+                agentDid?: string | undefined;
+                clientDid?: string | undefined;
+                reason?: string | undefined;
+                clientName?: string | undefined;
+                agentType?: string | undefined;
+                addedBy?: string | undefined;
+                addedAt?: string | undefined;
+            }[] | undefined;
+            rules?: {
+                name: string;
+                id: string;
+                action: "challenge" | "allow" | "block" | "redirect" | "log";
+                conditions: {
+                    value: string | number | boolean | string[];
+                    field: "path" | "agentDid" | "clientDid" | "method" | "confidence" | "agentType" | "agentName" | "agentVendor" | "reputationScore" | "riskLevel" | "origin" | "userAgent" | "signatureVerified" | "isAuthenticated" | "hasValidDelegation";
+                    operator: "equals" | "notEquals" | "contains" | "notContains" | "startsWith" | "endsWith" | "greaterThan" | "lessThan" | "greaterThanOrEquals" | "lessThanOrEquals" | "matches" | "in" | "notIn";
+                    caseInsensitive?: boolean | undefined;
+                }[];
+                message?: string | undefined;
+                metadata?: {
+                    createdAt?: string | undefined;
+                    updatedAt?: string | undefined;
+                    createdBy?: string | undefined;
+                } | undefined;
+                enabled?: boolean | undefined;
+                description?: string | undefined;
+                priority?: number | undefined;
+                redirectUrl?: string | undefined;
+            }[] | undefined;
+            excludedPaths?: string[] | undefined;
+            includedPaths?: string[] | undefined;
+        };
+    }>;
+    metadata: z.ZodOptional<z.ZodObject<{
+        requestId: z.ZodOptional<z.ZodString>;
+        timestamp: z.ZodOptional<z.ZodString>;
+        cachedUntil: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        timestamp?: string | undefined;
+        requestId?: string | undefined;
+        cachedUntil?: string | undefined;
+    }, {
+        timestamp?: string | undefined;
+        requestId?: string | undefined;
+        cachedUntil?: string | undefined;
+    }>>;
+}, "strip", z.ZodTypeAny, {
+    success: boolean;
+    data: {
+        policy: {
+            version: string;
+            enabled: boolean;
+            defaultAction: "challenge" | "allow" | "block" | "redirect" | "log";
+            thresholds: {
+                confidenceThreshold: number;
+                confidenceAction: "challenge" | "allow" | "block" | "redirect" | "log";
+                minReputationScore: number;
+                lowReputationAction: "challenge" | "allow" | "block" | "redirect" | "log";
+                trustedReputationThreshold: number;
+                trustSignedRequests: boolean;
+            };
+            denyList: {
+                active: boolean;
+                agentDid?: string | undefined;
+                clientDid?: string | undefined;
+                expiresAt?: string | undefined;
+                reason?: string | undefined;
+                clientName?: string | undefined;
+                agentType?: string | undefined;
+                blockedAt?: string | undefined;
+                addedBy?: string | undefined;
+            }[];
+            allowList: {
+                agentDid?: string | undefined;
+                clientDid?: string | undefined;
+                reason?: string | undefined;
+                clientName?: string | undefined;
+                agentType?: string | undefined;
+                addedBy?: string | undefined;
+                addedAt?: string | undefined;
+            }[];
+            rules: {
+                name: string;
+                id: string;
+                enabled: boolean;
+                action: "challenge" | "allow" | "block" | "redirect" | "log";
+                priority: number;
+                conditions: {
+                    value: string | number | boolean | string[];
+                    field: "path" | "agentDid" | "clientDid" | "method" | "confidence" | "agentType" | "agentName" | "agentVendor" | "reputationScore" | "riskLevel" | "origin" | "userAgent" | "signatureVerified" | "isAuthenticated" | "hasValidDelegation";
+                    operator: "equals" | "notEquals" | "contains" | "notContains" | "startsWith" | "endsWith" | "greaterThan" | "lessThan" | "greaterThanOrEquals" | "lessThanOrEquals" | "matches" | "in" | "notIn";
+                    caseInsensitive?: boolean | undefined;
+                }[];
+                message?: string | undefined;
+                metadata?: {
+                    createdAt?: string | undefined;
+                    updatedAt?: string | undefined;
+                    createdBy?: string | undefined;
+                } | undefined;
+                description?: string | undefined;
+                redirectUrl?: string | undefined;
+            }[];
+            excludedPaths: string[];
+            metadata?: {
+                lastUpdated?: string | undefined;
+                updatedBy?: string | undefined;
+                policyId?: string | undefined;
+            } | undefined;
+            redirectUrl?: string | undefined;
+            includedPaths?: string[] | undefined;
+        };
+    };
+    metadata?: {
+        timestamp?: string | undefined;
+        requestId?: string | undefined;
+        cachedUntil?: string | undefined;
+    } | undefined;
+}, {
+    success: boolean;
+    data: {
+        policy: {
+            metadata?: {
+                lastUpdated?: string | undefined;
+                updatedBy?: string | undefined;
+                policyId?: string | undefined;
+            } | undefined;
+            version?: string | undefined;
+            enabled?: boolean | undefined;
+            redirectUrl?: string | undefined;
+            defaultAction?: "challenge" | "allow" | "block" | "redirect" | "log" | undefined;
+            thresholds?: {
+                confidenceThreshold?: number | undefined;
+                confidenceAction?: "challenge" | "allow" | "block" | "redirect" | "log" | undefined;
+                minReputationScore?: number | undefined;
+                lowReputationAction?: "challenge" | "allow" | "block" | "redirect" | "log" | undefined;
+                trustedReputationThreshold?: number | undefined;
+                trustSignedRequests?: boolean | undefined;
+            } | undefined;
+            denyList?: {
+                agentDid?: string | undefined;
+                clientDid?: string | undefined;
+                expiresAt?: string | undefined;
+                reason?: string | undefined;
+                active?: boolean | undefined;
+                clientName?: string | undefined;
+                agentType?: string | undefined;
+                blockedAt?: string | undefined;
+                addedBy?: string | undefined;
+            }[] | undefined;
+            allowList?: {
+                agentDid?: string | undefined;
+                clientDid?: string | undefined;
+                reason?: string | undefined;
+                clientName?: string | undefined;
+                agentType?: string | undefined;
+                addedBy?: string | undefined;
+                addedAt?: string | undefined;
+            }[] | undefined;
+            rules?: {
+                name: string;
+                id: string;
+                action: "challenge" | "allow" | "block" | "redirect" | "log";
+                conditions: {
+                    value: string | number | boolean | string[];
+                    field: "path" | "agentDid" | "clientDid" | "method" | "confidence" | "agentType" | "agentName" | "agentVendor" | "reputationScore" | "riskLevel" | "origin" | "userAgent" | "signatureVerified" | "isAuthenticated" | "hasValidDelegation";
+                    operator: "equals" | "notEquals" | "contains" | "notContains" | "startsWith" | "endsWith" | "greaterThan" | "lessThan" | "greaterThanOrEquals" | "lessThanOrEquals" | "matches" | "in" | "notIn";
+                    caseInsensitive?: boolean | undefined;
+                }[];
+                message?: string | undefined;
+                metadata?: {
+                    createdAt?: string | undefined;
+                    updatedAt?: string | undefined;
+                    createdBy?: string | undefined;
+                } | undefined;
+                enabled?: boolean | undefined;
+                description?: string | undefined;
+                priority?: number | undefined;
+                redirectUrl?: string | undefined;
+            }[] | undefined;
+            excludedPaths?: string[] | undefined;
+            includedPaths?: string[] | undefined;
+        };
+    };
+    metadata?: {
+        timestamp?: string | undefined;
+        requestId?: string | undefined;
+        cachedUntil?: string | undefined;
+    } | undefined;
+}>;
+export type GetPolicyResponse = z.infer<typeof GetPolicyResponseSchema>;
+/**
+ * Request to update policy configuration
+ */
+export declare const UpdatePolicyRequestSchema: z.ZodObject<{
+    projectId: z.ZodString;
+    policy: z.ZodObject<{
+        version: z.ZodOptional<z.ZodDefault<z.ZodString>>;
+        enabled: z.ZodOptional<z.ZodDefault<z.ZodBoolean>>;
+        defaultAction: z.ZodOptional<z.ZodDefault<z.ZodEnum<["allow", "block", "redirect", "challenge", "log"]>>>;
+        redirectUrl: z.ZodOptional<z.ZodOptional<z.ZodString>>;
+        thresholds: z.ZodOptional<z.ZodDefault<z.ZodObject<{
+            /**
+             * Detection confidence threshold (0-100)
+             * Agents detected with confidence >= this value trigger the configured action
+             * @default 80
+             */
+            confidenceThreshold: z.ZodDefault<z.ZodNumber>;
+            /**
+             * Action to take when confidence threshold is exceeded
+             * @default 'block'
+             */
+            confidenceAction: z.ZodDefault<z.ZodEnum<["allow", "block", "redirect", "challenge", "log"]>>;
+            /**
+             * Minimum reputation score (0-100) required to allow access
+             * Agents with reputation < this value may be blocked/challenged
+             * Set to 0 to disable reputation-based enforcement
+             * @default 0
+             */
+            minReputationScore: z.ZodDefault<z.ZodNumber>;
+            /**
+             * Action to take when reputation is below threshold
+             * @default 'challenge'
+             */
+            lowReputationAction: z.ZodDefault<z.ZodEnum<["allow", "block", "redirect", "challenge", "log"]>>;
+            /**
+             * High reputation score threshold (0-100)
+             * Agents with reputation >= this value are trusted and bypass other checks
+             * @default 90
+             */
+            trustedReputationThreshold: z.ZodDefault<z.ZodNumber>;
+            /**
+             * Whether cryptographically signed requests (MCP-I verified) bypass thresholds
+             * @default true
+             */
+            trustSignedRequests: z.ZodDefault<z.ZodBoolean>;
+        }, "strip", z.ZodTypeAny, {
+            confidenceThreshold: number;
+            confidenceAction: "challenge" | "allow" | "block" | "redirect" | "log";
+            minReputationScore: number;
+            lowReputationAction: "challenge" | "allow" | "block" | "redirect" | "log";
+            trustedReputationThreshold: number;
+            trustSignedRequests: boolean;
+        }, {
+            confidenceThreshold?: number | undefined;
+            confidenceAction?: "challenge" | "allow" | "block" | "redirect" | "log" | undefined;
+            minReputationScore?: number | undefined;
+            lowReputationAction?: "challenge" | "allow" | "block" | "redirect" | "log" | undefined;
+            trustedReputationThreshold?: number | undefined;
+            trustSignedRequests?: boolean | undefined;
+        }>>>;
+        denyList: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodEffects<z.ZodObject<{
+            /** MCP-I client DID (e.g., "did:key:z6Mk...") */
+            clientDid: z.ZodOptional<z.ZodString>;
+            /** Agent DID from MCP-I identity */
+            agentDid: z.ZodOptional<z.ZodString>;
+            /** Human-readable client name (e.g., "Perplexity", "ChatGPT") */
+            clientName: z.ZodOptional<z.ZodString>;
+            /** Agent type to block (e.g., "ai_agent", "bot", "scraper") */
+            agentType: z.ZodOptional<z.ZodString>;
+            /** Reason for denial (shown to user/logged) */
+            reason: z.ZodOptional<z.ZodString>;
+            /** ISO 8601 timestamp when entry was added */
+            blockedAt: z.ZodOptional<z.ZodString>;
+            /** Who added this entry (user ID or "system") */
+            addedBy: z.ZodOptional<z.ZodString>;
+            /** Whether this entry is currently active */
+            active: z.ZodDefault<z.ZodBoolean>;
+            /** Optional expiration date for temporary blocks */
+            expiresAt: z.ZodOptional<z.ZodString>;
+        }, "strip", z.ZodTypeAny, {
+            active: boolean;
+            agentDid?: string | undefined;
+            clientDid?: string | undefined;
+            expiresAt?: string | undefined;
+            reason?: string | undefined;
+            clientName?: string | undefined;
+            agentType?: string | undefined;
+            blockedAt?: string | undefined;
+            addedBy?: string | undefined;
+        }, {
+            agentDid?: string | undefined;
+            clientDid?: string | undefined;
+            expiresAt?: string | undefined;
+            reason?: string | undefined;
+            active?: boolean | undefined;
+            clientName?: string | undefined;
+            agentType?: string | undefined;
+            blockedAt?: string | undefined;
+            addedBy?: string | undefined;
+        }>, {
+            active: boolean;
+            agentDid?: string | undefined;
+            clientDid?: string | undefined;
+            expiresAt?: string | undefined;
+            reason?: string | undefined;
+            clientName?: string | undefined;
+            agentType?: string | undefined;
+            blockedAt?: string | undefined;
+            addedBy?: string | undefined;
+        }, {
+            agentDid?: string | undefined;
+            clientDid?: string | undefined;
+            expiresAt?: string | undefined;
+            reason?: string | undefined;
+            active?: boolean | undefined;
+            clientName?: string | undefined;
+            agentType?: string | undefined;
+            blockedAt?: string | undefined;
+            addedBy?: string | undefined;
+        }>, "many">>>;
+        allowList: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodEffects<z.ZodObject<{
+            /** MCP-I client DID (e.g., "did:key:z6Mk...") */
+            clientDid: z.ZodOptional<z.ZodString>;
+            /** Agent DID from MCP-I identity */
+            agentDid: z.ZodOptional<z.ZodString>;
+            /** Human-readable client name (e.g., "Perplexity", "ChatGPT") */
+            clientName: z.ZodOptional<z.ZodString>;
+            /** Agent type to allow (e.g., "ai_agent", "verified_bot") */
+            agentType: z.ZodOptional<z.ZodString>;
+            /** Reason for allowing (documentation) */
+            reason: z.ZodOptional<z.ZodString>;
+            /** ISO 8601 timestamp when entry was added */
+            addedAt: z.ZodOptional<z.ZodString>;
+            /** Who added this entry */
+            addedBy: z.ZodOptional<z.ZodString>;
+        }, "strip", z.ZodTypeAny, {
+            agentDid?: string | undefined;
+            clientDid?: string | undefined;
+            reason?: string | undefined;
+            clientName?: string | undefined;
+            agentType?: string | undefined;
+            addedBy?: string | undefined;
+            addedAt?: string | undefined;
+        }, {
+            agentDid?: string | undefined;
+            clientDid?: string | undefined;
+            reason?: string | undefined;
+            clientName?: string | undefined;
+            agentType?: string | undefined;
+            addedBy?: string | undefined;
+            addedAt?: string | undefined;
+        }>, {
+            agentDid?: string | undefined;
+            clientDid?: string | undefined;
+            reason?: string | undefined;
+            clientName?: string | undefined;
+            agentType?: string | undefined;
+            addedBy?: string | undefined;
+            addedAt?: string | undefined;
+        }, {
+            agentDid?: string | undefined;
+            clientDid?: string | undefined;
+            reason?: string | undefined;
+            clientName?: string | undefined;
+            agentType?: string | undefined;
+            addedBy?: string | undefined;
+            addedAt?: string | undefined;
+        }>, "many">>>;
+        rules: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodEffects<z.ZodObject<{
+            /** Unique identifier for this rule */
+            id: z.ZodString;
+            /** Human-readable name */
+            name: z.ZodString;
+            /** Description of what this rule does */
+            description: z.ZodOptional<z.ZodString>;
+            /** Priority (lower = higher priority, evaluated first) */
+            priority: z.ZodDefault<z.ZodNumber>;
+            /**
+             * Conditions that must ALL match for this rule to apply (AND logic)
+             * For OR logic, create multiple rules with same action
+             */
+            conditions: z.ZodArray<z.ZodObject<{
+                /** Field to match against */
+                field: z.ZodEnum<["agentType", "agentName", "agentVendor", "clientDid", "agentDid", "confidence", "reputationScore", "riskLevel", "path", "method", "origin", "userAgent", "signatureVerified", "isAuthenticated", "hasValidDelegation"]>;
+                /** Comparison operator */
+                operator: z.ZodEnum<["equals", "notEquals", "contains", "notContains", "startsWith", "endsWith", "greaterThan", "lessThan", "greaterThanOrEquals", "lessThanOrEquals", "matches", "in", "notIn"]>;
+                /** Value to compare against */
+                value: z.ZodUnion<[z.ZodString, z.ZodNumber, z.ZodBoolean, z.ZodArray<z.ZodString, "many">]>;
+                /** Whether this condition is case-insensitive (for string comparisons) */
+                caseInsensitive: z.ZodOptional<z.ZodBoolean>;
+            }, "strip", z.ZodTypeAny, {
+                value: string | number | boolean | string[];
+                field: "path" | "agentDid" | "clientDid" | "method" | "confidence" | "agentType" | "agentName" | "agentVendor" | "reputationScore" | "riskLevel" | "origin" | "userAgent" | "signatureVerified" | "isAuthenticated" | "hasValidDelegation";
+                operator: "equals" | "notEquals" | "contains" | "notContains" | "startsWith" | "endsWith" | "greaterThan" | "lessThan" | "greaterThanOrEquals" | "lessThanOrEquals" | "matches" | "in" | "notIn";
+                caseInsensitive?: boolean | undefined;
+            }, {
+                value: string | number | boolean | string[];
+                field: "path" | "agentDid" | "clientDid" | "method" | "confidence" | "agentType" | "agentName" | "agentVendor" | "reputationScore" | "riskLevel" | "origin" | "userAgent" | "signatureVerified" | "isAuthenticated" | "hasValidDelegation";
+                operator: "equals" | "notEquals" | "contains" | "notContains" | "startsWith" | "endsWith" | "greaterThan" | "lessThan" | "greaterThanOrEquals" | "lessThanOrEquals" | "matches" | "in" | "notIn";
+                caseInsensitive?: boolean | undefined;
+            }>, "many">;
+            /** Action to take when conditions match */
+            action: z.ZodEnum<["allow", "block", "redirect", "challenge", "log"]>;
+            /** Redirect URL (required if action is 'redirect') */
+            redirectUrl: z.ZodOptional<z.ZodString>;
+            /** Custom message to show/log */
+            message: z.ZodOptional<z.ZodString>;
+            /** Whether this rule is currently active */
+            enabled: z.ZodDefault<z.ZodBoolean>;
+            /** Metadata for auditing */
+            metadata: z.ZodOptional<z.ZodObject<{
+                createdAt: z.ZodOptional<z.ZodString>;
+                updatedAt: z.ZodOptional<z.ZodString>;
+                createdBy: z.ZodOptional<z.ZodString>;
+            }, "strip", z.ZodTypeAny, {
+                createdAt?: string | undefined;
+                updatedAt?: string | undefined;
+                createdBy?: string | undefined;
+            }, {
+                createdAt?: string | undefined;
+                updatedAt?: string | undefined;
+                createdBy?: string | undefined;
+            }>>;
+        }, "strip", z.ZodTypeAny, {
+            name: string;
+            id: string;
+            enabled: boolean;
+            action: "challenge" | "allow" | "block" | "redirect" | "log";
+            priority: number;
+            conditions: {
+                value: string | number | boolean | string[];
+                field: "path" | "agentDid" | "clientDid" | "method" | "confidence" | "agentType" | "agentName" | "agentVendor" | "reputationScore" | "riskLevel" | "origin" | "userAgent" | "signatureVerified" | "isAuthenticated" | "hasValidDelegation";
+                operator: "equals" | "notEquals" | "contains" | "notContains" | "startsWith" | "endsWith" | "greaterThan" | "lessThan" | "greaterThanOrEquals" | "lessThanOrEquals" | "matches" | "in" | "notIn";
+                caseInsensitive?: boolean | undefined;
+            }[];
+            message?: string | undefined;
+            metadata?: {
+                createdAt?: string | undefined;
+                updatedAt?: string | undefined;
+                createdBy?: string | undefined;
+            } | undefined;
+            description?: string | undefined;
+            redirectUrl?: string | undefined;
+        }, {
+            name: string;
+            id: string;
+            action: "challenge" | "allow" | "block" | "redirect" | "log";
+            conditions: {
+                value: string | number | boolean | string[];
+                field: "path" | "agentDid" | "clientDid" | "method" | "confidence" | "agentType" | "agentName" | "agentVendor" | "reputationScore" | "riskLevel" | "origin" | "userAgent" | "signatureVerified" | "isAuthenticated" | "hasValidDelegation";
+                operator: "equals" | "notEquals" | "contains" | "notContains" | "startsWith" | "endsWith" | "greaterThan" | "lessThan" | "greaterThanOrEquals" | "lessThanOrEquals" | "matches" | "in" | "notIn";
+                caseInsensitive?: boolean | undefined;
+            }[];
+            message?: string | undefined;
+            metadata?: {
+                createdAt?: string | undefined;
+                updatedAt?: string | undefined;
+                createdBy?: string | undefined;
+            } | undefined;
+            enabled?: boolean | undefined;
+            description?: string | undefined;
+            priority?: number | undefined;
+            redirectUrl?: string | undefined;
+        }>, {
+            name: string;
+            id: string;
+            enabled: boolean;
+            action: "challenge" | "allow" | "block" | "redirect" | "log";
+            priority: number;
+            conditions: {
+                value: string | number | boolean | string[];
+                field: "path" | "agentDid" | "clientDid" | "method" | "confidence" | "agentType" | "agentName" | "agentVendor" | "reputationScore" | "riskLevel" | "origin" | "userAgent" | "signatureVerified" | "isAuthenticated" | "hasValidDelegation";
+                operator: "equals" | "notEquals" | "contains" | "notContains" | "startsWith" | "endsWith" | "greaterThan" | "lessThan" | "greaterThanOrEquals" | "lessThanOrEquals" | "matches" | "in" | "notIn";
+                caseInsensitive?: boolean | undefined;
+            }[];
+            message?: string | undefined;
+            metadata?: {
+                createdAt?: string | undefined;
+                updatedAt?: string | undefined;
+                createdBy?: string | undefined;
+            } | undefined;
+            description?: string | undefined;
+            redirectUrl?: string | undefined;
+        }, {
+            name: string;
+            id: string;
+            action: "challenge" | "allow" | "block" | "redirect" | "log";
+            conditions: {
+                value: string | number | boolean | string[];
+                field: "path" | "agentDid" | "clientDid" | "method" | "confidence" | "agentType" | "agentName" | "agentVendor" | "reputationScore" | "riskLevel" | "origin" | "userAgent" | "signatureVerified" | "isAuthenticated" | "hasValidDelegation";
+                operator: "equals" | "notEquals" | "contains" | "notContains" | "startsWith" | "endsWith" | "greaterThan" | "lessThan" | "greaterThanOrEquals" | "lessThanOrEquals" | "matches" | "in" | "notIn";
+                caseInsensitive?: boolean | undefined;
+            }[];
+            message?: string | undefined;
+            metadata?: {
+                createdAt?: string | undefined;
+                updatedAt?: string | undefined;
+                createdBy?: string | undefined;
+            } | undefined;
+            enabled?: boolean | undefined;
+            description?: string | undefined;
+            priority?: number | undefined;
+            redirectUrl?: string | undefined;
+        }>, "many">>>;
+        excludedPaths: z.ZodOptional<z.ZodDefault<z.ZodArray<z.ZodString, "many">>>;
+        includedPaths: z.ZodOptional<z.ZodOptional<z.ZodArray<z.ZodString, "many">>>;
+        metadata: z.ZodOptional<z.ZodOptional<z.ZodObject<{
+            lastUpdated: z.ZodOptional<z.ZodString>;
+            updatedBy: z.ZodOptional<z.ZodString>;
+            policyId: z.ZodOptional<z.ZodString>;
+        }, "strip", z.ZodTypeAny, {
+            lastUpdated?: string | undefined;
+            updatedBy?: string | undefined;
+            policyId?: string | undefined;
+        }, {
+            lastUpdated?: string | undefined;
+            updatedBy?: string | undefined;
+            policyId?: string | undefined;
+        }>>>;
+    }, "strip", z.ZodTypeAny, {
+        metadata?: {
+            lastUpdated?: string | undefined;
+            updatedBy?: string | undefined;
+            policyId?: string | undefined;
+        } | undefined;
+        version?: string | undefined;
+        enabled?: boolean | undefined;
+        redirectUrl?: string | undefined;
+        defaultAction?: "challenge" | "allow" | "block" | "redirect" | "log" | undefined;
+        thresholds?: {
+            confidenceThreshold: number;
+            confidenceAction: "challenge" | "allow" | "block" | "redirect" | "log";
+            minReputationScore: number;
+            lowReputationAction: "challenge" | "allow" | "block" | "redirect" | "log";
+            trustedReputationThreshold: number;
+            trustSignedRequests: boolean;
+        } | undefined;
+        denyList?: {
+            active: boolean;
+            agentDid?: string | undefined;
+            clientDid?: string | undefined;
+            expiresAt?: string | undefined;
+            reason?: string | undefined;
+            clientName?: string | undefined;
+            agentType?: string | undefined;
+            blockedAt?: string | undefined;
+            addedBy?: string | undefined;
+        }[] | undefined;
+        allowList?: {
+            agentDid?: string | undefined;
+            clientDid?: string | undefined;
+            reason?: string | undefined;
+            clientName?: string | undefined;
+            agentType?: string | undefined;
+            addedBy?: string | undefined;
+            addedAt?: string | undefined;
+        }[] | undefined;
+        rules?: {
+            name: string;
+            id: string;
+            enabled: boolean;
+            action: "challenge" | "allow" | "block" | "redirect" | "log";
+            priority: number;
+            conditions: {
+                value: string | number | boolean | string[];
+                field: "path" | "agentDid" | "clientDid" | "method" | "confidence" | "agentType" | "agentName" | "agentVendor" | "reputationScore" | "riskLevel" | "origin" | "userAgent" | "signatureVerified" | "isAuthenticated" | "hasValidDelegation";
+                operator: "equals" | "notEquals" | "contains" | "notContains" | "startsWith" | "endsWith" | "greaterThan" | "lessThan" | "greaterThanOrEquals" | "lessThanOrEquals" | "matches" | "in" | "notIn";
+                caseInsensitive?: boolean | undefined;
+            }[];
+            message?: string | undefined;
+            metadata?: {
+                createdAt?: string | undefined;
+                updatedAt?: string | undefined;
+                createdBy?: string | undefined;
+            } | undefined;
+            description?: string | undefined;
+            redirectUrl?: string | undefined;
+        }[] | undefined;
+        excludedPaths?: string[] | undefined;
+        includedPaths?: string[] | undefined;
+    }, {
+        metadata?: {
+            lastUpdated?: string | undefined;
+            updatedBy?: string | undefined;
+            policyId?: string | undefined;
+        } | undefined;
+        version?: string | undefined;
+        enabled?: boolean | undefined;
+        redirectUrl?: string | undefined;
+        defaultAction?: "challenge" | "allow" | "block" | "redirect" | "log" | undefined;
+        thresholds?: {
+            confidenceThreshold?: number | undefined;
+            confidenceAction?: "challenge" | "allow" | "block" | "redirect" | "log" | undefined;
+            minReputationScore?: number | undefined;
+            lowReputationAction?: "challenge" | "allow" | "block" | "redirect" | "log" | undefined;
+            trustedReputationThreshold?: number | undefined;
+            trustSignedRequests?: boolean | undefined;
+        } | undefined;
+        denyList?: {
+            agentDid?: string | undefined;
+            clientDid?: string | undefined;
+            expiresAt?: string | undefined;
+            reason?: string | undefined;
+            active?: boolean | undefined;
+            clientName?: string | undefined;
+            agentType?: string | undefined;
+            blockedAt?: string | undefined;
+            addedBy?: string | undefined;
+        }[] | undefined;
+        allowList?: {
+            agentDid?: string | undefined;
+            clientDid?: string | undefined;
+            reason?: string | undefined;
+            clientName?: string | undefined;
+            agentType?: string | undefined;
+            addedBy?: string | undefined;
+            addedAt?: string | undefined;
+        }[] | undefined;
+        rules?: {
+            name: string;
+            id: string;
+            action: "challenge" | "allow" | "block" | "redirect" | "log";
+            conditions: {
+                value: string | number | boolean | string[];
+                field: "path" | "agentDid" | "clientDid" | "method" | "confidence" | "agentType" | "agentName" | "agentVendor" | "reputationScore" | "riskLevel" | "origin" | "userAgent" | "signatureVerified" | "isAuthenticated" | "hasValidDelegation";
+                operator: "equals" | "notEquals" | "contains" | "notContains" | "startsWith" | "endsWith" | "greaterThan" | "lessThan" | "greaterThanOrEquals" | "lessThanOrEquals" | "matches" | "in" | "notIn";
+                caseInsensitive?: boolean | undefined;
+            }[];
+            message?: string | undefined;
+            metadata?: {
+                createdAt?: string | undefined;
+                updatedAt?: string | undefined;
+                createdBy?: string | undefined;
+            } | undefined;
+            enabled?: boolean | undefined;
+            description?: string | undefined;
+            priority?: number | undefined;
+            redirectUrl?: string | undefined;
+        }[] | undefined;
+        excludedPaths?: string[] | undefined;
+        includedPaths?: string[] | undefined;
+    }>;
+}, "strip", z.ZodTypeAny, {
+    projectId: string;
+    policy: {
+        metadata?: {
+            lastUpdated?: string | undefined;
+            updatedBy?: string | undefined;
+            policyId?: string | undefined;
+        } | undefined;
+        version?: string | undefined;
+        enabled?: boolean | undefined;
+        redirectUrl?: string | undefined;
+        defaultAction?: "challenge" | "allow" | "block" | "redirect" | "log" | undefined;
+        thresholds?: {
+            confidenceThreshold: number;
+            confidenceAction: "challenge" | "allow" | "block" | "redirect" | "log";
+            minReputationScore: number;
+            lowReputationAction: "challenge" | "allow" | "block" | "redirect" | "log";
+            trustedReputationThreshold: number;
+            trustSignedRequests: boolean;
+        } | undefined;
+        denyList?: {
+            active: boolean;
+            agentDid?: string | undefined;
+            clientDid?: string | undefined;
+            expiresAt?: string | undefined;
+            reason?: string | undefined;
+            clientName?: string | undefined;
+            agentType?: string | undefined;
+            blockedAt?: string | undefined;
+            addedBy?: string | undefined;
+        }[] | undefined;
+        allowList?: {
+            agentDid?: string | undefined;
+            clientDid?: string | undefined;
+            reason?: string | undefined;
+            clientName?: string | undefined;
+            agentType?: string | undefined;
+            addedBy?: string | undefined;
+            addedAt?: string | undefined;
+        }[] | undefined;
+        rules?: {
+            name: string;
+            id: string;
+            enabled: boolean;
+            action: "challenge" | "allow" | "block" | "redirect" | "log";
+            priority: number;
+            conditions: {
+                value: string | number | boolean | string[];
+                field: "path" | "agentDid" | "clientDid" | "method" | "confidence" | "agentType" | "agentName" | "agentVendor" | "reputationScore" | "riskLevel" | "origin" | "userAgent" | "signatureVerified" | "isAuthenticated" | "hasValidDelegation";
+                operator: "equals" | "notEquals" | "contains" | "notContains" | "startsWith" | "endsWith" | "greaterThan" | "lessThan" | "greaterThanOrEquals" | "lessThanOrEquals" | "matches" | "in" | "notIn";
+                caseInsensitive?: boolean | undefined;
+            }[];
+            message?: string | undefined;
+            metadata?: {
+                createdAt?: string | undefined;
+                updatedAt?: string | undefined;
+                createdBy?: string | undefined;
+            } | undefined;
+            description?: string | undefined;
+            redirectUrl?: string | undefined;
+        }[] | undefined;
+        excludedPaths?: string[] | undefined;
+        includedPaths?: string[] | undefined;
+    };
+}, {
+    projectId: string;
+    policy: {
+        metadata?: {
+            lastUpdated?: string | undefined;
+            updatedBy?: string | undefined;
+            policyId?: string | undefined;
+        } | undefined;
+        version?: string | undefined;
+        enabled?: boolean | undefined;
+        redirectUrl?: string | undefined;
+        defaultAction?: "challenge" | "allow" | "block" | "redirect" | "log" | undefined;
+        thresholds?: {
+            confidenceThreshold?: number | undefined;
+            confidenceAction?: "challenge" | "allow" | "block" | "redirect" | "log" | undefined;
+            minReputationScore?: number | undefined;
+            lowReputationAction?: "challenge" | "allow" | "block" | "redirect" | "log" | undefined;
+            trustedReputationThreshold?: number | undefined;
+            trustSignedRequests?: boolean | undefined;
+        } | undefined;
+        denyList?: {
+            agentDid?: string | undefined;
+            clientDid?: string | undefined;
+            expiresAt?: string | undefined;
+            reason?: string | undefined;
+            active?: boolean | undefined;
+            clientName?: string | undefined;
+            agentType?: string | undefined;
+            blockedAt?: string | undefined;
+            addedBy?: string | undefined;
+        }[] | undefined;
+        allowList?: {
+            agentDid?: string | undefined;
+            clientDid?: string | undefined;
+            reason?: string | undefined;
+            clientName?: string | undefined;
+            agentType?: string | undefined;
+            addedBy?: string | undefined;
+            addedAt?: string | undefined;
+        }[] | undefined;
+        rules?: {
+            name: string;
+            id: string;
+            action: "challenge" | "allow" | "block" | "redirect" | "log";
+            conditions: {
+                value: string | number | boolean | string[];
+                field: "path" | "agentDid" | "clientDid" | "method" | "confidence" | "agentType" | "agentName" | "agentVendor" | "reputationScore" | "riskLevel" | "origin" | "userAgent" | "signatureVerified" | "isAuthenticated" | "hasValidDelegation";
+                operator: "equals" | "notEquals" | "contains" | "notContains" | "startsWith" | "endsWith" | "greaterThan" | "lessThan" | "greaterThanOrEquals" | "lessThanOrEquals" | "matches" | "in" | "notIn";
+                caseInsensitive?: boolean | undefined;
+            }[];
+            message?: string | undefined;
+            metadata?: {
+                createdAt?: string | undefined;
+                updatedAt?: string | undefined;
+                createdBy?: string | undefined;
+            } | undefined;
+            enabled?: boolean | undefined;
+            description?: string | undefined;
+            priority?: number | undefined;
+            redirectUrl?: string | undefined;
+        }[] | undefined;
+        excludedPaths?: string[] | undefined;
+        includedPaths?: string[] | undefined;
+    };
+}>;
+export type UpdatePolicyRequest = z.infer<typeof UpdatePolicyRequestSchema>;
+/**
+ * Response after updating policy
+ */
+export declare const UpdatePolicyResponseSchema: z.ZodObject<{
+    success: z.ZodBoolean;
+    data: z.ZodObject<{
+        policy: z.ZodEffects<z.ZodObject<{
+            /** Schema version for migrations */
+            version: z.ZodDefault<z.ZodString>;
+            /** Whether policy enforcement is enabled */
+            enabled: z.ZodDefault<z.ZodBoolean>;
+            /** Default action when no rules match */
+            defaultAction: z.ZodDefault<z.ZodEnum<["allow", "block", "redirect", "challenge", "log"]>>;
+            /** Default redirect URL for redirect actions */
+            redirectUrl: z.ZodOptional<z.ZodString>;
+            /** Threshold-based enforcement settings */
+            thresholds: z.ZodDefault<z.ZodObject<{
+                /**
+                 * Detection confidence threshold (0-100)
+                 * Agents detected with confidence >= this value trigger the configured action
+                 * @default 80
+                 */
+                confidenceThreshold: z.ZodDefault<z.ZodNumber>;
+                /**
+                 * Action to take when confidence threshold is exceeded
+                 * @default 'block'
+                 */
+                confidenceAction: z.ZodDefault<z.ZodEnum<["allow", "block", "redirect", "challenge", "log"]>>;
+                /**
+                 * Minimum reputation score (0-100) required to allow access
+                 * Agents with reputation < this value may be blocked/challenged
+                 * Set to 0 to disable reputation-based enforcement
+                 * @default 0
+                 */
+                minReputationScore: z.ZodDefault<z.ZodNumber>;
+                /**
+                 * Action to take when reputation is below threshold
+                 * @default 'challenge'
+                 */
+                lowReputationAction: z.ZodDefault<z.ZodEnum<["allow", "block", "redirect", "challenge", "log"]>>;
+                /**
+                 * High reputation score threshold (0-100)
+                 * Agents with reputation >= this value are trusted and bypass other checks
+                 * @default 90
+                 */
+                trustedReputationThreshold: z.ZodDefault<z.ZodNumber>;
+                /**
+                 * Whether cryptographically signed requests (MCP-I verified) bypass thresholds
+                 * @default true
+                 */
+                trustSignedRequests: z.ZodDefault<z.ZodBoolean>;
+            }, "strip", z.ZodTypeAny, {
+                confidenceThreshold: number;
+                confidenceAction: "challenge" | "allow" | "block" | "redirect" | "log";
+                minReputationScore: number;
+                lowReputationAction: "challenge" | "allow" | "block" | "redirect" | "log";
+                trustedReputationThreshold: number;
+                trustSignedRequests: boolean;
+            }, {
+                confidenceThreshold?: number | undefined;
+                confidenceAction?: "challenge" | "allow" | "block" | "redirect" | "log" | undefined;
+                minReputationScore?: number | undefined;
+                lowReputationAction?: "challenge" | "allow" | "block" | "redirect" | "log" | undefined;
+                trustedReputationThreshold?: number | undefined;
+                trustSignedRequests?: boolean | undefined;
+            }>>;
+            /** Deny list entries (checked after allow list, before rules) */
+            denyList: z.ZodDefault<z.ZodArray<z.ZodEffects<z.ZodObject<{
+                /** MCP-I client DID (e.g., "did:key:z6Mk...") */
+                clientDid: z.ZodOptional<z.ZodString>;
+                /** Agent DID from MCP-I identity */
+                agentDid: z.ZodOptional<z.ZodString>;
+                /** Human-readable client name (e.g., "Perplexity", "ChatGPT") */
+                clientName: z.ZodOptional<z.ZodString>;
+                /** Agent type to block (e.g., "ai_agent", "bot", "scraper") */
+                agentType: z.ZodOptional<z.ZodString>;
+                /** Reason for denial (shown to user/logged) */
+                reason: z.ZodOptional<z.ZodString>;
+                /** ISO 8601 timestamp when entry was added */
+                blockedAt: z.ZodOptional<z.ZodString>;
+                /** Who added this entry (user ID or "system") */
+                addedBy: z.ZodOptional<z.ZodString>;
+                /** Whether this entry is currently active */
+                active: z.ZodDefault<z.ZodBoolean>;
+                /** Optional expiration date for temporary blocks */
+                expiresAt: z.ZodOptional<z.ZodString>;
+            }, "strip", z.ZodTypeAny, {
+                active: boolean;
+                agentDid?: string | undefined;
+                clientDid?: string | undefined;
+                expiresAt?: string | undefined;
+                reason?: string | undefined;
+                clientName?: string | undefined;
+                agentType?: string | undefined;
+                blockedAt?: string | undefined;
+                addedBy?: string | undefined;
+            }, {
+                agentDid?: string | undefined;
+                clientDid?: string | undefined;
+                expiresAt?: string | undefined;
+                reason?: string | undefined;
+                active?: boolean | undefined;
+                clientName?: string | undefined;
+                agentType?: string | undefined;
+                blockedAt?: string | undefined;
+                addedBy?: string | undefined;
+            }>, {
+                active: boolean;
+                agentDid?: string | undefined;
+                clientDid?: string | undefined;
+                expiresAt?: string | undefined;
+                reason?: string | undefined;
+                clientName?: string | undefined;
+                agentType?: string | undefined;
+                blockedAt?: string | undefined;
+                addedBy?: string | undefined;
+            }, {
+                agentDid?: string | undefined;
+                clientDid?: string | undefined;
+                expiresAt?: string | undefined;
+                reason?: string | undefined;
+                active?: boolean | undefined;
+                clientName?: string | undefined;
+                agentType?: string | undefined;
+                blockedAt?: string | undefined;
+                addedBy?: string | undefined;
+            }>, "many">>;
+            /** Allow list entries (exempt from all checks) */
+            allowList: z.ZodDefault<z.ZodArray<z.ZodEffects<z.ZodObject<{
+                /** MCP-I client DID (e.g., "did:key:z6Mk...") */
+                clientDid: z.ZodOptional<z.ZodString>;
+                /** Agent DID from MCP-I identity */
+                agentDid: z.ZodOptional<z.ZodString>;
+                /** Human-readable client name (e.g., "Perplexity", "ChatGPT") */
+                clientName: z.ZodOptional<z.ZodString>;
+                /** Agent type to allow (e.g., "ai_agent", "verified_bot") */
+                agentType: z.ZodOptional<z.ZodString>;
+                /** Reason for allowing (documentation) */
+                reason: z.ZodOptional<z.ZodString>;
+                /** ISO 8601 timestamp when entry was added */
+                addedAt: z.ZodOptional<z.ZodString>;
+                /** Who added this entry */
+                addedBy: z.ZodOptional<z.ZodString>;
+            }, "strip", z.ZodTypeAny, {
+                agentDid?: string | undefined;
+                clientDid?: string | undefined;
+                reason?: string | undefined;
+                clientName?: string | undefined;
+                agentType?: string | undefined;
+                addedBy?: string | undefined;
+                addedAt?: string | undefined;
+            }, {
+                agentDid?: string | undefined;
+                clientDid?: string | undefined;
+                reason?: string | undefined;
+                clientName?: string | undefined;
+                agentType?: string | undefined;
+                addedBy?: string | undefined;
+                addedAt?: string | undefined;
+            }>, {
+                agentDid?: string | undefined;
+                clientDid?: string | undefined;
+                reason?: string | undefined;
+                clientName?: string | undefined;
+                agentType?: string | undefined;
+                addedBy?: string | undefined;
+                addedAt?: string | undefined;
+            }, {
+                agentDid?: string | undefined;
+                clientDid?: string | undefined;
+                reason?: string | undefined;
+                clientName?: string | undefined;
+                agentType?: string | undefined;
+                addedBy?: string | undefined;
+                addedAt?: string | undefined;
+            }>, "many">>;
+            /** Custom policy rules (evaluated by priority after threshold checks) */
+            rules: z.ZodDefault<z.ZodArray<z.ZodEffects<z.ZodObject<{
+                /** Unique identifier for this rule */
+                id: z.ZodString;
+                /** Human-readable name */
+                name: z.ZodString;
+                /** Description of what this rule does */
+                description: z.ZodOptional<z.ZodString>;
+                /** Priority (lower = higher priority, evaluated first) */
+                priority: z.ZodDefault<z.ZodNumber>;
+                /**
+                 * Conditions that must ALL match for this rule to apply (AND logic)
+                 * For OR logic, create multiple rules with same action
+                 */
+                conditions: z.ZodArray<z.ZodObject<{
+                    /** Field to match against */
+                    field: z.ZodEnum<["agentType", "agentName", "agentVendor", "clientDid", "agentDid", "confidence", "reputationScore", "riskLevel", "path", "method", "origin", "userAgent", "signatureVerified", "isAuthenticated", "hasValidDelegation"]>;
+                    /** Comparison operator */
+                    operator: z.ZodEnum<["equals", "notEquals", "contains", "notContains", "startsWith", "endsWith", "greaterThan", "lessThan", "greaterThanOrEquals", "lessThanOrEquals", "matches", "in", "notIn"]>;
+                    /** Value to compare against */
+                    value: z.ZodUnion<[z.ZodString, z.ZodNumber, z.ZodBoolean, z.ZodArray<z.ZodString, "many">]>;
+                    /** Whether this condition is case-insensitive (for string comparisons) */
+                    caseInsensitive: z.ZodOptional<z.ZodBoolean>;
+                }, "strip", z.ZodTypeAny, {
+                    value: string | number | boolean | string[];
+                    field: "path" | "agentDid" | "clientDid" | "method" | "confidence" | "agentType" | "agentName" | "agentVendor" | "reputationScore" | "riskLevel" | "origin" | "userAgent" | "signatureVerified" | "isAuthenticated" | "hasValidDelegation";
+                    operator: "equals" | "notEquals" | "contains" | "notContains" | "startsWith" | "endsWith" | "greaterThan" | "lessThan" | "greaterThanOrEquals" | "lessThanOrEquals" | "matches" | "in" | "notIn";
+                    caseInsensitive?: boolean | undefined;
+                }, {
+                    value: string | number | boolean | string[];
+                    field: "path" | "agentDid" | "clientDid" | "method" | "confidence" | "agentType" | "agentName" | "agentVendor" | "reputationScore" | "riskLevel" | "origin" | "userAgent" | "signatureVerified" | "isAuthenticated" | "hasValidDelegation";
+                    operator: "equals" | "notEquals" | "contains" | "notContains" | "startsWith" | "endsWith" | "greaterThan" | "lessThan" | "greaterThanOrEquals" | "lessThanOrEquals" | "matches" | "in" | "notIn";
+                    caseInsensitive?: boolean | undefined;
+                }>, "many">;
+                /** Action to take when conditions match */
+                action: z.ZodEnum<["allow", "block", "redirect", "challenge", "log"]>;
+                /** Redirect URL (required if action is 'redirect') */
+                redirectUrl: z.ZodOptional<z.ZodString>;
+                /** Custom message to show/log */
+                message: z.ZodOptional<z.ZodString>;
+                /** Whether this rule is currently active */
+                enabled: z.ZodDefault<z.ZodBoolean>;
+                /** Metadata for auditing */
+                metadata: z.ZodOptional<z.ZodObject<{
+                    createdAt: z.ZodOptional<z.ZodString>;
+                    updatedAt: z.ZodOptional<z.ZodString>;
+                    createdBy: z.ZodOptional<z.ZodString>;
+                }, "strip", z.ZodTypeAny, {
+                    createdAt?: string | undefined;
+                    updatedAt?: string | undefined;
+                    createdBy?: string | undefined;
+                }, {
+                    createdAt?: string | undefined;
+                    updatedAt?: string | undefined;
+                    createdBy?: string | undefined;
+                }>>;
+            }, "strip", z.ZodTypeAny, {
+                name: string;
+                id: string;
+                enabled: boolean;
+                action: "challenge" | "allow" | "block" | "redirect" | "log";
+                priority: number;
+                conditions: {
+                    value: string | number | boolean | string[];
+                    field: "path" | "agentDid" | "clientDid" | "method" | "confidence" | "agentType" | "agentName" | "agentVendor" | "reputationScore" | "riskLevel" | "origin" | "userAgent" | "signatureVerified" | "isAuthenticated" | "hasValidDelegation";
+                    operator: "equals" | "notEquals" | "contains" | "notContains" | "startsWith" | "endsWith" | "greaterThan" | "lessThan" | "greaterThanOrEquals" | "lessThanOrEquals" | "matches" | "in" | "notIn";
+                    caseInsensitive?: boolean | undefined;
+                }[];
+                message?: string | undefined;
+                metadata?: {
+                    createdAt?: string | undefined;
+                    updatedAt?: string | undefined;
+                    createdBy?: string | undefined;
+                } | undefined;
+                description?: string | undefined;
+                redirectUrl?: string | undefined;
+            }, {
+                name: string;
+                id: string;
+                action: "challenge" | "allow" | "block" | "redirect" | "log";
+                conditions: {
+                    value: string | number | boolean | string[];
+                    field: "path" | "agentDid" | "clientDid" | "method" | "confidence" | "agentType" | "agentName" | "agentVendor" | "reputationScore" | "riskLevel" | "origin" | "userAgent" | "signatureVerified" | "isAuthenticated" | "hasValidDelegation";
+                    operator: "equals" | "notEquals" | "contains" | "notContains" | "startsWith" | "endsWith" | "greaterThan" | "lessThan" | "greaterThanOrEquals" | "lessThanOrEquals" | "matches" | "in" | "notIn";
+                    caseInsensitive?: boolean | undefined;
+                }[];
+                message?: string | undefined;
+                metadata?: {
+                    createdAt?: string | undefined;
+                    updatedAt?: string | undefined;
+                    createdBy?: string | undefined;
+                } | undefined;
+                enabled?: boolean | undefined;
+                description?: string | undefined;
+                priority?: number | undefined;
+                redirectUrl?: string | undefined;
+            }>, {
+                name: string;
+                id: string;
+                enabled: boolean;
+                action: "challenge" | "allow" | "block" | "redirect" | "log";
+                priority: number;
+                conditions: {
+                    value: string | number | boolean | string[];
+                    field: "path" | "agentDid" | "clientDid" | "method" | "confidence" | "agentType" | "agentName" | "agentVendor" | "reputationScore" | "riskLevel" | "origin" | "userAgent" | "signatureVerified" | "isAuthenticated" | "hasValidDelegation";
+                    operator: "equals" | "notEquals" | "contains" | "notContains" | "startsWith" | "endsWith" | "greaterThan" | "lessThan" | "greaterThanOrEquals" | "lessThanOrEquals" | "matches" | "in" | "notIn";
+                    caseInsensitive?: boolean | undefined;
+                }[];
+                message?: string | undefined;
+                metadata?: {
+                    createdAt?: string | undefined;
+                    updatedAt?: string | undefined;
+                    createdBy?: string | undefined;
+                } | undefined;
+                description?: string | undefined;
+                redirectUrl?: string | undefined;
+            }, {
+                name: string;
+                id: string;
+                action: "challenge" | "allow" | "block" | "redirect" | "log";
+                conditions: {
+                    value: string | number | boolean | string[];
+                    field: "path" | "agentDid" | "clientDid" | "method" | "confidence" | "agentType" | "agentName" | "agentVendor" | "reputationScore" | "riskLevel" | "origin" | "userAgent" | "signatureVerified" | "isAuthenticated" | "hasValidDelegation";
+                    operator: "equals" | "notEquals" | "contains" | "notContains" | "startsWith" | "endsWith" | "greaterThan" | "lessThan" | "greaterThanOrEquals" | "lessThanOrEquals" | "matches" | "in" | "notIn";
+                    caseInsensitive?: boolean | undefined;
+                }[];
+                message?: string | undefined;
+                metadata?: {
+                    createdAt?: string | undefined;
+                    updatedAt?: string | undefined;
+                    createdBy?: string | undefined;
+                } | undefined;
+                enabled?: boolean | undefined;
+                description?: string | undefined;
+                priority?: number | undefined;
+                redirectUrl?: string | undefined;
+            }>, "many">>;
+            /** Paths to exclude from policy enforcement (glob patterns supported) */
+            excludedPaths: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+            /** Paths to include (if set, only these paths are enforced) */
+            includedPaths: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            /** Metadata for the policy configuration */
+            metadata: z.ZodOptional<z.ZodObject<{
+                lastUpdated: z.ZodOptional<z.ZodString>;
+                updatedBy: z.ZodOptional<z.ZodString>;
+                policyId: z.ZodOptional<z.ZodString>;
+            }, "strip", z.ZodTypeAny, {
+                lastUpdated?: string | undefined;
+                updatedBy?: string | undefined;
+                policyId?: string | undefined;
+            }, {
+                lastUpdated?: string | undefined;
+                updatedBy?: string | undefined;
+                policyId?: string | undefined;
+            }>>;
+        }, "strip", z.ZodTypeAny, {
+            version: string;
+            enabled: boolean;
+            defaultAction: "challenge" | "allow" | "block" | "redirect" | "log";
+            thresholds: {
+                confidenceThreshold: number;
+                confidenceAction: "challenge" | "allow" | "block" | "redirect" | "log";
+                minReputationScore: number;
+                lowReputationAction: "challenge" | "allow" | "block" | "redirect" | "log";
+                trustedReputationThreshold: number;
+                trustSignedRequests: boolean;
+            };
+            denyList: {
+                active: boolean;
+                agentDid?: string | undefined;
+                clientDid?: string | undefined;
+                expiresAt?: string | undefined;
+                reason?: string | undefined;
+                clientName?: string | undefined;
+                agentType?: string | undefined;
+                blockedAt?: string | undefined;
+                addedBy?: string | undefined;
+            }[];
+            allowList: {
+                agentDid?: string | undefined;
+                clientDid?: string | undefined;
+                reason?: string | undefined;
+                clientName?: string | undefined;
+                agentType?: string | undefined;
+                addedBy?: string | undefined;
+                addedAt?: string | undefined;
+            }[];
+            rules: {
+                name: string;
+                id: string;
+                enabled: boolean;
+                action: "challenge" | "allow" | "block" | "redirect" | "log";
+                priority: number;
+                conditions: {
+                    value: string | number | boolean | string[];
+                    field: "path" | "agentDid" | "clientDid" | "method" | "confidence" | "agentType" | "agentName" | "agentVendor" | "reputationScore" | "riskLevel" | "origin" | "userAgent" | "signatureVerified" | "isAuthenticated" | "hasValidDelegation";
+                    operator: "equals" | "notEquals" | "contains" | "notContains" | "startsWith" | "endsWith" | "greaterThan" | "lessThan" | "greaterThanOrEquals" | "lessThanOrEquals" | "matches" | "in" | "notIn";
+                    caseInsensitive?: boolean | undefined;
+                }[];
+                message?: string | undefined;
+                metadata?: {
+                    createdAt?: string | undefined;
+                    updatedAt?: string | undefined;
+                    createdBy?: string | undefined;
+                } | undefined;
+                description?: string | undefined;
+                redirectUrl?: string | undefined;
+            }[];
+            excludedPaths: string[];
+            metadata?: {
+                lastUpdated?: string | undefined;
+                updatedBy?: string | undefined;
+                policyId?: string | undefined;
+            } | undefined;
+            redirectUrl?: string | undefined;
+            includedPaths?: string[] | undefined;
+        }, {
+            metadata?: {
+                lastUpdated?: string | undefined;
+                updatedBy?: string | undefined;
+                policyId?: string | undefined;
+            } | undefined;
+            version?: string | undefined;
+            enabled?: boolean | undefined;
+            redirectUrl?: string | undefined;
+            defaultAction?: "challenge" | "allow" | "block" | "redirect" | "log" | undefined;
+            thresholds?: {
+                confidenceThreshold?: number | undefined;
+                confidenceAction?: "challenge" | "allow" | "block" | "redirect" | "log" | undefined;
+                minReputationScore?: number | undefined;
+                lowReputationAction?: "challenge" | "allow" | "block" | "redirect" | "log" | undefined;
+                trustedReputationThreshold?: number | undefined;
+                trustSignedRequests?: boolean | undefined;
+            } | undefined;
+            denyList?: {
+                agentDid?: string | undefined;
+                clientDid?: string | undefined;
+                expiresAt?: string | undefined;
+                reason?: string | undefined;
+                active?: boolean | undefined;
+                clientName?: string | undefined;
+                agentType?: string | undefined;
+                blockedAt?: string | undefined;
+                addedBy?: string | undefined;
+            }[] | undefined;
+            allowList?: {
+                agentDid?: string | undefined;
+                clientDid?: string | undefined;
+                reason?: string | undefined;
+                clientName?: string | undefined;
+                agentType?: string | undefined;
+                addedBy?: string | undefined;
+                addedAt?: string | undefined;
+            }[] | undefined;
+            rules?: {
+                name: string;
+                id: string;
+                action: "challenge" | "allow" | "block" | "redirect" | "log";
+                conditions: {
+                    value: string | number | boolean | string[];
+                    field: "path" | "agentDid" | "clientDid" | "method" | "confidence" | "agentType" | "agentName" | "agentVendor" | "reputationScore" | "riskLevel" | "origin" | "userAgent" | "signatureVerified" | "isAuthenticated" | "hasValidDelegation";
+                    operator: "equals" | "notEquals" | "contains" | "notContains" | "startsWith" | "endsWith" | "greaterThan" | "lessThan" | "greaterThanOrEquals" | "lessThanOrEquals" | "matches" | "in" | "notIn";
+                    caseInsensitive?: boolean | undefined;
+                }[];
+                message?: string | undefined;
+                metadata?: {
+                    createdAt?: string | undefined;
+                    updatedAt?: string | undefined;
+                    createdBy?: string | undefined;
+                } | undefined;
+                enabled?: boolean | undefined;
+                description?: string | undefined;
+                priority?: number | undefined;
+                redirectUrl?: string | undefined;
+            }[] | undefined;
+            excludedPaths?: string[] | undefined;
+            includedPaths?: string[] | undefined;
+        }>, {
+            version: string;
+            enabled: boolean;
+            defaultAction: "challenge" | "allow" | "block" | "redirect" | "log";
+            thresholds: {
+                confidenceThreshold: number;
+                confidenceAction: "challenge" | "allow" | "block" | "redirect" | "log";
+                minReputationScore: number;
+                lowReputationAction: "challenge" | "allow" | "block" | "redirect" | "log";
+                trustedReputationThreshold: number;
+                trustSignedRequests: boolean;
+            };
+            denyList: {
+                active: boolean;
+                agentDid?: string | undefined;
+                clientDid?: string | undefined;
+                expiresAt?: string | undefined;
+                reason?: string | undefined;
+                clientName?: string | undefined;
+                agentType?: string | undefined;
+                blockedAt?: string | undefined;
+                addedBy?: string | undefined;
+            }[];
+            allowList: {
+                agentDid?: string | undefined;
+                clientDid?: string | undefined;
+                reason?: string | undefined;
+                clientName?: string | undefined;
+                agentType?: string | undefined;
+                addedBy?: string | undefined;
+                addedAt?: string | undefined;
+            }[];
+            rules: {
+                name: string;
+                id: string;
+                enabled: boolean;
+                action: "challenge" | "allow" | "block" | "redirect" | "log";
+                priority: number;
+                conditions: {
+                    value: string | number | boolean | string[];
+                    field: "path" | "agentDid" | "clientDid" | "method" | "confidence" | "agentType" | "agentName" | "agentVendor" | "reputationScore" | "riskLevel" | "origin" | "userAgent" | "signatureVerified" | "isAuthenticated" | "hasValidDelegation";
+                    operator: "equals" | "notEquals" | "contains" | "notContains" | "startsWith" | "endsWith" | "greaterThan" | "lessThan" | "greaterThanOrEquals" | "lessThanOrEquals" | "matches" | "in" | "notIn";
+                    caseInsensitive?: boolean | undefined;
+                }[];
+                message?: string | undefined;
+                metadata?: {
+                    createdAt?: string | undefined;
+                    updatedAt?: string | undefined;
+                    createdBy?: string | undefined;
+                } | undefined;
+                description?: string | undefined;
+                redirectUrl?: string | undefined;
+            }[];
+            excludedPaths: string[];
+            metadata?: {
+                lastUpdated?: string | undefined;
+                updatedBy?: string | undefined;
+                policyId?: string | undefined;
+            } | undefined;
+            redirectUrl?: string | undefined;
+            includedPaths?: string[] | undefined;
+        }, {
+            metadata?: {
+                lastUpdated?: string | undefined;
+                updatedBy?: string | undefined;
+                policyId?: string | undefined;
+            } | undefined;
+            version?: string | undefined;
+            enabled?: boolean | undefined;
+            redirectUrl?: string | undefined;
+            defaultAction?: "challenge" | "allow" | "block" | "redirect" | "log" | undefined;
+            thresholds?: {
+                confidenceThreshold?: number | undefined;
+                confidenceAction?: "challenge" | "allow" | "block" | "redirect" | "log" | undefined;
+                minReputationScore?: number | undefined;
+                lowReputationAction?: "challenge" | "allow" | "block" | "redirect" | "log" | undefined;
+                trustedReputationThreshold?: number | undefined;
+                trustSignedRequests?: boolean | undefined;
+            } | undefined;
+            denyList?: {
+                agentDid?: string | undefined;
+                clientDid?: string | undefined;
+                expiresAt?: string | undefined;
+                reason?: string | undefined;
+                active?: boolean | undefined;
+                clientName?: string | undefined;
+                agentType?: string | undefined;
+                blockedAt?: string | undefined;
+                addedBy?: string | undefined;
+            }[] | undefined;
+            allowList?: {
+                agentDid?: string | undefined;
+                clientDid?: string | undefined;
+                reason?: string | undefined;
+                clientName?: string | undefined;
+                agentType?: string | undefined;
+                addedBy?: string | undefined;
+                addedAt?: string | undefined;
+            }[] | undefined;
+            rules?: {
+                name: string;
+                id: string;
+                action: "challenge" | "allow" | "block" | "redirect" | "log";
+                conditions: {
+                    value: string | number | boolean | string[];
+                    field: "path" | "agentDid" | "clientDid" | "method" | "confidence" | "agentType" | "agentName" | "agentVendor" | "reputationScore" | "riskLevel" | "origin" | "userAgent" | "signatureVerified" | "isAuthenticated" | "hasValidDelegation";
+                    operator: "equals" | "notEquals" | "contains" | "notContains" | "startsWith" | "endsWith" | "greaterThan" | "lessThan" | "greaterThanOrEquals" | "lessThanOrEquals" | "matches" | "in" | "notIn";
+                    caseInsensitive?: boolean | undefined;
+                }[];
+                message?: string | undefined;
+                metadata?: {
+                    createdAt?: string | undefined;
+                    updatedAt?: string | undefined;
+                    createdBy?: string | undefined;
+                } | undefined;
+                enabled?: boolean | undefined;
+                description?: string | undefined;
+                priority?: number | undefined;
+                redirectUrl?: string | undefined;
+            }[] | undefined;
+            excludedPaths?: string[] | undefined;
+            includedPaths?: string[] | undefined;
+        }>;
+        changes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    }, "strip", z.ZodTypeAny, {
+        policy: {
+            version: string;
+            enabled: boolean;
+            defaultAction: "challenge" | "allow" | "block" | "redirect" | "log";
+            thresholds: {
+                confidenceThreshold: number;
+                confidenceAction: "challenge" | "allow" | "block" | "redirect" | "log";
+                minReputationScore: number;
+                lowReputationAction: "challenge" | "allow" | "block" | "redirect" | "log";
+                trustedReputationThreshold: number;
+                trustSignedRequests: boolean;
+            };
+            denyList: {
+                active: boolean;
+                agentDid?: string | undefined;
+                clientDid?: string | undefined;
+                expiresAt?: string | undefined;
+                reason?: string | undefined;
+                clientName?: string | undefined;
+                agentType?: string | undefined;
+                blockedAt?: string | undefined;
+                addedBy?: string | undefined;
+            }[];
+            allowList: {
+                agentDid?: string | undefined;
+                clientDid?: string | undefined;
+                reason?: string | undefined;
+                clientName?: string | undefined;
+                agentType?: string | undefined;
+                addedBy?: string | undefined;
+                addedAt?: string | undefined;
+            }[];
+            rules: {
+                name: string;
+                id: string;
+                enabled: boolean;
+                action: "challenge" | "allow" | "block" | "redirect" | "log";
+                priority: number;
+                conditions: {
+                    value: string | number | boolean | string[];
+                    field: "path" | "agentDid" | "clientDid" | "method" | "confidence" | "agentType" | "agentName" | "agentVendor" | "reputationScore" | "riskLevel" | "origin" | "userAgent" | "signatureVerified" | "isAuthenticated" | "hasValidDelegation";
+                    operator: "equals" | "notEquals" | "contains" | "notContains" | "startsWith" | "endsWith" | "greaterThan" | "lessThan" | "greaterThanOrEquals" | "lessThanOrEquals" | "matches" | "in" | "notIn";
+                    caseInsensitive?: boolean | undefined;
+                }[];
+                message?: string | undefined;
+                metadata?: {
+                    createdAt?: string | undefined;
+                    updatedAt?: string | undefined;
+                    createdBy?: string | undefined;
+                } | undefined;
+                description?: string | undefined;
+                redirectUrl?: string | undefined;
+            }[];
+            excludedPaths: string[];
+            metadata?: {
+                lastUpdated?: string | undefined;
+                updatedBy?: string | undefined;
+                policyId?: string | undefined;
+            } | undefined;
+            redirectUrl?: string | undefined;
+            includedPaths?: string[] | undefined;
+        };
+        changes?: string[] | undefined;
+    }, {
+        policy: {
+            metadata?: {
+                lastUpdated?: string | undefined;
+                updatedBy?: string | undefined;
+                policyId?: string | undefined;
+            } | undefined;
+            version?: string | undefined;
+            enabled?: boolean | undefined;
+            redirectUrl?: string | undefined;
+            defaultAction?: "challenge" | "allow" | "block" | "redirect" | "log" | undefined;
+            thresholds?: {
+                confidenceThreshold?: number | undefined;
+                confidenceAction?: "challenge" | "allow" | "block" | "redirect" | "log" | undefined;
+                minReputationScore?: number | undefined;
+                lowReputationAction?: "challenge" | "allow" | "block" | "redirect" | "log" | undefined;
+                trustedReputationThreshold?: number | undefined;
+                trustSignedRequests?: boolean | undefined;
+            } | undefined;
+            denyList?: {
+                agentDid?: string | undefined;
+                clientDid?: string | undefined;
+                expiresAt?: string | undefined;
+                reason?: string | undefined;
+                active?: boolean | undefined;
+                clientName?: string | undefined;
+                agentType?: string | undefined;
+                blockedAt?: string | undefined;
+                addedBy?: string | undefined;
+            }[] | undefined;
+            allowList?: {
+                agentDid?: string | undefined;
+                clientDid?: string | undefined;
+                reason?: string | undefined;
+                clientName?: string | undefined;
+                agentType?: string | undefined;
+                addedBy?: string | undefined;
+                addedAt?: string | undefined;
+            }[] | undefined;
+            rules?: {
+                name: string;
+                id: string;
+                action: "challenge" | "allow" | "block" | "redirect" | "log";
+                conditions: {
+                    value: string | number | boolean | string[];
+                    field: "path" | "agentDid" | "clientDid" | "method" | "confidence" | "agentType" | "agentName" | "agentVendor" | "reputationScore" | "riskLevel" | "origin" | "userAgent" | "signatureVerified" | "isAuthenticated" | "hasValidDelegation";
+                    operator: "equals" | "notEquals" | "contains" | "notContains" | "startsWith" | "endsWith" | "greaterThan" | "lessThan" | "greaterThanOrEquals" | "lessThanOrEquals" | "matches" | "in" | "notIn";
+                    caseInsensitive?: boolean | undefined;
+                }[];
+                message?: string | undefined;
+                metadata?: {
+                    createdAt?: string | undefined;
+                    updatedAt?: string | undefined;
+                    createdBy?: string | undefined;
+                } | undefined;
+                enabled?: boolean | undefined;
+                description?: string | undefined;
+                priority?: number | undefined;
+                redirectUrl?: string | undefined;
+            }[] | undefined;
+            excludedPaths?: string[] | undefined;
+            includedPaths?: string[] | undefined;
+        };
+        changes?: string[] | undefined;
+    }>;
+    metadata: z.ZodOptional<z.ZodObject<{
+        requestId: z.ZodOptional<z.ZodString>;
+        timestamp: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        timestamp?: string | undefined;
+        requestId?: string | undefined;
+    }, {
+        timestamp?: string | undefined;
+        requestId?: string | undefined;
+    }>>;
+}, "strip", z.ZodTypeAny, {
+    success: boolean;
+    data: {
+        policy: {
+            version: string;
+            enabled: boolean;
+            defaultAction: "challenge" | "allow" | "block" | "redirect" | "log";
+            thresholds: {
+                confidenceThreshold: number;
+                confidenceAction: "challenge" | "allow" | "block" | "redirect" | "log";
+                minReputationScore: number;
+                lowReputationAction: "challenge" | "allow" | "block" | "redirect" | "log";
+                trustedReputationThreshold: number;
+                trustSignedRequests: boolean;
+            };
+            denyList: {
+                active: boolean;
+                agentDid?: string | undefined;
+                clientDid?: string | undefined;
+                expiresAt?: string | undefined;
+                reason?: string | undefined;
+                clientName?: string | undefined;
+                agentType?: string | undefined;
+                blockedAt?: string | undefined;
+                addedBy?: string | undefined;
+            }[];
+            allowList: {
+                agentDid?: string | undefined;
+                clientDid?: string | undefined;
+                reason?: string | undefined;
+                clientName?: string | undefined;
+                agentType?: string | undefined;
+                addedBy?: string | undefined;
+                addedAt?: string | undefined;
+            }[];
+            rules: {
+                name: string;
+                id: string;
+                enabled: boolean;
+                action: "challenge" | "allow" | "block" | "redirect" | "log";
+                priority: number;
+                conditions: {
+                    value: string | number | boolean | string[];
+                    field: "path" | "agentDid" | "clientDid" | "method" | "confidence" | "agentType" | "agentName" | "agentVendor" | "reputationScore" | "riskLevel" | "origin" | "userAgent" | "signatureVerified" | "isAuthenticated" | "hasValidDelegation";
+                    operator: "equals" | "notEquals" | "contains" | "notContains" | "startsWith" | "endsWith" | "greaterThan" | "lessThan" | "greaterThanOrEquals" | "lessThanOrEquals" | "matches" | "in" | "notIn";
+                    caseInsensitive?: boolean | undefined;
+                }[];
+                message?: string | undefined;
+                metadata?: {
+                    createdAt?: string | undefined;
+                    updatedAt?: string | undefined;
+                    createdBy?: string | undefined;
+                } | undefined;
+                description?: string | undefined;
+                redirectUrl?: string | undefined;
+            }[];
+            excludedPaths: string[];
+            metadata?: {
+                lastUpdated?: string | undefined;
+                updatedBy?: string | undefined;
+                policyId?: string | undefined;
+            } | undefined;
+            redirectUrl?: string | undefined;
+            includedPaths?: string[] | undefined;
+        };
+        changes?: string[] | undefined;
+    };
+    metadata?: {
+        timestamp?: string | undefined;
+        requestId?: string | undefined;
+    } | undefined;
+}, {
+    success: boolean;
+    data: {
+        policy: {
+            metadata?: {
+                lastUpdated?: string | undefined;
+                updatedBy?: string | undefined;
+                policyId?: string | undefined;
+            } | undefined;
+            version?: string | undefined;
+            enabled?: boolean | undefined;
+            redirectUrl?: string | undefined;
+            defaultAction?: "challenge" | "allow" | "block" | "redirect" | "log" | undefined;
+            thresholds?: {
+                confidenceThreshold?: number | undefined;
+                confidenceAction?: "challenge" | "allow" | "block" | "redirect" | "log" | undefined;
+                minReputationScore?: number | undefined;
+                lowReputationAction?: "challenge" | "allow" | "block" | "redirect" | "log" | undefined;
+                trustedReputationThreshold?: number | undefined;
+                trustSignedRequests?: boolean | undefined;
+            } | undefined;
+            denyList?: {
+                agentDid?: string | undefined;
+                clientDid?: string | undefined;
+                expiresAt?: string | undefined;
+                reason?: string | undefined;
+                active?: boolean | undefined;
+                clientName?: string | undefined;
+                agentType?: string | undefined;
+                blockedAt?: string | undefined;
+                addedBy?: string | undefined;
+            }[] | undefined;
+            allowList?: {
+                agentDid?: string | undefined;
+                clientDid?: string | undefined;
+                reason?: string | undefined;
+                clientName?: string | undefined;
+                agentType?: string | undefined;
+                addedBy?: string | undefined;
+                addedAt?: string | undefined;
+            }[] | undefined;
+            rules?: {
+                name: string;
+                id: string;
+                action: "challenge" | "allow" | "block" | "redirect" | "log";
+                conditions: {
+                    value: string | number | boolean | string[];
+                    field: "path" | "agentDid" | "clientDid" | "method" | "confidence" | "agentType" | "agentName" | "agentVendor" | "reputationScore" | "riskLevel" | "origin" | "userAgent" | "signatureVerified" | "isAuthenticated" | "hasValidDelegation";
+                    operator: "equals" | "notEquals" | "contains" | "notContains" | "startsWith" | "endsWith" | "greaterThan" | "lessThan" | "greaterThanOrEquals" | "lessThanOrEquals" | "matches" | "in" | "notIn";
+                    caseInsensitive?: boolean | undefined;
+                }[];
+                message?: string | undefined;
+                metadata?: {
+                    createdAt?: string | undefined;
+                    updatedAt?: string | undefined;
+                    createdBy?: string | undefined;
+                } | undefined;
+                enabled?: boolean | undefined;
+                description?: string | undefined;
+                priority?: number | undefined;
+                redirectUrl?: string | undefined;
+            }[] | undefined;
+            excludedPaths?: string[] | undefined;
+            includedPaths?: string[] | undefined;
+        };
+        changes?: string[] | undefined;
+    };
+    metadata?: {
+        timestamp?: string | undefined;
+        requestId?: string | undefined;
+    } | undefined;
+}>;
+export type UpdatePolicyResponse = z.infer<typeof UpdatePolicyResponseSchema>;
+/**
+ * Validate a policy configuration
+ */
+export declare function validatePolicyConfig(data: unknown): PolicyConfig;
+/**
+ * Safely validate a policy configuration (returns result object)
+ */
+export declare function safeParsePolicyConfig(data: unknown): z.SafeParseReturnType<{
+    metadata?: {
+        lastUpdated?: string | undefined;
+        updatedBy?: string | undefined;
+        policyId?: string | undefined;
+    } | undefined;
+    version?: string | undefined;
+    enabled?: boolean | undefined;
+    redirectUrl?: string | undefined;
+    defaultAction?: "challenge" | "allow" | "block" | "redirect" | "log" | undefined;
+    thresholds?: {
+        confidenceThreshold?: number | undefined;
+        confidenceAction?: "challenge" | "allow" | "block" | "redirect" | "log" | undefined;
+        minReputationScore?: number | undefined;
+        lowReputationAction?: "challenge" | "allow" | "block" | "redirect" | "log" | undefined;
+        trustedReputationThreshold?: number | undefined;
+        trustSignedRequests?: boolean | undefined;
+    } | undefined;
+    denyList?: {
+        agentDid?: string | undefined;
+        clientDid?: string | undefined;
+        expiresAt?: string | undefined;
+        reason?: string | undefined;
+        active?: boolean | undefined;
+        clientName?: string | undefined;
+        agentType?: string | undefined;
+        blockedAt?: string | undefined;
+        addedBy?: string | undefined;
+    }[] | undefined;
+    allowList?: {
+        agentDid?: string | undefined;
+        clientDid?: string | undefined;
+        reason?: string | undefined;
+        clientName?: string | undefined;
+        agentType?: string | undefined;
+        addedBy?: string | undefined;
+        addedAt?: string | undefined;
+    }[] | undefined;
+    rules?: {
+        name: string;
+        id: string;
+        action: "challenge" | "allow" | "block" | "redirect" | "log";
+        conditions: {
+            value: string | number | boolean | string[];
+            field: "path" | "agentDid" | "clientDid" | "method" | "confidence" | "agentType" | "agentName" | "agentVendor" | "reputationScore" | "riskLevel" | "origin" | "userAgent" | "signatureVerified" | "isAuthenticated" | "hasValidDelegation";
+            operator: "equals" | "notEquals" | "contains" | "notContains" | "startsWith" | "endsWith" | "greaterThan" | "lessThan" | "greaterThanOrEquals" | "lessThanOrEquals" | "matches" | "in" | "notIn";
+            caseInsensitive?: boolean | undefined;
+        }[];
+        message?: string | undefined;
+        metadata?: {
+            createdAt?: string | undefined;
+            updatedAt?: string | undefined;
+            createdBy?: string | undefined;
+        } | undefined;
+        enabled?: boolean | undefined;
+        description?: string | undefined;
+        priority?: number | undefined;
+        redirectUrl?: string | undefined;
+    }[] | undefined;
+    excludedPaths?: string[] | undefined;
+    includedPaths?: string[] | undefined;
+}, {
+    version: string;
+    enabled: boolean;
+    defaultAction: "challenge" | "allow" | "block" | "redirect" | "log";
+    thresholds: {
+        confidenceThreshold: number;
+        confidenceAction: "challenge" | "allow" | "block" | "redirect" | "log";
+        minReputationScore: number;
+        lowReputationAction: "challenge" | "allow" | "block" | "redirect" | "log";
+        trustedReputationThreshold: number;
+        trustSignedRequests: boolean;
+    };
+    denyList: {
+        active: boolean;
+        agentDid?: string | undefined;
+        clientDid?: string | undefined;
+        expiresAt?: string | undefined;
+        reason?: string | undefined;
+        clientName?: string | undefined;
+        agentType?: string | undefined;
+        blockedAt?: string | undefined;
+        addedBy?: string | undefined;
+    }[];
+    allowList: {
+        agentDid?: string | undefined;
+        clientDid?: string | undefined;
+        reason?: string | undefined;
+        clientName?: string | undefined;
+        agentType?: string | undefined;
+        addedBy?: string | undefined;
+        addedAt?: string | undefined;
+    }[];
+    rules: {
+        name: string;
+        id: string;
+        enabled: boolean;
+        action: "challenge" | "allow" | "block" | "redirect" | "log";
+        priority: number;
+        conditions: {
+            value: string | number | boolean | string[];
+            field: "path" | "agentDid" | "clientDid" | "method" | "confidence" | "agentType" | "agentName" | "agentVendor" | "reputationScore" | "riskLevel" | "origin" | "userAgent" | "signatureVerified" | "isAuthenticated" | "hasValidDelegation";
+            operator: "equals" | "notEquals" | "contains" | "notContains" | "startsWith" | "endsWith" | "greaterThan" | "lessThan" | "greaterThanOrEquals" | "lessThanOrEquals" | "matches" | "in" | "notIn";
+            caseInsensitive?: boolean | undefined;
+        }[];
+        message?: string | undefined;
+        metadata?: {
+            createdAt?: string | undefined;
+            updatedAt?: string | undefined;
+            createdBy?: string | undefined;
+        } | undefined;
+        description?: string | undefined;
+        redirectUrl?: string | undefined;
+    }[];
+    excludedPaths: string[];
+    metadata?: {
+        lastUpdated?: string | undefined;
+        updatedBy?: string | undefined;
+        policyId?: string | undefined;
+    } | undefined;
+    redirectUrl?: string | undefined;
+    includedPaths?: string[] | undefined;
+}>;
+/**
+ * Validate a deny list entry
+ */
+export declare function validateDenyListEntry(data: unknown): DenyListEntry;
+/**
+ * Validate a policy rule
+ */
+export declare function validatePolicyRule(data: unknown): PolicyRule;
+/**
+ * Default policy configuration for new projects
+ */
+export declare const DEFAULT_POLICY_CONFIG: PolicyConfig;
+/**
+ * Example: Block high-confidence AI agents
+ */
+export declare const EXAMPLE_BLOCK_AI_AGENTS: PolicyRule;
+/**
+ * Example: Allow verified ChatGPT
+ */
+export declare const EXAMPLE_ALLOW_CHATGPT: AllowListEntry;
+/**
+ * Example: Challenge low-reputation agents
+ */
+export declare const EXAMPLE_CHALLENGE_LOW_REP: PolicyRule;