/** Headers injected only after successful x402 payment verification / settle. */
export declare const TOLLGATE_SECRET_HEADER = "x-tollgate-secret";
export declare const TOLLGATE_PAID_HEADER = "x-tollgate-paid";
export declare const TOLLGATE_TIMESTAMP_HEADER = "x-tollgate-timestamp";
/** Client-supplied trust headers must be stripped before injection (anti-spoof). */
export declare const TOLLGATE_TRUST_HEADERS: readonly ["x-tollgate-secret", "x-tollgate-paid", "x-tollgate-timestamp", "X-Tollgate-Secret", "X-Tollgate-Paid", "X-Tollgate-Timestamp"];
export interface UpstreamTrustMaterial {
    /** Raw shared secret (also sent as X-Tollgate-Secret for simple upstream checks). */
    secret: string;
    /** Unix ms timestamp used in the HMAC payload. */
    timestamp: string;
    /** hex(HMAC-SHA256(secret, `${timestamp}.${method}.${path}`)) */
    paidHmac: string;
}
/**
 * Build zero-trust stub headers for seller upstreams that only trust the tollgate.
 * Not mTLS — shared-secret + HMAC MVP. Upstream must require these and reject public direct hits.
 */
export declare function buildUpstreamTrustHeaders(secret: string, req: {
    method: string;
    path: string;
}, nowMs?: number): UpstreamTrustMaterial & {
    headers: Record<string, string>;
};
/** Optional helper for Express upstreams — verify HMAC (and optional raw secret). */
export declare function verifyUpstreamTrustHeaders(secret: string, headers: Record<string, string | string[] | undefined>, req: {
    method: string;
    path: string;
}, options?: {
    maxSkewMs?: number;
    nowMs?: number;
}): {
    ok: true;
} | {
    ok: false;
    reason: string;
};