/**
 * Post-quantum companion check for the InsumerAPI JWT (ML-DSA-65, RFC 9964).
 *
 * InsumerAPI returns a sibling `pqJwt` beside `jwt`: a compact JWS with
 * `alg: "ML-DSA-65"` over the same claims, signed under a post-quantum key
 * published in the same JWKS as an RFC 9964 `AKP` entry. It is ADDITIVE; the
 * ES256 `jwt` this package already verifies is unchanged.
 *
 * ML-DSA is not in Web Crypto or jose. Verification uses `@noble/post-quantum`
 * when it is installed (optional peer dependency); when it is not, the status
 * is `unverifiable` with a reason, never a silent pass or a silent failure.
 *
 * Reported, not refused: the companion's status is returned beside the
 * classical result. `refuted` (present and failing) is always treated as a
 * failure. `absent` or `unverifiable` only matter once the caller's own
 * `pqRequiredFrom` date has passed, judged by this process's clock.
 */
export type PqStatus = 'verified' | 'refuted' | 'absent' | 'unverifiable';
export interface PqResult {
    status: PqStatus;
    kid?: string;
    reason?: string;
}
export declare function verifyPqCompanion(pqJwt: unknown, classicalPayload: Record<string, unknown>, jwksUrl: string): Promise<PqResult>;
/** Policy: does this companion status fail the check, given the caller's cutoff? */
export declare function pqFails(result: PqResult, pqRequiredFrom?: string | Date): boolean;
//# sourceMappingURL=pq.d.ts.map