/**
 * @param {import('../clients.js').Client} client
 * @param {{ allowJwksHost?: (hostname: string, url: URL) => boolean }} [options]
 *   `allowJwksHost` gates the destination of a `jwksUri` fetch. A client's
 *   `jwks_uri` is client-supplied — under open or token-gated dynamic
 *   registration it is chosen by whoever registered — so a deployment can
 *   constrain which hosts the server will reach out to.
 * @returns {Promise<Function>} a `keyish` resolver for `jwt.verify`
 */
export function resolveClientKeys(client: import("../clients.js").Client, options?: {
    allowJwksHost?: (hostname: string, url: URL) => boolean;
}): Promise<Function>;