import { Jwk } from "@authhero/adapter-interfaces";
import { SsrfFetchOptions } from "../utils/ssrf-fetch";
export interface LoadClientKeysOptions {
    fetch?: SsrfFetchOptions;
}
/**
 * Subset of Client fields the JWKS loader actually reads. Narrower than
 * `Client` so callers can pass `EnrichedClient` (which redefines the
 * `connections` field shape) without structural mismatch.
 */
export interface ClientWithKeys {
    client_metadata?: Record<string, string> | undefined;
    registration_metadata?: Record<string, unknown> | undefined;
}
/**
 * Resolve a client's JWS verification keys. Per RFC 7591 §2 a client may
 * publish keys inline (`jwks`) or by reference (`jwks_uri`). Inline takes
 * precedence when both are present.
 *
 * jwks is stored on `client.registration_metadata.jwks` (DCR forward-compat
 * field); jwks_uri is stored on `client.client_metadata.jwks_uri`.
 *
 * Returns an empty array when the client has neither — callers must decide
 * whether that's allowed for the alg in question (HS* algs don't need it;
 * asymmetric algs do).
 */
export declare function loadClientJwks(client: ClientWithKeys, opts?: LoadClientKeysOptions): Promise<Jwk[]>;
