/**
 * A broker publish violation arrives on the CONNECTION, asynchronously, while
 * `nc.publish` itself returns normally. Watching `nc.status()` for OUR subject
 * is how a caller tells a missing GRANT from a missing RESPONDER: the two need
 * opposite responses, and a deadline that reads as "that endpoint isn't there"
 * is the wrong one.
 *
 * REGISTER THE WATCH BEFORE THE PUBLISH IT IS WATCHING. `nc.status()` registers
 * its listener at CALL time, so one created after `nc.publish` cannot see a
 * violation dispatched in between, and that dropped event is indistinguishable
 * from the silence this watch exists to eliminate.
 *
 * RELEASE IS `stop()`, NOT `return()`. The stream is a `QueuedIterator` parked
 * on an internal signal await, so a queued `return()` does not run until the
 * NEXT status event — which on a healthy connection may never come, leaking one
 * listener per call. `status()` is typed as a bare `AsyncIterable`, so `stop`
 * is reached structurally and its absence fails loud HERE rather than leaking
 * quietly.
 *
 * Watch only for OUR subject. The connection is shared, and another component's
 * denial or an unrelated transport error must not fail this call.
 */
import { PermissionViolationError, type NatsConnection } from "@nats-io/transport-node";
export type StatusStream = {
    [Symbol.asyncIterator](): AsyncIterator<{
        type: string;
        error?: unknown;
    }>;
    stop(err?: Error): void;
};
export declare function openPublishDenialWatch(nc: NatsConnection, subject: string, refusal: (err: PermissionViolationError) => Error, what: string): {
    denied: Promise<never>;
    release(): void;
};
//# sourceMappingURL=endpoint-publish-denial.d.ts.map