/**
 * NS drift reconciler — enforces Cloudflare DNS delegation for portfolios that choose it.
 * portfolio: every domain's nameservers must point to Cloudflare. Detects drift
 * (registrar NS not Cloudflare) and can re-delegate. Pure detection + an
 * injected reconcile loop, so it is fully testable.
 */
export declare function isCloudflareNs(ns: string[]): boolean;
export interface NsDriftVerdict {
    domain: string;
    drifted: boolean;
    reason: string;
}
export declare function classifyNsDrift(domain: string, registrarNs: string[]): NsDriftVerdict;
export interface NsReconcileDeps {
    getRegistrarNs: (domain: string) => Promise<string[]>;
    getCloudflareNs: (domain: string) => Promise<string[]>;
    setRegistrarNs: (domain: string, ns: string[]) => Promise<void>;
    log?: (event: string, detail: Record<string, unknown>) => void;
}
export interface NsReconcileSummary {
    checked: number;
    drifted: NsDriftVerdict[];
    fixed: string[];
    errors: number;
}
export declare function reconcileNsDrift(domains: string[], deps: NsReconcileDeps, opts?: {
    fix?: boolean;
}): Promise<NsReconcileSummary>;
//# sourceMappingURL=ns-drift.d.ts.map