/**
 * buildRunContext — the single code path that derives `RunContext` from
 * pipeline inputs.
 *
 * `RunContext` is the 9-field shape shared between `RunManifest.context`
 * (in GCS) and `ReportProvenance` (in Content Lake, which `extends
 * RunContext`). Routing every consumer through this function makes it
 * structurally impossible for the two to disagree: there is no second
 * code path to drift against.
 *
 * Contract test: `packages/eval/src/__tests__/run-context-parity.test.ts`
 *
 * @see docs/decisions/D0032-run-anchored-artifact-store.md (§ Move 5 — Drift Prevention)
 */
import { type Logger, type RunContext } from "../_vendor/ailf-core/index.d.ts";
import { type LiteracyVariant, type RunClassification, type RunExecutor, type RunExecutorSurface, type RunHost, type RunLineage, type RunOwner, type RunTool } from "../_vendor/ailf-shared/index.d.ts";
import type { ResolvedSourceConfig } from "../sources.js";
import type { EvalMode } from "./types.js";
/**
 * Inputs required to derive a `RunContext`. `ProvenanceInput` extends this
 * so every caller of `buildProvenance` is automatically a valid input to
 * `buildRunContext`.
 */
export interface RunContextInput {
    /** Feature areas that were evaluated */
    areas: string[];
    /**
     * Git metadata from the *calling* repository (cross-repo evaluations).
     * When provided, overrides CI env var detection so context attributes
     * to the caller — not the AILF core repo where the workflow executes.
     */
    callerGit?: {
        branch?: string;
        prNumber?: number;
        repo: string;
        sha?: string;
    };
    /**
     * Caller-provided D0037 envelope from a `--remote` PipelineRequest.
     * When set, overrides the server-env detection so the caller's intent
     * survives the API boundary. Same override pattern as `callerGit`.
     *
     * Only caller-identity fields are carried — `executor.email`, `tool`,
     * and `host` stay server-inferred.
     *
     * @see docs/decisions/D0037-run-classification-and-ownership-taxonomy.md
     */
    callerEnvelope?: {
        classification?: RunClassification;
        owner?: {
            team: string;
            individual?: string;
        };
        executor?: {
            type: "user";
            surface: RunExecutorSurface;
            name?: string;
            githubActor?: string;
        };
        purpose?: string;
        labels?: string[];
    };
    /** Evaluation fingerprint for cross-environment cache lookup */
    evalFingerprint?: string;
    /** Caller-supplied run lineage (re-runs, comparison partners, parent job). */
    lineage?: RunLineage;
    /** Logger instance (defaults to ConsoleLogger) */
    logger?: Logger;
    /** Evaluation mode */
    mode: EvalMode;
    /** Path to the package root (for reading config/models) */
    rootDir: string;
    /** Resolved documentation source */
    source: ResolvedSourceConfig;
    /** Specific task IDs evaluated (if scoped) */
    taskIds?: string[];
    /**
     * Literacy mode variant (`baseline | agentic | observed | full`). Only
     * meaningful when `mode === "literacy"`; ignored for other modes. Lands
     * on `RunContext.variant` and `ReportProvenance.variant` so consumers
     * can disambiguate which literacy variant the run executed.
     */
    variant?: LiteracyVariant;
    /**
     * Model IDs the caller requested via `PipelineRequest.models`. When
     * present, `RunContext.models` is filtered to this subset so the report's
     * `provenance.models` reflects what was actually evaluated. Unknown IDs
     * are silently filtered out — the upstream rejection path (W0281
     * `filterModelsByRequest`) has already failed the run or warned.
     */
    requestedModelIds?: string[];
}
/**
 * Resolve the provenance-policy-relevant fields (`classification`, `owner`,
 * `purpose`) from a caller envelope, falling back to server-env detection.
 *
 * This is the single resolution path shared by `buildRunContext` (which
 * records these on the report) and the pre-publish provenance gate (which
 * evaluates them). Routing both through one function means the value the gate
 * checks is exactly the value the report would carry — no second path to drift
 * against, mirroring the "one evaluator, two gates" guarantee.
 *
 * @see docs/design-docs/run-provenance-ownership-enforcement.md (T2)
 */
export declare function resolveProvenanceFields(envelope: RunContextInput["callerEnvelope"], log: Logger): {
    classification: RunClassification;
    owner: RunOwner;
    purpose?: string;
};
/**
 * Derive `RunContext` from pipeline inputs. The only construction path.
 *
 * Both `FinalizeRunStep` (via `RunManifest.context`) and
 * `PublishReportStep` (via `ReportProvenance`) call this function — the
 * former directly, the latter transitively through `buildProvenance`.
 */
export declare function buildRunContext(input: RunContextInput): RunContext;
/**
 * Resolve `classification` from `AILF_CLASSIFICATION`, validated against
 * the closed enum. Defaults to `"adhoc"` so unannotated runs never leak
 * into the canonical `"official"` series.
 */
export declare function detectClassification(log: Logger): RunClassification;
/**
 * Resolve `owner` from `AILF_OWNER_TEAM` (+ optional
 * `AILF_OWNER_INDIVIDUAL`). `team` is free-form; default is `"unknown"`.
 *
 * The init-template placeholder (`PLACEHOLDER_OWNER_TEAM`) is treated as
 * if the env var were unset — consumers that haven't filled it in yet
 * end up with `team: "unknown"` instead of the literal placeholder being
 * persisted onto the report (W0143).
 */
export declare function detectOwner(): RunOwner;
/**
 * Detect who/what invoked the run.
 *
 * Priority:
 * 1. GitHub Actions context → `{ type: "system", name: "github-actions", ... }`
 * 2. CLI context → `{ type: "user", surface: "cli", ... }` with git-config
 *    or OS username fallback. Email capture gated by
 *    `AILF_CAPTURE_EMAIL` (default on; set `0` to opt out).
 *
 * Every identity field is optional — missing git, containers, or masked
 * env vars must never block a run.
 */
export declare function detectExecutor(): RunExecutor;
/**
 * Resolve `tool` — which AILF/Node ran the eval. Captured on every new
 * run so cross-version trend comparisons can isolate framework changes
 * from doc changes.
 */
export declare function detectTool(log: Logger): RunTool;
/**
 * Resolve `host` — platform + arch + CI provider. Hostname is
 * intentionally excluded (leaks identity without filtering benefit).
 */
export declare function detectHost(): RunHost;
