(function (root, factory) {
  const api = factory();
  if (typeof module === "object" && module.exports) module.exports = api;
  if (root) root.AtlasLens = api;
})(typeof globalThis !== "undefined" ? globalThis : this, function () {
  "use strict";

  const OPERATIONS = new Set(["reference", "generate", "publish", "replace_master"]);
  const MEDIA = new Set(["visual", "gallery", "voice", "model_3d", "motion"]);

  function blocked(rule, reason) {
    return { decision: "BLOCKED", rule, reason, resource: null };
  }

  function evaluate(registry, slug, operation, medium) {
    if (!registry || !Array.isArray(registry.identities)) {
      return blocked("registry.identities must be an array", "The registry contract is unavailable or malformed.");
    }
    if (!OPERATIONS.has(operation)) {
      return blocked("operation must be registered", `Unknown operation: ${String(operation)}`);
    }
    if (!MEDIA.has(medium)) {
      return blocked("medium must be registered", `Unknown medium: ${String(medium)}`);
    }
    const identity = registry.identities.find((item) => item && item.slug === slug);
    if (!identity) {
      return blocked("identity slug must resolve exactly", `No identity is registered as ${String(slug)}.`);
    }
    const permissions = identity.permissions || {};
    if (permissions[operation] !== true) {
      return blocked(`permissions.${operation} must equal true`, `${identity.name} does not permit ${operation}.`);
    }
    const profile = identity.production_profiles && identity.production_profiles[medium];
    if (!profile || !["ready", "reference-only", "restricted", "unregistered"].includes(profile.state)) {
      return blocked(`production_profiles.${medium} must be registered`, `${identity.name} has no valid ${medium} production profile.`);
    }
    if (profile.state === "unregistered") {
      return blocked(`production_profiles.${medium}.state=unregistered`, `No approved ${medium} resources are registered for ${identity.name}.`);
    }
    if (profile.state === "restricted") {
      return blocked(`production_profiles.${medium}.state=restricted`, `${identity.name}'s ${medium} resources require an authority path outside this public contract.`);
    }
    if (profile.state === "reference-only" && operation !== "reference") {
      return blocked(`production_profiles.${medium}.state=reference-only`, `${identity.name}'s ${medium} resources may be inspected but not used for ${operation}.`);
    }
    if (permissions.approval_required === true && ["publish", "replace_master"].includes(operation)) {
      return blocked("permissions.approval_required=true", `${identity.name} requires human approval before ${operation}.`);
    }
    const resourceIds = Array.isArray(profile.resource_ids) ? profile.resource_ids : [];
    const resource = (identity.resources || []).find((candidate) => resourceIds.includes(candidate.id));
    if (!resource || !resource.sha256 || !resource.immutable_url) {
      return blocked(`production_profiles.${medium}.resource_ids must resolve`, `No checksum-locked ${medium} resource resolves for ${identity.name}.`);
    }
    return {
      decision: "ALLOWED",
      rule: `permissions.${operation}=true; production_profiles.${medium}.state=${profile.state}`,
      reason: `${identity.name} may ${operation} using the registered ${medium} resource.`,
      resource: {
        id: resource.id,
        role: resource.role,
        mime: resource.mime,
        url: resource.url,
        immutable_url: resource.immutable_url,
        sha256: resource.sha256
      }
    };
  }

  return { evaluate };
});
