Schema for built-in accessor entries.

Returns a set of all alias keys in the registry.

Schema for an alias entry.

Returns a map of qualified policy keys to their expressions.

Example: {:auth/admin [:= :doc/role "admin"], ...}

Schema for the :fn builtins entry.

Creates a new registry with built-in entries.

Built-ins include: - :doc — document accessor - :fn — builtin functions - :self — self-references - :param — parameter accessor - :event — event accessor

Returns the global registry, initializing if needed.

Initializes the global registry. Idempotent.

Protocol for registry operations.

Returns a set of all module namespace keys in the registry.

Schema for a user-defined module entry.

Policies can be simple expressions or rich definitions with metadata:

;; Simple
{:policies {:admin [:= :doc/role "admin"]}}

;; Rich with defaults and descriptions
{:policies {:has-role {:expr [:= :doc/role :param/role]
                       :description "Checks user role"
                       :params {:role {:default "user"}}}}}

Returns default values for a policy’s parameters.

Returns a map of param-key to default value for params that have defaults. Returns empty map if the policy has no defaults or is not found.

;; Given: {:has-role {:expr [...] :params {:role {:default "user"}}}}
(param-defaults registry :auth :has-role)
;=> {:role "user"}

Schema for parameter definition with optional metadata.

Can be either a simple keyword or a rich map with description/default.

Returns all parameterized policies in a module.

Returns a map of policy-key to param info for policies that require params.

(parameterized-policies registry :auth)
;=> {:has-role {:params #{:role}
;               :param-defs {:role {:description "..."}}
;               :description "Checks role"}}

Returns information about a policy in the registry.

Returns a map with: - :expr — the policy expression - :params — set of required parameter keys - :param-defs — map of param key to definition (description, default, etc.) - :defaults — map of param key to default value - :description — policy description if provided - :parameterized? — true if policy requires params

Returns nil if the policy is not found.

(policy-info registry :auth :has-role)
;=> {:expr [:= :doc/role :param/role]
;    :params #{:role}
;    :param-defs {:role {:description "Role to check"}}
;    :defaults {}
;    :description "Checks user role"
;    :parameterized? true}

Schema for a policy definition with optional param metadata.

Can be either a simple expression or a rich map with description/params.

Adds an alias to the registry. Returns a new registry.

alias-key is the alias keyword (e.g., :a). target-key is the namespace it points to (e.g., :auth).

Throws if alias-key is a reserved namespace or if target-key does not exist in the registry.

Registers an alias in the global registry.

Adds a module to the registry. Returns a new registry.

ns-key is the namespace keyword (e.g., :auth). module-def is a map with: - :policies — map of policy-key to policy expression - :imports — (optional) vector of imported namespace keys

Throws if ns-key is a reserved namespace.

Registers a module in the global registry.

Schema for the complete registry.

Schema for any registry entry.

Valid entry types in the registry.

Returns true if ns-key is a reserved namespace.

Set of namespace keywords reserved for built-in accessors.

Resets the global registry to a fresh state. Useful for testing.

Resolves a namespaced keyword to its handler information.

Returns a map with: - :namespace — the namespace keyword - :name — the local name keyword - :entry — the resolved registry entry

Returns nil if the namespace is not found.

Resolution precedence: 1. Built-in namespaces (:doc, :fn, :self, :param, :event) 2. Aliases (followed to target) 3. User modules

Removes a module from the registry. Returns a new registry.

Does not remove aliases pointing to this module.

Validates a module definition against the schema.

Returns {:ok module-def} if valid, {:error error-map} if invalid.

Validates the complete registry against the schema.

Returns {:ok registry} if valid, {:error error-map} if invalid.