Reads a value from scope by key (raw, for comparison)
Checks if a key's ACTUAL value is masked (for evidence display)
The WhereFilter to evaluate
What the row keeps of this threshold, the run's answer as data
(RedactionRule · serveThreshold), asked once per condition AFTER that key's read, because that read can be the
selected one, and after the rule ran on the real value. Default: the value itself, or a hole when its key is masked.
— matched = all conditions passed
Evaluates a Prisma-style filter against scope values.
Empty filter → NO match (anti-vacuous-truth — inverts Prisma/SQL)
A filter with no evaluable conditions (
{}, or only denied/non-object keys) returnsmatched: false. This deliberately INVERTS the Prisma/SQL intuition wherewhere: {}matches everything: in a decision rule, a rule that asserts nothing should never win a branch — "all zero conditions passed" is vacuous truth, and silently routing on it would fabricate decision evidence. Want a catch-all? Use the explicitdefaultBranchargument ofdecide()instead of an emptywhen.Unknown operators → condition fails (+ dev-mode warning)
An operator outside the supported set (
eq, ne, gt, gte, lt, lte, in, notIn) records a failed condition — the rule can never spuriously match through a typo (gtemisspelledgle). With dev mode enabled (enableDevMode()), a console warning names the unknown operator and key.Two comparison laws, no coercion
eq/ne/in/notInask for the SAME VALUE (sameValue);gt/gte/lt/lteask for an ORDER, which holds only between two numbers, two bigints, two strings or two Dates (inOrder). A missing value (null,undefined) is in no order with anything, so an ordered condition on it does not hold.