Function policiesCreate

packages/core/sdk/src/executor.ts:5969–6017

(
      input: CreateToolPolicyInput,
    )

        );

    const policiesCreate = (
      input: CreateToolPolicyInput,
    ): Effect.Effect<ToolPolicy, OrgWriteDeniedError | StorageFailure> =>
      transaction(
        Effect.gen(function* () {
          yield* guardOrgWrite(input.owner);
          if (!isValidPattern(input.pattern)) {
            return yield* new StorageError({
              message: `Invalid tool policy pattern: ${input.pattern}`,
              cause: undefined,
            });
          }
          if (!isToolPolicyAction(input.action)) {
            return yield* new StorageError({
              message: `Invalid tool policy action: ${String(input.action)}`,
              cause: undefined,
            });
          }
          yield* requireUserSubject(input.owner);
          const keys = yield* Effect.try({
            try: () => ownedKeys(input.owner),
            catch: (cause) => storageFailureFromUnknown("invalid owner", cause),
          });
          const existing = yield* core.findMany("tool_policy", {
            where: byOwner(input.owner),
          });
          // Default placement is specificity-aware (below any more-specific
          // rule), not top-of-list: a client that omits position — the UI when
          // its policy list is stale, the API, an agent tool — must not have its
          // broad rule silently shadow an existing narrow one.
          const position = input.position ?? positionForNewPattern(input.pattern, existing);
          const id = PolicyId.make(
            `pol_${Math.random().toString(36).slice(2)}${Date.now().toString(36)}`,
          );
          const now = new Date();
          const created = yield* core.create("tool_policy", {
            tenant: keys.tenant,
            owner: keys.owner,
            subject: keys.subject,
            id: String(id),
            pattern: input.pattern,
            action: input.action,
            position,
            created_at: now,
            updated_at: now,
          });
          return rowToToolPolicy(created);
        }),
      );

    const policiesUpdate = (
      input: UpdateToolPolicyInput,