Method handleCreateAgent

internal/httpapi/agents_write.go:183–253

(ctx context.Context, in *createAgentInput)

}

func (s *Server) handleCreateAgent(ctx context.Context, in *createAgentInput) (*createAgentOutput, error) {
	user, err := s.requireAccountUser(ctx)
	if err != nil {
		return nil, err
	}
	req := in.Body
	email := identity.NormalizeEmail(req.Email)

	if email == "" {
		return nil, NewError(http.StatusBadRequest, "invalid_request", "email is required")
	}

	// Resolve the DNS domain from the email itself (AG-1/AG-2): there is one
	// create path. An email on the deployment's shared domain is a shared-domain
	// registration (its local-part is validated as a slug, no ownership check);
	// any other domain is a custom-domain agent gated by ownership below.
	parts := strings.SplitN(email, "@", 2)
	if len(parts) != 2 || parts[0] == "" || parts[1] == "" {
		return nil, NewError(http.StatusBadRequest, "invalid_request", "invalid email address")
	}
	domain := parts[1]
	isShared := s.deps.SharedDomain != "" && strings.EqualFold(domain, s.deps.SharedDomain)
	if isShared {
		domain = s.deps.SharedDomain // normalize to the configured casing
		if err := validateSlug(parts[0]); err != nil {
			return nil, NewError(http.StatusBadRequest, "invalid_slug", err.Error())
		}
	}

	// Custom-domain ownership guard (decision 1): the domain must be
	// registered to this user AND verified. This is the load-bearing
	// authorization that an agent can only be created on a domain the
	// caller controls.
	if !isShared {
		if s.deps.LookupDomain == nil {
			return nil, NewError(http.StatusInternalServerError, "internal_error", "domain lookup unavailable")
		}
		dom, err := s.deps.LookupDomain(ctx, domain, user.ID)
		if err != nil {
			return nil, NewError(http.StatusBadRequest, "domain_not_registered", "register and verify your domain first")
		}
		if !dom.Verified {
			return nil, NewError(http.StatusBadRequest, "domain_not_verified", "verify your domain first")
		}
	}

	// Per-user agent cap (after auth + domain checks, so a 402 means
	// "valid request, out of capacity" — never masks a 400/401).
	if s.deps.EnforceAgentCreate != nil {
		if err := s.deps.EnforceAgentCreate(ctx, user.ID); err != nil {
			if env, ok := limitEnvelope(err); ok {
				return nil, env
			}
			return nil, NewError(http.StatusInternalServerError, "internal_error", "limits check failed")
		}
	}

	if s.deps.CreateAgent == nil {