fix: emit upgrade + upgrade_jwt on anonymous fresh-success responses

internal/handlers/cache.go

@@ -260,6 +260,8 @@ func (h *CacheHandler) NewCache(c *fiber.Ctx) error {
 		"env":            resource.Env,
 		"limits":         cacheAnonymousLimits(),
 		"note":           upgradeNote(upgradeURL),
+		"upgrade":        upgradeURL,
+		"upgrade_jwt":    jwtToken,
 	}
 	if creds.KeyPrefix != "" {
 		resp["key_prefix"] = creds.KeyPrefix

internal/handlers/db.go

@@ -260,6 +260,8 @@ func (h *DBHandler) NewDB(c *fiber.Ctx) error {
 		"env":            resource.Env,
 		"limits":         dbAnonymousLimits(),
 		"note":           upgradeNote(upgradeURL),
+		"upgrade":        upgradeURL,
+		"upgrade_jwt":    jwtToken,
 	}
 	if storageExceeded {
 		resp["warning"] = "Storage limit reached. Upgrade to continue."

internal/handlers/nosql.go

@@ -248,6 +248,8 @@ func (h *NoSQLHandler) NewNoSQL(c *fiber.Ctx) error {
 		"env":            resource.Env,
 		"limits":         nosqlAnonymousLimits(),
 		"note":           upgradeNote(upgradeURL),
+		"upgrade":        upgradeURL,
+		"upgrade_jwt":    jwtToken,
 	}
 	if nosqlStorageExceeded {
 		nosqlResp["warning"] = "Storage limit reached. Upgrade to continue."

internal/handlers/queue.go

@@ -255,6 +255,8 @@ func (h *QueueHandler) NewQueue(c *fiber.Ctx) error {
 		"env":            resource.Env,
 		"limits":         queueAnonymousLimits(),
 		"note":           upgradeNote(upgradeURL),
+		"upgrade":        upgradeURL,
+		"upgrade_jwt":    jwtToken,
 	})
 }
 

internal/handlers/upgrade_jwt_response_test.go

@@ -14,6 +14,51 @@ import (
 	"instant.dev/internal/testhelpers"
 )
 
+// TestAnonymousProvisionEmitsUpgradeJWT_OnFreshSuccess guards friction #17:
+// the fresh-success path (newly provisioned anonymous resource, not dedup)
+// must emit upgrade + upgrade_jwt alongside note. Prior to this fix the URL
+// was only embedded inside the note text and an agent had to string-parse
+// it back out — defeating the point of having a structured response.
+//
+// Fires /cache/new once from an unused IP. We don't strictly need provisioning
+// to fully succeed against the test DB (a 503 still emits the upgrade fields
+// before falling through) — we just assert the response object has the
+// fields when StatusCreated is returned.
+func TestAnonymousProvisionEmitsUpgradeJWT_OnFreshSuccess(t *testing.T) {
+	db, cleanDB := testhelpers.SetupTestDB(t)
+	defer cleanDB()
+	rdb, cleanRedis := testhelpers.SetupTestRedis(t)
+	defer cleanRedis()
+
+	app, cleanApp := testhelpers.NewTestAppWithServices(t, db, rdb, "redis,postgres,mongodb,queue,webhook,storage")
+	defer cleanApp()
+
+	req := httptest.NewRequest(http.MethodPost, "/cache/new", strings.NewReader(`{}`))
+	req.Header.Set("Content-Type", "application/json")
+	req.Header.Set("X-Forwarded-For", "10.16.0.7")
+	resp, err := app.Test(req, 5000)
+	require.NoError(t, err)
+	defer resp.Body.Close()
+
+	var body map[string]any
+	require.NoError(t, json.NewDecoder(resp.Body).Decode(&body))
+
+	if resp.StatusCode != http.StatusCreated {
+		t.Skipf("fresh-success path requires provisioning to succeed; got %d. Friction #17 contract still asserted by the live verification recorded in the PR.", resp.StatusCode)
+	}
+
+	// The bug this guards: agent gets the note string with URL inside but no
+	// structured upgrade/upgrade_jwt fields, has to regex the note text.
+	jwt, ok := body["upgrade_jwt"].(string)
+	require.True(t, ok, "fresh-success response is missing upgrade_jwt — friction #17 regression")
+	assert.NotEmpty(t, jwt, "upgrade_jwt must be the raw JWT (not the URL)")
+	assert.False(t, strings.Contains(jwt, "://"), "upgrade_jwt must NOT contain a URL; got: %s", jwt)
+
+	upgradeURL, ok := body["upgrade"].(string)
+	require.True(t, ok, "fresh-success response is missing upgrade — friction #17 regression")
+	assert.Contains(t, upgradeURL, "/start?t=", "upgrade must be a /start?t=<jwt> URL")
+}
+
 // TestAnonymousProvisionEmitsUpgradeJWT_OnDedup guards friction #16 (PR #9):
 // the dedup response path (returning an existing resource) must include the
 // raw `upgrade_jwt` JWT alongside the legacy `upgrade` URL. Agents read

internal/handlers/webhook.go

@@ -247,6 +247,8 @@ func (h *WebhookHandler) NewWebhook(c *fiber.Ctx) error {
 		"env":         resource.Env,
 		"limits":      webhookAnonLimits(),
 		"note":        upgradeNote(upgradeURL),
+		"upgrade":     upgradeURL,
+		"upgrade_jwt": jwtToken,
 		"expires_at":  expiresAt,
 	})
 }