Flatten extension upload responses

[IlyaasK]

Summary

• validate Stainless raw-field metadata for uploaded extension ID, optional name, and checksum
• require the API name and checksum echoes to match configured durable state
• preserve resolved project scope because extension metadata does not return it
• explicitly null the write-only source path in Terraform state
• exclude created time, archive size, last-used time, and all runtime data

Why this is v1 work

This is the pure success-response boundary needed before wiring kernel_extension Create. Separating flattening keeps malformed-success and drift semantics independently reviewable from API calls and Terraform state persistence.

Intentionally unsupported

• no SDK/client call
• no Terraform Create or uncertain-commit handling
• no metadata Get/Read flattening
• no archive bytes, timestamps, size, or runtime usage in state
• no download or browser/session operation

Verification

• gofmt -l cmd internal
• go test -count=20 ./internal/resources/extension
• go test -race -count=1 ./internal/resources/extension
• go test -count=1 -short -timeout=2m ./...
• go vet ./...
• go mod verify
• go mod tidy -diff
• terraform fmt -check -recursive examples
• bash scripts/check-docs.sh
• bash scripts/check-examples.sh
• bash scripts/check-markdown-links.sh
• git diff --check HEAD

All commands passed locally. Tests are pure, deterministic, and network-free.

Acceptance status

No API call or Terraform lifecycle behavior is introduced, so live acceptance testing is not applicable to this pure flatten slice.

Remaining risk

A malformed nominal success means Kernel may already have created the extension. This helper deliberately returns no invented state; the later Create core must preserve any trustworthy canonical ID and report an uncertain commit with lookup/import/delete guidance.

---

Note

Low Risk
Pure mapping and validation with no Terraform lifecycle or network calls; behavior is covered by unit tests.

Overview
Adds flattenExtensionUpload as the success-response boundary for upcoming kernel_extension Create: it turns a Kernel upload response into durable Terraform state and diagnostics only—no API or lifecycle wiring yet.

Validation follows the same Stainless raw-field pattern used elsewhere (e.g. browser pool): required id and checksum, optional name when present in JSON. It errors on missing/invalid fields and on name or checksum drift versus configured values. project_id is taken from the caller when scoped (not from API metadata); source_path is explicitly nulled as write-only; timestamps, size, and runtime fields are ignored.

Unit tests cover happy paths (nullable name, unscoped project), invalid required fields, and drift rejection.

^{Reviewed by Cursor Bugbot for commit bed4bab. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 3f100f2. Configure here.}