cloudflare_zone: UpgradeResourceState fails with "unsupported attribute 'account'" when upgrading from v6.9.1 to v6.10+

[pulumi]

Summary

Upgrading the pulumi-cloudflare SDK from v6.9.1 to any later version (tested: v6.17.0) causes pulumi preview to fail for existing cloudflare:index/zone:Zone resources with:

error: [ERROR] Could not parse raw state as v4 format: AttributeName("account"): unsupported attribute "account": Failed to unmarshal v4 zone state
error: Failed to unmarshal v4 zone state: Could not parse raw state as v4 format: AttributeName("account"): unsupported attribute "account"

Root Cause

State written by the v6.9.1 provider stores the Zone resource with an account nested object (e.g. {"id": "<account_id>"}) in both inputs and outputs. When the provider is upgraded to v6.10+, the upstream Cloudflare Terraform provider's plugin-framework-based cloudflare_zone schema no longer recognises account as a valid raw state attribute, so the Terraform state upgrader rejects it before the Pulumi bridge's TransformFromState gets a chance to run.

Existing state (written at v6.9.1):

{
  "type": "cloudflare:index/zone:Zone",
  "provider": "urn:pulumi:stack::...::pulumi:providers:cloudflare::default_6_9_1::...",
  "inputs": {
    "account": { "id": "a7b4bca74bbe27fdd0064952ff80a5b1" },
    "name": "foragd.app",
    "type": "full"
  }
}

The cloudflare_zero_trust_access_application and cloudflare_ruleset resources received similar fixes via PreStateUpgradeHook in #1569 and #1570. cloudflare_zone needs the same treatment.

Expected Fix

Add a PreStateUpgradeHook for cloudflare_zone in provider/resources.go that strips (or converts) the account nested object before the Terraform provider's state upgrader runs, analogous to the existing TransformFromState which already handles the accountId → account direction.

Workaround

Pin github.com/pulumi/pulumi-cloudflare/sdk/v6 back to v6.9.1 in go.mod. Both checksums are present in go.sum, so no go mod tidy is needed.

Environment

• pulumi-cloudflare SDK: v6.17.0 (breaks); v6.9.1 (works)
• pulumi-terraform-bridge: v3.134.0
• upstream cloudflare TF provider: ~v5.10.1 (v6.9.1) → v5.x latest (v6.17.0)
• Pulumi CLI: v3.253.0
• Language: Go

[javier-fiore]

I am using version 6.13 and it works fine, the bug was introduced in 6.14+