Apply secrets to function result properties marked as such (#272)

Function output properties can be annotated as secrets. That may have two effects: 1. The property is marked as a secret in Pulumi schema (already works in pulumi-go-provider). As of today, this will have no effect on Pulumi SDK and the result will still be returned to the engine as plain text. 2. The provider marks the output property value as a secret and that's what gets sent over gRPC to the client SDK. This PR implements (2) by applying secrets to inferred function results. Added an invoke test that verifies this behavior. Also, extended the `credentials` sample program with an implementation of a secretty invokes and verified that it works manually. Note that this requires 3.131.0 or later of Node.js/Go/YAML SDK or a later version for Python SDK support. Earlier versions fail to deserialize a secretty invoke output. Resolves #259
pulumi · Sep 24, 2024 · ade261c · ade261c
2 parents c63d6b6 + 2ee2a12
commit ade261c
Show file tree

Hide file tree

Showing 22 changed files with 190 additions and 82 deletions.
diff --git a/examples/assets/go.mod b/examples/assets/go.mod
@@ -61,9 +61,9 @@ require (
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pkg/term v1.1.0 // indirect
 	github.com/pulumi/appdash v0.0.0-20231130102222-75f619a67231 // indirect
-	github.com/pulumi/esc v0.9.2-0.20240910221656-328d3204100f // indirect
-	github.com/pulumi/pulumi/pkg/v3 v3.132.0 // indirect
-	github.com/pulumi/pulumi/sdk/v3 v3.132.0 // indirect
+	github.com/pulumi/esc v0.10.0 // indirect
+	github.com/pulumi/pulumi/pkg/v3 v3.134.0 // indirect
+	github.com/pulumi/pulumi/sdk/v3 v3.134.0 // indirect
 	github.com/rivo/uniseg v0.4.4 // indirect
 	github.com/rogpeppe/go-internal v1.12.0 // indirect
 	github.com/sabhiram/go-gitignore v0.0.0-20210923224102-525f6e181f06 // indirect

diff --git a/examples/assets/go.sum b/examples/assets/go.sum
@@ -158,12 +158,12 @@ github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZb
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/pulumi/appdash v0.0.0-20231130102222-75f619a67231 h1:vkHw5I/plNdTr435cARxCW6q9gc0S/Yxz7Mkd38pOb0=
 github.com/pulumi/appdash v0.0.0-20231130102222-75f619a67231/go.mod h1:murToZ2N9hNJzewjHBgfFdXhZKjY3z5cYC1VXk+lbFE=
-github.com/pulumi/esc v0.9.2-0.20240910221656-328d3204100f h1:0ZdVkYWt8zqyfDhjy7Q6V8ydWVvmmyCTRFTFOrvYPaM=
-github.com/pulumi/esc v0.9.2-0.20240910221656-328d3204100f/go.mod h1:2Bfa+FWj/xl8CKqRTWbWgDX0SOD4opdQgvYSURTGK2c=
-github.com/pulumi/pulumi/pkg/v3 v3.132.0 h1:FbIvkiFMOYwAixQZ330w42b0khMeAYj+vlH3k4lxwA8=
-github.com/pulumi/pulumi/pkg/v3 v3.132.0/go.mod h1:EnftmBaN59wQI//Q4a6XN3QUlHA4SiGBup8TXC8iT3s=
-github.com/pulumi/pulumi/sdk/v3 v3.132.0 h1:UDZHa+WpIEVxWJp+PCbsMxnTUeKMX3xBCcqIHxeAdzI=
-github.com/pulumi/pulumi/sdk/v3 v3.132.0/go.mod h1:J5kQEX8v87aeUhk6NdQXnjCo1DbiOnOiL3Sf2DuDda8=
+github.com/pulumi/esc v0.10.0 h1:jzBKzkLVW0mePeanDRfqSQoCJ5yrkux0jIwAkUxpRKE=
+github.com/pulumi/esc v0.10.0/go.mod h1:2Bfa+FWj/xl8CKqRTWbWgDX0SOD4opdQgvYSURTGK2c=
+github.com/pulumi/pulumi/pkg/v3 v3.134.0 h1:EaUwz7GMv38SlKqRt+KfzMh9+sYyAZQJvXeBpQfE1ZI=
+github.com/pulumi/pulumi/pkg/v3 v3.134.0/go.mod h1:zYNlBVHCvl3r+43iEwQX11BfEC+Dln7UOX8rvwuf1Co=
+github.com/pulumi/pulumi/sdk/v3 v3.134.0 h1:jnkRmtB/2Swkdj6b6CdtbDlCVLZTPCqINi8slnN7I/I=
+github.com/pulumi/pulumi/sdk/v3 v3.134.0/go.mod h1:J5kQEX8v87aeUhk6NdQXnjCo1DbiOnOiL3Sf2DuDda8=
 github.com/rivo/uniseg v0.1.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc=
 github.com/rivo/uniseg v0.2.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc=
 github.com/rivo/uniseg v0.4.4 h1:8TfxU8dW6PdqD27gjM8MVNuicgxIjxpm4K7x4jp8sis=

diff --git a/examples/credentials/consumer/Pulumi.yaml b/examples/credentials/consumer/Pulumi.yaml
@@ -6,6 +6,16 @@ plugins:
     - name: credentials
       path: ..
 
+variables:
+  helloworld:
+    fn::invoke:
+      function: credentials:sign
+      arguments:
+        message: "Hello, World!"
+      return: out
+      options:
+        provider: ${provider}
+
 resources:
   provider:
     type: pulumi:providers:credentials
@@ -22,3 +32,4 @@ outputs:
   user: ${user.name}
   password: ${user.password}
   rawPassword: ${provider.password}
+  helloworld: ${helloworld}
diff --git a/examples/credentials/go.mod b/examples/credentials/go.mod
@@ -6,7 +6,7 @@ go 1.22
 
 require (
 	github.com/pulumi/pulumi-go-provider v0.0.0-00010101000000-000000000000
-	github.com/pulumi/pulumi/sdk/v3 v3.132.0
+	github.com/pulumi/pulumi/sdk/v3 v3.134.0
 )
 
 require (
@@ -64,8 +64,8 @@ require (
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pkg/term v1.1.0 // indirect
 	github.com/pulumi/appdash v0.0.0-20231130102222-75f619a67231 // indirect
-	github.com/pulumi/esc v0.9.2-0.20240910221656-328d3204100f // indirect
-	github.com/pulumi/pulumi/pkg/v3 v3.132.0 // indirect
+	github.com/pulumi/esc v0.10.0 // indirect
+	github.com/pulumi/pulumi/pkg/v3 v3.134.0 // indirect
 	github.com/rivo/uniseg v0.4.4 // indirect
 	github.com/rogpeppe/go-internal v1.12.0 // indirect
 	github.com/sabhiram/go-gitignore v0.0.0-20210923224102-525f6e181f06 // indirect

diff --git a/examples/credentials/go.sum b/examples/credentials/go.sum
@@ -158,12 +158,12 @@ github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZb
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/pulumi/appdash v0.0.0-20231130102222-75f619a67231 h1:vkHw5I/plNdTr435cARxCW6q9gc0S/Yxz7Mkd38pOb0=
 github.com/pulumi/appdash v0.0.0-20231130102222-75f619a67231/go.mod h1:murToZ2N9hNJzewjHBgfFdXhZKjY3z5cYC1VXk+lbFE=
-github.com/pulumi/esc v0.9.2-0.20240910221656-328d3204100f h1:0ZdVkYWt8zqyfDhjy7Q6V8ydWVvmmyCTRFTFOrvYPaM=
-github.com/pulumi/esc v0.9.2-0.20240910221656-328d3204100f/go.mod h1:2Bfa+FWj/xl8CKqRTWbWgDX0SOD4opdQgvYSURTGK2c=
-github.com/pulumi/pulumi/pkg/v3 v3.132.0 h1:FbIvkiFMOYwAixQZ330w42b0khMeAYj+vlH3k4lxwA8=
-github.com/pulumi/pulumi/pkg/v3 v3.132.0/go.mod h1:EnftmBaN59wQI//Q4a6XN3QUlHA4SiGBup8TXC8iT3s=
-github.com/pulumi/pulumi/sdk/v3 v3.132.0 h1:UDZHa+WpIEVxWJp+PCbsMxnTUeKMX3xBCcqIHxeAdzI=
-github.com/pulumi/pulumi/sdk/v3 v3.132.0/go.mod h1:J5kQEX8v87aeUhk6NdQXnjCo1DbiOnOiL3Sf2DuDda8=
+github.com/pulumi/esc v0.10.0 h1:jzBKzkLVW0mePeanDRfqSQoCJ5yrkux0jIwAkUxpRKE=
+github.com/pulumi/esc v0.10.0/go.mod h1:2Bfa+FWj/xl8CKqRTWbWgDX0SOD4opdQgvYSURTGK2c=
+github.com/pulumi/pulumi/pkg/v3 v3.134.0 h1:EaUwz7GMv38SlKqRt+KfzMh9+sYyAZQJvXeBpQfE1ZI=
+github.com/pulumi/pulumi/pkg/v3 v3.134.0/go.mod h1:zYNlBVHCvl3r+43iEwQX11BfEC+Dln7UOX8rvwuf1Co=
+github.com/pulumi/pulumi/sdk/v3 v3.134.0 h1:jnkRmtB/2Swkdj6b6CdtbDlCVLZTPCqINi8slnN7I/I=
+github.com/pulumi/pulumi/sdk/v3 v3.134.0/go.mod h1:J5kQEX8v87aeUhk6NdQXnjCo1DbiOnOiL3Sf2DuDda8=
 github.com/rivo/uniseg v0.1.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc=
 github.com/rivo/uniseg v0.2.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc=
 github.com/rivo/uniseg v0.4.4 h1:8TfxU8dW6PdqD27gjM8MVNuicgxIjxpm4K7x4jp8sis=

diff --git a/examples/credentials/main.go b/examples/credentials/main.go
@@ -27,6 +27,9 @@ func provider() p.Provider {
 			"credentials": "index",
 		},
 		Config: infer.Config[*Config](),
+		Functions: []infer.InferredFunction{
+			infer.Function[*Sign](),
+		},
 	})
 }
 
@@ -110,3 +113,28 @@ func (*User) Diff(ctx context.Context, id string, olds UserState, news UserArgs)
 	}
 	return p.DiffResponse{}, nil
 }
+
+type Sign struct{}
+
+func (Sign) Call(ctx context.Context, args SignArgs) (SignRes, error) {
+	config := infer.GetConfig[Config](ctx)
+	return SignRes{
+		Out: fmt.Sprintf("%s by %s", args.Message, config.User),
+	}, nil
+}
+
+func (r *Sign) Annotate(a infer.Annotator) {
+	a.Describe(r, "Signs the message with the user name and returns the result as a secret.")
+}
+
+type SignArgs struct {
+	Message string `pulumi:"message"`
+}
+
+func (ra *SignArgs) Annotate(a infer.Annotator) {
+	a.Describe(&ra.Message, "Message to sign.")
+}
+
+type SignRes struct {
+	Out string `pulumi:"out" provider:"secret"`
+}
diff --git a/examples/dna-store/go.mod b/examples/dna-store/go.mod
@@ -61,9 +61,9 @@ require (
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pkg/term v1.1.0 // indirect
 	github.com/pulumi/appdash v0.0.0-20231130102222-75f619a67231 // indirect
-	github.com/pulumi/esc v0.9.2-0.20240910221656-328d3204100f // indirect
-	github.com/pulumi/pulumi/pkg/v3 v3.132.0 // indirect
-	github.com/pulumi/pulumi/sdk/v3 v3.132.0 // indirect
+	github.com/pulumi/esc v0.10.0 // indirect
+	github.com/pulumi/pulumi/pkg/v3 v3.134.0 // indirect
+	github.com/pulumi/pulumi/sdk/v3 v3.134.0 // indirect
 	github.com/rivo/uniseg v0.4.4 // indirect
 	github.com/rogpeppe/go-internal v1.12.0 // indirect
 	github.com/sabhiram/go-gitignore v0.0.0-20210923224102-525f6e181f06 // indirect

diff --git a/examples/dna-store/go.sum b/examples/dna-store/go.sum
@@ -158,12 +158,12 @@ github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZb
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/pulumi/appdash v0.0.0-20231130102222-75f619a67231 h1:vkHw5I/plNdTr435cARxCW6q9gc0S/Yxz7Mkd38pOb0=
 github.com/pulumi/appdash v0.0.0-20231130102222-75f619a67231/go.mod h1:murToZ2N9hNJzewjHBgfFdXhZKjY3z5cYC1VXk+lbFE=
-github.com/pulumi/esc v0.9.2-0.20240910221656-328d3204100f h1:0ZdVkYWt8zqyfDhjy7Q6V8ydWVvmmyCTRFTFOrvYPaM=
-github.com/pulumi/esc v0.9.2-0.20240910221656-328d3204100f/go.mod h1:2Bfa+FWj/xl8CKqRTWbWgDX0SOD4opdQgvYSURTGK2c=
-github.com/pulumi/pulumi/pkg/v3 v3.132.0 h1:FbIvkiFMOYwAixQZ330w42b0khMeAYj+vlH3k4lxwA8=
-github.com/pulumi/pulumi/pkg/v3 v3.132.0/go.mod h1:EnftmBaN59wQI//Q4a6XN3QUlHA4SiGBup8TXC8iT3s=
-github.com/pulumi/pulumi/sdk/v3 v3.132.0 h1:UDZHa+WpIEVxWJp+PCbsMxnTUeKMX3xBCcqIHxeAdzI=
-github.com/pulumi/pulumi/sdk/v3 v3.132.0/go.mod h1:J5kQEX8v87aeUhk6NdQXnjCo1DbiOnOiL3Sf2DuDda8=
+github.com/pulumi/esc v0.10.0 h1:jzBKzkLVW0mePeanDRfqSQoCJ5yrkux0jIwAkUxpRKE=
+github.com/pulumi/esc v0.10.0/go.mod h1:2Bfa+FWj/xl8CKqRTWbWgDX0SOD4opdQgvYSURTGK2c=
+github.com/pulumi/pulumi/pkg/v3 v3.134.0 h1:EaUwz7GMv38SlKqRt+KfzMh9+sYyAZQJvXeBpQfE1ZI=
+github.com/pulumi/pulumi/pkg/v3 v3.134.0/go.mod h1:zYNlBVHCvl3r+43iEwQX11BfEC+Dln7UOX8rvwuf1Co=
+github.com/pulumi/pulumi/sdk/v3 v3.134.0 h1:jnkRmtB/2Swkdj6b6CdtbDlCVLZTPCqINi8slnN7I/I=
+github.com/pulumi/pulumi/sdk/v3 v3.134.0/go.mod h1:J5kQEX8v87aeUhk6NdQXnjCo1DbiOnOiL3Sf2DuDda8=
 github.com/rivo/uniseg v0.1.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc=
 github.com/rivo/uniseg v0.2.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc=
 github.com/rivo/uniseg v0.4.4 h1:8TfxU8dW6PdqD27gjM8MVNuicgxIjxpm4K7x4jp8sis=

diff --git a/examples/file/go.mod b/examples/file/go.mod
@@ -6,7 +6,7 @@ go 1.22
 
 require (
 	github.com/pulumi/pulumi-go-provider v0.0.0-00010101000000-000000000000
-	github.com/pulumi/pulumi/sdk/v3 v3.132.0
+	github.com/pulumi/pulumi/sdk/v3 v3.134.0
 )
 
 require (
@@ -64,8 +64,8 @@ require (
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/pkg/term v1.1.0 // indirect
 	github.com/pulumi/appdash v0.0.0-20231130102222-75f619a67231 // indirect
-	github.com/pulumi/esc v0.9.2-0.20240910221656-328d3204100f // indirect
-	github.com/pulumi/pulumi/pkg/v3 v3.132.0 // indirect
+	github.com/pulumi/esc v0.10.0 // indirect
+	github.com/pulumi/pulumi/pkg/v3 v3.134.0 // indirect
 	github.com/rivo/uniseg v0.4.4 // indirect
 	github.com/rogpeppe/go-internal v1.12.0 // indirect
 	github.com/sabhiram/go-gitignore v0.0.0-20210923224102-525f6e181f06 // indirect

diff --git a/examples/file/go.sum b/examples/file/go.sum
@@ -158,12 +158,12 @@ github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZb
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/pulumi/appdash v0.0.0-20231130102222-75f619a67231 h1:vkHw5I/plNdTr435cARxCW6q9gc0S/Yxz7Mkd38pOb0=
 github.com/pulumi/appdash v0.0.0-20231130102222-75f619a67231/go.mod h1:murToZ2N9hNJzewjHBgfFdXhZKjY3z5cYC1VXk+lbFE=
-github.com/pulumi/esc v0.9.2-0.20240910221656-328d3204100f h1:0ZdVkYWt8zqyfDhjy7Q6V8ydWVvmmyCTRFTFOrvYPaM=
-github.com/pulumi/esc v0.9.2-0.20240910221656-328d3204100f/go.mod h1:2Bfa+FWj/xl8CKqRTWbWgDX0SOD4opdQgvYSURTGK2c=
-github.com/pulumi/pulumi/pkg/v3 v3.132.0 h1:FbIvkiFMOYwAixQZ330w42b0khMeAYj+vlH3k4lxwA8=
-github.com/pulumi/pulumi/pkg/v3 v3.132.0/go.mod h1:EnftmBaN59wQI//Q4a6XN3QUlHA4SiGBup8TXC8iT3s=
-github.com/pulumi/pulumi/sdk/v3 v3.132.0 h1:UDZHa+WpIEVxWJp+PCbsMxnTUeKMX3xBCcqIHxeAdzI=
-github.com/pulumi/pulumi/sdk/v3 v3.132.0/go.mod h1:J5kQEX8v87aeUhk6NdQXnjCo1DbiOnOiL3Sf2DuDda8=
+github.com/pulumi/esc v0.10.0 h1:jzBKzkLVW0mePeanDRfqSQoCJ5yrkux0jIwAkUxpRKE=
+github.com/pulumi/esc v0.10.0/go.mod h1:2Bfa+FWj/xl8CKqRTWbWgDX0SOD4opdQgvYSURTGK2c=
+github.com/pulumi/pulumi/pkg/v3 v3.134.0 h1:EaUwz7GMv38SlKqRt+KfzMh9+sYyAZQJvXeBpQfE1ZI=
+github.com/pulumi/pulumi/pkg/v3 v3.134.0/go.mod h1:zYNlBVHCvl3r+43iEwQX11BfEC+Dln7UOX8rvwuf1Co=
+github.com/pulumi/pulumi/sdk/v3 v3.134.0 h1:jnkRmtB/2Swkdj6b6CdtbDlCVLZTPCqINi8slnN7I/I=
+github.com/pulumi/pulumi/sdk/v3 v3.134.0/go.mod h1:J5kQEX8v87aeUhk6NdQXnjCo1DbiOnOiL3Sf2DuDda8=
 github.com/rivo/uniseg v0.1.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc=
 github.com/rivo/uniseg v0.2.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc=
 github.com/rivo/uniseg v0.4.4 h1:8TfxU8dW6PdqD27gjM8MVNuicgxIjxpm4K7x4jp8sis=

diff --git a/examples/random-login/go.mod b/examples/random-login/go.mod
@@ -8,7 +8,7 @@ require (
 	github.com/blang/semver v3.5.1+incompatible
 	github.com/pulumi/pulumi-go-provider v0.0.0-00010101000000-000000000000
 	github.com/pulumi/pulumi-random/sdk/v4 v4.8.0
-	github.com/pulumi/pulumi/sdk/v3 v3.132.0
+	github.com/pulumi/pulumi/sdk/v3 v3.134.0
 	github.com/stretchr/testify v1.9.0
 )
 
@@ -68,8 +68,8 @@ require (
 	github.com/pkg/term v1.1.0 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
 	github.com/pulumi/appdash v0.0.0-20231130102222-75f619a67231 // indirect
-	github.com/pulumi/esc v0.9.2-0.20240910221656-328d3204100f // indirect
-	github.com/pulumi/pulumi/pkg/v3 v3.132.0 // indirect
+	github.com/pulumi/esc v0.10.0 // indirect
+	github.com/pulumi/pulumi/pkg/v3 v3.134.0 // indirect
 	github.com/rivo/uniseg v0.4.4 // indirect
 	github.com/rogpeppe/go-internal v1.12.0 // indirect
 	github.com/sabhiram/go-gitignore v0.0.0-20210923224102-525f6e181f06 // indirect

diff --git a/examples/random-login/go.sum b/examples/random-login/go.sum
@@ -158,14 +158,14 @@ github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZb
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/pulumi/appdash v0.0.0-20231130102222-75f619a67231 h1:vkHw5I/plNdTr435cARxCW6q9gc0S/Yxz7Mkd38pOb0=
 github.com/pulumi/appdash v0.0.0-20231130102222-75f619a67231/go.mod h1:murToZ2N9hNJzewjHBgfFdXhZKjY3z5cYC1VXk+lbFE=
-github.com/pulumi/esc v0.9.2-0.20240910221656-328d3204100f h1:0ZdVkYWt8zqyfDhjy7Q6V8ydWVvmmyCTRFTFOrvYPaM=
-github.com/pulumi/esc v0.9.2-0.20240910221656-328d3204100f/go.mod h1:2Bfa+FWj/xl8CKqRTWbWgDX0SOD4opdQgvYSURTGK2c=
+github.com/pulumi/esc v0.10.0 h1:jzBKzkLVW0mePeanDRfqSQoCJ5yrkux0jIwAkUxpRKE=
+github.com/pulumi/esc v0.10.0/go.mod h1:2Bfa+FWj/xl8CKqRTWbWgDX0SOD4opdQgvYSURTGK2c=
 github.com/pulumi/pulumi-random/sdk/v4 v4.8.0 h1:zaSdfNqcaRqKld2jTB+YZIN7O4BsQ2m/AEFx7qNZJUY=
 github.com/pulumi/pulumi-random/sdk/v4 v4.8.0/go.mod h1:czSwj+jZnn/VWovMpTLUs/RL/ZS4PFHRdmlXrkvHqeI=
-github.com/pulumi/pulumi/pkg/v3 v3.132.0 h1:FbIvkiFMOYwAixQZ330w42b0khMeAYj+vlH3k4lxwA8=
-github.com/pulumi/pulumi/pkg/v3 v3.132.0/go.mod h1:EnftmBaN59wQI//Q4a6XN3QUlHA4SiGBup8TXC8iT3s=
-github.com/pulumi/pulumi/sdk/v3 v3.132.0 h1:UDZHa+WpIEVxWJp+PCbsMxnTUeKMX3xBCcqIHxeAdzI=
-github.com/pulumi/pulumi/sdk/v3 v3.132.0/go.mod h1:J5kQEX8v87aeUhk6NdQXnjCo1DbiOnOiL3Sf2DuDda8=
+github.com/pulumi/pulumi/pkg/v3 v3.134.0 h1:EaUwz7GMv38SlKqRt+KfzMh9+sYyAZQJvXeBpQfE1ZI=
+github.com/pulumi/pulumi/pkg/v3 v3.134.0/go.mod h1:zYNlBVHCvl3r+43iEwQX11BfEC+Dln7UOX8rvwuf1Co=
+github.com/pulumi/pulumi/sdk/v3 v3.134.0 h1:jnkRmtB/2Swkdj6b6CdtbDlCVLZTPCqINi8slnN7I/I=
+github.com/pulumi/pulumi/sdk/v3 v3.134.0/go.mod h1:J5kQEX8v87aeUhk6NdQXnjCo1DbiOnOiL3Sf2DuDda8=
 github.com/rivo/uniseg v0.1.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc=
 github.com/rivo/uniseg v0.2.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc=
 github.com/rivo/uniseg v0.4.4 h1:8TfxU8dW6PdqD27gjM8MVNuicgxIjxpm4K7x4jp8sis=

diff --git a/examples/str/go.mod b/examples/str/go.mod
@@ -7,7 +7,7 @@ replace github.com/pulumi/pulumi-go-provider => ../..
 require (
 	github.com/blang/semver v3.5.1+incompatible
 	github.com/pulumi/pulumi-go-provider v0.0.0-00010101000000-000000000000
-	github.com/pulumi/pulumi/sdk/v3 v3.132.0
+	github.com/pulumi/pulumi/sdk/v3 v3.134.0
 	github.com/stretchr/testify v1.9.0
 )
 
@@ -67,8 +67,8 @@ require (
 	github.com/pkg/term v1.1.0 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
 	github.com/pulumi/appdash v0.0.0-20231130102222-75f619a67231 // indirect
-	github.com/pulumi/esc v0.9.2-0.20240910221656-328d3204100f // indirect
-	github.com/pulumi/pulumi/pkg/v3 v3.132.0 // indirect
+	github.com/pulumi/esc v0.10.0 // indirect
+	github.com/pulumi/pulumi/pkg/v3 v3.134.0 // indirect
 	github.com/rivo/uniseg v0.4.4 // indirect
 	github.com/rogpeppe/go-internal v1.12.0 // indirect
 	github.com/sabhiram/go-gitignore v0.0.0-20210923224102-525f6e181f06 // indirect

diff --git a/examples/str/go.sum b/examples/str/go.sum
@@ -158,12 +158,12 @@ github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZb
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/pulumi/appdash v0.0.0-20231130102222-75f619a67231 h1:vkHw5I/plNdTr435cARxCW6q9gc0S/Yxz7Mkd38pOb0=
 github.com/pulumi/appdash v0.0.0-20231130102222-75f619a67231/go.mod h1:murToZ2N9hNJzewjHBgfFdXhZKjY3z5cYC1VXk+lbFE=
-github.com/pulumi/esc v0.9.2-0.20240910221656-328d3204100f h1:0ZdVkYWt8zqyfDhjy7Q6V8ydWVvmmyCTRFTFOrvYPaM=
-github.com/pulumi/esc v0.9.2-0.20240910221656-328d3204100f/go.mod h1:2Bfa+FWj/xl8CKqRTWbWgDX0SOD4opdQgvYSURTGK2c=
-github.com/pulumi/pulumi/pkg/v3 v3.132.0 h1:FbIvkiFMOYwAixQZ330w42b0khMeAYj+vlH3k4lxwA8=
-github.com/pulumi/pulumi/pkg/v3 v3.132.0/go.mod h1:EnftmBaN59wQI//Q4a6XN3QUlHA4SiGBup8TXC8iT3s=
-github.com/pulumi/pulumi/sdk/v3 v3.132.0 h1:UDZHa+WpIEVxWJp+PCbsMxnTUeKMX3xBCcqIHxeAdzI=
-github.com/pulumi/pulumi/sdk/v3 v3.132.0/go.mod h1:J5kQEX8v87aeUhk6NdQXnjCo1DbiOnOiL3Sf2DuDda8=
+github.com/pulumi/esc v0.10.0 h1:jzBKzkLVW0mePeanDRfqSQoCJ5yrkux0jIwAkUxpRKE=
+github.com/pulumi/esc v0.10.0/go.mod h1:2Bfa+FWj/xl8CKqRTWbWgDX0SOD4opdQgvYSURTGK2c=
+github.com/pulumi/pulumi/pkg/v3 v3.134.0 h1:EaUwz7GMv38SlKqRt+KfzMh9+sYyAZQJvXeBpQfE1ZI=
+github.com/pulumi/pulumi/pkg/v3 v3.134.0/go.mod h1:zYNlBVHCvl3r+43iEwQX11BfEC+Dln7UOX8rvwuf1Co=
+github.com/pulumi/pulumi/sdk/v3 v3.134.0 h1:jnkRmtB/2Swkdj6b6CdtbDlCVLZTPCqINi8slnN7I/I=
+github.com/pulumi/pulumi/sdk/v3 v3.134.0/go.mod h1:J5kQEX8v87aeUhk6NdQXnjCo1DbiOnOiL3Sf2DuDda8=
 github.com/rivo/uniseg v0.1.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc=
 github.com/rivo/uniseg v0.2.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc=
 github.com/rivo/uniseg v0.4.4 h1:8TfxU8dW6PdqD27gjM8MVNuicgxIjxpm4K7x4jp8sis=

diff --git a/go.mod b/go.mod
@@ -5,8 +5,8 @@ go 1.22
 require (
 	github.com/blang/semver v3.5.1+incompatible
 	github.com/mitchellh/mapstructure v1.5.0
-	github.com/pulumi/pulumi/pkg/v3 v3.132.0
-	github.com/pulumi/pulumi/sdk/v3 v3.132.0
+	github.com/pulumi/pulumi/pkg/v3 v3.134.0
+	github.com/pulumi/pulumi/sdk/v3 v3.134.0
 	google.golang.org/grpc v1.63.2
 	google.golang.org/protobuf v1.33.0
 	pgregory.net/rapid v1.1.0
@@ -39,7 +39,7 @@ require (
 	github.com/pgavlin/fx v0.1.6 // indirect
 	github.com/pjbgf/sha1cd v0.3.0 // indirect
 	github.com/pulumi/appdash v0.0.0-20231130102222-75f619a67231 // indirect
-	github.com/pulumi/esc v0.9.2-0.20240910221656-328d3204100f // indirect
+	github.com/pulumi/esc v0.10.0 // indirect
 	github.com/skeema/knownhosts v1.2.2 // indirect
 	golang.org/x/exp v0.0.0-20240604190554-fc45aab8b7f8 // indirect
 	golang.org/x/mod v0.18.0 // indirect

diff --git a/go.sum b/go.sum
@@ -158,12 +158,12 @@ github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZb
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/pulumi/appdash v0.0.0-20231130102222-75f619a67231 h1:vkHw5I/plNdTr435cARxCW6q9gc0S/Yxz7Mkd38pOb0=
 github.com/pulumi/appdash v0.0.0-20231130102222-75f619a67231/go.mod h1:murToZ2N9hNJzewjHBgfFdXhZKjY3z5cYC1VXk+lbFE=
-github.com/pulumi/esc v0.9.2-0.20240910221656-328d3204100f h1:0ZdVkYWt8zqyfDhjy7Q6V8ydWVvmmyCTRFTFOrvYPaM=
-github.com/pulumi/esc v0.9.2-0.20240910221656-328d3204100f/go.mod h1:2Bfa+FWj/xl8CKqRTWbWgDX0SOD4opdQgvYSURTGK2c=
-github.com/pulumi/pulumi/pkg/v3 v3.132.0 h1:FbIvkiFMOYwAixQZ330w42b0khMeAYj+vlH3k4lxwA8=
-github.com/pulumi/pulumi/pkg/v3 v3.132.0/go.mod h1:EnftmBaN59wQI//Q4a6XN3QUlHA4SiGBup8TXC8iT3s=
-github.com/pulumi/pulumi/sdk/v3 v3.132.0 h1:UDZHa+WpIEVxWJp+PCbsMxnTUeKMX3xBCcqIHxeAdzI=
-github.com/pulumi/pulumi/sdk/v3 v3.132.0/go.mod h1:J5kQEX8v87aeUhk6NdQXnjCo1DbiOnOiL3Sf2DuDda8=
+github.com/pulumi/esc v0.10.0 h1:jzBKzkLVW0mePeanDRfqSQoCJ5yrkux0jIwAkUxpRKE=
+github.com/pulumi/esc v0.10.0/go.mod h1:2Bfa+FWj/xl8CKqRTWbWgDX0SOD4opdQgvYSURTGK2c=
+github.com/pulumi/pulumi/pkg/v3 v3.134.0 h1:EaUwz7GMv38SlKqRt+KfzMh9+sYyAZQJvXeBpQfE1ZI=
+github.com/pulumi/pulumi/pkg/v3 v3.134.0/go.mod h1:zYNlBVHCvl3r+43iEwQX11BfEC+Dln7UOX8rvwuf1Co=
+github.com/pulumi/pulumi/sdk/v3 v3.134.0 h1:jnkRmtB/2Swkdj6b6CdtbDlCVLZTPCqINi8slnN7I/I=
+github.com/pulumi/pulumi/sdk/v3 v3.134.0/go.mod h1:J5kQEX8v87aeUhk6NdQXnjCo1DbiOnOiL3Sf2DuDda8=
 github.com/rivo/uniseg v0.1.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc=
 github.com/rivo/uniseg v0.2.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc=
 github.com/rivo/uniseg v0.4.4 h1:8TfxU8dW6PdqD27gjM8MVNuicgxIjxpm4K7x4jp8sis=

diff --git a/infer/function.go b/infer/function.go
@@ -154,6 +154,6 @@ func (r *derivedInvokeController[F, I, O]) Invoke(ctx context.Context, req p.Inv
 		return p.InvokeResponse{}, err
 	}
 	return p.InvokeResponse{
-		Return: m,
+		Return: applySecrets[O](m),
 	}, nil
 }