Additionally:

await stack.setConfig("somesecret", { value: "s3cr3t", secret: true });

Is

s3cr3t

in this case plain text or the encrypted value i get from a

pulumi config set somesecret s3cr3t --secret

?

stack.setConfig

takes a plaintext value and will encrypt it. So

s3cr3t

will be stored encrypted, but available at runtime as the plaintext value

s3cr3t

when retrieved via

stack.getConfig