If I some structural config in an ESC environment which has mixed secret and non-secret fields, like the following:

pulumicConfig:
  objConfig:
    nonSecret: not_a_secret
    secret:
      fn::secret: top_secret

then inside my program must I use

config.requireSecretObject

to get the whole object as a secret if I wish to keep

objConfig.secret

derived values encrypted in the state?

Hi Billy, that is correct