fn::open::1password-secrets fails with error fetching date secret from 1password with generic error

[andymeierdev]

Describe the bug

Opening an ESC environment that uses fn::open::1password-secrets fails with:

error: [0]
Diags: error fetching secret from 1password

The same 1Password service account token and op://... secret reference work correctly when tested directly with the 1Password CLI, so the token and reference are valid outside ESC.

Minimal repro

values:
  upstream:
    fn::open::pulumi-stacks:
      stacks:
        identity:
          stack: example-org/example-identity/prod

  secrets:
    fn::open::1password-secrets:
      login:
        serviceAccountToken: ${upstream.identity.serviceAccountTokenOutput}
      get:
        sampleSecret:
          ref: "op://ExampleVault/ExampleItem/dateField"

  environmentVariables:
    SAMPLE_SECRET: ${secrets.sampleSecret}

"op://ExampleVault/ExampleItem/dateField" is a date field

pulumi env open example-project/minimal-repro

Result:

error: [0]
Diags: error fetching secret from 1password

Additional evidence

Outside ESC, using the same service account token:

• listing accessible vaults succeeds
• reading the same op://... secret reference succeeds

Generic error related to #637

Environment

• Pulumi CLI: 3.228.0
• Host OS: macOS darwin/arm64

Workaround

Change the field type to a string

[andymeierdev]

Seems to be working now

[andymeierdev]

Reopening and updated description as I figured out that when the secret was a date field that was causing the error.