Pulumi stack secrets provider migration behavior varies by CLI version

Pulumi encrypts configuration values marked as secrets using the stack's configured secrets provider, and that provider identity is stored with the stack. The built-in passphrase provider requires shared key material, while cloud KMS providers and Pulumi Cloud delegate decryption to existing IAM. Because the choice is per-stack and difficult to reverse, teams need to understand the migration behavior before rollout.

Changing a stack's secrets provider is not a transparent flag flip. Pulumi re-encrypts on write, so pre-existing ciphertext must be re-set or rotated under the new provider. The exact subcommand and supported targets vary by CLI version, and provider plugins ship on independent cadences. The choice is also coupled to the state backend: self-managed backends pair naturally with a matching cloud KMS or passphrase, while Pulumi Cloud stacks can use managed secrets, changing the blast radius if a key leaks.

Which secrets providers are supported for the installed CLI and state backend combination, and what is the documented behavior for migrating an existing stack without manual re-setting of every secret? Does the installed CLI version expose a change-secrets-provider subcommand, and if so, which target providers are accepted?