Config + Secret from flags

id_effect_config already documents providers and Config descriptors. At a CLI edge, you usually:

  1. Parse a --token / --api-key flag (or read a path to a file).
  2. Seed a MapConfigProvider (or EnvConfigProvider) so the key matches what your Config::* descriptors expect.
  3. Evaluate Config::… inside an Effect using config_env in R.
  4. Wrap sensitive strings with Secret via Config::secret so logs and Debug never print raw material.

Minimal snippet

#![allow(unused)]
fn main() {
use id_effect::Effect;
use id_effect_config::{
    Config, ConfigError, MapConfigProvider, Secret, config_env,
};

fn load_api_token() -> Effect<Secret<String>, ConfigError, id_effect_config::ConfigEnv> {
    Config::string("API_TOKEN").secret().run::<Secret<String>, ConfigError, _>()
}

// In main: build provider from CLI flag, then `config_env(provider)` and `run_blocking`.
}

The repository ships a full runnable layout under examples/cli-minimal (cli_minimal package in the workspace).

Operational notes

  • Prefer short-lived exposure of secrets: parse → wrap in Secret → pass to effects; avoid storing raw String copies in globals.
  • For file-based secrets, read bytes in an effect and wrap immediately; redact paths in error messages if they reveal usernames.
  • Combine with CLI with clap for argv parsing and exit codes for main.