Module config 

Config - typed account/token/base-url/cache resolution with strict precedence and secret-safe token handling.

Precedence chain (binding feedback 03/06):

1. explicit constructor/config value (ConfigBuilder)
2. canonical AUTH_CLOUDFLARE_* environment variables
3. legacy Hermes-compatible aliases
   (CLOUDFLARE_ACCOUNT_ID, CLOUDFLARE_API_TOKEN,
    HERMES_CUSTOM_API_CLOUDFLARE_COM_API_KEY)
4. user config file (JSON - non-secret values only)
5. typed missing-config error (CloudflareError::MissingEnv)

The API token is held in SecretString: it never appears in Debug, Display, JSON serialization, or any error message. Callers consume it through as_ref()/into() (or SecretString::bearer_header) when building the Authorization: Bearer <token> header.

Structs

Config

Fully resolved provider configuration.

ConfigBuilder

Builder for Config - the “explicit constructor/config value” tier of the precedence chain.

SecretString

A wrapped API token that can never leak through formatting or JSON.

Constants

ACCOUNT_ID_ENV

Canonical env var for the Cloudflare account ID (non-secret).

ACCOUNT_ID_LEN

Expected Cloudflare account ID shape: exactly this many ASCII hex digits. (Workers & Pages → Overview → Account ID.)

API_TOKEN_ENV

Canonical env var for the Cloudflare API token (secret).

BASE_URL_ENV

Optional override for the Workers AI inference base URL.

CACHE_DIR_ENV

Optional override for the account-scoped cache directory.

CONFIG_ENV

Optional override for the user config file path.

CONFIG_FILE_NAME

Default user config file name under $HERMES_HOME/auth-cloudflare/.

LEGACY_HERMES_TOKEN_ENV

Legacy Hermes-compatible token alias (feedback 03).