Crate deepseek_secrets 

Secret storage for DeepSeek API keys.

Provides a small abstraction (KeyringStore) plus a default implementation backed by the OS keyring (DefaultKeyringStore), a file-based fallback for headless Linux (FileKeyringStore), and an in-memory store for tests (InMemoryKeyringStore).

Higher-level lookup goes through Secrets::resolve, which checks the keyring first and falls back to environment variables. The caller (typically the config crate) then falls back to plaintext TOML if both are empty — that final layer lives outside this crate so the precedence is explicit at the call site.

Hard rule: keyring → env → config-file. Never swap.

Structs

DefaultKeyringStore

OS keyring backend (macOS Keychain, Windows Credential Manager, Linux Secret Service / kwallet).

FileKeyringStore

JSON-on-disk fallback for headless environments without a Secret Service / dbus. Stored at <home>/.deepseek/secrets/secrets.json with mode 0600.

InMemoryKeyringStore

In-memory keyring (tests only).

Secrets

High-level façade combining a KeyringStore with environment variable fallbacks.

Enums

SecretsError

Errors that may arise from a KeyringStore backend.

Constants

DEFAULT_SERVICE

Default OS keychain service name. macOS users can verify entries with security find-generic-password -s deepseek -a <provider>.

Traits

KeyringStore

Abstract secret store; concrete implementations may use the OS keyring, a JSON file under ~/.deepseek/secrets/, or an in-memory map (tests).

Functions

env_for

Map a canonical provider name to its environment variable, returning the value if non-empty.