Crate brain_edge 

brain-edge — the HTTP/JSON edge for the Brain memory database, as a library.

Brain speaks a binary wire protocol (CBOR over TCP). This crate translates the hosted /v1/* HTTP/JSON API to that wire protocol via the Brain SDK. It is both:

• a binary (run) — the self-hostable front door; point any HTTP client at it and the self-host experience matches the cloud, only the base URL differs; and
• a library — the Arc cloud gateway embeds app::router and injects its own CredentialResolver + MeteringSink (via EdgeState::with_ports) to add API-key auth and usage metering without forking the wire↔JSON translation layer.

The two deployments share one engine: the same DTOs, the same mapping, the same per-credential connection pool. They differ only in the two injected ports.

Re-exports

pub use config::EdgeConfig;

pub use error::ApiError;

pub use pool::BrainPool;

pub use pool::BrainPoolConfig;

pub use port::BearerResolver;

pub use port::CredentialResolver;

pub use port::MeterEvent;

pub use port::MeteringSink;

pub use port::NoopMeter;

pub use port::Outcome;

pub use port::ResolvedCredential;

pub use port::bearer_token;

pub use state::EdgeState;

pub use wire_proxy::RateLimitConfig;

pub use wire_proxy::WireProxyConfig;

Modules

app

The HTTP surface: the data-plane router.

config

Deploy-time configuration, read from the environment.

crypto

Envelope encryption for tenant LLM provider keys (BYOK).

dto

The public JSON contract for /v1/*, grouped by domain.

error

HTTP error type — one JSON error envelope, mapped from Brain’s taxonomy.

pool

BrainPool — a bounded, per-credential connection-pool cache to Brain.

port

The two seams that let one edge serve two deployments.

state

Shared state: the BrainPool connection cache to Brain plus the injected CredentialResolver + MeteringSink ports.

wire_proxy

wire_proxy — the transparent Brain wire-protocol proxy (deployment Option X, Shape B: opaque frame-splice).

Structs

ActAs

The per-request effective-identity selector the gateway sets when running a BrainPool::shared service pool: build one with ActAs { namespace, space_id } (or the SDK request builders’ .act_as(..)) to run each op as a resolved tenant on behalf of the trusted service principal. Re-exported so a gateway consuming brain_edge need not also name brain_db_sdk directly. Per-request effective-identity selector carried on data-plane op requests. When present, the op runs as this (namespace, space_id) on behalf of the authenticated connection principal; when the field is absent (the common case, omitted on the wire) the op runs as the connection’s own key-bound identity.

Constants

CREDENTIAL_STORE_ENV

Env var pointing at a durable BYOK credential file.

Functions

harden

Apply the transport-level protections every deployment needs.

run

Run the self-host edge: build default state (bearer passthrough, no metering), bind the listener, and serve until shutdown.