Module gateway 

Axum-based HTTP gateway with proper HTTP/1.1 compliance, body limits, and timeouts.

This module replaces the raw TCP implementation with axum for:

• Proper HTTP/1.1 parsing and compliance
• Content-Length validation (handled by hyper)
• Request body size limits (64KB max)
• Request timeouts (30s) to prevent slow-loris attacks
• Header sanitization (handled by axum/hyper)

Modules

api

REST API handlers for the web dashboard.

api_agents

REST API handlers for agent management (/api/agents).

api_artifact_body

Serves the raw bytes of a Kumiho artifact’s underlying local file.

api_clawhub

ClawHub marketplace integration — proxy endpoints for the Construct gateway.

api_kumiho_proxy

Generic Kumiho API proxy — forwards /api/kumiho/* requests to the upstream Kumiho FastAPI server, injecting the service token and remapping auth errors so they don’t trigger browser re-pairing.

api_mcp

/api/mcp/* — discovery + health proxy for the in-process MCP server.

api_memory_graph

Aggregated memory graph endpoint for the Memory Auditor.

api_pairing

Device management and pairing API handlers.

api_skills

REST API handlers for skill management (/api/skills).

api_teams

REST API handlers for team management (/api/teams).

api_workflows

REST API handlers for workflow management (/api/workflows).

approval_registry

auth_rate_limit

Sliding-window rate limiter for authentication attempts.

canvas

Live Canvas gateway routes — REST + WebSocket for real-time canvas updates.

kumiho_client

HTTP client for the Kumiho FastAPI REST API.

mcp_discovery

Discovery of the local in-process MCP server.

nodes

WebSocket endpoint for dynamic node discovery and capability advertisement.

session_queue

Per-session actor queue for serializing concurrent access.

sse

Server-Sent Events (SSE) stream for real-time event delivery.

static_files

Static file serving for the embedded web dashboard.

terminal

WebSocket PTY terminal handler.

tls

TLS and mutual TLS (mTLS) support for the gateway server.

ws

WebSocket agent chat handler.

ws_mcp_events

GET /ws/mcp/events — WebSocket proxy onto the in-process MCP server’s session-wide progress SSE stream (GET /session/<id>/events).

Structs

AppState

Shared state for all axum handlers

GatewayRateLimiter

IdempotencyStore

WatiVerifyQuery

WebhookBody

Webhook request body

WhatsAppVerifyQuery

WhatsApp verification query params

Constants

IDEMPOTENCY_MAX_KEYS_DEFAULT

Fallback max distinct idempotency keys retained in gateway memory.

MAX_BODY_SIZE

Maximum request body size (64KB) — prevents memory exhaustion

RATE_LIMIT_MAX_KEYS_DEFAULT

Fallback max distinct client keys tracked in gateway rate limiter.

RATE_LIMIT_WINDOW_SECS

Sliding window used by gateway rate limiting.

REQUEST_TIMEOUT_SECS

Default request timeout (30s) — prevents slow-loris attacks.

Functions

gateway_request_timeout_secs

Read gateway request timeout from CONSTRUCT_GATEWAY_TIMEOUT_SECS env var at runtime, falling back to REQUEST_TIMEOUT_SECS.

run_gateway

Run the HTTP gateway using axum with proper HTTP/1.1 compliance.

verify_whatsapp_signature

Verify WhatsApp webhook signature (X-Hub-Signature-256). Returns true if the signature is valid, false otherwise. See: https://developers.facebook.com/docs/graph-api/webhooks/getting-started#verification-requests