phase 3

ui/core/canon/canon.go

@@ -0,0 +1,30 @@
+// Package canon implements the canonical-bytes serializer for the
+// Galaxy v1 transport envelopes (galaxy-request-v1, galaxy-response-v1,
+// galaxy-event-v1). The canonical-bytes contract is documented in
+// `docs/ARCHITECTURE.md` §15 and mirrored byte-for-byte by the gateway
+// in `gateway/authn`. Drift between the two implementations is caught
+// by the parity test under `gateway/authn/parity_with_ui_core_test.go`.
+//
+// The package is network-free, storage-free, and TinyGo-friendly: it
+// does not depend on `crypto/x509`, `encoding/pem`, or `os`. Random
+// bytes are never read inside this package; the higher-level keypair
+// API in `galaxy/core/keypair` accepts a caller-supplied io.Reader so
+// the WASM build can inject `crypto.getRandomValues`.
+package canon
+
+import "encoding/binary"
+
+// appendLengthPrefixedString encodes value as uvarint(len(value))
+// followed by the raw bytes of value.
+func appendLengthPrefixedString(dst []byte, value string) []byte {
+	return appendLengthPrefixedBytes(dst, []byte(value))
+}
+
+// appendLengthPrefixedBytes encodes value as uvarint(len(value))
+// followed by the raw bytes of value.
+func appendLengthPrefixedBytes(dst []byte, value []byte) []byte {
+	dst = binary.AppendUvarint(dst, uint64(len(value)))
+	dst = append(dst, value...)
+
+	return dst
+}