nupp.runtime.services.mac

Canonical nupp.mac API 1 catalog for keyed authentication algorithms.

Setup selects service before requiring nupp.mac. A selected catalog overrides matching built-ins and may add names; an unselected facade uses the built-in catalog. Descriptors are checked and retained at module initialization, so context creation and finalization perform no SPI resolution. Catalog discovery executes no provider. Importing this declaration creates no keyed or storage state.

Algorithm names match their map keys. digestSize is a positive fixed byte count; hmac-sha256 always produces 32 bytes. create receives the retained descriptor and a raw-byte key and returns independently owned State using the shared digest protocol. Updates must not retain input views. finish writes exactly digestSize bytes without consuming state; the facade closes state on success and failure. Cleanup consumes ownership without suspension. Providers define private records satisfying the canonical State interface rather than substituting its identity.

interface Algorithm
    readonly name: string
    readonly digestSize: integer
    create: function(self: Algorithm, key: string): State
end

create: function(self: Algorithm, key: string): State

name: string

digestSize: integer

interface Provider
    readonly algorithms: {[string]: Algorithm}
end

algorithms: {[string]: Algorithm}

const service: services.Service<Provider>