# `nupp.runtime.services.mac` Canonical `nupp.mac` API 1 catalog for keyed authentication algorithms. Setup selects `service` before requiring `nupp.mac`. A selected catalog overrides matching built-ins and may add names; an unselected facade uses the built-in catalog. Descriptors are checked and retained at module initialization, so context creation and finalization perform no SPI resolution. Catalog discovery executes no provider. Importing this declaration creates no keyed or storage state. Algorithm names match their map keys. digestSize is a positive fixed byte count; hmac-sha256 always produces 32 bytes. create receives the retained descriptor and a raw-byte key and returns independently owned State using the shared digest protocol. Updates must not retain input views. finish writes exactly digestSize bytes without consuming state; the facade closes state on success and failure. Cleanup consumes ownership without suspension. Providers define private records satisfying the canonical State interface rather than substituting its identity. ## Types ### `Algorithm` _interface_ ```nupp interface Algorithm readonly name: string readonly digestSize: integer create: function(self: Algorithm, key: string): State end ``` Fixed-output authentication algorithm and a factory for keyed state. #### Methods ##### `create` ```nupp create: function(self: Algorithm, key: string): State ``` Creates independent owned state from the raw-byte secret key. ###### Arguments | Name | Type | Description | | --- | --- | --- | | `self` | `Algorithm` | | | `key` | `string` | | ###### Returns | Type | Description | | --- | --- | | `State` | | #### Fields ##### `name` ```nupp name: string ``` Canonical algorithm name matching the catalog key. ##### `digestSize` ```nupp digestSize: integer ``` Fixed output size in bytes. ### `Provider` _interface_ ```nupp interface Provider readonly algorithms: {[string]: Algorithm} end ``` A selectable catalog of keyed algorithm descriptors. #### Fields ##### `algorithms` ```nupp algorithms: {[string]: Algorithm} ``` Algorithms keyed by canonical name; additional descriptor fields are allowed. ## Values ### `service` _variable_ ```nupp const service: services.Service ``` Select during setup before the MAC facade loads.