The npm modules

PATENT PENDING — Ma'atara Protocol. npm metadata, published declarations and local manifests checked on 21 September 2026.

Version equality does not prove byte equality or deployment. Test the installed artifact and retain the lockfile. Review each package's shipped licence; BSL-1.1 is not an unrestricted production-use grant.

Runtime setup

All four packages are ESM. Use TypeScript module resolution Bundler, node16 or nodenext. Import published export-map paths, not workspace source paths.

Toolkit initialization

createProtocolWasm() returns the API without doing I/O. Await initialization:

import { createProtocolWasm } from '@maatara/pqc-toolkit';
import * as glue from '@maatara/pqc-toolkit/wasm/glue';
const proto = createProtocolWasm();
await proto.init(wasmInput, { glue });

In 2.2.1, wasmInput accepts RequestInfo | URL | Response | BufferSource | WebAssembly.Module. For browser/Vite, import @maatara/pqc-toolkit/wasm/binary?url as the URL. For Cloudflare Workers, pass the bundled WebAssembly.Module, not a fetched relative asset URL:

import { createProtocolWasm } from '@maatara/pqc-toolkit';
import * as glue from '@maatara/pqc-toolkit/wasm/glue';
import wasmModule from '@maatara/pqc-toolkit/wasm/binary';
const proto = createProtocolWasm();
await proto.init(wasmModule as unknown as WebAssembly.Module, { glue });

The repository's esbuild --loader:.wasm=copy preserves an emitted .wasm import for Wrangler to bundle as a compiled WASM module. It does not use esbuild's file loader or fetch a relative path inside the Worker. The current Worker initialization path uses createProtocolWasm().init with explicit glue. The published ./cloudflare-loader helper simply forwards to glue initialization; its string-typed argument is not a runtime-specific asset resolver. Test your Wrangler bundle.

Node can supply bytes without fetching a local file URL:

import { readFile } from 'node:fs/promises';
import { createProtocolWasm } from '@maatara/pqc-toolkit';
import * as glue from '@maatara/pqc-toolkit/wasm/glue';
const bytes = await readFile(new URL(import.meta.resolve('@maatara/pqc-toolkit/wasm/binary')));
const proto = createProtocolWasm();
await proto.init(bytes, { glue });

Use Node with import.meta.resolve support. Test a real-WASM round trip rather than relying on mocks. Cache your initialization promise so concurrent callers wait for one initialization. Always pair glue and binary from the same release.

Neither channel entry point is a production messaging service, a Triple Ratchet compatibility claim, or an independent-audit result. Product orchestration remains private in @maatara/secure-channel; production profiles are disabled.

Calls and errors

Use proto.pqc.keygen, sign and verify as in Quickstart. Use proto.tree.didFromPublicKey for SDK identity binding instead of reproducing derivation. Native labels are ml-dsa-65, ml-kem-768 and sha3-384; aliases are not native modes.

Signature methods accept base64url-encoded message bytes. pqc.verify returns a boolean; key generation and signing can return { error: string }. Check errors before using result fields. Other methods can throw or return JSON strings; follow each shipped declaration.

hash.sha3 and hash.sha3String return lowercase hex strings; B64u variants return base64url strings. None of these return raw bytes.

Veritas Chain

The published 2.2.1 root exports v4, Merkle, anchor, TigerBeetle and enterprise-audit modules. The old runtime chain factory/facade is absent. Dependencies include @maatara/pqc-toolkit and @noble/hashes.

Use validateBlockV4 with real identity and signature callbacks and validateBlockTransitionV4 for linked transitions. Record integration shows the adapter. Shape validation alone does not establish current authority or completeness.

import { computeChainRoot, buildChainAnchor, blockHashOf } from '@maatara/veritas-chain/anchor';

const hashes = blocks.map(blockHashOf);
if (hashes.some(hash => hash === null)) throw new Error('Incomplete or non-native chain');
const blockHashesHex = hashes as string[];
const root = computeChainRoot(blockHashesHex, proto.hash.sha3String);
const submission = buildChainAnchor({ blockHashesHex, chainHeight }, proto.hash.sha3String);

blocks is your complete ordered list; chainHeight is its authenticated decimal height. blockHashOf requires the exact native blockHash field and returns null for invalid records. Never skip invalid blocks to obtain a root. Bind authenticated height/leaf count and ordering as well as the root; the root alone is not an exact-length commitment. The toolkit's separate Merkle surface is not interchangeable with these helpers.

buildChainAnchor uses chain height as epoch and supplies ISO validity timestamps. It does not submit a request or sign an attestation. See Anchors.

Aegis Pure

Import fingerprintText, fingerprintQuery, key-status helpers and computeKeyFingerprintV2 from the root. There are no public /ksr or /text-fingerprint subpath exports.

import { fingerprintText, fingerprintQuery } from '@maatara/aegis-pure';
const registration = fingerprintText(proto.hash.sha3String, documentText);
const query = fingerprintQuery(proto.hash.sha3String, queryText);

Compute locally and send only the outputs required by the text API. Map registration assetId to asset_id, wordCount to word_count and preserve chunks. Map query values to vectors, wordCount to word_count and chunkCount to chunk_count. Do not send prose.

Keep the released fingerprint pipeline unchanged; using these calls does not require reproducing its internal algorithms. Key-status results require fresh authenticated evidence. computeKeyFingerprintV2 expects a hasher returning 48 raw bytes; adapt the toolkit's hex output before using it as that callback.

Aegis Encoder

The browser package loads bundler-target WASM internally. It requires a bundler that resolves bare WASM imports and does not use the toolkit's URL convention. For Vite, configure vite-plugin-wasm, including worker bundles, and exclude the WASM packages from dependency prebundling where needed. Image decoding uses browser-specific createImageBitmap and OffscreenCanvas.

Use the released encoder and approved integration interface for capsule creation. Fingerprint construction and capsule signing internals are outside this public guide.

Private packages

@maatara/parable-api, @maatara/parable-identity, @maatara/identity-types, @maatara/worker-utils, @maatara/parable-provenance, @maatara/parable-ui, @maatara/aegis-models and @maatara/secure-channel are internal workspace packages. An example importing one is not an external npm installation path. Temporary legacy account healing is retired (HTTP 410), not an available migration dependency.