Package subpaths

Applies to @open-e2ee/signal-protocol-sdk 6.0.x. Public APIs and persisted formats follow semantic versioning.

The package is ESM-only ("type": "module"), and package.json marks it as sideEffects: false. It requires Node >= 22.12.0. Every peer dependency is optional: install only what your chosen adapters need. The following tables contain all 57 entries of the exports map: the root, ./package.json, and 55 subpaths.

Imports are exact. @open-e2ee/signal-protocol-sdk/keys resolves. @open-e2ee/signal-protocol-sdk/dist/keys and @open-e2ee/signal-protocol-sdk/src/keys do not. Deep paths outside this map are not reachable through the exports field.

internal/** is implementation-only and not part of the supported external API. The exports map omits it, so you cannot import it through the package name. If a symbol exists only inside internal/, treat it as unavailable. Internal APIs carry no compatibility promise across releases.

Root

Subpath	Exports
`.`	`createSignalProtocolClient`, `createSignalProtocolClientConfig`, `SignalProtocolClient`, `PostQuantumPolicy`, `BraidPolicy`, the error taxonomy, and the commonly used types
`./package.json`	The manifest itself, for tooling that reads the version

The root re-exports the broadly used surface. Everything below it is available for narrower imports and for symbols the root does not lift.

Client

Subpath	Exports
`./client`	`SignalProtocolClient`, `bindRelayLifecycle`, `RelayLifecycleAppState`, `RelayLifecycleOptions`, and the client-level re-exports
`./client/compose`	`createSignalProtocolClient`, `createSignalProtocolClientConfig`, `SignalProtocolClientCompositionOptions`, `SignalProtocolClientIdentityConfig`, `SignalProtocolClientAdapterConfig`
`./client/config`	`SignalProtocolClientConfig`, `DoubleRatchetConfig`, `SealedSenderConfig`, `SenderKeysConfig`, `ProgressCallback`, `Logger`
`./client/types`	`SendOptions`, `SendResult`, `DataMessageInput`, `SignalProtocolClientHooks`, `HookName`, `DecryptedEnvelope`
`./client/constants`	`MESSAGE_RECORD_TTL_MS`, `MAX_RETRY_RESPONSES_PER_MESSAGE`, `IMPLICIT_ENVELOPE_TYPES`, `isImplicitContentType`
`./client/headless`	`rotateKeysHeadless`, `checkRotationNeeded`, `HeadlessRotationOptions`, `PreKeyRotationResult`
`./client/endorsement-manager`	`EndorsementManager`, `EndorsementCacheStore`

./client/headless exists for scheduled maintenance without a UI: a background task or a server-side job that rotates keys. ./client/endorsement-manager supports GroupsV2 send endorsements.

Device

Subpath	Exports
`./device`	`prepareNewDeviceTransfer`, `prepareOldDeviceTransferWithBackup`, `createDeviceBackup`, `restoreDeviceBackup`, `encryptDeviceName`, `MAX_DEVICES`
`./device/provisioning`	`generateProvisioningQR`, `parseProvisioningQR`, `provisionDevice`, `connectToProvisioningSession`, `receiveProvisioningMessage`, `getDeviceMetadata`, `cancelProvisioning`
`./device/lifecycle`	`DeviceLifecycleManager`, `getLocalDeviceMetadata`
`./device/device-id`	`getDeviceId`, `getDeviceIdSync`, `preloadDeviceId`, `clearDeviceIdCache`
`./device/expo`	`getDeviceMetadata`, which reads the local device metadata from Expo and React Native
`./device/constants`	`DEFAULT_DEVICE_ID`, `MAX_DEVICES`, `PROVISIONING_SESSION_TTL_MS`, `DEVICE_ID_KEY`, `DEVICE_NAME_KEY`, `LOCAL_IDENTITY_KEY`, `DEVICE_REGISTERED_USER_ID_KEY`, `DEVICE_OWNER_SENTINEL`

There is no client.device.* namespace. Device linking, transfer, and backup are these modules. See device lifecycle and multi-device.

Keys, trust, and identity

Subpath	Exports
`./keys`	Re-exports of `./keys/generation` and `./keys/types`
`./keys/generation`	`generateIdentityKeyPair`, `generateRegistrationId`, `generateEcSignedPreKey`, `generateEcSignedPreKeyId`, `generateEcOneTimePreKeys`, `generateKyberLastResortPreKey`, `generateKemOneTimePreKeys`
`./keys/types`	`CompositeIdentityV1`, `IdentityTrustState`, `ContactIdentityRecord`, `PreKeyBundle`, `PublicKey`, `IdentityType`
`./safety`	`generateCompositeSafetyNumber`, `generateSingleKeyReferenceSafetyNumber`, `compareSafetyNumbers`, `isValidSafetyNumber`, `clearFingerprintCache`, `Fingerprint`, `DisplayableFingerprint`, `ScannableFingerprint`, verify-URL helpers
`./sealed-sender`	`deriveAccessKey`, `ACCESS_KEY_BYTES`

IdentityTrustState is exactly 'UNVERIFIED_TOFU' | 'VERIFIED'. See keys, identity, and sessions.

Feature modules

Subpath	Exports
`./groups`	`GroupsV2Manager`, `createGroupId`, `GroupServer`, `GroupStateStore`, `DecryptedGroup`, `AccessControl`
`./groups/server`	`GroupAuthorizationServerEngine`, `GROUP_CHANGE_LOG_PAGE_LIMIT`, `encodeGroupAuthority`, `isGroupErrorDetail`, `serializeGroupBaseline`, `serializeGroupChangeCommitment`, and the group server types
`./blocking`	`SignalProtocolBlockingManager` — `blockRecipient`, `unblockRecipient`, `isBlocked`, `listBlockedRecipients`, `applySyncSnapshot`
`./profile`	`encryptProfileName`, `decryptProfileName`, `getOrCreateOwnProfileKey`, `setProfileKeyStorage`, `updateEncryptedProfile`
`./username`	`formatUsername`, `hashUsername`, `parseUsername`
`./username/link`	`createUsernameLink`, `decryptUsernameLink`
`./media`	`MediaAttachmentPointer`, `MediaAttachmentMessage`, `MediaAttachmentError`, `MediaAttachmentErrorCode`, `MediaAttachmentTransferOptions`, `MEDIA_ATTACHMENT_POLICY_DEFAULTS`, `MEDIA_ATTACHMENT_POLICY_PRESETS`, `generateMediaAttachmentUploadRequestId`
`./files`	`streamingEncrypt`, `streamingDecrypt`, `DEFAULT_SEGMENT_SIZE`, `secureZeroBytes`
`./zk/groups`	`computeProfileKeyVersion`, `deriveGroupSecretParams`, `getGroupPublicParams`, `uuidToBytes`, `serviceIdBinary`, `SERVICE_ID_ACI`, `SERVICE_ID_PNI`
`./zk/credentials`	Credential key serialization and deserialization helpers
`./hooks`	`useSessionHealth`, `useKeyRotation`, `useKeyRotationWithControls`, `useRelayConnectionState`, `useRelayLifecycle`, `useGroupMembership`, `useSingleFlight`
`./logger`	`createDefaultSignalProtocolLogger`, `resolveSignalProtocolLogger`
`./server-clock`	`recordServerClockSample`, `estimateServerTimestamp`
`./encoding`	`bytesToBase64`, `base64ToBytes`, and the shared encoding helpers
`./encoding/hex`	`bytesToHex`, `hexToBytes`
`./utils/retry`	`withRetry`, `isRetryableError`, `SignalProtocolRetryConfig`

./hooks are React hooks and need react installed. The subpath also imports AppState from react-native when it loads, because useKeyRotation and useRelayLifecycle read it.

Types

Subpath	Exports
`./types`	`SignalProtocolLocalStore`, `ProtocolStore`, `SignalProtocolManager`, the error taxonomy, and the shared protocol types
`./types/address`	`ProtocolAddress` and its `create`, `parse`, `toString`, `equals`, `isUser`, `isValid`, `toStorageKey`, `fromStorageKey` helpers
`./types/messages`	`MessageType`, `ContentHint`, `MessageHeader`, `RatchetMessage`, `PreKeyMessage`, `ProtocolMessage`
`./types/utils`	`Base64`, `Hex`, `Bytes` branded types with `asBase64`, `asHex`, `asBytes`, `toBase64`, `toHex`, `isValidBase64`, `isValidHex`

Local storage and vault

Subpath	Exports	Status
`./local/store`	`SignalProtocolLocalStore`, `InMemorySignalProtocolStore` re-export, shared store types	—
`./local/store/expo`	`expoStore(options?)`, `ExpoSignalProtocolStore`, `ExpoSignalProtocolStoreFactoryOptions`	Primary supported adapter
`./local/store/expo/db`	`configureSignalProtocolExpoDbBindings`, `resetSignalProtocolExpoDbBindings`, `getDrizzle`, `getRawDatabase`, re-exported Drizzle operators	Advanced
`./local/store/expo/schema`	Drizzle table definitions and row types for the Expo schema	Advanced
`./local/store/node`	`nodeStore(config?)`, `NodeSignalProtocolStore`, `NodeSignalProtocolStoreConfig`	Non-mobile and server-side
`./local/store/web`	`indexedDbStore()`, `IndexedDbSignalProtocolStore`	Supported
`./local/store/react-native`	`reactNativeStore(...)`, `ReactNativeKeyValueStorage`, `assertBackendConformance`, `createReferenceReactNativeBackend`	Supported; caller-provided backend
`./local/store/memory`	`inMemoryStore()`, `InMemorySignalProtocolStore`	Development only
`./local/vault`	`SignalProtocolLocalSecretVault`	—
`./local/vault/expo-secure-store`	Vault implementation over `expo-secure-store`	—

Await the async indexedDbStore() and nodeStore() functions. Do not await expoStore() or inMemoryStore().

The expo/db and expo/schema subpaths exist so applications that already run Drizzle can share one database handle and inspect the schema. Writing to those tables directly bypasses the store's atomicity guarantees. Read Adapter interfaces before you do.

Remote relay

Subpath	Exports	Status
`./remote/relay`	`SignalProtocolRelayServer` re-export, `InMemorySignalProtocolRelayServer` re-export, shared relay types	—
`./remote/relay/types`	`SignalProtocolRelayServer`, `ProvisioningService`, `KeyRotationService`, `RelayConnectionState`, `RelayConnectionReason`, `Unsubscribe`, envelope and bundle types	—
`./remote/relay/memory`	`inMemoryRelay()`, `InMemorySignalProtocolRelayServer`	Development only

inMemoryRelay() is in-memory and single-process. It is the right thing for tests and for the quickstart, and the wrong thing for anything a user touches. The OpenE2EE Signal Protocol Relay is reached through createHostedSignalProtocolClient() from the package root, not through a relay subpath: see Signal Protocol Relay.

Remote object store

Subpath	Exports	Status
`./remote/object-store`	`SignalProtocolRemoteObjectStore` and the brokered request and response types	—
`./remote/object-store/convex-r2`	`convexR2ObjectStore(config)`, `ConvexR2ObjectStoreConfig`	—
`./remote/object-store/convex-r2/server`	Server-side broker helpers for the Convex R2 integration	—
`./remote/object-store/s3`	`s3ObjectStore(config)`, `S3ObjectStoreBroker`, `S3ObjectStoreConfig`	—

The /server subpath runs on your backend, not on the device. It is the half that holds the provider credential.

Peer dependencies by subpath

The package declares all peer dependencies as optional. Install only what the subpaths you import require.

If you import	You need
`./local/store/expo`, `./local/store/expo/*`	`expo`, `expo-sqlite`, `expo-crypto`, `drizzle-orm`
`./local/vault/expo-secure-store`	`expo-secure-store`
`./local/store/web`	`idb`
`./local/store/react-native`	`react-native`
`./device/device-id` on React Native	`react-native-device-info`, `expo-device`, `expo-constants`
`./device/expo`	`react-native`, `expo-constants`
`./remote/object-store/convex-r2`, `./remote/object-store/convex-r2/server`	`convex`
`./remote/object-store/convex-r2`	`@convex-dev/r2`
`./hooks`	`react`, `react-native`

Security and protocol policy covers the six direct production dependencies that the package installs, which resolve to six packages in total: @noble/ciphers, @noble/curves, @noble/hashes, @noble/post-quantum, async-lock, and unique-names-generator.

API reference: the curated client surface
Adapter interfaces: what the adapter subpaths require of you
Runtime support: which store subpath your runtime needs
Choosing adapters: picking between them