Package subpaths
The complete exports map of @open-e2ee/signal-protocol-sdk — every importable subpath, what it exports, and each entry's support status.
Applies to @open-e2ee/signal-protocol-sdk 0.1.x. Public APIs and persisted formats may change before 1.0.
The package is ESM-only ("type": "module"), and package.json marks it as sideEffects: false. It requires Node >= 18.0.0. Every peer dependency is optional: install only what your chosen adapters need. The following list contains all 55 importable subpaths plus ./package.json.
Imports are exact. @open-e2ee/signal-protocol-sdk/keys resolves. @open-e2ee/signal-protocol-sdk/dist/keys and @open-e2ee/signal-protocol-sdk/src/keys do not. Deep paths outside this map are not reachable through the exports field.
internal/** is implementation-only and not part of the supported external API. The exports map omits it, so you cannot import it through the package name. If a symbol exists only inside internal/, treat it as unavailable. Internal APIs carry no compatibility promise across 0.x releases.
Root
| Subpath | Exports |
|---|---|
. | createSignalProtocolClient, createSignalProtocolClientConfig, SignalProtocolClient, PostQuantumPolicy, BraidPolicy, the error taxonomy, and the commonly used types |
./package.json | The manifest itself, for tooling that reads the version |
The root re-exports the broadly used surface. Everything below it is available for narrower imports and for symbols the root does not lift.
Client
| Subpath | Exports |
|---|---|
./client | SignalProtocolClient and the client-level re-exports |
./client/compose | createSignalProtocolClient, createSignalProtocolClientConfig, SignalProtocolClientCompositionOptions, SignalProtocolClientIdentityConfig, SignalProtocolClientAdapterConfig |
./client/config | SignalProtocolClientConfig, DoubleRatchetConfig, SealedSenderConfig, SenderKeysConfig, ProgressCallback, ILogger |
./client/types | SendOptions, SendResult, DataMessageInput, SignalProtocolClientHooks, HookName, DecryptedEnvelope |
./client/constants | MESSAGE_RECORD_TTL_MS, MAX_RETRY_RESPONSES_PER_MESSAGE, IMPLICIT_ENVELOPE_TYPES, isImplicitContentType |
./client/headless | rotateKeysHeadless, checkRotationNeeded, HeadlessRotationOptions, HeadlessRotationResult |
./client/endorsement-manager | EndorsementManager, EndorsementCacheStore |
./client/headless exists for scheduled maintenance without a UI: a background task or a server-side job that rotates keys. ./client/endorsement-manager supports GroupsV2 send endorsements.
Device
| Subpath | Exports |
|---|---|
./device | prepareNewDeviceTransfer, prepareOldDeviceTransferWithBackup, createDeviceBackup, restoreDeviceBackup, encryptDeviceName, MAX_DEVICES |
./device/provisioning | generateProvisioningQR, parseProvisioningQR, provisionDevice, connectToProvisioningSession, receiveProvisioningMessage, getDeviceMetadata, cancelProvisioning |
./device/lifecycle | DeviceLifecycleManager, getLocalDeviceMetadata |
./device/device-id | getDeviceId, getDeviceIdSync, preloadDeviceId, clearDeviceIdCache |
./device/constants | DEFAULT_DEVICE_ID, MAX_DEVICES, PROVISIONING_SESSION_TTL_MS, DEVICE_ID_KEY, DEVICE_NAME_KEY, LOCAL_IDENTITY_KEY, DEVICE_REGISTERED_USER_ID_KEY, DEVICE_OWNER_SENTINEL |
There is no client.device.* namespace. Device linking, transfer, and backup are these modules. See device lifecycle and multi-device.
Keys, trust, and identity
| Subpath | Exports |
|---|---|
./keys | Re-exports of ./keys/generation and ./keys/types |
./keys/generation | generateIdentityKeyPair, generateRegistrationId, generateEcSignedPreKey, generateEcSignedPreKeyId, generateEcOneTimePreKeys, generateKyberLastResortPreKey, generateKemOneTimePreKeys |
./keys/types | CompositeIdentityV1, IdentityTrustState, ContactIdentityRecord, PreKeyBundle, PublicKey, IdentityType |
./safety | generateCompositeSafetyNumber, generateSingleKeyReferenceSafetyNumber, compareSafetyNumbers, isValidSafetyNumber, clearFingerprintCache, Fingerprint, DisplayableFingerprint, ScannableFingerprint, verify-URL helpers |
./sealed-sender | deriveAccessKey, ACCESS_KEY_BYTES |
IdentityTrustState is exactly 'UNVERIFIED_TOFU' | 'VERIFIED'. See keys, identity, and sessions.
Feature modules
| Subpath | Exports |
|---|---|
./groups | GroupsV2Manager, createGroupId, IGroupServer, IGroupStateStore, DecryptedGroup, AccessControl |
./blocking | SignalProtocolBlockingManager — blockRecipient, unblockRecipient, isBlocked, listBlockedRecipients, applySyncSnapshot |
./profile | encryptProfileName, decryptProfileName, getOrCreateOwnProfileKey, setProfileKeyStorage, updateEncryptedProfile |
./username | formatUsername, hashUsername, parseUsername |
./username/link | createUsernameLink, decryptUsernameLink |
./media | MediaAttachmentPointer, MediaAttachmentMessage, MediaAttachmentError, MediaAttachmentErrorCode, MediaAttachmentTransferOptions, MEDIA_ATTACHMENT_POLICY_DEFAULTS, MEDIA_ATTACHMENT_POLICY_PRESETS, generateMediaAttachmentUploadRequestId |
./files | streamingEncrypt, streamingDecrypt, DEFAULT_SEGMENT_SIZE, secureZeroBytes |
./zk/groups | computeProfileKeyVersion, deriveGroupSecretParams, getGroupPublicParams, uuidToBytes, serviceIdBinary, SERVICE_ID_ACI, SERVICE_ID_PNI |
./zk/credentials | Credential key serialisation and deserialisation helpers |
./hooks | useSessionHealth, useKeyRotation, useKeyRotationWithControls, useGroupMembership, useSingleFlight |
./hooks/use-connection-presence | useConnectionPresence |
./logger | createDefaultSignalProtocolLogger, resolveSignalProtocolLogger |
./server-clock | recordServerClockSample, estimateServerTimestamp |
./encoding | bytesToBase64, base64ToBytes, and the shared encoding helpers |
./encoding/hex | bytesToHex, hexToBytes |
./utils/retry | withRetry, isRetryableError, SignalProtocolRetryConfig |
./hooks are React hooks and need react installed. useConnectionPresence also pulls AppState from react-native and useConvex from convex/react. It requires a React Native app on a Convex backend. It has its own subpath for that reason.
Types
| Subpath | Exports |
|---|---|
./types | ISignalProtocolLocalStore, IProtocolStore, ISignalProtocolManager, the error taxonomy, and the shared protocol types |
./types/address | ProtocolAddress and its create, parse, toString, equals, isUser, isValid, toStorageKey, fromStorageKey helpers |
./types/messages | MessageType, ContentHint, MessageHeader, RatchetMessage, PreKeyMessage, ProtocolMessage |
./types/utils | Base64, Hex, Bytes branded types with asBase64, asHex, asBytes, toBase64, toHex, isValidBase64, isValidHex |
Local storage and vault
| Subpath | Exports | Status |
|---|---|---|
./local/store | ISignalProtocolLocalStore, InMemorySignalProtocolStore re-export, shared store types | — |
./local/store/expo | expoStore(options?), ExpoSignalProtocolStore, ExpoSignalProtocolStoreFactoryOptions | Primary supported adapter |
./local/store/expo/db | configureSignalProtocolExpoDbBindings, resetSignalProtocolExpoDbBindings, getDrizzle, getRawDatabase, re-exported Drizzle operators | Advanced |
./local/store/expo/schema | Drizzle table definitions and row types for the Expo schema | Advanced |
./local/store/node | nodeStore(config?), NodeSignalProtocolStore, NodeSignalProtocolStoreConfig | Non-mobile and server-side |
./local/store/web | indexedDbStore(), IndexedDbSignalProtocolStore | Supported |
./local/store/react-native | reactNativeStore(...), ReactNativeKeyValueStorage, assertBackendConformance, createReferenceReactNativeBackend | Supported; caller-provided backend |
./local/store/memory | inMemoryStore(), InMemorySignalProtocolStore | Development only |
./local/vault | ISignalProtocolLocalSecretVault | — |
./local/vault/expo-secure-store | Vault implementation over expo-secure-store | — |
Await the async indexedDbStore() and nodeStore() functions. Do not await expoStore() or inMemoryStore().
The expo/db and expo/schema subpaths exist so applications that already run Drizzle can share one database handle and inspect the schema. Writing to those tables directly bypasses the store's atomicity guarantees. Read Adapter interfaces before you do.
Remote relay
| Subpath | Exports | Status |
|---|---|---|
./remote/relay | ISignalProtocolRelayServer re-export, InMemorySignalProtocolRelayServer re-export, shared relay types | — |
./remote/relay/types | ISignalProtocolRelayServer, IProvisioningService, IKeyRotationService, envelope and bundle types | — |
./remote/relay/convex | convexRelay(options), ConvexSignalProtocolRelayServer, ConvexSignalProtocolRelayApi, ConvexSignalProtocolRelayOptions, ConvexGroupServer, ConvexGroupServerApi | — |
./remote/relay/convex/relay | The relay implementation module directly | — |
./remote/relay/memory | inMemoryRelay(), InMemorySignalProtocolRelayServer | Development only |
inMemoryRelay() is in-memory and single-process. It is the right thing for tests and for the quickstart, and the wrong thing for anything a user touches.
Remote object store
| Subpath | Exports | Status |
|---|---|---|
./remote/object-store | SignalProtocolRemoteObjectStore and the brokered request and response types | — |
./remote/object-store/convex-r2 | convexR2ObjectStore(config), ConvexR2ObjectStoreConfig | — |
./remote/object-store/convex-r2/server | Server-side broker helpers for the Convex R2 integration | — |
./remote/object-store/s3 | s3ObjectStore(config), S3ObjectStoreBroker, S3ObjectStoreConfig | — |
The /server subpath runs on your backend, not on the device. It is the half that holds the provider credential.
Peer dependencies by subpath
The package declares all peer dependencies as optional. Install only what the subpaths you import require.
| If you import | You need |
|---|---|
./local/store/expo, ./local/store/expo/* | expo, expo-sqlite, expo-crypto, drizzle-orm |
./local/vault/expo-secure-store | expo-secure-store |
./local/store/web | idb |
./local/store/react-native | react-native |
./device/device-id on React Native | react-native-device-info, expo-device, expo-constants |
./remote/relay/convex, ./remote/object-store/convex-r2 | convex |
./remote/object-store/convex-r2 | @convex-dev/r2 |
./hooks | react |
./hooks/use-connection-presence | react, react-native, convex |
Security and protocol policy covers the six direct production dependencies that the package installs, which resolve to six packages in total: @noble/ciphers, @noble/curves, @noble/hashes, @noble/post-quantum, async-lock, and unique-names-generator.
Next
- API reference: the curated client surface
- Adapter interfaces: what the adapter subpaths require of you
- Runtime support: which store subpath your runtime needs
- Choosing adapters: picking between them