diff --git a/.eslintrc.json b/.eslintrc.json
index efdaa1b..1ad9598 100644
--- a/.eslintrc.json
+++ b/.eslintrc.json
@@ -36,7 +36,8 @@
             "parser": "@typescript-eslint/parser",
             "parserOptions": {
                 "ecmaVersion": 2020,
-                "sourceType": "module"
+                "sourceType": "module",
+                "project": true
             },
             "extends": [
                 "plugin:@typescript-eslint/eslint-recommended",
@@ -90,7 +91,9 @@
                     {
                         "argsIgnorePattern": "^_"
                     }
-                ]
+                ],
+                "@typescript-eslint/consistent-type-imports": "error",
+                "@typescript-eslint/consistent-type-exports": "error"
             }
         }
     ]
diff --git a/src/3dh_client.ts b/src/3dh_client.ts
index bfbeb4d..7bb57ed 100644
--- a/src/3dh_client.ts
+++ b/src/3dh_client.ts
@@ -3,10 +3,11 @@
 // Licensed under the BSD-3-Clause license found in the LICENSE file or
 // at https://opensource.org/licenses/BSD-3-Clause
 
-import { AuthFinish, AuthRequest, CredentialRequest, KE1, KE2 } from './messages.js'
+import type { CredentialRequest, KE2 } from './messages.js'
+import { AuthFinish, AuthRequest, KE1 } from './messages.js'
 import { deriveKeys, preambleBuild, tripleDH_IKM } from './common.js'
 
-import { Config } from './config.js'
+import type { Config } from './config.js'
 import { joinAll } from './util.js'
 
 export class AKE3DHClient {
diff --git a/src/3dh_server.ts b/src/3dh_server.ts
index 6552693..6691ad6 100644
--- a/src/3dh_server.ts
+++ b/src/3dh_server.ts
@@ -3,17 +3,12 @@
 // Licensed under the BSD-3-Clause license found in the LICENSE file or
 // at https://opensource.org/licenses/BSD-3-Clause
 
-import {
-    AuthFinish,
-    AuthResponse,
-    CredentialResponse,
-    ExpectedAuthResult,
-    KE1
-} from './messages.js'
+import type { AuthFinish, CredentialResponse, KE1 } from './messages.js'
+import { AuthResponse, ExpectedAuthResult } from './messages.js'
 import { ctEqual, joinAll } from './util.js'
 import { deriveKeys, preambleBuild, tripleDH_IKM } from './common.js'
 
-import { Config } from './config.js'
+import type { Config } from './config.js'
 
 export class AKE3DHServer {
     private expected?: ExpectedAuthResult
diff --git a/src/common.ts b/src/common.ts
index a2aad50..fff2107 100644
--- a/src/common.ts
+++ b/src/common.ts
@@ -3,7 +3,8 @@
 // Licensed under the BSD-3-Clause license found in the LICENSE file or
 // at https://opensource.org/licenses/BSD-3-Clause
 
-import { AKEFn, AKEKeyPair, OPRFFn } from './thecrypto.js'
+import type { AKEFn, AKEKeyPair, OPRFFn } from './thecrypto.js'
+import type { SuiteID } from '@cloudflare/voprf-ts'
 import {
     Evaluation,
     EvaluationRequest,
@@ -11,15 +12,14 @@ import {
     OPRFClient,
     OPRFServer,
     Oprf,
-    SuiteID,
     deriveKeyPair,
     generateKeyPair,
     getKeySizes
 } from '@cloudflare/voprf-ts'
-import { CredentialResponse, KE1 } from './messages.js'
+import type { CredentialResponse, KE1 } from './messages.js'
 import { encode_number, encode_vector_16, encode_vector_8, joinAll } from './util.js'
 
-import { Config } from './config.js'
+import type { Config } from './config.js'
 
 export type Ok<T> = { ok: true; value: T }
 export type Err<E> = { ok: false; error: E }
diff --git a/src/config.ts b/src/config.ts
index eca1565..b01d6c2 100644
--- a/src/config.ts
+++ b/src/config.ts
@@ -3,7 +3,7 @@
 // Licensed under the BSD-3-Clause license found in the LICENSE file or
 // at https://opensource.org/licenses/BSD-3-Clause
 
-import { AKEFn, HashFn, KDFFn, MACFn, OPRFFn, PrngFn } from './thecrypto.js'
+import type { AKEFn, HashFn, KDFFn, MACFn, OPRFFn, PrngFn } from './thecrypto.js'
 
 export interface Config {
     readonly constants: {
diff --git a/src/core_client.ts b/src/core_client.ts
index 3db8ba6..21e3f49 100644
--- a/src/core_client.ts
+++ b/src/core_client.ts
@@ -3,18 +3,13 @@
 // Licensed under the BSD-3-Clause license found in the LICENSE file or
 // at https://opensource.org/licenses/BSD-3-Clause
 
-import { AKEKeyPair, KSFFn, ScryptKSFFn } from './thecrypto.js'
-import {
-    CredentialRequest,
-    CredentialResponse,
-    Envelope,
-    RegistrationRecord,
-    RegistrationRequest,
-    RegistrationResponse
-} from './messages.js'
+import type { AKEKeyPair, KSFFn } from './thecrypto.js'
+import { ScryptKSFFn } from './thecrypto.js'
+import type { CredentialResponse, RegistrationResponse } from './messages.js'
+import { CredentialRequest, Envelope, RegistrationRecord, RegistrationRequest } from './messages.js'
 import { checked_vector, encode_vector_16, joinAll, xor } from './util.js'
 
-import { Config } from './config.js'
+import type { Config } from './config.js'
 import { LABELS } from './common.js'
 
 class CleartextCredentials {
diff --git a/src/core_server.ts b/src/core_server.ts
index 5fdbd91..30e726b 100644
--- a/src/core_server.ts
+++ b/src/core_server.ts
@@ -3,17 +3,11 @@
 // Licensed under the BSD-3-Clause license found in the LICENSE file or
 // at https://opensource.org/licenses/BSD-3-Clause
 
-import {
-    CredentialRequest,
-    CredentialResponse,
-    Envelope,
-    RegistrationRecord,
-    RegistrationRequest,
-    RegistrationResponse
-} from './messages.js'
+import type { CredentialRequest, RegistrationRecord, RegistrationRequest } from './messages.js'
+import { CredentialResponse, Envelope, RegistrationResponse } from './messages.js'
 import { checked_vector, joinAll, xor } from './util.js'
 
-import { Config } from './config.js'
+import type { Config } from './config.js'
 import { LABELS } from './common.js'
 
 export class OpaqueCoreServer {
diff --git a/src/messages.ts b/src/messages.ts
index d1ff6f8..ca114c5 100644
--- a/src/messages.ts
+++ b/src/messages.ts
@@ -5,7 +5,7 @@
 
 import { checked_vector, decode_vector_16, encode_vector_16, joinAll } from './util.js'
 
-import { Config } from './config.js'
+import type { Config } from './config.js'
 
 export abstract class Serializable {
     abstract serialize(): number[]
diff --git a/src/opaque_client.ts b/src/opaque_client.ts
index 5067d69..66382d5 100644
--- a/src/opaque_client.ts
+++ b/src/opaque_client.ts
@@ -3,18 +3,19 @@
 // Licensed under the BSD-3-Clause license found in the LICENSE file or
 // at https://opensource.org/licenses/BSD-3-Clause
 
-import {
+import type {
     KE1,
     KE2,
-    KE3,
     RegistrationRecord,
     RegistrationRequest,
     RegistrationResponse
 } from './messages.js'
-import { KSFFn, ScryptKSFFn } from './thecrypto.js'
+import { KE3 } from './messages.js'
+import type { KSFFn } from './thecrypto.js'
+import { ScryptKSFFn } from './thecrypto.js'
 
 import { AKE3DHClient } from './3dh_client.js'
-import { Config } from './config.js'
+import type { Config } from './config.js'
 import { OpaqueCoreClient } from './core_client.js'
 
 export interface RegistrationClient {
diff --git a/src/opaque_server.ts b/src/opaque_server.ts
index 7302e1e..ba6c71c 100644
--- a/src/opaque_server.ts
+++ b/src/opaque_server.ts
@@ -3,19 +3,18 @@
 // Licensed under the BSD-3-Clause license found in the LICENSE file or
 // at https://opensource.org/licenses/BSD-3-Clause
 
-import { AKEExportKeyPair, AKEKeyPair } from './thecrypto.js'
-import {
+import type { AKEExportKeyPair, AKEKeyPair } from './thecrypto.js'
+import type {
     KE1,
-    KE2,
     KE3,
     RegistrationRecord,
     RegistrationRequest,
-    RegistrationResponse,
-    Serializable
+    RegistrationResponse
 } from './messages.js'
+import { KE2, Serializable } from './messages.js'
 
 import { AKE3DHServer } from './3dh_server.js'
-import { Config } from './config.js'
+import type { Config } from './config.js'
 import { OpaqueCoreServer } from './core_server.js'
 
 export interface RegistrationServer {
diff --git a/src/suites.ts b/src/suites.ts
index 8f162ec..64dc685 100644
--- a/src/suites.ts
+++ b/src/suites.ts
@@ -3,11 +3,14 @@
 // Licensed under the BSD-3-Clause license found in the LICENSE file or
 // at https://opensource.org/licenses/BSD-3-Clause
 
-import { AKE3DH, Err, OPRFBaseMode, Ok, Result } from './common.js'
-import { AKEFn, Hash, HashFn, Hkdf, Hmac, KDFFn, MACFn, OPRFFn, Prng, PrngFn } from './thecrypto.js'
-import { Oprf, SuiteID } from '@cloudflare/voprf-ts'
+import type { Result } from './common.js'
+import { AKE3DH, Err, OPRFBaseMode, Ok } from './common.js'
+import type { AKEFn, HashFn, KDFFn, MACFn, OPRFFn, PrngFn } from './thecrypto.js'
+import { Hash, Hkdf, Hmac, Prng } from './thecrypto.js'
+import type { SuiteID } from '@cloudflare/voprf-ts'
+import { Oprf } from '@cloudflare/voprf-ts'
 
-import { Config } from './config.js'
+import type { Config } from './config.js'
 
 export enum OpaqueID {
     OPAQUE_P256 = 'P256-SHA256',
diff --git a/test/credentials.test.ts b/test/credentials.test.ts
index 74f7062..6879e91 100644
--- a/test/credentials.test.ts
+++ b/test/credentials.test.ts
@@ -3,19 +3,21 @@
 // Licensed under the BSD-3-Clause license found in the LICENSE file or
 // at https://opensource.org/licenses/BSD-3-Clause
 
-import {
+import type {
     AKEExportKeyPair,
     Config,
+    RegistrationClient,
+    RegistrationServer
+} from '../src/index.js'
+import {
     CredentialFile,
     OpaqueClient,
     OpaqueConfig,
     OpaqueID,
     OpaqueServer,
-    RegistrationClient,
     RegistrationRecord,
     RegistrationRequest,
-    RegistrationResponse,
-    RegistrationServer
+    RegistrationResponse
 } from '../src/index.js'
 
 import { KVStorage } from './common.js'
diff --git a/test/opaque_core.test.ts b/test/opaque_core.test.ts
index 076a59a..657a172 100644
--- a/test/opaque_core.test.ts
+++ b/test/opaque_core.test.ts
@@ -3,14 +3,8 @@
 // Licensed under the BSD-3-Clause license found in the LICENSE file or
 // at https://opensource.org/licenses/BSD-3-Clause
 
-import {
-    AKEKeyPair,
-    Config,
-    CredentialFile,
-    OpaqueConfig,
-    OpaqueID,
-    RegistrationRecord
-} from '../src/index.js'
+import type { AKEKeyPair, Config, RegistrationRecord } from '../src/index.js'
+import { CredentialFile, OpaqueConfig, OpaqueID } from '../src/index.js'
 
 import { KVStorage } from './common.js'
 import { OpaqueCoreClient } from '../src/core_client.js'
diff --git a/test/opaque_full.test.ts b/test/opaque_full.test.ts
index 72a2da1..193b41b 100644
--- a/test/opaque_full.test.ts
+++ b/test/opaque_full.test.ts
@@ -3,11 +3,15 @@
 // Licensed under the BSD-3-Clause license found in the LICENSE file or
 // at https://opensource.org/licenses/BSD-3-Clause
 
-import {
+import type {
     AKEExportKeyPair,
     AuthClient,
     AuthServer,
     Config,
+    RegistrationClient,
+    RegistrationServer
+} from '../src/index.js'
+import {
     CredentialFile,
     KE1,
     KE2,
@@ -16,11 +20,9 @@ import {
     OpaqueConfig,
     OpaqueID,
     OpaqueServer,
-    RegistrationClient,
     RegistrationRecord,
     RegistrationRequest,
-    RegistrationResponse,
-    RegistrationServer
+    RegistrationResponse
 } from '../src/index.js'
 
 import { KVStorage } from './common.js'
diff --git a/test/vectors.test.ts b/test/vectors.test.ts
index f7081f6..7a8e64f 100644
--- a/test/vectors.test.ts
+++ b/test/vectors.test.ts
@@ -3,15 +3,14 @@
 // Licensed under the BSD-3-Clause license found in the LICENSE file or
 // at https://opensource.org/licenses/BSD-3-Clause
 
+import type { Config, KSFFn } from '../src/index.js'
 import {
     AKE3DH,
-    Config,
     CredentialFile,
     IdentityKSFFn,
     KE1,
     KE2,
     KE3,
-    KSFFn,
     OpaqueClient,
     OpaqueConfig,
     OpaqueServer,
@@ -19,7 +18,8 @@ import {
     isOk
 } from '../src/index.js'
 import { KVStorage, fromHex, fromHexString, notNullHex, notNullHexString, toHex } from './common.js'
-import { OPRFClient, Oprf, SuiteID } from '@cloudflare/voprf-ts'
+import type { SuiteID } from '@cloudflare/voprf-ts'
+import { OPRFClient, Oprf } from '@cloudflare/voprf-ts'
 
 import { jest } from '@jest/globals'
 import { readFileSync } from 'node:fs'