> ## Documentation Index
> Fetch the complete documentation index at: https://docs.wipe.me/llms.txt
> Use this file to discover all available pages before exploring further.

# JavaScript/TypeScript SDK

> Use Wipe.me from browsers, React applications, and Node.js.

Package: [`@wipe-me/sdk`](https://www.npmjs.com/package/@wipe-me/sdk)\
Current prerelease: `0.5.0-alpha.1`
Source: [JavaScript SDK](https://github.com/wipe-me/sdk/tree/main/javascript)

```bash theme={null}
npm install @wipe-me/sdk@0.5.0-alpha.1
npm install @wipe-me/sdk@next
pnpm add @wipe-me/sdk@0.5.0-alpha.1
yarn add @wipe-me/sdk@0.5.0-alpha.1
```

<Note>
  The npm `latest` tag may still point to an older default release. Install the exact
  alpha version or use `@next`.
</Note>

## Encrypt, create, retrieve, and decrypt

```javascript theme={null}
import {
  WipeClient,
  bytesToBase64Url,
  createV1Envelope,
  generateMessageId,
  generateSecret,
  readV1Envelope,
} from "@wipe-me/sdk";

const api = new WipeClient({ clientId: "my-app" });
const messageId = generateMessageId();
const secret = generateSecret();

const encrypted = await createV1Envelope({
  messageId,
  secret,
  message: "Private hello",
  onProgress: (event) => console.log(event.phase, event.percent),
});

await api.createMessage({
  messageId,
  envelope: encrypted.envelope,
  deletionKey: encrypted.deletionKeyHeader,
  contentHash: encrypted.contentHash,
  expiresAt: Date.now() + 24 * 60 * 60 * 1000,
});

const downloaded = await api.retrieveMessage(messageId);
const opened = await readV1Envelope({
  messageId,
  secret,
  envelope: downloaded.envelope,
});

await api.deleteMessage(messageId, bytesToBase64Url(opened.deletionKey));
```

Long-running operations accept `onProgress` callbacks whose events include `phase`,
`processedBytes`, `totalBytes`, and `percent`. Attachment writers default to 512 KiB
AES-GCM frames and accept power-of-two `cryptoChunkBytes` values from 64 KiB through
4 MiB.

The client also exposes health and effective-limit operations, bounded upload and
download tests, and privacy-safe performance reporting. Browser uploads can use
`createXHRTransport()` for upload progress.

API failures throw `APIError` with `status`, stable `code`, human-readable `message`,
and optional `retryAfter`.

<Warning>
  The fragment secret must remain local. Never put it in an API request, logs,
  analytics, Open Graph metadata, or server-rendered content. Treat authentication,
  integrity, and content-hash failures as fatal.
</Warning>

See the [package source and README](https://github.com/wipe-me/sdk/tree/main/javascript)
for the complete exported API, attachment inputs, link helpers, and runtime
requirements.