SDK capability index

More

This page is the human-readable companion to /sdk-capabilities.json. Source and executable tests are authoritative; “supported” means a public SDK method exists and the repository exercises its request shape or behavior. Live provider/replacement evidence remains a separate release gate. The shared language-neutral snippets and security notes are available as /sdk-public-api-examples-v1.json.

Shared capability map

Capability	Go	Node/TypeScript	Java	Notes
Endpoint prefixes / path style	New	new Client	LockwellClient.builder	Prefix participates in signing/presigning
Explicit S3 region	WithRegion	region	.region	Default us-east-1
Custom TLS transport / CA	WithHTTPClient	fetch / createNodeFetch	.httpClient	Verification stays enabled
Attempt timeout / cancellation	WithRequestTimeout, context	timeoutMs, AbortSignal	.requestTimeout, future cancellation	Defaults differ by surface/language
Retry policy	RetryPolicy	RetryPolicy	RetryPolicy	Only replay-safe requests
Progress	ProgressFunc	onProgress / TransferProgress	ProgressListener / TransferProgressListener	Callback failure cancels
Response correlation	WithResponseMetadata	onResponseMetadata	.responseMetadataListener	Request ids + optional traceparent
Bucket CRUD / versioning	all three surfaces	all three surfaces	all three surfaces	Admin is not an object client
Object CRUD / ranges / streaming	S3 + native	S3 + native	S3 + native + async S3	Close streaming downloads
Conditional create	S3 WithPutIfNoneMatch, native IfNoneMatch	S3/native ifNoneMatch	S3 .ifNoneMatch, native .ifAbsent	Native also supports overwrite-by-ETag
Checksums	five S3 algorithms + native maps	five S3 algorithms + native maps	five S3 algorithms + native maps	Per-part/composite supported
Multipart / list / abort	S3 + native	S3 + native	S3 + native + async S3	Streaming parts supported
SSE-S3 / SSE-C	typed S3 options	typed S3 options	typed S3 overloads	SSE-C is S3-only; SSE-KMS unsupported
Tagging / versions	S3 + native	S3 + native	S3 + native + async S3	Includes delete markers
Retention / legal hold	get/set/put	S3 reads + native get/set	typed S3 get/set + native get/set	No governance bypass
S3 presign	GET/PUT/HEAD/DELETE	GET/PUT/HEAD/DELETE	GET/PUT/HEAD/DELETE	Query-SigV4
Native signed URLs	GET/PUT constraints	GET/PUT + prefix specialization	GET/PUT constraints	No bearer token on use
CORS / webhook notification	native	native + kit	native + kit	Webhook only; no SNS/SQS/Lambda
Health / readiness	native + admin	native + admin	native + admin sync/async	Credential-free probes
Tenant/key/quota/usage/audit	admin	admin	admin	Dry-run where server supports it
App kit / ERP helpers	lockwellkit helpers	LockwellKit, ErpScopes, StorageProfiles, ErpErrors	LockwellKit, ErpScopes, StorageProfiles, ErpErrors	Pure helpers do not choose policy
Edge runtime	not applicable	/edge native/admin/kit/helpers	not applicable	S3 client intentionally omitted

The typed SSE-C helpers are implemented on the S3 surface. The merged metadata remediation keeps user metadata lossless and user-owned (including historical reserved names), while internal SSE-C and Object Lock state is typed and separate. Capability presence still does not grant SSE-C to the native wire; the effective LNW server mask excludes it.

Native Wire transport map

LNW/1 is an experimental, opt-in, disabled-by-default transport for the native data plane. It is not a fourth domain surface and does not change the S3 or HTTP-native JSON contracts.

Consumer	Package / entry	Runtime floor	Qualified scope	Explicit absences
Shared TypeScript client	@kelphect/[email protected] (/node, /bun, /protocol, /testing)	Node 22+, Bun 1.4+	raw TLS 1.3 LNW/1; server-only	browser/default, SSE-C, ADMIN, fallback
SolidStart adapter	@kelphect/[email protected] (/server, /node, /bun)	Node 22+ or Bun 1.4+ server; build toolchain Node 24+	SolidStart v2; Nitro node_server, node_cluster, bun	edge/static/unknown presets, SSE-C, ADMIN, fallback
Next.js adapter	@kelphect/[email protected] (root react-server/node)	Next.js 16.3.3–16.x; Node 22+, Bun 1.4+	App Router server components/actions/Node Route Handlers; standalone/container and representative Node serverless	Client/browser, Edge/middleware, SSE-C, ADMIN, fallback
Spring starter	com.lockwell:lockwell-spring-boot-starter:0.2.2	JDK 25; Spring Boot 4.1.1 tested	lifecycle sync/virtual-thread async, streams, Object Lock, tags, multipart, CORS, notifications, signed capabilities	SSE-C, ADMIN, browser/edge, fallback

The Go standalone LNW client, Node primary-LNW transport, Java shared-core LNW client, and Nuxt adapter remain open source-owner work and are deliberately not listed as supported consumers until their PRs merge and their exact cross-language gates pass. See the Native Wire guide and wire reference.

Go public namespaces

• pkg/lockwellsdk: Client, Credentials, APIError, RetryPolicy, Progress, ResponseMetadata, bucket/object/ copy/list/paginator/multipart/tagging/Object Lock/checksum types, all With* option functions, and four presign methods.
• pkg/lockwellnative: Client, NativeError, health types, object/list/version/tag/retention/legal-hold/multipart/CORS/ notification/signed-URL types and iterators.
• pkg/lockwelladmin: Client, AdminError, health, tenant/account/key/quota/usage/audit inputs and results.
• pkg/lockwellkit: Kit, provisioning/ensure/key-scope/signed-URL/webhook helpers and ERP mapping/profile classifiers.

The complete method signatures live on the Go SDK page and in package documentation generated from source.

Additional exported result, option, iterator, health, progress, and ERP helper symbols are indexed here so a source addition cannot silently outrun the website:

BatchDeleteError BatchDeleted CallbackErr ClassifyERPError DataRightsDownloadURL DataRightsExportWrite
DeleteError DeletedObject ERPErrorCategory ERPErrorClassification ERPErrorSurface ERPErrorSurfaceAdmin
ERPErrorSurfaceNative ERPErrorSurfaceUnknown ERPKeyInput ERPObjectWriteRecipe ERPPurpose ERPPurposeDataRights
ERPPurposeExports ERPPurposeFiscalArchive ERPPurposeImports ERPPurposePath ERPPurposePathFor
ERPPurposeSupportBundles ERPRetentionSpec ERPRetryDecision ERPRetryDoNotRetry ERPRetryOperatorAction
ERPRetryRefreshCredentials ERPRetryWithBackoff ERPScopedClauses ERPSignedDownloadRecipe ERPSignedUploadRecipe
ERPTenantMapping EnsureBucket EnsureKey EnsureKeyInput EnsureKeyResult EnsureTenant EnsureTenantProvisioning
EnsureTenantProvisioningInput EnsureTenantProvisioningResult ErrorBody ExportDownloadURL FiscalArchiveBucketInput
FiscalArchiveWrite GetObjectWithProgress GoString HealthStatus ImportObjectWrite ImportUploadURL LegalHoldOff LegalHoldOn
MultipartUploadEntry NewERPTenantMapping ObjectEntry PartListItem ProfileDataRights ProfileExports ProfileFiscalArchive
ProfileImports ProfileMetadataKey ProfileSupportBundles ReadinessComponent ReadinessStatus RedactedSupportBundleWrite
ResponseMetadataFunc RetentionCompliance SignURLWithResult SignedDownloadURLInput SignedDownloadURLWithResult SignedURL
TotalKnown URLForKey VersionEntry WithGetObjectProgress WithGetProgress WithLegalHold WithPartNumberMarker
WithUploadIDMarker WithUploadsDelimiter WithUploadsKeyMarker

The merged admin/consensus additions are also public Go symbols and are intentionally indexed here:

ConsensusChange ConsensusLifecycleInput ConsensusMember ConsensusMemberInput ConsensusReplaceInput
DrainConsensusMember ExecuteConsensusRebalance GetConsensusMembership JoinConsensusMember RebalanceInput
RebalancePlan RebalanceResult RebalanceSummary RemoveConsensusMember ReplaceConsensusMember VersioningDisabled

Node/TypeScript exports

The default entry exports Client, NativeClient, AdminClient, LockwellKit, typed error classes and predicates, RetryPolicy, TimeoutError, checksum helpers/constants, buildPresignedGetUrl, buildPresignedObjectUrl, urlForKey, createNodeFetch, verifyWebhook, WEBHOOK_SIGNATURE_HEADER_NAME, ErpScopes, StorageProfiles, ErpErrors, their constants, and standalone helper functions. /edge exports the native/admin/kit/ERP/retry/WebCrypto subset and omits the S3 client, Node checksum/presign helpers, and Node transport.

See Node SDK for method tables and runtime ownership rules.

The named constant and standalone-helper exports are:

ERP_ERROR_CATEGORIES ERP_ERROR_SURFACES ERP_PURPOSES ERP_RETRY_DECISIONS LEGAL_HOLD_OFF LEGAL_HOLD_ON
PROFILE_METADATA_KEY RETENTION_COMPLIANCE STORAGE_PROFILES classifyAdmin classifyNative companyPrefix
complianceRetention legalHoldEnabled retentionSpec withLegalHold

Java public packages

• com.lockwell.sdk: LockwellClient, LockwellAsyncClient, Credentials, ApiException, RetryPolicy, ResponseMetadata, Progress, TransferProgress, Checksums, Presign, SigV4Signer, EndpointPath, retention/ legal-hold enums, paginator, and health result types.
• com.lockwell.sdk.nativeapi: LockwellNativeClient, NativeTypes, NativeException, and JSON helpers used by the public native types.
• com.lockwell.sdk.admin: LockwellAdminClient, AdminTypes, and AdminException.
• com.lockwell.sdk.kit: LockwellKit, KitTypes, ErpScopes, StorageProfiles, and ErpErrors.
• com.lockwell.sdk.spring: LockwellProperties and LockwellAutoConfiguration for S3 sync/async beans.

See Java SDK and Java native production guide.

Public nested/result types that are easy to miss in narrative guides are:

CompleteChecksumResult CompleteMultipartResult CompleteResult CreateMultipartResult DeleteError DeleteMarkerEntry
DeletedEntry DeletedObject Direction EnsureKeyResult ListEntry ObjectEntry ObjectLockUpdateResult ObjectWriteRecipe
PartEntry RetentionMode RetentionResult RetentionSpec SignedDownloadRecipe SignedUploadRecipe SignedUrlMethod TenantMapping
UploadPartResult VersionEntry

@kelphect/sdk-native public surface

The server-only TypeScript LNW package exports LockwellNativeClient, createLockwellClient, Credentials, CredentialProvider, TLSOptions, NativeClientConfig, RequestOptions, MetricsSink, TraceSink, LogSink, UserMetadataEntry, ResponseMetadata, ClientDiagnostics, bucket/object/version/multipart/tag/retention/legal-hold/ CORS/notification/signed-capability request and result types, and the stable LockwellError subclasses ProtocolError, TransportError, AuthenticationError, AuthorizationError, ServiceError, CancelledError, DeadlineExceededError, ClientClosedError, and the redaction helper redact. The /protocol entry exports FrameType, Operation, Capability, CLIENT_CAPABILITIES, FieldNumber, ErrorCode, DEFAULT_LIMITS, MAGIC, VERSION, HEADER_BYTES, and CRC_BYTES; /testing exports codec fixtures and the injectable socket boundary. See Native TypeScript for runnable usage and package checks.

@kelphect/sdk-solidstart public surface

The SolidStart v2 adapter exports the Vite guard (lockwellSolidStart, validateSolidStartRuntime), runtime refusal error (UNSUPPORTED_RUNTIME_CODE, UnsupportedSolidStartRuntimeError), server-only lifecycle/configuration helpers, createLockwellSolidStartClient, createNodeLockwellSolidStartClient, and createBunLockwellSolidStartClient, request/response route helpers (bindLockwellRequest, createObjectRouteHandlers, getObjectResponse, headObjectResponse, putObjectResponse, uploadPartResponse), errorResponse, parseSingleRange, and server-function/action helpers (requireSolidStartRequest, runCurrentLockwellServerFunction, runLockwellAction). Configuration helpers include resolveLockwellSolidStartServerConfig, redactLockwellSolidStartServerConfig, and InvalidLockwellSolidStartConfigError (INVALID_SOLIDSTART_CONFIG_CODE); lifecycle state uses LockwellSolidStartClientLifecycle, LockwellSolidStartConfigCollisionError (SOLIDSTART_CONFIG_COLLISION_CODE), and the testing reset helper. Request-event integration exposes MissingSolidStartRequestEventError (NO_SOLIDSTART_REQUEST_CODE). It supports only Node 22+/Bun 1.4+ server targets and Nitro node_server/node_cluster/bun; browser, edge, static, and unknown targets fail closed. See SolidStart v2.

@kelphect/sdk-nextjs public surface

The merged Next.js adapter exports NextLockwellAdapter, createNextLockwell, getNextLockwell, disposeNextLockwell, lockwellConfigFromEnv, LockwellSecret, lockwellDeploymentConfig, and lockwellDeploymentDiagnostics. Route helpers include putRequest, getResponse, and headCached; cache helpers are lockwellBucketTag, lockwellObjectTag, expireLockwellObject, and revalidateLockwellObject. Request/error and observability helpers are lockwellRequestContext, safeLockwellError, lockwellErrorResponse, registerLockwellInstrumentation, and lockwellTraceSink. The adapter re-exports the typed shared native client operations through adapter.client. It supports Next.js 16.3.3–16.x on Node 22+ or Bun 1.4+ Node-compatible servers; Client Components, browser bundles, Edge, and middleware fail closed. See Next.js 16.3 and the implementation README.

Advanced typed/configuration exports are CacheMutation, GetResponseOptions, PutRequestOptions, LockwellCacheOptions, LockwellEnvironment, NextLockwellConfig, NextLockwellCredentialProvider, NextLockwellTLSOptions, and SafeLockwellError. Error and lifecycle classes are LockwellConfigurationError, LockwellRequestError, and UnsupportedLockwellRuntimeError; runtime helpers are assertLockwellNodeRuntime, assertLockwellServerRuntime, resolveLifecycle, resolveNativeConfig, and cachedHeadObject. The lifecycle type is LockwellLifecycle ("auto", "long-lived", or "serverless").

Spring Boot Native Wire public surface

The opt-in starter publishes com.lockwell.sdk.springwire.LockwellNativeWireClient, LockwellNativeWireAsyncClient, LockwellNativeWireHealthIndicator, LockwellNativeWireProperties, NativeWireTypes, ResponseMetadata, TransferProgressListener, and LockwellWireException. It is JDK 25-first, Spring Boot 4.1.1-tested, and exposes sync/virtual-thread async streaming, Object Lock, checksums, multipart, tags, CORS, webhook, and signed-capability operations. SSE-C and the reserved Admin wire surface are absent. See Spring Boot Native Wire.

Deliberate absences

There are no first-party .NET, Rust, PHP, or Ruby SDKs. Those languages are explicit product non-goals; do not use an experimental branch or closed proposal as a production claim. There are no public SDK methods for public buckets, anonymous reads, IAM/STS, SSE-KMS, bucket-policy editing, website hosting, Select, Lambda/Object Lambda, tiering, or arbitrary notification targets. CLI/Web UI-only operator workflows are not silently represented as SDK methods.