# SDK capability index This page is the human-readable companion to [`/sdk-capabilities.json`](/sdk-capabilities.json). Source and executable tests are authoritative; “supported” means a public SDK method exists and the repository exercises its request shape or behavior. Live provider/replacement evidence remains a separate release gate. The shared language-neutral snippets and security notes are available as [`/sdk-public-api-examples-v1.json`](/sdk-public-api-examples-v1.json). ## Shared capability map | Capability | Go | Node/TypeScript | Java | Notes | | -------------------------------- | --------------------------------------------- | ---------------------------------------------------------- | ---------------------------------------------------------- | ----------------------------------------- | | Endpoint prefixes / path style | `New` | `new Client` | `LockwellClient.builder` | Prefix participates in signing/presigning | | Explicit S3 region | `WithRegion` | `region` | `.region` | Default `us-east-1` | | Custom TLS transport / CA | `WithHTTPClient` | `fetch` / `createNodeFetch` | `.httpClient` | Verification stays enabled | | Attempt timeout / cancellation | `WithRequestTimeout`, context | `timeoutMs`, `AbortSignal` | `.requestTimeout`, future cancellation | Defaults differ by surface/language | | Retry policy | `RetryPolicy` | `RetryPolicy` | `RetryPolicy` | Only replay-safe requests | | Progress | `ProgressFunc` | `onProgress` / `TransferProgress` | `ProgressListener` / `TransferProgressListener` | Callback failure cancels | | Response correlation | `WithResponseMetadata` | `onResponseMetadata` | `.responseMetadataListener` | Request ids + optional traceparent | | Bucket CRUD / versioning | all three surfaces | all three surfaces | all three surfaces | Admin is not an object client | | Object CRUD / ranges / streaming | S3 + native | S3 + native | S3 + native + async S3 | Close streaming downloads | | Conditional create | S3 `WithPutIfNoneMatch`, native `IfNoneMatch` | S3/native `ifNoneMatch` | S3 `.ifNoneMatch`, native `.ifAbsent` | Native also supports overwrite-by-ETag | | Checksums | five S3 algorithms + native maps | five S3 algorithms + native maps | five S3 algorithms + native maps | Per-part/composite supported | | Multipart / list / abort | S3 + native | S3 + native | S3 + native + async S3 | Streaming parts supported | | SSE-S3 / SSE-C | typed S3 options | typed S3 options | typed S3 overloads | SSE-C is S3-only; SSE-KMS unsupported | | Tagging / versions | S3 + native | S3 + native | S3 + native + async S3 | Includes delete markers | | Retention / legal hold | get/set/put | S3 reads + native get/set | typed S3 get/set + native get/set | No governance bypass | | S3 presign | GET/PUT/HEAD/DELETE | GET/PUT/HEAD/DELETE | GET/PUT/HEAD/DELETE | Query-SigV4 | | Native signed URLs | GET/PUT constraints | GET/PUT + prefix specialization | GET/PUT constraints | No bearer token on use | | CORS / webhook notification | native | native + kit | native + kit | Webhook only; no SNS/SQS/Lambda | | Health / readiness | native + admin | native + admin | native + admin sync/async | Credential-free probes | | Tenant/key/quota/usage/audit | admin | admin | admin | Dry-run where server supports it | | App kit / ERP helpers | `lockwellkit` helpers | `LockwellKit`, `ErpScopes`, `StorageProfiles`, `ErpErrors` | `LockwellKit`, `ErpScopes`, `StorageProfiles`, `ErpErrors` | Pure helpers do not choose policy | | Edge runtime | not applicable | `/edge` native/admin/kit/helpers | not applicable | S3 client intentionally omitted | The typed SSE-C helpers are implemented on the S3 surface. The merged metadata remediation keeps user metadata lossless and user-owned (including historical reserved names), while internal SSE-C and Object Lock state is typed and separate. Capability presence still does not grant SSE-C to the native wire; the effective LNW server mask excludes it. ## Native Wire transport map LNW/1 is an experimental, opt-in, disabled-by-default transport for the native data plane. It is not a fourth domain surface and does not change the S3 or HTTP-native JSON contracts. | Consumer | Package / entry | Runtime floor | Qualified scope | Explicit absences | | --- | --- | --- | --- | --- | | Shared TypeScript client | `@kelphect/sdk-native@0.1.0` (`/node`, `/bun`, `/protocol`, `/testing`) | Node 22+, Bun 1.4+ | raw TLS 1.3 LNW/1; server-only | browser/default, SSE-C, ADMIN, fallback | | Go client | `github.com/RusticStack/lockwell-sdk-go/lockwellwire` | Go 1.27+ | raw TLS 1.3 LNW/1; server-only | browser/default, SSE-C, ADMIN, fallback | | Spring starter | `com.lockwell:lockwell-spring-boot-starter:0.2.2` | JDK 25; Spring Boot 4.1.1 tested | lifecycle sync/virtual-thread async, streams, Object Lock, tags, multipart, CORS, notifications, signed capabilities | SSE-C, ADMIN, browser/edge, fallback | The Nuxt adapter remains open source-owner work and is deliberately not listed as a supported consumer until its PR merges and its exact cross-language gates pass. See the [Native Wire guide](/guide/native-wire) and [wire reference](/reference/native-wire). ## Go public namespaces - `lockwellsdk` (`lockwell-sdk-go`): `Client`, `Credentials`, `APIError`, `RetryPolicy`, `Progress`, `ResponseMetadata`, bucket/object/ copy/list/paginator/multipart/tagging/Object Lock/checksum types, all `With*` option functions, and four presign methods. - `lockwellnative` (`lockwell-sdk-go`): `Client`, `NativeError`, health types, object/list/version/tag/retention/legal-hold/multipart/CORS/ notification/signed-URL types and iterators. - `lockwelladmin` (`lockwell-sdk-go`): `Client`, `AdminError`, health, tenant/account/key/quota/usage/audit inputs and results. - `lockwellkit` (`lockwell-sdk-go`): `Kit`, provisioning/ensure/key-scope/signed-URL/webhook helpers and ERP mapping/profile classifiers. The complete method signatures live on the [Go SDK page](/sdks/go) and in package documentation generated from source. Additional exported result, option, iterator, health, progress, and ERP helper symbols are indexed here so a source addition cannot silently outrun the website: ```text BatchDeleteError BatchDeleted CallbackErr ClassifyERPError DataRightsDownloadURL DataRightsExportWrite DeleteError DeletedObject ERPErrorCategory ERPErrorClassification ERPErrorSurface ERPErrorSurfaceAdmin ERPErrorSurfaceNative ERPErrorSurfaceUnknown ERPKeyInput ERPObjectWriteRecipe ERPPurpose ERPPurposeDataRights ERPPurposeExports ERPPurposeFiscalArchive ERPPurposeImports ERPPurposePath ERPPurposePathFor ERPPurposeSupportBundles ERPRetentionSpec ERPRetryDecision ERPRetryDoNotRetry ERPRetryOperatorAction ERPRetryRefreshCredentials ERPRetryWithBackoff ERPScopedClauses ERPSignedDownloadRecipe ERPSignedUploadRecipe ERPTenantMapping EnsureBucket EnsureKey EnsureKeyInput EnsureKeyResult EnsureTenant EnsureTenantProvisioning EnsureTenantProvisioningInput EnsureTenantProvisioningResult ErrorBody ExportDownloadURL FiscalArchiveBucketInput FiscalArchiveWrite GetObjectWithProgress GoString HealthStatus ImportObjectWrite ImportUploadURL LegalHoldOff LegalHoldOn MultipartUploadEntry NewERPTenantMapping ObjectEntry PartListItem ProfileDataRights ProfileExports ProfileFiscalArchive ProfileImports ProfileMetadataKey ProfileSupportBundles ReadinessComponent ReadinessStatus RedactedSupportBundleWrite ResponseMetadataFunc RetentionCompliance SignURLWithResult SignedDownloadURLInput SignedDownloadURLWithResult SignedURL TotalKnown URLForKey VersionEntry WithGetObjectProgress WithGetProgress WithLegalHold WithPartNumberMarker WithUploadIDMarker WithUploadsDelimiter WithUploadsKeyMarker ``` The merged admin/consensus additions are also public Go symbols and are intentionally indexed here: ```text ConsensusChange ConsensusLifecycleInput ConsensusMember ConsensusMemberInput ConsensusReplaceInput DrainConsensusMember ExecuteConsensusRebalance GetConsensusMembership JoinConsensusMember RebalanceInput RebalancePlan RebalanceResult RebalanceSummary RemoveConsensusMember ReplaceConsensusMember VersioningDisabled ``` ## Node/TypeScript exports The default entry exports `Client`, `NativeClient`, `AdminClient`, `LockwellKit`, typed error classes and predicates, `RetryPolicy`, `TimeoutError`, checksum helpers/constants, `buildPresignedGetUrl`, `buildPresignedObjectUrl`, `urlForKey`, `createNodeFetch`, `verifyWebhook`, `WEBHOOK_SIGNATURE_HEADER_NAME`, `ErpScopes`, `StorageProfiles`, `ErpErrors`, their constants, and standalone helper functions. `/edge` exports the native/admin/kit/ERP/retry/WebCrypto subset and omits the S3 client, Node checksum/presign helpers, and Node transport. See [Node SDK](/sdks/node) for method tables and runtime ownership rules. The named constant and standalone-helper exports are: ```text ERP_ERROR_CATEGORIES ERP_ERROR_SURFACES ERP_PURPOSES ERP_RETRY_DECISIONS LEGAL_HOLD_OFF LEGAL_HOLD_ON PROFILE_METADATA_KEY RETENTION_COMPLIANCE STORAGE_PROFILES classifyAdmin classifyNative companyPrefix complianceRetention legalHoldEnabled retentionSpec withLegalHold ``` ## Java public packages - `com.lockwell.sdk`: `LockwellClient`, `LockwellAsyncClient`, `Credentials`, `ApiException`, `RetryPolicy`, `ResponseMetadata`, `Progress`, `TransferProgress`, `Checksums`, `Presign`, `SigV4Signer`, `EndpointPath`, retention/ legal-hold enums, paginator, and health result types. - `com.lockwell.sdk.nativeapi`: `LockwellNativeClient`, `NativeTypes`, `NativeException`, and JSON helpers used by the public native types. - `com.lockwell.sdk.admin`: `LockwellAdminClient`, `AdminTypes`, and `AdminException`. - `com.lockwell.sdk.kit`: `LockwellKit`, `KitTypes`, `ErpScopes`, `StorageProfiles`, and `ErpErrors`. - `com.lockwell.sdk.spring`: `LockwellProperties` and `LockwellAutoConfiguration` for S3 sync/async beans. See [Java SDK](/sdks/java) and [Java native production guide](/sdks/java-native). Public nested/result types that are easy to miss in narrative guides are: ```text CompleteChecksumResult CompleteMultipartResult CompleteResult CreateMultipartResult DeleteError DeleteMarkerEntry DeletedEntry DeletedObject Direction EnsureKeyResult ListEntry ObjectEntry ObjectLockUpdateResult ObjectWriteRecipe PartEntry RetentionMode RetentionResult RetentionSpec SignedDownloadRecipe SignedUploadRecipe SignedUrlMethod TenantMapping UploadPartResult VersionEntry ``` ## `@kelphect/sdk-native` public surface The server-only TypeScript LNW package exports `LockwellNativeClient`, `createLockwellClient`, `Credentials`, `CredentialProvider`, `TLSOptions`, `NativeClientConfig`, `RequestOptions`, `MetricsSink`, `TraceSink`, `LogSink`, `UserMetadataEntry`, `ResponseMetadata`, `ClientDiagnostics`, bucket/object/version/multipart/tag/retention/legal-hold/ CORS/notification/signed-capability request and result types, and the stable `LockwellError` subclasses `ProtocolError`, `TransportError`, `AuthenticationError`, `AuthorizationError`, `ServiceError`, `CancelledError`, `DeadlineExceededError`, `ClientClosedError`, and the redaction helper `redact`. The `/protocol` entry exports `FrameType`, `Operation`, `Capability`, `CLIENT_CAPABILITIES`, `FieldNumber`, `ErrorCode`, `DEFAULT_LIMITS`, `MAGIC`, `VERSION`, `HEADER_BYTES`, and `CRC_BYTES`; `/testing` exports codec fixtures and the injectable socket boundary. See [Native TypeScript](/sdks/bun-native) for runnable usage and package checks. ## Spring Boot Native Wire public surface The opt-in starter publishes `com.lockwell.sdk.springwire.LockwellNativeWireClient`, `LockwellNativeWireAsyncClient`, `LockwellNativeWireHealthIndicator`, `LockwellNativeWireProperties`, `NativeWireTypes`, `ResponseMetadata`, `TransferProgressListener`, and `LockwellWireException`. It is JDK 25-first, Spring Boot 4.1.1-tested, and exposes sync/virtual-thread async streaming, Object Lock, checksums, multipart, tags, CORS, webhook, and signed-capability operations. SSE-C and the reserved Admin wire surface are absent. See [Spring Boot Native Wire](/sdks/java-spring-wire). ## Deliberate absences There are no first-party .NET, Rust, PHP, or Ruby SDKs. Those languages are explicit product non-goals; do not use an experimental branch or closed proposal as a production claim. There are no public SDK methods for public buckets, anonymous reads, IAM/STS, SSE-KMS, bucket-policy editing, website hosting, Select, Lambda/Object Lambda, tiering, or arbitrary notification targets. CLI/Web UI-only operator workflows are not silently represented as SDK methods.