{
  "schemaVersion": "lockwell.sdk.public-api-examples.v1",
  "version": "2026-08-29",
  "inventory": "docs/sdk-capability-matrix-v1.json#publicApiInventory",
  "examples": [
    {
      "id": "native-wire.go-streaming",
      "security": "LNW/1 requires TLS 1.3 and verified host identity. Credentials are resolved for each handshake and must never be logged; the caller owns retry decisions.",
      "go": [
        "client, err := lockwellwire.New(lockwellwire.Config{Address: nativeWireAddress, Credentials: lockwellwire.Credentials{AccessKeyID: accessKeyID, SecretKey: secretKey}})",
        "object, err := client.GetObject(ctx, lockwellwire.GetObjectInput{Bucket: bucket, Key: key})",
        "defer object.Body.Close()"
      ]
    },
    {
      "id": "admin.consensus-membership",
      "security": "Requires an admin bearer token with cluster.manage. Secret is write-only bootstrap material; never log it. Use dry-run before mutation.",
      "go": [
        "members, err := admin.GetConsensusMembership(ctx)",
        "preview, err := admin.JoinConsensusMember(ctx, lockwelladmin.ConsensusMemberInput{ID: nodeID, Address: raftAddr, ListenAddr: apiAddr, Secret: bootstrapSecret, Reason: reason, Confirm: nodeID, DryRun: true})"
      ],
      "node": [
        "const members = await admin.getConsensusMembership()",
        "const preview = await admin.joinConsensusMember({ id: nodeId, address: raftAddr, listenAddr: apiAddr, secret: bootstrapSecret, reason, confirm: nodeId, dryRun: true })"
      ],
      "java": [
        "List<ConsensusMember> members = admin.getConsensusMembership();",
        "ConsensusChange preview = admin.joinConsensusMemberDryRun(new ConsensusMemberInput(nodeId, raftAddr, apiAddr, bootstrapSecret, null, null, null, null, reason, nodeId));"
      ]
    },
    {
      "id": "admin.replica-rebalance",
      "security": "Confirmation must match the selected tenant or bucket. The server fails closed on RBAC, durability, and active-replica preconditions.",
      "go": [
        "result, err := admin.ExecuteConsensusRebalance(ctx, lockwelladmin.RebalanceInput{TenantID: tenantID, Reason: reason, ConfirmTenant: tenantID})"
      ],
      "node": [
        "const result = await admin.executeConsensusRebalance({ tenantId, reason, confirmTenant: tenantId })"
      ],
      "java": [
        "RebalanceResult result = admin.executeConsensusRebalance(new RebalanceInput(tenantId, null, reason, tenantId, null));"
      ]
    },
    {
      "id": "s3.object-lock-update",
      "security": "Governance bypass is deliberately absent. Active retention and legal-hold denials remain typed errors with request IDs.",
      "go": [
        "err := s3.PutObjectRetention(ctx, bucket, key, lockwellsdk.ObjectRetention{Mode: lockwellsdk.ObjectLockCompliance, RetainUntilDate: deadline}, lockwellsdk.WithVersionID(versionID))"
      ],
      "node": [
        "await s3.putObjectRetention(bucket, key, { mode: 'COMPLIANCE', retainUntilDate: deadline }, { versionId })",
        "await s3.putObjectLegalHold(bucket, key, true, { versionId })"
      ],
      "java": [
        "s3.putObjectRetention(bucket, key, versionId, RetentionMode.COMPLIANCE, deadline);",
        "s3.putObjectLegalHold(bucket, key, versionId, LegalHoldStatus.ON);"
      ]
    },
    {
      "id": "native.streaming-progress-cancellation",
      "security": "Progress is synchronous/backpressure-preserving. Cancellation closes the source or response; one-shot streams are never transparently replayed.",
      "references": {
        "go": "pkg/lockwellnative/progress_test.go",
        "node": "sdk/node/test/progress.test.js",
        "java": "sdk/java/src/test/java/com/lockwell/sdk/ProgressTest.java"
      }
    }
  ],
  "fullExamples": [
    "examples/lockwell-sdk-go/main.go",
    "examples/go-service",
    "examples/nextjs-app-router",
    "examples/nextjs-native-wire",
    "examples/hono-edge",
    "examples/spring-boot"
  ]
}