SDKs and developer tooling for the InOrbit platform.

InOrbit SDK

The iohr command line and the official client libraries for the InOrbit API in Rust, TypeScript, Go, Python, C# and Java.

The repository holds two things: the iohr command line, released as a pre-release, and six client libraries. Each library is a hand-written runtime plus an API surface that iohr sdk generate writes, cut to what your credentials may call (ADR 0011). The libraries pass the shared conformance suite, streams included (server-sent events or one /v1/ws socket, design.md section 7). Rust, TypeScript, Python and Go are on their registries. C# and Java are not on NuGet or Maven Central yet: build them from source until their registry releases (roadmap, M4b).

The versions below are read live from each registry, or from the repository's release tags where there is no registry release, so the table does not go stale between releases:

Part	Package	Latest release
Command line	iohr (APT, Homebrew, installers, GitHub releases)	, pre-release
Rust	inorbithr, Rust 1.94
TypeScript	@inorbithr/sdk, Node 22.12, Bun, Deno, browsers
Go	github.com/inorbithr/sdk/go, Go 1.26
Go, OpenTelemetry	github.com/inorbithr/sdk/go/otel, an optional module for spans and metrics
Python	inorbithr, Python 3.11
C#	InOrbit.Sdk, .NET 8	, built from source; not on NuGet yet
Java	hr.inorbit:inorbit-sdk, Java 17	, built from source; not on Maven Central yet
Dart	inorbit, Dart 3.9 and Flutter: the contract and its checker so far, the client follows	not released; not on pub.dev yet (dart/)

The contract the libraries are built against is synced from the platform into spec/, and the replay server in conformance/ runs the shared behaviour cases. docs/roadmap.md has the milestones.

The command line

# macOS and Linux, Homebrew
brew install inorbithr/tap/iohr

# Debian and Ubuntu: the repository is signed by the key with fingerprint
# 5FF6 7AF3 D50A 6B06 FFE6  EA8A FFA5 11CF 585B F28D
sudo install -d -m 0755 /etc/apt/keyrings
curl -fsSL https://packages.inorbit.hr/iohr.gpg | sudo tee /etc/apt/keyrings/iohr.gpg >/dev/null
printf 'Types: deb\nURIs: https://packages.inorbit.hr/apt\nSuites: stable\nComponents: main\nSigned-By: /etc/apt/keyrings/iohr.gpg\n' \
  | sudo tee /etc/apt/sources.list.d/iohr.sources >/dev/null
sudo apt update && sudo apt install iohr

# Any Linux or macOS, for your user only, no sudo
curl -fsSL https://packages.inorbit.hr/install.sh | sh

On Windows, install.ps1 from the same host installs it for your user. Then:

iohr login        # signs you in through your browser, or with a device code over SSH
iohr whoami
iohr api GET /v1/me

iohr keeps several accounts as profiles, creates and revokes API tokens, proves domains, connects an account's apps (iohr connectors, iohr connections: a key or a browser sign-in), installs signed extensions such as the InOrbit agent (iohr ext), checks Lab documents (iohr lab check) and keeps RFCs, PRDs and ADRs in the Decisions product (iohr decisions). It talks to api.inorbit.hr and auth.inorbit.hr, and to the extension registry only in iohr ext install, upgrade and sync (ADR 0012); there is no telemetry and no update check. Releases before 1.0 are pre-releases. Every release carries checksums, an SBOM and build provenance you can check with gh attestation verify. cli/README.md has every command.

Add a library to your project

iohr sdk add        # cargo add, npm install, pnpm/yarn/bun/deno add, uv/poetry/pdm add, pip or go get, from your project's files

The command is printed, then run by your project's own package manager (cli/README.md).

Generate a client for your account

iohr login
iohr sdk generate --lang rust --for default --out src/iohr   # or typescript, go, python, csharp, java

The generated code holds only the operations your profile's credential may call, so a call it may not make fails to compile (in TypeScript, Rust, Go, C#, Java; in Python, the type checker). Commit it with the iohr.lock beside it and run iohr sdk check in CI: it fails, with a diff, when what the credential may call changes. The guide is at docs.inorbit.hr/docs/sdk.

What every library does

• Authenticate with an API token, or exchange an API key for a short-lived token, cache it and refresh it, so you never handle the exchange yourself.
• Return typed results and one error type per language, carrying the API's error code and details; a code the library does not know yet is kept, not dropped.
• Retry what is safe to retry (429, 503, 504, connection failures), honouring Retry-After; a write is retried only when the operation is marked safe to repeat.
• Behave the same in every language: one set of conformance cases runs against all of them.

See docs/design.md for the library design.

Repository layout

Path	Contents
cli/	The iohr command line, its release scripts and packaging
spec/	The API contract, synced from the platform
conformance/	Shared behaviour cases and the replay server every SDK runs them against
rust/, typescript/, go/, python/, csharp/, java/	One runtime per language, with its generated public surface
dart/	The Dart runtime, started: the contract and the answer checker (platform RFC 0074.8)
examples/	Small programs that CI compiles
docs/	Design, decisions (ADRs), releasing, style

Security

• Report vulnerabilities privately: SECURITY.md.
• Supported versions: SUPPORT.md. Before 1.0 only the latest release gets fixes; the security support period starts with 1.0.
• Requirements, threat model, controls and how to verify releases: docs/security/.

Contributing

See CONTRIBUTING.md. Security issues: SECURITY.md.

License

Apache License 2.0.