@sphior/evidence (Node)

Record events from your own application as tamper-evident audit evidence. Every call is signed (HMAC-SHA256) and the platform stores only a cryptographic fingerprint of each event (hash_only) — the event body itself is never retained.

Requires Node 18+. Zero dependencies.

Install

npm install @sphior/evidence

Usage

Issue a signing key in the console (Connections → SaaS integrations → Signed ingest keys), then:

import { SphiorEvidence } from "@sphior/evidence";

const evidence = new SphiorEvidence({
  keyId: process.env.SPHIOR_KEY_ID,          // sphr_…（public）
  signingSecret: process.env.SPHIOR_SECRET,  // sphrsk_…（shown once at issue time）
});

await evidence.record(
  {
    id: "offboard-2026-08-07-taro",
    actor: "[email protected]",
    occurred_at: new Date().toISOString(),
    subject: "[email protected]",
  },
  { sourceType: "offboarding" },
);

• Batches of more than 200 events are split automatically.
• Retries only on network errors / 429 / 5xx, re-signing with a fresh nonce each attempt.
• Authentication and validation errors (401 / 422) throw SphiorEvidenceError immediately.

Test

npm test