@tryengrave/merkle

An RFC 6962 Merkle tree with tiled storage and proof generation — the cryptographic engine behind Engrave. Zero runtime dependencies. Runs in Node, Bun, Deno, Cloudflare Workers, and the browser.

npm install @tryengrave/merkle

Why

RFC 6962 is the append-only transparency-log tree that Certificate Transparency is built on. It gives you two things a plain hash chain can't:

• Inclusion proofs — prove a leaf is in a tree of size N with ~log₂(N) hashes.
• Consistency proofs — prove a later tree is an append-only extension of an earlier one, so a log can't be silently rewritten.

This implementation is specified by committed test vectors, not by its own source — the vectors are the source of truth.

Usage

import { Accumulator, inclusionProof, verifyInclusion, sha256 } from "@tryengrave/merkle"

const acc = new Accumulator()
acc.append(sha256(new TextEncoder().encode("event-1")))
acc.append(sha256(new TextEncoder().encode("event-2")))

const root = acc.root()                 // 32-byte Merkle root
const proof = inclusionProof(acc, 0)    // proof that leaf 0 is in the tree
const okAy = verifyInclusion(proof, root)

What's inside

• Accumulator — incremental root over an append-only sequence.
• inclusionProof / consistencyProof — proof generation (with tiled node sources for large trees).
• verifyInclusion / verifyConsistency — pure verification.
• sha256, leafHash, nodeHash, domain-separation tags — the exact hashing Engrave uses.

Notes

• Tree operations are synchronous (@noble/hashes) — crypto.subtle scheduling overhead dominates for 32-byte inputs.
• The incomplete right edge is handled per RFC 6962: a node with only a left child carries the left child up unchanged. Get this wrong and the tree looks correct until size isn't a power of two.

Part of Engrave — immutable audit evidence, verifiable by anyone. · How proofs work · MIT