Merkle Tree Utility

File: src/main/lib/merkle.ts

A pure-function Merkle tree library used by the attestation system to produce tamper-evident roots and O(log n) proofs over audit events. Built on Node.js crypto (SHA-256) with no external dependencies.

Domain Separation

All hashing uses domain-separated prefixes to prevent second-preimage attacks where an inner node hash could be mistaken for a valid leaf:

• Leaf hashes: SHA-256("leaf:" + data) via computeLeafHash()
• Node hashes: SHA-256("node:" + leftHash + rightHash) via internal nodeHash()

This ensures that no inner tree node can collide with a leaf hash.

Padding (Non-Power-of-2 Leaf Counts)