Integrate the native collector into a game client

find_package(RootHerald REQUIRED)

add_executable(launcher
  src/main.cpp
  src/herald_gate.cpp)

target_link_libraries(launcher PRIVATE
  RootHerald::RootHerald
  YourGameCore::Core)

#include <rootherald.h>
#include <stdexcept>
#include <string>

// Collects the opaque evidence blob over a server-issued nonce. Holds no key
// and never contacts Root Herald — the caller POSTs the blob to your matchmaker,
// which appraises it server→server. Throws on a TPM / collection failure.
std::string CollectEvidenceForLaunch(const char* nonceB64)
{
    char* evidenceJson = nullptr;
    RootHeraldStatus status =
        RootHeraldClient_CollectEvidence(nonceB64, &evidenceJson);

    if (status != ROOTHERALD_OK)
    {
        throw std::runtime_error(
            std::string("rh_collect_failed: ") + RootHerald_ErrorString(status));
    }

    std::string evidence = evidenceJson;       // self-contained evidence blob
    RootHeraldClient_FreeEvidence(evidenceJson); // caller owns + frees the buffer
    return evidence;  // POST verbatim to your matchmaker -> rh.verify()
}

import { RootHerald } from "@rootherald/node";

const rh = new RootHerald({ secretKey: process.env.RH_SECRET_KEY! }); // rh_sk_…

// (a) the launcher first asks for a challenge; relay the nonce to it.
app.post("/matchmake/challenge", async (_req, res) => {
  const { challengeId, nonce } = await rh.issueChallenge();
  res.json({ challengeId, nonce });
});

// (b) the launcher posts back the opaque evidence; appraise it server→server.
app.post("/matchmake/join", async (req, res) => {
  const verdict = await rh.verify(req.body.evidence, {
    challengeId: req.body.challengeId,
    policy: "rootherald:builtin:strict-hardware",
  });
  if (verdict.device.verdict !== "pass")
    return res.status(403).json({ error: "device_rejected" });

  // verdict.device.ueid is the stable per-tenant device id. Enforce
  // one-account-per-device or check a ban list.
  if (await usersRepo.deviceBanned(verdict.device.ueid))
    return res.status(403).json({ reason: "device_banned" });

  res.json({ sessionTicket: makeSessionTicket(verdict.device.ueid) });
});

async function banCheater(accountId: string) {
  const user = await usersRepo.find(accountId);
  // user.deviceUeid was persisted from verdict.device.ueid at join time.
  await usersRepo.banDevice({
    ueid: user.deviceUeid,
    reason: `anti-cheat hit: ${user.lastCheatSignal}`,
  });
  await usersRepo.suspend(accountId);
}