RootHeraldKit Swift Package

dependencies: [
    // Placeholder URL — the package is not published yet (TestFlight preview).
    .package(url: "https://github.com/RootHerald/rootherald-ios.git", branch: "main")
],
targets: [
    .target(
        name: "MyApp",
        dependencies: [
            .product(name: "RootHeraldKit", package: "rootherald-ios")
        ]
    )
]

import RootHeraldKit

@MainActor
final class SignupViewModel: ObservableObject {
    // Keyless: no api_key, no endpoint — nothing to connect to.
    private let client = RootHeraldClient()

    func submit(email: String, password: String) async {
        do {
            // Call 1 (server): your backend called
            // POST /api/v1/attestations/challenge with its rh_sk_ secret.
            // It returns a challengeId + nonce; relay them to the app.
            let challenge = try await api.mintChallenge(action: "signup")

            // Collect (device, keyless): run App Attest over the nonce and get
            // back an opaque evidence blob. No verdict, no call to RootHerald.
            let evidence = try await client.collectEvidence(nonce: challenge.nonce)
            // evidence.attestationObject : String   // base64 CBOR attestation object
            // evidence.keyId             : String   // base64 App Attest key id

            // Call 2 (server): relay the challengeId + opaque blob to YOUR
            // backend, which calls rh.verify() and enforces the verdict.
            try await api.signup(
                email: email,
                password: password,
                challengeId: challenge.challengeId,
                evidence: evidence
            )
        } catch {
            showError("Evidence collection failed: \(error)")
        }
    }
}

import { RootHerald } from "@rootherald/node";

const rh = new RootHerald({ secretKey: process.env.RH_SECRET_KEY! }); // rh_sk_…

// Call 1: mint the challenge the iOS app attests over.
export async function GET() {
  const { challengeId, nonce } = await rh.issueChallenge();
  return Response.json({ challengeId, nonce });
}

// Call 2: the app posts back { challengeId, evidence }. Appraise it — the
// verdict comes back directly; iOS evidence uses the SAME verify endpoint.
export async function POST(req: Request) {
  const { challengeId, evidence, email, password } = await req.json();

  // evidence = { attestationObject, keyId } straight from RootHeraldKit.
  const verdict = await rh.verify(evidence, {
    challengeId,
    policy: "rootherald:builtin:strict-hardware-permissive-mobile",
  });

  if (verdict.device.verdict !== "pass") {
    return Response.json({ error: "device_rejected" }, { status: 403 });
  }

  // verdict.device.ueid is a stable per-app-per-device pseudonym derived from
  // the App Attest key. Use it for one-device-one-account enforcement.
  const user = await usersRepo.create({ email, password, deviceId: verdict.device.ueid });
  return Response.json({ ok: true, userId: user.id });
}