Add embedded-ready SDK abstractions

CMakeLists.txt

@@ -6,27 +6,30 @@ set(CMAKE_C_STANDARD 99)
 include(GNUInstallDirs)
 include(CTest)
 
-find_package(CURL REQUIRED)
-
 find_package(PkgConfig REQUIRED)
 pkg_check_modules(SECP256K1 REQUIRED libsecp256k1)
 pkg_check_modules(CJSON REQUIRED IMPORTED_TARGET libcjson)
 link_directories(${SECP256K1_LIBRARY_DIRS})
 
+option(OMS_WALLET_ENABLE_CURL_TRANSPORT "Build default libcurl transport" ON)
 option(OMS_WALLET_BUILD_DEMO "Build demo target" ON)
 option(OMS_WALLET_BUILD_CLI "Build CLI target" ON)
 
+if(OMS_WALLET_ENABLE_CURL_TRANSPORT)
+    find_package(CURL REQUIRED)
+endif()
+
 # ---- Library ----
 
 set(OMS_WALLET_SDK_SOURCES
         lib/generated/waas/waas.gen.c
         lib/runtime/oms_wallet_runtime.c
         lib/wallet/oms_wallet_auth.c
+        lib/wallet/oms_wallet_auth_signer.c
         lib/wallet/oms_wallet_config.c
         lib/wallet/oms_wallet_request_signing.c
         lib/wallet/oms_wallet_ops.c
         lib/wallet/oms_wallet_shared.c
-        lib/networking/http_client.c
         lib/networking/http_client_common.c
         lib/infrastructure/is_valid_message_signature.c
         lib/indexer/get_token_balances.c
@@ -46,6 +49,12 @@ set(OMS_WALLET_SDK_SOURCES
         lib/utils/uuid.c
 )
 
+if(OMS_WALLET_ENABLE_CURL_TRANSPORT)
+    list(APPEND OMS_WALLET_SDK_SOURCES
+            lib/networking/http_client.c
+    )
+endif()
+
 if(APPLE)
     list(APPEND OMS_WALLET_SDK_SOURCES
             lib/storage/secure_storage.c
@@ -74,11 +83,19 @@ target_compile_options(oms_wallet_c_sdk PUBLIC
 )
 
 target_link_libraries(oms_wallet_c_sdk PUBLIC
-        CURL::libcurl
         PkgConfig::CJSON
         ${SECP256K1_LIBRARIES}
 )
 
+if(OMS_WALLET_ENABLE_CURL_TRANSPORT)
+    target_link_libraries(oms_wallet_c_sdk PUBLIC CURL::libcurl)
+else()
+    target_compile_definitions(oms_wallet_c_sdk PUBLIC
+            OMS_WALLET_NO_CURL_TRANSPORT
+            WAAS_NO_CURL_TRANSPORT
+    )
+endif()
+
 # macOS frameworks
 if(APPLE)
     target_link_libraries(oms_wallet_c_sdk PUBLIC
@@ -91,7 +108,7 @@ endif()
 
 set(OMS_WALLET_RUNTIME_TARGETS "")
 
-if(OMS_WALLET_BUILD_DEMO)
+if(OMS_WALLET_BUILD_DEMO AND OMS_WALLET_ENABLE_CURL_TRANSPORT)
     add_executable(oms_wallet_demo demo.c)
     target_link_libraries(oms_wallet_demo PRIVATE oms_wallet_c_sdk)
     set_target_properties(oms_wallet_demo PROPERTIES OUTPUT_NAME "oms-wallet-demo")
@@ -100,7 +117,7 @@ endif()
 
 # ---- CLI ----
 
-if(OMS_WALLET_BUILD_CLI)
+if(OMS_WALLET_BUILD_CLI AND OMS_WALLET_ENABLE_CURL_TRANSPORT)
     add_executable(oms_wallet_cli cli.c)
     target_link_libraries(oms_wallet_cli PRIVATE oms_wallet_c_sdk)
     set_target_properties(oms_wallet_cli PROPERTIES OUTPUT_NAME "oms-wallet")
@@ -146,4 +163,16 @@ if(BUILD_TESTING)
         target_link_libraries(secure_storage_test PRIVATE oms_wallet_c_sdk)
         add_test(NAME secure_storage_test COMMAND secure_storage_test)
     endif()
+
+    add_executable(auth_signer_provider_test
+            tests/auth_signer_provider_test.c)
+    target_link_libraries(auth_signer_provider_test PRIVATE oms_wallet_c_sdk)
+    add_test(NAME auth_signer_provider_test COMMAND auth_signer_provider_test)
+
+    if(UNIX)
+        add_executable(embedded_secure_auth_provider_test
+                tests/embedded_secure_auth_provider_test.c)
+        target_link_libraries(embedded_secure_auth_provider_test PRIVATE oms_wallet_c_sdk)
+        add_test(NAME embedded_secure_auth_provider_test COMMAND embedded_secure_auth_provider_test)
+    endif()
 endif()

README.md

@@ -3,9 +3,9 @@
 ## Support Matrix
 
 - macOS: supported for development and local testing, uses Keychain-backed secure storage
-- Linux: supported runtime target for normal POSIX + `libcurl` environments, uses POSIX file-backed secure storage
-- HTTP transport: `libcurl` only
-- Session model: single-session and not thread-safe
+- Linux: supported runtime target for POSIX + `libcurl` environments and for embedded integrations that provide their own transport/session/signer providers
+- HTTP transport: built-in `libcurl` transport is optional; applications can provide an SDK-wide transport callback
+- Session model: caller-owned `oms_wallet_sdk_t` context; each context owns config, session handles, transport, signer, and response limits
 
 ## Setup
 
@@ -37,50 +37,73 @@ Optional targets:
 
 ```shell
 cmake -S . -B build -DOMS_WALLET_BUILD_DEMO=OFF -DOMS_WALLET_BUILD_CLI=OFF
+cmake -S . -B build-no-curl -DOMS_WALLET_ENABLE_CURL_TRANSPORT=OFF -DOMS_WALLET_BUILD_DEMO=OFF -DOMS_WALLET_BUILD_CLI=OFF
 ```
 
 `OMS_WALLET_BUILD_DEMO` and `OMS_WALLET_BUILD_CLI` only control those runtime
 binaries. They do not disable the library or the test targets.
 
 ## Initialization
 
-Call `oms_wallet_config_init(...)` before using wallet, indexer, or API helpers.
-The SDK no longer falls back to built-in runtime URLs when config is unset.
+Allocate and initialize an `oms_wallet_sdk_t` before using wallet, indexer, or
+API helpers. The SDK no longer uses process-global mutable config.
 
 Minimal setup:
 
 ```c
 #include <wallet/oms_wallet_config.h>
 
-if (oms_wallet_config_init("YOUR_ACCESS_KEY") != 0) {
+oms_wallet_sdk_t sdk;
+if (oms_wallet_sdk_init(&sdk, "YOUR_ACCESS_KEY") != 0) {
     /* handle config initialization failure */
 }
 ```
 
 Common overrides:
 
 ```c
-oms_wallet_config_set_indexer_url_template("https://dev-{value}-indexer.sequence.app/rpc/Indexer/");
-oms_wallet_config_set_api_rpc_url("https://dev-api.sequence.app/rpc/API");
-oms_wallet_config_set_wallet_rpc_url("https://your-wallet-host/rpc/Wallet");
-oms_wallet_config_set_origin_header("Origin: http://localhost:3000");
-oms_wallet_config_set_storage_dir("/var/lib/oms-wallet-c-sdk");
+oms_wallet_config_set_indexer_url_template(&sdk, "https://dev-{value}-indexer.sequence.app/rpc/Indexer/");
+oms_wallet_config_set_api_rpc_url(&sdk, "https://dev-api.sequence.app/rpc/API");
+oms_wallet_config_set_wallet_rpc_url(&sdk, "https://your-wallet-host/rpc/Wallet");
+oms_wallet_config_set_origin_header(&sdk, "Origin: http://localhost:3000");
+oms_wallet_config_set_storage_dir(&sdk, "/var/lib/oms-wallet-c-sdk");
+oms_wallet_config_set_max_response_bytes(&sdk, 64 * 1024);
 ```
 
 The default wallet auth scope is `proj_1`. Only override it if your environment
 requires a different scope.
 
-Call `oms_wallet_config_cleanup()` when you are done with SDK-owned config state.
+Call `oms_wallet_sdk_cleanup(&sdk)` when you are done with SDK-owned state.
 
-`oms_wallet_restore_session()` returns:
+`oms_wallet_restore_session(&sdk)` returns:
 
 - `1` when a usable saved session was restored
 - `0` when no usable saved session exists yet
 - `-1` on an actual storage or restore failure
 
 ## Linux Secure Storage
 
-On Linux, secure storage uses a file-per-key backend with:
+By default, the SDK creates a local `ethereum-secp256k1` auth credential used
+to sign WaaS RPC requests. Applications that need hardware-backed credentials
+can replace this with `oms_wallet_config_set_auth_signer_provider(&sdk, ...)`. Custom
+providers own credential creation, credential identity, and request signing; the
+SDK does not require providers to export private key bytes.
+
+The SDK owns WaaS authorization canonicalization and passes canonical message
+bytes to the provider. Providers should sign those bytes as-is and return the
+signature hex string; they should not rebuild the HTTP request preimage
+independently. Tests and embedded integrations can also replace all SDK
+networking with `oms_wallet_config_set_transport(&sdk, ...)`. Wallet RPC
+requests are delivered to that transport after the SDK appends Authorization.
+Indexer and API helper requests use the same transport boundary.
+
+Session persistence can be platform-owned too:
+`oms_wallet_config_set_session_store_provider(&sdk, ...)` lets applications
+store challenge/verifier/signer-id/wallet-id state in NVRAM, TPM-sealed blobs,
+an encrypted database, or product-specific storage.
+
+On Linux, the default software provider stores its auth credential with a
+file-per-key backend using:
 
 - directory permissions: `0700`
 - file permissions: `0600`
@@ -97,13 +120,14 @@ Default storage path:
 Override the storage location with:
 
 ```c
-oms_wallet_config_set_storage_dir("/path/to/app-state");
+oms_wallet_config_set_storage_dir(&sdk, "/path/to/app-state");
 ```
 
-Persisted keys used by the SDK:
+Persisted session keys used by the SDK:
 
 - `access-key`: CLI-stored access key used to initialize SDK config
-- `seckey`: signer private key for the current session
+- `oms_auth_signer_id`: opaque auth credential signer handle
+- `seckey`: internal raw auth credential used only by the default software signer
 - `challenge`: pending email sign-in challenge
 - `verifier`: pending email sign-in verifier
 - `oms_wallet_id`: selected wallet id for follow-up wallet operations
@@ -123,6 +147,8 @@ Current test coverage:
 - `oms_wallet_request_signing_test`: validates canonical request payloads, preimages, digests, signatures, and authorization headers against checked-in vectors
 - `timestamps_test`: validates nonce monotonicity from `timestamp_next_nonce()`
 - `secure_storage_test`: Linux-only regression test for the POSIX secure-storage backend
+- `auth_signer_provider_test`: validates custom signer provider ownership and restore flow
+- `embedded_secure_auth_provider_test`: simulates an embedded secure-element signer plus SDK-owned request canonicalization over a custom transport
 
 #### Run the demo or cli