wasm support!

CHANGELOG.md

···
 # Changelog
 
+## [0.5.3] - 2025-10-15
+
+### Added
+
+**Experimental WASM Support** (`jacquard-common`, `jacquard-api`, `jacquard-identity`, `jacquard-oauth`)
+- Core crates now compile for `wasm32-unknown-unknown` target
+- Traits use `trait-variant` to conditionally exclude `Send` bounds on WASM
+- Platform-specific trait method implementations for methods with `Self: Sync` bounds
+- DNS-based handle resolution remains gated behind `dns` feature (unavailable on WASM)
+- HTTPS well-known and PDS resolution work on all platforms
+
+### Fixed
+
+**OAuth client** (`jacquard-oauth`)
+- Fixed tokio runtime detection for non-WASM targets
+- Conditional compilation for tokio-specific features
+
+
+---
+
 ## [0.5.2] - 2025-10-14
 
 ### Added

Cargo.lock

···
  "cfg-if",
  "js-sys",
  "libc",
- "wasi 0.11.1+wasi-snapshot-preview1",
+ "wasi",
  "wasm-bindgen",
 ]
 
 [[package]]
 name = "getrandom"
-version = "0.3.3"
+version = "0.3.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "26145e563e54f2cadc477553f1ec5ee650b00862f0a58bcd12cbdc5f0ea2d2f4"
+checksum = "899def5c37c4fd7b2664648c28120ecec138e4d395b459e5ca34f9cce2dd77fd"
 dependencies = [
  "cfg-if",
  "js-sys",
  "libc",
  "r-efi",
- "wasi 0.14.7+wasi-0.2.4",
+ "wasip2",
  "wasm-bindgen",
 ]
 
···
  "libc",
  "percent-encoding",
  "pin-project-lite",
- "socket2 0.5.10",
+ "socket2 0.6.0",
  "system-configuration",
  "tokio",
  "tower-service",
···
 
 [[package]]
 name = "jacquard"
-version = "0.5.2"
+version = "0.5.3"
 dependencies = [
- "async-trait",
  "bon",
  "bytes",
  "clap",
+ "getrandom 0.2.16",
  "http",
  "jacquard-api 0.5.2",
  "jacquard-common 0.5.2",
- "jacquard-derive 0.5.2",
+ "jacquard-derive 0.5.3",
  "jacquard-identity 0.5.2",
  "jacquard-oauth",
  "jose-jwk",
···
  "thiserror 2.0.17",
  "tokio",
  "tracing",
+ "trait-variant",
  "url",
 ]
 
···
  "bon",
  "bytes",
  "jacquard-common 0.5.2",
- "jacquard-derive 0.5.2",
+ "jacquard-derive 0.5.3",
  "miette",
  "serde",
  "thiserror 2.0.17",
···
  "chrono",
  "jacquard",
  "jacquard-common 0.5.2",
- "jacquard-derive 0.5.2",
+ "jacquard-derive 0.5.3",
  "jacquard-identity 0.5.2",
  "k256",
  "miette",
···
 name = "jacquard-common"
 version = "0.5.2"
 dependencies = [
- "async-trait",
  "base64 0.22.1",
  "bon",
  "bytes",
  "chrono",
  "cid",
  "ed25519-dalek",
+ "getrandom 0.3.4",
  "http",
  "ipld-core",
  "k256",
···
  "thiserror 2.0.17",
  "tokio",
  "tracing",
+ "trait-variant",
  "url",
 ]
 
···
 
 [[package]]
 name = "jacquard-derive"
-version = "0.5.2"
+version = "0.5.3"
 dependencies = [
  "jacquard-common 0.5.2",
  "proc-macro2",
···
 name = "jacquard-identity"
 version = "0.5.2"
 dependencies = [
- "async-trait",
  "bon",
  "bytes",
  "hickory-resolver",
···
  "thiserror 2.0.17",
  "tokio",
  "tracing",
+ "trait-variant",
  "url",
  "urlencoding",
 ]
 
 [[package]]
 name = "jacquard-lexicon"
-version = "0.5.2"
+version = "0.5.3"
 dependencies = [
  "async-trait",
  "clap",
···
 name = "jacquard-oauth"
 version = "0.5.2"
 dependencies = [
- "async-trait",
  "base64 0.22.1",
  "bytes",
  "chrono",
···
 checksum = "78bed444cc8a2160f01cbcf811ef18cac863ad68ae8ca62092e8db51d51c761c"
 dependencies = [
  "libc",
- "wasi 0.11.1+wasi-snapshot-preview1",
+ "wasi",
  "windows-sys 0.59.0",
 ]
 
···
  "quinn-udp",
  "rustc-hash",
  "rustls",
- "socket2 0.5.10",
+ "socket2 0.6.0",
  "thiserror 2.0.17",
  "tokio",
  "tracing",
···
 checksum = "f1906b49b0c3bc04b5fe5d86a77925ae6524a19b816ae38ce1e426255f1d8a31"
 dependencies = [
  "bytes",
- "getrandom 0.3.3",
+ "getrandom 0.3.4",
  "lru-slab",
  "rand 0.9.2",
  "ring",
···
  "cfg_aliases",
  "libc",
  "once_cell",
- "socket2 0.5.10",
+ "socket2 0.6.0",
  "tracing",
  "windows-sys 0.60.2",
 ]
···
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "99d9a13982dcf210057a8a78572b2217b667c3beacbf3a0d8b454f6f82837d38"
 dependencies = [
- "getrandom 0.3.3",
+ "getrandom 0.3.4",
 ]
 
 [[package]]
···
 checksum = "2d31c77bdf42a745371d260a26ca7163f1e0924b64afa0b688e61b5a9fa02f16"
 dependencies = [
  "fastrand",
- "getrandom 0.3.3",
+ "getrandom 0.3.4",
  "once_cell",
  "rustix",
  "windows-sys 0.60.2",
···
 checksum = "ccf3ec651a847eb01de73ccad15eb7d99f80485de043efb2f370cd654f4ea44b"
 
 [[package]]
-name = "wasi"
-version = "0.14.7+wasi-0.2.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "883478de20367e224c0090af9cf5f9fa85bed63a95c1abf3afc5c083ebc06e8c"
-dependencies = [
- "wasip2",
-]
-
-[[package]]
 name = "wasip2"
 version = "1.0.1+wasi-0.2.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22"
 dependencies = [
- "windows-sys 0.48.0",
+ "windows-sys 0.60.2",
 ]
 
 [[package]]

Cargo.toml

···
 
 [workspace.package]
 edition = "2024"
-version = "0.5.2"
+version = "0.5.3"
 authors = ["Orual <[e-mail]>"]
 repository = "https://tangled.org/@nonbinary.computer/jacquard"
 keywords = ["atproto", "at", "bluesky", "api", "client"]
···
 reqwest = { version = "0.12", default-features = false }
 
 # Async and runtimes
-async-trait = "0.1"
-tokio = "1"
+tokio = { version = "1", default-features = false }
 
 # Observability
 tracing = "0.1"

README.md

···
 
 Highlights:
 
+- experimental WASM support
 - better value type deserialization helpers
 - service auth implementation
 - XrpcRequest derive Macros
 - more builders in generated api to make constructing things easier (lmk if compile time is awful)
 - `AgentSessionExt` trait with a host of convenience methods for working with records and preferences
 - Improvements to the `Collection` trait, code generation, and addition of the `VecUpdate` trait to enable that
-- A bunch of examples, both in the docs and in the repository
-- More lexicons in the generated API bindings.
 
 ## Development
 
-This repo uses [Flakes](https://nixos.asia/en/flakes) from the get-go.
+This repo uses [Flakes](https://nixos.asia/en/flakes)
 
 ```bash
 # Dev shell
···
 ```
 
 There's also a [`justfile`](https://just.systems/) for Makefile-esque commands to be run inside of the devShell, and you can generally `cargo ...` or `just ...` whatever just fine if you don't want to use Nix and have the prerequisites installed.
+
+
+## Experimental WASM Support
+
+Core crates (`jacquard-common`, `jacquard-api`, `jacquard-identity`, `jacquard-oauth`) compile for `wasm32-unknown-unknown`. Traits use [`trait-variant`](https://docs.rs/trait-variant) to conditionally exclude `Send` bounds on WASM targets. DNS-based handle resolution is gated behind the `dns` feature and unavailable on WASM (HTTPS well-known and PDS resolution still work).
+
+Test WASM compilation:
+```bash
+just check-wasm
+# or: cargo build --target wasm32-unknown-unknown -p jacquard-common --no-default-features
+```
 
 [![License](https://img.shields.io/crates/l/jacquard.svg)](./LICENSE)

crates/jacquard-common/Cargo.toml

···
 
 
 [dependencies]
+trait-variant.workspace = true
 bon.workspace = true
 base64.workspace = true
 bytes.workspace = true
···
 thiserror.workspace = true
 url.workspace = true
 http.workspace = true
-async-trait.workspace = true
-tokio = { workspace = true, features = ["sync"] }
-reqwest = { workspace = true, optional = true, features = ["charset", "http2", "json", "system-proxy", "gzip", "rustls-tls"] }
+
+reqwest = { workspace = true, optional = true, features = ["charset", "gzip"] }
 serde_ipld_dagcbor.workspace = true
 signature = { version = "2", optional = true }
 tracing = { workspace = true, optional = true }
+tokio = { workspace = true, default-features = false, features = ["sync"] }
+
+[target.'cfg(target_family = "wasm")'.dependencies]
+getrandom = { version = "0.3.4", features = ["wasm_js"] }
+
+[target.'cfg(not(target_arch = "wasm32"))'.dependencies]
+reqwest = { workspace = true, optional = true, features = ["http2", "system-proxy", "rustls-tls"] }
 
 [features]
 default = ["service-auth", "reqwest-client", "crypto"]

crates/jacquard-common/src/error.rs

···
 
 #[cfg(feature = "reqwest-client")]
 impl From<reqwest::Error> for TransportError {
+    #[cfg(not(target_arch = "wasm32"))]
     fn from(e: reqwest::Error) -> Self {
         if e.is_timeout() {
             Self::Timeout
         } else if e.is_connect() {
             Self::Connect(e.to_string())
+        } else if e.is_builder() || e.is_request() {
+            Self::InvalidRequest(e.to_string())
+        } else {
+            Self::Other(Box::new(e))
+        }
+    }
+    #[cfg(target_arch = "wasm32")]
+    fn from(e: reqwest::Error) -> Self {
+        if e.is_timeout() {
+            Self::Timeout
         } else if e.is_builder() || e.is_request() {
             Self::InvalidRequest(e.to_string())
         } else {

crates/jacquard-common/src/http_client.rs

···
 use std::sync::Arc;
 
 /// HTTP client trait for sending raw HTTP requests.
+#[cfg_attr(not(target_arch = "wasm32"), trait_variant::make(Send))]
 pub trait HttpClient {
     /// Error type returned by the HTTP client
     type Error: std::error::Error + Display + Send + Sync + 'static;
+
     /// Send an HTTP request and return the response.
     fn send_http(
         &self,
         request: http::Request<Vec<u8>>,
-    ) -> impl Future<Output = core::result::Result<http::Response<Vec<u8>>, Self::Error>> + Send;
+    ) -> impl Future<Output = core::result::Result<http::Response<Vec<u8>>, Self::Error>>;
 }
 
 #[cfg(feature = "reqwest-client")]
···
     }
 }
 
-impl<T: HttpClient> HttpClient for Arc<T> {
+#[cfg(not(target_arch = "wasm32"))]
+impl<T: HttpClient + Sync> HttpClient for Arc<T> {
     type Error = T::Error;
 
     fn send_http(
···
         self.as_ref().send_http(request)
     }
 }
+
+#[cfg(target_arch = "wasm32")]
+impl<T: HttpClient> HttpClient for Arc<T> {
+    type Error = T::Error;
+
+    fn send_http(
+        &self,
+        request: http::Request<Vec<u8>>,
+    ) -> impl Future<Output = core::result::Result<http::Response<Vec<u8>>, Self::Error>> {
+        self.as_ref().send_http(request)
+    }
+}

crates/jacquard-common/src/session.rs

···
 //! Generic session storage traits and utilities.
 
-use async_trait::async_trait;
 use miette::Diagnostic;
 use serde::Serialize;
 use serde::de::DeserializeOwned;
···
 use std::collections::HashMap;
 use std::error::Error as StdError;
 use std::fmt::Display;
+use std::future::Future;
 use std::hash::Hash;
 use std::path::{Path, PathBuf};
 use std::sync::Arc;
···
 }
 
 /// Pluggable storage for arbitrary session records.
-#[async_trait]
+#[cfg_attr(not(target_arch = "wasm32"), trait_variant::make(Send))]
 pub trait SessionStore<K, T>: Send + Sync
 where
     K: Eq + Hash,
     T: Clone,
 {
     /// Get the current session if present.
-    async fn get(&self, key: &K) -> Option<T>;
+    fn get(&self, key: &K) -> impl Future<Output = Option<T>>;
     /// Persist the given session.
-    async fn set(&self, key: K, session: T) -> Result<(), SessionStoreError>;
+    fn set(&self, key: K, session: T) -> impl Future<Output = Result<(), SessionStoreError>>;
     /// Delete the given session.
-    async fn del(&self, key: &K) -> Result<(), SessionStoreError>;
+    fn del(&self, key: &K) -> impl Future<Output = Result<(), SessionStoreError>>;
 }
 
 /// In-memory session store suitable for short-lived sessions and tests.
···
     }
 }
 
-#[async_trait]
 impl<K, T> SessionStore<K, T> for MemorySessionStore<K, T>
 where
     K: Eq + Hash + Send + Sync,
···
     }
 }
 
-#[async_trait::async_trait]
 impl<
     K: Eq + Hash + Display + Send + Sync + 'static,
     T: Clone + Serialize + DeserializeOwned + Send + Sync + 'static,

crates/jacquard-common/src/types/tid.rs

···
     }
 
     /// Construct a TID from a timestamp (in microseconds) and clock ID
-    pub fn from_time(timestamp: usize, clkid: u32) -> Self {
+    pub fn from_time(timestamp: u64, clkid: u32) -> Self {
         let str = smol_str::format_smolstr!(
             "{0}{1:2>2}",
             s32_encode(timestamp as u64),
···
     }
 
     /// Extract the timestamp component (microseconds since UNIX epoch)
-    pub fn timestamp(&self) -> usize {
+    pub fn timestamp(&self) -> u64 {
         s32decode(self.0[0..11].to_owned())
     }
 
···
 }
 
 /// Decode a base32-sortable string into a usize
-pub fn s32decode(s: String) -> usize {
+pub fn s32decode(s: String) -> u64 {
     let mut i: usize = 0;
     for c in s.chars() {
         i = i * 32 + S32_CHAR.chars().position(|x| x == c).unwrap();
     }
-    i
+    i as u64
 }
 
 impl FromStr for Tid {
···
 /// Based on adenosine/adenosine/src/identifiers.rs
 /// TODO: clean up and normalize stuff between this and the stuff pulled from atrium
 pub struct Ticker {
-    last_timestamp: usize,
+    last_timestamp: u64,
     clock_id: u32,
 }
 
···
         let now = SystemTime::now()
             .duration_since(SystemTime::UNIX_EPOCH)
             .expect("timestamp in micros since UNIX epoch")
-            .as_micros() as usize;
+            .as_micros() as u64;
         // mask to 53 bits
         let now = now & 0x001FFFFFFFFFFFFF;
         if now > self.last_timestamp {

crates/jacquard-common/src/xrpc.rs

···
 impl<T: HttpClient> XrpcExt for T {}
 
 /// Stateful XRPC call trait
+#[cfg_attr(not(target_arch = "wasm32"), trait_variant::make(Send))]
 pub trait XrpcClient: HttpClient {
     /// Get the base URI for the client.
     fn base_uri(&self) -> Url;
···
     fn opts(&self) -> impl Future<Output = CallOptions<'_>> {
         async { CallOptions::default() }
     }
+
     /// Send an XRPC request and parse the response
+    #[cfg(not(target_arch = "wasm32"))]
     fn send<R>(
         &self,
         request: R,
-    ) -> impl Future<Output = XrpcResult<Response<<R as XrpcRequest>::Response>>> + Send
+    ) -> impl Future<Output = XrpcResult<Response<<R as XrpcRequest>::Response>>>
+    where
+        R: XrpcRequest + Send + Sync,
+        <R as XrpcRequest>::Response: Send + Sync,
+        Self: Sync;
+
+    /// Send an XRPC request and parse the response
+    #[cfg(target_arch = "wasm32")]
+    fn send<R>(
+        &self,
+        request: R,
+    ) -> impl Future<Output = XrpcResult<Response<<R as XrpcRequest>::Response>>>
     where
         R: XrpcRequest + Send + Sync,
         <R as XrpcRequest>::Response: Send + Sync;
···
     #[cfg_attr(feature = "tracing", tracing::instrument(level = "debug", skip(self, request), fields(nsid = R::NSID)))]
     pub async fn send<R>(self, request: &R) -> XrpcResult<Response<<R as XrpcRequest>::Response>>
     where
-        R: XrpcRequest + Send + Sync,
+        R: XrpcRequest,
         <R as XrpcRequest>::Response: Send + Sync,
     {
         let http_request = build_http_request(&self.base, request, &self.opts)

crates/jacquard-identity/Cargo.toml

···
 tracing = ["dep:tracing"]
 
 [dependencies]
-async-trait.workspace = true
+trait-variant.workspace = true
 bon.workspace = true
 bytes.workspace = true
 jacquard-common = { version = "0.5", path = "../jacquard-common", features = ["reqwest-client"] }
···
 percent-encoding.workspace = true
 reqwest.workspace = true
 url.workspace = true
-tokio = { workspace = true, features = ["macros", "rt-multi-thread", "fs"] }
-hickory-resolver = { optional = true, version = "0.24", default-features = false, features = ["system-config", "tokio-runtime"]}
 serde.workspace = true
 serde_json.workspace = true
 thiserror.workspace = true
···
 serde_html_form.workspace = true
 urlencoding.workspace = true
 tracing = { workspace = true, optional = true }
+
+
+[target.'cfg(not(target_family = "wasm"))'.dependencies]
+hickory-resolver = { optional = true, version = "0.24", default-features = false, features = ["system-config", "tokio-runtime"]}
+tokio = { workspace = true, features = ["macros", "rt-multi-thread"] }

crates/jacquard-identity/src/lib.rs

···
 //! Both support `.parse()` for borrowing and validation.
 
 // use crate::CowStr; // not currently needed directly here
+
+#![cfg_attr(target_arch = "wasm32", allow(unused))]
 pub mod resolver;
 
 use crate::resolver::{
···
 use jacquard_common::{IntoStatic, types::string::Handle};
 use percent_encoding::percent_decode_str;
 use reqwest::StatusCode;
-use std::sync::Arc;
 use url::{ParseError, Url};
 
-#[cfg(feature = "dns")]
-use hickory_resolver::{TokioAsyncResolver, config::ResolverConfig};
+#[cfg(all(feature = "dns", not(target_family = "wasm")))]
+use {hickory_resolver::{TokioAsyncResolver, config::ResolverConfig}, std::sync::Arc};
 
 /// Default resolver implementation with configurable fallback order.
 #[derive(Clone)]

crates/jacquard-identity/src/resolver.rs

···
 //!
 //! Parsing returns a `DidDocResponse` so callers can borrow from the response buffer
 //! and optionally validate the document `id` against the requested DID.
-
-use std::collections::BTreeMap;
-use std::marker::Sync;
-use std::str::FromStr;
-
+#![cfg_attr(target_arch = "wasm32", allow(unused))]
 use bon::Builder;
 use bytes::Bytes;
 use http::StatusCode;
···
 use jacquard_common::types::value::{AtDataError, Data};
 use jacquard_common::{CowStr, IntoStatic};
 use miette::Diagnostic;
+use std::collections::BTreeMap;
+use std::marker::Sync;
+use std::str::FromStr;
 use thiserror::Error;
 use url::Url;
 
···
     #[diagnostic(code(jacquard_identity::url))]
     Url(#[from] url::ParseError),
     #[error("DNS error: {0}")]
-    #[cfg(feature = "dns")]
+    #[cfg(all(feature = "dns", not(target_family = "wasm")))]
     #[diagnostic(code(jacquard_identity::dns))]
     Dns(#[from] hickory_resolver::error::ResolveError),
     #[error("serialize/deserialize error: {0}")]
···
     fn default() -> Self {
         // By default, prefer DNS then HTTPS for handles, then PDS fallback
         // For DID documents, prefer method-native sources, then PDS fallback
+        let mut handle_order = vec![];
+        #[cfg(not(target_family = "wasm"))]
+        handle_order.push(HandleStep::DnsTxt);
+        handle_order.push(HandleStep::HttpsWellKnown);
+        handle_order.push(HandleStep::PdsResolveHandle);
+
         Self::new()
             .plc_source(PlcSource::default())
-            .handle_order(vec![
-                HandleStep::DnsTxt,
-                HandleStep::HttpsWellKnown,
-                HandleStep::PdsResolveHandle,
-            ])
+            .handle_order(handle_order)
             .did_order(vec![
                 DidStep::DidWebHttps,
                 DidStep::PlcHttp,
···
 /// - Slingshot `resolveHandle` (unauthenticated) when configured as the PLC source
 /// - PDS fallbacks via helpers that use stateless XRPC on top of reqwest
 
+#[cfg_attr(not(target_arch = "wasm32"), trait_variant::make(Send))]
 pub trait IdentityResolver {
     /// Access options for validation decisions in default methods
     fn options(&self) -> &ResolverOptions;
 
     /// Resolve handle
+    #[cfg(not(target_arch = "wasm32"))]
     fn resolve_handle(
         &self,
         handle: &Handle<'_>,
-    ) -> impl Future<Output = Result<Did<'static>, IdentityError>> + Send
+    ) -> impl Future<Output = Result<Did<'static>, IdentityError>>
     where
         Self: Sync;
 
+    /// Resolve handle
+    #[cfg(target_arch = "wasm32")]
+    fn resolve_handle(
+        &self,
+        handle: &Handle<'_>,
+    ) -> impl Future<Output = Result<Did<'static>, IdentityError>>;
+
     /// Resolve DID document
+    #[cfg(not(target_arch = "wasm32"))]
     fn resolve_did_doc(
         &self,
         did: &Did<'_>,
-    ) -> impl Future<Output = Result<DidDocResponse, IdentityError>> + Send
+    ) -> impl Future<Output = Result<DidDocResponse, IdentityError>>
     where
         Self: Sync;
+
+    /// Resolve DID document
+    #[cfg(target_arch = "wasm32")]
+    fn resolve_did_doc(
+        &self,
+        did: &Did<'_>,
+    ) -> impl Future<Output = Result<DidDocResponse, IdentityError>>;
 
     /// Resolve DID doc from an identifier
+    #[cfg(not(target_arch = "wasm32"))]
     fn resolve_ident(
         &self,
         actor: &AtIdentifier<'_>,
-    ) -> impl Future<Output = Result<DidDocResponse, IdentityError>> + Send
+    ) -> impl Future<Output = Result<DidDocResponse, IdentityError>>
     where
         Self: Sync,
     {
···
     }
 
     /// Resolve DID doc from an identifier
+    #[cfg(target_arch = "wasm32")]
+    fn resolve_ident(
+        &self,
+        actor: &AtIdentifier<'_>,
+    ) -> impl Future<Output = Result<DidDocResponse, IdentityError>> {
+        async move {
+            match actor {
+                AtIdentifier::Did(did) => self.resolve_did_doc(&did).await,
+                AtIdentifier::Handle(handle) => {
+                    let did = self.resolve_handle(&handle).await?;
+                    self.resolve_did_doc(&did).await
+                }
+            }
+        }
+    }
+
+    /// Resolve DID doc from an identifier
+    #[cfg(not(target_arch = "wasm32"))]
     fn resolve_ident_owned(
         &self,
         actor: &AtIdentifier<'_>,
-    ) -> impl Future<Output = Result<DidDocument<'static>, IdentityError>> + Send
+    ) -> impl Future<Output = Result<DidDocument<'static>, IdentityError>>
     where
         Self: Sync,
     {
···
         }
     }
 
+    /// Resolve DID doc from an identifier
+    #[cfg(target_arch = "wasm32")]
+    fn resolve_ident_owned(
+        &self,
+        actor: &AtIdentifier<'_>,
+    ) -> impl Future<Output = Result<DidDocument<'static>, IdentityError>> {
+        async move {
+            match actor {
+                AtIdentifier::Did(did) => self.resolve_did_doc_owned(&did).await,
+                AtIdentifier::Handle(handle) => {
+                    let did = self.resolve_handle(&handle).await?;
+                    self.resolve_did_doc_owned(&did).await
+                }
+            }
+        }
+    }
+
     /// Resolve the DID document and return an owned version
+    #[cfg(not(target_arch = "wasm32"))]
     fn resolve_did_doc_owned(
         &self,
         did: &Did<'_>,
-    ) -> impl Future<Output = Result<DidDocument<'static>, IdentityError>> + Send
+    ) -> impl Future<Output = Result<DidDocument<'static>, IdentityError>>
     where
         Self: Sync,
     {
         async { self.resolve_did_doc(did).await?.into_owned() }
     }
+
+    /// Resolve the DID document and return an owned version
+    #[cfg(target_arch = "wasm32")]
+    fn resolve_did_doc_owned(
+        &self,
+        did: &Did<'_>,
+    ) -> impl Future<Output = Result<DidDocument<'static>, IdentityError>> {
+        async { self.resolve_did_doc(did).await?.into_owned() }
+    }
+
     /// Return the PDS url for a DID
-    fn pds_for_did(&self, did: &Did<'_>) -> impl Future<Output = Result<Url, IdentityError>> + Send
+    #[cfg(not(target_arch = "wasm32"))]
+    fn pds_for_did(&self, did: &Did<'_>) -> impl Future<Output = Result<Url, IdentityError>>
     where
         Self: Sync,
     {
···
             doc.pds_endpoint().ok_or(IdentityError::MissingPdsEndpoint)
         }
     }
+
+    /// Return the PDS url for a DID
+    #[cfg(target_arch = "wasm32")]
+    fn pds_for_did(&self, did: &Did<'_>) -> impl Future<Output = Result<Url, IdentityError>> {
+        async {
+            let resp = self.resolve_did_doc(did).await?;
+            let doc = resp.parse()?;
+            // Default-on doc id equality check
+            if self.options().validate_doc_id {
+                if doc.id.as_str() != did.as_str() {
+                    return Err(IdentityError::DocIdMismatch {
+                        expected: did.clone().into_static(),
+                        doc: doc.clone().into_static(),
+                    });
+                }
+            }
+            doc.pds_endpoint().ok_or(IdentityError::MissingPdsEndpoint)
+        }
+    }
+
     /// Return the DIS and PDS url for a handle
+    #[cfg(not(target_arch = "wasm32"))]
     fn pds_for_handle(
         &self,
         handle: &Handle<'_>,
-    ) -> impl Future<Output = Result<(Did<'static>, Url), IdentityError>> + Send
+    ) -> impl Future<Output = Result<(Did<'static>, Url), IdentityError>>
     where
         Self: Sync,
     {
···
             Ok((did, pds))
         }
     }
+
+    /// Return the DIS and PDS url for a handle
+    #[cfg(target_arch = "wasm32")]
+    fn pds_for_handle(
+        &self,
+        handle: &Handle<'_>,
+    ) -> impl Future<Output = Result<(Did<'static>, Url), IdentityError>> {
+        async {
+            let did = self.resolve_handle(handle).await?;
+            let pds = self.pds_for_did(&did).await?;
+            Ok((did, pds))
+        }
+    }
 }
 
+#[cfg(not(target_arch = "wasm32"))]
 impl<T: IdentityResolver + Sync> IdentityResolver for std::sync::Arc<T> {
+    fn options(&self) -> &ResolverOptions {
+        self.as_ref().options()
+    }
+
+    /// Resolve handle
+    async fn resolve_handle(&self, handle: &Handle<'_>) -> Result<Did<'static>, IdentityError> {
+        self.as_ref().resolve_handle(handle).await
+    }
+
+    /// Resolve DID document
+    async fn resolve_did_doc(&self, did: &Did<'_>) -> Result<DidDocResponse, IdentityError> {
+        self.as_ref().resolve_did_doc(did).await
+    }
+}
+
+#[cfg(target_arch = "wasm32")]
+impl<T: IdentityResolver> IdentityResolver for std::sync::Arc<T> {
     fn options(&self) -> &ResolverOptions {
         self.as_ref().options()
     }

crates/jacquard-lexicon/src/fetch/sources.rs

···
 pub use slices::SlicesSource;
 
 use crate::lexicon::LexiconDoc;
-use async_trait::async_trait;
 use miette::{IntoDiagnostic, Result};
 use std::collections::HashMap;
+use std::future::Future;
 
 #[derive(Debug, Clone)]
 pub struct Source {
···
     Slices(SlicesSource),
 }
 
-#[async_trait]
 pub trait LexiconSource {
-    fn fetch(&self) -> impl Future<Output = Result<HashMap<String, LexiconDoc<'_>>>>;
+    fn fetch(&self) -> impl Future<Output = Result<HashMap<String, LexiconDoc<'_>>>> + Send;
 }
 
 impl LexiconSource for SourceType {

crates/jacquard-oauth/Cargo.toml

···
 http.workspace = true
 bytes.workspace = true
 rand = { version = "0.8.5", features = ["small_rng"] }
-async-trait.workspace = true
 dashmap = "6.1.0"
-tokio = { workspace = true, features = ["sync", "net", "time"] }
+tokio = { workspace = true, default-features = false, features = ["sync"] }
 reqwest.workspace = true
 trait-variant.workspace = true
 webbrowser = { version = "0.8", optional = true }
-rouille  = { version =  "3.6.2", optional = true }
 tracing = { workspace = true, optional = true }
+
+[target.'cfg(not(target_arch = "wasm32"))'.dependencies]
+tokio = { workspace = true, features = ["rt", "net", "time"] }
+rouille = { version = "3.6.2", optional = true }
 
 [features]
 default = []

crates/jacquard-oauth/src/authstore.rs

···
+use std::future::Future;
 use std::sync::Arc;
 
 use dashmap::DashMap;
···
 
 use crate::session::{AuthRequestData, ClientSessionData};
 
-#[async_trait::async_trait]
+#[cfg_attr(not(target_arch = "wasm32"), trait_variant::make(Send))]
 pub trait ClientAuthStore {
-    async fn get_session(
+    fn get_session(
         &self,
         did: &Did<'_>,
         session_id: &str,
-    ) -> Result<Option<ClientSessionData<'_>>, SessionStoreError>;
+    ) -> impl Future<Output = Result<Option<ClientSessionData<'_>>, SessionStoreError>>;
 
-    async fn upsert_session(&self, session: ClientSessionData<'_>)
-    -> Result<(), SessionStoreError>;
+    fn upsert_session(&self, session: ClientSessionData<'_>)
+    -> impl Future<Output = Result<(), SessionStoreError>>;
 
-    async fn delete_session(
+    fn delete_session(
         &self,
         did: &Did<'_>,
         session_id: &str,
-    ) -> Result<(), SessionStoreError>;
+    ) -> impl Future<Output = Result<(), SessionStoreError>>;
 
-    async fn get_auth_req_info(
+    fn get_auth_req_info(
         &self,
         state: &str,
-    ) -> Result<Option<AuthRequestData<'_>>, SessionStoreError>;
+    ) -> impl Future<Output = Result<Option<AuthRequestData<'_>>, SessionStoreError>>;
 
-    async fn save_auth_req_info(
+    fn save_auth_req_info(
         &self,
         auth_req_info: &AuthRequestData<'_>,
-    ) -> Result<(), SessionStoreError>;
+    ) -> impl Future<Output = Result<(), SessionStoreError>>;
 
-    async fn delete_auth_req_info(&self, state: &str) -> Result<(), SessionStoreError>;
+    fn delete_auth_req_info(&self, state: &str) -> impl Future<Output = Result<(), SessionStoreError>>;
 }
 
 pub struct MemoryAuthStore {
···
     }
 }
 
-#[async_trait::async_trait]
 impl ClientAuthStore for MemoryAuthStore {
     async fn get_session(
         &self,
···
     }
 }
 
-#[async_trait::async_trait]
 impl<T: ClientAuthStore + Send + Sync>
     SessionStore<(Did<'static>, SmolStr), ClientSessionData<'static>> for Arc<T>
 {

crates/jacquard-oauth/src/client.rs

···
 {
     fn base_uri(&self) -> Url {
         // base_uri is a synchronous trait method; we must avoid async `.read().await`.
-        // Use `block_in_place` under Tokio to perform a blocking RwLock read safely.
+        // Use `block_in_place` under Tokio runtime to perform a blocking RwLock read safely.
+        #[cfg(not(target_arch = "wasm32"))]
         if tokio::runtime::Handle::try_current().is_ok() {
-            tokio::task::block_in_place(|| self.data.blocking_read().host_url.clone())
-        } else {
-            self.data.blocking_read().host_url.clone()
+            return tokio::task::block_in_place(|| self.data.blocking_read().host_url.clone());
         }
+
+        self.data.blocking_read().host_url.clone()
     }
 
     async fn opts(&self) -> CallOptions<'_> {
         self.options.read().await.clone()
     }
 
-    async fn send<R>(
-        &self,
-        request: R,
-    ) -> XrpcResult<Response<<R as XrpcRequest>::Response>>
+    async fn send<R>(&self, request: R) -> XrpcResult<Response<<R as XrpcRequest>::Response>>
     where
         R: XrpcRequest,
     {

crates/jacquard-oauth/src/dpop.rs

···
 
 type Result<T> = core::result::Result<T, Error>;
 
-#[async_trait::async_trait]
+#[cfg_attr(not(target_arch = "wasm32"), trait_variant::make(Send))]
 pub trait DpopClient: HttpClient {
-    async fn dpop_server(&self, request: Request<Vec<u8>>) -> Result<Response<Vec<u8>>>;
-    async fn dpop_client(&self, request: Request<Vec<u8>>) -> Result<Response<Vec<u8>>>;
-    async fn wrap_request(&self, request: Request<Vec<u8>>) -> Result<Response<Vec<u8>>>;
+    fn dpop_server(&self, request: Request<Vec<u8>>) -> impl std::future::Future<Output = Result<Response<Vec<u8>>>>;
+    fn dpop_client(&self, request: Request<Vec<u8>>) -> impl std::future::Future<Output = Result<Response<Vec<u8>>>>;
+    fn wrap_request(&self, request: Request<Vec<u8>>) -> impl std::future::Future<Output = Result<Response<Vec<u8>>>>;
 }
 
 pub trait DpopExt: HttpClient {

crates/jacquard-oauth/src/resolver.rs

···
     Uri(#[from] url::ParseError),
 }
 
+#[cfg(not(target_arch = "wasm32"))]
+async fn verify_issuer_impl<T: OAuthResolver + Sync + ?Sized>(
+    resolver: &T,
+    server_metadata: &OAuthAuthorizationServerMetadata<'_>,
+    sub: &Did<'_>,
+) -> Result<Url, ResolverError> {
+    let (metadata, identity) = resolver.resolve_from_identity(sub.as_str()).await?;
+    if !issuer_equivalent(&metadata.issuer, &server_metadata.issuer) {
+        return Err(ResolverError::AuthorizationServerMetadata(
+            "issuer mismatch".to_string(),
+        ));
+    }
+    Ok(identity
+        .pds_endpoint()
+        .ok_or(ResolverError::DidDocument(format!("{:?}", identity).into()))?)
+}
+
+#[cfg(target_arch = "wasm32")]
+async fn verify_issuer_impl<T: OAuthResolver + ?Sized>(
+    resolver: &T,
+    server_metadata: &OAuthAuthorizationServerMetadata<'_>,
+    sub: &Did<'_>,
+) -> Result<Url, ResolverError> {
+    let (metadata, identity) = resolver.resolve_from_identity(sub.as_str()).await?;
+    if !issuer_equivalent(&metadata.issuer, &server_metadata.issuer) {
+        return Err(ResolverError::AuthorizationServerMetadata(
+            "issuer mismatch".to_string(),
+        ));
+    }
+    Ok(identity
+        .pds_endpoint()
+        .ok_or(ResolverError::DidDocument(format!("{:?}", identity).into()))?)
+}
+
+#[cfg(not(target_arch = "wasm32"))]
+async fn resolve_oauth_impl<T: OAuthResolver + Sync + ?Sized>(
+    resolver: &T,
+    input: &str,
+) -> Result<
+    (
+        OAuthAuthorizationServerMetadata<'static>,
+        Option<DidDocument<'static>>,
+    ),
+    ResolverError,
+> {
+    // Allow using an entryway, or PDS url, directly as login input (e.g.
+    // when the user forgot their handle, or when the handle does not
+    // resolve to a DID)
+    Ok(if input.starts_with("https://") {
+        let url = Url::parse(input).map_err(|_| ResolverError::NotFound)?;
+        (resolver.resolve_from_service(&url).await?, None)
+    } else {
+        let (metadata, identity) = resolver.resolve_from_identity(input).await?;
+        (metadata, Some(identity))
+    })
+}
+
+#[cfg(target_arch = "wasm32")]
+async fn resolve_oauth_impl<T: OAuthResolver + ?Sized>(
+    resolver: &T,
+    input: &str,
+) -> Result<
+    (
+        OAuthAuthorizationServerMetadata<'static>,
+        Option<DidDocument<'static>>,
+    ),
+    ResolverError,
+> {
+    // Allow using an entryway, or PDS url, directly as login input (e.g.
+    // when the user forgot their handle, or when the handle does not
+    // resolve to a DID)
+    Ok(if input.starts_with("https://") {
+        let url = Url::parse(input).map_err(|_| ResolverError::NotFound)?;
+        (resolver.resolve_from_service(&url).await?, None)
+    } else {
+        let (metadata, identity) = resolver.resolve_from_identity(input).await?;
+        (metadata, Some(identity))
+    })
+}
+
+#[cfg(not(target_arch = "wasm32"))]
+async fn resolve_from_service_impl<T: OAuthResolver + Sync + ?Sized>(
+    resolver: &T,
+    input: &Url,
+) -> Result<OAuthAuthorizationServerMetadata<'static>, ResolverError> {
+    // Assume first that input is a PDS URL (as required by ATPROTO)
+    if let Ok(metadata) = resolver.get_resource_server_metadata(input).await {
+        return Ok(metadata);
+    }
+    // Fallback to trying to fetch as an issuer (Entryway)
+    resolver.get_authorization_server_metadata(input).await
+}
+
+#[cfg(target_arch = "wasm32")]
+async fn resolve_from_service_impl<T: OAuthResolver + ?Sized>(
+    resolver: &T,
+    input: &Url,
+) -> Result<OAuthAuthorizationServerMetadata<'static>, ResolverError> {
+    // Assume first that input is a PDS URL (as required by ATPROTO)
+    if let Ok(metadata) = resolver.get_resource_server_metadata(input).await {
+        return Ok(metadata);
+    }
+    // Fallback to trying to fetch as an issuer (Entryway)
+    resolver.get_authorization_server_metadata(input).await
+}
+
+#[cfg(not(target_arch = "wasm32"))]
+async fn resolve_from_identity_impl<T: OAuthResolver + Sync + ?Sized>(
+    resolver: &T,
+    input: &str,
+) -> Result<
+    (
+        OAuthAuthorizationServerMetadata<'static>,
+        DidDocument<'static>,
+    ),
+    ResolverError,
+> {
+    let actor =
+        AtIdentifier::new(input).map_err(|e| ResolverError::AtIdentifier(format!("{:?}", e)))?;
+    let identity = resolver.resolve_ident_owned(&actor).await?;
+    if let Some(pds) = &identity.pds_endpoint() {
+        let metadata = resolver.get_resource_server_metadata(pds).await?;
+        Ok((metadata, identity))
+    } else {
+        Err(ResolverError::DidDocument(format!("Did doc lacking pds")))
+    }
+}
+
+#[cfg(target_arch = "wasm32")]
+async fn resolve_from_identity_impl<T: OAuthResolver + ?Sized>(
+    resolver: &T,
+    input: &str,
+) -> Result<
+    (
+        OAuthAuthorizationServerMetadata<'static>,
+        DidDocument<'static>,
+    ),
+    ResolverError,
+> {
+    let actor =
+        AtIdentifier::new(input).map_err(|e| ResolverError::AtIdentifier(format!("{:?}", e)))?;
+    let identity = resolver.resolve_ident_owned(&actor).await?;
+    if let Some(pds) = &identity.pds_endpoint() {
+        let metadata = resolver.get_resource_server_metadata(pds).await?;
+        Ok((metadata, identity))
+    } else {
+        Err(ResolverError::DidDocument(format!("Did doc lacking pds")))
+    }
+}
+
+#[cfg(not(target_arch = "wasm32"))]
+async fn get_authorization_server_metadata_impl<T: HttpClient + Sync + ?Sized>(
+    client: &T,
+    issuer: &Url,
+) -> Result<OAuthAuthorizationServerMetadata<'static>, ResolverError> {
+    let mut md = resolve_authorization_server(client, issuer).await?;
+    // Normalize issuer string to the input URL representation to avoid slash quirks
+    md.issuer = jacquard_common::CowStr::from(issuer.as_str()).into_static();
+    Ok(md)
+}
+
+#[cfg(target_arch = "wasm32")]
+async fn get_authorization_server_metadata_impl<T: HttpClient + ?Sized>(
+    client: &T,
+    issuer: &Url,
+) -> Result<OAuthAuthorizationServerMetadata<'static>, ResolverError> {
+    let mut md = resolve_authorization_server(client, issuer).await?;
+    // Normalize issuer string to the input URL representation to avoid slash quirks
+    md.issuer = jacquard_common::CowStr::from(issuer.as_str()).into_static();
+    Ok(md)
+}
+
+#[cfg(not(target_arch = "wasm32"))]
+async fn get_resource_server_metadata_impl<T: OAuthResolver + Sync + ?Sized>(
+    resolver: &T,
+    pds: &Url,
+) -> Result<OAuthAuthorizationServerMetadata<'static>, ResolverError> {
+    let rs_metadata = resolve_protected_resource_info(resolver, pds).await?;
+    // ATPROTO requires one, and only one, authorization server entry
+    // > That document MUST contain a single item in the authorization_servers array.
+    // https://github.com/bluesky-social/proposals/tree/main/0004-oauth#server-metadata
+    let issuer = match &rs_metadata.authorization_servers {
+        Some(servers) if !servers.is_empty() => {
+            if servers.len() > 1 {
+                return Err(ResolverError::ProtectedResourceMetadata(format!(
+                    "unable to determine authorization server for PDS: {pds}"
+                )));
+            }
+            &servers[0]
+        }
+        _ => {
+            return Err(ResolverError::ProtectedResourceMetadata(format!(
+                "no authorization server found for PDS: {pds}"
+            )));
+        }
+    };
+    let as_metadata = resolver.get_authorization_server_metadata(issuer).await?;
+    // https://datatracker.ietf.org/doc/html/draft-ietf-oauth-resource-metadata-08#name-authorization-server-metada
+    if let Some(protected_resources) = &as_metadata.protected_resources {
+        let resource_url = rs_metadata
+            .resource
+            .strip_suffix('/')
+            .unwrap_or(rs_metadata.resource.as_str());
+        if !protected_resources.contains(&CowStr::Borrowed(resource_url)) {
+            return Err(ResolverError::AuthorizationServerMetadata(format!(
+                "pds {pds}, resource {0} not protected by issuer: {issuer}, protected resources: {1:?}",
+                rs_metadata.resource, protected_resources
+            )));
+        }
+    }
+
+    // TODO: atproot specific validation?
+    // https://github.com/bluesky-social/proposals/tree/main/0004-oauth#server-metadata
+    //
+    // eg.
+    // https://drafts.aaronpk.com/draft-parecki-oauth-client-id-metadata-document/draft-parecki-oauth-client-id-metadata-document.html
+    // if as_metadata.client_id_metadata_document_supported != Some(true) {
+    //     return Err(Error::AuthorizationServerMetadata(format!(
+    //         "authorization server does not support client_id_metadata_document: {issuer}"
+    //     )));
+    // }
+
+    Ok(as_metadata)
+}
+
+#[cfg(target_arch = "wasm32")]
+async fn get_resource_server_metadata_impl<T: OAuthResolver + ?Sized>(
+    resolver: &T,
+    pds: &Url,
+) -> Result<OAuthAuthorizationServerMetadata<'static>, ResolverError> {
+    let rs_metadata = resolve_protected_resource_info(resolver, pds).await?;
+    // ATPROTO requires one, and only one, authorization server entry
+    // > That document MUST contain a single item in the authorization_servers array.
+    // https://github.com/bluesky-social/proposals/tree/main/0004-oauth#server-metadata
+    let issuer = match &rs_metadata.authorization_servers {
+        Some(servers) if !servers.is_empty() => {
+            if servers.len() > 1 {
+                return Err(ResolverError::ProtectedResourceMetadata(format!(
+                    "unable to determine authorization server for PDS: {pds}"
+                )));
+            }
+            &servers[0]
+        }
+        _ => {
+            return Err(ResolverError::ProtectedResourceMetadata(format!(
+                "no authorization server found for PDS: {pds}"
+            )));
+        }
+    };
+    let as_metadata = resolver.get_authorization_server_metadata(issuer).await?;
+    // https://datatracker.ietf.org/doc/html/draft-ietf-oauth-resource-metadata-08#name-authorization-server-metada
+    if let Some(protected_resources) = &as_metadata.protected_resources {
+        let resource_url = rs_metadata
+            .resource
+            .strip_suffix('/')
+            .unwrap_or(rs_metadata.resource.as_str());
+        if !protected_resources.contains(&CowStr::Borrowed(resource_url)) {
+            return Err(ResolverError::AuthorizationServerMetadata(format!(
+                "pds {pds}, resource {0} not protected by issuer: {issuer}, protected resources: {1:?}",
+                rs_metadata.resource, protected_resources
+            )));
+        }
+    }
+
+    // TODO: atproot specific validation?
+    // https://github.com/bluesky-social/proposals/tree/main/0004-oauth#server-metadata
+    //
+    // eg.
+    // https://drafts.aaronpk.com/draft-parecki-oauth-client-id-metadata-document/draft-parecki-oauth-client-id-metadata-document.html
+    // if as_metadata.client_id_metadata_document_supported != Some(true) {
+    //     return Err(Error::AuthorizationServerMetadata(format!(
+    //         "authorization server does not support client_id_metadata_document: {issuer}"
+    //     )));
+    // }
+
+    Ok(as_metadata)
+}
+
+#[cfg_attr(not(target_arch = "wasm32"), trait_variant::make(Send))]
 pub trait OAuthResolver: IdentityResolver + HttpClient {
+    #[cfg(not(target_arch = "wasm32"))]
     fn verify_issuer(
         &self,
         server_metadata: &OAuthAuthorizationServerMetadata<'_>,
···
     where
         Self: Sync,
     {
-        async {
-            let (metadata, identity) = self.resolve_from_identity(sub).await?;
-            if !issuer_equivalent(&metadata.issuer, &server_metadata.issuer) {
-                return Err(ResolverError::AuthorizationServerMetadata(
-                    "issuer mismatch".to_string(),
-                ));
-            }
-            Ok(identity
-                .pds_endpoint()
-                .ok_or(ResolverError::DidDocument(format!("{:?}", identity).into()))?)
-        }
+        verify_issuer_impl(self, server_metadata, sub)
+    }
+
+    #[cfg(target_arch = "wasm32")]
+    fn verify_issuer(
+        &self,
+        server_metadata: &OAuthAuthorizationServerMetadata<'_>,
+        sub: &Did<'_>,
+    ) -> impl std::future::Future<Output = Result<Url, ResolverError>> {
+        verify_issuer_impl(self, server_metadata, sub)
     }
+
+    #[cfg(not(target_arch = "wasm32"))]
     fn resolve_oauth(
         &self,
         input: &str,
-    ) -> impl Future<
+    ) -> impl std::future::Future<
         Output = Result<
             (
                 OAuthAuthorizationServerMetadata<'static>,
···
     where
         Self: Sync,
     {
-        // Allow using an entryway, or PDS url, directly as login input (e.g.
-        // when the user forgot their handle, or when the handle does not
-        // resolve to a DID)
-        async {
-            Ok(if input.starts_with("https://") {
-                let url = Url::parse(input).map_err(|_| ResolverError::NotFound)?;
-                (self.resolve_from_service(&url).await?, None)
-            } else {
-                let (metadata, identity) = self.resolve_from_identity(input).await?;
-                (metadata, Some(identity))
-            })
-        }
+        resolve_oauth_impl(self, input)
+    }
+
+    #[cfg(target_arch = "wasm32")]
+    fn resolve_oauth(
+        &self,
+        input: &str,
+    ) -> impl std::future::Future<
+        Output = Result<
+            (
+                OAuthAuthorizationServerMetadata<'static>,
+                Option<DidDocument<'static>>,
+            ),
+            ResolverError,
+        >,
+    > {
+        resolve_oauth_impl(self, input)
     }
+
+    #[cfg(not(target_arch = "wasm32"))]
     fn resolve_from_service(
         &self,
         input: &Url,
-    ) -> impl Future<Output = Result<OAuthAuthorizationServerMetadata<'static>, ResolverError>> + Send
+    ) -> impl std::future::Future<
+        Output = Result<OAuthAuthorizationServerMetadata<'static>, ResolverError>,
+    > + Send
     where
         Self: Sync,
     {
-        async {
-            // Assume first that input is a PDS URL (as required by ATPROTO)
-            if let Ok(metadata) = self.get_resource_server_metadata(input).await {
-                return Ok(metadata);
-            }
-            // Fallback to trying to fetch as an issuer (Entryway)
-            self.get_authorization_server_metadata(input).await
-        }
+        resolve_from_service_impl(self, input)
     }
+
+    #[cfg(target_arch = "wasm32")]
+    fn resolve_from_service(
+        &self,
+        input: &Url,
+    ) -> impl std::future::Future<
+        Output = Result<OAuthAuthorizationServerMetadata<'static>, ResolverError>,
+    > {
+        resolve_from_service_impl(self, input)
+    }
+
+    #[cfg(not(target_arch = "wasm32"))]
     fn resolve_from_identity(
         &self,
         input: &str,
-    ) -> impl Future<
+    ) -> impl std::future::Future<
         Output = Result<
             (
                 OAuthAuthorizationServerMetadata<'static>,
···
     where
         Self: Sync,
     {
-        async {
-            let actor = AtIdentifier::new(input)
-                .map_err(|e| ResolverError::AtIdentifier(format!("{:?}", e)))?;
-            let identity = self.resolve_ident_owned(&actor).await?;
-            if let Some(pds) = &identity.pds_endpoint() {
-                let metadata = self.get_resource_server_metadata(pds).await?;
-                Ok((metadata, identity))
-            } else {
-                Err(ResolverError::DidDocument(format!("Did doc lacking pds")))
-            }
-        }
+        resolve_from_identity_impl(self, input)
     }
+
+    #[cfg(target_arch = "wasm32")]
+    fn resolve_from_identity(
+        &self,
+        input: &str,
+    ) -> impl std::future::Future<
+        Output = Result<
+            (
+                OAuthAuthorizationServerMetadata<'static>,
+                DidDocument<'static>,
+            ),
+            ResolverError,
+        >,
+    > {
+        resolve_from_identity_impl(self, input)
+    }
+
+    #[cfg(not(target_arch = "wasm32"))]
     fn get_authorization_server_metadata(
         &self,
         issuer: &Url,
-    ) -> impl Future<Output = Result<OAuthAuthorizationServerMetadata<'static>, ResolverError>> + Send
+    ) -> impl std::future::Future<
+        Output = Result<OAuthAuthorizationServerMetadata<'static>, ResolverError>,
+    > + Send
     where
         Self: Sync,
     {
-        async {
-            let mut md = resolve_authorization_server(self, issuer).await?;
-            // Normalize issuer string to the input URL representation to avoid slash quirks
-            md.issuer = jacquard_common::CowStr::from(issuer.as_str()).into_static();
-            Ok(md)
-        }
+        get_authorization_server_metadata_impl(self, issuer)
     }
+
+    #[cfg(target_arch = "wasm32")]
+    fn get_authorization_server_metadata(
+        &self,
+        issuer: &Url,
+    ) -> impl std::future::Future<
+        Output = Result<OAuthAuthorizationServerMetadata<'static>, ResolverError>,
+    > {
+        get_authorization_server_metadata_impl(self, issuer)
+    }
+
+    #[cfg(not(target_arch = "wasm32"))]
     fn get_resource_server_metadata(
         &self,
         pds: &Url,
-    ) -> impl Future<Output = Result<OAuthAuthorizationServerMetadata<'static>, ResolverError>> + Send
+    ) -> impl std::future::Future<
+        Output = Result<OAuthAuthorizationServerMetadata<'static>, ResolverError>,
+    > + Send
     where
         Self: Sync,
     {
-        async move {
-            let rs_metadata = resolve_protected_resource_info(self, pds).await?;
-            // ATPROTO requires one, and only one, authorization server entry
-            // > That document MUST contain a single item in the authorization_servers array.
-            // https://github.com/bluesky-social/proposals/tree/main/0004-oauth#server-metadata
-            let issuer = match &rs_metadata.authorization_servers {
-                Some(servers) if !servers.is_empty() => {
-                    if servers.len() > 1 {
-                        return Err(ResolverError::ProtectedResourceMetadata(format!(
-                            "unable to determine authorization server for PDS: {pds}"
-                        )));
-                    }
-                    &servers[0]
-                }
-                _ => {
-                    return Err(ResolverError::ProtectedResourceMetadata(format!(
-                        "no authorization server found for PDS: {pds}"
-                    )));
-                }
-            };
-            let as_metadata = self.get_authorization_server_metadata(issuer).await?;
-            // https://datatracker.ietf.org/doc/html/draft-ietf-oauth-resource-metadata-08#name-authorization-server-metada
-            if let Some(protected_resources) = &as_metadata.protected_resources {
-                let resource_url = rs_metadata
-                    .resource
-                    .strip_suffix('/')
-                    .unwrap_or(rs_metadata.resource.as_str());
-                if !protected_resources.contains(&CowStr::Borrowed(resource_url)) {
-                    return Err(ResolverError::AuthorizationServerMetadata(format!(
-                        "pds {pds}, resource {0} not protected by issuer: {issuer}, protected resources: {1:?}",
-                        rs_metadata.resource, protected_resources
-                    )));
-                }
-            }
+        get_resource_server_metadata_impl(self, pds)
+    }
 
-            // TODO: atproot specific validation?
-            // https://github.com/bluesky-social/proposals/tree/main/0004-oauth#server-metadata
-            //
-            // eg.
-            // https://drafts.aaronpk.com/draft-parecki-oauth-client-id-metadata-document/draft-parecki-oauth-client-id-metadata-document.html
-            // if as_metadata.client_id_metadata_document_supported != Some(true) {
-            //     return Err(Error::AuthorizationServerMetadata(format!(
-            //         "authorization server does not support client_id_metadata_document: {issuer}"
-            //     )));
-            // }
-
-            Ok(as_metadata)
-        }
+    #[cfg(target_arch = "wasm32")]
+    fn get_resource_server_metadata(
+        &self,
+        pds: &Url,
+    ) -> impl std::future::Future<
+        Output = Result<OAuthAuthorizationServerMetadata<'static>, ResolverError>,
+    > {
+        get_resource_server_metadata_impl(self, pds)
     }
 }
 

crates/jacquard/Cargo.toml

···
 api_full = ["api", "jacquard-api/bluesky", "jacquard-api/other", "jacquard-api/lexicon_community"]
 # All captured generated lexicon API bindings
 api_all = ["api_full", "jacquard-api/ufos"]
-dns = ["jacquard-identity/dns"]
+
 # Propagate loopback to oauth (server + browser helper)
 loopback = ["jacquard-oauth/loopback", "jacquard-oauth/browser-open"]
 # Enable tracing instrumentation
 tracing = ["dep:tracing", "jacquard-common/tracing", "jacquard-oauth/tracing", "jacquard-identity/tracing"]
+dns = ["jacquard-identity/dns"]
 
 
 [[example]]
···
 jacquard-identity = { version = "0.5", path = "../jacquard-identity" }
 
 bon.workspace = true
-async-trait.workspace = true
+trait-variant.workspace = true
 bytes.workspace = true
 http.workspace = true
 miette = { workspace = true }
-reqwest = { workspace = true, features = ["charset", "http2", "json", "system-proxy", "gzip", "rustls-tls"] }
+reqwest = { workspace = true, features = ["charset", "json", "gzip"] }
 serde.workspace = true
 serde_html_form.workspace = true
 serde_ipld_dagcbor.workspace = true
 serde_json.workspace = true
 thiserror.workspace = true
-tokio = { workspace = true, features = ["macros", "rt-multi-thread", "fs"] }
+tokio = { workspace = true, default-features = false, features = ["sync"] }
 url.workspace = true
 smol_str.workspace = true
 percent-encoding.workspace = true
···
 p256 = { workspace = true, features = ["ecdsa"] }
 rand_core.workspace = true
 tracing = { workspace = true, optional = true }
+
+[target.'cfg(not(target_arch = "wasm32"))'.dependencies]
+reqwest = { workspace = true, features = ["http2", "system-proxy", "rustls-tls"] }
+tokio = { workspace = true, features = ["macros", "rt-multi-thread", "fs"] }
+
+[target.'cfg(target_family = "wasm")'.dependencies]
+getrandom = { version = "0.2", features = ["js"] }
 
 [dev-dependencies]
 clap.workspace = true

crates/jacquard/src/client.rs

···
 /// Common interface for stateful sessions used by the Agent wrapper.
 ///
 /// Implemented by `CredentialSession` (app‑password) and `OAuthSession` (DPoP).
+#[cfg_attr(not(target_arch = "wasm32"), trait_variant::make(Send))]
 pub trait AgentSession: XrpcClient + HttpClient + Send + Sync {
     /// Identify the kind of session.
     fn session_kind(&self) -> AgentKind;
···
 impl<A: AgentSession> HttpClient for Agent<A> {
     type Error = <A as HttpClient>::Error;
 
+    #[cfg(not(target_arch = "wasm32"))]
     fn send_http(
         &self,
         request: http::Request<Vec<u8>>,
     ) -> impl Future<Output = core::result::Result<http::Response<Vec<u8>>, Self::Error>> + Send
     {
+        self.inner.send_http(request)
+    }
+
+    #[cfg(target_arch = "wasm32")]
+    fn send_http(
+        &self,
+        request: http::Request<Vec<u8>>,
+    ) -> impl Future<Output = core::result::Result<http::Response<Vec<u8>>, Self::Error>> {
         self.inner.send_http(request)
     }
 }

crates/jacquard/src/client/credential_session.rs

···
         S: Any + 'static,
     {
         #[cfg(feature = "tracing")]
-        let _span = tracing::info_span!("credential_session_login", identifier = %identifier).entered();
+        let _span =
+            tracing::info_span!("credential_session_login", identifier = %identifier).entered();
 
         // Resolve PDS base
         let pds = if identifier.as_ref().starts_with("http://")
···
         S: Any + 'static,
     {
         #[cfg(feature = "tracing")]
-        let _span = tracing::info_span!("credential_session_restore", did = %did, session_id = %session_id).entered();
+        let _span =
+            tracing::info_span!("credential_session_restore", did = %did, session_id = %session_id)
+                .entered();
 
         let key = (did.clone().into_static(), session_id.clone().into_static());
         let Some(sess) = self.store.get(&key).await else {
···
     fn base_uri(&self) -> Url {
         // base_uri is a synchronous trait method; avoid `.await` here.
         // Under Tokio, use `block_in_place` to make a blocking RwLock read safe.
+        #[cfg(not(target_arch = "wasm32"))]
         if tokio::runtime::Handle::try_current().is_ok() {
             tokio::task::block_in_place(|| {
                 self.endpoint.blocking_read().clone().unwrap_or(
···
                 )
             })
         } else {
+            self.endpoint.blocking_read().clone().unwrap_or(
+                Url::parse("https://public.bsky.app").expect("public appview should be valid url"),
+            )
+        }
+
+        #[cfg(target_arch = "wasm32")]
+        {
             self.endpoint.blocking_read().clone().unwrap_or(
                 Url::parse("https://public.bsky.app").expect("public appview should be valid url"),
             )

crates/jacquard/src/client/token.rs

···
     }
 }
 
-#[async_trait::async_trait]
 impl jacquard_oauth::authstore::ClientAuthStore for FileAuthStore {
     async fn get_session(
         &self,
···
     }
 }
 
-#[async_trait::async_trait]
 impl
     jacquard_common::session::SessionStore<
         crate::client::credential_session::SessionKey,

justfile

···
 pre-commit-all:
     pre-commit run --all-files
 
+# Check that jacquard-common compiles for wasm32
+check-wasm:
+    cargo build --target wasm32-unknown-unknown -p jacquard-common --no-default-features
+
 # Run 'cargo run' on the project
 run *ARGS:
     cargo run {{ARGS}}

rust-toolchain.toml

···
 [toolchain]
 channel = "stable"
 profile = "default"
+targets = [ "wasm32-unknown-unknown" ]