wip

feat: switch to owi conc, avoid needing wasm2wat
feat(kernel): add proof for error handling
2026-01-12 07:18:02 -05:00 · 2024-06-14 18:52:50 -07:00 · 2024-06-14 18:46:27 -07:00 · 2024-06-14 18:46:27 -07:00 · 2024-06-14 18:46:27 -07:00 · 2024-06-14 18:46:27 -07:00
57 changed files with 1789 additions and 308 deletions
--- a/.github/assets/logo-horizontal-darkmode.png
+++ b/.github/assets/logo-horizontal-darkmode.png
--- a/.github/assets/logo-horizontal.png
+++ b/.github/assets/logo-horizontal.png
--- a/.github/workflows/kernel.yml
+++ b/.github/workflows/kernel.yml
@@ -21,6 +21,9 @@ jobs:
          target: wasm32-unknown-unknown
      - uses: Swatinem/rust-cache@v2

+      - name: install wasm-tools
+        uses: bytecodealliance/actions/wasm-tools/setup@v1
+
      - name: Install deps
        run: |
          sudo apt install wabt --yes
@@ -39,6 +42,7 @@ jobs:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        if: ${{ env.GIT_EXIT_CODE }} != 0
        with:
+          author: "zshipko <zshipko@users.noreply.github.com>"
          title: "update(kernel): extism-runtime.wasm in ${{ github.event.pull_request.head.ref }}"
          body: "Automated PR to update `runtime/src/extism-runtime.wasm` in PR #${{ github.event.number }}"
          base: "${{ github.event.pull_request.head.ref }}"
--- a/.github/workflows/release-rust.yaml
+++ b/.github/workflows/release-rust.yaml
@@ -36,6 +36,18 @@ jobs:
          override: true
          target: ${{ matrix.target }}

+      - name: Release Rust convert-macros Crate
+        env:
+          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_API_TOKEN }}
+        run: |
+          version=$(cargo metadata --format-version=1 | jq -r '.packages[] | select(.name == "extism") | .version')
+
+          if ! &>/dev/null curl -sLIf https://crates.io/api/v1/crates/extism-convert-macros/${version}/download; then
+            cargo publish --manifest-path convert-macros/Cargo.toml --allow-dirty
+          else
+            echo "already published ${version}"
+          fi
+
      - name: Release Rust Convert Crate
        env:
          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_API_TOKEN }}
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -1,6 +1,6 @@
 [workspace]
 resolver = "2"
-members = ["extism-maturin", "manifest", "runtime", "libextism", "convert"]
+members = ["extism-maturin", "manifest", "runtime", "libextism", "convert", "convert-macros"]
 exclude = ["kernel"]

 [workspace.package]
@@ -14,4 +14,5 @@ version = "0.0.0+replaced-by-ci"
 [workspace.dependencies]
 extism = { path = "./runtime", version = "0.0.0+replaced-by-ci" }
 extism-convert = { path = "./convert", version = "0.0.0+replaced-by-ci" }
+extism-convert-macros = { path = "./convert-macros", version = "0.0.0+replaced-by-ci" }
 extism-manifest = { path = "./manifest", version = "0.0.0+replaced-by-ci" }
--- a/5
+++ b/5
@@ -4,10 +4,12 @@ AEXT=a
 FEATURES?=default
 DEFAULT_FEATURES?=yes
 RUST_TARGET?=
+EXTRA_LIBS=

 UNAME := $(shell uname -s)
 ifeq ($(UNAME),Darwin)
 	SOEXT=dylib
+	EXTRA_LIBS=-framework Security
 endif

 ifeq ($(DEFAULT_FEATURES),no)
@@ -29,7 +31,8 @@ endif
 build:
 	cargo build --release $(FEATURE_FLAGS) --manifest-path libextism/Cargo.toml $(TARGET_FLAGS)
 	sed -e "s%@CMAKE_INSTALL_PREFIX@%$(DEST)%" libextism/extism.pc.in > libextism/extism.pc
-	sed -e "s%@CMAKE_INSTALL_PREFIX@%$(DEST)%" libextism/extism-static.pc.in > libextism/extism-static.pc
+	sed -e "s%@CMAKE_INSTALL_PREFIX@%$(DEST)%" \
+	    -e "s%Libs: %Libs: $(EXTRA_LIBS) %" libextism/extism-static.pc.in > libextism/extism-static.pc

 bench:
 	@(cargo criterion $(TARGET_FLAGS) || echo 'For nicer output use cargo-criterion: `cargo install cargo-criterion` - using `cargo bench`') && cargo bench $(TARGET_FLAGS)
--- a/README.md
+++ b/README.md
@@ -1,65 +1,112 @@
-# [Extism](https://extism.org)
+<div align="center">
+    <a href="https://extism.org">
+    <picture>
+        <source media="(prefers-color-scheme: dark)" srcset=".github/assets/logo-horizontal-darkmode.png">
+        <img alt="Extism - the WebAssembly framework" width="75%" style="max-width: 600px" src=".github/assets/logo-horizontal.png">
+    </picture>
+    </a>

-[![Discord](https://img.shields.io/discord/1011124058408112148?color=%23404eed&label=Community%20Chat&logo=Discord&logoColor=%23404eed)](https://discord.gg/cx3usBCWnc)
+[![Discord](https://img.shields.io/discord/1011124058408112148?color=%23404eed&label=Community%20Chat&logo=Discord&logoColor=%23404eed)](https://extism.org/discord)
 ![GitHub Org's stars](https://img.shields.io/github/stars/extism)
-![GitHub all releases](https://img.shields.io/github/downloads/extism/extism/total)
+![Downloads](https://img.shields.io/crates/d/extism)
 ![GitHub License](https://img.shields.io/github/license/extism/extism)
 ![GitHub release (with filter)](https://img.shields.io/github/v/release/extism/extism)

-The universal plug-in system. Run WebAssembly extensions inside your app. Use idiomatic Host SDKs for [Go](https://github.com/extism/go-sdk#readme),
-[Ruby](https://github.com/extism/ruby-sdk#readme),
-[Python](https://github.com/extism/python-sdk#readme),
-[JavaScript](https://github.com/extism/js-sdk#readme),
-[Rust](/runtime/#readme),
-[C](libextism/#readme),
-[C++](https://github.com/extism/cpp-sdk/#readme),
-[OCaml](https://github.com/extism/ocaml-sdk#readme),
-[Haskell](https://github.com/extism/haskell-sdk#readme),
-[PHP](https://github.com/extism/php-sdk#readme),
-[Elixir](https://github.com/extism/elixir-sdk#readme),
-[.NET](https://github.com/extism/dotnet-sdk#readme),
-[Java](https://github.com/extism/java-sdk#readme),
-[Zig](https://github.com/extism/zig-sdk#readme),
-[D](https://github.com/extism/d-sdk#readme),
-&amp; more (others coming soon).
+</div>

-Plug-in development kits (PDK) for plug-in authors supported in [Rust](https://github.com/extism/rust-pdk#readme), [AssemblyScript](https://github.com/extism/assemblyscript-pdk#readme), [Go](https://github.com/extism/go-pdk#readme), [C/C++](https://github.com/extism/c-pdk#readme), [Haskell](https://github.com/extism/haskell-pdk#readme), [JavaScript](https://github.com/extism/js-pdk#readme), [C#](https://github.com/extism/dotnet-pdk#readme), [F#](https://github.com/extism/dotnet-pdk#readme) and [Zig](https://github.com/extism/zig-pdk#readme).
+# Overview

-<p align="center">
-  <img style="width: 70%;" src="https://user-images.githubusercontent.com/7517515/210286900-39b144fd-1b26-4dd0-b7a9-2b5755bc174d.png" alt="Extism embedded SDK language support"/>
-</p>
+Extism is a lightweight framework for building with WebAssembly (Wasm). It
+supports running Wasm code on servers, the edge, CLIs, IoT, browsers and
+everything in between. Extism is designed to be "universal" in that it supports
+a common interface, no matter where it runs.

-Add a flexible, secure, and _bLaZiNg FaSt_ plug-in system to your project. Server, desktop, mobile, web, database -- you name it. Enable users to write and execute safe extensions to your software in **3 easy steps:**
+> **Note:** One of the primary use cases for Extism is **building extensible
+> software & plugins**. You want to be able to execute arbitrary, untrusted code
+> from your users? Extism makes this safe and practical to do.

-### 1. Import
+Additionally, Extism adds some extra utilities on top of standard Wasm runtimes.
+For example, we support persistent memory/module-scope variables, secure &
+host-controlled HTTP without WASI, runtime limiters & timers, simpler host
+function linking, and more. Extism users build:

-Import an Extism Host SDK into your code as a library dependency.
+- plug-in systems
+- FaaS platforms
+- code generators
+- web applications
+- & much more...

-### 2. Integrate 
+# Run WebAssembly In Your App

-Identify the place(s) in your code where some arbitrary logic should run (the plug-in!), returning your code some results.
+Pick a SDK to import into your program, and refer to the documentation to get
+started:

-### 3. Execute
+| Type        | Language                                                                                       | Source Code                                                             | Package                                                                 |
+| ----------- | ---------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------- | ----------------------------------------------------------------------- |
+| Rust SDK    | <img alt="Rust SDK" src="https://extism.org/img/sdk-languages/rust.svg" width="50px"/>         | https://github.com/extism/extism/tree/main/runtime                      | [Crates.io](https://crates.io/crates/extism)                            |
+| JS SDK      | <img alt="JS SDK" src="https://extism.org/img/sdk-languages/js.svg" width="50px"/>             | https://github.com/extism/js-sdk <br/>(supports Web, Node, Deno & Bun!) | [NPM](https://www.npmjs.com/package/@extism/extism)                     |
+| Elixir SDK  | <img alt="Elixir SDK" src="https://extism.org/img/sdk-languages/elixir.svg" width="50px"/>     | https://github.com/extism/elixir-sdk                                    | [Hex](https://hex.pm/packages/extism)                                   |
+| Go SDK      | <img alt="Go SDK" src="https://extism.org/img/sdk-languages/go.svg" width="50px"/>             | https://github.com/extism/go-sdk                                        | [Go mod](https://pkg.go.dev/github.com/extism/go-sdk)                   |
+| Haskell SDK | <img alt="Haskell SDK" src="https://extism.org/img/sdk-languages/haskell.svg" width="50px"/>   | https://github.com/extism/haskell-sdk                                   | [Hackage](https://hackage.haskell.org/package/extism)                   |
+| Java SDK    | <img alt="Java SDK" src="https://extism.org/img/sdk-languages/java-android.svg" width="50px"/> | https://github.com/extism/java-sdk                                      | [Sonatype](https://central.sonatype.com/artifact/org.extism.sdk/extism) |
+| .NET SDK    | <img alt=".NET SDK" src="https://extism.org/img/sdk-languages/dotnet.svg" width="50px"/>       | https://github.com/extism/dotnet-sdk <br/>(supports C# & F#!)           | [Nuget](https://www.nuget.org/packages/Extism.Sdk)                      |
+| OCaml SDK   | <img alt="OCaml SDK" src="https://extism.org/img/sdk-languages/ocaml.svg" width="50px"/>       | https://github.com/extism/ocaml-sdk                                     | [opam](https://opam.ocaml.org/packages/extism/)                         |
+| Perl SDK    | <img alt="Perl SDK" src="https://extism.org/img/sdk-languages/perl.svg" width="50px"/>         | https://github.com/extism/perl-sdk                                      | [CPAN](https://metacpan.org/pod/Extism)                                 |
+| PHP SDK     | <img alt="PHP SDK" src="https://extism.org/img/sdk-languages/php.svg" width="50px"/>           | https://github.com/extism/php-sdk                                       | [Packagist](https://packagist.org/packages/extism/extism)               |
+| Python SDK  | <img alt="Python SDK" src="https://extism.org/img/sdk-languages/python.svg" width="50px"/>     | https://github.com/extism/python-sdk                                    | [PyPi](https://pypi.org/project/extism/)                                |
+| Ruby SDK    | <img alt="Ruby SDK" src="https://extism.org/img/sdk-languages/ruby.svg" width="50px"/>         | https://github.com/extism/ruby-sdk                                      | [RubyGems](https://rubygems.org/gems/extism)                            |
+| Zig SDK     | <img alt="Zig SDK" src="https://extism.org/img/sdk-languages/zig.svg" width="50px"/>           | https://github.com/extism/zig-sdk                                       | N/A                                                                     |
+| C SDK       | <img alt="C SDK" src="https://extism.org/img/sdk-languages/c.svg" width="50px"/>               | https://github.com/extism/extism/tree/main/libextism                    | N/A                                                                     |
+| C++ SDK     | <img alt="C++ SDK" src="https://extism.org/img/sdk-languages/cpp.svg" width="50px"/>           | https://github.com/extism/cpp-sdk                                       | N/A                                                                     |

-Load WebAssembly modules at any time in your app's lifetime and Extism will execute them in a secure sandbox, fully isolated from your program's memory.
+# Compile WebAssembly to run in Extism Hosts

-# API Status
+Extism Hosts (running the SDK) must execute WebAssembly code that has a PDK
+library compiled in to the `.wasm` binary. PDKs make it easy for plug-in /
+extension code authors to read input from the host and return data back, read
+provided configuration, set/get variables, make outbound HTTP calls if allowed,
+and more.

-**Please note:** This project still under active development and APIs are still changing. We are aiming for a stable 1.0 release in January, 2024.
-The main branch may have breaking changes until that point, but if you starting today, a 1.0.0-rcx release is the best place to start.
+Pick a PDK to import into your Wasm program, and refer to the documentation to
+get started:

-If you experience any problems or have any questions, please join our [Discord](https://discord.gg/cx3usBCWnc) and let us know.
-Our community is very responsive and happy to help get you started.
+| Type               | Language                                                                                                   | Source Code                                                   | Package                                                   |
+| ------------------ | ---------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------- | --------------------------------------------------------- |
+| Rust PDK           | <img alt="Rust PDK" src="https://extism.org/img/sdk-languages/rust.svg" width="50px"/>                     | https://github.com/extism/rust-pdk                            | [Crates.io](https://crates.io/crates/extism-pdk)          |
+| JS PDK             | <img alt="JS PDK" src="https://extism.org/img/sdk-languages/js.svg" width="50px"/>                         | https://github.com/extism/js-pdk                              | N/A                                                       |
+| Go PDK             | <img alt="Go PDK" src="https://extism.org/img/sdk-languages/go.svg" width="50px"/>                         | https://github.com/extism/go-pdk                              | [Go mod](https://pkg.go.dev/github.com/extism/go-pdk)     |
+| Haskell PDK        | <img alt="Haskell PDK" src="https://extism.org/img/sdk-languages/haskell.svg" width="50px"/>               | https://github.com/extism/haskell-pdk                         | [Hackage](https://hackage.haskell.org/package/extism-pdk) |
+| AssemblyScript PDK | <img alt="AssemblyScript PDK" src="https://extism.org/img/sdk-languages/assemblyscript.svg" width="50px"/> | https://github.com/extism/assemblyscript-pdk                  | [NPM](https://www.npmjs.com/package/@extism/as-pdk)       |
+| .NET PDK           | <img alt=".NET PDK" src="https://extism.org/img/sdk-languages/dotnet.svg" width="50px"/>                   | https://github.com/extism/dotnet-pdk <br/>(supports C# & F#!) | https://www.nuget.org/packages/Extism.Pdk                 |
+| C PDK              | <img alt="C PDK" src="https://extism.org/img/sdk-languages/c.svg" width="50px"/>                           | https://github.com/extism/c-pdk                               | N/A                                                       |
+| Zig PDK            | <img alt="Zig PDK" src="https://extism.org/img/sdk-languages/zig.svg" width="50px"/>                       | https://github.com/extism/zig-pdk                             | N/A                                                       |
+
+# Support
+
+## Discord
+
+If you experience any problems or have any questions, please join our
+[Discord](https://extism.org/discord) and let us know. Our community is very
+responsive and happy to help get you started.

 ## Usage

-Head to the [project website](https://extism.org) for more information and docs. Also, consider reading an [overview](https://extism.org/docs/overview) of Extism and its goals & approach.
+Head to the [project website](https://extism.org) for more information and docs.
+Also, consider reading an [overview](https://extism.org/docs/overview) of Extism
+and its goals & approach.

 ## Contribution

-Thank you for considering a contribution to Extism, we are happy to help you make a PR or find something to work on! 
+Thank you for considering a contribution to Extism, we are happy to help you
+make a PR or find something to work on!

-The easiest way to start would be to join the [Discord](https://discord.gg/cx3usBCWnc) or open an issue on the [`extism/proposals`](https://github.com/extism/proposals) issue tracker, which can eventually become an Extism Improvement Proposal (EIP).
+The easiest way to start would be to join the
+[Discord](https://extism.org/discord) or open an issue on the
+[`extism/proposals`](https://github.com/extism/proposals) issue tracker, which
+can eventually become an Extism Improvement Proposal (EIP).
+
+For more information, please read the
+[Contributing](https://extism.org/docs/concepts/contributing) guide.

 ---

@@ -68,8 +115,8 @@ The easiest way to start would be to join the [Discord](https://discord.gg/cx3us
 Extism is an open-source product from the team at:

 <p align="left">
-  <a href="https://dylib.so" _target="blanks"><img width="200px" src="https://user-images.githubusercontent.com/7517515/198204119-5afdebb9-a5d8-4322-bd2a-46179c8d7b24.svg"/></a>
+  <a href="https://dylibso.com" _target="blanks"><img width="200px" src="https://user-images.githubusercontent.com/7517515/198204119-5afdebb9-a5d8-4322-bd2a-46179c8d7b24.svg"/></a>
 </p>

-
-_Reach out and tell us what you're building! We'd love to help._
+_Reach out and tell us what you're building! We'd love to help:_
+<a href="mailto:hello@dylibso.com">hello@dylibso.com</a>
--- a/convert-macros/Cargo.toml
+++ b/convert-macros/Cargo.toml
@@ -0,0 +1,26 @@
+[package]
+name = "extism-convert-macros"
+edition.workspace = true
+authors.workspace = true
+license.workspace = true
+homepage.workspace = true
+repository.workspace = true
+version.workspace = true
+description = "Macros to remove boilerplate with Extism"
+
+[lib]
+proc-macro = true
+
+[features]
+extism-path = []
+extism-pdk-path = []
+
+[dependencies]
+manyhow.version = "0.11.0"
+proc-macro-crate = "3.1.0"
+proc-macro2 = "1.0.78"
+quote = "1.0.35"
+syn = { version = "2.0.48", features = ["derive"] }
+
+[dev-dependencies]
+trybuild = "1.0.89"
--- a/convert-macros/src/lib.rs
+++ b/convert-macros/src/lib.rs
@@ -0,0 +1,108 @@
+use std::iter;
+
+use manyhow::{ensure, error_message, manyhow, Result};
+use proc_macro_crate::{crate_name, FoundCrate};
+use quote::{format_ident, quote, ToTokens};
+use syn::{parse_quote, Attribute, DeriveInput, Path};
+
+/// Tries to resolve the path to `extism_convert` dynamically, falling back to feature flags when unsuccessful.
+fn convert_path() -> Path {
+    match (
+        crate_name("extism"),
+        crate_name("extism-convert"),
+        crate_name("extism-pdk"),
+    ) {
+        (Ok(FoundCrate::Name(name)), ..) => {
+            let ident = format_ident!("{name}");
+            parse_quote!(::#ident::convert)
+        }
+        (_, Ok(FoundCrate::Name(name)), ..) | (.., Ok(FoundCrate::Name(name))) => {
+            let ident = format_ident!("{name}");
+            parse_quote!(::#ident)
+        }
+        (Ok(FoundCrate::Itself), ..) => parse_quote!(::extism::convert),
+        (_, Ok(FoundCrate::Itself), ..) => parse_quote!(::extism_convert),
+        (.., Ok(FoundCrate::Itself)) => parse_quote!(::extism_pdk),
+        _ if cfg!(feature = "extism-path") => parse_quote!(::extism::convert),
+        _ if cfg!(feature = "extism-pdk-path") => parse_quote!(::extism_pdk),
+        _ => parse_quote!(::extism_convert),
+    }
+}
+
+fn extract_encoding(attrs: &[Attribute]) -> Result<Path> {
+    let encodings: Vec<_> = attrs
+        .iter()
+        .filter(|attr| attr.path().is_ident("encoding"))
+        .collect();
+    ensure!(!encodings.is_empty(), "encoding needs to be specified"; try = "`#[encoding(ToJson)]`");
+    ensure!(encodings.len() < 2, encodings[1], "only one encoding can be specified"; try = "remove `{}`", encodings[1].to_token_stream());
+
+    Ok(encodings[0].parse_args().map_err(
+        |e| error_message!(e.span(), "{e}"; note= "expects a path"; try = "`#[encoding(ToJson)]`"),
+    )?)
+}
+
+#[manyhow]
+#[proc_macro_derive(ToBytes, attributes(encoding))]
+pub fn to_bytes(
+    DeriveInput {
+        attrs,
+        ident,
+        generics,
+        ..
+    }: DeriveInput,
+) -> Result {
+    let encoding = extract_encoding(&attrs)?;
+    let convert = convert_path();
+
+    let (_, type_generics, _) = generics.split_for_impl();
+
+    let mut generics = generics.clone();
+    generics.make_where_clause().predicates.push(
+        parse_quote!(for<'__to_bytes_b> #encoding<&'__to_bytes_b Self>: #convert::ToBytes<'__to_bytes_b>)
+    );
+    generics.params = iter::once(parse_quote!('__to_bytes_a))
+        .chain(generics.params)
+        .collect();
+    let (impl_generics, _, where_clause) = generics.split_for_impl();
+
+    Ok(quote! {
+        impl #impl_generics #convert::ToBytes<'__to_bytes_a> for #ident #type_generics #where_clause
+        {
+            type Bytes = ::std::vec::Vec<u8>;
+
+            fn to_bytes(&self) -> Result<Self::Bytes, #convert::Error> {
+                #convert::ToBytes::to_bytes(&#encoding(self)).map(|__bytes| __bytes.as_ref().to_vec())
+            }
+        }
+
+    })
+}
+
+#[manyhow]
+#[proc_macro_derive(FromBytes, attributes(encoding))]
+pub fn from_bytes(
+    DeriveInput {
+        attrs,
+        ident,
+        mut generics,
+        ..
+    }: DeriveInput,
+) -> Result {
+    let encoding = extract_encoding(&attrs)?;
+    let convert = convert_path();
+    generics
+        .make_where_clause()
+        .predicates
+        .push(parse_quote!(#encoding<Self>: #convert::FromBytesOwned));
+    let (impl_generics, type_generics, where_clause) = generics.split_for_impl();
+    Ok(quote! {
+        impl #impl_generics #convert::FromBytesOwned for #ident #type_generics #where_clause
+        {
+            fn from_bytes_owned(__data: &[u8]) -> Result<Self, #convert::Error> {
+                <#encoding<Self> as #convert::FromBytesOwned>::from_bytes_owned(__data).map(|__encoding| __encoding.0)
+            }
+        }
+
+    })
+}
--- a/convert-macros/tests/ui.rs
+++ b/convert-macros/tests/ui.rs
@@ -0,0 +1,5 @@
+#[test]
+fn ui() {
+    let t = trybuild::TestCases::new();
+    t.compile_fail("tests/ui/*.rs");
+}
--- a/convert-macros/tests/ui/invalid-encoding.rs
+++ b/convert-macros/tests/ui/invalid-encoding.rs
@@ -0,0 +1,23 @@
+use extism_convert_macros::ToBytes;
+
+#[derive(ToBytes)]
+struct MissingEncoding;
+
+#[derive(ToBytes)]
+#[encoding]
+struct EmptyAttr;
+
+#[derive(ToBytes)]
+#[encoding = "string"]
+struct EqNoParen;
+
+#[derive(ToBytes)]
+#[encoding(something, else)]
+struct NotAPath;
+
+#[derive(ToBytes)]
+#[encoding(Multiple)]
+#[encoding(Encodings)]
+struct MultipleEncodings;
+
+fn main() {}
--- a/convert-macros/tests/ui/invalid-encoding.stderr
+++ b/convert-macros/tests/ui/invalid-encoding.stderr
@@ -0,0 +1,44 @@
+error: encoding needs to be specified
+
+         = try: `#[encoding(ToJson)]`
+ --> tests/ui/invalid-encoding.rs:3:10
+  |
+3 | #[derive(ToBytes)]
+  |          ^^^^^^^
+  |
+  = note: this error originates in the derive macro `ToBytes` (in Nightly builds, run with -Z macro-backtrace for more info)
+
+error: expected attribute arguments in parentheses: #[encoding(...)]
+
+         = note: expects a path
+         = try: `#[encoding(ToJson)]`
+ --> tests/ui/invalid-encoding.rs:7:3
+  |
+7 | #[encoding]
+  |   ^^^^^^^^
+
+error: expected parentheses: #[encoding(...)]
+
+         = note: expects a path
+         = try: `#[encoding(ToJson)]`
+  --> tests/ui/invalid-encoding.rs:11:12
+   |
+11 | #[encoding = "string"]
+   |            ^
+
+error: unexpected token
+
+         = note: expects a path
+         = try: `#[encoding(ToJson)]`
+  --> tests/ui/invalid-encoding.rs:15:21
+   |
+15 | #[encoding(something, else)]
+   |                     ^
+
+error: only one encoding can be specified
+
+         = try: remove `#[encoding(Encodings)]`
+  --> tests/ui/invalid-encoding.rs:20:1
+   |
+20 | #[encoding(Encodings)]
+   | ^^^^^^^^^^^^^^^^^^^^^^
--- a/convert/Cargo.toml
+++ b/convert/Cargo.toml
@@ -11,13 +11,14 @@ description = "Traits to make Rust types usable with Extism"

 [dependencies]
 anyhow = "1.0.75"
-base64 = "~0.21"
+base64 = "~0.22"
 bytemuck = {version = "1.14.0", optional = true }
 prost = { version = "0.12.0", optional = true }
 protobuf = { version = "3.2.0", optional = true }
 rmp-serde = { version = "1.1.2", optional = true }
 serde = "1.0.186"
 serde_json = "1.0.105"
+extism-convert-macros.workspace = true

 [dev-dependencies]
 serde = { version = "1.0.186", features = ["derive"] }
@@ -26,3 +27,5 @@ serde = { version = "1.0.186", features = ["derive"] }
 default = ["msgpack", "prost", "raw"]
 msgpack = ["rmp-serde"]
 raw = ["bytemuck"]
+extism-path = ["extism-convert-macros/extism-path"]
+extism-pdk-path = ["extism-convert-macros/extism-pdk-path"]
--- a/convert/src/encoding.rs
+++ b/convert/src/encoding.rs
@@ -11,8 +11,8 @@ use base64::Engine;
 /// extism_convert::encoding!(MyJson, serde_json::to_vec, serde_json::from_slice);
 /// ```
 ///
-/// This will create a struct `struct MyJson<T>(pub T)` and implement `ToBytes` using `serde_json::to_vec`
-/// and `FromBytesOwned` using `serde_json::from_vec`
+/// This will create a struct `struct MyJson<T>(pub T)` and implement [`ToBytes`] using [`serde_json::to_vec`]
+/// and [`FromBytesOwned`] using [`serde_json::from_slice`]
 #[macro_export]
 macro_rules! encoding {
    ($pub:vis $name:ident, $to_vec:expr, $from_slice:expr) => {
@@ -183,30 +183,5 @@ impl<'a, T: bytemuck::Pod> FromBytes<'a> for Raw<'a, T> {
    }
 }

-#[cfg(all(test, feature = "raw", target_endian = "little"))]
-mod tests {
-    use crate::*;
-
-    #[test]
-    fn test_raw() {
-        #[derive(Debug, Clone, Copy, PartialEq)]
-        struct TestRaw {
-            a: i32,
-            b: f64,
-            c: bool,
-        }
-        unsafe impl bytemuck::Pod for TestRaw {}
-        unsafe impl bytemuck::Zeroable for TestRaw {}
-        let x = TestRaw {
-            a: 123,
-            b: 45678.91011,
-            c: true,
-        };
-        let raw = Raw(&x).to_bytes().unwrap();
-        let y = Raw::from_bytes(&raw).unwrap();
-        assert_eq!(&x, y.0);
-
-        let y: Result<Raw<[u8; std::mem::size_of::<TestRaw>()]>, Error> = Raw::from_bytes(&raw);
-        assert!(y.is_ok());
-    }
-}
+#[cfg(all(feature = "raw", target_endian = "big"))]
+compile_error!("The raw feature is only supported on little endian targets");
--- a/convert/src/from_bytes.rs
+++ b/convert/src/from_bytes.rs
@@ -1,14 +1,68 @@
 use crate::*;

+pub use extism_convert_macros::FromBytes;
+
 /// `FromBytes` is used to define how a type should be decoded when working with
 /// Extism memory. It is used for plugin output and host function input.
+///
+/// `FromBytes` can be derived by delegating encoding to generic type implementing
+/// `FromBytes`, e.g., [`Json`], [`Msgpack`].
+///
+/// ```
+/// use extism_convert::{Json, FromBytes};
+/// use serde::Deserialize;
+///
+/// #[derive(FromBytes, Deserialize, PartialEq, Debug)]
+/// #[encoding(Json)]
+/// struct Struct {
+///     hello: String,
+/// }
+///
+/// assert_eq!(Struct::from_bytes(br#"{"hello":"hi"}"#)?, Struct { hello: "hi".into() });
+/// # Ok::<(), extism_convert::Error>(())
+/// ```
+///
+/// Custom encodings can also be used, through new-types with a single generic
+/// argument, i.e., `Type<T>(T)`, that implement `FromBytesOwned` for the struct.
+///
+/// ```
+/// use std::str::{self, FromStr};
+/// use std::convert::Infallible;
+/// use extism_convert::{Error, FromBytes, FromBytesOwned};
+///
+/// // Custom serialization using `FromStr`
+/// struct StringEnc<T>(T);
+/// impl<T: FromStr> FromBytesOwned for StringEnc<T> where Error: From<<T as FromStr>::Err> {
+///     fn from_bytes_owned(data: &[u8]) -> Result<Self, Error> {
+///         Ok(Self(str::from_utf8(data)?.parse()?))
+///     }
+/// }
+///
+/// #[derive(FromBytes, PartialEq, Debug)]
+/// #[encoding(StringEnc)]
+/// struct Struct {
+///     hello: String,
+/// }
+///
+/// impl FromStr for Struct {
+///     type Err = Infallible;
+///     fn from_str(s: &str) -> Result<Self, Infallible> {
+///         Ok(Self { hello: s.to_owned() })
+///     }
+/// }
+///
+/// assert_eq!(Struct::from_bytes(b"hi")?, Struct { hello: "hi".into() });
+/// # Ok::<(), extism_convert::Error>(())
+/// ```
 pub trait FromBytes<'a>: Sized {
    /// Decode a value from a slice of bytes
    fn from_bytes(data: &'a [u8]) -> Result<Self, Error>;
 }

-/// `FromBytesOwned` is similar to `FromBytes` but it doesn't borrow from the input slice.
-/// `FromBytes` is automatically implemented for all types that implement `FromBytesOwned`
+/// `FromBytesOwned` is similar to [`FromBytes`] but it doesn't borrow from the input slice.
+/// [`FromBytes`] is automatically implemented for all types that implement `FromBytesOwned`.
+///
+/// `FromBytesOwned` can be derived through [`#[derive(FromBytes)]`](FromBytes).
 pub trait FromBytesOwned: Sized {
    /// Decode a value from a slice of bytes, the resulting value should not borrow the input
    /// data.
@@ -98,3 +152,13 @@ impl<'a, T: FromBytes<'a>> FromBytes<'a> for std::io::Cursor<T> {
        Ok(std::io::Cursor::new(T::from_bytes(data)?))
    }
 }
+
+impl<'a, T: FromBytes<'a>> FromBytes<'a> for Option<T> {
+    fn from_bytes(data: &'a [u8]) -> Result<Self, Error> {
+        if data.is_empty() {
+            return Ok(None);
+        }
+
+        T::from_bytes(data).map(Some)
+    }
+}
--- a/convert/src/lib.rs
+++ b/convert/src/lib.rs
@@ -5,6 +5,9 @@
 //! similar to [axum extractors](https://docs.rs/axum/latest/axum/extract/index.html#intro) - they are
 //! implemented as a tuple struct with a single field that is meant to be extracted using pattern matching.

+// Makes proc-macros able to resolve `::extism_convert` correctly
+extern crate self as extism_convert;
+
 pub use anyhow::Error;

 mod encoding;
--- a/convert/src/tests.rs
+++ b/convert/src/tests.rs
@@ -20,6 +20,7 @@ fn roundtrip_json() {
 }

 #[test]
+#[cfg(feature = "msgpack")]
 fn roundtrip_msgpack() {
    let x = Testing {
        a: "foobar".to_string(),
@@ -37,3 +38,53 @@ fn roundtrip_base64() {
    let Base64(s): Base64<String> = FromBytes::from_bytes(bytes.as_bytes()).unwrap();
    assert_eq!(s, "this is a test");
 }
+
+#[test]
+fn rountrip_option() {
+    // `None` case
+    let e0: Option<Json<Testing>> = FromBytes::from_bytes(&[]).unwrap();
+    let b = e0.to_bytes().unwrap();
+    let e1: Option<Json<Testing>> = FromBytes::from_bytes(&b).unwrap();
+    assert!(e0.is_none());
+    assert_eq!(e0.is_none(), e1.is_none());
+
+    // `Some` case
+    let x = Testing {
+        a: "foobar".to_string(),
+        b: 123,
+        c: 456.7,
+    };
+    let bytes = Json(&x).to_bytes().unwrap();
+    let y: Option<Json<Testing>> = FromBytes::from_bytes(&bytes).unwrap();
+    let b = ToBytes::to_bytes(&y).unwrap();
+    let z: Option<Json<Testing>> = FromBytes::from_bytes(&b).unwrap();
+    assert_eq!(y.unwrap().0, z.unwrap().0);
+}
+
+#[cfg(all(feature = "raw", target_endian = "little"))]
+mod tests {
+    use crate::*;
+
+    #[test]
+    fn test_raw() {
+        #[derive(Debug, Clone, Copy, PartialEq)]
+        struct TestRaw {
+            a: i32,
+            b: f64,
+            c: bool,
+        }
+        unsafe impl bytemuck::Pod for TestRaw {}
+        unsafe impl bytemuck::Zeroable for TestRaw {}
+        let x = TestRaw {
+            a: 123,
+            b: 45678.91011,
+            c: true,
+        };
+        let raw = Raw(&x).to_bytes().unwrap();
+        let y = Raw::from_bytes(&raw).unwrap();
+        assert_eq!(&x, y.0);
+
+        let y: Result<Raw<[u8; std::mem::size_of::<TestRaw>()]>, Error> = Raw::from_bytes(&raw);
+        assert!(y.is_ok());
+    }
+}
--- a/convert/src/to_bytes.rs
+++ b/convert/src/to_bytes.rs
@@ -1,7 +1,58 @@
 use crate::*;

+pub use extism_convert_macros::ToBytes;
+
 /// `ToBytes` is used to define how a type should be encoded when working with
 /// Extism memory. It is used for plugin input and host function output.
+///
+/// `ToBytes` can be derived by delegating encoding to generic type implementing
+/// `ToBytes`, e.g., [`Json`], [`Msgpack`].
+///
+/// ```
+/// use extism_convert::{Json, ToBytes};
+/// use serde::Serialize;
+///
+/// #[derive(ToBytes, Serialize)]
+/// #[encoding(Json)]
+/// struct Struct {
+///     hello: String,
+/// }
+///
+/// assert_eq!(Struct { hello: "hi".into() }.to_bytes()?, br#"{"hello":"hi"}"#);
+/// # Ok::<(), extism_convert::Error>(())
+/// ```
+///
+/// But custom types can also be used, as long as they are new-types with a single
+/// generic argument, i.e., `Type<T>(T)`, that implement `ToBytes` for the struct.
+///
+/// ```
+/// use extism_convert::{Error, ToBytes};
+///
+/// // Custom serialization using `ToString`
+/// struct StringEnc<T>(T);
+/// impl<T: ToString> ToBytes<'_> for StringEnc<&T> {
+///     type Bytes = String;
+///     
+///     fn to_bytes(&self) -> Result<String, Error> {
+///         Ok(self.0.to_string())
+///     }
+/// }
+///
+/// #[derive(ToBytes)]
+/// #[encoding(StringEnc)]
+/// struct Struct {
+///     hello: String,
+/// }
+///
+/// impl ToString for Struct {
+///    fn to_string(&self) -> String {
+///        self.hello.clone()     
+///    }
+/// }
+///
+/// assert_eq!(Struct { hello: "hi".into() }.to_bytes()?, b"hi");
+/// # Ok::<(), Error>(())
+/// ```
 pub trait ToBytes<'a> {
    /// A configurable byte slice representation, allows any type that implements `AsRef<[u8]>`
    type Bytes: AsRef<[u8]>;
@@ -100,3 +151,26 @@ impl<'a, T: ToBytes<'a>> ToBytes<'a> for &'a T {
        <T as ToBytes>::to_bytes(self)
    }
 }
+
+impl<'a, T: ToBytes<'a>> ToBytes<'a> for Option<T> {
+    type Bytes = Vec<u8>;
+
+    fn to_bytes(&self) -> Result<Self::Bytes, Error> {
+        match self {
+            Some(x) => x.to_bytes().map(|x| x.as_ref().to_vec()),
+            None => Ok(vec![]),
+        }
+    }
+}
+
+#[test]
+fn test() {
+    use extism_convert::{Json, ToBytes};
+    use serde::Serialize;
+
+    #[derive(ToBytes, Serialize)]
+    #[encoding(Json)]
+    struct Struct {
+        hello: String,
+    }
+}
--- a/kernel/.cargo/config.toml
+++ b/kernel/.cargo/config.toml
--- a/kernel/.gitignore
+++ b/kernel/.gitignore
@@ -0,0 +1,3 @@
+owi-out
+*.wat
+proofs
--- a/kernel/Cargo.toml
+++ b/kernel/Cargo.toml
@@ -5,6 +5,10 @@ edition = "2021"

 [dependencies]

+[dev-dependencies]
+wasm-bindgen-test = "0.3.39"
+owi = {git = "https://github.com/dylibso/owi-rs"}
+
 [features]
 default = ["bounds-checking"]
 bounds-checking = []
@@ -12,4 +16,4 @@ bounds-checking = []
 [workspace]
 members = [
  "."
-]
+]
--- a/kernel/build.sh
+++ b/kernel/build.sh
@@ -1,5 +1,7 @@
 #!/usr/bin/env bash

+set -e
+
 export CARGO_FLAGS=""

 while getopts d flag
@@ -17,6 +19,9 @@ done

 cargo build --package extism-runtime-kernel --bin extism-runtime --release --target wasm32-unknown-unknown $CARGO_FLAGS
 cp target/wasm32-unknown-unknown/release/extism-runtime.wasm .
-wasm-strip extism-runtime.wasm
-mv extism-runtime.wasm ../runtime/src/extism-runtime.wasm

+wasm-tools parse extism-context.wat -o extism-context.wasm
+wasm-merge --enable-reference-types ./extism-runtime.wasm runtime extism-context.wasm context -o ../runtime/src/extism-runtime.wasm
+rm extism-context.wasm
+rm extism-runtime.wasm
+wasm-strip ../runtime/src/extism-runtime.wasm
--- a/kernel/examples/alloc_length.rs
+++ b/kernel/examples/alloc_length.rs
@@ -0,0 +1,21 @@
+#![no_main]
+#![no_std]
+use extism_runtime_kernel::*;
+use owi::*;
+
+main!({
+    let n = alloc(1024);
+
+    let x = u64();
+    assume(x > 0);
+
+    let m = alloc(x);
+
+    // 1. Length should equal `x` while active
+    assert(length(m) == x);
+
+    // 2. Length should equal `0` after free
+    free(m); // Free the block
+    assert(length(m) == 0);
+    free(n);
+});
--- a/kernel/examples/error.rs
+++ b/kernel/examples/error.rs
@@ -0,0 +1,24 @@
+#![no_main]
+#![no_std]
+use extism_runtime_kernel::*;
+use owi::*;
+
+main!({
+    let x = u64();
+    let n = u64();
+    let m = u64();
+    assume(x > 0);
+    assume(n > 0);
+    assume(m > 0);
+
+    alloc(n);
+    alloc(m);
+    let n = alloc(x);
+    assert(error_get() == 0);
+
+    error_set(n);
+    assert(error_get() == n);
+    alloc(m);
+    error_set(0);
+    assert(error_get() == 0);
+});
--- a/kernel/examples/load_store.rs
+++ b/kernel/examples/load_store.rs
@@ -0,0 +1,17 @@
+#![no_main]
+#![no_std]
+use extism_runtime_kernel::*;
+use owi::*;
+
+main!({
+    let x = u64();
+    assume(x > 0);
+
+    let m = alloc(x);
+    assert(length(m) == x);
+    for i in 0..x {
+        store_u8(m + i, i as u8);
+        assert(load_u8(m + i) == i as u8);
+    }
+    free(m);
+});
--- a/kernel/examples/reuse.rs
+++ b/kernel/examples/reuse.rs
@@ -0,0 +1,39 @@
+#![no_main]
+#![no_std]
+use extism_runtime_kernel::*;
+use owi::*;
+
+main!({
+    let x = u64();
+    assume(x > 0);
+
+    let y = u64();
+    assume(y > 0);
+
+    let mut tmp = 0;
+
+    for _ in 0..y {
+        let m = alloc(x);
+        if tmp == 0 {
+            tmp = m;
+        } else {
+            // Check that the existing block is being re-used
+            assert(m == tmp);
+        }
+
+        assert(length(m) == x);
+        free(m); // Free the block
+    }
+
+    let y = u64();
+    assume(y == x + 1);
+    let n = alloc(y);
+    assert(n > tmp);
+
+    let z = u64();
+    assume(z <= x);
+    assume(x - z < 32);
+    assume(z > 0);
+    let p = alloc(z);
+    assert(p == tmp);
+});
--- a/kernel/extism-context.wat
+++ b/kernel/extism-context.wat
@@ -0,0 +1,3 @@
+(module
+  (global (export "extism_context") (mut externref) (ref.null extern))
+)
--- a/kernel/src/bin/extism-runtime.rs
+++ b/kernel/src/bin/extism-runtime.rs
@@ -1,9 +1,9 @@
-#![no_main]
 #![no_std]
+#![no_main]

 pub use extism_runtime_kernel::*;

-#[cfg(target_arch = "wasm32")]
+#[cfg(all(target_arch = "wasm32", not(test)))]
 #[panic_handler]
 fn panic(_info: &core::panic::PanicInfo) -> ! {
    core::arch::wasm32::unreachable()
--- a/kernel/src/lib.rs
+++ b/kernel/src/lib.rs
@@ -175,7 +175,7 @@ impl MemoryRoot {
        core::ptr::write_bytes(
            self.blocks.as_mut_ptr() as *mut u8,
            MemoryStatus::Unused as u8,
-            self_position as usize,
+            self_position as usize - core::mem::size_of::<MemoryRoot>(),
        );

        // Clear extism runtime metadata
@@ -198,8 +198,8 @@ impl MemoryRoot {
    fn pointer_in_bounds_fast(p: Pointer) -> bool {
        // Similar to `pointer_in_bounds` but less accurate on the upper bound. This uses the total memory size,
        // instead of checking `MemoryRoot::length`
-        let end = core::arch::wasm32::memory_size(0) << 16;
-        p >= core::mem::size_of::<Self>() as Pointer && p <= end as Pointer
+        let end = (core::arch::wasm32::memory_size(0) as u64) << 16;
+        p >= core::mem::size_of::<Self>() as Pointer && p <= end as u64
    }

    // Find a block that is free to use, this can be a new block or an existing freed block. The `self_position` argument
@@ -228,7 +228,7 @@ impl MemoryRoot {
            if status == MemoryStatus::Free as u8 && b.size >= length as usize {
                // Split block if there is too much excess
                if b.size - length as usize >= 128 {
-                    b.size -= length as usize;
+                    b.size -= length as usize + core::mem::size_of::<MemoryBlock>();
                    b.used = 0;

                    let block1 = b.data.as_mut_ptr().add(b.size) as *mut MemoryBlock;
@@ -270,12 +270,13 @@ impl MemoryRoot {

        // Get the number of bytes available
        let mem_left = self_length - self_position - core::mem::size_of::<MemoryRoot>() as u64;
+        let length_with_block = length + core::mem::size_of::<MemoryBlock>() as u64;

        // When the allocation is larger than the number of bytes available
        // we will need to try to grow the memory
-        if length >= mem_left {
+        if length_with_block >= mem_left {
            // Calculate the number of pages needed to cover the remaining bytes
-            let npages = num_pages(length - mem_left);
+            let npages = num_pages(length_with_block - mem_left);
            let x = core::arch::wasm32::memory_grow(0, npages);
            if x == usize::MAX {
                return None;
@@ -574,3 +575,78 @@ pub unsafe fn error_get() -> Handle {
 pub unsafe fn memory_bytes() -> u64 {
    MemoryRoot::new().length.load(Ordering::Acquire)
 }
+
+#[cfg(test)]
+mod test {
+    use crate::*;
+    use wasm_bindgen_test::*;
+
+    // See https://github.com/extism/extism/pull/659
+    #[wasm_bindgen_test]
+    fn test_659() {
+        unsafe {
+            // Warning: These offsets will need to change if we adjust the kernel memory layout at all
+            reset();
+            assert_eq!(alloc(1065), 77);
+            assert_eq!(alloc(288), 1154);
+            assert_eq!(alloc(128), 1454);
+            assert_eq!(length(1154), 288);
+            assert_eq!(length(1454), 128);
+            free(1454);
+            assert_eq!(alloc(213), 1594);
+            length_unsafe(1594);
+            assert_eq!(alloc(511), 1819);
+            assert_eq!(alloc(4), 1454);
+            assert_eq!(length(1454), 4);
+            assert_eq!(length(1819), 511);
+            assert_eq!(alloc(13), 2342);
+            assert_eq!(length(2342), 13);
+            assert_eq!(alloc(336), 2367);
+            assert_eq!(alloc(1077), 2715);
+            assert_eq!(length(2367), 336);
+            assert_eq!(length(2715), 1077);
+            free(2715);
+            assert_eq!(alloc(1094), 3804);
+            length_unsafe(3804);
+
+            // Allocate 4 bytes, expect to receive address 3788
+            assert_eq!(alloc(4), 3788);
+
+            assert_eq!(alloc(4), 3772);
+            assert_eq!(length(3772), 4);
+
+            // Address 3788 has not been freed yet, so expect it to have 4 bytes allocated
+            assert_eq!(length(3788), 4);
+        }
+    }
+
+    #[wasm_bindgen_test]
+    fn test_oom() {
+        let size = 1024 * 1024 * 5;
+
+        let mut last = 0;
+        for _ in 0..1024 {
+            unsafe {
+                let ptr = alloc(size);
+                last = ptr;
+                if ptr == 0 {
+                    break;
+                }
+                assert_eq!(length(ptr), size);
+            }
+        }
+
+        assert_eq!(last, 0);
+    }
+
+    #[wasm_bindgen_test]
+    fn test_sym() {
+        unsafe {
+            reset();
+            let a = alloc(47);
+            let b = alloc(20);
+            assert_eq!(length(a), 47);
+            assert_eq!(length(b), 20);
+        }
+    }
+}
--- a/kernel/test.sh
+++ b/kernel/test.sh
@@ -0,0 +1,5 @@
+# install wasm-bindgen-cli to get wasm-bindgen-runner if it is not installed yet
+which wasm-bindgen-test-runner 1>/dev/null || cargo install -f wasm-bindgen-cli
+
+# run tests with the wasm-bindgen-runner
+CARGO_TARGET_WASM32_UNKNOWN_UNKNOWN_RUNNER=wasm-bindgen-test-runner cargo test --release --target=wasm32-unknown-unknown
--- a/kernel/verify.sh
+++ b/kernel/verify.sh
@@ -0,0 +1,23 @@
+#!/usr/bin/env bash
+
+set -e
+
+OUT_DIR=./target/wasm32-unknown-unknown/release/examples/
+get_proof() {
+   cp "$OUT_DIR/$1.wasm" "./proofs/$1.wasm"
+}
+
+cargo build --examples --release --target wasm32-unknown-unknown --no-default-features
+
+mkdir -p proofs
+get_proof alloc_length
+get_proof load_store
+get_proof reuse
+get_proof error
+
+for proof in $(ls proofs/*.wasm); do
+  echo "Checking $proof"
+  owi  conc "$proof" $@
+  echo
+  echo "---"
+done
--- a/libextism/.clang-format
+++ b/libextism/.clang-format
@@ -0,0 +1,2 @@
+BasedOnStyle: LLVM
+IndentWidth: 2
--- a/libextism/API.md
+++ b/libextism/API.md
@@ -14,7 +14,9 @@ Create a new plugin.
 - `functions`: is an array of `ExtismFunction*`
 - `n_functions`: is the number of functions
 - `with_wasi`: enables/disables WASI
- `errmsg`: error message during plugin creation
+- `errmsg`: error message during plugin creation, this should be freed with
+  `extism_plugin_new_error_free`
+

 ```c
 ExtismPlugin extism_plugin_new(const uint8_t *wasm,
@@ -24,6 +26,17 @@ ExtismPlugin extism_plugin_new(const uint8_t *wasm,
                               bool with_wasi,
                               char **errmsg);
 ```
+---
+
+### `extism_plugin_new_error_free`
+
+Frees the error message returned when creating a plugin
+
+```c
+void extism_plugin_new_error_free(char *err);
+```
+
+---

 ### `extism_plugin_free`

@@ -33,6 +46,8 @@ Remove a plugin from the registry and free associated memory.
 void extism_plugin_free(ExtismPlugin *plugin);
 ```

+---
+
 ### `extism_plugin_config`

 Update plugin config values, this will merge with the existing values.
@@ -43,6 +58,8 @@ bool extism_plugin_config(ExtismPlugin *plugin,
                          ExtismSize json_size);
 ```

+---
+
 ### `extism_plugin_function_exists`

 Returns true if `func_name` exists.
@@ -52,6 +69,8 @@ bool extism_plugin_function_exists(ExtismPlugin *plugin,
                                   const char *func_name);
 ```

+---
+
 ### `extism_plugin_call`

 Call a function.
@@ -59,6 +78,8 @@ Call a function.
 - `data`: is the input data
 - `data_len`: is the length of `data`

+Returns `0` when the call is successful.
+
 ```c
 int32_t extism_plugin_call(ExtismPlugin *plugin,
                           const char *func_name,
@@ -66,6 +87,28 @@ int32_t extism_plugin_call(ExtismPlugin *plugin,
                           ExtismSize data_len);
 ```

+---
+
+### `extism_plugin_call_with_host_context`
+
+Call a function with additional host context that can be accessed from inside host functions.
+- `func_name`: is the function to call
+- `data`: is the input data
+- `data_len`: is the length of `data`
+- `host_ctx`: an opaque pointer that can be accessed in host functions
+
+Returns `0` when the call is successful.
+
+```c
+int32_t extism_plugin_call_with_host_context(ExtismPlugin *plugin,
+                           const char *func_name,
+                           const uint8_t *data,
+                           ExtismSize data_len,
+                           void *host_ctx);
+```
+
+---
+
 ### `extism_plugin_error`

 Get the error associated with a `Plugin`
@@ -74,6 +117,8 @@ Get the error associated with a `Plugin`
 const char *extism_plugin_error(ExtismPlugin *plugin);
 ```

+---
+
 ### `extism_plugin_output_length`

 Get the length of a plugin's output data.
@@ -82,6 +127,8 @@ Get the length of a plugin's output data.
 ExtismSize extism_plugin_output_length(ExtismPlugin *plugin);
 ```

+---
+
 ### `extism_plugin_output_data`

 Get the plugin's output data.
@@ -90,6 +137,8 @@ Get the plugin's output data.
 const uint8_t *extism_plugin_output_data(ExtismPlugin *plugin);
 ```

+---
+
 ### `extism_plugin_reset`

 Reset the Extism runtime, this will invalidate all allocated memory.
@@ -98,6 +147,8 @@ Reset the Extism runtime, this will invalidate all allocated memory.
 bool extism_plugin_reset(ExtismPlugin *plugin);
 ```

+---
+
 ### `extism_log_file`

 Set log file and level.
@@ -106,6 +157,8 @@ Set log file and level.
 bool extism_log_file(const char *filename, const char *log_level);
 ```

+---
+
 ### `extism_log_custom`

 Enable a custom log handler, this will buffer logs until `extism_log_drain`
@@ -115,6 +168,8 @@ is called Log level should be one of: info, error, trace, debug, warn
 bool extism_log_custom(const char *log_level);
 ```

+---
+
 ### `extism_log_drain`

 Calls the provided callback function for each buffered log line.
@@ -124,6 +179,8 @@ This is only needed when `extism_log_custom` is used.
 void extism_log_drain(void (*handler)(const char *, uintptr_t));
 ```

+---
+
 ### `extism_version`

 Get the Extism version string.
@@ -132,6 +189,8 @@ Get the Extism version string.
 const char *extism_version(void);
 ```

+---
+
 ### `extism_current_plugin_memory`

 Returns a pointer to the memory of the currently running plugin
@@ -140,6 +199,19 @@ Returns a pointer to the memory of the currently running plugin
 uint8_t *extism_current_plugin_memory(ExtismCurrentPlugin *plugin);
 ```

+---
+
+### `extism_current_plugin_host_context`
+
+Get access to the host context, passed in using `extism_plugin_call_with_host_context`
+
+```c
+void *extism_current_plugin_host_context(ExtismCurrentPlugin *plugin);
+```
+
+---
+
+
 ### `extism_current_plugin_memory_alloc`

 Allocate a memory block in the currently running plugin
@@ -148,6 +220,8 @@ Allocate a memory block in the currently running plugin
 uint64_t extism_current_plugin_memory_alloc(ExtismCurrentPlugin *plugin, ExtismSize n);
 ```

+---
+
 ### `extism_current_plugin_memory_length`

 Get the length of an allocated block
@@ -156,6 +230,8 @@ Get the length of an allocated block
 ExtismSize extism_current_plugin_memory_length(ExtismCurrentPlugin *plugin, ExtismSize n);
 ```

+---
+
 ### `extism_current_plugin_memory_free`

 Free an allocated memory block
@@ -164,6 +240,8 @@ Free an allocated memory block
 void extism_current_plugin_memory_free(ExtismCurrentPlugin *plugin, uint64_t ptr);
 ```

+---
+
 ### `extism_function_new`
 Create a new host function
 - `name`: function name, this should be valid UTF-8
@@ -190,6 +268,8 @@ ExtismFunction *extism_function_new(const char *name,
                                    void (*free_user_data)(void *_));
 ```

+---
+
 ### `extism_function_set_namespace`

 Set the namespace of an `ExtismFunction`
@@ -198,6 +278,8 @@ Set the namespace of an `ExtismFunction`
 void extism_function_set_namespace(ExtismFunction *ptr, const char *namespace_);
 ```

+---
+
 ### `extism_function_free`

 Free an `ExtismFunction`
@@ -206,6 +288,8 @@ Free an `ExtismFunction`
 void extism_function_free(ExtismFunction *ptr);
 ```

+---
+
 ### `extism_plugin_cancel_handle`

 Get handle for plugin cancellation
@@ -214,6 +298,8 @@ Get handle for plugin cancellation
 const ExtismCancelHandle *extism_plugin_cancel_handle(const ExtismPlugin *plugin);
 ```

+---
+
 ### `extism_plugin_cancel`

 Cancel a running plugin from another thread
@@ -222,12 +308,14 @@ Cancel a running plugin from another thread
 bool extism_plugin_cancel(const ExtismCancelHandle *handle);
 ```

+---
+
 ## Type definitions:

 ### `ExtismPlugin`

 ```c
-typedef int32_t ExtismPlugin;
+typedef struct ExtismPlugin ExtismPlugin;
 ```

 ### `ExtismSize`
@@ -259,3 +347,5 @@ typedef struct ExtismCurrentPlugin ExtismCurrentPlugin;
 ```c
 typedef struct ExtismCancelHandle ExtismCancelHandle;
 ```
+
+
--- a/libextism/Makefile
+++ b/libextism/Makefile
@@ -4,7 +4,7 @@ build:

 .PHONY: static
 static:
-	$(CC) -g -o example example.c -l:libextism.a -lm
+	$(CC) -g -o example example.c -l:libextism.a -lm -lpthread

 # if needed, set PKG_CONFIG_PATH= to the directory with extism*.pc installed
 LDFLAGS=`pkg-config --libs extism`
--- a/libextism/README.md
+++ b/libextism/README.md
@@ -56,7 +56,6 @@ Since you may not have an Extism plug-in on hand to test, let's load a demo plug
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
-#include <unistd.h>

 void print_plugin_output(ExtismPlugin *plugin, int32_t rc){
  if (rc != EXTISM_SUCCESS) {
@@ -64,9 +63,9 @@ void print_plugin_output(ExtismPlugin *plugin, int32_t rc){
    return;
  }

-  size_t outlen = extism_plugin_output_length(plugin);
+  ExtismSize outlen = extism_plugin_output_length(plugin);
  const uint8_t *out = extism_plugin_output_data(plugin);
-  write(STDOUT_FILENO, out, outlen);
+  fwrite(out, 1, outlen, stdout);
 }

 int main(void) {
@@ -106,9 +105,9 @@ if (rc != EXTISM_SUCCESS) {
  exit(2);
 }

-size_t outlen = extism_plugin_output_length(plugin);
+ExtismSize outlen = extism_plugin_output_length(plugin);
 const uint8_t *out = extism_plugin_output_data(plugin);
-write(STDOUT_FILENO, out, outlen);
+fwrite(out, 1, outlen, stdout);
 ```

 Will print
@@ -171,7 +170,6 @@ We want to expose two functions to our plugin, `kv_write(key: String, value: Byt
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
-#include <unistd.h>

 // A stubbed out KV store
 typedef struct KVStore KVStore;
@@ -184,14 +182,14 @@ extern const uint32_t fake_kv_store_get(KVStore *kv, const char *key,

 // Our host functions to access the fake KV store
 void kv_get(ExtismCurrentPlugin *plugin, const ExtismVal *inputs,
-            size_t ninputs, ExtismVal *outputs, size_t noutputs,
+            ExtismSize ninputs, ExtismVal *outputs, ExtismSize noutputs,
            void *userdata) {
  // Cast the userdata pointer
  KVStore *kv = (KVStore *)userdata;

  // Get the offset to the key in the plugin memory
  uint64_t offs = inputs[0].v.i64;
-  size_t keylen = extism_current_plugin_memory_length(plugin, offs);
+  ExtismSize keylen = extism_current_plugin_memory_length(plugin, offs);

  // Allocate a new block to return
  uint64_t outoffs =
@@ -205,23 +203,23 @@ void kv_get(ExtismCurrentPlugin *plugin, const ExtismVal *inputs,
  *(uint64_t *)(extism_current_plugin_memory(plugin) + outoffs) = value;

  // Return the offset to our allocated block
-  outputs[0].t = PTR;
+  outputs[0].t = EXTISM_PTR;
  outputs[0].v.i64 = outoffs;
 }

 void kv_set(ExtismCurrentPlugin *plugin, const ExtismVal *inputs,
-            size_t ninputs, ExtismVal *outputs, size_t noutputs,
+            ExtismSize ninputs, ExtismVal *outputs, ExtismSize noutputs,
            void *userdata) {
  // Cast the userdata pointer
  KVStore *kv = (KVStore *)userdata;

  // Get the offset to the key in the plugin memory
  uint64_t keyoffs = inputs[0].v.i64;
-  size_t keylen = extism_current_plugin_memory_length(plugin, keyoffs);
+  ExtismSize keylen = extism_current_plugin_memory_length(plugin, keyoffs);

  // Get the offset to the value in the plugin memory
  uint64_t valueoffs = inputs[1].v.i64;
-  size_t valuelen = extism_current_plugin_memory_length(plugin, valueoffs);
+  ExtismSize valuelen = extism_current_plugin_memory_length(plugin, valueoffs);

  // Set key => value
  fake_kv_store_set(
@@ -234,13 +232,13 @@ int main(void) {
  const char *manifest = "{\"wasm\": [{\"url\": "
                         "\"https://github.com/extism/plugins/releases/latest/"
                         "download/count_vowels_kvstore.wasm\"}]}";
-  const ExtismValType kv_get_inputs[] = {PTR};
-  const ExtismValType kv_get_outputs[] = {PTR};
+  const ExtismValType kv_get_inputs[] = {EXTISM_PTR};
+  const ExtismValType kv_get_outputs[] = {EXTISM_PTR};
  ExtismFunction *kv_get_fn = extism_function_new(
      "kv_get", kv_get_inputs, 1, kv_get_outputs, 1, kv_get, kv, NULL);

-  const ExtismValType kv_set_inputs[] = {PTR};
-  const ExtismValType kv_set_outputs[] = {PTR};
+  const ExtismValType kv_set_inputs[] = {EXTISM_PTR};
+  const ExtismValType kv_set_outputs[] = {EXTISM_PTR};
  ExtismFunction *kv_set_fn = extism_function_new(
      "kv_set", kv_set_inputs, 1, kv_set_outputs, 1, kv_set, kv, NULL);
  const ExtismFunction *functions[] = {kv_get_fn};
@@ -288,5 +286,3 @@ print_plugin_output(plugin, extism_plugin_call(plugin, "count_vowels",
 # => Writing value=6 from key=count-vowels"
 # => {"count": 3, "total": 6, "vowels": "aeiouAEIOU"}
 ```
-
-
--- a/libextism/example.c
+++ b/libextism/example.c
@@ -9,7 +9,7 @@
 #include <sys/stat.h>
 #include <unistd.h>

-void log_handler(const char *line, uintptr_t length) {
+void log_handler(const char *line, ExtismSize length) {
  fwrite(line, length, 1, stderr);
 }

@@ -63,8 +63,8 @@ int main(int argc, char *argv[]) {

  size_t len = 0;
  uint8_t *data = read_file("../wasm/code-functions.wasm", &len);
-  ExtismValType inputs[] = {PTR};
-  ExtismValType outputs[] = {PTR};
+  ExtismValType inputs[] = {EXTISM_PTR};
+  ExtismValType outputs[] = {EXTISM_PTR};
  ExtismFunction *f =
      extism_function_new("hello_world", inputs, 1, outputs, 1, hello_world,
                          "Hello, again!", free_data);
--- a/libextism/extism-static.pc.in
+++ b/libextism/extism-static.pc.in
@@ -5,6 +5,6 @@ includedir=${prefix}/include
 Version: 1.0.0
 Name: Extism
 Description: The framework for building with WebAssembly (wasm).
-Libs: -L${libdir} -l:libextism.a
-Libs.private: -lm
+Libs: ${libdir}/libextism.a
+Libs.private: -lm -lpthread
 Cflags: -I${includedir}
--- a/libextism/extism.pc.in
+++ b/libextism/extism.pc.in
@@ -6,5 +6,5 @@ Version: 1.0.0
 Name: Extism
 Description: The framework for building with WebAssembly (wasm).
 Libs: -L${libdir} -lextism
-Libs.private: -lm
+Libs.private: -lm -lpthread
 Cflags: -I${includedir}
--- a/manifest/Cargo.toml
+++ b/manifest/Cargo.toml
@@ -10,7 +10,7 @@ version.workspace = true

 [dependencies]
 serde = { version = "1", features = ["derive"] }
-base64 = "~0.21"
+base64 = "~0.22"
 schemars = { version = "0.8", optional = true }
 serde_json = "1"

--- a/manifest/schema.json
+++ b/manifest/schema.json
@@ -1,9 +1,11 @@
 {
  "$schema": "http://json-schema.org/draft-07/schema#",
  "title": "Manifest",
+  "description": "The `Manifest` type is used to configure the runtime and specify how to load modules.",
  "type": "object",
  "properties": {
    "allowed_hosts": {
+      "description": "Specifies which hosts may be accessed via HTTP, if this is empty then no hosts may be accessed. Wildcards may be used.",
      "default": null,
      "type": [
        "array",
@@ -14,6 +16,7 @@
      }
    },
    "allowed_paths": {
+      "description": "Specifies which paths should be made available on disk when using WASI. This is a mapping from the path on disk to the path it should be available inside the plugin. For example, `\".\": \"/tmp\"` would mount the current directory as `/tmp` inside the module",
      "default": null,
      "type": [
        "object",
@@ -24,6 +27,7 @@
      }
    },
    "config": {
+      "description": "Config values are made accessible using the PDK `extism_config_get` function",
      "default": {},
      "type": "object",
      "additionalProperties": {
@@ -31,8 +35,11 @@
      }
    },
    "memory": {
+      "description": "Memory options",
      "default": {
-        "max_pages": null
+        "max_http_response_bytes": null,
+        "max_pages": null,
+        "max_var_bytes": null
      },
      "allOf": [
        {
@@ -41,6 +48,8 @@
      ]
    },
    "timeout_ms": {
+      "description": "The plugin timeout in milliseconds",
+      "default": null,
      "type": [
        "integer",
        "null"
@@ -49,6 +58,7 @@
      "minimum": 0.0
    },
    "wasm": {
+      "description": "WebAssembly modules, the `main` module should be named `main` or listed last",
      "default": [],
      "type": "array",
      "items": {
@@ -56,35 +66,63 @@
      }
    }
  },
+  "additionalProperties": false,
  "definitions": {
    "MemoryOptions": {
+      "description": "Configure memory settings",
      "type": "object",
      "properties": {
+        "max_http_response_bytes": {
+          "description": "The maximum number of bytes allowed in an HTTP response",
+          "default": null,
+          "type": [
+            "integer",
+            "null"
+          ],
+          "format": "uint64",
+          "minimum": 0.0
+        },
        "max_pages": {
+          "description": "The max number of WebAssembly pages that should be allocated",
          "type": [
            "integer",
            "null"
          ],
          "format": "uint32",
          "minimum": 0.0
+        },
+        "max_var_bytes": {
+          "description": "The maximum number of bytes allowed to be used by plugin vars. Setting this to 0 will disable Extism vars. The default value is 1mb.",
+          "default": 1048576,
+          "type": [
+            "integer",
+            "null"
+          ],
+          "format": "uint64",
+          "minimum": 0.0
        }
-      }
+      },
+      "additionalProperties": false
    },
    "Wasm": {
+      "description": "The `Wasm` type specifies how to access a WebAssembly module",
      "anyOf": [
        {
+          "description": "From disk",
          "type": "object",
          "required": [
            "path"
          ],
          "properties": {
            "hash": {
+              "description": "Module hash, if the data loaded from disk or via HTTP doesn't match an error will be raised",
              "type": [
                "string",
                "null"
              ]
            },
            "name": {
+              "description": "Module name, this is used by Extism to determine which is the `main` module",
              "type": [
                "string",
                "null"
@@ -93,45 +131,72 @@
            "path": {
              "type": "string"
            }
-          }
+          },
+          "additionalProperties": false
        },
        {
+          "description": "From memory",
          "type": "object",
          "required": [
            "data"
          ],
          "properties": {
            "data": {
-              "type": "string",
-              "format": "string"
+              "type": [
+                "string",
+                "object"
+              ],
+              "required": [
+                "len",
+                "ptr"
+              ],
+              "properties": {
+                "len": {
+                  "type": "integer",
+                  "format": "uint64",
+                  "minimum": 0.0
+                },
+                "ptr": {
+                  "type": "integer",
+                  "format": "uint64",
+                  "minimum": 0.0
+                }
+              },
+              "additionalProperties": false
            },
            "hash": {
+              "description": "Module hash, if the data loaded from disk or via HTTP doesn't match an error will be raised",
              "type": [
                "string",
                "null"
              ]
            },
            "name": {
+              "description": "Module name, this is used by Extism to determine which is the `main` module",
              "type": [
                "string",
                "null"
              ]
            }
-          }
+          },
+          "additionalProperties": false
        },
        {
+          "description": "Via HTTP",
          "type": "object",
          "required": [
            "url"
          ],
          "properties": {
            "hash": {
+              "description": "Module hash, if the data loaded from disk or via HTTP doesn't match an error will be raised",
              "type": [
                "string",
                "null"
              ]
            },
            "headers": {
+              "description": "Request headers",
              "default": {},
              "type": "object",
              "additionalProperties": {
@@ -139,21 +204,25 @@
              }
            },
            "method": {
+              "description": "Request method",
              "type": [
                "string",
                "null"
              ]
            },
            "name": {
+              "description": "Module name, this is used by Extism to determine which is the `main` module",
              "type": [
                "string",
                "null"
              ]
            },
            "url": {
+              "description": "The request URL",
              "type": "string"
            }
-          }
+          },
+          "additionalProperties": false
        }
      ]
    }
--- a/manifest/src/lib.rs
+++ b/manifest/src/lib.rs
@@ -10,8 +10,45 @@ pub type ManifestMemory = MemoryOptions;
 #[serde(deny_unknown_fields)]
 pub struct MemoryOptions {
    /// The max number of WebAssembly pages that should be allocated
-    #[serde(alias = "max")]
    pub max_pages: Option<u32>,
+
+    /// The maximum number of bytes allowed in an HTTP response
+    #[serde(default)]
+    pub max_http_response_bytes: Option<u64>,
+
+    /// The maximum number of bytes allowed to be used by plugin vars. Setting this to 0
+    /// will disable Extism vars. The default value is 1mb.
+    #[serde(default = "default_var_bytes")]
+    pub max_var_bytes: Option<u64>,
+}
+
+impl MemoryOptions {
+    /// Create an empty `MemoryOptions` value
+    pub fn new() -> Self {
+        Default::default()
+    }
+
+    /// Set max pages
+    pub fn with_max_pages(mut self, pages: u32) -> Self {
+        self.max_pages = Some(pages);
+        self
+    }
+
+    /// Set max HTTP response size
+    pub fn with_max_http_response_bytes(mut self, bytes: u64) -> Self {
+        self.max_http_response_bytes = Some(bytes);
+        self
+    }
+
+    /// Set max size of Extism vars
+    pub fn with_max_var_bytes(mut self, bytes: u64) -> Self {
+        self.max_var_bytes = Some(bytes);
+        self
+    }
+}
+
+fn default_var_bytes() -> Option<u64> {
+    Some(1024 * 1024)
 }

 /// Generic HTTP request structure
@@ -24,7 +61,6 @@ pub struct HttpRequest {

    /// Request headers
    #[serde(default)]
-    #[serde(alias = "header")]
    pub headers: std::collections::BTreeMap<String, String>,

    /// Request method
@@ -111,8 +147,8 @@ pub enum Wasm {

    /// From memory
    Data {
-        #[serde(with = "base64")]
-        #[cfg_attr(feature = "json_schema", schemars(schema_with = "base64_schema"))]
+        #[serde(with = "wasmdata")]
+        #[cfg_attr(feature = "json_schema", schemars(schema_with = "wasmdata_schema"))]
        data: Vec<u8>,
        #[serde(flatten)]
        meta: WasmMetadata,
@@ -195,11 +231,25 @@ impl Wasm {
    }
 }

+#[derive(Default, Debug, Clone, PartialEq, serde::Serialize, serde::Deserialize)]
+#[cfg_attr(feature = "json_schema", derive(schemars::JsonSchema))]
+#[serde(deny_unknown_fields)]
+struct DataPtrLength {
+    ptr: u64,
+    len: u64,
+}
+
 #[cfg(feature = "json_schema")]
-fn base64_schema(gen: &mut schemars::gen::SchemaGenerator) -> schemars::schema::Schema {
+fn wasmdata_schema(gen: &mut schemars::gen::SchemaGenerator) -> schemars::schema::Schema {
    use schemars::{schema::SchemaObject, JsonSchema};
    let mut schema: SchemaObject = <String>::json_schema(gen).into();
-    schema.format = Some("string".to_owned());
+    let objschema: SchemaObject = <DataPtrLength>::json_schema(gen).into();
+    let types = schemars::schema::SingleOrVec::<schemars::schema::InstanceType>::Vec(vec![
+        schemars::schema::InstanceType::String,
+        schemars::schema::InstanceType::Object,
+    ]);
+    schema.instance_type = Some(types);
+    schema.object = objschema.object;
    schema.into()
 }

@@ -211,6 +261,7 @@ pub struct Manifest {
    /// WebAssembly modules, the `main` module should be named `main` or listed last
    #[serde(default)]
    pub wasm: Vec<Wasm>,
+
    /// Memory options
    #[serde(default)]
    pub memory: MemoryOptions,
@@ -230,7 +281,7 @@ pub struct Manifest {
    #[serde(default)]
    pub allowed_paths: Option<BTreeMap<PathBuf, PathBuf>>,

-    /// The plugin timeout, by default this is set to 30s
+    /// The plugin timeout in milliseconds
    #[serde(default)]
    pub timeout_ms: Option<u64>,
 }
@@ -335,10 +386,12 @@ impl Manifest {
    }
 }

-mod base64 {
+mod wasmdata {
+    use crate::DataPtrLength;
    use base64::{engine::general_purpose, Engine as _};
    use serde::{Deserialize, Serialize};
    use serde::{Deserializer, Serializer};
+    use std::slice;

    pub fn serialize<S: Serializer>(v: &Vec<u8>, s: S) -> Result<S::Ok, S::Error> {
        let base64 = general_purpose::STANDARD.encode(v.as_slice());
@@ -346,10 +399,22 @@ mod base64 {
    }

    pub fn deserialize<'de, D: Deserializer<'de>>(d: D) -> Result<Vec<u8>, D::Error> {
-        let base64 = String::deserialize(d)?;
-        general_purpose::STANDARD
-            .decode(base64.as_bytes())
-            .map_err(serde::de::Error::custom)
+        #[derive(Deserialize)]
+        #[serde(untagged)]
+        enum WasmDataTypes {
+            String(String),
+            DataPtrLength(DataPtrLength),
+        }
+        Ok(match WasmDataTypes::deserialize(d)? {
+            WasmDataTypes::String(string) => general_purpose::STANDARD
+                .decode(string.as_bytes())
+                .map_err(serde::de::Error::custom)?,
+            WasmDataTypes::DataPtrLength(ptrlen) => {
+                let slice =
+                    unsafe { slice::from_raw_parts(ptrlen.ptr as *const u8, ptrlen.len as usize) };
+                slice.to_vec()
+            }
+        })
    }
 }

--- a/runtime/Cargo.toml
+++ b/runtime/Cargo.toml
@@ -9,20 +9,20 @@ repository.workspace = true
 version.workspace = true

 [dependencies]
-wasmtime = ">= 14.0.0, < 17.0.0"
-wasmtime-wasi = ">= 14.0.0, < 17.0.0"
+wasmtime = ">= 20.0.0, < 22.0.0"
+wasi-common = ">= 20.0.0, < 22.0.0"
 anyhow = "1"
 serde = {version = "1", features = ["derive"]}
 serde_json = "1"
 toml = "0.8"
 sha2 = "0.10"
 tracing = "0.1"
-tracing-subscriber = {version = "0.3", features = ["std", "env-filter", "fmt"]}
+tracing-subscriber = {version = "0.3.18", features = ["std", "env-filter", "fmt"]}
 url = "2"
 glob = "0.3"
 ureq = {version = "2.5", optional=true}
 extism-manifest = { workspace = true }
-extism-convert = { workspace = true }
+extism-convert = { workspace = true, features = ["extism-path"] }
 uuid = { version = "1", features = ["v4"] }
 libc = "0.2"

@@ -37,6 +37,8 @@ cbindgen = { version = "0.26", default-features = false }

 [dev-dependencies]
 criterion = "0.5.1"
+quickcheck = "1"
+rand = "0.8.5"

 [[bench]]
 name = "bench"
--- a/runtime/README.md
+++ b/runtime/README.md
@@ -12,7 +12,7 @@ To use the `extism` crate, you can add it to your Cargo file:

 ```toml
 [dependencies]
-extism = "^1.0.0-rc3"
+extism = "1.2.0"
 ```

 ## Environment variables
@@ -201,7 +201,7 @@ fn main() {
 }
 ```

-> *Note*: In order to write host functions you should get familiar with the methods on the [Extism::CurrentPlugin](https://docs.rs/extism/latest/extism/struct.CurrentPlugin.html) and [Extism::CurrentPlugin](https://docs.rs/extism/latest/extism/struct.UserData.html) types.
+> *Note*: In order to write host functions you should get familiar with the methods on the [CurrentPlugin](https://docs.rs/extism/latest/extism/struct.CurrentPlugin.html) and [UserData](https://docs.rs/extism/latest/extism/enum.UserData.html) types.

 Now we can invoke the event:

--- a/runtime/build.rs
+++ b/runtime/build.rs
@@ -7,7 +7,7 @@ fn main() {
 #define EXTISM_SUCCESS 0

 /** An alias for I64 to signify an Extism pointer */
-#define PTR I64
+#define EXTISM_PTR ExtismValType_I64
 ";
    if let Ok(x) = cbindgen::Builder::new()
        .with_crate(".")
--- a/runtime/examples/linking.rs
+++ b/runtime/examples/linking.rs
@@ -2,6 +2,8 @@ use extism::*;

 fn main() {
    let manifest = Manifest::new([
+        // upper.wat provides an export called `host_reflect` that takes a string
+        // and returns the same string uppercased
        Wasm::File {
            // See https://github.com/extism/plugins/blob/main/upper.wat
            path: "../wasm/upper.wasm".into(),
@@ -10,6 +12,9 @@ fn main() {
                hash: None,
            },
        },
+        // reflect expects host_reflect to be imported: https://github.com/extism/plugins/blob/e5578bbbdd87f9936a0a8d36df629768b2eff6bb/reflect/src/lib.rs#L5
+        // Extism will link the export from upper.wat to the import of reflect.rs at runtime so it
+        // can call it
        Wasm::File {
            // See https://github.com/extism/plugins/tree/main/reflect
            path: "../wasm/reflect.wasm".into(),
--- a/runtime/extism.h
+++ b/runtime/extism.h
@@ -10,7 +10,7 @@
 #define EXTISM_SUCCESS 0

 /** An alias for I64 to signify an Extism pointer */
-#define PTR I64
+#define EXTISM_PTR ExtismValType_I64


 /**
@@ -20,31 +20,31 @@ typedef enum {
  /**
   * Signed 32 bit integer.
   */
-  I32,
+  ExtismValType_I32,
  /**
   * Signed 64 bit integer.
   */
-  I64,
+  ExtismValType_I64,
  /**
   * Floating point 32 bit integer.
   */
-  F32,
+  ExtismValType_F32,
  /**
   * Floating point 64 bit integer.
   */
-  F64,
+  ExtismValType_F64,
  /**
   * A 128 bit number.
   */
-  V128,
+  ExtismValType_V128,
  /**
   * A reference to a Wasm function.
   */
-  FuncRef,
+  ExtismValType_FuncRef,
  /**
   * A reference to opaque data in the Wasm instance.
   */
-  ExternRef,
+  ExtismValType_ExternRef,
 } ExtismValType;

 /**
@@ -113,6 +113,12 @@ extern "C" {
 */
 const uint8_t *extism_plugin_id(ExtismPlugin *plugin);

+/**
+ * Get the current plugin's associated host context data. Returns null if call was made without
+ * host context.
+ */
+void *extism_current_plugin_host_context(ExtismCurrentPlugin *plugin);
+
 /**
 * Returns a pointer to the memory of the currently running plugin
 * NOTE: this should only be called from host functions.
@@ -231,6 +237,20 @@ int32_t extism_plugin_call(ExtismPlugin *plugin,
                           const uint8_t *data,
                           ExtismSize data_len);

+/**
+ * Call a function with host context.
+ *
+ * `func_name`: is the function to call
+ * `data`: is the input data
+ * `data_len`: is the length of `data`
+ * `host_context`: a pointer to context data that will be available in host functions
+ */
+int32_t extism_plugin_call_with_host_context(ExtismPlugin *plugin,
+                                             const char *func_name,
+                                             const uint8_t *data,
+                                             ExtismSize data_len,
+                                             void *host_context);
+
 /**
 * Get the error associated with a `Plugin`
 */
--- a/runtime/src/current_plugin.rs
+++ b/runtime/src/current_plugin.rs
@@ -15,6 +15,7 @@ pub struct CurrentPlugin {
    pub(crate) available_pages: Option<u32>,
    pub(crate) memory_limiter: Option<MemoryLimiter>,
    pub(crate) id: uuid::Uuid,
+    pub(crate) start_time: std::time::Instant,
 }

 unsafe impl Send for CurrentPlugin {}
@@ -62,6 +63,11 @@ impl wasmtime::ResourceLimiter for MemoryLimiter {
 }

 impl CurrentPlugin {
+    /// Gets `Plugin`'s ID
+    pub fn id(&self) -> uuid::Uuid {
+        self.id
+    }
+
    /// Get a `MemoryHandle` from a memory offset
    pub fn memory_handle(&mut self, offs: u64) -> Option<MemoryHandle> {
        if offs == 0 {
@@ -181,6 +187,23 @@ impl CurrentPlugin {
        anyhow::bail!("{} unable to locate extism memory", self.id)
    }

+    pub fn host_context<T: Clone + 'static>(&mut self) -> Result<T, Error> {
+        let (linker, mut store) = self.linker_and_store();
+        let Some(Extern::Global(xs)) = linker.get(&mut store, EXTISM_ENV_MODULE, "extism_context")
+        else {
+            anyhow::bail!("unable to locate an extism kernel global: extism_context",)
+        };
+
+        let Val::ExternRef(Some(xs)) = xs.get(&mut store) else {
+            anyhow::bail!("expected extism_context to be an externref value",)
+        };
+
+        match xs.data(&mut store)?.downcast_ref::<T>().cloned() {
+            Some(xs) => Ok(xs.clone()),
+            None => anyhow::bail!("could not downcast extism_context",),
+        }
+    }
+
    pub fn memory_alloc(&mut self, n: u64) -> Result<MemoryHandle, Error> {
        if n == 0 {
            return Ok(MemoryHandle {
@@ -288,25 +311,29 @@ impl CurrentPlugin {
        id: uuid::Uuid,
    ) -> Result<Self, Error> {
        let wasi = if wasi {
-            let auth = wasmtime_wasi::ambient_authority();
-            let mut ctx = wasmtime_wasi::WasiCtxBuilder::new();
-            for (k, v) in manifest.config.iter() {
-                ctx.env(k, v)?;
-            }
+            let auth = wasi_common::sync::ambient_authority();
+            let random = wasi_common::sync::random_ctx();
+            let clocks = wasi_common::sync::clocks_ctx();
+            let sched = wasi_common::sync::sched_ctx();
+            let table = wasi_common::Table::new();
+            let ctx = wasi_common::WasiCtx::new(random, clocks, sched, table);

            if let Some(a) = &manifest.allowed_paths {
                for (k, v) in a.iter() {
-                    let d = wasmtime_wasi::Dir::open_ambient_dir(k, auth)?;
-                    ctx.preopened_dir(d, v)?;
+                    let file = Box::new(wasi_common::sync::dir::Dir::from_cap_std(
+                        wasi_common::sync::Dir::open_ambient_dir(k, auth)?,
+                    ));
+                    ctx.push_preopened_dir(file, v)?;
                }
            }

            // Enable WASI output, typically used for debugging purposes
            if std::env::var("EXTISM_ENABLE_WASI_OUTPUT").is_ok() {
-                ctx.inherit_stdout().inherit_stderr();
+                ctx.set_stderr(Box::new(wasi_common::sync::stdio::stderr()));
+                ctx.set_stdout(Box::new(wasi_common::sync::stdio::stdout()));
            }

-            Some(Wasi { ctx: ctx.build() })
+            Some(Wasi { ctx })
        } else {
            None
        };
@@ -331,6 +358,7 @@ impl CurrentPlugin {
            available_pages,
            memory_limiter,
            id,
+            start_time: std::time::Instant::now(),
        })
    }

@@ -441,6 +469,18 @@ impl CurrentPlugin {
        let length = self.memory_length(offs).unwrap_or_default();
        (offs, length)
    }
+
+    /// Returns the remaining time before a plugin will timeout, or
+    /// `None` if no timeout is configured in the manifest
+    pub fn time_remaining(&self) -> Option<std::time::Duration> {
+        if let Some(x) = &self.manifest.timeout_ms {
+            let elapsed = &self.start_time.elapsed().as_millis();
+            let ms_left = x.saturating_sub(*elapsed as u64);
+            return Some(std::time::Duration::from_millis(ms_left));
+        }
+
+        None
+    }
 }

 impl Internal for CurrentPlugin {
@@ -452,14 +492,6 @@ impl Internal for CurrentPlugin {
        unsafe { &mut *self.store }
    }

-    fn linker(&self) -> &Linker<CurrentPlugin> {
-        unsafe { &*self.linker }
-    }
-
-    fn linker_mut(&mut self) -> &mut Linker<CurrentPlugin> {
-        unsafe { &mut *self.linker }
-    }
-
    fn linker_and_store(&mut self) -> (&mut Linker<CurrentPlugin>, &mut Store<CurrentPlugin>) {
        unsafe { (&mut *self.linker, &mut *self.store) }
    }
--- a/runtime/src/extism-runtime.wasm
+++ b/runtime/src/extism-runtime.wasm
--- a/runtime/src/function.rs
+++ b/runtime/src/function.rs
@@ -4,6 +4,7 @@ use wasmtime::Caller;
 use crate::{error, trace, CurrentPlugin, Error};

 /// An enumeration of all possible value types in WebAssembly.
+/// cbindgen:prefix-with-name
 #[derive(Debug, Clone, Hash, Eq, PartialEq)]
 #[repr(C)]
 pub enum ValType {
@@ -37,8 +38,13 @@ impl From<wasmtime::ValType> for ValType {
            F32 => ValType::F32,
            F64 => ValType::F64,
            V128 => ValType::V128,
-            FuncRef => ValType::FuncRef,
-            ExternRef => ValType::ExternRef,
+            Ref(t) => {
+                if t.heap_type().is_func() {
+                    ValType::FuncRef
+                } else {
+                    ValType::ExternRef
+                }
+            }
        }
    }
 }
@@ -52,8 +58,8 @@ impl From<ValType> for wasmtime::ValType {
            F32 => wasmtime::ValType::F32,
            F64 => wasmtime::ValType::F64,
            V128 => wasmtime::ValType::V128,
-            FuncRef => wasmtime::ValType::FuncRef,
-            ExternRef => wasmtime::ValType::ExternRef,
+            FuncRef => wasmtime::ValType::FUNCREF,
+            ExternRef => wasmtime::ValType::EXTERNREF,
        }
    }
 }
@@ -71,7 +77,9 @@ pub struct CPtr {
 /// UserDataHandle is an untyped version of `UserData` that is stored inside `Function` to keep a live reference.
 #[derive(Clone)]
 pub(crate) enum UserDataHandle {
+    #[allow(dead_code)]
    C(Arc<CPtr>),
+    #[allow(dead_code)]
    Rust(Arc<std::sync::Mutex<dyn std::any::Any>>),
 }

@@ -168,8 +176,8 @@ pub struct Function {
    /// Module name
    pub(crate) namespace: Option<String>,

-    /// Function type
-    pub(crate) ty: wasmtime::FuncType,
+    pub(crate) params: Vec<ValType>,
+    pub(crate) results: Vec<ValType>,

    /// Function handle
    pub(crate) f: Arc<FunctionInner>,
@@ -182,8 +190,8 @@ impl Function {
    /// Create a new host function
    pub fn new<T: 'static, F>(
        name: impl Into<String>,
-        args: impl IntoIterator<Item = ValType>,
-        returns: impl IntoIterator<Item = ValType>,
+        params: impl IntoIterator<Item = ValType>,
+        results: impl IntoIterator<Item = ValType>,
        user_data: UserData<T>,
        f: F,
    ) -> Function
@@ -195,13 +203,13 @@ impl Function {
    {
        let data = user_data.clone();
        let name = name.into();
-        let args = args.into_iter().map(wasmtime::ValType::from);
-        let returns = returns.into_iter().map(wasmtime::ValType::from);
-        let ty = wasmtime::FuncType::new(args, returns);
-        trace!("Creating function {name}: type={ty:?}");
+        let params = params.into_iter().collect();
+        let results = results.into_iter().collect();
+        trace!("Creating function {name}: params={params:?}, results={results:?}");
        Function {
            name,
-            ty,
+            params,
+            results,
            f: Arc::new(
                move |mut caller: Caller<_>, inp: &[Val], outp: &mut [Val]| {
                    let x = data.clone();
@@ -216,6 +224,22 @@ impl Function {
        }
    }

+    pub(crate) fn ty(&self, engine: &wasmtime::Engine) -> wasmtime::FuncType {
+        wasmtime::FuncType::new(
+            engine,
+            self.params
+                .iter()
+                .cloned()
+                .map(wasmtime::ValType::from)
+                .collect::<Vec<_>>(),
+            self.results
+                .iter()
+                .cloned()
+                .map(wasmtime::ValType::from)
+                .collect::<Vec<_>>(),
+        )
+    }
+
    /// Host function name
    pub fn name(&self) -> &str {
        &self.name
@@ -239,9 +263,14 @@ impl Function {
        self
    }

-    /// Get function type
-    pub fn ty(&self) -> &wasmtime::FuncType {
-        &self.ty
+    /// Get param types
+    pub fn params(&self) -> &[ValType] {
+        &self.params
+    }
+
+    /// Get result types
+    pub fn results(&self) -> &[ValType] {
+        &self.results
    }
 }

--- a/runtime/src/internal.rs
+++ b/runtime/src/internal.rs
@@ -3,7 +3,7 @@ use crate::*;
 /// WASI context
 pub struct Wasi {
    /// wasi
-    pub ctx: wasmtime_wasi::WasiCtx,
+    pub ctx: wasi_common::WasiCtx,
 }

 /// InternalExt provides a unified way of acessing `memory`, `store` and `internal` values
@@ -12,10 +12,6 @@ pub(crate) trait Internal {

    fn store_mut(&mut self) -> &mut Store<CurrentPlugin>;

-    fn linker(&self) -> &Linker<CurrentPlugin>;
-
-    fn linker_mut(&mut self) -> &mut Linker<CurrentPlugin>;
-
    fn linker_and_store(&mut self) -> (&mut Linker<CurrentPlugin>, &mut Store<CurrentPlugin>);

    fn current_plugin(&self) -> &CurrentPlugin {
--- a/runtime/src/lib.rs
+++ b/runtime/src/lib.rs
@@ -1,8 +1,12 @@
+// Makes proc-macros able to resolve `::extism` correctly
+extern crate self as extism;
+
 pub(crate) use extism_convert::*;
 pub(crate) use std::collections::BTreeMap;
 use std::str::FromStr;
 pub(crate) use wasmtime::*;

+#[doc(inline)]
 pub use extism_convert as convert;

 pub use anyhow::Error;
--- a/runtime/src/manifest.rs
+++ b/runtime/src/manifest.rs
@@ -47,9 +47,13 @@ fn to_module(engine: &Engine, wasm: &extism_manifest::Wasm) -> Result<(String, M
            let name = meta.name.as_deref().unwrap_or(MAIN_KEY).to_string();

            // Load file
-            let mut buf = Vec::new();
-            let mut file = std::fs::File::open(path)?;
-            file.read_to_end(&mut buf)?;
+            let buf = std::fs::read(path).map_err(|err| {
+                Error::msg(format!(
+                    "Unable to load Wasm file \"{}\": {}",
+                    path.display(),
+                    err.kind()
+                ))
+            })?;

            check_hash(&meta.hash, &buf)?;
            Ok((name, Module::new(engine, buf)?))
--- a/runtime/src/pdk.rs
+++ b/runtime/src/pdk.rs
@@ -97,19 +97,13 @@ pub(crate) fn var_set(
 ) -> Result<(), Error> {
    let data: &mut CurrentPlugin = caller.data_mut();

-    let mut size = 0;
-    for v in data.vars.values() {
-        size += v.len();
+    if data.manifest.memory.max_var_bytes.is_some_and(|x| x == 0) {
+        anyhow::bail!("Vars are disabled by this host")
    }

    let voffset = args!(input, 1, i64) as u64;
-
-    // If the store is larger than 100MB then stop adding things
-    if size > 1024 * 1024 * 100 && voffset != 0 {
-        return Err(Error::msg("Variable store is full"));
-    }
-
    let key_offs = args!(input, 0, i64) as u64;
+
    let key = {
        let handle = match data.memory_handle(key_offs) {
            Some(h) => h,
@@ -132,6 +126,22 @@ pub(crate) fn var_set(
        None => anyhow::bail!("invalid handle offset for var value: {voffset}"),
    };

+    let mut size = std::mem::size_of::<String>()
+        + std::mem::size_of::<Vec<u8>>()
+        + key.len()
+        + handle.length as usize;
+
+    for (k, v) in data.vars.iter() {
+        size += k.len();
+        size += v.len();
+        size += std::mem::size_of::<String>() + std::mem::size_of::<Vec<u8>>();
+    }
+
+    // If the store is larger than the configured size, or 1mb by default, then stop adding things
+    if size > data.manifest.memory.max_var_bytes.unwrap_or(1024 * 1024) as usize && voffset != 0 {
+        return Err(Error::msg("Variable store is full"));
+    }
+
    let value = data.memory_bytes(handle)?.to_vec();

    // Insert the value from memory into the `vars` map
@@ -207,6 +217,11 @@ pub(crate) fn http_request(
            r = r.set(k, v);
        }

+        // Set HTTP timeout to respect the manifest timeout
+        if let Some(remaining) = data.time_remaining() {
+            r = r.timeout(remaining);
+        }
+
        let res = if body_offset > 0 {
            let handle = match data.memory_handle(body_offset) {
                Some(h) => h,
@@ -226,20 +241,35 @@ pub(crate) fn http_request(
                Some(res.into_reader())
            }
            Err(e) => {
+                // Catch timeout and return
+                if let Some(d) = data.time_remaining() {
+                    if e.kind() == ureq::ErrorKind::Io && d.as_nanos() == 0 {
+                        anyhow::bail!("timeout");
+                    }
+                }
+                let msg = e.to_string();
                if let Some(res) = e.into_response() {
                    data.http_status = res.status();
                    Some(res.into_reader())
                } else {
-                    None
+                    return Err(Error::msg(msg));
                }
            }
        };

        if let Some(reader) = reader {
            let mut buf = Vec::new();
-            reader
-                .take(1024 * 1024 * 50) // TODO: make this limit configurable
-                .read_to_end(&mut buf)?;
+            let max = if let Some(max) = &data.manifest.memory.max_http_response_bytes {
+                reader.take(*max + 1).read_to_end(&mut buf)?;
+                *max
+            } else {
+                reader.take(1024 * 1024 * 50 + 1).read_to_end(&mut buf)?;
+                1024 * 1024 * 50
+            };
+
+            if buf.len() > max as usize {
+                anyhow::bail!("HTTP response exceeds the configured maximum number of bytes: {max}")
+            }

            let mem = data.memory_new(&buf)?;
            output[0] = Val::I64(mem.offset() as i64);
--- a/runtime/src/plugin.rs
+++ b/runtime/src/plugin.rs
@@ -1,4 +1,8 @@
-use std::{collections::BTreeMap, path::PathBuf};
+use std::{
+    any::Any,
+    collections::{BTreeMap, BTreeSet},
+    path::PathBuf,
+};

 use crate::*;

@@ -97,14 +101,6 @@ impl Internal for Plugin {
        &mut self.store
    }

-    fn linker(&self) -> &Linker<CurrentPlugin> {
-        &self.linker
-    }
-
-    fn linker_mut(&mut self) -> &mut Linker<CurrentPlugin> {
-        &mut self.linker
-    }
-
    fn linker_and_store(&mut self) -> (&mut Linker<CurrentPlugin>, &mut Store<CurrentPlugin>) {
        (&mut self.linker, &mut self.store)
    }
@@ -177,6 +173,112 @@ impl<'a> From<&'a Vec<u8>> for WasmInput<'a> {
    }
 }

+fn add_module<T: 'static>(
+    store: &mut Store<T>,
+    linker: &mut Linker<T>,
+    linked: &mut BTreeSet<String>,
+    modules: &BTreeMap<String, Module>,
+    name: String,
+    module: &Module,
+) -> Result<(), Error> {
+    if linked.contains(&name) {
+        return Ok(());
+    }
+
+    for import in module.imports() {
+        let module = import.module();
+
+        if module == EXTISM_ENV_MODULE && !matches!(import.ty(), ExternType::Func(_)) {
+            anyhow::bail!("linked modules cannot access non-function exports of extism kernel");
+        }
+
+        if !linked.contains(import.module()) {
+            if let Some(m) = modules.get(import.module()) {
+                add_module(
+                    store,
+                    linker,
+                    linked,
+                    modules,
+                    import.module().to_string(),
+                    m,
+                )?;
+            }
+        }
+    }
+
+    linker.module(store, name.as_str(), module)?;
+    linked.insert(name);
+
+    Ok(())
+}
+
+fn relink(
+    engine: &Engine,
+    mut store: &mut Store<CurrentPlugin>,
+    imports: &[Function],
+    modules: &BTreeMap<String, Module>,
+    with_wasi: bool,
+) -> Result<(InstancePre<CurrentPlugin>, Linker<CurrentPlugin>), Error> {
+    let mut linker = Linker::new(engine);
+    // Define PDK functions
+    macro_rules! add_funcs {
+            ($($name:ident($($args:expr),*) $(-> $($r:expr),*)?);* $(;)?) => {
+                $(
+                    let t = FuncType::new(&engine, [$($args),*], [$($($r),*)?]);
+                    linker.func_new(EXTISM_ENV_MODULE, stringify!($name), t, pdk::$name)?;
+                )*
+            };
+        }
+
+    // Add builtins
+    use wasmtime::ValType::*;
+    add_funcs!(
+        config_get(I64) -> I64;
+        var_get(I64) -> I64;
+        var_set(I64, I64);
+        http_request(I64, I64) -> I64;
+        http_status_code() -> I32;
+        log_warn(I64);
+        log_info(I64);
+        log_debug(I64);
+        log_error(I64);
+    );
+
+    let mut linked = BTreeSet::new();
+    linker.module(&mut store, EXTISM_ENV_MODULE, &modules[EXTISM_ENV_MODULE])?;
+    linked.insert(EXTISM_ENV_MODULE.to_string());
+
+    // If wasi is enabled then add it to the linker
+    if with_wasi {
+        wasi_common::sync::add_to_linker(&mut linker, |x: &mut CurrentPlugin| {
+            &mut x.wasi.as_mut().unwrap().ctx
+        })?;
+    }
+
+    for f in imports {
+        let name = f.name();
+        let ns = f.namespace().unwrap_or(EXTISM_USER_MODULE);
+        unsafe {
+            linker.func_new(ns, name, f.ty(engine).clone(), &*(f.f.as_ref() as *const _))?;
+        }
+    }
+
+    for (name, module) in modules.iter() {
+        add_module(
+            store,
+            &mut linker,
+            &mut linked,
+            modules,
+            name.clone(),
+            module,
+        )?;
+    }
+
+    let main = &modules[MAIN_KEY];
+    let instance_pre = linker.instantiate_pre(main)?;
+    Ok((instance_pre, linker))
+}
+
 impl Plugin {
    /// Create a new plugin from a Manifest or WebAssembly module, and host functions. The `with_wasi`
    /// parameter determines whether or not the module should be executed with WASI enabled.
@@ -203,7 +305,8 @@ impl Plugin {
            .coredump_on_trap(debug_options.coredump.is_some())
            .profiler(debug_options.profiling_strategy)
            .wasm_tail_call(true)
-            .wasm_function_references(true);
+            .wasm_function_references(true)
+            .wasm_gc(true);

        match cache_dir {
            Some(None) => (),
@@ -239,57 +342,9 @@ impl Plugin {
        );
        store.set_epoch_deadline(1);

-        let mut linker = Linker::new(&engine);
-        linker.allow_shadowing(true);
+        let imports: Vec<Function> = imports.into_iter().collect();
+        let (instance_pre, linker) = relink(&engine, &mut store, &imports, &modules, with_wasi)?;

-        // If wasi is enabled then add it to the linker
-        if with_wasi {
-            wasmtime_wasi::add_to_linker(&mut linker, |x: &mut CurrentPlugin| {
-                &mut x.wasi.as_mut().unwrap().ctx
-            })?;
-        }
-
-        let main = &modules[MAIN_KEY];
-        for (name, module) in modules.iter() {
-            if name != MAIN_KEY {
-                linker.module(&mut store, name, module)?;
-            }
-        }
-
-        let mut imports: Vec<_> = imports.into_iter().collect();
-        // Define PDK functions
-        macro_rules! add_funcs {
-            ($($name:ident($($args:expr),*) $(-> $($r:expr),*)?);* $(;)?) => {
-                $(
-                    let t = FuncType::new([$($args),*], [$($($r),*)?]);
-                    linker.func_new(EXTISM_ENV_MODULE, stringify!($name), t, pdk::$name)?;
-                )*
-            };
-        }
-
-        // Add builtins
-        use wasmtime::ValType::*;
-        add_funcs!(
-            config_get(I64) -> I64;
-            var_get(I64) -> I64;
-            var_set(I64, I64);
-            http_request(I64, I64) -> I64;
-            http_status_code() -> I32;
-            log_warn(I64);
-            log_info(I64);
-            log_debug(I64);
-            log_error(I64);
-        );
-
-        for f in &mut imports {
-            let name = f.name().to_string();
-            let ns = f.namespace().unwrap_or(EXTISM_USER_MODULE);
-            unsafe {
-                linker.func_new(ns, &name, f.ty().clone(), &*(f.f.as_ref() as *const _))?;
-            }
-        }
-
-        let instance_pre = linker.instantiate_pre(main)?;
        let timer_tx = Timer::tx();
        let mut plugin = Plugin {
            modules,
@@ -327,6 +382,7 @@ impl Plugin {
        if self.store_needs_reset {
            let engine = self.store.engine().clone();
            let internal = self.current_plugin_mut();
+            let with_wasi = internal.wasi.is_some();
            self.store = Store::new(
                &engine,
                CurrentPlugin::new(
@@ -337,6 +393,16 @@ impl Plugin {
                )?,
            );
            self.store.set_epoch_deadline(1);
+
+            let (instance_pre, linker) = relink(
+                &engine,
+                &mut self.store,
+                &self._functions,
+                &self.modules,
+                with_wasi,
+            )?;
+            self.linker = linker;
+            self.instance_pre = instance_pre;
            let store = &mut self.store as *mut _;
            let linker = &mut self.linker as *mut _;
            let current_plugin = self.current_plugin_mut();
@@ -347,14 +413,7 @@ impl Plugin {
                    .limiter(|internal| internal.memory_limiter.as_mut().unwrap());
            }

-            let main = &self.modules[MAIN_KEY];
-            for (name, module) in self.modules.iter() {
-                if name != MAIN_KEY {
-                    self.linker.module(&mut self.store, name, module)?;
-                }
-            }
            self.instantiations = 0;
-            self.instance_pre = self.linker.instantiate_pre(main)?;
            **instance_lock = None;
            self.store_needs_reset = false;
        }
@@ -403,12 +462,28 @@ impl Plugin {
    pub fn function_exists(&mut self, function: impl AsRef<str>) -> bool {
        self.modules[MAIN_KEY]
            .get_export(function.as_ref())
-            .map(|x| x.func().is_some())
+            .map(|x| {
+                if let Some(f) = x.func() {
+                    let (params, mut results) = (f.params(), f.results());
+                    match (params.len(), results.len()) {
+                        (0, 1) => matches!(results.next(), Some(wasmtime::ValType::I32)),
+                        (0, 0) => true,
+                        _ => false,
+                    }
+                } else {
+                    false
+                }
+            })
            .unwrap_or(false)
    }

    // Store input in memory and re-initialize `Internal` pointer
-    pub(crate) fn set_input(&mut self, input: *const u8, mut len: usize) -> Result<(), Error> {
+    pub(crate) fn set_input(
+        &mut self,
+        input: *const u8,
+        mut len: usize,
+        host_context: Option<Rooted<ExternRef>>,
+    ) -> Result<(), Error> {
        self.output = Output::default();
        self.clear_error()?;
        let id = self.id.to_string();
@@ -442,6 +517,13 @@ impl Plugin {
            )?;
        }

+        if let Some(Extern::Global(ctxt)) =
+            self.linker
+                .get(&mut self.store, EXTISM_ENV_MODULE, "extism_context")
+        {
+            ctxt.set(&mut self.store, Val::ExternRef(host_context))?;
+        }
+
        Ok(())
    }

@@ -534,7 +616,7 @@ impl Plugin {
                    if let Some(reactor_init) = reactor_init {
                        reactor_init.call(&mut store, &[], &mut [])?;
                    }
-                    let mut results = vec![Val::null(); init.ty(&store).results().len()];
+                    let mut results = vec![Val::I32(0); init.ty(&store).results().len()];
                    init.call(
                        &mut store,
                        &[Val::I32(0), Val::I32(0)],
@@ -619,6 +701,7 @@ impl Plugin {
        lock: &mut std::sync::MutexGuard<Option<Instance>>,
        name: impl AsRef<str>,
        input: impl AsRef<[u8]>,
+        host_context: Option<Rooted<ExternRef>>,
    ) -> Result<i32, (Error, i32)> {
        let name = name.as_ref();
        let input = input.as_ref();
@@ -632,7 +715,7 @@ impl Plugin {

        self.instantiate(lock).map_err(|e| (e, -1))?;

-        self.set_input(input.as_ptr(), input.len())
+        self.set_input(input.as_ptr(), input.len(), host_context)
            .map_err(|x| (x, -1))?;

        let func = match self.get_func(lock, name) {
@@ -663,9 +746,10 @@ impl Plugin {
            .expect("Timer should start");
        self.store.epoch_deadline_trap();
        self.store.set_epoch_deadline(1);
+        self.current_plugin_mut().start_time = std::time::Instant::now();

        // Call the function
-        let mut results = vec![wasmtime::Val::null(); n_results];
+        let mut results = vec![wasmtime::Val::I32(0); n_results];
        let mut res = func.call(self.store_mut(), &[], results.as_mut_slice());

        // Stop timer
@@ -750,13 +834,7 @@ impl Plugin {
                    }
                }

-                let wasi_exit_code = e
-                    .downcast_ref::<wasmtime_wasi::I32Exit>()
-                    .map(|e| e.0)
-                    .or_else(|| {
-                        e.downcast_ref::<wasmtime_wasi::preview2::I32Exit>()
-                            .map(|e| e.0)
-                    });
+                let wasi_exit_code = e.downcast_ref::<wasi_common::I32Exit>().map(|e| e.0);
                if let Some(exit_code) = wasi_exit_code {
                    debug!(
                        plugin = self.id.to_string(),
@@ -819,7 +897,33 @@ impl Plugin {
        let lock = self.instance.clone();
        let mut lock = lock.lock().unwrap();
        let data = input.to_bytes()?;
-        self.raw_call(&mut lock, name, data)
+        self.raw_call(&mut lock, name, data, None)
+            .map_err(|e| e.0)
+            .and_then(move |rc| {
+                if rc != 0 {
+                    Err(Error::msg(format!("Returned non-zero exit code: {rc}")))
+                } else {
+                    self.output()
+                }
+            })
+    }
+
+    pub fn call_with_host_context<'a, 'b, T, U, C>(
+        &'b mut self,
+        name: impl AsRef<str>,
+        input: T,
+        host_context: C,
+    ) -> Result<U, Error>
+    where
+        T: ToBytes<'a>,
+        U: FromBytes<'b>,
+        C: Any + Send + Sync + 'static,
+    {
+        let lock = self.instance.clone();
+        let mut lock = lock.lock().unwrap();
+        let data = input.to_bytes()?;
+        let ctx = ExternRef::new(&mut self.store, host_context)?;
+        self.raw_call(&mut lock, name, data, Some(ctx))
            .map_err(|e| e.0)
            .and_then(move |_| self.output())
    }
@@ -838,7 +942,7 @@ impl Plugin {
        let lock = self.instance.clone();
        let mut lock = lock.lock().unwrap();
        let data = input.to_bytes().map_err(|e| (e, -1))?;
-        self.raw_call(&mut lock, name, data)
+        self.raw_call(&mut lock, name, data, None)
            .and_then(move |_| self.output().map_err(|e| (e, -1)))
    }

--- a/runtime/src/sdk.rs
+++ b/runtime/src/sdk.rs
@@ -41,9 +41,9 @@ pub type ExtismFunctionType = extern "C" fn(
 /// Log drain callback
 pub type ExtismLogDrainFunctionType = extern "C" fn(data: *const std::ffi::c_char, size: Size);

-impl From<&wasmtime::Val> for ExtismVal {
-    fn from(value: &wasmtime::Val) -> Self {
-        match value.ty() {
+impl ExtismVal {
+    fn from_val(value: &wasmtime::Val, ctx: impl AsContext) -> Self {
+        match value.ty(ctx) {
            wasmtime::ValType::I32 => ExtismVal {
                t: ValType::I32,
                v: ValUnion {
@@ -84,6 +84,24 @@ pub unsafe extern "C" fn extism_plugin_id(plugin: *mut Plugin) -> *const u8 {
    plugin.id.as_bytes().as_ptr()
 }

+/// Get the current plugin's associated host context data. Returns null if call was made without
+/// host context.
+#[no_mangle]
+pub unsafe extern "C" fn extism_current_plugin_host_context(
+    plugin: *mut CurrentPlugin,
+) -> *mut std::ffi::c_void {
+    if plugin.is_null() {
+        return std::ptr::null_mut();
+    }
+
+    let plugin = &mut *plugin;
+    if let Ok(CVoidContainer(ptr)) = plugin.host_context::<CVoidContainer>() {
+        ptr
+    } else {
+        std::ptr::null_mut()
+    }
+}
+
 /// Returns a pointer to the memory of the currently running plugin
 /// NOTE: this should only be called from host functions.
 #[no_mangle]
@@ -200,7 +218,11 @@ pub unsafe extern "C" fn extism_function_new(
        output_types.clone(),
        user_data,
        move |plugin, inputs, outputs, user_data| {
-            let inputs: Vec<_> = inputs.iter().map(ExtismVal::from).collect();
+            let store = &*plugin.store;
+            let inputs: Vec<_> = inputs
+                .iter()
+                .map(|x| ExtismVal::from_val(x, store))
+                .collect();
            let mut output_tmp: Vec<_> = output_types
                .iter()
                .map(|t| ExtismVal {
@@ -389,20 +411,6 @@ pub unsafe extern "C" fn extism_plugin_config(
            }
        };

-    let wasi = &mut plugin.current_plugin_mut().wasi;
-    if let Some(Wasi { ctx, .. }) = wasi {
-        for (k, v) in json.iter() {
-            match v {
-                Some(v) => {
-                    let _ = ctx.push_env(k, v);
-                }
-                None => {
-                    let _ = ctx.push_env(k, "");
-                }
-            }
-        }
-    }
-
    let id = plugin.id;
    let config = &mut plugin.current_plugin_mut().manifest.config;
    for (k, v) in json.into_iter() {
@@ -464,6 +472,31 @@ pub unsafe extern "C" fn extism_plugin_call(
    func_name: *const c_char,
    data: *const u8,
    data_len: Size,
+) -> i32 {
+    extism_plugin_call_with_host_context(plugin, func_name, data, data_len, std::ptr::null_mut())
+}
+
+#[derive(Clone)]
+#[repr(transparent)]
+struct CVoidContainer(*mut std::ffi::c_void);
+
+// "You break it, you buy it."
+unsafe impl Send for CVoidContainer {}
+unsafe impl Sync for CVoidContainer {}
+
+/// Call a function with host context.
+///
+/// `func_name`: is the function to call
+/// `data`: is the input data
+/// `data_len`: is the length of `data`
+/// `host_context`: a pointer to context data that will be available in host functions
+#[no_mangle]
+pub unsafe extern "C" fn extism_plugin_call_with_host_context(
+    plugin: *mut Plugin,
+    func_name: *const c_char,
+    data: *const u8,
+    data_len: Size,
+    host_context: *mut std::ffi::c_void,
 ) -> i32 {
    if plugin.is_null() {
        return -1;
@@ -485,8 +518,11 @@ pub unsafe extern "C" fn extism_plugin_call(
        name
    );
    let input = std::slice::from_raw_parts(data, data_len as usize);
-    let res = plugin.raw_call(&mut lock, name, input);
-
+    let r = match ExternRef::new(&mut plugin.store, CVoidContainer(host_context)) {
+        Err(e) => return plugin.return_error(&mut lock, e, -1),
+        Ok(x) => x,
+    };
+    let res = plugin.raw_call(&mut lock, name, input, Some(r));
    match res {
        Err((e, rc)) => plugin.return_error(&mut lock, e, rc),
        Ok(x) => x,
@@ -671,7 +707,7 @@ unsafe fn set_log_buffer(filter: &str) -> Result<(), Error> {
 /// Calls the provided callback function for each buffered log line.
 /// This is only needed when `extism_log_custom` is used.
 pub unsafe extern "C" fn extism_log_drain(handler: ExtismLogDrainFunctionType) {
-    if let Some(buf) = &mut LOG_BUFFER {
+    if let Some(buf) = LOG_BUFFER.as_mut() {
        if let Ok(mut buf) = buf.buffer.lock() {
            for (line, len) in buf.drain(..) {
                handler(line.as_ptr(), len as u64);
--- a/runtime/src/tests/kernel.rs
+++ b/runtime/src/tests/kernel.rs
@@ -1,4 +1,5 @@
 use crate::*;
+use quickcheck::*;

 const KERNEL: &[u8] = include_bytes!("../extism-runtime.wasm");

@@ -319,3 +320,158 @@ fn test_load_input() {
    // Out of bounds should return 0
    assert_eq!(extism_input_load_u64(&mut store, instance, 123457), 0);
 }
+
+#[test]
+fn test_failed_quickcheck1() {
+    let (mut store, mut instance) = init_kernel_test();
+    let allocs = [
+        20622, 23162, 58594, 32421, 25928, 44611, 26318, 24455, 5798, 60202, 42126, 64928, 57832,
+        50888, 63256, 37562, 46334, 47985, 60836, 28132, 65535, 37800, 33150, 48768, 38457, 57249,
+        5734, 58587, 26294, 26653, 24519, 1,
+    ];
+
+    extism_reset(&mut store, &mut instance);
+    for a in allocs {
+        println!("Alloc: {a}");
+        let n = extism_alloc(&mut store, &mut instance, a);
+        if n == 0 {
+            continue;
+        }
+        assert_eq!(a, extism_length(&mut store, &mut instance, n));
+    }
+}
+
+#[test]
+fn test_failed_quickcheck2() {
+    let (mut store, mut instance) = init_kernel_test();
+    let allocs = [352054710, 1248853976, 2678441931, 14567928];
+
+    extism_reset(&mut store, &mut instance);
+    for a in allocs {
+        println!("Alloc: {a}");
+        let n = extism_alloc(&mut store, &mut instance, a);
+        if n == 0 {
+            continue;
+        }
+        assert_eq!(a, extism_length(&mut store, &mut instance, n));
+    }
+}
+
+quickcheck! {
+    fn check_alloc(amounts: Vec<u16>) -> bool {
+        let (mut store, mut instance) = init_kernel_test();
+        let instance = &mut instance;
+        for a in amounts {
+            let ptr = extism_alloc(&mut store, instance, a as u64);
+            if ptr == 0 || ptr == u64::MAX {
+                continue
+            }
+            if extism_length(&mut store, instance, ptr) != a as u64 {
+                return false
+            }
+        }
+
+        true
+    }
+}
+
+quickcheck! {
+    fn check_large_alloc(amounts: Vec<u32>) -> bool {
+        let (mut store, mut instance) = init_kernel_test();
+        let instance = &mut instance;
+        for a in amounts {
+            let ptr = extism_alloc(&mut store, instance, a as u64);
+            if ptr == 0 {
+                continue
+            }
+            let len = extism_length_unsafe(&mut store, instance, ptr);
+            if len != a as u64 {
+                return false
+            }
+        }
+
+        true
+    }
+}
+
+quickcheck! {
+    fn check_alloc_with_frees(amounts: Vec<u16>) -> bool {
+        let (mut store, mut instance) = init_kernel_test();
+        let instance = &mut instance;
+        let mut prev = 0;
+        for a in amounts {
+            let ptr = extism_alloc(&mut store, instance, a as u64);
+            if ptr == 0 {
+                continue
+            }
+            if extism_length(&mut store, instance, ptr) != a as u64  {
+                return false
+            }
+
+            if a % 2 == 0 {
+                extism_free(&mut store, instance, ptr);
+            } else if a % 3 == 0 {
+                extism_free(&mut store, instance, prev);
+            }
+
+            prev = ptr;
+        }
+
+        true
+    }
+}
+
+quickcheck! {
+    fn check_large_alloc_with_frees(amounts: Vec<u32>) -> bool {
+        let (mut store, mut instance) = init_kernel_test();
+        let instance = &mut instance;
+        let mut prev = 0;
+        for a in amounts {
+            let ptr = extism_alloc(&mut store, instance, a as u64);
+            if ptr == 0 || ptr == u64::MAX {
+                continue
+            }
+            if extism_length(&mut store, instance, ptr) != a as u64 {
+                return false
+            }
+            if a % 2 == 0 {
+                extism_free(&mut store, instance, ptr);
+            } else if a % 3 == 0 {
+                extism_free(&mut store, instance, prev);
+            }
+
+            prev = ptr;
+
+        }
+
+        true
+    }
+}
+
+quickcheck! {
+    fn check_alloc_with_load_and_store(amounts: Vec<u16>) -> bool {
+        use rand::Rng;
+        let mut rng = rand::thread_rng();
+        let (mut store, mut instance) = init_kernel_test();
+        let instance = &mut instance;
+        for a in amounts {
+            let ptr = extism_alloc(&mut store, instance, a as u64);
+            if ptr == 0 || ptr == u64::MAX {
+                continue
+            }
+            if extism_length(&mut store, instance, ptr) != a as u64 {
+                return false
+            }
+
+            for _ in 0..16 {
+                let i = rng.gen_range(ptr..ptr+a as u64);
+                extism_store_u8(&mut store, instance, i, i as u8);
+                if extism_load_u8(&mut store, instance, i as u64) != i as u8 {
+                    return false
+                }
+            }
+        }
+
+        true
+    }
+}
--- a/runtime/src/tests/runtime.rs
+++ b/runtime/src/tests/runtime.rs
@@ -1,3 +1,5 @@
+use extism_manifest::MemoryOptions;
+
 use crate::*;
 use std::{io::Write, time::Instant};

@@ -39,11 +41,12 @@ pub struct Count {

 #[test]
 fn it_works() {
-    tracing_subscriber::fmt()
+    let log = tracing_subscriber::fmt()
        .with_ansi(false)
        .with_env_filter("extism=debug")
        .with_writer(std::fs::File::create("test.log").unwrap())
-        .init();
+        .try_init()
+        .is_ok();

    let wasm_start = Instant::now();

@@ -143,8 +146,10 @@ fn it_works() {
    println!("wasm function call (avg, N = {}): {:?}", num_tests, avg);

    // Check that log file was written to
-    let meta = std::fs::metadata("test.log").unwrap();
-    assert!(meta.len() > 0);
+    if log {
+        let meta = std::fs::metadata("test.log").unwrap();
+        assert!(meta.len() > 0);
+    }
 }

 #[test]
@@ -235,6 +240,34 @@ fn test_timeout() {
    assert!(err == "timeout");
 }

+#[test]
+fn test_http_timeout() {
+    let f = Function::new(
+        "hello_world",
+        [PTR],
+        [PTR],
+        UserData::default(),
+        hello_world,
+    );
+
+    let manifest = Manifest::new([extism_manifest::Wasm::data(WASM_HTTP)])
+        .with_timeout(std::time::Duration::from_millis(1))
+        .with_allowed_host("www.extism.org");
+    let mut plugin = Plugin::new(manifest, [f], true).unwrap();
+
+    let start = std::time::Instant::now();
+    let output: Result<&[u8], Error> =
+        plugin.call("http_request", r#"{"url": "https://www.extism.org"}"#);
+    let end = std::time::Instant::now();
+    let time = end - start;
+    let err = output.unwrap_err().root_cause().to_string();
+    println!(
+        "Timed out plugin ran for {:?}, with error: {:?}",
+        time, &err
+    );
+    assert!(err == "timeout");
+}
+
 typed_plugin!(pub TestTypedPluginGenerics {
    count_vowels<T: FromBytes<'a>>(&str) -> T
 });
@@ -302,6 +335,42 @@ fn test_toml_manifest() {
    assert_eq!(count.get("count").unwrap().as_i64().unwrap(), 1);
 }

+#[test]
+fn test_call_with_host_context() {
+    #[derive(Clone)]
+    struct Foo {
+        message: String,
+    }
+
+    let f = Function::new(
+        "host_reflect",
+        [PTR],
+        [PTR],
+        UserData::default(),
+        |current_plugin, _val, ret, _user_data: UserData<()>| {
+            let foo = current_plugin.host_context::<Foo>()?;
+            let hnd = current_plugin.memory_new(foo.message)?;
+            ret[0] = current_plugin.memory_to_val(hnd);
+            Ok(())
+        },
+    );
+
+    let mut plugin = Plugin::new(WASM_REFLECT, [f], true).unwrap();
+
+    let message = "hello world";
+    let output: String = plugin
+        .call_with_host_context(
+            "reflect",
+            "anything, really",
+            Foo {
+                message: message.to_string(),
+            },
+        )
+        .unwrap();
+
+    assert_eq!(output, message);
+}
+
 #[test]
 fn test_fuzz_reflect_plugin() {
    // assert!(set_log_file("stdout", Some(log::Level::Trace)));
@@ -572,3 +641,112 @@ fn test_disable_cache() {

    assert!(t < t1);
 }
+
+#[test]
+fn test_manifest_ptr_len() {
+    let manifest = serde_json::json!({
+        "wasm" : [
+            {
+                "data" : {
+                    "ptr" : WASM_NO_FUNCTIONS.as_ptr() as u64,
+                    "len" : WASM_NO_FUNCTIONS.len()
+                }
+            }
+        ]
+    });
+    let mut plugin = Plugin::new(manifest.to_string().as_bytes(), [], true).unwrap();
+    let output = plugin.call("count_vowels", "abc123").unwrap();
+    let count: serde_json::Value = serde_json::from_slice(output).unwrap();
+    assert_eq!(count.get("count").unwrap().as_i64().unwrap(), 1);
+}
+
+#[test]
+fn test_no_vars() {
+    let data = br#"
+(module
+    (import "extism:host/env" "var_set" (func $var_set (param i64 i64)))
+    (import "extism:host/env" "input_offset" (func $input_offset (result i64)))
+    (func (export "test") (result i32)
+        (call $input_offset)
+        (call $input_offset)
+        (call $var_set)
+        (i32.const 0)
+    )
+)
+    "#;
+    let manifest = Manifest::new([Wasm::data(data)])
+        .with_memory_options(MemoryOptions::new().with_max_var_bytes(1));
+    let mut plugin = Plugin::new(manifest, [], true).unwrap();
+    let output: Result<(), Error> = plugin.call("test", b"A".repeat(1024));
+    assert!(output.is_err());
+    let output: Result<(), Error> = plugin.call("test", vec![]);
+    assert!(output.is_ok());
+}
+
+#[test]
+fn test_linking() {
+    let manifest = Manifest::new([
+        Wasm::Data {
+            data: br#"
+                (module
+                    (import "wasi_snapshot_preview1" "random_get" (func $random (param i32 i32) (result i32)))
+                    (import "extism:host/env" "alloc" (func $alloc (param i64) (result i64)))
+                    (import "extism:host/user" "hello" (func $hello))
+                    (global $counter (mut i32) (i32.const 0))
+                    (func $start (export "_start")
+                        (global.set $counter (i32.add (global.get $counter) (i32.const 1)))
+                    )
+                    (func (export "read_counter") (result i32)
+                        (global.get $counter)
+                    )
+                    (start $start)
+                )
+            "#.to_vec(),
+            meta: WasmMetadata {
+                name: Some("commander".to_string()),
+                hash: None,
+            },
+        },
+        Wasm::Data {
+            data: br#"
+                (module
+                    (import "commander" "_start" (func $commander_start))
+                    (import "commander" "read_counter" (func $commander_read_counter (result i32)))
+                    (import "extism:host/env" "store_u64" (func $store_u64 (param i64 i64)))
+                    (import "extism:host/env" "alloc" (func $alloc (param i64) (result i64)))
+                    (import "extism:host/user" "hello" (func $hello))
+                    (import "extism:host/env" "output_set" (func $output_set (param i64 i64)))
+                    (func (export "run") (result i32)
+                        (local $output i64)
+                        (local.set $output (call $alloc (i64.const 8)))
+
+                        (call $commander_start)
+                        (call $commander_start)
+                        (call $commander_start)
+                        (call $commander_start)
+                        (call $hello)
+                        (call $store_u64 (local.get $output) (i64.extend_i32_u (call $commander_read_counter)))
+                        (call $output_set (local.get $output) (i64.const 8))
+                        i32.const 0
+                    )
+                )
+            "#.to_vec(),
+            meta: WasmMetadata {
+                name: Some("main".to_string()),
+                hash: None,
+            },
+        },
+    ]);
+    let mut plugin = PluginBuilder::new(manifest)
+        .with_wasi(true)
+        .with_function("hello", [], [], UserData::new(()), |_, _, _, _| {
+            eprintln!("hello!");
+            Ok(())
+        })
+        .build()
+        .unwrap();
+
+    for _ in 0..5 {
+        assert_eq!(plugin.call::<&str, i64>("run", "Hello, world!").unwrap(), 1);
+    }
+}
Author	SHA1	Message	Date
zach	24622cd511	wip	2024-06-14 18:52:50 -07:00
zach	00f9155b9e	feat: switch to owi conc, avoid needing wasm2wat	2024-06-14 18:46:27 -07:00
zach	7c770e2f1c	feat(kernel): add proof for error handling	2024-06-14 18:46:27 -07:00
zach	33ad239c50	wip: reuse proof	2024-06-14 18:46:27 -07:00
zach	a62e37c21b	cleanup: reduce the size of the allocation used in load_store example	2024-06-14 18:46:27 -07:00
zach	20ee6620c6	cleanup: improve verification	2024-06-14 18:46:27 -07:00
zach	db0b04696c	cleanup: move proofs to examples directory	2024-06-14 18:46:27 -07:00
zach	6cc22bf2de	cleanup: use new names from owi	2024-06-14 18:46:11 -07:00
zach	52d3c4ffd6	cleanup: add some comments to verification tests	2024-06-14 18:46:11 -07:00
zach	b96b28231f	cleanup: ignore verification artifacts	2024-06-14 18:46:11 -07:00
zach	c1180d576c	checkpoint: use owi crate from git	2024-06-14 18:46:11 -07:00
zach	48af68facc	cleanup: improve owi verification	2024-06-14 18:46:11 -07:00
zach	38e6476797	wip	2024-06-14 18:46:09 -07:00
zach	6a18512fc0	v1.4.1	2024-06-14 10:12:55 -07:00
Gavin Hayes	8a95a18920	docs: add CPAN link for perl-sdk (#729 )	2024-06-14 12:32:51 -04:00
zach	9dbc22830e	fix: use wasi-common to avoid issues with tokio (#728 ) See https://github.com/bytecodealliance/wasmtime/issues/8799 I will make a 1.4.1 release after this is merged	2024-06-14 09:22:55 -07:00
zach	c3e912dffb	v1.4.0	2024-06-12 15:17:45 -07:00
Gavin Hayes	c4b82e3eda	fix(libextism): improve static linking pkgconfig (#726 ) This includes three fixes: * link static library by absolute path (should fix static linking on Mac/ with `lld`) * link static library with `-framework Security` on Mac * link `libpthread` , this should be a no-op on systems with modern libc, but should fix static linking on systems with glibc pre 2.34 see https://developers.redhat.com/articles/2021/12/17/why-glibc-234-removed-libpthread and error http://www.cpantesters.org/cpan/report/669fdfc8-25a4-11ef-9502-51fb6d8775ea --------- Co-authored-by: zach <zachshipko@gmail.com> Co-authored-by: zach <zach@dylibso.com>	2024-06-11 16:22:55 -04:00
zach	2a7345a480	fix: return error when non-zero exit code in returned (#727 ) Returns an error when a plugin call returns a non-zero exit code See https://github.com/extism/go-pdk/issues/33	2024-06-11 12:34:10 -07:00
Gavin Hayes	9099cc73c5	fix(libextism): examples and docs (#724 ) Big thanks to @konsumer for reporting the issues!	2024-06-07 14:42:20 -04:00
zach	3f54892a39	refactor!: update to wasmtime 20 or greater (#723 ) - Breaking: No longer copies Extism config values into WASI environment variables because the new interface doesn't allow for the environment to be updated - these should be accessed using the Extism config functions instead - Requires wasmtime 20 or greater - Enables wasm-gc - Similar to https://github.com/extism/extism/pull/697 without sockets or additional support for command modules	2024-06-05 12:57:25 -07:00
zach	ecf18a2d81	fix: re-use linking code from `Plugin::new` in `Plugin::reset_store` (#722 )	2024-05-31 08:25:06 -07:00
zach	9bc1fc73f2	chore: rename kernel/.cargo/config to kernel/.cargo/config.toml (#721 )	2024-05-28 18:26:19 -07:00
zach	2bf391f236	doc: update API.md for latest changes (#720 )	2024-05-28 09:27:17 -07:00
Muhammad Azeez	5da0eb38ec	refactor: remove HttpRequest.header alias (#718 ) https://github.com/extism/dotnet-pdk/pull/84 brought to my attention that the Rust SDK supports both `headers` and `header` while the go sdk only supports `headers`. After talking to Zach, we decided to remove the `header` alias from the Rust SDK too, since it's obsolete and we want people to use `headers`	2024-05-22 20:34:35 +03:00
zach	7cb6c53910	v1.3.0	2024-05-22 10:07:06 -07:00
zach	0882f35300	fix: respect overall timeout when using http requests (#717 ) Currently HTTP requests can extend beyond the configured timeout for a plugin - this PR sets the timeout of the HTTP request to the remaining time left if a timeout is set in the manifest.	2024-05-21 20:11:00 -07:00
Chris Dickinson	5d9c8c5d05	feat: per call context (#711 ) Add `plugin.call_with_host_context` and `current_plugin.host_context` methods, enabling per-call context to be looped from the guest invocation to any host functions it calls. In an HTTP server environment, this enables re-using a plugin across multiple requests while switching out backing connections and user information in host functions. (Imagine a host function, `update_user` -- previously the plugin would have to have been aware of the user to pass to the host function. Now that information is ambient.) This is a backwards-compatible change and requires no changes to existing plugins. Implement by adding a global, mutable externref to the extism kernel. Since most programming languages, including Rust, don't let you define these natively, we accomplish this by using `wasm-merge` to combine the kernel Wasm with Wasm generated by a WAT file containing only the global. (This pattern might be useful for other Wasm constructs we can't use directly from Rust, like `v128` in argument parameters.) Wasmtime requires extern refs to be `Any + Send + Sync + 'static`; we additionally add `Clone`. I haven't tried this with an `Arc` directly, but it should work at least for container structs that hold `Arc`'s themselves.	2024-05-21 11:53:43 -07:00
Gavin Hayes	75e92c40a0	fix(libextism): namespace ExtismValType (#715 ) Some of the old constants conflicted with Perl headers used for build Perl extensions such the [perl-sdk](`002e4437ac/Extism/lib/Extism/XS.xs`). This fix would allow removing the copy of extism.h (inlined in that file linked) out of the perl-sdk. These constants especially `I32` likely have conflicts with many other large C codebases. A new extism release with this fix should not be made until the affected sdks (cpp-sdk) have an update ready.	2024-05-20 11:58:04 -04:00
Benjamin Eckel	5373f7d88d	docs: Add more context to linking example (#707 ) Just adding more context in response to an inquiry about how this works.	2024-04-28 15:11:39 -05:00
Roland Fredenhagen	c5a23a31d8	feat: add id() to CurrentPlugin (#705 ) fixes #704	2024-04-15 09:03:48 -07:00
Steve Manuel	7206e2b362	chore: add perl-sdk to README list	2024-04-10 22:43:27 -06:00
Steve Manuel	20f551f019	chore: fix broken links in crate readme (#701 )	2024-04-04 10:23:46 -06:00
zach	9aa817def7	cleanup: add paths to errors, clippy (#700 )	2024-03-27 14:54:03 -07:00
zach	054a29e91d	v1.2.0	2024-03-12 08:52:04 -07:00
zach	d32d4a3dd7	fix(pdk): return error when no response is available (#694 )	2024-03-11 10:32:31 -07:00
Steve Manuel	5f62554aa1	chore: update badge to reflect rust installs (#693 )	2024-03-08 11:29:07 -07:00
zach	d47af24552	feat: add ability to configure size of the Extism var store (#692 ) - Adds `memory.max_var_bytes` to the manifest to limit the number of bytes allowed to be stored in Extism vars - if `max_var_bytes` is set to 0 then vars are disabled. - Adds some builder functions to `MemoryOptions` struct - Sets the default var store size to 1mb - Includes a test to make sure `var_set` returns an error when the limit is reached	2024-03-07 09:55:02 -08:00
dependabot[bot]	8a29e5b1d4	chore(deps): Update base64 requirement from ~0.21 to ~0.22 (#690 ) Updates the requirements on [base64](https://github.com/marshallpierce/rust-base64) to permit the latest version. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/marshallpierce/rust-base64/blob/master/RELEASE-NOTES.md">base64's changelog</a>.</em></p> <blockquote> <h1>0.22.0</h1> <ul> <li><code>DecodeSliceError::OutputSliceTooSmall</code> is now conservative rather than precise. That is, the error will only occur if the decoded output <em>cannot</em> fit, meaning that <code>Engine::decode_slice</code> can now be used with exactly-sized output slices. As part of this, <code>Engine::internal_decode</code> now returns <code>DecodeSliceError</code> instead of <code>DecodeError</code>, but that is not expected to affect any external callers.</li> <li><code>DecodeError::InvalidLength</code> now refers specifically to the <em>number of valid symbols</em> being invalid (i.e. <code>len % 4 == 1</code>), rather than just the number of input bytes. This avoids confusing scenarios when based on interpretation you could make a case for either <code>InvalidLength</code> or <code>InvalidByte</code> being appropriate.</li> <li>Decoding is somewhat faster (5-10%)</li> </ul> <h1>0.21.7</h1> <ul> <li>Support getting an alphabet's contents as a str via <code>Alphabet::as_str()</code></li> </ul> <h1>0.21.6</h1> <ul> <li>Improved introductory documentation and example</li> </ul> <h1>0.21.5</h1> <ul> <li>Add <code>Debug</code> and <code>Clone</code> impls for the general purpose Engine</li> </ul> <h1>0.21.4</h1> <ul> <li>Make <code>encoded_len</code> <code>const</code>, allowing the creation of arrays sized to encode compile-time-known data lengths</li> </ul> <h1>0.21.3</h1> <ul> <li>Implement <code>source</code> instead of <code>cause</code> on Error types</li> <li>Roll back MSRV to 1.48.0 so Debian can continue to live in a time warp</li> <li>Slightly faster chunked encoding for short inputs</li> <li>Decrease binary size</li> </ul> <h1>0.21.2</h1> <ul> <li>Rollback MSRV to 1.57.0 -- only dev dependencies need 1.60, not the main code</li> </ul> <h1>0.21.1</h1> <ul> <li>Remove the possibility of panicking during decoded length calculations</li> <li><code>DecoderReader</code> no longer sometimes erroneously ignores padding <a href="https://redirect.github.com/marshallpierce/rust-base64/issues/226">#226</a></li> </ul> <h2>Breaking changes</h2> <ul> <li><code>Engine.internal_decode</code> return type changed</li> <li>Update MSRV to 1.60.0</li> </ul> <h1>0.21.0</h1> <h2>Migration</h2> <h3>Functions</h3> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="`5d70ba7576`"><code>5d70ba7</code></a> Merge pull request <a href="https://redirect.github.com/marshallpierce/rust-base64/issues/269">#269</a> from marshallpierce/mp/decode-precisely</li> <li><a href="`efb6c006c7`"><code>efb6c00</code></a> Release notes</li> <li><a href="`2b91084a31`"><code>2b91084</code></a> Add some tests to boost coverage</li> <li><a href="`9e9c7abe65`"><code>9e9c7ab</code></a> Engine::internal_decode now returns DecodeSliceError</li> <li><a href="`a8a60f43c5`"><code>a8a60f4</code></a> Decode main loop improvements</li> <li><a href="`a25be0667c`"><code>a25be06</code></a> Simplify leftover output writes</li> <li><a href="`9979cc33bb`"><code>9979cc3</code></a> Keep morsels as separate bytes</li> <li><a href="`37670c5ec2`"><code>37670c5</code></a> Bump dev toolchain version (<a href="https://redirect.github.com/marshallpierce/rust-base64/issues/268">#268</a>)</li> <li><a href="`9652c78773`"><code>9652c78</code></a> v0.21.7</li> <li><a href="`08deccf703`"><code>08deccf</code></a> provide as_str() method to return the alphabet characters (<a href="https://redirect.github.com/marshallpierce/rust-base64/issues/264">#264</a>)</li> <li>Additional commits viewable in <a href="https://github.com/marshallpierce/rust-base64/compare/v0.21.0...v0.22.0">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2024-03-04 09:04:37 -08:00
zach	4e0cd3b1cf	doc: remove old default for timeout_ms (#688 )	2024-02-26 16:29:35 -08:00
zach	f4013c5ac0	fix: circular dependencies	2024-02-22 14:04:01 -08:00
zach	ddc339334e	fix: remove readme field	2024-02-22 13:07:06 -08:00
zach	ff5b714f95	v1.1.0	2024-02-22 11:01:19 -08:00
zach	ed1439ec2d	fix: linker issue that depends on the ordering of the linked functions (#685 ) It looks like when a module is added to the linker, all of its imports must already be present. This PR updates the linking process to take that into consideration and adds a test with a reproduction of the issue @chrisdickinson shared with me.	2024-02-22 10:56:21 -08:00
zach	62f0a231b0	ci: add release workflow for convert-macros crate (#683 )	2024-02-14 09:18:28 -08:00
zach	fc22412ff0	feat: allow max HTTP response size to be configured in the manifest (#674 ) - Adds `memory.max_http_response_bytes` field to specify the maximum size of an HTTP request response	2024-02-07 14:31:23 -08:00
Roland Fredenhagen	1a083f612a	feat(convert): add derive macros for To and FromBytes (#667 ) closes #661. - [x] docs - [x] tests - [x] depend on `extism-convert/extism-pdk-path` feature in https://github.com/extism/rust-pdk https://github.com/extism/rust-pdk/pull/47	2024-02-05 15:59:55 -08:00
zach	efa69d3668	chore: support for wasmtime 17.0.0 (#665 )	2024-01-25 16:11:17 -08:00
zach	fa1beb9155	v1.0.3	2024-01-22 10:21:30 -08:00
Onigbinde Oluwamuyiwa Elijah	fbae853505	fix: make function Plugin::function_extists check the type of the functions. (#664 ) This PR addresses #654 It checks the parameters and results of the function as described in the mentioned issue.	2024-01-22 08:40:09 -08:00
zach	8c8e4a6ffb	fix(kernel): fix potential overflow in bounds check when lots of memory has been allocated (#663 ) - Fixes potential overflow in bounds checking function - Found by running the `check_large_allocations` quickcheck test in a loop	2024-01-19 16:14:36 -08:00
zach	1f1e2699cb	v1.0.2	2024-01-19 13:10:13 -08:00
zach	d5dc9b41ab	feat: Use quickcheck to test allocations, fix one bug that was uncovered. (#662 ) - Adds quickcheck tests for alloc/free/load/store from the kernel, I wasn't able to include these in the new wasm-bindgen tests because `getrandom` isn't available on wasm32-unknown-unknown - Fixes a bug in the calculation of how much memory is needed to allocate the next block in the kernel. This bug is triggered when allocating at the end of a page, the size of the MemoryBlock value wasn't being taken in consideration when determining whether or not to call memory.grow	2024-01-19 13:04:21 -08:00
zach	822cec4093	v1.0.1	2024-01-18 10:32:04 -08:00
Marton Soos	0b4b732eb8	fix(kernel): Fix calculation of handle offset when splitting re-used memory, add kernel test (#659 )	2024-01-17 15:15:51 -08:00
zach	fa368d0b5a	feat(convert): add conversions for `Option<T>` (#658 )	2024-01-12 14:45:01 -08:00
Gavin Hayes	092eba5e2f	feat: manifest wasm data without base64 (#657 ) base64 support is retained. Now `data` can instead be `{"ptr": ptr_value, "len": len_value}` where `ptr_value` points to a wasm module and `len_value` is the size of bytes of it.	2024-01-12 16:48:25 -05:00
Benjamin Eckel	94b0b9a430	docs: fix rc version in docs (#656 )	2024-01-09 18:56:08 -06:00
Steve Manuel	85cc72e832	docs: add .NET PDK link to table	2024-01-09 07:41:13 -07:00
Steve Manuel	9aee9d8ca5	feat: update README (#655 ) Gives the README a bit of a refresh. --------- Co-authored-by: Benjamin Eckel <bhelx@simst.im>	2024-01-09 07:30:30 -07:00