feat: expose building a CompiledPlugin with a fuel limit (#883 )

Expose a new method `extism_compiled_plugin_new_with_fuel_limit` to build a CompiledPlugin with a fuel limit. Fixes #882
Update to wasmtime version with exceptions support (#880 )
2026-01-11 14:58:01 -05:00 · 2025-11-25 09:11:25 -08:00 · 2025-10-09 15:46:23 -07:00 · 2025-07-28 09:07:54 -07:00 · 2025-07-14 11:04:16 -07:00 · 2025-07-14 09:44:00 -07:00
44 changed files with 1521 additions and 454 deletions
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -0,0 +1 @@
+* @zshipko
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -9,33 +9,8 @@ updates:
    directory: "/" # Location of package manifests
    schedule:
      interval: "weekly"
+    ignore:
+      - dependency-name: "wasmtime"
+      - dependency-name: "wasi-common"
+      - dependency-name: "wiggle"

-  - package-ecosystem: "pip"
-    directory: "python"
-    schedule:
-      interval: "weekly"
-
-  - package-ecosystem: "mix"
-    directory: "elixir"
-    schedule:
-      interval: "weekly"
-
-  - package-ecosystem: "npm"
-    directory: "node"
-    schedule:
-      interval: "weekly"
-
-  - package-ecosystem: "composer"
-    directory: "/"
-    schedule:
-      interval: "weekly"
-
-  - package-ecosystem: "bundler"
-    directory: "ruby"
-    schedule:
-      interval: "weekly"
-
-  - package-ecosystem: "gomod"
-    directory: "/"
-    schedule:
-      interval: "weekly"
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1,4 +1,4 @@
-on: 
+on:
  pull_request:
    paths:
      - .github/actions/extism/**
@@ -52,7 +52,7 @@ jobs:
        shell: bash
        run: cargo build --release -p ${{ env.LIBEXTISM_CRATE }}
      - name: Upload artifact
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@v4
        with:
          name: libextism-${{ matrix.os }}
          path: |
@@ -116,4 +116,9 @@ jobs:
          path: target/**
          key: ${{ runner.os }}-target-${{ github.sha }}
      - run: cargo install cargo-criterion
-      - run: cargo criterion
+      - run:
+          cargo criterion
+      - run: |
+          git fetch
+          git checkout main
+          cargo criterion
--- a/.github/workflows/release-dotnet-native.yaml
+++ b/.github/workflows/release-dotnet-native.yaml
@@ -1,4 +1,6 @@
 on:
+  release:
+    types: [published, edited]
  workflow_dispatch:

 name: Release .NET Native NuGet Packages
@@ -18,10 +20,13 @@ jobs:
        uses: actions/setup-dotnet@v3.0.3
        with:
           dotnet-version: 7.x
-      - uses: dawidd6/action-download-artifact@v2
-        with:
-          workflow: release.yml
-          name: release-artifacts
+      - name: download release
+        run: |
+          tag='${{ github.ref }}'
+          tag="${tag/refs\/tags\//}"
+          gh release download "$tag" -p 'libextism-*.tar.gz'
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      - name: Extract Archive
        run: |      
          extract_archive() {
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -7,11 +7,6 @@ on:

 name: Release

-env:
-  RUNTIME_MANIFEST: runtime/Cargo.toml
-  RUNTIME_CRATE: libextism
-  RUSTFLAGS: -C target-feature=-crt-static
-  ARTIFACT_DIR: release-artifacts

 concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
@@ -21,6 +16,11 @@ jobs:
  release:
    name: ${{ matrix.os }} ${{ matrix.target }}
    runs-on: ${{ matrix.os }}-latest
+    env:
+      RUNTIME_MANIFEST: runtime/Cargo.toml
+      RUNTIME_CRATE: libextism
+      RUSTFLAGS: -C target-feature=-crt-static
+      ARTIFACT_DIR: release-artifacts-${{ matrix.os }}-${{ matrix.target }}
    strategy:
      matrix:
        include:
@@ -98,13 +98,11 @@ jobs:
          pyproject="$(cat extism-maturin/pyproject.toml)"
          <<<"$pyproject" >extism-maturin/pyproject.toml sed -e 's/^version = "0.0.0.replaced-by-ci"/version = "'"$version"'"/g'

-      - name: Install Rust
-        uses: actions-rs/toolchain@v1
+      - uses: actions-rust-lang/setup-rust-toolchain@v1
        with:
-          toolchain: stable
-          profile: minimal
-          override: true
          target: ${{ matrix.target }}
+          override: true
+          toolchain: stable

      - uses: Swatinem/rust-cache@v2
        with:
@@ -113,11 +111,15 @@ jobs:
          cache-on-failure: "true"

      - name: Build Target (${{ matrix.os }} ${{ matrix.target }})
-        uses: actions-rs/cargo@v1
-        with:
-          use-cross: ${{ matrix.os != 'windows' }}
-          command: build
-          args: --release --target ${{ matrix.target }} -p ${{ env.RUNTIME_CRATE }}
+        if: ${{ matrix.os != 'windows' }}
+        run: |
+          cargo install cross
+          cross build --release --target ${{ matrix.target }} -p ${{ env.RUNTIME_CRATE }}
+
+      - name: Build Target (${{ matrix.os }} ${{ matrix.target }})
+        if: ${{ matrix.os == 'windows' }}
+        run: |
+          cargo build --release --target ${{ matrix.target }} -p ${{ env.RUNTIME_CRATE }}

      - uses: actions/setup-python@v4
        with:
@@ -190,7 +192,7 @@ jobs:
          ls -ll ${DEST_DIR}

      - name: Upload Artifact to Summary
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@v4
        with:
          name: ${{ env.ARTIFACT_DIR }}
          path: ${{ env.ARTIFACT_DIR }}
@@ -209,9 +211,10 @@ jobs:
    needs: [release]
    if: github.ref == 'refs/heads/main'
    steps:
-      - uses: actions/download-artifact@v3
+      - uses: actions/download-artifact@v4
        with:
-          name: ${{ env.ARTIFACT_DIR }}
+          pattern: release-artifacts-*
+          merge-multiple: true

      - uses: "marvinpinto/action-automatic-releases@latest"
        with:
--- a/README.md
+++ b/README.md
@@ -36,6 +36,22 @@ function linking, and more. Extism users build:
 - web applications
 - & much more...

+# Supported Targets
+
+We currently provide releases for the following targets:
+
+- aarch64-apple-darwin
+- aarch64-unknown-linux-gnu
+- aarch64-unknown-linux-musl
+- x86_64-apple-darwin
+- x86_64-pc-windows-gnu
+- x86_64-pc-windows-msvc
+- x86_64-unknown-linux-gnu
+- x86_64-unknown-linux-musl
+
+For Android we suggest taking a look at the [Chicory SDK](https://github.com/extism/chicory-sdk) for a pure Java
+Extism runtime.
+
 # Run WebAssembly In Your App

 Pick a SDK to import into your program, and refer to the documentation to get
@@ -61,11 +77,11 @@ started:

 # Compile WebAssembly to run in Extism Hosts

-Extism Hosts (running the SDK) must execute WebAssembly code that has a PDK
-library compiled in to the `.wasm` binary. PDKs make it easy for plug-in /
-extension code authors to read input from the host and return data back, read
-provided configuration, set/get variables, make outbound HTTP calls if allowed,
-and more.
+Extism Hosts (running the SDK) must execute WebAssembly code that has a
+[PDK, or Plug-in Development Kit](https://extism.org/docs/concepts/pdk), library
+compiled in to the `.wasm` binary. PDKs make it easy for plug-in / extension
+code authors to read input from the host and return data back, read provided
+configuration, set/get variables, make outbound HTTP calls if allowed, and more.

 Pick a PDK to import into your Wasm program, and refer to the documentation to
 get started:
@@ -74,13 +90,73 @@ get started:
 | ------------------ | ---------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------- | --------------------------------------------------------- |
 | Rust PDK           | <img alt="Rust PDK" src="https://extism.org/img/sdk-languages/rust.svg" width="50px"/>                     | https://github.com/extism/rust-pdk                            | [Crates.io](https://crates.io/crates/extism-pdk)          |
 | JS PDK             | <img alt="JS PDK" src="https://extism.org/img/sdk-languages/js.svg" width="50px"/>                         | https://github.com/extism/js-pdk                              | N/A                                                       |
+| Python PDK         | <img alt="Python PDK" src="https://extism.org/img/sdk-languages/python.svg" width="50px"/>                 | https://github.com/extism/python-pdk                          | N/A                                                       |
 | Go PDK             | <img alt="Go PDK" src="https://extism.org/img/sdk-languages/go.svg" width="50px"/>                         | https://github.com/extism/go-pdk                              | [Go mod](https://pkg.go.dev/github.com/extism/go-pdk)     |
 | Haskell PDK        | <img alt="Haskell PDK" src="https://extism.org/img/sdk-languages/haskell.svg" width="50px"/>               | https://github.com/extism/haskell-pdk                         | [Hackage](https://hackage.haskell.org/package/extism-pdk) |
 | AssemblyScript PDK | <img alt="AssemblyScript PDK" src="https://extism.org/img/sdk-languages/assemblyscript.svg" width="50px"/> | https://github.com/extism/assemblyscript-pdk                  | [NPM](https://www.npmjs.com/package/@extism/as-pdk)       |
-| .NET PDK           | <img alt=".NET PDK" src="https://extism.org/img/sdk-languages/dotnet.svg" width="50px"/>                   | https://github.com/extism/dotnet-pdk <br/>(supports C# & F#!) | https://www.nuget.org/packages/Extism.Pdk                 |
+| .NET PDK           | <img alt=".NET PDK" src="https://extism.org/img/sdk-languages/dotnet.svg" width="50px"/>                   | https://github.com/extism/dotnet-pdk <br/>(supports C# & F#!) | [Nuget](https://www.nuget.org/packages/Extism.Pdk)        |
 | C PDK              | <img alt="C PDK" src="https://extism.org/img/sdk-languages/c.svg" width="50px"/>                           | https://github.com/extism/c-pdk                               | N/A                                                       |
+| C++ PDK            | <img alt="C++ PDK" src="https://extism.org/img/sdk-languages/cpp.svg" width="50px"/>                       | https://github.com/extism/cpp-pdk                             | N/A                                                       |
 | Zig PDK            | <img alt="Zig PDK" src="https://extism.org/img/sdk-languages/zig.svg" width="50px"/>                       | https://github.com/extism/zig-pdk                             | N/A                                                       |

+# Generating Bindings
+
+It's often very useful to define a schema to describe the function signatures
+and types you want to use between Extism SDK and PDK languages.
+
+[XTP Bindgen](https://github.com/dylibso/xtp-bindgen) is an open source
+framework to generate PDK bindings for Extism plug-ins. It's used by the
+[XTP Platform](https://www.getxtp.com/), but can be used outside of the platform
+to define any Extism compatible plug-in system.
+
+## 1. Install the `xtp` CLI.
+
+See installation instructions
+[here](https://docs.xtp.dylibso.com/docs/cli#installation).
+
+## 2. Create a schema using our OpenAPI-inspired IDL:
+
+```yaml
+version: v1-draft
+exports: 
+  CountVowels:
+      input: 
+          type: string
+          contentType: text/plain; charset=utf-8
+      output:
+          $ref: "#/components/schemas/VowelReport"
+          contentType: application/json
+# components.schemas defined in example-schema.yaml...
+```
+
+> See an example in [example-schema.yaml](./example-schema.yaml), or a full
+> "kitchen sink" example on
+> [the docs page](https://docs.xtp.dylibso.com/docs/concepts/xtp-schema/).
+
+## 3. Generate bindings to use from your plugins:
+
+```
+xtp plugin init --schema-file ./example-schema.yaml
+  > 1. TypeScript                      
+    2. Go                              
+    3. Rust                            
+    4. Python                          
+    5. C#                              
+    6. Zig                             
+    7. C++                             
+    8. GitHub Template                 
+    9. Local Template
+```
+
+This will create an entire boilerplate plugin project for you to get started
+with. Implement the empty function(s), and run `xtp plugin build` to compile
+your plugin.
+
+> For more information about XTP Bindgen, see the
+> [dylibso/xtp-bindgen](https://github.com/dylibso/xtp-bindgen) repository and
+> the official
+> [XTP Schema documentation](https://docs.xtp.dylibso.com/docs/concepts/xtp-schema).
+
 # Support

 ## Discord
--- a/convert-macros/src/lib.rs
+++ b/convert-macros/src/lib.rs
@@ -34,11 +34,11 @@ fn extract_encoding(attrs: &[Attribute]) -> Result<Path> {
        .iter()
        .filter(|attr| attr.path().is_ident("encoding"))
        .collect();
-    ensure!(!encodings.is_empty(), "encoding needs to be specified"; try = "`#[encoding(ToJson)]`");
+    ensure!(!encodings.is_empty(), "encoding needs to be specified"; try = "`#[encoding(Json)]`");
    ensure!(encodings.len() < 2, encodings[1], "only one encoding can be specified"; try = "remove `{}`", encodings[1].to_token_stream());

    Ok(encodings[0].parse_args().map_err(
-        |e| error_message!(e.span(), "{e}"; note= "expects a path"; try = "`#[encoding(ToJson)]`"),
+        |e| error_message!(e.span(), "{e}"; note= "expects a path"; try = "`#[encoding(Json)]`"),
    )?)
 }

--- a/convert-macros/tests/ui/invalid-encoding.stderr
+++ b/convert-macros/tests/ui/invalid-encoding.stderr
@@ -1,6 +1,6 @@
 error: encoding needs to be specified

-         = try: `#[encoding(ToJson)]`
+         = try: `#[encoding(Json)]`
 --> tests/ui/invalid-encoding.rs:3:10
  |
 3 | #[derive(ToBytes)]
@@ -11,7 +11,7 @@ error: encoding needs to be specified
 error: expected attribute arguments in parentheses: #[encoding(...)]

         = note: expects a path
-         = try: `#[encoding(ToJson)]`
+         = try: `#[encoding(Json)]`
 --> tests/ui/invalid-encoding.rs:7:3
  |
 7 | #[encoding]
@@ -20,7 +20,7 @@ error: expected attribute arguments in parentheses: #[encoding(...)]
 error: expected parentheses: #[encoding(...)]

         = note: expects a path
-         = try: `#[encoding(ToJson)]`
+         = try: `#[encoding(Json)]`
  --> tests/ui/invalid-encoding.rs:11:12
   |
 11 | #[encoding = "string"]
@@ -29,7 +29,7 @@ error: expected parentheses: #[encoding(...)]
 error: unexpected token

         = note: expects a path
-         = try: `#[encoding(ToJson)]`
+         = try: `#[encoding(Json)]`
  --> tests/ui/invalid-encoding.rs:15:21
   |
 15 | #[encoding(something, else)]
--- a/convert/Cargo.toml
+++ b/convert/Cargo.toml
@@ -13,7 +13,7 @@ description = "Traits to make Rust types usable with Extism"
 anyhow = "1.0.75"
 base64 = "~0.22"
 bytemuck = {version = "1.14.0", optional = true }
-prost = { version = "0.13.1", optional = true }
+prost = { version = "0.14.1", optional = true }
 protobuf = { version = "3.2.0", optional = true }
 rmp-serde = { version = "1.1.2", optional = true }
 serde = "1.0.186"
--- a/convert/src/encoding.rs
+++ b/convert/src/encoding.rs
@@ -55,7 +55,7 @@ encoding!(pub Json, serde_json::to_vec, serde_json::from_slice);
 #[cfg(feature = "msgpack")]
 encoding!(pub Msgpack, rmp_serde::to_vec, rmp_serde::from_slice);

-impl<'a> ToBytes<'a> for serde_json::Value {
+impl ToBytes<'_> for serde_json::Value {
    type Bytes = Vec<u8>;

    fn to_bytes(&self) -> Result<Self::Bytes, Error> {
@@ -85,7 +85,7 @@ impl<T: AsRef<[u8]>> From<T> for Base64<T> {
    }
 }

-impl<'a, T: AsRef<[u8]>> ToBytes<'a> for Base64<T> {
+impl<T: AsRef<[u8]>> ToBytes<'_> for Base64<T> {
    type Bytes = String;

    fn to_bytes(&self) -> Result<Self::Bytes, Error> {
@@ -124,7 +124,7 @@ impl<T: prost::Message> From<T> for Prost<T> {
 }

 #[cfg(feature = "prost")]
-impl<'a, T: prost::Message> ToBytes<'a> for Prost<T> {
+impl<T: prost::Message> ToBytes<'_> for Prost<T> {
    type Bytes = Vec<u8>;

    fn to_bytes(&self) -> Result<Self::Bytes, Error> {
@@ -146,7 +146,7 @@ impl<T: Default + prost::Message> FromBytesOwned for Prost<T> {
 pub struct Protobuf<T: protobuf::Message>(pub T);

 #[cfg(feature = "protobuf")]
-impl<'a, T: protobuf::Message> ToBytes<'a> for Protobuf<T> {
+impl<T: protobuf::Message> ToBytes<'_> for Protobuf<T> {
    type Bytes = Vec<u8>;

    fn to_bytes(&self) -> Result<Self::Bytes, Error> {
--- a/convert/src/from_bytes.rs
+++ b/convert/src/from_bytes.rs
@@ -141,6 +141,16 @@ impl FromBytesOwned for u32 {
    }
 }

+impl FromBytesOwned for bool {
+    fn from_bytes_owned(data: &[u8]) -> Result<Self, Error> {
+        if let Some(x) = data.first() {
+            Ok(*x != 0)
+        } else {
+            Err(Error::msg("Expected one byte to read boolean value"))
+        }
+    }
+}
+
 impl FromBytesOwned for () {
    fn from_bytes_owned(_: &[u8]) -> Result<Self, Error> {
        Ok(())
--- a/convert/src/tests.rs
+++ b/convert/src/tests.rs
@@ -61,8 +61,19 @@ fn rountrip_option() {
    assert_eq!(y.unwrap().0, z.unwrap().0);
 }

+#[test]
+fn check_bool() {
+    // `None` case
+    let a = true.to_bytes().unwrap();
+    let b = false.to_bytes().unwrap();
+    assert_ne!(a, b);
+
+    assert_eq!(a, [1]);
+    assert_eq!(b, [0]);
+}
+
 #[cfg(all(feature = "raw", target_endian = "little"))]
-mod tests {
+mod raw_tests {
    use crate::*;

    #[test]
--- a/convert/src/to_bytes.rs
+++ b/convert/src/to_bytes.rs
@@ -61,21 +61,21 @@ pub trait ToBytes<'a> {
    fn to_bytes(&self) -> Result<Self::Bytes, Error>;
 }

-impl<'a> ToBytes<'a> for () {
+impl ToBytes<'_> for () {
    type Bytes = [u8; 0];
    fn to_bytes(&self) -> Result<Self::Bytes, Error> {
        Ok([])
    }
 }

-impl<'a> ToBytes<'a> for Vec<u8> {
+impl ToBytes<'_> for Vec<u8> {
    type Bytes = Vec<u8>;
    fn to_bytes(&self) -> Result<Self::Bytes, Error> {
        Ok(self.clone())
    }
 }

-impl<'a> ToBytes<'a> for String {
+impl ToBytes<'_> for String {
    type Bytes = String;
    fn to_bytes(&self) -> Result<Self::Bytes, Error> {
        Ok(self.clone())
@@ -96,7 +96,7 @@ impl<'a> ToBytes<'a> for &'a str {
    }
 }

-impl<'a> ToBytes<'a> for f64 {
+impl ToBytes<'_> for f64 {
    type Bytes = [u8; 8];

    fn to_bytes(&self) -> Result<Self::Bytes, Error> {
@@ -104,7 +104,7 @@ impl<'a> ToBytes<'a> for f64 {
    }
 }

-impl<'a> ToBytes<'a> for f32 {
+impl ToBytes<'_> for f32 {
    type Bytes = [u8; 4];

    fn to_bytes(&self) -> Result<Self::Bytes, Error> {
@@ -112,7 +112,7 @@ impl<'a> ToBytes<'a> for f32 {
    }
 }

-impl<'a> ToBytes<'a> for i64 {
+impl ToBytes<'_> for i64 {
    type Bytes = [u8; 8];

    fn to_bytes(&self) -> Result<Self::Bytes, Error> {
@@ -120,7 +120,7 @@ impl<'a> ToBytes<'a> for i64 {
    }
 }

-impl<'a> ToBytes<'a> for i32 {
+impl ToBytes<'_> for i32 {
    type Bytes = [u8; 4];

    fn to_bytes(&self) -> Result<Self::Bytes, Error> {
@@ -128,7 +128,7 @@ impl<'a> ToBytes<'a> for i32 {
    }
 }

-impl<'a> ToBytes<'a> for u64 {
+impl ToBytes<'_> for u64 {
    type Bytes = [u8; 8];

    fn to_bytes(&self) -> Result<Self::Bytes, Error> {
@@ -136,7 +136,7 @@ impl<'a> ToBytes<'a> for u64 {
    }
 }

-impl<'a> ToBytes<'a> for u32 {
+impl ToBytes<'_> for u32 {
    type Bytes = [u8; 4];

    fn to_bytes(&self) -> Result<Self::Bytes, Error> {
@@ -144,6 +144,14 @@ impl<'a> ToBytes<'a> for u32 {
    }
 }

+impl ToBytes<'_> for bool {
+    type Bytes = [u8; 1];
+
+    fn to_bytes(&self) -> Result<Self::Bytes, Error> {
+        Ok([*self as u8])
+    }
+}
+
 impl<'a, T: ToBytes<'a>> ToBytes<'a> for &'a T {
    type Bytes = T::Bytes;

--- a/example-schema.yaml
+++ b/example-schema.yaml
@@ -0,0 +1,28 @@
+# yaml-language-server: $schema=https://xtp.dylibso.com/assets/wasm/schema.json
+# Learn more at https://docs.xtp.dylibso.com/docs/concepts/xtp-schema
+version: v1-draft
+exports: 
+  CountVowels:
+      input: 
+          type: string
+          contentType: text/plain; charset=utf-8
+      output:
+          $ref: "#/components/schemas/VowelReport"
+          contentType: application/json
+components:
+  schemas:
+    VowelReport:
+      description: The result of counting vowels on the Vowels input.
+      properties:
+        count:
+          type: integer
+          format: int32
+          description: The count of vowels for input string.
+        total:
+          type: integer
+          format: int32
+          description: The cumulative amount of vowels counted, if this keeps state across multiple function calls.
+          nullable: true
+        vowels:
+          type: string
+          description: The set of vowels used to get the count, e.g. "aAeEiIoOuU"
--- a/kernel/src/lib.rs
+++ b/kernel/src/lib.rs
@@ -255,15 +255,6 @@ impl MemoryRoot {
    pub unsafe fn alloc(&mut self, length: u64) -> Option<&'static mut MemoryBlock> {
        let self_position = self.position.load(Ordering::Acquire);
        let self_length = self.length.load(Ordering::Acquire);
-        let b = self.find_free_block(length, self_position);
-
-        // If there's a free block then re-use it
-        if let Some(b) = b {
-            b.used = length as usize;
-            b.status
-                .store(MemoryStatus::Active as u8, Ordering::Release);
-            return Some(b);
-        }

        // Get the current index for a new block
        let curr = self.blocks.as_ptr() as u64 + self_position;
@@ -275,6 +266,21 @@ impl MemoryRoot {
        // When the allocation is larger than the number of bytes available
        // we will need to try to grow the memory
        if length_with_block >= mem_left {
+            // If the current position is large enough to hold the length of the block being
+            // allocated then check for existing free blocks that can be re-used before
+            // growing memory
+            if length_with_block <= self_position {
+                let b = self.find_free_block(length, self_position);
+
+                // If there's a free block then re-use it
+                if let Some(b) = b {
+                    b.used = length as usize;
+                    b.status
+                        .store(MemoryStatus::Active as u8, Ordering::Release);
+                    return Some(b);
+                }
+            }
+
            // Calculate the number of pages needed to cover the remaining bytes
            let npages = num_pages(length_with_block - mem_left);
            let x = core::arch::wasm32::memory_grow(0, npages);
@@ -489,6 +495,8 @@ pub unsafe fn store_u64(p: Pointer, x: u64) {
 /// Set the range of the input data in memory
 /// h must always be a handle so that length works on it
 /// len must match length(handle)
+/// **Note**: this function takes ownership of the handle passed in
+/// the caller should not `free` this value
 #[no_mangle]
 pub unsafe fn input_set(h: Handle, len: u64) {
    let root = MemoryRoot::new();
@@ -503,6 +511,8 @@ pub unsafe fn input_set(h: Handle, len: u64) {
 }

 /// Set the range of the output data in memory
+/// **Note**: this function takes ownership of the handle passed in
+/// the caller should not `free` this value
 #[no_mangle]
 pub unsafe fn output_set(p: Pointer, len: u64) {
    let root = MemoryRoot::new();
@@ -548,6 +558,8 @@ pub unsafe fn reset() {

 /// Set the error message offset, the handle passed to this
 /// function should not be freed after this call
+/// **Note**: this function takes ownership of the handle passed in
+/// the caller should not `free` this value
 #[no_mangle]
 pub unsafe fn error_set(h: Handle) {
    let root = MemoryRoot::new();
@@ -582,45 +594,6 @@ mod test {
    use crate::*;
    use wasm_bindgen_test::*;

-    // See https://github.com/extism/extism/pull/659
-    #[wasm_bindgen_test]
-    fn test_659() {
-        unsafe {
-            // Warning: These offsets will need to change if we adjust the kernel memory layout at all
-            reset();
-            assert_eq!(alloc(1065), 77);
-            assert_eq!(alloc(288), 1154);
-            assert_eq!(alloc(128), 1454);
-            assert_eq!(length(1154), 288);
-            assert_eq!(length(1454), 128);
-            free(1454);
-            assert_eq!(alloc(213), 1594);
-            length_unsafe(1594);
-            assert_eq!(alloc(511), 1819);
-            assert_eq!(alloc(4), 1454);
-            assert_eq!(length(1454), 4);
-            assert_eq!(length(1819), 511);
-            assert_eq!(alloc(13), 2342);
-            assert_eq!(length(2342), 13);
-            assert_eq!(alloc(336), 2367);
-            assert_eq!(alloc(1077), 2715);
-            assert_eq!(length(2367), 336);
-            assert_eq!(length(2715), 1077);
-            free(2715);
-            assert_eq!(alloc(1094), 3804);
-            length_unsafe(3804);
-
-            // Allocate 4 bytes, expect to receive address 3788
-            assert_eq!(alloc(4), 3788);
-
-            assert_eq!(alloc(4), 3772);
-            assert_eq!(length(3772), 4);
-
-            // Address 3788 has not been freed yet, so expect it to have 4 bytes allocated
-            assert_eq!(length(3788), 4);
-        }
-    }
-
    #[wasm_bindgen_test]
    fn test_oom() {
        let size = 1024 * 1024 * 5;
--- a/manifest/src/lib.rs
+++ b/manifest/src/lib.rs
@@ -269,8 +269,8 @@ pub struct Manifest {
    /// Config values are made accessible using the PDK `extism_config_get` function
    #[serde(default)]
    pub config: BTreeMap<String, String>,
-    #[serde(default)]

+    #[serde(default)]
    /// Specifies which hosts may be accessed via HTTP, if this is empty then
    /// no hosts may be accessed. Wildcards may be used.
    pub allowed_hosts: Option<Vec<String>>,
@@ -417,14 +417,14 @@ mod wasmdata {
    }
 }

-impl<'a> From<Manifest> for std::borrow::Cow<'a, [u8]> {
+impl From<Manifest> for std::borrow::Cow<'_, [u8]> {
    fn from(m: Manifest) -> Self {
        let s = serde_json::to_vec(&m).unwrap();
        std::borrow::Cow::Owned(s)
    }
 }

-impl<'a> From<&Manifest> for std::borrow::Cow<'a, [u8]> {
+impl From<&Manifest> for std::borrow::Cow<'_, [u8]> {
    fn from(m: &Manifest) -> Self {
        let s = serde_json::to_vec(&m).unwrap();
        std::borrow::Cow::Owned(s)
--- a/runtime/Cargo.toml
+++ b/runtime/Cargo.toml
@@ -9,37 +9,56 @@ repository.workspace = true
 version.workspace = true

 [dependencies]
-wasmtime = ">= 20.0.0, < 24.0.0"
-wasi-common = ">= 20.0.0, < 24.0.0"
-wiggle = ">= 20.0.0, < 24.0.0"
+wasmtime = { version="37", default-features = false, features = [
+  'cache',
+  'gc',
+  'gc-drc',
+  'cranelift',
+  'coredump',
+  'wat',
+  'parallel-compilation',
+  'pooling-allocator',
+  'demangle',
+] }
+wasi-common = "37"
+wiggle = "37"
 anyhow = "1"
-serde = {version = "1", features = ["derive"]}
+serde = { version = "1", features = ["derive"] }
 serde_json = "1"
-toml = "0.8"
+toml = "0.9"
 sha2 = "0.10"
 tracing = "0.1"
-tracing-subscriber = {version = "0.3.18", features = ["std", "env-filter", "fmt"]}
+tracing-subscriber = { version = "0.3.18", features = [
+  "std",
+  "env-filter",
+  "fmt",
+] }
 url = "2"
 glob = "0.3"
-ureq = {version = "2.5", optional=true}
+ureq = { version = "3.0", optional = true }
 extism-manifest = { workspace = true }
 extism-convert = { workspace = true, features = ["extism-path"] }
 uuid = { version = "1", features = ["v4"] }
 libc = "0.2"

 [features]
-default = ["http", "register-http", "register-filesystem"]
-register-http = ["ureq"] # enables wasm to be downloaded using http
-register-filesystem = [] # enables wasm to be loaded from disk
-http = ["ureq"]          # enables extism_http_request
+default = ["http", "register-http", "register-filesystem", "wasmtime-default-features"]
+register-http = ["ureq"]           # enables wasm to be downloaded using http
+register-filesystem = []           # enables wasm to be loaded from disk
+http = ["ureq"]                    # enables extism_http_request
+wasmtime-exceptions = []           # enables exception-handling proposal in wasmtime (requires wasmtime gc feature)
+wasmtime-default-features = [
+  'wasmtime/default',
+]
+

 [build-dependencies]
-cbindgen = { version = "0.27", default-features = false }
+cbindgen = { version = "0.29", default-features = false }

 [dev-dependencies]
-criterion = "0.5.1"
+criterion = "0.7.0"
 quickcheck = "1"
-rand = "0.8.5"
+rand = "0.9.0"

 [[bench]]
 name = "bench"
--- a/runtime/README.md
+++ b/runtime/README.md
@@ -24,7 +24,7 @@ There are a few environment variables that can be used for debugging purposes:
 - `EXTISM_COREDUMP=extism.core`: write [coredump](https://github.com/WebAssembly/tool-conventions/blob/main/Coredump.md) to a file when a WebAssembly function traps
 - `EXTISM_DEBUG=1`: generate debug information
 - `EXTISM_PROFILE=perf|jitdump|vtune`: enable Wasmtime profiling
- `EXTISM_CACHE_CONFIG=path/to/config.toml`: enable Wasmtime cache, see [the docs](https://docs.wasmtime.dev/cli-cache.html) for details about configuration. Setting this to an empty string will disable caching.
+- `EXTISM_CACHE_CONFIG=path/to/config.toml`: enable Wasmtime cache, details [here](#wasmtime-caching)

 > *Note*: The debug and coredump info will only be written if the plug-in has an error.

@@ -88,7 +88,7 @@ println!("{:?}", res);

 ### Plug-in State

-Plug-ins may be stateful or stateless. Plug-ins can maintain state b/w calls by the use of variables. Our count vowels plug-in remembers the total number of vowels it's ever counted in the "total" key in the result. You can see this by making subsequent calls to the export:
+Plug-ins may be stateful or stateless. Plug-ins can maintain state between calls by the use of variables. Our count vowels plug-in remembers the total number of vowels it's ever counted in the "total" key in the result. You can see this by making subsequent calls to the export:

 ```rust
 let res = plugin.call::<&str, &str>("count_vowels", "Hello, world!").unwrap();
@@ -112,7 +112,8 @@ let mut plugin = Plugin::new(&manifest, [], true);
 let res = plugin.call::<&str, &str>("count_vowels", "Yellow, world!").unwrap();
 println!("{}", res);
 # => {"count": 3, "total": 3, "vowels": "aeiouAEIOU"}
-let mut plugin = Plugin::new(&manifest, [], true).with_config_key("vowels", "aeiouyAEIOUY");
+let manifest = Manifest::new([url]).with_config_key("vowels", "aeiouyAEIOUY");
+let mut plugin = Plugin::new(&manifest, [], true).unwrap();
 let res = plugin.call::<&str, &str>("count_vowels", "Yellow, world!").unwrap();
 println!("{}", res);
 # => {"count": 4, "total": 4, "vowels": "aeiouyAEIOUY"}
@@ -219,5 +220,52 @@ println!("{}", res);
 # => {"count": 3, "total": 6, "vowels": "aeiouAEIOU"}
 ```

+### Logging

+Plug-ins can't directly print anything to the console. They can however use Extism's built-in logging functionality, for example the [`log!` macro in the rust-pdk](https://docs.rs/extism-pdk/1.4.0/extism_pdk/macro.log.html) or the [`logInfo` function in the haskell-pdk](https://hackage.haskell.org/package/extism-pdk-1.2.0.0/docs/Extism-PDK.html#v:logInfo).

+Inside your host application, the rust-sdk emits these as [tracing](https://github.com/tokio-rs/tracing) events. The simplest way to make the logged messages visible is by adding the `tracing_subscriber` dependency to your crate and then initializing a tracing subscriber at the top of your main function:
+
+```rust
+tracing_subscriber::fmt::init();
+```
+
+### Wasmtime Caching
+
+To enable or disable caching for plugin compilation, you need to provide a configuration file that will be used by the [wasmtime crate](https://github.com/bytecodealliance/wasmtime).
+
+For more information and values that can be used for configuring caching, take a look at [the docs](https://docs.wasmtime.dev/cli-cache.html).
+
+> *Note*: As of now extism uses wasmtime [`version = ">= 27.0.0, < 31.0.0"`](https://github.com/extism/extism/blob/v1.11.1/runtime/Cargo.toml#L12), but the `enabled` key requirement [was removed](https://github.com/bytecodealliance/wasmtime/pull/10859) from `wasmtime` and its documentation, this could explain the `failed to parse config file` error you might encounter without it.
+
+An example configuration for caching would be:
+
+```toml
+[cache]
+enabled = true # This value is required
+directory = "/some/path"
+```
+
+You can :
+- [Create a global `wasmtime` configuration file](#using-a-configuration-file) in `$HOME/.config/wasmtime/config.toml`.
+- [Set the `EXTISM_CACHE_CONFIG` environment variable](#using-an-environment-variable)
+- [Set the configuration file path using `PluginBuilder`](#using-pluginbuilder)
+
+#### Using a configuration file
+
+The [wasmtime](https://github.com/bytecodealliance/wasmtime) crate, by default, will look for a configuration file in your systems' default configuration directory (for example on UNIX systems: `$HOME/.config/wasmtime/config.toml`),
+for more [information on this behaviour](`https://docs.rs/wasmtime/31.0.0/wasmtime/struct.Config.html#method.cache_config_load_default`).
+
+#### Using an environment variable
+
+You can set the `EXTISM_CACHE_CONFIG=path/to/config.toml` environment variable to set the path of the configuration file used by [wasmtime](https://github.com/bytecodealliance/wasmtime).
+Setting the variable to an empty string will disable caching (it won't load any configuration file).
+
+> *Note*: If the environment variable is not set, `wasmtime` will still try to read from a configuration file that may exist in your system's default configuration folder (e.g. `$HOME/.config/wasmtime/config.toml`).
+
+The environment variable does not override the path you might have set using `PluginBuilder`. will only be checked for if you did not specify a cache configuration path in `PluginBuilder`.
+
+#### Using PluginBuilder
+
+If you use a [PluginBuilder](https://docs.rs/extism/latest/extism/struct.PluginBuilder.html), you can set the `wasmtime` configuration path using the [with_cache_config](https://docs.rs/extism/latest/extism/struct.PluginBuilder.html#method.with_cache_config) method.
+This will override the `EXTISM_CACHE_CONFIG` environment variable if it's set, so you could have a "global" and per plugin configuration if needed.
--- a/runtime/benches/bench.rs
+++ b/runtime/benches/bench.rs
@@ -6,6 +6,7 @@ const COUNT_VOWELS: &[u8] = include_bytes!("../../wasm/code.wasm");
 const REFLECT: &[u8] = include_bytes!("../../wasm/reflect.wasm");
 const ECHO: &[u8] = include_bytes!("../../wasm/echo.wasm");
 const CONSUME: &[u8] = include_bytes!("../../wasm/consume.wasm");
+const ALLOCATIONS: &[u8] = include_bytes!("../../wasm/allocations.wasm");

 host_fn!(hello_world (a: String) -> String { Ok(a) });

@@ -35,6 +36,31 @@ pub fn create_plugin(c: &mut Criterion) {
    });
 }

+pub fn create_compiled(c: &mut Criterion) {
+    let mut g = c.benchmark_group("create");
+    g.noise_threshold(1.0);
+    g.significance_level(0.2);
+    g.bench_function("create_compiled", |b| {
+        b.iter(|| {
+            let plugin = PluginBuilder::new(COUNT_VOWELS).with_wasi(true);
+            let _compiled = CompiledPlugin::new(plugin).unwrap();
+        })
+    });
+}
+
+pub fn create_plugin_compiled(c: &mut Criterion) {
+    let mut g = c.benchmark_group("create");
+    g.noise_threshold(1.0);
+    g.significance_level(0.2);
+    let plugin = PluginBuilder::new(COUNT_VOWELS).with_wasi(true);
+    let compiled = CompiledPlugin::new(plugin).unwrap();
+    g.bench_function("create_plugin_compiled", |b| {
+        b.iter(|| {
+            let _plugin = Plugin::new_from_compiled(&compiled).unwrap();
+        })
+    });
+}
+
 pub fn create_plugin_no_cache(c: &mut Criterion) {
    let mut g = c.benchmark_group("create");
    g.noise_threshold(1.0);
@@ -168,6 +194,17 @@ pub fn reflect(c: &mut Criterion) {
    }
 }

+pub fn allocations(c: &mut Criterion) {
+    let mut g = c.benchmark_group("allocations");
+
+    let mut plugin = PluginBuilder::new(ALLOCATIONS).build().unwrap();
+    g.bench_function("allocations", |b| {
+        b.iter(|| {
+            plugin.call::<_, ()>("allocations", "").unwrap();
+        })
+    });
+}
+
 // This is an apples-to-apples comparison of a linked wasm "reflect" function to our host "reflect"
 // function.
 pub fn reflect_linked(c: &mut Criterion) {
@@ -260,13 +297,16 @@ pub fn reflect_linked(c: &mut Criterion) {

 criterion_group!(
    benches,
+    allocations,
    consume,
    echo,
    reflect,
    reflect_linked,
    basic,
    create_plugin,
+    create_plugin_compiled,
    create_plugin_no_cache,
+    create_compiled,
    count_vowels
 );
 criterion_main!(benches);
--- a/runtime/build.rs
+++ b/runtime/build.rs
@@ -24,6 +24,7 @@ fn main() {
        .rename_item("CurrentPlugin", "ExtismCurrentPlugin")
        .rename_item("CancelHandle", "ExtismCancelHandle")
        .rename_item("Plugin", "ExtismPlugin")
+        .rename_item("CompiledPlugin", "ExtismCompiledPlugin")
        .rename_item("Function", "ExtismFunction")
        .with_style(cbindgen::Style::Type)
        .generate()
--- a/runtime/examples/fs.rs
+++ b/runtime/examples/fs.rs
@@ -2,6 +2,8 @@ use extism::*;
 fn main() {
    let url = Wasm::file("../wasm/read_write.wasm");
    let manifest = Manifest::new([url])
+        // This will fail because we're using a readonly path (specified with the `ro:` prefix)
+        // to overwrite the data file, remove `ro:` from the path on the following line
        .with_allowed_path("ro:src/tests/data".to_string(), "/data")
        .with_config_key("path", "/data/data.txt");

@@ -14,10 +16,11 @@ fn main() {

    let res = plugin.call::<&str, &str>("try_read", "").unwrap();

-    println!("{:?}", res);
+    println!("{res:?}");

    println!("-----------------------------------------------------");

+    // If the allowed path is readonly then writing back to the file should fail
    println!("trying to write file: ");
    let line = format!(
        "Hello World at {:?}\n",
@@ -27,7 +30,7 @@ fn main() {
    );
    let res2 = plugin.call::<&str, &str>("try_write", &line).unwrap();

-    println!("{:?}", res2);
+    println!("{res2:?}");

    println!("done!");
 }
--- a/runtime/examples/linking.rs
+++ b/runtime/examples/linking.rs
@@ -30,6 +30,6 @@ fn main() {
        let res = plugin
            .call::<&str, &str>("reflect", "Hello, world!")
            .unwrap();
-        println!("{}", res);
+        println!("{res}");
    }
 }
--- a/runtime/examples/log_callback.rs
+++ b/runtime/examples/log_callback.rs
@@ -25,6 +25,6 @@ fn main() {
    println!("Dumping logs");

    for line in LOGS.lock().unwrap().iter() {
-        print!("{}", line);
+        print!("{line}");
    }
 }
--- a/runtime/examples/readme.rs
+++ b/runtime/examples/readme.rs
@@ -52,6 +52,6 @@ fn main() {
        let res = plugin
            .call::<&str, &str>("count_vowels", "Hello, world!")
            .unwrap();
-        println!("{}", res);
+        println!("{res}");
    }
 }
--- a/runtime/extism.h
+++ b/runtime/extism.h
@@ -52,6 +52,8 @@ typedef enum {
 */
 typedef struct ExtismCancelHandle ExtismCancelHandle;

+typedef struct ExtismCompiledPlugin ExtismCompiledPlugin;
+
 /**
 * CurrentPlugin stores data that is available to the caller in PDK functions, this should
 * only be accessed from inside a host function
@@ -154,7 +156,7 @@ void extism_current_plugin_memory_free(ExtismCurrentPlugin *plugin, ExtismMemory
 * - `n_outputs`: number of return types
 * - `func`: the function to call
 * - `user_data`: a pointer that will be passed to the function when it's called
- *    this value should live as long as the function exists
+ *   this value should live as long as the function exists
 * - `free_user_data`: a callback to release the `user_data` value when the resulting
 *   `ExtismFunction` is freed.
 *
@@ -179,6 +181,32 @@ void extism_function_free(ExtismFunction *f);
 */
 void extism_function_set_namespace(ExtismFunction *ptr, const char *namespace_);

+/**
+ * Pre-compile an Extism plugin
+ */
+ExtismCompiledPlugin *extism_compiled_plugin_new(const uint8_t *wasm,
+                                                 ExtismSize wasm_size,
+                                                 const ExtismFunction **functions,
+                                                 ExtismSize n_functions,
+                                                 bool with_wasi,
+                                                 char **errmsg);
+
+/**
+ * Pre-compile an Extism plugin and set the number of instructions a plugin is allowed to execute
+ */
+ExtismCompiledPlugin *extism_compiled_plugin_new_with_fuel_limit(const uint8_t *wasm,
+                                                                 ExtismSize wasm_size,
+                                                                 const ExtismFunction **functions,
+                                                                 ExtismSize n_functions,
+                                                                 bool with_wasi,
+                                                                 uint64_t fuel_limit,
+                                                                 char **errmsg);
+
+/**
+ * Free `ExtismCompiledPlugin`
+ */
+void extism_compiled_plugin_free(ExtismCompiledPlugin *plugin);
+
 /**
 * Create a new plugin with host functions, the functions passed to this function no longer need to be manually freed using
 *
@@ -195,6 +223,11 @@ ExtismPlugin *extism_plugin_new(const uint8_t *wasm,
                                bool with_wasi,
                                char **errmsg);

+/**
+ * Create a new plugin from an `ExtismCompiledPlugin`
+ */
+ExtismPlugin *extism_plugin_new_from_compiled(const ExtismCompiledPlugin *compiled, char **errmsg);
+
 /**
 * Create a new plugin and set the number of instructions a plugin is allowed to execute
 */
@@ -206,13 +239,18 @@ ExtismPlugin *extism_plugin_new_with_fuel_limit(const uint8_t *wasm,
                                                uint64_t fuel_limit,
                                                char **errmsg);

+/**
+ * Enable HTTP response headers in plugins using `extism:host/env::http_request`
+ */
+void extism_plugin_allow_http_response_headers(ExtismPlugin *plugin);
+
 /**
 * Free the error returned by `extism_plugin_new`, errors returned from `extism_plugin_error` don't need to be freed
 */
 void extism_plugin_new_error_free(char *err);

 /**
- * Remove a plugin from the registry and free associated memory
+ * Free `ExtismPlugin`
 */
 void extism_plugin_free(ExtismPlugin *plugin);

--- a/runtime/src/current_plugin.rs
+++ b/runtime/src/current_plugin.rs
@@ -14,6 +14,7 @@ pub struct CurrentPlugin {
    pub(crate) linker: *mut wasmtime::Linker<CurrentPlugin>,
    pub(crate) wasi: Option<Wasi>,
    pub(crate) http_status: u16,
+    pub(crate) http_headers: Option<std::collections::BTreeMap<String, String>>,
    pub(crate) available_pages: Option<u32>,
    pub(crate) memory_limiter: Option<MemoryLimiter>,
    pub(crate) id: uuid::Uuid,
@@ -55,7 +56,12 @@ impl wasmtime::ResourceLimiter for MemoryLimiter {
        Ok(true)
    }

-    fn table_growing(&mut self, _current: u32, desired: u32, maximum: Option<u32>) -> Result<bool> {
+    fn table_growing(
+        &mut self,
+        _current: usize,
+        desired: usize,
+        maximum: Option<usize>,
+    ) -> Result<bool> {
        if let Some(max) = maximum {
            return Ok(desired <= max);
        }
@@ -200,15 +206,16 @@ impl CurrentPlugin {
            anyhow::bail!("expected extism_context to be an externref value",)
        };

-        match xs
-            .data_mut(&mut *store)?
-            .downcast_mut::<Box<dyn std::any::Any + Send + Sync>>()
-        {
-            Some(xs) => match xs.downcast_mut::<T>() {
-                Some(xs) => Ok(xs),
-                None => anyhow::bail!("could not downcast extism_context inner value"),
-            },
-            None => anyhow::bail!("could not downcast extism_context"),
+        if let Some(d) = xs.data_mut(&mut *store)? {
+            match d.downcast_mut::<Box<dyn std::any::Any + Send + Sync>>() {
+                Some(xs) => match xs.downcast_mut::<T>() {
+                    Some(xs) => Ok(xs),
+                    None => anyhow::bail!("could not downcast extism_context inner value"),
+                },
+                None => anyhow::bail!("could not downcast extism_context"),
+            }
+        } else {
+            anyhow::bail!("extism_context not found")
        }
    }

@@ -332,6 +339,7 @@ impl CurrentPlugin {
        manifest: extism_manifest::Manifest,
        wasi: bool,
        available_pages: Option<u32>,
+        allow_http_response_headers: bool,
        id: uuid::Uuid,
    ) -> Result<Self, Error> {
        let wasi = if wasi {
@@ -394,6 +402,11 @@ impl CurrentPlugin {
            memory_limiter,
            id,
            start_time: std::time::Instant::now(),
+            http_headers: if allow_http_response_headers {
+                Some(BTreeMap::new())
+            } else {
+                None
+            },
        })
    }

@@ -464,10 +477,7 @@ impl CurrentPlugin {
            offset: offs,
            length,
        });
-        match s {
-            Ok(s) => Some(s),
-            Err(_) => None,
-        }
+        s.ok()
    }

    #[doc(hidden)]
--- a/runtime/src/extism-runtime.wasm
+++ b/runtime/src/extism-runtime.wasm
--- a/runtime/src/function.rs
+++ b/runtime/src/function.rs
@@ -284,8 +284,8 @@ impl Function {
 /// A few things worth noting:
 /// - The function always returns a `Result` that wraps the specified return type
 /// - If a first parameter and type are passed (`_user_data` above) followed by a semicolon it will be
-///    the name of the `UserData` parameter and can be used from inside the function
-//     definition.
+///   the name of the `UserData` parameter and can be used from inside the function
+//    definition.
 #[macro_export]
 macro_rules! host_fn {
    ($pub:vis $name: ident  ($($arg:ident : $argty:ty),*) $(-> $ret:ty)? $b:block) => {
--- a/runtime/src/lib.rs
+++ b/runtime/src/lib.rs
@@ -29,6 +29,7 @@ pub(crate) mod manifest;
 pub(crate) mod pdk;
 mod plugin;
 mod plugin_builder;
+mod pool;
 mod readonly_dir;
 mod timer;

@@ -39,8 +40,11 @@ pub use current_plugin::CurrentPlugin;
 pub use extism_convert::{FromBytes, FromBytesOwned, ToBytes};
 pub use extism_manifest::{Manifest, Wasm, WasmMetadata};
 pub use function::{Function, UserData, Val, ValType, PTR};
-pub use plugin::{CancelHandle, Plugin, WasmInput, EXTISM_ENV_MODULE, EXTISM_USER_MODULE};
+pub use plugin::{
+    CancelHandle, CompiledPlugin, Plugin, WasmInput, EXTISM_ENV_MODULE, EXTISM_USER_MODULE,
+};
 pub use plugin_builder::{DebugOptions, PluginBuilder};
+pub use pool::{Pool, PoolBuilder, PoolPlugin};

 pub(crate) use internal::{Internal, Wasi};
 pub(crate) use timer::{Timer, TimerAction};
@@ -94,7 +98,7 @@ pub fn set_log_callback<F: 'static + Clone + Fn(&str)>(
        let x = tracing_subscriber::EnvFilter::builder()
            .with_default_directive(tracing::Level::ERROR.into());
        if is_level {
-            x.parse_lossy(format!("extism={}", filter))
+            x.parse_lossy(format!("extism={filter}"))
        } else {
            x.parse_lossy(filter)
        }
--- a/runtime/src/manifest.rs
+++ b/runtime/src/manifest.rs
@@ -10,7 +10,7 @@ use crate::*;
 fn hex(data: &[u8]) -> String {
    let mut s = String::new();
    for &byte in data {
-        write!(&mut s, "{:02x}", byte).unwrap();
+        write!(&mut s, "{byte:02x}").unwrap();
    }
    s
 }
@@ -86,14 +86,16 @@ fn to_module(engine: &Engine, wasm: &extism_manifest::Wasm) -> Result<(String, M
            #[cfg(feature = "register-http")]
            {
                // Setup request
-                let mut req = ureq::request(method.as_deref().unwrap_or("GET"), url);
+                let mut req = ureq::http::request::Builder::new()
+                    .method(method.as_deref().unwrap_or("GET").to_uppercase().as_str())
+                    .uri(url);

                for (k, v) in headers.iter() {
-                    req = req.set(k, v);
+                    req = req.header(k, v);
                }

                // Fetch WASM code
-                let mut r = req.call()?.into_reader();
+                let mut r = ureq::run(req.body(())?)?.into_body().into_reader();
                let mut data = Vec::new();
                r.read_to_end(&mut data)?;

--- a/runtime/src/pdk.rs
+++ b/runtime/src/pdk.rs
@@ -20,6 +20,8 @@ macro_rules! args {
 /// Get a configuration value
 /// Params: i64 (offset)
 /// Returns: i64 (offset)
+/// **Note**: this function takes ownership of the handle passed in
+/// the caller should not `free` this value
 pub(crate) fn config_get(
    mut caller: Caller<CurrentPlugin>,
    input: &[Val],
@@ -38,6 +40,7 @@ pub(crate) fn config_get(
    };
    let val = data.manifest.config.get(key);
    let ptr = val.map(|x| (x.len(), x.as_ptr()));
+    data.memory_free(handle)?;
    let mem = match ptr {
        Some((len, ptr)) => {
            let bytes = unsafe { std::slice::from_raw_parts(ptr, len) };
@@ -55,6 +58,9 @@ pub(crate) fn config_get(
 /// Get a variable
 /// Params: i64 (offset)
 /// Returns: i64 (offset)
+/// **Note**: this function takes ownership of the handle passed in
+/// the caller should not `free` this value, but the return value
+/// will need to be freed
 pub(crate) fn var_get(
    mut caller: Caller<CurrentPlugin>,
    input: &[Val],
@@ -73,6 +79,8 @@ pub(crate) fn var_get(
    };
    let val = data.vars.get(key);
    let ptr = val.map(|x| (x.len(), x.as_ptr()));
+    data.memory_free(handle)?;
+
    let mem = match ptr {
        Some((len, ptr)) => {
            let bytes = unsafe { std::slice::from_raw_parts(ptr, len) };
@@ -90,6 +98,8 @@ pub(crate) fn var_get(
 /// Set a variable, if the value offset is 0 then the provided key will be removed
 /// Params: i64 (key offset), i64 (value offset)
 /// Returns: none
+/// **Note**: this function takes ownership of the handles passed in
+/// the caller should not `free` these values
 pub(crate) fn var_set(
    mut caller: Caller<CurrentPlugin>,
    input: &[Val],
@@ -104,12 +114,12 @@ pub(crate) fn var_set(
    let voffset = args!(input, 1, i64) as u64;
    let key_offs = args!(input, 0, i64) as u64;

+    let key_handle = match data.memory_handle(key_offs) {
+        Some(h) => h,
+        None => anyhow::bail!("invalid handle offset for var key: {key_offs}"),
+    };
    let key = {
-        let handle = match data.memory_handle(key_offs) {
-            Some(h) => h,
-            None => anyhow::bail!("invalid handle offset for var key: {key_offs}"),
-        };
-        let key = data.memory_str(handle)?;
+        let key = data.memory_str(key_handle)?;
        let key_len = key.len();
        let key_ptr = key.as_ptr();
        unsafe { std::str::from_utf8_unchecked(std::slice::from_raw_parts(key_ptr, key_len)) }
@@ -118,6 +128,7 @@ pub(crate) fn var_set(
    // Remove if the value offset is 0
    if voffset == 0 {
        data.vars.remove(key);
+        data.memory_free(key_handle)?;
        return Ok(());
    }

@@ -144,6 +155,9 @@ pub(crate) fn var_set(

    let value = data.memory_bytes(handle)?.to_vec();

+    data.memory_free(handle)?;
+    data.memory_free(key_handle)?;
+
    // Insert the value from memory into the `vars` map
    data.vars.insert(key.to_string(), value);

@@ -153,6 +167,9 @@ pub(crate) fn var_set(
 /// Make an HTTP request
 /// Params: i64 (offset to JSON encoded HttpRequest), i64 (offset to body or 0)
 /// Returns: i64 (offset)
+/// **Note**: this function takes ownership of the handles passed in
+/// the caller should not `free` these values, the result will need to
+/// be freed.
 pub(crate) fn http_request(
    #[allow(unused_mut)] mut caller: Caller<CurrentPlugin>,
    input: &[Val],
@@ -166,6 +183,7 @@ pub(crate) fn http_request(
            Some(h) => h,
            None => anyhow::bail!("http_request input is invalid: {http_req_offset}"),
        };
+        data.memory_free(handle)?;
        let req: extism_manifest::HttpRequest = serde_json::from_slice(data.memory_bytes(handle)?)?;
        output[0] = Val::I64(0);
        anyhow::bail!(
@@ -176,12 +194,16 @@ pub(crate) fn http_request(

    #[cfg(feature = "http")]
    {
+        data.http_headers.iter_mut().for_each(|x| x.clear());
+        data.http_status = 0;
+
        use std::io::Read;
        let handle = match data.memory_handle(http_req_offset) {
            Some(h) => h,
            None => anyhow::bail!("invalid handle offset for http request: {http_req_offset}"),
        };
        let req: extism_manifest::HttpRequest = serde_json::from_slice(data.memory_bytes(handle)?)?;
+        data.memory_free(handle)?;

        let body_offset = args!(input, 1, i64) as u64;

@@ -211,17 +233,22 @@ pub(crate) fn http_request(
            )));
        }

-        let mut r = ureq::request(req.method.as_deref().unwrap_or("GET"), &req.url);
+        let mut r = ureq::http::request::Builder::new()
+            .method(
+                req.method
+                    .as_deref()
+                    .unwrap_or("GET")
+                    .to_uppercase()
+                    .as_str(),
+            )
+            .uri(&req.url);

        for (k, v) in req.headers.iter() {
-            r = r.set(k, v);
+            r = r.header(k, v);
        }

        // Set HTTP timeout to respect the manifest timeout
-        if let Some(remaining) = data.time_remaining() {
-            r = r.timeout(remaining);
-        }
-
+        let timeout = data.time_remaining();
        let res = if body_offset > 0 {
            let handle = match data.memory_handle(body_offset) {
                Some(h) => h,
@@ -230,27 +257,48 @@ pub(crate) fn http_request(
                }
            };
            let buf: &[u8] = data.memory_bytes(handle)?;
-            r.send_bytes(buf)
+            let agent = ureq::agent();
+            let config = agent
+                .configure_request(r.body(buf)?)
+                .http_status_as_error(false);
+            let req = config.timeout_global(timeout).build();
+            ureq::run(req)
        } else {
-            r.call()
+            let agent = ureq::agent();
+            let config = agent
+                .configure_request(r.body(())?)
+                .http_status_as_error(false);
+            let req = config.timeout_global(timeout).build();
+            ureq::run(req)
        };

+        if let Some(handle) = data.memory_handle(body_offset) {
+            data.memory_free(handle)?;
+        }
+
        let reader = match res {
            Ok(res) => {
-                data.http_status = res.status();
-                Some(res.into_reader())
+                if let Some(headers) = &mut data.http_headers {
+                    for (name, h) in res.headers() {
+                        if let Ok(h) = h.to_str() {
+                            headers.insert(name.as_str().to_string(), h.to_string());
+                        }
+                    }
+                }
+                data.http_status = res.status().as_u16();
+                Some(res.into_body().into_reader())
            }
            Err(e) => {
                // Catch timeout and return
                if let Some(d) = data.time_remaining() {
-                    if e.kind() == ureq::ErrorKind::Io && d.as_nanos() == 0 {
+                    if matches!(e, ureq::Error::Timeout(_)) && d.as_nanos() == 0 {
                        anyhow::bail!("timeout");
                    }
                }
                let msg = e.to_string();
-                if let Some(res) = e.into_response() {
-                    data.http_status = res.status();
-                    Some(res.into_reader())
+                if let ureq::Error::StatusCode(res) = e {
+                    data.http_status = res;
+                    None
                } else {
                    return Err(Error::msg(msg));
                }
@@ -294,6 +342,24 @@ pub(crate) fn http_status_code(
    Ok(())
 }

+/// Get the HTTP response headers from the last HTTP request
+/// Params: none
+/// Returns: i64 (offset)
+pub(crate) fn http_headers(
+    mut caller: Caller<CurrentPlugin>,
+    _input: &[Val],
+    output: &mut [Val],
+) -> Result<(), Error> {
+    let data: &mut CurrentPlugin = caller.data_mut();
+    if let Some(h) = &data.http_headers {
+        let headers = serde_json::to_string(h)?;
+        data.memory_set_val(&mut output[0], headers)?;
+    } else {
+        output[0] = Val::I64(0);
+    }
+    Ok(())
+}
+
 pub fn log(
    level: tracing::Level,
    mut caller: Caller<CurrentPlugin>,
@@ -302,19 +368,21 @@ pub fn log(
 ) -> Result<(), Error> {
    let data: &mut CurrentPlugin = caller.data_mut();

+    let offset = args!(input, 0, i64) as u64;
+
    // Check if the current log level should be logged
    let global_log_level = tracing::level_filters::LevelFilter::current();
    if global_log_level == tracing::level_filters::LevelFilter::OFF || level > global_log_level {
+        if let Some(handle) = data.memory_handle(offset) {
+            data.memory_free(handle)?;
+        }
        return Ok(());
    }

-    let offset = args!(input, 0, i64) as u64;
-
    let handle = match data.memory_handle(offset) {
        Some(h) => h,
        None => anyhow::bail!("invalid handle offset for log message: {offset}"),
    };
-
    let id = data.id.to_string();
    let buf = data.memory_str(handle);

@@ -338,12 +406,16 @@ pub fn log(
        },
        Err(_) => tracing::error!(plugin = id, "unable to log message: {:?}", buf),
    }
+
+    data.memory_free(handle)?;
    Ok(())
 }

 /// Write to logs (warning)
 /// Params: i64 (offset)
 /// Returns: none
+/// **Note**: this function takes ownership of the handle passed in
+/// the caller should not `free` this value
 pub(crate) fn log_warn(
    caller: Caller<CurrentPlugin>,
    input: &[Val],
@@ -355,6 +427,8 @@ pub(crate) fn log_warn(
 /// Write to logs (info)
 /// Params: i64 (offset)
 /// Returns: none
+/// **Note**: this function takes ownership of the handle passed in
+/// the caller should not `free` this value
 pub(crate) fn log_info(
    caller: Caller<CurrentPlugin>,
    input: &[Val],
@@ -366,6 +440,8 @@ pub(crate) fn log_info(
 /// Write to logs (debug)
 /// Params: i64 (offset)
 /// Returns: none
+/// **Note**: this function takes ownership of the handle passed in
+/// the caller should not `free` this value
 pub(crate) fn log_debug(
    caller: Caller<CurrentPlugin>,
    input: &[Val],
@@ -377,6 +453,8 @@ pub(crate) fn log_debug(
 /// Write to logs (error)
 /// Params: i64 (offset)
 /// Returns: none
+/// **Note**: this function takes ownership of the handle passed in
+/// the caller should not `free` this value
 pub(crate) fn log_error(
    caller: Caller<CurrentPlugin>,
    input: &[Val],
@@ -388,6 +466,8 @@ pub(crate) fn log_error(
 /// Write to logs (trace)
 /// Params: i64 (offset)
 /// Returns: none
+/// **Note**: this function takes ownership of the handle passed in
+/// the caller should not `free` this value
 pub(crate) fn log_trace(
    caller: Caller<CurrentPlugin>,
    input: &[Val],
--- a/runtime/src/plugin.rs
+++ b/runtime/src/plugin.rs
@@ -2,9 +2,11 @@ use std::{
    any::Any,
    collections::{BTreeMap, BTreeSet},
    path::PathBuf,
+    sync::TryLockError,
 };

 use anyhow::Context;
+use plugin_builder::PluginBuilderOptions;

 use crate::*;

@@ -38,6 +40,93 @@ impl CancelHandle {
    }
 }

+#[derive(Clone)]
+pub struct CompiledPlugin {
+    pub(crate) manifest: Manifest,
+    pub(crate) modules: BTreeMap<String, Module>,
+    pub(crate) options: PluginBuilderOptions,
+    pub(crate) engine: wasmtime::Engine,
+}
+
+impl CompiledPlugin {
+    /// Create a new pre-compiled plugin
+    pub fn new(builder: PluginBuilder) -> Result<CompiledPlugin, Error> {
+        let mut config = builder.config.unwrap_or_default();
+        config
+            .async_support(false)
+            .epoch_interruption(true)
+            .debug_info(builder.options.debug_options.debug_info)
+            .coredump_on_trap(builder.options.debug_options.coredump.is_some())
+            .profiler(builder.options.debug_options.profiling_strategy)
+            .wasm_tail_call(true)
+            .wasm_function_references(true)
+            .wasm_gc(true);
+        #[cfg(feature = "wasmtime-exceptions")]
+        {
+            config.wasm_exceptions(true);
+        }
+
+        if builder.options.fuel.is_some() {
+            config.consume_fuel(true);
+        }
+
+        config.cache(Self::configure_cache(&builder.options.cache_config)?);
+
+        let engine = Engine::new(&config)?;
+
+        let (manifest, modules) = manifest::load(&engine, builder.source)?;
+        if modules.len() <= 1 {
+            anyhow::bail!("No wasm modules provided");
+        } else if !modules.contains_key(MAIN_KEY) {
+            anyhow::bail!("No main module provided");
+        }
+
+        Ok(CompiledPlugin {
+            manifest,
+            modules,
+            options: builder.options,
+            engine,
+        })
+    }
+
+    /// Return optional cache according to builder options.
+    fn configure_cache(
+        cache_opt: &Option<Option<std::path::PathBuf>>,
+    ) -> Result<Option<wasmtime::Cache>, Error> {
+        match cache_opt {
+            // Explicitly disabled
+            Some(None) => Ok(None),
+
+            // Explicit path
+            Some(Some(p)) => {
+                let cache = wasmtime::Cache::from_file(Some(p.as_path()))?;
+                Ok(Some(cache))
+            }
+
+            // Unspecified, try environment, then system fallback
+            None => {
+                match std::env::var_os("EXTISM_CACHE_CONFIG") {
+                    Some(val) => {
+                        if val.is_empty() {
+                            // Disable cache if env var exists but is empty
+                            Ok(None)
+                        } else {
+                            let p = PathBuf::from(val);
+                            let cache = wasmtime::Cache::from_file(Some(p.as_path()))?;
+                            Ok(Some(cache))
+                        }
+                    }
+                    None => {
+                        // load cache configuration from the system default path
+                        let cache = wasmtime::Cache::from_file(None)?;
+                        Ok(Some(cache))
+                    }
+                }
+            }
+        }
+    }
+}
+
 /// Plugin contains everything needed to execute a WASM function
 pub struct Plugin {
    /// A unique ID for each plugin
@@ -130,6 +219,7 @@ pub(crate) fn profiling_strategy() -> ProfilingStrategy {
 /// Defines an input type for Wasm data.
 ///
 /// Types that implement `Into<WasmInput>` can be passed directly into `Plugin::new`
+#[derive(Clone)]
 pub enum WasmInput<'a> {
    /// Raw Wasm module
    Data(std::borrow::Cow<'a, [u8]>),
@@ -139,7 +229,7 @@ pub enum WasmInput<'a> {
    ManifestRef(&'a Manifest),
 }

-impl<'a> From<Manifest> for WasmInput<'a> {
+impl From<Manifest> for WasmInput<'_> {
    fn from(value: Manifest) -> Self {
        WasmInput::Manifest(value)
    }
@@ -169,7 +259,7 @@ impl<'a> From<&'a str> for WasmInput<'a> {
    }
 }

-impl<'a> From<Vec<u8>> for WasmInput<'a> {
+impl From<Vec<u8>> for WasmInput<'_> {
    fn from(value: Vec<u8>) -> Self {
        WasmInput::Data(value.into())
    }
@@ -256,6 +346,7 @@ fn relink(
        var_set(I64, I64);
        http_request(I64, I64) -> I64;
        http_status_code() -> I32;
+        http_headers() -> I64;
        log_warn(I64);
        log_info(I64);
        log_debug(I64);
@@ -264,6 +355,37 @@ fn relink(
        get_log_level() -> I32;
    );

+    for (name, module) in modules.iter() {
+        if name == EXTISM_ENV_MODULE {
+            continue;
+        }
+
+        for import in module.imports() {
+            if import.module() == EXTISM_ENV_MODULE
+                && modules[EXTISM_ENV_MODULE]
+                    .get_export(import.name())
+                    .is_none()
+                && linker
+                    .get(&mut store, EXTISM_ENV_MODULE, import.name())
+                    .is_none()
+            {
+                let (kind, ty) = match import.ty() {
+                    ExternType::Func(t) => ("function", t.to_string()),
+                    ExternType::Global(t) => ("global", t.content().to_string()),
+                    ExternType::Tag(t) => ("tag", t.ty().to_string()),
+                    ExternType::Table(t) => ("table", t.element().to_string()),
+                    ExternType::Memory(_) => ("memory", String::new()),
+                };
+                anyhow::bail!(
+                    "Invalid {kind} import from extism:host/env: {} {ty}\n\n\
+                    Note: This may indicate that the PDK that was used to build this plugin has additional features that aren't \
+                    available in this version of the SDK, try updating the SDK to the latest version.",
+                    import.name(),
+                )
+            }
+        }
+    }
+
    let mut linked = BTreeSet::new();
    linker.module(&mut store, EXTISM_ENV_MODULE, &modules[EXTISM_ENV_MODULE])?;
    linked.insert(EXTISM_ENV_MODULE.to_string());
@@ -310,82 +432,45 @@ impl Plugin {
        imports: impl IntoIterator<Item = Function>,
        with_wasi: bool,
    ) -> Result<Plugin, Error> {
-        Self::build_new(
-            wasm.into(),
-            imports,
-            with_wasi,
-            Default::default(),
-            None,
-            None,
-        )
+        Self::new_from_compiled(&CompiledPlugin::new(
+            PluginBuilder::new(wasm)
+                .with_functions(imports)
+                .with_wasi(with_wasi),
+        )?)
    }

-    pub(crate) fn build_new(
-        wasm: WasmInput<'_>,
-        imports: impl IntoIterator<Item = Function>,
-        with_wasi: bool,
-        debug_options: DebugOptions,
-        cache_dir: Option<Option<PathBuf>>,
-        fuel: Option<u64>,
-    ) -> Result<Plugin, Error> {
-        // Setup wasmtime types
-        let mut config = Config::new();
-        config
-            .epoch_interruption(true)
-            .debug_info(debug_options.debug_info)
-            .coredump_on_trap(debug_options.coredump.is_some())
-            .profiler(debug_options.profiling_strategy)
-            .wasm_tail_call(true)
-            .wasm_function_references(true)
-            .wasm_gc(true);
-
-        if fuel.is_some() {
-            config.consume_fuel(true);
-        }
-
-        match cache_dir {
-            Some(None) => (),
-            Some(Some(path)) => {
-                config.cache_config_load(path)?;
-            }
-            None => {
-                if let Ok(env) = std::env::var("EXTISM_CACHE_CONFIG") {
-                    if !env.is_empty() {
-                        config.cache_config_load(&env)?;
-                    }
-                } else {
-                    config.cache_config_load_default()?;
-                }
-            }
-        }
-
-        let engine = Engine::new(&config)?;
-        let (manifest, modules) = manifest::load(&engine, wasm)?;
-        if modules.len() <= 1 {
-            anyhow::bail!("No wasm modules provided");
-        } else if !modules.contains_key(MAIN_KEY) {
-            anyhow::bail!("No main module provided");
-        }
-
-        let available_pages = manifest.memory.max_pages;
+    /// Create a new plugin from a pre-compiled plugin
+    pub fn new_from_compiled(compiled: &CompiledPlugin) -> Result<Plugin, Error> {
+        let available_pages = compiled.manifest.memory.max_pages;
        debug!("Available pages: {available_pages:?}");

        let id = uuid::Uuid::new_v4();
        let mut store = Store::new(
-            &engine,
-            CurrentPlugin::new(manifest, with_wasi, available_pages, id)?,
+            &compiled.engine,
+            CurrentPlugin::new(
+                compiled.manifest.clone(),
+                compiled.options.wasi,
+                available_pages,
+                compiled.options.http_response_headers,
+                id,
+            )?,
        );
        store.set_epoch_deadline(1);
-        if let Some(fuel) = fuel {
+        if let Some(fuel) = compiled.options.fuel {
            store.set_fuel(fuel)?;
        }

-        let imports: Vec<Function> = imports.into_iter().collect();
-        let (instance_pre, linker, host_context) =
-            relink(&engine, &mut store, &imports, &modules, with_wasi)?;
+        let imports: Vec<Function> = compiled.options.functions.to_vec();
+        let (instance_pre, linker, host_context) = relink(
+            &compiled.engine,
+            &mut store,
+            &imports,
+            &compiled.modules,
+            compiled.options.wasi,
+        )?;
        let timer_tx = Timer::tx();
        let mut plugin = Plugin {
-            modules,
+            modules: compiled.modules.clone(),
            linker,
            instance: std::sync::Arc::new(std::sync::Mutex::new(None)),
            instance_pre,
@@ -397,10 +482,10 @@ impl Plugin {
            instantiations: 0,
            output: Output::default(),
            store_needs_reset: false,
-            debug_options,
+            debug_options: compiled.options.debug_options.clone(),
            _functions: imports,
            error_msg: None,
-            fuel,
+            fuel: compiled.options.fuel,
            host_context,
        };

@@ -430,6 +515,7 @@ impl Plugin {
                    internal.manifest.clone(),
                    internal.wasi.is_some(),
                    internal.available_pages,
+                    internal.http_headers.is_some(),
                    self.id,
                )?,
            );
@@ -505,7 +591,7 @@ impl Plugin {
    }

    /// Returns `true` if the given function exists, otherwise `false`
-    pub fn function_exists(&mut self, function: impl AsRef<str>) -> bool {
+    pub fn function_exists(&self, function: impl AsRef<str>) -> bool {
        self.modules[MAIN_KEY]
            .get_export(function.as_ref())
            .map(|x| {
@@ -800,15 +886,20 @@ impl Plugin {

        // Set host context
        let r = if let Some(host_context) = host_context {
-            let inner = self
+            if let Some(inner) = self
                .host_context
                .data_mut(&mut self.store)
-                .map_err(|x| (x, -1))?;
-            if let Some(inner) = inner.downcast_mut::<Box<dyn std::any::Any + Send + Sync>>() {
-                let x: Box<T> = Box::new(host_context);
-                *inner = x;
+                .map_err(|x| (x, -1))?
+            {
+                if let Some(inner) = inner.downcast_mut::<Box<dyn std::any::Any + Send + Sync>>() {
+                    let x: Box<T> = Box::new(host_context);
+                    *inner = x;
+                }
+
+                Some(self.host_context)
+            } else {
+                None
            }
-            Some(self.host_context)
        } else {
            None
        };
@@ -851,7 +942,7 @@ impl Plugin {
        let mut res = func.call(self.store_mut(), &[], results.as_mut_slice());

        // Reset host context
-        if let Ok(inner) = self.host_context.data_mut(&mut self.store) {
+        if let Ok(Some(inner)) = self.host_context.data_mut(&mut self.store) {
            if let Some(inner) = inner.downcast_mut::<Box<dyn std::any::Any + Send + Sync>>() {
                let x: Box<dyn Any + Send + Sync> = Box::new(());
                *inner = x;
@@ -864,19 +955,24 @@ impl Plugin {
        let _ = self.timer_tx.send(TimerAction::Stop { id: self.id });
        self.store_needs_reset = name == "_start";

-        let mut rc = 0;
+        let mut rc = -1;
        if self.store.get_fuel().is_ok_and(|x| x == 0) {
            res = Err(Error::msg("plugin ran out of fuel"));
-            rc = -1;
        } else {
            // Get extism error
-            self.get_output_after_call().map_err(|x| (x, -1))?;
-            if !results.is_empty() {
-                rc = results[0].i32().unwrap_or(-1);
-                debug!(plugin = self.id.to_string(), "got return code: {}", rc);
+            let output_res = self.get_output_after_call().map_err(|x| (x, -1));
+
+            // Get the return code
+            if output_res.is_ok() && res.is_ok() {
+                rc = 0;
+                if !results.is_empty() {
+                    rc = results[0].i32().unwrap_or(-1);
+                    debug!(plugin = self.id.to_string(), "got return code: {}", rc);
+                }
            }

-            if self.output.error_offset != 0 && self.output.error_length != 0 {
+            // on extism error
+            if output_res.is_ok() && self.extism_error_is_set() {
                let handle = MemoryHandle {
                    offset: self.output.error_offset,
                    length: self.output.error_length,
@@ -896,11 +992,18 @@ impl Plugin {
                    }
                    Err(msg) => {
                        res = Err(Error::msg(format!(
-                            "Call to Extism plugin function {name} encountered an error: {}",
-                            msg,
+                            "unable to load error message from memory: {msg}",
                        )));
                    }
                }
+            // on wasmtime error
+            } else if let Err(e) = &res {
+                if e.is::<wasmtime::Trap>() {
+                    rc = 134; // EXIT_SIGNALED_SIGABRT
+                }
+            // if there was an error retrieving the output
+            } else {
+                output_res?;
            }
        }

@@ -955,11 +1058,12 @@ impl Plugin {
                        plugin = self.id.to_string(),
                        "WASI exit code: {}", exit_code
                    );
-                    if exit_code == 0 {
+
+                    if exit_code == 0 && !self.extism_error_is_set() {
                        return Ok(0);
                    }

-                    return Err((e.context("WASI exit code"), exit_code));
+                    return Err((e, exit_code));
                }

                // Handle timeout interrupts
@@ -987,6 +1091,10 @@ impl Plugin {
        }
    }

+    fn extism_error_is_set(&self) -> bool {
+        self.output.error_offset != 0 && self.output.error_length != 0
+    }
+
    /// Call a function by name with the given input, the return value is
    /// the output data returned by the plugin. The return type can be anything that implements
    /// [FromBytes]. This data will be invalidated next time the plugin is called.
@@ -1010,7 +1118,12 @@ impl Plugin {
        input: T,
    ) -> Result<U, Error> {
        let lock = self.instance.clone();
-        let mut lock = lock.lock().unwrap();
+        let mut lock = lock.try_lock().map_err(|e| match e {
+            TryLockError::Poisoned(_) => anyhow::anyhow!(
+                "instance lock was poisoned; previous thread panicked while calling into wasm"
+            ),
+            TryLockError::WouldBlock => anyhow::anyhow!("cannot make reentrant calls into plugin"),
+        })?;
        let data = input.to_bytes()?;
        self.raw_call(&mut lock, name, data, None::<()>)
            .map_err(|e| e.0)
@@ -1035,7 +1148,12 @@ impl Plugin {
        C: Any + Send + Sync + 'static,
    {
        let lock = self.instance.clone();
-        let mut lock = lock.lock().unwrap();
+        let mut lock = lock.try_lock().map_err(|e| match e {
+            TryLockError::Poisoned(_) => anyhow::anyhow!(
+                "instance lock was poisoned; previous thread panicked while calling into wasm"
+            ),
+            TryLockError::WouldBlock => anyhow::anyhow!("cannot make reentrant calls into plugin"),
+        })?;
        let data = input.to_bytes()?;
        self.raw_call(&mut lock, name, data, Some(host_context))
            .map_err(|e| e.0)
@@ -1054,7 +1172,18 @@ impl Plugin {
        input: T,
    ) -> Result<U, (Error, i32)> {
        let lock = self.instance.clone();
-        let mut lock = lock.lock().unwrap();
+        let mut lock = lock.try_lock().map_err(|e| match e {
+            TryLockError::Poisoned(_) => (
+                anyhow::anyhow!(
+                    "instance lock was poisoned; previous thread panicked while calling into wasm"
+                ),
+                -1,
+            ),
+            TryLockError::WouldBlock => (
+                anyhow::anyhow!("cannot make reentrant calls into plugin"),
+                -1,
+            ),
+        })?;
        let data = input.to_bytes().map_err(|e| (e, -1))?;
        self.raw_call(&mut lock, name, data, None::<()>)
            .and_then(move |_| self.output().map_err(|e| (e, -1)))
@@ -1082,6 +1211,25 @@ impl Plugin {
            anyhow::bail!("Plugin::clear_error failed, extism:host/env::error_set not found")
        }
    }
+
+    /// Returns the amount of fuel consumed by the plugin.
+    ///
+    /// This function calculates the difference between the initial fuel and the remaining fuel.
+    /// If either the initial fuel or the remaining fuel is not set, it returns `None`.
+    ///
+    /// # Returns
+    ///
+    /// * `Some(u64)` - The amount of fuel consumed.
+    /// * `None` - If the initial fuel or remaining fuel is not set.
+    pub fn fuel_consumed(&self) -> Option<u64> {
+        self.fuel.map(|x| {
+            x.saturating_sub(
+                self.store
+                    .get_fuel()
+                    .expect("fuel support should be enabled to use fuel"),
+            )
+        })
+    }
 }

 // Enumerates the PDK languages that need some additional initialization
@@ -1125,7 +1273,7 @@ macro_rules! typed_plugin {

        impl TryFrom<$crate::Plugin> for $name {
            type Error = $crate::Error;
-            fn try_from(mut x: $crate::Plugin) -> Result<Self, Self::Error> {
+            fn try_from(x: $crate::Plugin) -> Result<Self, Self::Error> {
                $(
                    if !x.function_exists(stringify!($f)) {
                        return Err($crate::Error::msg(format!("Invalid function: {}", stringify!($f))));
--- a/runtime/src/plugin_builder.rs
+++ b/runtime/src/plugin_builder.rs
@@ -33,13 +33,21 @@ impl Default for DebugOptions {
 }

 /// PluginBuilder is used to configure and create `Plugin` instances
+#[derive(Clone)]
 pub struct PluginBuilder<'a> {
-    source: WasmInput<'a>,
-    wasi: bool,
-    functions: Vec<Function>,
-    debug_options: DebugOptions,
-    cache_config: Option<Option<PathBuf>>,
-    fuel: Option<u64>,
+    pub(crate) source: WasmInput<'a>,
+    pub(crate) config: Option<wasmtime::Config>,
+    pub(crate) options: PluginBuilderOptions,
+}
+
+#[derive(Clone)]
+pub(crate) struct PluginBuilderOptions {
+    pub(crate) wasi: bool,
+    pub(crate) functions: Vec<Function>,
+    pub(crate) debug_options: DebugOptions,
+    pub(crate) cache_config: Option<Option<PathBuf>>,
+    pub(crate) fuel: Option<u64>,
+    pub(crate) http_response_headers: bool,
 }

 impl<'a> PluginBuilder<'a> {
@@ -47,17 +55,21 @@ impl<'a> PluginBuilder<'a> {
    pub fn new(plugin: impl Into<WasmInput<'a>>) -> Self {
        PluginBuilder {
            source: plugin.into(),
-            wasi: false,
-            functions: vec![],
-            debug_options: DebugOptions::default(),
-            cache_config: None,
-            fuel: None,
+            config: None,
+            options: PluginBuilderOptions {
+                wasi: false,
+                functions: vec![],
+                debug_options: DebugOptions::default(),
+                cache_config: None,
+                fuel: None,
+                http_response_headers: false,
+            },
        }
    }

    /// Enables WASI if the argument is set to `true`
    pub fn with_wasi(mut self, wasi: bool) -> Self {
-        self.wasi = wasi;
+        self.options.wasi = wasi;
        self
    }

@@ -76,7 +88,8 @@ impl<'a> PluginBuilder<'a> {
            + Sync
            + Send,
    {
-        self.functions
+        self.options
+            .functions
            .push(Function::new(name, args, returns, user_data, f));
        self
    }
@@ -97,74 +110,97 @@ impl<'a> PluginBuilder<'a> {
            + Sync
            + Send,
    {
-        self.functions
+        self.options
+            .functions
            .push(Function::new(name, args, returns, user_data, f).with_namespace(namespace));
        self
    }

    /// Add multiple host functions
    pub fn with_functions(mut self, f: impl IntoIterator<Item = Function>) -> Self {
-        self.functions.extend(f);
+        self.options.functions.extend(f);
        self
    }

    /// Set profiling strategy
    pub fn with_profiling_strategy(mut self, p: wasmtime::ProfilingStrategy) -> Self {
-        self.debug_options.profiling_strategy = p;
+        self.options.debug_options.profiling_strategy = p;
        self
    }

    /// Enable Wasmtime coredump on trap
    pub fn with_coredump(mut self, path: impl Into<std::path::PathBuf>) -> Self {
-        self.debug_options.coredump = Some(path.into());
+        self.options.debug_options.coredump = Some(path.into());
        self
    }

    /// Enable Extism memory dump when plugin calls return an error
    pub fn with_memdump(mut self, path: impl Into<std::path::PathBuf>) -> Self {
-        self.debug_options.memdump = Some(path.into());
+        self.options.debug_options.memdump = Some(path.into());
        self
    }

    /// Compile with debug info
    pub fn with_debug_info(mut self) -> Self {
-        self.debug_options.debug_info = true;
+        self.options.debug_options.debug_info = true;
        self
    }

    /// Configure debug options
    pub fn with_debug_options(mut self, options: DebugOptions) -> Self {
-        self.debug_options = options;
+        self.options.debug_options = options;
        self
    }

    /// Set wasmtime compilation cache config path
    pub fn with_cache_config(mut self, dir: impl Into<PathBuf>) -> Self {
-        self.cache_config = Some(Some(dir.into()));
+        self.options.cache_config = Some(Some(dir.into()));
        self
    }

    /// Turn wasmtime compilation caching off
    pub fn with_cache_disabled(mut self) -> Self {
-        self.cache_config = Some(None);
+        self.options.cache_config = Some(None);
        self
    }

-    // Limit the number of instructions that can be executed
+    /// Limit the number of instructions that can be executed
    pub fn with_fuel_limit(mut self, fuel: u64) -> Self {
-        self.fuel = Some(fuel);
+        self.options.fuel = Some(fuel);
+        self
+    }
+
+    /// Configure an initial wasmtime config to be passed to the plugin
+    ///
+    /// **Warning**: some values might be overwritten by the Extism runtime. In particular:
+    /// - async_support
+    /// - epoch_interruption
+    /// - debug_info
+    /// - coredump_on_trap
+    /// - profiler
+    /// - wasm_tail_call
+    /// - wasm_function_references
+    /// - wasm_gc
+    ///
+    /// See the implementation details of [PluginBuilder::build] and [Plugin::build_new] to verify which values are overwritten.
+    pub fn with_wasmtime_config(mut self, config: wasmtime::Config) -> Self {
+        self.config = Some(config);
+        self
+    }
+
+    /// Enables `http_response_headers`, which allows for plugins to access response headers when using `extism:host/env::http_request`
+    pub fn with_http_response_headers(mut self, allow: bool) -> Self {
+        self.options.http_response_headers = allow;
        self
    }

    /// Generate a new plugin with the configured settings
    pub fn build(self) -> Result<Plugin, Error> {
-        Plugin::build_new(
-            self.source,
-            self.functions,
-            self.wasi,
-            self.debug_options,
-            self.cache_config,
-            self.fuel,
-        )
+        Plugin::new_from_compiled(&CompiledPlugin::new(self)?)
+    }
+
+    /// Build new `CompiledPlugin`
+    pub fn compile(self) -> Result<CompiledPlugin, Error> {
+        CompiledPlugin::new(self)
    }
 }
--- a/runtime/src/pool.rs
+++ b/runtime/src/pool.rs
@@ -0,0 +1,195 @@
+use crate::{Error, FromBytesOwned, Plugin, ToBytes};
+use std::collections::HashMap;
+use std::sync::Arc;
+use std::sync::RwLock;
+
+// `PoolBuilder` is used to configure and create `Pool`s
+#[derive(Debug, Clone)]
+pub struct PoolBuilder {
+    /// Max number of concurrent instances for a plugin - by default this is set to
+    /// the output of `std::thread::available_parallelism`
+    pub max_instances: usize,
+}
+
+impl PoolBuilder {
+    /// Create a `PoolBuilder` with default values
+    pub fn new() -> Self {
+        Self::default()
+    }
+
+    /// Set the max number of parallel instances
+    pub fn with_max_instances(mut self, n: usize) -> Self {
+        self.max_instances = n;
+        self
+    }
+
+    /// Create a new `Pool` with the given configuration
+    pub fn build<F: 'static + Fn() -> Result<Plugin, Error>>(self, source: F) -> Pool {
+        Pool::new_from_builder(source, self)
+    }
+}
+
+impl Default for PoolBuilder {
+    fn default() -> Self {
+        PoolBuilder {
+            max_instances: std::thread::available_parallelism()
+                .expect("available parallelism")
+                .into(),
+        }
+    }
+}
+
+/// `PoolPlugin` is used by the pool to track the number of live instances of a particular plugin
+#[derive(Clone, Debug)]
+pub struct PoolPlugin(std::rc::Rc<std::cell::RefCell<Plugin>>);
+
+impl PoolPlugin {
+    fn new(plugin: Plugin) -> Self {
+        Self(std::rc::Rc::new(std::cell::RefCell::new(plugin)))
+    }
+
+    /// Access the underlying plugin
+    pub fn plugin(&self) -> std::cell::RefMut<'_, Plugin> {
+        self.0.borrow_mut()
+    }
+
+    /// Helper to call a plugin function on the underlying plugin
+    pub fn call<'a, Input: ToBytes<'a>, Output: FromBytesOwned>(
+        &self,
+        name: impl AsRef<str>,
+        input: Input,
+    ) -> Result<Output, Error> {
+        self.plugin().call(name.as_ref(), input)
+    }
+
+    /// Helper to get the underlying plugin's ID
+    pub fn id(&self) -> uuid::Uuid {
+        self.plugin().id
+    }
+}
+
+type PluginSource = dyn Fn() -> Result<Plugin, Error>;
+
+struct PoolInner {
+    plugin_source: Box<PluginSource>,
+    instances: Vec<PoolPlugin>,
+}
+
+unsafe impl Send for PoolInner {}
+unsafe impl Sync for PoolInner {}
+
+/// `Pool` manages threadsafe access to a limited number of instances of multiple plugins
+#[derive(Clone)]
+pub struct Pool {
+    config: PoolBuilder,
+    inner: Arc<std::sync::Mutex<PoolInner>>,
+    existing_functions: Arc<RwLock<HashMap<String, bool>>>,
+}
+
+unsafe impl Send for Pool {}
+unsafe impl Sync for Pool {}
+
+impl Pool {
+    /// Create a new pool with the default configuration
+    pub fn new<F: 'static + Fn() -> Result<Plugin, Error>>(source: F) -> Self {
+        Self::new_from_builder(Box::new(source), PoolBuilder::default())
+    }
+
+    /// Create a new pool configured using a `PoolBuilder`
+    pub fn new_from_builder<F: 'static + Fn() -> Result<Plugin, Error>>(
+        source: F,
+        builder: PoolBuilder,
+    ) -> Self {
+        Pool {
+            config: builder,
+            inner: Arc::new(std::sync::Mutex::new(PoolInner {
+                plugin_source: Box::new(source),
+                instances: Default::default(),
+            })),
+            existing_functions: RwLock::new(HashMap::default()).into(),
+        }
+    }
+
+    fn find_available(&self) -> Result<Option<PoolPlugin>, Error> {
+        let pool = self.inner.lock().unwrap();
+        for instance in pool.instances.iter() {
+            if std::rc::Rc::strong_count(&instance.0) == 1 {
+                return Ok(Some(instance.clone()));
+            }
+        }
+        Ok(None)
+    }
+
+    /// Get the number of live instances for a plugin
+    pub fn count(&self) -> usize {
+        self.inner.lock().unwrap().instances.len()
+    }
+
+    /// Get access to a plugin, this will create a new instance if needed (and allowed by the specified
+    /// max_instances). `Ok(None)` is returned if the timeout is reached before an available plugin could be
+    /// acquired
+    pub fn get(&self, timeout: std::time::Duration) -> Result<Option<PoolPlugin>, Error> {
+        let start = std::time::Instant::now();
+        let max = self.config.max_instances;
+        if let Some(avail) = self.find_available()? {
+            return Ok(Some(avail));
+        }
+
+        {
+            let mut pool = self.inner.lock().unwrap();
+            if pool.instances.len() < max {
+                let plugin = (*pool.plugin_source)()?;
+                let instance = PoolPlugin::new(plugin);
+                pool.instances.push(instance);
+                return Ok(Some(pool.instances.last().unwrap().clone()));
+            }
+        }
+
+        loop {
+            if let Ok(Some(x)) = self.find_available() {
+                return Ok(Some(x));
+            }
+            if std::time::Instant::now() - start > timeout {
+                return Ok(None);
+            }
+
+            std::thread::sleep(std::time::Duration::from_millis(100));
+        }
+    }
+
+    /// Access a plugin in a callback function. This calls `Pool::get` then the provided
+    /// callback. `Ok(None)` is returned if the timeout is reached before an available
+    /// plugin could be acquired
+    pub fn with_plugin<T>(
+        &self,
+        timeout: std::time::Duration,
+        f: impl FnOnce(&mut Plugin) -> Result<T, Error>,
+    ) -> Result<Option<T>, Error> {
+        if let Some(plugin) = self.get(timeout)? {
+            return f(&mut plugin.plugin()).map(Some);
+        }
+        Ok(None)
+    }
+
+    /// Returns `true` if the given function exists, otherwise `false`. Results are cached
+    /// after the first call.
+    pub fn function_exists(&self, name: &str, timeout: std::time::Duration) -> Result<bool, Error> {
+        // read current value if any
+        let read = self.existing_functions.read().unwrap();
+        let exists_opt = read.get(name).cloned();
+        drop(read);
+        if let Some(exists) = exists_opt {
+            Ok(exists)
+        } else {
+            // load plugin and call function_exists
+            let plugin = self.get(timeout)?;
+            let exists = plugin.unwrap().0.borrow().function_exists(name);
+
+            // write result to hashmap
+            let mut write = self.existing_functions.write().unwrap();
+            write.insert(name.to_string(), exists);
+
+            Ok(exists)
+        }
+    }
+}
--- a/runtime/src/sdk.rs
+++ b/runtime/src/sdk.rs
@@ -48,32 +48,32 @@ pub type ExtismFunctionType = extern "C" fn(
 pub type ExtismLogDrainFunctionType = extern "C" fn(data: *const std::ffi::c_char, size: Size);

 impl ExtismVal {
-    fn from_val(value: &wasmtime::Val, ctx: impl AsContext) -> Self {
-        match value.ty(ctx) {
-            wasmtime::ValType::I32 => ExtismVal {
+    fn from_val(value: &wasmtime::Val, ctx: impl AsContext) -> Result<Self, Error> {
+        match value.ty(ctx)? {
+            wasmtime::ValType::I32 => Ok(ExtismVal {
                t: ValType::I32,
                v: ValUnion {
                    i32: value.unwrap_i32(),
                },
-            },
-            wasmtime::ValType::I64 => ExtismVal {
+            }),
+            wasmtime::ValType::I64 => Ok(ExtismVal {
                t: ValType::I64,
                v: ValUnion {
                    i64: value.unwrap_i64(),
                },
-            },
-            wasmtime::ValType::F32 => ExtismVal {
+            }),
+            wasmtime::ValType::F32 => Ok(ExtismVal {
                t: ValType::F32,
                v: ValUnion {
                    f32: value.unwrap_f32(),
                },
-            },
-            wasmtime::ValType::F64 => ExtismVal {
+            }),
+            wasmtime::ValType::F64 => Ok(ExtismVal {
                t: ValType::F64,
                v: ValUnion {
                    f64: value.unwrap_f64(),
                },
-            },
+            }),
            t => todo!("{}", t),
        }
    }
@@ -180,7 +180,7 @@ pub unsafe extern "C" fn extism_current_plugin_memory_free(
 /// - `n_outputs`: number of return types
 /// - `func`: the function to call
 /// - `user_data`: a pointer that will be passed to the function when it's called
-///    this value should live as long as the function exists
+///   this value should live as long as the function exists
 /// - `free_user_data`: a callback to release the `user_data` value when the resulting
 ///   `ExtismFunction` is freed.
 ///
@@ -227,7 +227,7 @@ pub unsafe extern "C" fn extism_function_new(
            let store = &*plugin.store;
            let inputs: Vec<_> = inputs
                .iter()
-                .map(|x| ExtismVal::from_val(x, store))
+                .map(|x| ExtismVal::from_val(x, store).unwrap())
                .collect();
            let mut output_tmp: Vec<_> = output_types
                .iter()
@@ -266,8 +266,8 @@ pub unsafe extern "C" fn extism_function_new(
                match tmp.t {
                    ValType::I32 => *out = Val::I32(tmp.v.i32),
                    ValType::I64 => *out = Val::I64(tmp.v.i64),
-                    ValType::F32 => *out = Val::F32(tmp.v.f32 as u32),
-                    ValType::F64 => *out = Val::F64(tmp.v.f64 as u64),
+                    ValType::F32 => *out = Val::F32(tmp.v.f32.to_bits()),
+                    ValType::F64 => *out = Val::F64(tmp.v.f64.to_bits()),
                    _ => todo!(),
                }
            }
@@ -302,6 +302,143 @@ pub unsafe extern "C" fn extism_function_set_namespace(
    }
 }

+/// Pre-compile an Extism plugin
+#[no_mangle]
+pub unsafe extern "C" fn extism_compiled_plugin_new(
+    wasm: *const u8,
+    wasm_size: Size,
+    functions: *mut *const ExtismFunction,
+    n_functions: Size,
+    with_wasi: bool,
+    errmsg: *mut *mut std::ffi::c_char,
+) -> *mut CompiledPlugin {
+    trace!("Call to extism_plugin_new with wasm pointer {:?}", wasm);
+    let data = std::slice::from_raw_parts(wasm, wasm_size as usize);
+
+    let mut builder = PluginBuilder::new(data).with_wasi(with_wasi);
+
+    if !functions.is_null() {
+        let funcs = (0..n_functions)
+            .map(|i| unsafe { *functions.add(i as usize) })
+            .map(|ptr| {
+                if ptr.is_null() {
+                    return Err("Cannot pass null pointer");
+                }
+
+                let ExtismFunction(func) = &*ptr;
+                let Some(func) = func.take() else {
+                    return Err("Function cannot be registered with multiple different Plugins");
+                };
+
+                Ok(func)
+            })
+            .collect::<Result<Vec<_>, _>>()
+            .unwrap_or_else(|e| {
+                if !errmsg.is_null() {
+                    let e = std::ffi::CString::new(e.to_string()).unwrap();
+                    *errmsg = e.into_raw();
+                }
+                Vec::new()
+            });
+
+        if funcs.len() != n_functions as usize {
+            return std::ptr::null_mut();
+        }
+
+        builder = builder.with_functions(funcs);
+    }
+
+    CompiledPlugin::new(builder)
+        .map(|v| Box::into_raw(Box::new(v)))
+        .unwrap_or_else(|e| {
+            if !errmsg.is_null() {
+                let e = std::ffi::CString::new(format!(
+                    "Unable to compile Extism plugin: {}",
+                    e.root_cause(),
+                ))
+                .unwrap();
+                *errmsg = e.into_raw();
+            }
+            std::ptr::null_mut()
+        })
+}
+
+/// Pre-compile an Extism plugin and set the number of instructions a plugin is allowed to execute
+#[no_mangle]
+pub unsafe extern "C" fn extism_compiled_plugin_new_with_fuel_limit(
+    wasm: *const u8,
+    wasm_size: Size,
+    functions: *mut *const ExtismFunction,
+    n_functions: Size,
+    with_wasi: bool,
+    fuel_limit: u64,
+    errmsg: *mut *mut std::ffi::c_char,
+) -> *mut CompiledPlugin {
+    trace!("Call to extism_plugin_new with wasm pointer {:?}", wasm);
+    let data = std::slice::from_raw_parts(wasm, wasm_size as usize);
+
+    let mut builder = PluginBuilder::new(data)
+        .with_wasi(with_wasi)
+        .with_fuel_limit(fuel_limit);
+
+    if !functions.is_null() {
+        let funcs = (0..n_functions)
+            .map(|i| unsafe { *functions.add(i as usize) })
+            .map(|ptr| {
+                if ptr.is_null() {
+                    return Err("Cannot pass null pointer");
+                }
+
+                let ExtismFunction(func) = &*ptr;
+                let Some(func) = func.take() else {
+                    return Err("Function cannot be registered with multiple different Plugins");
+                };
+
+                Ok(func)
+            })
+            .collect::<Result<Vec<_>, _>>()
+            .unwrap_or_else(|e| {
+                if !errmsg.is_null() {
+                    let e = std::ffi::CString::new(e.to_string()).unwrap();
+                    *errmsg = e.into_raw();
+                }
+                Vec::new()
+            });
+
+        if funcs.len() != n_functions as usize {
+            return std::ptr::null_mut();
+        }
+
+        builder = builder.with_functions(funcs);
+    }
+
+    CompiledPlugin::new(builder)
+        .map(|v| Box::into_raw(Box::new(v)))
+        .unwrap_or_else(|e| {
+            if !errmsg.is_null() {
+                let e = std::ffi::CString::new(format!(
+                    "Unable to compile Extism plugin: {}",
+                    e.root_cause(),
+                ))
+                .unwrap();
+                *errmsg = e.into_raw();
+            }
+            std::ptr::null_mut()
+        })
+}
+
+/// Free `ExtismCompiledPlugin`
+#[no_mangle]
+pub unsafe extern "C" fn extism_compiled_plugin_free(plugin: *mut CompiledPlugin) {
+    if plugin.is_null() {
+        return;
+    }
+
+    let plugin = Box::from_raw(plugin);
+    trace!("called extism_compiled_plugin_free");
+    drop(plugin)
+}
+
 /// Create a new plugin with host functions, the functions passed to this function no longer need to be manually freed using
 ///
 /// `wasm`: is a WASM module (wat or wasm) or a JSON encoded manifest
@@ -318,36 +455,70 @@ pub unsafe extern "C" fn extism_plugin_new(
    with_wasi: bool,
    errmsg: *mut *mut std::ffi::c_char,
 ) -> *mut Plugin {
-    trace!("Call to extism_plugin_new with wasm pointer {:?}", wasm);
    let data = std::slice::from_raw_parts(wasm, wasm_size as usize);
-    let mut funcs = vec![];
-
-    if !functions.is_null() {
-        for i in 0..n_functions {
-            unsafe {
-                let f = *functions.add(i as usize);
-                if f.is_null() {
-                    continue;
+    let funcs = if functions.is_null() {
+        vec![]
+    } else {
+        let funcs = (0..n_functions)
+            .map(|i| unsafe { *functions.add(i as usize) })
+            .map(|ptr| {
+                if ptr.is_null() {
+                    return Err("Cannot pass null pointer");
                }
-                if let Some(f) = (*f).0.take() {
-                    funcs.push(f);
-                } else {
-                    let e = std::ffi::CString::new(
-                        "Function cannot be registered with multiple different Plugins",
-                    )
-                    .unwrap();
+
+                let ExtismFunction(func) = &*ptr;
+                let Some(func) = func.take() else {
+                    return Err("Function cannot be registered with multiple different Plugins");
+                };
+
+                Ok(func)
+            })
+            .collect::<Result<Vec<_>, _>>()
+            .unwrap_or_else(|e| {
+                if !errmsg.is_null() {
+                    let e = std::ffi::CString::new(e.to_string()).unwrap();
                    *errmsg = e.into_raw();
                }
-            }
-        }
-    }
+                Vec::new()
+            });

-    let plugin = Plugin::new(data, funcs, with_wasi);
+        if funcs.len() != n_functions as usize {
+            return std::ptr::null_mut();
+        }
+
+        funcs
+    };
+
+    Plugin::new(data, funcs, with_wasi)
+        .map(|v| Box::into_raw(Box::new(v)))
+        .unwrap_or_else(|e| {
+            if !errmsg.is_null() {
+                let e = std::ffi::CString::new(format!(
+                    "Unable to compile Extism plugin: {}",
+                    e.root_cause(),
+                ))
+                .unwrap();
+                *errmsg = e.into_raw();
+            }
+            std::ptr::null_mut()
+        })
+}
+
+/// Create a new plugin from an `ExtismCompiledPlugin`
+#[no_mangle]
+pub unsafe extern "C" fn extism_plugin_new_from_compiled(
+    compiled: *const CompiledPlugin,
+    errmsg: *mut *mut std::ffi::c_char,
+) -> *mut Plugin {
+    let plugin = Plugin::new_from_compiled(&*compiled);
    match plugin {
        Err(e) => {
            if !errmsg.is_null() {
-                let e = std::ffi::CString::new(format!("Unable to create Extism plugin: {}", e))
-                    .unwrap();
+                let e = std::ffi::CString::new(format!(
+                    "Unable to create Extism plugin: {}",
+                    e.root_cause(),
+                ))
+                .unwrap();
                *errmsg = e.into_raw();
            }
            std::ptr::null_mut()
@@ -372,42 +543,69 @@ pub unsafe extern "C" fn extism_plugin_new_with_fuel_limit(
        wasm
    );
    let data = std::slice::from_raw_parts(wasm, wasm_size as usize);
-    let mut funcs = vec![];
-
-    if !functions.is_null() {
-        for i in 0..n_functions {
-            unsafe {
-                let f = *functions.add(i as usize);
-                if f.is_null() {
-                    continue;
+    let funcs = if functions.is_null() {
+        vec![]
+    } else {
+        let funcs = (0..n_functions)
+            .map(|i| unsafe { *functions.add(i as usize) })
+            .map(|ptr| {
+                if ptr.is_null() {
+                    return Err("Cannot pass null pointer");
                }
-                if let Some(f) = (*f).0.take() {
-                    funcs.push(f);
-                } else {
-                    let e = std::ffi::CString::new(
-                        "Function cannot be registered with multiple different Plugins",
-                    )
-                    .unwrap();
+
+                let ExtismFunction(func) = &*ptr;
+                let Some(func) = func.take() else {
+                    return Err("Function cannot be registered with multiple different Plugins");
+                };
+
+                Ok(func)
+            })
+            .collect::<Result<Vec<_>, _>>()
+            .unwrap_or_else(|e| {
+                if !errmsg.is_null() {
+                    let e = std::ffi::CString::new(e.to_string()).unwrap();
                    *errmsg = e.into_raw();
                }
-            }
-        }
-    }
+                Vec::new()
+            });

-    let plugin = Plugin::build_new(
-        data.into(),
-        funcs,
-        with_wasi,
-        Default::default(),
-        None,
-        Some(fuel_limit),
-    );
+        if funcs.len() != n_functions as usize {
+            return std::ptr::null_mut();
+        }
+
+        funcs
+    };
+
+    let compiled = match CompiledPlugin::new(
+        PluginBuilder::new(data)
+            .with_functions(funcs)
+            .with_wasi(with_wasi)
+            .with_fuel_limit(fuel_limit),
+    ) {
+        Ok(x) => x,
+        Err(e) => {
+            if !errmsg.is_null() {
+                let e = std::ffi::CString::new(format!(
+                    "Unable to compile Extism plugin: {}",
+                    e.root_cause(),
+                ))
+                .unwrap();
+                *errmsg = e.into_raw();
+            }
+            return std::ptr::null_mut();
+        }
+    };
+
+    let plugin = Plugin::new_from_compiled(&compiled);

    match plugin {
        Err(e) => {
            if !errmsg.is_null() {
-                let e = std::ffi::CString::new(format!("Unable to create Extism plugin: {}", e))
-                    .unwrap();
+                let e = std::ffi::CString::new(format!(
+                    "Unable to create Extism plugin: {}",
+                    e.root_cause(),
+                ))
+                .unwrap();
                *errmsg = e.into_raw();
            }
            std::ptr::null_mut()
@@ -416,6 +614,13 @@ pub unsafe extern "C" fn extism_plugin_new_with_fuel_limit(
    }
 }

+/// Enable HTTP response headers in plugins using `extism:host/env::http_request`
+#[no_mangle]
+pub unsafe extern "C" fn extism_plugin_allow_http_response_headers(plugin: *mut Plugin) {
+    let plugin = &mut *plugin;
+    plugin.store.data_mut().http_headers = Some(BTreeMap::new());
+}
+
 /// Free the error returned by `extism_plugin_new`, errors returned from `extism_plugin_error` don't need to be freed
 #[no_mangle]
 pub unsafe extern "C" fn extism_plugin_new_error_free(err: *mut std::ffi::c_char) {
@@ -425,7 +630,7 @@ pub unsafe extern "C" fn extism_plugin_new_error_free(err: *mut std::ffi::c_char
    drop(std::ffi::CString::from_raw(err))
 }

-/// Remove a plugin from the registry and free associated memory
+/// Free `ExtismPlugin`
 #[no_mangle]
 pub unsafe extern "C" fn extism_plugin_free(plugin: *mut Plugin) {
    if plugin.is_null() {
@@ -730,7 +935,7 @@ fn set_log_file(log_file: impl Into<std::path::PathBuf>, filter: &str) -> Result
        let x = tracing_subscriber::EnvFilter::builder()
            .with_default_directive(tracing::Level::ERROR.into());
        if is_level {
-            x.parse_lossy(format!("extism={}", filter))
+            x.parse_lossy(format!("extism={filter}"))
        } else {
            x.parse_lossy(filter)
        }
@@ -758,7 +963,7 @@ fn set_log_file(log_file: impl Into<std::path::PathBuf>, filter: &str) -> Result
    Ok(())
 }

-static mut LOG_BUFFER: Option<LogBuffer> = None;
+static LOG_BUFFER: std::sync::Mutex<Option<LogBuffer>> = std::sync::Mutex::new(None);

 /// Enable a custom log handler, this will buffer logs until `extism_log_drain` is called
 /// Log level should be one of: info, error, trace, debug, warn
@@ -785,13 +990,13 @@ unsafe fn set_log_buffer(filter: &str) -> Result<(), Error> {
        let x = tracing_subscriber::EnvFilter::builder()
            .with_default_directive(tracing::Level::ERROR.into());
        if is_level {
-            x.parse_lossy(format!("extism={}", filter))
+            x.parse_lossy(format!("extism={filter}"))
        } else {
            x.parse_lossy(filter)
        }
    });
-    LOG_BUFFER = Some(LogBuffer::default());
-    let buf = LOG_BUFFER.clone().unwrap();
+    *LOG_BUFFER.lock().unwrap() = Some(LogBuffer::default());
+    let buf = LOG_BUFFER.lock().unwrap().clone().unwrap();
    cfg.with_ansi(false)
        .with_writer(move || buf.clone())
        .try_init()
@@ -803,7 +1008,7 @@ unsafe fn set_log_buffer(filter: &str) -> Result<(), Error> {
 /// Calls the provided callback function for each buffered log line.
 /// This is only needed when `extism_log_custom` is used.
 pub unsafe extern "C" fn extism_log_drain(handler: ExtismLogDrainFunctionType) {
-    if let Some(buf) = LOG_BUFFER.as_mut() {
+    if let Some(buf) = LOG_BUFFER.lock().unwrap().as_mut() {
        if let Ok(mut buf) = buf.buffer.lock() {
            for (line, len) in buf.drain(..) {
                handler(line.as_ptr(), len as u64);
--- a/runtime/src/tests/issues.rs
+++ b/runtime/src/tests/issues.rs
@@ -1,6 +1,7 @@
 use crate::*;

 const WASM_EMPTY: &[u8] = include_bytes!("../../../wasm/empty.wasm");
+const WASM_UNREACHABLE: &[u8] = include_bytes!("../../../wasm/unreachable.wasm");

 // https://github.com/extism/extism/issues/620
 #[test]
@@ -15,7 +16,7 @@ fn test_issue_620() {
    // Call test method, this does not work
    let p = plugin.call::<(), String>("test", ()).unwrap();

-    println!("{}", p);
+    println!("{p}");
 }

 // https://github.com/extism/extism/issues/619
@@ -26,3 +27,31 @@ host_fn!(
        Ok(path.display().to_string())
    }
 );
+
+// https://github.com/extism/extism/issues/775
+#[test]
+fn test_issue_775() {
+    // Load and build plugin
+    let url = Wasm::data(WASM_UNREACHABLE);
+    let manifest = Manifest::new([url]);
+    let mut plugin = PluginBuilder::new(manifest)
+        .with_wasi(true)
+        .build()
+        .unwrap();
+    // Call test method
+    let lock = plugin.instance.clone();
+    let mut lock = lock.lock().unwrap();
+    let res = plugin.raw_call(&mut lock, "do_unreachable", b"", None::<()>);
+    let p = match res {
+        Err(e) => {
+            if e.1 == 0 {
+                Err(e.1)
+            } else {
+                Ok(e.1)
+            }
+        }
+        Ok(code) => Err(code),
+    }
+    .unwrap();
+    println!("{p}");
+}
--- a/runtime/src/tests/kernel.rs
+++ b/runtime/src/tests/kernel.rs
@@ -153,9 +153,29 @@ fn test_kernel_allocations() {
    // Test allocations
    assert_eq!(extism_alloc(&mut store, instance, 0), 0);

+    // 512 bytes, test block re-use + splitting
+    let p = extism_alloc(&mut store, instance, 65535);
+    let first_alloc = p;
+    assert_eq!(extism_length(&mut store, instance, p), 65535);
+    assert_eq!(extism_length(&mut store, instance, p + 1), 0);
+    assert_eq!(extism_length(&mut store, instance, p + 2), 0);
+    assert_eq!(extism_length(&mut store, instance, p + 3), 0);
+    assert_eq!(extism_length(&mut store, instance, p + 4), 0);
+    extism_free(&mut store, instance, p);
+
+    // Should re-use the previous block
+    let q = extism_alloc(&mut store, instance, 65535);
+    assert_eq!(q, p);
+    assert_eq!(extism_length(&mut store, instance, q), 65535);
+    extism_free(&mut store, instance, q);
+
+    let r = extism_alloc(&mut store, instance, 65535 - 24);
+    assert_eq!(r, q);
+    assert_eq!(extism_length(&mut store, instance, q), 65535 - 24);
+    extism_free(&mut store, instance, r);
+
    // 1 byte
    let p = extism_alloc(&mut store, instance, 1);
-    let first_alloc = p;
    assert!(p > 0);
    assert_eq!(extism_length(&mut store, instance, p), 1);
    assert_eq!(extism_length_unsafe(&mut store, instance, p), 1);
@@ -175,37 +195,8 @@ fn test_kernel_allocations() {
        assert_eq!(extism_length(&mut store, instance, p), 64 - i);
        assert_eq!(extism_length_unsafe(&mut store, instance, p), 64 - i);
        extism_free(&mut store, instance, p);
-
-        // should re-use the last allocation
-        let q = extism_alloc(&mut store, instance, 64 - i);
-        assert_eq!(p, q);
-        assert_eq!(extism_length(&mut store, instance, q), 64 - i);
-        assert_eq!(extism_length_unsafe(&mut store, instance, q), 64 - i);
-        extism_free(&mut store, instance, q);
    }

-    // 512 bytes, test block re-use + splitting
-    let p = extism_alloc(&mut store, instance, 512);
-    assert_eq!(extism_length(&mut store, instance, p), 512);
-    assert_eq!(extism_length(&mut store, instance, p + 1), 0);
-    assert_eq!(extism_length(&mut store, instance, p + 2), 0);
-    assert_eq!(extism_length(&mut store, instance, p + 3), 0);
-    assert_eq!(extism_length(&mut store, instance, p + 4), 0);
-    extism_free(&mut store, instance, p);
-
-    // 128 bytes, should be split off the 512 byte block
-    let q = extism_alloc(&mut store, instance, 128);
-    assert!(p <= q && q < p + 512);
-    assert_eq!(extism_length(&mut store, instance, q), 128);
-    extism_free(&mut store, instance, q);
-
-    // 128 bytes, same as above
-    let r = extism_alloc(&mut store, instance, 128);
-    assert!(p <= r && r < p + 512);
-    assert!(r > p);
-    assert_eq!(extism_length(&mut store, instance, r), 128);
-    extism_free(&mut store, instance, q);
-
    // 100 pages
    let p = extism_alloc(&mut store, instance, 6553600);
    assert!(p > 0);
@@ -421,7 +412,7 @@ quickcheck! {
 quickcheck! {
    fn check_alloc_with_load_and_store(amounts: Vec<u16>) -> bool {
        use rand::Rng;
-        let mut rng = rand::thread_rng();
+        let mut rng = rand::rng();
        let (mut store, mut instance) = init_kernel_test();
        let instance = &mut instance;
        for a in amounts {
@@ -434,7 +425,7 @@ quickcheck! {
            }

            for _ in 0..16 {
-                let i = rng.gen_range(ptr..ptr+a as u64);
+                let i = rng.random_range(ptr..ptr+a as u64);
                extism_store_u8(&mut store, instance, i, i as u8);
                if extism_load_u8(&mut store, instance, i as u64) != i as u8 {
                    return false
--- a/runtime/src/tests/mod.rs
+++ b/runtime/src/tests/mod.rs
@@ -1,3 +1,4 @@
 mod issues;
 mod kernel;
+mod pool;
 mod runtime;
--- a/runtime/src/tests/pool.rs
+++ b/runtime/src/tests/pool.rs
@@ -0,0 +1,63 @@
+use crate::*;
+use std::time::Duration;
+
+fn run_thread(p: Pool, i: u64) -> std::thread::JoinHandle<()> {
+    std::thread::spawn(move || {
+        std::thread::sleep(Duration::from_millis(i));
+        let s: String = p
+            .get(Duration::from_secs(1))
+            .unwrap()
+            .unwrap()
+            .call("count_vowels", "abc")
+            .unwrap();
+        println!("{s}");
+    })
+}
+
+fn init(max_instances: usize) -> Pool {
+    let data = include_bytes!("../../../wasm/code.wasm");
+    let plugin_builder =
+        extism::PluginBuilder::new(extism::Manifest::new([extism::Wasm::data(data)]))
+            .with_wasi(true);
+    PoolBuilder::new()
+        .with_max_instances(max_instances)
+        .build(move || plugin_builder.clone().build())
+}
+
+#[test]
+fn test_threads() {
+    for i in 1..=3 {
+        let pool = init(i);
+        let threads = vec![
+            run_thread(pool.clone(), 1000),
+            run_thread(pool.clone(), 1000),
+            run_thread(pool.clone(), 1000),
+            run_thread(pool.clone(), 1000),
+            run_thread(pool.clone(), 1000),
+            run_thread(pool.clone(), 1000),
+            run_thread(pool.clone(), 500),
+            run_thread(pool.clone(), 500),
+            run_thread(pool.clone(), 500),
+            run_thread(pool.clone(), 500),
+            run_thread(pool.clone(), 500),
+            run_thread(pool.clone(), 0),
+        ];
+
+        for t in threads {
+            t.join().unwrap();
+        }
+
+        assert!(pool.count() <= i);
+    }
+}
+
+#[test]
+fn test_exists() -> Result<(), Error> {
+    let pool = init(1);
+    let timeout = Duration::from_secs(1);
+    assert!(pool.function_exists("count_vowels", timeout)?);
+    assert!(pool.function_exists("count_vowels", timeout)?);
+    assert!(!pool.function_exists("not_existing", timeout)?);
+    assert!(!pool.function_exists("not_existing", timeout)?);
+    Ok(())
+}
--- a/runtime/src/tests/runtime.rs
+++ b/runtime/src/tests/runtime.rs
@@ -1,7 +1,7 @@
-use extism_manifest::MemoryOptions;
+use extism_manifest::{HttpRequest, MemoryOptions};

 use crate::*;
-use std::{io::Write, time::Instant};
+use std::{collections::HashMap, io::Write, time::Instant};

 const WASM: &[u8] = include_bytes!("../../../wasm/code-functions.wasm");
 const WASM_NO_FUNCTIONS: &[u8] = include_bytes!("../../../wasm/code.wasm");
@@ -9,6 +9,7 @@ const WASM_LOOP: &[u8] = include_bytes!("../../../wasm/loop.wasm");
 const WASM_GLOBALS: &[u8] = include_bytes!("../../../wasm/globals.wasm");
 const WASM_REFLECT: &[u8] = include_bytes!("../../../wasm/reflect.wasm");
 const WASM_HTTP: &[u8] = include_bytes!("../../../wasm/http.wasm");
+const WASM_HTTP_HEADERS: &[u8] = include_bytes!("../../../wasm/http_headers.wasm");
 const WASM_FS: &[u8] = include_bytes!("../../../wasm/read_write.wasm");

 host_fn!(pub hello_world (a: String) -> String { Ok(a) });
@@ -132,10 +133,7 @@ fn it_works() {
        .unwrap();
    let native_avg: std::time::Duration = native_sum / native_num_tests as u32;

-    println!(
-        "native function call (avg, N = {}): {:?}",
-        native_num_tests, native_avg
-    );
+    println!("native function call (avg, N = {native_num_tests}): {native_avg:?}");

    let num_tests = test_times.len();
    let sum: std::time::Duration = test_times
@@ -144,7 +142,7 @@ fn it_works() {
        .unwrap();
    let avg: std::time::Duration = sum / num_tests as u32;

-    println!("wasm function call (avg, N = {}): {:?}", num_tests, avg);
+    println!("wasm function call (avg, N = {num_tests}): {avg:?}");

    // Check that log file was written to
    if log {
@@ -211,7 +209,7 @@ fn test_cancel() {
        let _output: Result<&[u8], Error> = plugin.call("loop_forever", "abc123");
        let end = std::time::Instant::now();
        let time = end - start;
-        println!("Cancelled plugin ran for {:?}", time);
+        println!("Cancelled plugin ran for {time:?}");
    }
 }

@@ -257,6 +255,23 @@ fn test_fuel() {
    }
 }

+#[test]
+fn test_fuel_consumption() {
+    let manifest = Manifest::new([extism_manifest::Wasm::data(WASM_LOOP)]);
+    let mut plugin = PluginBuilder::new(manifest)
+        .with_wasi(true)
+        .with_fuel_limit(10000)
+        .build()
+        .unwrap();
+
+    let output: Result<&[u8], Error> = plugin.call("loop_forever", "abc123");
+    assert!(output.is_err());
+
+    let fuel_consumed = plugin.fuel_consumed().unwrap();
+    println!("Fuel consumed: {fuel_consumed}");
+    assert!(fuel_consumed > 0);
+}
+
 #[test]
 #[cfg(feature = "http")]
 fn test_http_timeout() {
@@ -422,7 +437,7 @@ fn test_memory_max() {
    assert!(output.is_err());

    let err = output.unwrap_err().root_cause().to_string();
-    println!("{:?}", err);
+    println!("{err:?}");
    assert_eq!(err, "oom");

    // Should pass with memory.max set to a large enough number
@@ -446,7 +461,7 @@ fn hello_world_set_error(
    _user_data: UserData<()>,
 ) -> Result<(), Error> {
    plugin.set_error("TEST")?;
-    outputs[0] = inputs[0].clone();
+    outputs[0] = inputs[0];
    Ok(())
 }

@@ -485,7 +500,7 @@ fn test_extism_error() {
    let mut plugin = Plugin::new(&manifest, [f], true).unwrap();
    let output: Result<String, Error> = plugin.call("count_vowels", "a".repeat(1024));
    assert!(output.is_err());
-    println!("{:?}", output);
+    println!("{output:?}");
    assert_eq!(output.unwrap_err().root_cause().to_string(), "TEST");
 }

@@ -543,7 +558,7 @@ fn hello_world_user_data(
    let mut data = data.lock().unwrap();
    let s = _plugin.memory_get_val(&inputs[0])?;
    data.write_all(s)?;
-    outputs[0] = inputs[0].clone();
+    outputs[0] = inputs[0];
    Ok(())
 }

@@ -793,3 +808,33 @@ fn test_readonly_dirs() {
        "Expected try_write to fail, but it succeeded."
    );
 }
+
+#[test]
+#[cfg(feature = "http")]
+fn test_http_response_headers() {
+    let mut plugin = PluginBuilder::new(
+        Manifest::new([Wasm::data(WASM_HTTP_HEADERS)]).with_allowed_host("extism.org"),
+    )
+    .with_http_response_headers(true)
+    .build()
+    .unwrap();
+    let req = HttpRequest::new("https://extism.org");
+    let Json(res): Json<HashMap<String, String>> = plugin.call("http_get", Json(req)).unwrap();
+    println!("{res:?}");
+    assert_eq!(res["content-type"], "text/html; charset=utf-8");
+}
+
+#[test]
+#[cfg(feature = "http")]
+fn test_http_response_headers_disabled() {
+    let mut plugin = PluginBuilder::new(
+        Manifest::new([Wasm::data(WASM_HTTP_HEADERS)]).with_allowed_host("extism.org"),
+    )
+    .with_http_response_headers(false)
+    .build()
+    .unwrap();
+    let req = HttpRequest::new("https://extism.org");
+    let Json(res): Json<HashMap<String, String>> = plugin.call("http_get", Json(req)).unwrap();
+    println!("{res:?}");
+    assert!(res.is_empty());
+}
--- a/runtime/src/timer.rs
+++ b/runtime/src/timer.rs
@@ -22,18 +22,18 @@ pub(crate) struct Timer {

 #[cfg(not(target_family = "windows"))]
 extern "C" fn cleanup_timer() {
-    let mut timer = match unsafe { TIMER.lock() } {
+    let mut timer = match TIMER.lock() {
        Ok(x) => x,
        Err(e) => e.into_inner(),
    };
    drop(timer.take());
 }

-static mut TIMER: std::sync::Mutex<Option<Timer>> = std::sync::Mutex::new(None);
+static TIMER: std::sync::Mutex<Option<Timer>> = std::sync::Mutex::new(None);

 impl Timer {
    pub(crate) fn tx() -> std::sync::mpsc::Sender<TimerAction> {
-        let mut timer = match unsafe { TIMER.lock() } {
+        let mut timer = match TIMER.lock() {
            Ok(x) => x,
            Err(e) => e.into_inner(),
        };
@@ -92,25 +92,39 @@ impl Timer {
            loop {
                if plugins.is_empty() {
                    if let Ok(x) = rx.recv() {
-                        handle!(x)
+                        handle!(x);
                    }
                }

-                plugins = plugins
-                    .into_iter()
-                    .filter(|(_k, (engine, end))| {
-                        if let Some(end) = end {
-                            let now = std::time::Instant::now();
-                            if end <= &now {
-                                engine.increment_epoch();
-                                return false;
+                let mut timeout: Option<std::time::Duration> = None;
+
+                plugins.retain(|_k, (engine, end)| {
+                    if let Some(end) = end {
+                        let now = std::time::Instant::now();
+                        if *end <= now {
+                            engine.increment_epoch();
+                            return false;
+                        } else {
+                            let time_left =
+                                (*end - now).saturating_sub(std::time::Duration::from_millis(1));
+                            if let Some(t) = &timeout {
+                                if time_left < *t {
+                                    timeout = Some(time_left);
+                                }
+                            } else {
+                                timeout = Some(time_left);
                            }
                        }
-                        true
-                    })
-                    .collect();
+                    }

-                for x in rx.try_iter() {
+                    true
+                });
+
+                if let Some(timeout) = timeout {
+                    if let Ok(x) = rx.recv_timeout(timeout) {
+                        handle!(x)
+                    }
+                } else if let Ok(x) = rx.recv() {
                    handle!(x)
                }
            }
--- a/wasm/allocations.wasm
+++ b/wasm/allocations.wasm
--- a/wasm/http_headers.wasm
+++ b/wasm/http_headers.wasm
--- a/wasm/unreachable.wasm
+++ b/wasm/unreachable.wasm