diff --git a/Cargo.lock b/Cargo.lock
index 3e7f0028dc..610a6fbad2 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -2,6 +2,12 @@
 # It is not intended for manual editing.
 version = 3
 
+[[package]]
+name = "Inflector"
+version = "0.11.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fe438c63458706e03479442743baae6c88256498e6431708f6dfc520a26515d3"
+
 [[package]]
 name = "addr2line"
 version = "0.17.0"
@@ -37,6 +43,12 @@ dependencies = [
  "memchr",
 ]
 
+[[package]]
+name = "aliasable"
+version = "0.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "250f629c0161ad8107cf89319e990051fae62832fd343083bea452d93e2205fd"
+
 [[package]]
 name = "ambient-authority"
 version = "0.0.1"
@@ -2185,14 +2197,52 @@ version = "6.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9ff7415e9ae3fff1225851df9e0d9e4e5479f947619774677a63572e55e80eff"
 
+[[package]]
+name = "ouroboros"
+version = "0.15.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7f56a2b0aa5fc88687aaf63e85a7974422790ce3419a2e1a15870f8a55227822"
+dependencies = [
+ "aliasable",
+ "ouroboros_macro",
+]
+
+[[package]]
+name = "ouroboros_macro"
+version = "0.15.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6c40641e27d0eb38cae3dee081d920104d2db47a8e853c1a592ef68d33f5ebf4"
+dependencies = [
+ "Inflector",
+ "proc-macro-error",
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "outbound-http"
+version = "0.2.0"
+dependencies = [
+ "anyhow",
+ "bytes",
+ "http",
+ "reqwest",
+ "spin-app",
+ "spin-core",
+ "tracing",
+ "tracing-futures",
+ "url",
+ "wit-bindgen-wasmtime",
+]
+
 [[package]]
 name = "outbound-pg"
 version = "0.2.0"
 dependencies = [
  "anyhow",
  "postgres",
- "spin-engine",
- "spin-manifest",
+ "spin-core",
  "tracing",
  "wit-bindgen-wasmtime",
 ]
@@ -2202,24 +2252,14 @@ name = "outbound-redis"
 version = "0.2.0"
 dependencies = [
  "anyhow",
- "owning_ref",
  "redis",
- "spin-engine",
- "spin-manifest",
+ "spin-core",
+ "tokio",
  "tracing",
  "tracing-futures",
  "wit-bindgen-wasmtime",
 ]
 
-[[package]]
-name = "owning_ref"
-version = "0.4.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6ff55baddef9e4ad00f88b6c743a2a8062d4c6ade126c2a528644b8e444d52ce"
-dependencies = [
- "stable_deref_trait",
-]
-
 [[package]]
 name = "parking_lot"
 version = "0.11.2"
@@ -2938,9 +2978,9 @@ dependencies = [
 
 [[package]]
 name = "sanitize-filename"
-version = "0.3.0"
+version = "0.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bf18934a12018228c5b55a6dae9df5d0641e3566b3630cb46cc55564068e7c2f"
+checksum = "08c502bdb638f1396509467cb0580ef3b29aa2a45c5d43e5d84928241280296c"
 dependencies = [
  "lazy_static",
  "regex",
@@ -3260,6 +3300,19 @@ version = "0.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6e63cff320ae2c57904679ba7cb63280a3dc4613885beafb148ee7bf9aa9042d"
 
+[[package]]
+name = "spin-app"
+version = "0.1.0"
+dependencies = [
+ "anyhow",
+ "async-trait",
+ "ouroboros",
+ "serde",
+ "serde_json",
+ "spin-core",
+ "thiserror",
+]
+
 [[package]]
 name = "spin-build"
 version = "0.2.0"
@@ -3296,7 +3349,6 @@ dependencies = [
  "lazy_static",
  "nix 0.24.2",
  "openssl",
- "outbound-redis",
  "path-absolutize",
  "regex",
  "reqwest",
@@ -3306,7 +3358,6 @@ dependencies = [
  "sha2 0.10.3",
  "spin-build",
  "spin-config",
- "spin-engine",
  "spin-http-engine",
  "spin-loader",
  "spin-manifest",
@@ -3323,7 +3374,6 @@ dependencies = [
  "url",
  "uuid",
  "vergen",
- "wasi-outbound-http",
  "wasmtime",
  "which",
 ]
@@ -3333,32 +3383,28 @@ name = "spin-config"
 version = "0.2.0"
 dependencies = [
  "anyhow",
- "serde",
+ "async-trait",
+ "dotenvy",
+ "once_cell",
+ "spin-app",
+ "spin-core",
  "thiserror",
+ "tokio",
  "toml",
  "wit-bindgen-wasmtime",
 ]
 
 [[package]]
-name = "spin-engine"
-version = "0.2.0"
+name = "spin-core"
+version = "0.1.0"
 dependencies = [
  "anyhow",
- "bytes",
- "cap-std 0.24.4",
- "dirs 4.0.0",
- "sanitize-filename",
- "spin-config",
- "spin-manifest",
- "tempfile",
- "tokio",
+ "async-trait",
  "tracing",
- "tracing-futures",
  "wasi-cap-std-sync",
  "wasi-common",
  "wasmtime",
  "wasmtime-wasi",
- "wit-bindgen-wasmtime",
 ]
 
 [[package]]
@@ -3383,7 +3429,8 @@ dependencies = [
  "percent-encoding",
  "rustls-pemfile 0.3.0",
  "serde",
- "spin-engine",
+ "spin-app",
+ "spin-core",
  "spin-manifest",
  "spin-testing",
  "spin-trigger",
@@ -3392,12 +3439,8 @@ dependencies = [
  "tokio-rustls",
  "tracing",
  "tracing-futures",
- "tracing-subscriber",
  "url",
- "wasi-cap-std-sync",
- "wasi-common",
  "wasmtime",
- "wasmtime-wasi",
  "wit-bindgen-wasmtime",
 ]
 
@@ -3415,12 +3458,13 @@ dependencies = [
  "glob",
  "itertools",
  "lazy_static",
+ "outbound-http",
  "path-absolutize",
  "regex",
  "reqwest",
  "serde",
  "sha2 0.10.3",
- "spin-config",
+ "spin-app",
  "spin-manifest",
  "tempfile",
  "tokio",
@@ -3428,9 +3472,7 @@ dependencies = [
  "toml",
  "tracing",
  "tracing-futures",
- "tracing-subscriber",
  "walkdir",
- "wasi-outbound-http",
 ]
 
 [[package]]
@@ -3493,14 +3535,14 @@ dependencies = [
  "log",
  "redis",
  "serde",
- "spin-engine",
+ "spin-app",
+ "spin-core",
  "spin-manifest",
  "spin-testing",
  "spin-trigger",
  "tokio",
  "tracing",
  "tracing-futures",
- "tracing-subscriber",
  "wasi-common",
  "wasmtime",
  "wasmtime-wasi",
@@ -3562,33 +3604,13 @@ dependencies = [
  "anyhow",
  "http",
  "hyper",
- "spin-engine",
+ "serde",
+ "serde_json",
+ "spin-app",
+ "spin-core",
  "spin-http-engine",
- "spin-manifest",
- "spin-trigger",
-]
-
-[[package]]
-name = "spin-timer"
-version = "0.1.0"
-dependencies = [
- "anyhow",
- "async-trait",
- "chrono",
- "env_logger",
- "futures",
- "log",
- "spin-engine",
- "spin-manifest",
  "spin-trigger",
- "tokio",
- "tracing",
- "tracing-futures",
  "tracing-subscriber",
- "wasi-common",
- "wasmtime",
- "wasmtime-wasi",
- "wit-bindgen-wasmtime",
 ]
 
 [[package]]
@@ -3599,19 +3621,21 @@ dependencies = [
  "async-trait",
  "clap 3.2.19",
  "ctrlc",
- "dotenvy",
+ "dirs 4.0.0",
  "futures",
  "http",
+ "outbound-http",
  "outbound-pg",
  "outbound-redis",
+ "sanitize-filename",
  "serde",
+ "serde_json",
+ "spin-app",
  "spin-config",
- "spin-engine",
+ "spin-core",
  "spin-loader",
  "spin-manifest",
  "tracing",
- "wasi-outbound-http",
- "wasmtime",
 ]
 
 [[package]]
@@ -4297,21 +4321,21 @@ dependencies = [
 ]
 
 [[package]]
-name = "wasi-outbound-http"
-version = "0.2.0"
+name = "wasi-tokio"
+version = "0.39.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2ab325bba31ae9286b8ebdc18d32a43d6471312c9bc4e477240be444e00ec4f4"
 dependencies = [
  "anyhow",
- "bytes",
- "futures",
- "http",
- "reqwest",
- "spin-engine",
- "spin-manifest",
+ "cap-std 0.25.2",
+ "io-extras 0.15.0",
+ "io-lifetimes 0.7.3",
+ "lazy_static",
+ "rustix 0.35.9",
  "tokio",
- "tracing",
- "tracing-futures",
- "url",
- "wit-bindgen-wasmtime",
+ "wasi-cap-std-sync",
+ "wasi-common",
+ "wiggle",
 ]
 
 [[package]]
@@ -4592,6 +4616,7 @@ dependencies = [
  "anyhow",
  "wasi-cap-std-sync",
  "wasi-common",
+ "wasi-tokio",
  "wasmtime",
  "wiggle",
 ]
@@ -4679,6 +4704,7 @@ dependencies = [
  "tracing",
  "wasmtime",
  "wiggle-macro",
+ "witx",
 ]
 
 [[package]]
@@ -4878,6 +4904,7 @@ version = "0.2.0"
 source = "git+https://github.com/bytecodealliance/wit-bindgen?rev=cb871cfa1ee460b51eb1d144b175b9aab9c50aba#cb871cfa1ee460b51eb1d144b175b9aab9c50aba"
 dependencies = [
  "anyhow",
+ "async-trait",
  "bitflags",
  "thiserror",
  "wasmtime",
diff --git a/Cargo.toml b/Cargo.toml
index ae1d9c0f3d..44384ba56e 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -21,7 +21,6 @@ hippo-openapi = "0.10"
 hippo = { git = "https://github.com/deislabs/hippo-cli", tag = "v0.16.1" }
 lazy_static = "1.4.0"
 nix = { version = "0.24", features = ["signal"] }
-outbound-redis = { path = "crates/outbound-redis" }
 path-absolutize = "3.0.11"
 regex = "1.5.5"
 reqwest = { version = "0.11", features = ["stream"] }
@@ -31,7 +30,6 @@ serde_json = "1.0.82"
 sha2 = "0.10.2"
 spin-build = { path = "crates/build" }
 spin-config = { path = "crates/config" }
-spin-engine = { path = "crates/engine" }
 spin-http-engine = { path = "crates/http" }
 spin-loader = { path = "crates/loader" }
 spin-manifest = { path = "crates/manifest" }
@@ -44,10 +42,9 @@ tokio = { version = "1.11", features = [ "full" ] }
 toml = "0.5"
 tracing = { version = "0.1", features = [ "log" ] }
 tracing-futures = "0.2"
-tracing-subscriber = { version = "0.3.7", features = [ "env-filter" ] }
+tracing-subscriber = { version = "0.3", features = [ "env-filter" ] }
 url = "2.2.2"
 uuid = "^1.0"
-wasi-outbound-http = { path = "crates/outbound-http" }
 wasmtime = "0.39.1"
 
 [target.'cfg(target_os = "linux")'.dependencies]
@@ -70,9 +67,10 @@ e2e-tests = []
 
 [workspace]
 members = [
+    "crates/app",
     "crates/build",
     "crates/config",
-    "crates/engine",
+    "crates/core",
     "crates/http",
     "crates/loader",
     "crates/manifest",
@@ -82,7 +80,6 @@ members = [
     "crates/templates",
     "crates/testing",
     "crates/trigger",
-    "examples/spin-timer",
     "sdk/rust",
     "sdk/rust/macro"
 ]
diff --git a/build.rs b/build.rs
index b65cdc7a76..52f12997e4 100644
--- a/build.rs
+++ b/build.rs
@@ -48,7 +48,6 @@ error: the `wasm32-wasi` target is not installed
         "crates/http/benches/spin-http-benchmark",
     );
     build_wasm_test_program("wagi-benchmark.wasm", "crates/http/benches/wagi-benchmark");
-    build_wasm_test_program("echo.wasm", "examples/spin-timer/example");
 
     cargo_build(RUST_HTTP_INTEGRATION_TEST);
     cargo_build(RUST_HTTP_INTEGRATION_ENV_TEST);
diff --git a/crates/app/Cargo.toml b/crates/app/Cargo.toml
new file mode 100644
index 0000000000..1d8dedf4b3
--- /dev/null
+++ b/crates/app/Cargo.toml
@@ -0,0 +1,13 @@
+[package]
+name = "spin-app"
+version = "0.1.0"
+edition = "2021"
+
+[dependencies]
+anyhow = "1.0"
+async-trait = "0.1"
+ouroboros = "0.15"
+serde = { version = "1.0", features = ["derive"] }
+serde_json = "1.0"
+spin-core = { path = "../core" }
+thiserror = "1.0"
diff --git a/crates/app/src/host_component.rs b/crates/app/src/host_component.rs
new file mode 100644
index 0000000000..c428aefe45
--- /dev/null
+++ b/crates/app/src/host_component.rs
@@ -0,0 +1,51 @@
+use std::sync::Arc;
+
+use spin_core::{EngineBuilder, HostComponent, HostComponentsData};
+
+use crate::AppComponent;
+
+pub trait DynamicHostComponent: HostComponent {
+    fn update_data(&self, data: &mut Self::Data, component: &AppComponent) -> anyhow::Result<()>;
+}
+
+impl<DHC: DynamicHostComponent> DynamicHostComponent for Arc<DHC> {
+    fn update_data(&self, data: &mut Self::Data, component: &AppComponent) -> anyhow::Result<()> {
+        (**self).update_data(data, component)
+    }
+}
+
+type DataUpdater =
+    Box<dyn Fn(&mut HostComponentsData, &AppComponent) -> anyhow::Result<()> + Send + Sync>;
+
+#[derive(Default)]
+pub struct DynamicHostComponents {
+    data_updaters: Vec<DataUpdater>,
+}
+
+impl DynamicHostComponents {
+    pub fn add_dynamic_host_component<T: Send + Sync, DHC: DynamicHostComponent>(
+        &mut self,
+        engine_builder: &mut EngineBuilder<T>,
+        host_component: DHC,
+    ) -> anyhow::Result<()> {
+        let host_component = Arc::new(host_component);
+        let handle = engine_builder.add_host_component(host_component.clone())?;
+        self.data_updaters
+            .push(Box::new(move |host_components_data, component| {
+                let data = host_components_data.get_or_insert(handle);
+                host_component.update_data(data, component)
+            }));
+        Ok(())
+    }
+
+    pub fn update_data(
+        &self,
+        host_components_data: &mut HostComponentsData,
+        component: &AppComponent,
+    ) -> anyhow::Result<()> {
+        for data_updater in &self.data_updaters {
+            data_updater(host_components_data, component)?;
+        }
+        Ok(())
+    }
+}
diff --git a/crates/app/src/lib.rs b/crates/app/src/lib.rs
new file mode 100644
index 0000000000..92a3bf48c3
--- /dev/null
+++ b/crates/app/src/lib.rs
@@ -0,0 +1,267 @@
+mod host_component;
+pub mod locked;
+pub mod values;
+
+use ouroboros::self_referencing;
+use serde::Deserialize;
+use spin_core::{wasmtime, Engine, EngineBuilder, StoreBuilder};
+
+use host_component::DynamicHostComponents;
+use locked::{ContentPath, LockedApp, LockedComponent, LockedComponentSource, LockedTrigger};
+
+pub use async_trait::async_trait;
+pub use host_component::DynamicHostComponent;
+pub use locked::Variable;
+
+// TODO(lann): Should this migrate to spin-loader?
+#[async_trait]
+pub trait Loader {
+    async fn load_app(&self, uri: &str) -> anyhow::Result<LockedApp>;
+
+    async fn load_module(
+        &self,
+        engine: &wasmtime::Engine,
+        source: &LockedComponentSource,
+    ) -> anyhow::Result<spin_core::Module>;
+
+    async fn mount_files(
+        &self,
+        store_builder: &mut StoreBuilder,
+        component: &AppComponent,
+    ) -> anyhow::Result<()>;
+}
+
+pub struct AppLoader {
+    inner: Box<dyn Loader + Send + Sync>,
+    dynamic_host_components: DynamicHostComponents,
+}
+
+impl AppLoader {
+    pub fn new(loader: impl Loader + Send + Sync + 'static) -> Self {
+        Self {
+            inner: Box::new(loader),
+            dynamic_host_components: Default::default(),
+        }
+    }
+
+    pub fn add_dynamic_host_component<T: Send + Sync, DHC: DynamicHostComponent>(
+        &mut self,
+        engine_builder: &mut EngineBuilder<T>,
+        host_component: DHC,
+    ) -> anyhow::Result<()> {
+        self.dynamic_host_components
+            .add_dynamic_host_component(engine_builder, host_component)
+    }
+
+    pub async fn load_app(&self, uri: String) -> Result<App> {
+        let locked = self
+            .inner
+            .load_app(&uri)
+            .await
+            .map_err(Error::LoaderError)?;
+        Ok(App {
+            loader: self,
+            uri,
+            locked,
+        })
+    }
+
+    pub async fn load_owned_app(self, uri: String) -> Result<OwnedApp> {
+        OwnedApp::try_new_async(self, |loader| Box::pin(loader.load_app(uri))).await
+    }
+}
+
+impl std::fmt::Debug for AppLoader {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("AppLoader").finish()
+    }
+}
+
+#[self_referencing]
+#[derive(Debug)]
+pub struct OwnedApp {
+    pub loader: AppLoader,
+    #[borrows(loader)]
+    #[covariant]
+    app: App<'this>,
+}
+
+impl std::ops::Deref for OwnedApp {
+    type Target = App<'static>;
+
+    fn deref(&self) -> &Self::Target {
+        unsafe {
+            // We know that App's lifetime param is for AppLoader, which is owned by self here.
+            std::mem::transmute::<&App, &App<'static>>(self.borrow_app())
+        }
+    }
+}
+
+#[derive(Debug)]
+pub struct App<'a> {
+    loader: &'a AppLoader,
+    uri: String,
+    locked: LockedApp,
+}
+
+impl<'a> App<'a> {
+    pub fn uri(&self) -> &str {
+        &self.uri
+    }
+
+    pub fn get_metadata<'this, T: Deserialize<'this>>(&'this self, key: &str) -> Option<Result<T>> {
+        self.locked
+            .metadata
+            .get(key)
+            .map(|value| Ok(T::deserialize(value)?))
+    }
+
+    pub fn require_metadata<'this, T: Deserialize<'this>>(&'this self, key: &str) -> Result<T> {
+        self.get_metadata(key)
+            .ok_or_else(|| Error::ManifestError(format!("missing required {key:?}")))?
+    }
+
+    pub fn variables(&self) -> impl Iterator<Item = (&String, &Variable)> {
+        self.locked.variables.iter()
+    }
+
+    pub fn components(&self) -> impl Iterator<Item = AppComponent> {
+        self.locked
+            .components
+            .iter()
+            .map(|locked| AppComponent { app: self, locked })
+    }
+
+    pub fn get_component(&self, component_id: &str) -> Option<AppComponent> {
+        self.components()
+            .find(|component| component.locked.id == component_id)
+    }
+
+    pub fn triggers(&self) -> impl Iterator<Item = AppTrigger> {
+        self.locked
+            .triggers
+            .iter()
+            .map(|locked| AppTrigger { app: self, locked })
+    }
+
+    pub fn triggers_with_type(&'a self, trigger_type: &'a str) -> impl Iterator<Item = AppTrigger> {
+        self.triggers()
+            .filter(move |trigger| trigger.locked.trigger_type == trigger_type)
+    }
+}
+
+pub struct AppComponent<'a> {
+    pub app: &'a App<'a>,
+    locked: &'a LockedComponent,
+}
+
+impl<'a> AppComponent<'a> {
+    pub fn id(&self) -> &str {
+        &self.locked.id
+    }
+
+    pub fn source(&self) -> &LockedComponentSource {
+        &self.locked.source
+    }
+
+    pub fn files(&self) -> std::slice::Iter<ContentPath> {
+        self.locked.files.iter()
+    }
+
+    pub fn get_metadata<T: Deserialize<'a>>(&self, key: &str) -> Option<Result<T>> {
+        self.locked
+            .metadata
+            .get(key)
+            .map(|value| Ok(T::deserialize(value)?))
+    }
+
+    pub fn config(&self) -> impl Iterator<Item = (&String, &String)> {
+        self.locked.config.iter()
+    }
+
+    pub async fn load_module<T: Send + Sync>(
+        &self,
+        engine: &Engine<T>,
+    ) -> Result<spin_core::Module> {
+        self.app
+            .loader
+            .inner
+            .load_module(engine.as_ref(), &self.locked.source)
+            .await
+            .map_err(Error::LoaderError)
+    }
+
+    pub async fn apply_store_config(&self, builder: &mut StoreBuilder) -> Result<()> {
+        builder.env(&self.locked.env).map_err(Error::CoreError)?;
+
+        let loader = self.app.loader;
+        loader
+            .inner
+            .mount_files(builder, self)
+            .await
+            .map_err(Error::LoaderError)?;
+
+        loader
+            .dynamic_host_components
+            .update_data(builder.host_components_data(), self)
+            .map_err(Error::HostComponentError)?;
+
+        Ok(())
+    }
+}
+
+pub struct AppTrigger<'a> {
+    pub app: &'a App<'a>,
+    locked: &'a LockedTrigger,
+}
+
+impl<'a> AppTrigger<'a> {
+    pub fn id(&self) -> &str {
+        &self.locked.id
+    }
+
+    pub fn trigger_type(&self) -> &str {
+        &self.locked.trigger_type
+    }
+
+    pub fn component(&self) -> Result<AppComponent<'a>> {
+        let component_id = self.locked.trigger_config.get("component").ok_or_else(|| {
+            Error::ManifestError(format!(
+                "trigger {:?} missing 'component' config field",
+                self.locked.id
+            ))
+        })?;
+        let component_id = component_id.as_str().ok_or_else(|| {
+            Error::ManifestError(format!(
+                "trigger {:?} 'component' field has unexpected value {:?}",
+                self.locked.id, component_id
+            ))
+        })?;
+        self.app.get_component(component_id).ok_or_else(|| {
+            Error::ManifestError(format!(
+                "missing component {:?} configured for trigger {:?}",
+                component_id, self.locked.id
+            ))
+        })
+    }
+
+    pub fn typed_config<Config: Deserialize<'a>>(&self) -> Result<Config> {
+        Ok(Config::deserialize(&self.locked.trigger_config)?)
+    }
+}
+
+pub type Result<T> = std::result::Result<T, Error>;
+
+#[derive(Debug, thiserror::Error)]
+pub enum Error {
+    #[error("spin core error: {0}")]
+    CoreError(anyhow::Error),
+    #[error("host component error: {0}")]
+    HostComponentError(anyhow::Error),
+    #[error("loader error: {0}")]
+    LoaderError(anyhow::Error),
+    #[error("manifest error: {0}")]
+    ManifestError(String),
+    #[error("json error: {0}")]
+    JsonError(#[from] serde_json::Error),
+}
diff --git a/crates/app/src/locked.rs b/crates/app/src/locked.rs
new file mode 100644
index 0000000000..83c90bebb8
--- /dev/null
+++ b/crates/app/src/locked.rs
@@ -0,0 +1,154 @@
+use std::path::PathBuf;
+
+use serde::{Deserialize, Serialize};
+use serde_json::Value;
+
+use crate::values::ValuesMap;
+
+// LockedMap gives deterministic encoding, which we want.
+pub type LockedMap<T> = std::collections::BTreeMap<String, T>;
+
+/// A LockedApp represents a "fully resolved" Spin application.
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub struct LockedApp {
+    /// Locked schema version
+    pub spin_lock_version: FixedVersion<0>,
+    /// Application metadata
+    #[serde(default, skip_serializing_if = "ValuesMap::is_empty")]
+    pub metadata: ValuesMap,
+    /// Custom config variables
+    #[serde(default, skip_serializing_if = "LockedMap::is_empty")]
+    pub variables: LockedMap<Variable>,
+    /// Application triggers
+    pub triggers: Vec<LockedTrigger>,
+    /// Application components
+    pub components: Vec<LockedComponent>,
+}
+
+impl LockedApp {
+    pub fn from_json(contents: &[u8]) -> serde_json::Result<Self> {
+        serde_json::from_slice(contents)
+    }
+
+    pub fn to_json(&self) -> serde_json::Result<Vec<u8>> {
+        serde_json::to_vec_pretty(&self)
+    }
+}
+
+/// A LockedComponent represents a "fully resolved" Spin component.
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub struct LockedComponent {
+    /// Application-unique component identifier
+    pub id: String,
+    /// Component metadata
+    #[serde(default, skip_serializing_if = "ValuesMap::is_empty")]
+    pub metadata: ValuesMap,
+    /// Wasm source
+    pub source: LockedComponentSource,
+    /// WASI environment variables
+    #[serde(default, skip_serializing_if = "LockedMap::is_empty")]
+    pub env: LockedMap<String>,
+    /// WASI filesystem contents
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub files: Vec<ContentPath>,
+    /// Custom config values
+    #[serde(default, skip_serializing_if = "LockedMap::is_empty")]
+    pub config: LockedMap<String>,
+}
+
+/// A LockedComponentSource specifies a Wasm source.
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub struct LockedComponentSource {
+    /// Wasm source content type (e.g. "application/wasm")
+    pub content_type: String,
+    /// Wasm source content specification
+    #[serde(flatten)]
+    pub content: ContentRef,
+}
+
+/// A ContentPath specifies content mapped to a WASI path.
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub struct ContentPath {
+    /// Content specification
+    #[serde(flatten)]
+    pub content: ContentRef,
+    /// WASI mount path
+    pub path: PathBuf,
+}
+
+/// A ContentRef represents content used by an application.
+///
+/// At least one of `source` or `digest` must be specified. Implementations may
+/// require one or the other (or both).
+#[derive(Clone, Debug, Default, Serialize, Deserialize)]
+pub struct ContentRef {
+    /// A URI where the content can be accessed. Implementations may support
+    /// different URI schemes.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub source: Option<String>,
+    /// If set, the content must have the given SHA-256 digest.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub digest: Option<String>,
+}
+
+/// A LockedTrigger specifies configuration for an application trigger.
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub struct LockedTrigger {
+    /// Application-unique trigger identifier
+    pub id: String,
+    /// Trigger type (e.g. "http")
+    pub trigger_type: String,
+    /// Trigger-type-specific configuration
+    pub trigger_config: Value,
+}
+
+/// A Variable specifies a custom configuration variable.
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub struct Variable {
+    /// The variable's default value. If unset, the variable is required.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub default: Option<String>,
+    /// If set, the variable's value may be sensitive and e.g. shouldn't be logged.
+    #[serde(default, skip_serializing_if = "std::ops::Not::not")]
+    pub secret: bool,
+}
+
+/// FixedVersion represents a schema version field with a const value.
+#[allow(unused)]
+#[derive(Clone, Debug, Default, Serialize, Deserialize)]
+#[serde(into = "usize", try_from = "usize")]
+pub struct FixedVersion<const V: usize>;
+
+impl<const V: usize> From<FixedVersion<V>> for usize {
+    fn from(_: FixedVersion<V>) -> usize {
+        V
+    }
+}
+
+impl<const V: usize> From<FixedVersion<V>> for String {
+    fn from(_: FixedVersion<V>) -> String {
+        V.to_string()
+    }
+}
+
+impl<const V: usize> TryFrom<usize> for FixedVersion<V> {
+    type Error = String;
+
+    fn try_from(value: usize) -> Result<Self, Self::Error> {
+        if value != V {
+            return Err(format!("invalid version {} != {}", value, V));
+        }
+        Ok(Self)
+    }
+}
+
+impl<const V: usize> TryFrom<String> for FixedVersion<V> {
+    type Error = String;
+
+    fn try_from(value: String) -> Result<Self, Self::Error> {
+        let value: usize = value
+            .parse()
+            .map_err(|err| format!("invalid version: {}", err))?;
+        value.try_into()
+    }
+}
diff --git a/crates/app/src/values.rs b/crates/app/src/values.rs
new file mode 100644
index 0000000000..6a764a662f
--- /dev/null
+++ b/crates/app/src/values.rs
@@ -0,0 +1,57 @@
+use serde::Serialize;
+use serde_json::Value;
+
+// ValuesMap stores dynamically-typed values.
+pub type ValuesMap = serde_json::Map<String, Value>;
+
+/// ValuesMapBuilder assists in building a ValuesMap.
+#[derive(Default)]
+pub struct ValuesMapBuilder(ValuesMap);
+
+impl ValuesMapBuilder {
+    pub fn new() -> Self {
+        Self::default()
+    }
+
+    pub fn string(&mut self, key: impl Into<String>, value: impl Into<String>) -> &mut Self {
+        self.entry(key, value.into())
+    }
+
+    pub fn string_option(
+        &mut self,
+        key: impl Into<String>,
+        value: Option<impl Into<String>>,
+    ) -> &mut Self {
+        if let Some(value) = value {
+            self.0.insert(key.into(), value.into().into());
+        }
+        self
+    }
+
+    pub fn string_array<T: Into<String>>(
+        &mut self,
+        key: impl Into<String>,
+        iter: impl IntoIterator<Item = T>,
+    ) -> &mut Self {
+        self.entry(key, iter.into_iter().map(|s| s.into()).collect::<Vec<_>>())
+    }
+
+    pub fn entry(&mut self, key: impl Into<String>, value: impl Into<Value>) -> &mut Self {
+        self.0.insert(key.into(), value.into());
+        self
+    }
+
+    pub fn serializable(
+        &mut self,
+        key: impl Into<String>,
+        value: impl Serialize,
+    ) -> serde_json::Result<&mut Self> {
+        let value = serde_json::to_value(value)?;
+        self.0.insert(key.into(), value);
+        Ok(self)
+    }
+
+    pub fn build(&mut self) -> ValuesMap {
+        std::mem::take(&mut self.0)
+    }
+}
diff --git a/crates/config/Cargo.toml b/crates/config/Cargo.toml
index d7edb3c71f..960dbe38a3 100644
--- a/crates/config/Cargo.toml
+++ b/crates/config/Cargo.toml
@@ -6,9 +6,18 @@ authors = [ "Fermyon Engineering <engineering@fermyon.com>" ]
 
 [dependencies]
 anyhow = "1.0"
-serde = { version = "1.0", features = [ "derive" ] }
+async-trait = "0.1"
+dotenvy = "0.15"
+once_cell = "1"
+spin-app = { path = "../app" }
+spin-core = { path = "../core" }
 thiserror = "1"
-wit-bindgen-wasmtime = { git = "https://github.com/bytecodealliance/wit-bindgen", rev = "cb871cfa1ee460b51eb1d144b175b9aab9c50aba" }
+tokio = { version = "1", features = ["rt-multi-thread"] }
+
+[dependencies.wit-bindgen-wasmtime]
+git = "https://github.com/bytecodealliance/wit-bindgen"
+rev = "cb871cfa1ee460b51eb1d144b175b9aab9c50aba"
+features = ["async"]
 
 [dev-dependencies]
 toml = "0.5"
diff --git a/crates/config/src/host_component.rs b/crates/config/src/host_component.rs
index 20e7528bc6..6d98ea1d8c 100644
--- a/crates/config/src/host_component.rs
+++ b/crates/config/src/host_component.rs
@@ -1,40 +1,82 @@
-use std::sync::Arc;
+use std::sync::{Arc, Mutex};
 
-use crate::{Error, Key, Resolver, TreePath};
+use async_trait::async_trait;
+use once_cell::sync::OnceCell;
+use spin_app::{AppComponent, DynamicHostComponent};
+use spin_core::HostComponent;
 
-mod wit {
-    wit_bindgen_wasmtime::export!("../../wit/ephemeral/spin-config.wit");
+use crate::{Error, Key, Provider, Resolver};
+
+wit_bindgen_wasmtime::export!({paths: ["../../wit/ephemeral/spin-config.wit"], async: *});
+
+pub struct ConfigHostComponent {
+    providers: Mutex<Vec<Box<dyn Provider>>>,
+    resolver: Arc<OnceCell<Resolver>>,
 }
-pub use wit::spin_config::add_to_linker;
 
-/// A component configuration interface implementation.
-pub struct ComponentConfig {
-    component_root: TreePath,
-    resolver: Arc<Resolver>,
+impl ConfigHostComponent {
+    pub fn new(providers: Vec<Box<dyn Provider>>) -> Self {
+        Self {
+            providers: Mutex::new(providers),
+            resolver: Default::default(),
+        }
+    }
 }
 
-impl ComponentConfig {
-    pub fn new(component_id: impl Into<String>, resolver: Arc<Resolver>) -> crate::Result<Self> {
-        let component_root = TreePath::new(component_id).or_else(|_| {
-            // Temporary mitigation for https://github.com/fermyon/spin/issues/337
-            TreePath::new("invalid.path.issue_337")
+impl HostComponent for ConfigHostComponent {
+    type Data = ComponentConfig;
+
+    fn add_to_linker<T: Send>(
+        linker: &mut spin_core::Linker<T>,
+        get: impl Fn(&mut spin_core::Data<T>) -> &mut Self::Data + Send + Sync + Copy + 'static,
+    ) -> anyhow::Result<()> {
+        spin_config::add_to_linker(linker, get)
+    }
+
+    fn build_data(&self) -> Self::Data {
+        ComponentConfig {
+            resolver: self.resolver.clone(),
+            component_id: None,
+        }
+    }
+}
+
+impl DynamicHostComponent for ConfigHostComponent {
+    fn update_data(&self, data: &mut Self::Data, component: &AppComponent) -> anyhow::Result<()> {
+        self.resolver.get_or_try_init(|| {
+            let mut resolver = Resolver::new(component.app)?;
+            for provider in self.providers.lock().unwrap().drain(..) {
+                resolver.add_provider(provider);
+            }
+            Ok::<_, anyhow::Error>(resolver)
         })?;
-        Ok(Self {
-            component_root,
-            resolver,
-        })
+        data.component_id = Some(component.id().to_string());
+        Ok(())
     }
 }
 
-impl wit::spin_config::SpinConfig for ComponentConfig {
-    fn get_config(&mut self, key: &str) -> Result<String, wit::spin_config::Error> {
+/// A component configuration interface implementation.
+pub struct ComponentConfig {
+    resolver: Arc<OnceCell<Resolver>>,
+    component_id: Option<String>,
+}
+
+#[async_trait]
+impl spin_config::SpinConfig for ComponentConfig {
+    async fn get_config(&mut self, key: &str) -> Result<String, spin_config::Error> {
+        // Set by DynamicHostComponent::update_data
+        let component_id = self.component_id.as_deref().unwrap();
         let key = Key::new(key)?;
-        let path = &self.component_root + key;
-        Ok(self.resolver.resolve(&path)?)
+        Ok(self
+            .resolver
+            .get()
+            .unwrap()
+            .resolve(component_id, key)
+            .await?)
     }
 }
 
-impl From<Error> for wit::spin_config::Error {
+impl From<Error> for spin_config::Error {
     fn from(err: Error) -> Self {
         match err {
             Error::InvalidKey(msg) => Self::InvalidKey(msg),
diff --git a/crates/config/src/lib.rs b/crates/config/src/lib.rs
index 3df750684a..4fc1a4f1c9 100644
--- a/crates/config/src/lib.rs
+++ b/crates/config/src/lib.rs
@@ -1,14 +1,15 @@
-pub mod host_component;
+mod host_component;
 pub mod provider;
 
 mod template;
-mod tree;
 
-use std::fmt::Debug;
+use std::{borrow::Cow, collections::HashMap, fmt::Debug};
 
-pub use provider::Provider;
-pub use tree::{Tree, TreePath};
+use anyhow::{anyhow, Context};
+use spin_app::{App, Variable};
 
+pub use host_component::ConfigHostComponent;
+pub use provider::Provider;
 use template::{Part, Template};
 
 /// A config resolution error.
@@ -44,81 +45,102 @@ type Result<T> = std::result::Result<T, Error>;
 /// A configuration resolver.
 #[derive(Debug, Default)]
 pub struct Resolver {
-    tree: Tree,
+    variables: HashMap<String, Variable>,
+    // component_id -> key -> template
+    component_configs: HashMap<String, HashMap<String, Template>>,
     providers: Vec<Box<dyn Provider>>,
 }
 
 impl Resolver {
     /// Creates a Resolver for the given Tree.
-    pub fn new(tree: Tree) -> Result<Self> {
+    pub fn new(app: &App) -> anyhow::Result<Self> {
+        let variables = app
+            .variables()
+            .map(|(key, var)| (key.clone(), var.clone()))
+            .collect();
+
+        let mut component_configs = HashMap::new();
+        for component in app.components() {
+            let templates: &mut HashMap<_, _> = component_configs
+                .entry(component.id().to_string())
+                .or_default();
+            for (key, val) in component.config() {
+                Key::validate(key).with_context(|| {
+                    format!(
+                        "invalid config key {:?} for component {:?}",
+                        key,
+                        component.id()
+                    )
+                })?;
+                let template = Template::new(val.as_str()).with_context(|| {
+                    format!(
+                        "invalid config value for {:?} for component {:?}",
+                        key,
+                        component.id()
+                    )
+                })?;
+                templates.insert(key.clone(), template);
+            }
+        }
+
         Ok(Self {
-            tree,
-            providers: vec![],
+            variables,
+            component_configs,
+            providers: Default::default(),
         })
     }
 
     /// Adds a config Provider to the Resolver.
-    pub fn add_provider(&mut self, provider: impl Provider + 'static) {
-        self.providers.push(Box::new(provider));
+    pub fn add_provider(&mut self, provider: impl Into<Box<dyn Provider>>) {
+        self.providers.push(provider.into());
     }
 
-    /// Resolves a config value for the given path.
-    pub fn resolve(&self, path: &TreePath) -> Result<String> {
-        self.resolve_path(path, 0)
-    }
+    /// Resolve a config value for the given component and key.
+    pub async fn resolve(&self, component_id: &str, key: Key<'_>) -> Result<String> {
+        let component_config = self.component_configs.get(component_id).ok_or_else(|| {
+            Error::UnknownPath(format!("no config for component {component_id:?}"))
+        })?;
 
-    // Simple protection against infinite recursion
-    const RECURSION_LIMIT: usize = 100;
+        let template = component_config
+            .get(key.as_ref())
+            .ok_or_else(|| Error::UnknownPath(format!("no config for {component_id:?}.{key:?}")))?;
 
-    // TODO(lann): make this non-recursive and/or "flatten" templates
-    fn resolve_path(&self, path: &TreePath, depth: usize) -> Result<String> {
-        let depth = depth + 1;
-        if depth > Self::RECURSION_LIMIT {
-            return Err(Error::InvalidTemplate(format!(
-                "hit recursion limit at path: {}",
-                path
-            )));
+        self.resolve_template(template).await.map_err(|err| {
+            Error::InvalidTemplate(format!(
+                "failed to resolve template for {component_id:?}.{key:?}: {err:?}"
+            ))
+        })
+    }
+
+    async fn resolve_template(&self, template: &Template) -> Result<String> {
+        let mut resolved: Vec<Cow<str>> = Vec::with_capacity(template.parts().len());
+        for part in template.parts() {
+            resolved.push(match part {
+                Part::Lit(lit) => lit.as_ref().into(),
+                Part::Expr(expr) => self.resolve_expr(expr).await?,
+            });
         }
-        let slot = self.tree.get(path)?;
-        // If we're resolving top-level config we are ready to query provider(s).
-        if path.size() == 1 {
-            let key = path.keys().next().unwrap();
-            for provider in &self.providers {
-                if let Some(value) = provider.get(&key).map_err(Error::Provider)? {
-                    return Ok(value);
-                }
+        Ok(resolved.concat())
+    }
+
+    async fn resolve_expr(&self, expr: &str) -> Result<Cow<str>> {
+        let var = self
+            .variables
+            .get(expr)
+            .ok_or_else(|| Error::UnknownPath(format!("no variable named {expr:?}")))?;
+
+        for provider in &self.providers {
+            if let Some(value) = provider.get(&Key(expr)).await.map_err(Error::Provider)? {
+                return Ok(value.into());
             }
         }
-        // Resolve default template
-        if let Some(template) = &slot.default {
-            self.resolve_template(path, template, depth)
-        } else {
-            Err(Error::InvalidPath(format!(
-                "missing value at required path: {}",
-                path
-            )))
-        }
-    }
 
-    fn resolve_template(
-        &self,
-        path: &TreePath,
-        template: &Template,
-        depth: usize,
-    ) -> Result<String> {
-        template.parts().try_fold(String::new(), |value, part| {
-            Ok(match part {
-                Part::Lit(lit) => value + lit,
-                Part::Expr(expr) => {
-                    let expr_path = if expr.starts_with('.') {
-                        path.resolve_relative(expr)?
-                    } else {
-                        TreePath::new(expr.to_string())?
-                    };
-                    value + &self.resolve_path(&expr_path, depth)?
-                }
-            })
-        })
+        match var.default {
+            Some(ref default) => Ok(default.into()),
+            None => Err(Error::Provider(anyhow!(
+                "no provider resolved variable {expr:?}"
+            ))),
+        }
     }
 }
 
@@ -168,81 +190,8 @@ impl<'a> AsRef<str> for Key<'a> {
 
 #[cfg(test)]
 mod tests {
-    use std::collections::HashMap;
-
-    use toml::toml;
-
     use super::*;
 
-    #[test]
-    fn resolver_resolve_defaults() {
-        let mut tree: Tree = toml! {
-            top_level = { default = "top" }
-            top_ref = { default = "{{ top_level }}+{{ top_level }}" }
-            top_required = { required = true }
-        }
-        .try_into()
-        .unwrap();
-        tree.merge_defaults(
-            &TreePath::new("child").unwrap(),
-            toml! {
-                subtree_key = "sub"
-                top_ref = "{{ top_level }}"
-                recurse_ref = "{{ top_ref }}"
-                own_ref = "{{ .subtree_key }}"
-            }
-            .try_into::<HashMap<String, String>>()
-            .unwrap(),
-        )
-        .unwrap();
-        tree.merge_defaults(
-            &TreePath::new("child.grandchild").unwrap(),
-            toml! {
-                top_ref = "{{ top_level }}"
-                parent_ref = "{{ ..subtree_key }}"
-                mixed_ref = "{{ top_level }}/{{ ..recurse_ref }}"
-            }
-            .try_into::<HashMap<String, String>>()
-            .unwrap(),
-        )
-        .unwrap();
-
-        let resolver = Resolver::new(tree).unwrap();
-        for (path, expected) in [
-            ("top_level", "top"),
-            ("top_ref", "top+top"),
-            ("child.subtree_key", "sub"),
-            ("child.top_ref", "top"),
-            ("child.recurse_ref", "top+top"),
-            ("child.own_ref", "sub"),
-            ("child.grandchild.top_ref", "top"),
-            ("child.grandchild.parent_ref", "sub"),
-            ("child.grandchild.mixed_ref", "top/top+top"),
-        ] {
-            let path = TreePath::new(path).unwrap();
-            let value = resolver.resolve(&path).unwrap();
-            assert_eq!(value, expected, "mismatch at {:?}", path);
-        }
-    }
-
-    #[test]
-    fn resolver_recursion_limit() {
-        let resolver = Resolver::new(
-            toml! {
-                x = { default = "{{y}}" }
-                y = { default = "{{x}}" }
-            }
-            .try_into()
-            .unwrap(),
-        )
-        .unwrap();
-        let path = "x".to_string().try_into().unwrap();
-        assert!(matches!(
-            resolver.resolve(&path),
-            Err(Error::InvalidTemplate(_))
-        ));
-    }
-
     #[test]
     fn keys_good() {
         for key in ["a", "abc", "a1b2c3", "a_1", "a_1_b_3"] {
diff --git a/crates/config/src/provider.rs b/crates/config/src/provider.rs
index b4a0c50777..9f3799937a 100644
--- a/crates/config/src/provider.rs
+++ b/crates/config/src/provider.rs
@@ -1,12 +1,15 @@
 use std::fmt::Debug;
 
+use async_trait::async_trait;
+
 use crate::Key;
 
 /// Environment variable based provider.
 pub mod env;
 
 /// A config provider.
+#[async_trait]
 pub trait Provider: Debug + Send + Sync {
     /// Returns the value at the given config path, if it exists.
-    fn get(&self, key: &Key) -> anyhow::Result<Option<String>>;
+    async fn get(&self, key: &Key) -> anyhow::Result<Option<String>>;
 }
diff --git a/crates/config/src/provider/env.rs b/crates/config/src/provider/env.rs
index b4dff88b13..354fa84fc5 100644
--- a/crates/config/src/provider/env.rs
+++ b/crates/config/src/provider/env.rs
@@ -1,57 +1,73 @@
-use std::collections::HashMap;
+use std::{collections::HashMap, path::PathBuf, sync::Mutex};
 
-use anyhow::Context;
+use anyhow::{Context, Result};
+use async_trait::async_trait;
 
 use crate::{Key, Provider};
 
-pub const DEFAULT_PREFIX: &str = "SPIN_APP";
-
 /// A config Provider that uses environment variables.
 #[derive(Debug)]
 pub struct EnvProvider {
     prefix: String,
-    envs: HashMap<String, String>,
+    dotenv_path: Option<PathBuf>,
+    dotenv_cache: Mutex<Option<HashMap<String, String>>>,
 }
 
 impl EnvProvider {
     /// Creates a new EnvProvider.
-    pub fn new(prefix: impl Into<String>, envs: HashMap<String, String>) -> Self {
+    pub fn new(prefix: impl Into<String>, dotenv_path: Option<PathBuf>) -> Self {
         Self {
             prefix: prefix.into(),
-            envs,
+            dotenv_path,
+            dotenv_cache: Default::default(),
         }
     }
-}
-
-impl Default for EnvProvider {
-    fn default() -> Self {
-        Self {
-            prefix: DEFAULT_PREFIX.to_string(),
-            envs: HashMap::new(),
-        }
-    }
-}
 
-impl Provider for EnvProvider {
-    fn get(&self, key: &Key) -> anyhow::Result<Option<String>> {
+    fn get_sync(&self, key: &Key) -> Result<Option<String>> {
         let env_key = format!("{}_{}", &self.prefix, key.as_ref().to_ascii_uppercase());
         match std::env::var(&env_key) {
-            Err(std::env::VarError::NotPresent) => {
-                if let Some(value) = self.envs.get(&env_key) {
-                    return Ok(Some(value.to_string()));
-                }
-
-                Ok(None)
-            }
+            Err(std::env::VarError::NotPresent) => self.get_dotenv(&env_key),
             other => other
                 .map(Some)
                 .with_context(|| format!("failed to resolve env var {}", &env_key)),
         }
     }
+
+    fn get_dotenv(&self, key: &str) -> Result<Option<String>> {
+        if self.dotenv_path.is_none() {
+            return Ok(None);
+        }
+        let mut maybe_cache = self
+            .dotenv_cache
+            .lock()
+            .expect("dotenv_cache lock poisoned");
+        let cache = match maybe_cache.as_mut() {
+            Some(cache) => cache,
+            None => maybe_cache.insert(self.load_dotenv()?),
+        };
+        Ok(cache.get(key).cloned())
+    }
+
+    fn load_dotenv(&self) -> Result<HashMap<String, String>> {
+        let path = self.dotenv_path.as_deref().unwrap();
+        Ok(dotenvy::from_path_iter(path)
+            .into_iter()
+            .flatten()
+            .collect::<Result<HashMap<String, String>, _>>()?)
+    }
+}
+
+#[async_trait]
+impl Provider for EnvProvider {
+    async fn get(&self, key: &Key) -> Result<Option<String>> {
+        tokio::task::block_in_place(|| self.get_sync(key))
+    }
 }
 
 #[cfg(test)]
 mod test {
+    use std::env::temp_dir;
+
     use super::*;
 
     #[test]
@@ -64,20 +80,22 @@ mod test {
             "dotenv_val".to_string(),
         );
         assert_eq!(
-            EnvProvider::new("TESTING_SPIN", envs.clone())
-                .get(&key1)
+            EnvProvider::new("TESTING_SPIN", None)
+                .get_sync(&key1)
                 .unwrap(),
             Some("val".to_string())
         );
+    }
 
-        let key2 = Key::new("env_key2").unwrap();
-        envs.insert(
-            "TESTING_SPIN_ENV_KEY2".to_string(),
-            "dotenv_val".to_string(),
-        );
+    #[test]
+    fn provider_get_dotenv() {
+        let dotenv_path = temp_dir().join("spin-env-provider-test");
+        std::fs::write(&dotenv_path, b"TESTING_SPIN_ENV_KEY2=dotenv_val").unwrap();
+
+        let key = Key::new("env_key2").unwrap();
         assert_eq!(
-            EnvProvider::new("TESTING_SPIN", envs.clone())
-                .get(&key2)
+            EnvProvider::new("TESTING_SPIN", Some(dotenv_path))
+                .get_sync(&key)
                 .unwrap(),
             Some("dotenv_val".to_string())
         );
@@ -86,6 +104,11 @@ mod test {
     #[test]
     fn provider_get_missing() {
         let key = Key::new("please_do_not_ever_set_this_during_tests").unwrap();
-        assert_eq!(EnvProvider::default().get(&key).unwrap(), None);
+        assert_eq!(
+            EnvProvider::new("TESTING_SPIN", Default::default())
+                .get_sync(&key)
+                .unwrap(),
+            None
+        );
     }
 }
diff --git a/crates/config/src/template.rs b/crates/config/src/template.rs
index bc9e9ef0ea..783834bf2d 100644
--- a/crates/config/src/template.rs
+++ b/crates/config/src/template.rs
@@ -40,7 +40,7 @@ impl Template {
         Ok(Template(parts))
     }
 
-    pub(crate) fn parts(&self) -> impl Iterator<Item = &Part> {
+    pub(crate) fn parts(&self) -> std::slice::Iter<Part> {
         self.0.iter()
     }
 }
diff --git a/crates/config/src/tree.rs b/crates/config/src/tree.rs
deleted file mode 100644
index d39019f25b..0000000000
--- a/crates/config/src/tree.rs
+++ /dev/null
@@ -1,312 +0,0 @@
-use std::collections::BTreeMap;
-use std::collections::HashMap;
-
-use serde::Deserialize;
-use serde::Serialize;
-
-use crate::template::Template;
-use crate::{Error, Key, Result};
-
-/// A configuration tree.
-#[derive(Clone, Debug, Default, Deserialize, Serialize)]
-pub struct Tree(BTreeMap<TreePath, Slot>);
-
-impl Tree {
-    pub(crate) fn get(&self, path: &TreePath) -> Result<&Slot> {
-        self.0
-            .get(path)
-            .ok_or_else(|| Error::InvalidPath(format!("no slot at path: {}", path)))
-    }
-
-    pub fn merge(&mut self, base: &TreePath, other: Tree) -> Result<()> {
-        for (subpath, slot) in other.0.into_iter() {
-            self.merge_slot(base + &subpath, slot)?;
-        }
-        Ok(())
-    }
-
-    pub fn merge_defaults(
-        &mut self,
-        base: &TreePath,
-        defaults: impl IntoIterator<Item = (String, String)>,
-    ) -> Result<()> {
-        for (ref key, default) in defaults {
-            let path = base + Key::new(key)?;
-            let slot = Slot::from_default(default)?;
-            self.merge_slot(path, slot)?;
-        }
-        Ok(())
-    }
-
-    fn merge_slot(&mut self, path: TreePath, slot: Slot) -> Result<()> {
-        if self.0.contains_key(&path) {
-            return Err(Error::InvalidPath(format!(
-                "duplicate key at path: {}",
-                path
-            )));
-        }
-        self.0.insert(path, slot);
-        Ok(())
-    }
-}
-
-/// A path into a config tree.
-#[derive(Clone, Debug, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)]
-#[serde(try_from = "String")]
-pub struct TreePath(String);
-
-impl TreePath {
-    /// Creates a ConfigPath from a String.
-    pub fn new(path: impl Into<String>) -> Result<Self> {
-        let path = path.into();
-        if path.is_empty() {
-            return Err(Error::InvalidPath("empty".to_string()));
-        }
-        path.split('.').try_for_each(Key::validate)?;
-        Ok(TreePath(path))
-    }
-
-    /// Returns the number of keys in this Path.
-    pub fn size(&self) -> usize {
-        self.0.matches('.').count() + 1
-    }
-
-    /// Resolves the given relative path (starting with at least one '.').
-    pub fn resolve_relative(&self, rel: &str) -> Result<Self> {
-        if rel.is_empty() {
-            return Err(Error::InvalidPath("rel may not be empty".to_string()));
-        }
-        let key = rel.trim_start_matches('.');
-        let dots = rel.len() - key.len();
-        if dots == 0 {
-            return Err(Error::InvalidPath("rel must start with a '.'".to_string()));
-        }
-        // Remove last `dots` components from path.
-        let path = match self.0.rmatch_indices('.').chain([(0, "")]).nth(dots - 1) {
-            Some((0, _)) => key.to_string(),
-            Some((idx, _)) => format!("{}.{}", &self.0[..idx], key),
-            None => {
-                return Err(Error::InvalidPath(format!(
-                    "rel has too many dots relative to base path {}",
-                    self
-                )))
-            }
-        };
-        Ok(Self(path))
-    }
-
-    /// Produces an iterator over the keys of the path.
-    pub fn keys(&self) -> impl Iterator<Item = Key<'_>> {
-        self.0.split('.').map(Key)
-    }
-}
-
-impl AsRef<str> for TreePath {
-    fn as_ref(&self) -> &str {
-        self.0.as_ref()
-    }
-}
-
-impl std::fmt::Display for TreePath {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        write!(f, "{}", self.as_ref())
-    }
-}
-
-impl std::ops::Add for &TreePath {
-    type Output = TreePath;
-    fn add(self, rhs: &TreePath) -> Self::Output {
-        TreePath(format!("{}.{}", self.0, rhs.0))
-    }
-}
-
-impl std::ops::Add<Key<'_>> for &TreePath {
-    type Output = TreePath;
-    fn add(self, key: Key) -> Self::Output {
-        TreePath(format!("{}.{}", self.0, key.0))
-    }
-}
-
-impl TryFrom<String> for TreePath {
-    type Error = Error;
-    fn try_from(value: String) -> Result<Self> {
-        Self::new(value)
-    }
-}
-
-#[derive(Clone, Default, PartialEq, Deserialize, Serialize)]
-#[serde(into = "RawSlot", try_from = "RawSlot")]
-pub(crate) struct Slot {
-    pub secret: bool,
-    pub default: Option<Template>,
-}
-
-impl Slot {
-    fn from_default(default: impl Into<Box<str>>) -> Result<Self> {
-        Ok(Self {
-            default: Some(Template::new(default)?),
-            ..Default::default()
-        })
-    }
-}
-
-impl TryFrom<RawSlot> for Slot {
-    type Error = Error;
-
-    fn try_from(raw: RawSlot) -> Result<Self> {
-        let default = match raw.default {
-            Some(default) => Some(Template::new(default)?),
-            None if !raw.required => {
-                return Err(Error::InvalidSchema(
-                    "slot must have a default if not required".to_string(),
-                ));
-            }
-            None => None,
-        };
-        Ok(Self {
-            default,
-            secret: raw.secret,
-        })
-    }
-}
-
-impl From<Slot> for RawSlot {
-    fn from(slot: Slot) -> Self {
-        RawSlot {
-            default: slot.default.as_ref().map(|tmpl| tmpl.to_string()),
-            required: slot.default.is_none(),
-            secret: slot.secret,
-        }
-    }
-}
-
-impl std::fmt::Debug for Slot {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        let default = match self.default.as_ref() {
-            Some(_) if self.secret => Some("<SECRET>".to_string()),
-            not_secret => Some(format!("{:?}", not_secret)),
-        };
-        f.debug_struct("Slot")
-            .field("secret", &self.secret)
-            .field("default", &default)
-            .finish()
-    }
-}
-
-#[derive(Debug, Deserialize, PartialEq, Eq)]
-pub struct RawSection(pub HashMap<String, RawSlot>);
-
-#[derive(Debug, Default, PartialEq, Eq, Deserialize, Serialize)]
-#[serde(default)]
-pub struct RawSlot {
-    pub default: Option<String>,
-    pub required: bool,
-    pub secret: bool,
-}
-
-#[cfg(test)]
-mod tests {
-    use toml::toml;
-
-    use super::*;
-
-    #[test]
-    fn paths_good() {
-        for path in ["x", "x.y", "a.b_c.d", "f.a1.x_1"] {
-            TreePath::new(path).expect(path);
-        }
-    }
-
-    #[test]
-    fn paths_bad() {
-        for path in ["", "_x", "a._x", "a..b"] {
-            TreePath::new(path).expect_err(path);
-        }
-    }
-
-    #[test]
-    fn path_keys() {
-        assert_eq!(
-            TreePath::new("a").unwrap().keys().collect::<Vec<_>>(),
-            &[Key("a")]
-        );
-        assert_eq!(
-            TreePath::new("a.b_c.d").unwrap().keys().collect::<Vec<_>>(),
-            &[Key("a"), Key("b_c"), Key("d")]
-        );
-    }
-
-    #[test]
-    fn path_resolve_relative() {
-        let path = TreePath::new("a.b.c").unwrap();
-        for (rel, expected) in [(".x", "a.b.x"), ("..x", "a.x"), ("...x", "x")] {
-            assert_eq!(path.resolve_relative(rel).unwrap().as_ref(), expected);
-        }
-    }
-
-    #[test]
-    fn path_resolve_relative_bad() {
-        let path = TreePath::new("a.b.c").unwrap();
-        for rel in ["", "x", "....x"] {
-            path.resolve_relative(rel).expect_err(rel);
-        }
-    }
-
-    #[test]
-    fn path_display() {
-        let path = TreePath::new("a.b.c").unwrap();
-        assert_eq!(format!("{}", path), "a.b.c");
-    }
-
-    #[test]
-    fn slot_debug_secret() {
-        let mut slot = Slot {
-            default: Some(Template::new("sesame").unwrap()),
-            ..Default::default()
-        };
-        assert!(format!("{:?}", slot).contains("sesame"));
-
-        slot.secret = true;
-        assert!(!format!("{:?}", slot).contains("sesame"));
-        assert!(format!("{:?}", slot).contains("<SECRET>"));
-    }
-
-    #[test]
-    fn tree_from_toml() {
-        let tree: Tree = toml! {
-            required_key = { required = true }
-            secret_default = { default = "TOP-SECRET", secret = true }
-        }
-        .try_into()
-        .unwrap();
-
-        for (key, expected_slot) in [
-            (
-                "required_key",
-                Slot {
-                    default: None,
-                    ..Default::default()
-                },
-            ),
-            (
-                "secret_default",
-                Slot {
-                    default: Some(Template::new("TOP-SECRET").unwrap()),
-                    secret: true,
-                },
-            ),
-        ] {
-            let path = TreePath::new(key).expect(key);
-            assert_eq!(tree.get(&path).expect(key), &expected_slot);
-        }
-    }
-
-    #[test]
-    fn invalid_slot() {
-        toml! {
-            not_required_or_default = { secret = true }
-        }
-        .try_into::<Tree>()
-        .expect_err("should fail");
-    }
-}
diff --git a/crates/core/Cargo.toml b/crates/core/Cargo.toml
new file mode 100644
index 0000000000..d9308e39f3
--- /dev/null
+++ b/crates/core/Cargo.toml
@@ -0,0 +1,13 @@
+[package]
+name = "spin-core"
+version = "0.1.0"
+edition = "2021"
+
+[dependencies]
+anyhow = "1.0"
+tracing = "0.1"
+async-trait = "0.1"
+wasi-cap-std-sync = "0.39"
+wasi-common = "0.39"
+wasmtime = "0.39"
+wasmtime-wasi = { version = "0.39", features = ["tokio"] }
\ No newline at end of file
diff --git a/crates/core/src/host_component.rs b/crates/core/src/host_component.rs
new file mode 100644
index 0000000000..6443e290ae
--- /dev/null
+++ b/crates/core/src/host_component.rs
@@ -0,0 +1,129 @@
+use std::{any::Any, marker::PhantomData, sync::Arc};
+
+use anyhow::Result;
+
+use super::{Data, Linker};
+
+pub trait HostComponent: Send + Sync + 'static {
+    /// Host component runtime data.
+    type Data: Send + Sized + 'static;
+
+    /// Add this component to the given Linker, using the given runtime state-getting handle.
+    // This function signature mirrors those generated by wit-bindgen.
+    fn add_to_linker<T: Send>(
+        linker: &mut Linker<T>,
+        get: impl Fn(&mut Data<T>) -> &mut Self::Data + Send + Sync + Copy + 'static,
+    ) -> Result<()>;
+
+    fn build_data(&self) -> Self::Data;
+}
+
+impl<HC: HostComponent> HostComponent for Arc<HC> {
+    type Data = HC::Data;
+
+    fn add_to_linker<T: Send>(
+        linker: &mut Linker<T>,
+        get: impl Fn(&mut Data<T>) -> &mut Self::Data + Send + Sync + Copy + 'static,
+    ) -> Result<()> {
+        HC::add_to_linker(linker, get)
+    }
+
+    fn build_data(&self) -> Self::Data {
+        (**self).build_data()
+    }
+}
+
+pub struct HostComponentDataHandle<HC: HostComponent> {
+    idx: usize,
+    _phantom: PhantomData<fn() -> HC::Data>,
+}
+
+impl<HC: HostComponent> Copy for HostComponentDataHandle<HC> {}
+
+impl<HC: HostComponent> Clone for HostComponentDataHandle<HC> {
+    fn clone(&self) -> Self {
+        Self {
+            idx: self.idx,
+            _phantom: PhantomData,
+        }
+    }
+}
+
+type DataBuilder = Box<dyn Fn() -> Box<dyn Any + Send> + Send + Sync>;
+
+pub struct HostComponentsBuilder {
+    data_builders: Vec<DataBuilder>,
+}
+
+impl HostComponentsBuilder {
+    pub fn add_host_component<T: Send, HC: HostComponent + 'static>(
+        &mut self,
+        linker: &mut Linker<T>,
+        host_component: HC,
+    ) -> Result<HostComponentDataHandle<HC>> {
+        let idx = self.data_builders.len();
+        self.data_builders
+            .push(Box::new(move || Box::new(host_component.build_data())));
+        HC::add_to_linker(linker, move |data| {
+            data.host_components_data
+                .get_or_insert_idx(idx)
+                .downcast_mut()
+                .unwrap()
+        })?;
+        Ok(HostComponentDataHandle::<HC> {
+            idx,
+            _phantom: PhantomData,
+        })
+    }
+
+    pub fn build(self) -> HostComponents {
+        let data_builders = Arc::new(self.data_builders);
+        HostComponents { data_builders }
+    }
+}
+
+pub struct HostComponents {
+    data_builders: Arc<Vec<DataBuilder>>,
+}
+
+impl HostComponents {
+    pub fn builder() -> HostComponentsBuilder {
+        HostComponentsBuilder {
+            data_builders: Default::default(),
+        }
+    }
+
+    pub fn new_data(&self) -> HostComponentsData {
+        // Fill with `None`
+        let data = std::iter::repeat_with(Default::default)
+            .take(self.data_builders.len())
+            .collect();
+        HostComponentsData {
+            data,
+            data_builders: self.data_builders.clone(),
+        }
+    }
+}
+
+pub struct HostComponentsData {
+    data: Vec<Option<Box<dyn Any + Send>>>,
+    data_builders: Arc<Vec<DataBuilder>>,
+}
+
+impl HostComponentsData {
+    pub fn get_or_insert<HC: HostComponent>(
+        &mut self,
+        handle: HostComponentDataHandle<HC>,
+    ) -> &mut HC::Data {
+        let x = self.get_or_insert_idx(handle.idx);
+        x.downcast_mut().unwrap()
+    }
+
+    fn get_or_insert_idx(&mut self, idx: usize) -> &mut Box<dyn Any + Send> {
+        self.data[idx].get_or_insert_with(|| self.data_builders[idx]())
+    }
+
+    pub fn set<HC: HostComponent>(&mut self, handle: HostComponentDataHandle<HC>, data: HC::Data) {
+        self.data[handle.idx] = Some(Box::new(data));
+    }
+}
diff --git a/crates/core/src/io.rs b/crates/core/src/io.rs
new file mode 100644
index 0000000000..bf0e6a667c
--- /dev/null
+++ b/crates/core/src/io.rs
@@ -0,0 +1,16 @@
+use std::sync::{Arc, RwLock};
+
+use wasi_common::pipe::WritePipe;
+
+#[derive(Default)]
+pub struct OutputBuffer(Arc<RwLock<Vec<u8>>>);
+
+impl OutputBuffer {
+    pub fn take(&mut self) -> Vec<u8> {
+        std::mem::take(&mut *self.0.write().unwrap())
+    }
+
+    pub(crate) fn writer(&self) -> WritePipe<Vec<u8>> {
+        WritePipe::from_shared(self.0.clone())
+    }
+}
diff --git a/crates/core/src/lib.rs b/crates/core/src/lib.rs
new file mode 100644
index 0000000000..274638b28e
--- /dev/null
+++ b/crates/core/src/lib.rs
@@ -0,0 +1,173 @@
+mod host_component;
+mod io;
+mod limits;
+mod store;
+
+use std::sync::{Arc, Mutex};
+
+use anyhow::Result;
+use tracing::instrument;
+use wasmtime_wasi::WasiCtx;
+
+pub use wasmtime::{self, Instance, Module};
+
+use self::host_component::{HostComponents, HostComponentsBuilder};
+
+pub use host_component::{HostComponent, HostComponentDataHandle, HostComponentsData};
+pub use store::{Store, StoreBuilder};
+
+pub struct Config {
+    inner: wasmtime::Config,
+}
+
+impl Config {
+    /// Borrow the inner wasmtime::Config mutably.
+    /// WARNING: This is inherently unstable and may break at any time!
+    #[doc(hidden)]
+    pub fn wasmtime_config(&mut self) -> &mut wasmtime::Config {
+        &mut self.inner
+    }
+}
+
+impl Default for Config {
+    fn default() -> Self {
+        let mut inner = wasmtime::Config::new();
+        inner.async_support(true);
+        Self { inner }
+    }
+}
+
+pub struct Data<T> {
+    inner: T,
+    wasi: WasiCtx,
+    host_components_data: HostComponentsData,
+    store_limits: limits::StoreLimitsAsync,
+}
+
+impl<T> AsRef<T> for Data<T> {
+    fn as_ref(&self) -> &T {
+        &self.inner
+    }
+}
+
+impl<T> AsMut<T> for Data<T> {
+    fn as_mut(&mut self) -> &mut T {
+        &mut self.inner
+    }
+}
+
+pub type Linker<T> = wasmtime::Linker<Data<T>>;
+
+pub struct EngineBuilder<T> {
+    engine: wasmtime::Engine,
+    linker: Linker<T>,
+    host_components_builder: HostComponentsBuilder,
+}
+
+impl<T: Send + Sync> EngineBuilder<T> {
+    fn new(config: &Config) -> Result<Self> {
+        let engine = wasmtime::Engine::new(&config.inner)?;
+
+        let mut linker: Linker<T> = Linker::new(&engine);
+        wasmtime_wasi::tokio::add_to_linker(&mut linker, |data| &mut data.wasi)?;
+
+        Ok(Self {
+            engine,
+            linker,
+            host_components_builder: HostComponents::builder(),
+        })
+    }
+
+    pub fn link_import(
+        &mut self,
+        f: impl FnOnce(&mut Linker<T>, fn(&mut Data<T>) -> &mut T) -> Result<()>,
+    ) -> Result<()> {
+        f(&mut self.linker, Data::as_mut)
+    }
+
+    pub fn add_host_component<HC: HostComponent + Send + Sync + 'static>(
+        &mut self,
+        host_component: HC,
+    ) -> Result<HostComponentDataHandle<HC>> {
+        self.host_components_builder
+            .add_host_component(&mut self.linker, host_component)
+    }
+
+    pub fn build_with_data(self, instance_pre_data: T) -> Engine<T> {
+        let host_components = self.host_components_builder.build();
+
+        let instance_pre_store = Arc::new(Mutex::new(
+            StoreBuilder::new(self.engine.clone(), &host_components)
+                .build_with_data(instance_pre_data)
+                .expect("instance_pre_store build should not fail"),
+        ));
+
+        Engine {
+            inner: self.engine,
+            linker: self.linker,
+            host_components,
+            instance_pre_store,
+        }
+    }
+}
+
+impl<T: Default + Send + Sync> EngineBuilder<T> {
+    pub fn build(self) -> Engine<T> {
+        self.build_with_data(T::default())
+    }
+}
+
+pub struct Engine<T> {
+    inner: wasmtime::Engine,
+    linker: Linker<T>,
+    host_components: HostComponents,
+    instance_pre_store: Arc<Mutex<Store<T>>>,
+}
+
+impl<T: Send + Sync> Engine<T> {
+    pub fn builder(config: &Config) -> Result<EngineBuilder<T>> {
+        EngineBuilder::new(config)
+    }
+
+    pub fn store_builder(&self) -> StoreBuilder {
+        StoreBuilder::new(self.inner.clone(), &self.host_components)
+    }
+
+    #[instrument(skip_all)]
+    pub fn instantiate_pre(&self, module: &Module) -> Result<InstancePre<T>> {
+        let mut store = self.instance_pre_store.lock().unwrap();
+        let inner = self.linker.instantiate_pre(&mut *store, module)?;
+        Ok(InstancePre { inner })
+    }
+}
+
+impl<T> AsRef<wasmtime::Engine> for Engine<T> {
+    fn as_ref(&self) -> &wasmtime::Engine {
+        &self.inner
+    }
+}
+
+pub struct InstancePre<T> {
+    inner: wasmtime::InstancePre<Data<T>>,
+}
+
+impl<T: Send + Sync> InstancePre<T> {
+    #[instrument(skip_all)]
+    pub async fn instantiate_async(&self, store: &mut Store<T>) -> Result<Instance> {
+        self.inner.instantiate_async(store).await
+    }
+}
+
+impl<T> Clone for InstancePre<T> {
+    fn clone(&self) -> Self {
+        Self {
+            inner: self.inner.clone(),
+        }
+    }
+}
+
+impl<T> AsRef<wasmtime::InstancePre<Data<T>>> for InstancePre<T> {
+    fn as_ref(&self) -> &wasmtime::InstancePre<Data<T>> {
+        &self.inner
+    }
+}
diff --git a/crates/core/src/limits.rs b/crates/core/src/limits.rs
new file mode 100644
index 0000000000..28701a5e8d
--- /dev/null
+++ b/crates/core/src/limits.rs
@@ -0,0 +1,35 @@
+use async_trait::async_trait;
+use wasmtime::ResourceLimiterAsync;
+
+/// Async implementation of wasmtime's `StoreLimits`: https://github.com/bytecodealliance/wasmtime/blob/main/crates/wasmtime/src/limits.rs
+/// Used to limit the memory use and table size of each Instance
+#[derive(Default)]
+pub struct StoreLimitsAsync {
+    max_memory_size: Option<usize>,
+    max_table_elements: Option<u32>,
+}
+
+#[async_trait]
+impl ResourceLimiterAsync for StoreLimitsAsync {
+    async fn memory_growing(
+        &mut self,
+        _current: usize,
+        desired: usize,
+        _maximum: Option<usize>,
+    ) -> bool {
+        !matches!(self.max_memory_size, Some(limit) if desired > limit)
+    }
+
+    async fn table_growing(&mut self, _current: u32, desired: u32, _maximum: Option<u32>) -> bool {
+        !matches!(self.max_table_elements, Some(limit) if desired > limit)
+    }
+}
+
+impl StoreLimitsAsync {
+    pub fn new(max_memory_size: Option<usize>, max_table_elements: Option<u32>) -> Self {
+        Self {
+            max_memory_size,
+            max_table_elements,
+        }
+    }
+}
diff --git a/crates/core/src/store.rs b/crates/core/src/store.rs
new file mode 100644
index 0000000000..9d87a39df1
--- /dev/null
+++ b/crates/core/src/store.rs
@@ -0,0 +1,234 @@
+use anyhow::{anyhow, Result};
+use std::{
+    io::{Read, Write},
+    path::{Path, PathBuf},
+};
+use wasi_cap_std_sync::{ambient_authority, Dir};
+use wasi_common::{dir::DirCaps, pipe::WritePipe, WasiFile};
+use wasi_common::{file::FileCaps, pipe::ReadPipe};
+use wasmtime_wasi::tokio::WasiCtxBuilder;
+
+use crate::io::OutputBuffer;
+
+use super::{
+    host_component::{HostComponents, HostComponentsData},
+    limits::StoreLimitsAsync,
+    Data,
+};
+
+pub struct Store<T> {
+    inner: wasmtime::Store<Data<T>>,
+}
+
+impl<T> Store<T> {
+    pub fn host_components_data(&mut self) -> &mut HostComponentsData {
+        &mut self.inner.data_mut().host_components_data
+    }
+}
+
+impl<T> AsRef<wasmtime::Store<Data<T>>> for Store<T> {
+    fn as_ref(&self) -> &wasmtime::Store<Data<T>> {
+        &self.inner
+    }
+}
+
+impl<T> AsMut<wasmtime::Store<Data<T>>> for Store<T> {
+    fn as_mut(&mut self) -> &mut wasmtime::Store<Data<T>> {
+        &mut self.inner
+    }
+}
+
+impl<T> wasmtime::AsContext for Store<T> {
+    type Data = Data<T>;
+
+    fn as_context(&self) -> wasmtime::StoreContext<'_, Self::Data> {
+        self.inner.as_context()
+    }
+}
+
+impl<T> wasmtime::AsContextMut for Store<T> {
+    fn as_context_mut(&mut self) -> wasmtime::StoreContextMut<'_, Self::Data> {
+        self.inner.as_context_mut()
+    }
+}
+
+// WASI expects preopened dirs in FDs starting at 3 (0-2 are stdio).
+const WASI_FIRST_PREOPENED_DIR_FD: u32 = 3;
+
+const READ_ONLY_DIR_CAPS: DirCaps = DirCaps::from_bits_truncate(
+    DirCaps::OPEN.bits()
+        | DirCaps::READDIR.bits()
+        | DirCaps::READLINK.bits()
+        | DirCaps::PATH_FILESTAT_GET.bits()
+        | DirCaps::FILESTAT_GET.bits(),
+);
+const READ_ONLY_FILE_CAPS: FileCaps = FileCaps::from_bits_truncate(
+    FileCaps::READ.bits()
+        | FileCaps::SEEK.bits()
+        | FileCaps::TELL.bits()
+        | FileCaps::FILESTAT_GET.bits()
+        | FileCaps::POLL_READWRITE.bits(),
+);
+
+pub struct StoreBuilder {
+    engine: wasmtime::Engine,
+    wasi: std::result::Result<Option<WasiCtxBuilder>, String>,
+    read_only_preopened_dirs: Vec<(Dir, PathBuf)>,
+    host_components_data: HostComponentsData,
+    store_limits: StoreLimitsAsync,
+}
+
+impl StoreBuilder {
+    pub(crate) fn new(engine: wasmtime::Engine, host_components: &HostComponents) -> Self {
+        Self {
+            engine,
+            wasi: Ok(Some(WasiCtxBuilder::new())),
+            read_only_preopened_dirs: Vec::new(),
+            host_components_data: host_components.new_data(),
+            store_limits: StoreLimitsAsync::default(),
+        }
+    }
+
+    pub fn max_memory_size(&mut self, max_memory_size: usize) {
+        self.store_limits = StoreLimitsAsync::new(Some(max_memory_size), None);
+    }
+
+    pub fn inherit_stdio(&mut self) {
+        self.with_wasi(|wasi| wasi.inherit_stdio());
+    }
+
+    pub fn stdin(&mut self, file: impl WasiFile + 'static) {
+        self.with_wasi(|wasi| wasi.stdin(Box::new(file)))
+    }
+
+    pub fn stdin_pipe(&mut self, r: impl Read + Send + Sync + 'static) {
+        self.stdin(ReadPipe::new(r))
+    }
+
+    pub fn stdout(&mut self, file: impl WasiFile + 'static) {
+        self.with_wasi(|wasi| wasi.stdout(Box::new(file)))
+    }
+
+    pub fn stdout_pipe(&mut self, w: impl Write + Send + Sync + 'static) {
+        self.stdout(WritePipe::new(w))
+    }
+
+    pub fn stdout_buffered(&mut self) -> OutputBuffer {
+        let buffer = OutputBuffer::default();
+        self.stdout(buffer.writer());
+        buffer
+    }
+
+    pub fn stderr(&mut self, file: impl WasiFile + 'static) {
+        self.with_wasi(|wasi| wasi.stderr(Box::new(file)))
+    }
+
+    pub fn stderr_pipe(&mut self, w: impl Write + Send + Sync + 'static) {
+        self.stderr(WritePipe::new(w))
+    }
+
+    pub fn stderr_buffered(&mut self) -> OutputBuffer {
+        let buffer = OutputBuffer::default();
+        self.stderr(buffer.writer());
+        buffer
+    }
+
+    pub fn args<'b>(&mut self, args: impl IntoIterator<Item = &'b str>) -> Result<()> {
+        self.try_with_wasi(|mut wasi| {
+            for arg in args {
+                wasi = wasi.arg(arg)?;
+            }
+            Ok(wasi)
+        })
+    }
+
+    pub fn env(
+        &mut self,
+        vars: impl IntoIterator<Item = (impl AsRef<str>, impl AsRef<str>)>,
+    ) -> Result<()> {
+        self.try_with_wasi(|mut wasi| {
+            for (k, v) in vars {
+                wasi = wasi.env(k.as_ref(), v.as_ref())?;
+            }
+            Ok(wasi)
+        })
+    }
+
+    pub fn read_only_preopened_dir(
+        &mut self,
+        host_path: impl AsRef<Path>,
+        guest_path: PathBuf,
+    ) -> Result<()> {
+        // WasiCtxBuilder::preopened_dir doesn't let you set capabilities, so we need
+        // to wait and call WasiCtx::insert_dir after building the WasiCtx.
+        let dir = wasmtime_wasi::Dir::open_ambient_dir(host_path, ambient_authority())?;
+        self.read_only_preopened_dirs.push((dir, guest_path));
+        Ok(())
+    }
+
+    pub fn read_write_preopened_dir(
+        &mut self,
+        host_path: impl AsRef<Path>,
+        guest_path: PathBuf,
+    ) -> Result<()> {
+        let dir = wasmtime_wasi::Dir::open_ambient_dir(host_path, ambient_authority())?;
+        self.try_with_wasi(|wasi| wasi.preopened_dir(dir, guest_path))
+    }
+
+    pub fn host_components_data(&mut self) -> &mut HostComponentsData {
+        &mut self.host_components_data
+    }
+
+    pub fn build_with_data<T>(self, inner_data: T) -> Result<Store<T>> {
+        let mut wasi = self.wasi.map_err(anyhow::Error::msg)?.unwrap().build();
+
+        // Insert any read-only preopened dirs
+        for (idx, (dir, path)) in self.read_only_preopened_dirs.into_iter().enumerate() {
+            let fd = WASI_FIRST_PREOPENED_DIR_FD + idx as u32;
+            let dir = Box::new(wasmtime_wasi::tokio::Dir::from_cap_std(dir));
+            wasi.insert_dir(fd, dir, READ_ONLY_DIR_CAPS, READ_ONLY_FILE_CAPS, path);
+        }
+
+        let mut inner = wasmtime::Store::new(
+            &self.engine,
+            Data {
+                inner: inner_data,
+                wasi,
+                host_components_data: self.host_components_data,
+                store_limits: self.store_limits,
+            },
+        );
+        inner.limiter_async(move |data| &mut data.store_limits);
+        Ok(Store { inner })
+    }
+
+    pub fn build<T: Default>(self) -> Result<Store<T>> {
+        self.build_with_data(T::default())
+    }
+
+    fn with_wasi(&mut self, f: impl FnOnce(WasiCtxBuilder) -> WasiCtxBuilder) {
+        let _ = self.try_with_wasi(|wasi| Ok(f(wasi)));
+    }
+
+    fn try_with_wasi(
+        &mut self,
+        f: impl FnOnce(WasiCtxBuilder) -> Result<WasiCtxBuilder>,
+    ) -> Result<()> {
+        let wasi = self
+            .wasi
+            .as_mut()
+            .map_err(|err| anyhow!("StoreBuilder already failed: {}", err))?
+            .take()
+            .unwrap();
+        match f(wasi) {
+            Ok(wasi) => {
+                self.wasi = Ok(Some(wasi));
+                Ok(())
+            }
+            Err(err) => {
+                self.wasi = Err(err.to_string());
+                Err(err)
+            }
+        }
+    }
+}
diff --git a/crates/engine/Cargo.toml b/crates/engine/Cargo.toml
deleted file mode 100644
index 03a1f0a108..0000000000
--- a/crates/engine/Cargo.toml
+++ /dev/null
@@ -1,25 +0,0 @@
-[package]
-name = "spin-engine"
-version = "0.2.0"
-edition = "2021"
-authors = ["Fermyon Engineering <engineering@fermyon.com>"]
-
-[dependencies]
-anyhow = "1.0.44"
-bytes = "1.1.0"
-dirs = "4.0"
-sanitize-filename = "0.3.0"
-spin-config = { path = "../config" }
-spin-manifest = { path = "../manifest" }
-tempfile = "3.3.0"
-tokio = { version = "1.10.0", features = [ "fs" ] }
-tracing = { version = "0.1", features = [ "log" ] }
-tracing-futures = "0.2"
-wasi-cap-std-sync = "0.39.1"
-wasi-common = "0.39.1"
-wasmtime = "0.39.1"
-wasmtime-wasi = "0.39.1"
-cap-std = "0.24.1"
-
-[dev-dependencies]
-wit-bindgen-wasmtime = { git = "https://github.com/bytecodealliance/wit-bindgen", rev = "cb871cfa1ee460b51eb1d144b175b9aab9c50aba" }
diff --git a/crates/engine/src/host_component.rs b/crates/engine/src/host_component.rs
deleted file mode 100644
index 57b4b09d42..0000000000
--- a/crates/engine/src/host_component.rs
+++ /dev/null
@@ -1,100 +0,0 @@
-use std::{any::Any, marker::PhantomData};
-
-use anyhow::Result;
-use spin_manifest::CoreComponent;
-use wasmtime::Linker;
-
-use crate::RuntimeContext;
-
-/// Represents a host implementation of a Wasm interface.
-pub trait HostComponent: Send + Sync {
-    /// Host component runtime state.
-    type State: Any + Send;
-
-    /// Add this component to the given Linker, using the given runtime state-getting handle.
-    fn add_to_linker<T>(
-        linker: &mut Linker<RuntimeContext<T>>,
-        state_handle: HostComponentsStateHandle<Self::State>,
-    ) -> Result<()>;
-
-    /// Build a new runtime state object for the given component.
-    fn build_state(&self, component: &CoreComponent) -> Result<Self::State>;
-}
-type HostComponentState = Box<dyn Any + Send>;
-
-type StateBuilder = Box<dyn Fn(&CoreComponent) -> Result<HostComponentState> + Send + Sync>;
-
-#[derive(Default)]
-pub(crate) struct HostComponents {
-    state_builders: Vec<StateBuilder>,
-}
-
-impl HostComponents {
-    pub(crate) fn insert<T: 'static, Component: HostComponent + 'static>(
-        &mut self,
-        linker: &mut Linker<RuntimeContext<T>>,
-        host_component: Component,
-    ) -> Result<()> {
-        let handle = HostComponentsStateHandle {
-            idx: self.state_builders.len(),
-            _phantom: PhantomData,
-        };
-        Component::add_to_linker(linker, handle)?;
-        self.state_builders.push(Box::new(move |c| {
-            Ok(Box::new(host_component.build_state(c)?))
-        }));
-        Ok(())
-    }
-
-    pub(crate) fn build_state(&self, c: &CoreComponent) -> Result<HostComponentsState> {
-        Ok(HostComponentsState(
-            self.state_builders
-                .iter()
-                .map(|build_state| build_state(c))
-                .collect::<Result<_>>()?,
-        ))
-    }
-}
-
-/// A collection of host components state.
-#[derive(Default)]
-pub struct HostComponentsState(Vec<HostComponentState>);
-
-/// A handle to component state, used in HostComponent::add_to_linker.
-pub struct HostComponentsStateHandle<T> {
-    idx: usize,
-    _phantom: PhantomData<fn(T) -> T>,
-}
-
-impl<T: 'static> HostComponentsStateHandle<T> {
-    /// Get a ref to the component state associated with this handle from the RuntimeContext.
-    pub fn get<'a, U>(&self, ctx: &'a RuntimeContext<U>) -> &'a T {
-        ctx.host_components_state
-            .0
-            .get(self.idx)
-            .unwrap()
-            .downcast_ref()
-            .unwrap()
-    }
-
-    /// Get a mutable ref to the component state associated with this handle from the RuntimeContext.
-    pub fn get_mut<'a, U>(&self, ctx: &'a mut RuntimeContext<U>) -> &'a mut T {
-        ctx.host_components_state
-            .0
-            .get_mut(self.idx)
-            .unwrap()
-            .downcast_mut()
-            .unwrap()
-    }
-}
-
-impl<T> Clone for HostComponentsStateHandle<T> {
-    fn clone(&self) -> Self {
-        Self {
-            idx: self.idx,
-            _phantom: PhantomData,
-        }
-    }
-}
-
-impl<T> Copy for HostComponentsStateHandle<T> {}
diff --git a/crates/engine/src/io.rs b/crates/engine/src/io.rs
deleted file mode 100644
index 6553fc9c08..0000000000
--- a/crates/engine/src/io.rs
+++ /dev/null
@@ -1,256 +0,0 @@
-use std::{
-    collections::HashSet,
-    fmt::Debug,
-    io::{LineWriter, Write},
-    sync::{Arc, RwLock, RwLockReadGuard},
-};
-
-use wasi_common::{
-    pipe::{ReadPipe, WritePipe},
-    WasiFile,
-};
-
-/// Prepares a WASI pipe which writes to a memory buffer, optionally
-/// copying to the specified output stream.
-pub fn redirect_to_mem_buffer(
-    follow: Follow,
-) -> (WritePipe<WriteDestinations>, Arc<RwLock<WriteDestinations>>) {
-    let immediate = follow.writer();
-
-    let buffer: Vec<u8> = vec![];
-    let std_dests = WriteDestinations { buffer, immediate };
-    let lock = Arc::new(RwLock::new(std_dests));
-    let std_pipe = WritePipe::from_shared(lock.clone());
-
-    (std_pipe, lock)
-}
-
-/// Which components should have their logs followed on stdout/stderr.
-#[derive(Clone, Debug)]
-pub enum FollowComponents {
-    /// No components should have their logs followed.
-    None,
-    /// Only the specified components should have their logs followed.
-    Named(HashSet<String>),
-    /// All components should have their logs followed.
-    All,
-}
-
-impl FollowComponents {
-    /// Whether a given component should have its logs followed on stdout/stderr.
-    pub fn should_follow(&self, component_id: &str) -> bool {
-        match self {
-            Self::None => false,
-            Self::All => true,
-            Self::Named(ids) => ids.contains(component_id),
-        }
-    }
-}
-
-impl Default for FollowComponents {
-    fn default() -> Self {
-        Self::None
-    }
-}
-
-/// The buffers in which Wasm module output has been saved.
-pub trait OutputBuffers {
-    /// The buffer in which stdout has been saved.
-    fn stdout(&self) -> &[u8];
-    /// The buffer in which stderr has been saved.
-    fn stderr(&self) -> &[u8];
-}
-
-/// A set of redirected standard I/O streams with which
-/// a Wasm module is to be run.
-pub struct ModuleIoRedirects {
-    /// pipes for ModuleIoRedirects
-    pub pipes: RedirectPipes,
-    /// read handles for ModuleIoRedirects
-    pub read_handles: RedirectReadHandles,
-}
-
-impl Default for ModuleIoRedirects {
-    fn default() -> Self {
-        Self::new(false)
-    }
-}
-
-impl ModuleIoRedirects {
-    /// Constructs the ModuleIoRedirects, and RedirectReadHandles instances the default way
-    pub fn new(follow: bool) -> Self {
-        let rrh = RedirectReadHandles::new(follow);
-
-        let in_stdpipe: Box<dyn WasiFile> = Box::new(ReadPipe::from(vec![]));
-        let out_stdpipe: Box<dyn WasiFile> = Box::new(WritePipe::from_shared(rrh.stdout.clone()));
-        let err_stdpipe: Box<dyn WasiFile> = Box::new(WritePipe::from_shared(rrh.stderr.clone()));
-
-        Self {
-            pipes: RedirectPipes {
-                stdin: in_stdpipe,
-                stdout: out_stdpipe,
-                stderr: err_stdpipe,
-            },
-            read_handles: rrh,
-        }
-    }
-}
-
-/// Pipes from `ModuleIoRedirects`
-pub struct RedirectPipes {
-    pub(crate) stdin: Box<dyn WasiFile>,
-    pub(crate) stdout: Box<dyn WasiFile>,
-    pub(crate) stderr: Box<dyn WasiFile>,
-}
-
-impl RedirectPipes {
-    /// Constructs an instance from a set of WasiFile objects.
-    pub fn new(
-        stdin: Box<dyn WasiFile>,
-        stdout: Box<dyn WasiFile>,
-        stderr: Box<dyn WasiFile>,
-    ) -> Self {
-        Self {
-            stdin,
-            stdout,
-            stderr,
-        }
-    }
-}
-
-/// The destinations to which redirected module output will be written.
-/// Used for subsequently reading back the output.
-pub struct RedirectReadHandles {
-    stdout: Arc<RwLock<WriteDestinations>>,
-    stderr: Arc<RwLock<WriteDestinations>>,
-}
-
-impl Default for RedirectReadHandles {
-    fn default() -> Self {
-        Self::new(false)
-    }
-}
-
-impl RedirectReadHandles {
-    /// Creates a new RedirectReadHandles instance
-    pub fn new(follow: bool) -> Self {
-        let out_immediate = Follow::stdout(follow).writer();
-        let err_immediate = Follow::stderr(follow).writer();
-
-        let out_buffer: Vec<u8> = vec![];
-        let err_buffer: Vec<u8> = vec![];
-
-        let out_std_dests = WriteDestinations {
-            buffer: out_buffer,
-            immediate: out_immediate,
-        };
-        let err_std_dests = WriteDestinations {
-            buffer: err_buffer,
-            immediate: err_immediate,
-        };
-
-        Self {
-            stdout: Arc::new(RwLock::new(out_std_dests)),
-            stderr: Arc::new(RwLock::new(err_std_dests)),
-        }
-    }
-    /// Acquires a read lock for the in-memory output buffers.
-    pub fn read(&self) -> impl OutputBuffers + '_ {
-        RedirectReadHandlesLock {
-            stdout: self.stdout.read().unwrap(),
-            stderr: self.stderr.read().unwrap(),
-        }
-    }
-}
-
-struct RedirectReadHandlesLock<'a> {
-    stdout: RwLockReadGuard<'a, WriteDestinations>,
-    stderr: RwLockReadGuard<'a, WriteDestinations>,
-}
-
-impl<'a> OutputBuffers for RedirectReadHandlesLock<'a> {
-    fn stdout(&self) -> &[u8] {
-        self.stdout.buffer()
-    }
-    fn stderr(&self) -> &[u8] {
-        self.stderr.buffer()
-    }
-}
-
-/// Indicates whether a memory redirect should also pipe the output to
-/// the console so it can be followed live.
-pub enum Follow {
-    /// Do not pipe to console - only write to memory.
-    None,
-    /// Also pipe to stdout.
-    Stdout,
-    /// Also pipe to stderr.
-    Stderr,
-}
-
-impl Follow {
-    pub(crate) fn writer(&self) -> Box<dyn Write + Send + Sync> {
-        match self {
-            Self::None => Box::new(DiscardingWriter),
-            Self::Stdout => Box::new(LineWriter::new(std::io::stdout())),
-            Self::Stderr => Box::new(LineWriter::new(std::io::stderr())),
-        }
-    }
-
-    /// Follow on stdout if so specified.
-    pub fn stdout(follow_on_stdout: bool) -> Self {
-        if follow_on_stdout {
-            Self::Stdout
-        } else {
-            Self::None
-        }
-    }
-
-    /// Follow on stderr if so specified.
-    pub fn stderr(follow_on_stderr: bool) -> Self {
-        if follow_on_stderr {
-            Self::Stderr
-        } else {
-            Self::None
-        }
-    }
-}
-
-/// The destinations to which a component writes an output stream.
-pub struct WriteDestinations {
-    buffer: Vec<u8>,
-    immediate: Box<dyn Write + Send + Sync>,
-}
-
-impl WriteDestinations {
-    /// The memory buffer to which a component writes an output stream.
-    pub fn buffer(&self) -> &[u8] {
-        &self.buffer
-    }
-}
-
-impl Write for WriteDestinations {
-    fn write(&mut self, buf: &[u8]) -> std::io::Result<usize> {
-        let written = self.buffer.write(buf)?;
-        self.immediate.write_all(&buf[0..written])?;
-        Ok(written)
-    }
-
-    fn flush(&mut self) -> std::io::Result<()> {
-        self.buffer.flush()?;
-        self.immediate.flush()?;
-        Ok(())
-    }
-}
-
-struct DiscardingWriter;
-
-impl Write for DiscardingWriter {
-    fn write(&mut self, buf: &[u8]) -> std::io::Result<usize> {
-        Ok(buf.len())
-    }
-
-    fn flush(&mut self) -> std::io::Result<()> {
-        Ok(())
-    }
-}
diff --git a/crates/engine/src/lib.rs b/crates/engine/src/lib.rs
deleted file mode 100644
index 43bf7498ea..0000000000
--- a/crates/engine/src/lib.rs
+++ /dev/null
@@ -1,411 +0,0 @@
-//! A Spin execution context for applications.
-
-#![deny(missing_docs)]
-
-/// Host components.
-pub mod host_component;
-/// Input / Output redirects.
-pub mod io;
-
-use std::{collections::HashMap, io::Write, path::PathBuf, sync::Arc};
-
-use anyhow::{bail, Context, Result};
-use host_component::{HostComponent, HostComponents, HostComponentsState};
-use io::{FollowComponents, OutputBuffers, RedirectPipes};
-use spin_config::{host_component::ComponentConfig, Resolver};
-use spin_manifest::{CoreComponent, DirectoryMount, ModuleSource};
-use tokio::{
-    task::JoinHandle,
-    time::{sleep, Duration},
-};
-use tracing::{instrument, log};
-use wasi_common::WasiCtx;
-use wasmtime::{Instance, InstancePre, Linker, Module, Store};
-use wasmtime_wasi::{ambient_authority, Dir, WasiCtxBuilder};
-
-const SPIN_HOME: &str = ".spin";
-
-/// Builder-specific configuration.
-#[derive(Clone, Debug, Default)]
-pub struct ExecutionContextConfiguration {
-    /// Component configuration.
-    pub components: Vec<CoreComponent>,
-    /// Label for logging, etc.
-    pub label: String,
-    /// Log directory on host.
-    pub log_dir: Option<PathBuf>,
-    /// Component log following configuration.
-    pub follow_components: FollowComponents,
-    /// Application configuration resolver.
-    pub config_resolver: Option<Arc<Resolver>>,
-}
-
-/// Top-level runtime context data to be passed to a component.
-#[derive(Default)]
-pub struct RuntimeContext<T> {
-    /// WASI context data.
-    pub wasi: Option<WasiCtx>,
-    /// Component configuration.
-    pub component_config: Option<spin_config::host_component::ComponentConfig>,
-    /// Host components state.
-    pub host_components_state: HostComponentsState,
-    /// Generic runtime data that can be configured by specialized engines.
-    pub data: Option<T>,
-}
-
-/// The engine struct that encapsulate wasmtime engine
-#[derive(Clone, Default)]
-pub struct Engine(wasmtime::Engine);
-
-impl Engine {
-    /// Create a new engine and initialize it with the given config.
-    pub fn new(config: wasmtime::Config) -> Result<Self> {
-        Ok(Self(wasmtime::Engine::new(&config)?))
-    }
-
-    /// Get a clone of the internal `wasmtime::Engine`.
-    /// WARNING: The configuration of this Engine is likely to change in the future, and
-    /// will not be covered by any future stability guarantees.
-    pub fn inner(&self) -> wasmtime::Engine {
-        self.0.clone()
-    }
-}
-
-/// An execution context builder.
-pub struct Builder<T: Default> {
-    config: ExecutionContextConfiguration,
-    linker: Linker<RuntimeContext<T>>,
-    store: Store<RuntimeContext<T>>,
-    engine: Engine,
-    host_components: HostComponents,
-}
-
-impl<T: Default + 'static> Builder<T> {
-    /// Creates a new instance of the execution builder.
-    pub fn new(config: ExecutionContextConfiguration) -> Result<Builder<T>> {
-        Self::with_engine(config, Engine::new(Default::default())?)
-    }
-
-    /// Creates a new instance of the execution builder with the given wasmtime::Config.
-    pub fn with_engine(
-        config: ExecutionContextConfiguration,
-        engine: Engine,
-    ) -> Result<Builder<T>> {
-        let data = RuntimeContext::default();
-        let linker = Linker::new(&engine.0);
-        let store = Store::new(&engine.0, data);
-        let host_components = Default::default();
-
-        Ok(Self {
-            config,
-            linker,
-            store,
-            engine,
-            host_components,
-        })
-    }
-
-    /// Configures the WASI linker imports for the current execution context.
-    pub fn link_wasi(&mut self) -> Result<&mut Self> {
-        wasmtime_wasi::add_to_linker(&mut self.linker, |ctx| ctx.wasi.as_mut().unwrap())?;
-        Ok(self)
-    }
-
-    /// Configures the application configuration interface.
-    pub fn link_config(&mut self) -> Result<&mut Self> {
-        spin_config::host_component::add_to_linker(&mut self.linker, |ctx| {
-            ctx.component_config.as_mut().unwrap()
-        })?;
-        Ok(self)
-    }
-
-    /// Adds a HostComponent to the execution context.
-    pub fn add_host_component(
-        &mut self,
-        host_component: impl HostComponent + 'static,
-    ) -> Result<&mut Self> {
-        self.host_components
-            .insert(&mut self.linker, host_component)?;
-        Ok(self)
-    }
-
-    /// Builds a new instance of the execution context.
-    #[instrument(skip(self))]
-    pub async fn build(mut self) -> Result<ExecutionContext<T>> {
-        let _sloth_warning = warn_if_slothful();
-        let mut components = HashMap::new();
-        for c in &self.config.components {
-            let core = c.clone();
-            let module = match c.source.clone() {
-                ModuleSource::FileReference(p) => {
-                    let module = Module::from_file(&self.engine.0, &p).with_context(|| {
-                        format!(
-                            "Cannot create module for component {} from file {}",
-                            &c.id,
-                            &p.display()
-                        )
-                    })?;
-                    log::trace!("Created module for component {} from file {:?}", &c.id, &p);
-                    module
-                }
-                ModuleSource::Buffer(bytes, info) => {
-                    let module =
-                        Module::from_binary(&self.engine.0, &bytes).with_context(|| {
-                            format!("Cannot create module for component {} from {}", &c.id, info)
-                        })?;
-                    log::trace!(
-                        "Created module for component {} from {} with size {}",
-                        &c.id,
-                        info,
-                        bytes.len()
-                    );
-                    module
-                }
-            };
-
-            let pre = Arc::new(self.linker.instantiate_pre(&mut self.store, &module)?);
-            log::trace!("Created pre-instance from module for component {}.", &c.id);
-
-            components.insert(c.id.clone(), Component { core, pre });
-        }
-
-        log::trace!("Execution context initialized.");
-
-        Ok(ExecutionContext {
-            config: self.config,
-            engine: self.engine,
-            components,
-            host_components: Arc::new(self.host_components),
-        })
-    }
-
-    /// Configures default host interface implementations.
-    pub fn link_defaults(&mut self) -> Result<&mut Self> {
-        self.link_wasi()?.link_config()
-    }
-
-    /// Builds a new default instance of the execution context.
-    pub async fn build_default(
-        config: ExecutionContextConfiguration,
-    ) -> Result<ExecutionContext<T>> {
-        let mut builder = Self::new(config)?;
-        builder.link_defaults()?;
-        builder.build().await
-    }
-}
-
-/// Component for the execution context.
-#[derive(Clone)]
-pub struct Component<T: Default> {
-    /// Configuration for the component.
-    pub core: CoreComponent,
-    /// The pre-instance of the component
-    pub pre: Arc<InstancePre<RuntimeContext<T>>>,
-}
-
-/// A generic execution context for WebAssembly components.
-#[derive(Clone)]
-pub struct ExecutionContext<T: Default> {
-    /// Top-level runtime configuration.
-    pub config: ExecutionContextConfiguration,
-    /// Wasmtime engine.
-    pub engine: Engine,
-    /// Collection of pre-initialized (and already linked) components.
-    pub components: HashMap<String, Component<T>>,
-
-    host_components: Arc<HostComponents>,
-}
-
-impl<T: Default> ExecutionContext<T> {
-    /// Creates a store for a given component given its configuration and runtime data.
-    #[instrument(skip(self, data, io))]
-    pub fn prepare_component(
-        &self,
-        component: &str,
-        data: Option<T>,
-        io: Option<RedirectPipes>,
-        env: Option<HashMap<String, String>>,
-        args: Option<Vec<String>>,
-    ) -> Result<(Store<RuntimeContext<T>>, Instance)> {
-        log::trace!("Preparing component {}", component);
-        let component = match self.components.get(component) {
-            Some(c) => c,
-            None => bail!("Cannot find component {}", component),
-        };
-
-        let mut store = self.store(component, data, io, env, args)?;
-        let instance = component.pre.instantiate(&mut store)?;
-
-        Ok((store, instance))
-    }
-
-    /// Save logs for a given component in the log directory on the host
-    pub fn save_output_to_logs(
-        &self,
-        ior: impl OutputBuffers,
-        component: &str,
-        save_stdout: bool,
-        save_stderr: bool,
-    ) -> Result<()> {
-        let sanitized_label = sanitize(&self.config.label);
-        let sanitized_component_name = sanitize(&component);
-
-        let log_dir = match &self.config.log_dir {
-            Some(l) => l.clone(),
-            None => match dirs::home_dir() {
-                Some(h) => h.join(SPIN_HOME).join(&sanitized_label).join("logs"),
-                None => PathBuf::from(&sanitized_label).join("logs"),
-            },
-        };
-
-        let stdout_filename = log_dir.join(sanitize(format!(
-            "{}_{}.txt",
-            sanitized_component_name, "stdout",
-        )));
-
-        let stderr_filename = log_dir.join(sanitize(format!(
-            "{}_{}.txt",
-            sanitized_component_name, "stderr"
-        )));
-
-        std::fs::create_dir_all(&log_dir)?;
-
-        log::trace!("Saving logs to {:?} {:?}", stdout_filename, stderr_filename);
-
-        if save_stdout {
-            let mut file = std::fs::OpenOptions::new()
-                .write(true)
-                .append(true)
-                .create(true)
-                .open(stdout_filename)?;
-            let contents = ior.stdout();
-            file.write_all(contents)?;
-        }
-
-        if save_stderr {
-            let mut file = std::fs::OpenOptions::new()
-                .write(true)
-                .append(true)
-                .create(true)
-                .open(stderr_filename)?;
-            let contents = ior.stderr();
-            file.write_all(contents)?;
-        }
-
-        Ok(())
-    }
-    /// Creates a store for a given component given its configuration and runtime data.
-    fn store(
-        &self,
-        component: &Component<T>,
-        data: Option<T>,
-        io: Option<RedirectPipes>,
-        env: Option<HashMap<String, String>>,
-        args: Option<Vec<String>>,
-    ) -> Result<Store<RuntimeContext<T>>> {
-        log::trace!("Creating store.");
-        let (env, dirs) = Self::wasi_config(component, env)?;
-        let mut ctx = RuntimeContext::default();
-        let mut wasi_ctx = WasiCtxBuilder::new()
-            .args(&args.unwrap_or_default())?
-            .envs(&env)?;
-        match io {
-            Some(r) => {
-                wasi_ctx = wasi_ctx.stderr(r.stderr).stdout(r.stdout).stdin(r.stdin);
-            }
-            None => wasi_ctx = wasi_ctx.inherit_stdio(),
-        };
-
-        for dir in dirs {
-            let guest = dir.guest;
-            let host = dir.host;
-            wasi_ctx =
-                wasi_ctx.preopened_dir(Dir::open_ambient_dir(host, ambient_authority())?, guest)?;
-        }
-
-        if let Some(resolver) = &self.config.config_resolver {
-            ctx.component_config =
-                Some(ComponentConfig::new(&component.core.id, resolver.clone())?);
-        }
-
-        ctx.host_components_state = self.host_components.build_state(&component.core)?;
-
-        ctx.wasi = Some(wasi_ctx.build());
-        ctx.data = data;
-
-        let store = Store::new(&self.engine.0, ctx);
-        Ok(store)
-    }
-
-    #[allow(clippy::type_complexity)]
-    fn wasi_config(
-        component: &Component<T>,
-        env: Option<HashMap<String, String>>,
-    ) -> Result<(Vec<(String, String)>, Vec<DirectoryMount>)> {
-        let mut res = vec![];
-
-        for (k, v) in &component.core.wasm.environment {
-            res.push((k.clone(), v.clone()));
-        }
-
-        // Custom environment variables currently take precedence over component-defined
-        // environment variables. This might change in the future.
-        if let Some(envs) = env {
-            for (k, v) in envs {
-                res.push((k.clone(), v.clone()));
-            }
-        };
-
-        let dirs = component.core.wasm.mounts.clone();
-
-        Ok((res, dirs))
-    }
-}
-
-fn sanitize(name: impl AsRef<str>) -> String {
-    // options block copied from sanitize_filename project readme
-    let options = sanitize_filename::Options {
-        // true by default, truncates to 255 bytes
-        truncate: true,
-        // default value depends on the OS, removes reserved names like `con` from start of strings on Windows
-        windows: true,
-        // str to replace sanitized chars/strings
-        replacement: "",
-    };
-
-    // filename logic defined in the project works for directory names as well
-    // refer to: https://github.com/kardeiz/sanitize-filename/blob/f5158746946ed81015c3a33078dedf164686da19/src/lib.rs#L76-L165
-    sanitize_filename::sanitize_with_options(name, options)
-}
-
-const SLOTH_WARNING_DELAY_MILLIS: u64 = 1250;
-
-struct SlothWarning<T> {
-    warning: JoinHandle<T>,
-}
-
-impl<T> Drop for SlothWarning<T> {
-    fn drop(&mut self) {
-        self.warning.abort()
-    }
-}
-
-fn warn_if_slothful() -> SlothWarning<()> {
-    let warning = tokio::spawn(warn_slow());
-    SlothWarning { warning }
-}
-
-#[cfg(debug_assertions)]
-async fn warn_slow() {
-    sleep(Duration::from_millis(SLOTH_WARNING_DELAY_MILLIS)).await;
-    println!("This is a debug build - preparing Wasm modules might take a few seconds");
-    println!("If you're experiencing long startup times please switch to the release build");
-    println!();
-}
-
-#[cfg(not(debug_assertions))]
-async fn warn_slow() {
-    sleep(Duration::from_millis(SLOTH_WARNING_DELAY_MILLIS)).await;
-    println!("Preparing Wasm modules is taking a few seconds...");
-    println!();
-}
diff --git a/crates/http/Cargo.toml b/crates/http/Cargo.toml
index 7caf3cafac..a93e6fe60d 100644
--- a/crates/http/Cargo.toml
+++ b/crates/http/Cargo.toml
@@ -22,8 +22,9 @@ hyper-rustls = { version = "0.23.0" }
 indexmap = "1"
 percent-encoding = "2"
 serde = { version = "1.0", features = ["derive"] }
+spin-app = { path = "../app" }
+spin-core = { path = "../core" }
 spin-manifest = { path = "../manifest" }
-spin-engine = { path = "../engine" }
 spin-trigger = { path = "../trigger" }
 tls-listener = { version = "0.4.0", features = [
     "rustls",
@@ -35,13 +36,9 @@ tokio-rustls = { version = "0.23.2" }
 rustls-pemfile = "0.3.0"
 tracing = { version = "0.1", features = ["log"] }
 tracing-futures = "0.2"
-tracing-subscriber = { version = "0.3.7", features = ["env-filter"] }
 url = "2.2"
-wasi-cap-std-sync = "0.39.1"
-wasi-common = "0.39.1"
 wasmtime = "0.39.1"
-wasmtime-wasi = "0.39.1"
-wit-bindgen-wasmtime = { git = "https://github.com/bytecodealliance/wit-bindgen", rev = "cb871cfa1ee460b51eb1d144b175b9aab9c50aba" }
+wit-bindgen-wasmtime = { git = "https://github.com/bytecodealliance/wit-bindgen", rev = "cb871cfa1ee460b51eb1d144b175b9aab9c50aba", features = ["async"] }
 
 [dev-dependencies]
 criterion = { version = "0.3.5", features = ["async_tokio"] }
diff --git a/crates/http/benches/baseline.rs b/crates/http/benches/baseline.rs
index b3f6bf7ef8..106f451b75 100644
--- a/crates/http/benches/baseline.rs
+++ b/crates/http/benches/baseline.rs
@@ -7,7 +7,6 @@ use futures::future::join_all;
 use http::uri::Scheme;
 use http::Request;
 use spin_http_engine::HttpTrigger;
-use spin_manifest::{HttpConfig, HttpExecutor};
 use spin_testing::{assert_http_response_success, TestConfig};
 use tokio::runtime::Runtime;
 use tokio::task;
@@ -29,7 +28,7 @@ fn bench_startup(c: &mut Criterion) {
         b.to_async(&async_runtime).iter(|| async {
             let trigger = TestConfig::default()
                 .test_program("spin-http-benchmark.wasm")
-                .http_trigger(Default::default())
+                .http_spin_trigger("/")
                 .build_http_trigger()
                 .await;
             run_concurrent_requests(Arc::new(trigger), 0, 1).await;
@@ -39,10 +38,7 @@ fn bench_startup(c: &mut Criterion) {
         b.to_async(&async_runtime).iter(|| async {
             let trigger = TestConfig::default()
                 .test_program("wagi-benchmark.wasm")
-                .http_trigger(HttpConfig {
-                    executor: Some(HttpExecutor::Wagi(Default::default())),
-                    ..Default::default()
-                })
+                .http_wagi_trigger("/", Default::default())
                 .build_http_trigger()
                 .await;
             run_concurrent_requests(Arc::new(trigger), 0, 1).await;
@@ -58,7 +54,7 @@ fn bench_spin_concurrency_minimal(c: &mut Criterion) {
         async_runtime.block_on(
             TestConfig::default()
                 .test_program("spin-http-benchmark.wasm")
-                .http_trigger(Default::default())
+                .http_spin_trigger("/")
                 .build_http_trigger(),
         ),
     );
@@ -94,10 +90,7 @@ fn bench_wagi_concurrency_minimal(c: &mut Criterion) {
         async_runtime.block_on(
             TestConfig::default()
                 .test_program("wagi-benchmark.wasm")
-                .http_trigger(HttpConfig {
-                    executor: Some(HttpExecutor::Wagi(Default::default())),
-                    ..Default::default()
-                })
+                .http_wagi_trigger("/", Default::default())
                 .build_http_trigger(),
         ),
     );
diff --git a/crates/http/src/lib.rs b/crates/http/src/lib.rs
index d4a32d4d7a..ecf066dc7d 100644
--- a/crates/http/src/lib.rs
+++ b/crates/http/src/lib.rs
@@ -5,7 +5,7 @@ mod spin;
 mod tls;
 mod wagi;
 
-use std::{future::ready, net::SocketAddr, path::PathBuf, sync::Arc};
+use std::{collections::HashMap, future::ready, net::SocketAddr, path::PathBuf, sync::Arc};
 
 use anyhow::{Context, Error, Result};
 use async_trait::async_trait;
@@ -18,41 +18,32 @@ use hyper::{
     service::{make_service_fn, service_fn},
     Body, Request, Response, Server,
 };
-use spin_http::SpinHttpData;
-use spin_manifest::{ComponentMap, HttpConfig, HttpTriggerConfiguration, TriggerConfig};
-use spin_trigger::TriggerExecutor;
+use serde::{Deserialize, Serialize};
+use spin_trigger::{TriggerAppEngine, TriggerExecutor};
 pub use tls::TlsConfig;
 use tls_listener::TlsListener;
 use tokio::net::{TcpListener, TcpStream};
 use tokio_rustls::server::TlsStream;
 use tracing::log;
 
+pub use crate::wagi::WagiTriggerConfig;
+
 use crate::{
     routes::{RoutePattern, Router},
     spin::SpinHttpExecutor,
     wagi::WagiHttpExecutor,
 };
 
-wit_bindgen_wasmtime::import!("../../wit/ephemeral/spin-http.wit");
+wit_bindgen_wasmtime::import!({paths: ["../../wit/ephemeral/spin-http.wit"], async: *});
 
-type ExecutionContext = spin_engine::ExecutionContext<SpinHttpData>;
-type RuntimeContext = spin_engine::RuntimeContext<SpinHttpData>;
+pub(crate) type RuntimeData = spin_http::SpinHttpData;
+pub(crate) type Store = spin_core::Store<RuntimeData>;
 
 /// The Spin HTTP trigger.
-///
-/// Could this contain a list of multiple HTTP applications?
-/// (there could be a field apps: HashMap<String, Config>, where
-/// the key is the base path for the application, and the trigger
-/// would work across multiple applications.)
 pub struct HttpTrigger {
-    /// Trigger configuration.
-    trigger_config: HttpTriggerConfiguration,
-    /// Component trigger configurations.
-    component_triggers: ComponentMap<HttpConfig>,
-    /// Router.
+    app_engine: TriggerAppEngine<Self>,
     router: Router,
-    /// Spin execution context.
-    engine: ExecutionContext,
+    component_trigger_configs: HashMap<String, HttpTriggerConfig>,
 }
 
 #[derive(Args)]
@@ -83,45 +74,61 @@ impl CliArgs {
     }
 }
 
-pub struct HttpTriggerConfig(String, HttpConfig);
-
-impl TryFrom<(String, TriggerConfig)> for HttpTriggerConfig {
-    type Error = spin_manifest::Error;
+/// Configuration for the HTTP trigger
+#[derive(Clone, Debug, Default, Deserialize, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct HttpTriggerConfig {
+    /// Component ID to invoke
+    pub component: String,
+    /// HTTP route the component will be invoked for
+    pub route: String,
+    /// The HTTP executor the component requires
+    #[serde(default)]
+    pub executor: Option<HttpExecutorType>,
+}
 
-    fn try_from((component, config): (String, TriggerConfig)) -> Result<Self, Self::Error> {
-        Ok(HttpTriggerConfig(component, config.try_into()?))
-    }
+/// The executor for the HTTP component.
+/// The component can either implement the Spin HTTP interface,
+/// or the Wagi CGI interface.
+///
+/// If an executor is not specified, the inferred default is `HttpExecutor::Spin`.
+#[derive(Clone, Debug, Default, Deserialize, Serialize)]
+#[serde(deny_unknown_fields, rename_all = "lowercase", tag = "type")]
+pub enum HttpExecutorType {
+    /// The component implements the Spin HTTP interface.
+    #[default]
+    Spin,
+    /// The component implements the Wagi CGI interface.
+    Wagi(WagiTriggerConfig),
 }
 
 #[async_trait]
 impl TriggerExecutor for HttpTrigger {
-    type GlobalConfig = HttpTriggerConfiguration;
+    const TRIGGER_TYPE: &'static str = "http";
+    type RuntimeData = RuntimeData;
     type TriggerConfig = HttpTriggerConfig;
     type RunConfig = CliArgs;
-    type RuntimeContext = SpinHttpData;
-
-    fn new(
-        execution_context: ExecutionContext,
-        global_config: Self::GlobalConfig,
-        trigger_configs: impl IntoIterator<Item = Self::TriggerConfig>,
-    ) -> Result<Self> {
-        let component_triggers: ComponentMap<HttpConfig> = trigger_configs
-            .into_iter()
-            .map(|config| (config.0, config.1))
-            .collect();
 
-        let router = Router::build(&global_config.base, &component_triggers)?;
+    fn new(app_engine: TriggerAppEngine<Self>) -> Result<Self> {
+        let component_routes = app_engine
+            .trigger_configs()
+            .map(|(_, config)| (config.component.clone(), config.route.clone()));
+        let router = Router::build(component_routes)?;
         log::trace!(
             "Constructed router for application {}: {:?}",
-            execution_context.config.label,
+            app_engine.app_name,
             router.routes
         );
 
+        let component_trigger_configs = app_engine
+            .trigger_configs()
+            .map(|(_, config)| (config.component.clone(), config.clone()))
+            .collect();
+
         Ok(Self {
-            trigger_config: global_config,
-            component_triggers,
+            app_engine,
             router,
-            engine: execution_context,
+            component_trigger_configs,
         })
     }
 
@@ -135,10 +142,10 @@ impl TriggerExecutor for HttpTrigger {
         println!("Serving {}", base_url);
         log::info!("Serving {}", base_url);
         println!("Available Routes:");
-        for (route, component) in &self.router.routes {
-            println!("  {}: {}{}", component, base_url, route);
-            if let Some(component) = self.engine.components.get(component) {
-                if let Some(description) = &component.core.description {
+        for (route, component_id) in &self.router.routes {
+            println!("  {}: {}{}", component_id, base_url, route);
+            if let Some(component) = self.app_engine.app().get_component(component_id) {
+                if let Some(Ok(description)) = component.get_metadata::<&str>("description") {
                     println!("    {}", description);
                 }
             }
@@ -165,7 +172,7 @@ impl HttpTrigger {
 
         log::info!(
             "Processing request for application {} on URI {}",
-            &self.engine.config.label,
+            &self.app_engine.app_name,
             req.uri()
         );
 
@@ -173,48 +180,23 @@ impl HttpTrigger {
             "/healthz" => Ok(Response::new(Body::from("OK"))),
             route => match self.router.route(route) {
                 Ok(component_id) => {
-                    let trigger = self.component_triggers.get(component_id).unwrap();
-
-                    let executor = match &trigger.executor {
-                        Some(i) => i,
-                        None => &spin_manifest::HttpExecutor::Spin,
-                    };
+                    let trigger = self.component_trigger_configs.get(component_id).unwrap();
 
-                    let follow = self
-                        .engine
-                        .config
-                        .follow_components
-                        .should_follow(component_id);
+                    let executor = trigger.executor.as_ref().unwrap_or(&HttpExecutorType::Spin);
 
                     let res = match executor {
-                        spin_manifest::HttpExecutor::Spin => {
+                        HttpExecutorType::Spin => {
                             let executor = SpinHttpExecutor;
                             executor
-                                .execute(
-                                    &self.engine,
-                                    component_id,
-                                    &self.trigger_config.base,
-                                    &trigger.route,
-                                    req,
-                                    addr,
-                                    follow,
-                                )
+                                .execute(&self.app_engine, component_id, &trigger.route, req, addr)
                                 .await
                         }
-                        spin_manifest::HttpExecutor::Wagi(wagi_config) => {
+                        HttpExecutorType::Wagi(wagi_config) => {
                             let executor = WagiHttpExecutor {
                                 wagi_config: wagi_config.clone(),
                             };
                             executor
-                                .execute(
-                                    &self.engine,
-                                    component_id,
-                                    &self.trigger_config.base,
-                                    &trigger.route,
-                                    req,
-                                    addr,
-                                    follow,
-                                )
+                                .execute(&self.app_engine, component_id, &trigger.route, req, addr)
                                 .await
                         }
                     };
@@ -346,32 +328,28 @@ const PATH_INFO: &[&str] = &["SPIN_PATH_INFO", "PATH_INFO"];
 const MATCHED_ROUTE: &[&str] = &["SPIN_MATCHED_ROUTE", "X_MATCHED_ROUTE"];
 const COMPONENT_ROUTE: &[&str] = &["SPIN_COMPONENT_ROUTE", "X_COMPONENT_ROUTE"];
 const RAW_COMPONENT_ROUTE: &[&str] = &["SPIN_RAW_COMPONENT_ROUTE", "X_RAW_COMPONENT_ROUTE"];
-const BASE_PATH: &[&str] = &["SPIN_BASE_PATH", "X_BASE_PATH"];
 
-pub(crate) fn compute_default_headers<'a>(
+pub(crate) fn compute_default_headers(
     uri: &Uri,
     raw: &str,
-    base: &str,
     host: &str,
-) -> Result<Vec<(&'a [&'a str], String)>> {
+) -> Result<Vec<(&'static [&'static str], String)>> {
     let mut res = vec![];
     let abs_path = uri
         .path_and_query()
         .expect("cannot get path and query")
         .as_str();
-
-    let path_info = RoutePattern::from(base, raw).relative(abs_path)?;
+    let path_info = RoutePattern::from(raw).relative(abs_path)?;
 
     let scheme = uri.scheme_str().unwrap_or("http");
 
     let full_url = format!("{}://{}{}", scheme, host, abs_path);
-    let matched_route = RoutePattern::sanitize_with_base(base, raw);
+    let matched_route = RoutePattern::sanitize(raw);
 
     res.push((PATH_INFO, path_info));
     res.push((FULL_URL, full_url));
     res.push((MATCHED_ROUTE, matched_route));
 
-    res.push((BASE_PATH, base.to_string()));
     res.push((RAW_COMPONENT_ROUTE, raw.to_string()));
     res.push((
         COMPONENT_ROUTE,
@@ -393,51 +371,34 @@ pub(crate) trait HttpExecutor: Clone + Send + Sync + 'static {
     #[allow(clippy::too_many_arguments)]
     async fn execute(
         &self,
-        engine: &ExecutionContext,
-        component: &str,
-        base: &str,
+        app_engine: &TriggerAppEngine<HttpTrigger>,
+        component_id: &str,
         raw_route: &str,
         req: Request<Body>,
         client_addr: SocketAddr,
-        follow: bool,
     ) -> Result<Response<Body>>;
 }
 
 #[cfg(test)]
 mod tests {
-    use std::{collections::BTreeMap, sync::Once};
+    use std::collections::BTreeMap;
 
     use anyhow::Result;
-    use spin_manifest::{HttpConfig, HttpExecutor};
     use spin_testing::test_socket_addr;
-    use spin_trigger::TriggerExecutorBuilder;
 
     use super::*;
 
-    static LOGGER: Once = Once::new();
-
-    /// We can only initialize the tracing subscriber once per crate.
-    pub(crate) fn init() {
-        LOGGER.call_once(|| {
-            tracing_subscriber::fmt()
-                .with_env_filter(tracing_subscriber::EnvFilter::from_default_env())
-                .with_ansi(atty::is(atty::Stream::Stderr))
-                .init();
-        });
-    }
-
     #[test]
     fn test_default_headers_with_base_path() -> Result<()> {
         let scheme = "https";
         let host = "fermyon.dev";
-        let base = "/base";
         let trigger_route = "/foo/...";
         let component_path = "/foo";
         let path_info = "/bar";
 
         let req_uri = format!(
-            "{}://{}{}{}{}?key1=value1&key2=value2",
-            scheme, host, base, component_path, path_info
+            "{}://{}{}{}?key1=value1&key2=value2",
+            scheme, host, component_path, path_info
         );
 
         let req = http::Request::builder()
@@ -445,11 +406,11 @@ mod tests {
             .uri(req_uri)
             .body("")?;
 
-        let default_headers = crate::compute_default_headers(req.uri(), trigger_route, base, host)?;
+        let default_headers = crate::compute_default_headers(req.uri(), trigger_route, host)?;
 
         assert_eq!(
             search(FULL_URL, &default_headers).unwrap(),
-            "https://fermyon.dev/base/foo/bar?key1=value1&key2=value2".to_string()
+            "https://fermyon.dev/foo/bar?key1=value1&key2=value2".to_string()
         );
         assert_eq!(
             search(PATH_INFO, &default_headers).unwrap(),
@@ -457,11 +418,7 @@ mod tests {
         );
         assert_eq!(
             search(MATCHED_ROUTE, &default_headers).unwrap(),
-            "/base/foo/...".to_string()
-        );
-        assert_eq!(
-            search(BASE_PATH, &default_headers).unwrap(),
-            "/base".to_string()
+            "/foo/...".to_string()
         );
         assert_eq!(
             search(RAW_COMPONENT_ROUTE, &default_headers).unwrap(),
@@ -479,7 +436,6 @@ mod tests {
     fn test_default_headers_without_base_path() -> Result<()> {
         let scheme = "https";
         let host = "fermyon.dev";
-        let base = "/";
         let trigger_route = "/foo/...";
         let component_path = "/foo";
         let path_info = "/bar";
@@ -494,7 +450,7 @@ mod tests {
             .uri(req_uri)
             .body("")?;
 
-        let default_headers = crate::compute_default_headers(req.uri(), trigger_route, base, host)?;
+        let default_headers = crate::compute_default_headers(req.uri(), trigger_route, host)?;
 
         // TODO: we currently replace the scheme with HTTP. When TLS is supported, this should be fixed.
         assert_eq!(
@@ -509,10 +465,6 @@ mod tests {
             search(MATCHED_ROUTE, &default_headers).unwrap(),
             "/foo/...".to_string()
         );
-        assert_eq!(
-            search(BASE_PATH, &default_headers).unwrap(),
-            "/".to_string()
-        );
         assert_eq!(
             search(RAW_COMPONENT_ROUTE, &default_headers).unwrap(),
             "/foo/...".to_string()
@@ -525,8 +477,6 @@ mod tests {
         Ok(())
     }
 
-    // fn _search(key: &str, headers: &[(String, String)]) -> Option<String> {}
-
     fn search<'a>(keys: &'a [&'a str], headers: &[(&[&str], String)]) -> Option<String> {
         let mut res: Option<String> = None;
         for (k, v) in headers {
@@ -540,17 +490,11 @@ mod tests {
 
     #[tokio::test]
     async fn test_spin_http() -> Result<()> {
-        init();
-
-        let mut cfg = spin_testing::TestConfig::default();
-        cfg.test_program("rust-http-test.wasm")
-            .http_trigger(HttpConfig {
-                route: "/test".to_string(),
-                executor: Some(HttpExecutor::Spin),
-            });
-        let app = cfg.build_application();
-
-        let trigger: HttpTrigger = TriggerExecutorBuilder::new(app).build().await?;
+        let trigger = spin_testing::TestConfig::default()
+            .test_program("rust-http-test.wasm")
+            .http_spin_trigger("/test")
+            .build_http_trigger()
+            .await;
 
         let body = Body::from("Fermyon".as_bytes().to_vec());
         let req = http::Request::post("https://myservice.fermyon.dev/test?abc=def")
@@ -571,16 +515,11 @@ mod tests {
 
     #[tokio::test]
     async fn test_wagi_http() -> Result<()> {
-        init();
-
-        let mut cfg = spin_testing::TestConfig::default();
-        cfg.test_program("wagi-test.wasm").http_trigger(HttpConfig {
-            route: "/test".to_string(),
-            executor: Some(HttpExecutor::Wagi(Default::default())),
-        });
-        let app = cfg.build_application();
-
-        let trigger: HttpTrigger = TriggerExecutorBuilder::new(app).build().await?;
+        let trigger = spin_testing::TestConfig::default()
+            .test_program("wagi-test.wasm")
+            .http_wagi_trigger("/test", Default::default())
+            .build_http_trigger()
+            .await;
 
         let body = Body::from("Fermyon".as_bytes().to_vec());
         let req = http::Request::builder()
diff --git a/crates/http/src/routes.rs b/crates/http/src/routes.rs
index 224eab9551..75b3f0081f 100644
--- a/crates/http/src/routes.rs
+++ b/crates/http/src/routes.rs
@@ -1,12 +1,10 @@
 //! Route matching for the HTTP trigger.
 
-#![deny(missing_docs)]
+use std::{borrow::Cow, fmt};
 
 use anyhow::{Context, Result};
 use http::Uri;
 use indexmap::IndexMap;
-use spin_manifest::{ComponentMap, HttpConfig};
-use std::{borrow::Cow, fmt};
 
 /// Router for the HTTP trigger.
 #[derive(Clone, Debug)]
@@ -18,17 +16,11 @@ pub struct Router {
 impl Router {
     /// Builds a router based on application configuration.
     pub(crate) fn build(
-        base: &str,
-        component_http_configs: &ComponentMap<HttpConfig>,
+        component_routes: impl IntoIterator<Item = (String, String)>,
     ) -> Result<Self> {
-        let routes = component_http_configs
-            .iter()
-            .map(|(component_id, http_config)| {
-                (
-                    RoutePattern::from(base, &http_config.route),
-                    component_id.to_string(),
-                )
-            })
+        let routes = component_routes
+            .into_iter()
+            .map(|(component_id, route)| (RoutePattern::from(route), component_id))
             .collect();
 
         Ok(Self { routes })
@@ -61,17 +53,22 @@ pub enum RoutePattern {
 
 impl RoutePattern {
     /// Returns a RoutePattern given a path fragment.
-    pub fn from<S: Into<String>>(base: S, path: S) -> Self {
-        let path = Self::sanitize_with_base(base, path);
+    pub fn from(path: impl Into<String>) -> Self {
+        let path = Self::sanitize(path);
         match path.strip_suffix("/...") {
             Some(p) => Self::Wildcard(p.to_owned()),
-            None => Self::Exact(path),
+            None => Self::Exact(path.to_owned()),
         }
     }
 
+    /// Build a RoutePattern from the give base (prefix) and path suffix.
+    pub fn with_base(base: impl Into<String>, path: impl AsRef<str>) -> Self {
+        Self::from(Self::sanitize(base) + path.as_ref())
+    }
+
     /// Returns true if the given path fragment can be handled
     /// by the route pattern.
-    pub(crate) fn matches<S: Into<String>>(&self, p: S) -> bool {
+    pub(crate) fn matches(&self, p: impl Into<String>) -> bool {
         let p = Self::sanitize(p);
         match self {
             RoutePattern::Exact(path) => &p == path,
@@ -81,7 +78,6 @@ impl RoutePattern {
         }
     }
 
-    /// Resolves a relative path from the end of the matched path to the end of the string.
     pub(crate) fn relative(&self, uri: &str) -> Result<String> {
         let base = match self {
             Self::Exact(path) => path,
@@ -111,24 +107,15 @@ impl RoutePattern {
         }
     }
 
-    /// Sanitizes the base and path and return a formed path.
-    pub(crate) fn sanitize_with_base<S: Into<String>>(base: S, path: S) -> String {
-        format!(
-            "{}{}",
-            Self::sanitize(base.into()),
-            Self::sanitize(path.into())
-        )
-    }
-
     /// Strips the trailing slash from a string.
-    fn sanitize<S: Into<String>>(s: S) -> String {
-        let s = s.into();
+    pub(crate) fn sanitize(path: impl Into<String>) -> String {
+        let path = path.into();
         // TODO
         // This only strips a single trailing slash.
         // Should we attempt to strip all trailing slashes?
-        match s.strip_suffix('/') {
+        match path.strip_suffix('/') {
             Some(s) => s.into(),
-            None => s,
+            None => path,
         }
     }
 }
@@ -145,94 +132,53 @@ impl fmt::Display for RoutePattern {
 #[cfg(test)]
 mod route_tests {
     use super::*;
-    use crate::tests::init;
 
     #[test]
     fn test_exact_route() {
-        init();
-
-        let rp = RoutePattern::from("/", "/foo/bar");
+        let rp = RoutePattern::from("/foo/bar");
         assert!(rp.matches("/foo/bar"));
         assert!(rp.matches("/foo/bar/"));
         assert!(!rp.matches("/foo"));
         assert!(!rp.matches("/foo/bar/thisshouldbefalse"));
         assert!(!rp.matches("/abc"));
 
-        let rp = RoutePattern::from("/base", "/foo");
-        assert!(rp.matches("/base/foo"));
-        assert!(rp.matches("/base/foo/"));
-        assert!(!rp.matches("/base/foo/bar"));
-        assert!(!rp.matches("/thishouldbefalse"));
-
-        let rp = RoutePattern::from("/base/", "/foo");
-        assert!(rp.matches("/base/foo"));
-        assert!(rp.matches("/base/foo/"));
-        assert!(!rp.matches("/base/foo/bar"));
-        assert!(!rp.matches("/thishouldbefalse"));
-
-        let rp = RoutePattern::from("/base/", "/foo/");
-        assert!(rp.matches("/base/foo"));
-        assert!(rp.matches("/base/foo/"));
-        assert!(!rp.matches("/base/foo/bar"));
+        let rp = RoutePattern::from("/foo/bar/");
+        assert!(rp.matches("/foo/bar"));
+        assert!(rp.matches("/foo/bar/"));
+        assert!(!rp.matches("/foo/bar/baz"));
         assert!(!rp.matches("/thishouldbefalse"));
     }
 
     #[test]
     fn test_pattern_route() {
-        let rp = RoutePattern::from("/", "/...");
+        let rp = RoutePattern::from("/...");
         assert!(rp.matches("/foo/bar/"));
         assert!(rp.matches("/foo"));
         assert!(rp.matches("/foo/bar/baz"));
         assert!(rp.matches("/this/should/really/match/everything/"));
         assert!(rp.matches("/"));
 
-        let rp = RoutePattern::from("/", "/foo/...");
+        let rp = RoutePattern::from("/foo/...");
         assert!(rp.matches("/foo/bar/"));
         assert!(rp.matches("/foo"));
         assert!(rp.matches("/foo/bar/baz"));
         assert!(!rp.matches("/this/should/really/not/match/everything/"));
         assert!(!rp.matches("/"));
-
-        let rp = RoutePattern::from("/base", "/...");
-        assert!(rp.matches("/base/foo/bar/"));
-        assert!(rp.matches("/base/foo"));
-        assert!(rp.matches("/base/foo/bar/baz"));
-        assert!(rp.matches("/base/this/should/really/match/everything/"));
-        assert!(rp.matches("/base"));
     }
 
     #[test]
     fn test_relative() -> Result<()> {
         assert_eq!(
-            RoutePattern::from("/", "/foo").relative("/foo/bar")?,
+            RoutePattern::from("/foo").relative("/foo/bar")?,
             "/bar".to_string()
         );
+        assert_eq!(RoutePattern::from("/foo").relative("/foo")?, "".to_string());
         assert_eq!(
-            RoutePattern::from("/base", "/foo").relative("/base/foo/bar")?,
-            "/bar".to_string()
-        );
-
-        assert_eq!(
-            RoutePattern::from("/", "/foo").relative("/foo")?,
-            "".to_string()
-        );
-        assert_eq!(
-            RoutePattern::from("/base", "/foo").relative("/base/foo")?,
-            "".to_string()
-        );
-
-        assert_eq!(
-            RoutePattern::from("/", "/static/...").relative("/static/images/abc.png")?,
-            "/images/abc.png".to_string()
-        );
-        assert_eq!(
-            RoutePattern::from("/base", "/static/...").relative("/base/static/images/abc.png")?,
+            RoutePattern::from("/static/...").relative("/static/images/abc.png")?,
             "/images/abc.png".to_string()
         );
-
         assert_eq!(
-            RoutePattern::from("/base", "/static/...")
-                .relative("/base/static/images/abc.png?abc=def&foo=bar")?,
+            RoutePattern::from("/static/...").relative("/static/images/abc.png?abc=def&foo=bar")?,
             "/images/abc.png".to_string()
         );
 
@@ -243,8 +189,8 @@ mod route_tests {
     fn test_router() -> Result<()> {
         let mut routes = IndexMap::new();
 
-        routes.insert(RoutePattern::from("/", "/foo"), "foo".to_string());
-        routes.insert(RoutePattern::from("/", "/foo/bar"), "foobar".to_string());
+        routes.insert(RoutePattern::from("/foo"), "foo".to_string());
+        routes.insert(RoutePattern::from("/foo/bar"), "foobar".to_string());
 
         let r = Router { routes };
 
@@ -253,20 +199,7 @@ mod route_tests {
 
         let mut routes = IndexMap::new();
 
-        routes.insert(RoutePattern::from("/base", "/foo"), "foo".to_string());
-        routes.insert(
-            RoutePattern::from("/base", "/foo/bar"),
-            "foobar".to_string(),
-        );
-
-        let r = Router { routes };
-
-        assert_eq!(r.route("/base/foo")?, "foo".to_string());
-        assert_eq!(r.route("/base/foo/bar")?, "foobar".to_string());
-
-        let mut routes = IndexMap::new();
-
-        routes.insert(RoutePattern::from("/", "/..."), "all".to_string());
+        routes.insert(RoutePattern::from("/..."), "all".to_string());
 
         let r = Router { routes };
 
@@ -280,16 +213,13 @@ mod route_tests {
 
         let mut routes = IndexMap::new();
 
+        routes.insert(RoutePattern::from("/one/..."), "one_wildcard".to_string());
         routes.insert(
-            RoutePattern::from("/", "/one/..."),
-            "one_wildcard".to_string(),
-        );
-        routes.insert(
-            RoutePattern::from("/", "/one/two/..."),
+            RoutePattern::from("/one/two/..."),
             "onetwo_wildcard".to_string(),
         );
         routes.insert(
-            RoutePattern::from("/", "/one/two/three/..."),
+            RoutePattern::from("/one/two/three/..."),
             "onetwothree_wildcard".to_string(),
         );
 
@@ -303,17 +233,14 @@ mod route_tests {
         let mut routes = IndexMap::new();
 
         routes.insert(
-            RoutePattern::from("/", "/one/two/three/..."),
+            RoutePattern::from("/one/two/three/..."),
             "onetwothree_wildcard".to_string(),
         );
         routes.insert(
-            RoutePattern::from("/", "/one/two/..."),
+            RoutePattern::from("/one/two/..."),
             "onetwo_wildcard".to_string(),
         );
-        routes.insert(
-            RoutePattern::from("/", "/one/..."),
-            "one_wildcard".to_string(),
-        );
+        routes.insert(RoutePattern::from("/one/..."), "one_wildcard".to_string());
 
         let r = Router { routes };
 
diff --git a/crates/http/src/spin.rs b/crates/http/src/spin.rs
index e2c2913740..6c6761f4d6 100644
--- a/crates/http/src/spin.rs
+++ b/crates/http/src/spin.rs
@@ -1,15 +1,16 @@
-use crate::{
-    spin_http::{Method, SpinHttp},
-    ExecutionContext, HttpExecutor, RuntimeContext,
-};
+use std::{net::SocketAddr, str, str::FromStr};
+
 use anyhow::Result;
 use async_trait::async_trait;
 use hyper::{Body, Request, Response};
-use spin_engine::io::ModuleIoRedirects;
-use std::{net::SocketAddr, str, str::FromStr};
-use tokio::task::spawn_blocking;
+use spin_core::Instance;
+use spin_trigger::TriggerAppEngine;
 use tracing::log;
-use wasmtime::{Instance, Store};
+
+use crate::{
+    spin_http::{Method, SpinHttp},
+    HttpExecutor, HttpTrigger, Store,
+};
 
 #[derive(Clone)]
 pub struct SpinHttpExecutor;
@@ -18,37 +19,22 @@ pub struct SpinHttpExecutor;
 impl HttpExecutor for SpinHttpExecutor {
     async fn execute(
         &self,
-        engine: &ExecutionContext,
-        component: &str,
-        base: &str,
+        app_engine: &TriggerAppEngine<HttpTrigger>,
+        component_id: &str,
         raw_route: &str,
         req: Request<Body>,
         _client_addr: SocketAddr,
-        follow: bool,
     ) -> Result<Response<Body>> {
         log::trace!(
             "Executing request using the Spin executor for component {}",
-            component
+            component_id
         );
 
-        let mior = ModuleIoRedirects::new(follow);
+        let (instance, store) = app_engine.prepare_instance(component_id).await?;
 
-        let (store, instance) =
-            engine.prepare_component(component, None, Some(mior.pipes), None, None)?;
-
-        let resp_result = Self::execute_impl(store, instance, base, raw_route, req)
+        let resp = Self::execute_impl(store, instance, raw_route, req)
             .await
-            .map_err(contextualise_err);
-
-        let log_result =
-            engine.save_output_to_logs(mior.read_handles.read(), component, true, true);
-
-        // Defer checking for failures until here so that the logging runs
-        // even if the guest code fails. (And when checking, check the guest
-        // result first, so that guest failures are returned in preference to
-        // log failures.)
-        let resp = resp_result?;
-        log_result?;
+            .map_err(contextualise_err)?;
 
         log::info!(
             "Request finished, sending response with status code {}",
@@ -60,52 +46,48 @@ impl HttpExecutor for SpinHttpExecutor {
 
 impl SpinHttpExecutor {
     pub async fn execute_impl(
-        mut store: Store<RuntimeContext>,
+        mut store: Store,
         instance: Instance,
-        base: &str,
         raw_route: &str,
         req: Request<Body>,
     ) -> Result<Response<Body>> {
         let headers;
         let mut req = req;
         {
-            headers = Self::headers(&mut req, raw_route, base)?;
+            headers = Self::headers(&mut req, raw_route)?;
         }
 
-        let engine = SpinHttp::new(&mut store, &instance, |host| host.data.as_mut().unwrap())?;
+        let engine = SpinHttp::new(&mut store, &instance, |host| host.as_mut())?;
         let (parts, bytes) = req.into_parts();
         let bytes = hyper::body::to_bytes(bytes).await?.to_vec();
 
-        let res = spawn_blocking(move || -> Result<crate::spin_http::Response> {
-            let method = Self::method(&parts.method);
-
-            let headers: Vec<(&str, &str)> = headers
-                .iter()
-                .map(|(k, v)| (k.as_str(), v.as_str()))
-                .collect();
-
-            // Preparing to remove the params field. We are leaving it in place for now
-            // to avoid breaking the ABI, but no longer pass or accept values in it.
-            // https://github.com/fermyon/spin/issues/663
-            let params = vec![];
-
-            let body = Some(&bytes[..]);
-            let uri = match parts.uri.path_and_query() {
-                Some(u) => u.to_string(),
-                None => parts.uri.to_string(),
-            };
-
-            let req = crate::spin_http::Request {
-                method,
-                uri: &uri,
-                headers: &headers,
-                params: &params,
-                body,
-            };
-
-            Ok(engine.handle_http_request(&mut store, req)?)
-        })
-        .await??;
+        let method = Self::method(&parts.method);
+
+        let headers: Vec<(&str, &str)> = headers
+            .iter()
+            .map(|(k, v)| (k.as_str(), v.as_str()))
+            .collect();
+
+        // Preparing to remove the params field. We are leaving it in place for now
+        // to avoid breaking the ABI, but no longer pass or accept values in it.
+        // https://github.com/fermyon/spin/issues/663
+        let params = vec![];
+
+        let body = Some(&bytes[..]);
+        let uri = match parts.uri.path_and_query() {
+            Some(u) => u.to_string(),
+            None => parts.uri.to_string(),
+        };
+
+        let req = crate::spin_http::Request {
+            method,
+            uri: &uri,
+            headers: &headers,
+            params: &params,
+            body,
+        };
+
+        let res = engine.handle_http_request(&mut store, req).await?;
 
         if res.status < 100 || res.status > 600 {
             log::error!("malformed HTTP status code");
@@ -140,7 +122,7 @@ impl SpinHttpExecutor {
         }
     }
 
-    fn headers(req: &mut Request<Body>, raw: &str, base: &str) -> Result<Vec<(String, String)>> {
+    fn headers(req: &mut Request<Body>, raw: &str) -> Result<Vec<(String, String)>> {
         let mut res = Vec::new();
         for (name, value) in req
             .headers()
@@ -159,10 +141,10 @@ impl SpinHttpExecutor {
                 .as_bytes(),
         )?;
 
-        // Set the environment information (path info, base path, etc) as headers.
+        // Set the environment information (path info, etc) as headers.
         // In the future, we might want to have this information in a context
         // object as opposed to headers.
-        for (keys, val) in crate::compute_default_headers(req.uri(), raw, base, host)? {
+        for (keys, val) in crate::compute_default_headers(req.uri(), raw, host)? {
             res.push((Self::prepare_header_key(keys[0]), val));
         }
 
diff --git a/crates/http/src/wagi.rs b/crates/http/src/wagi.rs
index 4d2f27b6ce..be19dc3383 100644
--- a/crates/http/src/wagi.rs
+++ b/crates/http/src/wagi.rs
@@ -1,37 +1,65 @@
 mod util;
 
-use crate::{routes::RoutePattern, ExecutionContext, HttpExecutor};
+use std::net::SocketAddr;
+
 use anyhow::Result;
 use async_trait::async_trait;
+use bytes::Buf;
 use hyper::{body, Body, Request, Response};
-use spin_engine::io::{
-    redirect_to_mem_buffer, Follow, OutputBuffers, RedirectPipes, WriteDestinations,
-};
-use spin_manifest::WagiConfig;
-use std::{
-    net::SocketAddr,
-    sync::{Arc, RwLock, RwLockReadGuard},
-};
-use tokio::task::spawn_blocking;
+use serde::{Deserialize, Serialize};
+use spin_trigger::TriggerAppEngine;
 use tracing::log;
-use wasi_common::pipe::{ReadPipe, WritePipe};
+
+use crate::{routes::RoutePattern, HttpExecutor, HttpTrigger};
+
+/// Wagi specific configuration for the http executor.
+#[derive(Clone, Debug, Deserialize, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct WagiTriggerConfig {
+    /// The name of the entrypoint.
+    #[serde(default)]
+    pub entrypoint: String,
+
+    /// A string representation of the argv array.
+    ///
+    /// This should be a space-separate list of strings. The value
+    /// ${SCRIPT_NAME} will be replaced with the Wagi SCRIPT_NAME,
+    /// and the value ${ARGS} will be replaced with the query parameter
+    /// name/value pairs presented as args. For example,
+    /// `param1=val1&param2=val2` will become `param1=val1 param2=val2`,
+    /// which will then be presented to the program as two arguments
+    /// in argv.
+    #[serde(default)]
+    pub argv: String,
+}
+
+impl Default for WagiTriggerConfig {
+    fn default() -> Self {
+        /// This is the default Wagi entrypoint.
+        const WAGI_DEFAULT_ENTRYPOINT: &str = "_start";
+        const WAGI_DEFAULT_ARGV: &str = "${SCRIPT_NAME} ${ARGS}";
+
+        Self {
+            entrypoint: WAGI_DEFAULT_ENTRYPOINT.to_owned(),
+            argv: WAGI_DEFAULT_ARGV.to_owned(),
+        }
+    }
+}
 
 #[derive(Clone)]
 pub struct WagiHttpExecutor {
-    pub wagi_config: WagiConfig,
+    pub wagi_config: WagiTriggerConfig,
 }
 
 #[async_trait]
 impl HttpExecutor for WagiHttpExecutor {
     async fn execute(
         &self,
-        engine: &ExecutionContext,
+        app_engine: &TriggerAppEngine<HttpTrigger>,
         component: &str,
-        base: &str,
         raw_route: &str,
         req: Request<Body>,
         client_addr: SocketAddr,
-        follow: bool,
     ) -> Result<Response<Body>> {
         log::trace!(
             "Executing request using the Wagi executor for component {}",
@@ -52,16 +80,14 @@ impl HttpExecutor for WagiHttpExecutor {
             .replace("${ARGS}", &args);
 
         let (parts, body) = req.into_parts();
-
-        let body = body::to_bytes(body).await?.to_vec();
-        let len = body.len();
-        let (redirects, outputs) = Self::streams_from_body(body, follow);
+        let body = body::aggregate(body).await?;
+        let content_length = body.remaining();
         // TODO
         // The default host and TLS fields are currently hard-coded.
         let mut headers = util::build_headers(
-            &RoutePattern::from(base, raw_route),
+            &RoutePattern::from(raw_route),
             &parts,
-            len,
+            content_length,
             client_addr,
             "default_host",
             false,
@@ -80,17 +106,21 @@ impl HttpExecutor for WagiHttpExecutor {
         // This sets the current environment variables Wagi expects (such as
         // `PATH_INFO`, or `X_FULL_URL`).
         // Note that this overrides any existing headers previously set by Wagi.
-        for (keys, val) in crate::compute_default_headers(&parts.uri, raw_route, base, host)? {
+        for (keys, val) in crate::compute_default_headers(&parts.uri, raw_route, host)? {
             headers.insert(keys[1].to_string(), val);
         }
 
-        let (mut store, instance) = engine.prepare_component(
-            component,
-            None,
-            Some(redirects),
-            Some(headers),
-            Some(argv.split(' ').map(|s| s.to_owned()).collect()),
-        )?;
+        let mut store_builder = app_engine.store_builder(component)?;
+
+        // Set up Wagi environment
+        store_builder.args(argv.split(' '))?;
+        store_builder.env(headers)?;
+        store_builder.stdin_pipe(body.reader());
+        let mut stdout_buffer = store_builder.stdout_buffered();
+
+        let (instance, mut store) = app_engine
+            .prepare_instance_with_store(component, store_builder)
+            .await?;
 
         let start = instance
             .get_func(&mut store, &self.wagi_config.entrypoint)
@@ -102,79 +132,15 @@ impl HttpExecutor for WagiHttpExecutor {
                 )
             })?;
         tracing::trace!("Calling Wasm entry point");
-        let guest_result = spawn_blocking(move || start.call(&mut store, &[], &mut [])).await;
+        let guest_result = start.call_async(&mut store, &[], &mut []).await;
         tracing::info!("Module execution complete");
+        guest_result.or_else(ignore_successful_proc_exit_trap)?;
 
-        let log_result = engine.save_output_to_logs(outputs.read(), component, false, true);
-
-        // Defer checking for failures until here so that the logging runs
-        // even if the guest code fails. (And when checking, check the guest
-        // result first, so that guest failures are returned in preference to
-        // log failures.)
-        guest_result?.or_else(ignore_successful_proc_exit_trap)?;
-        log_result?;
-
-        let stdout = outputs.stdout.read().unwrap();
+        let stdout = stdout_buffer.take();
         util::compose_response(&stdout)
     }
 }
 
-impl WagiHttpExecutor {
-    fn streams_from_body(
-        body: Vec<u8>,
-        follow_on_stderr: bool,
-    ) -> (RedirectPipes, WagiRedirectReadHandles) {
-        let stdin = ReadPipe::from(body);
-
-        let stdout_buf = vec![];
-        let stdout_lock = Arc::new(RwLock::new(stdout_buf));
-        let stdout_pipe = WritePipe::from_shared(stdout_lock.clone());
-
-        let (stderr_pipe, stderr_lock) = redirect_to_mem_buffer(Follow::stderr(follow_on_stderr));
-
-        let rd = RedirectPipes::new(
-            Box::new(stdin),
-            Box::new(stdout_pipe),
-            Box::new(stderr_pipe),
-        );
-
-        let h = WagiRedirectReadHandles {
-            stdout: stdout_lock,
-            stderr: stderr_lock,
-        };
-
-        (rd, h)
-    }
-}
-
-struct WagiRedirectReadHandles {
-    stdout: Arc<RwLock<Vec<u8>>>,
-    stderr: Arc<RwLock<WriteDestinations>>,
-}
-
-impl WagiRedirectReadHandles {
-    fn read(&self) -> impl OutputBuffers + '_ {
-        WagiRedirectReadHandlesLock {
-            stdout: self.stdout.read().unwrap(),
-            stderr: self.stderr.read().unwrap(),
-        }
-    }
-}
-
-struct WagiRedirectReadHandlesLock<'a> {
-    stdout: RwLockReadGuard<'a, Vec<u8>>,
-    stderr: RwLockReadGuard<'a, WriteDestinations>,
-}
-
-impl<'a> OutputBuffers for WagiRedirectReadHandlesLock<'a> {
-    fn stdout(&self) -> &[u8] {
-        &self.stdout
-    }
-    fn stderr(&self) -> &[u8] {
-        self.stderr.buffer()
-    }
-}
-
 fn ignore_successful_proc_exit_trap(guest_err: anyhow::Error) -> Result<()> {
     match guest_err.root_cause().downcast_ref::<wasmtime::Trap>() {
         Some(trap) => match trap.i32_exit_status() {
diff --git a/crates/loader/Cargo.toml b/crates/loader/Cargo.toml
index fc496fd957..2426894394 100644
--- a/crates/loader/Cargo.toml
+++ b/crates/loader/Cargo.toml
@@ -15,12 +15,13 @@ futures = "0.3.17"
 glob = "0.3.0"
 itertools = "0.10.3"
 lazy_static = "1.4.0"
+outbound-http = { path = "../outbound-http" } 
 path-absolutize = "3.0.11"
 regex = "1.5.4"
 reqwest = "0.11.9"
 sha2 = "0.10.1"
 serde = { version = "1.0", features = [ "derive" ] }
-spin-config = { path = "../config" }
+spin-app = { path = "../app" }
 spin-manifest = { path = "../manifest" }
 tempfile = "3.3.0"
 tokio = { version = "1.11", features = [ "full" ] }
@@ -28,6 +29,4 @@ tokio-util = "0.6"
 toml = "0.5"
 tracing = { version = "0.1", features = [ "log" ] }
 tracing-futures = "0.2"
-tracing-subscriber = { version = "0.3.7", features = [ "env-filter" ] }
-walkdir = "2.3.2"
-wasi-outbound-http = { path = "../outbound-http" } 
+walkdir = "2.3.2"
\ No newline at end of file
diff --git a/crates/loader/src/assets.rs b/crates/loader/src/assets.rs
index fc06d885e3..c8f708e54b 100644
--- a/crates/loader/src/assets.rs
+++ b/crates/loader/src/assets.rs
@@ -90,19 +90,6 @@ pub fn file_sha256_digest_string(path: impl AsRef<Path>) -> std::io::Result<Stri
     Ok(digest_string)
 }
 
-/// Change file to writable or readonly
-pub(crate) async fn change_file_permission(
-    path: impl AsRef<Path>,
-    allow_transient_write: bool,
-) -> Result<()> {
-    let mut perms = tokio::fs::metadata(&path).await?.permissions();
-    perms.set_readonly(!allow_transient_write);
-    tokio::fs::set_permissions(path, perms.clone())
-        .await
-        .with_context(|| anyhow!("Cannot set permission {:?}", perms.clone()))?;
-    Ok(())
-}
-
 #[cfg(test)]
 mod test {
     use super::*;
diff --git a/crates/loader/src/bindle/assets.rs b/crates/loader/src/bindle/assets.rs
index 101664b2bd..50c8539a14 100644
--- a/crates/loader/src/bindle/assets.rs
+++ b/crates/loader/src/bindle/assets.rs
@@ -12,7 +12,7 @@ use tracing::log;
 
 use crate::file_sha256_digest_string;
 use crate::{
-    assets::{change_file_permission, create_dir, ensure_under},
+    assets::{create_dir, ensure_under},
     bindle::utils::BindleReader,
 };
 
@@ -22,15 +22,12 @@ pub(crate) async fn prepare_component(
     parcels: &[Label],
     base_dst: impl AsRef<Path>,
     component: &str,
-    allow_transient_write: bool,
 ) -> Result<DirectoryMount> {
     let copier = Copier {
         reader: reader.clone(),
         id: bindle_id.clone(),
     };
-    copier
-        .prepare(parcels, base_dst, component, allow_transient_write)
-        .await
+    copier.prepare(parcels, base_dst, component).await
 }
 
 pub(crate) struct Copier {
@@ -44,7 +41,6 @@ impl Copier {
         parcels: &[Label],
         base_dst: impl AsRef<Path>,
         component: &str,
-        allow_transient_write: bool,
     ) -> Result<DirectoryMount> {
         log::info!(
             "Mounting files from '{}' to '{}'",
@@ -54,39 +50,25 @@ impl Copier {
 
         let host = create_dir(&base_dst, component).await?;
         let guest = "/".to_string();
-        self.copy_all(parcels, &host, allow_transient_write).await?;
+        self.copy_all(parcels, &host).await?;
 
         Ok(DirectoryMount { host, guest })
     }
 
-    async fn copy_all(
-        &self,
-        parcels: &[Label],
-        dir: impl AsRef<Path>,
-        allow_transient_write: bool,
-    ) -> Result<()> {
-        match stream::iter(
-            parcels
-                .iter()
-                .map(|p| self.copy(p, &dir, allow_transient_write)),
-        )
-        .buffer_unordered(crate::MAX_PARALLEL_ASSET_PROCESSING)
-        .filter_map(|r| future::ready(r.err()))
-        .map(|e| log::error!("{:?}", e))
-        .count()
-        .await
+    async fn copy_all(&self, parcels: &[Label], dir: impl AsRef<Path>) -> Result<()> {
+        match stream::iter(parcels.iter().map(|p| self.copy(p, &dir)))
+            .buffer_unordered(crate::MAX_PARALLEL_ASSET_PROCESSING)
+            .filter_map(|r| future::ready(r.err()))
+            .map(|e| log::error!("{:?}", e))
+            .count()
+            .await
         {
             0 => Ok(()),
             n => bail!("Error copying assets: {} file(s) not copied", n),
         }
     }
 
-    async fn copy(
-        &self,
-        p: &Label,
-        dir: impl AsRef<Path>,
-        allow_transient_write: bool,
-    ) -> Result<()> {
+    async fn copy(&self, p: &Label, dir: impl AsRef<Path>) -> Result<()> {
         let to = dir.as_ref().join(&p.name);
 
         ensure_under(&dir, &to)?;
@@ -94,16 +76,9 @@ impl Copier {
         if to.exists() {
             match check_existing_file(to.clone(), p).await {
                 Ok(true) => {
-                    change_file_permission(&to, allow_transient_write).await?;
                     return Ok(());
                 }
-                Ok(false) => {
-                    // file exists but digest doesn't match, set it to writable first for further writing
-                    let perms = tokio::fs::metadata(&to).await?.permissions();
-                    if perms.readonly() {
-                        change_file_permission(&to, true).await?;
-                    }
-                }
+                Ok(false) => (),
                 Err(err) => tracing::error!("Error verifying existing parcel: {}", err),
             }
         }
@@ -144,8 +119,6 @@ impl Copier {
             })?;
         }
 
-        change_file_permission(&to, allow_transient_write).await?;
-
         Ok(())
     }
 }
diff --git a/crates/loader/src/bindle/config.rs b/crates/loader/src/bindle/config.rs
index 0d86c1ae77..ec3738add3 100644
--- a/crates/loader/src/bindle/config.rs
+++ b/crates/loader/src/bindle/config.rs
@@ -1,4 +1,5 @@
 use serde::{Deserialize, Serialize};
+use spin_manifest::Variable;
 use std::collections::HashMap;
 
 /// Application configuration file format.
@@ -9,8 +10,8 @@ pub struct RawAppManifest {
     pub trigger: spin_manifest::ApplicationTrigger,
 
     /// Application-specific configuration schema.
-    #[serde(rename = "variables")]
-    pub config: Option<spin_config::Tree>,
+    #[serde(default)]
+    pub variables: HashMap<String, Variable>,
 
     /// Configuration for the application components.
     #[serde(rename = "component")]
diff --git a/crates/loader/src/bindle/mod.rs b/crates/loader/src/bindle/mod.rs
index 74e8a5fdc6..879c7c2fd2 100644
--- a/crates/loader/src/bindle/mod.rs
+++ b/crates/loader/src/bindle/mod.rs
@@ -10,23 +10,24 @@ mod connection;
 /// Bindle helper functions.
 mod utils;
 
-use crate::{
-    bindle::{
-        config::{RawAppManifest, RawComponentManifest},
-        utils::{find_manifest, parcels_in_group},
-    },
-    validation::{parse_allowed_http_hosts, validate_allowed_http_hosts},
-};
+use std::path::Path;
+
 use anyhow::{anyhow, Context, Result};
 use bindle::Invoice;
-pub use connection::BindleConnectionInfo;
 use futures::future;
+use outbound_http::allowed_http_hosts::validate_allowed_http_hosts;
 use spin_manifest::{
     Application, ApplicationInformation, ApplicationOrigin, CoreComponent, ModuleSource,
     SpinVersion, WasmConfig,
 };
-use std::{path::Path, sync::Arc};
 use tracing::log;
+
+use {
+    config::{RawAppManifest, RawComponentManifest},
+    utils::{find_manifest, parcels_in_group},
+};
+
+pub use connection::BindleConnectionInfo;
 pub(crate) use utils::BindleReader;
 pub use utils::SPIN_MANIFEST_MEDIA_TYPE;
 
@@ -34,19 +35,14 @@ pub use utils::SPIN_MANIFEST_MEDIA_TYPE;
 /// prepared application configuration consumable by a Spin execution context.
 /// If a directory is provided, use it as the base directory to expand the assets,
 /// otherwise create a new temporary directory.
-pub async fn from_bindle(
-    id: &str,
-    url: &str,
-    base_dst: impl AsRef<Path>,
-    allow_transient_write: bool,
-) -> Result<Application> {
+pub async fn from_bindle(id: &str, url: &str, base_dst: impl AsRef<Path>) -> Result<Application> {
     // TODO
     // Handle Bindle authentication.
     let connection_info = BindleConnectionInfo::new(url, false, None, None);
     let client = connection_info.client()?;
     let reader = BindleReader::remote(&client, &id.parse()?);
 
-    prepare(id, url, &reader, base_dst, allow_transient_write).await
+    prepare(id, url, &reader, base_dst).await
 }
 
 /// Converts a Bindle invoice into Spin configuration.
@@ -55,7 +51,6 @@ async fn prepare(
     url: &str,
     reader: &BindleReader,
     base_dst: impl AsRef<Path>,
-    allow_transient_write: bool,
 ) -> Result<Application> {
     // First, get the invoice from the Bindle server.
     let invoice = reader
@@ -64,34 +59,25 @@ async fn prepare(
         .with_context(|| anyhow!("Failed to load invoice '{}' from '{}'", id, url))?;
 
     // Then, reconstruct the application manifest from the parcels.
-    let mut raw: RawAppManifest =
+    let raw: RawAppManifest =
         toml::from_slice(&reader.get_parcel(&find_manifest(&invoice)?).await?)?;
     log::trace!("Recreated manifest from bindle: {:?}", raw);
 
     validate_raw_app_manifest(&raw)?;
 
-    let mut config_root = raw.config.take().unwrap_or_default();
-    for component in &mut raw.components {
-        if let Some(config) = component.config.take() {
-            let path = component.id.clone().try_into().with_context(|| {
-                format!("component ID {:?} not a valid config path", component.id)
-            })?;
-            config_root.merge_defaults(&path, config)?;
-        }
-    }
-    let config_resolver = Some(Arc::new(spin_config::Resolver::new(config_root)?));
-
     let info = info(&raw, &invoice, url);
     log::trace!("Application information from bindle: {:?}", info);
+
     let component_triggers = raw
         .components
         .iter()
         .map(|c| (c.id.clone(), c.trigger.clone()))
         .collect();
+
     let components = future::join_all(
         raw.components
             .into_iter()
-            .map(|c| async { core(c, &invoice, reader, &base_dst, allow_transient_write).await })
+            .map(|c| async { core(c, &invoice, reader, &base_dst).await })
             .collect::<Vec<_>>(),
     )
     .await
@@ -99,11 +85,13 @@ async fn prepare(
     .map(|x| x.expect("Cannot prepare component"))
     .collect::<Vec<_>>();
 
+    let variables = raw.variables;
+
     Ok(Application {
         info,
         components,
         component_triggers,
-        config_resolver,
+        variables,
     })
 }
 
@@ -119,7 +107,6 @@ async fn core(
     invoice: &Invoice,
     reader: &BindleReader,
     base_dst: impl AsRef<Path>,
-    allow_transient_write: bool,
 ) -> Result<CoreComponent> {
     let bytes = reader
         .get_parcel(&raw.source)
@@ -133,31 +120,26 @@ async fn core(
         Some(group) => {
             let parcels = parcels_in_group(invoice, &group);
             vec![
-                assets::prepare_component(
-                    reader,
-                    &invoice.bindle.id,
-                    &parcels,
-                    base_dst,
-                    &id,
-                    allow_transient_write,
-                )
-                .await?,
+                assets::prepare_component(reader, &invoice.bindle.id, &parcels, base_dst, &id)
+                    .await?,
             ]
         }
         None => vec![],
     };
     let environment = raw.wasm.environment.unwrap_or_default();
-    let allowed_http_hosts = parse_allowed_http_hosts(&raw.wasm.allowed_http_hosts)?;
+    let allowed_http_hosts = raw.wasm.allowed_http_hosts.unwrap_or_default();
     let wasm = WasmConfig {
         environment,
         mounts,
         allowed_http_hosts,
     };
+    let config = raw.config.unwrap_or_default();
     Ok(CoreComponent {
         source,
         id,
         description,
         wasm,
+        config,
     })
 }
 
diff --git a/crates/loader/src/lib.rs b/crates/loader/src/lib.rs
index 92dca06511..8a8438369d 100644
--- a/crates/loader/src/lib.rs
+++ b/crates/loader/src/lib.rs
@@ -13,7 +13,6 @@
 mod assets;
 pub mod bindle;
 pub mod local;
-mod validation;
 
 /// Load a Spin application configuration from a spin.toml manifest file.
 pub use local::from_file;
diff --git a/crates/loader/src/local/assets.rs b/crates/loader/src/local/assets.rs
index 8ece1d50a1..7174dc0f36 100644
--- a/crates/loader/src/local/assets.rs
+++ b/crates/loader/src/local/assets.rs
@@ -1,19 +1,18 @@
 #![deny(missing_docs)]
 
-use crate::assets::{
-    change_file_permission, create_dir, ensure_all_under, ensure_under, to_relative,
-};
-use anyhow::{anyhow, bail, ensure, Context, Result};
-use futures::{future, stream, StreamExt};
-use spin_manifest::DirectoryMount;
 use std::{
     path::{Path, PathBuf},
     vec,
 };
+
+use anyhow::{anyhow, bail, ensure, Context, Result};
+use futures::{future, stream, StreamExt};
+use spin_manifest::DirectoryMount;
 use tracing::log;
 use walkdir::WalkDir;
 
 use super::config::{RawDirectoryPlacement, RawFileMount};
+use crate::assets::{create_dir, ensure_all_under, ensure_under, to_relative};
 
 /// Prepare all local assets given a component ID and its file patterns.
 /// This file will copy all assets into a temporary directory as read-only.
@@ -22,7 +21,6 @@ pub(crate) async fn prepare_component(
     src: impl AsRef<Path>,
     base_dst: impl AsRef<Path>,
     id: &str,
-    allow_transient_write: bool,
     exclude_files: &[String],
 ) -> Result<Vec<DirectoryMount>> {
     log::info!(
@@ -34,7 +32,7 @@ pub(crate) async fn prepare_component(
     let files = collect(raw_mounts, exclude_files, src)?;
     let host = create_dir(&base_dst, id).await?;
     let guest = "/".to_string();
-    copy_all(&files, &host, allow_transient_write).await?;
+    copy_all(&files, &host).await?;
 
     Ok(vec![DirectoryMount { guest, host }])
 }
@@ -186,12 +184,8 @@ fn collect_pattern(pattern: &str, rel: impl AsRef<Path>) -> Result<Vec<FileMount
 }
 
 /// Copy all files to the mount directory.
-async fn copy_all(
-    files: &[FileMount],
-    dir: impl AsRef<Path>,
-    allow_transient_write: bool,
-) -> Result<()> {
-    let copy_futures = files.iter().map(|f| copy(f, &dir, allow_transient_write));
+async fn copy_all(files: &[FileMount], dir: impl AsRef<Path>) -> Result<()> {
+    let copy_futures = files.iter().map(|f| copy(f, &dir));
     let errors = stream::iter(copy_futures)
         .buffer_unordered(crate::MAX_PARALLEL_ASSET_PROCESSING)
         .filter_map(|r| future::ready(r.err()))
@@ -207,7 +201,7 @@ async fn copy_all(
 }
 
 /// Copy a single file to the mount directory, setting it as read-only.
-async fn copy(file: &FileMount, dir: impl AsRef<Path>, allow_transient_write: bool) -> Result<()> {
+async fn copy(file: &FileMount, dir: impl AsRef<Path>) -> Result<()> {
     let from = &file.src;
     let to = dir.as_ref().join(&file.relative_dst);
 
@@ -221,18 +215,10 @@ async fn copy(file: &FileMount, dir: impl AsRef<Path>, allow_transient_write: bo
 
     tokio::fs::create_dir_all(to.parent().expect("Cannot copy to file '/'")).await?;
 
-    // if destination file is read-only, set it to writable first
-    let metadata = tokio::fs::metadata(&to).await;
-    if metadata.is_ok() && metadata.unwrap().permissions().readonly() {
-        change_file_permission(&to, true).await?;
-    }
-
     let _ = tokio::fs::copy(&from, &to)
         .await
         .with_context(|| anyhow!("Error copying asset file  '{}'", from.display()))?;
 
-    change_file_permission(&to, allow_transient_write).await?;
-
     Ok(())
 }
 
diff --git a/crates/loader/src/local/config.rs b/crates/loader/src/local/config.rs
index c08a774577..17fc21c3e4 100644
--- a/crates/loader/src/local/config.rs
+++ b/crates/loader/src/local/config.rs
@@ -5,7 +5,7 @@
 #![deny(missing_docs)]
 
 use serde::{Deserialize, Serialize};
-use spin_manifest::{ApplicationTrigger, TriggerConfig};
+use spin_manifest::{ApplicationTrigger, TriggerConfig, Variable};
 use std::{collections::HashMap, path::PathBuf};
 
 /// Container for any version of the manifest.
@@ -27,8 +27,8 @@ pub struct RawAppManifest {
     pub info: RawAppInformation,
 
     /// Application-specific configuration schema.
-    #[serde(rename = "variables")]
-    pub config: Option<spin_config::Tree>,
+    #[serde(default)]
+    pub variables: HashMap<String, Variable>,
 
     /// Configuration for the application components.
     #[serde(rename = "component")]
diff --git a/crates/loader/src/local/mod.rs b/crates/loader/src/local/mod.rs
index cc7ffb5ba7..5900ab87da 100644
--- a/crates/loader/src/local/mod.rs
+++ b/crates/loader/src/local/mod.rs
@@ -10,21 +10,20 @@ pub mod config;
 #[cfg(test)]
 mod tests;
 
+use std::{path::Path, str::FromStr};
+
 use anyhow::{anyhow, bail, Context, Result};
 use config::{RawAppInformation, RawAppManifest, RawAppManifestAnyVersion, RawComponentManifest};
 use futures::future;
+use outbound_http::allowed_http_hosts::validate_allowed_http_hosts;
 use path_absolutize::Absolutize;
 use spin_manifest::{
     Application, ApplicationInformation, ApplicationOrigin, CoreComponent, ModuleSource,
     SpinVersion, WasmConfig,
 };
-use std::{path::Path, str::FromStr, sync::Arc};
 use tokio::{fs::File, io::AsyncReadExt};
 
-use crate::{
-    bindle::BindleConnectionInfo,
-    validation::{parse_allowed_http_hosts, validate_allowed_http_hosts},
-};
+use crate::bindle::BindleConnectionInfo;
 
 /// Given the path to a spin.toml manifest file, prepare its assets locally and
 /// get a prepared application configuration consumable by a Spin execution context.
@@ -34,7 +33,6 @@ pub async fn from_file(
     app: impl AsRef<Path>,
     base_dst: impl AsRef<Path>,
     bindle_connection: &Option<BindleConnectionInfo>,
-    allow_transient_write: bool,
 ) -> Result<Application> {
     let app = app
         .as_ref()
@@ -43,14 +41,7 @@ pub async fn from_file(
     let manifest = raw_manifest_from_file(&app).await?;
     validate_raw_app_manifest(&manifest)?;
 
-    prepare_any_version(
-        manifest,
-        app,
-        base_dst,
-        bindle_connection,
-        allow_transient_write,
-    )
-    .await
+    prepare_any_version(manifest, app, base_dst, bindle_connection).await
 }
 
 /// Reads the spin.toml file as a raw manifest.
@@ -74,12 +65,9 @@ async fn prepare_any_version(
     src: impl AsRef<Path>,
     base_dst: impl AsRef<Path>,
     bindle_connection: &Option<BindleConnectionInfo>,
-    allow_transient_write: bool,
 ) -> Result<Application> {
     match raw {
-        RawAppManifestAnyVersion::V1(raw) => {
-            prepare(raw, src, base_dst, bindle_connection, allow_transient_write).await
-        }
+        RawAppManifestAnyVersion::V1(raw) => prepare(raw, src, base_dst, bindle_connection).await,
     }
 }
 
@@ -101,11 +89,9 @@ fn error_on_duplicate_ids(components: Vec<RawComponentManifest>) -> Result<()> {
 pub fn validate_raw_app_manifest(raw: &RawAppManifestAnyVersion) -> Result<()> {
     match raw {
         RawAppManifestAnyVersion::V1(raw) => {
-            let _ = raw
-                .components
+            raw.components
                 .iter()
-                .map(|c| validate_allowed_http_hosts(&c.wasm.allowed_http_hosts))
-                .collect::<Result<Vec<_>>>()?;
+                .try_for_each(|c| validate_allowed_http_hosts(&c.wasm.allowed_http_hosts))?;
         }
     }
     Ok(())
@@ -113,27 +99,15 @@ pub fn validate_raw_app_manifest(raw: &RawAppManifestAnyVersion) -> Result<()> {
 
 /// Converts a raw application manifest into Spin configuration.
 async fn prepare(
-    mut raw: RawAppManifest,
+    raw: RawAppManifest,
     src: impl AsRef<Path>,
     base_dst: impl AsRef<Path>,
     bindle_connection: &Option<BindleConnectionInfo>,
-    allow_transient_write: bool,
 ) -> Result<Application> {
     let info = info(raw.info, &src);
 
     error_on_duplicate_ids(raw.components.clone())?;
 
-    let mut config_root = raw.config.unwrap_or_default();
-    for component in &mut raw.components {
-        if let Some(config) = component.config.take() {
-            let path = component.id.clone().try_into().with_context(|| {
-                format!("component ID {:?} not a valid config path", component.id)
-            })?;
-            config_root.merge_defaults(&path, config)?;
-        }
-    }
-    let config_resolver = Some(Arc::new(spin_config::Resolver::new(config_root)?));
-
     let component_triggers = raw
         .components
         .iter()
@@ -143,9 +117,7 @@ async fn prepare(
     let components = future::join_all(
         raw.components
             .into_iter()
-            .map(|c| async {
-                core(c, &src, &base_dst, bindle_connection, allow_transient_write).await
-            })
+            .map(|c| async { core(c, &src, &base_dst, bindle_connection).await })
             .collect::<Vec<_>>(),
     )
     .await
@@ -153,11 +125,13 @@ async fn prepare(
     .collect::<Result<Vec<_>>>()
     .context("Failed to prepare configuration")?;
 
+    let variables = raw.variables;
+
     Ok(Application {
         info,
         components,
         component_triggers,
-        config_resolver,
+        variables,
     })
 }
 
@@ -167,7 +141,6 @@ async fn core(
     src: impl AsRef<Path>,
     base_dst: impl AsRef<Path>,
     bindle_connection: &Option<BindleConnectionInfo>,
-    allow_transient_write: bool,
 ) -> Result<CoreComponent> {
     let id = raw.id;
 
@@ -215,30 +188,24 @@ async fn core(
     let mounts = match raw.wasm.files {
         Some(f) => {
             let exclude_files = raw.wasm.exclude_files.unwrap_or_default();
-            assets::prepare_component(
-                &f,
-                src,
-                &base_dst,
-                &id,
-                allow_transient_write,
-                &exclude_files,
-            )
-            .await?
+            assets::prepare_component(&f, src, &base_dst, &id, &exclude_files).await?
         }
         None => vec![],
     };
     let environment = raw.wasm.environment.unwrap_or_default();
-    let allowed_http_hosts = parse_allowed_http_hosts(&raw.wasm.allowed_http_hosts)?;
+    let allowed_http_hosts = raw.wasm.allowed_http_hosts.unwrap_or_default();
     let wasm = WasmConfig {
         environment,
         mounts,
         allowed_http_hosts,
     };
+    let config = raw.config.unwrap_or_default();
     Ok(CoreComponent {
         source,
         id,
         description,
         wasm,
+        config,
     })
 }
 
diff --git a/crates/loader/src/local/tests.rs b/crates/loader/src/local/tests.rs
index 3ffe3a2abe..ee002d0dac 100644
--- a/crates/loader/src/local/tests.rs
+++ b/crates/loader/src/local/tests.rs
@@ -11,7 +11,7 @@ async fn test_from_local_source() -> Result<()> {
 
     let temp_dir = tempfile::tempdir()?;
     let dir = temp_dir.path();
-    let app = from_file(MANIFEST, dir, &None, false).await?;
+    let app = from_file(MANIFEST, dir, &None).await?;
 
     assert_eq!(app.info.name, "spin-local-source-test");
     assert_eq!(app.info.version, "1.0.0");
@@ -145,7 +145,7 @@ async fn test_duplicate_component_id_is_rejected() -> Result<()> {
 
     let temp_dir = tempfile::tempdir()?;
     let dir = temp_dir.path();
-    let app = from_file(MANIFEST, dir, &None, false).await;
+    let app = from_file(MANIFEST, dir, &None).await;
 
     assert!(
         app.is_err(),
@@ -167,7 +167,7 @@ async fn test_insecure_allow_all_with_invalid_url() -> Result<()> {
 
     let temp_dir = tempfile::tempdir()?;
     let dir = temp_dir.path();
-    let app = from_file(MANIFEST, dir, &None, false).await;
+    let app = from_file(MANIFEST, dir, &None).await;
 
     assert!(
         app.is_ok(),
@@ -183,7 +183,7 @@ async fn test_invalid_url_in_allowed_http_hosts_is_rejected() -> Result<()> {
 
     let temp_dir = tempfile::tempdir()?;
     let dir = temp_dir.path();
-    let app = from_file(MANIFEST, dir, &None, false).await;
+    let app = from_file(MANIFEST, dir, &None).await;
 
     assert!(app.is_err(), "Expected allowed_http_hosts parsing error");
 
diff --git a/crates/manifest/src/lib.rs b/crates/manifest/src/lib.rs
index 2018c88742..58b8a80f94 100644
--- a/crates/manifest/src/lib.rs
+++ b/crates/manifest/src/lib.rs
@@ -4,12 +4,10 @@
 
 use indexmap::IndexMap;
 use serde::{Deserialize, Serialize};
-use spin_config::Resolver;
 use std::{
     collections::HashMap,
     fmt::{Debug, Formatter},
     path::PathBuf,
-    sync::Arc,
 };
 
 /// A trigger error.
@@ -32,8 +30,8 @@ pub struct Application {
     pub components: Vec<CoreComponent>,
     /// Configuration for the components' triggers.
     pub component_triggers: ComponentMap<TriggerConfig>,
-    /// Application-specific configuration resolver.
-    pub config_resolver: Option<Arc<Resolver>>,
+    /// Custom config variables
+    pub variables: HashMap<String, Variable>,
 }
 
 /// Spin API version.
@@ -81,6 +79,8 @@ pub struct CoreComponent {
     pub description: Option<String>,
     /// Per-component WebAssembly configuration.
     pub wasm: WasmConfig,
+    /// Custom config
+    pub config: HashMap<String, String>,
 }
 
 /// The location from which an application was loaded.
@@ -149,70 +149,6 @@ impl TryFrom<ApplicationTrigger> for RedisTriggerConfiguration {
     }
 }
 
-/// An HTTP host allow-list.
-#[derive(Clone, Debug, Eq, PartialEq)]
-pub enum AllowedHttpHosts {
-    /// All HTTP hosts are allowed (the "insecure:allow-all" value was present in the list)
-    AllowAll,
-    /// Only the specified hosts are allowed.
-    AllowSpecific(Vec<AllowedHttpHost>),
-}
-
-impl Default for AllowedHttpHosts {
-    fn default() -> Self {
-        Self::AllowSpecific(vec![])
-    }
-}
-
-impl AllowedHttpHosts {
-    /// Tests whether the given URL is allowed according to the allow-list.
-    pub fn allow(&self, url: &url::Url) -> bool {
-        match self {
-            Self::AllowAll => true,
-            Self::AllowSpecific(hosts) => hosts.iter().any(|h| h.allow(url)),
-        }
-    }
-}
-
-/// An HTTP host allow-list entry.
-#[derive(Clone, Debug, Default, Eq, PartialEq)]
-pub struct AllowedHttpHost {
-    domain: String,
-    port: Option<u16>,
-}
-
-impl AllowedHttpHost {
-    /// Creates a new allow-list entry.
-    pub fn new(name: impl Into<String>, port: Option<u16>) -> Self {
-        Self {
-            domain: name.into(),
-            port,
-        }
-    }
-
-    /// An allow-list entry that specifies a host and allows the default port.
-    pub fn host(name: impl Into<String>) -> Self {
-        Self {
-            domain: name.into(),
-            port: None,
-        }
-    }
-
-    /// An allow-list entry that specifies a host and port.
-    pub fn host_and_port(name: impl Into<String>, port: u16) -> Self {
-        Self {
-            domain: name.into(),
-            port: Some(port),
-        }
-    }
-
-    fn allow(&self, url: &url::Url) -> bool {
-        (url.scheme() == "http" || url.scheme() == "https")
-            && self.domain == url.host_str().unwrap_or_default()
-            && self.port == url.port()
-    }
-}
-
 /// WebAssembly configuration.
 #[derive(Clone, Debug, Default)]
 pub struct WasmConfig {
@@ -221,7 +157,7 @@ pub struct WasmConfig {
     /// List of directory mounts that need to be mapped inside the WebAssembly module.
     pub mounts: Vec<DirectoryMount>,
     /// Optional list of HTTP hosts the component is allowed to connect.
-    pub allowed_http_hosts: AllowedHttpHosts,
+    pub allowed_http_hosts: Vec<String>,
 }
 
 /// Directory mount for the assets of a component.
@@ -389,3 +325,18 @@ impl TryFrom<TriggerConfig> for RedisConfig {
         }
     }
 }
+
+/// Custom configuration variable
+#[derive(Clone, Debug, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
+pub struct Variable {
+    /// If true, this variable is required by the application.
+    #[serde(default)]
+    pub required: bool,
+    /// Default value for this variable; must be specified iff `required` is false
+    #[serde(default)]
+    pub default: Option<String>,
+    /// If true, this variable may contain sensitive information and shouldn't be e.g. logged.
+    #[serde(default)]
+    pub secret: bool,
+}
diff --git a/crates/outbound-http/Cargo.toml b/crates/outbound-http/Cargo.toml
index 7c0ed02bcb..40ec53b021 100644
--- a/crates/outbound-http/Cargo.toml
+++ b/crates/outbound-http/Cargo.toml
@@ -1,5 +1,5 @@
 [package]
-name = "wasi-outbound-http"
+name = "outbound-http"
 version = "0.2.0"
 edition = "2021"
 authors = ["Fermyon Engineering <engineering@fermyon.com>"]
@@ -10,13 +10,16 @@ doctest = false
 [dependencies]
 anyhow  = "1.0"
 bytes = "1"
-futures = "0.3"
 http = "0.2"
 reqwest = { version = "0.11", default-features = true, features = [ "json", "blocking" ] }
-spin-engine = { path = "../engine" }
-spin-manifest = { path = "../manifest" }
-tokio = { version = "1.4.0", features = [ "full" ] }
+spin-app = { path = "../app" }
+spin-core = { path = "../core" }
 tracing = { version = "0.1", features = [ "log" ] }
 tracing-futures = "0.2"
 url = "2.2.1"
-wit-bindgen-wasmtime = { git = "https://github.com/bytecodealliance/wit-bindgen", rev = "cb871cfa1ee460b51eb1d144b175b9aab9c50aba" }
+
+[dependencies.wit-bindgen-wasmtime]
+git = "https://github.com/bytecodealliance/wit-bindgen"
+rev = "cb871cfa1ee460b51eb1d144b175b9aab9c50aba"
+features = ["async"]
+
diff --git a/crates/loader/src/validation.rs b/crates/outbound-http/src/allowed_http_hosts.rs
similarity index 81%
rename from crates/loader/src/validation.rs
rename to crates/outbound-http/src/allowed_http_hosts.rs
index 5ddf4c1fb3..4378ac1cdd 100644
--- a/crates/loader/src/validation.rs
+++ b/crates/outbound-http/src/allowed_http_hosts.rs
@@ -1,8 +1,71 @@
-#![deny(missing_docs)]
-
 use anyhow::{anyhow, Result};
 use reqwest::Url;
-use spin_manifest::{AllowedHttpHost, AllowedHttpHosts};
+
+const ALLOW_ALL_HOSTS: &str = "insecure:allow-all";
+
+/// An HTTP host allow-list.
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub enum AllowedHttpHosts {
+    /// All HTTP hosts are allowed (the "insecure:allow-all" value was present in the list)
+    AllowAll,
+    /// Only the specified hosts are allowed.
+    AllowSpecific(Vec<AllowedHttpHost>),
+}
+
+impl Default for AllowedHttpHosts {
+    fn default() -> Self {
+        Self::AllowSpecific(vec![])
+    }
+}
+
+impl AllowedHttpHosts {
+    /// Tests whether the given URL is allowed according to the allow-list.
+    pub fn allow(&self, url: &url::Url) -> bool {
+        match self {
+            Self::AllowAll => true,
+            Self::AllowSpecific(hosts) => hosts.iter().any(|h| h.allow(url)),
+        }
+    }
+}
+
+/// An HTTP host allow-list entry.
+#[derive(Clone, Debug, Default, Eq, PartialEq)]
+pub struct AllowedHttpHost {
+    domain: String,
+    port: Option<u16>,
+}
+
+impl AllowedHttpHost {
+    /// Creates a new allow-list entry.
+    pub fn new(name: impl Into<String>, port: Option<u16>) -> Self {
+        Self {
+            domain: name.into(),
+            port,
+        }
+    }
+
+    /// An allow-list entry that specifies a host and allows the default port.
+    pub fn host(name: impl Into<String>) -> Self {
+        Self {
+            domain: name.into(),
+            port: None,
+        }
+    }
+
+    /// An allow-list entry that specifies a host and port.
+    pub fn host_and_port(name: impl Into<String>, port: u16) -> Self {
+        Self {
+            domain: name.into(),
+            port: Some(port),
+        }
+    }
+
+    fn allow(&self, url: &url::Url) -> bool {
+        (url.scheme() == "http" || url.scheme() == "https")
+            && self.domain == url.host_str().unwrap_or_default()
+            && self.port == url.port()
+    }
+}
 
 // Checks a list of allowed HTTP hosts is valid
 pub fn validate_allowed_http_hosts(http_hosts: &Option<Vec<String>>) -> Result<()> {
@@ -14,10 +77,7 @@ pub fn parse_allowed_http_hosts(raw: &Option<Vec<String>>) -> Result<AllowedHttp
     match raw {
         None => Ok(AllowedHttpHosts::AllowSpecific(vec![])),
         Some(list) => {
-            if list
-                .iter()
-                .any(|domain| domain == wasi_outbound_http::ALLOW_ALL_HOSTS)
-            {
+            if list.iter().any(|domain| domain == ALLOW_ALL_HOSTS) {
                 Ok(AllowedHttpHosts::AllowAll)
             } else {
                 let parse_results = list
diff --git a/crates/outbound-http/src/host_component.rs b/crates/outbound-http/src/host_component.rs
index c3aa252a91..ecb857fbf0 100644
--- a/crates/outbound-http/src/host_component.rs
+++ b/crates/outbound-http/src/host_component.rs
@@ -1,30 +1,39 @@
 use anyhow::Result;
-use wit_bindgen_wasmtime::wasmtime::Linker;
 
-use spin_engine::{
-    host_component::{HostComponent, HostComponentsStateHandle},
-    RuntimeContext,
-};
-use spin_manifest::CoreComponent;
+use spin_app::DynamicHostComponent;
+use spin_core::{Data, HostComponent, Linker};
 
-use crate::OutboundHttp;
+use crate::{allowed_http_hosts::parse_allowed_http_hosts, OutboundHttp};
 
 pub struct OutboundHttpComponent;
 
+pub const ALLOWED_HTTP_HOSTS_METADATA_KEY: &str = "allowed_http_hosts";
+
 impl HostComponent for OutboundHttpComponent {
-    type State = OutboundHttp;
+    type Data = OutboundHttp;
 
-    fn add_to_linker<T>(
-        linker: &mut Linker<RuntimeContext<T>>,
-        data_handle: HostComponentsStateHandle<Self::State>,
+    fn add_to_linker<T: Send>(
+        linker: &mut Linker<T>,
+        get: impl Fn(&mut Data<T>) -> &mut Self::Data + Send + Sync + Copy + 'static,
     ) -> Result<()> {
-        crate::add_to_linker(linker, move |ctx| data_handle.get_mut(ctx))?;
-        Ok(())
+        super::wasi_outbound_http::add_to_linker(linker, get)
+    }
+
+    fn build_data(&self) -> Self::Data {
+        Default::default()
     }
+}
 
-    fn build_state(&self, component: &CoreComponent) -> Result<Self::State> {
-        Ok(OutboundHttp {
-            allowed_hosts: component.wasm.allowed_http_hosts.clone(),
-        })
+impl DynamicHostComponent for OutboundHttpComponent {
+    fn update_data(
+        &self,
+        data: &mut Self::Data,
+        component: &spin_app::AppComponent,
+    ) -> anyhow::Result<()> {
+        let hosts = component
+            .get_metadata(ALLOWED_HTTP_HOSTS_METADATA_KEY)
+            .transpose()?;
+        data.allowed_hosts = parse_allowed_http_hosts(&hosts)?;
+        Ok(())
     }
 }
diff --git a/crates/outbound-http/src/lib.rs b/crates/outbound-http/src/lib.rs
index b7d891fd6d..b6fe1067fa 100644
--- a/crates/outbound-http/src/lib.rs
+++ b/crates/outbound-http/src/lib.rs
@@ -1,19 +1,17 @@
+pub mod allowed_http_hosts;
 mod host_component;
 
-use futures::executor::block_on;
+use std::str::FromStr;
+
 use http::HeaderMap;
 use reqwest::{Client, Url};
-use spin_manifest::AllowedHttpHosts;
-use std::str::FromStr;
-use tokio::runtime::Handle;
-use wasi_outbound_http::*;
+use spin_app::async_trait;
 
+use allowed_http_hosts::AllowedHttpHosts;
 pub use host_component::OutboundHttpComponent;
-pub use wasi_outbound_http::add_to_linker;
-
-wit_bindgen_wasmtime::export!("../../wit/ephemeral/wasi-outbound-http.wit");
 
-pub const ALLOW_ALL_HOSTS: &str = "insecure:allow-all";
+wit_bindgen_wasmtime::export!({paths: ["../../wit/ephemeral/wasi-outbound-http.wit"], async: *});
+use wasi_outbound_http::*;
 
 /// A very simple implementation for outbound HTTP requests.
 #[derive(Default, Clone)]
@@ -37,8 +35,9 @@ impl OutboundHttp {
     }
 }
 
+#[async_trait]
 impl wasi_outbound_http::WasiOutboundHttp for OutboundHttp {
-    fn request(&mut self, req: Request) -> Result<Response, HttpError> {
+    async fn request(&mut self, req: Request<'_>) -> Result<Response, HttpError> {
         if !self.is_allowed(req.uri)? {
             tracing::log::info!("Destination not allowed: {}", req.uri);
             return Err(HttpError::DestinationNotAllowed);
@@ -53,61 +52,39 @@ impl wasi_outbound_http::WasiOutboundHttp for OutboundHttp {
             tracing::log::warn!("HTTP params field is deprecated");
         }
 
-        match Handle::try_current() {
-            // If running in a Tokio runtime, spawn a new blocking executor
-            // that will send the HTTP request, and block on its execution.
-            // This attempts to avoid any deadlocks from other operations
-            // already executing on the same executor (compared with just
-            // blocking on the current one).
-            Ok(r) => block_on(r.spawn_blocking(move || -> Result<Response, HttpError> {
-                let client = Client::builder().build().unwrap();
-                let res = block_on(
-                    client
-                        .request(method, url)
-                        .headers(headers)
-                        .body(body)
-                        .send(),
-                );
-                let res = log_request_error(res)?;
-                Response::try_from(res)
-            }))
-            .map_err(|_| HttpError::RuntimeError)?,
-            Err(_) => {
-                let res = reqwest::blocking::Client::new()
-                    .request(method, url)
-                    .headers(headers)
-                    .body(body)
-                    .send();
-                let res = log_request_error(res)?;
-                Ok(Response::try_from(res)?)
-            }
-        }
+        let client = Client::builder().build().unwrap();
+        let resp = client
+            .request(method, url)
+            .headers(headers)
+            .body(body)
+            .send()
+            .await
+            .map_err(log_reqwest_error)?;
+        Response::from_reqwest(resp).await
     }
 }
 
-fn log_request_error<R>(response: Result<R, reqwest::Error>) -> Result<R, reqwest::Error> {
-    if let Err(e) = &response {
-        let error_desc = if e.is_timeout() {
-            "timeout error"
-        } else if e.is_connect() {
-            "connection error"
-        } else if e.is_body() || e.is_decode() {
-            "message body error"
-        } else if e.is_request() {
-            "request error"
-        } else {
-            "error"
-        };
-        tracing::warn!(
-            "Outbound HTTP {}: URL {}, error detail {:?}",
-            error_desc,
-            e.url()
-                .map(|u| u.to_string())
-                .unwrap_or_else(|| "<unknown>".to_owned()),
-            e
-        );
-    }
-    response
+fn log_reqwest_error(err: reqwest::Error) -> HttpError {
+    let error_desc = if err.is_timeout() {
+        "timeout error"
+    } else if err.is_connect() {
+        "connection error"
+    } else if err.is_body() || err.is_decode() {
+        "message body error"
+    } else if err.is_request() {
+        "request error"
+    } else {
+        "error"
+    };
+    tracing::warn!(
+        "Outbound HTTP {}: URL {}, error detail {:?}",
+        error_desc,
+        err.url()
+            .map(|u| u.to_string())
+            .unwrap_or_else(|| "<unknown>".to_owned()),
+        err
+    );
+    HttpError::RuntimeError
 }
 
 impl From<Method> for http::Method {
@@ -124,30 +101,12 @@ impl From<Method> for http::Method {
     }
 }
 
-impl TryFrom<reqwest::Response> for Response {
-    type Error = HttpError;
-
-    fn try_from(res: reqwest::Response) -> Result<Self, Self::Error> {
+impl Response {
+    async fn from_reqwest(res: reqwest::Response) -> Result<Self, HttpError> {
         let status = res.status().as_u16();
         let headers = response_headers(res.headers())?;
 
-        let body = Some(block_on(res.bytes())?.to_vec());
-
-        Ok(Response {
-            status,
-            headers,
-            body,
-        })
-    }
-}
-
-impl TryFrom<reqwest::blocking::Response> for Response {
-    type Error = HttpError;
-
-    fn try_from(res: reqwest::blocking::Response) -> Result<Self, Self::Error> {
-        let status = res.status().as_u16();
-        let headers = response_headers(res.headers())?;
-        let body = Some(res.bytes()?.to_vec());
+        let body = Some(res.bytes().await?.to_vec());
 
         Ok(Response {
             status,
diff --git a/crates/outbound-pg/Cargo.toml b/crates/outbound-pg/Cargo.toml
index 769ec0318b..98019831b5 100644
--- a/crates/outbound-pg/Cargo.toml
+++ b/crates/outbound-pg/Cargo.toml
@@ -9,7 +9,10 @@ doctest = false
 [dependencies]
 anyhow = "1.0"
 postgres = { version = "0.19.3" }
-spin-engine = { path = "../engine" }
-spin-manifest = { path = "../manifest" }
+spin-core = { path = "../core" }
 tracing = { version = "0.1", features = [ "log" ] }
-wit-bindgen-wasmtime = { git = "https://github.com/bytecodealliance/wit-bindgen", rev = "cb871cfa1ee460b51eb1d144b175b9aab9c50aba" }
+
+[dependencies.wit-bindgen-wasmtime]
+git = "https://github.com/bytecodealliance/wit-bindgen"
+rev = "cb871cfa1ee460b51eb1d144b175b9aab9c50aba"
+features = ["async"]
\ No newline at end of file
diff --git a/crates/outbound-pg/src/lib.rs b/crates/outbound-pg/src/lib.rs
index 213706c836..63ca64f07b 100644
--- a/crates/outbound-pg/src/lib.rs
+++ b/crates/outbound-pg/src/lib.rs
@@ -1,40 +1,33 @@
 use anyhow::anyhow;
-use outbound_pg::*;
 use postgres::{types::ToSql, types::Type, Client, NoTls, Row};
+use spin_core::HostComponent;
+use wit_bindgen_wasmtime::async_trait;
 
-pub use outbound_pg::add_to_linker;
-use spin_engine::{
-    host_component::{HostComponent, HostComponentsStateHandle},
-    RuntimeContext,
-};
-use wit_bindgen_wasmtime::wasmtime::Linker;
-
-wit_bindgen_wasmtime::export!("../../wit/ephemeral/outbound-pg.wit");
+wit_bindgen_wasmtime::export!({paths: ["../../wit/ephemeral/outbound-pg.wit"], async: *});
+use outbound_pg::{Column, DbDataType, DbValue, ParameterValue, PgError, RowSet};
 
 /// A simple implementation to support outbound pg connection
 #[derive(Default, Clone)]
 pub struct OutboundPg;
 
 impl HostComponent for OutboundPg {
-    type State = Self;
+    type Data = Self;
 
-    fn add_to_linker<T>(
-        linker: &mut Linker<RuntimeContext<T>>,
-        state_handle: HostComponentsStateHandle<Self::State>,
+    fn add_to_linker<T: Send>(
+        linker: &mut spin_core::Linker<T>,
+        get: impl Fn(&mut spin_core::Data<T>) -> &mut Self::Data + Send + Sync + Copy + 'static,
     ) -> anyhow::Result<()> {
-        add_to_linker(linker, move |ctx| state_handle.get_mut(ctx))
+        outbound_pg::add_to_linker(linker, get)
     }
 
-    fn build_state(
-        &self,
-        _component: &spin_manifest::CoreComponent,
-    ) -> anyhow::Result<Self::State> {
-        Ok(Self)
+    fn build_data(&self) -> Self::Data {
+        Default::default()
     }
 }
 
+#[async_trait]
 impl outbound_pg::OutboundPg for OutboundPg {
-    fn execute(
+    async fn execute(
         &mut self,
         address: &str,
         statement: &str,
@@ -56,7 +49,7 @@ impl outbound_pg::OutboundPg for OutboundPg {
         Ok(nrow)
     }
 
-    fn query(
+    async fn query(
         &mut self,
         address: &str,
         statement: &str,
diff --git a/crates/outbound-redis/Cargo.toml b/crates/outbound-redis/Cargo.toml
index 7e65bea559..ae219255c1 100644
--- a/crates/outbound-redis/Cargo.toml
+++ b/crates/outbound-redis/Cargo.toml
@@ -8,10 +8,13 @@ doctest = false
 
 [dependencies]
 anyhow = "1.0"
-owning_ref = "0.4.1"
-redis = { version = "0.21", features = [ "tokio-comp" ] }
-spin-engine = { path = "../engine" }
-spin-manifest = { path = "../manifest" }
-tracing = { version = "0.1", features = [ "log" ] }
+redis = { version = "0.21", features = ["tokio-comp"] }
+spin-core = { path = "../core" }
+tokio = { version = "1", features = ["sync"] }
+tracing = { version = "0.1", features = ["log"] }
 tracing-futures = "0.2"
-wit-bindgen-wasmtime = { git = "https://github.com/bytecodealliance/wit-bindgen", rev = "cb871cfa1ee460b51eb1d144b175b9aab9c50aba" }
\ No newline at end of file
+
+[dependencies.wit-bindgen-wasmtime]
+git = "https://github.com/bytecodealliance/wit-bindgen"
+rev = "cb871cfa1ee460b51eb1d144b175b9aab9c50aba"
+features = ["async"]
\ No newline at end of file
diff --git a/crates/outbound-redis/src/lib.rs b/crates/outbound-redis/src/lib.rs
index 60c114ae49..8309faf884 100644
--- a/crates/outbound-redis/src/lib.rs
+++ b/crates/outbound-redis/src/lib.rs
@@ -1,116 +1,84 @@
-use outbound_redis::*;
-use owning_ref::RwLockReadGuardRef;
-use redis::Commands;
-use std::{
-    collections::HashMap,
-    sync::{Arc, Mutex, RwLock},
-};
+use std::{collections::HashMap, sync::Arc};
 
-pub use outbound_redis::add_to_linker;
-use spin_engine::{
-    host_component::{HostComponent, HostComponentsStateHandle},
-    RuntimeContext,
-};
-use wit_bindgen_wasmtime::wasmtime::Linker;
+use anyhow::Result;
+use redis::{aio::Connection, AsyncCommands};
+use spin_core::{HostComponent, Linker};
+use tokio::sync::{Mutex, RwLock};
+use wit_bindgen_wasmtime::async_trait;
 
-wit_bindgen_wasmtime::export!("../../wit/ephemeral/outbound-redis.wit");
+wit_bindgen_wasmtime::export!({paths: ["../../wit/ephemeral/outbound-redis.wit"], async: *});
+use outbound_redis::Error;
 
-/// A simple implementation to support outbound Redis commands.
+#[derive(Clone, Default)]
 pub struct OutboundRedis {
-    pub connections: Arc<RwLock<HashMap<String, Mutex<redis::Connection>>>>,
+    connections: Arc<RwLock<HashMap<String, Arc<Mutex<Connection>>>>>,
 }
 
 impl HostComponent for OutboundRedis {
-    type State = Self;
+    type Data = Self;
 
-    fn add_to_linker<T>(
-        linker: &mut Linker<RuntimeContext<T>>,
-        state_handle: HostComponentsStateHandle<Self::State>,
+    fn add_to_linker<T: Send>(
+        linker: &mut Linker<T>,
+        get: impl Fn(&mut spin_core::Data<T>) -> &mut Self::Data + Send + Sync + Copy + 'static,
     ) -> anyhow::Result<()> {
-        add_to_linker(linker, move |ctx| state_handle.get_mut(ctx))
+        crate::outbound_redis::add_to_linker(linker, get)
     }
 
-    fn build_state(&self, component: &spin_manifest::CoreComponent) -> anyhow::Result<Self::State> {
-        let mut conn_map = HashMap::new();
-        if let Some(address) = component.wasm.environment.get("REDIS_ADDRESS") {
-            let client = redis::Client::open(address.to_string())?;
-            let conn = client.get_connection()?;
-            conn_map.insert(address.to_owned(), Mutex::new(conn));
-        }
-        Ok(Self {
-            connections: Arc::new(RwLock::new(conn_map)),
-        })
+    fn build_data(&self) -> Self::Data {
+        self.clone()
     }
 }
 
+#[async_trait]
 impl outbound_redis::OutboundRedis for OutboundRedis {
-    fn publish(&mut self, address: &str, channel: &str, payload: &[u8]) -> Result<(), Error> {
-        let conn_map = self.get_reused_conn_map(address)?;
-        let mut conn = conn_map
-            .get(address)
-            .unwrap()
-            .lock()
-            .map_err(|_| Error::Error)?;
-        conn.publish(channel, payload).map_err(|_| Error::Error)?;
+    async fn publish(&mut self, address: &str, channel: &str, payload: &[u8]) -> Result<(), Error> {
+        let conn = self.get_conn(address).await.map_err(log_error)?;
+        conn.lock()
+            .await
+            .publish(channel, payload)
+            .await
+            .map_err(log_error)?;
         Ok(())
     }
 
-    fn get(&mut self, address: &str, key: &str) -> Result<Vec<u8>, Error> {
-        let conn_map = self.get_reused_conn_map(address)?;
-        let mut conn = conn_map
-            .get(address)
-            .unwrap()
-            .lock()
-            .map_err(|_| Error::Error)?;
-        let value = conn.get(key).map_err(|_| Error::Error)?;
+    async fn get(&mut self, address: &str, key: &str) -> Result<Vec<u8>, Error> {
+        let conn = self.get_conn(address).await.map_err(log_error)?;
+        let value = conn.lock().await.get(key).await.map_err(log_error)?;
         Ok(value)
     }
 
-    fn set(&mut self, address: &str, key: &str, value: &[u8]) -> Result<(), Error> {
-        let conn_map = self.get_reused_conn_map(address)?;
-        let mut conn = conn_map
-            .get(address)
-            .unwrap()
-            .lock()
-            .map_err(|_| Error::Error)?;
-        conn.set(key, value).map_err(|_| Error::Error)?;
+    async fn set(&mut self, address: &str, key: &str, value: &[u8]) -> Result<(), Error> {
+        let conn = self.get_conn(address).await.map_err(log_error)?;
+        conn.lock().await.set(key, value).await.map_err(log_error)?;
         Ok(())
     }
 
-    fn incr(&mut self, address: &str, key: &str) -> Result<i64, Error> {
-        let conn_map = self.get_reused_conn_map(address)?;
-        let mut conn = conn_map
-            .get(address)
-            .unwrap()
-            .lock()
-            .map_err(|_| Error::Error)?;
-        let value = conn.incr(key, 1).map_err(|_| Error::Error)?;
+    async fn incr(&mut self, address: &str, key: &str) -> Result<i64, Error> {
+        let conn = self.get_conn(address).await.map_err(log_error)?;
+        let value = conn.lock().await.incr(key, 1).await.map_err(log_error)?;
         Ok(value)
     }
 }
 
 impl OutboundRedis {
-    fn get_reused_conn_map<'ret, 'me: 'ret, 'c>(
-        &'me mut self,
-        address: &'c str,
-    ) -> Result<RwLockReadGuardRef<'ret, HashMap<String, Mutex<redis::Connection>>>, Error> {
-        let conn_map = self.connections.read().map_err(|_| Error::Error)?;
-        if conn_map.get(address).is_some() {
-            tracing::debug!("Reuse connection: {:?}", address);
-            return Ok(RwLockReadGuardRef::new(conn_map));
-        }
-        // Get rid of our read lock
-        drop(conn_map);
-
-        let mut conn_map = self.connections.write().map_err(|_| Error::Error)?;
-        let client = redis::Client::open(address).map_err(|_| Error::Error)?;
-        let conn = client.get_connection().map_err(|_| Error::Error)?;
-        tracing::debug!("Build new connection: {:?}", address);
-        conn_map.insert(address.to_string(), Mutex::new(conn));
-        // Get rid of our write lock
-        drop(conn_map);
-
-        let conn_map = self.connections.read().map_err(|_| Error::Error)?;
-        Ok(RwLockReadGuardRef::new(conn_map))
+    async fn get_conn(&self, address: &str) -> Result<Arc<Mutex<Connection>>> {
+        let conn_map = self.connections.read().await;
+        let conn = if let Some(conn) = conn_map.get(address) {
+            conn.clone()
+        } else {
+            let conn = redis::Client::open(address)?.get_async_connection().await?;
+            let conn = Arc::new(Mutex::new(conn));
+            self.connections
+                .write()
+                .await
+                .insert(address.to_string(), conn.clone());
+            conn
+        };
+        Ok(conn)
     }
 }
+
+fn log_error(err: impl std::fmt::Debug) -> Error {
+    tracing::warn!("Outbound Redis error: {err:?}");
+    Error::Error
+}
diff --git a/crates/publish/src/expander.rs b/crates/publish/src/expander.rs
index 7dc58dccb6..543eb65d89 100644
--- a/crates/publish/src/expander.rs
+++ b/crates/publish/src/expander.rs
@@ -89,12 +89,12 @@ fn bindle_manifest(
         .collect::<Result<Vec<_>>>()
         .context("Failed to convert components to Bindle format")?;
     let trigger = local.info.trigger.clone();
-    let config = local.config.clone();
+    let variables = local.variables.clone();
 
     Ok(bindle_schema::RawAppManifest {
         trigger,
+        variables,
         components,
-        config,
     })
 }
 
diff --git a/crates/redis/Cargo.toml b/crates/redis/Cargo.toml
index ccfbe0fe5f..df01d81e39 100644
--- a/crates/redis/Cargo.toml
+++ b/crates/redis/Cargo.toml
@@ -14,14 +14,14 @@ env_logger = "0.9"
 futures = "0.3"
 log = { version = "0.4", default-features = false }
 serde = { version = "1.0", features = [ "derive" ] }
-spin-engine = { path = "../engine" }
+spin-app = { path = "../app" }
+spin-core = { path = "../core" }
 spin-manifest = { path = "../manifest" }
 spin-trigger = { path = "../trigger" }
 redis = { version = "0.21", features = [ "tokio-comp" ] }
 tokio = { version = "1.14", features = [ "full" ] }
 tracing = { version = "0.1", features = [ "log" ] }
 tracing-futures = "0.2"
-tracing-subscriber = { version = "0.3.7", features = [ "env-filter" ] }
 wasi-common = "0.39.1"
 wasmtime = "0.39.1"
 wasmtime-wasi = "0.39.1"
diff --git a/crates/redis/src/lib.rs b/crates/redis/src/lib.rs
index c7183645b4..c7c2c0d7a7 100644
--- a/crates/redis/src/lib.rs
+++ b/crates/redis/src/lib.rs
@@ -2,98 +2,80 @@
 
 mod spin;
 
-use crate::spin::SpinRedisExecutor;
-use anyhow::Result;
+use std::collections::HashMap;
+
+use anyhow::{Context, Result};
 use async_trait::async_trait;
 use futures::StreamExt;
 use redis::{Client, ConnectionLike};
-use spin_manifest::{ComponentMap, RedisConfig, RedisTriggerConfiguration, TriggerConfig};
-use spin_redis::SpinRedisData;
-use spin_trigger::{cli::NoArgs, TriggerExecutor};
-use std::{collections::HashMap, sync::Arc};
+use serde::{de::IgnoredAny, Deserialize, Serialize};
+use spin_trigger::{cli::NoArgs, TriggerAppEngine, TriggerExecutor};
+
+use crate::spin::SpinRedisExecutor;
 
-wit_bindgen_wasmtime::import!("../../wit/ephemeral/spin-redis.wit");
+wit_bindgen_wasmtime::import!({paths: ["../../wit/ephemeral/spin-redis.wit"], async: *});
 
-type ExecutionContext = spin_engine::ExecutionContext<SpinRedisData>;
-type RuntimeContext = spin_engine::RuntimeContext<SpinRedisData>;
+pub(crate) type RuntimeData = spin_redis::SpinRedisData;
+pub(crate) type Store = spin_core::Store<RuntimeData>;
 
 /// The Spin Redis trigger.
-#[derive(Clone)]
 pub struct RedisTrigger {
-    /// Trigger configuration.
-    trigger_config: RedisTriggerConfiguration,
-    /// Component trigger configurations.
-    component_triggers: ComponentMap<RedisConfig>,
-    /// Spin execution context.
-    engine: Arc<ExecutionContext>,
-    /// Map from channel name to tuple of component name & index.
-    subscriptions: HashMap<String, usize>,
+    app_engine: TriggerAppEngine<Self>,
+    // Redis address to connect to
+    address: String,
+    // Mapping of subscription channels to component IDs
+    channel_components: HashMap<String, String>,
 }
 
-pub struct RedisTriggerConfig(String, RedisConfig);
-
-impl TryFrom<(String, TriggerConfig)> for RedisTriggerConfig {
-    type Error = spin_manifest::Error;
-
-    fn try_from((component, config): (String, TriggerConfig)) -> Result<Self, Self::Error> {
-        Ok(RedisTriggerConfig(component, config.try_into()?))
-    }
+#[derive(Clone, Debug, Default, Deserialize, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct RedisTriggerConfig {
+    /// Component ID to invoke
+    pub component: String,
+    /// Channel to subscribe to
+    pub channel: String,
+    /// Trigger executor (currently unused)
+    #[serde(default, skip_serializing)]
+    pub executor: IgnoredAny,
 }
 
 #[async_trait]
 impl TriggerExecutor for RedisTrigger {
-    type GlobalConfig = RedisTriggerConfiguration;
+    const TRIGGER_TYPE: &'static str = "redis";
+    type RuntimeData = RuntimeData;
     type TriggerConfig = RedisTriggerConfig;
     type RunConfig = NoArgs;
-    type RuntimeContext = SpinRedisData;
-
-    fn new(
-        execution_context: ExecutionContext,
-        global_config: Self::GlobalConfig,
-        trigger_configs: impl IntoIterator<Item = Self::TriggerConfig>,
-    ) -> Result<Self> {
-        let component_triggers: ComponentMap<RedisConfig> = trigger_configs
-            .into_iter()
-            .map(|config| (config.0, config.1))
-            .collect();
-        let subscriptions = execution_context
-            .config
-            .components
-            .iter()
-            .enumerate()
-            .filter_map(|(idx, component)| {
-                component_triggers
-                    .get(&component.id)
-                    .map(|redis_config| (redis_config.channel.clone(), idx))
-            })
+
+    fn new(app_engine: TriggerAppEngine<Self>) -> Result<Self> {
+        let address = app_engine
+            .app()
+            .require_metadata("redis_address")
+            .context("Failed to configure Redis trigger")?;
+
+        let channel_components = app_engine
+            .trigger_configs()
+            .map(|(_, config)| (config.channel.clone(), config.component.clone()))
             .collect();
 
         Ok(Self {
-            trigger_config: global_config,
-            component_triggers,
-            engine: Arc::new(execution_context),
-            subscriptions,
+            app_engine,
+            address,
+            channel_components,
         })
     }
 
     /// Run the Redis trigger indefinitely.
     async fn run(self, _config: Self::RunConfig) -> Result<()> {
-        let address = self.trigger_config.address.as_str();
+        let address = &self.address;
 
         log::info!("Connecting to Redis server at {}", address);
         let mut client = Client::open(address.to_string())?;
         let mut pubsub = client.get_async_connection().await?.into_pubsub();
 
         // Subscribe to channels
-        for (subscription, idx) in self.subscriptions.iter() {
-            let name = &self.engine.config.components[*idx].id;
-            log::info!(
-                "Subscribed component #{} ({}) to channel: {}",
-                idx,
-                name,
-                subscription
-            );
-            pubsub.subscribe(subscription).await?;
+        for (channel, component) in self.channel_components.iter() {
+            log::info!("Subscribing component {component:?} to channel {channel:?}");
+            pubsub.subscribe(channel).await?;
         }
 
         let mut stream = pubsub.on_message();
@@ -118,35 +100,17 @@ impl RedisTrigger {
         let channel = msg.get_channel_name();
         log::info!("Received message on channel {:?}", channel);
 
-        if let Some(idx) = self.subscriptions.get(channel).copied() {
-            let component = &self.engine.config.components[idx];
-            let executor = self
-                .component_triggers
-                .get(&component.id)
-                .and_then(|t| t.executor.clone())
-                .unwrap_or_default();
-
-            let follow = self
-                .engine
-                .config
-                .follow_components
-                .should_follow(&component.id);
-
-            match executor {
-                spin_manifest::RedisExecutor::Spin => {
-                    log::trace!("Executing Spin Redis component {}", component.id);
-                    let executor = SpinRedisExecutor;
-                    executor
-                        .execute(
-                            &self.engine,
-                            &component.id,
-                            channel,
-                            msg.get_payload_bytes(),
-                            follow,
-                        )
-                        .await?
-                }
-            };
+        if let Some(component_id) = self.channel_components.get(channel) {
+            log::trace!("Executing Redis component {component_id:?}");
+            let executor = SpinRedisExecutor;
+            executor
+                .execute(
+                    &self.app_engine,
+                    component_id,
+                    channel,
+                    msg.get_payload_bytes(),
+                )
+                .await?
         } else {
             log::debug!("No subscription found for {:?}", channel);
         }
@@ -161,11 +125,10 @@ impl RedisTrigger {
 pub(crate) trait RedisExecutor: Clone + Send + Sync + 'static {
     async fn execute(
         &self,
-        engine: &ExecutionContext,
-        component: &str,
+        app_engine: &TriggerAppEngine<RedisTrigger>,
+        component_id: &str,
         channel: &str,
         payload: &[u8],
-        follow: bool,
     ) -> Result<()>;
 }
 
diff --git a/crates/redis/src/spin.rs b/crates/redis/src/spin.rs
index 694f11812e..5e9fc21fb8 100644
--- a/crates/redis/src/spin.rs
+++ b/crates/redis/src/spin.rs
@@ -1,9 +1,9 @@
-use crate::{spin_redis::SpinRedis, ExecutionContext, RedisExecutor, RuntimeContext};
-use anyhow::Result;
+use anyhow::{anyhow, Result};
 use async_trait::async_trait;
-use spin_engine::io::ModuleIoRedirects;
-use tokio::task::spawn_blocking;
-use wasmtime::{Instance, Store};
+use spin_core::Instance;
+use spin_trigger::TriggerAppEngine;
+
+use crate::{spin_redis::SpinRedis, RedisExecutor, RedisTrigger, Store};
 
 #[derive(Clone)]
 pub struct SpinRedisExecutor;
@@ -12,23 +12,14 @@ pub struct SpinRedisExecutor;
 impl RedisExecutor for SpinRedisExecutor {
     async fn execute(
         &self,
-        engine: &ExecutionContext,
-        component: &str,
+        app_engine: &TriggerAppEngine<RedisTrigger>,
+        component_id: &str,
         channel: &str,
         payload: &[u8],
-        follow: bool,
     ) -> Result<()> {
-        log::trace!(
-            "Executing request using the Spin executor for component {}",
-            component
-        );
-
-        let mior = ModuleIoRedirects::new(follow);
+        let (instance, store) = app_engine.prepare_instance(component_id).await?;
 
-        let (store, instance) =
-            engine.prepare_component(component, None, Some(mior.pipes), None, None)?;
-
-        let result = match Self::execute_impl(store, instance, channel, payload.to_vec()).await {
+        match Self::execute_impl(store, instance, channel, payload.to_vec()).await {
             Ok(()) => {
                 log::trace!("Request finished OK");
                 Ok(())
@@ -37,32 +28,22 @@ impl RedisExecutor for SpinRedisExecutor {
                 log::trace!("Request finished with error {}", e);
                 Err(e)
             }
-        };
-
-        let log_result =
-            engine.save_output_to_logs(mior.read_handles.read(), component, true, true);
-
-        result.and(log_result)
+        }
     }
 }
 
 impl SpinRedisExecutor {
     pub async fn execute_impl(
-        mut store: Store<RuntimeContext>,
+        mut store: Store,
         instance: Instance,
         _channel: &str,
         payload: Vec<u8>,
     ) -> Result<()> {
-        let engine = SpinRedis::new(&mut store, &instance, |host| host.data.as_mut().unwrap())?;
-
-        let _res = spawn_blocking(move || -> Result<crate::spin_redis::Error> {
-            match engine.handle_redis_message(&mut store, &payload) {
-                Ok(_) => Ok(crate::spin_redis::Error::Success),
-                Err(_) => Ok(crate::spin_redis::Error::Error),
-            }
-        })
-        .await??;
+        let engine = SpinRedis::new(&mut store, &instance, |host| host.as_mut())?;
 
-        Ok(())
+        engine
+            .handle_redis_message(&mut store, &payload)
+            .await?
+            .map_err(|err| anyhow!("{err:?}"))
     }
 }
diff --git a/crates/redis/src/tests.rs b/crates/redis/src/tests.rs
index b7e3cf4f8e..bd14171e1d 100644
--- a/crates/redis/src/tests.rs
+++ b/crates/redis/src/tests.rs
@@ -1,21 +1,7 @@
 use super::*;
 use anyhow::Result;
 use redis::{Msg, Value};
-use spin_manifest::{RedisConfig, RedisExecutor};
 use spin_testing::TestConfig;
-use spin_trigger::TriggerExecutorBuilder;
-use std::sync::Once;
-
-static LOGGER: Once = Once::new();
-
-/// We can only initialize the tracing subscriber once per crate.
-pub(crate) fn init() {
-    LOGGER.call_once(|| {
-        tracing_subscriber::fmt()
-            .with_env_filter(tracing_subscriber::EnvFilter::from_default_env())
-            .init();
-    });
-}
 
 fn create_trigger_event(channel: &str, payload: &str) -> redis::Msg {
     Msg::from_value(&redis::Value::Bulk(vec![
@@ -29,17 +15,11 @@ fn create_trigger_event(channel: &str, payload: &str) -> redis::Msg {
 #[ignore]
 #[tokio::test]
 async fn test_pubsub() -> Result<()> {
-    init();
-
-    let mut cfg = TestConfig::default();
-    cfg.test_program("redis-rust.wasm")
-        .redis_trigger(RedisConfig {
-            channel: "messages".to_string(),
-            executor: Some(RedisExecutor::Spin),
-        });
-    let app = cfg.build_application();
-
-    let trigger: RedisTrigger = TriggerExecutorBuilder::new(app).build().await?;
+    let trigger: RedisTrigger = TestConfig::default()
+        .test_program("redis-rust.wasm")
+        .redis_trigger("messages")
+        .build_trigger()
+        .await;
 
     let msg = create_trigger_event("messages", "hello");
     trigger.handle(msg).await?;
diff --git a/crates/testing/Cargo.toml b/crates/testing/Cargo.toml
index f00283a033..34a72300c3 100644
--- a/crates/testing/Cargo.toml
+++ b/crates/testing/Cargo.toml
@@ -8,7 +8,10 @@ authors = ["Fermyon Engineering <engineering@fermyon.com>"]
 anyhow = "1.0"
 http = "0.2"
 hyper = "0.14"
-spin-engine = { path = "../engine" }
-spin-manifest = { path = "../manifest" }
+serde = "1"
+serde_json = "1"
+spin-app = { path = "../app" }
+spin-core = { path = "../core" }
 spin-http-engine = { path = "../http" }
 spin-trigger = { path = "../trigger" }
+tracing-subscriber = { version = "0.3", features = ["env-filter"] }
\ No newline at end of file
diff --git a/crates/testing/src/lib.rs b/crates/testing/src/lib.rs
index 7c4348bc8e..fcfb867509 100644
--- a/crates/testing/src/lib.rs
+++ b/crates/testing/src/lib.rs
@@ -4,23 +4,44 @@
 use std::{
     net::SocketAddr,
     path::{Path, PathBuf},
+    sync::Once,
 };
 
 use http::{uri::Scheme, Request, Response};
 use hyper::Body;
-use spin_engine::{Builder, ExecutionContextConfiguration};
-use spin_http_engine::HttpTrigger;
-use spin_manifest::{
-    Application, ApplicationInformation, ApplicationOrigin, ApplicationTrigger, CoreComponent,
-    HttpConfig, ModuleSource, RedisConfig, RedisTriggerConfiguration, SpinVersion, TriggerConfig,
+use serde::de::DeserializeOwned;
+use spin_app::{
+    async_trait,
+    locked::{LockedApp, LockedComponentSource},
+    AppComponent, Loader,
 };
-use spin_trigger::TriggerExecutorBuilder;
+use spin_core::{Module, StoreBuilder};
+use spin_http_engine::{HttpExecutorType, HttpTrigger, HttpTriggerConfig, WagiTriggerConfig};
+use spin_trigger::{TriggerExecutor, TriggerExecutorBuilder};
+
+static LOGGER: Once = Once::new();
+
+/// We can only initialize the tracing subscriber once per crate.
+pub(crate) fn init() {
+    LOGGER.call_once(|| {
+        tracing_subscriber::fmt()
+            .with_env_filter(tracing_subscriber::EnvFilter::from_default_env())
+            .with_test_writer()
+            .init();
+    });
+}
+
+macro_rules! from_json {
+    ($($json:tt)+) => {
+        serde_json::from_value(serde_json::json!($($json)+)).expect("valid json")
+    };
+}
 
 #[derive(Default)]
 pub struct TestConfig {
     module_path: Option<PathBuf>,
-    application_trigger: Option<ApplicationTrigger>,
-    trigger_config: Option<TriggerConfig>,
+    http_trigger_config: HttpTriggerConfig,
+    redis_channel: String,
 }
 
 impl TestConfig {
@@ -37,84 +58,87 @@ impl TestConfig {
         )
     }
 
-    pub fn http_trigger(&mut self, config: HttpConfig) -> &mut Self {
-        self.application_trigger = Some(ApplicationTrigger::Http(Default::default()));
-        self.trigger_config = Some(TriggerConfig::Http(config));
+    pub fn http_spin_trigger(&mut self, route: impl Into<String>) -> &mut Self {
+        self.http_trigger_config = HttpTriggerConfig {
+            component: "test-component".to_string(),
+            route: route.into(),
+            executor: None,
+        };
         self
     }
 
-    pub fn redis_trigger(&mut self, config: RedisConfig) -> &mut Self {
-        self.application_trigger = Some(ApplicationTrigger::Redis(RedisTriggerConfiguration {
-            address: "redis://localhost:6379".to_owned(),
-        }));
-        self.trigger_config = Some(TriggerConfig::Redis(config));
+    pub fn http_wagi_trigger(
+        &mut self,
+        route: impl Into<String>,
+        wagi_config: WagiTriggerConfig,
+    ) -> &mut Self {
+        self.http_trigger_config = HttpTriggerConfig {
+            component: "test-component".to_string(),
+            route: route.into(),
+            executor: Some(HttpExecutorType::Wagi(wagi_config)),
+        };
         self
     }
 
-    pub fn build_application_information(&self) -> ApplicationInformation {
-        ApplicationInformation {
-            spin_version: SpinVersion::V1,
-            name: "test-app".to_string(),
-            version: "1.0.0".to_string(),
-            description: None,
-            authors: vec![],
-            trigger: self
-                .application_trigger
-                .clone()
-                .expect("http_trigger or redis_trigger required"),
-            namespace: None,
-            origin: ApplicationOrigin::File(
-                PathBuf::from(env!("CARGO_MANIFEST_DIR")).join("fake_spin.toml"),
-            ),
-        }
+    pub fn redis_trigger(&mut self, channel: impl Into<String>) -> &mut Self {
+        self.redis_channel = channel.into();
+        self
     }
 
-    pub fn build_component(&self) -> CoreComponent {
-        let module_path = self
-            .module_path
-            .clone()
-            .expect("module_path or test_program required");
-        CoreComponent {
-            source: ModuleSource::FileReference(module_path),
-            id: "test-component".to_string(),
-            description: None,
-            wasm: Default::default(),
+    pub fn build_locked_app(&self) -> LockedApp {
+        let components = from_json!([{
+            "id": "test-component",
+            "source": {
+                "content_type": "application/wasm",
+                "digest": "test-source",
+            },
+        }]);
+        let triggers = from_json!([
+            {
+                "id": "test-http-trigger",
+                "trigger_type": "http",
+                "trigger_config": self.http_trigger_config,
+            },
+                {
+                "id": "test-redis-trigger",
+                "trigger_type": "redis",
+                "trigger_config": {
+                    "component": "test-component",
+                    "channel": self.redis_channel,
+                },
+            },
+        ]);
+        let metadata = from_json!({"name": "test-app", "redis_address": "test-redis-host"});
+        let variables = Default::default();
+        LockedApp {
+            spin_lock_version: spin_app::locked::FixedVersion,
+            components,
+            triggers,
+            metadata,
+            variables,
         }
     }
 
-    pub fn build_application(&self) -> Application {
-        Application {
-            info: self.build_application_information(),
-            components: vec![self.build_component()],
-            component_triggers: [(
-                "test-component".to_string(),
-                self.trigger_config
-                    .clone()
-                    .expect("http_trigger or redis_trigger required"),
-            )]
-            .into_iter()
-            .collect(),
-            config_resolver: None,
+    pub fn build_loader(&self) -> impl Loader {
+        init();
+        TestLoader {
+            app: self.build_locked_app(),
+            module_path: self.module_path.clone().expect("module path to be set"),
         }
     }
 
-    pub async fn prepare_builder<T: Default + 'static>(&self, app: Application) -> Builder<T> {
-        let config = ExecutionContextConfiguration {
-            components: app.components,
-            label: app.info.name,
-            config_resolver: app.config_resolver,
-            ..Default::default()
-        };
-        let mut builder = Builder::new(config).expect("Builder::new failed");
-        builder.link_defaults().expect("link_defaults failed");
-        builder
+    pub async fn build_trigger<Executor: TriggerExecutor>(&self) -> Executor
+    where
+        Executor::TriggerConfig: DeserializeOwned,
+    {
+        TriggerExecutorBuilder::new(self.build_loader())
+            .build(TEST_APP_URI.to_string())
+            .await
+            .unwrap()
     }
 
     pub async fn build_http_trigger(&self) -> HttpTrigger {
-        TriggerExecutorBuilder::new(self.build_application())
-            .build()
-            .await
-            .unwrap()
+        self.build_trigger().await
     }
 
     pub async fn handle_http_request(&self, req: Request<Body>) -> anyhow::Result<Response<Body>> {
@@ -125,6 +149,39 @@ impl TestConfig {
     }
 }
 
+const TEST_APP_URI: &str = "spin-test:";
+
+struct TestLoader {
+    app: LockedApp,
+    module_path: PathBuf,
+}
+
+#[async_trait]
+impl Loader for TestLoader {
+    async fn load_app(&self, uri: &str) -> anyhow::Result<LockedApp> {
+        assert_eq!(uri, TEST_APP_URI);
+        Ok(self.app.clone())
+    }
+
+    async fn load_module(
+        &self,
+        engine: &spin_core::wasmtime::Engine,
+        source: &LockedComponentSource,
+    ) -> anyhow::Result<spin_core::Module> {
+        assert_eq!(source.content.digest.as_deref(), Some("test-source"),);
+        Module::from_file(engine, &self.module_path)
+    }
+
+    async fn mount_files(
+        &self,
+        _store_builder: &mut StoreBuilder,
+        component: &AppComponent,
+    ) -> anyhow::Result<()> {
+        assert_eq!(component.files().len(), 0, "files testing not implemented");
+        Ok(())
+    }
+}
+
 pub fn test_socket_addr() -> SocketAddr {
     "127.0.0.1:55555".parse().unwrap()
 }
diff --git a/crates/trigger/Cargo.toml b/crates/trigger/Cargo.toml
index 2bf1cd96ee..589ac91231 100644
--- a/crates/trigger/Cargo.toml
+++ b/crates/trigger/Cargo.toml
@@ -9,16 +9,18 @@ anyhow = "1.0"
 async-trait = "0.1"
 clap = { version = "3.1.15", features = ["derive", "env"] }
 ctrlc = { version = "3.2", features = ["termination"] }
-dotenvy = "0.15.1"
+dirs = "4"
 futures = "0.3"
 http = "0.2"
+outbound-http = { path = "../outbound-http" } 
 outbound-redis = { path = "../outbound-redis" }
 outbound-pg = { path = "../outbound-pg" }
+sanitize-filename = "0.4"
 serde = "1.0"
+serde_json = "1.0"
+spin-app = { path = "../app" }
 spin-config = { path = "../config" }
-spin-engine = { path = "../engine" }
+spin-core = { path = "../core" }
 spin-loader = { path = "../loader" }
 spin-manifest = { path = "../manifest" }
-tracing = { version = "0.1", features = [ "log" ] }
-wasi-outbound-http = { path = "../outbound-http" } 
-wasmtime = "0.39.1"
\ No newline at end of file
+tracing = { version = "0.1", features = [ "log" ] }
\ No newline at end of file
diff --git a/crates/trigger/src/cli.rs b/crates/trigger/src/cli.rs
index ca2ff2cc3a..6ca56be4fb 100644
--- a/crates/trigger/src/cli.rs
+++ b/crates/trigger/src/cli.rs
@@ -1,16 +1,10 @@
-use std::{
-    collections::HashMap,
-    error::Error,
-    path::{Path, PathBuf},
-    sync::Arc,
-};
-
-use anyhow::{bail, Context, Result};
+use std::path::PathBuf;
+
+use anyhow::{Context, Result};
 use clap::{Args, IntoApp, Parser};
-use spin_engine::io::FollowComponents;
-use spin_loader::bindle::BindleConnectionInfo;
-use spin_manifest::{Application, ApplicationTrigger, TriggerConfig};
+use serde::de::DeserializeOwned;
 
+use crate::{stdio::FollowComponents, loader::TriggerLoader};
 use crate::{TriggerExecutor, TriggerExecutorBuilder};
 
 pub const APP_LOG_DIR: &str = "APP_LOG_DIR";
@@ -18,6 +12,10 @@ pub const DISABLE_WASMTIME_CACHE: &str = "DISABLE_WASMTIME_CACHE";
 pub const FOLLOW_LOG_OPT: &str = "FOLLOW_ID";
 pub const WASMTIME_CACHE_FILE: &str = "WASMTIME_CACHE_FILE";
 
+// Set by `spin up`
+pub const SPIN_LOCKED_URL: &str = "SPIN_LOCKED_URL";
+pub const SPIN_WORKING_DIR: &str = "SPIN_WORKING_DIR";
+
 /// A command that runs a TriggerExecutor.
 #[derive(Parser, Debug)]
 #[clap(next_help_heading = "TRIGGER OPTIONS")]
@@ -25,10 +23,6 @@ pub struct TriggerExecutorCommand<Executor: TriggerExecutor>
 where
     Executor::RunConfig: Args,
 {
-    /// Pass an environment variable (key=value) to all components of the application.
-    #[clap(long = "env", short = 'e', parse(try_from_str = parse_env_var))]
-    pub env: Vec<(String, String)>,
-
     /// Log directory for the stdout and stderr of components.
     #[clap(
             name = APP_LOG_DIR,
@@ -71,6 +65,10 @@ where
         )]
     pub follow_all_components: bool,
 
+    /// Set the static assets of the components in the temporary directory as writable.
+    #[clap(long = "allow-transient-write")]
+    pub allow_transient_write: bool,
+
     #[clap(flatten)]
     pub run_config: Executor::RunConfig,
 
@@ -86,11 +84,7 @@ pub struct NoArgs;
 impl<Executor: TriggerExecutor> TriggerExecutorCommand<Executor>
 where
     Executor::RunConfig: Args,
-    Executor::GlobalConfig: TryFrom<ApplicationTrigger>,
-    <Executor::GlobalConfig as TryFrom<ApplicationTrigger>>::Error: Error + Send + Sync + 'static,
-    Executor::TriggerConfig: TryFrom<(String, TriggerConfig)>,
-    <Executor::TriggerConfig as TryFrom<(String, TriggerConfig)>>::Error:
-        Error + Send + Sync + 'static,
+    Executor::TriggerConfig: DeserializeOwned,
 {
     /// Create a new TriggerExecutorBuilder from this TriggerExecutorCommand.
     pub async fn run(self) -> Result<()> {
@@ -102,15 +96,22 @@ where
             return Ok(());
         }
 
-        let app = self.build_application().await?;
-        let mut builder = TriggerExecutorBuilder::new(app);
-        self.update_wasmtime_config(builder.wasmtime_config_mut())?;
-        builder.follow_components(self.follow_components());
-        if let Some(log_dir) = self.log {
-            builder.log_dir(log_dir);
-        }
+        // Required env vars
+        let working_dir = std::env::var(SPIN_WORKING_DIR).context(SPIN_WORKING_DIR)?;
+        let locked_url = std::env::var(SPIN_LOCKED_URL).context(SPIN_LOCKED_URL)?;
+
+        let loader = TriggerLoader::new(working_dir, self.allow_transient_write);
+
+        let executor: Executor = {
+            let mut builder = TriggerExecutorBuilder::new(loader);
+            self.update_wasmtime_config(builder.wasmtime_config_mut())?;
+            builder.follow_components(self.follow_components());
+            if let Some(log_dir) = self.log {
+                builder.log_dir(log_dir);
+            }
+            builder.build(locked_url).await?
+        };
 
-        let executor: Executor = builder.build().await?;
         let run_fut = executor.run(self.run_config);
 
         let (abortable, abort_handle) = futures::future::abortable(run_fut);
@@ -130,68 +131,6 @@ where
             }
         }
     }
-}
-
-impl<Executor: TriggerExecutor> TriggerExecutorCommand<Executor>
-where
-    Executor::RunConfig: Args,
-{
-    pub async fn build_application(&self) -> Result<Application> {
-        let working_dir = std::env::var("SPIN_WORKING_DIR").context("SPIN_WORKING_DIR")?;
-        let manifest_url = std::env::var("SPIN_MANIFEST_URL").context("SPIN_MANIFEST_URL")?;
-        let allow_transient_write: bool = std::env::var("SPIN_ALLOW_TRANSIENT_WRITE")
-            .unwrap_or_else(|_| "false".to_string())
-            .trim()
-            .parse()
-            .context("SPIN_ALLOW_TRANSIENT_WRITE")?;
-
-        // TODO(lann): Find a better home for this; spin_loader?
-        let dotenv_path;
-        let mut app = if let Some(manifest_file) = manifest_url.strip_prefix("file://") {
-            dotenv_path = Path::new(manifest_file).parent().unwrap().join(".env");
-            let bindle_connection = std::env::var("BINDLE_URL")
-                .ok()
-                .map(|url| BindleConnectionInfo::new(url, false, None, None));
-            spin_loader::from_file(
-                manifest_file,
-                working_dir,
-                &bindle_connection,
-                allow_transient_write,
-            )
-            .await?
-        } else if let Some(bindle_url) = manifest_url.strip_prefix("bindle+") {
-            dotenv_path = Path::new("./.env").to_path_buf();
-            let (bindle_server, bindle_id) = bindle_url
-                .rsplit_once("?id=")
-                .context("invalid bindle URL")?;
-            spin_loader::from_bindle(bindle_id, bindle_server, working_dir, allow_transient_write)
-                .await?
-        } else {
-            bail!("invalid SPIN_MANIFEST_URL {}", manifest_url);
-        };
-
-        // Apply --env to all components in the given app
-        for c in app.components.iter_mut() {
-            for (k, v) in self.env.iter().cloned() {
-                c.wasm.environment.insert(k, v);
-            }
-        }
-
-        let envs = read_dotenv(dotenv_path)?;
-
-        // Add default config provider(s).
-        // TODO(lann): Make config provider(s) configurable.
-        if let Some(ref mut resolver) = app.config_resolver {
-            let resolver = Arc::get_mut(resolver)
-                .context("Internal error: app.config_resolver unexpectedly shared")?;
-            resolver.add_provider(spin_config::provider::env::EnvProvider::new(
-                spin_config::provider::env::DEFAULT_PREFIX,
-                envs,
-            ));
-        }
-
-        Ok(app)
-    }
 
     pub fn follow_components(&self) -> FollowComponents {
         if self.follow_all_components {
@@ -204,7 +143,7 @@ where
         }
     }
 
-    fn update_wasmtime_config(&self, config: &mut wasmtime::Config) -> Result<()> {
+    fn update_wasmtime_config(&self, config: &mut spin_core::wasmtime::Config) -> Result<()> {
         // Apply --cache / --disable-cache
         if !self.disable_cache {
             match &self.cache {
@@ -215,27 +154,3 @@ where
         Ok(())
     }
 }
-
-// Parse the environment variables passed in `key=value` pairs.
-fn parse_env_var(s: &str) -> Result<(String, String)> {
-    let parts: Vec<_> = s.splitn(2, '=').collect();
-    if parts.len() != 2 {
-        bail!("Environment variable must be of the form `key=value`");
-    }
-    Ok((parts[0].to_owned(), parts[1].to_owned()))
-}
-
-// Return environment key value mapping in ".env" file.
-fn read_dotenv(dotenv_path: impl AsRef<Path>) -> Result<HashMap<String, String>> {
-    let mut envs = HashMap::new();
-    if !dotenv_path.as_ref().exists() {
-        return Ok(envs);
-    }
-
-    let env_iter = dotenvy::from_path_iter(dotenv_path)?;
-    for env_item in env_iter {
-        let (key, value) = env_item?;
-        envs.insert(key, value);
-    }
-    Ok(envs)
-}
diff --git a/crates/trigger/src/lib.rs b/crates/trigger/src/lib.rs
index 76a7608f9f..e248662cf1 100644
--- a/crates/trigger/src/lib.rs
+++ b/crates/trigger/src/lib.rs
@@ -1,45 +1,49 @@
+pub mod cli;
+mod loader;
+pub mod locked;
+mod stdio;
+
 use std::{
     collections::HashMap,
-    error::Error,
     marker::PhantomData,
-    path::PathBuf,
-    sync::{Arc, RwLock},
+    path::{Path, PathBuf},
 };
 
-use anyhow::Result;
+use anyhow::{Context, Result};
 use async_trait::async_trait;
-use spin_engine::{
-    io::FollowComponents, Builder, Engine, ExecutionContext, ExecutionContextConfiguration,
-};
-use spin_manifest::{Application, ApplicationTrigger, TriggerConfig};
+use serde::de::DeserializeOwned;
+
+use spin_app::{App, AppLoader, AppTrigger, Loader, OwnedApp};
+use spin_config::{provider::env::EnvProvider, Provider};
+use spin_core::{Config, Engine, EngineBuilder, Instance, InstancePre, Store, StoreBuilder};
+
+use stdio::{ComponentStdioWriter, FollowComponents};
+
+const SPIN_HOME: &str = ".spin";
+const SPIN_CONFIG_ENV_PREFIX: &str = "SPIN_APP";
 
-pub mod cli;
 #[async_trait]
 pub trait TriggerExecutor: Sized {
-    type GlobalConfig;
+    const TRIGGER_TYPE: &'static str;
+    type RuntimeData: Default + Send + Sync + 'static;
     type TriggerConfig;
     type RunConfig;
-    type RuntimeContext: Default + 'static;
 
     /// Create a new trigger executor.
-    fn new(
-        execution_context: ExecutionContext<Self::RuntimeContext>,
-        global_config: Self::GlobalConfig,
-        trigger_configs: impl IntoIterator<Item = Self::TriggerConfig>,
-    ) -> Result<Self>;
+    fn new(app_engine: TriggerAppEngine<Self>) -> Result<Self>;
 
     /// Run the trigger executor.
     async fn run(self, config: Self::RunConfig) -> Result<()>;
 
     /// Make changes to the ExecutionContext using the given Builder.
-    fn configure_execution_context(_builder: &mut Builder<Self::RuntimeContext>) -> Result<()> {
+    fn configure_engine(_builder: &mut EngineBuilder<Self::RuntimeData>) -> Result<()> {
         Ok(())
     }
 }
 
 pub struct TriggerExecutorBuilder<Executor: TriggerExecutor> {
-    application: Application,
-    wasmtime_config: wasmtime::Config,
+    loader: AppLoader,
+    config: Config,
     log_dir: Option<PathBuf>,
     follow_components: FollowComponents,
     disable_default_host_components: bool,
@@ -48,10 +52,10 @@ pub struct TriggerExecutorBuilder<Executor: TriggerExecutor> {
 
 impl<Executor: TriggerExecutor> TriggerExecutorBuilder<Executor> {
     /// Create a new TriggerExecutorBuilder with the given Application.
-    pub fn new(application: Application) -> Self {
+    pub fn new(loader: impl Loader + Send + Sync + 'static) -> Self {
         Self {
-            application,
-            wasmtime_config: Default::default(),
+            loader: AppLoader::new(loader),
+            config: Default::default(),
             log_dir: None,
             follow_components: Default::default(),
             disable_default_host_components: false,
@@ -62,8 +66,8 @@ impl<Executor: TriggerExecutor> TriggerExecutorBuilder<Executor> {
     /// !!!Warning!!! Using a custom Wasmtime Config is entirely unsupported;
     /// many configurations are likely to cause errors or unexpected behavior.
     #[doc(hidden)]
-    pub fn wasmtime_config_mut(&mut self) -> &mut wasmtime::Config {
-        &mut self.wasmtime_config
+    pub fn wasmtime_config_mut(&mut self) -> &mut spin_core::wasmtime::Config {
+        self.config.wasmtime_config()
     }
 
     pub fn log_dir(&mut self, log_dir: PathBuf) -> &mut Self {
@@ -81,53 +85,197 @@ impl<Executor: TriggerExecutor> TriggerExecutorBuilder<Executor> {
         self
     }
 
-    pub async fn build(self) -> Result<Executor>
+    pub async fn build(mut self, app_uri: String) -> Result<Executor>
     where
-        Executor::GlobalConfig: TryFrom<ApplicationTrigger>,
-        <Executor::GlobalConfig as TryFrom<ApplicationTrigger>>::Error:
-            Error + Send + Sync + 'static,
-        Executor::TriggerConfig: TryFrom<(String, TriggerConfig)>,
-        <Executor::TriggerConfig as TryFrom<(String, TriggerConfig)>>::Error:
-            Error + Send + Sync + 'static,
+        Executor::TriggerConfig: DeserializeOwned,
     {
-        let app = self.application;
-
-        // Build ExecutionContext
-        let ctx_config = ExecutionContextConfiguration {
-            components: app.components,
-            label: app.info.name,
-            log_dir: self.log_dir,
-            follow_components: self.follow_components,
-            config_resolver: app.config_resolver,
+        let engine = {
+            let mut builder = Engine::builder(&self.config)?;
+
+            if !self.disable_default_host_components {
+                builder.add_host_component(outbound_redis::OutboundRedis::default())?;
+                builder.add_host_component(outbound_pg::OutboundPg)?;
+                self.loader.add_dynamic_host_component(
+                    &mut builder,
+                    outbound_http::OutboundHttpComponent,
+                )?;
+                self.loader.add_dynamic_host_component(
+                    &mut builder,
+                    spin_config::ConfigHostComponent::new(self.default_config_providers(&app_uri)),
+                )?;
+            }
+
+            Executor::configure_engine(&mut builder)?;
+            builder.build()
         };
-        let engine = Engine::new(self.wasmtime_config)?;
-        let mut ctx_builder = Builder::with_engine(ctx_config, engine)?;
-        ctx_builder.link_defaults()?;
-        if !self.disable_default_host_components {
-            add_default_host_components(&mut ctx_builder)?;
-        }
-        Executor::configure_execution_context(&mut ctx_builder)?;
-        let execution_context = ctx_builder.build().await?;
 
-        // Build trigger configurations
-        let global_config = app.info.trigger.try_into()?;
-        let trigger_configs = app
-            .component_triggers
-            .into_iter()
-            .map(|(id, config)| Ok((id, config).try_into()?))
-            .collect::<Result<Vec<_>>>()?;
+        let app = self.loader.load_owned_app(app_uri).await?;
+        let app_name = app.require_metadata("name")?;
+
+        let log_dir = {
+            let sanitized_app = sanitize_filename::sanitize(&app_name);
+            let parent_dir = match dirs::home_dir() {
+                Some(home) => home.join(SPIN_HOME),
+                None => PathBuf::new(), // "./"
+            };
+            parent_dir.join(sanitized_app).join("logs")
+        };
 
         // Run trigger executor
-        Executor::new(execution_context, global_config, trigger_configs)
+        Executor::new(
+            TriggerAppEngine::new(engine, app_name, app, log_dir, self.follow_components).await?,
+        )
     }
+
+    pub fn default_config_providers(&self, app_uri: &str) -> Vec<Box<dyn Provider>> {
+        // EnvProvider
+        let dotenv_path = app_uri
+            .strip_prefix("file://")
+            .and_then(|path| Path::new(path).parent())
+            .unwrap_or_else(|| Path::new("."))
+            .join(".env");
+        vec![Box::new(EnvProvider::new(
+            SPIN_CONFIG_ENV_PREFIX,
+            Some(dotenv_path),
+        ))]
+    }
+}
+
+/// Execution context for a TriggerExecutor executing a particular App.
+pub struct TriggerAppEngine<Executor: TriggerExecutor> {
+    /// Engine to be used with this executor.
+    pub engine: Engine<Executor::RuntimeData>,
+    /// Name of the app for e.g. logging.
+    pub app_name: String,
+    // An owned wrapper of the App.
+    app: OwnedApp,
+    // Log directory
+    log_dir: PathBuf,
+    // Component stdio follow config
+    follow_components: FollowComponents,
+    // Trigger configs for this trigger type, with order matching `app.triggers_with_type(Executor::TRIGGER_TYPE)`
+    trigger_configs: Vec<Executor::TriggerConfig>,
+    // Map of {Component ID -> InstancePre} for each component.
+    component_instance_pres: HashMap<String, InstancePre<Executor::RuntimeData>>,
 }
 
-/// Add the default set of host components to the given builder.
-pub fn add_default_host_components<T: Default + 'static>(builder: &mut Builder<T>) -> Result<()> {
-    builder.add_host_component(wasi_outbound_http::OutboundHttpComponent)?;
-    builder.add_host_component(outbound_redis::OutboundRedis {
-        connections: Arc::new(RwLock::new(HashMap::new())),
-    })?;
-    builder.add_host_component(outbound_pg::OutboundPg)?;
-    Ok(())
+impl<Executor: TriggerExecutor> TriggerAppEngine<Executor> {
+    /// Returns a new TriggerAppEngine. May return an error if trigger config validation or
+    /// component pre-instantiation fails.
+    pub async fn new(
+        engine: Engine<Executor::RuntimeData>,
+        app_name: String,
+        app: OwnedApp,
+        log_dir: PathBuf,
+        follow_components: FollowComponents,
+    ) -> Result<Self>
+    where
+        <Executor as TriggerExecutor>::TriggerConfig: DeserializeOwned,
+    {
+        let trigger_configs = app
+            .triggers_with_type(Executor::TRIGGER_TYPE)
+            .map(|trigger| {
+                trigger.typed_config().with_context(|| {
+                    format!("invalid trigger configuration for {:?}", trigger.id())
+                })
+            })
+            .collect::<Result<_>>()?;
+
+        let mut component_instance_pres = HashMap::default();
+        for component in app.components() {
+            let module = component.load_module(&engine).await?;
+            let instance_pre = engine.instantiate_pre(&module)?;
+            component_instance_pres.insert(component.id().to_string(), instance_pre);
+        }
+
+        Ok(Self {
+            engine,
+            app_name,
+            app,
+            log_dir,
+            follow_components,
+            trigger_configs,
+            component_instance_pres,
+        })
+    }
+
+    /// Returns a reference to the App.
+    pub fn app(&self) -> &App {
+        &self.app
+    }
+
+    /// Returns AppTriggers and typed TriggerConfigs for this executor type.
+    pub fn trigger_configs(&self) -> impl Iterator<Item = (AppTrigger, &Executor::TriggerConfig)> {
+        self.app
+            .triggers_with_type(Executor::TRIGGER_TYPE)
+            .zip(&self.trigger_configs)
+    }
+
+    /// Returns a new StoreBuilder for the given component ID.
+    pub fn store_builder(&self, component_id: &str) -> Result<StoreBuilder> {
+        let mut builder = self.engine.store_builder();
+
+        // Set up stdio logging
+        builder.stdout_pipe(self.component_stdio_writer(component_id, "stdout")?);
+        builder.stderr_pipe(self.component_stdio_writer(component_id, "stderr")?);
+
+        Ok(builder)
+    }
+
+    fn component_stdio_writer(
+        &self,
+        component_id: &str,
+        log_suffix: &str,
+    ) -> Result<ComponentStdioWriter> {
+        let sanitized_component_id = sanitize_filename::sanitize(component_id);
+        // e.g.
+        let log_path = self
+            .log_dir
+            .join(format!("{sanitized_component_id}_{log_suffix}.txt"));
+        let follow = self.follow_components.should_follow(component_id);
+        ComponentStdioWriter::new(&log_path, follow)
+            .with_context(|| format!("Failed to open log file {log_path:?}"))
+    }
+
+    /// Returns a new Store and Instance for the given component ID.
+    pub async fn prepare_instance(
+        &self,
+        component_id: &str,
+    ) -> Result<(Instance, Store<Executor::RuntimeData>)> {
+        let store_builder = self.store_builder(component_id)?;
+        self.prepare_instance_with_store(component_id, store_builder)
+            .await
+    }
+
+    /// Returns a new Store and Instance for the given component ID and StoreBuilder.
+    pub async fn prepare_instance_with_store(
+        &self,
+        component_id: &str,
+        mut store_builder: StoreBuilder,
+    ) -> Result<(Instance, Store<Executor::RuntimeData>)> {
+        // Look up AppComponent
+        let component = self.app.get_component(component_id).with_context(|| {
+            format!(
+                "app {:?} has no component {:?}",
+                self.app_name, component_id
+            )
+        })?;
+
+        // Build Store
+        component.apply_store_config(&mut store_builder).await?;
+        let mut store = store_builder.build()?;
+
+        // Instantiate
+        let instance = self.component_instance_pres[component_id]
+            .instantiate_async(&mut store)
+            .await
+            .with_context(|| {
+                format!(
+                    "app {:?} component {:?} instantiation failed",
+                    self.app_name, component_id
+                )
+            })?;
+
+        Ok((instance, store))
+    }
 }
diff --git a/crates/trigger/src/loader.rs b/crates/trigger/src/loader.rs
new file mode 100644
index 0000000000..2fc975a6e0
--- /dev/null
+++ b/crates/trigger/src/loader.rs
@@ -0,0 +1,82 @@
+use std::path::{Path, PathBuf};
+
+use anyhow::{ensure, Context, Result};
+use async_trait::async_trait;
+use spin_app::{
+    locked::{LockedApp, LockedComponentSource},
+    AppComponent, Loader,
+};
+use spin_core::StoreBuilder;
+
+pub struct TriggerLoader {
+    working_dir: PathBuf,
+    allow_transient_write: bool,
+}
+
+impl TriggerLoader {
+    pub(crate) fn new(working_dir: impl Into<PathBuf>, allow_transient_write: bool) -> Self {
+        Self {
+            working_dir: working_dir.into(),
+            allow_transient_write,
+        }
+    }
+}
+
+#[async_trait]
+impl Loader for TriggerLoader {
+    async fn load_app(&self, uri: &str) -> Result<LockedApp> {
+        let path = unwrap_file_uri(uri)?;
+        let contents =
+            std::fs::read(path).with_context(|| format!("failed to read manifest at {path:?}"))?;
+        let app =
+            serde_json::from_slice(&contents).context("failed to parse app lock file JSON")?;
+        Ok(app)
+    }
+
+    async fn load_module(
+        &self,
+        engine: &spin_core::wasmtime::Engine,
+        source: &LockedComponentSource,
+    ) -> Result<spin_core::Module> {
+        let source = source
+            .content
+            .source
+            .as_ref()
+            .context("LockedComponentSource missing source field")?;
+        let path = unwrap_file_uri(source)?;
+        spin_core::Module::from_file(engine, path)
+    }
+
+    async fn mount_files(
+        &self,
+        store_builder: &mut StoreBuilder,
+        component: &AppComponent,
+    ) -> Result<()> {
+        for content_dir in component.files() {
+            let source_uri = content_dir
+                .content
+                .source
+                .as_deref()
+                .with_context(|| format!("Missing 'source' on files mount {content_dir:?}"))?;
+            let source_path = self.working_dir.join(unwrap_file_uri(source_uri)?);
+            ensure!(
+                source_path.is_dir(),
+                "TriggerLoader only supports directory mounts; {source_path:?} is not a directory"
+            );
+            let guest_path = content_dir.path.clone();
+            if self.allow_transient_write {
+                store_builder.read_write_preopened_dir(source_path, guest_path)?;
+            } else {
+                store_builder.read_only_preopened_dir(source_path, guest_path)?;
+            }
+        }
+        Ok(())
+    }
+}
+
+fn unwrap_file_uri(uri: &str) -> Result<&Path> {
+    Ok(Path::new(
+        uri.strip_prefix("file://")
+            .context("TriggerLoader supports only file:// URIs")?,
+    ))
+}
diff --git a/crates/trigger/src/locked.rs b/crates/trigger/src/locked.rs
new file mode 100644
index 0000000000..019d0db659
--- /dev/null
+++ b/crates/trigger/src/locked.rs
@@ -0,0 +1,185 @@
+use std::path::PathBuf;
+
+use anyhow::{bail, ensure, Context, Result};
+use spin_app::{
+    locked::{
+        self, ContentPath, ContentRef, LockedApp, LockedComponent, LockedComponentSource,
+        LockedTrigger,
+    },
+    values::{ValuesMap, ValuesMapBuilder},
+};
+use spin_manifest::{
+    Application, ApplicationInformation, ApplicationTrigger, CoreComponent, HttpConfig,
+    HttpTriggerConfiguration, RedisConfig, RedisTriggerConfiguration, TriggerConfig,
+};
+
+const WASM_CONTENT_TYPE: &str = "application/wasm";
+
+/// Construct a LockedApp from the given Application. Any buffered component
+/// sources will be written to the given `working_dir`.
+pub fn build_locked_app(app: Application, working_dir: impl Into<PathBuf>) -> Result<LockedApp> {
+    let working_dir = working_dir.into();
+    LockedAppBuilder { working_dir }.build(app)
+}
+
+struct LockedAppBuilder {
+    working_dir: PathBuf,
+}
+
+impl LockedAppBuilder {
+    fn build(self, app: Application) -> Result<LockedApp> {
+        Ok(LockedApp {
+            spin_lock_version: spin_app::locked::FixedVersion,
+            triggers: self.build_triggers(&app.info.trigger, app.component_triggers)?,
+            metadata: self.build_metadata(app.info),
+            variables: self.build_variables(app.variables)?,
+            components: self.build_components(app.components)?,
+        })
+    }
+
+    fn build_metadata(&self, info: ApplicationInformation) -> ValuesMap {
+        let redis_address = match info.trigger {
+            ApplicationTrigger::Redis(RedisTriggerConfiguration { address }) => Some(address),
+            _ => None,
+        };
+        let origin = match info.origin {
+            spin_manifest::ApplicationOrigin::File(path) => {
+                format!("file://{}", path.to_string_lossy())
+            }
+            spin_manifest::ApplicationOrigin::Bindle { id, server } => {
+                format!("bindle+{server}?id={id}")
+            }
+        };
+        ValuesMapBuilder::new()
+            .string("name", &info.name)
+            .string("version", &info.version)
+            .string_option("description", info.description.as_deref())
+            .string_option("redis_address", redis_address)
+            .string("origin", origin)
+            .build()
+    }
+
+    fn build_variables<B: FromIterator<(String, locked::Variable)>>(
+        &self,
+        variables: impl IntoIterator<Item = (String, spin_manifest::Variable)>,
+    ) -> Result<B> {
+        variables
+            .into_iter()
+            .map(|(name, var)| {
+                ensure!(
+                    var.required ^ var.default.is_some(),
+                    "variable {name:?} must either be required or have a default"
+                );
+                Ok((
+                    name,
+                    locked::Variable {
+                        default: var.default,
+                        secret: var.secret,
+                    },
+                ))
+            })
+            .collect()
+    }
+
+    fn build_triggers(
+        &self,
+        app_trigger: &ApplicationTrigger,
+        component_triggers: impl IntoIterator<Item = (String, TriggerConfig)>,
+    ) -> Result<Vec<LockedTrigger>> {
+        component_triggers
+            .into_iter()
+            .map(|(component_id, config)| {
+                let id = format!("trigger--{component_id}");
+
+                let mut builder = ValuesMapBuilder::new();
+                builder.string("component", component_id);
+                let trigger_type = match (app_trigger, config) {
+                    (ApplicationTrigger::Http(HttpTriggerConfiguration{base}), TriggerConfig::Http(HttpConfig{ route, executor })) => {
+                        let route = base.trim_end_matches('/').to_string() + &route;
+                        builder.string("route", route);                     
+                        builder.serializable("executor", executor)?;
+                        "http"
+                    },
+                    (ApplicationTrigger::Redis(_), TriggerConfig::Redis(RedisConfig{ channel, executor: _ })) => {
+                        builder.string("channel", channel);
+                        "redis"
+                    },
+                    (app_config, trigger_config) => bail!("Mismatched app and component trigger configs: {app_config:?} vs {trigger_config:?}")
+                }.into();
+                let trigger_config = builder.build().into();
+
+                Ok(LockedTrigger {
+                    id,
+                    trigger_type,
+                    trigger_config,
+                })
+            })
+            .collect()
+    }
+
+    fn build_components(
+        &self,
+        components: impl IntoIterator<Item = CoreComponent>,
+    ) -> Result<Vec<LockedComponent>> {
+        components
+            .into_iter()
+            .map(|component| {
+                let id = component.id;
+
+                let metadata = ValuesMapBuilder::new()
+                    .string_option("description", component.description)
+                    .string_array("allowed_http_hosts", component.wasm.allowed_http_hosts)
+                    .build();
+
+                let source = {
+                    let path = match component.source {
+                        spin_manifest::ModuleSource::FileReference(path) => path,
+                        spin_manifest::ModuleSource::Buffer(bytes, name) => {
+                            let wasm_path = self.working_dir.join(&id).with_extension("wasm");
+                            std::fs::write(&wasm_path, bytes).with_context(|| {
+                                format!(
+                                    "Failed to write buffered source for component {id:?} ({name})"
+                                )
+                            })?;
+                            wasm_path
+                        }
+                    };
+                    LockedComponentSource {
+                        content_type: WASM_CONTENT_TYPE.into(),
+                        content: content_file_path(path),
+                    }
+                };
+
+                let env = component.wasm.environment.into_iter().collect();
+
+                let files = component
+                    .wasm
+                    .mounts
+                    .into_iter()
+                    .map(|mount| ContentPath {
+                        content: content_file_path(mount.host),
+                        path: mount.guest.into(),
+                    })
+                    .collect();
+
+                let config = component.config.into_iter().collect();
+
+                Ok(LockedComponent {
+                    id,
+                    metadata,
+                    source,
+                    env,
+                    files,
+                    config,
+                })
+            })
+            .collect()
+    }
+}
+
+fn content_file_path(path: PathBuf) -> ContentRef {
+    ContentRef {
+        source: Some(format!("file://{}", path.to_string_lossy())),
+        ..Default::default()
+    }
+}
diff --git a/crates/trigger/src/stdio.rs b/crates/trigger/src/stdio.rs
new file mode 100644
index 0000000000..80d6880328
--- /dev/null
+++ b/crates/trigger/src/stdio.rs
@@ -0,0 +1,60 @@
+use std::{collections::HashSet, fs::File, path::Path};
+
+/// Which components should have their logs followed on stdout/stderr.
+#[derive(Clone, Debug)]
+pub enum FollowComponents {
+    /// No components should have their logs followed.
+    None,
+    /// Only the specified components should have their logs followed.
+    Named(HashSet<String>),
+    /// All components should have their logs followed.
+    All,
+}
+
+impl FollowComponents {
+    /// Whether a given component should have its logs followed on stdout/stderr.
+    pub fn should_follow(&self, component_id: &str) -> bool {
+        match self {
+            Self::None => false,
+            Self::All => true,
+            Self::Named(ids) => ids.contains(component_id),
+        }
+    }
+}
+
+impl Default for FollowComponents {
+    fn default() -> Self {
+        Self::None
+    }
+}
+
+/// ComponentStdioWriter forwards output to a log file and (optionally) stderr
+pub struct ComponentStdioWriter {
+    log_file: File,
+    follow: bool,
+}
+
+impl ComponentStdioWriter {
+    pub fn new(log_path: &Path, follow: bool) -> anyhow::Result<Self> {
+        let log_file = File::options().create(true).append(true).open(log_path)?;
+        Ok(Self { log_file, follow })
+    }
+}
+
+impl std::io::Write for ComponentStdioWriter {
+    fn write(&mut self, buf: &[u8]) -> std::io::Result<usize> {
+        let written = self.log_file.write(buf)?;
+        if self.follow {
+            std::io::stderr().write_all(&buf[..written])?;
+        }
+        Ok(written)
+    }
+
+    fn flush(&mut self) -> std::io::Result<()> {
+        self.log_file.flush()?;
+        if self.follow {
+            std::io::stderr().flush()?;
+        }
+        Ok(())
+    }
+}
diff --git a/examples/spin-timer/Cargo.toml b/examples/spin-timer/Cargo.toml
deleted file mode 100644
index 9aff03f487..0000000000
--- a/examples/spin-timer/Cargo.toml
+++ /dev/null
@@ -1,24 +0,0 @@
-[package]
-name = "spin-timer"
-version = "0.1.0"
-authors = ["Fermyon Engineering <engineering@fermyon.com>"]
-edition = "2021"
-
-[dependencies]
-anyhow = "1.0"
-async-trait = "0.1"
-chrono = "0.4"
-env_logger = "0.9"
-futures = "0.3"
-log = { version = "0.4", default-features = false }
-spin-engine = { path = "../../crates/engine" }
-spin-manifest = { path = "../../crates/manifest" }
-spin-trigger = { path = "../../crates/trigger" }
-tokio = { version = "1.14", features = [ "full" ] }
-tracing = { version = "0.1", features = [ "log" ] }
-tracing-futures = "0.2"
-tracing-subscriber = { version = "0.3.7", features = [ "env-filter" ] }
-wasi-common = "0.39.1"
-wasmtime = "0.39.1"
-wasmtime-wasi = "0.39.1"
-wit-bindgen-wasmtime = { git = "https://github.com/bytecodealliance/wit-bindgen", rev = "cb871cfa1ee460b51eb1d144b175b9aab9c50aba" }
diff --git a/examples/spin-timer/example/.cargo/config.toml b/examples/spin-timer/example/.cargo/config.toml
deleted file mode 100644
index 6b77899cb3..0000000000
--- a/examples/spin-timer/example/.cargo/config.toml
+++ /dev/null
@@ -1,2 +0,0 @@
-[build]
-target = "wasm32-wasi"
diff --git a/examples/spin-timer/example/Cargo.lock b/examples/spin-timer/example/Cargo.lock
deleted file mode 100644
index f727412064..0000000000
--- a/examples/spin-timer/example/Cargo.lock
+++ /dev/null
@@ -1,206 +0,0 @@
-# This file is automatically @generated by Cargo.
-# It is not intended for manual editing.
-version = 3
-
-[[package]]
-name = "anyhow"
-version = "1.0.48"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "62e1f47f7dc0422027a4e370dd4548d4d66b26782e513e98dca1e689e058a80e"
-
-[[package]]
-name = "async-trait"
-version = "0.1.51"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "44318e776df68115a881de9a8fd1b9e53368d7a4a5ce4cc48517da3393233a5e"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn",
-]
-
-[[package]]
-name = "bitflags"
-version = "1.3.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
-
-[[package]]
-name = "heck"
-version = "0.3.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6d621efb26863f0e9924c6ac577e8275e5e6b77455db64ffa6c65c904e9e132c"
-dependencies = [
- "unicode-segmentation",
-]
-
-[[package]]
-name = "id-arena"
-version = "2.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "25a2bc672d1148e28034f176e01fffebb08b35768468cc954630da77a1449005"
-
-[[package]]
-name = "memchr"
-version = "2.4.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "308cc39be01b73d0d18f82a0e7b2a3df85245f84af96fdddc5d202d27e47b86a"
-
-[[package]]
-name = "proc-macro2"
-version = "1.0.32"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ba508cc11742c0dc5c1659771673afbab7a0efab23aa17e854cbab0837ed0b43"
-dependencies = [
- "unicode-xid",
-]
-
-[[package]]
-name = "pulldown-cmark"
-version = "0.8.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ffade02495f22453cd593159ea2f59827aae7f53fa8323f756799b670881dcf8"
-dependencies = [
- "bitflags",
- "memchr",
- "unicase",
-]
-
-[[package]]
-name = "quote"
-version = "1.0.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "38bc8cc6a5f2e3655e0899c1b848643b2562f853f114bfec7be120678e3ace05"
-dependencies = [
- "proc-macro2",
-]
-
-[[package]]
-name = "rust-echo-test"
-version = "0.1.0"
-dependencies = [
- "wit-bindgen-rust",
-]
-
-[[package]]
-name = "syn"
-version = "1.0.81"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f2afee18b8beb5a596ecb4a2dce128c719b4ba399d34126b9e4396e3f9860966"
-dependencies = [
- "proc-macro2",
- "quote",
- "unicode-xid",
-]
-
-[[package]]
-name = "tinyvec"
-version = "1.5.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2c1c1d5a42b6245520c249549ec267180beaffcc0615401ac8e31853d4b6d8d2"
-dependencies = [
- "tinyvec_macros",
-]
-
-[[package]]
-name = "tinyvec_macros"
-version = "0.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cda74da7e1a664f795bb1f8a87ec406fb89a02522cf6e50620d016add6dbbf5c"
-
-[[package]]
-name = "unicase"
-version = "2.6.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "50f37be617794602aabbeee0be4f259dc1778fabe05e2d67ee8f79326d5cb4f6"
-dependencies = [
- "version_check",
-]
-
-[[package]]
-name = "unicode-normalization"
-version = "0.1.19"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d54590932941a9e9266f0832deed84ebe1bf2e4c9e4a3554d393d18f5e854bf9"
-dependencies = [
- "tinyvec",
-]
-
-[[package]]
-name = "unicode-segmentation"
-version = "1.8.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8895849a949e7845e06bd6dc1aa51731a103c42707010a5b591c0038fb73385b"
-
-[[package]]
-name = "unicode-xid"
-version = "0.2.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8ccb82d61f80a663efe1f787a51b16b5a51e3314d6ac365b08639f52387b33f3"
-
-[[package]]
-name = "version_check"
-version = "0.9.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5fecdca9a5291cc2b8dcf7dc02453fee791a280f3743cb0905f8822ae463b3fe"
-
-[[package]]
-name = "wit-bindgen-gen-core"
-version = "0.2.0"
-source = "git+https://github.com/bytecodealliance/wit-bindgen?rev=cb871cfa1ee460b51eb1d144b175b9aab9c50aba#cb871cfa1ee460b51eb1d144b175b9aab9c50aba"
-dependencies = [
- "anyhow",
- "wit-parser",
-]
-
-[[package]]
-name = "wit-bindgen-gen-rust"
-version = "0.2.0"
-source = "git+https://github.com/bytecodealliance/wit-bindgen?rev=cb871cfa1ee460b51eb1d144b175b9aab9c50aba#cb871cfa1ee460b51eb1d144b175b9aab9c50aba"
-dependencies = [
- "heck",
- "wit-bindgen-gen-core",
-]
-
-[[package]]
-name = "wit-bindgen-gen-rust-wasm"
-version = "0.2.0"
-source = "git+https://github.com/bytecodealliance/wit-bindgen?rev=cb871cfa1ee460b51eb1d144b175b9aab9c50aba#cb871cfa1ee460b51eb1d144b175b9aab9c50aba"
-dependencies = [
- "heck",
- "wit-bindgen-gen-core",
- "wit-bindgen-gen-rust",
-]
-
-[[package]]
-name = "wit-bindgen-rust"
-version = "0.2.0"
-source = "git+https://github.com/bytecodealliance/wit-bindgen?rev=cb871cfa1ee460b51eb1d144b175b9aab9c50aba#cb871cfa1ee460b51eb1d144b175b9aab9c50aba"
-dependencies = [
- "async-trait",
- "bitflags",
- "wit-bindgen-rust-impl",
-]
-
-[[package]]
-name = "wit-bindgen-rust-impl"
-version = "0.2.0"
-source = "git+https://github.com/bytecodealliance/wit-bindgen?rev=cb871cfa1ee460b51eb1d144b175b9aab9c50aba#cb871cfa1ee460b51eb1d144b175b9aab9c50aba"
-dependencies = [
- "proc-macro2",
- "syn",
- "wit-bindgen-gen-core",
- "wit-bindgen-gen-rust-wasm",
-]
-
-[[package]]
-name = "wit-parser"
-version = "0.2.0"
-source = "git+https://github.com/bytecodealliance/wit-bindgen?rev=cb871cfa1ee460b51eb1d144b175b9aab9c50aba#cb871cfa1ee460b51eb1d144b175b9aab9c50aba"
-dependencies = [
- "anyhow",
- "id-arena",
- "pulldown-cmark",
- "unicode-normalization",
- "unicode-xid",
-]
diff --git a/examples/spin-timer/example/Cargo.toml b/examples/spin-timer/example/Cargo.toml
deleted file mode 100644
index 009a6f8247..0000000000
--- a/examples/spin-timer/example/Cargo.toml
+++ /dev/null
@@ -1,12 +0,0 @@
-[package]
-    name    = "rust-echo-test"
-    version = "0.1.0"
-    edition = "2021"
-
-[lib]
-    crate-type = [ "cdylib" ]
-
-[dependencies]
-    wit-bindgen-rust = { git = "https://github.com/bytecodealliance/wit-bindgen", rev = "cb871cfa1ee460b51eb1d144b175b9aab9c50aba" }
-
-[workspace]
diff --git a/examples/spin-timer/example/src/lib.rs b/examples/spin-timer/example/src/lib.rs
deleted file mode 100644
index 6bc061bd27..0000000000
--- a/examples/spin-timer/example/src/lib.rs
+++ /dev/null
@@ -1,8 +0,0 @@
-wit_bindgen_rust::export!("../spin-timer.wit");
-
-struct SpinTimer;
-impl spin_timer::SpinTimer for SpinTimer {
-    fn handle_timer_request(msg: String) -> String {
-        format!("ECHO: {}", msg)
-    }
-}
diff --git a/examples/spin-timer/readme.md b/examples/spin-timer/readme.md
deleted file mode 100644
index d451079028..0000000000
--- a/examples/spin-timer/readme.md
+++ /dev/null
@@ -1,3 +0,0 @@
-# Extending Spin with a trigger and application
-
-<https://spin.fermyon.dev/extending-and-embedding>
diff --git a/examples/spin-timer/spin-timer.wit b/examples/spin-timer/spin-timer.wit
deleted file mode 100644
index f5088cbe36..0000000000
--- a/examples/spin-timer/spin-timer.wit
+++ /dev/null
@@ -1 +0,0 @@
-handle-timer-request: func(msg: string) -> string
diff --git a/examples/spin-timer/src/main.rs b/examples/spin-timer/src/main.rs
deleted file mode 100644
index 213e2ba9cc..0000000000
--- a/examples/spin-timer/src/main.rs
+++ /dev/null
@@ -1,89 +0,0 @@
-// The wit_bindgen_wasmtime::import below is triggering this lint.
-#![allow(clippy::needless_question_mark)]
-
-use std::{sync::Arc, time::Duration};
-
-use anyhow::Result;
-use spin_engine::{Builder, ExecutionContextConfiguration};
-use spin_manifest::{CoreComponent, ModuleSource, WasmConfig};
-use tokio::task::spawn_blocking;
-
-wit_bindgen_wasmtime::import!("spin-timer.wit");
-
-type ExecutionContext = spin_engine::ExecutionContext<spin_timer::SpinTimerData>;
-
-#[tokio::main]
-async fn main() -> Result<()> {
-    tracing_subscriber::fmt()
-        .with_env_filter(tracing_subscriber::EnvFilter::from_default_env())
-        .init();
-
-    let component = component();
-    let engine = Builder::build_default(ExecutionContextConfiguration {
-        components: vec![component],
-        label: "timer-app".to_string(),
-        ..Default::default()
-    })
-    .await?;
-    let trigger = TimerTrigger {
-        engine: Arc::new(engine),
-        interval: Duration::from_secs(1),
-    };
-    trigger.run().await
-}
-
-/// A custom timer trigger that executes the
-/// first component of an application on every interval.
-#[derive(Clone)]
-pub struct TimerTrigger {
-    /// The Spin execution context.
-    engine: Arc<ExecutionContext>,
-    /// The interval at which the component is executed.   
-    pub interval: Duration,
-}
-
-impl TimerTrigger {
-    /// Runs the trigger at every interval.
-    async fn run(&self) -> Result<()> {
-        let mut interval = tokio::time::interval(self.interval);
-        loop {
-            interval.tick().await;
-            self.handle(
-                chrono::Local::now()
-                    .format("%Y-%m-%d][%H:%M:%S")
-                    .to_string(),
-            )
-            .await?;
-        }
-    }
-    /// Execute the first component in the application configuration.
-    async fn handle(&self, msg: String) -> Result<()> {
-        let (mut store, instance) = self.engine.prepare_component(
-            &self.engine.config.components[0].id,
-            None,
-            None,
-            None,
-            None,
-        )?;
-
-        let res = spawn_blocking(move || -> Result<String> {
-            let t = spin_timer::SpinTimer::new(&mut store, &instance, |host| {
-                host.data.as_mut().unwrap()
-            })?;
-            Ok(t.handle_timer_request(&mut store, &msg)?)
-        })
-        .await??;
-        log::info!("{}\n", res);
-
-        Ok(())
-    }
-}
-
-pub fn component() -> CoreComponent {
-    CoreComponent {
-        source: ModuleSource::FileReference("target/test-programs/echo.wasm".into()),
-        id: "test".to_string(),
-        description: None,
-        wasm: WasmConfig::default(),
-    }
-}
diff --git a/src/commands/deploy.rs b/src/commands/deploy.rs
index 1f925bb963..84b88ffd0e 100644
--- a/src/commands/deploy.rs
+++ b/src/commands/deploy.rs
@@ -417,7 +417,7 @@ fn print_available_routes(
                 Err(_) => "http",
             };
 
-            let route = RoutePattern::from(base, &http_cfg.route);
+            let route = RoutePattern::with_base(base, &http_cfg.route);
             println!("  {}: {}://{}{}", component.id, scheme, address, route);
             if let Some(description) = &component.description {
                 println!("    {}", description);
diff --git a/src/commands/up.rs b/src/commands/up.rs
index bc78e05dd1..cf532a4077 100644
--- a/src/commands/up.rs
+++ b/src/commands/up.rs
@@ -8,6 +8,7 @@ use anyhow::{bail, Context, Result};
 use clap::{CommandFactory, Parser};
 use spin_loader::bindle::BindleConnectionInfo;
 use spin_manifest::ApplicationTrigger;
+use spin_trigger::cli::{SPIN_LOCKED_URL, SPIN_WORKING_DIR};
 use tempfile::TempDir;
 
 use crate::opts::*;
@@ -77,14 +78,14 @@ pub struct UpCommand {
     )]
     pub insecure: bool,
 
+    /// Pass an environment variable (key=value) to all components of the application.
+    #[clap(short = 'e', long = "env", parse(try_from_str = parse_env_var))]
+    pub env: Vec<(String, String)>,
+
     /// Temporary directory for the static assets of the components.
     #[clap(long = "temp")]
     pub tmp: Option<PathBuf>,
 
-    /// Set the static assets of the components in the temporary directory as writable.
-    #[clap(long = "allow-transient-write")]
-    pub allow_transient_write: bool,
-
     /// All other args, to be passed through to the trigger
     #[clap(hide = true)]
     pub trigger_args: Vec<OsString>,
@@ -92,6 +93,8 @@ pub struct UpCommand {
 
 impl UpCommand {
     pub async fn run(self) -> Result<()> {
+        // For displaying help, first print `spin up`'s own usage text, then
+        // attempt to load an app and print trigger-type-specific usage.
         let help = self.help;
         if help {
             Self::command()
@@ -100,6 +103,7 @@ impl UpCommand {
                 .print_help()?;
             println!();
         }
+
         self.run_inner().await.or_else(|err| {
             if help {
                 tracing::warn!("Error resolving trigger-specific help: {}", err);
@@ -111,55 +115,48 @@ impl UpCommand {
     }
 
     async fn run_inner(self) -> Result<()> {
-        let working_dir_holder = match &self.tmp {
+        let working_dir = match &self.tmp {
             None => WorkingDirectory::Temporary(tempfile::tempdir()?),
             Some(d) => WorkingDirectory::Given(d.to_owned()),
         };
-        let working_dir = working_dir_holder.path();
 
-        let app = match (&self.app, &self.bindle) {
+        let mut app = match (&self.app, &self.bindle) {
             (app, None) => {
                 let manifest_file = app
                     .as_deref()
                     .unwrap_or_else(|| DEFAULT_MANIFEST_FILE.as_ref());
                 let bindle_connection = self.bindle_connection();
-                spin_loader::from_file(
-                    manifest_file,
-                    working_dir,
-                    &bindle_connection,
-                    self.allow_transient_write,
-                )
-                .await?
+                spin_loader::from_file(manifest_file, &working_dir, &bindle_connection).await?
             }
             (None, Some(bindle)) => match &self.server {
-                Some(server) => {
-                    spin_loader::from_bindle(
-                        bindle,
-                        server,
-                        working_dir,
-                        self.allow_transient_write,
-                    )
-                    .await?
-                }
+                Some(server) => spin_loader::from_bindle(bindle, server, &working_dir).await?,
                 _ => bail!("Loading from a bindle requires a Bindle server URL"),
             },
             (Some(_), Some(_)) => bail!("Specify only one of app file or bindle ID"),
         };
 
-        let manifest_url = match app.info.origin {
-            spin_manifest::ApplicationOrigin::File(path) => {
-                format!("file://{}", path.canonicalize()?.to_string_lossy())
+        // Apply --env to component environments
+        if !self.env.is_empty() {
+            for component in app.components.iter_mut() {
+                component.wasm.environment.extend(self.env.iter().cloned());
             }
-            spin_manifest::ApplicationOrigin::Bindle { id, server } => {
-                format!("bindle+{}?id={}", server, id)
-            }
-        };
+        }
 
         let trigger_type = match app.info.trigger {
             ApplicationTrigger::Http(_) => "http",
             ApplicationTrigger::Redis(_) => "redis",
         };
 
+        // Build and write app lock file
+        let locked_app = spin_trigger::locked::build_locked_app(app, working_dir.as_ref())?;
+        let locked_path = working_dir.as_ref().join("spin.lock");
+        let locked_app_contents =
+            serde_json::to_vec_pretty(&locked_app).context("failed to serialize locked app")?;
+        std::fs::write(&locked_path, locked_app_contents)
+            .with_context(|| format!("failed to write {:?}", locked_path))?;
+        let locked_url = format!("file://{}", locked_path.to_string_lossy());
+
+        // For `spin up --help`, we just want the executor to dump its own argument usage info
         let trigger_args = if self.help {
             vec![OsString::from("--help-args-only")]
         } else {
@@ -168,26 +165,20 @@ impl UpCommand {
 
         // The docs for `current_exe` warn that this may be insecure because it could be executed
         // via hard-link. I think it should be fine as long as we aren't `setuid`ing this binary.
-        let mut cmd = std::process::Command::new(std::env::current_exe().unwrap());
+        let spin_path = std::env::current_exe().unwrap();
+
+        let mut cmd = std::process::Command::new(spin_path);
         cmd.arg("trigger")
-            .env("SPIN_WORKING_DIR", working_dir)
-            .env("SPIN_MANIFEST_URL", manifest_url)
-            .env("SPIN_TRIGGER_TYPE", trigger_type)
-            .env(
-                "SPIN_ALLOW_TRANSIENT_WRITE",
-                self.allow_transient_write.to_string(),
-            )
+            .env(SPIN_WORKING_DIR, working_dir.as_ref())
+            .env(SPIN_LOCKED_URL, locked_url)
             .arg(trigger_type)
             .args(trigger_args);
 
-        if let Some(bindle_server) = self.server {
-            cmd.env(BINDLE_URL_ENV, bindle_server);
-        }
-
         tracing::trace!("Running trigger executor: {:?}", cmd);
 
         let mut child = cmd.spawn().context("Failed to execute trigger")?;
 
+        // Terminate trigger executor if `spin up` itself receives a termination signal
         #[cfg(not(windows))]
         {
             // https://github.com/nix-rust/nix/issues/656
@@ -224,11 +215,20 @@ enum WorkingDirectory {
     Temporary(TempDir),
 }
 
-impl WorkingDirectory {
-    fn path(&self) -> &Path {
+impl AsRef<Path> for WorkingDirectory {
+    fn as_ref(&self) -> &Path {
         match self {
             Self::Given(p) => p,
             Self::Temporary(t) => t.path(),
         }
     }
 }
+
+// Parse the environment variables passed in `key=value` pairs.
+fn parse_env_var(s: &str) -> Result<(String, String)> {
+    let parts: Vec<_> = s.splitn(2, '=').collect();
+    if parts.len() != 2 {
+        bail!("Environment variable must be of the form `key=value`");
+    }
+    Ok((parts[0].to_owned(), parts[1].to_owned()))
+}