From 1e0759f80df74a037855ea81ed03c0c94ea5f654 Mon Sep 17 00:00:00 2001
From: Ruslan Pislari <ruslan.pislari@gcore.com>
Date: Fri, 28 Mar 2025 09:29:18 +0200
Subject: [PATCH] key value store implementation

---
 Cargo.lock                                    | 600 ++++++++++--------
 Cargo.toml                                    |  11 +-
 crates/http-backend/Cargo.toml                |   4 +-
 crates/http-service/Cargo.toml                |   6 +-
 crates/http-service/src/executor/http.rs      |  69 +-
 crates/http-service/src/executor/wasi_http.rs |  17 +-
 crates/http-service/src/lib.rs                |  23 +-
 crates/http-service/src/state.rs              |   6 +-
 crates/key-value-store/Cargo.toml             |  17 +
 crates/key-value-store/src/lib.rs             | 142 +++++
 crates/reactor/Cargo.toml                     |   2 +-
 crates/runtime/Cargo.toml                     |   8 +-
 crates/runtime/src/app.rs                     |  33 +-
 crates/runtime/src/lib.rs                     |  18 +
 crates/runtime/src/store.rs                   |  42 +-
 crates/secret/Cargo.toml                      |   1 -
 crates/secret/src/lib.rs                      |  45 +-
 sdk                                           |   2 +-
 src/context.rs                                | 160 +++++
 src/executor.rs                               |  34 +
 src/key_value.rs                              |  28 +
 src/main.rs                                   | 187 +-----
 22 files changed, 906 insertions(+), 549 deletions(-)
 create mode 100644 crates/key-value-store/Cargo.toml
 create mode 100644 crates/key-value-store/src/lib.rs
 create mode 100644 src/context.rs
 create mode 100644 src/executor.rs
 create mode 100644 src/key_value.rs

diff --git a/Cargo.lock b/Cargo.lock
index c93f7f8..42b7018 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -26,7 +26,7 @@ dependencies = [
  "cfg-if",
  "once_cell",
  "version_check",
- "zerocopy",
+ "zerocopy 0.7.35",
 ]
 
 [[package]]
@@ -117,9 +117,9 @@ dependencies = [
 
 [[package]]
 name = "anyhow"
-version = "1.0.95"
+version = "1.0.97"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "34ac096ce696dc2fcabef30516bb13c0a68a11d30131d3df6f04711467681b04"
+checksum = "dcfed56ad506cb2c684a14971b8861fdc3baaaae314b9e5f9bb532cbe3ba7a4f"
 
 [[package]]
 name = "arbitrary"
@@ -129,9 +129,9 @@ checksum = "dde20b3d026af13f561bdd0f15edf01fc734f0dafcedbaf42bba506a9517f223"
 
 [[package]]
 name = "async-trait"
-version = "0.1.86"
+version = "0.1.88"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "644dd749086bf3771a2fbc5f256fdb982d53f011c7d5d560304eafeecebce79d"
+checksum = "e539d3fca749fcee5236ab05e93a52867dd549cc157c8cb7f99595f3cedffdb5"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -144,6 +144,18 @@ version = "1.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1505bd5d3d116872e7271a6d4e16d81d0c8570876c8de68093a09ac269d8aac0"
 
+[[package]]
+name = "auditable-serde"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c7bf8143dfc3c0258df908843e169b5cc5fcf76c7718bd66135ef4a9cd558c5"
+dependencies = [
+ "semver",
+ "serde",
+ "serde_json",
+ "topological-sort",
+]
+
 [[package]]
 name = "autocfg"
 version = "1.4.0"
@@ -179,9 +191,9 @@ checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
 
 [[package]]
 name = "bitflags"
-version = "2.8.0"
+version = "2.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8f68f53c83ab957f72c32642f3868eec03eb974d1fb82e453128456482613d36"
+checksum = "5c8214115b7bf84099f1309324e63141d4c5d7cc26862f97a0a857dbefe165bd"
 
 [[package]]
 name = "block-buffer"
@@ -194,9 +206,9 @@ dependencies = [
 
 [[package]]
 name = "borsh"
-version = "1.5.5"
+version = "1.5.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5430e3be710b68d984d1391c854eb431a9d548640711faa54eecb1df93db91cc"
+checksum = "ad8646f98db542e39fc66e68a20b2144f6a732636df7c2354e74645faaa433ce"
 dependencies = [
  "cfg_aliases",
 ]
@@ -221,18 +233,18 @@ dependencies = [
 
 [[package]]
 name = "bytemuck"
-version = "1.21.0"
+version = "1.22.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ef657dfab802224e671f5818e9a4935f9b1957ed18e58292690cc39e7a4092a3"
+checksum = "b6b1fc10dbac614ebc03540c9dbd60e83887fda27794998c6528f1782047d540"
 dependencies = [
  "bytemuck_derive",
 ]
 
 [[package]]
 name = "bytemuck_derive"
-version = "1.8.1"
+version = "1.9.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3fa76293b4f7bb636ab88fd78228235b5248b4d05cc589aed610f954af5d7c7a"
+checksum = "7ecc273b49b3205b83d648f0690daa588925572cc5063745bfe547fe7ec8e1a1"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -247,15 +259,15 @@ checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b"
 
 [[package]]
 name = "bytes"
-version = "1.10.0"
+version = "1.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f61dac84819c6588b558454b194026eb1f09c293b9036ae9b159e74e73ab6cf9"
+checksum = "d71b6127be86fdcfddb610f7182ac57211d4b18a3e9c82eb2d17662f2227ad6a"
 
 [[package]]
 name = "bytesize"
-version = "1.3.2"
+version = "2.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2d2c12f985c78475a6b8d629afd0c360260ef34cfef52efccdcfd31972f81c2e"
+checksum = "a3c8f83209414aacf0eeae3cf730b18d6981697fba62f200fcfb92b9f082acba"
 
 [[package]]
 name = "candle-core"
@@ -332,7 +344,7 @@ checksum = "4ac68674a6042af2bcee1adad9f6abd432642cf03444ce3a5b36c3f39f23baf8"
 dependencies = [
  "cap-primitives",
  "cap-std",
- "rustix",
+ "rustix 0.38.44",
  "smallvec",
 ]
 
@@ -348,7 +360,7 @@ dependencies = [
  "io-lifetimes",
  "ipnet",
  "maybe-owned",
- "rustix",
+ "rustix 0.38.44",
  "windows-sys 0.59.0",
  "winx",
 ]
@@ -372,7 +384,7 @@ dependencies = [
  "cap-primitives",
  "io-extras",
  "io-lifetimes",
- "rustix",
+ "rustix 0.38.44",
 ]
 
 [[package]]
@@ -385,15 +397,15 @@ dependencies = [
  "cap-primitives",
  "iana-time-zone",
  "once_cell",
- "rustix",
+ "rustix 0.38.44",
  "winx",
 ]
 
 [[package]]
 name = "cc"
-version = "1.2.14"
+version = "1.2.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0c3d1b2e905a3a7b00a6141adb0e4c0bb941d11caf55349d863942a1cc44e3c9"
+checksum = "1fcb57c740ae1daf453ae85f16e37396f672b039e00d9d866e07ddb24e328e3a"
 dependencies = [
  "jobserver",
  "libc",
@@ -414,9 +426,9 @@ checksum = "613afe47fcd5fac7ccf1db93babcb082c5994d996f20b8b159f2ad1658eb5724"
 
 [[package]]
 name = "chrono"
-version = "0.4.39"
+version = "0.4.40"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7e36cc9d416881d2e24f9a963be5fb1cd90966419ac844274161d10488b3e825"
+checksum = "1a7964611d71df112cb1730f2ee67324fcf4d0fc6606acbbe9bfe06df124637c"
 dependencies = [
  "android-tzdata",
  "iana-time-zone",
@@ -424,7 +436,7 @@ dependencies = [
  "num-traits",
  "serde",
  "wasm-bindgen",
- "windows-targets",
+ "windows-link",
 ]
 
 [[package]]
@@ -441,9 +453,9 @@ checksum = "bba18ee93d577a8428902687bcc2b6b45a56b1981a1f6d779731c86cc4c5db18"
 
 [[package]]
 name = "clap"
-version = "4.5.30"
+version = "4.5.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "92b7b18d71fad5313a1e320fa9897994228ce274b60faa4d694fe0ea89cd9e6d"
+checksum = "e958897981290da2a852763fe9cdb89cd36977a5d729023127095fa94d95e2ff"
 dependencies = [
  "clap_builder",
  "clap_derive",
@@ -451,9 +463,9 @@ dependencies = [
 
 [[package]]
 name = "clap_builder"
-version = "4.5.30"
+version = "4.5.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a35db2071778a7344791a4fb4f95308b5673d219dee3ae348b86642574ecc90c"
+checksum = "83b0f35019843db2160b5bb19ae09b4e6411ac33fc6a712003c33e03090e2489"
 dependencies = [
  "anstream",
  "anstyle",
@@ -463,9 +475,9 @@ dependencies = [
 
 [[package]]
 name = "clap_derive"
-version = "4.5.28"
+version = "4.5.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bf4ced95c6f4a675af3da73304b9ac4ed991640c36374e4b46795c49e17cf1ed"
+checksum = "09176aae279615badda0765c0c0b3f6ed53f4709118af73cf4655d85d1530cd7"
 dependencies = [
  "heck",
  "proc-macro2",
@@ -481,9 +493,9 @@ checksum = "f46ad14479a25103f283c0f10005961cf086d8dc42205bb44c46ac563475dca6"
 
 [[package]]
 name = "clickhouse"
-version = "0.13.1"
+version = "0.13.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2135bb9638e8c8c1e3d794f242099e57987059ba52e7e3de597e1d99b2c4a5a3"
+checksum = "d9894248c4c5a4402f76a56c273836a0c32547ec8a68166aedee7e01b7b8d102"
 dependencies = [
  "bstr",
  "bytes",
@@ -590,7 +602,7 @@ dependencies = [
 [[package]]
 name = "cranelift-bitset"
 version = "0.116.1"
-source = "git+https://github.com/G-Core/wasmtime.git?branch=wasi_nn_candle_backend#f79220e9b613bcd0381dd4aec26695686c170aaf"
+source = "git+https://github.com/G-Core/wasmtime.git?branch=wasi_nn_candle_backend#566d11edfe6d46d4f75472f8713da04598ae3252"
 dependencies = [
  "serde",
  "serde_derive",
@@ -648,7 +660,7 @@ dependencies = [
 [[package]]
 name = "cranelift-entity"
 version = "0.116.1"
-source = "git+https://github.com/G-Core/wasmtime.git?branch=wasi_nn_candle_backend#f79220e9b613bcd0381dd4aec26695686c170aaf"
+source = "git+https://github.com/G-Core/wasmtime.git?branch=wasi_nn_candle_backend#566d11edfe6d46d4f75472f8713da04598ae3252"
 dependencies = [
  "cranelift-bitset 0.116.1 (git+https://github.com/G-Core/wasmtime.git?branch=wasi_nn_candle_backend)",
  "serde",
@@ -828,9 +840,9 @@ dependencies = [
 
 [[package]]
 name = "either"
-version = "1.13.0"
+version = "1.15.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "60b1af1c220855b6ceac025d3f6ecdd2b7c4894bfe9cd9bda4fbb4bc7c0d4cf0"
+checksum = "48c757948c5ede0e46177b7add2e67155f70e33c07fea8284df6576da70b3719"
 
 [[package]]
 name = "embedded-io"
@@ -865,16 +877,6 @@ dependencies = [
  "syn",
 ]
 
-[[package]]
-name = "env_filter"
-version = "0.1.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "186e05a59d4c50738528153b83b0b0194d3a29507dfec16eccd4b342903397d0"
-dependencies = [
- "log",
- "regex",
-]
-
 [[package]]
 name = "env_logger"
 version = "0.10.2"
@@ -888,19 +890,6 @@ dependencies = [
  "termcolor",
 ]
 
-[[package]]
-name = "env_logger"
-version = "0.11.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dcaee3d8e3cfc3fd92428d477bc97fc29ec8716d180c0d74c643bb26166660e0"
-dependencies = [
- "anstream",
- "anstyle",
- "env_filter",
- "humantime",
- "log",
-]
-
 [[package]]
 name = "equivalent"
 version = "1.0.2"
@@ -939,6 +928,7 @@ dependencies = [
  "hyper",
  "hyper-tls",
  "hyper-util",
+ "key-value-store",
  "pretty_env_logger",
  "runtime",
  "secret",
@@ -956,13 +946,23 @@ checksum = "37909eebbb50d72f9059c3b6d82c0463f2ff062c9e95845c43a6c9c0355411be"
 
 [[package]]
 name = "fd-lock"
-version = "4.0.2"
+version = "4.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7e5768da2206272c81ef0b5e951a41862938a6070da63bcea197899942d3b947"
+checksum = "0ce92ff622d6dadf7349484f42c93271a0d49b7cc4d466a936405bacbe10aa78"
 dependencies = [
  "cfg-if",
- "rustix",
- "windows-sys 0.52.0",
+ "rustix 1.0.3",
+ "windows-sys 0.59.0",
+]
+
+[[package]]
+name = "flate2"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "11faaf5a5236997af9848be0bef4db95824b1d534ebc64d0f0c6cf3e67bd38dc"
+dependencies = [
+ "crc32fast",
+ "miniz_oxide",
 ]
 
 [[package]]
@@ -973,9 +973,9 @@ checksum = "3f9eec918d3f24069decb9af1554cad7c880e2da24a9afd88aca000531ab82c1"
 
 [[package]]
 name = "foldhash"
-version = "0.1.4"
+version = "0.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a0d2fde1f7b3d48b8395d5f2de76c18a528bd6a9cdde438df747bfcba3e05d6f"
+checksum = "d9c4f5dac5e15c24eb999c26181a6ca40b39fe946cbe4c263c7209467bc83af2"
 
 [[package]]
 name = "foreign-types"
@@ -1003,12 +1003,12 @@ dependencies = [
 
 [[package]]
 name = "fs-set-times"
-version = "0.20.2"
+version = "0.20.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5e2e6123af26f0f2c51cc66869137080199406754903cc926a7690401ce09cb4"
+checksum = "94e7099f6313ecacbe1256e8ff9d617b75d1bcb16a6fddef94866d225a01a14a"
 dependencies = [
  "io-lifetimes",
- "rustix",
+ "rustix 1.0.3",
  "windows-sys 0.59.0",
 ]
 
@@ -1116,7 +1116,7 @@ version = "0.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "27d12c0aed7f1e24276a241aadc4cb8ea9f83000f34bc062b7cc2d51e3b0fabd"
 dependencies = [
- "bitflags 2.8.0",
+ "bitflags 2.9.0",
  "debugid",
  "fxhash",
  "serde",
@@ -1277,14 +1277,14 @@ dependencies = [
 
 [[package]]
 name = "getrandom"
-version = "0.3.1"
+version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "43a49c392881ce6d5c3b8cb70f98717b7c07aabbdff06687b9030dbfbe2725f8"
+checksum = "73fea8450eea4bac3940448fb7ae50d91f034f941199fcd9d909a5a07aa455f0"
 dependencies = [
  "cfg-if",
  "libc",
- "wasi 0.13.3+wasi-0.2.2",
- "windows-targets",
+ "r-efi",
+ "wasi 0.14.2+wasi-0.2.4",
 ]
 
 [[package]]
@@ -1320,8 +1320,7 @@ dependencies = [
 [[package]]
 name = "half"
 version = "2.4.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6dd08c532ae367adf81c312a4580bc67f1d0fe8bc9c460520283f4c0ff277888"
+source = "git+https://github.com/starkat99/half-rs.git?tag=v2.4.1#b2c5209f437fbe189e7e1533b3919a596f4a8dc5"
 dependencies = [
  "bytemuck",
  "cfg-if",
@@ -1364,9 +1363,9 @@ checksum = "d231dfb89cfffdbc30e7fc41579ed6066ad03abda9e567ccafae602b97ec5024"
 
 [[package]]
 name = "hermit-abi"
-version = "0.4.0"
+version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fbf6a919d6cf397374f7dfeeea91d974c7c0a7221d0d0f4f20d859d329e53fcc"
+checksum = "fbd780fe5cc30f81464441920d82ac8740e2e46b29a6fad543ddd075229ce37e"
 
 [[package]]
 name = "hex"
@@ -1376,9 +1375,9 @@ checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70"
 
 [[package]]
 name = "http"
-version = "1.2.0"
+version = "1.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f16ca2af56261c99fba8bac40a10251ce8188205a4c448fbb745a2e4daa76fea"
+checksum = "f4a85d31aea989eead29a3aaf9e1115a180df8282431156e533de47660892565"
 dependencies = [
  "bytes",
  "fnv",
@@ -1417,12 +1416,12 @@ dependencies = [
 
 [[package]]
 name = "http-body-util"
-version = "0.1.2"
+version = "0.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "793429d76616a256bcb62c2a2ec2bed781c8307e797e2598c50010f2bee2544f"
+checksum = "b021d93e26becf5dc7e1b75b1bed1fd93124b374ceb73f43d4d4eafec896a64a"
 dependencies = [
  "bytes",
- "futures-util",
+ "futures-core",
  "http",
  "http-body",
  "pin-project-lite",
@@ -1443,6 +1442,7 @@ dependencies = [
  "http-body-util",
  "hyper",
  "hyper-util",
+ "key-value-store",
  "nanoid",
  "reactor",
  "runtime",
@@ -1462,9 +1462,9 @@ dependencies = [
 
 [[package]]
 name = "httparse"
-version = "1.10.0"
+version = "1.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f2d708df4e7140240a16cd6ab0ab65c972d7433ab77819ea693fde9c43811e2a"
+checksum = "6dbf3de79e51f3d586ab4cb9d5c3e2c14aa28ed23d180cf89b4df0454a69cc87"
 
 [[package]]
 name = "httpdate"
@@ -1474,9 +1474,9 @@ checksum = "df3b46402a9d5adb4c86a0cf463f42e19994e3ee891101b1841f30a545cb49a9"
 
 [[package]]
 name = "humantime"
-version = "2.1.0"
+version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9a3a5bfb195931eeb336b2a7b4d761daec841b97f947d34394601737a7bba5e4"
+checksum = "9b112acc8b3adf4b107a8ec20977da0273a8c386765a3ec0229bd500a1443f9f"
 
 [[package]]
 name = "hyper"
@@ -1536,14 +1536,15 @@ dependencies = [
 
 [[package]]
 name = "iana-time-zone"
-version = "0.1.61"
+version = "0.1.62"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "235e081f3925a06703c2d0117ea8b91f042756fd6e7a6e5d901e8ca1a996b220"
+checksum = "b2fd658b06e56721792c5df4475705b6cda790e9298d19d2f8af083457bcd127"
 dependencies = [
  "android_system_properties",
  "core-foundation-sys",
  "iana-time-zone-haiku",
  "js-sys",
+ "log",
  "wasm-bindgen",
  "windows-core 0.52.0",
 ]
@@ -1598,9 +1599,9 @@ dependencies = [
 
 [[package]]
 name = "icu_locid_transform_data"
-version = "1.5.0"
+version = "1.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fdc8ff3388f852bede6b579ad4e978ab004f139284d7b28715f773507b946f6e"
+checksum = "7515e6d781098bf9f7205ab3fc7e9709d34554ae0b21ddbcb5febfa4bc7df11d"
 
 [[package]]
 name = "icu_normalizer"
@@ -1622,9 +1623,9 @@ dependencies = [
 
 [[package]]
 name = "icu_normalizer_data"
-version = "1.5.0"
+version = "1.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f8cafbf7aa791e9b22bec55a167906f9e1215fd475cd22adfcf660e03e989516"
+checksum = "c5e8338228bdc8ab83303f16b797e177953730f601a96c25d10cb3ab0daa0cb7"
 
 [[package]]
 name = "icu_properties"
@@ -1643,9 +1644,9 @@ dependencies = [
 
 [[package]]
 name = "icu_properties_data"
-version = "1.5.0"
+version = "1.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "67a8effbc3dd3e4ba1afa8ad918d5684b8868b3b26500753effea8d2eed19569"
+checksum = "85fb8799753b75aee8d2a21d7c14d9f38921b54b3dbda10f5a3c7a7b82dba5e2"
 
 [[package]]
 name = "icu_provider"
@@ -1704,9 +1705,9 @@ dependencies = [
 
 [[package]]
 name = "indexmap"
-version = "2.7.1"
+version = "2.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8c9c992b02b5b4c94ea26e32fe5bccb7aa7d9f390ab5c1221ff895bc7ea8b652"
+checksum = "3954d50fe15b02142bf25d3b8bdadb634ec3948f103d04ffe3031bc8fe9d7058"
 dependencies = [
  "equivalent",
  "hashbrown 0.15.2",
@@ -1737,11 +1738,11 @@ checksum = "469fb0b9cefa57e3ef31275ee7cacb78f2fdca44e4765491884a2b119d4eb130"
 
 [[package]]
 name = "is-terminal"
-version = "0.4.15"
+version = "0.4.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e19b23d53f35ce9f56aebc7d1bb4e6ac1e9c0db7ac85c8d1760c04379edced37"
+checksum = "e04d7f318608d35d4b61ddd75cbdaee86b023ebe2bd5a66ee0915f0bf93095a9"
 dependencies = [
- "hermit-abi 0.4.0",
+ "hermit-abi 0.5.0",
  "libc",
  "windows-sys 0.59.0",
 ]
@@ -1772,9 +1773,9 @@ dependencies = [
 
 [[package]]
 name = "itoa"
-version = "1.0.14"
+version = "1.0.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d75a2a4b1b190afb6f5425f10f6a8f959d2ea0b9c2b1d79553551850539e4674"
+checksum = "4a5f13b858c8d314ee3e8f639011f7ccefe71f97f96e50151fb991f267928e2c"
 
 [[package]]
 name = "ittapi"
@@ -1815,6 +1816,17 @@ dependencies = [
  "wasm-bindgen",
 ]
 
+[[package]]
+name = "key-value-store"
+version = "0.10.2"
+dependencies = [
+ "async-trait",
+ "reactor",
+ "slab",
+ "smol_str",
+ "wasmtime",
+]
+
 [[package]]
 name = "lazy_static"
 version = "1.5.0"
@@ -1835,9 +1847,9 @@ checksum = "09edd9e8b54e49e587e4f6295a7d29c3ea94d469cb40ab8ca70b288248a81db2"
 
 [[package]]
 name = "libc"
-version = "0.2.169"
+version = "0.2.171"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b5aba8db14291edd000dfcc4d620c7ebfb122c613afb886ca8803fa4e128a20a"
+checksum = "c19937216e9d3aa9956d9bb8dfc0b0c8beb6058fc4f7a4dc4d850edf86a237d6"
 
 [[package]]
 name = "libloading"
@@ -1861,7 +1873,7 @@ version = "0.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c0ff37bd590ca25063e35af745c343cb7a0271906fb7b37e4813e8f79f00268d"
 dependencies = [
- "bitflags 2.8.0",
+ "bitflags 2.9.0",
  "libc",
 ]
 
@@ -1871,11 +1883,17 @@ version = "0.4.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d26c52dbd32dccf2d10cac7725f8eae5296885fb5703b261f7d0a0739ec807ab"
 
+[[package]]
+name = "linux-raw-sys"
+version = "0.9.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fe7db12097d22ec582439daf8618b8fdd1a7bef6270e9af3b1ebcd30893cf413"
+
 [[package]]
 name = "litemap"
-version = "0.7.4"
+version = "0.7.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4ee93343901ab17bd981295f2cf0026d4ad018c7c31ba84549a4ddbb47a45104"
+checksum = "23fb14cb19457329c82206317a5663005a4d404783dc74f4252769b0d5f42856"
 
 [[package]]
 name = "lock_api"
@@ -1889,9 +1907,9 @@ dependencies = [
 
 [[package]]
 name = "log"
-version = "0.4.25"
+version = "0.4.27"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "04cbf5b083de1c7e0222a7a51dbfdba1cbe1c6ab0b15e29fff3f6c077fd9cd9f"
+checksum = "13dc2df351e3202783a1fe0d44375f7295ffb4049267b0f3018346dc122a1d94"
 
 [[package]]
 name = "loom"
@@ -1948,7 +1966,7 @@ version = "0.6.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b2cffa4ad52c6f791f4f8b15f0c05f9824b2ced1160e88cc393d64fff9a8ac64"
 dependencies = [
- "rustix",
+ "rustix 0.38.44",
 ]
 
 [[package]]
@@ -1972,9 +1990,9 @@ dependencies = [
 
 [[package]]
 name = "miniz_oxide"
-version = "0.8.4"
+version = "0.8.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b3b1c9bd4fe1f0f8b387f6eb9eb3b4a1aa26185e5750efb9140301703f62cd1b"
+checksum = "8e3e04debbb59698c15bacbb6d93584a8c0ca9cc3213cb423d31f760d8843ce5"
 dependencies = [
  "adler2",
 ]
@@ -2037,9 +2055,9 @@ dependencies = [
 
 [[package]]
 name = "native-tls"
-version = "0.2.13"
+version = "0.2.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0dab59f8e050d5df8e4dd87d9206fb6f65a483e20ac9fda365ade4fab353196c"
+checksum = "87de3442987e9dbec73158d5c715e7ad9072fda936bb03d19d7fa10e00520f0e"
 dependencies = [
  "libc",
  "log",
@@ -2120,9 +2138,9 @@ dependencies = [
 
 [[package]]
 name = "once_cell"
-version = "1.20.3"
+version = "1.21.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "945462a4b81e43c4e3ba96bd7b49d834c6f61198356aa858733bc4acf3cbe62e"
+checksum = "42f5e15c9953c5e4ccceeb2e7382a716482c34515315f7b03532b8b4e8393d2d"
 
 [[package]]
 name = "openssl"
@@ -2130,7 +2148,7 @@ version = "0.10.71"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5e14130c6a98cd258fdcb0fb6d744152343ff729cbfcb28c656a9d12b999fbcd"
 dependencies = [
- "bitflags 2.8.0",
+ "bitflags 2.9.0",
  "cfg-if",
  "foreign-types",
  "libc",
@@ -2170,19 +2188,20 @@ dependencies = [
 
 [[package]]
 name = "openvino"
-version = "0.8.0"
+version = "0.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8f03a664ab0b6917131f5c1a787795fa4d19ad6a334caf9c96284453abdf23fd"
+checksum = "24bd3a7ef39968e6a4f1b1206c1c876f9bd50cf739ccbcd69f8539bbac5dcc7a"
 dependencies = [
  "openvino-finder",
  "openvino-sys",
+ "thiserror",
 ]
 
 [[package]]
 name = "openvino-finder"
-version = "0.8.0"
+version = "0.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "34d6bbb3e00d9ad3cd60bca1341665a9cfb2b6764df37c58d921627368ae32fc"
+checksum = "05d234d1394a413ea8adaf0c40806b9ad1946be6310b441f688840654a331973"
 dependencies = [
  "cfg-if",
  "log",
@@ -2190,11 +2209,11 @@ dependencies = [
 
 [[package]]
 name = "openvino-sys"
-version = "0.8.0"
+version = "0.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "04315994236727c3573f7e8d8bf857e93ff373ee2e063f08aa78aceac58e3bc5"
+checksum = "44c98acf37fc84ad9d7da4dc6c18f0f60ad209b43a6f555be01f9003d0a2a43d"
 dependencies = [
- "env_logger 0.11.6",
+ "env_logger",
  "libloading",
  "once_cell",
  "openvino-finder",
@@ -2243,18 +2262,18 @@ checksum = "e3148f5046208a5d56bcfc03053e3ca6334e51da8dfb19b6cdc8b306fae3283e"
 
 [[package]]
 name = "pin-project"
-version = "1.1.9"
+version = "1.1.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dfe2e71e1471fe07709406bf725f710b02927c9c54b2b5b2ec0e8087d97c327d"
+checksum = "677f1add503faace112b9f1373e43e9e054bfdd22ff1a63c1bc485eaec6a6a8a"
 dependencies = [
  "pin-project-internal",
 ]
 
 [[package]]
 name = "pin-project-internal"
-version = "1.1.9"
+version = "1.1.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f6e859e6e5bd50440ab63c47e3ebabc90f26251f7c73c3d3e837b74a1cc3fa67"
+checksum = "6e918e4ff8c4549eb882f14b3a4bc8c8bc93de829416eacf579f1207a8fbf861"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -2275,15 +2294,15 @@ checksum = "8b870d8c151b6f2fb93e84a13146138f05d02ed11c7e7c54f8826aaaf7c9f184"
 
 [[package]]
 name = "pkg-config"
-version = "0.3.31"
+version = "0.3.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "953ec861398dccce10c670dfeaf3ec4911ca479e9c02154b3a215178c5f566f2"
+checksum = "7edddbd0b52d732b21ad9a5fab5c704c14cd949e5e9a1ec5929a24fded1b904c"
 
 [[package]]
 name = "portable-atomic"
-version = "1.10.0"
+version = "1.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "280dc24453071f1b63954171985a0b0d30058d287960968b9b2aca264c8d4ee6"
+checksum = "350e9b48cbc6b0e028b0473b114454c6316e57336ee184ceab6e53f72c178b3e"
 
 [[package]]
 name = "postcard"
@@ -2299,11 +2318,11 @@ dependencies = [
 
 [[package]]
 name = "ppv-lite86"
-version = "0.2.20"
+version = "0.2.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "77957b295656769bb8ad2b6a6b09d897d94f05c41b069aede1fcdaa675eaea04"
+checksum = "85eae3c4ed2f50dcfe72643da4befc30deadb458a9b590d720cde2f2b1e97da9"
 dependencies = [
- "zerocopy",
+ "zerocopy 0.8.24",
 ]
 
 [[package]]
@@ -2312,15 +2331,15 @@ version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "865724d4dbe39d9f3dd3b52b88d859d66bcb2d6a0acfd5ea68a65fb66d4bdc1c"
 dependencies = [
- "env_logger 0.10.2",
+ "env_logger",
  "log",
 ]
 
 [[package]]
 name = "proc-macro2"
-version = "1.0.93"
+version = "1.0.94"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "60946a68e5f9d28b0dc1c21bb8a97ee7d018a8b322fa57838ba31cc878e22d99"
+checksum = "a31971752e70b8b2686d7e46ec17fb38dad4051d94024c88df49b667caea9c84"
 dependencies = [
  "unicode-ident",
 ]
@@ -2331,11 +2350,11 @@ version = "0.16.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "731e0d9356b0c25f16f33b5be79b1c57b562f141ebfcdb0ad8ac2c13a24293b4"
 dependencies = [
- "bitflags 2.8.0",
+ "bitflags 2.9.0",
  "hex",
  "lazy_static",
  "procfs-core",
- "rustix",
+ "rustix 0.38.44",
 ]
 
 [[package]]
@@ -2344,7 +2363,7 @@ version = "0.16.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2d3554923a69f4ce04c4a754260c338f505ce22642d3830e049a399fc2059a29"
 dependencies = [
- "bitflags 2.8.0",
+ "bitflags 2.9.0",
  "hex",
 ]
 
@@ -2404,13 +2423,19 @@ dependencies = [
 
 [[package]]
 name = "quote"
-version = "1.0.38"
+version = "1.0.40"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0e4dccaaaf89514f546c693ddc140f729f958c247918a13380cccc6078391acc"
+checksum = "1885c039570dc00dcb4ff087a89e185fd56bae234ddc7f056a945bf36467248d"
 dependencies = [
  "proc-macro2",
 ]
 
+[[package]]
+name = "r-efi"
+version = "5.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "74765f6d916ee2faa39bc8e68e4f3ed8949b48cccdac59983d287a7cb71ce9c5"
+
 [[package]]
 name = "rand"
 version = "0.8.5"
@@ -2495,11 +2520,11 @@ checksum = "03251193000f4bd3b042892be858ee50e8b3719f2b08e5833ac4353724632430"
 
 [[package]]
 name = "redox_syscall"
-version = "0.5.8"
+version = "0.5.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "03a862b389f93e68874fbf580b9de08dd02facb9a788ebadaf4a3fd33cf58834"
+checksum = "0b8c0c260b63a8219631167be35e6a988e9554dbd323f8bd08439c8ed1302bd1"
 dependencies = [
- "bitflags 2.8.0",
+ "bitflags 2.9.0",
 ]
 
 [[package]]
@@ -2585,9 +2610,9 @@ checksum = "b9b1a3d5f46d53f4a3478e2be4a5a5ce5108ea58b100dcd139830eae7f79a3a1"
 
 [[package]]
 name = "ring"
-version = "0.17.9"
+version = "0.17.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e75ec5e92c4d8aede845126adc388046234541629e76029599ed35a003c7ed24"
+checksum = "a4689e6c2294d81e88dc6261c768b63bc4fcdb852be6d1352498b114f61383b7"
 dependencies = [
  "cc",
  "cfg-if",
@@ -2610,9 +2635,11 @@ dependencies = [
  "clickhouse",
  "http",
  "http-backend",
+ "key-value-store",
  "lazy_static",
  "moka",
  "prometheus",
+ "secret",
  "serde",
  "serde_json",
  "smol_str",
@@ -2655,15 +2682,28 @@ version = "0.38.44"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "fdb5bc1ae2baa591800df16c9ca78619bf65c0488b41b96ccec5d11220d8c154"
 dependencies = [
- "bitflags 2.8.0",
+ "bitflags 2.9.0",
  "errno",
  "itoa",
  "libc",
- "linux-raw-sys",
+ "linux-raw-sys 0.4.15",
  "once_cell",
  "windows-sys 0.59.0",
 ]
 
+[[package]]
+name = "rustix"
+version = "1.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e56a18552996ac8d29ecc3b190b4fdbb2d91ca4ec396de7bbffaf43f3d637e96"
+dependencies = [
+ "bitflags 2.9.0",
+ "errno",
+ "libc",
+ "linux-raw-sys 0.9.3",
+ "windows-sys 0.59.0",
+]
+
 [[package]]
 name = "rustls"
 version = "0.22.4"
@@ -2697,15 +2737,15 @@ dependencies = [
 
 [[package]]
 name = "rustversion"
-version = "1.0.19"
+version = "1.0.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f7c45b9784283f1b2e7fb61b42047c2fd678ef0960d4f6f1eba131594cc369d4"
+checksum = "eded382c5f5f786b989652c49544c4877d9f015cc22e145a5ea8ea66c2921cd2"
 
 [[package]]
 name = "ryu"
-version = "1.0.19"
+version = "1.0.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6ea1a2d0a644769cc99faa24c3ad26b379b786fe7c36fd3c546254801650e6dd"
+checksum = "28d3b2b1366ec20994f1fd18c3c594f05c5dd4bc44d8bb0c1c632c8d6829481f"
 
 [[package]]
 name = "safetensors"
@@ -2769,7 +2809,6 @@ name = "secret"
 version = "0.10.2"
 dependencies = [
  "anyhow",
- "async-trait",
  "reactor",
  "tracing",
 ]
@@ -2780,7 +2819,7 @@ version = "2.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "897b2245f0b511c87893af39b033e5ca9cce68824c4d7e7630b5a1d339658d02"
 dependencies = [
- "bitflags 2.8.0",
+ "bitflags 2.9.0",
  "core-foundation",
  "core-foundation-sys",
  "libc",
@@ -2799,33 +2838,33 @@ dependencies = [
 
 [[package]]
 name = "semver"
-version = "1.0.25"
+version = "1.0.26"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f79dfe2d285b0488816f30e700a7438c5a73d816b5b7d3ac72fbc48b0d185e03"
+checksum = "56e6fa9c48d24d85fb3de5ad847117517440f6beceb7798af16b4a87d616b8d0"
 dependencies = [
  "serde",
 ]
 
 [[package]]
 name = "seq-macro"
-version = "0.3.5"
+version = "0.3.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a3f0bf26fd526d2a95683cd0f87bf103b8539e2ca1ef48ce002d67aad59aa0b4"
+checksum = "1bc711410fbe7399f390ca1c3b60ad0f53f80e95c5eb935e52268a0e2cd49acc"
 
 [[package]]
 name = "serde"
-version = "1.0.217"
+version = "1.0.219"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "02fc4265df13d6fa1d00ecff087228cc0a2b5f3c0e87e258d8b94a156e984c70"
+checksum = "5f0e2c6ed6606019b4e29e69dbaba95b11854410e5347d525002456dbbb786b6"
 dependencies = [
  "serde_derive",
 ]
 
 [[package]]
 name = "serde_derive"
-version = "1.0.217"
+version = "1.0.219"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5a9bf7cf98d04a2b28aead066b7496853d4779c9cc183c440dbac457641e19a0"
+checksum = "5b0276cf7f2c73365f7157c8123c21cd9a50fbbd844757af28ca1f5925fc2a00"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -2845,9 +2884,9 @@ dependencies = [
 
 [[package]]
 name = "serde_json"
-version = "1.0.138"
+version = "1.0.140"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d434192e7da787e94a6ea7e9670b26a036d0ca41e0b7efb2676dd32bae872949"
+checksum = "20068b6e96dc6c9bd23e01df8827e6c7e1f2fddd43c21810382803c136b99373"
 dependencies = [
  "itoa",
  "memchr",
@@ -2904,9 +2943,9 @@ dependencies = [
 
 [[package]]
 name = "shellflip"
-version = "2.1.1"
+version = "2.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "964660222a47f2903556eee15c697eba1bf7d3c6499b6dd8a2401929e8aa2702"
+checksum = "9e7fc6ae47837f145a25189fe979402d0b6e4934fbb41404c10c1c2d0709a2da"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -2968,9 +3007,9 @@ dependencies = [
 
 [[package]]
 name = "socket2"
-version = "0.5.8"
+version = "0.5.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c970269d99b64e60ec3bd6ad27270092a5394c4e309314b18ae3fe575695fbe8"
+checksum = "4f5fd57c80058a56cf5c777ab8a126398ece8e442983605d280a44ce79d0edef"
 dependencies = [
  "libc",
  "windows-sys 0.52.0",
@@ -3017,9 +3056,9 @@ checksum = "13c2bddecc57b384dee18652358fb23172facb8a2c51ccc10d74c157bdea3292"
 
 [[package]]
 name = "syn"
-version = "2.0.98"
+version = "2.0.100"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "36147f1a48ae0ec2b5b3bc5b537d267457555a10dc06f3dbc8cb11ba3006d3b1"
+checksum = "b09a44accad81e1ba1cd74a32461ba89dee89095ba17b32f5d03683b1b1fc2a0"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -3043,7 +3082,7 @@ version = "0.5.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ec7dddc5f0fee506baf8b9fdb989e242f17e4b11c61dfbb0635b705217199eea"
 dependencies = [
- "bitflags 2.8.0",
+ "bitflags 2.9.0",
  "byteorder",
  "enum-as-inner",
  "libc",
@@ -3057,12 +3096,12 @@ version = "0.27.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cc4592f674ce18521c2a81483873a49596655b179f71c5e05d10c1fe66c78745"
 dependencies = [
- "bitflags 2.8.0",
+ "bitflags 2.9.0",
  "cap-fs-ext",
  "cap-std",
  "fd-lock",
  "io-lifetimes",
- "rustix",
+ "rustix 0.38.44",
  "windows-sys 0.59.0",
  "winx",
 ]
@@ -3081,15 +3120,14 @@ checksum = "e502f78cdbb8ba4718f566c418c52bc729126ffd16baee5baa718cf25dd5a69a"
 
 [[package]]
 name = "tempfile"
-version = "3.17.1"
+version = "3.19.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "22e5a0acb1f3f55f65cc4a866c361b2fb2a0ff6366785ae6fbb5f85df07ba230"
+checksum = "7437ac7763b9b123ccf33c338a5cc1bac6f69b45a136c19bdd8a65e3916435bf"
 dependencies = [
- "cfg-if",
  "fastrand",
- "getrandom 0.3.1",
+ "getrandom 0.3.2",
  "once_cell",
- "rustix",
+ "rustix 1.0.3",
  "windows-sys 0.59.0",
 ]
 
@@ -3177,9 +3215,9 @@ dependencies = [
 
 [[package]]
 name = "tokio"
-version = "1.43.0"
+version = "1.44.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3d61fa4ffa3de412bfea335c6ecff681de2b609ba3c77ef3e00e521813a9ed9e"
+checksum = "f382da615b842244d4b8738c82ed1275e6c5dd90c459a30941cd07080b06c91a"
 dependencies = [
  "backtrace",
  "bytes",
@@ -3238,9 +3276,9 @@ dependencies = [
 
 [[package]]
 name = "tokio-util"
-version = "0.7.13"
+version = "0.7.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d7fcaa8d55a2bdd6b83ace262b016eca0d79ee02818c5c1bcdf0305114081078"
+checksum = "6b9590b93e6fcc1739458317cccd391ad3955e2bde8913edf6f95f9e65a8f034"
 dependencies = [
  "bytes",
  "futures-core",
@@ -3285,6 +3323,12 @@ dependencies = [
  "winnow",
 ]
 
+[[package]]
+name = "topological-sort"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ea68304e134ecd095ac6c3574494fc62b909f416c4fca77e440530221e549d3d"
+
 [[package]]
 name = "tower"
 version = "0.5.2"
@@ -3415,9 +3459,9 @@ checksum = "1dccffe3ce07af9386bfd29e80c0ab1a8205a2fc34e4bcd40364df902cfa8f3f"
 
 [[package]]
 name = "unicode-ident"
-version = "1.0.17"
+version = "1.0.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "00e2473a93778eb0bad35909dff6a10d28e63f792f16ed15e404fca9d5eeedbe"
+checksum = "5a5f39404a5da50712a4c1eecf25e90dd62b613502b7e925fd4e4d19b5c96512"
 
 [[package]]
 name = "unicode-width"
@@ -3468,11 +3512,11 @@ checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821"
 
 [[package]]
 name = "uuid"
-version = "1.13.2"
+version = "1.16.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8c1f41ffb7cf259f1ecc2876861a17e7142e63ead296f671f81f6ae85903e0d6"
+checksum = "458f7a779bf54acc9f347480ac654f68407d3aab21269a6e3c9f922acd9e2da9"
 dependencies = [
- "getrandom 0.3.1",
+ "getrandom 0.3.2",
 ]
 
 [[package]]
@@ -3520,9 +3564,9 @@ checksum = "9c8d87e72b64a3b4db28d11ce29237c246188f4f51057d65a7eab63b7987e423"
 
 [[package]]
 name = "wasi"
-version = "0.13.3+wasi-0.2.2"
+version = "0.14.2+wasi-0.2.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "26816d2e1a4a36a2940b96c5296ce403917633dff8f3440e9b236ed6f6bacad2"
+checksum = "9683f9a5a998d873c0d21fcbe3c083009670149a8fab228644b8bd36b2c48cb3"
 dependencies = [
  "wit-bindgen-rt",
 ]
@@ -3530,10 +3574,10 @@ dependencies = [
 [[package]]
 name = "wasi-common"
 version = "29.0.1"
-source = "git+https://github.com/G-Core/wasmtime.git?branch=wasi_nn_candle_backend#f79220e9b613bcd0381dd4aec26695686c170aaf"
+source = "git+https://github.com/G-Core/wasmtime.git?branch=wasi_nn_candle_backend#566d11edfe6d46d4f75472f8713da04598ae3252"
 dependencies = [
  "anyhow",
- "bitflags 2.8.0",
+ "bitflags 2.9.0",
  "cap-fs-ext",
  "cap-rand",
  "cap-std",
@@ -3542,7 +3586,7 @@ dependencies = [
  "io-extras",
  "io-lifetimes",
  "log",
- "rustix",
+ "rustix 0.38.44",
  "system-interface",
  "thiserror",
  "tracing",
@@ -3621,39 +3665,31 @@ dependencies = [
 
 [[package]]
 name = "wasm-encoder"
-version = "0.223.1"
+version = "0.227.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7a0a96fdeaee8fbeb4bd917fb8157d48c0d61c3b1f4ee4c363c8e8d68b2f4fe8"
-dependencies = [
- "leb128",
- "wasmparser 0.223.1",
-]
-
-[[package]]
-name = "wasm-encoder"
-version = "0.225.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6f7eac0445cac73bcf09e6a97f83248d64356dccf9f2b100199769b6b42464e5"
+checksum = "80bb72f02e7fbf07183443b27b0f3d4144abf8c114189f2e088ed95b696a7822"
 dependencies = [
  "leb128fmt",
- "wasmparser 0.225.0",
+ "wasmparser 0.227.1",
 ]
 
 [[package]]
 name = "wasm-metadata"
-version = "0.223.1"
+version = "0.227.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e2e7e37883181704d96b89dbd8f1291be13694c71cd0663aebb94b46d235a377"
+checksum = "ce1ef0faabbbba6674e97a56bee857ccddf942785a336c8b47b42373c922a91d"
 dependencies = [
  "anyhow",
+ "auditable-serde",
+ "flate2",
  "indexmap",
  "serde",
  "serde_derive",
  "serde_json",
  "spdx",
  "url",
- "wasm-encoder 0.223.1",
- "wasmparser 0.223.1",
+ "wasm-encoder 0.227.1",
+ "wasmparser 0.227.1",
 ]
 
 [[package]]
@@ -3662,7 +3698,7 @@ version = "0.221.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d06bfa36ab3ac2be0dee563380147a5b81ba10dd8885d7fbbc9eb574be67d185"
 dependencies = [
- "bitflags 2.8.0",
+ "bitflags 2.9.0",
  "hashbrown 0.15.2",
  "indexmap",
  "semver",
@@ -3671,27 +3707,16 @@ dependencies = [
 
 [[package]]
 name = "wasmparser"
-version = "0.223.1"
+version = "0.227.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "664b980991ed9a8c834eb528a8979ab1109edcf52dc05dd5751e2cc3fb31035d"
+checksum = "0f51cad774fb3c9461ab9bccc9c62dfb7388397b5deda31bf40e8108ccd678b2"
 dependencies = [
- "bitflags 2.8.0",
+ "bitflags 2.9.0",
  "hashbrown 0.15.2",
  "indexmap",
  "semver",
 ]
 
-[[package]]
-name = "wasmparser"
-version = "0.225.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "36e5456165f81e64cb9908a0fe9b9d852c2c74582aa3fe2be3c2da57f937d3ae"
-dependencies = [
- "bitflags 2.8.0",
- "indexmap",
- "semver",
-]
-
 [[package]]
 name = "wasmprinter"
 version = "0.221.3"
@@ -3710,7 +3735,7 @@ dependencies = [
  "addr2line",
  "anyhow",
  "async-trait",
- "bitflags 2.8.0",
+ "bitflags 2.9.0",
  "bumpalo",
  "cc",
  "cfg-if",
@@ -3731,7 +3756,7 @@ dependencies = [
  "psm",
  "pulley-interpreter",
  "rayon",
- "rustix",
+ "rustix 0.38.44",
  "semver",
  "serde",
  "serde_derive",
@@ -3775,7 +3800,7 @@ dependencies = [
  "directories-next",
  "log",
  "postcard",
- "rustix",
+ "rustix 0.38.44",
  "serde",
  "serde_derive",
  "sha2",
@@ -3852,7 +3877,7 @@ dependencies = [
 [[package]]
 name = "wasmtime-environ"
 version = "29.0.1"
-source = "git+https://github.com/G-Core/wasmtime.git?branch=wasi_nn_candle_backend#f79220e9b613bcd0381dd4aec26695686c170aaf"
+source = "git+https://github.com/G-Core/wasmtime.git?branch=wasi_nn_candle_backend#566d11edfe6d46d4f75472f8713da04598ae3252"
 dependencies = [
  "anyhow",
  "cranelift-bitset 0.116.1 (git+https://github.com/G-Core/wasmtime.git?branch=wasi_nn_candle_backend)",
@@ -3876,7 +3901,7 @@ dependencies = [
  "anyhow",
  "cc",
  "cfg-if",
- "rustix",
+ "rustix 0.38.44",
  "wasmtime-asm-macros",
  "wasmtime-versioned-export-macros",
  "windows-sys 0.59.0",
@@ -3887,7 +3912,7 @@ name = "wasmtime-jit-debug"
 version = "29.0.1"
 dependencies = [
  "object",
- "rustix",
+ "rustix 0.38.44",
  "wasmtime-versioned-export-macros",
 ]
 
@@ -3927,7 +3952,7 @@ version = "29.0.1"
 dependencies = [
  "anyhow",
  "async-trait",
- "bitflags 2.8.0",
+ "bitflags 2.9.0",
  "bytes",
  "cap-fs-ext",
  "cap-net-ext",
@@ -3938,7 +3963,7 @@ dependencies = [
  "futures",
  "io-extras",
  "io-lifetimes",
- "rustix",
+ "rustix 0.38.44",
  "system-interface",
  "thiserror",
  "tokio",
@@ -3953,7 +3978,7 @@ dependencies = [
 [[package]]
 name = "wasmtime-wasi-http"
 version = "29.0.1"
-source = "git+https://github.com/G-Core/wasmtime.git?branch=wasi_nn_candle_backend#f79220e9b613bcd0381dd4aec26695686c170aaf"
+source = "git+https://github.com/G-Core/wasmtime.git?branch=wasi_nn_candle_backend#566d11edfe6d46d4f75472f8713da04598ae3252"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -3975,7 +4000,7 @@ dependencies = [
 [[package]]
 name = "wasmtime-wasi-nn"
 version = "29.0.1"
-source = "git+https://github.com/G-Core/wasmtime.git?branch=wasi_nn_candle_backend#f79220e9b613bcd0381dd4aec26695686c170aaf"
+source = "git+https://github.com/G-Core/wasmtime.git?branch=wasi_nn_candle_backend#566d11edfe6d46d4f75472f8713da04598ae3252"
 dependencies = [
  "anyhow",
  "candle-core",
@@ -4026,24 +4051,24 @@ dependencies = [
 
 [[package]]
 name = "wast"
-version = "225.0.0"
+version = "227.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c61496027ff707f9fa9e0b22c34ec163eb7adb1070df565e32a9180a76e4300b"
+checksum = "85c14e5042b16c9d267da3b9b0f4529870455178415286312c25c34dfc1b2816"
 dependencies = [
  "bumpalo",
  "leb128fmt",
  "memchr",
  "unicode-width",
- "wasm-encoder 0.225.0",
+ "wasm-encoder 0.227.1",
 ]
 
 [[package]]
 name = "wat"
-version = "1.225.0"
+version = "1.227.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "89e72a33942234fd0794bcdac30e43b448de3187512414267678e511c6755f11"
+checksum = "b3d394d5bef7006ff63338d481ca10f1af76601e65ebdf5ed33d29302994e9cc"
 dependencies = [
- "wast 225.0.0",
+ "wast 227.0.1",
 ]
 
 [[package]]
@@ -4070,7 +4095,7 @@ version = "29.0.1"
 dependencies = [
  "anyhow",
  "async-trait",
- "bitflags 2.8.0",
+ "bitflags 2.9.0",
  "thiserror",
  "tracing",
  "wasmtime",
@@ -4080,11 +4105,11 @@ dependencies = [
 [[package]]
 name = "wiggle"
 version = "29.0.1"
-source = "git+https://github.com/G-Core/wasmtime.git?branch=wasi_nn_candle_backend#f79220e9b613bcd0381dd4aec26695686c170aaf"
+source = "git+https://github.com/G-Core/wasmtime.git?branch=wasi_nn_candle_backend#566d11edfe6d46d4f75472f8713da04598ae3252"
 dependencies = [
  "anyhow",
  "async-trait",
- "bitflags 2.8.0",
+ "bitflags 2.9.0",
  "thiserror",
  "tracing",
  "wasmtime",
@@ -4107,7 +4132,7 @@ dependencies = [
 [[package]]
 name = "wiggle-generate"
 version = "29.0.1"
-source = "git+https://github.com/G-Core/wasmtime.git?branch=wasi_nn_candle_backend#f79220e9b613bcd0381dd4aec26695686c170aaf"
+source = "git+https://github.com/G-Core/wasmtime.git?branch=wasi_nn_candle_backend#566d11edfe6d46d4f75472f8713da04598ae3252"
 dependencies = [
  "anyhow",
  "heck",
@@ -4131,7 +4156,7 @@ dependencies = [
 [[package]]
 name = "wiggle-macro"
 version = "29.0.1"
-source = "git+https://github.com/G-Core/wasmtime.git?branch=wasi_nn_candle_backend#f79220e9b613bcd0381dd4aec26695686c170aaf"
+source = "git+https://github.com/G-Core/wasmtime.git?branch=wasi_nn_candle_backend#566d11edfe6d46d4f75472f8713da04598ae3252"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -4274,6 +4299,12 @@ dependencies = [
  "syn",
 ]
 
+[[package]]
+name = "windows-link"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "76840935b766e1b0a05c0066835fb9ec80071d4c09a16f6bd5f7e655e3c14c38"
+
 [[package]]
 name = "windows-result"
 version = "0.2.0"
@@ -4377,9 +4408,9 @@ checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"
 
 [[package]]
 name = "winnow"
-version = "0.7.2"
+version = "0.7.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "59690dea168f2198d1a3b0cac23b8063efcd11012f10ae4698f284808c8ef603"
+checksum = "0e97b544156e9bebe1a0ffbc03484fc1ffe3100cbce3ffb17eac35f7cdd7ab36"
 dependencies = [
  "memchr",
 ]
@@ -4390,36 +4421,36 @@ version = "0.36.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3f3fd376f71958b862e7afb20cfe5a22830e1963462f3a17f49d82a6c1d1f42d"
 dependencies = [
- "bitflags 2.8.0",
+ "bitflags 2.9.0",
  "windows-sys 0.59.0",
 ]
 
 [[package]]
 name = "wit-bindgen-rt"
-version = "0.33.0"
+version = "0.39.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3268f3d866458b787f390cf61f4bbb563b922d091359f9608842999eaee3943c"
+checksum = "6f42320e61fe2cfd34354ecb597f86f413484a798ba44a8ca1165c58d42da6c1"
 dependencies = [
- "bitflags 2.8.0",
+ "bitflags 2.9.0",
 ]
 
 [[package]]
 name = "wit-component"
-version = "0.223.1"
+version = "0.227.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3fc2fcc52a79f6f010a89c867e53e06d4227f86c58984add3e37f32b8e7af5f0"
+checksum = "635c3adc595422cbf2341a17fb73a319669cc8d33deed3a48368a841df86b676"
 dependencies = [
  "anyhow",
- "bitflags 2.8.0",
+ "bitflags 2.9.0",
  "indexmap",
  "log",
  "serde",
  "serde_derive",
  "serde_json",
- "wasm-encoder 0.223.1",
+ "wasm-encoder 0.227.1",
  "wasm-metadata",
- "wasmparser 0.223.1",
- "wit-parser 0.223.1",
+ "wasmparser 0.227.1",
+ "wit-parser 0.227.1",
 ]
 
 [[package]]
@@ -4442,9 +4473,9 @@ dependencies = [
 
 [[package]]
 name = "wit-parser"
-version = "0.223.1"
+version = "0.227.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "263fde17f1fbe55a413f16eb59094bf751795c6da469a05c3d45ea6c77df6b40"
+checksum = "ddf445ed5157046e4baf56f9138c124a0824d4d1657e7204d71886ad8ce2fc11"
 dependencies = [
  "anyhow",
  "id-arena",
@@ -4455,7 +4486,7 @@ dependencies = [
  "serde_derive",
  "serde_json",
  "unicode-xid",
- "wasmparser 0.223.1",
+ "wasmparser 0.227.1",
 ]
 
 [[package]]
@@ -4512,8 +4543,16 @@ version = "0.7.35"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1b9b4fd18abc82b8136838da5d50bae7bdea537c574d8dc1a34ed098d6c166f0"
 dependencies = [
- "byteorder",
- "zerocopy-derive",
+ "zerocopy-derive 0.7.35",
+]
+
+[[package]]
+name = "zerocopy"
+version = "0.8.24"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2586fea28e186957ef732a5f8b3be2da217d65c5969d4b1e17f973ebbe876879"
+dependencies = [
+ "zerocopy-derive 0.8.24",
 ]
 
 [[package]]
@@ -4527,20 +4566,31 @@ dependencies = [
  "syn",
 ]
 
+[[package]]
+name = "zerocopy-derive"
+version = "0.8.24"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a996a8f63c5c4448cd959ac1bab0aaa3306ccfd060472f85943ee0750f0169be"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
 [[package]]
 name = "zerofrom"
-version = "0.1.5"
+version = "0.1.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cff3ee08c995dee1859d998dea82f7374f2826091dd9cd47def953cae446cd2e"
+checksum = "50cc42e0333e05660c3587f3bf9d0478688e15d870fab3346451ce7f8c9fbea5"
 dependencies = [
  "zerofrom-derive",
 ]
 
 [[package]]
 name = "zerofrom-derive"
-version = "0.1.5"
+version = "0.1.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "595eed982f7d355beb85837f651fa22e90b3c044842dc7f2c2842c086f295808"
+checksum = "d71e5d6e06ab090c67b5e44993ec16b72dcbaabc526db883a360057678b48502"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -4589,27 +4639,27 @@ dependencies = [
 
 [[package]]
 name = "zstd"
-version = "0.13.2"
+version = "0.13.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fcf2b778a664581e31e389454a7072dab1647606d44f7feea22cd5abb9c9f3f9"
+checksum = "e91ee311a569c327171651566e07972200e76fcfe2242a4fa446149a3881c08a"
 dependencies = [
  "zstd-safe",
 ]
 
 [[package]]
 name = "zstd-safe"
-version = "7.2.1"
+version = "7.2.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "54a3ab4db68cea366acc5c897c7b4d4d1b8994a9cd6e6f841f8964566a419059"
+checksum = "8f49c4d5f0abb602a93fb8736af2a4f4dd9512e36f7f570d66e65ff867ed3b9d"
 dependencies = [
  "zstd-sys",
 ]
 
 [[package]]
 name = "zstd-sys"
-version = "2.0.13+zstd.1.5.6"
+version = "2.0.15+zstd.1.5.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "38ff0f21cfee8f97d94cef41359e0c89aa6113028ab0291aa8ca0038995a95aa"
+checksum = "eb81183ddd97d0c74cedf1d50d85c8d08c1b8b68ee863bdee9e706eedba1a237"
 dependencies = [
  "cc",
  "pkg-config",
diff --git a/Cargo.toml b/Cargo.toml
index a34dbea..c8348ba 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -13,7 +13,7 @@ tokio = { version = "1", features = ["full"] }
 tokio-util = { version = "0.7", features = ["codec"] }
 tracing = "0.1"
 hyper = { version = "1", features = ["full"] }
-http = "1.2.0"
+http = "1.3.1"
 async-trait = "0.1"
 wasmtime = { version = "29.0.1", git = "https://github.com/G-Core/wasmtime.git", branch = "wasi_nn_candle_backend"}
 wasmtime-wasi = { version = "29.0.1", git = "https://github.com/G-Core/wasmtime.git", branch = "wasi_nn_candle_backend"}
@@ -21,6 +21,7 @@ wasi-common = { version = "29.0.1", git = "https://github.com/G-Core/wasmtime.gi
 wasmtime-wasi-nn = { version = "29.0.1", features = ["openvino", "candle"], git = "https://github.com/G-Core/wasmtime.git", branch = "wasi_nn_candle_backend"}
 wasmtime-wasi-http = { version = "29.0.1", git = "https://github.com/G-Core/wasmtime.git", branch = "wasi_nn_candle_backend"}
 wasmtime-environ = { version = "29.0.1", git = "https://github.com/G-Core/wasmtime.git", branch = "wasi_nn_candle_backend"}
+bytesize = "2.0.1"
 
 clap = { version = "4", features = ["derive"] }
 moka = { version = "0.12", features = ["sync"] }
@@ -59,10 +60,14 @@ http-service = { path = "crates/http-service" }
 http-backend = { path = "crates/http-backend" }
 dictionary = { path = "crates/dictionary" }
 secret = { path = "crates/secret" }
+key-value-store = { path = "crates/key-value-store" }
 hyper-tls = "0.6"
 hyper-util = { version = "0.1", features = ["client", "client-legacy", "http1", "tokio"] }
 http-body-util = "0.1"
-bytesize = "1.3.0"
+bytesize = { workspace = true}
 
 [target.'cfg(target_family = "unix")'.dependencies]
-shellflip = "2.1.1"
+shellflip = "2.1.2"
+
+[patch.crates-io]
+half = { git = 'https://github.com/starkat99/half-rs.git', tag = "v2.4.1" }
diff --git a/crates/http-backend/Cargo.toml b/crates/http-backend/Cargo.toml
index 6214312..a15df59 100644
--- a/crates/http-backend/Cargo.toml
+++ b/crates/http-backend/Cargo.toml
@@ -14,8 +14,8 @@ tracing = {workspace = true}
 hyper = { workspace = true }
 tokio = { workspace = true }
 hyper-util = { version = "0.1.10", features = ["client", "client-legacy", "http1", "tokio"] }
-http-body-util = "0.1.2"
-pin-project = "1.1.8"
+http-body-util = "0.1.3"
+pin-project = "1.1.10"
 tower-service = "0.3.3"
 smol_str = {workspace = true}
 
diff --git a/crates/http-service/Cargo.toml b/crates/http-service/Cargo.toml
index 984e03b..11d00e6 100644
--- a/crates/http-service/Cargo.toml
+++ b/crates/http-service/Cargo.toml
@@ -28,17 +28,17 @@ http-backend = { path = "../http-backend" }
 dictionary = { path = "../dictionary" }
 secret = { path = "../secret" }
 nanoid = "0.4"
-bytesize = "1.3.0"
+bytesize = { workspace = true }
 async-trait = "0.1"
 hyper-util = { version = "0.1", features = ["server", "server-graceful"] }
 http-body-util = "0.1"
 bytes = "1.10"
 
 [target.'cfg(target_family = "unix")'.dependencies]
-shellflip = "2.1.1"
+shellflip = "2.1.2"
 
 [dev-dependencies]
 claims = "0.8"
 test-case = "3.3"
 tracing-test = "0.2"
-
+key-value-store = { path = "../key-value-store" }
diff --git a/crates/http-service/src/executor/http.rs b/crates/http-service/src/executor/http.rs
index 2daf8c8..f3ad6fb 100644
--- a/crates/http-service/src/executor/http.rs
+++ b/crates/http-service/src/executor/http.rs
@@ -10,26 +10,23 @@ use http_body_util::{BodyExt, Full};
 use hyper::body::Body;
 use reactor::gcore::fastedge;
 use runtime::{store::StoreBuilder, InstancePre};
-use secret::{Secret, SecretStrategy};
 use std::time::{Duration, Instant};
 use wasmtime_wasi::StdoutStream;
 use wasmtime_wasi_http::body::HyperOutgoingBody;
 
 /// Execute context used by ['HttpService']
 #[derive(Clone)]
-pub struct HttpExecutorImpl<C, T: SecretStrategy> {
-    instance_pre: InstancePre<HttpState<C, T>>,
+pub struct HttpExecutorImpl<C> {
+    instance_pre: InstancePre<HttpState<C>>,
     store_builder: StoreBuilder,
     backend: Backend<C>,
     dictionary: Dictionary,
-    secret: Secret<T>,
 }
 
 #[async_trait]
-impl<C, T> HttpExecutor for HttpExecutorImpl<C, T>
+impl<C> HttpExecutor for HttpExecutorImpl<C>
 where
     C: Clone + Send + Sync + 'static,
-    T: SecretStrategy + Clone + Send + Sync,
 {
     async fn execute<B, R>(
         &self,
@@ -93,7 +90,6 @@ where
             propagate_headers: parts.headers,
             propagate_header_names,
             dictionary: self.dictionary.clone(),
-            secret: self.secret.clone(),
         };
 
         let mut store = store_builder.build(state)?;
@@ -147,24 +143,21 @@ where
     }
 }
 
-impl<C, T> HttpExecutorImpl<C, T>
+impl<C> HttpExecutorImpl<C>
 where
     C: Clone + Send + Sync + 'static,
-    T: SecretStrategy + Clone + Send,
 {
     pub fn new(
-        instance_pre: InstancePre<HttpState<C, T>>,
+        instance_pre: InstancePre<HttpState<C>>,
         store_builder: StoreBuilder,
         backend: Backend<C>,
         dictionary: Dictionary,
-        secret: Secret<T>,
     ) -> Self {
         Self {
             instance_pre,
             store_builder,
             backend,
             dictionary,
-            secret,
         }
     }
 }
@@ -195,7 +188,8 @@ mod tests {
     use dictionary::Dictionary;
     use http_backend::{Backend, BackendStrategy, FastEdgeConnector};
     use http_body_util::Empty;
-    use runtime::app::Status;
+    use key_value_store::KeyValueStore;
+    use runtime::app::{KvStoreOption, SecretOption, Status};
     use runtime::logger::{Logger, NullAppender};
     use runtime::service::ServiceBuilder;
     use runtime::util::stats::{StatRow, StatsWriter};
@@ -203,7 +197,7 @@ mod tests {
         componentize_if_necessary, App, ContextT, PreCompiledLoader, Router, WasiVersion,
         WasmConfig, WasmEngine,
     };
-    use secret::Secret;
+    use secret::SecretStore;
     use smol_str::{SmolStr, ToSmolStr};
     use std::collections::HashMap;
     use wasmtime::component::Component;
@@ -237,6 +231,14 @@ mod tests {
         fn engine_ref(&self) -> &Engine {
             &self.engine
         }
+
+        fn make_secret_store(&self, _secrets: &Vec<SecretOption>) -> anyhow::Result<SecretStore> {
+            todo!()
+        }
+
+        fn make_key_value_store(&self, _stores: &Vec<KvStoreOption>) -> KeyValueStore {
+            todo!()
+        }
     }
 
     static DUMMY_SAMPLE: &[u8] = include_bytes!("../fixtures/dummy.wasm");
@@ -278,34 +280,19 @@ mod tests {
         }
     }
 
-    #[derive(Clone)]
-    struct TestSecret;
-
-    impl SecretStrategy for TestSecret {
-        fn get(&self, _key: String) -> anyhow::Result<Option<Vec<u8>>> {
-            Ok(Some(b"secret".to_vec()))
-        }
-
-        fn get_effective_at(&self, _key: String, _at: u64) -> anyhow::Result<Option<Vec<u8>>> {
-            Ok(Some(b"secret".to_vec()))
-        }
-    }
-
-    impl ExecutorFactory<HttpState<FastEdgeConnector, TestSecret>> for TestContext {
-        type Executor = HttpExecutorImpl<FastEdgeConnector, TestSecret>;
+    impl ExecutorFactory<HttpState<FastEdgeConnector>> for TestContext {
+        type Executor = HttpExecutorImpl<FastEdgeConnector>;
 
         fn get_executor(
             &self,
             name: SmolStr,
             cfg: &App,
-            engine: &WasmEngine<HttpState<FastEdgeConnector, TestSecret>>,
+            engine: &WasmEngine<HttpState<FastEdgeConnector>>,
         ) -> anyhow::Result<Self::Executor> {
             let mut dictionary = Dictionary::new();
             for (k, v) in cfg.env.iter() {
                 dictionary.insert(k.to_string(), v.to_string());
             }
-            let secret = Secret::new(TestSecret);
-
             let env = cfg.env.iter().collect::<Vec<(&SmolStr, &SmolStr)>>();
 
             let logger = self.make_logger(name.clone(), cfg);
@@ -326,7 +313,6 @@ mod tests {
                 store_builder,
                 self.backend(),
                 dictionary,
-                secret,
             ))
         }
     }
@@ -348,6 +334,7 @@ mod tests {
             status,
             debug_until: None,
             secrets: vec![],
+            kv_stores: vec![],
         })
     }
 
@@ -388,7 +375,7 @@ mod tests {
             engine: make_engine(),
         };
 
-        let http_service: HttpService<TestContext, TestSecret> =
+        let http_service: HttpService<TestContext> =
             assert_ok!(ServiceBuilder::new(context).build());
 
         let res = assert_ok!(http_service.handle_request("1", req).await);
@@ -430,6 +417,7 @@ mod tests {
             status: Status::Enabled,
             debug_until: None,
             secrets: vec![],
+            kv_stores: vec![],
         });
 
         let context = TestContext {
@@ -438,7 +426,7 @@ mod tests {
             engine: make_engine(),
         };
 
-        let http_service: HttpService<TestContext, TestSecret> =
+        let http_service: HttpService<TestContext> =
             assert_ok!(ServiceBuilder::new(context).build());
 
         let res = assert_ok!(http_service.handle_request("2", req).await);
@@ -479,6 +467,7 @@ mod tests {
             status: Status::Enabled,
             debug_until: None,
             secrets: vec![],
+            kv_stores: vec![],
         });
 
         let context = TestContext {
@@ -487,7 +476,7 @@ mod tests {
             engine: make_engine(),
         };
 
-        let http_service: HttpService<TestContext, TestSecret> =
+        let http_service: HttpService<TestContext> =
             assert_ok!(ServiceBuilder::new(context).build());
 
         let res = assert_ok!(http_service.handle_request("3", req).await);
@@ -521,7 +510,7 @@ mod tests {
             engine: make_engine(),
         };
 
-        let http_service: HttpService<TestContext, TestSecret> =
+        let http_service: HttpService<TestContext> =
             assert_ok!(ServiceBuilder::new(context).build());
         let res = assert_ok!(http_service.handle_request("4", req).await);
         assert_eq!(StatusCode::NOT_FOUND, res.status());
@@ -547,7 +536,7 @@ mod tests {
             engine: make_engine(),
         };
 
-        let http_service: HttpService<TestContext, TestSecret> =
+        let http_service: HttpService<TestContext> =
             assert_ok!(ServiceBuilder::new(context).build());
         let res = assert_ok!(http_service.handle_request("5", req).await);
         assert_eq!(StatusCode::NOT_FOUND, res.status());
@@ -573,7 +562,7 @@ mod tests {
             engine: make_engine(),
         };
 
-        let http_service: HttpService<TestContext, TestSecret> =
+        let http_service: HttpService<TestContext> =
             assert_ok!(ServiceBuilder::new(context).build());
         let res = assert_ok!(http_service.handle_request("6", req).await);
         assert_eq!(StatusCode::TOO_MANY_REQUESTS, res.status());
@@ -599,7 +588,7 @@ mod tests {
             engine: make_engine(),
         };
 
-        let http_service: HttpService<TestContext, TestSecret> =
+        let http_service: HttpService<TestContext> =
             assert_ok!(ServiceBuilder::new(context).build());
         let res = assert_ok!(http_service.handle_request("7", req).await);
         assert_eq!(StatusCode::NOT_ACCEPTABLE, res.status());
diff --git a/crates/http-service/src/executor/wasi_http.rs b/crates/http-service/src/executor/wasi_http.rs
index c41a8e7..4267440 100644
--- a/crates/http-service/src/executor/wasi_http.rs
+++ b/crates/http-service/src/executor/wasi_http.rs
@@ -11,26 +11,23 @@ use http_backend::Backend;
 use http_body_util::{BodyExt, Full};
 use hyper::body::Body;
 use runtime::{store::StoreBuilder, InstancePre};
-use secret::{Secret, SecretStrategy};
 use wasmtime_wasi_http::bindings::http::types::Scheme;
 use wasmtime_wasi_http::bindings::ProxyPre;
 use wasmtime_wasi_http::{body::HyperOutgoingBody, WasiHttpView};
 
 /// Execute context used by ['HttpService']
 #[derive(Clone)]
-pub struct WasiHttpExecutorImpl<C, T: SecretStrategy> {
-    instance_pre: InstancePre<HttpState<C, T>>,
+pub struct WasiHttpExecutorImpl<C> {
+    instance_pre: InstancePre<HttpState<C>>,
     store_builder: StoreBuilder,
     backend: Backend<C>,
     dictionary: Dictionary,
-    secret: Secret<T>,
 }
 
 #[async_trait]
-impl<C, T> HttpExecutor for WasiHttpExecutorImpl<C, T>
+impl<C> HttpExecutor for WasiHttpExecutorImpl<C>
 where
     C: Clone + Send + Sync + 'static,
-    T: SecretStrategy + Clone + Send + Sync + 'static,
 {
     async fn execute<B, R>(
         &self,
@@ -103,7 +100,6 @@ where
             propagate_headers,
             propagate_header_names,
             dictionary: self.dictionary.clone(),
-            secret: self.secret.clone(),
         };
 
         let mut store = store_builder.build(state).context("store build")?;
@@ -190,24 +186,21 @@ where
     }
 }
 
-impl<C, T> WasiHttpExecutorImpl<C, T>
+impl<C> WasiHttpExecutorImpl<C>
 where
     C: Clone + Send + Sync + 'static,
-    T: SecretStrategy + Clone + Send + 'static,
 {
     pub fn new(
-        instance_pre: InstancePre<HttpState<C, T>>,
+        instance_pre: InstancePre<HttpState<C>>,
         store_builder: StoreBuilder,
         backend: Backend<C>,
         dictionary: Dictionary,
-        secret: Secret<T>,
     ) -> Self {
         Self {
             instance_pre,
             store_builder,
             backend,
             dictionary,
-            secret,
         }
     }
 }
diff --git a/crates/http-service/src/lib.rs b/crates/http-service/src/lib.rs
index 2836062..574dc43 100644
--- a/crates/http-service/src/lib.rs
+++ b/crates/http-service/src/lib.rs
@@ -23,7 +23,6 @@ use runtime::{
     app::Status, service::Service, util::stats::StatsWriter, App, AppResult, ContextT, Router,
     WasmEngine, WasmEngineBuilder,
 };
-use secret::SecretStrategy;
 use smol_str::SmolStr;
 #[cfg(feature = "stats")]
 use smol_str::ToSmolStr;
@@ -59,8 +58,8 @@ pub struct HttpConfig {
     pub backoff: u64,
 }
 
-pub struct HttpService<T: ContextT, S: SecretStrategy> {
-    engine: WasmEngine<HttpState<T::BackendConnector, S>>,
+pub struct HttpService<T: ContextT> {
+    engine: WasmEngine<HttpState<T::BackendConnector>>,
     context: T,
 }
 
@@ -68,22 +67,21 @@ pub trait ContextHeaders {
     fn append_headers(&self) -> impl Iterator<Item = (SmolStr, SmolStr)>;
 }
 
-impl<T, S> Service for HttpService<T, S>
+impl<T> Service for HttpService<T>
 where
     T: ContextT
         + StatsWriter
         + Router
         + ContextHeaders
-        + ExecutorFactory<HttpState<T::BackendConnector, S>>
+        + ExecutorFactory<HttpState<T::BackendConnector>>
         + Clone
         + Sync
         + Send
         + 'static,
     T::BackendConnector: Connect + Clone + Send + Sync + 'static,
     T::Executor: HttpExecutor + Send + Sync,
-    S: SecretStrategy + Send + Sync + 'static,
 {
-    type State = HttpState<T::BackendConnector, S>;
+    type State = HttpState<T::BackendConnector>;
     type Config = HttpConfig;
     type Context = T;
 
@@ -199,26 +197,29 @@ where
             &mut data.as_mut().dictionary
         })?;
 
-        reactor::gcore::fastedge::secret::add_to_linker(linker, |data| &mut data.as_mut().secret)?;
+        reactor::gcore::fastedge::secret::add_to_linker(linker, |data| &mut data.secret_store)?;
+
+        reactor::gcore::fastedge::key_value::add_to_linker(linker, |data| {
+            &mut data.key_value_store
+        })?;
 
         Ok(())
     }
 }
 
-impl<T, U> HttpService<T, U>
+impl<T> HttpService<T>
 where
     T: ContextT
         + StatsWriter
         + Router
         + ContextHeaders
-        + ExecutorFactory<HttpState<T::BackendConnector, U>>
+        + ExecutorFactory<HttpState<T::BackendConnector>>
         + Sync
         + Send
         + 'static
         + Clone,
     T::BackendConnector: Clone + Send + Sync + 'static,
     T::Executor: HttpExecutor + Send + Sync,
-    U: SecretStrategy,
 {
     /// handle HTTP request.
     async fn handle_request<B>(
diff --git a/crates/http-service/src/state.rs b/crates/http-service/src/state.rs
index e7c4076..df1bd57 100644
--- a/crates/http-service/src/state.rs
+++ b/crates/http-service/src/state.rs
@@ -5,19 +5,17 @@ use http::uri::Scheme;
 use http::{header, HeaderMap, HeaderName, Uri};
 use http_backend::Backend;
 use runtime::BackendRequest;
-use secret::{Secret, SecretStrategy};
 use tracing::instrument;
 
-pub struct HttpState<C, T: SecretStrategy> {
+pub struct HttpState<C> {
     pub(super) http_backend: Backend<C>,
     pub(super) uri: Uri,
     pub(super) propagate_headers: HeaderMap,
     pub(super) propagate_header_names: Vec<HeaderName>,
     pub(super) dictionary: Dictionary,
-    pub(super) secret: Secret<T>,
 }
 
-impl<C, T: SecretStrategy> BackendRequest for HttpState<C, T> {
+impl<C> BackendRequest for HttpState<C> {
     #[instrument(skip(self), ret, err)]
     fn backend_request(&mut self, mut head: Parts) -> anyhow::Result<(String, Parts)> {
         let original_url = head.uri;
diff --git a/crates/key-value-store/Cargo.toml b/crates/key-value-store/Cargo.toml
new file mode 100644
index 0000000..9107947
--- /dev/null
+++ b/crates/key-value-store/Cargo.toml
@@ -0,0 +1,17 @@
+[package]
+name = "key-value-store"
+version.workspace = true
+edition.workspace = true
+publish.workspace = true
+authors.workspace = true
+description = "key-value store host function"
+
+[dependencies]
+reactor = { path = "../reactor" }
+wasmtime = {workspace = true}
+slab = "0.4"
+async-trait = "0.1.88"
+smol_str = {workspace = true}
+
+[lints]
+workspace = true
diff --git a/crates/key-value-store/src/lib.rs b/crates/key-value-store/src/lib.rs
new file mode 100644
index 0000000..8e5896b
--- /dev/null
+++ b/crates/key-value-store/src/lib.rs
@@ -0,0 +1,142 @@
+use reactor::gcore::fastedge::key_value;
+use slab::Slab;
+use smol_str::SmolStr;
+use std::collections::HashSet;
+use std::sync::Arc;
+use wasmtime::component::Resource;
+
+pub use key_value::{Error, Value};
+
+#[async_trait::async_trait]
+pub trait Store: Sync + Send {
+    async fn get(&self, key: &str) -> Result<Option<Value>, Error>;
+
+    async fn get_by_range(&self, key: &str, min: u32, max: u32) -> Result<Vec<Value>, Error>;
+
+    async fn bf_exists(&self, bf: &str, key: &str) -> Result<bool, Error>;
+}
+
+#[async_trait::async_trait]
+pub trait StoreManager: Sync + Send {
+    async fn get_store(&self, name: &str) -> Result<Arc<dyn Store>, Error>;
+}
+
+#[derive(Clone)]
+pub struct KeyValueStore {
+    allowed_stores: HashSet<SmolStr>,
+    manager: Arc<dyn StoreManager>,
+    stores: Slab<Arc<dyn Store>>,
+}
+
+impl key_value::HostStore for KeyValueStore {
+    async fn open(&mut self, name: String) -> Result<Resource<key_value::Store>, Error> {
+        let store_id = KeyValueStore::open(self, &name).await?;
+        Ok(Resource::new_own(store_id))
+    }
+
+    async fn get(
+        &mut self,
+        store: Resource<key_value::Store>,
+        key: String,
+    ) -> Result<Option<Vec<u8>>, Error> {
+        let store_id = store.rep();
+        KeyValueStore::get(self, store_id, &key).await
+    }
+
+    async fn get_by_range(
+        &mut self,
+        store: Resource<key_value::Store>,
+        key: String,
+        min: u32,
+        max: u32,
+    ) -> Result<Vec<Value>, Error> {
+        let store_id = store.rep();
+        KeyValueStore::get_by_range(self, store_id, &key, min, max).await
+    }
+
+    async fn bf_exists(
+        &mut self,
+        store: Resource<key_value::Store>,
+        bf: String,
+        key: String,
+    ) -> Result<bool, Error> {
+        let store_id = store.rep();
+        KeyValueStore::bf_exists(self, store_id, &bf, &key).await
+    }
+
+    async fn drop(&mut self, store: Resource<key_value::Store>) -> Result<(), wasmtime::Error> {
+        self.stores.remove(store.rep() as usize);
+        Ok(())
+    }
+}
+
+impl key_value::Host for KeyValueStore {}
+
+impl KeyValueStore {
+    pub fn new(allowed_stores: Vec<SmolStr>, manager: Arc<dyn StoreManager>) -> Self {
+        Self {
+            allowed_stores: allowed_stores.into_iter().collect(),
+            manager,
+            stores: Slab::new(),
+        }
+    }
+
+    /// Open a store by name. Return the store ID.
+    pub async fn open(&mut self, name: &str) -> Result<u32, Error> {
+        if self.allowed_stores.contains(name) {
+            let store = self.manager.get_store(name).await?;
+            Ok(self.stores.insert(store) as u32)
+        } else {
+            Err(Error::AccessDenied)
+        }
+    }
+
+    /// Get a value from a store by key.
+    pub async fn get(&self, store: u32, key: &str) -> Result<Option<Value>, Error> {
+        let Some(store) = self.stores.get(store as usize) else {
+            return Err(Error::NoSuchStore);
+        };
+        store.get(key).await
+    }
+
+    /// Get a values from a store by key.
+    pub async fn get_by_range(
+        &self,
+        store: u32,
+        key: &str,
+        min: u32,
+        max: u32,
+    ) -> Result<Vec<Value>, Error> {
+        let Some(store) = self.stores.get(store as usize) else {
+            return Err(Error::NoSuchStore);
+        };
+        store.get_by_range(key, min, max).await
+    }
+
+    /// Get a value from a store by key.
+    pub async fn bf_exists(&self, store: u32, bf: &str, key: &str) -> Result<bool, Error> {
+        let Some(store) = self.stores.get(store as usize) else {
+            return Err(Error::NoSuchStore);
+        };
+        store.bf_exists(bf, key).await
+    }
+}
+
+impl Default for KeyValueStore {
+    fn default() -> Self {
+        Self {
+            allowed_stores: Default::default(),
+            manager: Arc::new(NoSuchStoreManager),
+            stores: Slab::new(),
+        }
+    }
+}
+
+pub struct NoSuchStoreManager;
+
+#[async_trait::async_trait]
+impl StoreManager for NoSuchStoreManager {
+    async fn get_store(&self, _name: &str) -> Result<Arc<dyn Store>, Error> {
+        Err(Error::NoSuchStore)
+    }
+}
diff --git a/crates/reactor/Cargo.toml b/crates/reactor/Cargo.toml
index 9dfb042..e0d9a2a 100644
--- a/crates/reactor/Cargo.toml
+++ b/crates/reactor/Cargo.toml
@@ -7,4 +7,4 @@ authors.workspace = true
 description = "Main reactor module with world exports and all generated bindgen for included components"
 
 [dependencies]
-wasmtime = { workspace = true, features = ["component-model"] }
+wasmtime = { workspace = true, features = ["component-model"] }
\ No newline at end of file
diff --git a/crates/runtime/Cargo.toml b/crates/runtime/Cargo.toml
index 6c7ed81..787ccf9 100644
--- a/crates/runtime/Cargo.toml
+++ b/crates/runtime/Cargo.toml
@@ -24,12 +24,14 @@ wasmtime-environ = { workspace = true }
 smol_str = { workspace = true }
 moka = { workspace = true }
 http = {workspace = true}
-wit-component = "0.223.0"
+wit-component = "0.227.1"
 tracing = { workspace = true }
-bytesize = "1"
+bytesize = { workspace = true }
 http-backend = { path = "../http-backend" }
+key-value-store = { path = "../key-value-store" }
+secret = { path = "../secret" }
 async-trait = "0.1"
-bytes = "1.9"
+bytes = "1.10"
 serde = "1.0"
 serde_json = "1.0"
 chrono = { version = "0.4", features = ["serde"] }
diff --git a/crates/runtime/src/app.rs b/crates/runtime/src/app.rs
index 2ee1b35..2b1ff3f 100644
--- a/crates/runtime/src/app.rs
+++ b/crates/runtime/src/app.rs
@@ -26,7 +26,33 @@ pub struct App {
     #[serde(default)]
     pub debug_until: Option<DateTime<Utc>>,
     #[serde(default)]
-    pub secrets: Vec<Secret>,
+    pub secrets: Vec<SecretOption>,
+    #[serde(default)]
+    pub kv_stores: Vec<KvStoreOption>,
+}
+
+#[derive(Debug, Clone, PartialEq, Deserialize)]
+pub struct KvStoreOption {
+    /// The url
+    pub param: SmolStr,
+    #[serde(default)]
+    pub name: SmolStr,
+    #[serde(default)]
+    pub prefix: SmolStr,
+    #[serde(default = "KvStoreOption::default_cache_size")]
+    pub cache_size: u64,
+    #[serde(default = "KvStoreOption::default_cache_ttl")]
+    pub cache_ttl: u64,
+}
+
+impl KvStoreOption {
+    fn default_cache_size() -> u64 {
+        1000
+    }
+
+    fn default_cache_ttl() -> u64 {
+        60
+    }
 }
 
 pub type SecretValues = Vec<SecretValue>;
@@ -38,7 +64,7 @@ pub struct SecretValue {
 }
 
 #[derive(Debug, Clone, PartialEq, Deserialize)]
-pub struct Secret {
+pub struct SecretOption {
     pub name: SmolStr,
     pub secret_values: SecretValues,
 }
@@ -148,13 +174,14 @@ mod tests {
             plan: "test_plan".to_smolstr(),
             status: Status::Enabled,
             debug_until: Some(assert_ok!("2037-01-01T12:00:27.87Z".parse())),
-            secrets: vec![Secret {
+            secrets: vec![SecretOption {
                 name: "SECRET".to_smolstr(),
                 secret_values: vec![SecretValue {
                     effective_from: 0,
                     value: "encrypted".to_string(),
                 }],
             }],
+            kv_stores: vec![],
         };
 
         assert_eq!(expected, assert_ok!(serde_json::from_str(&json)));
diff --git a/crates/runtime/src/lib.rs b/crates/runtime/src/lib.rs
index 98fe64d..1528ef8 100644
--- a/crates/runtime/src/lib.rs
+++ b/crates/runtime/src/lib.rs
@@ -1,3 +1,5 @@
+use crate::app::KvStoreOption;
+use key_value_store::KeyValueStore;
 use std::{fmt::Debug, ops::Deref};
 use wasmtime_wasi_http::{HttpResult, WasiHttpCtx, WasiHttpView};
 
@@ -20,11 +22,13 @@ pub mod store;
 pub mod stub;
 pub mod util;
 
+use crate::app::SecretOption;
 use crate::logger::Logger;
 use anyhow::{anyhow, bail};
 pub use app::{App, SecretValue, SecretValues};
 use http::request::Parts;
 use http::Request;
+use secret::SecretStore;
 use smol_str::SmolStr;
 use std::borrow::Cow;
 use wasmtime_environ::wasmparser::{Encoding, Parser, Payload};
@@ -82,6 +86,8 @@ pub struct Data<T> {
     pub table: ResourceTable,
     pub logger: Option<Logger>,
     http: WasiHttpCtx,
+    pub secret_store: SecretStore,
+    pub key_value_store: KeyValueStore,
 }
 
 pub trait BackendRequest {
@@ -141,6 +147,14 @@ impl<T> Data<T> {
             Wasi::Preview2(ctx) => ctx,
         }
     }
+
+    pub fn secret_store_ref(&self) -> &SecretStore {
+        &self.secret_store
+    }
+
+    pub fn key_value_store_ref(&self) -> &KeyValueStore {
+        &self.key_value_store
+    }
 }
 
 /// Global Engine configuration for `WasmEngineBuilder`.
@@ -322,6 +336,10 @@ pub trait ContextT {
     fn loader(&self) -> &dyn PreCompiledLoader<u64>;
 
     fn engine_ref(&self) -> &Engine;
+
+    fn make_secret_store(&self, secrets: &Vec<SecretOption>) -> anyhow::Result<SecretStore>;
+
+    fn make_key_value_store(&self, stores: &Vec<KvStoreOption>) -> KeyValueStore;
 }
 
 pub trait ExecutorCache {
diff --git a/crates/runtime/src/store.rs b/crates/runtime/src/store.rs
index 4b33390..ec1093b 100644
--- a/crates/runtime/src/store.rs
+++ b/crates/runtime/src/store.rs
@@ -1,19 +1,21 @@
+use crate::limiter::ProxyLimiter;
+use crate::logger::Logger;
+use crate::registry::CachedGraphRegistry;
+use crate::{Data, Wasi, WasiVersion, DEFAULT_EPOCH_TICK_INTERVAL};
 use anyhow::Result;
-use std::collections::HashMap;
-use std::fmt::{Debug, Formatter};
-use std::ops::{Deref, DerefMut};
+use key_value_store::KeyValueStore;
+use secret::SecretStore;
+use std::{
+    collections::HashMap,
+    fmt::{Debug, Formatter},
+    ops::{Deref, DerefMut},
+};
 use tracing::{debug, instrument, trace};
 use wasmtime::component::ResourceTable;
 use wasmtime_wasi::WasiCtxBuilder;
 use wasmtime_wasi_http::WasiHttpCtx;
 use wasmtime_wasi_nn::wit::WasiNnCtx;
 
-use crate::{Data, Wasi, WasiVersion, DEFAULT_EPOCH_TICK_INTERVAL};
-
-use crate::limiter::ProxyLimiter;
-use crate::logger::Logger;
-use crate::registry::CachedGraphRegistry;
-
 /// A `Store` holds the runtime state of a app instance.
 ///
 /// `Store` lives only for the lifetime of a single app invocation.
@@ -80,6 +82,8 @@ pub struct StoreBuilder {
     version: WasiVersion,
     properties: HashMap<String, String>,
     registry: CachedGraphRegistry,
+    secret_store: SecretStore,
+    key_value_store: KeyValueStore,
 }
 
 impl StoreBuilder {
@@ -94,6 +98,8 @@ impl StoreBuilder {
             version,
             properties: Default::default(),
             registry: CachedGraphRegistry::new(),
+            secret_store: Default::default(),
+            key_value_store: KeyValueStore::default(),
         }
     }
 
@@ -146,6 +152,22 @@ impl StoreBuilder {
         Self { properties, ..self }
     }
 
+    /// Set secret store
+    pub fn secret_store(self, secret_store: SecretStore) -> Self {
+        Self {
+            secret_store,
+            ..self
+        }
+    }
+
+    /// Set key value store
+    pub fn key_value_store(self, key_value_store: KeyValueStore) -> Self {
+        Self {
+            key_value_store,
+            ..self
+        }
+    }
+
     pub fn make_wasi_nn(&self) -> Result<WasiNnCtx> {
         // initialize application specific graph
         let backends: Vec<&str> = self
@@ -223,6 +245,8 @@ impl StoreBuilder {
                 table,
                 logger,
                 http: WasiHttpCtx::new(),
+                secret_store: self.secret_store,
+                key_value_store: self.key_value_store,
             },
         );
         inner.limiter(|state| &mut state.store_limits);
diff --git a/crates/secret/Cargo.toml b/crates/secret/Cargo.toml
index 5b4cf98..58a5db3 100644
--- a/crates/secret/Cargo.toml
+++ b/crates/secret/Cargo.toml
@@ -10,7 +10,6 @@ description = "secret host function"
 reactor = { path = "../reactor" }
 anyhow = {workspace = true}
 tracing = {workspace = true}
-async-trait = {workspace = true}
 
 [lints]
 workspace = true
diff --git a/crates/secret/src/lib.rs b/crates/secret/src/lib.rs
index 589e276..f45b5a2 100644
--- a/crates/secret/src/lib.rs
+++ b/crates/secret/src/lib.rs
@@ -1,16 +1,20 @@
 use reactor::gcore::fastedge::secret;
+use std::ops::Deref;
+use std::sync::Arc;
 
-pub trait SecretStrategy {
+/// Secret strategy trait
+pub trait SecretStrategy: Send + Sync {
     fn get(&self, key: String) -> anyhow::Result<Option<Vec<u8>>>;
     fn get_effective_at(&self, key: String, at: u64) -> anyhow::Result<Option<Vec<u8>>>;
 }
 
+/// Secret store implementation
 #[derive(Clone)]
-pub struct Secret<T: SecretStrategy> {
-    strategy: T,
+pub struct SecretStore {
+    strategy: Arc<dyn SecretStrategy>,
 }
 
-impl<T: SecretStrategy + Send> secret::Host for Secret<T> {
+impl secret::Host for SecretStore {
     async fn get(&mut self, key: String) -> Result<Option<String>, secret::Error> {
         match self.strategy.get(key) {
             Ok(None) => Ok(None),
@@ -42,8 +46,37 @@ impl<T: SecretStrategy + Send> secret::Host for Secret<T> {
     }
 }
 
-impl<T: SecretStrategy> Secret<T> {
-    pub fn new(strategy: T) -> Self {
+impl SecretStore {
+    pub fn new(strategy: Arc<dyn SecretStrategy>) -> Self {
         Self { strategy }
     }
 }
+
+impl Deref for SecretStore {
+    type Target = dyn SecretStrategy;
+
+    fn deref(&self) -> &Self::Target {
+        self.strategy.as_ref()
+    }
+}
+
+/// Default secret strategy that does not decrypt anything and always returns None
+struct DefaultSecretStrategy {}
+
+impl SecretStrategy for DefaultSecretStrategy {
+    fn get(&self, _key: String) -> anyhow::Result<Option<Vec<u8>>> {
+        Ok(None)
+    }
+
+    fn get_effective_at(&self, _key: String, _at: u64) -> anyhow::Result<Option<Vec<u8>>> {
+        Ok(None)
+    }
+}
+
+impl Default for SecretStore {
+    fn default() -> Self {
+        Self {
+            strategy: Arc::new(DefaultSecretStrategy {}),
+        }
+    }
+}
diff --git a/sdk b/sdk
index b774205..af1ab97 160000
--- a/sdk
+++ b/sdk
@@ -1 +1 @@
-Subproject commit b774205847823a960b877e9c011cb8965e28326e
+Subproject commit af1ab97436e8fa4a4db5e6191aae98397081ef02
diff --git a/src/context.rs b/src/context.rs
new file mode 100644
index 0000000..5dca5f6
--- /dev/null
+++ b/src/context.rs
@@ -0,0 +1,160 @@
+use crate::executor::RunExecutor;
+use crate::key_value::CliStoreManager;
+use crate::secret::SecretImpl;
+use dictionary::Dictionary;
+use http_backend::Backend;
+use http_service::executor::{HttpExecutorImpl, WasiHttpExecutorImpl};
+use http_service::state::HttpState;
+use http_service::{ContextHeaders, ExecutorFactory};
+use hyper_tls::HttpsConnector;
+use hyper_util::client::legacy::connect::HttpConnector;
+use key_value_store::KeyValueStore;
+use runtime::app::{KvStoreOption, SecretOption};
+use runtime::logger::{Console, Logger};
+use runtime::util::stats::{StatRow, StatsWriter};
+use runtime::{
+    componentize_if_necessary, App, ContextT, ExecutorCache, PreCompiledLoader, Router,
+    WasiVersion, WasmEngine,
+};
+use secret::SecretStore;
+use smol_str::SmolStr;
+use std::collections::HashMap;
+use std::sync::Arc;
+use wasmtime::component::Component;
+use wasmtime::{Engine, Module};
+
+/// Test tool execution context
+#[derive(Clone)]
+pub struct Context {
+    pub(crate) headers: HashMap<SmolStr, SmolStr>,
+    pub(crate) engine: Engine,
+    pub(crate) app: Option<App>,
+    pub(crate) backend: Backend<HttpsConnector<HttpConnector>>,
+    pub(crate) wasm_bytes: Vec<u8>,
+    pub(crate) wasi_http: bool,
+}
+
+impl PreCompiledLoader<u64> for Context {
+    fn load_component(&self, _id: u64) -> anyhow::Result<Component> {
+        let wasm_sample = componentize_if_necessary(&self.wasm_bytes)?;
+        Component::new(&self.engine, wasm_sample)
+    }
+
+    fn load_module(&self, _id: u64) -> anyhow::Result<Module> {
+        unreachable!("")
+    }
+}
+
+impl ContextT for Context {
+    type BackendConnector = HttpsConnector<HttpConnector>;
+    fn make_logger(&self, _app_name: SmolStr, _wrk: &App) -> Logger {
+        Logger::new(Console::default())
+    }
+
+    fn backend(&self) -> Backend<HttpsConnector<HttpConnector>> {
+        self.backend.to_owned()
+    }
+
+    fn loader(&self) -> &dyn PreCompiledLoader<u64> {
+        self
+    }
+
+    fn engine_ref(&self) -> &Engine {
+        &self.engine
+    }
+
+    fn make_secret_store(&self, secrets: &Vec<SecretOption>) -> anyhow::Result<SecretStore> {
+        let mut secret_impl = SecretImpl::default();
+        for s in secrets {
+            if let Some(value) = s.secret_values.first() {
+                secret_impl.insert(s.name.to_string(), value.value.to_string());
+            }
+        }
+        Ok(SecretStore::new(Arc::new(secret_impl)))
+    }
+
+    fn make_key_value_store(&self, stores: &Vec<KvStoreOption>) -> KeyValueStore {
+        let stores = stores.iter().map(|s| s.name.clone()).collect();
+        KeyValueStore::new(stores, Arc::new(CliStoreManager))
+    }
+}
+
+impl ExecutorFactory<HttpState<HttpsConnector<HttpConnector>>> for Context {
+    type Executor = RunExecutor;
+
+    fn get_executor(
+        &self,
+        name: SmolStr,
+        app: &App,
+        engine: &WasmEngine<HttpState<HttpsConnector<HttpConnector>>>,
+    ) -> anyhow::Result<Self::Executor> {
+        let mut dictionary = Dictionary::new();
+        for (k, v) in app.env.iter() {
+            dictionary.insert(k.to_string(), v.to_string());
+        }
+
+        let env = app.env.iter().collect::<Vec<(&SmolStr, &SmolStr)>>();
+
+        let logger = self.make_logger(name, app);
+        let secret_store = self.make_secret_store(app.secrets.as_ref())?;
+        let key_value_store = self.make_key_value_store(app.kv_stores.as_ref());
+
+        let version = WasiVersion::Preview2;
+        let store_builder = engine
+            .store_builder(version)
+            .set_env(&env)
+            .max_memory_size(app.mem_limit)
+            .max_epoch_ticks(app.max_duration)
+            .logger(logger)
+            .secret_store(secret_store)
+            .key_value_store(key_value_store);
+
+        let component = self.loader().load_component(app.binary_id)?;
+        let instance_pre = engine.component_instantiate_pre(&component)?;
+        if self.wasi_http {
+            Ok(RunExecutor::Wasi(WasiHttpExecutorImpl::new(
+                instance_pre,
+                store_builder,
+                self.backend(),
+                dictionary,
+            )))
+        } else {
+            Ok(RunExecutor::Http(HttpExecutorImpl::new(
+                instance_pre,
+                store_builder,
+                self.backend(),
+                dictionary,
+            )))
+        }
+    }
+}
+
+impl ExecutorCache for Context {
+    fn remove(&self, _name: &str) {
+        unreachable!()
+    }
+
+    fn remove_all(&self) {
+        unreachable!()
+    }
+}
+
+impl ContextHeaders for Context {
+    fn append_headers(&self) -> impl Iterator<Item = (SmolStr, SmolStr)> {
+        self.headers.iter().map(|(k, v)| (k.clone(), v.clone()))
+    }
+}
+
+impl Router for Context {
+    async fn lookup_by_name(&self, _name: &str) -> Option<App> {
+        self.app.to_owned()
+    }
+
+    async fn lookup_by_id(&self, _id: u64) -> Option<(SmolStr, App)> {
+        unreachable!()
+    }
+}
+
+impl StatsWriter for Context {
+    fn write_stats(&self, _stat: StatRow) {}
+}
diff --git a/src/executor.rs b/src/executor.rs
new file mode 100644
index 0000000..6a153b4
--- /dev/null
+++ b/src/executor.rs
@@ -0,0 +1,34 @@
+use async_trait::async_trait;
+use bytesize::ByteSize;
+use http::{Request, Response, StatusCode};
+use http_body_util::BodyExt;
+use http_service::executor::{HttpExecutor, HttpExecutorImpl, WasiHttpExecutorImpl};
+use http_service::HyperOutgoingBody;
+use hyper::body::Body;
+use hyper_tls::HttpsConnector;
+use hyper_util::client::legacy::connect::HttpConnector;
+use std::time::Duration;
+
+pub enum RunExecutor {
+    Http(HttpExecutorImpl<HttpsConnector<HttpConnector>>),
+    Wasi(WasiHttpExecutorImpl<HttpsConnector<HttpConnector>>),
+}
+
+#[async_trait]
+impl HttpExecutor for RunExecutor {
+    async fn execute<B, R>(
+        &self,
+        req: Request<B>,
+        on_response: R,
+    ) -> anyhow::Result<Response<HyperOutgoingBody>>
+    where
+        R: FnOnce(StatusCode, ByteSize, Duration) + Send + 'static,
+        B: BodyExt + Send,
+        <B as Body>::Data: Send,
+    {
+        match self {
+            RunExecutor::Http(ref executor) => executor.execute(req, on_response).await,
+            RunExecutor::Wasi(ref executor) => executor.execute(req, on_response).await,
+        }
+    }
+}
diff --git a/src/key_value.rs b/src/key_value.rs
new file mode 100644
index 0000000..def387d
--- /dev/null
+++ b/src/key_value.rs
@@ -0,0 +1,28 @@
+use key_value_store::{Error, Store, StoreManager, Value};
+use std::sync::Arc;
+
+struct CliStore;
+
+pub(crate) struct CliStoreManager;
+
+#[async_trait::async_trait]
+impl StoreManager for CliStoreManager {
+    async fn get_store(&self, _name: &str) -> Result<Arc<dyn Store>, Error> {
+        Ok(Arc::new(CliStore))
+    }
+}
+
+#[async_trait::async_trait]
+impl Store for CliStore {
+    async fn get(&self, key: &str) -> Result<Option<Vec<u8>>, Error> {
+        Ok(Some(key.as_bytes().to_vec()))
+    }
+
+    async fn get_by_range(&self, _key: &str, _min: u32, _max: u32) -> Result<Vec<Value>, Error> {
+        todo!()
+    }
+
+    async fn bf_exists(&self, _bf: &str, _key: &str) -> Result<bool, Error> {
+        todo!()
+    }
+}
diff --git a/src/main.rs b/src/main.rs
index c1a87f5..dbb5cf6 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -1,37 +1,23 @@
+mod context;
+mod executor;
+mod key_value;
 mod secret;
 
-use crate::secret::SecretImpl;
-use ::secret::Secret;
-use async_trait::async_trait;
-use bytesize::{ByteSize, MB};
+use bytesize::MB;
 use clap::{Args, Parser, Subcommand};
-use dictionary::Dictionary;
-use http::{Request, Response, StatusCode};
+use context::Context;
 use http_backend::{Backend, BackendStrategy};
-use http_body_util::BodyExt;
-use http_service::executor::{
-    ExecutorFactory, HttpExecutor, HttpExecutorImpl, WasiHttpExecutorImpl,
-};
-use http_service::state::HttpState;
-use http_service::{ContextHeaders, HttpConfig, HttpService, HyperOutgoingBody};
-use hyper::body::Body;
+use http_service::{HttpConfig, HttpService};
 use hyper_tls::HttpsConnector;
 use hyper_util::client::legacy::connect::HttpConnector;
 use runtime::app::Status;
-use runtime::logger::{Console, Logger};
 use runtime::service::{Service, ServiceBuilder};
-use runtime::util::stats::{StatRow, StatsWriter};
-use runtime::{
-    componentize_if_necessary, App, ContextT, ExecutorCache, PreCompiledLoader, Router,
-    SecretValue, WasiVersion, WasmConfig, WasmEngine,
-};
+use runtime::{App, SecretValue, WasmConfig};
 use smol_str::{SmolStr, ToSmolStr};
 use std::collections::HashMap;
 use std::path::PathBuf;
-use std::time::Duration;
 use tokio::signal;
-use wasmtime::component::Component;
-use wasmtime::{Engine, Module};
+use wasmtime::Engine;
 
 #[derive(Debug, Parser)]
 #[command(name = "fastedge-run")]
@@ -81,17 +67,6 @@ struct HttpRunArgs {
     secret: Option<Vec<(SmolStr, SmolStr)>>,
 }
 
-/// Test tool execution context
-#[derive(Clone)]
-struct CliContext {
-    headers: HashMap<SmolStr, SmolStr>,
-    engine: Engine,
-    app: Option<App>,
-    backend: Backend<HttpsConnector<HttpConnector>>,
-    wasm_bytes: Vec<u8>,
-    wasi_http: bool,
-}
-
 #[tokio::main]
 async fn main() -> anyhow::Result<()> {
     pretty_env_logger::init();
@@ -120,7 +95,7 @@ async fn main() -> anyhow::Result<()> {
             let mut secrets = vec![];
             if let Some(secret) = run.secret {
                 for (name, s) in secret.into_iter() {
-                    secrets.push(runtime::app::Secret {
+                    secrets.push(runtime::app::SecretOption {
                         name,
                         secret_values: vec![SecretValue {
                             effective_from: 0,
@@ -143,6 +118,7 @@ async fn main() -> anyhow::Result<()> {
                 status: Status::Enabled,
                 debug_until: None,
                 secrets,
+                kv_stores: vec![],
             };
 
             let mut headers: HashMap<SmolStr, SmolStr> =
@@ -150,7 +126,7 @@ async fn main() -> anyhow::Result<()> {
 
             append_headers(run.geo, &mut headers);
 
-            let context = CliContext {
+            let context = Context {
                 headers,
                 engine,
                 app: Some(cli_app),
@@ -159,7 +135,7 @@ async fn main() -> anyhow::Result<()> {
                 wasi_http: run.wasi_http.unwrap_or_default(),
             };
 
-            let http: HttpService<CliContext, SecretImpl> = ServiceBuilder::new(context).build()?;
+            let http: HttpService<Context> = ServiceBuilder::new(context).build()?;
             let http = http.run(HttpConfig {
                 all_interfaces: false,
                 port: run.port,
@@ -209,145 +185,6 @@ fn append_headers(geo: bool, headers: &mut HashMap<SmolStr, SmolStr>) {
     }
 }
 
-impl PreCompiledLoader<u64> for CliContext {
-    fn load_component(&self, _id: u64) -> anyhow::Result<Component> {
-        let wasm_sample = componentize_if_necessary(&self.wasm_bytes)?;
-        Component::new(&self.engine, wasm_sample)
-    }
-
-    fn load_module(&self, _id: u64) -> anyhow::Result<Module> {
-        unreachable!("")
-    }
-}
-
-impl ContextT for CliContext {
-    type BackendConnector = HttpsConnector<HttpConnector>;
-    fn make_logger(&self, _app_name: SmolStr, _wrk: &App) -> Logger {
-        Logger::new(Console::default())
-    }
-
-    fn backend(&self) -> Backend<HttpsConnector<HttpConnector>> {
-        self.backend.to_owned()
-    }
-
-    fn loader(&self) -> &dyn PreCompiledLoader<u64> {
-        self
-    }
-
-    fn engine_ref(&self) -> &Engine {
-        &self.engine
-    }
-}
-
-enum CliExecutor {
-    Http(HttpExecutorImpl<HttpsConnector<HttpConnector>, SecretImpl>),
-    Wasi(WasiHttpExecutorImpl<HttpsConnector<HttpConnector>, SecretImpl>),
-}
-
-#[async_trait]
-impl HttpExecutor for CliExecutor {
-    async fn execute<B, R>(
-        &self,
-        req: Request<B>,
-        on_response: R,
-    ) -> anyhow::Result<Response<HyperOutgoingBody>>
-    where
-        R: FnOnce(StatusCode, ByteSize, Duration) + Send + 'static,
-        B: BodyExt + Send,
-        <B as Body>::Data: Send,
-    {
-        match self {
-            CliExecutor::Http(ref executor) => executor.execute(req, on_response).await,
-            CliExecutor::Wasi(ref executor) => executor.execute(req, on_response).await,
-        }
-    }
-}
-
-impl ExecutorFactory<HttpState<HttpsConnector<HttpConnector>, SecretImpl>> for CliContext {
-    type Executor = CliExecutor;
-
-    fn get_executor(
-        &self,
-        name: SmolStr,
-        app: &App,
-        engine: &WasmEngine<HttpState<HttpsConnector<HttpConnector>, SecretImpl>>,
-    ) -> anyhow::Result<Self::Executor> {
-        let mut dictionary = Dictionary::new();
-        for (k, v) in app.env.iter() {
-            dictionary.insert(k.to_string(), v.to_string());
-        }
-        let mut secret_impl = SecretImpl::default();
-        for s in app.secrets.iter() {
-            if let Some(value) = s.secret_values.first() {
-                secret_impl.insert(s.name.to_string(), value.value.to_string());
-            }
-        }
-        let secret = Secret::new(secret_impl);
-
-        let env = app.env.iter().collect::<Vec<(&SmolStr, &SmolStr)>>();
-
-        let logger = self.make_logger(name, app);
-
-        let version = WasiVersion::Preview2;
-        let store_builder = engine
-            .store_builder(version)
-            .set_env(&env)
-            .max_memory_size(app.mem_limit)
-            .max_epoch_ticks(app.max_duration)
-            .logger(logger);
-
-        let component = self.loader().load_component(app.binary_id)?;
-        let instance_pre = engine.component_instantiate_pre(&component)?;
-        if self.wasi_http {
-            Ok(CliExecutor::Wasi(WasiHttpExecutorImpl::new(
-                instance_pre,
-                store_builder,
-                self.backend(),
-                dictionary,
-                secret,
-            )))
-        } else {
-            Ok(CliExecutor::Http(HttpExecutorImpl::new(
-                instance_pre,
-                store_builder,
-                self.backend(),
-                dictionary,
-                secret,
-            )))
-        }
-    }
-}
-
-impl ExecutorCache for CliContext {
-    fn remove(&self, _name: &str) {
-        unreachable!()
-    }
-
-    fn remove_all(&self) {
-        unreachable!()
-    }
-}
-
-impl ContextHeaders for CliContext {
-    fn append_headers(&self) -> impl Iterator<Item = (SmolStr, SmolStr)> {
-        self.headers.iter().map(|(k, v)| (k.clone(), v.clone()))
-    }
-}
-
-impl Router for CliContext {
-    async fn lookup_by_name(&self, _name: &str) -> Option<App> {
-        self.app.to_owned()
-    }
-
-    async fn lookup_by_id(&self, _id: u64) -> Option<(SmolStr, App)> {
-        unreachable!()
-    }
-}
-
-impl StatsWriter for CliContext {
-    fn write_stats(&self, _stat: StatRow) {}
-}
-
 fn parse_key_value<T, U>(
     s: &str,
 ) -> Result<(T, U), Box<dyn std::error::Error + Send + Sync + 'static>>