diff --git a/README.md b/README.md
new file mode 100644
index 0000000..aed6190
--- /dev/null
+++ b/README.md
@@ -0,0 +1,470 @@
+# dlang.http
+
+An HTTP/1.1 server plugin for the **dlang** VM. It gives a dlang script a `http` global with
+routing, static file serving, custom error pages, a small template engine (`view`) and
+file uploads (`multipart/form-data`).
+
+> [!IMPORTANT]
+> **This project was generated with AI** (GitHub Copilot) and has not been reviewed by a
+> human. Treat the code and this documentation as a starting point: read it, test it, and
+> only use it in production once you understand and trust it. See
+> [AI-generated code](#ai-generated-code) at the bottom.
+
+> The dlang language and its VM live in their own repository. This repository only contains
+> the HTTP plugin; the `dlang/` folder is an unmodified copy of the upstream VM headers and
+> sources, kept here so the plugin can be built as a standalone shared library.
+
+---
+
+## Table of contents
+
+- [Features](#features)
+- [Requirements](#requirements)
+- [Building](#building)
+- [Installing the plugin](#installing-the-plugin)
+- [Quick start](#quick-start)
+- [API reference](#api-reference)
+  - [`http.server()`](#httpserver)
+  - [`server.listen(port)`](#serverlistenport)
+  - [`server.route(path, methods, handler)`](#serverroutepath-methods-handler)
+  - [Route handler arguments](#route-handler-arguments)
+  - [`server.static(...)`](#serverstatic)
+  - [`server.error(code, handler)`](#servererrorcode-handler)
+  - [`server.maxBody(bytes)`](#servermaxbodybytes)
+  - [File uploads](#file-uploads)
+  - [`http.save` / `http.saveTo`](#httpsave--httpsaveto)
+  - [`view.Render(path, vars)`](#viewrenderpath-vars)
+- [Status codes](#status-codes)
+- [Request and response flow](#request-and-response-flow)
+- [Limitations](#limitations)
+- [Project layout](#project-layout)
+- [AI-generated code](#ai-generated-code)
+
+---
+
+## Features
+
+| Feature | Summary |
+| --- | --- |
+| Routing | Exact-path routes with a per-route list of HTTP methods |
+| Static files | URL prefix → folder, exact URL → file, MIME type detected by extension |
+| Request parsing | Query string, url-encoded bodies, JSON bodies and `multipart/form-data` |
+| File uploads | Uploaded files as tables (`filename`, `contentType`, `size`, raw `content`) plus `http.save` / `http.saveTo` helpers to write them to disk |
+| Cookies | Parsed `Cookie:` header as a table |
+| Error pages | Custom handlers or bodies per status code, with a built-in HTML fallback |
+| Templates | `view.Render("page.html", { ... })` with recursive `@include` and `{{ key }}` interpolation |
+| Body limit | Configurable request size limit (`server.maxBody`), oversized uploads get `413` |
+
+---
+
+## Requirements
+
+- **Windows** or **Linux** (the plugin refuses to compile on other platforms).
+- A **C++20** compiler: MSVC (Windows) or Clang/GCC (Linux).
+- **CMake ≥ 3.10** and **Ninja** for the presets in `CMakePresets.json`.
+- A **dlang host** (interpreter/runner) that supports plugins, since this repository builds
+  a plugin, not a program.
+
+---
+
+## Building
+
+The presets use Ninja with `cl.exe`, so run the commands from a *Developer Command Prompt*
+(or build the folder from VS Code with the CMake Tools extension, which sets up the
+compiler environment automatically).
+
+```bash
+# configure
+cmake --preset x64-debug        # or x64-release, x86-debug, x86-release
+                                # linux-debug on Linux, macos-debug on macOS
+
+# build
+cmake --build out/build/x64-debug
+```
+
+Available presets: `x64-debug`, `x64-release`, `x86-debug`, `x86-release` (Windows),
+`linux-debug` (Linux) and `macos-debug` (macOS).
+
+The build output is a shared library:
+
+| Platform | Output |
+| --- | --- |
+| Windows | `out/build/<preset>/dlang.http/dlang.http.dll` |
+| Linux | `out/build/<preset>/dlang.http/dlang.http.so` |
+
+> The shared library compiles `entry.cpp` together with the VM sources in
+> `dlang.http/dlang/src/`, so no external dlang SDK is needed. Windows additionally links
+> `ws2_32`; Linux links `dl` and `pthread`.
+
+---
+
+## Installing the plugin
+
+Plugins are looked up in a `plugins/` folder relative to the working directory of the dlang
+host. The loader appends the platform extension itself (`.dll` on Windows, `.so` on Linux),
+so the file must be named `dlang.http.dll` / `dlang.http.so`:
+
+```text
+my-app/
+├─ plugins/
+│  └─ dlang.http.dll      # copied from the build output
+└─ app.dl
+```
+
+Load it from a script with `require` (the returned string is a status message such as
+`"plugin loaded!"`):
+
+```dlang
+require("dlang.http");
+```
+
+Once loaded, the plugin registers two globals: `http` and `view`.
+
+---
+
+## Quick start
+
+`app.dl`:
+
+```dlang
+require("dlang.http");
+
+var server = http.server();
+
+// Serve everything in ./public under /assets (e.g. /assets/css/site.css)
+server.static("/assets", "./public");
+
+// A plain text route
+server.route("/", ["GET"], func(req, params, cookies, files)
+    return "Hello world!";
+end);
+
+// Query-string parameters arrive in `params`
+server.route("/hello", ["GET"], func(req, params, cookies, files)
+    return "Hello " + params.name + "!";
+end);
+
+// Return a table as `body` and the plugin JSON-encodes it for you
+server.route("/api/status", ["GET"], func(req, params, cookies, files)
+    return {
+        body: {
+            ok: true,
+            name: "dlang.http"
+        }
+    };
+end);
+
+// Uploads: `files` holds the multipart/form-data file fields
+server.route("/upload", ["POST"], func(req, params, cookies, files)
+    if (#files > 0) then
+        var saved = http.saveTo(files.avatar, "./uploads");
+        return { body: "Saved to " + saved, contentType: "text/plain" };
+    end
+    return { body: "No file uploaded", statusCode: 400 };
+end);
+
+// Custom error page
+server.error(404, func(req)
+    return {
+        body: "<h1>Not found</h1><p>" + req.path + "</p>",
+        contentType: "text/html"
+    };
+end);
+
+// Blocks and serves requests until the process is stopped
+server.listen(8080);
+```
+
+> `#files` is the size operator: it returns the number of entries in the table. Because a
+> missing table field evaluates to `nil` (and logs a VM warning), checking `#files` first
+> keeps handlers free of warnings.
+
+---
+
+## API reference
+
+### `http.server()`
+
+Creates a server table. Every other `server.*` function is called on that table, and the
+table itself is not sent to the OS socket until `listen` is called.
+
+### `server.listen(port)`
+
+Binds `0.0.0.0:<port>`, accepts connections in a loop and serves them until the process
+ends. Returns `false` when the socket cannot be created, bound or listened on; on success it
+never returns.
+
+### `server.route(path, methods, handler)`
+
+Registers a route.
+
+- `path` – the exact request path, e.g. `"/users"` (no wildcards or path parameters; read
+  `req.path` if you need to match patterns yourself).
+- `methods` – a list of method names, e.g. `["GET", "POST"]`. Comparison is
+  case-sensitive, so use uppercase.
+- `handler` – a function (see below).
+
+When a path matches but none of its methods do, the server answers `405 Method Not
+Allowed`.
+
+### Route handler arguments
+
+Handlers are called with four arguments:
+
+```dlang
+func(req, params, cookies, files)
+```
+
+| Argument | Contents |
+| --- | --- |
+| `req` | Table with `method`, `path`, `query` (only when the URL had one), `params`, `cookies`, `files` and `body` (only when the request body was not empty) |
+| `params` | All request parameters merged into one table: query string + body |
+| `cookies` | The parsed `Cookie:` header |
+| `files` | Uploaded files from a `multipart/form-data` body, keyed by form field name |
+
+`params` is filled from the body depending on the `Content-Type`:
+
+| `Content-Type` | Body handling |
+| --- | --- |
+| `application/x-www-form-urlencoded` | `a=1&b=2` decoded into strings |
+| anything containing `json` | Parsed as a JSON object via the VM's `table.json_decode`, keeping numbers, booleans and nested tables/lists; only the top-level fields are merged |
+| `multipart/form-data` | Text fields are merged; file fields go to `files` |
+| anything else | Treated as url-encoded form data |
+
+A key that occurs more than once (for example `?tag=a&tag=b`) becomes a list.
+
+The four-argument signature is backward compatible: older three-parameter handlers keep
+working, they simply never see `files`.
+
+**Return values.** A handler returns either a string (sent as the body, `text/html` by
+default) or a table:
+
+```dlang
+return {
+    body: "text or a table (a table is JSON encoded)",
+    contentType: "text/plain",
+    statusCode: 200
+};
+```
+
+If a handler throws, the server answers `500` using the configured error page.
+
+### `server.static(...)`
+
+Serves files from disk. Four call shapes are supported:
+
+```dlang
+server.static("/assets", "./public");            // URL prefix  -> folder
+server.static("/style.css", "./style.css");      // exact URL   -> single file
+server.static({ assets: "./public" });           // map of keys -> paths
+server.static([["/a.css", "./a.css"]]);          // list of [url, file] pairs
+```
+
+Details:
+
+- Table keys must be dlang identifiers (dlang tables have no string keys); a leading `/` is
+  added automatically, so the `{ assets: "./public" }` form serves `/assets/...`.
+- Folder mounts answer `/` with `index.html`, pick the longest matching prefix and detect the
+  MIME type from the file extension.
+- Exact URL → file mappings take precedence over folder mounts.
+- Static files are only served when no route matches the path.
+- Paths are URL-decoded first; anything containing `..` or `\` is rejected, so a request
+  cannot escape the mounted folder.
+
+### `server.error(code, handler)`
+
+Overrides the page for a status code. The handler may be a body string, a function, or a
+table:
+
+```dlang
+server.error(404, "<h1>Not found</h1>");
+server.error(500, { body: "Something broke", contentType: "text/plain" });
+
+server.error(404, func(req)
+    // req = { method, path, statusCode }
+    return { body: "Missing: " + req.path, contentType: "text/html" };
+end);
+```
+
+Status codes without an override (and handler failures) fall back to a built-in dark-themed
+HTML page. A custom body of `""` also falls back to the built-in page.
+
+### `server.maxBody(bytes)`
+
+Changes the maximum request body the server buffers. The default is **16 MiB**. Requests
+that announce a larger `Content-Length` are refused with `413 Payload Too Large` before the
+body is read:
+
+```dlang
+server.maxBody(64 * 1024 * 1024);   // allow 64 MiB uploads
+```
+
+### File uploads
+
+An upload (`<form enctype="multipart/form-data">`, or `FormData` in `fetch`/XHR) is split
+into its parts. Text fields end up in `params` like any other form post, and every file
+field becomes an entry in `files`:
+
+```dlang
+func(req, params, cookies, files)
+    var avatar = files.avatar;      // one entry per field name
+    // avatar.field        -> "avatar"
+    // avatar.filename     -> "cat.png"
+    // avatar.contentType  -> "image/png"
+    // avatar.size         -> 1234
+    // avatar.content      -> the raw bytes
+end
+```
+
+If several files are uploaded under the same field name (for example a multi-select), that
+entry becomes a list of file tables. `filename*` (RFC 5987), quoted filenames, CRLF and
+LF-only framing are all handled; malformed bodies are ignored instead of raising an error.
+
+The same table is available as `req.files`, so a handler can read `req.files.avatar` if it
+prefers not to use the fourth parameter. To store an upload, hand it to
+[`http.save` / `http.saveTo`](#httpsave--httpsaveto):
+
+```dlang
+var saved = http.saveTo(files.avatar, "./uploads");
+```
+
+Raw bodies are available too: `req.body` holds the undecoded request body, which is handy
+for uploads sent as `application/octet-stream`.
+
+### `http.save` / `http.saveTo`
+
+Write an upload to disk:
+
+```dlang
+http.save(upload, "./uploads/cat.png");   // -> true on success, false on failure
+http.saveTo(upload, "./uploads");         // -> the written path (e.g. "./uploads/cat.png"), or "" on failure
+```
+
+The helpers live on the `http` table rather than a separate global, because a route
+handler's fourth parameter is conventionally called `files` and would shadow a global of
+the same name.
+
+- `save` takes an explicit path and creates missing parent directories.
+- `saveTo` appends the uploaded `filename` to a folder.
+- Both accept a plain string as the first argument, so a raw body can be written as well:
+  `http.save(req.body, "./uploads/blob.bin")`.
+- The filename is sanitized before use: any directory part (`C:\Users\me\evil.txt`,
+  `../../etc/passwd`) is stripped and unsafe characters are replaced, so a client can never
+  choose the target directory.
+
+### `view.Render(path, vars)`
+
+Renders a small template file and returns the result as a string. `view.render` is an alias.
+Template paths are read relative to the process working directory; a missing template raises
+an error, which a route handler turns into a `500`.
+
+```dlang
+server.route("/", ["GET"], func(req, params, cookies, files)
+    return view.Render("templates/page.html", {
+        title: "Home",
+        user: { name: "Ada" },
+        items: ["a", "b"]
+    });
+end);
+```
+
+Template syntax:
+
+| Syntax | Behaviour |
+| --- | --- |
+| `@include("partial.html")` | Inlines another template. Recursive, resolved relative to the including file (with a fallback to the working directory); cycles are skipped and nesting is limited to 32 levels |
+| `{{ key }}` | Replaced with the matching variable. Strings, numbers and booleans are printed as-is |
+| `{{ a.b }}` | Walks into nested tables |
+| `{{ list }}` / `{{ table }}` | Serialized to JSON (convenient inside `<script>`) |
+
+Unknown keys are left in the output as literal `{{key}}` text, which makes typos easy to
+spot. Missing or cyclic includes are replaced with an HTML comment.
+
+---
+
+## Status codes
+
+Responses use these standard reason phrases — anything else falls back to `OK`, while the
+numeric status code is always the one you asked for:
+
+`200 OK`, `201 Created`, `204 No Content`, `301 Moved Permanently`, `302 Found`,
+`400 Bad Request`, `401 Unauthorized`, `403 Forbidden`, `404 Not Found`,
+`405 Method Not Allowed`, `413 Payload Too Large`, `500 Internal Server Error`,
+`501 Not Implemented`.
+
+Responses are always sent with `Content-Length`, `Content-Type` and `Connection: close`.
+
+---
+
+## Request and response flow
+
+```mermaid
+flowchart TD
+    A[Accept connection] --> B[Read headers + Content-Length body]
+    B --> C{Body within limit?}
+    C -- no --> D[413]
+    C -- yes --> E[Parse query, cookies and body<br/>urlencoded / JSON / multipart]
+    E --> F{Route matches path?}
+    F -- yes, method allowed --> G[Call handler with req, params, cookies, files]
+    F -- yes, other method --> H[405]
+    F -- no --> I{Static mount matches?}
+    I -- yes --> J[Serve file with detected MIME type]
+    I -- no --> K[404]
+    G --> L[Send response: string, or table with body / contentType / statusCode]
+    G -. handler threw .-> M[500 with error page]
+```
+
+---
+
+## Limitations
+
+- **One request at a time.** `listen` accepts and handles connections sequentially in a
+  blocking loop; there is no thread pool or keep-alive.
+- **Exact route paths only.** No `:parameters`, wildcards or regex routes; match on
+  `req.path` yourself if you need them.
+- **`Content-Length` only.** Chunked transfer encoding is not supported, and a request
+  without `Content-Length` has no body.
+- **In-memory bodies.** The whole body (up to `server.maxBody`) is buffered before a handler
+  runs, and static files are read fully into memory before being sent.
+- **HTTP/1.1 only**, no TLS. Put a reverse proxy in front if you need HTTPS.
+- **Global server state.** Routes, static mounts, error pages and the socket are
+  process-wide, so one `listen` call serves one server per process.
+
+---
+
+## Project layout
+
+```text
+dlang-http/
+├─ CMakeLists.txt                 # top-level project
+├─ CMakePresets.json              # Windows / Linux / macOS configure presets
+└─ dlang.http/
+   ├─ CMakeLists.txt              # builds the `dlang.http` shared library
+   ├─ entry.cpp                   # the entire plugin: server, routing, static files,
+   │                              # uploads, error pages and the view engine
+   ├─ json.hpp                    # nlohmann/json (used by the VM's table library)
+   └─ dlang/                      # upstream dlang VM copy — do not edit
+      ├─ vm.hpp, types/, libs/, parser/
+      └─ src/                     # compiler, lexer, parser, VM implementation
+```
+
+Everything plugin-specific lives in `dlang.http/entry.cpp`; `dlang.http/dlang/` is a
+verbatim copy of the dlang VM so the shared library can be built and link the VM
+implementation.
+
+---
+
+## AI-generated code
+
+This repository and this README were produced with the help of an AI assistant
+(GitHub Copilot). That means:
+
+- The code was **generated, then verified against its own test harnesses** (request parsing,
+  multipart uploads, socket-level request handling, `http.save`/`saveTo`), but it has not
+  been reviewed by a human maintainer.
+- Comments and documentation may describe behaviour that has not been audited in every
+  edge case, and the API is still evolving.
+- Treat it as a starting point: review the source in `dlang.http/entry.cpp`, test it with
+  your own inputs, and add a license before publishing or distributing it.
+
+There is no warranty of any kind. Use it at your own risk.
diff --git a/dlang.http/entry.cpp b/dlang.http/entry.cpp
index c1981da..95b5546 100644
--- a/dlang.http/entry.cpp
+++ b/dlang.http/entry.cpp
@@ -103,6 +103,10 @@ struct ErrorResponse {
 static std::vector<StaticMount> g_staticMounts;
 static std::unordered_map<int, ErrorPage> g_errorPages;
 
+// Largest request body we are willing to buffer. Raised/lowered with
+// `server.maxBody(bytes)`; anything bigger is answered with 413.
+static size_t g_maxBodyBytes = 16u * 1024u * 1024u;
+
 // Toggle blocking mode on a socket in a cross-platform way.
 static void SetBlocking(SocketHandle sock, bool blocking) {
 #ifdef DLANG_HTTP_WINDOWS
@@ -145,7 +149,9 @@ static const char* ReasonPhrase(int statusCode) {
         case 403: return "Forbidden";
         case 404: return "Not Found";
         case 405: return "Method Not Allowed";
+        case 413: return "Payload Too Large";
         case 500: return "Internal Server Error";
+        case 501: return "Not Implemented";
         default:  return "OK";
     }
 }
@@ -644,6 +650,1035 @@ static void ExtractResponse(DlangVM* vm, const StackValue& returned,
     }
 }
 
+// ---------------------------------------------------------------------------
+// Views: view.Render("page.html", { name: "World" })
+//
+// A tiny text/HTML template engine:
+//
+//   @include("partial.html")  -> inlines another template file. Includes are
+//                                recursive and resolved relative to the file
+//                                that contains them (falling back to the
+//                                process working directory).
+//   {{ key }}                 -> replaced with the matching entry from the
+//                                variables table. Dotted paths ({{ user.name }})
+//                                walk into nested tables. Unknown keys are left
+//                                untouched so they are easy to spot.
+//
+// Variable values may be strings, numbers, booleans or tables/lists (tables and
+// lists are serialized to JSON, which is handy for embedding data in <script>).
+// ---------------------------------------------------------------------------
+
+static const int kMaxViewIncludeDepth = 32;
+
+static std::string ViewTrim(const std::string& value) {
+    size_t begin = 0;
+    size_t end = value.size();
+
+    while (begin < end && std::isspace(static_cast<unsigned char>(value[begin])))
+        ++begin;
+    while (end > begin && std::isspace(static_cast<unsigned char>(value[end - 1])))
+        --end;
+
+    return value.substr(begin, end - begin);
+}
+
+// Convert a dlang value into the text that replaces a {{ placeholder }}.
+static bool ViewValueToString(DlangVM* vm, const StackValue& value, std::string& out) {
+    switch (value.type) {
+        case StackValueType::String:
+            out = std::get<std::string>(value.data);
+            return true;
+        case StackValueType::Int:
+            out = DoubleToString(std::get<double>(value.data));
+            return true;
+        case StackValueType::Bool:
+            out = std::get<bool>(value.data) ? "true" : "false";
+            return true;
+        case StackValueType::NIL:
+            out.clear();
+            return true;
+        case StackValueType::Table:
+        case StackValueType::List:
+            return EncodeTableAsJson(vm, value, out);
+        default:
+            return false;
+    }
+}
+
+// Look up "user.name" style keys, walking nested tables as we go.
+static bool LookupViewVariable(const StackValue& variables,
+                               const std::string& path,
+                               StackValue& out) {
+    StackValue current = variables;
+    size_t start = 0;
+
+    while (true) {
+        size_t dot = path.find('.', start);
+        std::string key = ViewTrim(path.substr(
+            start, dot == std::string::npos ? std::string::npos : dot - start));
+
+        if (key.empty() || current.type != StackValueType::Table)
+            return false;
+
+        StackValue next;
+        if (!GetTableField(current, key.c_str(), next))
+            return false;
+
+        if (dot == std::string::npos) {
+            out = next;
+            return true;
+        }
+
+        current = next;
+        start = dot + 1;
+    }
+}
+
+// Replace every {{ key }} placeholder with the matching value.
+static std::string InterpolateViewVariables(DlangVM* vm,
+                                            const std::string& source,
+                                            const StackValue& variables) {
+    std::string out;
+    out.reserve(source.size());
+
+    size_t i = 0;
+    while (i < source.size()) {
+        size_t open = source.find("{{", i);
+        if (open == std::string::npos) {
+            out += source.substr(i);
+            break;
+        }
+
+        out += source.substr(i, open - i);
+
+        size_t close = source.find("}}", open + 2);
+        if (close == std::string::npos) {
+            out += source.substr(open);
+            break;
+        }
+
+        std::string key = ViewTrim(source.substr(open + 2, close - open - 2));
+
+        StackValue value;
+        std::string text;
+        if (key.empty() ||
+            !LookupViewVariable(variables, key, value) ||
+            !ViewValueToString(vm, value, text)) {
+            // Unknown (or unrenderable) variable: keep the placeholder intact.
+            out += source.substr(open, close + 2 - open);
+        }
+        else {
+            out += text;
+        }
+
+        i = close + 2;
+    }
+
+    return out;
+}
+
+// Recursively inline every @include("...") directive.
+static std::string ExpandViewIncludes(const std::string& source,
+                                      const std::filesystem::path& baseDir,
+                                      std::vector<std::string>& activeFiles,
+                                      int depth) {
+    const std::string directive = "@include";
+
+    std::string out;
+    size_t i = 0;
+
+    while (i < source.size()) {
+        size_t at = source.find(directive, i);
+        if (at == std::string::npos) {
+            out += source.substr(i);
+            break;
+        }
+
+        out += source.substr(i, at - i);
+
+        // Parse: @include ( "path" )  -- whitespace and ' / " quotes allowed.
+        size_t p = at + directive.size();
+        while (p < source.size() && std::isspace(static_cast<unsigned char>(source[p])))
+            ++p;
+
+        bool parsed = false;
+        std::string includePath;
+
+        if (p < source.size() && source[p] == '(') {
+            ++p;
+            while (p < source.size() && std::isspace(static_cast<unsigned char>(source[p])))
+                ++p;
+
+            if (p < source.size() && (source[p] == '"' || source[p] == '\'')) {
+                char quote = source[p++];
+                size_t quoteEnd = source.find(quote, p);
+
+                if (quoteEnd != std::string::npos) {
+                    includePath = source.substr(p, quoteEnd - p);
+
+                    size_t q = quoteEnd + 1;
+                    while (q < source.size() && std::isspace(static_cast<unsigned char>(source[q])))
+                        ++q;
+
+                    if (q < source.size() && source[q] == ')') {
+                        i = q + 1;
+                        parsed = true;
+                    }
+                }
+            }
+        }
+
+        if (!parsed) {
+            // Not a well-formed directive; emit it verbatim and move on.
+            out += directive;
+            i = at + directive.size();
+            continue;
+        }
+
+        if (depth >= kMaxViewIncludeDepth) {
+            out += "<!-- view: include depth limit reached -->";
+            continue;
+        }
+
+        std::error_code ec;
+        std::filesystem::path resolved = baseDir / includePath;
+
+        if (!std::filesystem::is_regular_file(resolved, ec) || ec) {
+            // Fall back to a path relative to the process working directory.
+            if (std::filesystem::is_regular_file(includePath, ec) && !ec)
+                resolved = includePath;
+            else {
+                out += "<!-- view: include not found: " + includePath + " -->";
+                continue;
+            }
+        }
+
+        std::filesystem::path canonical = std::filesystem::weakly_canonical(resolved, ec);
+        std::string canonicalStr = ec ? resolved.string() : canonical.string();
+
+        if (std::find(activeFiles.begin(), activeFiles.end(), canonicalStr) != activeFiles.end()) {
+            out += "<!-- view: include cycle skipped: " + includePath + " -->";
+            continue;
+        }
+
+        std::string fileContent;
+        if (!ReadFileBinary(resolved.string(), fileContent)) {
+            out += "<!-- view: include not found: " + includePath + " -->";
+            continue;
+        }
+
+        activeFiles.push_back(canonicalStr);
+        out += ExpandViewIncludes(fileContent, resolved.parent_path(), activeFiles, depth + 1);
+        activeFiles.pop_back();
+    }
+
+    return out;
+}
+
+void NativeViewRender(DlangVM* vm) {
+    // view.Render(path, variables)
+    //
+    // `GET_FIELD` already consumed the `view` table while resolving the
+    // `view.Render` callee, so only the two explicit arguments are on the stack
+    // (the variables table is on top).
+    StackValue variables = dlang_pop(vm);
+    StackValue pathValue = dlang_pop(vm);
+
+    if (pathValue.type != StackValueType::String) {
+        std::cerr << "view.Render: template path must be a string\n";
+        throw std::runtime_error("view.Render: template path must be a string");
+    }
+
+    std::string path = std::get<std::string>(pathValue.data);
+
+    std::string source;
+    if (!ReadFileBinary(path, source)) {
+        std::cerr << "view.Render: could not open template '" << path << "'\n";
+        throw std::runtime_error("view.Render: could not open template '" + path + "'");
+    }
+
+    std::error_code ec;
+    std::vector<std::string> activeFiles;
+    std::filesystem::path canonical = std::filesystem::weakly_canonical(path, ec);
+    activeFiles.push_back(ec ? path : canonical.string());
+
+    std::string expanded = ExpandViewIncludes(
+        source, std::filesystem::path(path).parent_path(), activeFiles, 0);
+    std::string rendered = InterpolateViewVariables(vm, expanded, variables);
+
+    dlang_pushstring(vm, rendered.c_str());
+}
+
+// ---------------------------------------------------------------------------
+// Request parsing
+//
+// Every route handler is invoked with four arguments:
+//
+//   fn(req, params, cookies, files)
+//
+//   req      -> { method, path, query, params, cookies, files, body }
+//   params   -> a single key/value table holding *all* request parameters:
+//               the query string (GET) plus the request body (POST/PUT/PATCH/
+//               DELETE). Body values are read as url-encoded form data, as a
+//               JSON object when Content-Type is application/json, or as the
+//               plain fields of a multipart/form-data upload. A key that occurs
+//               more than once is collected into a list.
+//   cookies  -> the parsed `Cookie:` header as a key/value table.
+//   files    -> the uploaded files of a multipart/form-data body, keyed by form
+//               field name (see the "File uploads" section below).
+//
+// `req.body` holds the raw request body (handy for uploads sent as
+// `application/octet-stream`) and is only set when the body is not empty.
+//
+// Values coming from the query string / url-encoded body are stored as strings;
+// JSON bodies keep their native types (numbers, booleans, nested tables/lists).
+// ---------------------------------------------------------------------------
+
+static std::string HttpTrim(const std::string& value) {
+    size_t begin = 0;
+    size_t end = value.size();
+
+    while (begin < end) {
+        unsigned char c = static_cast<unsigned char>(value[begin]);
+        if (!std::isspace(c) && value[begin] != '\r' && value[begin] != '\n')
+            break;
+        ++begin;
+    }
+    while (end > begin) {
+        unsigned char c = static_cast<unsigned char>(value[end - 1]);
+        if (!std::isspace(c) && value[end - 1] != '\r' && value[end - 1] != '\n')
+            break;
+        --end;
+    }
+
+    return value.substr(begin, end - begin);
+}
+
+// Case-insensitive lookup of a single header inside a header block. A request
+// block starts with the request line (`GET / HTTP/1.1`), which is not a header,
+// while the header block of a multipart part has no such line; hence the
+// `skipFirstLine` switch.
+static bool FindHeader(const std::string& headers, const std::string& name,
+                       std::string& out, bool skipFirstLine) {
+    std::string wanted = ToLower(HttpTrim(name));
+
+    std::istringstream stream(headers);
+    std::string line;
+    bool firstLine = true;
+
+    while (std::getline(stream, line)) {
+        if (firstLine) {
+            firstLine = false;
+            if (skipFirstLine)    // skip the request line
+                continue;
+        }
+        if (!line.empty() && line.back() == '\r')
+            line.pop_back();
+
+        size_t colon = line.find(':');
+        if (colon == std::string::npos)
+            continue;
+
+        if (ToLower(HttpTrim(line.substr(0, colon))) == wanted) {
+            out = HttpTrim(line.substr(colon + 1));
+            return true;
+        }
+    }
+
+    return false;
+}
+
+static bool GetHeaderValue(const std::string& headers, const std::string& name,
+                           std::string& out) {
+    return FindHeader(headers, name, out, true);
+}
+
+// Insert one key/value pair into a parameter table. When the same key shows up
+// more than once the values are collected into a list.
+static void AddParamValue(DlangTable& table, const std::string& key,
+                          const std::string& value) {
+    if (key.empty())
+        return;
+
+    StackValue existing;
+    if (table.Get(key, existing)) {
+        if (existing.type == StackValueType::String) {
+            auto list = std::make_shared<DlangList>();
+            list->Push(existing);
+            list->Push(StackValue(StackValueType::String, value));
+            table.Set(key, StackValue(StackValueType::List, list));
+        }
+        else if (existing.type == StackValueType::List) {
+            auto list = std::get<std::shared_ptr<DlangList>>(existing.data);
+            list->Push(StackValue(StackValueType::String, value));
+        }
+        return;
+    }
+
+    table.Set(key, StackValue(StackValueType::String, value));
+}
+
+// Parse an `a=1&b=2` style string (query string or url-encoded body).
+static void ParseUrlEncoded(const std::string& data, DlangTable& table) {
+    size_t start = 0;
+
+    while (start <= data.size()) {
+        size_t amp = data.find('&', start);
+        std::string pair = data.substr(
+            start, amp == std::string::npos ? std::string::npos : amp - start);
+
+        if (!pair.empty()) {
+            size_t eq = pair.find('=');
+            std::string key, value;
+
+            if (eq == std::string::npos) {
+                key = UrlDecode(pair);
+            }
+            else {
+                key = UrlDecode(pair.substr(0, eq));
+                value = UrlDecode(pair.substr(eq + 1));
+            }
+
+            AddParamValue(table, key, value);
+        }
+
+        if (amp == std::string::npos)
+            break;
+        start = amp + 1;
+    }
+}
+
+// Parse the `Cookie:` header ("a=1; b=2") into a table.
+static void ParseCookies(const std::string& header, DlangTable& table) {
+    size_t start = 0;
+
+    while (start <= header.size()) {
+        size_t semi = header.find(';', start);
+        std::string pair = HttpTrim(header.substr(
+            start, semi == std::string::npos ? std::string::npos : semi - start));
+
+        if (!pair.empty()) {
+            size_t eq = pair.find('=');
+            if (eq != std::string::npos) {
+                std::string key = HttpTrim(pair.substr(0, eq));
+                std::string value = HttpTrim(pair.substr(eq + 1));
+
+                if (!key.empty())
+                    table.Set(key, StackValue(StackValueType::String, value));
+            }
+        }
+
+        if (semi == std::string::npos)
+            break;
+        start = semi + 1;
+    }
+}
+
+// Decode a JSON string into a value using the VM's native `table.json_decode`.
+// Returns false when the library/function is unavailable or the text is not
+// valid JSON, in which case the body is simply ignored.
+static bool DecodeJsonValue(DlangVM* vm, const std::string& text, StackValue& out) {
+    StackValue jsonLib = vm->globals.Get("table");
+    if (jsonLib.type != StackValueType::Table)
+        return false;
+
+    StackValue decodeFn;
+    if (!GetTableField(jsonLib, "json_decode", decodeFn) ||
+        decodeFn.type != StackValueType::Function)
+        return false;
+
+    int base = vm->stack.top();
+    bool ok = false;
+
+    try {
+        dlang_pushstring(vm, text.c_str());
+        dlang_push(vm, decodeFn);
+
+        if (dlang_call(vm, 1)) {
+            out = dlang_pop(vm);
+            ok = true;
+        }
+    }
+    catch (...) {
+        ok = false;
+    }
+
+    ResetStack(vm, base);
+    return ok;
+}
+
+// Merge the top-level fields of a JSON object body into the parameter table.
+static void MergeJsonBody(DlangVM* vm, const std::string& body, DlangTable& table) {
+    StackValue decoded;
+    if (!DecodeJsonValue(vm, body, decoded))
+        return;
+    if (decoded.type != StackValueType::Table)
+        return;
+
+    auto tablePtr = std::get<std::shared_ptr<DlangTable>>(decoded.data);
+    for (const auto& [key, value] : tablePtr->fields)
+        table.Set(key, value);
+}
+
+// ---------------------------------------------------------------------------
+// File uploads (multipart/form-data)
+//
+// A form posted with `enctype="multipart/form-data"` (what a browser sends for
+// `<input type="file">`, or what `FormData` produces in fetch/XHR) is split into
+// its parts:
+//
+//   * plain fields -> merged into the regular parameter table, exactly like a
+//                     url-encoded body, so `params.name` keeps working,
+//   * file fields  -> collected in a `files` table, keyed by form field name.
+//                     A field name that occurs more than once becomes a list.
+//
+// Every file entry is a table:
+//
+//   { field = "avatar", filename = "cat.png", contentType = "image/png",
+//     size = 1234, content = "<raw bytes>" }
+//
+// `content` holds the bytes exactly as they arrived (binary safe). The table is
+// exposed as `req.files` and passed to the route handler as its 4th argument:
+//
+//   fn(req, params, cookies, files)
+//
+// The `http` table writes an upload to disk (the helpers are not a global of
+// their own, so that the `files` parameter above cannot shadow them):
+//
+//   http.save(upload, "out/cat.png")   -> true on success
+//   http.saveTo(upload, "out")         -> the written path, or "" on failure
+// ---------------------------------------------------------------------------
+
+// Percent-decode a string. Unlike UrlDecode this leaves '+' alone, which matters
+// for RFC 5987 encoded filenames (`filename*=UTF-8''cat%20pic.png`).
+static std::string PercentDecode(const std::string& input) {
+    std::string output;
+    output.reserve(input.size());
+
+    for (size_t i = 0; i < input.size(); ++i) {
+        if (input[i] == '%' && i + 2 < input.size()) {
+            std::string hex = input.substr(i + 1, 2);
+            output += static_cast<char>(std::strtol(hex.c_str(), nullptr, 16));
+            i += 2;
+        }
+        else {
+            output += input[i];
+        }
+    }
+
+    return output;
+}
+
+// Pull the `boundary=...` parameter (quoted or not) out of a Content-Type.
+static bool GetMultipartBoundary(const std::string& contentType, std::string& out) {
+    size_t at = ToLower(contentType).find("boundary=");
+    if (at == std::string::npos)
+        return false;
+
+    // The boundary ends at the next ';' (other parameters may follow it).
+    std::string rest = contentType.substr(at + 9);
+    size_t end = rest.find(';');
+
+    std::string boundary = HttpTrim(end == std::string::npos ? rest : rest.substr(0, end));
+    if (boundary.size() >= 2 && boundary.front() == '"' && boundary.back() == '"')
+        boundary = boundary.substr(1, boundary.size() - 2);
+
+    if (boundary.empty())
+        return false;
+
+    out = boundary;
+    return true;
+}
+
+// Read one `;`-separated parameter (e.g. `name` / `filename`) out of a header
+// value such as `form-data; name="avatar"; filename="cat.png"`.
+static bool GetHeaderParameter(const std::string& headerValue, const std::string& name,
+                               std::string& out) {
+    std::string wanted = ToLower(name);
+    size_t start = 0;
+
+    while (start <= headerValue.size()) {
+        size_t semi = headerValue.find(';', start);
+        std::string pair = HttpTrim(headerValue.substr(
+            start, semi == std::string::npos ? std::string::npos : semi - start));
+
+        size_t eq = pair.find('=');
+        if (eq != std::string::npos && ToLower(HttpTrim(pair.substr(0, eq))) == wanted) {
+            std::string value = HttpTrim(pair.substr(eq + 1));
+            if (value.size() >= 2 && value.front() == '"' && value.back() == '"')
+                value = value.substr(1, value.size() - 2);
+
+            out = value;
+            return true;
+        }
+
+        if (semi == std::string::npos)
+            break;
+        start = semi + 1;
+    }
+
+    return false;
+}
+
+// Filename of a part, honouring both `filename=` and the RFC 5987
+// `filename*=UTF-8''...` form. Empty when the part is a plain form field.
+static std::string PartFilename(const std::string& disposition) {
+    std::string filename;
+    if (GetHeaderParameter(disposition, "filename", filename))
+        return filename;
+
+    std::string extended;
+    if (!GetHeaderParameter(disposition, "filename*", extended))
+        return std::string();
+
+    // Shaped as charset'language'percent-encoded-value.
+    size_t firstQuote = extended.find('\'');
+    size_t secondQuote = (firstQuote == std::string::npos)
+                             ? std::string::npos
+                             : extended.find('\'', firstQuote + 1);
+
+    if (secondQuote != std::string::npos)
+        return PercentDecode(extended.substr(secondQuote + 1));
+
+    return PercentDecode(extended);
+}
+
+// Build the table describing one uploaded file.
+static StackValue MakeFileEntry(const std::string& field,
+                                const std::string& filename,
+                                const std::string& contentType,
+                                const std::string& content) {
+    auto entry = std::make_shared<DlangTable>();
+    entry->Set("field", StackValue(StackValueType::String, field));
+    entry->Set("filename", StackValue(StackValueType::String, filename));
+    entry->Set("contentType", StackValue(StackValueType::String, contentType));
+    entry->Set("size", StackValue(StackValueType::Int, static_cast<double>(content.size())));
+    entry->Set("content", StackValue(StackValueType::String, content));
+
+    return StackValue(StackValueType::Table, entry);
+}
+
+// Store a file entry. Repeated form field names are collected into a list.
+static void AddFileEntry(DlangTable& table, const std::string& key, const StackValue& entry) {
+    if (key.empty())
+        return;
+
+    StackValue existing;
+    if (table.Get(key, existing)) {
+        if (existing.type == StackValueType::Table) {
+            auto list = std::make_shared<DlangList>();
+            list->Push(existing);
+            list->Push(entry);
+            table.Set(key, StackValue(StackValueType::List, list));
+        }
+        else if (existing.type == StackValueType::List) {
+            std::get<std::shared_ptr<DlangList>>(existing.data)->Push(entry);
+        }
+        return;
+    }
+
+    table.Set(key, entry);
+}
+
+// Split a `multipart/form-data` body into its parts and fill the parameter and
+// file tables.
+static void ParseMultipartBody(const std::string& body, const std::string& boundary,
+                               DlangTable& params, DlangTable& files) {
+    const std::string delimiter = "--" + boundary;
+
+    size_t position = body.find(delimiter);
+    if (position == std::string::npos)
+        return;
+
+    while (position != std::string::npos) {
+        size_t afterDelimiter = position + delimiter.size();
+
+        // "--boundary--" closes the body.
+        if (body.compare(afterDelimiter, 2, "--") == 0)
+            break;
+
+        size_t cursor = afterDelimiter;
+        if (body.compare(cursor, 2, "\r\n") == 0)
+            cursor += 2;
+        else if (cursor < body.size() && body[cursor] == '\n')
+            cursor += 1;
+
+        // Part headers run until the blank line; the raw bytes follow it.
+        size_t headerEnd = body.find("\r\n\r\n", cursor);
+        size_t separatorSize = 4;
+
+        if (headerEnd == std::string::npos) {
+            headerEnd = body.find("\n\n", cursor);
+            separatorSize = 2;
+        }
+        if (headerEnd == std::string::npos)
+            break;
+
+        std::string partHeaders = body.substr(cursor, headerEnd - cursor);
+        size_t contentStart = headerEnd + separatorSize;
+
+        size_t next = body.find(delimiter, contentStart);
+        size_t contentEnd = (next == std::string::npos) ? body.size() : next;
+
+        // The line break in front of the next delimiter is framing, not content.
+        if (contentEnd >= 2 && body.compare(contentEnd - 2, 2, "\r\n") == 0)
+            contentEnd -= 2;
+        else if (contentEnd >= 1 && body[contentEnd - 1] == '\n')
+            contentEnd -= 1;
+
+        if (contentEnd < contentStart)
+            contentEnd = contentStart;
+
+        std::string content = body.substr(contentStart, contentEnd - contentStart);
+
+        std::string disposition;
+        std::string fieldName;
+
+        if (FindHeader(partHeaders, "Content-Disposition", disposition, false) &&
+            GetHeaderParameter(disposition, "name", fieldName)) {
+
+            std::string filename = PartFilename(disposition);
+
+            if (filename.empty()) {
+                AddParamValue(params, fieldName, content);
+            }
+            else {
+                std::string partContentType;
+                if (!FindHeader(partHeaders, "Content-Type", partContentType, false))
+                    partContentType = "application/octet-stream";
+
+                AddFileEntry(files, fieldName,
+                             MakeFileEntry(fieldName, filename, partContentType, content));
+            }
+        }
+
+        position = next;
+    }
+}
+
+// Trim a client supplied filename down to something safe to use on disk.
+static std::string SafeUploadFilename(const std::string& filename) {
+    // Some clients (old IE) send a full path; only trust the last component.
+    size_t slash = filename.find_last_of("/\\");
+    std::string name = (slash == std::string::npos) ? filename : filename.substr(slash + 1);
+
+    std::string cleaned;
+    cleaned.reserve(name.size());
+
+    for (unsigned char c : name) {
+        if (c < 0x20 || c == 0x7f || c == '"' || c == '*' || c == ':' ||
+            c == '<' || c == '>' || c == '?' || c == '|')
+            cleaned += '_';
+        else
+            cleaned += static_cast<char>(c);
+    }
+
+    if (cleaned.empty() || cleaned == "." || cleaned == "..")
+        return "upload.bin";
+
+    return cleaned;
+}
+
+static bool WriteFileBinary(const std::string& path, const std::string& data) {
+    std::error_code ec;
+    std::filesystem::path target(path);
+
+    if (target.has_parent_path() && !target.parent_path().empty()) {
+        std::filesystem::create_directories(target.parent_path(), ec);
+        if (ec)
+            return false;
+    }
+
+    std::ofstream file(path, std::ios::binary | std::ios::trunc);
+    if (!file.is_open())
+        return false;
+
+    file.write(data.data(), static_cast<std::streamsize>(data.size()));
+    return file.good();
+}
+
+// Pull the bytes (and a suggested filename) out of an upload value. A plain
+// string is accepted too, so a raw request body can be written as well.
+static bool ExtractUploadContent(const StackValue& value, std::string& outContent,
+                                 std::string& outFilename) {
+    if (value.type == StackValueType::String) {
+        outContent = std::get<std::string>(value.data);
+        outFilename = "upload.bin";
+        return true;
+    }
+
+    if (value.type != StackValueType::Table)
+        return false;
+
+    StackValue content;
+    if (!GetTableField(value, "content", content) || content.type != StackValueType::String)
+        return false;
+
+    outContent = std::get<std::string>(content.data);
+
+    StackValue filename;
+    if (GetTableField(value, "filename", filename) &&
+        filename.type == StackValueType::String &&
+        !std::get<std::string>(filename.data).empty())
+        outFilename = std::get<std::string>(filename.data);
+    else
+        outFilename = "upload.bin";
+
+    return true;
+}
+
+void NativeFilesSave(DlangVM* vm) {
+    // http.save(upload, path) -> true when the bytes were written to disk.
+    StackValue pathValue = dlang_pop(vm);
+    StackValue uploadValue = dlang_pop(vm);
+
+    std::string content, filename;
+    if (pathValue.type != StackValueType::String ||
+        !ExtractUploadContent(uploadValue, content, filename)) {
+        dlang_pushboolean(vm, false);
+        return;
+    }
+
+    dlang_pushboolean(vm, WriteFileBinary(std::get<std::string>(pathValue.data), content));
+}
+
+void NativeFilesSaveTo(DlangVM* vm) {
+    // http.saveTo(upload, folder) -> the written path, or "" on failure.
+    StackValue folderValue = dlang_pop(vm);
+    StackValue uploadValue = dlang_pop(vm);
+
+    std::string content, filename;
+    if (folderValue.type != StackValueType::String ||
+        !ExtractUploadContent(uploadValue, content, filename)) {
+        dlang_pushstring(vm, "");
+        return;
+    }
+
+    std::filesystem::path target =
+        std::filesystem::path(std::get<std::string>(folderValue.data)) /
+        SafeUploadFilename(filename);
+
+    if (!WriteFileBinary(target.string(), content)) {
+        dlang_pushstring(vm, "");
+        return;
+    }
+
+    dlang_pushstring(vm, target.string());
+}
+
+// Read a full HTTP request: the header block plus the body described by
+// Content-Length. `headerEnd` is set to the offset of the blank line that
+// terminates the headers. Returns false when no complete header block arrived.
+// `outTooLarge` reports a body bigger than `g_maxBodyBytes`, in which case the
+// request is refused before the whole body has been buffered.
+static bool ReadRequest(SocketHandle sock, std::string& raw, size_t& headerEnd,
+                        bool& outTooLarge) {
+    raw.clear();
+    headerEnd = std::string::npos;
+    outTooLarge = false;
+
+    char buffer[4096];
+    size_t contentLength = 0;
+    bool hasContentLength = false;
+
+    while (true) {
+        int bytes = recv(sock, buffer, sizeof(buffer), 0);
+        if (bytes <= 0)
+            break;
+
+        raw.append(buffer, static_cast<size_t>(bytes));
+
+        if (headerEnd == std::string::npos) {
+            headerEnd = raw.find("\r\n\r\n");
+            if (headerEnd != std::string::npos) {
+                std::string lengthValue;
+                if (GetHeaderValue(raw.substr(0, headerEnd), "Content-Length", lengthValue)) {
+                    hasContentLength = true;
+                    contentLength = static_cast<size_t>(
+                        std::strtoul(lengthValue.c_str(), nullptr, 10));
+
+                    // An announced oversized body is refused up front instead of
+                    // being buffered in full.
+                    if (contentLength > g_maxBodyBytes) {
+                        outTooLarge = true;
+                        break;
+                    }
+                }
+            }
+        }
+
+        if (headerEnd != std::string::npos) {
+            size_t bodyStart = headerEnd + 4;
+            if (!hasContentLength || raw.size() >= bodyStart + contentLength)
+                break;
+        }
+
+        // Defensive cap so a misbehaving client cannot exhaust memory, for
+        // requests that understate their size as well as endless header blocks.
+        if (raw.size() > g_maxBodyBytes + 64u * 1024u) {
+            outTooLarge = true;
+            break;
+        }
+    }
+
+    return headerEnd != std::string::npos;
+}
+
+void NativeMaxBody(DlangVM* vm) {
+    // server.maxBody(bytes) -> change the request body limit.
+    StackValue value = dlang_pop(vm);
+
+    if (value.type != StackValueType::Int)
+        return;
+
+    double bytes = std::get<double>(value.data);
+    if (bytes > 0)
+        g_maxBodyBytes = static_cast<size_t>(bytes);
+}
+
+// Handle one fully read request: parse the request line, build the parameter
+// tables and dispatch to a route, a static file or an error page.
+static void HandleRequest(DlangVM* vm, SocketHandle clientSocket,
+                          const std::string& headerBlock, const std::string& body,
+                          bool bodyTooLarge) {
+    std::istringstream stream(headerBlock);
+    std::string method, fullPath, version;
+
+    if (!(stream >> method >> fullPath >> version))
+        return;
+
+    size_t qPos = fullPath.find('?');
+    std::string path = (qPos != std::string::npos) ? fullPath.substr(0, qPos) : fullPath;
+    std::string query = (qPos != std::string::npos) ? fullPath.substr(qPos + 1) : std::string();
+
+    // An oversized upload is refused before anything else is parsed.
+    if (bodyTooLarge) {
+        ErrorResponse err = RenderError(vm, 413, method, path);
+        SendResponse(clientSocket, 413, err.contentType, err.body);
+        return;
+    }
+
+    // Every request parameter (query string + body) goes into a single key/value
+    // table, uploaded files into another, and the Cookie header into a third.
+    auto paramsTable = std::make_shared<DlangTable>();
+    auto filesTable = std::make_shared<DlangTable>();
+    ParseUrlEncoded(query, *paramsTable);
+
+    if (!body.empty()) {
+        std::string contentType;
+        bool hasContentType = GetHeaderValue(headerBlock, "Content-Type", contentType);
+
+        std::string boundary;
+        bool isMultipart = hasContentType &&
+                           ToLower(contentType).find("multipart/form-data") != std::string::npos &&
+                           GetMultipartBoundary(contentType, boundary);
+
+        if (isMultipart)
+            ParseMultipartBody(body, boundary, *paramsTable, *filesTable);
+        else if (hasContentType && ToLower(contentType).find("json") != std::string::npos)
+            MergeJsonBody(vm, body, *paramsTable);
+        else
+            ParseUrlEncoded(body, *paramsTable);
+    }
+
+    auto cookiesTable = std::make_shared<DlangTable>();
+    std::string cookieHeader;
+    if (GetHeaderValue(headerBlock, "Cookie", cookieHeader))
+        ParseCookies(cookieHeader, *cookiesTable);
+
+    StackValue paramsValue(StackValueType::Table, paramsTable);
+    StackValue cookiesValue(StackValueType::Table, cookiesTable);
+    StackValue filesValue(StackValueType::Table, filesTable);
+
+    const RouteHandler* matched = nullptr;
+    bool pathMatched = false;
+
+    for (const auto& route : g_routes) {
+        if (route.path != path)
+            continue;
+
+        pathMatched = true;
+        auto it = std::find(route.methods.begin(), route.methods.end(), method);
+        if (it != route.methods.end()) {
+            matched = &route;
+            break;
+        }
+    }
+
+    if (matched) {
+        int base = vm->stack.top();
+
+        try {
+            // arg 1: req = { method, path, query, params, cookies, files, body }
+            dlang_newtable(vm);
+
+            dlang_pushstring(vm, method.c_str());
+            dlang_setfield(vm, "method");
+
+            dlang_pushstring(vm, path.c_str());
+            dlang_setfield(vm, "path");
+
+            if (!query.empty()) {
+                dlang_pushstring(vm, query.c_str());
+                dlang_setfield(vm, "query");
+            }
+
+            if (!body.empty()) {
+                dlang_pushstring(vm, body);
+                dlang_setfield(vm, "body");
+            }
+
+            dlang_push(vm, paramsValue);
+            dlang_setfield(vm, "params");
+
+            dlang_push(vm, cookiesValue);
+            dlang_setfield(vm, "cookies");
+
+            dlang_push(vm, filesValue);
+            dlang_setfield(vm, "files");
+
+            // arg 2: params, arg 3: cookies, arg 4: files
+            dlang_push(vm, paramsValue);
+            dlang_push(vm, cookiesValue);
+            dlang_push(vm, filesValue);
+
+            dlang_push(vm, matched->functionVal);
+            if (!dlang_call(vm, 4))
+                throw std::runtime_error("Route handler could not be called");
+
+            // CallFunc leaves the handler's return value on top of the stack;
+            // inspect it directly instead of using the (now stack-consuming)
+            // field opcodes.
+            StackValue returned = dlang_pop(vm);
+
+            std::string responseBody;
+            std::string contentType;
+            int statusCode = 200;
+            ExtractResponse(vm, returned, responseBody, contentType, statusCode);
+
+            ResetStack(vm, base);
+            SendResponse(clientSocket, statusCode, contentType, responseBody);
+        }
+        catch (...) {
+            ResetStack(vm, base);
+            ErrorResponse err = RenderError(vm, 500, method, path);
+            SendResponse(clientSocket, 500, err.contentType, err.body);
+        }
+    }
+    else {
+        std::string staticBody, staticType;
+
+        if (!pathMatched && TryResolveStatic(path, staticBody, staticType)) {
+            SendResponse(clientSocket, 200, staticType, staticBody);
+        }
+        else {
+            int errorCode = pathMatched ? 405 : 404;
+            ErrorResponse err = RenderError(vm, errorCode, method, path);
+            SendResponse(clientSocket, errorCode, err.contentType, err.body);
+        }
+    }
+}
+
 void NativeListen(DlangVM* vm) {
     int portInt = static_cast<int>(dlang_tonumber(vm));
 
@@ -682,81 +1717,17 @@ void NativeListen(DlangVM* vm) {
             setsockopt(clientSocket, IPPROTO_TCP, TCP_NODELAY,
                        reinterpret_cast<const char*>(&flag), sizeof(flag));
 
-            char buffer[4096];
-            int bytes = recv(clientSocket, buffer, sizeof(buffer) - 1, 0);
+            std::string rawRequest;
+            size_t headerEnd = std::string::npos;
+            bool bodyTooLarge = false;
 
-            if (bytes > 0) {
-                buffer[bytes] = '\0';
-                std::istringstream stream(buffer);
-                std::string method, fullPath, version;
+            if (ReadRequest(clientSocket, rawRequest, headerEnd, bodyTooLarge)) {
+                std::string headerBlock = rawRequest.substr(0, headerEnd);
+                std::string body = (headerEnd + 4 < rawRequest.size())
+                                       ? rawRequest.substr(headerEnd + 4)
+                                       : std::string();
 
-                if (stream >> method >> fullPath >> version) {
-                    size_t qPos = fullPath.find('?');
-                    std::string path = (qPos != std::string::npos) ? fullPath.substr(0, qPos) : fullPath;
-
-                    const RouteHandler* matched = nullptr;
-                    bool pathMatched = false;
-
-                    for (const auto& route : g_routes) {
-                        if (route.path != path)
-                            continue;
-
-                        pathMatched = true;
-                        auto it = std::find(route.methods.begin(), route.methods.end(), method);
-                        if (it != route.methods.end()) {
-                            matched = &route;
-                            break;
-                        }
-                    }
-
-                    if (matched) {
-                        int base = vm->stack.top();
-
-                        try {
-                            dlang_newtable(vm);
-
-                            dlang_pushstring(vm, method.c_str());
-                            dlang_setfield(vm, "method");
-
-                            dlang_pushstring(vm, path.c_str());
-                            dlang_setfield(vm, "path");
-
-                            dlang_push(vm, matched->functionVal);
-                            if (!dlang_call(vm, 1))
-                                throw std::runtime_error("Route handler could not be called");
-
-                            // CallFunc leaves the handler's return value on top
-                            // of the stack; inspect it directly instead of using
-                            // the (now stack-consuming) field opcodes.
-                            StackValue returned = dlang_pop(vm);
-
-                            std::string responseBody;
-                            std::string contentType;
-                            int statusCode = 200;
-                            ExtractResponse(vm, returned, responseBody, contentType, statusCode);
-
-                            ResetStack(vm, base);
-                            SendResponse(clientSocket, statusCode, contentType, responseBody);
-                        }
-                        catch (...) {
-                            ResetStack(vm, base);
-                            ErrorResponse err = RenderError(vm, 500, method, path);
-                            SendResponse(clientSocket, 500, err.contentType, err.body);
-                        }
-                    }
-                    else {
-                        std::string staticBody, staticType;
-
-                        if (!pathMatched && TryResolveStatic(path, staticBody, staticType)) {
-                            SendResponse(clientSocket, 200, staticType, staticBody);
-                        }
-                        else {
-                            int errorCode = pathMatched ? 405 : 404;
-                            ErrorResponse err = RenderError(vm, errorCode, method, path);
-                            SendResponse(clientSocket, errorCode, err.contentType, err.body);
-                        }
-                    }
-                }
+                HandleRequest(vm, clientSocket, headerBlock, body, bodyTooLarge);
             }
 
             shutdown(clientSocket, DLANG_SHUT_WRITE);
@@ -792,6 +1763,9 @@ void NativeCreate(DlangVM* vm)
 
     dlang_pushcfunction(vm, NativeError);
     dlang_setfield(vm, "error");
+
+    dlang_pushcfunction(vm, NativeMaxBody);
+    dlang_setfield(vm, "maxBody");
 }
 
 extern "C" {
@@ -803,6 +1777,27 @@ extern "C" {
         dlang_pushcfunction(vm, NativeCreate);
         dlang_setfield(vm, "server");
 
+        // http.save(upload, path) and http.saveTo(upload, folder) write an upload
+        // to disk. They hang off the `http` table rather than a separate `files`
+        // global: a route handler's 4th parameter is conventionally called
+        // `files` and would shadow a global with that name.
+        dlang_pushcfunction(vm, NativeFilesSave);
+        dlang_setfield(vm, "save");
+
+        dlang_pushcfunction(vm, NativeFilesSaveTo);
+        dlang_setfield(vm, "saveTo");
+
         dlang_setglobal(vm, "http");
+
+        // view.Render(path, variables) -> rendered template string.
+        dlang_newtable(vm);
+
+        dlang_pushcfunction(vm, NativeViewRender);
+        dlang_setfield(vm, "Render");
+
+        dlang_pushcfunction(vm, NativeViewRender);
+        dlang_setfield(vm, "render");
+
+        dlang_setglobal(vm, "view");
     }
 }
\ No newline at end of file