Merge main

19 files changed, 3332 insertions, 0 deletions

diff --git a/zenhttp/httpclient.cpp b/zenhttp/httpclient.cpp
new file mode 100644
index 000000000..b7df12026
--- /dev/null
+++ b/zenhttp/httpclient.cpp
@@ -0,0 +1,158 @@
+// Copyright Epic Games, Inc. All Rights Reserved.
+
+#include <zenhttp/httpclient.h>
+#include <zenhttp/httpserver.h>
+
+#include <zencore/compactbinarybuilder.h>
+#include <zencore/compactbinarypackage.h>
+#include <zencore/iobuffer.h>
+#include <zencore/logging.h>
+#include <zencore/sharedbuffer.h>
+#include <zencore/stream.h>
+
+#include "httpshared.h"
+
+#include <doctest/doctest.h>
+
+static std::atomic<uint32_t> HttpClientRequestIdCounter{0};
+
+namespace zen {
+
+using namespace std::literals;
+
+HttpClient::Response
+FromCprResponse(cpr::Response& InResponse)
+{
+	return {.StatusCode = InResponse.status_code};
+}
+
+//////////////////////////////////////////////////////////////////////////
+
+HttpClient::HttpClient(std::string_view BaseUri) : m_BaseUri(BaseUri)
+{
+}
+
+HttpClient::~HttpClient()
+{
+}
+
+HttpClient::Response
+HttpClient::TransactPackage(std::string_view Url, CbPackage Package)
+{
+	cpr::Session Sess;
+	Sess.SetUrl(m_BaseUri + std::string(Url));
+
+	// First, list of offered chunks for filtering on the server end
+
+	std::vector<IoHash>			  AttachmentsToSend;
+	std::span<const CbAttachment> Attachments = Package.GetAttachments();
+
+	const uint32_t RequestId	   = ++HttpClientRequestIdCounter;
+	auto		   RequestIdString = fmt::to_string(RequestId);
+
+	if (Attachments.empty() == false)
+	{
+		CbObjectWriter Writer;
+		Writer.BeginArray("offer");
+
+		for (const CbAttachment& Attachment : Attachments)
+		{
+			IoHash Hash = Attachment.GetHash();
+
+			Writer.AddHash(Hash);
+		}
+
+		Writer.EndArray();
+
+		MemoryOutStream MemOut;
+		BinaryWriter	MemWriter(MemOut);
+		Writer.Save(MemWriter);
+
+		Sess.SetHeader(
+			{{"Content-Type", "application/x-ue-offer"}, {"UE-Session", "123456789012345678901234"}, {"UE-Request", RequestIdString}});
+		Sess.SetBody(cpr::Body{(const char*)MemOut.Data(), MemOut.Size()});
+
+		cpr::Response FilterResponse = Sess.Post();
+
+		if (FilterResponse.status_code == 200)
+		{
+			IoBuffer ResponseBuffer(IoBuffer::Wrap, FilterResponse.text.data(), FilterResponse.text.size());
+			CbObject ResponseObject = LoadCompactBinaryObject(ResponseBuffer);
+
+			for (auto& Entry : ResponseObject["need"])
+			{
+				ZEN_ASSERT(Entry.IsHash());
+				AttachmentsToSend.push_back(Entry.AsHash());
+			}
+		}
+	}
+
+	// Prepare package for send
+
+	CbPackage SendPackage;
+	SendPackage.SetObject(Package.GetObject(), Package.GetObjectHash());
+
+	for (const IoHash& AttachmentCid : AttachmentsToSend)
+	{
+		const CbAttachment* Attachment = Package.FindAttachment(AttachmentCid);
+
+		if (Attachment)
+		{
+			SendPackage.AddAttachment(*Attachment);
+		}
+		else
+		{
+			// This should be an error -- server asked to have something we can't find
+		}
+	}
+
+	// Transmit package payload
+
+	CompositeBuffer Message		= FormatPackageMessageBuffer(SendPackage);
+	SharedBuffer	FlatMessage = Message.Flatten();
+
+	Sess.SetHeader(
+		{{"Content-Type", "application/x-ue-cbpkg"}, {"UE-Session", "123456789012345678901234"}, {"UE-Request", RequestIdString}});
+	Sess.SetBody(cpr::Body{(const char*)FlatMessage.GetData(), FlatMessage.GetSize()});
+
+	cpr::Response FilterResponse = Sess.Post();
+
+	if (!IsHttpSuccessCode(FilterResponse.status_code))
+	{
+		return FromCprResponse(FilterResponse);
+	}
+
+	IoBuffer ResponseBuffer(IoBuffer::Clone, FilterResponse.text.data(), FilterResponse.text.size());
+
+	if (auto It = FilterResponse.header.find("Content-Type"); It != FilterResponse.header.end())
+	{
+		HttpContentType ContentType = ParseContentType(It->second);
+
+		ResponseBuffer.SetContentType(ContentType);
+	}
+
+	return {.StatusCode = FilterResponse.status_code, .ResponsePayload = ResponseBuffer};
+}
+
+HttpClient::Response
+HttpClient::Delete(std::string_view Url)
+{
+	ZEN_UNUSED(Url);
+	return {};
+}
+
+//////////////////////////////////////////////////////////////////////////
+
+TEST_CASE("httpclient")
+{
+	using namespace std::literals;
+
+	SUBCASE("client") {}
+}
+
+void
+httpclient_forcelink()
+{
+}
+
+}  // namespace zen
diff --git a/zenhttp/httpnull.cpp b/zenhttp/httpnull.cpp
new file mode 100644
index 000000000..57cba13d3
--- /dev/null
+++ b/zenhttp/httpnull.cpp
@@ -0,0 +1,67 @@
+// Copyright Epic Games, Inc. All Rights Reserved.
+
+#include "httpnull.h"
+
+#include <conio.h>
+#include <zencore/logging.h>
+
+namespace zen {
+
+HttpNullServer::HttpNullServer()
+{
+}
+
+HttpNullServer::~HttpNullServer()
+{
+}
+
+void
+HttpNullServer::RegisterService(HttpService& Service)
+{
+	ZEN_UNUSED(Service);
+}
+
+void
+HttpNullServer::Initialize(int BasePort)
+{
+	ZEN_UNUSED(BasePort);
+}
+
+void
+HttpNullServer::Run(bool TestMode)
+{
+	if (TestMode == false)
+	{
+		zen::logging::ConsoleLog().info("Zen Server running (null HTTP). Press ESC or Q to quit");
+	}
+
+	do
+	{
+		int WaitTimeout = -1;
+
+		if (!TestMode)
+		{
+			WaitTimeout = 1000;
+		}
+
+		if (!TestMode && _kbhit() != 0)
+		{
+			char c = (char)_getch();
+
+			if (c == 27 || c == 'Q' || c == 'q')
+			{
+				RequestApplicationExit(0);
+			}
+		}
+
+		m_ShutdownEvent.Wait(WaitTimeout);
+	} while (!IsApplicationExitRequested());
+}
+
+void
+HttpNullServer::RequestExit()
+{
+	m_ShutdownEvent.Set();
+}
+
+}  // namespace zen
diff --git a/zenhttp/httpnull.h b/zenhttp/httpnull.h
new file mode 100644
index 000000000..b15b1b123
--- /dev/null
+++ b/zenhttp/httpnull.h
@@ -0,0 +1,29 @@
+// Copyright Epic Games, Inc. All Rights Reserved.
+
+#pragma once
+
+#include <zencore/thread.h>
+#include <zenhttp/httpserver.h>
+
+namespace zen {
+
+/**
+ * @brief Null implementation of "http" server. Does nothing
+ */
+
+class HttpNullServer : public HttpServer
+{
+public:
+	HttpNullServer();
+	~HttpNullServer();
+
+	virtual void RegisterService(HttpService& Service) override;
+	virtual void Initialize(int BasePort) override;
+	virtual void Run(bool TestMode) override;
+	virtual void RequestExit() override;
+
+private:
+	Event m_ShutdownEvent;
+};
+
+}  // namespace zen
diff --git a/zenhttp/httpserver.cpp b/zenhttp/httpserver.cpp
new file mode 100644
index 000000000..f97ac0067
--- /dev/null
+++ b/zenhttp/httpserver.cpp
@@ -0,0 +1,533 @@
+// Copyright Epic Games, Inc. All Rights Reserved.
+
+#include <zenhttp/httpserver.h>
+
+#include "httpnull.h"
+#include "httpshared.h"
+#include "httpsys.h"
+#include "httpuws.h"
+
+#include <zencore/compactbinary.h>
+#include <zencore/compactbinarypackage.h>
+#include <zencore/iobuffer.h>
+#include <zencore/logging.h>
+#include <zencore/refcount.h>
+#include <zencore/stream.h>
+#include <zencore/string.h>
+#include <zencore/thread.h>
+
+#include <conio.h>
+#include <new.h>
+#include <charconv>
+#include <span>
+#include <string_view>
+
+#include <doctest/doctest.h>
+
+namespace zen {
+
+using namespace std::literals;
+
+std::string_view
+MapContentTypeToString(HttpContentType ContentType)
+{
+	switch (ContentType)
+	{
+		default:
+		case HttpContentType::kUnknownContentType:
+		case HttpContentType::kBinary:
+			return "application/octet-stream"sv;
+
+		case HttpContentType::kText:
+			return "text/plain"sv;
+
+		case HttpContentType::kJSON:
+			return "application/json"sv;
+
+		case HttpContentType::kCbObject:
+			return "application/x-ue-cb"sv;
+
+		case HttpContentType::kCbPackage:
+			return "application/x-ue-cbpkg"sv;
+
+		case HttpContentType::kCbPackageOffer:
+			return "application/x-ue-offer"sv;
+
+		case HttpContentType::kYAML:
+			return "text/yaml"sv;
+	}
+}
+
+static const uint32_t HashBinary					= HashStringDjb2("application/octet-stream"sv);
+static const uint32_t HashJson						= HashStringDjb2("application/json"sv);
+static const uint32_t HashYaml						= HashStringDjb2("text/yaml"sv);
+static const uint32_t HashText						= HashStringDjb2("text/plain"sv);
+static const uint32_t HashCompactBinary				= HashStringDjb2("application/x-ue-cb"sv);
+static const uint32_t HashCompactBinaryPackage		= HashStringDjb2("application/x-ue-cbpkg"sv);
+static const uint32_t HashCompactBinaryPackageOffer = HashStringDjb2("application/x-ue-offer"sv);
+
+HttpContentType
+ParseContentType(const std::string_view& ContentTypeString)
+{
+	if (!ContentTypeString.empty())
+	{
+		const uint32_t CtHash = HashStringDjb2(ContentTypeString);
+
+		if (CtHash == HashBinary)
+		{
+			return HttpContentType::kBinary;
+		}
+		else if (CtHash == HashCompactBinary)
+		{
+			return HttpContentType::kCbObject;
+		}
+		else if (CtHash == HashCompactBinaryPackage)
+		{
+			return HttpContentType::kCbPackage;
+		}
+		else if (CtHash == HashCompactBinaryPackageOffer)
+		{
+			return HttpContentType::kCbPackageOffer;
+		}
+		else if (CtHash == HashJson)
+		{
+			return HttpContentType::kJSON;
+		}
+		else if (CtHash == HashYaml)
+		{
+			return HttpContentType::kYAML;
+		}
+		else if (CtHash == HashText)
+		{
+			return HttpContentType::kText;
+		}
+	}
+
+	return HttpContentType::kUnknownContentType;
+}
+
+const char*
+ReasonStringForHttpResultCode(int HttpCode)
+{
+	switch (HttpCode)
+	{
+			// 1xx Informational
+
+		case 100:
+			return "Continue";
+		case 101:
+			return "Switching Protocols";
+
+			// 2xx Success
+
+		case 200:
+			return "OK";
+		case 201:
+			return "Created";
+		case 202:
+			return "Accepted";
+		case 204:
+			return "No Content";
+		case 205:
+			return "Reset Content";
+		case 206:
+			return "Partial Content";
+
+			// 3xx Redirection
+
+		case 300:
+			return "Multiple Choices";
+		case 301:
+			return "Moved Permanently";
+		case 302:
+			return "Found";
+		case 303:
+			return "See Other";
+		case 304:
+			return "Not Modified";
+		case 305:
+			return "Use Proxy";
+		case 306:
+			return "Switch Proxy";
+		case 307:
+			return "Temporary Redirect";
+		case 308:
+			return "Permanent Redirect";
+
+			// 4xx Client errors
+
+		case 400:
+			return "Bad Request";
+		case 401:
+			return "Unauthorized";
+		case 402:
+			return "Payment Required";
+		case 403:
+			return "Forbidden";
+		case 404:
+			return "Not Found";
+		case 405:
+			return "Method Not Allowed";
+		case 406:
+			return "Not Acceptable";
+		case 407:
+			return "Proxy Authentication Required";
+		case 408:
+			return "Request Timeout";
+		case 409:
+			return "Conflict";
+		case 410:
+			return "Gone";
+		case 411:
+			return "Length Required";
+		case 412:
+			return "Precondition Failed";
+		case 413:
+			return "Payload Too Large";
+		case 414:
+			return "URI Too Long";
+		case 415:
+			return "Unsupported Media Type";
+		case 416:
+			return "Range Not Satisifiable";
+		case 417:
+			return "Expectation Failed";
+		case 418:
+			return "I'm a teapot";
+		case 421:
+			return "Misdirected Request";
+		case 422:
+			return "Unprocessable Entity";
+		case 423:
+			return "Locked";
+		case 424:
+			return "Failed Dependency";
+		case 425:
+			return "Too Early";
+		case 426:
+			return "Upgrade Required";
+		case 428:
+			return "Precondition Required";
+		case 429:
+			return "Too Many Requests";
+		case 431:
+			return "Request Header Fields Too Large";
+
+			// 5xx Server errors
+
+		case 500:
+			return "Internal Server Error";
+		case 501:
+			return "Not Implemented";
+		case 502:
+			return "Bad Gateway";
+		case 503:
+			return "Service Unavailable";
+		case 504:
+			return "Gateway Timeout";
+		case 505:
+			return "HTTP Version Not Supported";
+		case 506:
+			return "Variant Also Negotiates";
+		case 507:
+			return "Insufficient Storage";
+		case 508:
+			return "Loop Detected";
+		case 510:
+			return "Not Extended";
+		case 511:
+			return "Network Authentication Required";
+
+		default:
+			return "Unknown Result";
+	}
+}
+
+//////////////////////////////////////////////////////////////////////////
+
+Ref<IHttpPackageHandler>
+HttpService::HandlePackageRequest(HttpServerRequest& HttpServiceRequest)
+{
+	ZEN_UNUSED(HttpServiceRequest);
+
+	return nullptr;
+}
+
+//////////////////////////////////////////////////////////////////////////
+
+HttpServerRequest::HttpServerRequest()
+{
+}
+
+HttpServerRequest::~HttpServerRequest()
+{
+}
+
+void
+HttpServerRequest::WriteResponse(HttpResponseCode ResponseCode, CbPackage Data)
+{
+	std::vector<IoBuffer> ResponseBuffers = FormatPackageMessage(Data);
+	return WriteResponse(ResponseCode, HttpContentType::kCbPackage, ResponseBuffers);
+}
+
+void
+HttpServerRequest::WriteResponse(HttpResponseCode ResponseCode, CbObject Data)
+{
+	SharedBuffer			Buf = Data.GetBuffer();
+	std::array<IoBuffer, 1> Buffers{IoBufferBuilder::MakeCloneFromMemory(Buf.GetData(), Buf.GetSize())};
+	return WriteResponse(ResponseCode, HttpContentType::kCbObject, Buffers);
+}
+
+void
+HttpServerRequest::WriteResponse(HttpResponseCode ResponseCode, HttpContentType ContentType, std::string_view ResponseString)
+{
+	return WriteResponse(ResponseCode, ContentType, std::u8string_view{(char8_t*)ResponseString.data(), ResponseString.size()});
+}
+
+void
+HttpServerRequest::WriteResponse(HttpResponseCode ResponseCode, HttpContentType ContentType, IoBuffer Blob)
+{
+	std::array<IoBuffer, 1> Buffers{Blob};
+	return WriteResponse(ResponseCode, ContentType, Buffers);
+}
+
+void
+HttpServerRequest::WriteResponse(HttpResponseCode ResponseCode, HttpContentType ContentType, CompositeBuffer& Payload)
+{
+	std::span<const SharedBuffer> Segments = Payload.GetSegments();
+
+	std::vector<IoBuffer> Buffers;
+
+	for (auto& Segment : Segments)
+	{
+		Buffers.push_back(Segment.AsIoBuffer());
+	}
+
+	WriteResponse(ResponseCode, ContentType, Payload);
+}
+
+HttpServerRequest::QueryParams
+HttpServerRequest::GetQueryParams()
+{
+	QueryParams Params;
+
+	const std::string_view QStr = QueryString();
+
+	const char* QueryIt	 = QStr.data();
+	const char* QueryEnd = QueryIt + QStr.size();
+
+	while (QueryIt != QueryEnd)
+	{
+		if (*QueryIt == '&')
+		{
+			++QueryIt;
+			continue;
+		}
+
+		const std::string_view Query{QueryIt, QueryEnd};
+
+		size_t DelimIndex = Query.find('&', 0);
+
+		if (DelimIndex == std::string_view::npos)
+		{
+			DelimIndex = Query.size();
+		}
+
+		std::string_view ThisQuery{QueryIt, DelimIndex};
+
+		size_t EqIndex = ThisQuery.find('=', 0);
+
+		if (EqIndex != std::string_view::npos)
+		{
+			std::string_view Parm{ThisQuery.data(), EqIndex};
+			ThisQuery.remove_prefix(EqIndex + 1);
+
+			Params.KvPairs.emplace_back(Parm, ThisQuery);
+		}
+
+		QueryIt += DelimIndex;
+	}
+
+	return Params;
+}
+
+Oid
+HttpServerRequest::SessionId() const
+{
+	if (m_Flags & kHaveSessionId)
+	{
+		return m_SessionId;
+	}
+
+	m_SessionId = ParseSessionId();
+	m_Flags |= kHaveSessionId;
+	return m_SessionId;
+}
+
+uint32_t
+HttpServerRequest::RequestId() const
+{
+	if (m_Flags & kHaveRequestId)
+	{
+		return m_RequestId;
+	}
+
+	m_RequestId = ParseRequestId();
+	m_Flags |= kHaveRequestId;
+	return m_RequestId;
+}
+
+CbObject
+HttpServerRequest::ReadPayloadObject()
+{
+	if (IoBuffer Payload = ReadPayload())
+	{
+		return LoadCompactBinaryObject(std::move(Payload));
+	}
+
+	return {};
+}
+
+CbPackage
+HttpServerRequest::ReadPayloadPackage()
+{
+	if (IoBuffer Payload = ReadPayload())
+	{
+		return ParsePackageMessage(std::move(Payload));
+	}
+
+	return {};
+}
+
+//////////////////////////////////////////////////////////////////////////
+
+void
+HttpRequestRouter::AddPattern(const char* Id, const char* Regex)
+{
+	ZEN_ASSERT(m_PatternMap.find(Id) == m_PatternMap.end());
+
+	m_PatternMap.insert({Id, Regex});
+}
+
+void
+HttpRequestRouter::RegisterRoute(const char* Regex, HttpRequestRouter::HandlerFunc_t&& HandlerFunc, HttpVerb SupportedVerbs)
+{
+	ExtendableStringBuilder<128> ExpandedRegex;
+	ProcessRegexSubstitutions(Regex, ExpandedRegex);
+
+	m_Handlers.emplace_back(ExpandedRegex.c_str(), SupportedVerbs, std::move(HandlerFunc), Regex);
+}
+
+void
+HttpRequestRouter::ProcessRegexSubstitutions(const char* Regex, StringBuilderBase& OutExpandedRegex)
+{
+	size_t RegexLen = strlen(Regex);
+
+	for (size_t i = 0; i < RegexLen;)
+	{
+		bool matched = false;
+
+		if (Regex[i] == '{' && ((i == 0) || (Regex[i - 1] != '\\')))
+		{
+			// Might have a pattern reference - find closing brace
+
+			for (size_t j = i + 1; j < RegexLen; ++j)
+			{
+				if (Regex[j] == '}')
+				{
+					std::string Pattern(&Regex[i + 1], j - i - 1);
+
+					if (auto it = m_PatternMap.find(Pattern); it != m_PatternMap.end())
+					{
+						OutExpandedRegex.Append(it->second.c_str());
+					}
+					else
+					{
+						// Default to anything goes (or should this just be an error?)
+
+						OutExpandedRegex.Append("(.+?)");
+					}
+
+					// skip ahead
+					i = j + 1;
+
+					matched = true;
+
+					break;
+				}
+			}
+		}
+
+		if (!matched)
+		{
+			OutExpandedRegex.Append(Regex[i++]);
+		}
+	}
+}
+
+bool
+HttpRequestRouter::HandleRequest(zen::HttpServerRequest& Request)
+{
+	const HttpVerb Verb = Request.RequestVerb();
+
+	std::string_view  Uri = Request.RelativeUri();
+	HttpRouterRequest RouterRequest(Request);
+
+	for (const auto& Handler : m_Handlers)
+	{
+		if ((Handler.Verbs & Verb) == Verb && regex_match(begin(Uri), end(Uri), RouterRequest.m_Match, Handler.RegEx))
+		{
+			Handler.Handler(RouterRequest);
+
+			return true;  // Route matched
+		}
+	}
+
+	return false;  // No route matched
+}
+
+//////////////////////////////////////////////////////////////////////////
+
+Ref<HttpServer>
+CreateHttpServer()
+{
+#if 0
+	return new HttpUwsServer;
+#elif ZEN_WITH_HTTPSYS
+	return new HttpSysServer{std::thread::hardware_concurrency()};
+#else
+	return new HttpNullServer;
+#endif
+}
+
+//////////////////////////////////////////////////////////////////////////
+
+TEST_CASE("http")
+{
+	using namespace std::literals;
+
+	SUBCASE("router")
+	{
+		HttpRequestRouter r;
+		r.AddPattern("a", "[[:alpha:]]+");
+		r.RegisterRoute(
+			"{a}",
+			[&](auto) {},
+			HttpVerb::kGet);
+
+		// struct TestHttpServerRequest : public HttpServerRequest
+		//{
+		//	TestHttpServerRequest(std::string_view Uri) : m_uri{Uri} {}
+		//};
+
+		// TestHttpServerRequest req{};
+		// r.HandleRequest(req);
+	}
+}
+
+void
+http_forcelink()
+{
+}
+
+}  // namespace zen
diff --git a/zenhttp/httpshared.cpp b/zenhttp/httpshared.cpp
new file mode 100644
index 000000000..68252a763
--- /dev/null
+++ b/zenhttp/httpshared.cpp
@@ -0,0 +1,138 @@
+// Copyright Epic Games, Inc. All Rights Reserved.
+
+#include "httpshared.h"
+
+#include <zencore/compactbinarypackage.h>
+#include <zencore/compositebuffer.h>
+#include <zencore/iobuffer.h>
+#include <zencore/iohash.h>
+#include <zencore/stream.h>
+
+#include <span>
+#include <vector>
+
+namespace zen {
+
+CompositeBuffer
+FormatPackageMessageBuffer(const CbPackage& Data)
+{
+	std::vector<IoBuffer> Message = FormatPackageMessage(Data);
+
+	std::vector<SharedBuffer> Buffers;
+
+	for (IoBuffer& Buf : Message)
+	{
+		Buffers.push_back(SharedBuffer(Buf));
+	}
+
+	return CompositeBuffer(std::move(Buffers));
+}
+
+std::vector<IoBuffer>
+FormatPackageMessage(const CbPackage& Data)
+{
+	const std::span<const CbAttachment>& Attachments = Data.GetAttachments();
+
+	std::vector<IoBuffer> ResponseBuffers;
+	ResponseBuffers.reserve(3 + Attachments.size());  // TODO: may want to use an additional fudge factor here to avoid growing since each
+													  // attachment is likely to consist of several buffers
+
+	uint64_t TotalAttachmentsSize = 0;
+
+	// Fixed size header
+
+	CbPackageHeader Hdr{.HeaderMagic = kCbPkgMagic, .AttachmentCount = gsl::narrow<uint32_t>(Attachments.size())};
+
+	ResponseBuffers.push_back(IoBufferBuilder::MakeCloneFromMemory(&Hdr, sizeof Hdr));
+
+	// Attachment metadata array
+
+	IoBuffer AttachmentMetadataBuffer = IoBuffer{sizeof(CbAttachmentEntry) * (Attachments.size() + /* root */ 1)};
+
+	CbAttachmentEntry* AttachmentInfo = reinterpret_cast<CbAttachmentEntry*>(AttachmentMetadataBuffer.MutableData());
+
+	ResponseBuffers.push_back(AttachmentMetadataBuffer);  // Attachment metadata
+
+	// Root object
+
+	IoBuffer RootIoBuffer = Data.GetObject().GetBuffer().AsIoBuffer();
+	ResponseBuffers.push_back(RootIoBuffer);  // Root object
+
+	*AttachmentInfo++ = {.AttachmentSize = RootIoBuffer.Size(), .AttachmentHash = Data.GetObjectHash()};
+
+	// Attachment payloads
+
+	for (const CbAttachment& Attachment : Attachments)
+	{
+		CompressedBuffer AttachmentBuffer = Attachment.AsCompressedBinary();
+		CompositeBuffer	 Compressed		  = AttachmentBuffer.GetCompressed();
+
+		*AttachmentInfo++ = {.AttachmentSize = AttachmentBuffer.GetCompressedSize(),
+							 .AttachmentHash = IoHash::FromBLAKE3(AttachmentBuffer.GetRawHash())};
+
+		for (const SharedBuffer& Segment : Compressed.GetSegments())
+		{
+			ResponseBuffers.push_back(Segment.AsIoBuffer());
+			TotalAttachmentsSize += Segment.GetSize();
+		}
+	}
+
+	return std::move(ResponseBuffers);
+}
+
+CbPackage
+ParsePackageMessage(IoBuffer Payload, std::function<IoBuffer(const IoHash&, uint64_t)> CreateBuffer)
+{
+	if (!Payload)
+	{
+		return {};
+	}
+
+	MemoryInStream InStream(Payload);
+	BinaryReader   Reader(InStream);
+
+	CbPackage Package;
+
+	CbPackageHeader Hdr;
+	Reader.Read(&Hdr, sizeof Hdr);
+
+	if (Hdr.HeaderMagic != kCbPkgMagic)
+	{
+		// report error
+		return {};
+	}
+
+	uint32_t ChunkCount = Hdr.AttachmentCount + 1;
+
+	std::unique_ptr<CbAttachmentEntry[]> AttachmentEntries{new CbAttachmentEntry[ChunkCount]};
+
+	Reader.Read(AttachmentEntries.get(), sizeof(CbAttachmentEntry) * ChunkCount);
+
+	for (uint32_t i = 0; i < ChunkCount; ++i)
+	{
+		const CbAttachmentEntry& Entry			  = AttachmentEntries[i];
+		const uint64_t			 AttachmentSize	  = Entry.AttachmentSize;
+		IoBuffer				 AttachmentBuffer = CreateBuffer(Entry.AttachmentHash, AttachmentSize);
+
+		ZEN_ASSERT(AttachmentBuffer);
+		ZEN_ASSERT(AttachmentBuffer.Size() == AttachmentSize);
+
+		Reader.Read(AttachmentBuffer.MutableData(), AttachmentSize);
+
+		CompressedBuffer CompBuf(CompressedBuffer::FromCompressed(SharedBuffer(AttachmentBuffer)));
+
+		if (i == 0)
+		{
+			Package.SetObject(LoadCompactBinaryObject(std::move(CompBuf)));
+		}
+		else
+		{
+			CbAttachment Attachment(std::move(CompBuf));
+			Package.AddAttachment(Attachment);
+		}
+	}
+
+	return Package;
+}
+
+}  // namespace zen
\ No newline at end of file
diff --git a/zenhttp/httpshared.h b/zenhttp/httpshared.h
new file mode 100644
index 000000000..06fdb104f
--- /dev/null
+++ b/zenhttp/httpshared.h
@@ -0,0 +1,45 @@
+// Copyright Epic Games, Inc. All Rights Reserved.
+
+#pragma once
+
+#include <zencore/iobuffer.h>
+#include <zencore/iohash.h>
+
+#include <functional>
+
+namespace zen {
+
+class IoBuffer;
+class CbPackage;
+class CompositeBuffer;
+
+struct CbPackageHeader
+{
+	uint32_t HeaderMagic;
+	uint32_t AttachmentCount;
+	uint32_t Reserved1;
+	uint32_t Reserved2;
+};
+
+static_assert(sizeof(CbPackageHeader) == 16);
+
+static constinit uint32_t kCbPkgMagic = 0xaa77aacc;
+
+struct CbAttachmentEntry
+{
+	uint64_t AttachmentSize;
+	uint32_t Reserved1;
+	IoHash	 AttachmentHash;
+};
+
+static_assert(sizeof(CbAttachmentEntry) == 32);
+
+std::vector<IoBuffer> FormatPackageMessage(const CbPackage& Data);
+CompositeBuffer		  FormatPackageMessageBuffer(const CbPackage& Data);
+CbPackage			  ParsePackageMessage(
+				IoBuffer												  Payload,
+				std::function<IoBuffer(const IoHash& Cid, uint64_t Size)> CreateBuffer = [](const IoHash&, uint64_t Size) -> IoBuffer {
+		return IoBuffer{Size};
+				});
+
+}  // namespace zen
diff --git a/zenhttp/httpsys.cpp b/zenhttp/httpsys.cpp
new file mode 100644
index 000000000..9ee004c5c
--- /dev/null
+++ b/zenhttp/httpsys.cpp
@@ -0,0 +1,1431 @@
+// Copyright Epic Games, Inc. All Rights Reserved.
+
+#include "httpsys.h"
+
+#include "httpshared.h"
+
+#include <zencore/compactbinary.h>
+#include <zencore/compactbinarybuilder.h>
+#include <zencore/compactbinarypackage.h>
+#include <zencore/except.h>
+#include <zencore/logging.h>
+#include <zencore/scopeguard.h>
+#include <zencore/string.h>
+
+#if ZEN_WITH_HTTPSYS
+
+#	include <conio.h>
+#	include <mstcpip.h>
+#	pragma comment(lib, "httpapi.lib")
+
+std::wstring
+UTF8_to_wstring(const char* in)
+{
+	std::wstring out;
+	unsigned int codepoint;
+
+	while (*in != 0)
+	{
+		unsigned char ch = static_cast<unsigned char>(*in);
+
+		if (ch <= 0x7f)
+			codepoint = ch;
+		else if (ch <= 0xbf)
+			codepoint = (codepoint << 6) | (ch & 0x3f);
+		else if (ch <= 0xdf)
+			codepoint = ch & 0x1f;
+		else if (ch <= 0xef)
+			codepoint = ch & 0x0f;
+		else
+			codepoint = ch & 0x07;
+
+		++in;
+
+		if (((*in & 0xc0) != 0x80) && (codepoint <= 0x10ffff))
+		{
+			if (sizeof(wchar_t) > 2)
+			{
+				out.append(1, static_cast<wchar_t>(codepoint));
+			}
+			else if (codepoint > 0xffff)
+			{
+				out.append(1, static_cast<wchar_t>(0xd800 + (codepoint >> 10)));
+				out.append(1, static_cast<wchar_t>(0xdc00 + (codepoint & 0x03ff)));
+			}
+			else if (codepoint < 0xd800 || codepoint >= 0xe000)
+			{
+				out.append(1, static_cast<wchar_t>(codepoint));
+			}
+		}
+	}
+
+	return out;
+}
+
+namespace zen {
+
+using namespace std::literals;
+
+class HttpSysServer;
+class HttpSysTransaction;
+class HttpMessageResponseRequest;
+
+//////////////////////////////////////////////////////////////////////////
+
+HttpVerb
+TranslateHttpVerb(HTTP_VERB ReqVerb)
+{
+	switch (ReqVerb)
+	{
+		case HttpVerbOPTIONS:
+			return HttpVerb::kOptions;
+
+		case HttpVerbGET:
+			return HttpVerb::kGet;
+
+		case HttpVerbHEAD:
+			return HttpVerb::kHead;
+
+		case HttpVerbPOST:
+			return HttpVerb::kPost;
+
+		case HttpVerbPUT:
+			return HttpVerb::kPut;
+
+		case HttpVerbDELETE:
+			return HttpVerb::kDelete;
+
+		case HttpVerbCOPY:
+			return HttpVerb::kCopy;
+
+		default:
+			// TODO: invalid request?
+			return (HttpVerb)0;
+	}
+}
+
+uint64_t
+GetContentLength(const HTTP_REQUEST* HttpRequest)
+{
+	const HTTP_KNOWN_HEADER& clh = HttpRequest->Headers.KnownHeaders[HttpHeaderContentLength];
+	std::string_view		 cl(clh.pRawValue, clh.RawValueLength);
+	uint64_t				 ContentLength = 0;
+	std::from_chars(cl.data(), cl.data() + cl.size(), ContentLength);
+	return ContentLength;
+};
+
+HttpContentType
+GetContentType(const HTTP_REQUEST* HttpRequest)
+{
+	const HTTP_KNOWN_HEADER& CtHdr = HttpRequest->Headers.KnownHeaders[HttpHeaderContentType];
+	return ParseContentType({CtHdr.pRawValue, CtHdr.RawValueLength});
+};
+
+HttpContentType
+GetAcceptType(const HTTP_REQUEST* HttpRequest)
+{
+	const HTTP_KNOWN_HEADER& CtHdr = HttpRequest->Headers.KnownHeaders[HttpHeaderAccept];
+	return ParseContentType({CtHdr.pRawValue, CtHdr.RawValueLength});
+};
+
+/**
+ * @brief Base class for any pending or active HTTP transactions
+ */
+class HttpSysRequestHandler
+{
+public:
+	explicit HttpSysRequestHandler(HttpSysTransaction& InRequest) : m_Request(InRequest) {}
+	virtual ~HttpSysRequestHandler() = default;
+
+	virtual void				   IssueRequest(std::error_code& ErrorCode)								= 0;
+	virtual HttpSysRequestHandler* HandleCompletion(ULONG IoResult, ULONG_PTR NumberOfBytesTransferred) = 0;
+
+	HttpSysTransaction& Transaction() { return m_Request; }
+
+private:
+	HttpSysTransaction& m_Request;	// Related HTTP transaction object
+};
+
+/**
+ * This is the handler for the initial HTTP I/O request which will receive the headers
+ * and however much of the remaining payload might fit in the embedded request buffer.
+ *
+ * It is also used to receive any entity body data relating to the request
+ *
+ */
+struct InitialRequestHandler : public HttpSysRequestHandler
+{
+	inline HTTP_REQUEST* HttpRequest() { return (HTTP_REQUEST*)m_RequestBuffer; }
+	inline uint32_t		 RequestBufferSize() const { return sizeof m_RequestBuffer; }
+	inline bool			 IsInitialRequest() const { return m_IsInitialRequest; }
+
+	InitialRequestHandler(HttpSysTransaction& InRequest);
+	~InitialRequestHandler();
+
+	virtual void				   IssueRequest(std::error_code& ErrorCode) override final;
+	virtual HttpSysRequestHandler* HandleCompletion(ULONG IoResult, ULONG_PTR NumberOfBytesTransferred) override;
+
+	bool	 m_IsInitialRequest		= true;
+	uint64_t m_CurrentPayloadOffset = 0;
+	uint64_t m_ContentLength		= ~uint64_t(0);
+	IoBuffer m_PayloadBuffer;
+	UCHAR	 m_RequestBuffer[4096 + sizeof(HTTP_REQUEST)];
+};
+
+/**
+ * This is the class which request handlers use to interact with the server instance
+ */
+
+class HttpSysServerRequest : public HttpServerRequest
+{
+public:
+	HttpSysServerRequest(HttpSysTransaction& Tx, HttpService& Service, IoBuffer PayloadBuffer);
+	~HttpSysServerRequest() = default;
+
+	virtual Oid		 ParseSessionId() const override;
+	virtual uint32_t ParseRequestId() const override;
+
+	virtual IoBuffer ReadPayload() override;
+	virtual void	 WriteResponse(HttpResponseCode ResponseCode) override;
+	virtual void	 WriteResponse(HttpResponseCode ResponseCode, HttpContentType ContentType, std::span<IoBuffer> Blobs) override;
+	virtual void	 WriteResponse(HttpResponseCode ResponseCode, HttpContentType ContentType, std::u8string_view ResponseString) override;
+
+	using HttpServerRequest::WriteResponse;
+
+	HttpSysTransaction&			m_HttpTx;
+	HttpMessageResponseRequest* m_Response = nullptr;  // TODO: make this more general
+	IoBuffer					m_PayloadBuffer;
+};
+
+/** HTTP transaction
+
+	There will be an instance of this per pending and in-flight HTTP transaction
+
+  */
+class HttpSysTransaction final
+{
+public:
+	HttpSysTransaction(HttpSysServer& Server);
+	virtual ~HttpSysTransaction();
+
+	enum class Status
+	{
+		kDone,
+		kRequestPending
+	};
+
+	Status HandleCompletion(ULONG IoResult, ULONG_PTR NumberOfBytesTransferred);
+
+	static void __stdcall IoCompletionCallback(PTP_CALLBACK_INSTANCE Instance,
+											   PVOID				 pContext /* HttpSysServer */,
+											   PVOID				 pOverlapped,
+											   ULONG				 IoResult,
+											   ULONG_PTR			 NumberOfBytesTransferred,
+											   PTP_IO				 Io);
+
+	void				  IssueInitialRequest(std::error_code& ErrorCode);
+	PTP_IO				  Iocp();
+	HANDLE				  RequestQueueHandle();
+	inline OVERLAPPED*	  Overlapped() { return &m_HttpOverlapped; }
+	inline HttpSysServer& Server() { return m_HttpServer; }
+	inline HTTP_REQUEST*  HttpRequest() { return m_InitialHttpHandler.HttpRequest(); }
+
+	HttpSysServerRequest& InvokeRequestHandler(HttpService& Service, IoBuffer Payload);
+
+private:
+	OVERLAPPED	   m_HttpOverlapped{};
+	HttpSysServer& m_HttpServer;
+
+	// Tracks which handler is due to handle the next I/O completion event
+	HttpSysRequestHandler*				m_CompletionHandler = nullptr;
+	RwLock								m_CompletionMutex;
+	InitialRequestHandler				m_InitialHttpHandler{*this};
+	std::optional<HttpSysServerRequest> m_HandlerRequest;
+	Ref<IHttpPackageHandler>			m_PackageHandler;
+};
+
+//////////////////////////////////////////////////////////////////////////
+
+/**
+ * @brief HTTP request response I/O request handler
+ *
+ * Asynchronously streams out a response to an HTTP request via compound
+ * responses from memory or directly from file
+ */
+
+class HttpMessageResponseRequest : public HttpSysRequestHandler
+{
+public:
+	HttpMessageResponseRequest(HttpSysTransaction& InRequest, uint16_t ResponseCode);
+	HttpMessageResponseRequest(HttpSysTransaction& InRequest, uint16_t ResponseCode, std::string_view Message);
+	HttpMessageResponseRequest(HttpSysTransaction& InRequest,
+							   uint16_t			   ResponseCode,
+							   HttpContentType	   ContentType,
+							   const void*		   Payload,
+							   size_t			   PayloadSize);
+	HttpMessageResponseRequest(HttpSysTransaction& InRequest,
+							   uint16_t			   ResponseCode,
+							   HttpContentType	   ContentType,
+							   std::span<IoBuffer> Blobs);
+	~HttpMessageResponseRequest();
+
+	virtual void				   IssueRequest(std::error_code& ErrorCode) override final;
+	virtual HttpSysRequestHandler* HandleCompletion(ULONG IoResult, ULONG_PTR NumberOfBytesTransferred) override;
+	void						   SuppressResponseBody();	// typically used for HEAD requests
+
+private:
+	std::vector<HTTP_DATA_CHUNK> m_HttpDataChunks;
+	uint64_t					 m_TotalDataSize	   = 0;	 // Sum of all chunk sizes
+	uint16_t					 m_ResponseCode		   = 0;
+	uint32_t					 m_NextDataChunkOffset = 0;	 // Cursor used for very large chunk lists
+	uint32_t					 m_RemainingChunkCount = 0;	 // Backlog for multi-call sends
+	bool						 m_IsInitialResponse   = true;
+	HttpContentType				 m_ContentType		   = HttpContentType::kBinary;
+	std::vector<IoBuffer>		 m_DataBuffers;
+
+	void InitializeForPayload(uint16_t ResponseCode, std::span<IoBuffer> Blobs);
+};
+
+HttpMessageResponseRequest::HttpMessageResponseRequest(HttpSysTransaction& InRequest, uint16_t ResponseCode)
+: HttpSysRequestHandler(InRequest)
+{
+	std::array<IoBuffer, 0> EmptyBufferList;
+
+	InitializeForPayload(ResponseCode, EmptyBufferList);
+}
+
+HttpMessageResponseRequest::HttpMessageResponseRequest(HttpSysTransaction& InRequest, uint16_t ResponseCode, std::string_view Message)
+: HttpSysRequestHandler(InRequest)
+, m_ContentType(HttpContentType::kText)
+{
+	IoBuffer				MessageBuffer(IoBuffer::Wrap, Message.data(), Message.size());
+	std::array<IoBuffer, 1> SingleBufferList({MessageBuffer});
+
+	InitializeForPayload(ResponseCode, SingleBufferList);
+}
+
+HttpMessageResponseRequest::HttpMessageResponseRequest(HttpSysTransaction& InRequest,
+													   uint16_t			   ResponseCode,
+													   HttpContentType	   ContentType,
+													   const void*		   Payload,
+													   size_t			   PayloadSize)
+: HttpSysRequestHandler(InRequest)
+, m_ContentType(ContentType)
+{
+	IoBuffer				MessageBuffer(IoBuffer::Wrap, Payload, PayloadSize);
+	std::array<IoBuffer, 1> SingleBufferList({MessageBuffer});
+
+	InitializeForPayload(ResponseCode, SingleBufferList);
+}
+
+HttpMessageResponseRequest::HttpMessageResponseRequest(HttpSysTransaction& InRequest,
+													   uint16_t			   ResponseCode,
+													   HttpContentType	   ContentType,
+													   std::span<IoBuffer> BlobList)
+: HttpSysRequestHandler(InRequest)
+, m_ContentType(ContentType)
+{
+	InitializeForPayload(ResponseCode, BlobList);
+}
+
+HttpMessageResponseRequest::~HttpMessageResponseRequest()
+{
+}
+
+void
+HttpMessageResponseRequest::InitializeForPayload(uint16_t ResponseCode, std::span<IoBuffer> BlobList)
+{
+	m_ResponseCode = ResponseCode;
+
+	const uint32_t ChunkCount = gsl::narrow<uint32_t>(BlobList.size());
+
+	m_HttpDataChunks.reserve(ChunkCount);
+	m_DataBuffers.reserve(ChunkCount);
+
+	for (IoBuffer& Buffer : BlobList)
+	{
+		m_DataBuffers.emplace_back(std::move(Buffer)).MakeOwned();
+	}
+
+	// Initialize the full array up front
+
+	uint64_t LocalDataSize = 0;
+
+	for (IoBuffer& Buffer : m_DataBuffers)
+	{
+		uint64_t BufferDataSize = Buffer.Size();
+
+		ZEN_ASSERT(BufferDataSize);
+
+		LocalDataSize += BufferDataSize;
+
+		IoBufferFileReference FileRef;
+		if (Buffer.GetFileReference(/* out */ FileRef))
+		{
+			// Use direct file transfer
+
+			m_HttpDataChunks.push_back({});
+			auto& Chunk = m_HttpDataChunks.back();
+
+			Chunk.DataChunkType									   = HttpDataChunkFromFileHandle;
+			Chunk.FromFileHandle.FileHandle						   = FileRef.FileHandle;
+			Chunk.FromFileHandle.ByteRange.StartingOffset.QuadPart = FileRef.FileChunkOffset;
+			Chunk.FromFileHandle.ByteRange.Length.QuadPart		   = BufferDataSize;
+		}
+		else
+		{
+			// Send from memory, need to make sure we chunk the buffer up since
+			// the underlying data structure only accepts 32-bit chunk sizes for
+			// memory chunks. When this happens the vector will be reallocated,
+			// which is fine since this will be a pretty rare case and sending
+			// the data is going to take a lot longer than a memory allocation :)
+
+			const uint8_t* WriteCursor = reinterpret_cast<const uint8_t*>(Buffer.Data());
+
+			while (BufferDataSize)
+			{
+				const ULONG ThisChunkSize = gsl::narrow<ULONG>(zen::Min(1 * 1024 * 1024 * 1024, BufferDataSize));
+
+				m_HttpDataChunks.push_back({});
+				auto& Chunk = m_HttpDataChunks.back();
+
+				Chunk.DataChunkType			  = HttpDataChunkFromMemory;
+				Chunk.FromMemory.pBuffer	  = (void*)WriteCursor;
+				Chunk.FromMemory.BufferLength = ThisChunkSize;
+
+				BufferDataSize -= ThisChunkSize;
+				WriteCursor += ThisChunkSize;
+			}
+		}
+	}
+
+	m_RemainingChunkCount = gsl::narrow<uint32_t>(m_HttpDataChunks.size());
+	m_TotalDataSize		  = LocalDataSize;
+}
+
+void
+HttpMessageResponseRequest::SuppressResponseBody()
+{
+	m_RemainingChunkCount = 0;
+	m_HttpDataChunks.clear();
+	m_DataBuffers.clear();
+}
+
+HttpSysRequestHandler*
+HttpMessageResponseRequest::HandleCompletion(ULONG IoResult, ULONG_PTR NumberOfBytesTransferred)
+{
+	ZEN_UNUSED(NumberOfBytesTransferred);
+
+	if (IoResult)
+	{
+		spdlog::warn("response aborted due to error: '{}'", GetWindowsErrorAsString(IoResult));
+
+		// if one transmit failed there's really no need to go on
+		return nullptr;
+	}
+
+	if (m_RemainingChunkCount == 0)
+	{
+		return nullptr;	 // All done
+	}
+
+	return this;
+}
+
+void
+HttpMessageResponseRequest::IssueRequest(std::error_code& ErrorCode)
+{
+	HttpSysTransaction& Tx		= Transaction();
+	HTTP_REQUEST* const HttpReq = Tx.HttpRequest();
+	PTP_IO const		Iocp	= Tx.Iocp();
+
+	StartThreadpoolIo(Iocp);
+
+	// Split payload into batches to play well with the underlying API
+
+	const int MaxChunksPerCall = 9999;
+
+	const int ThisRequestChunkCount	 = std::min<int>(m_RemainingChunkCount, MaxChunksPerCall);
+	const int ThisRequestChunkOffset = m_NextDataChunkOffset;
+
+	m_RemainingChunkCount -= ThisRequestChunkCount;
+	m_NextDataChunkOffset += ThisRequestChunkCount;
+
+	/* Should this code also use HTTP_SEND_RESPONSE_FLAG_BUFFER_DATA?
+
+		From the docs:
+
+		This flag enables buffering of data in the kernel on a per-response basis. It should
+		be used by an application doing synchronous I/O, or by a an application doing
+		asynchronous I/O with no more than one send outstanding at a time.
+
+		Applications using asynchronous I/O which may have more than one send outstanding at
+		a time should not use this flag.
+
+		When this flag is set, it should be used consistently in calls to the
+		HttpSendHttpResponse function as well.
+	 */
+
+	ULONG SendFlags = 0;
+
+	if (m_RemainingChunkCount)
+	{
+		// We need to make more calls to send the full amount of data
+		SendFlags |= HTTP_SEND_RESPONSE_FLAG_MORE_DATA;
+	}
+
+	ULONG SendResult = 0;
+
+	if (m_IsInitialResponse)
+	{
+		// Populate response structure
+
+		HTTP_RESPONSE HttpResponse = {};
+
+		HttpResponse.EntityChunkCount = USHORT(ThisRequestChunkCount);
+		HttpResponse.pEntityChunks	  = m_HttpDataChunks.data() + ThisRequestChunkOffset;
+
+		// Content-length header
+
+		char ContentLengthString[32];
+		_ui64toa_s(m_TotalDataSize, ContentLengthString, sizeof ContentLengthString, 10);
+
+		PHTTP_KNOWN_HEADER ContentLengthHeader = &HttpResponse.Headers.KnownHeaders[HttpHeaderContentLength];
+		ContentLengthHeader->pRawValue		   = ContentLengthString;
+		ContentLengthHeader->RawValueLength	   = (USHORT)strlen(ContentLengthString);
+
+		// Content-type header
+
+		PHTTP_KNOWN_HEADER ContentTypeHeader = &HttpResponse.Headers.KnownHeaders[HttpHeaderContentType];
+
+		std::string_view ContentTypeString = MapContentTypeToString(m_ContentType);
+
+		ContentTypeHeader->pRawValue	  = ContentTypeString.data();
+		ContentTypeHeader->RawValueLength = (USHORT)ContentTypeString.size();
+
+		HttpResponse.StatusCode	  = m_ResponseCode;
+		HttpResponse.pReason	  = ReasonStringForHttpResultCode(m_ResponseCode);
+		HttpResponse.ReasonLength = (USHORT)strlen(HttpResponse.pReason);
+
+		// Cache policy
+
+		HTTP_CACHE_POLICY CachePolicy;
+
+		CachePolicy.Policy		  = HttpCachePolicyNocache;	 //  HttpCachePolicyUserInvalidates;
+		CachePolicy.SecondsToLive = 0;
+
+		// Initial response API call
+
+		SendResult = HttpSendHttpResponse(Tx.RequestQueueHandle(),
+										  HttpReq->RequestId,
+										  SendFlags,
+										  &HttpResponse,
+										  &CachePolicy,
+										  NULL,
+										  NULL,
+										  0,
+										  Tx.Overlapped(),
+										  NULL);
+
+		m_IsInitialResponse = false;
+	}
+	else
+	{
+		// Subsequent response API calls
+
+		SendResult = HttpSendResponseEntityBody(Tx.RequestQueueHandle(),
+												HttpReq->RequestId,
+												SendFlags,
+												(USHORT)ThisRequestChunkCount,				// EntityChunkCount
+												&m_HttpDataChunks[ThisRequestChunkOffset],	// EntityChunks
+												NULL,										// BytesSent
+												NULL,										// Reserved1
+												0,											// Reserved2
+												Tx.Overlapped(),							// Overlapped
+												NULL										// LogData
+		);
+	}
+
+	if ((SendResult != NO_ERROR)			 // Synchronous completion, but the completion event will still be posted to IOCP
+		&& (SendResult != ERROR_IO_PENDING)	 // Asynchronous completion
+	)
+	{
+		// Some error occurred, no completion will be posted
+
+		CancelThreadpoolIo(Iocp);
+
+		spdlog::error("failed to send HTTP response (error: '{}'), request URL: {}"sv, SendResult, HttpReq->pRawUrl);
+
+		ErrorCode = MakeWin32ErrorCode(SendResult);
+	}
+	else
+	{
+		ErrorCode = {};
+	}
+}
+
+/**
+			  _________
+			 /   _____/ ______________  __ ___________
+			 \_____  \_/ __ \_  __ \  \/ // __ \_  __ \
+			 /        \  ___/|  | \/\   /\  ___/|  | \/
+			/_______  /\___  >__|    \_/  \___  >__|
+					\/     \/                 \/
+*/
+
+HttpSysServer::HttpSysServer(unsigned int ThreadCount) : m_ThreadPool(ThreadCount)
+{
+	ULONG Result = HttpInitialize(HTTPAPI_VERSION_2, HTTP_INITIALIZE_SERVER, nullptr);
+
+	if (Result != NO_ERROR)
+	{
+		return;
+	}
+
+	m_IsHttpInitialized = true;
+	m_IsOk				= true;
+}
+
+HttpSysServer::~HttpSysServer()
+{
+	if (m_IsHttpInitialized)
+	{
+		Cleanup();
+
+		HttpTerminate(HTTP_INITIALIZE_SERVER, nullptr);
+	}
+}
+
+void
+HttpSysServer::Initialize(const wchar_t* UrlPath)
+{
+	m_IsOk = false;
+
+	ULONG Result = HttpCreateServerSession(HTTPAPI_VERSION_2, &m_HttpSessionId, 0);
+
+	if (Result != NO_ERROR)
+	{
+		spdlog::error("Failed to create server session for '{}': {x}"sv, WideToUtf8(UrlPath), Result);
+
+		return;
+	}
+
+	Result = HttpCreateUrlGroup(m_HttpSessionId, &m_HttpUrlGroupId, 0);
+
+	if (Result != NO_ERROR)
+	{
+		spdlog::error("Failed to create URL group for '{}': {x}"sv, WideToUtf8(UrlPath), Result);
+
+		return;
+	}
+
+	m_BaseUri = UrlPath;
+
+	Result = HttpAddUrlToUrlGroup(m_HttpUrlGroupId, UrlPath, HTTP_URL_CONTEXT(0), 0);
+
+	if (Result != NO_ERROR)
+	{
+		spdlog::error("Failed to add base URL to URL group for '{}': {x}"sv, WideToUtf8(UrlPath), Result);
+
+		return;
+	}
+
+	HTTP_BINDING_INFO HttpBindingInfo = {{0}, 0};
+
+	Result = HttpCreateRequestQueue(HTTPAPI_VERSION_2,
+									/* Name */ nullptr,
+									/* SecurityAttributes */ nullptr,
+									/* Flags */ 0,
+									&m_RequestQueueHandle);
+
+	if (Result != NO_ERROR)
+	{
+		spdlog::error("Failed to create request queue for '{}': {x}"sv, WideToUtf8(UrlPath), Result);
+
+		return;
+	}
+
+	HttpBindingInfo.Flags.Present	   = 1;
+	HttpBindingInfo.RequestQueueHandle = m_RequestQueueHandle;
+
+	Result = HttpSetUrlGroupProperty(m_HttpUrlGroupId, HttpServerBindingProperty, &HttpBindingInfo, sizeof(HttpBindingInfo));
+
+	if (Result != NO_ERROR)
+	{
+		spdlog::error("Failed to set server binding property for '{}': {x}"sv, WideToUtf8(UrlPath), Result);
+
+		return;
+	}
+
+	// Create I/O completion port
+
+	std::error_code ErrorCode;
+	m_ThreadPool.CreateIocp(m_RequestQueueHandle, HttpSysTransaction::IoCompletionCallback, /* Context */ this, /* out */ ErrorCode);
+
+	if (ErrorCode)
+	{
+		spdlog::error("Failed to create IOCP for '{}': {}"sv, WideToUtf8(UrlPath), ErrorCode.message());
+	}
+	else
+	{
+		m_IsOk = true;
+	}
+}
+
+void
+HttpSysServer::Cleanup()
+{
+	++m_IsShuttingDown;
+
+	if (m_RequestQueueHandle)
+	{
+		HttpCloseRequestQueue(m_RequestQueueHandle);
+		m_RequestQueueHandle = nullptr;
+	}
+
+	if (m_HttpUrlGroupId)
+	{
+		HttpCloseUrlGroup(m_HttpUrlGroupId);
+		m_HttpUrlGroupId = 0;
+	}
+
+	if (m_HttpSessionId)
+	{
+		HttpCloseServerSession(m_HttpSessionId);
+		m_HttpSessionId = 0;
+	}
+}
+
+void
+HttpSysServer::StartServer()
+{
+	const int InitialRequestCount = 32;
+
+	for (int i = 0; i < InitialRequestCount; ++i)
+	{
+		IssueNewRequestMaybe();
+	}
+}
+
+void
+HttpSysServer::Run(bool TestMode)
+{
+	if (TestMode == false)
+	{
+		zen::logging::ConsoleLog().info("Zen Server running. Press ESC or Q to quit");
+	}
+
+	do
+	{
+		int WaitTimeout = -1;
+
+		if (!TestMode)
+		{
+			WaitTimeout = 1000;
+		}
+
+		if (!TestMode && _kbhit() != 0)
+		{
+			char c = (char)_getch();
+
+			if (c == 27 || c == 'Q' || c == 'q')
+			{
+				RequestApplicationExit(0);
+			}
+		}
+
+		m_ShutdownEvent.Wait(WaitTimeout);
+	} while (!IsApplicationExitRequested());
+}
+
+void
+HttpSysServer::OnHandlingRequest()
+{
+	if (--m_PendingRequests > m_MinPendingRequests)
+	{
+		// We have more than the minimum number of requests pending, just let someone else
+		// enqueue new requests
+		return;
+	}
+
+	IssueNewRequestMaybe();
+}
+
+void
+HttpSysServer::IssueNewRequestMaybe()
+{
+	if (m_IsShuttingDown.load(std::memory_order::acquire))
+	{
+		return;
+	}
+
+	if (m_PendingRequests.load(std::memory_order::relaxed) >= m_MaxPendingRequests)
+	{
+		return;
+	}
+
+	std::unique_ptr<HttpSysTransaction> Request = std::make_unique<HttpSysTransaction>(*this);
+
+	std::error_code ErrorCode;
+	Request->IssueInitialRequest(ErrorCode);
+
+	if (ErrorCode)
+	{
+		// No request was actually issued. What is the appropriate response?
+
+		return;
+	}
+
+	// This may end up exceeding the MaxPendingRequests limit, but it's not
+	// really a problem. I'm doing it this way mostly to avoid dealing with
+	// exceptions here
+	++m_PendingRequests;
+
+	Request.release();
+}
+
+void
+HttpSysServer::RegisterService(const char* UrlPath, HttpService& Service)
+{
+	if (UrlPath[0] == '/')
+	{
+		++UrlPath;
+	}
+
+	const std::wstring Path16 = UTF8_to_wstring(UrlPath);
+	Service.SetUriPrefixLength(Path16.size() + 1 /* leading slash */);
+
+	// Convert to wide string
+
+	std::wstring Url16 = m_BaseUri + Path16;
+
+	ULONG Result = HttpAddUrlToUrlGroup(m_HttpUrlGroupId, Url16.c_str(), HTTP_URL_CONTEXT(&Service), 0 /* Reserved */);
+
+	if (Result != NO_ERROR)
+	{
+		spdlog::error("HttpAddUrlToUrlGroup failed with result {}"sv, Result);
+
+		return;
+	}
+}
+
+void
+HttpSysServer::UnregisterService(const char* UrlPath, HttpService& Service)
+{
+	ZEN_UNUSED(Service);
+
+	if (UrlPath[0] == '/')
+	{
+		++UrlPath;
+	}
+
+	const std::wstring Path16 = UTF8_to_wstring(UrlPath);
+
+	// Convert to wide string
+
+	std::wstring Url16 = m_BaseUri + Path16;
+
+	ULONG Result = HttpRemoveUrlFromUrlGroup(m_HttpUrlGroupId, Url16.c_str(), 0);
+
+	if (Result != NO_ERROR)
+	{
+		spdlog::error("HttpRemoveUrlFromUrlGroup failed with result {}"sv, Result);
+	}
+}
+
+//////////////////////////////////////////////////////////////////////////
+
+HttpSysTransaction::HttpSysTransaction(HttpSysServer& Server) : m_HttpServer(Server), m_CompletionHandler(&m_InitialHttpHandler)
+{
+}
+
+HttpSysTransaction::~HttpSysTransaction()
+{
+}
+
+PTP_IO
+HttpSysTransaction::Iocp()
+{
+	return m_HttpServer.m_ThreadPool.Iocp();
+}
+
+HANDLE
+HttpSysTransaction::RequestQueueHandle()
+{
+	return m_HttpServer.m_RequestQueueHandle;
+}
+
+void
+HttpSysTransaction::IssueInitialRequest(std::error_code& ErrorCode)
+{
+	m_InitialHttpHandler.IssueRequest(ErrorCode);
+}
+
+void
+HttpSysTransaction::IoCompletionCallback(PTP_CALLBACK_INSTANCE Instance,
+										 PVOID				   pContext /* HttpSysServer */,
+										 PVOID				   pOverlapped,
+										 ULONG				   IoResult,
+										 ULONG_PTR			   NumberOfBytesTransferred,
+										 PTP_IO				   Io)
+{
+	UNREFERENCED_PARAMETER(Io);
+	UNREFERENCED_PARAMETER(Instance);
+	UNREFERENCED_PARAMETER(pContext);
+
+	// Note that for a given transaction we may be in this completion function on more
+	// than one thread at any given moment. This means we need to be careful about what
+	// happens in here
+
+	HttpSysTransaction* Transaction = CONTAINING_RECORD(pOverlapped, HttpSysTransaction, m_HttpOverlapped);
+
+	if (Transaction->HandleCompletion(IoResult, NumberOfBytesTransferred) == HttpSysTransaction::Status::kDone)
+	{
+		delete Transaction;
+	}
+}
+
+HttpSysTransaction::Status
+HttpSysTransaction::HandleCompletion(ULONG IoResult, ULONG_PTR NumberOfBytesTransferred)
+{
+	// We use this to ensure sequential execution of completion handlers
+	// for any given transaction. It also ensures all member variables are
+	// in a consistent state for the current thread
+
+	RwLock::ExclusiveLockScope _(m_CompletionMutex);
+
+	bool IsRequestPending = false;
+
+	if (HttpSysRequestHandler* CurrentHandler = m_CompletionHandler)
+	{
+		const bool IsInitialRequest = (CurrentHandler == &m_InitialHttpHandler) && m_InitialHttpHandler.IsInitialRequest();
+
+		if (IsInitialRequest)
+		{
+			// Ensure we have a sufficient number of pending requests outstanding
+			m_HttpServer.OnHandlingRequest();
+		}
+
+		m_CompletionHandler = CurrentHandler->HandleCompletion(IoResult, NumberOfBytesTransferred);
+
+		if (m_CompletionHandler)
+		{
+			try
+			{
+				std::error_code ErrorCode;
+				m_CompletionHandler->IssueRequest(ErrorCode);
+
+				if (ErrorCode)
+				{
+					spdlog::error("IssueRequest() failed {}"sv, ErrorCode.message());
+				}
+				else
+				{
+					IsRequestPending = true;
+				}
+			}
+			catch (std::exception& Ex)
+			{
+				spdlog::error("exception caught from IssueRequest(): {}"sv, Ex.what());
+
+				// something went wrong, no request is pending
+			}
+		}
+		else
+		{
+			if (IsInitialRequest == false)
+			{
+				delete CurrentHandler;
+			}
+		}
+	}
+
+	// Ensure new requests are enqueued as necessary
+	m_HttpServer.IssueNewRequestMaybe();
+
+	if (IsRequestPending)
+	{
+		// There is another request pending on this transaction, so it needs to remain valid
+		return Status::kRequestPending;
+	}
+
+	// Transaction done, caller should clean up (delete) this instance
+	return Status::kDone;
+}
+
+HttpSysServerRequest&
+HttpSysTransaction::InvokeRequestHandler(HttpService& Service, IoBuffer Payload)
+{
+	HttpSysServerRequest& ThisRequest = m_HandlerRequest.emplace(*this, Service, Payload);
+
+	if (ThisRequest.RequestVerb() == HttpVerb::kPost)
+	{
+		if (ThisRequest.RequestContentType() == HttpContentType::kCbPackageOffer)
+		{
+			// The client is presenting us with a package attachments offer, we need
+			// to filter it down to the list of attachments we need them to send in
+			// the follow-up request
+
+			m_PackageHandler = Service.HandlePackageRequest(ThisRequest);
+
+			if (m_PackageHandler)
+			{
+				CbObject OfferMessage = LoadCompactBinaryObject(Payload);
+
+				std::vector<IoHash> OfferCids;
+
+				for (auto& CidEntry : OfferMessage["offer"])
+				{
+					if (!CidEntry.IsHash())
+					{
+						// Should yield bad request response?
+
+						continue;
+					}
+
+					OfferCids.push_back(CidEntry.AsHash(IoHash::Zero));
+				}
+
+				m_PackageHandler->FilterOffer(OfferCids);
+
+				CbObjectWriter ResponseWriter;
+				ResponseWriter.BeginArray("need");
+
+				for (const IoHash& Cid : OfferCids)
+				{
+					ResponseWriter.AddHash(Cid);
+				}
+
+				ResponseWriter.EndArray();
+
+				// Emit filter response
+				ThisRequest.WriteResponse(HttpResponseCode::OK, ResponseWriter.Save());
+
+				return ThisRequest;
+			}
+		}
+		else if (ThisRequest.RequestContentType() == HttpContentType::kCbPackage)
+		{
+			// Process chunks in package request
+
+			m_PackageHandler = Service.HandlePackageRequest(ThisRequest);
+
+			// TODO: this should really be done in a streaming fashion, currently this emulates
+			// the intended flow from an API perspective
+
+			if (m_PackageHandler)
+			{
+				m_PackageHandler->OnRequestBegin();
+
+				auto CreateBuffer = [&](const IoHash& Cid, uint64_t Size) -> IoBuffer { return m_PackageHandler->CreateTarget(Cid, Size); };
+
+				CbPackage Package = ParsePackageMessage(ThisRequest.ReadPayload(), CreateBuffer);
+
+				m_PackageHandler->OnRequestComplete();
+			}
+		}
+	}
+
+	// Default request handling
+
+	Service.HandleRequest(ThisRequest);
+
+	return ThisRequest;
+}
+
+//////////////////////////////////////////////////////////////////////////
+
+HttpSysServerRequest::HttpSysServerRequest(HttpSysTransaction& Tx, HttpService& Service, IoBuffer PayloadBuffer)
+: m_HttpTx(Tx)
+, m_PayloadBuffer(std::move(PayloadBuffer))
+{
+	const HTTP_REQUEST* HttpRequestPtr = Tx.HttpRequest();
+
+	const int PrefixLength	= Service.UriPrefixLength();
+	const int AbsPathLength = HttpRequestPtr->CookedUrl.AbsPathLength / sizeof(char16_t);
+
+	if (AbsPathLength >= PrefixLength)
+	{
+		// We convert the URI immediately because most of the code involved prefers to deal
+		// with utf8. This has some performance impact which I'd prefer to avoid but for now
+		// we just have to live with it
+
+		WideToUtf8({(char16_t*)HttpRequestPtr->CookedUrl.pAbsPath + PrefixLength, gsl::narrow<size_t>(AbsPathLength - PrefixLength)},
+				   m_UriUtf8);
+	}
+	else
+	{
+		m_UriUtf8.Reset();
+	}
+
+	if (auto QueryStringLength = HttpRequestPtr->CookedUrl.QueryStringLength)
+	{
+		--QueryStringLength;
+
+		WideToUtf8({(char16_t*)(HttpRequestPtr->CookedUrl.pQueryString) + 1, QueryStringLength / sizeof(char16_t)}, m_QueryStringUtf8);
+	}
+	else
+	{
+		m_QueryStringUtf8.Reset();
+	}
+
+	m_Verb			= TranslateHttpVerb(HttpRequestPtr->Verb);
+	m_ContentLength = GetContentLength(HttpRequestPtr);
+	m_ContentType	= GetContentType(HttpRequestPtr);
+	m_AcceptType	= GetAcceptType(HttpRequestPtr);
+}
+
+Oid
+HttpSysServerRequest::ParseSessionId() const
+{
+	const HTTP_REQUEST* HttpRequestPtr = m_HttpTx.HttpRequest();
+
+	for (int i = 0; i < HttpRequestPtr->Headers.UnknownHeaderCount; ++i)
+	{
+		HTTP_UNKNOWN_HEADER& Header = HttpRequestPtr->Headers.pUnknownHeaders[i];
+		std::string_view	 HeaderName{Header.pName, Header.NameLength};
+
+		if (HeaderName == "UE-Session"sv)
+		{
+			if (Header.RawValueLength == Oid::StringLength)
+			{
+				return Oid::FromHexString({Header.pRawValue, Header.RawValueLength});
+			}
+		}
+	}
+
+	return {};
+}
+
+uint32_t
+HttpSysServerRequest::ParseRequestId() const
+{
+	const HTTP_REQUEST* HttpRequestPtr = m_HttpTx.HttpRequest();
+
+	for (int i = 0; i < HttpRequestPtr->Headers.UnknownHeaderCount; ++i)
+	{
+		HTTP_UNKNOWN_HEADER& Header = HttpRequestPtr->Headers.pUnknownHeaders[i];
+		std::string_view	 HeaderName{Header.pName, Header.NameLength};
+
+		if (HeaderName == "UE-Request"sv)
+		{
+			std::string_view RequestValue{Header.pRawValue, Header.RawValueLength};
+			uint32_t		 RequestId = 0;
+			std::from_chars(RequestValue.data(), RequestValue.data() + RequestValue.size(), RequestId);
+			return RequestId;
+		}
+	}
+
+	return 0;
+}
+
+IoBuffer
+HttpSysServerRequest::ReadPayload()
+{
+	return m_PayloadBuffer;
+}
+
+void
+HttpSysServerRequest::WriteResponse(HttpResponseCode ResponseCode)
+{
+	ZEN_ASSERT(IsHandled() == false);
+
+	m_Response = new HttpMessageResponseRequest(m_HttpTx, (uint16_t)ResponseCode);
+
+	if (SuppressBody())
+	{
+		m_Response->SuppressResponseBody();
+	}
+
+	SetIsHandled();
+}
+
+void
+HttpSysServerRequest::WriteResponse(HttpResponseCode ResponseCode, HttpContentType ContentType, std::span<IoBuffer> Blobs)
+{
+	ZEN_ASSERT(IsHandled() == false);
+
+	m_Response = new HttpMessageResponseRequest(m_HttpTx, (uint16_t)ResponseCode, ContentType, Blobs);
+
+	if (SuppressBody())
+	{
+		m_Response->SuppressResponseBody();
+	}
+
+	SetIsHandled();
+}
+
+void
+HttpSysServerRequest::WriteResponse(HttpResponseCode ResponseCode, HttpContentType ContentType, std::u8string_view ResponseString)
+{
+	ZEN_ASSERT(IsHandled() == false);
+
+	m_Response =
+		new HttpMessageResponseRequest(m_HttpTx, (uint16_t)ResponseCode, ContentType, ResponseString.data(), ResponseString.size());
+
+	if (SuppressBody())
+	{
+		m_Response->SuppressResponseBody();
+	}
+
+	SetIsHandled();
+}
+
+//////////////////////////////////////////////////////////////////////////
+
+InitialRequestHandler::InitialRequestHandler(HttpSysTransaction& InRequest) : HttpSysRequestHandler(InRequest)
+{
+}
+
+InitialRequestHandler::~InitialRequestHandler()
+{
+}
+
+void
+InitialRequestHandler::IssueRequest(std::error_code& ErrorCode)
+{
+	HttpSysTransaction& Tx		= Transaction();
+	PTP_IO				Iocp	= Tx.Iocp();
+	HTTP_REQUEST*		HttpReq = Tx.HttpRequest();
+
+	StartThreadpoolIo(Iocp);
+
+	ULONG HttpApiResult;
+
+	if (IsInitialRequest())
+	{
+		HttpApiResult = HttpReceiveHttpRequest(Tx.RequestQueueHandle(),
+											   HTTP_NULL_ID,
+											   HTTP_RECEIVE_REQUEST_FLAG_COPY_BODY,
+											   HttpReq,
+											   RequestBufferSize(),
+											   NULL,
+											   Tx.Overlapped());
+	}
+	else
+	{
+		// The http.sys team recommends limiting the size to 128KB
+		static const uint64_t kMaxBytesPerApiCall = 128 * 1024;
+
+		uint64_t	   BytesToRead		   = m_ContentLength - m_CurrentPayloadOffset;
+		const uint64_t BytesToReadThisCall = zen::Min(BytesToRead, kMaxBytesPerApiCall);
+		void*		   BufferWriteCursor   = reinterpret_cast<uint8_t*>(m_PayloadBuffer.MutableData()) + m_CurrentPayloadOffset;
+
+		HttpApiResult = HttpReceiveRequestEntityBody(Tx.RequestQueueHandle(),
+													 HttpReq->RequestId,
+													 0, /* Flags */
+													 BufferWriteCursor,
+													 gsl::narrow<ULONG>(BytesToReadThisCall),
+													 nullptr,  // BytesReturned
+													 Tx.Overlapped());
+	}
+
+	if (HttpApiResult != ERROR_IO_PENDING && HttpApiResult != NO_ERROR)
+	{
+		CancelThreadpoolIo(Iocp);
+
+		if (HttpApiResult == ERROR_MORE_DATA)
+		{
+			// ProcessReceiveAndPostResponse(pIoRequest, pServerContext->Io, ERROR_MORE_DATA);
+		}
+
+		// CleanupHttpIoRequest(pIoRequest);
+
+		ErrorCode = MakeWin32ErrorCode(HttpApiResult);
+
+		spdlog::error("HttpReceiveHttpRequest failed, error {}", ErrorCode.message());
+
+		return;
+	}
+
+	ErrorCode = std::error_code();
+}
+
+HttpSysRequestHandler*
+InitialRequestHandler::HandleCompletion(ULONG IoResult, ULONG_PTR NumberOfBytesTransferred)
+{
+	auto _ = MakeGuard([&] { m_IsInitialRequest = false; });
+
+	switch (IoResult)
+	{
+		case ERROR_OPERATION_ABORTED:
+			return nullptr;
+
+		case ERROR_MORE_DATA:
+			// Insufficient buffer space
+			break;
+	}
+
+	// Route requests
+
+	try
+	{
+		HTTP_REQUEST* HttpReq = HttpRequest();
+
+#	if 0
+		for (int i = 0; i < HttpReq->RequestInfoCount; ++i)
+		{
+			auto& ReqInfo = HttpReq->pRequestInfo[i];
+
+			switch (ReqInfo.InfoType)
+			{
+				case HttpRequestInfoTypeRequestTiming:
+					{
+						const HTTP_REQUEST_TIMING_INFO* TimingInfo = reinterpret_cast<HTTP_REQUEST_TIMING_INFO*>(ReqInfo.pInfo);
+
+						spdlog::info("");
+					}
+					break;
+				case HttpRequestInfoTypeAuth:
+					spdlog::info("");
+					break;
+				case HttpRequestInfoTypeChannelBind:
+					spdlog::info("");
+					break;
+				case HttpRequestInfoTypeSslProtocol:
+					spdlog::info("");
+					break;
+				case HttpRequestInfoTypeSslTokenBindingDraft:
+					spdlog::info("");
+					break;
+				case HttpRequestInfoTypeSslTokenBinding:
+					spdlog::info("");
+					break;
+				case HttpRequestInfoTypeTcpInfoV0:
+					{
+						const TCP_INFO_v0* TcpInfo = reinterpret_cast<const TCP_INFO_v0*>(ReqInfo.pInfo);
+
+						spdlog::info("");
+					}
+					break;
+				case HttpRequestInfoTypeRequestSizing:
+					{
+						const HTTP_REQUEST_SIZING_INFO* SizingInfo = reinterpret_cast<const HTTP_REQUEST_SIZING_INFO*>(ReqInfo.pInfo);
+						spdlog::info("");
+					}
+					break;
+				case HttpRequestInfoTypeQuicStats:
+					spdlog::info("");
+					break;
+				case HttpRequestInfoTypeTcpInfoV1:
+					{
+						const TCP_INFO_v1* TcpInfo = reinterpret_cast<const TCP_INFO_v1*>(ReqInfo.pInfo);
+
+						spdlog::info("");
+					}
+					break;
+			}
+		}
+#	endif
+
+		if (HttpService* Service = reinterpret_cast<HttpService*>(HttpReq->UrlContext))
+		{
+			if (m_IsInitialRequest)
+			{
+				m_ContentLength					  = GetContentLength(HttpReq);
+				const HttpContentType ContentType = GetContentType(HttpReq);
+
+				if (m_ContentLength)
+				{
+					// Handle initial chunk read by copying any payload which has already been copied
+					// into our embedded request buffer
+
+					m_PayloadBuffer = IoBuffer(m_ContentLength);
+					m_PayloadBuffer.SetContentType(ContentType);
+
+					uint64_t	   BytesToRead		 = m_ContentLength;
+					uint8_t* const BufferBase		 = reinterpret_cast<uint8_t*>(m_PayloadBuffer.MutableData());
+					uint8_t*	   BufferWriteCursor = BufferBase;
+
+					const int EntityChunkCount = HttpReq->EntityChunkCount;
+
+					for (int i = 0; i < EntityChunkCount; ++i)
+					{
+						HTTP_DATA_CHUNK& EntityChunk = HttpReq->pEntityChunks[i];
+
+						ZEN_ASSERT(EntityChunk.DataChunkType == HttpDataChunkFromMemory);
+
+						const uint64_t BufferLength = EntityChunk.FromMemory.BufferLength;
+
+						ZEN_ASSERT(BufferLength <= BytesToRead);
+
+						memcpy(BufferWriteCursor, EntityChunk.FromMemory.pBuffer, BufferLength);
+
+						BufferWriteCursor += BufferLength;
+						BytesToRead -= BufferLength;
+					}
+
+					m_CurrentPayloadOffset = BufferWriteCursor - BufferBase;
+				}
+			}
+			else
+			{
+				m_CurrentPayloadOffset += NumberOfBytesTransferred;
+			}
+
+			if (m_CurrentPayloadOffset == m_ContentLength)
+			{
+				m_PayloadBuffer.MakeImmutable();
+
+				// Body received completely - call request handler
+
+				HttpSysServerRequest& ThisRequest = Transaction().InvokeRequestHandler(*Service, m_PayloadBuffer);
+
+				if (!ThisRequest.IsHandled())
+				{
+					return new HttpMessageResponseRequest(Transaction(), 404, "Not found"sv);
+				}
+
+				if (HttpMessageResponseRequest* Response = ThisRequest.m_Response)
+				{
+					return Response;
+				}
+			}
+			else
+			{
+				// Issue a read request for more body data
+				return this;
+			}
+		}
+
+		// Unable to route
+		return new HttpMessageResponseRequest(Transaction(), 404, "No suitable route found"sv);
+	}
+	catch (std::exception& ex)
+	{
+		// TODO provide more meaningful error output
+
+		return new HttpMessageResponseRequest(Transaction(), 500, ex.what());
+	}
+}
+
+//////////////////////////////////////////////////////////////////////////
+//
+// HttpServer interface implementation
+//
+
+void
+HttpSysServer::Initialize(int BasePort)
+{
+	using namespace std::literals;
+
+	WideStringBuilder<64> BaseUri;
+	BaseUri << u8"http://*:"sv << int64_t(BasePort) << u8"/"sv;
+
+	Initialize(BaseUri.c_str());
+	StartServer();
+}
+
+void
+HttpSysServer::RequestExit()
+{
+	m_ShutdownEvent.Set();
+}
+void
+HttpSysServer::RegisterService(HttpService& Service)
+{
+	RegisterService(Service.BaseUri(), Service);
+}
+
+}  // namespace zen
+#endif
\ No newline at end of file
diff --git a/zenhttp/httpsys.h b/zenhttp/httpsys.h
new file mode 100644
index 000000000..6616817ec
--- /dev/null
+++ b/zenhttp/httpsys.h
@@ -0,0 +1,75 @@
+// Copyright Epic Games, Inc. All Rights Reserved.
+
+#pragma once
+
+#include <zenhttp/httpserver.h>
+
+#ifndef ZEN_WITH_HTTPSYS
+#	if ZEN_PLATFORM_WINDOWS
+#		define ZEN_WITH_HTTPSYS 1
+#	else
+#		define ZEN_WITH_HTTPSYS 0
+#	endif
+#endif
+
+#if ZEN_WITH_HTTPSYS
+#	define _WINSOCKAPI_
+#	include <zencore/windows.h>
+#	include "iothreadpool.h"
+
+#	include <atlbase.h>
+#	include <http.h>
+
+namespace zen {
+
+/**
+ * @brief Windows implementation of HTTP server based on http.sys
+ *
+ * This requires elevation to function
+ */
+class HttpSysServer : public HttpServer
+{
+	friend class HttpSysTransaction;
+
+public:
+	explicit HttpSysServer(unsigned int ThreadCount);
+	~HttpSysServer();
+
+	// HttpServer interface implementation
+
+	virtual void Initialize(int BasePort) override;
+	virtual void Run(bool TestMode) override;
+	virtual void RequestExit() override;
+	virtual void RegisterService(HttpService& Service) override;
+
+private:
+	void Initialize(const wchar_t* UrlPath);
+	void Cleanup();
+
+	void StartServer();
+	void OnHandlingRequest();
+	void IssueNewRequestMaybe();
+
+	inline bool IsOk() const { return m_IsOk; }
+
+	void RegisterService(const char* Endpoint, HttpService& Service);
+	void UnregisterService(const char* Endpoint, HttpService& Service);
+
+private:
+	bool			m_IsOk				= false;
+	bool			m_IsHttpInitialized = false;
+	WinIoThreadPool m_ThreadPool;
+
+	std::wstring		   m_BaseUri;  // http://*:nnnn/
+	HTTP_SERVER_SESSION_ID m_HttpSessionId		= 0;
+	HTTP_URL_GROUP_ID	   m_HttpUrlGroupId		= 0;
+	HANDLE				   m_RequestQueueHandle = 0;
+	std::atomic_int32_t	   m_PendingRequests{0};
+	std::atomic<int32_t>   m_IsShuttingDown{0};
+	int32_t				   m_MinPendingRequests = 16;
+	int32_t				   m_MaxPendingRequests = 128;
+	Event				   m_ShutdownEvent;
+};
+
+}  // namespace zen
+#endif
diff --git a/zenhttp/httpuws.cpp b/zenhttp/httpuws.cpp
new file mode 100644
index 000000000..992809b17
--- /dev/null
+++ b/zenhttp/httpuws.cpp
@@ -0,0 +1,96 @@
+// Copyright Epic Games, Inc. All Rights Reserved.
+
+#include "httpuws.h"
+
+#pragma warning(push)
+#pragma warning(disable : 4244 4324 4267 4458 4706)
+#include <uwebsockets/App.h>
+#pragma warning(pop)
+
+#include <conio.h>
+#include <zencore/logging.h>
+
+#if ZEN_PLATFORM_WINDOWS
+#	pragma comment(lib, "Iphlpapi.lib")
+#endif
+
+namespace zen {
+
+HttpUwsServer::HttpUwsServer()
+{
+}
+
+HttpUwsServer::~HttpUwsServer()
+{
+}
+
+void
+HttpUwsServer::RegisterService(HttpService& Service)
+{
+	ZEN_UNUSED(Service);
+}
+
+void
+HttpUwsServer::Initialize(int BasePort)
+{
+	m_BasePort = BasePort;
+}
+
+void
+HttpUwsServer::Run(bool TestMode)
+{
+	if (TestMode == false)
+	{
+		zen::logging::ConsoleLog().info("Zen Server running (null HTTP). Press ESC or Q to quit");
+	}
+
+	::uWS::App()
+		.get("/*",
+			 [](uWS::HttpResponse<false>* res, uWS::HttpRequest* req) {
+				 res->end("Hello world!");
+				 ZEN_UNUSED(req);
+			 })
+		.post("/*",
+			  [](uWS::HttpResponse<false>* res, uWS::HttpRequest* req) {
+				  res->onData([&](std::string_view Data, bool fin) {
+					  ZEN_UNUSED(Data);
+					  if (fin)
+						  res->end("Hello world!");
+				  });
+
+				  res->onAborted([&] {});
+				  ZEN_UNUSED(req);
+			  })
+		.listen(m_BasePort, [](auto* listen_socket) { ZEN_UNUSED(listen_socket); })
+		.run();
+
+	do
+	{
+		int WaitTimeout = -1;
+
+		if (!TestMode)
+		{
+			WaitTimeout = 1000;
+		}
+
+		if (!TestMode && _kbhit() != 0)
+		{
+			char c = (char)_getch();
+
+			if (c == 27 || c == 'Q' || c == 'q')
+			{
+				RequestApplicationExit(0);
+			}
+		}
+
+		m_ShutdownEvent.Wait(WaitTimeout);
+	} while (!IsApplicationExitRequested());
+}
+
+void
+HttpUwsServer::RequestExit()
+{
+	m_ShutdownEvent.Set();
+}
+
+}  // namespace zen
diff --git a/zenhttp/httpuws.h b/zenhttp/httpuws.h
new file mode 100644
index 000000000..ec55ae2fd
--- /dev/null
+++ b/zenhttp/httpuws.h
@@ -0,0 +1,27 @@
+// Copyright Epic Games, Inc. All Rights Reserved.
+
+#pragma once
+
+#include <zenhttp/httpserver.h>
+
+#include <zencore/thread.h>
+
+namespace zen {
+
+class HttpUwsServer : public HttpServer
+{
+public:
+	HttpUwsServer();
+	~HttpUwsServer();
+
+	virtual void RegisterService(HttpService& Service) override;
+	virtual void Initialize(int BasePort) override;
+	virtual void Run(bool TestMode) override;
+	virtual void RequestExit() override;
+
+private:
+	Event m_ShutdownEvent;
+	int	  m_BasePort = 0;
+};
+
+}  // namespace zen
\ No newline at end of file
diff --git a/zenhttp/include/zenhttp/httpclient.h b/zenhttp/include/zenhttp/httpclient.h
new file mode 100644
index 000000000..8975f6fe1
--- /dev/null
+++ b/zenhttp/include/zenhttp/httpclient.h
@@ -0,0 +1,48 @@
+// Copyright Epic Games, Inc. All Rights Reserved.
+
+#pragma once
+
+#include "zenhttp.h"
+
+#include <zencore/iobuffer.h>
+#include <zenhttp/httpcommon.h>
+
+#include <zencore/windows.h>
+
+// For some reason, these don't seem to stick, so we disable the warnings
+//#	define _SILENCE_CXX17_C_HEADER_DEPRECATION_WARNING 1
+//#	define _SILENCE_ALL_CXX17_DEPRECATION_WARNINGS		1
+#pragma warning(push)
+#pragma warning(disable : 4004)
+#pragma warning(disable : 4996)
+#include <cpr/cpr.h>
+#pragma warning(pop)
+
+namespace zen {
+
+class CbPackage;
+
+/** Asynchronous HTTP client implementation for Zen use cases
+ */
+class HttpClient
+{
+public:
+	HttpClient(std::string_view BaseUri);
+	~HttpClient();
+
+	struct Response
+	{
+		int		 StatusCode = 0;
+		IoBuffer ResponsePayload;
+	};
+
+	[[nodiscard]] Response TransactPackage(std::string_view Url, CbPackage Package);
+	[[nodiscard]] Response Delete(std::string_view Url);
+
+private:
+	std::string m_BaseUri;
+};
+
+}  // namespace zen
+
+void httpclient_forcelink();  // internal
diff --git a/zenhttp/include/zenhttp/httpcommon.h b/zenhttp/include/zenhttp/httpcommon.h
new file mode 100644
index 000000000..41ec706f4
--- /dev/null
+++ b/zenhttp/include/zenhttp/httpcommon.h
@@ -0,0 +1,170 @@
+// Copyright Epic Games, Inc. All Rights Reserved.
+
+#pragma once
+
+#include <zencore/iobuffer.h>
+
+#include <string_view>
+
+#include <gsl/gsl-lite.hpp>
+
+namespace zen {
+
+using HttpContentType = ZenContentType;
+
+class IoBuffer;
+class CbObject;
+class CbPackage;
+class StringBuilderBase;
+
+std::string_view MapContentTypeToString(HttpContentType ContentType);
+HttpContentType	 ParseContentType(const std::string_view& ContentTypeString);
+const char*		 ReasonStringForHttpResultCode(int HttpCode);
+
+[[nodiscard]] inline bool
+IsHttpSuccessCode(int HttpCode)
+{
+	return (HttpCode >= 200) && (HttpCode < 300);
+}
+
+enum class HttpVerb : uint8_t
+{
+	kGet	 = 1 << 0,
+	kPut	 = 1 << 1,
+	kPost	 = 1 << 2,
+	kDelete	 = 1 << 3,
+	kHead	 = 1 << 4,
+	kCopy	 = 1 << 5,
+	kOptions = 1 << 6
+};
+
+gsl_DEFINE_ENUM_BITMASK_OPERATORS(HttpVerb);
+
+enum class HttpResponseCode
+{
+	// 1xx - Informational
+
+	Continue = 100,	 //!< Indicates that the initial part of a request has been received and has not yet been rejected by the server.
+	SwitchingProtocols = 101,  //!< Indicates that the server understands and is willing to comply with the client's request, via the
+							   //!< Upgrade header field, for a change in the application protocol being used on this connection.
+	Processing = 102,  //!< Is an interim response used to inform the client that the server has accepted the complete request, but has not
+					   //!< yet completed it.
+	EarlyHints = 103,  //!< Indicates to the client that the server is likely to send a final response with the header fields included in
+					   //!< the informational response.
+
+	// 2xx - Successful
+
+	OK		 = 200,	 //!< Indicates that the request has succeeded.
+	Created	 = 201,	 //!< Indicates that the request has been fulfilled and has resulted in one or more new resources being created.
+	Accepted = 202,	 //!< Indicates that the request has been accepted for processing, but the processing has not been completed.
+	NonAuthoritativeInformation = 203,	//!< Indicates that the request was successful but the enclosed payload has been modified from that
+										//!< of the origin server's 200 (OK) response by a transforming proxy.
+	NoContent = 204,  //!< Indicates that the server has successfully fulfilled the request and that there is no additional content to send
+					  //!< in the response payload body.
+	ResetContent = 205,	   //!< Indicates that the server has fulfilled the request and desires that the user agent reset the \"document
+						   //!< view\", which caused the request to be sent, to its original state as received from the origin server.
+	PartialContent = 206,  //!< Indicates that the server is successfully fulfilling a range request for the target resource by transferring
+						   //!< one or more parts of the selected representation that correspond to the satisfiable ranges found in the
+						   //!< requests's Range header field.
+	MultiStatus		= 207,	//!< Provides status for multiple independent operations.
+	AlreadyReported = 208,	//!< Used inside a DAV:propstat response element to avoid enumerating the internal members of multiple bindings
+							//!< to the same collection repeatedly. [RFC 5842]
+	IMUsed = 226,  //!< The server has fulfilled a GET request for the resource, and the response is a representation of the result of one
+				   //!< or more instance-manipulations applied to the current instance.
+
+	// 3xx - Redirection
+
+	MultipleChoices = 300,	 //!< Indicates that the target resource has more than one representation, each with its own more specific
+							 //!< identifier, and information about the alternatives is being provided so that the user (or user agent) can
+							 //!< select a preferred representation by redirecting its request to one or more of those identifiers.
+	MovedPermanently = 301,	 //!< Indicates that the target resource has been assigned a new permanent URI and any future references to this
+							 //!< resource ought to use one of the enclosed URIs.
+	Found	 = 302,			 //!< Indicates that the target resource resides temporarily under a different URI.
+	SeeOther = 303,		//!< Indicates that the server is redirecting the user agent to a different resource, as indicated by a URI in the
+						//!< Location header field, that is intended to provide an indirect response to the original request.
+	NotModified = 304,	//!< Indicates that a conditional GET request has been received and would have resulted in a 200 (OK) response if it
+						//!< were not for the fact that the condition has evaluated to false.
+	UseProxy = 305,		//!< \deprecated \parblock Due to security concerns regarding in-band configuration of a proxy. \endparblock
+						//!< The requested resource MUST be accessed through the proxy given by the Location field.
+	TemporaryRedirect = 307,  //!< Indicates that the target resource resides temporarily under a different URI and the user agent MUST NOT
+							  //!< change the request method if it performs an automatic redirection to that URI.
+	PermanentRedirect = 308,  //!< The target resource has been assigned a new permanent URI and any future references to this resource
+							  //!< ought to use one of the enclosed URIs. [...] This status code is similar to 301 Moved Permanently
+							  //!< (Section 7.3.2 of rfc7231), except that it does not allow rewriting the request method from POST to GET.
+
+	// 4xx - Client Error
+	BadRequest = 400,		//!< Indicates that the server cannot or will not process the request because the received syntax is invalid,
+							//!< nonsensical, or exceeds some limitation on what the server is willing to process.
+	Unauthorized = 401,		//!< Indicates that the request has not been applied because it lacks valid authentication credentials for the
+							//!< target resource.
+	PaymentRequired = 402,	//!< *Reserved*
+	Forbidden		= 403,	//!< Indicates that the server understood the request but refuses to authorize it.
+	NotFound = 404,	 //!< Indicates that the origin server did not find a current representation for the target resource or is not willing
+					 //!< to disclose that one exists.
+	MethodNotAllowed = 405,	 //!< Indicates that the method specified in the request-line is known by the origin server but not supported by
+							 //!< the target resource.
+	NotAcceptable = 406,	 //!< Indicates that the target resource does not have a current representation that would be acceptable to the
+						  //!< user agent, according to the proactive negotiation header fields received in the request, and the server is
+						  //!< unwilling to supply a default representation.
+	ProxyAuthenticationRequired =
+		407,  //!< Is similar to 401 (Unauthorized), but indicates that the client needs to authenticate itself in order to use a proxy.
+	RequestTimeout =
+		408,		 //!< Indicates that the server did not receive a complete request message within the time that it was prepared to wait.
+	Conflict = 409,	 //!< Indicates that the request could not be completed due to a conflict with the current state of the resource.
+	Gone = 410,	 //!< Indicates that access to the target resource is no longer available at the origin server and that this condition is
+				 //!< likely to be permanent.
+	LengthRequired = 411,  //!< Indicates that the server refuses to accept the request without a defined Content-Length.
+	PreconditionFailed =
+		412,  //!< Indicates that one or more preconditions given in the request header fields evaluated to false when tested on the server.
+	PayloadTooLarge = 413,	//!< Indicates that the server is refusing to process a request because the request payload is larger than the
+							//!< server is willing or able to process.
+	URITooLong = 414,		//!< Indicates that the server is refusing to service the request because the request-target is longer than the
+							//!< server is willing to interpret.
+	UnsupportedMediaType = 415,	 //!< Indicates that the origin server is refusing to service the request because the payload is in a format
+								 //!< not supported by the target resource for this method.
+	RangeNotSatisfiable = 416,	//!< Indicates that none of the ranges in the request's Range header field overlap the current extent of the
+								//!< selected resource or that the set of ranges requested has been rejected due to invalid ranges or an
+								//!< excessive request of small or overlapping ranges.
+	ExpectationFailed = 417,	//!< Indicates that the expectation given in the request's Expect header field could not be met by at least
+								//!< one of the inbound servers.
+	ImATeapot			= 418,	//!< Any attempt to brew coffee with a teapot should result in the error code 418 I'm a teapot.
+	UnprocessableEntity = 422,	//!< Means the server understands the content type of the request entity (hence a 415(Unsupported Media
+								//!< Type) status code is inappropriate), and the syntax of the request entity is correct (thus a 400 (Bad
+								//!< Request) status code is inappropriate) but was unable to process the contained instructions.
+	Locked			 = 423,		//!< Means the source or destination resource of a method is locked.
+	FailedDependency = 424,		//!< Means that the method could not be performed on the resource because the requested action depended on
+								//!< another action and that action failed.
+	UpgradeRequired = 426,	//!< Indicates that the server refuses to perform the request using the current protocol but might be willing to
+							//!< do so after the client upgrades to a different protocol.
+	PreconditionRequired = 428,	 //!< Indicates that the origin server requires the request to be conditional.
+	TooManyRequests		 = 429,	 //!< Indicates that the user has sent too many requests in a given amount of time (\"rate limiting\").
+	RequestHeaderFieldsTooLarge =
+		431,  //!< Indicates that the server is unwilling to process the request because its header fields are too large.
+	UnavailableForLegalReasons =
+		451,  //!< This status code indicates that the server is denying access to the resource in response to a legal demand.
+
+	// 5xx - Server Error
+
+	InternalServerError =
+		500,			   //!< Indicates that the server encountered an unexpected condition that prevented it from fulfilling the request.
+	NotImplemented = 501,  //!< Indicates that the server does not support the functionality required to fulfill the request.
+	BadGateway	   = 502,  //!< Indicates that the server, while acting as a gateway or proxy, received an invalid response from an inbound
+						   //!< server it accessed while attempting to fulfill the request.
+	ServiceUnavailable = 503,  //!< Indicates that the server is currently unable to handle the request due to a temporary overload or
+							   //!< scheduled maintenance, which will likely be alleviated after some delay.
+	GatewayTimeout = 504,	   //!< Indicates that the server, while acting as a gateway or proxy, did not receive a timely response from an
+							   //!< upstream server it needed to access in order to complete the request.
+	HTTPVersionNotSupported = 505,	//!< Indicates that the server does not support, or refuses to support, the protocol version that was
+									//!< used in the request message.
+	VariantAlsoNegotiates =
+		506,  //!< Indicates that the server has an internal configuration error: the chosen variant resource is configured to engage in
+			  //!< transparent content negotiation itself, and is therefore not a proper end point in the negotiation process.
+	InsufficientStorage = 507,	//!< Means the method could not be performed on the resource because the server is unable to store the
+								//!< representation needed to successfully complete the request.
+	LoopDetected = 508,	 //!< Indicates that the server terminated an operation because it encountered an infinite loop while processing a
+						 //!< request with "Depth: infinity". [RFC 5842]
+	NotExtended					  = 510,  //!< The policy for accessing the resource has not been met in the request. [RFC 2774]
+	NetworkAuthenticationRequired = 511,  //!< Indicates that the client needs to authenticate to gain network access.
+};
+
+}  // namespace zen
diff --git a/zenhttp/include/zenhttp/httpserver.h b/zenhttp/include/zenhttp/httpserver.h
new file mode 100644
index 000000000..de097ceb3
--- /dev/null
+++ b/zenhttp/include/zenhttp/httpserver.h
@@ -0,0 +1,273 @@
+// Copyright Epic Games, Inc. All Rights Reserved.
+
+#pragma once
+
+#include "zenhttp.h"
+
+#include <zenhttp/httpcommon.h>
+
+#include <zencore/enumflags.h>
+#include <zencore/iobuffer.h>
+#include <zencore/iohash.h>
+#include <zencore/refcount.h>
+#include <zencore/string.h>
+#include <zencore/uid.h>
+
+#include <functional>
+#include <gsl/gsl-lite.hpp>
+#include <list>
+#include <regex>
+#include <span>
+#include <unordered_map>
+
+namespace zen {
+
+/** HTTP Server Request
+ */
+class HttpServerRequest
+{
+public:
+	HttpServerRequest();
+	~HttpServerRequest();
+
+	// Synchronous operations
+
+	[[nodiscard]] inline std::string_view RelativeUri() const { return m_UriUtf8; }	 // Returns URI without service prefix
+	[[nodiscard]] inline std::string_view QueryString() const { return m_QueryStringUtf8; }
+
+	struct QueryParams
+	{
+		std::vector<std::pair<std::string_view, std::string_view>> KvPairs;
+
+		std::string_view GetValue(std::string_view ParamName)
+		{
+			for (const auto& Kv : KvPairs)
+			{
+				const std::string_view& Key = Kv.first;
+
+				if (Key.size() == ParamName.size())
+				{
+					if (0 == _strnicmp(Key.data(), ParamName.data(), Key.size()))
+					{
+						return Kv.second;
+					}
+				}
+			}
+
+			return std::string_view();
+		}
+	};
+
+	QueryParams GetQueryParams();
+
+	inline HttpVerb		   RequestVerb() const { return m_Verb; }
+	inline HttpContentType RequestContentType() { return m_ContentType; }
+	inline HttpContentType AcceptContentType() { return m_AcceptType; }
+
+	inline uint64_t ContentLength() const { return m_ContentLength; }
+	Oid				SessionId() const;
+	uint32_t		RequestId() const;
+
+	inline bool IsHandled() const { return !!(m_Flags & kIsHandled); }
+	inline bool SuppressBody() const { return !!(m_Flags & kSuppressBody); }
+	inline void SetSuppressResponseBody() { m_Flags |= kSuppressBody; }
+
+	/** Read POST/PUT payload for request body, which is always available without delay
+	 */
+	virtual IoBuffer ReadPayload() = 0;
+
+	ZENCORE_API CbObject  ReadPayloadObject();
+	ZENCORE_API CbPackage ReadPayloadPackage();
+
+	/** Respond with payload
+
+		No data will have been sent when any of these functions return. Instead, the response will be transmitted
+		asynchronously, after returning from a request handler function.
+
+		Note that this is destructive in the sense that the IoBuffer instances referred to by Blobs will be
+		moved into our response handler array where they are kept alive, in order to reduce ref-counting storms
+	  */
+	virtual void WriteResponse(HttpResponseCode ResponseCode, HttpContentType ContentType, std::span<IoBuffer> Blobs)		  = 0;
+	virtual void WriteResponse(HttpResponseCode ResponseCode)																  = 0;
+	virtual void WriteResponse(HttpResponseCode ResponseCode, HttpContentType ContentType, std::u8string_view ResponseString) = 0;
+	virtual void WriteResponse(HttpResponseCode ResponseCode, HttpContentType ContentType, CompositeBuffer& Payload);
+
+	void WriteResponse(HttpResponseCode ResponseCode, CbObject Data);
+	void WriteResponse(HttpResponseCode ResponseCode, CbPackage Package);
+	void WriteResponse(HttpResponseCode ResponseCode, HttpContentType ContentType, std::string_view ResponseString);
+	void WriteResponse(HttpResponseCode ResponseCode, HttpContentType ContentType, IoBuffer Blob);
+
+protected:
+	enum
+	{
+		kIsHandled	   = 1 << 0,
+		kSuppressBody  = 1 << 1,
+		kHaveRequestId = 1 << 2,
+		kHaveSessionId = 1 << 3,
+	};
+
+	mutable uint32_t			 m_Flags		 = 0;
+	HttpVerb					 m_Verb			 = HttpVerb::kGet;
+	HttpContentType				 m_ContentType	 = HttpContentType::kBinary;
+	HttpContentType				 m_AcceptType	 = HttpContentType::kUnknownContentType;
+	uint64_t					 m_ContentLength = ~0ull;
+	ExtendableStringBuilder<128> m_UriUtf8;
+	ExtendableStringBuilder<128> m_QueryStringUtf8;
+	mutable uint32_t			 m_RequestId = ~uint32_t(0);
+	mutable Oid					 m_SessionId = Oid::Zero;
+
+	inline void SetIsHandled() { m_Flags |= kIsHandled; }
+
+	virtual Oid		 ParseSessionId() const = 0;
+	virtual uint32_t ParseRequestId() const = 0;
+};
+
+class IHttpPackageHandler : public RefCounted
+{
+public:
+	virtual void	 FilterOffer(std::vector<IoHash>& OfferCids)		   = 0;
+	virtual void	 OnRequestBegin()									   = 0;
+	virtual IoBuffer CreateTarget(const IoHash& Cid, uint64_t StorageSize) = 0;
+	virtual void	 OnRequestComplete()								   = 0;
+};
+
+/**
+ * Base class for implementing an HTTP "service"
+ *
+ * A service exposes one or more endpoints with a certain URI prefix
+ *
+ */
+
+class HttpService
+{
+public:
+	HttpService()		   = default;
+	virtual ~HttpService() = default;
+
+	virtual const char*				 BaseUri() const									  = 0;
+	virtual void					 HandleRequest(HttpServerRequest& HttpServiceRequest) = 0;
+	virtual Ref<IHttpPackageHandler> HandlePackageRequest(HttpServerRequest& HttpServiceRequest);
+
+	// Internals
+
+	inline void SetUriPrefixLength(size_t PrefixLength) { m_UriPrefixLength = (int)PrefixLength; }
+	inline int	UriPrefixLength() const { return m_UriPrefixLength; }
+
+private:
+	int m_UriPrefixLength = 0;
+};
+
+/** HTTP server
+ *
+ *	Implements the main event loop to service HTTP requests, and handles routing
+ *  requests to the appropriate handler as registered via RegisterService
+ */
+class HttpServer : public RefCounted
+{
+public:
+	virtual void RegisterService(HttpService& Service) = 0;
+	virtual void Initialize(int BasePort)			   = 0;
+	virtual void Run(bool TestMode)					   = 0;
+	virtual void RequestExit()						   = 0;
+};
+
+Ref<HttpServer> CreateHttpServer();
+
+//////////////////////////////////////////////////////////////////////////
+
+class HttpRouterRequest
+{
+public:
+	HttpRouterRequest(HttpServerRequest& Request) : m_HttpRequest(Request) {}
+
+	ZENCORE_API std::string	  GetCapture(uint32_t Index) const;
+	inline HttpServerRequest& ServerRequest() { return m_HttpRequest; }
+
+private:
+	using MatchResults_t = std::match_results<std::string_view::const_iterator>;
+
+	HttpServerRequest& m_HttpRequest;
+	MatchResults_t	   m_Match;
+
+	friend class HttpRequestRouter;
+};
+
+inline std::string
+HttpRouterRequest::GetCapture(uint32_t Index) const
+{
+	ZEN_ASSERT(Index < m_Match.size());
+
+	return m_Match[Index];
+}
+
+/** HTTP request router helper
+ *
+ * This helper class allows a service implementer to register one or more
+ * endpoints using pattern matching (currently using regex matching)
+ *
+ * This is intended to be initialized once only, there is no thread
+ * safety so you can absolutely not add or remove endpoints once the handler
+ * goes live
+ */
+
+class HttpRequestRouter
+{
+public:
+	typedef std::function<void(HttpRouterRequest&)> HandlerFunc_t;
+
+	/**
+	 * @brief Add pattern which can be referenced by name, commonly used for URL components
+	 * @param Id String used to identify patterns for replacement
+	 * @param Regex String which will replace the Id string in any registered URL paths
+	 */
+	void AddPattern(const char* Id, const char* Regex);
+
+	/**
+	 * @brief Register a an endpoint handler for the given route
+	 * @param Regex Regular expression used to match the handler to a request. This may
+	 *		  contain pattern aliases registered via AddPattern
+	 * @param HandlerFunc Handler function to call for any matching request
+	 * @param SupportedVerbs Supported HTTP verbs for this handler
+	 */
+	void RegisterRoute(const char* Regex, HandlerFunc_t&& HandlerFunc, HttpVerb SupportedVerbs);
+
+	void ProcessRegexSubstitutions(const char* Regex, StringBuilderBase& ExpandedRegex);
+
+	/**
+	 * @brief HTTP request handling function - this should be called to route the
+	 *		  request to a registered handler
+	 * @param Request Request to route to a handler
+	 * @return Function returns true if the request was routed successfully
+	 */
+	bool HandleRequest(zen::HttpServerRequest& Request);
+
+private:
+	struct HandlerEntry
+	{
+		HandlerEntry(const char* Regex, HttpVerb SupportedVerbs, HandlerFunc_t&& Handler, const char* Pattern)
+		: RegEx(Regex, std::regex::icase | std::regex::ECMAScript)
+		, Verbs(SupportedVerbs)
+		, Handler(std::move(Handler))
+		, Pattern(Pattern)
+		{
+		}
+
+		~HandlerEntry() = default;
+
+		std::regex	  RegEx;
+		HttpVerb	  Verbs;
+		HandlerFunc_t Handler;
+		const char*	  Pattern;
+
+	private:
+		HandlerEntry& operator=(const HandlerEntry&) = delete;
+		HandlerEntry(const HandlerEntry&)			 = delete;
+	};
+
+	std::list<HandlerEntry>						 m_Handlers;
+	std::unordered_map<std::string, std::string> m_PatternMap;
+};
+
+}  // namespace zen
+
+void http_forcelink();	// internal
diff --git a/zenhttp/include/zenhttp/zenhttp.h b/zenhttp/include/zenhttp/zenhttp.h
new file mode 100644
index 000000000..c6ec92e7c
--- /dev/null
+++ b/zenhttp/include/zenhttp/zenhttp.h
@@ -0,0 +1,7 @@
+// Copyright Epic Games, Inc. All Rights Reserved.
+
+#pragma once
+
+#include <zencore/zencore.h>
+
+#define ZENHTTP_API	 // Placeholder to allow DLL configs in the future
diff --git a/zenhttp/iothreadpool.cpp b/zenhttp/iothreadpool.cpp
new file mode 100644
index 000000000..4f1a6642b
--- /dev/null
+++ b/zenhttp/iothreadpool.cpp
@@ -0,0 +1,43 @@
+// Copyright Epic Games, Inc. All Rights Reserved.
+
+#include "iothreadpool.h"
+
+#include <zencore/except.h>
+
+namespace zen {
+
+WinIoThreadPool::WinIoThreadPool(int InThreadCount)
+{
+	// Thread pool setup
+
+	m_ThreadPool = CreateThreadpool(NULL);
+
+	SetThreadpoolThreadMinimum(m_ThreadPool, InThreadCount);
+	SetThreadpoolThreadMaximum(m_ThreadPool, InThreadCount * 2);
+
+	InitializeThreadpoolEnvironment(&m_CallbackEnvironment);
+
+	m_CleanupGroup = CreateThreadpoolCleanupGroup();
+
+	SetThreadpoolCallbackPool(&m_CallbackEnvironment, m_ThreadPool);
+
+	SetThreadpoolCallbackCleanupGroup(&m_CallbackEnvironment, m_CleanupGroup, NULL);
+}
+
+WinIoThreadPool::~WinIoThreadPool()
+{
+	CloseThreadpool(m_ThreadPool);
+}
+
+void
+WinIoThreadPool::CreateIocp(HANDLE IoHandle, PTP_WIN32_IO_CALLBACK Callback, void* Context, std::error_code& ErrorCode)
+{
+	m_ThreadPoolIo = CreateThreadpoolIo(IoHandle, Callback, Context, &m_CallbackEnvironment);
+
+	if (!m_ThreadPoolIo)
+	{
+		ErrorCode = MakeErrorCodeFromLastError();
+	}
+}
+
+}  // namespace zen
diff --git a/zenhttp/iothreadpool.h b/zenhttp/iothreadpool.h
new file mode 100644
index 000000000..4418b940b
--- /dev/null
+++ b/zenhttp/iothreadpool.h
@@ -0,0 +1,33 @@
+// Copyright Epic Games, Inc. All Rights Reserved.
+
+#pragma once
+
+#include <zencore/windows.h>
+
+#include <system_error>
+
+namespace zen {
+
+//////////////////////////////////////////////////////////////////////////
+//
+// Thread pool. Implemented in terms of Windows thread pool right now, will
+//				need a cross-platform implementation eventually
+//
+
+class WinIoThreadPool
+{
+public:
+	WinIoThreadPool(int InThreadCount);
+	~WinIoThreadPool();
+
+	void		  CreateIocp(HANDLE IoHandle, PTP_WIN32_IO_CALLBACK Callback, void* Context, std::error_code& ErrorCode);
+	inline PTP_IO Iocp() const { return m_ThreadPoolIo; }
+
+private:
+	PTP_POOL			m_ThreadPool   = nullptr;
+	PTP_CLEANUP_GROUP	m_CleanupGroup = nullptr;
+	PTP_IO				m_ThreadPoolIo = nullptr;
+	TP_CALLBACK_ENVIRON m_CallbackEnvironment;
+};
+
+}  // namespace zen
diff --git a/zenhttp/xmake.lua b/zenhttp/xmake.lua
new file mode 100644
index 000000000..65d5f08ea
--- /dev/null
+++ b/zenhttp/xmake.lua
@@ -0,0 +1,7 @@
+target('zenhttp')
+    set_kind("static")
+    add_files("**.cpp")
+    add_includedirs("include", {public=true})
+    add_deps("zencore")
+    add_packages("vcpkg::gsl-lite", "vcpkg::uwebsockets", "vcpkg::usockets", "vcpkg::libuv")
+    add_options("httpsys")
\ No newline at end of file
diff --git a/zenhttp/zenhttp.vcxproj b/zenhttp/zenhttp.vcxproj
new file mode 100644
index 000000000..3536d1929
--- /dev/null
+++ b/zenhttp/zenhttp.vcxproj
@@ -0,0 +1,126 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <ItemGroup Label="ProjectConfigurations">
+    <ProjectConfiguration Include="Debug|x64">
+      <Configuration>Debug</Configuration>
+      <Platform>x64</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Release|x64">
+      <Configuration>Release</Configuration>
+      <Platform>x64</Platform>
+    </ProjectConfiguration>
+  </ItemGroup>
+  <PropertyGroup Label="Globals">
+    <VCProjectVersion>16.0</VCProjectVersion>
+    <Keyword>Win32Proj</Keyword>
+    <ProjectGuid>{8eeb3be5-7001-46bf-aafd-edb7558ac012}</ProjectGuid>
+    <RootNamespace>zenhttp</RootNamespace>
+    <WindowsTargetPlatformVersion>10.0</WindowsTargetPlatformVersion>
+  </PropertyGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration">
+    <ConfigurationType>StaticLibrary</ConfigurationType>
+    <UseDebugLibraries>true</UseDebugLibraries>
+    <PlatformToolset>v142</PlatformToolset>
+    <CharacterSet>Unicode</CharacterSet>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration">
+    <ConfigurationType>StaticLibrary</ConfigurationType>
+    <UseDebugLibraries>false</UseDebugLibraries>
+    <PlatformToolset>v142</PlatformToolset>
+    <WholeProgramOptimization>true</WholeProgramOptimization>
+    <CharacterSet>Unicode</CharacterSet>
+  </PropertyGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
+  <ImportGroup Label="ExtensionSettings">
+  </ImportGroup>
+  <ImportGroup Label="Shared">
+  </ImportGroup>
+  <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+    <Import Project="..\zen_base_debug.props" />
+    <Import Project="..\zenfs_common.props" />
+  </ImportGroup>
+  <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+    <Import Project="..\zen_base_release.props" />
+    <Import Project="..\zenfs_common.props" />
+  </ImportGroup>
+  <PropertyGroup Label="UserMacros" />
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
+    <LinkIncremental>true</LinkIncremental>
+    <PublicIncludeDirectories>$(ProjectDir)include;$(PublicIncludeDirectories)</PublicIncludeDirectories>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
+    <LinkIncremental>false</LinkIncremental>
+    <PublicIncludeDirectories>$(ProjectDir)include;$(PublicIncludeDirectories)</PublicIncludeDirectories>
+  </PropertyGroup>
+  <PropertyGroup Label="Vcpkg">
+    <VcpkgEnableManifest>true</VcpkgEnableManifest>
+  </PropertyGroup>
+  <PropertyGroup Label="Vcpkg" Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
+    <VcpkgUseStatic>true</VcpkgUseStatic>
+  </PropertyGroup>
+  <PropertyGroup Label="Vcpkg" Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
+    <VcpkgUseStatic>true</VcpkgUseStatic>
+  </PropertyGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
+    <ClCompile>
+      <SDLCheck>true</SDLCheck>
+      <PreprocessorDefinitions>_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <ConformanceMode>true</ConformanceMode>
+      <AdditionalIncludeDirectories>.\include</AdditionalIncludeDirectories>
+    </ClCompile>
+    <Link>
+      <SubSystem>Console</SubSystem>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
+    <ClCompile>
+      <FunctionLevelLinking>true</FunctionLevelLinking>
+      <IntrinsicFunctions>true</IntrinsicFunctions>
+      <SDLCheck>true</SDLCheck>
+      <PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <ConformanceMode>true</ConformanceMode>
+      <AdditionalIncludeDirectories>.\include</AdditionalIncludeDirectories>
+    </ClCompile>
+    <Link>
+      <SubSystem>Console</SubSystem>
+      <EnableCOMDATFolding>true</EnableCOMDATFolding>
+      <OptimizeReferences>true</OptimizeReferences>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemGroup>
+    <ClCompile Include="httpclient.cpp" />
+    <ClCompile Include="httpnull.cpp" />
+    <ClCompile Include="httpserver.cpp" />
+    <ClCompile Include="httpshared.cpp" />
+    <ClCompile Include="httpsys.cpp" />
+    <ClCompile Include="httpuws.cpp" />
+    <ClCompile Include="iothreadpool.cpp" />
+  </ItemGroup>
+  <ItemGroup>
+    <ClInclude Include="httpnull.h" />
+    <ClInclude Include="httpshared.h" />
+    <ClInclude Include="httpsys.h" />
+    <ClInclude Include="httpuws.h" />
+    <ClInclude Include="include\zenhttp\httpclient.h" />
+    <ClInclude Include="include\zenhttp\httpcommon.h" />
+    <ClInclude Include="include\zenhttp\httpserver.h" />
+    <ClInclude Include="include\zenhttp\zenhttp.h" />
+    <ClInclude Include="iothreadpool.h" />
+  </ItemGroup>
+  <ItemGroup>
+    <ProjectReference Include="..\zencore\zencore.vcxproj">
+      <Project>{d75bf9ab-c61e-4fff-ad59-1563430f05e2}</Project>
+    </ProjectReference>
+  </ItemGroup>
+  <ItemGroup>
+    <None Include="xmake.lua" />
+  </ItemGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
+  <ImportGroup Label="ExtensionTargets">
+  </ImportGroup>
+</Project>
\ No newline at end of file
diff --git a/zenhttp/zenhttp.vcxproj.filters b/zenhttp/zenhttp.vcxproj.filters
new file mode 100644
index 000000000..da292c18f
--- /dev/null
+++ b/zenhttp/zenhttp.vcxproj.filters
@@ -0,0 +1,26 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <ItemGroup>
+    <ClCompile Include="httpclient.cpp" />
+    <ClCompile Include="httpserver.cpp" />
+    <ClCompile Include="httpsys.cpp" />
+    <ClCompile Include="iothreadpool.cpp" />
+    <ClCompile Include="httpnull.cpp" />
+    <ClCompile Include="httpuws.cpp" />
+    <ClCompile Include="httpshared.cpp" />
+  </ItemGroup>
+  <ItemGroup>
+    <ClInclude Include="include\zenhttp\httpclient.h" />
+    <ClInclude Include="include\zenhttp\httpserver.h" />
+    <ClInclude Include="httpsys.h" />
+    <ClInclude Include="iothreadpool.h" />
+    <ClInclude Include="include\zenhttp\zenhttp.h" />
+    <ClInclude Include="httpnull.h" />
+    <ClInclude Include="httpuws.h" />
+    <ClInclude Include="httpshared.h" />
+    <ClInclude Include="include\zenhttp\httpcommon.h" />
+  </ItemGroup>
+  <ItemGroup>
+    <None Include="xmake.lua" />
+  </ItemGroup>
+</Project>
\ No newline at end of file