Add the cpp-boost-beast-server generator (BETA) emitting a C++17
Boost.Beast HTTP/1.1 server: strand-per-connection sessions with
message_generator responses, encoded-segment routing with 404/405+Allow,
OAS parameter deserialization (path simple/label/matrix, query
form/space/pipe/deepObject, header simple, cookie form) with enum,
pattern, and bound validation into RFC 9457 problem responses, JSON body
codec over generated model to/fromJsonValue APIs, OR-of-AND security
extraction with a deny-by-default Authorizer seam, single-shot strand
posting responders, and an addApiImplStubs quick-start main. CMake links
Boost 1.81+ json+url compiled libraries; -Wall/-W4 clean.

…e suites

Add the server-regression OAS 3.1 fixture (path/query/header/cookie
styles, enum/pattern/bound constraints, bearer + apiKey security),
12-test codegen suite (defaults, contract emission, stubs, IR stripping,
multipart/x-www-form-urlencoded/text-*/event-stream/content-style/
cookie-matrix/ambiguous-route rejections, 3.0 compatibility), and the
native loopback runtime test compiling and running the generated server
against real sockets: 200/201/204 happy paths, 400 problem+json with
errors[] for every constraint class, 404, 405+Allow, 413, 415, 401 with
and without credentials, keep-alive, label-pattern paths, and
pipe-delimited collections. Header params now look up lowercased field
names; enum allow-lists render unescaped.

Add the deterministic cpp-boost-beast-server petstore sample (builds
clean with -Wall and serves 501 stubs / 400 / 404 over HTTP/1.1), the
generated generator documentation, and a three-OS sample build workflow
covering Boost json+url consumers. API headers now emit the model
namespace using-directive only when an API actually references a
generated model class (map-only APIs such as store inventory compile
standalone).

…erage

Runtime: anonymous security alternatives (security: []) now bypass the
authorization gate; 413 body-limit responses close the connection instead
of re-reading leftover body bytes as a new request; responses mirror the
request HTTP version and keep-alive preference; HttpServer::stop posts
the acceptor close onto its strand; ResponderCore's completion flag is
atomic and the handler-exception 500 routes through the guard; 401s
carry WWW-Authenticate for http-scheme challenges; cookie names strip
leading OWS; BodyJson handles uint64 numbers above INT64_MAX without
throwing past the invalid_argument catch and supports any-type bodies;
parseScalar enforces whole-input match and rejects inf/nan; problem JSON
escapes bytes >= 0x7f to keep bodies valid UTF-8.

Generator: request-body and parameter $refs are resolved before fact
extraction so bodies and constraints survive; declared media-type
parameters are normalized out of kMediaTypes; ranged status codes
(2XX) and oauth2/openIdConnect/mutualTLS schemes are rejected at
generation; integer/number/bool enums are validated at runtime like
string enums; header and cookie params gain enum checks; route shape
keys mirror the runtime splitter; dead x-server-route/kind/inner facts
and the bodyKind helper are removed; shared OperationFacts gains the
Apache header.

Loopback coverage: anonymous-op bypass against a denying authorizer,
integer-enum rejection/acceptance, and conventional spaced Cookie
headers.

…tests

Generation gate:
- reject array/object cookie params, non-scalar array items, object
  params other than query deepObject string maps, heterogeneous enums
- fix malformed security-scheme diagnostic quoting

Runtime:
- splitMatrixExploded(): strip repeated name= per element for
  style=matrix explode=true path parameters
- router literal-over-parameter ranking (most literal segments wins,
  ties keep registration order) so /pets/bulk beats /pets/{petId}
- re-arm the stream timer in send_response so deferred handler
  completions are not aborted by an expired read deadline
- mirror request version/keep-alive on the 413 body_limit path
- deepObject required-missing now reports 400
- shared param-constraints partial: uniform pattern/length/bound
  ladders across query, header, and cookie scalar parameters
- jsonEscape passes UTF-8 through; escapes only C0 controls and DEL

Rendering: minimum/maximum bounds emit long-double-safe literals
(plain integers gain .0), so int64 extremes compile under -Wall.

Tests: four new gate rejection tests plus a deepObject acceptance
test; runtime test hardened (compiler/Boost skip guards, file-based
output redirection, process-tree termination on timeout) and a new
validation-disabled end-to-end case; loopback driver covers matrix
explode, spaceDelimited, deepObject required, literal ranking,
deferred completions, WWW-Authenticate challenges, HTTP/1.0
mirroring incl. 413, cookie decoding, and duplicate-completion
guarding; locator precedence test now probes a template present in
both embedded dirs.

CI: Windows sample job installs boost-asio/beast/multiprecision
ports (the build failed on missing beast and multiprecision headers).

Docs: README ServerOptions table for readTimeoutSeconds/bodyLimitBytes;
sample regenerated deterministically.

The feature set advertised FormUnencoded/FormMultipart support while
the server never parses those payloads (they degrade to no typed body).
Exclude both parameter features and regenerate the generator docs page.

… variant bodies

Move the 16 chunked OAS 3.1 schema-IR templates from the client-only
embedded dir into cpp-boost-beast-common so the server generator (whose
own dir never carried them) can reach the chunked IR path for large
specs, and pin resolution from both generators with a locator test.

Wipe the inherited DefaultCodegen typeMapping before seeding it, same
as the client generator: AnyType -> oas_any_type_not_mapped is a
placeholder header this family never provides, and the OpenAI corpus
(FunctionToolParam output_schema anyOf) reaches it through a freeform
branch that must resolve to boost::json::value.

Render std::variant, std::optional, and std::monostate bodies in
BodyJson.h: composition-typed responses serialize the active branch via
std::visit, and null branches serialize as JSON null instead of failing
to compile.

…d-body JSON members

Parameter shapes the JSON runtime cannot decode (content-style, form
fields, object/array queries outside deepObject/scalar rules, cookie
containers, heterogeneous enums, enum-class dataTypes) now degrade to a
dropped handler field with a warning instead of rejecting the document,
mirroring the media-type policy so real-world corpora generate code.
The OpenAI spec drove the rules: the classifier keys off the resolved
dataType the templates emit, so parseScalar can never see a type without
an overload.

Request-body recovery: a multipart+JSON body whose JSON member $refs a
generated model now types the handler body exactly (the model's include
is appended via toModelImport when DefaultCodegen did not import it);
models aliased to std::variant degrade to no typed body because
fromJsonLeaf cannot decode unions; a body model colliding with the
generated request struct is namespace-qualified. The model
using-directive flag accounts for recovered bodies. The gate now
rejects only non-deterministic routing (ambiguous templates, ranged
codes). Tests: six degrade rewrites plus four new contracts.

…e the right logger

BodyJson.h declares a std::optional overload but relied on <variant>
transitively providing <optional>; include it directly. The shared model
codegen hardcoded its logger to CppBoostBeastClientCodegen, so server
degrade warnings were attributed to the client class; use getClass().
Regenerated petstore server sample picks up the new include.

… rule

ArchUnitRulesTest requires slf4j Logger fields to be non-public,
non-static and final (PR OpenAPITools#8799); the new assembler logger was static.
Both call sites are instance methods, so the field becomes an instance
logger.

…tests

- Router: tokenize embedded path expressions in one segment; shape keys
  keep literal text distinct from placeholders
- RequestContext held via shared_ptr through the handler/service chain
- Optional request bodies no longer fail presence checks when absent
- Multi-tag operations get per-operation contract type names
- ParamCodecs: float narrowing range checks, exclusive numeric bounds,
  collection/item constraints (new param-container-constraints include),
  strict label/matrix percent-encoded codecs, exact integer comparisons
- Problem JSON: sanitize malformed UTF-8 in error details
- Gate: wildcard response media no longer accepted as JSON; request-body
  schema selected per declared media; form-encoding hard-reject moved to
  a server-side override so the shared model path no longer rejects the
  client corpus; MultiServer feature claim set to false
- Generated CMake: warnings are errors by default (opt-out flag added)
- README quick-start renders real operations and attach sequence
- Runtime regression spec/driver extended to cover all of the above

… regression

The sample workflow ran the runtime test with -pl modules/openapi-generator
alone, so the 7.26.0-SNAPSHOT sibling (openapi-generator-core) could not be
resolved from the snapshot repo on a clean runner checkout. Build the
upstream modules with -am and tolerate modules without the selected test.

…l-closed codecs, review gaps

- BodyJson: unwrap tagged CompositionBranchValue branches so oneOf
  responses whose C++ types collide serialize through std::visit
- ParamCodecs: reject hex floats explicitly, accept ERANGE underflow,
  drop the dead errno store; document the whole-input match
- param-constraints / param-container-constraints: guard std::regex
  construction so an out-of-subset pattern fails closed with 400
  instead of retry-throwing 500 per request (absent/empty skip it)
- Assembler: apiNamespace is constructor-injected (the operations-map
  merge runs after postProcessOperationsWithModels, which made the
  collision guard inert); mixed bodies type the JSON member model even
  when an unparseable member came first; README facts carry
  model-namespace-qualified send types
- Codegen: exclude Host/BasePath global features (never mounted); the
  server overrides the shared form-encoding reject because it degrades
  flattened form fields with a warning instead of aborting
- Workflow: trigger the sample CI on generator, template, and test
  resource changes; add generation/runtime coverage for the new paths

Deterministic re-run of bin/generate-samples.sh and
bin/utils/export_generator.sh after the fix commit: README quick-start
qualifies model response types, BodyJson.h gains the tagged-branch
serializer, ParamCodecs.h gains the hex-float gate, and the feature
table now reports Host/BasePath as unsupported.

- server runtime driver: unicode property-escape fail-closed legs,
  100-continue, oversized-body version mirror, 404 query stripping,
  PORT/HttpServer ownership probes already covered
- exact-number driver: validator-level property-escape refusal incl.
  doubled-backslash literal case
- preserve-additional-properties driver owns its serialized value
  (the old code bound a reference into a destroyed temporary)
- CI triggers widened to shared model-pipeline sources

Regenerated after the review-round template fixes: fail-closed
validator (property escapes), decode resets, required-null rejection,
HTTP two-stage read + interim 100, codecs with JSON wire grammar,
sample README policy notes.

- witness overlap + adjacent-expression codegen rejections
- license-header terminator sanitization
- nullable model body kept typed as std::optional
- HTML-significant route names rendered unescaped
- runtime: body enum/required-null 400 legs (validation-leg gated),
  404 query-strip, stepwise Expect: 100-continue interim proof,
  path-item inherited parameter constraint legs

http::message::contains() only exists since Boost 1.85; the Linux CI
image ships an older Beast and the sample build failed on it. count()
has been available since the first Beast release.

…ed trie

The ambiguous-route gate enumerated candidate witnesses with a
step-budgeted depth-first glob merge. Branchy-but-intersecting pairs
(alternating wildcard/literal layouts like /v/{p}a{p}a{p}a vs
/v/a{p}a{p}a{p}) exhaust the step cap without emitting a witness, so a
real collision could be silently under-reported and shipped as a
runtime-shadowed route.

Replace it with product-NFA trie BFS over (i,j) token positions:
epsilon-closure per level, emitted chars advance at least one side, so
a shortest witness has length at most n+m. Finishing all levels is a
disjointness proof, not a timeout. Regression test drives the old
under-report through to a rejection naming the witness path.

…ct lists, double gates

Four wire-level correctness gaps from the third review round, each with
a loopback driver leg:

- UTF-8 length checks (maxLength/minLength) now validate sequence
  structure, not just lead bytes: overlong encodings, surrogates, and
  out-of-range tails degrade to a strict byte count and cannot be
  smuggled through as one code point (param codecs and the body
  validator share the grammar).
- The body validator's std::wregex path encodes scalars above U+FFFF as
  UTF-16 surrogate pairs on 16-bit wchar_t (Windows); storing the bare
  code point truncated it silently. README documents the platform
  split.
- Expect handling tokenises EVERY repeated Expect field line per
  RFC 9110 5.3, not just the first: an unsupported token on line two
  answers 417 instead of being ignored.
- parseFloatScalar gates against the DESTINATION range for float and
  double alike. Where long double is wider than double (x86 80-bit),
  1e400 parses finite and the old double-only gate handed the service
  an infinity cast out of the schema's range; both platforms now
  answer 400 identically.

Samples regenerated.

Two suppression rules in the product-trie witness search could
"prove" two routable templates disjoint when they genuinely
collide:

- the level-0 accept (both segments matching an empty path
  segment) was filtered out, so pairs colliding only through
  empty captures went unreported;
- every step where BOTH sides merely absorb a char was skipped,
  but a whole-segment capture may not be empty (Router::matches
  refuses it) and absorbs only at index 0, so '/{p}' vs '{q}'
  needed exactly one root both-absorb char to yield a witness.

Allow exactly one both-absorb step from the root state at level 0
(complete: whole-segment captures only need one stretched char,
partial captures may be empty), keep empty candidates in the list,
and let the caller's whole-path Router::matches mirror reject
unverifiable ones. New regression: '/{p}/a/b' vs '/{q}/a{r}/b'
 collide on /c/a/b and must be refused; the old search generated
them.

The repeated-100-continue probe broke out of its read loop as soon
as the 200 status line appeared in the transcript. The body can
split across socket segments (headers and partial body in one read,
the tail in the next), so the 'twice' assertion raced the body and
the probe was flaky under load. Stop only once both the status line
AND the body marker arrived; EOF (Connection: close) still ends the
read as before.

Inside the doubles' exact window every image names exactly one integer,
so a signed destination whose full range fits within it (int32 and
narrower) must accept its own minimum -2^digits; the open lower edge is
only sound for destinations reaching the precision boundary (int64),
whose -2^53 image is ambiguous with -9007199254740993. Keep the upper
edge open everywhere. Native regression covers int32 min/max acceptance
and the int64 -2^53 refusal.

The previous wording implied -2^53 itself is accepted for a narrower
signed destination; the destination-bounds check rejects it as
out-of-range. What is accepted is the destination's own minimum, whose
image is unambiguous inside the exact window. Regenerated both samples.