OpenAPI specification diff checker

Requests and responses are judged in opposite directions, because the consumer sits on the other side of each. Breaking: a removed operation or path, a new required parameter, a request that accepts less (a narrower type, a shrunken enum, a closed additional-properties map), a response that loses a field or value, a removed success status, and authentication added to a call that was public. Non-breaking: new paths, optional parameters, wider request types, extra response properties. Review: everything that depends on the client, like a new response enum value against an exhaustive switch, a new status code, a changed operationId, or a combinator reshuffle. Info: version numbers, server URLs, titles, deprecations, and renamed path parameters.

Known limits:

• OpenAPI 3.x only; Swagger 2.0 documents are refused with a clear message.
• Remote $ref files are never fetched; a reference the tool cannot follow is reported as review, not guessed at.
• Webhooks, callbacks, examples, and link objects are not compared.
• YAML anchors, aliases, merge keys, and tags are refused rather than expanded.
• Changes inside components.schemas surface at every operation that uses them, plus a note when a named schema is added or removed.