[DerManoMann]

Second part of the new shape for 3.0, and the new feature: verifying on the client side, so no framework is needed. It works against a running server, a mock handler or anything else a client can talk to.

$stack = HandlerStack::create();
$stack->push(new OpenApiVerifierMiddleware(OpenApiVerifier::fromSpecification('openapi.yaml')), 'openapi-verifier');

$client = new Client(['handler' => $stack]);
$client->get('/user/1'); // throws OpenApiSchemaMismatchException if it does not match `/user/{id}`

• Adapters\Guzzle\OpenApiVerifierMiddleware verifies when the response promise resolves. A mismatch rejects it, so get() throws, and so does getAsync()->wait().
• Adapters\Psr18\OpenApiVerifyingClient wraps any PSR-18 client, Guzzle's included. Its mismatch exception is not a PSR-18 client exception on purpose, since the request itself was sent.
• OpenApiVerifier::verify() rewinds the body after reading it. Reading left the stream at its end, which nobody noticed while only framework middleware called the verifier. A client's caller reads the body next, and would have got an empty string.

guzzlehttp/guzzle goes into require-dev and suggest. psr/http-client is required, since it only holds interfaces, like psr/http-message.

ClientAdapterTest runs the same cases through Guzzle sync, Guzzle async and the PSR-18 client, using Guzzle's MockHandler, and checks that the body can still be read afterwards. Checked locally with highest and lowest dependencies.