v2.6.0 — Filtered documentation sets + clean-by-default output

Filtered documentation sets

A documentation set can now emit only a subset of your API — e.g. an integration spec containing just the endpoints an API key can call. Operations are matched to their Laravel route and selected by a pluggable filter; the default discriminator is route middleware (ground truth), not hand-written security annotations.

'integration' => [
    'paths'  => ['docs_json' => 'api-docs-integration.json'],
    'filter' => ['include' => [['middleware' => 'auth.apikey']]],
    'security_override' => [['apiKey' => []]],
],

• Built-in filters: middleware, tag, path, operationId, plus a custom-class escape hatch (OperationFilter).
• Action-first route resolution (controller action → route), with a path-signature fallback for closure / annotation-only operations.
• security_override forces consistent auth on a filtered set and restricts advertised security schemes.
• Unmatched operations are reported — openapi:generate prints a kept / dropped / unmatched summary so annotation-vs-route drift is never silent.

Clean output by default

Every generated document is now pruned to only the schemas, parameters, responses, security schemes and tags its operations actually reference — specs no longer ship unused schemas. Filtered sets always prune.

Behavior change: the default/full spec now drops DTOs (and annotation schemas) that no documented operation references. Set prune_unused_components => false on a set to restore the previous "include everything" behavior.

See the README for full configuration.