feat(story-2.4): with_options(auth=) + _from_view tracks user_middleware/auth

with_options now accepts `auth: AuthValue | object = _UNSET`. View
construction recomposes the chain from the new (or inherited) user
middleware + auth value: `with_options(middleware=...)` preserves auth;
`with_options(auth=...)` preserves user middleware; both can change
together; neither change loses the auth/middleware that wasn't passed.

_from_view gains `user_middleware=` and `auth=` keyword params so the
view client inherits the raw inputs (not just the composed result) and
its own with_options call works correctly.

Three new wiring tests cover: auth runs INSIDE user middleware (user
sees request before auth header; transport sees it after); with_options
replaces auth in the view while preserving the parent; with_options
replacing middleware preserves auth.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: lesnik512

src/httpware/client.py

@@ -598,6 +598,7 @@ def with_options(
         timeout: Timeout | float | None = _UNSET,
         decoder: ResponseDecoder | None = _UNSET,
         middleware: Sequence[Middleware] | None = _UNSET,
+        auth: AuthValue | object = _UNSET,
     ) -> "AsyncClient":
         """Return a new AsyncClient sharing the same transport with overridden config.
 
@@ -619,18 +620,46 @@ def with_options(
             changes["timeout"] = _normalize_timeout(timeout)
         if decoder is not _UNSET:
             changes["decoder"] = decoder or PydanticDecoder()
+
+        new_user_middleware = self._user_middleware
         if middleware is not _UNSET:
-            changes["middleware"] = tuple(middleware) if middleware is not None else ()
+            new_user_middleware = tuple(middleware) if middleware is not None else ()
+
+        new_auth: AuthValue = self._auth
+        if auth is not _UNSET:
+            new_auth = auth  # ty: ignore[invalid-assignment]
+
+        new_auth_middleware = _normalize_auth(new_auth)
+        new_composed: tuple[Middleware, ...] = (
+            new_user_middleware
+            if new_auth_middleware is None
+            else (*new_user_middleware, new_auth_middleware)
+        )
+        changes["middleware"] = new_composed
 
         new_config = dataclasses.replace(self._config, **changes)
-        return AsyncClient._from_view(new_config, self._transport)
+        return AsyncClient._from_view(
+            new_config,
+            self._transport,
+            user_middleware=new_user_middleware,
+            auth=new_auth,
+        )
 
     @classmethod
-    def _from_view(cls, config: ClientConfig, transport: Transport) -> "AsyncClient":
+    def _from_view(
+        cls,
+        config: ClientConfig,
+        transport: Transport,
+        *,
+        user_middleware: tuple[Middleware, ...],
+        auth: AuthValue,
+    ) -> "AsyncClient":
         """Construct a view sharing an existing transport. Bypasses __init__."""
         client = cls.__new__(cls)
         client._config = config  # noqa: SLF001
         client._transport = transport  # noqa: SLF001
         client._dispatch = compose(config.middleware, transport)  # noqa: SLF001
         client._owns_transport = False  # noqa: SLF001
+        client._user_middleware = user_middleware  # noqa: SLF001
+        client._auth = auth  # noqa: SLF001
         return client

tests/test_client_middleware_wiring.py

@@ -1,5 +1,7 @@
 """Unit tests for AsyncClient middleware wiring through compose() and with_options."""
 
+from collections.abc import Mapping
+
 from httpware import AsyncClient, RecordedTransport
 from httpware.middleware import Middleware, Next
 from httpware.request import Request
@@ -112,3 +114,60 @@ def decode(self, content: bytes, model: type) -> object:  # pragma: no cover  #
     client = AsyncClient(transport=transport)
     view = client.with_options(decoder=new_decoder)
     assert view._config.decoder is new_decoder  # noqa: SLF001
+
+
+async def test_auth_runs_inside_user_middleware() -> None:
+    transport = RecordedTransport(
+        default=Response(status=200, headers={}, content=b"", url="/", elapsed=0.0)
+    )
+
+    user_seen_headers: list[Mapping[str, str]] = []
+
+    class _UserOuter:
+        async def __call__(self, request: Request, next: Next) -> Response:  # noqa: A002
+            user_seen_headers.append(dict(request.headers))
+            return await next(request)
+
+    client = AsyncClient(transport=transport, middleware=[_UserOuter()], auth="tok")
+    await client.get("/foo")
+
+    # User middleware saw the request BEFORE auth header was applied.
+    assert "Authorization" not in user_seen_headers[0]
+    # Transport saw the request WITH the auth header.
+    assert transport.last_request is not None
+    assert transport.last_request.headers["Authorization"] == "Bearer tok"
+
+
+async def test_with_options_auth_replaces_auth_middleware() -> None:
+    transport = RecordedTransport(
+        default=Response(status=200, headers={}, content=b"", url="/", elapsed=0.0)
+    )
+    client = AsyncClient(transport=transport, auth="parent")
+    view = client.with_options(auth="view")
+
+    await view.get("/foo")
+    assert transport.last_request is not None
+    assert transport.last_request.headers["Authorization"] == "Bearer view"
+
+    await client.get("/foo")
+    assert transport.last_request is not None
+    assert transport.last_request.headers["Authorization"] == "Bearer parent"
+
+
+async def test_with_options_middleware_keeps_existing_auth() -> None:
+    transport = RecordedTransport(
+        default=Response(status=200, headers={}, content=b"", url="/", elapsed=0.0)
+    )
+
+    class _M:
+        async def __call__(self, request: Request, next: Next) -> Response:  # noqa: A002
+            return await next(request)
+
+    m1 = _M()
+    m2 = _M()
+    client = AsyncClient(transport=transport, auth="tok", middleware=[m1])
+    view = client.with_options(middleware=[m2])
+
+    await view.get("/foo")
+    assert transport.last_request is not None
+    assert transport.last_request.headers["Authorization"] == "Bearer tok"