2.0 ** attempt_index raises OverflowError in Python for attempt_index >= 1024
rather than saturating to math.inf as the old docstring claimed. Catch the
OverflowError and clamp the ceiling directly to max_delay, which is the
correct clamped result. Tests added to pin both the no-raise and the exact
max_delay clamp behaviours.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

When a server's Retry-After header exceeds max_delay, the middleware
previously consumed a budget token before giving up, allowing a
Retry-After flood to silently drain shared-budget capacity. Move the
retry_after > max_delay guard before try_withdraw() in both AsyncRetry
and Retry so the token is only spent when a real retry will happen.

Adds test_retry_after_exceeds_max_delay_does_not_consume_budget_token
(async) and …_sync (sync) to pin the invariant.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

For URLs like `http://user:pass@/path` (credentials but no hostname),
the previous reconstruction from `parts.hostname` yielded an empty
netloc, causing `urlunsplit` to emit `http:///path`.  Fix by slicing
the `user:pass@` prefix directly off `parts.netloc`; when the remainder
is empty (no real host), reconstruct without an authority section to
produce `http:/path` instead.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

…spec absent

When msgspec is not installed, `_contains_custom_type` would raise
`NameError: name 'msgspec' is not defined` rather than the friendly
`ImportError`. Added an early guard that raises `ImportError(MISSING_DEPENDENCY_MESSAGE)`
when `import_checker.is_msgspec_installed` is False, matching the
pattern used in `MsgspecDecoder.__init__`.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

…g caveat

The module docstring said "asyncio-safe" without noting that a sync thread
holding the threading.Lock can briefly block the event-loop thread. Added
clarification that the critical section is intentionally tiny to bound
latency, while preserving the core safety guarantee (no torn state).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Factor `_is_replayable_type` shared helper so both async and sync
detectors use the same exclusion list. `_is_streaming_body_async` now
returns True when the body has `__iter__` and is not a replayable type
(bytes/bytearray/memoryview/str/dict/list/tuple), closing the gap where
a sync generator passed to AsyncClient bypassed the streaming-body
marker and the AsyncRetry replay guard.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

…r-import leakage

Without __all__, `from httpware.middleware import *` would expose Awaitable,
Callable, Protocol, TypeAlias, runtime_checkable, httpx2, chain, and
resilience. Added explicit __all__ listing exactly the 10 public names
(protocols + phase decorators). Tests added to test_public_api.py to guard
this contract.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

float(int("9" * 400)) raises OverflowError (not ValueError) in Python,
crashing the retry loop when a server sends a pathologically large
Retry-After integer string. Widen the except clause to
(ValueError, OverflowError) so oversized values fall back to jitter
backoff rather than propagating unhandled.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Follow-up reconciliation after the parallel correctness fixes:
- _strip_userinfo's no-host fix only covered the no-query case; _mask_query's
  urlunsplit re-introduced http:///path when a sensitive query was masked.
  Factor a shared _reassemble() helper used by both, so the empty-authority
  triple-slash is avoided everywhere (normal URLs stay byte-identical).
- hoist a function-body import in the msgspec test (ruff PLC0415) and use the
  project's # ty: ignore form.
- cover the empty-netloc query/fragment branches, the @-in-path guard, and
  mark the never-iterated sync-generator test body no-cover.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>