Summary

The fetch adapter is now aligned with the http adapter for Basic auth: it first respects config.auth, and when that is not provided, it falls back to credentials embedded in the request URL, sets Authorization: Basic ..., and clears any existing authorization header so precedence matches Node behavior.

It also sanitizes the URL by stripping credentials before constructing Request, which prevents the TypeError: Request cannot be constructed from a URL that includes credentials.

Existing test was covering classic http adapter instead of fetch so it was passing which is wrong and is now fixed. New tests cover URL-based auth fallback, decoding of percent-encoded credentials, safe handling of malformed percent-encoding without throwing, and confirmation that the auth option overrides a manually provided Authorization header regardless of header casing.

Checklist

• Tests added or updated (or N/A with reason)
• Docs / types updated if public API changed (index.d.ts and index.d.cts)
• No breaking changes (or called out explicitly above)

Summary by cubic

Fixes Basic auth in the fetch adapter to match http, including URL-embedded credentials (username, password, or password-only). Credentials are stripped from the URL and sent via a UTF‑8‑safe Authorization: Basic ... header to avoid Request construction errors.

Description

• Summary of changes
  • Precedence: config.auth > URL creds; clear any Authorization header (any casing).
  • Decode percent-encoded username/password; keep malformed encodings literal.
  • Support password-only URL creds; parity with http (small http fix included).
  • UTF‑8-safe base64 for username and password; set Authorization: Basic ....
  • Strip creds from URL before creating Request.
  • Lightweight pre-check to avoid parsing URLs without likely creds.
• Reasoning
  • Align adapters, match Node behavior, and prevent fetch URL-with-credentials errors.
• Additional context
  • No API changes; behavior matches http and WHATWG URL.

Docs
Please update /docs/ (and README where relevant) to cover:

• Auth precedence and clearing pre-set Authorization.
• URL credential fallback (incl. password-only), decoding, and malformed handling.
• UTF‑8 handling for both username and password, and stripping credentials before Request.

Testing

• Switched an existing test to target the fetch adapter.
• Added fetch tests for UTF‑8 credentials, URL-based fallback, percent-decoding (valid/malformed), password-only creds, and auth overriding an Authorization header (any casing).
• Added an http test for password-only URL creds.

Semantic version impact
Patch: bug fix and behavior alignment; no public API changes.

^{Written for commit d3d6e60. Summary will update on new commits.}