[Kayvan-Zahiri]

URL-based configuration reads username and password directly from the URL object, whose properties remain percent-encoded. This sends encoded characters in the Basic authentication header and rejects otherwise valid credentials containing characters such as @, /, spaces, or percent signs.

Decode both URL userinfo fields once before storing them. Three request-level regressions assert the exact Basic header and exposed configuration. A password containing literal %2F verifies that it is not decoded a second time.

Validation: all three regressions fail before the fix; all45 tests pass afterward. npm test builds the ESM and CommonJS variants before exercising the real driver with Undici's network-disabled MockAgent. npm run lint and git diff --check pass. Tested on Node24.1.0 with npm ci lockfile dependencies; the Node22/24 CI matrix and hosted database authentication were not run. All credentials in tests are synthetic.