@zereight/mcp-gitlab 2.1.63 → 2.1.65

package/build/index.js

@@ -89,7 +89,7 @@ import { formatPrometheusMetrics } from "./server/metrics.js";
 import { SERVER_VERSION } from "./server/version.js";
 import { isInitializationRequestBody, isUnauthenticatedDiscoveryRequestBody, readAcceptHeader, readMcpSessionIdHeader, redactSessionIdForLog, } from "./server/request-helpers.js";
 export { readMcpSessionIdHeader } from "./server/request-helpers.js";
-import { normalizeGitLabApiUrl } from "./utils/url.js";
+import { encodeGitLabPath, encodeGitLabPathSegment, normalizeGitLabApiUrl, } from "./utils/url.js";
 import { estimateMergeCommitCount, filterDiffsByPatterns, openSafeOutputWriteStream, readSafeExistingFile, summarizeWebhookEvents, } from "./utils/helpers.js";
 import { graphqlQueryContainsWriteOperation, graphqlQueryContainsDeleteOperation, } from "./utils/graphql-query.js";
 import { resolveNestedWikiUpdateTitle } from "./utils/wiki-title.js";
@@ -98,9 +98,10 @@ import { redactSensitiveGitLabFields } from "./utils/redact-sensitive.js";
 import { createMaskingPolicyResolver, getManagedMaskingProjectIds, } from "./masking/index.js";
 import { checkForNewVersion } from "./utils/version-check.js";
 import { assertGitLabVersionAtLeast } from "./utils/gitlab-version-gate.js";
+import { fetchWithValidatedRedirects } from "./utils/safe-redirect-fetch.js";
 import { parseGitLabVersionApiResponse, } from "./utils/gitlab-instance-version.js";
 import { buildBulkPublishDraftNotesBody, needsGitLab19_2BulkPublish, } from "./utils/bulk-publish-options.js";
-import { cleanMutuallyExclusiveIdUsernameOptions, LIST_MERGE_REQUESTS_ID_USERNAME_PAIRS, sanitizeToolArguments, } from "./utils/tool-args.js";
+import { appendFilterParam, appendFilterParams, cleanMutuallyExclusiveIdUsernameOptions, dropBlankArrayEntries, isBlankFilterValue, LIST_MERGE_REQUESTS_ID_USERNAME_PAIRS, sanitizeToolArguments, } from "./utils/tool-args.js";
 import { parseSearchReplaceBlocks, applySearchReplace, applyUnifiedDiff, } from "./utils/patch-helper.js";
 import { requireBearerAuth } from "@modelcontextprotocol/sdk/server/auth/middleware/bearerAuth.js";
 import { GitLabClientPool } from "./gitlab-client-pool.js";
@@ -829,7 +830,7 @@ async function ensureValidOAuthToken() {
         throw error;
     }
 }
-// Permission mode gate: readonly exposes only read tools; modify blocks delete tools; full allows all
+// Permission mode gate: readonly exposes only read tools; modify blocks delete/teardown tools; full allows all
 function isToolAllowedByPermissionMode(toolName) {
     switch (GITLAB_PERMISSION_MODE) {
         case "readonly":
@@ -1165,6 +1166,21 @@ const getFetchConfig = () => {
         dispatcher,
     };
 };
+/**
+ * Options for the download sinks that stream a file through `fetchWithValidatedRedirects`.
+ *
+ * GitLab answers a release asset, a job artifact or an uploaded file with a redirect to
+ * its object storage, so those hops leave the origin and must be validated. The client
+ * split matters as much as the headers: the wrapped client adds the cookie jar and a
+ * fresh `Authorization` on a `401`, so a hop whose credentials were withheld has to use
+ * plain undici instead.
+ */
+const downloadRedirectOptions = () => ({
+    ...getFetchConfig(),
+    fetchImpl: fetch,
+    unauthenticatedFetchImpl: undiciFetch,
+    isTrustedRedirectHost: isTrustedGitLabRedirectHost,
+});
 // Compute at startup
 const enabledToolsets = parseEnabledToolsets(GITLAB_TOOLSETS_RAW);
 const individuallyEnabledTools = parseIndividualTools(GITLAB_TOOLS_RAW);
@@ -1195,23 +1211,6 @@ function parseAllowedGitLabApiUrls(value) {
         .map(toAllowedGitLabApiUrl)
         .filter((entry) => Boolean(entry));
 }
-function encodeGitLabPathSegment(value) {
-    const segment = String(value);
-    let decodedSegment;
-    try {
-        decodedSegment = decodeURIComponent(segment);
-    }
-    catch {
-        decodedSegment = segment;
-    }
-    if (decodedSegment === "." || decodedSegment === "..") {
-        throw new Error("GitLab URL path segments cannot be '.' or '..'");
-    }
-    return encodeURIComponent(decodedSegment);
-}
-function encodeGitLabPath(value) {
-    return value.split("/").map(encodeGitLabPathSegment).join("/");
-}
 function resolveTrustedGitLabApiUrl(value) {
     const parsed = new URL(normalizeGitLabApiUrl(value));
     if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
@@ -1238,6 +1237,17 @@ for (const { host, apiUrl } of [
         GITLAB_ALLOWED_API_URLS_BY_HOST.set(host, apiUrl);
     }
 }
+/**
+ * Redirects from the GitLab API to operator-declared GitLab hosts are followed even
+ * when the host resolves to a private address (self-hosted instances and their
+ * storage may live on an internal network), and those hosts keep receiving the
+ * request credentials. Every other redirect target must resolve to a public
+ * address and is fetched without credentials.
+ *
+ * The lookup key is `URL.host`, which keeps a non-default port, matching how this
+ * map is built from GITLAB_API_URL / GITLAB_ALLOWED_HOSTS.
+ */
+const isTrustedGitLabRedirectHost = (host) => GITLAB_ALLOWED_API_URLS_BY_HOST.has(host);
 const GITLAB_PROJECT_ID = process.env.GITLAB_PROJECT_ID;
 const GITLAB_ALLOWED_PROJECT_IDS = process.env.GITLAB_ALLOWED_PROJECT_IDS?.split(",")
     .map(id => id.trim())
@@ -1364,7 +1374,7 @@ function rejectIfProjectScopedDeployment(toolName) {
 async function forkProject(projectId, namespace) {
     projectId = decodeURIComponent(projectId); // Decode project ID
     const effectiveProjectId = getEffectiveProjectId(projectId);
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(effectiveProjectId)}/fork`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(effectiveProjectId)}/fork`);
     if (namespace) {
         url.searchParams.append("namespace", namespace);
     }
@@ -1391,7 +1401,7 @@ async function forkProject(projectId, namespace) {
 async function createBranch(projectId, options) {
     projectId = decodeURIComponent(projectId); // Decode project ID
     const effectiveProjectId = getEffectiveProjectId(projectId);
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(effectiveProjectId)}/repository/branches`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(effectiveProjectId)}/repository/branches`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
         method: "POST",
@@ -1413,7 +1423,7 @@ async function createBranch(projectId, options) {
 async function getDefaultBranchRef(projectId) {
     projectId = decodeURIComponent(projectId); // Decode project ID
     const effectiveProjectId = getEffectiveProjectId(projectId);
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(effectiveProjectId)}`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(effectiveProjectId)}`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
     });
@@ -1433,12 +1443,12 @@ async function getDefaultBranchRef(projectId) {
 async function getFileContents(projectId, filePath, ref) {
     const decodedProjectId = projectId ? decodeURIComponent(projectId) : "";
     const effectiveProjectId = getEffectiveProjectId(decodedProjectId);
-    const encodedPath = encodeURIComponent(filePath);
+    const encodedPath = encodeGitLabPathSegment(filePath);
     // Fall back to default branch if ref is not provided
     if (!ref) {
         ref = await getDefaultBranchRef(decodedProjectId);
     }
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(effectiveProjectId)}/repository/files/${encodedPath}`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(effectiveProjectId)}/repository/files/${encodedPath}`);
     url.searchParams.append("ref", ref);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
@@ -1464,7 +1474,7 @@ async function getFileContents(projectId, filePath, ref) {
 async function createIssue(projectId, options) {
     projectId = decodeURIComponent(projectId); // Decode project ID
     const effectiveProjectId = getEffectiveProjectId(projectId);
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(effectiveProjectId)}/issues`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(effectiveProjectId)}/issues`);
     // Build request body, converting labels array to comma-separated string
     const body = { ...options };
     if (body.labels && Array.isArray(body.labels)) {
@@ -1499,30 +1509,33 @@ async function listIssues(projectId, options = {}) {
         // resolve the default project (or fail for a multi-project allowlist)
         const decodedProjectId = projectId ? decodeURIComponent(projectId) : "";
         const effectiveProjectId = getEffectiveProjectId(decodedProjectId);
-        url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(effectiveProjectId)}/issues`);
+        url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(effectiveProjectId)}/issues`);
     }
     else {
         url = new URL(`${getEffectiveApiUrl()}/issues`);
     }
     // Add all query parameters
     Object.entries(options).forEach(([key, value]) => {
-        if (value !== undefined) {
-            const keys = ["labels", "assignee_username"];
-            if (keys.includes(key)) {
-                if (Array.isArray(value)) {
-                    // Handle array of labels
-                    value.forEach(label => {
-                        url.searchParams.append(`${key}[]`, label.toString());
-                    });
-                }
-                else if (value) {
-                    url.searchParams.append(`${key}[]`, value.toString());
-                }
+        // Drop blank entries inside arrays so ["", "bug"] behaves like the scalar guard below
+        const normalized = dropBlankArrayEntries(value);
+        if (isBlankFilterValue(normalized)) {
+            return;
+        }
+        const keys = ["labels", "assignee_username"];
+        if (keys.includes(key)) {
+            if (Array.isArray(normalized)) {
+                // Handle array of labels
+                normalized.forEach(label => {
+                    url.searchParams.append(`${key}[]`, String(label));
+                });
             }
             else {
-                url.searchParams.append(key, String(value));
+                url.searchParams.append(`${key}[]`, String(normalized));
             }
         }
+        else {
+            url.searchParams.append(key, String(normalized));
+        }
     });
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
@@ -1533,11 +1546,7 @@ async function listIssues(projectId, options = {}) {
 }
 async function listTodos(options = {}) {
     const url = new URL(`${getEffectiveApiUrl()}/todos`);
-    Object.entries(options).forEach(([key, value]) => {
-        if (value !== undefined) {
-            url.searchParams.append(key, String(value));
-        }
-    });
+    appendFilterParams(url.searchParams, options);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
     });
@@ -1566,20 +1575,22 @@ async function markAllTodosDone() {
  */
 function appendMergeRequestFilters(url, options) {
     Object.entries(options).forEach(([key, value]) => {
-        if (value === undefined) {
+        // Drop blank entries inside arrays so ["", "bug"] behaves like the scalar guard below
+        const normalized = dropBlankArrayEntries(value);
+        if (isBlankFilterValue(normalized)) {
             return;
         }
-        if (key === "labels" && Array.isArray(value)) {
-            url.searchParams.append(key, value.join(","));
+        if (key === "labels" && Array.isArray(normalized)) {
+            url.searchParams.append(key, normalized.join(","));
         }
-        else if (key === "approved_by_usernames" && Array.isArray(value)) {
+        else if (key === "approved_by_usernames" && Array.isArray(normalized)) {
             // GitLab expects array-bracket form: approved_by_usernames[]=alice&approved_by_usernames[]=bob
-            for (const v of value) {
+            for (const v of normalized) {
                 url.searchParams.append(`${key}[]`, String(v));
             }
         }
         else {
-            url.searchParams.append(key, String(value));
+            url.searchParams.append(key, String(normalized));
         }
     });
 }
@@ -1599,7 +1610,7 @@ async function listMergeRequests(projectId, options = {}) {
         // In strict scope, never fall back to the instance-wide endpoint;
         // resolve the default project (or fail for a multi-project allowlist)
         const effectiveProjectId = getEffectiveProjectId(decodedProjectId);
-        url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(effectiveProjectId)}/merge_requests`);
+        url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(effectiveProjectId)}/merge_requests`);
     }
     else {
         url = new URL(`${getEffectiveApiUrl()}/merge_requests`);
@@ -1621,7 +1632,7 @@ async function listMergeRequests(projectId, options = {}) {
  */
 async function listGroupMergeRequests(groupId, options = {}) {
     const decodedGroupId = decodeURIComponent(groupId);
-    const url = new URL(`${getEffectiveApiUrl()}/groups/${encodeURIComponent(decodedGroupId)}/merge_requests`);
+    const url = new URL(`${getEffectiveApiUrl()}/groups/${encodeGitLabPathSegment(decodedGroupId)}/merge_requests`);
     appendMergeRequestFilters(url, options);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
@@ -1640,7 +1651,7 @@ async function listGroupMergeRequests(groupId, options = {}) {
  */
 async function getIssue(projectId, issueIid) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/issues/${encodeGitLabPathSegment(issueIid)}`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/issues/${encodeGitLabPathSegment(issueIid)}`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
     });
@@ -1659,7 +1670,7 @@ async function getIssue(projectId, issueIid) {
  */
 async function updateIssue(projectId, issueIid, options) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/issues/${encodeGitLabPathSegment(issueIid)}`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/issues/${encodeGitLabPathSegment(issueIid)}`);
     // Convert labels array to comma-separated string if present
     const body = { ...options };
     if (body.labels && Array.isArray(body.labels)) {
@@ -1684,7 +1695,7 @@ async function updateIssue(projectId, issueIid, options) {
  */
 async function deleteIssue(projectId, issueIid) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/issues/${encodeGitLabPathSegment(issueIid)}`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/issues/${encodeGitLabPathSegment(issueIid)}`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
         method: "DELETE",
@@ -2297,7 +2308,7 @@ async function resolveProjectOrGroupPath(projectId) {
     }
     const effectiveProjectId = getEffectiveProjectId(requestedProjectId);
     if (explicitKind === "group") {
-        const groupUrl = new URL(`${getEffectiveApiUrl()}/groups/${encodeURIComponent(effectiveProjectId)}`);
+        const groupUrl = new URL(`${getEffectiveApiUrl()}/groups/${encodeGitLabPathSegment(effectiveProjectId)}`);
         const groupResponse = await fetch(groupUrl.toString(), {
             ...getFetchConfig(),
         });
@@ -2305,7 +2316,7 @@ async function resolveProjectOrGroupPath(projectId) {
         const group = await groupResponse.json();
         return { path: group.full_path, kind: "group" };
     }
-    const projectUrl = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(effectiveProjectId)}`);
+    const projectUrl = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(effectiveProjectId)}`);
     const projectResponse = await fetch(projectUrl.toString(), {
         ...getFetchConfig(),
     });
@@ -2317,7 +2328,7 @@ async function resolveProjectOrGroupPath(projectId) {
         !explicitKind &&
         getEffectiveAllowedProjectIds().length === 0 &&
         !/^\d+$/.test(effectiveProjectId)) {
-        const groupUrl = new URL(`${getEffectiveApiUrl()}/groups/${encodeURIComponent(effectiveProjectId)}`);
+        const groupUrl = new URL(`${getEffectiveApiUrl()}/groups/${encodeGitLabPathSegment(effectiveProjectId)}`);
         const groupResponse = await fetch(groupUrl.toString(), {
             ...getFetchConfig(),
         });
@@ -3058,7 +3069,7 @@ async function updateWorkItem(projectId, iid, options) {
  */
 async function listIssueLinks(projectId, issueIid) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/issues/${encodeGitLabPathSegment(issueIid)}/links`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/issues/${encodeGitLabPathSegment(issueIid)}/links`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
     });
@@ -3077,7 +3088,7 @@ async function listIssueLinks(projectId, issueIid) {
  */
 async function getIssueLink(projectId, issueIid, issueLinkId) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/issues/${encodeGitLabPathSegment(issueIid)}/links/${encodeGitLabPathSegment(issueLinkId)}`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/issues/${encodeGitLabPathSegment(issueIid)}/links/${encodeGitLabPathSegment(issueLinkId)}`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
     });
@@ -3099,7 +3110,7 @@ async function getIssueLink(projectId, issueIid, issueLinkId) {
 async function createIssueLink(projectId, issueIid, targetProjectId, targetIssueIid, linkType = "relates_to") {
     projectId = decodeURIComponent(projectId); // Decode project ID
     targetProjectId = decodeURIComponent(targetProjectId); // Decode target project ID as well
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/issues/${encodeGitLabPathSegment(issueIid)}/links`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/issues/${encodeGitLabPathSegment(issueIid)}/links`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
         method: "POST",
@@ -3124,7 +3135,7 @@ async function createIssueLink(projectId, issueIid, targetProjectId, targetIssue
  */
 async function deleteIssueLink(projectId, issueIid, issueLinkId) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/issues/${encodeGitLabPathSegment(issueIid)}/links/${encodeGitLabPathSegment(issueLinkId)}`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/issues/${encodeGitLabPathSegment(issueIid)}/links/${encodeGitLabPathSegment(issueLinkId)}`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
         method: "DELETE",
@@ -3141,7 +3152,7 @@ async function deleteIssueLink(projectId, issueIid, issueLinkId) {
  */
 async function createMergeRequest(projectId, options) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/merge_requests`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
         method: "POST",
@@ -3183,7 +3194,7 @@ async function createMergeRequest(projectId, options) {
  */
 async function listDiscussions(projectId, resourceType, resourceIid, options = {}) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/${resourceType}/${encodeGitLabPathSegment(resourceIid)}/discussions`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/${resourceType}/${encodeGitLabPathSegment(resourceIid)}/discussions`);
     // Add query parameters for pagination and sorting
     if (options.page) {
         url.searchParams.append("page", options.page.toString());
@@ -3247,7 +3258,7 @@ async function listIssueDiscussions(projectId, issueIid, options = {}) {
 }
 async function deleteMergeRequestDiscussionNote(projectId, mergeRequestIid, discussionId, noteId) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/discussions/${encodeGitLabPathSegment(discussionId)}/notes/${encodeGitLabPathSegment(noteId)}`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/discussions/${encodeGitLabPathSegment(discussionId)}/notes/${encodeGitLabPathSegment(noteId)}`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
         method: "DELETE",
@@ -3271,7 +3282,7 @@ async function deleteMergeRequestDiscussionNote(projectId, mergeRequestIid, disc
  */
 async function updateMergeRequestDiscussionNote(projectId, mergeRequestIid, discussionId, noteId, body, resolved) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/discussions/${encodeGitLabPathSegment(discussionId)}/notes/${encodeGitLabPathSegment(noteId)}`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/discussions/${encodeGitLabPathSegment(discussionId)}/notes/${encodeGitLabPathSegment(noteId)}`);
     // Only one of body or resolved can be sent according to GitLab API
     const payload = {};
     if (body !== undefined) {
@@ -3317,7 +3328,7 @@ async function updateMergeRequestDiscussionNote(projectId, mergeRequestIid, disc
  */
 async function updateIssueNote(projectId, issueIid, discussionId, noteId, body, resolved) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/issues/${encodeGitLabPathSegment(issueIid)}/discussions/${encodeGitLabPathSegment(discussionId)}/notes/${encodeGitLabPathSegment(noteId)}`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/issues/${encodeGitLabPathSegment(issueIid)}/discussions/${encodeGitLabPathSegment(discussionId)}/notes/${encodeGitLabPathSegment(noteId)}`);
     // Only one of body or resolved can be sent according to GitLab API
     const payload = {};
     if (body !== undefined) {
@@ -3346,7 +3357,7 @@ async function updateIssueNote(projectId, issueIid, discussionId, noteId, body,
  */
 async function createIssueNote(projectId, issueIid, discussionId, body, createdAt) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const basePath = `${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/issues/${encodeGitLabPathSegment(issueIid)}`;
+    const basePath = `${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/issues/${encodeGitLabPathSegment(issueIid)}`;
     const url = new URL(discussionId ? `${basePath}/discussions/${encodeGitLabPathSegment(discussionId)}/notes` : `${basePath}/notes`);
     const payload = { body };
     if (createdAt) {
@@ -3374,7 +3385,7 @@ async function createIssueNote(projectId, issueIid, discussionId, body, createdA
  */
 async function createMergeRequestDiscussionNote(projectId, mergeRequestIid, discussionId, body, createdAt) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/discussions/${encodeGitLabPathSegment(discussionId)}/notes`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/discussions/${encodeGitLabPathSegment(discussionId)}/notes`);
     const payload = { body };
     if (createdAt) {
         payload.created_at = createdAt;
@@ -3390,7 +3401,7 @@ async function createMergeRequestDiscussionNote(projectId, mergeRequestIid, disc
 }
 async function createMergeRequestNote(projectId, mergeRequestIid, body) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/notes`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/notes`);
     const payload = {
         id: projectId,
         merge_request_iid: mergeRequestIid,
@@ -3407,7 +3418,7 @@ async function createMergeRequestNote(projectId, mergeRequestIid, body) {
 }
 async function deleteMergeRequestNote(projectId, mergeRequestIid, noteId) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/notes/${encodeGitLabPathSegment(noteId)}`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/notes/${encodeGitLabPathSegment(noteId)}`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
         method: "DELETE",
@@ -3420,7 +3431,7 @@ async function deleteMergeRequestNote(projectId, mergeRequestIid, noteId) {
 // --- Emoji Reactions (REST) ---
 function buildAwardEmojiPath(entity, projectId, entityIid, opts) {
     projectId = decodeURIComponent(projectId);
-    const pp = encodeURIComponent(getEffectiveProjectId(projectId));
+    const pp = encodeGitLabPathSegment(getEffectiveProjectId(projectId));
     let path = `${getEffectiveApiUrl()}/projects/${pp}/${entity}/${encodeGitLabPathSegment(entityIid)}`;
     if (opts?.noteId) {
         path = opts.discussionId
@@ -3455,7 +3466,7 @@ async function deleteRestAwardEmoji(path) {
 }
 async function getMergeRequestNote(projectId, mergeRequestIid, noteId) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/notes/${encodeGitLabPathSegment(noteId)}`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/notes/${encodeGitLabPathSegment(noteId)}`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
         method: "GET",
@@ -3466,7 +3477,7 @@ async function getMergeRequestNote(projectId, mergeRequestIid, noteId) {
 }
 async function getMergeRequestDiscussion(projectId, mergeRequestIid, discussionId) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/discussions/${encodeGitLabPathSegment(discussionId)}`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/discussions/${encodeGitLabPathSegment(discussionId)}`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
         method: "GET",
@@ -3477,7 +3488,7 @@ async function getMergeRequestDiscussion(projectId, mergeRequestIid, discussionI
 }
 async function getMergeRequestNotes(projectId, mergeRequestIid, sort, order_by, per_page, page) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/notes`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/notes`);
     if (sort) {
         url.searchParams.append("sort", sort);
     }
@@ -3500,7 +3511,7 @@ async function getMergeRequestNotes(projectId, mergeRequestIid, sort, order_by,
 }
 async function updateMergeRequestNote(projectId, mergeRequestIid, noteId, body) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/notes/${encodeGitLabPathSegment(noteId)}`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/notes/${encodeGitLabPathSegment(noteId)}`);
     const payload = {
         id: projectId,
         merge_request_iid: mergeRequestIid,
@@ -3530,8 +3541,8 @@ async function updateMergeRequestNote(projectId, mergeRequestIid, noteId, body)
  */
 async function createOrUpdateFile(projectId, filePath, content, commitMessage, branch, previousPath, last_commit_id, commit_id, encoding) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const encodedPath = encodeURIComponent(filePath);
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/repository/files/${encodedPath}`);
+    const encodedPath = encodeGitLabPathSegment(filePath);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/repository/files/${encodedPath}`);
     const resolvedEncoding = encoding ?? GITLAB_REPO_FILE_ENCODING;
     const body = {
         branch,
@@ -3602,7 +3613,7 @@ async function createOrUpdateFile(projectId, filePath, content, commitMessage, b
  */
 async function createCommit(projectId, message, branch, actions) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/repository/commits`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/repository/commits`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
         method: "POST",
@@ -3671,7 +3682,7 @@ async function searchBlobs(params) {
     let basePath;
     if (params.project_id) {
         const decodedProjectId = decodeURIComponent(params.project_id);
-        const projectId = encodeURIComponent(getEffectiveProjectId(decodedProjectId));
+        const projectId = encodeGitLabPathSegment(getEffectiveProjectId(decodedProjectId));
         basePath = `${getEffectiveApiUrl()}/projects/${projectId}/search`;
     }
     else if (params.group_id) {
@@ -3749,11 +3760,11 @@ async function getMergeRequest(projectId, mergeRequestIid, branchName) {
     projectId = decodeURIComponent(projectId); // Decode project ID
     let url;
     if (mergeRequestIid) {
-        url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}`);
+        url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}`);
         url.searchParams.append("include_diverged_commits_count", "true");
     }
     else if (branchName) {
-        url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests?source_branch=${encodeURIComponent(branchName)}`);
+        url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/merge_requests?source_branch=${encodeURIComponent(branchName)}`);
     }
     else {
         throw new Error("Either mergeRequestIid or branchName must be provided");
@@ -3771,7 +3782,7 @@ async function getMergeRequest(projectId, mergeRequestIid, branchName) {
     return GitLabMergeRequestSchema.parse(data);
 }
 async function getMergeRequestSourceCommitCount(projectId, mergeRequestIid) {
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/commits`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/commits`);
     url.searchParams.append("per_page", "100");
     let totalCount = 0;
     let page = 1;
@@ -3799,12 +3810,8 @@ async function getMergeRequestSourceCommitCount(projectId, mergeRequestIid) {
 }
 async function listMergeRequestPipelines(projectId, mergeRequestIid, options = {}) {
     projectId = decodeURIComponent(projectId);
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/pipelines`);
-    Object.entries(options).forEach(([key, value]) => {
-        if (value !== undefined) {
-            url.searchParams.append(key, value.toString());
-        }
-    });
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/pipelines`);
+    appendFilterParams(url.searchParams, options);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
     });
@@ -3813,7 +3820,7 @@ async function listMergeRequestPipelines(projectId, mergeRequestIid, options = {
     return z.array(GitLabMergeRequestPipelineSchema).parse(data);
 }
 async function getProjectMergeMethod(projectId) {
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
     });
@@ -4000,7 +4007,7 @@ async function getMergeRequestDiffs(projectId, mergeRequestIid, branchName, view
         const mergeRequest = await getMergeRequest(projectId, undefined, branchName);
         mergeRequestIid = mergeRequest.iid;
     }
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/changes`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/changes`);
     if (view) {
         url.searchParams.append("view", view);
     }
@@ -4030,7 +4037,7 @@ async function listMergeRequestDiffs(projectId, mergeRequestIid, branchName, pag
         const mergeRequest = await getMergeRequest(projectId, undefined, branchName);
         mergeRequestIid = mergeRequest.iid;
     }
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/diffs`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/diffs`);
     if (page) {
         url.searchParams.append("page", page.toString());
     }
@@ -4066,7 +4073,7 @@ async function listMergeRequestChangedFiles(projectId, mergeRequestIid, branchNa
         const mergeRequest = await getMergeRequest(projectId, undefined, branchName);
         mergeRequestIid = mergeRequest.iid;
     }
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/changes`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/changes`);
     const response = await fetch(url.toString(), { ...getFetchConfig() });
     await handleGitLabError(response);
     const data = (await response.json());
@@ -4107,7 +4114,7 @@ async function getMergeRequestFileDiff(projectId, filePaths, mergeRequestIid, br
     let page = 1;
     const perPage = 20;
     while (remaining.size > 0) {
-        const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/diffs`);
+        const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/diffs`);
         url.searchParams.append("page", page.toString());
         url.searchParams.append("per_page", perPage.toString());
         if (unidiff) {
@@ -4150,7 +4157,7 @@ async function getMergeRequestFileDiff(projectId, filePaths, mergeRequestIid, br
  */
 async function getBranchDiffs(projectId, from, to, straight) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/repository/compare`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/repository/compare`);
     url.searchParams.append("from", from);
     url.searchParams.append("to", to);
     if (straight !== undefined) {
@@ -4185,7 +4192,7 @@ async function updateMergeRequest(projectId, options, mergeRequestIid, branchNam
         const mergeRequest = await getMergeRequest(projectId, undefined, branchName);
         mergeRequestIid = mergeRequest.iid;
     }
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
         method: "PUT",
@@ -4205,7 +4212,7 @@ async function updateMergeRequest(projectId, options, mergeRequestIid, branchNam
  */
 async function mergeMergeRequest(projectId, options, mergeRequestIid) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/merge`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/merge`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
         method: "PUT",
@@ -4225,7 +4232,7 @@ async function mergeMergeRequest(projectId, options, mergeRequestIid) {
  */
 async function approveMergeRequest(projectId, mergeRequestIid, sha, approvalPassword) {
     projectId = decodeURIComponent(projectId);
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/approve`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/approve`);
     const body = {};
     if (sha) {
         body.sha = sha;
@@ -4250,7 +4257,7 @@ async function approveMergeRequest(projectId, mergeRequestIid, sha, approvalPass
  */
 async function unapproveMergeRequest(projectId, mergeRequestIid) {
     projectId = decodeURIComponent(projectId);
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/unapprove`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/unapprove`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
         method: "POST",
@@ -4268,7 +4275,7 @@ async function unapproveMergeRequest(projectId, mergeRequestIid) {
  */
 async function getMergeRequestApprovalState(projectId, mergeRequestIid) {
     projectId = decodeURIComponent(projectId);
-    const approvalStateUrl = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/approval_state`);
+    const approvalStateUrl = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/approval_state`);
     const approvalStateResponse = await fetch(approvalStateUrl.toString(), {
         ...getFetchConfig(),
         method: "GET",
@@ -4316,7 +4323,7 @@ async function getMergeRequestApprovalState(projectId, mergeRequestIid) {
  */
 async function getMergeRequestConflicts(projectId, mergeRequestIid) {
     projectId = decodeURIComponent(projectId);
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/conflicts`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/conflicts`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
         method: "GET",
@@ -4325,7 +4332,7 @@ async function getMergeRequestConflicts(projectId, mergeRequestIid) {
     return (await response.json());
 }
 async function getMergeRequestApprovalsFallback(projectId, mergeRequestIid) {
-    const approvalsUrl = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/approvals`);
+    const approvalsUrl = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/approvals`);
     const approvalsResponse = await fetch(approvalsUrl.toString(), {
         ...getFetchConfig(),
         method: "GET",
@@ -4385,7 +4392,7 @@ async function createNote(projectId, noteableType, // specifies 'issue' or 'merg
 noteableIid, body) {
     projectId = decodeURIComponent(projectId); // Decode project ID
     // ⚙️ Response type can be adjusted according to the GitLab API documentation
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/${noteableType}s/${encodeGitLabPathSegment(noteableIid)}/notes` // Using plural form (issues/merge_requests) as per GitLab API documentation
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/${noteableType}s/${encodeGitLabPathSegment(noteableIid)}/notes` // Using plural form (issues/merge_requests) as per GitLab API documentation
     );
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
@@ -4406,7 +4413,7 @@ noteableIid, body) {
  */
 async function getDraftNote(project_id, merge_request_iid, draft_note_id) {
     const effectiveProjectId = getEffectiveProjectId(decodeURIComponent(project_id));
-    const response = await fetch(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(effectiveProjectId)}/merge_requests/${encodeGitLabPathSegment(merge_request_iid)}/draft_notes/${encodeGitLabPathSegment(draft_note_id)}`, { ...getFetchConfig() });
+    const response = await fetch(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(effectiveProjectId)}/merge_requests/${encodeGitLabPathSegment(merge_request_iid)}/draft_notes/${encodeGitLabPathSegment(draft_note_id)}`, { ...getFetchConfig() });
     if (!response.ok) {
         const errorText = await response.text();
         throw new Error(`GitLab API error: ${response.status} ${response.statusText}\n${errorText}`);
@@ -4416,7 +4423,7 @@ async function getDraftNote(project_id, merge_request_iid, draft_note_id) {
 }
 async function listDraftNotes(projectId, mergeRequestIid) {
     projectId = decodeURIComponent(projectId);
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/draft_notes`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/draft_notes`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
         method: "GET",
@@ -4440,7 +4447,7 @@ async function listDraftNotes(projectId, mergeRequestIid) {
  */
 async function createDraftNote(projectId, mergeRequestIid, body, inReplyToDiscussionId, position, resolveDiscussion) {
     projectId = decodeURIComponent(projectId);
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/draft_notes`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/draft_notes`);
     const requestBody = { note: body };
     if (inReplyToDiscussionId) {
         requestBody.in_reply_to_discussion_id = inReplyToDiscussionId;
@@ -4475,7 +4482,7 @@ async function createDraftNote(projectId, mergeRequestIid, body, inReplyToDiscus
  */
 async function updateDraftNote(projectId, mergeRequestIid, draftNoteId, body, position, resolveDiscussion) {
     projectId = decodeURIComponent(projectId);
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/draft_notes/${encodeGitLabPathSegment(draftNoteId)}`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/draft_notes/${encodeGitLabPathSegment(draftNoteId)}`);
     const requestBody = {};
     if (body !== undefined) {
         requestBody.note = body;
@@ -4507,7 +4514,7 @@ async function updateDraftNote(projectId, mergeRequestIid, draftNoteId, body, po
  */
 async function deleteDraftNote(projectId, mergeRequestIid, draftNoteId) {
     projectId = decodeURIComponent(projectId);
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/draft_notes/${encodeGitLabPathSegment(draftNoteId)}`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/draft_notes/${encodeGitLabPathSegment(draftNoteId)}`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
         method: "DELETE",
@@ -4526,7 +4533,7 @@ async function deleteDraftNote(projectId, mergeRequestIid, draftNoteId) {
  */
 async function publishDraftNote(projectId, mergeRequestIid, draftNoteId) {
     projectId = decodeURIComponent(projectId);
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/draft_notes/${encodeGitLabPathSegment(draftNoteId)}/publish`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/draft_notes/${encodeGitLabPathSegment(draftNoteId)}/publish`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
         method: "PUT",
@@ -4597,7 +4604,7 @@ async function fetchGitLabInstanceVersion() {
  */
 async function bulkPublishDraftNotes(projectId, mergeRequestIid, options = {}) {
     projectId = decodeURIComponent(projectId);
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/draft_notes/bulk_publish`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/draft_notes/bulk_publish`);
     const body = buildBulkPublishDraftNotesBody(options);
     if (needsGitLab19_2BulkPublish(body)) {
         await assertGitLabVersionAtLeast({
@@ -4635,7 +4642,7 @@ async function bulkPublishDraftNotes(projectId, mergeRequestIid, options = {}) {
 }
 async function resolveMergeRequestThread(projectId, mergeRequestIid, discussionId, resolved) {
     projectId = decodeURIComponent(projectId);
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/discussions/${encodeGitLabPathSegment(discussionId)}`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/discussions/${encodeGitLabPathSegment(discussionId)}`);
     if (resolved !== undefined) {
         url.searchParams.append("resolved", resolved ? "true" : "false");
     }
@@ -4667,7 +4674,7 @@ async function resolveMergeRequestThread(projectId, mergeRequestIid, discussionI
  */
 async function createMergeRequestThread(projectId, mergeRequestIid, body, position, createdAt) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/discussions`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/discussions`);
     const payload = { body };
     if (position) {
         payload.position = position;
@@ -4694,7 +4701,7 @@ async function createMergeRequestThread(projectId, mergeRequestIid, body, positi
  */
 async function listMergeRequestVersions(projectId, mergeRequestIid) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/versions`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/versions`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
     });
@@ -4713,7 +4720,7 @@ async function listMergeRequestVersions(projectId, mergeRequestIid) {
  */
 async function getMergeRequestVersion(projectId, mergeRequestIid, versionId, unidiff) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/versions/${encodeGitLabPathSegment(versionId)}`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/versions/${encodeGitLabPathSegment(versionId)}`);
     if (unidiff !== undefined) {
         url.searchParams.append("unidiff", String(unidiff));
     }
@@ -4734,16 +4741,7 @@ async function getMergeRequestVersion(projectId, mergeRequestIid, versionId, uni
 async function listProjects(options = {}) {
     // Construct the query parameters
     const params = new URLSearchParams();
-    for (const [key, value] of Object.entries(options)) {
-        if (value !== undefined && value !== null) {
-            if (typeof value === "boolean") {
-                params.append(key, value ? "true" : "false");
-            }
-            else {
-                params.append(key, String(value));
-            }
-        }
-    }
+    appendFilterParams(params, options);
     // Make the API request
     const response = await fetch(`${getEffectiveApiUrl()}/projects?${params.toString()}`, {
         ...getFetchConfig(),
@@ -4764,18 +4762,9 @@ async function listProjects(options = {}) {
 async function listLabels(projectId, options = {}) {
     projectId = decodeURIComponent(projectId); // Decode project ID
     // Construct the URL with project path
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/labels`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/labels`);
     // Add query parameters
-    Object.entries(options).forEach(([key, value]) => {
-        if (value !== undefined) {
-            if (typeof value === "boolean") {
-                url.searchParams.append(key, value ? "true" : "false");
-            }
-            else {
-                url.searchParams.append(key, String(value));
-            }
-        }
-    });
+    appendFilterParams(url.searchParams, options);
     // Make the API request
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
@@ -4796,7 +4785,7 @@ async function listLabels(projectId, options = {}) {
  */
 async function getLabel(projectId, labelId, includeAncestorGroups) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/labels/${encodeURIComponent(String(labelId))}`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/labels/${encodeGitLabPathSegment(String(labelId))}`);
     // Add query parameters
     if (includeAncestorGroups !== undefined) {
         url.searchParams.append("include_ancestor_groups", includeAncestorGroups ? "true" : "false");
@@ -4821,7 +4810,7 @@ async function getLabel(projectId, labelId, includeAncestorGroups) {
 async function createLabel(projectId, options) {
     projectId = decodeURIComponent(projectId); // Decode project ID
     // Make the API request
-    const response = await fetch(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/labels`, {
+    const response = await fetch(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/labels`, {
         ...getFetchConfig(),
         method: "POST",
         body: JSON.stringify(options),
@@ -4843,7 +4832,7 @@ async function createLabel(projectId, options) {
 async function updateLabel(projectId, labelId, options) {
     projectId = decodeURIComponent(projectId); // Decode project ID
     // Make the API request
-    const response = await fetch(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/labels/${encodeURIComponent(String(labelId))}`, {
+    const response = await fetch(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/labels/${encodeGitLabPathSegment(String(labelId))}`, {
         ...getFetchConfig(),
         method: "PUT",
         body: JSON.stringify(options),
@@ -4863,7 +4852,7 @@ async function updateLabel(projectId, labelId, options) {
 async function deleteLabel(projectId, labelId) {
     projectId = decodeURIComponent(projectId); // Decode project ID
     // Make the API request
-    const response = await fetch(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/labels/${encodeURIComponent(String(labelId))}`, {
+    const response = await fetch(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/labels/${encodeGitLabPathSegment(String(labelId))}`, {
         ...getFetchConfig(),
         method: "DELETE",
     });
@@ -4877,7 +4866,7 @@ async function deleteLabel(projectId, labelId) {
  * @returns {Promise<GitLabProject[]>} Array of projects in the group
  */
 async function listGroupProjects(options) {
-    const url = new URL(`${getEffectiveApiUrl()}/groups/${encodeURIComponent(options.group_id)}/projects`);
+    const url = new URL(`${getEffectiveApiUrl()}/groups/${encodeGitLabPathSegment(options.group_id)}/projects`);
     // Add optional parameters to URL
     if (options.include_subgroups)
         url.searchParams.append("include_subgroups", "true");
@@ -4927,11 +4916,11 @@ async function listGroupProjects(options) {
 function buildWebhookBaseUrl(projectId, groupId) {
     if (projectId) {
         projectId = decodeURIComponent(projectId);
-        return `${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/hooks`;
+        return `${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/hooks`;
     }
     rejectIfStrictProjectScope("group webhooks");
     const decodedGroupId = decodeURIComponent(groupId);
-    return `${getEffectiveApiUrl()}/groups/${encodeURIComponent(decodedGroupId)}/hooks`;
+    return `${getEffectiveApiUrl()}/groups/${encodeGitLabPathSegment(decodedGroupId)}/hooks`;
 }
 /**
  * List webhooks for a project or group
@@ -5046,7 +5035,7 @@ async function getWebhookEvent(options) {
  */
 async function listWikiPages(projectId, options = {}) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/wikis`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/wikis`);
     if (options.page)
         url.searchParams.append("page", options.page.toString());
     if (options.per_page)
@@ -5067,7 +5056,7 @@ async function listWikiPages(projectId, options = {}) {
  */
 async function getWikiPage(projectId, slug, renderHtml) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/wikis/${encodeURIComponent(slug)}`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/wikis/${encodeGitLabPathSegment(slug)}`);
     if (renderHtml)
         url.searchParams.append("render_html", renderHtml.toString());
     const response = await fetch(url.toString(), { ...getFetchConfig() });
@@ -5083,7 +5072,7 @@ async function createWikiPage(projectId, title, content, format) {
     const body = { title, content };
     if (format)
         body.format = format;
-    const response = await fetch(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/wikis`, {
+    const response = await fetch(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/wikis`, {
         ...getFetchConfig(),
         method: "POST",
         body: JSON.stringify(body),
@@ -5111,7 +5100,7 @@ async function updateWikiPage(projectId, slug, title, content, format) {
         body.content = content;
     if (format)
         body.format = format;
-    const response = await fetch(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/wikis/${encodeURIComponent(slug)}`, {
+    const response = await fetch(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/wikis/${encodeGitLabPathSegment(slug)}`, {
         ...getFetchConfig(),
         method: "PUT",
         body: JSON.stringify(body),
@@ -5125,7 +5114,7 @@ async function updateWikiPage(projectId, slug, title, content, format) {
  */
 async function deleteWikiPage(projectId, slug) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const response = await fetch(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/wikis/${encodeURIComponent(slug)}`, {
+    const response = await fetch(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/wikis/${encodeGitLabPathSegment(slug)}`, {
         ...getFetchConfig(),
         method: "DELETE",
     });
@@ -5136,7 +5125,7 @@ async function deleteWikiPage(projectId, slug) {
  */
 async function listGroupWikiPages(groupId, options = {}) {
     groupId = decodeURIComponent(groupId); // Decode group ID
-    const url = new URL(`${getEffectiveApiUrl()}/groups/${encodeURIComponent(groupId)}/wikis`);
+    const url = new URL(`${getEffectiveApiUrl()}/groups/${encodeGitLabPathSegment(groupId)}/wikis`);
     if (options.page)
         url.searchParams.append("page", options.page.toString());
     if (options.per_page)
@@ -5157,7 +5146,7 @@ async function listGroupWikiPages(groupId, options = {}) {
  */
 async function getGroupWikiPage(groupId, slug, renderHtml) {
     groupId = decodeURIComponent(groupId); // Decode group ID
-    const url = new URL(`${getEffectiveApiUrl()}/groups/${encodeURIComponent(groupId)}/wikis/${encodeURIComponent(slug)}`);
+    const url = new URL(`${getEffectiveApiUrl()}/groups/${encodeGitLabPathSegment(groupId)}/wikis/${encodeGitLabPathSegment(slug)}`);
     if (renderHtml)
         url.searchParams.append("render_html", renderHtml.toString());
     const response = await fetch(url.toString(), { ...getFetchConfig() });
@@ -5173,7 +5162,7 @@ async function createGroupWikiPage(groupId, title, content, format) {
     const body = { title, content };
     if (format)
         body.format = format;
-    const response = await fetch(`${getEffectiveApiUrl()}/groups/${encodeURIComponent(groupId)}/wikis`, {
+    const response = await fetch(`${getEffectiveApiUrl()}/groups/${encodeGitLabPathSegment(groupId)}/wikis`, {
         ...getFetchConfig(),
         method: "POST",
         body: JSON.stringify(body),
@@ -5201,7 +5190,7 @@ async function updateGroupWikiPage(groupId, slug, title, content, format) {
         body.content = content;
     if (format)
         body.format = format;
-    const response = await fetch(`${getEffectiveApiUrl()}/groups/${encodeURIComponent(groupId)}/wikis/${encodeURIComponent(slug)}`, {
+    const response = await fetch(`${getEffectiveApiUrl()}/groups/${encodeGitLabPathSegment(groupId)}/wikis/${encodeGitLabPathSegment(slug)}`, {
         ...getFetchConfig(),
         method: "PUT",
         body: JSON.stringify(body),
@@ -5215,7 +5204,7 @@ async function updateGroupWikiPage(groupId, slug, title, content, format) {
  */
 async function deleteGroupWikiPage(groupId, slug) {
     groupId = decodeURIComponent(groupId); // Decode group ID
-    const response = await fetch(`${getEffectiveApiUrl()}/groups/${encodeURIComponent(groupId)}/wikis/${encodeURIComponent(slug)}`, {
+    const response = await fetch(`${getEffectiveApiUrl()}/groups/${encodeGitLabPathSegment(groupId)}/wikis/${encodeGitLabPathSegment(slug)}`, {
         ...getFetchConfig(),
         method: "DELETE",
     });
@@ -5230,13 +5219,9 @@ async function deleteGroupWikiPage(groupId, slug) {
  */
 async function listPipelines(projectId, options = {}) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/pipelines`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/pipelines`);
     // Add all query parameters
-    Object.entries(options).forEach(([key, value]) => {
-        if (value !== undefined) {
-            url.searchParams.append(key, value.toString());
-        }
-    });
+    appendFilterParams(url.searchParams, options);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
     });
@@ -5253,7 +5238,7 @@ async function listPipelines(projectId, options = {}) {
  */
 async function getPipeline(projectId, pipelineId, signal) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/pipelines/${encodeGitLabPathSegment(pipelineId)}`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/pipelines/${encodeGitLabPathSegment(pipelineId)}`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
         signal,
@@ -5267,7 +5252,7 @@ async function getPipeline(projectId, pipelineId, signal) {
 }
 async function getPipelineVariables(projectId, pipelineId, page, perPage) {
     projectId = decodeURIComponent(projectId);
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/pipelines/${encodeGitLabPathSegment(pipelineId)}/variables`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/pipelines/${encodeGitLabPathSegment(pipelineId)}/variables`);
     if (page !== undefined)
         url.searchParams.set("page", String(page));
     if (perPage !== undefined)
@@ -5279,7 +5264,7 @@ async function getPipelineVariables(projectId, pipelineId, page, perPage) {
 async function getPipelineReport(projectId, pipelineId, summary = false, page, perPage) {
     projectId = decodeURIComponent(projectId);
     const endpoint = summary ? "test_report_summary" : "test_report";
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/pipelines/${encodeGitLabPathSegment(pipelineId)}/${endpoint}`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/pipelines/${encodeGitLabPathSegment(pipelineId)}/${endpoint}`);
     if (page !== undefined)
         url.searchParams.set("page", String(page));
     if (perPage !== undefined)
@@ -5290,13 +5275,13 @@ async function getPipelineReport(projectId, pipelineId, summary = false, page, p
 }
 async function deletePipeline(projectId, pipelineId) {
     projectId = decodeURIComponent(projectId);
-    const response = await fetch(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/pipelines/${encodeGitLabPathSegment(pipelineId)}`, { ...getFetchConfig(), method: "DELETE" });
+    const response = await fetch(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/pipelines/${encodeGitLabPathSegment(pipelineId)}`, { ...getFetchConfig(), method: "DELETE" });
     await handleGitLabError(response);
     return response.status === 204 ? { deleted: true } : response.json();
 }
 async function updatePipelineMetadata(projectId, pipelineId, name) {
     projectId = decodeURIComponent(projectId);
-    const response = await fetch(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/pipelines/${encodeGitLabPathSegment(pipelineId)}/metadata`, { ...getFetchConfig(), method: "PUT", body: JSON.stringify({ name }) });
+    const response = await fetch(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/pipelines/${encodeGitLabPathSegment(pipelineId)}/metadata`, { ...getFetchConfig(), method: "PUT", body: JSON.stringify({ name }) });
     await handleGitLabError(response);
     return response.json();
 }
@@ -5309,12 +5294,8 @@ async function updatePipelineMetadata(projectId, pipelineId, name) {
  */
 async function listDeployments(projectId, options = {}) {
     projectId = decodeURIComponent(projectId);
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/deployments`);
-    Object.entries(options).forEach(([key, value]) => {
-        if (value !== undefined) {
-            url.searchParams.append(key, value.toString());
-        }
-    });
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/deployments`);
+    appendFilterParams(url.searchParams, options);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
     });
@@ -5331,7 +5312,7 @@ async function listDeployments(projectId, options = {}) {
  */
 async function getDeployment(projectId, deploymentId) {
     projectId = decodeURIComponent(projectId);
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/deployments/${encodeGitLabPathSegment(deploymentId)}`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/deployments/${encodeGitLabPathSegment(deploymentId)}`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
     });
@@ -5344,7 +5325,7 @@ async function getDeployment(projectId, deploymentId) {
 }
 async function deploymentRequest(projectId, path = "", method = "GET", body, query) {
     projectId = decodeURIComponent(projectId);
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/deployments${path}`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/deployments${path}`);
     for (const [key, value] of Object.entries(query ?? {})) {
         if (value !== undefined)
             url.searchParams.set(key, String(value));
@@ -5365,12 +5346,8 @@ async function deploymentRequest(projectId, path = "", method = "GET", body, que
  */
 async function listEnvironments(projectId, options = {}) {
     projectId = decodeURIComponent(projectId);
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/environments`);
-    Object.entries(options).forEach(([key, value]) => {
-        if (value !== undefined) {
-            url.searchParams.append(key, value.toString());
-        }
-    });
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/environments`);
+    appendFilterParams(url.searchParams, options);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
     });
@@ -5387,7 +5364,7 @@ async function listEnvironments(projectId, options = {}) {
  */
 async function getEnvironment(projectId, environmentId) {
     projectId = decodeURIComponent(projectId);
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/environments/${encodeGitLabPathSegment(environmentId)}`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/environments/${encodeGitLabPathSegment(environmentId)}`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
     });
@@ -5400,7 +5377,7 @@ async function getEnvironment(projectId, environmentId) {
 }
 async function environmentRequest(projectId, path, method, body, query) {
     projectId = decodeURIComponent(projectId);
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/environments${path}`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/environments${path}`);
     for (const [key, value] of Object.entries(query ?? {}))
         if (value !== undefined)
             url.searchParams.set(key, String(value));
@@ -5410,13 +5387,13 @@ async function environmentRequest(projectId, path, method, body, query) {
 }
 async function pipelineTriggerRequest(projectId, path = "", method = "GET", body) {
     projectId = decodeURIComponent(projectId);
-    const response = await fetch(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/triggers${path}`, { ...getFetchConfig(), method, body: body === undefined ? undefined : JSON.stringify(body) });
+    const response = await fetch(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/triggers${path}`, { ...getFetchConfig(), method, body: body === undefined ? undefined : JSON.stringify(body) });
     await handleGitLabError(response);
     return response.status === 204 ? { success: true } : response.json();
 }
 async function triggerPipeline(projectId, token, ref, variables, inputs) {
     projectId = decodeURIComponent(projectId);
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/trigger/pipeline`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/trigger/pipeline`);
     url.searchParams.set("token", token);
     url.searchParams.set("ref", ref);
     const body = {};
@@ -5438,18 +5415,9 @@ async function triggerPipeline(projectId, token, ref, variables, inputs) {
  */
 async function listPipelineJobs(projectId, pipelineId, options = {}) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/pipelines/${encodeGitLabPathSegment(pipelineId)}/jobs`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/pipelines/${encodeGitLabPathSegment(pipelineId)}/jobs`);
     // Add all query parameters
-    Object.entries(options).forEach(([key, value]) => {
-        if (value !== undefined) {
-            if (typeof value === "boolean") {
-                url.searchParams.append(key, value ? "true" : "false");
-            }
-            else {
-                url.searchParams.append(key, value.toString());
-            }
-        }
-    });
+    appendFilterParams(url.searchParams, options);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
     });
@@ -5470,18 +5438,9 @@ async function listPipelineJobs(projectId, pipelineId, options = {}) {
  */
 async function listPipelineTriggerJobs(projectId, pipelineId, options = {}) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/pipelines/${encodeGitLabPathSegment(pipelineId)}/bridges`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/pipelines/${encodeGitLabPathSegment(pipelineId)}/bridges`);
     // Add all query parameters
-    Object.entries(options).forEach(([key, value]) => {
-        if (value !== undefined) {
-            if (typeof value === "boolean") {
-                url.searchParams.append(key, value ? "true" : "false");
-            }
-            else {
-                url.searchParams.append(key, value.toString());
-            }
-        }
-    });
+    appendFilterParams(url.searchParams, options);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
     });
@@ -5494,7 +5453,7 @@ async function listPipelineTriggerJobs(projectId, pipelineId, options = {}) {
 }
 async function getPipelineJob(projectId, jobId, signal) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/jobs/${encodeGitLabPathSegment(jobId)}`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/jobs/${encodeGitLabPathSegment(jobId)}`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
         signal,
@@ -5518,7 +5477,7 @@ async function getPipelineJob(projectId, jobId, signal) {
 const MAX_JOB_TRACE_LINES = 1000;
 async function getPipelineJobOutput(projectId, jobId, limit, offset) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/jobs/${encodeGitLabPathSegment(jobId)}/trace`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/jobs/${encodeGitLabPathSegment(jobId)}/trace`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
         headers: {
@@ -5553,7 +5512,7 @@ async function getPipelineJobOutput(projectId, jobId, limit, offset) {
 }
 async function validateCiLint(projectId, options) {
     projectId = decodeURIComponent(projectId);
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/ci/lint`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/ci/lint`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
         method: "POST",
@@ -5565,17 +5524,8 @@ async function validateCiLint(projectId, options) {
 }
 async function validateProjectCiLint(projectId, options) {
     projectId = decodeURIComponent(projectId);
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/ci/lint`);
-    Object.entries(options).forEach(([key, value]) => {
-        if (value !== undefined) {
-            if (typeof value === "boolean") {
-                url.searchParams.append(key, value ? "true" : "false");
-            }
-            else {
-                url.searchParams.append(key, value.toString());
-            }
-        }
-    });
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/ci/lint`);
+    appendFilterParams(url.searchParams, options);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
     });
@@ -5593,17 +5543,8 @@ async function validateProjectCiLint(projectId, options) {
  */
 async function listJobArtifacts(projectId, jobId, options = {}) {
     projectId = decodeURIComponent(projectId);
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/jobs/${encodeGitLabPathSegment(jobId)}/artifacts/tree`);
-    Object.entries(options).forEach(([key, value]) => {
-        if (value !== undefined) {
-            if (typeof value === "boolean") {
-                url.searchParams.append(key, value ? "true" : "false");
-            }
-            else {
-                url.searchParams.append(key, value.toString());
-            }
-        }
-    });
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/jobs/${encodeGitLabPathSegment(jobId)}/artifacts/tree`);
+    appendFilterParams(url.searchParams, options);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
     });
@@ -5625,10 +5566,8 @@ async function listJobArtifacts(projectId, jobId, options = {}) {
 async function downloadJobArtifacts(projectId, jobId, localPath) {
     projectId = decodeURIComponent(projectId);
     const effectiveProjectId = getEffectiveProjectId(projectId);
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(effectiveProjectId)}/jobs/${encodeGitLabPathSegment(jobId)}/artifacts`);
-    const response = await fetch(url.toString(), {
-        ...getFetchConfig(),
-    });
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(effectiveProjectId)}/jobs/${encodeGitLabPathSegment(jobId)}/artifacts`);
+    const response = await fetchWithValidatedRedirects(url.toString(), downloadRedirectOptions());
     if (response.status === 404) {
         throw new Error(`Job artifacts not found. The job may not have produced artifacts or the job ID is invalid.`);
     }
@@ -5652,14 +5591,9 @@ async function downloadJobArtifacts(projectId, jobId, localPath) {
 async function getJobArtifactFile(projectId, jobId, artifactPath) {
     projectId = decodeURIComponent(projectId);
     const effectiveProjectId = getEffectiveProjectId(projectId);
-    const encodedArtifactPath = artifactPath
-        .split("/")
-        .map(segment => encodeGitLabPathSegment(segment))
-        .join("/");
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(effectiveProjectId)}/jobs/${encodeGitLabPathSegment(jobId)}/artifacts/${encodedArtifactPath}`);
-    const response = await fetch(url.toString(), {
-        ...getFetchConfig(),
-    });
+    const encodedArtifactPath = encodeGitLabPath(artifactPath);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(effectiveProjectId)}/jobs/${encodeGitLabPathSegment(jobId)}/artifacts/${encodedArtifactPath}`);
+    const response = await fetchWithValidatedRedirects(url.toString(), downloadRedirectOptions());
     if (response.status === 404) {
         throw new Error(`Artifact file not found: ${artifactPath}`);
     }
@@ -5677,7 +5611,7 @@ async function getJobArtifactFile(projectId, jobId, artifactPath) {
  */
 async function createPipeline(projectId, ref, variables, inputs) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/pipeline`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/pipeline`);
     const body = { ref };
     if (variables && variables.length > 0) {
         body.variables = variables;
@@ -5703,7 +5637,7 @@ async function createPipeline(projectId, ref, variables, inputs) {
  */
 async function retryPipeline(projectId, pipelineId) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/pipelines/${encodeGitLabPathSegment(pipelineId)}/retry`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/pipelines/${encodeGitLabPathSegment(pipelineId)}/retry`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
         method: "POST",
@@ -5721,7 +5655,7 @@ async function retryPipeline(projectId, pipelineId) {
  */
 async function cancelPipeline(projectId, pipelineId) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/pipelines/${encodeGitLabPathSegment(pipelineId)}/cancel`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/pipelines/${encodeGitLabPathSegment(pipelineId)}/cancel`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
         method: "POST",
@@ -5739,12 +5673,8 @@ async function cancelPipeline(projectId, pipelineId) {
  */
 async function listPipelineSchedules(projectId, options = {}) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/pipeline_schedules`);
-    Object.entries(options).forEach(([key, value]) => {
-        if (value !== undefined) {
-            url.searchParams.append(key, value.toString());
-        }
-    });
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/pipeline_schedules`);
+    appendFilterParams(url.searchParams, options);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
     });
@@ -5761,7 +5691,7 @@ async function listPipelineSchedules(projectId, options = {}) {
  */
 async function getPipelineSchedule(projectId, pipelineScheduleId) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/pipeline_schedules/${encodeGitLabPathSegment(pipelineScheduleId)}`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/pipeline_schedules/${encodeGitLabPathSegment(pipelineScheduleId)}`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
     });
@@ -5779,12 +5709,8 @@ async function getPipelineSchedule(projectId, pipelineScheduleId) {
  */
 async function listPipelineSchedulePipelines(projectId, pipelineScheduleId, options = {}) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/pipeline_schedules/${encodeGitLabPathSegment(pipelineScheduleId)}/pipelines`);
-    Object.entries(options).forEach(([key, value]) => {
-        if (value !== undefined) {
-            url.searchParams.append(key, value.toString());
-        }
-    });
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/pipeline_schedules/${encodeGitLabPathSegment(pipelineScheduleId)}/pipelines`);
+    appendFilterParams(url.searchParams, options);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
     });
@@ -5801,7 +5727,7 @@ async function listPipelineSchedulePipelines(projectId, pipelineScheduleId, opti
  */
 async function createPipelineSchedule(projectId, options) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/pipeline_schedules`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/pipeline_schedules`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
         method: "POST",
@@ -5821,7 +5747,7 @@ async function createPipelineSchedule(projectId, options) {
  */
 async function updatePipelineSchedule(projectId, pipelineScheduleId, options) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/pipeline_schedules/${encodeGitLabPathSegment(pipelineScheduleId)}`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/pipeline_schedules/${encodeGitLabPathSegment(pipelineScheduleId)}`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
         method: "PUT",
@@ -5840,7 +5766,7 @@ async function updatePipelineSchedule(projectId, pipelineScheduleId, options) {
  */
 async function deletePipelineSchedule(projectId, pipelineScheduleId) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/pipeline_schedules/${encodeGitLabPathSegment(pipelineScheduleId)}`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/pipeline_schedules/${encodeGitLabPathSegment(pipelineScheduleId)}`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
         method: "DELETE",
@@ -5856,7 +5782,7 @@ async function deletePipelineSchedule(projectId, pipelineScheduleId) {
  */
 async function playPipelineSchedule(projectId, pipelineScheduleId) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/pipeline_schedules/${encodeGitLabPathSegment(pipelineScheduleId)}/play`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/pipeline_schedules/${encodeGitLabPathSegment(pipelineScheduleId)}/play`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
         method: "POST",
@@ -5874,7 +5800,7 @@ async function playPipelineSchedule(projectId, pipelineScheduleId) {
  */
 async function takeOwnershipPipelineSchedule(projectId, pipelineScheduleId) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/pipeline_schedules/${encodeGitLabPathSegment(pipelineScheduleId)}/take_ownership`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/pipeline_schedules/${encodeGitLabPathSegment(pipelineScheduleId)}/take_ownership`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
         method: "POST",
@@ -5893,7 +5819,7 @@ async function takeOwnershipPipelineSchedule(projectId, pipelineScheduleId) {
  */
 async function getPipelineScheduleVariable(projectId, pipelineScheduleId, key) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/pipeline_schedules/${encodeGitLabPathSegment(pipelineScheduleId)}/variables/${encodeGitLabPathSegment(key)}`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/pipeline_schedules/${encodeGitLabPathSegment(pipelineScheduleId)}/variables/${encodeGitLabPathSegment(key)}`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
     });
@@ -5911,7 +5837,7 @@ async function getPipelineScheduleVariable(projectId, pipelineScheduleId, key) {
  */
 async function createPipelineScheduleVariable(projectId, pipelineScheduleId, options) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/pipeline_schedules/${encodeGitLabPathSegment(pipelineScheduleId)}/variables`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/pipeline_schedules/${encodeGitLabPathSegment(pipelineScheduleId)}/variables`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
         method: "POST",
@@ -5932,7 +5858,7 @@ async function createPipelineScheduleVariable(projectId, pipelineScheduleId, opt
  */
 async function updatePipelineScheduleVariable(projectId, pipelineScheduleId, key, options) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/pipeline_schedules/${encodeGitLabPathSegment(pipelineScheduleId)}/variables/${encodeGitLabPathSegment(key)}`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/pipeline_schedules/${encodeGitLabPathSegment(pipelineScheduleId)}/variables/${encodeGitLabPathSegment(key)}`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
         method: "PUT",
@@ -5952,7 +5878,7 @@ async function updatePipelineScheduleVariable(projectId, pipelineScheduleId, key
  */
 async function deletePipelineScheduleVariable(projectId, pipelineScheduleId, key) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/pipeline_schedules/${encodeGitLabPathSegment(pipelineScheduleId)}/variables/${encodeGitLabPathSegment(key)}`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/pipeline_schedules/${encodeGitLabPathSegment(pipelineScheduleId)}/variables/${encodeGitLabPathSegment(key)}`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
         method: "DELETE",
@@ -5969,7 +5895,7 @@ async function deletePipelineScheduleVariable(projectId, pipelineScheduleId, key
  */
 async function playPipelineJob(projectId, jobId, variables, jobInputs) {
     projectId = decodeURIComponent(projectId);
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/jobs/${encodeGitLabPathSegment(jobId)}/play`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/jobs/${encodeGitLabPathSegment(jobId)}/play`);
     const body = {};
     if (variables && variables.length > 0) {
         body.job_variables_attributes = variables;
@@ -6003,7 +5929,7 @@ async function playPipelineJobs(projectId, jobIds, variables, timeoutSeconds = 3
  */
 async function retryPipelineJob(projectId, jobId, jobInputs) {
     projectId = decodeURIComponent(projectId);
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/jobs/${encodeGitLabPathSegment(jobId)}/retry`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/jobs/${encodeGitLabPathSegment(jobId)}/retry`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
         method: "POST",
@@ -6015,7 +5941,7 @@ async function retryPipelineJob(projectId, jobId, jobInputs) {
 }
 async function erasePipelineJob(projectId, jobId) {
     projectId = decodeURIComponent(projectId);
-    const response = await fetch(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/jobs/${encodeGitLabPathSegment(jobId)}/erase`, { ...getFetchConfig(), method: "POST" });
+    const response = await fetch(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/jobs/${encodeGitLabPathSegment(jobId)}/erase`, { ...getFetchConfig(), method: "POST" });
     await handleGitLabError(response);
     return response.status === 204 ? { erased: true } : response.json();
 }
@@ -6051,7 +5977,7 @@ async function waitForStatus(fetchStatus, terminalStatuses, timeoutSeconds = 300
  */
 async function cancelPipelineJob(projectId, jobId, force) {
     projectId = decodeURIComponent(projectId);
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/jobs/${encodeGitLabPathSegment(jobId)}/cancel`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/jobs/${encodeGitLabPathSegment(jobId)}/cancel`);
     if (force !== undefined) {
         url.searchParams.append("force", force.toString());
     }
@@ -6083,7 +6009,7 @@ async function getRepositoryTree(options) {
         queryParams.append("page_token", options.page_token);
     if (options.pagination)
         queryParams.append("pagination", options.pagination);
-    const response = await fetch(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(options.project_id))}/repository/tree?${queryParams.toString()}`, { ...getFetchConfig() });
+    const response = await fetch(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(options.project_id))}/repository/tree?${queryParams.toString()}`, { ...getFetchConfig() });
     if (response.status === 404) {
         throw new Error("Repository or path not found");
     }
@@ -6105,17 +6031,20 @@ async function getRepositoryTree(options) {
  */
 async function listProjectMilestones(projectId, options) {
     projectId = decodeURIComponent(projectId);
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/milestones`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/milestones`);
     Object.entries(options).forEach(([key, value]) => {
-        if (value !== undefined) {
-            if (key === "iids" && Array.isArray(value) && value.length > 0) {
-                value.forEach(iid => {
-                    url.searchParams.append("iids[]", iid.toString());
-                });
-            }
-            else if (value !== undefined) {
-                url.searchParams.append(key, value.toString());
-            }
+        // Drop blank entries inside arrays so they behave like the scalar blank guard below
+        const normalized = dropBlankArrayEntries(value);
+        if (isBlankFilterValue(normalized)) {
+            return;
+        }
+        if (key === "iids" && Array.isArray(normalized)) {
+            normalized.forEach(iid => {
+                url.searchParams.append("iids[]", String(iid));
+            });
+        }
+        else {
+            url.searchParams.append(key, String(normalized));
         }
     });
     const response = await fetch(url.toString(), {
@@ -6133,7 +6062,7 @@ async function listProjectMilestones(projectId, options) {
  */
 async function getProjectMilestone(projectId, milestoneId) {
     projectId = decodeURIComponent(projectId);
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/milestones/${encodeGitLabPathSegment(milestoneId)}`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/milestones/${encodeGitLabPathSegment(milestoneId)}`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
     });
@@ -6149,7 +6078,7 @@ async function getProjectMilestone(projectId, milestoneId) {
  */
 async function createProjectMilestone(projectId, options) {
     projectId = decodeURIComponent(projectId);
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/milestones`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/milestones`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
         method: "POST",
@@ -6168,7 +6097,7 @@ async function createProjectMilestone(projectId, options) {
  */
 async function editProjectMilestone(projectId, milestoneId, options) {
     projectId = decodeURIComponent(projectId);
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/milestones/${encodeGitLabPathSegment(milestoneId)}`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/milestones/${encodeGitLabPathSegment(milestoneId)}`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
         method: "PUT",
@@ -6186,7 +6115,7 @@ async function editProjectMilestone(projectId, milestoneId, options) {
  */
 async function deleteProjectMilestone(projectId, milestoneId) {
     projectId = decodeURIComponent(projectId);
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/milestones/${encodeGitLabPathSegment(milestoneId)}`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/milestones/${encodeGitLabPathSegment(milestoneId)}`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
         method: "DELETE",
@@ -6201,12 +6130,8 @@ async function deleteProjectMilestone(projectId, milestoneId) {
  */
 async function getMilestoneIssues(projectId, milestoneId, options = {}) {
     projectId = decodeURIComponent(projectId);
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/milestones/${encodeGitLabPathSegment(milestoneId)}/issues`);
-    Object.entries(options).forEach(([key, value]) => {
-        if (value !== undefined) {
-            url.searchParams.append(key, String(value));
-        }
-    });
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/milestones/${encodeGitLabPathSegment(milestoneId)}/issues`);
+    appendFilterParams(url.searchParams, options);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
     });
@@ -6222,12 +6147,8 @@ async function getMilestoneIssues(projectId, milestoneId, options = {}) {
  */
 async function getMilestoneMergeRequests(projectId, milestoneId, options = {}) {
     projectId = decodeURIComponent(projectId);
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/milestones/${encodeGitLabPathSegment(milestoneId)}/merge_requests`);
-    Object.entries(options).forEach(([key, value]) => {
-        if (value !== undefined) {
-            url.searchParams.append(key, String(value));
-        }
-    });
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/milestones/${encodeGitLabPathSegment(milestoneId)}/merge_requests`);
+    appendFilterParams(url.searchParams, options);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
     });
@@ -6243,7 +6164,7 @@ async function getMilestoneMergeRequests(projectId, milestoneId, options = {}) {
  */
 async function promoteProjectMilestone(projectId, milestoneId) {
     projectId = decodeURIComponent(projectId);
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/milestones/${encodeGitLabPathSegment(milestoneId)}/promote`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/milestones/${encodeGitLabPathSegment(milestoneId)}/promote`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
         method: "POST",
@@ -6260,12 +6181,8 @@ async function promoteProjectMilestone(projectId, milestoneId) {
  */
 async function getMilestoneBurndownEvents(projectId, milestoneId, options = {}) {
     projectId = decodeURIComponent(projectId);
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/milestones/${encodeGitLabPathSegment(milestoneId)}/burndown_events`);
-    Object.entries(options).forEach(([key, value]) => {
-        if (value !== undefined) {
-            url.searchParams.append(key, String(value));
-        }
-    });
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/milestones/${encodeGitLabPathSegment(milestoneId)}/burndown_events`);
+    appendFilterParams(url.searchParams, options);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
     });
@@ -6278,17 +6195,20 @@ async function getMilestoneBurndownEvents(projectId, milestoneId, options = {})
  */
 async function listGroupMilestones(groupId, options) {
     groupId = decodeURIComponent(groupId);
-    const url = new URL(`${getEffectiveApiUrl()}/groups/${encodeURIComponent(groupId)}/milestones`);
+    const url = new URL(`${getEffectiveApiUrl()}/groups/${encodeGitLabPathSegment(groupId)}/milestones`);
     Object.entries(options).forEach(([key, value]) => {
-        if (value !== undefined) {
-            if (key === "iids" && Array.isArray(value) && value.length > 0) {
-                value.forEach(iid => {
-                    url.searchParams.append("iids[]", iid.toString());
-                });
-            }
-            else {
-                url.searchParams.append(key, value.toString());
-            }
+        // Drop blank entries inside arrays so they behave like the scalar blank guard below
+        const normalized = dropBlankArrayEntries(value);
+        if (isBlankFilterValue(normalized)) {
+            return;
+        }
+        if (key === "iids" && Array.isArray(normalized)) {
+            normalized.forEach(iid => {
+                url.searchParams.append("iids[]", String(iid));
+            });
+        }
+        else {
+            url.searchParams.append(key, String(normalized));
         }
     });
     const response = await fetch(url.toString(), {
@@ -6303,7 +6223,7 @@ async function listGroupMilestones(groupId, options) {
  */
 async function getGroupMilestone(groupId, milestoneId) {
     groupId = decodeURIComponent(groupId);
-    const url = new URL(`${getEffectiveApiUrl()}/groups/${encodeURIComponent(groupId)}/milestones/${encodeGitLabPathSegment(milestoneId)}`);
+    const url = new URL(`${getEffectiveApiUrl()}/groups/${encodeGitLabPathSegment(groupId)}/milestones/${encodeGitLabPathSegment(milestoneId)}`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
     });
@@ -6316,7 +6236,7 @@ async function getGroupMilestone(groupId, milestoneId) {
  */
 async function createGroupMilestone(groupId, options) {
     groupId = decodeURIComponent(groupId);
-    const url = new URL(`${getEffectiveApiUrl()}/groups/${encodeURIComponent(groupId)}/milestones`);
+    const url = new URL(`${getEffectiveApiUrl()}/groups/${encodeGitLabPathSegment(groupId)}/milestones`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
         method: "POST",
@@ -6331,7 +6251,7 @@ async function createGroupMilestone(groupId, options) {
  */
 async function editGroupMilestone(groupId, milestoneId, options) {
     groupId = decodeURIComponent(groupId);
-    const url = new URL(`${getEffectiveApiUrl()}/groups/${encodeURIComponent(groupId)}/milestones/${encodeGitLabPathSegment(milestoneId)}`);
+    const url = new URL(`${getEffectiveApiUrl()}/groups/${encodeGitLabPathSegment(groupId)}/milestones/${encodeGitLabPathSegment(milestoneId)}`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
         method: "PUT",
@@ -6346,7 +6266,7 @@ async function editGroupMilestone(groupId, milestoneId, options) {
  */
 async function deleteGroupMilestone(groupId, milestoneId) {
     groupId = decodeURIComponent(groupId);
-    const url = new URL(`${getEffectiveApiUrl()}/groups/${encodeURIComponent(groupId)}/milestones/${encodeGitLabPathSegment(milestoneId)}`);
+    const url = new URL(`${getEffectiveApiUrl()}/groups/${encodeGitLabPathSegment(groupId)}/milestones/${encodeGitLabPathSegment(milestoneId)}`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
         method: "DELETE",
@@ -6358,12 +6278,8 @@ async function deleteGroupMilestone(groupId, milestoneId) {
  */
 async function getGroupMilestoneIssues(groupId, milestoneId, options = {}) {
     groupId = decodeURIComponent(groupId);
-    const url = new URL(`${getEffectiveApiUrl()}/groups/${encodeURIComponent(groupId)}/milestones/${encodeGitLabPathSegment(milestoneId)}/issues`);
-    Object.entries(options).forEach(([key, value]) => {
-        if (value !== undefined) {
-            url.searchParams.append(key, String(value));
-        }
-    });
+    const url = new URL(`${getEffectiveApiUrl()}/groups/${encodeGitLabPathSegment(groupId)}/milestones/${encodeGitLabPathSegment(milestoneId)}/issues`);
+    appendFilterParams(url.searchParams, options);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
     });
@@ -6376,12 +6292,8 @@ async function getGroupMilestoneIssues(groupId, milestoneId, options = {}) {
  */
 async function getGroupMilestoneMergeRequests(groupId, milestoneId, options = {}) {
     groupId = decodeURIComponent(groupId);
-    const url = new URL(`${getEffectiveApiUrl()}/groups/${encodeURIComponent(groupId)}/milestones/${encodeGitLabPathSegment(milestoneId)}/merge_requests`);
-    Object.entries(options).forEach(([key, value]) => {
-        if (value !== undefined) {
-            url.searchParams.append(key, String(value));
-        }
-    });
+    const url = new URL(`${getEffectiveApiUrl()}/groups/${encodeGitLabPathSegment(groupId)}/milestones/${encodeGitLabPathSegment(milestoneId)}/merge_requests`);
+    appendFilterParams(url.searchParams, options);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
     });
@@ -6394,12 +6306,8 @@ async function getGroupMilestoneMergeRequests(groupId, milestoneId, options = {}
  */
 async function getGroupMilestoneBurndownEvents(groupId, milestoneId, options = {}) {
     groupId = decodeURIComponent(groupId);
-    const url = new URL(`${getEffectiveApiUrl()}/groups/${encodeURIComponent(groupId)}/milestones/${encodeGitLabPathSegment(milestoneId)}/burndown_events`);
-    Object.entries(options).forEach(([key, value]) => {
-        if (value !== undefined) {
-            url.searchParams.append(key, String(value));
-        }
-    });
+    const url = new URL(`${getEffectiveApiUrl()}/groups/${encodeGitLabPathSegment(groupId)}/milestones/${encodeGitLabPathSegment(milestoneId)}/burndown_events`);
+    appendFilterParams(url.searchParams, options);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
     });
@@ -6469,7 +6377,7 @@ async function getUsers(usernames) {
  */
 async function listCommits(projectId, options = {}) {
     projectId = decodeURIComponent(projectId);
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/repository/commits`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/repository/commits`);
     // Add query parameters
     if (options.ref_name)
         url.searchParams.append("ref_name", options.ref_name);
@@ -6513,7 +6421,7 @@ async function listCommits(projectId, options = {}) {
  */
 async function getCommit(projectId, sha, stats) {
     projectId = decodeURIComponent(projectId);
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/repository/commits/${encodeURIComponent(sha)}`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/repository/commits/${encodeGitLabPathSegment(sha)}`);
     if (stats) {
         url.searchParams.append("stats", "true");
     }
@@ -6535,7 +6443,7 @@ async function getCommit(projectId, sha, stats) {
  */
 async function getCommitDiff(projectId, sha, full_diff) {
     projectId = decodeURIComponent(projectId);
-    const baseUrl = `${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/repository/commits/${encodeURIComponent(sha)}/diff`;
+    const baseUrl = `${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/repository/commits/${encodeGitLabPathSegment(sha)}/diff`;
     let allDiffs = [];
     let page = 1;
     while (true) {
@@ -6574,7 +6482,7 @@ async function getCommitDiff(projectId, sha, full_diff) {
  */
 async function getFileBlame(projectId, options) {
     projectId = decodeURIComponent(projectId);
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/repository/files/${encodeURIComponent(options.file_path)}/blame`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/repository/files/${encodeGitLabPathSegment(options.file_path)}/blame`);
     url.searchParams.append("ref", options.ref);
     if (options.range_start !== undefined && options.range_end !== undefined) {
         url.searchParams.append("range[start]", options.range_start.toString());
@@ -6597,12 +6505,8 @@ async function getFileBlame(projectId, options) {
  */
 async function listCommitStatuses(projectId, sha, options = {}) {
     projectId = decodeURIComponent(projectId);
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/repository/commits/${encodeURIComponent(sha)}/statuses`);
-    Object.entries(options).forEach(([key, value]) => {
-        if (value !== undefined) {
-            url.searchParams.append(key, value.toString());
-        }
-    });
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/repository/commits/${encodeGitLabPathSegment(sha)}/statuses`);
+    appendFilterParams(url.searchParams, options);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
     });
@@ -6623,12 +6527,8 @@ async function createCommitStatus(projectId, sha, options) {
         throw new Error("Use either name or context when creating a commit status, not both.");
     }
     projectId = decodeURIComponent(projectId);
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/statuses/${encodeURIComponent(sha)}`);
-    Object.entries(options).forEach(([key, value]) => {
-        if (value !== undefined) {
-            url.searchParams.append(key, value.toString());
-        }
-    });
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/statuses/${encodeGitLabPathSegment(sha)}`);
+    appendFilterParams(url.searchParams, options);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
         method: "POST",
@@ -6717,7 +6617,7 @@ async function listProjectMembers(projectId, options = {}) {
     projectId = decodeURIComponent(projectId);
     const effectiveProjectId = getEffectiveProjectId(projectId);
     const membersPath = options.include_inheritance ? "members/all" : "members";
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(effectiveProjectId)}/${membersPath}`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(effectiveProjectId)}/${membersPath}`);
     // Add query parameters
     if (options.query)
         url.searchParams.append("query", options.query);
@@ -6747,7 +6647,7 @@ async function listProjectMembers(projectId, options = {}) {
 async function listGroupMembers(groupId, options = {}) {
     groupId = decodeURIComponent(groupId);
     const membersPath = options.include_inheritance ? "members/all" : "members";
-    const url = new URL(`${getEffectiveApiUrl()}/groups/${encodeURIComponent(groupId)}/${membersPath}`);
+    const url = new URL(`${getEffectiveApiUrl()}/groups/${encodeGitLabPathSegment(groupId)}/${membersPath}`);
     if (options.query)
         url.searchParams.append("query", options.query);
     if (options.user_ids) {
@@ -6774,7 +6674,7 @@ async function listGroupMembers(groupId, options = {}) {
  */
 async function listGroupIterations(groupId, options = {}) {
     groupId = decodeURIComponent(groupId);
-    const url = new URL(`${getEffectiveApiUrl()}/groups/${encodeURIComponent(groupId)}/iterations`);
+    const url = new URL(`${getEffectiveApiUrl()}/groups/${encodeGitLabPathSegment(groupId)}/iterations`);
     // クエリパラメータの追加
     if (options.state)
         url.searchParams.append("state", options.state);
@@ -6804,21 +6704,15 @@ async function listGroupIterations(groupId, options = {}) {
 // --- CI/CD Variables ---
 async function listProjectVariables(projectId, options = {}) {
     projectId = decodeURIComponent(projectId);
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/variables`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/variables`);
     Object.entries(options).forEach(([key, value]) => {
-        if (value === undefined)
-            return;
         if (key === "filter" && typeof value === "object" && value !== null) {
-            Object.entries(value).forEach(([fKey, fVal]) => {
-                url.searchParams.append(`filter[${fKey}]`, fVal);
+            Object.entries(value).forEach(([filterKey, filterValue]) => {
+                appendFilterParam(url.searchParams, `filter[${filterKey}]`, filterValue);
             });
+            return;
         }
-        else if (typeof value === "boolean") {
-            url.searchParams.append(key, value ? "true" : "false");
-        }
-        else {
-            url.searchParams.append(key, String(value));
-        }
+        appendFilterParam(url.searchParams, key, value);
     });
     const response = await fetch(url.toString(), getFetchConfig());
     await handleGitLabError(response);
@@ -6827,7 +6721,7 @@ async function listProjectVariables(projectId, options = {}) {
 }
 async function getProjectVariable(projectId, key, filter) {
     projectId = decodeURIComponent(projectId);
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/variables/${encodeURIComponent(key)}`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/variables/${encodeGitLabPathSegment(key)}`);
     if (filter?.environment_scope) {
         url.searchParams.append("filter[environment_scope]", filter.environment_scope);
     }
@@ -6838,7 +6732,7 @@ async function getProjectVariable(projectId, key, filter) {
 }
 async function createProjectVariable(projectId, options) {
     projectId = decodeURIComponent(projectId);
-    const response = await fetch(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/variables`, { ...getFetchConfig(), method: "POST", body: JSON.stringify(options) });
+    const response = await fetch(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/variables`, { ...getFetchConfig(), method: "POST", body: JSON.stringify(options) });
     await handleGitLabError(response);
     const data = await response.json();
     return GitLabCiVariableSchema.parse(data);
@@ -6846,7 +6740,7 @@ async function createProjectVariable(projectId, options) {
 async function updateProjectVariable(projectId, key, options) {
     projectId = decodeURIComponent(projectId);
     const { filter, ...body } = options;
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/variables/${encodeURIComponent(key)}`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/variables/${encodeGitLabPathSegment(key)}`);
     if (filter?.environment_scope) {
         url.searchParams.append("filter[environment_scope]", filter.environment_scope);
     }
@@ -6861,7 +6755,7 @@ async function updateProjectVariable(projectId, key, options) {
 }
 async function deleteProjectVariable(projectId, key, filter) {
     projectId = decodeURIComponent(projectId);
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/variables/${encodeURIComponent(key)}`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/variables/${encodeGitLabPathSegment(key)}`);
     if (filter?.environment_scope) {
         url.searchParams.append("filter[environment_scope]", filter.environment_scope);
     }
@@ -6869,22 +6763,16 @@ async function deleteProjectVariable(projectId, key, filter) {
     await handleGitLabError(response);
 }
 async function listGroupVariables(groupId, options = {}) {
-    const encoded = encodeURIComponent(decodeURIComponent(groupId));
+    const encoded = encodeGitLabPathSegment(groupId);
     const url = new URL(`${getEffectiveApiUrl()}/groups/${encoded}/variables`);
     Object.entries(options).forEach(([key, value]) => {
-        if (value === undefined)
-            return;
         if (key === "filter" && typeof value === "object" && value !== null) {
-            Object.entries(value).forEach(([fKey, fVal]) => {
-                url.searchParams.append(`filter[${fKey}]`, fVal);
+            Object.entries(value).forEach(([filterKey, filterValue]) => {
+                appendFilterParam(url.searchParams, `filter[${filterKey}]`, filterValue);
             });
+            return;
         }
-        else if (typeof value === "boolean") {
-            url.searchParams.append(key, value ? "true" : "false");
-        }
-        else {
-            url.searchParams.append(key, String(value));
-        }
+        appendFilterParam(url.searchParams, key, value);
     });
     const response = await fetch(url.toString(), getFetchConfig());
     await handleGitLabError(response);
@@ -6892,8 +6780,8 @@ async function listGroupVariables(groupId, options = {}) {
     return z.array(GitLabCiVariableSchema).parse(data);
 }
 async function getGroupVariable(groupId, key, filter) {
-    const encoded = encodeURIComponent(decodeURIComponent(groupId));
-    const url = new URL(`${getEffectiveApiUrl()}/groups/${encoded}/variables/${encodeURIComponent(key)}`);
+    const encoded = encodeGitLabPathSegment(groupId);
+    const url = new URL(`${getEffectiveApiUrl()}/groups/${encoded}/variables/${encodeGitLabPathSegment(key)}`);
     if (filter?.environment_scope) {
         url.searchParams.append("filter[environment_scope]", filter.environment_scope);
     }
@@ -6903,7 +6791,7 @@ async function getGroupVariable(groupId, key, filter) {
     return GitLabCiVariableSchema.parse(data);
 }
 async function createGroupVariable(groupId, options) {
-    const encoded = encodeURIComponent(decodeURIComponent(groupId));
+    const encoded = encodeGitLabPathSegment(groupId);
     const response = await fetch(`${getEffectiveApiUrl()}/groups/${encoded}/variables`, {
         ...getFetchConfig(),
         method: "POST",
@@ -6914,9 +6802,9 @@ async function createGroupVariable(groupId, options) {
     return GitLabCiVariableSchema.parse(data);
 }
 async function updateGroupVariable(groupId, key, options) {
-    const encoded = encodeURIComponent(decodeURIComponent(groupId));
+    const encoded = encodeGitLabPathSegment(groupId);
     const { filter, ...body } = options;
-    const url = new URL(`${getEffectiveApiUrl()}/groups/${encoded}/variables/${encodeURIComponent(key)}`);
+    const url = new URL(`${getEffectiveApiUrl()}/groups/${encoded}/variables/${encodeGitLabPathSegment(key)}`);
     if (filter?.environment_scope) {
         url.searchParams.append("filter[environment_scope]", filter.environment_scope);
     }
@@ -6930,8 +6818,8 @@ async function updateGroupVariable(groupId, key, options) {
     return GitLabCiVariableSchema.parse(data);
 }
 async function deleteGroupVariable(groupId, key, filter) {
-    const encoded = encodeURIComponent(decodeURIComponent(groupId));
-    const url = new URL(`${getEffectiveApiUrl()}/groups/${encoded}/variables/${encodeURIComponent(key)}`);
+    const encoded = encodeGitLabPathSegment(groupId);
+    const url = new URL(`${getEffectiveApiUrl()}/groups/${encoded}/variables/${encodeGitLabPathSegment(key)}`);
     if (filter?.environment_scope) {
         url.searchParams.append("filter[environment_scope]", filter.environment_scope);
     }
@@ -7017,7 +6905,7 @@ async function listDependencyProxyBlobs(groupPath, options = {}) {
     };
 }
 async function purgeDependencyProxyCache(groupId) {
-    const encoded = encodeURIComponent(decodeURIComponent(groupId));
+    const encoded = encodeGitLabPathSegment(groupId);
     const url = new URL(`${getEffectiveApiUrl()}/groups/${encoded}/dependency_proxy/cache`);
     const response = await fetch(url.toString(), { ...getFetchConfig(), method: "DELETE" });
     await handleGitLabError(response);
@@ -7047,7 +6935,7 @@ async function resolveProjectFullPath(projectId) {
     if (!/^\d+$/.test(decoded)) {
         return decoded;
     }
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(decoded)}`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(decoded)}`);
     const response = await fetch(url.toString(), { ...getFetchConfig() });
     await handleGitLabError(response);
     const project = (await response.json());
@@ -7358,7 +7246,7 @@ async function markdownUpload(projectId, filePath, content, filename) {
     // Create form data
     const form = new FormData();
     form.append("file", new File([fileBuffer], fileName, { type: "application/octet-stream" }));
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(effectiveProjectId)}/uploads`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(effectiveProjectId)}/uploads`);
     const defaultFetchConfig = getFetchConfig();
     delete defaultFetchConfig.headers["Content-Type"];
     const response = await fetch(url.toString(), {
@@ -7399,11 +7287,8 @@ function getSafeAttachmentFilename(filename) {
 async function downloadAttachment(projectId, secret, filename, localPath) {
     const effectiveProjectId = getEffectiveProjectId(projectId);
     const safeFilename = getSafeAttachmentFilename(filename);
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(effectiveProjectId)}/uploads/${encodeGitLabPathSegment(secret)}/${encodeGitLabPathSegment(safeFilename)}`);
-    const response = await fetch(url.toString(), {
-        ...getFetchConfig(),
-        method: "GET",
-    });
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(effectiveProjectId)}/uploads/${encodeGitLabPathSegment(secret)}/${encodeGitLabPathSegment(safeFilename)}`);
+    const response = await fetchWithValidatedRedirects(url.toString(), downloadRedirectOptions());
     if (!response.ok) {
         await handleGitLabError(response);
     }
@@ -7431,11 +7316,7 @@ async function downloadAttachment(projectId, secret, filename, localPath) {
 async function listEvents(options = {}) {
     const url = new URL(`${getEffectiveApiUrl()}/events`);
     // Add all query parameters
-    Object.entries(options).forEach(([key, value]) => {
-        if (value !== undefined) {
-            url.searchParams.append(key, value.toString());
-        }
-    });
+    appendFilterParams(url.searchParams, options);
     const response = await fetch(url.toString(), { ...getFetchConfig() });
     if (!response.ok) {
         await handleGitLabError(response);
@@ -7451,13 +7332,9 @@ async function listEvents(options = {}) {
  */
 async function getProjectEvents(projectId, options = {}) {
     const effectiveProjectId = getEffectiveProjectId(projectId);
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(effectiveProjectId)}/events`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(effectiveProjectId)}/events`);
     // Add all query parameters
-    Object.entries(options).forEach(([key, value]) => {
-        if (value !== undefined) {
-            url.searchParams.append(key, value.toString());
-        }
-    });
+    appendFilterParams(url.searchParams, options);
     const response = await fetch(url.toString(), { ...getFetchConfig() });
     if (!response.ok) {
         await handleGitLabError(response);
@@ -7474,13 +7351,9 @@ async function getProjectEvents(projectId, options = {}) {
  */
 async function listReleases(projectId, options = {}) {
     const effectiveProjectId = getEffectiveProjectId(projectId);
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(effectiveProjectId)}/releases`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(effectiveProjectId)}/releases`);
     // Add query parameters
-    Object.entries(options).forEach(([key, value]) => {
-        if (value !== undefined) {
-            url.searchParams.append(key, value.toString());
-        }
-    });
+    appendFilterParams(url.searchParams, options);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
     });
@@ -7498,7 +7371,7 @@ async function listReleases(projectId, options = {}) {
  */
 async function getRelease(projectId, tagName, includeHtmlDescription) {
     const effectiveProjectId = getEffectiveProjectId(projectId);
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(effectiveProjectId)}/releases/${encodeGitLabPathSegment(tagName)}`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(effectiveProjectId)}/releases/${encodeGitLabPathSegment(tagName)}`);
     if (includeHtmlDescription !== undefined) {
         url.searchParams.append("include_html_description", includeHtmlDescription.toString());
     }
@@ -7518,7 +7391,7 @@ async function getRelease(projectId, tagName, includeHtmlDescription) {
  */
 async function createRelease(projectId, options) {
     const effectiveProjectId = getEffectiveProjectId(projectId);
-    const response = await fetch(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(effectiveProjectId)}/releases`, {
+    const response = await fetch(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(effectiveProjectId)}/releases`, {
         ...getFetchConfig(),
         method: "POST",
         body: JSON.stringify(options),
@@ -7537,7 +7410,7 @@ async function createRelease(projectId, options) {
  */
 async function updateRelease(projectId, tagName, options) {
     const effectiveProjectId = getEffectiveProjectId(projectId);
-    const response = await fetch(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(effectiveProjectId)}/releases/${encodeGitLabPathSegment(tagName)}`, {
+    const response = await fetch(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(effectiveProjectId)}/releases/${encodeGitLabPathSegment(tagName)}`, {
         ...getFetchConfig(),
         method: "PUT",
         body: JSON.stringify(options),
@@ -7555,7 +7428,7 @@ async function updateRelease(projectId, tagName, options) {
  */
 async function deleteRelease(projectId, tagName) {
     const effectiveProjectId = getEffectiveProjectId(projectId);
-    const response = await fetch(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(effectiveProjectId)}/releases/${encodeGitLabPathSegment(tagName)}`, {
+    const response = await fetch(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(effectiveProjectId)}/releases/${encodeGitLabPathSegment(tagName)}`, {
         ...getFetchConfig(),
         method: "DELETE",
     });
@@ -7571,7 +7444,7 @@ async function deleteRelease(projectId, tagName) {
  */
 async function createReleaseEvidence(projectId, tagName) {
     const effectiveProjectId = getEffectiveProjectId(projectId);
-    const response = await fetch(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(effectiveProjectId)}/releases/${encodeGitLabPathSegment(tagName)}/evidence`, {
+    const response = await fetch(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(effectiveProjectId)}/releases/${encodeGitLabPathSegment(tagName)}/evidence`, {
         ...getFetchConfig(),
         method: "POST",
     });
@@ -7587,9 +7460,7 @@ async function createReleaseEvidence(projectId, tagName) {
  */
 async function downloadReleaseAsset(projectId, tagName, directAssetPath) {
     const effectiveProjectId = getEffectiveProjectId(projectId);
-    const response = await fetch(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(effectiveProjectId)}/releases/${encodeGitLabPathSegment(tagName)}/downloads/${encodeGitLabPath(directAssetPath)}`, {
-        ...getFetchConfig(),
-    });
+    const response = await fetchWithValidatedRedirects(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(effectiveProjectId)}/releases/${encodeGitLabPathSegment(tagName)}/downloads/${encodeGitLabPath(directAssetPath)}`, downloadRedirectOptions());
     await handleGitLabError(response);
     return await response.text();
 }
@@ -7602,12 +7473,8 @@ async function downloadReleaseAsset(projectId, tagName, directAssetPath) {
  */
 async function listTags(projectId, options = {}) {
     const effectiveProjectId = getEffectiveProjectId(projectId);
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(effectiveProjectId)}/repository/tags`);
-    Object.entries(options).forEach(([key, value]) => {
-        if (value !== undefined) {
-            url.searchParams.append(key, value.toString());
-        }
-    });
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(effectiveProjectId)}/repository/tags`);
+    appendFilterParams(url.searchParams, options);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
     });
@@ -7624,7 +7491,7 @@ async function listTags(projectId, options = {}) {
  */
 async function getTag(projectId, tagName) {
     const effectiveProjectId = getEffectiveProjectId(projectId);
-    const response = await fetch(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(effectiveProjectId)}/repository/tags/${encodeURIComponent(tagName)}`, {
+    const response = await fetch(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(effectiveProjectId)}/repository/tags/${encodeGitLabPathSegment(tagName)}`, {
         ...getFetchConfig(),
     });
     await handleGitLabError(response);
@@ -7640,7 +7507,7 @@ async function getTag(projectId, tagName) {
  */
 async function createTag(projectId, options) {
     const effectiveProjectId = getEffectiveProjectId(projectId);
-    const response = await fetch(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(effectiveProjectId)}/repository/tags`, {
+    const response = await fetch(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(effectiveProjectId)}/repository/tags`, {
         ...getFetchConfig(),
         method: "POST",
         body: JSON.stringify(options),
@@ -7657,7 +7524,7 @@ async function createTag(projectId, options) {
  */
 async function deleteTag(projectId, tagName) {
     const effectiveProjectId = getEffectiveProjectId(projectId);
-    const response = await fetch(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(effectiveProjectId)}/repository/tags/${encodeURIComponent(tagName)}`, {
+    const response = await fetch(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(effectiveProjectId)}/repository/tags/${encodeGitLabPathSegment(tagName)}`, {
         ...getFetchConfig(),
         method: "DELETE",
     });
@@ -7672,7 +7539,7 @@ async function deleteTag(projectId, tagName) {
  */
 async function getTagSignature(projectId, tagName) {
     const effectiveProjectId = getEffectiveProjectId(projectId);
-    const response = await fetch(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(effectiveProjectId)}/repository/tags/${encodeURIComponent(tagName)}/signature`, {
+    const response = await fetch(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(effectiveProjectId)}/repository/tags/${encodeGitLabPathSegment(tagName)}/signature`, {
         ...getFetchConfig(),
     });
     await handleGitLabError(response);
@@ -7736,7 +7603,7 @@ async function handleToolCall(params) {
         if (!isToolAllowedByPermissionMode(params.name)) {
             throw new Error(GITLAB_PERMISSION_MODE === "readonly"
                 ? `${params.name} is not allowed in read-only mode`
-                : `${params.name} is not allowed in modify mode (delete operations are disabled)`);
+                : `${params.name} is not allowed in modify mode (delete and teardown operations are disabled)`);
         }
         logger.info({ tool: params.name, event: "tool_call_start" }, `tool_call_start: ${params.name}`);
         switch (params.name) {
@@ -7749,7 +7616,7 @@ async function handleToolCall(params) {
                 }
                 if (GITLAB_PERMISSION_MODE === "modify" &&
                     graphqlQueryContainsDeleteOperation(args.query)) {
-                    throw new Error("execute_graphql does not allow delete mutations in modify mode");
+                    throw new Error("execute_graphql does not allow destructive mutations in modify mode");
                 }
                 const apiUrl = new URL(getEffectiveApiUrl());
                 // Build GraphQL endpoint preserving any instance subpath (e.g. /gitlab)
@@ -8339,7 +8206,7 @@ async function handleToolCall(params) {
             }
             case "get_namespace": {
                 const args = GetNamespaceSchema.parse(params.arguments);
-                const url = new URL(`${GITLAB_API_URL}/namespaces/${encodeURIComponent(args.namespace_id)}`);
+                const url = new URL(`${GITLAB_API_URL}/namespaces/${encodeGitLabPathSegment(args.namespace_id)}`);
                 const response = await fetch(url.toString(), {
                     ...getFetchConfig(),
                 });
@@ -8352,7 +8219,7 @@ async function handleToolCall(params) {
             }
             case "verify_namespace": {
                 const args = VerifyNamespaceSchema.parse(params.arguments);
-                const url = new URL(`${GITLAB_API_URL}/namespaces/${encodeURIComponent(args.path)}/exists`);
+                const url = new URL(`${GITLAB_API_URL}/namespaces/${encodeGitLabPathSegment(args.path)}/exists`);
                 if (args.parent_id !== undefined)
                     url.searchParams.set("parent_id", String(args.parent_id));
                 const response = await fetch(url.toString(), {
@@ -8369,7 +8236,7 @@ async function handleToolCall(params) {
                 const args = GetProjectSchema.parse(params.arguments);
                 const options = params.arguments;
                 const effectiveProjectId = getEffectiveProjectId(args.project_id);
-                const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(effectiveProjectId)}`);
+                const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(effectiveProjectId)}`);
                 if (options.license)
                     url.searchParams.append("license", "true");
                 if (options.statistics)
@@ -8398,7 +8265,7 @@ async function handleToolCall(params) {
                 const { project_id, ...updates } = UpdateProjectSchema.parse(params.arguments);
                 const effectiveProjectId = getEffectiveProjectId(project_id);
                 const body = Object.fromEntries(Object.entries(updates).filter(([, value]) => value !== undefined));
-                const response = await fetch(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(effectiveProjectId)}`, {
+                const response = await fetch(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(effectiveProjectId)}`, {
                     ...getFetchConfig(),
                     method: "PUT",
                     body: JSON.stringify(body),
@@ -8437,7 +8304,7 @@ async function handleToolCall(params) {
             }
             case "get_user": {
                 const args = GetUserSchema.parse(params.arguments);
-                const url = new URL(`${getEffectiveApiUrl()}/users/${encodeURIComponent(args.user_id)}`);
+                const url = new URL(`${getEffectiveApiUrl()}/users/${encodeGitLabPathSegment(args.user_id)}`);
                 const response = await fetch(url.toString(), {
                     ...getFetchConfig(),
                 });
@@ -8847,8 +8714,8 @@ async function handleToolCall(params) {
                 };
             }
             case "list_labels": {
-                const args = ListLabelsSchema.parse(params.arguments);
-                const labels = await listLabels(args.project_id, args);
+                const { project_id, ...options } = ListLabelsSchema.parse(params.arguments);
+                const labels = await listLabels(project_id, options);
                 return {
                     content: [{ type: "text", text: JSON.stringify(labels) }],
                 };
@@ -10317,7 +10184,7 @@ async function handleToolCall(params) {
             case "get_branch": {
                 const args = GetBranchSchema.parse(params.arguments);
                 const projectId = decodeURIComponent(args.project_id);
-                const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/repository/branches/${encodeURIComponent(args.branch_name)}`);
+                const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/repository/branches/${encodeGitLabPathSegment(args.branch_name)}`);
                 const response = await fetch(url.toString(), {
                     ...getFetchConfig(),
                 });
@@ -10331,7 +10198,7 @@ async function handleToolCall(params) {
             case "list_branches": {
                 const args = ListBranchesSchema.parse(params.arguments);
                 const projectId = decodeURIComponent(args.project_id);
-                const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/repository/branches`);
+                const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/repository/branches`);
                 if (args.search) {
                     url.searchParams.append("search", args.search);
                 }
@@ -10354,7 +10221,7 @@ async function handleToolCall(params) {
             case "delete_branch": {
                 const args = DeleteBranchSchema.parse(params.arguments);
                 const projectId = decodeURIComponent(args.project_id);
-                const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/repository/branches/${encodeURIComponent(args.branch_name)}`);
+                const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/repository/branches/${encodeGitLabPathSegment(args.branch_name)}`);
                 const response = await fetch(url.toString(), {
                     ...getFetchConfig(),
                     method: "DELETE",
@@ -10368,7 +10235,7 @@ async function handleToolCall(params) {
                 const args = ListProtectedBranchesSchema.parse(params.arguments);
                 const projectId = decodeURIComponent(args.project_id);
                 const effectiveProjectId = getEffectiveProjectId(projectId);
-                const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(effectiveProjectId)}/protected_branches`);
+                const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(effectiveProjectId)}/protected_branches`);
                 if (args.search)
                     url.searchParams.append("search", args.search);
                 if (args.page)
@@ -10388,7 +10255,7 @@ async function handleToolCall(params) {
                 const args = GetProtectedBranchSchema.parse(params.arguments);
                 const projectId = decodeURIComponent(args.project_id);
                 const effectiveProjectId = getEffectiveProjectId(projectId);
-                const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(effectiveProjectId)}/protected_branches/${encodeURIComponent(args.branch_name)}`);
+                const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(effectiveProjectId)}/protected_branches/${encodeGitLabPathSegment(args.branch_name)}`);
                 const response = await fetch(url.toString(), {
                     ...getFetchConfig(),
                 });
@@ -10402,7 +10269,7 @@ async function handleToolCall(params) {
                 const args = ProtectBranchSchema.parse(params.arguments);
                 const projectId = decodeURIComponent(args.project_id);
                 const effectiveProjectId = getEffectiveProjectId(projectId);
-                const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(effectiveProjectId)}/protected_branches`);
+                const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(effectiveProjectId)}/protected_branches`);
                 const body = { name: args.branch_name };
                 if (args.push_access_level !== undefined)
                     body.push_access_level = args.push_access_level;
@@ -10429,7 +10296,7 @@ async function handleToolCall(params) {
                 const args = UnprotectBranchSchema.parse(params.arguments);
                 const projectId = decodeURIComponent(args.project_id);
                 const effectiveProjectId = getEffectiveProjectId(projectId);
-                const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(effectiveProjectId)}/protected_branches/${encodeURIComponent(args.branch_name)}`);
+                const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(effectiveProjectId)}/protected_branches/${encodeGitLabPathSegment(args.branch_name)}`);
                 const response = await fetch(url.toString(), {
                     ...getFetchConfig(),
                     method: "DELETE",
@@ -10443,7 +10310,7 @@ async function handleToolCall(params) {
                 const args = UpdateDefaultBranchSchema.parse(params.arguments);
                 const projectId = decodeURIComponent(args.project_id);
                 const effectiveProjectId = getEffectiveProjectId(projectId);
-                const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(effectiveProjectId)}`);
+                const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(effectiveProjectId)}`);
                 const response = await fetch(url.toString(), {
                     ...getFetchConfig(),
                     method: "PUT",
@@ -10500,6 +10367,7 @@ function buildDownloadProxyDeps() {
         getDispatcherForUrl: clientPool.getDispatcherForUrl.bind(clientPool),
         fetch: undiciFetch,
         logger,
+        isTrustedRedirectHost: isTrustedGitLabRedirectHost,
     };
 }
 /**
@@ -10561,9 +10429,68 @@ async function startSSEServer() {
         }
         next();
     };
-    const transports = {};
+    // Session IDs are untrusted map keys (POST /messages?sessionId=). A null
+    // prototype prevents inherited names such as "constructor" from masquerading
+    // as live transports, matching the Streamable HTTP transport.
+    const transports = Object.create(null);
+    const sessionLastActivity = new Map();
     let shuttingDown = false;
-    app.get("/sse", rejectDnsRebinding, requireSseAuth, async (req, res) => {
+    // Mirror the Streamable HTTP controls so the SSE transport cannot be used to
+    // exhaust the process: a session cap, a per-IP creation rate limit and an idle
+    // timeout that closes connections which never send anything.
+    const maxSessions = Number.parseInt(process.env.MAX_SESSIONS || "1000", 10);
+    const maxSseConnectionsPerMinute = Number.parseInt(process.env.MAX_REQUESTS_PER_MINUTE || "60", 10);
+    const idleTimeoutMs = Math.max(SESSION_TIMEOUT_SECONDS, 1) * 1000;
+    const sseConnectionRateLimit = rateLimit({
+        windowMs: 60_000,
+        limit: maxSseConnectionsPerMinute,
+        keyGenerator: (req) => ipKeyGenerator(normalizeProxyClientIpForRateLimit(req.ip ?? "")),
+        standardHeaders: true,
+        legacyHeaders: false,
+        handler: (_req, res) => {
+            res.status(429).json({
+                error: "Rate limit exceeded",
+                message: `Maximum ${maxSseConnectionsPerMinute} SSE connections per minute allowed`,
+            });
+        },
+    });
+    /**
+     * Reclaim SSE sessions that have not received a POST /messages request within
+     * the idle timeout.
+     *
+     * On /sse it is correct to idle-close an open GET: the stream alone is not
+     * proof of a live client, so a client that connects and never sends anything
+     * would otherwise hold a MAX_SESSIONS slot forever. This intentionally
+     * differs from the Streamable HTTP GET /mcp handler, which pauses inactivity
+     * expiry while its stream is open so list_changed can still be pushed - do
+     * not copy that rule here.
+     */
+    const closeIdleSseSessions = () => {
+        const now = Date.now();
+        for (const [sessionId, lastActivity] of sessionLastActivity) {
+            if (now - lastActivity < idleTimeoutMs)
+                continue;
+            const transport = transports[sessionId];
+            delete transports[sessionId];
+            sessionLastActivity.delete(sessionId);
+            logger.info({ sessionId, event: "sse_session_idle_closed" }, `SSE session ${sessionId} closed after ${SESSION_TIMEOUT_SECONDS}s of inactivity`);
+            if (transport) {
+                void transport.close().catch(error => {
+                    logger.error({ err: error }, "Error closing idle SSE transport");
+                });
+            }
+        }
+    };
+    const idleSweep = setInterval(closeIdleSseSessions, Math.min(idleTimeoutMs, 60_000));
+    idleSweep.unref();
+    app.get("/sse", rejectDnsRebinding, requireSseAuth, sseConnectionRateLimit, async (req, res) => {
+        if (Object.keys(transports).length >= maxSessions) {
+            res.status(503).json({
+                error: "Server capacity reached",
+                message: `Maximum ${maxSessions} concurrent sessions allowed. Please try again later.`,
+            });
+            return;
+        }
         const serverInstance = createServer();
         const effectiveHosts = getEffectiveAllowedHosts(req);
         const transport = new SSEServerTransport("/messages", res, {
@@ -10571,16 +10498,38 @@ async function startSSEServer() {
             allowedHosts: [...effectiveHosts],
             allowedOrigins: [...effectiveHosts].flatMap(host => [`http://${host}`, `https://${host}`]),
         });
-        transports[transport.sessionId] = transport;
+        const sessionId = transport.sessionId;
+        transports[sessionId] = transport;
+        sessionLastActivity.set(sessionId, Date.now());
         res.on("close", () => {
-            delete transports[transport.sessionId];
+            delete transports[sessionId];
+            sessionLastActivity.delete(sessionId);
         });
-        await serverInstance.connect(transport);
+        try {
+            await serverInstance.connect(transport);
+        }
+        catch (error) {
+            logger.error({ err: error, sessionId }, "SSE connection error");
+            // Release the capacity slot immediately instead of waiting for the
+            // client to disconnect or the idle sweep to run.
+            delete transports[sessionId];
+            sessionLastActivity.delete(sessionId);
+            if (!res.headersSent) {
+                res.status(500).json({
+                    error: "Internal server error",
+                    message: error instanceof Error ? error.message : "Unknown error",
+                });
+            }
+            else {
+                res.end();
+            }
+        }
     });
     app.post("/messages", rejectDnsRebinding, requireSseAuth, async (req, res) => {
         const sessionId = req.query.sessionId;
         const transport = transports[sessionId];
         if (transport) {
+            sessionLastActivity.set(sessionId, Date.now());
             await transport.handlePostMessage(req, res);
         }
         else {
@@ -10589,10 +10538,18 @@ async function startSSEServer() {
     });
     registerDownloadProxy(app, buildDownloadProxyDeps());
     app.get("/health", (_, res) => {
-        res.status(200).json({
-            status: "healthy",
+        const activeSessions = Object.keys(transports).length;
+        const isHealthy = activeSessions < maxSessions;
+        if (!isHealthy) {
+            logger.warn({ activeSessions, maxSessions }, "Health check degraded: active SSE session capacity reached");
+        }
+        res.status(isHealthy ? 200 : 503).json({
+            status: isHealthy ? "healthy" : "degraded",
             version: SERVER_VERSION,
             transport: TransportMode.SSE,
+            activeSessions,
+            maxSessions,
+            uptime: process.uptime(),
         });
     });
     const httpServer = app.listen(Number(PORT), HOST, () => {
@@ -10604,6 +10561,7 @@ async function startSSEServer() {
             return;
         shuttingDown = true;
         logger.info(`${signal} received, shutting down SSE server...`);
+        clearInterval(idleSweep);
         httpServer.close(() => logger.info("SSE HTTP server closed"));
         await Promise.allSettled(Object.values(transports).map(async (transport) => {
             try {