@zereight/mcp-gitlab 2.1.64 → 2.1.65

package/build/index.js

@@ -89,7 +89,7 @@ import { formatPrometheusMetrics } from "./server/metrics.js";
 import { SERVER_VERSION } from "./server/version.js";
 import { isInitializationRequestBody, isUnauthenticatedDiscoveryRequestBody, readAcceptHeader, readMcpSessionIdHeader, redactSessionIdForLog, } from "./server/request-helpers.js";
 export { readMcpSessionIdHeader } from "./server/request-helpers.js";
-import { normalizeGitLabApiUrl } from "./utils/url.js";
+import { encodeGitLabPath, encodeGitLabPathSegment, normalizeGitLabApiUrl, } from "./utils/url.js";
 import { estimateMergeCommitCount, filterDiffsByPatterns, openSafeOutputWriteStream, readSafeExistingFile, summarizeWebhookEvents, } from "./utils/helpers.js";
 import { graphqlQueryContainsWriteOperation, graphqlQueryContainsDeleteOperation, } from "./utils/graphql-query.js";
 import { resolveNestedWikiUpdateTitle } from "./utils/wiki-title.js";
@@ -98,6 +98,7 @@ import { redactSensitiveGitLabFields } from "./utils/redact-sensitive.js";
 import { createMaskingPolicyResolver, getManagedMaskingProjectIds, } from "./masking/index.js";
 import { checkForNewVersion } from "./utils/version-check.js";
 import { assertGitLabVersionAtLeast } from "./utils/gitlab-version-gate.js";
+import { fetchWithValidatedRedirects } from "./utils/safe-redirect-fetch.js";
 import { parseGitLabVersionApiResponse, } from "./utils/gitlab-instance-version.js";
 import { buildBulkPublishDraftNotesBody, needsGitLab19_2BulkPublish, } from "./utils/bulk-publish-options.js";
 import { appendFilterParam, appendFilterParams, cleanMutuallyExclusiveIdUsernameOptions, dropBlankArrayEntries, isBlankFilterValue, LIST_MERGE_REQUESTS_ID_USERNAME_PAIRS, sanitizeToolArguments, } from "./utils/tool-args.js";
@@ -829,7 +830,7 @@ async function ensureValidOAuthToken() {
         throw error;
     }
 }
-// Permission mode gate: readonly exposes only read tools; modify blocks delete tools; full allows all
+// Permission mode gate: readonly exposes only read tools; modify blocks delete/teardown tools; full allows all
 function isToolAllowedByPermissionMode(toolName) {
     switch (GITLAB_PERMISSION_MODE) {
         case "readonly":
@@ -1165,6 +1166,21 @@ const getFetchConfig = () => {
         dispatcher,
     };
 };
+/**
+ * Options for the download sinks that stream a file through `fetchWithValidatedRedirects`.
+ *
+ * GitLab answers a release asset, a job artifact or an uploaded file with a redirect to
+ * its object storage, so those hops leave the origin and must be validated. The client
+ * split matters as much as the headers: the wrapped client adds the cookie jar and a
+ * fresh `Authorization` on a `401`, so a hop whose credentials were withheld has to use
+ * plain undici instead.
+ */
+const downloadRedirectOptions = () => ({
+    ...getFetchConfig(),
+    fetchImpl: fetch,
+    unauthenticatedFetchImpl: undiciFetch,
+    isTrustedRedirectHost: isTrustedGitLabRedirectHost,
+});
 // Compute at startup
 const enabledToolsets = parseEnabledToolsets(GITLAB_TOOLSETS_RAW);
 const individuallyEnabledTools = parseIndividualTools(GITLAB_TOOLS_RAW);
@@ -1195,23 +1211,6 @@ function parseAllowedGitLabApiUrls(value) {
         .map(toAllowedGitLabApiUrl)
         .filter((entry) => Boolean(entry));
 }
-function encodeGitLabPathSegment(value) {
-    const segment = String(value);
-    let decodedSegment;
-    try {
-        decodedSegment = decodeURIComponent(segment);
-    }
-    catch {
-        decodedSegment = segment;
-    }
-    if (decodedSegment === "." || decodedSegment === "..") {
-        throw new Error("GitLab URL path segments cannot be '.' or '..'");
-    }
-    return encodeURIComponent(decodedSegment);
-}
-function encodeGitLabPath(value) {
-    return value.split("/").map(encodeGitLabPathSegment).join("/");
-}
 function resolveTrustedGitLabApiUrl(value) {
     const parsed = new URL(normalizeGitLabApiUrl(value));
     if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
@@ -1238,6 +1237,17 @@ for (const { host, apiUrl } of [
         GITLAB_ALLOWED_API_URLS_BY_HOST.set(host, apiUrl);
     }
 }
+/**
+ * Redirects from the GitLab API to operator-declared GitLab hosts are followed even
+ * when the host resolves to a private address (self-hosted instances and their
+ * storage may live on an internal network), and those hosts keep receiving the
+ * request credentials. Every other redirect target must resolve to a public
+ * address and is fetched without credentials.
+ *
+ * The lookup key is `URL.host`, which keeps a non-default port, matching how this
+ * map is built from GITLAB_API_URL / GITLAB_ALLOWED_HOSTS.
+ */
+const isTrustedGitLabRedirectHost = (host) => GITLAB_ALLOWED_API_URLS_BY_HOST.has(host);
 const GITLAB_PROJECT_ID = process.env.GITLAB_PROJECT_ID;
 const GITLAB_ALLOWED_PROJECT_IDS = process.env.GITLAB_ALLOWED_PROJECT_IDS?.split(",")
     .map(id => id.trim())
@@ -1364,7 +1374,7 @@ function rejectIfProjectScopedDeployment(toolName) {
 async function forkProject(projectId, namespace) {
     projectId = decodeURIComponent(projectId); // Decode project ID
     const effectiveProjectId = getEffectiveProjectId(projectId);
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(effectiveProjectId)}/fork`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(effectiveProjectId)}/fork`);
     if (namespace) {
         url.searchParams.append("namespace", namespace);
     }
@@ -1391,7 +1401,7 @@ async function forkProject(projectId, namespace) {
 async function createBranch(projectId, options) {
     projectId = decodeURIComponent(projectId); // Decode project ID
     const effectiveProjectId = getEffectiveProjectId(projectId);
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(effectiveProjectId)}/repository/branches`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(effectiveProjectId)}/repository/branches`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
         method: "POST",
@@ -1413,7 +1423,7 @@ async function createBranch(projectId, options) {
 async function getDefaultBranchRef(projectId) {
     projectId = decodeURIComponent(projectId); // Decode project ID
     const effectiveProjectId = getEffectiveProjectId(projectId);
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(effectiveProjectId)}`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(effectiveProjectId)}`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
     });
@@ -1433,12 +1443,12 @@ async function getDefaultBranchRef(projectId) {
 async function getFileContents(projectId, filePath, ref) {
     const decodedProjectId = projectId ? decodeURIComponent(projectId) : "";
     const effectiveProjectId = getEffectiveProjectId(decodedProjectId);
-    const encodedPath = encodeURIComponent(filePath);
+    const encodedPath = encodeGitLabPathSegment(filePath);
     // Fall back to default branch if ref is not provided
     if (!ref) {
         ref = await getDefaultBranchRef(decodedProjectId);
     }
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(effectiveProjectId)}/repository/files/${encodedPath}`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(effectiveProjectId)}/repository/files/${encodedPath}`);
     url.searchParams.append("ref", ref);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
@@ -1464,7 +1474,7 @@ async function getFileContents(projectId, filePath, ref) {
 async function createIssue(projectId, options) {
     projectId = decodeURIComponent(projectId); // Decode project ID
     const effectiveProjectId = getEffectiveProjectId(projectId);
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(effectiveProjectId)}/issues`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(effectiveProjectId)}/issues`);
     // Build request body, converting labels array to comma-separated string
     const body = { ...options };
     if (body.labels && Array.isArray(body.labels)) {
@@ -1499,7 +1509,7 @@ async function listIssues(projectId, options = {}) {
         // resolve the default project (or fail for a multi-project allowlist)
         const decodedProjectId = projectId ? decodeURIComponent(projectId) : "";
         const effectiveProjectId = getEffectiveProjectId(decodedProjectId);
-        url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(effectiveProjectId)}/issues`);
+        url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(effectiveProjectId)}/issues`);
     }
     else {
         url = new URL(`${getEffectiveApiUrl()}/issues`);
@@ -1600,7 +1610,7 @@ async function listMergeRequests(projectId, options = {}) {
         // In strict scope, never fall back to the instance-wide endpoint;
         // resolve the default project (or fail for a multi-project allowlist)
         const effectiveProjectId = getEffectiveProjectId(decodedProjectId);
-        url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(effectiveProjectId)}/merge_requests`);
+        url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(effectiveProjectId)}/merge_requests`);
     }
     else {
         url = new URL(`${getEffectiveApiUrl()}/merge_requests`);
@@ -1622,7 +1632,7 @@ async function listMergeRequests(projectId, options = {}) {
  */
 async function listGroupMergeRequests(groupId, options = {}) {
     const decodedGroupId = decodeURIComponent(groupId);
-    const url = new URL(`${getEffectiveApiUrl()}/groups/${encodeURIComponent(decodedGroupId)}/merge_requests`);
+    const url = new URL(`${getEffectiveApiUrl()}/groups/${encodeGitLabPathSegment(decodedGroupId)}/merge_requests`);
     appendMergeRequestFilters(url, options);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
@@ -1641,7 +1651,7 @@ async function listGroupMergeRequests(groupId, options = {}) {
  */
 async function getIssue(projectId, issueIid) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/issues/${encodeGitLabPathSegment(issueIid)}`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/issues/${encodeGitLabPathSegment(issueIid)}`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
     });
@@ -1660,7 +1670,7 @@ async function getIssue(projectId, issueIid) {
  */
 async function updateIssue(projectId, issueIid, options) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/issues/${encodeGitLabPathSegment(issueIid)}`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/issues/${encodeGitLabPathSegment(issueIid)}`);
     // Convert labels array to comma-separated string if present
     const body = { ...options };
     if (body.labels && Array.isArray(body.labels)) {
@@ -1685,7 +1695,7 @@ async function updateIssue(projectId, issueIid, options) {
  */
 async function deleteIssue(projectId, issueIid) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/issues/${encodeGitLabPathSegment(issueIid)}`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/issues/${encodeGitLabPathSegment(issueIid)}`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
         method: "DELETE",
@@ -2298,7 +2308,7 @@ async function resolveProjectOrGroupPath(projectId) {
     }
     const effectiveProjectId = getEffectiveProjectId(requestedProjectId);
     if (explicitKind === "group") {
-        const groupUrl = new URL(`${getEffectiveApiUrl()}/groups/${encodeURIComponent(effectiveProjectId)}`);
+        const groupUrl = new URL(`${getEffectiveApiUrl()}/groups/${encodeGitLabPathSegment(effectiveProjectId)}`);
         const groupResponse = await fetch(groupUrl.toString(), {
             ...getFetchConfig(),
         });
@@ -2306,7 +2316,7 @@ async function resolveProjectOrGroupPath(projectId) {
         const group = await groupResponse.json();
         return { path: group.full_path, kind: "group" };
     }
-    const projectUrl = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(effectiveProjectId)}`);
+    const projectUrl = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(effectiveProjectId)}`);
     const projectResponse = await fetch(projectUrl.toString(), {
         ...getFetchConfig(),
     });
@@ -2318,7 +2328,7 @@ async function resolveProjectOrGroupPath(projectId) {
         !explicitKind &&
         getEffectiveAllowedProjectIds().length === 0 &&
         !/^\d+$/.test(effectiveProjectId)) {
-        const groupUrl = new URL(`${getEffectiveApiUrl()}/groups/${encodeURIComponent(effectiveProjectId)}`);
+        const groupUrl = new URL(`${getEffectiveApiUrl()}/groups/${encodeGitLabPathSegment(effectiveProjectId)}`);
         const groupResponse = await fetch(groupUrl.toString(), {
             ...getFetchConfig(),
         });
@@ -3059,7 +3069,7 @@ async function updateWorkItem(projectId, iid, options) {
  */
 async function listIssueLinks(projectId, issueIid) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/issues/${encodeGitLabPathSegment(issueIid)}/links`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/issues/${encodeGitLabPathSegment(issueIid)}/links`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
     });
@@ -3078,7 +3088,7 @@ async function listIssueLinks(projectId, issueIid) {
  */
 async function getIssueLink(projectId, issueIid, issueLinkId) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/issues/${encodeGitLabPathSegment(issueIid)}/links/${encodeGitLabPathSegment(issueLinkId)}`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/issues/${encodeGitLabPathSegment(issueIid)}/links/${encodeGitLabPathSegment(issueLinkId)}`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
     });
@@ -3100,7 +3110,7 @@ async function getIssueLink(projectId, issueIid, issueLinkId) {
 async function createIssueLink(projectId, issueIid, targetProjectId, targetIssueIid, linkType = "relates_to") {
     projectId = decodeURIComponent(projectId); // Decode project ID
     targetProjectId = decodeURIComponent(targetProjectId); // Decode target project ID as well
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/issues/${encodeGitLabPathSegment(issueIid)}/links`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/issues/${encodeGitLabPathSegment(issueIid)}/links`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
         method: "POST",
@@ -3125,7 +3135,7 @@ async function createIssueLink(projectId, issueIid, targetProjectId, targetIssue
  */
 async function deleteIssueLink(projectId, issueIid, issueLinkId) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/issues/${encodeGitLabPathSegment(issueIid)}/links/${encodeGitLabPathSegment(issueLinkId)}`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/issues/${encodeGitLabPathSegment(issueIid)}/links/${encodeGitLabPathSegment(issueLinkId)}`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
         method: "DELETE",
@@ -3142,7 +3152,7 @@ async function deleteIssueLink(projectId, issueIid, issueLinkId) {
  */
 async function createMergeRequest(projectId, options) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/merge_requests`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
         method: "POST",
@@ -3184,7 +3194,7 @@ async function createMergeRequest(projectId, options) {
  */
 async function listDiscussions(projectId, resourceType, resourceIid, options = {}) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/${resourceType}/${encodeGitLabPathSegment(resourceIid)}/discussions`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/${resourceType}/${encodeGitLabPathSegment(resourceIid)}/discussions`);
     // Add query parameters for pagination and sorting
     if (options.page) {
         url.searchParams.append("page", options.page.toString());
@@ -3248,7 +3258,7 @@ async function listIssueDiscussions(projectId, issueIid, options = {}) {
 }
 async function deleteMergeRequestDiscussionNote(projectId, mergeRequestIid, discussionId, noteId) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/discussions/${encodeGitLabPathSegment(discussionId)}/notes/${encodeGitLabPathSegment(noteId)}`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/discussions/${encodeGitLabPathSegment(discussionId)}/notes/${encodeGitLabPathSegment(noteId)}`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
         method: "DELETE",
@@ -3272,7 +3282,7 @@ async function deleteMergeRequestDiscussionNote(projectId, mergeRequestIid, disc
  */
 async function updateMergeRequestDiscussionNote(projectId, mergeRequestIid, discussionId, noteId, body, resolved) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/discussions/${encodeGitLabPathSegment(discussionId)}/notes/${encodeGitLabPathSegment(noteId)}`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/discussions/${encodeGitLabPathSegment(discussionId)}/notes/${encodeGitLabPathSegment(noteId)}`);
     // Only one of body or resolved can be sent according to GitLab API
     const payload = {};
     if (body !== undefined) {
@@ -3318,7 +3328,7 @@ async function updateMergeRequestDiscussionNote(projectId, mergeRequestIid, disc
  */
 async function updateIssueNote(projectId, issueIid, discussionId, noteId, body, resolved) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/issues/${encodeGitLabPathSegment(issueIid)}/discussions/${encodeGitLabPathSegment(discussionId)}/notes/${encodeGitLabPathSegment(noteId)}`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/issues/${encodeGitLabPathSegment(issueIid)}/discussions/${encodeGitLabPathSegment(discussionId)}/notes/${encodeGitLabPathSegment(noteId)}`);
     // Only one of body or resolved can be sent according to GitLab API
     const payload = {};
     if (body !== undefined) {
@@ -3347,7 +3357,7 @@ async function updateIssueNote(projectId, issueIid, discussionId, noteId, body,
  */
 async function createIssueNote(projectId, issueIid, discussionId, body, createdAt) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const basePath = `${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/issues/${encodeGitLabPathSegment(issueIid)}`;
+    const basePath = `${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/issues/${encodeGitLabPathSegment(issueIid)}`;
     const url = new URL(discussionId ? `${basePath}/discussions/${encodeGitLabPathSegment(discussionId)}/notes` : `${basePath}/notes`);
     const payload = { body };
     if (createdAt) {
@@ -3375,7 +3385,7 @@ async function createIssueNote(projectId, issueIid, discussionId, body, createdA
  */
 async function createMergeRequestDiscussionNote(projectId, mergeRequestIid, discussionId, body, createdAt) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/discussions/${encodeGitLabPathSegment(discussionId)}/notes`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/discussions/${encodeGitLabPathSegment(discussionId)}/notes`);
     const payload = { body };
     if (createdAt) {
         payload.created_at = createdAt;
@@ -3391,7 +3401,7 @@ async function createMergeRequestDiscussionNote(projectId, mergeRequestIid, disc
 }
 async function createMergeRequestNote(projectId, mergeRequestIid, body) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/notes`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/notes`);
     const payload = {
         id: projectId,
         merge_request_iid: mergeRequestIid,
@@ -3408,7 +3418,7 @@ async function createMergeRequestNote(projectId, mergeRequestIid, body) {
 }
 async function deleteMergeRequestNote(projectId, mergeRequestIid, noteId) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/notes/${encodeGitLabPathSegment(noteId)}`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/notes/${encodeGitLabPathSegment(noteId)}`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
         method: "DELETE",
@@ -3421,7 +3431,7 @@ async function deleteMergeRequestNote(projectId, mergeRequestIid, noteId) {
 // --- Emoji Reactions (REST) ---
 function buildAwardEmojiPath(entity, projectId, entityIid, opts) {
     projectId = decodeURIComponent(projectId);
-    const pp = encodeURIComponent(getEffectiveProjectId(projectId));
+    const pp = encodeGitLabPathSegment(getEffectiveProjectId(projectId));
     let path = `${getEffectiveApiUrl()}/projects/${pp}/${entity}/${encodeGitLabPathSegment(entityIid)}`;
     if (opts?.noteId) {
         path = opts.discussionId
@@ -3456,7 +3466,7 @@ async function deleteRestAwardEmoji(path) {
 }
 async function getMergeRequestNote(projectId, mergeRequestIid, noteId) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/notes/${encodeGitLabPathSegment(noteId)}`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/notes/${encodeGitLabPathSegment(noteId)}`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
         method: "GET",
@@ -3467,7 +3477,7 @@ async function getMergeRequestNote(projectId, mergeRequestIid, noteId) {
 }
 async function getMergeRequestDiscussion(projectId, mergeRequestIid, discussionId) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/discussions/${encodeGitLabPathSegment(discussionId)}`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/discussions/${encodeGitLabPathSegment(discussionId)}`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
         method: "GET",
@@ -3478,7 +3488,7 @@ async function getMergeRequestDiscussion(projectId, mergeRequestIid, discussionI
 }
 async function getMergeRequestNotes(projectId, mergeRequestIid, sort, order_by, per_page, page) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/notes`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/notes`);
     if (sort) {
         url.searchParams.append("sort", sort);
     }
@@ -3501,7 +3511,7 @@ async function getMergeRequestNotes(projectId, mergeRequestIid, sort, order_by,
 }
 async function updateMergeRequestNote(projectId, mergeRequestIid, noteId, body) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/notes/${encodeGitLabPathSegment(noteId)}`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/notes/${encodeGitLabPathSegment(noteId)}`);
     const payload = {
         id: projectId,
         merge_request_iid: mergeRequestIid,
@@ -3531,8 +3541,8 @@ async function updateMergeRequestNote(projectId, mergeRequestIid, noteId, body)
  */
 async function createOrUpdateFile(projectId, filePath, content, commitMessage, branch, previousPath, last_commit_id, commit_id, encoding) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const encodedPath = encodeURIComponent(filePath);
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/repository/files/${encodedPath}`);
+    const encodedPath = encodeGitLabPathSegment(filePath);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/repository/files/${encodedPath}`);
     const resolvedEncoding = encoding ?? GITLAB_REPO_FILE_ENCODING;
     const body = {
         branch,
@@ -3603,7 +3613,7 @@ async function createOrUpdateFile(projectId, filePath, content, commitMessage, b
  */
 async function createCommit(projectId, message, branch, actions) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/repository/commits`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/repository/commits`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
         method: "POST",
@@ -3672,7 +3682,7 @@ async function searchBlobs(params) {
     let basePath;
     if (params.project_id) {
         const decodedProjectId = decodeURIComponent(params.project_id);
-        const projectId = encodeURIComponent(getEffectiveProjectId(decodedProjectId));
+        const projectId = encodeGitLabPathSegment(getEffectiveProjectId(decodedProjectId));
         basePath = `${getEffectiveApiUrl()}/projects/${projectId}/search`;
     }
     else if (params.group_id) {
@@ -3750,11 +3760,11 @@ async function getMergeRequest(projectId, mergeRequestIid, branchName) {
     projectId = decodeURIComponent(projectId); // Decode project ID
     let url;
     if (mergeRequestIid) {
-        url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}`);
+        url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}`);
         url.searchParams.append("include_diverged_commits_count", "true");
     }
     else if (branchName) {
-        url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests?source_branch=${encodeURIComponent(branchName)}`);
+        url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/merge_requests?source_branch=${encodeURIComponent(branchName)}`);
     }
     else {
         throw new Error("Either mergeRequestIid or branchName must be provided");
@@ -3772,7 +3782,7 @@ async function getMergeRequest(projectId, mergeRequestIid, branchName) {
     return GitLabMergeRequestSchema.parse(data);
 }
 async function getMergeRequestSourceCommitCount(projectId, mergeRequestIid) {
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/commits`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/commits`);
     url.searchParams.append("per_page", "100");
     let totalCount = 0;
     let page = 1;
@@ -3800,7 +3810,7 @@ async function getMergeRequestSourceCommitCount(projectId, mergeRequestIid) {
 }
 async function listMergeRequestPipelines(projectId, mergeRequestIid, options = {}) {
     projectId = decodeURIComponent(projectId);
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/pipelines`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/pipelines`);
     appendFilterParams(url.searchParams, options);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
@@ -3810,7 +3820,7 @@ async function listMergeRequestPipelines(projectId, mergeRequestIid, options = {
     return z.array(GitLabMergeRequestPipelineSchema).parse(data);
 }
 async function getProjectMergeMethod(projectId) {
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
     });
@@ -3997,7 +4007,7 @@ async function getMergeRequestDiffs(projectId, mergeRequestIid, branchName, view
         const mergeRequest = await getMergeRequest(projectId, undefined, branchName);
         mergeRequestIid = mergeRequest.iid;
     }
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/changes`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/changes`);
     if (view) {
         url.searchParams.append("view", view);
     }
@@ -4027,7 +4037,7 @@ async function listMergeRequestDiffs(projectId, mergeRequestIid, branchName, pag
         const mergeRequest = await getMergeRequest(projectId, undefined, branchName);
         mergeRequestIid = mergeRequest.iid;
     }
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/diffs`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/diffs`);
     if (page) {
         url.searchParams.append("page", page.toString());
     }
@@ -4063,7 +4073,7 @@ async function listMergeRequestChangedFiles(projectId, mergeRequestIid, branchNa
         const mergeRequest = await getMergeRequest(projectId, undefined, branchName);
         mergeRequestIid = mergeRequest.iid;
     }
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/changes`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/changes`);
     const response = await fetch(url.toString(), { ...getFetchConfig() });
     await handleGitLabError(response);
     const data = (await response.json());
@@ -4104,7 +4114,7 @@ async function getMergeRequestFileDiff(projectId, filePaths, mergeRequestIid, br
     let page = 1;
     const perPage = 20;
     while (remaining.size > 0) {
-        const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/diffs`);
+        const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/diffs`);
         url.searchParams.append("page", page.toString());
         url.searchParams.append("per_page", perPage.toString());
         if (unidiff) {
@@ -4147,7 +4157,7 @@ async function getMergeRequestFileDiff(projectId, filePaths, mergeRequestIid, br
  */
 async function getBranchDiffs(projectId, from, to, straight) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/repository/compare`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/repository/compare`);
     url.searchParams.append("from", from);
     url.searchParams.append("to", to);
     if (straight !== undefined) {
@@ -4182,7 +4192,7 @@ async function updateMergeRequest(projectId, options, mergeRequestIid, branchNam
         const mergeRequest = await getMergeRequest(projectId, undefined, branchName);
         mergeRequestIid = mergeRequest.iid;
     }
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
         method: "PUT",
@@ -4202,7 +4212,7 @@ async function updateMergeRequest(projectId, options, mergeRequestIid, branchNam
  */
 async function mergeMergeRequest(projectId, options, mergeRequestIid) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/merge`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/merge`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
         method: "PUT",
@@ -4222,7 +4232,7 @@ async function mergeMergeRequest(projectId, options, mergeRequestIid) {
  */
 async function approveMergeRequest(projectId, mergeRequestIid, sha, approvalPassword) {
     projectId = decodeURIComponent(projectId);
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/approve`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/approve`);
     const body = {};
     if (sha) {
         body.sha = sha;
@@ -4247,7 +4257,7 @@ async function approveMergeRequest(projectId, mergeRequestIid, sha, approvalPass
  */
 async function unapproveMergeRequest(projectId, mergeRequestIid) {
     projectId = decodeURIComponent(projectId);
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/unapprove`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/unapprove`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
         method: "POST",
@@ -4265,7 +4275,7 @@ async function unapproveMergeRequest(projectId, mergeRequestIid) {
  */
 async function getMergeRequestApprovalState(projectId, mergeRequestIid) {
     projectId = decodeURIComponent(projectId);
-    const approvalStateUrl = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/approval_state`);
+    const approvalStateUrl = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/approval_state`);
     const approvalStateResponse = await fetch(approvalStateUrl.toString(), {
         ...getFetchConfig(),
         method: "GET",
@@ -4313,7 +4323,7 @@ async function getMergeRequestApprovalState(projectId, mergeRequestIid) {
  */
 async function getMergeRequestConflicts(projectId, mergeRequestIid) {
     projectId = decodeURIComponent(projectId);
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/conflicts`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/conflicts`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
         method: "GET",
@@ -4322,7 +4332,7 @@ async function getMergeRequestConflicts(projectId, mergeRequestIid) {
     return (await response.json());
 }
 async function getMergeRequestApprovalsFallback(projectId, mergeRequestIid) {
-    const approvalsUrl = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/approvals`);
+    const approvalsUrl = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/approvals`);
     const approvalsResponse = await fetch(approvalsUrl.toString(), {
         ...getFetchConfig(),
         method: "GET",
@@ -4382,7 +4392,7 @@ async function createNote(projectId, noteableType, // specifies 'issue' or 'merg
 noteableIid, body) {
     projectId = decodeURIComponent(projectId); // Decode project ID
     // ⚙️ Response type can be adjusted according to the GitLab API documentation
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/${noteableType}s/${encodeGitLabPathSegment(noteableIid)}/notes` // Using plural form (issues/merge_requests) as per GitLab API documentation
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/${noteableType}s/${encodeGitLabPathSegment(noteableIid)}/notes` // Using plural form (issues/merge_requests) as per GitLab API documentation
     );
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
@@ -4403,7 +4413,7 @@ noteableIid, body) {
  */
 async function getDraftNote(project_id, merge_request_iid, draft_note_id) {
     const effectiveProjectId = getEffectiveProjectId(decodeURIComponent(project_id));
-    const response = await fetch(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(effectiveProjectId)}/merge_requests/${encodeGitLabPathSegment(merge_request_iid)}/draft_notes/${encodeGitLabPathSegment(draft_note_id)}`, { ...getFetchConfig() });
+    const response = await fetch(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(effectiveProjectId)}/merge_requests/${encodeGitLabPathSegment(merge_request_iid)}/draft_notes/${encodeGitLabPathSegment(draft_note_id)}`, { ...getFetchConfig() });
     if (!response.ok) {
         const errorText = await response.text();
         throw new Error(`GitLab API error: ${response.status} ${response.statusText}\n${errorText}`);
@@ -4413,7 +4423,7 @@ async function getDraftNote(project_id, merge_request_iid, draft_note_id) {
 }
 async function listDraftNotes(projectId, mergeRequestIid) {
     projectId = decodeURIComponent(projectId);
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/draft_notes`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/draft_notes`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
         method: "GET",
@@ -4437,7 +4447,7 @@ async function listDraftNotes(projectId, mergeRequestIid) {
  */
 async function createDraftNote(projectId, mergeRequestIid, body, inReplyToDiscussionId, position, resolveDiscussion) {
     projectId = decodeURIComponent(projectId);
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/draft_notes`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/draft_notes`);
     const requestBody = { note: body };
     if (inReplyToDiscussionId) {
         requestBody.in_reply_to_discussion_id = inReplyToDiscussionId;
@@ -4472,7 +4482,7 @@ async function createDraftNote(projectId, mergeRequestIid, body, inReplyToDiscus
  */
 async function updateDraftNote(projectId, mergeRequestIid, draftNoteId, body, position, resolveDiscussion) {
     projectId = decodeURIComponent(projectId);
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/draft_notes/${encodeGitLabPathSegment(draftNoteId)}`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/draft_notes/${encodeGitLabPathSegment(draftNoteId)}`);
     const requestBody = {};
     if (body !== undefined) {
         requestBody.note = body;
@@ -4504,7 +4514,7 @@ async function updateDraftNote(projectId, mergeRequestIid, draftNoteId, body, po
  */
 async function deleteDraftNote(projectId, mergeRequestIid, draftNoteId) {
     projectId = decodeURIComponent(projectId);
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/draft_notes/${encodeGitLabPathSegment(draftNoteId)}`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/draft_notes/${encodeGitLabPathSegment(draftNoteId)}`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
         method: "DELETE",
@@ -4523,7 +4533,7 @@ async function deleteDraftNote(projectId, mergeRequestIid, draftNoteId) {
  */
 async function publishDraftNote(projectId, mergeRequestIid, draftNoteId) {
     projectId = decodeURIComponent(projectId);
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/draft_notes/${encodeGitLabPathSegment(draftNoteId)}/publish`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/draft_notes/${encodeGitLabPathSegment(draftNoteId)}/publish`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
         method: "PUT",
@@ -4594,7 +4604,7 @@ async function fetchGitLabInstanceVersion() {
  */
 async function bulkPublishDraftNotes(projectId, mergeRequestIid, options = {}) {
     projectId = decodeURIComponent(projectId);
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/draft_notes/bulk_publish`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/draft_notes/bulk_publish`);
     const body = buildBulkPublishDraftNotesBody(options);
     if (needsGitLab19_2BulkPublish(body)) {
         await assertGitLabVersionAtLeast({
@@ -4632,7 +4642,7 @@ async function bulkPublishDraftNotes(projectId, mergeRequestIid, options = {}) {
 }
 async function resolveMergeRequestThread(projectId, mergeRequestIid, discussionId, resolved) {
     projectId = decodeURIComponent(projectId);
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/discussions/${encodeGitLabPathSegment(discussionId)}`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/discussions/${encodeGitLabPathSegment(discussionId)}`);
     if (resolved !== undefined) {
         url.searchParams.append("resolved", resolved ? "true" : "false");
     }
@@ -4664,7 +4674,7 @@ async function resolveMergeRequestThread(projectId, mergeRequestIid, discussionI
  */
 async function createMergeRequestThread(projectId, mergeRequestIid, body, position, createdAt) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/discussions`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/discussions`);
     const payload = { body };
     if (position) {
         payload.position = position;
@@ -4691,7 +4701,7 @@ async function createMergeRequestThread(projectId, mergeRequestIid, body, positi
  */
 async function listMergeRequestVersions(projectId, mergeRequestIid) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/versions`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/versions`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
     });
@@ -4710,7 +4720,7 @@ async function listMergeRequestVersions(projectId, mergeRequestIid) {
  */
 async function getMergeRequestVersion(projectId, mergeRequestIid, versionId, unidiff) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/versions/${encodeGitLabPathSegment(versionId)}`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/merge_requests/${encodeGitLabPathSegment(mergeRequestIid)}/versions/${encodeGitLabPathSegment(versionId)}`);
     if (unidiff !== undefined) {
         url.searchParams.append("unidiff", String(unidiff));
     }
@@ -4752,7 +4762,7 @@ async function listProjects(options = {}) {
 async function listLabels(projectId, options = {}) {
     projectId = decodeURIComponent(projectId); // Decode project ID
     // Construct the URL with project path
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/labels`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/labels`);
     // Add query parameters
     appendFilterParams(url.searchParams, options);
     // Make the API request
@@ -4775,7 +4785,7 @@ async function listLabels(projectId, options = {}) {
  */
 async function getLabel(projectId, labelId, includeAncestorGroups) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/labels/${encodeURIComponent(String(labelId))}`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/labels/${encodeGitLabPathSegment(String(labelId))}`);
     // Add query parameters
     if (includeAncestorGroups !== undefined) {
         url.searchParams.append("include_ancestor_groups", includeAncestorGroups ? "true" : "false");
@@ -4800,7 +4810,7 @@ async function getLabel(projectId, labelId, includeAncestorGroups) {
 async function createLabel(projectId, options) {
     projectId = decodeURIComponent(projectId); // Decode project ID
     // Make the API request
-    const response = await fetch(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/labels`, {
+    const response = await fetch(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/labels`, {
         ...getFetchConfig(),
         method: "POST",
         body: JSON.stringify(options),
@@ -4822,7 +4832,7 @@ async function createLabel(projectId, options) {
 async function updateLabel(projectId, labelId, options) {
     projectId = decodeURIComponent(projectId); // Decode project ID
     // Make the API request
-    const response = await fetch(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/labels/${encodeURIComponent(String(labelId))}`, {
+    const response = await fetch(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/labels/${encodeGitLabPathSegment(String(labelId))}`, {
         ...getFetchConfig(),
         method: "PUT",
         body: JSON.stringify(options),
@@ -4842,7 +4852,7 @@ async function updateLabel(projectId, labelId, options) {
 async function deleteLabel(projectId, labelId) {
     projectId = decodeURIComponent(projectId); // Decode project ID
     // Make the API request
-    const response = await fetch(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/labels/${encodeURIComponent(String(labelId))}`, {
+    const response = await fetch(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/labels/${encodeGitLabPathSegment(String(labelId))}`, {
         ...getFetchConfig(),
         method: "DELETE",
     });
@@ -4856,7 +4866,7 @@ async function deleteLabel(projectId, labelId) {
  * @returns {Promise<GitLabProject[]>} Array of projects in the group
  */
 async function listGroupProjects(options) {
-    const url = new URL(`${getEffectiveApiUrl()}/groups/${encodeURIComponent(options.group_id)}/projects`);
+    const url = new URL(`${getEffectiveApiUrl()}/groups/${encodeGitLabPathSegment(options.group_id)}/projects`);
     // Add optional parameters to URL
     if (options.include_subgroups)
         url.searchParams.append("include_subgroups", "true");
@@ -4906,11 +4916,11 @@ async function listGroupProjects(options) {
 function buildWebhookBaseUrl(projectId, groupId) {
     if (projectId) {
         projectId = decodeURIComponent(projectId);
-        return `${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/hooks`;
+        return `${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/hooks`;
     }
     rejectIfStrictProjectScope("group webhooks");
     const decodedGroupId = decodeURIComponent(groupId);
-    return `${getEffectiveApiUrl()}/groups/${encodeURIComponent(decodedGroupId)}/hooks`;
+    return `${getEffectiveApiUrl()}/groups/${encodeGitLabPathSegment(decodedGroupId)}/hooks`;
 }
 /**
  * List webhooks for a project or group
@@ -5025,7 +5035,7 @@ async function getWebhookEvent(options) {
  */
 async function listWikiPages(projectId, options = {}) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/wikis`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/wikis`);
     if (options.page)
         url.searchParams.append("page", options.page.toString());
     if (options.per_page)
@@ -5046,7 +5056,7 @@ async function listWikiPages(projectId, options = {}) {
  */
 async function getWikiPage(projectId, slug, renderHtml) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/wikis/${encodeURIComponent(slug)}`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/wikis/${encodeGitLabPathSegment(slug)}`);
     if (renderHtml)
         url.searchParams.append("render_html", renderHtml.toString());
     const response = await fetch(url.toString(), { ...getFetchConfig() });
@@ -5062,7 +5072,7 @@ async function createWikiPage(projectId, title, content, format) {
     const body = { title, content };
     if (format)
         body.format = format;
-    const response = await fetch(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/wikis`, {
+    const response = await fetch(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/wikis`, {
         ...getFetchConfig(),
         method: "POST",
         body: JSON.stringify(body),
@@ -5090,7 +5100,7 @@ async function updateWikiPage(projectId, slug, title, content, format) {
         body.content = content;
     if (format)
         body.format = format;
-    const response = await fetch(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/wikis/${encodeURIComponent(slug)}`, {
+    const response = await fetch(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/wikis/${encodeGitLabPathSegment(slug)}`, {
         ...getFetchConfig(),
         method: "PUT",
         body: JSON.stringify(body),
@@ -5104,7 +5114,7 @@ async function updateWikiPage(projectId, slug, title, content, format) {
  */
 async function deleteWikiPage(projectId, slug) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const response = await fetch(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/wikis/${encodeURIComponent(slug)}`, {
+    const response = await fetch(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/wikis/${encodeGitLabPathSegment(slug)}`, {
         ...getFetchConfig(),
         method: "DELETE",
     });
@@ -5115,7 +5125,7 @@ async function deleteWikiPage(projectId, slug) {
  */
 async function listGroupWikiPages(groupId, options = {}) {
     groupId = decodeURIComponent(groupId); // Decode group ID
-    const url = new URL(`${getEffectiveApiUrl()}/groups/${encodeURIComponent(groupId)}/wikis`);
+    const url = new URL(`${getEffectiveApiUrl()}/groups/${encodeGitLabPathSegment(groupId)}/wikis`);
     if (options.page)
         url.searchParams.append("page", options.page.toString());
     if (options.per_page)
@@ -5136,7 +5146,7 @@ async function listGroupWikiPages(groupId, options = {}) {
  */
 async function getGroupWikiPage(groupId, slug, renderHtml) {
     groupId = decodeURIComponent(groupId); // Decode group ID
-    const url = new URL(`${getEffectiveApiUrl()}/groups/${encodeURIComponent(groupId)}/wikis/${encodeURIComponent(slug)}`);
+    const url = new URL(`${getEffectiveApiUrl()}/groups/${encodeGitLabPathSegment(groupId)}/wikis/${encodeGitLabPathSegment(slug)}`);
     if (renderHtml)
         url.searchParams.append("render_html", renderHtml.toString());
     const response = await fetch(url.toString(), { ...getFetchConfig() });
@@ -5152,7 +5162,7 @@ async function createGroupWikiPage(groupId, title, content, format) {
     const body = { title, content };
     if (format)
         body.format = format;
-    const response = await fetch(`${getEffectiveApiUrl()}/groups/${encodeURIComponent(groupId)}/wikis`, {
+    const response = await fetch(`${getEffectiveApiUrl()}/groups/${encodeGitLabPathSegment(groupId)}/wikis`, {
         ...getFetchConfig(),
         method: "POST",
         body: JSON.stringify(body),
@@ -5180,7 +5190,7 @@ async function updateGroupWikiPage(groupId, slug, title, content, format) {
         body.content = content;
     if (format)
         body.format = format;
-    const response = await fetch(`${getEffectiveApiUrl()}/groups/${encodeURIComponent(groupId)}/wikis/${encodeURIComponent(slug)}`, {
+    const response = await fetch(`${getEffectiveApiUrl()}/groups/${encodeGitLabPathSegment(groupId)}/wikis/${encodeGitLabPathSegment(slug)}`, {
         ...getFetchConfig(),
         method: "PUT",
         body: JSON.stringify(body),
@@ -5194,7 +5204,7 @@ async function updateGroupWikiPage(groupId, slug, title, content, format) {
  */
 async function deleteGroupWikiPage(groupId, slug) {
     groupId = decodeURIComponent(groupId); // Decode group ID
-    const response = await fetch(`${getEffectiveApiUrl()}/groups/${encodeURIComponent(groupId)}/wikis/${encodeURIComponent(slug)}`, {
+    const response = await fetch(`${getEffectiveApiUrl()}/groups/${encodeGitLabPathSegment(groupId)}/wikis/${encodeGitLabPathSegment(slug)}`, {
         ...getFetchConfig(),
         method: "DELETE",
     });
@@ -5209,7 +5219,7 @@ async function deleteGroupWikiPage(groupId, slug) {
  */
 async function listPipelines(projectId, options = {}) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/pipelines`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/pipelines`);
     // Add all query parameters
     appendFilterParams(url.searchParams, options);
     const response = await fetch(url.toString(), {
@@ -5228,7 +5238,7 @@ async function listPipelines(projectId, options = {}) {
  */
 async function getPipeline(projectId, pipelineId, signal) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/pipelines/${encodeGitLabPathSegment(pipelineId)}`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/pipelines/${encodeGitLabPathSegment(pipelineId)}`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
         signal,
@@ -5242,7 +5252,7 @@ async function getPipeline(projectId, pipelineId, signal) {
 }
 async function getPipelineVariables(projectId, pipelineId, page, perPage) {
     projectId = decodeURIComponent(projectId);
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/pipelines/${encodeGitLabPathSegment(pipelineId)}/variables`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/pipelines/${encodeGitLabPathSegment(pipelineId)}/variables`);
     if (page !== undefined)
         url.searchParams.set("page", String(page));
     if (perPage !== undefined)
@@ -5254,7 +5264,7 @@ async function getPipelineVariables(projectId, pipelineId, page, perPage) {
 async function getPipelineReport(projectId, pipelineId, summary = false, page, perPage) {
     projectId = decodeURIComponent(projectId);
     const endpoint = summary ? "test_report_summary" : "test_report";
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/pipelines/${encodeGitLabPathSegment(pipelineId)}/${endpoint}`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/pipelines/${encodeGitLabPathSegment(pipelineId)}/${endpoint}`);
     if (page !== undefined)
         url.searchParams.set("page", String(page));
     if (perPage !== undefined)
@@ -5265,13 +5275,13 @@ async function getPipelineReport(projectId, pipelineId, summary = false, page, p
 }
 async function deletePipeline(projectId, pipelineId) {
     projectId = decodeURIComponent(projectId);
-    const response = await fetch(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/pipelines/${encodeGitLabPathSegment(pipelineId)}`, { ...getFetchConfig(), method: "DELETE" });
+    const response = await fetch(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/pipelines/${encodeGitLabPathSegment(pipelineId)}`, { ...getFetchConfig(), method: "DELETE" });
     await handleGitLabError(response);
     return response.status === 204 ? { deleted: true } : response.json();
 }
 async function updatePipelineMetadata(projectId, pipelineId, name) {
     projectId = decodeURIComponent(projectId);
-    const response = await fetch(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/pipelines/${encodeGitLabPathSegment(pipelineId)}/metadata`, { ...getFetchConfig(), method: "PUT", body: JSON.stringify({ name }) });
+    const response = await fetch(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/pipelines/${encodeGitLabPathSegment(pipelineId)}/metadata`, { ...getFetchConfig(), method: "PUT", body: JSON.stringify({ name }) });
     await handleGitLabError(response);
     return response.json();
 }
@@ -5284,7 +5294,7 @@ async function updatePipelineMetadata(projectId, pipelineId, name) {
  */
 async function listDeployments(projectId, options = {}) {
     projectId = decodeURIComponent(projectId);
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/deployments`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/deployments`);
     appendFilterParams(url.searchParams, options);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
@@ -5302,7 +5312,7 @@ async function listDeployments(projectId, options = {}) {
  */
 async function getDeployment(projectId, deploymentId) {
     projectId = decodeURIComponent(projectId);
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/deployments/${encodeGitLabPathSegment(deploymentId)}`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/deployments/${encodeGitLabPathSegment(deploymentId)}`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
     });
@@ -5315,7 +5325,7 @@ async function getDeployment(projectId, deploymentId) {
 }
 async function deploymentRequest(projectId, path = "", method = "GET", body, query) {
     projectId = decodeURIComponent(projectId);
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/deployments${path}`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/deployments${path}`);
     for (const [key, value] of Object.entries(query ?? {})) {
         if (value !== undefined)
             url.searchParams.set(key, String(value));
@@ -5336,7 +5346,7 @@ async function deploymentRequest(projectId, path = "", method = "GET", body, que
  */
 async function listEnvironments(projectId, options = {}) {
     projectId = decodeURIComponent(projectId);
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/environments`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/environments`);
     appendFilterParams(url.searchParams, options);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
@@ -5354,7 +5364,7 @@ async function listEnvironments(projectId, options = {}) {
  */
 async function getEnvironment(projectId, environmentId) {
     projectId = decodeURIComponent(projectId);
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/environments/${encodeGitLabPathSegment(environmentId)}`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/environments/${encodeGitLabPathSegment(environmentId)}`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
     });
@@ -5367,7 +5377,7 @@ async function getEnvironment(projectId, environmentId) {
 }
 async function environmentRequest(projectId, path, method, body, query) {
     projectId = decodeURIComponent(projectId);
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/environments${path}`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/environments${path}`);
     for (const [key, value] of Object.entries(query ?? {}))
         if (value !== undefined)
             url.searchParams.set(key, String(value));
@@ -5377,13 +5387,13 @@ async function environmentRequest(projectId, path, method, body, query) {
 }
 async function pipelineTriggerRequest(projectId, path = "", method = "GET", body) {
     projectId = decodeURIComponent(projectId);
-    const response = await fetch(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/triggers${path}`, { ...getFetchConfig(), method, body: body === undefined ? undefined : JSON.stringify(body) });
+    const response = await fetch(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/triggers${path}`, { ...getFetchConfig(), method, body: body === undefined ? undefined : JSON.stringify(body) });
     await handleGitLabError(response);
     return response.status === 204 ? { success: true } : response.json();
 }
 async function triggerPipeline(projectId, token, ref, variables, inputs) {
     projectId = decodeURIComponent(projectId);
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/trigger/pipeline`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/trigger/pipeline`);
     url.searchParams.set("token", token);
     url.searchParams.set("ref", ref);
     const body = {};
@@ -5405,7 +5415,7 @@ async function triggerPipeline(projectId, token, ref, variables, inputs) {
  */
 async function listPipelineJobs(projectId, pipelineId, options = {}) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/pipelines/${encodeGitLabPathSegment(pipelineId)}/jobs`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/pipelines/${encodeGitLabPathSegment(pipelineId)}/jobs`);
     // Add all query parameters
     appendFilterParams(url.searchParams, options);
     const response = await fetch(url.toString(), {
@@ -5428,7 +5438,7 @@ async function listPipelineJobs(projectId, pipelineId, options = {}) {
  */
 async function listPipelineTriggerJobs(projectId, pipelineId, options = {}) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/pipelines/${encodeGitLabPathSegment(pipelineId)}/bridges`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/pipelines/${encodeGitLabPathSegment(pipelineId)}/bridges`);
     // Add all query parameters
     appendFilterParams(url.searchParams, options);
     const response = await fetch(url.toString(), {
@@ -5443,7 +5453,7 @@ async function listPipelineTriggerJobs(projectId, pipelineId, options = {}) {
 }
 async function getPipelineJob(projectId, jobId, signal) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/jobs/${encodeGitLabPathSegment(jobId)}`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/jobs/${encodeGitLabPathSegment(jobId)}`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
         signal,
@@ -5467,7 +5477,7 @@ async function getPipelineJob(projectId, jobId, signal) {
 const MAX_JOB_TRACE_LINES = 1000;
 async function getPipelineJobOutput(projectId, jobId, limit, offset) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/jobs/${encodeGitLabPathSegment(jobId)}/trace`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/jobs/${encodeGitLabPathSegment(jobId)}/trace`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
         headers: {
@@ -5502,7 +5512,7 @@ async function getPipelineJobOutput(projectId, jobId, limit, offset) {
 }
 async function validateCiLint(projectId, options) {
     projectId = decodeURIComponent(projectId);
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/ci/lint`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/ci/lint`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
         method: "POST",
@@ -5514,7 +5524,7 @@ async function validateCiLint(projectId, options) {
 }
 async function validateProjectCiLint(projectId, options) {
     projectId = decodeURIComponent(projectId);
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/ci/lint`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/ci/lint`);
     appendFilterParams(url.searchParams, options);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
@@ -5533,7 +5543,7 @@ async function validateProjectCiLint(projectId, options) {
  */
 async function listJobArtifacts(projectId, jobId, options = {}) {
     projectId = decodeURIComponent(projectId);
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/jobs/${encodeGitLabPathSegment(jobId)}/artifacts/tree`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/jobs/${encodeGitLabPathSegment(jobId)}/artifacts/tree`);
     appendFilterParams(url.searchParams, options);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
@@ -5556,10 +5566,8 @@ async function listJobArtifacts(projectId, jobId, options = {}) {
 async function downloadJobArtifacts(projectId, jobId, localPath) {
     projectId = decodeURIComponent(projectId);
     const effectiveProjectId = getEffectiveProjectId(projectId);
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(effectiveProjectId)}/jobs/${encodeGitLabPathSegment(jobId)}/artifacts`);
-    const response = await fetch(url.toString(), {
-        ...getFetchConfig(),
-    });
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(effectiveProjectId)}/jobs/${encodeGitLabPathSegment(jobId)}/artifacts`);
+    const response = await fetchWithValidatedRedirects(url.toString(), downloadRedirectOptions());
     if (response.status === 404) {
         throw new Error(`Job artifacts not found. The job may not have produced artifacts or the job ID is invalid.`);
     }
@@ -5583,14 +5591,9 @@ async function downloadJobArtifacts(projectId, jobId, localPath) {
 async function getJobArtifactFile(projectId, jobId, artifactPath) {
     projectId = decodeURIComponent(projectId);
     const effectiveProjectId = getEffectiveProjectId(projectId);
-    const encodedArtifactPath = artifactPath
-        .split("/")
-        .map(segment => encodeGitLabPathSegment(segment))
-        .join("/");
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(effectiveProjectId)}/jobs/${encodeGitLabPathSegment(jobId)}/artifacts/${encodedArtifactPath}`);
-    const response = await fetch(url.toString(), {
-        ...getFetchConfig(),
-    });
+    const encodedArtifactPath = encodeGitLabPath(artifactPath);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(effectiveProjectId)}/jobs/${encodeGitLabPathSegment(jobId)}/artifacts/${encodedArtifactPath}`);
+    const response = await fetchWithValidatedRedirects(url.toString(), downloadRedirectOptions());
     if (response.status === 404) {
         throw new Error(`Artifact file not found: ${artifactPath}`);
     }
@@ -5608,7 +5611,7 @@ async function getJobArtifactFile(projectId, jobId, artifactPath) {
  */
 async function createPipeline(projectId, ref, variables, inputs) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/pipeline`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/pipeline`);
     const body = { ref };
     if (variables && variables.length > 0) {
         body.variables = variables;
@@ -5634,7 +5637,7 @@ async function createPipeline(projectId, ref, variables, inputs) {
  */
 async function retryPipeline(projectId, pipelineId) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/pipelines/${encodeGitLabPathSegment(pipelineId)}/retry`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/pipelines/${encodeGitLabPathSegment(pipelineId)}/retry`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
         method: "POST",
@@ -5652,7 +5655,7 @@ async function retryPipeline(projectId, pipelineId) {
  */
 async function cancelPipeline(projectId, pipelineId) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/pipelines/${encodeGitLabPathSegment(pipelineId)}/cancel`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/pipelines/${encodeGitLabPathSegment(pipelineId)}/cancel`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
         method: "POST",
@@ -5670,7 +5673,7 @@ async function cancelPipeline(projectId, pipelineId) {
  */
 async function listPipelineSchedules(projectId, options = {}) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/pipeline_schedules`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/pipeline_schedules`);
     appendFilterParams(url.searchParams, options);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
@@ -5688,7 +5691,7 @@ async function listPipelineSchedules(projectId, options = {}) {
  */
 async function getPipelineSchedule(projectId, pipelineScheduleId) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/pipeline_schedules/${encodeGitLabPathSegment(pipelineScheduleId)}`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/pipeline_schedules/${encodeGitLabPathSegment(pipelineScheduleId)}`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
     });
@@ -5706,7 +5709,7 @@ async function getPipelineSchedule(projectId, pipelineScheduleId) {
  */
 async function listPipelineSchedulePipelines(projectId, pipelineScheduleId, options = {}) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/pipeline_schedules/${encodeGitLabPathSegment(pipelineScheduleId)}/pipelines`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/pipeline_schedules/${encodeGitLabPathSegment(pipelineScheduleId)}/pipelines`);
     appendFilterParams(url.searchParams, options);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
@@ -5724,7 +5727,7 @@ async function listPipelineSchedulePipelines(projectId, pipelineScheduleId, opti
  */
 async function createPipelineSchedule(projectId, options) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/pipeline_schedules`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/pipeline_schedules`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
         method: "POST",
@@ -5744,7 +5747,7 @@ async function createPipelineSchedule(projectId, options) {
  */
 async function updatePipelineSchedule(projectId, pipelineScheduleId, options) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/pipeline_schedules/${encodeGitLabPathSegment(pipelineScheduleId)}`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/pipeline_schedules/${encodeGitLabPathSegment(pipelineScheduleId)}`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
         method: "PUT",
@@ -5763,7 +5766,7 @@ async function updatePipelineSchedule(projectId, pipelineScheduleId, options) {
  */
 async function deletePipelineSchedule(projectId, pipelineScheduleId) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/pipeline_schedules/${encodeGitLabPathSegment(pipelineScheduleId)}`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/pipeline_schedules/${encodeGitLabPathSegment(pipelineScheduleId)}`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
         method: "DELETE",
@@ -5779,7 +5782,7 @@ async function deletePipelineSchedule(projectId, pipelineScheduleId) {
  */
 async function playPipelineSchedule(projectId, pipelineScheduleId) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/pipeline_schedules/${encodeGitLabPathSegment(pipelineScheduleId)}/play`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/pipeline_schedules/${encodeGitLabPathSegment(pipelineScheduleId)}/play`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
         method: "POST",
@@ -5797,7 +5800,7 @@ async function playPipelineSchedule(projectId, pipelineScheduleId) {
  */
 async function takeOwnershipPipelineSchedule(projectId, pipelineScheduleId) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/pipeline_schedules/${encodeGitLabPathSegment(pipelineScheduleId)}/take_ownership`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/pipeline_schedules/${encodeGitLabPathSegment(pipelineScheduleId)}/take_ownership`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
         method: "POST",
@@ -5816,7 +5819,7 @@ async function takeOwnershipPipelineSchedule(projectId, pipelineScheduleId) {
  */
 async function getPipelineScheduleVariable(projectId, pipelineScheduleId, key) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/pipeline_schedules/${encodeGitLabPathSegment(pipelineScheduleId)}/variables/${encodeGitLabPathSegment(key)}`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/pipeline_schedules/${encodeGitLabPathSegment(pipelineScheduleId)}/variables/${encodeGitLabPathSegment(key)}`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
     });
@@ -5834,7 +5837,7 @@ async function getPipelineScheduleVariable(projectId, pipelineScheduleId, key) {
  */
 async function createPipelineScheduleVariable(projectId, pipelineScheduleId, options) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/pipeline_schedules/${encodeGitLabPathSegment(pipelineScheduleId)}/variables`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/pipeline_schedules/${encodeGitLabPathSegment(pipelineScheduleId)}/variables`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
         method: "POST",
@@ -5855,7 +5858,7 @@ async function createPipelineScheduleVariable(projectId, pipelineScheduleId, opt
  */
 async function updatePipelineScheduleVariable(projectId, pipelineScheduleId, key, options) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/pipeline_schedules/${encodeGitLabPathSegment(pipelineScheduleId)}/variables/${encodeGitLabPathSegment(key)}`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/pipeline_schedules/${encodeGitLabPathSegment(pipelineScheduleId)}/variables/${encodeGitLabPathSegment(key)}`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
         method: "PUT",
@@ -5875,7 +5878,7 @@ async function updatePipelineScheduleVariable(projectId, pipelineScheduleId, key
  */
 async function deletePipelineScheduleVariable(projectId, pipelineScheduleId, key) {
     projectId = decodeURIComponent(projectId); // Decode project ID
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/pipeline_schedules/${encodeGitLabPathSegment(pipelineScheduleId)}/variables/${encodeGitLabPathSegment(key)}`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/pipeline_schedules/${encodeGitLabPathSegment(pipelineScheduleId)}/variables/${encodeGitLabPathSegment(key)}`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
         method: "DELETE",
@@ -5892,7 +5895,7 @@ async function deletePipelineScheduleVariable(projectId, pipelineScheduleId, key
  */
 async function playPipelineJob(projectId, jobId, variables, jobInputs) {
     projectId = decodeURIComponent(projectId);
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/jobs/${encodeGitLabPathSegment(jobId)}/play`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/jobs/${encodeGitLabPathSegment(jobId)}/play`);
     const body = {};
     if (variables && variables.length > 0) {
         body.job_variables_attributes = variables;
@@ -5926,7 +5929,7 @@ async function playPipelineJobs(projectId, jobIds, variables, timeoutSeconds = 3
  */
 async function retryPipelineJob(projectId, jobId, jobInputs) {
     projectId = decodeURIComponent(projectId);
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/jobs/${encodeGitLabPathSegment(jobId)}/retry`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/jobs/${encodeGitLabPathSegment(jobId)}/retry`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
         method: "POST",
@@ -5938,7 +5941,7 @@ async function retryPipelineJob(projectId, jobId, jobInputs) {
 }
 async function erasePipelineJob(projectId, jobId) {
     projectId = decodeURIComponent(projectId);
-    const response = await fetch(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/jobs/${encodeGitLabPathSegment(jobId)}/erase`, { ...getFetchConfig(), method: "POST" });
+    const response = await fetch(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/jobs/${encodeGitLabPathSegment(jobId)}/erase`, { ...getFetchConfig(), method: "POST" });
     await handleGitLabError(response);
     return response.status === 204 ? { erased: true } : response.json();
 }
@@ -5974,7 +5977,7 @@ async function waitForStatus(fetchStatus, terminalStatuses, timeoutSeconds = 300
  */
 async function cancelPipelineJob(projectId, jobId, force) {
     projectId = decodeURIComponent(projectId);
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/jobs/${encodeGitLabPathSegment(jobId)}/cancel`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/jobs/${encodeGitLabPathSegment(jobId)}/cancel`);
     if (force !== undefined) {
         url.searchParams.append("force", force.toString());
     }
@@ -6006,7 +6009,7 @@ async function getRepositoryTree(options) {
         queryParams.append("page_token", options.page_token);
     if (options.pagination)
         queryParams.append("pagination", options.pagination);
-    const response = await fetch(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(options.project_id))}/repository/tree?${queryParams.toString()}`, { ...getFetchConfig() });
+    const response = await fetch(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(options.project_id))}/repository/tree?${queryParams.toString()}`, { ...getFetchConfig() });
     if (response.status === 404) {
         throw new Error("Repository or path not found");
     }
@@ -6028,7 +6031,7 @@ async function getRepositoryTree(options) {
  */
 async function listProjectMilestones(projectId, options) {
     projectId = decodeURIComponent(projectId);
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/milestones`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/milestones`);
     Object.entries(options).forEach(([key, value]) => {
         // Drop blank entries inside arrays so they behave like the scalar blank guard below
         const normalized = dropBlankArrayEntries(value);
@@ -6059,7 +6062,7 @@ async function listProjectMilestones(projectId, options) {
  */
 async function getProjectMilestone(projectId, milestoneId) {
     projectId = decodeURIComponent(projectId);
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/milestones/${encodeGitLabPathSegment(milestoneId)}`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/milestones/${encodeGitLabPathSegment(milestoneId)}`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
     });
@@ -6075,7 +6078,7 @@ async function getProjectMilestone(projectId, milestoneId) {
  */
 async function createProjectMilestone(projectId, options) {
     projectId = decodeURIComponent(projectId);
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/milestones`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/milestones`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
         method: "POST",
@@ -6094,7 +6097,7 @@ async function createProjectMilestone(projectId, options) {
  */
 async function editProjectMilestone(projectId, milestoneId, options) {
     projectId = decodeURIComponent(projectId);
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/milestones/${encodeGitLabPathSegment(milestoneId)}`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/milestones/${encodeGitLabPathSegment(milestoneId)}`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
         method: "PUT",
@@ -6112,7 +6115,7 @@ async function editProjectMilestone(projectId, milestoneId, options) {
  */
 async function deleteProjectMilestone(projectId, milestoneId) {
     projectId = decodeURIComponent(projectId);
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/milestones/${encodeGitLabPathSegment(milestoneId)}`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/milestones/${encodeGitLabPathSegment(milestoneId)}`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
         method: "DELETE",
@@ -6127,7 +6130,7 @@ async function deleteProjectMilestone(projectId, milestoneId) {
  */
 async function getMilestoneIssues(projectId, milestoneId, options = {}) {
     projectId = decodeURIComponent(projectId);
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/milestones/${encodeGitLabPathSegment(milestoneId)}/issues`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/milestones/${encodeGitLabPathSegment(milestoneId)}/issues`);
     appendFilterParams(url.searchParams, options);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
@@ -6144,7 +6147,7 @@ async function getMilestoneIssues(projectId, milestoneId, options = {}) {
  */
 async function getMilestoneMergeRequests(projectId, milestoneId, options = {}) {
     projectId = decodeURIComponent(projectId);
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/milestones/${encodeGitLabPathSegment(milestoneId)}/merge_requests`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/milestones/${encodeGitLabPathSegment(milestoneId)}/merge_requests`);
     appendFilterParams(url.searchParams, options);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
@@ -6161,7 +6164,7 @@ async function getMilestoneMergeRequests(projectId, milestoneId, options = {}) {
  */
 async function promoteProjectMilestone(projectId, milestoneId) {
     projectId = decodeURIComponent(projectId);
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/milestones/${encodeGitLabPathSegment(milestoneId)}/promote`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/milestones/${encodeGitLabPathSegment(milestoneId)}/promote`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
         method: "POST",
@@ -6178,7 +6181,7 @@ async function promoteProjectMilestone(projectId, milestoneId) {
  */
 async function getMilestoneBurndownEvents(projectId, milestoneId, options = {}) {
     projectId = decodeURIComponent(projectId);
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/milestones/${encodeGitLabPathSegment(milestoneId)}/burndown_events`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/milestones/${encodeGitLabPathSegment(milestoneId)}/burndown_events`);
     appendFilterParams(url.searchParams, options);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
@@ -6192,7 +6195,7 @@ async function getMilestoneBurndownEvents(projectId, milestoneId, options = {})
  */
 async function listGroupMilestones(groupId, options) {
     groupId = decodeURIComponent(groupId);
-    const url = new URL(`${getEffectiveApiUrl()}/groups/${encodeURIComponent(groupId)}/milestones`);
+    const url = new URL(`${getEffectiveApiUrl()}/groups/${encodeGitLabPathSegment(groupId)}/milestones`);
     Object.entries(options).forEach(([key, value]) => {
         // Drop blank entries inside arrays so they behave like the scalar blank guard below
         const normalized = dropBlankArrayEntries(value);
@@ -6220,7 +6223,7 @@ async function listGroupMilestones(groupId, options) {
  */
 async function getGroupMilestone(groupId, milestoneId) {
     groupId = decodeURIComponent(groupId);
-    const url = new URL(`${getEffectiveApiUrl()}/groups/${encodeURIComponent(groupId)}/milestones/${encodeGitLabPathSegment(milestoneId)}`);
+    const url = new URL(`${getEffectiveApiUrl()}/groups/${encodeGitLabPathSegment(groupId)}/milestones/${encodeGitLabPathSegment(milestoneId)}`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
     });
@@ -6233,7 +6236,7 @@ async function getGroupMilestone(groupId, milestoneId) {
  */
 async function createGroupMilestone(groupId, options) {
     groupId = decodeURIComponent(groupId);
-    const url = new URL(`${getEffectiveApiUrl()}/groups/${encodeURIComponent(groupId)}/milestones`);
+    const url = new URL(`${getEffectiveApiUrl()}/groups/${encodeGitLabPathSegment(groupId)}/milestones`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
         method: "POST",
@@ -6248,7 +6251,7 @@ async function createGroupMilestone(groupId, options) {
  */
 async function editGroupMilestone(groupId, milestoneId, options) {
     groupId = decodeURIComponent(groupId);
-    const url = new URL(`${getEffectiveApiUrl()}/groups/${encodeURIComponent(groupId)}/milestones/${encodeGitLabPathSegment(milestoneId)}`);
+    const url = new URL(`${getEffectiveApiUrl()}/groups/${encodeGitLabPathSegment(groupId)}/milestones/${encodeGitLabPathSegment(milestoneId)}`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
         method: "PUT",
@@ -6263,7 +6266,7 @@ async function editGroupMilestone(groupId, milestoneId, options) {
  */
 async function deleteGroupMilestone(groupId, milestoneId) {
     groupId = decodeURIComponent(groupId);
-    const url = new URL(`${getEffectiveApiUrl()}/groups/${encodeURIComponent(groupId)}/milestones/${encodeGitLabPathSegment(milestoneId)}`);
+    const url = new URL(`${getEffectiveApiUrl()}/groups/${encodeGitLabPathSegment(groupId)}/milestones/${encodeGitLabPathSegment(milestoneId)}`);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
         method: "DELETE",
@@ -6275,7 +6278,7 @@ async function deleteGroupMilestone(groupId, milestoneId) {
  */
 async function getGroupMilestoneIssues(groupId, milestoneId, options = {}) {
     groupId = decodeURIComponent(groupId);
-    const url = new URL(`${getEffectiveApiUrl()}/groups/${encodeURIComponent(groupId)}/milestones/${encodeGitLabPathSegment(milestoneId)}/issues`);
+    const url = new URL(`${getEffectiveApiUrl()}/groups/${encodeGitLabPathSegment(groupId)}/milestones/${encodeGitLabPathSegment(milestoneId)}/issues`);
     appendFilterParams(url.searchParams, options);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
@@ -6289,7 +6292,7 @@ async function getGroupMilestoneIssues(groupId, milestoneId, options = {}) {
  */
 async function getGroupMilestoneMergeRequests(groupId, milestoneId, options = {}) {
     groupId = decodeURIComponent(groupId);
-    const url = new URL(`${getEffectiveApiUrl()}/groups/${encodeURIComponent(groupId)}/milestones/${encodeGitLabPathSegment(milestoneId)}/merge_requests`);
+    const url = new URL(`${getEffectiveApiUrl()}/groups/${encodeGitLabPathSegment(groupId)}/milestones/${encodeGitLabPathSegment(milestoneId)}/merge_requests`);
     appendFilterParams(url.searchParams, options);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
@@ -6303,7 +6306,7 @@ async function getGroupMilestoneMergeRequests(groupId, milestoneId, options = {}
  */
 async function getGroupMilestoneBurndownEvents(groupId, milestoneId, options = {}) {
     groupId = decodeURIComponent(groupId);
-    const url = new URL(`${getEffectiveApiUrl()}/groups/${encodeURIComponent(groupId)}/milestones/${encodeGitLabPathSegment(milestoneId)}/burndown_events`);
+    const url = new URL(`${getEffectiveApiUrl()}/groups/${encodeGitLabPathSegment(groupId)}/milestones/${encodeGitLabPathSegment(milestoneId)}/burndown_events`);
     appendFilterParams(url.searchParams, options);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
@@ -6374,7 +6377,7 @@ async function getUsers(usernames) {
  */
 async function listCommits(projectId, options = {}) {
     projectId = decodeURIComponent(projectId);
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/repository/commits`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/repository/commits`);
     // Add query parameters
     if (options.ref_name)
         url.searchParams.append("ref_name", options.ref_name);
@@ -6418,7 +6421,7 @@ async function listCommits(projectId, options = {}) {
  */
 async function getCommit(projectId, sha, stats) {
     projectId = decodeURIComponent(projectId);
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/repository/commits/${encodeURIComponent(sha)}`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/repository/commits/${encodeGitLabPathSegment(sha)}`);
     if (stats) {
         url.searchParams.append("stats", "true");
     }
@@ -6440,7 +6443,7 @@ async function getCommit(projectId, sha, stats) {
  */
 async function getCommitDiff(projectId, sha, full_diff) {
     projectId = decodeURIComponent(projectId);
-    const baseUrl = `${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/repository/commits/${encodeURIComponent(sha)}/diff`;
+    const baseUrl = `${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/repository/commits/${encodeGitLabPathSegment(sha)}/diff`;
     let allDiffs = [];
     let page = 1;
     while (true) {
@@ -6479,7 +6482,7 @@ async function getCommitDiff(projectId, sha, full_diff) {
  */
 async function getFileBlame(projectId, options) {
     projectId = decodeURIComponent(projectId);
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/repository/files/${encodeURIComponent(options.file_path)}/blame`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/repository/files/${encodeGitLabPathSegment(options.file_path)}/blame`);
     url.searchParams.append("ref", options.ref);
     if (options.range_start !== undefined && options.range_end !== undefined) {
         url.searchParams.append("range[start]", options.range_start.toString());
@@ -6502,7 +6505,7 @@ async function getFileBlame(projectId, options) {
  */
 async function listCommitStatuses(projectId, sha, options = {}) {
     projectId = decodeURIComponent(projectId);
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/repository/commits/${encodeURIComponent(sha)}/statuses`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/repository/commits/${encodeGitLabPathSegment(sha)}/statuses`);
     appendFilterParams(url.searchParams, options);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
@@ -6524,7 +6527,7 @@ async function createCommitStatus(projectId, sha, options) {
         throw new Error("Use either name or context when creating a commit status, not both.");
     }
     projectId = decodeURIComponent(projectId);
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/statuses/${encodeURIComponent(sha)}`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/statuses/${encodeGitLabPathSegment(sha)}`);
     appendFilterParams(url.searchParams, options);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
@@ -6614,7 +6617,7 @@ async function listProjectMembers(projectId, options = {}) {
     projectId = decodeURIComponent(projectId);
     const effectiveProjectId = getEffectiveProjectId(projectId);
     const membersPath = options.include_inheritance ? "members/all" : "members";
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(effectiveProjectId)}/${membersPath}`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(effectiveProjectId)}/${membersPath}`);
     // Add query parameters
     if (options.query)
         url.searchParams.append("query", options.query);
@@ -6644,7 +6647,7 @@ async function listProjectMembers(projectId, options = {}) {
 async function listGroupMembers(groupId, options = {}) {
     groupId = decodeURIComponent(groupId);
     const membersPath = options.include_inheritance ? "members/all" : "members";
-    const url = new URL(`${getEffectiveApiUrl()}/groups/${encodeURIComponent(groupId)}/${membersPath}`);
+    const url = new URL(`${getEffectiveApiUrl()}/groups/${encodeGitLabPathSegment(groupId)}/${membersPath}`);
     if (options.query)
         url.searchParams.append("query", options.query);
     if (options.user_ids) {
@@ -6671,7 +6674,7 @@ async function listGroupMembers(groupId, options = {}) {
  */
 async function listGroupIterations(groupId, options = {}) {
     groupId = decodeURIComponent(groupId);
-    const url = new URL(`${getEffectiveApiUrl()}/groups/${encodeURIComponent(groupId)}/iterations`);
+    const url = new URL(`${getEffectiveApiUrl()}/groups/${encodeGitLabPathSegment(groupId)}/iterations`);
     // クエリパラメータの追加
     if (options.state)
         url.searchParams.append("state", options.state);
@@ -6701,7 +6704,7 @@ async function listGroupIterations(groupId, options = {}) {
 // --- CI/CD Variables ---
 async function listProjectVariables(projectId, options = {}) {
     projectId = decodeURIComponent(projectId);
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/variables`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/variables`);
     Object.entries(options).forEach(([key, value]) => {
         if (key === "filter" && typeof value === "object" && value !== null) {
             Object.entries(value).forEach(([filterKey, filterValue]) => {
@@ -6718,7 +6721,7 @@ async function listProjectVariables(projectId, options = {}) {
 }
 async function getProjectVariable(projectId, key, filter) {
     projectId = decodeURIComponent(projectId);
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/variables/${encodeURIComponent(key)}`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/variables/${encodeGitLabPathSegment(key)}`);
     if (filter?.environment_scope) {
         url.searchParams.append("filter[environment_scope]", filter.environment_scope);
     }
@@ -6729,7 +6732,7 @@ async function getProjectVariable(projectId, key, filter) {
 }
 async function createProjectVariable(projectId, options) {
     projectId = decodeURIComponent(projectId);
-    const response = await fetch(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/variables`, { ...getFetchConfig(), method: "POST", body: JSON.stringify(options) });
+    const response = await fetch(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/variables`, { ...getFetchConfig(), method: "POST", body: JSON.stringify(options) });
     await handleGitLabError(response);
     const data = await response.json();
     return GitLabCiVariableSchema.parse(data);
@@ -6737,7 +6740,7 @@ async function createProjectVariable(projectId, options) {
 async function updateProjectVariable(projectId, key, options) {
     projectId = decodeURIComponent(projectId);
     const { filter, ...body } = options;
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/variables/${encodeURIComponent(key)}`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/variables/${encodeGitLabPathSegment(key)}`);
     if (filter?.environment_scope) {
         url.searchParams.append("filter[environment_scope]", filter.environment_scope);
     }
@@ -6752,7 +6755,7 @@ async function updateProjectVariable(projectId, key, options) {
 }
 async function deleteProjectVariable(projectId, key, filter) {
     projectId = decodeURIComponent(projectId);
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/variables/${encodeURIComponent(key)}`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/variables/${encodeGitLabPathSegment(key)}`);
     if (filter?.environment_scope) {
         url.searchParams.append("filter[environment_scope]", filter.environment_scope);
     }
@@ -6760,7 +6763,7 @@ async function deleteProjectVariable(projectId, key, filter) {
     await handleGitLabError(response);
 }
 async function listGroupVariables(groupId, options = {}) {
-    const encoded = encodeURIComponent(decodeURIComponent(groupId));
+    const encoded = encodeGitLabPathSegment(groupId);
     const url = new URL(`${getEffectiveApiUrl()}/groups/${encoded}/variables`);
     Object.entries(options).forEach(([key, value]) => {
         if (key === "filter" && typeof value === "object" && value !== null) {
@@ -6777,8 +6780,8 @@ async function listGroupVariables(groupId, options = {}) {
     return z.array(GitLabCiVariableSchema).parse(data);
 }
 async function getGroupVariable(groupId, key, filter) {
-    const encoded = encodeURIComponent(decodeURIComponent(groupId));
-    const url = new URL(`${getEffectiveApiUrl()}/groups/${encoded}/variables/${encodeURIComponent(key)}`);
+    const encoded = encodeGitLabPathSegment(groupId);
+    const url = new URL(`${getEffectiveApiUrl()}/groups/${encoded}/variables/${encodeGitLabPathSegment(key)}`);
     if (filter?.environment_scope) {
         url.searchParams.append("filter[environment_scope]", filter.environment_scope);
     }
@@ -6788,7 +6791,7 @@ async function getGroupVariable(groupId, key, filter) {
     return GitLabCiVariableSchema.parse(data);
 }
 async function createGroupVariable(groupId, options) {
-    const encoded = encodeURIComponent(decodeURIComponent(groupId));
+    const encoded = encodeGitLabPathSegment(groupId);
     const response = await fetch(`${getEffectiveApiUrl()}/groups/${encoded}/variables`, {
         ...getFetchConfig(),
         method: "POST",
@@ -6799,9 +6802,9 @@ async function createGroupVariable(groupId, options) {
     return GitLabCiVariableSchema.parse(data);
 }
 async function updateGroupVariable(groupId, key, options) {
-    const encoded = encodeURIComponent(decodeURIComponent(groupId));
+    const encoded = encodeGitLabPathSegment(groupId);
     const { filter, ...body } = options;
-    const url = new URL(`${getEffectiveApiUrl()}/groups/${encoded}/variables/${encodeURIComponent(key)}`);
+    const url = new URL(`${getEffectiveApiUrl()}/groups/${encoded}/variables/${encodeGitLabPathSegment(key)}`);
     if (filter?.environment_scope) {
         url.searchParams.append("filter[environment_scope]", filter.environment_scope);
     }
@@ -6815,8 +6818,8 @@ async function updateGroupVariable(groupId, key, options) {
     return GitLabCiVariableSchema.parse(data);
 }
 async function deleteGroupVariable(groupId, key, filter) {
-    const encoded = encodeURIComponent(decodeURIComponent(groupId));
-    const url = new URL(`${getEffectiveApiUrl()}/groups/${encoded}/variables/${encodeURIComponent(key)}`);
+    const encoded = encodeGitLabPathSegment(groupId);
+    const url = new URL(`${getEffectiveApiUrl()}/groups/${encoded}/variables/${encodeGitLabPathSegment(key)}`);
     if (filter?.environment_scope) {
         url.searchParams.append("filter[environment_scope]", filter.environment_scope);
     }
@@ -6902,7 +6905,7 @@ async function listDependencyProxyBlobs(groupPath, options = {}) {
     };
 }
 async function purgeDependencyProxyCache(groupId) {
-    const encoded = encodeURIComponent(decodeURIComponent(groupId));
+    const encoded = encodeGitLabPathSegment(groupId);
     const url = new URL(`${getEffectiveApiUrl()}/groups/${encoded}/dependency_proxy/cache`);
     const response = await fetch(url.toString(), { ...getFetchConfig(), method: "DELETE" });
     await handleGitLabError(response);
@@ -6932,7 +6935,7 @@ async function resolveProjectFullPath(projectId) {
     if (!/^\d+$/.test(decoded)) {
         return decoded;
     }
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(decoded)}`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(decoded)}`);
     const response = await fetch(url.toString(), { ...getFetchConfig() });
     await handleGitLabError(response);
     const project = (await response.json());
@@ -7243,7 +7246,7 @@ async function markdownUpload(projectId, filePath, content, filename) {
     // Create form data
     const form = new FormData();
     form.append("file", new File([fileBuffer], fileName, { type: "application/octet-stream" }));
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(effectiveProjectId)}/uploads`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(effectiveProjectId)}/uploads`);
     const defaultFetchConfig = getFetchConfig();
     delete defaultFetchConfig.headers["Content-Type"];
     const response = await fetch(url.toString(), {
@@ -7284,11 +7287,8 @@ function getSafeAttachmentFilename(filename) {
 async function downloadAttachment(projectId, secret, filename, localPath) {
     const effectiveProjectId = getEffectiveProjectId(projectId);
     const safeFilename = getSafeAttachmentFilename(filename);
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(effectiveProjectId)}/uploads/${encodeGitLabPathSegment(secret)}/${encodeGitLabPathSegment(safeFilename)}`);
-    const response = await fetch(url.toString(), {
-        ...getFetchConfig(),
-        method: "GET",
-    });
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(effectiveProjectId)}/uploads/${encodeGitLabPathSegment(secret)}/${encodeGitLabPathSegment(safeFilename)}`);
+    const response = await fetchWithValidatedRedirects(url.toString(), downloadRedirectOptions());
     if (!response.ok) {
         await handleGitLabError(response);
     }
@@ -7332,7 +7332,7 @@ async function listEvents(options = {}) {
  */
 async function getProjectEvents(projectId, options = {}) {
     const effectiveProjectId = getEffectiveProjectId(projectId);
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(effectiveProjectId)}/events`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(effectiveProjectId)}/events`);
     // Add all query parameters
     appendFilterParams(url.searchParams, options);
     const response = await fetch(url.toString(), { ...getFetchConfig() });
@@ -7351,7 +7351,7 @@ async function getProjectEvents(projectId, options = {}) {
  */
 async function listReleases(projectId, options = {}) {
     const effectiveProjectId = getEffectiveProjectId(projectId);
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(effectiveProjectId)}/releases`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(effectiveProjectId)}/releases`);
     // Add query parameters
     appendFilterParams(url.searchParams, options);
     const response = await fetch(url.toString(), {
@@ -7371,7 +7371,7 @@ async function listReleases(projectId, options = {}) {
  */
 async function getRelease(projectId, tagName, includeHtmlDescription) {
     const effectiveProjectId = getEffectiveProjectId(projectId);
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(effectiveProjectId)}/releases/${encodeGitLabPathSegment(tagName)}`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(effectiveProjectId)}/releases/${encodeGitLabPathSegment(tagName)}`);
     if (includeHtmlDescription !== undefined) {
         url.searchParams.append("include_html_description", includeHtmlDescription.toString());
     }
@@ -7391,7 +7391,7 @@ async function getRelease(projectId, tagName, includeHtmlDescription) {
  */
 async function createRelease(projectId, options) {
     const effectiveProjectId = getEffectiveProjectId(projectId);
-    const response = await fetch(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(effectiveProjectId)}/releases`, {
+    const response = await fetch(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(effectiveProjectId)}/releases`, {
         ...getFetchConfig(),
         method: "POST",
         body: JSON.stringify(options),
@@ -7410,7 +7410,7 @@ async function createRelease(projectId, options) {
  */
 async function updateRelease(projectId, tagName, options) {
     const effectiveProjectId = getEffectiveProjectId(projectId);
-    const response = await fetch(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(effectiveProjectId)}/releases/${encodeGitLabPathSegment(tagName)}`, {
+    const response = await fetch(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(effectiveProjectId)}/releases/${encodeGitLabPathSegment(tagName)}`, {
         ...getFetchConfig(),
         method: "PUT",
         body: JSON.stringify(options),
@@ -7428,7 +7428,7 @@ async function updateRelease(projectId, tagName, options) {
  */
 async function deleteRelease(projectId, tagName) {
     const effectiveProjectId = getEffectiveProjectId(projectId);
-    const response = await fetch(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(effectiveProjectId)}/releases/${encodeGitLabPathSegment(tagName)}`, {
+    const response = await fetch(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(effectiveProjectId)}/releases/${encodeGitLabPathSegment(tagName)}`, {
         ...getFetchConfig(),
         method: "DELETE",
     });
@@ -7444,7 +7444,7 @@ async function deleteRelease(projectId, tagName) {
  */
 async function createReleaseEvidence(projectId, tagName) {
     const effectiveProjectId = getEffectiveProjectId(projectId);
-    const response = await fetch(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(effectiveProjectId)}/releases/${encodeGitLabPathSegment(tagName)}/evidence`, {
+    const response = await fetch(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(effectiveProjectId)}/releases/${encodeGitLabPathSegment(tagName)}/evidence`, {
         ...getFetchConfig(),
         method: "POST",
     });
@@ -7460,9 +7460,7 @@ async function createReleaseEvidence(projectId, tagName) {
  */
 async function downloadReleaseAsset(projectId, tagName, directAssetPath) {
     const effectiveProjectId = getEffectiveProjectId(projectId);
-    const response = await fetch(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(effectiveProjectId)}/releases/${encodeGitLabPathSegment(tagName)}/downloads/${encodeGitLabPath(directAssetPath)}`, {
-        ...getFetchConfig(),
-    });
+    const response = await fetchWithValidatedRedirects(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(effectiveProjectId)}/releases/${encodeGitLabPathSegment(tagName)}/downloads/${encodeGitLabPath(directAssetPath)}`, downloadRedirectOptions());
     await handleGitLabError(response);
     return await response.text();
 }
@@ -7475,7 +7473,7 @@ async function downloadReleaseAsset(projectId, tagName, directAssetPath) {
  */
 async function listTags(projectId, options = {}) {
     const effectiveProjectId = getEffectiveProjectId(projectId);
-    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(effectiveProjectId)}/repository/tags`);
+    const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(effectiveProjectId)}/repository/tags`);
     appendFilterParams(url.searchParams, options);
     const response = await fetch(url.toString(), {
         ...getFetchConfig(),
@@ -7493,7 +7491,7 @@ async function listTags(projectId, options = {}) {
  */
 async function getTag(projectId, tagName) {
     const effectiveProjectId = getEffectiveProjectId(projectId);
-    const response = await fetch(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(effectiveProjectId)}/repository/tags/${encodeURIComponent(tagName)}`, {
+    const response = await fetch(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(effectiveProjectId)}/repository/tags/${encodeGitLabPathSegment(tagName)}`, {
         ...getFetchConfig(),
     });
     await handleGitLabError(response);
@@ -7509,7 +7507,7 @@ async function getTag(projectId, tagName) {
  */
 async function createTag(projectId, options) {
     const effectiveProjectId = getEffectiveProjectId(projectId);
-    const response = await fetch(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(effectiveProjectId)}/repository/tags`, {
+    const response = await fetch(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(effectiveProjectId)}/repository/tags`, {
         ...getFetchConfig(),
         method: "POST",
         body: JSON.stringify(options),
@@ -7526,7 +7524,7 @@ async function createTag(projectId, options) {
  */
 async function deleteTag(projectId, tagName) {
     const effectiveProjectId = getEffectiveProjectId(projectId);
-    const response = await fetch(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(effectiveProjectId)}/repository/tags/${encodeURIComponent(tagName)}`, {
+    const response = await fetch(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(effectiveProjectId)}/repository/tags/${encodeGitLabPathSegment(tagName)}`, {
         ...getFetchConfig(),
         method: "DELETE",
     });
@@ -7541,7 +7539,7 @@ async function deleteTag(projectId, tagName) {
  */
 async function getTagSignature(projectId, tagName) {
     const effectiveProjectId = getEffectiveProjectId(projectId);
-    const response = await fetch(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(effectiveProjectId)}/repository/tags/${encodeURIComponent(tagName)}/signature`, {
+    const response = await fetch(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(effectiveProjectId)}/repository/tags/${encodeGitLabPathSegment(tagName)}/signature`, {
         ...getFetchConfig(),
     });
     await handleGitLabError(response);
@@ -7605,7 +7603,7 @@ async function handleToolCall(params) {
         if (!isToolAllowedByPermissionMode(params.name)) {
             throw new Error(GITLAB_PERMISSION_MODE === "readonly"
                 ? `${params.name} is not allowed in read-only mode`
-                : `${params.name} is not allowed in modify mode (delete operations are disabled)`);
+                : `${params.name} is not allowed in modify mode (delete and teardown operations are disabled)`);
         }
         logger.info({ tool: params.name, event: "tool_call_start" }, `tool_call_start: ${params.name}`);
         switch (params.name) {
@@ -7618,7 +7616,7 @@ async function handleToolCall(params) {
                 }
                 if (GITLAB_PERMISSION_MODE === "modify" &&
                     graphqlQueryContainsDeleteOperation(args.query)) {
-                    throw new Error("execute_graphql does not allow delete mutations in modify mode");
+                    throw new Error("execute_graphql does not allow destructive mutations in modify mode");
                 }
                 const apiUrl = new URL(getEffectiveApiUrl());
                 // Build GraphQL endpoint preserving any instance subpath (e.g. /gitlab)
@@ -8208,7 +8206,7 @@ async function handleToolCall(params) {
             }
             case "get_namespace": {
                 const args = GetNamespaceSchema.parse(params.arguments);
-                const url = new URL(`${GITLAB_API_URL}/namespaces/${encodeURIComponent(args.namespace_id)}`);
+                const url = new URL(`${GITLAB_API_URL}/namespaces/${encodeGitLabPathSegment(args.namespace_id)}`);
                 const response = await fetch(url.toString(), {
                     ...getFetchConfig(),
                 });
@@ -8221,7 +8219,7 @@ async function handleToolCall(params) {
             }
             case "verify_namespace": {
                 const args = VerifyNamespaceSchema.parse(params.arguments);
-                const url = new URL(`${GITLAB_API_URL}/namespaces/${encodeURIComponent(args.path)}/exists`);
+                const url = new URL(`${GITLAB_API_URL}/namespaces/${encodeGitLabPathSegment(args.path)}/exists`);
                 if (args.parent_id !== undefined)
                     url.searchParams.set("parent_id", String(args.parent_id));
                 const response = await fetch(url.toString(), {
@@ -8238,7 +8236,7 @@ async function handleToolCall(params) {
                 const args = GetProjectSchema.parse(params.arguments);
                 const options = params.arguments;
                 const effectiveProjectId = getEffectiveProjectId(args.project_id);
-                const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(effectiveProjectId)}`);
+                const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(effectiveProjectId)}`);
                 if (options.license)
                     url.searchParams.append("license", "true");
                 if (options.statistics)
@@ -8267,7 +8265,7 @@ async function handleToolCall(params) {
                 const { project_id, ...updates } = UpdateProjectSchema.parse(params.arguments);
                 const effectiveProjectId = getEffectiveProjectId(project_id);
                 const body = Object.fromEntries(Object.entries(updates).filter(([, value]) => value !== undefined));
-                const response = await fetch(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(effectiveProjectId)}`, {
+                const response = await fetch(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(effectiveProjectId)}`, {
                     ...getFetchConfig(),
                     method: "PUT",
                     body: JSON.stringify(body),
@@ -8306,7 +8304,7 @@ async function handleToolCall(params) {
             }
             case "get_user": {
                 const args = GetUserSchema.parse(params.arguments);
-                const url = new URL(`${getEffectiveApiUrl()}/users/${encodeURIComponent(args.user_id)}`);
+                const url = new URL(`${getEffectiveApiUrl()}/users/${encodeGitLabPathSegment(args.user_id)}`);
                 const response = await fetch(url.toString(), {
                     ...getFetchConfig(),
                 });
@@ -10186,7 +10184,7 @@ async function handleToolCall(params) {
             case "get_branch": {
                 const args = GetBranchSchema.parse(params.arguments);
                 const projectId = decodeURIComponent(args.project_id);
-                const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/repository/branches/${encodeURIComponent(args.branch_name)}`);
+                const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/repository/branches/${encodeGitLabPathSegment(args.branch_name)}`);
                 const response = await fetch(url.toString(), {
                     ...getFetchConfig(),
                 });
@@ -10200,7 +10198,7 @@ async function handleToolCall(params) {
             case "list_branches": {
                 const args = ListBranchesSchema.parse(params.arguments);
                 const projectId = decodeURIComponent(args.project_id);
-                const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/repository/branches`);
+                const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/repository/branches`);
                 if (args.search) {
                     url.searchParams.append("search", args.search);
                 }
@@ -10223,7 +10221,7 @@ async function handleToolCall(params) {
             case "delete_branch": {
                 const args = DeleteBranchSchema.parse(params.arguments);
                 const projectId = decodeURIComponent(args.project_id);
-                const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(getEffectiveProjectId(projectId))}/repository/branches/${encodeURIComponent(args.branch_name)}`);
+                const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(getEffectiveProjectId(projectId))}/repository/branches/${encodeGitLabPathSegment(args.branch_name)}`);
                 const response = await fetch(url.toString(), {
                     ...getFetchConfig(),
                     method: "DELETE",
@@ -10237,7 +10235,7 @@ async function handleToolCall(params) {
                 const args = ListProtectedBranchesSchema.parse(params.arguments);
                 const projectId = decodeURIComponent(args.project_id);
                 const effectiveProjectId = getEffectiveProjectId(projectId);
-                const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(effectiveProjectId)}/protected_branches`);
+                const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(effectiveProjectId)}/protected_branches`);
                 if (args.search)
                     url.searchParams.append("search", args.search);
                 if (args.page)
@@ -10257,7 +10255,7 @@ async function handleToolCall(params) {
                 const args = GetProtectedBranchSchema.parse(params.arguments);
                 const projectId = decodeURIComponent(args.project_id);
                 const effectiveProjectId = getEffectiveProjectId(projectId);
-                const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(effectiveProjectId)}/protected_branches/${encodeURIComponent(args.branch_name)}`);
+                const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(effectiveProjectId)}/protected_branches/${encodeGitLabPathSegment(args.branch_name)}`);
                 const response = await fetch(url.toString(), {
                     ...getFetchConfig(),
                 });
@@ -10271,7 +10269,7 @@ async function handleToolCall(params) {
                 const args = ProtectBranchSchema.parse(params.arguments);
                 const projectId = decodeURIComponent(args.project_id);
                 const effectiveProjectId = getEffectiveProjectId(projectId);
-                const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(effectiveProjectId)}/protected_branches`);
+                const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(effectiveProjectId)}/protected_branches`);
                 const body = { name: args.branch_name };
                 if (args.push_access_level !== undefined)
                     body.push_access_level = args.push_access_level;
@@ -10298,7 +10296,7 @@ async function handleToolCall(params) {
                 const args = UnprotectBranchSchema.parse(params.arguments);
                 const projectId = decodeURIComponent(args.project_id);
                 const effectiveProjectId = getEffectiveProjectId(projectId);
-                const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(effectiveProjectId)}/protected_branches/${encodeURIComponent(args.branch_name)}`);
+                const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(effectiveProjectId)}/protected_branches/${encodeGitLabPathSegment(args.branch_name)}`);
                 const response = await fetch(url.toString(), {
                     ...getFetchConfig(),
                     method: "DELETE",
@@ -10312,7 +10310,7 @@ async function handleToolCall(params) {
                 const args = UpdateDefaultBranchSchema.parse(params.arguments);
                 const projectId = decodeURIComponent(args.project_id);
                 const effectiveProjectId = getEffectiveProjectId(projectId);
-                const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeURIComponent(effectiveProjectId)}`);
+                const url = new URL(`${getEffectiveApiUrl()}/projects/${encodeGitLabPathSegment(effectiveProjectId)}`);
                 const response = await fetch(url.toString(), {
                     ...getFetchConfig(),
                     method: "PUT",
@@ -10369,6 +10367,7 @@ function buildDownloadProxyDeps() {
         getDispatcherForUrl: clientPool.getDispatcherForUrl.bind(clientPool),
         fetch: undiciFetch,
         logger,
+        isTrustedRedirectHost: isTrustedGitLabRedirectHost,
     };
 }
 /**
@@ -10430,9 +10429,68 @@ async function startSSEServer() {
         }
         next();
     };
-    const transports = {};
+    // Session IDs are untrusted map keys (POST /messages?sessionId=). A null
+    // prototype prevents inherited names such as "constructor" from masquerading
+    // as live transports, matching the Streamable HTTP transport.
+    const transports = Object.create(null);
+    const sessionLastActivity = new Map();
     let shuttingDown = false;
-    app.get("/sse", rejectDnsRebinding, requireSseAuth, async (req, res) => {
+    // Mirror the Streamable HTTP controls so the SSE transport cannot be used to
+    // exhaust the process: a session cap, a per-IP creation rate limit and an idle
+    // timeout that closes connections which never send anything.
+    const maxSessions = Number.parseInt(process.env.MAX_SESSIONS || "1000", 10);
+    const maxSseConnectionsPerMinute = Number.parseInt(process.env.MAX_REQUESTS_PER_MINUTE || "60", 10);
+    const idleTimeoutMs = Math.max(SESSION_TIMEOUT_SECONDS, 1) * 1000;
+    const sseConnectionRateLimit = rateLimit({
+        windowMs: 60_000,
+        limit: maxSseConnectionsPerMinute,
+        keyGenerator: (req) => ipKeyGenerator(normalizeProxyClientIpForRateLimit(req.ip ?? "")),
+        standardHeaders: true,
+        legacyHeaders: false,
+        handler: (_req, res) => {
+            res.status(429).json({
+                error: "Rate limit exceeded",
+                message: `Maximum ${maxSseConnectionsPerMinute} SSE connections per minute allowed`,
+            });
+        },
+    });
+    /**
+     * Reclaim SSE sessions that have not received a POST /messages request within
+     * the idle timeout.
+     *
+     * On /sse it is correct to idle-close an open GET: the stream alone is not
+     * proof of a live client, so a client that connects and never sends anything
+     * would otherwise hold a MAX_SESSIONS slot forever. This intentionally
+     * differs from the Streamable HTTP GET /mcp handler, which pauses inactivity
+     * expiry while its stream is open so list_changed can still be pushed - do
+     * not copy that rule here.
+     */
+    const closeIdleSseSessions = () => {
+        const now = Date.now();
+        for (const [sessionId, lastActivity] of sessionLastActivity) {
+            if (now - lastActivity < idleTimeoutMs)
+                continue;
+            const transport = transports[sessionId];
+            delete transports[sessionId];
+            sessionLastActivity.delete(sessionId);
+            logger.info({ sessionId, event: "sse_session_idle_closed" }, `SSE session ${sessionId} closed after ${SESSION_TIMEOUT_SECONDS}s of inactivity`);
+            if (transport) {
+                void transport.close().catch(error => {
+                    logger.error({ err: error }, "Error closing idle SSE transport");
+                });
+            }
+        }
+    };
+    const idleSweep = setInterval(closeIdleSseSessions, Math.min(idleTimeoutMs, 60_000));
+    idleSweep.unref();
+    app.get("/sse", rejectDnsRebinding, requireSseAuth, sseConnectionRateLimit, async (req, res) => {
+        if (Object.keys(transports).length >= maxSessions) {
+            res.status(503).json({
+                error: "Server capacity reached",
+                message: `Maximum ${maxSessions} concurrent sessions allowed. Please try again later.`,
+            });
+            return;
+        }
         const serverInstance = createServer();
         const effectiveHosts = getEffectiveAllowedHosts(req);
         const transport = new SSEServerTransport("/messages", res, {
@@ -10440,16 +10498,38 @@ async function startSSEServer() {
             allowedHosts: [...effectiveHosts],
             allowedOrigins: [...effectiveHosts].flatMap(host => [`http://${host}`, `https://${host}`]),
         });
-        transports[transport.sessionId] = transport;
+        const sessionId = transport.sessionId;
+        transports[sessionId] = transport;
+        sessionLastActivity.set(sessionId, Date.now());
         res.on("close", () => {
-            delete transports[transport.sessionId];
+            delete transports[sessionId];
+            sessionLastActivity.delete(sessionId);
         });
-        await serverInstance.connect(transport);
+        try {
+            await serverInstance.connect(transport);
+        }
+        catch (error) {
+            logger.error({ err: error, sessionId }, "SSE connection error");
+            // Release the capacity slot immediately instead of waiting for the
+            // client to disconnect or the idle sweep to run.
+            delete transports[sessionId];
+            sessionLastActivity.delete(sessionId);
+            if (!res.headersSent) {
+                res.status(500).json({
+                    error: "Internal server error",
+                    message: error instanceof Error ? error.message : "Unknown error",
+                });
+            }
+            else {
+                res.end();
+            }
+        }
     });
     app.post("/messages", rejectDnsRebinding, requireSseAuth, async (req, res) => {
         const sessionId = req.query.sessionId;
         const transport = transports[sessionId];
         if (transport) {
+            sessionLastActivity.set(sessionId, Date.now());
             await transport.handlePostMessage(req, res);
         }
         else {
@@ -10458,10 +10538,18 @@ async function startSSEServer() {
     });
     registerDownloadProxy(app, buildDownloadProxyDeps());
     app.get("/health", (_, res) => {
-        res.status(200).json({
-            status: "healthy",
+        const activeSessions = Object.keys(transports).length;
+        const isHealthy = activeSessions < maxSessions;
+        if (!isHealthy) {
+            logger.warn({ activeSessions, maxSessions }, "Health check degraded: active SSE session capacity reached");
+        }
+        res.status(isHealthy ? 200 : 503).json({
+            status: isHealthy ? "healthy" : "degraded",
             version: SERVER_VERSION,
             transport: TransportMode.SSE,
+            activeSessions,
+            maxSessions,
+            uptime: process.uptime(),
         });
     });
     const httpServer = app.listen(Number(PORT), HOST, () => {
@@ -10473,6 +10561,7 @@ async function startSSEServer() {
             return;
         shuttingDown = true;
         logger.info(`${signal} received, shutting down SSE server...`);
+        clearInterval(idleSweep);
         httpServer.close(() => logger.info("SSE HTTP server closed"));
         await Promise.allSettled(Object.values(transports).map(async (transport) => {
             try {