fix(core): make normalizeRuntimeValidation idempotent

Per-operation and per-tag `query` overrides inherit the already-normalized global
query options. The query merge fed that inherited `{ enabled, strategy }` object
back through `normalizeRuntimeValidation`, which treated any truthy object as
enabled — silently flipping a disabled global (`runtimeValidation: false`) to
`enabled: true` for any operation/tag with a `query` override block.

Make `normalizeRuntimeValidation` idempotent: an already-normalized value is
returned unchanged. Add a regression test for the per-operation inheritance path
and an idempotency unit test.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: the-ult

packages/core/src/generators/runtime-validation.test.ts

@@ -150,4 +150,15 @@ describe('normalizeRuntimeValidation', () => {
       strategy: 'both',
     });
   });
+
+  it('is idempotent: returns an already-normalized object unchanged', () => {
+    // Guards the per-operation query inheritance path, which can hand an
+    // already-normalized global value back into normalization.
+    expect(
+      normalizeRuntimeValidation({ enabled: false, strategy: 'throw' }),
+    ).toEqual({ enabled: false, strategy: 'throw' });
+    expect(
+      normalizeRuntimeValidation({ enabled: true, strategy: 'both' }),
+    ).toEqual({ enabled: true, strategy: 'both' });
+  });
 });

packages/core/src/generators/runtime-validation.ts

@@ -46,6 +46,10 @@ export interface EmitResponseValidationOptions {
  *
  * The raw `ZodError` is passed to `console.error` (no `prettifyError`/`flatten`)
  * to stay agnostic across Zod 3 and Zod 4.
+ *
+ * `operationName` is interpolated into a single-quoted string literal; callers
+ * pass sanitized camelCase operation identifiers, so there is no string-literal
+ * injection surface.
  */
 const buildGuardBody = (
   schemaRef: string,
@@ -101,15 +105,23 @@ export const emitResponseValidation = ({
  * Normalizes the user-facing `runtimeValidation` config surface
  * (`boolean | { strategy }`) into the canonical `{ enabled, strategy }` object
  * consumed by the generators.
+ *
+ * Idempotent: an already-normalized value is returned unchanged, so it is safe
+ * to call on an inherited (already-normalized) value — e.g. when a per-operation
+ * `query` override inherits the normalized global default.
  */
 export const normalizeRuntimeValidation = (
-  value: RuntimeValidation | undefined,
+  value: RuntimeValidation | NormalizedRuntimeValidation | undefined,
 ): NormalizedRuntimeValidation => {
   if (!value) {
     return { enabled: false, strategy: 'throw' };
   }
   if (value === true) {
     return { enabled: true, strategy: 'throw' };
   }
+  // Already-normalized canonical object — return as-is (idempotent).
+  if ('enabled' in value) {
+    return value;
+  }
   return { enabled: true, strategy: value.strategy ?? 'throw' };
 };

packages/orval/src/utils/options.test.ts

@@ -223,6 +223,47 @@ describe('normalizeOptions', () => {
     }
   });
 
+  it('does not enable query runtimeValidation for a per-operation override when the global default is disabled', async () => {
+    const workspace = await createTempWorkspace();
+
+    try {
+      const normalized = await normalizeOptions(
+        {
+          input: {
+            target: {
+              openapi: '3.1.0',
+              info: { title: 'Test', version: '1.0.0' },
+              paths: {},
+            },
+          },
+          output: {
+            target: './generated.ts',
+            client: 'angular',
+            override: {
+              // Global query runtimeValidation is omitted -> disabled.
+              operations: {
+                // A per-operation query override that does NOT mention
+                // runtimeValidation must inherit the disabled global value, not
+                // silently flip it on.
+                listPets: {
+                  query: { useQuery: true },
+                },
+              },
+            },
+          },
+        },
+        workspace,
+      );
+
+      expect(
+        normalized.output.override.operations.listPets?.query
+          ?.runtimeValidation,
+      ).toEqual({ enabled: false, strategy: 'throw' });
+    } finally {
+      await rm(workspace, { recursive: true, force: true });
+    }
+  });
+
   it('normalizes angular retrievalClient as the generated retrieval mode', async () => {
     const workspace = await createTempWorkspace();