fix(angular): url-encode path params when urlEncodeParameters is set

packages/angular/src/http-client.test.ts

@@ -1963,4 +1963,56 @@ describe('angular HttpClient generator', () => {
       expect(getHttpClientReturnTypes(['getPetById'])).toBe('');
     });
   });
+
+  // ── urlEncodeParameters ─────────────────────────────────────────────
+
+  describe('urlEncodeParameters', () => {
+    const createOptionsWithUrlEncode = (urlEncodeParameters: boolean) => {
+      const output = createOutput({ urlEncodeParameters });
+      return createGeneratorOptions({
+        route: '/api/pets/${petId}',
+        context: createContextSpec(output),
+      });
+    };
+
+    it('encodes path parameters when urlEncodeParameters is true', () => {
+      const verbOption = createVerbOption();
+      const options = createOptionsWithUrlEncode(true);
+
+      const impl = generateHttpClientImplementation(verbOption, options);
+
+      expect(impl).toContain(
+        '`/api/pets/${encodeURIComponent(String(petId))}`',
+      );
+      expect(impl).not.toContain('`/api/pets/${petId}`');
+    });
+
+    it('leaves the route unchanged when urlEncodeParameters is false', () => {
+      const verbOption = createVerbOption();
+      const options = createOptionsWithUrlEncode(false);
+
+      const impl = generateHttpClientImplementation(verbOption, options);
+
+      expect(impl).toContain('`/api/pets/${petId}`');
+      expect(impl).not.toContain('encodeURIComponent');
+    });
+
+    it('encodes the route passed to the mutator config', () => {
+      const verbOption = createVerbOption({
+        mutator: {
+          name: 'customInstance',
+          path: './mutator',
+          default: true,
+          hasThirdArg: false,
+          hasSecondArg: false,
+        } as GeneratorVerbOptions['mutator'],
+      });
+      const options = createOptionsWithUrlEncode(true);
+
+      const impl = generateHttpClientImplementation(verbOption, options);
+
+      expect(impl).toContain('/api/pets/${encodeURIComponent(String(petId))}');
+      expect(impl).not.toContain('url: `/api/pets/${petId}`');
+    });
+  });
 });

packages/angular/src/http-client.ts

@@ -19,6 +19,7 @@ import {
   type GetterProp,
   GetterPropType,
   isBoolean,
+  makeRouteSafe,
   pascal,
   toObjectString,
 } from '@orval/core';
@@ -316,8 +317,18 @@ export const generateHttpClientImplementation = (
     paramsSerializer,
     paramsFilter,
   }: GeneratorVerbOptions,
-  { route, context }: HttpClientGeneratorContext,
+  { route: _route, context }: HttpClientGeneratorContext,
 ) => {
+  // Opt-in URL-encoding of path parameters (`urlEncodeParameters`), applied once
+  // at the single point the route enters this builder so the mutator config and
+  // every inline interpolation below stay consistent. `makeRouteSafe` is not
+  // idempotent — applying it more than once double-encodes — so it must run here
+  // exactly once and nowhere downstream.
+  let route = _route;
+  if (context.output.urlEncodeParameters) {
+    route = makeRouteSafe(route);
+  }
+
   const isRequestOptions = override.requestOptions !== false;
   const isFormData = !override.formData.disabled;
   const isFormUrlEncoded = override.formUrlEncoded !== false;

packages/angular/src/http-resource.test.ts

@@ -2523,4 +2523,41 @@ describe('angular httpResource generator', () => {
       expect(healthFile?.content).not.toContain('getPetByIdResource');
     });
   });
+
+  // ── urlEncodeParameters ─────────────────────────────────────────────
+
+  describe('urlEncodeParameters', () => {
+    const generateRetrievalHeader = (urlEncodeParameters: boolean): string => {
+      const verbOption = createVerbOption();
+      routeRegistry.set('getPetById', '/api/pets/${petId}');
+
+      return generateHttpResourceHeader({
+        title: 'PetService',
+        isRequestOptions: true,
+        isMutator: false,
+        isGlobalMutator: false,
+        provideIn: 'root',
+        hasAwaitedType: false,
+        output: createOutput({ urlEncodeParameters }),
+        verbOptions: { getPetById: verbOption },
+        clientImplementation: '',
+      } as never);
+    };
+
+    it('encodes the signal path parameter when urlEncodeParameters is true', () => {
+      const header = generateRetrievalHeader(true);
+
+      expect(header).toContain(
+        '`/api/pets/${encodeURIComponent(String(petId()))}`',
+      );
+      expect(header).not.toContain('`/api/pets/${petId()}`');
+    });
+
+    it('leaves the route unchanged when urlEncodeParameters is false', () => {
+      const header = generateRetrievalHeader(false);
+
+      expect(header).toContain('`/api/pets/${petId()}`');
+      expect(header).not.toContain('encodeURIComponent');
+    });
+  });
 });

packages/angular/src/http-resource.ts

@@ -22,6 +22,7 @@ import {
   isSyntheticDefaultImportsAllow,
   jsDoc,
   kebab,
+  makeRouteSafe,
   type NormalizedOutputOptions,
   type OpenApiInfoObject,
   OutputMode,
@@ -812,13 +813,21 @@ const buildHttpResourceFunction = (
     (prop) => prop.type === GetterPropType.NAMED_PATH_PARAMS,
   );
   const signalRoute = applySignalRoute(route, params, hasNamedParams);
+  // Opt-in URL-encoding of path parameters (`urlEncodeParameters`). Must run
+  // AFTER `applySignalRoute`: that step matches the literal `${param}` template
+  // to rewrite it to its signal form (e.g. `${param()}`), so encoding first
+  // would stop the substitution from matching. Wrapping the already-rewritten
+  // form yields `${encodeURIComponent(String(param()))}`, which is correct.
+  const encodedRoute = output.urlEncodeParameters
+    ? makeRouteSafe(signalRoute)
+    : signalRoute;
 
   const signalProps = buildSignalProps(props, params);
   const args = toObjectString(signalProps, 'implementation');
 
   const { bodyForm, request, isUrlOnly } = buildResourceRequest(
     verbOption,
-    signalRoute,
+    encodedRoute,
   );
 
   if (uniqueContentTypes.length > 1) {

packages/query/src/client.ts

@@ -102,8 +102,13 @@ export const generateAngularHttpRequestFunction = (
     formUrlEncoded,
     override,
   }: GeneratorVerbOptions,
-  { route, context }: GeneratorOptions,
+  { route: _route, context }: GeneratorOptions,
 ) => {
+  let route = _route;
+  if (context.output.urlEncodeParameters) {
+    route = makeRouteSafe(route);
+  }
+
   const isRequestOptions = override.requestOptions !== false;
   const isFormData = !override.formData.disabled;
   const isFormUrlEncoded = override.formUrlEncoded !== false;