@workos/oagen-emitters 0.7.1 → 0.7.3

package/.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-  ".": "0.7.1"
+  ".": "0.7.3"
 }

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## [0.7.3](https://github.com/workos/oagen-emitters/compare/v0.7.2...v0.7.3) (2026-05-02)
+
+
+### Bug Fixes
+
+* url-encode path parameters in php/node/python/kotlin emitters ([#75](https://github.com/workos/oagen-emitters/issues/75)) ([34c08fc](https://github.com/workos/oagen-emitters/commit/34c08fc10510db53f1f989edab5b4d0cead15aa9))
+
+## [0.7.2](https://github.com/workos/oagen-emitters/compare/v0.7.1...v0.7.2) (2026-05-01)
+
+
+### Bug Fixes
+
+* **php:** wrap degenerate-union models in fromArray/toArray ([#72](https://github.com/workos/oagen-emitters/issues/72)) ([053d34a](https://github.com/workos/oagen-emitters/commit/053d34adcbbecbed6793c54c4fd48a03aef97f21))
+
 ## [0.7.1](https://github.com/workos/oagen-emitters/compare/v0.7.0...v0.7.1) (2026-05-01)
 
 

package/dist/index.mjs

@@ -1,2 +1,2 @@
-import { _ as nodeEmitter, a as rustExtractor, c as pythonExtractor, d as rubyEmitter, f as kotlinEmitter, g as pythonEmitter, h as phpEmitter, i as kotlinExtractor, l as rubyExtractor, m as goEmitter, n as elixirExtractor, o as goExtractor, p as dotnetEmitter, r as dotnetExtractor, s as phpExtractor, t as workosEmittersPlugin, u as nodeExtractor } from "./plugin-h8Onp2Ma.mjs";
+import { _ as nodeEmitter, a as rustExtractor, c as pythonExtractor, d as rubyEmitter, f as kotlinEmitter, g as pythonEmitter, h as phpEmitter, i as kotlinExtractor, l as rubyExtractor, m as goEmitter, n as elixirExtractor, o as goExtractor, p as dotnetEmitter, r as dotnetExtractor, s as phpExtractor, t as workosEmittersPlugin, u as nodeExtractor } from "./plugin-BoTAX4nl.mjs";
 export { dotnetEmitter, dotnetExtractor, elixirExtractor, goEmitter, goExtractor, kotlinEmitter, kotlinExtractor, nodeEmitter, nodeExtractor, phpEmitter, phpExtractor, pythonEmitter, pythonExtractor, rubyEmitter, rubyExtractor, rustExtractor, workosEmittersPlugin };

package/dist/{plugin-h8Onp2Ma.mjs → plugin-BoTAX4nl.mjs}

@@ -4475,6 +4475,79 @@ function formatWrapperDescription(name) {
 	return name.split("_").map((w, i) => i === 0 ? w.charAt(0).toUpperCase() + w.slice(1) : w).join(" ");
 }
 //#endregion
+//#region src/shared/path-template.ts
+/**
+* Parse an OpenAPI path template into an ordered list of literal and
+* parameter segments. Adjacent literals are coalesced into a single segment
+* (the only way two literals can be adjacent is if the input had `{}{}`
+* which is malformed; we still handle it deterministically).
+*
+* Examples:
+*   "/orgs/{id}/users/{uid}" → [
+*     { kind: 'literal', value: '/orgs/' },
+*     { kind: 'param',   name:  'id' },
+*     { kind: 'literal', value: '/users/' },
+*     { kind: 'param',   name:  'uid' },
+*   ]
+*   "/health"               → [{ kind: 'literal', value: '/health' }]
+*   ""                      → []
+*/
+function parsePathTemplate(path, options = {}) {
+	const normalized = options.stripLeadingSlash && path.startsWith("/") ? path.slice(1) : path;
+	if (normalized === "") return [];
+	const segments = [];
+	const re = /\{([^{}]+)\}/g;
+	let cursor = 0;
+	let m;
+	while ((m = re.exec(normalized)) !== null) {
+		if (m.index > cursor) segments.push({
+			kind: "literal",
+			value: normalized.slice(cursor, m.index)
+		});
+		segments.push({
+			kind: "param",
+			name: m[1]
+		});
+		cursor = m.index + m[0].length;
+	}
+	if (cursor < normalized.length) segments.push({
+		kind: "literal",
+		value: normalized.slice(cursor)
+	});
+	return segments;
+}
+/** True when at least one segment is a parameter placeholder. */
+function hasPathParams(segments) {
+	return segments.some((s) => s.kind === "param");
+}
+//#endregion
+//#region src/node/path-expression.ts
+/**
+* Build the TypeScript expression that the SDK passes as the request path.
+*
+* Every {paramName} placeholder becomes `${encodeURIComponent(name)}` inside a
+* template literal. encodeURIComponent is used (not encodeURI) because we want
+* "/" to be encoded too — otherwise a caller-supplied id containing "../" can
+* be normalized by the underlying HTTP transport (libcurl, fetch, etc.) into
+* a different endpoint of the WorkOS API while still authenticated with the
+* application's API key.
+*
+*   "/orgs"            → `'orgs'`
+*   "/orgs/{id}"       → `` `orgs/${encodeURIComponent(id)}` ``
+*   "/orgs/{id}/foo"   → `` `orgs/${encodeURIComponent(id)}/foo` ``
+*/
+function buildNodePathExpression(rawPath) {
+	const segments = parsePathTemplate(rawPath);
+	if (!hasPathParams(segments)) return `'${rawPath}'`;
+	let body = "";
+	for (const seg of segments) body += renderSegment(seg);
+	return `\`${body}\``;
+}
+function renderSegment(seg) {
+	if (seg.kind === "literal") return seg.value.replace(/\\/g, "\\\\").replace(/`/g, "\\`").replace(/\$\{/g, "\\${");
+	return `\${encodeURIComponent(${fieldName$5(seg.name)})}`;
+}
+//#endregion
 //#region src/node/wrappers.ts
 /**
 * Generate TypeScript wrapper method lines for union split operations.
@@ -4564,8 +4637,7 @@ function emitWrapperMethod$6(lines, resolvedOp, wrapper, ctx) {
 }
 /** Build a path template string from an Operation. */
 function buildPathStr$1(op) {
-	const interpolated = op.path.replace(/\{(\w+)\}/g, (_, p) => `\${${fieldName$5(p)}}`);
-	return interpolated.includes("${") ? `\`${interpolated}\`` : `'${op.path}'`;
+	return buildNodePathExpression(op.path);
 }
 /** Convert a JS value to a TypeScript literal. */
 function tsLiteral$1(value) {
@@ -5365,8 +5437,7 @@ function renderQueryExpr(queryParams) {
 	return `options ? { ${parts.join(", ")} } : undefined`;
 }
 function buildPathStr(op) {
-	const interpolated = op.path.replace(/\{(\w+)\}/g, (_, p) => `\${${fieldName$5(p)}}`);
-	return interpolated.includes("${") ? `\`${interpolated}\`` : `'${op.path}'`;
+	return buildNodePathExpression(op.path);
 }
 function buildPathParams(op, specEnumNames) {
 	const declaredNames = new Set(op.pathParams.map((p) => fieldName$5(p.name)));
@@ -7638,6 +7709,46 @@ function buildRecursiveHashMap$1(models, enums) {
 	return hashCache;
 }
 //#endregion
+//#region src/python/path-expression.ts
+/**
+* Build the Python f-string that the SDK passes to the request layer.
+*
+* Every {paramName} placeholder is wrapped in
+* `urllib.parse.quote(str(...), safe="")` so that an unencoded "/" or "../"
+* in a caller-supplied id cannot be normalized by the underlying HTTP
+* transport into a different endpoint of the WorkOS API while still
+* authenticated with the application's API key. `safe=""` is critical:
+* the stdlib default of `safe="/"` does NOT encode "/" and would leave the
+* traversal vector open.
+*
+* Generated files using this helper must import `quote` (e.g.
+* `from urllib.parse import quote`).
+*
+*   "/orgs"                        → `"orgs"`
+*   "/orgs/{id}"                   → `f"orgs/{quote(str(id), safe='')}"`
+*   "/orgs/{id}" with id ∈ enums   → `f"orgs/{quote(str(enum_value(id)), safe='')}"`
+*/
+function buildPythonPathExpression(rawPath, options = {}) {
+	const segments = parsePathTemplate(rawPath, { stripLeadingSlash: true });
+	if (segments.length === 0) return "\"\"";
+	if (!hasPathParams(segments)) {
+		const literal = segments[0].value;
+		return `"${escapePyDoubleQuoted(literal)}"`;
+	}
+	const enums = options.enumParams;
+	let body = "";
+	for (const seg of segments) if (seg.kind === "literal") body += escapePyDoubleQuoted(seg.value);
+	else {
+		const varName = fieldName$4(seg.name);
+		const inner = enums?.has(seg.name) ? `enum_value(${varName})` : varName;
+		body += `{quote(str(${inner}), safe='')}`;
+	}
+	return `f"${body}"`;
+}
+function escapePyDoubleQuoted(literal) {
+	return literal.replace(/\\/g, "\\\\").replace(/"/g, "\\\"").replace(/\{/g, "{{").replace(/\}/g, "}}");
+}
+//#endregion
 //#region src/python/wrappers.ts
 /**
 * Generate Python wrapper method lines for split operations.
@@ -7707,12 +7818,7 @@ function emitWrapperMethod$5(lines, resolvedOp, wrapper, ctx, isAsync) {
 		lines.push(`        if ${pyName} is not None:`);
 		lines.push(`            body["${paramName}"] = ${pyName}`);
 	}
-	let pathExpr;
-	if (op.pathParams.length > 0) {
-		let path = op.path.replace(/^\//, "");
-		for (const p of op.pathParams) path = path.replace(`{${p.name}}`, `{${fieldName$4(p.name)}}`);
-		pathExpr = `f"${path}"`;
-	} else pathExpr = `"${op.path.replace(/^\//, "")}"`;
+	const pathExpr = buildPythonPathExpression(op.path);
 	const awaitPrefix = isAsync ? "await " : "";
 	lines.push("");
 	if (wrapper.responseModelName) {
@@ -8397,6 +8503,7 @@ function generateResources$5(services, ctx) {
 		lines.push("from __future__ import annotations");
 		lines.push("");
 		lines.push("from typing import TYPE_CHECKING, Any, Dict, List, Literal, Optional, Type, Union, cast");
+		if (allOperations.some((op) => op.pathParams.length > 0) || allOperations.some((op) => /\{[^{}]+\}/.test(op.path))) lines.push("from urllib.parse import quote");
 		lines.push("");
 		lines.push("if TYPE_CHECKING:");
 		lines.push(`    from ${importPrefix}_client import AsyncWorkOSClient, WorkOSClient`);
@@ -8699,15 +8806,12 @@ function buildErrorRaisesBlock(op) {
 }
 /**
 * Build a Python f-string path expression from an operation path.
-* E.g., "/organizations/{id}" -> f"organizations/{id}"
+* E.g., "/organizations/{id}" -> f"organizations/{quote(str(id), safe='')}"
 */
 function buildPathString$1(op) {
-	const path = op.path.replace(/^\//, "");
-	if (op.pathParams.length === 0) return `"${path}"`;
-	let fPath = path;
-	for (const param of op.pathParams) if (param.type.kind === "enum" || param.type.kind === "nullable" && param.type.inner?.kind === "enum") fPath = fPath.replace(`{${param.name}}`, `{enum_value(${fieldName$4(param.name)})}`);
-	else fPath = fPath.replace(`{${param.name}}`, `{${fieldName$4(param.name)}}`);
-	return `f"${fPath}"`;
+	const enumParams = /* @__PURE__ */ new Set();
+	for (const p of op.pathParams) if (p.type.kind === "enum" || p.type.kind === "nullable" && p.type.inner?.kind === "enum") enumParams.add(p.name);
+	return buildPythonPathExpression(op.path, { enumParams });
 }
 //#endregion
 //#region src/shared/non-spec-services.ts
@@ -10624,6 +10728,28 @@ function generateModels$4(models, ctx) {
 	return files;
 }
 /**
+* Resolve a degenerate union to a single TypeRef when possible.
+* - allOf: PHP collapses to the first variant (mirrors `mapTypeRef`).
+* - oneOf/anyOf where every variant has the same generated PHP type: collapse
+*   to that variant (e.g. discriminated unions whose branches the IR pinned to
+*   one model name).
+* Returns null when the union is genuinely polymorphic.
+*/
+function resolveDegenerateUnion(ref) {
+	if (ref.kind !== "union") return null;
+	if (ref.compositionKind === "allOf") return ref.variants[0] ?? null;
+	if (ref.variants.length === 0) return null;
+	const signature = (v) => {
+		if (v.kind === "model") return `model:${v.name}`;
+		if (v.kind === "enum") return `enum:${v.name}`;
+		return `kind:${v.kind}`;
+	};
+	const first = ref.variants[0];
+	const firstSig = signature(first);
+	for (const v of ref.variants) if (signature(v) !== firstSig) return null;
+	return first;
+}
+/**
 * Generate the fromArray accessor expression for a field.
 */
 function generateFromArrayAccessor(ref, wireName, required) {
@@ -10654,7 +10780,11 @@ function generateFromArrayValue(ref, accessor) {
 			if (ref.items.kind === "primitive" && ref.items.format === "date-time") return `array_map(fn ($item) => new \\DateTimeImmutable($item), ${accessor})`;
 			return accessor;
 		case "nullable": return generateFromArrayValue(ref.inner, accessor);
-		case "union": return accessor;
+		case "union": {
+			const resolved = resolveDegenerateUnion(ref);
+			if (resolved) return generateFromArrayValue(resolved, accessor);
+			return accessor;
+		}
 		case "map": return accessor;
 		case "literal": return accessor;
 	}
@@ -10676,6 +10806,10 @@ function isComplexType(ref) {
 		case "enum": return true;
 		case "array": return isComplexType(ref.items);
 		case "nullable": return isComplexType(ref.inner);
+		case "union": {
+			const resolved = resolveDegenerateUnion(ref);
+			return resolved ? isComplexType(resolved) : false;
+		}
 		default: return false;
 	}
 }
@@ -10697,7 +10831,11 @@ function generateToArrayValue(ref, accessor, nullable = false) {
 			return accessor;
 		case "nullable": return generateToArrayValue(ref.inner, accessor, true);
 		case "map": return accessor;
-		case "union": return accessor;
+		case "union": {
+			const resolved = resolveDegenerateUnion(ref);
+			if (resolved) return generateToArrayValue(resolved, accessor, nullable);
+			return accessor;
+		}
 		case "literal": return accessor;
 	}
 }
@@ -10760,6 +10898,39 @@ function generateEnums$4(enums, ctx) {
 	return files;
 }
 //#endregion
+//#region src/php/path-expression.ts
+/**
+* Build the PHP expression that the SDK passes to HttpClient as `path:`.
+*
+* Concatenation, not interpolation: PHP does not allow function calls inside
+* "..." strings, and every parameter must be wrapped in `rawurlencode(...)` so
+* that an unencoded "../" in a caller-supplied id cannot be normalized by
+* libcurl into a different endpoint of the WorkOS API while still
+* authenticated with the application's API key.
+*
+*   "/orgs"            → `'orgs'`
+*   "/orgs/{id}"       → `'orgs/' . rawurlencode($id)`
+*   "/orgs/{id}/users" → `'orgs/' . rawurlencode($id) . '/users'`
+*   "/orgs/{id}" with id ∈ valueAccessorParams → `'orgs/' . rawurlencode($id->value)`
+*/
+function buildPhpPathExpression(rawPath, options = {}) {
+	const segments = parsePathTemplate(rawPath, { stripLeadingSlash: true });
+	if (segments.length === 0) return "''";
+	if (!hasPathParams(segments)) return phpSingleQuoted(segments[0].value);
+	const valueAccessor = options.valueAccessorParams;
+	const parts = [];
+	for (const seg of segments) if (seg.kind === "literal") parts.push(phpSingleQuoted(seg.value));
+	else {
+		const varName = fieldName$3(seg.name);
+		const accessor = valueAccessor?.has(seg.name) ? `$${varName}->value` : `$${varName}`;
+		parts.push(`rawurlencode(${accessor})`);
+	}
+	return parts.join(" . ");
+}
+function phpSingleQuoted(literal) {
+	return `'${literal.replace(/\\/g, "\\\\").replace(/'/g, "\\'")}'`;
+}
+//#endregion
 //#region src/php/wrappers.ts
 /**
 * Generate PHP wrapper methods for split union operations.
@@ -10819,14 +10990,11 @@ function emitWrapperMethod$4(lines, resolvedOp, wrapper, ctx) {
 		lines.push(`        $body['${clientField}'] = ${clientExpr};`);
 	}
 	const httpMethod = op.httpMethod.toUpperCase();
-	let path = op.path.startsWith("/") ? op.path.slice(1) : op.path;
-	const hasInterpolation = /\{[^}]+\}/.test(path);
-	path = path.replace(/\{([^}]+)\}/g, (_match, param) => `{$${fieldName$3(param)}}`);
-	const pathQuote = hasInterpolation ? "\"" : "'";
+	const pathExpr = buildPhpPathExpression(op.path);
 	lines.push("");
 	lines.push("        $response = $this->client->request(");
 	lines.push(`            method: '${httpMethod}',`);
-	lines.push(`            path: ${pathQuote}${path}${pathQuote},`);
+	lines.push(`            path: ${pathExpr},`);
 	lines.push("            body: $body,");
 	lines.push("            options: $options,");
 	lines.push("        );");
@@ -11311,16 +11479,9 @@ function buildBodyParamMap(op, bodyModel) {
 	return map;
 }
 function buildPathString(op) {
-	let path = op.path.startsWith("/") ? op.path.slice(1) : op.path;
-	if (op.pathParams.length === 0) return `'${path}'`;
-	const paramExprs = /* @__PURE__ */ new Map();
-	for (const p of op.pathParams) {
-		const phpName = fieldName$3(p.name);
-		const isEnum = p.type.kind === "enum" || p.type.kind === "model";
-		paramExprs.set(p.name, isEnum ? `{$${phpName}->value}` : `{$${phpName}}`);
-	}
-	path = path.replace(/\{([^}]+)\}/g, (_match, param) => paramExprs.get(param) ?? `{$${fieldName$3(param)}}`);
-	return `"${path}"`;
+	const valueAccessor = /* @__PURE__ */ new Set();
+	for (const p of op.pathParams) if (p.type.kind === "enum" || p.type.kind === "model") valueAccessor.add(p.name);
+	return buildPhpPathExpression(op.path, { valueAccessorParams: valueAccessor });
 }
 function isEnumType(ref) {
 	if (ref.kind === "enum") return true;
@@ -13224,7 +13385,7 @@ function generateMethod$1(serviceType, mountName, method, op, plan, _ctx, resolv
 	if (paramsType) params.push(`params ${paramsType}`);
 	params.push("opts ...RequestOption");
 	lines.push(`func (s *${serviceType}) ${method}(${params.join(", ")}) ${returnType} {`);
-	const pathExpr = buildPathExpr$2(op);
+	const pathExpr = buildPathExpr$1(op);
 	if (isUrlBuilder) {
 		emitUrlBuilderMethod(lines, op, pathExpr, resolvedOp, paramsType);
 		lines.push("}");
@@ -13523,7 +13684,7 @@ function needsStringsImport(operations, resolvedLookup) {
 	}
 	return false;
 }
-function buildPathExpr$2(op) {
+function buildPathExpr$1(op) {
 	if (op.pathParams.length === 0) return `"${op.path}"`;
 	let fmtStr = op.path;
 	const args = [];
@@ -15967,7 +16128,7 @@ function generateMethod(_serviceType, mountName, method, methodStem, op, plan, c
 		for (const field of inferFromClient) if (field === "client_id") lines.push(`            options.${fieldName$1(field)} = this.Client.RequireClientId();`);
 		else lines.push(`            options.${fieldName$1(field)} = this.Client.${clientFieldExpression$1(field)} ?? string.Empty;`);
 	}
-	const pathExpr = buildPathExpr$1(op);
+	const pathExpr = buildPathExpr(op);
 	const needsInlineRequest = isUrlBuilder || hasBearerOverride && !!bearerParamName || hasGroups;
 	const optionsArg = optionsClass ? "options" : "null";
 	if (needsInlineRequest) {
@@ -16031,7 +16192,7 @@ function generateAutoPagingMethod(mountName, method, methodStem, op, plan, ctx,
 	params.push("CancellationToken cancellationToken = default");
 	lines.push(`        public virtual IAsyncEnumerable<${itemType}> ${methodStem}AutoPagingAsync(${params.join(", ")})`);
 	lines.push("        {");
-	const pathExpr = buildPathExpr$1(op);
+	const pathExpr = buildPathExpr(op);
 	const optionsArg = optionsClass ? "options" : "null";
 	lines.push(`            return this.ListAutoPagingAsync<${itemType}>(${pathExpr}, ${optionsArg}, requestOptions, cancellationToken);`);
 	lines.push("        }");
@@ -16055,7 +16216,7 @@ function optionsClassName(mountName, method) {
 	if (methodStem.startsWith(prefix)) return `${methodStem}Options`;
 	return `${prefix}${methodStem}Options`;
 }
-function buildPathExpr$1(op) {
+function buildPathExpr(op) {
 	if (op.pathParams.length === 0) return `"${op.path}"`;
 	let interpolated = op.path;
 	for (const p of sortPathParamsByTemplateOrder$1(op)) interpolated = interpolated.replace(`{${p.name}}`, `{Uri.EscapeDataString(${localName(p.name)})}`);
@@ -17834,6 +17995,45 @@ function structuralHash(model) {
 	return model.fields.map((f) => `${f.name}:${JSON.stringify(normalizeTypeForHash(f.type))}:${f.required}`).sort().join("|");
 }
 //#endregion
+//#region src/kotlin/path-expression.ts
+/**
+* The fully-qualified runtime helper that the generated code calls. Kotlin
+* doesn't ship a path-segment URL encoder out of the box (java.net.URLEncoder
+* is form-encoding — it encodes space as "+", which is wrong for path
+* segments). The runtime helper lives in workos-kotlin at
+* com.workos.common.http.encodePathSegment.
+*/
+const KOTLIN_PATH_ENCODE_IMPORT = "com.workos.common.http.encodePathSegment";
+/**
+* Build the Kotlin string-template that the SDK passes as the request path.
+*
+* Every {paramName} placeholder is wrapped in `encodePathSegment(...)` so a
+* caller-supplied id containing "../" cannot be normalized by the underlying
+* HTTP transport into a different endpoint of the WorkOS API while still
+* authenticated with the application's API key.
+*
+*   "/orgs"            → `"orgs"`
+*   "/orgs/{id}"       → `"orgs/${encodePathSegment(id)}"`
+*   "/orgs/{id}/foo"   → `"orgs/${encodePathSegment(id)}/foo"`
+*/
+function buildKotlinPathExpression(rawPath) {
+	const segments = parsePathTemplate(rawPath);
+	if (!hasPathParams(segments)) return {
+		expression: ktLiteral(rawPath),
+		requiresEncodeImport: false
+	};
+	let body = "";
+	for (const seg of segments) if (seg.kind === "literal") body += escapeKotlinStringLiteral(seg.value);
+	else body += `\${encodePathSegment(${propertyName(seg.name)})}`;
+	return {
+		expression: `"${body}"`,
+		requiresEncodeImport: true
+	};
+}
+function escapeKotlinStringLiteral(literal) {
+	return literal.replace(/\\/g, "\\\\").replace(/"/g, "\\\"").replace(/\$/g, "\\$");
+}
+//#endregion
 //#region src/kotlin/wrappers.ts
 /**
 * Emit Kotlin wrapper methods for a union-split operation. Each wrapper
@@ -17919,7 +18119,7 @@ function emitWrapperMethod$1(resolvedOp, wrapper, ctx) {
 		}
 		lines.push(`      )`);
 	} else lines.push(`    val body = linkedMapOf<String, Any?>()`);
-	const pathExpr = buildPathExpr(op.path, pathParams);
+	const pathExpr = buildKotlinPathExpression(op.path).expression;
 	const httpMethod = op.httpMethod.toUpperCase();
 	lines.push(`    val config =`);
 	lines.push(`      RequestConfig(`);
@@ -17937,17 +18137,6 @@ function emitWrapperMethod$1(resolvedOp, wrapper, ctx) {
 function escapeKdoc$1(s) {
 	return s.replace(/\*\//g, "*​/");
 }
-function buildPathExpr(path, pathParams) {
-	if (pathParams.length === 0) return ktLiteral(path);
-	let result = path;
-	for (const pp of pathParams) {
-		const placeholder = `{${pp.name}}`;
-		const propName = propertyName(pp.name);
-		const replacement = /^[a-zA-Z_][a-zA-Z0-9_]*$/.test(propName) ? `\$${propName}` : `\${${propName}}`;
-		result = result.replaceAll(placeholder, replacement);
-	}
-	return `"${result.replace(/\\/g, "\\\\").replace(/"/g, "\\\"")}"`;
-}
 //#endregion
 //#region src/kotlin/overrides.ts
 /**
@@ -18020,6 +18209,7 @@ function generateApiClass(mountName, operations, ctx, resolvedLookup) {
 				for (const rp of resolvedParams) if (rp.field) registerTypeImports(rp.field.type, imports, ctx);
 			}
 			imports.add("com.workos.common.http.bodyOf");
+			if (/\{[^{}]+\}/.test(resolvedOp.operation.path)) imports.add(KOTLIN_PATH_ENCODE_IMPORT);
 			const wrapperLines = generateWrapperMethods$1(resolvedOp, ctx);
 			if (body.length > 0) body.push("");
 			for (const line of wrapperLines) body.push(line);
@@ -18182,7 +18372,9 @@ function renderMethod(_mountName, method, op, ctx, resolvedOp, imports) {
 	const specDeclaresBody = op.requestBody !== void 0;
 	const hasBody = methodAlwaysHasBody || specDeclaresBody && httpMethod !== "GET" || (httpMethod === "PUT" || httpMethod === "PATCH" || httpMethod === "POST" || httpMethod === "DELETE") && (Object.keys(defaults).length > 0 || inferFromClient.length > 0) && specDeclaresBody;
 	const appendDefaultsAsQuery = !hasBody && (Object.keys(defaults).length > 0 || inferFromClient.length > 0);
-	const pathExpr = buildPathExpression(op.path, pathParams);
+	const pathBuilt = buildKotlinPathExpression(op.path);
+	const pathExpr = pathBuilt.expression;
+	if (pathBuilt.requiresEncodeImport) imports.add(KOTLIN_PATH_ENCODE_IMPORT);
 	if (op.path === "/user_management/authenticate" && httpMethod === "POST" && plan.responseModelName === "AuthenticateResponse") {
 		imports.add("com.workos.models.AuthenticateResponse");
 		const grantType = defaults.grant_type ?? "authorization_code";
@@ -18405,20 +18597,6 @@ function queryParamToString(type, varName) {
 	if (type.kind === "primitive" && type.type === "string") return varName;
 	return `${varName}.toString()`;
 }
-function buildPathExpression(path, pathParams) {
-	if (pathParams.length === 0) return ktLiteral(path);
-	let result = path;
-	for (const pp of pathParams) {
-		const placeholder = `{${pp.name}}`;
-		const propName = propertyName(pp.name);
-		const replacement = isBareIdentifier(propName) ? `\$${propName}` : `\${${propName}}`;
-		result = result.replaceAll(placeholder, replacement);
-	}
-	return `"${result.replace(/\\/g, "\\\\").replace(/"/g, "\\\"")}"`;
-}
-function isBareIdentifier(name) {
-	return /^[a-zA-Z_][a-zA-Z0-9_]*$/.test(name);
-}
 function pickNamedQueryParam(sorted, name) {
 	const match = sorted.find((p) => p.name === name);
 	return match ? propertyName(match.name) : "null";
@@ -21975,4 +22153,4 @@ const workosEmittersPlugin = {
 //#endregion
 export { nodeEmitter as _, rustExtractor as a, pythonExtractor as c, rubyEmitter as d, kotlinEmitter as f, pythonEmitter as g, phpEmitter as h, kotlinExtractor as i, rubyExtractor as l, goEmitter as m, elixirExtractor as n, goExtractor as o, dotnetEmitter as p, dotnetExtractor as r, phpExtractor as s, workosEmittersPlugin as t, nodeExtractor as u };
 
-//# sourceMappingURL=plugin-h8Onp2Ma.mjs.map
+//# sourceMappingURL=plugin-BoTAX4nl.mjs.map