fix(nest): keep non-contract params and harden path param handling

[dinwwwh]

The NestJS adapter previously rebuilt request params from the contract's dynamic path params only, so anything else NestJS matched was dropped, and param names were read and written through the prototype chain. Params matched outside the contract path now reach the procedure input, and path params can no longer touch the prototype.

Fixes

• Params from dynamic controller or global prefixes (e.g. @Controller(':tenant')) are no longer dropped, including when the contract path has no dynamic params at all.
• A non-rest param literally named path no longer collides with Express's wildcard key and disappears.
• Params named like __proto__ become own properties on a null-prototype object instead of being silently lost or mutating the prototype.
• Rest params are resolved from the adapter's own wildcard key (path on Express, * on Fastify) and the raw wildcard key no longer leaks into input.

Testing

• New cases run on both Express and Fastify adapters: dynamic controller prefixes with static/dynamic/rest contract paths, a /files/{path} route, __proto__ injection, and a custom request parser without a wildcard param.
• 91 tests pass; implement.ts sits at 100% statement and branch coverage.

Chore

• worker-configuration.d.ts files regenerated by wrangler (workerd version bump).

[pullfrog]

Run failed. View the logs →

  ^{｜ Rerun failed job ➔ ｜ View workflow run ｜ via Pullfrog ｜ Using DeepSeek Flash (free via Pullfrog for OSS) ｜ 𝕏}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
orpc	Skipped		Aug 8, 2026 7:45am

[pkg-pr-new]

More templates

• @orpc/bun-playground
• @orpc/cloudflare-playground
• @orpc/nest-playground
• @orpc/next-playground

@orpc/ai-sdk

npm i https://pkg.pr.new/@orpc/ai-sdk@1818

@orpc/arktype

npm i https://pkg.pr.new/@orpc/arktype@1818

@orpc/bun

npm i https://pkg.pr.new/@orpc/bun@1818

@orpc/client

npm i https://pkg.pr.new/@orpc/client@1818

@orpc/cloudflare

npm i https://pkg.pr.new/@orpc/cloudflare@1818

@orpc/contract

npm i https://pkg.pr.new/@orpc/contract@1818

@orpc/experimental-effect

npm i https://pkg.pr.new/@orpc/experimental-effect@1818

@orpc/evlog

npm i https://pkg.pr.new/@orpc/evlog@1818

@orpc/hibernation

npm i https://pkg.pr.new/@orpc/hibernation@1818

@orpc/json-schema

npm i https://pkg.pr.new/@orpc/json-schema@1818

@orpc/nest

npm i https://pkg.pr.new/@orpc/nest@1818

@orpc/next

npm i https://pkg.pr.new/@orpc/next@1818

@orpc/openapi

npm i https://pkg.pr.new/@orpc/openapi@1818

@orpc/opentelemetry

npm i https://pkg.pr.new/@orpc/opentelemetry@1818

@orpc/pinia-colada

npm i https://pkg.pr.new/@orpc/pinia-colada@1818

@orpc/pino

npm i https://pkg.pr.new/@orpc/pino@1818

@orpc/publisher

npm i https://pkg.pr.new/@orpc/publisher@1818

@orpc/ratelimit

npm i https://pkg.pr.new/@orpc/ratelimit@1818

@orpc/server

npm i https://pkg.pr.new/@orpc/server@1818

@orpc/shared

npm i https://pkg.pr.new/@orpc/shared@1818

@orpc/swr

npm i https://pkg.pr.new/@orpc/swr@1818

@orpc/tanstack-query

npm i https://pkg.pr.new/@orpc/tanstack-query@1818

@orpc/trpc

npm i https://pkg.pr.new/@orpc/trpc@1818

@orpc/valibot

npm i https://pkg.pr.new/@orpc/valibot@1818

@orpc/zod

npm i https://pkg.pr.new/@orpc/zod@1818

commit: c6735f6

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[codspeed-hq]

Merging this PR will not alter performance

✅ 25 untouched benchmarks

---

_{Comparing claude/toorpcopenapiparams-improvements-1adefd (c6735f6) with main (e584b49)}