v28 is for Koko Da Doll

[RobinTail]

Koko Da Doll (aka Rasheeda Williams) was a 35-year-young Black trans woman, performance artist, singer, and star
of the acclaimed documentary Kokomo City. Born in College Park, Georgia, she was based in Atlanta and
became a prominent voice for transgender visibility and the rights of Black trans women.

She was a talented rap artist who released two singles: "Trick" (2020) and "Bulletproof" (2022).

A song she created was featured on the TV show The Chi in 2023, showcasing her artistic talents beyond her advocacy work.

Koko was one of four Black trans women featured in the groundbreaking documentary Kokomo City, directed by D. Smith. The film premiered at the 2023 Sundance Film Festival and won both the NEXT Innovator Award and NEXT Audience
Award. It also received the Berlinale Panorama Audience Award.

In the film, Koko spoke openly about her experiences as a sex worker and the challenges faced by Black trans women. She discussed doing sex work to avoid homelessness for her mother, sister, and herself.

After the Sundance première, Koko wrote on Instagram:

"I will be the reason there's more opportunities and doors opening for transgender girls."

She hoped that her participation in the film would help save lives and create more opportunities for young trans women.

On April 18, 2023, at around 11pm, Koko Da Doll was found dead with a gunshot wound on a sidewalk near Holmes Shopping
Plaza in Southwest Atlanta. She was 35 years old.

A 17-year-old suspect was arrested on April 27, 2023, on suspicion of murder, aggravated assault, and possession of a firearm in the commission of a felony. Atlanta police indicated that a hate crime investigation was ongoing.

Koko was the 13th trans person killed in the United States in 2023. Following her death, Kokomo City was dedicated to her memory. She was honored during the In Memoriam segment at the 2023 BET Awards.

The New York Times described her as someone who "brims with vitality, ambition, and insight" — a woman who fought tooth and nail for her life and self-worth.

Her tragic death serves as a stark reminder of the ongoing violence and discrimination faced by trans women in America.

AP News · AL.com · TDoR

---

👩🏽‍🍳 Cooking...

• migration(v28): require ESLint 10 #3207
• Drop Node 20 #3242
• Using native typescript loader #3267
• ref(node22): Using Promise.withResolvers() #3268
• Upgrading typescript-eslint for TypeScript 6 support #3287
• chore(v28): Using undici 8 #3294
• br(v28): wrongMethodBehavior —> hintAllowedMethods #3299
• br(v28): methodLikeRouteBehavior —> recognizeMethodDependentRoutes #3300
• fix(v28): simpler call for descriptors #3301
• br(v28): hasSummaryFromDescription —> hasSummary #3302
• br(v28): mv noContent —> noBodySchema #3303
• br(v28): shortDescription —> summary, hasSummary —> summarizer (fn) #3310
• br(v28): Making zod plugin an optional peer dependency. #3313
• fix(agents): Updating import convention for v28 #3334
• fix(test): rm symbols test #3340
• feat(v28): Supporting Zod 4.4 #3364 (incl. undo of FIX(deps): Reducing compatibility with Zod #3357)
• fix(v28:plugin): Minor adjustments #3365

Summary by CodeRabbit

• New Features

  • v28: public option/metadata renames (shortDescription → summary, wrongMethodBehavior → hintAllowedMethods, methodLikeRouteBehavior → recognizeMethodDependentRoutes, noContent → noBodySchema) and a configurable documentation summarizer.

• Documentation

  • CHANGELOG/README/SECURITY updated with v28 notes, summarizer docs, migration examples and migration tool link; README shows Zod plugin as optional and xBrand usage.

• Chores

  • Zod plugin moved to optional/peer, branding API renamed (.brand → .xBrand); tooling and Node/module resolution updates.

• Tests

  • Test suite updated to align with renames, summarizer, metadata/examples and branding changes.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

📝 Walkthrough

Walkthrough

Rename config/docs properties, centralize Zod brand/examples into a new metadata module, convert many runtime imports to type-only and explicit .ts specifiers, add migration helpers/ESLint fixes, update CI/tooling and Node targets, and replace several manual Promise wrappers with Promise.withResolvers.

Changes

v28 migration (types, metadata, imports, migration, tooling)

Layer / File(s)	Summary
Data Shape / Types express-zod-api/src/config-type.ts, express-zod-api/src/endpoints-factory.ts	Renamed config fields: wrongMethodBehavior → hintAllowedMethods?: boolean; methodLikeRouteBehavior → recognizeMethodDependentRoutes?: boolean; shortDescription?: string → summary?: string.
Core Implementation express-zod-api/src/metadata.ts, express-zod-api/src/*-schema.ts, express-zod-api/src/raw-schema.ts	Added brandProperty = "x-brand", getBrand() and getExamples() helpers; replaced schema .brand(...) usage with .meta({ [brandProperty]: ... }).
API Surface / Callers express-zod-api/src/endpoint.ts, express-zod-api/src/integration.ts, express-zod-api/src/endpoints-factory.ts	Applied property renames in constructors/getters and BuildProps (shortDescription→summary, noContent→noBodySchema); endpoint getter renamed to summary.
Documentation / Summarization express-zod-api/src/documentation.ts, express-zod-api/src/documentation-helpers.ts	Replaced hasSummaryFromDescription with summarizer?: Summarizer (defaulted); introduced trimSummary(summary?: string, limit = 50) and integrated it into summary generation.
Examples & Registry Access express-zod-api/src/result-helpers.ts, express-zod-api/src/result-handler.ts, express-zod-api/src/documentation-helpers.ts	Call sites switched from direct globalRegistry or external plugin getBrand to local getExamples()/getBrand() helpers; example checks now use examples.length.
Zod Plugin Runtime & Types zod-plugin/src/augmentation.ts, zod-plugin/src/runtime.ts, zod-plugin/src/brand.ts	Introduced xBrand(brand?: PropertyKey) augmentation and runtime xBrand prototype patch; removed plugin-exported getBrand.
Migration Rule & Helpers migration/helpers.ts, migration/index.ts, migration/index.spec.ts	Added AST helpers (NamedProp, queryNamedProp, getPropName, changeProp) and rewrote migration rule listeners to rename/fix properties (wrongMethodBehavior, methodLikeRouteBehavior, hasSummaryFromDescription, noContent, shortDescription) including value transformations and summarizer insertion/removal.
Promise refactor express-zod-api/src/graceful-helpers.ts, express-zod-api/src/middleware.ts, express-zod-api/tests/graceful-shutdown.spec.ts	Replaced several new Promise wrappers with Promise.withResolvers() patterns and returned the created promise.
Module resolution & imports tsconfig.json, cjs-test/tsconfig.json, many src/*, tests/*, example/**, *.tsdown.config.ts	Switched base to @tsconfig/node22, enabled allowImportingTsExtensions/verbatimModuleSyntax; converted many runtime imports to import type; updated local imports to explicit .ts extensions and added JSON import assertions where applicable.
CI / Tooling / Packaging .github/workflows/*, package.json, express-zod-api/package.json, migration/package.json, zod-plugin/package.json, pnpm-workspace.yaml	Updated GitHub Actions branch filters and Node matrix; replaced unrun with node in scripts/workflows; bumped package versions; moved @express-zod-api/zod-plugin to optional peerDependencies; tightened Node engine ranges.
Examples & Tests example/**, compat-test/*, esm-test/*, cjs-test/*, many express-zod-api/tests/*	Updated examples/tests to new property names and metadata API (.meta({ examples })), converted imports to import type and explicit .ts specifiers, adjusted test spawn commands from unrun → node, and updated many assertions accordingly.

Sequence Diagram(s)

sequenceDiagram
    participant Client as Client
    participant Server as Server
    participant Router as Router
    participant Docs as Docs
    participant Meta as Meta

    Client->>Server: HTTP request
    Server->>Router: dispatch route (uses recognizeMethodDependentRoutes)
    Router->>Router: interpret path keys as method vs path (preferMethod)
    alt wrong method on existing path
        Router->>Server: apply or skip 405+Allow based on hintAllowedMethods
    end
    Docs->>Meta: request summary via summarizer(summary, description, trimSummary)
    Docs->>Meta: request examples / brand via getExamples/getBrand
    Meta-->>Docs: returns examples / brand metadata

Loading

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~50 minutes

Possibly related PRs

• RobinTail/express-zod-api#3301 — overlapping v28 migration: renames, metadata handling, and import/specifier changes.
• RobinTail/express-zod-api#3162 — moves Zod branding/metadata into helpers and updates consumers (xBrand/metadata work).
• RobinTail/express-zod-api#3080 — repository-wide import specifier changes to explicit .ts extensions.

"I nibbled code and hid the brand in meta hay,
trimmed big summaries so docs could gently say,
swapped promises for resolvers, neat and bright,
taught Zod a new xBrand to wear at night,
the rabbit hops — v28 lands light."

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch make-v28

[coveralls-official]

coverage: 100.0%. remained the same — make-v28 into master

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​tsconfig/​node22@​22.0.5
	typescript-eslint@​8.55.0 ⏵ 8.58.0
	typescript-eslint@​8.55.0 ⏵ 8.59.0
	@​typescript-eslint/​rule-tester@​8.55.0 ⏵ 8.59.0	+1		+1
	globals@​14.0.0 ⏵ 17.6.0			+1
	@​eslint/​js@​9.39.4 ⏵ 10.0.1
	eslint@​9.39.4 ⏵ 10.0.0	+1
	eslint@​9.39.4 ⏵ 10.3.0	+1
	zod@​4.3.6 ⏵ 4.4.1			+1
	undici@​7.25.0 ⏵ 8.0.0	+28		+1

View full report

[coderabbitai]

🧹 Nitpick comments (1)

package.json (1)

6-8: Add explicit engines.node constraint for native TypeScript execution.

Lines 6 and 8 execute .ts files directly with node. The root package.json lacks an engines.node field, which means contributors on Node 20 or older will encounter runtime failures. Add an explicit constraint aligned with your CI test matrix.

Suggested patch

 {
   "private": true,
   "type": "module",
+  "engines": {
+    "node": ">=22.19.0"
+  },
   "scripts": {

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@package.json` around lines 6 - 8, The package.json is missing an engines.node
constraint while prebuild and pretest scripts run .ts files directly with node;
add an "engines": { "node": "<semver-constraint>" } entry to package.json
(matching your CI test matrix, e.g., the minimum Node version that supports
native TS execution used in CI) so contributors on older Node versions won't
fail; update the semver to align with CI and ensure any README/contributor docs
reflect the required Node version.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Nitpick comments:
In `@package.json`:
- Around line 6-8: The package.json is missing an engines.node constraint while
prebuild and pretest scripts run .ts files directly with node; add an "engines":
{ "node": "<semver-constraint>" } entry to package.json (matching your CI test
matrix, e.g., the minimum Node version that supports native TS execution used in
CI) so contributors on older Node versions won't fail; update the semver to
align with CI and ensure any README/contributor docs reflect the required Node
version.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: c571205f-e5f9-4138-93b4-da3850f8a373

📥 Commits

Reviewing files that changed from the base of the PR and between a2e5a6e and f603c72.

⛔ Files ignored due to path filters (1)

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (1)

• package.json

[pullfrog]

No new issues. Reviewed the following changes:

• Guarded trimSummary against non-positive and NaN limits via Math.max(1, limit || 0) - 1, ensuring the result is never longer than the requested limit and never produces a negative slice end
• Added a parameterized test covering limit values of 5, 0, -1, and NaN

  ^{｜ View workflow run ｜ Using Claude Opus ｜ 𝕏}

[RobinTail]

🚀 beta 5 includes the Node 26 support

[pullfrog]

No new issues. Reviewed the following changes:

• Hardened trimSummary against non-positive and NaN limits by flooring the effective limit at 1, with parameterized tests covering 5/0/-1/NaN
• Widened GlobalMeta[brandProperty] and xBrand parameter from symbol | string | number to PropertyKey in the zod-plugin augmentation, with matching type-level tests
• Merged master to pick up Node 26 support and extended v28's engines range to ^22.19.0 || ^24.0.0 || ^26.0.0
• Bumped beta versions: express-zod-api@28.0.0-beta.5, migration@28.0.0-beta.3, zod-plugin@5.0.0-beta.5
• Minor AGENTS.md wording tweak for test.each placeholder guidance

Prior review feedback:

• trimSummary edge cases for non-positive limits — addressed

  ^{｜ View workflow run ｜ Using Claude Opus ｜ 𝕏}

[RobinTail]

@pullfrog please make the final review before releasing the next major version. Let me know if I'm missing something. Verify the CHANGELOG entry and the validity of the README to the changes of the implementation.

[pullfrog]

Important

The v28 public API renames and their internal wiring line up cleanly, and the CHANGELOG's migration snippets (summarizer: ({ summary, trim }) => trim(summary) etc.) are exactly equivalent to the old behaviour. A few gaps worth closing before the tag, in rough severity order:

1. Migration codemod doesn't cover .brand() → .xBrand() — silent breakage for anyone using brandHandling with user schemas.
2. README never mentions summarizer — the new feature is advertised in the CHANGELOG but has no documentation for users.
3. README.md .remap() sample is inconsistent — unlike the other plugin-only method examples, it lacks a "requires Zod Plugin" inline note.
4. zod-plugin/CHANGELOG.md v5.0.0 drops Node 26 from the supported list but zod-plugin/package.json keeps it — contradicts both the plugin's own package.json and v4.2.0's "Supporting Node 26" entry.
5. Minor: the main CHANGELOG's migration bullet could mention the new ESLint 10 peer requirement, and the getBrand() removal from @express-zod-api/zod-plugin exports (currently only documented in the plugin's own CHANGELOG).

Verified accurate (non-exhaustive):

• Node engines ^22.19.0 || ^24.0.0 || ^26.0.0 are consistent across all workspace package.json files, CI matrix, and tsconfig.
• All five property renames wire through correctly: hintAllowedMethods in routing.ts:111, recognizeMethodDependentRoutes in routing-walker.ts:40-54, summary on endpoints-factory.ts/endpoint.ts/documentation.ts, summarizer in documentation.ts:55-59, noBodySchema in integration.ts.
• defaultSummarizer preserves the old hasSummaryFromDescription: true behaviour, and trimSummary(undefined) returns undefined, so the summarizer: ({ summary, trim }) => trim(summary) replacement for hasSummaryFromDescription: false is semantically exact.
• No framework src/ file invokes plugin-only methods (.brand(), .example(), .remap(), .deprecated(), .xBrand(), .label()); all six built-in brands use .meta({ [brandProperty]: ... }) consistently.
• README.md has no surviving references to any of the five renamed options or to .brand() outside the Zod Plugin section; TOC anchors all resolve; example workspace uses summary, hintAllowedMethods, etc.
• SECURITY.md correctly adds v28 (Koko, 05.2026).

---

Note: 1 inline comment(s) dropped because they did not anchor to lines inside the PR diff:

• README.md:552 (RIGHT) — line 552 (RIGHT) is not inside a diff hunk

  ^{｜ Fix all ➔ ｜ Fix 👍s ➔ ｜ View workflow run ｜ Using Claude Opus ｜ 𝕏}

[pullfrog]

The CHANGELOG introduces summarizer as the replacement for hasSummaryFromDescription and a new feature (configurable trim limit, description fallback), but the README never mentions it — grep summarizer README.md returns zero hits. The natural home is right here under Creating documentation, alongside the summary/description example. Users upgrading who relied on hasSummaryFromDescription: false have no in-repo guidance on the replacement beyond the one-line CHANGELOG snippet.

[pullfrog]

Two small additions worth considering under the migration bullet: (a) the migration now requires ESLint ≥ 10 and typescript-eslint ≥ 8.58 (peer-dep bump in migration/package.json), so users on ESLint 9 will see a peer-dep error when installing; (b) getBrand() was removed from @express-zod-api/zod-plugin's exports — users who imported it (as encouraged by the old brandHandling docs) now need schema.meta()?.["x-brand"]. Currently only documented in the plugin's own CHANGELOG.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@migration/index.ts`:
- Around line 42-48: Update the selector regexes used for matching call
expressions to be anchored so they only match exact property names: replace the
unanchored `/build|buildVoid/` used in the selector for shortDescription with
`/^(build|buildVoid)$/`, and replace the unanchored
`/Documentation|Integration/` used in the brandHandling selector with
`/^(Documentation|Integration)$/`; edit the selectors that build the strings
(the ones constructing `${NT.CallExpression}[callee.property.name=...]` and
`${NT.NewExpression}[callee.name=...]`) so they use the anchored forms to avoid
matching substrings like "rebuild" or "buildSchema".

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 98aaf900-0c39-4945-bbce-3ef8bff00234

📥 Commits

Reviewing files that changed from the base of the PR and between ad8ff20 and 8fa06c4.

📒 Files selected for processing (2)

• migration/index.spec.ts
• migration/index.ts

🚧 Files skipped from review as they are similar to previous changes (1)

• migration/index.spec.ts

[pullfrog]

No new issues. Reviewed the following changes:

• Anchored the shortDescription selector's callee.property.name regex to /^(build|buildVoid)$/ so it no longer matches any method name containing build as a substring (e.g., rebuild, buildConfig)
• Anchored the brandHandling selector's callee.name regex to /^(Documentation|Integration)$/ so it only matches those exact constructors rather than any identifier containing those substrings

  ^{｜ View workflow run ｜ Using Claude Opus ｜ 𝕏}