[purpshell]

CLI dev already has hosted-history and Calls commands, but its exact SDK dependency predates the merged ingestion-order API contract. Pin @polymorfa/sdk to the immutable 0.1.0-dev.20260923171224 prerelease published from SDK dev commit 2d6a4d1a1445f2a77a37daab4d66ebc65a25660e. The package and lockfile change together; all existing commands and output remain unchanged.

Impact across surfaces:

• API: unaffected here. The SDK artifact pins monorepo API dev commit 270fbe53e04927d360076971a3e54e2772fb0ed2 with the hosted-history and event-list contracts.
• SDK: uses the already published immutable @polymorfa/sdk@0.1.0-dev.20260923171224 from SDK #270; this PR changes no SDK source. The exact npm tarball integrity is recorded in the lockfile.
• CLI: dependency pin only. Existing history commands from CLI feat(calls): add call consent commands #29 continue to call chats.list/retrieve/listMessages/retrieveMessage; event list keeps its timestamp/cursor behavior. Flags, help, output, credential handling, and exit behavior are unchanged.
• Docs: unaffected because there is no CLI workflow or public contract change. The CLI guide describes an exact SDK prerelease pin without promising a particular current version.
• Feature release: unaffected. Hosted history remains an unreleased enrolled beta gated by API authority and HMS enablement; this dependency update does not enroll users or release it.
• Admin: unaffected; no staff-console or Temporal code consumes the CLI package.

Validation: Node 22 npm ci and the complete CLI npm run verify passed locally: format, lint, typecheck, 804/804 tests, build, pack dry-run, and production audit with zero vulnerabilities. The SDK publish workflow succeeded at its exact source head; the npm registry resolves this version and its dev dist-tag. Hosted PR CI is required before merge.

---

^{Need help on this PR? Tag @codesmith with what you need. Autofix is disabled.}

[coderabbitai]

Warning

Review limit reached

• Ask an admin to enable usage-based reviews

Open in CodeRabbit

Reviews can continue after your included limit without a manual trigger. An admin must approve usage-based billing.

Next included review available in 9 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used all 2 included reviews currently available. Your 68 included PR review attempts over the past 7 days set your current allowance at 2 reviews per hour.

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: bff601b4-3c96-4990-a16d-4097d9439476

📥 Commits

Reviewing files that changed from the base of the PR and between db302f9 and 737be11.

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (1)

• package.json

---

_{Comment @coderabbitai help to get the list of available commands.}