[purpshell]

polymorfa webhook test --owner organization --input ... passed project-only body and sessionId fields through to the API, which rejects them with HTTP 400. The command now checks owner input before calling the SDK: team tests accept only eventType, and project tests require body and sessionId together. Help, package guidance, and the webhook skill explain the two forms.

This change builds against the existing exact @polymorfa/sdk@0.1.0-dev.20260926005918 pin. Its package-lock integrity matches the npm registry (sha512-PAkVAqN5QNSKcoT4i7DJHDRp5RfKbDmiJUDurkgxJYOyFR4d+wJ65HrAqkY5KGvBjtANsjkqRczmt8gQRAnGVw==). The current SDK already exposes webhooks.test, so this CLI validation does not need an unpublished package to compile. API contract clarification is polymorfa/polymorfa #352, with spec source commit 9be29db321ecdb8e164bbf33d5b2cb1f4ff12c91; the matching owner-specific SDK types are polymorfa/sdks #312. Those are separate merge and publication gates.

Five-part assessment:

• API: No route or runtime change. API #352 documents the existing team/project input rules.
• SDK: The installed exact prerelease supports the called method; #312 adds owner-specific TypeScript input types and early team rejection.
• CLI: Updated the webhook test command's input validation, help, focused tests, README, and skill guidance. Output and exit conventions remain the existing CLI error path.
• Docs: The public webhook guide is updated in API #352. This PR updates CLI package guidance. A dated customer changelog entry waits for CLI publication.
• Feature release: Existing webhook permissions and availability are unchanged. No flag, entitlement, or enrollment change. CLI registry publication and live delivery acceptance remain separate.

Validation: developer-webhooks.test.ts (18 passed), typecheck, and focused ESLint passed against the exact installed SDK pin. No authenticated or live webhook test was run. Exact-head CI is the broader gate.

---

^{Need help on this PR? Tag @codesmith with what you need. Autofix is disabled.}

[coderabbitai]

Warning

Review limit reached

• Ask an admin to enable usage-based reviews

Open in CodeRabbit

Reviews can continue after your included limit without a manual trigger. An admin must approve usage-based billing.

Next included review available in 8 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used all 2 included reviews currently available. Your 63 included PR review attempts over the past 7 days set your current allowance at 2 reviews per hour.

The included review limit has been reached and this organization has disabled usage-based review continuation. Wait for reviews to reset or ask a billing admin to change After included review limits.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: 3682dbb3-8202-47f5-8e1f-0fc24fe942da

📥 Commits

Reviewing files that changed from the base of the PR and between 0982f48 and b14c335.

📒 Files selected for processing (4)

• README.md
• skills/polymorfa-webhooks/SKILL.md
• src/commands/webhook/test.ts
• test/commands/developer-webhooks.test.ts

---

_{Comment @coderabbitai help to get the list of available commands.}