[purpshell]

Adds message send order and message send order-status for the Brazil payment orders beta (API polymorfa/polymorfa#429 and #433; SDK polymorfa/sdks#329). The CLI pins @polymorfa/sdk@0.1.0-dev.20261001215108, the dev prerelease that sdks dev cdb35d4 published.

• order --order <file|-> sends the orderDetails JSON object unchanged. The API validates BRL, totals, the Pix key and the dynamic Pix code, and names the failing field.
• order-status builds orderStatus from --reference-id, --body, --footer, --order-status (+ --order-description) and --payment-status (+ --payment-timestamp). At least one status is required, and this is checked before any request.
• Both commands pin transport: official_api, accept --idempotency-key, and make one network attempt (maxNetworkRetries: 0). Polymorfa relays orders and does not process funds. Teams outside the beta receive feature_unavailable.
• The README has a new section. The prerelease pin is updated in the README and the release test.

Verification: typecheck, lint (0 errors), build, and vitest (964 passed, including 4 new order tests: file send with idempotency key, non-object refusal, status flags, and a missing status refused before transport).

Not exercised: a live send against the deployed beta.

---

^{Need help on this PR? Tag @codesmith with what you need. Autofix is disabled.}

[coderabbitai]

Warning

Review limit reached

The included review limit has been reached and this organization has disabled usage-based review continuation. Wait for reviews to reset or ask a billing admin to change After included review limits.

• Ask an admin to enable usage-based reviews

Open in CodeRabbit

Reviews can continue after your included limit without a manual trigger. An admin must approve usage-based billing.

Next included review available in 43 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used all 2 included reviews currently available. Your 65 included PR review attempts over the past 7 days set your current allowance at 2 reviews per hour.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: 4a518343-1388-43ae-b929-455ace58fe6a

📥 Commits

Reviewing files that changed from the base of the PR and between 22c40ee and 9988bde.

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (7)

• README.md
• package.json
• src/commands/message/send/order-status.ts
• src/commands/message/send/order.ts
• src/input/payment-order.ts
• test/commands/message-sends.test.ts
• test/release/check-prerelease.test.ts

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

---

_{Comment @coderabbitai help to get the list of available commands.}

[purpshell]

Local review (code-review, high) of the first head. Seven findings, all addressed in 9988bde:

1. Both commands now pass maxNetworkRetries: 0 (src/input/payment-order.ts), so an order or status is never resent automatically. A test shows a 503 makes exactly one request.
2. WhatsApp's 409 refusals are no longer retried, covered by the same one-attempt option.
3. The commands no longer offer --transport, --mention, --forwarded or --reply-to. The request pins transport: official_api.
4. order-status builds typed branches without a cast.
5. Blank --body, --footer, --order-description and --reference-id are refused locally.
6. --order must be the orderDetails object itself; a wrapped object is refused before transport and the missing keys are listed.
7. Tests now cover the dependent-flag guards (also enforced with oclif dependsOn), the payment-only branch and a wrapped file. The stdin path reuses the existing readJsonInput, whose tests already cover it.
   Checks: typecheck, lint, vitest 966 passed.