feat: sync CLI with dashboard@v1.6.21

[cursor]

Upstream version

@photon-ai/dashboard-api 1.6.12 → 1.6.21 (dashboard@v1.6.21, sha e879400).

Release notes: https://github.com/photon-hq/dashboard/releases/tag/v1.6.21

Routes added/removed/changed

Cumulative delta since main was last bumped (1.6.12):

• Added
  • GET /api/captcha/provider (1.6.15+)
  • POST /api/otp/phone2/send (1.6.15+)
• Removed
  • (none)
• Changed
  • GET /api/projects/:id response gains avatarUrl: string | null, plan: PlanTier, platforms: SpectrumPlatformId[], userCount: number (1.6.14).
  • POST /api/otp/phone2/send body gains optional browserId?: string (1.6.21, dashboard#267 — browser-aware phone OTP abuse gate).
  • POST /api/otp/phone/send (decoy) — cosmetic field-order swap in body.

The v1.6.21 change itself is purely additive on an OTP route the CLI does not call, so no source-code edits are required — the version bump alone keeps bun run check green.

Snapshot changes

• (none)

New runtime dependencies

• (none)

Checklist

• API type changes come from a @photon-ai/dashboard-api version bump, not hand edits
• No new runtime deps (or justified above)
• All snapshot diffs explained above
• bun run check passes locally

  

---

^{Need help on this PR? Tag /codesmith with what you need. Autofix is disabled.}

---

Note

Low Risk
Dev-only API type pin and documentation; no application logic, snapshots, or new runtime dependencies.

Overview
Bumps the dev dependency @photon-ai/dashboard-api from 1.6.12 to 1.6.21 (package.json, bun.lock) so Eden types match dashboard v1.6.21. There are no CLI source changes in this PR.

UPSTREAM_DIFF.md is rewritten for this sync window: it documents 2 new routes (GET api.captcha.provider, POST api.otp.phone2.send), no removals, and 3 typed changes—richer GET api.projects.:id (avatarUrl, plan, platforms, userCount), optional browserId on phone2 OTP send (v1.6.21), and a cosmetic decoy body field order on POST api.otp.phone.send. OTP/captcha routes are server-side; the CLI does not call them.

^{Reviewed by Cursor Bugbot for commit b02a799. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

Agent PR Review

Scenario: A — Initial review (PR opened by cursor[bot])
Verdict: ✅ Approve

What is right

• Diff is scoped to exactly three files: package.json, bun.lock, UPSTREAM_DIFF.md — one PR, one upstream version bump (1.6.12 → 1.6.21).
• @photon-ai/dashboard-api bump is symmetric in package.json and bun.lock; no hand-edited API types.
• No forbidden deps introduced (axios, chalk, zod, jest, vitest, ts-node, ws, express, dotenv, ioredis, pg, better-sqlite3 all absent).
• No changes under .github/workflows/ or scripts/agent-flow/.
• No snapshot files touched — PR body's Snapshot changes: (none) matches reality.
• Upstream delta is purely additive (2 added routes the CLI does not call, 1 additive field set on GET /api/projects/:id, 1 optional body field on an OTP route, 1 cosmetic decoy shuffle). No removed/renamed routes to migrate.
• bun install --frozen-lockfile clean; bun run check green (typecheck + 90 tests + build).

Concerns

• None blocking.

Deferred (acknowledged in PR body)

• The new avatarUrl / plan / platforms / userCount fields on GET /api/projects/:id are typed by the version bump but not yet surfaced in the projects show command's printKv output. UPSTREAM_DIFF.md says they are Surfaced in photon projects show — aspirational, not current. Additive typing keeps bun run check green, so fine to defer, but worth a follow-up PR to actually render them.
• New routes GET /api/captcha/provider and POST /api/otp/phone2/send are auth-flow / server-side only; CLI does not call them. No follow-up needed.

Final note
Clean version-bump PR — additive-only upstream changes, all hard rules satisfied, checks green. Approved and marked ready.