feat: sync CLI with dashboard@1.6.22

[cursor]

Upstream version

• dashboard@1.6.22 (sha e51e4dc7c6a793f73ddaa49895fd0ab9b79a06c6) — https://github.com/photon-hq/dashboard/releases/tag/1.6.22
• @photon-ai/dashboard-api bumped 1.6.12 → 1.6.22

Routes added/removed/changed

• 1.6.21 → 1.6.22 delta: none. Dashboard PR #268 ("Record browser hash on flagged real sends") is pure server-side forensic logging on POST /api/otp/phone2/send; the bundled .d.ts is bit-identical to 1.6.21 (diff -rq on the two dashboard-api/dist dirs returned empty).
• Cumulative 1.6.12 → 1.6.22 delta (from prior unmerged sync PRs, kept as reference): additive-only surface — captcha.provider GET, four new fields (plan, platforms, userCount, avatarUrl) on GET /api/projects/:id, and the otp.phone → otp.phone2 split with an optional browserId body field. None of these touch code paths the CLI exercises today (rg for otp\.phone|otp/phone|phone2|browserId|captcha\.provider in src/ is empty), so bun run check stays green after just the dep bump. See UPSTREAM_DIFF.md for the full table.

Snapshot changes

• (none)

New runtime dependencies

• (none)

Checklist

• API type changes come from a @photon-ai/dashboard-api version bump, not hand edits
• No new runtime deps
• All snapshot diffs explained above
• bun run check passes locally

  

---

^{Need help on this PR? Tag /codesmith with what you need. Autofix is disabled.}

---

Note

Low Risk
Dependency-only sync with no application code or new runtime deps; the 1.6.22 API types match 1.6.21 for what the CLI uses.

Overview
Aligns the CLI with dashboard@1.6.22 by bumping the dev dependency @photon-ai/dashboard-api from 1.6.12 to 1.6.22 in package.json and refreshing bun.lock. There are no changes under src/ or to runtime dependencies.

The 1.6.21 → 1.6.22 API bundle is unchanged on the type surface (server-only forensic logging on OTP send); the CLI still types HTTP via PublicApp from this package in src/lib/api.ts.

^{Reviewed by Cursor Bugbot for commit 67b8985. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

Agent PR Review

Scenario: A — Initial review (PR opened by cursor[bot])
Verdict: ✅ Approve

What's right

• Single-purpose bump: only package.json + bun.lock changed, @photon-ai/dashboard-api 1.6.12 → 1.6.22
• No forbidden deps introduced; no new runtime deps
• .github/workflows/ untouched; no snapshot files touched (PR body's "(none)" matches)
• 1.6.21 → 1.6.22 is bit-identical .d.ts (dashboard PR #268 is server-side only), so no CLI code needed to move
• Removed route spectrum.avatar-upload-url (from the cumulative 1.6.12 → 1.6.22 delta) is already migrated: src/commands/spectrum/avatar.ts:34-58 uses the two-step spectrum.avatar.upload.post + spectrum.avatar.commit.post flow
• bun install --frozen-lockfile && bun run check green locally: typecheck OK, 90/90 tests pass, build 245.93 KB

Concerns

• (none)

Deferred (acknowledged in PR body)

• Additive-only cumulative surface the CLI doesn't exercise: captcha.provider GET, new fields (plan, platforms, userCount, avatarUrl) on GET /api/projects/:id, otp.phone → otp.phone2 split with optional browserId. rg for these symbols in src/ returns empty, so deferring is safe.
• Other cumulative additions from UPSTREAM_DIFF.md (slack config, webhooks, whatsapp templates, voice settings, project members, spectrum avatar re-uploads, spectrum-updates PATCH) are additive routes not wired to any CLI command today.

Final note

Clean version-bump PR; upstream deltas the CLI actually exercises are already covered, and the rest is additive surface safely deferred. Marked Ready and approved.