feat: sync CLI with dashboard@v1.3.1

[cursor]

Upstream

• Dashboard release: v1.3.1 (sha c2b68e9)
• @photon-ai/dashboard-api: 1.2.0 → 1.3.1

Routes added / removed / changed

The route map exposed by PublicApp is structurally identical between
v1.2.0 and v1.3.1 — no routes were added, removed, or had signature
changes. The notable PRs in this window are app-layer / CI / auth-hardening
that don't touch shapes the CLI consumes (#191, #194, #199, #190).

What did change is the published type bundle: starting at 1.2.3,
@photon-ai/dashboard-api emits request/response bodies as any and
response status maps as { [x: string]: any } rather than the rich DTOs
the 1.2.0 bundle carried. This loosened the inferred type of Eden
treaty's data, which is the source of the (small) CLI breakage.

CLI changes

• Bumped @photon-ai/dashboard-api devDep to 1.3.1.
• projects list and spectrum users list each call .map(...) on
  data — under the new contract data is { [x: string]: any }, so
  the callback param was implicitly any and tripped noImplicitAny.
  Recovered the shape with a boundary cast, mirroring the pattern
  src/commands/spectrum/lines.ts already uses for SpectrumLine:
  • src/commands/projects.ts: new local Project DTO, cast list
    response with as Project[].
  • src/commands/spectrum/users.ts: cast data?.users ?? [] with
    the existing SpectrumUser interface.
• UPSTREAM_DIFF.md refreshed to describe the 1.2.0 → 1.3.1 window.

Snapshot changes

(none)

New runtime dependencies

(none)

Verification

• bun run check — typecheck + 33 tests + build all pass.

  

---

^{Need help on this PR? Tag /codesmith with what you need. Autofix is disabled.}

[github-actions]

Agent PR Review

Scenario: A - Initial review (PR opened by cursor bot)
Verdict: Approve

What is right:

• Single upstream bump: @photon-ai/dashboard-api 1.2.0 to 1.3.1 consistently applied in package.json and bun.lock (no hand-edits).
• No forbidden deps introduced; no Node, npm, pnpm, or yarn footprint.
• .github/workflows/, scripts/agent-flow/, snapshots, and tests untouched. PR body Snapshot-changes section correctly reports (none).
• Boundary-cast fix is minimal and idiomatic: mirrors the existing SpectrumLine pattern in src/commands/spectrum/lines.ts:38 with the same shape (data ?? []) as T[], no try/catch added, no DTO splitting, no rewrites.
• New local Project DTO in src/commands/projects.ts:33-40 covers exactly the fields actually read by registerListCommand: id, name, status, location, platforms, updatedAt.
• SpectrumUser cast in src/commands/spectrum/users.ts:40 reuses the file-local interface rather than creating a parallel type.
• Eden treaty { data, error, status } destructure and SessionExpiredError on 401 preserved everywhere.
• UPSTREAM_DIFF.md rewritten to accurately reflect the 1.2.0 to 1.3.1 window (0 added / 0 removed / 0 changed routes; loosened published types are the source of the breakage).
• bun install --frozen-lockfile and bun run check is green locally: typecheck + 33 tests + build all pass.

Concerns: None blocking.

Deferred (acknowledged in PR body): None - upstream had 0 route additions/removals/signature changes in this window, so there is nothing to defer.

Final note: Clean, narrowly-scoped sync PR: one dep bump plus two boundary casts to recover types Eden treaty no longer infers under the looser 1.3.1 published contract. Approved.