feat: sync CLI with dashboard@v1.6.4

[cursor]

Upstream version

@photon-ai/dashboard-api@1.6.1 (packaged for photon-hq/dashboard@v1.6.4, sha 44c3931589ed3c77bb553016706c9334d1a8bd27).

Dashboard v1.6.4 only tightens SMS OTP send handling to require an authenticated session (dashboard#233) — it did not publish a new @photon-ai/dashboard-api version. The type contract is unchanged from v1.6.3, so this PR catches the CLI up to the current published contract (1.2.0 → 1.6.1).

Routes added/removed/changed

Relative to the 1.2.0 we had pinned:

• Added (7) — all new routes under existing surfaces, no CLI changes needed to keep compiling:
  • PATCH /api/profile/promotional-emails
  • GET /api/profile/promotional-status
  • GET /api/projects/:id/call-registry/profile
  • PATCH /api/projects/:id/call-registry/profile
  • PUT /api/projects/:id/call-registry/profile
  • GET /api/projects/:id/call-registry/registrations
  • POST /api/projects/:id/call-registry/registrations
• Removed: (none)
• Changed: (none) — but every 1.6.x response body is now typed as Record<string, any> in the bundled .d.ts, which is why the type fix below is needed. See UPSTREAM_DIFF.md.

Snapshot changes

• (none)

New runtime dependencies

• (none)

Checklist

• API type changes come from a @photon-ai/dashboard-api version bump, not hand edits
• No new runtime deps
• All snapshot diffs explained above
• bun run check passes locally (typecheck + 36 tests + build)

  

---

^{Need help on this PR? Tag /codesmith with what you need. Autofix is disabled.}

[cursor]

Bugbot is not enabled for this team, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[github-actions]

Agent PR Review

Scenario: A — Initial review (PR opened by cursor[bot])
Verdict: ✅ Approve

What's right

• Single upstream version bump: @photon-ai/dashboard-api 1.2.0 → 1.6.1 in both package.json and bun.lock; no hand-edited API types.
• No forbidden deps introduced; runtime deps unchanged (@clack/prompts, @commander-js/extra-typings, @elysiajs/eden, better-auth, cli-table3, commander, open, picocolors, update-notifier).
• .github/workflows/ and scripts/agent-flow/ untouched.
• Response-shape degradation to Record<string, any> handled correctly: new Project and SpectrumUser DTOs added to src/lib/types.ts and cast at the API boundary in the two list commands — matches the "cast at the API boundary, never deep in command logic" guidance.
• SpectrumUser moved from an inline interface in src/commands/spectrum/users.ts into src/lib/types.ts (reuse instead of parallel types).
• getApi() + Eden treaty + { data, error, status } destructure preserved; 401 still throws SessionExpiredError (error.status === 401 in projects list, status === 401 elsewhere — both existing patterns).
• No snapshot files touched; PR body's "Snapshot changes: (none)" matches reality.
• bun install --frozen-lockfile && bun run check is green locally: typecheck clean, 36/36 tests pass, build succeeds (0.38 MB bundle).

Concerns

• None.

Deferred (acknowledged in PR body)

• 7 new routes under existing surfaces, all noted in the PR body as compile-safe additions:
  • PATCH /api/profile/promotional-emails
  • GET /api/profile/promotional-status
  • GET /api/projects/:id/call-registry/profile
  • PATCH /api/projects/:id/call-registry/profile
  • PUT /api/projects/:id/call-registry/profile
  • GET /api/projects/:id/call-registry/registrations
  • POST /api/projects/:id/call-registry/registrations

Final note

Clean catch-up sync: the DTO casts at the boundary are the minimal, correct response to the 1.6.x Record<string, any> typing regression, and the deferred routes are legitimately additive. Marked ready and labeled agent-review:approved + agent-flow.