feat: sync CLI with dashboard@v1.6.5

[cursor]

Upstream version

@photon-ai/dashboard-api@1.6.1 — packaged for photon-hq/dashboard@v1.6.5 (sha 69f7b6e6bdfb0a9fd72ee94f278c6ccc82956b0c).

Dashboard v1.6.5 did not publish a new @photon-ai/dashboard-api version — the release only renames the Spectrum project env vars to a SPECTRUM_ prefix (dashboard#234) and gates phone OTP sends behind Cloudflare Turnstile (dashboard#236, #237, #238). None of those touch route paths, request bodies, or response shapes surfaced to the CLI.

main is still pinned to @photon-ai/dashboard-api@1.2.0, so this PR effectively catches the CLI up to the current published contract (1.2.0 → 1.6.1).

Routes added/removed/changed

Route delta vs. main's pinned 1.2.0 (unchanged from the v1.6.4 sync, since api-public was not republished for v1.6.5):

• Added (7):
  • GET, PATCH, PUT api.projects.:id.call-registry.profile
  • GET, POST api.projects.:id.call-registry.registrations
  • GET api.profile.promotional-status
  • PATCH api.profile.promotional-emails
• Removed: (none)
• Route paths changed: (none)
• Response typing changed on all 80 unchanged routes: the 1.6.x bundled .d.ts exposes every response body as Record<string, any> (index-signature only). Dot access on data still compiles, but Array.prototype.map callbacks lose their inferred element type, which is the concrete typecheck fallout addressed by the DTO cast commit below.

See UPSTREAM_DIFF.md for the full delta.

Snapshot changes

• (none)

New runtime dependencies

• (none) — dev-dep bump of @photon-ai/dashboard-api from 1.2.0 → 1.6.1, no runtime deps touched.

Checklist

• API type changes come from a @photon-ai/dashboard-api version bump, not hand edits
• No new runtime deps (or justified above)
• All snapshot diffs explained above
• bun run check passes locally

  

---

^{Need help on this PR? Tag /codesmith with what you need. Autofix is disabled.}

[github-actions]

Agent PR Review

Scenario: A — Initial review (PR opened by cursor[bot])
Verdict: ✅ Approve

What's right

• Upstream contract bumped via @photon-ai/dashboard-api 1.2.0 → 1.6.1 in package.json + bun.lock — no hand-edited types.
• No forbidden deps introduced; no raw fetch() calls added to Photon API paths; no .github/workflows/ or scripts/agent-flow/ changes.
• Response-typing regression to Record<string, any> addressed with two DTOs (Project, SpectrumUser) in src/lib/types.ts, cast at the API boundary in src/commands/projects.ts:69 and src/commands/spectrum/users.ts:41 — matches AGENTS.md soft rule ("cast at the API boundary, never deep in command logic").
• Locally-declared SpectrumUser in spectrum/users.ts was hoisted into the shared module rather than duplicated — no parallel types.
• bun install --frozen-lockfile && bun run check passes locally (typecheck + 36 tests + build all green).
• UPSTREAM_DIFF.md regenerated against 1.6.1, snapshot section correctly notes "(none)", and PR body explains the v1.6.5 → 1.6.1 relationship.

Concerns

• None blocking.

Deferred (acknowledged in PR body / UPSTREAM_DIFF.md)

• 7 newly published routes remain unimplemented in the CLI, which is fine for a sync PR:
  • GET/PATCH/PUT api.projects.:id.call-registry.profile
  • GET/POST api.projects.:id.call-registry.registrations
  • GET api.profile.promotional-status
  • PATCH api.profile.promotional-emails

Final note

Clean version bump plus a minimal, boundary-scoped type fix — no scope creep. Approving and marking ready.