feat: sync CLI with dashboard@v1.6.10

[cursor]

Upstream version

• @photon-ai/dashboard-api@1.6.10 (dashboard@v1.6.10, sha 676c9cd801aac1ead4b25fb61188fc11aa8336a3)
• Release notes: https://github.com/photon-hq/dashboard/releases/tag/v1.6.10

Routes added/removed/changed

Between 1.6.9 and 1.6.10: no route changes. Dashboard v1.6.10 is a security-hardening rollup — Turnstile captcha gating on the email-auth account lifecycle (sign-up / password reset / risk-triggered sign-in), Turnstile hostname pin, structured SigNoz logging across the phone-OTP + auth-security pipelines, and an OTLP endpoint default fix. None of it touches the public API surface.

Against the 1.2.0 baseline pinned on main (7 routes added, 0 removed, 0 changed):

• Added: GET /api/profile/promotional-status, PATCH /api/profile/promotional-emails
• Added: GET|PUT|PATCH /api/projects/:id/call-registry/profile
• Added: GET|POST /api/projects/:id/call-registry/registrations

No CLI command touches those routes today, so nothing needed to change on that front.

Snapshot changes

• (none)

New runtime dependencies

• (none)

Checklist

• API type changes come from a @photon-ai/dashboard-api version bump, not hand edits
• No new runtime deps
• All snapshot diffs explained above
• bun run check passes locally

---

Notes

• The 1.6.x contract widens every response body to Record<string, any>. That's fine for dot-access but breaks list.map((p) => …) under noImplicitAny on GET /api/projects (projects.ts) and GET /api/projects/:id/spectrum/users (spectrum/users.ts). Cast at the API boundary with a local DTO (matches the existing pattern in src/commands/spectrum/lines.ts) — no other command sites regressed.

  

---

^{Need help on this PR? Tag /codesmith with what you need. Autofix is disabled.}

[github-actions]

Agent PR Review

Scenario: A — Initial review (draft PR opened by cursor[bot])
Verdict: ✅ Approve

What's right

• Single upstream bump: @photon-ai/dashboard-api 1.2.0 → 1.6.10 in package.json + bun.lock; no hand edits to API types.
• No forbidden runtime deps introduced (axios/chalk/zod/jest/vitest/ts-node/ws/express/dotenv/ioredis/pg/better-sqlite3 all absent).
• .github/workflows/ and scripts/agent-flow/ untouched.
• Snapshot changes: none — PR body correctly declares (none).
• Eden treaty { data, error, status } destructure preserved in both touched command files; spectrum/users.ts:38 still throws SessionExpiredError on 401.
• The two boundary casts (src/commands/projects.ts:68 and src/commands/spectrum/users.ts:40-41) are the minimum fix for the 1.6.x contract widening response bodies to Record<string, any> — pattern mirrors the existing SpectrumLine local DTO in src/commands/spectrum/lines.ts:134.
• bun install --frozen-lockfile && bun run check runs green locally (36 tests pass, typecheck clean, build succeeds).

Concerns

• None blocking. Minor: AGENTS.md soft rule prefers new DTOs in src/lib/types.ts, but the PR mirrors the pre-existing local-interface pattern in src/commands/spectrum/lines.ts — internally consistent, not worth churning.

Deferred (acknowledged in PR body)

• 7 new routes added upstream (api.profile.promotional-status, api.profile.promotional-emails, api.projects.:id.call-registry.{profile,registrations}). No CLI commands touch them today; correctly deferred per PR body.

Final note

1.6.10 is a security-hardening rollup with no route removals or shape changes affecting current CLI surface — the two list typing regressions are surgically addressed and nothing else needs to move.