feat: sync CLI with dashboard@v1.6.15

[cursor]

Upstream version

@photon-ai/dashboard-api@1.6.15 — dashboard v1.6.15 (82d51e40947c35def51e38c92fb9edadc89b1408).

Routes added/removed/changed

vs. previous CLI-side sync target (1.6.14):

• Added: POST /api/otp/phone2/send — the real phone-OTP send path (dashboard#259).
• Removed: none — the old POST /api/otp/phone/send is kept in the type surface as a decoy honeypot.
• Changed: none. Field ordering on the decoy body swapped code/captchaToken cosmetically; no shape change.

dashboard#258 (temporary signup IP suspensions) is pure server-side abuse control with no public route surface change.

The CLI does not call any api.otp.* route (phone OTP is a browser/mobile auth flow), so no command edits are required. bun run check stays green from the version bump alone.

Snapshot changes

• (none)

New runtime dependencies

• (none)

Checklist

• API type changes come from a @photon-ai/dashboard-api version bump, not hand edits
• No new runtime deps (or justified above)
• All snapshot diffs explained above
• bun run check passes locally

  

---

^{Need help on this PR? Tag /codesmith with what you need. Autofix is disabled.}

---

Note

Low Risk
Dev-dependency version bump and documentation only; no CLI logic or new runtime deps, and OTP routes are outside CLI usage.

Overview
Bumps the typed API surface to @photon-ai/dashboard-api@1.6.15 (dashboard v1.6.15) in package.json and bun.lock, with no CLI command or runtime dependency changes.

UPSTREAM_DIFF.md is reframed for this sync: it documents the v1.6.14 → v1.6.15 delta (notably POST api.otp.phone2.send) and notes that the legacy api.otp.phone.send stays in types as a decoy; signup IP suspensions are server-only. The cumulative vs-main route counts are updated accordingly.

The CLI does not call api.otp.* routes, so behavior is unchanged beyond staying aligned with upstream types.

^{Reviewed by Cursor Bugbot for commit 4c19fa1. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

Agent PR Review

Scenario: A — Initial review (PR opened by cursor[bot])
Verdict: ✅ Approve

What's right

• Version bump only: @photon-ai/dashboard-api 1.6.12 → 1.6.15 in package.json + bun.lock, no hand-edited types.
• Diff is scoped to package.json, bun.lock, UPSTREAM_DIFF.md — no unrelated refactors, no .github/workflows/ or scripts/agent-flow/ edits.
• No forbidden deps introduced; no package-manager cross-contamination.
• The only added route, POST /api/otp/phone2/send, is genuinely unreachable from the CLI — grep -rn "api\.otp" in src/ returns zero hits, so the "no command edits required" claim in the PR body checks out.
• No removed/changed routes to migrate; the old api.otp.phone.send decoy stays in the type surface and is likewise uncalled.
• No snapshot files touched (PR body "Snapshot changes: (none)" matches the diff).
• bun install --frozen-lockfile && bun run check green locally: typecheck clean, 90/90 tests pass, build produces dist/photon.js.

Concerns

• None blocking.

Deferred (acknowledged in PR body)

• None — this sync has no new CLI-facing surface to defer.

Final note

Clean minimal sync that catches main up to dashboard v1.6.15; the intermediate 1.6.13/1.6.14 hops carried no CLI-called route churn, and bun run check confirms type compatibility. Marking Ready and approving.