feat: sync CLI with dashboard@v1.6.18

[cursor]

Upstream version

@photon-ai/dashboard-api@1.6.18 — dashboard@v1.6.18 (db38faf00dd88c718f1a80069ffd472cedd97adf)

Release notes: feat(auth): Use Google reCAPTCHA for ENG-2052 OTP sends (dashboard#262). Pure server-side auth-flow change.

Routes added/removed/changed

• (none) — diff -rq between the @photon-ai/dashboard-api 1.6.17 and 1.6.18 dist/ directories is empty. The bundled .d.ts is bit-identical; only the version metadata moved.
• The pre-existing UPSTREAM_DIFF.md on this branch reflects the accumulated delta from the previously-pinned 1.6.12 baseline (main was still on 1.6.12 via PR fix: guard list commands against response shape changes #79); the 1.6.12 breaking-change fixes already landed on main, so this bump requires no code changes.

Snapshot changes

• (none)

New runtime dependencies

• (none)

Checklist

• API type changes come from a @photon-ai/dashboard-api version bump, not hand edits
• No new runtime deps
• All snapshot diffs explained above
• bun run check passes locally

  

---

^{Need help on this PR? Tag /codesmith with what you need. Autofix is disabled.}

---

Note

Low Risk
Version-pin and lockfile update only; no application logic or API surface changes in this repo.

Overview
Bumps the dev dependency @photon-ai/dashboard-api from 1.6.12 to 1.6.18 in package.json and bun.lock, aligning the CLI’s typed Eden contract with dashboard v1.6.18.

There are no CLI source, snapshot, or runtime dependency changes in this diff—the lockfile entry for the package is updated to match the new version and integrity hash only.

^{Reviewed by Cursor Bugbot for commit 2459037. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

Agent PR Review

Scenario: A — Initial review (cursor[bot] draft)
Verdict: Approve

What is right

• Diff is limited to package.json and bun.lock; single line change bumping @photon-ai/dashboard-api from 1.6.12 to 1.6.18.
• No forbidden runtime deps introduced; no hand-edited API types; no changes under .github/workflows/ or scripts/agent-flow/.
• bun install --frozen-lockfile succeeds; bun run check passes (typecheck + 90/90 tests + build, 1 snapshot unchanged).
• Lockfile pins exactly one resolution of @photon-ai/dashboard-api@1.6.18 — no duplicate or floating peers.
• PR body correctly notes the upstream 1.6.17 to 1.6.18 dist/ diff is empty (server-only reCAPTCHA change) and that the accumulated 1.6.12 to 1.6.17 route churn from UPSTREAM_DIFF.md was already absorbed by PR fix: guard list commands against response shape changes #79 landing on main, so no CLI code changes are required for this bump.
• One PR = one version bump; no drive-by refactors.

Concerns

• None.

Deferred (acknowledged in PR body)

• New routes listed in UPSTREAM_DIFF.md (slack, webhooks, whatsapp templates, project members, spectrum avatar upload/commit, voice settings/sip-inbound, etc.) remain unimplemented in src/commands/. Consistent with the "new routes may be deferred" policy; the removed spectrum.avatar-upload-url GET was not referenced in the CLI, so no migration needed.

Final note

Clean version-only bump — marked ready and approved.