feat: sync CLI with dashboard@v1.6.22

[cursor]

Upstream version

• @photon-ai/dashboard-api 1.6.12 → 1.6.22 (dashboard@v1.6.22, sha 105b499d5b0c764fa294c75da55e50ea49b8e02e)
• Release: https://github.com/photon-hq/dashboard/releases/tag/v1.6.22

Routes added/removed/changed

Cumulative 1.6.12 → 1.6.22 delta (main was still pinned to 1.6.12 before this bump):

• Added: GET /api/captcha/provider, POST /api/otp/phone2/send.
• Removed: (none).
• Changed:
  • GET /api/projects/:id — response body gains avatarUrl, plan, platforms, userCount (dashboard#255, v1.6.14). Already surfaced in photon projects show on main.
  • POST /api/otp/phone2/send — body gains optional browserId?: string (dashboard#267, v1.6.21).
  • POST /api/otp/phone.send — cosmetic field-order swap in decoy body (v1.6.15).

No CLI code changes are required: the two new routes are OTP / captcha auth flows the CLI does not call, and the additive projects show fields were already wired into the command on main. bun run check is green after just the version bump.

See UPSTREAM_DIFF.md for the per-release breakdown, including no-op releases v1.6.13 and v1.6.16–v1.6.20.

v1.6.22 itself is a no-op vs v1.6.21 at the @photon-ai/dashboard-api layer — the two dists differ only in unrelated identity metadata; routes and DTOs are identical. Upstream v1.6.22 covers server-side forensic logging (dashboard#268) and a captcha-provider swap (reCAPTCHA → hCaptcha, dashboard#272); neither touches routes the CLI calls.

Snapshot changes

• (none)

New runtime dependencies

• (none)

Checklist

• API type changes come from a @photon-ai/dashboard-api version bump, not hand edits
• No new runtime deps (or justified above)
• All snapshot diffs explained above
• bun run check passes locally

  

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

---

Note

Low Risk
Dependency and documentation-only sync; upstream OTP/captcha routes are not used by the CLI and existing project-show fields were already wired on main.

Overview
Bumps the dev dependency @photon-ai/dashboard-api from 1.6.12 to 1.6.22 in package.json and bun.lock so CLI types track dashboard@v1.6.22. There are no runtime or CLI source changes in this PR.

UPSTREAM_DIFF.md is rewritten for the 1.6.12→1.6.22 range: it documents 2 new routes (GET api.captcha.provider, POST api.otp.phone2.send), no removals, and 3 changed contracts (richer GET api.projects.:id with avatarUrl, plan, platforms, userCount; optional browserId on phone2 OTP send; cosmetic OTP decoy field order). Per-release notes call out that most intermediate releases are server-only no-ops and that v1.6.22 matches v1.6.21 at the published API package layer.

^{Reviewed by Cursor Bugbot for commit 05a40b4. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

Agent PR Review

Scenario: A — Initial review (PR opened by cursor[bot])
Verdict: Approve

What is right

• Scope is limited to the required version bump: @photon-ai/dashboard-api 1.6.12 to 1.6.22 in package.json + bun.lock, plus a corresponding refresh of UPSTREAM_DIFF.md. No source, test, snapshot, workflow, or scripts/agent-flow/ files touched.
• API types come from the dep bump only — no hand-edited types in src/lib/types.ts.
• No forbidden dependencies introduced (axios/chalk/zod/jest/vitest/ts-node/ws/express/dotenv/ioredis/pg/better-sqlite3 all absent).
• bun install --frozen-lockfile && bun run check is green locally: typecheck ok, 90/90 tests ok, build ok (245.93 KB bundle).
• One PR = one upstream bump; no bundled refactors.
• Upstream coverage checks out:
  • GET /api/captcha/provider and POST /api/otp/phone2/send — auth-flow routes the CLI does not call; deferral acknowledged in PR body.
  • GET /api/projects/:id additive fields (avatarUrl, plan, platforms, userCount) flow through the auto-generated types; photon projects show --json surfaces them via printJson(data).
  • POST /api/otp/phone2/send optional browserId and cosmetic otp.phone.send field-order swap — not called by the CLI.
• Snapshot changes correctly declared as "(none)" in PR body.

Concerns

• None blocking.

Deferred (acknowledged in PR body)

• GET /api/captcha/provider — server-side captcha provider lookup; not a CLI concern.
• POST /api/otp/phone2/send (incl. optional browserId) — browser-aware phone-OTP abuse gate; not a CLI concern.

Final note
Clean, minimal 1.6.12 to 1.6.22 sync. Moving draft to ready and approving.