feat: sync CLI with dashboard@v1.6.19

UPSTREAM_DIFF.md

@@ -1,44 +1,24 @@
-# Upstream API Diff
+# Upstream API Diff — dashboard@v1.6.19
 
-> Old routes: 36 · New routes: 58
+Bump `@photon-ai/dashboard-api` 1.6.12 → 1.6.19.
 
-## Added Routes
+## Changes since 1.6.12
 
-| Route | Method |
-|-------|--------|
-| `api.profile.spectrum-updates` | `PATCH` |
-| `api.projects.:id.members` | `GET` |
-| `api.projects.:id.members` | `POST` |
-| `api.projects.:id.members.:memberUserId` | `DELETE` |
-| `api.projects.:id.slack` | `DELETE` |
-| `api.projects.:id.slack` | `GET` |
-| `api.projects.:id.slack` | `PUT` |
-| `api.projects.:id.slack.installations` | `GET` |
-| `api.projects.:id.slack.installations.:teamId` | `DELETE` |
-| `api.projects.:id.spectrum.avatar` | `DELETE` |
-| `api.projects.:id.spectrum.avatar.commit` | `POST` |
-| `api.projects.:id.spectrum.avatar.upload` | `POST` |
-| `api.projects.:id.voice.imessage-enabled` | `PATCH` |
-| `api.projects.:id.voice.settings` | `GET` |
-| `api.projects.:id.voice.sip-inbound` | `DELETE` |
-| `api.projects.:id.voice.sip-inbound` | `PATCH` |
-| `api.projects.:id.webhooks` | `GET` |
-| `api.projects.:id.webhooks` | `POST` |
-| `api.projects.:id.webhooks.:webhookId` | `DELETE` |
-| `api.projects.:id.whatsapp.templates` | `GET` |
-| `api.projects.:id.whatsapp.templates` | `POST` |
-| `api.projects.:id.whatsapp.templates.:templateId` | `DELETE` |
-| `api.projects.:id.whatsapp.templates.:templateId` | `PATCH` |
+- **1.6.13** — Server-side signup validation (dashboard#250, suspend signups with >3 email-local dots). No route/DTO change.
+- **1.6.14** — Additive fields on `GET /api/projects/:id` (dashboard#255): `avatarUrl`, `plan`, `platforms`, `userCount`. Surfaced by `photon projects show` (already on main).
+- **1.6.15** — Additive OTP route `POST /api/otp/phone2/send` (dashboard#259) plus old `POST /api/otp/phone/send` kept as decoy. Server-side signup IP suspensions (dashboard#258). No CLI impact — CLI never called `api.otp.*`.
+- **1.6.16** — Server-side logging on real phone OTP send after three failures (dashboard#260). No route/DTO change.
+- **1.6.17** — Server-side block list for suspicious OTP IPs for seven days (dashboard#261). No route/DTO change.
+- **1.6.18** — Server-side swap of OTP send captcha provider to Google reCAPTCHA (dashboard#262). No route/DTO change.
+- **1.6.19** — Add CAPTCHA method to phone OTP forensic logs (dashboard#263). No route/DTO change.
 
-## Removed Routes
+`diff -rq` on the bundled dist between 1.6.18 and 1.6.19 is empty, confirming no
+public API surface change in this release.
 
-| Route | Method |
-|-------|--------|
-| `api.projects.:id.spectrum.avatar-upload-url` | `GET` |
+## Added / Removed / Changed Routes
 
-## Summary
+_(none in 1.6.19)_
 
-- **23** added
-- **1** removed
-- **0** changed
-- **35** unchanged
+The cumulative 1.6.12 → 1.6.19 delta (additive project-detail fields in 1.6.14
+and additive OTP route in 1.6.15) is unchanged from the v1.6.18 sync and is
+already reflected on main.

package.json

@@ -49,7 +49,7 @@
     "prepublishOnly": "bun run typecheck && bun run build"
   },
   "devDependencies": {
-    "@photon-ai/dashboard-api": "1.6.12",
+    "@photon-ai/dashboard-api": "1.6.19",
     "@types/bun": "latest",
     "@types/node": "^25.6.2",
     "@types/semver": "^7.7.1",