feat: sync CLI with dashboard@v1.6.6

[cursor]

Upstream version

• dashboard@v1.6.6 (69f7b6e6bdfb0a9fd72ee94f278c6ccc82956b0c)
• Bumps @photon-ai/dashboard-api devDep 1.2.0 → 1.6.1 (latest published; still what dashboard@v1.6.6 ships, since v1.6.6 is a same-commit redeploy of v1.6.5 with no api-public change)

Routes added/removed/changed

No API contract change from v1.6.5 → v1.6.6 (redeploy). Relative to the CLI's previously-pinned @photon-ai/dashboard-api@1.2.0, the accumulated deltas from UPSTREAM_DIFF.md are:

Added (23) — none wired into CLI commands yet:

• projects/:id/members GET/POST + projects/:id/members/:memberUserId DELETE
• projects/:id/slack GET/PUT/DELETE + projects/:id/slack/installations GET + projects/:id/slack/installations/:teamId DELETE
• projects/:id/spectrum/avatar DELETE + projects/:id/spectrum/avatar/upload POST + projects/:id/spectrum/avatar/commit POST
• projects/:id/voice/imessage-enabled PATCH + projects/:id/voice/settings GET + projects/:id/voice/sip-inbound PATCH/DELETE
• projects/:id/webhooks GET/POST + projects/:id/webhooks/:webhookId DELETE
• projects/:id/whatsapp/templates GET/POST + projects/:id/whatsapp/templates/:templateId PATCH/DELETE
• profile/spectrum-updates PATCH

Removed (1):

• projects/:id/spectrum/avatar-upload-url GET (not consumed by any existing CLI command)

Changed: none.

Snapshot changes

• (none)

New runtime dependencies

• (none)

Checklist

• API type changes come from a @photon-ai/dashboard-api version bump, not hand edits
• No new runtime deps
• All snapshot diffs explained above
• bun run check passes locally

Notes

The 1.6.x @photon-ai/dashboard-api bundled .d.ts types every route response body as Record<string, any> (index-signature only). Dot access still compiles, but Array.prototype.map callbacks lose their element type (TS7006). Fixed at the API boundary by introducing typed Project and SpectrumUser DTOs in src/lib/types.ts and casting data / data.users in the two affected list commands (projects.ts, spectrum/users.ts). The previously-local SpectrumUser interface is hoisted into the shared module so the add-user handler shares the shape.

  

---

^{Need help on this PR? Tag /codesmith with what you need. Autofix is disabled.}

[github-actions]

Agent PR Review

Scenario: A — Initial review (PR opened by cursor[bot])
Verdict: ✅ Approve

What's right

• Single upstream bump: `@photon-ai/dashboard-api` 1.2.0 → 1.6.1 in `package.json` + `bun.lock`, no hand-edited API types.
• Only one removed route (`api.projects.:id.spectrum.avatar-upload-url` GET) — confirmed unused by any command in `src/commands/`.
• 23 new routes deferred and explicitly acknowledged in PR body.
• DTO hoisting is minimal and correct: `Project` and `SpectrumUser` land in `src/lib/types.ts` and are cast at the API boundary in `src/commands/projects.ts:69` and `src/commands/spectrum/users.ts:41` — matches the boundary-cast rule in AGENTS.md.
• `SpectrumUser` interface was hoisted from `spectrum/users.ts` into the shared module (removes the parallel type; the add-user handler now shares the shape).
• No forbidden deps introduced; no raw `fetch()` against the Photon API added (the two existing `fetch()` sites in `src/lib/api.ts` and `src/commands/spectrum/avatar.ts` are pre-existing and unrelated to this PR).
• `.github/workflows/` and `scripts/agent-flow/` untouched.
• `bun run check` passes locally: typecheck clean, 36/36 tests pass, build succeeds.

Concerns

• None.

Deferred (acknowledged in PR body)

• `projects/:id/members` GET/POST + `.:memberUserId` DELETE
• `projects/:id/slack` GET/PUT/DELETE + `.installations` GET + `.installations/:teamId` DELETE
• `projects/:id/spectrum/avatar` DELETE + `.avatar/upload` POST + `.avatar/commit` POST
• `projects/:id/voice/imessage-enabled` PATCH + `.settings` GET + `.sip-inbound` PATCH/DELETE
• `projects/:id/webhooks` GET/POST + `.:webhookId` DELETE
• `projects/:id/whatsapp/templates` GET/POST + `.:templateId` PATCH/DELETE
• `profile/spectrum-updates` PATCH

Final note

Clean, minimal sync PR — one version bump plus the exact boundary-cast fix the 1.6.x `Record<string, any>` response typing forced. Ready for human merge.