feat: sync CLI with dashboard@v1.6.7

[cursor]

Upstream version

• dashboard release: v1.6.7 (3becbeada08dfdedaa195c8f7597dd5e40f07bfc)
• Effective type contract: @photon-ai/dashboard-api@1.6.1 (unchanged since the v1.6.1 publish on 2026-07-08 — v1.6.2–v1.6.7 are dashboard-only releases and did not republish the @photon-ai/dashboard-api package; v1.6.7 in particular is a phone-OTP quota-lockout security fix that doesn't touch the public API surface).
• Bumps the pinned dev dep from 1.2.0 → 1.6.1 since main was still on the pre-1.3.x contract.

Routes added/removed/changed

Summary from UPSTREAM_DIFF.md (36 → 58 routes):

• Added (23): profile spectrum-updates PATCH; per-project members (GET/POST/DELETE), slack config (GET/PUT/DELETE) + slack installations (GET/DELETE), spectrum avatar (DELETE + upload/commit POSTs), voice iMessage toggle (PATCH), voice settings GET, voice SIP inbound (PATCH/DELETE), webhooks (GET/POST/DELETE), whatsapp templates (GET/POST/DELETE/PATCH).
• Removed (1): GET api.projects.:id.spectrum.avatar-upload-url (replaced by the new avatar upload/commit pair).
• Changed: none.

Only typecheck-affecting deltas are handled here — new CLI surfaces for the added routes are left for follow-up PRs per the automation's Priority-3 guidance.

Snapshot changes

• (none)

New runtime dependencies

• (none)

Checklist

• API type changes come from a @photon-ai/dashboard-api version bump, not hand edits
• No new runtime deps
• All snapshot diffs explained above
• bun run check passes locally

Notes on the type-contract shape

Every response body in the bundled .d.ts on 1.6.x is currently Record<string, any> (index-signature only), which broke .map((p) => ...) in the projects list and spectrum users list commands with TS7006. Fixed by adding typed Project and SpectrumUser DTOs to src/lib/types.ts and casting data / data.users at the API boundary (matching the pattern used by prior sync PRs #40–#69). The local SpectrumUser interface in spectrum/users.ts is now imported from the shared types module.

  

---

^{Need help on this PR? Tag /codesmith with what you need. Autofix is disabled.}

[github-actions]

Agent PR Review

Scenario: A — Initial review (PR opened by cursor[bot])
Verdict: ✅ Approve

What's right

• API contract update is a clean version bump: @photon-ai/dashboard-api 1.2.0 → 1.6.1 in package.json and bun.lock, no hand-edited types.
• No forbidden deps introduced; runtime dependencies unchanged.
• No changes to .github/workflows/ or scripts/agent-flow/.
• Eden pattern preserved: getApi() + { data, error, status } destructure and SessionExpiredError on 401 are intact in both touched commands. The only edits are boundary casts ((data ?? []) as Project[], (data?.users ?? []) as SpectrumUser[]) to work around the Record<string, any> response shape in the 1.6.x .d.ts.
• New DTOs are consolidated in src/lib/types.ts per the soft-rule guidance; the local SpectrumUser in spectrum/users.ts is now imported from the shared module rather than duplicated.
• Removed route GET api.projects.:id.spectrum.avatar-upload-url was already migrated to the two-step avatar.upload.post + avatar.commit.post flow in a prior sync (src/commands/spectrum/avatar.ts:47-53), so no stale references remain.
• Snapshot files untouched (## Snapshot changes: (none) in PR body matches the diff).
• bun run check passes locally: typecheck clean, 36/36 tests, build 0.38 MB.

Concerns

• None blocking.

Deferred (acknowledged in PR body)

• CLI surfaces for the 23 added routes (project members, slack config/installations, spectrum avatar DELETE, voice iMessage/settings/SIP-inbound, webhooks, whatsapp templates, profile spectrum-updates PATCH) are explicitly left for follow-up PRs per the automation's Priority-3 guidance.

Final note

Minimal, well-scoped type-contract sync — one upstream bump, no unrelated refactors. Marking ready for review.