feat: sync CLI with dashboard@v1.6.8

[cursor]

Upstream version

• Dashboard release: v1.6.8 @ e80f455e22ccb06aba82a723744d648747c4ea6d
• API type contract: @photon-ai/dashboard-api@1.6.1 (unchanged — v1.6.8 is a security hardening pass on the phone-OTP flow, dashboard#241, and does not republish the api-public package)
• CLI was previously pinned to @photon-ai/dashboard-api@1.2.0, so this catches the CLI up to the current public surface.

Routes added/removed/changed

Relative to the pinned 1.2.0 → 1.6.1 delta already documented in UPSTREAM_DIFF.md (36 → 58 routes):

• 23 added — including project members (GET/POST /api/projects/:id/members, DELETE /api/projects/:id/members/:memberUserId), Slack integration (GET/PUT/DELETE /api/projects/:id/slack + installations), Spectrum avatar (POST /api/projects/:id/spectrum/avatar/upload + commit, DELETE), voice (PATCH /api/projects/:id/voice/imessage-enabled, GET /api/projects/:id/voice/settings, PATCH/DELETE /api/projects/:id/voice/sip-inbound), webhooks (GET/POST /api/projects/:id/webhooks, DELETE …/:webhookId), WhatsApp templates (GET/POST /api/projects/:id/whatsapp/templates, PATCH/DELETE …/:templateId), profile spectrum updates (PATCH /api/profile/spectrum-updates).
• 1 removed — GET /api/projects/:id/spectrum/avatar-upload-url (superseded by the new upload/commit pair).
• 0 changed.

No new CLI commands in this PR — scope is minimum-viable typecheck fix, per the automation prompt's Priority 1/2. New routes remain follow-up work.

Snapshot changes

• (none)

New runtime dependencies

• (none)

Notes

The 1.6.x bundled .d.ts publishes route response bodies as Record<string, any> (index signature only). Dot access still compiles, but .map((p) => …) in projects list and spectrum users list trips TS7006 (implicit-any callback param). Fix pattern matches AGENTS.md's soft rules — typed DTOs live in src/lib/types.ts and get cast at the API boundary:

• Added Project and SpectrumUser DTOs in src/lib/types.ts.
• projects list: (data ?? []) as Project[].
• spectrum users list: (data?.users ?? []) as SpectrumUser[]; dropped the file-local SpectrumUser interface in favor of the shared one.

Checklist

• API type changes come from a @photon-ai/dashboard-api version bump, not hand edits
• No new runtime deps (or justified above)
• All snapshot diffs explained above
• bun run check passes locally

  

---

^{Need help on this PR? Tag /codesmith with what you need. Autofix is disabled.}

[github-actions]

Agent PR Review

Scenario: A — Initial review (PR opened by cursor[bot])
Verdict: ✅ Approve

What's right

• Single upstream bump: @photon-ai/dashboard-api 1.2.0 → 1.6.1 in both package.json and bun.lock, no hand-edited types.
• Diff scope stays minimal (5 files): dep bump + two casts + shared DTOs. No unrelated refactors.
• New Project and SpectrumUser DTOs land in src/lib/types.ts and are cast at the API boundary (src/commands/projects.ts:69, src/commands/spectrum/users.ts:41) — matches AGENTS.md soft rules.
• File-local SpectrumUser interface removed in favor of the shared one — no parallel types.
• Removed route GET /api/projects/:id/spectrum/avatar-upload-url is only referenced in an explanatory comment in src/commands/spectrum/avatar.ts:48; the actual upload flow already uses the new avatar.upload + avatar.commit pair.
• 23 new routes explicitly deferred in PR body (typecheck-fix-only scope).
• No forbidden deps introduced; no changes to .github/workflows/ or scripts/agent-flow/.
• getApi() + Eden treaty pattern preserved, { data, error, status } destructure preserved, 401 → SessionExpiredError preserved.
• Snapshot changes "(none)" acknowledged in PR body.
• bun install --frozen-lockfile && bun run check runs green locally (typecheck + 36 tests + bundle).

Concerns

• None.

Deferred (acknowledged in PR body)

• 23 new routes: project members, Slack integration + installations, Spectrum avatar delete, voice (iMessage toggle, settings, SIP inbound), webhooks CRUD, WhatsApp templates CRUD, PATCH /api/profile/spectrum-updates. Follow-up work per PR body.

Final note

Clean minimum-viable typecheck fix for the 1.2.0 → 1.6.1 catch-up; marking ready and applying agent-review:approved + agent-flow.