feat: sync CLI with dashboard@v1.6.9

[cursor]

Upstream version

• Dashboard release: v1.6.9 @ 300c4f6976206ab994b3f40e632dfdd116de79a3
• Bumps @photon-ai/dashboard-api from 1.2.0 → 1.6.9.

Routes added/removed/changed

v1.6.9 is a security-hardening release (progressive phone-OTP lockout + account suspension, dashboard#243) plus a release-pipeline repair (dashboard#242) that unsticks Publish api-public after being broken since v1.6.2. The public API contract itself is unchanged from v1.6.8, so this PR replays the accumulated 1.2.0→1.6.x delta already summarized in UPSTREAM_DIFF.md:

• 23 routes added — project members (GET/POST /projects/:id/members, DELETE /projects/:id/members/:memberUserId), Slack integration (GET/PUT/DELETE /projects/:id/slack, GET /projects/:id/slack/installations, DELETE .../:teamId), Spectrum avatar (POST /projects/:id/spectrum/avatar/upload, POST .../commit, DELETE .../avatar), voice settings (GET /projects/:id/voice/settings, PATCH /projects/:id/voice/imessage-enabled, PATCH/DELETE /projects/:id/voice/sip-inbound), webhooks (GET/POST /projects/:id/webhooks, DELETE .../:webhookId), WhatsApp templates (GET/POST /projects/:id/whatsapp/templates, PATCH/DELETE .../:templateId), PATCH /profile/spectrum-updates.
• 1 route removed — GET /projects/:id/spectrum/avatar-upload-url (superseded by the new upload/commit pair).
• 0 routes changed.
• New behavior introduced in v1.6.9 — ACCOUNT_SUSPENDED error class from the central auth guard, plus phone-OTP lockout/suspension flow — is fully server-side and not exposed as a new route surface, so no CLI change is required.

Snapshot changes

• (none)

New runtime dependencies

• (none)

Checklist

• API type changes come from a @photon-ai/dashboard-api version bump, not hand edits
• No new runtime deps
• All snapshot diffs explained above
• bun run check passes locally (36 tests, typecheck clean, build 0.38 MB)

Notes for reviewers

The response body of every route in the 1.6.x bundled .d.ts degrades to Record<string, any>, so the two typed callback sites (projects list, spectrum users list) get TS7006 on .map((p) => ...) / .map((u) => ...). Fixed with the memory-noted pattern: minimal Project + SpectrumUser DTOs in src/lib/types.ts cast once at the API boundary ((data ?? []) as Project[], (data?.users ?? []) as SpectrumUser[]). The local SpectrumUser interface previously duplicated in src/commands/spectrum/users.ts is removed in favor of the shared one.

  

---

^{Need help on this PR? Tag /codesmith with what you need. Autofix is disabled.}

[github-actions]

Agent PR Review — Scenario A (initial review, cursor[bot] draft) — Verdict: Approve.

Whats right:

• Single upstream bump: @photon-ai/dashboard-api 1.2.0 → 1.6.9 in package.json + bun.lock; no hand-edited API types.
• Response-body degradation (Record<string, any>) handled per pattern: minimal DTOs Project + SpectrumUser added to src/lib/types.ts, cast once at the API boundary (src/commands/projects.ts:69, src/commands/spectrum/users.ts:41).
• Duplicate local SpectrumUser interface removed from src/commands/spectrum/users.ts in favor of the shared type.
• No forbidden deps, no workflow changes, no snapshot changes, no unrelated refactors.
• Removed route GET /api/projects/:id/spectrum/avatar-upload-url was already migrated in a prior release to the upload/commit two-step flow (src/commands/spectrum/avatar.ts:47-65); only a historical explanatory comment remains.
• All commands still use getApi() + Eden treaty with { data, error, status } destructuring and SessionExpiredError on 401.
• bun install --frozen-lockfile + bun run check green locally: typecheck clean, 36/36 tests pass, build 0.38 MB.

Concerns: none blocking.

Deferred (acknowledged in PR body): 23 additive routes (project members, Slack integration, Spectrum avatar upload/commit/delete, voice settings, webhooks, WhatsApp templates, PATCH /profile/spectrum-updates) — no CLI surface change required to make bun run check pass; can land in follow-ups. New v1.6.9 ACCOUNT_SUSPENDED behavior is server-side only.

Final note: clean, minimal, single-purpose version bump with the correct DTO-at-boundary pattern — approving and marking ready.