feat: sync CLI with dashboard@v1.6.11

[cursor]

Upstream version

• dashboard@v1.6.11 (a05def8bd326ac389250630d9569a202f6d97ed8) → @photon-ai/dashboard-api@1.6.11
• Release notes: https://github.com/photon-hq/dashboard/releases/tag/v1.6.11

Routes added/removed/changed

v1.6.11 is a security-hardening release (email-domain block list + interaction-required Turnstile + send-never-verify penalty for phone OTP, dashboard#247 + additive migration 0031). It does not touch the public API surface: diff -q between the @photon-ai/dashboard-api@1.6.10 and @1.6.11 dist/ trees is empty (bit-identical .d.ts), so from the CLI's perspective this bump is a no-op.

main is still pinned to @photon-ai/dashboard-api@1.2.0, so the effective delta shipped by this PR (relative to main) matches the existing UPSTREAM_DIFF.md:

• Added (23): projects/:id/members (GET/POST + DELETE /:memberUserId), projects/:id/slack (GET/PUT/DELETE + installations GET + installations/:teamId DELETE), projects/:id/spectrum/avatar (DELETE + avatar/upload POST + avatar/commit POST), projects/:id/voice/imessage-enabled (PATCH), projects/:id/voice/settings (GET), projects/:id/voice/sip-inbound (PATCH/DELETE), projects/:id/webhooks (GET/POST + :webhookId DELETE), projects/:id/whatsapp/templates (GET/POST + :templateId PATCH/DELETE), profile/spectrum-updates (PATCH).
• Removed (1): projects/:id/spectrum/avatar-upload-url (GET) — long since migrated to the two-step upload/commit flow in the CLI (see e4e3322).
• Changed: none.

Snapshot changes

• (none)

New runtime dependencies

• (none)

Checklist

• API type changes come from a @photon-ai/dashboard-api version bump, not hand edits
• No new runtime deps (or justified above)
• All snapshot diffs explained above
• bun run check passes locally

Notes for reviewer

• Two commits: (1) chore(deps): bump @photon-ai/dashboard-api to 1.6.11 (package.json + bun.lock), (2) fix(commands): restore typed \list` for projects/spectrum users— the 1.6.x bundled.d.tstypes every response body asRecord<string, any>(index-signature only), solist.map((p) => ...)trips TS7006. Fix casts at the API boundary insrc/commands/projects.ts(new localProjectDTO) andsrc/commands/spectrum/users.ts(reuses the existing localSpectrumUser), matching the pattern already in src/commands/spectrum/lines.ts`.
• UPSTREAM_DIFF.md was left as-is: its content (23 added / 1 removed) already matches the 1.2.0 → 1.6.11 delta this PR ships against main.

  

---

^{Need help on this PR? Tag /codesmith with what you need. Autofix is disabled.}

[github-actions]

Agent PR Review

Scenario: A — Initial review (PR opened by cursor[bot])
Verdict: ✅ Approve

What's right

• Single upstream bump @photon-ai/dashboard-api 1.2.0 → 1.6.11 in both package.json and bun.lock — no hand-edited types.
• No forbidden deps introduced; Bun-only workflow intact (configVersion: 0 added by lockfile is Bun-native).
• .github/workflows/ and scripts/agent-flow/ untouched.
• Only 4 files changed (bun.lock, package.json, src/commands/projects.ts, src/commands/spectrum/users.ts) — no unrelated refactors bundled.
• Eden treaty pattern preserved: getApi() + { data, error, status } destructure + SessionExpiredError on 401 (see src/commands/spectrum/users.ts:34-37).
• Type-cast fix in projects.ts:68 and spectrum/users.ts:40 matches the boundary-cast pattern already used in src/commands/spectrum/lines.ts:38 — necessary because the 1.6.x bundled .d.ts degrades response bodies to Record<string, any> and list.map(...) would trip TS7006.
• bun install --frozen-lockfile && bun run check green locally (typecheck + 36 tests + build).

Concerns

• None blocking. Minor soft-rule note: src/lib/types.ts explicitly invites DTOs when the published contract degrades (its own comment names Record<string, any> as the trigger), and the new Project interface was added inline at src/commands/projects.ts:819 instead. Non-blocking because SpectrumUser/SpectrumLine already live inline — this PR is consistent with the existing pattern, not the stated preference. Worth revisiting as a repo-wide cleanup, not in this PR.

Deferred (acknowledged in PR body)

• 23 new routes (projects/:id/members, slack, spectrum/avatar upload/commit, voice/*, webhooks, whatsapp/templates, profile/spectrum-updates) — PR body notes 1.6.10 → 1.6.11 is a bit-identical .d.ts no-op, so surfacing these routes in CLI commands is future work.
• 1 removed route projects/:id/spectrum/avatar-upload-url — long-since migrated to the two-step upload/commit flow in the CLI (referenced commit e4e3322).

Final note

Clean, minimal upstream bump with the exact type-boundary shim the 1.6.x bundled types require; readying for review.