feat: sync CLI with dashboard@v1.6.12

[cursor]

Upstream version

• Dashboard release: v1.6.12 (sha 9e2913d1dbc9c9d2cec1160cca2451bd8a6da3f9)
• @photon-ai/dashboard-api: 1.2.0 → 1.6.12

Unlike the last several no-op bumps in the 1.6.x series (v1.6.4–v1.6.11 were all security / infra fixes with an identical public API surface), v1.6.12 does change the public API contract. Two routes now have breaking body / response shapes; both are used by the CLI and fixed in this PR.

Routes added/removed/changed

Route list vs. the 1.2.0 bundled .d.ts is unchanged from the previous no-op runs — the 23-added / 1-removed table in UPSTREAM_DIFF.md still applies. What's new in 1.6.12 are two changed signatures:

• Changed PATCH api.projects.:id.spectrum.profile — body no longer accepts avatarUrl (only firstName / lastName). The avatar URL is now applied server-side by spectrum/avatar/commit, so the client no longer needs a follow-up PATCH.
• Changed GET api.projects.:id.lines — response is now { lines, pendingRegistrations } instead of a bare SpectrumLine[] array.

CLI-side fixes:

• src/commands/spectrum/avatar.ts: drop the post-commit profile PATCH step (and its --no-update-profile flag + buildRecoveryCommand / shellQuote helpers) since the API no longer accepts avatarUrl there.
• src/commands/spectrum/profile.ts: remove the --avatar-url option from spectrum profile update; the option's hint already pointed users at spectrum avatar upload, which remains the only supported path.
• src/commands/spectrum/lines.ts: unwrap data?.lines before casting to the local SpectrumLine[] DTO in the list command.
• UPSTREAM_DIFF.md: add a Changed Routes section documenting both signatures and bump the summary counters to 23 added / 1 removed / 2 changed / 33 unchanged.

No new commands or DTOs; new routes from the 1.6.x delta (webhooks, whatsapp.templates, voice.settings, slack.installations, projects.:id.members, etc.) are still deferred.

Snapshot changes

• (none)

New runtime dependencies

• (none)

Checklist

• API type changes come from a @photon-ai/dashboard-api version bump, not hand edits
• No new runtime deps (or justified above)
• All snapshot diffs explained above
• bun run check passes locally (typecheck + 36 tests + build, all green)

  

---

^{Need help on this PR? Tag /codesmith with what you need. Autofix is disabled.}

---

Note

Medium Risk
Breaking upstream API shapes affect live CLI calls to profile and lines; changes are localized to Spectrum commands with a straightforward response unwrap and removed dead paths.

Overview
Bumps @photon-ai/dashboard-api from 1.2.0 to 1.6.12 and updates Spectrum CLI commands for two breaking API contract changes documented in UPSTREAM_DIFF.md.

Spectrum profile / avatar: PATCH spectrum/profile no longer accepts avatarUrl (avatars are applied on spectrum/avatar/commit). The CLI drops --avatar-url from spectrum profile update, removes the post-commit profile PATCH (and --no-update-profile, recovery helpers) from spectrum avatar upload, and directs users to upload for avatars.

Lines list: GET projects/:id/lines now returns { lines, pendingRegistrations } instead of a bare array; spectrum lines list reads data?.lines for table/JSON output (pending registrations are not surfaced yet).

^{Reviewed by Cursor Bugbot for commit 7ddfb1f. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

Agent PR Review

Scenario: A — Initial review (PR opened by cursor[bot])
Verdict: Approve

What's right

• Version bump only: @photon-ai/dashboard-api 1.2.0 -> 1.6.12 in both package.json and bun.lock, no hand-edited API types.
• Both breaking upstream shapes are covered:
  • PATCH api.projects.:id.spectrum.profile — --avatar-url option and avatarUrl from the request body removed in src/commands/spectrum/profile.ts; body typed as { firstName?: string; lastName?: string }.
  • GET api.projects.:id.lines — response unwrapped via data?.lines ?? [] in src/commands/spectrum/lines.ts:38.
• src/commands/spectrum/avatar.ts correctly drops the post-commit profile PATCH plus the now-unused --no-update-profile flag and buildRecoveryCommand / shellQuote helpers. Removed PRODUCTION_URL import is consistent with the deletion.
• Every call still routes through getApi() + Eden treaty with { data, error, status } destructuring; 401 continues to throw SessionExpiredError. The lone fetch() in avatar.ts:68 is a presigned-URL PUT (S3), not a Photon API call.
• UPSTREAM_DIFF.md gains a Changed Routes section and the summary counters update to 23 added / 1 removed / 2 changed / 33 unchanged.
• No forbidden deps introduced; no .github/workflows/ or scripts/agent-flow/ touched; no snapshot files modified (PR body correctly notes "(none)").
• bun install --frozen-lockfile clean; bun run check green (typecheck + 36 tests + build).

Concerns

• None blocking.

Deferred (acknowledged in PR body)

• New 1.6.x routes: webhooks, whatsapp.templates, voice.settings, voice.sip-inbound, voice.imessage-enabled, slack / slack.installations, projects.:id.members, profile.spectrum-updates. No CLI commands yet; safe to defer.
• pendingRegistrations field on the new lines GET response is not surfaced anywhere in the CLI. Fine to defer since the list command only rendered lines before.

Final note

Clean, minimal, well-scoped upstream sync for v1.6.12; both changed signatures are correctly migrated and the deferred surface is called out. Marking ready and approving.