feat(cli): support signed-retry on customers update (email/phone changes)

[jklein24]

Summary

Changing --email or --phone-number for an Embedded Wallet customer is a signed-retry operation — the first PATCH /customers/{id} returns a 202 challenge, and completion requires a Grid-Wallet-Signature + Request-Id. customers update now accepts --wallet-signature / --request-id and forwards them, matching the other signed operations (the CLI forwards a caller-supplied stamp; it does not compute it).

Addresses the follow-up flagged on #705's review.

Test plan

• cd cli && npm run build — clean compile.
• npm test — new test asserts customers update forwards the signed-retry headers (68 total).

Original PR: #706

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

2 Skipped Deployments

Project	Deployment	Actions	Updated (UTC)
grid-flow-builder	Ignored	Preview	Jul 20, 2026 10:17pm
grid-wallet-demo	Ignored	Preview	Jul 20, 2026 10:17pm

[akanter]

Warning

This pull request is not mergeable via GitHub because a downstack PR is open. Once all requirements are satisfied, merge this PR as a stack on Graphite.
Learn more

• feat(cli): support signed-retry on customers update (email/phone changes) #713 👈 (View in Graphite)
• feat(cli): add exchange-rates, crypto, discoveries, uma-providers, tokens, and internal-account update/export #712
• feat(cli): add cards and auth domains + signed-request header support #711
• feat(cli): add customer contact-verification commands #710
• fix(cli): reconcile existing Grid CLI commands with the current API #709
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[ls-bolt]

@greptileai review

[greptile-apps]

Greptile Summary

   🤘 FEAR NOT THE PATCH REQUEST, FOR IT HAS BEEN SIGNED IN FIRE 🤘
   ⚡ THE CHALLENGE RETURNS A 202 — WE SHALL RETRY WITH STEEL ⚡

customers update now participates in the signed-retry flow for --email and --phone-number changes on Embedded Wallet customers. The command gains --wallet-signature and --request-id options that are forwarded verbatim as Grid-Wallet-Signature / Request-Id headers, matching the pattern already used by other signed operations.

• Signed options are added via the shared addSignedOptions helper; validation uses signedOptionsError to reject incomplete pairs (exactly one of the two flags) before the HTTP call is made.
• client.ts already filters undefined header values, so a plain update with no signed headers sends no extra headers.
• Three new tests cover happy-path forwarding and both rejection directions of the XOR guard.

Confidence Score: 5/5

Safe to merge — the change is additive, forwards caller-supplied headers through an already-established pattern, and the client correctly drops undefined header values when signed options are absent.

The update command reuses the same addSignedOptions / signedHeaders / signedOptionsError helpers already proven in other signed commands. The client's undefined-filtering loop means a plain update with no signed headers is unaffected. Both XOR-rejection directions are tested, matching the companion-case fix from the prior review round.

No files require special attention.

Important Files Changed

Filename	Overview
cli/src/commands/customers.ts	Adds signed-retry support to the update action: imports shared helpers, chains addSignedOptions onto the update command, validates with signedOptionsError, and forwards headers via signedHeaders. Logic is clean and consistent with other signed commands.
cli/test/customers.test.ts	Adds three new tests covering the happy-path header forwarding and both XOR-rejection directions (signature-only and request-id-only). Addresses the previously flagged gap from PR #705.
cli/README.md	Adds a documentation comment explaining the two-step signed-retry flow for email/phone changes and the separate-calls requirement.

Sequence Diagram

%%{init: {'theme': 'neutral'}}%%
sequenceDiagram
    actor User
    participant CLI as grid CLI
    participant API as Grid API

    User->>CLI: "customers update cust_7 --type INDIVIDUAL --email [email protected]"
    CLI->>API: PATCH /customers/cust_7 (no signed headers)
    API-->>CLI: "202 Challenge { requestId, challenge }"
    CLI-->>User: 202 response (user signs externally)

    User->>CLI: "customers update cust_7 --type INDIVIDUAL --email [email protected] --wallet-signature stamp --request-id id"
    CLI->>CLI: signedOptionsError() both present, no error
    CLI->>API: PATCH /customers/cust_7 Grid-Wallet-Signature: stamp Request-Id: id
    API-->>CLI: 200 Updated customer
    CLI-->>User: success

Loading

%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
sequenceDiagram
    actor User
    participant CLI as grid CLI
    participant API as Grid API

    User->>CLI: "customers update cust_7 --type INDIVIDUAL --email [email protected]"
    CLI->>API: PATCH /customers/cust_7 (no signed headers)
    API-->>CLI: "202 Challenge { requestId, challenge }"
    CLI-->>User: 202 response (user signs externally)

    User->>CLI: "customers update cust_7 --type INDIVIDUAL --email [email protected] --wallet-signature stamp --request-id id"
    CLI->>CLI: signedOptionsError() both present, no error
    CLI->>API: PATCH /customers/cust_7 Grid-Wallet-Signature: stamp Request-Id: id
    API-->>CLI: 200 Updated customer
    CLI-->>User: success

Loading

_{Reviews (3): Last reviewed commit: "feat(cli): support signed-retry on custo..." | Re-trigger Greptile}

[ls-bolt]

@greptileai review