feat(cli): support signed-retry on customers update (email/phone changes)

[ls-bolt]

This PR has been claimed. The active PR is now #713.

Summary

Changing --email or --phone-number for an Embedded Wallet customer is a signed-retry operation — the first PATCH /customers/{id} returns a 202 challenge, and completion requires a Grid-Wallet-Signature + Request-Id. customers update now accepts --wallet-signature / --request-id and forwards them, matching the other signed operations (the CLI forwards a caller-supplied stamp; it does not compute it).

Addresses the follow-up flagged on #705's review.

Test plan

• cd cli && npm run build — clean compile.
• npm test — new test asserts customers update forwards the signed-retry headers (68 total).

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

2 Skipped Deployments

Project	Deployment	Actions	Updated (UTC)
grid-flow-builder	Ignored	Preview	Jul 19, 2026 1:36am
grid-wallet-demo	Ignored	Preview	Jul 19, 2026 1:36am

[akanter]

Warning

This pull request is not mergeable via GitHub because a downstack PR is open. Once all requirements are satisfied, merge this PR as a stack on Graphite.
Learn more

• feat(cli): support signed-retry on customers update (email/phone changes) #706 👈 (View in Graphite)
• feat(cli): add exchange-rates, crypto, discoveries, uma-providers, tokens, and internal-account update/export #705
• feat(cli): add cards and auth domains + signed-request header support #704
• feat(cli): add customer contact-verification commands #703
• fix(cli): reconcile existing Grid CLI commands with the current API #702
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[ls-bolt]

@greptileai review

[greptile-apps]

Greptile Summary

This PR extends customers update to support the signed-retry protocol needed when changing --email or --phone-number for Embedded Wallet customers, addressing a follow-up from PR #705.

• Adds --wallet-signature / --request-id flags to customers update and forwards them as Grid-Wallet-Signature / Request-Id headers via the existing addSignedOptions / signedHeaders helpers in signed.ts.
• Extracts a new signedOptionsError helper with XOR validation (both-or-neither guard) that is reusable across other commands, and wires it into the update action's validation chain.
• Adds two tests covering header forwarding (with path assertion) and co-validation rejection, and documents the two-step flow in the README.

Confidence Score: 5/5

Safe to merge — the changes are additive, the client already filters undefined headers, and the both-or-neither guard correctly uses XOR semantics.

The new signedOptionsError XOR guard is correct, the client.ts undefined-header filter ensures clean requests when neither signed flag is provided, and both threads from the previous review have been fully addressed (path assertion added, co-validation guard extracted into a shared helper and tested).

No files require special attention.

Important Files Changed

Filename	Overview
cli/src/signed.ts	Adds signedOptionsError helper — XOR validation ensuring both signed-retry headers are supplied together or not at all. Logic is correct and the function is reusable across commands.
cli/src/commands/customers.ts	Wires addSignedOptions, signedOptionsError, and signedHeaders into the customers update action; validation and header forwarding are correctly ordered and complete.
cli/test/customers.test.ts	Adds two new tests: header forwarding (with path assertion) and co-validation rejection. The previously flagged path assertion is now present.
cli/README.md	Documents the signed-retry flow for email/phone updates, including the separate-calls constraint.

Sequence Diagram

%%{init: {'theme': 'neutral'}}%%
sequenceDiagram
    participant User
    participant CLI as grid CLI
    participant API as PATCH /customers/{id}

    User->>CLI: "customers update cust_7 --type INDIVIDUAL --email ada@example.com"
    CLI->>API: "PATCH /customers/{id} (no signed headers)"
    API-->>CLI: 202 Challenge (requestId)
    CLI-->>User: 202 response + requestId

    User->>CLI: "customers update cust_7 --type INDIVIDUAL --email ada@example.com --wallet-signature stamp --request-id id"
    Note over CLI: signedOptionsError() validates both flags present together
    CLI->>API: "PATCH /customers/{id} Grid-Wallet-Signature + Request-Id"
    API-->>CLI: 200 OK (updated customer)
    CLI-->>User: success

Loading

%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
sequenceDiagram
    participant User
    participant CLI as grid CLI
    participant API as PATCH /customers/{id}

    User->>CLI: "customers update cust_7 --type INDIVIDUAL --email ada@example.com"
    CLI->>API: "PATCH /customers/{id} (no signed headers)"
    API-->>CLI: 202 Challenge (requestId)
    CLI-->>User: 202 response + requestId

    User->>CLI: "customers update cust_7 --type INDIVIDUAL --email ada@example.com --wallet-signature stamp --request-id id"
    Note over CLI: signedOptionsError() validates both flags present together
    CLI->>API: "PATCH /customers/{id} Grid-Wallet-Signature + Request-Id"
    API-->>CLI: 200 OK (updated customer)
    CLI-->>User: success

Loading

_{Reviews (2): Last reviewed commit: "feat(cli): support signed-retry on custo..." | Re-trigger Greptile}

[ls-bolt]

@greptileai review