Publishes bank.program.*; null publishes nothing (tests).
Whether an operator may grant each program: it is live, and a live ACTIVE route's version in effect names it. Without that route nothing could be placed under the grant, and RouteFusion onboarding would fail (§ 3.6).
Soft-deletes a program, refused while any customer holds a grant on it. Deleting a deleted program succeeds and publishes again, as a retry.
Grants the program to the customer, alongside any other grant they hold, the same vendor's included (§ 3.3). Re-granting a held program is a no-op. Refuses a program no placement route names; see checkRouted.
grant's body inside the caller's transaction, so the caller's own write
commits or rolls back with it. Call invalidateGrant after the commit.
After a grant or revoke commits: busts the program cache it touched and publishes it. A re-grant of a held program publishes again. Best-effort, since a caller's retry finds its grant committed and never calls this again.
Removes the customer's grant on the program. Existing virtual accounts and memos are untouched (§ 4.5): only new minting stops.
revoke's body inside the caller's transaction. Call invalidateGrant
after the commit.
Edits a live program. null clears a nullable field and an omitted one is
left alone. The provider program id may change only while no grant or
virtual account references it: both carry it as the program's identity.
Program CRUD and grants (PROGRAM_ROUTING.md § 3.1, § 3.3). A grant is a permission: a customer may hold any number of programs, of any vendor.