export type RouteAccessMeta = {
  readonly permissions?: readonly string[]
}

/** UI visibility hint only; the API remains the authorization authority. */
export function canAccessRoute(meta: RouteAccessMeta, grantedPermissions: ReadonlySet<string>): boolean {
  const required = meta.permissions ?? []
  return required.every(permission => grantedPermissions.has(permission))
}