useCan
Gate UI on the same scope strings the server enforces — reactive permissions.
Gate UI on the SAME scope strings the server's requireScope checks — one
source of truth, no separate frontend permission list. Feed the subject's scopes
(from your session query) to <PermissionProvider>; useCan reads them.
import { PermissionProvider, useCan } from '@voltro/client'
<PermissionProvider scopes={session.scopes}>…</PermissionProvider>
const canDelete = useCan('todos:delete') // ADMIN bypasses; deny-by-defaultUX only — the server still enforces. Pairs with <AutoForm> / <DataTable> to
auto-hide actions the subject can't perform.
The scope set itself, the canCall matcher, the OR variant (useCanAny /
canCallAny), and the per-RESOURCE gates (useResourceCan / useResourceCans)
are in usePermissions.