Marc-André Bombeck 464522f315 feat(ai): publish capabilities on the account payload ...

GET /api/auth/me gains ai: the state of every capability and the
provider block, resolved for the active record and masked to the
grant like moduleAccess. The authority comes from the switch the
payload already resolved, so a delegate reads not_permitted_for_record
and a guardian is limited to the operator's key.

useAiCapability is the web reader and fails closed until the payload
arrives. GET /api/feature-flags becomes a deprecated projection of the
operator switches with a Deprecation header and a link to its
successor.

2026-09-24 07:49:14 +02:00

..

__tests__

feat(ai): publish capabilities on the account payload

2026-09-24 07:49:14 +02:00

route.ts

feat(ai): publish capabilities on the account payload

2026-09-24 07:49:14 +02:00