r.authClaims(...)
Overview
Section titled “Overview”r.authClaims(fn), contributes claims into SessionUser.claims whenever
a session is issued (login AND tenant switch, claims are recomputed to
avoid stale leaks across tenancies).
Multiple hooks merge; keys are auto-prefixed <feature>:<key>, so
cross-feature collisions are impossible by construction. Best-effort by
design: a throwing hook logs and drops only that feature’s claims, login
still succeeds (identity facts are convenience, not access gates).
From packages/framework/src/engine/feature-ast/patterns.ts -> AuthClaimsPattern