feat: add default idToken claims (signin_state, login_hint) and kmsi on AccountInfo

[tnorling]

Description

Adds two features to msal-common and msal-browser:

1. Default optional idToken claims on all auth requests

Automatically includes signin_state and login_hint as optional idToken claims on every auth request. These are injected at wire-serialization time in RequestParameterBuilder.addClaims(), so request.claims remains unchanged and SilentFlowClient cache-skip logic is unaffected.

When no user-specified claims or client capabilities are present, the claims parameter will be:

{"id_token":{"signin_state":{"essential":false},"login_hint":{"essential":false}}}

Caller-specified idToken claims are preserved and not overwritten.

2. kmsi boolean on AccountInfo

A new optional kmsi field on AccountInfo indicates whether the Keep Me Signed In flag is set. It is populated from the signin_state claim using the existing isKmsi() helper in AuthToken.ts.

Implementation details

• buildMergedClaims — New function in RequestParameterBuilder that parses claims JSON, merges default optional idToken claims, and appends client capabilities (xms_cc) in a single parse/stringify pass.
• addClientCapabilitiesToClaims removed — Replaced by buildMergedClaims. All callers updated (NestedAppAuthAdapter, PlatformAuthInteractionClient, BrowserUtils).
• ClaimsRequestKeys — Added ID_TOKEN, SIGNIN_STATE, and LOGIN_HINT constants.
• addClaims always sets the CLAIMS parameter — Since buildMergedClaims always produces a non-empty result, the previous conditional guard was removed.

Changed packages

• @azure/msal-common (minor)
• @azure/msal-browser (minor)

Companion PR

• 1P ADO: IDDP/msal-javascript-1p PR #24680

[Copilot]

Pull request overview

This PR enhances MSAL request-claims handling by automatically injecting default optional id_token claims (signin_state, login_hint) into all auth requests (at wire-serialization time), and by surfacing Keep Me Signed In (KMSI) state as an optional kmsi boolean on AccountInfo. It also replaces the prior “add client capabilities to claims” helper with a new single-pass buildMergedClaims merger.

Changes:

• Add buildMergedClaims to merge caller claims + default optional id_token claims + xms_cc client capabilities, and update callers to use it.
• Add AccountInfo.kmsi derived from the signin_state claim using the existing isKmsi helper.
• Update unit tests and API review output, and add Beachball changefiles for msal-common/msal-browser.

Reviewed changes

Copilot reviewed 17 out of 17 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
lib/msal-common/src/request/RequestParameterBuilder.ts	Introduces buildMergedClaims and makes addClaims always set the claims param.
lib/msal-common/src/utils/Constants.ts	Adds ClaimsRequestKeys constants for id_token, signin_state, and login_hint.
lib/msal-common/src/account/AccountInfo.ts	Adds kmsi?: boolean to AccountInfo and populates it from signin_state.
lib/msal-common/apiReview/msal-common.api.md	Updates extracted public API for new kmsi and buildMergedClaims.
lib/msal-common/test/request/RequestParameterBuilder.spec.ts	Updates/expands unit tests for merged-claims behavior and default claims injection.
lib/msal-common/test/protocol/Authorize.spec.ts	Adjusts expected encoded claims query parameter.
lib/msal-common/test/client/RefreshTokenClient.spec.ts	Adjusts expected encoded claims parameter for token requests.
lib/msal-common/test/client/AuthorizationCodeClient.spec.ts	Adjusts expected encoded claims parameter for token requests.
lib/msal-browser/src/utils/BrowserUtils.ts	Switches exported helper from addClientCapabilitiesToClaims to buildMergedClaims.
lib/msal-browser/src/naa/mapping/NestedAppAuthAdapter.ts	Updates NAA claims construction to use buildMergedClaims.
lib/msal-browser/src/interaction_client/PlatformAuthInteractionClient.ts	Updates platform request initialization to use buildMergedClaims.
lib/msal-browser/test/naa/JSRuntime.spec.ts	Updates assertions to validate default id_token claims are added in NAA flow.
lib/msal-browser/test/interaction_client/PlatformAuthInteractionClient.spec.ts	Updates expectations to account for injected default id_token claims.
lib/msal-browser/test/interaction_client/SilentIframeClient.spec.ts	Updates test AccountInfo objects with new optional fields.
lib/msal-browser/test/utils/StringConstants.ts	Updates shared test AccountInfo fixture with new optional fields.
change/@azure-msal-common-1d98c12e-3b9f-4969-a710-fa8e2bf5a287.json	Beachball changefile for msal-common minor change.
change/@azure-msal-browser-b1b2fad5-8b32-43bd-9659-38cdc37ce382.json	Beachball changefile for msal-browser minor change.

Comments suppressed due to low confidence (1)

lib/msal-common/src/request/RequestParameterBuilder.ts:533

• Same hasOwnProperty shadowing concern applies to the access_token check. Use Object.prototype.hasOwnProperty.call(...) to avoid a caller-provided hasOwnProperty key breaking this logic.

        if (
            !mergedClaims.hasOwnProperty(
                Constants.ClaimsRequestKeys.ACCESS_TOKEN
            )
        ) {