feat: Surface agent registration id on API key validation

[m0tzy]

Summary

Adapts the SDK to workos/workos#63786, which expands the POST /api_keys/validations response with an optional top-level agent_registration_id — present only when the validated API key is assigned to an agent registration, omitted otherwise.

workos.apiKeys.createValidation now surfaces this as an optional agentRegistrationId:

• ValidateApiKeyResponse gains agentRegistrationId?: string (and the serialized type gains agent_registration_id?).
• The deserializer conditionally spreads the field, so it is omitted (not null) for non-agent keys — mirroring the server's "present only when set" semantics and matching the existing optional-field convention (e.g. stripeCustomerId in the organization serializer).

The shared ApiKey object (list/create/get) is unchanged; the new field lives on the validation response only.

Testing

• jest src/api-keys — 11 pass (added: agent-assigned key returns the registration id; non-agent key omits the field; existing cases untouched)
• tsc --noEmit, eslint, and prettier --check all clean

Closes AUTH-6624

🤖 Generated with Claude Code

[linear-code]

AUTH-6624

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

[greptile-apps]

Greptile Summary

This PR surfaces agent registration ids from API key validation responses. The main changes are:

• Adds optional agentRegistrationId response typing.
• Maps agent_registration_id in the validation deserializer.
• Adds tests for present and omitted agent registration ids.

Confidence Score: 5/5

The change is narrowly scoped to API key validation response typing and deserialization.

The updated validation response contract maps the new optional server field to the SDK response shape while preserving omitted-field behavior for non-agent keys. The changed tests cover both present and absent agent_registration_id cases, and the shared ApiKey shape remains outside the new field’s scope.

None.

T-Rex Logs

What T-Rex did

• Ran the initial API key validation contract tests to establish baseline behavior; the run exited with code 1 and showed inputHasAgentRegistrationId: true while outputHasAgentRegistrationId: false.
• Ran the API key validation agent registration tests after changes; the run exited with code 0 and now shows outputHasAgentRegistrationId: true with the camelCase agent key.
• Executed the targeted API key test suite for the src/api-keys path to validate agent-assigned and non-agent validation responses; the run exited with code 0.

_{Ran code and verified through T-Rex}

_{Reviews (1): Last reviewed commit: "fix(api-keys): Use correct agent_reg_ pr..." | Re-trigger Greptile}