workos: OAuthAuthorizationServerMetadata type omits registration_endpoint and client_id_metadata_document_supported

[piersonmarks]

Summary

The OAuthAuthorizationServerMetadata type in packages/plugins/workos/src/types.ts
does not declare registration_endpoint (DCR) or client_id_metadata_document_supported
(CIMD), even though AuthKit returns both at its RFC 8414
/.well-known/oauth-authorization-server endpoint.

This is a type-accuracy gap, not a correctness bug: in
workosRouter the success path passes the fetched AuthKit document through verbatim
(res.json(await response.json())), so the fields are served correctly at runtime. The
type only describes the static fallback object, which intentionally omits CIMD/DCR.

Context

Follow-up from #601, which fixed the route to fetch the RFC 8414 OAuth Authorization
Server Metadata endpoint (instead of the OIDC discovery document) so CIMD/DCR/PKCE fields
reach MCP clients.

Current type

export interface OAuthAuthorizationServerMetadata {
  readonly issuer: string;
  readonly authorization_endpoint: string;
  readonly token_endpoint: string;
  readonly jwks_uri: string;
  readonly response_types_supported: readonly string[];
  readonly grant_types_supported: readonly string[];
  readonly code_challenge_methods_supported?: readonly string[];
  readonly token_endpoint_auth_methods_supported?: readonly string[];
  readonly scopes_supported?: readonly string[];
}

Proposed change

Add the two fields as optional so the type accurately models AuthKit's response:

  readonly registration_endpoint?: string;
  readonly client_id_metadata_document_supported?: boolean;

Verification

Against a live AuthKit tenant, /.well-known/oauth-authorization-server returns:

"client_id_metadata_document_supported": true,
"registration_endpoint": "https://<authkit-domain>/oauth2/register"

while /.well-known/openid-configuration contains neither field.