feat: support keyless PKCE public clients

[nicknisi]

Bring keyless PKCE public clients to @workos/authkit-tanstack-react-start, the same experience as workos/authkit-react-router#96 (workos/authkit-react-router#96). It builds on the authkit-session change from the preceding job, whose branch and PR it names.

authkit-tanstack-start delegates to @workos/authkit-session (src/server/authkit-loader.ts calls createAuthService and getConfig). So:

• Develop against the new authkit-session. Use the authkit-session job's packed build (its worktree under ~/.riker/worktrees; find it from the preceding job's branch riker/<n>-let-workos-authkit-session-run-as-a-keyle… or ask), via a pnpm override in this worktree only while developing. Never commit a file:, link: or override dependency.
• Make the package's own surface keyless-ready: validateConfig, middleware options, any configure/options types re-exported from authkit-session, and anything here that assumes an API key. Key-only features must surface authkit-session's clear error.
• README: a public-client (keyless) section matching fix: update to authkit-session@0.5.3 #96's.
• Unit tests here: config validation in both modes, middleware/sign-in working without a key, and the clear error for key-only features.
• End to end with example/: copy it to a scratch directory, point it at both packed builds (authkit-session and this package), run it with no WORKOS_API_KEY, and show the sign-in route redirects with code_challenge and S256. Leave the dev server running and give Nick the URL and steps to sign in, see the session load, and see a refresh succeed.
• The dependency: the committed package.json should keep a published @workos/authkit-session range. Say exactly which authkit-session release this needs, and whether the PR can merge before that release (e.g. if nothing here type-depends on the new union, it can; otherwise note that it must wait and bump the range when it's out).

Riker's check pnpm install --frozen-lockfile >/dev/null && git diff --quiet origin/main...HEAD -- pnpm-lock.yaml && ! grep -qE '"(file|link):' package.json example/package.json && pnpm typecheck && pnpm lint && pnpm format:check && pnpm test && pnpm build passed.

Opened as a draft by Riker (job 98).

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The changes appear safe to merge; no new actionable issues were found.

Summary

The PR documents keyless sign-in, adds tests for this package’s keyless paths, and gives organization lookups a clear missing-key error.

• TanStack apps can sign in without a WorkOS API key.
• Organization lookups explain missing keys without breaking the impersonation banner.

_{Reviews (3) · Last reviewed commit: "docs: drop the expected-release note fro..." · Reviewed by Greptile}

[workos-shipyard]

⚓ Shipyard review suggestion

Suggested team: applied-ai, based on recent contributors to the changed files (@mitch-fultz).

• Assign @jacobiajohnson · 0 assignments in the last 7 days
• Assign @meganspaulding · 0 assignments in the last 7 days
• Assign @mitch-fultz · 0 assignments in the last 7 days
• Pick for me · balances recent workload

Links open Shipyard for confirmation. Choosing a reviewer overrides availability; “Pick for me” skips known absences.
Comment /tag <team> for a team or /tag to infer one. Tag the same team again to reroll.

Shipyard Analysis

⏳ Generating analysis...

⚓ Explore the analysis in depth in Shipyard · 🔄 Re-run analysis

[gjtorikian]

LGTM. Will need authkit-session #59 to merge and 0.8.0 to publish

[gjtorikian]

no need for "expected to be..."

[nicknisi]

Dropped the "expected to be…" parenthetical; the note now just says keyless mode needs @workos/authkit-session 0.8.0 or later.