workos-auth-setuplisted

# WorkOS Auth Setup Follow this skill strictly. Reference: [Convex AuthKit add-to-app guide](https://docs.convex.dev/auth/authkit/add-to-app). ## Verify the project Confirm that `$project-setup`, `$convex-setup`, and `$coss-ui-setup` are complete. If one is missing, stop and ask the user to run it first. Find the TanStack Start frontend under `apps/*` and read its actual package name from `package.json`. Use that name in pnpm filters. Do not create or update `packages/backend/convex.json` in this skill. ## Install AuthKit ```powershell pnpm --filter <frontend-package-name> add @workos/authkit-tanstack-react-start ``` ## Configure environment variables Help the user create a WorkOS account if needed and obtain the Client ID and API key. Configure the frontend application's `.env.local`: ```env WORKOS_CLIENT_ID=client_your_client_id WORKOS_API_KEY=sk_test_your_api_key WORKOS_COOKIE_PASSWORD=your_secure_password_at_least_32_characters WORKOS_REDIRECT_URI=http://localhost:3000/callback VITE_CONVEX_URL=https://your-convex-url.convex.cloud ``` Use the detected frontend port instead of `3000` when it differs. Configure the same callback URL in WorkOS. Keep `WORKOS_API_KEY` server-only, require at least 32 characters for `WORKOS_COOKIE_PASSWORD`, never commit `.env.local`, and never print environment values. Do not require or prompt the user to configure a WorkOS Initiate Login URI. It is optional for this skill's core setup and must not block completion. Configure the