docs: add verified package usage examples

packages/helpers/README.md

@@ -13,7 +13,9 @@ bun add @wrnexus/helpers
 The package is private, so the machine must be authenticated to the `wrnexus` npm
 organization.
 
-## Forward-auth login redirects
+## Usage
+
+### Redirect an unauthenticated forward-auth request
 
 The gateway calls an SSO verifier on a different URL from the original application.
 These helpers reconstruct the original URL from the gateway headers and safely place it
@@ -42,15 +44,29 @@ Location: http://sso.localhost:3000/login?returnTo=http%3A%2F%2Fadmin.localhost%
 
 Always list the application hosts that are valid redirect destinations. Forwarded host
 headers are rejected when `allowedHosts` is absent or does not match, preventing an open
-redirect. A callback can support dynamic tenant domains:
+redirect.
 
 The SSO hostname is the login destination, not an `allowedHosts` entry. For example,
 when protecting `admin.localhost:3000`, keep `admin.localhost:3000` in the allowlist even
 though the verifier runs at `sso.localhost:3000`. WRNexus preserves both hosts across a
 nested gateway request.
 
+### Support dynamic tenant domains
+
 ```ts
-allowedHosts: (host) => host.endsWith(".example.test");
+import type { Context } from "@wrnexus/core";
+import { getOriginalRequestOrigin, redirectToLogin } from "@wrnexus/helpers";
+
+export const GET = async (ctx: Context) => {
+  const allowedHosts = (host: string) => host === "example.test" || host.endsWith(".example.test");
+
+  console.info("Authentication requested by", getOriginalRequestOrigin(ctx, { allowedHosts }));
+  return redirectToLogin(ctx, "https://auth.example.test/login", {
+    allowedHosts,
+    returnToParam: "continue",
+    status: 303,
+  });
+};
 ```
 
 ## API

packages/helpers/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wrnexus/helpers",
-  "version": "0.2.23",
+  "version": "0.2.24",
   "private": true,
   "type": "module",
   "description": "Safe convenience helpers for WrNexus request contexts and common application flows.",