feat: add helpers and improve workspace auth flows

README.md

@@ -1384,10 +1384,11 @@ self-skips without `WRNEXUS_PG_URL` / `WRNEXUS_MYSQL_URL`.
 
 ## Optional packages
 
-Opt-in, dependency-free packages (Bun/WebCrypto natives) — import only what you need:
+Opt-in helpers and feature packages — import only what you need:
 
 | Package               | What it gives you                                                                     |
 | --------------------- | ------------------------------------------------------------------------------------- |
+| `@wrnexus/helpers`    | Context URL helpers and safe forward-auth `redirectToLogin` responses                 |
 | `@wrnexus/jwt`        | HS256 `signJwt`/`verifyJwt` + `jwtAuth` bearer middleware (stateless auth)            |
 | `@wrnexus/oauth`      | OAuth 2.0 sign-in with PKCE — Google/GitHub/Discord presets + `defineProvider`        |
 | `@wrnexus/authz`      | Authorization: RBAC (`defineRbac`), PBAC/ABAC policies (`any`/`all`/`attr`), guards   |
@@ -1399,6 +1400,7 @@ Opt-in, dependency-free packages (Bun/WebCrypto natives) — import only what yo
 
 ```ts
 import { signJwt, jwtAuth } from "@wrnexus/jwt";
+import { getOriginalRequestUrl, redirectToLogin } from "@wrnexus/helpers";
 import { google, startAuth, completeAuth } from "@wrnexus/oauth";
 import { defineRbac, requirePermission, any, attr } from "@wrnexus/authz";
 import { encrypt, decrypt, generateKey, sha256, hmacSign } from "@wrnexus/encryption";