feat(payment): add auth-service delegation routes, and sdk helpers.

- wire `/register-payer` and `/add-users` into the auth Express app
- lazily manage Lit client lifecycle, reusing worker instance when present
- derive payer wallets deterministically and delegate via PaymentManager
- expose auth-service `registerPayer` / `delegateUsers` helpers in networks + client SDK

Author: Ansonhkg

apps/lit-auth-server/src/main.ts

@@ -7,6 +7,7 @@ const litAuthServer = createLitAuthServer({
   network: process.env['NETWORK'],
   litTxsenderRpcUrl: process.env['LIT_TXSENDER_RPC_URL'] as string,
   litTxsenderPrivateKey: process.env['LIT_TXSENDER_PRIVATE_KEY'],
+  litDelegationRootMnemonic: process.env['LIT_DELEGATION_ROOT_MNEMONIC'],
   enableApiKeyGate: process.env['ENABLE_API_KEY_GATE'] === 'true',
   stytchProjectId: process.env['STYTCH_PROJECT_ID'],
   stytchSecretKey: process.env['STYTCH_SECRET'],

packages/auth-services/src/auth-server/src/app.ts

@@ -5,6 +5,7 @@ import rateLimit from 'express-rate-limit';
 import { json, urlencoded } from 'express';
 import { registerStatusRoutes } from './routes/status.express';
 import { registerPkpRoutes } from './routes/pkp.express';
+import { registerPaymentRoutes } from './routes/payment.express';
 import { registerStytchRoutes } from './routes/auth/stytch.express';
 import { registerWebAuthnRoutes } from './routes/auth/webauthn.express';
 import { apiKeyGate } from '../middleware/apiKeyGate.express';
@@ -20,6 +21,8 @@ export const createApp = (config?: Partial<AppConfig>): Express => {
     litTxsenderRpcUrl: config?.litTxsenderRpcUrl ?? env.LIT_TXSENDER_RPC_URL,
     litTxsenderPrivateKey:
       config?.litTxsenderPrivateKey ?? env.LIT_TXSENDER_PRIVATE_KEY,
+    litDelegationRootMnemonic:
+      config?.litDelegationRootMnemonic ?? env.LIT_DELEGATION_ROOT_MNEMONIC,
     enableApiKeyGate: config?.enableApiKeyGate ?? env.ENABLE_API_KEY_GATE,
     redisUrl: config?.redisUrl ?? env.REDIS_URL,
     stytchProjectId: config?.stytchProjectId ?? env.STYTCH_PROJECT_ID,
@@ -56,6 +59,7 @@ export const createApp = (config?: Partial<AppConfig>): Express => {
   // routes
   registerStatusRoutes(app);
   registerPkpRoutes(app);
+  registerPaymentRoutes(app, cfg);
   registerStytchRoutes(app, createStytchClient(cfg));
   registerWebAuthnRoutes(app);
 

packages/auth-services/src/auth-server/src/createAuthServer.ts

@@ -10,6 +10,7 @@ export type CreateLitAuthServerOptions = {
   network?: string;
   litTxsenderRpcUrl?: string;
   litTxsenderPrivateKey?: string;
+  litDelegationRootMnemonic?: string;
   enableApiKeyGate?: boolean;
   redisUrl?: string;
   stytchProjectId?: string;
@@ -33,6 +34,7 @@ export const createLitAuthServer = (
     network: options.network,
     litTxsenderRpcUrl: options.litTxsenderRpcUrl,
     litTxsenderPrivateKey: options.litTxsenderPrivateKey,
+    litDelegationRootMnemonic: options.litDelegationRootMnemonic,
     enableApiKeyGate: options.enableApiKeyGate ?? false,
     redisUrl: options.redisUrl,
     stytchProjectId: options.stytchProjectId,

packages/auth-services/src/auth-server/src/index.ts

@@ -11,6 +11,7 @@ const cfg = {
   network: env.NETWORK,
   litTxsenderRpcUrl: env.LIT_TXSENDER_RPC_URL,
   litTxsenderPrivateKey: env.LIT_TXSENDER_PRIVATE_KEY,
+  litDelegationRootMnemonic: env.LIT_DELEGATION_ROOT_MNEMONIC,
   enableApiKeyGate: env.ENABLE_API_KEY_GATE,
   redisUrl: env.REDIS_URL,
   stytchProjectId: env.STYTCH_PROJECT_ID,

packages/auth-services/src/auth-server/src/providers/env.ts

@@ -18,6 +18,7 @@ export const env = createEnv({
     STYTCH_SECRET: z.string().min(1).optional(),
     MAX_REQUESTS_PER_WINDOW: z.coerce.number().int().positive().default(60),
     WINDOW_MS: z.coerce.number().int().positive().default(60_000),
+    LIT_DELEGATION_ROOT_MNEMONIC: z.string().min(1).optional(),
   },
   clientPrefix: 'PUBLIC_',
   client: {},
@@ -36,4 +37,5 @@ export type AppConfig = {
   stytchSecretKey?: string;
   maxRequestsPerWindow: number;
   windowMs: number;
+  litDelegationRootMnemonic?: string;
 };