L402 — Lightning Network

import httpx, re, hashlib, base64
from ecdsa import VerifyingKey, SECP256k1

def parse_l402_challenge(www_auth: str) -> tuple[str, str]:
    """Parse macaroon and invoice from WWW-Authenticate header."""
    mac = re.search(r'macaroon="([^"]+)"', www_auth).group(1)
    inv = re.search(r'invoice="([^"]+)"', www_auth).group(1)
    return mac, inv

def query_oracle_l402(pair: str, pay_invoice_fn) -> dict:
    """Query oracle via L402. pay_invoice_fn should accept an invoice
    string and return the preimage hex."""
    url = f"https://api.myceliasignal.com/oracle/{pair}"

    with httpx.Client(timeout=15) as client:
        # Step 1: Get 402 challenge
        resp = client.get(url)
        if resp.status_code != 402:
            raise Exception(f"Expected 402, got {resp.status_code}")

        www_auth = resp.headers["WWW-Authenticate"]
        macaroon, invoice = parse_l402_challenge(www_auth)

        # Step 2: Pay invoice (your Lightning implementation)
        preimage = pay_invoice_fn(invoice)

        # Step 3: Retry with L402 credentials
        resp = client.get(
            url,
            headers={"Authorization": f"L402 {macaroon}:{preimage}"}
        )

        if resp.status_code != 200:
            raise Exception(f"Auth failed: {resp.text}")

        data = resp.json()

        # Step 4: Verify secp256k1 signature
        msg_hash = hashlib.sha256(data["canonical"].encode()).digest()
        vk = VerifyingKey.from_string(
            bytes.fromhex(data["pubkey"]),
            curve=SECP256k1
        )
        vk.verify_digest(
            base64.b64decode(data["signature"]),
            msg_hash
        )

        # Parse price from canonical
        fields = data["canonical"].split("|")
        return {
            "price": fields[2],
            "sources": fields[7].split(","),
            "timestamp": fields[5],
            "verified": True,
        }

Authorization: L402 <macaroon_base64>:<preimage_hex>