keytd-manat 0.1.0__tar.gz

keytd_manat-0.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 KeyTD
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

keytd_manat-0.1.0/PKG-INFO

@@ -0,0 +1,92 @@
+Metadata-Version: 2.4
+Name: keytd-manat
+Version: 0.1.0
+Summary: One API for Azerbaijani online payment providers: Kapital Bank, Azericard, Payriff, Epoint, GoldenPay and Yığım.
+Author-email: KeyTD <info@keytd.com>
+License-Expression: MIT
+Project-URL: Homepage, https://github.com/KeyTechAndDesign/manat
+Project-URL: Issues, https://github.com/KeyTechAndDesign/manat/issues
+Keywords: azerbaijan,payments,azn,manat,payment-gateway,kapital-bank,azericard,payriff,epoint,goldenpay,yigim
+Classifier: Programming Language :: Python :: 3
+Classifier: Topic :: Office/Business :: Financial
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Dynamic: license-file
+
+# Manat for Python
+
+One API for Azerbaijani online payment providers: Kapital Bank, Azericard, Payriff, Epoint, GoldenPay and Yığım.
+Python 3.10+, no dependencies (standard library only, RSA included).
+
+```bash
+pip install keytd-manat
+```
+
+```python
+from manat import Manat, azn
+from manat.providers import KapitalBank
+
+pay = Manat(KapitalBank(username=os.environ["KB_USER"], password=os.environ["KB_PASSWORD"]))
+
+result = pay.create_payment("A-1001", azn("25.50"), "https://shop.az/payment/return")  # 2550 qəpik
+if result.next.type == "redirect":
+    return redirect(result.next.url)
+```
+
+Store `result.payment_id` with the order. It is what `get_status`, `refund`, `capture` and `cancel` take.
+
+## Providers
+
+```python
+from manat.providers import Azericard, Epoint, GoldenPay, KapitalBank, Payriff, Yigim
+
+KapitalBank(username, password, environment="test")
+Azericard(terminal, private_key_pem, "My Shop", "https://shop.az", gateway_public_key=gateway_pem, environment="test")
+Payriff(secret_key)
+Epoint(public_key, private_key)
+GoldenPay(auth_key, merchant_name, environment="test")
+Yigim(merchant, api_key, biller, environment="test")
+```
+
+| Provider     | create_payment | verify_callback | get_status | refund | capture | cancel |
+|--------------|:-:|:-:|:-:|:-:|:-:|:-:|
+| Kapital Bank | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
+| Azericard    | ✓ (form POST) | ✓ | ✓ | ✓ | ✓ | ✓ |
+| Payriff      | ✓ | ✓ | ✓ | ✓ | ✓ | — |
+| Epoint       | ✓ | ✓ | ✓ | ✓ | — | — |
+| GoldenPay    | ✓ | ✓ | ✓ | ✓ | — | — |
+| Yığım        | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
+
+Every provider takes `base_url` (or `gateway_url`), `transport` and `timeout` keyword arguments.
+
+## Callbacks
+
+Pass what your handler received, with the raw body. Unsigned redirects and webhooks are never trusted: the adapter
+re-reads the payment from the provider's API.
+
+```python
+event = pay.verify_callback(request.method, query=request.args, body=request.get_data(as_text=True))
+if event.status == "paid":
+    ...  # fulfil event.payment_id; for Azericard store event.provider_ref for refunds
+```
+
+## Refunds, capture, cancel
+
+```python
+pay.refund(payment_id)                                   # full refund
+pay.refund(payment_id, amount=azn("10.00"))              # partial
+pay.capture(payment_id)                                  # after intent="authorize"
+pay.refund(payment_id, provider_ref=event.provider_ref)  # Azericard
+```
+
+## Errors
+
+Everything raises `manat.ManatError`. `error.code` is one of `invalid_request`, `invalid_signature`, `provider_error`,
+`network_error`, `unsupported_operation`; `provider_code`, `provider_message` and `raw` hold what the provider said.
+
+## Tests
+
+```bash
+cd python && PYTHONPATH=src:tests python3 -m unittest discover -s tests
+```

keytd_manat-0.1.0/README.md

@@ -0,0 +1,76 @@
+# Manat for Python
+
+One API for Azerbaijani online payment providers: Kapital Bank, Azericard, Payriff, Epoint, GoldenPay and Yığım.
+Python 3.10+, no dependencies (standard library only, RSA included).
+
+```bash
+pip install keytd-manat
+```
+
+```python
+from manat import Manat, azn
+from manat.providers import KapitalBank
+
+pay = Manat(KapitalBank(username=os.environ["KB_USER"], password=os.environ["KB_PASSWORD"]))
+
+result = pay.create_payment("A-1001", azn("25.50"), "https://shop.az/payment/return")  # 2550 qəpik
+if result.next.type == "redirect":
+    return redirect(result.next.url)
+```
+
+Store `result.payment_id` with the order. It is what `get_status`, `refund`, `capture` and `cancel` take.
+
+## Providers
+
+```python
+from manat.providers import Azericard, Epoint, GoldenPay, KapitalBank, Payriff, Yigim
+
+KapitalBank(username, password, environment="test")
+Azericard(terminal, private_key_pem, "My Shop", "https://shop.az", gateway_public_key=gateway_pem, environment="test")
+Payriff(secret_key)
+Epoint(public_key, private_key)
+GoldenPay(auth_key, merchant_name, environment="test")
+Yigim(merchant, api_key, biller, environment="test")
+```
+
+| Provider     | create_payment | verify_callback | get_status | refund | capture | cancel |
+|--------------|:-:|:-:|:-:|:-:|:-:|:-:|
+| Kapital Bank | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
+| Azericard    | ✓ (form POST) | ✓ | ✓ | ✓ | ✓ | ✓ |
+| Payriff      | ✓ | ✓ | ✓ | ✓ | ✓ | — |
+| Epoint       | ✓ | ✓ | ✓ | ✓ | — | — |
+| GoldenPay    | ✓ | ✓ | ✓ | ✓ | — | — |
+| Yığım        | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
+
+Every provider takes `base_url` (or `gateway_url`), `transport` and `timeout` keyword arguments.
+
+## Callbacks
+
+Pass what your handler received, with the raw body. Unsigned redirects and webhooks are never trusted: the adapter
+re-reads the payment from the provider's API.
+
+```python
+event = pay.verify_callback(request.method, query=request.args, body=request.get_data(as_text=True))
+if event.status == "paid":
+    ...  # fulfil event.payment_id; for Azericard store event.provider_ref for refunds
+```
+
+## Refunds, capture, cancel
+
+```python
+pay.refund(payment_id)                                   # full refund
+pay.refund(payment_id, amount=azn("10.00"))              # partial
+pay.capture(payment_id)                                  # after intent="authorize"
+pay.refund(payment_id, provider_ref=event.provider_ref)  # Azericard
+```
+
+## Errors
+
+Everything raises `manat.ManatError`. `error.code` is one of `invalid_request`, `invalid_signature`, `provider_error`,
+`network_error`, `unsupported_operation`; `provider_code`, `provider_message` and `raw` hold what the provider said.
+
+## Tests
+
+```bash
+cd python && PYTHONPATH=src:tests python3 -m unittest discover -s tests
+```

keytd_manat-0.1.0/pyproject.toml

@@ -0,0 +1,25 @@
+[build-system]
+requires = ["setuptools>=77"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "keytd-manat"
+version = "0.1.0"
+description = "One API for Azerbaijani online payment providers: Kapital Bank, Azericard, Payriff, Epoint, GoldenPay and Yığım."
+readme = "README.md"
+license = "MIT"
+authors = [{name = "KeyTD", email = "info@keytd.com"}]
+requires-python = ">=3.10"
+dependencies = []
+keywords = ["azerbaijan", "payments", "azn", "manat", "payment-gateway", "kapital-bank", "azericard", "payriff", "epoint", "goldenpay", "yigim"]
+classifiers = [
+    "Programming Language :: Python :: 3",
+    "Topic :: Office/Business :: Financial",
+]
+
+[project.urls]
+Homepage = "https://github.com/KeyTechAndDesign/manat"
+Issues = "https://github.com/KeyTechAndDesign/manat/issues"
+
+[tool.setuptools.packages.find]
+where = ["src"]

keytd_manat-0.1.0/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

keytd_manat-0.1.0/src/keytd_manat.egg-info/PKG-INFO

@@ -0,0 +1,92 @@
+Metadata-Version: 2.4
+Name: keytd-manat
+Version: 0.1.0
+Summary: One API for Azerbaijani online payment providers: Kapital Bank, Azericard, Payriff, Epoint, GoldenPay and Yığım.
+Author-email: KeyTD <info@keytd.com>
+License-Expression: MIT
+Project-URL: Homepage, https://github.com/KeyTechAndDesign/manat
+Project-URL: Issues, https://github.com/KeyTechAndDesign/manat/issues
+Keywords: azerbaijan,payments,azn,manat,payment-gateway,kapital-bank,azericard,payriff,epoint,goldenpay,yigim
+Classifier: Programming Language :: Python :: 3
+Classifier: Topic :: Office/Business :: Financial
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Dynamic: license-file
+
+# Manat for Python
+
+One API for Azerbaijani online payment providers: Kapital Bank, Azericard, Payriff, Epoint, GoldenPay and Yığım.
+Python 3.10+, no dependencies (standard library only, RSA included).
+
+```bash
+pip install keytd-manat
+```
+
+```python
+from manat import Manat, azn
+from manat.providers import KapitalBank
+
+pay = Manat(KapitalBank(username=os.environ["KB_USER"], password=os.environ["KB_PASSWORD"]))
+
+result = pay.create_payment("A-1001", azn("25.50"), "https://shop.az/payment/return")  # 2550 qəpik
+if result.next.type == "redirect":
+    return redirect(result.next.url)
+```
+
+Store `result.payment_id` with the order. It is what `get_status`, `refund`, `capture` and `cancel` take.
+
+## Providers
+
+```python
+from manat.providers import Azericard, Epoint, GoldenPay, KapitalBank, Payriff, Yigim
+
+KapitalBank(username, password, environment="test")
+Azericard(terminal, private_key_pem, "My Shop", "https://shop.az", gateway_public_key=gateway_pem, environment="test")
+Payriff(secret_key)
+Epoint(public_key, private_key)
+GoldenPay(auth_key, merchant_name, environment="test")
+Yigim(merchant, api_key, biller, environment="test")
+```
+
+| Provider     | create_payment | verify_callback | get_status | refund | capture | cancel |
+|--------------|:-:|:-:|:-:|:-:|:-:|:-:|
+| Kapital Bank | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
+| Azericard    | ✓ (form POST) | ✓ | ✓ | ✓ | ✓ | ✓ |
+| Payriff      | ✓ | ✓ | ✓ | ✓ | ✓ | — |
+| Epoint       | ✓ | ✓ | ✓ | ✓ | — | — |
+| GoldenPay    | ✓ | ✓ | ✓ | ✓ | — | — |
+| Yığım        | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
+
+Every provider takes `base_url` (or `gateway_url`), `transport` and `timeout` keyword arguments.
+
+## Callbacks
+
+Pass what your handler received, with the raw body. Unsigned redirects and webhooks are never trusted: the adapter
+re-reads the payment from the provider's API.
+
+```python
+event = pay.verify_callback(request.method, query=request.args, body=request.get_data(as_text=True))
+if event.status == "paid":
+    ...  # fulfil event.payment_id; for Azericard store event.provider_ref for refunds
+```
+
+## Refunds, capture, cancel
+
+```python
+pay.refund(payment_id)                                   # full refund
+pay.refund(payment_id, amount=azn("10.00"))              # partial
+pay.capture(payment_id)                                  # after intent="authorize"
+pay.refund(payment_id, provider_ref=event.provider_ref)  # Azericard
+```
+
+## Errors
+
+Everything raises `manat.ManatError`. `error.code` is one of `invalid_request`, `invalid_signature`, `provider_error`,
+`network_error`, `unsupported_operation`; `provider_code`, `provider_message` and `raw` hold what the provider said.
+
+## Tests
+
+```bash
+cd python && PYTHONPATH=src:tests python3 -m unittest discover -s tests
+```

keytd_manat-0.1.0/src/keytd_manat.egg-info/SOURCES.txt

@@ -0,0 +1,26 @@
+LICENSE
+README.md
+pyproject.toml
+src/keytd_manat.egg-info/PKG-INFO
+src/keytd_manat.egg-info/SOURCES.txt
+src/keytd_manat.egg-info/dependency_links.txt
+src/keytd_manat.egg-info/top_level.txt
+src/manat/__init__.py
+src/manat/_crypto.py
+src/manat/_form.py
+src/manat/_http.py
+src/manat/_json.py
+src/manat/_values.py
+src/manat/client.py
+src/manat/errors.py
+src/manat/money.py
+src/manat/types.py
+src/manat/providers/__init__.py
+src/manat/providers/azericard.py
+src/manat/providers/epoint.py
+src/manat/providers/goldenpay.py
+src/manat/providers/kapitalbank.py
+src/manat/providers/payriff.py
+src/manat/providers/yigim.py
+tests/test_units.py
+tests/test_vectors.py

keytd_manat-0.1.0/src/keytd_manat.egg-info/dependency_links.txt

@@ -0,0 +1 @@
+

keytd_manat-0.1.0/src/keytd_manat.egg-info/top_level.txt

@@ -0,0 +1 @@
+manat

keytd_manat-0.1.0/src/manat/__init__.py

@@ -0,0 +1,12 @@
+"""One API for Azerbaijani online payment providers."""
+
+from .client import Manat
+from .errors import ManatError, is_manat_error
+from .money import Money, azn, from_decimal
+from .types import CreatePaymentResult, IncomingCallback, NextAction, PaymentEvent, PaymentState, RefundResult
+
+__all__ = [
+    "Manat", "ManatError", "is_manat_error", "Money", "azn", "from_decimal",
+    "CreatePaymentResult", "IncomingCallback", "NextAction", "PaymentEvent", "PaymentState", "RefundResult",
+]
+__version__ = "0.1.0"

keytd_manat-0.1.0/src/manat/_crypto.py

@@ -0,0 +1,174 @@
+"""Hashes, constant-time comparison and RSA-SHA256 (PKCS#1 v1.5) on the standard library alone."""
+
+from __future__ import annotations
+
+import base64
+import hashlib
+import hmac
+import math
+import re
+import secrets
+from dataclasses import dataclass
+from typing import List, Optional, Tuple
+
+_PEM = re.compile(r"-----BEGIN ([A-Z0-9 ]+)-----([A-Za-z0-9+/=\s]+)-----END \1-----")
+# DigestInfo prefix for SHA-256 (RFC 8017, section 9.2).
+_SHA256_PREFIX = bytes.fromhex("3031300d060960864801650304020105000420")
+
+
+def md5_hex(text: str) -> str:
+    return hashlib.md5(text.encode("utf-8")).hexdigest()
+
+
+def sha1_base64(text: str) -> str:
+    return base64.b64encode(hashlib.sha1(text.encode("utf-8")).digest()).decode("ascii")
+
+
+def safe_equals(actual: Optional[str], expected: str) -> bool:
+    return isinstance(actual, str) and hmac.compare_digest(actual.encode("utf-8"), expected.encode("utf-8"))
+
+
+@dataclass(frozen=True)
+class RsaPublicKey:
+    n: int
+    e: int
+
+    @property
+    def bits(self) -> int:
+        return self.n.bit_length()
+
+    def verify_sha256(self, text: str, signature: bytes) -> bool:
+        k = (self.n.bit_length() + 7) // 8
+        if len(signature) != k:
+            return False
+        s = int.from_bytes(signature, "big")
+        if s >= self.n:
+            return False
+        return hmac.compare_digest(pow(s, self.e, self.n).to_bytes(k, "big"), _encode(text, k))
+
+
+@dataclass(frozen=True)
+class RsaPrivateKey:
+    n: int
+    e: int
+    d: int
+
+    @property
+    def bits(self) -> int:
+        return self.n.bit_length()
+
+    def sign_sha256(self, text: str) -> bytes:
+        k = (self.n.bit_length() + 7) // 8
+        m = int.from_bytes(_encode(text, k), "big")
+        # Blinding keeps the private-key exponentiation's timing independent of the message.
+        while True:
+            r = secrets.randbelow(self.n - 2) + 2
+            if math.gcd(r, self.n) == 1:
+                break
+        blinded = pow(m * pow(r, self.e, self.n) % self.n, self.d, self.n)
+        return (blinded * pow(r, -1, self.n) % self.n).to_bytes(k, "big")
+
+
+def private_key(pem: str) -> RsaPrivateKey:
+    label, der = _block(pem)
+    if label == "RSA PRIVATE KEY":
+        return _rsa_private(der)
+    if label == "PRIVATE KEY":
+        # PrivateKeyInfo { version, AlgorithmIdentifier, OCTET STRING { RSAPrivateKey } }
+        info = _Der(_Der(der).read(0x30))
+        info.read(0x02)
+        info.read(0x30)
+        return _rsa_private(info.read(0x04))
+    raise ValueError(f'unsupported PEM block "{label}" (encrypted keys are not supported)')
+
+
+def public_key(pem: str) -> RsaPublicKey:
+    label, der = _block(pem)
+    if label == "RSA PUBLIC KEY":
+        return _rsa_public(der)
+    if label == "PUBLIC KEY":
+        return _spki(der)
+    if label == "CERTIFICATE":
+        # Certificate { TBSCertificate { [0] version?, serial, signature, issuer, validity, subject, spki, … }, … }
+        tbs = _Der(_Der(_Der(der).read(0x30)).read(0x30))
+        if tbs.peek() == 0xA0:
+            tbs.read(0xA0)
+        for tag in (0x02, 0x30, 0x30, 0x30, 0x30):
+            tbs.read(tag)
+        return _spki(_wrap(0x30, tbs.read(0x30)))
+    raise ValueError(f'unsupported PEM block "{label}"')
+
+
+def _encode(text: str, k: int) -> bytes:
+    """EMSA-PKCS1-v1_5: 00 01 FF…FF 00 DigestInfo(SHA-256)."""
+    t = _SHA256_PREFIX + hashlib.sha256(text.encode("utf-8")).digest()
+    if k < len(t) + 11:
+        raise ValueError("key too short")
+    return b"\x00\x01" + b"\xff" * (k - len(t) - 3) + b"\x00" + t
+
+
+def _block(pem: str) -> Tuple[str, bytes]:
+    match = _PEM.search(pem or "")
+    if not match:
+        raise ValueError("not a PEM key")
+    return match.group(1), base64.b64decode(re.sub(r"\s", "", match.group(2)), validate=True)
+
+
+def _rsa_private(der: bytes) -> RsaPrivateKey:
+    key = _Der(_Der(der).read(0x30))
+    key.read(0x02)  # version
+    n, e, d = (int.from_bytes(key.read(0x02), "big") for _ in range(3))
+    return RsaPrivateKey(n, e, d)
+
+
+def _rsa_public(der: bytes) -> RsaPublicKey:
+    key = _Der(_Der(der).read(0x30))
+    n, e = (int.from_bytes(key.read(0x02), "big") for _ in range(2))
+    return RsaPublicKey(n, e)
+
+
+def _spki(der: bytes) -> RsaPublicKey:
+    # SubjectPublicKeyInfo { AlgorithmIdentifier, BIT STRING { 00, RSAPublicKey } }
+    info = _Der(_Der(der).read(0x30))
+    info.read(0x30)
+    return _rsa_public(info.read(0x03)[1:])
+
+
+def _wrap(tag: int, content: bytes) -> bytes:
+    length = len(content)
+    if length < 0x80:
+        return bytes([tag, length]) + content
+    size = (length.bit_length() + 7) // 8
+    return bytes([tag, 0x80 | size]) + length.to_bytes(size, "big") + content
+
+
+class _Der:
+    """Just enough DER reading for RSA keys."""
+
+    def __init__(self, data: bytes) -> None:
+        self.data = data
+        self.pos = 0
+
+    def peek(self) -> int:
+        return self.data[self.pos] if self.pos < len(self.data) else -1
+
+    def read(self, tag: int) -> bytes:
+        if self.peek() != tag:
+            raise ValueError(f"bad key: expected DER tag 0x{tag:02x}")
+        self.pos += 1
+        length = self.data[self.pos]
+        self.pos += 1
+        if length & 0x80:
+            count = length & 0x7F
+            if not 1 <= count <= 4:
+                raise ValueError("bad key: DER length")
+            length = int.from_bytes(self.data[self.pos:self.pos + count], "big")
+            self.pos += count
+        if self.pos + length > len(self.data):
+            raise ValueError("bad key: truncated")
+        value = self.data[self.pos:self.pos + length]
+        self.pos += length
+        return value
+
+
+__all__: List[str] = ["md5_hex", "sha1_base64", "safe_equals", "private_key", "public_key", "RsaPrivateKey", "RsaPublicKey"]

keytd_manat-0.1.0/src/manat/_form.py

@@ -0,0 +1,35 @@
+from __future__ import annotations
+
+from typing import Dict, Iterable, Mapping, Tuple, Union
+from urllib.parse import unquote_plus
+
+_SAFE = frozenset(b"abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789*-._")
+
+
+def encode(fields: Union[Mapping[str, str], Iterable[Tuple[str, str]]]) -> str:
+    """application/x-www-form-urlencoded, encoded like JavaScript's URLSearchParams."""
+    pairs = fields.items() if isinstance(fields, Mapping) else fields
+    return "&".join(f"{_escape(key)}={_escape(value)}" for key, value in pairs)
+
+
+def decode(body: str) -> Dict[str, str]:
+    """Later duplicates are ignored; malformed %-escapes are kept as text."""
+    out: Dict[str, str] = {}
+    for pair in (body or "").split("&"):
+        if not pair:
+            continue
+        key, _, value = pair.partition("=")
+        out.setdefault(unquote_plus(key), unquote_plus(value))
+    return out
+
+
+def _escape(text: str) -> str:
+    out = []
+    for byte in (text or "").encode("utf-8"):
+        if byte in _SAFE:
+            out.append(chr(byte))
+        elif byte == 0x20:
+            out.append("+")
+        else:
+            out.append(f"%{byte:02X}")
+    return "".join(out)

keytd_manat-0.1.0/src/manat/_http.py

@@ -0,0 +1,86 @@
+from __future__ import annotations
+
+import http.client
+import urllib.error
+import urllib.request
+from dataclasses import dataclass
+from typing import Any, Dict, Mapping, Optional, Protocol, Tuple
+
+from . import _form, _json
+from .errors import NETWORK_ERROR, ManatError
+
+
+@dataclass(frozen=True)
+class HttpResponse:
+    status: int
+    text: str
+
+
+class Transport(Protocol):
+    """Sends one request. Raise OSError (or http.client.HTTPException) on a network failure."""
+
+    def send(self, method: str, url: str, headers: Mapping[str, str], body: Optional[bytes], timeout: float) -> HttpResponse: ...
+
+
+class _NoRedirect(urllib.request.HTTPRedirectHandler):
+    def redirect_request(self, *args: Any, **kwargs: Any) -> None:
+        return None
+
+
+class UrllibTransport:
+    """Default transport on urllib: TLS verified, redirects not followed."""
+
+    def __init__(self) -> None:
+        self._opener = urllib.request.build_opener(_NoRedirect)
+
+    def send(self, method: str, url: str, headers: Mapping[str, str], body: Optional[bytes], timeout: float) -> HttpResponse:
+        request = urllib.request.Request(url, data=body, headers=dict(headers), method=method)
+        try:
+            with self._opener.open(request, timeout=timeout) as response:
+                return HttpResponse(response.status, _decode(response.read(), response.headers.get_content_charset()))
+        except urllib.error.HTTPError as error:
+            return HttpResponse(error.code, _decode(error.read(), error.headers.get_content_charset() if error.headers else None))
+
+
+class Http:
+    """Encodes bodies, applies the timeout and turns failures into ManatError for one adapter."""
+
+    def __init__(self, provider: str, transport: Optional[Transport], timeout: float) -> None:
+        self.provider = provider
+        self.transport: Transport = transport or UrllibTransport()
+        self.timeout = timeout
+
+    def send(self, method: str, url: str, headers: Optional[Mapping[str, str]] = None, json: Any = None,
+             form: Optional[Mapping[str, str]] = None) -> HttpResponse:
+        lower: Dict[str, str] = {name.lower(): value for name, value in (headers or {}).items()}
+        body: Optional[bytes] = None
+        if form is not None:
+            body = _form.encode(form).encode("utf-8")
+            lower.setdefault("content-type", "application/x-www-form-urlencoded")
+        elif json is not None:
+            body = _json.stringify(json).encode("utf-8")
+            lower.setdefault("content-type", "application/json")
+        try:
+            return self.transport.send(method, url, lower, body, self.timeout)
+        except ManatError:
+            raise
+        except (OSError, http.client.HTTPException) as error:
+            raise ManatError(NETWORK_ERROR, f"{self.provider}: {method} {url} {error}", provider=self.provider) from error
+
+    def json(self, method: str, url: str, headers: Optional[Mapping[str, str]] = None, json: Any = None,
+             form: Optional[Mapping[str, str]] = None) -> Tuple[int, Any]:
+        response = self.send(method, url, {"accept": "application/json", **{k.lower(): v for k, v in (headers or {}).items()}}, json, form)
+        if not response.text:
+            return response.status, None
+        try:
+            return response.status, _json.parse(response.text)
+        except ValueError as error:
+            raise ManatError(NETWORK_ERROR, f'{self.provider}: expected JSON, got HTTP {response.status} "{response.text[:200]}"',
+                             provider=self.provider, raw=response.text) from error
+
+
+def _decode(data: bytes, charset: Optional[str]) -> str:
+    try:
+        return data.decode(charset or "utf-8")
+    except (LookupError, UnicodeDecodeError):
+        return data.decode("utf-8", errors="replace")