"""
Path Proof receipt replay/forgery gate.

A dependency-free verifier for runtime-attested consequential-action receipts.
See ``docs/path-proof-receipt.md`` for the threat model and field rationale.

Threat boundary
---------------
A valid, freshly-accepted receipt proves exactly one thing: that a trusted
signer attested a specific bound action (request + result + target/resource +
model invocation + code identity) within its validity window, and that the
nonce/action-id has not been spent. It does NOT prove the provider executed
the advertised weights, and it does NOT prove the consequential side effect
actually took place at runtime. Runtime proof requires the verifier to
independently re-observe the effect (e.g. read Gitea state back and compare
``result_sha256``). Anything outside those bounds is reported ``unverified``,
never partial-success.

Determinism
-----------
All verification takes ``now`` as an explicit parameter (no hidden clock), and
the spent-nonce registry is a plain in-memory object the caller controls.
There is no I/O, no randomness, and no network in this module.
"""

from . import keys
from .keys import SignerKey
from .receipt import (
    SPEND_KIND_NONCE,
    SPEND_KIND_ACTION_ID,
    SpendRecord,
    SpentRegistry,
    canonical_json,
    build_receipt,
    receipt_payload,
    verify_receipt,
    verify_and_accept,
)

__all__ = [
    "SPEND_KIND_NONCE",
    "SPEND_KIND_ACTION_ID",
    "SignerKey",
    "SpendRecord",
    "SpentRegistry",
    "canonical_json",
    "build_receipt",
    "receipt_payload",
    "verify_receipt",
    "verify_and_accept",
    "keys",
]