@zktx.io/sui-mcp 0.5.0

package/dist/core/action/suiChainReceiptEvidence.js

@@ -0,0 +1,106 @@
+import { z } from "zod";
+import { makeSignedRawIntegerStringSchema, parseSignedRawInteger } from "../numeric/rawU64.js";
+import { normalizeCoinType } from "../read/coinMetadata.js";
+import { suiAddressStringSchema, suiTransactionDigestSchema } from "../suiAddress.js";
+export const SUI_CHAIN_RECEIPT_REQUIRED_INCLUDE = [
+    "transaction",
+    "effects",
+    "balanceChanges",
+    "objectTypes"
+];
+const isoUtcStringSchema = z.string().refine((value) => {
+    const parsed = new Date(value);
+    return Number.isFinite(parsed.getTime()) && parsed.toISOString() === value;
+}, "Expected ISO 8601 UTC timestamp");
+const suiChainReceiptIncludeFieldSchema = z.enum(SUI_CHAIN_RECEIPT_REQUIRED_INCLUDE);
+const suiChainReceiptIncludeSchema = z.array(suiChainReceiptIncludeFieldSchema)
+    .length(SUI_CHAIN_RECEIPT_REQUIRED_INCLUDE.length)
+    .superRefine((include, ctx) => {
+    for (const field of SUI_CHAIN_RECEIPT_REQUIRED_INCLUDE) {
+        if (!include.includes(field)) {
+            ctx.addIssue({
+                code: "custom",
+                path: [],
+                message: `chain receipt include is missing '${field}'`
+            });
+        }
+    }
+    if (new Set(include).size !== include.length) {
+        ctx.addIssue({
+            code: "custom",
+            path: [],
+            message: "chain receipt include fields must not be duplicated"
+        });
+    }
+});
+const coinTypeSchema = z.string().min(1).max(512).refine((value) => {
+    try {
+        normalizeCoinType(value);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}, "Expected a Sui struct tag coin type");
+const suiChainReceiptPackageCallSchema = z.object({
+    commandIndex: z.number().int().nonnegative(),
+    packageId: suiAddressStringSchema,
+    module: z.string().min(1).max(128),
+    function: z.string().min(1).max(128),
+    target: z.string().min(1).max(512)
+}).strict().superRefine((call, ctx) => {
+    const expectedTarget = `${call.packageId}::${call.module}::${call.function}`;
+    if (call.target !== expectedTarget) {
+        ctx.addIssue({
+            code: "custom",
+            path: ["target"],
+            message: "package call target must match packageId::module::function"
+        });
+    }
+});
+const suiChainReceiptAccountBalanceChangeSchema = z.object({
+    index: z.number().int().nonnegative(),
+    coinType: coinTypeSchema,
+    amountRaw: makeSignedRawIntegerStringSchema("accountBalanceChanges[].amountRaw"),
+    direction: z.enum(["increase", "decrease", "zero"])
+}).strict().superRefine((change, ctx) => {
+    const amount = parseSignedRawInteger(change.amountRaw, "accountBalanceChanges[].amountRaw");
+    const direction = amount > 0n ? "increase" :
+        amount < 0n ? "decrease" :
+            "zero";
+    if (change.direction !== direction) {
+        ctx.addIssue({
+            code: "custom",
+            path: ["direction"],
+            message: "balance change direction must match amountRaw sign"
+        });
+    }
+});
+const suiChainReceiptEffectsStatusSchema = z.discriminatedUnion("success", [
+    z.object({
+        success: z.literal(true),
+        errorKind: z.never().optional(),
+        errorMessage: z.never().optional()
+    }).strict(),
+    z.object({
+        success: z.literal(false),
+        errorKind: z.string().min(1).max(200).optional(),
+        errorMessage: z.string().min(1).max(2000).optional()
+    }).strict()
+]);
+export const suiChainReceiptEvidenceSchema = z.object({
+    kind: z.literal("sui_chain_receipt_v1"),
+    source: z.object({
+        method: z.literal("client.core.getTransaction"),
+        network: z.literal("sui:mainnet"),
+        chainIdentifier: z.string().min(1),
+        fetchedAt: isoUtcStringSchema,
+        include: suiChainReceiptIncludeSchema
+    }).strict(),
+    txDigest: suiTransactionDigestSchema,
+    sender: suiAddressStringSchema,
+    effectsStatus: suiChainReceiptEffectsStatusSchema,
+    packageCalls: z.array(suiChainReceiptPackageCallSchema),
+    accountBalanceChanges: z.array(suiChainReceiptAccountBalanceChangeSchema),
+    objectTypes: z.record(suiAddressStringSchema, z.string().min(1).max(512))
+}).strict();

package/dist/core/action/suiChainReceiptMapping.js

@@ -0,0 +1,107 @@
+import { parseSuiAddress } from "../suiAddress.js";
+// Shared, pure mappers from the SDK getTransaction result to chain-receipt facts.
+// Both the session-bound verifier (suiChainReceiptVerifier.ts) and the public
+// receipt reader (suiChainReceiptReader.ts) use these so the effects-status,
+// Move-call, and object-type shapes are mapped in one place. Balance changes are
+// not here because the verifier filters them to the reviewed account while the
+// public reader keeps them all, so each owns its own balance mapper.
+export function effectsStatusFromSdk(status) {
+    if (status.success) {
+        return { success: true };
+    }
+    const error = status.error;
+    const errorKind = typeof error === "object" && error !== null && typeof error.$kind === "string"
+        ? error.$kind.slice(0, 200)
+        : undefined;
+    const errorMessage = typeof error === "object" && error !== null && typeof error.message === "string" && error.message.length > 0
+        ? error.message.slice(0, 2000)
+        : undefined;
+    return {
+        success: false,
+        ...(errorKind === undefined ? {} : { errorKind }),
+        ...(errorMessage === undefined ? {} : { errorMessage })
+    };
+}
+export function packageCallsFromTransaction(transaction) {
+    return transaction.commands.flatMap((command, commandIndex) => {
+        const moveCall = moveCallFromCommand(command);
+        if (!moveCall) {
+            return [];
+        }
+        const packageId = parseSuiAddress(moveCall.package);
+        if (!packageId) {
+            throw new Error("Sui mainnet receipt contains a Move call with an invalid package id.");
+        }
+        return [
+            {
+                commandIndex,
+                packageId,
+                module: moveCall.module,
+                function: moveCall.function,
+                target: `${packageId}::${moveCall.module}::${moveCall.function}`
+            }
+        ];
+    });
+}
+export function objectTypesFromSdk(objectTypes) {
+    return Object.fromEntries(Object.entries(objectTypes).map(([objectId, objectType]) => {
+        const normalizedObjectId = parseSuiAddress(objectId);
+        if (!normalizedObjectId) {
+            throw new Error("Sui mainnet receipt contains an invalid object id in objectTypes.");
+        }
+        return [normalizedObjectId, objectType];
+    }));
+}
+// Fail-closed address parsing for receipt facts. Both the verifier and the
+// public reader turn a raw chain address into a receipt address ONLY through
+// this helper, so neither path can silently drop or null out a balance-change
+// address or sender when the SDK payload is not the expected shape. A malformed
+// address throws; callers map the throw to a fail-closed receipt outcome rather
+// than returning partial facts.
+export function requireReceiptAddress(rawAddress, errorMessage) {
+    const address = rawAddress === null || rawAddress === undefined ? undefined : parseSuiAddress(rawAddress);
+    if (!address) {
+        throw new Error(errorMessage);
+    }
+    return address;
+}
+// Shared error classification for the getTransaction read, used by both the
+// verifier and the public reader so a "transaction not found" is recognized one
+// way everywhere.
+export function isReceiptNotFoundError(error) {
+    const code = typeof error === "object" && error !== null
+        ? (error.code ?? error.status)
+        : undefined;
+    if (code === "NOT_FOUND" || code === "NotFound" || code === "NOT_FOUND_ERROR" || code === 5) {
+        return true;
+    }
+    // Only genuine "this digest does not exist / is not indexed" signals map to
+    // not_found. Availability/outage phrasing (e.g. "service not available") is a
+    // provider failure and must stay an `unavailable` (502), not a 404.
+    return /\b(not found|not indexed|could not find|unable to find|no transaction)\b/i.test(receiptErrorMessage(error, ""));
+}
+export function receiptErrorMessage(error, fallback) {
+    if (error instanceof Error) {
+        return error.message || fallback;
+    }
+    if (typeof error === "string") {
+        return error || fallback;
+    }
+    if (typeof error === "object" && error !== null) {
+        const message = error.message;
+        if (typeof message === "string" && message.length > 0) {
+            return message;
+        }
+    }
+    return fallback;
+}
+function moveCallFromCommand(command) {
+    const maybeCommand = command;
+    if (!maybeCommand.MoveCall) {
+        return undefined;
+    }
+    if (maybeCommand.$kind !== undefined && maybeCommand.$kind !== "MoveCall") {
+        return undefined;
+    }
+    return maybeCommand.MoveCall;
+}

package/dist/core/action/suiChainReceiptReader.js

@@ -0,0 +1,211 @@
+import { readCoinReservation } from "./transactionFunding.js";
+import { normalizeCoinType } from "../read/coinMetadata.js";
+import { suiTransactionDigestSchema } from "../suiAddress.js";
+import { receiptPtbMermaid } from "./receiptPtbGraph.js";
+import { effectsStatusFromSdk, isReceiptNotFoundError, objectTypesFromSdk, packageCallsFromTransaction, receiptErrorMessage, requireReceiptAddress } from "./suiChainReceiptMapping.js";
+import { SUI_CHAIN_RECEIPT_REQUIRED_INCLUDE } from "./suiChainReceiptEvidence.js";
+const PUBLIC_RECEIPT_INCLUDE = {
+    ...Object.fromEntries(SUI_CHAIN_RECEIPT_REQUIRED_INCLUDE.map((field) => [field, true])),
+    events: true
+};
+export async function readPublicChainReceipt(options, input) {
+    const digest = suiTransactionDigestSchema.safeParse(input.digest);
+    if (!digest.success) {
+        return { status: "invalid_digest" };
+    }
+    if (options.network !== "mainnet") {
+        return { status: "unavailable", message: "Receipt reads require a verified Sui mainnet endpoint." };
+    }
+    let chainIdentifier;
+    try {
+        chainIdentifier = (await options.client.core.getChainIdentifier()).chainIdentifier;
+    }
+    catch (error) {
+        return { status: "unavailable", message: receiptErrorMessage(error, "Sui mainnet chain identifier lookup failed.") };
+    }
+    if (chainIdentifier !== options.expectedChainIdentifier) {
+        return { status: "unavailable", message: "Receipt reads require a verified Sui mainnet endpoint." };
+    }
+    let result;
+    try {
+        result = await options.client.core.getTransaction({ digest: digest.data, include: PUBLIC_RECEIPT_INCLUDE });
+    }
+    catch (error) {
+        if (isReceiptNotFoundError(error)) {
+            return { status: "not_found" };
+        }
+        return { status: "unavailable", message: receiptErrorMessage(error, "Sui mainnet transaction lookup failed.") };
+    }
+    const transaction = result.$kind === "Transaction" ? result.Transaction : result.FailedTransaction;
+    const transactionData = transaction.transaction;
+    const effects = transaction.effects;
+    if (!transactionData || !effects || !transaction.balanceChanges || !transaction.objectTypes) {
+        return { status: "unavailable", message: "Sui mainnet receipt is missing required fields." };
+    }
+    // Build receipt facts fail-closed: any malformed field (sender, Move calls,
+    // balance-change address, object id) throws inside this block and maps to an
+    // `unavailable` outcome, so the public receipt is never returned with silently
+    // dropped or nulled facts and the mappers can never crash the request. The PTB
+    // graph is best-effort and falls back to undefined (placeholder shown), so it is
+    // produced outside this block and never fails the receipt.
+    let receipt;
+    try {
+        receipt = {
+            txDigest: transaction.digest,
+            // A present-but-unparseable sender is a malformed payload and fails closed.
+            // An absent sender is legitimate for some system transactions, so it maps
+            // to undefined. The account-bound verifier instead requires a sender
+            // because it must match the reviewed account.
+            sender: transactionData.sender === null || transactionData.sender === undefined
+                ? undefined
+                : requireReceiptAddress(transactionData.sender, "Sui mainnet receipt has an unparseable sender address."),
+            effectsStatus: effectsStatusFromSdk(effects.status),
+            packageCalls: packageCallsFromTransaction(transactionData),
+            balanceChanges: balanceChangesFromSdk(transaction.balanceChanges),
+            objectTypes: objectTypesFromSdk(transaction.objectTypes),
+            gas: gasFromSdk(effects.gasUsed, transactionData.gasData),
+            inputs: inputsFromSdk(transactionData.inputs ?? []),
+            events: eventsFromSdk(transaction.events ?? []),
+            ptbGraph: ptbGraphFromTransaction(transactionData),
+            chainIdentifier,
+            fetchedAt: input.now.toISOString()
+        };
+    }
+    catch (error) {
+        return {
+            status: "unavailable",
+            message: receiptErrorMessage(error, "Sui mainnet receipt could not be read as expected facts.")
+        };
+    }
+    // Best-effort decimals enrichment: resolved outside the fail-closed block so a
+    // coin-metadata miss or outage leaves the balance change on its raw amount and
+    // never turns a readable receipt into an error.
+    if (options.resolveCoinUnit && receipt.balanceChanges.length > 0) {
+        receipt = { ...receipt, balanceChanges: await withCoinDecimals(receipt.balanceChanges, options.resolveCoinUnit) };
+    }
+    return { status: "found", receipt };
+}
+async function withCoinDecimals(changes, resolveCoinUnit) {
+    const units = new Map();
+    await Promise.all([...new Set(changes.map((change) => change.coinType))].map(async (coinType) => {
+        try {
+            units.set(coinType, await resolveCoinUnit(coinType));
+        }
+        catch {
+            // Best-effort only: leave the coin without decimals.
+        }
+    }));
+    return changes.map((change) => {
+        const unit = units.get(change.coinType);
+        return unit && unit.status === "available"
+            ? { ...change, decimals: unit.decimals, symbol: unit.symbol }
+            : change;
+    });
+}
+function balanceChangesFromSdk(balanceChanges) {
+    return balanceChanges.map((change, index) => {
+        const address = requireReceiptAddress(change.address, "Sui mainnet receipt contains a balance change with an invalid address.");
+        const amount = BigInt(change.amount);
+        return {
+            index,
+            address,
+            coinType: normalizeCoinType(change.coinType),
+            amountRaw: amount.toString(),
+            direction: amount > 0n ? "increase" : amount < 0n ? "decrease" : "zero"
+        };
+    });
+}
+function gasFromSdk(gasUsed, gasData) {
+    const computation = BigInt(gasUsed.computationCost);
+    const storage = BigInt(gasUsed.storageCost);
+    const rebate = BigInt(gasUsed.storageRebate);
+    return {
+        totalMist: (computation + storage - rebate).toString(),
+        computationMist: computation.toString(),
+        storageMist: storage.toString(),
+        storageRebateMist: rebate.toString(),
+        nonRefundableStorageMist: BigInt(gasUsed.nonRefundableStorageFee).toString(),
+        budgetMist: gasData?.budget === null || gasData?.budget === undefined ? undefined : BigInt(gasData.budget).toString(),
+        priceMist: gasData?.price === null || gasData?.price === undefined ? undefined : BigInt(gasData.price).toString(),
+        paymentObjectId: firstPaymentObjectId(gasData)
+    };
+}
+function firstPaymentObjectId(gasData) {
+    const payment = gasData?.payment;
+    if (!Array.isArray(payment) || payment.length === 0) {
+        return undefined;
+    }
+    for (const item of payment) {
+        const ref = asRecord(item);
+        if (typeof ref?.objectId !== "string" || typeof ref.digest !== "string")
+            continue;
+        try {
+            if (!readCoinReservation(ref.digest))
+                return ref.objectId;
+        }
+        catch { /* Invalid refs do not establish gas object facts. */ }
+    }
+    return undefined;
+}
+// PTB inputs, simplified to a kind and (for object inputs) an object id. The exact
+// SDK enum shape is read defensively so a shape change degrades to `unknown`
+// rather than throwing.
+function inputsFromSdk(inputs) {
+    return inputs.map((raw, index) => {
+        const input = asRecord(raw);
+        if (input) {
+            if ("Object" in input) {
+                const object = asRecord(input.Object);
+                const variant = asRecord(object?.ImmOrOwnedObject) ?? asRecord(object?.SharedObject) ?? asRecord(object?.Receiving) ?? object;
+                const objectId = typeof variant?.objectId === "string" ? variant.objectId : undefined;
+                const kind = object && "SharedObject" in object ? "shared_object" : object && "Receiving" in object ? "receiving" : "object";
+                return { index, kind, objectId };
+            }
+            if ("UnresolvedObject" in input) {
+                const object = asRecord(input.UnresolvedObject);
+                return { index, kind: "object", objectId: typeof object?.objectId === "string" ? object.objectId : undefined };
+            }
+            if ("Pure" in input || "UnresolvedPure" in input) {
+                const pure = asRecord(input.Pure) ?? asRecord(input.UnresolvedPure);
+                const bytes = pureBytesToHex(pure?.bytes);
+                return bytes === undefined
+                    ? { index, kind: "pure", objectId: undefined }
+                    : { index, kind: "pure", objectId: undefined, bytes };
+            }
+            if ("FundsWithdrawal" in input) {
+                return { index, kind: "withdrawal", objectId: undefined };
+            }
+        }
+        return { index, kind: "unknown", objectId: undefined };
+    });
+}
+function eventsFromSdk(events) {
+    return events.map((event, index) => ({
+        index,
+        packageId: event.packageId,
+        module: event.module,
+        eventType: event.eventType,
+        sender: event.sender
+    }));
+}
+function ptbGraphFromTransaction(transactionData) {
+    const mermaid = receiptPtbMermaid({ inputs: transactionData.inputs, commands: transactionData.commands });
+    return mermaid === undefined ? undefined : { mermaid };
+}
+function asRecord(value) {
+    return typeof value === "object" && value !== null ? value : undefined;
+}
+// A pure input's bytes arrive base64-encoded; surface them as 0x-hex (the
+// convention used elsewhere in the UI). Returns undefined for an absent or
+// non-string value so the input simply carries no bytes.
+function pureBytesToHex(value) {
+    if (typeof value !== "string" || value.length === 0) {
+        return undefined;
+    }
+    try {
+        return `0x${Buffer.from(value, "base64").toString("hex")}`;
+    }
+    catch {
+        return undefined;
+    }
+}

package/dist/core/action/suiChainReceiptVerifier.js

@@ -0,0 +1,178 @@
+import { assertNoForbiddenMcpFields } from "./forbiddenFields.js";
+import { SUI_CHAIN_RECEIPT_REQUIRED_INCLUDE, suiChainReceiptEvidenceSchema } from "./suiChainReceiptEvidence.js";
+import { normalizeCoinType } from "../read/coinMetadata.js";
+import { parseSuiAddress, suiTransactionDigestSchema } from "../suiAddress.js";
+import { effectsStatusFromSdk, isReceiptNotFoundError, objectTypesFromSdk, packageCallsFromTransaction, receiptErrorMessage, requireReceiptAddress } from "./suiChainReceiptMapping.js";
+export const SUI_CHAIN_RECEIPT_GET_TRANSACTION_INCLUDE = includeObjectFromFields(SUI_CHAIN_RECEIPT_REQUIRED_INCLUDE);
+// Bounded per-read wait for the known digest to become visible on this node.
+// This existing 12-second source-read window is independent of the backend's
+// 10-minute initial observation deadline. A missing receipt does not establish
+// whether a prior submit (including one with a lost reply) executed.
+export const SUI_CHAIN_RECEIPT_WAIT_TIMEOUT_MS = 12_000;
+// waitForTransaction aborts with a DOMException named "TimeoutError" when its wait window elapses.
+// Treat that exactly like not_found — the transaction is simply not readable here yet — so the
+// session stays pending for a retry rather than being marked a verification failure.
+function isWaitTimeoutError(error) {
+    return typeof error === "object" && error !== null && error.name === "TimeoutError";
+}
+export async function verifySuiChainReceipt(options, input) {
+    const parsedInput = parseVerifierInput(input);
+    if (!parsedInput.ok) {
+        return verificationFailed(parsedInput.message);
+    }
+    if (options.network !== "mainnet") {
+        return verificationFailed("Chain receipt verification requires a verified Sui mainnet endpoint.");
+    }
+    let chainIdentifier;
+    try {
+        const chainIdentifierResult = await options.client.core.getChainIdentifier();
+        chainIdentifier = chainIdentifierResult.chainIdentifier;
+    }
+    catch (error) {
+        return verificationFailed(receiptErrorMessage(error, "Sui mainnet chain identifier lookup failed."));
+    }
+    if (chainIdentifier !== options.expectedChainIdentifier) {
+        return verificationFailed("Chain receipt verification requires a verified Sui mainnet endpoint.");
+    }
+    let result;
+    try {
+        // The signed transaction was just submitted: it is on chain but may not yet be queryable on
+        // this server's fullnode (checkpoint-propagation lag). Wait for it instead of returning a
+        // premature not_found, so a single review-page poll resolves straight to the final receipt.
+        result = await options.client.core.waitForTransaction({
+            digest: parsedInput.txDigest,
+            include: SUI_CHAIN_RECEIPT_GET_TRANSACTION_INCLUDE,
+            timeout: SUI_CHAIN_RECEIPT_WAIT_TIMEOUT_MS
+        });
+    }
+    catch (error) {
+        if (isReceiptNotFoundError(error) || isWaitTimeoutError(error)) {
+            return {
+                status: "not_found",
+                failureReason: "chain_receipt_unavailable",
+                message: "Sui mainnet did not return a transaction for the signed digest within the wait window."
+            };
+        }
+        return verificationFailed(receiptErrorMessage(error, "Sui mainnet transaction lookup failed."));
+    }
+    try {
+        const transaction = result.$kind === "Transaction" ? result.Transaction : result.FailedTransaction;
+        const receipt = createSuiChainReceiptEvidenceFromTransaction({
+            transaction,
+            txDigest: parsedInput.txDigest,
+            reviewedTransactionDigest: parsedInput.reviewedTransactionDigest,
+            account: parsedInput.account,
+            chainIdentifier,
+            fetchedAt: parsedInput.now
+        });
+        if (!receipt.effectsStatus.success) {
+            return {
+                status: "verified_failure",
+                failureReason: "chain_execution_failed",
+                message: "Sui mainnet verified the transaction receipt and reported failed execution effects.",
+                receipt
+            };
+        }
+        return { status: "verified_success", receipt };
+    }
+    catch (error) {
+        return verificationFailed(receiptErrorMessage(error, "Sui mainnet transaction receipt could not be verified."));
+    }
+}
+function includeObjectFromFields(fields) {
+    return Object.fromEntries(fields.map((field) => [field, true]));
+}
+function parseVerifierInput(input) {
+    if (!(input.now instanceof Date) || !Number.isFinite(input.now.getTime())) {
+        return { ok: false, message: "Chain receipt fetchedAt time must be a valid Date." };
+    }
+    const txDigest = suiTransactionDigestSchema.safeParse(input.txDigest);
+    if (!txDigest.success) {
+        return { ok: false, message: "Signed transaction digest is not a valid Sui transaction digest." };
+    }
+    const reviewedTransactionDigest = suiTransactionDigestSchema.safeParse(input.reviewedTransactionDigest);
+    if (!reviewedTransactionDigest.success) {
+        return { ok: false, message: "Reviewed transaction digest is not a valid Sui transaction digest." };
+    }
+    const account = parseSuiAddress(input.account);
+    if (!account) {
+        return { ok: false, message: "Reviewed account is not a valid Sui address." };
+    }
+    return {
+        ok: true,
+        txDigest: txDigest.data,
+        reviewedTransactionDigest: reviewedTransactionDigest.data,
+        account,
+        now: input.now
+    };
+}
+function createSuiChainReceiptEvidenceFromTransaction(input) {
+    if (input.txDigest !== input.reviewedTransactionDigest) {
+        throw new Error("Signed transaction digest does not match the reviewed transaction digest.");
+    }
+    if (input.transaction.digest !== input.txDigest) {
+        throw new Error("Sui mainnet returned a transaction digest that does not match the signed digest.");
+    }
+    const transactionData = input.transaction.transaction;
+    if (!transactionData) {
+        throw new Error("Sui mainnet receipt is missing parsed transaction data.");
+    }
+    const effects = input.transaction.effects;
+    if (!effects) {
+        throw new Error("Sui mainnet receipt is missing transaction effects.");
+    }
+    if (effects.transactionDigest !== input.txDigest) {
+        throw new Error("Sui mainnet receipt effects digest does not match the signed digest.");
+    }
+    const sender = requireReceiptAddress(transactionData.sender, "Sui mainnet receipt is missing a valid sender.");
+    if (sender !== input.account) {
+        throw new Error("Sui mainnet receipt sender does not match the reviewed account.");
+    }
+    if (!input.transaction.balanceChanges) {
+        throw new Error("Sui mainnet receipt is missing balance changes.");
+    }
+    if (!input.transaction.objectTypes) {
+        throw new Error("Sui mainnet receipt is missing object type map.");
+    }
+    const receipt = {
+        kind: "sui_chain_receipt_v1",
+        source: {
+            method: "client.core.getTransaction",
+            network: "sui:mainnet",
+            chainIdentifier: input.chainIdentifier,
+            fetchedAt: input.fetchedAt.toISOString(),
+            include: [...SUI_CHAIN_RECEIPT_REQUIRED_INCLUDE]
+        },
+        txDigest: input.txDigest,
+        sender,
+        effectsStatus: effectsStatusFromSdk(effects.status),
+        packageCalls: packageCallsFromTransaction(transactionData),
+        accountBalanceChanges: accountBalanceChangesFromSdk(input.transaction.balanceChanges, input.account),
+        objectTypes: objectTypesFromSdk(input.transaction.objectTypes)
+    };
+    const parsed = suiChainReceiptEvidenceSchema.parse(receipt);
+    assertNoForbiddenMcpFields(parsed);
+    return parsed;
+}
+function accountBalanceChangesFromSdk(balanceChanges, account) {
+    return balanceChanges.flatMap((change, index) => {
+        const address = requireReceiptAddress(change.address, "Sui mainnet receipt contains a balance change with an invalid address.");
+        if (address !== account) {
+            return [];
+        }
+        const amount = BigInt(change.amount);
+        return [{
+                index,
+                coinType: normalizeCoinType(change.coinType),
+                amountRaw: amount.toString(),
+                direction: amount > 0n ? "increase" : amount < 0n ? "decrease" : "zero"
+            }];
+    });
+}
+function verificationFailed(message) {
+    return {
+        status: "verification_failed",
+        failureReason: "receipt_verification_failed",
+        message
+    };
+}