Extract reusable governance helpers from the e2e upgrade flow

Most of upgrade_flow.rs was either generic proposal-flow plumbing or
upgrade-specific PTB construction — neither of which needs to live in
the test crate. Pulls the non-test pieces into the hashi crate so both
the e2e harness and the CLI can share them.

New `hashi::cli::upgrade` module with:
  - build_upgrade_package — wraps `sui move build --dump-bytecode-as-base64`
    and parses the output into a Publish + digest.
  - build_upgrade_execution_transaction — constructs the
    `execute + publish + finalize` PTB the upgrade proposal requires.
  - build_execute_proposal_transaction — generic non-upgrade proposal
    execution; takes execute_package_id separately so post-upgrade
    disable_version still routes through the new package.
  - extract_proposal_id_from_response — parse ProposalCreatedEvent.
  - extract_new_package_id_from_response — find the new package in the
    upgrade tx effects.

In `hashi::cli::client`:
  - Replace the UpdateConfig-specific build_vote_update_config_transaction
    / build_execute_update_config_transaction with a generic standalone
    build_vote_transaction. HashiClient::build_vote_transaction now
    delegates to it, removing the duplicate PTB construction.

The e2e `upgrade_flow.rs` and the TestNetworksBuilder on-chain config
override flow now go through these helpers, which drops ~300 lines of
duplicated PTB boilerplate and inline event parsing.

No behaviour change; no new CLI commands are wired up yet. Follow-up
work on the cli-governance-improvements branch will add pre-flight
checks (version +1 enforcement, quorum readiness, etc.) and an
execute-upgrade CLI command that uses these helpers.

Author: Bridgerz

crates/e2e-tests/src/lib.rs

@@ -277,9 +277,13 @@ async fn apply_onchain_config_overrides(
 ) -> Result<()> {
     use hashi::cli::client::CreateProposalParams;
     use hashi::cli::client::build_create_proposal_transaction;
-    use hashi::cli::client::build_execute_update_config_transaction;
-    use hashi::cli::client::build_vote_update_config_transaction;
+    use hashi::cli::client::build_vote_transaction;
+    use hashi::cli::upgrade::build_execute_proposal_transaction;
+    use hashi::cli::upgrade::extract_proposal_id_from_response;
     use hashi::sui_tx_executor::SuiTxExecutor;
+    use sui_sdk_types::Identifier;
+    use sui_sdk_types::StructTag;
+    use sui_sdk_types::TypeTag;
 
     let nodes = networks.hashi_network.nodes();
 
@@ -304,6 +308,13 @@ async fn apply_onchain_config_overrides(
     // to wait for all nodes to catch up to the last applied override.
     let mut exec_checkpoint: u64 = 0;
 
+    let update_config_type_tag = TypeTag::Struct(Box::new(StructTag::new(
+        hashi_ids.package_id,
+        Identifier::from_static("update_config"),
+        Identifier::from_static("UpdateConfig"),
+        vec![],
+    )));
+
     //TODO could we build the proposals and vote/execute on them all at the same time vs doing them
     //one at a time?
     for (key, value) in overrides {
@@ -324,31 +335,14 @@ async fn apply_onchain_config_overrides(
             "create UpdateConfig proposal for '{key}' failed"
         );
 
-        // Extract the proposal ID from the ProposalCreatedEvent. The event BCS
-        // layout is (Address, u64) — proposal_id followed by timestamp_ms.
-        let proposal_id = response
-            .transaction()
-            .events()
-            .events()
-            .iter()
-            .find(|e| e.contents().name().contains("ProposalCreatedEvent"))
-            .ok_or_else(|| {
-                anyhow::anyhow!(
-                    "ProposalCreatedEvent not found after creating proposal for '{key}'"
-                )
-            })
-            .and_then(|e| {
-                let (id, _ts): (sui_sdk_types::Address, u64) =
-                    bcs::from_bytes(e.contents().value())?;
-                Ok(id)
-            })?;
-
+        let proposal_id = extract_proposal_id_from_response(&response)?;
         tracing::info!("proposal {proposal_id} created for '{key}'; collecting votes");
 
         // 2. All remaining nodes vote. This gives 100% of total weight,
         //    guaranteeing the 66.67% quorum threshold is met.
         for executor in &mut executors[1..] {
-            let vote_tx = build_vote_update_config_transaction(hashi_ids, proposal_id);
+            let vote_tx =
+                build_vote_transaction(hashi_ids, proposal_id, update_config_type_tag.clone());
             let vote_resp = executor.execute(vote_tx).await?;
             anyhow::ensure!(
                 vote_resp.transaction().effects().status().success(),
@@ -357,7 +351,12 @@ async fn apply_onchain_config_overrides(
         }
 
         // 3. Node 0 executes the proposal now that quorum is reached.
-        let execute_tx = build_execute_update_config_transaction(hashi_ids, proposal_id);
+        let execute_tx = build_execute_proposal_transaction(
+            hashi_ids,
+            proposal_id,
+            hashi_ids.package_id,
+            "update_config",
+        )?;
         let exec_resp = executors[0].execute(execute_tx).await?;
         anyhow::ensure!(
             exec_resp.transaction().effects().status().success(),

crates/e2e-tests/src/upgrade_flow.rs

@@ -10,18 +10,20 @@
 use anyhow::Result;
 use hashi::cli::client::CreateProposalParams;
 use hashi::cli::client::build_create_proposal_transaction;
+use hashi::cli::client::build_vote_transaction;
+use hashi::cli::upgrade::build_execute_proposal_transaction;
+use hashi::cli::upgrade::build_upgrade_execution_transaction;
+use hashi::cli::upgrade::build_upgrade_package;
+use hashi::cli::upgrade::extract_new_package_id_from_response;
+use hashi::cli::upgrade::extract_proposal_id_from_response;
 use hashi::config::HashiIds;
-use hashi::sui_tx_executor::SUI_CLOCK_OBJECT_ID;
 use hashi::sui_tx_executor::SuiTxExecutor;
 use std::path::Path;
 use std::path::PathBuf;
 use sui_sdk_types::Address;
 use sui_sdk_types::Identifier;
 use sui_sdk_types::StructTag;
 use sui_sdk_types::TypeTag;
-use sui_transaction_builder::Function;
-use sui_transaction_builder::ObjectInput;
-use sui_transaction_builder::TransactionBuilder;
 
 use crate::TestNetworks;
 use crate::sui_network::sui_binary;
@@ -94,57 +96,6 @@ pub fn prepare_upgrade_package(test_dir: &Path, original_package_id: Address) ->
     Ok(dst)
 }
 
-/// Build the upgraded package and return the compiled modules + digest.
-pub fn build_upgrade_package(
-    package_path: &Path,
-    client_config: Option<&Path>,
-) -> Result<(sui_sdk_types::Publish, Vec<u8>)> {
-    let mut cmd = std::process::Command::new(sui_binary());
-    cmd.arg("move");
-
-    if let Some(config) = client_config {
-        cmd.arg("--client.config").arg(config);
-    }
-
-    cmd.arg("-p")
-        .arg(package_path)
-        .arg("build")
-        .arg("-e")
-        .arg("testnet")
-        .arg("--dump-bytecode-as-base64");
-
-    let output = cmd.output()?;
-    anyhow::ensure!(
-        output.status.success(),
-        "sui move build failed:\nstdout: {}\nstderr: {}",
-        output.stdout.escape_ascii(),
-        output.stderr.escape_ascii()
-    );
-
-    #[derive(serde::Deserialize)]
-    struct MoveBuildOutput {
-        modules: Vec<String>,
-        dependencies: Vec<Address>,
-        digest: Vec<u8>,
-    }
-
-    let build_output: MoveBuildOutput = serde_json::from_slice(&output.stdout)?;
-    let digest = build_output.digest.clone();
-    let modules = build_output
-        .modules
-        .into_iter()
-        .map(|b64| <base64ct::Base64 as base64ct::Encoding>::decode_vec(&b64))
-        .collect::<Result<Vec<_>, _>>()?;
-
-    Ok((
-        sui_sdk_types::Publish {
-            modules,
-            dependencies: build_output.dependencies,
-        },
-        digest,
-    ))
-}
-
 /// Run the full upgrade lifecycle: prepare → build → propose → vote → execute+publish+finalize.
 ///
 /// Returns the new package ID on success.
@@ -171,7 +122,7 @@ pub async fn execute_full_upgrade(networks: &mut TestNetworks) -> Result<Address
 
     // 2. Build the upgrade
     tracing::info!("building upgrade package from {}", upgrade_path.display());
-    let (compiled, digest) = build_upgrade_package(&upgrade_path, client_config)?;
+    let (compiled, digest) = build_upgrade_package(sui_binary(), &upgrade_path, client_config)?;
     tracing::info!("upgrade package built, digest: {digest:?}");
 
     // 3. Propose the upgrade
@@ -189,17 +140,7 @@ pub async fn execute_full_upgrade(networks: &mut TestNetworks) -> Result<Address
         "create Upgrade proposal failed"
     );
 
-    let proposal_id = response
-        .transaction()
-        .events()
-        .events()
-        .iter()
-        .find(|e| e.contents().name().contains("ProposalCreatedEvent"))
-        .ok_or_else(|| anyhow::anyhow!("ProposalCreatedEvent not found"))
-        .and_then(|e| {
-            let (id, _ts): (Address, u64) = bcs::from_bytes(e.contents().value())?;
-            Ok(id)
-        })?;
+    let proposal_id = extract_proposal_id_from_response(&response)?;
     tracing::info!("upgrade proposal {proposal_id} created");
 
     // 4. All other nodes vote (upgrade requires 100% quorum)
@@ -211,28 +152,8 @@ pub async fn execute_full_upgrade(networks: &mut TestNetworks) -> Result<Address
     )));
 
     for executor in &mut executors[1..] {
-        let mut builder = TransactionBuilder::new();
-        let hashi_arg = builder.object(
-            ObjectInput::new(hashi_ids.hashi_object_id)
-                .as_shared()
-                .with_mutable(true),
-        );
-        let proposal_id_arg = builder.pure(&proposal_id);
-        let clock_arg = builder.object(
-            ObjectInput::new(SUI_CLOCK_OBJECT_ID)
-                .as_shared()
-                .with_mutable(false),
-        );
-        builder.move_call(
-            Function::new(
-                hashi_ids.package_id,
-                Identifier::from_static("proposal"),
-                Identifier::from_static("vote"),
-            )
-            .with_type_args(vec![upgrade_type_tag.clone()]),
-            vec![hashi_arg, proposal_id_arg, clock_arg],
-        );
-        let vote_resp = executor.execute(builder).await?;
+        let vote_tx = build_vote_transaction(hashi_ids, proposal_id, upgrade_type_tag.clone());
+        let vote_resp = executor.execute(vote_tx).await?;
         anyhow::ensure!(
             vote_resp.transaction().effects().status().success(),
             "vote on Upgrade proposal failed"
@@ -242,69 +163,15 @@ pub async fn execute_full_upgrade(networks: &mut TestNetworks) -> Result<Address
 
     // 5. Execute upgrade + publish + finalize in one PTB
     tracing::info!("executing upgrade (execute + publish + finalize in one PTB)...");
-    let mut builder = TransactionBuilder::new();
-    let hashi_arg = builder.object(
-        ObjectInput::new(hashi_ids.hashi_object_id)
-            .as_shared()
-            .with_mutable(true),
-    );
-    let proposal_id_arg = builder.pure(&proposal_id);
-    let clock_arg = builder.object(
-        ObjectInput::new(SUI_CLOCK_OBJECT_ID)
-            .as_shared()
-            .with_mutable(false),
-    );
-
-    // Step A: upgrade::execute → UpgradeTicket
-    let ticket = builder.move_call(
-        Function::new(
-            hashi_ids.package_id,
-            Identifier::from_static("upgrade"),
-            Identifier::from_static("execute"),
-        ),
-        vec![hashi_arg, proposal_id_arg, clock_arg],
-    );
-
-    // Step B: publish upgrade → UpgradeReceipt
-    let receipt = builder.upgrade(
-        compiled.modules,
-        compiled.dependencies,
-        hashi_ids.package_id,
-        ticket,
-    );
-
-    // Step C: finalize_upgrade
-    let hashi_arg2 = builder.object(
-        ObjectInput::new(hashi_ids.hashi_object_id)
-            .as_shared()
-            .with_mutable(true),
-    );
-    builder.move_call(
-        Function::new(
-            hashi_ids.package_id,
-            Identifier::from_static("upgrade"),
-            Identifier::from_static("finalize_upgrade"),
-        ),
-        vec![hashi_arg2, receipt],
-    );
-
-    let upgrade_resp = executors[0].execute(builder).await?;
+    let upgrade_tx = build_upgrade_execution_transaction(hashi_ids, proposal_id, compiled);
+    let upgrade_resp = executors[0].execute(upgrade_tx).await?;
     anyhow::ensure!(
         upgrade_resp.transaction().effects().status().success(),
         "upgrade execute+publish+finalize failed: {:?}",
         upgrade_resp.transaction().effects().status()
     );
 
-    let new_package_id = upgrade_resp
-        .transaction()
-        .effects()
-        .changed_objects()
-        .iter()
-        .find(|o| o.object_type() == "package")
-        .ok_or_else(|| anyhow::anyhow!("new package not found in upgrade effects"))?
-        .object_id()
-        .parse::<Address>()?;
-
+    let new_package_id = extract_new_package_id_from_response(&upgrade_resp)?;
     tracing::info!("upgrade complete! new package: {new_package_id}");
     Ok(new_package_id)
 }
@@ -333,17 +200,7 @@ pub async fn disable_version(
         "create DisableVersion proposal failed"
     );
 
-    let proposal_id = response
-        .transaction()
-        .events()
-        .events()
-        .iter()
-        .find(|e| e.contents().name().contains("ProposalCreatedEvent"))
-        .ok_or_else(|| anyhow::anyhow!("ProposalCreatedEvent not found"))
-        .and_then(|e| {
-            let (id, _ts): (Address, u64) = bcs::from_bytes(e.contents().value())?;
-            Ok(id)
-        })?;
+    let proposal_id = extract_proposal_id_from_response(&response)?;
 
     let disable_version_type = TypeTag::Struct(Box::new(StructTag::new(
         hashi_ids.package_id,
@@ -353,55 +210,21 @@ pub async fn disable_version(
     )));
 
     for executor in &mut executors[1..] {
-        let mut builder = TransactionBuilder::new();
-        let hashi_arg = builder.object(
-            ObjectInput::new(hashi_ids.hashi_object_id)
-                .as_shared()
-                .with_mutable(true),
-        );
-        let proposal_id_arg = builder.pure(&proposal_id);
-        let clock_arg = builder.object(
-            ObjectInput::new(SUI_CLOCK_OBJECT_ID)
-                .as_shared()
-                .with_mutable(false),
-        );
-        builder.move_call(
-            Function::new(
-                hashi_ids.package_id,
-                Identifier::from_static("proposal"),
-                Identifier::from_static("vote"),
-            )
-            .with_type_args(vec![disable_version_type.clone()]),
-            vec![hashi_arg, proposal_id_arg, clock_arg],
-        );
-        let vote_resp = executor.execute(builder).await?;
+        let vote_tx = build_vote_transaction(hashi_ids, proposal_id, disable_version_type.clone());
+        let vote_resp = executor.execute(vote_tx).await?;
         anyhow::ensure!(
             vote_resp.transaction().effects().status().success(),
             "vote on DisableVersion proposal failed"
         );
     }
 
-    let mut builder = TransactionBuilder::new();
-    let hashi_arg = builder.object(
-        ObjectInput::new(hashi_ids.hashi_object_id)
-            .as_shared()
-            .with_mutable(true),
-    );
-    let proposal_id_arg = builder.pure(&proposal_id);
-    let clock_arg = builder.object(
-        ObjectInput::new(SUI_CLOCK_OBJECT_ID)
-            .as_shared()
-            .with_mutable(false),
-    );
-    builder.move_call(
-        Function::new(
-            execute_package_id,
-            Identifier::from_static("disable_version"),
-            Identifier::from_static("execute"),
-        ),
-        vec![hashi_arg, proposal_id_arg, clock_arg],
-    );
-    let exec_resp = executors[0].execute(builder).await?;
+    let execute_tx = build_execute_proposal_transaction(
+        hashi_ids,
+        proposal_id,
+        execute_package_id,
+        "disable_version",
+    )?;
+    let exec_resp = executors[0].execute(execute_tx).await?;
     anyhow::ensure!(
         exec_resp.transaction().effects().status().success(),
         "execute DisableVersion proposal failed"