Inspect a Sui UpgradeCap before preparing a package release

A release built from the correct repository can still target an obsolete package ID or require a change outside the allowed upgrade policy. Inspect the capability used by the deployment.

Read package, version and policy together

In a Move helper taking cap by immutable reference, inspect all three values before an upgrade is authorized. Record the capability ID separately from the package ID. The framework tracks the latest authorized package in this capability across successive releases.

let current_id = sui::package::upgrade_package(cap);
let current_version = sui::package::version(cap);
let allowed = sui::package::upgrade_policy(cap);

Verify the ticket and receipt flow

An upgrade transaction authorizes a ticket for the intended policy and bytecode digest, executes the package upgrade, then commits the resulting receipt back to its capability. Inside that flow the recorded package ID can temporarily be zero. Inspect the completed transaction and the final capability state before updating deployment records.

Sources