Cardano Updates

cardano-api #1210 removed the legacy 'Cardano.Api.Certificate' module
and stopped re-exporting Certificate-construction helpers from
'Cardano.Api'. Migrate cardano-cli to import the relevant types
('StakePoolRelay', 'StakePoolMetadataReference', 'StakePoolMetadata',
'DRepMetadata', 'KESPeriod', 'OperationalCertificate',
'OperationalCertificateIssueCounter', 'PoolId', 'StakePoolParameters',
helpers like 'issueOperationalCertificate', 'validateAndHashStakePoolMetadata',
'toShelleyPoolParams', 'hashDRepMetadata', 'getKesPeriod', 'getOpCertCount',
data instances 'Hash StakePoolMetadataHash' / 'Hash DRepMetadataHash',
'AsType AsOperationalCertificate' / 'AsType AsOperationalCertificateIssueCounter',
'MIRPot') from 'Cardano.Api.Experimental.Certificate' or
'Cardano.Api.Compatible.Certificate' as appropriate.

Drops vacuous 'hiding (make*Certificate)' / 'hiding (Certificate)'
clauses that referenced names no longer re-exported from 'Cardano.Api',
which had become '-Wdodgy-imports' errors under '-Werror'. Removes the
redundant 'Cardano.Ledger.Core' qualified import from
'Cardano.CLI.Read' that became unused after the cardano-api re-export
narrowing.

Pins cardano-api to the tip of the release/cardano-api-11.2.0.0 branch
in cabal.project until CHaP publishes 11.2.0.0. Bumps the cardano-cli
cabal dep from ^>=11.1 to ^>=11.2. Drops the per-package warning
downgrades that were temporary scaffolding for the migration.

Eliminate the legacy 'TxOut CtxTx era' and 'TxOut CtxUTxO era' type
signatures and pattern matches from cardano-cli's non-Byron code paths.
Byron-era code uses a separate pre-Shelley tx output model and is left
alone — 'Exp.TxOut' is not applicable there.

  * 'friendlyTxOut' in 'Compatible/Json/Friendly.hs' now takes
    'Exp.TxOut (LedgerEra era)' and reads address, value, datum, and
    reference script directly via the ledger lenses ('addrTxOutL',
    'valueTxOutL', 'datumTxOutL', 'referenceScriptTxOutL'). The two
    call sites ('basePairs', 'friendlyReturnCollateral') wrap the
    body's ledger outputs with 'Exp.TxOut' instead of going through
    'fromShelleyTxOut → fromCtxUTxOTxOut'. The dead 'friendlyTxOutValue'
    helper is dropped.

  * 'filteredUTxOsToText' in 'EraBased/Query/Run.hs' now takes a
    'ShelleyBasedEra era' witness, converts the api 'UTxO era' to the
    ledger UTxO once via 'toLedgerUTxO', then renders each entry from
    '(TxIn, Exp.TxOut (ShelleyLedgerEra era))' using ledger lenses.
    The pre-Babbage datum slot has no uniform ledger representation,
    so the renderer emits an empty placeholder there and shows the
    babbage+ ledger datum elsewhere — debug-style output, no golden
    tests touched.

  * Removed 'validateTxReturnCollateral' from
    'Type/Error/TxValidationError.hs'. It was exported but never
    called outside its own module; the actual return-collateral
    construction in 'EraBased/Transaction/Run' builds
    'Exp.TxReturnCollateral' directly.

Remaining uses of legacy ctx-typed tx outputs in cardano-cli are
confined to Byron-only modules.

Drops the last remaining uses of the deprecated old-API transaction
body surface (`TxBody`, `getTxBody`, `getTxBodyAndWitnesses`,
`makeShelleyKeyWitness`, `makeSignedTransaction`,
`evaluateTransactionExecutionUnits` on a deprecated `TxBody`,
`getTxId . getTxBody`) from cardano-cli's source tree.

`IncompleteTxBody` is reworked from a `newtype` wrapping
`InAnyShelleyBasedEra TxBody` into a GADT existential carrying
`Exp.UnsignedTx (ShelleyLedgerEra era)` plus `IsShelleyBasedEra`
evidence. `readFileTxBody` pattern-matches `ShelleyTx _ ledgerTx`
directly and wraps as `Exp.UnsignedTx ledgerTx` — no `getTxBody`.

Consumers in `Transaction.Run` are migrated to:
- `makeShelleyKeyWitness'` (ledger-level body) and `addWitnesses` for
  signing — both non-deprecated and work for all Shelley-based eras,
  preserving pre-Conway support.
- `getTxIdShelley` for transaction IDs.
- `evaluateTransactionExecutionUnitsShelley` (operates on the ledger
  `Tx` directly) for `transaction calculate-plutus-script-cost`,
  preserving Alonzo+ era support.
- `Exp.evaluateTransactionFee` on `Exp.UnsignedTx` for
  `transaction calculate-min-fee` (already Conway+ via `sbeToEra`).

`TransactionView.Run` no longer needs the
`makeSignedTransaction []`-then-extract-ledger boundary that PR #1374
added — the new `readFileTxBody` returns `Exp.UnsignedTx` directly.

The TextEnvelope I/O boundary still uses `Tx era` and `ShelleyTx _`
(both non-deprecated), since `Exp.UnsignedTx`/`Exp.SignedTx` have no
`HasTextEnvelope` instance. The on-disk `.tx`/`.txbody` formats are
unchanged.

The compatible command path (`Cardano.CLI.Compatible.Transaction.Run`)
was already using non-deprecated symbols (`makeShelleyKeyWitness'`,
`addWitnesses`) and is unchanged by this commit.

Adapt to cardano-api PR #1209, which removes the legacy 'TxOut CtxTx era'
from the Compatible and Experimental APIs:

  * 'createCompatibleTx' now takes '[Exp.TxOut (ShelleyLedgerEra era)]'
    plus a new 'Map L.DataHash (L.Data ...)' argument carrying any
    supplemental datum bodies. The legacy 'TxOut CtxTx era' bundled
    supplemental datums inside outputs; 'Exp.TxOut' only carries the
    datum hash, so callers thread the full datum bodies in explicitly.
  * The bridge helpers 'fromLegacyTxOut', 'legacyDatumToDatum',
    'supplementalDatumFromLegacy', 'toLedgerDatum', and the
    'DatumDecodingError' type are deleted from 'Cardano.Api.Experimental.Tx'.

Migration:

  * 'mkTxOut' and 'toTxOutInAnyEra' now return
    '(Exp.TxOut (ShelleyLedgerEra era), Map DataHash (L.Data ...))'
    directly, building the legacy 'TxOut CtxTx era' internally only as
    a stepping stone for 'toShelleyTxOutAny'.
  * 'createCompatibleTx' call site in 'Compatible/Transaction/Run.hs'
    folds the per-output supplemental datums via 'Map.unions' and
    passes them as the new argument.
  * 'toTxOutInEra' and 'toTxOutInShelleyBasedEra' in
    'EraBased/Transaction/Run.hs' delegate directly to 'mkTxOut' (the
    deleted 'fromLegacyTxOut' is gone).
  * 'TxCmdDatumDecodingError' is removed since the underlying
    'Exp.DatumDecodingError' is gone and the new conversion is total.

Temporary 'cabal.project' additions (to be removed once #1209 is
merged and the next cardano-api is published to CHaP):

  * 'source-repository-package' pointing at the PR branch so CI can
    build against the unpublished API.
  * Per-package '-Wwarn=deprecations -Wwarn=unused-imports' for
    cardano-cli. The PR branch is several commits ahead of
    cardano-api-11.1.0.0 and surfaces unrelated TxBody/TxBodyContent
    deprecations (cardano-api PR #1200) plus a redundant
    'Cardano.Ledger.Core' import in 'Cardano.CLI.Read' that became
    visible after upstream re-exports widened. Both are separate
    cleanups out of scope for this PR.

`TxBodyFile` was a `File (TxBody ())` whose phantom payload was only
ever used as a file-tag for option/parser plumbing; the bytes on disk
do not depend on it. Replace `TxBody ()` with a fresh empty
`TxBodyTag` data type so the alias no longer references the deprecated
`TxBody` from cardano-api PR #1200.

No on-disk format change. No call-site change beyond the alias itself.

Add --key-output-bech32/--key-output-text-envelope to governance key-gen commands

Adds key output format flags to drep key-gen, committee key-gen-cold,
and committee key-gen-hot, matching the existing address key-gen behaviour.

Closes #1165

The four call sites that produced an Exp.Certificate via helpers in
Cardano.Api.Compatible.Certificate (makeStakePoolRegistrationCertificate,
makeStakeAddressRegistrationCertificate, makeMIRCertificate,
makeGenesisKeyDelegationCertificate) now build the ledger TxCert
directly and wrap it in Exp.Certificate. This severs cardano-cli's
dependency on those Compatible helpers and lets cardano-api eventually
deprecate them along with the old Certificate type.

Era-varying inputs (StakeRegistrationRequirements, Delegatee type
families) are inlined at each callsite. MIR and GenesisKeyDelegation
certificates remain pinned to BabbageEra since their on-chain
serialization is uniform across Shelley->Babbage.

For stake address registration the per-era case dispatches between
shelleyToBabbageReg (pre-Conway, no deposit, uses
ShelleyEraTxCert.mkRegTxCert) and createRegistrationCertificate
(Conway+), which validates the deposit is present and delegates to
Exp.makeStakeAddressRegistrationCertificate, rendering the era name
via prettyShow for the error message.

Compatible.Certificate.getTxCertWitness is retained where it extracts
the stake-credential witness from a ledger TxCert: it operates on
Ledger.TxCert directly and is independent of the old Certificate type.
A follow-up cardano-api change can re-export it under the experimental
API and that import can then move.

Replace the remaining five imports of Cardano.Api.Compatible.Certificate
with direct ledger-level construction of Exp.Certificate. This removes
the indirection through the Compatible API so the old Certificate type
in cardano-api can be deprecated.

The era-varying helpers (StakeRegistrationRequirements, Delegatee type
families) are inlined at each callsite. MIR and GenesisKeyDelegation
certificates remain pinned to BabbageEra since their on-chain
serialization is uniform across Shelley->Babbage.

For stake address registration the per-era case dispatches between two
paths: shelleyToBabbageReg (pre-Conway, no deposit, uses
ShelleyEraTxCert.mkRegTxCert) and createRegistrationCertificate
(Conway+) which validates the deposit is present and delegates to
Exp.makeStakeAddressRegistrationCertificate, rendering the era name
via prettyShow for the error message.

Move the stake address registration cert construction out of the
per-era case into two top-level helpers: shelleyToBabbageReg for
pre-Conway (uses ShelleyEraTxCert.mkRegTxCert) and expReg for
Conway-onwards (indexed by Exp.Era era, uses ConwayEraTxCert
.mkRegDepositTxCert via obtainCommonConstraints).

Replace the remaining five imports of Cardano.Api.Compatible.Certificate
with direct ledger-level construction of Exp.Certificate. This removes
the indirection through the Compatible API so the old Certificate type
in cardano-api can be deprecated.

The era-varying helpers (StakeRegistrationRequirements, Delegatee type
families) are inlined at each callsite. MIR and GenesisKeyDelegation
certificates remain pinned to BabbageEra since their on-chain
serialization is uniform across Shelley→Babbage.

Eliminate the legacy 'TxOut CtxTx era' and 'TxOut CtxUTxO era' type
signatures and pattern matches from cardano-cli's non-Byron code paths.
Byron-era code is left alone — Byron uses a separate pre-Shelley tx
output model and 'Exp.TxOut' is not applicable.

Surfaces migrated:

  * 'Cardano.CLI.Compatible.Transaction.TxOut': 'mkTxOut' and
    'toTxOutInAnyEra' now return '(Exp.TxOut, Map DataHash (L.Data ...))'
    directly. The legacy 'TxOut CtxTx era' is still used internally as a
    stepping stone to reuse the api's 'toShelleyTxOutAny' field-level
    conversion logic; it does not leak to callers.

  * 'Cardano.CLI.Compatible.Transaction.Run': the 'createCompatibleTx'
    call site now just splits the tuple returned by 'toTxOutInAnyEra'.

  * 'Cardano.CLI.EraBased.Transaction.Run': 'toTxOutInEra' and
    'toTxOutInShelleyBasedEra' delegate straight to 'mkTxOut' now that
    it produces the tuple itself.

  * 'Cardano.CLI.Compatible.Json.Friendly.friendlyTxOut': now takes
    'Exp.TxOut (LedgerEra era)' and reads address / value / datum /
    reference script directly via the ledger lenses ('addrTxOutL',
    'valueTxOutL', 'datumTxOutL', 'referenceScriptTxOutL'). The two
    call sites in 'basePairs' and 'friendlyReturnCollateral' wrap the
    body's ledger outputs with 'Exp.TxOut' directly instead of going
    through 'fromShelleyTxOut → fromCtxUTxOTxOut'. The dead
    'friendlyTxOutValue' helper is dropped.

  * 'Cardano.CLI.EraBased.Query.Run.filteredUTxOsToText': now takes a
    'ShelleyBasedEra era' witness; converts the api 'UTxO era' to the
    ledger UTxO once via 'toLedgerUTxO', then renders each entry from
    '(api TxIn, Exp.TxOut (ShelleyLedgerEra era))' using ledger lenses.
    The pre-Babbage datum slot has no uniform ledger representation,
    so the text renderer emits an empty placeholder there and shows
    the babbage+ ledger datum elsewhere — debug-style output, no
    golden tests.

  * 'Cardano.CLI.Type.Error.TxValidationError': removed
    'validateTxReturnCollateral', which was exported but never called
    anywhere outside its own module (the actual return-collateral
    construction in 'EraBased/Transaction/Run' builds
    'Exp.TxReturnCollateral' directly).

Remaining uses of legacy ctx-typed tx outputs in cardano-cli are
confined to Byron-only modules and to the internal stepping-stone use
inside 'mkTxOut'.

Adapt to cardano-api PR #1209, which removes the legacy 'TxOut CtxTx era'
from the Compatible and Experimental APIs:

  * createCompatibleTx now takes '[Exp.TxOut (ShelleyLedgerEra era)]' plus
    a new 'Map L.DataHash (L.Data ...)' of supplemental datum bodies. The
    legacy 'TxOut CtxTx era' bundled supplemental datums inside outputs;
    'Exp.TxOut' only carries the datum hash, so callers thread the full
    datum bodies in explicitly.
  * The bridge helpers in 'Cardano.Api.Experimental.Tx'
    (fromLegacyTxOut, legacyDatumToDatum, supplementalDatumFromLegacy,
    toLedgerDatum, DatumDecodingError) are deleted.

Changes here:

  * Add a 'convertLegacyTxOut' helper in
    'Cardano.CLI.Compatible.Transaction.TxOut' that maps each legacy
    'TxOut CtxTx era' to '(Exp.TxOut, Map DataHash (L.Data ...))' using
    'toShelleyTxOutAny' (which already strips supplemental datums to
    their hash in the ledger TxOut) and pulls the supplemental datum
    bodies into the map.
  * Update the 'createCompatibleTx' call in
    'Cardano.CLI.Compatible.Transaction.Run' to convert outs at the
    boundary and pass the folded 'extraDatums' map.
  * Replace 'Exp.fromLegacyTxOut' in 'toTxOutInEra' and
    'toTxOutInShelleyBasedEra' with 'convertLegacyTxOut', using
    'obtainCommonConstraints' to bridge 'ShelleyLedgerEra ~ LedgerEra'.
  * Drop 'TxCmdDatumDecodingError' from 'TxCmdError' since the
    underlying 'Exp.DatumDecodingError' is gone and the new conversion
    is total.

Temporary cabal.project additions (to be removed once #1209 is merged
and the next cardano-api is published to CHaP):

  * source-repository-package pointing at the PR branch, so CI can
    build against the unpublished API.
  * Per-package '-Wwarn=deprecations -Wwarn=unused-imports' for
    cardano-cli. The PR branch is several commits ahead of
    cardano-api-11.1.0.0 and surfaces unrelated TxBody/TxBodyContent
    deprecations (cardano-api PR #1200) plus a redundant
    'Cardano.Ledger.Core' import in 'Cardano.CLI.Read' that became
    visible after upstream re-exports widened. Both are separate
    cardano-cli cleanups out of scope for this PR.

Drop redundant ProtocolParametersUpdate conversion in shelleyToBabbage update

`makeShelleyUpdateProposal` (cardano-api ^>=11.1) accepts
`EraBasedProtocolParametersUpdate era` directly. The existing code in
`shelleyToBabbageProtocolParametersUpdate` constructed that value,
converted it to the deprecated `ProtocolParametersUpdate` via
`createEraBasedProtocolParamUpdate` / `fromLedgerPParamsUpdate`, and
passed the result to `makeShelleyUpdateProposal` — an unnecessary
round-trip through the old API.

Drop the conversion; pass `eraBasedPParams` directly. No behaviour
change.

Drops the last remaining uses of the deprecated old-API transaction
body surface (`TxBody`, `getTxBody`, `getTxBodyAndWitnesses`,
`makeShelleyKeyWitness`, `makeSignedTransaction`,
`evaluateTransactionExecutionUnits` on a deprecated `TxBody`,
`getTxId . getTxBody`) from cardano-cli's source tree.

`IncompleteTxBody` is reworked from a `newtype` wrapping
`InAnyShelleyBasedEra TxBody` into a GADT existential carrying
`Exp.UnsignedTx (ShelleyLedgerEra era)` plus `IsShelleyBasedEra`
evidence. `readFileTxBody` pattern-matches `ShelleyTx _ ledgerTx`
directly and wraps as `Exp.UnsignedTx ledgerTx` — no `getTxBody`.

Consumers in `Transaction.Run` are migrated to:
- `makeShelleyKeyWitness'` (ledger-level body) and `addWitnesses` for
  signing — both non-deprecated and work for all Shelley-based eras,
  preserving pre-Conway support.
- `getTxIdShelley` for transaction IDs.
- `evaluateTransactionExecutionUnitsShelley` (operates on the ledger
  `Tx` directly) for `transaction calculate-plutus-script-cost`,
  preserving Alonzo+ era support.
- `Exp.evaluateTransactionFee` on `Exp.UnsignedTx` for
  `transaction calculate-min-fee` (already Conway+ via `sbeToEra`).

`TransactionView.Run` no longer needs the
`makeSignedTransaction []`-then-extract-ledger boundary that PR #1374
added — the new `readFileTxBody` returns `Exp.UnsignedTx` directly.

The TextEnvelope I/O boundary still uses `Tx era` and `ShelleyTx _`
(both non-deprecated), since `Exp.UnsignedTx`/`Exp.SignedTx` have no
`HasTextEnvelope` instance. The on-disk `.tx`/`.txbody` formats are
unchanged.

The compatible command path (`Cardano.CLI.Compatible.Transaction.Run`)
was already using non-deprecated symbols (`makeShelleyKeyWitness'`,
`addWitnesses`) and is unchanged by this commit.

`TxBodyFile` was a `File (TxBody ())` whose phantom payload was only
ever used as a file-tag for option/parser plumbing; the bytes on disk
do not depend on it. Replace `TxBody ()` with a fresh empty
`TxBodyTag` data type so the alias no longer references the deprecated
`TxBody` from cardano-api PR #1200.

No on-disk format change. No call-site change beyond the alias itself.

Pins cardano-api to the master commit containing PR #1200, which
deprecates `TxBody`, `TxBodyContent`, `getTxBody`, `getTxBodyContent`,
`createTransactionBody`, `defaultTxBodyContent`, and `BalancedTxBody`.

Lets this PR verify -Wdeprecations is clean against the deprecated
surface. Remove this stanza once cardano-api releases a version
containing #1200.

Migrate friendly transaction renderer to experimental API (Exp.Era era)

Migrates Cardano.CLI.Compatible.Json.Friendly off the old-API
Tx / TxBody / TxBodyContent onto Exp.SignedTx / Exp.UnsignedTx, with
the public renderer functions (friendlyTx, friendlyTxBody,
friendlyTxImpl, friendlyTxBodyImpl) now taking Exp.Era era instead of
ShelleyBasedEra era. This is the last consumer of old-API
TxBodyContent in cardano-cli.

Behaviour change: 'cardano-cli debug transaction view' and
'cardano-cli transaction view' now only accept Conway and Dijkstra
tx / tx-body files. Pre-Conway files (Shelley, Allegra, Mary, Alonzo,
Babbage) fail with a DeprecatedEra error. The corresponding pre-Conway
golden tests have been removed.

Added in the migration commit but no {..} patterns use it.

The previous commit bumped cabal.project's cardano-haskell-packages
index-state to 2026-05-08T13:26:45Z, but the nix-side CHaP pin in
flake.lock was still at 2026-04-30. haskell.nix-driven CI checks
(actionlint, check-formatting, check-cabal-files, check-cabal-gild,
test-hls-works, shellcheck) all failed with Cabal-7159 "Latest known
index-state for 'cardano-haskell-packages' (2026-04-30T13:08:25Z) is
older than the requested index-state (2026-05-08T13:26:45Z)".

Updated via `nix flake lock --update-input CHaP` per CONTRIBUTING.md.