Fail instead of silently dropping Plutus scripts the era does not support by carbolymer · Pull Request #1363 · IntersectMBO/cardano-api

carbolymer · 2026-09-30T13:47:50Z

Plutus scripts in a language the era does not support are rejected instead of being dropped.

In the experimental API the check happens where the bytes enter.
decodeAnyPlutusScript and deserialiseAnyPlutusScriptFromTextEnvelope fail with a decoder error that names the language and the era.
PlutusScriptInEra can only be built for a pairing the ledger supports: mkPlutusScriptInEra, deserialisePlutusScriptInEra and deserialiseAnyPlutusScriptOfLanguage take the ledger's EraPlutusTxInfo lang era constraint, and so do its SerialiseAsCBOR and HasTextEnvelope instances, so a wrong pairing is a compile error.
PlutusLangInEra lang era is the runtime proof returned by plutusLangInShelleyBasedEra and plutusLangInEra, which ask the ledger's mkSupportedLanguage; cardano-api keeps no table of languages per era.
PlutusScriptInEra also holds the ledger script, built once through the ledger's mkSupportedPlutusScript, so no later conversion can fail and fromPlutusRunnable is gone.
This is a breaking change to the experimental API: PlutusScriptInEra gains a field and a constraint, deserialisePlutusScriptInEra and deserialiseAnyPlutusScriptOfLanguage lose their language argument, and decodeAnyPlutusScript and deserialiseAnyPlutusScriptFromTextEnvelope now require IsShelleyBasedEra for the api era that matches the ledger era.

In the legacy API, createTransactionBody fails with TxOutputReferenceScriptLanguageNotSupportedInEra when an output or the return collateral carries a reference script in a language the era does not support.
The test generators take the supported Plutus languages from scriptLanguageSupportedInEra, and the Plutus V4 fixture is a validator compiled against Plutus V4.

Context

The experimental part follows the design Jordan proposed on this PR and prepared in PR 1372, folded in here:

Known gap, outside this PR:

cardano-ledger-dijkstra 0.4.0.0 reads auxiliary scripts only up to eraMaxLanguage, still PlutusV3, so a PlutusV4 auxiliary script in Dijkstra is dropped on read-back until ledger 0.5.0.0. A TODO marks the spot in toAuxiliaryData.
Set Dijkstra's eraMaxLanguage to PlutusV4, fix tests cardano-ledger#6109

How to trust this PR

prop_deserialise_rejects_unsupported_plutus_language checks that V4 bytes fail to decode in Conway with the error naming the era.
prop_makeUnsignedTx_accepts_reference_plutus_v4_witness checks that a reference witness still passes.
prop_createTransactionBody_rejects_unsupported_reference_script_language checks the legacy reference script path.
A test that builds a Plutus V4 inline witness in Conway no longer typechecks, which is the point of the change.

Checklist

Commit sequence broadly makes sense and commits have useful messages
New tests are added if needed and existing tests are updated. See Running tests for more details
Self-reviewed the diff
Changelog fragment added in .changes/

Copilot

Copilot review overview

🟡 Changes recommended

The dependency bump is misclassified and the experimental API migration note inaccurately describes two previous return types.

Review effort: Balanced
Findings: 3

Open (3)

Correct migration note for requirements function return types · New
Classify disjoint dependency ranges as a breaking change · New
Correct comment describing retained redeemer and dropped script · New

What changed in this PR

Prevents unsupported Plutus scripts from being silently omitted during transaction construction.

Changes:

Returns explicit errors for unsupported witness and reference-script languages.
Adds regression tests, V4 fixtures, and golden output.
Updates Plutus dependencies and changelog fragments.

File	Description
`flake.lock`	Updates the CHaP revision.
`cardano-api/test/cardano-api-test/Test/Cardano/Api/Transaction/Body/Plutus/Scripts.hs`	Adds unsupported-language regression tests.
`cardano-api/test/cardano-api-golden/Test/Golden/ErrorsSpec.hs`	Adds the new output-error golden case.
`cardano-api/test/cardano-api-golden/files/errors/Cardano.Api.Tx.Body.TxBodyError/TxBodyOutputReferenceScriptLanguageNotSupportedInEra.txt`	Records the new error message.
`cardano-api/src/Cardano/Api/Tx/Internal/Output.hs`	Validates output reference-script languages.
`cardano-api/src/Cardano/Api/Tx/Internal/Body.hs`	Applies validation during body creation.
`cardano-api/src/Cardano/Api/Experimental/Tx/Internal/TxScriptWitnessRequirements.hs`	Propagates unsupported-language failures.
`cardano-api/src/Cardano/Api/Experimental/Tx/Internal/BodyContent/New.hs`	Adds and returns the unsigned-transaction error.
`cardano-api/src/Cardano/Api/Experimental/Tx/Internal/AnyWitness.hs`	Changes script extraction to `Either`.
`cardano-api/src/Cardano/Api/Experimental/Plutus/Internal/Shim/LegacyScripts.hs`	Adapts legacy witness conversion.
`cardano-api/src/Cardano/Api/Experimental/AnyScriptWitness.hs`	Detects unsupported inline script languages.
`cardano-api/gen/Test/Gen/Cardano/Api/Typed.hs`	Restricts generation to supported languages.
`cardano-api/gen/Test/Gen/Cardano/Api/Hardcoded.hs`	Adds Plutus V4 fixtures.
`cardano-api/cardano-api.cabal`	Requires Plutus 1.71 dependencies.
`cabal.project`	Advances the CHaP index state.
`.changes/plutus-1-71-bump.yml`	Documents the dependency bump.
`.changes/legacy-tx-body-unsupported-reference-script-language-error.yml`	Documents the legacy API break.
`.changes/experimental-tx-unsupported-plutus-language-error.yml`	Documents the experimental API break.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

+description: |
+  `makeUnsignedTx` now fails with `MakeUnsignedTxPlutusLanguageNotSupportedInEra` when an inline Plutus script uses a language the era does not support.
+  Before, the script was silently dropped from the witness set while its redeemer was kept, so the transaction failed on submission.
+  `getAnyWitnessScript`, `getAnyPlutusWitnessPlutusScript`, `getTxScriptWitnessRequirements` and `getTxScriptWitnessesRequirements` now return `Either L.Language` instead of `Maybe`.


+-- | An inline Plutus witness must be rejected, not silently dropped with its
+-- redeemer, when the era does not support its language. V4 fails in Conway.


Jimbo4350 · 2026-10-02T19:34:14Z

What about this approach? master...jordan/plutus-language-in-era-vs-master

Jimbo4350

LGTM. I have one further small simplification to suggest: mgalazyn/fix/unsupported-plutus-language-error...jordan/plutus-script-in-era-single-field

…port Plutus scripts in a language the era does not support are rejected instead of being dropped. In the experimental API the check happens where the bytes enter. decodeAnyPlutusScript and deserialiseAnyPlutusScriptFromTextEnvelope fail with a decoder error that names the language and the era. PlutusScriptInEra carries the ledger's EraPlutusTxInfo lang era evidence in its constructor, so it exists only for a pairing the ledger supports and converts to the ledger script through mkSupportedPlutusScript without a partial step. deserialisePlutusScriptInEra and deserialiseAnyPlutusScriptOfLanguage take that constraint instead of a language singleton, and so do the SerialiseAsCBOR and HasTextEnvelope instances of PlutusScriptInEra. PlutusLangInEra lang era is the runtime proof, returned by plutusLangInShelleyBasedEra and plutusLangInEra, which ask the ledger's mkSupportedLanguage; cardano-api keeps no table of languages per era. The legacy shim looks the language up at runtime, and the Either L.Language results and MakeUnsignedTxPlutusLanguageNotSupportedInEra are gone. In the legacy API, createTransactionBody fails with TxOutputReferenceScriptLanguageNotSupportedInEra when an output or the return collateral carries a reference script in a language the era does not support. Before, the output was built without the script and no error was reported. The test generators take the supported Plutus languages from scriptLanguageSupportedInEra, and the Plutus V4 fixture is a validator compiled against Plutus V4. Co-authored-by: Jordan Millar <jordan.millar@iohk.io>

carbolymer · 2026-10-09T06:30:26Z

@Jimbo4350 makes sense, thanks! I've used it 👍🏻

…lutus-language-error Fail instead of silently dropping Plutus scripts the era does not support

carbolymer added this pull request to stack #1364 September 30, 2026 13:48

carbolymer changed the title ~~Fail instead of silently dropping Plutus scripts unsupported by the era~~ Reject Plutus scripts unsupported by the era instead of silently dropping them Sep 30, 2026

carbolymer self-assigned this Sep 30, 2026

carbolymer mentioned this pull request Sep 30, 2026

Add Plutus V4 support in the Dijkstra era #1359

Open

4 tasks done

carbolymer force-pushed the mgalazyn/fix/unsupported-plutus-language-error branch 2 times, most recently from 1c03d44 to ed67933 Compare October 1, 2026 19:25

carbolymer changed the title ~~Reject Plutus scripts unsupported by the era instead of silently dropping them~~ Fail instead of silently dropping Plutus scripts the era does not support Oct 1, 2026

carbolymer force-pushed the mgalazyn/fix/unsupported-plutus-language-error branch from ed67933 to 62d4680 Compare October 1, 2026 20:13

carbolymer marked this pull request as ready for review October 1, 2026 20:13

Copilot AI balanced review requested due to automatic review settings October 1, 2026 20:13

carbolymer requested review from a team, CarlosLopezDeLara, Jimbo4350, disassembler, erikd and palas as code owners October 1, 2026 20:13

Copilot started reviewing on behalf of carbolymer October 1, 2026 20:15 View session

Copilot AI reviewed Oct 1, 2026

View reviewed changes

carbolymer force-pushed the mgalazyn/fix/unsupported-plutus-language-error branch 2 times, most recently from 4f7d365 to b2764fd Compare October 7, 2026 13:33

carbolymer mentioned this pull request Oct 7, 2026

Check the Plutus script language against the era when scripts are deserialised #1372

Closed

3 of 4 tasks

carbolymer force-pushed the mgalazyn/fix/unsupported-plutus-language-error branch 4 times, most recently from 54a1fbb to 5f5de62 Compare October 8, 2026 13:50

Jimbo4350 approved these changes Oct 8, 2026

View reviewed changes

carbolymer force-pushed the mgalazyn/fix/unsupported-plutus-language-error branch from 5f5de62 to 1833ae9 Compare October 9, 2026 06:29

carbolymer force-pushed the mgalazyn/fix/unsupported-plutus-language-error branch from 1833ae9 to cfcc6e2 Compare October 9, 2026 06:30

carbolymer added this pull request to the merge queue Oct 9, 2026

Merged via the queue into master with commit 65205dc Oct 9, 2026
34 checks passed

carbolymer added a commit that referenced this pull request Oct 9, 2026

Merge pull request #1363 from IntersectMBO/mgalazyn/fix/unsupported-p…

cb74404

…lutus-language-error Fail instead of silently dropping Plutus scripts the era does not support

carbolymer deleted the mgalazyn/fix/unsupported-plutus-language-error branch October 9, 2026 07:13

carbolymer mentioned this pull request Oct 9, 2026

Ensure Plutus V4 scripts can be deserialised by cardano-cli IntersectMBO/cardano-cli#1448

Open

3 tasks

Navigation Menu

Repository navigation

Fail instead of silently dropping Plutus scripts the era does not support - #1363

Fail instead of silently dropping Plutus scripts the era does not support#1363
carbolymer merged 1 commit into
masterfrom
mgalazyn/fix/unsupported-plutus-language-error

carbolymer commented Sep 30, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Jimbo4350 commented Oct 2, 2026

Uh oh!

Jimbo4350 left a comment

Uh oh!

carbolymer commented Oct 9, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

		-- \| An inline Plutus witness must be rejected, not silently dropped with its
		-- redeemer, when the era does not support its language. V4 fails in Conway.

Conversation

carbolymer commented Sep 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Context

How to trust this PR

Checklist

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🟡 Changes recommended

Uh oh!

Uh oh!

Jimbo4350 commented Oct 2, 2026

Uh oh!

Jimbo4350 left a comment

Choose a reason for hiding this comment

Uh oh!

carbolymer commented Oct 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

carbolymer commented Sep 30, 2026 •

edited

Loading

carbolymer commented Oct 9, 2026 •

edited

Loading