vetkeys examples: migrate to icp-cli, @icp-sdk/vetkeys 0.5.0-beta.0, and @icp-sdk/core

[marc0olo]

Background

The vetkeys examples were previously maintained in dfinity/vetkeys and have since moved to this repo. A migration PR (dfinity/vetkeys#366) was developed there but never merged — it was closed when the examples moved. All the work it describes needs to land here instead.

@icp-sdk/vetkeys@0.5.0-beta.0 is now published to npm, unblocking all of this work.

Note: encrypted_chat was removed as an unfinished prototype. Six examples remain.

---

Examples in scope

• basic_bls_signing
• basic_ibe
• basic_timelock_ibe
• encrypted_notes_dapp_vetkd → rename to encrypted_notes_app_vetkd
• password_manager
• password_manager_with_metadata

PR strategy

One PR per example, in this order (simplest first to validate the approach):

1. basic_bls_signing
2. basic_ibe
3. basic_timelock_ibe
4. password_manager
5. password_manager_with_metadata
6. encrypted_notes_app_vetkd (most complex: rename + Svelte 3→4 + Rollup→Vite)

---

Changes required in each PR

1. Frontend package.json — dependency swap

Old	New
@dfinity/vetkeys@^0.3.0	@icp-sdk/vetkeys@^0.5.0-beta.0
@dfinity/auth-client	@icp-sdk/auth@^7.1.0
@dfinity/principal, @dfinity/agent, @dfinity/candid, @dfinity/identity	@icp-sdk/core@^5.4.0

Also:

• Add dev:rust / dev:motoko npm scripts
• Remove deprecated baseUrl from tsconfig.json
• Rename tailwind.config.cjs → tailwind.config.mjs in both password_manager examples
• Regenerate package-lock.json

2. Frontend source — import + API updates

• Update all @dfinity/* import paths to @icp-sdk/* equivalents
• Replace HttpAgent.createSync() / new HttpAgent(opts) with await HttpAgent.create({ ... })
• Add required associatedData arg to encryption/decryption calls
• Add missing await to DerivedKeyMaterial.fromCryptoKey()
• Remove window.global polyfill

3. gen_bindings.sh — replace dfx with icp CLI

• dfx generate <canister> → icp generate <canister>
• Remove the perl rewrite block that converted @icp-sdk/core → @dfinity/* (no longer needed)
• Add a guard so candid-extractor absence doesn't silently wipe the committed .did file

4. Backend config — replace dfx.json with icp.yaml

Remove dfx.json from each backend (rust/ and motoko/), add icp.yaml. Internet Identity is configured via ii: true in the network block (requires icp-cli >= 0.2.4):

# Rust example
canisters:
  - name: basic_bls_signing
    recipe:
      type: "@dfinity/rust@v3.2.0"
      configuration:
        package: ic-vetkeys-example-basic-bls-signing-backend
        candid: backend/backend.did
        init_args: '("test_key_1")'

  - name: www
    recipe:
      type: "@dfinity/asset-canister@v2.1.0"
      configuration:
        dir: ../frontend/dist
        build:
          - npm install --prefix ../frontend
          - npm run build --prefix ../frontend

networks:
  - name: local
    mode: managed
    ii: true

Use test_key_1 (not dfx_test_key) as the init arg — standardised on the PocketIC/icp-cli key name.

5. Backend libraries

• Rust Cargo.toml: bump ic-vetkeys to 0.7.0; update password_manager_with_metadata for the changed KeyManager API
• Motoko mops.toml: bump vetkeys package to 0.5.0; add [toolchain] moc = "1.5.1" to all Motoko examples; remove --enhanced-orthogonal-persistence from [moc] args

6. Makefiles

• rm -rf .dfx → rm -rf .icp
• Replace any remaining dfx calls with icp equivalents

7. CI workflows — one new file per example

.github/workflows/rust-vetkeys-{example}-example.yml pattern:

name: rust-vetkeys-{example}
on:
  push:
    branches: [master]
  pull_request:
    paths:
      - rust/vetkeys/{example}/**
      - .github/workflows/provision-darwin.sh
      - .github/workflows/provision-linux.sh
      - .github/workflows/rust-vetkeys-{example}-example.yml
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true
jobs:
  {example}-darwin:
    runs-on: macos-15
    steps:
      - uses: actions/checkout@...
      - name: Provision Darwin
        run: bash .github/workflows/provision-darwin.sh
      - name: Pre-download network launcher
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: bash .github/workflows/pre-download-launcher.sh
      - name: Build
        run: |
          pushd rust/vetkeys/{example}/rust
          icp network start --background
          icp deploy
          popd
  {example}-linux:
    runs-on: ubuntu-24.04
    # same steps with provision-linux.sh

Note: basic_timelock_ibe has no rust/ subdir — its CI target path is rust/vetkeys/basic_timelock_ibe directly.

8. READMEs — drop ICP Ninja, update CLI instructions

ICP Ninja support is intentionally dropped when removing dfx.json. Update each README to:

• Remove all icp.ninja launch badges and links
• Replace dfx commands with icp equivalents in local dev instructions

---

Per-example notes

Example	Notes
basic_bls_signing	Baseline — plain TS + Vite
basic_ibe	Same structure
basic_timelock_ibe	Root-level dfx.json, Rust-only (no Motoko backend)
password_manager	No gen_bindings.sh; motoko/backend/icp.yaml already exists — update it
password_manager_with_metadata	Rust backend needs KeyManager API updates for v0.7.0
encrypted_notes_app_vetkd	Rename dir; canister name is encrypted_notes (no dapp → app rename inside); upgrade Svelte 3→4 + Rollup→Vite

[marc0olo]

also, these places need to be updated accordingly:

• https://github.com/dfinity/examples/tree/master/rust/encrypted-notes-dapp-vetkd
• https://github.com/dfinity/examples/tree/master/motoko/encrypted-notes-dapp-vetkd

they can actually be removed as the examples are now sitting in rust/vetkeys.