chore: migrate vetkeys library and toolchain to @icp-sdk/* and icp-cli

[marc0olo]

Summary

• Library migration: Migrates `frontend/ic_vetkeys` from `@dfinity/*` agent packages to `@icp-sdk/core`, updates all canister bindings and type declarations, and documents the breaking constructor change in `CHANGELOG.md`.
• Toolchain migration: Replaces `dfx` with `icp-cli` for the library and backend canister CI (`frontend_ic_vetkeys`, `backend-motoko`, `backend-rust` workflows), provision scripts, `Makefile` targets, and canister project files (`dfx.json` → `icp.yaml`); removes the root-level `dfx.json`. The example workflows still use `dfx` and are migrated separately in chore(examples): migrate all 7 examples to icp-cli and @dfinity/vetkeys #366.
• CI fixes: Use `ICP_CLI_GITHUB_TOKEN` instead of `GITHUB_TOKEN` so `icp network start` / `icp deploy` can fetch the network launcher binary from GitHub without hitting rate limits. Fix workflow self-trigger path (`frontend_ic_vetkeys.yml` → `frontend.yml`).
• Test fixes: Guard against missing canister-id env vars in integration test helpers; fix a pre-existing flaky backend test (`should_access_map_values`) that could fail when two random map keys collided — switched `keyvals` from `Vec` to `BTreeMap` so duplicate inserts update the expected value rather than accumulating stale entries.

Breaking changes

• `DefaultEncryptedMapsClient` and `DefaultKeyManagerClient` constructors now require a pre-built `HttpAgent` (created by the caller with `await HttpAgent.create(...)`) instead of `HttpAgentOptions`. This avoids the deprecated `new HttpAgent(options)` constructor and allows full initialisation (including `fetchRootKey`) before the agent is used. See `CHANGELOG.md` for a migration example.
• `@dfinity/agent`, `@dfinity/auth-client`, and `@dfinity/principal` are replaced by `@icp-sdk/core/agent`, `@icp-sdk/auth/client`, and `@icp-sdk/core/principal`.

Notes

• The `provision-frontend-{linux,darwin}.sh` CI scripts are intentionally temporary — they install `icp-cli` and Rust only for the `frontend_ic_vetkeys` workflow. They will be consolidated once the example workflows are also migrated (tracked in chore(examples): migrate all 7 examples to icp-cli and @dfinity/vetkeys #366).
• Canister declaration files under `src/declarations/` are auto-generated by `@icp-sdk/bindgen` and are not part of the library's public `exports` map. The `createActor` helper they contain is unused by library code; `DefaultEncryptedMapsClient` and `DefaultKeyManagerClient` are the intended public API.

[Copilot]

Pull request overview

Migrates the frontend/ic_vetkeys library from @dfinity/* agent packages to @icp-sdk/*, regenerates canister bindings, and updates the repo toolchain/workflows to use icp-cli instead of dfx.

Changes:

• Replace @dfinity/* JS agent/auth/principal dependencies with @icp-sdk/* equivalents and update frontend canister client construction.
• Regenerate canister declarations/bindings and document the breaking HttpAgent constructor change in the frontend changelog.
• Replace dfx-based project/tooling (configs, Makefiles, CI provisioning) with icp-cli and icp.yaml.

Reviewed changes

Copilot reviewed 37 out of 41 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
package-lock.json	Updates dependency graph to remove @dfinity/* agent deps and add @icp-sdk/core and new transitive deps.
frontend/ic_vetkeys/src/utils/utils.ts	Switches Principal type import to @icp-sdk/core/principal.
frontend/ic_vetkeys/src/key_manager/key_manager_canister.ts	Migrates actor construction to @icp-sdk/core/agent + idlFactory.
frontend/ic_vetkeys/src/key_manager/key_manager_canister.test.ts	Updates identity/agent imports to @icp-sdk/* and adjusts local host port.
frontend/ic_vetkeys/src/key_manager/index.ts	Updates Principal import and adjusts ByteBuf construction behavior.
frontend/ic_vetkeys/src/encrypted_maps/index.ts	Switches Principal import to @icp-sdk/core/principal.
frontend/ic_vetkeys/src/encrypted_maps/encrypted_maps_canister.ts	Migrates actor construction to @icp-sdk/core/agent + idlFactory.
frontend/ic_vetkeys/src/encrypted_maps/encrypted_maps_canister.test.ts	Updates identity/agent imports to @icp-sdk/* and adjusts local host port.
frontend/ic_vetkeys/src/declarations/ic_vetkeys_manager_canister/ic_vetkeys_manager_canister.ts	Adds bindgen-generated TS wrapper for manager canister.
frontend/ic_vetkeys/src/declarations/ic_vetkeys_manager_canister/ic_vetkeys_manager_canister.did.js	Updates generated JS Candid interface for manager canister (bindgen).
frontend/ic_vetkeys/src/declarations/ic_vetkeys_manager_canister/ic_vetkeys_manager_canister.did.d.ts	Updates generated TS Candid types for manager canister (bindgen).
frontend/ic_vetkeys/src/declarations/ic_vetkeys_encrypted_maps_canister/ic_vetkeys_encrypted_maps_canister.ts	Adds bindgen-generated TS wrapper for encrypted maps canister.
frontend/ic_vetkeys/src/declarations/ic_vetkeys_encrypted_maps_canister/ic_vetkeys_encrypted_maps_canister.did.js	Updates generated JS Candid interface for encrypted maps canister (bindgen).
frontend/ic_vetkeys/src/declarations/ic_vetkeys_encrypted_maps_canister/ic_vetkeys_encrypted_maps_canister.did.d.ts	Updates generated TS Candid types for encrypted maps canister (bindgen).
frontend/ic_vetkeys/package.json	Replaces @dfinity/* deps with @icp-sdk/core and migrates test/deploy scripts to icp CLI.
frontend/ic_vetkeys/make_did_bindings.sh	Replaces dfx generate workflow with @icp-sdk/bindgen-based generation.
frontend/ic_vetkeys/CHANGELOG.md	Documents breaking change: canister clients now require a pre-built async HttpAgent.
dfx.json	Removes root-level dfx.json as part of toolchain migration.
backend/rs/canisters/tests/tests/sign_with_bls.rs	Improves diagnostics/robustness around CUSTOM_WASM_PATH loading.
backend/rs/canisters/icp.yaml	Adds new icp.yaml canister project definition for Rust canisters.
backend/rs/canisters/ic_vetkeys_manager_canister/tests/tests.rs	Improves diagnostics/robustness around CUSTOM_WASM_PATH loading.
backend/rs/canisters/ic_vetkeys_manager_canister/dfx.json	Removes Rust canister dfx.json in favor of icp.yaml toolchain.
backend/rs/canisters/ic_vetkeys_manager_canister/Makefile	Adds test target and retains candid extraction flow.
backend/rs/canisters/ic_vetkeys_encrypted_maps_canister/tests/tests.rs	Improves diagnostics/robustness around CUSTOM_WASM_PATH loading.
backend/rs/canisters/ic_vetkeys_encrypted_maps_canister/dfx.json	Removes Rust canister dfx.json in favor of icp.yaml toolchain.
backend/rs/canisters/ic_vetkeys_encrypted_maps_canister/Makefile	Adds test target and adjusts clean to remove .icp/cache.
backend/mo/ic_vetkeys/mops.toml	Pins Motoko compiler toolchain version.
backend/mo/canisters/ic_vetkeys_manager_canister/src/Main.mo	Updates canister to persistent/transient state pattern compatible with updated lib usage.
backend/mo/canisters/ic_vetkeys_manager_canister/mops.toml	Pins Motoko compiler and bumps ic-vetkeys dependency to 0.4.0.
backend/mo/canisters/ic_vetkeys_manager_canister/icp.yaml	Adds icp.yaml project definition for Motoko manager canister.
backend/mo/canisters/ic_vetkeys_manager_canister/dfx.json	Removes Motoko canister dfx.json in favor of icp.yaml.
backend/mo/canisters/ic_vetkeys_manager_canister/Makefile	Switches build/test flow to icp build and .icp/cache/artifacts pathing.
backend/mo/canisters/ic_vetkeys_encrypted_maps_canister/mops.toml	Pins Motoko compiler toolchain version.
backend/mo/canisters/ic_vetkeys_encrypted_maps_canister/icp.yaml	Adds icp.yaml project definition for Motoko encrypted maps canister.
backend/mo/canisters/ic_vetkeys_encrypted_maps_canister/dfx.json	Removes Motoko canister dfx.json in favor of icp.yaml.
backend/mo/canisters/ic_vetkeys_encrypted_maps_canister/Makefile	Switches build/test flow to icp build and .icp/cache/artifacts pathing.
.gitignore	Ignores **/.icp/cache artifacts from icp-cli.
.github/workflows/provision-frontend-linux.sh	Adds CI provisioning script to install icp-cli and Rust on Linux.
.github/workflows/provision-frontend-darwin.sh	Adds CI provisioning script to install icp-cli and Rust on macOS.
.github/workflows/frontend.yml	Updates CI to use Node 22 and new provisioning scripts.
.github/workflows/backend-motoko.yml	Updates CI to use Node 22 and new provisioning scripts for Motoko jobs.

Comments suppressed due to low confidence (2)

frontend/ic_vetkeys/src/key_manager/key_manager_canister.ts:8

• The named imports (_SERVICE, AccessRights, ByteBuf) are being imported as runtime values from ic_vetkeys_manager_canister.did.js, but that module only exports idlFactory and init. In ESM this will throw at module-load time (“does not provide an export named …”). Convert this to a type-only import (e.g., import type { ... } from ...did.js) and keep only idlFactory as a value import, or import the runtime symbols from a module that actually exports them.
  frontend/ic_vetkeys/src/encrypted_maps/index.ts:14
• This module still imports/re-exports AccessRights and ByteBuf from ../declarations/.../ic_vetkeys_manager_canister.did (a Candid .did file), which is not a JS/TS module and will fail to bundle / load (no named exports). Switch these imports to the generated ...ic_vetkeys_manager_canister.did.js module (using import type for type-only symbols) or another generated TS wrapper that actually provides the types.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 41 out of 47 changed files in this pull request and generated 4 comments.

Comments suppressed due to low confidence (1)

frontend/ic_vetkeys/src/key_manager/key_manager_canister.test.ts:27

• newKeyManager reads process.env.CANISTER_ID_IC_VETKEYS_MANAGER_CANISTER (type string | undefined) and passes it directly to DefaultKeyManagerClient, which expects a string. If the env var isn't set (e.g., running this test file standalone), this will fail at runtime with a confusing error. Add an explicit check that throws a clear message when canisterId is missing (or provide a default via the deploy script).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 46 out of 52 changed files in this pull request and generated 1 comment.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.