chore(rust): update vetkeys examples to ic-vetkeys 0.8.1 and @icp-sdk/vetkeys 0.5.0

rust/vetkeys/basic_bls_signing/backend/Cargo.toml

@@ -18,7 +18,7 @@ getrandom = { version = "0.2", features = ["custom"] }
 ic-cdk = "0.20.1"
 ic-cdk-management-canister = "0.1.1"
 ic-stable-structures = "0.6.8"
-ic-vetkeys = "0.7.0"
+ic-vetkeys = "0.8.1"
 serde = "1.0.217"
 serde_bytes = "0.11.15"
 serde_cbor = "0.11.2"

rust/vetkeys/basic_bls_signing/frontend/package.json

@@ -10,7 +10,7 @@
   "dependencies": {
     "@icp-sdk/auth": "^7.1.0",
     "@icp-sdk/core": "^5.4.0",
-    "@icp-sdk/vetkeys": "^0.5.0-beta.0"
+    "@icp-sdk/vetkeys": "^0.5.0"
   },
   "devDependencies": {
     "@icp-sdk/bindgen": "~0.2.2",

rust/vetkeys/basic_ibe/backend/Cargo.toml

@@ -18,7 +18,7 @@ ic-cdk = "0.20.1"
 ic-cdk-management-canister = "0.1.1"
 ic-dummy-getrandom-for-wasm = "0.1.0"
 ic-stable-structures = "0.6.8"
-ic-vetkeys = "0.7.0"
+ic-vetkeys = "0.8.1"
 serde = "1.0.217"
 serde_bytes = "0.11.15"
 serde_cbor = "0.11.2"

rust/vetkeys/basic_ibe/frontend/package.json

@@ -10,7 +10,7 @@
   "dependencies": {
     "@icp-sdk/auth": "^7.1.0",
     "@icp-sdk/core": "^5.4.0",
-    "@icp-sdk/vetkeys": "^0.5.0-beta.0"
+    "@icp-sdk/vetkeys": "^0.5.0"
   },
   "devDependencies": {
     "@icp-sdk/bindgen": "~0.2.2",

rust/vetkeys/basic_timelock_ibe/backend/Cargo.toml

@@ -20,7 +20,7 @@ ic-cdk-management-canister = "0.1.1"
 ic-cdk-timers = "1.0.0"
 ic-dummy-getrandom-for-wasm = "0.1.0"
 ic-stable-structures = "0.6.8"
-ic-vetkeys = "0.7.0"
+ic-vetkeys = "0.8.1"
 serde = "1.0.217"
 serde_bytes = "0.11.15"
 serde_cbor = "0.11.2"

rust/vetkeys/basic_timelock_ibe/frontend/package.json

@@ -26,6 +26,6 @@
   "dependencies": {
     "@icp-sdk/auth": "^7.1.0",
     "@icp-sdk/core": "^5.4.0",
-    "@icp-sdk/vetkeys": "^0.5.0-beta.0"
+    "@icp-sdk/vetkeys": "^0.5.0"
   }
 }

rust/vetkeys/basic_vetkd/frontend/package.json

@@ -10,7 +10,7 @@
   "dependencies": {
     "@icp-sdk/auth": "^7.1.0",
     "@icp-sdk/core": "^5.4.0",
-    "@icp-sdk/vetkeys": "^0.5.0-beta.0"
+    "@icp-sdk/vetkeys": "^0.5.0"
   },
   "devDependencies": {
     "@icp-sdk/bindgen": "~0.2.2",

rust/vetkeys/encrypted_notes_app_vetkd/frontend/package.json

@@ -26,7 +26,7 @@
   "dependencies": {
     "@icp-sdk/auth": "^7.1.0",
     "@icp-sdk/core": "^5.4.0",
-    "@icp-sdk/vetkeys": "^0.5.0-beta.0",
+    "@icp-sdk/vetkeys": "^0.5.0",
     "daisyui": "^1.25.4",
     "idb-keyval": "6.2.1",
     "isomorphic-dompurify": "^2.25.0",

rust/vetkeys/password_manager/Cargo.toml

@@ -6,7 +6,7 @@ resolver = "2"
 ic-cdk = "0.20.1"
 ic-cdk-management-canister = "0.1.1"
 ic-stable-structures = "0.7.0"
-ic-vetkeys = "0.7.0"
+ic-vetkeys = "0.8.1"
 
 [profile.release]
 lto = true

rust/vetkeys/password_manager/README.md

@@ -58,12 +58,24 @@ icp network stop
 
 An **Encrypted Maps**-enabled Rust canister that securely stores passwords.
 
-> **Note.** This backend is hand-written today. An upstream Rust macro that generates an entire Encrypted Maps canister in one line — `ic_vetkeys::export_encrypted_maps_canister!(...)` — is in progress ([dfinity/vetkeys#404](https://github.com/dfinity/vetkeys/pull/404)); it produces the same Candid interface with far less boilerplate.
+> **Note.** The entire canister is generated by the `ic_vetkeys::export_encrypted_maps_canister!(...)` macro: the canister owns the `MemoryManager` and passes Encrypted Maps its four `Memory` instances, and the macro emits the `#[init]`/`#[post_upgrade]` plus every `#[query]`/`#[update]` endpoint. Because the macro is the single source of the endpoint set, the exposed Candid matches what the `@icp-sdk/vetkeys` frontend expects by construction. See [`backend/src/lib.rs`](backend/src/lib.rs). When you need to extend the standard endpoints with your own state or invariants, see the [`password_manager_with_metadata`](../password_manager_with_metadata/) example, which layers per-password metadata on hand-written endpoints.
 
 ### Frontend (`frontend/`)
 
 A **Svelte** application providing a user-friendly interface for managing vaults and passwords. It talks to the backend through the `@icp-sdk/vetkeys` Encrypted Maps client.
 
+#### Derived-key caching
+
+`EncryptedMaps` derives and caches the vetKey material used to encrypt/decrypt values. As of `@icp-sdk/vetkeys` 0.5.0 this cache is **in memory by default** (discarded on page reload). This example opts into cross-reload persistence with `IndexedDbDerivedKeyMaterialCache`, giving the store a **per-identity namespace** (`vetkeys-<principal>`) so one identity's keys are never served to another on the same origin, and it calls `clearCache()` on the `EncryptedMaps` instance on logout to drop the cached material.
+
+**Verifying `clearCache()` on logout.** `clearCache()` *empties* the cache's object store; it does not delete the database, so an empty `vetkeys-<principal>` database remaining in the list is expected (an empty store holds no usable key material). To check it:
+
+1. Open DevTools → **Application → IndexedDB**.
+2. Expand `vetkeys-<principal>` → `derived-key-material`. While logged in and after opening a vault it holds one or more entries; after logout it should hold **0**.
+3. DevTools caches this view — click **Refresh database** after logging out, otherwise stale entries appear to linger.
+
+You will also see an unrelated `icp-sdk-<host>` database (object store `subnetNodeKeys`): that is the agent's cache of public subnet node keys, not key material, and is safe to ignore.
+
 ## Updating the Candid interface
 
 `backend/backend.did` defines the backend's public interface. If you change the backend's public API, regenerate it:

rust/vetkeys/password_manager/backend/backend.did

@@ -1,5 +1,17 @@
-type AccessRights = variant { Read; ReadWrite; ReadWriteManage };
+// Access rights of a user to a vetKey in [`crate::key_manager::KeyManager`] and/or an encrypted map in [`crate::encrypted_maps::EncryptedMaps`].
+type AccessRights = variant {
+  // User can retrieve the vetKey or encrypted map.
+  Read;
+  // User can update values in the encrypted map.
+  ReadWrite;
+  // User can view/share/revoke access to the vetKey or encrypted map.
+  ReadWriteManage;
+};
+// Efficiently serializable and deserializable byte vector that is `Storable` with `ic_stable_structures`.
+// See, e.g., [https://mmapped.blog/posts/01-effective-rust-canisters#serde-bytes](https://mmapped.blog/posts/01-effective-rust-canisters#serde-bytes) for more details regarding why `Vec<u8>` does not work out of the box.
+// Also, we cannot use `serde_bytes::ByteBuf` directly because it is not `Storable`.
 type ByteBuf = record { inner : blob };
+// Represents the complete data for an encrypted map, including ownership, contents, and access control.
 type EncryptedMapData = record {
   access_control : vec record { principal; AccessRights };
   keyvals : vec record { ByteBuf; ByteBuf };