Follow-up: move skills to @icp-sdk/core v6 once the dependency chain supports it

Follow-up to #364, which pins every skill to @icp-sdk/core@^5. This issue tracks flipping them to ^6 — do not action until the chain below is green.

Why we are on ^5

@icp-sdk/core 6.1.0 is published (6.0.0 on 2026-07-06, 6.1.0 on 2026-08-03), but nothing downstream accepts it:

Installing core 6 alongside @icp-sdk/auth is a hard failure:

npm error code ERESOLVE
npm error Found: @icp-sdk/core@6.1.0
npm error Could not resolve dependency:
npm error peer @icp-sdk/core@"^5" from @icp-sdk/auth@8.0.3

Forcing it with --legacy-peer-deps is worse — it installs two copies of core (5.4.0 nested for vetKeys, 6.1.0 at root), so Principal/HttpAgent class identities no longer match across the boundary vetKeys passes them over.

What core 6 actually broke

Not documented in the changelog (it lists only feats). From icp-js-signer#39, which fixed them:

• Agent.readState — first parameter is now InputTargetPrincipal ({ canisterId } | { subnetId }), was Principal | string
• DerEncodedPublicKey narrowed to Uint8Array<ArrayBuffer>
• Delegation gains an optional 4th constructor arg (permissions) — additive, not breaking

The documented API surface our skills use is unaffected: core 6.1.0 still exports ./agent/canister-env, ./principal, safeGetCanisterEnv, HttpAgent.create/createSync. This is purely a dependency-resolution blocker.

Upstream chain (in order)

1. dfinity/icp-js-signer#39 — "feat!: require @icp-sdk/core v6". APPROVED by a member on 2026-07-30, currently CONFLICTING on package-lock.json only, untouched since. Two signer releases have shipped past it (5.6.2 on 2026-08-03, 5.6.3 later) without including it. This is the blocker.
2. @icp-sdk/auth — bump signer to ^6, peer core to ^6. Code search finds 0 uses of readState and 0 of DerEncodedPublicKey; the 6 new Delegation sites are unaffected (4th arg optional). Likely a version bump plus CI.
3. @icp-sdk/vetkeys — bump dep core ^5.4.0 → ^6. No open PR; nobody has started. Same 0/0 result on the breaking symbols.
4. @dfinity/oisy-wallet-signer — currently on ^4, so it needs ^5 first (see #364) and then ^6. Furthest behind.
5. @icp-sdk/bindgen — nothing to do. No core dependency, and its generated output type-checks clean under strict against both 5.4.0 and 6.1.0.

What changes here when it is green

Three files, version strings only:

• skills/icp-cli/references/binding-generation.md — install line + the version note
• skills/icp-cli/references/dfx-migration.md — install line
• skills/icp-cli/SKILL.md:115 — the core wording
• skills/vetkeys/SKILL.md:25 — core ^5.4 → ^6, and @icp-sdk/vetkeys >=0.5 → >=0.6
• skills/wallet-integration/SKILL.md — unpin oisy once it supports the target major

Definition of done

npm i '@icp-sdk/core@^6' @icp-sdk/auth @icp-sdk/vetkeys @icp-sdk/canisters \
      @dfinity/oisy-wallet-signer @dfinity/utils zod

resolves with one copy of @icp-sdk/core at 6.x and no ERESOLVE. Until that command is clean, ^5 stays.

First check the upstream signer, auth, vetkeys, and wallet-signer dependency chain, especially icp-js-signer#39, and wait until it supports core 6. Then update the listed skill files' version strings and run the provided npm install command. Done means resolution succeeds with one @icp-sdk/core 6.x copy and no ERESOLVE.