chore: sync II spec to dfinity/internet-identity release-2026-10-02

.sources/VERSIONS

@@ -39,4 +39,4 @@
 # -------------------------------------------------------
 
 motoko                v1.16.1                                                     01aee06
-internetidentity      release-2026-09-25                                         64ba1637
+internetidentity      release-2026-10-02                                         b9a8aaf4

public/references/internet-identity.did

@@ -304,6 +304,11 @@ type InternetIdentityInit = record {
     // serve the list over plain http. null / opt false (the default) require https
     // for every notifying origin, and a non-loopback origin always requires https.
     notifications_allow_insecure_sender_list : opt bool;
+    // Deploy flag relaxing the https requirement for the Web Push endpoint a
+    // browser registers, for a deployment whose relay is a local server rather
+    // than a push service. As above, only loopback hosts (localhost / 127.0.0.1)
+    // may then be plain http; null / opt false (the default) require https.
+    notifications_allow_insecure_endpoint : opt bool;
     // Configuration for Web Analytics
     analytics_config : opt opt AnalyticsConfig;
     // Configuration to show dapps explorer or not
@@ -339,12 +344,11 @@ type InternetIdentityInit = record {
     // set/clear pattern as `dnssec_config`: null keeps the previously stored
     // value, `opt null` clears it, `opt opt "https://..."` sets it.
     mcp_official_url : opt opt text;
-    // Server-side kill switch for the notifications feature. null / `opt false`
-    // (the default) disables every notification endpoint; `opt true` enables
-    // them. Omitting it on upgrade keeps the stored value.
-    // Apps allowed to notify. Omitted on upgrade keeps the stored list, an empty list
-    // turns notifications off, and entries enable them for those origins only.
-    notifications_enabled_origins : opt vec text;
+    // Server-side switch for the notifications feature. `opt true` enables every
+    // notification endpoint, for any app; `opt false` disables them. Omitting it on
+    // upgrade keeps the stored value, and a canister that never stored one has them
+    // disabled.
+    notifications_enabled : opt bool;
 };
 
 // DNSSEC trust-anchor list. Any feature that needs DNSSEC-verified DNS
@@ -1509,6 +1513,32 @@ type AccountUpdate = record {
     name : opt text;
 };
 
+// An app the identity has signed in to, for the user's own list of their apps. Only
+// apps some account was used at: consent, a named account or a chosen default can each
+// be stored at an app the identity never signed in to.
+type ApplicationInfo = record {
+    // The origin the app's identity is derived for: what its accounts and its
+    // notification consent are stored under.
+    origin : FrontendHostname;
+    // The latest sign-in to any of the identity's accounts at the app.
+    last_used : Timestamp;
+    // Whether the app may notify the identity: it holds consent, and this deployment
+    // notifies for it, as notification_consent_granted answers.
+    notifications_allowed : bool;
+    // When the app last had a notification queued for one of the identity's browsers,
+    // or null where it never has.
+    last_notified : opt Timestamp;
+};
+
+type ListApplicationsRequest = record {
+    anchor_number : UserNumber;
+};
+
+type ListApplicationsError = variant {
+    Unauthorized : principal;
+    InternalCanisterError : text;
+};
+
 type DummyAuthConfig = record {
     // Prompts user for a index value (0 - 255) when set to true,
     // this is used in e2e to have multiple dummy auth identities.
@@ -1907,6 +1937,44 @@ type NotificationDelegationError = variant {
     InternalCanisterError : text;
 };
 
+// ===== Notifications a browser has yet to show =====
+
+type GetNextNotificationRequest = record {
+    anchor_number : UserNumber;
+};
+
+// What a service worker shows for one wake-up: the app and account it is for, the
+// canister holding its content, and which notification.
+type NotificationToShow = record {
+    origin : FrontendHostname;
+    account_number : opt AccountNumber;   // null = the unreserved default account
+    canister_id : principal;
+    id : NotificationId;
+};
+
+// Null once nothing is left to show.
+type GetNextNotificationResponse = record {
+    notification : opt NotificationToShow;
+};
+
+type GetNextNotificationError = variant {
+    // Also a caller that is no browser of the identity.
+    InternalCanisterError : text;
+};
+
+type RemoveNotificationRequest = record {
+    anchor_number : UserNumber;
+    // As browser_get_next_notification returned it.
+    notification : NotificationToShow;
+};
+
+type RemoveNotificationResponse = record {};
+
+type RemoveNotificationError = variant {
+    // Also a caller that is no browser of the identity.
+    InternalCanisterError : text;
+};
+
 service : (opt InternetIdentityInit) -> {
     // Legacy identity management API
     // ==============================
@@ -2185,6 +2253,10 @@ service : (opt InternetIdentityInit) -> {
         origin : FrontendHostname,
     ) -> (variant { Ok : vec AccountInfo; Err: GetAccountsError }) query;
 
+    // Every app the identity holds accounts at, so the user can see where they have
+    // signed in. Authorized by the identity's own access methods.
+    list_applications : (ListApplicationsRequest) -> (variant { Ok : vec ApplicationInfo; Err : ListApplicationsError }) query;
+
     create_account : (
         anchor_number : UserNumber,
         origin : FrontendHostname,
@@ -2391,13 +2463,18 @@ service : (opt InternetIdentityInit) -> {
     prepare_notification_delegation : (PrepareNotificationDelegationRequest) -> (variant { Ok : PrepareNotificationDelegationResponse; Err : NotificationDelegationError });
     get_notification_delegation : (GetNotificationDelegationRequest) -> (variant { Ok : GetNotificationDelegationResponse; Err : NotificationDelegationError }) query;
 
+    // Called by the service worker on a wake-up, signed with the browser key: the oldest
+    // notification its browser has yet to show, passing over the ones it skips.
+    browser_get_next_notification : (GetNextNotificationRequest) -> (variant { Ok : GetNextNotificationResponse; Err : GetNextNotificationError }) query;
+    // Called by the service worker for the one it shows, while it fetches the content.
+    browser_remove_notification : (RemoveNotificationRequest) -> (variant { Ok : RemoveNotificationResponse; Err : RemoveNotificationError });
+
     // Called by the browser itself, signed with the browser key it signs in with.
     set_webpush_subscription : (SetWebPushSubscriptionRequest) -> (variant { Ok; Err : SetWebPushSubscriptionError });
     // Called by the identity, so one browser can silence another.
     remove_webpush_subscription : (RemoveWebPushSubscriptionRequest) -> (variant { Ok; Err : RemoveWebPushSubscriptionError });
     get_webpush_subscription_status : (GetWebPushSubscriptionStatusRequest) -> (opt WebPushSubscriptionStatus) query;
 
-    // Called by an app's backend canister for the origin it names. Not
-    // implemented yet: every call is refused.
+    // Called by an app's backend canister for the origin it names.
     app_send_notification : (SendNotificationArg) -> (variant { Ok : SendNotificationResponse; Err : SendNotificationError });
 };