@arsedizioni/ars-utils 22.5.13 → 22.5.14

package/types/arsedizioni-ars-utils-evolution.common.d.ts

@@ -1,8 +1,9 @@
-import { QueryModel, SendToModel, LoginOAuthType, LoginResult, ApiResult, FolderTree } from '@arsedizioni/ars-utils/core';
+import { QueryModel, SendToModel, ApiResult, FolderTree } from '@arsedizioni/ars-utils/core';
 import { HttpInterceptorFn } from '@angular/common/http';
-import * as rxjs from 'rxjs';
 import * as i0 from '@angular/core';
 import { Signal, WritableSignal } from '@angular/core';
+import * as rxjs from 'rxjs';
+import { Observable } from 'rxjs';
 
 declare const EvolutionMessages: {
     ERROR: string;
@@ -16,19 +17,101 @@ declare const EvolutionMessages: {
     LOGOUT: string;
 };
 
-interface EvolutionLoginResult extends LoginResult<EvolutionUserInfo> {
+/**
+ * Outcome of a login, an MFA confirmation, an account switch or a session restore.
+ *
+ * Aligned with the Evolution `/session/*` API on 2026-08-25, and mirrors
+ * `EVO.API.Models.Requests.LoginResultModel`. It is a plain payload and no longer an envelope of
+ * its own: `EvolutionLoginResult extends LoginResult<EvolutionUserInfo>` inherited `success` and
+ * `message` from `ApiResult<boolean>`, so every answer carried two outcomes -- the transport's and
+ * its own -- and the caller had to know which of the two to read. The API wraps this in
+ * `ApiResult<T>` like every other payload, and that wrapper is the only outcome there is.
+ *
+ * `context` is absent while a login is pending an e-mailed code: nothing about the account is
+ * disclosed before the code has been redeemed. `GET /session/me` answers with this same shape,
+ * built by the same `ResolveSignInContextAsync`, so restoring a session and opening one give an
+ * identical context by construction.
+ */
+interface EvolutionLoginResult {
+    /** The authenticated user with the licence context, or `undefined` while an MFA code is pending. */
+    context?: EvolutionUserInfo;
+    /** Whether a verification code has been e-mailed and must be confirmed through `/session/confirm`. */
+    requiresMfa?: boolean;
+    /**
+     * Whether the stored password has expired and must be changed before the application is usable.
+     *
+     * It replaces `context.isTemporary`, which was read for the same purpose and was always false:
+     * `UserInfo.IsTemporary` is `[NotMapped]` on the API, is never emitted as a claim and was never
+     * filled.
+     */
+    requiresPasswordChange?: boolean;
 }
+/**
+ * The session as this library holds it, persisted so a page refresh has something to validate.
+ *
+ * Two fields went with the new contract, and both were about replaying a login nobody asked for
+ * again:
+ *
+ * - `remember`, the flag behind "Ricordami", which made the API issue an `evolution_remember`
+ *   cookie it could later decrypt the stored password from. `POST /session/login` has no such
+ *   field, the cookie is not written and nothing is replayed: a sign-in always starts from what the
+ *   user just typed. This is why `LoginService.autoLogin` no longer exists -- it was
+ *   a credential-less `login()` that relied on exactly that replay.
+ * - `oauth`, the provider the session was opened with, kept so the client could re-post the
+ *   provider's access token on the next login. The exchange is entirely server-side now, no token
+ *   ever reaches the browser, and once the session cookie exists a provider login is
+ *   indistinguishable from a password one.
+ *
+ * The stored context is a hint, never evidence: the auth cookie is HttpOnly and may have expired
+ * while this outlived it, so `LoginService.initialize` validates it against `/session/me` before
+ * anyone is told there is a session.
+ */
 interface EvolutionLoginInfo {
-    context: EvolutionUserInfo;
-    oauth?: LoginOAuthType;
-    remember?: boolean;
+    /** The licence context of the signed-in user, as returned by the last login, switch or restore. */
+    context?: EvolutionUserInfo;
 }
+/**
+ * The `sessionStorage` key naming which account a tab is working as; its value travels on every
+ * request as `X-Evo-Account`.
+ *
+ * It lives here, and not on `CoreService`, so the auth interceptor can read it without importing a
+ * service: the interceptor is a factory precisely so that registering it does not pull the Evolution
+ * service graph into the eager bundle.
+ */
+declare const EVOLUTION_ACTIVE_ACCOUNT_KEY = "evolution_account";
 interface EvolutionUserLink {
     id?: number;
     userId: number;
     userName?: string;
     key: string;
 }
+/**
+ * The settings an account may change about itself: the dashboard it opens on and its flags.
+ * Mirrors `UpdateUserSettingsModel`; the account is resolved from the session, and the `userId`
+ * is only there for an administrator acting on somebody else.
+ */
+interface EvolutionUpdateUserSettingsModel {
+    userId?: number;
+    dashboard?: string;
+    flags?: number;
+}
+/**
+ * A password change, serving both flows the API supports: the self-service one, which sends
+ * `oldPassword` together with the new one, and the administrator-initiated one, which names the
+ * account instead.
+ */
+interface EvolutionResetPasswordModel {
+    userId?: number;
+    userEmail?: string;
+    password?: string;
+    oldPassword?: string;
+    recaptchaToken?: string;
+}
+/** A password-recovery request: the address to mail the link to, plus the reCAPTCHA that guards it. */
+interface EvolutionRecoverPasswordModel {
+    email?: string;
+    recaptchaToken?: string;
+}
 interface EvolutionUserModuleInfo {
     name: string;
     module: number;
@@ -47,15 +130,36 @@ interface EvolutionLicenceModuleInfo {
     availableOption3?: number;
     usedOption3?: number;
 }
+/**
+ * The signed-in account together with its licence context, as `ResolveSignInContextAsync` builds it
+ * on the API and as every login, switch and restore returns it.
+ *
+ * What this interface does NOT declare is what the Evolution application computes for itself after
+ * a login -- `hasFormazione`, `hasRS`, `expiry`, `expiryInfo` and the rest of the derived
+ * module-accessibility flags. They are not sent by the API and this library does not invent model
+ * fields the wire never carries: a host that wants them derives them from {@link allowedModules},
+ * as the Evolution client does. The licence customization (logo, templates, colours) is left out
+ * for the same reason plus one more: it is a model of its own, and nothing here consumes it.
+ */
 interface EvolutionUserInfo {
     licenceId: number;
     userId: number;
+    /** The place (subject / site / department) the account is scoped to, when it is scoped at all. */
+    placeId?: number;
     companyName: string;
+    /** Relative path of the licence logo, when the licence carries a customization. */
+    companyLogo?: string;
     firstName: string;
     fullName: string;
     flags?: number;
     email: string;
     sessionId?: string;
+    /**
+     * @deprecated Always false. `UserInfo.IsTemporary` is `[NotMapped]` on the API, is never
+     * emitted as a claim and is never filled; an expired password is reported by
+     * {@link EvolutionLoginResult.requiresPasswordChange}. Kept only so a consumer still reading it
+     * keeps compiling.
+     */
     isTemporary?: boolean;
     role: number;
     scope: number;
@@ -72,7 +176,11 @@ interface EvolutionUserInfo {
     siteCostCenter?: string;
     departmentId?: number;
     departmentName?: string;
-    expiryDate?: string;
+    /**
+     * When the licence expires. A `Date` and not a `string`: the API sends an ISO timestamp and the
+     * HTTP date interceptor is what turns it into a date, exactly as it does for every other model.
+     */
+    expiryDate?: Date;
     isExpired?: boolean;
     isAdministrator?: boolean;
     isPowerUser?: boolean;
@@ -80,12 +188,27 @@ interface EvolutionUserInfo {
     isUser?: boolean;
     isSupportUser?: boolean;
     isGod?: boolean;
-    administrators: string;
+    /** Whether the licence has the AI assistant available at all. */
+    isMcpAvailable?: boolean;
+    /** Whether this account may use it. */
+    isMcpEnabled?: boolean;
+    /** Whether the licence also has the orchestrator; its connection details stay on the host. */
+    isMcpOrchestratorAvailable?: boolean;
+    /** The operator this account is bound to, for the applications that work by operator. */
+    operatorId?: number;
+    /** Whether the licence carries a customization (logo, mail templates, colours). */
+    hasCustomization?: boolean;
+    administrators?: string;
     availableModules: EvolutionLicenceModuleInfo[];
+    availableUsers: number;
+    usedUsers: number;
     availableEmployees: number;
     usedEmployees: number;
     availableStorage: number;
     usedStorage: number;
+    availableOption1?: number;
+    availableOption2?: number;
+    availableOption3?: number;
 }
 declare enum EvolutionServiceFlags {
     None = 0,
@@ -703,9 +826,30 @@ interface EvolutionComplianceActivitiesAddParams extends EvolutionComplianceActi
 /**
  * Builds the Evolution auth HTTP interceptor.
  *
- * Takes its two inputs — the Evolution base URI and the service flags — directly
- * as arguments (captured in the closure), so it never injects EvolutionService:
- * registering it does not pull the full Evolution service into the eager bundle.
+ * Attaches the credentials, the service-worker bypass and the active-account header to every
+ * request aimed at the Evolution API, and turns HTTP failures into broadcast messages -- no UI
+ * dependency here.
+ *
+ * Takes the Evolution base URI and the service flags directly as arguments, captured in the
+ * closure, so it never injects `EvolutionService`: registering it does not pull the whole Evolution
+ * service into the eager bundle. The debounce and the expiry latch live in that same closure, so
+ * two applications registering two interceptors never share them.
+ *
+ * ## What the statuses mean
+ *
+ * Aligned with the Evolution API on 2026-08-25. The meaning of the status codes changed with it:
+ * failures used to arrive as `200 OK` with `success: false`, and a dead session had to be guessed
+ * from a 405, a 410 or any 5xx. Now the status is the truth -- a 401 on an already-authenticated
+ * request means the session is gone, a 403 means the permission is missing, a 5xx means the server
+ * broke, and those are three different things that used to be one. `invalidateSession` is
+ * therefore now, and only, a 401 outside the authentication endpoints.
+ *
+ * `EvolutionServiceFlags.NotifySystemErrors` still governs one narrow case, and only that one: a
+ * 5xx, i.e. a failure of the server rather than of the request. Without the flag it is swallowed,
+ * as it always was in this library.
+ *
+ * Errors are re-thrown rather than swallowed: call sites rely on their `error` callback firing, and
+ * on `finalize` clearing a busy dialog.
  *
  * Register it with `withInterceptors`:
  * @example
@@ -721,11 +865,35 @@ interface EvolutionComplianceActivitiesAddParams extends EvolutionComplianceActi
 declare function evolutionAuthInterceptor(serviceUri: string, flags?: EvolutionServiceFlags): HttpInterceptorFn;
 
 /**
- * Authentication service for the Evolution module: login / logout / MFA,
- * session bootstrap, connectivity ping and the broadcast handler.
- * All session state lives in the private {@link CoreService}; this service
- * orchestrates the HTTP flows and re-publishes the parts of core that
- * consumers need.
+ * Authentication for the Evolution back end: password login, e-mailed code confirmation, account
+ * switch, logout and session restore. All session state lives in the private {@link CoreService};
+ * this service orchestrates the HTTP flows and re-publishes the parts of core that consumers need.
+ *
+ * Aligned with the Evolution API on 2026-08-25. Everything goes through `/session/*` and an
+ * HttpOnly cookie now: there is no bearer token, no `remember` credential the API can replay, and
+ * no provider token acquired by the caller -- the external-provider flow is a full-page redirect
+ * handled server-side, and all that reaches this service is the `/session/me` call on the way back.
+ *
+ * ## What this service no longer offers, and why
+ *
+ * - **`autoLogin`.** It was `login(undefined, undefined, true)`: a credential-less sign-in that
+ *   worked only because the API could decrypt a stored password from an `evolution_remember`
+ *   cookie. `POST /session/login` takes a user and a password and nothing else.
+ * - **`autoLogout`.** It wrapped {@link logout} in toasts and a callback, and ran the callback
+ *   from `complete` -- that is, before the request it was waiting for had said anything. A host
+ *   that wants a callback subscribes: `logout().subscribe(() => …)`.
+ * - **re-login on `LOGIN_CHANGED`.** The handler used to answer that message with a silent
+ *   `autoLogin`, which is the same replay by another name. The message is still broadcast by hosts
+ *   that link and unlink Evolution, and it is theirs to act on; this library no longer signs
+ *   anybody in without being asked.
+ * - **the OAuth `Authorization` header, and the per-tab `X-Client-Id`.** The first is server-side
+ *   now; the second was a random UUID that gave every tab a session cookie of its own. A tab says
+ *   which of the accounts in the one cookie it is working as with `X-Evo-Account`, written by
+ *   {@link CoreService.setActiveAccount}.
+ *
+ * This is a deliberately reduced subset of what the Evolution application itself does: passkeys and
+ * the provider redirect are not here. A library whose job is to let another application talk to
+ * Evolution signs in with a password; an application that offers the other ways in owns them.
  */
 declare class LoginService {
     private readonly httpClient;
@@ -733,6 +901,15 @@ declare class LoginService {
     private readonly destroyRef;
     private readonly core;
     private broadcastInitialized;
+    /**
+     * The address the pending login was started with, kept so {@link confirmIdentity} can send it
+     * along with the code.
+     *
+     * The API stores each verification code under the account it was issued to, so a code alone is
+     * not redeemable -- which is what stops a guessed code from opening whatever login happens to be
+     * pending.
+     */
+    private pendingLoginEmail?;
     /**
      * Gets the base URI of the Evolution back-end service.
      * @returns The configured service URI, or undefined before initialize().
@@ -748,9 +925,14 @@ declare class LoginService {
      * @returns The current {@link EvolutionLoginInfo}, or undefined.
      */
     get loginInfo(): EvolutionLoginInfo | undefined;
-    /** `true` when the user has an active (non-temporary) session. */
+    /**
+     * Gets the signed-in account with its licence context.
+     * @returns The current {@link EvolutionUserInfo}, or undefined when there is no session.
+     */
+    get user(): EvolutionUserInfo | undefined;
+    /** `true` when this browser has a session the API has accepted. */
     get loggedIn(): Signal<boolean>;
-    /** `true` while a login request is in flight. */
+    /** `true` while an authentication is in flight. */
     get loggingIn(): WritableSignal<boolean>;
     /**
      * Persists the current login info to `localStorage` (delegates to core).
@@ -769,14 +951,20 @@ declare class LoginService {
      */
     reset(): void;
     /**
-     * Removes Evolution session data and resets the state (delegates to core).
-     * @param clearOAuthToken - When true, also removes the stored OAuth2 access token.
+     * Clears every trace of the session on this device without asking the API anything
+     * (delegates to core). Use {@link logout} for a real sign-out.
      * @returns void
      */
-    clear(clearOAuthToken?: boolean): void;
+    clear(): void;
     /**
-     * Initialises the service with the back-end URI and optional feature flags.
-     * Must be called once during application bootstrap before any other method.
+     * Initialises the service with the back-end URI and optional feature flags, and revalidates a
+     * session that survived a page refresh instead of assuming it is still there.
+     *
+     * Must be called once during application bootstrap, before any other method. What it used to do
+     * on a refresh was announce `LOGIN_COMPLETED` on the strength of a value in local storage; the
+     * auth cookie is HttpOnly and may have expired while that value lived on, so the claim was never
+     * verified and the consumer met the inevitable 401 as "your session just expired" rather than as
+     * a bootstrap that never got off the ground.
      * @param serviceUri - Base URL of the Evolution service.
      * @param flags - Bitmask of `EvolutionServiceFlags` (default: `None`).
      * @returns void
@@ -789,56 +977,102 @@ declare class LoginService {
      */
     private handleBroadcastMessage;
     /**
-     * Sends a one-shot ping to the back end to verify connectivity.
+     * Sends a one-shot ping to the back end to verify connectivity. Errors are swallowed.
      * @returns void
      */
     ping(): void;
     /**
-     * Performs an automatic login using the credentials already stored in the session.
-     * @param onSuccess - Optional callback invoked after a successful login.
-     * @returns `true` (always) — the result is handled via the subscription callbacks.
+     * Authenticates the user with an e-mail address and a password, the only credentials
+     * `POST /session/login` accepts.
+     *
+     * On success the session cookie is issued and the context stored, unless the API answers
+     * `requiresMfa`: the device is not a trusted one, a six-digit code has been e-mailed and nothing
+     * about the account is disclosed until {@link confirmIdentity} redeems it.
+     *
+     * A failure is no longer a `200 OK` carrying `success: false`. Wrong credentials come back as a
+     * real 4xx with the message in the envelope, so the `next` branch of the caller is never reached.
+     * @param email - The user's e-mail address.
+     * @param password - The user's password.
+     * @returns An observable that emits the `ApiResult<EvolutionLoginResult>`.
      */
-    autoLogin(onSuccess?: () => void): boolean;
+    login(email?: string, password?: string): Observable<ApiResult<EvolutionLoginResult>>;
     /**
-     * Performs an automatic logout, notifying the user when the session ends.
-     * @param onSuccess - Optional callback invoked after the logout completes.
-     * @returns void
+     * Confirms a pending e-mailed code challenge, which establishes the session and marks this device
+     * as trusted: the next sign-in from it will not ask for a code again.
+     *
+     * The address travels with the code, in the body. The API stores each code under the account it
+     * was issued to, so naming the account is part of redeeming it; and a code in the body is a code
+     * that stays out of the URL, where `POST /login/confirm/{code}` left it for the access logs and
+     * the browser history to keep.
+     * @param code - The one-time confirmation code provided to the user.
+     * @param email - The address the code was sent to; defaults to the one the pending login started with.
+     * @returns An observable that emits the `ApiResult<EvolutionLoginResult>`.
      */
-    autoLogout(onSuccess?: () => void): void;
+    confirmIdentity(code: string, email?: string): Observable<ApiResult<EvolutionLoginResult>>;
     /**
-     * Authenticates the user against the Evolution back end (credential or OAuth2).
-     * @param email - User e-mail (credential login only; omit for OAuth2).
-     * @param password - User password (credential login only; omit for OAuth2).
-     * @param remember - Whether to persist the session across browser restarts.
-     * @param oauth - OAuth2 provider type, when using federated login.
-     * @param oauthAccessToken - Bearer token from the OAuth2 provider.
+     * Reads the current session from the server, which resolves it from the auth cookie's claims.
+     * Used to restore the state after a page refresh instead of trusting what local storage holds.
+     *
+     * The route answers with the same `EvolutionLoginResult` a login answers with, built by the same
+     * `ResolveSignInContextAsync`, so a restored session and a fresh one are identical by
+     * construction.
      * @returns An observable that emits the `ApiResult<EvolutionLoginResult>`.
      */
-    login(email?: string, password?: string, remember?: boolean, oauth?: LoginOAuthType, oauthAccessToken?: string | undefined): rxjs.Observable<ApiResult<EvolutionLoginResult>>;
+    me(): Observable<ApiResult<EvolutionLoginResult>>;
     /**
-     * Finalises a successful login by updating the stored context and notifying consumers.
-     * @param result - The login result payload from the server.
+     * Asks `/session/me` whether the restored session is still alive, and announces the login when it
+     * is.
+     *
+     * Nothing is cleared on failure, and that is deliberate: a failure here is not proof of a dead
+     * session -- the API may be unreachable, the proxy may have answered 502, the device may be
+     * offline -- and clearing on any of those would sign the user out with a perfectly valid cookie.
+     * A genuine 401 is a different matter and the interceptor has already reported it.
      * @returns void
      */
-    private completeLogin;
+    private restoreSession;
     /**
-     * Confirms a multi-factor authentication challenge and completes the login.
-     * @param code - The one-time MFA code entered by the user.
+     * Switches this tab to another account of the same person -- same address, same stored password
+     * -- without re-entering credentials.
+     *
+     * The account being left stays open: a switch used to close its session, because each account had
+     * a cookie of its own, and they now share one cookie holding several. What changes here is only
+     * which account THIS tab names on its requests, which {@link completeLogin} records.
+     * @param id - The user ID to switch to.
      * @returns An observable that emits the `ApiResult<EvolutionLoginResult>`.
      */
-    confirmIdentity(code: string): rxjs.Observable<ApiResult<EvolutionLoginResult>>;
+    loginSwitch(id: number): Observable<ApiResult<EvolutionLoginResult>>;
     /**
-     * Logs the current user out of the back end and clears local session data.
-     * @param forget - When `true`, instructs the server to discard all stored credentials.
+     * Signs out: closes this browser's session on the API and clears the local state whatever the
+     * answer, since there is nothing useful to do with a logout that failed.
+     *
+     * `forget` no longer means "drop the stored credentials" -- there are none to drop. It means
+     * "stop trusting this device", that is clear the MFA cookie, so that the next sign-in from here
+     * is challenged with an e-mailed code again. It also closes one session and not all of them: an
+     * account may hold one per front end, and signing out of this browser must not sign the person
+     * out of their phone.
+     * @param forget - When `true`, the device stops being a trusted one. Defaults to `false`.
      * @returns An observable that emits `ApiResult<unknown>`.
      */
-    logout(forget?: boolean): rxjs.Observable<ApiResult<unknown>>;
+    logout(forget?: boolean): Observable<ApiResult<unknown>>;
     /**
-     * Switches the active session to a different user account while retaining credentials.
-     * @param id - The user ID to switch to.
-     * @returns An observable that emits the `ApiResult<EvolutionLoginResult>`.
+     * Finalises a login, a code confirmation, an account switch or a session restore: stores the
+     * context, raises the logged-in signal, records which account this tab is working as and
+     * optionally announces `LOGIN_COMPLETED`.
+     *
+     * `loggedIn` is raised unconditionally. It used to be `!result.context?.isTemporary`, and
+     * `isTemporary` was always false -- it is `[NotMapped]` on the API and never filled -- so the
+     * condition never did anything. An expired password is reported by `requiresPasswordChange` and
+     * does not mean there is no session: the cookie has been issued, and it is what the password
+     * change itself travels on.
+     *
+     * `loggingIn` is deliberately left alone. Whoever raised it lowers it -- {@link restoreSession}
+     * for a refresh, the host application for its own sign-in flow -- because lowering it here would
+     * drop the host's splash the instant the response arrived, before anything was on screen.
+     * @param result - The login result payload from the server.
+     * @param notify - Whether to broadcast `LOGIN_COMPLETED`. Defaults to `true`.
+     * @returns void
      */
-    loginSwitch(id: number): rxjs.Observable<ApiResult<EvolutionLoginResult>>;
+    private completeLogin;
     static ɵfac: i0.ɵɵFactoryDeclaration<LoginService, never>;
     static ɵprov: i0.ɵɵInjectableDeclaration<LoginService>;
 }
@@ -904,7 +1138,15 @@ declare class ComplianceService {
     static ɵprov: i0.ɵɵInjectableDeclaration<ComplianceService>;
 }
 
-/** Account endpoints (the `Links` section): user links management. */
+/**
+ * The `/account/*` endpoints: the links a user account carries, its settings, its password and the
+ * licence behind it.
+ *
+ * Everything here acts on the account the session names, which is why none of these methods takes
+ * one. The licence refresh is the exception in appearance only: the id in the route is ignored by
+ * the API, which reads the account from the session -- it used to be taken at face value, with no
+ * authorization at all, so any integer returned somebody else's company and expiry.
+ */
 declare class AccountService {
     private readonly httpClient;
     private readonly core;
@@ -920,6 +1162,34 @@ declare class AccountService {
      * @returns An observable that emits `ApiResult<boolean>`.
      */
     deleteLink(item: EvolutionUserLink): rxjs.Observable<ApiResult<boolean>>;
+    /**
+     * Persists updated settings for the signed-in account (dashboard, flags).
+     * @param params - The settings to save.
+     * @returns An observable that emits `ApiResult<boolean>`.
+     */
+    updateSettings(params: EvolutionUpdateUserSettingsModel): rxjs.Observable<ApiResult<boolean>>;
+    /**
+     * Changes a password: the signed-in account's own, with `oldPassword`, or somebody else's when an
+     * administrator names it.
+     * @param params - The password change to apply.
+     * @returns An observable that emits `ApiResult<boolean>`.
+     */
+    resetPassword(params: EvolutionResetPasswordModel): rxjs.Observable<ApiResult<boolean>>;
+    /**
+     * Starts a password recovery, which mails a reset link to the given address.
+     * @param params - The address to recover, with the reCAPTCHA token that guards the route.
+     * @returns An observable that emits `ApiResult<boolean>`.
+     */
+    recoverPassword(params: EvolutionRecoverPasswordModel): rxjs.Observable<ApiResult<boolean>>;
+    /**
+     * Re-reads the licence of the signed-in account: company, expiry, quotas and allowed modules.
+     *
+     * Does NOT update the stored context: what the caller does with a fresh licence -- refresh a
+     * settings page, recompute a quota, store it -- is the caller's business, and a service that
+     * quietly rewrote the session context under it would be doing more than it was asked.
+     * @returns An observable that emits `ApiResult<EvolutionUserInfo>`.
+     */
+    refreshLicence(): rxjs.Observable<ApiResult<EvolutionUserInfo>>;
     static ɵfac: i0.ɵɵFactoryDeclaration<AccountService, never>;
     static ɵprov: i0.ɵɵInjectableDeclaration<AccountService>;
 }
@@ -962,9 +1232,18 @@ declare class EvolutionService {
      * @returns The current {@link EvolutionLoginInfo}, or undefined.
      */
     get loginInfo(): EvolutionLoginInfo | undefined;
-    /** `true` when the user has an active (non-temporary) session. */
+    /**
+     * Gets the signed-in account with its licence context.
+     * @returns The current {@link EvolutionUserInfo}, or undefined when there is no session.
+     */
+    get user(): EvolutionUserInfo | undefined;
+    /**
+     * `true` when this browser has a session the API has accepted. It starts from the stored context
+     * and is confirmed -- or left to the interceptor's 401 handling -- by the `/session/me` call
+     * {@link initialize} makes.
+     */
     get loggedIn(): Signal<boolean>;
-    /** `true` while a login request is in flight. */
+    /** `true` while an authentication is in flight. */
     get loggingIn(): WritableSignal<boolean>;
     /**
      * Initialises the service with the back-end URI and optional feature flags.
@@ -982,5 +1261,5 @@ declare class EvolutionService {
     static ɵprov: i0.ɵɵInjectableDeclaration<EvolutionService>;
 }
 
-export { AccountService, ComplianceService, ERPComplianceActivityState, ERPComplianceLawOrigin, ERPComplianceLawState, ERPComplianceLawsSelectionType, ERPComplianceNotificationLimit, ERPComplianceProfileFlags, ERPComplianceProfileRole, ERPComplianceRegisterNotificationType, ERPComplianceRegisterSiteImportOptions, ERPComplianceScope, ERPExportFormat, ERPExportPart, ERPExportSource, ERPExportType, ERPModule, ERPPlace, ERPPlacePermission, ERPRecurrenceFrequencyType, EvolutionComplianceActivityStates, EvolutionComplianceContextInfo, EvolutionComplianceLawChangeStates, EvolutionComplianceLawOrigins, EvolutionComplianceLawStates, EvolutionComplianceNotificationLimits, EvolutionComplianceNotifications, EvolutionComplianceObligationAuthorities, EvolutionComplianceObligationTypes, EvolutionComplianceProfileFlags, EvolutionComplianceProfileRoles, EvolutionComplianceScopes, EvolutionMessages, EvolutionRecurrenceFrequencyTypes, EvolutionService, EvolutionServiceFlags, LoginService, evolutionAuthInterceptor };
-export type { ComplianceRegisterUsersResultModel, EvolutionChangeContextModel, EvolutionChangeContextResultModel, EvolutionComplianceActivitiesAddParams, EvolutionComplianceActivity, EvolutionComplianceLaswExportParams, EvolutionComplianceLaw, EvolutionComplianceLawDocumentInfo, EvolutionComplianceLawReference, EvolutionComplianceLawsAddParams, EvolutionComplianceRegister, EvolutionComplianceRegisterProfile, EvolutionComplianceRegisterSite, EvolutionContextInfo, EvolutionExportModel, EvolutionLicenceModuleInfo, EvolutionLoginInfo, EvolutionLoginResult, EvolutionPermission, EvolutionPlacePermission, EvolutionPlaceable, EvolutionQueryRegisterProfilesModel, EvolutionRegisterProfileSiteInfo, EvolutionRegisterProfileUserInfo, EvolutionUserInfo, EvolutionUserLink, EvolutionUserModuleInfo };
+export { AccountService, ComplianceService, ERPComplianceActivityState, ERPComplianceLawOrigin, ERPComplianceLawState, ERPComplianceLawsSelectionType, ERPComplianceNotificationLimit, ERPComplianceProfileFlags, ERPComplianceProfileRole, ERPComplianceRegisterNotificationType, ERPComplianceRegisterSiteImportOptions, ERPComplianceScope, ERPExportFormat, ERPExportPart, ERPExportSource, ERPExportType, ERPModule, ERPPlace, ERPPlacePermission, ERPRecurrenceFrequencyType, EVOLUTION_ACTIVE_ACCOUNT_KEY, EvolutionComplianceActivityStates, EvolutionComplianceContextInfo, EvolutionComplianceLawChangeStates, EvolutionComplianceLawOrigins, EvolutionComplianceLawStates, EvolutionComplianceNotificationLimits, EvolutionComplianceNotifications, EvolutionComplianceObligationAuthorities, EvolutionComplianceObligationTypes, EvolutionComplianceProfileFlags, EvolutionComplianceProfileRoles, EvolutionComplianceScopes, EvolutionMessages, EvolutionRecurrenceFrequencyTypes, EvolutionService, EvolutionServiceFlags, LoginService, evolutionAuthInterceptor };
+export type { ComplianceRegisterUsersResultModel, EvolutionChangeContextModel, EvolutionChangeContextResultModel, EvolutionComplianceActivitiesAddParams, EvolutionComplianceActivity, EvolutionComplianceLaswExportParams, EvolutionComplianceLaw, EvolutionComplianceLawDocumentInfo, EvolutionComplianceLawReference, EvolutionComplianceLawsAddParams, EvolutionComplianceRegister, EvolutionComplianceRegisterProfile, EvolutionComplianceRegisterSite, EvolutionContextInfo, EvolutionExportModel, EvolutionLicenceModuleInfo, EvolutionLoginInfo, EvolutionLoginResult, EvolutionPermission, EvolutionPlacePermission, EvolutionPlaceable, EvolutionQueryRegisterProfilesModel, EvolutionRecoverPasswordModel, EvolutionRegisterProfileSiteInfo, EvolutionRegisterProfileUserInfo, EvolutionResetPasswordModel, EvolutionUpdateUserSettingsModel, EvolutionUserInfo, EvolutionUserLink, EvolutionUserModuleInfo };