@nauticana/sail 1.1.11 → 1.1.13

package/README.md

@@ -4,7 +4,7 @@ A shared Angular component library for building CRUD-based admin frontends. Prov
 
 > **Compatibility:** sail and keel are versioned in lock-step. The current line is **sail v1.1.x ↔ keel v1.2.x** (sail v1.1.9 needs keel v1.2.16 for the OAuth-connect layer). Earlier lines: **sail v0.5.x ↔ keel v0.5.x**, **sail v0.6.x / v0.7.x ↔ keel v0.7.x**, **sail v0.8.x ↔ keel v0.8.x**, **sail v0.9.x ↔ keel v0.9.x**. Newer sail releases extend the contract — older keel servers reject unknown endpoints with HTTP 404 / 400. The v0.8.x line additionally ships the `table_action` framework (per-table custom buttons surfaced in `TableList` / `TableSearch` / `TableEdit` / `TableDetail`); see the [Migrating to v0.7.0 §5 — TableAction](#migrating-to-v070--payout-user-payment-methods-table-actions) section for the seed shape (basis `table_action` + `authorization_object` + `authorization_object_action` rows) and the [keel/README Table Actions](https://github.com/nauticana/keel#table-actions) section for backend wiring via `handler.WrapTableAction`.
 
-**Recent additions:** `BaseAuthService.acceptToken(jwt)` — adopt an externally-minted JWT (registration / SSO-handoff flows) and run the full post-login sequence (store under the canonical `jwt` key, load appdata, init routes); apps must use this instead of writing `localStorage` directly. `BaseRestService.analytic<T>(endpoint, params?)` — GET a keel `analytic/<endpoint>` report and return its rows.
+**Recent additions:** `BaseAuthService.acceptToken(jwt)` — adopt an externally-minted JWT (registration / SSO-handoff flows) and run the full post-login sequence (store under the canonical `jwt` key, load appdata, init routes); apps must use this instead of writing `localStorage` directly. `BaseRestService.analytic<T>(endpoint, params?)` — GET a keel `analytic/<endpoint>` report and return its rows. `passwordPolicyValidator` + `BaseAuthService.ensurePasswordPolicy()` — validate passwords against keel's policy (via `SailGuiConfig.passwordPolicyUrl`); see Configuration reference.
 
 > **v1.1.10 is a breaking release.** The base classes migrated to signals (`records()`, `editableRecord()`, `isNew()` …), `login()`/`loginWithGoogle()` now return Observables, CRUD errors are typed `SailApiError`, `BaseView` split into read-only `BaseView` + `AbstractEditableView`, the decorators are renamed `IsSailString`/`IsSailNumeric`, and `configureRestUrls()` is finally safe to call from a subclass constructor. The complete old→new mapping is machine-readable in [`migration_guide.json`](migration_guide.json). Consumers must fully migrate before pushing to test or prod.
 
@@ -273,13 +273,24 @@ interface SailGuiConfig {
   googleClientId?: string;            // Google Identity Services client ID
   appleServiceId?: string;            // Apple Services ID
   appleRedirectUri?: string;          // Apple Sign-In redirect URI
-  privacyPolicyUrl?: string;          // Linked from ConsentGateComponent
+  privacyPolicyUrl?: string;          // Linked from ConsentGateComponent and the login footer
+  termsUrl?: string;                  // Linked from the SMS-consent disclosure and the login footer
   defaultPolicyVersion?: string;      // Content hash of the deployed policy
   defaultPolicyLanguage?: string;     // ISO 639-1 fallback language
   accountDeletedRoute?: string;       // Route after account deletion (default '/login/local')
+  passwordPolicyUrl?: string;         // Public route serving keel's password policy (see below)
 }
 ```
 
+### Password-policy validation
+
+Set `passwordPolicyUrl` to the app's public route for keel's `PublicHandler.GetPasswordPolicy`
+(e.g. `'/public/v1/auth/password/policy'`). `BaseAuthService.ensurePasswordPolicy()` fetches it
+once into the `passwordRules` signal, and `passwordPolicyValidator(() => auth.passwordRules())`
+validates new-password inputs against the real policy before submit (`passwordPolicyHint(rules)`
+builds the matching hint text). Built into `chpass` / `confirm-chpass`; reuse in app signup forms.
+Omit the URL to skip client-side policy checks. The server stays the authoritative gate.
+
 ## Backend endpoints (keel v1.0)
 
 | Endpoint | Purpose |
@@ -1128,8 +1139,8 @@ The v0.6 / v0.7 line introduced three additive feature groups against keel v0.7.
 
 | From | Export | Purpose |
 |---|---|---|
-| `@nauticana/sail` | `PayoutService` | keel/payout API client — hosted-KYC launch, reuse flow, status |
-| `@nauticana/sail` | `PayoutProviderOnboardingComponent` (`<sail-payout-provider-onboarding>`) | Drop-in onboarding step with reuse picker + hosted-KYC launcher |
+| `@nauticana/sail` | `PayoutService` | keel/payout API client — onboarding, reuse, status, bank-version replacement, beneficiary registration |
+| `@nauticana/sail` | `PayoutProviderOnboardingComponent` (`<sail-payout-provider-onboarding>`) | Drop-in onboarding step with reuse picker, hosted-KYC handoff, and asynchronous-confirmation output |
 | `@nauticana/sail` | `PayoutBankInfoFormComponent` (`<sail-payout-bank-info-form>`) | Tax + payout details form (country / currency / tax ID / billing address / agreement) |
 | `@nauticana/sail` | `UserPaymentMethodService` | Saved-card list / delete / set-default API client |
 | `@nauticana/sail` | `UserPaymentMethodsComponent` (`<sail-user-payment-methods>`) | List of saved cards/wallets with set-default + delete |
@@ -1141,10 +1152,12 @@ Make sure your keel deployment exposes these — they're all under `/api/v1/`:
 
 | Endpoint | Method | Purpose |
 |---|---|---|
-| `/api/v1/payout/onboard/start` | POST | Open hosted-KYC; returns `{ url, externalAccountId, expiresAt }` |
+| `/api/v1/payout/onboard/start` | POST | Start provider onboarding; returns `{ url, externalAccountId, expiresAt }` (`url` is empty when confirmation continues asynchronously) |
 | `/api/v1/payout/reusable` | POST | List provider accounts the user has on other partners |
 | `/api/v1/payout/reusable/link` | POST | Copy a `providerAccountId` onto the active partner's `user_bank_info` row |
 | `/api/v1/payout/status` | POST | `{ complete: true }` once the active partner's row has a `providerAccountId` |
+| `/api/v1/payout/bank/replace` | POST | Supersede the active bank-info version and insert its replacement atomically; the app must wire the handler's `SealTaxID` hook |
+| `/api/v1/payout/beneficiary/register` | POST | Create and link a provider beneficiary from provider-collected details |
 | `/api/v1/payment-methods/set-default` | POST | Atomic multi-row UPDATE — sets one row as default, clears the rest |
 | `/api/v1/{table}/{action_name}` | POST | Per-table custom actions resolved from `basis.table_action` |
 
@@ -1166,6 +1179,7 @@ Drop the two components into a wizard step. Routing between them stays in the co
     <sail-payout-provider-onboarding
         (linked)="step.set('done')"
         (started)="step.set('waiting')"
+        (pending)="step.set('awaiting-confirmation')"
         (skipped)="step.set('done')"
         (back)="step.set('bank')">
     </sail-payout-provider-onboarding>
@@ -1173,7 +1187,9 @@ Drop the two components into a wizard step. Routing between them stays in the co
 }
 ```
 
-`BankInfoFormValue` maps 1:1 to `basis.user_bank_info` columns. The consumer decides where to POST it — typically a direct generic-CRUD insert against `/api/v1/user_bank_info`. The provider account itself is created by `<sail-payout-provider-onboarding>` via `PayoutService.startOnboarding()` → hosted KYC → webhook back to keel.
+`BankInfoFormValue` is application-layer input, not a generic-CRUD row. In particular, its plaintext `taxId` must be sealed into the `tax_id_encrypted` column and must never be sent through the generic `/api/v1/user_bank_info` CRUD surface. First-time setup goes through the consuming app's registration service. Changes to an existing destination use `PayoutService.replaceBankInfo()`, which calls keel's atomic version-replacement endpoint; wire `PayoutHandler.SealTaxID` so that endpoint seals the plaintext before persistence.
+
+`PayoutService.startOnboarding()` returns a `PayoutOnboardingSession`. When `url` is non-empty, the component emits `started` and navigates to the provider's hosted flow. When `url` is empty, as with Wise email recipients, it emits `pending` instead; consumers must show an awaiting-confirmation state while the recipient completes the provider's email flow. Airwallex apps can pass details collected by the embedded beneficiary component to `PayoutService.registerBeneficiary()`.
 
 For apps that operate on a single keel partner, the reuse picker stays empty and only the "Start onboarding" CTA renders. Multi-partner apps get the picker for free.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nauticana/sail",
-  "version": "1.1.11",
+  "version": "1.1.13",
   "description": "Metadata-driven Angular component library for CRUD admin frontends backed by the keel Go backend. Tables, forms, navigation, OTP/2FA/social auth, billing, payout onboarding.",
   "main": "src/index.ts",
   "scripts": {

package/src/component/login/chpass_component.html

@@ -21,6 +21,10 @@
         <mat-form-field appearance="outline">
           <mat-label>New Password</mat-label>
           <input matInput type="password" formControlName="new_password" autocomplete="new-password" required>
+          @if (passwordHint(); as hint) { <mat-hint>{{ hint }}</mat-hint> }
+          @if (chpassForm.controls.new_password.hasError('passwordPolicy')) {
+            <mat-error>{{ chpassForm.controls.new_password.getError('passwordPolicy').message }}</mat-error>
+          }
         </mat-form-field>
 
         <mat-form-field appearance="outline">

package/src/component/login/chpass_component.ts

@@ -1,4 +1,4 @@
-import { ChangeDetectionStrategy, Component, inject, signal, ViewEncapsulation } from '@angular/core';
+import { ChangeDetectionStrategy, Component, computed, effect, inject, signal, ViewEncapsulation } from '@angular/core';
 import { FormBuilder, ReactiveFormsModule, Validators } from '@angular/forms';
 import { BaseAuthService } from '../../service/auth.service';
 import { Router, RouterLink } from '@angular/router';
@@ -8,6 +8,7 @@ import { MatInputModule } from '@angular/material/input';
 import { MatCheckboxModule } from '@angular/material/checkbox';
 import { SAIL_GUI_CONFIG, SailGuiConfig, DEFAULT_CONFIG } from '../../config';
 import { BaseAsync } from '../abstract/base_async';
+import { passwordPolicyValidator, passwordPolicyHint } from '../../util/password_policy';
 
 @Component({
   selector: 'sail-chpass',
@@ -34,10 +35,21 @@ export class ChpassComponent extends BaseAsync {
   chpassForm = this.fb.group({
     username: ['', Validators.required],
     old_password: ['', Validators.required],
-    new_password: ['', [Validators.required, Validators.minLength(6)]],
+    new_password: ['', [Validators.required, passwordPolicyValidator(() => this.auth.passwordRules())]],
     confirm_password: ['', Validators.required],
   });
 
+  protected readonly passwordHint = computed(() => passwordPolicyHint(this.auth.passwordRules()));
+
+  constructor() {
+    super();
+    this.auth.ensurePasswordPolicy();
+    effect(() => {
+      this.auth.passwordRules();
+      this.chpassForm.controls.new_password.updateValueAndValidity({ emitEvent: false });
+    });
+  }
+
   toggleForgotPassword(checked: boolean) {
     this.forgotPassword.set(checked);
     const oldPw = this.chpassForm.get('old_password')!;
@@ -52,7 +64,7 @@ export class ChpassComponent extends BaseAsync {
       confirmPw.setValue('');
     } else {
       oldPw.setValidators(Validators.required);
-      newPw.setValidators([Validators.required, Validators.minLength(6)]);
+      newPw.setValidators([Validators.required, passwordPolicyValidator(() => this.auth.passwordRules())]);
       confirmPw.setValidators(Validators.required);
     }
     oldPw.updateValueAndValidity();

package/src/component/login/confirm_chpass_component.html

@@ -21,6 +21,10 @@
       <mat-form-field appearance="outline">
         <mat-label>New Password</mat-label>
         <input matInput type="password" formControlName="new_password" autocomplete="new-password" required>
+        @if (passwordHint(); as hint) { <mat-hint>{{ hint }}</mat-hint> }
+        @if (confirmForm.controls.new_password.hasError('passwordPolicy')) {
+          <mat-error>{{ confirmForm.controls.new_password.getError('passwordPolicy').message }}</mat-error>
+        }
       </mat-form-field>
 
       <mat-form-field appearance="outline">

package/src/component/login/confirm_chpass_component.ts

@@ -1,4 +1,4 @@
-import { ChangeDetectionStrategy, Component, inject, OnInit, ViewEncapsulation } from '@angular/core';
+import { ChangeDetectionStrategy, Component, computed, effect, inject, OnInit, ViewEncapsulation } from '@angular/core';
 import { FormBuilder, ReactiveFormsModule, Validators } from '@angular/forms';
 import { BaseAuthService } from '../../service/auth.service';
 import { ActivatedRoute, Router, RouterLink } from '@angular/router';
@@ -7,6 +7,7 @@ import { MatFormFieldModule } from '@angular/material/form-field';
 import { MatInputModule } from '@angular/material/input';
 import { SAIL_GUI_CONFIG, SailGuiConfig, DEFAULT_CONFIG } from '../../config';
 import { BaseAsync } from '../abstract/base_async';
+import { passwordPolicyValidator, passwordPolicyHint } from '../../util/password_policy';
 
 @Component({
   selector: 'sail-confirm-chpass',
@@ -31,11 +32,23 @@ export class ConfirmChpassComponent extends BaseAsync implements OnInit {
   confirmForm = this.fb.group({
     username: ['', Validators.required],
     code: ['', Validators.required],
-    new_password: ['', [Validators.required, Validators.minLength(6)]],
+    new_password: ['', [Validators.required, passwordPolicyValidator(() => this.auth.passwordRules())]],
     confirm_password: ['', Validators.required],
   });
 
+  protected readonly passwordHint = computed(() => passwordPolicyHint(this.auth.passwordRules()));
+
+  constructor() {
+    super();
+    // Re-validate the new-password field once the policy arrives.
+    effect(() => {
+      this.auth.passwordRules();
+      this.confirmForm.controls.new_password.updateValueAndValidity({ emitEvent: false });
+    });
+  }
+
   ngOnInit() {
+    this.auth.ensurePasswordPolicy();
     const username = this.route.snapshot.queryParamMap.get('username');
     if (username) {
       this.confirmForm.patchValue({ username });

package/src/component/login/login_component.html

@@ -38,11 +38,17 @@
     <div class="auth-actions">
       <a routerLink="/login/chpass">I forgot my password</a>
     </div>
-    @if (guiConfig.loginFooterLinks && guiConfig.loginFooterLinks.length > 0) {
+    @if (guiConfig.loginFooterLinks?.length || guiConfig.termsUrl || guiConfig.privacyPolicyUrl) {
       <div class="auth-footer">
-        @for (link of guiConfig.loginFooterLinks; track link.routerLink) {
+        @for (link of guiConfig.loginFooterLinks ?? []; track link.routerLink) {
           <a [routerLink]="link.routerLink">{{ link.label }}</a>
         }
+        @if (guiConfig.termsUrl) {
+          <a [href]="guiConfig.termsUrl" target="_blank" rel="noopener">Terms of Service</a>
+        }
+        @if (guiConfig.privacyPolicyUrl) {
+          <a [href]="guiConfig.privacyPolicyUrl" target="_blank" rel="noopener">Privacy Policy</a>
+        }
       </div>
     }
   </div>

package/src/component/payout/bank_info_form.ts

@@ -26,8 +26,10 @@ export const DEFAULT_COUNTRY_PROFILES: CountryProfile[] = [
  *
  * Captures the basis `user_bank_info` fields (country, currency, account
  * holder, tax id, billing address, agreement). Emits the form value via
- * `(submitted)` — the consumer decides whether to POST directly to
- * /api/v1/user_bank_info or pipe through its own registration service.
+ * `(submitted)` — first-time setup POSTs through the app's registration
+ * service; CHANGES to an existing destination go through
+ * PayoutService.replaceBankInfo (atomic version replacement), never a
+ * generic CRUD edit.
  *
  * Ships no CSS — the consuming app styles the classes globally.
  *
@@ -58,7 +60,11 @@ export class PayoutBankInfoFormComponent {
   /** When true, the back button renders alongside submit. */
   readonly showBack = input(true);
 
-  /** Emitted on submit; payload maps 1:1 to basis user_bank_info columns. */
+  /**
+   * Emitted on submit as application-layer input. The consumer must use its
+   * registration service for first-time setup or PayoutService.replaceBankInfo
+   * for changes; never send this payload through generic CRUD.
+   */
   readonly submitted = output<BankInfoFormValue>();
   /** Emitted when the user clicks Back. */
   readonly back = output<void>();

package/src/component/payout/provider_onboarding.ts

@@ -14,12 +14,13 @@ import { ReusableAccount } from '../../model/appdata';
  * two paths:
  *   1. Reuse an existing provider account from another partner row
  *      (zero-KYC; calls /api/v1/payout/reusable/link).
- *   2. Hand off to the provider's hosted-KYC page
- *      (/api/v1/payout/onboard/start).
+ *   2. Start provider onboarding (/api/v1/payout/onboard/start), then
+ *      either hand off to a hosted-KYC page or emit `pending` when the
+ *      provider continues asynchronously without a hosted URL.
  *
- * Routing is consumer-owned via the `(linked)` / `(skipped)` outputs —
- * the component itself never calls Router. Optional `title` and
- * `skipLabel` inputs cover the common UX strings.
+ * Routing is consumer-owned via the `(linked)`, `(pending)`, and
+ * `(skipped)` outputs — the component itself never calls Router.
+ * Optional `title` and `skipLabel` inputs cover the common UX strings.
  *
  * Ships no CSS — the consuming app styles the classes globally.
  *
@@ -47,6 +48,13 @@ export class PayoutProviderOnboardingComponent extends BaseAsync implements OnIn
   readonly back = output<void>();
   /** Emitted just before handing off to the hosted-KYC page. */
   readonly started = output<void>();
+  /**
+   * Emitted when onboarding started but there is no hosted page to open
+   * (Wise email recipients: the account is linked and awaits the
+   * recipient's email confirmation). Consumers show a "linked, awaiting
+   * confirmation" state instead of navigating.
+   */
+  readonly pending = output<void>();
 
   private readonly payoutService = inject(PayoutService);
 
@@ -79,6 +87,10 @@ export class PayoutProviderOnboardingComponent extends BaseAsync implements OnIn
     this.run(
       this.payoutService.startOnboarding(),
       (res) => {
+        if (!res.url) {
+          this.pending.emit();
+          return;
+        }
         this.started.emit();
         // Same-tab handoff: window.open from an async callback is popup-blocked
         // (always on Safari), which used to leave users on a "waiting" screen

package/src/config.ts

@@ -53,9 +53,9 @@ export interface SailGuiConfig {
   appleServiceId?: string;
   /** Apple Sign-In redirect URI. Must match the Services ID configuration. */
   appleRedirectUri?: string;
-  /** Public URL of your privacy policy. Shown as a link in ConsentGateComponent. */
+  /** Public URL of your privacy policy. Linked from ConsentGateComponent and the login footer. */
   privacyPolicyUrl?: string;
-  /** Public URL of your terms of service. Shown in the SMS-consent disclosure. */
+  /** Public URL of your terms of service. Linked from the SMS-consent disclosure and the login footer. */
   termsUrl?: string;
   /** Brand name shown in the SMS/10DLC consent disclosure (e.g. "Daxoom"). */
   appName?: string;
@@ -74,6 +74,11 @@ export interface SailGuiConfig {
   /** Hostnames a post-login `?return=` may redirect to (open-redirect allowlist),
    * e.g. ['mcp.example.com']. Anything not listed is ignored. */
   allowedReturnHosts?: string[];
+
+  /** Public route serving the password policy (keel PublicHandler.GetPasswordPolicy),
+   * e.g. '/public/v1/auth/password/policy'. When set, sail fetches it once and
+   * password inputs validate against it. Omitted → policy validation is skipped. */
+  passwordPolicyUrl?: string;
 }
 
 export const SAIL_GUI_CONFIG = new InjectionToken<SailGuiConfig>('SailGuiConfig');

package/src/index.ts

@@ -71,3 +71,4 @@ export * from './service/base_rest.service';
 export * from './util/text';
 export * from './util/money';
 export * from './util/errors';
+export * from './util/password_policy';

package/src/model/appdata.ts

@@ -377,18 +377,22 @@ export interface ReusableAccount {
 	onboardedAt:       string;
 }
 
-// Result of PayoutService.startOnboarding(). url is opened in a webview /
-// external browser; the provider posts back via webhook when activation
-// lands.
+// Result of PayoutService.startOnboarding(). A non-empty url is opened in a
+// webview / external browser. Some providers have no hosted flow (for example,
+// Wise email recipients); in that case url and expiresAt are empty and
+// PayoutProviderOnboardingComponent emits `pending` while confirmation
+// continues asynchronously.
 export interface PayoutOnboardingSession {
 	url:               string;
 	externalAccountId: string;
 	expiresAt:         string;
 }
 
-// Payload the bank-info form emits. Maps 1:1 to basis user_bank_info
-// columns. The consumer decides where to POST it — typically a direct
-// generic-CRUD insert against /api/v1/user_bank_info.
+// Application-layer payload emitted by the bank-info form. It is not a
+// generic-CRUD row: taxId must be sealed into basis.user_bank_info's
+// tax_id_encrypted column. First-time setup goes through the consuming app's
+// registration service; changes use PayoutService.replaceBankInfo so keel can
+// atomically supersede the active destination version.
 export interface BankInfoFormValue {
 	countryCode:       string;
 	currency:          string;

package/src/service/auth.service.ts

@@ -1,6 +1,7 @@
 import { Injectable, WritableSignal, inject, signal } from '@angular/core';
 import { HttpErrorResponse, HttpParams } from '@angular/common/http';
 import { filter, map, mergeMap, take, tap } from 'rxjs/operators';
+import { PasswordRules } from '../util/password_policy';
 import { ApplicationData, ConfirmRegisterResponse, DictionaryPath, LoginResponse2FA, PartnerRegistration, RestReport, TableDefinition, TrustedDevice, TwoFactorSetupResponse, TwoFactorVerifyRequest, TwoFactorVerifyResponse } from '../model/appdata';
 import {
   LoginResponseSocial,
@@ -94,6 +95,22 @@ export abstract class BaseAuthService extends BaseRestService {
   token: string | null = null;
   readonly isLoggedIn = signal(false);
 
+  /** keel password policy for pre-submit validation; undefined until loaded
+   *  (or when guiConfig.passwordPolicyUrl is unset). Fed via ensurePasswordPolicy(). */
+  readonly passwordRules = signal<PasswordRules | undefined>(undefined);
+  private passwordPolicyLoading = false;
+
+  /** Fetch the policy once (public route, safe pre-login). No-op if already
+   *  loaded/loading or no URL configured. */
+  ensurePasswordPolicy(): void {
+    if (this.passwordRules() || this.passwordPolicyLoading || !this.guiConfig.passwordPolicyUrl) return;
+    this.passwordPolicyLoading = true;
+    this.http.get<PasswordRules>(this.url(this.guiConfig.passwordPolicyUrl)).subscribe({
+      next: (rules) => this.passwordRules.set(rules),
+      error: () => { this.passwordPolicyLoading = false; },
+    });
+  }
+
   /** Last appdata load failure (null when none). */
   readonly appDataError = signal<unknown>(null);
 

package/src/service/payout.service.ts

@@ -3,6 +3,7 @@ import { Observable } from 'rxjs';
 import { RestURL } from './rest_url';
 import { BaseRestService } from './base_rest.service';
 import {
+  BankInfoFormValue,
   PayoutOnboardingSession,
   ReusableAccount,
 } from '../model/appdata';
@@ -20,7 +21,11 @@ import {
  */
 @Injectable({ providedIn: 'root' })
 export class PayoutService extends BaseRestService {
-  /** Launch the hosted-KYC flow. Returns a URL to open + provider-side handle. */
+  /**
+   * Start provider onboarding. A non-empty URL is the hosted-KYC handoff;
+   * an empty URL means confirmation continues asynchronously (for example,
+   * a Wise recipient confirming from email).
+   */
   startOnboarding(): Observable<PayoutOnboardingSession> {
     return this.http.post<PayoutOnboardingSession>(this.url(RestURL.payoutOnboardStartURL), {});
   }
@@ -39,4 +44,25 @@ export class PayoutService extends BaseRestService {
   status(): Observable<{ complete: boolean }> {
     return this.http.post<{ complete: boolean }>(this.url(RestURL.payoutStatusURL), {});
   }
+
+  /**
+   * Replace the payout destination with a new bank-info version
+   * (atomic supersede + insert on the backend). Identity changes go
+   * through this, never through generic CRUD edits. `provider` and
+   * `providerAgreement` are server-owned and ignored here.
+   */
+  replaceBankInfo(value: BankInfoFormValue): Observable<{ message: string }> {
+    const { countryCode, currency, accountHolderName, billingAddress, taxIdType, taxId } = value;
+    return this.http.post<{ message: string }>(this.url(RestURL.payoutBankReplaceURL),
+      { countryCode, currency, accountHolderName, billingAddress, taxIdType, taxId });
+  }
+
+  /**
+   * Register a payout beneficiary from provider-collected details
+   * (Airwallex embedded beneficiary component). The payload passes
+   * through to the provider; the backend links the returned id.
+   */
+  registerBeneficiary(beneficiary: unknown): Observable<{ beneficiaryId: string }> {
+    return this.http.post<{ beneficiaryId: string }>(this.url(RestURL.payoutBeneficiaryURL), { beneficiary });
+  }
 }

package/src/service/rest_url.ts

@@ -53,6 +53,8 @@ export const RestURL = {
   payoutReusableURL:     '/api/v1/payout/reusable',
   payoutReusableLinkURL: '/api/v1/payout/reusable/link',
   payoutStatusURL:       '/api/v1/payout/status',
+  payoutBankReplaceURL:  '/api/v1/payout/bank/replace',
+  payoutBeneficiaryURL:  '/api/v1/payout/beneficiary/register',
   // User payment methods — list/delete go through keel's generic REST
   // CRUD against the UserSpecific basis table; set-default is a
   // TableAction (basis table_action row), mounted at the conventional

package/src/util/password_policy.ts

@@ -0,0 +1,43 @@
+import { AbstractControl, ValidationErrors, ValidatorFn } from '@angular/forms';
+
+// keel PasswordPolicyView — the composition rules for pre-submit validation.
+export interface PasswordRules {
+  minLength: number;
+  minUpper: number;
+  minLower: number;
+  minDigit: number;
+}
+
+type RulesSource = PasswordRules | (() => PasswordRules | undefined);
+
+// Validator for keel's password policy. Empty is left to Validators.required;
+// undefined rules (not loaded) skip the check. Char classes match keel's ASCII rules.
+export function passwordPolicyValidator(source: RulesSource): ValidatorFn {
+  return (control: AbstractControl): ValidationErrors | null => {
+    const rules = typeof source === 'function' ? source() : source;
+    const value: string = control.value ?? '';
+    if (!rules || !value) return null;
+    let upper = 0, lower = 0, digit = 0;
+    for (const ch of value) {
+      if (ch >= 'A' && ch <= 'Z') upper++;
+      else if (ch >= 'a' && ch <= 'z') lower++;
+      else if (ch >= '0' && ch <= '9') digit++;
+    }
+    const unmet: string[] = [];
+    if (value.length < rules.minLength) unmet.push(`${rules.minLength} characters`);
+    if (upper < rules.minUpper) unmet.push('an uppercase letter');
+    if (lower < rules.minLower) unmet.push('a lowercase letter');
+    if (digit < rules.minDigit) unmet.push('a number');
+    return unmet.length ? { passwordPolicy: { message: `Password needs ${unmet.join(', ')}.` } } : null;
+  };
+}
+
+// Human-readable requirement string built from the loaded rules ('' when unknown).
+export function passwordPolicyHint(rules?: PasswordRules): string {
+  if (!rules) return '';
+  const parts = [`at least ${rules.minLength} characters`];
+  if (rules.minUpper > 0) parts.push('an uppercase letter');
+  if (rules.minLower > 0) parts.push('a lowercase letter');
+  if (rules.minDigit > 0) parts.push('a number');
+  return `Use ${parts.join(', ')}.`;
+}