@duffcloudservices/site-forms 0.1.4 → 0.2.1

package/README.md

@@ -208,6 +208,10 @@ import {
   with a single retry on 5xx and `multipart/form-data` when files are
   present.
 
+File fields emit a single `File` by default. When `attachmentPolicy.maxFiles`
+is greater than `1`, the file field emits `File[]`, enables multiple
+selection, previews selected files, and allows removing files before submit.
+
 ## Visual editor integration
 
 The form root carries `data-form-key="<formId>"` and every field
@@ -251,6 +255,40 @@ pnpm --filter @duffcloudservices/site-forms test        # vitest --run
 pnpm --filter @duffcloudservices/site-forms type-check  # vue-tsc --noEmit
 ```
 
+## Compliance requirements for form submissions
+
+### Sensitive forms (`isSensitive: true`)
+
+Forms flagged as sensitive (law firm intake, HIPAA intake, any privilege-sensitive questionnaire) carry platform-enforced rules that form authors and site integrators must not override:
+
+1. **Notification emails suppress submission content.** When `isSensitive: true`, the portal notification email for a new submission contains only a portal link — never field values, names, or any submission body. This is required for attorney-client privilege (ABA Rule 1.6) and HIPAA confidentiality.
+
+2. **Access audit logging.** Every time a portal user opens a sensitive-form submission, the platform writes an audit log entry (`PortalAuditLog`, event: `submission_viewed`). This cannot be disabled.
+
+3. **Set via portal, not YAML.** The `isSensitive` flag lives in the `PortalSiteForms` table (managed via the portal Form Manager). It is not part of the `.dcs/forms/*.yaml` snapshot — the runtime itself has no concept of sensitivity.
+
+### Form version tracking
+
+Every submission row stores `formVersion` (the schema version of the form at submission time). If a form's fields change after submissions are collected, old submissions remain interpretable: the portal can reconstruct what was shown by looking up the version-keyed schema. This is required for compliance audit trails.
+
+### General form requirements
+
+All DCS-managed forms that collect personal data must:
+- Link a Privacy Policy URL in proximity to the submit action
+- Store `formVersionId`, submission timestamp, and submitter IP with every submission row (handled automatically by the platform)
+- Not collect unnecessary data fields (data minimization)
+
+### Intake questionnaires (attorneys, healthcare)
+
+Use the **Legal Intake — Standard** form template (created via the portal Form Manager → Templates) when building intake forms for law firms. This template:
+- Pre-populates the attorney-client privilege disclaimer and consent checkbox (non-removable)
+- Automatically sets `isSensitive: true`
+- Includes matter-type and adverse-parties fields for conflict screening
+
+For healthcare intake, mark the form as `FormKind: "hipaa"` so the submission handler applies PHI-aware redaction for notification emails.
+
+---
+
 ## Related docs
 
 - **Authoring guide** — [`.docs/forms/AUTHORING.md`](../../.docs/forms/AUTHORING.md)

package/dist/DcsForm.vue.d.ts

@@ -47,7 +47,13 @@ declare function __VLS_template(): {
     rootEl: any;
 };
 type __VLS_TemplateResult = ReturnType<typeof __VLS_template>;
-declare const __VLS_component: import('vue').DefineComponent<Props, {}, {}, {}, {}, import('vue').ComponentOptionsMixin, import('vue').ComponentOptionsMixin, {
+declare const __VLS_component: import('vue').DefineComponent<Props, {
+    values: import('./types').FormValues;
+    errors: import('vue').Ref<import('./types').FormErrors, import('./types').FormErrors>;
+    validateAll: () => boolean;
+    collectSubmissionValues: () => import('./types').FormValues;
+    reset: () => void;
+}, {}, {}, {}, import('vue').ComponentOptionsMixin, import('vue').ComponentOptionsMixin, {
     "submit-success": (event: DcsFormSubmitSuccess) => any;
     "submit-error": (event: DcsFormSubmitError) => any;
     "validation-error": (errors: Record<string, string | undefined>) => any;

package/dist/composables/useFormValidation.d.ts

@@ -1,4 +1,4 @@
-import { PortalFormDefinition, PortalFormField, FormErrors, FormValues } from '../types';
+import { PortalFormAttachmentPolicy, PortalFormDefinition, PortalFormField, FormErrors, FormValues } from '../types';
 /**
  * Returns true iff `field` is currently visible given the form's
  * other values. Hidden fields are never validated and never sent.
@@ -9,7 +9,7 @@ export declare function isFieldVisible(field: PortalFormField, values: FormValue
  * `undefined` if valid. Layout-only field types (section-heading,
  * html-block) and hidden fields never produce errors.
  */
-export declare function validateField(field: PortalFormField, value: unknown): string | undefined;
+export declare function validateField(field: PortalFormField, value: unknown, attachmentPolicy?: PortalFormAttachmentPolicy): string | undefined;
 /**
  * Validates an entire form. Skips fields that are not visible.
  * If `fieldIds` is supplied, only those fields are validated

package/dist/fields/DcsFormFile.vue.d.ts

@@ -1,12 +1,15 @@
-import { PortalFormField } from '../types';
+import { PortalFormAttachmentPolicy, PortalFormField } from '../types';
 type __VLS_Props = {
     field: PortalFormField;
-    modelValue: File | undefined;
+    attachmentPolicy?: PortalFormAttachmentPolicy;
+    modelValue: File | File[] | undefined;
     error?: string;
 };
 declare const _default: import('vue').DefineComponent<__VLS_Props, {}, {}, {}, {}, import('vue').ComponentOptionsMixin, import('vue').ComponentOptionsMixin, {
-    "update:modelValue": (value: File | undefined) => any;
+    "update:modelValue": (value: File | File[] | undefined) => any;
 }, string, import('vue').PublicProps, Readonly<__VLS_Props> & Readonly<{
-    "onUpdate:modelValue"?: ((value: File | undefined) => any) | undefined;
-}>, {}, {}, {}, {}, string, import('vue').ComponentProvideOptions, false, {}, HTMLDivElement>;
+    "onUpdate:modelValue"?: ((value: File | File[] | undefined) => any) | undefined;
+}>, {}, {}, {}, {}, string, import('vue').ComponentProvideOptions, false, {
+    inputEl: HTMLInputElement;
+}, HTMLDivElement>;
 export default _default;