Merge pull request #12 from DevelopmentFinanceObservatory/release/website

Sync dfo-website@dd1f50d60809

Author: jm-rivera

db/test/live-share.test.ts

@@ -529,6 +529,30 @@ test('live share routes', async (t) => {
         assert.equal(stub.to('/render/data').length, 0);
     });
 
+    // Node's fetch decodes a gzipped export and keeps its compressed length.
+    await t.test(
+        'data: a gzipped export streams every row without its compressed length',
+        async () => {
+            const id = await liveShare();
+            const { deps } = over({
+                refreshFrame: () => frameAnswer('current', DATASET_FRAME),
+                storedExport: () =>
+                    new Response('year,value\n2024,1\n', {
+                        headers: {
+                            'content-type': 'text/csv',
+                            'content-encoding': 'gzip',
+                            'content-length': '9',
+                        },
+                    }),
+            });
+
+            const file = await download(deps, id, 'data', 'format=csv&bundle=false');
+
+            assert.equal(file.headers.get('content-length'), null);
+            assert.equal(await file.text(), 'year,value\n2024,1\n');
+        },
+    );
+
     await t.test('data: no file while pending, on an error, or on a refused export', async () => {
         const id = await liveShare();
         const queued = over({

docs/analytics.md

@@ -4,7 +4,7 @@ Usage events go to our own database, errors to Sentry, and page views to Google
 
 ## Usage events
 
-The events DFO Overview asks for (Data access → "Events to record") land in the `event` table (`db/schema.ts`, migration `0006_events`): one row per event with a dotted `name`, the event's own `props` (JSONB), `user_id` when signed in, a random per-browser `visitor_id` (localStorage, no cookie) when the visitor has consented, and the `page`. No IPs, no prompt text.
+The events DFO Overview asks for (Data access → "Events to record") land in the `event` table (`db/schema.ts`, migration `0006_events`): one row per event with a dotted `name`, the event's own `props` (JSONB), `user_id` when signed in, a random per-browser `visitor_id` (localStorage, no cookie) when the visitor has consented, and the `page`. No event holds an IP address or the text of a Studio prompt. The three search events hold the first 500 characters of the query.
 
 The browser stores `visitor_id` only after the visitor accepts "DFO usage statistics" in the Analytics category of the cookie banner (Usercentrics service `L3eMCSMT3WELG7`, read through the CMP's `window.__ucCmp` API and `UC_CONSENT` event in `src/lib/consent.ts`). Until then, including while the banner is loading or blocked, events arrive with a null visitor id. Withdrawing consent deletes the stored id.
 

src/app/(site)/ai-policy/page.tsx

@@ -8,10 +8,6 @@ export const metadata: Metadata = {
         'How the DFO’s AI-assisted search works, where its figures come from, and what happens to what you type.',
 };
 
-// ONE's own text (legal's draft, "Website policy content - DFO"). Two
-// bullets of section 3 — retention and legal basis — are still blanks in
-// that draft, so they are not on the page yet: a policy page must not
-// publish a placeholder.
 const AiPolicyPage = () => (
     <main>
         <Policy title="AI Transparency">
@@ -29,6 +25,11 @@ const AiPolicyPage = () => (
                 elimination of errors, and we encourage users to verify any figure used for
                 high-stakes decisions against the cited primary source.
             </p>
+            <p>
+                The same data is available to other AI assistants, such as Claude and ChatGPT,
+                through the DFO’s connector. There the DFO supplies the figures and their sources,
+                and the assistant you chose writes the answer under its provider’s own terms.
+            </p>
 
             <h2>2. Data provenance and source grounding</h2>
             <p>
@@ -53,17 +54,52 @@ const AiPolicyPage = () => (
                     system pipeline.
                 </li>
                 <li>
-                    <strong>Enterprise isolation.</strong> Natural language interactions are
-                    processed through isolated enterprise-tier channels. Your query strings, search
-                    history, and session parameters are confidential and are not used to train any
-                    public AI model.
+                    <strong>How questions are processed.</strong> The text of your question is sent
+                    to Google’s Gemini models, which read it to find the data you asked for and, in
+                    the Studio, to write the answer.
+                </li>
+                <li>
+                    <strong>What a search records.</strong> When you search on this site, we record
+                    the first 500 characters of your question together with the data it matched, to
+                    learn what people look for and where the data falls short. The record is tied to
+                    your account if you are signed in, and to a random identifier in your browser if
+                    you accepted usage statistics in the cookie banner. These records are held in
+                    the DFO’s own database and in PostHog, an analytics service hosted in the EU.
+                </li>
+                <li>
+                    <strong>Studio conversations.</strong> The Studio stores each conversation so
+                    that it can continue from one message to the next. If you are signed in, the
+                    conversation is also saved to your account until you delete it or delete your
+                    account. A technical record of each conversation, including its text, is kept in
+                    Langfuse, a monitoring service hosted in the EU, so that we can find and fix
+                    faults. Usage statistics record that a prompt was sent and how long it was, and
+                    leave out its text.
+                </li>
+                <li>
+                    <strong>Connected assistants.</strong> When you use the DFO from another
+                    assistant, the DFO receives the question and the data requests that assistant
+                    sends. It needs no account and is not told who you are. Charts and tables the
+                    assistant creates through the DFO are stored so that they can be shown, and
+                    anyone who has a chart’s link can open it.
                 </li>
                 <li>
-                    <strong>Data minimization.</strong> Query text is processed only to generate a
-                    response and is not linked to a persistent user profile beyond what’s needed to
-                    maintain your active session.
+                    <strong>Internet addresses.</strong> Our servers’ request logs record the
+                    internet address of each request, as on any website. Usage statistics do not
+                    include it.
                 </li>
             </ul>
+            <p>
+                For a question about your data, or for help with the DFO, write to{' '}
+                <a href="mailto:data@one.org">data@one.org</a>. ONE’s{' '}
+                <a
+                    href="https://www.one.org/info/privacy-policy/"
+                    target="_blank"
+                    rel="noopener noreferrer"
+                >
+                    privacy policy
+                </a>{' '}
+                covers the rest of this website.
+            </p>
         </Policy>
     </main>
 );

src/app/mcp/[[...path]]/route.ts

@@ -45,6 +45,8 @@ const proxy = async (req: NextRequest, { params }: { params: Promise<{ path?: st
         bearer: MCP_TOKEN,
         caller: requestCaller(req.headers),
         unreachable: 'The MCP servers are unreachable.',
+        // MCP responses pass through as the harness sent them.
+        compress: false,
     });
 };
 

src/components/organisms/BuildTools/BuildTools.tsx

@@ -16,22 +16,22 @@ const PACKAGES_HREF = docsSectionHref('oda_reader');
 const boxes = [
     {
         title: 'REST API',
-        text: 'Three core endpoints: search indicators, query observations, and availability to check data coverage',
+        text: 'Turn a plain-English question into a dataset in CSV, Excel, or Parquet, with its sources and citation. Look up names and codes.',
         href: '/docs',
     },
     {
         title: 'Python Packages',
-        text: 'Pull clean, sourced development finance data into your pipeline in minutes. Data refreshes automatically as DFO updates',
+        text: 'Load OECD, IMF, and TOSSD data into pandas straight from the publisher, with our open-source packages.',
         href: PACKAGES_HREF,
     },
     {
         title: 'MCP Server',
-        text: 'Add DFO to Claude, Cursor, or any MCP-compatible environment. All DFO tools become available in your session instantly',
+        text: 'Connect the DFO to Claude, ChatGPT, or Gemini. Your assistant answers from DFO data and names the source of each number.',
         href: '/docs',
     },
     {
         title: 'Embed Anywhere',
-        text: 'Drop DFO charts with live data directly into your own reports, dashboards, or other digital tools.',
+        text: 'Paste iframe code from Studio into any web page to show a whole canvas or a single chart, on live data or as a snapshot.',
         href: '/docs',
     },
 ];

src/components/organisms/DataSearch/DataSearch.module.scss

@@ -1992,6 +1992,16 @@ span.slotMarked {
         margin-top: rem(8);
     }
 
+    // Why the part offers this reading, in the same small type as the
+    // closest-match lead.
+    .cardBasis {
+        @include font-size(14px, 1.3);
+
+        font-family: var(--font-dm-mono);
+        color: var(--color-sage);
+        letter-spacing: -0.01em;
+    }
+
     .cardRetry {
         margin-top: auto;
     }

src/components/organisms/DataSearch/ReadingCards.tsx

@@ -8,7 +8,7 @@ import { TokenAbout } from './TokenAbout';
 
 import Button from '@/components/atoms/Button/Button';
 import { isClosestMatch } from '@/lib/search/departures';
-import { readingOf, readingsSummary } from '@/lib/search/readings';
+import { basisNote, readingOf, readingsSummary } from '@/lib/search/readings';
 import { tokenAbout } from '@/lib/search/tokenAbout';
 import type { Part } from '@/lib/search/types';
 import { statVarsUnreadable } from '@/lib/search/view';
@@ -17,8 +17,9 @@ import { statVarsUnreadable } from '@/lib/search/view';
  * A candidates part's readings, one card per candidate spec: the reading's
  * heading and byline as plain text, since an edit to a reading the reader
  * has not chosen has nothing to apply to, and its measure's About block
- * shown open, since the definition is what tells two readings apart. The
- * card's one action picks the reading. The part's own summary plan is the
+ * shown open, since the definition is what tells two readings apart. A
+ * rival reading leads with why the part offers it (`basis`). The card's
+ * one action picks the reading. The part's own summary plan is the
  * block's screen-reader text, and a closest-match part draws its lead once
  * above the cards.
  */
@@ -50,6 +51,7 @@ const ReadingCards = ({
                 return {
                     spec,
                     reading,
+                    note: basisNote(spec.basis),
                     about: tokenAbout(measure, spec, reading.statedElsewhere),
                 };
             }),
@@ -69,7 +71,7 @@ const ReadingCards = ({
                 {readingsSummary(part.sentence_plan)}
             </p>
             <ul className={styles.cards}>
-                {readings.map(({ spec, reading, about }, index) => (
+                {readings.map(({ spec, reading, note, about }, index) => (
                     <li
                         key={spec.spec_id}
                         className={styles.readingCard}
@@ -91,6 +93,7 @@ const ReadingCards = ({
                             </>
                         ) : (
                             <>
+                                {note && <p className={styles.cardBasis}>{note}</p>}
                                 <div aria-hidden="true">
                                     <p className={styles.cardTitle}>{reading.heading}</p>
                                     {reading.byline && (

src/components/organisms/DataSearch/useSearchRun.ts

@@ -529,9 +529,10 @@ export const useSearchRun = () => {
                                 });
                             }
                             break;
-                        // `shape` carries variable_index too (would map the
-                        // same way as `step`), but nothing renders its
-                        // payload. A deliberate no-op.
+                        // `frame` and `shape` carry variable_index too (would
+                        // map the same way as `step`), but nothing renders
+                        // their payloads. A deliberate no-op.
+                        case 'frame':
                         case 'shape':
                             break;
                         case 'sentence':

src/components/organisms/Studio/canvas/Whiteboard.module.scss

@@ -172,7 +172,8 @@
 }
 
 // The resize grip: a corner glyph at the card's bottom-right, hover-only.
-// Dragging it resizes the card cell by cell within its kind's range.
+// Dragging it resizes the card cell by cell within its kind's range. On a
+// chart view it changes the width alone (the height follows the chart).
 .resizeGrip {
     @include flex(row, center, center);
 
@@ -200,6 +201,10 @@
     }
 }
 
+.resizeGripWidth {
+    cursor: ew-resize;
+}
+
 .slot:hover .resizeGrip {
     opacity: 1;
 }

src/components/organisms/Studio/canvas/Whiteboard.tsx

@@ -14,6 +14,7 @@ import {
     effectiveKind,
     FILTER_KIND,
     GAP,
+    heightIsDerived,
     resolveCardView,
     widgetTitle,
 } from './layout';
@@ -149,6 +150,7 @@ const Whiteboard = ({
     const { slots, setSlots, fitRows, raise } = useSlots({
         widgets,
         pinnedIds,
+        views,
         initialLayout,
         viewCols,
         onLayoutChange,
@@ -422,6 +424,9 @@ const Whiteboard = ({
                     chartSource,
                 } = resolveCardView(widget, views[widget.id]);
                 const isText = widget.kind === 'text';
+                // A chart view's height follows its content, so its grip
+                // changes the width alone.
+                const widthOnly = heightIsDerived(widget, cardView);
                 const dimmed = !!dimKind && effectiveKind(widget, views[widget.id]) !== dimKind;
                 const extras: CardExtras = {
                     pinned: pinnedIds.includes(widget.id),
@@ -551,9 +556,12 @@ const Whiteboard = ({
                             )}
                             {!isLeaving && !readOnly && !isText && (
                                 <span
-                                    className={styles.resizeGrip}
+                                    className={classNames(
+                                        styles.resizeGrip,
+                                        widthOnly && styles.resizeGripWidth,
+                                    )}
                                     data-nowave=""
-                                    onPointerDown={resizing.startResize(widget.id)}
+                                    onPointerDown={resizing.startResize(widget.id, widthOnly)}
                                     onPointerMove={resizing.moveResize}
                                     onPointerUp={resizing.endResize}
                                     onPointerCancel={resizing.endResize}
@@ -570,6 +578,7 @@ const Whiteboard = ({
                                 scale={f}
                                 theme={theme}
                                 widthCells={slot.w}
+                                heightCells={slot.h}
                                 onFit={(rows) => fitRows(widget.id, rows)}
                                 extras={extras}
                             />