Merge pull request #85 from DevelopmentFinanceObservatory/release/2026-10-29

release: website 24e53dc to production

Author: jm-rivera

db/test/conversation-search.test.ts

@@ -0,0 +1,53 @@
+import path from 'node:path';
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import { drizzle } from 'drizzle-orm/node-postgres';
+import { searchConversations } from '../../src/lib/chat/conversationSearch.ts';
+import { applyMigrations } from '../apply-migrations.ts';
+import { conversation, user } from '../schema.ts';
+import { createTestDatabase } from './harness.ts';
+
+const MIGRATIONS_FOLDER = path.resolve(import.meta.dirname, '../migrations');
+
+/**
+ * Conversation search on Postgres reads each saved message's text and the
+ * title of the card a user message names, and leaves out the approved plan
+ * stored beside a reply.
+ */
+test('conversation search matches message text and card titles, not stored plans', async (t) => {
+    const database = await createTestDatabase();
+    t.after(() => database.teardown());
+
+    await applyMigrations(database.migratorPool(), {
+        migrationsFolder: MIGRATIONS_FOLDER,
+        runtimeDbUser: database.runtimeUser,
+        migratorDbUser: database.migratorUser,
+    });
+
+    const db = drizzle(database.runtimePool());
+
+    await db.insert(user).values([{ id: 'owner', name: 'Owner', email: 'owner@example.org' }]);
+    await db.insert(conversation).values({
+        id: 'conv-1',
+        userId: 'owner',
+        title: 'Aid question',
+        data: {
+            messages: [
+                { role: 'user', text: 'How much aid did Ghana get?' },
+                {
+                    role: 'bot',
+                    text: 'About 1 billion dollars.',
+                    plan: { title: 'Net disbursements to Zanzibar', steps: [], choices: [] },
+                },
+                { role: 'user', text: 'Make it a bar chart', card: { title: 'Health aid trend' } },
+            ],
+        },
+    });
+
+    const hits = async (q: string) =>
+        (await searchConversations(db, 'owner', q)).map((hit) => [hit.id, hit.snippet]);
+
+    assert.deepEqual(await hits('ghana'), [['conv-1', 'How much aid did Ghana get?']]);
+    assert.deepEqual(await hits('health aid'), [['conv-1', 'Health aid trend']]);
+    assert.deepEqual(await hits('zanzibar'), []);
+});

db/test/harness.ts

@@ -78,6 +78,16 @@ export async function createTestDatabase(): Promise<TestDatabase> {
     });
 
     const pools: Pool[] = [];
+    const closed: Promise<void>[] = [];
+
+    const open = (user: string, password: string): Pool => {
+        const pool = poolFor(databaseName, user, password);
+        pool.on('connect', (client) => {
+            closed.push(new Promise((resolve) => client.once('end', resolve)));
+        });
+        pools.push(pool);
+        return pool;
+    };
 
     return {
         databaseName,
@@ -86,22 +96,21 @@ export async function createTestDatabase(): Promise<TestDatabase> {
         runtimeUser,
         runtimePassword,
         migratorPool(): Pool {
-            const pool = poolFor(databaseName, migratorUser, migratorPassword);
-            pools.push(pool);
-            return pool;
+            return open(migratorUser, migratorPassword);
         },
         runtimePool(): Pool {
-            const pool = poolFor(databaseName, runtimeUser, runtimePassword);
-            pools.push(pool);
-            return pool;
+            return open(runtimeUser, runtimePassword);
         },
         adminPool(): Pool {
-            const pool = poolFor(databaseName, SUPERUSER_USER, SUPERUSER_PASSWORD);
-            pools.push(pool);
-            return pool;
+            return open(SUPERUSER_USER, SUPERUSER_PASSWORD);
         },
         async teardown(): Promise<void> {
+            // pool.end() resolves once it has asked its clients to close, not
+            // once they have. A backend that has not yet read its client's
+            // Terminate when the terminate below reaches it sends the client
+            // a FATAL error, which the ended pool emits with no listener.
             await Promise.all(pools.map((pool) => pool.end()));
+            await Promise.all(closed);
 
             const admin = new Client({
                 host: SUPERUSER_HOST,

docs/development.md

@@ -211,17 +211,17 @@ The `apis`, `ai` and `dcp` repositories run their own dev services. `apis` and `
 
 ## API client package
 
-The Search, Datasets and Graph types come from `@developmentfinance/client`, vendored as `vendor/developmentfinance-client-0.1.0.tgz`. The tarball is the `typescript/` package of the sdk repository, built and packed. To refresh it, pack that package into `vendor/` and re-lock, so `pnpm-lock.yaml` carries the new tarball's integrity:
+The Search, Datasets and Graph types come from `@developmentfinance/client`, vendored as `vendor/developmentfinance-client-0.1.0.tgz`. The tarball is the `typescript/` package of the sdk repository, built and packed. To refresh it, pack that package into `vendor/` and re-lock:
 
 ```sh
 cd <sdk checkout>/typescript
 pnpm install && pnpm run build
 pnpm pack --pack-destination <website checkout>/vendor
 cd <website checkout>
-pnpm install
+just relock-client
 ```
 
-A new package version packs under a new file name. Point the `@developmentfinance/client` entry in `package.json` at it before re-locking. A rebuilt tarball keeps its file name, so a local re-vendor needs the client's directory under `node_modules/.pnpm` deleted before `pnpm install --frozen-lockfile` picks it up. Commit the tarball and the lockfile together.
+A new package version packs under a new file name. Point the `@developmentfinance/client` entry in `package.json` at it, delete the old tarball, then re-lock. `just relock-client` deletes the client's stale directory under `node_modules/.pnpm` (pnpm keeps an installed `file:` package of the same name and version, so a rebuilt tarball is otherwise ignored), has pnpm re-resolve the client's lockfile entries from the tarball with `pnpm install --lockfile-only --fix-lockfile`, runs `pnpm install --frozen-lockfile`, and imports the client to prove it loads. The re-lock needs the registry. It changes the client's entries and those of any dependency the new tarball adds. pnpm 10.5.2 also fills in deprecation notices and writes `eslint-plugin-import`'s peer suffix in one of two equivalent forms, so a re-lock can touch those few lines too. Commit the tarball and the lockfile together.
 
 The tarball carries the statuses of the codes the proxy raises itself and not their descriptions. `src/lib/proxy/proxy-codes.json` holds the full file, copied from the spec-kit repository's `python/client-contract/src/dfo_client_contract/proxy-codes.json` and formatted with Prettier. Copy it again when the client contract changes it.
 

justfile

@@ -48,6 +48,16 @@ env:
         echo "ok Created {{ENV_FILE}} from {{ENV_SAMPLE}}."
     fi
 
+# pnpm reuses an installed `file:` package whose name and version are
+# unchanged, so the stale install goes first.
+#
+# Re-lock the vendored API client tarball
+relock-client:
+    rm -rf node_modules/.pnpm/@developmentfinance+client@*
+    pnpm install --lockfile-only --fix-lockfile
+    pnpm install --frozen-lockfile
+    node --input-type=module -e "await import('@developmentfinance/client')"
+
 # ── Development ───────────────────────────────────────
 
 # LAN access (phone/tablet testing) needs DEV_ORIGINS set in {{ENV_FILE}}.