@acms-subir/core 0.0.1 → 0.1.0

package/src/layouts/Site.astro

@@ -6,6 +6,8 @@ import { siteOrigin, absUrl, canonicalPath } from '../lib/seo';
 import { siteLang } from '../lib/dates';
 import { CONTENT } from '../lib/content';
 import { I18N, localeFromPath, localeHomeUrl } from '../lib/i18n';
+import { SEARCH } from '../lib/search-config';
+import { searchStrings } from '../lib/search-i18n';
 import '../styles/site.css';
 import '../styles/cards.css';
 
@@ -62,6 +64,11 @@ const metaDescription = description || settings.tagline || undefined;
 // locale setting (a date-formatting concern) stays the fallback
 const reqLocale = I18N.enabled ? localeFromPath(current) : '';
 const htmlLang = reqLocale || siteLang(settings);
+// search modal chrome: strings follow the document language, the form's
+// no-JS fallback goes to the (locale-prefixed) /search page
+const showSearch = !bare && SEARCH.enabled;
+const searchT = searchStrings(htmlLang.slice(0, 2));
+const searchAction = reqLocale && reqLocale !== I18N.defaultLocale ? `/${reqLocale}/search` : '/search';
 // hreflang alternates connect the per-language home pages; other routes have
 // no language twins yet, so alternates are emitted only on home paths
 const isHomePath = I18N.enabled && I18N.locales.some((l) => current === localeHomeUrl(l));
@@ -188,9 +195,114 @@ const homeJsonLd =
               ))}
             </span>
           )}
+          {showSearch && (
+            <a class="pc-search-trigger" href={searchAction} data-search-open aria-label={searchT.label}>
+              <svg width="17" height="17" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.2" stroke-linecap="round" aria-hidden="true"><circle cx="11" cy="11" r="7" /><path d="m20 20-3.6-3.6" /></svg>
+            </a>
+          )}
         </nav>
       </header>
     )}
+    {showSearch && (
+      <dialog class="pc-search" aria-label={searchT.label}>
+        {/* a real GET form: with JS disabled (or the fetch failing) the
+            query submits to the /search page instead of the live modal */}
+        <form class="pc-search-box" action={searchAction} method="get" role="search">
+          <svg width="18" height="18" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.2" stroke-linecap="round" aria-hidden="true"><circle cx="11" cy="11" r="7" /><path d="m20 20-3.6-3.6" /></svg>
+          <input class="pc-search-input" type="search" name="q" placeholder={searchT.placeholder} aria-label={searchT.label} autocomplete="off" />
+          <button type="button" class="pc-search-kbd" data-search-close>esc</button>
+        </form>
+        <div class="pc-search-results" hidden></div>
+      </dialog>
+    )}
+    {showSearch && (
+      <script is:inline define:vars={{ searchLocale: reqLocale, t: searchT }}>
+        (() => {
+          const dlg = document.querySelector('dialog.pc-search');
+          if (!dlg || !dlg.showModal) return;
+          const input = dlg.querySelector('.pc-search-input');
+          const box = dlg.querySelector('.pc-search-results');
+          let ctl = null;
+          let timer = 0;
+          let sel = -1;
+
+          const open = () => { if (!dlg.open) dlg.showModal(); input.focus(); input.select(); };
+          document.querySelectorAll('[data-search-open]').forEach((el) =>
+            el.addEventListener('click', (e) => { e.preventDefault(); open(); })
+          );
+          dlg.querySelectorAll('[data-search-close]').forEach((el) => el.addEventListener('click', () => dlg.close()));
+          // clicks on ::backdrop (and the dialog's transparent frame) land on
+          // the dialog element itself — descendants stop at the panel
+          dlg.addEventListener('click', (e) => { if (e.target === dlg) dlg.close(); });
+          document.addEventListener('keydown', (e) => {
+            if ((e.key === 'k' || e.key === 'K') && (e.metaKey || e.ctrlKey)) {
+              e.preventDefault();
+              dlg.open ? dlg.close() : open();
+              return;
+            }
+            const a = document.activeElement;
+            const typing = a && (/^(INPUT|TEXTAREA|SELECT)$/.test(a.tagName) || a.isContentEditable);
+            if (e.key === '/' && !typing && !dlg.open) { e.preventDefault(); open(); }
+          });
+
+          const esc = (s) => String(s).replace(/[&<>"]/g, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;' }[c]));
+          // snippet arrives pre-escaped from /api/search (only <mark> inside)
+          const hit = (url, title, meta, snippet) =>
+            `<a class="pc-search-hit" href="${esc(url)}"><span class="pc-search-t">${esc(title)}` +
+            (snippet ? `<span class="pc-search-snip">${snippet}</span>` : '') +
+            `</span>${meta ? `<span class="pc-search-m">${esc(meta)}</span>` : ''}</a>`;
+
+          const render = (d) => {
+            const groups = [];
+            if (d.posts.length) groups.push([t.posts, d.posts.map((p) => hit(p.url, p.title, p.date, p.snippet))]);
+            if (d.pages.length) groups.push([t.pages, d.pages.map((p) => hit(p.url, p.title, (p.locale || '').toUpperCase(), p.snippet))]);
+            if (d.tags.length) groups.push([t.tags, d.tags.map((g) => hit(g.url, g.name, `${g.count} ${t.posts.toLowerCase()}`))]);
+            if (d.authors.length) groups.push([t.authors, d.authors.map((u) => hit(u.url, u.name, ''))]);
+            box.innerHTML = groups.length
+              ? groups.map(([label, items]) => `<div class="pc-search-group">${esc(label)}</div>${items.join('')}`).join('')
+              : `<div class="pc-search-empty">${esc(t.empty)} “${esc(input.value.trim())}”</div>`;
+            box.hidden = false;
+            sel = -1;
+          };
+
+          input.addEventListener('input', () => {
+            clearTimeout(timer);
+            const q = input.value.trim();
+            if (!q) {
+              if (ctl) ctl.abort();
+              box.hidden = true;
+              box.innerHTML = '';
+              return;
+            }
+            timer = setTimeout(async () => {
+              if (ctl) ctl.abort();
+              ctl = new AbortController();
+              try {
+                const res = await fetch(`/api/search?q=${encodeURIComponent(q)}&locale=${encodeURIComponent(searchLocale)}`, { signal: ctl.signal });
+                if (res.ok) render(await res.json());
+              } catch { /* aborted or offline — the form still submits to /search */ }
+            }, 150);
+          });
+
+          const move = (dir) => {
+            const hits = [...box.querySelectorAll('.pc-search-hit')];
+            if (!hits.length) return;
+            sel = (sel + dir + hits.length) % hits.length;
+            hits.forEach((h, i) => h.classList.toggle('sel', i === sel));
+            hits[sel].scrollIntoView({ block: 'nearest' });
+          };
+          input.addEventListener('keydown', (e) => {
+            if (e.key === 'ArrowDown') { e.preventDefault(); move(1); }
+            else if (e.key === 'ArrowUp') { e.preventDefault(); move(-1); }
+            else if (e.key === 'Enter') {
+              const cur = box.querySelector('.pc-search-hit.sel');
+              if (cur) { e.preventDefault(); cur.click(); }
+              // no selection: the form submits to the /search page
+            }
+          });
+        })();
+      </script>
+    )}
     <main class="site-main">
       <slot />
     </main>

package/src/lib/plaintext.ts

@@ -0,0 +1,22 @@
+// Searchable plain text from rendered body_html: the FTS index stores this
+// instead of a posts column, derived once per write. Dynamic-block
+// placeholders (<div data-dyn>) carry no text, so tag-stripping drops them;
+// script/style bodies are removed explicitly. Entity decoding covers what
+// the editor emits — the named basics plus numeric escapes.
+const codePoint = (n: number) => (n > 0 && n <= 0x10ffff ? String.fromCodePoint(n) : ' ');
+
+export function htmlToPlaintext(html: string): string {
+  if (!html) return '';
+  return html
+    .replace(/<(script|style)\b[^>]*>[\s\S]*?<\/\1>/gi, ' ')
+    .replace(/<[^>]*>/g, ' ')
+    .replace(/&#x([0-9a-f]+);/gi, (_, h: string) => codePoint(parseInt(h, 16)))
+    .replace(/&#(\d+);/g, (_, n: string) => codePoint(Number(n)))
+    .replace(/&nbsp;/gi, ' ')
+    .replace(/&amp;/gi, '&')
+    .replace(/&lt;/gi, '<')
+    .replace(/&gt;/gi, '>')
+    .replace(/&quot;/gi, '"')
+    .replace(/\s+/g, ' ')
+    .trim();
+}

package/src/lib/repo/migrations.ts

@@ -226,6 +226,21 @@ export const MIGRATIONS: Migration[] = [
     version: 20,
     statements: [`ALTER TABLE pages ADD COLUMN locale TEXT NOT NULL DEFAULT ''`],
   },
+  {
+    // Public search: one FTS5 row per published post/page (title, excerpt,
+    // stripped body text, public tag names). Rows are synced by the repo on
+    // every write — no SQL triggers — and backfilled in code right after
+    // this version applies, since plaintext can't be derived in SQL.
+    // remove_diacritics makes "cafe" match "café" (matters for es content).
+    version: 21,
+    statements: [
+      `CREATE VIRTUAL TABLE IF NOT EXISTS search_index USING fts5(
+        kind UNINDEXED, ref_id UNINDEXED, locale UNINDEXED,
+        title, excerpt, plaintext, tags,
+        tokenize = 'unicode61 remove_diacritics 2'
+      )`,
+    ],
+  },
 ];
 
 export const LATEST_VERSION = MIGRATIONS[MIGRATIONS.length - 1].version;

package/src/lib/repo/sql.ts

@@ -1,7 +1,7 @@
-import type { ContentRepository, Stats } from './types';
-import { Page, Post, Link, Media, NavItem, Redirect, Settings, Tag, User, normalizeRedirectPath, slugify, type WidgetInstance } from '../schema';
+import type { ContentRepository, SearchResults, Stats } from './types';
+import { Page, Post, Link, Media, NavItem, Redirect, Settings, Tag, User, isInternalTag, normalizeRedirectPath, publicTags, slugify, type WidgetInstance } from '../schema';
 import { MIGRATIONS, MIGRATIONS_TABLE } from './migrations';
-import { rankByQuery } from './search';
+import { htmlToPlaintext } from '../plaintext';
 import { SEED } from '../brand';
 import { CONTENT, postsIndexUrl } from '../content';
 
@@ -75,6 +75,28 @@ function rowToLink(r: Row): Link {
   });
 }
 
+// FTS5 MATCH expression from user input: each whitespace token becomes a
+// quoted phrase (operators like AND / OR / - stay inert), the last one gets
+// a * for search-as-you-type prefix matching.
+function ftsQuery(query: string): string {
+  const tokens = query.split(/\s+/).filter(Boolean).slice(0, 8);
+  return tokens.map((t, i) => `"${t.replace(/"/g, '""')}"${i === tokens.length - 1 ? '*' : ''}`).join(' ');
+}
+
+// snippet() brackets matches with private-use-area chars so the raw text can
+// be entity-escaped before the markers become <mark> — the result is safe to
+// render with set:html / innerHTML.
+const MARK_OPEN = '\uE000';
+const MARK_CLOSE = '\uE001';
+const SNIPPET = `snippet(search_index, 5, '${MARK_OPEN}', '${MARK_CLOSE}', '…', 12)`;
+// column weights: kind, ref_id, locale (unindexed), title, excerpt, plaintext, tags
+const RANK = 'bm25(search_index, 0, 0, 0, 8.0, 4.0, 1.0, 2.0)';
+function safeSnippet(raw: unknown): string {
+  return String(raw ?? '')
+    .replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;')
+    .replaceAll(MARK_OPEN, '<mark>').replaceAll(MARK_CLOSE, '</mark>');
+}
+
 export class SqlRepository implements ContentRepository {
   private driver!: SqlDriver;
   private ready: Promise<void>;
@@ -106,12 +128,16 @@ export class SqlRepository implements ContentRepository {
         applied = 1;
       }
     }
-    for (const m of MIGRATIONS.filter((m) => m.version > applied)) {
+    const pending = MIGRATIONS.filter((m) => m.version > applied);
+    for (const m of pending) {
       await this.driver.batch([
         ...m.statements.map((sql) => ({ sql })),
         { sql: 'INSERT INTO migrations (version, applied_at) VALUES (?, ?)', args: [m.version, Date.now()] },
       ]);
     }
+    // v21 introduced the search index; plaintext can't be derived in SQL, so
+    // the backfill runs here once, right after that version lands.
+    if (pending.some((m) => m.version === 21)) await this.reindexSearch();
   }
 
   private async seed() {
@@ -136,6 +162,65 @@ export class SqlRepository implements ContentRepository {
       { sql: 'INSERT INTO links (id, label, url, ord) VALUES (?, ?, ?, 0)', args: [uuid(), 'GitHub', 'https://github.com'] },
       { sql: 'INSERT INTO links (id, label, url, ord) VALUES (?, ?, ?, 1)', args: [uuid(), 'Astro docs', 'https://docs.astro.build'] },
     ]);
+    // seed rows are inserted with raw SQL, after migrate()'s backfill ran
+    await this.reindexSearch();
+  }
+
+  // ---- search index ----
+  // One FTS5 row per published post/page. Sync lives here at the repo layer
+  // so every write path — saves, scheduled publishes, restores, seeds —
+  // flows through the same statements.
+  private postIndexStatements(r: Row): SqlStatement[] {
+    const stmts: SqlStatement[] = [
+      { sql: "DELETE FROM search_index WHERE kind = 'post' AND ref_id = ?", args: [r.id] },
+    ];
+    if (r.status === 'published') {
+      stmts.push({
+        sql: "INSERT INTO search_index (kind, ref_id, locale, title, excerpt, plaintext, tags) VALUES ('post', ?, '', ?, ?, ?, ?)",
+        args: [
+          r.id, r.title, r.excerpt ?? '',
+          htmlToPlaintext(String(r.body_html ?? '')) || String(r.body ?? ''),
+          publicTags(JSON.parse(String(r.tags ?? '[]'))).join(' '),
+        ],
+      });
+    }
+    return stmts;
+  }
+  private pageIndexStatements(r: Row): SqlStatement[] {
+    const stmts: SqlStatement[] = [
+      { sql: "DELETE FROM search_index WHERE kind = 'page' AND ref_id = ?", args: [r.id] },
+    ];
+    if (r.status === 'published') {
+      stmts.push({
+        sql: "INSERT INTO search_index (kind, ref_id, locale, title, excerpt, plaintext, tags) VALUES ('page', ?, ?, ?, ?, ?, '')",
+        args: [r.id, r.locale ?? '', r.title, r.seo_desc ?? '', htmlToPlaintext(String(r.body_html ?? ''))],
+      });
+    }
+    return stmts;
+  }
+  private async syncPostIndex(id: string) {
+    const r = await this.first('SELECT id, status, title, excerpt, tags, body, body_html FROM posts WHERE id = ?', [id]);
+    await this.driver.batch(
+      r ? this.postIndexStatements(r) : [{ sql: "DELETE FROM search_index WHERE kind = 'post' AND ref_id = ?", args: [id] }]
+    );
+  }
+  private async syncPageIndex(id: string) {
+    const r = await this.first('SELECT id, status, locale, title, seo_desc, body_html FROM pages WHERE id = ?', [id]);
+    await this.driver.batch(
+      r ? this.pageIndexStatements(r) : [{ sql: "DELETE FROM search_index WHERE kind = 'page' AND ref_id = ?", args: [id] }]
+    );
+  }
+  // full rebuild: the v21 backfill, restores, seeds
+  private async reindexSearch() {
+    const [posts, pages] = await Promise.all([
+      this.driver.all("SELECT id, status, title, excerpt, tags, body, body_html FROM posts WHERE status = 'published'"),
+      this.driver.all("SELECT id, status, locale, title, seo_desc, body_html FROM pages WHERE status = 'published'"),
+    ]);
+    await this.driver.batch([
+      { sql: 'DELETE FROM search_index' },
+      ...posts.flatMap((r) => this.postIndexStatements(r)),
+      ...pages.flatMap((r) => this.pageIndexStatements(r)),
+    ]);
   }
 
   // ---- pages ----
@@ -199,10 +284,14 @@ export class SqlRepository implements ContentRepository {
     }
     args.push(id);
     await this.driver.run(`UPDATE pages SET ${sets.join(', ')} WHERE id = ?`, args);
+    await this.syncPageIndex(id);
   }
   async deletePage(id: string) {
     await this.ready;
-    await this.driver.run('DELETE FROM pages WHERE id = ?', [id]);
+    await this.driver.batch([
+      { sql: 'DELETE FROM pages WHERE id = ?', args: [id] },
+      { sql: "DELETE FROM search_index WHERE kind = 'page' AND ref_id = ?", args: [id] },
+    ]);
   }
 
   // ---- posts ----
@@ -313,27 +402,29 @@ export class SqlRepository implements ContentRepository {
         })),
       ]);
     }
+    await this.syncPostIndex(id);
   }
   async deletePost(id: string) {
     await this.ready;
     await this.driver.batch([
       { sql: 'DELETE FROM posts WHERE id = ?', args: [id] },
       { sql: 'DELETE FROM post_authors WHERE post_id = ?', args: [id] },
+      { sql: "DELETE FROM search_index WHERE kind = 'post' AND ref_id = ?", args: [id] },
     ]);
   }
   async publishDuePosts(now: number) {
     await this.ready;
-    const due = await this.first(
-      "SELECT COUNT(*) AS n FROM posts WHERE status = 'scheduled' AND scheduled_at IS NOT NULL AND scheduled_at <= ?",
+    const due = await this.driver.all(
+      "SELECT id FROM posts WHERE status = 'scheduled' AND scheduled_at IS NOT NULL AND scheduled_at <= ?",
       [now]
     );
-    const n = Number(due?.n ?? 0);
-    if (!n) return 0;
+    if (!due.length) return 0;
     await this.driver.run(
       "UPDATE posts SET status = 'published', published_at = COALESCE(published_at, scheduled_at), scheduled_at = NULL, updated_at = ? WHERE status = 'scheduled' AND scheduled_at IS NOT NULL AND scheduled_at <= ?",
       [now, now]
     );
-    return n;
+    for (const r of due) await this.syncPostIndex(String(r.id));
+    return due.length;
   }
 
   // ---- media ----
@@ -556,25 +647,75 @@ export class SqlRepository implements ContentRepository {
   }
 
   // ---- search ----
-  async searchPublished(query: string) {
-    await this.ready;
+  async searchPublished(query: string, opts?: { locale?: string }): Promise<SearchResults> {
+    await this.ready;
+    const trimmed = query.trim();
+    if (!trimmed) return { posts: [], pages: [], tags: [], authors: [] };
+    const locale = opts?.locale ?? '';
+    let postRows: Row[];
+    let pageRows: Row[];
+    try {
+      [postRows, pageRows] = await Promise.all([
+        this.driver.all(
+          `SELECT p.*, ${SNIPPET} AS snip FROM search_index JOIN posts p ON p.id = search_index.ref_id
+           WHERE search_index MATCH ? AND search_index.kind = 'post' AND p.status = 'published'
+           ORDER BY ${RANK} LIMIT 50`,
+          [ftsQuery(trimmed)]
+        ),
+        // locale is a boost, never a filter: the visitor's language sorts
+        // first, every locale stays visible (en/es cover different topics)
+        this.driver.all(
+          `SELECT g.*, ${SNIPPET} AS snip FROM search_index JOIN pages g ON g.id = search_index.ref_id
+           WHERE search_index MATCH ? AND search_index.kind = 'page' AND g.status = 'published'
+           ORDER BY (search_index.locale = ?) DESC, ${RANK} LIMIT 50`,
+          [ftsQuery(trimmed), locale]
+        ),
+      ]);
+    } catch {
+      // FTS5 unavailable or a query form it rejects — degrade to the old
+      // LIKE scan (recency-ordered, snippets fall back to excerpt/seo_desc)
+      [postRows, pageRows] = await this.likeSearch(trimmed, locale);
+    }
+    const like = `%${trimmed.replace(/[%_]/g, ' ').trim()}%`;
+    const [authors, tagRows, userRows] = await Promise.all([
+      this.authorMap(),
+      this.driver.all('SELECT * FROM tags WHERE name LIKE ? OR slug LIKE ? ORDER BY name COLLATE NOCASE ASC LIMIT 20', [like, like]),
+      this.driver.all('SELECT * FROM users WHERE name LIKE ? OR bio LIKE ? ORDER BY name COLLATE NOCASE ASC LIMIT 20', [like, like]),
+    ]);
+    const tags = tagRows.map(rowToTag).filter((t) => !isInternalTag(t.name));
+    let tagCounts = new Map<string, number>();
+    if (tags.length) {
+      const published = await this.driver.all("SELECT tags FROM posts WHERE status = 'published'");
+      for (const r of published) {
+        for (const name of JSON.parse(String(r.tags ?? '[]')) as string[]) {
+          const key = name.toLowerCase();
+          tagCounts.set(key, (tagCounts.get(key) ?? 0) + 1);
+        }
+      }
+    }
+    return {
+      posts: postRows.map((r) => ({
+        doc: rowToPost(r, authors.get(String(r.id))),
+        snippet: safeSnippet(r.snip ?? r.excerpt ?? ''),
+      })),
+      pages: pageRows.map((r) => ({ doc: rowToPage(r), snippet: safeSnippet(r.snip ?? r.seo_desc ?? '') })),
+      tags: tags.map((tag) => ({ tag, count: tagCounts.get(tag.name.toLowerCase()) ?? 0 })),
+      authors: userRows.map(rowToUser),
+    };
+  }
+  private async likeSearch(query: string, locale: string): Promise<[Row[], Row[]]> {
     const q = `%${query.replace(/[%_]/g, ' ').trim()}%`;
-    if (q === '%%') return { posts: [], pages: [] };
-    const [posts, pages, authors] = await Promise.all([
+    if (q === '%%') return [[], []];
+    return Promise.all([
       this.driver.all(
         "SELECT * FROM posts WHERE status = 'published' AND (title LIKE ? OR excerpt LIKE ? OR body_html LIKE ? OR body LIKE ?) ORDER BY published_at DESC LIMIT 50",
         [q, q, q, q]
       ),
       this.driver.all(
-        "SELECT * FROM pages WHERE status = 'published' AND (title LIKE ? OR body_html LIKE ?) ORDER BY updated_at DESC LIMIT 50",
-        [q, q]
+        "SELECT * FROM pages WHERE status = 'published' AND (title LIKE ? OR body_html LIKE ?) ORDER BY (locale = ?) DESC, updated_at DESC LIMIT 50",
+        [q, q, locale]
       ),
-      this.authorMap(),
     ]);
-    return {
-      posts: rankByQuery(posts.map((r) => rowToPost(r, authors.get(String(r.id)))), query),
-      pages: pages.map(rowToPage),
-    };
   }
 
   // ---- restore ----
@@ -584,9 +725,11 @@ export class SqlRepository implements ContentRepository {
       ...['posts', 'pages', 'media', 'links', 'tags', 'nav_items', 'users', 'post_authors', 'redirects'].map((t) => ({
         sql: `DELETE FROM ${t}`,
       })),
+      // p.locale defaults to '' via the zod schema, so pre-v20 backups
+      // restore cleanly as default-locale pages
       ...content.pages.map((p) => ({
-        sql: 'INSERT INTO pages (id, slug, title, status, is_home, blocks, body_json, body_html, seo_title, seo_desc, template, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)',
-        args: [p.id, p.slug, p.title, p.status, p.isHome ? 1 : 0, JSON.stringify(p.blocks), p.bodyJson, p.bodyHtml, p.seoTitle, p.seoDesc, p.template, p.createdAt, p.updatedAt],
+        sql: 'INSERT INTO pages (id, slug, title, status, is_home, locale, blocks, body_json, body_html, seo_title, seo_desc, template, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)',
+        args: [p.id, p.slug, p.title, p.status, p.isHome ? 1 : 0, p.locale, JSON.stringify(p.blocks), p.bodyJson, p.bodyHtml, p.seoTitle, p.seoDesc, p.template, p.createdAt, p.updatedAt],
       })),
       // p.collection defaults to 'posts' via the zod schema, so pre-v19
       // backups restore cleanly into the built-in collection
@@ -628,6 +771,7 @@ export class SqlRepository implements ContentRepository {
     ];
     await this.driver.batch(stmts);
     await this.updateSettings(content.settings);
+    await this.reindexSearch();
   }
 
   // ---- redirects ----

package/src/lib/repo/sqlite.ts

@@ -37,7 +37,9 @@ export class SqliteRepository extends SqlRepository {
         const { mkdirSync } = await import(/* @vite-ignore */ 'node:fs');
         mkdirSync('./data', { recursive: true });
       }
-      return new LibsqlDriver(createClient({ url }));
+      // remote libSQL (Turso, sqld) needs a token; local files don't
+      const authToken = env('SQLITE_AUTH_TOKEN', '');
+      return new LibsqlDriver(createClient(authToken ? { url, authToken } : { url }));
     });
   }
 }

package/src/lib/repo/types.ts

@@ -7,6 +7,19 @@ export interface Stats {
   linkClicks: number;
 }
 
+// snippet is safe HTML: entity-escaped text with <mark> around matched terms
+export interface SearchHit<T> {
+  doc: T;
+  snippet: string;
+}
+
+export interface SearchResults {
+  posts: SearchHit<Post>[];
+  pages: SearchHit<Page>[];
+  tags: { tag: Tag; count: number }[];
+  authors: User[];
+}
+
 // The single contract both backends implement. The app only ever imports
 // this — never a concrete adapter.
 export interface ContentRepository {
@@ -101,9 +114,12 @@ export interface ContentRepository {
   reorderNavItems(ids: string[]): Promise<void>;
   deleteNavItem(id: string): Promise<void>;
 
-  // public search — ranked LIKE over published posts and pages (title >
-  // excerpt > body). Behind this method so FTS can replace it transparently.
-  searchPublished(query: string): Promise<{ posts: Post[]; pages: Page[] }>;
+  // public search — FTS5 over published posts and pages (bm25: title >
+  // excerpt > tags > body) plus name matches from the tag registry (internal
+  // #tags excluded) and author profiles. opts.locale is a ranking boost,
+  // never a filter: pages in the visitor's locale sort first, every locale
+  // stays visible (en/es cover different topics, not translations).
+  searchPublished(query: string, opts?: { locale?: string }): Promise<SearchResults>;
 
   // backup restore — id-preserving replace-all from a backup's content.json.
   // Users restore WITHOUT password hashes (backups never contain them).

package/src/lib/search-config.ts

@@ -0,0 +1,10 @@
+// Search feature toggle, configured per project via the integration:
+//   acms({ search: { enabled: false } })
+// integration.mjs validates and fills defaults before serializing; when
+// disabled it also skips injecting /search and /api/search, so this flag
+// only decides whether the layout renders the trigger + modal.
+import { userConfig } from 'virtual:acms-config';
+
+export const SEARCH = {
+  enabled: userConfig.search?.enabled ?? true,
+};

package/src/lib/search-i18n.ts

@@ -0,0 +1,45 @@
+// UI strings for the search modal and /search page. There is no site-wide
+// translation catalog yet — search is the first public surface with
+// per-locale chrome, so the dict lives here until one exists. Locales fall
+// back to English.
+export interface SearchStrings {
+  label: string;
+  placeholder: string;
+  posts: string;
+  pages: string;
+  tags: string;
+  authors: string;
+  empty: string;
+  result: string;
+  results: string;
+  button: string;
+}
+
+const STRINGS: Record<string, SearchStrings> = {
+  en: {
+    label: 'Search',
+    placeholder: 'Search posts, pages, tags and authors',
+    posts: 'Posts',
+    pages: 'Pages',
+    tags: 'Tags',
+    authors: 'Authors',
+    empty: 'Nothing found for',
+    result: 'result',
+    results: 'results',
+    button: 'Search',
+  },
+  es: {
+    label: 'Buscar',
+    placeholder: 'Busca artículos, páginas, etiquetas y autores',
+    posts: 'Artículos',
+    pages: 'Páginas',
+    tags: 'Etiquetas',
+    authors: 'Autores',
+    empty: 'No hay resultados para',
+    result: 'resultado',
+    results: 'resultados',
+    button: 'Buscar',
+  },
+};
+
+export const searchStrings = (locale: string): SearchStrings => STRINGS[locale] ?? STRINGS.en;

package/src/pages/admin/index.astro

@@ -57,18 +57,21 @@ function ago(ts: number) {
   <div id="acms-update" hidden data-current={coreVersion} class="card card-pad" style="display:none;align-items:center;gap:10px;margin-bottom:14px;border-left:3px solid var(--accent)">
     <div>
       <b>ACMS <span id="acms-update-latest"></span> is available</b>
-      <span class="hint" style="margin-left:6px">you're on {coreVersion} — run <code>npx acms update</code>, then <code>npm run deploy</code>.</span>
+      <span class="hint" style="margin-left:6px">you're on {coreVersion} — run <code>npx acms update</code>; it prints the deploy steps for your setup.</span>
     </div>
-    <a class="btn sm ghost" style="margin-left:auto" href="https://github.com/zurielbm/acms-subir/releases" target="_blank" rel="noopener">What's new</a>
+    <a id="acms-update-notes" class="btn sm ghost" style="margin-left:auto" href="https://www.npmjs.com/package/@acms-subir/core" target="_blank" rel="noopener">What's new</a>
+    <button id="acms-update-dismiss" class="btn sm ghost" type="button" aria-label="Dismiss until the next release" title="Dismiss until the next release">×</button>
   </div>
   <script>
     // Ghost-style update nudge: npm registry check, cached a day, silent on
-    // any failure (offline, unpublished package, CORS).
+    // any failure (offline, unpublished package, CORS). Dismissal is stored
+    // per-version, so the banner returns on the next release.
     (async () => {
       const el = document.getElementById('acms-update');
       if (!el) return;
       const current = el.dataset.current ?? '';
       const KEY = 'acms-update-check';
+      const DISMISSED = 'acms-update-dismissed';
       let latest = '';
       try {
         const cached = JSON.parse(localStorage.getItem(KEY) ?? 'null');
@@ -86,12 +89,23 @@ function ago(ts: number) {
         for (let i = 0; i < 3; i++) { if ((pa[i] ?? 0) < (pb[i] ?? 0)) return true; if ((pa[i] ?? 0) > (pb[i] ?? 0)) return false; }
         return false;
       };
-      if (latest && lt(current, latest)) {
-        const slot = document.getElementById('acms-update-latest');
-        if (slot) slot.textContent = latest;
-        el.hidden = false;
-        el.style.display = 'flex';
+      if (!latest || !lt(current, latest)) return;
+      try { if (localStorage.getItem(DISMISSED) === latest) return; } catch {}
+      const slot = document.getElementById('acms-update-latest');
+      if (slot) slot.textContent = latest;
+      // deep-link to the version's npm page — the repository is self-hosted and
+      // private, so npm is the only public place this release exists
+      const notes = document.getElementById('acms-update-notes');
+      if (notes instanceof HTMLAnchorElement) {
+        notes.href = `https://www.npmjs.com/package/@acms-subir/core/v/${encodeURIComponent(latest)}`;
       }
+      document.getElementById('acms-update-dismiss')?.addEventListener('click', () => {
+        try { localStorage.setItem(DISMISSED, latest); } catch {}
+        el.hidden = true;
+        el.style.display = 'none';
+      });
+      el.hidden = false;
+      el.style.display = 'flex';
     })();
   </script>