@acms-subir/core 0.0.2 → 0.1.0

package/CHANGELOG.md

@@ -0,0 +1,47 @@
+# @acms-subir/core
+
+## 0.1.0
+
+### Minor Changes
+
+- d2d4761: Calendar card: embed a Google Calendar (or any ICS feed) as a native, themeable widget instead of an iframe. One card renders one view — month grid, week strip, or upcoming list — server-side at request time from the feed (5-minute cache, recurring events expanded, site timezone honored), with a small vanilla script for month/week navigation and an event-details popover. Paste an embed URL, calendar ID, or .ics link in the editor; add up to six color-coded feeds per card, plus an optional title/subtitle. Styling is driven by scoped `--cal-*` custom properties defaulting to theme tokens and stable `.pc-cal-*` class hooks, so themes and Settings → Code injection can restyle it freely.
+- 769f9de: Code-first content config: `acms({ content })` renames the post collection per project
+
+  - `content.posts.{singular,plural,base}` changes every user-visible label
+    (site nav, admin sidebar, headings, buttons, feeds) and moves the public
+    routes off `/blog` — validated at build time, defaults unchanged.
+  - Tag archives moved to a standalone `/tag/[slug]` (configurable via
+    `content.tags.base`); `<postsBase>/tag/*` always 301s to the new location.
+  - When `base` is renamed, `/blog/*` (plus any `content.posts.redirectFrom`
+    entries) 301s to the new base — only on requests that would otherwise 404,
+    so rules never shadow real content.
+  - Internal identifiers (DB rows, backup format, `/admin/posts`) are never
+    renamed, so existing backups and sessions survive.
+  - Scaffolder: new "What do you call your posts?" prompt (`--content
+articles|releases|notes`) writes the block into `astro.config.mjs`.
+
+- 769f9de: Multiple content collections: `acms({ content: { collections } })`
+
+  - Each key in the `collections` map gets its own public routes at `base`,
+    admin section at `/admin/c/<key>`, sidebar entry, dashboard stat, and
+    feed/sitemap entries. `posts` is the built-in collection; `content.posts`
+    stays as shorthand for `collections.posts`. Labels default from the key.
+  - Migration v19 rebuilds the posts table: new `collection` column (existing
+    rows land in `posts`) and slug uniqueness becomes per-collection, so the
+    same slug can exist in different collections. Pre-v19 backups restore
+    cleanly.
+  - One shared tag registry; tag archives group entries by collection when
+    more than one is configured. `/rss.xml` stays the everything-feed with a
+    collection `<category>` per item.
+  - The editor gains a collection switcher (multi-collection sites only);
+    moving a published entry between collections leaves a 301. Post-list cards
+    can target a collection.
+  - `/admin/posts` and `/admin/posts/[id]` 308 to their `/admin/c/posts`
+    equivalents. Removing a collection key hides its routes but never deletes
+    rows — the dashboard shows a restore notice.
+
+- 8e1f688: The update story: `acms update` now prints the release notes it crossed and deploy instructions matched to your target — `npm run deploy` for Cloudflare, `docker compose up -d --build` for Docker — plus a `--check` flag that exits 1 when behind, for CI or cron. Notes come from the `CHANGELOG.md` that now ships inside the package, so nothing depends on a git host or an API token. The admin dashboard shows a dismissible banner when a new release is out (checked at most daily, straight from the npm registry, fail-open), and `astro dev` logs a once-a-day nudge (opt out with `ACMS_NO_UPDATE_CHECK=1`). The scaffolder no longer freezes silently during `npm install` — the spinner animates with elapsed time — and its Next-steps box now mentions `npx acms update`.
+
+### Patch Changes
+
+- 19bf3c7: Enforce the documented "project-local routes win" rule at injection time. Astro registers injected and file-based routes at equal priority and serves the injected one on a collision (with a deprecation warning that this becomes a hard error), so the integration now skips injecting any route whose pattern the consumer already defines in `src/pages/` — checked as `<pattern>.astro`, `<pattern>.ts`, `<pattern>/index.astro`, or `<pattern>/index.ts`. Shell overrides of `/`, collection indexes, feeds, and any other public route now actually take effect.

package/cli.mjs

@@ -1,26 +1,32 @@
 #!/usr/bin/env node
 // `acms` — tiny maintenance CLI installed with @acms-subir/core.
 //   acms update           check the registry, install the latest core, print what's new
+//   acms update --check   just report whether an update exists (exit 1 if behind)
 //   acms doctor           sanity-check the project setup
 //   acms add cloudflare   retrofit Workers deployment (wrangler.jsonc, deps, D1/R2)
 //   acms add docker       retrofit self-hosting (Dockerfile, compose.yml)
 import { spawnSync } from 'node:child_process';
 import { readFileSync, writeFileSync, existsSync } from 'node:fs';
 import { createRequire } from 'node:module';
-import { join } from 'node:path';
+import { dirname, join } from 'node:path';
 
 const PKG = '@acms-subir/core';
 const cmd = process.argv[2];
 
 const read = (p) => { try { return readFileSync(p, 'utf8'); } catch { return ''; } };
-const installedVersion = () => {
+const installedPkgJson = () => {
   try {
-    const require = createRequire(join(process.cwd(), 'package.json'));
-    return JSON.parse(readFileSync(require.resolve(`${PKG}/package.json`), 'utf8')).version;
+    return createRequire(join(process.cwd(), 'package.json')).resolve(`${PKG}/package.json`);
   } catch { return null; }
 };
+const installedVersion = () => {
+  const p = installedPkgJson();
+  try { return p ? JSON.parse(readFileSync(p, 'utf8')).version : null; } catch { return null; }
+};
 const latestVersion = async () => {
-  const res = await fetch(`https://registry.npmjs.org/${encodeURIComponent(PKG)}/latest`);
+  const res = await fetch(`https://registry.npmjs.org/${encodeURIComponent(PKG)}/latest`, {
+    signal: AbortSignal.timeout(10_000),
+  });
   if (!res.ok) throw new Error(`registry responded ${res.status}`);
   return (await res.json()).version;
 };
@@ -30,7 +36,33 @@ const semverLt = (a, b) => {
   return false;
 };
 
+// Release notes come from the CHANGELOG that changesets writes into the
+// package itself, read after the install from the freshly unpacked copy. No
+// git-host API is involved on purpose: the repository lives on a private
+// OneDev instance, so anything API-based would need a token on every site
+// that runs this command.
+const changelogFor = (pkgJsonPath) => (pkgJsonPath ? read(join(dirname(pkgJsonPath), 'CHANGELOG.md')) : '');
+// Entries newer than `current` up to `latest`, oldest first. Changesets writes
+// one "## X.Y.Z" heading per release.
+const releaseNotes = (md, current, latest) => {
+  // split on every "## " heading, not just the version ones, so a hand-written
+  // "## Unreleased" section cannot get swallowed into the entry above it
+  const heads = [...md.matchAll(/^## +(.*)$/gm)];
+  return heads
+    .map((h, i) => ({
+      version: h[1].trim().match(/^\d+\.\d+\.\d+$/)?.[0],
+      body: md.slice(h.index + h[0].length, heads[i + 1]?.index ?? md.length).trim(),
+    }))
+    .filter((r) => r.version && semverLt(current, r.version) && !semverLt(latest, r.version))
+    .sort((a, b) => (semverLt(a.version, b.version) ? -1 : 1));
+};
+const deployTargets = () => ({
+  cloudflare: ['wrangler.jsonc', 'wrangler.json', 'wrangler.toml'].some((f) => existsSync(f)),
+  docker: ['compose.yml', 'compose.yaml', 'docker-compose.yml', 'Dockerfile'].some((f) => existsSync(f)),
+});
+
 if (cmd === 'update') {
+  const checkOnly = process.argv.includes('--check');
   const current = installedVersion();
   if (!current) { console.error(`✗ ${PKG} is not installed here — run this from your site's folder.`); process.exit(1); }
   let latest;
@@ -39,13 +71,38 @@ if (cmd === 'update') {
     console.log(`✓ Already up to date (${current}).`);
     process.exit(0);
   }
+  if (checkOnly) {
+    console.log(`Update available: ${current} → ${latest}. Run: npx acms update`);
+    process.exit(1);
+  }
   console.log(`Updating ${PKG} ${current} → ${latest}…`);
   const res = spawnSync('npm', ['install', `${PKG}@latest`, '--no-audit', '--no-fund'], { stdio: 'inherit' });
   if (res.status !== 0) process.exit(res.status ?? 1);
-  console.log(`
-✓ Updated to ${latest}. What's new: https://github.com/zurielbm/acms-subir/releases
-  Deploy when ready:  npm run deploy
-  (the database migrates itself on the first request — no manual steps)`);
+  console.log(`\n✓ Updated to ${latest}.`);
+  const notes = releaseNotes(changelogFor(installedPkgJson()), current, latest);
+  if (notes.length) {
+    console.log(`\nWhat's new:`);
+    for (const r of notes) {
+      console.log(`\n  ${PKG} ${r.version}`);
+      if (r.body) console.log(r.body.split('\n').map((l) => `    ${l}`).join('\n'));
+    }
+  } else {
+    console.log(`\nWhat's new: https://www.npmjs.com/package/${PKG}/v/${latest}`);
+  }
+  const t = deployTargets();
+  const steps = [
+    ...(t.cloudflare ? ['  npm run deploy                       # Cloudflare Workers'] : []),
+    ...(t.docker ? ['  git push, then on your server:       docker compose up -d --build'] : []),
+  ];
+  console.log([
+    '',
+    'Deploy when ready:',
+    ...(steps.length ? steps : ['  rebuild and redeploy your host']),
+    '  (the database migrates itself on the first request — no manual steps)',
+  ].join('\n'));
+  // the registry fetch leaves a keep-alive socket in undici's pool, which can
+  // hold the event loop open for seconds after there is nothing left to do
+  process.exit(0);
 } else if (cmd === 'add') {
   // Retrofit a deployment target onto an existing project. Both targets share
   // one codebase — astro.config picks the adapter via DEPLOY_TARGET — so
@@ -251,6 +308,7 @@ data
 
 Usage:
   acms update           Update the CMS core to the latest release
+  acms update --check   Report whether an update exists (exit 1 if behind)
   acms doctor           Check this project's setup
   acms add cloudflare   Add Workers deployment to this project (--provision creates D1 + R2)
   acms add docker       Add Docker self-hosting to this project`);

package/integration.mjs

@@ -1,4 +1,5 @@
-import { readFileSync } from 'node:fs';
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 
 // This file is loaded by Node while Astro evaluates the consumer's
@@ -27,7 +28,6 @@ const ROUTES = [
   ['/[...slug]', '[...slug].astro'],
   ['/author/[slug]', 'author/[slug].astro'],
   ['/links', 'links.astro'],
-  ['/search', 'search.astro'],
   ['/go/[id]', 'go/[id].ts'],
   ['/media/[...key]', 'media/[...key].ts'],
   ['/embed/[pageId]/[blockId]', 'embed/[pageId]/[blockId].ts'],
@@ -180,6 +180,55 @@ function resolveI18n(i18n, contentBases) {
   return { locales, defaultLocale };
 }
 
+// Defaults + validation for acms({ search }). Search ships on; disabling it
+// removes the /search page(s) and /api/search from the route table, and the
+// layout skips the header trigger + modal (lib/search-config.ts).
+function resolveSearch(search) {
+  if (search === undefined) return { enabled: true };
+  const unknown = Object.keys(search).filter((k) => k !== 'enabled');
+  if (unknown.length > 0) {
+    throw new Error(
+      `acms: unknown search key${unknown.length > 1 ? 's' : ''} ${unknown.map((k) => `"${k}"`).join(', ')} — ` +
+        'the only valid key is search.enabled'
+    );
+  }
+  const enabled = search.enabled ?? true;
+  if (typeof enabled !== 'boolean') {
+    throw new Error('acms: search.enabled must be true or false');
+  }
+  return { enabled };
+}
+
+const semverLt = (a, b) => {
+  const pa = a.split('.').map(Number), pb = b.split('.').map(Number);
+  for (let i = 0; i < 3; i++) { if ((pa[i] ?? 0) < (pb[i] ?? 0)) return true; if ((pa[i] ?? 0) > (pb[i] ?? 0)) return false; }
+  return false;
+};
+
+// Dev-only update nudge: one log line when a newer core is on npm, checked at
+// most once per 24h (stamp file in Astro's cache dir). Fire-and-forget — it
+// never delays startup and swallows every failure. ACMS_NO_UPDATE_CHECK=1
+// disables it entirely.
+async function devUpdateNudge(cacheDir, logger) {
+  const stampFile = join(cacheDir, 'acms-update-check.json');
+  try {
+    const stamp = JSON.parse(readFileSync(stampFile, 'utf8'));
+    if (Date.now() - stamp.at < 86_400_000) return;
+  } catch {}
+  try {
+    const res = await fetch('https://registry.npmjs.org/@acms-subir%2Fcore/latest', {
+      signal: AbortSignal.timeout(3000),
+    });
+    if (!res.ok) return;
+    const latest = (await res.json()).version ?? '';
+    mkdirSync(dirname(stampFile), { recursive: true });
+    writeFileSync(stampFile, JSON.stringify({ at: Date.now(), latest }));
+    if (latest && semverLt(CORE_VERSION, latest)) {
+      logger.info(`v${latest} is available (you're on ${CORE_VERSION}) — npx acms update`);
+    }
+  } catch {}
+}
+
 const CONFIG_ID = 'virtual:acms-config';
 const THEMES_ID = 'virtual:acms-user-themes';
 
@@ -231,6 +280,10 @@ function acmsVitePlugin(userConfig) {
  *   Home page content per language is authored in /admin as a normal page
  *   marked "home" with that language selected. Omit for monolingual sites —
  *   nothing changes.
+ * @param {{enabled?: boolean}} [options.search]
+ *   Public site search: the /search page, the /api/search JSON endpoint, and
+ *   the header search modal. On by default — set `enabled: false` to remove
+ *   all three.
  * @returns {import('astro').AstroIntegration}
  */
 export default function acms(options = {}) {
@@ -240,12 +293,14 @@ export default function acms(options = {}) {
     [content.tags.base, 'content.tags.base'],
   ]);
   const i18n = resolveI18n(options.i18n, contentBases);
+  const search = resolveSearch(options.search);
   const userConfig = {
     coreVersion: CORE_VERSION,
     brand: options.brand ?? {},
     seed: options.seed ?? {},
     content,
     i18n,
+    search,
   };
   const routes = [...ROUTES];
   for (const c of Object.values(content.collections)) {
@@ -257,13 +312,35 @@ export default function acms(options = {}) {
   for (const l of i18n.locales) {
     if (l !== i18n.defaultLocale) routes.push([`/${l}`, 'index.astro']);
   }
+  if (search.enabled) {
+    routes.push(['/search', 'search.astro'], ['/api/search', 'api/search.ts']);
+    // a locale-prefixed search page per non-default locale, mirroring the
+    // per-locale home routes; search.astro derives its locale from the path
+    for (const l of i18n.locales) {
+      if (l !== i18n.defaultLocale) routes.push([`/${l}/search`, 'search.astro']);
+    }
+  }
+  let cacheDir = '';
   return {
     name: 'acms',
     hooks: {
-      'astro:config:setup': ({ command, injectRoute, addMiddleware, updateConfig }) => {
+      'astro:config:setup': ({ config, command, injectRoute, addMiddleware, updateConfig }) => {
+        if (config.cacheDir) cacheDir = fileURLToPath(config.cacheDir);
         updateConfig({ vite: { plugins: [acmsVitePlugin(userConfig)] } });
 
+        // "Project-local routes win" is enforced here: Astro registers
+        // injected and file-based routes at equal priority (and the injected
+        // one is served on a collision), so a route is only injected when the
+        // consumer has no file at the same pattern in src/pages.
+        const pagesDir = fileURLToPath(new URL('./pages/', config.srcDir));
+        const overridden = (pattern) => {
+          const rel = pattern === '/' ? 'index' : pattern.slice(1);
+          return ['.astro', '.ts', '/index.astro', '/index.ts'].some((suffix) =>
+            existsSync(`${pagesDir}${rel}${suffix}`)
+          );
+        };
         for (const [pattern, file] of routes) {
+          if (overridden(pattern)) continue;
           injectRoute({ pattern, entrypoint: entry(`./src/pages/${file}`) });
         }
         // Auth gate, trailing-slash canonicalization, redirect fallback,
@@ -281,6 +358,11 @@ export default function acms(options = {}) {
           });
         }
       },
+      // fires only for `astro dev` — builds and previews never phone anywhere
+      'astro:server:start': ({ logger }) => {
+        if (!cacheDir || process.env.ACMS_NO_UPDATE_CHECK) return;
+        void devUpdateNudge(cacheDir, logger);
+      },
     },
   };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@acms-subir/core",
-  "version": "0.0.2",
+  "version": "0.1.0",
   "publishConfig": {
     "access": "public"
   },
@@ -10,7 +10,7 @@
   "homepage": "https://acms.subir.dev",
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/zurielbm/acms-subir.git",
+    "url": "git+https://onedev.subir.dev/acms-subir.git",
     "directory": "packages/core"
   },
   "keywords": [
@@ -40,7 +40,8 @@
   "files": [
     "integration.mjs",
     "cli.mjs",
-    "src"
+    "src",
+    "CHANGELOG.md"
   ],
   "dependencies": {
     "@dnd-kit/core": "^6.3.1",
@@ -64,7 +65,7 @@
   "peerDependencies": {
     "@astrojs/cloudflare": "^12.6.13",
     "@astrojs/node": "^9.2.0",
-    "@astrojs/react": "^6.0.2",
+    "@astrojs/react": "^4.4.2",
     "astro": "^5.7.0",
     "react": "^19.0.0",
     "react-dom": "^19.0.0"

package/src/layouts/Site.astro

@@ -6,6 +6,8 @@ import { siteOrigin, absUrl, canonicalPath } from '../lib/seo';
 import { siteLang } from '../lib/dates';
 import { CONTENT } from '../lib/content';
 import { I18N, localeFromPath, localeHomeUrl } from '../lib/i18n';
+import { SEARCH } from '../lib/search-config';
+import { searchStrings } from '../lib/search-i18n';
 import '../styles/site.css';
 import '../styles/cards.css';
 
@@ -62,6 +64,11 @@ const metaDescription = description || settings.tagline || undefined;
 // locale setting (a date-formatting concern) stays the fallback
 const reqLocale = I18N.enabled ? localeFromPath(current) : '';
 const htmlLang = reqLocale || siteLang(settings);
+// search modal chrome: strings follow the document language, the form's
+// no-JS fallback goes to the (locale-prefixed) /search page
+const showSearch = !bare && SEARCH.enabled;
+const searchT = searchStrings(htmlLang.slice(0, 2));
+const searchAction = reqLocale && reqLocale !== I18N.defaultLocale ? `/${reqLocale}/search` : '/search';
 // hreflang alternates connect the per-language home pages; other routes have
 // no language twins yet, so alternates are emitted only on home paths
 const isHomePath = I18N.enabled && I18N.locales.some((l) => current === localeHomeUrl(l));
@@ -188,9 +195,114 @@ const homeJsonLd =
               ))}
             </span>
           )}
+          {showSearch && (
+            <a class="pc-search-trigger" href={searchAction} data-search-open aria-label={searchT.label}>
+              <svg width="17" height="17" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.2" stroke-linecap="round" aria-hidden="true"><circle cx="11" cy="11" r="7" /><path d="m20 20-3.6-3.6" /></svg>
+            </a>
+          )}
         </nav>
       </header>
     )}
+    {showSearch && (
+      <dialog class="pc-search" aria-label={searchT.label}>
+        {/* a real GET form: with JS disabled (or the fetch failing) the
+            query submits to the /search page instead of the live modal */}
+        <form class="pc-search-box" action={searchAction} method="get" role="search">
+          <svg width="18" height="18" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.2" stroke-linecap="round" aria-hidden="true"><circle cx="11" cy="11" r="7" /><path d="m20 20-3.6-3.6" /></svg>
+          <input class="pc-search-input" type="search" name="q" placeholder={searchT.placeholder} aria-label={searchT.label} autocomplete="off" />
+          <button type="button" class="pc-search-kbd" data-search-close>esc</button>
+        </form>
+        <div class="pc-search-results" hidden></div>
+      </dialog>
+    )}
+    {showSearch && (
+      <script is:inline define:vars={{ searchLocale: reqLocale, t: searchT }}>
+        (() => {
+          const dlg = document.querySelector('dialog.pc-search');
+          if (!dlg || !dlg.showModal) return;
+          const input = dlg.querySelector('.pc-search-input');
+          const box = dlg.querySelector('.pc-search-results');
+          let ctl = null;
+          let timer = 0;
+          let sel = -1;
+
+          const open = () => { if (!dlg.open) dlg.showModal(); input.focus(); input.select(); };
+          document.querySelectorAll('[data-search-open]').forEach((el) =>
+            el.addEventListener('click', (e) => { e.preventDefault(); open(); })
+          );
+          dlg.querySelectorAll('[data-search-close]').forEach((el) => el.addEventListener('click', () => dlg.close()));
+          // clicks on ::backdrop (and the dialog's transparent frame) land on
+          // the dialog element itself — descendants stop at the panel
+          dlg.addEventListener('click', (e) => { if (e.target === dlg) dlg.close(); });
+          document.addEventListener('keydown', (e) => {
+            if ((e.key === 'k' || e.key === 'K') && (e.metaKey || e.ctrlKey)) {
+              e.preventDefault();
+              dlg.open ? dlg.close() : open();
+              return;
+            }
+            const a = document.activeElement;
+            const typing = a && (/^(INPUT|TEXTAREA|SELECT)$/.test(a.tagName) || a.isContentEditable);
+            if (e.key === '/' && !typing && !dlg.open) { e.preventDefault(); open(); }
+          });
+
+          const esc = (s) => String(s).replace(/[&<>"]/g, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;' }[c]));
+          // snippet arrives pre-escaped from /api/search (only <mark> inside)
+          const hit = (url, title, meta, snippet) =>
+            `<a class="pc-search-hit" href="${esc(url)}"><span class="pc-search-t">${esc(title)}` +
+            (snippet ? `<span class="pc-search-snip">${snippet}</span>` : '') +
+            `</span>${meta ? `<span class="pc-search-m">${esc(meta)}</span>` : ''}</a>`;
+
+          const render = (d) => {
+            const groups = [];
+            if (d.posts.length) groups.push([t.posts, d.posts.map((p) => hit(p.url, p.title, p.date, p.snippet))]);
+            if (d.pages.length) groups.push([t.pages, d.pages.map((p) => hit(p.url, p.title, (p.locale || '').toUpperCase(), p.snippet))]);
+            if (d.tags.length) groups.push([t.tags, d.tags.map((g) => hit(g.url, g.name, `${g.count} ${t.posts.toLowerCase()}`))]);
+            if (d.authors.length) groups.push([t.authors, d.authors.map((u) => hit(u.url, u.name, ''))]);
+            box.innerHTML = groups.length
+              ? groups.map(([label, items]) => `<div class="pc-search-group">${esc(label)}</div>${items.join('')}`).join('')
+              : `<div class="pc-search-empty">${esc(t.empty)} “${esc(input.value.trim())}”</div>`;
+            box.hidden = false;
+            sel = -1;
+          };
+
+          input.addEventListener('input', () => {
+            clearTimeout(timer);
+            const q = input.value.trim();
+            if (!q) {
+              if (ctl) ctl.abort();
+              box.hidden = true;
+              box.innerHTML = '';
+              return;
+            }
+            timer = setTimeout(async () => {
+              if (ctl) ctl.abort();
+              ctl = new AbortController();
+              try {
+                const res = await fetch(`/api/search?q=${encodeURIComponent(q)}&locale=${encodeURIComponent(searchLocale)}`, { signal: ctl.signal });
+                if (res.ok) render(await res.json());
+              } catch { /* aborted or offline — the form still submits to /search */ }
+            }, 150);
+          });
+
+          const move = (dir) => {
+            const hits = [...box.querySelectorAll('.pc-search-hit')];
+            if (!hits.length) return;
+            sel = (sel + dir + hits.length) % hits.length;
+            hits.forEach((h, i) => h.classList.toggle('sel', i === sel));
+            hits[sel].scrollIntoView({ block: 'nearest' });
+          };
+          input.addEventListener('keydown', (e) => {
+            if (e.key === 'ArrowDown') { e.preventDefault(); move(1); }
+            else if (e.key === 'ArrowUp') { e.preventDefault(); move(-1); }
+            else if (e.key === 'Enter') {
+              const cur = box.querySelector('.pc-search-hit.sel');
+              if (cur) { e.preventDefault(); cur.click(); }
+              // no selection: the form submits to the /search page
+            }
+          });
+        })();
+      </script>
+    )}
     <main class="site-main">
       <slot />
     </main>

package/src/lib/plaintext.ts

@@ -0,0 +1,22 @@
+// Searchable plain text from rendered body_html: the FTS index stores this
+// instead of a posts column, derived once per write. Dynamic-block
+// placeholders (<div data-dyn>) carry no text, so tag-stripping drops them;
+// script/style bodies are removed explicitly. Entity decoding covers what
+// the editor emits — the named basics plus numeric escapes.
+const codePoint = (n: number) => (n > 0 && n <= 0x10ffff ? String.fromCodePoint(n) : ' ');
+
+export function htmlToPlaintext(html: string): string {
+  if (!html) return '';
+  return html
+    .replace(/<(script|style)\b[^>]*>[\s\S]*?<\/\1>/gi, ' ')
+    .replace(/<[^>]*>/g, ' ')
+    .replace(/&#x([0-9a-f]+);/gi, (_, h: string) => codePoint(parseInt(h, 16)))
+    .replace(/&#(\d+);/g, (_, n: string) => codePoint(Number(n)))
+    .replace(/&nbsp;/gi, ' ')
+    .replace(/&amp;/gi, '&')
+    .replace(/&lt;/gi, '<')
+    .replace(/&gt;/gi, '>')
+    .replace(/&quot;/gi, '"')
+    .replace(/\s+/g, ' ')
+    .trim();
+}

package/src/lib/repo/migrations.ts

@@ -226,6 +226,21 @@ export const MIGRATIONS: Migration[] = [
     version: 20,
     statements: [`ALTER TABLE pages ADD COLUMN locale TEXT NOT NULL DEFAULT ''`],
   },
+  {
+    // Public search: one FTS5 row per published post/page (title, excerpt,
+    // stripped body text, public tag names). Rows are synced by the repo on
+    // every write — no SQL triggers — and backfilled in code right after
+    // this version applies, since plaintext can't be derived in SQL.
+    // remove_diacritics makes "cafe" match "café" (matters for es content).
+    version: 21,
+    statements: [
+      `CREATE VIRTUAL TABLE IF NOT EXISTS search_index USING fts5(
+        kind UNINDEXED, ref_id UNINDEXED, locale UNINDEXED,
+        title, excerpt, plaintext, tags,
+        tokenize = 'unicode61 remove_diacritics 2'
+      )`,
+    ],
+  },
 ];
 
 export const LATEST_VERSION = MIGRATIONS[MIGRATIONS.length - 1].version;

package/src/lib/repo/sql.ts

@@ -1,7 +1,7 @@
-import type { ContentRepository, Stats } from './types';
-import { Page, Post, Link, Media, NavItem, Redirect, Settings, Tag, User, normalizeRedirectPath, slugify, type WidgetInstance } from '../schema';
+import type { ContentRepository, SearchResults, Stats } from './types';
+import { Page, Post, Link, Media, NavItem, Redirect, Settings, Tag, User, isInternalTag, normalizeRedirectPath, publicTags, slugify, type WidgetInstance } from '../schema';
 import { MIGRATIONS, MIGRATIONS_TABLE } from './migrations';
-import { rankByQuery } from './search';
+import { htmlToPlaintext } from '../plaintext';
 import { SEED } from '../brand';
 import { CONTENT, postsIndexUrl } from '../content';
 
@@ -75,6 +75,28 @@ function rowToLink(r: Row): Link {
   });
 }
 
+// FTS5 MATCH expression from user input: each whitespace token becomes a
+// quoted phrase (operators like AND / OR / - stay inert), the last one gets
+// a * for search-as-you-type prefix matching.
+function ftsQuery(query: string): string {
+  const tokens = query.split(/\s+/).filter(Boolean).slice(0, 8);
+  return tokens.map((t, i) => `"${t.replace(/"/g, '""')}"${i === tokens.length - 1 ? '*' : ''}`).join(' ');
+}
+
+// snippet() brackets matches with private-use-area chars so the raw text can
+// be entity-escaped before the markers become <mark> — the result is safe to
+// render with set:html / innerHTML.
+const MARK_OPEN = '\uE000';
+const MARK_CLOSE = '\uE001';
+const SNIPPET = `snippet(search_index, 5, '${MARK_OPEN}', '${MARK_CLOSE}', '…', 12)`;
+// column weights: kind, ref_id, locale (unindexed), title, excerpt, plaintext, tags
+const RANK = 'bm25(search_index, 0, 0, 0, 8.0, 4.0, 1.0, 2.0)';
+function safeSnippet(raw: unknown): string {
+  return String(raw ?? '')
+    .replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;')
+    .replaceAll(MARK_OPEN, '<mark>').replaceAll(MARK_CLOSE, '</mark>');
+}
+
 export class SqlRepository implements ContentRepository {
   private driver!: SqlDriver;
   private ready: Promise<void>;
@@ -106,12 +128,16 @@ export class SqlRepository implements ContentRepository {
         applied = 1;
       }
     }
-    for (const m of MIGRATIONS.filter((m) => m.version > applied)) {
+    const pending = MIGRATIONS.filter((m) => m.version > applied);
+    for (const m of pending) {
       await this.driver.batch([
         ...m.statements.map((sql) => ({ sql })),
         { sql: 'INSERT INTO migrations (version, applied_at) VALUES (?, ?)', args: [m.version, Date.now()] },
       ]);
     }
+    // v21 introduced the search index; plaintext can't be derived in SQL, so
+    // the backfill runs here once, right after that version lands.
+    if (pending.some((m) => m.version === 21)) await this.reindexSearch();
   }
 
   private async seed() {
@@ -136,6 +162,65 @@ export class SqlRepository implements ContentRepository {
       { sql: 'INSERT INTO links (id, label, url, ord) VALUES (?, ?, ?, 0)', args: [uuid(), 'GitHub', 'https://github.com'] },
       { sql: 'INSERT INTO links (id, label, url, ord) VALUES (?, ?, ?, 1)', args: [uuid(), 'Astro docs', 'https://docs.astro.build'] },
     ]);
+    // seed rows are inserted with raw SQL, after migrate()'s backfill ran
+    await this.reindexSearch();
+  }
+
+  // ---- search index ----
+  // One FTS5 row per published post/page. Sync lives here at the repo layer
+  // so every write path — saves, scheduled publishes, restores, seeds —
+  // flows through the same statements.
+  private postIndexStatements(r: Row): SqlStatement[] {
+    const stmts: SqlStatement[] = [
+      { sql: "DELETE FROM search_index WHERE kind = 'post' AND ref_id = ?", args: [r.id] },
+    ];
+    if (r.status === 'published') {
+      stmts.push({
+        sql: "INSERT INTO search_index (kind, ref_id, locale, title, excerpt, plaintext, tags) VALUES ('post', ?, '', ?, ?, ?, ?)",
+        args: [
+          r.id, r.title, r.excerpt ?? '',
+          htmlToPlaintext(String(r.body_html ?? '')) || String(r.body ?? ''),
+          publicTags(JSON.parse(String(r.tags ?? '[]'))).join(' '),
+        ],
+      });
+    }
+    return stmts;
+  }
+  private pageIndexStatements(r: Row): SqlStatement[] {
+    const stmts: SqlStatement[] = [
+      { sql: "DELETE FROM search_index WHERE kind = 'page' AND ref_id = ?", args: [r.id] },
+    ];
+    if (r.status === 'published') {
+      stmts.push({
+        sql: "INSERT INTO search_index (kind, ref_id, locale, title, excerpt, plaintext, tags) VALUES ('page', ?, ?, ?, ?, ?, '')",
+        args: [r.id, r.locale ?? '', r.title, r.seo_desc ?? '', htmlToPlaintext(String(r.body_html ?? ''))],
+      });
+    }
+    return stmts;
+  }
+  private async syncPostIndex(id: string) {
+    const r = await this.first('SELECT id, status, title, excerpt, tags, body, body_html FROM posts WHERE id = ?', [id]);
+    await this.driver.batch(
+      r ? this.postIndexStatements(r) : [{ sql: "DELETE FROM search_index WHERE kind = 'post' AND ref_id = ?", args: [id] }]
+    );
+  }
+  private async syncPageIndex(id: string) {
+    const r = await this.first('SELECT id, status, locale, title, seo_desc, body_html FROM pages WHERE id = ?', [id]);
+    await this.driver.batch(
+      r ? this.pageIndexStatements(r) : [{ sql: "DELETE FROM search_index WHERE kind = 'page' AND ref_id = ?", args: [id] }]
+    );
+  }
+  // full rebuild: the v21 backfill, restores, seeds
+  private async reindexSearch() {
+    const [posts, pages] = await Promise.all([
+      this.driver.all("SELECT id, status, title, excerpt, tags, body, body_html FROM posts WHERE status = 'published'"),
+      this.driver.all("SELECT id, status, locale, title, seo_desc, body_html FROM pages WHERE status = 'published'"),
+    ]);
+    await this.driver.batch([
+      { sql: 'DELETE FROM search_index' },
+      ...posts.flatMap((r) => this.postIndexStatements(r)),
+      ...pages.flatMap((r) => this.pageIndexStatements(r)),
+    ]);
   }
 
   // ---- pages ----
@@ -199,10 +284,14 @@ export class SqlRepository implements ContentRepository {
     }
     args.push(id);
     await this.driver.run(`UPDATE pages SET ${sets.join(', ')} WHERE id = ?`, args);
+    await this.syncPageIndex(id);
   }
   async deletePage(id: string) {
     await this.ready;
-    await this.driver.run('DELETE FROM pages WHERE id = ?', [id]);
+    await this.driver.batch([
+      { sql: 'DELETE FROM pages WHERE id = ?', args: [id] },
+      { sql: "DELETE FROM search_index WHERE kind = 'page' AND ref_id = ?", args: [id] },
+    ]);
   }
 
   // ---- posts ----
@@ -313,27 +402,29 @@ export class SqlRepository implements ContentRepository {
         })),
       ]);
     }
+    await this.syncPostIndex(id);
   }
   async deletePost(id: string) {
     await this.ready;
     await this.driver.batch([
       { sql: 'DELETE FROM posts WHERE id = ?', args: [id] },
       { sql: 'DELETE FROM post_authors WHERE post_id = ?', args: [id] },
+      { sql: "DELETE FROM search_index WHERE kind = 'post' AND ref_id = ?", args: [id] },
     ]);
   }
   async publishDuePosts(now: number) {
     await this.ready;
-    const due = await this.first(
-      "SELECT COUNT(*) AS n FROM posts WHERE status = 'scheduled' AND scheduled_at IS NOT NULL AND scheduled_at <= ?",
+    const due = await this.driver.all(
+      "SELECT id FROM posts WHERE status = 'scheduled' AND scheduled_at IS NOT NULL AND scheduled_at <= ?",
       [now]
     );
-    const n = Number(due?.n ?? 0);
-    if (!n) return 0;
+    if (!due.length) return 0;
     await this.driver.run(
       "UPDATE posts SET status = 'published', published_at = COALESCE(published_at, scheduled_at), scheduled_at = NULL, updated_at = ? WHERE status = 'scheduled' AND scheduled_at IS NOT NULL AND scheduled_at <= ?",
       [now, now]
     );
-    return n;
+    for (const r of due) await this.syncPostIndex(String(r.id));
+    return due.length;
   }
 
   // ---- media ----
@@ -556,25 +647,75 @@ export class SqlRepository implements ContentRepository {
   }
 
   // ---- search ----
-  async searchPublished(query: string) {
-    await this.ready;
+  async searchPublished(query: string, opts?: { locale?: string }): Promise<SearchResults> {
+    await this.ready;
+    const trimmed = query.trim();
+    if (!trimmed) return { posts: [], pages: [], tags: [], authors: [] };
+    const locale = opts?.locale ?? '';
+    let postRows: Row[];
+    let pageRows: Row[];
+    try {
+      [postRows, pageRows] = await Promise.all([
+        this.driver.all(
+          `SELECT p.*, ${SNIPPET} AS snip FROM search_index JOIN posts p ON p.id = search_index.ref_id
+           WHERE search_index MATCH ? AND search_index.kind = 'post' AND p.status = 'published'
+           ORDER BY ${RANK} LIMIT 50`,
+          [ftsQuery(trimmed)]
+        ),
+        // locale is a boost, never a filter: the visitor's language sorts
+        // first, every locale stays visible (en/es cover different topics)
+        this.driver.all(
+          `SELECT g.*, ${SNIPPET} AS snip FROM search_index JOIN pages g ON g.id = search_index.ref_id
+           WHERE search_index MATCH ? AND search_index.kind = 'page' AND g.status = 'published'
+           ORDER BY (search_index.locale = ?) DESC, ${RANK} LIMIT 50`,
+          [ftsQuery(trimmed), locale]
+        ),
+      ]);
+    } catch {
+      // FTS5 unavailable or a query form it rejects — degrade to the old
+      // LIKE scan (recency-ordered, snippets fall back to excerpt/seo_desc)
+      [postRows, pageRows] = await this.likeSearch(trimmed, locale);
+    }
+    const like = `%${trimmed.replace(/[%_]/g, ' ').trim()}%`;
+    const [authors, tagRows, userRows] = await Promise.all([
+      this.authorMap(),
+      this.driver.all('SELECT * FROM tags WHERE name LIKE ? OR slug LIKE ? ORDER BY name COLLATE NOCASE ASC LIMIT 20', [like, like]),
+      this.driver.all('SELECT * FROM users WHERE name LIKE ? OR bio LIKE ? ORDER BY name COLLATE NOCASE ASC LIMIT 20', [like, like]),
+    ]);
+    const tags = tagRows.map(rowToTag).filter((t) => !isInternalTag(t.name));
+    let tagCounts = new Map<string, number>();
+    if (tags.length) {
+      const published = await this.driver.all("SELECT tags FROM posts WHERE status = 'published'");
+      for (const r of published) {
+        for (const name of JSON.parse(String(r.tags ?? '[]')) as string[]) {
+          const key = name.toLowerCase();
+          tagCounts.set(key, (tagCounts.get(key) ?? 0) + 1);
+        }
+      }
+    }
+    return {
+      posts: postRows.map((r) => ({
+        doc: rowToPost(r, authors.get(String(r.id))),
+        snippet: safeSnippet(r.snip ?? r.excerpt ?? ''),
+      })),
+      pages: pageRows.map((r) => ({ doc: rowToPage(r), snippet: safeSnippet(r.snip ?? r.seo_desc ?? '') })),
+      tags: tags.map((tag) => ({ tag, count: tagCounts.get(tag.name.toLowerCase()) ?? 0 })),
+      authors: userRows.map(rowToUser),
+    };
+  }
+  private async likeSearch(query: string, locale: string): Promise<[Row[], Row[]]> {
     const q = `%${query.replace(/[%_]/g, ' ').trim()}%`;
-    if (q === '%%') return { posts: [], pages: [] };
-    const [posts, pages, authors] = await Promise.all([
+    if (q === '%%') return [[], []];
+    return Promise.all([
       this.driver.all(
         "SELECT * FROM posts WHERE status = 'published' AND (title LIKE ? OR excerpt LIKE ? OR body_html LIKE ? OR body LIKE ?) ORDER BY published_at DESC LIMIT 50",
         [q, q, q, q]
       ),
       this.driver.all(
-        "SELECT * FROM pages WHERE status = 'published' AND (title LIKE ? OR body_html LIKE ?) ORDER BY updated_at DESC LIMIT 50",
-        [q, q]
+        "SELECT * FROM pages WHERE status = 'published' AND (title LIKE ? OR body_html LIKE ?) ORDER BY (locale = ?) DESC, updated_at DESC LIMIT 50",
+        [q, q, locale]
       ),
-      this.authorMap(),
     ]);
-    return {
-      posts: rankByQuery(posts.map((r) => rowToPost(r, authors.get(String(r.id)))), query),
-      pages: pages.map(rowToPage),
-    };
   }
 
   // ---- restore ----
@@ -630,6 +771,7 @@ export class SqlRepository implements ContentRepository {
     ];
     await this.driver.batch(stmts);
     await this.updateSettings(content.settings);
+    await this.reindexSearch();
   }
 
   // ---- redirects ----

package/src/lib/repo/types.ts

@@ -7,6 +7,19 @@ export interface Stats {
   linkClicks: number;
 }
 
+// snippet is safe HTML: entity-escaped text with <mark> around matched terms
+export interface SearchHit<T> {
+  doc: T;
+  snippet: string;
+}
+
+export interface SearchResults {
+  posts: SearchHit<Post>[];
+  pages: SearchHit<Page>[];
+  tags: { tag: Tag; count: number }[];
+  authors: User[];
+}
+
 // The single contract both backends implement. The app only ever imports
 // this — never a concrete adapter.
 export interface ContentRepository {
@@ -101,9 +114,12 @@ export interface ContentRepository {
   reorderNavItems(ids: string[]): Promise<void>;
   deleteNavItem(id: string): Promise<void>;
 
-  // public search — ranked LIKE over published posts and pages (title >
-  // excerpt > body). Behind this method so FTS can replace it transparently.
-  searchPublished(query: string): Promise<{ posts: Post[]; pages: Page[] }>;
+  // public search — FTS5 over published posts and pages (bm25: title >
+  // excerpt > tags > body) plus name matches from the tag registry (internal
+  // #tags excluded) and author profiles. opts.locale is a ranking boost,
+  // never a filter: pages in the visitor's locale sort first, every locale
+  // stays visible (en/es cover different topics, not translations).
+  searchPublished(query: string, opts?: { locale?: string }): Promise<SearchResults>;
 
   // backup restore — id-preserving replace-all from a backup's content.json.
   // Users restore WITHOUT password hashes (backups never contain them).

package/src/lib/search-config.ts

@@ -0,0 +1,10 @@
+// Search feature toggle, configured per project via the integration:
+//   acms({ search: { enabled: false } })
+// integration.mjs validates and fills defaults before serializing; when
+// disabled it also skips injecting /search and /api/search, so this flag
+// only decides whether the layout renders the trigger + modal.
+import { userConfig } from 'virtual:acms-config';
+
+export const SEARCH = {
+  enabled: userConfig.search?.enabled ?? true,
+};

package/src/lib/search-i18n.ts

@@ -0,0 +1,45 @@
+// UI strings for the search modal and /search page. There is no site-wide
+// translation catalog yet — search is the first public surface with
+// per-locale chrome, so the dict lives here until one exists. Locales fall
+// back to English.
+export interface SearchStrings {
+  label: string;
+  placeholder: string;
+  posts: string;
+  pages: string;
+  tags: string;
+  authors: string;
+  empty: string;
+  result: string;
+  results: string;
+  button: string;
+}
+
+const STRINGS: Record<string, SearchStrings> = {
+  en: {
+    label: 'Search',
+    placeholder: 'Search posts, pages, tags and authors',
+    posts: 'Posts',
+    pages: 'Pages',
+    tags: 'Tags',
+    authors: 'Authors',
+    empty: 'Nothing found for',
+    result: 'result',
+    results: 'results',
+    button: 'Search',
+  },
+  es: {
+    label: 'Buscar',
+    placeholder: 'Busca artículos, páginas, etiquetas y autores',
+    posts: 'Artículos',
+    pages: 'Páginas',
+    tags: 'Etiquetas',
+    authors: 'Autores',
+    empty: 'No hay resultados para',
+    result: 'resultado',
+    results: 'resultados',
+    button: 'Buscar',
+  },
+};
+
+export const searchStrings = (locale: string): SearchStrings => STRINGS[locale] ?? STRINGS.en;

package/src/pages/admin/index.astro

@@ -57,18 +57,21 @@ function ago(ts: number) {
   <div id="acms-update" hidden data-current={coreVersion} class="card card-pad" style="display:none;align-items:center;gap:10px;margin-bottom:14px;border-left:3px solid var(--accent)">
     <div>
       <b>ACMS <span id="acms-update-latest"></span> is available</b>
-      <span class="hint" style="margin-left:6px">you're on {coreVersion} — run <code>npx acms update</code>, then <code>npm run deploy</code>.</span>
+      <span class="hint" style="margin-left:6px">you're on {coreVersion} — run <code>npx acms update</code>; it prints the deploy steps for your setup.</span>
     </div>
-    <a class="btn sm ghost" style="margin-left:auto" href="https://github.com/zurielbm/acms-subir/releases" target="_blank" rel="noopener">What's new</a>
+    <a id="acms-update-notes" class="btn sm ghost" style="margin-left:auto" href="https://www.npmjs.com/package/@acms-subir/core" target="_blank" rel="noopener">What's new</a>
+    <button id="acms-update-dismiss" class="btn sm ghost" type="button" aria-label="Dismiss until the next release" title="Dismiss until the next release">×</button>
   </div>
   <script>
     // Ghost-style update nudge: npm registry check, cached a day, silent on
-    // any failure (offline, unpublished package, CORS).
+    // any failure (offline, unpublished package, CORS). Dismissal is stored
+    // per-version, so the banner returns on the next release.
     (async () => {
       const el = document.getElementById('acms-update');
       if (!el) return;
       const current = el.dataset.current ?? '';
       const KEY = 'acms-update-check';
+      const DISMISSED = 'acms-update-dismissed';
       let latest = '';
       try {
         const cached = JSON.parse(localStorage.getItem(KEY) ?? 'null');
@@ -86,12 +89,23 @@ function ago(ts: number) {
         for (let i = 0; i < 3; i++) { if ((pa[i] ?? 0) < (pb[i] ?? 0)) return true; if ((pa[i] ?? 0) > (pb[i] ?? 0)) return false; }
         return false;
       };
-      if (latest && lt(current, latest)) {
-        const slot = document.getElementById('acms-update-latest');
-        if (slot) slot.textContent = latest;
-        el.hidden = false;
-        el.style.display = 'flex';
+      if (!latest || !lt(current, latest)) return;
+      try { if (localStorage.getItem(DISMISSED) === latest) return; } catch {}
+      const slot = document.getElementById('acms-update-latest');
+      if (slot) slot.textContent = latest;
+      // deep-link to the version's npm page — the repository is self-hosted and
+      // private, so npm is the only public place this release exists
+      const notes = document.getElementById('acms-update-notes');
+      if (notes instanceof HTMLAnchorElement) {
+        notes.href = `https://www.npmjs.com/package/@acms-subir/core/v/${encodeURIComponent(latest)}`;
       }
+      document.getElementById('acms-update-dismiss')?.addEventListener('click', () => {
+        try { localStorage.setItem(DISMISSED, latest); } catch {}
+        el.hidden = true;
+        el.style.display = 'none';
+      });
+      el.hidden = false;
+      el.style.display = 'flex';
     })();
   </script>
 

package/src/pages/api/search.ts

@@ -0,0 +1,44 @@
+import type { APIRoute } from 'astro';
+import { getRepo } from '../../lib/repo';
+import { authorSlug, publicTags } from '../../lib/schema';
+import { collectionUrl, tagUrl } from '../../lib/content';
+import { localeHomeUrl, normalizePageLocale } from '../../lib/i18n';
+import { formatDate } from '../../lib/dates';
+
+// Public search API behind the site's search modal. Published-only by
+// construction — the same contract as rss/sitemap — so it needs no auth and
+// the middleware already leaves /api alone. `locale` boosts the visitor's
+// language to the top of page results; it never filters. Snippets are safe
+// HTML (entity-escaped, <mark> around matches) ready for innerHTML.
+
+const LIMITS = { posts: 10, pages: 5, tags: 5, authors: 5 };
+
+export const GET: APIRoute = async ({ locals, url }) => {
+  const headers = { 'Content-Type': 'application/json; charset=utf-8', 'Cache-Control': 'public, max-age=60' };
+  const q = (url.searchParams.get('q') ?? '').trim().slice(0, 100);
+  if (!q) return new Response(JSON.stringify({ posts: [], pages: [], tags: [], authors: [] }), { headers });
+
+  const repo = await getRepo(locals);
+  const locale = normalizePageLocale(url.searchParams.get('locale') ?? '');
+  const [results, settings] = await Promise.all([repo.searchPublished(q, { locale }), repo.getSettings()]);
+
+  const body = {
+    posts: results.posts.slice(0, LIMITS.posts).map(({ doc: p, snippet }) => ({
+      title: p.title,
+      url: collectionUrl(p.collection, p.slug),
+      excerpt: p.excerpt,
+      snippet,
+      date: p.publishedAt ? formatDate(p.publishedAt, settings) : '',
+      tags: publicTags(p.tags),
+    })),
+    pages: results.pages.slice(0, LIMITS.pages).map(({ doc: p, snippet }) => ({
+      title: p.title,
+      url: p.isHome ? localeHomeUrl(p.locale) : `/${p.slug}`,
+      snippet,
+      locale: p.locale,
+    })),
+    tags: results.tags.slice(0, LIMITS.tags).map(({ tag, count }) => ({ name: tag.name, url: tagUrl(tag.slug), count })),
+    authors: results.authors.slice(0, LIMITS.authors).map((u) => ({ name: u.name, url: `/author/${authorSlug(u)}`, avatar: u.avatar })),
+  };
+  return new Response(JSON.stringify(body), { headers });
+};

package/src/pages/search.astro

@@ -1,41 +1,54 @@
 ---
 import Site from '../layouts/Site.astro';
 import { getRepo } from '../lib/repo';
-import { formatDate } from '../lib/dates';
-import { CONTENT, collectionUrl } from '../lib/content';
+import { formatDate, siteLang } from '../lib/dates';
+import { collectionUrl, tagUrl } from '../lib/content';
+import { authorSlug } from '../lib/schema';
+import { I18N, localeFromPath, localeHomeUrl, normalizePageLocale } from '../lib/i18n';
+import { searchStrings } from '../lib/search-i18n';
+
+// The no-JS search surface (the modal's form falls back here). Serves both
+// /search and the locale-prefixed /<locale>/search routes — the locale comes
+// from the path, same trick as the per-locale home routes, and only boosts
+// page ranking; every locale's content stays visible.
 
 const repo = await getRepo(Astro.locals);
 const q = (Astro.url.searchParams.get('q') ?? '').trim();
-const results = q ? await repo.searchPublished(q) : { posts: [], pages: [] };
 const settings = await repo.getSettings();
-const total = results.posts.length + results.pages.length;
+const reqLocale = I18N.enabled ? localeFromPath(Astro.url.pathname) : '';
+const locale = normalizePageLocale(reqLocale);
+const t = searchStrings((reqLocale || siteLang(settings)).slice(0, 2));
+const results = q
+  ? await repo.searchPublished(q, { locale })
+  : { posts: [], pages: [], tags: [], authors: [] };
+const total = results.posts.length + results.pages.length + results.tags.length + results.authors.length;
 ---
 
-<Site title={q ? `Search: ${q}` : 'Search'} description={`Search ${settings.siteTitle}`} noindex={Boolean(q)}>
+<Site title={q ? `${t.label}: ${q}` : t.label} description={`${t.label} · ${settings.siteTitle}`} noindex={Boolean(q)}>
   <header class="search-hero">
-    <h1>Search</h1>
-    <form class="search-form" action="/search" method="get" role="search">
+    <h1>{t.label}</h1>
+    <form class="search-form" action={Astro.url.pathname} method="get" role="search">
       <input
         type="search"
         name="q"
         value={q}
-        placeholder={`Search ${CONTENT.posts.plural.toLowerCase()} and pages…`}
-        aria-label="Search"
+        placeholder={t.placeholder}
+        aria-label={t.label}
         autofocus={!q}
       />
-      <button type="submit">Search</button>
+      <button type="submit">{t.button}</button>
     </form>
   </header>
 
   {q && (
     <p class="search-count">
-      {total === 0 ? `Nothing found for “${q}”.` : `${total} ${total === 1 ? 'result' : 'results'} for “${q}”`}
+      {total === 0 ? `${t.empty} “${q}”.` : `${total} ${total === 1 ? t.result : t.results} · “${q}”`}
     </p>
   )}
 
   {results.posts.length > 0 && (
     <ul class="post-list">
-      {results.posts.map((p) => (
+      {results.posts.map(({ doc: p, snippet }) => (
         <li class="post-item">
           {p.cover && (
             <a class="post-thumb" href={collectionUrl(p.collection, p.slug)}><img src={p.cover} alt={p.coverAlt} loading="lazy" /></a>
@@ -45,7 +58,11 @@ const total = results.posts.length + results.pages.length;
             <div class="post-meta">
               {p.publishedAt && <time datetime={new Date(p.publishedAt).toISOString()}>{formatDate(p.publishedAt, settings)}</time>}
             </div>
-            {p.excerpt && <p class="post-excerpt">{p.excerpt}</p>}
+            {snippet ? (
+              <p class="post-excerpt" set:html={snippet} />
+            ) : (
+              p.excerpt && <p class="post-excerpt">{p.excerpt}</p>
+            )}
           </div>
         </li>
       ))}
@@ -53,12 +70,46 @@ const total = results.posts.length + results.pages.length;
   )}
 
   {results.pages.length > 0 && (
-    <section class="search-pages">
-      <h2>Pages</h2>
+    <section class="search-section">
+      <h2>{t.pages}</h2>
       <ul class="post-list">
-        {results.pages.map((p) => (
+        {results.pages.map(({ doc: p, snippet }) => (
           <li class="post-item">
-            <div><a href={p.isHome ? '/' : `/${p.slug}`}>{p.title}</a></div>
+            <div>
+              <a href={p.isHome ? localeHomeUrl(p.locale) : `/${p.slug}`}>{p.title}</a>
+              {I18N.enabled && p.locale !== locale && (
+                <span class="search-loc">{(p.locale || I18N.defaultLocale).toUpperCase()}</span>
+              )}
+              {snippet && <p class="post-excerpt" set:html={snippet} />}
+            </div>
+          </li>
+        ))}
+      </ul>
+    </section>
+  )}
+
+  {results.tags.length > 0 && (
+    <section class="search-section">
+      <h2>{t.tags}</h2>
+      <div class="search-tags">
+        {results.tags.map(({ tag, count }) => (
+          <a class="tag" href={tagUrl(tag.slug)}>{tag.name} <span class="search-tag-count">{count}</span></a>
+        ))}
+      </div>
+    </section>
+  )}
+
+  {results.authors.length > 0 && (
+    <section class="search-section">
+      <h2>{t.authors}</h2>
+      <ul class="post-list">
+        {results.authors.map((u) => (
+          <li class="post-item">
+            {u.avatar && <img class="search-avatar" src={u.avatar} alt="" loading="lazy" />}
+            <div>
+              <a href={`/author/${authorSlug(u)}`}>{u.name}</a>
+              {u.bio && <p class="post-excerpt">{u.bio}</p>}
+            </div>
           </li>
         ))}
       </ul>
@@ -79,5 +130,19 @@ const total = results.posts.length + results.pages.length;
     background: var(--accent); color: #fff; cursor: pointer;
   }
   .search-count { color: var(--muted); }
-  .search-pages h2 { font-size: 1.1rem; margin-top: 2rem; }
+  .search-section h2 { font-size: 1.1rem; margin-top: 2rem; }
+  /* snippets arrive pre-escaped with <mark> around matches (set:html), so
+     the highlight style must reach into the injected fragment */
+  .post-excerpt :global(mark) {
+    background: color-mix(in srgb, var(--accent) 22%, transparent);
+    color: inherit; border-radius: 3px; padding: 0 1px;
+  }
+  .search-loc {
+    font-size: 11px; font-weight: 700; letter-spacing: 0.06em; color: var(--muted);
+    border: 1px solid var(--line); border-radius: 5px; padding: 1px 5px; margin-left: 8px;
+    vertical-align: 2px;
+  }
+  .search-tags { display: flex; flex-wrap: wrap; gap: 8px; margin-top: 10px; }
+  .search-tag-count { color: var(--muted); }
+  .search-avatar { width: 44px; height: 44px; border-radius: 50%; object-fit: cover; flex: none; }
 </style>

package/src/styles/site.css

@@ -425,3 +425,88 @@ a.tag:hover { background: var(--accent); color: #fff; }
     .pc-cal-row .d { flex-basis: 84px; }
   }
 }
+
+/* Site search (.pc-search) — the header trigger + overlay modal rendered by
+   Site.astro. The server renders the dialog around a real GET form to the
+   /search page, so search works with JS disabled; the inline script upgrades
+   it to live /api/search results. Scoped custom properties default to global
+   tokens — theme CSS and Settings → Code injection are unlayered, so either
+   overrides any of this without !important. */
+@layer base {
+  .site-nav a.pc-search-trigger {
+    display: inline-flex; align-items: center; align-self: center;
+    color: var(--muted); padding: 2px;
+  }
+  .site-nav a.pc-search-trigger:hover { color: var(--ink); }
+  .pc-search-trigger svg { display: block; }
+
+  dialog.pc-search {
+    --search-bg: var(--panel);
+    --search-ink: var(--ink);
+    --search-muted: var(--muted);
+    --search-line: var(--line);
+    --search-accent: var(--accent);
+    --search-radius: 12px;
+    --search-veil: rgb(0 0 0 / 0.35);
+    --search-width: 640px;
+    --search-top: 9vh;
+    width: min(var(--search-width), 92vw);
+    margin: var(--search-top) auto auto;
+    border: 0; padding: 0; background: transparent; overflow: visible;
+  }
+  dialog.pc-search::backdrop { background: var(--search-veil); backdrop-filter: blur(3px); }
+
+  .pc-search-box {
+    display: flex; align-items: center; gap: 12px;
+    background: var(--search-bg); color: var(--search-ink);
+    border-radius: var(--search-radius);
+    box-shadow: 0 14px 40px rgb(0 0 0 / 0.18), 0 2px 6px rgb(0 0 0 / 0.08);
+    padding: 15px 18px;
+  }
+  .pc-search-box svg { flex: none; color: var(--search-muted); }
+  .pc-search-input {
+    flex: 1; min-width: 0; border: 0; outline: 0; background: transparent;
+    font: inherit; font-size: 17px; color: var(--search-ink);
+  }
+  .pc-search-input::placeholder { color: var(--search-muted); }
+  .pc-search-input::-webkit-search-cancel-button { display: none; }
+  .pc-search-kbd {
+    flex: none; border: 1px solid var(--search-line); border-radius: 6px;
+    background: transparent; color: var(--search-muted); cursor: pointer;
+    font-size: 11px; font-weight: 700; letter-spacing: 0.04em; padding: 2px 7px;
+  }
+  .pc-search-kbd:hover { color: var(--search-ink); }
+
+  .pc-search-results {
+    margin-top: 10px; padding: 2px 0 8px;
+    background: var(--search-bg); border-radius: var(--search-radius);
+    box-shadow: 0 14px 40px rgb(0 0 0 / 0.16);
+    max-height: min(56vh, 460px); overflow-y: auto;
+  }
+  .pc-search-group {
+    font-size: 10.5px; font-weight: 700; letter-spacing: 0.13em; text-transform: uppercase;
+    color: var(--search-muted); padding: 14px 18px 4px;
+  }
+  a.pc-search-hit {
+    display: flex; align-items: baseline; gap: 10px;
+    padding: 8px 18px; text-decoration: none; color: var(--search-ink); font-size: 15.5px;
+  }
+  a.pc-search-hit:hover, a.pc-search-hit.sel {
+    background: color-mix(in srgb, var(--search-ink) 6%, transparent);
+  }
+  .pc-search-t { min-width: 0; }
+  .pc-search-snip {
+    display: block; font-size: 13px; color: var(--search-muted);
+    overflow: hidden; text-overflow: ellipsis; white-space: nowrap;
+  }
+  .pc-search-snip mark {
+    background: color-mix(in srgb, var(--search-accent) 22%, transparent);
+    color: inherit; border-radius: 3px; padding: 0 1px;
+  }
+  .pc-search-m { margin-left: auto; flex: none; font-size: 12.5px; color: var(--search-muted); }
+  .pc-search-empty { padding: 18px; color: var(--search-muted); font-size: 14.5px; }
+
+  @media (max-width: 640px) {
+    dialog.pc-search { --search-top: 4vh; width: 94vw; }
+  }
+}

package/src/lib/repo/search.ts

@@ -1,14 +0,0 @@
-import type { Post } from '../schema';
-
-// Shared ranking for the LIKE-based search: title hits beat excerpt hits beat
-// body hits; recency breaks ties. Swap the adapters' SQL for FTS later and
-// this ranking can go — the repo method signature stays the same.
-export function rankByQuery(posts: Post[], query: string): Post[] {
-  const q = query.toLowerCase();
-  const score = (p: Post) =>
-    (p.title.toLowerCase().includes(q) ? 4 : 0) +
-    (p.excerpt.toLowerCase().includes(q) ? 2 : 0) +
-    (p.tags.some((t) => t.toLowerCase().includes(q)) ? 2 : 0) +
-    1;
-  return [...posts].sort((a, b) => score(b) - score(a) || (b.publishedAt ?? 0) - (a.publishedAt ?? 0));
-}