@acms-subir/core 0.0.2 → 0.2.0

package/src/lib/repo/sql.ts

@@ -1,7 +1,8 @@
-import type { ContentRepository, Stats } from './types';
-import { Page, Post, Link, Media, NavItem, Redirect, Settings, Tag, User, normalizeRedirectPath, slugify, type WidgetInstance } from '../schema';
+import type { ContentRepository, SearchResults, Stats } from './types';
+import { Page, Post, Link, Media, NavItem, Redirect, Settings, Snippet, Tag, User, isInternalTag, normalizeRedirectPath, publicTags, slugify, type WidgetInstance } from '../schema';
+import { pickDesignDraft, pickPageDraft, pickPostDraft } from '../drafts';
 import { MIGRATIONS, MIGRATIONS_TABLE } from './migrations';
-import { rankByQuery } from './search';
+import { htmlToPlaintext } from '../plaintext';
 import { SEED } from '../brand';
 import { CONTENT, postsIndexUrl } from '../content';
 
@@ -24,6 +25,17 @@ export interface SqlDriver {
   batch(stmts: SqlStatement[]): Promise<void>;
 }
 
+// a corrupt snapshot must never make the whole row unreadable
+function parseDraft(raw: unknown): Record<string, unknown> | null {
+  if (!raw) return null;
+  try {
+    const d = JSON.parse(String(raw));
+    return d && typeof d === 'object' && !Array.isArray(d) ? d : null;
+  } catch {
+    return null;
+  }
+}
+
 function rowToPage(r: Row): Page {
   return Page.parse({
     id: r.id, slug: r.slug, title: r.title, status: r.status,
@@ -31,7 +43,7 @@ function rowToPage(r: Row): Page {
     blocks: JSON.parse(String(r.blocks ?? '[]')),
     bodyJson: r.body_json ?? '', bodyHtml: r.body_html ?? '',
     seoTitle: r.seo_title ?? '', seoDesc: r.seo_desc ?? '',
-    template: r.template ?? '',
+    template: r.template ?? '', draft: parseDraft(r.draft),
     createdAt: Number(r.created_at), updatedAt: Number(r.updated_at),
   });
 }
@@ -43,12 +55,17 @@ function rowToPost(r: Row, authorIds?: string[]): Post {
     seoTitle: r.seo_title ?? '', seoDesc: r.seo_desc ?? '', status: r.status,
     featured: Boolean(r.featured), authorId: r.author_id ?? null,
     authorIds: authorIds ?? (r.author_id ? [String(r.author_id)] : []),
-    template: r.template ?? '',
+    template: r.template ?? '', draft: parseDraft(r.draft),
     publishedAt: r.published_at === null ? null : Number(r.published_at),
     scheduledAt: r.scheduled_at === null ? null : Number(r.scheduled_at),
     createdAt: Number(r.created_at), updatedAt: Number(r.updated_at),
   });
 }
+function rowToSnippet(r: Row): Snippet {
+  return Snippet.parse({
+    id: r.id, name: r.name, contentJson: r.content_json ?? '[]', createdAt: Number(r.created_at),
+  });
+}
 function rowToTag(r: Row): Tag {
   return Tag.parse({ id: r.id, name: r.name, slug: r.slug, description: r.description ?? '' });
 }
@@ -75,6 +92,28 @@ function rowToLink(r: Row): Link {
   });
 }
 
+// FTS5 MATCH expression from user input: each whitespace token becomes a
+// quoted phrase (operators like AND / OR / - stay inert), the last one gets
+// a * for search-as-you-type prefix matching.
+function ftsQuery(query: string): string {
+  const tokens = query.split(/\s+/).filter(Boolean).slice(0, 8);
+  return tokens.map((t, i) => `"${t.replace(/"/g, '""')}"${i === tokens.length - 1 ? '*' : ''}`).join(' ');
+}
+
+// snippet() brackets matches with private-use-area chars so the raw text can
+// be entity-escaped before the markers become <mark> — the result is safe to
+// render with set:html / innerHTML.
+const MARK_OPEN = '\uE000';
+const MARK_CLOSE = '\uE001';
+const SNIPPET = `snippet(search_index, 5, '${MARK_OPEN}', '${MARK_CLOSE}', '…', 12)`;
+// column weights: kind, ref_id, locale (unindexed), title, excerpt, plaintext, tags
+const RANK = 'bm25(search_index, 0, 0, 0, 8.0, 4.0, 1.0, 2.0)';
+function safeSnippet(raw: unknown): string {
+  return String(raw ?? '')
+    .replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;')
+    .replaceAll(MARK_OPEN, '<mark>').replaceAll(MARK_CLOSE, '</mark>');
+}
+
 export class SqlRepository implements ContentRepository {
   private driver!: SqlDriver;
   private ready: Promise<void>;
@@ -106,12 +145,16 @@ export class SqlRepository implements ContentRepository {
         applied = 1;
       }
     }
-    for (const m of MIGRATIONS.filter((m) => m.version > applied)) {
+    const pending = MIGRATIONS.filter((m) => m.version > applied);
+    for (const m of pending) {
       await this.driver.batch([
         ...m.statements.map((sql) => ({ sql })),
         { sql: 'INSERT INTO migrations (version, applied_at) VALUES (?, ?)', args: [m.version, Date.now()] },
       ]);
     }
+    // v21 introduced the search index; plaintext can't be derived in SQL, so
+    // the backfill runs here once, right after that version lands.
+    if (pending.some((m) => m.version === 21)) await this.reindexSearch();
   }
 
   private async seed() {
@@ -136,6 +179,65 @@ export class SqlRepository implements ContentRepository {
       { sql: 'INSERT INTO links (id, label, url, ord) VALUES (?, ?, ?, 0)', args: [uuid(), 'GitHub', 'https://github.com'] },
       { sql: 'INSERT INTO links (id, label, url, ord) VALUES (?, ?, ?, 1)', args: [uuid(), 'Astro docs', 'https://docs.astro.build'] },
     ]);
+    // seed rows are inserted with raw SQL, after migrate()'s backfill ran
+    await this.reindexSearch();
+  }
+
+  // ---- search index ----
+  // One FTS5 row per published post/page. Sync lives here at the repo layer
+  // so every write path — saves, scheduled publishes, restores, seeds —
+  // flows through the same statements.
+  private postIndexStatements(r: Row): SqlStatement[] {
+    const stmts: SqlStatement[] = [
+      { sql: "DELETE FROM search_index WHERE kind = 'post' AND ref_id = ?", args: [r.id] },
+    ];
+    if (r.status === 'published') {
+      stmts.push({
+        sql: "INSERT INTO search_index (kind, ref_id, locale, title, excerpt, plaintext, tags) VALUES ('post', ?, '', ?, ?, ?, ?)",
+        args: [
+          r.id, r.title, r.excerpt ?? '',
+          htmlToPlaintext(String(r.body_html ?? '')) || String(r.body ?? ''),
+          publicTags(JSON.parse(String(r.tags ?? '[]'))).join(' '),
+        ],
+      });
+    }
+    return stmts;
+  }
+  private pageIndexStatements(r: Row): SqlStatement[] {
+    const stmts: SqlStatement[] = [
+      { sql: "DELETE FROM search_index WHERE kind = 'page' AND ref_id = ?", args: [r.id] },
+    ];
+    if (r.status === 'published') {
+      stmts.push({
+        sql: "INSERT INTO search_index (kind, ref_id, locale, title, excerpt, plaintext, tags) VALUES ('page', ?, ?, ?, ?, ?, '')",
+        args: [r.id, r.locale ?? '', r.title, r.seo_desc ?? '', htmlToPlaintext(String(r.body_html ?? ''))],
+      });
+    }
+    return stmts;
+  }
+  private async syncPostIndex(id: string) {
+    const r = await this.first('SELECT id, status, title, excerpt, tags, body, body_html FROM posts WHERE id = ?', [id]);
+    await this.driver.batch(
+      r ? this.postIndexStatements(r) : [{ sql: "DELETE FROM search_index WHERE kind = 'post' AND ref_id = ?", args: [id] }]
+    );
+  }
+  private async syncPageIndex(id: string) {
+    const r = await this.first('SELECT id, status, locale, title, seo_desc, body_html FROM pages WHERE id = ?', [id]);
+    await this.driver.batch(
+      r ? this.pageIndexStatements(r) : [{ sql: "DELETE FROM search_index WHERE kind = 'page' AND ref_id = ?", args: [id] }]
+    );
+  }
+  // full rebuild: the v21 backfill, restores, seeds
+  private async reindexSearch() {
+    const [posts, pages] = await Promise.all([
+      this.driver.all("SELECT id, status, title, excerpt, tags, body, body_html FROM posts WHERE status = 'published'"),
+      this.driver.all("SELECT id, status, locale, title, seo_desc, body_html FROM pages WHERE status = 'published'"),
+    ]);
+    await this.driver.batch([
+      { sql: 'DELETE FROM search_index' },
+      ...posts.flatMap((r) => this.postIndexStatements(r)),
+      ...pages.flatMap((r) => this.pageIndexStatements(r)),
+    ]);
   }
 
   // ---- pages ----
@@ -173,7 +275,9 @@ export class SqlRepository implements ContentRepository {
   }
   async updatePage(id: string, data: Parameters<ContentRepository['updatePage']>[1]) {
     await this.ready;
-    const sets: string[] = ['updated_at = ?'];
+    // a direct live write supersedes any staged edits (applyPageDraft routes
+    // through here too, so applying clears the snapshot in the same UPDATE)
+    const sets: string[] = ['updated_at = ?', 'draft = NULL'];
     const args: unknown[] = [Date.now()];
     if (data.title !== undefined) { sets.push('title = ?'); args.push(data.title); }
     if (data.slug !== undefined) { sets.push('slug = ?'); args.push(data.slug); }
@@ -199,10 +303,37 @@ export class SqlRepository implements ContentRepository {
     }
     args.push(id);
     await this.driver.run(`UPDATE pages SET ${sets.join(', ')} WHERE id = ?`, args);
+    await this.syncPageIndex(id);
+  }
+  // stage edits on a live page: only the `draft` JSON changes — live columns,
+  // updated_at (public auto-nav order) and the search index stay untouched
+  async savePageDraft(id: string, data: Parameters<ContentRepository['savePageDraft']>[1]) {
+    await this.ready;
+    const r = await this.first('SELECT draft FROM pages WHERE id = ?', [id]);
+    if (!r) return;
+    const merged: Record<string, unknown> = parseDraft(r.draft) ?? {};
+    for (const [k, v] of Object.entries(data)) if (v !== undefined) merged[k] = v;
+    merged.savedAt = Date.now();
+    await this.driver.run('UPDATE pages SET draft = ? WHERE id = ?', [JSON.stringify(merged), id]);
+  }
+  async applyPageDraft(id: string) {
+    await this.ready;
+    const r = await this.first('SELECT draft FROM pages WHERE id = ?', [id]);
+    const draft = parseDraft(r?.draft);
+    if (!draft) return;
+    // updatePage handles is_home displacement, FTS sync and clears the draft
+    await this.updatePage(id, pickPageDraft(draft));
+  }
+  async discardPageDraft(id: string) {
+    await this.ready;
+    await this.driver.run('UPDATE pages SET draft = NULL WHERE id = ?', [id]);
   }
   async deletePage(id: string) {
     await this.ready;
-    await this.driver.run('DELETE FROM pages WHERE id = ?', [id]);
+    await this.driver.batch([
+      { sql: 'DELETE FROM pages WHERE id = ?', args: [id] },
+      { sql: "DELETE FROM search_index WHERE kind = 'page' AND ref_id = ?", args: [id] },
+    ]);
   }
 
   // ---- posts ----
@@ -267,7 +398,9 @@ export class SqlRepository implements ContentRepository {
     await this.ready;
     const current = await this.getPost(id);
     if (!current) return;
-    const sets: string[] = ['updated_at = ?'];
+    // a direct live write supersedes any staged edits (applyPostDraft routes
+    // through here too, so applying clears the snapshot in the same UPDATE)
+    const sets: string[] = ['updated_at = ?', 'draft = NULL'];
     const args: unknown[] = [Date.now()];
     if (data.title !== undefined) { sets.push('title = ?'); args.push(data.title); }
     if (data.slug !== undefined) { sets.push('slug = ?'); args.push(data.slug); }
@@ -313,27 +446,52 @@ export class SqlRepository implements ContentRepository {
         })),
       ]);
     }
+    await this.syncPostIndex(id);
+  }
+  // stage edits on a live post: only the `draft` JSON changes — live columns,
+  // author joins and the search index stay untouched until Update
+  async savePostDraft(id: string, data: Parameters<ContentRepository['savePostDraft']>[1]) {
+    await this.ready;
+    const r = await this.first('SELECT draft FROM posts WHERE id = ?', [id]);
+    if (!r) return;
+    const merged: Record<string, unknown> = parseDraft(r.draft) ?? {};
+    for (const [k, v] of Object.entries(data)) if (v !== undefined) merged[k] = v;
+    merged.savedAt = Date.now();
+    await this.driver.run('UPDATE posts SET draft = ? WHERE id = ?', [JSON.stringify(merged), id]);
+  }
+  async applyPostDraft(id: string) {
+    await this.ready;
+    const r = await this.first('SELECT draft FROM posts WHERE id = ?', [id]);
+    const draft = parseDraft(r?.draft);
+    if (!draft) return;
+    // updatePost handles author joins, FTS sync and clears the draft
+    await this.updatePost(id, pickPostDraft(draft));
+  }
+  async discardPostDraft(id: string) {
+    await this.ready;
+    await this.driver.run('UPDATE posts SET draft = NULL WHERE id = ?', [id]);
   }
   async deletePost(id: string) {
     await this.ready;
     await this.driver.batch([
       { sql: 'DELETE FROM posts WHERE id = ?', args: [id] },
       { sql: 'DELETE FROM post_authors WHERE post_id = ?', args: [id] },
+      { sql: "DELETE FROM search_index WHERE kind = 'post' AND ref_id = ?", args: [id] },
     ]);
   }
   async publishDuePosts(now: number) {
     await this.ready;
-    const due = await this.first(
-      "SELECT COUNT(*) AS n FROM posts WHERE status = 'scheduled' AND scheduled_at IS NOT NULL AND scheduled_at <= ?",
+    const due = await this.driver.all(
+      "SELECT id FROM posts WHERE status = 'scheduled' AND scheduled_at IS NOT NULL AND scheduled_at <= ?",
       [now]
     );
-    const n = Number(due?.n ?? 0);
-    if (!n) return 0;
+    if (!due.length) return 0;
     await this.driver.run(
       "UPDATE posts SET status = 'published', published_at = COALESCE(published_at, scheduled_at), scheduled_at = NULL, updated_at = ? WHERE status = 'scheduled' AND scheduled_at IS NOT NULL AND scheduled_at <= ?",
       [now, now]
     );
-    return n;
+    for (const r of due) await this.syncPostIndex(String(r.id));
+    return due.length;
   }
 
   // ---- media ----
@@ -473,6 +631,26 @@ export class SqlRepository implements ContentRepository {
     }
   }
 
+  // ---- snippets ----
+  async listSnippets() {
+    await this.ready;
+    const rows = await this.driver.all('SELECT * FROM snippets ORDER BY name COLLATE NOCASE ASC');
+    return rows.map(rowToSnippet);
+  }
+  async createSnippet({ name, contentJson }: { name: string; contentJson: string }) {
+    await this.ready;
+    const id = crypto.randomUUID();
+    await this.driver.run('INSERT INTO snippets (id, name, content_json, created_at) VALUES (?, ?, ?, ?)', [
+      id, name, contentJson, Date.now(),
+    ]);
+    const r = await this.first('SELECT * FROM snippets WHERE id = ?', [id]);
+    return rowToSnippet(r!);
+  }
+  async deleteSnippet(id: string) {
+    await this.ready;
+    await this.driver.run('DELETE FROM snippets WHERE id = ?', [id]);
+  }
+
   // ---- users ----
   async listUsers() {
     await this.ready;
@@ -556,25 +734,75 @@ export class SqlRepository implements ContentRepository {
   }
 
   // ---- search ----
-  async searchPublished(query: string) {
-    await this.ready;
+  async searchPublished(query: string, opts?: { locale?: string }): Promise<SearchResults> {
+    await this.ready;
+    const trimmed = query.trim();
+    if (!trimmed) return { posts: [], pages: [], tags: [], authors: [] };
+    const locale = opts?.locale ?? '';
+    let postRows: Row[];
+    let pageRows: Row[];
+    try {
+      [postRows, pageRows] = await Promise.all([
+        this.driver.all(
+          `SELECT p.*, ${SNIPPET} AS snip FROM search_index JOIN posts p ON p.id = search_index.ref_id
+           WHERE search_index MATCH ? AND search_index.kind = 'post' AND p.status = 'published'
+           ORDER BY ${RANK} LIMIT 50`,
+          [ftsQuery(trimmed)]
+        ),
+        // locale is a boost, never a filter: the visitor's language sorts
+        // first, every locale stays visible (en/es cover different topics)
+        this.driver.all(
+          `SELECT g.*, ${SNIPPET} AS snip FROM search_index JOIN pages g ON g.id = search_index.ref_id
+           WHERE search_index MATCH ? AND search_index.kind = 'page' AND g.status = 'published'
+           ORDER BY (search_index.locale = ?) DESC, ${RANK} LIMIT 50`,
+          [ftsQuery(trimmed), locale]
+        ),
+      ]);
+    } catch {
+      // FTS5 unavailable or a query form it rejects — degrade to the old
+      // LIKE scan (recency-ordered, snippets fall back to excerpt/seo_desc)
+      [postRows, pageRows] = await this.likeSearch(trimmed, locale);
+    }
+    const like = `%${trimmed.replace(/[%_]/g, ' ').trim()}%`;
+    const [authors, tagRows, userRows] = await Promise.all([
+      this.authorMap(),
+      this.driver.all('SELECT * FROM tags WHERE name LIKE ? OR slug LIKE ? ORDER BY name COLLATE NOCASE ASC LIMIT 20', [like, like]),
+      this.driver.all('SELECT * FROM users WHERE name LIKE ? OR bio LIKE ? ORDER BY name COLLATE NOCASE ASC LIMIT 20', [like, like]),
+    ]);
+    const tags = tagRows.map(rowToTag).filter((t) => !isInternalTag(t.name));
+    let tagCounts = new Map<string, number>();
+    if (tags.length) {
+      const published = await this.driver.all("SELECT tags FROM posts WHERE status = 'published'");
+      for (const r of published) {
+        for (const name of JSON.parse(String(r.tags ?? '[]')) as string[]) {
+          const key = name.toLowerCase();
+          tagCounts.set(key, (tagCounts.get(key) ?? 0) + 1);
+        }
+      }
+    }
+    return {
+      posts: postRows.map((r) => ({
+        doc: rowToPost(r, authors.get(String(r.id))),
+        snippet: safeSnippet(r.snip ?? r.excerpt ?? ''),
+      })),
+      pages: pageRows.map((r) => ({ doc: rowToPage(r), snippet: safeSnippet(r.snip ?? r.seo_desc ?? '') })),
+      tags: tags.map((tag) => ({ tag, count: tagCounts.get(tag.name.toLowerCase()) ?? 0 })),
+      authors: userRows.map(rowToUser),
+    };
+  }
+  private async likeSearch(query: string, locale: string): Promise<[Row[], Row[]]> {
     const q = `%${query.replace(/[%_]/g, ' ').trim()}%`;
-    if (q === '%%') return { posts: [], pages: [] };
-    const [posts, pages, authors] = await Promise.all([
+    if (q === '%%') return [[], []];
+    return Promise.all([
       this.driver.all(
         "SELECT * FROM posts WHERE status = 'published' AND (title LIKE ? OR excerpt LIKE ? OR body_html LIKE ? OR body LIKE ?) ORDER BY published_at DESC LIMIT 50",
         [q, q, q, q]
       ),
       this.driver.all(
-        "SELECT * FROM pages WHERE status = 'published' AND (title LIKE ? OR body_html LIKE ?) ORDER BY updated_at DESC LIMIT 50",
-        [q, q]
+        "SELECT * FROM pages WHERE status = 'published' AND (title LIKE ? OR body_html LIKE ?) ORDER BY (locale = ?) DESC, updated_at DESC LIMIT 50",
+        [q, q, locale]
       ),
-      this.authorMap(),
     ]);
-    return {
-      posts: rankByQuery(posts.map((r) => rowToPost(r, authors.get(String(r.id)))), query),
-      pages: pages.map(rowToPage),
-    };
   }
 
   // ---- restore ----
@@ -587,14 +815,14 @@ export class SqlRepository implements ContentRepository {
       // p.locale defaults to '' via the zod schema, so pre-v20 backups
       // restore cleanly as default-locale pages
       ...content.pages.map((p) => ({
-        sql: 'INSERT INTO pages (id, slug, title, status, is_home, locale, blocks, body_json, body_html, seo_title, seo_desc, template, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)',
-        args: [p.id, p.slug, p.title, p.status, p.isHome ? 1 : 0, p.locale, JSON.stringify(p.blocks), p.bodyJson, p.bodyHtml, p.seoTitle, p.seoDesc, p.template, p.createdAt, p.updatedAt],
+        sql: 'INSERT INTO pages (id, slug, title, status, is_home, locale, blocks, body_json, body_html, seo_title, seo_desc, template, draft, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)',
+        args: [p.id, p.slug, p.title, p.status, p.isHome ? 1 : 0, p.locale, JSON.stringify(p.blocks), p.bodyJson, p.bodyHtml, p.seoTitle, p.seoDesc, p.template, p.draft ? JSON.stringify(p.draft) : null, p.createdAt, p.updatedAt],
       })),
       // p.collection defaults to 'posts' via the zod schema, so pre-v19
       // backups restore cleanly into the built-in collection
       ...content.posts.map((p) => ({
-        sql: 'INSERT INTO posts (id, collection, slug, title, body, body_json, body_html, excerpt, tags, cover, cover_alt, seo_title, seo_desc, status, featured, author_id, template, published_at, scheduled_at, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)',
-        args: [p.id, p.collection, p.slug, p.title, p.body, p.bodyJson, p.bodyHtml, p.excerpt, JSON.stringify(p.tags), p.cover, p.coverAlt, p.seoTitle, p.seoDesc, p.status, p.featured ? 1 : 0, p.authorIds[0] ?? p.authorId, p.template, p.publishedAt, p.scheduledAt, p.createdAt, p.updatedAt],
+        sql: 'INSERT INTO posts (id, collection, slug, title, body, body_json, body_html, excerpt, tags, cover, cover_alt, seo_title, seo_desc, status, featured, author_id, template, draft, published_at, scheduled_at, created_at, updated_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)',
+        args: [p.id, p.collection, p.slug, p.title, p.body, p.bodyJson, p.bodyHtml, p.excerpt, JSON.stringify(p.tags), p.cover, p.coverAlt, p.seoTitle, p.seoDesc, p.status, p.featured ? 1 : 0, p.authorIds[0] ?? p.authorId, p.template, p.draft ? JSON.stringify(p.draft) : null, p.publishedAt, p.scheduledAt, p.createdAt, p.updatedAt],
       })),
       ...content.posts.flatMap((p) =>
         (p.authorIds.length ? p.authorIds : p.authorId ? [p.authorId] : []).map((aid, i) => ({
@@ -630,6 +858,7 @@ export class SqlRepository implements ContentRepository {
     ];
     await this.driver.batch(stmts);
     await this.updateSettings(content.settings);
+    await this.reindexSearch();
   }
 
   // ---- redirects ----
@@ -674,17 +903,23 @@ export class SqlRepository implements ContentRepository {
       siteLogo: r?.site_logo ?? '',
       siteUrl: r?.site_url ?? '', siteFavicon: r?.site_favicon ?? '', siteCover: r?.site_cover ?? '',
       announcement: JSON.parse(String(r?.announcement ?? '{}')),
+      analytics: JSON.parse(String(r?.analytics ?? '{}')),
       headCode: r?.head_code ?? '', footerCode: r?.footer_code ?? '',
       timezone: r?.timezone ?? '', locale: r?.locale ?? '',
       draftsApiKey: r?.drafts_api_key ?? '',
       draftsAllowedOrigins: JSON.parse(String(r?.drafts_allowed_origins ?? '[]')),
+      draftDesign: parseDraft(r?.draft_design),
     });
   }
   async updateSettings(data: Partial<Settings>) {
     await this.ready;
     const current = await this.getSettings();
+    // draft_design: undefined = leave the staged design alone (a settings
+    // save must not clobber it); null/value = explicit write (restore)
+    const draftDesign =
+      data.draftDesign === undefined ? current.draftDesign : data.draftDesign;
     await this.driver.run(
-      'UPDATE settings SET site_title = ?, tagline = ?, footer_text = ?, links_name = ?, links_bio = ?, links_avatar = ?, active_theme = ?, design_overrides = ?, site_logo = ?, site_url = ?, site_favicon = ?, site_cover = ?, announcement = ?, head_code = ?, footer_code = ?, timezone = ?, locale = ?, drafts_api_key = ?, drafts_allowed_origins = ? WHERE id = 1',
+      'UPDATE settings SET site_title = ?, tagline = ?, footer_text = ?, links_name = ?, links_bio = ?, links_avatar = ?, active_theme = ?, design_overrides = ?, site_logo = ?, site_url = ?, site_favicon = ?, site_cover = ?, announcement = ?, analytics = ?, head_code = ?, footer_code = ?, timezone = ?, locale = ?, drafts_api_key = ?, drafts_allowed_origins = ?, draft_design = ? WHERE id = 1',
       [
         data.siteTitle ?? current.siteTitle, data.tagline ?? current.tagline,
         data.footerText ?? current.footerText,
@@ -697,15 +932,39 @@ export class SqlRepository implements ContentRepository {
         data.siteFavicon ?? current.siteFavicon,
         data.siteCover ?? current.siteCover,
         JSON.stringify(data.announcement ?? current.announcement),
+        JSON.stringify(data.analytics ?? current.analytics),
         data.headCode ?? current.headCode,
         data.footerCode ?? current.footerCode,
         data.timezone ?? current.timezone,
         data.locale ?? current.locale,
         data.draftsApiKey ?? current.draftsApiKey,
         JSON.stringify(data.draftsAllowedOrigins ?? current.draftsAllowedOrigins),
+        draftDesign ? JSON.stringify(draftDesign) : null,
       ]
     );
   }
+  // Design-screen staging: only the draft_design JSON changes on save — the
+  // live design columns wait for applyDesignDraft ("Publish design").
+  async saveDesignDraft(data: Parameters<ContentRepository['saveDesignDraft']>[0]) {
+    await this.ready;
+    const r = await this.first('SELECT draft_design FROM settings WHERE id = 1');
+    const merged: Record<string, unknown> = parseDraft(r?.draft_design) ?? {};
+    for (const [k, v] of Object.entries(data)) if (v !== undefined) merged[k] = v;
+    merged.savedAt = Date.now();
+    await this.driver.run('UPDATE settings SET draft_design = ? WHERE id = 1', [JSON.stringify(merged)]);
+  }
+  async applyDesignDraft() {
+    await this.ready;
+    const r = await this.first('SELECT draft_design FROM settings WHERE id = 1');
+    const draft = parseDraft(r?.draft_design);
+    if (!draft) return;
+    await this.updateSettings(pickDesignDraft(draft));
+    await this.discardDesignDraft();
+  }
+  async discardDesignDraft() {
+    await this.ready;
+    await this.driver.run('UPDATE settings SET draft_design = NULL WHERE id = 1');
+  }
   async getStats(): Promise<Stats> {
     await this.ready;
     const r = await this.first(`SELECT

package/src/lib/repo/types.ts

@@ -1,4 +1,4 @@
-import type { Page, Post, Link, Media, NavItem, Redirect, Settings, Tag, User, Role, WidgetInstance } from '../schema';
+import type { Page, Post, Link, Media, NavItem, Redirect, Settings, Snippet, Tag, User, Role, WidgetInstance } from '../schema';
 
 export interface Stats {
   publishedPages: number;
@@ -7,6 +7,19 @@ export interface Stats {
   linkClicks: number;
 }
 
+// snippet is safe HTML: entity-escaped text with <mark> around matched terms
+export interface SearchHit<T> {
+  doc: T;
+  snippet: string;
+}
+
+export interface SearchResults {
+  posts: SearchHit<Post>[];
+  pages: SearchHit<Page>[];
+  tags: { tag: Tag; count: number }[];
+  authors: User[];
+}
+
 // The single contract both backends implement. The app only ever imports
 // this — never a concrete adapter.
 export interface ContentRepository {
@@ -23,6 +36,12 @@ export interface ContentRepository {
       blocks?: WidgetInstance[];
     }
   ): Promise<void>;
+  // pending edits on a live page: save stages into the `draft` JSON column
+  // (live columns untouched), apply copies staged → live and clears, discard
+  // just clears. See lib/drafts.ts for the snapshot shape.
+  savePageDraft(id: string, data: Omit<Parameters<ContentRepository['updatePage']>[1], 'status'>): Promise<void>;
+  applyPageDraft(id: string): Promise<void>;
+  discardPageDraft(id: string): Promise<void>;
   deletePage(id: string): Promise<void>;
 
   // posts
@@ -47,6 +66,10 @@ export interface ContentRepository {
       >
     >
   ): Promise<void>;
+  // pending edits on a live post — same contract as the page variants above
+  savePostDraft(id: string, data: Omit<Parameters<ContentRepository['updatePost']>[1], 'status' | 'scheduledAt'>): Promise<void>;
+  applyPostDraft(id: string): Promise<void>;
+  discardPostDraft(id: string): Promise<void>;
   deletePost(id: string): Promise<void>;
   // flips scheduled posts whose time has passed to published; returns count
   publishDuePosts(now: number): Promise<number>;
@@ -85,6 +108,11 @@ export interface ContentRepository {
   // auto-register any names missing from the registry (called on post save)
   ensureTags(names: string[]): Promise<void>;
 
+  // snippets — named, reusable editor-content fragments
+  listSnippets(): Promise<Snippet[]>;
+  createSnippet(data: { name: string; contentJson: string }): Promise<Snippet>;
+  deleteSnippet(id: string): Promise<void>;
+
   // users — passHash stays inside the repo; getUserAuth is for login only
   listUsers(): Promise<User[]>;
   getUser(id: string): Promise<User | null>;
@@ -101,9 +129,12 @@ export interface ContentRepository {
   reorderNavItems(ids: string[]): Promise<void>;
   deleteNavItem(id: string): Promise<void>;
 
-  // public search — ranked LIKE over published posts and pages (title >
-  // excerpt > body). Behind this method so FTS can replace it transparently.
-  searchPublished(query: string): Promise<{ posts: Post[]; pages: Page[] }>;
+  // public search — FTS5 over published posts and pages (bm25: title >
+  // excerpt > tags > body) plus name matches from the tag registry (internal
+  // #tags excluded) and author profiles. opts.locale is a ranking boost,
+  // never a filter: pages in the visitor's locale sort first, every locale
+  // stays visible (en/es cover different topics, not translations).
+  searchPublished(query: string, opts?: { locale?: string }): Promise<SearchResults>;
 
   // backup restore — id-preserving replace-all from a backup's content.json.
   // Users restore WITHOUT password hashes (backups never contain them).
@@ -128,5 +159,10 @@ export interface ContentRepository {
   // settings & dashboard
   getSettings(): Promise<Settings>;
   updateSettings(data: Partial<Settings>): Promise<void>;
+  // Design-screen staging: save stages into settings.draftDesign, apply
+  // copies staged → live design fields and clears, discard just clears
+  saveDesignDraft(data: Partial<Pick<Settings, 'activeTheme' | 'designOverrides' | 'siteLogo' | 'siteFavicon' | 'siteCover'>>): Promise<void>;
+  applyDesignDraft(): Promise<void>;
+  discardDesignDraft(): Promise<void>;
   getStats(): Promise<Stats>;
 }

package/src/lib/schema.ts

@@ -78,6 +78,8 @@ export const Page = z.object({
   seoDesc: z.string().default(''),
   // theme template name (templates/page-<name>.astro); empty = default layout
   template: z.string().default(''),
+  // pending edits on a live page (see lib/drafts.ts); null = none staged
+  draft: z.record(z.any()).nullable().default(null),
   createdAt: z.number(),
   updatedAt: z.number(),
 });
@@ -110,6 +112,8 @@ export const Post = z.object({
   authorIds: z.array(z.string()).default([]),
   // theme template name (templates/post-<name>.astro); empty = default layout
   template: z.string().default(''),
+  // pending edits on a live post (see lib/drafts.ts); null = none staged
+  draft: z.record(z.any()).nullable().default(null),
   publishedAt: z.number().nullable(),
   scheduledAt: z.number().nullable().default(null),
   createdAt: z.number(),
@@ -152,6 +156,17 @@ export const Tag = z.object({
 });
 export type Tag = z.infer<typeof Tag>;
 
+// Snippets: named, reusable fragments of editor content, saved from a
+// selection and re-inserted from the "/" menu. contentJson is a JSON array of
+// ProseMirror nodes.
+export const Snippet = z.object({
+  id: z.string(),
+  name: z.string(),
+  contentJson: z.string(),
+  createdAt: z.number(),
+});
+export type Snippet = z.infer<typeof Snippet>;
+
 export const Role = z.enum(['owner', 'editor']);
 export type Role = z.infer<typeof Role>;
 
@@ -268,11 +283,49 @@ export const Settings = z.object({
       dismissible: z.boolean().default(true),
     })
     .default({}),
+  // analytics providers, rendered into the public <head> by lib/analytics.ts
+  // (owner-only; IDs are re-validated there before any markup is built)
+  analytics: z
+    .object({
+      umami: z
+        .object({
+          enabled: z.boolean().default(false),
+          websiteId: z.string().default(''),
+          scriptUrl: z.string().default('https://cloud.umami.is/script.js'),
+          // session replay (Umami v3.1+): a second recorder.js tag, derived
+          // from scriptUrl. Defaults mirror Umami's own dashboard defaults.
+          replay: z
+            .object({
+              enabled: z.boolean().default(false),
+              sampleRate: z.number().min(0.01).max(1).default(0.15),
+              maskLevel: z.enum(['moderate', 'strict']).default('moderate'),
+              maxDuration: z.number().int().positive().default(300000),
+            })
+            .default({}),
+        })
+        .default({}),
+      metaPixel: z
+        .object({
+          enabled: z.boolean().default(false),
+          pixelId: z.string().default(''),
+        })
+        .default({}),
+      // experimental: same code path as the others, but not verified live yet
+      tiktokPixel: z
+        .object({
+          enabled: z.boolean().default(false),
+          pixelId: z.string().default(''),
+        })
+        .default({}),
+    })
+    .default({}),
   // external drafts API: bearer key for POST /api/drafts (empty = endpoint
   // off) and the browser origins allowed to call it ('*' entry allows all,
   // 'http://localhost:*' matches any port). Managed in /admin/settings.
   draftsApiKey: z.string().default(''),
   draftsAllowedOrigins: z.array(z.string()).default([]),
+  // staged Design-screen changes (see lib/drafts.ts); null = none pending
+  draftDesign: z.record(z.any()).nullable().default(null),
 });
 export type Settings = z.infer<typeof Settings>;