A static site can fake search. Ship a JSON index of every post, filter it in the browser, and the box works with no server at all.
It works right up until the index is stale, and then it lies. It lists a post that was retracted an hour ago, or misses one published this morning, and it does so with total confidence, because a client-side index cannot know it is out of date.
One live path
So search is the one thing here that is not a file. The box posts to /api/search on this same origin. Behind that path is a small function that queries Postgres as the anonymous caller and returns matching published posts.
Two properties come out of that. Results reflect the database at the moment you typed, not at the moment the site was built. And the same row policy that hides drafts from the site hides them from search, without the endpoint containing a single line about drafts.
The cost is honest and small: one function, and a search box that needs the network. So it says so when the network is not there. An empty result and a failed request look different on this page, deliberately, because they mean different things.