@tinacms/graphql 1.4.28 → 1.4.30

package/dist/index.js

@@ -26,6 +26,7 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 var src_exports = {};
 __export(src_exports, {
   AuditFileSystemBridge: () => AuditFileSystemBridge,
+  Database: () => Database,
   FilesystemBridge: () => FilesystemBridge,
   IsomorphicBridge: () => IsomorphicBridge,
   TinaFetchError: () => TinaFetchError,
@@ -36,12 +37,17 @@ __export(src_exports, {
   assertShape: () => assertShape,
   buildDotTinaFiles: () => buildDotTinaFiles,
   buildSchema: () => buildSchema,
+  checkPasswordHash: () => checkPasswordHash,
   createDatabase: () => createDatabase,
+  createDatabaseInternal: () => createDatabaseInternal,
+  createLocalDatabase: () => createLocalDatabase,
   createSchema: () => createSchema,
+  generatePasswordHash: () => generatePasswordHash,
   getChangedFiles: () => getChangedFiles,
   getSha: () => getSha,
   handleFetchErrorError: () => handleFetchErrorError,
   loadAndParseWithAliases: () => loadAndParseWithAliases,
+  mapUserFields: () => mapUserFields,
   parseFile: () => parseFile,
   resolve: () => resolve,
   scanAllContent: () => scanAllContent,
@@ -514,6 +520,7 @@ var astBuilder = {
     CollectionDocumentUnion: "DocumentUnion",
     Folder: "Folder",
     String: "String",
+    Password: "Password",
     Reference: "Reference",
     Collection: "Collection",
     ID: "ID",
@@ -1324,6 +1331,126 @@ var scalarDefinitions = [
 ];
 var staticDefinitions = [...scalarDefinitions, interfaceDefinitions];
 
+// src/auth/utils.ts
+var import_crypto = __toESM(require("crypto"));
+var import_scmp = __toESM(require("scmp"));
+var DEFAULT_SALT_LENGTH = 32;
+var DEFAULT_KEY_LENGTH = 512;
+var DEFAULT_ITERATIONS = 25e3;
+var DEFAULT_DIGEST = "sha256";
+var generatePasswordHash = async ({
+  password,
+  opts: {
+    saltLength = DEFAULT_SALT_LENGTH,
+    keyLength = DEFAULT_KEY_LENGTH,
+    iterations = DEFAULT_ITERATIONS,
+    digest = DEFAULT_DIGEST
+  } = {
+    saltLength: DEFAULT_SALT_LENGTH,
+    keyLength: DEFAULT_KEY_LENGTH,
+    iterations: DEFAULT_ITERATIONS,
+    digest: DEFAULT_DIGEST
+  }
+}) => {
+  if (!password) {
+    throw new Error("Password is required");
+  }
+  if (password.length < 3) {
+    throw new Error("Password must be at least 3 characters");
+  }
+  const salt = (await new Promise((resolve2, reject) => {
+    import_crypto.default.randomBytes(saltLength, (err, saltBuffer) => {
+      if (err) {
+        reject(err);
+      }
+      resolve2(saltBuffer);
+    });
+  })).toString("hex");
+  const hash = (await new Promise((resolve2, reject) => {
+    import_crypto.default.pbkdf2(
+      password,
+      salt,
+      iterations,
+      keyLength,
+      digest,
+      (err, hashBuffer) => {
+        if (err) {
+          reject(err);
+        }
+        resolve2(hashBuffer);
+      }
+    );
+  })).toString("hex");
+  return `${salt}${hash}`;
+};
+var checkPasswordHash = async ({
+  saltedHash,
+  password,
+  opts: {
+    saltLength = DEFAULT_SALT_LENGTH,
+    keyLength = DEFAULT_KEY_LENGTH,
+    iterations = DEFAULT_ITERATIONS,
+    digest = DEFAULT_DIGEST
+  } = {
+    saltLength: DEFAULT_SALT_LENGTH,
+    keyLength: DEFAULT_KEY_LENGTH,
+    iterations: DEFAULT_ITERATIONS,
+    digest: DEFAULT_DIGEST
+  }
+}) => {
+  const salt = saltedHash.slice(0, saltLength * 2);
+  const hash = saltedHash.slice(saltLength * 2);
+  try {
+    await new Promise((resolve2, reject) => {
+      import_crypto.default.pbkdf2(
+        password,
+        salt,
+        iterations,
+        keyLength,
+        digest,
+        (err, hashBuffer) => {
+          if (err) {
+            reject(null);
+          }
+          if ((0, import_scmp.default)(hashBuffer, Buffer.from(hash, "hex"))) {
+            resolve2();
+          }
+          reject(null);
+        }
+      );
+    });
+  } catch (e) {
+    return false;
+  }
+  return true;
+};
+var mapUserFields = (collectable, prefix = []) => {
+  var _a, _b, _c, _d, _e;
+  const results = [];
+  const passwordFields = ((_a = collectable.fields) == null ? void 0 : _a.filter((field) => field.type === "password")) || [];
+  if (passwordFields.length > 1) {
+    throw new Error("Only one password field is allowed");
+  }
+  const idFields = ((_b = collectable.fields) == null ? void 0 : _b.filter((field) => field.uid)) || [];
+  if (idFields.length > 1) {
+    throw new Error("Only one uid field is allowed");
+  }
+  if (passwordFields.length || idFields.length) {
+    results.push({
+      path: prefix,
+      collectable,
+      idFieldName: (_c = idFields[0]) == null ? void 0 : _c.name,
+      passwordFieldName: (_d = passwordFields[0]) == null ? void 0 : _d.name
+    });
+  }
+  (_e = collectable.fields) == null ? void 0 : _e.forEach((field) => {
+    if (field.type === "object" && field.fields) {
+      results.push(...mapUserFields(field, [...prefix, field.name]));
+    }
+  });
+  return results;
+};
+
 // src/builder/index.ts
 var createBuilder = async ({
   tinaSchema
@@ -1424,7 +1551,7 @@ var Builder = class {
           type: astBuilder.TYPES.String
         })
       ];
-      await this.addToLookupMap({
+      this.addToLookupMap({
         type: astBuilder.TYPES.Node,
         resolveType: "nodeDocument"
       });
@@ -1567,7 +1694,7 @@ var Builder = class {
           type: astBuilder.TYPES.String
         })
       ];
-      await this.addToLookupMap({
+      this.addToLookupMap({
         type: type.name.value,
         resolveType: "collectionDocument",
         collection: collection.name,
@@ -1581,6 +1708,43 @@ var Builder = class {
         required: true
       });
     };
+    this.authenticationCollectionDocument = async (collection) => {
+      const name = "authenticate";
+      const type = await this._buildAuthDocumentType(collection);
+      const args = [
+        astBuilder.InputValueDefinition({
+          name: "sub",
+          type: astBuilder.TYPES.String,
+          required: true
+        }),
+        astBuilder.InputValueDefinition({
+          name: "password",
+          type: astBuilder.TYPES.String,
+          required: true
+        })
+      ];
+      return astBuilder.FieldDefinition({ type, name, args, required: false });
+    };
+    this.updatePasswordMutation = async (collection) => {
+      return astBuilder.FieldDefinition({
+        type: astBuilder.TYPES.Boolean,
+        name: "updatePassword",
+        required: true,
+        args: [
+          astBuilder.InputValueDefinition({
+            name: "password",
+            required: true,
+            type: astBuilder.TYPES.String
+          })
+        ]
+      });
+    };
+    this.authorizationCollectionDocument = async (collection) => {
+      const name = "authorize";
+      const type = await this._buildAuthDocumentType(collection);
+      const args = [];
+      return astBuilder.FieldDefinition({ type, name, args, required: false });
+    };
     this.collectionFragment = async (collection) => {
       const name = NAMER.dataTypeName(collection.namespace);
       const fragmentName = NAMER.fragmentName(collection.namespace);
@@ -1625,6 +1789,29 @@ var Builder = class {
         case "boolean":
         case "rich-text":
           return astBuilder.FieldNodeDefinition(field);
+        case "password":
+          const passwordValue = await this._buildFieldNodeForFragments(
+            {
+              name: "value",
+              namespace: [...field.namespace, "value"],
+              type: "string",
+              required: true
+            },
+            depth
+          );
+          const passwordChangeRequired = await this._buildFieldNodeForFragments(
+            {
+              name: "passwordChangeRequired",
+              namespace: [...field.namespace, "passwordChangeRequired"],
+              type: "boolean",
+              required: false
+            },
+            depth
+          );
+          return astBuilder.FieldWithSelectionSetDefinition({
+            name: field.name,
+            selections: filterSelections([passwordValue, passwordChangeRequired])
+          });
         case "object":
           if (((_a = field.fields) == null ? void 0 : _a.length) > 0) {
             const selections2 = [];
@@ -1838,6 +2025,34 @@ var Builder = class {
         ]
       });
     };
+    this._buildAuthDocumentType = async (collection, suffix = "", extraFields = [], extraInterfaces = []) => {
+      const usersFields = mapUserFields(collection, []);
+      if (!usersFields.length) {
+        throw new Error("Auth collection must have a user field");
+      }
+      if (usersFields.length > 1) {
+        throw new Error("Auth collection cannot have more than one user field");
+      }
+      const usersField = usersFields[0].collectable;
+      const documentTypeName = NAMER.documentTypeName(usersField.namespace);
+      const templateInfo = this.tinaSchema.getTemplatesForCollectable(usersField);
+      if (templateInfo.type === "union") {
+        throw new Error("Auth collection user field cannot be a union");
+      }
+      const fields = templateInfo.template.fields;
+      const templateFields = await sequential(fields, async (field) => {
+        return this._buildDataField(field);
+      });
+      return astBuilder.ObjectTypeDefinition({
+        name: documentTypeName + suffix,
+        interfaces: [
+          astBuilder.NamedType({ name: astBuilder.TYPES.Node }),
+          astBuilder.NamedType({ name: astBuilder.TYPES.Document }),
+          ...extraInterfaces
+        ],
+        fields: [...templateFields]
+      });
+    };
     this._filterCollectionDocumentType = async (collection) => {
       const t = this.tinaSchema.getTemplatesForCollectable(collection);
       if (t.type === "union") {
@@ -2096,9 +2311,7 @@ var Builder = class {
           const filter = await this._connectionFilterBuilder({
             fieldName: field.name,
             namespace: field.namespace,
-            collections: await this.tinaSchema.getCollectionsByName(
-              field.collections
-            )
+            collections: this.tinaSchema.getCollectionsByName(field.collections)
           });
           return astBuilder.InputValueDefinition({
             name: field.name,
@@ -2131,6 +2344,8 @@ var Builder = class {
             list: field.list,
             type: astBuilder.TYPES.String
           });
+        case "password":
+          return this._buildPasswordMutation(field);
         case "object":
           return astBuilder.InputValueDefinition({
             name: field.name,
@@ -2165,6 +2380,27 @@ var Builder = class {
         )
       });
     };
+    this._buildPasswordMutation = async (field) => {
+      return astBuilder.InputValueDefinition({
+        name: field.name,
+        list: field.list,
+        type: astBuilder.InputObjectTypeDefinition({
+          name: NAMER.dataMutationTypeName(field.namespace),
+          fields: [
+            astBuilder.InputValueDefinition({
+              name: "value",
+              type: astBuilder.TYPES.String,
+              required: false
+            }),
+            astBuilder.InputValueDefinition({
+              name: "passwordChangeRequired",
+              type: astBuilder.TYPES.Boolean,
+              required: true
+            })
+          ]
+        })
+      });
+    };
     this._buildUpdateDocumentMutationParams = async (field) => {
       const fields = await sequential(
         this.tinaSchema.getCollectionsByName(field.collections),
@@ -2329,6 +2565,29 @@ Visit https://tina.io/docs/errors/ui-not-supported/ for more information
             required: field.required,
             type: astBuilder.TYPES.Scalar(field.type)
           });
+        case "password":
+          return astBuilder.FieldDefinition({
+            name: field.name,
+            list: field.list,
+            required: field.required,
+            type: astBuilder.ObjectTypeDefinition({
+              name: NAMER.dataTypeName(field.namespace),
+              fields: [
+                await this._buildDataField({
+                  name: "value",
+                  namespace: [...field.namespace, "value"],
+                  type: "string",
+                  required: true
+                }),
+                await this._buildDataField({
+                  name: "passwordChangeRequired",
+                  namespace: [...field.namespace, "passwordChangeRequired"],
+                  type: "boolean",
+                  required: false
+                })
+              ]
+            })
+          });
         case "object":
           return astBuilder.FieldDefinition({
             name: field.name,
@@ -2452,7 +2711,8 @@ var FIELD_TYPES = [
   "image",
   "reference",
   "object",
-  "rich-text"
+  "rich-text",
+  "password"
 ];
 var validateSchema = async (schema) => {
   const schema2 = addNamespaceToSchema(
@@ -2595,7 +2855,7 @@ var validateField = async (field) => {
 // package.json
 var package_default = {
   name: "@tinacms/graphql",
-  version: "1.4.28",
+  version: "1.4.30",
   main: "dist/index.js",
   module: "dist/index.mjs",
   typings: "dist/index.d.ts",
@@ -2650,6 +2910,7 @@ var package_default = {
     micromatch: "4.0.5",
     "normalize-path": "^3.0.0",
     "readable-stream": "^4.3.0",
+    scmp: "^2.1.0",
     yup: "^0.32.9"
   },
   publishConfig: {
@@ -2836,6 +3097,17 @@ var _buildSchema = async (builder, tinaSchema) => {
   );
   await sequential(collections, async (collection) => {
     queryTypeDefinitionFields.push(await builder.collectionDocument(collection));
+    if (collection.isAuthCollection) {
+      queryTypeDefinitionFields.push(
+        await builder.authenticationCollectionDocument(collection)
+      );
+      queryTypeDefinitionFields.push(
+        await builder.authorizationCollectionDocument(collection)
+      );
+      mutationTypeDefinitionFields.push(
+        await builder.updatePasswordMutation(collection)
+      );
+    }
     mutationTypeDefinitionFields.push(
       await builder.updateCollectionDocumentMutation(collection)
     );
@@ -4122,7 +4394,7 @@ var createResolver = (args) => {
   return new Resolver(args);
 };
 var resolveFieldData = async ({ namespace, ...field }, rawData, accumulator, tinaSchema, config, isAudit) => {
-  var _a;
+  var _a, _b;
   if (!rawData) {
     return void 0;
   }
@@ -4146,6 +4418,12 @@ var resolveFieldData = async ({ namespace, ...field }, rawData, accumulator, tin
         accumulator[field.name] = value;
       }
       break;
+    case "password":
+      accumulator[field.name] = {
+        value: void 0,
+        passwordChangeRequired: (_a = value["passwordChangeRequired"]) != null ? _a : false
+      };
+      break;
     case "image":
       accumulator[field.name] = resolveMediaRelativeToCloud(
         value,
@@ -4159,7 +4437,7 @@ var resolveFieldData = async ({ namespace, ...field }, rawData, accumulator, tin
         field,
         (value2) => resolveMediaRelativeToCloud(value2, config, tinaSchema.schema)
       );
-      if (((_a = tree == null ? void 0 : tree.children[0]) == null ? void 0 : _a.type) === "invalid_markdown") {
+      if (((_b = tree == null ? void 0 : tree.children[0]) == null ? void 0 : _b.type) === "invalid_markdown") {
         if (isAudit) {
           const invalidNode = tree == null ? void 0 : tree.children[0];
           throw new import_graphql3.GraphQLError(
@@ -4179,7 +4457,7 @@ var resolveFieldData = async ({ namespace, ...field }, rawData, accumulator, tin
           (yup3) => yup3.array().of(yup3.object().required())
         );
         accumulator[field.name] = await sequential(value, async (item) => {
-          const template = await tinaSchema.getTemplateForData({
+          const template = tinaSchema.getTemplateForData({
             data: item,
             collection: {
               namespace,
@@ -4207,7 +4485,7 @@ var resolveFieldData = async ({ namespace, ...field }, rawData, accumulator, tin
         if (!value) {
           return;
         }
-        const template = await tinaSchema.getTemplateForData({
+        const template = tinaSchema.getTemplateForData({
           data: value,
           collection: {
             namespace,
@@ -4370,43 +4648,71 @@ var Resolver = class {
       }
       await this.database.delete(fullPath);
     };
-    this.buildObjectMutations = (fieldValue, field) => {
+    this.buildObjectMutations = async (fieldValue, field, existingData) => {
       if (field.fields) {
         const objectTemplate = field;
         if (Array.isArray(fieldValue)) {
-          return fieldValue.map(
-            (item) => this.buildFieldMutations(item, objectTemplate)
+          const idField = objectTemplate.fields.find((field2) => field2.uid);
+          if (idField) {
+            const ids = fieldValue.map((d) => d[idField.name]);
+            const duplicateIds = ids.filter(
+              (id, index) => ids.indexOf(id) !== index
+            );
+            if (duplicateIds.length > 0) {
+              throw new Error(
+                `Duplicate ids found in array for field marked as identifier: ${idField.name}`
+              );
+            }
+          }
+          return Promise.all(
+            fieldValue.map(
+              async (item) => {
+                return this.buildFieldMutations(
+                  item,
+                  objectTemplate,
+                  idField && existingData && (existingData == null ? void 0 : existingData.find(
+                    (d) => d[idField.name] === item[idField.name]
+                  ))
+                );
+              }
+            )
           );
         } else {
           return this.buildFieldMutations(
             fieldValue,
-            objectTemplate
+            objectTemplate,
+            existingData
           );
         }
       }
       if (field.templates) {
         if (Array.isArray(fieldValue)) {
-          return fieldValue.map((item) => {
-            if (typeof item === "string") {
-              throw new Error(
-                `Expected object for template value for field ${field.name}`
+          return Promise.all(
+            fieldValue.map(async (item) => {
+              if (typeof item === "string") {
+                throw new Error(
+                  `Expected object for template value for field ${field.name}`
+                );
+              }
+              const templates = field.templates.map((templateOrTemplateName) => {
+                return templateOrTemplateName;
+              });
+              const [templateName] = Object.entries(item)[0];
+              const template = templates.find(
+                (template2) => template2.name === templateName
               );
-            }
-            const templates = field.templates.map((templateOrTemplateName) => {
-              return templateOrTemplateName;
-            });
-            const [templateName] = Object.entries(item)[0];
-            const template = templates.find(
-              (template2) => template2.name === templateName
-            );
-            if (!template) {
-              throw new Error(`Expected to find template ${templateName}`);
-            }
-            return {
-              ...this.buildFieldMutations(item[template.name], template),
-              _template: template.name
-            };
-          });
+              if (!template) {
+                throw new Error(`Expected to find template ${templateName}`);
+              }
+              return {
+                ...await this.buildFieldMutations(
+                  item[template.name],
+                  template
+                ),
+                _template: template.name
+              };
+            })
+          );
         } else {
           if (typeof fieldValue === "string") {
             throw new Error(
@@ -4424,7 +4730,10 @@ var Resolver = class {
             throw new Error(`Expected to find template ${templateName}`);
           }
           return {
-            ...this.buildFieldMutations(fieldValue[template.name], template),
+            ...await this.buildFieldMutations(
+              fieldValue[template.name],
+              template
+            ),
             _template: template.name
           };
         }
@@ -4463,7 +4772,7 @@ var Resolver = class {
         }
         return this.getDocument(realPath);
       }
-      const params = this.buildObjectMutations(
+      const params = await this.buildObjectMutations(
         args.params[collection.name],
         collection
       );
@@ -4485,9 +4794,10 @@ var Resolver = class {
         switch (templateInfo.type) {
           case "object":
             if (params2) {
-              const values = this.buildFieldMutations(
+              const values = await this.buildFieldMutations(
                 params2,
-                templateInfo.template
+                templateInfo.template,
+                doc == null ? void 0 : doc._rawData
               );
               await this.database.put(
                 realPath,
@@ -4507,7 +4817,11 @@ var Resolver = class {
                 }
                 const values = {
                   ...oldDoc,
-                  ...this.buildFieldMutations(templateParams, template),
+                  ...await this.buildFieldMutations(
+                    templateParams,
+                    template,
+                    doc == null ? void 0 : doc._rawData
+                  ),
                   _template: lastItem(template.namespace)
                 };
                 await this.database.put(realPath, values, collection.name);
@@ -4516,9 +4830,10 @@ var Resolver = class {
         }
         return this.getDocument(realPath);
       }
-      const params = this.buildObjectMutations(
+      const params = await this.buildObjectMutations(
         isCollectionSpecific ? args.params : args.params[collection.name],
-        collection
+        collection,
+        doc == null ? void 0 : doc._rawData
       );
       await this.database.put(realPath, { ...oldDoc, ...params }, collection.name);
       return this.getDocument(realPath);
@@ -4748,13 +5063,24 @@ var Resolver = class {
         }
       };
     };
-    this.buildFieldMutations = (fieldParams, template) => {
+    this.buildFieldMutations = async (fieldParams, template, existingData) => {
+      var _a;
       const accum = {};
-      Object.entries(fieldParams).forEach(([fieldName, fieldValue]) => {
+      for (const passwordField of template.fields.filter(
+        (f) => f.type === "password"
+      )) {
+        if (!fieldParams[passwordField.name]["value"]) {
+          fieldParams[passwordField.name] = {
+            ...fieldParams[passwordField.name],
+            value: ""
+          };
+        }
+      }
+      for (const [fieldName, fieldValue] of Object.entries(fieldParams)) {
         if (Array.isArray(fieldValue)) {
           if (fieldValue.length === 0) {
             accum[fieldName] = [];
-            return;
+            break;
           }
         }
         const field = template.fields.find((field2) => field2.name === fieldName);
@@ -4778,7 +5104,31 @@ var Resolver = class {
             );
             break;
           case "object":
-            accum[fieldName] = this.buildObjectMutations(fieldValue, field);
+            accum[fieldName] = await this.buildObjectMutations(
+              fieldValue,
+              field,
+              existingData == null ? void 0 : existingData[fieldName]
+            );
+            break;
+          case "password":
+            if (typeof fieldValue !== "object") {
+              throw new Error(
+                `Expected to find object for password field ${fieldName}. Found ${typeof accum[fieldName]}`
+              );
+            }
+            if (fieldValue["value"]) {
+              accum[fieldName] = {
+                ...fieldValue,
+                value: await generatePasswordHash({
+                  password: fieldValue["value"]
+                })
+              };
+            } else {
+              accum[fieldName] = {
+                ...fieldValue,
+                value: (_a = existingData == null ? void 0 : existingData[fieldName]) == null ? void 0 : _a["value"]
+              };
+            }
             break;
           case "rich-text":
             accum[fieldName] = (0, import_mdx.stringifyMDX)(
@@ -4797,7 +5147,7 @@ var Resolver = class {
           default:
             throw new Error(`No mutation builder for field type ${field.type}`);
         }
-      });
+      }
       return accum;
     };
     this.buildParams = (args) => {
@@ -4867,6 +5217,9 @@ var resolveDateInput = (value) => {
   return date;
 };
 
+// src/resolve.ts
+var import_lodash4 = __toESM(require("lodash"));
+
 // src/error.ts
 var import_graphql4 = require("graphql");
 var NotFoundError = class extends import_graphql4.GraphQLError {
@@ -4884,7 +5237,8 @@ var resolve = async ({
   database,
   silenceErrors,
   verbose,
-  isAudit
+  isAudit,
+  ctxUser
 }) => {
   var _a;
   try {
@@ -4899,7 +5253,7 @@ var resolve = async ({
       schema: tinaConfig,
       flags: (_a = tinaConfig == null ? void 0 : tinaConfig.meta) == null ? void 0 : _a.flags
     });
-    const resolver = await createResolver({
+    const resolver = createResolver({
       config,
       database,
       tinaSchema,
@@ -4977,6 +5331,121 @@ var resolve = async ({
               );
             }
           }
+          if (info.fieldName === "authenticate" || info.fieldName === "authorize") {
+            const sub = args.sub || (ctxUser == null ? void 0 : ctxUser.sub);
+            const collection = tinaSchema.getCollections().find((c) => c.isAuthCollection);
+            if (!collection) {
+              throw new Error(`Auth collection not found`);
+            }
+            const userFields = mapUserFields(collection, ["_rawData"]);
+            if (!userFields.length) {
+              throw new Error(
+                `No user field found in collection ${collection.name}`
+              );
+            }
+            if (userFields.length > 1) {
+              throw new Error(
+                `Multiple user fields found in collection ${collection.name}`
+              );
+            }
+            const userField = userFields[0];
+            const realPath = `${collection.path}/index.json`;
+            const userDoc = await resolver.getDocument(realPath);
+            const users = import_lodash4.default.get(userDoc, userField.path);
+            if (!users) {
+              throw new Error("No users found");
+            }
+            const { idFieldName, passwordFieldName } = userField;
+            if (!idFieldName) {
+              throw new Error("No uid field found on user field");
+            }
+            const user = users.find((u) => u[idFieldName] === sub);
+            if (!user) {
+              return null;
+            }
+            if (info.fieldName === "authenticate") {
+              const saltedHash = import_lodash4.default.get(user, [passwordFieldName || "", "value"]);
+              if (!saltedHash) {
+                throw new Error("No password field found on user field");
+              }
+              const matches = await checkPasswordHash({
+                saltedHash,
+                password: args.password
+              });
+              if (matches) {
+                return user;
+              } else {
+                return null;
+              }
+            } else {
+              return user;
+            }
+          }
+          if (info.fieldName === "updatePassword") {
+            if (!(ctxUser == null ? void 0 : ctxUser.sub)) {
+              throw new Error("Not authorized");
+            }
+            if (!args.password) {
+              throw new Error("No password provided");
+            }
+            const collection = tinaSchema.getCollections().find((c) => c.isAuthCollection);
+            if (!collection) {
+              throw new Error(`Auth collection not found`);
+            }
+            const userFields = mapUserFields(collection, ["_rawData"]);
+            if (!userFields.length) {
+              throw new Error(
+                `No user field found in collection ${collection.name}`
+              );
+            }
+            if (userFields.length > 1) {
+              throw new Error(
+                `Multiple user fields found in collection ${collection.name}`
+              );
+            }
+            const userField = userFields[0];
+            const realPath = `${collection.path}/index.json`;
+            const userDoc = await resolver.getDocument(realPath);
+            const users = import_lodash4.default.get(userDoc, userField.path);
+            if (!users) {
+              throw new Error("No users found");
+            }
+            const { idFieldName, passwordFieldName } = userField;
+            const user = users.find((u) => u[idFieldName] === ctxUser.sub);
+            if (!user) {
+              throw new Error("Not authorized");
+            }
+            user[passwordFieldName] = {
+              value: args.password,
+              passwordChangeRequired: false
+            };
+            const params = {};
+            import_lodash4.default.set(
+              params,
+              userField.path.slice(1),
+              users.map((u) => {
+                if (user[idFieldName] === u[idFieldName]) {
+                  return user;
+                } else {
+                  return {
+                    ...u,
+                    [passwordFieldName]: {
+                      ...u[passwordFieldName],
+                      value: ""
+                    }
+                  };
+                }
+              })
+            );
+            await resolver.updateResolveDocument({
+              collection,
+              args: { params },
+              realPath,
+              isCollectionSpecific: true,
+              isAddPendingDocument: false
+            });
+            return true;
+          }
           if (!lookup) {
             return value;
           }
@@ -5117,12 +5586,78 @@ var resolve = async ({
   }
 };
 
+// src/level/tinaLevel.ts
+var import_many_level = require("many-level");
+var import_readable_stream = require("readable-stream");
+var import_net = require("net");
+var TinaLevelClient = class extends import_many_level.ManyLevelGuest {
+  constructor(port) {
+    super();
+    this._connected = false;
+    this.port = port || 9e3;
+  }
+  openConnection() {
+    if (this._connected)
+      return;
+    const socket = (0, import_net.connect)(this.port);
+    (0, import_readable_stream.pipeline)(socket, this.createRpcStream(), socket, () => {
+      this._connected = false;
+    });
+    this._connected = true;
+  }
+};
+
 // src/database/index.ts
 var import_path4 = __toESM(require("path"));
 var import_graphql6 = require("graphql");
 var import_micromatch2 = __toESM(require("micromatch"));
 var import_js_sha12 = __toESM(require("js-sha1"));
+var import_lodash5 = __toESM(require("lodash"));
+var createLocalDatabase = (config) => {
+  const level = new TinaLevelClient(config == null ? void 0 : config.port);
+  level.openConnection();
+  const fsBridge = new FilesystemBridge((config == null ? void 0 : config.rootPath) || process.cwd());
+  return new Database({
+    bridge: fsBridge,
+    ...config || {},
+    level
+  });
+};
 var createDatabase = (config) => {
+  if (config.onPut && config.onDelete) {
+    console.warn(
+      "onPut and onDelete are deprecated. Please use gitProvider.onPut and gitProvider.onDelete instead."
+    );
+  }
+  if (config.level) {
+    console.warn("level is deprecated. Please use databaseAdapter instead.");
+  }
+  if (config.onPut && config.onDelete && config.level && !config.databaseAdapter && !config.gitProvider) {
+    return new Database({
+      ...config,
+      level: config.level
+    });
+  }
+  if (!config.gitProvider) {
+    throw new Error(
+      "createDatabase requires a gitProvider. Please provide a gitProvider."
+    );
+  }
+  if (!config.databaseAdapter) {
+    throw new Error(
+      "createDatabase requires a databaseAdapter. Please provide a databaseAdapter."
+    );
+  }
+  return new Database({
+    ...config,
+    bridge: config.bridge,
+    level: config.databaseAdapter,
+    onPut: config.gitProvider.onPut.bind(config.gitProvider),
+    onDelete: config.gitProvider.onDelete.bind(config.gitProvider),
+    namespace: config.namespace || "tinacms"
+  });
+};
+var createDatabaseInternal = (config) => {
   return new Database({
     ...config,
     bridge: config.bridge,
@@ -5137,7 +5672,7 @@ var Database = class {
   constructor(config) {
     this.config = config;
     this.collectionForPath = async (filepath) => {
-      const tinaSchema = await this.getSchema(this.level);
+      const tinaSchema = await this.getSchema(this.contentLevel);
       try {
         return tinaSchema.getCollectionByFullPath(filepath);
       } catch (e) {
@@ -5146,13 +5681,25 @@ var Database = class {
     this.getGeneratedFolder = () => import_path4.default.join(this.tinaDirectory, "__generated__");
     this.getMetadata = async (key) => {
       await this.initLevel();
-      const metadataLevel = this.rootLevel.sublevel("_metadata", SUBLEVEL_OPTIONS);
+      let metadataLevel = this.rootLevel.sublevel("_metadata", SUBLEVEL_OPTIONS);
+      if (this.contentNamespace) {
+        metadataLevel = metadataLevel.sublevel(
+          this.contentNamespace,
+          SUBLEVEL_OPTIONS
+        );
+      }
       const metadata = await metadataLevel.get(`metadata_${key}`);
       return metadata == null ? void 0 : metadata.value;
     };
     this.setMetadata = async (key, value) => {
       await this.initLevel();
-      const metadataLevel = this.rootLevel.sublevel("_metadata", SUBLEVEL_OPTIONS);
+      let metadataLevel = this.rootLevel.sublevel("_metadata", SUBLEVEL_OPTIONS);
+      if (this.contentNamespace) {
+        metadataLevel = metadataLevel.sublevel(
+          this.contentNamespace,
+          SUBLEVEL_OPTIONS
+        );
+      }
       return metadataLevel.put(`metadata_${key}`, { value });
     };
     this.get = async (filepath) => {
@@ -5160,7 +5707,15 @@ var Database = class {
       if (SYSTEM_FILES.includes(filepath)) {
         throw new Error(`Unexpected get for config file ${filepath}`);
       } else {
-        const contentObject = await this.level.sublevel(
+        let collection;
+        let level = this.contentLevel;
+        if (this.appLevel) {
+          collection = await this.collectionForPath(filepath);
+          if (collection == null ? void 0 : collection.isDetached) {
+            level = this.appLevel.sublevel(collection.name, SUBLEVEL_OPTIONS);
+          }
+        }
+        const contentObject = await level.sublevel(
           CONTENT_ROOT_PREFIX,
           SUBLEVEL_OPTIONS
         ).get((0, import_schema_tools3.normalizePath)(filepath));
@@ -5170,7 +5725,7 @@ var Database = class {
         return transformDocument(
           filepath,
           contentObject,
-          await this.getSchema(this.level)
+          await this.getSchema(this.contentLevel)
         );
       }
     };
@@ -5186,23 +5741,29 @@ var Database = class {
         dataFields,
         collection
       );
-      const indexDefinitions = await this.getIndexDefinitions(this.level);
+      const indexDefinitions = await this.getIndexDefinitions(this.contentLevel);
       const collectionIndexDefinitions = indexDefinitions == null ? void 0 : indexDefinitions[collection.name];
       const normalizedPath = (0, import_schema_tools3.normalizePath)(filepath);
-      if (this.bridge) {
-        await this.bridge.put(normalizedPath, stringifiedFile);
+      if (!(collection == null ? void 0 : collection.isDetached)) {
+        if (this.bridge) {
+          await this.bridge.put(normalizedPath, stringifiedFile);
+        }
+        try {
+          await this.onPut(normalizedPath, stringifiedFile);
+        } catch (e) {
+          throw new import_graphql6.GraphQLError(
+            `Error running onPut hook for ${filepath}: ${e}`,
+            null,
+            null,
+            null,
+            null,
+            e
+          );
+        }
       }
-      try {
-        await this.onPut(normalizedPath, stringifiedFile);
-      } catch (e) {
-        throw new import_graphql6.GraphQLError(
-          `Error running onPut hook for ${filepath}: ${e}`,
-          null,
-          null,
-          null,
-          null,
-          e
-        );
+      let level = this.contentLevel;
+      if (collection == null ? void 0 : collection.isDetached) {
+        level = this.appLevel.sublevel(collection.name, SUBLEVEL_OPTIONS);
       }
       const folderTreeBuilder = new FolderTreeBuilder();
       const folderKey = folderTreeBuilder.update(filepath, collection.path || "");
@@ -5213,7 +5774,7 @@ var Database = class {
           collectionIndexDefinitions,
           dataFields,
           "put",
-          this.level
+          level
         ),
         ...makeIndexOpsForDocument(
           normalizedPath,
@@ -5221,10 +5782,10 @@ var Database = class {
           collectionIndexDefinitions,
           dataFields,
           "put",
-          this.level
+          level
         )
       ];
-      const existingItem = await this.level.sublevel(
+      const existingItem = await level.sublevel(
         CONTENT_ROOT_PREFIX,
         SUBLEVEL_OPTIONS
       ).get(normalizedPath);
@@ -5235,7 +5796,7 @@ var Database = class {
           collectionIndexDefinitions,
           existingItem,
           "del",
-          this.level
+          level
         ),
         ...makeIndexOpsForDocument(
           normalizedPath,
@@ -5243,7 +5804,7 @@ var Database = class {
           collectionIndexDefinitions,
           existingItem,
           "del",
-          this.level
+          level
         )
       ] : [];
       const ops = [
@@ -5253,13 +5814,13 @@ var Database = class {
           type: "put",
           key: normalizedPath,
           value: dataFields,
-          sublevel: this.level.sublevel(
+          sublevel: level.sublevel(
             CONTENT_ROOT_PREFIX,
             SUBLEVEL_OPTIONS
           )
         }
       ];
-      await this.level.batch(ops);
+      await level.batch(ops);
     };
     this.put = async (filepath, data, collectionName) => {
       var _a, _b;
@@ -5270,7 +5831,9 @@ var Database = class {
         } else {
           let collectionIndexDefinitions;
           if (collectionName) {
-            const indexDefinitions = await this.getIndexDefinitions(this.level);
+            const indexDefinitions = await this.getIndexDefinitions(
+              this.contentLevel
+            );
             collectionIndexDefinitions = indexDefinitions == null ? void 0 : indexDefinitions[collectionName];
           }
           const normalizedPath = (0, import_schema_tools3.normalizePath)(filepath);
@@ -5295,26 +5858,29 @@ var Database = class {
             dataFields,
             collection
           );
-          if (this.bridge) {
-            await this.bridge.put(normalizedPath, stringifiedFile);
-          }
-          try {
-            await this.onPut(normalizedPath, stringifiedFile);
-          } catch (e) {
-            throw new import_graphql6.GraphQLError(
-              `Error running onPut hook for ${filepath}: ${e}`,
-              null,
-              null,
-              null,
-              null,
-              e
-            );
+          if (!(collection == null ? void 0 : collection.isDetached)) {
+            if (this.bridge) {
+              await this.bridge.put(normalizedPath, stringifiedFile);
+            }
+            try {
+              await this.onPut(normalizedPath, stringifiedFile);
+            } catch (e) {
+              throw new import_graphql6.GraphQLError(
+                `Error running onPut hook for ${filepath}: ${e}`,
+                null,
+                null,
+                null,
+                null,
+                e
+              );
+            }
           }
           const folderTreeBuilder = new FolderTreeBuilder();
           const folderKey = folderTreeBuilder.update(
             filepath,
             collection.path || ""
           );
+          const level = (collection == null ? void 0 : collection.isDetached) ? this.appLevel.sublevel(collection == null ? void 0 : collection.name, SUBLEVEL_OPTIONS) : this.contentLevel;
           const putOps = [
             ...makeIndexOpsForDocument(
               normalizedPath,
@@ -5322,7 +5888,7 @@ var Database = class {
               collectionIndexDefinitions,
               dataFields,
               "put",
-              this.level
+              level
             ),
             ...makeIndexOpsForDocument(
               normalizedPath,
@@ -5330,10 +5896,10 @@ var Database = class {
               collectionIndexDefinitions,
               dataFields,
               "put",
-              this.level
+              level
             )
           ];
-          const existingItem = await this.level.sublevel(
+          const existingItem = await level.sublevel(
             CONTENT_ROOT_PREFIX,
             SUBLEVEL_OPTIONS
           ).get(normalizedPath);
@@ -5344,7 +5910,7 @@ var Database = class {
               collectionIndexDefinitions,
               existingItem,
               "del",
-              this.level
+              level
             ),
             ...makeIndexOpsForDocument(
               normalizedPath,
@@ -5352,7 +5918,7 @@ var Database = class {
               collectionIndexDefinitions,
               existingItem,
               "del",
-              this.level
+              level
             )
           ] : [];
           const ops = [
@@ -5362,13 +5928,13 @@ var Database = class {
               type: "put",
               key: normalizedPath,
               value: dataFields,
-              sublevel: this.level.sublevel(
+              sublevel: level.sublevel(
                 CONTENT_ROOT_PREFIX,
                 SUBLEVEL_OPTIONS
               )
             }
           ];
-          await this.level.batch(ops);
+          await level.batch(ops);
         }
         return true;
       } catch (error) {
@@ -5418,7 +5984,7 @@ var Database = class {
       const writeTemplateKey = templateDetails.info.type === "union";
       const aliasedData = applyNameOverrides(templateDetails.template, payload);
       const extension = import_path4.default.extname(filepath);
-      const stringifiedFile = stringifyFile(
+      return stringifyFile(
         aliasedData,
         extension,
         writeTemplateKey,
@@ -5427,7 +5993,6 @@ var Database = class {
           frontmatterDelimiters: collection == null ? void 0 : collection.frontmatterDelimiters
         }
       );
-      return stringifiedFile;
     };
     this.flush = async (filepath) => {
       const data = await this.get(filepath);
@@ -5436,12 +6001,7 @@ var Database = class {
       if (!collection) {
         throw new Error(`Unable to find collection for path ${filepath}`);
       }
-      const stringifiedFile = await this.stringifyFile(
-        filepath,
-        dataFields,
-        collection
-      );
-      return stringifiedFile;
+      return this.stringifyFile(filepath, dataFields, collection);
     };
     this.getLookup = async (returnType) => {
       await this.initLevel();
@@ -5449,11 +6009,10 @@ var Database = class {
         import_path4.default.join(this.getGeneratedFolder(), `_lookup.json`)
       );
       if (!this._lookup) {
-        const _lookup = await this.level.sublevel(
+        this._lookup = await this.contentLevel.sublevel(
           CONTENT_ROOT_PREFIX,
           SUBLEVEL_OPTIONS
         ).get(lookupPath);
-        this._lookup = _lookup;
       }
       return this._lookup[returnType];
     };
@@ -5462,7 +6021,7 @@ var Database = class {
       const graphqlPath = (0, import_schema_tools3.normalizePath)(
         import_path4.default.join(this.getGeneratedFolder(), `_graphql.json`)
       );
-      return await this.level.sublevel(
+      return await this.contentLevel.sublevel(
         CONTENT_ROOT_PREFIX,
         SUBLEVEL_OPTIONS
       ).get(graphqlPath);
@@ -5482,7 +6041,7 @@ var Database = class {
       const schemaPath = (0, import_schema_tools3.normalizePath)(
         import_path4.default.join(this.getGeneratedFolder(), `_schema.json`)
       );
-      return await (level || this.level).sublevel(
+      return await (level || this.contentLevel).sublevel(
         CONTENT_ROOT_PREFIX,
         SUBLEVEL_OPTIONS
       ).get(schemaPath);
@@ -5492,7 +6051,7 @@ var Database = class {
         return this.tinaSchema;
       }
       await this.initLevel();
-      const schema = existingSchema || await this.getTinaSchema(level || this.level);
+      const schema = existingSchema || await this.getTinaSchema(level || this.contentLevel);
       if (!schema) {
         throw new Error(
           `Unable to get schema from level db: ${(0, import_schema_tools3.normalizePath)(
@@ -5508,7 +6067,7 @@ var Database = class {
         await new Promise(async (resolve2, reject) => {
           await this.initLevel();
           try {
-            const schema = await this.getSchema(level || this.level);
+            const schema = await this.getSchema(level || this.contentLevel);
             const collections = schema.getCollections();
             for (const collection of collections) {
               const indexDefinitions = {
@@ -5575,7 +6134,6 @@ var Database = class {
         last,
         before,
         sort = DEFAULT_COLLECTION_SORT_KEY,
-        collection,
         filterChain: rawFilterChain,
         folder
       } = queryOptions;
@@ -5591,22 +6149,25 @@ var Database = class {
       } else if (before) {
         query.lt = atob(before);
       }
-      const allIndexDefinitions = await this.getIndexDefinitions(this.level);
-      const indexDefinitions = allIndexDefinitions == null ? void 0 : allIndexDefinitions[queryOptions.collection];
+      const tinaSchema = await this.getSchema(this.contentLevel);
+      const collection = tinaSchema.getCollection(queryOptions.collection);
+      const allIndexDefinitions = await this.getIndexDefinitions(
+        this.contentLevel
+      );
+      const indexDefinitions = allIndexDefinitions == null ? void 0 : allIndexDefinitions[collection.name];
       if (!indexDefinitions) {
-        throw new Error(
-          `No indexDefinitions for collection ${queryOptions.collection}`
-        );
+        throw new Error(`No indexDefinitions for collection ${collection.name}`);
       }
       const filterChain = coerceFilterChainOperands(rawFilterChain);
       const indexDefinition = sort && (indexDefinitions == null ? void 0 : indexDefinitions[sort]);
       const filterSuffixes = indexDefinition && makeFilterSuffixes(filterChain, indexDefinition);
-      const rootLevel = this.level.sublevel(
+      const level = (collection == null ? void 0 : collection.isDetached) ? this.appLevel.sublevel(collection == null ? void 0 : collection.name, SUBLEVEL_OPTIONS) : this.contentLevel;
+      const rootLevel = level.sublevel(
         CONTENT_ROOT_PREFIX,
         SUBLEVEL_OPTIONS
       );
-      const sublevel = indexDefinition ? this.level.sublevel(
-        `${collection}${folder ? `_${folder === FOLDER_ROOT ? folder : import_js_sha12.default.hex(folder)}` : ""}`,
+      const sublevel = indexDefinition ? level.sublevel(
+        `${collection.name}${folder ? `_${folder === FOLDER_ROOT ? folder : import_js_sha12.default.hex(folder)}` : ""}`,
         SUBLEVEL_OPTIONS
       ).sublevel(sort, SUBLEVEL_OPTIONS) : rootLevel;
       if (!query.gt && !query.gte) {
@@ -5678,7 +6239,7 @@ var Database = class {
               throw new TinaQueryError({
                 originalError: error,
                 file: edge.path,
-                collection,
+                collection: collection.name,
                 stack: error.stack
               });
             } else {
@@ -5726,8 +6287,8 @@ var Database = class {
           }
           let nextVersion;
           if (!this.config.version) {
-            await this.level.clear();
-            nextLevel = this.level;
+            await this.contentLevel.clear();
+            nextLevel = this.contentLevel;
           } else {
             const version = await this.getDatabaseVersion();
             nextVersion = version ? `${parseInt(version) + 1}` : "0";
@@ -5757,10 +6318,10 @@ var Database = class {
         },
         async () => {
           if (this.config.version) {
-            if (this.level) {
-              await this.level.clear();
+            if (this.contentLevel) {
+              await this.contentLevel.clear();
             }
-            this.level = nextLevel;
+            this.contentLevel = nextLevel;
           }
         }
       );
@@ -5771,10 +6332,10 @@ var Database = class {
       const enqueueOps = async (ops) => {
         operations.push(...ops);
         while (operations.length >= 25) {
-          await this.level.batch(operations.splice(0, 25));
+          await this.contentLevel.batch(operations.splice(0, 25));
         }
       };
-      const tinaSchema = await this.getSchema(this.level);
+      const tinaSchema = await this.getSchema(this.contentLevel);
       await this.indexStatusCallbackWrapper(async () => {
         const { pathsByCollection, nonCollectionPaths, collections } = await partitionPathsByCollection(tinaSchema, documentPaths);
         for (const collection of Object.keys(pathsByCollection)) {
@@ -5790,7 +6351,7 @@ var Database = class {
         }
       });
       while (operations.length) {
-        await this.level.batch(operations.splice(0, 25));
+        await this.contentLevel.batch(operations.splice(0, 25));
       }
     };
     this.indexContentByPaths = async (documentPaths) => {
@@ -5799,31 +6360,29 @@ var Database = class {
       const enqueueOps = async (ops) => {
         operations.push(...ops);
         while (operations.length >= 25) {
-          await this.level.batch(operations.splice(0, 25));
+          await this.contentLevel.batch(operations.splice(0, 25));
         }
       };
-      const tinaSchema = await this.getSchema(this.level);
+      const tinaSchema = await this.getSchema(this.contentLevel);
       await this.indexStatusCallbackWrapper(async () => {
         await scanContentByPaths(
           tinaSchema,
           documentPaths,
           async (collection, documentPaths2) => {
-            if (collection) {
+            if (collection && !collection.isDetached) {
               await _indexContent(
                 this,
-                this.level,
+                this.contentLevel,
                 documentPaths2,
                 enqueueOps,
                 collection
               );
-            } else {
-              await _indexContent(this, this.level, documentPaths2, enqueueOps);
             }
           }
         );
       });
       while (operations.length) {
-        await this.level.batch(operations.splice(0, 25));
+        await this.contentLevel.batch(operations.splice(0, 25));
       }
     };
     this.delete = async (filepath) => {
@@ -5832,14 +6391,14 @@ var Database = class {
       if (!collection) {
         throw new Error(`No collection found for path: ${filepath}`);
       }
-      const indexDefinitions = await this.getIndexDefinitions(this.level);
+      const indexDefinitions = await this.getIndexDefinitions(this.contentLevel);
       const collectionIndexDefinitions = indexDefinitions == null ? void 0 : indexDefinitions[collection.name];
-      this.level.sublevel(
-        CONTENT_ROOT_PREFIX,
-        SUBLEVEL_OPTIONS
-      );
+      let level = this.contentLevel;
+      if (collection == null ? void 0 : collection.isDetached) {
+        level = this.appLevel.sublevel(collection == null ? void 0 : collection.name, SUBLEVEL_OPTIONS);
+      }
       const itemKey = (0, import_schema_tools3.normalizePath)(filepath);
-      const rootSublevel = this.level.sublevel(
+      const rootSublevel = level.sublevel(
         CONTENT_ROOT_PREFIX,
         SUBLEVEL_OPTIONS
       );
@@ -5850,14 +6409,14 @@ var Database = class {
           filepath,
           collection.path || ""
         );
-        await this.level.batch([
+        await this.contentLevel.batch([
           ...makeIndexOpsForDocument(
             filepath,
             collection.name,
             collectionIndexDefinitions,
             item,
             "del",
-            this.level
+            level
           ),
           ...makeIndexOpsForDocument(
             filepath,
@@ -5865,7 +6424,7 @@ var Database = class {
             collectionIndexDefinitions,
             item,
             "del",
-            this.level
+            level
           ),
           {
             type: "del",
@@ -5874,20 +6433,22 @@ var Database = class {
           }
         ]);
       }
-      if (this.bridge) {
-        await this.bridge.delete((0, import_schema_tools3.normalizePath)(filepath));
-      }
-      try {
-        await this.onDelete((0, import_schema_tools3.normalizePath)(filepath));
-      } catch (e) {
-        throw new import_graphql6.GraphQLError(
-          `Error running onDelete hook for ${filepath}: ${e}`,
-          null,
-          null,
-          null,
-          null,
-          e
-        );
+      if (!(collection == null ? void 0 : collection.isDetached)) {
+        if (this.bridge) {
+          await this.bridge.delete((0, import_schema_tools3.normalizePath)(filepath));
+        }
+        try {
+          await this.onDelete((0, import_schema_tools3.normalizePath)(filepath));
+        } catch (e) {
+          throw new import_graphql6.GraphQLError(
+            `Error running onDelete hook for ${filepath}: ${e}`,
+            null,
+            null,
+            null,
+            null,
+            e
+          );
+        }
       }
     };
     this._indexAllContent = async (level, schema) => {
@@ -5904,7 +6465,29 @@ var Database = class {
         tinaSchema,
         this.bridge,
         async (collection, contentPaths) => {
-          await _indexContent(this, level, contentPaths, enqueueOps, collection);
+          const userFields = mapUserFields(collection, []);
+          if (collection.isDetached) {
+            const level2 = this.appLevel.sublevel(
+              collection.name,
+              SUBLEVEL_OPTIONS
+            );
+            const doc = await level2.keys({ limit: 1 }).next();
+            if (!doc) {
+              await _indexContent(
+                this,
+                level2,
+                contentPaths,
+                enqueueOps,
+                collection,
+                userFields.map((field) => [
+                  ...field.path,
+                  field.passwordFieldName
+                ])
+              );
+            }
+          } else {
+            await _indexContent(this, level, contentPaths, enqueueOps, collection);
+          }
         }
       );
       while (operations.length) {
@@ -5918,22 +6501,36 @@ var Database = class {
     this.indexStatusCallback = config.indexStatusCallback || defaultStatusCallback;
     this.onPut = config.onPut || defaultOnPut;
     this.onDelete = config.onDelete || defaultOnDelete;
+    this.contentNamespace = config.namespace;
   }
   async updateDatabaseVersion(version) {
-    const metadataLevel = this.rootLevel.sublevel("_metadata", SUBLEVEL_OPTIONS);
+    let metadataLevel = this.rootLevel.sublevel("_metadata", SUBLEVEL_OPTIONS);
+    if (this.contentNamespace) {
+      metadataLevel = metadataLevel.sublevel(
+        this.contentNamespace,
+        SUBLEVEL_OPTIONS
+      );
+    }
     await metadataLevel.put("metadata", { version });
   }
   async getDatabaseVersion() {
-    const metadataLevel = this.rootLevel.sublevel("_metadata", SUBLEVEL_OPTIONS);
+    let metadataLevel = this.rootLevel.sublevel("_metadata", SUBLEVEL_OPTIONS);
+    if (this.contentNamespace) {
+      metadataLevel = metadataLevel.sublevel(
+        this.contentNamespace,
+        SUBLEVEL_OPTIONS
+      );
+    }
     const metadata = await metadataLevel.get("metadata");
     return metadata == null ? void 0 : metadata.version;
   }
   async initLevel() {
-    if (this.level) {
+    if (this.contentLevel) {
       return;
     }
+    this.appLevel = this.rootLevel.sublevel("_appData", SUBLEVEL_OPTIONS);
     if (!this.config.version) {
-      this.level = this.rootLevel;
+      this.contentLevel = this.contentNamespace ? this.rootLevel.sublevel("_content", SUBLEVEL_OPTIONS).sublevel(this.contentNamespace, SUBLEVEL_OPTIONS) : this.rootLevel.sublevel("_content", SUBLEVEL_OPTIONS);
     } else {
       let version = await this.getDatabaseVersion();
       if (!version) {
@@ -5943,9 +6540,9 @@ var Database = class {
         } catch (e) {
         }
       }
-      this.level = this.rootLevel.sublevel(version, SUBLEVEL_OPTIONS);
+      this.contentLevel = this.contentNamespace ? this.rootLevel.sublevel("_content").sublevel(this.contentNamespace, SUBLEVEL_OPTIONS).sublevel(version, SUBLEVEL_OPTIONS) : this.rootLevel.sublevel(version, SUBLEVEL_OPTIONS);
     }
-    if (!this.level) {
+    if (!this.contentLevel) {
       throw new import_graphql6.GraphQLError("Error initializing LevelDB instance");
     }
   }
@@ -5994,7 +6591,36 @@ var Database = class {
     }
   }
 };
-var _indexContent = async (database, level, documentPaths, enqueueOps, collection) => {
+var hashPasswordVisitor = async (node, path7) => {
+  const passwordValuePath = [...path7, "value"];
+  const plaintextPassword = import_lodash5.default.get(node, passwordValuePath);
+  if (plaintextPassword) {
+    import_lodash5.default.set(
+      node,
+      passwordValuePath,
+      await generatePasswordHash({ password: plaintextPassword })
+    );
+  }
+};
+var visitNodes = async (node, path7, callback) => {
+  const [currentLevel, ...remainingLevels] = path7;
+  if (!(remainingLevels == null ? void 0 : remainingLevels.length)) {
+    return callback(node, path7);
+  }
+  if (Array.isArray(node[currentLevel])) {
+    for (const item of node[currentLevel]) {
+      await visitNodes(item, remainingLevels, callback);
+    }
+  } else {
+    await visitNodes(node[currentLevel], remainingLevels, callback);
+  }
+};
+var hashPasswordValues = async (data, passwordFields) => Promise.all(
+  passwordFields.map(
+    async (passwordField) => visitNodes(data, passwordField, hashPasswordVisitor)
+  )
+);
+var _indexContent = async (database, level, documentPaths, enqueueOps, collection, passwordFields) => {
   let collectionIndexDefinitions;
   let collectionPath;
   if (collection) {
@@ -6022,6 +6648,9 @@ var _indexContent = async (database, level, documentPaths, enqueueOps, collectio
       if (!aliasedData) {
         return;
       }
+      if (passwordFields == null ? void 0 : passwordFields.length) {
+        await hashPasswordValues(aliasedData, passwordFields);
+      }
       const normalizedPath = (0, import_schema_tools3.normalizePath)(filepath);
       const folderKey = folderTreeBuilder.update(
         normalizedPath,
@@ -6081,7 +6710,9 @@ var _deleteIndexContent = async (database, documentPaths, enqueueOps, collection
   }
   let collectionIndexDefinitions;
   if (collection) {
-    const indexDefinitions = await database.getIndexDefinitions(database.level);
+    const indexDefinitions = await database.getIndexDefinitions(
+      database.contentLevel
+    );
     collectionIndexDefinitions = indexDefinitions == null ? void 0 : indexDefinitions[collection.name];
     if (!collectionIndexDefinitions) {
       throw new Error(`No indexDefinitions for collection ${collection.name}`);
@@ -6090,9 +6721,9 @@ var _deleteIndexContent = async (database, documentPaths, enqueueOps, collection
   const tinaSchema = await database.getSchema();
   let templateInfo = null;
   if (collection) {
-    templateInfo = await tinaSchema.getTemplatesForCollectable(collection);
+    templateInfo = tinaSchema.getTemplatesForCollectable(collection);
   }
-  const rootLevel = database.level.sublevel(
+  const rootLevel = database.contentLevel.sublevel(
     CONTENT_ROOT_PREFIX,
     SUBLEVEL_OPTIONS
   );
@@ -6116,7 +6747,7 @@ var _deleteIndexContent = async (database, documentPaths, enqueueOps, collection
           collectionIndexDefinitions,
           aliasedData,
           "del",
-          database.level
+          database.contentLevel
         ),
         ...makeIndexOpsForDocument(
           itemKey,
@@ -6124,7 +6755,7 @@ var _deleteIndexContent = async (database, documentPaths, enqueueOps, collection
           collectionIndexDefinitions,
           aliasedData,
           "del",
-          database.level
+          database.contentLevel
         ),
         { type: "del", key: itemKey, sublevel: rootLevel }
       ]);
@@ -6137,33 +6768,12 @@ var _deleteIndexContent = async (database, documentPaths, enqueueOps, collection
         collection,
         collectionIndexDefinitions,
         "del",
-        database.level
+        database.contentLevel
       )
     );
   }
 };
 
-// src/level/tinaLevel.ts
-var import_many_level = require("many-level");
-var import_readable_stream = require("readable-stream");
-var import_net = require("net");
-var TinaLevelClient = class extends import_many_level.ManyLevelGuest {
-  constructor(port) {
-    super();
-    this._connected = false;
-    this.port = port || 9e3;
-  }
-  openConnection() {
-    if (this._connected)
-      return;
-    const socket = (0, import_net.connect)(this.port);
-    (0, import_readable_stream.pipeline)(socket, this.createRpcStream(), socket, () => {
-      this._connected = false;
-    });
-    this._connected = true;
-  }
-};
-
 // src/git/index.ts
 var import_isomorphic_git = __toESM(require("isomorphic-git"));
 var import_fs_extra = __toESM(require("fs-extra"));
@@ -6700,6 +7310,7 @@ var buildSchema = async (config, flags) => {
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   AuditFileSystemBridge,
+  Database,
   FilesystemBridge,
   IsomorphicBridge,
   TinaFetchError,
@@ -6710,12 +7321,17 @@ var buildSchema = async (config, flags) => {
   assertShape,
   buildDotTinaFiles,
   buildSchema,
+  checkPasswordHash,
   createDatabase,
+  createDatabaseInternal,
+  createLocalDatabase,
   createSchema,
+  generatePasswordHash,
   getChangedFiles,
   getSha,
   handleFetchErrorError,
   loadAndParseWithAliases,
+  mapUserFields,
   parseFile,
   resolve,
   scanAllContent,