@tinacms/graphql 1.4.28 → 1.4.30

package/dist/index.mjs

@@ -458,6 +458,7 @@ var astBuilder = {
     CollectionDocumentUnion: "DocumentUnion",
     Folder: "Folder",
     String: "String",
+    Password: "Password",
     Reference: "Reference",
     Collection: "Collection",
     ID: "ID",
@@ -1268,6 +1269,125 @@ var scalarDefinitions = [
 ];
 var staticDefinitions = [...scalarDefinitions, interfaceDefinitions];
 
+// src/auth/utils.ts
+import crypto from "crypto";
+import scmp from "scmp";
+var DEFAULT_SALT_LENGTH = 32;
+var DEFAULT_KEY_LENGTH = 512;
+var DEFAULT_ITERATIONS = 25e3;
+var DEFAULT_DIGEST = "sha256";
+var generatePasswordHash = async ({
+  password,
+  opts: {
+    saltLength = DEFAULT_SALT_LENGTH,
+    keyLength = DEFAULT_KEY_LENGTH,
+    iterations = DEFAULT_ITERATIONS,
+    digest = DEFAULT_DIGEST
+  } = {
+    saltLength: DEFAULT_SALT_LENGTH,
+    keyLength: DEFAULT_KEY_LENGTH,
+    iterations: DEFAULT_ITERATIONS,
+    digest: DEFAULT_DIGEST
+  }
+}) => {
+  if (!password) {
+    throw new Error("Password is required");
+  }
+  if (password.length < 3) {
+    throw new Error("Password must be at least 3 characters");
+  }
+  const salt = (await new Promise((resolve2, reject) => {
+    crypto.randomBytes(saltLength, (err, saltBuffer) => {
+      if (err) {
+        reject(err);
+      }
+      resolve2(saltBuffer);
+    });
+  })).toString("hex");
+  const hash = (await new Promise((resolve2, reject) => {
+    crypto.pbkdf2(
+      password,
+      salt,
+      iterations,
+      keyLength,
+      digest,
+      (err, hashBuffer) => {
+        if (err) {
+          reject(err);
+        }
+        resolve2(hashBuffer);
+      }
+    );
+  })).toString("hex");
+  return `${salt}${hash}`;
+};
+var checkPasswordHash = async ({
+  saltedHash,
+  password,
+  opts: {
+    saltLength = DEFAULT_SALT_LENGTH,
+    keyLength = DEFAULT_KEY_LENGTH,
+    iterations = DEFAULT_ITERATIONS,
+    digest = DEFAULT_DIGEST
+  } = {
+    saltLength: DEFAULT_SALT_LENGTH,
+    keyLength: DEFAULT_KEY_LENGTH,
+    iterations: DEFAULT_ITERATIONS,
+    digest: DEFAULT_DIGEST
+  }
+}) => {
+  const salt = saltedHash.slice(0, saltLength * 2);
+  const hash = saltedHash.slice(saltLength * 2);
+  try {
+    await new Promise((resolve2, reject) => {
+      crypto.pbkdf2(
+        password,
+        salt,
+        iterations,
+        keyLength,
+        digest,
+        (err, hashBuffer) => {
+          if (err) {
+            reject(null);
+          }
+          if (scmp(hashBuffer, Buffer.from(hash, "hex"))) {
+            resolve2();
+          }
+          reject(null);
+        }
+      );
+    });
+  } catch (e) {
+    return false;
+  }
+  return true;
+};
+var mapUserFields = (collectable, prefix = []) => {
+  const results = [];
+  const passwordFields = collectable.fields?.filter((field) => field.type === "password") || [];
+  if (passwordFields.length > 1) {
+    throw new Error("Only one password field is allowed");
+  }
+  const idFields = collectable.fields?.filter((field) => field.uid) || [];
+  if (idFields.length > 1) {
+    throw new Error("Only one uid field is allowed");
+  }
+  if (passwordFields.length || idFields.length) {
+    results.push({
+      path: prefix,
+      collectable,
+      idFieldName: idFields[0]?.name,
+      passwordFieldName: passwordFields[0]?.name
+    });
+  }
+  collectable.fields?.forEach((field) => {
+    if (field.type === "object" && field.fields) {
+      results.push(...mapUserFields(field, [...prefix, field.name]));
+    }
+  });
+  return results;
+};
+
 // src/builder/index.ts
 var createBuilder = async ({
   tinaSchema
@@ -1368,7 +1488,7 @@ var Builder = class {
           type: astBuilder.TYPES.String
         })
       ];
-      await this.addToLookupMap({
+      this.addToLookupMap({
         type: astBuilder.TYPES.Node,
         resolveType: "nodeDocument"
       });
@@ -1511,7 +1631,7 @@ var Builder = class {
           type: astBuilder.TYPES.String
         })
       ];
-      await this.addToLookupMap({
+      this.addToLookupMap({
         type: type.name.value,
         resolveType: "collectionDocument",
         collection: collection.name,
@@ -1525,6 +1645,43 @@ var Builder = class {
         required: true
       });
     };
+    this.authenticationCollectionDocument = async (collection) => {
+      const name = "authenticate";
+      const type = await this._buildAuthDocumentType(collection);
+      const args = [
+        astBuilder.InputValueDefinition({
+          name: "sub",
+          type: astBuilder.TYPES.String,
+          required: true
+        }),
+        astBuilder.InputValueDefinition({
+          name: "password",
+          type: astBuilder.TYPES.String,
+          required: true
+        })
+      ];
+      return astBuilder.FieldDefinition({ type, name, args, required: false });
+    };
+    this.updatePasswordMutation = async (collection) => {
+      return astBuilder.FieldDefinition({
+        type: astBuilder.TYPES.Boolean,
+        name: "updatePassword",
+        required: true,
+        args: [
+          astBuilder.InputValueDefinition({
+            name: "password",
+            required: true,
+            type: astBuilder.TYPES.String
+          })
+        ]
+      });
+    };
+    this.authorizationCollectionDocument = async (collection) => {
+      const name = "authorize";
+      const type = await this._buildAuthDocumentType(collection);
+      const args = [];
+      return astBuilder.FieldDefinition({ type, name, args, required: false });
+    };
     this.collectionFragment = async (collection) => {
       const name = NAMER.dataTypeName(collection.namespace);
       const fragmentName = NAMER.fragmentName(collection.namespace);
@@ -1567,6 +1724,29 @@ var Builder = class {
         case "boolean":
         case "rich-text":
           return astBuilder.FieldNodeDefinition(field);
+        case "password":
+          const passwordValue = await this._buildFieldNodeForFragments(
+            {
+              name: "value",
+              namespace: [...field.namespace, "value"],
+              type: "string",
+              required: true
+            },
+            depth
+          );
+          const passwordChangeRequired = await this._buildFieldNodeForFragments(
+            {
+              name: "passwordChangeRequired",
+              namespace: [...field.namespace, "passwordChangeRequired"],
+              type: "boolean",
+              required: false
+            },
+            depth
+          );
+          return astBuilder.FieldWithSelectionSetDefinition({
+            name: field.name,
+            selections: filterSelections([passwordValue, passwordChangeRequired])
+          });
         case "object":
           if (field.fields?.length > 0) {
             const selections2 = [];
@@ -1780,6 +1960,34 @@ var Builder = class {
         ]
       });
     };
+    this._buildAuthDocumentType = async (collection, suffix = "", extraFields = [], extraInterfaces = []) => {
+      const usersFields = mapUserFields(collection, []);
+      if (!usersFields.length) {
+        throw new Error("Auth collection must have a user field");
+      }
+      if (usersFields.length > 1) {
+        throw new Error("Auth collection cannot have more than one user field");
+      }
+      const usersField = usersFields[0].collectable;
+      const documentTypeName = NAMER.documentTypeName(usersField.namespace);
+      const templateInfo = this.tinaSchema.getTemplatesForCollectable(usersField);
+      if (templateInfo.type === "union") {
+        throw new Error("Auth collection user field cannot be a union");
+      }
+      const fields = templateInfo.template.fields;
+      const templateFields = await sequential(fields, async (field) => {
+        return this._buildDataField(field);
+      });
+      return astBuilder.ObjectTypeDefinition({
+        name: documentTypeName + suffix,
+        interfaces: [
+          astBuilder.NamedType({ name: astBuilder.TYPES.Node }),
+          astBuilder.NamedType({ name: astBuilder.TYPES.Document }),
+          ...extraInterfaces
+        ],
+        fields: [...templateFields]
+      });
+    };
     this._filterCollectionDocumentType = async (collection) => {
       const t = this.tinaSchema.getTemplatesForCollectable(collection);
       if (t.type === "union") {
@@ -2038,9 +2246,7 @@ var Builder = class {
           const filter = await this._connectionFilterBuilder({
             fieldName: field.name,
             namespace: field.namespace,
-            collections: await this.tinaSchema.getCollectionsByName(
-              field.collections
-            )
+            collections: this.tinaSchema.getCollectionsByName(field.collections)
           });
           return astBuilder.InputValueDefinition({
             name: field.name,
@@ -2073,6 +2279,8 @@ var Builder = class {
             list: field.list,
             type: astBuilder.TYPES.String
           });
+        case "password":
+          return this._buildPasswordMutation(field);
         case "object":
           return astBuilder.InputValueDefinition({
             name: field.name,
@@ -2107,6 +2315,27 @@ var Builder = class {
         )
       });
     };
+    this._buildPasswordMutation = async (field) => {
+      return astBuilder.InputValueDefinition({
+        name: field.name,
+        list: field.list,
+        type: astBuilder.InputObjectTypeDefinition({
+          name: NAMER.dataMutationTypeName(field.namespace),
+          fields: [
+            astBuilder.InputValueDefinition({
+              name: "value",
+              type: astBuilder.TYPES.String,
+              required: false
+            }),
+            astBuilder.InputValueDefinition({
+              name: "passwordChangeRequired",
+              type: astBuilder.TYPES.Boolean,
+              required: true
+            })
+          ]
+        })
+      });
+    };
     this._buildUpdateDocumentMutationParams = async (field) => {
       const fields = await sequential(
         this.tinaSchema.getCollectionsByName(field.collections),
@@ -2271,6 +2500,29 @@ Visit https://tina.io/docs/errors/ui-not-supported/ for more information
             required: field.required,
             type: astBuilder.TYPES.Scalar(field.type)
           });
+        case "password":
+          return astBuilder.FieldDefinition({
+            name: field.name,
+            list: field.list,
+            required: field.required,
+            type: astBuilder.ObjectTypeDefinition({
+              name: NAMER.dataTypeName(field.namespace),
+              fields: [
+                await this._buildDataField({
+                  name: "value",
+                  namespace: [...field.namespace, "value"],
+                  type: "string",
+                  required: true
+                }),
+                await this._buildDataField({
+                  name: "passwordChangeRequired",
+                  namespace: [...field.namespace, "passwordChangeRequired"],
+                  type: "boolean",
+                  required: false
+                })
+              ]
+            })
+          });
         case "object":
           return astBuilder.FieldDefinition({
             name: field.name,
@@ -2395,7 +2647,8 @@ var FIELD_TYPES = [
   "image",
   "reference",
   "object",
-  "rich-text"
+  "rich-text",
+  "password"
 ];
 var validateSchema = async (schema) => {
   const schema2 = addNamespaceToSchema(
@@ -2535,7 +2788,7 @@ var validateField = async (field) => {
 // package.json
 var package_default = {
   name: "@tinacms/graphql",
-  version: "1.4.28",
+  version: "1.4.30",
   main: "dist/index.js",
   module: "dist/index.mjs",
   typings: "dist/index.d.ts",
@@ -2590,6 +2843,7 @@ var package_default = {
     micromatch: "4.0.5",
     "normalize-path": "^3.0.0",
     "readable-stream": "^4.3.0",
+    scmp: "^2.1.0",
     yup: "^0.32.9"
   },
   publishConfig: {
@@ -2775,6 +3029,17 @@ var _buildSchema = async (builder, tinaSchema) => {
   );
   await sequential(collections, async (collection) => {
     queryTypeDefinitionFields.push(await builder.collectionDocument(collection));
+    if (collection.isAuthCollection) {
+      queryTypeDefinitionFields.push(
+        await builder.authenticationCollectionDocument(collection)
+      );
+      queryTypeDefinitionFields.push(
+        await builder.authorizationCollectionDocument(collection)
+      );
+      mutationTypeDefinitionFields.push(
+        await builder.updatePasswordMutation(collection)
+      );
+    }
     mutationTypeDefinitionFields.push(
       await builder.updateCollectionDocumentMutation(collection)
     );
@@ -4081,6 +4346,12 @@ var resolveFieldData = async ({ namespace, ...field }, rawData, accumulator, tin
         accumulator[field.name] = value;
       }
       break;
+    case "password":
+      accumulator[field.name] = {
+        value: void 0,
+        passwordChangeRequired: value["passwordChangeRequired"] ?? false
+      };
+      break;
     case "image":
       accumulator[field.name] = resolveMediaRelativeToCloud(
         value,
@@ -4114,7 +4385,7 @@ var resolveFieldData = async ({ namespace, ...field }, rawData, accumulator, tin
           (yup3) => yup3.array().of(yup3.object().required())
         );
         accumulator[field.name] = await sequential(value, async (item) => {
-          const template = await tinaSchema.getTemplateForData({
+          const template = tinaSchema.getTemplateForData({
             data: item,
             collection: {
               namespace,
@@ -4142,7 +4413,7 @@ var resolveFieldData = async ({ namespace, ...field }, rawData, accumulator, tin
         if (!value) {
           return;
         }
-        const template = await tinaSchema.getTemplateForData({
+        const template = tinaSchema.getTemplateForData({
           data: value,
           collection: {
             namespace,
@@ -4305,43 +4576,71 @@ var Resolver = class {
       }
       await this.database.delete(fullPath);
     };
-    this.buildObjectMutations = (fieldValue, field) => {
+    this.buildObjectMutations = async (fieldValue, field, existingData) => {
       if (field.fields) {
         const objectTemplate = field;
         if (Array.isArray(fieldValue)) {
-          return fieldValue.map(
-            (item) => this.buildFieldMutations(item, objectTemplate)
+          const idField = objectTemplate.fields.find((field2) => field2.uid);
+          if (idField) {
+            const ids = fieldValue.map((d) => d[idField.name]);
+            const duplicateIds = ids.filter(
+              (id, index) => ids.indexOf(id) !== index
+            );
+            if (duplicateIds.length > 0) {
+              throw new Error(
+                `Duplicate ids found in array for field marked as identifier: ${idField.name}`
+              );
+            }
+          }
+          return Promise.all(
+            fieldValue.map(
+              async (item) => {
+                return this.buildFieldMutations(
+                  item,
+                  objectTemplate,
+                  idField && existingData && existingData?.find(
+                    (d) => d[idField.name] === item[idField.name]
+                  )
+                );
+              }
+            )
           );
         } else {
           return this.buildFieldMutations(
             fieldValue,
-            objectTemplate
+            objectTemplate,
+            existingData
           );
         }
       }
       if (field.templates) {
         if (Array.isArray(fieldValue)) {
-          return fieldValue.map((item) => {
-            if (typeof item === "string") {
-              throw new Error(
-                `Expected object for template value for field ${field.name}`
+          return Promise.all(
+            fieldValue.map(async (item) => {
+              if (typeof item === "string") {
+                throw new Error(
+                  `Expected object for template value for field ${field.name}`
+                );
+              }
+              const templates = field.templates.map((templateOrTemplateName) => {
+                return templateOrTemplateName;
+              });
+              const [templateName] = Object.entries(item)[0];
+              const template = templates.find(
+                (template2) => template2.name === templateName
               );
-            }
-            const templates = field.templates.map((templateOrTemplateName) => {
-              return templateOrTemplateName;
-            });
-            const [templateName] = Object.entries(item)[0];
-            const template = templates.find(
-              (template2) => template2.name === templateName
-            );
-            if (!template) {
-              throw new Error(`Expected to find template ${templateName}`);
-            }
-            return {
-              ...this.buildFieldMutations(item[template.name], template),
-              _template: template.name
-            };
-          });
+              if (!template) {
+                throw new Error(`Expected to find template ${templateName}`);
+              }
+              return {
+                ...await this.buildFieldMutations(
+                  item[template.name],
+                  template
+                ),
+                _template: template.name
+              };
+            })
+          );
         } else {
           if (typeof fieldValue === "string") {
             throw new Error(
@@ -4359,7 +4658,10 @@ var Resolver = class {
             throw new Error(`Expected to find template ${templateName}`);
           }
           return {
-            ...this.buildFieldMutations(fieldValue[template.name], template),
+            ...await this.buildFieldMutations(
+              fieldValue[template.name],
+              template
+            ),
             _template: template.name
           };
         }
@@ -4398,7 +4700,7 @@ var Resolver = class {
         }
         return this.getDocument(realPath);
       }
-      const params = this.buildObjectMutations(
+      const params = await this.buildObjectMutations(
         args.params[collection.name],
         collection
       );
@@ -4420,9 +4722,10 @@ var Resolver = class {
         switch (templateInfo.type) {
           case "object":
             if (params2) {
-              const values = this.buildFieldMutations(
+              const values = await this.buildFieldMutations(
                 params2,
-                templateInfo.template
+                templateInfo.template,
+                doc?._rawData
               );
               await this.database.put(
                 realPath,
@@ -4442,7 +4745,11 @@ var Resolver = class {
                 }
                 const values = {
                   ...oldDoc,
-                  ...this.buildFieldMutations(templateParams, template),
+                  ...await this.buildFieldMutations(
+                    templateParams,
+                    template,
+                    doc?._rawData
+                  ),
                   _template: lastItem(template.namespace)
                 };
                 await this.database.put(realPath, values, collection.name);
@@ -4451,9 +4758,10 @@ var Resolver = class {
         }
         return this.getDocument(realPath);
       }
-      const params = this.buildObjectMutations(
+      const params = await this.buildObjectMutations(
         isCollectionSpecific ? args.params : args.params[collection.name],
-        collection
+        collection,
+        doc?._rawData
       );
       await this.database.put(realPath, { ...oldDoc, ...params }, collection.name);
       return this.getDocument(realPath);
@@ -4682,13 +4990,23 @@ var Resolver = class {
         }
       };
     };
-    this.buildFieldMutations = (fieldParams, template) => {
+    this.buildFieldMutations = async (fieldParams, template, existingData) => {
       const accum = {};
-      Object.entries(fieldParams).forEach(([fieldName, fieldValue]) => {
+      for (const passwordField of template.fields.filter(
+        (f) => f.type === "password"
+      )) {
+        if (!fieldParams[passwordField.name]["value"]) {
+          fieldParams[passwordField.name] = {
+            ...fieldParams[passwordField.name],
+            value: ""
+          };
+        }
+      }
+      for (const [fieldName, fieldValue] of Object.entries(fieldParams)) {
         if (Array.isArray(fieldValue)) {
           if (fieldValue.length === 0) {
             accum[fieldName] = [];
-            return;
+            break;
           }
         }
         const field = template.fields.find((field2) => field2.name === fieldName);
@@ -4712,7 +5030,31 @@ var Resolver = class {
             );
             break;
           case "object":
-            accum[fieldName] = this.buildObjectMutations(fieldValue, field);
+            accum[fieldName] = await this.buildObjectMutations(
+              fieldValue,
+              field,
+              existingData?.[fieldName]
+            );
+            break;
+          case "password":
+            if (typeof fieldValue !== "object") {
+              throw new Error(
+                `Expected to find object for password field ${fieldName}. Found ${typeof accum[fieldName]}`
+              );
+            }
+            if (fieldValue["value"]) {
+              accum[fieldName] = {
+                ...fieldValue,
+                value: await generatePasswordHash({
+                  password: fieldValue["value"]
+                })
+              };
+            } else {
+              accum[fieldName] = {
+                ...fieldValue,
+                value: existingData?.[fieldName]?.["value"]
+              };
+            }
             break;
           case "rich-text":
             accum[fieldName] = stringifyMDX(
@@ -4731,7 +5073,7 @@ var Resolver = class {
           default:
             throw new Error(`No mutation builder for field type ${field.type}`);
         }
-      });
+      }
       return accum;
     };
     this.buildParams = (args) => {
@@ -4801,6 +5143,9 @@ var resolveDateInput = (value) => {
   return date;
 };
 
+// src/resolve.ts
+import _4 from "lodash";
+
 // src/error.ts
 import { GraphQLError as GraphQLError3 } from "graphql";
 var NotFoundError = class extends GraphQLError3 {
@@ -4818,7 +5163,8 @@ var resolve = async ({
   database,
   silenceErrors,
   verbose,
-  isAudit
+  isAudit,
+  ctxUser
 }) => {
   try {
     const verboseValue = verbose ?? true;
@@ -4832,7 +5178,7 @@ var resolve = async ({
       schema: tinaConfig,
       flags: tinaConfig?.meta?.flags
     });
-    const resolver = await createResolver({
+    const resolver = createResolver({
       config,
       database,
       tinaSchema,
@@ -4907,6 +5253,121 @@ var resolve = async ({
               );
             }
           }
+          if (info.fieldName === "authenticate" || info.fieldName === "authorize") {
+            const sub = args.sub || ctxUser?.sub;
+            const collection = tinaSchema.getCollections().find((c) => c.isAuthCollection);
+            if (!collection) {
+              throw new Error(`Auth collection not found`);
+            }
+            const userFields = mapUserFields(collection, ["_rawData"]);
+            if (!userFields.length) {
+              throw new Error(
+                `No user field found in collection ${collection.name}`
+              );
+            }
+            if (userFields.length > 1) {
+              throw new Error(
+                `Multiple user fields found in collection ${collection.name}`
+              );
+            }
+            const userField = userFields[0];
+            const realPath = `${collection.path}/index.json`;
+            const userDoc = await resolver.getDocument(realPath);
+            const users = _4.get(userDoc, userField.path);
+            if (!users) {
+              throw new Error("No users found");
+            }
+            const { idFieldName, passwordFieldName } = userField;
+            if (!idFieldName) {
+              throw new Error("No uid field found on user field");
+            }
+            const user = users.find((u) => u[idFieldName] === sub);
+            if (!user) {
+              return null;
+            }
+            if (info.fieldName === "authenticate") {
+              const saltedHash = _4.get(user, [passwordFieldName || "", "value"]);
+              if (!saltedHash) {
+                throw new Error("No password field found on user field");
+              }
+              const matches = await checkPasswordHash({
+                saltedHash,
+                password: args.password
+              });
+              if (matches) {
+                return user;
+              } else {
+                return null;
+              }
+            } else {
+              return user;
+            }
+          }
+          if (info.fieldName === "updatePassword") {
+            if (!ctxUser?.sub) {
+              throw new Error("Not authorized");
+            }
+            if (!args.password) {
+              throw new Error("No password provided");
+            }
+            const collection = tinaSchema.getCollections().find((c) => c.isAuthCollection);
+            if (!collection) {
+              throw new Error(`Auth collection not found`);
+            }
+            const userFields = mapUserFields(collection, ["_rawData"]);
+            if (!userFields.length) {
+              throw new Error(
+                `No user field found in collection ${collection.name}`
+              );
+            }
+            if (userFields.length > 1) {
+              throw new Error(
+                `Multiple user fields found in collection ${collection.name}`
+              );
+            }
+            const userField = userFields[0];
+            const realPath = `${collection.path}/index.json`;
+            const userDoc = await resolver.getDocument(realPath);
+            const users = _4.get(userDoc, userField.path);
+            if (!users) {
+              throw new Error("No users found");
+            }
+            const { idFieldName, passwordFieldName } = userField;
+            const user = users.find((u) => u[idFieldName] === ctxUser.sub);
+            if (!user) {
+              throw new Error("Not authorized");
+            }
+            user[passwordFieldName] = {
+              value: args.password,
+              passwordChangeRequired: false
+            };
+            const params = {};
+            _4.set(
+              params,
+              userField.path.slice(1),
+              users.map((u) => {
+                if (user[idFieldName] === u[idFieldName]) {
+                  return user;
+                } else {
+                  return {
+                    ...u,
+                    [passwordFieldName]: {
+                      ...u[passwordFieldName],
+                      value: ""
+                    }
+                  };
+                }
+              })
+            );
+            await resolver.updateResolveDocument({
+              collection,
+              args: { params },
+              realPath,
+              isCollectionSpecific: true,
+              isAddPendingDocument: false
+            });
+            return true;
+          }
           if (!lookup) {
             return value;
           }
@@ -5047,12 +5508,78 @@ var resolve = async ({
   }
 };
 
+// src/level/tinaLevel.ts
+import { ManyLevelGuest } from "many-level";
+import { pipeline } from "readable-stream";
+import { connect } from "net";
+var TinaLevelClient = class extends ManyLevelGuest {
+  constructor(port) {
+    super();
+    this._connected = false;
+    this.port = port || 9e3;
+  }
+  openConnection() {
+    if (this._connected)
+      return;
+    const socket = connect(this.port);
+    pipeline(socket, this.createRpcStream(), socket, () => {
+      this._connected = false;
+    });
+    this._connected = true;
+  }
+};
+
 // src/database/index.ts
 import path4 from "path";
 import { GraphQLError as GraphQLError5 } from "graphql";
 import micromatch2 from "micromatch";
 import sha2 from "js-sha1";
+import _5 from "lodash";
+var createLocalDatabase = (config) => {
+  const level = new TinaLevelClient(config?.port);
+  level.openConnection();
+  const fsBridge = new FilesystemBridge(config?.rootPath || process.cwd());
+  return new Database({
+    bridge: fsBridge,
+    ...config || {},
+    level
+  });
+};
 var createDatabase = (config) => {
+  if (config.onPut && config.onDelete) {
+    console.warn(
+      "onPut and onDelete are deprecated. Please use gitProvider.onPut and gitProvider.onDelete instead."
+    );
+  }
+  if (config.level) {
+    console.warn("level is deprecated. Please use databaseAdapter instead.");
+  }
+  if (config.onPut && config.onDelete && config.level && !config.databaseAdapter && !config.gitProvider) {
+    return new Database({
+      ...config,
+      level: config.level
+    });
+  }
+  if (!config.gitProvider) {
+    throw new Error(
+      "createDatabase requires a gitProvider. Please provide a gitProvider."
+    );
+  }
+  if (!config.databaseAdapter) {
+    throw new Error(
+      "createDatabase requires a databaseAdapter. Please provide a databaseAdapter."
+    );
+  }
+  return new Database({
+    ...config,
+    bridge: config.bridge,
+    level: config.databaseAdapter,
+    onPut: config.gitProvider.onPut.bind(config.gitProvider),
+    onDelete: config.gitProvider.onDelete.bind(config.gitProvider),
+    namespace: config.namespace || "tinacms"
+  });
+};
+var createDatabaseInternal = (config) => {
   return new Database({
     ...config,
     bridge: config.bridge,
@@ -5067,7 +5594,7 @@ var Database = class {
   constructor(config) {
     this.config = config;
     this.collectionForPath = async (filepath) => {
-      const tinaSchema = await this.getSchema(this.level);
+      const tinaSchema = await this.getSchema(this.contentLevel);
       try {
         return tinaSchema.getCollectionByFullPath(filepath);
       } catch (e) {
@@ -5076,13 +5603,25 @@ var Database = class {
     this.getGeneratedFolder = () => path4.join(this.tinaDirectory, "__generated__");
     this.getMetadata = async (key) => {
       await this.initLevel();
-      const metadataLevel = this.rootLevel.sublevel("_metadata", SUBLEVEL_OPTIONS);
+      let metadataLevel = this.rootLevel.sublevel("_metadata", SUBLEVEL_OPTIONS);
+      if (this.contentNamespace) {
+        metadataLevel = metadataLevel.sublevel(
+          this.contentNamespace,
+          SUBLEVEL_OPTIONS
+        );
+      }
       const metadata = await metadataLevel.get(`metadata_${key}`);
       return metadata?.value;
     };
     this.setMetadata = async (key, value) => {
       await this.initLevel();
-      const metadataLevel = this.rootLevel.sublevel("_metadata", SUBLEVEL_OPTIONS);
+      let metadataLevel = this.rootLevel.sublevel("_metadata", SUBLEVEL_OPTIONS);
+      if (this.contentNamespace) {
+        metadataLevel = metadataLevel.sublevel(
+          this.contentNamespace,
+          SUBLEVEL_OPTIONS
+        );
+      }
       return metadataLevel.put(`metadata_${key}`, { value });
     };
     this.get = async (filepath) => {
@@ -5090,7 +5629,15 @@ var Database = class {
       if (SYSTEM_FILES.includes(filepath)) {
         throw new Error(`Unexpected get for config file ${filepath}`);
       } else {
-        const contentObject = await this.level.sublevel(
+        let collection;
+        let level = this.contentLevel;
+        if (this.appLevel) {
+          collection = await this.collectionForPath(filepath);
+          if (collection?.isDetached) {
+            level = this.appLevel.sublevel(collection.name, SUBLEVEL_OPTIONS);
+          }
+        }
+        const contentObject = await level.sublevel(
           CONTENT_ROOT_PREFIX,
           SUBLEVEL_OPTIONS
         ).get(normalizePath(filepath));
@@ -5100,7 +5647,7 @@ var Database = class {
         return transformDocument(
           filepath,
           contentObject,
-          await this.getSchema(this.level)
+          await this.getSchema(this.contentLevel)
         );
       }
     };
@@ -5116,23 +5663,29 @@ var Database = class {
         dataFields,
         collection
       );
-      const indexDefinitions = await this.getIndexDefinitions(this.level);
+      const indexDefinitions = await this.getIndexDefinitions(this.contentLevel);
       const collectionIndexDefinitions = indexDefinitions?.[collection.name];
       const normalizedPath = normalizePath(filepath);
-      if (this.bridge) {
-        await this.bridge.put(normalizedPath, stringifiedFile);
+      if (!collection?.isDetached) {
+        if (this.bridge) {
+          await this.bridge.put(normalizedPath, stringifiedFile);
+        }
+        try {
+          await this.onPut(normalizedPath, stringifiedFile);
+        } catch (e) {
+          throw new GraphQLError5(
+            `Error running onPut hook for ${filepath}: ${e}`,
+            null,
+            null,
+            null,
+            null,
+            e
+          );
+        }
       }
-      try {
-        await this.onPut(normalizedPath, stringifiedFile);
-      } catch (e) {
-        throw new GraphQLError5(
-          `Error running onPut hook for ${filepath}: ${e}`,
-          null,
-          null,
-          null,
-          null,
-          e
-        );
+      let level = this.contentLevel;
+      if (collection?.isDetached) {
+        level = this.appLevel.sublevel(collection.name, SUBLEVEL_OPTIONS);
       }
       const folderTreeBuilder = new FolderTreeBuilder();
       const folderKey = folderTreeBuilder.update(filepath, collection.path || "");
@@ -5143,7 +5696,7 @@ var Database = class {
           collectionIndexDefinitions,
           dataFields,
           "put",
-          this.level
+          level
         ),
         ...makeIndexOpsForDocument(
           normalizedPath,
@@ -5151,10 +5704,10 @@ var Database = class {
           collectionIndexDefinitions,
           dataFields,
           "put",
-          this.level
+          level
         )
       ];
-      const existingItem = await this.level.sublevel(
+      const existingItem = await level.sublevel(
         CONTENT_ROOT_PREFIX,
         SUBLEVEL_OPTIONS
       ).get(normalizedPath);
@@ -5165,7 +5718,7 @@ var Database = class {
           collectionIndexDefinitions,
           existingItem,
           "del",
-          this.level
+          level
         ),
         ...makeIndexOpsForDocument(
           normalizedPath,
@@ -5173,7 +5726,7 @@ var Database = class {
           collectionIndexDefinitions,
           existingItem,
           "del",
-          this.level
+          level
         )
       ] : [];
       const ops = [
@@ -5183,13 +5736,13 @@ var Database = class {
           type: "put",
           key: normalizedPath,
           value: dataFields,
-          sublevel: this.level.sublevel(
+          sublevel: level.sublevel(
             CONTENT_ROOT_PREFIX,
             SUBLEVEL_OPTIONS
           )
         }
       ];
-      await this.level.batch(ops);
+      await level.batch(ops);
     };
     this.put = async (filepath, data, collectionName) => {
       await this.initLevel();
@@ -5199,7 +5752,9 @@ var Database = class {
         } else {
           let collectionIndexDefinitions;
           if (collectionName) {
-            const indexDefinitions = await this.getIndexDefinitions(this.level);
+            const indexDefinitions = await this.getIndexDefinitions(
+              this.contentLevel
+            );
             collectionIndexDefinitions = indexDefinitions?.[collectionName];
           }
           const normalizedPath = normalizePath(filepath);
@@ -5224,26 +5779,29 @@ var Database = class {
             dataFields,
             collection
           );
-          if (this.bridge) {
-            await this.bridge.put(normalizedPath, stringifiedFile);
-          }
-          try {
-            await this.onPut(normalizedPath, stringifiedFile);
-          } catch (e) {
-            throw new GraphQLError5(
-              `Error running onPut hook for ${filepath}: ${e}`,
-              null,
-              null,
-              null,
-              null,
-              e
-            );
+          if (!collection?.isDetached) {
+            if (this.bridge) {
+              await this.bridge.put(normalizedPath, stringifiedFile);
+            }
+            try {
+              await this.onPut(normalizedPath, stringifiedFile);
+            } catch (e) {
+              throw new GraphQLError5(
+                `Error running onPut hook for ${filepath}: ${e}`,
+                null,
+                null,
+                null,
+                null,
+                e
+              );
+            }
           }
           const folderTreeBuilder = new FolderTreeBuilder();
           const folderKey = folderTreeBuilder.update(
             filepath,
             collection.path || ""
           );
+          const level = collection?.isDetached ? this.appLevel.sublevel(collection?.name, SUBLEVEL_OPTIONS) : this.contentLevel;
           const putOps = [
             ...makeIndexOpsForDocument(
               normalizedPath,
@@ -5251,7 +5809,7 @@ var Database = class {
               collectionIndexDefinitions,
               dataFields,
               "put",
-              this.level
+              level
             ),
             ...makeIndexOpsForDocument(
               normalizedPath,
@@ -5259,10 +5817,10 @@ var Database = class {
               collectionIndexDefinitions,
               dataFields,
               "put",
-              this.level
+              level
             )
           ];
-          const existingItem = await this.level.sublevel(
+          const existingItem = await level.sublevel(
             CONTENT_ROOT_PREFIX,
             SUBLEVEL_OPTIONS
           ).get(normalizedPath);
@@ -5273,7 +5831,7 @@ var Database = class {
               collectionIndexDefinitions,
               existingItem,
               "del",
-              this.level
+              level
             ),
             ...makeIndexOpsForDocument(
               normalizedPath,
@@ -5281,7 +5839,7 @@ var Database = class {
               collectionIndexDefinitions,
               existingItem,
               "del",
-              this.level
+              level
             )
           ] : [];
           const ops = [
@@ -5291,13 +5849,13 @@ var Database = class {
               type: "put",
               key: normalizedPath,
               value: dataFields,
-              sublevel: this.level.sublevel(
+              sublevel: level.sublevel(
                 CONTENT_ROOT_PREFIX,
                 SUBLEVEL_OPTIONS
               )
             }
           ];
-          await this.level.batch(ops);
+          await level.batch(ops);
         }
         return true;
       } catch (error) {
@@ -5347,7 +5905,7 @@ var Database = class {
       const writeTemplateKey = templateDetails.info.type === "union";
       const aliasedData = applyNameOverrides(templateDetails.template, payload);
       const extension = path4.extname(filepath);
-      const stringifiedFile = stringifyFile(
+      return stringifyFile(
         aliasedData,
         extension,
         writeTemplateKey,
@@ -5356,7 +5914,6 @@ var Database = class {
           frontmatterDelimiters: collection?.frontmatterDelimiters
         }
       );
-      return stringifiedFile;
     };
     this.flush = async (filepath) => {
       const data = await this.get(filepath);
@@ -5365,12 +5922,7 @@ var Database = class {
       if (!collection) {
         throw new Error(`Unable to find collection for path ${filepath}`);
       }
-      const stringifiedFile = await this.stringifyFile(
-        filepath,
-        dataFields,
-        collection
-      );
-      return stringifiedFile;
+      return this.stringifyFile(filepath, dataFields, collection);
     };
     this.getLookup = async (returnType) => {
       await this.initLevel();
@@ -5378,11 +5930,10 @@ var Database = class {
         path4.join(this.getGeneratedFolder(), `_lookup.json`)
       );
       if (!this._lookup) {
-        const _lookup = await this.level.sublevel(
+        this._lookup = await this.contentLevel.sublevel(
           CONTENT_ROOT_PREFIX,
           SUBLEVEL_OPTIONS
         ).get(lookupPath);
-        this._lookup = _lookup;
       }
       return this._lookup[returnType];
     };
@@ -5391,7 +5942,7 @@ var Database = class {
       const graphqlPath = normalizePath(
         path4.join(this.getGeneratedFolder(), `_graphql.json`)
       );
-      return await this.level.sublevel(
+      return await this.contentLevel.sublevel(
         CONTENT_ROOT_PREFIX,
         SUBLEVEL_OPTIONS
       ).get(graphqlPath);
@@ -5411,7 +5962,7 @@ var Database = class {
       const schemaPath = normalizePath(
         path4.join(this.getGeneratedFolder(), `_schema.json`)
       );
-      return await (level || this.level).sublevel(
+      return await (level || this.contentLevel).sublevel(
         CONTENT_ROOT_PREFIX,
         SUBLEVEL_OPTIONS
       ).get(schemaPath);
@@ -5421,7 +5972,7 @@ var Database = class {
         return this.tinaSchema;
       }
       await this.initLevel();
-      const schema = existingSchema || await this.getTinaSchema(level || this.level);
+      const schema = existingSchema || await this.getTinaSchema(level || this.contentLevel);
       if (!schema) {
         throw new Error(
           `Unable to get schema from level db: ${normalizePath(
@@ -5437,7 +5988,7 @@ var Database = class {
         await new Promise(async (resolve2, reject) => {
           await this.initLevel();
           try {
-            const schema = await this.getSchema(level || this.level);
+            const schema = await this.getSchema(level || this.contentLevel);
             const collections = schema.getCollections();
             for (const collection of collections) {
               const indexDefinitions = {
@@ -5503,7 +6054,6 @@ var Database = class {
         last,
         before,
         sort = DEFAULT_COLLECTION_SORT_KEY,
-        collection,
         filterChain: rawFilterChain,
         folder
       } = queryOptions;
@@ -5519,22 +6069,25 @@ var Database = class {
       } else if (before) {
         query.lt = atob(before);
       }
-      const allIndexDefinitions = await this.getIndexDefinitions(this.level);
-      const indexDefinitions = allIndexDefinitions?.[queryOptions.collection];
+      const tinaSchema = await this.getSchema(this.contentLevel);
+      const collection = tinaSchema.getCollection(queryOptions.collection);
+      const allIndexDefinitions = await this.getIndexDefinitions(
+        this.contentLevel
+      );
+      const indexDefinitions = allIndexDefinitions?.[collection.name];
       if (!indexDefinitions) {
-        throw new Error(
-          `No indexDefinitions for collection ${queryOptions.collection}`
-        );
+        throw new Error(`No indexDefinitions for collection ${collection.name}`);
       }
       const filterChain = coerceFilterChainOperands(rawFilterChain);
       const indexDefinition = sort && indexDefinitions?.[sort];
       const filterSuffixes = indexDefinition && makeFilterSuffixes(filterChain, indexDefinition);
-      const rootLevel = this.level.sublevel(
+      const level = collection?.isDetached ? this.appLevel.sublevel(collection?.name, SUBLEVEL_OPTIONS) : this.contentLevel;
+      const rootLevel = level.sublevel(
         CONTENT_ROOT_PREFIX,
         SUBLEVEL_OPTIONS
       );
-      const sublevel = indexDefinition ? this.level.sublevel(
-        `${collection}${folder ? `_${folder === FOLDER_ROOT ? folder : sha2.hex(folder)}` : ""}`,
+      const sublevel = indexDefinition ? level.sublevel(
+        `${collection.name}${folder ? `_${folder === FOLDER_ROOT ? folder : sha2.hex(folder)}` : ""}`,
         SUBLEVEL_OPTIONS
       ).sublevel(sort, SUBLEVEL_OPTIONS) : rootLevel;
       if (!query.gt && !query.gte) {
@@ -5606,7 +6159,7 @@ var Database = class {
               throw new TinaQueryError({
                 originalError: error,
                 file: edge.path,
-                collection,
+                collection: collection.name,
                 stack: error.stack
               });
             } else {
@@ -5654,8 +6207,8 @@ var Database = class {
           }
           let nextVersion;
           if (!this.config.version) {
-            await this.level.clear();
-            nextLevel = this.level;
+            await this.contentLevel.clear();
+            nextLevel = this.contentLevel;
           } else {
             const version = await this.getDatabaseVersion();
             nextVersion = version ? `${parseInt(version) + 1}` : "0";
@@ -5685,10 +6238,10 @@ var Database = class {
         },
         async () => {
           if (this.config.version) {
-            if (this.level) {
-              await this.level.clear();
+            if (this.contentLevel) {
+              await this.contentLevel.clear();
             }
-            this.level = nextLevel;
+            this.contentLevel = nextLevel;
           }
         }
       );
@@ -5699,10 +6252,10 @@ var Database = class {
       const enqueueOps = async (ops) => {
         operations.push(...ops);
         while (operations.length >= 25) {
-          await this.level.batch(operations.splice(0, 25));
+          await this.contentLevel.batch(operations.splice(0, 25));
         }
       };
-      const tinaSchema = await this.getSchema(this.level);
+      const tinaSchema = await this.getSchema(this.contentLevel);
       await this.indexStatusCallbackWrapper(async () => {
         const { pathsByCollection, nonCollectionPaths, collections } = await partitionPathsByCollection(tinaSchema, documentPaths);
         for (const collection of Object.keys(pathsByCollection)) {
@@ -5718,7 +6271,7 @@ var Database = class {
         }
       });
       while (operations.length) {
-        await this.level.batch(operations.splice(0, 25));
+        await this.contentLevel.batch(operations.splice(0, 25));
       }
     };
     this.indexContentByPaths = async (documentPaths) => {
@@ -5727,31 +6280,29 @@ var Database = class {
       const enqueueOps = async (ops) => {
         operations.push(...ops);
         while (operations.length >= 25) {
-          await this.level.batch(operations.splice(0, 25));
+          await this.contentLevel.batch(operations.splice(0, 25));
         }
       };
-      const tinaSchema = await this.getSchema(this.level);
+      const tinaSchema = await this.getSchema(this.contentLevel);
       await this.indexStatusCallbackWrapper(async () => {
         await scanContentByPaths(
           tinaSchema,
           documentPaths,
           async (collection, documentPaths2) => {
-            if (collection) {
+            if (collection && !collection.isDetached) {
               await _indexContent(
                 this,
-                this.level,
+                this.contentLevel,
                 documentPaths2,
                 enqueueOps,
                 collection
               );
-            } else {
-              await _indexContent(this, this.level, documentPaths2, enqueueOps);
             }
           }
         );
       });
       while (operations.length) {
-        await this.level.batch(operations.splice(0, 25));
+        await this.contentLevel.batch(operations.splice(0, 25));
       }
     };
     this.delete = async (filepath) => {
@@ -5760,14 +6311,14 @@ var Database = class {
       if (!collection) {
         throw new Error(`No collection found for path: ${filepath}`);
       }
-      const indexDefinitions = await this.getIndexDefinitions(this.level);
+      const indexDefinitions = await this.getIndexDefinitions(this.contentLevel);
       const collectionIndexDefinitions = indexDefinitions?.[collection.name];
-      this.level.sublevel(
-        CONTENT_ROOT_PREFIX,
-        SUBLEVEL_OPTIONS
-      );
+      let level = this.contentLevel;
+      if (collection?.isDetached) {
+        level = this.appLevel.sublevel(collection?.name, SUBLEVEL_OPTIONS);
+      }
       const itemKey = normalizePath(filepath);
-      const rootSublevel = this.level.sublevel(
+      const rootSublevel = level.sublevel(
         CONTENT_ROOT_PREFIX,
         SUBLEVEL_OPTIONS
       );
@@ -5778,14 +6329,14 @@ var Database = class {
           filepath,
           collection.path || ""
         );
-        await this.level.batch([
+        await this.contentLevel.batch([
           ...makeIndexOpsForDocument(
             filepath,
             collection.name,
             collectionIndexDefinitions,
             item,
             "del",
-            this.level
+            level
           ),
           ...makeIndexOpsForDocument(
             filepath,
@@ -5793,7 +6344,7 @@ var Database = class {
             collectionIndexDefinitions,
             item,
             "del",
-            this.level
+            level
           ),
           {
             type: "del",
@@ -5802,20 +6353,22 @@ var Database = class {
           }
         ]);
       }
-      if (this.bridge) {
-        await this.bridge.delete(normalizePath(filepath));
-      }
-      try {
-        await this.onDelete(normalizePath(filepath));
-      } catch (e) {
-        throw new GraphQLError5(
-          `Error running onDelete hook for ${filepath}: ${e}`,
-          null,
-          null,
-          null,
-          null,
-          e
-        );
+      if (!collection?.isDetached) {
+        if (this.bridge) {
+          await this.bridge.delete(normalizePath(filepath));
+        }
+        try {
+          await this.onDelete(normalizePath(filepath));
+        } catch (e) {
+          throw new GraphQLError5(
+            `Error running onDelete hook for ${filepath}: ${e}`,
+            null,
+            null,
+            null,
+            null,
+            e
+          );
+        }
       }
     };
     this._indexAllContent = async (level, schema) => {
@@ -5832,7 +6385,29 @@ var Database = class {
         tinaSchema,
         this.bridge,
         async (collection, contentPaths) => {
-          await _indexContent(this, level, contentPaths, enqueueOps, collection);
+          const userFields = mapUserFields(collection, []);
+          if (collection.isDetached) {
+            const level2 = this.appLevel.sublevel(
+              collection.name,
+              SUBLEVEL_OPTIONS
+            );
+            const doc = await level2.keys({ limit: 1 }).next();
+            if (!doc) {
+              await _indexContent(
+                this,
+                level2,
+                contentPaths,
+                enqueueOps,
+                collection,
+                userFields.map((field) => [
+                  ...field.path,
+                  field.passwordFieldName
+                ])
+              );
+            }
+          } else {
+            await _indexContent(this, level, contentPaths, enqueueOps, collection);
+          }
         }
       );
       while (operations.length) {
@@ -5846,22 +6421,36 @@ var Database = class {
     this.indexStatusCallback = config.indexStatusCallback || defaultStatusCallback;
     this.onPut = config.onPut || defaultOnPut;
     this.onDelete = config.onDelete || defaultOnDelete;
+    this.contentNamespace = config.namespace;
   }
   async updateDatabaseVersion(version) {
-    const metadataLevel = this.rootLevel.sublevel("_metadata", SUBLEVEL_OPTIONS);
+    let metadataLevel = this.rootLevel.sublevel("_metadata", SUBLEVEL_OPTIONS);
+    if (this.contentNamespace) {
+      metadataLevel = metadataLevel.sublevel(
+        this.contentNamespace,
+        SUBLEVEL_OPTIONS
+      );
+    }
     await metadataLevel.put("metadata", { version });
   }
   async getDatabaseVersion() {
-    const metadataLevel = this.rootLevel.sublevel("_metadata", SUBLEVEL_OPTIONS);
+    let metadataLevel = this.rootLevel.sublevel("_metadata", SUBLEVEL_OPTIONS);
+    if (this.contentNamespace) {
+      metadataLevel = metadataLevel.sublevel(
+        this.contentNamespace,
+        SUBLEVEL_OPTIONS
+      );
+    }
     const metadata = await metadataLevel.get("metadata");
     return metadata?.version;
   }
   async initLevel() {
-    if (this.level) {
+    if (this.contentLevel) {
       return;
     }
+    this.appLevel = this.rootLevel.sublevel("_appData", SUBLEVEL_OPTIONS);
     if (!this.config.version) {
-      this.level = this.rootLevel;
+      this.contentLevel = this.contentNamespace ? this.rootLevel.sublevel("_content", SUBLEVEL_OPTIONS).sublevel(this.contentNamespace, SUBLEVEL_OPTIONS) : this.rootLevel.sublevel("_content", SUBLEVEL_OPTIONS);
     } else {
       let version = await this.getDatabaseVersion();
       if (!version) {
@@ -5871,9 +6460,9 @@ var Database = class {
         } catch (e) {
         }
       }
-      this.level = this.rootLevel.sublevel(version, SUBLEVEL_OPTIONS);
+      this.contentLevel = this.contentNamespace ? this.rootLevel.sublevel("_content").sublevel(this.contentNamespace, SUBLEVEL_OPTIONS).sublevel(version, SUBLEVEL_OPTIONS) : this.rootLevel.sublevel(version, SUBLEVEL_OPTIONS);
     }
-    if (!this.level) {
+    if (!this.contentLevel) {
       throw new GraphQLError5("Error initializing LevelDB instance");
     }
   }
@@ -5922,7 +6511,36 @@ var Database = class {
     }
   }
 };
-var _indexContent = async (database, level, documentPaths, enqueueOps, collection) => {
+var hashPasswordVisitor = async (node, path7) => {
+  const passwordValuePath = [...path7, "value"];
+  const plaintextPassword = _5.get(node, passwordValuePath);
+  if (plaintextPassword) {
+    _5.set(
+      node,
+      passwordValuePath,
+      await generatePasswordHash({ password: plaintextPassword })
+    );
+  }
+};
+var visitNodes = async (node, path7, callback) => {
+  const [currentLevel, ...remainingLevels] = path7;
+  if (!remainingLevels?.length) {
+    return callback(node, path7);
+  }
+  if (Array.isArray(node[currentLevel])) {
+    for (const item of node[currentLevel]) {
+      await visitNodes(item, remainingLevels, callback);
+    }
+  } else {
+    await visitNodes(node[currentLevel], remainingLevels, callback);
+  }
+};
+var hashPasswordValues = async (data, passwordFields) => Promise.all(
+  passwordFields.map(
+    async (passwordField) => visitNodes(data, passwordField, hashPasswordVisitor)
+  )
+);
+var _indexContent = async (database, level, documentPaths, enqueueOps, collection, passwordFields) => {
   let collectionIndexDefinitions;
   let collectionPath;
   if (collection) {
@@ -5950,6 +6568,9 @@ var _indexContent = async (database, level, documentPaths, enqueueOps, collectio
       if (!aliasedData) {
         return;
       }
+      if (passwordFields?.length) {
+        await hashPasswordValues(aliasedData, passwordFields);
+      }
       const normalizedPath = normalizePath(filepath);
       const folderKey = folderTreeBuilder.update(
         normalizedPath,
@@ -6009,7 +6630,9 @@ var _deleteIndexContent = async (database, documentPaths, enqueueOps, collection
   }
   let collectionIndexDefinitions;
   if (collection) {
-    const indexDefinitions = await database.getIndexDefinitions(database.level);
+    const indexDefinitions = await database.getIndexDefinitions(
+      database.contentLevel
+    );
     collectionIndexDefinitions = indexDefinitions?.[collection.name];
     if (!collectionIndexDefinitions) {
       throw new Error(`No indexDefinitions for collection ${collection.name}`);
@@ -6018,9 +6641,9 @@ var _deleteIndexContent = async (database, documentPaths, enqueueOps, collection
   const tinaSchema = await database.getSchema();
   let templateInfo = null;
   if (collection) {
-    templateInfo = await tinaSchema.getTemplatesForCollectable(collection);
+    templateInfo = tinaSchema.getTemplatesForCollectable(collection);
   }
-  const rootLevel = database.level.sublevel(
+  const rootLevel = database.contentLevel.sublevel(
     CONTENT_ROOT_PREFIX,
     SUBLEVEL_OPTIONS
   );
@@ -6044,7 +6667,7 @@ var _deleteIndexContent = async (database, documentPaths, enqueueOps, collection
           collectionIndexDefinitions,
           aliasedData,
           "del",
-          database.level
+          database.contentLevel
         ),
         ...makeIndexOpsForDocument(
           itemKey,
@@ -6052,7 +6675,7 @@ var _deleteIndexContent = async (database, documentPaths, enqueueOps, collection
           collectionIndexDefinitions,
           aliasedData,
           "del",
-          database.level
+          database.contentLevel
         ),
         { type: "del", key: itemKey, sublevel: rootLevel }
       ]);
@@ -6065,33 +6688,12 @@ var _deleteIndexContent = async (database, documentPaths, enqueueOps, collection
         collection,
         collectionIndexDefinitions,
         "del",
-        database.level
+        database.contentLevel
       )
     );
   }
 };
 
-// src/level/tinaLevel.ts
-import { ManyLevelGuest } from "many-level";
-import { pipeline } from "readable-stream";
-import { connect } from "net";
-var TinaLevelClient = class extends ManyLevelGuest {
-  constructor(port) {
-    super();
-    this._connected = false;
-    this.port = port || 9e3;
-  }
-  openConnection() {
-    if (this._connected)
-      return;
-    const socket = connect(this.port);
-    pipeline(socket, this.createRpcStream(), socket, () => {
-      this._connected = false;
-    });
-    this._connected = true;
-  }
-};
-
 // src/git/index.ts
 import git from "isomorphic-git";
 import fs from "fs-extra";
@@ -6627,6 +7229,7 @@ var buildSchema = async (config, flags) => {
 };
 export {
   AuditFileSystemBridge,
+  Database,
   FilesystemBridge,
   IsomorphicBridge,
   TinaFetchError,
@@ -6637,12 +7240,17 @@ export {
   assertShape,
   buildDotTinaFiles,
   buildSchema,
+  checkPasswordHash,
   createDatabase,
+  createDatabaseInternal,
+  createLocalDatabase,
   createSchema,
+  generatePasswordHash,
   getChangedFiles,
   getSha,
   handleFetchErrorError,
   loadAndParseWithAliases,
+  mapUserFields,
   parseFile,
   resolve,
   scanAllContent,