payload 4.0.0-internal.fa345ef → 4.0.0-internal.fec2230

package/dist/config/types.d.ts

@@ -1,4 +1,5 @@
 import type { ClientTranslationKeys, DefaultTranslationsObject, I18n, I18nClient, I18nOptions, TFunction } from '@payloadcms/translations';
+import type { StandardJSONSchemaV1, StandardSchemaV1 } from '@standard-schema/spec';
 import type { BusboyConfig } from 'busboy';
 import type GraphQL from 'graphql';
 import type { GraphQLFormattedError } from 'graphql';
@@ -7,23 +8,22 @@ import type { Metadata } from 'next';
 import type { DestinationStream, Level, LoggerOptions } from 'pino';
 import type React from 'react';
 import type { default as sharp } from 'sharp';
-import type { DeepRequired } from 'ts-essentials';
 import type { ComponentRenderer } from '../admin/adapters/render.js';
 import type { ServerAdapter } from '../admin/adapters/server.js';
 import type { RichTextAdapterProvider } from '../admin/RichText.js';
 import type { CustomStatus, DocumentSubViewTypes, DocumentTabConfig, DocumentViewServerProps, PublishButtonClientProps, PublishButtonServerProps, RichTextAdapter, UnpublishButtonClientProps, UnpublishButtonServerProps } from '../admin/types.js';
 import type { AdminViewConfig, ViewTypes, VisibleEntities } from '../admin/views/index.js';
 import type { SanitizedPermissions } from '../auth/index.js';
-import type { AddToImportMap, ImportMap, Imports, InternalImportMap } from '../bin/generateImportMap/index.js';
-import type { Collection, CollectionConfig, SanitizedCollectionConfig } from '../collections/config/types.js';
+import type { AddToImportMap, ImportMap, Imports, InternalImportMap } from '../cli/commands/generateImportMap/generateImportMap.js';
+import type { Collection, CollectionAccess, CollectionConfig, SanitizedCollectionConfig } from '../collections/config/types.js';
 import type { DatabaseAdapterResult } from '../database/types.js';
 import type { EmailAdapter, SendEmailOptions } from '../email/types.js';
 import type { ErrorName } from '../errors/types.js';
-import type { GlobalConfig, Globals, SanitizedGlobalConfig } from '../globals/config/types.js';
+import type { GlobalAccess, GlobalConfig, Globals, SanitizedGlobalConfig } from '../globals/config/types.js';
 import type { Block, ClientField, DataFromWidgetSlug, DefaultDocumentIDType, Field, FlattenedBlock, JobsConfig, KVAdapterResult, Payload, RegisteredPlugins, RequestContext, SelectField, TypedWidget, User, WidgetSlug } from '../index.js';
 import type { QueryPreset, QueryPresetConstraints } from '../query-presets/types.js';
 import type { SanitizedJobsConfig } from '../queues/config/types/index.js';
-import type { PayloadRequest, Where } from '../types/index.js';
+import type { MaybePromise, PayloadRequest, Where } from '../types/index.js';
 import type { PayloadLogger } from '../utilities/logger.js';
 /**
  * The string path pointing to the React component. If one of the generics is `never`, you effectively mark it as a server-only or client-only component.
@@ -48,18 +48,81 @@ export type ResolvedComponent<TComponentServerProps extends never | object, TCom
     Component: React.FC<TComponentClientProps | TComponentServerProps>;
     serverProps?: TComponentServerProps;
 };
-export type BinScriptConfig = {
-    key: string;
-    scriptPath: string;
+/** Shared resources used while the Payload CLI is running. */
+export type CLIRuntime = {
+    /** Directory containing the Payload config, used to resolve relative command paths. */
+    configDir: string;
+    destroy: () => Promise<void>;
+    getConfig: () => Promise<SanitizedConfig>;
+    getPayload: (options?: Omit<InitOptions, 'config'>) => Promise<Payload>;
+    readonly isScheduled: boolean;
+    markScheduled: () => void;
 };
-export type BinScript = (config: SanitizedConfig) => Promise<void> | void;
+export type CLICommandDescription = {
+    aliases?: string[];
+    description: string;
+    examples?: string[];
+    inputSchema: Record<string, unknown>;
+    name: string;
+};
+export type CLIGlobalOptionDescription = {
+    description: string;
+    flags: string;
+};
+export type CLIHelp = {
+    commands: CLICommandDescription[];
+    globalOptions: CLIGlobalOptionDescription[];
+    output: (args?: {
+        command?: string;
+    }) => void;
+};
+export type CLIInputSchema<Input extends Record<string, unknown> = Record<string, unknown>, Output extends Record<string, unknown> = Input> = StandardJSONSchemaV1<Input, Output> & StandardSchemaV1<Input, Output>;
+export type CLIFieldOverride = 'argument' | {
+    flags?: string;
+    parse?: (value: string, previous: unknown) => unknown;
+    type?: 'option';
+} | {
+    parse?: (value: string, previous: unknown) => unknown;
+    position?: number;
+    syntax?: string;
+    type: 'argument';
+} | false;
+/** A schema-backed command definition created with `defineCLICommand`. */
+export type CLICommand = {
+    aliases?: string[];
+    allowUnknownOption: boolean;
+    cli: false | Partial<Record<string, CLIFieldOverride>>;
+    description: string;
+    examples?: string[];
+    handler: (context: {
+        args: Record<string, unknown>;
+        getConfig: CLIRuntime['getConfig'];
+        getPayload: CLIRuntime['getPayload'];
+        help: CLIHelp;
+        isJSON: boolean;
+    }) => MaybePromise<CLICommandResult | number | void>;
+    helpGroup?: string;
+    input: CLIInputSchema;
+    readonly schema: Record<string, unknown>;
+};
+/** Structured data and an optional exit code returned by a Payload CLI command. */
+export type CLICommandResult = {
+    /** Process exit code. Omit this, or use `0`, when the command succeeds. */
+    exitCode?: number;
+    /** Data included under `result` when the command uses JSON output. */
+    result?: unknown;
+};
+/** A CLI command definition, import reference, or `false` to disable the command. */
+export type CLICommandEntry = CLICommand | PayloadComponent;
+/** CLI commands keyed by their command-line name. */
+export type CLICommands = Record<string, CLICommandEntry>;
 type Prettify<T> = {
     [K in keyof T]: T[K];
 } & NonNullable<unknown>;
 /**
  * @experimental The plugin API (`order`, `slug`, `options`) may change before being declared stable.
  */
-export type Plugin = ((config: Config) => Config | Promise<Config>) & {
+export type Plugin = ((config: Config) => MaybePromise<Config>) & {
     /** @experimental Plugin options exposed for cross-plugin mutation. */
     options?: Record<string, unknown>;
     /** @experimental Execution order - lower values run first. Defaults to 0. */
@@ -168,14 +231,6 @@ export type OGImageConfig = {
     url: string;
     width?: number | string;
 };
-/**
- * @todo find a way to remove the deep clone here.
- * It can probably be removed after the `DeepRequired` from `Config` to `SanitizedConfig` is removed.
- * Same with `CollectionConfig` to `SanitizedCollectionConfig`.
- */
-type DeepClone<T> = T extends object ? {
-    [K in keyof T]: DeepClone<T[K]>;
-} : T;
 export type MetaConfig = {
     /**
      * When `static`, a pre-made image will be used for all pages.
@@ -189,7 +244,7 @@ export type MetaConfig = {
      * @example `" - Custom CMS"`
      */
     titleSuffix?: string;
-} & DeepClone<Metadata>;
+} & Metadata;
 export type ServerOnlyLivePreviewProperties = keyof Pick<RootLivePreviewConfig, 'url'>;
 type GeneratePreviewURLOptions = {
     locale: string;
@@ -277,6 +332,8 @@ export type AccessArgs<TData = any> = {
     isReadingStaticFile?: boolean;
     /** The original request that requires an access check */
     req: PayloadRequest;
+    /** The slug of the Collection or Global document being accessed */
+    slug: string;
 };
 /**
  * Access function runs on the server
@@ -285,6 +342,10 @@ export type AccessArgs<TData = any> = {
  * @see https://payloadcms.com/docs/access-control/overview
  */
 export type Access<TData = any> = (args: AccessArgs<TData>) => AccessResult | Promise<AccessResult>;
+export type BaseAccess = {
+    collections?: CollectionAccess;
+    globals?: GlobalAccess;
+};
 /** Web Request/Response model, but the req has more payload specific properties added to it. */
 export type PayloadHandler = (req: PayloadRequest) => Promise<Response> | Response;
 /**
@@ -479,7 +540,7 @@ export type SanitizedLocalizationConfig = Prettify<{
      * @example `["en", "es", "fr", "nl", "de", "jp"]`
      */
     localeCodes: string[];
-} & LocalizationConfigWithLabels>;
+} & Omit<LocalizationConfigWithLabels, 'fallback'> & Required<Pick<LocalizationConfigWithLabels, 'fallback'>>>;
 /**
  * @see https://payloadcms.com/docs/configuration/localization#localization
  */
@@ -710,283 +771,409 @@ export type SidebarTab = {
     /** Unique identifier for override/disable */
     slug: string;
 };
-/**
- * This is the central configuration
- *
- * @see https://payloadcms.com/docs/configuration/overview
- */
-export type Config = {
-    /** Configure admin dashboard */
-    admin?: {
-        /** Automatically log in as a user */
-        autoLogin?: {
-            /**
-             * The email address of the user to login as
-             */
-            email?: string;
-            /** The password of the user to login as. This is only needed if `prefillOnly` is set to true */
-            password?: string;
-            /**
-             * If set to true, the login credentials will be prefilled but the user will still need to click the login button.
-             *
-             * @default false
-             */
-            prefillOnly?: boolean;
-            /** The username of the user to login as */
-            username?: string;
-        } | false;
+type RootAdminConfig = {
+    /** Automatically log in as a user */
+    autoLogin?: {
         /**
-         * Automatically refresh user tokens for users logged into the dashboard
+         * The email address of the user to login as
+         */
+        email?: string;
+        /** The password of the user to login as. This is only needed if `prefillOnly` is set to true */
+        password?: string;
+        /**
+         * If set to true, the login credentials will be prefilled but the user will still need to click the login button.
          *
          * @default false
          */
-        autoRefresh?: boolean;
-        /** Set account profile picture. Options: gravatar, default or a custom React component. */
-        avatar?: 'default' | 'gravatar' | {
-            Component: PayloadComponent;
+        prefillOnly?: boolean;
+        /** The username of the user to login as */
+        username?: string;
+    } | false;
+    /**
+     * Automatically refresh user tokens for users logged into the dashboard
+     *
+     * @default false
+     */
+    autoRefresh?: boolean;
+    /** Set account profile picture. Options: gravatar, default or a custom React component. */
+    avatar?: 'default' | 'gravatar' | {
+        Component: PayloadComponent;
+    };
+    /**
+     * Add extra and/or replace built-in components with custom components
+     *
+     * @see https://payloadcms.com/docs/custom-components/overview
+     */
+    components?: {
+        /**
+         * Add custom components to the top right of the Admin Panel
+         */
+        actions?: CustomComponent[];
+        /**
+         * Add custom components after the collection overview
+         */
+        afterDashboard?: CustomComponent[];
+        /**
+         * Add custom components after the email/password field
+         */
+        afterLogin?: CustomComponent[];
+        /**
+         * Add custom components after the navigation section
+         */
+        afterNav?: CustomComponent[];
+        /**
+         * Add custom components after the navigation links
+         */
+        afterNavLinks?: CustomComponent[];
+        /**
+         * Add custom components before the collection overview
+         */
+        beforeDashboard?: CustomComponent[];
+        /**
+         * Add custom components before the email/password field
+         */
+        beforeLogin?: CustomComponent[];
+        /**
+         * Add custom components before the navigation section
+         */
+        beforeNav?: CustomComponent[];
+        /**
+         * Add custom components before the navigation links
+         */
+        beforeNavLinks?: CustomComponent[];
+        /** Replace graphical components */
+        graphics?: {
+            /** Replace the icon in the navigation */
+            Icon?: CustomComponent;
+            /** Replace the logo on the login page */
+            Logo?: CustomComponent;
         };
         /**
-         * Add extra and/or replace built-in components with custom components
-         *
-         * @see https://payloadcms.com/docs/custom-components/overview
+         * Add custom header to top of page globally
          */
-        components?: {
-            /**
-             * Add custom components to the top right of the Admin Panel
-             */
-            actions?: CustomComponent[];
-            /**
-             * Add custom components after the collection overview
-             */
-            afterDashboard?: CustomComponent[];
-            /**
-             * Add custom components after the email/password field
-             */
-            afterLogin?: CustomComponent[];
-            /**
-             * Add custom components after the navigation section
-             */
-            afterNav?: CustomComponent[];
-            /**
-             * Add custom components after the navigation links
-             */
-            afterNavLinks?: CustomComponent[];
-            /**
-             * Add custom components before the collection overview
-             */
-            beforeDashboard?: CustomComponent[];
-            /**
-             * Add custom components before the email/password field
-             */
-            beforeLogin?: CustomComponent[];
-            /**
-             * Add custom components before the navigation section
-             */
-            beforeNav?: CustomComponent[];
-            /**
-             * Add custom components before the navigation links
-             */
-            beforeNavLinks?: CustomComponent[];
-            /** Replace graphical components */
-            graphics?: {
-                /** Replace the icon in the navigation */
-                Icon?: CustomComponent;
-                /** Replace the logo on the login page */
-                Logo?: CustomComponent;
-            };
-            /**
-             * Add custom header to top of page globally
-             */
-            header?: CustomComponent[];
-            /** Replace logout related components */
-            logout?: {
-                /** Replace the logout button  */
-                Button?: CustomComponent;
-            };
-            /**
-             * Replace the navigation with a custom component
-             */
-            Nav?: CustomComponent;
-            /**
-             * Wrap the admin dashboard in custom context providers
-             */
-            providers?: PayloadComponent<{
-                children?: React.ReactNode;
-            }, {
-                children?: React.ReactNode;
-            }>[];
-            /**
-             * Add custom menu items to the navigation menu accessible via the gear icon.
-             * These components will be rendered in a popup menu above the logout button.
-             */
-            settingsMenu?: CustomComponent[];
-            /** Sidebar configuration */
-            sidebar?: {
-                /** Extensible tab system */
-                tabs?: SidebarTab[];
-            };
-            /**
-             * Add custom items to the user menu popup in the admin panel header.
-             * These components will be rendered in the Settings sub-popup of the user menu.
-             * When empty or absent, the Settings sub-trigger is not shown.
-             */
-            userMenuSettingsItems?: UserMenuSettingsItem[];
-            /**
-             * Replace or modify top-level admin routes, or add new ones:
-             * + `Account` - `/admin/account`
-             * + `Dashboard` - `/admin`
-             * + `:path` - `/admin/:path`
-             */
-            views?: {
-                /** Add custom admin views */
-                [key: string]: AdminViewConfig;
-                /** Replace the account screen */
-                account?: AdminViewConfig;
-                /** Replace the admin homepage */
-                dashboard?: AdminViewConfig;
-            };
+        header?: CustomComponent[];
+        /** Replace logout related components */
+        logout?: {
+            /** Replace the logout button  */
+            Button?: CustomComponent;
         };
-        /** Extension point to add your custom data. Available in server and client. */
-        custom?: Record<string, any>;
         /**
-         * Customize the dashboard widgets
-         * @experimental This prop is subject to change in future releases.
+         * Replace the navigation with a custom component
          */
-        dashboard?: DashboardConfig;
-        /** Global date format that will be used for all dates in the Admin panel. Any valid date-fns format pattern can be used. */
-        dateFormat?: string;
+        Nav?: CustomComponent;
         /**
-         * Each entry in this map generates an entry in the importMap.
+         * Wrap the admin dashboard in custom context providers
          */
-        dependencies?: AdminDependencies;
+        providers?: PayloadComponent<{
+            children?: React.ReactNode;
+        }, {
+            children?: React.ReactNode;
+        }>[];
         /**
-         * @deprecated
-         * This option is deprecated and will be removed in v4.
-         * To disable the admin panel itself, delete your `/app/(payload)/admin` directory.
-         * To disable all REST API and GraphQL endpoints, delete your `/app/(payload)/api` directory.
-         * Note: If you've modified the default paths via `admin.routes`, delete those directories instead.
+         * Add custom menu items to the navigation menu accessible via the gear icon.
+         * These components will be rendered in a popup menu above the logout button.
          */
-        disable?: boolean;
-        importMap?: {
-            /**
-             * Automatically generate component map during development
-             * @default true
-             */
-            autoGenerate?: boolean;
-            /**
-             * The base directory for component paths starting with /.
-             * @default process.cwd()
-             **/
-            baseDir?: string;
-            /**
-             * You can use generators to add custom components to the component import map.
-             * This allows you to import custom components in the admin panel.
-             */
-            generators?: ImportMapGenerators;
-            /**
-             * If Payload cannot find the import map file location automatically,
-             * you can manually provide it here.
-             */
-            importMapFile?: string;
+        settingsMenu?: CustomComponent[];
+        /** Sidebar configuration */
+        sidebar?: {
+            /** Extensible tab system */
+            tabs?: SidebarTab[];
         };
         /**
-         * Live Preview options.
-         *
-         * @see https://payloadcms.com/docs/live-preview/overview
+         * Add custom items to the user menu popup in the admin panel header.
+         * These components will be rendered in the Settings sub-popup of the user menu.
+         * When empty or absent, the Settings sub-trigger is not shown.
+         */
+        userMenuSettingsItems?: UserMenuSettingsItem[];
+        /**
+         * Replace or modify top-level admin routes, or add new ones:
+         * + `Account` - `/admin/account`
+         * + `Dashboard` - `/admin`
+         * + `:path` - `/admin/:path`
          */
-        livePreview?: RootLivePreviewConfig;
-        /** Base meta data to use for the Admin Panel. Included properties are titleSuffix, ogImage, and favicon. */
-        meta?: MetaConfig;
-        routes?: {
-            /** The route for the account page.
-             *
-             * @default '/account'
-             */
-            account?: `/${string}`;
-            /** The route for the create first user page.
-             *
-             * @default '/create-first-user'
-             */
-            createFirstUser?: `/${string}`;
-            /** The route for the forgot password page.
-             *
-             * @default '/forgot'
-             */
-            forgot?: `/${string}`;
-            /** The route the user will be redirected to after being inactive for too long.
-             *
-             * @default '/logout-inactivity'
-             */
-            inactivity?: `/${string}`;
-            /** The route for the login page.
-             *
-             * @default '/login'
-             */
-            login?: `/${string}`;
-            /** The route for the logout page.
-             *
-             * @default '/logout'
-             */
-            logout?: `/${string}`;
-            /** The route for the reset password page.
-             *
-             * @default '/reset'
-             */
-            reset?: `/${string}`;
-            /** The route for the unauthorized page.
-             *
-             * @default '/unauthorized'
-             */
-            unauthorized?: `/${string}`;
+        views?: {
+            /** Add custom admin views */
+            [key: string]: AdminViewConfig;
+            /** Replace the account screen */
+            account?: AdminViewConfig;
+            /** Replace the admin homepage */
+            dashboard?: AdminViewConfig;
         };
+    };
+    /** Extension point to add your custom data. Available in server and client. */
+    custom?: Record<string, any>;
+    /**
+     * Customize the dashboard widgets
+     * @experimental This prop is subject to change in future releases.
+     */
+    dashboard?: DashboardConfig;
+    /** Global date format that will be used for all dates in the Admin panel. Any valid date-fns format pattern can be used. */
+    dateFormat?: string;
+    /**
+     * Each entry in this map generates an entry in the importMap.
+     */
+    dependencies?: AdminDependencies;
+    /**
+     * @deprecated
+     * This option is deprecated and will be removed in v4.
+     * To disable the admin panel itself, delete your `/app/(payload)/admin` directory.
+     * To disable all REST API and GraphQL endpoints, delete your `/app/(payload)/api` directory.
+     * Note: If you've modified the default paths via `admin.routes`, delete those directories instead.
+     */
+    disable?: boolean;
+    importMap?: {
         /**
-         * Suppresses React hydration mismatch warnings during the hydration of the root <html> tag.
-         * Useful in scenarios where the server-rendered HTML might intentionally differ from the client-rendered DOM.
-         * @default false
+         * Automatically generate component map during development
+         * @default true
          */
-        suppressHydrationWarning?: boolean;
+        autoGenerate?: boolean;
         /**
-         * Restrict the Admin Panel theme to use only one of your choice
+         * The base directory for component paths starting with /.
+         * @default process.cwd()
+         **/
+        baseDir?: string;
+        /**
+         * You can use generators to add custom components to the component import map.
+         * This allows you to import custom components in the admin panel.
+         */
+        generators?: ImportMapGenerators;
+        /**
+         * If Payload cannot find the import map file location automatically,
+         * you can manually provide it here.
+         */
+        importMapFile?: string;
+    };
+    /**
+     * Live Preview options.
+     *
+     * @see https://payloadcms.com/docs/live-preview/overview
+     */
+    livePreview?: RootLivePreviewConfig;
+    /** Base meta data to use for the Admin Panel. Included properties are titleSuffix, ogImage, and favicon. */
+    meta?: MetaConfig;
+    routes?: {
+        /** The route for the account page.
+         *
+         * @default '/account'
+         */
+        account?: `/${string}`;
+        /** The route for the create first user page.
+         *
+         * @default '/create-first-user'
+         */
+        createFirstUser?: `/${string}`;
+        /** The route for the forgot password page.
+         *
+         * @default '/forgot'
+         */
+        forgot?: `/${string}`;
+        /** The route the user will be redirected to after being inactive for too long.
+         *
+         * @default '/logout-inactivity'
+         */
+        inactivity?: `/${string}`;
+        /** The route for the login page.
          *
-         * @default 'all' // The theme can be configured by users
+         * @default '/login'
+         */
+        login?: `/${string}`;
+        /** The route for the logout page.
+         *
+         * @default '/logout'
+         */
+        logout?: `/${string}`;
+        /** The route for the reset password page.
+         *
+         * @default '/reset'
+         */
+        reset?: `/${string}`;
+        /** The route for the unauthorized page.
+         *
+         * @default '/unauthorized'
+         */
+        unauthorized?: `/${string}`;
+    };
+    /**
+     * Suppresses React hydration mismatch warnings during the hydration of the root <html> tag.
+     * Useful in scenarios where the server-rendered HTML might intentionally differ from the client-rendered DOM.
+     * @default false
+     */
+    suppressHydrationWarning?: boolean;
+    /**
+     * Restrict the Admin Panel theme to use only one of your choice
+     *
+     * @default 'all' // The theme can be configured by users
+     */
+    theme?: 'all' | 'dark' | 'light';
+    /**
+     * Configure timezone related settings for the admin panel.
+     */
+    timezones?: TimezonesConfig;
+    /**
+     * Configure toast message behavior and appearance in the admin panel.
+     * Currently using [Sonner](https://sonner.emilkowal.ski) for toast notifications.
+     *
+     * @experimental This property is experimental and may change in future releases. Use at your own risk.
+     */
+    toast?: {
+        /**
+         * Time in milliseconds until the toast automatically closes.
+         * @default 4000
+         */
+        duration?: number;
+        /**
+         * If `true`, will expand the message stack so that all messages are shown simultaneously without user interaction.
+         * Otherwise only the latest notification can be read until the user hovers the stack.
+         * @default false
+         */
+        expand?: boolean;
+        /**
+         * The maximum number of toasts that can be visible on the screen at once.
+         * @default 5
          */
-        theme?: 'all' | 'dark' | 'light';
+        limit?: number;
         /**
-         * Configure timezone related settings for the admin panel.
+         * The position of the toast on the screen.
+         * @default 'bottom-right'
          */
-        timezones?: TimezonesConfig;
+        position?: 'bottom-center' | 'bottom-left' | 'bottom-right' | 'top-center' | 'top-left' | 'top-right';
+    };
+    /** The slug of a Collection that you want to be used to log in to the Admin dashboard. */
+    user?: string;
+};
+type RootGraphQLConfig = {
+    disable?: boolean;
+    /**
+     * Disable introspection queries in production.
+     *
+     * @default true
+     */
+    disableIntrospectionInProduction?: boolean;
+    /**
+     * Disable the GraphQL Playground in production.
+     *
+     * @default true
+     */
+    disablePlaygroundInProduction?: boolean;
+    maxComplexity?: number;
+    /**
+     * Function that returns an object containing keys to custom GraphQL mutations
+     *
+     * @see https://payloadcms.com/docs/graphql/extending
+     */
+    mutations?: GraphQLExtension;
+    /**
+     * Function that returns an object containing keys to custom GraphQL queries
+     *
+     * @see https://payloadcms.com/docs/graphql/extending
+     */
+    queries?: GraphQLExtension;
+    /**
+     * Filepath to write the generated schema to
+     */
+    schemaOutputFile?: string;
+    /**
+     * Function that returns an array of validation rules to apply to the GraphQL schema
+     *
+     * @see https://payloadcms.com/docs/graphql/overview#custom-validation-rules
+     */
+    validationRules?: (args: GraphQL.ExecutionArgs) => GraphQL.ValidationRule[];
+};
+type RootTypeScriptConfig = {
+    /**
+     * Automatically generate types during development
+     * @default true
+     */
+    autoGenerate?: boolean;
+    /** Disable declare block in generated types file */
+    declare?: {
         /**
-         * Configure toast message behavior and appearance in the admin panel.
-         * Currently using [Sonner](https://sonner.emilkowal.ski) for toast notifications.
+         * @internal internal use only to allow for multiple declarations within a monorepo and suppress the "Duplicate identifier GeneratedTypes" error
+         *
+         * Adds a @ts-ignore flag above the GeneratedTypes interface declaration
          *
-         * @experimental This property is experimental and may change in future releases. Use at your own risk.
+         * @default false
          */
-        toast?: {
-            /**
-             * Time in milliseconds until the toast automatically closes.
-             * @default 4000
-             */
-            duration?: number;
-            /**
-             * If `true`, will expand the message stack so that all messages are shown simultaneously without user interaction.
-             * Otherwise only the latest notification can be read until the user hovers the stack.
-             * @default false
-             */
-            expand?: boolean;
-            /**
-             * The maximum number of toasts that can be visible on the screen at once.
-             * @default 5
-             */
-            limit?: number;
-            /**
-             * The position of the toast on the screen.
-             * @default 'bottom-right'
-             */
-            position?: 'bottom-center' | 'bottom-left' | 'bottom-right' | 'top-center' | 'top-left' | 'top-right';
+        ignoreTSError?: boolean;
+    } | false;
+    /**
+     * Also generate a write-shaped input type (e.g. `PostInput`) next to each read type, describing
+     * what `create`/`update` accept: relationships and uploads as IDs only, `id` and `defaultValue`
+     * fields optional, and `createdAt`/`updatedAt`/virtual/join fields removed. These are
+     * exposed on `Config['collectionsInput']` and `Config['globalsInput']`. Set `true` to turn them on.
+     * Draft-enabled entities retain `_status` because it is a writable create/update field.
+     *
+     * @default false
+     *
+     * @remarks
+     * Off by default. The Local API's `create`/`update` still type their `data` against the read
+     * type, so these input types aren't used internally - they're here for you to opt into, e.g. to
+     * type a form payload, a seed script, or an API client. `@payloadcms/plugin-mcp` also uses the
+     * input schema, but it builds that itself at runtime, so MCP gets the accurate write schema
+     * whether or not this flag is on.
+     *
+     * @todo We'd like to turn this on by default (or have the Local API use the input type
+     * directly), but there's a catch. When you read a document with `depth > 0`, its relationships
+     * come back as full documents rather than IDs. A strict ID-only input type would reject that and
+     * break the common "read a doc, change a field, save it back" pattern. To enable it by default,
+     * the input type would first need to accept a relationship as either an ID or the full document
+     * (which is what Payload already does at runtime), while keeping `id`, `defaultValue`, and
+     * auto-managed fields optional. Until then it stays opt-in, so we don't put a type that's
+     * stricter than the runtime on the main write path.
+     */
+    generateInputTypes?: boolean;
+    /** Filename to write the generated types to */
+    outputFile?: string;
+    /**
+     * Post-process the generated TypeScript types string before writing to file.
+     * Useful for plugins that need to inject generic types that JSON Schema cannot express.
+     *
+     * Functions are applied in order after the built-in Select generics are added.
+     *
+     * @example
+     * ```ts
+     * postProcess: [
+     *   ({ compiledTypes, config }) => {
+     *     const genericType = `export type MyGeneric<T> = { value: T };`
+     *     return compiledTypes.replace(/(\/\*[\s\S]*?\*\/\n)/, `$1\n${genericType}\n`)
+     *   },
+     * ]
+     * ```
+     */
+    postProcess?: Array<(args: {
+        compiledTypes: string;
+        config: SanitizedConfig;
+    }) => string>;
+    /**
+     * Allows you to modify the base JSON schema that is generated during generate:types. This JSON schema will be used
+     * to generate the TypeScript interfaces.
+     */
+    schema?: Array<(args: {
+        collectionIDFieldTypes: {
+            [key: string]: 'number' | 'string';
         };
-        /** The slug of a Collection that you want to be used to log in to the Admin dashboard. */
-        user?: string;
-    };
+        config: SanitizedConfig;
+        i18n: I18n;
+        jsonSchema: JSONSchema4;
+    }) => JSONSchema4>;
+    /**
+     * Enable strict type safety for draft operations. When enabled, the `draft` parameter is forbidden
+     * on collections without drafts, and query results with `draft: true` type required fields as optional.
+     * This prevents invalid draft usage at compile time and ensures type correctness across all Local API operations.
+     *
+     * @default false
+     * @todo Remove in v4. Strict draft types will become the default behavior.
+     */
+    strictDraftTypes?: boolean;
+};
+/**
+ * This is the central configuration
+ *
+ * @see https://payloadcms.com/docs/configuration/overview
+ */
+export type Config = {
+    /** Configure admin dashboard */
+    admin?: RootAdminConfig;
     /**
      * Configure authentication-related Payload-wide settings.
      */
@@ -995,10 +1182,12 @@ export type Config = {
          * Define which JWT identification methods you'd like to support for Payload's local auth strategy, as well as the order that they're retrieved in.
          * Defaults to ['JWT', 'Bearer', 'cookie]
          */
-        jwtOrder: ('Bearer' | 'cookie' | 'JWT')[];
+        jwtOrder?: ('Bearer' | 'cookie' | 'JWT')[];
     };
-    /** Custom Payload bin scripts can be injected via the config. */
-    bin?: BinScriptConfig[];
+    /**
+     * Define Collection and Global access constraints that are combined with document Access Control using AND semantics.
+     */
+    baseAccess?: BaseAccess;
     blocks?: Block[];
     /**
      * Pass additional options to the parser used to process `multipart/form-data` requests.
@@ -1009,6 +1198,11 @@ export type Config = {
      * @experimental This property is experimental and may change in future releases. Use at your own risk.
      */
     bodyParser?: Partial<BusboyConfig>;
+    /** Customize the Payload CLI, or set to `false` to disable it. */
+    cli?: {
+        /** Add, replace, or disable commands by name. Built-in commands are added during sanitization. */
+        commands?: CLICommands;
+    } | false;
     /**
      * Manage the datamodel of your application
      *
@@ -1036,7 +1230,7 @@ export type Config = {
      *
      * @see https://payloadcms.com/docs/getting-started/concepts#depth
      *
-     * @default 2
+     * @default 1
      */
     defaultDepth?: number;
     /**
@@ -1066,44 +1260,7 @@ export type Config = {
      *
      * @see https://payloadcms.com/docs/graphql/overview
      */
-    graphQL?: {
-        disable?: boolean;
-        /**
-         * Disable introspection queries in production.
-         *
-         * @default true
-         */
-        disableIntrospectionInProduction?: boolean;
-        /**
-         * Disable the GraphQL Playground in production.
-         *
-         * @default true
-         */
-        disablePlaygroundInProduction?: boolean;
-        maxComplexity?: number;
-        /**
-         * Function that returns an object containing keys to custom GraphQL mutations
-         *
-         * @see https://payloadcms.com/docs/graphql/extending
-         */
-        mutations?: GraphQLExtension;
-        /**
-         * Function that returns an object containing keys to custom GraphQL queries
-         *
-         * @see https://payloadcms.com/docs/graphql/extending
-         */
-        queries?: GraphQLExtension;
-        /**
-         * Filepath to write the generated schema to
-         */
-        schemaOutputFile?: string;
-        /**
-         * Function that returns an array of validation rules to apply to the GraphQL schema
-         *
-         * @see https://payloadcms.com/docs/graphql/overview#custom-validation-rules
-         */
-        validationRules?: (args: GraphQL.ExecutionArgs) => GraphQL.ValidationRule[];
-    };
+    graphQL?: RootGraphQLConfig;
     /**
      * Tap into Payload-wide hooks.
      *
@@ -1200,6 +1357,13 @@ export type Config = {
      * @see https://payloadcms.com/docs/plugins/overview
      */
     plugins?: Plugin[];
+    /**
+     * Previous `secret` values that should still be accepted for reads (verifying
+     * JWTs, matching API keys, decrypting stored values) during a bounded key
+     * rotation. New data is always written with the current `secret`. Retire these
+     * once `rotateSecret` has re-keyed existing data.
+     */
+    previousSecrets?: string[];
     /**
      * Allow you to save and share filters, columns, and sort orders for your collections.
      * @see https://payloadcms.com/docs/query-presets/overview
@@ -1333,135 +1497,45 @@ export type Config = {
     /** Send anonymous telemetry data about general usage. */
     telemetry?: boolean;
     /** Control how typescript interfaces are generated from your collections. */
-    typescript?: {
-        /**
-         * Automatically generate types during development
-         * @default true
-         */
-        autoGenerate?: boolean;
-        /** Disable declare block in generated types file */
-        declare?: {
-            /**
-             * @internal internal use only to allow for multiple declarations within a monorepo and suppress the "Duplicate identifier GeneratedTypes" error
-             *
-             * Adds a @ts-ignore flag above the GeneratedTypes interface declaration
-             *
-             * @default false
-             */
-            ignoreTSError?: boolean;
-        } | false;
-        /**
-         * Also generate a write-shaped input type (e.g. `PostInput`) next to each read type, describing
-         * what `create`/`update` accept: relationships and uploads as IDs only, `id` and `defaultValue`
-         * fields optional, and `createdAt`/`updatedAt`/`_status`/virtual/join fields removed. These are
-         * exposed on `Config['collectionsInput']` and `Config['globalsInput']`. Set `true` to turn them on.
-         *
-         * @default false
-         *
-         * @remarks
-         * Off by default. The Local API's `create`/`update` still type their `data` against the read
-         * type, so these input types aren't used internally - they're here for you to opt into, e.g. to
-         * type a form payload, a seed script, or an API client. `@payloadcms/plugin-mcp` also uses the
-         * input schema, but it builds that itself at runtime, so MCP gets the accurate write schema
-         * whether or not this flag is on.
-         *
-         * @todo We'd like to turn this on by default (or have the Local API use the input type
-         * directly), but there's a catch. When you read a document with `depth > 0`, its relationships
-         * come back as full documents rather than IDs. A strict ID-only input type would reject that and
-         * break the common "read a doc, change a field, save it back" pattern. To enable it by default,
-         * the input type would first need to accept a relationship as either an ID or the full document
-         * (which is what Payload already does at runtime), while keeping `id`, `defaultValue`, and
-         * auto-managed fields optional. Until then it stays opt-in, so we don't put a type that's
-         * stricter than the runtime on the main write path.
-         */
-        generateInputTypes?: boolean;
-        /** Filename to write the generated types to */
-        outputFile?: string;
-        /**
-         * Post-process the generated TypeScript types string before writing to file.
-         * Useful for plugins that need to inject generic types that JSON Schema cannot express.
-         *
-         * Functions are applied in order after the built-in Select generics are added.
-         *
-         * @example
-         * ```ts
-         * postProcess: [
-         *   ({ compiledTypes, config }) => {
-         *     const genericType = `export type MyGeneric<T> = { value: T };`
-         *     return compiledTypes.replace(/(\/\*[\s\S]*?\*\/\n)/, `$1\n${genericType}\n`)
-         *   },
-         * ]
-         * ```
-         */
-        postProcess?: Array<(args: {
-            compiledTypes: string;
-            config: SanitizedConfig;
-        }) => string>;
-        /**
-         * Allows you to modify the base JSON schema that is generated during generate:types. This JSON schema will be used
-         * to generate the TypeScript interfaces.
-         */
-        schema?: Array<(args: {
-            collectionIDFieldTypes: {
-                [key: string]: 'number' | 'string';
-            };
-            config: SanitizedConfig;
-            i18n: I18n;
-            jsonSchema: JSONSchema4;
-        }) => JSONSchema4>;
-        /**
-         * Enable strict type safety for draft operations. When enabled, the `draft` parameter is forbidden
-         * on collections without drafts, and query results with `draft: true` type required fields as optional.
-         * This prevents invalid draft usage at compile time and ensures type correctness across all Local API operations.
-         *
-         * @default false
-         * @todo Remove in v4. Strict draft types will become the default behavior.
-         */
-        strictDraftTypes?: boolean;
-    };
+    typescript?: RootTypeScriptConfig;
     /**
      * Customize the handling of incoming file uploads for collections that have uploads enabled.
      */
     upload?: FetchAPIFileUploadOptions;
 };
-/**
- * @todo remove the `DeepRequired` in v4.
- * We don't actually guarantee that all properties are set when sanitizing configs.
- */
-export type SanitizedConfig = {
-    admin: {
-        /**
-         * `Required` (shallow) marks the top-level dashboard props as required, mainly `defaultLayout`,
-         * which sanitizing always fills in. Do not switch this to the `DeepRequired` used below: it
-         * recurses into the widgets and re-expands the whole `Field` type (a large self-referencing
-         * union), which is very expensive to check. Never run a `Field`-bearing type through
-         * `DeepRequired`.
-         */
-        dashboard: Required<NonNullable<NonNullable<Config['admin']>['dashboard']>>;
-        timezones: SanitizedTimezoneConfig;
-    } & DeepRequired<Omit<NonNullable<Config['admin']>, 'dashboard'>>;
-    blocks?: FlattenedBlock[];
+interface SanitizedAdminConfig extends Omit<RootAdminConfig, 'avatar' | 'components' | 'custom' | 'dashboard' | 'dateFormat' | 'dependencies' | 'importMap' | 'meta' | 'routes' | 'theme' | 'timezones' | 'user'>, Required<Pick<RootAdminConfig, 'avatar' | 'components' | 'custom' | 'dateFormat' | 'dependencies' | 'theme' | 'user'>> {
+    dashboard: Required<DashboardConfig>;
+    importMap: Omit<NonNullable<RootAdminConfig['importMap']>, 'baseDir'> & Required<Pick<NonNullable<RootAdminConfig['importMap']>, 'baseDir'>>;
+    meta: Omit<MetaConfig, 'defaultOGImageType' | 'robots' | 'titleSuffix'> & Required<Pick<MetaConfig, 'defaultOGImageType' | 'robots' | 'titleSuffix'>>;
+    routes: Required<NonNullable<RootAdminConfig['routes']>>;
+    timezones: SanitizedTimezoneConfig;
+}
+type SanitizedGraphQLConfig = Omit<RootGraphQLConfig, 'disableIntrospectionInProduction' | 'disablePlaygroundInProduction' | 'maxComplexity' | 'schemaOutputFile'> & Required<Pick<RootGraphQLConfig, 'disableIntrospectionInProduction' | 'disablePlaygroundInProduction' | 'maxComplexity' | 'schemaOutputFile'>>;
+type SanitizedTypeScriptConfig = Omit<RootTypeScriptConfig, 'autoGenerate' | 'outputFile'> & Required<Pick<RootTypeScriptConfig, 'autoGenerate' | 'outputFile'>>;
+export interface SanitizedConfig extends Omit<Config, 'admin' | 'auth' | 'blocks' | 'cli' | 'collections' | 'cookiePrefix' | 'cors' | 'csrf' | 'custom' | 'defaultDepth' | 'defaultMaxTextLength' | 'editor' | 'endpoints' | 'globals' | 'graphQL' | 'hooks' | 'i18n' | 'jobs' | 'kv' | 'localization' | 'loggingLevels' | 'maxDepth' | 'routes' | 'serverURL' | 'storage' | 'telemetry' | 'typescript' | 'upload'>, Required<Pick<Config, 'cookiePrefix' | 'cors' | 'csrf' | 'custom' | 'defaultDepth' | 'defaultMaxTextLength' | 'endpoints' | 'hooks' | 'kv' | 'loggingLevels' | 'maxDepth' | 'serverURL' | 'storage' | 'telemetry'>> {
+    admin: SanitizedAdminConfig;
+    auth: Required<NonNullable<Config['auth']>>;
+    blocks: FlattenedBlock[];
+    cli: {
+        commands: CLICommands;
+    } | false;
     collections: SanitizedCollectionConfig[];
     /** Default richtext editor to use for richText fields */
     editor?: RichTextAdapter<any, any, any>;
-    endpoints: Endpoint[];
     globals: SanitizedGlobalConfig[];
+    graphQL: SanitizedGraphQLConfig;
     i18n: Required<I18nOptions>;
     jobs: SanitizedJobsConfig;
     localization: false | SanitizedLocalizationConfig;
-    paths: {
-        config: string;
-        configDir: string;
-        rawConfig: string;
-    };
-    storage: StorageAdapter[];
+    routes: Required<NonNullable<Config['routes']>>;
+    typescript: SanitizedTypeScriptConfig;
     upload: {
         /**
          * Deduped list of adapters used in the project
          */
         adapters: string[];
     } & FetchAPIFileUploadOptions;
-} & Omit<DeepRequired<Config>, 'admin' | 'blocks' | 'collections' | 'editor' | 'endpoint' | 'globals' | 'i18n' | 'jobs' | 'localization' | 'storage' | 'upload'>;
+}
 export type EditConfig = EditConfigWithoutRoot | EditConfigWithRoot;
 /**
  * Replace or modify _all_ nested document views and routes, including the document header, controls, and tabs. This cannot be used in conjunction with other nested views.