@vxil/config 0.7.0 → 0.8.1

package/dist/index.d.ts

@@ -14,7 +14,7 @@ export interface FieldDef {
     relationTo?: string;
     computed?: boolean;
     compute?: unknown;
-    /** Claims-table-enforced value uniqueness across live items (cms.md §9.3):
+    /** Claims-table-enforced value uniqueness across live items (guide ch. 4):
      *  a duplicate write is a clean 409 unique_violation. Scalar types only
      *  (string/int/float/datetime/relation/file). Carried on collection/field
      *  CREATE by `vxil push` and server apply; since 2026-07-17 `vxil push` also
@@ -22,12 +22,12 @@ export interface FieldDef {
      *  field re-add — packages/cli/src/cms.ts FIELD_ATTRS); attributes push
      *  cannot reconcile surface as a visible plan warning, never a silent no-op. */
     unique?: boolean;
-    /** Per-relation-field delete behavior (cms.md §11): bounded, atomic fan-out
-     *  when the referenced item is deleted — or `restrict` (§11.1), which REFUSES
+    /** Per-relation-field delete behavior (guide ch. 4): bounded, atomic fan-out
+     *  when the referenced item is deleted — or `restrict`, which REFUSES
      *  the delete with 409 `referenced` while a live reference exists. Same
      *  carriage + reconcile behavior as `unique`. */
     onDelete?: 'cascade' | 'set_null' | 'restrict';
-    /** FIELD-LEVEL READ SECURITY (cms.md §18): the end-user ORG ROLE slugs allowed
+    /** FIELD-LEVEL READ SECURITY (guide ch. 4): the end-user ORG ROLE slugs allowed
      *  to READ this field. Omitted/`[]` = ungated (every caller sees it — today's
      *  behavior). A non-empty list is FAIL-SAFE: in VERIFIED end-user mode the
      *  field is OMITTED from every read (get / list / query / `$expand` at any
@@ -40,8 +40,23 @@ export interface FieldDef {
      *  `orgs` role alphabet). The gate
      *  never affects WRITES. Carried by BOTH push paths and alterable in place. */
     readRoles?: string[];
+    /** EQUALITY INDEX for an UNSLOTTED field (guide ch. 4 "Indexed equality"):
+     *  `=` / `$eq` / `$in` filters on it are index-served instead of a bounded
+     *  scan — results are identical either way. At most 4 per collection (the
+     *  equality-key budget, separate from the 8 index slots); not together with
+     *  `indexSlot` (a slot already indexes equality) and not on a computed field
+     *  (both checked here at define time and again by the server). Carried by
+     *  BOTH push paths and alterable in place; on a collection over 2,000 live
+     *  items `vxil push` also runs the re-index that arms it. */
+    indexed?: boolean;
 }
-/** One config-declared per-record ACTION button (cms.md §17): exactly ONE
+/** The per-collection budget of `indexed: true` fields (cms/0158: e1…e4). */
+export declare const CMS_INDEXED_FIELD_BUDGET = 4;
+/** Define-time checks of a collection's `indexed` fields — the same refusals
+ *  the server makes (422), so a config fails at `defineConfig` / `collection()`
+ *  instead of mid-push. Throws on the first violation. */
+export declare function assertIndexedFields(name: string, def: CollectionDef): void;
+/** One config-declared per-record ACTION button (guide ch. 4): exactly ONE
  *  human-initiated step — pressing it invokes the deployed tenant function `fn`
  *  with `{ collection, item_id, action, actor, item }` and returns its result.
  *  No conditions, no chaining, no scheduling. `key` matches
@@ -56,7 +71,7 @@ export interface CmsActionDef {
  *  `FieldDef` itself so it can never drift from the authoring type: it is every
  *  key of `FieldDef` except `type` (which is required, not an optional carried
  *  attribute). This is the compile-time source of truth for the config-carriage
- *  completeness ratchet (audit 2026-07-15e #2, roadmap §4.5 P3): the CLI carriage
+ *  completeness ratchet: the CLI carriage
  *  table (`packages/cli/src/cms.ts` FIELD_ATTRS) and the server one
  *  (`workers/control-plane/src/handlers/apply.ts` FIELD_ATTR_DELTA) each pin
  *  `keyof` coverage against a set that equals this — so a 9th attribute added to
@@ -83,7 +98,7 @@ export interface CollectionDef {
      *  server-caller mode. Not a hard-isolation predicate; a single declarative
      *  flag the typed worker consults. Omit for shared/reference collections. */
     ownerField?: string;
-    /** Public delivery (roadmap §4.4): when true, this collection's PUBLISHED items
+    /** Public delivery (guide ch. 4): when true, this collection's PUBLISHED items
      *  are servable through the keyless, edge-cached GET /v1/cms/public/:tenantId/
      *  :collection lane (no API key). Owner-UNSCOPED (public content, not per-user);
      *  the owner_field is stripped from every served row. Default false. Carried by
@@ -91,22 +106,22 @@ export interface CollectionDef {
      *  with a regression test on each — an attribute read by no enforcing path ships
      *  inert (the validation.unique / owner_field precedent). */
     public?: boolean;
-    /** Per-record action buttons (cms.md §17): `[{ key, label, fn }]`, stored on
+    /** Per-record action buttons (guide ch. 4): `[{ key, label, fn }]`, stored on
      *  the collection (model data, not a config leaf). The dashboard renders one
      *  button per action on each record row; `POST /v1/cms/items/:coll/:id/actions/
      *  :key` invokes `fn` once. Carried by BOTH push paths (create + reconcile on
      *  existing collections — config is the source of truth; `[]`/absent clears). */
     actions?: CmsActionDef[];
 }
-/** The auth lifecycle events an `authHook` binding may subscribe to (F4-30,
- * auth wave 2026-09-10) — a CLOSED union; ONE event per binding, one audit
+/** The auth lifecycle events an `authHook` binding may subscribe to
+ * (2026-09-10) — a CLOSED union; ONE event per binding, one audit
  * event → one function invocation, no branching inside vxil:
  *   user.created    — auth.user.created  { user_id, method, is_anonymous }
  *   session.created — auth.session.created { user_id, session_id }
  *   session.revoked — auth.session.revoked { user_id, session_id, reason }
  *   signin.failure  — auth.signin.failure { email_hash | user_id, reason } */
 export type AuthHookEvent = 'user.created' | 'session.created' | 'session.revoked' | 'signin.failure';
-/** The opt-in re-delivery of a platform-delivered trigger (F33, 2026-09-25).
+/** The opt-in re-delivery of a platform-delivered trigger (guide ch. 8).
  *  DEFAULT OFF: the platform acknowledges every delivery with a 200 whatever
  *  the handler returned — an application error is observed (`functions.run.failed`),
  *  never re-delivered. With `retry` set on a `queue` / `webhook` / `cmsHook` /
@@ -126,7 +141,7 @@ export interface FunctionTriggerRetry {
     /** 1–5 attempts in all (1 = a failed attempt dead-letters at once, no re-delivery) */
     maxAttempts: number;
 }
-/** A function trigger (the §7.3 crossing). cmsHook fires on a CMS write;
+/** A function trigger (guide ch. 8). cmsHook fires on a CMS write;
  * authHook fires on ONE auth lifecycle event (default `user.created` — the
  * post-signup hook; at-least-once, ~1min fanout latency). */
 export type FunctionTrigger = {
@@ -228,7 +243,7 @@ export interface FunctionDef {
         timeoutMs?: number;
     };
     enabled?: boolean;
-    /** optional typed contract surfaced by `vxil gen` (Level 1, §4.5). */
+    /** optional typed contract surfaced by `vxil gen` (Level 1; guide ch. 8). */
     signature?: {
         input?: unknown;
         output?: unknown;
@@ -263,8 +278,7 @@ export declare const RELEASED_API_VERSIONS: readonly ApiVersion[];
 /** Recursive partial: a `vxil.config.ts` may write any SUBSET of a nested bag
  *  (`auth: { otp: { enabled: true } }`) — the server applies the defaults for
  *  the rest (Value.Default). A shallow `Partial` made `tsc` reject every
- *  partially-written nested bag, including the guide's own skeleton
- *  (found by the 2026-09-19 cvskit dry-run). Arrays and primitives are kept
+ *  partially-written nested bag, including the guide's own skeleton. Arrays and primitives are kept
  *  as-is; only plain object bags recurse. */
 export type DeepPartial<T> = T extends readonly unknown[] ? T : T extends object ? {
     [K in keyof T]?: DeepPartial<T[K]>;
@@ -303,7 +317,7 @@ export interface VxilConfig {
     };
     /** (b) CMS SCHEMA-AS-CODE — collections + fields. `push` reconciles them
      *  additively against GET /v1/cms/collections (no destructive drops without
-     *  --allow-destructive). Lane-A hooks stay in features.cms.hooks (config). */
+     *  --allow-destructive). Validation hooks stay in features.cms.hooks (config). */
     cms?: {
         collections?: Record<string, CollectionDef>;
     };
@@ -319,7 +333,7 @@ export interface VxilConfig {
  *  from JS callers with no compile gate, or a stale generated value) fails fast
  *  here rather than 404-ing every request against a nonexistent major. */
 export declare function defineConfig(c: VxilConfig): VxilConfig;
-/** Authoring helper for split-out cms/<name>.ts collection modules (§6a).
+/** Authoring helper for split-out cms/<name>.ts collection modules (guide ch. 5).
  *  `field('title', 'string', { required: true, indexSlot: 's1' })`. */
 export declare function field(type: FieldType, opts?: Omit<FieldDef, 'type'>): FieldDef;
 /** Authoring helper for a collection module: `export default collection({...})`. */

package/dist/index.js

@@ -1,3 +1,25 @@
+/** The per-collection budget of `indexed: true` fields (cms/0158: e1…e4). */
+export const CMS_INDEXED_FIELD_BUDGET = 4;
+/** Define-time checks of a collection's `indexed` fields — the same refusals
+ *  the server makes (422), so a config fails at `defineConfig` / `collection()`
+ *  instead of mid-push. Throws on the first violation. */
+export function assertIndexedFields(name, def) {
+    let n = 0;
+    for (const [fname, f] of Object.entries(def.fields ?? {})) {
+        if (f.indexed !== true)
+            continue;
+        n += 1;
+        if (f.indexSlot) {
+            throw new Error(`vxil.config: cms.${name}.${fname} sets both indexed and indexSlot '${f.indexSlot}' — a slot already indexes equality; use one`);
+        }
+        if (f.computed) {
+            throw new Error(`vxil.config: cms.${name}.${fname} is computed — a computed field cannot be indexed (bind it to an indexSlot instead)`);
+        }
+    }
+    if (n > CMS_INDEXED_FIELD_BUDGET) {
+        throw new Error(`vxil.config: cms.${name} has ${n} indexed fields — at most ${CMS_INDEXED_FIELD_BUDGET} per collection`);
+    }
+}
 /** The released majors `defineConfig` validates `apiVersion` against. Widened
  *  only by a real v2. */
 export const RELEASED_API_VERSIONS = ['v1'];
@@ -11,14 +33,17 @@ export function defineConfig(c) {
             `(released: ${RELEASED_API_VERSIONS.map((v) => `'${v}'`).join(', ')}). ` +
             'A new major ships as a new path with its own deprecation window — see https://vxil.com/docs/guide/12-going-to-production.');
     }
+    for (const [name, def] of Object.entries(c.cms?.collections ?? {}))
+        assertIndexedFields(name, def);
     return c;
 }
-/** Authoring helper for split-out cms/<name>.ts collection modules (§6a).
+/** Authoring helper for split-out cms/<name>.ts collection modules (guide ch. 5).
  *  `field('title', 'string', { required: true, indexSlot: 's1' })`. */
 export function field(type, opts = {}) {
     return { type, ...opts };
 }
 /** Authoring helper for a collection module: `export default collection({...})`. */
 export function collection(def) {
+    assertIndexedFields(def.singular ?? 'collection', def);
     return def;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vxil/config",
-  "version": "0.7.0",
+  "version": "0.8.1",
   "description": "Typed vxil.config.ts authoring for the vxil backend platform — defineConfig, feature and cms field definitions (published for @vxil/cli).",
   "license": "MIT",
   "homepage": "https://vxil.com",
@@ -22,7 +22,7 @@
     "src"
   ],
   "dependencies": {
-    "@vxil/feature-configs": "0.7.0"
+    "@vxil/feature-configs": "0.7.1"
   },
   "publishConfig": {
     "access": "public"

package/src/index.test.ts

@@ -1,5 +1,7 @@
 import { describe, expect, it } from 'vitest';
-import { defineConfig, RELEASED_API_VERSIONS } from './index.js';
+import {
+  assertIndexedFields, CMS_INDEXED_FIELD_BUDGET, collection, defineConfig, field, RELEASED_API_VERSIONS,
+} from './index.js';
 
 describe('defineConfig', () => {
   it('is an identity function (returns its argument verbatim)', () => {
@@ -26,3 +28,25 @@ describe('defineConfig', () => {
       .toThrow(/docs\/guide\/12-going-to-production/);
   });
 });
+
+describe('indexed fields (PERF-26b) — define-time checks', () => {
+  it('accepts up to four unslotted indexed fields', () => {
+    const c = collection({ fields: {
+      a: field('string', { indexed: true }), b: field('int', { indexed: true }),
+      c: field('bool', { indexed: true }), d: field('string', { indexed: true }),
+      e: field('string', { indexSlot: 's1' }),
+    } });
+    expect(Object.keys(c.fields)).toHaveLength(5);
+    expect(CMS_INDEXED_FIELD_BUDGET).toBe(4);
+  });
+
+  it('refuses a fifth, indexed + indexSlot, and a computed indexed field', () => {
+    expect(() => defineConfig({ cms: { collections: { posts: { fields: Object.fromEntries(
+      ['a', 'b', 'c', 'd', 'e'].map((k) => [k, field('string', { indexed: true })]),
+    ) } } } })).toThrow(/at most 4 per collection/);
+    expect(() => collection({ fields: { a: field('string', { indexed: true, indexSlot: 's1' }) } }))
+      .toThrow(/already indexes equality/);
+    expect(() => assertIndexedFields('posts', { fields: { a: field('string', { indexed: true, computed: true }) } }))
+      .toThrow(/computed/);
+  });
+});

package/src/index.ts

@@ -4,8 +4,8 @@
 // so `vxil push` can compile it to a JSON manifest. Type-checking happens in the
 // tenant's editor (real autocomplete from the @vxil/feature-configs Static<>
 // types); the control plane never executes this file. This keeps config-as-code
-// §7.3-consistent — config is DATA; the only tenant CODE that crosses into vxil
-// is (a) the Lane-A hook expressions (a closed sandbox) and (b) the functions/
+// consistent — config is DATA; the only tenant CODE that crosses into vxil
+// is (a) the hook expressions (a closed sandbox) and (b) the functions/
 // sources (the opt-in, plan-limited, egress-guarded crossing). Everything here is
 // declarative. See https://vxil.com/docs/guide/05-typed-sdk-and-cli.
 import type {
@@ -33,7 +33,7 @@ export interface FieldDef {
   relationTo?: string;
   computed?: boolean;
   compute?: unknown;
-  /** Claims-table-enforced value uniqueness across live items (cms.md §9.3):
+  /** Claims-table-enforced value uniqueness across live items (guide ch. 4):
    *  a duplicate write is a clean 409 unique_violation. Scalar types only
    *  (string/int/float/datetime/relation/file). Carried on collection/field
    *  CREATE by `vxil push` and server apply; since 2026-07-17 `vxil push` also
@@ -41,12 +41,12 @@ export interface FieldDef {
    *  field re-add — packages/cli/src/cms.ts FIELD_ATTRS); attributes push
    *  cannot reconcile surface as a visible plan warning, never a silent no-op. */
   unique?: boolean;
-  /** Per-relation-field delete behavior (cms.md §11): bounded, atomic fan-out
-   *  when the referenced item is deleted — or `restrict` (§11.1), which REFUSES
+  /** Per-relation-field delete behavior (guide ch. 4): bounded, atomic fan-out
+   *  when the referenced item is deleted — or `restrict`, which REFUSES
    *  the delete with 409 `referenced` while a live reference exists. Same
    *  carriage + reconcile behavior as `unique`. */
   onDelete?: 'cascade' | 'set_null' | 'restrict';
-  /** FIELD-LEVEL READ SECURITY (cms.md §18): the end-user ORG ROLE slugs allowed
+  /** FIELD-LEVEL READ SECURITY (guide ch. 4): the end-user ORG ROLE slugs allowed
    *  to READ this field. Omitted/`[]` = ungated (every caller sees it — today's
    *  behavior). A non-empty list is FAIL-SAFE: in VERIFIED end-user mode the
    *  field is OMITTED from every read (get / list / query / `$expand` at any
@@ -59,9 +59,41 @@ export interface FieldDef {
    *  `orgs` role alphabet). The gate
    *  never affects WRITES. Carried by BOTH push paths and alterable in place. */
   readRoles?: string[];
+  /** EQUALITY INDEX for an UNSLOTTED field (guide ch. 4 "Indexed equality"):
+   *  `=` / `$eq` / `$in` filters on it are index-served instead of a bounded
+   *  scan — results are identical either way. At most 4 per collection (the
+   *  equality-key budget, separate from the 8 index slots); not together with
+   *  `indexSlot` (a slot already indexes equality) and not on a computed field
+   *  (both checked here at define time and again by the server). Carried by
+   *  BOTH push paths and alterable in place; on a collection over 2,000 live
+   *  items `vxil push` also runs the re-index that arms it. */
+  indexed?: boolean;
 }
 
-/** One config-declared per-record ACTION button (cms.md §17): exactly ONE
+/** The per-collection budget of `indexed: true` fields (cms/0158: e1…e4). */
+export const CMS_INDEXED_FIELD_BUDGET = 4;
+
+/** Define-time checks of a collection's `indexed` fields — the same refusals
+ *  the server makes (422), so a config fails at `defineConfig` / `collection()`
+ *  instead of mid-push. Throws on the first violation. */
+export function assertIndexedFields(name: string, def: CollectionDef): void {
+  let n = 0;
+  for (const [fname, f] of Object.entries(def.fields ?? {})) {
+    if (f.indexed !== true) continue;
+    n += 1;
+    if (f.indexSlot) {
+      throw new Error(`vxil.config: cms.${name}.${fname} sets both indexed and indexSlot '${f.indexSlot}' — a slot already indexes equality; use one`);
+    }
+    if (f.computed) {
+      throw new Error(`vxil.config: cms.${name}.${fname} is computed — a computed field cannot be indexed (bind it to an indexSlot instead)`);
+    }
+  }
+  if (n > CMS_INDEXED_FIELD_BUDGET) {
+    throw new Error(`vxil.config: cms.${name} has ${n} indexed fields — at most ${CMS_INDEXED_FIELD_BUDGET} per collection`);
+  }
+}
+
+/** One config-declared per-record ACTION button (guide ch. 4): exactly ONE
  *  human-initiated step — pressing it invokes the deployed tenant function `fn`
  *  with `{ collection, item_id, action, actor, item }` and returns its result.
  *  No conditions, no chaining, no scheduling. `key` matches
@@ -77,7 +109,7 @@ export interface CmsActionDef {
  *  `FieldDef` itself so it can never drift from the authoring type: it is every
  *  key of `FieldDef` except `type` (which is required, not an optional carried
  *  attribute). This is the compile-time source of truth for the config-carriage
- *  completeness ratchet (audit 2026-07-15e #2, roadmap §4.5 P3): the CLI carriage
+ *  completeness ratchet: the CLI carriage
  *  table (`packages/cli/src/cms.ts` FIELD_ATTRS) and the server one
  *  (`workers/control-plane/src/handlers/apply.ts` FIELD_ATTR_DELTA) each pin
  *  `keyof` coverage against a set that equals this — so a 9th attribute added to
@@ -105,7 +137,7 @@ export interface CollectionDef {
    *  server-caller mode. Not a hard-isolation predicate; a single declarative
    *  flag the typed worker consults. Omit for shared/reference collections. */
   ownerField?: string;
-  /** Public delivery (roadmap §4.4): when true, this collection's PUBLISHED items
+  /** Public delivery (guide ch. 4): when true, this collection's PUBLISHED items
    *  are servable through the keyless, edge-cached GET /v1/cms/public/:tenantId/
    *  :collection lane (no API key). Owner-UNSCOPED (public content, not per-user);
    *  the owner_field is stripped from every served row. Default false. Carried by
@@ -113,7 +145,7 @@ export interface CollectionDef {
    *  with a regression test on each — an attribute read by no enforcing path ships
    *  inert (the validation.unique / owner_field precedent). */
   public?: boolean;
-  /** Per-record action buttons (cms.md §17): `[{ key, label, fn }]`, stored on
+  /** Per-record action buttons (guide ch. 4): `[{ key, label, fn }]`, stored on
    *  the collection (model data, not a config leaf). The dashboard renders one
    *  button per action on each record row; `POST /v1/cms/items/:coll/:id/actions/
    *  :key` invokes `fn` once. Carried by BOTH push paths (create + reconcile on
@@ -121,8 +153,8 @@ export interface CollectionDef {
   actions?: CmsActionDef[];
 }
 
-/** The auth lifecycle events an `authHook` binding may subscribe to (F4-30,
- * auth wave 2026-09-10) — a CLOSED union; ONE event per binding, one audit
+/** The auth lifecycle events an `authHook` binding may subscribe to
+ * (2026-09-10) — a CLOSED union; ONE event per binding, one audit
  * event → one function invocation, no branching inside vxil:
  *   user.created    — auth.user.created  { user_id, method, is_anonymous }
  *   session.created — auth.session.created { user_id, session_id }
@@ -130,7 +162,7 @@ export interface CollectionDef {
  *   signin.failure  — auth.signin.failure { email_hash | user_id, reason } */
 export type AuthHookEvent = 'user.created' | 'session.created' | 'session.revoked' | 'signin.failure';
 
-/** The opt-in re-delivery of a platform-delivered trigger (F33, 2026-09-25).
+/** The opt-in re-delivery of a platform-delivered trigger (guide ch. 8).
  *  DEFAULT OFF: the platform acknowledges every delivery with a 200 whatever
  *  the handler returned — an application error is observed (`functions.run.failed`),
  *  never re-delivered. With `retry` set on a `queue` / `webhook` / `cmsHook` /
@@ -151,7 +183,7 @@ export interface FunctionTriggerRetry {
   maxAttempts: number;
 }
 
-/** A function trigger (the §7.3 crossing). cmsHook fires on a CMS write;
+/** A function trigger (guide ch. 8). cmsHook fires on a CMS write;
  * authHook fires on ONE auth lifecycle event (default `user.created` — the
  * post-signup hook; at-least-once, ~1min fanout latency). */
 export type FunctionTrigger =
@@ -233,7 +265,7 @@ export interface FunctionDef {
     timeoutMs?: number;
   };
   enabled?: boolean;
-  /** optional typed contract surfaced by `vxil gen` (Level 1, §4.5). */
+  /** optional typed contract surfaced by `vxil gen` (Level 1; guide ch. 8). */
   signature?: { input?: unknown; output?: unknown };
 }
 
@@ -264,8 +296,7 @@ export const RELEASED_API_VERSIONS: readonly ApiVersion[] = ['v1'];
 /** Recursive partial: a `vxil.config.ts` may write any SUBSET of a nested bag
  *  (`auth: { otp: { enabled: true } }`) — the server applies the defaults for
  *  the rest (Value.Default). A shallow `Partial` made `tsc` reject every
- *  partially-written nested bag, including the guide's own skeleton
- *  (found by the 2026-09-19 cvskit dry-run). Arrays and primitives are kept
+ *  partially-written nested bag, including the guide's own skeleton. Arrays and primitives are kept
  *  as-is; only plain object bags recurse. */
 export type DeepPartial<T> = T extends readonly unknown[]
   ? T
@@ -310,7 +341,7 @@ export interface VxilConfig {
 
   /** (b) CMS SCHEMA-AS-CODE — collections + fields. `push` reconciles them
    *  additively against GET /v1/cms/collections (no destructive drops without
-   *  --allow-destructive). Lane-A hooks stay in features.cms.hooks (config). */
+   *  --allow-destructive). Validation hooks stay in features.cms.hooks (config). */
   cms?: {
     collections?: Record<string, CollectionDef>;
   };
@@ -337,10 +368,11 @@ export function defineConfig(c: VxilConfig): VxilConfig {
         'A new major ships as a new path with its own deprecation window — see https://vxil.com/docs/guide/12-going-to-production.',
     );
   }
+  for (const [name, def] of Object.entries(c.cms?.collections ?? {})) assertIndexedFields(name, def);
   return c;
 }
 
-/** Authoring helper for split-out cms/<name>.ts collection modules (§6a).
+/** Authoring helper for split-out cms/<name>.ts collection modules (guide ch. 5).
  *  `field('title', 'string', { required: true, indexSlot: 's1' })`. */
 export function field(
   type: FieldType,
@@ -351,5 +383,6 @@ export function field(
 
 /** Authoring helper for a collection module: `export default collection({...})`. */
 export function collection(def: CollectionDef): CollectionDef {
+  assertIndexedFields(def.singular ?? 'collection', def);
   return def;
 }