@byline/host-tanstack-start 4.15.0 → 4.17.0

package/src/integrations/analytics-events.ts

@@ -0,0 +1,224 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+
+import { ANALYTICS_MAX_BODY_BYTES, type Analytics, getAnalytics } from '@byline/analytics'
+import { type BylineLogger, getLogger } from '@byline/core'
+
+export interface AnalyticsEventHandlerOptions {
+  /** Host-owned resolver for deployment-specific, request-scoped network facts. */
+  resolveRequestContext: AnalyticsRequestContextResolver
+  /** Test/embedding seam; production resolves the registered installation runtime. */
+  analytics?: () => Pick<Analytics, 'ingest'>
+  /** Test/embedding seam; production resolves the initialized application logger. */
+  logger?: () => Pick<BylineLogger, 'error'>
+}
+
+export interface AnalyticsRequestContext {
+  clientIp?: string | null
+  country?: string | null
+}
+
+export type AnalyticsRequestContextResolver = (
+  request: Request
+) => AnalyticsRequestContext | Promise<AnalyticsRequestContext>
+
+export interface LocalAnalyticsRequestContextOptions {
+  /** Resolve the direct peer address from the host runtime, without forwarded headers. */
+  resolveClientIp: (
+    request: Request
+  ) => string | null | undefined | Promise<string | null | undefined>
+  /** Explicit development-only identity for runtimes that expose no peer address. */
+  developmentFallbackClientIp?: string
+}
+
+export interface TrustedAnalyticsHeadersOptions {
+  /** Header overwritten by the trusted reverse proxy with the normalized client address. */
+  clientIpHeader: string
+  /** Optional header overwritten by the trusted edge with an ISO country code. */
+  countryHeader?: string
+  /** Explicit context or resolver used only when a trusted header is absent. */
+  fallback?: AnalyticsRequestContext | AnalyticsRequestContextResolver
+}
+
+/**
+ * Resolve an identity for a server reached directly through a loopback URL.
+ * Both the URL and the direct peer address must be loopback. This is safe for
+ * a directly reached local server. A same-host reverse proxy also appears as
+ * a loopback peer, however, so do not expose this fallback through a public
+ * proxy where a client can select the Host header.
+ */
+export function localAnalyticsRequestContext(
+  options: LocalAnalyticsRequestContextOptions
+): AnalyticsRequestContextResolver {
+  const developmentFallbackClientIp =
+    options.developmentFallbackClientIp == null
+      ? undefined
+      : validateFact(options.developmentFallbackClientIp, 'developmentFallbackClientIp', 255)
+
+  return async (request) => {
+    const clientIp = await options.resolveClientIp(request)
+    if (isLoopbackHostname(new URL(request.url).hostname) && isLoopbackAddress(clientIp)) {
+      return { clientIp: validateFact(clientIp, 'resolved clientIp', 255) }
+    }
+    return developmentFallbackClientIp == null ? {} : { clientIp: developmentFallbackClientIp }
+  }
+}
+
+/**
+ * Resolve network facts from headers owned and overwritten by a trusted proxy.
+ * This helper does not establish that trust: the deployment must prevent a
+ * client from selecting the configured header values or bypassing the proxy.
+ */
+export function trustedAnalyticsHeaders(
+  options: TrustedAnalyticsHeadersOptions
+): AnalyticsRequestContextResolver {
+  const clientIpHeader = validateHeaderName(options.clientIpHeader, 'clientIpHeader')
+  const countryHeader =
+    options.countryHeader == null
+      ? undefined
+      : validateHeaderName(options.countryHeader, 'countryHeader')
+  const fallback =
+    typeof options.fallback === 'function' ? options.fallback : validateFallback(options.fallback)
+
+  return async (request) => {
+    const fallbackContext =
+      typeof fallback === 'function' ? validateFallback(await fallback(request)) : fallback
+    return {
+      clientIp: request.headers.get(clientIpHeader)?.trim() || fallbackContext?.clientIp,
+      country:
+        (countryHeader == null ? null : request.headers.get(countryHeader)?.trim()) ||
+        fallbackContext?.country,
+    }
+  }
+}
+
+export function createAnalyticsEventHandler(
+  options: AnalyticsEventHandlerOptions
+): (request: Request) => Promise<Response> {
+  const resolveAnalytics = options.analytics ?? getAnalytics
+
+  return async (request) => {
+    const body = await readBoundedBody(request, ANALYTICS_MAX_BODY_BYTES)
+    try {
+      const requestContext = await options.resolveRequestContext(request)
+      const result = await resolveAnalytics().ingest({
+        method: request.method,
+        body: body ?? new Uint8Array(ANALYTICS_MAX_BODY_BYTES + 1),
+        origin: request.headers.get('origin'),
+        referer: request.headers.get('referer'),
+        userAgent: request.headers.get('user-agent'),
+        secPurpose: request.headers.get('sec-purpose'),
+        xPurpose: request.headers.get('x-purpose'),
+        clientIp: requestContext.clientIp,
+        country: requestContext.country,
+      })
+
+      return analyticsResponse(result.status)
+    } catch (error) {
+      const logger = options.logger?.() ?? getLogger()
+      logger.error({ errorCode: safeErrorCode(error) }, '[analytics] event persistence failed')
+      return analyticsResponse(503)
+    }
+  }
+}
+
+function safeErrorCode(error: unknown): string {
+  if (error == null || typeof error !== 'object' || !('code' in error)) return 'UNKNOWN'
+  const code = error.code
+  return typeof code === 'string' && /^[a-z0-9_-]{1,64}$/iu.test(code) ? code : 'UNKNOWN'
+}
+
+function analyticsResponse(status: number): Response {
+  return new Response(null, {
+    status,
+    headers: { 'cache-control': 'no-store' },
+  })
+}
+
+async function readBoundedBody(request: Request, limit: number): Promise<Uint8Array | null> {
+  const declaredLength = Number(request.headers.get('content-length'))
+  if (Number.isFinite(declaredLength) && declaredLength > limit) return null
+  if (request.body == null) return new Uint8Array()
+
+  const reader = request.body.getReader()
+  const chunks: Uint8Array[] = []
+  let length = 0
+  try {
+    while (true) {
+      const { done, value } = await reader.read()
+      if (done) break
+      length += value.byteLength
+      if (length > limit) {
+        await reader.cancel()
+        return null
+      }
+      chunks.push(value)
+    }
+  } finally {
+    reader.releaseLock()
+  }
+
+  const body = new Uint8Array(length)
+  let offset = 0
+  for (const chunk of chunks) {
+    body.set(chunk, offset)
+    offset += chunk.byteLength
+  }
+  return body
+}
+
+function validateHeaderName(value: string, label: string): string {
+  const normalized = value.trim().toLowerCase()
+  if (!/^[!#$%&'*+.^_`|~0-9a-z-]+$/u.test(normalized)) {
+    throw new Error(`analytics ${label} must be a valid HTTP header name`)
+  }
+  return normalized
+}
+
+function validateFallback(
+  value: AnalyticsRequestContext | undefined
+): AnalyticsRequestContext | undefined {
+  if (value == null) return undefined
+  return {
+    ...(value.clientIp == null
+      ? {}
+      : { clientIp: validateFact(value.clientIp, 'fallback.clientIp', 255) }),
+    ...(value.country == null
+      ? {}
+      : { country: validateFact(value.country, 'fallback.country', 16) }),
+  }
+}
+
+function validateFact(value: string, label: string, maxLength: number): string {
+  const normalized = value.trim()
+  if (normalized.length === 0 || normalized.length > maxLength) {
+    throw new Error(`analytics ${label} must contain 1 to ${maxLength} characters`)
+  }
+  return normalized
+}
+
+function isLoopbackHostname(value: string): boolean {
+  const normalized = stripIpv6Brackets(value.toLowerCase())
+  return (
+    normalized === 'localhost' || normalized.endsWith('.localhost') || isLoopbackAddress(normalized)
+  )
+}
+
+function isLoopbackAddress(value: string | null | undefined): value is string {
+  if (value == null) return false
+  const normalized = stripIpv6Brackets(value.trim().toLowerCase())
+  return (
+    normalized === '::1' ||
+    /^127(?:\.\d{1,3}){3}$/u.test(normalized) ||
+    /^::ffff:127(?:\.\d{1,3}){3}$/u.test(normalized)
+  )
+}
+
+function stripIpv6Brackets(value: string): string {
+  return value.startsWith('[') && value.endsWith(']') ? value.slice(1, -1) : value
+}

package/src/integrations/api-utils.ts

@@ -16,12 +16,16 @@
 // src/server.ts (TanStack Start server entry point) before any
 // requests are handled. No need to import it here.
 
-import type { CollectionDefinition, CollectionRecord } from '@byline/core'
-import { getCollectionDefinition } from '@byline/core'
+import type {
+  CollectionDefinition,
+  CollectionRecord,
+  MultiCollectionDefinition,
+} from '@byline/core'
+import { getCollectionDefinition, isSingleton } from '@byline/core'
 
 import { bylineCore } from './byline-core.js'
 
-export interface EnsuredCollection {
+export interface EnsuredDocumentResource {
   definition: CollectionDefinition
   collection: {
     id: string
@@ -31,21 +35,28 @@ export interface EnsuredCollection {
   }
 }
 
+export interface EnsuredCollection extends EnsuredDocumentResource {
+  definition: MultiCollectionDefinition
+}
+
 /**
- * Resolve a collection for an admin API request.
+ * Resolve either registered document-resource kind against the reconciled
+ * collection record.
  *
  * Collections are reconciled with the database once at startup by
  * `initBylineCore()` (see `packages/core/src/services/collection-bootstrap.ts`).
  * This helper is a per-request cache lookup against the resulting in-memory
  * registry — no DB I/O, no hash work.
  *
- * Returns `null` when the path is not registered in the client/server config.
+ * This broader seam is reserved for operations such as field upload whose core
+ * service is explicitly kind-aware; collection route families continue to use
+ * `ensureCollection` below.
  */
-export async function ensureCollection(path: string): Promise<EnsuredCollection | null> {
+export async function ensureDocumentResource(
+  path: string
+): Promise<EnsuredDocumentResource | null> {
   const definition = getCollectionDefinition(path)
-  if (definition == null) {
-    return null
-  }
+  if (definition == null) return null
 
   let record: CollectionRecord
   try {
@@ -64,3 +75,17 @@ export async function ensureCollection(path: string): Promise<EnsuredCollection
     },
   }
 }
+
+/**
+ * Narrow the shared document-resource resolution to a multi-document
+ * collection for a collection-scoped admin API request.
+ *
+ * Returns `null` when the path is unregistered or belongs to a singleton, so
+ * collection route families cannot accidentally admit the other resource kind.
+ */
+export async function ensureCollection(path: string): Promise<EnsuredCollection | null> {
+  const resource = await ensureDocumentResource(path)
+  return resource != null && !isSingleton(resource.definition)
+    ? { ...resource, definition: resource.definition }
+    : null
+}

package/src/integrations/serve-analytics-agent.test.node.ts

@@ -0,0 +1,20 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+
+import { describe, expect, it } from 'vitest'
+
+import { serveAnalyticsAgent } from './serve-analytics-agent.js'
+
+describe('serveAnalyticsAgent', () => {
+  it('serves the bundled standalone collector with bounded first-party caching', async () => {
+    const response = serveAnalyticsAgent()
+    expect(response.headers.get('content-type')).toBe('text/javascript; charset=utf-8')
+    expect(response.headers.get('cache-control')).toBe('public, max-age=3600, must-revalidate')
+    expect(await response.text()).toContain('text/plain')
+  })
+})

package/src/integrations/serve-analytics-agent.ts

@@ -0,0 +1,19 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+
+import { ANALYTICS_AGENT_SOURCE } from '@byline/analytics-agent/source'
+
+export function serveAnalyticsAgent(): Response {
+  return new Response(ANALYTICS_AGENT_SOURCE, {
+    headers: {
+      'cache-control': 'public, max-age=3600, must-revalidate',
+      'content-type': 'text/javascript; charset=utf-8',
+      'x-content-type-options': 'nosniff',
+    },
+  })
+}

package/src/routes/analytics-range.ts

@@ -0,0 +1,55 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+
+import type { AnalyticsDashboardPeriod } from '@byline/admin/analytics'
+
+const UTC_DAY_PATTERN = /^\d{4}-\d{2}-\d{2}$/u
+
+export function buildAnalyticsDashboardRange(
+  period: AnalyticsDashboardPeriod,
+  now = new Date(),
+  earliestReportDay: string | null = null
+): { from: string; to: string } {
+  const to = new Date(Date.UTC(now.getUTCFullYear(), now.getUTCMonth(), now.getUTCDate()))
+
+  if (period === 'ytd') {
+    return {
+      from: formatUtcDay(new Date(Date.UTC(to.getUTCFullYear(), 0, 1))),
+      to: formatUtcDay(to),
+    }
+  }
+
+  if (period === 'all') {
+    const toDay = formatUtcDay(to)
+    const earliest = earliestReportDay == null ? toDay : assertUtcDay(earliestReportDay)
+    return {
+      from: earliest <= toDay ? earliest : toDay,
+      to: toDay,
+    }
+  }
+
+  const from = new Date(to)
+  from.setUTCDate(from.getUTCDate() - (period - 1))
+  return { from: formatUtcDay(from), to: formatUtcDay(to) }
+}
+
+function formatUtcDay(value: Date): string {
+  const year = value.getUTCFullYear().toString().padStart(4, '0')
+  const month = (value.getUTCMonth() + 1).toString().padStart(2, '0')
+  const day = value.getUTCDate().toString().padStart(2, '0')
+  return `${year}-${month}-${day}`
+}
+
+function assertUtcDay(value: string): string {
+  if (!UTC_DAY_PATTERN.test(value)) throw new Error('analytics report day must use YYYY-MM-DD')
+  const date = new Date(`${value}T00:00:00.000Z`)
+  if (!Number.isFinite(date.valueOf()) || formatUtcDay(date) !== value) {
+    throw new Error('analytics report day must be a real UTC calendar day')
+  }
+  return value
+}

package/src/routes/create-admin-analytics-route.test.node.ts

@@ -0,0 +1,46 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+
+import { describe, expect, it } from 'vitest'
+
+import { buildAnalyticsDashboardRange } from './analytics-range.js'
+
+describe('buildAnalyticsDashboardRange', () => {
+  it('builds inclusive UTC periods across month and year boundaries', () => {
+    expect(buildAnalyticsDashboardRange(7, new Date('2027-01-03T23:59:59.999Z'))).toEqual({
+      from: '2026-12-28',
+      to: '2027-01-03',
+    })
+  })
+
+  it('builds year-to-date from January 1 in UTC', () => {
+    expect(buildAnalyticsDashboardRange('ytd', new Date('2027-06-03T23:59:59.999Z'))).toEqual({
+      from: '2027-01-01',
+      to: '2027-06-03',
+    })
+  })
+
+  it('builds all-time from the earliest reportable day', () => {
+    expect(
+      buildAnalyticsDashboardRange('all', new Date('2027-06-03T23:59:59.999Z'), '2024-02-29')
+    ).toEqual({ from: '2024-02-29', to: '2027-06-03' })
+  })
+
+  it('uses today for an empty all-time report', () => {
+    expect(buildAnalyticsDashboardRange('all', new Date('2027-06-03T23:59:59.999Z'))).toEqual({
+      from: '2027-06-03',
+      to: '2027-06-03',
+    })
+  })
+
+  it('rejects an invalid earliest report day before constructing a range', () => {
+    expect(() =>
+      buildAnalyticsDashboardRange('all', new Date('2027-06-03T23:59:59.999Z'), '2027-02-30')
+    ).toThrow(/real UTC calendar day/u)
+  })
+})

package/src/routes/create-admin-analytics-route.tsx

@@ -0,0 +1,109 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+
+import { createFileRoute, notFound } from '@tanstack/react-router'
+
+import type { AnalyticsDashboardData, AnalyticsDashboardPeriod } from '@byline/admin/analytics'
+import { AnalyticsDashboard } from '@byline/admin/analytics/components/dashboard'
+import { isAnalyticsDashboardPeriod } from '@byline/analytics/config'
+import { useTranslation } from '@byline/i18n/react'
+import { z } from 'zod'
+
+import { BreadcrumbsClient } from '../admin-shell/chrome/breadcrumbs/breadcrumbs-client.js'
+import { useNavigate } from '../admin-shell/chrome/loose-router.js'
+import {
+  getAnalyticsCountries,
+  getAnalyticsReferrers,
+  getAnalyticsReportCoverage,
+  getAnalyticsRuntime,
+  getAnalyticsSummary,
+  getAnalyticsTop,
+} from '../server-fns/analytics/index.js'
+import { getAdminRoutePath } from './admin-path.js'
+import { buildAnalyticsDashboardRange } from './analytics-range.js'
+
+const periodSchema = z.preprocess((value) => {
+  if (value == null) return undefined
+  if (value === 'ytd' || value === 'all') return value
+  return Number(value)
+}, z.custom<AnalyticsDashboardPeriod>((value) => isAnalyticsDashboardPeriod(value)).optional())
+
+const searchSchema = z.object({
+  period: periodSchema.catch(undefined),
+})
+
+interface AnalyticsSearch {
+  period?: AnalyticsDashboardPeriod
+}
+
+export function createAdminAnalyticsRoute(path: string) {
+  const Route: any = createFileRoute(path as never)({
+    validateSearch: searchSchema,
+    loaderDeps: ({ search }: { search: AnalyticsSearch }) => ({
+      period: search.period ?? 30,
+    }),
+    loader: async ({ deps }: { deps: { period: AnalyticsDashboardPeriod } }) => {
+      const runtime = await getAnalyticsRuntime()
+      if (!runtime.enabled) throw notFound()
+
+      const coverage = await getAnalyticsReportCoverage()
+      const range = buildAnalyticsDashboardRange(deps.period, new Date(), coverage.summaryFrom)
+      const [summary, pages, downloads, referrers, countries] = await Promise.all([
+        getAnalyticsSummary({ data: range }),
+        getAnalyticsTop({ data: { ...range, kind: 'page', limit: 20 } }),
+        getAnalyticsTop({ data: { ...range, kind: 'download', limit: 20 } }),
+        getAnalyticsReferrers({ data: { ...range, limit: 20 } }),
+        getAnalyticsCountries({ data: range }),
+      ])
+
+      return {
+        data: {
+          summary,
+          pages,
+          downloads,
+          referrers,
+          countries,
+          range,
+          coverage,
+        } satisfies AnalyticsDashboardData,
+        period: deps.period,
+      }
+    },
+    component: function AdminAnalyticsComponent() {
+      const { data, period } = Route.useLoaderData() as {
+        data: AnalyticsDashboardData
+        period: AnalyticsDashboardPeriod
+      }
+      const navigate = useNavigate()
+      const { t } = useTranslation('byline-admin')
+
+      return (
+        <>
+          <BreadcrumbsClient
+            breadcrumbs={[
+              { label: t('chrome.menu.dashboard'), href: getAdminRoutePath() },
+              { label: t('analytics.title'), href: getAdminRoutePath('analytics') },
+            ]}
+          />
+          <AnalyticsDashboard
+            data={data}
+            period={period}
+            onPeriodChange={(nextPeriod) => {
+              navigate({
+                to: getAdminRoutePath('analytics'),
+                search: { period: nextPeriod },
+              })
+            }}
+          />
+        </>
+      )
+    },
+  })
+
+  return Route
+}

package/src/routes/create-admin-dashboard-route.test.node.ts

@@ -0,0 +1,70 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const mocks = vi.hoisted(() => ({
+  getCollectionStats: vi.fn(),
+  collections: [
+    { path: 'articles', labels: { singular: 'Article', plural: 'Articles' }, showStats: true },
+    {
+      singleton: true,
+      path: 'site-settings',
+      label: 'Site settings',
+      // Deliberately collection-like: kind must win even for malformed input.
+      showStats: true,
+    },
+  ],
+}))
+
+vi.mock('@tanstack/react-router', () => ({
+  createFileRoute: () => (options: Record<string, unknown>) => ({ options }),
+}))
+
+vi.mock('@byline/core', () => ({
+  filterReadableCollections: (collections: unknown[]) => collections,
+  getAdminConfig: () => ({ collections: mocks.collections }),
+  isSingleton: (definition: { singleton?: boolean }) => definition.singleton === true,
+}))
+
+vi.mock('../server-fns/collections/index.js', () => ({
+  getCollectionStats: mocks.getCollectionStats,
+}))
+vi.mock('../admin-shell/chrome/breadcrumbs/breadcrumbs-client.js', () => ({
+  BreadcrumbsClient: () => null,
+}))
+vi.mock('../admin-shell/chrome/dashboard.js', () => ({ AdminDashboard: () => null }))
+vi.mock('@byline/i18n/react', () => ({ useTranslation: () => ({ t: (key: string) => key }) }))
+vi.mock('./admin-path.js', () => ({ getAdminRoutePath: () => '/admin' }))
+
+import { createAdminDashboardRoute } from './create-admin-dashboard-route.js'
+
+type DashboardLoader = (input: {
+  context: { user: { is_super_admin: boolean; abilities: string[] } }
+}) => Promise<{ statsMap: Record<string, Array<{ status: string; count: number }>> }>
+
+describe('admin dashboard route loader', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    mocks.getCollectionStats.mockResolvedValue([{ status: 'published', count: 4 }])
+  })
+
+  it('never requests collection statistics for a singleton resource', async () => {
+    const route = createAdminDashboardRoute('/admin/') as {
+      options: { loader: DashboardLoader }
+    }
+
+    await expect(
+      route.options.loader({ context: { user: { is_super_admin: true, abilities: [] } } })
+    ).resolves.toEqual({ statsMap: { articles: [{ status: 'published', count: 4 }] } })
+
+    expect(mocks.getCollectionStats).toHaveBeenCalledOnce()
+    expect(mocks.getCollectionStats).toHaveBeenCalledWith('articles')
+    expect(mocks.getCollectionStats).not.toHaveBeenCalledWith('site-settings')
+  })
+})

package/src/routes/create-admin-dashboard-route.tsx

@@ -8,7 +8,12 @@
 
 import { createFileRoute } from '@tanstack/react-router'
 
-import { filterReadableCollections, getAdminConfig } from '@byline/core'
+import {
+  filterReadableCollections,
+  getAdminConfig,
+  isSingleton,
+  type MultiCollectionDefinition,
+} from '@byline/core'
 import { useTranslation } from '@byline/i18n/react'
 
 import { BreadcrumbsClient } from '../admin-shell/chrome/breadcrumbs/breadcrumbs-client.js'
@@ -40,7 +45,10 @@ export function createAdminDashboardRoute(path: string) {
 
       await Promise.all(
         visible
-          .filter((c) => c.showStats === true)
+          .filter(
+            (resource): resource is MultiCollectionDefinition =>
+              !isSingleton(resource) && resource.showStats === true
+          )
           .map(async (c) => {
             try {
               statsMap[c.path] = await getCollectionStats(c.path)