@bakery-framework/cli 2.1.1 → 2.2.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bakery-framework/cli",
-  "version": "2.1.1",
+  "version": "2.2.0",
   "description": "Bakery entry point and process supervision: mode dispatch, dev watcher, cluster.",
   "keywords": [
     "bakery",
@@ -39,10 +39,10 @@
     "bun": ">=1.4.0"
   },
   "dependencies": {
-    "@bakery-framework/core": "^2.1.1"
+    "@bakery-framework/core": "^2.2.0"
   },
   "peerDependencies": {
-    "@bakery-framework/orm": "^2.1.1"
+    "@bakery-framework/orm": "^2.2.0"
   },
   "peerDependenciesMeta": {
     "@bakery-framework/orm": {

package/src/build.ts

@@ -0,0 +1,33 @@
+import { errorMsg, serveLog } from '@bakery-framework/core/logger'
+
+/**
+ * `bakery --build`: the work a production start can have done ahead of it,
+ * which is whatever the app's plugins do in their `build` hook. plugin-vue
+ * bundles every page there.
+ *
+ * Production by construction: the flags make anything without `--dev`
+ * production, so the output is minified and keyed to the production cache,
+ * which `initConfig` empties first when the app or the framework has a new
+ * version. Nothing is served and no database is opened.
+ *
+ * Returns the exit code: 1 when any plugin failed, so a deploy stops there.
+ */
+export async function build(): Promise<number> {
+  try {
+    const { initConfig } = await import('@bakery-framework/core/core/config')
+    const { buildPlugins } = await import('@bakery-framework/core/startup')
+
+    await initConfig()
+    const { built, failed } = await buildPlugins()
+
+    if (failed.length) {
+      serveLog.BUILD_FAILED({ plugins: failed.join(', ') })
+      return 1
+    }
+    if (!built.length) serveLog.BUILD_NOTHING()
+    return 0
+  } catch (error: any) {
+    serveLog.UNHANDLED_ERR({ error: `bakery --build: ${errorMsg(error)}` })
+    return 1
+  }
+}

package/src/dev.ts

@@ -57,20 +57,31 @@ if (hasORM()) {
     const currentHash = await computeSchemaHash(schemaFromConfig(config))
     const [, stored] = await Try.catch(Bun.file(hashFile).text())
 
-    const decision = classifySchemaSync({
-      force: process.argv.includes('--sync') || process.argv.includes('-s'),
-      currentHash,
-      storedHash: stored?.trim() || null,
-      // Only meaningful for the default SQLite target; with a DB_URL there is
-      // no local file to stat, and the hash (which covers DB_URL) plus `--sync`
-      // are the levers for an externally reset database.
-      dbMissing:
-        !process.env.DB_URL &&
-        !process.env.DATABASE_URL &&
-        !(await Bun.file(`${Bakery.dataDir}/server.db`).exists()),
-    })
+    // Migrations mode checks on every boot instead: a migration changes the
+    // database without touching anything the hash covers, and the check is
+    // one catalog read that changes nothing. Its mismatches are reported and
+    // the server still boots, which is what a developer mid-migration needs.
+    const migrations = (config as Partial<ProcessedAppConfig> | undefined)
+      ?.migrations
+    const decision = migrations
+      ? 'check'
+      : classifySchemaSync({
+          force: process.argv.includes('--sync') || process.argv.includes('-s'),
+          currentHash,
+          storedHash: stored?.trim() || null,
+          // Only meaningful for the default SQLite target; with a DB_URL there is
+          // no local file to stat, and the hash (which covers DB_URL) plus `--sync`
+          // are the levers for an externally reset database.
+          dbMissing:
+            !process.env.DB_URL &&
+            !process.env.DATABASE_URL &&
+            !(await Bun.file(`${Bakery.dataDir}/server.db`).exists()),
+        })
 
-    if (decision === 'skip') {
+    if (decision === 'check') {
+      const { SyncService } = await import('@bakery-framework/orm/sync')
+      await SyncService.run()
+    } else if (decision === 'skip') {
       serveLog.SCHEMA_SYNC_SKIP()
       // Only on the skip path. When a sync runs it reports drift itself, from
       // the plan it just built; here nothing else would ever look. Measured at
@@ -86,10 +97,11 @@ if (hasORM()) {
       if (drift) serveLog.SCHEMA_DRIFT({ reason: drift.reason })
     } else {
       const { SyncService } = await import('@bakery-framework/orm/sync')
-      await SyncService.run()
-      // Recorded only after run() resolves: a failed or aborted sync must leave
-      // the previous hash (or none) behind so the next boot re-syncs.
-      if (currentHash) {
+      const synced = await SyncService.run()
+      // Recorded only after a sync that went through: a failed, aborted or
+      // refused one must leave the previous hash (or none) behind so the next
+      // boot syncs again.
+      if (synced && currentHash) {
         const [writeError] = await Try.catch(Bun.write(hashFile, currentHash))
         // A failed record is tolerated silently: its only consequence is that
         // the next boot syncs again, which is the safe direction.

package/src/index.ts

@@ -31,6 +31,7 @@ if (process.argv.includes('--help') || process.argv.includes('-h')) {
   console.log(`
 Usage: bakery [--dev] [--sync] [--threads N] [--port N]
        bakery --types
+       bakery --build
 
 Runs the application in the current directory: the one whose
 \`server.config.ts\` sits beside it.
@@ -42,6 +43,10 @@ Flags:
                     tsconfig.bakery.json) and exit, without starting a server.
                     Every dev boot does the same; a fresh clone or a CI job
                     needs it before tsc can find them.
+  --build           Run each plugin's build step and exit: plugin-vue bundles
+                    every page into a few content-hashed chunks, which a
+                    production start then serves. Run it before starting;
+                    a server keeps what it found when it started.
   --sync, -s        Run the schema sync before starting. Requires
                     @bakery-framework/orm; it is an error rather than a skip
                     when that is missing, because asking for a sync and
@@ -64,6 +69,13 @@ if (process.argv.includes('--types')) {
   process.exit(await writeTypes())
 }
 
+// The same reasoning: a command that exits, and production by construction,
+// since it is not `--dev`.
+if (process.argv.includes('--build')) {
+  const { build } = await import('./build')
+  process.exit(await build())
+}
+
 // Before any mode takes over, and before the config is read: `applyPortFlag`
 // writes `process.env.PORT`, which is what the worker, the startup banner and
 // the dev master's advertised URL all resolve from, and what the spawned dev
@@ -97,7 +109,11 @@ if (
     process.exit(1)
   }
   const { SyncService } = await import('@bakery-framework/orm/sync')
-  await SyncService.run()
+  // False is a database that does not match what the app declares: drift the
+  // migrations check found, or a Field.Sql column classic sync refused. Both
+  // were reported; serving queries typed against the wrong schema is not
+  // the safe direction.
+  if (!(await SyncService.run())) process.exit(1)
 }
 try {
   if (threadsOption !== null && !isDevWorker && !isThreadWorker && !isDev) {

package/src/pipeline.ts

@@ -1,10 +1,14 @@
+import type { Handler } from '@bakery-framework/core/handlers'
 import { is } from '@bakery-framework/core/utils/common'
-import { getClientIp } from '@bakery-framework/core/utils/http'
+import {
+  getClientIp,
+  type RateLimitKey,
+} from '@bakery-framework/core/utils/http'
 import { retryAfterSeconds } from './rate-limit'
 
 /**
- * The three decisions `worker.ts`'s `fetch` makes that are pure functions of
- * their arguments.
+ * The decisions `worker.ts`'s `fetch` makes that are pure functions of their
+ * arguments.
  *
  * They were inline in the `Bun.serve` callback, which is unreachable from a
  * test: `worker.ts` calls `Bun.serve` at module scope, so importing it binds a
@@ -38,7 +42,174 @@ export function isErrorResult(res: unknown): boolean {
 }
 
 /**
- * Which token bucket this request spends from.
+ * One bucket a request can be charged to: the top level, or a route rule,
+ * checked and ready to match.
+ */
+export interface RateLimitBucket {
+  /**
+   * `''` for the top level, the rule's prefix (lower case, one slash between
+   * segments) otherwise. Prepended to every key the bucket hashes, so a client
+   * spending at `/api/auth` and the same client spending elsewhere draw from
+   * two buckets, not one.
+   */
+  prefix: string
+  /** The prefix's segments, compared against the request's. */
+  segments: string[]
+  max: number
+  refill: number
+  keyBy?: RateLimitKey
+}
+
+/** `rateLimit` checked once: the top-level bucket, and the rules most specific first. */
+export interface CompiledRateLimit {
+  base: RateLimitBucket
+  routes: RateLimitBucket[]
+}
+
+/**
+ * Keyed by the setting object, which is frozen with the config for the life
+ * of the process, so each host's `rateLimit` is checked once. Weak, because a
+ * test seam (`__setTestConfig`) hands in new objects freely.
+ */
+const compiled = new WeakMap<RateLimitConfig, CompiledRateLimit>()
+
+/** A path's segments the way routing reads them: no empty ones, any case. */
+function pathSegments(path: string): string[] {
+  return path.toLowerCase().split('/').filter(Boolean)
+}
+
+function checkBudget(where: string, max: unknown, refill: unknown): void {
+  if (typeof max !== 'number' || !Number.isFinite(max) || max < 1) {
+    throw new Error(`${where}.max must be a number of 1 or more, got ${max}`)
+  }
+  if (typeof refill !== 'number' || !Number.isFinite(refill) || refill <= 0) {
+    throw new Error(
+      `${where}.refill must be a number above 0 (1 / 60 is one a minute), got ${refill}`,
+    )
+  }
+}
+
+function checkKeyBy(where: string, keyBy: unknown): void {
+  if (keyBy !== undefined && typeof keyBy !== 'function') {
+    throw new Error(`${where}.keyBy must be a function`)
+  }
+}
+
+/**
+ * Check a `rateLimit` setting and put its rules in matching order.
+ *
+ * Throws on a setting that cannot mean anything, naming the field: a refill
+ * of 0, a prefix without its leading slash, two rules for one prefix.
+ * `worker.ts` calls this for the base config and every host before it
+ * serves, so a typo stops the boot instead of surfacing on some later
+ * request, or as a bucket that admits nothing, which is what the pool makes
+ * of a refill it cannot use.
+ */
+export function compileRateLimit(
+  rl: RateLimitConfig,
+  where = 'rateLimit',
+): CompiledRateLimit {
+  const known = compiled.get(rl)
+  if (known) return known
+
+  checkBudget(where, rl.max, rl.refill)
+  checkKeyBy(where, rl.keyBy)
+  if (rl.routes !== undefined && !Array.isArray(rl.routes)) {
+    throw new Error(`${where}.routes must be an array of rules`)
+  }
+
+  const seen = new Set<string>()
+  const routes: RateLimitBucket[] = (rl.routes ?? []).map((rule, i) => {
+    const at = `${where}.routes[${i}]`
+    if (typeof rule?.prefix !== 'string' || !rule.prefix.startsWith('/')) {
+      throw new Error(`${at}.prefix must be a path starting with "/"`)
+    }
+    checkBudget(at, rule.max, rule.refill)
+    checkKeyBy(at, rule.keyBy)
+
+    const segments = pathSegments(rule.prefix)
+    const prefix = `/${segments.join('/')}`
+    if (seen.has(prefix)) {
+      throw new Error(`${at}.prefix covers ${prefix}, as an earlier rule does`)
+    }
+    seen.add(prefix)
+    return {
+      prefix,
+      segments,
+      max: rule.max,
+      refill: rule.refill,
+      keyBy: rule.keyBy,
+    }
+  })
+  // Longest first, so the first rule that matches is the most specific. Two
+  // rules of one length match the same path only if they are the same
+  // prefix, which the check above refuses.
+  routes.sort((a, b) => b.segments.length - a.segments.length)
+
+  const out: CompiledRateLimit = {
+    base: {
+      prefix: '',
+      segments: [],
+      max: rl.max,
+      refill: rl.refill,
+      keyBy: rl.keyBy,
+    },
+    routes,
+  }
+  compiled.set(rl, out)
+  return out
+}
+
+/**
+ * Check the base `rateLimit` and every host's, so a bad one fails the boot.
+ * A host entry's setting reaches requests as the same object (`config.ts`
+ * merges it by reference), so what is checked here is what is served.
+ */
+export function checkRateLimits(config: Readonly<ProcessedAppConfig>): void {
+  if (config.rateLimit) compileRateLimit(config.rateLimit)
+  for (const [host, entry] of Object.entries(config.hosts ?? {})) {
+    if (entry?.rateLimit) {
+      compileRateLimit(entry.rateLimit, `hosts['${host}'].rateLimit`)
+    }
+  }
+}
+
+/**
+ * The bucket a path is charged to: the rule with the longest prefix covering
+ * it, else the top level.
+ *
+ * Matched on segments, empty ones dropped and case folded, because that is how
+ * routing reads a path: `$routing.ts` splits on `/` and filters out the empty
+ * parts, so `/api//auth/sign-in` reaches `api/auth/sign-in.ts`. A rule matched
+ * on the raw string would let that spelling through on the top-level budget.
+ * Case is folded so a case-insensitive filesystem cannot open the same gap;
+ * where routing would refuse the spelling, charging it to the rule costs
+ * nothing.
+ */
+export function rateLimitBucket(
+  limit: CompiledRateLimit,
+  path: string,
+): RateLimitBucket {
+  if (limit.routes.length === 0) return limit.base
+
+  const segments = pathSegments(path)
+  for (const rule of limit.routes) {
+    if (rule.segments.length > segments.length) continue
+    let i = 0
+    while (i < rule.segments.length && rule.segments[i] === segments[i]) i++
+    if (i === rule.segments.length) return rule
+  }
+  return limit.base
+}
+
+/**
+ * Which token bucket this request spends from, within its rule.
+ *
+ * `keyBy` first, then the client address, then the hostname. A `keyBy` that
+ * returns nothing hands the request to its address rather than to a key it
+ * shares with every other unclassified request, which is what makes "the
+ * account when signed in, the address when not" one line:
+ * `keyBy: req => req.session.get('accountId')`.
  *
  * The `|| hostname` is not a tidy-up. An empty key is a *valid* string that
  * hashes to one fixed slot, so every client whose IP could not be determined,
@@ -48,11 +219,41 @@ export function isErrorResult(res: unknown): boolean {
  * per-host, which is the coarsest grouping that is still meaningful.
  */
 export function rateLimitKey(
-  rl: RateLimitConfig,
+  bucket: { keyBy?: RateLimitKey },
   req: Request,
   hostname: string,
 ): string {
-  return (rl.keyBy ? rl.keyBy(req) : getClientIp(req)) || hostname
+  return bucket.keyBy?.(req) || getClientIp(req) || hostname
+}
+
+/**
+ * The string a request's bucket is hashed from: its key, behind the rule's
+ * prefix when there is one. A newline cannot reach a key from a client (HTTP
+ * refuses one in a header value, and so in a cookie), so no key can pose as
+ * another rule's.
+ */
+export function bucketKey(bucket: RateLimitBucket, key: string): string {
+  return bucket.prefix ? `${bucket.prefix}\n${key}` : key
+}
+
+/**
+ * Whether a request was served as an asset: answered under 400 by a handler
+ * that says, of this request, that what it served was one. See
+ * `Handler.isAsset`. A status of 0 stands for no response at all, a
+ * WebSocket upgrade for one.
+ */
+export function answeredAsAsset(
+  handler: typeof Handler | undefined,
+  path: string,
+  req: Request,
+  status: number,
+): boolean {
+  return (
+    handler !== undefined &&
+    status > 0 &&
+    status < 400 &&
+    handler.isAsset(path, req)
+  )
 }
 
 /**

package/src/rate-limit.ts

@@ -1,14 +1,14 @@
 import { LRUCache } from '@bakery-framework/core/cache/lru'
+import { hostKey } from '@bakery-framework/core/core/bakery'
+import { RATE_LIMIT_SLOT_COUNT } from '@bakery-framework/core/utils/shared-pool'
 
 /**
- * Number of token buckets in `SharedMemoryPool`'s rate-limit region.
- *
- * Must match `RATE_LIMIT_SLOT_COUNT` there: `consumeToken()` fails closed on an
- * out-of-range slot, so a value that is too large would deny every request that
- * hashed past the end of the region. `rate-limit.test.ts` cross-checks this
- * against a real pool rather than trusting the two constants to stay in step.
+ * Number of token buckets in `SharedMemoryPool`'s rate-limit region, taken
+ * from the pool itself. It was a second constant here with a comment asking
+ * that the two be kept in step, and `consumeToken()` fails closed on a slot
+ * past the end, so a mismatch would deny every client hashed out of range.
  */
-export const RATE_LIMIT_SLOTS = 1024
+export const RATE_LIMIT_SLOTS = RATE_LIMIT_SLOT_COUNT
 
 /**
  * Map a rate-limit key (client IP, or whatever `rateLimit.keyBy` returns) onto
@@ -94,3 +94,61 @@ export function __resetRateLimitLogState(): void {
 export function retryAfterSeconds(refill: number): number {
   return Math.max(1, Math.ceil(1 / refill))
 }
+
+/**
+ * Bound for the set of URLs proven to be assets, sized like the route cache it
+ * sits beside (`HandlerMap.routeCache`): an entry per asset URL an app
+ * serves, per configured host. Past it the LRU evicts, and an evicted URL
+ * borrows a token on its next request and is proven again.
+ */
+export const PROVEN_ASSET_KEYS = import.meta.env.THREAD_WORKER ? 500 : 5000
+
+/** Hashes of asset URLs some handler has served successfully. */
+const provenAssets = new LRUCache<bigint, true>(PROVEN_ASSET_KEYS)
+
+/**
+ * What identifies a request to the proven-asset set: its host, path and query,
+ * and what the browser said it was fetching (`Sec-Fetch-Dest`).
+ *
+ * The destination is part of it because one URL can be two things: a Vue
+ * page answers its own URL with HTML for a navigation and with its script for
+ * an import. Proving the script must not make the page free. A client can
+ * send any `Sec-Fetch-Dest` it likes, but only to its own cost: a different
+ * value is a different key, and a key is proven only by a handler serving an
+ * asset for it.
+ *
+ * Hashed, because the query is the client's, and 5000 raw URLs at the length
+ * a client may send could hold tens of megabytes. A 64-bit hash collision
+ * would make one URL free on another's proof: for any one request, a chance
+ * of 5000 in 2^64, about 3 in 10^16.
+ *
+ * Must be called inside the request's `hostStore` scope, as `hostKey` is.
+ */
+export function assetKey(path: string, search: string, req: Request): bigint {
+  const dest = req.headers.get('sec-fetch-dest') ?? ''
+  return Bun.hash.wyhash(`${hostKey(path + search)}
+${dest}`)
+}
+
+/** Whether a handler has served this key as an asset, and still holds it. */
+export function isProvenAsset(key: bigint): boolean {
+  return provenAssets.get(key) === true
+}
+
+export function proveAsset(key: bigint): void {
+  provenAssets.set(key, true)
+}
+
+/**
+ * Drop a key whose request skipped the bucket and then was not served as an
+ * asset: a deleted file, a refused range, a guard that said no. The next
+ * request for it borrows a token like any other.
+ */
+export function forgetAsset(key: bigint): void {
+  provenAssets.delete(key)
+}
+
+/** Test seam, beside `__resetRateLimitLogState`. */
+export function __resetProvenAssets(): void {
+  provenAssets.clear()
+}

package/src/worker.ts

@@ -19,12 +19,29 @@ import {
 } from '@bakery-framework/core/router'
 import { Session } from '@bakery-framework/core/session'
 import { runStartupBanner, setupServer } from '@bakery-framework/core/startup'
-import { deferredValue, Try } from '@bakery-framework/core/utils/common'
+import { Try } from '@bakery-framework/core/utils/common'
 import { parsedUrl } from '@bakery-framework/core/utils/http'
 import { COUNTER_SLOTS } from '@bakery-framework/core/utils/shared-pool'
 import { hasORM } from './orm'
-import { isErrorResult, rateLimitKey, tooManyRequests } from './pipeline'
-import { rateLimitSlot, sampleRateLimitLog } from './rate-limit'
+import {
+  answeredAsAsset,
+  bucketKey,
+  checkRateLimits,
+  compileRateLimit,
+  isErrorResult,
+  type RateLimitConfig,
+  rateLimitBucket,
+  rateLimitKey,
+  tooManyRequests,
+} from './pipeline'
+import {
+  assetKey,
+  forgetAsset,
+  isProvenAsset,
+  proveAsset,
+  rateLimitSlot,
+  sampleRateLimitLog,
+} from './rate-limit'
 import { runShutdownSequence } from './shutdown'
 
 /**
@@ -130,7 +147,109 @@ try {
   process.exit(1)
 }
 
+/**
+ * What the limiter did with a request, for `settleRequest` to finish once the
+ * response is known: the request's asset key, whether it skipped the bucket
+ * as a proven asset, and otherwise the slot it borrowed a token from.
+ */
+type RateLimitTicket = {
+  asset: bigint
+  skipped: boolean
+  slot: number
+  refill: number
+}
+
+/**
+ * Let a request in, or answer it 429.
+ *
+ * A URL some handler has already served as an asset skips the bucket (see
+ * `Handler.isAsset`). Anything else borrows a token before it is routed: the
+ * charge cannot wait for the response, because admitting first and charging
+ * afterwards lets a burst of any size through at once.
+ */
+function admitRequest(
+  rl: RateLimitConfig,
+  path: string,
+  search: string,
+  req: Request,
+  hostname: string,
+): RateLimitTicket | Response {
+  const asset = assetKey(path, search, req)
+  if (isProvenAsset(asset)) return { asset, skipped: true, slot: -1, refill: 0 }
+
+  const bucket = rateLimitBucket(compileRateLimit(rl), path)
+  const key = rateLimitKey(bucket, req, hostname)
+  const slot = rateLimitSlot(bucketKey(bucket, key))
+  if (Bakery.sharedPool.consumeToken(slot, bucket.max, bucket.refill)) {
+    return { asset, skipped: false, slot, refill: bucket.refill }
+  }
+
+  // Sampled: availability under flood: stdout is effectively synchronous on
+  // Windows, so a line per rejection replays the flood the limiter just
+  // absorbed as a logging flood. Sampled per bucket, so a client limited at
+  // sign-in and elsewhere gets a line for each.
+  const suppressed = sampleRateLimitLog(bucketKey(bucket, key))
+  if (suppressed !== null) {
+    const prefix = bucket.prefix
+    if (prefix && suppressed > 0) {
+      serveLog.RATE_LIMITED_ROUTE_SUPPRESSED({
+        ip: key,
+        prefix,
+        count: suppressed,
+      })
+    } else if (prefix) {
+      serveLog.RATE_LIMITED_ROUTE({ ip: key, prefix })
+    } else if (suppressed > 0) {
+      serveLog.RATE_LIMITED_SUPPRESSED({ ip: key, count: suppressed })
+    } else {
+      serveLog.RATE_LIMITED({ ip: key })
+    }
+  }
+  return tooManyRequests(bucket.refill)
+}
+
+/**
+ * Settle the limiter's account with a request once its response is ready.
+ *
+ * Served as an asset: its URL is remembered, and a borrowed token goes back.
+ * Skipped the bucket as a proven asset and then was not one (a deleted file,
+ * a refused range, a guard that said no): the URL is forgotten and the
+ * request is charged after the fact, so a URL that has started failing costs
+ * what any other request costs. Anything else keeps the token it spent.
+ */
+function settleRequest(
+  ticket: RateLimitTicket,
+  rl: RateLimitConfig,
+  path: string,
+  req: Request,
+  hostname: string,
+  res: Response | undefined,
+): void {
+  const handler = hostStore.getStore()?.handler
+  if (answeredAsAsset(handler, path, req, res?.status ?? 0)) {
+    proveAsset(ticket.asset)
+    if (!ticket.skipped)
+      Bakery.sharedPool.refundToken(ticket.slot, ticket.refill)
+    return
+  }
+  if (!ticket.skipped) return
+
+  forgetAsset(ticket.asset)
+  const bucket = rateLimitBucket(compileRateLimit(rl), path)
+  const key = rateLimitKey(bucket, req, hostname)
+  Bakery.sharedPool.consumeToken(
+    rateLimitSlot(bucketKey(bucket, key)),
+    bucket.max,
+    bucket.refill,
+  )
+}
+
 try {
+  // Before anything binds: a rate limit that cannot mean anything (a refill
+  // of 0, a prefix without its slash) stops the boot here, naming the field,
+  // in the catch below.
+  checkRateLimits(Bakery.config)
+
   Bakery.server = Bun.serve({
     port: PORT,
     hostname: Bakery.config.host,
@@ -150,26 +269,30 @@ try {
         const path = url.pathname
         req.startNs = Bun.nanoseconds()
         req.__hostname = hostname
-        deferredValue(req, 'session', Session.from)
+
+        // Before the limiter, whose `keyBy` may key on the account. A store
+        // that cannot be read answers the request as an error: carrying on
+        // without the session would treat every signed-in visitor as signed
+        // out for as long as the store is down.
+        const loading = Session.attach(req)
+        if (loading) {
+          const [loadError] = await Try.catch(loading)
+          if (loadError) {
+            Bakery.sharedPool.incrementCounter(COUNTER_SLOTS.TOTAL_ERRORS, 1)
+            serveLog.SESSION_LOAD_ERR({ error: errorMsg(loadError) })
+            return await processResponse(
+              await handleRequestError(path, req, loadError),
+              req,
+            )
+          }
+        }
 
         const rl = Bakery.config.rateLimit
+        let ticket: RateLimitTicket | null = null
         if (rl) {
-          const key = rateLimitKey(rl, req, hostname)
-          const slot = rateLimitSlot(key)
-          if (!Bakery.sharedPool.consumeToken(slot, rl.max, rl.refill)) {
-            // Sampled: availability under flood: stdout is effectively
-            // synchronous on Windows, so a line per rejection replays the
-            // flood the limiter just absorbed as a logging flood.
-            const suppressed = sampleRateLimitLog(key)
-            if (suppressed !== null) {
-              if (suppressed > 0) {
-                serveLog.RATE_LIMITED_SUPPRESSED({ ip: key, count: suppressed })
-              } else {
-                serveLog.RATE_LIMITED({ ip: key })
-              }
-            }
-            return tooManyRequests(rl.refill)
-          }
+          const admitted = admitRequest(rl, path, url.search, req, hostname)
+          if (admitted instanceof Response) return admitted
+          ticket = admitted
         }
 
         Bakery.sharedPool.incrementCounter(COUNTER_SLOTS.TOTAL_REQUESTS, 1)
@@ -197,7 +320,9 @@ try {
           COUNTER_SLOTS.LATENCY_SUM_MS,
           elapsedMs,
         )
-        return processResponse(resp, req)
+        const res = await processResponse(resp, req)
+        if (rl && ticket) settleRequest(ticket, rl, path, req, hostname, res)
+        return res
       })
     },