@nifrajs/core 5.5.0 → 5.6.0

package/src/file-type.ts

@@ -0,0 +1,130 @@
+/**
+ * Magic-byte file-type detection - trust the bytes, not the `Content-Type` header (which a client
+ * sets freely). Reads only the leading bytes; imports nothing, so it is edge-safe. Covers the common
+ * upload types; returns `null` for anything unrecognized (incl. text formats like SVG/CSV that have no
+ * magic number - handle those explicitly if you accept them).
+ *
+ * The shared owner for every type-by-bytes check: `@nifrajs/schema/form`'s `t.file({ accept })` and
+ * `@nifrajs/uploads`'s `validateUpload` must give one file one verdict, so both read this module.
+ */
+
+export interface FileType {
+  /** Detected MIME type, e.g. `"image/png"`. */
+  readonly mime: string
+  /** Canonical extension (no dot), e.g. `"png"`. */
+  readonly ext: string
+}
+
+/**
+ * How many leading bytes {@link detectFileType} looks at. Reading this many from the start of a file
+ * (`file.slice(0, FILE_TYPE_PREFIX_BYTES)`) is enough for every type it knows: it reaches the first four
+ * compatible brands of an ISO-BMFF `ftyp` box, where an AVIF with the generic `mif1` brand says `avif`.
+ */
+export const FILE_TYPE_PREFIX_BYTES = 32
+
+/**
+ * Every MIME type {@link detectFileType} can return. An allow-list entry outside this set (and
+ * outside a `type/*` wildcard that covers one of them) can never match, so check a configured
+ * allow-list against it up front instead of rejecting every upload at request time.
+ */
+export const DETECTABLE_MIME_TYPES: readonly string[] = [
+  "image/jpeg",
+  "image/png",
+  "image/gif",
+  "image/webp",
+  "audio/wav",
+  "video/x-msvideo",
+  "image/avif",
+  "image/heic",
+  "audio/mp4",
+  "video/mp4",
+  "video/webm",
+  "audio/ogg",
+  "audio/mpeg",
+  "application/pdf",
+  "application/zip",
+  "application/gzip",
+]
+
+/**
+ * An MPEG audio frame header: an 11-bit frame sync, then a version, layer, bitrate and sample rate that
+ * are not reserved values. An MP3 needs no ID3 tag, so this is how an untagged one starts. AAC's ADTS
+ * sync shares the first 12 bits, but its layer is always the reserved `00`.
+ */
+function mpegAudioFrame(bytes: Uint8Array): boolean {
+  const [b0 = 0, b1 = 0, b2 = 0] = bytes
+  if (bytes.length < 4 || b0 !== 0xff || (b1 & 0xe0) !== 0xe0) return false
+  const version = (b1 >> 3) & 0b11
+  const layer = (b1 >> 1) & 0b11
+  const bitrate = b2 >> 4
+  const sampleRate = (b2 >> 2) & 0b11
+  return version !== 0b01 && layer !== 0b00 && bitrate !== 0b1111 && sampleRate !== 0b11
+}
+
+/** Detect a file's type from its magic bytes, or `null` if unrecognized. */
+export function detectFileType(bytes: Uint8Array): FileType | null {
+  const at = (offset: number, ...sig: number[]): boolean =>
+    sig.every((byte, i) => bytes[offset + i] === byte)
+
+  // Images
+  if (at(0, 0xff, 0xd8, 0xff)) return { mime: "image/jpeg", ext: "jpg" }
+  if (at(0, 0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a))
+    return { mime: "image/png", ext: "png" }
+  if (at(0, 0x47, 0x49, 0x46, 0x38)) return { mime: "image/gif", ext: "gif" }
+
+  // RIFF container (bytes 0-3 "RIFF", 8-11 the form type)
+  if (at(0, 0x52, 0x49, 0x46, 0x46)) {
+    if (at(8, 0x57, 0x45, 0x42, 0x50)) return { mime: "image/webp", ext: "webp" }
+    if (at(8, 0x57, 0x41, 0x56, 0x45)) return { mime: "audio/wav", ext: "wav" }
+    if (at(8, 0x41, 0x56, 0x49, 0x20)) return { mime: "video/x-msvideo", ext: "avi" }
+  }
+
+  // ISO-BMFF (`ftyp` box at offset 4) - mp4 / avif / heic / m4a, disambiguated by the major brand.
+  if (at(4, 0x66, 0x74, 0x79, 0x70)) {
+    const brandAt = (offset: number): string =>
+      String.fromCharCode(
+        bytes[offset] ?? 0,
+        bytes[offset + 1] ?? 0,
+        bytes[offset + 2] ?? 0,
+        bytes[offset + 3] ?? 0,
+      )
+    const brand = brandAt(8)
+    // The compatible brands follow the minor version, to the end of the ftyp box. Only those inside the
+    // prefix count: the box size is the sender's claim, and a verdict must not depend on bytes a caller
+    // that sniffs `FILE_TYPE_PREFIX_BYTES` never reads.
+    const boxEnd = Math.min(
+      bytes.length,
+      FILE_TYPE_PREFIX_BYTES,
+      ((bytes[0] ?? 0) << 24) | ((bytes[1] ?? 0) << 16) | ((bytes[2] ?? 0) << 8) | (bytes[3] ?? 0),
+    )
+    const compatible: string[] = []
+    for (let offset = 16; offset + 4 <= boxEnd; offset += 4) compatible.push(brandAt(offset))
+    // A HEIF-family file whose major brand is the generic `mif1`/`msf1`/`miaf` names its codec among
+    // the compatible brands: AVIF says `avif`/`avis`.
+    const avif = (name: string): boolean => name === "avif" || name === "avis"
+    const generic = brand === "mif1" || brand === "msf1" || brand === "miaf"
+    if (avif(brand) || (generic && compatible.some(avif)))
+      return { mime: "image/avif", ext: "avif" }
+    if (brand.startsWith("hei") || brand.startsWith("hev") || generic) {
+      return { mime: "image/heic", ext: "heic" }
+    }
+    // Audio brands share the ISO-BMFF container but are NOT video - labeling them `video/mp4` would
+    // both reject real audio under an `audio/*` allow-list and admit it under `video/*`. `M4A `/`M4B `
+    // are AAC audio / audiobooks.
+    if (brand === "M4A " || brand === "M4B ") return { mime: "audio/mp4", ext: "m4a" }
+    return { mime: "video/mp4", ext: "mp4" }
+  }
+
+  // A/V + archives
+  if (at(0, 0x1a, 0x45, 0xdf, 0xa3)) return { mime: "video/webm", ext: "webm" } // Matroska/WebM
+  if (at(0, 0x4f, 0x67, 0x67, 0x53)) return { mime: "audio/ogg", ext: "ogg" }
+  if (at(0, 0x49, 0x44, 0x33)) return { mime: "audio/mpeg", ext: "mp3" } // ID3 tag
+  if (mpegAudioFrame(bytes)) return { mime: "audio/mpeg", ext: "mp3" } // an untagged MP3
+  if (at(0, 0x25, 0x50, 0x44, 0x46)) return { mime: "application/pdf", ext: "pdf" } // "%PDF"
+  if (at(0, 0x50, 0x4b, 0x03, 0x04) || at(0, 0x50, 0x4b, 0x05, 0x06)) {
+    return { mime: "application/zip", ext: "zip" } // also docx/xlsx/odt containers
+  }
+  if (at(0, 0x1f, 0x8b)) return { mime: "application/gzip", ext: "gz" }
+
+  return null
+}

package/src/index.ts

@@ -16,7 +16,7 @@
  * read its own package.json at runtime. `scripts/version.ts` rewrites it on every release bump and
  * `check:publish` asserts it equals `@nifrajs/core`'s package version.
  */
-export const VERSION = "5.5.0" as const
+export const VERSION = "5.6.0" as const
 
 export type Version = typeof VERSION
 
@@ -58,6 +58,7 @@ export {
   markAuthenticatedRequest,
   rejected,
 } from "./server/auth.ts"
+export { beforeHandler } from "./server/before-handler.ts"
 export type {
   Context,
   Params,

package/src/internal/route-program.ts

@@ -11,8 +11,10 @@ import type { StandardSchemaV1 } from "../schema/standard.ts"
 import { markAuthenticatedRequest } from "../server/auth.ts"
 import { declaredHeaderNames } from "../server/headers.ts"
 import { pathnameOf } from "../server/http.ts"
+import type { Logger } from "../server/logger.ts"
 import { queryObjectOf } from "../server/query.ts"
 import type { Registry } from "../server/registry.ts"
+import { toResponse } from "../server/respond.ts"
 import {
   CONTEXT_SEARCH,
   CONTEXT_SET,
@@ -262,6 +264,77 @@ function authenticationInputOf(
   })
 }
 
+/**
+ * Run the `authenticate()` stages a mount was registered after, in order, against the request the
+ * mount would receive: `undefined` once each one authenticated, else the response that refuses it. A
+ * stage that throws or decides nothing valid answers 503, and its cause goes to `logger`, as a route
+ * error no hook answers does.
+ */
+export function authenticateMount(
+  stages: readonly RawAuthStage[],
+  request: Request,
+  platform: { readonly env?: unknown; readonly clientIp?: string | undefined } | undefined,
+  logger: Logger,
+): MaybePromise<Response | undefined> {
+  let query: Readonly<Record<string, string | readonly string[]>> | undefined
+  const search = (() => {
+    const at = request.url.indexOf("?")
+    return at === -1 ? "" : request.url.slice(at)
+  })()
+  const input = Object.freeze({
+    method: request.method,
+    pathname: pathnameOf(request.url),
+    headers: authHeadersOf(request),
+    params: Object.freeze({}),
+    search,
+    get query() {
+      query ??= frozenQueryOf(search)
+      return query
+    },
+    request,
+    env: platform?.env,
+    clientIp: platform?.clientIp,
+    signal: request.signal,
+  })
+  const unavailable = (error: unknown): Response => {
+    logger.error("authenticate() stage failed before a mount", {
+      method: request.method,
+      path: input.pathname,
+      error: error instanceof Error ? error.message : String(error),
+    })
+    return toResponse(defaultAuthenticationResponse("unavailable"), EMPTY_RESPONSE_CONTROLS)
+  }
+  const decide = (
+    index: number,
+    result: import("../server/auth.ts").AuthenticationResult<unknown>,
+  ): MaybePromise<Response | undefined> => {
+    if (!isAuthenticationDecision(result)) {
+      const id = stages[index]?.id
+      return unavailable(new TypeError(`authenticate() stage "${id}" returned an invalid decision`))
+    }
+    if (result.kind === "rejected") {
+      const refusal = result.response ?? defaultAuthenticationResponse(result.reason)
+      return refusal instanceof Response ? refusal : toResponse(refusal, EMPTY_RESPONSE_CONTROLS)
+    }
+    markAuthenticatedRequest(request)
+    return run(index + 1)
+  }
+  const run = (index: number): MaybePromise<Response | undefined> => {
+    const stage = stages[index]
+    if (stage === undefined) return undefined
+    let outcome: MaybePromise<import("../server/auth.ts").AuthenticationResult<unknown>>
+    try {
+      outcome = stage.run(input)
+    } catch (error) {
+      return unavailable(error)
+    }
+    return outcome instanceof Promise
+      ? outcome.then((settled) => decide(index, settled), unavailable)
+      : decide(index, outcome)
+  }
+  return run(0)
+}
+
 function defaultAuthenticationResponse(
   reason: import("../server/auth.ts").AuthenticationFailureReason | undefined,
 ): ResponseResult {
@@ -270,6 +343,25 @@ function defaultAuthenticationResponse(
   return status(401, { ok: false, error: "unauthorized" })
 }
 
+/** Whether a stage returned a decision it may: a rejection with a known reason and a response, if
+ * any, that answers; or a principal. */
+function isAuthenticationDecision(
+  result: import("../server/auth.ts").AuthenticationResult<unknown>,
+): boolean {
+  return (
+    result !== null &&
+    typeof result === "object" &&
+    (result.kind === "rejected"
+      ? validAuthenticationFailureReason(result.reason) &&
+        (result.response === undefined ||
+          result.response instanceof Response ||
+          isResponseResult(result.response))
+      : result.kind === "authenticated" &&
+        result.principal !== null &&
+        result.principal !== undefined)
+  )
+}
+
 function validAuthenticationFailureReason(
   value: unknown,
 ): value is import("../server/auth.ts").AuthenticationFailureReason | undefined {
@@ -410,18 +502,7 @@ function finishAuthentication<T>(
   next: number,
   validationComplete = false,
 ): ProgramResult<T> {
-  if (
-    result === null ||
-    typeof result !== "object" ||
-    (result.kind === "rejected"
-      ? !validAuthenticationFailureReason(result.reason) ||
-        (result.response !== undefined &&
-          !(result.response instanceof Response) &&
-          !isResponseResult(result.response))
-      : result.kind !== "authenticated" ||
-        result.principal === null ||
-        result.principal === undefined)
-  ) {
+  if (!isAuthenticationDecision(result)) {
     const id = program.authStages[next - 1]!.id
     const error = new TypeError(`authenticate() stage "${id}" returned an invalid decision`)
     return failAuthentication(host, entry, ctx, finalize, wrapResponse, error)
@@ -499,7 +580,7 @@ async function continueFastAuthenticatedProgram<T>(
   try {
     const settled = await pending
     if (settled !== undefined) return wrapResponse(settled as Response | ResponseResult)
-    return await runFastAuthenticatedProgram(
+    const outcome = runFastAuthenticatedProgram(
       host,
       entry,
       program,
@@ -509,6 +590,7 @@ async function continueFastAuthenticatedProgram<T>(
       wrapResponse,
       validationIndex,
     )
+    return outcome instanceof Promise ? await outcome : outcome
   } catch (error) {
     return await host.handleProgramError(entry, error, ctx, finalize, wrapResponse)
   }
@@ -585,7 +667,7 @@ async function continueValidationBeforeAuthentication<T>(
   try {
     const settled = await pending
     if (settled !== undefined) return wrapResponse(settled as Response | ResponseResult)
-    return await runValidationBeforeAuthentication(
+    const outcome = runValidationBeforeAuthentication(
       host,
       entry,
       program,
@@ -595,6 +677,7 @@ async function continueValidationBeforeAuthentication<T>(
       wrapResponse,
       validationIndex,
     )
+    return outcome instanceof Promise ? await outcome : outcome
   } catch (error) {
     return await host.handleProgramError(entry, error, ctx, finalize, wrapResponse)
   }
@@ -616,7 +699,7 @@ function runValidatedProgram<T>(
 type ProgramResult<T> = MaybePromise<T>
 
 /** Opt-in sensitive-route lane: run authentication/policy hooks before parsing untrusted input. */
-async function runAuthBeforeValidation<T>(
+function runAuthBeforeValidation<T>(
   host: RouteProgramRuntime,
   entry: RouteEntry,
   program: RouteProgram,
@@ -625,23 +708,53 @@ async function runAuthBeforeValidation<T>(
   finalize: (result: unknown, set: CtxSet, ctx?: RawContext) => T,
   wrapResponse: (response: Response | ResponseResult) => T,
   gated = false,
-): Promise<T> {
+  deriveStart = 0,
+  beforeStart = 0,
+  validationStart = 0,
+): ProgramResult<T> {
   try {
     if (!gated) {
-      if (program.hasDecorations) Object.assign(ctx, program.decorations)
+      if (deriveStart === 0 && beforeStart === 0 && program.hasDecorations)
+        Object.assign(ctx, program.decorations)
 
-      for (const derive of program.derives) {
-        const result = derive(ctx)
-        const settled = result instanceof Promise ? await result : result
-        if (isEarly(settled)) return finishEarly(host, entry, ctx, settled, finalize, wrapResponse)
-        Object.assign(ctx, settled)
+      for (let i = deriveStart; i < program.derives.length; i++) {
+        const result = program.derives[i]!(ctx)
+        if (result instanceof Promise) {
+          return continueProgram(
+            host,
+            entry,
+            program,
+            source,
+            ctx,
+            finalize,
+            wrapResponse,
+            { kind: "derive", next: i + 1, policy: true },
+            result,
+            undefined,
+          )
+        }
+        if (isEarly(result)) return finishEarly(host, entry, ctx, result, finalize, wrapResponse)
+        Object.assign(ctx, result)
       }
 
-      for (const before of program.beforeHandle) {
-        const result = before(ctx)
-        const settled = result instanceof Promise ? await result : result
-        if (settled !== undefined)
-          return finishEarly(host, entry, ctx, settled, finalize, wrapResponse)
+      for (let i = beforeStart; i < program.beforeHandle.length; i++) {
+        const result = program.beforeHandle[i]!(ctx)
+        if (result instanceof Promise) {
+          return continueProgram(
+            host,
+            entry,
+            program,
+            source,
+            ctx,
+            finalize,
+            wrapResponse,
+            { kind: "before", next: i + 1, policy: true },
+            result,
+            undefined,
+          )
+        }
+        if (result !== undefined)
+          return finishEarly(host, entry, ctx, result, finalize, wrapResponse)
       }
 
       // The policy hooks have passed, so the idempotency gate may buffer the body now. Not awaited:
@@ -653,30 +766,52 @@ async function runAuthBeforeValidation<T>(
       }
     }
 
-    for (const stage of program.validationStages) {
+    for (let i = validationStart; i < program.validationStages.length; i++) {
+      const stage = program.validationStages[i]!
       const result =
         stage.kind === "body"
-          ? await host.readProgramBody(entry, source, ctx)
+          ? host.readProgramBody(entry, source, ctx)
           : host.validateProgramStage(entry, stage, source, ctx)
-      const settled = result instanceof Promise ? await result : result
-      if (settled !== undefined) return wrapResponse(settled)
+      if (result instanceof Promise) {
+        return continueProgram(
+          host,
+          entry,
+          program,
+          source,
+          ctx,
+          finalize,
+          wrapResponse,
+          { kind: "validation", next: i + 1, policy: true },
+          result,
+          undefined,
+        )
+      }
+      if (result !== undefined) return wrapResponse(result)
     }
 
-    let result = await program.handler(ctx)
-    for (const after of program.afterHandle) {
-      const transformed = after(result, ctx)
-      result = transformed instanceof Promise ? await transformed : transformed
-    }
-    return await host.finishProgramResult(entry, ctx, result, finalize, wrapResponse)
+    // A pending outcome here already met the error boundary (continueProgram or the response
+    // contract), so wrapping it in another catch would only add a promise.
+    return runHooksSync(
+      host,
+      entry,
+      program,
+      source,
+      ctx,
+      finalize,
+      wrapResponse,
+      program.derives.length,
+      program.beforeHandle.length,
+      undefined,
+    )
   } catch (error) {
-    return await host.handleProgramError(entry, error, ctx, finalize, wrapResponse)
+    return host.handleProgramError(entry, error, ctx, finalize, wrapResponse)
   }
 }
 
 type PendingPhase =
-  | { readonly kind: "validation"; readonly next: number }
-  | { readonly kind: "derive"; readonly next: number }
-  | { readonly kind: "before"; readonly next: number }
+  | { readonly kind: "validation"; readonly next: number; readonly policy?: true }
+  | { readonly kind: "derive"; readonly next: number; readonly policy?: true }
+  | { readonly kind: "before"; readonly next: number; readonly policy?: true }
   | { readonly kind: "handler" }
   | { readonly kind: "after"; readonly next: number }
 
@@ -757,7 +892,7 @@ function runSync<T>(
     }
     if (outcome !== undefined) return wrapResponse(outcome)
   }
-  return runHooksSync(host, entry, program, source, ctx, finalize, wrapResponse, 0, 0, 0, initial)
+  return runHooksSync(host, entry, program, source, ctx, finalize, wrapResponse, 0, 0, initial)
 }
 
 function runHooksSync<T>(
@@ -770,7 +905,6 @@ function runHooksSync<T>(
   wrapResponse: (response: Response | ResponseResult) => T,
   deriveIndex: number,
   beforeIndex: number,
-  afterIndex: number,
   initial: unknown,
 ): ProgramResult<T> {
   for (let i = deriveIndex; i < program.derives.length; i++) {
@@ -826,7 +960,20 @@ function runHooksSync<T>(
       initial,
     )
   }
-  let result = output
+  return runAfterSync(host, entry, program, source, ctx, finalize, wrapResponse, 0, output)
+}
+
+function runAfterSync<T>(
+  host: RouteProgramRuntime,
+  entry: RouteEntry,
+  program: RouteProgram,
+  source: RequestSource,
+  ctx: RawContext,
+  finalize: (result: unknown, set: CtxSet, ctx?: RawContext) => T,
+  wrapResponse: (response: Response | ResponseResult) => T,
+  afterIndex: number,
+  result: unknown,
+): ProgramResult<T> {
   for (let i = afterIndex; i < program.afterHandle.length; i++) {
     const outcome = program.afterHandle[i]!(result, ctx)
     if (outcome instanceof Promise) {
@@ -876,7 +1023,7 @@ async function continueProgram<T>(
     } else {
       result = settled
     }
-    return await runAsyncStages(
+    const outcome = runAsyncStages(
       host,
       entry,
       program,
@@ -887,12 +1034,13 @@ async function continueProgram<T>(
       pendingPhase,
       result,
     )
+    return outcome instanceof Promise ? await outcome : outcome
   } catch (error) {
     return await host.handleProgramError(entry, error, ctx, finalize, wrapResponse)
   }
 }
 
-async function runAsyncStages<T>(
+function runAsyncStages<T>(
   host: RouteProgramRuntime,
   entry: RouteEntry,
   program: RouteProgram,
@@ -902,54 +1050,74 @@ async function runAsyncStages<T>(
   wrapResponse: (response: Response | ResponseResult) => T,
   pendingPhase: PendingPhase,
   result: unknown,
-): Promise<T> {
-  try {
-    if (pendingPhase.kind === "validation") {
-      const validations = program.validationStages
-      for (let i = pendingPhase.next; i < validations.length; i++) {
-        const stage = validations[i]!
-        const outcome =
-          stage.kind === "body"
-            ? await host.readProgramBody(entry, source, ctx)
-            : host.validateProgramStage(entry, stage, source, ctx)
-        const settled = outcome instanceof Promise ? await outcome : outcome
-        if (settled !== undefined) return wrapResponse(settled)
-      }
-    }
-
-    const deriveStart = pendingPhase.kind === "derive" ? pendingPhase.next : 0
-    if (pendingPhase.kind === "validation" || pendingPhase.kind === "derive") {
-      for (let i = deriveStart; i < program.derives.length; i++) {
-        const outcome = program.derives[i]!(ctx)
-        const settled = outcome instanceof Promise ? await outcome : outcome
-        if (isEarly(settled)) return finishEarly(host, entry, ctx, settled, finalize, wrapResponse)
-        Object.assign(ctx, settled)
-      }
-    }
-
-    const beforeStart = pendingPhase.kind === "before" ? pendingPhase.next : 0
-    if (
-      pendingPhase.kind === "validation" ||
-      pendingPhase.kind === "derive" ||
-      pendingPhase.kind === "before"
-    ) {
-      for (let i = beforeStart; i < program.beforeHandle.length; i++) {
-        const outcome = program.beforeHandle[i]!(ctx)
-        const settled = outcome instanceof Promise ? await outcome : outcome
-        if (settled !== undefined)
-          return finishEarly(host, entry, ctx, settled, finalize, wrapResponse)
-      }
-      const output = program.handler(ctx)
-      result = output instanceof Promise ? await output : output
+): ProgramResult<T> {
+  // After an actual async boundary, resume the same sync runner until the next pending stage.
+  // Sync hooks and finalization need no async function wrapper or additional microtask turn.
+  if (pendingPhase.kind === "validation") {
+    if (pendingPhase.policy) {
+      return runAuthBeforeValidation(
+        host,
+        entry,
+        program,
+        source,
+        ctx,
+        finalize,
+        wrapResponse,
+        true,
+        0,
+        0,
+        pendingPhase.next,
+      )
     }
-
-    const afterStart = pendingPhase.kind === "after" ? pendingPhase.next : 0
-    for (let i = afterStart; i < program.afterHandle.length; i++) {
-      const outcome = program.afterHandle[i]!(result, ctx)
-      result = outcome instanceof Promise ? await outcome : outcome
+    return runSync(
+      host,
+      entry,
+      program,
+      source,
+      ctx,
+      finalize,
+      wrapResponse,
+      pendingPhase.next,
+      result,
+    )
+  }
+  if (pendingPhase.kind === "derive" || pendingPhase.kind === "before") {
+    if (pendingPhase.policy) {
+      return runAuthBeforeValidation(
+        host,
+        entry,
+        program,
+        source,
+        ctx,
+        finalize,
+        wrapResponse,
+        false,
+        pendingPhase.kind === "derive" ? pendingPhase.next : program.derives.length,
+        pendingPhase.kind === "before" ? pendingPhase.next : 0,
+      )
     }
-    return await host.finishProgramResult(entry, ctx, result, finalize, wrapResponse)
-  } catch (error) {
-    return await host.handleProgramError(entry, error, ctx, finalize, wrapResponse)
+    return runHooksSync(
+      host,
+      entry,
+      program,
+      source,
+      ctx,
+      finalize,
+      wrapResponse,
+      pendingPhase.kind === "derive" ? pendingPhase.next : program.derives.length,
+      pendingPhase.kind === "before" ? pendingPhase.next : 0,
+      result,
+    )
   }
+  return runAfterSync(
+    host,
+    entry,
+    program,
+    source,
+    ctx,
+    finalize,
+    wrapResponse,
+    pendingPhase.kind === "after" ? pendingPhase.next : 0,
+    result,
+  )
 }