@c9up/aurora 0.1.3

package/dist/render.js

@@ -0,0 +1,283 @@
+/**
+ * Render a `TemplateResult` to the DOM and keep it reactive.
+ *
+ * `render(template, container)` clones the parsed `<template>`, walks to
+ * each slot, attaches the corresponding value (with `effect()` for any
+ * reactive expression), and appends the result to the container. The
+ * returned dispose function tears down every effect and removes the
+ * mounted nodes.
+ */
+import { readComponentLifecycle } from "./component.js";
+import { getTemplate } from "./html.js";
+import { effect, isSignal } from "./reactive.js";
+import { isTemplateResult, } from "./types.js";
+/**
+ * Mount a TemplateResult into `container`. Returns a `Disposer` that
+ * stops every reactive effect and removes the mounted nodes. Calling it
+ * twice is a no-op.
+ */
+export function render(result, container) {
+    const cleanups = [];
+    const mountedNodes = [];
+    const mountHooks = [];
+    const fragment = mount(result, cleanups, mountedNodes, mountHooks);
+    container.appendChild(fragment);
+    // `onMount` hooks fire after the fragment is live in the document so
+    // callbacks that measure / focus / observe see a real DOM. A returned
+    // cleanup function joins the unmount queue.
+    for (const hook of mountHooks) {
+        try {
+            const teardown = hook();
+            if (typeof teardown === "function")
+                cleanups.push(teardown);
+        }
+        catch {
+            /* swallow — one bad onMount should not block sibling components */
+        }
+    }
+    let disposed = false;
+    return () => {
+        if (disposed)
+            return;
+        disposed = true;
+        for (const c of cleanups.splice(0))
+            c();
+        for (const node of mountedNodes)
+            node.remove();
+    };
+}
+/**
+ * Build a fragment for a TemplateResult and register cleanups.
+ *
+ * @internal Exported so `hydrate.ts` can client-render a reactive
+ * nested-template subtree when the signal changes after hydration
+ * (the swap path — see `hydrateTextSlot`).
+ */
+export function mount(result, cleanups, mounted, mountHooks) {
+    const tpl = getTemplate(result.strings);
+    const fragment = tpl.element.content.cloneNode(true);
+    // Forward any component()-attached lifecycle from this result.
+    const lifecycle = readComponentLifecycle(result);
+    if (lifecycle) {
+        for (const hook of lifecycle.mountHooks)
+            mountHooks.push(hook);
+        for (const c of lifecycle.cleanups)
+            cleanups.push(c);
+    }
+    // Multi-slot attrs need every contributing value before we can join
+    // the final string. Collect them in a first pass, attach effects
+    // after.
+    const multiGroups = new Map();
+    for (let i = 0; i < tpl.slots.length; i++) {
+        const slot = tpl.slots[i];
+        const node = resolvePath(fragment, slot.path);
+        if (slot.kind === "attr" && slot.staticParts !== undefined) {
+            collectMultiAttr(slot, node, result.values[i], multiGroups);
+        }
+        else {
+            applySlot(slot, node, result.values[i], cleanups, mounted, mountHooks);
+        }
+    }
+    for (const group of multiGroups.values()) {
+        applyMultiAttrGroup(group, cleanups);
+    }
+    for (const child of Array.from(fragment.childNodes)) {
+        mounted.push(child);
+    }
+    return fragment;
+}
+function resolvePath(root, path) {
+    let node = root;
+    for (const i of path)
+        node = node.childNodes[i];
+    return node;
+}
+function applySlot(slot, node, value, cleanups, mounted, mountHooks) {
+    switch (slot.kind) {
+        case "text":
+            applyTextSlot(slot, node, value, cleanups, mounted, mountHooks);
+            return;
+        case "attr":
+            applyAttrSlot(slot, node, value, cleanups);
+            return;
+        case "boolean-attr":
+            applyBooleanAttrSlot(slot, node, value, cleanups);
+            return;
+        case "prop":
+            applyPropSlot(slot, node, value, cleanups);
+            return;
+        case "event":
+            applyEventSlot(slot, node, value, cleanups);
+            return;
+    }
+}
+/**
+ * Text slot — replace the marker comment with whatever the value
+ * resolves to. The anchor comment stays in place; new content is
+ * inserted before it, and each re-render swaps out only the nodes it
+ * previously inserted.
+ */
+function applyTextSlot(_slot, anchor, value, cleanups, mounted, mountHooks) {
+    let currentNodes = [];
+    // Per-render disposers for whatever the slot currently shows. A
+    // reactive slot that swaps a nested TemplateResult for another must
+    // dispose the OLD subtree's effects + event listeners — otherwise
+    // they'd live in the shared `cleanups` array until the whole root
+    // disposes, leaking a stale subscription/listener on every branch
+    // change. We hand `localCleanups` (not `cleanups`) to the per-render
+    // mount and tear it down at the top of each `set()`.
+    let localCleanups = [];
+    function disposeLocal() {
+        for (const d of localCleanups)
+            d();
+        localCleanups = [];
+    }
+    function set(newValue) {
+        disposeLocal();
+        for (const n of currentNodes)
+            n.remove();
+        currentNodes = [];
+        const nodes = renderValueIntoNodes(newValue, localCleanups, mounted, mountHooks);
+        const parent = anchor.parentNode;
+        if (!parent)
+            return;
+        for (const n of nodes) {
+            parent.insertBefore(n, anchor);
+            currentNodes.push(n);
+        }
+    }
+    if (isSignal(value) || typeof value === "function") {
+        const dispose = effect(() => {
+            set(value());
+        });
+        // Root disposal tears down the slot's own effect AND whatever
+        // subtree is currently mounted.
+        cleanups.push(() => {
+            dispose();
+            disposeLocal();
+        });
+    }
+    else {
+        set(value);
+        // Static value never re-runs, but its subtree (e.g. a one-shot
+        // nested template) still needs to be disposed with the root.
+        cleanups.push(disposeLocal);
+    }
+}
+function renderValueIntoNodes(value, cleanups, mounted, mountHooks) {
+    if (value === null || value === undefined || value === false)
+        return [];
+    if (Array.isArray(value)) {
+        const out = [];
+        for (const item of value) {
+            out.push(...renderValueIntoNodes(item, cleanups, mounted, mountHooks));
+        }
+        return out;
+    }
+    if (isTemplateResult(value)) {
+        const frag = mount(value, cleanups, mounted, mountHooks);
+        return Array.from(frag.childNodes);
+    }
+    if (value instanceof Node) {
+        return [value];
+    }
+    return [document.createTextNode(String(value))];
+}
+function applyAttrSlot(slot, el, value, cleanups) {
+    function apply(v) {
+        if (v === null || v === undefined || v === false) {
+            el.removeAttribute(slot.name);
+        }
+        else if (v === true) {
+            el.setAttribute(slot.name, "");
+        }
+        else {
+            el.setAttribute(slot.name, String(v));
+        }
+    }
+    if (isSignal(value) || typeof value === "function") {
+        const dispose = effect(() => apply(value()));
+        cleanups.push(dispose);
+    }
+    else {
+        apply(value);
+    }
+}
+function collectMultiAttr(slot, el, value, groups) {
+    if (!slot.staticParts)
+        return;
+    const key = `${slot.name}::${slot.path.join(".")}`;
+    let group = groups.get(key);
+    if (!group) {
+        group = {
+            el,
+            name: slot.name,
+            staticParts: slot.staticParts,
+            values: [],
+        };
+        groups.set(key, group);
+    }
+    group.values.push(value);
+}
+function applyMultiAttrGroup(group, cleanups) {
+    function join() {
+        let out = group.staticParts[0] ?? "";
+        for (let i = 0; i < group.values.length; i++) {
+            const v = resolveReactive(group.values[i]);
+            out += v == null || v === false ? "" : String(v);
+            out += group.staticParts[i + 1] ?? "";
+        }
+        return out;
+    }
+    const hasReactive = group.values.some((v) => isSignal(v) || typeof v === "function");
+    if (hasReactive) {
+        const dispose = effect(() => {
+            group.el.setAttribute(group.name, join());
+        });
+        cleanups.push(dispose);
+    }
+    else {
+        group.el.setAttribute(group.name, join());
+    }
+}
+function resolveReactive(value) {
+    if (isSignal(value))
+        return value();
+    if (typeof value === "function")
+        return value();
+    return value;
+}
+function applyBooleanAttrSlot(slot, el, value, cleanups) {
+    function apply(v) {
+        if (v)
+            el.setAttribute(slot.name, "");
+        else
+            el.removeAttribute(slot.name);
+    }
+    if (isSignal(value) || typeof value === "function") {
+        const dispose = effect(() => apply(value()));
+        cleanups.push(dispose);
+    }
+    else {
+        apply(value);
+    }
+}
+function applyPropSlot(slot, el, value, cleanups) {
+    function apply(v) {
+        el[slot.name] = v;
+    }
+    if (isSignal(value) || typeof value === "function") {
+        const dispose = effect(() => apply(value()));
+        cleanups.push(dispose);
+    }
+    else {
+        apply(value);
+    }
+}
+function applyEventSlot(slot, el, value, cleanups) {
+    if (typeof value !== "function")
+        return;
+    const handler = value;
+    el.addEventListener(slot.event, handler);
+    cleanups.push(() => el.removeEventListener(slot.event, handler));
+}

package/dist/route.d.ts

@@ -0,0 +1,64 @@
+/**
+ * `auroraRoute` — Ream route handler that SSR-renders an aurora
+ * component and ships the markup plus the bytes needed for client-side
+ * hydration.
+ *
+ * Usage:
+ *
+ *   import { auroraRoute } from '@c9up/aurora/provider'
+ *   router.get('/dashboard', auroraRoute({
+ *     entry: '/app/pages/dashboard.client.js',
+ *     render: () => Dashboard({ user: ... })
+ *   }))
+ *
+ * The handler:
+ *   1. invokes `render()` and stringifies the result via @c9up/aurora's SSR
+ *   2. wraps the markup in the page shell from `shell` (default: a minimal
+ *      <!doctype html> document)
+ *   3. embeds a `<script type="module">` that imports the user-supplied
+ *      `entry` module — the client bundle is expected to call
+ *      `hydrate(document.getElementById('aurora-root'), factory)` itself.
+ */
+import type { TemplateResult } from "./types.js";
+/**
+ * Structural slice of Ream's HttpContext — the response surface we need.
+ * Declaring it locally keeps aurora's bundle free of a `@c9up/ream`
+ * import; any framework whose context exposes `response.header()` and
+ * `response.send()` satisfies this contract via structural subtyping.
+ */
+export interface AuroraResponse {
+    status(code: number): AuroraResponse;
+    header(name: string, value: string): AuroraResponse;
+    send(data: string): void;
+}
+export interface AuroraHttpContext {
+    request: unknown;
+    response: AuroraResponse;
+}
+/** Configuration for a single auroraRoute call. */
+export interface AuroraRouteConfig {
+    /**
+     * SSR factory. Called once per request. Returning a TemplateResult is
+     * the common case; returning a Promise<TemplateResult> works too
+     * (data-loading components).
+     */
+    render: (ctx: AuroraHttpContext) => TemplateResult | Promise<TemplateResult>;
+    /**
+     * Path to the ES module the browser should import to hydrate. The
+     * value is inlined into a `<script type="module" src="...">` tag —
+     * make sure the route exists on the Ream router (typically served
+     * statically). Defaults to `/aurora-client.js`.
+     */
+    entry?: string;
+    /**
+     * Page shell. Defaults to a minimal HTML5 doctype with a `<div
+     * id="aurora-root">` that wraps the SSR markup. Apps swap in their
+     * own to control `<head>` (title, meta, fonts, css).
+     */
+    shell?: (body: string, entry: string) => string;
+}
+/**
+ * Build a Ream-compatible route handler that SSR-renders the given
+ * factory and serves the full HTML document.
+ */
+export declare function auroraRoute(config: AuroraRouteConfig): (ctx: AuroraHttpContext) => Promise<void>;

package/dist/route.js

@@ -0,0 +1,49 @@
+/**
+ * `auroraRoute` — Ream route handler that SSR-renders an aurora
+ * component and ships the markup plus the bytes needed for client-side
+ * hydration.
+ *
+ * Usage:
+ *
+ *   import { auroraRoute } from '@c9up/aurora/provider'
+ *   router.get('/dashboard', auroraRoute({
+ *     entry: '/app/pages/dashboard.client.js',
+ *     render: () => Dashboard({ user: ... })
+ *   }))
+ *
+ * The handler:
+ *   1. invokes `render()` and stringifies the result via @c9up/aurora's SSR
+ *   2. wraps the markup in the page shell from `shell` (default: a minimal
+ *      <!doctype html> document)
+ *   3. embeds a `<script type="module">` that imports the user-supplied
+ *      `entry` module — the client bundle is expected to call
+ *      `hydrate(document.getElementById('aurora-root'), factory)` itself.
+ */
+import { renderToString } from "./ssr.js";
+const DEFAULT_SHELL = (body, entry) => `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8" />
+<meta name="viewport" content="width=device-width,initial-scale=1" />
+<title>Aurora</title>
+</head>
+<body>
+<div id="aurora-root">${body}</div>
+<script type="module" src="${entry}"></script>
+</body>
+</html>`;
+/**
+ * Build a Ream-compatible route handler that SSR-renders the given
+ * factory and serves the full HTML document.
+ */
+export function auroraRoute(config) {
+    const entry = config.entry ?? "/aurora-client.js";
+    const shell = config.shell ?? DEFAULT_SHELL;
+    return async (ctx) => {
+        const tree = await config.render(ctx);
+        const body = renderToString(tree);
+        const html = shell(body, entry);
+        ctx.response.header("content-type", "text/html; charset=utf-8");
+        ctx.response.send(html);
+    };
+}

package/dist/server/renderPage.d.ts

@@ -0,0 +1,62 @@
+/**
+ * `renderPage` — server-side helper that turns a page name + props into
+ * a full HTML document, ready to ship from a route handler.
+ *
+ * The output carries everything the browser needs to hydrate against
+ * the SSR markup with zero app-side scripting:
+ *
+ *   <head>
+ *     ...
+ *     <script type="importmap">
+ *       { "imports": { "@c9up/aurora": "/_assets/aurora/index.js" } }
+ *     </script>
+ *   </head>
+ *   <body>
+ *     <div id="aurora-root">…SSR markup…</div>
+ *     <script id="aurora-page-data" type="application/json">{…}</script>
+ *     <script type="module">
+ *       import { hydrate } from '@c9up/aurora'
+ *       import Page from '/_assets/pages/ProjectPage.js'
+ *       const data = JSON.parse(document.getElementById('aurora-page-data').textContent)
+ *       hydrate(document.getElementById('aurora-root'), () => Page(data.props))
+ *     </script>
+ *   </body>
+ */
+import type { Pages } from "../Pages.js";
+/**
+ * Structural slice of the host framework's response. Same shape
+ * `auroraRoute()` uses — keeps aurora free of a `@c9up/ream` import.
+ */
+export interface RenderResponse {
+    status(code: number): RenderResponse;
+    header(name: string, value: string): RenderResponse;
+    send(body: string): void;
+}
+export interface RenderHttpContext {
+    request: unknown;
+    response: RenderResponse;
+}
+export interface RenderPageOptions {
+    /**
+     * Importmap entries injected into `<head>`. Defaults to mapping
+     * `@c9up/aurora` to `/_assets/aurora/index.js`. Override to point
+     * at a different mount or to add app-side aliases.
+     */
+    importmap?: Record<string, string>;
+    /**
+     * Extra markup spliced into `<head>` after the importmap. Use to
+     * inject `<title>`, meta tags, stylesheets.
+     */
+    headExtra?: string;
+    /**
+     * Outer language tag on the `<html>` element. Defaults to `en`.
+     */
+    lang?: string;
+    /**
+     * Mount root id for the SSR + hydrated tree. Defaults to
+     * `aurora-root`. Matches the id the client-side hydrate script
+     * targets.
+     */
+    rootId?: string;
+}
+export declare function renderPage<P>(ctx: RenderHttpContext, pages: Pages, name: string, props: P, options?: RenderPageOptions): Promise<void>;

package/dist/server/renderPage.js

@@ -0,0 +1,83 @@
+/**
+ * `renderPage` — server-side helper that turns a page name + props into
+ * a full HTML document, ready to ship from a route handler.
+ *
+ * The output carries everything the browser needs to hydrate against
+ * the SSR markup with zero app-side scripting:
+ *
+ *   <head>
+ *     ...
+ *     <script type="importmap">
+ *       { "imports": { "@c9up/aurora": "/_assets/aurora/index.js" } }
+ *     </script>
+ *   </head>
+ *   <body>
+ *     <div id="aurora-root">…SSR markup…</div>
+ *     <script id="aurora-page-data" type="application/json">{…}</script>
+ *     <script type="module">
+ *       import { hydrate } from '@c9up/aurora'
+ *       import Page from '/_assets/pages/ProjectPage.js'
+ *       const data = JSON.parse(document.getElementById('aurora-page-data').textContent)
+ *       hydrate(document.getElementById('aurora-root'), () => Page(data.props))
+ *     </script>
+ *   </body>
+ */
+import { renderToString } from "../ssr.js";
+export async function renderPage(ctx, pages, name, props, options = {}) {
+    const factory = await pages.resolve(name);
+    // The factory must be invoked the SAME way client-side for hydrate
+    // to find matching slots — `Page(props)` is the contract.
+    const tree = await factory(props);
+    const body = renderToString(tree);
+    const importmap = {
+        "@c9up/aurora": "/_assets/aurora/index.js",
+        ...options.importmap,
+    };
+    const rootId = options.rootId ?? "aurora-root";
+    const lang = options.lang ?? "en";
+    const pageUrl = pages.urlFor(name);
+    const doc = `<!doctype html>
+<html lang="${escapeAttr(lang)}">
+<head>
+<meta charset="utf-8" />
+<meta name="viewport" content="width=device-width,initial-scale=1" />
+<script type="importmap">${JSON.stringify({ imports: importmap })}</script>
+${options.headExtra ?? ""}
+</head>
+<body>
+<div id="${escapeAttr(rootId)}">${body}</div>
+<script id="aurora-page-data" type="application/json">${escapeJsonForScript({
+        name,
+        props,
+        url: pageUrl,
+        rootId,
+    })}</script>
+<script type="module">
+import { hydrate } from '@c9up/aurora'
+import Page from ${JSON.stringify(pageUrl)}
+const data = JSON.parse(document.getElementById('aurora-page-data').textContent)
+hydrate(document.getElementById(data.rootId), () => Page(data.props))
+</script>
+</body>
+</html>`;
+    ctx.response.header("content-type", "text/html; charset=utf-8");
+    ctx.response.send(doc);
+}
+function escapeAttr(value) {
+    return value
+        .replace(/&/g, "&amp;")
+        .replace(/"/g, "&quot;")
+        .replace(/</g, "&lt;");
+}
+/**
+ * Escape a JSON payload for safe embedding inside a `<script>` block.
+ * The HTML parser closes the script on `</script>` regardless of JSON
+ * quoting, so we slash-escape the `/`. We also escape `<!--` and `-->`
+ * to dodge HTML-comment interpretation inside the script body.
+ */
+function escapeJsonForScript(value) {
+    return JSON.stringify(value)
+        .replace(/<\/(script)/gi, "<\\/$1")
+        .replace(/<!--/g, "<\\!--")
+        .replace(/-->/g, "--\\>");
+}

package/dist/server/serveAssets.d.ts

@@ -0,0 +1,43 @@
+/**
+ * `serveAssets` — generic static-file handler exposed by aurora so an
+ * app can mount the runtime + the pages dist with a couple of routes:
+ *
+ *   router.get('/_assets/aurora/*', serveAssets({ root: auroraDistPath }))
+ *   router.get('/_assets/pages/*',  serveAssets({ root: pagesPath }))
+ *
+ * The handler is framework-agnostic: it reads `ctx.request.param('*')`
+ * and writes to `ctx.response`. Any context that satisfies
+ * `AssetsHttpContext` (Ream, AdonisJS, anything duck-typed) works.
+ */
+export interface AssetsRequest {
+    /**
+     * Read the wildcard `*` segment of the matched route. Most routers
+     * (Ream, AdonisJS, fastify with params) expose this as
+     * `params['*']` — the duck-typed helper below accepts either
+     * convention.
+     */
+    param(name: string): unknown;
+}
+export interface AssetsResponse {
+    status(code: number): AssetsResponse;
+    header(name: string, value: string): AssetsResponse;
+    send(body: string | Buffer): void;
+}
+export interface AssetsHttpContext {
+    request: AssetsRequest;
+    response: AssetsResponse;
+}
+export interface ServeAssetsOptions {
+    /**
+     * Absolute filesystem root the handler is allowed to serve from.
+     * Requests resolving outside this root return 403.
+     */
+    root: string;
+    /**
+     * `Cache-Control` value to emit. Defaults to a dev-friendly
+     * 60-second TTL. Production deployments should hash the asset
+     * name and switch to `public, max-age=31536000, immutable`.
+     */
+    cacheControl?: string;
+}
+export declare function serveAssets(options: ServeAssetsOptions): (ctx: AssetsHttpContext) => Promise<void>;

package/dist/server/serveAssets.js

@@ -0,0 +1,89 @@
+/**
+ * `serveAssets` — generic static-file handler exposed by aurora so an
+ * app can mount the runtime + the pages dist with a couple of routes:
+ *
+ *   router.get('/_assets/aurora/*', serveAssets({ root: auroraDistPath }))
+ *   router.get('/_assets/pages/*',  serveAssets({ root: pagesPath }))
+ *
+ * The handler is framework-agnostic: it reads `ctx.request.param('*')`
+ * and writes to `ctx.response`. Any context that satisfies
+ * `AssetsHttpContext` (Ream, AdonisJS, anything duck-typed) works.
+ */
+import { readFile, realpath } from "node:fs/promises";
+import { extname, join, resolve as resolvePath, sep } from "node:path";
+const CONTENT_TYPES = {
+    ".js": "text/javascript; charset=utf-8",
+    ".mjs": "text/javascript; charset=utf-8",
+    ".map": "application/json; charset=utf-8",
+    ".css": "text/css; charset=utf-8",
+    ".json": "application/json; charset=utf-8",
+};
+export function serveAssets(options) {
+    const root = options.root;
+    const cacheControl = options.cacheControl ?? "public, max-age=60";
+    // Canonicalize the root ONCE at handler creation. The realpath check
+    // below compares against this canonical form so a symlinked root
+    // (e.g. `/var/www/current → /var/www/release-42`) still resolves
+    // requests correctly. `realpath` failure at construction means the
+    // configured root doesn't exist yet — we fall back to the lexical
+    // resolve so the first request emits a clean 404 instead of a boot
+    // crash. The realpath re-check at request time handles that case.
+    let canonicalRoot;
+    realpath(root).then((p) => {
+        canonicalRoot = p;
+    }, () => {
+        /* root not yet on disk — request-time realpath will surface it */
+    });
+    return async (ctx) => {
+        const rest = ctx.request.param("*");
+        if (typeof rest !== "string" || rest.length === 0) {
+            ctx.response.status(400).send("missing asset path");
+            return;
+        }
+        // First gate: lexical containment check. `resolve()` collapses
+        // `../` segments; we assert the resolved path still starts with
+        // `root + sep`. This blocks the "../../../etc/passwd" class of
+        // requests before we ever touch the filesystem.
+        const absolute = resolvePath(join(root, rest));
+        if (!absolute.startsWith(root + sep) && absolute !== root) {
+            ctx.response.status(403).send("forbidden");
+            return;
+        }
+        // Second gate: dereference any symlinks under the root and
+        // re-check containment against the canonical root. Without this
+        // step a symlink planted at `<root>/legit → /etc/secrets` would
+        // pass the lexical check above and be served. We re-canonicalize
+        // the root each request when the constructor-time realpath
+        // hadn't resolved yet (root mounted after boot).
+        let canonicalAbsolute;
+        let canonicalRootNow;
+        try {
+            canonicalRootNow = canonicalRoot ?? (await realpath(root));
+            canonicalAbsolute = await realpath(absolute);
+        }
+        catch {
+            // realpath fails if the target doesn't exist — emit a normal
+            // 404 here so symlink-escape probes can't be distinguished
+            // from genuine misses via response timing or status.
+            ctx.response.status(404).send("asset not found");
+            return;
+        }
+        if (!canonicalAbsolute.startsWith(canonicalRootNow + sep) &&
+            canonicalAbsolute !== canonicalRootNow) {
+            ctx.response.status(403).send("forbidden");
+            return;
+        }
+        let body;
+        try {
+            body = await readFile(canonicalAbsolute);
+        }
+        catch {
+            ctx.response.status(404).send("asset not found");
+            return;
+        }
+        const type = CONTENT_TYPES[extname(canonicalAbsolute)] ?? "application/octet-stream";
+        ctx.response.header("content-type", type);
+        ctx.response.header("cache-control", cacheControl);
+        ctx.response.send(body);
+    };
+}