fulmine.js 5.19.4 → 5.19.6

package/README.md

@@ -989,6 +989,10 @@ suite, so what is compared is what their own build produces.
 - ✅ [Apollo Server](https://www.apollographql.com/docs/apollo-server) through
   [`@as-integrations/express5`](https://www.npmjs.com/package/@as-integrations/express5)
 - ✅ [tRPC](https://trpc.io) through `@trpc/server/adapters/express`
+- ✅ [MCP](https://modelcontextprotocol.io) through
+  [`@modelcontextprotocol/sdk`](https://www.npmjs.com/package/@modelcontextprotocol/sdk) on the
+  Streamable HTTP transport, with the body read off the stream or handed over by `express.json()`.
+  Runnable: [`examples/mcp.js`](./examples/mcp.js)
 - ✅ [Angular SSR](#angular-ssr), which is an ordinary Express `server.ts` plus one line of build
   configuration
 
@@ -1010,10 +1014,11 @@ Any Express view engine should work. Here's list of engines we include in our te
 ## Examples
 
 [`examples/`](./examples/README.md) has one runnable file per thing this does that Express does not:
-the cluster option, `app.ws()`, socket.io through `attachApp`, the pre-compressed twins,
-`express.compression()`, `express.serverTiming()`, TLS through `uwsOptions`, the PROXY protocol,
-what `listen()` decided about each route, and the app answering as an `http.Server`. What an
-Express application already does is documented by Express and is not repeated there.
+the cluster option, `app.ws()`, socket.io through `attachApp`, an MCP server on the official SDK,
+the pre-compressed twins, `express.compression()`, `express.serverTiming()`, TLS through
+`uwsOptions`, the PROXY protocol, what `listen()` decided about each route, and the app answering as
+an `http.Server`. What an Express application already does is documented by Express and is not
+repeated there.
 
 ```sh
 cd examples

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "fulmine.js",
-    "version": "5.19.4",
+    "version": "5.19.6",
     "description": "Drop-in Express 5 replacement on uWebSockets.js. Your existing middleware keeps working.",
     "main": "src/index.js",
     "exports": {

package/src/declarative.js

@@ -18,7 +18,7 @@ limitations under the License.
 */
 
 const acorn = require("acorn");
-const { stringify, withDefaultCharset, withUtf8Charset, contentTypeFor } = require("./utils.js");
+const { stringify, contentTypeSet, withUtf8Charset, contentTypeFor } = require("./utils.js");
 // H3App, DeclarativeResponse and _cfg exist at runtime but are missing from the .d.ts the
 // package ships, so the module is read through a loose alias
 const uWS = require("uWebSockets.js");
@@ -250,10 +250,16 @@ function readStatusAndHeaders(callExprs, headers) {
 
             for (let [header, value] of pairs) {
                 const name = String(header).toLowerCase();
-                // res.set adds a charset to a content-type, res.setHeader does not: setHeader
-                // is node's and node does not know what a media type is
+                // res.set resolves a content-type through the mime database, res.setHeader does
+                // not: setHeader is node's and node does not know what a media type is
                 if (call.obj.propertyName !== "setHeader" && name === "content-type") {
-                    value = withDefaultCharset(value);
+                    const resolved = contentTypeSet(String(value));
+                    if (resolved === false) {
+                        // res.set stores false for it and the body method writes its own type
+                        // instead; left to the ordinary path rather than worked out twice here
+                        return null;
+                    }
+                    value = resolved;
                 }
                 const index = headers.findIndex((entry) => String(entry[0]).toLowerCase() === name);
                 if (index === -1) {
@@ -823,10 +829,10 @@ module.exports = function compileDeclarative(cb, app) {
         if (!connection && advertise) {
             decRes = decRes.writeHeader("connection", "keep-alive");
         }
-        // not when the handler is closing: Keep-Alive describes a connection that stays open, and
-        // the ordinary path leaves it out for the same reason
-        const closing = typeof connection?.[1] === "string" && connection[1].toLowerCase() === "close";
-        if (advertise && !closing && !headers.some((header) => header[0].toLowerCase() === "keep-alive")) {
+        // not when the route wrote its own Connection, whatever it says: node writes the two as a
+        // pair and writes neither once the response has set Connection, and the ordinary path
+        // leaves it out for the same reason
+        if (advertise && !connection && !headers.some((header) => header[0].toLowerCase() === "keep-alive")) {
             decRes = decRes.writeHeader("keep-alive", "timeout=10");
         }
 

package/src/middlewares.js

@@ -810,6 +810,53 @@ function serveStatic(root, options) {
     };
 }
 
+/**
+ * A zlib throw as the 400 body-parser answers a corrupt body with. zlib reports it twice, and the
+ * 'error' a tick later would land on nothing and end the process, so the listener goes back on.
+ *
+ * @param {Inflater} inflate
+ * @param {HttpError} err what inflate.process threw
+ * @returns {HttpError} the same error, carrying its status
+ */
+function inflateError(inflate, err) {
+    inflate.instance?.on?.("error", () => {});
+    err.status = 400;
+    err.statusCode = 400;
+    err.expose = true;
+    return err;
+}
+
+/**
+ * What a Content-Encoding means here: the decompressor to run, or the 415 it is refused with. An
+ * empty body is judged the same way, so both callers share this.
+ *
+ * @param {string|undefined} rawContentEncoding
+ * @param {any} options the parser's options, read loosely: only inflate is looked at
+ * @returns {{inflate?: Inflater, error?: HttpError}}
+ */
+function encodingFor(rawContentEncoding, options) {
+    if (!options.inflate) {
+        const contentEncoding = (rawContentEncoding || "identity").toLowerCase();
+        if (contentEncoding !== "identity") {
+            return {
+                error: bodyError("content encoding unsupported", 415, "encoding.unsupported", {
+                    encoding: contentEncoding
+                })
+            };
+        }
+        return {};
+    }
+    const inflate = createInflate(rawContentEncoding);
+    if (inflate === false) {
+        return {
+            error: bodyError('unsupported content encoding "' + rawContentEncoding + '"', 415, "encoding.unsupported", {
+                encoding: rawContentEncoding
+            })
+        };
+    }
+    return { inflate };
+}
+
 /**
  * The decompressor for a Content-Encoding, or undefined when the body is not compressed. An
  * encoding nobody knows throws, since decoding it wrong is worse than refusing.
@@ -986,8 +1033,11 @@ function createBodyParser(defaultType, beforeReturn, checkOptions, charsetPolicy
                 }
             }
 
-            // the charset is settled before anything is read, as body-parser settles it: a bad one
-            // answers 415 even for an empty body, and before the verify hook can run
+            // The charset is settled before anything is read, as body-parser settles it: a bad one
+            // answers 415 even for an empty body, and before the verify hook can run. Its two
+            // halves sit on either side of the encoding, which is the order body-parser reads
+            // them in: the charset this parser accepts at all, then the Content-Encoding, then
+            // whether iconv knows the charset.
             let encoding;
             if (charsetPolicy) {
                 encoding = charsetOf(type) ?? defaultCharset;
@@ -997,9 +1047,16 @@ function createBodyParser(defaultType, beforeReturn, checkOptions, charsetPolicy
                 ) {
                     return next(charsetError(encoding));
                 }
-                if (!BUFFER_CHARSETS.has(encoding) && !loadIconv().encodingExists(encoding)) {
-                    return next(charsetError(encoding));
-                }
+            }
+
+            const encoded = encodingFor(req._rawHeader("content-encoding"), options);
+            if (encoded.error) {
+                return next(encoded.error);
+            }
+            const inflate = encoded.inflate;
+
+            if (encoding !== undefined && !BUFFER_CHARSETS.has(encoding) && !loadIconv().encodingExists(encoding)) {
+                return next(charsetError(encoding));
             }
 
             // an empty body still has to produce this parser's empty value the way express does -
@@ -1008,15 +1065,28 @@ function createBodyParser(defaultType, beforeReturn, checkOptions, charsetPolicy
             // and the verify hook still runs first: webhook signature checks rely on that
             if (lengthNumber === 0) {
                 req.bodyRead = true;
-                const empty = Buffer.alloc(0);
+                /** @type {Buffer<ArrayBufferLike>} what the parser is handed: zlib's tail is wider */
+                let empty = Buffer.alloc(0);
+                if (inflate) {
+                    // nothing to inflate is a stream cut short for zlib, and body-parser answers
+                    // that with a 400 rather than with the empty value
+                    try {
+                        empty = inflate.process(EMPTY_BUFFER, inflate._finishFlag);
+                    } catch (e) {
+                        return next(inflateError(inflate, /** @type {HttpError} */ (e)));
+                    }
+                }
                 if (!runVerify(req, res, next, options, empty, encoding)) {
                     return;
                 }
                 return beforeReturn(req, res, next, options, empty, encoding);
             }
 
-            // skip reading too large body; NaN compares false, so no declared length passes
-            if (lengthNumber > limit) {
+            // skip reading too large body; NaN compares false, so no declared length passes.
+            // Not while inflating: content-length counts the compressed bytes and the limit is
+            // about the ones that come out, which body-parser says by leaving the length unset.
+            // The limit is still enforced per chunk as they inflate, see keepChunk
+            if (!inflate && lengthNumber > limit) {
                 return next(
                     bodyError("request entity too large", 413, "entity.too.large", {
                         expected: lengthNumber,
@@ -1039,33 +1109,7 @@ function createBodyParser(defaultType, beforeReturn, checkOptions, charsetPolicy
                 return next();
             }
 
-            /** @type {Inflater|false|undefined} */
-            let inflate;
             let totalSize = 0;
-            const rawContentEncoding = req._rawHeader("content-encoding");
-            const contentEncoding = (rawContentEncoding || "identity").toLowerCase();
-            if (!options.inflate && contentEncoding !== "identity") {
-                return next(
-                    bodyError("content encoding unsupported", 415, "encoding.unsupported", {
-                        encoding: contentEncoding
-                    })
-                );
-            }
-            if (options.inflate) {
-                inflate = createInflate(rawContentEncoding);
-                if (inflate === false) {
-                    return next(
-                        bodyError(
-                            'unsupported content encoding "' + rawContentEncoding + '"',
-                            415,
-                            "encoding.unsupported",
-                            {
-                                encoding: rawContentEncoding
-                            }
-                        )
-                    );
-                }
-            }
 
             // From here the body really gets read, and uWS delivers it on native callbacks that
             // carry no async context, so this is the one continuation that has to be bound: an
@@ -1137,24 +1181,16 @@ function createBodyParser(defaultType, beforeReturn, checkOptions, charsetPolicy
             let finished = false;
 
             /**
-             * A zlib throw becomes the 400 body-parser answers a corrupt body with.
-             *
-             * zlib reports it twice: process() throws, and the stream emits 'error' a tick later.
-             * fast-zlib removes its own listeners on the way out, so that second one lands on
-             * nothing, and an unhandled 'error' event ends the process. The listener goes on after
-             * the throw, since process() would have removed it.
+             * A zlib throw becomes the 400 body-parser answers a corrupt body with, and what was
+             * kept of the body goes.
              *
              * @param {HttpError} err what inflate.process threw
              */
             function failInflate(err) {
-                /** @type {Inflater} */ (inflate).instance?.on?.("error", () => {});
                 finished = true;
                 abs.length = 0;
                 target = null;
-                err.status = 400;
-                err.statusCode = 400;
-                err.expose = true;
-                next(err);
+                next(inflateError(/** @type {Inflater} */ (inflate), err));
             }
 
             /**

package/src/response-utils.js

@@ -57,7 +57,10 @@ for (const s of [
     "gzip",
     "br",
     "deflate",
-    "zstd"
+    "zstd",
+    // res.set("Content-Type", x) stores false when the mime database knows nothing about x, the
+    // way express does, and the lookup below turns that back into the bytes node writes for it
+    "false"
 ]) {
     HEADER_VALUE_BUF[s] = Buffer.from(s);
 }

package/src/response.js

@@ -34,13 +34,13 @@ const {
     validateHeaderName,
     validateHeaderValue,
     headerIsWritable,
-    withDefaultCharset,
     withUtf8Charset,
     asStatError,
     httpError,
     headersSentError,
     applyWriteHead,
     contentTypeFor,
+    contentTypeSet,
     statTag,
     cachedStat,
     NullObject
@@ -49,6 +49,41 @@ const { isAbsolute } = require("path");
 const fs = require("fs");
 const Path = require("path");
 const statuses = require("statuses");
+
+/**
+ * The TypeError node throws for a chunk that is not a string, a Buffer or a Uint8Array, named the
+ * way node names it: a primitive by type and value, an object by its constructor.
+ *
+ * @param {unknown} chunk what end() was handed, known here not to be a string or a Uint8Array
+ * @returns {NodeJS.ErrnoException}
+ */
+function invalidChunkError(chunk) {
+    let received;
+    if (chunk === null) {
+        received = "null";
+    } else if (typeof chunk === "object" || typeof chunk === "function") {
+        const name = /** @type {any} */ (chunk).constructor?.name;
+        received = name ? `an instance of ${name}` : "an instance of Object";
+    } else if (typeof chunk === "bigint") {
+        received = `type bigint (${chunk}n)`;
+    } else if (typeof chunk === "symbol") {
+        received = `type symbol (${String(chunk)})`;
+    } else {
+        received = `type ${typeof chunk} (${chunk})`;
+    }
+    /** @type {NodeJS.ErrnoException} */
+    const err = new TypeError(
+        `The "chunk" argument must be of type string or an instance of Buffer or Uint8Array. Received ${received}`
+    );
+    err.code = "ERR_INVALID_ARG_TYPE";
+    // node stamps the code into the stack's first line and then puts the name back, so err.name
+    // reads TypeError while the error page, which prints the stack, shows the bracketed form
+    err.name = "TypeError [ERR_INVALID_ARG_TYPE]";
+    void err.stack;
+    // through the index signature: name is not optional on Error, so a plain delete is a type error
+    delete (/** @type {Record<string, unknown>} */ (/** @type {unknown} */ (err)).name);
+    return err;
+}
 const { sign } = require("cookie-signature");
 const ms = require("ms");
 const Socket = require("./socket.js");
@@ -77,6 +112,10 @@ const COALESCE_BELOW = 4 * 1024;
 const HIGH_WATERMARK = 128 * 1024;
 // the exact string json() writes, so send() can skip recomputing the charset on it
 const JSON_UTF8 = "application/json; charset=utf-8";
+
+// The Keep-Alive every response is seeded with, kept as a constant so setHeader can tell it apart
+// from one the application set itself.
+const SEEDED_KEEP_ALIVE = "timeout=10";
 // send's ceiling for maxAge, one year in milliseconds. Anything larger is clamped to it rather
 // than written out, since a year is already longer than any cache will honour.
 const MAX_MAXAGE = 60 * 60 * 24 * 365 * 1000;
@@ -187,7 +226,7 @@ module.exports = class Response extends LazyWritable {
                 ? {}
                 : {
                       connection: "keep-alive",
-                      "keep-alive": "timeout=10"
+                      "keep-alive": SEEDED_KEEP_ALIVE
                   };
         // the client asked for the connection to be closed, and uWS closes it, so saying otherwise
         // would be telling the client something the transport contradicts. A declarative response
@@ -535,7 +574,17 @@ module.exports = class Response extends LazyWritable {
             throw headersSentError("write");
         }
         this.statusCode = statusCode;
-        const reason = applyWriteHead(this, statusMessage, headers);
+        let reason;
+        try {
+            reason = applyWriteHead(this, statusMessage, headers);
+        } catch (err) {
+            // node fixes the phrase before it reads the headers and keeps it, so a 500 after a
+            // writeHead that threw goes out as "500 OK"
+            if (!this.statusText) {
+                this.statusText = typeof statusMessage === "string" ? statusMessage : statuses.message[statusCode];
+            }
+            throw err;
+        }
         if (reason !== undefined) {
             this.statusText = reason;
         }
@@ -665,6 +714,15 @@ module.exports = class Response extends LazyWritable {
         if (typeof cb !== "function") {
             cb = undefined;
         }
+        // node refuses a chunk that is not a string, a Buffer or a Uint8Array, and writes it only
+        // `if (chunk)`, so end(0) sends nothing. A number reached uWS and answered nothing at all.
+        // The typeof goes first so a string body, which is nearly every body, leaves on it alone
+        if (typeof data !== "string" && data !== undefined && !(data instanceof Uint8Array)) {
+            if (data) {
+                throw invalidChunkError(data);
+            }
+            data = undefined;
+        }
         // uWS takes a string as utf-8 and nothing else, so any other encoding is applied here, the
         // way write() applies it: res.end(data, "binary") is how old code sends an image
         if (typeof data === "string" && encoding !== undefined && encoding !== "utf8" && encoding !== "utf-8") {
@@ -790,6 +848,25 @@ module.exports = class Response extends LazyWritable {
      * @returns {this}
      */
     send(body) {
+        // undefined means nothing was passed, and Express treats that differently from a value
+        // that happens to be empty: no content-type and no ETag for send(), both for send(null)
+        // and send(""). It writes no header for it either, so it does not refuse a head that has
+        // gone out: after a res.write(), express answers this and we hung up on it.
+        if (body === undefined) {
+            if (!this.headersSent) {
+                // freshness and the bodiless statuses, as every express send goes through: a 204
+                // answered with json(undefined) loses the type json had set
+                if (this.req.fresh) {
+                    this.status(304);
+                }
+                if (this.statusCode === 204 || this.statusCode === 304) {
+                    delete this.headers["content-type"];
+                    delete this.headers["content-length"];
+                    delete this.headers["transfer-encoding"];
+                }
+            }
+            return this.end("");
+        }
         if (this.headersSent) {
             // what express's send meets first once the head is out is setHeader's refusal
             throw headersSentError("set");
@@ -802,12 +879,6 @@ module.exports = class Response extends LazyWritable {
             body = Buffer.from(body.buffer, body.byteOffset, body.byteLength);
         }
         const isBuffer = Buffer.isBuffer(body);
-        // undefined means nothing was passed, and Express treats that differently from a value
-        // that happens to be empty: no content-type and no ETag for send(), both for send(null)
-        // and send("").
-        if (body === undefined) {
-            return this.end("");
-        }
         // null is an object as far as Express's switch is concerned, so it becomes the empty
         // string without ever reaching the branch that gives a string its content-type. It still
         // earns an ETag. send("") takes the string branch and does get one.
@@ -823,8 +894,15 @@ module.exports = class Response extends LazyWritable {
             return this.json(body);
         } else if (typeof body === "boolean") {
             return this.json(body);
-        } else if (!isBuffer) {
-            body = String(body);
+        } else if (!isBuffer && typeof body !== "string") {
+            // a symbol, a bigint or a function: express sizes it with byteLength or from(), and
+            // neither takes it, so what node throws is the answer. A string never gets here: it
+            // is the common body, and measuring it twice cost 157us per thousand requests
+            const generateETag = !this.headers["etag"] && typeof this.app._hot().etagFn === "function";
+            if (!generateETag && body.length < 1000) {
+                Buffer.byteLength(body, "utf8");
+            }
+            Buffer.from(body, "utf8");
         }
         if (typeof body === "string" && !isBuffer) {
             const contentType = this.headers["content-type"];
@@ -1130,10 +1208,13 @@ module.exports = class Response extends LazyWritable {
                 }
 
                 if (ranges === -1) {
-                    // the header goes on the response itself, as send writes it before raising
-                    // the error, and the status stays on the error for the handler to apply
-                    this.headers["content-range"] = `bytes */${len}`;
-                    return done(httpError(416));
+                    // on the response as send writes it, and on the error too: the error page
+                    // drops the content headers and writes back only what the error carries
+                    const unsatisfiable = `bytes */${len}`;
+                    this.headers["content-range"] = unsatisfiable;
+                    const err = httpError(416);
+                    err.headers = { "Content-Range": unsatisfiable };
+                    return done(err);
                 }
                 if (ranges !== -2 && ranges.length === 1) {
                     this.status(206);
@@ -1329,6 +1410,14 @@ module.exports = class Response extends LazyWritable {
         // catch it
         const out = Array.isArray(value) ? value.map(String) : String(value);
         validateHeaderValue(field, out);
+        // node writes Connection and Keep-Alive as a pair, and writes neither once the response has
+        // set Connection itself, so the seeded Keep-Alive goes with it. Anything that opens an
+        // event stream sets Connection: the MCP transport does, and so does every SSE library.
+        if (key === "connection" && this.headers["keep-alive"] === SEEDED_KEEP_ALIVE) {
+            // through an index signature: the seeded pair is not optional in what the constructor
+            // infers, so a plain delete of it is a type error
+            delete (/** @type {Record<string, string|string[]>} */ (this.headers)["keep-alive"]);
+        }
         this.headers[key] = out;
         return this;
     }
@@ -1609,9 +1698,17 @@ module.exports = class Response extends LazyWritable {
                 if (Array.isArray(out)) {
                     throw new TypeError("Content-Type cannot be set to an Array");
                 }
-                // every type the mime database gives a charset, not a list of three. The list was
-                // missing application/manifest+json among others, which Express does charset.
-                out = withDefaultCharset(out);
+                // an extension becomes its media type here, charset included
+                const resolved = contentTypeSet(out);
+                if (resolved === false) {
+                    // what the mime database knows nothing about is stored as the false express
+                    // stores, so send() and json() read it as unset and write their own type.
+                    // Through setHeader first, for the checks, then the boolean over the string
+                    this.setHeader(field, "false");
+                    this.headers[name] = /** @type {any} */ (false);
+                    return this;
+                }
+                out = resolved;
             }
             // the name as it was written, not the lowercased one: setHeader lowercases it itself,
             // and it is the name that a refused header is reported by, which Express takes from
@@ -2016,7 +2113,8 @@ module.exports = class Response extends LazyWritable {
 
     /**
      * Sets Content-Type. An extension is looked up as a mime type and gets a charset; anything
-     * containing a slash is used as written. Also available as `contentType()`.
+     * containing a slash is used as written. An extension the database does not know falls back
+     * to octet-stream here, which res.set does not do. Also available as `contentType()`.
      * @param {string} type
      * @returns {this}
      */

package/src/router.js

@@ -930,13 +930,21 @@ module.exports = class Router extends EventEmitter {
             }
             return;
         }
-        if (response.statusCode === 200) {
-            // the status the error carries, as express's own final handler reads it: a body that
-            // was too large or a request cut short is the client's 4xx, not a 500 from here
-            const status = err?.status ?? err?.statusCode;
-            response.statusCode = Number.isInteger(status) && status >= 400 && status <= 599 ? status : 500;
+        // the status express's final handler picks: the error's own when it is an error status,
+        // else the response's when that is one, else 500
+        const own = [err?.status, err?.statusCode].find((s) => typeof s === "number" && s >= 400 && s < 600);
+        let carried;
+        if (own !== undefined) {
+            response.statusCode = own;
+            // only with a status of its own does the error's headers go out, and only after the
+            // page drops the content ones: a 416 carries the Content-Range it wants kept
+            if (err.headers && typeof err.headers === "object") {
+                carried = err.headers;
+            }
+        } else if (!(response.statusCode >= 400 && response.statusCode <= 599)) {
+            response.statusCode = 500;
         }
-        this._sendErrorPage(request, response, err, true);
+        this._sendErrorPage(request, response, err, true, carried);
     }
 
     /**
@@ -1390,13 +1398,21 @@ module.exports = class Router extends EventEmitter {
      * @param {Response} response
      * @param {unknown} err whatever was thrown, which need not be an Error
      * @param {boolean} [checkEnv] whether production should redact it
+     * @param {Record<string, any>} [carried] the headers the error asked for, written last
      */
-    _sendErrorPage(request, response, err, checkEnv = false) {
+    _sendErrorPage(request, response, err, checkEnv = false, carried = undefined) {
         err = this._generateErrorPage(err, response.statusCode, checkEnv);
         request.noEtag = true;
         // a header that cannot be written is what brought the request here in the first place when
         // the throw came out of the flush, and writing it again would throw with nobody left
         response._dropUnwritableHeaders();
+        // the content headers a handler set before failing describe a body that is not this one
+        response.removeHeader("Content-Encoding");
+        response.removeHeader("Content-Language");
+        response.removeHeader("Content-Range");
+        for (const name in carried) {
+            response.setHeader(name, carried[name]);
+        }
         response.setHeader("Content-Type", "text/html; charset=utf-8");
         response.setHeader("X-Content-Type-Options", "nosniff");
         response.setHeader("Content-Security-Policy", "default-src 'none'");

package/src/utils.js

@@ -39,7 +39,8 @@ const { Stats } = require("fs");
  *   expose?: boolean,
  *   code?: string,
  *   type?: string,
- *   types?: string[]
+ *   types?: string[],
+ *   headers?: Record<string, any>
  * }} HttpError
  */
 
@@ -807,6 +808,16 @@ const lookupType = memoizeByString((type) => mime.lookup(type) || "application/o
  */
 const contentTypeFor = memoizeByString((type) => mime.contentType(type) || "application/octet-stream");
 
+/**
+ * The content-type res.set stores for a value, which is what express stores: an extension resolved
+ * to its media type with the charset the database gives it, and false when it resolves to nothing.
+ * A false there is falsy for every default below it, so send() and json() write their own.
+ *
+ * @param {string} value
+ * @returns {string|false}
+ */
+const contentTypeSet = memoizeByString((value) => mime.contentType(value));
+
 /**
  * A media type from either spelling: "html" is looked up in the mime database, while anything
  * containing a slash is already one and is parsed for its parameters.
@@ -1740,6 +1751,7 @@ module.exports = {
     entityTag,
     statTag,
     contentTypeFor,
+    contentTypeSet,
     negotiateEncoding,
     ENCODING_BR,
     ENCODING_GZIP,