@jsenv/server 17.6.4 → 17.6.6

package/dist/client/default_body_4xx_5xx/4xx.html

@@ -94,10 +94,20 @@
           ${css}
         </style>
         <dialog>
-          <p>Connection with server is lost</p>
-          <button autofocus name="reconnect">Retry</button>
+          <p>Connection with server is lost, waiting for it to come back...</p>
+          <button autofocus name="retry">Retry now</button>
         </dialog>`;
       
+      // The peer is a dev server being restarted, not a flaky network: it can be down
+      // for the length of an "npm install" and there is no attempt count past which
+      // giving up would be correct. Attempts space out to RETRY_AFTER_MAX_MS and never
+      // stop; the dialog is a status the page can leave and come back to, so closing
+      // it keeps the loop running and the page still reloads once the server answers.
+      const RETRY_AFTER_MS = 500;
+      const RETRY_AFTER_MAX_MS = 5000;
+      // Most restarts complete before this, so a quick one goes unnoticed.
+      const DIALOG_AFTER_MS = 3000;
+      
       class JsenvAutoreloadOnServerRestart extends HTMLElement {
         constructor({ url } = {}) {
           super();
@@ -105,59 +115,83 @@
           root.innerHTML = html;
       
           const dialog = root.querySelector("dialog");
-          const reconnectButton = dialog.querySelector('button[name="reconnect"]');
+          const retryButton = dialog.querySelector('button[name="retry"]');
       
-          (async () => {
-            const connect = () => {
-              const websocket = new WebSocket(url);
-              const connectedPromise = new Promise((resolve) => {
-                websocket.onerror = () => {
-                  resolve(null);
-                };
-                websocket.onopen = () => {
-                  resolve(websocket);
-                };
-              });
-              return connectedPromise;
-            };
+          const connect = () => {
+            const websocket = new WebSocket(url);
+            return new Promise((resolve) => {
+              websocket.onerror = () => {
+                resolve(null);
+              };
+              websocket.onopen = () => {
+                resolve(websocket);
+              };
+            });
+          };
+      
+          let retryAfter = RETRY_AFTER_MS;
+          let retryTimeout = null;
+          let dialogTimeout = null;
+      
+          const tryToReconnect = async () => {
+            retryTimeout = null;
+            retryButton.disabled = true;
+            const websocket = await connect();
+            if (websocket) {
+              clearTimeout(dialogTimeout);
+              console.info("reconnected to server, reloading the page...");
+              window.location.reload(true);
+              return;
+            }
+            retryButton.disabled = false;
+            retryTimeout = setTimeout(tryToReconnect, retryAfter);
+            const nextRetryAfter = retryAfter * 2;
+            retryAfter =
+              nextRetryAfter > RETRY_AFTER_MAX_MS
+                ? RETRY_AFTER_MAX_MS
+                : nextRetryAfter;
+          };
       
+          const retryNow = () => {
+            if (retryTimeout === null) {
+              return;
+            }
+            clearTimeout(retryTimeout);
+            retryAfter = RETRY_AFTER_MS;
+            tryToReconnect();
+          };
+      
+          const waitForServerToComeBack = () => {
+            console.info("connection to server lost, trying to reconnect");
+            dialogTimeout = setTimeout(() => {
+              dialogTimeout = null;
+              dialog.showModal();
+            }, DIALOG_AFTER_MS);
+            tryToReconnect();
+          };
+      
+          retryButton.onclick = () => {
+            retryNow();
+          };
+          // A tab coming back to the foreground, or the network coming back, are the
+          // moments the server is most likely to be up already; waiting out the
+          // backoff then shows a detached page for no reason.
+          window.addEventListener("online", retryNow);
+          window.addEventListener("focus", retryNow);
+          document.addEventListener("visibilitychange", () => {
+            if (document.visibilityState === "visible") {
+              retryNow();
+            }
+          });
+      
+          (async () => {
             const initialWebSocket = await connect();
             if (!initialWebSocket) {
+              waitForServerToComeBack();
               return;
             }
-            initialWebSocket.onclose = async () => {
-              console.info("connection to server lost, trying to reconnect");
-              const retry = async () => {
-                let attemptCount = 0;
-                let timeToWait = 100;
-                const tryToReconnect = async () => {
-                  const newWebsocket = await connect();
-                  if (newWebsocket) {
-                    dialog.close();
-                    console.info("reconnected to server, reloading the page...");
-                    window.location.reload(true);
-                    return;
-                  }
-                  attemptCount++;
-                  if (attemptCount === 10) {
-                    dialog.showModal();
-                    reconnectButton.onclick = async () => {
-                      reconnectButton.disabled = true;
-                      const previousContext = reconnectButton.textContent;
-                      reconnectButton.textContent = "Retrying...";
-                      await retry();
-                      reconnectButton.textContent = previousContext;
-                      reconnectButton.disabled = false;
-                    };
-                    return;
-                  }
-                  timeToWait += 100;
-                  await new Promise((resolve) => setTimeout(resolve, timeToWait));
-                  await tryToReconnect();
-                };
-                await tryToReconnect();
-              };
-              retry();
+            initialWebSocket.onclose = () => {
+              waitForServerToComeBack();
             };
           })();
         }

package/dist/client/route_inspector/route_inspector.html

@@ -275,10 +275,20 @@
           ${css}
         </style>
         <dialog>
-          <p>Connection with server is lost</p>
-          <button autofocus name="reconnect">Retry</button>
+          <p>Connection with server is lost, waiting for it to come back...</p>
+          <button autofocus name="retry">Retry now</button>
         </dialog>`;
       
+      // The peer is a dev server being restarted, not a flaky network: it can be down
+      // for the length of an "npm install" and there is no attempt count past which
+      // giving up would be correct. Attempts space out to RETRY_AFTER_MAX_MS and never
+      // stop; the dialog is a status the page can leave and come back to, so closing
+      // it keeps the loop running and the page still reloads once the server answers.
+      const RETRY_AFTER_MS = 500;
+      const RETRY_AFTER_MAX_MS = 5000;
+      // Most restarts complete before this, so a quick one goes unnoticed.
+      const DIALOG_AFTER_MS = 3000;
+      
       class JsenvAutoreloadOnServerRestart extends HTMLElement {
         constructor({ url } = {}) {
           super();
@@ -286,59 +296,83 @@
           root.innerHTML = html;
       
           const dialog = root.querySelector("dialog");
-          const reconnectButton = dialog.querySelector('button[name="reconnect"]');
+          const retryButton = dialog.querySelector('button[name="retry"]');
       
-          (async () => {
-            const connect = () => {
-              const websocket = new WebSocket(url);
-              const connectedPromise = new Promise((resolve) => {
-                websocket.onerror = () => {
-                  resolve(null);
-                };
-                websocket.onopen = () => {
-                  resolve(websocket);
-                };
-              });
-              return connectedPromise;
-            };
+          const connect = () => {
+            const websocket = new WebSocket(url);
+            return new Promise((resolve) => {
+              websocket.onerror = () => {
+                resolve(null);
+              };
+              websocket.onopen = () => {
+                resolve(websocket);
+              };
+            });
+          };
+      
+          let retryAfter = RETRY_AFTER_MS;
+          let retryTimeout = null;
+          let dialogTimeout = null;
+      
+          const tryToReconnect = async () => {
+            retryTimeout = null;
+            retryButton.disabled = true;
+            const websocket = await connect();
+            if (websocket) {
+              clearTimeout(dialogTimeout);
+              console.info("reconnected to server, reloading the page...");
+              window.location.reload(true);
+              return;
+            }
+            retryButton.disabled = false;
+            retryTimeout = setTimeout(tryToReconnect, retryAfter);
+            const nextRetryAfter = retryAfter * 2;
+            retryAfter =
+              nextRetryAfter > RETRY_AFTER_MAX_MS
+                ? RETRY_AFTER_MAX_MS
+                : nextRetryAfter;
+          };
       
+          const retryNow = () => {
+            if (retryTimeout === null) {
+              return;
+            }
+            clearTimeout(retryTimeout);
+            retryAfter = RETRY_AFTER_MS;
+            tryToReconnect();
+          };
+      
+          const waitForServerToComeBack = () => {
+            console.info("connection to server lost, trying to reconnect");
+            dialogTimeout = setTimeout(() => {
+              dialogTimeout = null;
+              dialog.showModal();
+            }, DIALOG_AFTER_MS);
+            tryToReconnect();
+          };
+      
+          retryButton.onclick = () => {
+            retryNow();
+          };
+          // A tab coming back to the foreground, or the network coming back, are the
+          // moments the server is most likely to be up already; waiting out the
+          // backoff then shows a detached page for no reason.
+          window.addEventListener("online", retryNow);
+          window.addEventListener("focus", retryNow);
+          document.addEventListener("visibilitychange", () => {
+            if (document.visibilityState === "visible") {
+              retryNow();
+            }
+          });
+      
+          (async () => {
             const initialWebSocket = await connect();
             if (!initialWebSocket) {
+              waitForServerToComeBack();
               return;
             }
-            initialWebSocket.onclose = async () => {
-              console.info("connection to server lost, trying to reconnect");
-              const retry = async () => {
-                let attemptCount = 0;
-                let timeToWait = 100;
-                const tryToReconnect = async () => {
-                  const newWebsocket = await connect();
-                  if (newWebsocket) {
-                    dialog.close();
-                    console.info("reconnected to server, reloading the page...");
-                    window.location.reload(true);
-                    return;
-                  }
-                  attemptCount++;
-                  if (attemptCount === 10) {
-                    dialog.showModal();
-                    reconnectButton.onclick = async () => {
-                      reconnectButton.disabled = true;
-                      const previousContext = reconnectButton.textContent;
-                      reconnectButton.textContent = "Retrying...";
-                      await retry();
-                      reconnectButton.textContent = previousContext;
-                      reconnectButton.disabled = false;
-                    };
-                    return;
-                  }
-                  timeToWait += 100;
-                  await new Promise((resolve) => setTimeout(resolve, timeToWait));
-                  await tryToReconnect();
-                };
-                await tryToReconnect();
-              };
-              retry();
+            initialWebSocket.onclose = () => {
+              waitForServerToComeBack();
             };
           })();
         }

package/dist/jsenv_server.js

@@ -7309,11 +7309,14 @@ const TIMING_NOOP = () => {
  *   - `GET /@jsenv/server/*`, serving this package's own client files;
  *   - `/.internal/alive.websocket` and `/.internal/alive.eventsource`, which a client
  *     subscribes to in order to reload when the server restarts.
- * @param {boolean|Object} [params.serverTiming=false] - `true` or `{ minDuration }` to send
- *   `server-timing` response headers: the time to start responding, the routing of each
- *   plugin, what routes measure with `helpers.timing` and the `timing` a response hands
- *   back. `minDuration` (ms) drops the entries that took less: 0 keeps everything (what a
- *   test wants), a human reading devtools usually wants the sub-millisecond noise gone.
+ * @param {boolean|Function|Object} [params.serverTiming=false] - `true`, `(request) =>
+ *   boolean` or `{ enabled, minDuration }` to send `server-timing` response headers: the
+ *   time to start responding, the routing of each plugin, what routes measure with
+ *   `helpers.timing` and the `timing` a response hands back. `enabled` can be a function
+ *   too: it is asked once per request, so a server can measure for a client it recognizes
+ *   (a header, a cookie, an origin) and stay silent for everyone else. `minDuration` (ms)
+ *   drops the entries that took less: 0 keeps everything (what a test wants), a human
+ *   reading devtools usually wants the sub-millisecond noise gone.
  * @param {number} [params.requestWaitingMs=0] - Call `requestWaitingCallback` when a request
  *   still has no response after that many ms (0 disables).
  * @param {Function} [params.requestWaitingCallback] - `({ request, requestWaitingMs })`, logs a warning by default.
@@ -7670,13 +7673,16 @@ const startServer = async ({
     sendResponseOperation.addAbortSignal(receiveRequestOperation.signal);
     return [receiveRequestOperation, sendResponseOperation];
   };
-  const serverTimingMinDuration =
-    serverTiming && typeof serverTiming === "object"
-      ? serverTiming.minDuration || 0
-      : 0;
+  const { serverTimingEnabled, serverTimingMinDuration } =
+    resolveServerTiming(serverTiming);
   const getResponseProperties = async (request) => {
+    // Asked once per request, on what the client sent: an api can then measure
+    // for everyone and disclose to a token, a cookie, an origin — instead of
+    // choosing between measuring nothing and telling every client what it does
+    // internally.
+    const timingEnabled = serverTimingEnabled(request);
     const timings = {};
-    const timing = serverTiming
+    const timing = timingEnabled
       ? (name) => {
           const start = performance.now();
           timings[name] = null;
@@ -7711,7 +7717,7 @@ const startServer = async ({
 
     let headersToInject;
     const finalizeResponseProperties = (responseProperties) => {
-      if (serverTiming) {
+      if (timingEnabled) {
         startRespondingTiming.end();
         // A response can hand back measures of its own (a `timing` property —
         // durations keyed by description, null for a plain marker): they join
@@ -8233,6 +8239,36 @@ const PROCESS_TEARDOWN_EVENTS_MAP = {
   exit: STOP_REASON_PROCESS_EXIT,
 };
 
+const SERVER_TIMING_DISABLED = () => false;
+const SERVER_TIMING_ENABLED = () => true;
+
+const resolveServerTiming = (serverTiming) => {
+  if (typeof serverTiming === "function") {
+    return {
+      serverTimingEnabled: serverTiming,
+      serverTimingMinDuration: 0,
+    };
+  }
+  if (serverTiming && typeof serverTiming === "object") {
+    const { enabled = true, minDuration = 0 } = serverTiming;
+    return {
+      serverTimingEnabled:
+        typeof enabled === "function"
+          ? enabled
+          : enabled
+            ? SERVER_TIMING_ENABLED
+            : SERVER_TIMING_DISABLED,
+      serverTimingMinDuration: minDuration,
+    };
+  }
+  return {
+    serverTimingEnabled: serverTiming
+      ? SERVER_TIMING_ENABLED
+      : SERVER_TIMING_DISABLED,
+    serverTimingMinDuration: 0,
+  };
+};
+
 const internalErrorHtmlFileUrl = import.meta.resolve("./client/error_handler/500.html");
 let internalErrorHtmlTemplate;
 const readInternalErrorHtmlTemplate = () => {
@@ -8421,6 +8457,9 @@ class ProgressiveResponse {
  * so here we just need to add the CORS headers to the response
  */
 
+const TIMING_ALLOW_ORIGIN_DISABLED = () => false;
+const TIMING_ALLOW_ORIGIN_ENABLED = () => true;
+
 const jsenvAccessControlAllowedHeaders = ["x-requested-with"];
 
 const jsenvAccessControlAllowedMethods = [
@@ -8453,8 +8492,10 @@ const jsenvAccessControlAllowedMethods = [
  * @param {boolean} [params.accessControlAllowCredentials=false] - Send
  *   `access-control-allow-credentials: true`.
  * @param {number} [params.accessControlMaxAge=600] - Seconds a browser may cache the preflight.
- * @param {boolean} [params.timingAllowOrigin=false] - Send `timing-allow-origin` so the
- *   allowed origin can read resource timing.
+ * @param {boolean|Function} [params.timingAllowOrigin=false] - Send `timing-allow-origin`
+ *   so the allowed origin can read resource timing (the `server-timing` header included).
+ *   A `(request) => boolean` is asked once per request, so it can be the very test that
+ *   decides `startServer({ serverTiming })`.
  * @returns {Object|Array} The plugin, or `[]` when CORS stays disabled.
  */
 const serverPluginCORS = ({
@@ -8482,6 +8523,12 @@ const serverPluginCORS = ({
   const allowedOriginChecker = createAllowedOriginChecker(
     accessControlAllowedOrigins,
   );
+  const timingAllowOriginEnabled =
+    typeof timingAllowOrigin === "function"
+      ? timingAllowOrigin
+      : timingAllowOrigin
+        ? TIMING_ALLOW_ORIGIN_ENABLED
+        : TIMING_ALLOW_ORIGIN_DISABLED;
 
   return {
     name: "jsenv:cors",
@@ -8496,7 +8543,7 @@ const serverPluginCORS = ({
         accessControlAllowRequestHeaders,
         accessControlAllowCredentials,
         accessControlMaxAge,
-        timingAllowOrigin,
+        timingAllowOriginEnabled,
       });
       return {
         headers: accessControlHeaders,
@@ -8550,7 +8597,7 @@ const originPatternToRegExp = (originPattern) => {
 // https://www.w3.org/TR/cors/
 // https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS
 const generateAccessControlHeaders = ({
-  request: { headers },
+  request,
   allowedOriginChecker,
   accessControlAllowRequestOrigin,
   accessControlAllowedMethods,
@@ -8561,8 +8608,9 @@ const generateAccessControlHeaders = ({
   // by default OPTIONS request can be cache for a long time, it's not going to change soon ?
   // we could put a lot here, see https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Max-Age
   accessControlMaxAge = 600,
-  timingAllowOrigin,
+  timingAllowOriginEnabled,
 } = {}) => {
+  const { headers } = request;
   const vary = [];
 
   // Access-Control-Allow-Origin must be a single value (not a list).
@@ -8626,7 +8674,9 @@ const generateAccessControlHeaders = ({
       ? { "access-control-allow-credentials": true }
       : {}),
     "access-control-max-age": accessControlMaxAge,
-    ...(timingAllowOrigin ? { "timing-allow-origin": allowOrigin } : {}),
+    ...(timingAllowOriginEnabled(request)
+      ? { "timing-allow-origin": allowOrigin }
+      : {}),
     ...(vary.length ? { vary: vary.join(", ") } : {}),
   };
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jsenv/server",
-  "version": "17.6.4",
+  "version": "17.6.6",
   "type": "module",
   "description": "A modern Node.js HTTP server with declarative routing, content negotiation, and WebSocket support",
   "repository": {
@@ -56,8 +56,8 @@
     "@jsenv/utils": "../../tooling/utils",
     "eventsource": "5.1.1",
     "formidable": "3.5.4",
-    "playwright": "1.62.1",
-    "undici": "8.10.0",
+    "playwright": "1.63.0",
+    "undici": "8.10.2",
     "ws": "8.21.3"
   },
   "publishConfig": {

package/src/plugins/autoreload_on_server_restart/client/autoreload_on_server_restart.js

@@ -26,10 +26,20 @@ const html = /* html */ `<style>
     ${css}
   </style>
   <dialog>
-    <p>Connection with server is lost</p>
-    <button autofocus name="reconnect">Retry</button>
+    <p>Connection with server is lost, waiting for it to come back...</p>
+    <button autofocus name="retry">Retry now</button>
   </dialog>`;
 
+// The peer is a dev server being restarted, not a flaky network: it can be down
+// for the length of an "npm install" and there is no attempt count past which
+// giving up would be correct. Attempts space out to RETRY_AFTER_MAX_MS and never
+// stop; the dialog is a status the page can leave and come back to, so closing
+// it keeps the loop running and the page still reloads once the server answers.
+const RETRY_AFTER_MS = 500;
+const RETRY_AFTER_MAX_MS = 5000;
+// Most restarts complete before this, so a quick one goes unnoticed.
+const DIALOG_AFTER_MS = 3000;
+
 class JsenvAutoreloadOnServerRestart extends HTMLElement {
   constructor({ url } = {}) {
     super();
@@ -37,59 +47,83 @@ class JsenvAutoreloadOnServerRestart extends HTMLElement {
     root.innerHTML = html;
 
     const dialog = root.querySelector("dialog");
-    const reconnectButton = dialog.querySelector('button[name="reconnect"]');
+    const retryButton = dialog.querySelector('button[name="retry"]');
 
-    (async () => {
-      const connect = () => {
-        const websocket = new WebSocket(url);
-        const connectedPromise = new Promise((resolve) => {
-          websocket.onerror = () => {
-            resolve(null);
-          };
-          websocket.onopen = () => {
-            resolve(websocket);
-          };
-        });
-        return connectedPromise;
-      };
+    const connect = () => {
+      const websocket = new WebSocket(url);
+      return new Promise((resolve) => {
+        websocket.onerror = () => {
+          resolve(null);
+        };
+        websocket.onopen = () => {
+          resolve(websocket);
+        };
+      });
+    };
+
+    let retryAfter = RETRY_AFTER_MS;
+    let retryTimeout = null;
+    let dialogTimeout = null;
+
+    const tryToReconnect = async () => {
+      retryTimeout = null;
+      retryButton.disabled = true;
+      const websocket = await connect();
+      if (websocket) {
+        clearTimeout(dialogTimeout);
+        console.info("reconnected to server, reloading the page...");
+        window.location.reload(true);
+        return;
+      }
+      retryButton.disabled = false;
+      retryTimeout = setTimeout(tryToReconnect, retryAfter);
+      const nextRetryAfter = retryAfter * 2;
+      retryAfter =
+        nextRetryAfter > RETRY_AFTER_MAX_MS
+          ? RETRY_AFTER_MAX_MS
+          : nextRetryAfter;
+    };
 
+    const retryNow = () => {
+      if (retryTimeout === null) {
+        return;
+      }
+      clearTimeout(retryTimeout);
+      retryAfter = RETRY_AFTER_MS;
+      tryToReconnect();
+    };
+
+    const waitForServerToComeBack = () => {
+      console.info("connection to server lost, trying to reconnect");
+      dialogTimeout = setTimeout(() => {
+        dialogTimeout = null;
+        dialog.showModal();
+      }, DIALOG_AFTER_MS);
+      tryToReconnect();
+    };
+
+    retryButton.onclick = () => {
+      retryNow();
+    };
+    // A tab coming back to the foreground, or the network coming back, are the
+    // moments the server is most likely to be up already; waiting out the
+    // backoff then shows a detached page for no reason.
+    window.addEventListener("online", retryNow);
+    window.addEventListener("focus", retryNow);
+    document.addEventListener("visibilitychange", () => {
+      if (document.visibilityState === "visible") {
+        retryNow();
+      }
+    });
+
+    (async () => {
       const initialWebSocket = await connect();
       if (!initialWebSocket) {
+        waitForServerToComeBack();
         return;
       }
-      initialWebSocket.onclose = async () => {
-        console.info("connection to server lost, trying to reconnect");
-        const retry = async () => {
-          let attemptCount = 0;
-          let timeToWait = 100;
-          const tryToReconnect = async () => {
-            const newWebsocket = await connect();
-            if (newWebsocket) {
-              dialog.close();
-              console.info("reconnected to server, reloading the page...");
-              window.location.reload(true);
-              return;
-            }
-            attemptCount++;
-            if (attemptCount === 10) {
-              dialog.showModal();
-              reconnectButton.onclick = async () => {
-                reconnectButton.disabled = true;
-                const previousContext = reconnectButton.textContent;
-                reconnectButton.textContent = "Retrying...";
-                await retry();
-                reconnectButton.textContent = previousContext;
-                reconnectButton.disabled = false;
-              };
-              return;
-            }
-            timeToWait += 100;
-            await new Promise((resolve) => setTimeout(resolve, timeToWait));
-            await tryToReconnect();
-          };
-          await tryToReconnect();
-        };
-        retry();
+      initialWebSocket.onclose = () => {
+        waitForServerToComeBack();
       };
     })();
   }

package/src/plugins/cors/server_plugin_cors.js

@@ -3,6 +3,9 @@
  * so here we just need to add the CORS headers to the response
  */
 
+const TIMING_ALLOW_ORIGIN_DISABLED = () => false;
+const TIMING_ALLOW_ORIGIN_ENABLED = () => true;
+
 export const jsenvAccessControlAllowedHeaders = ["x-requested-with"];
 
 export const jsenvAccessControlAllowedMethods = [
@@ -35,8 +38,10 @@ export const jsenvAccessControlAllowedMethods = [
  * @param {boolean} [params.accessControlAllowCredentials=false] - Send
  *   `access-control-allow-credentials: true`.
  * @param {number} [params.accessControlMaxAge=600] - Seconds a browser may cache the preflight.
- * @param {boolean} [params.timingAllowOrigin=false] - Send `timing-allow-origin` so the
- *   allowed origin can read resource timing.
+ * @param {boolean|Function} [params.timingAllowOrigin=false] - Send `timing-allow-origin`
+ *   so the allowed origin can read resource timing (the `server-timing` header included).
+ *   A `(request) => boolean` is asked once per request, so it can be the very test that
+ *   decides `startServer({ serverTiming })`.
  * @returns {Object|Array} The plugin, or `[]` when CORS stays disabled.
  */
 export const serverPluginCORS = ({
@@ -64,6 +69,12 @@ export const serverPluginCORS = ({
   const allowedOriginChecker = createAllowedOriginChecker(
     accessControlAllowedOrigins,
   );
+  const timingAllowOriginEnabled =
+    typeof timingAllowOrigin === "function"
+      ? timingAllowOrigin
+      : timingAllowOrigin
+        ? TIMING_ALLOW_ORIGIN_ENABLED
+        : TIMING_ALLOW_ORIGIN_DISABLED;
 
   return {
     name: "jsenv:cors",
@@ -78,7 +89,7 @@ export const serverPluginCORS = ({
         accessControlAllowRequestHeaders,
         accessControlAllowCredentials,
         accessControlMaxAge,
-        timingAllowOrigin,
+        timingAllowOriginEnabled,
       });
       return {
         headers: accessControlHeaders,
@@ -132,7 +143,7 @@ const originPatternToRegExp = (originPattern) => {
 // https://www.w3.org/TR/cors/
 // https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS
 const generateAccessControlHeaders = ({
-  request: { headers },
+  request,
   allowedOriginChecker,
   accessControlAllowRequestOrigin,
   accessControlAllowedMethods,
@@ -143,8 +154,9 @@ const generateAccessControlHeaders = ({
   // by default OPTIONS request can be cache for a long time, it's not going to change soon ?
   // we could put a lot here, see https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Max-Age
   accessControlMaxAge = 600,
-  timingAllowOrigin,
+  timingAllowOriginEnabled,
 } = {}) => {
+  const { headers } = request;
   const vary = [];
 
   // Access-Control-Allow-Origin must be a single value (not a list).
@@ -208,7 +220,9 @@ const generateAccessControlHeaders = ({
       ? { "access-control-allow-credentials": true }
       : {}),
     "access-control-max-age": accessControlMaxAge,
-    ...(timingAllowOrigin ? { "timing-allow-origin": allowOrigin } : {}),
+    ...(timingAllowOriginEnabled(request)
+      ? { "timing-allow-origin": allowOrigin }
+      : {}),
     ...(vary.length ? { vary: vary.join(", ") } : {}),
   };
 };

package/src/start_server.js

@@ -129,11 +129,14 @@ const TIMING_NOOP = () => {
  *   - `GET /@jsenv/server/*`, serving this package's own client files;
  *   - `/.internal/alive.websocket` and `/.internal/alive.eventsource`, which a client
  *     subscribes to in order to reload when the server restarts.
- * @param {boolean|Object} [params.serverTiming=false] - `true` or `{ minDuration }` to send
- *   `server-timing` response headers: the time to start responding, the routing of each
- *   plugin, what routes measure with `helpers.timing` and the `timing` a response hands
- *   back. `minDuration` (ms) drops the entries that took less: 0 keeps everything (what a
- *   test wants), a human reading devtools usually wants the sub-millisecond noise gone.
+ * @param {boolean|Function|Object} [params.serverTiming=false] - `true`, `(request) =>
+ *   boolean` or `{ enabled, minDuration }` to send `server-timing` response headers: the
+ *   time to start responding, the routing of each plugin, what routes measure with
+ *   `helpers.timing` and the `timing` a response hands back. `enabled` can be a function
+ *   too: it is asked once per request, so a server can measure for a client it recognizes
+ *   (a header, a cookie, an origin) and stay silent for everyone else. `minDuration` (ms)
+ *   drops the entries that took less: 0 keeps everything (what a test wants), a human
+ *   reading devtools usually wants the sub-millisecond noise gone.
  * @param {number} [params.requestWaitingMs=0] - Call `requestWaitingCallback` when a request
  *   still has no response after that many ms (0 disables).
  * @param {Function} [params.requestWaitingCallback] - `({ request, requestWaitingMs })`, logs a warning by default.
@@ -490,13 +493,16 @@ export const startServer = async ({
     sendResponseOperation.addAbortSignal(receiveRequestOperation.signal);
     return [receiveRequestOperation, sendResponseOperation];
   };
-  const serverTimingMinDuration =
-    serverTiming && typeof serverTiming === "object"
-      ? serverTiming.minDuration || 0
-      : 0;
+  const { serverTimingEnabled, serverTimingMinDuration } =
+    resolveServerTiming(serverTiming);
   const getResponseProperties = async (request) => {
+    // Asked once per request, on what the client sent: an api can then measure
+    // for everyone and disclose to a token, a cookie, an origin — instead of
+    // choosing between measuring nothing and telling every client what it does
+    // internally.
+    const timingEnabled = serverTimingEnabled(request);
     const timings = {};
-    const timing = serverTiming
+    const timing = timingEnabled
       ? (name) => {
           const start = performance.now();
           timings[name] = null;
@@ -531,7 +537,7 @@ export const startServer = async ({
 
     let headersToInject;
     const finalizeResponseProperties = (responseProperties) => {
-      if (serverTiming) {
+      if (timingEnabled) {
         startRespondingTiming.end();
         // A response can hand back measures of its own (a `timing` property —
         // durations keyed by description, null for a plain marker): they join
@@ -1057,3 +1063,33 @@ const PROCESS_TEARDOWN_EVENTS_MAP = {
   beforeExit: STOP_REASON_PROCESS_BEFORE_EXIT,
   exit: STOP_REASON_PROCESS_EXIT,
 };
+
+const SERVER_TIMING_DISABLED = () => false;
+const SERVER_TIMING_ENABLED = () => true;
+
+const resolveServerTiming = (serverTiming) => {
+  if (typeof serverTiming === "function") {
+    return {
+      serverTimingEnabled: serverTiming,
+      serverTimingMinDuration: 0,
+    };
+  }
+  if (serverTiming && typeof serverTiming === "object") {
+    const { enabled = true, minDuration = 0 } = serverTiming;
+    return {
+      serverTimingEnabled:
+        typeof enabled === "function"
+          ? enabled
+          : enabled
+            ? SERVER_TIMING_ENABLED
+            : SERVER_TIMING_DISABLED,
+      serverTimingMinDuration: minDuration,
+    };
+  }
+  return {
+    serverTimingEnabled: serverTiming
+      ? SERVER_TIMING_ENABLED
+      : SERVER_TIMING_DISABLED,
+    serverTimingMinDuration: 0,
+  };
+};