@promigence/sdk 0.1.0-beta.15 → 0.1.0-beta.17

package/dist/models.gen.d.ts

@@ -358,7 +358,9 @@ export interface BillingCredits {
      */
     balance_usd: number;
     /**
-     * Available credits cannot start new work.
+     * Available credits cannot pay for new work. That stops new work only where credits pay for
+     * it (`model` `credits`, or the trial); a `postpaid` organization's new work is billed after
+     * use.
      */
     exhausted: boolean;
     /**
@@ -739,6 +741,11 @@ export interface BuildQueued {
      * True when a verification command was given.
      */
     verified: boolean;
+    /**
+     * What to know before the build ends: with `move_alias`, which snapshot gives up the alias
+     * to it once it is stored.
+     */
+    warnings?: Array<string>;
 }
 /**
  * Builds in the period.
@@ -964,6 +971,24 @@ export interface CaptureView {
      */
     snapshot_id: string;
 }
+/**
+ * What applies to a failed run's sandboxes when the run does not say (`capture`).
+ */
+export interface CapturesEffective {
+    /**
+     * Which choice decided it: `project`, `org`, or `default` (neither chose, so the default
+     * applies).
+     */
+    from: CapturesFrom;
+    /**
+     * Whether a failed sandbox is kept so you can reopen it where it broke.
+     */
+    kept: boolean;
+}
+/**
+ * Which choice decides whether a failed run's sandboxes are kept, when the run does not say.
+ */
+export type CapturesFrom = "project" | "org" | "default";
 /**
  * The card on file, enough to recognise it.
  */
@@ -1503,6 +1528,45 @@ export interface ErrorBody {
  * Every error code the API returns. `category` decides whether the failure is billed: `env` is ours (not billed before hand-over; after it, the time since the sandbox's last snapshot is credited back, up to 24 hours, when our side shows the cause), `task` is your command and is billed. The full table is `x-promigence-error-codes` at the document root.
  */
 export type ErrorCode = "fork_failed" | "start_timeout" | "readiness_failed" | "verify_too_slow" | "verify_each_failed" | "toolchain_mismatch" | "sandbox_unresponsive" | "oom_within_tier" | "disk_full_within_tier" | "sandbox_interrupted" | "integrity_mismatch" | "egress_unavailable" | "service_timeout" | "preempted" | "verify_did_not_cover" | "grader_failed" | "nonzero_exit" | "grade_not_passed" | "task_timeout" | "oom_over_tier" | "disk_over_tier" | "shutdown_by_task" | "modified_by_task" | "cap_killed" | "cap_exceeded" | "cap_paused" | "credits_paused" | "aborted_by_client" | "stopped_by_support" | "expired" | "not_started" | "superseded" | "usage" | "internal" | "auth" | "forbidden" | "not_found" | "unreachable" | "rate_limited" | "timeout" | "not_verified" | "snapshot_incompatible" | "storage_limit_reached" | "resume_unavailable" | "sandbox_unreachable" | "capacity_busy" | "region_at_capacity" | "builder_unavailable" | "builder_busy" | "overloaded" | "tier_unavailable" | "snapshot_unavailable" | "capacity_limit" | "build_timeout" | "dockerfile_build_failed" | "image_unresolvable" | "registry_unavailable" | "enoent" | "trial_credits_exhausted" | "credits_exhausted" | "credit_unclaimed" | "setup_required" | "card_required" | "billing_unavailable" | "purchase_limit" | "card_needed" | "auto_reload_unavailable" | "purchases_blocked" | "concurrency_limit" | "egress_cap_reached" | "project_cap_reached" | "spend_limit_reached" | "billing_hold" | "tier_over_plan" | "network_host_refused" | "network_policy_unsupported" | "secrets_in_snapshot" | "secrets_unavailable" | "secret_binding_unsupported" | "idempotency_key_reused" | "idempotency_key_in_use" | "repo_credentials_not_supported" | "account_exists" | "invite_invalid" | "invite_required" | "key_expired" | "account_blocked";
+/**
+ * `POST /v1/sandboxes/{id}/execs/attach`: pick up a command whose connection dropped, by the key
+ * it was started with (the `Promigence-Exec-Key` header).
+ */
+export interface ExecAttach {
+    /**
+     * The key the command was started with.
+     */
+    key: string;
+    /**
+     * A stream only: the same for standard error.
+     */
+    stderr_offset?: number | null;
+    /**
+     * A stream only: how many bytes of standard output you already have; you are sent what
+     * follows. Default 0.
+     */
+    stdout_offset?: number | null;
+}
+/**
+ * `POST /v1/sandboxes/{id}/execs/cancel`: stop a command started with a key, now.
+ */
+export interface ExecCancel {
+    /**
+     * The key the command was started with.
+     */
+    key: string;
+}
+/**
+ * `POST /v1/sandboxes/{id}/execs/cancel`.
+ */
+export interface ExecCancelled {
+    /**
+     * True when the command was still running and is being stopped; false when it had already
+     * ended, which is not a failure.
+     */
+    cancelled: boolean;
+    sandbox_id: string;
+}
 /**
  * `POST /v1/sandboxes/{id}/execs`, and the `exec` of `POST /v1/runs`: one command. `argv` (a
  * non-empty list) or `sh` (a shell line) is required.
@@ -1609,8 +1673,9 @@ export interface ExecResult {
      */
     oom_killed?: boolean;
     /**
-     * Why the command ended without an exit code: `timeout`, `out_of_memory` or `signal`.
-     * Absent when it exited on its own.
+     * Why the command ended without an exit code: `timeout`, `out_of_memory`, `signal`, or
+     * `not_reattached` (it was started with a `Promigence-Exec-Key`, its connection dropped, and
+     * nobody picked it up again in time, so it was stopped). Absent when it exited on its own.
      */
     reason?: string | null;
     sandbox_id: string;
@@ -1791,7 +1856,8 @@ export interface Failure {
 }
 export type FailureCategory = "env" | "snapshot" | "task" | "cap" | "grader" | "preempt" | "other";
 /**
- * `POST /v1/sandboxes/{id}/files/archive`: pack a path into a `.tar.gz` inside the sandbox.
+ * `POST /v1/sandboxes/{id}/files/archive`: pack a path into a `.tar.gz` inside the sandbox. A path
+ * is absolute, or relative to the sandbox's working directory.
  */
 export interface FileArchive {
     /**
@@ -1799,13 +1865,15 @@ export interface FileArchive {
      */
     exclude?: Array<string>;
     /**
-     * Where the archive is written (absolute). Default: beside the source.
+     * Where the archive is written: absolute, or relative to the sandbox's working directory.
+     * Default: beside the source.
      */
     out?: string | null;
     path: string;
 }
 /**
- * `POST /v1/sandboxes/{id}/files/chmod`: at least one of `mode`, `uid`, `gid`.
+ * `POST /v1/sandboxes/{id}/files/chmod`: at least one of `mode`, `uid`, `gid`. The path is absolute,
+ * or relative to the sandbox's working directory.
  */
 export interface FileChmod {
     gid?: number | null;
@@ -1815,7 +1883,8 @@ export interface FileChmod {
     uid?: number | null;
 }
 /**
- * `POST /v1/sandboxes/{id}/files/copy`.
+ * `POST /v1/sandboxes/{id}/files/copy`. A path is absolute, or relative to the sandbox's working
+ * directory.
  */
 export interface FileCopy {
     from: string;
@@ -1824,7 +1893,8 @@ export interface FileCopy {
     to: string;
 }
 /**
- * `DELETE /v1/sandboxes/{id}/files`: a path, and `recursive` for a directory with something in it.
+ * `DELETE /v1/sandboxes/{id}/files`: a path (absolute, or relative to the sandbox's working
+ * directory), and `recursive` for a directory with something in it.
  */
 export interface FileDeleteRequest {
     path: string;
@@ -1845,7 +1915,8 @@ export interface FileDeleted {
     sandbox_id: string;
 }
 /**
- * `POST /v1/sandboxes/{id}/files/extract`.
+ * `POST /v1/sandboxes/{id}/files/extract`. A path is absolute, or relative to the sandbox's
+ * working directory.
  */
 export interface FileExtract {
     archive: string;
@@ -1885,7 +1956,7 @@ export interface FileListRequest {
      */
     limit?: number | null;
     /**
-     * The directory (absolute). Default: `/`.
+     * The directory: absolute, or relative to the sandbox's working directory. Default: `/`.
      */
     path?: string | null;
     /**
@@ -1909,7 +1980,8 @@ export interface FileListing {
     truncated: boolean;
 }
 /**
- * `POST /v1/sandboxes/{id}/files/mkdir`. Paths are absolute.
+ * `POST /v1/sandboxes/{id}/files/mkdir`. A path is absolute, or relative to the sandbox's working
+ * directory (where its commands start).
  */
 export interface FileMkdir {
     mode?: FileMode | null;
@@ -1924,7 +1996,8 @@ export interface FileMkdir {
  */
 export type FileMode = number | string;
 /**
- * `POST /v1/sandboxes/{id}/files/move`.
+ * `POST /v1/sandboxes/{id}/files/move`. A path is absolute, or relative to the sandbox's working
+ * directory.
  */
 export interface FileMove {
     from: string;
@@ -1932,8 +2005,8 @@ export interface FileMove {
     to: string;
 }
 /**
- * `POST /v1/sandboxes/{id}/files/read` and `POST /v1/sandboxes/{id}/files/stat`: one path,
- * absolute, inside the sandbox.
+ * `POST /v1/sandboxes/{id}/files/read` and `POST /v1/sandboxes/{id}/files/stat`: one path inside
+ * the sandbox, absolute or relative to its working directory (where its commands start).
  */
 export interface FilePathRequest {
     path: string;
@@ -1959,7 +2032,8 @@ export interface FileSearchRequest {
      */
     limit?: number | null;
     /**
-     * The directory to search (absolute). Default: `/`.
+     * The directory to search: absolute, or relative to the sandbox's working directory.
+     * Default: `/`.
      */
     path?: string | null;
     /**
@@ -2953,6 +3027,11 @@ export interface Me {
      */
     spend?: number | null;
     spend_detail?: SpendDetail | null;
+    /**
+     * What the organisation stores now, against `limits.max_storage_gb` and
+     * `limits.max_capture_storage_gb`. Absent from a server before it.
+     */
+    storage?: MeStorage | null;
     /**
      * The organisation's trial credit. Absent for a key that may not see the organisation's
      * money: only an owner's key of the default project does.
@@ -2977,6 +3056,11 @@ export interface MeConcurrency {
  * The limits in force for an organisation.
  */
 export interface MeLimits {
+    /**
+     * The storage saved failures may use, in GB: when a new one would pass it, the oldest are
+     * removed to make room; `null` for no limit.
+     */
+    max_capture_storage_gb?: number | null;
     /**
      * Sandboxes that may be live at once.
      */
@@ -2985,6 +3069,10 @@ export interface MeLimits {
      * Sandboxes that may be starting at once.
      */
     max_inflight: number;
+    /**
+     * Paused sandboxes that may be kept; `null` for no limit.
+     */
+    max_paused?: number | null;
     /**
      * The largest sandbox shape, in vCPU; `null` for no limit.
      */
@@ -2993,6 +3081,41 @@ export interface MeLimits {
      * The longest a sandbox may live, in seconds; `null` for no limit.
      */
     max_session_s?: number | null;
+    /**
+     * Snapshots that may be kept; `null` for no limit.
+     */
+    max_snapshots?: number | null;
+    /**
+     * Everything stored together, in GB: snapshots, paused sandboxes and saved failures; `null`
+     * for no limit.
+     */
+    max_storage_gb?: number | null;
+}
+/**
+ * What an organisation stores now (`GET /v1/me` `storage`).
+ */
+export interface MeStorage {
+    /**
+     * Saved failures kept now.
+     */
+    captures: number;
+    /**
+     * Of that, what saved failures use, in bytes (what `limits.max_capture_storage_gb` holds).
+     */
+    captures_bytes: number;
+    /**
+     * Paused sandboxes kept now.
+     */
+    paused: number;
+    /**
+     * Snapshots kept now.
+     */
+    snapshots: number;
+    /**
+     * Everything stored together, in bytes: snapshots, paused sandboxes and saved failures (what
+     * `limits.max_storage_gb` holds; a GB there is 2^30 bytes).
+     */
+    used_bytes: number;
 }
 /**
  * `GET /v1/orgs/{org_id}/members`.
@@ -3074,7 +3197,7 @@ export interface NameCreate {
      */
     name: string;
 }
-export type Network = "none" | "egress";
+export type Network = "none" | "egress" | "allow";
 /**
  * An allowlist: the only hosts the sandbox may reach.
  */
@@ -3224,8 +3347,9 @@ export interface OrgList {
 export interface OrgPatch {
     /**
      * Keep a failed sandbox so it can be reopened where it broke, when a run does not say
-     * (`capture`): `true` or `false`; `null` = the next level's setting. Set by an owner, on its
-     * own (no other field in the same request).
+     * (`capture`): `true` or `false`; `null` = not chosen, so the default applies: not kept unless
+     * the organization or project chose to keep them. A project may choose its own. Set by an
+     * owner, on its own (no other field in the same request).
      */
     failure_captures?: boolean | null;
     /**
@@ -3238,6 +3362,13 @@ export interface OrgPatch {
      * owner.
      */
     output_retention_days?: number | null;
+    /**
+     * The length of new preview URLs when a request does not say: `short` or `long` (a longer,
+     * harder-to-guess URL, for apps with sensitive data); `null` = the default, `short`. A
+     * project may name its own. Set by an owner, on its own (no other field in the same
+     * request). Custom domains are coming soon.
+     */
+    preview_link_length?: PreviewLinkLength | null;
 }
 /**
  * One organization you belong to. Billing, members and credits belong to it.
@@ -3256,10 +3387,18 @@ export interface OrgView {
      */
     default: boolean;
     /**
-     * Whether a failed sandbox is kept so you can reopen it where it broke, when a run does not
-     * say (`capture`); `null` = the default. A project may name its own.
+     * This organization's choice: whether a failed sandbox is kept so you can reopen it where it
+     * broke, when a run does not say (`capture`); `null` = not chosen, so the default applies:
+     * not kept unless the organization or project chose to keep them. A project may choose its
+     * own. What applies is `failure_captures_effective`.
      */
     failure_captures?: boolean | null;
+    /**
+     * What applies to a failed run of this organization when neither the run (`capture`) nor
+     * its project says: kept or not, and which choice decided it. A run's own `capture` is
+     * followed either way.
+     */
+    failure_captures_effective?: CapturesEffective | null;
     members: number;
     name: string;
     org_id: string;
@@ -3268,6 +3407,11 @@ export interface OrgView {
      * name its own.
      */
     output_retention_days?: number | null;
+    /**
+     * The length of new preview URLs when a request does not say (`length`): `short` or `long`;
+     * `null` = the default, `short`. A project may name its own.
+     */
+    preview_link_length?: PreviewLinkLength | null;
     projects: number;
     /**
      * Your role in it: `owner` or `member`.
@@ -3528,19 +3672,30 @@ export interface Port {
      * Unix nanoseconds.
      */
     created_unix_ns?: number | null;
+    /**
+     * When the URL stops working on its own, Unix nanoseconds; `null` when it works until it is
+     * revoked or the sandbox ends.
+     */
+    expires_unix_ns?: number | null;
     /**
      * The same publication addressed by name rather than by path. Apps that emit absolute paths
      * need this form.
      */
     host_url_label?: string | null;
+    /**
+     * `short` (`https://brave-otter-48213.<domain>/`) or `long` (a longer, harder-to-guess
+     * URL). Which one a new URL gets: the request's `length`, else its project's setting, else
+     * its organization's, else `short`.
+     */
+    length?: PreviewLinkLength | null;
     /**
      * The port inside the sandbox.
      */
     port?: number | null;
     sandbox_id: string;
     /**
-     * The token the URL carries. Pass it to `DELETE /v1/sandboxes/{id}/ports/{token_or_port}` to
-     * revoke this one URL.
+     * The token the URL carries. Pass it in the body of `POST /v1/sandboxes/{id}/ports/revoke`
+     * (`{"token": …}`) to revoke this one URL.
      */
     token?: string | null;
     /**
@@ -3559,10 +3714,35 @@ export interface PortList {
  * `POST /v1/sandboxes/{id}/ports`.
  */
 export interface PortOpen {
+    /**
+     * `short` (`https://brave-otter-48213.<domain>/`) or `long` (a longer, harder-to-guess URL,
+     * for apps with sensitive data). Absent: the project's setting, else the organization's,
+     * else `short`. Custom domains are coming soon.
+     */
+    length?: PreviewLinkLength | null;
     /**
      * 1–65535.
      */
     port: number;
+    /**
+     * Seconds until the URL stops working on its own, 1 to 2592000 (30 days). Absent: it works
+     * until it is revoked or the sandbox ends.
+     */
+    ttl_s?: number | null;
+}
+/**
+ * `POST /v1/sandboxes/{id}/ports/revoke`: revoke one URL by its token, or every URL of a port,
+ * with what it names in the body. The token never travels in a URL.
+ */
+export interface PortRevoke {
+    /**
+     * A port: every URL minted for it is revoked. Exactly one of `token` and `port`.
+     */
+    port?: number | null;
+    /**
+     * The token of the one URL to revoke.
+     */
+    token?: string | null;
 }
 /**
  * `POST /v1/billing/portal` — a link to the billing portal.
@@ -3571,7 +3751,7 @@ export interface PortalSession {
     url: string;
 }
 /**
- * `DELETE /v1/sandboxes/{id}/ports/{token_or_port}`.
+ * `POST /v1/sandboxes/{id}/ports/revoke` and `DELETE /v1/sandboxes/{id}/ports/{token_or_port}`.
  */
 export interface PortsRevoked {
     ok: boolean;
@@ -3582,6 +3762,10 @@ export interface PortsRevoked {
     revoked: Array<string>;
     sandbox_id: string;
 }
+/**
+ * How long a preview URL is. Custom domains are coming soon.
+ */
+export type PreviewLinkLength = "short" | "long";
 /**
  * The free credit a new account gets. An account's own credit, and whether it can still claim
  * it, is `GET /v1/credits/offer`.
@@ -3855,8 +4039,9 @@ export interface ProjectMoved {
 export interface ProjectPatch {
     /**
      * Keep a failed sandbox so it can be reopened where it broke, when a run does not say
-     * (`capture`): `true` or `false`; `null` = the next level's setting. Set by an owner, on its
-     * own (no other field in the same request).
+     * (`capture`): `true` or `false`; `null` = not chosen, so the organization's choice applies,
+     * and where neither chose, the default: not kept unless the organization or project chose to
+     * keep them. Set by an owner, on its own (no other field in the same request).
      */
     failure_captures?: boolean | null;
     /**
@@ -3869,6 +4054,13 @@ export interface ProjectPatch {
      * sandbox ends, 1–30; `null` = the organization's setting. Set by an owner.
      */
     output_retention_days?: number | null;
+    /**
+     * The length of this project's new preview URLs when a request does not say: `short` or
+     * `long` (a longer, harder-to-guess URL, for apps with sensitive data); `null` = the
+     * organization's setting. Set by an owner, on its own (no other field in the same request).
+     * Custom domains are coming soon.
+     */
+    preview_link_length?: PreviewLinkLength | null;
 }
 /**
  * One project. API keys belong to a project; a project holds any number of repositories.
@@ -3883,10 +4075,18 @@ export interface ProjectView {
      */
     default: boolean;
     /**
-     * Whether this project's failed sandboxes are kept to reopen, when a run does not say
-     * (`capture`); `null` = the organization's setting. Set by an owner.
+     * This project's choice: whether its failed sandboxes are kept to reopen, when a run does not
+     * say (`capture`); `null` = not chosen, so the organization's choice applies, and where
+     * neither chose, the default: not kept unless the organization or project chose to keep
+     * them. Set by an owner. What applies is `failure_captures_effective`.
      */
     failure_captures?: boolean | null;
+    /**
+     * What applies to this project's failed runs when the run does not say (`capture`): kept or
+     * not, and which choice decided it (this project's, its organization's, or the default). A
+     * run's own `capture` is followed either way.
+     */
+    failure_captures_effective?: CapturesEffective | null;
     /**
      * Keys that still work.
      */
@@ -3913,6 +4113,11 @@ export interface ProjectView {
      * organization's setting. Set by an owner.
      */
     output_retention_days?: number | null;
+    /**
+     * The length of this project's new preview URLs when a request does not say (`length`):
+     * `short` or `long`; `null` = the organization's setting. Set by an owner.
+     */
+    preview_link_length?: PreviewLinkLength | null;
     project_id: string;
 }
 export interface Provenance {
@@ -4158,6 +4363,11 @@ export interface ReplayStats {
     success_pct: number;
 }
 export interface Requested {
+    /**
+     * With `network: "allow"`: the only destinations the run's sandboxes may reach, as the run
+     * named them. Absent for the other modes.
+     */
+    allow?: Array<string>;
     allow_partial: boolean;
     count: number;
     /**
@@ -4736,6 +4946,12 @@ export interface Sandbox {
      */
     holdout_passed?: boolean | null;
     holdout_score?: number | null;
+    /**
+     * `PROMIGENCE_INDEX`: this sandbox's place in its run, from 0. A retry, a replay or a
+     * reopened failure keeps its original's. Absent when the run's command set the variable
+     * itself.
+     */
+    index?: number | null;
     /**
      * True when this is a one-time wait: once the waiting sandboxes can start, the rest of the
      * run starts at once too. False otherwise.
@@ -4763,6 +4979,12 @@ export interface Sandbox {
     retry_of?: string | null;
     sandbox_id: string;
     score?: number | null;
+    /**
+     * `PROMIGENCE_SEED`: the number this sandbox's commands were given in that variable. A
+     * retry, a replay or a reopened failure keeps its original's. Absent when the run's command
+     * set the variable itself.
+     */
+    seed?: number | null;
     state: SandboxState;
     t_end?: string | null;
     t_handoff?: string | null;
@@ -5513,6 +5735,12 @@ export interface SecretStored {
      * of the `*`. Present when `hosts` is.
      */
     urls?: Array<string>;
+    /**
+     * Things to know about the value just stored, one `code: sentence` per line; absent when
+     * there are none. `api_key_value`: the value holds an API key of this service, which any
+     * command in a sandbox given this secret can use.
+     */
+    warnings?: Array<string>;
 }
 /**
  * One stored secret, without its value.
@@ -5692,6 +5920,11 @@ export interface SessionTrial {
  */
 export interface SnapshotAliasSet {
     alias: string | null;
+    /**
+     * Take the name from the snapshot of the project that has it, which stays, unnamed. Without
+     * it, a name another snapshot has is refused.
+     */
+    move_alias?: boolean;
 }
 /**
  * What an image occupies in storage: `allocated`, which can be less than its size.
@@ -5745,6 +5978,11 @@ export interface SnapshotCreate {
      * A container image, `REF@sha256:<digest>`; a tag is resolved to its digest first.
      */
     image?: string | null;
+    /**
+     * With `alias`: take the name from the snapshot of the project that has it, which stays,
+     * unnamed. Without it, an `alias` another snapshot has is refused and nothing is built.
+     */
+    move_alias?: boolean;
     /**
      * `github:` repositories: a branch, a tag or a commit sha, resolved to the commit it names
      * when the build is accepted. Default: the repository's default branch.
@@ -5815,9 +6053,10 @@ export interface SnapshotDeduped {
     alias_applied?: boolean | null;
     /**
      * The alias that was asked for, when the snapshot did not hold it. The snapshot takes it
-     * (`alias_applied: true`) as a new build would: another snapshot of the project that had it
-     * keeps its row, without a name. A snapshot has one alias, so a name it had before gives
-     * way, and `warnings` says which.
+     * (`alias_applied: true`) as a new build would: a name another snapshot of the project has
+     * is taken only with `move_alias`, and that snapshot keeps its row, without a name. A
+     * snapshot has one alias, so a name it had before gives way. `warnings` says which names
+     * moved.
      */
     alias_requested?: string | null;
     /**

package/dist/proxy.js

@@ -1,7 +1,8 @@
 import { request as httpRequest } from "node:http";
 import { request as httpsRequest } from "node:https";
 import { connect as tlsConnect } from "node:tls";
-import { Readable } from "node:stream";
+import { Readable, pipeline } from "node:stream";
+import { constants as zlibConstants, createBrotliDecompress, createGunzip } from "node:zlib";
 import { guardCertChain, makeCertChainGuard } from "./ca-guard.js";
 function withCertGuard(existing) {
     return existing === undefined ? guardCertChain : makeCertChainGuard(existing);
@@ -130,7 +131,32 @@ async function bodyOf(init) {
         return Buffer.from(b);
     return Buffer.from(await new Response(b).arrayBuffer());
 }
-function toResponse(res) {
+const ACCEPT_ENCODING = "br, gzip";
+function decoded(res) {
+    const enc = res.headers["content-encoding"];
+    if (typeof enc !== "string")
+        return res;
+    const steps = [];
+    for (const c of enc.toLowerCase().split(",").map((s) => s.trim()).reverse()) {
+        if (c === "" || c === "identity")
+            continue;
+        if (c === "gzip" || c === "x-gzip") {
+            steps.push(createGunzip({ flush: zlibConstants.Z_SYNC_FLUSH, finishFlush: zlibConstants.Z_SYNC_FLUSH }));
+        }
+        else if (c === "br") {
+            steps.push(createBrotliDecompress({
+                flush: zlibConstants.BROTLI_OPERATION_FLUSH, finishFlush: zlibConstants.BROTLI_OPERATION_FLUSH,
+            }));
+        }
+        else {
+            return res;
+        }
+    }
+    if (steps.length === 0)
+        return res;
+    return pipeline([res, ...steps], () => { });
+}
+function toResponse(res, head) {
     const headers = new Headers();
     for (const [k, v] of Object.entries(res.headers)) {
         if (v === undefined)
@@ -143,7 +169,8 @@ function toResponse(res) {
     }
     const status = res.statusCode ?? 502;
     const noBody = status === 204 || status === 304;
-    return new Response(noBody ? null : Readable.toWeb(res), {
+    const body = head ? res : decoded(res);
+    return new Response(noBody ? null : Readable.toWeb(body), {
         status, statusText: res.statusMessage ?? "", headers,
     });
 }
@@ -156,6 +183,8 @@ export function proxyFetch(proxy) {
         const url = new URL(typeof input === "string" ? input : input instanceof URL ? input.href : input.url);
         const method = (init?.method ?? "GET").toUpperCase();
         const headers = headersOf(init);
+        if (headers["accept-encoding"] === undefined)
+            headers["accept-encoding"] = ACCEPT_ENCODING;
         const body = await bodyOf(init);
         if (body)
             headers["content-length"] = String(body.length);
@@ -178,7 +207,7 @@ export function proxyFetch(proxy) {
             const done = (res) => {
                 settled = true;
                 signal?.removeEventListener("abort", onAbort);
-                resolve(toResponse(res));
+                resolve(toResponse(res, method === "HEAD"));
             };
             if (url.protocol === "http:") {
                 const req = proxyRequest({