@posthog/core 1.28.6 → 1.29.0

package/dist/cookie.d.ts

@@ -0,0 +1,69 @@
+/**
+ * Minimal cookie-reading interface compatible with Next.js `cookies()`,
+ * `request.cookies`, and plain objects.
+ */
+export interface CookieStore {
+    get(name: string): {
+        value: string;
+    } | undefined;
+}
+/**
+ * Adapts a raw `Cookie` header string into a {@link CookieStore}.
+ */
+export declare function cookieStoreFromHeader(cookieHeader: string): CookieStore;
+export interface PostHogCookieState {
+    distinctId: string;
+    isIdentified: boolean;
+    sessionId?: string;
+    deviceId?: string;
+}
+/**
+ * Returns the PostHog cookie name for the given API key.
+ *
+ * PostHog-js stores state in a cookie named `ph_<sanitized_token>_posthog`.
+ * The token is sanitized by replacing `+` with `PL`, `/` with `SL`, `=` with `EQ`.
+ *
+ * @param apiKey - The PostHog project API key
+ * @returns The cookie name string
+ */
+export declare function getPostHogCookieName(apiKey: string): string;
+/**
+ * Serializes an anonymous ID into the JSON format posthog-js expects.
+ *
+ * When `distinct_id === $device_id`, posthog-js treats the user as anonymous.
+ *
+ * @param anonymousId - The anonymous distinct ID to serialize
+ * @returns JSON string suitable for the PostHog cookie value
+ */
+export declare function serializePostHogCookie(anonymousId: string): string;
+/**
+ * Reads and parses the PostHog cookie from a cookie store.
+ *
+ * Compatible with Next.js `cookies()`, `request.cookies`, and any object
+ * with a `get(name)` method that returns `{ value: string } | undefined`.
+ */
+export declare function readPostHogCookie(cookies: CookieStore, apiKey: string): PostHogCookieState | null;
+/**
+ * Converts cookie state into PostHog properties (e.g. `$session_id`, `$device_id`).
+ */
+export declare function cookieStateToProperties(state: PostHogCookieState | null): Record<string, string> | undefined;
+/**
+ * Parses a PostHog cookie value and extracts identity information.
+ *
+ * The cookie value is a JSON object containing `distinct_id` and `$user_state`.
+ * A user is considered identified if `$user_state` is `'identified'`.
+ *
+ * @param cookieValue - The raw cookie string value
+ * @returns Parsed identity state, or null if the cookie is missing/invalid
+ */
+export declare function parsePostHogCookie(cookieValue: string): PostHogCookieState | null;
+export interface ConsentCookieConfig {
+    consent_persistence_name?: string | null;
+    opt_out_capturing_cookie_prefix?: string | null;
+}
+export declare function getConsentCookieName(apiKey: string, config?: ConsentCookieConfig): string;
+export interface ConsentConfig extends ConsentCookieConfig {
+    opt_out_capturing_by_default?: boolean;
+}
+export declare function isOptedOut(cookies: CookieStore, apiKey: string, config?: ConsentConfig): boolean;
+//# sourceMappingURL=cookie.d.ts.map

package/dist/cookie.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookie.d.ts","sourceRoot":"","sources":["../src/cookie.ts"],"names":[],"mappings":"AAMA;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAA;CACjD;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,YAAY,EAAE,MAAM,GAAG,WAAW,CAmBvE;AAED,MAAM,WAAW,kBAAkB;IACjC,UAAU,EAAE,MAAM,CAAA;IAClB,YAAY,EAAE,OAAO,CAAA;IACrB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAED;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAG3D;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CASlE;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,GAAG,kBAAkB,GAAG,IAAI,CAIjG;AAED;;GAEG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,kBAAkB,GAAG,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAY5G;AAED;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,MAAM,GAAG,kBAAkB,GAAG,IAAI,CAuBjF;AAED,MAAM,WAAW,mBAAmB;IAClC,wBAAwB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACxC,+BAA+B,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAChD;AAID,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,mBAAmB,GAAG,MAAM,CAQzF;AAED,MAAM,WAAW,aAAc,SAAQ,mBAAmB;IACxD,4BAA4B,CAAC,EAAE,OAAO,CAAA;CACvC;AAED,wBAAgB,UAAU,CAAC,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,aAAa,GAAG,OAAO,CAUhG"}

package/dist/cookie.js

@@ -0,0 +1,137 @@
+"use strict";
+var __webpack_require__ = {};
+(()=>{
+    __webpack_require__.d = (exports1, definition)=>{
+        for(var key in definition)if (__webpack_require__.o(definition, key) && !__webpack_require__.o(exports1, key)) Object.defineProperty(exports1, key, {
+            enumerable: true,
+            get: definition[key]
+        });
+    };
+})();
+(()=>{
+    __webpack_require__.o = (obj, prop)=>Object.prototype.hasOwnProperty.call(obj, prop);
+})();
+(()=>{
+    __webpack_require__.r = (exports1)=>{
+        if ('undefined' != typeof Symbol && Symbol.toStringTag) Object.defineProperty(exports1, Symbol.toStringTag, {
+            value: 'Module'
+        });
+        Object.defineProperty(exports1, '__esModule', {
+            value: true
+        });
+    };
+})();
+var __webpack_exports__ = {};
+__webpack_require__.r(__webpack_exports__);
+__webpack_require__.d(__webpack_exports__, {
+    getConsentCookieName: ()=>getConsentCookieName,
+    parsePostHogCookie: ()=>parsePostHogCookie,
+    isOptedOut: ()=>isOptedOut,
+    readPostHogCookie: ()=>readPostHogCookie,
+    serializePostHogCookie: ()=>serializePostHogCookie,
+    cookieStateToProperties: ()=>cookieStateToProperties,
+    getPostHogCookieName: ()=>getPostHogCookieName,
+    cookieStoreFromHeader: ()=>cookieStoreFromHeader
+});
+const index_js_namespaceObject = require("./utils/index.js");
+const uuidv7_js_namespaceObject = require("./vendor/uuidv7.js");
+const COOKIE_PREFIX = 'ph_';
+const COOKIE_SUFFIX = '_posthog';
+function cookieStoreFromHeader(cookieHeader) {
+    const cookies = {};
+    if (cookieHeader) for (const pair of cookieHeader.split(';')){
+        const [key, ...valueParts] = pair.trim().split('=');
+        if (key) {
+            const raw = valueParts.join('=').trim();
+            try {
+                cookies[key.trim()] = decodeURIComponent(raw);
+            } catch  {
+                cookies[key.trim()] = raw;
+            }
+        }
+    }
+    return {
+        get: (name)=>name in cookies ? {
+                value: cookies[name]
+            } : void 0
+    };
+}
+function getPostHogCookieName(apiKey) {
+    const sanitized = apiKey.replace(/\+/g, 'PL').replace(/\//g, 'SL').replace(/=/g, 'EQ');
+    return `${COOKIE_PREFIX}${sanitized}${COOKIE_SUFFIX}`;
+}
+function serializePostHogCookie(anonymousId) {
+    const now = Date.now();
+    const sessionId = (0, uuidv7_js_namespaceObject.uuidv7)();
+    return JSON.stringify({
+        distinct_id: anonymousId,
+        $device_id: anonymousId,
+        $user_state: 'anonymous',
+        $sesid: [
+            now,
+            sessionId,
+            now
+        ]
+    });
+}
+function readPostHogCookie(cookies, apiKey) {
+    const cookieName = getPostHogCookieName(apiKey);
+    const cookie = cookies.get(cookieName);
+    return cookie ? parsePostHogCookie(cookie.value) : null;
+}
+function cookieStateToProperties(state) {
+    if (!state) return;
+    const props = {};
+    if (state.sessionId) props.$session_id = state.sessionId;
+    if (state.deviceId) props.$device_id = state.deviceId;
+    return Object.keys(props).length > 0 ? props : void 0;
+}
+function parsePostHogCookie(cookieValue) {
+    if (!cookieValue) return null;
+    try {
+        const parsed = JSON.parse(cookieValue);
+        if (!parsed || 'object' != typeof parsed || !parsed.distinct_id) return null;
+        const sesid = (0, index_js_namespaceObject.isArray)(parsed.$sesid) ? parsed.$sesid[1] : void 0;
+        return {
+            distinctId: String(parsed.distinct_id),
+            isIdentified: 'identified' === parsed.$user_state,
+            sessionId: 'string' == typeof sesid ? sesid : void 0,
+            deviceId: 'string' == typeof parsed.$device_id ? parsed.$device_id : void 0
+        };
+    } catch  {
+        return null;
+    }
+}
+const CONSENT_PREFIX = '__ph_opt_in_out_';
+function getConsentCookieName(apiKey, config) {
+    if (config?.consent_persistence_name) return config.consent_persistence_name;
+    if (config?.opt_out_capturing_cookie_prefix) return config.opt_out_capturing_cookie_prefix + apiKey;
+    return CONSENT_PREFIX + apiKey;
+}
+function isOptedOut(cookies, apiKey, config) {
+    const cookieName = getConsentCookieName(apiKey, config);
+    const cookie = cookies.get(cookieName);
+    if (cookie) return (0, index_js_namespaceObject.isNoLike)(cookie.value);
+    return config?.opt_out_capturing_by_default ?? false;
+}
+exports.cookieStateToProperties = __webpack_exports__.cookieStateToProperties;
+exports.cookieStoreFromHeader = __webpack_exports__.cookieStoreFromHeader;
+exports.getConsentCookieName = __webpack_exports__.getConsentCookieName;
+exports.getPostHogCookieName = __webpack_exports__.getPostHogCookieName;
+exports.isOptedOut = __webpack_exports__.isOptedOut;
+exports.parsePostHogCookie = __webpack_exports__.parsePostHogCookie;
+exports.readPostHogCookie = __webpack_exports__.readPostHogCookie;
+exports.serializePostHogCookie = __webpack_exports__.serializePostHogCookie;
+for(var __webpack_i__ in __webpack_exports__)if (-1 === [
+    "cookieStateToProperties",
+    "cookieStoreFromHeader",
+    "getConsentCookieName",
+    "getPostHogCookieName",
+    "isOptedOut",
+    "parsePostHogCookie",
+    "readPostHogCookie",
+    "serializePostHogCookie"
+].indexOf(__webpack_i__)) exports[__webpack_i__] = __webpack_exports__[__webpack_i__];
+Object.defineProperty(exports, '__esModule', {
+    value: true
+});

package/dist/cookie.mjs

@@ -0,0 +1,82 @@
+import { isArray, isNoLike } from "./utils/index.mjs";
+import { uuidv7 } from "./vendor/uuidv7.mjs";
+const COOKIE_PREFIX = 'ph_';
+const COOKIE_SUFFIX = '_posthog';
+function cookieStoreFromHeader(cookieHeader) {
+    const cookies = {};
+    if (cookieHeader) for (const pair of cookieHeader.split(';')){
+        const [key, ...valueParts] = pair.trim().split('=');
+        if (key) {
+            const raw = valueParts.join('=').trim();
+            try {
+                cookies[key.trim()] = decodeURIComponent(raw);
+            } catch  {
+                cookies[key.trim()] = raw;
+            }
+        }
+    }
+    return {
+        get: (name)=>name in cookies ? {
+                value: cookies[name]
+            } : void 0
+    };
+}
+function getPostHogCookieName(apiKey) {
+    const sanitized = apiKey.replace(/\+/g, 'PL').replace(/\//g, 'SL').replace(/=/g, 'EQ');
+    return `${COOKIE_PREFIX}${sanitized}${COOKIE_SUFFIX}`;
+}
+function serializePostHogCookie(anonymousId) {
+    const now = Date.now();
+    const sessionId = uuidv7();
+    return JSON.stringify({
+        distinct_id: anonymousId,
+        $device_id: anonymousId,
+        $user_state: 'anonymous',
+        $sesid: [
+            now,
+            sessionId,
+            now
+        ]
+    });
+}
+function readPostHogCookie(cookies, apiKey) {
+    const cookieName = getPostHogCookieName(apiKey);
+    const cookie = cookies.get(cookieName);
+    return cookie ? parsePostHogCookie(cookie.value) : null;
+}
+function cookieStateToProperties(state) {
+    if (!state) return;
+    const props = {};
+    if (state.sessionId) props.$session_id = state.sessionId;
+    if (state.deviceId) props.$device_id = state.deviceId;
+    return Object.keys(props).length > 0 ? props : void 0;
+}
+function parsePostHogCookie(cookieValue) {
+    if (!cookieValue) return null;
+    try {
+        const parsed = JSON.parse(cookieValue);
+        if (!parsed || 'object' != typeof parsed || !parsed.distinct_id) return null;
+        const sesid = isArray(parsed.$sesid) ? parsed.$sesid[1] : void 0;
+        return {
+            distinctId: String(parsed.distinct_id),
+            isIdentified: 'identified' === parsed.$user_state,
+            sessionId: 'string' == typeof sesid ? sesid : void 0,
+            deviceId: 'string' == typeof parsed.$device_id ? parsed.$device_id : void 0
+        };
+    } catch  {
+        return null;
+    }
+}
+const CONSENT_PREFIX = '__ph_opt_in_out_';
+function getConsentCookieName(apiKey, config) {
+    if (config?.consent_persistence_name) return config.consent_persistence_name;
+    if (config?.opt_out_capturing_cookie_prefix) return config.opt_out_capturing_cookie_prefix + apiKey;
+    return CONSENT_PREFIX + apiKey;
+}
+function isOptedOut(cookies, apiKey, config) {
+    const cookieName = getConsentCookieName(apiKey, config);
+    const cookie = cookies.get(cookieName);
+    if (cookie) return isNoLike(cookie.value);
+    return config?.opt_out_capturing_by_default ?? false;
+}
+export { cookieStateToProperties, cookieStoreFromHeader, getConsentCookieName, getPostHogCookieName, isOptedOut, parsePostHogCookie, readPostHogCookie, serializePostHogCookie };

package/dist/gzip.d.ts

@@ -4,6 +4,7 @@
  */
 export declare function isGzipSupported(): boolean;
 export declare const isNativeAsyncGzipReadError: (error: unknown) => boolean;
+export declare const isNativeAsyncGzipError: (error: unknown) => boolean;
 export type GzipCompressOptions = {
     /**
      * By default this helper swallows compression errors and returns null.

package/dist/gzip.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gzip.d.ts","sourceRoot":"","sources":["../src/gzip.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,wBAAgB,eAAe,IAAI,OAAO,CAOzC;AAED,eAAO,MAAM,0BAA0B,GAAI,OAAO,OAAO,KAAG,OAQ3D,CAAA;AAED,MAAM,MAAM,mBAAmB,GAAG;IAChC;;;;;OAKG;IACH,OAAO,CAAC,EAAE,OAAO,CAAA;CAClB,CAAA;AAED;;GAEG;AACH,wBAAsB,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,UAAO,EAAE,OAAO,CAAC,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CA8BrH"}
+{"version":3,"file":"gzip.d.ts","sourceRoot":"","sources":["../src/gzip.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,wBAAgB,eAAe,IAAI,OAAO,CAOzC;AAID,eAAO,MAAM,0BAA0B,GAAI,OAAO,OAAO,KAAG,OAQ3D,CAAA;AAED,eAAO,MAAM,sBAAsB,GAAI,OAAO,OAAO,KAAG,OAQvD,CAAA;AA0DD,MAAM,MAAM,mBAAmB,GAAG;IAChC;;;;;OAKG;IACH,OAAO,CAAC,EAAE,OAAO,CAAA;CAClB,CAAA;AAED;;GAEG;AACH,wBAAsB,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,UAAO,EAAE,OAAO,CAAC,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CAgCrH"}

package/dist/gzip.js

@@ -26,21 +26,60 @@ __webpack_require__.r(__webpack_exports__);
 __webpack_require__.d(__webpack_exports__, {
     gzipCompress: ()=>gzipCompress,
     isGzipSupported: ()=>isGzipSupported,
+    isNativeAsyncGzipError: ()=>isNativeAsyncGzipError,
     isNativeAsyncGzipReadError: ()=>isNativeAsyncGzipReadError
 });
 function isGzipSupported() {
     return 'CompressionStream' in globalThis && 'TextEncoder' in globalThis && 'Response' in globalThis && 'function' == typeof Response.prototype.blob;
 }
+const NATIVE_GZIP_VALIDATION_ERROR = 'NativeGzipValidationError';
 const isNativeAsyncGzipReadError = (error)=>{
     if (!error || 'object' != typeof error) return false;
     const name = 'name' in error ? String(error.name) : '';
     return 'NotReadableError' === name;
 };
+const isNativeAsyncGzipError = (error)=>{
+    if (!error || 'object' != typeof error) return false;
+    const name = 'name' in error ? String(error.name) : '';
+    return isNativeAsyncGzipReadError(error) || name === NATIVE_GZIP_VALIDATION_ERROR;
+};
+let crc32Table;
+const getCrc32Table = ()=>{
+    if (crc32Table) return crc32Table;
+    crc32Table = [];
+    for(let i = 0; i < 256; i++){
+        let crc = i;
+        for(let j = 0; j < 8; j++)crc = 1 & crc ? 0xedb88320 ^ crc >>> 1 : crc >>> 1;
+        crc32Table[i] = crc >>> 0;
+    }
+    return crc32Table;
+};
+const crc32 = (bytes)=>{
+    const table = getCrc32Table();
+    let crc = 0xffffffff;
+    for(let i = 0; i < bytes.length; i++)crc = table[(crc ^ bytes[i]) & 0xff] ^ crc >>> 8;
+    return (0xffffffff ^ crc) >>> 0;
+};
+const throwNativeGzipValidationError = (reason)=>{
+    const error = new Error(`Native gzip produced invalid output: ${reason}`);
+    error.name = NATIVE_GZIP_VALIDATION_ERROR;
+    throw error;
+};
+const validateNativeGzip = async (compressed, inputBytes)=>{
+    if (compressed.size < 18) throwNativeGzipValidationError('too-short');
+    const header = new Uint8Array(await compressed.slice(0, 10).arrayBuffer());
+    if (0x1f !== header[0] || 0x8b !== header[1] || 0x08 !== header[2]) throwNativeGzipValidationError('invalid-header');
+    const trailer = new DataView(await compressed.slice(compressed.size - 8).arrayBuffer());
+    if (trailer.getUint32(0, true) !== crc32(inputBytes)) throwNativeGzipValidationError('invalid-crc');
+    const inputSize = inputBytes.length >>> 0;
+    if (trailer.getUint32(4, true) !== inputSize) throwNativeGzipValidationError('invalid-size');
+};
 async function gzipCompress(input, isDebug = true, options) {
     try {
+        const inputBytes = new TextEncoder().encode(input);
         const compressedStream = new CompressionStream('gzip');
         const writer = compressedStream.writable.getWriter();
-        const writePromise = writer.write(new TextEncoder().encode(input)).then(()=>writer.close()).catch(async (err)=>{
+        const writePromise = writer.write(inputBytes).then(()=>writer.close()).catch(async (err)=>{
             try {
                 await writer.abort(err);
             } catch  {}
@@ -51,6 +90,7 @@ async function gzipCompress(input, isDebug = true, options) {
             responsePromise,
             writePromise
         ]);
+        await validateNativeGzip(compressed, inputBytes);
         return compressed;
     } catch (error) {
         if (options?.rethrow) throw error;
@@ -60,10 +100,12 @@ async function gzipCompress(input, isDebug = true, options) {
 }
 exports.gzipCompress = __webpack_exports__.gzipCompress;
 exports.isGzipSupported = __webpack_exports__.isGzipSupported;
+exports.isNativeAsyncGzipError = __webpack_exports__.isNativeAsyncGzipError;
 exports.isNativeAsyncGzipReadError = __webpack_exports__.isNativeAsyncGzipReadError;
 for(var __webpack_i__ in __webpack_exports__)if (-1 === [
     "gzipCompress",
     "isGzipSupported",
+    "isNativeAsyncGzipError",
     "isNativeAsyncGzipReadError"
 ].indexOf(__webpack_i__)) exports[__webpack_i__] = __webpack_exports__[__webpack_i__];
 Object.defineProperty(exports, '__esModule', {

package/dist/gzip.mjs

@@ -1,16 +1,54 @@
 function isGzipSupported() {
     return 'CompressionStream' in globalThis && 'TextEncoder' in globalThis && 'Response' in globalThis && 'function' == typeof Response.prototype.blob;
 }
+const NATIVE_GZIP_VALIDATION_ERROR = 'NativeGzipValidationError';
 const isNativeAsyncGzipReadError = (error)=>{
     if (!error || 'object' != typeof error) return false;
     const name = 'name' in error ? String(error.name) : '';
     return 'NotReadableError' === name;
 };
+const isNativeAsyncGzipError = (error)=>{
+    if (!error || 'object' != typeof error) return false;
+    const name = 'name' in error ? String(error.name) : '';
+    return isNativeAsyncGzipReadError(error) || name === NATIVE_GZIP_VALIDATION_ERROR;
+};
+let crc32Table;
+const getCrc32Table = ()=>{
+    if (crc32Table) return crc32Table;
+    crc32Table = [];
+    for(let i = 0; i < 256; i++){
+        let crc = i;
+        for(let j = 0; j < 8; j++)crc = 1 & crc ? 0xedb88320 ^ crc >>> 1 : crc >>> 1;
+        crc32Table[i] = crc >>> 0;
+    }
+    return crc32Table;
+};
+const crc32 = (bytes)=>{
+    const table = getCrc32Table();
+    let crc = 0xffffffff;
+    for(let i = 0; i < bytes.length; i++)crc = table[(crc ^ bytes[i]) & 0xff] ^ crc >>> 8;
+    return (0xffffffff ^ crc) >>> 0;
+};
+const throwNativeGzipValidationError = (reason)=>{
+    const error = new Error(`Native gzip produced invalid output: ${reason}`);
+    error.name = NATIVE_GZIP_VALIDATION_ERROR;
+    throw error;
+};
+const validateNativeGzip = async (compressed, inputBytes)=>{
+    if (compressed.size < 18) throwNativeGzipValidationError('too-short');
+    const header = new Uint8Array(await compressed.slice(0, 10).arrayBuffer());
+    if (0x1f !== header[0] || 0x8b !== header[1] || 0x08 !== header[2]) throwNativeGzipValidationError('invalid-header');
+    const trailer = new DataView(await compressed.slice(compressed.size - 8).arrayBuffer());
+    if (trailer.getUint32(0, true) !== crc32(inputBytes)) throwNativeGzipValidationError('invalid-crc');
+    const inputSize = inputBytes.length >>> 0;
+    if (trailer.getUint32(4, true) !== inputSize) throwNativeGzipValidationError('invalid-size');
+};
 async function gzipCompress(input, isDebug = true, options) {
     try {
+        const inputBytes = new TextEncoder().encode(input);
         const compressedStream = new CompressionStream('gzip');
         const writer = compressedStream.writable.getWriter();
-        const writePromise = writer.write(new TextEncoder().encode(input)).then(()=>writer.close()).catch(async (err)=>{
+        const writePromise = writer.write(inputBytes).then(()=>writer.close()).catch(async (err)=>{
             try {
                 await writer.abort(err);
             } catch  {}
@@ -21,6 +59,7 @@ async function gzipCompress(input, isDebug = true, options) {
             responsePromise,
             writePromise
         ]);
+        await validateNativeGzip(compressed, inputBytes);
         return compressed;
     } catch (error) {
         if (options?.rethrow) throw error;
@@ -28,4 +67,4 @@ async function gzipCompress(input, isDebug = true, options) {
         return null;
     }
 }
-export { gzipCompress, isGzipSupported, isNativeAsyncGzipReadError };
+export { gzipCompress, isGzipSupported, isNativeAsyncGzipError, isNativeAsyncGzipReadError };

package/dist/index.d.ts

@@ -1,5 +1,5 @@
 export { getFeatureFlagValue } from './featureFlagUtils';
-export { gzipCompress, isNativeAsyncGzipReadError } from './gzip';
+export { gzipCompress, isNativeAsyncGzipError, isNativeAsyncGzipReadError } from './gzip';
 export * from './utils';
 export * as ErrorTracking from './error-tracking';
 export { buildOtlpLogRecord, buildOtlpLogsPayload, getOtlpSeverityNumber, getOtlpSeverityText, toOtlpAnyValue, toOtlpKeyValueList, } from './logs/logs-utils';
@@ -7,6 +7,7 @@ export { PostHogLogs } from './logs';
 export type { BeforeSendLogFn, BufferedLogEntry, CaptureLogger, LogSdkContext, PostHogLogsConfig, ResolvedPostHogLogsConfig, } from './logs/types';
 export type { CaptureLogOptions, LogAttributeValue, LogAttributes, LogSeverityLevel } from './logs/types';
 export { uuidv7 } from './vendor/uuidv7';
+export * from './cookie';
 export * from './posthog-core';
 export * from './posthog-core-stateless';
 export * from './tracing-headers';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAA;AACxD,OAAO,EAAE,YAAY,EAAE,0BAA0B,EAAE,MAAM,QAAQ,CAAA;AACjE,cAAc,SAAS,CAAA;AACvB,OAAO,KAAK,aAAa,MAAM,kBAAkB,CAAA;AACjD,OAAO,EACL,kBAAkB,EAClB,oBAAoB,EACpB,qBAAqB,EACrB,mBAAmB,EACnB,cAAc,EACd,kBAAkB,GACnB,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAA;AACpC,YAAY,EACV,eAAe,EACf,gBAAgB,EAChB,aAAa,EACb,aAAa,EACb,iBAAiB,EACjB,yBAAyB,GAC1B,MAAM,cAAc,CAAA;AAIrB,YAAY,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAA;AACzG,OAAO,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AACxC,cAAc,gBAAgB,CAAA;AAC9B,cAAc,0BAA0B,CAAA;AACxC,cAAc,mBAAmB,CAAA;AACjC,cAAc,SAAS,CAAA;AACvB,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAA;AACxD,OAAO,EAAE,YAAY,EAAE,sBAAsB,EAAE,0BAA0B,EAAE,MAAM,QAAQ,CAAA;AACzF,cAAc,SAAS,CAAA;AACvB,OAAO,KAAK,aAAa,MAAM,kBAAkB,CAAA;AACjD,OAAO,EACL,kBAAkB,EAClB,oBAAoB,EACpB,qBAAqB,EACrB,mBAAmB,EACnB,cAAc,EACd,kBAAkB,GACnB,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAA;AACpC,YAAY,EACV,eAAe,EACf,gBAAgB,EAChB,aAAa,EACb,aAAa,EACb,iBAAiB,EACjB,yBAAyB,GAC1B,MAAM,cAAc,CAAA;AAIrB,YAAY,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAA;AACzG,OAAO,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AACxC,cAAc,UAAU,CAAA;AACxB,cAAc,gBAAgB,CAAA;AAC9B,cAAc,0BAA0B,CAAA;AACxC,cAAc,mBAAmB,CAAA;AACjC,cAAc,SAAS,CAAA;AACvB,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAA"}

package/dist/index.js

@@ -1,5 +1,8 @@
 "use strict";
 var __webpack_modules__ = {
+    "./cookie": function(module) {
+        module.exports = require("./cookie.js");
+    },
     "./error-tracking": function(module) {
         module.exports = require("./error-tracking/index.js");
     },
@@ -86,12 +89,13 @@ var __webpack_exports__ = {};
         buildOtlpLogRecord: ()=>_logs_logs_utils__WEBPACK_IMPORTED_MODULE_4__.buildOtlpLogRecord,
         buildOtlpLogsPayload: ()=>_logs_logs_utils__WEBPACK_IMPORTED_MODULE_4__.buildOtlpLogsPayload,
         getFeatureFlagValue: ()=>_featureFlagUtils__WEBPACK_IMPORTED_MODULE_0__.getFeatureFlagValue,
-        getLengthFromRules: ()=>_surveys_validation__WEBPACK_IMPORTED_MODULE_11__.getLengthFromRules,
+        getLengthFromRules: ()=>_surveys_validation__WEBPACK_IMPORTED_MODULE_12__.getLengthFromRules,
         getOtlpSeverityNumber: ()=>_logs_logs_utils__WEBPACK_IMPORTED_MODULE_4__.getOtlpSeverityNumber,
         getOtlpSeverityText: ()=>_logs_logs_utils__WEBPACK_IMPORTED_MODULE_4__.getOtlpSeverityText,
-        getRequirementsHint: ()=>_surveys_validation__WEBPACK_IMPORTED_MODULE_11__.getRequirementsHint,
-        getValidationError: ()=>_surveys_validation__WEBPACK_IMPORTED_MODULE_11__.getValidationError,
+        getRequirementsHint: ()=>_surveys_validation__WEBPACK_IMPORTED_MODULE_12__.getRequirementsHint,
+        getValidationError: ()=>_surveys_validation__WEBPACK_IMPORTED_MODULE_12__.getValidationError,
         gzipCompress: ()=>_gzip__WEBPACK_IMPORTED_MODULE_1__.gzipCompress,
+        isNativeAsyncGzipError: ()=>_gzip__WEBPACK_IMPORTED_MODULE_1__.isNativeAsyncGzipError,
         isNativeAsyncGzipReadError: ()=>_gzip__WEBPACK_IMPORTED_MODULE_1__.isNativeAsyncGzipReadError,
         toOtlpAnyValue: ()=>_logs_logs_utils__WEBPACK_IMPORTED_MODULE_4__.toOtlpAnyValue,
         toOtlpKeyValueList: ()=>_logs_logs_utils__WEBPACK_IMPORTED_MODULE_4__.toOtlpKeyValueList,
@@ -104,6 +108,7 @@ var __webpack_exports__ = {};
     for(var __WEBPACK_IMPORT_KEY__ in _utils__WEBPACK_IMPORTED_MODULE_2__)if ([
         "toOtlpKeyValueList",
         "PostHogLogs",
+        "isNativeAsyncGzipError",
         "getOtlpSeverityText",
         "isNativeAsyncGzipReadError",
         "getFeatureFlagValue",
@@ -126,11 +131,36 @@ var __webpack_exports__ = {};
     var _logs_logs_utils__WEBPACK_IMPORTED_MODULE_4__ = __webpack_require__("./logs/logs-utils");
     var _logs__WEBPACK_IMPORTED_MODULE_5__ = __webpack_require__("./logs");
     var _vendor_uuidv7__WEBPACK_IMPORTED_MODULE_6__ = __webpack_require__("./vendor/uuidv7");
-    var _posthog_core__WEBPACK_IMPORTED_MODULE_7__ = __webpack_require__("./posthog-core");
+    var _cookie__WEBPACK_IMPORTED_MODULE_7__ = __webpack_require__("./cookie");
+    var __WEBPACK_REEXPORT_OBJECT__ = {};
+    for(var __WEBPACK_IMPORT_KEY__ in _cookie__WEBPACK_IMPORTED_MODULE_7__)if ([
+        "toOtlpKeyValueList",
+        "PostHogLogs",
+        "isNativeAsyncGzipError",
+        "getOtlpSeverityText",
+        "isNativeAsyncGzipReadError",
+        "getFeatureFlagValue",
+        "uuidv7",
+        "getValidationError",
+        "ErrorTracking",
+        "gzipCompress",
+        "default",
+        "getRequirementsHint",
+        "getOtlpSeverityNumber",
+        "getLengthFromRules",
+        "buildOtlpLogsPayload",
+        "buildOtlpLogRecord",
+        "toOtlpAnyValue"
+    ].indexOf(__WEBPACK_IMPORT_KEY__) < 0) __WEBPACK_REEXPORT_OBJECT__[__WEBPACK_IMPORT_KEY__] = (function(key) {
+        return _cookie__WEBPACK_IMPORTED_MODULE_7__[key];
+    }).bind(0, __WEBPACK_IMPORT_KEY__);
+    __webpack_require__.d(__webpack_exports__, __WEBPACK_REEXPORT_OBJECT__);
+    var _posthog_core__WEBPACK_IMPORTED_MODULE_8__ = __webpack_require__("./posthog-core");
     var __WEBPACK_REEXPORT_OBJECT__ = {};
-    for(var __WEBPACK_IMPORT_KEY__ in _posthog_core__WEBPACK_IMPORTED_MODULE_7__)if ([
+    for(var __WEBPACK_IMPORT_KEY__ in _posthog_core__WEBPACK_IMPORTED_MODULE_8__)if ([
         "toOtlpKeyValueList",
         "PostHogLogs",
+        "isNativeAsyncGzipError",
         "getOtlpSeverityText",
         "isNativeAsyncGzipReadError",
         "getFeatureFlagValue",
@@ -146,14 +176,15 @@ var __webpack_exports__ = {};
         "buildOtlpLogRecord",
         "toOtlpAnyValue"
     ].indexOf(__WEBPACK_IMPORT_KEY__) < 0) __WEBPACK_REEXPORT_OBJECT__[__WEBPACK_IMPORT_KEY__] = (function(key) {
-        return _posthog_core__WEBPACK_IMPORTED_MODULE_7__[key];
+        return _posthog_core__WEBPACK_IMPORTED_MODULE_8__[key];
     }).bind(0, __WEBPACK_IMPORT_KEY__);
     __webpack_require__.d(__webpack_exports__, __WEBPACK_REEXPORT_OBJECT__);
-    var _posthog_core_stateless__WEBPACK_IMPORTED_MODULE_8__ = __webpack_require__("./posthog-core-stateless");
+    var _posthog_core_stateless__WEBPACK_IMPORTED_MODULE_9__ = __webpack_require__("./posthog-core-stateless");
     var __WEBPACK_REEXPORT_OBJECT__ = {};
-    for(var __WEBPACK_IMPORT_KEY__ in _posthog_core_stateless__WEBPACK_IMPORTED_MODULE_8__)if ([
+    for(var __WEBPACK_IMPORT_KEY__ in _posthog_core_stateless__WEBPACK_IMPORTED_MODULE_9__)if ([
         "toOtlpKeyValueList",
         "PostHogLogs",
+        "isNativeAsyncGzipError",
         "getOtlpSeverityText",
         "isNativeAsyncGzipReadError",
         "getFeatureFlagValue",
@@ -169,14 +200,15 @@ var __webpack_exports__ = {};
         "buildOtlpLogRecord",
         "toOtlpAnyValue"
     ].indexOf(__WEBPACK_IMPORT_KEY__) < 0) __WEBPACK_REEXPORT_OBJECT__[__WEBPACK_IMPORT_KEY__] = (function(key) {
-        return _posthog_core_stateless__WEBPACK_IMPORTED_MODULE_8__[key];
+        return _posthog_core_stateless__WEBPACK_IMPORTED_MODULE_9__[key];
     }).bind(0, __WEBPACK_IMPORT_KEY__);
     __webpack_require__.d(__webpack_exports__, __WEBPACK_REEXPORT_OBJECT__);
-    var _tracing_headers__WEBPACK_IMPORTED_MODULE_9__ = __webpack_require__("./tracing-headers");
+    var _tracing_headers__WEBPACK_IMPORTED_MODULE_10__ = __webpack_require__("./tracing-headers");
     var __WEBPACK_REEXPORT_OBJECT__ = {};
-    for(var __WEBPACK_IMPORT_KEY__ in _tracing_headers__WEBPACK_IMPORTED_MODULE_9__)if ([
+    for(var __WEBPACK_IMPORT_KEY__ in _tracing_headers__WEBPACK_IMPORTED_MODULE_10__)if ([
         "toOtlpKeyValueList",
         "PostHogLogs",
+        "isNativeAsyncGzipError",
         "getOtlpSeverityText",
         "isNativeAsyncGzipReadError",
         "getFeatureFlagValue",
@@ -192,14 +224,15 @@ var __webpack_exports__ = {};
         "buildOtlpLogRecord",
         "toOtlpAnyValue"
     ].indexOf(__WEBPACK_IMPORT_KEY__) < 0) __WEBPACK_REEXPORT_OBJECT__[__WEBPACK_IMPORT_KEY__] = (function(key) {
-        return _tracing_headers__WEBPACK_IMPORTED_MODULE_9__[key];
+        return _tracing_headers__WEBPACK_IMPORTED_MODULE_10__[key];
     }).bind(0, __WEBPACK_IMPORT_KEY__);
     __webpack_require__.d(__webpack_exports__, __WEBPACK_REEXPORT_OBJECT__);
-    var _types__WEBPACK_IMPORTED_MODULE_10__ = __webpack_require__("./types");
+    var _types__WEBPACK_IMPORTED_MODULE_11__ = __webpack_require__("./types");
     var __WEBPACK_REEXPORT_OBJECT__ = {};
-    for(var __WEBPACK_IMPORT_KEY__ in _types__WEBPACK_IMPORTED_MODULE_10__)if ([
+    for(var __WEBPACK_IMPORT_KEY__ in _types__WEBPACK_IMPORTED_MODULE_11__)if ([
         "toOtlpKeyValueList",
         "PostHogLogs",
+        "isNativeAsyncGzipError",
         "getOtlpSeverityText",
         "isNativeAsyncGzipReadError",
         "getFeatureFlagValue",
@@ -215,10 +248,10 @@ var __webpack_exports__ = {};
         "buildOtlpLogRecord",
         "toOtlpAnyValue"
     ].indexOf(__WEBPACK_IMPORT_KEY__) < 0) __WEBPACK_REEXPORT_OBJECT__[__WEBPACK_IMPORT_KEY__] = (function(key) {
-        return _types__WEBPACK_IMPORTED_MODULE_10__[key];
+        return _types__WEBPACK_IMPORTED_MODULE_11__[key];
     }).bind(0, __WEBPACK_IMPORT_KEY__);
     __webpack_require__.d(__webpack_exports__, __WEBPACK_REEXPORT_OBJECT__);
-    var _surveys_validation__WEBPACK_IMPORTED_MODULE_11__ = __webpack_require__("./surveys/validation");
+    var _surveys_validation__WEBPACK_IMPORTED_MODULE_12__ = __webpack_require__("./surveys/validation");
 })();
 exports.ErrorTracking = __webpack_exports__.ErrorTracking;
 exports.PostHogLogs = __webpack_exports__.PostHogLogs;
@@ -231,6 +264,7 @@ exports.getOtlpSeverityText = __webpack_exports__.getOtlpSeverityText;
 exports.getRequirementsHint = __webpack_exports__.getRequirementsHint;
 exports.getValidationError = __webpack_exports__.getValidationError;
 exports.gzipCompress = __webpack_exports__.gzipCompress;
+exports.isNativeAsyncGzipError = __webpack_exports__.isNativeAsyncGzipError;
 exports.isNativeAsyncGzipReadError = __webpack_exports__.isNativeAsyncGzipReadError;
 exports.toOtlpAnyValue = __webpack_exports__.toOtlpAnyValue;
 exports.toOtlpKeyValueList = __webpack_exports__.toOtlpKeyValueList;
@@ -247,6 +281,7 @@ for(var __webpack_i__ in __webpack_exports__)if (-1 === [
     "getRequirementsHint",
     "getValidationError",
     "gzipCompress",
+    "isNativeAsyncGzipError",
     "isNativeAsyncGzipReadError",
     "toOtlpAnyValue",
     "toOtlpKeyValueList",

package/dist/index.mjs

@@ -1,13 +1,14 @@
 import { getFeatureFlagValue } from "./featureFlagUtils.mjs";
-import { gzipCompress, isNativeAsyncGzipReadError } from "./gzip.mjs";
+import { gzipCompress, isNativeAsyncGzipError, isNativeAsyncGzipReadError } from "./gzip.mjs";
 import { buildOtlpLogRecord, buildOtlpLogsPayload, getOtlpSeverityNumber, getOtlpSeverityText, toOtlpAnyValue, toOtlpKeyValueList } from "./logs/logs-utils.mjs";
 import { PostHogLogs } from "./logs/index.mjs";
 import { uuidv7 } from "./vendor/uuidv7.mjs";
 import { getLengthFromRules, getRequirementsHint, getValidationError } from "./surveys/validation.mjs";
 export * from "./utils/index.mjs";
+export * from "./cookie.mjs";
 export * from "./posthog-core.mjs";
 export * from "./posthog-core-stateless.mjs";
 export * from "./tracing-headers.mjs";
 export * from "./types.mjs";
 import * as __WEBPACK_EXTERNAL_MODULE__error_tracking_index_mjs_b3406d6f__ from "./error-tracking/index.mjs";
-export { __WEBPACK_EXTERNAL_MODULE__error_tracking_index_mjs_b3406d6f__ as ErrorTracking, PostHogLogs, buildOtlpLogRecord, buildOtlpLogsPayload, getFeatureFlagValue, getLengthFromRules, getOtlpSeverityNumber, getOtlpSeverityText, getRequirementsHint, getValidationError, gzipCompress, isNativeAsyncGzipReadError, toOtlpAnyValue, toOtlpKeyValueList, uuidv7 };
+export { __WEBPACK_EXTERNAL_MODULE__error_tracking_index_mjs_b3406d6f__ as ErrorTracking, PostHogLogs, buildOtlpLogRecord, buildOtlpLogsPayload, getFeatureFlagValue, getLengthFromRules, getOtlpSeverityNumber, getOtlpSeverityText, getRequirementsHint, getValidationError, gzipCompress, isNativeAsyncGzipError, isNativeAsyncGzipReadError, toOtlpAnyValue, toOtlpKeyValueList, uuidv7 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@posthog/core",
-  "version": "1.28.6",
+  "version": "1.29.0",
   "license": "MIT",
   "main": "dist/index.js",
   "module": "dist/index.mjs",
@@ -67,7 +67,7 @@
     }
   },
   "dependencies": {
-    "@posthog/types": "1.373.1"
+    "@posthog/types": "1.373.3"
   },
   "devDependencies": {
     "@rslib/core": "0.10.6",

package/src/cookie.ts

@@ -0,0 +1,173 @@
+import { isArray, isNoLike } from './utils'
+import { uuidv7 } from './vendor/uuidv7'
+
+const COOKIE_PREFIX = 'ph_'
+const COOKIE_SUFFIX = '_posthog'
+
+/**
+ * Minimal cookie-reading interface compatible with Next.js `cookies()`,
+ * `request.cookies`, and plain objects.
+ */
+export interface CookieStore {
+  get(name: string): { value: string } | undefined
+}
+
+/**
+ * Adapts a raw `Cookie` header string into a {@link CookieStore}.
+ */
+export function cookieStoreFromHeader(cookieHeader: string): CookieStore {
+  const cookies: Record<string, string> = {}
+  if (cookieHeader) {
+    for (const pair of cookieHeader.split(';')) {
+      const [key, ...valueParts] = pair.trim().split('=')
+      if (key) {
+        const raw = valueParts.join('=').trim()
+        // `decodeURIComponent` throws `URIError` on malformed sequences (e.g. `%gg`).
+        // The Cookie header is externally controlled, so fall back to the raw value
+        // rather than crashing the request handler.
+        try {
+          cookies[key.trim()] = decodeURIComponent(raw)
+        } catch {
+          cookies[key.trim()] = raw
+        }
+      }
+    }
+  }
+  return { get: (name: string) => (name in cookies ? { value: cookies[name] } : undefined) }
+}
+
+export interface PostHogCookieState {
+  distinctId: string
+  isIdentified: boolean
+  sessionId?: string
+  deviceId?: string
+}
+
+/**
+ * Returns the PostHog cookie name for the given API key.
+ *
+ * PostHog-js stores state in a cookie named `ph_<sanitized_token>_posthog`.
+ * The token is sanitized by replacing `+` with `PL`, `/` with `SL`, `=` with `EQ`.
+ *
+ * @param apiKey - The PostHog project API key
+ * @returns The cookie name string
+ */
+export function getPostHogCookieName(apiKey: string): string {
+  const sanitized = apiKey.replace(/\+/g, 'PL').replace(/\//g, 'SL').replace(/=/g, 'EQ')
+  return `${COOKIE_PREFIX}${sanitized}${COOKIE_SUFFIX}`
+}
+
+/**
+ * Serializes an anonymous ID into the JSON format posthog-js expects.
+ *
+ * When `distinct_id === $device_id`, posthog-js treats the user as anonymous.
+ *
+ * @param anonymousId - The anonymous distinct ID to serialize
+ * @returns JSON string suitable for the PostHog cookie value
+ */
+export function serializePostHogCookie(anonymousId: string): string {
+  const now = Date.now()
+  const sessionId = uuidv7()
+  return JSON.stringify({
+    distinct_id: anonymousId,
+    $device_id: anonymousId,
+    $user_state: 'anonymous',
+    $sesid: [now, sessionId, now],
+  })
+}
+
+/**
+ * Reads and parses the PostHog cookie from a cookie store.
+ *
+ * Compatible with Next.js `cookies()`, `request.cookies`, and any object
+ * with a `get(name)` method that returns `{ value: string } | undefined`.
+ */
+export function readPostHogCookie(cookies: CookieStore, apiKey: string): PostHogCookieState | null {
+  const cookieName = getPostHogCookieName(apiKey)
+  const cookie = cookies.get(cookieName)
+  return cookie ? parsePostHogCookie(cookie.value) : null
+}
+
+/**
+ * Converts cookie state into PostHog properties (e.g. `$session_id`, `$device_id`).
+ */
+export function cookieStateToProperties(state: PostHogCookieState | null): Record<string, string> | undefined {
+  if (!state) {
+    return undefined
+  }
+  const props: Record<string, string> = {}
+  if (state.sessionId) {
+    props.$session_id = state.sessionId
+  }
+  if (state.deviceId) {
+    props.$device_id = state.deviceId
+  }
+  return Object.keys(props).length > 0 ? props : undefined
+}
+
+/**
+ * Parses a PostHog cookie value and extracts identity information.
+ *
+ * The cookie value is a JSON object containing `distinct_id` and `$user_state`.
+ * A user is considered identified if `$user_state` is `'identified'`.
+ *
+ * @param cookieValue - The raw cookie string value
+ * @returns Parsed identity state, or null if the cookie is missing/invalid
+ */
+export function parsePostHogCookie(cookieValue: string): PostHogCookieState | null {
+  if (!cookieValue) {
+    return null
+  }
+
+  try {
+    const parsed = JSON.parse(cookieValue)
+    if (!parsed || typeof parsed !== 'object' || !parsed.distinct_id) {
+      return null
+    }
+
+    // $sesid is stored as [lastActivityTimestamp, sessionId, sessionStartTimestamp]
+    const sesid = isArray(parsed.$sesid) ? parsed.$sesid[1] : undefined
+
+    return {
+      distinctId: String(parsed.distinct_id),
+      isIdentified: parsed.$user_state === 'identified',
+      sessionId: typeof sesid === 'string' ? sesid : undefined,
+      deviceId: typeof parsed.$device_id === 'string' ? parsed.$device_id : undefined,
+    }
+  } catch {
+    return null
+  }
+}
+
+export interface ConsentCookieConfig {
+  consent_persistence_name?: string | null
+  opt_out_capturing_cookie_prefix?: string | null
+}
+
+const CONSENT_PREFIX = '__ph_opt_in_out_'
+
+export function getConsentCookieName(apiKey: string, config?: ConsentCookieConfig): string {
+  if (config?.consent_persistence_name) {
+    return config.consent_persistence_name
+  }
+  if (config?.opt_out_capturing_cookie_prefix) {
+    return config.opt_out_capturing_cookie_prefix + apiKey
+  }
+  return CONSENT_PREFIX + apiKey
+}
+
+export interface ConsentConfig extends ConsentCookieConfig {
+  opt_out_capturing_by_default?: boolean
+}
+
+export function isOptedOut(cookies: CookieStore, apiKey: string, config?: ConsentConfig): boolean {
+  const cookieName = getConsentCookieName(apiKey, config)
+  const cookie = cookies.get(cookieName)
+
+  if (cookie) {
+    return isNoLike(cookie.value)
+  }
+
+  // No consent cookie means pending — defer to config
+  return config?.opt_out_capturing_by_default ?? false
+}

package/src/gzip.ts

@@ -11,6 +11,8 @@ export function isGzipSupported(): boolean {
   )
 }
 
+const NATIVE_GZIP_VALIDATION_ERROR = 'NativeGzipValidationError'
+
 export const isNativeAsyncGzipReadError = (error: unknown): boolean => {
   if (!error || typeof error !== 'object') {
     return false
@@ -21,6 +23,72 @@ export const isNativeAsyncGzipReadError = (error: unknown): boolean => {
   return name === 'NotReadableError'
 }
 
+export const isNativeAsyncGzipError = (error: unknown): boolean => {
+  if (!error || typeof error !== 'object') {
+    return false
+  }
+
+  const name = 'name' in error ? String(error.name) : ''
+
+  return isNativeAsyncGzipReadError(error) || name === NATIVE_GZIP_VALIDATION_ERROR
+}
+
+type NativeGzipValidationReason = 'too-short' | 'invalid-header' | 'invalid-crc' | 'invalid-size'
+
+let crc32Table: number[] | undefined
+
+const getCrc32Table = (): number[] => {
+  if (crc32Table) {
+    return crc32Table
+  }
+
+  crc32Table = []
+  for (let i = 0; i < 256; i++) {
+    let crc = i
+    for (let j = 0; j < 8; j++) {
+      crc = crc & 1 ? 0xedb88320 ^ (crc >>> 1) : crc >>> 1
+    }
+    crc32Table[i] = crc >>> 0
+  }
+  return crc32Table
+}
+
+const crc32 = (bytes: Uint8Array): number => {
+  const table = getCrc32Table()
+  let crc = 0xffffffff
+  for (let i = 0; i < bytes.length; i++) {
+    crc = table[(crc ^ bytes[i]) & 0xff] ^ (crc >>> 8)
+  }
+  return (crc ^ 0xffffffff) >>> 0
+}
+
+const throwNativeGzipValidationError = (reason: NativeGzipValidationReason): never => {
+  const error = new Error(`Native gzip produced invalid output: ${reason}`)
+  error.name = NATIVE_GZIP_VALIDATION_ERROR
+  throw error
+}
+
+const validateNativeGzip = async (compressed: Blob, inputBytes: Uint8Array): Promise<void> => {
+  if (compressed.size < 18) {
+    throwNativeGzipValidationError('too-short')
+  }
+
+  const header = new Uint8Array(await compressed.slice(0, 10).arrayBuffer())
+  if (header[0] !== 0x1f || header[1] !== 0x8b || header[2] !== 0x08) {
+    throwNativeGzipValidationError('invalid-header')
+  }
+
+  const trailer = new DataView(await compressed.slice(compressed.size - 8).arrayBuffer())
+  if (trailer.getUint32(0, true) !== crc32(inputBytes)) {
+    throwNativeGzipValidationError('invalid-crc')
+  }
+
+  const inputSize = inputBytes.length >>> 0
+  if (trailer.getUint32(4, true) !== inputSize) {
+    throwNativeGzipValidationError('invalid-size')
+  }
+}
+
 export type GzipCompressOptions = {
   /**
    * By default this helper swallows compression errors and returns null.
@@ -36,11 +104,12 @@ export type GzipCompressOptions = {
  */
 export async function gzipCompress(input: string, isDebug = true, options?: GzipCompressOptions): Promise<Blob | null> {
   try {
+    const inputBytes = new TextEncoder().encode(input)
     const compressedStream = new CompressionStream('gzip')
     const writer = compressedStream.writable.getWriter()
 
     const writePromise = writer
-      .write(new TextEncoder().encode(input))
+      .write(inputBytes)
       .then(() => writer.close())
       .catch(async (err) => {
         try {
@@ -53,6 +122,7 @@ export async function gzipCompress(input: string, isDebug = true, options?: Gzip
     const responsePromise = new Response(compressedStream.readable).blob()
 
     const [compressed] = await Promise.all([responsePromise, writePromise])
+    await validateNativeGzip(compressed, inputBytes)
     return compressed
   } catch (error) {
     if (options?.rethrow) {

package/src/index.ts

@@ -1,5 +1,5 @@
 export { getFeatureFlagValue } from './featureFlagUtils'
-export { gzipCompress, isNativeAsyncGzipReadError } from './gzip'
+export { gzipCompress, isNativeAsyncGzipError, isNativeAsyncGzipReadError } from './gzip'
 export * from './utils'
 export * as ErrorTracking from './error-tracking'
 export {
@@ -24,6 +24,7 @@ export type {
 // packages to type their `captureLog` calls.
 export type { CaptureLogOptions, LogAttributeValue, LogAttributes, LogSeverityLevel } from './logs/types'
 export { uuidv7 } from './vendor/uuidv7'
+export * from './cookie'
 export * from './posthog-core'
 export * from './posthog-core-stateless'
 export * from './tracing-headers'