ThumbmarkJS Files

Highlights

• The API can now ask the client to send a collect beacon. When the pro API returns a collect directive on the /thumbmark response, the client sends one small, fire-and-forget request to collect.thumbmarkjs.com containing the User-Agent, the resolved thumbmark, and the JA4 TLS fingerprint the API observed for that request. The receiving server also fingerprints the TLS handshake of that connection and stores it alongside those fields, building network-level fraud-detection signals for the account. Targeting and volume are decided entirely server-side, so there is no client-side sampling to tune. See Collect beacon in the README. (#154)
• It never fires for anonymous installs. An install with neither api_key nor simple_request makes no API call at all, so it never receives the directive and never sends the beacon. collect_beacon: false disables it specifically; this is independent of logging, which governs only the anonymous 0.01% sample.

New options

Fixes

• Possible unhandled promise rejection removed. The beacon's fallback fetch was previously wrapped in a timeout race, with the rejection handler attached to the race rather than to the fetch itself. A request that failed after the timeout therefore had no handler and could surface as an uncaught rejection in the host page. The handler is now attached directly to the fetch promise.
• The collect directive is no longer persisted in the cached API response. It is a one-shot, per-request instruction; a cached copy would have re-triggered the beacon on every page load for the whole cache lifetime.

Size

gzip 11,234 → 11,575 B (+341 B, +3.0%); raw 30,422 → 31,580 B.

Note on fingerprint stability

The fingerprint output is unchanged from 1.11.0. Nothing in this release enters the hash or alters getThumbmark()'s return value, so existing thumbmark hashes remain stable across this upgrade.