@indiegems/gem-web-sdk 9.0.0 → 9.1.0

package/docs/server-bundles.md

@@ -80,8 +80,8 @@ To check the download yourself: the package npm serves is, byte for byte, the fi
 also publishes on its download host, with the hash beside it:
 
 ```bash
-curl -fsSL -O https://downloads.gemarcade.com/sdk/v9.0.0/gem-web-sdk.tgz
-curl -fsSL https://downloads.gemarcade.com/sdk/v9.0.0/gem-web-sdk.tgz.sri
+curl -fsSL -O https://downloads.gemarcade.com/sdk/v9.1.0/gem-web-sdk.tgz
+curl -fsSL https://downloads.gemarcade.com/sdk/v9.1.0/gem-web-sdk.tgz.sri
 openssl dgst -sha384 -binary gem-web-sdk.tgz | openssl base64 -A
 ```
 

package/docs/what-a-game-must-do.md

@@ -528,7 +528,10 @@ credit for it until you say so.
   inventory and dialog operable on the standard gamepad mapping with the pointer unused, and a focus
   cue thicker than a hairline — a 1px outline disappears at ten feet. TV remotes arrive as
   **keyboard-class events** (arrows, Enter, Back), so a game that calls itself a keyboard game is a
-  D-pad game on a TV whether it planned to be or not.
+  D-pad game on a TV whether it planned to be or not. One control a gamepad cannot work: a
+  rewarded-ad button. Browsers do not count gamepad input as a press, so a rewarded ask made from
+  one is refused ([`rewarded-ads.md` §3](rewarded-ads.md#3-ask-from-the-press-then-re-read)). A
+  remote's keys do count. Keep the ordinary way on beside the button working.
 - **Title-safe layout.** HUD and critical UI inset at least ~5% of the frame — roughly 48–96px at
   1080p. `env(safe-area-inset-*)` resolves to **0 on every TV**: overscan is a hardware crop the
   browser cannot see, so no platform can hand you the number and your game must apply its own
@@ -1283,8 +1286,10 @@ nothing, so a reward must never be handed out on the strength of it.
 [`cross-promotion.md`](cross-promotion.md) is the page.
 
 A button the player presses for a reward — a revive, an extra attempt — is the same call with
-`format: 'rewarded'`. Your game config declares what each such button grants, the platform writes
-the reward into your game's inventory, and your game reads it there rather than from the answer.
+`format: 'rewarded'`, made from that press itself. The button says it is an ad and names the
+reward, and the Arcade starts the ad as soon as the ask arrives. Your game config declares what
+each such button grants, the platform writes the reward into your game's inventory, and your game
+reads it there rather than from the answer.
 [`rewarded-ads.md`](rewarded-ads.md) is that page.
 
 ## An account upsell, if your game has something to offer one

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indiegems/gem-web-sdk",
-  "version": "9.0.0",
+  "version": "9.1.0",
   "description": "postMessage bridge contract between gem-web and browser-playable games",
   "license": "UNLICENSED",
   "type": "module",

package/schema/bridge.v1.json

@@ -3203,9 +3203,21 @@
         "",
         "  RENDER IT IN YOUR OWN CHROME. Labelled as a promotion, dismissible, and",
         "  focus-trapped over the paused game. Nothing in this message is rendered.",
-        "  For `rewarded`, the player pressed the game's button, and the game's",
-        "  label is not the disclosure: paint an offer sheet that says it is an ad",
-        "  and what the player gets, with a way to decline, BEFORE anything plays.",
+        "  For `rewarded`, the player pressed the game's button, and THAT PRESS IS",
+        "  THE OPT-IN: the game's label says it is an ad and names the reward, so",
+        "  start the ad without a prompt of your own. Label it as an ad for as long",
+        "  as it plays, and let the player close it; closing early is a skip and",
+        "  pays nothing. Where no ad could play and nothing was granted, say so",
+        "  briefly in your own chrome ('No ad available right now').",
+        "",
+        "  DO NOT RELY ON THE FRAME HAVING CHECKED FOR A PRESS. SDK releases after",
+        "  9.0.0 send a rewarded ask only while the frame holds user activation,",
+        "  where the browser reports it. Every SDK from 5.1.0 to 9.0.0 sends one",
+        "  with no such check, so a game pinned to one of those can ask from a",
+        "  timer and start an ad with no press, and a hostile frame posts on the",
+        "  port directly. Even the check cannot say which press caused an ask:",
+        "  activation belongs to the whole frame for a few seconds, so an ask from",
+        "  the game's jump button passes it too.",
         "",
         "  PAUSE WITH `gem.pause`. That message already means 'stop running and stop",
         "  making noise', which is exactly what is wanted while a panel is up. Do",
@@ -3285,8 +3297,8 @@
         "                no; a game reads it identically to `no_ad`.",
         "",
         "AFTER A `rewarded` ASK the player pressed a button, so two of those",
-        "readings change. `shown` means an offer sheet was painted and has",
-        "closed, whatever the player chose inside it, and still grants nothing.",
+        "readings change. `shown` means the parent painted something for the ask",
+        "and it has closed - the ad, however it ended - and still grants nothing.",
         "`no_ad` can arrive with the reward already granted - where no ad serves",
         "and the game's config says to grant without one, for one - so a game",
         "reads its own inventory, never the outcome, to learn whether a reward",