@indiegems/gem-web-sdk 9.1.2 → 9.1.4

package/docs/changelog.md

@@ -16,6 +16,18 @@ Its entries are grouped under up to five headings:
 - **Rebuild**: a type changed. Recompile against the new version; code that compiles today keeps compiling unless the entry says otherwise.
 - **New capability**: something a game can now do. Nothing changes unless you use it.
 
+## 9.1.4
+
+Upgrading from 9.1.3. Impact: none.
+
+Nothing in this release asks anything of a game.
+
+## 9.1.3
+
+Upgrading from 9.1.2. Impact: none.
+
+Nothing in this release asks anything of a game.
+
 ## 9.1.2
 
 Upgrading from 9.1.1. Impact: none.

package/docs/getting-started.md

@@ -50,7 +50,7 @@ either way.
 ```jsonc
 // package.json
 "dependencies": {
-  "@indiegems/gem-web-sdk": "9.1.2"
+  "@indiegems/gem-web-sdk": "9.1.4"
 }
 ```
 
@@ -248,12 +248,12 @@ Once it is open:
 - **Fullscreen covers it.** Leave fullscreen to see it again.
 
 The panel is also reachable from inside your game — see
-[GemDevTools.open](https://gemarcade.com/developer/api/game#gemdevtools-open), which answers
+[GemDevTools.open](api/api-reference-game.md#gemdevtools-open), which answers
 `false` for a session that was not granted it rather than throwing — though it does reject if a
 panel it _is_ allowed to open fails to load, so catch it either way.
 
 If you put your own button on it, gate the button on
-[`onDevToolsPermissionChange`](https://gemarcade.com/developer/api/game#gemoptions-ondevtoolspermissionchange)
+[`onDevToolsPermissionChange`](api/api-reference-game.md#gemoptions-ondevtoolspermissionchange)
 rather than checking anything at boot:
 
 ```js
@@ -559,5 +559,5 @@ credential made for a build pipeline can upload and promote, and cannot delete.
   items, shops or loot. Start with **[the shop tutorial](game-economy-tutorial.md)** to build one.
 - **[Rooms and the match lifecycle](rooms-and-matches.md)** — if it is multiplayer.
 
-The [API reference](https://gemarcade.com/developer/api) has every symbol the SDK publishes,
-with signatures and descriptions.
+The [API reference](api/api-reference-game.md) has every symbol the SDK publishes, with
+signatures and descriptions; the [server half](api/api-reference-server.md) is beside it.

package/docs/manifest.json

@@ -33,8 +33,8 @@
     },
     {
       "file": "changelog.md",
-      "sha256": "97c84086804c395ca9674cb0dc0bc5336ac1c49adcfc68d85c144655659c6898",
-      "updated": "2026-10-09T01:13:28Z"
+      "sha256": "6333e652b2c3ffade4ced6759436b8ab3dcb95b25a43c1bd82fe9a6f23fd8a7d",
+      "updated": "2026-10-10T01:45:03Z"
     },
     {
       "file": "cross-promotion.md",
@@ -68,8 +68,8 @@
     },
     {
       "file": "getting-started.md",
-      "sha256": "0559be6739add079acf5677c369ff84e93e6f16411e477dac9971ce678d6f4f8",
-      "updated": "2026-10-09T01:13:28Z"
+      "sha256": "22fab7f0fd67966239c38541a8620ac7fe614f100b96df3e94570b573d4a9f61",
+      "updated": "2026-10-10T01:45:03Z"
     },
     {
       "file": "inventory-and-catalogs.md",
@@ -93,8 +93,8 @@
     },
     {
       "file": "platform-rules.md",
-      "sha256": "76fa088b27d27f7e5c936540a65ed5dc7c9f957334d0db650135173672ffba4d",
-      "updated": "2026-10-09T00:14:06Z"
+      "sha256": "b259bcebc6ae12b1db9c7279a6e2adb174af9d60090bf31001e23616f6423fbf",
+      "updated": "2026-10-10T00:12:33Z"
     },
     {
       "file": "player-sign-in.md",
@@ -123,13 +123,13 @@
     },
     {
       "file": "server-bundles.md",
-      "sha256": "02f13ee28d1c1d95f16fe23f3a68464bee6e449c635ec1492595e911ad436d3f",
-      "updated": "2026-10-09T01:13:28Z"
+      "sha256": "bc59062fefb7c17986671e2a8b6b86b714d1c7e9774956a3df98adcef38a7fd2",
+      "updated": "2026-10-10T01:45:03Z"
     },
     {
       "file": "serverless-functions-js.md",
-      "sha256": "8d5bda66dfebd93e80fe97b2f09c0651c26dc83b16827bdae7aa25f198f89e0b",
-      "updated": "2026-10-03T00:26:43Z"
+      "sha256": "56588d50d5a59f066164565470663f8f9da03fe85d98a96d3754e6ec14eb9fac",
+      "updated": "2026-10-10T00:12:33Z"
     },
     {
       "file": "serverless-functions.md",

package/docs/platform-rules.md

@@ -295,12 +295,12 @@ them to do something is.
 Both of these are working code in this repository. Neither was linked from anywhere until this page
 existed, which is how integrators end up rebuilding them.
 
-- **[`examples/e2e/`](../examples/e2e/README.md) — the bridge, end to end, in a real browser.** A real
+- **`examples/e2e/` — the bridge, end to end, in a real browser.** A real
   parent page and a real game frame, served from two different origins, exchanging a real
   `MessagePort`. `pnpm e2e` builds the artifacts and serves it. This is the thing to run when a
   handshake is not landing and you need to know whether the problem is the SDK or your page:
   `?sandbox=strict` reproduces the sandbox failure on demand.
-- **[`examples/server-bundle/echo.mjs`](../examples/server-bundle/echo.mjs) — a complete dedicated
+- **`examples/server-bundle/echo.mjs` — a complete dedicated
   server for a match, in one file.** The lifecycle a bundle implements and the first message on the
   channel, running. Its contract is [`server-bundles.md`](server-bundles.md).
 

package/docs/server-bundles.md

@@ -80,8 +80,8 @@ To check the download yourself: the package npm serves is, byte for byte, the fi
 also publishes on its download host, with the hash beside it:
 
 ```bash
-curl -fsSL -O https://downloads.gemarcade.com/sdk/v9.1.2/gem-web-sdk.tgz
-curl -fsSL https://downloads.gemarcade.com/sdk/v9.1.2/gem-web-sdk.tgz.sri
+curl -fsSL -O https://downloads.gemarcade.com/sdk/v9.1.4/gem-web-sdk.tgz
+curl -fsSL https://downloads.gemarcade.com/sdk/v9.1.4/gem-web-sdk.tgz.sri
 openssl dgst -sha384 -binary gem-web-sdk.tgz | openssl base64 -A
 ```
 
@@ -261,7 +261,7 @@ other version-skew member on `host`:
 | `leave`   | `cause` — why the connection ended, as the runtime saw it; `superseded` means the same player is already back on a newer connection and the `join` that says so follows at once                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
 | `message` | `reliable` / `ordered` — [the delivery class the sender asked for](#delivery-classes-the-flags-are-the-senders-request); `sessionId`; `playerNumber`                                                                     |
 
-A complete working example is [`examples/server-bundle/echo.mjs`](../examples/server-bundle/echo.mjs)
+A complete working example is `examples/server-bundle/echo.mjs`
 — a chat relay in one file, exercising every lifecycle method, the startup reads and most of the
 runtime surface. This repo's suite drives it against the contract below, so it is a starting point
 rather than a sketch.
@@ -493,7 +493,7 @@ and inherits none of that, which is why the example above loops around it.
 
 A complete, runnable version of this — with the slot's access rules, the room template that makes a
 dedicated server exist at all, and a real match's logs — is
-[`examples/server-saves/`](../examples/server-saves/README.md) in the SDK repository. It refuses the
+`examples/server-saves/` in the SDK repository. It refuses the
 upload outright where the snippet above merely skips an unexpected header, because a grant naming
 something else is a platform bug worth surfacing rather than working around.
 

package/docs/serverless-functions-js.md

@@ -1,6 +1,8 @@
 # Serverless functions in JavaScript
 
-<!-- gem-web: unpublished — the platform does not run JavaScript functions yet -->
+**The platform does not run JavaScript functions yet.** This page describes how one is written
+and how it behaves; today a function you publish is a WebAssembly component, as
+[serverless-functions.md](serverless-functions.md) describes.
 
 A serverless function can be written in JavaScript or TypeScript instead of Rust: the language your
 game is already written in, so the verification code in your browser game moves into a function
@@ -12,6 +14,32 @@ what it may change, its limits, channels, and calling it from your game holds he
 page covers only what is different: how you write one, how the SDK behaves inside it, and how
 publishing checks it.
 
+**JavaScript suits light work; heavy computation belongs in a component.** The platform's engine
+runs JavaScript without a JIT, so the same work takes many times longer than in a WebAssembly
+component, and the gap is smallest on a call that does little and widest on sustained computation.
+Checking a claim, looking a record up or making a small state update finishes well inside a call's
+limits in either language. Replaying a run to verify it, or ranking a large board, is where the gap
+decides whether the call finishes: the CPU limit is the same for both, so JavaScript runs out of it
+on work a component finishes many times over, and the call fails with `function_failed` and
+`cpu_budget_exceeded`. A game has one function per channel, so the heaviest thing it does decides
+the language. Measured with each running as the platform runs it, the same algorithm in JavaScript
+and in Rust:
+
+| The work                                                                          | The component was faster by       |
+| --------------------------------------------------------------------------------- | --------------------------------- |
+| A function that only returns its input, which measures the engine's cost per call | about 20 times                    |
+| A loop of 20,000 integer steps                                                    | about 20 times                    |
+| Ranking a daily leaderboard of 10,000 players                                     | about 60 times                    |
+| Numeric benchmarks: n-body, spectral-norm, fannkuch-redux and binary-trees        | from about 30 to nearly 200 times |
+| The numeric benchmarks and the leaderboard, on average                            | about 80 times                    |
+
+**Your game's speed in a browser is no guide.** The same JavaScript under V8, the engine in Chrome,
+measured with Node.js on the numeric benchmarks and the leaderboard, ran about 100 times faster than
+on the platform's engine once its JIT had warmed up, which is a little faster than the component,
+and about 7 times faster on its first call. With its JIT switched off it was still about 5 times
+faster. Before you rely on a heavy check, invoke it on `dev` with input as large as a real
+player's.
+
 ## 1. The contract
 
 The same as a component's: bytes in, bytes out, one fresh instance per call, nothing kept between

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@indiegems/gem-web-sdk",
-  "version": "9.1.2",
+  "version": "9.1.4",
   "description": "postMessage bridge contract between gem-web and browser-playable games",
   "license": "UNLICENSED",
   "type": "module",