Terrain nodes can now be positioned/rotated (scene-v1 protocol 41); new Enable XInput option on Windows; more UI text moved to translatable strings; UI automation helpers and asset-resolve robustness improvements.

Author: efroemling

.efrocachemap

@@ -1,4 +1,4 @@
-### 1.8.0 (build 22966, api 9, 2026-08-06)
+### 1.8.0 (build 22967, api 9, 2026-08-08)
 - Fully implemented asset packages (more on this soon)
 - Upgraded to Python 3.14. This gives us a few nice useful bits such as zstd
   compression to help speed up online stuff and also means we can get rid of all
@@ -18,6 +18,10 @@
 - Upgraded Windows builds from VS2022 to VS2026.
 - Added password option to game hosting.
 - Button and image widgets can now be rotated (thanks vishal332008!)
+- Terrain nodes now have `position` and `rotate` attrs, so a terrain can be
+  placed and oriented instead of being stuck wherever its mesh was authored.
+  Rendering, collision, and bg-dynamics (debris/smoke/shadows) all follow.
+  Note that this bumps the scene-v1 protocol to 41 (thanks vishal332008!)
 - Renamed the `BaStdAssets` asset package to `BaClassicAssets`; its client
   wrapper modules are now `bauiv1.classicassets` / `bascenev1.classicassets`
   (previously `stdassets`).

CHANGELOG.md

@@ -61,6 +61,15 @@ available builds.
   values and player-customized names are plain strings. If you assign an
   `Lstr` it is flattened to a `str`, so team names you set will no longer
   re-translate when the language changes; assign a `LangStr` to keep that.
+- `bascenev1.InputDevice.get_button_name()` now returns a `LangStr` rather
+  than an `Lstr`. It could not take a `langstr` argument like the calls above
+  because it is implemented natively and the old return value existed only to
+  be converted straight back for display. Calling `.evaluate()` on the result
+  or passing it to a text/label slot works unchanged; the one thing that
+  breaks is using the result as a substitution inside an `Lstr`, which
+  `LangStr` values cannot ride. A side benefit: generic names such as
+  'button 5' now re-translate when the language changes instead of being
+  baked at the time you asked for them.
 - `ba*.Call()` will change to behave like `ba*.CallStrict()` instead of
   `ba*.CallPartial()`. To prepare for this, change all of your existing `Call()`
   usage to `CallPartial()` to lock in current behavior. Or use `CallStrict()` if

CHANGELOG_API_VERSIONS.md

@@ -407,6 +407,7 @@ set(BALLISTICA_SOURCES
   ${BA_SRC_ROOT}/ballistica/base/dynamics/bg/bg_dynamics_volume_light_data.h
   ${BA_SRC_ROOT}/ballistica/base/dynamics/collision_cache.cc
   ${BA_SRC_ROOT}/ballistica/base/dynamics/collision_cache.h
+  ${BA_SRC_ROOT}/ballistica/base/dynamics/geom_transform.h
   ${BA_SRC_ROOT}/ballistica/base/graphics/component/empty_component.h
   ${BA_SRC_ROOT}/ballistica/base/graphics/component/object_component.cc
   ${BA_SRC_ROOT}/ballistica/base/graphics/component/object_component.h

ballisticakit-cmake/CMakeLists.txt

@@ -276,6 +276,7 @@
     <ClInclude Include="..\..\src\ballistica\base\dynamics\bg\bg_dynamics_volume_light_data.h" />
     <ClCompile Include="..\..\src\ballistica\base\dynamics\collision_cache.cc" />
     <ClInclude Include="..\..\src\ballistica\base\dynamics\collision_cache.h" />
+    <ClInclude Include="..\..\src\ballistica\base\dynamics\geom_transform.h" />
     <ClInclude Include="..\..\src\ballistica\base\graphics\component\empty_component.h" />
     <ClCompile Include="..\..\src\ballistica\base\graphics\component\object_component.cc" />
     <ClInclude Include="..\..\src\ballistica\base\graphics\component\object_component.h" />

ballisticakit-windows/Generic/BallisticaKitGeneric.vcxproj

@@ -256,6 +256,9 @@
     <ClInclude Include="..\..\src\ballistica\base\dynamics\collision_cache.h">
       <Filter>ballistica\base\dynamics</Filter>
     </ClInclude>
+    <ClInclude Include="..\..\src\ballistica\base\dynamics\geom_transform.h">
+      <Filter>ballistica\base\dynamics</Filter>
+    </ClInclude>
     <ClInclude Include="..\..\src\ballistica\base\graphics\component\empty_component.h">
       <Filter>ballistica\base\graphics\component</Filter>
     </ClInclude>

ballisticakit-windows/Generic/BallisticaKitGeneric.vcxproj.filters

@@ -269,6 +269,7 @@
     <ClInclude Include="..\..\src\ballistica\base\dynamics\bg\bg_dynamics_volume_light_data.h" />
     <ClCompile Include="..\..\src\ballistica\base\dynamics\collision_cache.cc" />
     <ClInclude Include="..\..\src\ballistica\base\dynamics\collision_cache.h" />
+    <ClInclude Include="..\..\src\ballistica\base\dynamics\geom_transform.h" />
     <ClInclude Include="..\..\src\ballistica\base\graphics\component\empty_component.h" />
     <ClCompile Include="..\..\src\ballistica\base\graphics\component\object_component.cc" />
     <ClInclude Include="..\..\src\ballistica\base\graphics\component\object_component.h" />

ballisticakit-windows/Headless/BallisticaKitHeadless.vcxproj

@@ -256,6 +256,9 @@
     <ClInclude Include="..\..\src\ballistica\base\dynamics\collision_cache.h">
       <Filter>ballistica\base\dynamics</Filter>
     </ClInclude>
+    <ClInclude Include="..\..\src\ballistica\base\dynamics\geom_transform.h">
+      <Filter>ballistica\base\dynamics</Filter>
+    </ClInclude>
     <ClInclude Include="..\..\src\ballistica\base\graphics\component\empty_component.h">
       <Filter>ballistica\base\graphics\component</Filter>
     </ClInclude>

ballisticakit-windows/Headless/BallisticaKitHeadless.vcxproj.filters

@@ -0,0 +1,88 @@
+# Client SSL Trust
+
+**Description:** Why bring-our-own-Python builds trust the bundled certifi store ONLY (cafile= skips the OS store), the Windows expired-legacy-root failure it prevents, and the BA_USE_SYSTEM_CERTS escape hatch.
+
+In builds that bring their own Python distribution, client TLS trust
+comes from the bundled certifi store and nothing else — the OS
+certificate store is deliberately never loaded. This page records the
+mechanism, the concrete Windows failure that motivated it, and the
+escape hatch for environments that genuinely need OS-store roots.
+
+## Policy and mechanism
+
+- **`baenv._setup_certs`**
+  (`src/assets/ba_data/python/baenv.py`) — in bring-our-own-Python
+  builds (`contains_python_dist`, or forced via
+  `BA_USE_BUNDLED_ROOT_CERTS=1`) it sets
+  `SSL_CERT_FILE = REQUESTS_CA_BUNDLE = certifi.where()`.
+- **The single shared SSL context** is built in
+  `babase/_env.py` `_bootstrap_networking`
+  (`_g_net_warm_start_ssl_context`, exposed as `app.net.sslcontext` +
+  `app.net.urllib3pool`; all client HTTPS funnels through that pool).
+  When `SSL_CERT_FILE` is set (and the escape hatch below isn't), it
+  builds the context via
+  `ssl.create_default_context(cafile=SSL_CERT_FILE)`.
+- **The load-bearing detail: passing `cafile=` makes CPython skip
+  `load_default_certs()`**, so the OS cert store is fully out of the
+  loop — trust is the bundled certifi set only, on every platform.
+- `v2transport` reuses `app.net.sslcontext` rather than minting its own
+  context (commit `ed79b46600`) — its old inline
+  `create_default_context()` was a leftover from the private-CA `cadata`
+  days, obsolete since basn nodes moved to public Let's Encrypt certs.
+
+## Why: the Windows expired-legacy-root failure
+
+Only win32 ever loaded the OS cert store — CPython's
+`load_default_certs()` enumerates the system store on Windows only, so
+mac/Linux/Android/iOS were already effectively certifi-only. The change
+brings Windows in line rather than taking anything away elsewhere.
+
+The failure it prevents: expired legacy roots lingering in a user's
+Windows store (DST Root CA X3, the expired ISRG Root X2 cross-sign,
+stale R3/E1 intermediates) **poison OpenSSL chain-building**. OpenSSL
+anchors on the expired duplicate and rejects a currently-valid Let's
+Encrypt basn-node cert with `CERT_HAS_EXPIRED`, even though a valid
+ISRG X2 exists in certifi. Browsers (Chrome/Edge via CryptoAPI,
+Firefox via mozilla::pkix) do robust alternate-path chain building and
+don't trip on this; OpenSSL does not — so we feed it a clean store.
+
+## Escape hatch
+
+`BA_USE_SYSTEM_CERTS=1` reverts to a bare `create_default_context()`
+(OS store trust). This exists for corporate/AV TLS-inspection proxy
+environments whose MITM root lives only in the system store.
+
+## Diagnostic signature and rule-outs
+
+The characteristic symptom: WSS to `*.basn.ballistica.net` (Let's
+Encrypt cert) fails with `CERT_HAS_EXPIRED` while HTTPS to
+`regional.ballistica.net` (Amazon cert) succeeds — e.g. the game stuck
+in construct-mode. Rule-outs before blaming the OS store:
+
+- **Not the clock** — the browser uses the same clock and works; a
+  wrong clock also yields "not yet valid", not "expired".
+- **Not the server** — `curl -sv https://prod-<id>.basn.ballistica.net/`
+  shows `verify ok` with valid dates.
+- **Not stale bundled certifi** — verify it carries current ISRG
+  X1/X2 and zero expired anchors.
+
+Confirm the OS store on Windows with PowerShell:
+
+```powershell
+Get-ChildItem Cert:\LocalMachine\Root,Cert:\CurrentUser\Root,Cert:\LocalMachine\CA,Cert:\CurrentUser\CA | ? {$_.NotAfter -lt (Get-Date)}
+```
+
+Gotcha: **Firefox uses its own Mozilla/NSS store** and ignores the
+Windows store by default (enterprise-roots auto-import aside), so it's
+the wrong browser for testing an OS-store issue — use Edge or Chrome
+(CryptoAPI).
+
+## Deferred alternative
+
+A curated cross-platform trust set — certifi plus only the
+*non-expired* OS roots — was considered and deferred in favor of
+certifi-only simplicity/consistency. We don't bundle `cryptography`,
+so date-filtering OS roots would need `ssl.enum_certificates`
+(win-only) plus `_test_decode_cert` or a hand-rolled ASN.1 read.
+Revisit only if the corporate/AV MITM population ever proves to
+matter beyond what `BA_USE_SYSTEM_CERTS` covers.

docs/design/client-ssl-trust.md

@@ -23,7 +23,7 @@
     "bauiv1lib": "buil"
   },
   "efrocache_repository_url": "https://files.ballistica.net/cache/ba1",
-  "engine_build_number": 22966,
+  "engine_build_number": 22967,
   "name": "BallisticaKit",
   "public": true,
   "python_paths": [
@@ -43,5 +43,5 @@
     "tests",
     "config"
   ],
-  "version": "1.8.0a74"
+  "version": "1.8.0a75"
 }