Changelog

2026-05-01 - 1.4.0 - feat(network)

add configurable VM egress firewall policies and WireGuard-based host routing

adds firewall and wireguard options to SmartVM and NetworkManager configuration interfaces
validates firewall rules, WireGuard managed configs, and unsupported hook or IPv6 settings with dedicated error codes
sets up iptables egress chains, NAT, policy routing, and cleanup for managed VM subnet traffic
documents the new networking capabilities and adds tests for config validation and option forwarding

remove outdated base image bundle readme and consolidate hosted manifest documentation

Deletes the dedicated assets/base-images/readme.md documentation file
Keeps hosted base image manifest guidance and example usage in the main project README

stage VM runtime artifacts and writable drives in per-VM ephemeral storage by default

default runtime files to /dev/shm/.smartvm/runtime when available, with per-VM socket and drive staging paths
copy writable drives into per-VM runtime storage before boot and remove them during cleanup, with per-drive and global opt-out controls
prefer squashfs rootfs images over ext4 when resolving Firecracker CI base images
add tests and documentation for ephemeral drive staging and runtime directory defaults

add managed base image bundles with cache retention, hosted manifests, and opt-in integration boot testing

introduces BaseImageManager with support for Firecracker CI presets and hosted manifest-based kernel/rootfs bundles
adds SmartVM.ensureBaseImage() and exports new base image types and manager APIs
validates and verifies downloaded base image artifacts with checksums and bounded cache eviction
hardens process, socket, network, and config handling with safer spawning, subnet/interface validation, and expanded tests

tighten TypeScript compiler settings and harden error message handling

enable strict noImplicitAny checks and include Node types in the TypeScript configuration
remove the implicit any override from the build script so compiler strictness is enforced during builds
handle non-Error thrown values safely when wrapping startup and network setup failures
update package metadata and bundled files to include project configuration and license assets

add release configuration with npm registries and public access; add @ship.zone/szci placeholder

Added release.registries including https://verdaccio.lossless.digital and https://registry.npmjs.org
Set release.accessLevel to 'public' in npmextra.json
Added an empty @ship.zone/szci entry to npmextra.json

Initial commit: repository and project scaffold.