paratix 0.15.0 → 0.16.0

package/dist/{chunk-GB5QZWUM.js → chunk-56SN6NQH.js}

@@ -3446,19 +3446,8 @@ async function resolveComposeConfigImages(parameters) {
     `${composeCommand(parameters.runtime, parameters.projectDirectory)} config --format json`,
     EXEC_OPTS4
   );
-  if (result.code !== 0) {
-    return failedCommand(
-      `[compose.pull] failed to resolve images for ${parameters.projectDirectory}`,
-      result
-    );
-  }
-  const images = parseComposeConfigImages(result.stdout);
-  if (images === null) {
-    return failed(
-      `[compose.pull] failed to parse compose config images for ${parameters.projectDirectory}`
-    );
-  }
-  return images;
+  if (result.code !== 0) return null;
+  return parseComposeConfigImages(result.stdout);
 }
 async function inspectComposeImageBeforePull(parameters) {
   const result = await parameters.ssh.exec(
@@ -4194,7 +4183,15 @@ var compose = {
           runtime,
           ssh: connection
         });
-        if (!Array.isArray(images)) return images;
+        if (images === null) {
+          const fallbackResult = await connection.exec(
+            `${composeCommand(runtime, projectDirectory)} pull 2>&1`,
+            EXEC_OPTS4
+          );
+          if (fallbackResult.code !== 0)
+            return failedCommand(`[compose.pull] failed for ${projectDirectory}`, fallbackResult);
+          return { status: "changed" };
+        }
         const beforePull = await snapshotComposeImagesBeforePull({
           images,
           runtime,
@@ -10604,12 +10601,17 @@ function parseApkVersion(out, packageName) {
 async function getInstalledVersion(ssh2, pm, packageName) {
   const quoted = shellQuote(packageName);
   if (pm === "apk") {
-    const raw = await ssh2.output(`apk version -v ${quoted}`);
-    return parseApkVersion(raw.trim(), packageName);
+    const apkResult = await ssh2.exec(`apk version -v ${quoted}`, VERSION_EXEC_OPTS);
+    if (apkResult.code !== 0) return null;
+    return parseApkVersion(apkResult.stdout.trim(), packageName);
   }
   if (pm === "apt") {
-    const raw = await ssh2.output(`dpkg-query -W -f='\${Version}' ${quoted} 2>/dev/null`);
-    const aptVersion = raw.trim();
+    const aptResult = await ssh2.exec(
+      `dpkg-query -W -f='\${Version}' ${quoted} 2>/dev/null`,
+      VERSION_EXEC_OPTS
+    );
+    if (aptResult.code !== 0) return null;
+    const aptVersion = aptResult.stdout.trim();
     return aptVersion.length > 0 ? aptVersion : null;
   }
   const result = await ssh2.exec(
@@ -11025,10 +11027,11 @@ async function snapshotQuadletFile(ssh2, filePath) {
     mode: normalizeQuadletMode(rawMode)
   };
 }
-async function restoreQuadletFileSnapshot(ssh2, filePath, snapshot) {
+async function restoreQuadletFileSnapshot(parameters) {
+  const { filePath, label, snapshot, ssh: ssh2 } = parameters;
   if (snapshot.exists) {
     if (await isSymlink(ssh2, filePath)) {
-      throw new Error(`[quadlet.container] refuses to restore through symlink at ${filePath}`);
+      throw new Error(`[${label}] refuses to restore through symlink at ${filePath}`);
     }
     await ssh2.writeFile(filePath, snapshot.content, { mode: snapshot.mode });
     return;
@@ -11036,24 +11039,30 @@ async function restoreQuadletFileSnapshot(ssh2, filePath, snapshot) {
   await ssh2.exec(`rm -f ${shellQuote(filePath)}`, { ignoreExitCode: true, silent: true });
 }
 async function applyQuadletFile(parameters) {
+  const label = parameters.label ?? "quadlet.container";
   const mkdirResult = await parameters.ssh.exec(CONTAINERS_SYSTEMD_DIRECTORY_COMMAND, {
     ignoreExitCode: true,
     silent: true
   });
   if (mkdirResult.code !== 0) {
     return failedCommand(
-      `[quadlet.container: ${parameters.name}] failed to create quadlet directory`,
+      `[${label}: ${parameters.name}] failed to create quadlet directory`,
       mkdirResult
     );
   }
   if (await isSymlink(parameters.ssh, parameters.filePath)) {
     return failed(
-      `[quadlet.container: ${parameters.name}] refuses to write through symlink at ${parameters.filePath}`
+      `[${label}: ${parameters.name}] refuses to write through symlink at ${parameters.filePath}`
     );
   }
   const snapshot = await snapshotQuadletFile(parameters.ssh, parameters.filePath);
   const restoreSnapshot = async () => {
-    await restoreQuadletFileSnapshot(parameters.ssh, parameters.filePath, snapshot);
+    await restoreQuadletFileSnapshot({
+      filePath: parameters.filePath,
+      label,
+      snapshot,
+      ssh: parameters.ssh
+    });
   };
   try {
     await parameters.ssh.writeFile(parameters.filePath, parameters.content, {
@@ -11062,7 +11071,7 @@ async function applyQuadletFile(parameters) {
   } catch (error) {
     const reason = error instanceof Error ? error.message : String(error);
     return withRollbackFailure(
-      failed(`[quadlet.container: ${parameters.name}] failed to write quadlet file: ${reason}`),
+      failed(`[${label}: ${parameters.name}] failed to write quadlet file: ${reason}`),
       restoreSnapshot,
       "quadlet apply failed"
     );
@@ -11073,10 +11082,7 @@ async function applyQuadletFile(parameters) {
   });
   if (daemonReload.code === 0) return { status: "changed" };
   return withRollbackFailure(
-    failedCommand(
-      `[quadlet.container: ${parameters.name}] systemctl daemon-reload failed`,
-      daemonReload
-    ),
+    failedCommand(`[${label}: ${parameters.name}] systemctl daemon-reload failed`, daemonReload),
     restoreSnapshot,
     "quadlet apply failed"
   );
@@ -11112,7 +11118,7 @@ var QUADLET_PULL_CHANGED_OUTPUT_PATTERNS = [
 ];
 function assertQuadletLineValue(key, value) {
   if (QUADLET_CONTROL_CHARACTER_PATTERN.test(value)) {
-    throw new Error(`quadlet.container ${key} values must not contain control characters`);
+    throw new Error(`quadlet ${key} values must not contain control characters`);
   }
 }
 function renderQuadletLine(key, value) {
@@ -11345,6 +11351,37 @@ function parseQuadletImageInspectOutput(output) {
   };
 }
 
+// src/modules/quadletNetworkHelpers.ts
+function getQuadletNetworkFilePath(name) {
+  return `${CONTAINERS_SYSTEMD_DIRECTORY}/${name}.network`;
+}
+function buildQuadletNetworkUnitLines(options) {
+  return compactQuadletLines([
+    renderQuadletLine("NetworkName", options.name),
+    maybeRenderQuadletLine("Driver", options.driver),
+    maybeRenderQuadletLine("IPAMDriver", options.ipamDriver),
+    maybeRenderQuadletBool("Internal", options.internal),
+    maybeRenderQuadletBool("IPv6", options.ipv6),
+    maybeRenderQuadletBool("DisableDNS", options.disableDns),
+    maybeRenderQuadletLine("Subnet", options.subnet),
+    maybeRenderQuadletLine("Gateway", options.gateway),
+    maybeRenderQuadletLine("IPRange", options.ipRange),
+    ...renderQuadletRepeated("DNS", options.dns ?? []),
+    ...renderQuadletKeyValue("Options", options.options ?? {}),
+    ...renderQuadletKeyValue("Label", options.label ?? {}),
+    ...renderQuadletRepeated("PodmanArgs", options.podmanArgs ?? [])
+  ]);
+}
+function generateNetworkQuadlet(options) {
+  const sections = [
+    renderQuadletSection("Unit", [
+      renderQuadletLine("Description", options.description ?? `Podman network: ${options.name}`)
+    ]),
+    renderQuadletSection("Network", buildQuadletNetworkUnitLines(options))
+  ];
+  return sections.join("\n").trimEnd();
+}
+
 // src/modules/quadletValidationHelpers.ts
 var UNIT_NAME_PATTERN2 = new RegExp("^[\\w@.\\-]+$", "v");
 var UNIT_NAME_ALL_DOTS_PATTERN = new RegExp("^\\.+$", "v");
@@ -11419,8 +11456,8 @@ function validateQuadletAuthFilePath(field, value) {
 // src/modules/quadlet.ts
 var QUADLET_RELOAD_HASH_LENGTH = 16;
 var SYSTEMCTL2 = "systemctl";
-function buildQuadletReloadFlag(name, content) {
-  const flagPrefix = `quadlet-container-${sha256String(name).slice(0, QUADLET_RELOAD_HASH_LENGTH)}-`;
+function buildQuadletReloadFlag(kind, name, content) {
+  const flagPrefix = `quadlet-${kind}-${sha256String(name).slice(0, QUADLET_RELOAD_HASH_LENGTH)}-`;
   return {
     flagName: `${flagPrefix}${sha256String(content).slice(0, QUADLET_RELOAD_HASH_LENGTH)}`,
     flagPrefix
@@ -11502,7 +11539,7 @@ async function applyQuadletImageUpdate(parameters) {
     ssh: parameters.ssh
   });
 }
-async function buildQuadletContainerDryRunDiff(ssh2, filePath, desired) {
+async function buildQuadletDryRunDiff(ssh2, filePath, desired) {
   try {
     const exists = await ssh2.exists(filePath);
     const current = exists ? await ssh2.readFile(filePath) : "";
@@ -11513,6 +11550,16 @@ async function buildQuadletContainerDryRunDiff(ssh2, filePath, desired) {
     return void 0;
   }
 }
+async function podmanNetworkExists(ssh2, name) {
+  const result = await ssh2.exec(`podman network exists -- ${shellQuote(name)}`, {
+    ignoreExitCode: true,
+    silent: true
+  });
+  return result.code === 0;
+}
+function quadletNetworkLiveHint(name) {
+  return `network '${name}' already exists; the running network is not recreated automatically \u2014 remove it to apply changed settings`;
+}
 var quadlet = {
   /**
    * Write a Podman Quadlet `.container` definition and reload systemd when it changes.
@@ -11528,11 +11575,11 @@ var quadlet = {
     validateQuadletImageValue("image", options.image);
     const filePath = getQuadletContainerFilePath(options.name);
     const content = generateContainerQuadlet(options);
-    const reloadFlag = buildQuadletReloadFlag(options.name, content);
+    const reloadFlag = buildQuadletReloadFlag("container", options.name, content);
     return {
       async _applyDryRun(ssh2) {
         if (!ssh2) return { status: "changed" };
-        const diff = await buildQuadletContainerDryRunDiff(ssh2, filePath, content);
+        const diff = await buildQuadletDryRunDiff(ssh2, filePath, content);
         if (diff != null) return { diff, status: "changed" };
         const flagPresent = await hasFlag(ssh2, reloadFlag.flagName);
         if (flagPresent) return { status: "changed" };
@@ -11556,6 +11603,67 @@ var quadlet = {
       name: `quadlet.container: ${options.name}`
     };
   },
+  /**
+   * Write a Podman Quadlet `.network` definition and reload systemd when it changes.
+   *
+   * Mirrors {@link quadlet.container}: the unit is written atomically to
+   * `/etc/containers/systemd/<name>.network`, symlinks are refused, and
+   * `systemctl daemon-reload` runs when the content changes. Containers
+   * reference the network via their existing `networks` option
+   * (e.g. `networks: ["app.network"]`).
+   *
+   * When the change lands and a network with the same name is already live on
+   * the host, the result carries an advisory detail: Podman does not recreate
+   * a running network, so changed `subnet`/`gateway`/… only take effect after
+   * the network is removed.
+   *
+   * @param options - Configuration for the Quadlet network definition.
+   * @returns A Module that ensures the Quadlet `.network` file is present and up to date.
+   */
+  network(options) {
+    validateQuadletName(options.name);
+    const filePath = getQuadletNetworkFilePath(options.name);
+    const content = generateNetworkQuadlet(options);
+    const reloadFlag = buildQuadletReloadFlag("network", options.name, content);
+    return {
+      async _applyDryRun(ssh2) {
+        if (!ssh2) return { status: "changed" };
+        const diff = await buildQuadletDryRunDiff(ssh2, filePath, content);
+        if (diff != null) {
+          const liveHint = await podmanNetworkExists(ssh2, options.name) ? quadletNetworkLiveHint(options.name) : void 0;
+          return liveHint == null ? { diff, status: "changed" } : { _dryRunDetail: liveHint, diff, status: "changed" };
+        }
+        const flagPresent = await hasFlag(ssh2, reloadFlag.flagName);
+        return flagPresent ? { status: "changed" } : { _dryRunDetail: "(dry-run, daemon-reload pending)", status: "changed" };
+      },
+      _dryRunDiffProducer: true,
+      async apply(ssh2) {
+        if (!ssh2) return failed(`[quadlet.network: ${options.name}] SSH connection is required`);
+        const contentChanges = await buildQuadletDryRunDiff(ssh2, filePath, content) != null;
+        const result = await applyQuadletFile({
+          content,
+          filePath,
+          label: "quadlet.network",
+          name: options.name,
+          ssh: ssh2
+        });
+        if (result.status !== "changed") return result;
+        const flagFailure = await setVersionedFlag(ssh2, reloadFlag.flagName, reloadFlag.flagPrefix);
+        if (flagFailure) return flagFailure;
+        if (contentChanges && await podmanNetworkExists(ssh2, options.name)) {
+          return { ...result, detail: quadletNetworkLiveHint(options.name) };
+        }
+        return result;
+      },
+      async check(ssh2) {
+        if (!ssh2) return NEEDS_APPLY;
+        const fileResult = await checkQuadletFile({ content, filePath, ssh: ssh2 });
+        if (fileResult !== "ok") return fileResult;
+        return await hasFlag(ssh2, reloadFlag.flagName) ? "ok" : NEEDS_APPLY;
+      },
+      name: `quadlet.network: ${options.name}`
+    };
+  },
   /**
    * Pull the latest image for a Quadlet-managed container and restart the service
    * only when the image changed.

package/dist/cli.js

@@ -6262,7 +6262,7 @@ async function runApplyCommand(file, options, run = runPlaybook) {
   if (options.diff && !options.dryRun) {
     throw new CliUsageError("--diff requires --dry-run");
   }
-  printCliHeader("0.15.0-645d2fd");
+  printCliHeader("0.16.0-81f051d");
   const environmentOverrides = applyCliEnvironmentOverrides(options.env, {
     firstRun: options.firstRun
   });
@@ -6300,7 +6300,7 @@ function renderSubcommandOptionsHelp(command) {
   return ["", `Options for "paratix ${command.name()} <file>":`, ...rows].join("\n");
 }
 var program = new Command();
-program.name("paratix").description("Idempotent VPS setup tool in TypeScript").version("0.15.0-645d2fd");
+program.name("paratix").description("Idempotent VPS setup tool in TypeScript").version("0.16.0-81f051d");
 var applyCommand = program.command("apply <file>").description("Apply a server definition").option(
   "--diff",
   "When combined with --dry-run, show a unified diff per module that would change.",

package/dist/{index-Da9ccU5K.d.ts → index-N3n0FmKh.d.ts}

@@ -1466,6 +1466,23 @@ type QuadletImageUpdateOptions = {
     serviceName?: string;
 };
 
+type QuadletNetworkOptions = {
+    description?: string;
+    disableDns?: boolean;
+    dns?: string[];
+    driver?: string;
+    gateway?: string;
+    internal?: boolean;
+    ipamDriver?: string;
+    ipRange?: string;
+    ipv6?: boolean;
+    label?: Record<string, string>;
+    name: string;
+    options?: Record<string, string>;
+    podmanArgs?: string[];
+    subnet?: string;
+};
+
 /**
  * Modules for managing Podman Quadlet definitions.
  *
@@ -1484,6 +1501,24 @@ declare const quadlet: {
      * @returns A Module that ensures the Quadlet file is present and up to date.
      */
     container(options: QuadletContainerOptions): Module;
+    /**
+     * Write a Podman Quadlet `.network` definition and reload systemd when it changes.
+     *
+     * Mirrors {@link quadlet.container}: the unit is written atomically to
+     * `/etc/containers/systemd/<name>.network`, symlinks are refused, and
+     * `systemctl daemon-reload` runs when the content changes. Containers
+     * reference the network via their existing `networks` option
+     * (e.g. `networks: ["app.network"]`).
+     *
+     * When the change lands and a network with the same name is already live on
+     * the host, the result carries an advisory detail: Podman does not recreate
+     * a running network, so changed `subnet`/`gateway`/… only take effect after
+     * the network is removed.
+     *
+     * @param options - Configuration for the Quadlet network definition.
+     * @returns A Module that ensures the Quadlet `.network` file is present and up to date.
+     */
+    network(options: QuadletNetworkOptions): Module;
     /**
      * Pull the latest image for a Quadlet-managed container and restart the service
      * only when the image changed.

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-import { E as Environment, M as Module, a as ModuleMetaEntry, b as MetaEnvironmentValue, c as EnvironmentMetaEntry, S as SshdPortMetaEntry, d as SystemHostMetaEntry, e as SystemRebootMetaEntry, f as ModuleResult, g as ExecResult, h as ModuleStatus, i as SshConnection, O as OrchestrationStep, j as ShutdownSignal, k as ServerDefinition } from './index-Da9ccU5K.js';
-export { l as EnvironmentValue, m as ExecOptions, N as NEEDS_APPLY, n as SshConfig, o as apt, p as archive, q as command, r as compose, s as cron, t as download, u as file, v as git, w as group, x as hostname, y as mount, z as net, A as op, B as package, C as quadlet, D as releaseUpgrade, F as rsync, G as script, H as service, I as ssh, J as sshd, K as swap, L as sysctl, P as system, Q as systemd, R as timer, T as ufw, U as user } from './index-Da9ccU5K.js';
+import { E as Environment, M as Module, a as ModuleMetaEntry, b as MetaEnvironmentValue, c as EnvironmentMetaEntry, S as SshdPortMetaEntry, d as SystemHostMetaEntry, e as SystemRebootMetaEntry, f as ModuleResult, g as ExecResult, h as ModuleStatus, i as SshConnection, O as OrchestrationStep, j as ShutdownSignal, k as ServerDefinition } from './index-N3n0FmKh.js';
+export { l as EnvironmentValue, m as ExecOptions, N as NEEDS_APPLY, n as SshConfig, o as apt, p as archive, q as command, r as compose, s as cron, t as download, u as file, v as git, w as group, x as hostname, y as mount, z as net, A as op, B as package, C as quadlet, D as releaseUpgrade, F as rsync, G as script, H as service, I as ssh, J as sshd, K as swap, L as sysctl, P as system, Q as systemd, R as timer, T as ufw, U as user } from './index-N3n0FmKh.js';
 
 /**
  * Fail the run if a condition on the current env is not satisfied.

package/dist/index.js

@@ -61,7 +61,7 @@ import {
   user,
   validateHostLabel,
   validateSshConfig
-} from "./chunk-GB5QZWUM.js";
+} from "./chunk-56SN6NQH.js";
 
 // src/conditionalModules.ts
 function createConditionalApplyState(environment) {

package/dist/modules/index.d.ts

@@ -1 +1 @@
-export { V as PackageSpec, W as UpgradeOptions, o as apt, p as archive, q as command, r as compose, s as cron, t as download, u as file, v as git, w as group, x as hostname, y as mount, z as net, A as op, B as package, C as quadlet, D as releaseUpgrade, F as rsync, G as script, H as service, I as ssh, J as sshd, K as swap, L as sysctl, P as system, Q as systemd, R as timer, T as ufw, U as user } from '../index-Da9ccU5K.js';
+export { V as PackageSpec, W as UpgradeOptions, o as apt, p as archive, q as command, r as compose, s as cron, t as download, u as file, v as git, w as group, x as hostname, y as mount, z as net, A as op, B as package, C as quadlet, D as releaseUpgrade, F as rsync, G as script, H as service, I as ssh, J as sshd, K as swap, L as sysctl, P as system, Q as systemd, R as timer, T as ufw, U as user } from '../index-N3n0FmKh.js';

package/dist/modules/index.js

@@ -27,7 +27,7 @@ import {
   timer,
   ufw,
   user
-} from "../chunk-GB5QZWUM.js";
+} from "../chunk-56SN6NQH.js";
 export {
   apt,
   archive,

package/llm-guide.md

@@ -186,6 +186,8 @@ the idiomatic way to ensure a previously installed cron job is gone.
 | `compose.restart` | `(options: { projectDirectory: string; runtime?: "docker" \| "podman" }): Module`                                    | No         |
 | `compose.systemd` | `(options: { detached?: boolean; name?: string; projectDirectory: string; runtime?: "docker" \| "podman" }): Module` | Yes        |
 
+> **`compose.pull` change detection:** `compose.pull` compares image digests before and after the pull to report `ok` (nothing new) vs `changed`. This needs `compose config --format json`. With `runtime: "podman"`, when the compose provider is the Python `podman-compose` (which does not support `--format json`), digest-based detection is unavailable: the pull still runs, but always reports `changed`. The Docker and Compose v2 paths are unaffected.
+
 ### `download`
 
 | Method            | Signature                                                                                                                                                                                                                                                                                                                    | Idempotent |
@@ -360,6 +362,7 @@ Whitespace und Shell-Metazeichen werden abgelehnt. `package.absent` ist rein nam
 | Method                | Signature                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                | Idempotent |
 | --------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ---------- |
 | `quadlet.container`   | `(options: { addCapability?: string[]; addDevice?: string[]; annotation?: Record<string, string>; autoUpdate?: "local" \| "registry"; containerName?: string; description?: string; dns?: string[]; dnsOption?: string[]; dnsSearch?: string[]; dropCapability?: string[]; entrypoint?: string[]; environment?: Record<string, string>; environmentFiles?: string[]; exec?: string[]; exposeHostPort?: string[]; groupAdd?: string[]; healthCmd?: string; healthInterval?: string; healthOnFailure?: "kill" \| "none" \| "restart" \| "stop"; healthRetries?: number; healthStartPeriod?: string; healthTimeout?: string; hostName?: string; image: string; ip?: string; ip6?: string; label?: Record<string, string>; logDriver?: string; mask?: string[]; mount?: string[]; name: string; networks?: string[]; noNewPrivileges?: boolean; notify?: boolean; podmanArgs?: string[]; publishPorts?: string[]; pull?: "always" \| "missing" \| "never" \| "newer"; readOnly?: boolean; restart?: "always" \| "no" \| "on-abnormal" \| "on-abort" \| "on-failure" \| "on-success" \| "on-watchdog"; runInit?: boolean; secret?: string[]; seccompProfile?: string; securityLabelDisable?: boolean; securityLabelType?: string; stopTimeout?: number; sysctl?: Record<string, string>; timeoutStartSec?: number; timeoutStopSec?: number; timezone?: string; tmpfs?: string[]; ulimit?: string[]; unmask?: string[]; user?: string; userNs?: string; volumes?: string[]; wantedBy?: string; workingDir?: string }): Module` | Yes        |
+| `quadlet.network`     | `(options: { description?: string; disableDns?: boolean; dns?: string[]; driver?: string; gateway?: string; internal?: boolean; ipRange?: string; ipamDriver?: string; ipv6?: boolean; label?: Record<string, string>; name: string; options?: Record<string, string>; podmanArgs?: string[]; subnet?: string }): Module` — writes `/etc/containers/systemd/<name>.network`; reference it from a container via `networks: ["<name>.network"]`. When the change lands and a network with the same name is already live, `changed` carries an advisory detail that the running network is not recreated until removed                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      | Yes        |
 | `quadlet.updateImage` | `(options: { authFile?: string; image: string; name: string; serviceName?: string }): Module` — returns `changed` with the new registry digest (or local image ID fallback) in parentheses when a newer image was pulled                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 | Partial    |
 
 ### `releaseUpgrade`
@@ -803,20 +806,21 @@ Rules:
 
 Diff-producing built-in modules:
 
-| Module                                      | Diff content                                                                                                                                                                         |
-| ------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
-| `file.copy`                                 | Unified diff between the remote file and the local source.                                                                                                                           |
-| `file.template`                             | Unified diff between the remote file and the rendered template.                                                                                                                      |
-| `sysctl.set`                                | `key = old → new` for the desired configuration.                                                                                                                                     |
-| `hostname.set`                              | `hostname = old → new`.                                                                                                                                                              |
-| `swap.file`                                 | Diff of the `/etc/fstab` entry (or removal of the line for `state: "absent"`).                                                                                                       |
-| `swap.swappiness`                           | `vm.swappiness = old → new` (via `sysctl.set`).                                                                                                                                      |
-| `swap.vfsCachePressure`                     | `vm.vfs_cache_pressure = old → new` (via `sysctl.set`).                                                                                                                              |
-| `cron.job` / `cron.absent`                  | Unified diff of the target user's crontab.                                                                                                                                           |
-| `timer.scheduled` (present)                 | Concatenated diffs of the `.service` and `.timer` unit files.                                                                                                                        |
-| `timer.scheduled` (absent) / `timer.absent` | List of unit files to remove.                                                                                                                                                        |
-| `net.hosts`                                 | Unified diff of `/etc/hosts`.                                                                                                                                                        |
-| `quadlet.container`                         | Unified diff of the `.container` unit file. If the file already matches but the `daemon-reload` flag is missing, `(dry-run, daemon-reload pending)` also appears as a detail suffix. |
+| Module                                      | Diff content                                                                                                                                                                                                                                                             |
+| ------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| `file.copy`                                 | Unified diff between the remote file and the local source.                                                                                                                                                                                                               |
+| `file.template`                             | Unified diff between the remote file and the rendered template.                                                                                                                                                                                                          |
+| `sysctl.set`                                | `key = old → new` for the desired configuration.                                                                                                                                                                                                                         |
+| `hostname.set`                              | `hostname = old → new`.                                                                                                                                                                                                                                                  |
+| `swap.file`                                 | Diff of the `/etc/fstab` entry (or removal of the line for `state: "absent"`).                                                                                                                                                                                           |
+| `swap.swappiness`                           | `vm.swappiness = old → new` (via `sysctl.set`).                                                                                                                                                                                                                          |
+| `swap.vfsCachePressure`                     | `vm.vfs_cache_pressure = old → new` (via `sysctl.set`).                                                                                                                                                                                                                  |
+| `cron.job` / `cron.absent`                  | Unified diff of the target user's crontab.                                                                                                                                                                                                                               |
+| `timer.scheduled` (present)                 | Concatenated diffs of the `.service` and `.timer` unit files.                                                                                                                                                                                                            |
+| `timer.scheduled` (absent) / `timer.absent` | List of unit files to remove.                                                                                                                                                                                                                                            |
+| `net.hosts`                                 | Unified diff of `/etc/hosts`.                                                                                                                                                                                                                                            |
+| `quadlet.container`                         | Unified diff of the `.container` unit file. If the file already matches but the `daemon-reload` flag is missing, `(dry-run, daemon-reload pending)` also appears as a detail suffix.                                                                                     |
+| `quadlet.network`                           | Unified diff of the `.network` unit file. If the file already matches but the `daemon-reload` flag is missing, `(dry-run, daemon-reload pending)` also appears as a detail suffix. When a network with the same name is already live, the advisory hint is appended too. |
 
 ### Implementing a Diff for a Custom Module
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "paratix",
-  "version": "0.15.0",
+  "version": "0.16.0",
   "description": "Idempotent VPS setup tool in TypeScript",
   "type": "module",
   "files": [