fix: route prebuilt --image-ref through layering path (#113)

Author: mcclurejt

packages/cli/src/commands/compute/app/deploy.ts

@@ -413,7 +413,12 @@ export default class AppDeploy extends Command {
           : "off";
 
       // Isolated billing is not yet available in the CLI.
-      const { prepared, gasEstimate } = isVerifiable
+      // Use the verifiable build path only for git-source builds where the build
+      // service fully layers the image. For prebuilt image refs, route through
+      // the normal prepareDeploy path so that layerRemoteImageIfNeeded can
+      // add the ecloud runtime layer (startup script, KMS client, Caddy) if
+      // the image doesn't already have it.
+      const { prepared, gasEstimate } = verifiableMode === "git"
         ? await compute.app.prepareDeployFromVerifiableBuild({
             name: appName,
             imageRef,

packages/cli/src/commands/compute/app/upgrade.ts

@@ -350,7 +350,12 @@ export default class AppUpgrade extends Command {
           ? "private"
           : "off";
 
-      const { prepared, gasEstimate } = isVerifiable
+      // Use the verifiable build path only for git-source builds where the build
+      // service fully layers the image. For prebuilt image refs, route through
+      // the normal prepareUpgrade path so that layerRemoteImageIfNeeded can
+      // add the ecloud runtime layer (startup script, KMS client, Caddy) if
+      // the image doesn't already have it.
+      const { prepared, gasEstimate } = verifiableMode === "git"
         ? await compute.app.prepareUpgradeFromVerifiableBuild(appID, {
             imageRef,
             imageDigest: verifiableImageDigest!,

packages/sdk/src/client/common/docker/layer.ts

@@ -156,17 +156,17 @@ export async function layerRemoteImageIfNeeded(
 
   const docker = new Docker();
 
+  // Pull image first to ensure we have it locally for inspection
+  logger.info(`Pulling image ${imageRef}...`);
+  await pullDockerImage(docker, imageRef, DOCKER_PLATFORM, logger);
+
   // Check if image already has ecloud layering
   const alreadyLayered = await checkIfImageAlreadyLayeredForECloud(docker, imageRef);
   if (alreadyLayered) {
     logger.info("Image already has ecloud layering");
     return imageRef;
   }
 
-  // Pull image to ensure we have it locally
-  logger.info(`Pulling image ${imageRef}...`);
-  await pullDockerImage(docker, imageRef, DOCKER_PLATFORM, logger);
-
   // Prompt for target image (to avoid overwriting source)
   // TODO: Make this configurable via options
   const targetImageRef = `${imageRef}-layered`;