[cnuss]

Implements Tasks 1–3 of #158: --layers-from <image> adds the one layer of your own images to the deployed image, next to rowdy's.

rowdy create aws lambda ghcr.io/owner/app:latest --layers-from ghcr.io/tunnel-pizza/tunneld:latest

• Input. The flag repeats, or ROWDY_LAYERS_FROM takes one image per line or a YAML list. Repeats are added once. Naming rowdy's own image adds nothing.

• Order. Sources go on in the order given, then rowdy's layer last, so /usr/local/bin/rowdy is always rowdy's.

• Hygiene check. Each source must be built like rowdy's final stage. On every platform it publishes, before anything is uploaded, rowdy checks for:

  • one layer and one diff_id;
  • a history of one COPY/ADD, plus only ENTRYPOINT, CMD or LABEL;
  • no Env beyond PATH.

  A source that breaks a rule fails the deploy, and the error names the image, the platform and the rule. There is no size limit; it was dropped on review.

• rowdy's own image (ghcr.io/scaffoldly/rowdy:beta) is exempt, because this repo builds it and re-tags :beta on every main build. A change to it can't fail every deploy.

• Credentials. Source blobs are read anonymously, never with the app image's registry credentials. Before this PR they were sent with the app's Authorization header.

• Missing platforms. A platform a source doesn't publish is copied without it. That logs WARN Layers Skipped only for linux/amd64, the platform Lambda runs; other platforms log at debug.

• No flag, no change. A deploy without the flag injects rowdy's layer exactly as before.

Commits:

• db930db the rules and argument parsing (src/api/internal/layers.ts, src/util/list.ts);
• d0edbcd multi-source collect/check/inject (Transfer.source, Transfer.collect);
• a3a6a68 the CLI flag, LambdaImageService, and the docs (docs/runtime.md "Your own layers", README);
• 6503a39 fixes from the whole-branch review.

Tests: unit suite 400 passed. That includes live public-registry tests:

• rowdy:beta and tunneld's new single-layer :latest (feat(image): build the container on scratch, one layer tunnel-pizza/tunneld#402) are accepted;
• nginx:alpine is refused;
• tunneld then rowdy are injected in order, with layers, diff_ids and history aligned;
• busybox's linux/386 is copied unchanged;
• a source blob is read anonymously, with a 200 from ghcr.io.

Not here:

• the Action's layers-from: input, Task 5 on the github branch, after this ships in a release;
• an end-to-end deploy with tunneld, which goes through CI.

Deferred minors from the review:

• a refusal names the platform in completion order;
• platform matching ignores variant;
• a classic build-arg RUN is refused as |1 in history;
• withLayersFrom doesn't copy its array.

Refs #158

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}