Enum Ecosystem 

pub enum Ecosystem {
    Uv,
    Npm,
    Cargo,
}

An ecosystem whose dependency files may enter the build artifact (#74).

The variant fixes both entry names. That is the TRAP-5 half of the design: the artifact is a shared image snapshot, so what may enter it is an allowlist of dependency-defining files, not a caller-named list — there is no field anywhere in this module a caller could put .env or a credentials file’s name into. The byte-scan test at the bottom of this file covers the entries this type admits.

Variants

Uv

Python under uv: pyproject.toml + uv.lock.

Npm

Node under npm: package.json + package-lock.json.

Cargo

Rust under cargo: Cargo.toml + Cargo.lock.

Implementations

impl Ecosystem

pub const ALL: [Ecosystem; 3]

Every ecosystem, in detection order.

pub fn manifest_name(self) -> &'static str

The manifest’s file name, which is also its zip entry name.

pub fn lockfile_name(self) -> &'static str

The lockfile’s file name, which is also its zip entry name — and the file the environment layer is keyed on (#74).

pub fn install_run_line(self) -> &'static str

The whole RUN line that installs the environment layer: toolchain bootstrap on the managed al2023 base, then the lockfile-faithful install.

The install commands are the lockfile-faithful spellings

uv sync --locked, npm ci, and cargo fetch --locked each refuse a lockfile that disagrees with its manifest rather than quietly re-resolving — which is what keeps the baked layer the thing the content hash says it is. uv sync without --locked, npm install, or a bare cargo fetch would install something and the hash would then name an environment the build did not produce.

The bootstrap packages are measured, the full build is not yet

The managed base is al2023-minimal and ships no toolchain, so each line installs its own. Package names and the binaries they land were verified against the Amazon Linux 2023 repos (2026-08-31): python3.12-pip puts pip3.12 on PATH, nodejs22-npm puts npm and node on PATH, cargo puts cargo on PATH. install_weak_deps=0 keeps the layer minimal. A full in-guest build of each line is the live-conformance scenario #74’s acceptance defers to — see the issue.

Cargo is the one that needs a stub: cargo fetch refuses a package with no targets, so the line creates an empty src/main.rs first. The working tree synced at launch lands over it.

Trait Implementations

impl Clone for Ecosystem

fn clone(&self) -> Ecosystem

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Copy for Ecosystem

impl Debug for Ecosystem

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.

impl Eq for Ecosystem

impl PartialEq for Ecosystem

fn eq(&self, other: &Ecosystem) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl StructuralPartialEq for Ecosystem