Module prebuilt 

Fetch self-contained, relocation-free language toolchains as prebuilt vendor archives — “our apt-get” for the macOS sandbox, the prebuilt arm.

Why a prebuilt archive (vs a source build)

The C-tool population (crate::source_build) has to be compiled at an absolute keg prefix so its baked install-names point at real paths. The language toolchains don’t: vendors (go.dev, nodejs.org, the astral-sh/oven-sh/denoland/ziglang/Adoptium/GraalVM releases) publish macOS archives that are already position-independent and link only the macOS system libraries (/usr/lib/...). Dropping one into an absolute keg and pointing PATH / GOROOT / JAVA_HOME / CARGO_HOME at that keg yields a tool that runs unmodified under a deny-default Seatbelt profile.

What this builds

A keg for one of go/node/rust/python/deno/bun/zig/java/graalvm: resolve the requested formula to a concrete vendor URL (replicating the live version-resolution that the rootfs provisioner in zlayer-builder performs), download it, extract it into the keg with the canonical per-language on-disk layout, and write a KegManifest whose path_dirs + env are absolute keg-rooted paths. Swift is intentionally not handled here — on macOS it is provisioned from the host Xcode, so it falls through to the source arm.

The resolvers, API structs and extraction logic are duplicated from zlayer_builder::macos_toolchain on purpose: zlayer-toolchain is a leaf crate and must not depend on zlayer-builder (that would re-introduce the build cycle this crate exists to break).

Structs

PrebuiltResolution

A resolved prebuilt toolchain: the concrete version, the vendor download URL, and the upstream-published sha256 when one is available.

Functions

ensure_prebuilt

Fetch + extract the prebuilt toolchain for formula into a keg under cache_dir, write its KegManifest, and return the keg path.

is_prebuilt_formula

Return true if formula names a language toolchain handled by the prebuilt fetcher (go/golang, node/nodejs, rust, python/python3/python@N, deno, bun, zig, java/openjdk/openjdk@N, and any graalvm-containing name).