feat(builder): nix.rust block for Rust external build dependencies

[dlipicar]

What & why

The builder-driven Rust path (codegen.rust, #125) compiles a module's crate with a buildRustPackage call (lib/mkLogosModule.nix, the rustStaticLib binding) that passed only src/sourceRoot/cargoLock/doCheck — no nativeBuildInputs/buildInputs/env, and no metadata knob to add them (nix.packages.* is routed only to the C++ plugin link). So any Rust module whose crate or a transitive *-sys dependency needs a system build tool/library — pkg-config+openssl (reqwest native-tls), libsqlite3-sys (rusqlite), libclang (bindgen), protoc (prost) — failed in the nix sandbox. The only workaround was hand-rolling a buildRustPackage in the module's own flake, discarding the trivial-flake benefit of the builder path.

Change

A new nix.rust metadata block, mirroring nix.packages:

"nix": { "rust": {
  "packages": { "build": ["pkg-config"], "runtime": ["openssl"] },
  "env": { "OPENSSL_NO_VENDOR": "1" }
} }

• packages.build → buildRustPackage.nativeBuildInputs (host tools: pkg-config, protoc, rustPlatform.bindgenHook)
• packages.runtime → buildRustPackage.buildInputs (link libs: openssl, sqlite, zstd)
• env → buildRustPackage.env

Names resolve via the existing dotted-path getPkg. Empty by default → existing modules are unaffected. Also adds escape-hatch args rustExtraNativeBuildInputs / rustExtraBuildInputs / rustEnv to mkLogosModule for deps that can't be named by a nixpkgs attr path (arbitrary derivation / store-path env).

Files

• lib/parseMetadata.nix — parse nix.rust → nix_rust (safe defaults)
• lib/mkLogosModule.nix — resolve via getPkg + inject into rustStaticLib; new flake args
• docs/configuration.md — document the block (reqwest-native-tls + bindgen examples)
• tests/test-parse-metadata.nix — unit assertions for nix_rust
• tests/fixtures/rust-native-dep/ + tests/test-rust-native-dep.nix — flake check checks.<sys>.rust-native-dep

Verification

• checks.<sys>.default — 256 pure-eval tests pass (incl. new nix_rust assertions).
• checks.<sys>.rust-native-dep — a Rust cdylib module whose build.rs probes zlib via pkg-config builds with nix.rust and fails without it (negative run confirmed: The pkg-config command could not be found). This proves the block is what makes native deps reach the crate compile, and that the empty-nix.rust path still drives cargo normally — no regression for existing Rust modules.

🤖 Generated with Claude Code

[github-actions]

📊 Doc-test reports

The four ways to wrap a C library plus the two cross-language composition tours — each scaffolded into real modules, built against this commit, loaded in logoscore, and driven — rendered alongside the commands actually run and their output (updated each run, commit 187633d):

• ubuntu-latest report
• macos-latest report

Pages can take a minute to update after the run finishes.