fix(build): support Bazel native builds on NixOS ARM64

MODULE.bazel

@@ -150,11 +150,15 @@ crate.from_cargo(
 )
 
 # audiopus_sys builds its vendored opus via the `cmake` crate: give the build
-# script a PATH that resolves cmake/make (runner image, GH runners, dev hosts)
-# and the policy override its old CMakeLists needs under CMake 4.x. The cmake
+# script a PATH that resolves cmake/make (runner image, GH runners, NixOS, and
+# other dev hosts) and the policy override its old CMakeLists needs under CMake
+# 4.x. The patch pins CMAKE_INSTALL_LIBDIR=lib because the crate always links
+# from <prefix>/lib while CMake uses lib64 on some aarch64 systems. The cmake
 # crate picks up CC/CFLAGS from the Bazel cc toolchain on its own.
 crate.annotation(
     crate = "audiopus_sys",
+    patches = ["//bazel/patches:audiopus-sys-libdir.patch"],
+    patch_args = ["-p1"],
     build_script_env = {
         "CMAKE_POLICY_VERSION_MINIMUM": "3.5",
         # msvc cross only (cmake-rs reads VAR_<triple> before VAR; the key is
@@ -174,7 +178,7 @@ crate.annotation(
         # the UBSan runtime. Opus shipped without sanitizers under
         # cargo-zigbuild too.
         "CFLAGS": "-fno-sanitize=undefined",
-        "PATH": "/usr/local/bin:/usr/bin:/bin:/opt/homebrew/bin",
+        "PATH": "/usr/local/bin:/usr/bin:/bin:/opt/homebrew/bin:/run/current-system/sw/bin",
     },
 )
 

bazel/patches/audiopus-sys-libdir.patch

@@ -0,0 +1,14 @@
+--- a/build.rs
++++ b/build.rs
+@@ -39,7 +39,10 @@ fn build_opus(is_static: bool) {
+     );
+ 
+     println!("cargo:info=Building Opus via CMake.");
+-    let opus_build_dir = cmake::build(opus_path);
++    let opus_build_dir = cmake::Config::new(opus_path)
++        // link_opus() expects the installed archive under <prefix>/lib.
++        .define("CMAKE_INSTALL_LIBDIR", "lib")
++        .build();
+     link_opus(is_static, opus_build_dir.display())
+ }
+ 

packages/natives/CHANGELOG.md

@@ -2,6 +2,10 @@
 
 ## [Unreleased]
 
+### Fixed
+
+- Fixed local Bazel addon builds on NixOS by exposing system CMake tools to sandboxed build scripts and forcing bundled Opus into the library directory expected by `audiopus_sys`.
+
 ## [17.2.1] - 2026-07-30
 
 ### Fixed