Re-enable the Nix flake on aarch64-darwin.

PR #3422 added the flake but bailed out on Darwin pending a fix for
"could not find native static library `rusty_v8`". With v8 now on
145.0.0 (PR #4073) the build itself works on aarch64-darwin, so this
removes the `builtins.abort` guard and fills in the real sha256 for the
v145.0.0 rusty_v8 archive on aarch64-darwin.

The underlying bug — v8s build.rs writing `librusty_v8.a` outside the
locations cargo and crane treat as authoritative — already has a known
workaround in PR #3921, but that fix only lives in
`.github/workflows/ci.yml` and so does not protect the Nix build. This
ports the equivalent guard into the flake as a `preBuild` on
`commonArgs`: if the v8 build directory exists but `librusty_v8.a` is
missing, clean and rebuild just the v8 crate. With current
nixpkgs/crane the file does in fact survive the `buildDepsOnly` →
`buildPackage` handoff on aarch64-darwin, so the guard no-ops on the
happy path; it is defence-in-depth for the next time crane or nixpkgs
shifts.

x86_64-darwin and aarch64-linux still use placeholder hashes; users on
those platforms will continue to hit the existing fail-then-paste-hash
loop documented in `librusty_v8.nix`.

# API and ABI breaking changes

None. Build-system only, no runtime change.

# Expected complexity level and risk

1.

# Testing

- [x] `nix flake check --no-build` passes on aarch64-darwin.
- [x] `nix build .#default` produces working `spacetime`,
  `spacetimedb-cli`, and `spacetimedb-standalone` binaries; all three
  report `spacetimedb tool version 2.3.0`.
- [x] `nix build .#checks.aarch64-darwin.workspace-fmt` passes.
- [x] `nix develop --command rustc --version` succeeds (the command
  originally reported failing before this change).
- [ ] Confirmation from a reviewer with x86_64-linux that the change
  has not regressed the previously working platform.

Author: krisajenkins

flake.nix

@@ -30,20 +30,11 @@
         # Note that `self.rev` is not set for builds with a dirty worktree, in which case we instead use `self.dirtyRev`.
         gitCommit = if (self ? rev) then self.rev else self.dirtyRev;
 
-        librusty_v8 = if pkgs.stdenv.isDarwin then
-          # Building on MacOS, we've seen errors building rusty_v8 with a local RUSTY_V8_ARCHIVE:
-          # https://github.com/clockworklabs/SpacetimeDB/pull/3422#issuecomment-3416972711 .
-          # For now, error on MacOS (darwin) targets.
-          builtins.abort ''
-          This flake doesn't work on MacOS due to some quirk of compiling rusty-v8 against a precompiled V8 archive.
-          If you can get a build working on MacOS under Nix, please submit a PR to https://github.com/clockworklabs/SpacetimeDB/pulls.
-          See https://github.com/clockworklabs/SpacetimeDB/pull/3422 for more details.
-          ''
-            # We fetch a precompiled v8 binary.
-            # The rusty_v8 build.rs normally tries to download v8 artifacts during compilation,
-            # but the Nix build sandbox doesn't give it network access.
-            # Instead, download the archive in a Nix-friendly way with a recorded sha.
-                      else (pkgs.callPackage ./librusty_v8.nix {});
+        # We fetch a precompiled v8 binary.
+        # The rusty_v8 build.rs normally tries to download v8 artifacts during compilation,
+        # but the Nix build sandbox doesn't give it network access.
+        # Instead, download the archive in a Nix-friendly way with a recorded sha.
+        librusty_v8 = pkgs.callPackage ./librusty_v8.nix {};
 
         # The Rust toolchain that we actually build with.
         rustStable = pkgs.rust-bin.fromRustupToolchainFile ./rust-toolchain.toml;
@@ -85,6 +76,34 @@
           # Include our precompiled V8.
           RUSTY_V8_ARCHIVE = librusty_v8;
           SPACETIMEDB_NIX_BUILD_GIT_COMMIT = gitCommit;
+
+          # Workaround for https://github.com/clockworklabs/SpacetimeDB/issues/3882
+          # (fixed for CI in https://github.com/clockworklabs/SpacetimeDB/pull/3921).
+          # The v8 crate's build.rs writes `librusty_v8.a` to
+          # `$CARGO_TARGET_DIR/<profile>/gn_out/obj/`, which is outside the
+          # directories cargo and crane treat as authoritative artifacts.
+          # Mixed cargo invocations on the same target dir — including crane's
+          # buildDepsOnly -> buildPackage handoff — can leave that file missing
+          # while cargo still believes v8 is up to date, producing
+          # "could not find native static library `rusty_v8`" at link time.
+          # If the v8 build directory exists (so v8 has been built before) but
+          # the static lib is gone, clean and rebuild just the v8 crate.
+          preBuild = ''
+            for profile in release debug; do
+              target_dir="''${CARGO_TARGET_DIR:-target}"
+              lib="$target_dir/$profile/gn_out/obj/librusty_v8.a"
+              if compgen -G "$target_dir/$profile/build/v8-*" > /dev/null \
+                 && [ ! -f "$lib" ]; then
+                echo "librusty_v8.a missing at $lib; cleaning and rebuilding v8."
+                cargo clean -p v8 || true
+                if [ "$profile" = release ]; then
+                  cargo build --release -p v8
+                else
+                  cargo build -p v8
+                fi
+              fi
+            done
+          '';
         };
 
         # Build a separate derivation containing our dependencies,

librusty_v8.nix

@@ -30,6 +30,6 @@ in
       # copy the detected sha256 from the error message in here, then re-run.
       aarch64-linux = "0000000000000000000000000000000000000000000000000000";
       x86_64-darwin = "0000000000000000000000000000000000000000000000000000";
-      aarch64-darwin = "0000000000000000000000000000000000000000000000000000";
+      aarch64-darwin = "sha256-yHa1eydVCrfYGgrZANbzgmmf25p7ui1VMas2A7BhG6k=";
     };
   }