rusty_v8

Problem requires , but from crates.io cannot complete that build because required source inputs are absent from the package. Why this matters We hit this while evaluating celld as a stateful V8 execution substrate for customer-authored workflows and agents. Celld does not currently claim hostile multi-tenant isolation, so enabling V8's software sandbox is one concrete defense-in-depth step toward safely running untrusted code. This is not a theoretical consumer. After working around the packaging gap, we built celld with , adapted its one incompatible ArrayBuffer backing-store call, and successfully ran both a stateless Worker and a SQLite Durable Object. The missing inputs mean a normal crates.io consumer cannot reproduce that hardening path. It must instead assemble and patch a full rusty_v8 source checkout outside Cargo. That makes sandbox-enabled builds difficult to pin, automate in CI, and keep current with security releases. We are not specifically asking for a prebuilt sandbox archive. A documented and CI-covered full-source workflow would solve the problem too. Reproduction Tested on macOS arm64 with Rust 1.94.1 and Ninja 1.13. Observed The build stops on missing inputs, in order: 1. 2. 3. A full checkout with submodules plus at V8's DEPS-pinned commit builds successfully. A real celld consumer then compiled and ran with . Expected There should be one documented, CI-covered way for a crates.io consumer to build features that require : either publish the required inputs or direct Cargo consumers to a reproducible full-source path. Related: #1999 covers ICU data staging, but not the other missing published-package inputs.

Summary expose as a thin binding over V8 document global proxy reuse, idempotence, microtask disassociation, and the lifetime constraint on previously returned queue references test two contexts sharing a microtask queue, with tasks enqueued under their corresponding context scopes verify that detached-context work is skipped, active-context work still runs, and the shared queue remains reusable Closes #2059. Testing (361 passed)

Completes the artifact-resolution improvement series from #2063, #2064 and #2066. The README grew its prebuilt-artifact documentation one env var at a time, so the resolution order was described piecemeal across five sections plus a stale trailing "Download cache" section that still showed pre-.gz filenames and the old full-URL cache key. This replaces all of that with a single "Prebuilt artifacts" section: a resolution-order table covering both artifacts (static lib and src binding), each variable documented once in context, and the cache and integrity/pinning story in one place. Every claim was cross-checked against the build script's actual behavior. It also batches small cleanups deferred from earlier reviews: set-but-empty environment values are now treated as unset consistently via a new env_non_empty helper (previously RUSTY_V8_MIRROR="" produced broken "/v.../file" URLs), and RUSTY_V8_ARCHIVE_SHA256 under V8_FROM_SOURCE=1 now emits a no-op warning like RUSTY_V8_SKIP_DOWNLOAD does. The .sum checksum records build.rs writes into gen/ are gitignored; the downloaded bindings themselves deliberately are not, because cargo publish only packages them into the crate because they are not ignored.