[memexy]

You could implement this by fine grained imports and subprocess execution. Node.js actually has a very nice sub-process communication API: https://nodejs.org/api/child_process.html#child_process_subp....

At some point I remember writing some gpg wrappers with Node.js and I remember the subprocess API being one of the more pleasant ones to work with. In the case of more stringent Deno process sandboxing, the parent process would spawn another Deno process with a smaller set of capabilities.

[Pozzuh]

Deno uses the web standard Worker API to implement sub processes. They are also working on fine-grained permissions for these workers [1].

[1] https://github.com/denoland/deno/issues/4867

[memexy]

Good to know and even better than my proposed solution then. If the language supports it directly then there is no need to write sub-process shims for managing permissions.