The app design is going to have to change around per-process permissions. build.ts doesn't need the same as main.ts but at that point what are you getting where you couldn't just use docker and abstract that pattern to literally all software and dependencies that aren't in deno.

Maybe it's a start of better tooling? Kicking out a graph of package/permission call stack might be useful to audit