deno

And Deno with URL imports mean you can have a single-file script with external dependencies and it just works.

Can you say more about why TypeScript with Deno is your scripting language of choice?

Or just use nodejs, it got many of the features deno/bun originally shipped with.

Zerobox uses the Deno sandboxing policy and also the same pattern for cred injection (placeholders as env vars, replaced at network call time).

They also do the exact same thing, different sandboxing mechanism though (I think Deno has it's own way of sandboxing subprocesses).

For fine grained permission control, you can use Deno Workers.

Just a reminder that you can run most node things with deno run and have opt in permissions, audit trail and even external permission system integration now.

I feel like Deno falls under most people's radar often.

I took this idea from the Deno sandboxing docs.

The same criticism has been said of Deno and Pnpm and bun, and yet, despite all these years since their respective releases, node and npm remain slower than all three options.

(Python does this now too with inline dependencies and uv run.) Deno and Bun also come with decent APIs that are not quite a standard library but help a lot.

The gotcha is that "deno task <<some package.json script>>" will NOT execute with this model which I find extremely unintuitive and had me thinking deno abandoned its sandbox for nodejs compatibility completely.

It isn't used by anyone besides me, but I wrote a property-testing library for Deno [1] that has a form of "sometimes" assertions (inspired by Antithesis) and uses "internal shrinking" (inspired by Hypothesis).

With my favorite database (Gel) effectively dead (team acquihire by Vercel), I told Claude to reimplement it in Deno/TypeScript.

Deno also provides the same functionality, but with a smaller optimized binary.

This is basically what Deno's import maps tried to solve, and what they ended up with looked a lot like a package registry again.