But you can't build a pop-up if you don't have access to create new windows, yet you can still be turing complete. For example, WASM is Turing complete, but it

But you can't build a pop-up if you don't have access to create new windows, yet you can still be turing complete. For example, WASM is Turing complete, but it can't create popup windows because it has no access to the DOM. I think JavaScript should have to request access to use browser APIs, and you should be able to disable access to any of all of them. For example, I should be about to disable: - network access (disables adding script tags, XMLHttpRequest, fetch) - 2d canvas access - 3d canvas access - WASM And so on, just like mobile apps, but perhaps more granular. The app should also be able to put a note as to why it needs each specific feature.