You have to meet your users where they are. Your users are not using nix and bazel, they're using npm and typescript. If your users are using bazel, it's easy

You have to meet your users where they are. Your users are not using nix and bazel, they're using npm and typescript. If your users are using bazel, it's easy to separate "download" from "build", but if you're meeting your users over here where cows aren't spherical, you can't take security that seriously. Security doesn't help if all your users leave.