Deno runs code with no ambient authority. Reading an environment variable requires --allow-env, network access requires --allow-net, and file reads require --allow-read. An npm package that reads process.env.NODE_ENV at import time therefore throws unless the permission was granted, even though the same code is inert under Node.
Deno 2 renamed the thrown error from Deno.errors.PermissionDenied to Deno.errors.NotCapable, so code catching the old name by class no longer matches. The message names the missing flag, for example Requires env access to "HOME", run again with the --allow-env flag.
Grant the narrowest thing that works. --allow-env=NODE_ENV,DATABASE_URL is an allowlist, and --allow-net=api.example.com:443 restricts by host and port. -A grants everything and defeats the point of running under Deno at all. In an interactive terminal Deno prompts instead of failing, which is why a script can work by hand and fail in CI where there is no TTY to answer the prompt.