Taken from crystallography, the JavaScript here is like the oxygen in silicon dioxide and in water. Same material, same physical properties, completely different structure and function depending on where it is.
Clearly you have yet to work on something that isn't just form validation and DOM rendering.
Everything you mentioned is achievable with Rill. I have found two simple ways to Isolate server only code in Rill.
1) Have two Rill servers, one with shared code and one without. Where the shared code server interacts with the isolated secure api from the other server.
2) Have one server that calls itself through http(s) requests where the api bits of the server and everything else you mention is hidden behind a "if (!process.browser)" statement. With browserify and other build tools you can have it automatically parse out any server side code. This is my preferred approach because I get to bundle all of the important parts of my app together while still having granular control over where things run.
That's all I'm trying to say here.
Call it what it really is: monolingual.