should be the transitive dependencies, not just top-level (so the lock file or equiv) or you just reward the "barely wrap it and give it a new name" js crowd even more.