My gut here says that if dep inference is good, we can match against maven coordinates that exist in the lockfile for the same level (or better) performance than searching for declared

jvm_artifacts

(as currently implemented, anyway)