Guix's solution was to automate as much as possible, but in the end it required manual curation. Even simple npm packages tend to have hundreds to thousands of dependencies.

Making this doubly complicated is that many of the npm packages aren't actually built directly in a clear way from their source. If you really care about reproducibility, not being able to get easily from source code to some usable package is a real problem.