tom: move deps to allow npm install --production