[Aman-goel-04]

Summary

• Link Java and Kotlin imports to the Maven group:artifact they come from, so repowise report inventory no longer reports "N declared package(s), 0 imported through the import graph" on JVM repos. The linker only tried the import path and its first dotted segment, which can never equal a group:artifact declared name.
• Add a curated package-prefix to group:artifact table (external_systems/jvm_packages.py, about 100 common artifacts: Guava, Jackson, Gson, Commons, JUnit 4/5, Mockito, Spring, SLF4J/Logback, Jakarta, kotlinx, etc.). It matches the longest prefix on whole dotted segments. declaration_name_candidates offers the mapped names right after the whole name and ahead of the generic first-segment fallback.
• No groupId-prefix guessing. The table only offers candidates, and a link forms only when a manifest declares that exact coordinate. An import matching nothing stays unlinked. Where a sub-package ships in a different artifact than its parent prefix, a longer entry overrides it (e.g. com.google.common.truth -> truth, not guava). An empty tuple fences a prefix off entirely (e.g. com.google.gson.protobuf, which is not in the gson jar).
• Unchanged: npm/pip linking and the exact maven:group:artifact query form (parse_query).

Related Issues

Closes #4489

Test Plan

• Tests pass (pytest)
• Lint passes (ruff check .)
• Web build passes (npm run build); n/a, no frontend changes

New tests in tests/unit/analysis/test_external_systems_links.py (29 pass in that file):

• com.google.common.collect resolves to a declared com.google.guava:guava
• longest prefix wins (org.junit.Test -> junit:junit, org.junit.jupiter.api.Test -> junit-jupiter-api)
• prefix match is on whole segments (org.junitx.Foo stays unlinked)
• an unknown import stays unlinked
• a known import whose coordinate is not declared stays unlinked (no guessing)
• requests.adapters still resolves to requests, and its candidates are unchanged
• guava sub-packages shipped in other artifacts (truth, guava-testlib) are not linked to guava
• a fenced prefix (com.google.gson.protobuf*) stays unlinked even when gson is declared

Repro from the issue (google/gson, repowise init --yes --no-prose, then repowise report inventory --format markdown):

Before: 12 component(s); 15 declared package(s), 0 imported through the import graph
After: 12 component(s); 15 declared package(s), 4 imported through the import graph

Linked external nodes after the fix, by declared package:

Declared package	Nodes
com.google.guava:guava	12
com.google.guava:guava-testlib	12
com.google.protobuf:protobuf-java	18
junit:junit	18
com.fasterxml.jackson.core:jackson-databind	4
com.google.errorprone:error_prone_annotations	3
com.google.truth:truth	3
com.google.truth.extensions:truth-proto-extension	1
org.junit.jupiter:junit-jupiter	1

Imports from packages the repo does not declare (jackson-core, caliper, test-parameter-injector) stay unlinked, as do gson's own generated protobuf classes.

Notes for reviewers

• The table is hand-written, so the coordinates are worth a check against Maven Central, especially the Spring, Jackson and Jakarta entries.
• Links are computed and stored at index time, so an existing index needs a fresh repowise init to pick them up. repowise reindex does not rebuild them.
• Not included: reading package lists from jars in a local ~/.m2 or Gradle cache, which the issue lists as an optional addition. Gradle declarations will link once feat(inventory): read Gradle build scripts into the declared package store #4488 lands, provided they use the group:artifact name form.

Checklist

• My code follows the project's code style
• I have added tests for new functionality
• All existing tests still pass
• I have updated documentation if needed; n/a, no user docs describe this matcher

[RaghavChamadiya]

Thanks @Aman-goel-04. Whole-segment longest-prefix matching that only links when a manifest declares the exact coordinate is the precision-first shape we want.

Two bot findings in jvm_packages.py still apply, both one line each: com.google.protobuf swallows com.google.protobuf.util, so JsonFormat links to protobuf-java in a repo that declares both (add "com.google.protobuf.util": ("com.google.protobuf:protobuf-java-util",)), and org.junit swallows org.junit.platform.* (add "org.junit.platform": ()). With those I'll merge.

[repowise-bot]

🔍 1 thing to check

1. This PR introduces untested complexity in packages/core/src/repowise/core/analysis/external_systems/jvm_packages.py line 154

✅ Health of changed files: 10.0 (unchanged)
_{Average full file score (structure and history) of 3 changed code files, weighted by size before this PR; not the repository score.}

👀 Suggested reviewers @RaghavChamadiya

---

📊 See the full report for this PR
_{Plain markdown for agents}

_{Settings and updates}

_{Blast radius, every caller of the contracts it changes, and health before and after. No sign-in.
Updated 2026-10-27 07:57 UTC
Silence one PR with [skip repowise] in the title · Bot settings
⭐ Star Repowise · 📥 Install on another repo}

[Aman-goel-04]

Thanks for reviewing, done, tests added too. CI should be green now. Pls go ahead w the merge once it's green.

[Aman-goel-04]

Please go ahead with the merge!