Add cross-repo Maven library dependency links

[nvt-pankajsharma]

Problem

cross-repo-intelligence currently links services through HTTP/async/channel style edges, but it does not expose cross-repo library dependency relationships. In a multi-repo Maven platform this makes it hard to answer questions like:

• which services depend on a shared library artifact?
• which service repos consume a shared library artifact?
• where is a shared artifact referenced through direct dependencies or Maven exclusions?

This came up while indexing independent repositories into the same CBM_CACHE_DIR; the desired relationship is library usage, not just HTTP calls.

Proposed behavior

When index_repository runs in cross-repo-intelligence mode, it should also match Maven artifacts across indexed projects:

• read indexed pom.xml files for the source project
• collect Maven dependency coordinates from actual <dependencies> blocks
• read indexed pom.xml files for target projects
• collect each target project Maven artifact coordinates
• when source dependency coordinates match a target artifact, emit cross-repo library edges

Suggested edge types:

• CROSS_LIBRARY_DEPENDS_ON in the consumer/source project
• CROSS_LIBRARY_USED_BY in the provider/target project

The output summary and architecture cross-repo summary should include these new edge types.

Scope

This issue is intentionally scoped to Maven pom.xml support. Gradle, npm, Go modules, Python packages, and richer code-level import-to-artifact resolution can be separate follow-up issues.

Tests

Add focused regression tests that build temporary provider/consumer projects with neutral Maven coordinates and assert library edge creation, valid JSON edge properties, and no false positives from dependency-management-only declarations.

[nvt-pankajsharma]

Closing this draft tracking issue. I will re-open a smaller sanitized proposal after reworking the scope and implementation shape.

[nvt-pankajsharma]

Reopening this sanitized tracking issue. The implementation will be reworked locally before a new PR is opened.

[DeusData]

Thanks. I’ve linked this under #398 and #592. Maven dependency links fit the cross-repo package-graph track; the next step should be a small public multi-module or two-repo fixture with expected dependency edges before broadening the resolver.

[nvt-pankajsharma]

@DeusData Let me know if anything need to be done from my side. Really happy to help as I am using this tool from almost 4-5 months and I love it. This will be my second contribution.

[DeusData]

Yes, help is welcome here. The best next contribution is a small public Maven fixture plus a red expected-edge test that demonstrates the exact cross-repository dependency link we need. Please start with that fixture and test rather than a broad resolver implementation; once the expected graph contract is concrete, we can review the narrow resolver change against it.