feat(manifest): add socket manifest maven (1.1.125, Coana 15.5.5)

[Jeppe Fredsgaard Blaabjerg (jfblaa)]

Summary

Adds a new socket manifest maven command that generates a Socket facts file (.socket.facts.json) from a Maven pom.xml project, mirroring the existing gradle / scala (sbt) facts flows. socket-cli delegates to the Coana CLI's manifest maven command (which owns the Maven extension that resolves the dependency graph); socket-cli only constructs the args and verifies the emitted facts file.

This ships as the 1.1.125 release (1.1.124 was taken by --reach-retain-facts-file on v1.x, since merged in): the feature plus the Coana bump it depends on.

What's included

• New command cmd-manifest-maven.mts — facts-only (Maven is already pom-native, so there is no --pom path). Flags: --bin (defaults to mvn on PATH; point at ./mvnw to use a wrapper), --maven-opts (e.g. -P <profile> -s <settings.xml>), --include-configs / --exclude-configs (Maven scopes), --ignore-unresolved, --verbose. Reads defaults from socket.json like the other JVM tools.
• convert-maven-to-facts.mts — thin delegate to the shared runCoanaManifestFacts (widened to accept ecosystem: 'maven' / --maven-opts).
• Auto-detection — pom.xml → maven in detect-manifest-actions.mts, wired into socket manifest auto (generate_auto_manifest.mts).
• Setup wizard — a Maven choice + setupMaven in the socket manifest setup configurator.
• Types — maven entry in socket.json manifest defaults.
• Docs/changelog — README section and a 1.1.125 changelog entry.
• Coana bump — @coana-tech/cli 15.5.0 → 15.5.5, which adds the manifest maven command this delegates to.

Review follow-ups (mtorp)

• Changelog version label — relabeled the new section 1.1.124 → 1.1.125 to match package.json, and aligned the PR title/body.
• --*-opts space-splitting — replaced the per-tool split(' ') with a shared quote-aware tokenizer (parseBuildToolOpts) honoring single/double quotes, applied across gradle/kotlin/scala/maven + auto-manifest so the advertised -s "my settings.xml" case works without a maven-only divergence. Unquoted input tokenizes exactly as before; added a unit test.

Verification

• pnpm build:dist:src, pnpm check:tsc, pnpm check:lint, biome format all clean.
• New parse-build-tool-opts.test.mts and cmd-manifest-maven.test.mts; gradle/kotlin/scala/auto suites pass.
• End-to-end smoke test against a real Maven project with the published 15.5.5 produces a complete graph (direct + transitive deps, correct tool: "maven" metadata).

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​@​coana-tech/​cli@​15.5.5

View full report

[Martin Torp (mtorp)]

Approving — clean, low-risk addition that faithfully mirrors the existing Gradle/sbt facts delegation: type-safe flag/socket.json plumbing, an argv-based (no-shell) spawn path, and good rationale comments. CI is green across the board.

Two non-blocking notes inline:

• CHANGELOG version label — the new section is the 1.1.125 release (per package.json) but is labeled 1.1.124; suggestion attached. Worth reconciling with the PR title/body too (they say 1.1.124).
• --maven-opts space-splitting — a pre-existing, consistent limitation shared with --gradle-opts/--sbt-opts; flagged only because the Maven help text advertises the spaced-path case.