@coana-tech/cli 15.2.6 → 15.2.7

package/cli.mjs

@@ -225628,13 +225628,39 @@ var PnpmFixingManager = class extends NpmEcosystemFixingManager {
     if (result.error) {
       logger.debug("finalize fixes stdout", result.stdout);
       logger.debug("finalize fixes stderr", result.stderr);
-      throw result.error;
+      const trustErrorMessage = buildPnpmTrustDowngradeMessage(`${result.stdout}
+${result.stderr}`);
+      if (trustErrorMessage !== void 0) throw new Error(trustErrorMessage);
+      throw new Error(buildPnpmFinalizeFailureMessage(result.stdout, result.stderr, result.error.message));
     }
     logger.info(
       `Run 'pnpm install' in '${relative7(this.rootDir, this.subprojectPath) || "."}' to install the updated dependencies`
     );
   }
 };
+function parsePnpmTrustDowngrade(output) {
+  const match2 = output.match(/ERR_PNPM_TRUST_DOWNGRADE[^\n]*?"([^"]+)"/);
+  return match2 ? { packageRef: match2[1] } : void 0;
+}
+function buildPnpmFinalizeFailureMessage(stdout, stderr, fallbackMessage) {
+  const combined = [stderr.trim(), stdout.trim()].filter(Boolean).join("\n").trim();
+  return combined ? `${fallbackMessage}
+
+pnpm output:
+${combined}` : fallbackMessage;
+}
+function buildPnpmTrustDowngradeMessage(output) {
+  const parsed = parsePnpmTrustDowngrade(output);
+  if (!parsed) return void 0;
+  const { packageRef } = parsed;
+  return `pnpm refused to update the lockfile due to a trust-downgrade on "${packageRef}" (ERR_PNPM_TRUST_DOWNGRADE). This usually means the package lost its npm provenance attestation between releases \u2014 often a publishing-workflow regression rather than a real supply-chain incident.
+
+To unblock the fix, edit pnpm-workspace.yaml at the workspace root (the same file your \`trustPolicy: no-downgrade\` setting lives in) and either:
+  \u2022 set \`trustPolicy: off\` to disable the check entirely, or
+  \u2022 keep the policy on and allow just this release via:
+      trustPolicyExclude:
+        - '${packageRef}'`;
+}
 function getVersionNumber(version4) {
   const pnpmLockVersionSuffix = /((\d+)\.(\d+)\.(\d+)((-((\d|[a-zA-Z]|\.)+)){0,1})((\+((\d|\.)+)){0,1}))(_|\()(.+)/;
   const match2 = version4.match(pnpmLockVersionSuffix);
@@ -252321,7 +252347,7 @@ async function onlineScan(dependencyTree, apiKey, timeout) {
 }
 
 // dist/version.js
-var version3 = "15.2.6";
+var version3 = "15.2.7";
 
 // dist/cli-core.js
 var { mapValues, omit, partition, pickBy: pickBy2 } = import_lodash15.default;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coana-tech/cli",
-  "version": "15.2.6",
+  "version": "15.2.7",
   "description": "Coana CLI",
   "type": "module",
   "bin": {