From dd1b913875566cfd580bd2a26e162ec97dde2eac Mon Sep 17 00:00:00 2001
From: alphacrack <18480504+alphacrack@users.noreply.github.com>
Date: Fri, 7 Aug 2026 17:27:41 +0200
Subject: [PATCH] fix: make local-build e2e independent of the library version

The local-consumer pinned 'file:../../aws-cdk-secure-constructs-1.0.0.tgz'.
The 0.1.0 release (#70) bumped the version, orphaning that path, so
'npm run test:local-build' failed at the consumer install step. CI didn't
catch it because CI doesn't run the local-build e2e.

Remove the version-pinned dependency from the consumer's package.json and
install the freshly packed tarball with 'npm install --no-save' instead.
The check now works across version bumps and never mutates the consumer's
package.json (no git-restore footgun).

Verified: npm run test:local-build succeeds end-to-end (pack -> install ->
cdk synth) and leaves the working tree clean.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 examples/local-consumer/package.json | 1 -
 scripts/test-local-build.sh          | 7 +++++--
 2 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/examples/local-consumer/package.json b/examples/local-consumer/package.json
index 6fb5186..080c4cd 100644
--- a/examples/local-consumer/package.json
+++ b/examples/local-consumer/package.json
@@ -9,7 +9,6 @@
   },
   "dependencies": {
     "aws-cdk-lib": "^2.196.0",
-    "aws-cdk-secure-constructs": "file:../../aws-cdk-secure-constructs-1.0.0.tgz",
     "constructs": "^10.3.0"
   },
   "devDependencies": {
diff --git a/scripts/test-local-build.sh b/scripts/test-local-build.sh
index 4bf2463..c580c31 100755
--- a/scripts/test-local-build.sh
+++ b/scripts/test-local-build.sh
@@ -31,8 +31,11 @@ cd "$CONSUMER"
 echo "==> Installing consumer app dependencies..."
 npm install --no-fund --no-audit
 
-echo "==> Installing packed library..."
-npm install --no-fund --no-audit "$ROOT/$TARBALL"
+# Install the freshly packed tarball into node_modules only (--no-save), so the
+# consumer's package.json is never mutated and the check works regardless of the
+# library version (the tarball name includes the version).
+echo "==> Installing the packed library ($TARBALL)..."
+npm install --no-fund --no-audit --no-save "$ROOT/$TARBALL"
 
 echo "==> Synthesizing CDK stack..."
 npx cdk synth >/dev/null