[lloydmangnall]

Lets a SharedVpc tier be renamed without replacing anything, carry the role of the workloads it holds, and name the accounts it is shared with.

Implements: Bh.Flow.Platform.NetworkDualStack 8 @ f03b8f21 (SubnetTier role, shareWith, formerNames; Subnet azId; invariants rename-keeps-identity, shared-only-with-the-role-accounts, zones-named-by-id, tier-has-a-role).

What changes

• formerNames: every resource SharedVpc names after a tier carries each former logical name as a Pulumi alias: subnets, the tier NACL, its rules and associations, route tables, routes, route-table associations and RAM associations. publicSubnetIds / privateSubnetIds / dataSubnetIds and NAT placement follow a renamed tier through its former name. New output tierSubnetIds lists every tier by its current name.
• role: tagged Role on the tier's subnets and NACL. Optional in this release (a warning when absent), required after.
• shareWith: the accounts (by sharedAccounts name) a tier is shared with. The full set goes in the main share, a narrower set gets a share of its own, and [] shares with no account. shareViaRam is deprecated but still accepted. Exactly one of the two is required, and an unknown account fails closed.
• RAM association names move from a running index (<env>-ram-<tier>-<n>) to tier plus AZ letter (<env>-ram-<tier>-<a…p>), carrying the old name as an alias. legacyRamSharedTiers gives the old layout for a stack that changes its sharing in the same apply.
• AzId tag on every subnet (zone names map to physical zones per account), from availabilityZoneIds or aws.getAvailabilityZones.

Tests

shared-vpc.rename.unit.test.ts (17 new tests) runs the old and new layouts and checks what the engine would do, using the aliases from the child options.

• A rename with formerNames and unchanged sharing: no creates, no deletes.
• The dev re-tiering with legacyRamSharedTiers: only the unshared tiers' associations are deleted.
• The same without it: the kept associations would be recreated. This is the case to watch in the preview.
• A rename without formerNames: everything is replaced.
• An unchanged stack upgrading: association names move only by alias.

Also covered: outputs follow the rename; the Role and AzId tags; a narrower share; and the fail-closed sharing checks. The existing mocks now answer getAvailabilityZones.

nx run-many -t lint typecheck test build -p @adaptiveworx/iac-aws passes: 80 tests, up from 63.

Depends on: nothing.
Followed by:

1. iac-worx dev-ops-vpc-use1: the rename (public→edge, private→flow, data→analytics) with roles, shareWith (flow: worx-app-dev; edge and analytics: none), legacyRamSharedTiers: ["public", "private", "data"], and the stack's parseSubnetTiers keys (role, shareWith, formerNames).
2. Then app-flow-use1, which reads the flow tier's /64s.

Apply steps: none for this PR. The EA publishes the release via Nx Release; the version is not hand-edited.

Expected preview for the consumer (dev-ops-vpc-use1, once it adopts this):

• Every subnet, NACL, NACL rule and association, and route-table association shows as a rename (an alias) with tag updates only: Name, Tier, Role and AzId.
• RAM: the flow tier's 6 associations show as renames.
• The edge and analytics tiers' 12 associations are deleted. That's the intended unsharing from worx-app-dev, per the EA's ruling.
• No subnet is replaced. Any create plus delete on a subnet, or on a flow association, means stop.

Out of scope, noted: the repo README, docs/security-implementation.md and iac-schemas' infisical-secrets example still show shareViaRam. It's still valid; docs follow-up.

🤖 Generated with Claude Code