[lloydmangnall]

Step B2 of the alignment window: two package changes and a docs commit. Rebase-merge it, so Nx Release sees each scoped commit (CONTRIBUTING: multi-package PRs are rebased, never squashed).

1. feat(iac-core): stack and project names read both grammars through one map. Implements Pl.Architecture.Meta.NamingConventionsAcrossPlatforms 9: pulumi-project-is-one-account, pulumi-stack-shape, names-migrate-through-an-alias-map.
   • The account grammar: project {tenant}-{provider}-{account-purpose}-{env}; stack {target-env}-{stack-purpose}[-{concern}]-{region} (glb for global platforms). The project's segment count decides the grammar.
   • parseStackIdentity: a legacy name and its new name give the same identity. detectStackContext then gives the same context apart from projectName and stackName, and targetEnvironment stays present only for centralized stacks.
   • NameAliasMap: the consumer's one declared old → new map. It lives in iac-worx, because iac-core holds no tenant's names.
     • validateNameAliases checks it: keys legacy, targets account-grammar, same identity on both sides, one target per key, one new project per legacy project.
     • canonicalStackName resolves either name.
     • detectStackContext({ nameAliases }) refuses a legacy name the map doesn't declare.
   • Tests: both grammars, all 16 iac-worx renames (a fixture; the declared map is B3's), refusals, and a name in neither grammar.
2. feat(iac-aws)!: SharedVpc tiers require role; shareViaRam removed. Implements Bh.Flow.Platform.NetworkDualStack 9 and ends feat(iac-aws): tier aliases and roles for SharedVpc renames #75's deprecation.
   • role and shareWith are required, and shareViaRam is refused with its replacement named.
   • The main share is the tiers sharing with every account (isInMainShare). Old RAM association names derive from it, so a stack moving shareViaRam: true to shareWith naming every account needs no legacyRamSharedTiers.
   • defaultSubnetTiers(sharedAccounts) replaces DEFAULT_SUBNET_TIERS.
   • The tag: SharedByTiers joins with + (the tag-charset rule flagged ,). The tag updates in place.
3. docs(repo): the tier examples in README.md and docs/security-implementation.md now use role and shareWith.

Consumer impact

Does any consumer need to act? That means changing its arguments, config or code, or
accepting a preview it didn't ask for (new or changed resources on a live stack).

• No.

• Yes. Every commit that causes it carries ! (or a BREAKING CHANGE: footer), whatever
  its type. Below 1.0 an unmarked feat ships as a patch that ^0.y.z ranges accept
  (CONTRIBUTING.md#types-we-use).

• iac-aws 0.6.0 (!): the iac-worx stacks still setting shareViaRam are dev-ops-vpc-usw2, stg-ops-vpc-use1, stg-ops-vpc-usw2 and prd-ops-vpc-use1. Each must give every tier a role and a shareWith: every shared account for shareViaRam: true, [] for false. dev-ops-vpc-use1 already does (#151, applied).

  • Preview after migrating: the SharedByTiers tag on the shared route table, private,data → private+data. Each tier's Role tag is added.
  • No RAM association is recreated when sharing is unchanged: the main-share derivation keeps the old index names.

• iac-core 0.5.1: additive. With no map passed, detectStackContext() reads legacy names exactly as before. A consumer opts into strict mode by passing its map (B3).

Release version (pnpm release:dry):

• @adaptiveworx/iac-core 0.5.0 → 0.5.1
• @adaptiveworx/iac-aws 0.5.1 → 0.6.0
• @adaptiveworx/iac-azure 0.1.4 → 0.1.5 (a version-only bump that Nx makes for a dependent of iac-core, with no code change)

Depends on

• iac-aws 0.5.1 (feat(iac-aws): tier aliases and roles for SharedVpc renames #75, chore(release): publish iac-aws@0.5.1 #76), merged and published.

Followed by

• B3 (iac-worx): pin iac-core 0.5.1 and iac-aws 0.6.0. Declare the one name alias map (the 16 renames), validated by validateNameAliases. Route discovery, the dispatch resolver, the stack-name guards and the *StackRef config values through it. Migrate the four VPC stacks off shareViaRam.
• W3: the EA's pulumi stack rename per project, under the map.
• Later: remove the map once the last rename is applied. Update the iac-schemas SUBNET_TIERS Infisical template, which still shows shareViaRam (iac-worx no longer reads tiers from Infisical).

Apply steps

None: library only. The EA merges (rebase), then publishes through the Scheduled Release.

Expected preview (consumers)

See Consumer impact: tag changes only on the migrated VPC stacks, nothing created or replaced.

🤖 Generated with Claude Code