fix(aliases): skip sub-resource arrays in scalar precompute and harden denorm Phase 2a

- In compute_aggregates_for_version, skip non-wildcard entries whose
  short name matches a detected sub-resource array.  Without this
  filter, scalar alias normalization would overwrite the properly
  flattened sub-resource array with a non-flattened copy.

- Populate alias_owned_normalized_roots for all non-wildcard scalar
  aliases (not just single-segment ones) so Phase 2a correctly skips
  nested alias roots like sku.name.

- Change get_path_exact_or_ci to accept &[String] directly instead
  of &[&str], eliminating the per-op Vec<&str> allocation in the
  scalar denormalization loop.

Author: anakrish

src/languages/azure_policy/aliases/denormalizer/mod.rs

@@ -9,18 +9,20 @@ pub(crate) mod sub_resource;
 #[cfg(test)]
 mod tests;
 
+use alloc::vec::Vec;
+
 use crate::Value;
 
 use crate::Rc;
 
 use super::obj_map::{
     extract_type_field, find_key_ci, get_path_exact_or_ci, make_value, new_map,
-    obj_get_exact_or_ci, obj_insert, remove_element_field, set_nested, val_str, ROOT_FIELDS,
+    obj_get_exact_or_ci, obj_insert, remove_element_field_ci, set_nested, val_str, ROOT_FIELDS,
 };
 use super::types::ResolvedAliases;
 use super::AliasRegistry;
 
-use super::normalizer::{apply_element_remap, ElementRemap};
+use super::normalizer::apply_element_remap_reverse;
 
 use casing::{default_casing_map, denormalize_value, restore_casing};
 
@@ -101,12 +103,7 @@ pub fn denormalize_with_aliases(
     // Phase 2b: Aliased scalar fields → versioned ARM paths.
     if let Some(agg) = selected_agg {
         for op in &agg.scalar_aliases_denormalize {
-            let segments: alloc::vec::Vec<&str> = op
-                .normalized_path_segments
-                .iter()
-                .map(|segment| segment.as_str())
-                .collect();
-            let val = get_path_exact_or_ci(obj, &segments);
+            let val = get_path_exact_or_ci(obj, &op.normalized_path_segments);
             let val = match val {
                 Some(v) => v,
                 None => continue,
@@ -126,6 +123,28 @@ pub fn denormalize_with_aliases(
         }
 
         // Phase 2c + 2d: Use precomputed renames/remaps.
+        //
+        // For data-plane resources, non-root fields live in `result` (no
+        // "properties" wrapper) but Phases 2c/2d/3 all operate on
+        // `properties`.  Stage data-plane fields into `properties` so the
+        // subsequent phases can process them uniformly; Phase 4 merges
+        // them back into `result` at the top level.
+        if is_data_plane {
+            let keys_to_move: Vec<Value> = result
+                .keys()
+                .filter(|k| {
+                    val_str(k)
+                        .is_some_and(|s| !ROOT_FIELDS.iter().any(|f| f.eq_ignore_ascii_case(s)))
+                })
+                .cloned()
+                .collect();
+            for k in keys_to_move {
+                if let Some(v) = result.remove(&k) {
+                    properties.entry(k).or_insert(v);
+                }
+            }
+        }
+
         // Phase 2c: Precomputed array base renames.
         for (alias_base_lc, arm_base) in &agg.array_renames_denormalize {
             if let Some(key) = find_key_ci(&properties, alias_base_lc) {
@@ -137,14 +156,16 @@ pub fn denormalize_with_aliases(
 
         // Phase 2d: Precomputed reverse element-level field remaps.
         // target_field is already stored with original ARM casing.
+        // Uses case-insensitive lookups because Phase 2a restored key casing
+        // but array_chain/source_field are lowercased.
         for rev in &agg.reverse_element_remaps {
-            let remap = ElementRemap {
-                array_chain: rev.array_chain.clone(),
-                source_field: rev.source_field.clone(),
-                target_field: rev.target_field.clone(),
-            };
-            apply_element_remap(&mut properties, &remap, false);
-            remove_element_field(&mut properties, &rev.array_chain, &rev.cleanup_field);
+            apply_element_remap_reverse(
+                &mut properties,
+                &rev.array_chain,
+                &rev.source_field_segments,
+                &rev.target_field,
+            );
+            remove_element_field_ci(&mut properties, &rev.array_chain, &rev.cleanup_field);
         }
     }
 
@@ -160,14 +181,22 @@ pub fn denormalize_with_aliases(
 
     // Phase 4: Attach properties to result.
     if !properties.is_empty() {
-        let props_key = Value::from("properties");
-        if let Some(Value::Object(existing_rc)) = result.get_mut(&props_key) {
-            let existing = Rc::make_mut(existing_rc);
+        if is_data_plane {
+            // Data-plane resources have no "properties" wrapper; merge
+            // directly into the top-level result.
             for (k, v) in properties {
-                existing.entry(k).or_insert(v);
+                result.entry(k).or_insert(v);
             }
         } else {
-            obj_insert(&mut result, "properties", make_value(properties));
+            let props_key = Value::from("properties");
+            if let Some(Value::Object(existing_rc)) = result.get_mut(&props_key) {
+                let existing = Rc::make_mut(existing_rc);
+                for (k, v) in properties {
+                    existing.entry(k).or_insert(v);
+                }
+            } else {
+                obj_insert(&mut result, "properties", make_value(properties));
+            }
         }
     }
 

src/languages/azure_policy/aliases/denormalizer/sub_resource.rs

@@ -56,9 +56,7 @@ pub fn rewrap_precomputed_sub_resource_arrays(
     ops: &[PrecomputedSubResourceRewrap],
 ) {
     for op in ops {
-        let parent_parts: Vec<&str> = op.parent_path.iter().map(|part| part.as_str()).collect();
-
-        for_each_array_object_in_path_ci(properties, &parent_parts, &mut |parent| {
+        for_each_array_object_in_path_ci(properties, &op.parent_path, &mut |parent| {
             if let Some(Value::Array(arr)) = obj_get_mut_ci(parent, &op.array_name) {
                 let inner = crate::Rc::make_mut(arr);
                 for elem in inner.iter_mut() {

src/languages/azure_policy/aliases/mod.rs

@@ -225,11 +225,8 @@ impl AliasRegistry {
             // so that overwritten aliases that no longer indicate sub-resource
             // wrapping cause stale classifications to be removed.
             existing.sub_resource_arrays = redetect_sub_resource_arrays(&existing.entries);
-            // Recompute aggregates after merge.
-            let (default_agg, versioned_agg) =
-                precompute_aggregates(&existing.entries, &existing.sub_resource_arrays);
-            existing.default_aggregates = default_agg;
-            existing.versioned_aggregates = versioned_agg;
+            // Recompute casing map and aggregates after merge.
+            existing.rebuild_aggregates();
         } else {
             self.types.insert(lc_type, resolved);
         }
@@ -480,6 +477,17 @@ fn compute_aggregates_for_version(
         let selected_path = entry.select_path(api_version);
 
         if !entry.is_wildcard {
+            // Skip non-wildcard entries whose short name matches a detected
+            // sub-resource array.  These are handled by the sub-resource
+            // rewrap path; including them here would overwrite the properly
+            // flattened array with a non-flattened copy.
+            if sub_resource_arrays.contains(&entry.short_name.to_ascii_lowercase()) {
+                continue;
+            }
+
+            // Only mark root as alias-owned when the alias IS the root
+            // (single-segment path).  Multi-segment aliases share a root key
+            // that may contain non-alias siblings which Phase 2a must preserve.
             if entry.normalized_output_segments().len() == 1 {
                 let root = entry.normalized_root_key();
                 let stripped = root.strip_prefix("_p_").unwrap_or(root);
@@ -536,9 +544,12 @@ fn compute_aggregates_for_version(
                         target_field: target_lc.clone(),
                     });
 
+                    let source_field_segments: Vec<String> =
+                        target_lc.split('.').map(String::from).collect();
                     reverse_element_remaps.push(PrecomputedReverseRemap {
                         array_chain,
                         source_field: target_lc.clone(),
+                        source_field_segments,
                         target_field: arm_leaf.to_string(),
                         cleanup_field: target_lc,
                     });

src/languages/azure_policy/aliases/normalizer/element_remap.rs

@@ -8,31 +8,12 @@ use alloc::vec::Vec;
 
 use crate::Value;
 
-use super::super::obj_map::{for_each_array_object_in_chain, get_path, set_nested, ObjMap};
+use super::super::obj_map::{
+    for_each_array_object_in_chain, for_each_array_object_in_chain_ci, get_path,
+    get_path_exact_or_ci, set_nested, ObjMap,
+};
 use super::super::types::PrecomputedRemap;
 
-/// Describes a field remapping inside each element of a (possibly nested) array.
-pub struct ElementRemap {
-    /// Chain of array navigations for nested `[*]` levels.
-    pub(crate) array_chain: Vec<Vec<String>>,
-    /// Dot-separated path to read within the innermost array element.
-    pub(crate) source_field: String,
-    /// Dot-separated path to write within the innermost array element.
-    pub(crate) target_field: String,
-}
-
-/// Apply an element-level field remap to each element of an array (or nested
-/// array chain).
-///
-/// When `lowercase` is `true` (normalizer), target path segments are
-/// lowercased.  When `false` (denormalizer), they are written verbatim
-/// so that restored casing is preserved.
-pub fn apply_element_remap(result: &mut ObjMap, remap: &ElementRemap, lowercase: bool) {
-    for_each_array_object_in_chain(result, &remap.array_chain, &mut |element| {
-        remap_deep_field(element, &remap.source_field, &remap.target_field, lowercase);
-    });
-}
-
 /// Apply a precomputed element remap (from [`PrecomputedRemap`]) without
 /// any per-call string splitting or allocation.
 pub fn apply_element_remap_precomputed(result: &mut ObjMap, remap: &PrecomputedRemap) {
@@ -51,6 +32,26 @@ fn remap_deep_field(obj: &mut ObjMap, source: &str, target: &str, lowercase: boo
     set_nested(obj, target, val, lowercase);
 }
 
+/// Apply a reverse (denormalization) element-level field remap using
+/// case-insensitive lookups for both array chain traversal and source field
+/// reads.  This is necessary because Phase 2a restores key casing before
+/// Phase 2d runs, so the lowercased chain/source segments would miss with
+/// exact-case lookups.
+pub fn apply_element_remap_reverse(
+    result: &mut ObjMap,
+    array_chain: &[Vec<String>],
+    source_segments: &[String],
+    target: &str,
+) {
+    for_each_array_object_in_chain_ci(result, array_chain, &mut |element| {
+        let val = match get_path_exact_or_ci(element, source_segments) {
+            Some(v) => v.clone(),
+            None => return,
+        };
+        set_nested(element, target, val, false);
+    });
+}
+
 /// Read a value at a dot-separated path from an ObjMap.
 fn read_dotted_path(obj: &ObjMap, path: &str) -> Option<Value> {
     let segments: Vec<&str> = path.split('.').collect();

src/languages/azure_policy/aliases/normalizer/mod.rs

@@ -11,7 +11,7 @@ mod element_remap;
 mod flatten;
 
 // Re-export items used by the denormalizer.
-pub(crate) use element_remap::{apply_element_remap, ElementRemap};
+pub(crate) use element_remap::apply_element_remap_reverse;
 
 use crate::Value;