feat(azure-policy): add alias normalization and denormalization (#635)

* feat: add Azure Policy alias normalization/denormalization

Add normalizer and denormalizer for ARM JSON resources, enabling Azure
Policy alias short names to become direct paths into a flat structure.

- Normalizer: flattens properties wrappers, lowercases keys, resolves
  per-alias versioned ARM paths, handles sub-resource array flattening,
  element-level field remaps, and array base renames
- Denormalizer: reverses all transformations with casing restoration
- AliasRegistry: loads production alias catalogs and data policy manifests
- Types: serde deserialization for ARM provider alias formats
- YAML test suite: 13 test files covering normalize, denormalize, round-trip,
  data-plane, edge cases, malformed input, sub-resources, and registry API
- Benchmark suite for normalization performance

* feat: add FFI and C# bindings for alias normalization

- FFI: alias_registry.rs with C-compatible API for loading catalogs,
  normalizing resources, and denormalizing back to ARM JSON
- C#: AliasRegistry wrapper class with NativeMethods P/Invoke bindings
  and integration tests
- Updated Cargo.lock files for new serde_json dependency

bindings/csharp/Regorus.Tests/AliasRegistryTests.cs

@@ -0,0 +1,191 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+
+using System;
+using System.Text.Json;
+using System.Text.Json.Nodes;
+using Microsoft.VisualStudio.TestTools.UnitTesting;
+using Regorus;
+
+namespace Regorus.Tests;
+
+[TestClass]
+public class AliasRegistryTests
+{
+    private const string AliasesJson = @"[{
+        ""namespace"": ""Microsoft.Storage"",
+        ""resourceTypes"": [{
+            ""resourceType"": ""storageAccounts"",
+            ""aliases"": [{
+                ""name"": ""Microsoft.Storage/storageAccounts/supportsHttpsTrafficOnly"",
+                ""defaultPath"": ""properties.supportsHttpsTrafficOnly"",
+                ""paths"": []
+            }, {
+                ""name"": ""Microsoft.Storage/storageAccounts/accessTier"",
+                ""defaultPath"": ""properties.accessTier"",
+                ""paths"": []
+            }]
+        }]
+    }]";
+
+    private const string ManifestJson = @"{
+        ""dataNamespace"": ""Microsoft.KeyVault.Data"",
+        ""aliases"": [],
+        ""resourceTypeAliases"": [{
+            ""resourceType"": ""vaults/certificates"",
+            ""aliases"": [{
+                ""name"": ""Microsoft.KeyVault.Data/vaults/certificates/keySize"",
+                ""paths"": [{ ""path"": ""keySize"", ""apiVersions"": [""7.0""] }]
+            }]
+        }]
+    }";
+
+    [TestMethod]
+    public void Create_and_dispose_succeeds()
+    {
+        using var registry = new AliasRegistry();
+        Assert.AreEqual(0, registry.Length);
+    }
+
+    [TestMethod]
+    public void LoadJson_populates_registry()
+    {
+        using var registry = new AliasRegistry();
+        registry.LoadJson(AliasesJson);
+        Assert.AreEqual(1, registry.Length);
+    }
+
+    [TestMethod]
+    public void LoadManifest_populates_registry()
+    {
+        using var registry = new AliasRegistry();
+        registry.LoadManifest(ManifestJson);
+        Assert.AreEqual(1, registry.Length);
+    }
+
+    [TestMethod]
+    public void NormalizeAndWrap_produces_envelope()
+    {
+        using var registry = new AliasRegistry();
+        registry.LoadJson(AliasesJson);
+
+        var resource = @"{
+            ""name"": ""acct1"",
+            ""type"": ""Microsoft.Storage/storageAccounts"",
+            ""properties"": { ""supportsHttpsTrafficOnly"": true, ""accessTier"": ""Hot"" }
+        }";
+
+        var result = registry.NormalizeAndWrap(resource, "2023-01-01", "{}", "{}");
+        Assert.IsNotNull(result);
+
+        var envelope = JsonNode.Parse(result!)!;
+        Assert.IsNotNull(envelope["resource"]);
+        Assert.IsNotNull(envelope["parameters"]);
+        Assert.IsNotNull(envelope["context"]);
+
+        // Normalized resource should have lowercased alias field names
+        var res = envelope["resource"]!;
+        Assert.AreEqual(true, res["supportshttpstrafficonly"]?.GetValue<bool>());
+        Assert.AreEqual("Hot", res["accesstier"]?.GetValue<string>());
+        Assert.AreEqual("acct1", res["name"]?.GetValue<string>());
+    }
+
+    [TestMethod]
+    public void NormalizeAndWrap_with_context_and_parameters()
+    {
+        using var registry = new AliasRegistry();
+        registry.LoadJson(AliasesJson);
+
+        var resource = @"{
+            ""name"": ""acct1"",
+            ""type"": ""Microsoft.Storage/storageAccounts"",
+            ""properties"": { ""supportsHttpsTrafficOnly"": true }
+        }";
+        var context = @"{""resourceGroup"": {""name"": ""rg1""}}";
+        var parameters = @"{""env"": ""prod""}";
+
+        var result = registry.NormalizeAndWrap(resource, "2023-01-01", context, parameters);
+        Assert.IsNotNull(result);
+
+        var envelope = JsonNode.Parse(result!)!;
+        Assert.AreEqual("rg1", envelope["context"]!["resourceGroup"]!["name"]?.GetValue<string>());
+        Assert.AreEqual("prod", envelope["parameters"]!["env"]?.GetValue<string>());
+    }
+
+    [TestMethod]
+    public void Denormalize_restores_properties()
+    {
+        using var registry = new AliasRegistry();
+        registry.LoadJson(AliasesJson);
+
+        var normalized = @"{
+            ""name"": ""acct1"",
+            ""type"": ""Microsoft.Storage/storageAccounts"",
+            ""supportshttpstrafficonly"": true,
+            ""accesstier"": ""Hot""
+        }";
+
+        var result = registry.Denormalize(normalized, "2023-01-01");
+        Assert.IsNotNull(result);
+
+        var arm = JsonNode.Parse(result!)!;
+        Assert.AreEqual("acct1", arm["name"]?.GetValue<string>());
+        Assert.AreEqual(true, arm["properties"]!["supportsHttpsTrafficOnly"]?.GetValue<bool>());
+        Assert.AreEqual("Hot", arm["properties"]!["accessTier"]?.GetValue<string>());
+    }
+
+    [TestMethod]
+    public void Round_trip_normalize_then_denormalize()
+    {
+        using var registry = new AliasRegistry();
+        registry.LoadJson(AliasesJson);
+
+        var resource = @"{
+            ""name"": ""acct1"",
+            ""type"": ""Microsoft.Storage/storageAccounts"",
+            ""properties"": { ""supportsHttpsTrafficOnly"": true, ""accessTier"": ""Hot"" }
+        }";
+
+        // Normalize
+        var envelopeJson = registry.NormalizeAndWrap(resource, "2023-01-01", "{}", "{}");
+        Assert.IsNotNull(envelopeJson);
+
+        var envelope = JsonNode.Parse(envelopeJson!)!;
+        var normalizedResource = envelope["resource"]!.ToJsonString();
+
+        // Denormalize
+        var armJson = registry.Denormalize(normalizedResource, "2023-01-01");
+        Assert.IsNotNull(armJson);
+
+        var arm = JsonNode.Parse(armJson!)!;
+        Assert.AreEqual(true, arm["properties"]!["supportsHttpsTrafficOnly"]?.GetValue<bool>());
+        Assert.AreEqual("Hot", arm["properties"]!["accessTier"]?.GetValue<string>());
+        Assert.AreEqual("acct1", arm["name"]?.GetValue<string>());
+    }
+
+    [TestMethod]
+    public void DataPlane_manifest_normalize()
+    {
+        using var registry = new AliasRegistry();
+        registry.LoadManifest(ManifestJson);
+
+        var resource = @"{
+            ""type"": ""Microsoft.KeyVault.Data/vaults/certificates"",
+            ""keySize"": 2048
+        }";
+
+        var result = registry.NormalizeAndWrap(resource, "7.0", "{}", "{}");
+        Assert.IsNotNull(result);
+
+        var envelope = JsonNode.Parse(result!)!;
+        Assert.AreEqual(2048, envelope["resource"]!["keysize"]?.GetValue<int>());
+    }
+
+    [TestMethod]
+    [ExpectedException(typeof(InvalidOperationException))]
+    public void LoadJson_invalid_throws()
+    {
+        using var registry = new AliasRegistry();
+        registry.LoadJson("not valid json");
+    }
+}

bindings/csharp/Regorus/AliasRegistry.cs

@@ -0,0 +1,153 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+
+using System;
+using Regorus.Internal;
+
+#nullable enable
+namespace Regorus
+{
+    /// <summary>
+    /// Manages Azure Policy alias definitions used for resource normalization
+    /// and policy compilation.
+    /// </summary>
+    public unsafe sealed class AliasRegistry : SafeHandleWrapper
+    {
+        /// <summary>
+        /// Create an empty alias registry.
+        /// </summary>
+        public AliasRegistry()
+            : base(RegorusAliasRegistryHandle.Create(), nameof(AliasRegistry))
+        {
+        }
+
+        /// <summary>
+        /// Load control-plane alias data (array of ProviderAliases) from a JSON string.
+        /// </summary>
+        /// <param name="json">JSON array of ProviderAliases (e.g. from Get-AzPolicyAlias or ResourceTypesAndAliases.json)</param>
+        public void LoadJson(string json)
+        {
+            Utf8Marshaller.WithUtf8(json, jsonPtr =>
+            {
+                UseHandle(regPtr =>
+                {
+                    CheckAndDropResult(API.regorus_alias_registry_load_json(
+                        (RegorusAliasRegistry*)regPtr, (byte*)jsonPtr));
+                    return 0;
+                });
+            });
+        }
+
+        /// <summary>
+        /// Load a data-plane policy manifest from a JSON string.
+        /// </summary>
+        /// <param name="json">JSON object containing a DataPolicyManifest</param>
+        public void LoadManifest(string json)
+        {
+            Utf8Marshaller.WithUtf8(json, jsonPtr =>
+            {
+                UseHandle(regPtr =>
+                {
+                    CheckAndDropResult(API.regorus_alias_registry_load_manifest(
+                        (RegorusAliasRegistry*)regPtr, (byte*)jsonPtr));
+                    return 0;
+                });
+            });
+        }
+
+        /// <summary>
+        /// Gets the number of resource types loaded in the registry.
+        /// </summary>
+        public long Length
+        {
+            get
+            {
+                return UseHandle(regPtr =>
+                {
+                    return ResultHelpers.GetIntResult(
+                        API.regorus_alias_registry_len((RegorusAliasRegistry*)regPtr));
+                });
+            }
+        }
+
+        /// <summary>
+        /// Normalize an ARM resource JSON and wrap it into the standard input envelope
+        /// expected by a compiled Azure Policy program.
+        /// </summary>
+        /// <param name="resourceJson">Raw ARM resource JSON</param>
+        /// <param name="apiVersion">API version string (e.g. "2023-01-01"), or null to use default alias paths</param>
+        /// <param name="contextJson">Additional context JSON object (pass "{}" if none)</param>
+        /// <param name="parametersJson">Policy parameter values JSON (pass "{}" if none)</param>
+        /// <returns>JSON string: { "resource": &lt;normalized&gt;, "context": &lt;context&gt;, "parameters": &lt;params&gt; }</returns>
+        public string? NormalizeAndWrap(string resourceJson, string? apiVersion = null, string contextJson = "{}", string parametersJson = "{}")
+        {
+            return Utf8Marshaller.WithUtf8(resourceJson, resPtr =>
+                Utf8Marshaller.WithUtf8(contextJson, ctxPtr =>
+                    Utf8Marshaller.WithUtf8(parametersJson, paramsPtr =>
+                    {
+                        if (apiVersion is null)
+                        {
+                            return UseHandle(regPtr =>
+                            {
+                                return ResultHelpers.GetStringResult(
+                                    API.regorus_alias_registry_normalize_and_wrap(
+                                        (RegorusAliasRegistry*)regPtr,
+                                        (byte*)resPtr, null,
+                                        (byte*)ctxPtr, (byte*)paramsPtr));
+                            });
+                        }
+                        else
+                        {
+                            return Utf8Marshaller.WithUtf8(apiVersion, apiPtr =>
+                                UseHandle(regPtr =>
+                                {
+                                    return ResultHelpers.GetStringResult(
+                                        API.regorus_alias_registry_normalize_and_wrap(
+                                            (RegorusAliasRegistry*)regPtr,
+                                            (byte*)resPtr, (byte*)apiPtr,
+                                            (byte*)ctxPtr, (byte*)paramsPtr));
+                                }));
+                        }
+                    })));
+        }
+
+        /// <summary>
+        /// Denormalize a previously-normalized resource JSON back to ARM format.
+        /// </summary>
+        /// <param name="normalizedJson">The normalized resource JSON</param>
+        /// <param name="apiVersion">API version string, or null to use default alias paths</param>
+        /// <returns>Denormalized ARM JSON string</returns>
+        public string? Denormalize(string normalizedJson, string? apiVersion = null)
+        {
+            return Utf8Marshaller.WithUtf8(normalizedJson, normPtr =>
+            {
+                if (apiVersion is null)
+                {
+                    return UseHandle(regPtr =>
+                    {
+                        return ResultHelpers.GetStringResult(
+                            API.regorus_alias_registry_denormalize(
+                                (RegorusAliasRegistry*)regPtr,
+                                (byte*)normPtr, null));
+                    });
+                }
+                else
+                {
+                    return Utf8Marshaller.WithUtf8(apiVersion, apiPtr =>
+                        UseHandle(regPtr =>
+                        {
+                            return ResultHelpers.GetStringResult(
+                                API.regorus_alias_registry_denormalize(
+                                    (RegorusAliasRegistry*)regPtr,
+                                    (byte*)normPtr, (byte*)apiPtr));
+                        }));
+                }
+            });
+        }
+
+        private static string? CheckAndDropResult(RegorusResult result)
+        {
+            return ResultHelpers.GetStringResult(result);
+        }
+    }
+}

bindings/csharp/Regorus/NativeMethods.cs

@@ -669,6 +669,55 @@ namespace Regorus.Internal
         internal static extern RegorusResult regorus_effect_schema_clear();
 
         #endregion
+
+        #region Alias Registry Methods
+
+        /// <summary>
+        /// Create a new, empty AliasRegistry.
+        /// </summary>
+        [DllImport(LibraryName, EntryPoint = "regorus_alias_registry_new", CallingConvention = CallingConvention.Cdecl, ExactSpelling = true)]
+        internal static extern RegorusAliasRegistry* regorus_alias_registry_new();
+
+        /// <summary>
+        /// Drop an AliasRegistry.
+        /// </summary>
+        [DllImport(LibraryName, EntryPoint = "regorus_alias_registry_drop", CallingConvention = CallingConvention.Cdecl, ExactSpelling = true)]
+        internal static extern void regorus_alias_registry_drop(RegorusAliasRegistry* registry);
+
+        /// <summary>
+        /// Load control-plane alias data (array of ProviderAliases) into the registry.
+        /// </summary>
+        [DllImport(LibraryName, EntryPoint = "regorus_alias_registry_load_json", CallingConvention = CallingConvention.Cdecl, ExactSpelling = true)]
+        internal static extern RegorusResult regorus_alias_registry_load_json(RegorusAliasRegistry* registry, byte* json);
+
+        /// <summary>
+        /// Load a data-plane policy manifest into the registry.
+        /// </summary>
+        [DllImport(LibraryName, EntryPoint = "regorus_alias_registry_load_manifest", CallingConvention = CallingConvention.Cdecl, ExactSpelling = true)]
+        internal static extern RegorusResult regorus_alias_registry_load_manifest(RegorusAliasRegistry* registry, byte* json);
+
+        /// <summary>
+        /// Return the number of resource types loaded in the alias registry.
+        /// </summary>
+        [DllImport(LibraryName, EntryPoint = "regorus_alias_registry_len", CallingConvention = CallingConvention.Cdecl, ExactSpelling = true)]
+        internal static extern RegorusResult regorus_alias_registry_len(RegorusAliasRegistry* registry);
+
+        /// <summary>
+        /// Normalize an ARM resource JSON and wrap it into the standard input envelope.
+        /// Returns a JSON string.
+        /// </summary>
+        [DllImport(LibraryName, EntryPoint = "regorus_alias_registry_normalize_and_wrap", CallingConvention = CallingConvention.Cdecl, ExactSpelling = true)]
+        internal static extern RegorusResult regorus_alias_registry_normalize_and_wrap(
+            RegorusAliasRegistry* registry, byte* resource_json, byte* api_version, byte* context_json, byte* parameters_json);
+
+        /// <summary>
+        /// Denormalize a previously-normalized resource JSON back to ARM format.
+        /// </summary>
+        [DllImport(LibraryName, EntryPoint = "regorus_alias_registry_denormalize", CallingConvention = CallingConvention.Cdecl, ExactSpelling = true)]
+        internal static extern RegorusResult regorus_alias_registry_denormalize(
+            RegorusAliasRegistry* registry, byte* normalized_json, byte* api_version);
+
+        #endregion
     }
 
     #region Native Structures
@@ -874,5 +923,13 @@ namespace Regorus.Internal
         public byte* content;
     }
 
+    /// <summary>
+    /// Wrapper for AliasRegistry.
+    /// </summary>
+    [StructLayout(LayoutKind.Sequential)]
+    internal unsafe partial struct RegorusAliasRegistry
+    {
+    }
+
     #endregion
 }

bindings/csharp/Regorus/SafeHandles.cs

@@ -183,4 +183,52 @@ namespace Regorus
             return true;
         }
     }
+
+    internal sealed class RegorusAliasRegistryHandle : SafeHandleZeroOrMinusOneIsInvalid
+    {
+        private RegorusAliasRegistryHandle() : base(ownsHandle: true)
+        {
+        }
+
+        internal static RegorusAliasRegistryHandle Create()
+        {
+            unsafe
+            {
+                var raw = Internal.API.regorus_alias_registry_new();
+                if (raw is null)
+                {
+                    throw new InvalidOperationException("Failed to create Regorus alias registry.");
+                }
+
+                var handle = new RegorusAliasRegistryHandle();
+                handle.SetHandle((IntPtr)raw);
+                return handle;
+            }
+        }
+
+        internal static RegorusAliasRegistryHandle FromPointer(IntPtr pointer)
+        {
+            if (pointer == IntPtr.Zero)
+            {
+                throw new ArgumentException("Pointer cannot be zero.", nameof(pointer));
+            }
+
+            var handle = new RegorusAliasRegistryHandle();
+            handle.SetHandle(pointer);
+            return handle;
+        }
+
+        protected override bool ReleaseHandle()
+        {
+            if (!IsInvalid)
+            {
+                unsafe
+                {
+                    Internal.API.regorus_alias_registry_drop((Internal.RegorusAliasRegistry*)handle);
+                }
+                SetHandle(IntPtr.Zero);
+            }
+            return true;
+        }
+    }
 }

bindings/ffi/Cargo.lock

@@ -57,9 +57,9 @@ dependencies = [
 
 [[package]]
 name = "anstyle"
-version = "1.0.13"
+version = "1.0.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5192cca8006f1fd4f7237516f40fa183bb07f8fbdfedaa0036de5ea9b0b45e78"
+checksum = "940b3a0ca603d1eade50a4846a2afffd5ef57a9feac2c0e2ec2e14f9ead76000"
 
 [[package]]
 name = "anstyle-parse"
@@ -119,9 +119,9 @@ checksum = "5e764a1d40d510daf35e07be9eb06e75770908c27d411ee6c92109c9840eaaf7"
 
 [[package]]
 name = "bitflags"
-version = "2.10.0"
+version = "2.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "812e12b5285cc515a9c72a5c1d3b6d46a19dac5acfef5265968c166106e31dd3"
+checksum = "843867be96c8daad0d758b57df9392b6d8d271134fce549de6ce169ff98a92af"
 
 [[package]]
 name = "borrow-or-share"
@@ -141,9 +141,9 @@ dependencies = [
 
 [[package]]
 name = "bumpalo"
-version = "3.19.1"
+version = "3.20.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5dd9dc738b7a8311c7ade152424974d8115f2cdad61e8dab8dac9f2362298510"
+checksum = "5d20789868f4b01b2f2caec9f5c4e0213b41e3e5702a50157d699ae31ced2fcb"
 
 [[package]]
 name = "bytecount"
@@ -172,9 +172,9 @@ dependencies = [
 
 [[package]]
 name = "cc"
-version = "1.2.55"
+version = "1.2.58"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "47b26a0954ae34af09b50f0de26458fa95369a0d478d8236d3f93082b219bd29"
+checksum = "e1e928d4b69e3077709075a938a05ffbedfa53a84c8f766efbf8220bb1ff60e1"
 dependencies = [
  "find-msvc-tools",
  "shlex",
@@ -258,9 +258,9 @@ dependencies = [
 
 [[package]]
 name = "colorchoice"
-version = "1.0.4"
+version = "1.0.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b05b61dc5112cbb17e4b6cd61790d9845d13888356391624cbe7e41efeac1e75"
+checksum = "1d07550c9036bf2ae0c684c4297d503f838287c83c53686d05370d0e139ae570"
 
 [[package]]
 name = "core-foundation-sys"
@@ -672,15 +672,15 @@ checksum = "a6cb138bb79a146c1bd460005623e142ef0181e3d0219cb493e02f7d08a35695"
 
 [[package]]
 name = "itoa"
-version = "1.0.17"
+version = "1.0.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "92ecc6618181def0457392ccd0ee51198e065e016d1d527a7ac1b6dc7c1f09d2"
+checksum = "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682"
 
 [[package]]
 name = "js-sys"
-version = "0.3.85"
+version = "0.3.91"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8c942ebf8e95485ca0d52d97da7c5a2c387d0e7f0ba4c35e93bfcaee045955b3"
+checksum = "b49715b7073f385ba4bc528e5747d02e66cb39c6146efb66b781f131f0fb399c"
 dependencies = [
  "once_cell",
  "wasm-bindgen",
@@ -727,15 +727,15 @@ checksum = "09edd9e8b54e49e587e4f6295a7d29c3ea94d469cb40ab8ca70b288248a81db2"
 
 [[package]]
 name = "libc"
-version = "0.2.180"
+version = "0.2.183"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bcc35a38544a891a5f7c865aca548a982ccb3b8650a5b06d0fd33a10283c56fc"
+checksum = "b5b646652bf6661599e1da8901b3b9522896f01e736bad5f723fe7a3a27f899d"
 
 [[package]]
 name = "linux-raw-sys"
-version = "0.11.0"
+version = "0.12.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "df1d3c3b53da64cf5760482273a98e575c651a67eec7f77df96b5b642de8f039"
+checksum = "32a66949e030da00e8c7d4434b251670a91556f4144941d37452769c25d58a53"
 
 [[package]]
 name = "litemap"
@@ -766,9 +766,9 @@ checksum = "a1dc47f592c06f33f8e3aea9591776ec7c9f9e4124778ff8a3c3b87159f7e593"
 
 [[package]]
 name = "memchr"
-version = "2.7.6"
+version = "2.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f52b00d39961fc5b2736ea853c9cc86238e165017a493d1d5c8eac6bdc4cc273"
+checksum = "f8ca58f447f06ed17d5fc4043ce1b10dd205e060fb3ce5b979b8ed8e59ff3f79"
 
 [[package]]
 name = "msvc_spectre_libs"
@@ -860,9 +860,9 @@ dependencies = [
 
 [[package]]
 name = "once_cell"
-version = "1.21.3"
+version = "1.21.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "42f5e15c9953c5e4ccceeb2e7382a716482c34515315f7b03532b8b4e8393d2d"
+checksum = "9f7c3e4beb33f85d45ae3e3a1792185706c8e16d043238c593331cc7cd313b50"
 
 [[package]]
 name = "once_cell_polyfill"
@@ -967,9 +967,9 @@ dependencies = [
 
 [[package]]
 name = "quote"
-version = "1.0.44"
+version = "1.0.45"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "21b2ebcf727b7760c461f091f9f0f539b77b8e87f2fd88131e7f1b433b3cece4"
+checksum = "41f2619966050689382d2b44f664f4bc593e129785a36d6ee376ddf37259b924"
 dependencies = [
  "proc-macro2",
 ]
@@ -1061,9 +1061,9 @@ dependencies = [
 
 [[package]]
 name = "regex-automata"
-version = "0.4.13"
+version = "0.4.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5276caf25ac86c8d810222b3dbb938e512c55c6831a10f3e6ed1c93b84041f1c"
+checksum = "6e1dd4122fc1595e8162618945476892eefca7b88c52820e74af6262213cae8f"
 dependencies = [
  "aho-corasick",
  "memchr",
@@ -1072,9 +1072,9 @@ dependencies = [
 
 [[package]]
 name = "regex-syntax"
-version = "0.8.8"
+version = "0.8.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7a2d987857b319362043e95f5353c0535c1f58eec5336fdfcf626430af7def58"
+checksum = "dc897dd8d9e8bd1ed8cdad82b5966c3e0ecae09fb1907d58efaa013543185d0a"
 
 [[package]]
 name = "regorus"
@@ -1086,6 +1086,7 @@ dependencies = [
  "dashmap",
  "data-encoding",
  "globset",
+ "hashbrown 0.16.1",
  "icu_casemap",
  "indexmap",
  "ipnet",
@@ -1137,9 +1138,9 @@ dependencies = [
 
 [[package]]
 name = "rustix"
-version = "1.1.3"
+version = "1.1.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "146c9e247ccc180c1f61615433868c99f3de3ae256a30a43b49f67c2d9171f34"
+checksum = "b6fe4565b9518b83ef4f91bb47ce29620ca828bd32cb7e408f0062e9930ba190"
 dependencies = [
  "bitflags",
  "errno",
@@ -1156,9 +1157,9 @@ checksum = "b39cdef0fa800fc44525c84ccb54a029961a8215f9619753635a9c0d2538d46d"
 
 [[package]]
 name = "ryu"
-version = "1.0.22"
+version = "1.0.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a50f4cf475b65d88e057964e0e9bb1f0aa9bbb2036dc65c64596b42932536984"
+checksum = "9774ba4a74de5f7b1c1451ed6cd5285a32eddb5cccb8cc655a4e50009e06477f"
 
 [[package]]
 name = "scopeguard"
@@ -1217,9 +1218,9 @@ dependencies = [
 
 [[package]]
 name = "serde_spanned"
-version = "1.0.4"
+version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f8bbf91e5a4d6315eee45e704372590b30e260ee83af6639d64557f51b067776"
+checksum = "876ac351060d4f882bb1032b6369eb0aef79ad9df1ea8bc404874d8cc3d0cd98"
 dependencies = [
  "serde_core",
 ]
@@ -1275,9 +1276,9 @@ checksum = "7da8b5736845d9f2fcb837ea5d9e2628564b3b043a70948a3f0b778838c5fb4f"
 
 [[package]]
 name = "syn"
-version = "2.0.114"
+version = "2.0.117"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d4d107df263a3013ef9b1879b0df87d706ff80f65a86ea879bd9c31f9b307c2a"
+checksum = "e665b8803e7b1d2a727f4023456bbbbe74da67099c585258af0ad9c5013b9b99"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -1297,12 +1298,12 @@ dependencies = [
 
 [[package]]
 name = "tempfile"
-version = "3.24.0"
+version = "3.27.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "655da9c7eb6305c55742045d5a8d2037996d61d8de95806335c7c86ce0f82e9c"
+checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd"
 dependencies = [
  "fastrand",
- "getrandom 0.3.4",
+ "getrandom 0.4.2",
  "once_cell",
  "rustix",
  "windows-sys",
@@ -1341,9 +1342,9 @@ dependencies = [
 
 [[package]]
 name = "toml"
-version = "0.9.11+spec-1.1.0"
+version = "0.9.12+spec-1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f3afc9a848309fe1aaffaed6e1546a7a14de1f935dc9d89d32afd9a44bab7c46"
+checksum = "cf92845e79fc2e2def6a5d828f0801e29a2f8acc037becc5ab08595c7d5e9863"
 dependencies = [
  "indexmap",
  "serde_core",
@@ -1351,7 +1352,7 @@ dependencies = [
  "toml_datetime",
  "toml_parser",
  "toml_writer",
- "winnow",
+ "winnow 0.7.15",
 ]
 
 [[package]]
@@ -1365,18 +1366,18 @@ dependencies = [
 
 [[package]]
 name = "toml_parser"
-version = "1.0.6+spec-1.1.0"
+version = "1.1.0+spec-1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a3198b4b0a8e11f09dd03e133c0280504d0801269e9afa46362ffde1cbeebf44"
+checksum = "2334f11ee363607eb04df9b8fc8a13ca1715a72ba8662a26ac285c98aabb4011"
 dependencies = [
- "winnow",
+ "winnow 1.0.0",
 ]
 
 [[package]]
 name = "toml_writer"
-version = "1.0.6+spec-1.1.0"
+version = "1.1.0+spec-1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ab16f14aed21ee8bfd8ec22513f7287cd4a91aa92e44edfe2c17ddd004e92607"
+checksum = "d282ade6016312faf3e41e57ebbba0c073e4056dab1232ab1cb624199648f8ed"
 
 [[package]]
 name = "unicode-general-category"
@@ -1386,9 +1387,9 @@ checksum = "0b993bddc193ae5bd0d623b49ec06ac3e9312875fdae725a975c51db1cc1677f"
 
 [[package]]
 name = "unicode-ident"
-version = "1.0.22"
+version = "1.0.24"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9312f7c4f6ff9069b165498234ce8be658059c6728633667c526e27dc2cf1df5"
+checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75"
 
 [[package]]
 name = "unicode-xid"
@@ -1428,9 +1429,9 @@ checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821"
 
 [[package]]
 name = "uuid"
-version = "1.22.0"
+version = "1.23.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a68d3c8f01c0cfa54a75291d83601161799e4a89a39e0929f4b0354d88757a37"
+checksum = "5ac8b6f42ead25368cf5b098aeb3dc8a1a2c05a3eee8a9a1a68c640edbfc79d9"
 dependencies = [
  "getrandom 0.4.2",
  "rand",
@@ -1478,9 +1479,9 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen"
-version = "0.2.108"
+version = "0.2.114"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "64024a30ec1e37399cf85a7ffefebdb72205ca1c972291c51512360d90bd8566"
+checksum = "6532f9a5c1ece3798cb1c2cfdba640b9b3ba884f5db45973a6f442510a87d38e"
 dependencies = [
  "cfg-if",
  "once_cell",
@@ -1491,9 +1492,9 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-macro"
-version = "0.2.108"
+version = "0.2.114"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "008b239d9c740232e71bd39e8ef6429d27097518b6b30bdf9086833bd5b6d608"
+checksum = "18a2d50fcf105fb33bb15f00e7a77b772945a2ee45dcf454961fd843e74c18e6"
 dependencies = [
  "quote",
  "wasm-bindgen-macro-support",
@@ -1501,9 +1502,9 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-macro-support"
-version = "0.2.108"
+version = "0.2.114"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5256bae2d58f54820e6490f9839c49780dff84c65aeab9e772f15d5f0e913a55"
+checksum = "03ce4caeaac547cdf713d280eda22a730824dd11e6b8c3ca9e42247b25c631e3"
 dependencies = [
  "bumpalo",
  "proc-macro2",
@@ -1514,9 +1515,9 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-shared"
-version = "0.2.108"
+version = "0.2.114"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1f01b580c9ac74c8d8f0c0e4afb04eeef2acf145458e52c03845ee9cd23e3d12"
+checksum = "75a326b8c223ee17883a4251907455a2431acc2791c98c26279376490c378c16"
 dependencies = [
  "unicode-ident",
 ]
@@ -1625,9 +1626,15 @@ dependencies = [
 
 [[package]]
 name = "winnow"
-version = "0.7.14"
+version = "0.7.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5a5364e9d77fcdeeaa6062ced926ee3381faa2ee02d3eb83a5c27a8825540829"
+checksum = "df79d97927682d2fd8adb29682d1140b343be4ac0f08fd68b7765d9c059d3945"
+
+[[package]]
+name = "winnow"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a90e88e4667264a994d34e6d1ab2d26d398dcdca8b7f52bec8668957517fc7d8"
 
 [[package]]
 name = "wit-bindgen"
@@ -1748,18 +1755,18 @@ dependencies = [
 
 [[package]]
 name = "zerocopy"
-version = "0.8.36"
+version = "0.8.47"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dafd85c832c1b68bbb4ec0c72c7f6f4fc5179627d2bc7c26b30e4c0cc11e76cc"
+checksum = "efbb2a062be311f2ba113ce66f697a4dc589f85e78a4aea276200804cea0ed87"
 dependencies = [
  "zerocopy-derive",
 ]
 
 [[package]]
 name = "zerocopy-derive"
-version = "0.8.36"
+version = "0.8.47"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7cb7e4e8436d9db52fbd6625dbf2f45243ab84994a72882ec8227b99e72b439a"
+checksum = "0e8bc7269b54418e7aeeef514aa68f8690b8c0489a06b0136e5f57c4c5ccab89"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -1823,6 +1830,6 @@ dependencies = [
 
 [[package]]
 name = "zmij"
-version = "1.0.17"
+version = "1.0.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "02aae0f83f69aafc94776e879363e9771d7ecbffe2c7fbb6c14c5e00dfe88439"
+checksum = "b8848ee67ecc8aedbaf3e4122217aff892639231befc6a1b58d29fff4c2cabaa"

bindings/ffi/src/alias_registry.rs

@@ -0,0 +1,479 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+
+//! FFI bindings for `AliasRegistry` – Azure Policy alias catalog management.
+
+#![cfg(feature = "azure_policy")]
+
+use crate::common::{from_c_str, to_ref, RegorusResult, RegorusStatus};
+use crate::panic_guard::with_unwind_guard;
+
+use alloc::boxed::Box;
+use alloc::format;
+use alloc::string::String;
+use anyhow::Result;
+use core::ffi::c_char;
+use core::ptr;
+
+use regorus::languages::azure_policy::aliases::AliasRegistry;
+
+/// Opaque wrapper for `AliasRegistry`.
+pub struct RegorusAliasRegistry {
+    registry: AliasRegistry,
+}
+
+// ---------------------------------------------------------------------------
+// Lifecycle
+// ---------------------------------------------------------------------------
+
+/// Create a new, empty `AliasRegistry`.
+///
+/// The caller must eventually call `regorus_alias_registry_drop` to free the handle.
+#[no_mangle]
+pub extern "C" fn regorus_alias_registry_new() -> *mut RegorusAliasRegistry {
+    let wrapper = RegorusAliasRegistry {
+        registry: AliasRegistry::new(),
+    };
+    Box::into_raw(Box::new(wrapper))
+}
+
+/// Drop a `RegorusAliasRegistry`.
+#[no_mangle]
+pub extern "C" fn regorus_alias_registry_drop(registry: *mut RegorusAliasRegistry) {
+    if let Ok(r) = to_ref(registry) {
+        unsafe {
+            let _ = Box::from_raw(ptr::from_mut(r));
+        }
+    }
+}
+
+// ---------------------------------------------------------------------------
+// Loading
+// ---------------------------------------------------------------------------
+
+/// Load control-plane alias data (array of `ProviderAliases`) into the registry.
+///
+/// `json` must be a valid null-terminated UTF-8 string containing the JSON
+/// array returned by `Get-AzPolicyAlias` or the static
+/// `ResourceTypesAndAliases.json` file.
+#[no_mangle]
+pub extern "C" fn regorus_alias_registry_load_json(
+    registry: *mut RegorusAliasRegistry,
+    json: *const c_char,
+) -> RegorusResult {
+    with_unwind_guard(|| {
+        let output = || -> Result<()> {
+            let json_str = from_c_str(json)?;
+            to_ref(registry)?.registry.load_from_json(&json_str)?;
+            Ok(())
+        }();
+
+        match output {
+            Ok(()) => RegorusResult::ok_void(),
+            Err(e) => RegorusResult::err_with_message(
+                RegorusStatus::InvalidDataFormat,
+                format!("Failed to load alias catalog: {e}"),
+            ),
+        }
+    })
+}
+
+/// Load a data-plane policy manifest into the registry.
+///
+/// `json` must be a valid null-terminated UTF-8 string containing a single
+/// `DataPolicyManifest` JSON object.
+#[no_mangle]
+pub extern "C" fn regorus_alias_registry_load_manifest(
+    registry: *mut RegorusAliasRegistry,
+    json: *const c_char,
+) -> RegorusResult {
+    with_unwind_guard(|| {
+        let output = || -> Result<()> {
+            let json_str = from_c_str(json)?;
+            to_ref(registry)?
+                .registry
+                .load_data_policy_manifest_json(&json_str)?;
+            Ok(())
+        }();
+
+        match output {
+            Ok(()) => RegorusResult::ok_void(),
+            Err(e) => RegorusResult::err_with_message(
+                RegorusStatus::InvalidDataFormat,
+                format!("Failed to load data-plane manifest: {e}"),
+            ),
+        }
+    })
+}
+
+// ---------------------------------------------------------------------------
+// Queries
+// ---------------------------------------------------------------------------
+
+/// Return the number of resource types loaded in the alias registry.
+#[no_mangle]
+pub extern "C" fn regorus_alias_registry_len(registry: *mut RegorusAliasRegistry) -> RegorusResult {
+    with_unwind_guard(|| {
+        let output = || -> Result<i64> {
+            let len = to_ref(registry)?.registry.len();
+            Ok(len as i64)
+        }();
+
+        match output {
+            Ok(n) => RegorusResult::ok_int(n),
+            Err(e) => RegorusResult::err_with_message(RegorusStatus::Error, format!("{e}")),
+        }
+    })
+}
+
+// ---------------------------------------------------------------------------
+// Normalize / Denormalize
+// ---------------------------------------------------------------------------
+
+/// Normalize an ARM resource JSON and wrap it into the standard input envelope.
+///
+/// Returns a JSON string:
+/// `{ "resource": <normalized>, "context": <context>, "parameters": <params> }`.
+///
+/// * `resource_json` – raw ARM resource JSON
+/// * `api_version` – API version string (e.g. `"2023-01-01"`), or null to use
+///   the default alias paths
+/// * `context_json` – JSON object for additional context (pass `"{}"` if none)
+/// * `parameters_json` – JSON object of policy parameter values (pass `"{}"` if none)
+#[no_mangle]
+pub extern "C" fn regorus_alias_registry_normalize_and_wrap(
+    registry: *mut RegorusAliasRegistry,
+    resource_json: *const c_char,
+    api_version: *const c_char,
+    context_json: *const c_char,
+    parameters_json: *const c_char,
+) -> RegorusResult {
+    with_unwind_guard(|| {
+        let output = || -> Result<String> {
+            let resource_str = from_c_str(resource_json)?;
+            let api_ver = if api_version.is_null() {
+                None
+            } else {
+                let s = from_c_str(api_version)?;
+                if s.is_empty() {
+                    None
+                } else {
+                    Some(s)
+                }
+            };
+            let context_str = from_c_str(context_json)?;
+            let params_str = from_c_str(parameters_json)?;
+
+            let resource = regorus::Value::from_json_str(&resource_str)?;
+            let context = regorus::Value::from_json_str(&context_str)?;
+            let params = regorus::Value::from_json_str(&params_str)?;
+
+            let wrapped = to_ref(registry)?.registry.normalize_and_wrap(
+                &resource,
+                api_ver.as_deref(),
+                Some(context),
+                Some(params),
+            );
+            wrapped.to_json_str()
+        }();
+
+        match output {
+            Ok(s) => RegorusResult::ok_string(s),
+            Err(e) => RegorusResult::err_with_message(RegorusStatus::Error, format!("{e}")),
+        }
+    })
+}
+
+/// Denormalize a previously-normalized resource JSON back to ARM format.
+///
+/// * `normalized_json` – the normalized resource JSON
+/// * `api_version` – API version string, or null to use the default alias paths
+///
+/// Returns the denormalized ARM JSON string.
+#[no_mangle]
+pub extern "C" fn regorus_alias_registry_denormalize(
+    registry: *mut RegorusAliasRegistry,
+    normalized_json: *const c_char,
+    api_version: *const c_char,
+) -> RegorusResult {
+    with_unwind_guard(|| {
+        let output = || -> Result<String> {
+            let normalized_str = from_c_str(normalized_json)?;
+            let api_ver = if api_version.is_null() {
+                None
+            } else {
+                let s = from_c_str(api_version)?;
+                if s.is_empty() {
+                    None
+                } else {
+                    Some(s)
+                }
+            };
+
+            let normalized = regorus::Value::from_json_str(&normalized_str)?;
+
+            let result = to_ref(registry)?
+                .registry
+                .denormalize(&normalized, api_ver.as_deref());
+            result.to_json_str()
+        }();
+
+        match output {
+            Ok(s) => RegorusResult::ok_string(s),
+            Err(e) => RegorusResult::err_with_message(RegorusStatus::Error, format!("{e}")),
+        }
+    })
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::common::regorus_result_drop;
+    use core::ffi::CStr;
+    use std::ffi::CString;
+
+    /// Helper: create a C string from a Rust &str.
+    fn c(s: &str) -> CString {
+        CString::new(s).expect("CString::new failed")
+    }
+
+    /// Helper: assert a RegorusResult has Ok status and extract string output.
+    fn assert_ok_string(r: &RegorusResult) -> String {
+        assert_eq!(r.status, RegorusStatus::Ok, "expected Ok status");
+        assert!(!r.output.is_null(), "expected non-null output");
+        let s = unsafe { CStr::from_ptr(r.output) }
+            .to_str()
+            .expect("invalid UTF-8 in output")
+            .to_string();
+        s
+    }
+
+    /// Helper: assert a RegorusResult has Ok status with integer output.
+    fn assert_ok_int(r: &RegorusResult) -> i64 {
+        assert_eq!(r.status, RegorusStatus::Ok, "expected Ok status");
+        r.int_value
+    }
+
+    const ALIASES: &str = r#"[{
+        "namespace": "Microsoft.Storage",
+        "resourceTypes": [{
+            "resourceType": "storageAccounts",
+            "aliases": [{
+                "name": "Microsoft.Storage/storageAccounts/supportsHttpsTrafficOnly",
+                "defaultPath": "properties.supportsHttpsTrafficOnly",
+                "paths": []
+            }]
+        }]
+    }]"#;
+
+    const MANIFEST: &str = r#"{
+        "dataNamespace": "Microsoft.KeyVault.Data",
+        "aliases": [],
+        "resourceTypeAliases": [{
+            "resourceType": "vaults/certificates",
+            "aliases": [{
+                "name": "Microsoft.KeyVault.Data/vaults/certificates/keySize",
+                "paths": [{ "path": "keySize", "apiVersions": ["7.0"] }]
+            }]
+        }]
+    }"#;
+
+    #[test]
+    fn lifecycle_new_and_drop() {
+        let reg = regorus_alias_registry_new();
+        assert!(!reg.is_null());
+        regorus_alias_registry_drop(reg);
+    }
+
+    #[test]
+    fn load_json_and_check_len() {
+        let reg = regorus_alias_registry_new();
+        let json = c(ALIASES);
+
+        let r = regorus_alias_registry_load_json(reg, json.as_ptr());
+        assert_eq!(r.status, RegorusStatus::Ok);
+        regorus_result_drop(r);
+
+        let r = regorus_alias_registry_len(reg);
+        assert_eq!(assert_ok_int(&r), 1);
+        regorus_result_drop(r);
+
+        regorus_alias_registry_drop(reg);
+    }
+
+    #[test]
+    fn load_manifest_and_check_len() {
+        let reg = regorus_alias_registry_new();
+        let json = c(MANIFEST);
+
+        let r = regorus_alias_registry_load_manifest(reg, json.as_ptr());
+        assert_eq!(r.status, RegorusStatus::Ok);
+        regorus_result_drop(r);
+
+        let r = regorus_alias_registry_len(reg);
+        assert_eq!(assert_ok_int(&r), 1);
+        regorus_result_drop(r);
+
+        regorus_alias_registry_drop(reg);
+    }
+
+    #[test]
+    fn load_invalid_json_returns_error() {
+        let reg = regorus_alias_registry_new();
+        let bad = c("not valid json");
+
+        let r = regorus_alias_registry_load_json(reg, bad.as_ptr());
+        assert_ne!(r.status, RegorusStatus::Ok);
+        regorus_result_drop(r);
+
+        regorus_alias_registry_drop(reg);
+    }
+
+    #[test]
+    fn normalize_and_wrap_round_trip() {
+        let reg = regorus_alias_registry_new();
+        let aliases = c(ALIASES);
+        let r = regorus_alias_registry_load_json(reg, aliases.as_ptr());
+        assert_eq!(r.status, RegorusStatus::Ok);
+        regorus_result_drop(r);
+
+        let resource = c(r#"{
+            "name": "acct1",
+            "type": "Microsoft.Storage/storageAccounts",
+            "properties": { "supportsHttpsTrafficOnly": true }
+        }"#);
+        let api = c("2023-01-01");
+        let ctx = c(r#"{"resourceGroup": {"name": "rg1"}}"#);
+        let params = c(r#"{"env": "prod"}"#);
+
+        // Normalize
+        let r = regorus_alias_registry_normalize_and_wrap(
+            reg,
+            resource.as_ptr(),
+            api.as_ptr(),
+            ctx.as_ptr(),
+            params.as_ptr(),
+        );
+        let envelope_json = assert_ok_string(&r);
+        regorus_result_drop(r);
+
+        // Parse and verify structure
+        let envelope: serde_json::Value =
+            serde_json::from_str(&envelope_json).expect("invalid JSON output");
+        assert!(
+            envelope.get("resource").is_some(),
+            "envelope missing 'resource'"
+        );
+        assert!(
+            envelope.get("parameters").is_some(),
+            "envelope missing 'parameters'"
+        );
+        assert!(
+            envelope.get("context").is_some(),
+            "envelope missing 'context'"
+        );
+
+        // The normalized resource should have lowercased alias fields
+        let res = &envelope["resource"];
+        assert_eq!(res["supportshttpstrafficonly"], true);
+        assert_eq!(res["name"], "acct1");
+
+        // Context and parameters should be passed through
+        assert_eq!(envelope["context"]["resourceGroup"]["name"], "rg1");
+        assert_eq!(envelope["parameters"]["env"], "prod");
+
+        // Denormalize the resource portion
+        let resource_json = serde_json::to_string(&res).expect("serialize resource");
+        let norm_cstr = c(&resource_json);
+
+        let r = regorus_alias_registry_denormalize(reg, norm_cstr.as_ptr(), api.as_ptr());
+        let denorm_json = assert_ok_string(&r);
+        regorus_result_drop(r);
+
+        let denorm: serde_json::Value =
+            serde_json::from_str(&denorm_json).expect("invalid denorm JSON");
+        // Should be back under properties with restored casing
+        assert_eq!(
+            denorm["properties"]["supportsHttpsTrafficOnly"], true,
+            "expected restored casing under properties"
+        );
+
+        regorus_alias_registry_drop(reg);
+    }
+
+    #[test]
+    fn denormalize_invalid_json_returns_error() {
+        let reg = regorus_alias_registry_new();
+        let aliases = c(ALIASES);
+        let r = regorus_alias_registry_load_json(reg, aliases.as_ptr());
+        assert_eq!(r.status, RegorusStatus::Ok);
+        regorus_result_drop(r);
+
+        let bad = c("not json");
+        let api = c("2023-01-01");
+        let r = regorus_alias_registry_denormalize(reg, bad.as_ptr(), api.as_ptr());
+        assert_ne!(r.status, RegorusStatus::Ok);
+        regorus_result_drop(r);
+
+        regorus_alias_registry_drop(reg);
+    }
+
+    #[test]
+    fn normalize_data_plane_manifest() {
+        let reg = regorus_alias_registry_new();
+        let manifest = c(MANIFEST);
+        let r = regorus_alias_registry_load_manifest(reg, manifest.as_ptr());
+        assert_eq!(r.status, RegorusStatus::Ok);
+        regorus_result_drop(r);
+
+        let resource = c(r#"{
+            "type": "Microsoft.KeyVault.Data/vaults/certificates",
+            "keySize": 2048
+        }"#);
+        let api = c("7.0");
+        let ctx = c("{}");
+        let params = c("{}");
+
+        let r = regorus_alias_registry_normalize_and_wrap(
+            reg,
+            resource.as_ptr(),
+            api.as_ptr(),
+            ctx.as_ptr(),
+            params.as_ptr(),
+        );
+        let envelope_json = assert_ok_string(&r);
+        regorus_result_drop(r);
+
+        let envelope: serde_json::Value =
+            serde_json::from_str(&envelope_json).expect("invalid JSON output");
+        assert_eq!(envelope["resource"]["keysize"], 2048);
+
+        regorus_alias_registry_drop(reg);
+    }
+
+    #[test]
+    fn empty_registry_normalize() {
+        let reg = regorus_alias_registry_new();
+        let resource = c(r#"{"name": "test", "type": "Unknown/type", "properties": {"foo": 1}}"#);
+        let api = c("");
+        let ctx = c("{}");
+        let params = c("{}");
+
+        let r = regorus_alias_registry_normalize_and_wrap(
+            reg,
+            resource.as_ptr(),
+            api.as_ptr(),
+            ctx.as_ptr(),
+            params.as_ptr(),
+        );
+        let json = assert_ok_string(&r);
+        regorus_result_drop(r);
+
+        let envelope: serde_json::Value = serde_json::from_str(&json).expect("invalid JSON");
+        // Without aliases, properties should still be flattened
+        assert_eq!(envelope["resource"]["foo"], 1);
+        assert_eq!(envelope["resource"]["name"], "test");
+
+        regorus_alias_registry_drop(reg);
+    }
+}

bindings/ffi/src/common.rs

@@ -11,6 +11,7 @@ use core::ffi::{c_char, c_longlong, c_void, CStr};
 use core::{mem, ptr};
 
 /// Status of a call on `RegorusEngine`.
+#[derive(Debug, PartialEq)]
 #[repr(C)]
 pub enum RegorusStatus {
     /// The operation was successful.

bindings/ffi/src/lib.rs

@@ -5,6 +5,7 @@
 
 extern crate alloc;
 
+mod alias_registry;
 mod allocator;
 mod common;
 mod compile;

bindings/java/Cargo.lock

@@ -69,9 +69,9 @@ checksum = "5e764a1d40d510daf35e07be9eb06e75770908c27d411ee6c92109c9840eaaf7"
 
 [[package]]
 name = "bitflags"
-version = "2.10.0"
+version = "2.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "812e12b5285cc515a9c72a5c1d3b6d46a19dac5acfef5265968c166106e31dd3"
+checksum = "843867be96c8daad0d758b57df9392b6d8d271134fce549de6ce169ff98a92af"
 
 [[package]]
 name = "borrow-or-share"
@@ -91,9 +91,9 @@ dependencies = [
 
 [[package]]
 name = "bumpalo"
-version = "3.19.1"
+version = "3.20.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5dd9dc738b7a8311c7ade152424974d8115f2cdad61e8dab8dac9f2362298510"
+checksum = "5d20789868f4b01b2f2caec9f5c4e0213b41e3e5702a50157d699ae31ced2fcb"
 
 [[package]]
 name = "bytecount"
@@ -109,9 +109,9 @@ checksum = "1e748733b7cbc798e1434b6ac524f0c1ff2ab456fe201501e6497c8417a4fc33"
 
 [[package]]
 name = "cc"
-version = "1.2.55"
+version = "1.2.58"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "47b26a0954ae34af09b50f0de26458fa95369a0d478d8236d3f93082b219bd29"
+checksum = "e1e928d4b69e3077709075a938a05ffbedfa53a84c8f766efbf8220bb1ff60e1"
 dependencies = [
  "find-msvc-tools",
  "shlex",
@@ -512,9 +512,9 @@ checksum = "d98f6fed1fde3f8c21bc40a1abb88dd75e67924f9cffc3ef95607bad8017f8e2"
 
 [[package]]
 name = "itoa"
-version = "1.0.17"
+version = "1.0.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "92ecc6618181def0457392ccd0ee51198e065e016d1d527a7ac1b6dc7c1f09d2"
+checksum = "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682"
 
 [[package]]
 name = "jni"
@@ -567,9 +567,9 @@ dependencies = [
 
 [[package]]
 name = "js-sys"
-version = "0.3.85"
+version = "0.3.91"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8c942ebf8e95485ca0d52d97da7c5a2c387d0e7f0ba4c35e93bfcaee045955b3"
+checksum = "b49715b7073f385ba4bc528e5747d02e66cb39c6146efb66b781f131f0fb399c"
 dependencies = [
  "once_cell",
  "wasm-bindgen",
@@ -616,9 +616,9 @@ checksum = "09edd9e8b54e49e587e4f6295a7d29c3ea94d469cb40ab8ca70b288248a81db2"
 
 [[package]]
 name = "libc"
-version = "0.2.180"
+version = "0.2.183"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bcc35a38544a891a5f7c865aca548a982ccb3b8650a5b06d0fd33a10283c56fc"
+checksum = "b5b646652bf6661599e1da8901b3b9522896f01e736bad5f723fe7a3a27f899d"
 
 [[package]]
 name = "litemap"
@@ -649,9 +649,9 @@ checksum = "a1dc47f592c06f33f8e3aea9591776ec7c9f9e4124778ff8a3c3b87159f7e593"
 
 [[package]]
 name = "memchr"
-version = "2.7.6"
+version = "2.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f52b00d39961fc5b2736ea853c9cc86238e165017a493d1d5c8eac6bdc4cc273"
+checksum = "f8ca58f447f06ed17d5fc4043ce1b10dd205e060fb3ce5b979b8ed8e59ff3f79"
 
 [[package]]
 name = "msvc_spectre_libs"
@@ -743,9 +743,9 @@ dependencies = [
 
 [[package]]
 name = "once_cell"
-version = "1.21.3"
+version = "1.21.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "42f5e15c9953c5e4ccceeb2e7382a716482c34515315f7b03532b8b4e8393d2d"
+checksum = "9f7c3e4beb33f85d45ae3e3a1792185706c8e16d043238c593331cc7cd313b50"
 
 [[package]]
 name = "outref"
@@ -842,9 +842,9 @@ dependencies = [
 
 [[package]]
 name = "quote"
-version = "1.0.44"
+version = "1.0.45"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "21b2ebcf727b7760c461f091f9f0f539b77b8e87f2fd88131e7f1b433b3cece4"
+checksum = "41f2619966050689382d2b44f664f4bc593e129785a36d6ee376ddf37259b924"
 dependencies = [
  "proc-macro2",
 ]
@@ -936,9 +936,9 @@ dependencies = [
 
 [[package]]
 name = "regex-automata"
-version = "0.4.13"
+version = "0.4.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5276caf25ac86c8d810222b3dbb938e512c55c6831a10f3e6ed1c93b84041f1c"
+checksum = "6e1dd4122fc1595e8162618945476892eefca7b88c52820e74af6262213cae8f"
 dependencies = [
  "aho-corasick",
  "memchr",
@@ -947,9 +947,9 @@ dependencies = [
 
 [[package]]
 name = "regex-syntax"
-version = "0.8.8"
+version = "0.8.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7a2d987857b319362043e95f5353c0535c1f58eec5336fdfcf626430af7def58"
+checksum = "dc897dd8d9e8bd1ed8cdad82b5966c3e0ecae09fb1907d58efaa013543185d0a"
 
 [[package]]
 name = "regorus"
@@ -1024,9 +1024,9 @@ checksum = "b39cdef0fa800fc44525c84ccb54a029961a8215f9619753635a9c0d2538d46d"
 
 [[package]]
 name = "ryu"
-version = "1.0.22"
+version = "1.0.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a50f4cf475b65d88e057964e0e9bb1f0aa9bbb2036dc65c64596b42932536984"
+checksum = "9774ba4a74de5f7b1c1451ed6cd5285a32eddb5cccb8cc655a4e50009e06477f"
 
 [[package]]
 name = "same-file"
@@ -1153,9 +1153,9 @@ checksum = "6ce2be8dc25455e1f91df71bfa12ad37d7af1092ae736f3a6cd0e37bc7810596"
 
 [[package]]
 name = "syn"
-version = "2.0.114"
+version = "2.0.117"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d4d107df263a3013ef9b1879b0df87d706ff80f65a86ea879bd9c31f9b307c2a"
+checksum = "e665b8803e7b1d2a727f4023456bbbbe74da67099c585258af0ad9c5013b9b99"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -1211,9 +1211,9 @@ checksum = "0b993bddc193ae5bd0d623b49ec06ac3e9312875fdae725a975c51db1cc1677f"
 
 [[package]]
 name = "unicode-ident"
-version = "1.0.22"
+version = "1.0.24"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9312f7c4f6ff9069b165498234ce8be658059c6728633667c526e27dc2cf1df5"
+checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75"
 
 [[package]]
 name = "unicode-xid"
@@ -1247,9 +1247,9 @@ checksum = "b6c140620e7ffbb22c2dee59cafe6084a59b5ffc27a8859a5f0d494b5d52b6be"
 
 [[package]]
 name = "uuid"
-version = "1.22.0"
+version = "1.23.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a68d3c8f01c0cfa54a75291d83601161799e4a89a39e0929f4b0354d88757a37"
+checksum = "5ac8b6f42ead25368cf5b098aeb3dc8a1a2c05a3eee8a9a1a68c640edbfc79d9"
 dependencies = [
  "getrandom 0.4.2",
  "rand",
@@ -1307,9 +1307,9 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen"
-version = "0.2.108"
+version = "0.2.114"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "64024a30ec1e37399cf85a7ffefebdb72205ca1c972291c51512360d90bd8566"
+checksum = "6532f9a5c1ece3798cb1c2cfdba640b9b3ba884f5db45973a6f442510a87d38e"
 dependencies = [
  "cfg-if",
  "once_cell",
@@ -1320,9 +1320,9 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-macro"
-version = "0.2.108"
+version = "0.2.114"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "008b239d9c740232e71bd39e8ef6429d27097518b6b30bdf9086833bd5b6d608"
+checksum = "18a2d50fcf105fb33bb15f00e7a77b772945a2ee45dcf454961fd843e74c18e6"
 dependencies = [
  "quote",
  "wasm-bindgen-macro-support",
@@ -1330,9 +1330,9 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-macro-support"
-version = "0.2.108"
+version = "0.2.114"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5256bae2d58f54820e6490f9839c49780dff84c65aeab9e772f15d5f0e913a55"
+checksum = "03ce4caeaac547cdf713d280eda22a730824dd11e6b8c3ca9e42247b25c631e3"
 dependencies = [
  "bumpalo",
  "proc-macro2",
@@ -1343,9 +1343,9 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-shared"
-version = "0.2.108"
+version = "0.2.114"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1f01b580c9ac74c8d8f0c0e4afb04eeef2acf145458e52c03845ee9cd23e3d12"
+checksum = "75a326b8c223ee17883a4251907455a2431acc2791c98c26279376490c378c16"
 dependencies = [
  "unicode-ident",
 ]
@@ -1580,18 +1580,18 @@ dependencies = [
 
 [[package]]
 name = "zerocopy"
-version = "0.8.36"
+version = "0.8.47"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dafd85c832c1b68bbb4ec0c72c7f6f4fc5179627d2bc7c26b30e4c0cc11e76cc"
+checksum = "efbb2a062be311f2ba113ce66f697a4dc589f85e78a4aea276200804cea0ed87"
 dependencies = [
  "zerocopy-derive",
 ]
 
 [[package]]
 name = "zerocopy-derive"
-version = "0.8.36"
+version = "0.8.47"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7cb7e4e8436d9db52fbd6625dbf2f45243ab84994a72882ec8227b99e72b439a"
+checksum = "0e8bc7269b54418e7aeeef514aa68f8690b8c0489a06b0136e5f57c4c5ccab89"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -1654,6 +1654,6 @@ dependencies = [
 
 [[package]]
 name = "zmij"
-version = "1.0.17"
+version = "1.0.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "02aae0f83f69aafc94776e879363e9771d7ecbffe2c7fbb6c14c5e00dfe88439"
+checksum = "b8848ee67ecc8aedbaf3e4122217aff892639231befc6a1b58d29fff4c2cabaa"

bindings/python/Cargo.lock

@@ -69,9 +69,9 @@ checksum = "5e764a1d40d510daf35e07be9eb06e75770908c27d411ee6c92109c9840eaaf7"
 
 [[package]]
 name = "bitflags"
-version = "2.10.0"
+version = "2.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "812e12b5285cc515a9c72a5c1d3b6d46a19dac5acfef5265968c166106e31dd3"
+checksum = "843867be96c8daad0d758b57df9392b6d8d271134fce549de6ce169ff98a92af"
 
 [[package]]
 name = "borrow-or-share"
@@ -91,9 +91,9 @@ dependencies = [
 
 [[package]]
 name = "bumpalo"
-version = "3.19.1"
+version = "3.20.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5dd9dc738b7a8311c7ade152424974d8115f2cdad61e8dab8dac9f2362298510"
+checksum = "5d20789868f4b01b2f2caec9f5c4e0213b41e3e5702a50157d699ae31ced2fcb"
 
 [[package]]
 name = "bytecount"
@@ -103,9 +103,9 @@ checksum = "175812e0be2bccb6abe50bb8d566126198344f707e304f45c648fd8f2cc0365e"
 
 [[package]]
 name = "cc"
-version = "1.2.55"
+version = "1.2.58"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "47b26a0954ae34af09b50f0de26458fa95369a0d478d8236d3f93082b219bd29"
+checksum = "e1e928d4b69e3077709075a938a05ffbedfa53a84c8f766efbf8220bb1ff60e1"
 dependencies = [
  "find-msvc-tools",
  "shlex",
@@ -496,15 +496,15 @@ checksum = "d98f6fed1fde3f8c21bc40a1abb88dd75e67924f9cffc3ef95607bad8017f8e2"
 
 [[package]]
 name = "itoa"
-version = "1.0.17"
+version = "1.0.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "92ecc6618181def0457392ccd0ee51198e065e016d1d527a7ac1b6dc7c1f09d2"
+checksum = "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682"
 
 [[package]]
 name = "js-sys"
-version = "0.3.85"
+version = "0.3.91"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8c942ebf8e95485ca0d52d97da7c5a2c387d0e7f0ba4c35e93bfcaee045955b3"
+checksum = "b49715b7073f385ba4bc528e5747d02e66cb39c6146efb66b781f131f0fb399c"
 dependencies = [
  "once_cell",
  "wasm-bindgen",
@@ -551,9 +551,9 @@ checksum = "09edd9e8b54e49e587e4f6295a7d29c3ea94d469cb40ab8ca70b288248a81db2"
 
 [[package]]
 name = "libc"
-version = "0.2.180"
+version = "0.2.183"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bcc35a38544a891a5f7c865aca548a982ccb3b8650a5b06d0fd33a10283c56fc"
+checksum = "b5b646652bf6661599e1da8901b3b9522896f01e736bad5f723fe7a3a27f899d"
 
 [[package]]
 name = "litemap"
@@ -584,9 +584,9 @@ checksum = "a1dc47f592c06f33f8e3aea9591776ec7c9f9e4124778ff8a3c3b87159f7e593"
 
 [[package]]
 name = "memchr"
-version = "2.7.6"
+version = "2.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f52b00d39961fc5b2736ea853c9cc86238e165017a493d1d5c8eac6bdc4cc273"
+checksum = "f8ca58f447f06ed17d5fc4043ce1b10dd205e060fb3ce5b979b8ed8e59ff3f79"
 
 [[package]]
 name = "msvc_spectre_libs"
@@ -678,9 +678,9 @@ dependencies = [
 
 [[package]]
 name = "once_cell"
-version = "1.21.3"
+version = "1.21.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "42f5e15c9953c5e4ccceeb2e7382a716482c34515315f7b03532b8b4e8393d2d"
+checksum = "9f7c3e4beb33f85d45ae3e3a1792185706c8e16d043238c593331cc7cd313b50"
 
 [[package]]
 name = "ordered-float"
@@ -746,9 +746,9 @@ dependencies = [
 
 [[package]]
 name = "portable-atomic"
-version = "1.13.0"
+version = "1.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f89776e4d69bb58bc6993e99ffa1d11f228b839984854c7daeb5d37f87cbe950"
+checksum = "c33a9471896f1c69cecef8d20cbe2f7accd12527ce60845ff44c153bb2a21b49"
 
 [[package]]
 name = "postcard"
@@ -851,9 +851,9 @@ dependencies = [
 
 [[package]]
 name = "quote"
-version = "1.0.44"
+version = "1.0.45"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "21b2ebcf727b7760c461f091f9f0f539b77b8e87f2fd88131e7f1b433b3cece4"
+checksum = "41f2619966050689382d2b44f664f4bc593e129785a36d6ee376ddf37259b924"
 dependencies = [
  "proc-macro2",
 ]
@@ -945,9 +945,9 @@ dependencies = [
 
 [[package]]
 name = "regex-automata"
-version = "0.4.13"
+version = "0.4.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5276caf25ac86c8d810222b3dbb938e512c55c6831a10f3e6ed1c93b84041f1c"
+checksum = "6e1dd4122fc1595e8162618945476892eefca7b88c52820e74af6262213cae8f"
 dependencies = [
  "aho-corasick",
  "memchr",
@@ -956,9 +956,9 @@ dependencies = [
 
 [[package]]
 name = "regex-syntax"
-version = "0.8.8"
+version = "0.8.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7a2d987857b319362043e95f5353c0535c1f58eec5336fdfcf626430af7def58"
+checksum = "dc897dd8d9e8bd1ed8cdad82b5966c3e0ecae09fb1907d58efaa013543185d0a"
 
 [[package]]
 name = "regorus"
@@ -1025,9 +1025,9 @@ checksum = "b39cdef0fa800fc44525c84ccb54a029961a8215f9619753635a9c0d2538d46d"
 
 [[package]]
 name = "ryu"
-version = "1.0.22"
+version = "1.0.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a50f4cf475b65d88e057964e0e9bb1f0aa9bbb2036dc65c64596b42932536984"
+checksum = "9774ba4a74de5f7b1c1451ed6cd5285a32eddb5cccb8cc655a4e50009e06477f"
 
 [[package]]
 name = "scopeguard"
@@ -1129,9 +1129,9 @@ checksum = "6ce2be8dc25455e1f91df71bfa12ad37d7af1092ae736f3a6cd0e37bc7810596"
 
 [[package]]
 name = "syn"
-version = "2.0.114"
+version = "2.0.117"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d4d107df263a3013ef9b1879b0df87d706ff80f65a86ea879bd9c31f9b307c2a"
+checksum = "e665b8803e7b1d2a727f4023456bbbbe74da67099c585258af0ad9c5013b9b99"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -1151,9 +1151,9 @@ dependencies = [
 
 [[package]]
 name = "target-lexicon"
-version = "0.13.4"
+version = "0.13.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b1dd07eb858a2067e2f3c7155d54e929265c264e6f37efe3ee7a8d1b5a1dd0ba"
+checksum = "adb6935a6f5c20170eeceb1a3835a49e12e19d792f6dd344ccc76a985ca5a6ca"
 
 [[package]]
 name = "thiserror"
@@ -1193,9 +1193,9 @@ checksum = "0b993bddc193ae5bd0d623b49ec06ac3e9312875fdae725a975c51db1cc1677f"
 
 [[package]]
 name = "unicode-ident"
-version = "1.0.22"
+version = "1.0.24"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9312f7c4f6ff9069b165498234ce8be658059c6728633667c526e27dc2cf1df5"
+checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75"
 
 [[package]]
 name = "unicode-xid"
@@ -1229,9 +1229,9 @@ checksum = "b6c140620e7ffbb22c2dee59cafe6084a59b5ffc27a8859a5f0d494b5d52b6be"
 
 [[package]]
 name = "uuid"
-version = "1.22.0"
+version = "1.23.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a68d3c8f01c0cfa54a75291d83601161799e4a89a39e0929f4b0354d88757a37"
+checksum = "5ac8b6f42ead25368cf5b098aeb3dc8a1a2c05a3eee8a9a1a68c640edbfc79d9"
 dependencies = [
  "getrandom 0.4.2",
  "rand",
@@ -1279,9 +1279,9 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen"
-version = "0.2.108"
+version = "0.2.114"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "64024a30ec1e37399cf85a7ffefebdb72205ca1c972291c51512360d90bd8566"
+checksum = "6532f9a5c1ece3798cb1c2cfdba640b9b3ba884f5db45973a6f442510a87d38e"
 dependencies = [
  "cfg-if",
  "once_cell",
@@ -1292,9 +1292,9 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-macro"
-version = "0.2.108"
+version = "0.2.114"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "008b239d9c740232e71bd39e8ef6429d27097518b6b30bdf9086833bd5b6d608"
+checksum = "18a2d50fcf105fb33bb15f00e7a77b772945a2ee45dcf454961fd843e74c18e6"
 dependencies = [
  "quote",
  "wasm-bindgen-macro-support",
@@ -1302,9 +1302,9 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-macro-support"
-version = "0.2.108"
+version = "0.2.114"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5256bae2d58f54820e6490f9839c49780dff84c65aeab9e772f15d5f0e913a55"
+checksum = "03ce4caeaac547cdf713d280eda22a730824dd11e6b8c3ca9e42247b25c631e3"
 dependencies = [
  "bumpalo",
  "proc-macro2",
@@ -1315,9 +1315,9 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-shared"
-version = "0.2.108"
+version = "0.2.114"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1f01b580c9ac74c8d8f0c0e4afb04eeef2acf145458e52c03845ee9cd23e3d12"
+checksum = "75a326b8c223ee17883a4251907455a2431acc2791c98c26279376490c378c16"
 dependencies = [
  "unicode-ident",
 ]
@@ -1534,18 +1534,18 @@ dependencies = [
 
 [[package]]
 name = "zerocopy"
-version = "0.8.36"
+version = "0.8.47"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dafd85c832c1b68bbb4ec0c72c7f6f4fc5179627d2bc7c26b30e4c0cc11e76cc"
+checksum = "efbb2a062be311f2ba113ce66f697a4dc589f85e78a4aea276200804cea0ed87"
 dependencies = [
  "zerocopy-derive",
 ]
 
 [[package]]
 name = "zerocopy-derive"
-version = "0.8.36"
+version = "0.8.47"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7cb7e4e8436d9db52fbd6625dbf2f45243ab84994a72882ec8227b99e72b439a"
+checksum = "0e8bc7269b54418e7aeeef514aa68f8690b8c0489a06b0136e5f57c4c5ccab89"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -1608,6 +1608,6 @@ dependencies = [
 
 [[package]]
 name = "zmij"
-version = "1.0.17"
+version = "1.0.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "02aae0f83f69aafc94776e879363e9771d7ecbffe2c7fbb6c14c5e00dfe88439"
+checksum = "b8848ee67ecc8aedbaf3e4122217aff892639231befc6a1b58d29fff4c2cabaa"

bindings/wasm/Cargo.lock

@@ -80,9 +80,9 @@ checksum = "5e764a1d40d510daf35e07be9eb06e75770908c27d411ee6c92109c9840eaaf7"
 
 [[package]]
 name = "bitflags"
-version = "2.10.0"
+version = "2.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "812e12b5285cc515a9c72a5c1d3b6d46a19dac5acfef5265968c166106e31dd3"
+checksum = "843867be96c8daad0d758b57df9392b6d8d271134fce549de6ce169ff98a92af"
 
 [[package]]
 name = "borrow-or-share"
@@ -102,9 +102,9 @@ dependencies = [
 
 [[package]]
 name = "bumpalo"
-version = "3.19.1"
+version = "3.20.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5dd9dc738b7a8311c7ade152424974d8115f2cdad61e8dab8dac9f2362298510"
+checksum = "5d20789868f4b01b2f2caec9f5c4e0213b41e3e5702a50157d699ae31ced2fcb"
 
 [[package]]
 name = "bytecount"
@@ -120,9 +120,9 @@ checksum = "37b2a672a2cb129a2e41c10b1224bb368f9f37a2b16b612598138befd7b37eb5"
 
 [[package]]
 name = "cc"
-version = "1.2.55"
+version = "1.2.58"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "47b26a0954ae34af09b50f0de26458fa95369a0d478d8236d3f93082b219bd29"
+checksum = "e1e928d4b69e3077709075a938a05ffbedfa53a84c8f766efbf8220bb1ff60e1"
 dependencies = [
  "find-msvc-tools",
  "shlex",
@@ -297,26 +297,25 @@ dependencies = [
 
 [[package]]
 name = "futures-core"
-version = "0.3.31"
+version = "0.3.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "05f29059c0c2090612e8d742178b0580d2dc940c837851ad723096f87af6663e"
+checksum = "7e3450815272ef58cec6d564423f6e755e25379b217b0bc688e295ba24df6b1d"
 
 [[package]]
 name = "futures-task"
-version = "0.3.31"
+version = "0.3.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f90f7dce0722e95104fcb095585910c0977252f286e354b5e3bd38902cd99988"
+checksum = "037711b3d59c33004d3856fbdc83b99d4ff37a24768fa1be9ce3538a1cde4393"
 
 [[package]]
 name = "futures-util"
-version = "0.3.31"
+version = "0.3.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9fa08315bb612088cc391249efdc3bc77536f16c91f6cf495e6fbe85b20a4a81"
+checksum = "389ca41296e6190b48053de0321d02a77f32f8a5d2461dd38762c0593805c6d6"
 dependencies = [
  "futures-core",
  "futures-task",
  "pin-project-lite",
- "pin-utils",
  "slab",
 ]
 
@@ -553,9 +552,9 @@ checksum = "d98f6fed1fde3f8c21bc40a1abb88dd75e67924f9cffc3ef95607bad8017f8e2"
 
 [[package]]
 name = "itoa"
-version = "1.0.17"
+version = "1.0.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "92ecc6618181def0457392ccd0ee51198e065e016d1d527a7ac1b6dc7c1f09d2"
+checksum = "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682"
 
 [[package]]
 name = "js-sys"
@@ -608,9 +607,9 @@ checksum = "09edd9e8b54e49e587e4f6295a7d29c3ea94d469cb40ab8ca70b288248a81db2"
 
 [[package]]
 name = "libc"
-version = "0.2.180"
+version = "0.2.183"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bcc35a38544a891a5f7c865aca548a982ccb3b8650a5b06d0fd33a10283c56fc"
+checksum = "b5b646652bf6661599e1da8901b3b9522896f01e736bad5f723fe7a3a27f899d"
 
 [[package]]
 name = "libm"
@@ -647,9 +646,9 @@ checksum = "a1dc47f592c06f33f8e3aea9591776ec7c9f9e4124778ff8a3c3b87159f7e593"
 
 [[package]]
 name = "memchr"
-version = "2.7.6"
+version = "2.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f52b00d39961fc5b2736ea853c9cc86238e165017a493d1d5c8eac6bdc4cc273"
+checksum = "f8ca58f447f06ed17d5fc4043ce1b10dd205e060fb3ce5b979b8ed8e59ff3f79"
 
 [[package]]
 name = "minicov"
@@ -761,9 +760,9 @@ dependencies = [
 
 [[package]]
 name = "once_cell"
-version = "1.21.3"
+version = "1.21.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "42f5e15c9953c5e4ccceeb2e7382a716482c34515315f7b03532b8b4e8393d2d"
+checksum = "9f7c3e4beb33f85d45ae3e3a1792185706c8e16d043238c593331cc7cd313b50"
 
 [[package]]
 name = "oorandom"
@@ -826,15 +825,9 @@ dependencies = [
 
 [[package]]
 name = "pin-project-lite"
-version = "0.2.16"
+version = "0.2.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3b3cff922bd51709b605d9ead9aa71031d81447142d828eb4a6eba76fe619f9b"
-
-[[package]]
-name = "pin-utils"
-version = "0.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8b870d8c151b6f2fb93e84a13146138f05d02ed11c7e7c54f8826aaaf7c9f184"
+checksum = "a89322df9ebe1c1578d689c92318e070967d1042b512afbe49518723f4e6d5cd"
 
 [[package]]
 name = "postcard"
@@ -878,9 +871,9 @@ dependencies = [
 
 [[package]]
 name = "quote"
-version = "1.0.44"
+version = "1.0.45"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "21b2ebcf727b7760c461f091f9f0f539b77b8e87f2fd88131e7f1b433b3cece4"
+checksum = "41f2619966050689382d2b44f664f4bc593e129785a36d6ee376ddf37259b924"
 dependencies = [
  "proc-macro2",
 ]
@@ -972,9 +965,9 @@ dependencies = [
 
 [[package]]
 name = "regex-automata"
-version = "0.4.13"
+version = "0.4.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5276caf25ac86c8d810222b3dbb938e512c55c6831a10f3e6ed1c93b84041f1c"
+checksum = "6e1dd4122fc1595e8162618945476892eefca7b88c52820e74af6262213cae8f"
 dependencies = [
  "aho-corasick",
  "memchr",
@@ -983,9 +976,9 @@ dependencies = [
 
 [[package]]
 name = "regex-syntax"
-version = "0.8.8"
+version = "0.8.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7a2d987857b319362043e95f5353c0535c1f58eec5336fdfcf626430af7def58"
+checksum = "dc897dd8d9e8bd1ed8cdad82b5966c3e0ecae09fb1907d58efaa013543185d0a"
 
 [[package]]
 name = "regorus"
@@ -1042,9 +1035,9 @@ checksum = "b39cdef0fa800fc44525c84ccb54a029961a8215f9619753635a9c0d2538d46d"
 
 [[package]]
 name = "ryu"
-version = "1.0.22"
+version = "1.0.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a50f4cf475b65d88e057964e0e9bb1f0aa9bbb2036dc65c64596b42932536984"
+checksum = "9774ba4a74de5f7b1c1451ed6cd5285a32eddb5cccb8cc655a4e50009e06477f"
 
 [[package]]
 name = "same-file"
@@ -1148,9 +1141,9 @@ checksum = "b2aa850e253778c88a04c3d7323b043aeda9d3e30d5971937c1855769763678e"
 
 [[package]]
 name = "slab"
-version = "0.4.11"
+version = "0.4.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7a2ae44ef20feb57a68b23d846850f861394c2e02dc425a50098ae8c90267589"
+checksum = "0c790de23124f9ab44544d7ac05d60440adc586479ce501c1d6d7da3cd8c9cf5"
 
 [[package]]
 name = "smallvec"
@@ -1172,9 +1165,9 @@ checksum = "6ce2be8dc25455e1f91df71bfa12ad37d7af1092ae736f3a6cd0e37bc7810596"
 
 [[package]]
 name = "syn"
-version = "2.0.114"
+version = "2.0.117"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d4d107df263a3013ef9b1879b0df87d706ff80f65a86ea879bd9c31f9b307c2a"
+checksum = "e665b8803e7b1d2a727f4023456bbbbe74da67099c585258af0ad9c5013b9b99"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -1230,9 +1223,9 @@ checksum = "0b993bddc193ae5bd0d623b49ec06ac3e9312875fdae725a975c51db1cc1677f"
 
 [[package]]
 name = "unicode-ident"
-version = "1.0.22"
+version = "1.0.24"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9312f7c4f6ff9069b165498234ce8be658059c6728633667c526e27dc2cf1df5"
+checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75"
 
 [[package]]
 name = "unicode-xid"
@@ -1266,9 +1259,9 @@ checksum = "b6c140620e7ffbb22c2dee59cafe6084a59b5ffc27a8859a5f0d494b5d52b6be"
 
 [[package]]
 name = "uuid"
-version = "1.22.0"
+version = "1.23.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a68d3c8f01c0cfa54a75291d83601161799e4a89a39e0929f4b0354d88757a37"
+checksum = "5ac8b6f42ead25368cf5b098aeb3dc8a1a2c05a3eee8a9a1a68c640edbfc79d9"
 dependencies = [
  "getrandom 0.4.2",
  "js-sys",
@@ -1670,18 +1663,18 @@ dependencies = [
 
 [[package]]
 name = "zerocopy"
-version = "0.8.36"
+version = "0.8.47"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dafd85c832c1b68bbb4ec0c72c7f6f4fc5179627d2bc7c26b30e4c0cc11e76cc"
+checksum = "efbb2a062be311f2ba113ce66f697a4dc589f85e78a4aea276200804cea0ed87"
 dependencies = [
  "zerocopy-derive",
 ]
 
 [[package]]
 name = "zerocopy-derive"
-version = "0.8.36"
+version = "0.8.47"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7cb7e4e8436d9db52fbd6625dbf2f45243ab84994a72882ec8227b99e72b439a"
+checksum = "0e8bc7269b54418e7aeeef514aa68f8690b8c0489a06b0136e5f57c4c5ccab89"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -1744,6 +1737,6 @@ dependencies = [
 
 [[package]]
 name = "zmij"
-version = "1.0.17"
+version = "1.0.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "02aae0f83f69aafc94776e879363e9771d7ecbffe2c7fbb6c14c5e00dfe88439"
+checksum = "b8848ee67ecc8aedbaf3e4122217aff892639231befc6a1b58d29fff4c2cabaa"