# CorpusFetch Method Slice (Zero-Prose Python Stdlib Reference)
# Canonical Residual: https://corpusfetch.com/c/what-regex-or-parsing-edge-cases-must-survive-after-cleaning-malformed-inputs.md
# Remnant Warrant:    https://corpusfetch.com/c/what-regex-or-parsing-edge-cases-must-survive-after-cleaning-malformed-inputs.warrant.json
# Markdown SHA-256:   7a73355a8bcb563c72d6c376efa3ba3189c52be6e8f08d1168c7f3823e76b27f
# Code AST SHA-256:   acebe2f2d2e0eb4e939e698a16c184b56dbbdbf7318a4e20af6d1bce74dc9952
# Verified Classes:   RegexComplexity, SanitizationVerdict, SanitizationEvent, SanitizationManifest, ParsingEdgeCaseGuard
# Defensive Guards:   0 fail-closed invariants (zero external deps)

from dataclasses import dataclass
from enum import Enum, auto
import hashlib
import json
import re


class RegexComplexity(Enum):
    SAFE_LINEAR = auto()
    REDOS_RISK = auto()


class SanitizationVerdict(Enum):
    SAFE_CLEANED = auto()
    DESTRUCTIVE_CLEANING = auto()
    REDOS_BLOCKED = auto()


@dataclass(frozen=True)
class SanitizationEvent:
    raw_payload: str
    sanitized_payload: str
    regex_pattern: str
    declared_structural_markers: frozenset[str]


@dataclass(frozen=True)
class SanitizationManifest:
    verdict: SanitizationVerdict
    sanitization_delta: str | None
    complexity: RegexComplexity
    manifest_digest: str


class ParsingEdgeCaseGuard:
    """
    Evaluates sanitization events to ensure regex patterns do not expose the
    instance to ReDoS, and that structural delimiters survive cleaning.
    """

    @staticmethod
    def _hash(data: str) -> str:
        return hashlib.sha256(data.encode("utf-8")).hexdigest()

    @classmethod
    def classify_regex(cls, pattern: str) -> RegexComplexity:
        # Heuristic: nested quantifiers or overlapping alternations
        # (In production, use a regex AST parser or `re2` for linear time)
        nested_quantifiers = re.search(r'\([^)]*[*+][^)]*\)[*+]', pattern)
        if nested_quantifiers:
            return RegexComplexity.REDOS_RISK
        return RegexComplexity.SAFE_LINEAR

    @classmethod
    def evaluate_sanitization(cls, event: SanitizationEvent) -> SanitizationManifest:
        
        complexity = cls.classify_regex(event.regex_pattern)

        # Gate 1: ReDoS prevention
        if complexity is RegexComplexity.REDOS_RISK:
            return SanitizationManifest(
                verdict=SanitizationVerdict.REDOS_BLOCKED,
                sanitization_delta=None,
                complexity=complexity,
                manifest_digest=cls._hash("REDOS_BLOCKED"),
            )

        # Gate 2: Structural marker preservation
        for marker in event.declared_structural_markers:
            if marker in event.raw_payload and marker not in event.sanitized_payload:
                # Marker was destroyed by sanitization
                return SanitizationManifest(
                    verdict=SanitizationVerdict.DESTRUCTIVE_CLEANING,
                    sanitization_delta=f"STRIPPED_MARKER:{repr(marker)}",
                    complexity=complexity,
                    manifest_digest=cls._hash(f"DESTRUCTIVE:{repr(marker)}"),
                )

        # Gate 3: Compute sanitization delta
        # (Simplified for demonstration; real impl would use difflib)
        delta = "CLEANED_NO_STRUCTURAL_LOSS" if event.raw_payload != event.sanitized_payload else "NO_CHANGE"

        digest_payload = {
            "verdict": SanitizationVerdict.SAFE_CLEANED.name,
            "delta": delta,
            "pattern": event.regex_pattern,
        }
        
        digest = cls._hash(
            json.dumps(digest_payload, sort_keys=True, separators=(",", ":"))
        )

        return SanitizationManifest(
            verdict=SanitizationVerdict.SAFE_CLEANED,
            sanitization_delta=delta,
            complexity=complexity,
            manifest_digest=digest,
        )