Generate an adversarial string that pumps pattern and then fails to match, forcing maximal backtracking. Returns the evil string and whether it fails to match (a timeout counts as failing -- it's the vulnerability).

Generate a minimal string that pattern matches quickly (the baseline).

Time the evil vs benign string AND sweep increasing pump sizes to classify growth as linear / polynomial / exponential. The verdict names the engine.

Sweep RE2 max_mem to find the DFA compile-memory cliff: the largest cap at which compilation fails and the smallest at which it succeeds.

Check pattern matches all positives and rejects all negatives (each in a killable subprocess). Returns pass plus any false positives/negatives.

Composite verdict: accept pattern only if it (a) passes all test cases, (b) shows no super-linear NFA growth on the engine, and (c) compiles within the RE2 memory bound. On rejection, names the dangerous construct and the family of safe rewrites to try. Does not auto-rewrite.

Mechanically generate safe-rewrite CANDIDATES for a ReDoS-prone pattern and return only the ones that are VERIFIED. Use this when analyze/redos_bench flags a pattern as super-linear and you want a concrete, drop-in replacement rather than just the name of a technique.

Each candidate is independently checked: correctness on your positives/ negatives, non-super-linear growth on engine, AND language equivalence to the original (exact DFA comparison when both are regular, else seeded differential fuzzing). A candidate is marked safe/chosen as best ONLY if all three hold -- never an unverified guess. best is null when nothing verifies. Deterministic for a given seed. Note: atomic-group/possessive candidates need a modern engine (Python re>=3.11, PCRE2, Java); RE2/Go can't parse them, which the candidate notes call out.

Drive suggest_rewrites in a loop and return a GUARANTEED-safe equivalent or an honest failure. Use this when you want the server to do the iteration for you and hand back a single fixed pattern you can trust.

success=true requires the fixed pattern to be verified non-super-linear on EVERY requested engine (default ["python"]) AND provably/empirically equivalent to the original input. If no such pattern exists, or a requested engine isn't installed, returns success=false with failure_reason and the closest candidate -- never a fabricated fix. Deterministic for a given seed.

Classify NFA growth for one pattern across MULTIPLE regex engines and return a per-engine matrix. Use this to decide whether a pattern is safe on the engine you actually deploy on -- the same regex can be exponential on a backtracking engine (Python re/regex, Node/V8, PCRE2, Java) yet linear on an automaton engine (RE2, Go).

Every requested engine appears in per_engine: installed ones with a measured growth verdict + curve, missing ones with available=false and a skipped_reason (never silently omitted). DFA/memory analysis runs once (engine-independent); correctness runs once on a reference engine. overall_accepted is true only if the pattern is safe on every requested engine that is available AND none were unavailable; otherwise the result is honestly unverified. Default engines covers the whole registry (python, regex, re2, node, go, java, pcre2).