internal/

Package cli wires the cobra command tree for the possession binary.

Package config loads and validates a possession role-matrix YAML file.

Package detect is possession's detection evaluator.

Package flow implements Tier-2 stateful multi-step authentication flows (Packet 7).

Package jwt provides JWT inspection helpers and the malformed-token construction primitives used by the JWT mutators in internal/mutate.

Package model contains the core domain types for possession.

Package mutate produces deterministic Variant sets for one baseline CapturedRequest under a given role matrix.

Package normalize collapses path identifiers to templates and deduplicates CapturedRequests into Endpoints.

Package parse converts HAR files and curl commands into a uniform stream of model.CapturedRequest values for the normalize stage.

Package record persists a scan's network phase (every variant + baseline request/response) to disk and replays it back into the detection pipeline without re-hitting the target (POST_V01 Item 7).

Package replay issues baseline and variant HTTP requests and collects responses.

Package report renders model.RunResult in possession's three v1.0 output formats: human (default ASCII), json (deterministic pretty-printed), and sarif (SARIF 2.1.0 via go-sarif/v3 for GitHub code scanning).

Package suppress implements the possession.allowlist suppression file.