infrastructure/

Package sbomcache is a filesystem-backed, content-addressed cache of generated SBOMs.

Package openai implements ports.LLM against an OpenAI-compatible Chat Completions API – the reference provider, tested against the LLM gateway.

Package file provides simple file-backed stores for single-tenant self-host mode and tests.

Package memory provides in-memory repository implementations for the walking skeleton and tests.

Package postgres provides PostgreSQL-backed repositories (pgx/v5) and applies migrations via goose.

Package ast adapts the synapse-ast sidecar to the ports.ASTProvider port: it shells out (argv only, no shell) to the binary, which parses the target with tree-sitter and returns per-language function counts as JSON.

Package astwalk is the source-tree walk + result model shared by the synapse-ast sidecar's CGO (tree-sitter) and CGO-free (stub) builds.

Package bincat catalogs installed language packages from a materialized image root filesystem that a lockfile would miss: Go module dependencies embedded in compiled Go binaries (via stdlib debug/buildinfo) and Python distributions installed on disk (*.dist-info / *.egg-info metadata).

Package codeanalysis is a deterministic, pure-Go maintainability + reliability rule engine: it walks a source tree and flags code smells (Kind=quality) and likely bugs (Kind=reliability) per (file, line), mirroring the SAST pattern analyzer.

Package codeinventory is a deterministic, pure-Go code-size inventory: it walks a source tree, classifies each file's language with go-enry, and counts code / comment / blank lines per language, plus functions where a first-party parser exists (Go today, via go/parser).

Package coverage parses a test-coverage report (lcov, Cobertura XML, or JaCoCo XML) into per-file, per-line coverage.

Package doctor provides an offline, read-only preflight report for synapse-cli.

Package duplication is a deterministic, pure-Go copy-paste (clone) detector: it walks a source tree, tokenizes each file (comment- and whitespace-insensitive, language-aware comment stripping), and finds runs of duplicated tokens across and within files via a Rabin-Karp rolling hash, then reports the standard duplication metrics (blocks, duplicated lines, files, density).

Package enry adapts source-language detection to the LanguageDetector port, backed by go-enry (the GitHub Linguist port).

Package gitdiff computes the set of added/changed lines per file between a base ref and the working tree, for "new code" (Clean-as-You-Code) gating: a finding is "new" when it sits on a changed line.

Package gomodgraph resolves the transitive dependency EDGES of a Go module by shelling out to `go mod graph` via argv and mapping its module-graph output onto the SBOM's existing golang components.

Package govulncheck adapts the Go call-graph builder to the CallGraphBuilder port by shelling out to a pinned govulncheck binary via argv.

Package gradleresolve resolves a Gradle project's full dependency tree (direct + transitive, with the resolved versions) by shelling out (argv only) to a pinned `gradle` with a Synapse init script that walks the resolution-result GRAPH of the `runtimeClasspath` of EVERY project in the build (root + all subprojects) and prints each resolved Maven module.

Package grype is a DetectionSource that augments OSV.

Package ignorefile loads a repo-committed .synapseignore suppression policy from a prepared workspace.

Package jarchecksum captures the artifact SHA-1 of JVM components by hashing the JAR files in the prepared workspace.

Package jarhash recovers the Maven coordinate of a shaded / relocated / metadata-less JVM component from its artifact SHA-1, by querying Maven Central's SHA-1 search API.

Package jarlicense recovers component licenses from the license TEXT embedded in JARs in the prepared workspace, for components the registry lookup left unknown.

Package jvmreach computes COARSE, deterministic class-level reachability for JVM projects: starting from the application's own compiled classes, does anything (transitively) reference a dependency's classes at all? A dependency whose classes are never referenced is "present but not wired in" – the signal behind the field complaint that a scan lists packages the project does not use.

Package license adapts license classification + policy to the LicenseScanner port.

Package licensefile recovers component licenses by classifying the LICENSE / COPYING files present in the prepared workspace – the cross-ecosystem equivalent of Trivy's `--license-full`, but for ANY language (not just JARs, which jarlicense handles).

Package licensemeta enriches SBOM components with license metadata from package registries (license recovery).

Package licensetext classifies license FILE TEXT into an SPDX id with a confidence score, using github.com/google/licensecheck (the classifier deps.dev/pkgsite use).

Package manifest enriches a generator's SBOM from dependency manifests the generator under-uses: it reconstructs missing dependency edges (Gemfile.lock), recovers dependencies the generator cannot resolve from source (Maven pom.xml, Gradle version catalogs), and refines component scope via pnpm workspace attribution.

Package manifestresolve resolves the dependency tree of a lockfile-less package manifest by shelling out (argv only, no shell) to the ecosystem's own tool in a LOCK-ONLY, NO-SCRIPTS mode over a THROWAWAY COPY of the manifest, then reusing the owned lockfile parser to emit pinned components.

Package mavencoord recovers authoritative Maven coordinates for SBOM components whose groupId was mis-derived during SBOM generation.

Package mavenresolve resolves a Maven project's full dependency tree (direct + transitive, with the real versions) by shelling out to `mvn dependency:list` via argv, then parsing the resolved coordinates into SBOM components.

Package misconfig is an owned, deterministic infrastructure-as-code / config scanner over a prepared workspace.

Package notebook decodes the small, stable subset of the Jupyter notebook format needed by source analyzers.

Package npmresolve resolves an npm project's dependency tree (direct + transitive, with pinned versions) from a package.json that has NO committed lockfile — the common raw-source state where the manifest declares only semver RANGES (^1.2.3, ~1.0, >=2) and the SBOM otherwise sees no resolvable version to advisory-match.

Package nvd backfills the severity of vulnerabilities the detection sources left UNKNOWN (an OSV-only distro CVE often carries no CVSS) by looking up the CVE's CVSS base score in the NVD CVE API.

Package ospkg catalogs installed OS packages from a materialized image root filesystem: Debian/Ubuntu dpkg (/var/lib/dpkg/status), Alpine apk (/lib/apk/db/installed), and RHEL-family rpm (/var/lib/rpm/rpmdb.sqlite), with the distro release read from /etc/os-release.

Package osv is a DetectionSource that queries OSV.dev – the primary vuln source (free, no auth, no rate limit).

Package ownadvisory is the OWNED advisory DetectionSource: it matches an SBOM against Synapse's own normalized advisory store using the owned matcher (internal/domain/advisory), producing the same vulnerability.RawFinding the OSV/Grype adapters do – but WITHOUT querying any third-party service.

Package ownsbom is Synapse's OWNED SBOM producer: a per-ecosystem parser registry that reads dependency manifests/lockfiles directly and emits a normalized sbom.SBOM, WITHOUT shelling out to a third-party scanner.

Package pyimports is a SOURCE-ONLY Python import scanner: it reads a target's first-party .py files and extracts the top-level modules they import, plus whether the code uses dynamic imports.

Package qualityprofile loads the .synapse-gate.yaml (quality gate) and .synapse-rules.yaml (rule profile) config files into the pure-domain qualitygate types.

Package risk enriches vulnerabilities with CISA KEV + FIRST EPSS so they can be ordered by real risk priority (KEV -> EPSS x CVSS).

Package sast is a deterministic, pure-Go pattern scanner: it walks a source tree and flags high-signal weaknesses (weak crypto, hardcoded secrets/keys, insecure TLS config) by regex, emitting one finding per (file, line, rule).

Package secretscan is an owned, deterministic secret scanner over a prepared workspace.

Package ssacallgraph builds a deterministic call graph from Go SOURCE using go/ssa – the general, first-party call graph taint analysis needs.

Package syft adapts SBOM generation to the SBOMGenerator port by shelling out to a pinned Syft binary.

Package taintcallgraph is the adapter that produces a general first-party call graph for E39 taint analysis by shelling out to the sandboxed `synapse-callgraph` argv binary (which runs the heavy go/ssa builder, internal/infrastructure/tools/ssacallgraph).

Package vexfile loads an in-repo OpenVEX document (.synapse.vex.json) from a prepared workspace.