ecdat 0.2.0__py3-none-any.whl

ecdat-0.2.0.dist-info/METADATA

@@ -0,0 +1,142 @@
+Metadata-Version: 2.4
+Name: ecdat
+Version: 0.2.0
+Summary: Cryptographic discovery and post-quantum readiness scanner — CLI with a gradient ASCII banner and an animated 3D globe (CBOM, CycloneDX 1.6)
+Author: ECDAT Team
+License-Expression: MIT
+Project-URL: Homepage, https://github.com/profm0r14rty/ecdat
+Project-URL: Repository, https://github.com/profm0r14rty/ecdat
+Project-URL: Issues, https://github.com/profm0r14rty/ecdat/issues
+Project-URL: Changelog, https://github.com/profm0r14rty/ecdat/blob/main/CHANGELOG.md
+Keywords: cbom,cli,cryptography,cyclonedx,post-quantum,pqc,quantum,sbom,security
+Classifier: Development Status :: 3 - Alpha
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Developers
+Classifier: Intended Audience :: Information Technology
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
+Classifier: Topic :: Security
+Classifier: Topic :: Security :: Cryptography
+Classifier: Topic :: Software Development :: Quality Assurance
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: pydantic>=2
+Requires-Dist: rich>=13.7
+Provides-Extra: dev
+Requires-Dist: pytest; extra == "dev"
+Requires-Dist: pytest-cov; extra == "dev"
+Requires-Dist: jsonschema; extra == "dev"
+Requires-Dist: build; extra == "dev"
+Requires-Dist: twine; extra == "dev"
+Dynamic: license-file
+
+# ecdat
+
+**ECDAT** is a [CycloneDX](https://cyclonedx.org/) **Cryptography Bill of
+Materials (CBOM) scanner for post-quantum readiness**. One command finds the
+cryptographic artefacts in a codebase — RSA, ECC, DH, DSA, MD5, SHA-1, DES,
+3DES, RC4, AES, and others — scores each one's post-quantum risk with Mosca's
+inequality, recommends NIST post-quantum replacements, and emits a real
+CycloneDX 1.6 CBOM next to a dashboard-friendly risk summary.
+
+It is a small, self-contained Python package (runtime dependencies: `pydantic`
+and `rich`) — no FastAPI, Postgres, Redis, or Docker required. It runs fully
+offline: the only network access is `git clone` for an explicit URL scan.
+
+Why it is more than a lookalike scanner:
+
+- **Real CBOM output.** The report is genuine CycloneDX 1.6, validated against
+  the official JSON Schema on every scan in the test suite, so Dependency-Track,
+  Syft, Grype, and other CycloneDX tooling parse it unchanged.
+- **"Classically broken" is not "quantum vulnerable".** MD5, SHA-1, DES, 3DES,
+  and RC4 are reported as broken *today*; RSA, ECC, DH, and DSA as broken *by
+  Shor's algorithm*. An actively exploitable hash is never mislabeled
+  "quantum-safe".
+- **Offline and private.** No telemetry, no update checks.
+- **Crash-safe.** Expected errors print a clear message and exit code;
+  unexpected errors are written to a local crash log instead of a raw
+  traceback.
+
+## Install
+
+```bash
+pipx install ecdat        # recommended: isolated and on PATH
+uv tool install ecdat     # recommended if you use uv
+pip install ecdat         # into the active Python environment
+```
+
+If plain `pip` reports `externally-managed-environment`, that is
+[PEP 668](https://peps.python.org/pep-0668/) protecting your OS Python — use
+`pipx` or `uv tool` (or a virtualenv) instead of forcing the install. On
+Windows, install with `py -m pip install ecdat`; if `ecdat` is not on `PATH`,
+run the CLI as `py -m ecdat …`.
+
+## 60-second tour
+
+```bash
+ecdat demo                                   # scan the bundled sample project
+ecdat scan .                                 # scan the current directory
+ecdat scan https://github.com/<user>/<repo>  # scan a public https:// repo
+ecdat about                                  # credits and an animated 3D globe
+ecdat doctor                                 # check your environment
+```
+
+## Commands
+
+| Command | Description |
+|---------|-------------|
+| `ecdat scan <path-or-url>` | Scan a local directory, or an `https://` Git repository |
+| `ecdat demo` | Scan the bundled, deliberately-insecure sample project (zero setup) |
+| `ecdat doctor` | Environment self-check with a one-line fix per problem |
+| `ecdat about` | Credits, project links, and a spinning 3D globe |
+| `ecdat help [command]` | Command overview, or full help for one command |
+| `ecdat version` | Version, engine, signature count, Python, and OS |
+
+Global flags: `--version`, `--no-color`, and `--debug`.
+
+## Formats
+
+`ecdat scan --format <pretty|json|cbom|summary>`:
+
+| Format | Contents |
+|--------|----------|
+| `pretty` | Colourised terminal report (default) |
+| `json` | The full `ScanResult` |
+| `cbom` | A CycloneDX 1.6 CBOM |
+| `summary` | The risk rollup used by dashboards |
+
+Payload formats write **only** the payload to stdout; progress, warnings, and
+errors go to stderr — so `ecdat scan . -f cbom > cbom.json` is safe to pipe.
+`ecdat demo` supports `pretty`, `json`, and `summary`.
+
+For CI, `ecdat scan . --fail-on high` exits `1` when a finding is at or above
+that level (`quantum-safe` findings never count) and `0` when clean. The other
+exit codes are `2` (usage/validation error), `3` (scan/runtime/unexpected
+error), and `130` (interrupted with `Ctrl-C`).
+
+## Guarantees
+
+- **Offline by default.** Only `git clone` for an explicit `https://` URL scan
+  touches the network; local scans never do.
+- **No telemetry and no update checks.**
+- **Injection-safe rendering.** File paths, matched snippets, and algorithm
+  names from scanned (untrusted) code are rendered as plain text and cannot
+  inject terminal escapes or Rich/HTML/Markdown markup.
+- **Validated Git-URL scanning.** Only `https://` URLs are cloned, and the host
+  is resolved and checked against private/reserved address ranges before any
+  clone runs.
+
+## Links
+
+- Source, issues, and documentation: <https://github.com/profm0r14rty/ecdat>
+- Security policy: <https://github.com/profm0r14rty/ecdat/blob/main/SECURITY.md>
+- Changelog: <https://github.com/profm0r14rty/ecdat/blob/main/CHANGELOG.md>
+- Live demo dashboard: <https://ecdat-web.onrender.com>
+- Live demo API: <https://ecdat-api.onrender.com>
+- License (MIT): <https://github.com/profm0r14rty/ecdat/blob/main/LICENSE>

ecdat-0.2.0.dist-info/RECORD

@@ -0,0 +1,51 @@
+ecdat/__init__.py,sha256=BOTeAsSSsyvPoPc3UcLBTGX1oRgO_36k1NpCsxQLMYU,255
+ecdat/__main__.py,sha256=CJz3NsJwYFPOuY4zrLVg6TEh18GHKabXuHz_3apmqT0,99
+ecdat/py.typed,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+ecdat/cli/__init__.py,sha256=k9MqA6JYPNvSGmSmNuSgFRBgJI5oqxaXLENvn8eg1nQ,6235
+ecdat/cli/parser.py,sha256=7wRLlRsA4apj5lcOTTF0sjubEFdY4A8RiLQr7Z4NlzQ,3065
+ecdat/cli/commands/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+ecdat/cli/commands/about.py,sha256=WqhlTylTU3lUSn5mqkEnGQo2nJbdYo4HjQRBQsjEb4Y,4306
+ecdat/cli/commands/demo.py,sha256=xn9oSqY4ssfyTlxqlIXFfKFXxLxpU9KBm9qtepJaJYQ,3831
+ecdat/cli/commands/doctor.py,sha256=aUVuXzn-KFQCSgPOupO5cD13lF2vWy4i_oKIPC80_Hk,8696
+ecdat/cli/commands/help_cmd.py,sha256=ezPxwpPc_yNknO-tInUpA2jDTqsmz-AibC36JnBAKkk,6281
+ecdat/cli/commands/scan.py,sha256=8veZUGvuadiHNtroqX_lorX_xIz24bf4Wu28AlXlqKo,7021
+ecdat/cli/commands/version_cmd.py,sha256=jcvnp70vLiH5getr9N67YJxVgblZP1KdA7WQmNBp6Ds,1480
+ecdat/demo_project/auth/login.py,sha256=rZ4zI7vX5c4eMWeF1rpKdIfuEjU_2S9PeO9JMCKZKTI,2496
+ecdat/demo_project/certs/cert_verify.go,sha256=6Xhj5rCH9FtLD8xMaIdpI1UfEBVQp45wphOpPisXgBE,2381
+ecdat/demo_project/keyexchange/channel.go,sha256=j_6VmbMfSIKvNbsf2F2yKls8G4otVe2wdd22ErWM3K8,1441
+ecdat/demo_project/legacy/LegacyCrypto.java,sha256=qIja8rRhe9_k715Kid_pJm8drtEF7A7Iq9no5rZ2lA4,2624
+ecdat/demo_project/payments/payment.py,sha256=ZNaL5bB9W6gXgzQ0lovMEM6R4MnmINFcDsqcBgiTtt4,2076
+ecdat/demo_project/quantum/pqc_utils.py,sha256=wQQ0grfyAeRyrVNjJJRdtYEzE4UOvTqT6SLiL0fHIak,2233
+ecdat/demo_project/quantum/slh_signer.py,sha256=AOuS0VVyw2PvTEz_UZGZ8tKmgOa2_xHwF9bLoZDW2u4,1258
+ecdat/demo_project/tokens/signing.js,sha256=GEKuJsOgi40tHMztx0AhN4c08N2lOjaYsi5iddtrao4,1575
+ecdat/services/__init__.py,sha256=AlwMW3oG-5vx_ygyd4d_0ekYqw_ACERqtSUeF3zCL38,31
+ecdat/services/crashlog.py,sha256=CEBdSBwKg-qQpTjULFka2ag1EmbCWXpIVKG1SFuaX5Y,3243
+ecdat/services/demo.py,sha256=Yhqci4jgzEacBOLgW_Bz5yUzHrvcAL4eIhk4y6mNeLc,3001
+ecdat/services/paths.py,sha256=rOlu2kq_gZZMhE6rQ2ApC_oLs0RY6biuHgBVhQjDFPc,1649
+ecdat/services/scanner.py,sha256=ybfCcp1LKA9xmz3bddjIzPkPqlRCF-NO7Z3BLYpj3k0,7886
+ecdat/services/viewmodel.py,sha256=NLRpbPV8nZGDp1CKVucXCC_JGzYUeXSvLdQ0_YL6O0E,10150
+ecdat/ui/__init__.py,sha256=_-6m7QQDrN6HW4FCW8RzjvnfQWLcsOrYuhER0Xnh4gM,74
+ecdat/ui/art3d.py,sha256=kbtd8ErI26jx5Qq3j57V6v-ZqHFgi15x5ESp9foCtTM,5799
+ecdat/ui/art_static.py,sha256=sC5XaAGBnl9WAJ47ebpW7ePekZubHa8qQ7NB2eKxhrg,1980
+ecdat/ui/art_text.py,sha256=MrCWwXeYS_vvbm3LXD93CvwPMMSRW2o95C-koX3EZXM,2320
+ecdat/ui/banner.py,sha256=baIb1LetcHIPCBm06GYSytdUyE-RSKHwMYcMjThWJMA,5204
+ecdat/ui/console.py,sha256=lpv4deyTM_PS-GwibFQXL5wWswFmkkpsk4peCTlW_K0,3815
+ecdat/ui/motion.py,sha256=TJlJdHEsG_MWZo76zJO2OPhqqiq93ejNIrJhu8YDu_0,1837
+ecdat/ui/render.py,sha256=9x_i9JAnaIyiIBtsm5JHarpNC0j3vfN6p6E2lzjkOpI,14846
+ecdat/ui/theme.py,sha256=vVJXUj9i0fakirAKiCzjafX6TsuUYwOIPF8IENm-n5g,5773
+ecdat-0.2.0.dist-info/licenses/LICENSE,sha256=dMfAf8nlYhDH6bgNsWVgX_Fbsz3urRxtIinmgnn687Y,1071
+ecdat_core/__init__.py,sha256=1O7qWp5bcCESexCZmARnuvPd0r5TRbqCNQPBOF04iJU,314
+ecdat_core/cbom_export.py,sha256=fqN7qCfXUZ9ge9qsPqj1gJ3OLpIRsH3bp40Mk-hvEVU,9849
+ecdat_core/cli.py,sha256=2pJVk7J5RV5qOcNsAPGLwZ1kKMKDlk3Ep9eQ9jMIC8k,7285
+ecdat_core/detector.py,sha256=F-xuL6i3Qk_IDp2wxJnyEoqFXyuMrkpWLtXaOjMV5Rk,10596
+ecdat_core/ingestion.py,sha256=ADbxEL60UG0oH6aPqRiO_e1T-t28ebJNiy4X0pl3KRA,20918
+ecdat_core/models.py,sha256=mtIz8LFTO1Ove-agL04C82SdXAmzrHHNbhp1LdNpl6o,5456
+ecdat_core/recommender.py,sha256=6CYpVHlFUZU5_4oMt9mPpgHAIddIpbw2KnEPCP6oihk,2940
+ecdat_core/risk_engine.py,sha256=5tX7fyxjFzmh4Twp4QnWg9hc0xXoVhPLOIZAxca1Oe4,10663
+ecdat_core/signature_loader.py,sha256=YyWS53wVswP7Vs8RWcWe0NIyHPxrzlK270HE2AzvRPQ,7648
+ecdat_core/signatures.json,sha256=LcPyquVkaJMSNQdOIPgbeReFtpfG7eORkaw19DoGh0Y,24736
+ecdat-0.2.0.dist-info/METADATA,sha256=hb61C3OOa1LN13El9W78VWu_q7aaQBfZNYUNyBjZhqg,6347
+ecdat-0.2.0.dist-info/WHEEL,sha256=YVMoNqKzERt-wjUZwJ33xBGAwnFl-4cqbYkTtWa4itE,91
+ecdat-0.2.0.dist-info/entry_points.txt,sha256=lYK7UoQ8ncEZghNNdeRH1Cao2zkUcqjb-7lxh_wXzIg,41
+ecdat-0.2.0.dist-info/top_level.txt,sha256=qKYEK2ZH4q1NHurvUFQBLetpx7XqH9NJtqtRIQv9zeY,17
+ecdat-0.2.0.dist-info/RECORD,,

ecdat-0.2.0.dist-info/WHEEL

@@ -0,0 +1,5 @@
+Wheel-Version: 1.0
+Generator: setuptools (84.0.0)
+Root-Is-Purelib: true
+Tag: py3-none-any
+

ecdat-0.2.0.dist-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+ecdat = ecdat.cli:main

ecdat-0.2.0.dist-info/licenses/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Errorists Team
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

ecdat-0.2.0.dist-info/top_level.txt

@@ -0,0 +1,2 @@
+ecdat
+ecdat_core

ecdat_core/__init__.py

@@ -0,0 +1,6 @@
+"""ECDAT - Enterprise Cryptographic Discovery & Analysis Tool.
+
+A Cryptography Bill of Materials (CBOM) scanner for post-quantum-readiness assessment.
+Discovers cryptographic artefacts in source code, assesses their quantum-computing risk
+using Mosca's algorithm, and recommends NIST post-quantum replacements.
+"""

ecdat_core/cbom_export.py

@@ -0,0 +1,287 @@
+"""CycloneDX 1.6 CBOM export module for ECDAT.
+
+Converts an ECDAT :class:`ScanResult` into a dict matching the real
+CycloneDX 1.6 BOM JSON structure, and provides a lightweight summary
+format optimised for frontend consumption.
+
+Public API:
+    - :func:`export_cbom` -> full CycloneDX 1.6 BOM dict.
+    - :func:`export_summary` -> frontend-friendly summary dict.
+"""
+
+from __future__ import annotations
+
+from collections import Counter
+from uuid import uuid4
+
+from ecdat_core.models import Detection, Recommendation, RiskAssessment, ScanResult
+
+# ---------------------------------------------------------------------------
+# ECDAT tool identity embedded in every CBOM.
+# ---------------------------------------------------------------------------
+_TOOL_NAME = "ECDAT"
+_TOOL_VERSION = "0.1.0"
+
+# ---------------------------------------------------------------------------
+# Algorithm family keywords → CycloneDX ``algorithmProperties.primitive``.
+# Checked case-insensitively against ``algorithm_family``.
+#
+# The values MUST be members of the official CycloneDX 1.6
+# ``algorithmProperties.primitive`` enum (verified against
+# bom-1.6.schema.json): ``signature``, ``hash``, ``block-cipher``,
+# ``key-agree``, ``kem``, ``pke``, ... — note ``key-agree``, NOT
+# ``key-agreement``.
+# ---------------------------------------------------------------------------
+_PRIMITIVE_RULES: list[tuple[str, str]] = [
+    ("sign", "signature"),
+    ("dsa", "signature"),
+    ("ecdsa", "signature"),
+    ("sha", "hash"),
+    ("md5", "hash"),
+    ("hash", "hash"),
+    ("aes", "block-cipher"),
+    ("des", "block-cipher"),
+    ("blowfish", "block-cipher"),
+    ("cast", "block-cipher"),
+    ("idea", "block-cipher"),
+    ("rc4", "block-cipher"),
+    ("chacha", "block-cipher"),
+    ("salsa", "block-cipher"),
+    ("rsa", "pke"),
+    ("dh", "key-agree"),
+    ("ecdh", "key-agree"),
+    ("key-agreement", "key-agree"),
+    ("key-exchange", "key-agree"),
+    ("kem", "kem"),
+]
+
+
+# ---------------------------------------------------------------------------
+# Public API
+# ---------------------------------------------------------------------------
+
+
+def export_cbom(scan_result: ScanResult) -> dict:
+    """Produce a CycloneDX 1.6 BOM dict from a :class:`ScanResult`.
+
+    The returned dict conforms to the real CycloneDX 1.6 specification with
+    ``bomFormat`` set to ``"CycloneDX"``, ``specVersion`` set to ``"1.6"``,
+    and each detection mapped to a ``cryptographic-asset`` component.
+
+    Args:
+        scan_result: The complete scan result to export.
+
+    Returns:
+        A dict matching the CycloneDX 1.6 BOM structure.
+    """
+    risk_lookup: dict[str, RiskAssessment] = {
+        ra.detection_id: ra for ra in scan_result.risk_assessments
+    }
+    rec_lookup: dict[str, Recommendation] = {
+        rec.detection_id: rec for rec in scan_result.recommendations
+    }
+
+    components = [
+        _build_component(det, risk_lookup, rec_lookup)
+        for det in scan_result.detections
+    ]
+
+    return {
+        "bomFormat": "CycloneDX",
+        "specVersion": "1.6",
+        "serialNumber": f"urn:uuid:{uuid4()}",
+        "version": 1,
+        "metadata": {
+            "timestamp": scan_result.scanned_at,
+            "tools": {
+                "components": [
+                    {
+                        "type": "application",
+                        "name": _TOOL_NAME,
+                        "version": _TOOL_VERSION,
+                    }
+                ]
+            },
+            "component": {
+                "type": "application",
+                "name": scan_result.target,
+            },
+        },
+        "components": components,
+    }
+
+
+def export_summary(scan_result: ScanResult) -> dict:
+    """Produce a frontend-friendly summary dict from a :class:`ScanResult`.
+
+    Includes detection counts, quantum-vulnerability statistics, risk-level
+    breakdown, algorithm-family distribution, and the five highest-urgency
+    detections.
+
+    Args:
+        scan_result: The complete scan result to summarise.
+
+    Returns:
+        A dict with aggregated statistics ready for frontend consumption.
+    """
+    total = len(scan_result.detections)
+    vuln_count = sum(
+        1 for det in scan_result.detections if det.quantum_vulnerable
+    )
+
+    risk_lookup: dict[str, RiskAssessment] = {
+        ra.detection_id: ra for ra in scan_result.risk_assessments
+    }
+
+    # Risk level counts (initialise all buckets so the frontend always sees
+    # every level even when the count is zero).
+    risk_level_counts: dict[str, int] = {
+        "critical": 0,
+        "high": 0,
+        "medium": 0,
+        "low": 0,
+        "quantum-safe": 0,
+    }
+    for ra in scan_result.risk_assessments:
+        risk_level_counts[ra.risk_level] = risk_level_counts.get(ra.risk_level, 0) + 1
+
+    # Algorithm family counts.
+    family_counter: Counter[str] = Counter(
+        det.algorithm_family for det in scan_result.detections
+    )
+
+    # Top-5 highest-urgency detections.
+    top_5 = _top_urgency(scan_result.detections, risk_lookup, limit=5)
+
+    return {
+        "total_detections": total,
+        "quantum_vulnerable_count": vuln_count,
+        "quantum_vulnerable_percentage": (vuln_count / total * 100.0) if total else 0.0,
+        "risk_level_counts": risk_level_counts,
+        "algorithm_family_counts": dict(family_counter),
+        "top_5_urgency": top_5,
+    }
+
+
+# ---------------------------------------------------------------------------
+# Private helpers
+# ---------------------------------------------------------------------------
+
+
+def _classify_primitive(algorithm_family: str) -> str | None:
+    """Best-effort classification of an algorithm family to a CycloneDX primitive.
+
+    Args:
+        algorithm_family: The algorithm family name (e.g. ``"RSA"``, ``"SHA"``).
+
+    Returns:
+        One of ``"signature"``, ``"hash"``, ``"block-cipher"``,
+        ``"key-agree"``, ``"kem"``, ``"pke"``, or ``None`` if unclassifiable.
+        Returned values are members of the official CycloneDX 1.6
+        ``algorithmProperties.primitive`` enum.
+    """
+    family_lower = algorithm_family.lower()
+    for keyword, primitive in _PRIMITIVE_RULES:
+        if keyword in family_lower:
+            return primitive
+    return None
+
+
+def _build_component(
+    detection: Detection,
+    risk_lookup: dict[str, RiskAssessment],
+    rec_lookup: dict[str, Recommendation],
+) -> dict:
+    """Build a single CycloneDX component dict for a detection.
+
+    Args:
+        detection: The detection to represent as a component.
+        risk_lookup: Map from detection ID to its risk assessment.
+        rec_lookup: Map from detection ID to its recommendation.
+
+    Returns:
+        A dict matching the CycloneDX 1.6 component structure for
+        ``cryptographic-asset`` components.
+    """
+    ra = risk_lookup.get(detection.id)
+    rec = rec_lookup.get(detection.id)
+
+    # --- cryptoProperties ---
+    crypto_props: dict = {"assetType": detection.asset_type}
+    if detection.asset_type == "algorithm":
+        algo_props: dict = {}
+        primitive = _classify_primitive(detection.algorithm_family)
+        # The official CycloneDX 1.6 schema types ``primitive`` as a string
+        # enum without ``null``: an unclassifiable family is emitted as the
+        # schema-sanctioned "unknown" rather than null (which the schema
+        # rejects) or an omitted key.
+        algo_props["primitive"] = primitive if primitive is not None else "unknown"
+        if detection.key_size_bits is not None:
+            algo_props["parameterSetIdentifier"] = str(detection.key_size_bits)
+        crypto_props["algorithmProperties"] = algo_props
+
+    # --- properties ---
+    properties = [
+        {
+            "name": "ecdat:quantumVulnerable",
+            "value": "true" if detection.quantum_vulnerable else "false",
+        },
+        {
+            "name": "ecdat:classicallyBroken",
+            "value": "true" if detection.classically_broken else "false",
+        },
+        {"name": "ecdat:riskLevel", "value": ra.risk_level if ra else ""},
+        {"name": "ecdat:confidence", "value": str(detection.confidence)},
+        {"name": "ecdat:recommendedAlgorithm", "value": rec.recommended_algorithm if rec else ""},
+        {"name": "ecdat:fipsReference", "value": rec.fips_reference if rec else ""},
+    ]
+
+    return {
+        "type": "cryptographic-asset",
+        "bom-ref": detection.id,
+        "name": detection.algorithm_family,
+        "cryptoProperties": crypto_props,
+        "evidence": {
+            "occurrences": [
+                {"location": detection.file_path, "line": detection.line_number}
+            ]
+        },
+        "properties": properties,
+    }
+
+
+def _top_urgency(
+    detections: list[Detection],
+    risk_lookup: dict[str, RiskAssessment],
+    limit: int = 5,
+) -> list[dict]:
+    """Return the *limit* highest-urgency detections as a list of dicts.
+
+    Each dict contains ``detection_id``, ``algorithm_family``, ``risk_level``,
+    ``urgency_ratio``, ``file_path``, and ``line_number``.
+
+    Args:
+        detections: All detections to consider.
+        risk_lookup: Map from detection ID to its risk assessment.
+        limit: Maximum number of results (default 5).
+
+    Returns:
+        A list of dicts sorted by ``urgency_ratio`` descending.
+    """
+    paired = []
+    for det in detections:
+        ra = risk_lookup.get(det.id)
+        if ra is None:
+            continue
+        paired.append(
+            {
+                "detection_id": det.id,
+                "algorithm_family": det.algorithm_family,
+                "risk_level": ra.risk_level,
+                "urgency_ratio": ra.urgency_ratio,
+                "file_path": det.file_path,
+                "line_number": det.line_number,
+            }
+        )
+    paired.sort(key=lambda item: item["urgency_ratio"], reverse=True)
+    return paired[:limit]