diff --git a/doc.go b/doc.go
new file mode 100644
index 0000000..f3c2803
--- /dev/null
+++ b/doc.go
@@ -0,0 +1,8 @@
+// Package ficha issues, validates, and revokes opaque encrypted tokens
+// carrying consumer-defined permissions. Tokens are sealed with
+// XChaCha20-Poly1305 authenticated encryption.
+//
+// Persistence (revocation storage, key storage) is intentionally not
+// part of this package. Consumers provide their own implementations
+// of the small interfaces defined here.
+package ficha
diff --git a/go.mod b/go.mod
new file mode 100644
index 0000000..2813c37
--- /dev/null
+++ b/go.mod
@@ -0,0 +1,8 @@
+module git.juancwu.dev/juancwu/ficha
+
+go 1.26.2
+
+require (
+	golang.org/x/crypto v0.50.0 // indirect
+	golang.org/x/sys v0.43.0 // indirect
+)
diff --git a/go.sum b/go.sum
new file mode 100644
index 0000000..035bcee
--- /dev/null
+++ b/go.sum
@@ -0,0 +1,4 @@
+golang.org/x/crypto v0.50.0 h1:zO47/JPrL6vsNkINmLoo/PH1gcxpls50DNogFvB5ZGI=
+golang.org/x/crypto v0.50.0/go.mod h1:3muZ7vA7PBCE6xgPX7nkzzjiUq87kRItoJQM1Yo8S+Q=
+golang.org/x/sys v0.43.0 h1:Rlag2XtaFTxp19wS8MXlJwTvoh8ArU6ezoyFsMyCTNI=
+golang.org/x/sys v0.43.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=