subcheck 0.2.0__tar.gz

subcheck-0.2.0/.gitattributes

@@ -0,0 +1,10 @@
+# Normalize line endings to LF in the repo (kills the CRLF churn on Windows).
+* text=auto eol=lf
+
+# Explicitly text
+*.py    text eol=lf
+*.json  text eol=lf
+*.toml  text eol=lf
+*.md    text eol=lf
+*.yml   text eol=lf
+*.yaml  text eol=lf

subcheck-0.2.0/.github/dependabot.yml

@@ -0,0 +1,40 @@
+# Dependabot configuration - deliberately low-noise.
+#
+# Non-major updates arrive as ONE grouped PR per ecosystem per month.
+# Security updates stay ungrouped and uncooled so they land fast.
+# Rationale and the estate-wide posture: github.com/Dashtid/estate
+version: 2
+updates:
+  - package-ecosystem: "pip"
+    directory: "/"
+    schedule:
+      interval: "monthly"
+    open-pull-requests-limit: 5
+    cooldown:
+      default-days: 7
+      semver-major-days: 30
+    groups:
+      python-non-major:
+        applies-to: version-updates
+        patterns:
+          - "*"
+        update-types:
+          - "minor"
+          - "patch"
+    labels:
+      - "dependencies"
+
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "monthly"
+    open-pull-requests-limit: 3
+    cooldown:
+      default-days: 7
+    groups:
+      actions-all:
+        applies-to: version-updates
+        patterns:
+          - "*"
+    labels:
+      - "dependencies"

subcheck-0.2.0/.github/workflows/ci.yml

@@ -0,0 +1,34 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.10", "3.11", "3.12", "3.13"]
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v7
+        with:
+          python-version: ${{ matrix.python-version }}
+      - name: Install
+        run: |
+          python -m pip install --upgrade pip
+          pip install -e ".[dev]"
+      - name: Lint (ruff)
+        run: ruff check .
+      - name: Type check (mypy)
+        run: mypy
+      - name: Security lint (bandit)
+        run: bandit -q -r src
+      - name: Tests (pytest)
+        run: pytest -q --cov=subcheck --cov-report=term-missing

subcheck-0.2.0/.github/workflows/release.yml

@@ -0,0 +1,44 @@
+name: Release
+
+# Publishes to PyPI via OIDC trusted publishing (no stored API token) - the same
+# short-lived-token mechanism this tool exists to inspect. Fires when a GitHub
+# Release is published. Requires the PyPI side to be configured once:
+# pypi.org -> project "subcheck" (or a pending publisher before first release) ->
+# owner Dashtid, repository subcheck, workflow release.yml, environment pypi.
+
+on:
+  release:
+    types: [published]
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-python@v7
+        with:
+          python-version: "3.12"
+      - name: Build sdist and wheel
+        run: |
+          python -m pip install --upgrade pip build
+          python -m build
+      - uses: actions/upload-artifact@v6
+        with:
+          name: dist
+          path: dist/
+
+  publish:
+    needs: build
+    runs-on: ubuntu-latest
+    environment: pypi
+    permissions:
+      id-token: write   # OIDC trusted publishing
+    steps:
+      - uses: actions/download-artifact@v7
+        with:
+          name: dist
+          path: dist/
+      - uses: pypa/gh-action-pypi-publish@release/v1

subcheck-0.2.0/.gitignore

@@ -0,0 +1,11 @@
+__pycache__/
+*.py[cod]
+.venv/
+venv/
+*.egg-info/
+build/
+dist/
+.pytest_cache/
+.ruff_cache/
+.coverage
+htmlcov/

subcheck-0.2.0/ARCHITECTURE.md

@@ -0,0 +1,129 @@
+# How subcheck works
+
+A plain-language tour, for picking the project back up after time away.
+
+## The one-sentence version
+
+When a GitHub Actions job authenticates to a cloud, it gets a **token**. subcheck reads that
+token's claims and compares them against a **policy file you wrote**. If they don't match, it exits
+non-zero and your CI step fails.
+
+## The problem it exists for
+
+A GitHub Actions job that needs AWS credentials gets a short-lived token. Inside it is a claim
+called `sub` — a single line of text:
+
+```
+repo:acme/payments-api:ref:refs/heads/main
+```
+
+Read it as: *"this job is running on the main branch of acme/payments-api."*
+
+On the cloud side, an admin writes a **trust condition** — a rule saying which of those strings is
+acceptable. That string-versus-rule comparison **is the entire security boundary**. Write the rule
+too loosely (say `repo:acme/payments-api:*`) and every branch in the repo can reach your
+production credentials.
+
+subcheck sits on the **workflow side**. It doesn't know or care what the cloud rule says. It asks
+one question: *"is the token this job received the one I expected?"* Answering that early turns a
+later, cryptic `AccessDenied` into a readable diff — and catches the case where your token silently
+changed shape (see the immutable-claims migration in the README).
+
+## The flow, end to end
+
+```
+  --token <jwt>            --policy policy.yaml
+        |                          |
+        v                          v
+   decoder.py                 policy.py          "what did I get?"  vs  "what did I expect?"
+   decode_claims()            load_policy_file()
+        |                          |
+    {claims dict}            Policy(rules=[ClaimRule, ...])
+        \                          /
+         \                        /
+          v                      v
+              validator.py  validate()
+                       |
+              [Result, Result, ...]      one per rule: PASS / FAIL / MISSING
+                       |
+                       v
+              report.py  build_report()  -> adds summary counts + advisory notes
+                       |
+                       v
+              to_text() or to_json()
+                       |
+                       v
+              cli.py prints, returns 0 / 1 / 2
+```
+
+## The files
+
+All under `src/subcheck/`. Roughly 400 lines total — small enough to read in one sitting.
+
+| File | What it does |
+|---|---|
+| **`cli.py`** | The entry point. Parses arguments, decides where claims come from, calls everything else in order, prints, and returns the exit code. Start here. |
+| **`decoder.py`** | Turns a JWT string into a claims dictionary. A JWT is three base64 chunks joined by dots; this splits it, decodes the middle one, and parses the JSON. Also holds `parse_github_sub`, which breaks a `sub` string into its parts and detects the legacy vs immutable format. |
+| **`policy.py`** | Reads your YAML/JSON policy file and turns it into a list of `ClaimRule` objects. Also holds `CLAIM_SEVERITY` — the table deciding which claims are "high" severity. |
+| **`validator.py`** | The comparison engine. For each rule, look up the claim and check it (`equals` / `in` / `matches` / `glob`). Produces one `Result` per rule. ~60 lines; the real logic is `_matches()`. |
+| **`report.py`** | Assembles results into a report dict, adds the summary counts and the advisory `notes`, and formats it as text or JSON. |
+
+Tests mirror this one-to-one: `tests/test_decoder.py`, `test_validator.py`, `test_cli.py`,
+`test_report.py`, plus `test_decoder_vectors.py` (see below).
+
+## Two concepts worth knowing
+
+**Exit codes are the product.** `0` = everything matched, `1` = a claim didn't match (this is what
+fails your CI step), `2` = you gave it bad input. A CI gate is just a program with a meaningful
+exit code.
+
+**Notes are advisory, not gating.** `report.py` produces `notes` — hints about the immutable-claims
+migration. They never change pass/fail. They exist because a silently-changed `sub` format is the
+failure mode people don't see coming.
+
+## The subvectors connection
+
+`tests/fixtures/github_subjects.json` holds real GitHub subject strings copied from the
+[subvectors](https://github.com/Dashtid/subvectors) vector suite (CC0, so copying is free).
+`test_decoder_vectors.py` runs each one through `parse_github_sub` and asserts the result matches
+what subvectors says it should be.
+
+**This is test data only.** subcheck does not import subvectors at runtime and never will — the
+dependency is one-way and exists so the two projects can't silently disagree about what a subject
+string means.
+
+## What it deliberately does NOT do
+
+These are decisions, not gaps. See `BACKLOG.md` → Non-goals.
+
+- **It does not verify the token's signature.** It decodes and inspects. Verifying that GitHub
+  really issued the token is the cloud provider's job at role-assumption time. So subcheck is a
+  *misconfiguration catcher, not an authentication control* — someone who controls the workflow can
+  just skip the step.
+- **It does not simulate cloud trust conditions.** Your policy's `glob` is not "what AWS would do."
+  Grading real cloud rules is subvectors' job. Blurring that line risks being wrong in exactly the
+  way subvectors exists to catch.
+- **It is not released.** No PyPI package, no git tag, no `action.yml` — on purpose. The launch is
+  parked until the flagship and the companion article are ready.
+
+## Running it
+
+```bash
+pip install -e ".[dev]"
+
+# decode a token and just look at it
+subcheck --token-file token.txt
+
+# check it against a policy (this is the CI gate)
+subcheck --claims examples/claims-pull-request.json --policy examples/policy.json
+echo $?     # 1 — the sub doesn't match
+
+# see the immutable-migration advisory
+subcheck --claims examples/claims-immutable.json --policy examples/policy.json
+
+# the full check suite (what CI runs)
+pytest -q --cov=subcheck && ruff check . && python -m mypy && bandit -q -r src
+```
+
+> On this machine use `python -m mypy` — a bare `mypy` resolves to a different Python install that
+> lacks the type stubs.

subcheck-0.2.0/BACKLOG.md

@@ -0,0 +1,141 @@
+# Backlog
+
+Granular, current task list for subcheck. Complements [`README.md`](README.md) (what it is) and
+[`CHANGELOG.md`](CHANGELOG.md) (what shipped).
+
+**What subcheck is — and is not.** subcheck decodes the OIDC token a GitHub Actions job actually
+received and asserts its claims against an expectation *you* write. It is the token-author's
+expectation language and a fail-fast CI gate. It is **not** a cloud-trust-condition simulator and
+**not** an authentication control — grading whether a trust *condition* (AWS StringLike / Azure FIC
+/ GCP CEL) is well-formed, matching, and safe lives in the sibling
+[subvectors](https://github.com/Dashtid/subvectors); verifying the JWT signature is the cloud
+provider's job at assume-time. Keep that line sharp (see Non-goals).
+
+**Sequencing.** subvectors is the flagship; subcheck is the finished companion. The original plan
+was to keep subcheck parked until a subvectors v0.1 + article #1 launch burst — but as of
+2026-08-16 that gate has partly fired on its own (subcheck is pinned at public slot #2) while both
+gate conditions remain outside your control. See the DECISION in Phase 4 before doing more here.
+
+Status keys: `[ ]` todo · `[~]` in progress · `[x]` done this cycle.
+
+## Phase 0 — correctness & honesty (done this cycle)
+
+- `[x]` Fix the stale sibling description: subvectors is a conformance test-vector suite, not a
+  "PR gate that maps claims to reachable IAM roles" (the killed `oidc-reach` scanner). Corrected in
+  README tagline + Why section + CONTRIBUTING.
+- `[x]` Fix the README quickstart output to match real output (7 rows, `5 pass, 1 fail, 1 missing`).
+- `[x]` Document that `matches` is unanchored (`re.search`) and that `equals`/`in` are
+  JSON-type-sensitive while `matches`/`glob` stringify.
+- `[x]` Note the `--token <jwt>` argv-leak footgun; steer to `--token -` / `--token-file`.
+- `[x]` Add a "Related tools" cross-link to subvectors (the ecosystem-link half of the family).
+- `[x]` CI: add Python 3.13, add `mypy` (green), add coverage report; ship `py.typed` + add
+  `types-PyYAML` to dev deps.
+- `[x]` Commit + push the above (done; tree clean and in sync).
+- `[ ]` Open follow-up issues for the good-first-issue items below (`gh issue list` returns empty).
+
+## Phase 1 — immutable subject-claims awareness (done this cycle)
+
+The immutable `sub` format (`repo:owner@<owner_id>/repo@<repo_id>:...`) became automatic for
+new/renamed/transferred repos on **2026-07-15**; name-based policies silently stop matching.
+
+- `[x]` Immutable-aware decoder: `parse_github_sub` parses both formats, exposes
+  `repository_id`/`repository_owner_id` and a `format` field. Mirrors the subvectors subject grammar.
+- `[x]` Wire `parse_github_sub` into the engine — used for report **advisories** (format detection +
+  migration hints), *not* a `sub.<component>` DSL. `repository`/`repository_owner`/`ref`/`environment`
+  are already top-level claims, so a parsed-sub DSL would be redundant; revisit only on concrete need.
+- `[x]` Migration advisories (`report["notes"]`): flag a name-based `sub` pin that will break, and
+  hint when an immutable token fails a name-based pattern.
+- `[x]` `repository_id`/`repository_owner_id` ranked high severity (the durable trust anchors).
+- `[x]` Example pair: `examples/claims-immutable.json` + `examples/policy-immutable.json`.
+- `[ ]` (optional) `job_workflow_ref` pinning example + severity — the reusable-workflow supply-chain
+  anchor AWS now exposes as a first-class condition key.
+
+## Phase 2 — first consumer of subvectors (done this cycle)
+
+- `[x]` Vendored subvectors' CC0 GitHub `subject` strings as decoder fixtures
+  (`tests/fixtures/github_subjects.json`, cited); `tests/test_decoder_vectors.py` asserts
+  `parse_github_sub` agrees with the subvectors subject grammar on all 9 (legacy, both immutable ID
+  forms, case-sensitivity, nested-branch ref, tag ref, customized multi-segment sub). One-way,
+  test-time, self-contained (CI-safe) — subvectors is never a runtime dependency.
+- `[ ]` (upstream, separate subvectors session) record subcheck as the corpus's first consumer in
+  subvectors' BACKLOG "Consumer-adoption" item — the adoption datapoint its success metric tracks.
+
+## Phase 3 — ship it properly (DE-GATED 2026-08-22 — decision taken, executed)
+
+- `[x]` `release.yml` — PyPI **trusted publishing (OIDC)**, fires on a published GitHub Release
+  (build job + publish job, `environment: pypi`, `id-token: write`). Version bumped **0.2.0**
+  (immutable-claims support is a feature); CHANGELOG rolled; tag `v0.2.0` pushed (inert until the
+  Release is created).
+- `[x]` `action.yml` composite wrapper — `uses: Dashtid/subcheck@v0.2.0` (or `@main`, which works
+  already: it installs from the action path, no PyPI needed). Inputs passed via `env`, never
+  interpolated into `run:` (the template-injection footgun).
+- `[x]` Topics: added `aws-iam`, `cicd-security`, `supply-chain-security`, `least-privilege`
+  (11 total). Seeded 5 `good first issue` tickets (#2-#6: forbidden rule, SARIF, GitLab sub,
+  `--fail-on`, `--claim-map`).
+- `[ ]` **[HUMAN — the two remaining clicks]** (1) pypi.org → Publishing → add a *pending
+  publisher* for project `subcheck`: owner `Dashtid`, repo `subcheck`, workflow `release.yml`,
+  environment `pypi`. (2) `gh release create v0.2.0 --title "subcheck 0.2.0" --notes-from-tag`
+  (or via UI) — the release event fires the publish. Optionally repeat the pending-publisher step
+  for `subvectors` to reserve that name too.
+
+## Phase 4 — launch (the gate has partly fired on its own)
+
+- `[x]` **Set the GitHub pin** — done, and at slot **#2** (verified 2026-08-16), ahead of its gate.
+- `[ ]` Record the demo GIF/asciinema (a PR failing on `sub=...:pull_request`).
+- `[ ]` Coordinated burst *with subvectors*: article -> Show HN -> one subreddit -> LinkedIn.
+
+> [!] **DECISION NEEDED — the gate no longer holds.** subcheck is pinned on the public profile at
+> slot #2 while its README still says `pip install subcheck  # once published` and PyPI 404s. It is
+> *featured but not installable*, which is the worst of both. Both original gate conditions (a
+> Checkov merge, article #1) are outside your control and still unmet after a month, and the pin
+> already spent the launch signal. **Either de-gate and ship Phase 3, or unpin.** Recommendation:
+> de-gate. Cheap either way: reserve the `subcheck` and `subvectors` PyPI names now (5 min, both
+> currently unregistered and squattable).
+
+## Phase 2.5 — technical-soundness pass (done this cycle)
+
+Driven by a research fan-out (article-saturation + primary-source verification + adversarial
+refutation) before any article gets published. Findings that were *facts*, fixed here:
+
+- `[x]` **The fork claim was wrong.** A fork's `pull_request` cannot mint a token for the upstream
+  repo — `id-token: write` is downgraded and `ACTIONS_ID_TOKEN_REQUEST_TOKEN` is never injected.
+  README now lists the real paths. This error is endemic to the published literature; do not
+  reintroduce it, and it is worth an article of its own (see below).
+- `[x]` Half-immutable subjects (`@id` on one segment) reported as `malformed`, not `immutable`.
+- `[x]` Migration hints suppressed for non-github.com issuers (GHES keeps mutable names).
+- `[x]` Legacy hint no longer implies format follows from repo age (org/repo opt-in exists).
+- `[x]` `repository_id`/`repository_owner_id` provenance corrected (since Jan 2023, pin them now).
+- `[x]` `glob` vs IAM `StringLike` divergence documented (POSIX character classes).
+- `[x]` `job_workflow_ref` promoted to high severity.
+- `[x]` Documented *why* subcheck exists: `runner_environment`, `event_name`, `head_ref`,
+  `base_ref`, `workflow_ref` are **not expressible in an AWS trust policy at all**.
+
+Open follow-ups from the same pass:
+
+- `[ ]` **subvectors carries the same half-immutable tolerance** — `src/subvectors/github.py:56`
+  `RepoSegment.immutable` uses `owner_id is not None or repo_id is not None`. Fix in a subvectors
+  session so the two grammars genuinely agree (subcheck's decoder docstring claims they do).
+- `[ ]` Re-vendor the subject fixtures if subvectors adds a malformed/asymmetric subject vector.
+
+## Correctness / quality parking lot
+
+- `[ ]` `--fail-on <severity>` threshold gating — today any single required-but-missing medium claim
+  fails the whole gate (`report.py` `passed = all(PASS)`); no way to gate on high only.
+- `[ ]` Optional `exp`/`iat`/`nbf` time checks — flag an expired or not-yet-valid token.
+- `[ ]` `forbidden` rule (assert a claim is NOT one of a set). *(good first issue)*
+- `[ ]` SARIF output so findings land in the GitHub Security tab. *(good first issue)*
+- `[ ]` GitLab CI `sub` format support. *(good first issue)*
+- `[ ]` Decide `equals`/`in` type handling: coerce, or keep type-strict + documented (currently the
+  latter).
+- `[ ]` Close test-coverage holes (92% now): `glob` branch, `--token-file`, `--token -` stdin,
+  `load_policy_file` suffix logic, `to_json`/summary counts, and the `rc=2` bad-policy/bad-JSON paths.
+- `[ ]` Cosmetic: rephrase the `# nosec B105` comments so bandit stops emitting "Test in comment"
+  warnings (prose after `# nosec` is parsed as test IDs).
+
+## Non-goals (hold the line)
+
+- No cloud-trust-condition *simulation* (AWS StringLike / Azure FIC exact / GCP CEL matching) — that
+  collides with subvectors and risks being wrong, the exact bug class subvectors exists to grade.
+- No JWT signature/issuer verification — keep the honest "misconfiguration catcher, not auth control"
+  boundary explicit as the tool grows.
+- No scanner / posture / reachability-graph scope creep.

subcheck-0.2.0/CHANGELOG.md

@@ -0,0 +1,58 @@
+# Changelog
+
+All notable changes are documented here. Format based on
+[Keep a Changelog](https://keepachangelog.com/); this project follows
+[Semantic Versioning](https://semver.org/).
+
+## [0.2.0] - 2026-08-22
+
+First published release (PyPI, via OIDC trusted publishing — fittingly, the same mechanism the
+tool inspects). Also ships `action.yml`, so a workflow can gate with
+`uses: Dashtid/subcheck@v0.2.0` instead of a curl+pip snippet.
+
+### Added
+- Immutable subject-claims support: `parse_github_sub` decodes both the legacy and the immutable
+  `repo:owner@id/repo@id:...` `sub` formats, exposing owner/repo IDs and a `format` field.
+- Report `notes`: advisory hints about the 2026-07-15 immutable-format migration (a name-based
+  `sub` pin that will break; a hint when an immutable token fails a name-based pattern).
+- `repository_id` / `repository_owner_id` ranked as high-severity (immutable) trust anchors.
+- `examples/claims-immutable.json` + `examples/policy-immutable.json` (an id-pinned durable policy).
+
+### Changed
+- CI also runs on Python 3.13, type-checks with `mypy`, and reports coverage; the package now
+  ships a `py.typed` marker.
+
+### Fixed
+- **Corrected a factually wrong threat description.** A fork's pull request cannot mint an OIDC
+  token for the upstream repo (GitHub downgrades `id-token: write` and never injects
+  `ACTIONS_ID_TOKEN_REQUEST_TOKEN` for fork `pull_request` runs). The README now names the real
+  paths: push/branch-create access, `pull_request_target` / `workflow_run` with untrusted checkout,
+  and compromised third-party actions in a trusted job.
+- `parse_github_sub` no longer reports a subject carrying an ID on only one segment as
+  `immutable`; that shape is `malformed` (GitHub emits `@id` on both segments or neither) and is
+  surfaced as an advisory note.
+- Migration advisories are suppressed for non-github.com issuers — immutable subject claims are a
+  github.com-only feature, so GitHub Enterprise Server must not be told to migrate.
+- The legacy-format advisory no longer implies the format follows from a repo's age; any repo can
+  opt in early via the org-level or repo-level immutable-subject setting.
+- Corrected `repository_id` / `repository_owner_id` provenance: they have existed since January
+  2023 and work on legacy-format tokens, so they can be pinned today rather than after migrating.
+- Documented that `glob` honours POSIX character classes while IAM `StringLike` treats `[`/`]` as
+  literals, and that `repository_owner` is not an AWS condition key (only `repository_owner_id`).
+- `job_workflow_ref` promoted to high severity — the only claim constraining which workflow code
+  minted the token, and an AWS-accepted alternative identity-provider control to `sub`.
+- README quickstart output now matches the tool's real output (7 rows, `5 pass, 1 fail, 1 missing`).
+- The sibling **subvectors** is described accurately across README/CONTRIBUTING (a conformance
+  test-vector suite, not a reachability PR gate).
+- Documented that `matches` is unanchored (`re.search`) and that `equals`/`in` are JSON-type-sensitive.
+
+## [0.1.0] - 2026-07-15
+
+### Added
+- Decode a GitHub Actions OIDC JWT's claims (`--token` / `--token-file` / `--claims`),
+  without signature verification (inspection only).
+- Expected-claims policy in YAML or JSON: `equals`, `in`, `matches`, `glob`, `required`,
+  plus `issuer`/`audience` shortcuts.
+- Validation with per-claim severity and `PASS` / `FAIL` / `MISSING` results.
+- Text and JSON reports; non-zero exit on any finding for use as a CI gate.
+- `parse_github_sub` helper for the GitHub `sub` claim.

subcheck-0.2.0/CONTRIBUTING.md

@@ -0,0 +1,28 @@
+# Contributing
+
+Thanks for looking. This is a small, focused tool — decode GitHub Actions OIDC claims and
+validate them against a policy. It stays deliberately small: it asserts a token against an
+expectation *you* write, and deliberately does **not** simulate a cloud's trust-condition
+semantics — grading whether a trust condition is well-formed, matching, and safe lives in the
+sibling [subvectors](https://github.com/Dashtid/subvectors) vector suite.
+
+## Setup
+
+```bash
+pip install -e ".[dev]"
+pytest -q && ruff check . && bandit -r src
+```
+
+## Good first issues
+
+Small, self-contained additions (labelled `good first issue`):
+
+- Support the GitLab CI OIDC token `sub` format alongside GitHub's.
+- Add a `forbidden` rule (assert a claim is NOT one of a set of values).
+- Add `--claim-map` to normalise provider-specific claim names before validation.
+- Emit [SARIF](https://sarifweb.azurewebsites.net/) so findings show up in the GitHub Security tab.
+
+## Pull requests
+
+Keep the change focused, add a test, and make sure `pytest`, `ruff check`, and `bandit` pass.
+Not sure about scope? Open an issue first — open questions are welcome.

subcheck-0.2.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 David Dashti
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.