add permissions in package.json