@shrkcrft/inspector 0.1.0-alpha.1

package/dist/ci-permissions-fix.d.ts

@@ -0,0 +1,38 @@
+/**
+ * CI permissions auto-fix preview.
+ *
+ * Reads the structured audit produced by `auditCiWorkflow` and returns a
+ * suggested edit — never writes. Output formats: `patch`, `markdown`, `json`.
+ *
+ * Heuristics:
+ *  - comment-posting step detected but no `pull-requests: write` → suggest
+ *    adding a permissions block.
+ *  - `pull-requests: write` requested but no comment-posting step → suggest
+ *    narrowing to `contents: read`.
+ *  - top-level permissions block missing → suggest the least-privilege
+ *    default for the provider.
+ */
+import type { ICiPermissionsAudit, CiProviderForAudit } from './ci-permissions.js';
+export declare const CI_PERMISSIONS_FIX_SCHEMA = "sharkcraft.ci-permissions-fix/v1";
+export type CiPermissionsFixFormat = 'patch' | 'markdown' | 'json';
+export interface ICiPermissionsFixHint {
+    code: 'add-permissions-block' | 'add-pull-requests-write' | 'narrow-permissions-block' | 'remove-pull-requests-write' | 'pin-action-sha' | 'pin-image-digest' | 'requires-manual' | 'add-oidc-block' | 'add-id-tokens-block' | 'add-azure-permissions-block' | 'no-action-required';
+    severity: 'info' | 'warning' | 'error';
+    message: string;
+    explanation: string;
+    /** Unified-diff style suggestion (best-effort, deterministic). */
+    patch?: string;
+    /** Plain text that an editor can paste in. */
+    insertion?: string;
+}
+export interface ICiPermissionsFixPreview {
+    schema: typeof CI_PERMISSIONS_FIX_SCHEMA;
+    provider: CiProviderForAudit;
+    workflowFile: string;
+    hints: readonly ICiPermissionsFixHint[];
+    /** Combined unified diff, or empty if no actionable hint. */
+    combinedPatch: string;
+}
+export declare function buildCiPermissionsFixPreview(audit: ICiPermissionsAudit): ICiPermissionsFixPreview;
+export declare function renderCiPermissionsFixPreview(preview: ICiPermissionsFixPreview, format: CiPermissionsFixFormat): string;
+//# sourceMappingURL=ci-permissions-fix.d.ts.map

package/dist/ci-permissions-fix.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ci-permissions-fix.d.ts","sourceRoot":"","sources":["../src/ci-permissions-fix.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,KAAK,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAEnF,eAAO,MAAM,yBAAyB,qCAAqC,CAAC;AAE5E,MAAM,MAAM,sBAAsB,GAAG,OAAO,GAAG,UAAU,GAAG,MAAM,CAAC;AAEnE,MAAM,WAAW,qBAAqB;IACpC,IAAI,EACA,uBAAuB,GACvB,yBAAyB,GACzB,0BAA0B,GAC1B,4BAA4B,GAC5B,gBAAgB,GAChB,kBAAkB,GAClB,iBAAiB,GACjB,gBAAgB,GAChB,qBAAqB,GACrB,6BAA6B,GAC7B,oBAAoB,CAAC;IACzB,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC;IACvC,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,kEAAkE;IAClE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,8CAA8C;IAC9C,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,wBAAwB;IACvC,MAAM,EAAE,OAAO,yBAAyB,CAAC;IACzC,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,SAAS,qBAAqB,EAAE,CAAC;IACxC,6DAA6D;IAC7D,aAAa,EAAE,MAAM,CAAC;CACvB;AAoPD,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,mBAAmB,GAAG,wBAAwB,CAkFjG;AA+CD,wBAAgB,6BAA6B,CAC3C,OAAO,EAAE,wBAAwB,EACjC,MAAM,EAAE,sBAAsB,GAC7B,MAAM,CAoCR"}

package/dist/ci-permissions-fix.js

@@ -0,0 +1,382 @@
+/**
+ * CI permissions auto-fix preview.
+ *
+ * Reads the structured audit produced by `auditCiWorkflow` and returns a
+ * suggested edit — never writes. Output formats: `patch`, `markdown`, `json`.
+ *
+ * Heuristics:
+ *  - comment-posting step detected but no `pull-requests: write` → suggest
+ *    adding a permissions block.
+ *  - `pull-requests: write` requested but no comment-posting step → suggest
+ *    narrowing to `contents: read`.
+ *  - top-level permissions block missing → suggest the least-privilege
+ *    default for the provider.
+ */
+import { existsSync, readFileSync } from 'node:fs';
+export const CI_PERMISSIONS_FIX_SCHEMA = 'sharkcraft.ci-permissions-fix/v1';
+function leastPrivilegeBlock(provider, withPullRequestsWrite) {
+    if (provider === 'github-actions') {
+        return withPullRequestsWrite
+            ? 'permissions:\n  contents: read\n  pull-requests: write\n'
+            : 'permissions:\n  contents: read\n';
+    }
+    if (provider === 'gitlab') {
+        return withPullRequestsWrite
+            ? '# GitLab CI uses CI/CD variables, not file-level permissions.\n# Store a Project Access Token with `api` scope as a masked variable\n# named REVIEW_TOKEN, then reference it in the comment-posting job:\n#   variables:\n#     GIT_STRATEGY: clone\n#   id_tokens:\n#     GITLAB_OIDC_TOKEN:\n#       aud: https://gitlab.example.com\n'
+            : '# GitLab CI uses CI/CD variables, not file-level permissions.\n# $CI_JOB_TOKEN is read-only for repo metadata — no extra scopes required.\n';
+    }
+    if (provider === 'bitbucket') {
+        return withPullRequestsWrite
+            ? 'oidc: true   # add to each step that needs write scopes — pair with a repo access token in Bitbucket settings\n'
+            : '# Bitbucket Pipelines has no top-level permissions block.\n# Use repository access tokens (Bitbucket settings → Access tokens) and store them as secured variables.\n';
+    }
+    if (provider === 'azure') {
+        return withPullRequestsWrite
+            ? 'permissions:\n  contents: read\n  pull-requests: write   # Azure Pipelines job-level permissions (recent feature)\n'
+            : 'permissions:\n  contents: read\n';
+    }
+    if (provider === 'jenkins') {
+        return '// Jenkins permissions are configured in Manage Jenkins → Security → Authorization.\n// Use Matrix-based or Role-based security; the Jenkinsfile itself cannot grant or restrict scopes.\n';
+    }
+    return '# (least-privilege block — provider-specific)\n';
+}
+function makeAddPermissionsBlockPatch(file, body, withPullRequestsWrite) {
+    const block = leastPrivilegeBlock('github-actions', withPullRequestsWrite);
+    // Insert after the first `name:` line at the top level.
+    const lines = body.split(/\r?\n/);
+    let nameLine = -1;
+    for (let i = 0; i < lines.length; i += 1) {
+        if (/^name:\s+/.test(lines[i])) {
+            nameLine = i;
+            break;
+        }
+    }
+    if (nameLine < 0)
+        nameLine = 0;
+    const blockLines = block.split(/\r?\n/).filter((l) => l.length > 0);
+    const patch = [
+        `--- a/${file}`,
+        `+++ b/${file}`,
+        `@@ -${nameLine + 1},1 +${nameLine + 1},${1 + blockLines.length} @@`,
+        ` ${lines[nameLine] ?? ''}`,
+        ...blockLines.map((l) => `+${l}`),
+    ];
+    return patch.join('\n') + '\n';
+}
+function makeInsertAfterTopLineMatchingPatch(file, body, matcher, block) {
+    const lines = body.split(/\r?\n/);
+    let anchor = -1;
+    for (let i = 0; i < lines.length; i += 1) {
+        if (matcher.test(lines[i])) {
+            anchor = i;
+            break;
+        }
+    }
+    if (anchor < 0)
+        anchor = 0;
+    const blockLines = block.split(/\r?\n/).filter((l) => l.length > 0);
+    return [
+        `--- a/${file}`,
+        `+++ b/${file}`,
+        `@@ -${anchor + 1},1 +${anchor + 1},${1 + blockLines.length} @@`,
+        ` ${lines[anchor] ?? ''}`,
+        ...blockLines.map((l) => `+${l}`),
+    ].join('\n') + '\n';
+}
+function emitGitlabHints(audit, body) {
+    const hints = [];
+    if (audit.postsComments) {
+        const block = 'id_tokens:\n  GITLAB_OIDC_TOKEN:\n    aud: https://gitlab.example.com   # replace with your GitLab host\n';
+        // Anchor after the first `stages:` line if present, otherwise top.
+        const hasIdTokens = /\bid_tokens:\s*$/m.test(body);
+        if (hasIdTokens) {
+            hints.push({
+                code: 'requires-manual',
+                severity: 'info',
+                message: 'Pipeline already declares `id_tokens:` — confirm the `aud:` matches your GitLab instance and the consuming script trades the OIDC token for a scoped access token.',
+                explanation: 'GitLab CI has no native permissions block. Least-privilege comes from OIDC + a Project Access Token with `api` scope on the consuming job.',
+                insertion: leastPrivilegeBlock('gitlab', true),
+            });
+        }
+        else {
+            hints.push({
+                code: 'add-id-tokens-block',
+                severity: 'warning',
+                message: 'Pipeline posts MR comments without declaring an `id_tokens:` block — comment-posting will require a long-lived PRIVATE-TOKEN, which is harder to rotate.',
+                explanation: 'Use GitLab OIDC: declare `id_tokens.GITLAB_OIDC_TOKEN.aud` on the job, then exchange the token for a Project Access Token at runtime. Avoids storing long-lived secrets in CI/CD variables.',
+                patch: body ? makeInsertAfterTopLineMatchingPatch(audit.workflowFile, body, /^\s*stages:\s*$/, block) : undefined,
+                insertion: block,
+            });
+        }
+    }
+    else {
+        hints.push({
+            code: 'no-action-required',
+            severity: 'info',
+            message: 'No MR-comment-posting step detected — $CI_JOB_TOKEN is sufficient and no scoped token is required.',
+            explanation: 'GitLab CI runs each job with a read-only $CI_JOB_TOKEN by default; only enable write scopes (Project Access Tokens) on jobs that actually mutate the project.',
+        });
+    }
+    return hints;
+}
+function emitBitbucketHints(audit, body) {
+    const hints = [];
+    const hasOidc = /\boidc:\s*true\b/.test(body);
+    if (audit.postsComments && !hasOidc) {
+        const block = '      oidc: true   # exchange for a scoped repo access token at runtime\n';
+        hints.push({
+            code: 'add-oidc-block',
+            severity: 'warning',
+            message: 'Pipeline posts PR comments without declaring `oidc: true` — pair the comment-posting step with OIDC + a repository access token instead of a long-lived secret.',
+            explanation: 'Bitbucket Pipelines has no top-level permissions block; least-privilege comes from `oidc: true` + a repo-scoped access token configured in Bitbucket settings.',
+            patch: body
+                ? makeInsertAfterTopLineMatchingPatch(audit.workflowFile, body, /^\s*-\s*step:\s*$/, block)
+                : undefined,
+            insertion: block,
+        });
+    }
+    else if (!audit.postsComments) {
+        hints.push({
+            code: 'no-action-required',
+            severity: 'info',
+            message: 'No PR-comment-posting step detected — the default repository access token is read-only.',
+            explanation: 'Bitbucket Pipelines does not require explicit permissions for read-only operations. Avoid checking long-lived tokens into the file regardless.',
+        });
+    }
+    else {
+        hints.push({
+            code: 'requires-manual',
+            severity: 'info',
+            message: 'Pipeline already declares `oidc: true`. Confirm the consuming step exchanges the token for the minimum repo scope it needs.',
+            explanation: 'OIDC exchange happens at runtime — the workflow file cannot enforce the resulting token\'s scope. Audit the API calls in the step.',
+            insertion: leastPrivilegeBlock('bitbucket', true),
+        });
+    }
+    return hints;
+}
+function emitAzureHints(audit, body) {
+    const hints = [];
+    const hasPermissions = /^\s*permissions:\s*$/m.test(body);
+    if (audit.postsComments && !hasPermissions) {
+        const block = leastPrivilegeBlock('azure', true);
+        hints.push({
+            code: 'add-azure-permissions-block',
+            severity: 'warning',
+            message: 'Pipeline posts PR comments without declaring a job-level `permissions:` block. Azure Pipelines now supports job-level permissions — use them to scope the System.AccessToken.',
+            explanation: 'When the job-level `permissions:` feature is enabled on the project, Azure Pipelines restricts System.AccessToken to the scopes you list. Without the block, the token defaults to the project-level setting.',
+            patch: body
+                ? makeInsertAfterTopLineMatchingPatch(audit.workflowFile, body, /^\s*(jobs|stages):\s*$/, block)
+                : undefined,
+            insertion: block,
+        });
+    }
+    else if (!audit.postsComments) {
+        hints.push({
+            code: 'no-action-required',
+            severity: 'info',
+            message: 'No PR-comment-posting step detected — the default Build Service token is read-only for repo metadata.',
+            explanation: 'Azure Pipelines defaults the System.AccessToken to project-scoped read; only enable write scopes when the pipeline mutates repo state.',
+        });
+    }
+    else {
+        hints.push({
+            code: 'requires-manual',
+            severity: 'info',
+            message: 'Pipeline already declares a `permissions:` block. Confirm it lists only the scopes the comment-posting job needs (typically `contents: read` + `pull-requests: write`).',
+            explanation: 'Azure Pipelines permissions blocks are additive per job — make sure broader scopes are not granted to unrelated jobs.',
+            insertion: leastPrivilegeBlock('azure', true),
+        });
+    }
+    return hints;
+}
+function emitJenkinsHints(audit) {
+    return [
+        {
+            code: 'requires-manual',
+            severity: audit.postsComments ? 'warning' : 'info',
+            message: audit.postsComments
+                ? 'Jenkinsfile posts PR comments — declarative pipelines cannot grant permissions; this is configured in Jenkins itself.'
+                : 'Jenkinsfile detected — declarative pipelines cannot grant permissions; this is configured in Jenkins itself.',
+            explanation: 'Jenkins permissions are administered via Manage Jenkins → Security → Authorization (Matrix-based or Role-based plugin). Edit there, not in the Jenkinsfile. The pipeline\'s `withCredentials(...)` block scopes secrets to a step but does not grant repository write access on its own.',
+            insertion: leastPrivilegeBlock('jenkins', audit.postsComments),
+        },
+    ];
+}
+function makeNarrowPermissionsPatch(file, body) {
+    // Find the broad permission lines and propose replacing each with
+    // `contents: read`.
+    const lines = body.split(/\r?\n/);
+    const out = [];
+    for (let i = 0; i < lines.length; i += 1) {
+        const m = /^(\s*)(contents|pull-requests|issues|deployments|actions):\s*write\b/.exec(lines[i]);
+        if (m) {
+            const indent = m[1] ?? '';
+            const scope = m[2] ?? 'contents';
+            out.push(`--- a/${file}`);
+            out.push(`+++ b/${file}`);
+            out.push(`@@ -${i + 1},1 +${i + 1},1 @@`);
+            out.push(`-${lines[i] ?? ''}`);
+            out.push(`+${indent}${scope === 'pull-requests' ? 'pull-requests: read' : 'contents: read'}`);
+        }
+    }
+    return out.length === 0 ? '' : out.join('\n') + '\n';
+}
+export function buildCiPermissionsFixPreview(audit) {
+    const hints = [];
+    if (!audit.exists) {
+        hints.push({
+            code: 'no-action-required',
+            severity: 'error',
+            message: 'Workflow file does not exist — nothing to fix.',
+            explanation: 'Run `shrk ci scaffold` first to produce a workflow, then re-run the audit.',
+        });
+        return {
+            schema: CI_PERMISSIONS_FIX_SCHEMA,
+            provider: audit.provider,
+            workflowFile: audit.workflowFile,
+            hints,
+            combinedPatch: '',
+        };
+    }
+    let body = '';
+    try {
+        body = existsSync(audit.workflowFile) ? readFileSync(audit.workflowFile, 'utf8') : '';
+    }
+    catch {
+        body = '';
+    }
+    // Non-GHA providers: emit provider-specific hints and return early.
+    if (audit.provider === 'gitlab') {
+        for (const h of emitGitlabHints(audit, body))
+            hints.push(h);
+        return finalize(audit, hints);
+    }
+    if (audit.provider === 'bitbucket') {
+        for (const h of emitBitbucketHints(audit, body))
+            hints.push(h);
+        return finalize(audit, hints);
+    }
+    if (audit.provider === 'azure') {
+        for (const h of emitAzureHints(audit, body))
+            hints.push(h);
+        return finalize(audit, hints);
+    }
+    if (audit.provider === 'jenkins') {
+        for (const h of emitJenkinsHints(audit))
+            hints.push(h);
+        return finalize(audit, hints);
+    }
+    const isGha = audit.provider === 'github-actions';
+    const missingPermsBlock = audit.findings.some((f) => f.code === 'permissions-block-missing');
+    // Case 1: comment-posting requested but no permissions block (or no pull-requests: write).
+    if (isGha && audit.postsComments && !audit.requestsWritePermissions) {
+        hints.push({
+            code: 'add-pull-requests-write',
+            severity: 'error',
+            message: 'Workflow posts PR comments but does not declare `pull-requests: write`. The comment step will 403 at runtime.',
+            explanation: 'Add a top-level `permissions:` block with `contents: read` + `pull-requests: write`. Scope to the comment-posting job if possible.',
+            patch: body ? makeAddPermissionsBlockPatch(audit.workflowFile, body, true) : undefined,
+            insertion: leastPrivilegeBlock(audit.provider, true),
+        });
+    }
+    // Case 2: pull-requests: write requested but no comment-posting step.
+    if (isGha && audit.requestsWritePermissions && !audit.postsComments) {
+        hints.push({
+            code: 'remove-pull-requests-write',
+            severity: 'warning',
+            message: '`pull-requests: write` requested but no comment-posting step detected — narrow to `contents: read`.',
+            explanation: 'Wider permission tokens leak more credentials when an action is compromised. Only enable write scopes on the step that needs them.',
+            patch: body ? makeNarrowPermissionsPatch(audit.workflowFile, body) : undefined,
+            insertion: leastPrivilegeBlock(audit.provider, false),
+        });
+    }
+    // Case 3: no permissions block at all.
+    if (isGha && missingPermsBlock && !audit.postsComments) {
+        hints.push({
+            code: 'add-permissions-block',
+            severity: 'info',
+            message: 'No top-level `permissions:` block — workflow inherits the repository default. Add `contents: read` to lock down the token explicitly.',
+            explanation: 'Even if the repo default looks read-only, explicit permissions blocks are reviewer-friendly and survive default changes.',
+            patch: body ? makeAddPermissionsBlockPatch(audit.workflowFile, body, false) : undefined,
+            insertion: leastPrivilegeBlock(audit.provider, false),
+        });
+    }
+    return finalize(audit, hints);
+}
+function finalize(audit, hints) {
+    // Supply-chain hints — provider-agnostic.
+    if (audit.externalActions.length > 0) {
+        hints.push({
+            code: 'pin-action-sha',
+            severity: 'info',
+            message: `Uses ${audit.externalActions.length} external action(s). Pin each to an immutable SHA when reproducibility matters.`,
+            explanation: 'Tag-based references (`@v4`) are mutable. Pinning the action SHA mitigates supply-chain swap-outs.',
+        });
+    }
+    if (audit.externalImages.length > 0) {
+        hints.push({
+            code: 'pin-image-digest',
+            severity: 'info',
+            message: `Uses ${audit.externalImages.length} external image(s). Consider pinning by digest.`,
+            explanation: 'Tag-based image references can be rewritten after a vulnerability. Pinning to `@sha256:…` is sturdier.',
+        });
+    }
+    if (hints.length === 0) {
+        hints.push({
+            code: 'no-action-required',
+            severity: 'info',
+            message: 'Permissions audit looks tight — no automated fix to suggest.',
+            explanation: 'The workflow already requests least privilege for its detected steps. Continue to review external actions on each upgrade.',
+        });
+    }
+    const combinedPatch = hints
+        .map((h) => h.patch)
+        .filter((p) => Boolean(p))
+        .join('\n');
+    return {
+        schema: CI_PERMISSIONS_FIX_SCHEMA,
+        provider: audit.provider,
+        workflowFile: audit.workflowFile,
+        hints,
+        combinedPatch,
+    };
+}
+export function renderCiPermissionsFixPreview(preview, format) {
+    if (format === 'json')
+        return JSON.stringify(preview, null, 2) + '\n';
+    if (format === 'patch') {
+        if (preview.combinedPatch)
+            return preview.combinedPatch;
+        return '# No actionable diff — see the markdown report for explanation.\n';
+    }
+    const lines = [];
+    lines.push(`# CI permissions fix preview — \`${preview.workflowFile}\``);
+    lines.push('');
+    lines.push(`Provider: \`${preview.provider}\``);
+    lines.push('');
+    for (const h of preview.hints) {
+        lines.push(`## ${h.code} _(${h.severity})_`);
+        lines.push('');
+        lines.push(h.message);
+        lines.push('');
+        lines.push(h.explanation);
+        if (h.insertion) {
+            lines.push('');
+            lines.push('Suggested insertion:');
+            lines.push('');
+            lines.push('```yaml');
+            lines.push(h.insertion.trimEnd());
+            lines.push('```');
+        }
+        if (h.patch) {
+            lines.push('');
+            lines.push('Suggested patch:');
+            lines.push('');
+            lines.push('```diff');
+            lines.push(h.patch.trimEnd());
+            lines.push('```');
+        }
+        lines.push('');
+    }
+    return lines.join('\n');
+}

package/dist/ci-permissions.d.ts

@@ -0,0 +1,51 @@
+/**
+ * CI workflow permissions audit.
+ *
+ * Reads a workflow YAML and produces a structured assessment of:
+ *  - which write scopes the workflow requests,
+ *  - whether the workflow posts comments,
+ *  - whether it uses external actions or container images,
+ *  - whether it uploads artifacts,
+ *  - a least-privilege recommendation.
+ *
+ * The audit is intentionally regex-based — no YAML parser, no network
+ * resolution. The goal is "deterministic explanation of what this file
+ * implies", not full schema validation.
+ */
+export declare const CI_PERMISSIONS_AUDIT_SCHEMA = "sharkcraft.ci-permissions-audit/v1";
+export type CiProviderForAudit = 'github-actions' | 'gitlab' | 'bitbucket' | 'azure' | 'jenkins';
+export interface ICiPermissionsFinding {
+    code: 'permissions-block-missing' | 'permissions-write-requested' | 'comment-posting-detected' | 'token-usage' | 'external-action' | 'external-image' | 'artifact-upload' | 'shell-step';
+    severity: 'info' | 'warning' | 'error';
+    message: string;
+    /** Lines (1-indexed) in the workflow where the finding was triggered. */
+    lines: readonly number[];
+    /** Optional remediation hint. */
+    suggestion?: string;
+}
+export interface ICiPermissionsAudit {
+    schema: typeof CI_PERMISSIONS_AUDIT_SCHEMA;
+    provider: CiProviderForAudit;
+    workflowFile: string;
+    exists: boolean;
+    /** Top-level summary booleans for quick consumption. */
+    postsComments: boolean;
+    requestsWritePermissions: boolean;
+    usesTokens: boolean;
+    externalActions: readonly string[];
+    externalImages: readonly string[];
+    uploadsArtifacts: boolean;
+    findings: readonly ICiPermissionsFinding[];
+    /** Recommended least-privilege block (provider-specific). */
+    recommendation: string;
+    /** Free-form notes for the human reviewer. */
+    notes: readonly string[];
+}
+export interface IAuditCiWorkflowInput {
+    /** Absolute path to the workflow file. */
+    file: string;
+    /** Override the detected provider (useful when the filename is non-standard). */
+    provider?: CiProviderForAudit | null;
+}
+export declare function auditCiWorkflow(input: IAuditCiWorkflowInput): ICiPermissionsAudit;
+//# sourceMappingURL=ci-permissions.d.ts.map

package/dist/ci-permissions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ci-permissions.d.ts","sourceRoot":"","sources":["../src/ci-permissions.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,2BAA2B,uCAAuC,CAAC;AAEhF,MAAM,MAAM,kBAAkB,GAAG,gBAAgB,GAAG,QAAQ,GAAG,WAAW,GAAG,OAAO,GAAG,SAAS,CAAC;AAEjG,MAAM,WAAW,qBAAqB;IACpC,IAAI,EACA,2BAA2B,GAC3B,6BAA6B,GAC7B,0BAA0B,GAC1B,aAAa,GACb,iBAAiB,GACjB,gBAAgB,GAChB,iBAAiB,GACjB,YAAY,CAAC;IACjB,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC;IACvC,OAAO,EAAE,MAAM,CAAC;IAChB,yEAAyE;IACzE,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IACzB,iCAAiC;IACjC,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,OAAO,2BAA2B,CAAC;IAC3C,QAAQ,EAAE,kBAAkB,CAAC;IAC7B,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,OAAO,CAAC;IAChB,wDAAwD;IACxD,aAAa,EAAE,OAAO,CAAC;IACvB,wBAAwB,EAAE,OAAO,CAAC;IAClC,UAAU,EAAE,OAAO,CAAC;IACpB,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,gBAAgB,EAAE,OAAO,CAAC;IAC1B,QAAQ,EAAE,SAAS,qBAAqB,EAAE,CAAC;IAC3C,6DAA6D;IAC7D,cAAc,EAAE,MAAM,CAAC;IACvB,8CAA8C;IAC9C,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;CAC1B;AAwWD,MAAM,WAAW,qBAAqB;IACpC,0CAA0C;IAC1C,IAAI,EAAE,MAAM,CAAC;IACb,iFAAiF;IACjF,QAAQ,CAAC,EAAE,kBAAkB,GAAG,IAAI,CAAC;CACtC;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,qBAAqB,GAAG,mBAAmB,CAmEjF"}