credvault 0.9.0 → 0.10.0

package/LICENSE.md

@@ -0,0 +1,61 @@
+# PolyForm Strict License 1.0.0
+
+<https://polyformproject.org/licenses/strict/1.0.0>
+
+## Acceptance
+
+In order to get any license under these terms, you must agree to them as both strict obligations and conditions to all your licenses.
+
+## Copyright License
+
+The licensor grants you a copyright license for the software to do everything you might do with the software that would otherwise infringe the licensor's copyright in it for any permitted purpose, other than distributing the software or making changes or new works based on the software.
+
+## Patent License
+
+The licensor grants you a patent license for the software that covers patent claims the licensor can license, or becomes able to license, that you would infringe by using the software.
+
+## Noncommercial Purposes
+
+Any noncommercial purpose is a permitted purpose.
+
+## Personal Uses
+
+Personal use for research, experiment, and testing for the benefit of public knowledge, personal study, private entertainment, hobby projects, amateur pursuits, or religious observance, without any anticipated commercial application, is use for a permitted purpose.
+
+## Noncommercial Organizations
+
+Use by any charitable organization, educational institution, public research organization, public safety or health organization, environmental protection organization, or government institution is use for a permitted purpose regardless of the source of funding or obligations resulting from the funding.
+
+## Fair Use
+
+You may have "fair use" rights for the software under the law. These terms do not limit them.
+
+## No Other Rights
+
+These terms do not allow you to sublicense or transfer any of your licenses to anyone else, or prevent the licensor from granting licenses to anyone else.  These terms do not imply any other licenses.
+
+## Patent Defense
+
+If you make any written claim that the software infringes or contributes to infringement of any patent, your patent license for the software granted under these terms ends immediately. If your company makes such a claim, your patent license ends immediately for work on behalf of your company.
+
+## Violations
+
+The first time you are notified in writing that you have violated any of these terms, or done anything with the software not covered by your licenses, your licenses can nonetheless continue if you come into full compliance with these terms, and take practical steps to correct past violations, within 32 days of receiving notice.  Otherwise, all your licenses end immediately.
+
+## No Liability
+
+***As far as the law allows, the software comes as is, without any warranty or condition, and the licensor will not be liable to you for any damages arising out of these terms or the use or nature of the software, under any kind of legal claim.***
+
+## Definitions
+
+The **licensor** is the individual or entity offering these terms, and the **software** is the software the licensor makes available under these terms.
+
+**You** refers to the individual or entity agreeing to these terms.
+
+**Your company** is any legal entity, sole proprietorship, or other kind of organization that you work for, plus all organizations that have control over, are under the control of, or are under common control with that organization.  **Control** means ownership of substantially all the assets of an entity, or the power to direct its management and policies by vote, contract, or otherwise.  Control can be direct or indirect.
+
+**Your licenses** are all the licenses granted to you for the software under these terms.
+
+**Use** means anything you do with the software requiring one of your licenses.
+
+Required Notice: Copyright 2026 William Jin (https://wrenautomation.com)

package/README.md

@@ -26,6 +26,7 @@ npm install credvault
 | `canaryStore(store)` | Reading a tripwire credential records it, tells a person, and throws. |
 | `totp(seed)` | The current code from a TOTP seed. `findTotpSecret(pageText)` finds the seed on an enrollment page. |
 | `newPassword()` | 24 characters, every class, no look-alikes. |
+| `ownerCredentials({ roleArn, owner, region })` | One app, many owners: an AWS session tagged `owner=<owner>` from one shared role, renewed before it ends. `ownerSsmClient` wraps it; `ownerPath("/myapp", "acme")` = `/myapp/owners/acme`. |
 
 ## Example
 
@@ -42,11 +43,34 @@ await keys.put("NPM_TOKEN", token, { expiresAt: "2026-12-21T00:00:00Z" });
 const soon = expiring(await keys.list(), 14 * 86_400_000);
 ```
 
+## Owners
+
+One role serves every owner. Its policy names the session tag, so a session
+reaches only its owner's path, and a session without the tag reaches nothing:
+
+```json
+{
+  "Effect": "Allow",
+  "Action": ["ssm:GetParameter", "ssm:GetParameters", "ssm:GetParametersByPath", "ssm:PutParameter", "ssm:DeleteParameter"],
+  "Resource": [
+    "arn:aws:ssm:*:*:parameter/myapp/owners/${aws:PrincipalTag/owner}",
+    "arn:aws:ssm:*:*:parameter/myapp/owners/${aws:PrincipalTag/owner}/*"
+  ]
+}
+```
+
+Its trust policy allows `sts:AssumeRole` and `sts:TagSession`, with the
+`owner` tag required. Add `kms:Decrypt`/`Encrypt` on the SSM key, and
+`ssm:DescribeParameters` on `*` (it cannot be scoped: names show, values
+never). `ownerSsmClient({ roleArn, owner: "acme", region })` then hands
+`ssmEnvStore(ssm, ownerPath("/myapp", "acme") + "/config")` a client that
+cannot read another owner.
+
 ## Rules it keeps
 
 - Values never go into argv, logs or error messages. `list` returns names only.
 - A sealed file opened without its key fails loudly. It never fails as a parse error.
 - A wrong write is undone from history. A push that cannot keep the old state writes nothing.
-- Each app has its own Keychain item, SSM path and env prefix, so two apps never share a secret by accident.
+- Each app has its own Keychain item, SSM path and env prefix, so two apps never share a secret by accident. Each owner of an app has its own path and an AWS session that reaches only it.
 
-MIT
+PolyForm Strict 1.0.0: read and personal use only; no commercial use, changes or redistribution. See LICENSE.md.

package/dist/index.d.ts

@@ -5,6 +5,7 @@ export { aesGcmCipher, type Cipher, isSealed, type KeychainItem, keychainKey, pl
 export { CREDENTIAL_ENV_FIELDS, type Credential, type CredentialEnvStore, type CredentialInput, type CredentialStore, credentialEnv, credentialEnvName, credentialSchema, type EnvNaming, envCredentials, fileCredentials, layeredCredentials, memoryCredentials, type PushOptions, pullCredentials, pushCredentials, type SeenVersions, type SharedCredentialStore, type SyncOptions, syncedCredentials, versionsFile, } from "./credentials.js";
 export { ENV_KEY, type EnvEntry, type EnvListing, type EnvStore, envFileStore, expiring, memoryEnvStore, type PutOptions, parseDotenv, ssmEnvStore, syncedEnvStore, toDotenv, toExports, upsertDotenv, } from "./env-store.js";
 export { type CredentialHistory, type CredentialVersion, changedFields, memoryCredentialHistory, ssmCredentialHistory, } from "./history.js";
+export { type AwsCredentials, checkOwner, OWNER_NAME, type OwnerSession, ownerCredentials, ownerPath, ownerSsmClient, } from "./owner.js";
 export { newPassword } from "./passwords.js";
 export { envSecrets, memorySecrets, type SecretSource, type TrackingSecrets, trackingSecrets, } from "./secrets.js";
 export { tailJson, tailLines } from "./tail.js";

package/dist/index.js

@@ -5,6 +5,7 @@ export { aesGcmCipher, isSealed, keychainKey, plainCipher, trustKeychainKey, } f
 export { CREDENTIAL_ENV_FIELDS, credentialEnv, credentialEnvName, credentialSchema, envCredentials, fileCredentials, layeredCredentials, memoryCredentials, pullCredentials, pushCredentials, syncedCredentials, versionsFile, } from "./credentials.js";
 export { ENV_KEY, envFileStore, expiring, memoryEnvStore, parseDotenv, ssmEnvStore, syncedEnvStore, toDotenv, toExports, upsertDotenv, } from "./env-store.js";
 export { changedFields, memoryCredentialHistory, ssmCredentialHistory, } from "./history.js";
+export { checkOwner, OWNER_NAME, ownerCredentials, ownerPath, ownerSsmClient, } from "./owner.js";
 export { newPassword } from "./passwords.js";
 export { envSecrets, memorySecrets, trackingSecrets, } from "./secrets.js";
 export { tailJson, tailLines } from "./tail.js";

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,WAAW,EAAoC,MAAM,YAAY,CAAC;AACtF,OAAO,EAEL,aAAa,EACb,gBAAgB,EAChB,WAAW,EACX,QAAQ,GACT,MAAM,aAAa,CAAC;AACrB,OAAO,EAGL,WAAW,EACX,OAAO,EAEP,WAAW,GACZ,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,YAAY,EAEZ,QAAQ,EAER,WAAW,EACX,WAAW,EACX,gBAAgB,GACjB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,qBAAqB,EAKrB,aAAa,EACb,iBAAiB,EACjB,gBAAgB,EAEhB,cAAc,EACd,eAAe,EACf,kBAAkB,EAClB,iBAAiB,EAEjB,eAAe,EACf,eAAe,EAIf,iBAAiB,EACjB,YAAY,GACb,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,OAAO,EAIP,YAAY,EACZ,QAAQ,EACR,cAAc,EAEd,WAAW,EACX,WAAW,EACX,cAAc,EACd,QAAQ,EACR,SAAS,EACT,YAAY,GACb,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAGL,aAAa,EACb,uBAAuB,EACvB,oBAAoB,GACrB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EACL,UAAU,EACV,aAAa,EAGb,eAAe,GAChB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAChD,OAAO,EACL,YAAY,EACZ,cAAc,EACd,YAAY,EAIZ,IAAI,EACJ,eAAe,GAChB,MAAM,WAAW,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,WAAW,EAAoC,MAAM,YAAY,CAAC;AACtF,OAAO,EAEL,aAAa,EACb,gBAAgB,EAChB,WAAW,EACX,QAAQ,GACT,MAAM,aAAa,CAAC;AACrB,OAAO,EAGL,WAAW,EACX,OAAO,EAEP,WAAW,GACZ,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,YAAY,EAEZ,QAAQ,EAER,WAAW,EACX,WAAW,EACX,gBAAgB,GACjB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,qBAAqB,EAKrB,aAAa,EACb,iBAAiB,EACjB,gBAAgB,EAEhB,cAAc,EACd,eAAe,EACf,kBAAkB,EAClB,iBAAiB,EAEjB,eAAe,EACf,eAAe,EAIf,iBAAiB,EACjB,YAAY,GACb,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,OAAO,EAIP,YAAY,EACZ,QAAQ,EACR,cAAc,EAEd,WAAW,EACX,WAAW,EACX,cAAc,EACd,QAAQ,EACR,SAAS,EACT,YAAY,GACb,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAGL,aAAa,EACb,uBAAuB,EACvB,oBAAoB,GACrB,MAAM,cAAc,CAAC;AACtB,OAAO,EAEL,UAAU,EACV,UAAU,EAEV,gBAAgB,EAChB,SAAS,EACT,cAAc,GACf,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EACL,UAAU,EACV,aAAa,EAGb,eAAe,GAChB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAChD,OAAO,EACL,YAAY,EACZ,cAAc,EACd,YAAY,EAIZ,IAAI,EACJ,eAAe,GAChB,MAAM,WAAW,CAAC"}

package/dist/owner.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Owners: one app, several tenants. Each owner has its own SSM path
+ * (`/myapp/owners/<owner>/…`) and an AWS session that reaches only that
+ * path: one shared role, scoped by the session tag `owner`
+ * (`${aws:PrincipalTag/owner}` in its policy). A session without the tag
+ * reaches nothing. The role's shape is in the README.
+ */
+import { SSMClient } from "@aws-sdk/client-ssm";
+import { STSClient } from "@aws-sdk/client-sts";
+/** An owner's name: lowercase letters, digits and `_`, starting with a letter. Safe in a path, a tag and a session name. */
+export declare const OWNER_NAME: RegExp;
+export declare function checkOwner(owner: string): string;
+/** An owner's path under an app's root: `ownerPath("/myapp", "acme")` = `/myapp/owners/acme`. */
+export declare function ownerPath(root: string, owner: string): string;
+export interface AwsCredentials {
+    accessKeyId: string;
+    secretAccessKey: string;
+    sessionToken?: string;
+    expiration?: Date;
+}
+export interface OwnerSession {
+    /** The shared owners role. */
+    roleArn: string;
+    owner: string;
+    region: string;
+    /** How long a session lasts, in seconds (default 3600). */
+    durationSeconds?: number;
+    /** Default: an STS client on the process's own credentials. */
+    sts?: Pick<STSClient, "send">;
+    now?: () => number;
+}
+/**
+ * The owner's credentials, for any AWS client (`credentials:`): one
+ * AssumeRole with the tag `owner=<owner>`, reused until 5 minutes before it
+ * ends. Callers at the same moment share one request.
+ */
+export declare function ownerCredentials(o: OwnerSession): () => Promise<AwsCredentials>;
+/** An SSM client that acts as the owner. */
+export declare function ownerSsmClient(o: OwnerSession): SSMClient;

package/dist/owner.js

@@ -0,0 +1,67 @@
+/**
+ * Owners: one app, several tenants. Each owner has its own SSM path
+ * (`/myapp/owners/<owner>/…`) and an AWS session that reaches only that
+ * path: one shared role, scoped by the session tag `owner`
+ * (`${aws:PrincipalTag/owner}` in its policy). A session without the tag
+ * reaches nothing. The role's shape is in the README.
+ */
+import { SSMClient } from "@aws-sdk/client-ssm";
+import { AssumeRoleCommand, STSClient } from "@aws-sdk/client-sts";
+/** An owner's name: lowercase letters, digits and `_`, starting with a letter. Safe in a path, a tag and a session name. */
+export const OWNER_NAME = /^[a-z][a-z0-9_]{0,39}$/;
+export function checkOwner(owner) {
+    if (!OWNER_NAME.test(owner))
+        throw new Error(`owner "${owner}": lowercase letters, digits and _, starting with a letter, 40 at most`);
+    return owner;
+}
+/** An owner's path under an app's root: `ownerPath("/myapp", "acme")` = `/myapp/owners/acme`. */
+export function ownerPath(root, owner) {
+    return `${root.replace(/\/+$/, "")}/owners/${checkOwner(owner)}`;
+}
+/** Renew this long before a session ends, so no call carries a dying token. */
+const RENEW_MS = 5 * 60_000;
+/**
+ * The owner's credentials, for any AWS client (`credentials:`): one
+ * AssumeRole with the tag `owner=<owner>`, reused until 5 minutes before it
+ * ends. Callers at the same moment share one request.
+ */
+export function ownerCredentials(o) {
+    const owner = checkOwner(o.owner);
+    const sts = o.sts ?? new STSClient({ region: o.region });
+    const now = o.now ?? Date.now;
+    let current;
+    let pending;
+    const fresh = (c) => c.expiration === undefined || c.expiration.getTime() - now() > RENEW_MS;
+    return () => {
+        if (current && fresh(current))
+            return Promise.resolve(current);
+        pending ??= sts
+            .send(new AssumeRoleCommand({
+            RoleArn: o.roleArn,
+            RoleSessionName: `owner-${owner}`,
+            DurationSeconds: o.durationSeconds ?? 3600,
+            Tags: [{ Key: "owner", Value: owner }],
+        }))
+            .then((out) => {
+            const c = out.Credentials;
+            if (!c?.AccessKeyId || !c.SecretAccessKey)
+                throw new Error(`owner ${owner}: STS answered without credentials`);
+            current = {
+                accessKeyId: c.AccessKeyId,
+                secretAccessKey: c.SecretAccessKey,
+                ...(c.SessionToken ? { sessionToken: c.SessionToken } : {}),
+                ...(c.Expiration ? { expiration: c.Expiration } : {}),
+            };
+            return current;
+        })
+            .finally(() => {
+            pending = undefined;
+        });
+        return pending;
+    };
+}
+/** An SSM client that acts as the owner. */
+export function ownerSsmClient(o) {
+    return new SSMClient({ region: o.region, credentials: ownerCredentials(o) });
+}
+//# sourceMappingURL=owner.js.map

package/dist/owner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"owner.js","sourceRoot":"","sources":["../src/owner.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAEnE,4HAA4H;AAC5H,MAAM,CAAC,MAAM,UAAU,GAAG,wBAAwB,CAAC;AAEnD,MAAM,UAAU,UAAU,CAAC,KAAa;IACtC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC;QACzB,MAAM,IAAI,KAAK,CACb,UAAU,KAAK,wEAAwE,CACxF,CAAC;IACJ,OAAO,KAAK,CAAC;AACf,CAAC;AAED,iGAAiG;AACjG,MAAM,UAAU,SAAS,CAAC,IAAY,EAAE,KAAa;IACnD,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,WAAW,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;AACnE,CAAC;AAqBD,+EAA+E;AAC/E,MAAM,QAAQ,GAAG,CAAC,GAAG,MAAM,CAAC;AAE5B;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,CAAe;IAC9C,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAClC,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,IAAI,IAAI,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IACzD,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IAC9B,IAAI,OAAmC,CAAC;IACxC,IAAI,OAA4C,CAAC;IACjD,MAAM,KAAK,GAAG,CAAC,CAAiB,EAAE,EAAE,CAClC,CAAC,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,GAAG,EAAE,GAAG,QAAQ,CAAC;IAC1E,OAAO,GAAG,EAAE;QACV,IAAI,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC;YAAE,OAAO,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC/D,OAAO,KAAK,GAAG;aACZ,IAAI,CACH,IAAI,iBAAiB,CAAC;YACpB,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,eAAe,EAAE,SAAS,KAAK,EAAE;YACjC,eAAe,EAAE,CAAC,CAAC,eAAe,IAAI,IAAI;YAC1C,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;SACvC,CAAC,CACH;aACA,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE;YACZ,MAAM,CAAC,GAAG,GAAG,CAAC,WAAW,CAAC;YAC1B,IAAI,CAAC,CAAC,EAAE,WAAW,IAAI,CAAC,CAAC,CAAC,eAAe;gBACvC,MAAM,IAAI,KAAK,CAAC,SAAS,KAAK,oCAAoC,CAAC,CAAC;YACtE,OAAO,GAAG;gBACR,WAAW,EAAE,CAAC,CAAC,WAAW;gBAC1B,eAAe,EAAE,CAAC,CAAC,eAAe;gBAClC,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3D,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACtD,CAAC;YACF,OAAO,OAAO,CAAC;QACjB,CAAC,CAAC;aACD,OAAO,CAAC,GAAG,EAAE;YACZ,OAAO,GAAG,SAAS,CAAC;QACtB,CAAC,CAAC,CAAC;QACL,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC;AACJ,CAAC;AAED,4CAA4C;AAC5C,MAAM,UAAU,cAAc,CAAC,CAAe;IAC5C,OAAO,IAAI,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,WAAW,EAAE,gBAAgB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAC/E,CAAC"}

package/package.json

@@ -1,10 +1,10 @@
 {
   "name": "credvault",
-  "version": "0.9.0",
+  "version": "0.10.0",
+  "license": "PolyForm-Strict-1.0.0",
   "packageManager": "pnpm@9.15.0",
   "description": "Keep the credentials an automation signs in with: sealed at rest, shared through SSM, every use audited, expiries watched.",
   "type": "module",
-  "license": "MIT",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
   "exports": {
@@ -15,7 +15,8 @@
   },
   "files": [
     "dist",
-    "README.md"
+    "README.md",
+    "LICENSE.md"
   ],
   "engines": {
     "node": ">=22"
@@ -30,6 +31,7 @@
   },
   "dependencies": {
     "@aws-sdk/client-ssm": "3.1136.0",
+    "@aws-sdk/client-sts": "3.1136.0",
     "zod": "4.6.5"
   },
   "devDependencies": {

package/LICENSE

@@ -1,21 +0,0 @@
-MIT License
-
-Copyright (c) 2026 Wren Automation
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.