Add windows/arm64 KMS plugin asset stub so all release targets build

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

.boundary-version

@@ -0,0 +1 @@
+1.0.1+ent

.gitea/workflows/ci.yml

@@ -0,0 +1,48 @@
+name: ci
+
+on:
+  push:
+    branches: [main]
+    tags-ignore: ['**']
+  workflow_dispatch:
+  schedule:
+    - cron: '17 6 * * *'
+
+env:
+  GOPRIVATE: repo.anhonesthost.net
+  GOFLAGS: -buildvcs=false
+
+jobs:
+  ci:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+          cache: false
+
+      - name: Build
+        run: go build ./...
+
+      - name: Vet
+        run: go vet ./...
+
+      - name: Unit tests (no controller required)
+        run: make test
+
+      - name: Build release binary (linux/amd64)
+        run: |
+          CGO_ENABLED=0 go build -trimpath -o "$RUNNER_TEMP/terraform-provider-threshold" .
+          test -x "$RUNNER_TEMP/terraform-provider-threshold"
+
+      - name: govulncheck
+        run: |
+          go install golang.org/x/vuln/cmd/govulncheck@v1.9.0
+          "$(go env GOPATH)/bin/govulncheck" ./...
+
+      - name: osv-scanner
+        run: |
+          go install github.com/google/osv-scanner/v2/cmd/osv-scanner@v2.7.0
+          "$(go env GOPATH)/bin/osv-scanner" scan source -r .

.github/dependabot.yml

@@ -1,20 +0,0 @@
-# Copyright (c) HashiCorp, Inc.
-# SPDX-License-Identifier: MPL-2.0
-
-# See GitHub's docs for more information on this file:
-# https://docs.github.com/en/free-pro-team@latest/github/administering-a-repository/configuration-options-for-dependency-updates
-version: 2
-updates:
-  # Maintain dependencies for GitHub Actions
-  - package-ecosystem: "github-actions"
-    directory: "/"
-    schedule:
-      # Check for updates to GitHub Actions every weekday
-      interval: "daily"
-
-  # Maintain dependencies for Go modules
-  - package-ecosystem: "gomod"
-    directory: "/"
-    schedule:
-      # Check for updates to Go modules every weekday
-      interval: "daily"

.github/pull_request_template.md

@@ -0,0 +1,11 @@
+## PCI review checklist
+
+<!-- heimdall_github_prtemplate:grc-pci_dss-2024-01-05 -->
+
+- [ ] I have documented a clear reason for, and description of, the change I am making.
+
+- [ ] If applicable, I've documented a plan to revert these changes if they require more than reverting the pull request.
+
+- [ ] If applicable, I've documented the impact of any changes to security controls.
+
+  Examples of changes to security controls include using new access control methods, adding or removing logging pipelines, etc.

.github/workflows/actionlint.yml

@@ -1,15 +0,0 @@
-name: Lint GitHub Actions workflows
-on: push
-
-permissions:
-  contents: read
-
-jobs:
-  actionlint:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
-      - name: Check workflow files
-        uses: docker://docker.mirror.hashicorp.services/rhysd/actionlint@sha256:02ccb6d91e4cb4a7b21eb99d5274d257e81ae667688d730e89d7ea0d6d35db91
-        with:
-          args: -color

.github/workflows/jira.yml

@@ -1,109 +0,0 @@
-on:
-  issues:
-    types: [opened, closed, deleted, reopened]
-  pull_request_target:
-    types: [opened, closed, reopened]
-  issue_comment: # Also triggers when commenting on a PR from the conversation view
-    types: [created]
-  workflow_dispatch:
-
-name: Jira Sync
-
-permissions:
-  contents: read
-
-jobs:
-  sync:
-    runs-on: ubuntu-latest
-    name: Jira sync
-    steps:
-    - name: Check if community user
-      if: github.event.action == 'opened'
-      id: boundary-team-role
-      run: |
-        TEAM="boundary"
-        ROLE="$(gh api orgs/hashicorp/teams/${TEAM}/memberships/${{ github.actor }} | jq -r '.role | select(.!=null)')"
-        if [[ -n "${ROLE}" ]]; then
-          echo "Actor ${{ github.actor }} is a ${TEAM} team member, skipping ticket creation"
-        else
-          echo "Actor ${{ github.actor }} is not a ${TEAM} team member"
-        fi
-        echo "name=role::${ROLE}" >> "$GITHUB_OUTPUT"
-      env:
-        GITHUB_TOKEN: ${{ secrets.JIRA_SYNC_GITHUB_TOKEN }}
-
-    - name: Set ticket type
-      if: github.event.action == 'opened' && !steps.boundary-team-role.outputs.role
-      id: set-ticket-type
-      run: |
-        if [[ "${{ github.event_name }}" == "pull_request_target" ]]; then
-          echo "name=type::PR" >> "$GITHUB_OUTPUT"
-        else
-          echo "name=type::ISS" >> "$GITHUB_OUTPUT"
-        fi
-
-    - name: Create ticket
-      if: github.event.action == 'opened' && !steps.boundary-team-role.outputs.role
-      uses: tomhjp/gh-action-jira-create@3ed1789cad3521292e591a7cfa703215ec1348bf # v0.2.1
-      env:
-        JIRA_BASE_URL: ${{ secrets.JIRA_BASE_URL }}
-        JIRA_USER_EMAIL: ${{ secrets.JIRA_USER_EMAIL }}
-        JIRA_API_TOKEN: ${{ secrets.JIRA_API_TOKEN }}
-      with:
-        project: ICU
-        issuetype: "GH Issue"
-        summary: "${{ github.event.repository.name }} [${{ steps.set-ticket-type.outputs.type }} #${{ github.event.issue.number || github.event.pull_request.number }}]: ${{ github.event.issue.title || github.event.pull_request.title }}"
-        description: "${{ github.event.issue.body || github.event.pull_request.body }}\n\n_Created from GitHub Action for ${{ github.event.issue.html_url || github.event.pull_request.html_url }} from ${{ github.actor }}_"
-        # customfield_10089 is Issue Link custom field
-        extraFields: '{"customfield_10089": "${{ github.event.issue.html_url || github.event.pull_request.html_url }}"}'
-
-    - name: Search
-      if: github.event.action != 'opened'
-      id: search
-      uses: tomhjp/gh-action-jira-search@04700b457f317c3e341ce90da5a3ff4ce058f2fa # v0.2.2
-      env:
-        JIRA_BASE_URL: ${{ secrets.JIRA_BASE_URL }}
-        JIRA_USER_EMAIL: ${{ secrets.JIRA_USER_EMAIL }}
-        JIRA_API_TOKEN: ${{ secrets.JIRA_API_TOKEN }}
-      with:
-        # cf[10089] is Issue Link custom field
-        jql: 'issuetype = "GH Issue" and cf[10089]="${{ github.event.issue.html_url || github.event.pull_request.html_url }}"'
-
-    - name: Sync comment
-      if: github.event.action == 'created' && steps.search.outputs.issue
-      uses: tomhjp/gh-action-jira-comment@6eb6b9ead70221916b6badd118c24535ed220bd9 # v0.2.0
-      env:
-        JIRA_BASE_URL: ${{ secrets.JIRA_BASE_URL }}
-        JIRA_USER_EMAIL: ${{ secrets.JIRA_USER_EMAIL }}
-        JIRA_API_TOKEN: ${{ secrets.JIRA_API_TOKEN }}
-      with:
-        issue: ${{ steps.search.outputs.issue }}
-        comment: "${{ github.actor }} ${{ github.event.review.state || 'commented' }}:\n\n${{ github.event.comment.body || github.event.review.body }}\n\n${{ github.event.comment.html_url || github.event.review.html_url }}"
-
-    - name: Transitions
-      id: transitions
-      if: steps.search.outputs.issue
-      run: |
-        if [[ "${{ github.event.action }}" == "closed" || "${{ github.event.action }}" == "deleted" ]]; then
-          echo "Closing ticket"
-          echo "name=Done" >> "$GITHUB_OUTPUT"
-        elif [[ "${{ github.event.action }}" == "reopened" ]]; then
-          echo "Reopening ticket"
-          echo "name='Reopen'" >> "$GITHUB_OUTPUT"
-        fi
-
-    # Transition issue API reference: https://developer.atlassian.com/cloud/jira/platform/rest/v3/api-group-issues/#api-rest-api-3-issue-issueidorkey-transitions-post
-    - name: Transition ticket
-      if: steps.transitions.outputs.name
-      run: |
-        transitions="$(curl --silent \
-          --url "${{ secrets.JIRA_BASE_URL }}rest/api/3/issue/${{ steps.search.outputs.issue }}/transitions" \
-          --user "${{ secrets.JIRA_USER_EMAIL }}:${{ secrets.JIRA_API_TOKEN }}" \
-          --header "Accept: application/json")"
-        id="$(echo "${transitions}" | jq -r '.transitions[] | select(.name == "${{ steps.transitions.outputs.name }}") | .id')"
-        curl --silent \
-          --url "${{ secrets.JIRA_BASE_URL }}rest/api/3/issue/${{ steps.search.outputs.issue }}/transitions" \
-          --user "${{ secrets.JIRA_USER_EMAIL }}:${{ secrets.JIRA_API_TOKEN }}" \
-          --header "Accept: application/json" \
-          --header "Content-Type: application/json" \
-          --data "$(printf '{"transition": {"id": "%s"}}' "${id}")"

.github/workflows/make-gen-delta.yml

@@ -1,43 +0,0 @@
-name: "make-gen-delta"
-on:
-  - workflow_dispatch
-  - push
-  - pull_request
-  - workflow_call
-
-permissions:
-  contents: read
-
-jobs:
-  make-gen-delta:
-    name: "Check for uncommitted changes from make gen"
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
-        with:
-          fetch-depth: '0'
-      - name: Determine Go version
-        id: get-go-version
-        # We use .go-version as our source of truth for current Go
-        # version, because "goenv" can react to it automatically.
-        run: |
-          echo "Building with Go $(cat .go-version)"
-          echo "go-version=$(cat .go-version)" >> "$GITHUB_OUTPUT"
-      - name: Set up Go
-        uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
-        with:
-          go-version: "${{ steps.get-go-version.outputs.go-version }}"
-      - name: Running go mod tidy
-        run: |
-          go mod tidy
-      - name: Install Dependencies
-        run: |
-          make tools
-      - name: Running make gen
-        run: |
-          make gen
-      - name: Check for changes
-        run: |
-          git diff --exit-code
-          git status --porcelain
-          test -z "$(git status --porcelain)"

.github/workflows/release.yml

@@ -1,55 +0,0 @@
-name: Release
-
-on:
-  push:
-    tags:
-      - 'v[0-9]+.[0-9]+.[0-9]+*'
-
-permissions:
-  contents: write
-
-jobs:
-  go-version:
-    runs-on: ubuntu-latest
-    outputs:
-      version: ${{ steps.go-version.outputs.go-version }}
-    steps:
-      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
-      - id: go-version
-        # We use .go-version as our source of truth for current Go
-        # version, because "goenv" can react to it automatically.
-        run: |
-          echo "Building with Go $(cat .go-version)"
-          echo "go-version=$(cat .go-version)" >> "$GITHUB_OUTPUT"
-  release-notes:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
-        with:
-          fetch-depth: 0
-      - name: Generate Release Notes
-        run: sed -n -e "1{/# /d;}" -e "2{/^$/d;}" -e "/# $(git describe --abbrev=0 --exclude="$(git describe --abbrev=0 --match='v*.*.*' --tags)" --match='v*.*.*' --tags | tr -d v)/q;p" CHANGELOG.md > release-notes.txt
-      - uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4.4.0
-        with:
-          name: release-notes
-          path: release-notes.txt
-          retention-days: 1
-  terraform-provider-release:
-    name: 'Terraform Provider Release'
-    needs: [go-version, release-notes]
-    uses: hashicorp/ghaction-terraform-provider-release/.github/workflows/hashicorp.yml@v4
-    secrets:
-      hc-releases-github-token: '${{ secrets.HASHI_RELEASES_GITHUB_TOKEN }}'
-      hc-releases-host-staging: '${{ secrets.HC_RELEASES_HOST_STAGING }}'
-      hc-releases-host-prod: '${{ secrets.HC_RELEASES_HOST_PROD }}'
-      hc-releases-key-prod: '${{ secrets.HC_RELEASES_KEY_PROD }}'
-      hc-releases-key-staging: '${{ secrets.HC_RELEASES_KEY_STAGING }}'
-      hc-releases-terraform-registry-sync-token: '${{ secrets.TF_PROVIDER_RELEASE_TERRAFORM_REGISTRY_SYNC_TOKEN }}'
-      setup-signore-github-token: '${{ secrets.HASHI_SIGNORE_GITHUB_TOKEN }}'
-      signore-client-id: '${{ secrets.SIGNORE_CLIENT_ID }}'
-      signore-client-secret: '${{ secrets.SIGNORE_CLIENT_SECRET }}'
-    with:
-      release-notes: true
-      setup-go-version: '${{ needs.go-version.outputs.version }}'
-      # Product Version (e.g. v1.2.3 or github.ref_name)
-      product-version: '${{ github.ref_name }}'

.github/workflows/test.yml

@@ -1,45 +0,0 @@
-name: test
-
-on:
-  - push
-  - pull_request
-  - workflow_dispatch
-  - workflow_call
-
-permissions:
-  contents: read
-
-jobs:
-  test:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
-      - name: Determine go version
-        id: get-go-version
-        # We use .go-version as our source of truth for current Go
-        # version, because "goenv" can react to it automatically.
-        run: |
-          echo "Building with Go $(cat .go-version)"
-          echo "go-version=$(cat .go-version)" >> "$GITHUB_OUTPUT"
-      - name: Set up Go
-        uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
-        with:
-          go-version: "${{ steps.get-go-version.outputs.go-version }}"
-          cache: false
-      - name: Determine Go cache paths
-        id: go-cache-paths
-        run: |
-          echo "go-build=$(go env GOCACHE)" >> "$GITHUB_OUTPUT"
-          echo "go-mod=$(go env GOMODCACHE)" >> "$GITHUB_OUTPUT"
-      - name: Set up Go modules cache
-        uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4.0.2
-        with:
-          path: |
-            ${{ steps.go-cache-paths.outputs.go-build }}
-            ${{ steps.go-cache-paths.outputs.go-mod }}
-          key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
-          restore-keys: |
-            ${{ runner.os }}-go
-      - name: Acceptance Tests
-        run: |
-          make testacc

.go-version

@@ -1 +1 @@
-1.21.5
+1.26.6

.goreleaser.yml

@@ -1,78 +1,31 @@
-# Copyright (c) HashiCorp, Inc.
 # SPDX-License-Identifier: MPL-2.0
-
-archives:
-  - files:
-      # Ensure only built binary is archived
-      - 'none*'
-    format: zip
-    name_template: '{{ .ProjectName }}_{{ .Version }}_{{ .Os }}_{{ .Arch }}'
+# Local/unsigned release config. No GPG signing, Vault, Artifactory or
+# Terraform Registry publishing: this fork has no registry.
+# Try it with:  goreleaser build --snapshot --clean
+version: 2
+project_name: terraform-provider-threshold
 before:
   hooks:
-    - 'go mod download'
-    - './scripts/plugins-all.sh'
+    - go mod tidy
 builds:
-  - # Binary naming only required for Terraform CLI 0.12
-    binary: '{{ .ProjectName }}_v{{ .Version }}_x5'
+  - id: provider
+    main: .
+    binary: "{{ .ProjectName }}_v{{ .Version }}"
     env:
       - CGO_ENABLED=0
     flags:
       - -trimpath
-    goos:
-      - darwin
-      - freebsd
-      - linux
-      - windows
-    goarch:
-      - '386'
-      - amd64
-      - arm
-      - arm64
-    ignore:
-      - goarch: arm
-        goos: windows
-      - goarch: arm64
-        goos: freebsd
-      - goarch: arm64
-        goos: windows
     ldflags:
-      - -s -w -X main.Version={{.Version}}
-    mod_timestamp: '{{ .CommitTimestamp }}'
+      - -s -w
+    goos: [linux, darwin, windows]
+    goarch: [amd64, arm64]
+archives:
+  - formats: [zip]
+    name_template: "{{ .ProjectName }}_{{ .Version }}_{{ .Os }}_{{ .Arch }}"
 checksum:
+  name_template: "{{ .ProjectName }}_{{ .Version }}_SHA256SUMS"
   algorithm: sha256
-  extra_files:
-    - glob: 'terraform-registry-manifest.json'
-      name_template: '{{ .ProjectName }}_{{ .Version }}_manifest.json'
-  name_template: '{{ .ProjectName }}_{{ .Version }}_SHA256SUMS'
-publishers:
-  - checksum: true
-    # Terraform CLI 0.10 - 0.11 perform discovery via HTTP headers on releases.hashicorp.com
-    # For providers which have existed since those CLI versions, exclude
-    # discovery by setting the protocol version headers to 5.
-    cmd: hc-releases upload -product {{ .ProjectName }} -version {{ .Version }} -file={{ .ArtifactPath }}={{ .ArtifactName }} -header=x-terraform-protocol-version=5 -header=x-terraform-protocol-versions=5.0
-    env:
-      - HC_RELEASES_HOST={{ .Env.HC_RELEASES_HOST }}
-      - HC_RELEASES_KEY={{ .Env.HC_RELEASES_KEY }}
-    extra_files:
-      - glob: 'terraform-registry-manifest.json'
-        name_template: '{{ .ProjectName }}_{{ .Version }}_manifest.json'
-    name: upload
-    signature: true
 release:
-  extra_files:
-    - glob: 'terraform-registry-manifest.json'
-      name_template: '{{ .ProjectName }}_{{ .Version }}_manifest.json'
-  ids:
-    - none
-signs:
-  - args: ["sign", "--dearmor", "--file", "${artifact}", "--out", "${signature}"]
-    artifacts: checksum
-    cmd: signore
-    signature: ${artifact}.sig
-  - args: ["sign", "--dearmor", "--file", "${artifact}", "--out", "${signature}"]
-    artifacts: checksum
-    cmd: signore
-    id: key-id
-    signature: ${artifact}.72D7468F.sig
-snapshot:
-  name_template: "{{ .Tag }}-next"
+  disable: true
+changelog:
+  disable: true

.release/release-metadata.hcl

@@ -1,5 +0,0 @@
-# Copyright (c) HashiCorp, Inc.
-# SPDX-License-Identifier: MPL-2.0
-
-url_source_repository      = "https://github.com/hashicorp/terraform-provider-boundary"
-url_license                = "https://github.com/hashicorp/terraform-provider-boundary/blob/main/LICENSE"

CHANGELOG.md

@@ -2,6 +2,64 @@
 
 Canonical reference for changes, improvements, and bugfixes for the Boundary Terraform provider.
 
+## Next
+## 1.6.1 (Jul 24th, 2026)
+
+### New and Improved
+
+* Adds support to enable set/remove alias suffix and aliases at project scope
+  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/824))
+
+## 1.6.0 (Jul 8th, 2026)
+
+### New and Improved
+
+* Adds support to enable Session Recording for RDP Targets
+  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/818))
+
+
+## 1.5.1 (Feb 2nd, 2026)
+
+### New and Improved
+
+* Adds support for Vault LDAP Credential Store.
+  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/778))
+
+## 1.5.0 (December 19th, 2025)
+
+### New and Improved
+
+* Adds support for Password credentials.
+  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/758))
+
+## 1.4.0 (September 25th, 2025)
+
+### New and Improved
+
+* Adds support for new RDP target type and Username, Password, and Domain credentials.
+  ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/735))
+
+## 1.3.1 (July 11th, 2025)
+
+### Bug Fix
+
+* Fixes a problem where the KMS plugins were not being bundled in the provider's
+  binary ([PR](https://github.com/hashicorp/terraform-provider-boundary/pull/717))
+
+## 1.3.0 (July 9th, 2025)
+
+### Known Issues
+
+* `Error configuring kms: plugin is nil`: This error message may occur when you
+  attempt to use KMS plugin functionality. The [KMS plugins](plugins/kms/mains)
+  were not bundled in this Terraform provider release and thus any functionality
+  related to this will not work.
+
+### New and Improved
+
+* Updates various dependencies across the provider
+  ([Example PR](https://github.com/hashicorp/terraform-provider-boundary/pull/708))
+
 ## 1.2.0 (October 21, 2024)
 
 ### New and Improved

CODEOWNERS

@@ -1,4 +0,0 @@
-# These owners will be the default owners for everything in
-# the repo, unless a later match takes precedence.
-
-@hashicorp/boundary

Dockerfile

@@ -1,10 +0,0 @@
-# Copyright (c) HashiCorp, Inc.
-# SPDX-License-Identifier: MPL-2.0
-
-FROM golang:1.20
-
-WORKDIR /go/src/terraform-provider-boundary
-COPY . .
-
-RUN go get -d -v ./...
-RUN go install -v ./...

Makefile

@@ -1,14 +1,14 @@
 default: testacc
 GOOS=$(shell go env GOOS)
 GOARCH=$(shell go env GOARCH)
-INSTALL_PATH=~/.local/share/terraform/plugins/localhost/providers/boundary/0.0.1/linux_$(GOARCH)
+INSTALL_PATH=~/.local/share/terraform/plugins/repo.anhonesthost.net/cybercovellc/threshold/0.0.1/linux_$(GOARCH)
 BUILD_ALL_PATH=${PWD}/bin
 
 ifeq ($(GOOS), darwin)
-	INSTALL_PATH=~/Library/Application\ Support/io.terraform/plugins/localhost/providers/boundary/0.0.1/darwin_$(GOARCH)
+	INSTALL_PATH=~/Library/Application\ Support/io.terraform/plugins/repo.anhonesthost.net/cybercovellc/threshold/0.0.1/darwin_$(GOARCH)
 endif
 ifeq ($(GOOS), "windows")
-	INSTALL_PATH=%APPDATA%/HashiCorp/Terraform/plugins/localhost/providers/boundary/0.0.1/windows_$(GOARCH)
+	INSTALL_PATH=%APPDATA%/HashiCorp/Terraform/plugins/repo.anhonesthost.net/cybercovellc/threshold/0.0.1/windows_$(GOARCH)
 endif
 
 REGISTRY_NAME?=docker.io/hashicorpboundary
@@ -25,27 +25,38 @@ tools:
 	go generate -tags tools tools/tools.go
 	go install github.com/hashicorp/copywrite@v0.15.0
 
+# Unit tests: only the tests that do not need a running Threshold/Boundary
+# controller. Everything else is an acceptance test, run via `make testacc`.
+UNIT_TESTS = ^(TestProvider|TestSetFromVaultCredentialStoreResponseMapReadsWorkerFilterFromAttributes|TestAccTargetWithAddress_HostSourceAndAddressConflict|TestValidateTargetAliasScope|TestAliasSuffixFromScopeResponseMap|TestValidateAliasSuffixScope)$$
+
 test:
-	echo "Placeholder"
+	go test ./... -count=1 -run '$(UNIT_TESTS)'
+
+VERSION ?= $(shell cat version/VERSION)
+
+# Cross-compile release binaries for linux/darwin/windows x amd64/arm64 into dist/
+.PHONY: build-all
+build-all:
+	./scripts/build-release.sh $(VERSION)
 
 # Run acceptance tests
 testacc:
-	TF_ACC=1 go test ./... -v $(TESTARGS) -timeout 120m
+	./test.sh
 
 dev:
 	GOOS=${GOOS} GOARCH=${GOARCH} ./scripts/plugins.sh
 	mkdir -p $(INSTALL_PATH)
-	go build -o $(INSTALL_PATH)/terraform-provider-boundary main.go
+	go build -o $(INSTALL_PATH)/terraform-provider-threshold main.go
 
 dev-no-plugins:
 	mkdir -p $(INSTALL_PATH)
-	go build -o $(INSTALL_PATH)/terraform-provider-boundary main.go
+	go build -o $(INSTALL_PATH)/terraform-provider-threshold main.go
 
 all:
 	mkdir -p $(BUILD_ALL_PATH)
-	GOOS=darwin go build -o $(BUILD_ALL_PATH)/terraform-provider-boundary_darwin-amd64 main.go
-	GOOS=windows go build -o $(BUILD_ALL_PATH)/terraform-provider-boundary_windows-amd64 main.go
-	GOOS=linux go build -o $(BUILD_ALL_PATH)/terraform-provider-boundary_linux-amd64 main.go
+	GOOS=darwin go build -o $(BUILD_ALL_PATH)/terraform-provider-threshold_darwin-amd64 main.go
+	GOOS=windows go build -o $(BUILD_ALL_PATH)/terraform-provider-threshold_windows-amd64 main.go
+	GOOS=linux go build -o $(BUILD_ALL_PATH)/terraform-provider-threshold_linux-amd64 main.go
 
 docs:
 	go run github.com/hashicorp/terraform-plugin-docs/cmd/tfplugindocs

NOTICE

@@ -0,0 +1,15 @@
+terraform-provider-threshold
+
+This project is a community fork of terraform-provider-boundary
+(https://github.com/hashicorp/terraform-provider-boundary),
+Copyright (c) HashiCorp, Inc. / IBM Corp., licensed under the Mozilla Public
+License, version 2.0. The original copyright and license notices are retained in
+LICENSE and in the source file headers.
+
+Modifications in this fork (Go module path, imports of the Threshold api/sdk
+modules, product wording, removal of HashiCorp release tooling, CI) are made by
+CyberCove LLC and its contributors and are likewise made available under MPL-2.0.
+
+This fork is a community project for Threshold, a community fork of Boundary CE.
+It is not affiliated with, endorsed by, or supported by HashiCorp or IBM.
+"Boundary", "Terraform" and "HashiCorp" are trademarks of their respective owners.

README.md

@@ -1,33 +1,112 @@
-![](boundary.png)
+# Terraform Provider for Threshold
 
-# Terraform Provider Boundary
+A community fork of [hashicorp/terraform-provider-boundary](https://github.com/hashicorp/terraform-provider-boundary)
+for [Threshold](https://repo.anhonesthost.net/CyberCoveLLC/threshold), itself a community fork of Boundary CE.
 
-Available in the [Terraform Registry](https://registry.terraform.io/providers/hashicorp/boundary/latest).
+## About this fork
+
+- **Upstream:** `hashicorp/terraform-provider-boundary`, licensed MPL-2.0 (see [LICENSE](LICENSE) and [NOTICE](NOTICE)).
+  This fork is not affiliated with, endorsed by, or supported by HashiCorp or IBM.
+- **What changed:** the Go module is `repo.anhonesthost.net/CyberCoveLLC/terraform-provider-threshold`,
+  it builds against the Threshold `api` and `sdk` Go modules
+  (`repo.anhonesthost.net/CyberCoveLLC/threshold/api` and `.../sdk`), and product wording in docs and
+  schema descriptions says "Threshold". Release plumbing for HashiCorp's CRT/registry pipeline was removed.
+- **Compatibility:** resource and data source type names (`boundary_*`), provider arguments (`addr`,
+  `auth_method_id`, ...) and the `BOUNDARY_*` environment variables are unchanged, so existing Terraform
+  configurations keep working. Because the resource types start with `boundary_`, Terraform infers the
+  provider local name `boundary`; keep `boundary = { source = ... }` in `required_providers`.
+- **Distribution:** there is no public registry for this provider. Install it from a release zip or a local build
+  as described below. Its address is `repo.anhonesthost.net/cybercovellc/threshold`.
 
 ## Requirements
 
--	[Terraform](https://www.terraform.io/downloads.html) >= 0.13.x
--	[Go](https://golang.org/doc/install) >= 1.21
+-	[Terraform](https://www.terraform.io/downloads.html) >= 0.13.x (or OpenTofu)
+-	[Go](https://golang.org/doc/install) >= 1.26 (see `go.mod`), with `GOPRIVATE=repo.anhonesthost.net` if the Threshold modules are not publicly fetchable
 
-## Building The Provider
+## Installing
 
-1. Clone the repository
-1. Enter the repository directory
-1. Build the provider using `make dev`. This will place the provider onto your system in a [Terraform 0.13-compliant](https://www.terraform.io/upgrade-guides/0-13.html#in-house-providers) manner.
+Provider address: `repo.anhonesthost.net/cybercovellc/threshold`. Version `0.1.0` is used in the examples.
 
-You'll need to ensure that your Terraform file contains the information necessary to find the plugin when running `terraform init`. `make dev` will use a version number of 0.0.1, so the following block will work:
+### 1. Build locally
+
+```sh
+export GOPRIVATE=repo.anhonesthost.net
+make build-all VERSION=0.1.0          # or: scripts/build-release.sh 0.1.0 dist
+# single platform, no zip:
+go build -o terraform-provider-threshold .
+# with goreleaser installed:
+goreleaser build --snapshot --clean --single-target
+```
+
+`make build-all` writes `dist/terraform-provider-threshold_<version>_<os>_<arch>.zip` for linux, darwin and
+windows on amd64 and arm64 (needs `zip`). Never commit `dist/`.
+
+### 2. Filesystem mirror (recommended for shared hosts)
+
+Terraform's `provider_installation` can serve providers from a local directory. Layout (unpacked form):
+
+```
+/usr/share/terraform/providers/
+  repo.anhonesthost.net/cybercovellc/threshold/0.1.0/linux_amd64/terraform-provider-threshold_v0.1.0
+```
+
+or the packed form: `.../repo.anhonesthost.net/cybercovellc/threshold/terraform-provider-threshold_0.1.0_linux_amd64.zip`.
+Then in `~/.terraformrc` (`%APPDATA%\terraform.rc` on Windows):
+
+```hcl
+provider_installation {
+  filesystem_mirror {
+    path    = "/usr/share/terraform/providers"
+    include = ["repo.anhonesthost.net/cybercovellc/threshold"]
+  }
+  direct {
+    exclude = ["repo.anhonesthost.net/cybercovellc/threshold"]
+  }
+}
+```
+
+and in your configuration:
 
 ```hcl
 terraform {
   required_providers {
     boundary = {
-      source = "localhost/providers/boundary"
-      version = "0.0.1"
+      source  = "repo.anhonesthost.net/cybercovellc/threshold"
+      version = "0.1.0"
     }
   }
 }
+
+provider "boundary" {
+  addr = "https://threshold.example.com:9200"
+  # auth_method_id / auth_method_login_name / auth_method_password, token, or recovery_kms_hcl
+}
 ```
 
+### 3. dev_overrides (development)
+
+Build the binary into a directory and point Terraform at it (`terraform init` is not needed, and `terraform plan`
+prints a warning):
+
+```hcl
+# ~/.terraformrc
+provider_installation {
+  dev_overrides {
+    "repo.anhonesthost.net/cybercovellc/threshold" = "/home/you/go/bin"   # directory holding terraform-provider-threshold
+  }
+  direct {}
+}
+```
+
+`go install .` places `terraform-provider-threshold` in `$GOPATH/bin`. `make dev` installs a `0.0.1` build
+into Terraform's implied local mirror under the same address.
+
+## Building The Provider
+
+1. Clone the repository
+1. Enter the repository directory
+1. Build with `go build -o terraform-provider-threshold .` (or `make dev`, which also builds the optional built-in KMS plugins from `plugins/kms/mains`)
+
 ## Adding Dependencies
 
 This provider uses [Go modules](https://github.com/golang/go/wiki/Modules).
@@ -48,7 +127,9 @@ If you wish to work on the provider, you'll first need [Go](http://www.golang.or
 
 To compile the provider, run `go install`. This will build the provider and put the provider binary in the `$GOPATH/bin` directory.
 
-In order to run the full suite of Acceptance tests,
+Unit tests (no controller needed) run with `make test`. All other tests are acceptance tests and require a running
+Threshold/Boundary-compatible controller (`BOUNDARY_ADDR`, `BOUNDARY_AUTH_TOKEN`, `BOUNDARY_DEV_RECOVERY_KEY`) and, for the
+Vault tests, Docker. In order to run the full suite of Acceptance tests,
 a postgres docker container must be started first:
 
 ```sh
@@ -65,23 +146,23 @@ $ make testacc
 ```
 
 For more details on the docker image and troubleshooting see the
-[boundary testing doc](https://github.com/hashicorp/boundary/blob/main/CONTRIBUTING.md#testing).
+[Threshold contributing guide](https://repo.anhonesthost.net/CyberCoveLLC/threshold).
 
 ## Debugging the provider
 
-If you're using vscode, this provider has delve debugging baked into the [.vscode](https://github.com/hashicorp/terraform-provider-boundary/tree/main/.vscode) directory. To debug you can find instructions [here.](https://dev.to/drewmullen/vscode-terraform-provider-development-setup-debugging-6bn#usage)
+If you're using vscode, this provider has delve debugging baked into the [.vscode](https://repo.anhonesthost.net/CyberCoveLLC/terraform-provider-threshold/tree/main/.vscode) directory. To debug you can find instructions [here.](https://dev.to/drewmullen/vscode-terraform-provider-development-setup-debugging-6bn#usage)
 
 ## Generating Docs
 
-This provider uses the [terraform-plugin-docs](https://github.com/hashicorp/terraform-plugin-docs/) tool to generate documentation. Each resource and data source requires a set of examples [examples](https://github.com/hashicorp/terraform-provider-boundary/tree/main/examples) then you execute a binary to generate the docs which are placed in [./docs](https://github.com/hashicorp/terraform-provider-boundary/tree/main/docs). Optionally, you can specify your own [templates](https://github.com/hashicorp/terraform-provider-boundary/tree/main/templates) for a resource or data source if you want to add custom information (example: [data "boundary_scope"](https://github.com/hashicorp/terraform-provider-boundary/blob/main/templates/data-sources/scope.md.tmpl#L11))
+This provider uses the [terraform-plugin-docs](https://github.com/hashicorp/terraform-plugin-docs/) tool to generate documentation. Each resource and data source requires a set of examples [examples](https://repo.anhonesthost.net/CyberCoveLLC/terraform-provider-threshold/tree/main/examples) then you execute a binary to generate the docs which are placed in [./docs](https://repo.anhonesthost.net/CyberCoveLLC/terraform-provider-threshold/tree/main/docs). Optionally, you can specify your own [templates](https://repo.anhonesthost.net/CyberCoveLLC/terraform-provider-threshold/tree/main/templates) for a resource or data source if you want to add custom information (example: [data "boundary_scope"](https://repo.anhonesthost.net/CyberCoveLLC/terraform-provider-threshold/blob/main/templates/data-sources/scope.md.tmpl#L11))
 
 ### New Resources & Data Sources (documentation templates)
 
-If you're adding a new resource or a data source, you must include a documentation template for your new R/DS in [./templates](https://github.com/hashicorp/terraform-provider-boundary/tree/main/templates) directory. This provider uses the [terraform-plugin-docs](https://github.com/hashicorp/terraform-plugin-docs/) tool to generate documentation. For full details see the link.
+If you're adding a new resource or a data source, you must include a documentation template for your new R/DS in [./templates](https://repo.anhonesthost.net/CyberCoveLLC/terraform-provider-threshold/tree/main/templates) directory. This provider uses the [terraform-plugin-docs](https://github.com/hashicorp/terraform-plugin-docs/) tool to generate documentation. For full details see the link.
 
 ### Documentation Examples for Resources & Data Sources
 
-Examples are required for all resources and data sources. This provider uses the [terraform-plugin-docs](https://github.com/hashicorp/terraform-plugin-docs/) tool to generate documentation. To add examples, add a new file to the [./examples](https://github.com/hashicorp/terraform-provider-boundary/tree/main/examples) directory or update the existing files. Next make sure the corresponding template in [./templates](https://github.com/hashicorp/terraform-provider-boundary/tree/main/templates) directory references this example.
+Examples are required for all resources and data sources. This provider uses the [terraform-plugin-docs](https://github.com/hashicorp/terraform-plugin-docs/) tool to generate documentation. To add examples, add a new file to the [./examples](https://repo.anhonesthost.net/CyberCoveLLC/terraform-provider-threshold/tree/main/examples) directory or update the existing files. Next make sure the corresponding template in [./templates](https://repo.anhonesthost.net/CyberCoveLLC/terraform-provider-threshold/tree/main/templates) directory references this example.
 
 ### Generating
 
@@ -93,7 +174,7 @@ go run github.com/hashicorp/terraform-plugin-docs/cmd/tfplugindocs
 
 ## Using the provider
 
-Please see our detailed docs for individual resource usage. Below is a complex example using the Boundary provider to configure all resource types available:
+Please see our detailed docs for individual resource usage. Below is a complex example using the provider to configure all resource types available:
 
 ```hcl
 provider "boundary" {

docs/data-sources/account.md

@@ -3,17 +3,17 @@
 page_title: "boundary_account Data Source - terraform-provider-boundary"
 subcategory: ""
 description: |-
-  The boundary_account data source allows you to find a Boundary account.
+  The boundary_account data source allows you to find a Threshold account.
 ---
 
 # boundary_account (Data Source)
 
-The boundary_account data source allows you to find a Boundary account.
+The boundary_account data source allows you to find a Threshold account.
 
 ## Example Usage
 
 ```terraform
-# Retrieve the ID of a Boundary account
+# Retrieve the ID of a Threshold account
 data "boundary_account" "admin" {
   name           = "admin"
   auth_method_id = "ampw_1234567890"

docs/data-sources/auth_method.md

@@ -3,12 +3,12 @@
 page_title: "boundary_auth_method Data Source - terraform-provider-boundary"
 subcategory: ""
 description: |-
-  The boundaryauthmethod data source allows you to find a Boundary auth method.
+  The boundary_auth_method data source allows you to find a Threshold auth method.
 ---
 
 # boundary_auth_method (Data Source)
 
-The boundary_auth_method data source allows you to find a Boundary auth method.
+The boundary_auth_method data source allows you to find a Threshold auth method.
 
 ## Example Usage
 

docs/data-sources/group.md

@@ -3,12 +3,12 @@
 page_title: "boundary_group Data Source - terraform-provider-boundary"
 subcategory: ""
 description: |-
-  The boundary_group data source allows you to find a Boundary group.
+  The boundary_group data source allows you to find a Threshold group.
 ---
 
 # boundary_group (Data Source)
 
-The boundary_group data source allows you to find a Boundary group.
+The boundary_group data source allows you to find a Threshold group.
 
 ## Example Usage
 

docs/data-sources/role.md

@@ -0,0 +1,62 @@
+---
+# generated by https://github.com/hashicorp/terraform-plugin-docs
+page_title: "boundary_role Data Source - terraform-provider-boundary"
+subcategory: ""
+description: |-
+  The boundary_role data source allows you to find a Threshold role.
+---
+
+# boundary_role (Data Source)
+
+The boundary_role data source allows you to find a Threshold role.
+
+## Example Usage
+
+```terraform
+# Role from the global scope
+data "boundary_role" "global_role" {
+  name = "global_role_one"
+}
+
+# Role from an org scope
+data "boundary_scope" "org" {
+  name     = "org_one"
+  scope_id = "global"
+}
+
+data "boundary_role" "org_role" {
+  name     = "org_role_one"
+  scope_id = data.boundary_scope.org.id
+}
+```
+
+<!-- schema generated by tfplugindocs -->
+## Schema
+
+### Required
+
+- `name` (String) The name of the role to retrieve.
+
+### Optional
+
+- `scope_id` (String) The scope ID in which the resource is created. Defaults `global` if unset.
+
+### Read-Only
+
+- `description` (String) The description of the retrieved role.
+- `grant_scope_ids` (Set of String) The list of scope IDs for the role's grants.
+- `grant_strings` (Set of String) The list of stringified grants for the role.
+- `id` (String) The ID of the retrieved role.
+- `principal_ids` (Set of String) The list of principal (user or group) IDs added as principals on the role.
+- `scope` (List of Object) (see [below for nested schema](#nestedatt--scope))
+
+<a id="nestedatt--scope"></a>
+### Nested Schema for `scope`
+
+Read-Only:
+
+- `description` (String)
+- `id` (String)
+- `name` (String)
+- `parent_scope_id` (String)
+- `type` (String)

docs/data-sources/scope.md

@@ -2,18 +2,18 @@
 page_title: "boundary_scope Data Source - terraform-provider-boundary"
 subcategory: ""
 description: |-
-  The scope data source allows you to discover an existing Boundary scope by name.
+  The scope data source allows you to discover an existing Threshold scope by name.
 ---
 
 # boundary_scope (Data Source)
 
-The scope data source allows you to discover an existing Boundary scope by name.
+The scope data source allows you to discover an existing Threshold scope by name.
 Please note that the Global scope will always have an id of "global", and does not need to be discovered with this data source.
 
 ## Example Usage
 
 ```terraform
-# Retrieve the ID of a Boundary project
+# Retrieve the ID of a Threshold project
 data "boundary_scope" "org" {
   name     = "SecOps"
   scope_id = "global"

docs/data-sources/user.md

@@ -3,12 +3,12 @@
 page_title: "boundary_user Data Source - terraform-provider-boundary"
 subcategory: ""
 description: |-
-  The user data source allows you to find a Boundary user.
+  The user data source allows you to find a Threshold user.
 ---
 
 # boundary_user (Data Source)
 
-The user data source allows you to find a Boundary user.
+The user data source allows you to find a Threshold user.
 
 ## Example Usage
 

docs/index.md

@@ -1,13 +1,13 @@
 ---
-page_title: "Provider: Boundary"
+page_title: "Provider: Threshold"
 subcategory: ""
 description: |-
-  Terraform provider for configuring Boundary.
+  Terraform provider for configuring Threshold.
 ---
 
-# Boundary Provider
+# Threshold Provider
 
-Terraform provider for configuring Boundary.
+Terraform provider for configuring Threshold.
 
 ## Example Usage
 
@@ -40,7 +40,7 @@ provider "boundary" {
 
 ### Required
 
-- `addr` (String) The base url of the Boundary API, e.g. "http://127.0.0.1:9200". If not set, it will be read from the "BOUNDARY_ADDR" env var.
+- `addr` (String) The base url of the Threshold API, e.g. "http://127.0.0.1:9200". If not set, it will be read from the "BOUNDARY_ADDR" env var.
 
 ### Optional
 
@@ -49,8 +49,8 @@ provider "boundary" {
 - `auth_method_password` (String) The auth method password for password-style or ldap-style auth methods
 - `password_auth_method_login_name` (String, Deprecated) The auth method login name for password-style auth methods
 - `password_auth_method_password` (String, Deprecated) The auth method password for password-style auth methods
-- `plugin_execution_dir` (String) Specifies a directory that the Boundary provider can use to write and execute its built-in plugins.
+- `plugin_execution_dir` (String) Specifies a directory that the Threshold provider can use to write and execute its built-in plugins.
 - `recovery_kms_hcl` (String) Can be a heredoc string or a path on disk. If set, the string/file will be parsed as HCL and used with the recovery KMS mechanism. While this is set, it will override any other authentication information; the KMS mechanism will always be used. See Boundary's KMS docs for examples: https://boundaryproject.io/docs/configuration/kms
 - `scope_id` (String) The scope ID for the default auth method.
-- `tls_insecure` (Boolean) When set to true, does not validate the Boundary API endpoint certificate
-- `token` (String) The Boundary token to use, as a string or path on disk containing just the string. If set, the token read here will be used in place of authenticating with the auth method specified in "auth_method_id", although the recovery KMS mechanism will still override this. Can also be set with the BOUNDARY_TOKEN environment variable.
+- `tls_insecure` (Boolean) When set to true, does not validate the Threshold API endpoint certificate
+- `token` (String) The Threshold token to use, as a string or path on disk containing just the string. If set, the token read here will be used in place of authenticating with the auth method specified in "auth_method_id", although the recovery KMS mechanism will still override this. Can also be set with the BOUNDARY_TOKEN environment variable.

docs/resources/account_ldap.md

@@ -3,12 +3,12 @@
 page_title: "boundary_account_ldap Resource - terraform-provider-boundary"
 subcategory: ""
 description: |-
-  The account resource allows you to configure a Boundary account.
+  The account resource allows you to configure a Threshold account.
 ---
 
 # boundary_account_ldap (Resource)
 
-The account resource allows you to configure a Boundary account.
+The account resource allows you to configure a Threshold account.
 
 ## Example Usage
 
@@ -71,6 +71,8 @@ resource "boundary_user" "einstein" {
 
 Import is supported using the following syntax:
 
+The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can be used, for example:
+
 ```shell
 terraform import boundary_account_ldap.foo <my-id>
 ```

docs/resources/account_oidc.md

@@ -3,12 +3,12 @@
 page_title: "boundary_account_oidc Resource - terraform-provider-boundary"
 subcategory: ""
 description: |-
-  The account resource allows you to configure a Boundary account.
+  The account resource allows you to configure a Threshold account.
 ---
 
 # boundary_account_oidc (Resource)
 
-The account resource allows you to configure a Boundary account.
+The account resource allows you to configure a Threshold account.
 
 
 

docs/resources/account_password.md

@@ -3,12 +3,12 @@
 page_title: "boundary_account_password Resource - terraform-provider-boundary"
 subcategory: ""
 description: |-
-  The account resource allows you to configure a Boundary account.
+  The account resource allows you to configure a Threshold account.
 ---
 
 # boundary_account_password (Resource)
 
-The account resource allows you to configure a Boundary account.
+The account resource allows you to configure a Threshold account.
 
 ## Example Usage
 
@@ -56,6 +56,8 @@ resource "boundary_account_password" "jeff" {
 
 Import is supported using the following syntax:
 
+The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can be used, for example:
+
 ```shell
 terraform import boundary_account_password.foo <my-id>
 ```

docs/resources/alias_target.md

@@ -3,12 +3,12 @@
 page_title: "boundary_alias_target Resource - terraform-provider-boundary"
 subcategory: ""
 description: |-
-  The target alias resource allows you to configure a Boundary target alias.
+  The target alias resource allows you to configure a Threshold target alias at project and global scopes.
 ---
 
 # boundary_alias_target (Resource)
 
-The target alias resource allows you to configure a Boundary target alias.
+The target alias resource allows you to configure a Threshold target alias at project and global scopes.
 
 ## Example Usage
 
@@ -28,6 +28,16 @@ resource "boundary_scope" "project" {
   auto_create_admin_role = true
 }
 
+resource "boundary_scope_alias_suffix" "org" {
+  scope_id     = boundary_scope.org.id
+  alias_suffix = "org"
+}
+
+resource "boundary_scope_alias_suffix" "project" {
+  scope_id     = boundary_scope.project.id
+  alias_suffix = "projectone"
+}
+
 resource "boundary_host_catalog_static" "foo" {
   name        = "test"
   description = "test catalog"
@@ -75,6 +85,19 @@ resource "boundary_alias_target" "example_alias_target" {
   destination_id            = boundary_target.foo.id
   authorize_session_host_id = boundary_host_static.bar.id
 }
+
+resource "boundary_alias_target" "example_alias_target_project" {
+  name                      = "example_alias_target_project"
+  description               = "Example project-scoped alias to target foo"
+  scope_id                  = boundary_scope.project.id
+  value                     = "prodops.projectone.org"
+  destination_id            = boundary_target.foo.id
+  authorize_session_host_id = boundary_host_static.bar.id
+  depends_on = [
+    boundary_scope_alias_suffix.org,
+    boundary_scope_alias_suffix.project,
+  ]
+}
 ```
 
 <!-- schema generated by tfplugindocs -->
@@ -82,12 +105,12 @@ resource "boundary_alias_target" "example_alias_target" {
 
 ### Required
 
-- `scope_id` (String) The scope ID.
+- `scope_id` (String) The scope ID. Org scopes are not supported for aliases.
 - `value` (String) The value of the alias.
 
 ### Optional
 
-- `authorize_session_host_id` (String) The host id to pass to Boundary when performing an authorize session action.
+- `authorize_session_host_id` (String) The host id to pass to Threshold when performing an authorize session action.
 - `description` (String) The alias description.
 - `destination_id` (String) The destination of the alias.
 - `name` (String) The alias name. Defaults to the resource name.
@@ -101,6 +124,9 @@ resource "boundary_alias_target" "example_alias_target" {
 
 Import is supported using the following syntax:
 
+The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can be used, for example:
+
 ```shell
 terraform import boundary_alias_target.example_alias_target <my-id>
+terraform import boundary_alias_target.example_alias_target_project <my-id>
 ```

docs/resources/auth_method.md

@@ -3,12 +3,12 @@
 page_title: "boundary_auth_method Resource - terraform-provider-boundary"
 subcategory: ""
 description: |-
-  The auth method resource allows you to configure a Boundary auth_method.
+  The auth method resource allows you to configure a Threshold auth_method.
 ---
 
 # boundary_auth_method (Resource)
 
-The auth method resource allows you to configure a Boundary auth_method.
+The auth method resource allows you to configure a Threshold auth_method.
 
 ## Example Usage
 
@@ -25,6 +25,12 @@ resource "boundary_auth_method" "password" {
   scope_id = boundary_scope.org.id
   type     = "password"
 }
+
+resource "boundary_auth_method" "password_is_primary" {
+  scope_id = boundary_scope.org.id
+  type     = "password"
+  is_primary_for_scope = true
+}
 ```
 
 <!-- schema generated by tfplugindocs -->
@@ -38,6 +44,7 @@ resource "boundary_auth_method" "password" {
 ### Optional
 
 - `description` (String) The auth method description.
+- `is_primary_for_scope` (Boolean) When true, makes this auth method the primary auth method for the scope in which it resides.
 - `min_login_name_length` (Number, Deprecated) The minimum login name length.
 - `min_password_length` (Number, Deprecated) The minimum password length.
 - `name` (String) The auth method name. Defaults to the resource name.
@@ -50,6 +57,8 @@ resource "boundary_auth_method" "password" {
 
 Import is supported using the following syntax:
 
+The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can be used, for example:
+
 ```shell
 terraform import boundary_auth_method.foo <my-id>
 ```

docs/resources/auth_method_ldap.md

@@ -3,12 +3,12 @@
 page_title: "boundary_auth_method_ldap Resource - terraform-provider-boundary"
 subcategory: ""
 description: |-
-  The LDAP auth method resource allows you to configure a Boundary authmethodldap.
+  The LDAP auth method resource allows you to configure a Threshold auth_method_ldap.
 ---
 
 # boundary_auth_method_ldap (Resource)
 
-The LDAP auth method resource allows you to configure a Boundary auth_method_ldap.
+The LDAP auth method resource allows you to configure a Threshold auth_method_ldap.
 
 ## Example Usage
 
@@ -49,11 +49,11 @@ resource "boundary_auth_method_ldap" "forumsys_ldap" {
 - `anon_group_search` (Boolean) Use anon bind when performing LDAP group searches (optional).
 - `bind_dn` (String) The distinguished name of entry to bind when performing user and group searches (optional).
 - `bind_password` (String) The password to use along with bind-dn performing user and group searches (optional).
-- `bind_password_hmac` (String) The HMAC of the bind password returned by the Boundary controller, which is used for comparison after initial setting of the value.
+- `bind_password_hmac` (String) The HMAC of the bind password returned by the Threshold controller, which is used for comparison after initial setting of the value.
 - `certificates` (List of String) PEM-encoded X.509 CA certificate in ASN.1 DER form that can be used as a trust anchor when connecting to an LDAP server(optional).  This may be specified multiple times
 - `client_certificate` (String) PEM-encoded X.509 client certificate in ASN.1 DER form that can be used to authenticate against an LDAP server(optional).
 - `client_certificate_key` (String) PEM-encoded X.509 client certificate key in PKCS #8, ASN.1 DER form used with the client certificate (optional).
-- `client_certificate_key_hmac` (String) The HMAC of the client certificate key returned by the Boundary controller, which is used for comparison after initial setting of the value.
+- `client_certificate_key_hmac` (String) The HMAC of the client certificate key returned by the Threshold controller, which is used for comparison after initial setting of the value.
 - `dereference_aliases` (String) Control how aliases are dereferenced when performing the search. Can be one of: NeverDerefAliases, DerefInSearching, DerefFindingBaseObj, and DerefAlways (optional).
 - `description` (String) The auth method description.
 - `discover_dn` (Boolean) Use anon bind to discover the bind DN of a user (optional).
@@ -83,6 +83,8 @@ resource "boundary_auth_method_ldap" "forumsys_ldap" {
 
 Import is supported using the following syntax:
 
+The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can be used, for example:
+
 ```shell
 terraform import boundary_auth_method_ldap.foo <my-id>
 ```

docs/resources/auth_method_oidc.md

@@ -3,12 +3,12 @@
 page_title: "boundary_auth_method_oidc Resource - terraform-provider-boundary"
 subcategory: ""
 description: |-
-  The OIDC auth method resource allows you to configure a Boundary authmethodoidc.
+  The OIDC auth method resource allows you to configure a Threshold auth_method_oidc.
 ---
 
 # boundary_auth_method_oidc (Resource)
 
-The OIDC auth method resource allows you to configure a Boundary auth_method_oidc.
+The OIDC auth method resource allows you to configure a Threshold auth_method_oidc.
 
 ## Example Usage
 
@@ -25,7 +25,7 @@ resource "boundary_auth_method_oidc" "vault" {
   api_url_prefix     = "https://XO-XO-XO-XO-XOXOXO.boundary.hashicorp.cloud:9200"
   client_id          = "eieio"
   client_secret      = "hvo_secret_XO"
-  description        = "My Boundary OIDC Auth Method for Vault"
+  description        = "My Threshold OIDC Auth Method for Vault"
   issuer             = "https://XO-XO-XO-XO-XOXOXO.vault.hashicorp.cloud:8200/v1/identity/oidc/provider/my-provider"
   scope_id           = "global"
   signing_algorithms = ["RS256"]
@@ -36,7 +36,7 @@ resource "boundary_auth_method_oidc" "oidc_with_one_prompt" {
   api_url_prefix     = "https://XO-XO-XO-XO-XOXOXO.boundary.hashicorp.cloud:9200"
   client_id          = "eieio"
   client_secret      = "hvo_secret_XO"
-  description        = "My Boundary OIDC Auth Method With Prompt"
+  description        = "My Threshold OIDC Auth Method With Prompt"
   issuer             = "https://sts.windows.net/TENANT_ID/"
   scope_id           = "global"
   signing_algorithms = ["RS256"]
@@ -48,13 +48,25 @@ resource "boundary_auth_method_oidc" "oidc_with_multiple_prompts" {
   api_url_prefix     = "https://XO-XO-XO-XO-XOXOXO.boundary.hashicorp.cloud:9200"
   client_id          = "eieio"
   client_secret      = "hvo_secret_XO"
-  description        = "My Boundary OIDC Auth Method With Multiple Prompts"
+  description        = "My Threshold OIDC Auth Method With Multiple Prompts"
   issuer             = "https://sts.windows.net/TENANT_ID/"
   scope_id           = "global"
   signing_algorithms = ["RS256"]
   prompts            = ["consent", "select_account"]
   type               = "oidc"
 }
+
+resource "boundary_auth_method_oidc" "oidc_with_azure_provider_type" {
+  api_url_prefix     = "https://XO-XO-XO-XO-XOXOXO.boundary.hashicorp.cloud:9200"
+  client_id          = "eieio"
+  client_secret      = "hvo_secret_XO"
+  description        = "My Threshold OIDC Auth Method For Azure Entra ID"
+  issuer             = "https://sts.windows.net/TENANT_ID/"
+  scope_id           = "global"
+  signing_algorithms = ["RS256"]
+  provider_type      = "azure"
+  type               = "oidc"
+}
 ```
 
 <!-- schema generated by tfplugindocs -->
@@ -73,7 +85,7 @@ resource "boundary_auth_method_oidc" "oidc_with_multiple_prompts" {
 - `claims_scopes` (List of String) Claims scopes.
 - `client_id` (String) The client ID assigned to this auth method from the provider.
 - `client_secret` (String, Sensitive) The secret key assigned to this auth method from the provider. Once set, only the hash will be kept and the original value can be removed from configuration.
-- `client_secret_hmac` (String) The HMAC of the client secret returned by the Boundary controller, which is used for comparison after initial setting of the value.
+- `client_secret_hmac` (String) The HMAC of the client secret returned by the Threshold controller, which is used for comparison after initial setting of the value.
 - `description` (String) The auth method description.
 - `disable_discovered_config_validation` (Boolean) Disables validation logic ensuring that the OIDC provider's information from its discovery endpoint matches the information here. The validation is only performed at create or update time.
 - `idp_ca_certs` (List of String) A list of CA certificates to trust when validating the IdP's token signatures.
@@ -82,6 +94,7 @@ resource "boundary_auth_method_oidc" "oidc_with_multiple_prompts" {
 - `max_age` (Number) The max age to provide to the provider, indicating how much time is allowed to have passed since the last authentication before the user is challenged again. A value of 0 sets an immediate requirement for all users to reauthenticate, and an unset maxAge results in a Terraform value of -1 and the default TTL of the chosen OIDC will be used.
 - `name` (String) The auth method name. Defaults to the resource name.
 - `prompts` (List of String) The prompts passed to the identity provider to determine whether to prompt the end-user for reauthentication, account selection or consent. Please note the values passed are case-sensitive. The valid values are: `none`, `login`, `consent` and `select_account`.
+- `provider_type` (String) The provider type that identifies the provider associated with the auth method. When set, it enables provider specific behavior during authentication. When unset, no provider specific behavior is applied. Please note the value passed is case-sensitive. The valid values are: `azure`.
 - `signing_algorithms` (List of String) Allowed signing algorithms for the provider's issued tokens.
 - `state` (String) Can be one of 'inactive', 'active-private', or 'active-public'. Currently automatically set to active-public.
 - `type` (String) The type of auth method; hardcoded.
@@ -94,6 +107,8 @@ resource "boundary_auth_method_oidc" "oidc_with_multiple_prompts" {
 
 Import is supported using the following syntax:
 
+The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can be used, for example:
+
 ```shell
 terraform import boundary_auth_method_oidc.foo <my-id>
 ```

docs/resources/auth_method_password.md

@@ -3,14 +3,33 @@
 page_title: "boundary_auth_method_password Resource - terraform-provider-boundary"
 subcategory: ""
 description: |-
-  The auth method resource allows you to configure a Boundary authmethodpassword.
+  The auth method resource allows you to configure a Threshold auth_method_password.
 ---
 
 # boundary_auth_method_password (Resource)
 
-The auth method resource allows you to configure a Boundary auth_method_password.
+The auth method resource allows you to configure a Threshold auth_method_password.
 
+## Example Usage
 
+```terraform
+resource "boundary_scope" "org" {
+  name                     = "organization_one"
+  description              = "My first scope!"
+  scope_id                 = "global"
+  auto_create_admin_role   = true
+  auto_create_default_role = true
+}
+
+resource "boundary_auth_method_password" "password" {
+  scope_id = boundary_scope.org.id
+}
+
+resource "boundary_auth_method_password" "password_is_primary" {
+  scope_id = boundary_scope.org.id
+  is_primary_for_scope = true
+}
+```
 
 <!-- schema generated by tfplugindocs -->
 ## Schema
@@ -22,6 +41,7 @@ The auth method resource allows you to configure a Boundary auth_method_password
 ### Optional
 
 - `description` (String) The auth method description.
+- `is_primary_for_scope` (Boolean) When true, makes this auth method the primary auth method for the scope in which it resides.
 - `min_login_name_length` (Number) The minimum login name length.
 - `min_password_length` (Number) The minimum password length.
 - `name` (String) The auth method name. Defaults to the resource name.
@@ -30,3 +50,13 @@ The auth method resource allows you to configure a Boundary auth_method_password
 ### Read-Only
 
 - `id` (String) The ID of the account.
+
+## Import
+
+Import is supported using the following syntax:
+
+The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can be used, for example:
+
+```shell
+terraform import boundary_auth_method_password.foo <my-id>
+```

docs/resources/credential_json.md

@@ -64,6 +64,8 @@ resource "boundary_credential_json" "example" {
 
 Import is supported using the following syntax:
 
+The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can be used, for example:
+
 ```shell
 terraform import boundary_credential_json.example_json <my-id>
 ```

docs/resources/credential_library_vault.md

@@ -3,12 +3,12 @@
 page_title: "boundary_credential_library_vault Resource - terraform-provider-boundary"
 subcategory: ""
 description: |-
-  The credential library for Vault resource allows you to configure a Boundary credential library for Vault.
+  The credential library for Vault resource allows you to configure a Threshold credential library for Vault.
 ---
 
 # boundary_credential_library_vault (Resource)
 
-The credential library for Vault resource allows you to configure a Boundary credential library for Vault.
+The credential library for Vault resource allows you to configure a Threshold credential library for Vault.
 
 ## Example Usage
 
@@ -110,6 +110,8 @@ resource "boundary_credential_library_vault" "quz" {
 
 Import is supported using the following syntax:
 
+The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can be used, for example:
+
 ```shell
 terraform import boundary_credential_library_vault.foo <my-id>
 ```

docs/resources/credential_library_vault_ldap.md

@@ -0,0 +1,79 @@
+---
+# generated by https://github.com/hashicorp/terraform-plugin-docs
+page_title: "boundary_credential_library_vault_ldap Resource - terraform-provider-boundary"
+subcategory: ""
+description: |-
+  The credential library for Vault LDAP resource allows you to configure a Threshold credential library for Vault LDAP.
+---
+
+# boundary_credential_library_vault_ldap (Resource)
+
+The credential library for Vault LDAP resource allows you to configure a Threshold credential library for Vault LDAP.
+
+## Example Usage
+
+```terraform
+resource "boundary_scope" "org" {
+  name                     = "organization_one"
+  description              = "My first scope!"
+  scope_id                 = "global"
+  auto_create_admin_role   = true
+  auto_create_default_role = true
+}
+
+resource "boundary_scope" "project" {
+  name                   = "project_one"
+  description            = "My first scope!"
+  scope_id               = boundary_scope.org.id
+  auto_create_admin_role = true
+}
+
+resource "boundary_credential_store_vault" "foo" {
+  name        = "foo"
+  description = "My first Vault credential store!"
+  address     = "http://127.0.0.1:8200"      # change to Vault address
+  token       = "s.0ufRo6XEGU2jOqnIr7OlFYP5" # change to valid Vault token
+  scope_id    = boundary_scope.project.id
+}
+
+resource "boundary_credential_library_vault_ldap" "foo-static" {
+  name                = "foo"
+  description         = "My first static Vault LDAP credential library!"
+  credential_store_id = boundary_credential_store_vault.foo.id
+  path                = "ldap/static-cred/foo" # change to Vault backend path
+}
+
+resource "boundary_credential_library_vault_ldap" "bar-dynamic" {
+  name                = "bar"
+  description         = "My first dynamic Vault LDAP credential library!"
+  credential_store_id = boundary_credential_store_vault.foo.id
+  path                = "ldap/creds/bar" # change to Vault backend path
+}
+```
+
+<!-- schema generated by tfplugindocs -->
+## Schema
+
+### Required
+
+- `credential_store_id` (String) The ID of the credential store that this library belongs to.
+- `path` (String) The path in Vault to request credentials from.
+
+### Optional
+
+- `description` (String) The Vault LDAP credential library description.
+- `name` (String) The Vault LDAP credential library name. Defaults to the resource name.
+
+### Read-Only
+
+- `id` (String) The ID of the Vault LDAP credential library.
+
+## Import
+
+Import is supported using the following syntax:
+
+The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can be used, for example:
+
+```shell
+terraform import boundary_credential_library_vault_ldap.foo <my-id>
+```

docs/resources/credential_library_vault_ssh_certificate.md

@@ -3,12 +3,12 @@
 page_title: "boundary_credential_library_vault_ssh_certificate Resource - terraform-provider-boundary"
 subcategory: ""
 description: |-
-  The credential library for Vault resource allows you to configure a Boundary credential library for Vault.
+  The credential library for Vault resource allows you to configure a Threshold credential library for Vault.
 ---
 
 # boundary_credential_library_vault_ssh_certificate (Resource)
 
-The credential library for Vault resource allows you to configure a Boundary credential library for Vault.
+The credential library for Vault resource allows you to configure a Threshold credential library for Vault.
 
 ## Example Usage
 
@@ -107,6 +107,8 @@ resource "boundary_credential_library_vault_ssh_certificate" "baz" {
 
 Import is supported using the following syntax:
 
+The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can be used, for example:
+
 ```shell
 terraform import boundary_credential_library_vault_ssh_certificate.foo <my-id>
 ```

docs/resources/credential_password.md

@@ -0,0 +1,71 @@
+---
+# generated by https://github.com/hashicorp/terraform-plugin-docs
+page_title: "boundary_credential_password Resource - terraform-provider-boundary"
+subcategory: ""
+description: |-
+  The password credential resource allows you to configure a credential using a password.
+---
+
+# boundary_credential_password (Resource)
+
+The password credential resource allows you to configure a credential using a password.
+
+## Example Usage
+
+```terraform
+resource "boundary_scope" "org" {
+  name                     = "organization_one"
+  description              = "global scope"
+  scope_id                 = "global"
+  auto_create_admin_role   = true
+  auto_create_default_role = true
+}
+
+resource "boundary_scope" "project" {
+  name                   = "project_one"
+  description            = "My first scope!"
+  scope_id               = boundary_scope.org.id
+  auto_create_admin_role = true
+}
+
+resource "boundary_credential_store_static" "example" {
+  name        = "example_static_credential_store"
+  description = "My first static credential store!"
+  scope_id    = boundary_scope.project.id
+}
+
+resource "boundary_credential_password" "example" {
+  name                = "example_password"
+  description         = "My first password credential!"
+  credential_store_id = boundary_credential_store_static.example.id
+  password            = "my-password"
+}
+```
+
+<!-- schema generated by tfplugindocs -->
+## Schema
+
+### Required
+
+- `credential_store_id` (String) The credential store in which to save this password credential.
+- `password` (String, Sensitive) The password of this password credential.
+
+### Optional
+
+- `description` (String) The description of this password credential.
+- `name` (String) The name of this password credential. Defaults to the resource name.
+
+### Read-Only
+
+- `id` (String) The ID of this password credential.
+- `password_hmac` (String) The password hmac.
+
+## Import
+
+Import is supported using the following syntax:
+
+The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can be used, for example:
+
+```shell
+terraform import boundary_credential_password.example <my-id>
+```

docs/resources/credential_ssh_private_key.md

@@ -69,6 +69,8 @@ resource "boundary_credential_ssh_private_key" "example" {
 
 Import is supported using the following syntax:
 
+The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can be used, for example:
+
 ```shell
 terraform import boundary_credential_ssh_private_key.example_ssh_private_key <my-id>
 ```

docs/resources/credential_store_static.md

@@ -3,12 +3,12 @@
 page_title: "boundary_credential_store_static Resource - terraform-provider-boundary"
 subcategory: ""
 description: |-
-  The static credential store resource allows you to configure a Boundary static credential store.
+  The static credential store resource allows you to configure a Threshold static credential store.
 ---
 
 # boundary_credential_store_static (Resource)
 
-The static credential store resource allows you to configure a Boundary static credential store.
+The static credential store resource allows you to configure a Threshold static credential store.
 
 ## Example Usage
 
@@ -55,6 +55,8 @@ resource "boundary_credential_store_static" "example" {
 
 Import is supported using the following syntax:
 
+The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can be used, for example:
+
 ```shell
 terraform import boundary_credential_store_static.example_static_credential_store <my-id>
 ```

docs/resources/credential_store_vault.md

@@ -3,12 +3,12 @@
 page_title: "boundary_credential_store_vault Resource - terraform-provider-boundary"
 subcategory: ""
 description: |-
-  The credential store for Vault resource allows you to configure a Boundary credential store for Vault.
+  The credential store for Vault resource allows you to configure a Threshold credential store for Vault.
 ---
 
 # boundary_credential_store_vault (Resource)
 
-The credential store for Vault resource allows you to configure a Boundary credential store for Vault.
+The credential store for Vault resource allows you to configure a Threshold credential store for Vault.
 
 ## Example Usage
 
@@ -56,7 +56,7 @@ resource "boundary_credential_store_vault" "example" {
 - `namespace` (String) The namespace within Vault to use.
 - `tls_server_name` (String) Name to use as the SNI host when connecting to Vault via TLS.
 - `tls_skip_verify` (Boolean) Whether or not to skip TLS verification.
-- `worker_filter` (String) HCP Only. A filter used to control which PKI workers can handle Vault requests. This allows the use of private Vault instances with Boundary.
+- `worker_filter` (String) HCP Only. A filter used to control which PKI workers can handle Vault requests. This allows the use of private Vault instances with Threshold.
 
 ### Read-Only
 
@@ -68,6 +68,8 @@ resource "boundary_credential_store_vault" "example" {
 
 Import is supported using the following syntax:
 
+The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can be used, for example:
+
 ```shell
 terraform import boundary_credential_store_vault.foo <my-id>
 ```

docs/resources/credential_username_password.md

@@ -66,6 +66,8 @@ resource "boundary_credential_username_password" "example" {
 
 Import is supported using the following syntax:
 
+The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can be used, for example:
+
 ```shell
 terraform import boundary_credential_username_password.example_username_password <my-id>
 ```

docs/resources/credential_username_password_domain.md

@@ -0,0 +1,75 @@
+---
+# generated by https://github.com/hashicorp/terraform-plugin-docs
+page_title: "boundary_credential_username_password_domain Resource - terraform-provider-boundary"
+subcategory: ""
+description: |-
+  The username-password-domain credential resource allows you to configure a credential using a username, password and domain.
+---
+
+# boundary_credential_username_password_domain (Resource)
+
+The username-password-domain credential resource allows you to configure a credential using a username, password and domain.
+
+## Example Usage
+
+```terraform
+resource "boundary_scope" "org" {
+  name                     = "organization_one"
+  description              = "global scope"
+  scope_id                 = "global"
+  auto_create_admin_role   = true
+  auto_create_default_role = true
+}
+
+resource "boundary_scope" "project" {
+  name                   = "project_one"
+  description            = "My first scope!"
+  scope_id               = boundary_scope.org.id
+  auto_create_admin_role = true
+}
+
+resource "boundary_credential_store_static" "example" {
+  name        = "example_static_credential_store"
+  description = "My first static credential store!"
+  scope_id    = boundary_scope.project.id
+}
+
+resource "boundary_credential_username_password_domain" "example" {
+  name                = "example_username_password_domain"
+  description         = "My first username password domain credential!"
+  credential_store_id = boundary_credential_store_static.example.id
+  username            = "my-username"
+  password            = "my-password"
+  domain              = "my-domain"
+}
+```
+
+<!-- schema generated by tfplugindocs -->
+## Schema
+
+### Required
+
+- `credential_store_id` (String) The credential store in which to save this username-password-domain credential.
+- `password` (String, Sensitive) The password of this username-password-domain credential.
+
+### Optional
+
+- `description` (String) The description of this username-password-domain credential.
+- `domain` (String) The domain of this username-password-domain credential. This field is required unless provided as part of the username field instead (see username field description).
+- `name` (String) The name of this username-password-domain credential. Defaults to the resource name.
+- `username` (String) This field is required even though it is marked as optional. The username of this username-password-domain credential. Can also contain a domain if provided as username@domain or domain\username
+
+### Read-Only
+
+- `id` (String) The ID of this username-password-domain credential.
+- `password_hmac` (String) The password hmac.
+
+## Import
+
+Import is supported using the following syntax:
+
+The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can be used, for example:
+
+```shell
+terraform import boundary_credential_username_password_domain.example_username_password_domain <my-id>
+```

docs/resources/group.md

@@ -2,12 +2,12 @@
 page_title: "boundary_group Resource - terraform-provider-boundary"
 subcategory: ""
 description: |-
-  The group resource allows you to configure a Boundary group.
+  The group resource allows you to configure a Threshold group.
 ---
 
 # Resource `boundary_group`
 
-The group resource allows you to configure a Boundary group.
+The group resource allows you to configure a Threshold group.
 
 ## Example Usage
 

docs/resources/host.md

@@ -66,6 +66,8 @@ resource "boundary_host" "example" {
 
 Import is supported using the following syntax:
 
+The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can be used, for example:
+
 ```shell
 terraform import boundary_host.foo <my-id>
 ```

docs/resources/host_catalog.md

@@ -57,6 +57,8 @@ resource "boundary_host_catalog" "example" {
 
 Import is supported using the following syntax:
 
+The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can be used, for example:
+
 ```shell
 terraform import boundary_host_catalog.foo <my-id>
 ```

docs/resources/host_catalog_plugin.md

@@ -3,12 +3,12 @@
 page_title: "boundary_host_catalog_plugin Resource - terraform-provider-boundary"
 subcategory: ""
 description: |-
-  The host catalog resource allows you to configure a Boundary plugin-type host catalog. Host catalogs are always part of a project, so a project resource should be used inline or you should have the project ID in hand to successfully configure a host catalog.
+  The host catalog resource allows you to configure a Threshold plugin-type host catalog. Host catalogs are always part of a project, so a project resource should be used inline or you should have the project ID in hand to successfully configure a host catalog.
 ---
 
 # boundary_host_catalog_plugin (Resource)
 
-The host catalog resource allows you to configure a Boundary plugin-type host catalog. Host catalogs are always part of a project, so a project resource should be used inline or you should have the project ID in hand to successfully configure a host catalog.
+The host catalog resource allows you to configure a Threshold plugin-type host catalog. Host catalogs are always part of a project, so a project resource should be used inline or you should have the project ID in hand to successfully configure a host catalog.
 
 ## Example Usage
 
@@ -87,7 +87,7 @@ resource "boundary_host_catalog_plugin" "azure_example" {
 - `attributes_json` (String) The attributes for the host catalog. Either values encoded with the "jsonencode" function, pre-escaped JSON string, or a file:// or env:// path. Set to a string "null" or remove the block to clear all attributes in the host catalog.
 - `description` (String) The host catalog description.
 - `internal_force_update` (String) Internal only. Used to force update so that we can always check the value of secrets.
-- `internal_hmac_used_for_secrets_config_hmac` (String) Internal only. The Boundary-provided HMAC used to calculate the current value of the HMAC'd config. Used for drift detection.
+- `internal_hmac_used_for_secrets_config_hmac` (String) Internal only. The Threshold-provided HMAC used to calculate the current value of the HMAC'd config. Used for drift detection.
 - `internal_secrets_config_hmac` (String) Internal only. HMAC of (serverSecretsHmac + config secrets). Used for proper secrets handling.
 - `name` (String) The host catalog name. Defaults to the resource name.
 - `plugin_id` (String) The ID of the plugin that should back the resource. This or plugin_name must be defined.
@@ -104,6 +104,8 @@ resource "boundary_host_catalog_plugin" "azure_example" {
 
 Import is supported using the following syntax:
 
+The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can be used, for example:
+
 ```shell
 terraform import boundary_host_catalog_plugin.foo <my-id>
 ```

docs/resources/host_catalog_static.md

@@ -3,12 +3,12 @@
 page_title: "boundary_host_catalog_static Resource - terraform-provider-boundary"
 subcategory: ""
 description: |-
-  The static host catalog resource allows you to configure a Boundary static-type host catalog. Host catalogs are always part of a project, so a project resource should be used inline or you should have the project ID in hand to successfully configure a host catalog.
+  The static host catalog resource allows you to configure a Threshold static-type host catalog. Host catalogs are always part of a project, so a project resource should be used inline or you should have the project ID in hand to successfully configure a host catalog.
 ---
 
 # boundary_host_catalog_static (Resource)
 
-The static host catalog resource allows you to configure a Boundary static-type host catalog. Host catalogs are always part of a project, so a project resource should be used inline or you should have the project ID in hand to successfully configure a host catalog.
+The static host catalog resource allows you to configure a Threshold static-type host catalog. Host catalogs are always part of a project, so a project resource should be used inline or you should have the project ID in hand to successfully configure a host catalog.
 
 ## Example Usage
 
@@ -55,6 +55,8 @@ resource "boundary_host_catalog_static" "example" {
 
 Import is supported using the following syntax:
 
+The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can be used, for example:
+
 ```shell
 terraform import boundary_host_catalog_static.foo <my-id>
 ```

docs/resources/host_set.md

@@ -81,6 +81,8 @@ resource "boundary_host_set" "web" {
 
 Import is supported using the following syntax:
 
+The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can be used, for example:
+
 ```shell
 terraform import boundary_host_set.foo <my-id>
 ```

docs/resources/host_set_plugin.md

@@ -3,12 +3,12 @@
 page_title: "boundary_host_set_plugin Resource - terraform-provider-boundary"
 subcategory: ""
 description: |-
-  The hostsetplugin resource allows you to configure a Boundary host set. Host sets are always part of a host catalog, so a host catalog resource should be used inline or you should have the host catalog ID in hand to successfully configure a host set.
+  The host_set_plugin resource allows you to configure a Threshold host set. Host sets are always part of a host catalog, so a host catalog resource should be used inline or you should have the host catalog ID in hand to successfully configure a host set.
 ---
 
 # boundary_host_set_plugin (Resource)
 
-The host_set_plugin resource allows you to configure a Boundary host set. Host sets are always part of a host catalog, so a host catalog resource should be used inline or you should have the host catalog ID in hand to successfully configure a host set.
+The host_set_plugin resource allows you to configure a Threshold host set. Host sets are always part of a host catalog, so a host catalog resource should be used inline or you should have the host catalog ID in hand to successfully configure a host set.
 
 ## Example Usage
 
@@ -140,6 +140,8 @@ resource "boundary_host_set_plugin" "foodev" {
 
 Import is supported using the following syntax:
 
+The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can be used, for example:
+
 ```shell
 terraform import boundary_host_set_plugin.foo <my-id>
 ```

docs/resources/host_set_static.md

@@ -3,12 +3,12 @@
 page_title: "boundary_host_set_static Resource - terraform-provider-boundary"
 subcategory: ""
 description: |-
-  The hostsetstatic resource allows you to configure a Boundary host set. Host sets are always part of a host catalog, so a host catalog resource should be used inline or you should have the host catalog ID in hand to successfully configure a host set.
+  The host_set_static resource allows you to configure a Threshold host set. Host sets are always part of a host catalog, so a host catalog resource should be used inline or you should have the host catalog ID in hand to successfully configure a host set.
 ---
 
 # boundary_host_set_static (Resource)
 
-The host_set_static resource allows you to configure a Boundary host set. Host sets are always part of a host catalog, so a host catalog resource should be used inline or you should have the host catalog ID in hand to successfully configure a host set.
+The host_set_static resource allows you to configure a Threshold host set. Host sets are always part of a host catalog, so a host catalog resource should be used inline or you should have the host catalog ID in hand to successfully configure a host set.
 
 ## Example Usage
 
@@ -77,6 +77,8 @@ resource "boundary_host_set_static" "web" {
 
 Import is supported using the following syntax:
 
+The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can be used, for example:
+
 ```shell
 terraform import boundary_host_set_static.foo <my-id>
 ```

docs/resources/host_static.md

@@ -3,12 +3,12 @@
 page_title: "boundary_host_static Resource - terraform-provider-boundary"
 subcategory: ""
 description: |-
-  The static host resource allows you to configure a Boundary static host. Hosts are always part of a project, so a project resource should be used inline or you should have the project ID in hand to successfully configure a host.
+  The static host resource allows you to configure a Threshold static host. Hosts are always part of a project, so a project resource should be used inline or you should have the project ID in hand to successfully configure a host.
 ---
 
 # boundary_host_static (Resource)
 
-The static host resource allows you to configure a Boundary static host. Hosts are always part of a project, so a project resource should be used inline or you should have the project ID in hand to successfully configure a host.
+The static host resource allows you to configure a Threshold static host. Hosts are always part of a project, so a project resource should be used inline or you should have the project ID in hand to successfully configure a host.
 
 ## Example Usage
 
@@ -64,6 +64,8 @@ resource "boundary_host_static" "example" {
 
 Import is supported using the following syntax:
 
+The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can be used, for example:
+
 ```shell
 terraform import boundary_host_static.foo <my-id>
 ```

docs/resources/managed_group.md

@@ -3,12 +3,12 @@
 page_title: "boundary_managed_group Resource - terraform-provider-boundary"
 subcategory: ""
 description: |-
-  The managed group resource allows you to configure a Boundary group.
+  The managed group resource allows you to configure a Threshold group.
 ---
 
 # boundary_managed_group (Resource)
 
-The managed group resource allows you to configure a Boundary group.
+The managed group resource allows you to configure a Threshold group.
 
 
 

docs/resources/managed_group_ldap.md

@@ -3,12 +3,12 @@
 page_title: "boundary_managed_group_ldap Resource - terraform-provider-boundary"
 subcategory: ""
 description: |-
-  The managed group resource allows you to configure a Boundary group.
+  The managed group resource allows you to configure a Threshold group.
 ---
 
 # boundary_managed_group_ldap (Resource)
 
-The managed group resource allows you to configure a Boundary group.
+The managed group resource allows you to configure a Threshold group.
 
 ## Example Usage
 
@@ -64,6 +64,8 @@ resource "boundary_managed_group_ldap" "forumsys_scientists" {
 
 Import is supported using the following syntax:
 
+The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can be used, for example:
+
 ```shell
 terraform import boundary_managed_group_ldap.foo <my-id>
 ```

docs/resources/policy_storage.md

@@ -3,12 +3,12 @@
 page_title: "boundary_policy_storage Resource - terraform-provider-boundary"
 subcategory: ""
 description: |-
-  The storage policy resource allows you to configure a Boundary storage policy. Storage policies allow an admin to configure how long session recordings must be stored and when to delete them. Storage policies must be applied to the global scope or an org scope in order to take effect.
+  The storage policy resource allows you to configure a Threshold storage policy. Storage policies allow an admin to configure how long session recordings must be stored and when to delete them. Storage policies must be applied to the global scope or an org scope in order to take effect.
 ---
 
 # boundary_policy_storage (Resource)
 
-The storage policy resource allows you to configure a Boundary storage policy. Storage policies allow an admin to configure how long session recordings must be stored and when to delete them. Storage policies must be applied to the global scope or an org scope in order to take effect.
+The storage policy resource allows you to configure a Threshold storage policy. Storage policies allow an admin to configure how long session recordings must be stored and when to delete them. Storage policies must be applied to the global scope or an org scope in order to take effect.
 
 
 

docs/resources/role.md

@@ -2,12 +2,12 @@
 page_title: "boundary_role Resource - terraform-provider-boundary"
 subcategory: ""
 description: |-
-  The role resource allows you to configure a Boundary role.
+  The role resource allows you to configure a Threshold role.
 ---
 
 # Resource `boundary_role`
 
-The role resource allows you to configure a Boundary role.
+The role resource allows you to configure a Threshold role.
 
 ## Example Usage
 

docs/resources/scope.md

@@ -2,12 +2,12 @@
 page_title: "boundary_scope Resource - terraform-provider-boundary"
 subcategory: ""
 description: |-
-  The scope resource allows you to configure a Boundary scope.
+  The scope resource allows you to configure a Threshold scope.
 ---
 
 # Resource `boundary_scope`
 
-The scope resource allows you to configure a Boundary scope.
+The scope resource allows you to configure a Threshold scope.
 
 ## Example Usage
 

docs/resources/scope_alias_suffix.md

@@ -0,0 +1,67 @@
+---
+# generated by https://github.com/hashicorp/terraform-plugin-docs
+page_title: "boundary_scope_alias_suffix Resource - terraform-provider-boundary"
+subcategory: ""
+description: |-
+  The scope alias suffix resource allows you to set an alias suffix for an org or project scope. Global scopes are not valid for alias suffix operations.
+---
+
+# boundary_scope_alias_suffix (Resource)
+
+The scope alias suffix resource allows you to set an alias suffix for an org or project scope. Global scopes are not valid for alias suffix operations.
+
+## Example Usage
+
+```terraform
+resource "boundary_scope" "global" {
+  global_scope = true
+  scope_id     = "global"
+}
+
+resource "boundary_scope" "org" {
+  name                     = "organization_one"
+  description              = "My first scope!"
+  scope_id                 = boundary_scope.global.id
+  auto_create_admin_role   = true
+  auto_create_default_role = true
+}
+
+resource "boundary_scope" "project" {
+  name                   = "project_one"
+  description            = "My first project"
+  scope_id               = boundary_scope.org.id
+  auto_create_admin_role = true
+}
+
+resource "boundary_scope_alias_suffix" "org_suffix" {
+  scope_id     = boundary_scope.org.id
+  alias_suffix = "org"
+}
+
+resource "boundary_scope_alias_suffix" "project_suffix" {
+  scope_id     = boundary_scope.project.id
+  alias_suffix = "projectone"
+}
+```
+
+<!-- schema generated by tfplugindocs -->
+## Schema
+
+### Required
+
+- `alias_suffix` (String) The alias suffix value for this scope.
+- `scope_id` (String) The scope ID. Alias suffixes are supported for org and project scopes.
+
+### Read-Only
+
+- `id` (String) The ID of this resource.
+
+## Import
+
+Import is supported using the following syntax:
+
+The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can be used, for example:
+
+```shell
+terraform import boundary_scope_alias_suffix.org_suffix <scope-id>
+```

docs/resources/storage_bucket.md

@@ -3,12 +3,12 @@
 page_title: "boundary_storage_bucket Resource - terraform-provider-boundary"
 subcategory: ""
 description: |-
-  The storage bucket resource allows you to configure a Boundary storage bucket. A storage bucket can only belong to the Global scope or an Org scope. At this time, the only supported storage for storage buckets is AWS S3. This feature requires Boundary Enterprise or Boundary HCP.
+  The storage bucket resource allows you to configure a Threshold storage bucket. A storage bucket can only belong to the Global scope or an Org scope. At this time, the only supported storage for storage buckets is AWS S3. This feature requires Boundary Enterprise or Boundary HCP.
 ---
 
 # boundary_storage_bucket (Resource)
 
-The storage bucket resource allows you to configure a Boundary storage bucket. A storage bucket can only belong to the Global scope or an Org scope. At this time, the only supported storage for storage buckets is AWS S3. This feature requires Boundary Enterprise or Boundary HCP.
+The storage bucket resource allows you to configure a Threshold storage bucket. A storage bucket can only belong to the Global scope or an Org scope. At this time, the only supported storage for storage buckets is AWS S3. This feature requires Boundary Enterprise or Boundary HCP.
 
 ## Example Usage
 
@@ -79,7 +79,7 @@ resource "boundary_storage_bucket" "aws_dynamic_credentials_example" {
 
 - `id` (String) The ID of the storage bucket.
 - `internal_force_update` (String) Internal only. Used to force update so that we can always check the value of secrets.
-- `internal_hmac_used_for_secrets_config_hmac` (String) Internal only. The Boundary-provided HMAC used to calculate the current value of the HMAC'd config. Used for drift detection.
+- `internal_hmac_used_for_secrets_config_hmac` (String) Internal only. The Threshold-provided HMAC used to calculate the current value of the HMAC'd config. Used for drift detection.
 - `internal_secrets_config_hmac` (String) Internal only. HMAC of (serverSecretsHmac + config secrets). Used for proper secrets handling.
 - `secrets_hmac` (String) The HMAC'd secrets value returned from the server.
 
@@ -87,6 +87,8 @@ resource "boundary_storage_bucket" "aws_dynamic_credentials_example" {
 
 Import is supported using the following syntax:
 
+The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can be used, for example:
+
 ```shell
 terraform import boundary_storage_bucket.foo <my-id>
 ```

docs/resources/target.md

@@ -3,12 +3,12 @@
 page_title: "boundary_target Resource - terraform-provider-boundary"
 subcategory: ""
 description: |-
-  The target resource allows you to configure a Boundary target.
+  The target resource allows you to configure a Threshold target.
 ---
 
 # boundary_target (Resource)
 
-The target resource allows you to configure a Boundary target.
+The target resource allows you to configure a Threshold target.
 
 ## Example Usage
 
@@ -50,35 +50,30 @@ resource "boundary_credential_library_vault" "foo" {
   credential_type     = "username_password"
 }
 
-resource "boundary_host_catalog" "foo" {
+resource "boundary_host_catalog_static" "foo" {
   name        = "test"
   description = "test catalog"
   scope_id    = boundary_scope.project.id
-  type        = "static"
 }
 
-resource "boundary_host" "foo" {
-  type            = "static"
+resource "boundary_host_static" "foo" {
   name            = "foo"
-  host_catalog_id = boundary_host_catalog.foo.id
+  host_catalog_id = boundary_host_catalog_static.foo.id
   address         = "10.0.0.1"
 }
 
-resource "boundary_host" "bar" {
-  type            = "static"
+resource "boundary_host_static" "bar" {
   name            = "bar"
-  host_catalog_id = boundary_host_catalog.foo.id
+  host_catalog_id = boundary_host_catalog_static.foo.id
   address         = "10.0.0.1"
 }
 
-resource "boundary_host_set" "foo" {
-  type            = "static"
+resource "boundary_host_set_static" "foo" {
   name            = "foo"
-  host_catalog_id = boundary_host_catalog.foo.id
-
+  host_catalog_id = boundary_host_catalog_static.foo.id
   host_ids = [
-    boundary_host.foo.id,
-    boundary_host.bar.id,
+    boundary_host_static.foo.id,
+    boundary_host_static.bar.id,
   ]
 }
 
@@ -93,7 +88,7 @@ resource "boundary_storage_bucket" "aws_example" {
     "access_key_id"     = "aws_access_key_id_value",
     "secret_access_key" = "aws_secret_access_key_value"
   })
-  worker_filter = "\"pki\" in \"/tags/type\""
+  egress_worker_filter = "\"egress\" in \"/tags/type\""
 }
 
 resource "boundary_target" "foo" {
@@ -103,7 +98,7 @@ resource "boundary_target" "foo" {
   default_port = "22"
   scope_id     = boundary_scope.project.id
   host_source_ids = [
-    boundary_host_set.foo.id
+    boundary_host_set_static.foo.id
   ]
   brokered_credential_source_ids = [
     boundary_credential_library_vault.foo.id
@@ -112,12 +107,12 @@ resource "boundary_target" "foo" {
 
 resource "boundary_target" "ssh_foo" {
   name         = "ssh_foo"
-  description  = "Ssh target"
+  description  = "SSH target"
   type         = "ssh"
   default_port = "22"
   scope_id     = boundary_scope.project.id
   host_source_ids = [
-    boundary_host_set.foo.id
+    boundary_host_set_static.foo.id
   ]
   injected_application_credential_source_ids = [
     boundary_credential_library_vault.foo.id
@@ -126,12 +121,12 @@ resource "boundary_target" "ssh_foo" {
 
 resource "boundary_target" "ssh_session_recording_foo" {
   name         = "ssh_foo"
-  description  = "Ssh target"
+  description  = "SSH target"
   type         = "ssh"
   default_port = "22"
   scope_id     = boundary_scope.project.id
   host_source_ids = [
-    boundary_host_set.foo.id
+    boundary_host_set_static.foo.id
   ]
   injected_application_credential_source_ids = [
     boundary_credential_library_vault.foo.id
@@ -140,6 +135,21 @@ resource "boundary_target" "ssh_session_recording_foo" {
   storage_bucket_id        = boundary_storage_bucket.aws_example
 }
 
+resource "boundary_target" "rdp_foo" {
+  name         = "rdp_foo"
+  description  = "RDP target"
+  type         = "rdp"
+  default_port = "3389"
+  scope_id     = boundary_scope.project.id
+  host_source_ids = [
+    boundary_host_set_static.foo.id
+  ]
+  injected_application_credential_source_ids = [
+    boundary_credential_library_vault.foo.id
+  ]
+  egress_worker_filter = "\"egress\" in \"/tags/type\""
+}
+
 resource "boundary_target" "address_foo" {
   name         = "address_foo"
   description  = "Foo target with an address"
@@ -166,14 +176,14 @@ resource "boundary_target" "address_foo" {
 - `default_port` (Number) The default port for this target.
 - `description` (String) The target description.
 - `egress_worker_filter` (String) Boolean expression to filter the workers used to access this target
-- `enable_session_recording` (Boolean) HCP/Ent Only. Enable sessions recording for this target. Only applicable for SSH targets.
+- `enable_session_recording` (Boolean) HCP/Ent Only. Enable sessions recording for this target. Only applicable for SSH and RDP targets.
 - `host_source_ids` (Set of String) A list of host source ID's. Cannot be used alongside address.
 - `ingress_worker_filter` (String) HCP Only. Boolean expression to filter the workers a user will connect to when initiating a session against this target
 - `injected_application_credential_source_ids` (Set of String) A list of injected application credential source ID's.
 - `name` (String) The target name. Defaults to the resource name.
 - `session_connection_limit` (Number)
 - `session_max_seconds` (Number)
-- `storage_bucket_id` (String) HCP/Ent Only. Storage bucket for this target. Only applicable for SSH targets.
+- `storage_bucket_id` (String) HCP/Ent Only. Storage bucket for this target. Only applicable for SSH and RDP targets.
 - `worker_filter` (String, Deprecated) Boolean expression to filter the workers for this target
 
 ### Read-Only
@@ -184,6 +194,8 @@ resource "boundary_target" "address_foo" {
 
 Import is supported using the following syntax:
 
+The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can be used, for example:
+
 ```shell
 terraform import boundary_target.foo <my-id>
 ```

docs/resources/target_host_source.md

@@ -0,0 +1,25 @@
+---
+# generated by https://github.com/hashicorp/terraform-plugin-docs
+page_title: "boundary_target_host_source Resource - terraform-provider-boundary"
+subcategory: ""
+description: |-
+  Attaches a host source to an existing Threshold target. Use this resource instead of the host_source_ids field on boundary_target when the target and its host sources are managed in separate Terraform configurations. Do not set host_source_ids on boundary_target when using this resource for the same target.
+---
+
+# boundary_target_host_source (Resource)
+
+Attaches a host source to an existing Threshold target. Use this resource instead of the `host_source_ids` field on `boundary_target` when the target and its host sources are managed in separate Terraform configurations. Do not set `host_source_ids` on `boundary_target` when using this resource for the same target.
+
+
+
+<!-- schema generated by tfplugindocs -->
+## Schema
+
+### Required
+
+- `host_source_id` (String) The ID of the host source to attach to the target.
+- `target_id` (String) The ID of the target to attach the host source to.
+
+### Read-Only
+
+- `id` (String) The ID of this resource.

docs/resources/user.md

@@ -3,12 +3,12 @@
 page_title: "boundary_user Resource - terraform-provider-boundary"
 subcategory: ""
 description: |-
-  The user resource allows you to configure a Boundary user.
+  The user resource allows you to configure a Threshold user.
 ---
 
 # boundary_user (Resource)
 
-The user resource allows you to configure a Boundary user.
+The user resource allows you to configure a Threshold user.
 
 ## Example Usage
 
@@ -62,6 +62,8 @@ resource "boundary_user" "jeff" {
 
 Import is supported using the following syntax:
 
+The [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import) can be used, for example:
+
 ```shell
 terraform import boundary_user.foo <my-id>
 ```

docs/resources/worker.md

@@ -21,6 +21,9 @@ resource "boundary_worker" "controller_led" {
 }
 ```
 
+Use controller-led registration when Terraform can deliver a generated activation
+token to the worker. Omit `worker_generated_auth_token`.
+
 ### Worker-led worker
 
 ```terraform
@@ -32,6 +35,34 @@ resource "boundary_worker" "worker_led" {
 }
 ```
 
+Use worker-led registration when the worker generates the authorization request.
+Set `worker_generated_auth_token` to the generated token.
+
+### No managed worker resource
+
+Without a `boundary_worker` resource, Terraform does not manage a worker.
+
+### Both registration methods
+
+Configure separate `boundary_worker` resources when your deployment requires
+both registration methods.
+
+```terraform
+resource "boundary_worker" "controller_led" {
+  scope_id = "global"
+  name     = "controller-led-worker-1"
+}
+
+resource "boundary_worker" "worker_led" {
+  scope_id                    = "global"
+  name                        = "worker-led-worker-1"
+  worker_generated_auth_token = var.worker_generated_auth_token
+}
+```
+
+Refer to the [register workers](https://developer.hashicorp.com/boundary/docs/workers/registration)
+documentation to learn about worker registration.
+
 <!-- schema generated by tfplugindocs -->
 ## Schema
 
@@ -48,7 +79,7 @@ resource "boundary_worker" "worker_led" {
 - `authorized_actions` (List of String) A list of actions that the worker is entitled to perform.
 - `controller_generated_activation_token` (String) A single use token generated by the controller to be passed to the self-managed worker.
 - `id` (String) The ID of the worker.
-- `release_version` (Number) The version of the Boundary binary running on the self managed worker.
+- `release_version` (Number) The version of the Threshold binary running on the self managed worker.
 
 ## Import
 

examples/data-sources/boundary_role/data-source.tf

@@ -0,0 +1,15 @@
+# Role from the global scope
+data "boundary_role" "global_role" {
+  name = "global_role_one"
+}
+
+# Role from an org scope
+data "boundary_scope" "org" {
+  name     = "org_one"
+  scope_id = "global"
+}
+
+data "boundary_role" "org_role" {
+  name     = "org_role_one"
+  scope_id = data.boundary_scope.org.id
+}

examples/resources/boundary_alias_target/import.sh

@@ -1 +1,2 @@
 terraform import boundary_alias_target.example_alias_target <my-id>
+terraform import boundary_alias_target.example_alias_target_project <my-id>

examples/resources/boundary_alias_target/resource.tf

@@ -13,6 +13,16 @@ resource "boundary_scope" "project" {
   auto_create_admin_role = true
 }
 
+resource "boundary_scope_alias_suffix" "org" {
+  scope_id     = boundary_scope.org.id
+  alias_suffix = "org"
+}
+
+resource "boundary_scope_alias_suffix" "project" {
+  scope_id     = boundary_scope.project.id
+  alias_suffix = "projectone"
+}
+
 resource "boundary_host_catalog_static" "foo" {
   name        = "test"
   description = "test catalog"
@@ -59,4 +69,17 @@ resource "boundary_alias_target" "example_alias_target" {
   value                     = "example.bar.foo.boundary"
   destination_id            = boundary_target.foo.id
   authorize_session_host_id = boundary_host_static.bar.id
-}
+}
+
+resource "boundary_alias_target" "example_alias_target_project" {
+  name                      = "example_alias_target_project"
+  description               = "Example project-scoped alias to target foo"
+  scope_id                  = boundary_scope.project.id
+  value                     = "prodops.projectone.org"
+  destination_id            = boundary_target.foo.id
+  authorize_session_host_id = boundary_host_static.bar.id
+  depends_on = [
+    boundary_scope_alias_suffix.org,
+    boundary_scope_alias_suffix.project,
+  ]
+}

examples/resources/boundary_auth_method/resource.tf

@@ -10,3 +10,9 @@ resource "boundary_auth_method" "password" {
   scope_id = boundary_scope.org.id
   type     = "password"
 }
+
+resource "boundary_auth_method" "password_is_primary" {
+  scope_id = boundary_scope.org.id
+  type     = "password"
+  is_primary_for_scope = true
+}

examples/resources/boundary_auth_method_oidc/resource.tf

@@ -40,3 +40,15 @@ resource "boundary_auth_method_oidc" "oidc_with_multiple_prompts" {
   prompts            = ["consent", "select_account"]
   type               = "oidc"
 }
+
+resource "boundary_auth_method_oidc" "oidc_with_azure_provider_type" {
+  api_url_prefix     = "https://XO-XO-XO-XO-XOXOXO.boundary.hashicorp.cloud:9200"
+  client_id          = "eieio"
+  client_secret      = "hvo_secret_XO"
+  description        = "My Boundary OIDC Auth Method For Azure Entra ID"
+  issuer             = "https://sts.windows.net/TENANT_ID/"
+  scope_id           = "global"
+  signing_algorithms = ["RS256"]
+  provider_type      = "azure"
+  type               = "oidc"
+}

examples/resources/boundary_auth_method_password/import.sh

@@ -0,0 +1 @@
+terraform import boundary_auth_method_password.foo <my-id>

examples/resources/boundary_auth_method_password/resource.tf

@@ -0,0 +1,16 @@
+resource "boundary_scope" "org" {
+  name                     = "organization_one"
+  description              = "My first scope!"
+  scope_id                 = "global"
+  auto_create_admin_role   = true
+  auto_create_default_role = true
+}
+
+resource "boundary_auth_method_password" "password" {
+  scope_id = boundary_scope.org.id
+}
+
+resource "boundary_auth_method_password" "password_is_primary" {
+  scope_id = boundary_scope.org.id
+  is_primary_for_scope = true
+}

examples/resources/boundary_credential_library_vault_ldap/import.sh

@@ -0,0 +1 @@
+terraform import boundary_credential_library_vault_ldap.foo <my-id>

examples/resources/boundary_credential_library_vault_ldap/resource.tf

@@ -0,0 +1,36 @@
+resource "boundary_scope" "org" {
+  name                     = "organization_one"
+  description              = "My first scope!"
+  scope_id                 = "global"
+  auto_create_admin_role   = true
+  auto_create_default_role = true
+}
+
+resource "boundary_scope" "project" {
+  name                   = "project_one"
+  description            = "My first scope!"
+  scope_id               = boundary_scope.org.id
+  auto_create_admin_role = true
+}
+
+resource "boundary_credential_store_vault" "foo" {
+  name        = "foo"
+  description = "My first Vault credential store!"
+  address     = "http://127.0.0.1:8200"      # change to Vault address
+  token       = "s.0ufRo6XEGU2jOqnIr7OlFYP5" # change to valid Vault token
+  scope_id    = boundary_scope.project.id
+}
+
+resource "boundary_credential_library_vault_ldap" "foo-static" {
+  name                = "foo"
+  description         = "My first static Vault LDAP credential library!"
+  credential_store_id = boundary_credential_store_vault.foo.id
+  path                = "ldap/static-cred/foo" # change to Vault backend path
+}
+
+resource "boundary_credential_library_vault_ldap" "bar-dynamic" {
+  name                = "bar"
+  description         = "My first dynamic Vault LDAP credential library!"
+  credential_store_id = boundary_credential_store_vault.foo.id
+  path                = "ldap/creds/bar" # change to Vault backend path
+}

examples/resources/boundary_credential_password/import.sh

@@ -0,0 +1 @@
+terraform import boundary_credential_password.example <my-id>

examples/resources/boundary_credential_password/resource.tf

@@ -0,0 +1,27 @@
+resource "boundary_scope" "org" {
+  name                     = "organization_one"
+  description              = "global scope"
+  scope_id                 = "global"
+  auto_create_admin_role   = true
+  auto_create_default_role = true
+}
+
+resource "boundary_scope" "project" {
+  name                   = "project_one"
+  description            = "My first scope!"
+  scope_id               = boundary_scope.org.id
+  auto_create_admin_role = true
+}
+
+resource "boundary_credential_store_static" "example" {
+  name        = "example_static_credential_store"
+  description = "My first static credential store!"
+  scope_id    = boundary_scope.project.id
+}
+
+resource "boundary_credential_password" "example" {
+  name                = "example_password"
+  description         = "My first password credential!"
+  credential_store_id = boundary_credential_store_static.example.id
+  password            = "my-password"
+}

examples/resources/boundary_credential_username_password_domain/import.sh

@@ -0,0 +1 @@
+terraform import boundary_credential_username_password_domain.example_username_password_domain <my-id>

examples/resources/boundary_credential_username_password_domain/resource.tf

@@ -0,0 +1,29 @@
+resource "boundary_scope" "org" {
+  name                     = "organization_one"
+  description              = "global scope"
+  scope_id                 = "global"
+  auto_create_admin_role   = true
+  auto_create_default_role = true
+}
+
+resource "boundary_scope" "project" {
+  name                   = "project_one"
+  description            = "My first scope!"
+  scope_id               = boundary_scope.org.id
+  auto_create_admin_role = true
+}
+
+resource "boundary_credential_store_static" "example" {
+  name        = "example_static_credential_store"
+  description = "My first static credential store!"
+  scope_id    = boundary_scope.project.id
+}
+
+resource "boundary_credential_username_password_domain" "example" {
+  name                = "example_username_password_domain"
+  description         = "My first username password domain credential!"
+  credential_store_id = boundary_credential_store_static.example.id
+  username            = "my-username"
+  password            = "my-password"
+  domain              = "my-domain"
+}

examples/resources/boundary_scope_alias_suffix/import.sh

@@ -0,0 +1 @@
+terraform import boundary_scope_alias_suffix.org_suffix <scope-id>

examples/resources/boundary_scope_alias_suffix/resource.tf

@@ -0,0 +1,29 @@
+resource "boundary_scope" "global" {
+  global_scope = true
+  scope_id     = "global"
+}
+
+resource "boundary_scope" "org" {
+  name                     = "organization_one"
+  description              = "My first scope!"
+  scope_id                 = boundary_scope.global.id
+  auto_create_admin_role   = true
+  auto_create_default_role = true
+}
+
+resource "boundary_scope" "project" {
+  name                   = "project_one"
+  description            = "My first project"
+  scope_id               = boundary_scope.org.id
+  auto_create_admin_role = true
+}
+
+resource "boundary_scope_alias_suffix" "org_suffix" {
+  scope_id     = boundary_scope.org.id
+  alias_suffix = "org"
+}
+
+resource "boundary_scope_alias_suffix" "project_suffix" {
+  scope_id     = boundary_scope.project.id
+  alias_suffix = "projectone"
+}

examples/resources/boundary_target/resource.tf

@@ -35,35 +35,30 @@ resource "boundary_credential_library_vault" "foo" {
   credential_type     = "username_password"
 }
 
-resource "boundary_host_catalog" "foo" {
+resource "boundary_host_catalog_static" "foo" {
   name        = "test"
   description = "test catalog"
   scope_id    = boundary_scope.project.id
-  type        = "static"
 }
 
-resource "boundary_host" "foo" {
-  type            = "static"
+resource "boundary_host_static" "foo" {
   name            = "foo"
-  host_catalog_id = boundary_host_catalog.foo.id
+  host_catalog_id = boundary_host_catalog_static.foo.id
   address         = "10.0.0.1"
 }
 
-resource "boundary_host" "bar" {
-  type            = "static"
+resource "boundary_host_static" "bar" {
   name            = "bar"
-  host_catalog_id = boundary_host_catalog.foo.id
+  host_catalog_id = boundary_host_catalog_static.foo.id
   address         = "10.0.0.1"
 }
 
-resource "boundary_host_set" "foo" {
-  type            = "static"
+resource "boundary_host_set_static" "foo" {
   name            = "foo"
-  host_catalog_id = boundary_host_catalog.foo.id
-
+  host_catalog_id = boundary_host_catalog_static.foo.id
   host_ids = [
-    boundary_host.foo.id,
-    boundary_host.bar.id,
+    boundary_host_static.foo.id,
+    boundary_host_static.bar.id,
   ]
 }
 
@@ -78,7 +73,7 @@ resource "boundary_storage_bucket" "aws_example" {
     "access_key_id"     = "aws_access_key_id_value",
     "secret_access_key" = "aws_secret_access_key_value"
   })
-  worker_filter = "\"pki\" in \"/tags/type\""
+  egress_worker_filter = "\"egress\" in \"/tags/type\""
 }
 
 resource "boundary_target" "foo" {
@@ -88,7 +83,7 @@ resource "boundary_target" "foo" {
   default_port = "22"
   scope_id     = boundary_scope.project.id
   host_source_ids = [
-    boundary_host_set.foo.id
+    boundary_host_set_static.foo.id
   ]
   brokered_credential_source_ids = [
     boundary_credential_library_vault.foo.id
@@ -97,12 +92,12 @@ resource "boundary_target" "foo" {
 
 resource "boundary_target" "ssh_foo" {
   name         = "ssh_foo"
-  description  = "Ssh target"
+  description  = "SSH target"
   type         = "ssh"
   default_port = "22"
   scope_id     = boundary_scope.project.id
   host_source_ids = [
-    boundary_host_set.foo.id
+    boundary_host_set_static.foo.id
   ]
   injected_application_credential_source_ids = [
     boundary_credential_library_vault.foo.id
@@ -111,12 +106,12 @@ resource "boundary_target" "ssh_foo" {
 
 resource "boundary_target" "ssh_session_recording_foo" {
   name         = "ssh_foo"
-  description  = "Ssh target"
+  description  = "SSH target"
   type         = "ssh"
   default_port = "22"
   scope_id     = boundary_scope.project.id
   host_source_ids = [
-    boundary_host_set.foo.id
+    boundary_host_set_static.foo.id
   ]
   injected_application_credential_source_ids = [
     boundary_credential_library_vault.foo.id
@@ -125,6 +120,21 @@ resource "boundary_target" "ssh_session_recording_foo" {
   storage_bucket_id        = boundary_storage_bucket.aws_example
 }
 
+resource "boundary_target" "rdp_foo" {
+  name         = "rdp_foo"
+  description  = "RDP target"
+  type         = "rdp"
+  default_port = "3389"
+  scope_id     = boundary_scope.project.id
+  host_source_ids = [
+    boundary_host_set_static.foo.id
+  ]
+  injected_application_credential_source_ids = [
+    boundary_credential_library_vault.foo.id
+  ]
+  egress_worker_filter = "\"egress\" in \"/tags/type\""
+}
+
 resource "boundary_target" "address_foo" {
   name         = "address_foo"
   description  = "Foo target with an address"

examples/resources/boundary_worker/both.tf

@@ -0,0 +1,10 @@
+resource "boundary_worker" "controller_led" {
+  scope_id = "global"
+  name     = "controller-led-worker-1"
+}
+
+resource "boundary_worker" "worker_led" {
+  scope_id                    = "global"
+  name                        = "worker-led-worker-1"
+  worker_generated_auth_token = var.worker_generated_auth_token
+}

go.mod

@@ -1,145 +1,112 @@
-module github.com/hashicorp/terraform-provider-boundary
+module repo.anhonesthost.net/CyberCoveLLC/terraform-provider-threshold
 
-go 1.23.1
+go 1.26.9
 
 require (
-	github.com/YakDriver/regexache v0.23.0
-	github.com/hashicorp/boundary v0.18.0
-	github.com/hashicorp/boundary/api v0.0.53
-	github.com/hashicorp/boundary/sdk v0.0.49
-	github.com/hashicorp/cap v0.5.1-0.20240315182732-faa330bfb8df
+	github.com/YakDriver/regexache v0.25.0
+	github.com/hashicorp/cap v0.14.0
 	github.com/hashicorp/cap/ldap v0.0.0-20240206183135-ed8f24513744
-	github.com/hashicorp/go-cty v1.4.1-0.20200723130312-85980079f637
-	github.com/hashicorp/go-kms-wrapping/v2 v2.0.17-0.20240313190905-91d44aa8e360
-	github.com/hashicorp/go-secure-stdlib/configutil/v2 v2.0.11
-	github.com/hashicorp/go-secure-stdlib/parseutil v0.1.8
-	github.com/hashicorp/go-secure-stdlib/pluginutil/v2 v2.0.7
-	github.com/hashicorp/terraform-plugin-docs v0.18.0
-	github.com/hashicorp/terraform-plugin-sdk/v2 v2.33.0
-	github.com/jimlambrt/gldap v0.1.11
+	github.com/hashicorp/go-cty v1.5.0
+	github.com/hashicorp/go-kms-wrapping/v2 v2.0.26
+	github.com/hashicorp/go-secure-stdlib/configutil/v2 v2.0.13
+	github.com/hashicorp/go-secure-stdlib/parseutil v0.2.0
+	github.com/hashicorp/go-secure-stdlib/pluginutil/v2 v2.0.8
+	github.com/hashicorp/terraform-plugin-docs v0.25.0
+	github.com/hashicorp/terraform-plugin-sdk/v2 v2.40.1
+	github.com/hashicorp/vault/api v1.22.0
+	github.com/jimlambrt/gldap v0.1.14
+	github.com/kelseyhightower/envconfig v1.4.0
 	github.com/kr/pretty v0.3.1
 	github.com/mitchellh/go-homedir v1.1.0
-	github.com/stretchr/testify v1.9.0
-	golang.org/x/crypto v0.25.0
-	mvdan.cc/gofumpt v0.6.0
+	github.com/ory/dockertest/v3 v3.12.0
+	github.com/stretchr/testify v1.12.1
+	golang.org/x/crypto v0.57.0
+	mvdan.cc/gofumpt v0.12.0
+	repo.anhonesthost.net/CyberCoveLLC/threshold/api v0.1.0
+	repo.anhonesthost.net/CyberCoveLLC/threshold/sdk v0.1.0
 )
 
 require (
-	dario.cat/mergo v1.0.0 // indirect
-	github.com/99designs/go-keychain v0.0.0-20191008050251-8e49817e8af4 // indirect
-	github.com/Azure/go-ansiterm v0.0.0-20230124172434-306776ec8161 // indirect
-	github.com/Azure/go-ntlmssp v0.0.0-20221128193559-754e69321358 // indirect
-	github.com/DATA-DOG/go-sqlmock v1.5.2 // indirect
+	dario.cat/mergo v1.0.1 // indirect
+	github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c // indirect
+	github.com/Azure/go-ntlmssp v0.1.1 // indirect
+	github.com/BurntSushi/toml v1.4.0 // indirect
 	github.com/Kunde21/markdownfmt/v3 v3.1.0 // indirect
 	github.com/Masterminds/goutils v1.1.1 // indirect
-	github.com/Masterminds/semver/v3 v3.2.1 // indirect
+	github.com/Masterminds/semver/v3 v3.4.0 // indirect
 	github.com/Masterminds/sprig/v3 v3.2.3 // indirect
-	github.com/Microsoft/go-winio v0.6.1 // indirect
+	github.com/Microsoft/go-winio v0.6.2 // indirect
 	github.com/Nvveen/Gotty v0.0.0-20120604004816-cd527374f1e5 // indirect
-	github.com/ProtonMail/go-crypto v1.1.0-alpha.0 // indirect
+	github.com/ProtonMail/go-crypto v1.4.1 // indirect
 	github.com/agext/levenshtein v1.2.2 // indirect
-	github.com/alessio/shellescape v1.4.2 // indirect
 	github.com/apparentlymart/go-textseg/v15 v15.0.0 // indirect
 	github.com/armon/go-radix v1.0.0 // indirect
-	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/bgentry/speakeasy v0.1.0 // indirect
+	github.com/bmatcuk/doublestar/v4 v4.10.0 // indirect
 	github.com/cenkalti/backoff v2.2.1+incompatible // indirect
-	github.com/cenkalti/backoff/v3 v3.2.2 // indirect
-	github.com/cenkalti/backoff/v4 v4.2.1 // indirect
-	github.com/cespare/xxhash/v2 v2.2.0 // indirect
-	github.com/cloudflare/circl v1.3.7 // indirect
-	github.com/containerd/continuity v0.4.3 // indirect
-	github.com/coreos/go-oidc/v3 v3.9.0 // indirect
-	github.com/danieljoos/wincred v1.2.1 // indirect
-	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
-	github.com/docker/cli v25.0.3+incompatible // indirect
-	github.com/docker/docker v27.1.1+incompatible // indirect
-	github.com/docker/go-connections v0.5.0 // indirect
+	github.com/cenkalti/backoff/v4 v4.3.0 // indirect
+	github.com/cespare/xxhash/v2 v2.3.0 // indirect
+	github.com/cloudflare/circl v1.6.3 // indirect
+	github.com/containerd/continuity v0.4.5 // indirect
+	github.com/containerd/errdefs v1.0.0 // indirect
+	github.com/containerd/errdefs/pkg v0.3.0 // indirect
+	github.com/coreos/go-oidc/v3 v3.11.0 // indirect
+	github.com/distribution/reference v0.6.0 // indirect
+	github.com/docker/cli v29.2.0+incompatible // indirect
+	github.com/docker/go-connections v0.6.0 // indirect
 	github.com/docker/go-units v0.5.0 // indirect
-	github.com/dustin/go-humanize v1.0.1 // indirect
-	github.com/dvsekhvalnov/jose2go v1.6.0 // indirect
-	github.com/fatih/color v1.17.0 // indirect
-	github.com/fatih/structs v1.1.0 // indirect
-	github.com/glebarez/go-sqlite v1.22.0 // indirect
-	github.com/glebarez/sqlite v1.10.0 // indirect
-	github.com/go-asn1-ber/asn1-ber v1.5.5 // indirect
-	github.com/go-jose/go-jose/v3 v3.0.3 // indirect
-	github.com/go-ldap/ldap/v3 v3.4.6 // indirect
-	github.com/godbus/dbus/v5 v5.1.0 // indirect
-	github.com/gogo/protobuf v1.3.2 // indirect
-	github.com/golang-migrate/migrate/v4 v4.17.0 // indirect
-	github.com/golang/protobuf v1.5.3 // indirect
-	github.com/google/go-cmp v0.6.0 // indirect
+	github.com/fatih/color v1.18.0 // indirect
+	github.com/felixge/httpsnoop v1.1.0 // indirect
+	github.com/go-asn1-ber/asn1-ber v1.5.8-0.20250403174932-29230038a667 // indirect
+	github.com/go-jose/go-jose/v3 v3.0.5 // indirect
+	github.com/go-jose/go-jose/v4 v4.1.4 // indirect
+	github.com/go-ldap/ldap/v3 v3.4.12 // indirect
+	github.com/go-logr/logr v1.4.4 // indirect
+	github.com/go-logr/stdr v1.2.2 // indirect
+	github.com/go-viper/mapstructure/v2 v2.4.0 // indirect
+	github.com/golang/protobuf v1.5.4 // indirect
+	github.com/google/go-cmp v0.7.0 // indirect
 	github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 // indirect
 	github.com/google/uuid v1.6.0 // indirect
-	github.com/grpc-ecosystem/go-grpc-middleware v1.4.0 // indirect
-	github.com/grpc-ecosystem/grpc-gateway/v2 v2.19.1 // indirect
-	github.com/hashicorp/cli v1.1.6 // indirect
-	github.com/hashicorp/dbassert v0.0.0-20231012105025-1bc1bd88e22b // indirect
+	github.com/hashicorp/cli v1.1.7 // indirect
 	github.com/hashicorp/errwrap v1.1.0 // indirect
-	github.com/hashicorp/eventlogger v0.2.9 // indirect
+	github.com/hashicorp/eventlogger v0.2.11 // indirect
 	github.com/hashicorp/eventlogger/filters/encrypt v0.1.8-0.20231208142215-efdb51ec090d // indirect
-	github.com/hashicorp/go-bexpr v0.1.13 // indirect
 	github.com/hashicorp/go-checkpoint v0.5.0 // indirect
 	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
-	github.com/hashicorp/go-dbw v0.1.5-0.20240909162114-6cee92b3da36 // indirect
 	github.com/hashicorp/go-hclog v1.6.3 // indirect
-	github.com/hashicorp/go-kms-wrapping/extras/kms/v2 v2.0.0-20231219183231-6bac757bb482 // indirect
-	github.com/hashicorp/go-kms-wrapping/plugin/v2 v2.0.7 // indirect
+	github.com/hashicorp/go-kms-wrapping/plugin/v2 v2.0.9 // indirect
 	github.com/hashicorp/go-multierror v1.1.1 // indirect
-	github.com/hashicorp/go-plugin v1.6.0 // indirect
-	github.com/hashicorp/go-rate v0.0.0-20231204194614-cc8d401f70ab // indirect
-	github.com/hashicorp/go-retryablehttp v0.7.7 // indirect
+	github.com/hashicorp/go-plugin v1.7.0 // indirect
+	github.com/hashicorp/go-retryablehttp v0.7.8 // indirect
 	github.com/hashicorp/go-rootcerts v1.0.2 // indirect
 	github.com/hashicorp/go-secure-stdlib/base62 v0.1.2 // indirect
-	github.com/hashicorp/go-secure-stdlib/gatedwriter v0.1.1 // indirect
-	github.com/hashicorp/go-secure-stdlib/kv-builder v0.1.2 // indirect
-	github.com/hashicorp/go-secure-stdlib/listenerutil v0.1.9 // indirect
-	github.com/hashicorp/go-secure-stdlib/mlock v0.1.3 // indirect
+	github.com/hashicorp/go-secure-stdlib/listenerutil v0.1.10 // indirect
 	github.com/hashicorp/go-secure-stdlib/reloadutil v0.1.1 // indirect
 	github.com/hashicorp/go-secure-stdlib/strutil v0.1.2 // indirect
 	github.com/hashicorp/go-secure-stdlib/tlsutil v0.1.3 // indirect
-	github.com/hashicorp/go-sockaddr v1.0.6 // indirect
+	github.com/hashicorp/go-sockaddr v1.0.7 // indirect
 	github.com/hashicorp/go-uuid v1.0.3 // indirect
-	github.com/hashicorp/go-version v1.6.0 // indirect
-	github.com/hashicorp/hc-install v0.6.3 // indirect
-	github.com/hashicorp/hcl v1.0.1-vault-5 // indirect
-	github.com/hashicorp/hcl/v2 v2.19.1 // indirect
+	github.com/hashicorp/go-version v1.9.0 // indirect
+	github.com/hashicorp/hc-install v0.9.4 // indirect
+	github.com/hashicorp/hcl v1.0.1-vault-7 // indirect
+	github.com/hashicorp/hcl/v2 v2.24.0 // indirect
 	github.com/hashicorp/logutils v1.0.0 // indirect
-	github.com/hashicorp/nodeenrollment v0.2.13 // indirect
-	github.com/hashicorp/terraform-exec v0.20.0 // indirect
-	github.com/hashicorp/terraform-json v0.21.0 // indirect
-	github.com/hashicorp/terraform-plugin-go v0.22.0 // indirect
-	github.com/hashicorp/terraform-plugin-log v0.9.0 // indirect
-	github.com/hashicorp/terraform-registry-address v0.2.3 // indirect
+	github.com/hashicorp/terraform-exec v0.25.1 // indirect
+	github.com/hashicorp/terraform-json v0.27.3-0.20260213134036-298b8f6b673a // indirect
+	github.com/hashicorp/terraform-plugin-go v0.31.0 // indirect
+	github.com/hashicorp/terraform-plugin-log v0.10.0 // indirect
+	github.com/hashicorp/terraform-registry-address v0.4.0 // indirect
 	github.com/hashicorp/terraform-svchost v0.1.1 // indirect
-	github.com/hashicorp/vault/api v1.12.0 // indirect
-	github.com/hashicorp/vault/sdk v0.11.0 // indirect
-	github.com/hashicorp/yamux v0.1.1 // indirect
+	github.com/hashicorp/yamux v0.1.2 // indirect
 	github.com/huandu/xstrings v1.4.0 // indirect
 	github.com/imdario/mergo v0.3.16 // indirect
-	github.com/jackc/chunkreader/v2 v2.0.1 // indirect
-	github.com/jackc/pgconn v1.14.3 // indirect
-	github.com/jackc/pgio v1.0.0 // indirect
-	github.com/jackc/pgpassfile v1.0.0 // indirect
-	github.com/jackc/pgproto3/v2 v2.3.3 // indirect
-	github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect
-	github.com/jackc/pgx/v5 v5.6.0 // indirect
-	github.com/jackc/puddle/v2 v2.2.1 // indirect
-	github.com/jefferai/go-libsecret v0.0.0-20210525195240-b53481abef97 // indirect
 	github.com/jefferai/isbadcipher v0.0.0-20190226160619-51d2077c035f // indirect
-	github.com/jefferai/keyring v1.1.7-0.20220316160357-58a74bb55891 // indirect
-	github.com/jinzhu/gorm v1.9.16 // indirect
-	github.com/jinzhu/inflection v1.0.0 // indirect
-	github.com/jinzhu/now v1.1.5 // indirect
 	github.com/kr/text v0.2.0 // indirect
-	github.com/lib/pq v1.10.9 // indirect
-	github.com/mattn/go-colorable v0.1.13 // indirect
+	github.com/lib/pq v1.11.2 // indirect
+	github.com/mattn/go-colorable v0.1.14 // indirect
 	github.com/mattn/go-isatty v0.0.20 // indirect
 	github.com/mattn/go-runewidth v0.0.9 // indirect
-	github.com/mattn/go-sqlite3 v2.0.3+incompatible // indirect
-	github.com/mikesmitty/edkey v0.0.0-20170222072505-3356ea4e686a // indirect
-	github.com/mitchellh/cli v1.1.5 // indirect
 	github.com/mitchellh/copystructure v1.2.0 // indirect
 	github.com/mitchellh/go-testing-interface v1.14.1 // indirect
 	github.com/mitchellh/go-wordwrap v1.0.1 // indirect
@@ -147,29 +114,18 @@ require (
 	github.com/mitchellh/pointerstructure v1.2.1 // indirect
 	github.com/mitchellh/reflectwalk v1.0.2 // indirect
 	github.com/moby/docker-image-spec v1.3.1 // indirect
-	github.com/moby/sys/user v0.1.0 // indirect
-	github.com/moby/term v0.5.0 // indirect
+	github.com/moby/moby/api v1.53.0 // indirect
+	github.com/moby/moby/client v0.2.2 // indirect
+	github.com/moby/sys/user v0.4.1 // indirect
+	github.com/moby/term v0.5.2 // indirect
 	github.com/mr-tron/base58 v1.2.0 // indirect
-	github.com/mtibben/percent v0.2.1 // indirect
-	github.com/ncruces/go-strftime v0.1.9 // indirect
 	github.com/oklog/run v1.1.0 // indirect
 	github.com/opencontainers/go-digest v1.0.0 // indirect
-	github.com/opencontainers/image-spec v1.1.0-rc6 // indirect
-	github.com/opencontainers/runc v1.2.0-rc.3 // indirect
-	github.com/ory/dockertest/v3 v3.10.0 // indirect
-	github.com/pires/go-proxyproto v0.7.0 // indirect
-	github.com/pkg/errors v0.9.1 // indirect
-	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
+	github.com/opencontainers/image-spec v1.1.1 // indirect
+	github.com/opencontainers/runc v1.3.6 // indirect
 	github.com/posener/complete v1.2.3 // indirect
-	github.com/prometheus/client_golang v1.18.0 // indirect
-	github.com/prometheus/client_model v0.5.0 // indirect
-	github.com/prometheus/common v0.46.0 // indirect
-	github.com/prometheus/procfs v0.12.0 // indirect
-	github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
-	github.com/rogpeppe/go-internal v1.12.0 // indirect
-	github.com/russross/blackfriday v1.6.0 // indirect
+	github.com/rogpeppe/go-internal v1.16.0 // indirect
 	github.com/ryanuber/go-glob v1.0.0 // indirect
-	github.com/sethvargo/go-diceware v0.3.0 // indirect
 	github.com/shopspring/decimal v1.3.1 // indirect
 	github.com/sirupsen/logrus v1.9.3 // indirect
 	github.com/spf13/cast v1.6.0 // indirect
@@ -179,35 +135,30 @@ require (
 	github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb // indirect
 	github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect
 	github.com/xeipuuv/gojsonschema v1.2.0 // indirect
-	github.com/xo/dburl v0.23.1 // indirect
-	github.com/yuin/goldmark v1.6.0 // indirect
+	github.com/yuin/goldmark v1.7.7 // indirect
 	github.com/yuin/goldmark-meta v1.1.0 // indirect
-	github.com/zalando/go-keyring v0.2.3 // indirect
-	github.com/zclconf/go-cty v1.14.2 // indirect
-	go.uber.org/atomic v1.11.0 // indirect
-	golang.org/x/exp v0.0.0-20240205201215-2c58cdc269a3 // indirect
-	golang.org/x/mod v0.17.0 // indirect
-	golang.org/x/net v0.25.0 // indirect
-	golang.org/x/oauth2 v0.17.0 // indirect
-	golang.org/x/sync v0.7.0 // indirect
-	golang.org/x/sys v0.22.0 // indirect
-	golang.org/x/term v0.22.0 // indirect
-	golang.org/x/text v0.16.0 // indirect
-	golang.org/x/time v0.5.0 // indirect
-	golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d // indirect
+	github.com/zclconf/go-cty v1.18.1 // indirect
+	go.abhg.dev/goldmark/frontmatter v0.2.0 // indirect
+	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
+	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.70.0 // indirect
+	go.opentelemetry.io/otel v1.45.0 // indirect
+	go.opentelemetry.io/otel/metric v1.45.0 // indirect
+	go.opentelemetry.io/otel/trace v1.45.0 // indirect
+	go.yaml.in/yaml/v3 v3.0.5 // indirect
+	golang.org/x/exp v0.0.0-20250506013437-ce4c2cf36ca6 // indirect
+	golang.org/x/mod v0.41.0 // indirect
+	golang.org/x/net v0.60.0 // indirect
+	golang.org/x/oauth2 v0.36.0 // indirect
+	golang.org/x/sync v0.23.0 // indirect
+	golang.org/x/sys v0.48.0 // indirect
+	golang.org/x/text v0.42.0 // indirect
+	golang.org/x/time v0.14.0 // indirect
+	golang.org/x/tools v0.49.0 // indirect
 	google.golang.org/appengine v1.6.8 // indirect
-	google.golang.org/genproto v0.0.0-20240205150955-31a09d347014 // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20240205150955-31a09d347014 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20240205150955-31a09d347014 // indirect
-	google.golang.org/grpc v1.61.1 // indirect
-	google.golang.org/protobuf v1.34.2 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20260817212433-ac3dfec99bb1 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20260817212433-ac3dfec99bb1 // indirect
+	google.golang.org/grpc v1.85.0-dev.0.20260825072537-93e31b48545e // indirect
+	google.golang.org/protobuf v1.36.12 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
-	gorm.io/driver/postgres v1.5.9 // indirect
-	gorm.io/driver/sqlite v1.5.6 // indirect
-	gorm.io/gorm v1.25.11 // indirect
-	modernc.org/libc v1.41.0 // indirect
-	modernc.org/mathutil v1.6.0 // indirect
-	modernc.org/memory v1.7.2 // indirect
-	modernc.org/sqlite v1.28.0 // indirect
 )

go.sum

@@ -1,392 +1,267 @@
-cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
-dario.cat/mergo v1.0.0 h1:AGCNq9Evsj31mOgNPcLyXc+4PNABt905YmuqPYYpBWk=
-dario.cat/mergo v1.0.0/go.mod h1:uNxQE+84aUszobStD9th8a29P2fMDhsBdgRYvZOxGmk=
-github.com/99designs/go-keychain v0.0.0-20191008050251-8e49817e8af4 h1:/vQbFIOMbk2FiG/kXiLl8BRyzTWDw7gX/Hz7Dd5eDMs=
-github.com/99designs/go-keychain v0.0.0-20191008050251-8e49817e8af4/go.mod h1:hN7oaIRCjzsZ2dE+yG5k+rsdt3qcwykqK6HVGcKwsw4=
-github.com/Azure/go-ansiterm v0.0.0-20230124172434-306776ec8161 h1:L/gRVlceqvL25UVaW/CKtUDjefjrs0SPonmDGUVOYP0=
-github.com/Azure/go-ansiterm v0.0.0-20230124172434-306776ec8161/go.mod h1:xomTg63KZ2rFqZQzSB4Vz2SUXa1BpHTVz9L5PTmPC4E=
-github.com/Azure/go-ntlmssp v0.0.0-20221128193559-754e69321358 h1:mFRzDkZVAjdal+s7s0MwaRv9igoPqLRdzOLzw/8Xvq8=
-github.com/Azure/go-ntlmssp v0.0.0-20221128193559-754e69321358/go.mod h1:chxPXzSsl7ZWRAuOIE23GDNzjWuZquvFlgA8xmpunjU=
-github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
-github.com/DATA-DOG/go-sqlmock v1.5.2 h1:OcvFkGmslmlZibjAjaHm3L//6LiuBgolP7OputlJIzU=
-github.com/DATA-DOG/go-sqlmock v1.5.2/go.mod h1:88MAG/4G7SMwSE3CeA0ZKzrT5CiOU3OJ+JlNzwDqpNU=
+dario.cat/mergo v1.0.1 h1:Ra4+bf83h2ztPIQYNP99R6m+Y7KfnARDfID+a+vLl4s=
+dario.cat/mergo v1.0.1/go.mod h1:uNxQE+84aUszobStD9th8a29P2fMDhsBdgRYvZOxGmk=
+filippo.io/edwards25519 v1.1.0 h1:FNf4tywRC1HmFuKW5xopWpigGjJKiJSV0Cqo0cJWDaA=
+filippo.io/edwards25519 v1.1.0/go.mod h1:BxyFTGdWcka3PhytdK4V28tE5sGfRvvvRV7EaN4VDT4=
+github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c h1:udKWzYgxTojEKWjV8V+WSxDXJ4NFATAsZjh8iIbsQIg=
+github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c/go.mod h1:xomTg63KZ2rFqZQzSB4Vz2SUXa1BpHTVz9L5PTmPC4E=
+github.com/Azure/go-ntlmssp v0.1.1 h1:l+FM/EEMb0U9QZE7mKNEDw5Mu3mFiaa2GKOoTSsNDPw=
+github.com/Azure/go-ntlmssp v0.1.1/go.mod h1:NYqdhxd/8aAct/s4qSYZEerdPuH1liG2/X9DiVTbhpk=
+github.com/BurntSushi/toml v1.4.0 h1:kuoIxZQy2WRRk1pttg9asf+WVv6tWQuBNVmK8+nqPr0=
+github.com/BurntSushi/toml v1.4.0/go.mod h1:ukJfTF/6rtPPRCnwkur4qwRxa8vTRFBF0uk2lLoLwho=
 github.com/Kunde21/markdownfmt/v3 v3.1.0 h1:KiZu9LKs+wFFBQKhrZJrFZwtLnCCWJahL+S+E/3VnM0=
 github.com/Kunde21/markdownfmt/v3 v3.1.0/go.mod h1:tPXN1RTyOzJwhfHoon9wUr4HGYmWgVxSQN6VBJDkrVc=
 github.com/Masterminds/goutils v1.1.1 h1:5nUrii3FMTL5diU80unEVvNevw1nH4+ZV4DSLVJLSYI=
 github.com/Masterminds/goutils v1.1.1/go.mod h1:8cTjp+g8YejhMuvIA5y2vz3BpJxksy863GQaJW2MFNU=
-github.com/Masterminds/semver/v3 v3.1.1/go.mod h1:VPu/7SZ7ePZ3QOrcuXROw5FAcLl4a0cBrbBpGY/8hQs=
 github.com/Masterminds/semver/v3 v3.2.0/go.mod h1:qvl/7zhW3nngYb5+80sSMF+FG2BjYrf8m9wsX0PNOMQ=
-github.com/Masterminds/semver/v3 v3.2.1 h1:RN9w6+7QoMeJVGyfmbcgs28Br8cvmnucEXnY0rYXWg0=
-github.com/Masterminds/semver/v3 v3.2.1/go.mod h1:qvl/7zhW3nngYb5+80sSMF+FG2BjYrf8m9wsX0PNOMQ=
-github.com/Masterminds/sprig/v3 v3.2.1/go.mod h1:UoaO7Yp8KlPnJIYWTFkMaqPUYKTfGFPhxNuwnnxkKlk=
+github.com/Masterminds/semver/v3 v3.4.0 h1:Zog+i5UMtVoCU8oKka5P7i9q9HgrJeGzI9SA1Xbatp0=
+github.com/Masterminds/semver/v3 v3.4.0/go.mod h1:4V+yj/TJE1HU9XfppCwVMZq3I84lprf4nC11bSS5beM=
 github.com/Masterminds/sprig/v3 v3.2.3 h1:eL2fZNezLomi0uOLqjQoN6BfsDD+fyLtgbJMAj9n6YA=
 github.com/Masterminds/sprig/v3 v3.2.3/go.mod h1:rXcFaZ2zZbLRJv/xSysmlgIM1u11eBaRMhvYXJNkGuM=
-github.com/Microsoft/go-winio v0.6.1 h1:9/kr64B9VUZrLm5YYwbGtUJnMgqWVOdUAXu6Migciow=
-github.com/Microsoft/go-winio v0.6.1/go.mod h1:LRdKpFKfdobln8UmuiYcKPot9D2v6svN5+sAH+4kjUM=
+github.com/Microsoft/go-winio v0.6.2 h1:F2VQgta7ecxGYO8k3ZZz3RS8fVIXVxONVUPlNERoyfY=
+github.com/Microsoft/go-winio v0.6.2/go.mod h1:yd8OoFMLzJbo9gZq8j5qaps8bJ9aShtEA8Ipt1oGCvU=
 github.com/Nvveen/Gotty v0.0.0-20120604004816-cd527374f1e5 h1:TngWCqHvy9oXAN6lEVMRuU21PR1EtLVZJmdB18Gu3Rw=
 github.com/Nvveen/Gotty v0.0.0-20120604004816-cd527374f1e5/go.mod h1:lmUJ/7eu/Q8D7ML55dXQrVaamCz2vxCfdQBasLZfHKk=
-github.com/ProtonMail/go-crypto v1.1.0-alpha.0 h1:nHGfwXmFvJrSR9xu8qL7BkO4DqTHXE9N5vPhgY2I+j0=
-github.com/ProtonMail/go-crypto v1.1.0-alpha.0/go.mod h1:rA3QumHc/FZ8pAHreoekgiAbzpNsfQAosU5td4SnOrE=
-github.com/PuerkitoBio/goquery v1.5.1/go.mod h1:GsLWisAFVj4WgDibEWF4pvYnkVQBpKBKeU+7zCJoLcc=
-github.com/YakDriver/regexache v0.23.0 h1:kv3j4XKhbx/vqUilSBgizXDUXHvvH1KdYekdmGwz4C4=
-github.com/YakDriver/regexache v0.23.0/go.mod h1:K4BZ3MYKAqSFbYWqmbsG+OzYUDyJjnMEr27DJEsVG3U=
+github.com/ProtonMail/go-crypto v1.4.1 h1:9RfcZHqEQUvP8RzecWEUafnZVtEvrBVL9BiF67IQOfM=
+github.com/ProtonMail/go-crypto v1.4.1/go.mod h1:e1OaTyu5SYVrO9gKOEhTc+5UcXtTUa+P3uLudwcgPqo=
+github.com/YakDriver/regexache v0.25.0 h1:uggvmj09EhXQgaXYmdGsKuDARbmdOIqICiO+PIwhlTA=
+github.com/YakDriver/regexache v0.25.0/go.mod h1:4xOFrfggN3UAGlhcvNpM/kuedpJL+48DrUs0CcCxPv8=
 github.com/agext/levenshtein v1.2.2 h1:0S/Yg6LYmFJ5stwQeRp6EeOcCbj7xiqQSdNelsXvaqE=
 github.com/agext/levenshtein v1.2.2/go.mod h1:JEDfjyjHDjOF/1e4FlBE/PkbqA9OfWu2ki2W0IB5558=
-github.com/alessio/shellescape v1.4.2 h1:MHPfaU+ddJ0/bYWpgIeUnQUqKrlJ1S7BfEYPM4uEoM0=
-github.com/alessio/shellescape v1.4.2/go.mod h1:PZAiSCk0LJaZkiCSkPv8qIobYglO3FPpyFjDCtHLS30=
-github.com/alexbrainman/sspi v0.0.0-20210105120005-909beea2cc74 h1:Kk6a4nehpJ3UuJRqlA3JxYxBZEqCeOmATOvrbT4p9RA=
-github.com/alexbrainman/sspi v0.0.0-20210105120005-909beea2cc74/go.mod h1:cEWa1LVoE5KvSD9ONXsZrj0z6KqySlCCNKHlLzbqAt4=
-github.com/andybalholm/cascadia v1.1.0/go.mod h1:GsXiBklL0woXo1j/WYWtSYYC4ouU9PqHO0sqidkEA4Y=
+github.com/alexbrainman/sspi v0.0.0-20250919150558-7d374ff0d59e h1:4dAU9FXIyQktpoUAgOJK3OTFc/xug0PCXYCqU0FgDKI=
+github.com/alexbrainman/sspi v0.0.0-20250919150558-7d374ff0d59e/go.mod h1:cEWa1LVoE5KvSD9ONXsZrj0z6KqySlCCNKHlLzbqAt4=
 github.com/apparentlymart/go-textseg/v12 v12.0.0/go.mod h1:S/4uRK2UtaQttw1GenVJEynmyUenKwP++x/+DdGV/Ec=
 github.com/apparentlymart/go-textseg/v15 v15.0.0 h1:uYvfpb3DyLSCGWnctWKGj857c6ew1u1fNQOlOtuGxQY=
 github.com/apparentlymart/go-textseg/v15 v15.0.0/go.mod h1:K8XmNZdhEBkdlyDdvbmmsvpAG721bKi0joRfFdHIWJ4=
-github.com/armon/go-radix v0.0.0-20180808171621-7fddfc383310/go.mod h1:ufUuZ+zHj4x4TnLV4JWEpy2hxWSpsRywHrMgIH9cCH8=
 github.com/armon/go-radix v1.0.0 h1:F4z6KzEeeQIMeLFa97iZU6vupzoecKdU5TX24SNppXI=
 github.com/armon/go-radix v1.0.0/go.mod h1:ufUuZ+zHj4x4TnLV4JWEpy2hxWSpsRywHrMgIH9cCH8=
-github.com/benbjohnson/clock v1.1.0/go.mod h1:J11/hYXuz8f4ySSvYwY0FKfm+ezbsZBKZxNJlLklBHA=
-github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
-github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
 github.com/bgentry/speakeasy v0.1.0 h1:ByYyxL9InA1OWqxJqqp2A5pYHUrCiAL6K3J+LKSsQkY=
 github.com/bgentry/speakeasy v0.1.0/go.mod h1:+zsyZBPWlz7T6j88CTgSN5bM796AkVf0kBD4zp0CCIs=
-github.com/bufbuild/protocompile v0.4.0 h1:LbFKd2XowZvQ/kajzguUp2DC9UEIQhIq77fZZlaQsNA=
-github.com/bufbuild/protocompile v0.4.0/go.mod h1:3v93+mbWn/v3xzN+31nwkJfrEpAUwp+BagBSZWx+TP8=
+github.com/bmatcuk/doublestar/v4 v4.10.0 h1:zU9WiOla1YA122oLM6i4EXvGW62DvKZVxIe6TYWexEs=
+github.com/bmatcuk/doublestar/v4 v4.10.0/go.mod h1:xBQ8jztBU6kakFMg+8WGxn0c6z1fTSPVIjEY1Wr7jzc=
+github.com/bufbuild/protocompile v0.14.1 h1:iA73zAf/fyljNjQKwYzUHD6AD4R8KMasmwa/FBatYVw=
+github.com/bufbuild/protocompile v0.14.1/go.mod h1:ppVdAIhbr2H8asPk6k4pY7t9zB1OU5DoEw9xY/FUi1c=
 github.com/cenkalti/backoff v2.2.1+incompatible h1:tNowT99t7UNflLxfYYSlKYsBpXdEet03Pg2g16Swow4=
 github.com/cenkalti/backoff v2.2.1+incompatible/go.mod h1:90ReRw6GdpyfrHakVjL/QHaoyV4aDUVVkXQJJJ3NXXM=
-github.com/cenkalti/backoff/v3 v3.2.2 h1:cfUAAO3yvKMYKPrvhDuHSwQnhZNk/RMHKdZqKTxfm6M=
-github.com/cenkalti/backoff/v3 v3.2.2/go.mod h1:cIeZDE3IrqwwJl6VUwCN6trj1oXrTS4rc0ij+ULvLYs=
-github.com/cenkalti/backoff/v4 v4.2.1 h1:y4OZtCnogmCPw98Zjyt5a6+QwPLGkiQsYW5oUqylYbM=
-github.com/cenkalti/backoff/v4 v4.2.1/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyYozVcomhLiZE=
-github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
-github.com/cespare/xxhash/v2 v2.2.0 h1:DC2CZ1Ep5Y4k3ZQ899DldepgrayRUGE6BBZ/cd9Cj44=
-github.com/cespare/xxhash/v2 v2.2.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
-github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
-github.com/cloudflare/circl v1.3.7 h1:qlCDlTPz2n9fu58M0Nh1J/JzcFpfgkFHHX3O35r5vcU=
-github.com/cloudflare/circl v1.3.7/go.mod h1:sRTcRWXGLrKw6yIGJ+l7amYJFfAXbZG0kBSc8r4zxgA=
-github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc=
-github.com/containerd/continuity v0.4.3 h1:6HVkalIp+2u1ZLH1J/pYX2oBVXlJZvh1X1A7bEZ9Su8=
-github.com/containerd/continuity v0.4.3/go.mod h1:F6PTNCKepoxEaXLQp3wDAjygEnImnZ/7o4JzpodfroQ=
-github.com/coreos/go-oidc/v3 v3.9.0 h1:0J/ogVOd4y8P0f0xUh8l9t07xRP/d8tccvjHl2dcsSo=
-github.com/coreos/go-oidc/v3 v3.9.0/go.mod h1:rTKz2PYwftcrtoCzV5g5kvfJoWcm0Mk8AF8y1iAQro4=
+github.com/cenkalti/backoff/v4 v4.3.0 h1:MyRJ/UdXutAwSAT+s3wNd7MfTIcy71VQueUuFK343L8=
+github.com/cenkalti/backoff/v4 v4.3.0/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyYozVcomhLiZE=
+github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
+github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
+github.com/cloudflare/circl v1.6.3 h1:9GPOhQGF9MCYUeXyMYlqTR6a5gTrgR/fBLXvUgtVcg8=
+github.com/cloudflare/circl v1.6.3/go.mod h1:2eXP6Qfat4O/Yhh8BznvKnJ+uzEoTQ6jVKJRn81BiS4=
+github.com/containerd/continuity v0.4.5 h1:ZRoN1sXq9u7V6QoHMcVWGhOwDFqZ4B9i5H6un1Wh0x4=
+github.com/containerd/continuity v0.4.5/go.mod h1:/lNJvtJKUQStBzpVQ1+rasXO1LAWtUQssk28EZvJ3nE=
+github.com/containerd/errdefs v1.0.0 h1:tg5yIfIlQIrxYtu9ajqY42W3lpS19XqdxRQeEwYG8PI=
+github.com/containerd/errdefs v1.0.0/go.mod h1:+YBYIdtsnF4Iw6nWZhJcqGSg/dwvV7tyJ/kCkyJ2k+M=
+github.com/containerd/errdefs/pkg v0.3.0 h1:9IKJ06FvyNlexW690DXuQNx2KA2cUJXx151Xdx3ZPPE=
+github.com/containerd/errdefs/pkg v0.3.0/go.mod h1:NJw6s9HwNuRhnjJhM7pylWwMyAkmCQvQ4GpJHEqRLVk=
+github.com/coreos/go-oidc/v3 v3.11.0 h1:Ia3MxdwpSw702YW0xgfmP1GVCMA9aEFWu12XUZ3/OtI=
+github.com/coreos/go-oidc/v3 v3.11.0/go.mod h1:gE3LgjOgFoHi9a4ce4/tJczr0Ai2/BoDhf0r5lltWI0=
 github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
-github.com/creack/pty v1.1.21 h1:1/QdRyBaHHJP61QkWMXlOIBfsgdDeeKfK8SYVUWJKf0=
-github.com/creack/pty v1.1.21/go.mod h1:MOBLtS5ELjhRRrroQr9kyvTxUAFNvYEK993ew/Vr4O4=
-github.com/cyphar/filepath-securejoin v0.2.4 h1:Ugdm7cg7i6ZK6x3xDF1oEu1nfkyfH53EtKeQYTC3kyg=
-github.com/cyphar/filepath-securejoin v0.2.4/go.mod h1:aPGpWjXOXUn2NCNjFvBE6aRxGGx79pTxQpKOJNYHHl4=
-github.com/danieljoos/wincred v1.2.1 h1:dl9cBrupW8+r5250DYkYxocLeZ1Y4vB1kxgtjxw8GQs=
-github.com/danieljoos/wincred v1.2.1/go.mod h1:uGaFL9fDn3OLTvzCGulzE+SzjEe5NGlh5FdCcyfPwps=
+github.com/creack/pty v1.1.24 h1:bJrF4RRfyJnbTJqzRLHzcGaZK1NeM5kTC9jGgovnR1s=
+github.com/creack/pty v1.1.24/go.mod h1:08sCNb52WyoAwi2QDyzUCTgcvVFhUzewun7wtTfvcwE=
+github.com/cyphar/filepath-securejoin v0.5.2 h1:w/T2bhKr4pgwG0SUGjU4S/Is9+zUknLh5ROTJLzWX8E=
+github.com/cyphar/filepath-securejoin v0.5.2/go.mod h1:Sdj7gXlvMcPZsbhwhQ33GguGLDGQL7h7bg04C/+u9jI=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/denisenkom/go-mssqldb v0.0.0-20191124224453-732737034ffd h1:83Wprp6ROGeiHFAP8WJdI2RoxALQYgdllERc3N5N2DM=
-github.com/denisenkom/go-mssqldb v0.0.0-20191124224453-732737034ffd/go.mod h1:xbL0rPBG9cCiLr28tMa8zpbdarY27NDyej4t/EjAShU=
-github.com/dhui/dktest v0.4.0 h1:z05UmuXZHO/bgj/ds2bGMBu8FI4WA+Ag/m3ghL+om7M=
-github.com/dhui/dktest v0.4.0/go.mod h1:v/Dbz1LgCBOi2Uki2nUqLBGa83hWBGFMu5MrgMDCc78=
-github.com/distribution/reference v0.5.0 h1:/FUIFXtfc/x2gpa5/VGfiGLuOIdYa1t65IKK2OFGvA0=
-github.com/distribution/reference v0.5.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E=
-github.com/docker/cli v25.0.3+incompatible h1:KLeNs7zws74oFuVhgZQ5ONGZiXUUdgsdy6/EsX/6284=
-github.com/docker/cli v25.0.3+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
-github.com/docker/docker v27.1.1+incompatible h1:hO/M4MtV36kzKldqnA37IWhebRA+LnqqcqDja6kVaKY=
-github.com/docker/docker v27.1.1+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
-github.com/docker/go-connections v0.5.0 h1:USnMq7hx7gwdVZq1L49hLXaFtUdTADjXGp+uj1Br63c=
-github.com/docker/go-connections v0.5.0/go.mod h1:ov60Kzw0kKElRwhNs9UlUHAE/F9Fe6GLaXnqyDdmEXc=
+github.com/distribution/reference v0.6.0 h1:0IXCQ5g4/QMHHkarYzh5l+u8T3t73zM5QvfrDyIgxBk=
+github.com/distribution/reference v0.6.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E=
+github.com/docker/cli v29.2.0+incompatible h1:9oBd9+YM7rxjZLfyMGxjraKBKE4/nVyvVfN4qNl9XRM=
+github.com/docker/cli v29.2.0+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
+github.com/docker/go-connections v0.6.0 h1:LlMG9azAe1TqfR7sO+NJttz1gy6KO7VJBh+pMmjSD94=
+github.com/docker/go-connections v0.6.0/go.mod h1:AahvXYshr6JgfUJGdDCs2b5EZG/vmaMAntpSFH5BFKE=
 github.com/docker/go-units v0.5.0 h1:69rxXcBk27SvSaaxTtLh/8llcHD8vYHT7WSdRZ/jvr4=
 github.com/docker/go-units v0.5.0/go.mod h1:fgPhTUdO+D/Jk86RDLlptpiXQzgHJF7gydDDbaIK4Dk=
-github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY=
-github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto=
-github.com/dvsekhvalnov/jose2go v1.6.0 h1:Y9gnSnP4qEI0+/uQkHvFXeD2PLPJeXEL+ySMEA2EjTY=
-github.com/dvsekhvalnov/jose2go v1.6.0/go.mod h1:QsHjhyTlD/lAVqn/NSbVZmSCGeDehTB/mPZadG+mhXU=
 github.com/emirpasic/gods v1.18.1 h1:FXtiHYKDGKCW2KzwZKx0iC0PQmdlorYgdFG9jPXJ1Bc=
 github.com/emirpasic/gods v1.18.1/go.mod h1:8tpGGwCnJ5H4r6BWwaV6OrWmMoPhUl5jm/FMNAnJvWQ=
-github.com/envoyproxy/go-control-plane v0.9.0/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
-github.com/envoyproxy/go-control-plane v0.9.1-0.20191026205805-5f8ba28d4473/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
-github.com/envoyproxy/go-control-plane v0.9.4/go.mod h1:6rpuAdCZL397s3pYoYcLgu1mIlRU8Am5FuJP05cCM98=
-github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
-github.com/erikstmartin/go-testdb v0.0.0-20160219214506-8d10e4a1bae5 h1:Yzb9+7DPaBjB8zlTR87/ElzFsnQfuHnVUVqpZZIcV5Y=
-github.com/erikstmartin/go-testdb v0.0.0-20160219214506-8d10e4a1bae5/go.mod h1:a2zkGnVExMxdzMo3M0Hi/3sEU+cWnZpSni0O6/Yb/P0=
-github.com/fatih/color v1.7.0/go.mod h1:Zm6kSWBoL9eyXnKyktHP6abPY2pDugNf5KwzbycvMj4=
 github.com/fatih/color v1.13.0/go.mod h1:kLAiJbzzSOZDVNGyDpeOxJ47H46qBXwg5ILebYFFOfk=
-github.com/fatih/color v1.17.0 h1:GlRw1BRJxkpqUCBKzKOw098ed57fEsKeNjpTe3cSjK4=
-github.com/fatih/color v1.17.0/go.mod h1:YZ7TlrGPkiz6ku9fK3TLD/pl3CpsiFyu8N92HLgmosI=
-github.com/fatih/structs v1.1.0 h1:Q7juDM0QtcnhCpeyLGQKyg4TOIghuNXrkL32pHAUMxo=
-github.com/fatih/structs v1.1.0/go.mod h1:9NiDSp5zOcgEDl+j00MP/WkGVPOlPRLejGD8Ga6PJ7M=
-github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg=
-github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
+github.com/fatih/color v1.18.0 h1:S8gINlzdQ840/4pfAwic/ZE0djQEH3wM94VfqLTZcOM=
+github.com/fatih/color v1.18.0/go.mod h1:4FelSpRwEGDpQ12mAdzqdOukCy4u8WUtOY6lkT/6HfU=
+github.com/felixge/httpsnoop v1.1.0 h1:3YtUj32ZZkqZtt3sZZsClsymw/QDuVfpNhoA31zeORc=
+github.com/felixge/httpsnoop v1.1.0/go.mod h1:Zqxgdd+1Rkcz8euOqdr7lqgCRJztwr5hp9vDSi5UZCE=
 github.com/frankban/quicktest v1.14.6 h1:7Xjx+VpznH+oBnejlPUj8oUpdxnVs4f8XU8WnHkI4W8=
 github.com/frankban/quicktest v1.14.6/go.mod h1:4ptaffx2x8+WTWXmUCuVU6aPUX1/Mz7zb5vbUoiM6w0=
-github.com/glebarez/go-sqlite v1.22.0 h1:uAcMJhaA6r3LHMTFgP0SifzgXg46yJkgxqyuyec+ruQ=
-github.com/glebarez/go-sqlite v1.22.0/go.mod h1:PlBIdHe0+aUEFn+r2/uthrWq4FxbzugL0L8Li6yQJbc=
-github.com/glebarez/sqlite v1.10.0 h1:u4gt8y7OND/cCei/NMHmfbLxF6xP2wgKcT/BJf2pYkc=
-github.com/glebarez/sqlite v1.10.0/go.mod h1:IJ+lfSOmiekhQsFTJRx/lHtGYmCdtAiTaf5wI9u5uHA=
-github.com/go-asn1-ber/asn1-ber v1.5.5 h1:MNHlNMBDgEKD4TcKr36vQN68BA00aDfjIt3/bD50WnA=
-github.com/go-asn1-ber/asn1-ber v1.5.5/go.mod h1:hEBeB/ic+5LoWskz+yKT7vGhhPYkProFKoKdwZRWMe0=
+github.com/go-asn1-ber/asn1-ber v1.5.8-0.20250403174932-29230038a667 h1:BP4M0CvQ4S3TGls2FvczZtj5Re/2ZzkV9VwqPHH/3Bo=
+github.com/go-asn1-ber/asn1-ber v1.5.8-0.20250403174932-29230038a667/go.mod h1:hEBeB/ic+5LoWskz+yKT7vGhhPYkProFKoKdwZRWMe0=
 github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 h1:+zs/tPmkDkHx3U66DAb0lQFJrpS6731Oaa12ikc+DiI=
 github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376/go.mod h1:an3vInlBmSxCcxctByoQdvwPiA7DTK7jaaFDBTtu0ic=
-github.com/go-git/go-billy/v5 v5.5.0 h1:yEY4yhzCDuMGSv83oGxiBotRzhwhNr8VZyphhiu+mTU=
-github.com/go-git/go-billy/v5 v5.5.0/go.mod h1:hmexnoNsr2SJU1Ju67OaNz5ASJY3+sHgFRpCtpDCKow=
-github.com/go-git/go-git/v5 v5.11.0 h1:XIZc1p+8YzypNr34itUfSvYJcv+eYdTnTvOZ2vD3cA4=
-github.com/go-git/go-git/v5 v5.11.0/go.mod h1:6GFcX2P3NM7FPBfpePbpLd21XxsgdAt+lKqXmCUiUCY=
-github.com/go-jose/go-jose/v3 v3.0.3 h1:fFKWeig/irsp7XD2zBxvnmA/XaRWp5V3CBsZXJF7G7k=
-github.com/go-jose/go-jose/v3 v3.0.3/go.mod h1:5b+7YgP7ZICgJDBdfjZaIt+H/9L9T/YQrVfLAMboGkQ=
-github.com/go-kit/log v0.1.0/go.mod h1:zbhenjAZHb184qTLMA9ZjW7ThYL0H2mk7Q6pNt4vbaY=
-github.com/go-ldap/ldap/v3 v3.4.6 h1:ert95MdbiG7aWo/oPYp9btL3KJlMPKnP58r09rI8T+A=
-github.com/go-ldap/ldap/v3 v3.4.6/go.mod h1:IGMQANNtxpsOzj7uUAMjpGBaOVTC4DYyIy8VsTdxmtc=
-github.com/go-logfmt/logfmt v0.5.0/go.mod h1:wCYkCAKZfumFQihp8CzCvQ3paCTfi41vtzG1KdI/P7A=
-github.com/go-logr/logr v1.4.1 h1:pKouT5E8xu9zeFC39JXRDukb6JFQPXM5p5I91188VAQ=
-github.com/go-logr/logr v1.4.1/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
+github.com/go-git/go-billy/v5 v5.8.0 h1:I8hjc3LbBlXTtVuFNJuwYuMiHvQJDq1AT6u4DwDzZG0=
+github.com/go-git/go-billy/v5 v5.8.0/go.mod h1:RpvI/rw4Vr5QA+Z60c6d6LXH0rYJo0uD5SqfmrrheCY=
+github.com/go-git/go-git/v5 v5.18.0 h1:O831KI+0PR51hM2kep6T8k+w0/LIAD490gvqMCvL5hM=
+github.com/go-git/go-git/v5 v5.18.0/go.mod h1:pW/VmeqkanRFqR6AljLcs7EA7FbZaN5MQqO7oZADXpo=
+github.com/go-jose/go-jose/v3 v3.0.5 h1:BLLJWbC4nMZOfuPVxoZIxeYsn6Nl2r1fITaJ78UQlVQ=
+github.com/go-jose/go-jose/v3 v3.0.5/go.mod h1:5b+7YgP7ZICgJDBdfjZaIt+H/9L9T/YQrVfLAMboGkQ=
+github.com/go-jose/go-jose/v4 v4.1.4 h1:moDMcTHmvE6Groj34emNPLs/qtYXRVcd6S7NHbHz3kA=
+github.com/go-jose/go-jose/v4 v4.1.4/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08=
+github.com/go-ldap/ldap/v3 v3.4.12 h1:1b81mv7MagXZ7+1r7cLTWmyuTqVqdwbtJSjC0DAp9s4=
+github.com/go-ldap/ldap/v3 v3.4.12/go.mod h1:+SPAGcTtOfmGsCb3h1RFiq4xpp4N636G75OEace8lNo=
+github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
+github.com/go-logr/logr v1.4.4 h1:tG4xh9yMsRCAiodLVTxyrkzSZ9+o0L1Kg/+cPVcbP/8=
+github.com/go-logr/logr v1.4.4/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
 github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
 github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
-github.com/go-sql-driver/mysql v1.5.0/go.mod h1:DCzpHaOWr8IXmIStZouvnhqoel9Qv2LBy8hT2VhHyBg=
-github.com/go-sql-driver/mysql v1.6.0 h1:BCTh4TKNUYmOmMUcQ3IipzF5prigylS7XXjEkfCHuOE=
-github.com/go-sql-driver/mysql v1.6.0/go.mod h1:DCzpHaOWr8IXmIStZouvnhqoel9Qv2LBy8hT2VhHyBg=
-github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY=
-github.com/go-test/deep v1.0.4/go.mod h1:wGDj63lr65AM2AQyKZd/NYHGb0R+1RLqB8NKt3aSFNA=
-github.com/go-test/deep v1.1.0 h1:WOcxcdHcvdgThNXjw0t76K42FXTU7HpNQWHpA2HHNlg=
-github.com/go-test/deep v1.1.0/go.mod h1:5C2ZWiW0ErCdrYzpqxLbTX7MG14M9iiw8DgHncVwcsE=
-github.com/godbus/dbus/v5 v5.0.4/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
-github.com/godbus/dbus/v5 v5.1.0 h1:4KLkAxT3aOY8Li4FRJe/KvhoNFFxo0m6fNuFUO8QJUk=
-github.com/godbus/dbus/v5 v5.1.0/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
-github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
-github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
-github.com/golang-migrate/migrate/v4 v4.17.0 h1:rd40H3QXU0AA4IoLllFcEAEo9dYKRHYND2gB4p7xcaU=
-github.com/golang-migrate/migrate/v4 v4.17.0/go.mod h1:+Cp2mtLP4/aXDTKb9wmXYitdrNx2HGs45rbWAo6OsKM=
-github.com/golang-sql/civil v0.0.0-20190719163853-cb61b32ac6fe/go.mod h1:8vg3r2VgvsThLBIFL93Qb5yWzgyZWhEmBwUJWevAkK0=
-github.com/golang-sql/civil v0.0.0-20220223132316-b832511892a9 h1:au07oEsX2xN0ktxqI+Sida1w446QrXBRJ0nee3SNZlA=
-github.com/golang-sql/civil v0.0.0-20220223132316-b832511892a9/go.mod h1:8vg3r2VgvsThLBIFL93Qb5yWzgyZWhEmBwUJWevAkK0=
-github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
-github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da h1:oI5xCqsCo564l8iNU+DwB5epxmsaqB+rhGL0m5jtYqE=
-github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
-github.com/golang/mock v1.1.1/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
+github.com/go-quicktest/qt v1.102.0 h1:HSQxCeh5YZH3EL3W39ixjtyaEhcWSXQHtHnMBzSs474=
+github.com/go-quicktest/qt v1.102.0/go.mod h1:p4lGIVX+8Wa6ZPNDvqcxq36XpUDLh42FLetFU7odllI=
+github.com/go-sql-driver/mysql v1.8.1 h1:LedoTUt/eveggdHS9qUFC1EFSa8bU2+1pZjSRpvNJ1Y=
+github.com/go-sql-driver/mysql v1.8.1/go.mod h1:wEBSXgmK//2ZFJyE+qWnIsVGmvmEKlqwuVSjsCm7DZg=
+github.com/go-test/deep v1.1.1 h1:0r/53hagsehfO4bzD2Pgr/+RgHqhmf+k1Bpse2cTu1U=
+github.com/go-test/deep v1.1.1/go.mod h1:5C2ZWiW0ErCdrYzpqxLbTX7MG14M9iiw8DgHncVwcsE=
+github.com/go-viper/mapstructure/v2 v2.4.0 h1:EBsztssimR/CONLSZZ04E8qAkxNYq4Qp9LvH92wZUgs=
+github.com/go-viper/mapstructure/v2 v2.4.0/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM=
+github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 h1:f+oWsMOmNPc8JmEHVZIycC7hBoQxHH9pNKQORJNozsQ=
+github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8/go.mod h1:wcDNUvekVysuuOpQKo3191zZyTpiI6se1N1ULghS0sw=
 github.com/golang/protobuf v1.1.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
-github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
-github.com/golang/protobuf v1.3.2/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
-github.com/golang/protobuf v1.3.3/go.mod h1:vzj43D7+SQXF/4pzW/hwtAqwc6iTitCiVSaWz5lYuqw=
 github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk=
 github.com/golang/protobuf v1.5.2/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
-github.com/golang/protobuf v1.5.3 h1:KhyjKVUg7Usr/dYsdSqoFveMYd5ko72D+zANwlG1mmg=
-github.com/golang/protobuf v1.5.3/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
-github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5aqRK0M=
+github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
+github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
 github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
-github.com/google/go-cmp v0.5.4/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
-github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
-github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
-github.com/google/pprof v0.0.0-20221118152302-e6195bd50e26 h1:Xim43kblpZXfIBQsbuBVKCudVG457BR2GZFIz3uw3hQ=
-github.com/google/pprof v0.0.0-20221118152302-e6195bd50e26/go.mod h1:dDKJzRmX4S37WGHujM7tX//fmj1uioxKzKxz3lo4HJo=
+github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
+github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
 github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 h1:El6M4kTTCOh6aBiKaUGG7oYTSPP8MxqL4YI3kZKwcP4=
 github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510/go.mod h1:pupxD2MaaD3pAXIBCelhxNneeOaAeabZDe5s4K6zSpQ=
 github.com/google/uuid v1.1.1/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/google/uuid v1.3.1/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/grpc-ecosystem/go-grpc-middleware v1.4.0 h1:UH//fgunKIs4JdUbpDl1VZCDaL56wXCB/5+wF6uHfaI=
-github.com/grpc-ecosystem/go-grpc-middleware v1.4.0/go.mod h1:g5qyo/la0ALbONm6Vbp88Yd8NsDy6rZz+RcrMPxvld8=
-github.com/grpc-ecosystem/grpc-gateway/v2 v2.19.1 h1:/c3QmbOGMGTOumP2iT/rCwB7b0QDGLKzqOmktBjT+Is=
-github.com/grpc-ecosystem/grpc-gateway/v2 v2.19.1/go.mod h1:5SN9VR2LTsRFsrEC6FHgRbTWrTHu6tqPeKxEQv15giM=
-github.com/hashicorp/boundary v0.18.0 h1:YJw83MsPvtbQGpqC6+94QquwdvQkjUj3SOyDeR3Kudc=
-github.com/hashicorp/boundary v0.18.0/go.mod h1:7VMX+OYBNYt3V3GatMOj2PK6xdTpQfYUPpUI2M/fXcM=
-github.com/hashicorp/boundary/api v0.0.53 h1:4T7lJIoRf8to5j5FjawiWN4L4yolfqd4kT398Jh04So=
-github.com/hashicorp/boundary/api v0.0.53/go.mod h1:cDpdeEjTB9CFMGyMJJobwN5QbbT/wUYO28qXYK9wmM8=
-github.com/hashicorp/boundary/sdk v0.0.49 h1:XOb6mSKyrU/wI20+5xTYBHQUP7eIeKcLxKSCpCs4yzM=
-github.com/hashicorp/boundary/sdk v0.0.49/go.mod h1:IHP79to8aIi22FiY58pgBqJL96/U9D8ZAUhS2DdC+Us=
-github.com/hashicorp/cap v0.5.1-0.20240315182732-faa330bfb8df h1:GG98gdcZqXuOgY6UnPpgGfynKd492IGICpjaEz4rKmw=
-github.com/hashicorp/cap v0.5.1-0.20240315182732-faa330bfb8df/go.mod h1:9XAXB89zPUrfaNzjbUG4f0/cVQ81oNx/vUudy6wnOzw=
+github.com/hashicorp/cap v0.14.0 h1:IPWX/ewgw8tQPl0qpnCuNf6BFXOCz7ijSM5ikX27cNg=
+github.com/hashicorp/cap v0.14.0/go.mod h1:Kbu5owAOJzQ/HH4Ba/76wsIXN2tRiJgToJKBO2MAEFE=
 github.com/hashicorp/cap/ldap v0.0.0-20240206183135-ed8f24513744 h1:6cU01ORaCUxRXRS0YYnmm4tMfAvFRjamhjgMrgmoWZs=
 github.com/hashicorp/cap/ldap v0.0.0-20240206183135-ed8f24513744/go.mod h1:SOJuo/OFD0qKQ7d8qOy+a2B9Tw0/97oHIo+qXxs7HZE=
-github.com/hashicorp/cli v1.1.6 h1:CMOV+/LJfL1tXCOKrgAX0uRKnzjj/mpmqNXloRSy2K8=
-github.com/hashicorp/cli v1.1.6/go.mod h1:MPon5QYlgjjo0BSoAiN0ESeT5fRzDjVRp+uioJ0piz4=
-github.com/hashicorp/dbassert v0.0.0-20231012105025-1bc1bd88e22b h1:rvg3eCucdlpfsnbYXM1Ett4f0reNmIuCruyJUF4iw/0=
-github.com/hashicorp/dbassert v0.0.0-20231012105025-1bc1bd88e22b/go.mod h1:GCYXHZsaYdDfPh/xD3A/t6754HPpumeLkA0vLpYVjZE=
+github.com/hashicorp/cli v1.1.7 h1:/fZJ+hNdwfTSfsxMBa9WWMlfjUZbX8/LnUxgAd7lCVU=
+github.com/hashicorp/cli v1.1.7/go.mod h1:e6Mfpga9OCT1vqzFuoGZiiF/KaG9CbUfO5s3ghU3YgU=
 github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
 github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I=
 github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
-github.com/hashicorp/eventlogger v0.2.9 h1:QO8hPXNngadMp72FVNTwIduLAG9fcLP7t59bSFd7gDY=
-github.com/hashicorp/eventlogger v0.2.9/go.mod h1://CHt6/j+Q2lc0NlUB5af4aS2M0c0aVBg9/JfcpAyhM=
+github.com/hashicorp/eventlogger v0.2.11 h1:lkK8ARM/DrCeL5deH2yVS6p40337dESi+77p9pIfLqo=
+github.com/hashicorp/eventlogger v0.2.11/go.mod h1:Rmc3MEopz7jUnLokZVTWAsXaEP5rqd20ObGS+pcau3U=
 github.com/hashicorp/eventlogger/filters/encrypt v0.1.8-0.20231208142215-efdb51ec090d h1:Zia/aoFQmhtzqY6NVR0DVcxmZowbavqbTeum1bRRZhs=
 github.com/hashicorp/eventlogger/filters/encrypt v0.1.8-0.20231208142215-efdb51ec090d/go.mod h1:tMywUTIvdB/FXhwm6HMTt61C8/eODY6gitCHhXtyojg=
-github.com/hashicorp/go-bexpr v0.1.13 h1:HNwp7vZrMpRq8VZXj8VF90LbZpRjQQpim1oJF0DgSwg=
-github.com/hashicorp/go-bexpr v0.1.13/go.mod h1:gN7hRKB3s7yT+YvTdnhZVLTENejvhlkZ8UE4YVBS+Q8=
 github.com/hashicorp/go-checkpoint v0.5.0 h1:MFYpPZCnQqQTE18jFwSII6eUQrD/oxMFp3mlgcqk5mU=
 github.com/hashicorp/go-checkpoint v0.5.0/go.mod h1:7nfLNL10NsxqO4iWuW6tWW0HjZuDrwkBuEQsVcpCOgg=
 github.com/hashicorp/go-cleanhttp v0.5.0/go.mod h1:JpRdi6/HCYpAwUzNwuwqhbovhLtngrth3wmdIIUrZ80=
 github.com/hashicorp/go-cleanhttp v0.5.2 h1:035FKYIWjmULyFRBKPs8TBQoi0x6d9G4xc9neXJWAZQ=
 github.com/hashicorp/go-cleanhttp v0.5.2/go.mod h1:kO/YDlP8L1346E6Sodw+PrpBSV4/SoxCXGY6BqNFT48=
-github.com/hashicorp/go-cty v1.4.1-0.20200723130312-85980079f637 h1:Ud/6/AdmJ1R7ibdS0Wo5MWPj0T1R0fkpaD087bBaW8I=
-github.com/hashicorp/go-cty v1.4.1-0.20200723130312-85980079f637/go.mod h1:EiZBMaudVLy8fmjf9Npq1dq9RalhveqZG5w/yz3mHWs=
-github.com/hashicorp/go-dbw v0.1.5-0.20240909162114-6cee92b3da36 h1:rPD+2QPhCLq8mKMx2FnIaqR5PTNT+LzhjfacYWuvFzY=
-github.com/hashicorp/go-dbw v0.1.5-0.20240909162114-6cee92b3da36/go.mod h1:/YHbfK7mgG9k09aB74Imw3fEOwno0eTtlFTTYGZ7SFk=
+github.com/hashicorp/go-cty v1.5.0 h1:EkQ/v+dDNUqnuVpmS5fPqyY71NXVgT5gf32+57xY8g0=
+github.com/hashicorp/go-cty v1.5.0/go.mod h1:lFUCG5kd8exDobgSfyj4ONE/dc822kiYMguVKdHGMLM=
 github.com/hashicorp/go-hclog v1.6.3 h1:Qr2kF+eVWjTiYmU7Y31tYlP1h0q/X3Nl3tPGdaB11/k=
 github.com/hashicorp/go-hclog v1.6.3/go.mod h1:W4Qnvbt70Wk/zYJryRzDRU/4r0kIg0PVHBcfoyhpF5M=
-github.com/hashicorp/go-kms-wrapping/extras/kms/v2 v2.0.0-20231219183231-6bac757bb482 h1:1DqTnLaNk658AEenlF4PNGYd9b1hXE/+0jSOBIGOAms=
-github.com/hashicorp/go-kms-wrapping/extras/kms/v2 v2.0.0-20231219183231-6bac757bb482/go.mod h1:323uN1BJ6bc9F1U6DPvgmLTVlBlMMnOIRrzCd5ZDee0=
-github.com/hashicorp/go-kms-wrapping/plugin/v2 v2.0.7 h1:gM4OwbF16Cmfxt2QMkoGMQbRTfYFZLvDMPgU3rM3KIo=
-github.com/hashicorp/go-kms-wrapping/plugin/v2 v2.0.7/go.mod h1:7ZMHVluyqgHgEuTADeDzFNWoA9mnyPfdiK8Tk2Bct1c=
-github.com/hashicorp/go-kms-wrapping/v2 v2.0.17-0.20240313190905-91d44aa8e360 h1:AgzTis5Y2hKvmluFZH7V6+evaB1LoKT1KKjXysywyRI=
-github.com/hashicorp/go-kms-wrapping/v2 v2.0.17-0.20240313190905-91d44aa8e360/go.mod h1:ZiKZctjRTLEppuRwrttWkp71VYMbTTCkazK4xT7U/NQ=
+github.com/hashicorp/go-kms-wrapping/plugin/v2 v2.0.9 h1:8Of1hlBVUGZqC3TBoVRaD6a2h9XaPhDuEAUHRZGPhnk=
+github.com/hashicorp/go-kms-wrapping/plugin/v2 v2.0.9/go.mod h1:7egilz8lAcTD4oTAmfh/yV6RK+nI3XXNO1FyVb765Ig=
+github.com/hashicorp/go-kms-wrapping/v2 v2.0.26 h1:26kCSEeyyVJQSbCNwugsLEnZ2JwfQOUHEMXpqIY5rK4=
+github.com/hashicorp/go-kms-wrapping/v2 v2.0.26/go.mod h1:NeK2Ul15t1zutp/dZzt28XQrGZHosbxE/QLNNfaWObM=
 github.com/hashicorp/go-multierror v1.0.0/go.mod h1:dHtQlpGsu+cZNNAkkCN/P3hoUDHhCYQXV3UM06sGGrk=
 github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo=
 github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
-github.com/hashicorp/go-plugin v1.6.0 h1:wgd4KxHJTVGGqWBq4QPB1i5BZNEx9BR8+OFmHDmTk8A=
-github.com/hashicorp/go-plugin v1.6.0/go.mod h1:lBS5MtSSBZk0SHc66KACcjjlU6WzEVP/8pwz68aMkCI=
-github.com/hashicorp/go-rate v0.0.0-20231204194614-cc8d401f70ab h1:XIeGyyCCS80b5MKfU4E6ioLocIYtT4FmfdNH0uNYQi8=
-github.com/hashicorp/go-rate v0.0.0-20231204194614-cc8d401f70ab/go.mod h1:uTQC66EFZuSKunHYx0hHIfdH3nhRrv7UOOE8Ug0yI0A=
-github.com/hashicorp/go-retryablehttp v0.7.7 h1:C8hUCYzor8PIfXHa4UrZkU4VvK8o9ISHxT2Q8+VepXU=
-github.com/hashicorp/go-retryablehttp v0.7.7/go.mod h1:pkQpWZeYWskR+D1tR2O5OcBFOxfA7DoAO6xtkuQnHTk=
+github.com/hashicorp/go-plugin v1.7.0 h1:YghfQH/0QmPNc/AZMTFE3ac8fipZyZECHdDPshfk+mA=
+github.com/hashicorp/go-plugin v1.7.0/go.mod h1:BExt6KEaIYx804z8k4gRzRLEvxKVb+kn0NMcihqOqb8=
+github.com/hashicorp/go-retryablehttp v0.7.8 h1:ylXZWnqa7Lhqpk0L1P1LzDtGcCR0rPVUrx/c8Unxc48=
+github.com/hashicorp/go-retryablehttp v0.7.8/go.mod h1:rjiScheydd+CxvumBsIrFKlx3iS0jrZ7LvzFGFmuKbw=
 github.com/hashicorp/go-rootcerts v1.0.2 h1:jzhAVGtqPKbwpyCPELlgNWhE1znq+qwJtW5Oi2viEzc=
 github.com/hashicorp/go-rootcerts v1.0.2/go.mod h1:pqUvnprVnM5bf7AOirdbb01K4ccR319Vf4pU3K5EGc8=
-github.com/hashicorp/go-secure-stdlib/base62 v0.1.1/go.mod h1:EdWO6czbmthiwZ3/PUsDV+UD1D5IRU4ActiaWGwt0Yw=
 github.com/hashicorp/go-secure-stdlib/base62 v0.1.2 h1:ET4pqyjiGmY09R5y+rSd70J2w45CtbWDNvGqWp/R3Ng=
 github.com/hashicorp/go-secure-stdlib/base62 v0.1.2/go.mod h1:EdWO6czbmthiwZ3/PUsDV+UD1D5IRU4ActiaWGwt0Yw=
-github.com/hashicorp/go-secure-stdlib/configutil/v2 v2.0.11 h1:uPW2Wn0YlmI9RGSkZpcIplnVRwJ7BCiGpk1vnF2TMw4=
-github.com/hashicorp/go-secure-stdlib/configutil/v2 v2.0.11/go.mod h1:uis9dCmOzXuOaRyXq+1Foh31kcvXKoWogjNnhfjHfW8=
-github.com/hashicorp/go-secure-stdlib/gatedwriter v0.1.1 h1:9um9R8i0+HbRHS9d64kdvWR0/LJvo12sIonvR9zr1+U=
-github.com/hashicorp/go-secure-stdlib/gatedwriter v0.1.1/go.mod h1:6RoRTSMDK2H/rKh3P/JIsk1tK8aatKTt3JyvIopi3GQ=
-github.com/hashicorp/go-secure-stdlib/kv-builder v0.1.2 h1:NS6BHieb/pDfx3M9jDdaPpGyyVp+aD4A3DjX3dgRmzs=
-github.com/hashicorp/go-secure-stdlib/kv-builder v0.1.2/go.mod h1:rf5JPE13wi+NwjgsmGkbg4b2CgHq8v7Htn/F0nDe/hg=
-github.com/hashicorp/go-secure-stdlib/listenerutil v0.1.9 h1:0S0ctJ7Ra8O7ap+/3fZUnzJ3VzJyirWS/WnNCuOYtZY=
-github.com/hashicorp/go-secure-stdlib/listenerutil v0.1.9/go.mod h1:TNNdgtjLgVDbrgFcyCKrlAicIl3dZF94swJltyGUX2M=
-github.com/hashicorp/go-secure-stdlib/mlock v0.1.3 h1:kH3Rhiht36xhAfhuHyWJDgdXXEx9IIZhDGRk24CDhzg=
-github.com/hashicorp/go-secure-stdlib/mlock v0.1.3/go.mod h1:ov1Q0oEDjC3+A4BwsG2YdKltrmEw8sf9Pau4V9JQ4Vo=
-github.com/hashicorp/go-secure-stdlib/parseutil v0.1.8 h1:iBt4Ew4XEGLfh6/bPk4rSYmuZJGizr6/x/AEizP0CQc=
-github.com/hashicorp/go-secure-stdlib/parseutil v0.1.8/go.mod h1:aiJI+PIApBRQG7FZTEBx5GiiX+HbOHilUdNxUZi4eV0=
-github.com/hashicorp/go-secure-stdlib/pluginutil/v2 v2.0.7 h1:oYEPhztZRmZCETTxxIo5MNa+I+DDqSDZ+biJt2o4Ncw=
-github.com/hashicorp/go-secure-stdlib/pluginutil/v2 v2.0.7/go.mod h1:ggFN8dlaLWS2R1gymBbCrvXM/bkZP7hEAa4seqDwhyg=
+github.com/hashicorp/go-secure-stdlib/configutil/v2 v2.0.13 h1:TayxZ5drfMP0G6T++WvnLESGLOWeHtdWDWWTAi2e3Qk=
+github.com/hashicorp/go-secure-stdlib/configutil/v2 v2.0.13/go.mod h1:NDRQ/F3DXTylqjORAP0cA+puH/JFrLlT+NlqxHK2/e8=
+github.com/hashicorp/go-secure-stdlib/listenerutil v0.1.10 h1:2iDz+t0JLl1W0tJhvmhsh/UBgT1JgC8Qxz8HxYMWXQo=
+github.com/hashicorp/go-secure-stdlib/listenerutil v0.1.10/go.mod h1:eZkXE+osawMrAWR4wJRmyKauUwH6mNGbjFuiDujnbPk=
+github.com/hashicorp/go-secure-stdlib/parseutil v0.2.0 h1:U+kC2dOhMFQctRfhK0gRctKAPTloZdMU5ZJxaesJ/VM=
+github.com/hashicorp/go-secure-stdlib/parseutil v0.2.0/go.mod h1:Ll013mhdmsVDuoIXVfBtvgGJsXDYkTw1kooNcoCXuE0=
+github.com/hashicorp/go-secure-stdlib/pluginutil/v2 v2.0.8 h1:pgSicufBI+MvaIG9Keykb3k9B3sWtDNjmsoyrl2/8Qw=
+github.com/hashicorp/go-secure-stdlib/pluginutil/v2 v2.0.8/go.mod h1:sBcjk+paCXCMR9HHLcrYSfPz2FsskD8MQuotKiyM2aA=
 github.com/hashicorp/go-secure-stdlib/reloadutil v0.1.1 h1:SMGUnbpAcat8rIKHkBPjfv81yC46a8eCNZ2hsR2l1EI=
 github.com/hashicorp/go-secure-stdlib/reloadutil v0.1.1/go.mod h1:Ch/bf00Qnx77MZd49JRgHYqHQjtEmTgGU2faufpVZb0=
-github.com/hashicorp/go-secure-stdlib/strutil v0.1.1/go.mod h1:gKOamz3EwoIoJq7mlMIRBpVTAUn8qPCrEclOKKWhD3U=
 github.com/hashicorp/go-secure-stdlib/strutil v0.1.2 h1:kes8mmyCpxJsI7FTwtzRqEy9CdjCtrXrXGuOpxEA7Ts=
 github.com/hashicorp/go-secure-stdlib/strutil v0.1.2/go.mod h1:Gou2R9+il93BqX25LAKCLuM+y9U2T4hlwvT1yprcna4=
 github.com/hashicorp/go-secure-stdlib/tlsutil v0.1.3 h1:xbrxd0U9XQW8qL1BAz2XrAjAF/P2vcqUTAues9c24B8=
 github.com/hashicorp/go-secure-stdlib/tlsutil v0.1.3/go.mod h1:LWq2Sy8UoKKuK4lFuCNWSjJj57MhNNf2zzBWMtkAIX4=
-github.com/hashicorp/go-sockaddr v1.0.6 h1:RSG8rKU28VTUTvEKghe5gIhIQpv8evvNpnDEyqO4u9I=
-github.com/hashicorp/go-sockaddr v1.0.6/go.mod h1:uoUUmtwU7n9Dv3O4SNLeFvg0SxQ3lyjsj6+CCykpaxI=
+github.com/hashicorp/go-sockaddr v1.0.7 h1:G+pTkSO01HpR5qCxg7lxfsFEZaG+C0VssTy/9dbT+Fw=
+github.com/hashicorp/go-sockaddr v1.0.7/go.mod h1:FZQbEYa1pxkQ7WLpyXJ6cbjpT8q0YgQaK/JakXqGyWw=
 github.com/hashicorp/go-uuid v1.0.0/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
 github.com/hashicorp/go-uuid v1.0.2/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
 github.com/hashicorp/go-uuid v1.0.3 h1:2gKiV6YVmrJ1i2CKKa9obLvRieoRGviZFL26PcT/Co8=
 github.com/hashicorp/go-uuid v1.0.3/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
-github.com/hashicorp/go-version v1.6.0 h1:feTTfFNnjP967rlCxM/I9g701jU+RN74YKx2mOkIeek=
-github.com/hashicorp/go-version v1.6.0/go.mod h1:fltr4n8CU8Ke44wwGCBoEymUuxUHl09ZGVZPK5anwXA=
-github.com/hashicorp/hc-install v0.6.3 h1:yE/r1yJvWbtrJ0STwScgEnCanb0U9v7zp0Gbkmcoxqs=
-github.com/hashicorp/hc-install v0.6.3/go.mod h1:KamGdbodYzlufbWh4r9NRo8y6GLHWZP2GBtdnms1Ln0=
-github.com/hashicorp/hcl v1.0.1-vault-5 h1:kI3hhbbyzr4dldA8UdTb7ZlVVlI2DACdCfz31RPDgJM=
-github.com/hashicorp/hcl v1.0.1-vault-5/go.mod h1:XYhtn6ijBSAj6n4YqAaf7RBPS4I06AItNorpy+MoQNM=
-github.com/hashicorp/hcl/v2 v2.19.1 h1://i05Jqznmb2EXqa39Nsvyan2o5XyMowW5fnCKW5RPI=
-github.com/hashicorp/hcl/v2 v2.19.1/go.mod h1:ThLC89FV4p9MPW804KVbe/cEXoQ8NZEh+JtMeeGErHE=
+github.com/hashicorp/go-version v1.9.0 h1:CeOIz6k+LoN3qX9Z0tyQrPtiB1DFYRPfCIBtaXPSCnA=
+github.com/hashicorp/go-version v1.9.0/go.mod h1:fltr4n8CU8Ke44wwGCBoEymUuxUHl09ZGVZPK5anwXA=
+github.com/hashicorp/hc-install v0.9.4 h1:KKWOpUG0EqIV63Qk2GGFrZ0s275NVs5lKf9N5vjBNoc=
+github.com/hashicorp/hc-install v0.9.4/go.mod h1:4LRYeEN2bMIFfIv57ldMWt9awfuZhvpbRt0vWmv51WU=
+github.com/hashicorp/hcl v1.0.1-vault-7 h1:ag5OxFVy3QYTFTJODRzTKVZ6xvdfLLCA1cy/Y6xGI0I=
+github.com/hashicorp/hcl v1.0.1-vault-7/go.mod h1:XYhtn6ijBSAj6n4YqAaf7RBPS4I06AItNorpy+MoQNM=
+github.com/hashicorp/hcl/v2 v2.24.0 h1:2QJdZ454DSsYGoaE6QheQZjtKZSUs9Nh2izTWiwQxvE=
+github.com/hashicorp/hcl/v2 v2.24.0/go.mod h1:oGoO1FIQYfn/AgyOhlg9qLC6/nOJPX3qGbkZpYAcqfM=
 github.com/hashicorp/logutils v1.0.0 h1:dLEQVugN8vlakKOUE3ihGLTZJRB4j+M2cdTm/ORI65Y=
 github.com/hashicorp/logutils v1.0.0/go.mod h1:QIAnNjmIWmVIIkWDTG1z5v++HQmx9WQRO+LraFDTW64=
-github.com/hashicorp/nodeenrollment v0.2.13 h1:TkVH6giSXgq4ojwWzbK1Q9JQgvGVilWtdmAdw7Lfeug=
-github.com/hashicorp/nodeenrollment v0.2.13/go.mod h1:3TcYV0L7N4EmeGHIQWr/JFAAsV+yHJaX9IQjeff/w5Q=
-github.com/hashicorp/terraform-exec v0.20.0 h1:DIZnPsqzPGuUnq6cH8jWcPunBfY+C+M8JyYF3vpnuEo=
-github.com/hashicorp/terraform-exec v0.20.0/go.mod h1:ckKGkJWbsNqFKV1itgMnE0hY9IYf1HoiekpuN0eWoDw=
-github.com/hashicorp/terraform-json v0.21.0 h1:9NQxbLNqPbEMze+S6+YluEdXgJmhQykRyRNd+zTI05U=
-github.com/hashicorp/terraform-json v0.21.0/go.mod h1:qdeBs11ovMzo5puhrRibdD6d2Dq6TyE/28JiU4tIQxk=
-github.com/hashicorp/terraform-plugin-docs v0.18.0 h1:2bINhzXc+yDeAcafurshCrIjtdu1XHn9zZ3ISuEhgpk=
-github.com/hashicorp/terraform-plugin-docs v0.18.0/go.mod h1:iIUfaJpdUmpi+rI42Kgq+63jAjI8aZVTyxp3Bvk9Hg8=
-github.com/hashicorp/terraform-plugin-go v0.22.0 h1:1OS1Jk5mO0f5hrziWJGXXIxBrMe2j/B8E+DVGw43Xmc=
-github.com/hashicorp/terraform-plugin-go v0.22.0/go.mod h1:mPULV91VKss7sik6KFEcEu7HuTogMLLO/EvWCuFkRVE=
-github.com/hashicorp/terraform-plugin-log v0.9.0 h1:i7hOA+vdAItN1/7UrfBqBwvYPQ9TFvymaRGZED3FCV0=
-github.com/hashicorp/terraform-plugin-log v0.9.0/go.mod h1:rKL8egZQ/eXSyDqzLUuwUYLVdlYeamldAHSxjUFADow=
-github.com/hashicorp/terraform-plugin-sdk/v2 v2.33.0 h1:qHprzXy/As0rxedphECBEQAh3R4yp6pKksKHcqZx5G8=
-github.com/hashicorp/terraform-plugin-sdk/v2 v2.33.0/go.mod h1:H+8tjs9TjV2w57QFVSMBQacf8k/E1XwLXGCARgViC6A=
-github.com/hashicorp/terraform-registry-address v0.2.3 h1:2TAiKJ1A3MAkZlH1YI/aTVcLZRu7JseiXNRHbOAyoTI=
-github.com/hashicorp/terraform-registry-address v0.2.3/go.mod h1:lFHA76T8jfQteVfT7caREqguFrW3c4MFSPhZB7HHgUM=
+github.com/hashicorp/terraform-exec v0.25.1 h1:PRutYRGM8pixV3B8812NYoBK5O+yuf3qcB/70KFKGiU=
+github.com/hashicorp/terraform-exec v0.25.1/go.mod h1:+izOYrs9sKMQK4OYvGDnrSSJHY/pm4e4eXFqSL2Q5mA=
+github.com/hashicorp/terraform-json v0.27.3-0.20260213134036-298b8f6b673a h1:T7AMR21kjrbeEpN+KhGlyd31XXHsSZF5zg+ivfeYte4=
+github.com/hashicorp/terraform-json v0.27.3-0.20260213134036-298b8f6b673a/go.mod h1:yjb5C2W07l8lmAzdyVgOLji0/D2IoHkR3rusBzUO4O0=
+github.com/hashicorp/terraform-plugin-docs v0.25.0 h1:qHs1V257NxVe8tv6HS4UQfNqjaPP5eUlLeDf7jYk85U=
+github.com/hashicorp/terraform-plugin-docs v0.25.0/go.mod h1:MQggCmY8zgP7R7E/cC0b0cmTvA9hSj3ZKyrrsDjRbLo=
+github.com/hashicorp/terraform-plugin-go v0.31.0 h1:0Fz2r9DQ+kNNl6bx8HRxFd1TfMKUvnrOtvJPmp3Z0q8=
+github.com/hashicorp/terraform-plugin-go v0.31.0/go.mod h1:A88bDhd/cW7FnwqxQRz3slT+QY6yzbHKc6AOTtmdeS8=
+github.com/hashicorp/terraform-plugin-log v0.10.0 h1:eu2kW6/QBVdN4P3Ju2WiB2W3ObjkAsyfBsL3Wh1fj3g=
+github.com/hashicorp/terraform-plugin-log v0.10.0/go.mod h1:/9RR5Cv2aAbrqcTSdNmY1NRHP4E3ekrXRGjqORpXyB0=
+github.com/hashicorp/terraform-plugin-sdk/v2 v2.40.1 h1:2yPUd7esMOpuTaG3y1iEla1iw+tla+3ZEkkBnmOAre4=
+github.com/hashicorp/terraform-plugin-sdk/v2 v2.40.1/go.mod h1:sq8qsxh+PwdvTQFcd17kfCoBgQo46ADNMvCpKE7t/gY=
+github.com/hashicorp/terraform-registry-address v0.4.0 h1:S1yCGomj30Sao4l5BMPjTGZmCNzuv7/GDTDX99E9gTk=
+github.com/hashicorp/terraform-registry-address v0.4.0/go.mod h1:LRS1Ay0+mAiRkUyltGT+UHWkIqTFvigGn/LbMshfflE=
 github.com/hashicorp/terraform-svchost v0.1.1 h1:EZZimZ1GxdqFRinZ1tpJwVxxt49xc/S52uzrw4x0jKQ=
 github.com/hashicorp/terraform-svchost v0.1.1/go.mod h1:mNsjQfZyf/Jhz35v6/0LWcv26+X7JPS+buii2c9/ctc=
-github.com/hashicorp/vault/api v1.12.0 h1:meCpJSesvzQyao8FCOgk2fGdoADAnbDu2WPJN1lDLJ4=
-github.com/hashicorp/vault/api v1.12.0/go.mod h1:si+lJCYO7oGkIoNPAN8j3azBLTn9SjMGS+jFaHd1Cck=
-github.com/hashicorp/vault/sdk v0.11.0 h1:KP/tBUywaVcvOebAfMPNCCiXKeCNEbm3JauYmrZd7RI=
-github.com/hashicorp/vault/sdk v0.11.0/go.mod h1:cG0OZ7Ebq09Xn2N7OWtHbVqq6LpYP6fkyWo0PIvkLsA=
-github.com/hashicorp/yamux v0.1.1 h1:yrQxtgseBDrq9Y652vSRDvsKCJKOUD+GzTS4Y0Y8pvE=
-github.com/hashicorp/yamux v0.1.1/go.mod h1:CtWFDAQgb7dxtzFs4tWbplKIe2jSi3+5vKbgIO0SLnQ=
-github.com/huandu/xstrings v1.3.1/go.mod h1:y5/lhBue+AyNmUVz9RLU9xbLR0o4KIIExikq4ovT0aE=
-github.com/huandu/xstrings v1.3.2/go.mod h1:y5/lhBue+AyNmUVz9RLU9xbLR0o4KIIExikq4ovT0aE=
+github.com/hashicorp/vault/api v1.22.0 h1:+HYFquE35/B74fHoIeXlZIP2YADVboaPjaSicHEZiH0=
+github.com/hashicorp/vault/api v1.22.0/go.mod h1:IUZA2cDvr4Ok3+NtK2Oq/r+lJeXkeCrHRmqdyWfpmGM=
+github.com/hashicorp/yamux v0.1.2 h1:XtB8kyFOyHXYVFnwT5C3+Bdo8gArse7j2AQ0DA0Uey8=
+github.com/hashicorp/yamux v0.1.2/go.mod h1:C+zze2n6e/7wshOZep2A70/aQU6QBRWJO/G6FT1wIns=
 github.com/huandu/xstrings v1.3.3/go.mod h1:y5/lhBue+AyNmUVz9RLU9xbLR0o4KIIExikq4ovT0aE=
 github.com/huandu/xstrings v1.4.0 h1:D17IlohoQq4UcpqD7fDk80P7l+lwAmlFaBHgOipl2FU=
 github.com/huandu/xstrings v1.4.0/go.mod h1:y5/lhBue+AyNmUVz9RLU9xbLR0o4KIIExikq4ovT0aE=
 github.com/imdario/mergo v0.3.11/go.mod h1:jmQim1M+e3UYxmgPu/WyfjB3N3VflVyUjjjwH0dnCYA=
 github.com/imdario/mergo v0.3.16 h1:wwQJbIsHYGMUyLSPrEq1CT16AhnhNJQ51+4fdHUnCl4=
 github.com/imdario/mergo v0.3.16/go.mod h1:WBLT9ZmE3lPoWsEzCh9LPo3TiwVN+ZKEjmz+hD27ysY=
-github.com/jackc/chunkreader/v2 v2.0.0/go.mod h1:odVSm741yZoC3dpHEUXIqA9tQRhFrgOHwnPIn9lDKlk=
-github.com/jackc/chunkreader/v2 v2.0.1 h1:i+RDz65UE+mmpjTfyz0MoVTnzeYxroil2G82ki7MGG8=
-github.com/jackc/chunkreader/v2 v2.0.1/go.mod h1:odVSm741yZoC3dpHEUXIqA9tQRhFrgOHwnPIn9lDKlk=
-github.com/jackc/pgconn v1.14.3 h1:bVoTr12EGANZz66nZPkMInAV/KHD2TxH9npjXXgiB3w=
-github.com/jackc/pgconn v1.14.3/go.mod h1:RZbme4uasqzybK2RK5c65VsHxoyaml09lx3tXOcO/VM=
-github.com/jackc/pgio v1.0.0 h1:g12B9UwVnzGhueNavwioyEEpAmqMe1E/BN9ES+8ovkE=
-github.com/jackc/pgio v1.0.0/go.mod h1:oP+2QK2wFfUWgr+gxjoBH9KGBb31Eio69xUb0w5bYf8=
-github.com/jackc/pgmock v0.0.0-20210724152146-4ad1a8207f65 h1:DadwsjnMwFjfWc9y5Wi/+Zz7xoE5ALHsRQlOctkOiHc=
-github.com/jackc/pgmock v0.0.0-20210724152146-4ad1a8207f65/go.mod h1:5R2h2EEX+qri8jOWMbJCtaPWkrrNc7OHwsp2TCqp7ak=
-github.com/jackc/pgpassfile v1.0.0 h1:/6Hmqy13Ss2zCq62VdNG8tM1wchn8zjSGOBJ6icpsIM=
-github.com/jackc/pgpassfile v1.0.0/go.mod h1:CEx0iS5ambNFdcRtxPj5JhEz+xB6uRky5eyVu/W2HEg=
-github.com/jackc/pgproto3/v2 v2.3.3 h1:1HLSx5H+tXR9pW3in3zaztoEwQYRC9SQaYUHjTSUOag=
-github.com/jackc/pgproto3/v2 v2.3.3/go.mod h1:WfJCnwN3HIg9Ish/j3sgWXnAfK8A9Y0bwXYU5xKaEdA=
-github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 h1:iCEnooe7UlwOQYpKFhBabPMi4aNAfoODPEFNiAnClxo=
-github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761/go.mod h1:5TJZWKEWniPve33vlWYSoGYefn3gLQRzjfDlhSJ9ZKM=
-github.com/jackc/pgx/v5 v5.6.0 h1:SWJzexBzPL5jb0GEsrPMLIsi/3jOo7RHlzTjcAeDrPY=
-github.com/jackc/pgx/v5 v5.6.0/go.mod h1:DNZ/vlrUnhWCoFGxHAG8U2ljioxukquj7utPDgtQdTw=
-github.com/jackc/puddle/v2 v2.2.1 h1:RhxXJtFG022u4ibrCSMSiu5aOq1i77R3OHKNJj77OAk=
-github.com/jackc/puddle/v2 v2.2.1/go.mod h1:vriiEXHvEE654aYKXXjOvZM39qJ0q+azkZFrfEOc3H4=
 github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 h1:BQSFePA1RWJOlocH6Fxy8MmwDt+yVQYULKfN0RoTN8A=
 github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99/go.mod h1:1lJo3i6rXxKeerYnT8Nvf0QmHCRC1n8sfWVwXF2Frvo=
-github.com/jefferai/go-libsecret v0.0.0-20210525195240-b53481abef97 h1:/jVRo4KmyL3FgEYAqFe+S8nxo6xRkFLm+CvIV0qG7PU=
-github.com/jefferai/go-libsecret v0.0.0-20210525195240-b53481abef97/go.mod h1:4oP93ARN1AkyA31rzogqyUoa4u5PBybl8dJQBl2+E7A=
+github.com/jcmturner/aescts/v2 v2.0.0 h1:9YKLH6ey7H4eDBXW8khjYslgyqG2xZikXP0EQFKrle8=
+github.com/jcmturner/aescts/v2 v2.0.0/go.mod h1:AiaICIRyfYg35RUkr8yESTqvSy7csK90qZ5xfvvsoNs=
+github.com/jcmturner/dnsutils/v2 v2.0.0 h1:lltnkeZGL0wILNvrNiVCR6Ro5PGU/SeBvVO/8c/iPbo=
+github.com/jcmturner/dnsutils/v2 v2.0.0/go.mod h1:b0TnjGOvI/n42bZa+hmXL+kFJZsFT7G4t3HTlQ184QM=
+github.com/jcmturner/gofork v1.7.6 h1:QH0l3hzAU1tfT3rZCnW5zXl+orbkNMMRGJfdJjHVETg=
+github.com/jcmturner/gofork v1.7.6/go.mod h1:1622LH6i/EZqLloHfE7IeZ0uEJwMSUyQ/nDd82IeqRo=
+github.com/jcmturner/goidentity/v6 v6.0.1 h1:VKnZd2oEIMorCTsFBnJWbExfNN7yZr3EhJAxwOkZg6o=
+github.com/jcmturner/goidentity/v6 v6.0.1/go.mod h1:X1YW3bgtvwAXju7V3LCIMpY0Gbxyjn/mY9zx4tFonSg=
+github.com/jcmturner/gokrb5/v8 v8.4.4 h1:x1Sv4HaTpepFkXbt2IkL29DXRf8sOfZXo8eRKh687T8=
+github.com/jcmturner/gokrb5/v8 v8.4.4/go.mod h1:1btQEpgT6k+unzCwX1KdWMEwPPkkgBtP+F6aCACiMrs=
+github.com/jcmturner/rpc/v2 v2.0.3 h1:7FXXj8Ti1IaVFpSAziCZWNzbNuZmnvw/i6CqLNdWfZY=
+github.com/jcmturner/rpc/v2 v2.0.3/go.mod h1:VUJYCIDm3PVOEHw8sgt091/20OJjskO/YJki3ELg/Hc=
 github.com/jefferai/isbadcipher v0.0.0-20190226160619-51d2077c035f h1:E87tDTVS5W65euzixn7clSzK66puSt1H4I5SC0EmHH4=
 github.com/jefferai/isbadcipher v0.0.0-20190226160619-51d2077c035f/go.mod h1:3J2qVK16Lq8V+wfiL2lPeDZ7UWMxk5LemerHa1p6N00=
-github.com/jefferai/keyring v1.1.7-0.20220316160357-58a74bb55891 h1:rXk4+lacHriOWnHKgZsP+rjn6nruMGC7fsE2j40iyVY=
-github.com/jefferai/keyring v1.1.7-0.20220316160357-58a74bb55891/go.mod h1:iwmrBX0aG5ajn+PGr3OucduQG4BYozBamv28xdVv6JE=
-github.com/jhump/protoreflect v1.15.1 h1:HUMERORf3I3ZdX05WaQ6MIpd/NJ434hTp5YiKgfCL6c=
-github.com/jhump/protoreflect v1.15.1/go.mod h1:jD/2GMKKE6OqX8qTjhADU1e6DShO+gavG9e0Q693nKo=
-github.com/jimlambrt/gldap v0.1.11 h1:9pkugYgqFNzzVry4DqsXh/Of9UhJCzeysamhRm5xi+Y=
-github.com/jimlambrt/gldap v0.1.11/go.mod h1:DGNs1w1D3Je+fnAXATmYFNXQiEWv4EdJGEEW4aJpkVk=
-github.com/jinzhu/gorm v1.9.16 h1:+IyIjPEABKRpsu/F8OvDPy9fyQlgsg2luMV2ZIH5i5o=
-github.com/jinzhu/gorm v1.9.16/go.mod h1:G3LB3wezTOWM2ITLzPxEXgSkOXAntiLHS7UdBefADcs=
-github.com/jinzhu/inflection v1.0.0 h1:K317FqzuhWc8YvSVlFMCCUb36O/S9MCKRDI7QkRKD/E=
-github.com/jinzhu/inflection v1.0.0/go.mod h1:h+uFLlag+Qp1Va5pdKtLDYj+kHp5pxUVkryuEj+Srlc=
-github.com/jinzhu/now v1.0.1/go.mod h1:d3SSVoowX0Lcu0IBviAWJpolVfI5UJVZZ7cO71lE/z8=
-github.com/jinzhu/now v1.1.5 h1:/o9tlHleP7gOFmsnYNz3RGnqzefHA47wQpKrrdTIwXQ=
-github.com/jinzhu/now v1.1.5/go.mod h1:d3SSVoowX0Lcu0IBviAWJpolVfI5UJVZZ7cO71lE/z8=
+github.com/jhump/protoreflect v1.17.0 h1:qOEr613fac2lOuTgWN4tPAtLL7fUSbuJL5X5XumQh94=
+github.com/jhump/protoreflect v1.17.0/go.mod h1:h9+vUUL38jiBzck8ck+6G/aeMX8Z4QUY/NiJPwPNi+8=
+github.com/jimlambrt/gldap v0.1.14 h1:InG9kldhIu6OoQK0hvfkW1Lqpc5eLJhxiiDTNmRnrDM=
+github.com/jimlambrt/gldap v0.1.14/go.mod h1:yobW9JIAmqe23dVNOaMWewPaff6jGaHgYjspPIIgYmg=
+github.com/kelseyhightower/envconfig v1.4.0 h1:Im6hONhd3pLkfDFsbRgu68RDNkGF1r3dvMUtDTo2cv8=
+github.com/kelseyhightower/envconfig v1.4.0/go.mod h1:cccZRl6mQpaq41TPp5QxidR+Sa3axMbJDNb//FQX6Gg=
 github.com/kevinburke/ssh_config v1.2.0 h1:x584FjTGwHzMwvHx18PXxbBVzfnxogHaAReU4gf13a4=
 github.com/kevinburke/ssh_config v1.2.0/go.mod h1:CT57kijsi8u/K/BOFA39wgDQJ9CxiF4nAY/ojJ6r6mM=
-github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
-github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
-github.com/kisielk/sqlstruct v0.0.0-20201105191214-5f3e10d3ab46/go.mod h1:yyMNCyc/Ib3bDTKd379tNMpB/7/H5TjM2Y9QJ5THLbE=
-github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
 github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
-github.com/kr/pretty v0.2.0/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
 github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
 github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
 github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
 github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
-github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0SNc=
-github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw=
-github.com/lib/pq v1.1.1/go.mod h1:5WUZQaWbwv1U+lTReE5YruASi9Al49XbQIvNi/34Woo=
-github.com/lib/pq v1.10.9 h1:YXG7RB+JIjhP29X+OtkiDnYaXQwpS4JEWq7dtCCRUEw=
-github.com/lib/pq v1.10.9/go.mod h1:AlVN5x4E4T544tWzH6hKfbfQvm3HdbOxrmggDNAPY9o=
-github.com/mattn/go-colorable v0.0.9/go.mod h1:9vuHe8Xs5qXnSaW/c/ABM9alt+Vo+STaOChaDxuIBZU=
+github.com/lib/pq v1.11.2 h1:x6gxUeu39V0BHZiugWe8LXZYZ+Utk7hSJGThs8sdzfs=
+github.com/lib/pq v1.11.2/go.mod h1:/p+8NSbOcwzAEI7wiMXFlgydTwcgTr3OSKMsD2BitpA=
 github.com/mattn/go-colorable v0.1.9/go.mod h1:u6P/XSegPjTcexA+o6vUJrdnUu04hMope9wVRipJSqc=
 github.com/mattn/go-colorable v0.1.12/go.mod h1:u5H1YNBxpqRaxsYJYSkiCWKzEfiAb1Gb520KVy5xxl4=
-github.com/mattn/go-colorable v0.1.13 h1:fFA4WZxdEF4tXPZVKMLwD8oUnCTTo08duU7wxecdEvA=
-github.com/mattn/go-colorable v0.1.13/go.mod h1:7S9/ev0klgBDR4GtXTXX8a3vIGJpMovkB8vQcUbaXHg=
-github.com/mattn/go-isatty v0.0.3/go.mod h1:M+lRXTBqGeGNdLjl/ufCoiOlB5xdOkqRJdNxMWT7Zi4=
+github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE=
+github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
 github.com/mattn/go-isatty v0.0.12/go.mod h1:cbi8OIDigv2wuxKPP5vlRcQ1OAZbq2CE4Kysco4FUpU=
 github.com/mattn/go-isatty v0.0.14/go.mod h1:7GGIvUiUoEMVVmxf/4nioHXj79iQHKdU27kJ6hsGG94=
-github.com/mattn/go-isatty v0.0.16/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM=
 github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
 github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
 github.com/mattn/go-runewidth v0.0.9 h1:Lm995f3rfxdpd6TSmuVCHVb/QhupuXlYr8sCI/QdE+0=
 github.com/mattn/go-runewidth v0.0.9/go.mod h1:H031xJmbD/WCDINGzjvQ9THkh0rPKHF+m2gUSrubnMI=
-github.com/mattn/go-sqlite3 v1.14.0/go.mod h1:JIl7NbARA7phWnGvh0LKTyg7S9BA+6gx71ShQilpsus=
-github.com/mattn/go-sqlite3 v2.0.3+incompatible h1:gXHsfypPkaMZrKbD5209QV9jbUTJKjyR5WD3HYQSd+U=
-github.com/mattn/go-sqlite3 v2.0.3+incompatible/go.mod h1:FPy6KqzDD04eiIsT53CuJW3U88zkxoIYsOqkbpncsNc=
-github.com/miekg/dns v1.1.58 h1:ca2Hdkz+cDg/7eNF6V56jjzuZ4aCAE+DbVkILdQWG/4=
-github.com/miekg/dns v1.1.58/go.mod h1:Ypv+3b/KadlvW9vJfXOTf300O4UqaHFzFCuHz+rPkBY=
-github.com/mikesmitty/edkey v0.0.0-20170222072505-3356ea4e686a h1:eU8j/ClY2Ty3qdHnn0TyW3ivFoPC/0F1gQZz8yTxbbE=
-github.com/mikesmitty/edkey v0.0.0-20170222072505-3356ea4e686a/go.mod h1:v8eSC2SMp9/7FTKUncp7fH9IwPfw+ysMObcEz5FWheQ=
-github.com/mitchellh/cli v1.1.5 h1:OxRIeJXpAMztws/XHlN2vu6imG5Dpq+j61AzAX5fLng=
-github.com/mitchellh/cli v1.1.5/go.mod h1:v8+iFts2sPIKUV1ltktPXMCC8fumSKFItNcD2cLtRR4=
 github.com/mitchellh/copystructure v1.0.0/go.mod h1:SNtv71yrdKgLRyLFxmLdkAbkKEFWgYaq1OVrnRcwhnw=
 github.com/mitchellh/copystructure v1.2.0 h1:vpKXTN4ewci03Vljg/q9QvCGUDttBOGBIa15WveJJGw=
 github.com/mitchellh/copystructure v1.2.0/go.mod h1:qLl+cE2AmVv+CoeAwDPye/v+N2HKCj9FbZEVFJRxO9s=
@@ -406,94 +281,58 @@ github.com/mitchellh/reflectwalk v1.0.2 h1:G2LzWKi524PWgd3mLHV8Y5k7s6XUvT0Gef6zx
 github.com/mitchellh/reflectwalk v1.0.2/go.mod h1:mSTlrgnPZtwu0c4WaC2kGObEpuNDbx0jmZXqmk4esnw=
 github.com/moby/docker-image-spec v1.3.1 h1:jMKff3w6PgbfSa69GfNg+zN/XLhfXJGnEx3Nl2EsFP0=
 github.com/moby/docker-image-spec v1.3.1/go.mod h1:eKmb5VW8vQEh/BAr2yvVNvuiJuY6UIocYsFu/DxxRpo=
-github.com/moby/sys/user v0.1.0 h1:WmZ93f5Ux6het5iituh9x2zAG7NFY9Aqi49jjE1PaQg=
-github.com/moby/sys/user v0.1.0/go.mod h1:fKJhFOnsCN6xZ5gSfbM6zaHGgDJMrqt9/reuj4T7MmU=
-github.com/moby/term v0.5.0 h1:xt8Q1nalod/v7BqbG21f8mQPqH+xAaC9C3N3wfWbVP0=
-github.com/moby/term v0.5.0/go.mod h1:8FzsFHVUBGZdbDsJw/ot+X+d5HLUbvklYLJ9uGfcI3Y=
-github.com/morikuni/aec v1.0.0 h1:nP9CBfwrvYnBRgY6qfDQkygYDmYwOilePFkwzv4dU8A=
-github.com/morikuni/aec v1.0.0/go.mod h1:BbKIizmSmc5MMPqRYbxO4ZU0S0+P200+tUnFx7PXmsc=
+github.com/moby/moby/api v1.53.0 h1:PihqG1ncw4W+8mZs69jlwGXdaYBeb5brF6BL7mPIS/w=
+github.com/moby/moby/api v1.53.0/go.mod h1:8mb+ReTlisw4pS6BRzCMts5M49W5M7bKt1cJy/YbAqc=
+github.com/moby/moby/client v0.2.2 h1:Pt4hRMCAIlyjL3cr8M5TrXCwKzguebPAc2do2ur7dEM=
+github.com/moby/moby/client v0.2.2/go.mod h1:2EkIPVNCqR05CMIzL1mfA07t0HvVUUOl85pasRz/GmQ=
+github.com/moby/sys/user v0.4.1 h1:RgjRlaDKi/Xmyrz4t8lyzXT6v2ooFeO/7xtchmhVWE0=
+github.com/moby/sys/user v0.4.1/go.mod h1:E9QsW5WRe1kUAf7kW8hXKwu1uhsZEAdPLYHYSDudF4Y=
+github.com/moby/term v0.5.2 h1:6qk3FJAFDs6i/q3W/pQ97SX192qKfZgGjCQqfCJkgzQ=
+github.com/moby/term v0.5.2/go.mod h1:d3djjFCrjnB+fl8NJux+EJzu0msscUP+f8it8hPkFLc=
 github.com/mr-tron/base58 v1.2.0 h1:T/HDJBh4ZCPbU39/+c3rRvE0uKBQlU27+QI8LJ4t64o=
 github.com/mr-tron/base58 v1.2.0/go.mod h1:BinMc/sQntlIE1frQmRFPUoPA1Zkr8VRgBdjWI2mNwc=
-github.com/mtibben/percent v0.2.1 h1:5gssi8Nqo8QU/r2pynCm+hBQHpkB/uNK7BJCFogWdzs=
-github.com/mtibben/percent v0.2.1/go.mod h1:KG9uO+SZkUp+VkRHsCdYQV3XSZrrSpR3O9ibNBTZrns=
-github.com/ncruces/go-strftime v0.1.9 h1:bY0MQC28UADQmHmaF5dgpLmImcShSi2kHU9XLdhx/f4=
-github.com/ncruces/go-strftime v0.1.9/go.mod h1:Fwc5htZGVVkseilnfgOVb9mKy6w1naJmn9CehxcKcls=
-github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e/go.mod h1:zD1mROLANZcx1PVRCS0qkT7pwLkGfwJo4zjcN/Tysno=
 github.com/oklog/run v1.1.0 h1:GEenZ1cK0+q0+wsJew9qUg/DyD8k3JzYsZAi5gYi2mA=
 github.com/oklog/run v1.1.0/go.mod h1:sVPdnTZT1zYwAJeCMu2Th4T21pA3FPOQRfWjQlk7DVU=
 github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U=
 github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM=
-github.com/opencontainers/image-spec v1.1.0-rc6 h1:XDqvyKsJEbRtATzkgItUqBA7QHk58yxX1Ov9HERHNqU=
-github.com/opencontainers/image-spec v1.1.0-rc6/go.mod h1:W4s4sFTMaBeK1BQLXbG4AdM2szdn85PY75RI83NrTrM=
-github.com/opencontainers/runc v1.2.0-rc.3 h1:5vQhejBp4S5w1DwFZ7L3CSOQX9cmcc8JKFy/mOBTJlo=
-github.com/opencontainers/runc v1.2.0-rc.3/go.mod h1:HADgqJU4nqAmOpe+uYBTJ4ZRvjks3ptCjKXp1pHqmCc=
-github.com/opentracing/opentracing-go v1.1.0/go.mod h1:UkNAQd3GIcIGf0SeVgPpRdFStlNbqXla1AfSYxPUl2o=
-github.com/ory/dockertest/v3 v3.10.0 h1:4K3z2VMe8Woe++invjaTB7VRyQXQy5UY+loujO4aNE4=
-github.com/ory/dockertest/v3 v3.10.0/go.mod h1:nr57ZbRWMqfsdGdFNLHz5jjNdDb7VVFnzAeW1n5N1Lg=
-github.com/pires/go-proxyproto v0.7.0 h1:IukmRewDQFWC7kfnb66CSomk2q/seBuilHBYFwyq0Hs=
-github.com/pires/go-proxyproto v0.7.0/go.mod h1:Vz/1JPY/OACxWGQNIRY2BeyDmpoaWmEP40O9LbuiFR4=
-github.com/pjbgf/sha1cd v0.3.0 h1:4D5XXmUUBUl/xQ6IjCkEAbqXskkq/4O7LmGn0AqMDs4=
-github.com/pjbgf/sha1cd v0.3.0/go.mod h1:nZ1rrWOcGJ5uZgEEVL1VUM9iRQiZvWdbZjkKyFzPPsI=
+github.com/opencontainers/image-spec v1.1.1 h1:y0fUlFfIZhPF1W537XOLg0/fcx6zcHCJwooC2xJA040=
+github.com/opencontainers/image-spec v1.1.1/go.mod h1:qpqAh3Dmcf36wStyyWU+kCeDgrGnAve2nCC8+7h8Q0M=
+github.com/opencontainers/runc v1.3.6 h1:SLGIymCtsk80iNPWgbc8dtjI30r+5mTVV+4dN8/17Sk=
+github.com/opencontainers/runc v1.3.6/go.mod h1:o1wyv76EDlTkcf0KTFgN8bMWLPvgF/HfX709lDv+rr4=
+github.com/ory/dockertest/v3 v3.12.0 h1:3oV9d0sDzlSQfHtIaB5k6ghUCVMVLpAY8hwrqoCyRCw=
+github.com/ory/dockertest/v3 v3.12.0/go.mod h1:aKNDTva3cp8dwOWwb9cWuX84aH5akkxXRvO7KCwWVjE=
+github.com/pjbgf/sha1cd v0.3.2 h1:a9wb0bp1oC2TGwStyn0Umc/IGKQnEgF0vVaZ8QF8eo4=
+github.com/pjbgf/sha1cd v0.3.2/go.mod h1:zQWigSxVmsHEZow5qaLtPYxpcKMMQpa09ixqBxuCS6A=
 github.com/pkg/diff v0.0.0-20210226163009-20ebb0f2a09e/go.mod h1:pJLUxLENpZxwdsKMEsNbx1VGcRFpLqf3715MtcvvzbA=
-github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
-github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
-github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
-github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/posener/complete v1.1.1/go.mod h1:em0nMJCgc9GFtwrmVmEMR/ZL6WyhyjMBndrE9hABlRI=
 github.com/posener/complete v1.2.3 h1:NP0eAhjcjImqslEwo/1hq7gpajME0fTLTezBKDqfXqo=
 github.com/posener/complete v1.2.3/go.mod h1:WZIdtGGp+qx0sLrYKtIRAruyNpv6hFCicSgv7Sy7s/s=
-github.com/prometheus/client_golang v1.18.0 h1:HzFfmkOzH5Q8L8G+kSJKUx5dtG87sewO+FoDDqP5Tbk=
-github.com/prometheus/client_golang v1.18.0/go.mod h1:T+GXkCk5wSJyOqMIzVgvvjFDlkOQntgjkJWKrN5txjA=
-github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
-github.com/prometheus/client_model v0.5.0 h1:VQw1hfvPvk3Uv6Qf29VrPF32JB6rtbgI6cYPYQjL0Qw=
-github.com/prometheus/client_model v0.5.0/go.mod h1:dTiFglRmd66nLR9Pv9f0mZi7B7fk5Pm3gvsjB5tr+kI=
-github.com/prometheus/common v0.46.0 h1:doXzt5ybi1HBKpsZOL0sSkaNHJJqkyfEWZGGqqScV0Y=
-github.com/prometheus/common v0.46.0/go.mod h1:Tp0qkxpb9Jsg54QMe+EAmqXkSV7Evdy1BTn+g2pa/hQ=
-github.com/prometheus/procfs v0.12.0 h1:jluTpSng7V9hY0O2R9DzzJHYb2xULk9VTR1V1R/k6Bo=
-github.com/prometheus/procfs v0.12.0/go.mod h1:pcuDEFsWDnvcgNzo4EEweacyhjeA9Zk3cnaOZAZEfOo=
-github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec h1:W09IVJc94icq4NjY3clb7Lk8O1qJ8BdBEF8z0ibU0rE=
-github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec/go.mod h1:qqbHyh8v60DhA7CoWK5oRCqLrMHRGoxYCSS9EjAz6Eo=
-github.com/rogpeppe/go-internal v1.6.2/go.mod h1:xXDCJY+GAPziupqXw64V24skbSoqbTEfhy4qGm1nDQc=
 github.com/rogpeppe/go-internal v1.9.0/go.mod h1:WtVeX8xhTBvf0smdhujwtBcq4Qrzq/fJaraNFVN+nFs=
-github.com/rogpeppe/go-internal v1.12.0 h1:exVL4IDcn6na9z1rAb56Vxr+CgyK3nn3O+epU5NdKM8=
-github.com/rogpeppe/go-internal v1.12.0/go.mod h1:E+RYuTGaKKdloAfM02xzb0FW3Paa99yedzYV+kq4uf4=
-github.com/russross/blackfriday v1.6.0 h1:KqfZb0pUVN2lYqZUYRddxF4OR8ZMURnJIG5Y3VRLtww=
-github.com/russross/blackfriday v1.6.0/go.mod h1:ti0ldHuxg49ri4ksnFxlkCfN+hvslNlmVHqNRXXJNAY=
+github.com/rogpeppe/go-internal v1.16.0 h1:O9DK+vNMDVGLr2BeZqmpLeMjiMNkuXfcqntWbZV6S5g=
+github.com/rogpeppe/go-internal v1.16.0/go.mod h1:DrUVZyrJU+txYW5/1kwtXQSMFio52ZOxX7yM1VHvnxs=
 github.com/ryanuber/go-glob v1.0.0 h1:iQh3xXAumdQ+4Ufa5b25cRpC5TYKlno6hsv6Cb3pkBk=
 github.com/ryanuber/go-glob v1.0.0/go.mod h1:807d1WSdnB0XRJzKNil9Om6lcp/3a0v4qIHxIXzX/Yc=
-github.com/sergi/go-diff v1.2.0 h1:XU+rvMAioB0UC3q1MFrIQy4Vo5/4VsRDQQXHsEya6xQ=
-github.com/sergi/go-diff v1.2.0/go.mod h1:STckp+ISIX8hZLjrqAeVduY0gWCT9IjLuqbuNXdaHfM=
-github.com/sethvargo/go-diceware v0.3.0 h1:UVVEfmN/uF50JfWAN7nbY6CiAlp5xeSx+5U0lWKkMCQ=
-github.com/sethvargo/go-diceware v0.3.0/go.mod h1:lH5Q/oSPMivseNdhMERAC7Ti5oOPqsaVddU1BcN1CY0=
+github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3 h1:n661drycOFuPLCN3Uc8sB6B/s6Z4t2xvBgU1htSHuq8=
+github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3/go.mod h1:A0bzQcvG0E7Rwjx0REVgAGH58e96+X0MeOfepqsbeW4=
 github.com/shopspring/decimal v1.2.0/go.mod h1:DKyhrW/HYNuLGql+MJL6WCR6knT2jwCFRcu2hWCYk4o=
 github.com/shopspring/decimal v1.3.1 h1:2Usl1nmF/WZucqkFZhnfFYxxxu8LG21F6nPQBE5gKV8=
 github.com/shopspring/decimal v1.3.1/go.mod h1:DKyhrW/HYNuLGql+MJL6WCR6knT2jwCFRcu2hWCYk4o=
-github.com/sirupsen/logrus v1.4.2/go.mod h1:tLMulIdttU9McNUspp0xgXVQah82FyeX6MwdIuYE2rE=
 github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
 github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
-github.com/skeema/knownhosts v1.2.1 h1:SHWdIUa82uGZz+F+47k8SY4QhhI291cXCpopT1lK2AQ=
-github.com/skeema/knownhosts v1.2.1/go.mod h1:xYbVRSPxqBZFrdmDyMmsOs+uX1UZC3nTN3ThzgDxUwo=
+github.com/skeema/knownhosts v1.3.1 h1:X2osQ+RAjK76shCbvhHHHVl3ZlgDm8apHEHFqRjnBY8=
+github.com/skeema/knownhosts v1.3.1/go.mod h1:r7KTdC8l4uxWRyK2TpQZ/1o5HaSzh06ePQNxPwTcfiY=
 github.com/spf13/cast v1.3.1/go.mod h1:Qx5cxh0v+4UWYiBimWS+eyWzqEqokIECu5etghLkUJE=
 github.com/spf13/cast v1.6.0 h1:GEiTHELF+vaR5dhz3VqZfFSzZjYbgeKDpBxQVS4GYJ0=
 github.com/spf13/cast v1.6.0/go.mod h1:ancEpBxwJDODSW/UG4rDrAqiKolqNNh2DX3mk86cAdo=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
-github.com/stretchr/objx v0.1.1/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
-github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
-github.com/stretchr/objx v0.5.2 h1:xuMeJ0Sdp5ZMRXx/aWO6RZxdr3beISkG5/G/aIRr3pY=
-github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA=
 github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
 github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
 github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA=
-github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.7.2/go.mod h1:R6va5+xMeoiuVRoj+gSkQ7d3FALtqAAGI1FQKckRals=
-github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
-github.com/stretchr/testify v1.9.0 h1:HtqpIVDClZ4nwg75+f6Lvsy/wHu+3BoSGCbBAcpTsTg=
-github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
+github.com/stretchr/testify v1.12.1 h1:EuwCh5fleGS7H32xRwO3wRGT7DxrDhLAT6FF8MpWDWE=
+github.com/stretchr/testify v1.12.1/go.mod h1:MDEgiDPPsNp5cuIrHPPCyornHKgEVbtFUmoNlxoYthg=
 github.com/vmihailenco/msgpack v3.3.3+incompatible/go.mod h1:fy3FlTQTDXWkZ7Bh6AcGMlsjHatGryHQYUTf1ShIgkk=
 github.com/vmihailenco/msgpack v4.0.4+incompatible h1:dSLoQfGFAo3F6OoNhwUmLwVgaUXK79GlxNBwueZn0xI=
 github.com/vmihailenco/msgpack v4.0.4+incompatible/go.mod h1:fy3FlTQTDXWkZ7Bh6AcGMlsjHatGryHQYUTf1ShIgkk=
@@ -510,227 +349,144 @@ github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 h1:EzJWgHo
 github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415/go.mod h1:GwrjFmJcFw6At/Gs6z4yjiIwzuJ1/+UwLxMQDVQXShQ=
 github.com/xeipuuv/gojsonschema v1.2.0 h1:LhYJRs+L4fBtjZUfuSZIKGeVu0QRy8e5Xi7D17UxZ74=
 github.com/xeipuuv/gojsonschema v1.2.0/go.mod h1:anYRn/JVcOK2ZgGU+IjEV4nwlhoK5sQluxsYJ78Id3Y=
-github.com/xo/dburl v0.23.1 h1:PX1RgQaaJV1S5iADcM1TT39OLrg5daeV6Hp7RYwVoYw=
-github.com/xo/dburl v0.23.1/go.mod h1:B7/G9FGungw6ighV8xJNwWYQPMfn3gsi2sn5SE8Bzco=
-github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
-github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
-github.com/yuin/goldmark v1.6.0 h1:boZcn2GTjpsynOsC0iJHnBWa4Bi0qzfJjthwauItG68=
-github.com/yuin/goldmark v1.6.0/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
+github.com/yuin/goldmark v1.7.7 h1:5m9rrB1sW3JUMToKFQfb+FGt1U7r57IHu5GrYrG2nqU=
+github.com/yuin/goldmark v1.7.7/go.mod h1:uzxRWxtg69N339t3louHJ7+O03ezfj6PlliRlaOzY1E=
 github.com/yuin/goldmark-meta v1.1.0 h1:pWw+JLHGZe8Rk0EGsMVssiNb/AaPMHfSRszZeUeiOUc=
 github.com/yuin/goldmark-meta v1.1.0/go.mod h1:U4spWENafuA7Zyg+Lj5RqK/MF+ovMYtBvXi1lBb2VP0=
-github.com/zalando/go-keyring v0.2.3 h1:v9CUu9phlABObO4LPWycf+zwMG7nlbb3t/B5wa97yms=
-github.com/zalando/go-keyring v0.2.3/go.mod h1:HL4k+OXQfJUWaMnqyuSOc0drfGPX2b51Du6K+MRgZMk=
-github.com/zclconf/go-cty v1.14.2 h1:kTG7lqmBou0Zkx35r6HJHUQTvaRPr5bIAf3AoHS0izI=
-github.com/zclconf/go-cty v1.14.2/go.mod h1:VvMs5i0vgZdhYawQNq5kePSpLAoz8u1xvZgrPIxfnZE=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.48.0 h1:doUP+ExOpH3spVTLS0FcWGLnQrPct/hD/bCPbDRUEAU=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.48.0/go.mod h1:rdENBZMT2OE6Ne/KLwpiXudnAsbdrdBaqBvTN8M8BgA=
-go.opentelemetry.io/otel v1.23.1 h1:Za4UzOqJYS+MUczKI320AtqZHZb7EqxO00jAHE0jmQY=
-go.opentelemetry.io/otel v1.23.1/go.mod h1:Td0134eafDLcTS4y+zQ26GE8u3dEuRBiBCTUIRHaikA=
-go.opentelemetry.io/otel/metric v1.23.1 h1:PQJmqJ9u2QaJLBOELl1cxIdPcpbwzbkjfEyelTl2rlo=
-go.opentelemetry.io/otel/metric v1.23.1/go.mod h1:mpG2QPlAfnK8yNhNJAxDZruU9Y1/HubbC+KyH8FaCWI=
-go.opentelemetry.io/otel/trace v1.23.1 h1:4LrmmEd8AU2rFvU1zegmvqW7+kWarxtNOPyeL6HmYY8=
-go.opentelemetry.io/otel/trace v1.23.1/go.mod h1:4IpnpJFwr1mo/6HL8XIPJaE9y0+u1KcVmuW7dwFSVrI=
-go.uber.org/atomic v1.7.0/go.mod h1:fEN4uk6kAWBTFdckzkM89CLk9XfWZrxpCo0nPH17wJc=
-go.uber.org/atomic v1.11.0 h1:ZvwS0R+56ePWxUNi+Atn9dWONBPp/AUETXlHW0DxSjE=
-go.uber.org/atomic v1.11.0/go.mod h1:LUxbIzbOniOlMKjJjyPfpl4v+PKK2cNJn91OQbhoJI0=
-go.uber.org/goleak v1.0.0/go.mod h1:8a7PlsEVH3e/a/GLqe5IIrQx6GzcnRmZEufDUTk4A7A=
-go.uber.org/goleak v1.1.10/go.mod h1:8a7PlsEVH3e/a/GLqe5IIrQx6GzcnRmZEufDUTk4A7A=
-go.uber.org/goleak v1.1.12 h1:gZAh5/EyT/HQwlpkCy6wTpqfH9H8Lz8zbm3dZh+OyzA=
-go.uber.org/goleak v1.1.12/go.mod h1:cwTWslyiVhfpKIDGSZEM2HlOvcqm+tG4zioyIeLoqMQ=
-go.uber.org/multierr v1.6.0/go.mod h1:cdWPpRnG4AhwMwsgIHip0KRBQjJy5kYEpYjJxpXp9iU=
-go.uber.org/zap v1.18.1/go.mod h1:xg/QME4nWcxGxrpdeYfq7UvYrLh66cuVKdrbD1XF/NI=
+github.com/zclconf/go-cty v1.18.1 h1:yEGE8M4iIZlyKQURZNb2SnEyZlZHUcBCnx6KF81KuwM=
+github.com/zclconf/go-cty v1.18.1/go.mod h1:qpnV6EDNgC1sns/AleL1fvatHw72j+S+nS+MJ+T2CSg=
+github.com/zclconf/go-cty-debug v0.0.0-20240509010212-0d6042c53940 h1:4r45xpDWB6ZMSMNJFMOjqrGHynW3DIBuR2H9j0ug+Mo=
+github.com/zclconf/go-cty-debug v0.0.0-20240509010212-0d6042c53940/go.mod h1:CmBdvvj3nqzfzJ6nTCIwDTPZ56aVGvDrmztiO5g3qrM=
+go.abhg.dev/goldmark/frontmatter v0.2.0 h1:P8kPG0YkL12+aYk2yU3xHv4tcXzeVnN+gU0tJ5JnxRw=
+go.abhg.dev/goldmark/frontmatter v0.2.0/go.mod h1:XqrEkZuM57djk7zrlRUB02x8I5J0px76YjkOzhB4YlU=
+go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64=
+go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.70.0 h1:LMuyCAyfalSjDyjdC65nK6N0zoTT63+E/u95X0JovZI=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.70.0/go.mod h1:085m8qbm4hgc8rZWGDEa4vmyyo2c3nPxUslYUKUIU04=
+go.opentelemetry.io/otel v1.45.0 h1:pdrWmLHofpubmArBv1LgFSv1Z0Ie/ppdZzu+kUN5EeU=
+go.opentelemetry.io/otel v1.45.0/go.mod h1:XZxIqPapzEYnhNSScF5DIqXhm/rYi0FzCe2XddAwZfQ=
+go.opentelemetry.io/otel/metric v1.45.0 h1:7Eg1uH7CJ5cXv9is6tnBe1FI6rj1nwUdbFypRm3br/M=
+go.opentelemetry.io/otel/metric v1.45.0/go.mod h1:HAPbm1nd3p1PmFH7v2dR+6BjXxw+Lq4a2+pndMAm08s=
+go.opentelemetry.io/otel/sdk v1.45.0 h1:4VVSMgQ83dUgW2aoX5f6JgLvHwIvzcuLnF9lUdCSpCw=
+go.opentelemetry.io/otel/sdk v1.45.0/go.mod h1:Sr40LgXV7DsKMMJMKOhUWOgMWTfAaqvm2kF0g7ilwuA=
+go.opentelemetry.io/otel/sdk/metric v1.45.0 h1:oVFszMfyj1Am6s24Vtc7wBb8BKLcwepJjNEYILuiE3o=
+go.opentelemetry.io/otel/sdk/metric v1.45.0/go.mod h1:vUWUxDZvu1WVRj8JA8S0AdhsPrZoDpA2DdZauIh4mDA=
+go.opentelemetry.io/otel/trace v1.45.0 h1:l/mP6Uv7oNO7/TblbhpbgMidxhq1uO/rPsikOyVhxag=
+go.opentelemetry.io/otel/trace v1.45.0/go.mod h1:qoJJA2xNMnxRrdISU/kLtfUH2wNeQbiv+jhs/CxI8bc=
+go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
+go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
+go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw=
+go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
-golang.org/x/crypto v0.0.0-20190325154230-a5d413f7728c/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
-golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
-golang.org/x/crypto v0.0.0-20191205180655-e7c4368fe9dd/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/crypto v0.0.0-20200414173820-0848c9571904/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/crypto v0.0.0-20200820211705-5c72a883971a/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.3.0/go.mod h1:hebNnKkNXi2UzZN1eVRvBB7co0a+JxK6XbPiWVs/3J4=
-golang.org/x/crypto v0.13.0/go.mod h1:y6Z2r+Rw4iayiXXAIxJIDAJ1zMW4yaTpebo8fPOliYc=
 golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU=
-golang.org/x/crypto v0.25.0 h1:ypSNr+bnYL2YhwoMt2zPxHFmbAN1KZs/njMG3hxUp30=
-golang.org/x/crypto v0.25.0/go.mod h1:T+wALwcMOSE0kXgUAnPAHqTLW+XHgcELELW8VaDgm/M=
-golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
-golang.org/x/exp v0.0.0-20240205201215-2c58cdc269a3 h1:/RIbNt/Zr7rVhIkQhooTxCxFcdWLGIKnZA4IXNFSrvo=
-golang.org/x/exp v0.0.0-20240205201215-2c58cdc269a3/go.mod h1:idGWGoKP1toJGkd5/ig9ZLuPcZBC3ewk7SzmH0uou08=
-golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
-golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod h1:wehouNa3lNwaWXcvxsM5YxQ5yQlVC4a0KAMCusXpPoU=
-golang.org/x/lint v0.0.0-20190313153728-d0100b6bd8b3/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
-golang.org/x/lint v0.0.0-20190930215403-16217165b5de/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
-golang.org/x/lint v0.0.0-20200302205851-738671d3881b/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
-golang.org/x/mod v0.1.1-0.20191105210325-c90efee705ee/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg=
-golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/mod v0.4.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
+golang.org/x/crypto v0.57.0 h1:3ZVCjf8Ggz7zneR/EHRVx68Ctf+2pmIMP2UFhh9cC6M=
+golang.org/x/crypto v0.57.0/go.mod h1:Fdz0i5U6CoizGwLda9DttjSk6qlZo25zYNtR+ycvuZA=
+golang.org/x/exp v0.0.0-20250506013437-ce4c2cf36ca6 h1:y5zboxd6LQAqYIhHnB48p0ByQ/GnQx2BE33L8BOHQkI=
+golang.org/x/exp v0.0.0-20250506013437-ce4c2cf36ca6/go.mod h1:U6Lno4MTRCDY+Ba7aCcauB9T60gsv5s4ralQzP72ZoQ=
 golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
 golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
-golang.org/x/mod v0.17.0 h1:zY54UmvipHiNd+pm+m0x9KhZ9hl1/7QNMyxXbc6ICqA=
-golang.org/x/mod v0.17.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
-golang.org/x/net v0.0.0-20180218175443-cbe0f9307d01/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20190213061140-3a22650c66bd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
+golang.org/x/mod v0.41.0 h1:qJmnOUb4YB+FsEuM3HcWucdZASCPGhsX6uljO6pog0c=
+golang.org/x/mod v0.41.0/go.mod h1:Ek9pY8RKWXwsWvd3rQiHYtMqkjSUV+s1Rj7j4H5Ur6o=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20200202094626-16171245cfb2/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20200324143707-d3edc9973b7e/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
-golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
 golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
 golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
 golang.org/x/net v0.2.0/go.mod h1:KqCZLdyyvdV855qA2rE3GC2aiw5xGR5TEjj8smXukLY=
 golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
 golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
-golang.org/x/net v0.25.0 h1:d/OCCoBEUq33pjydKrGQhw7IlUPI2Oylr+8qLx49kac=
-golang.org/x/net v0.25.0/go.mod h1:JkAGAh7GEvH74S6FOH42FLoXpXbE/aqXSrIQjXgsiwM=
-golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
-golang.org/x/oauth2 v0.17.0 h1:6m3ZPmLEFdVxKKWnKq4VqZ60gutO35zm+zrAHVmHyDQ=
-golang.org/x/oauth2 v0.17.0/go.mod h1:OzPDGQiuQMguemayvdylqddI7qcD9lnSDb+1FiwQ5HA=
+golang.org/x/net v0.60.0 h1:79p50tfZlm0J9YfoDsSi639qSXNGVwEzOPLCxM2FsYU=
+golang.org/x/net v0.60.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg=
+golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs=
+golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.7.0 h1:YsImfSBoP9QPYL0xyKJPq0gcaJdG3rInoqxTWbfQu9M=
-golang.org/x/sync v0.7.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
-golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sync v0.23.0 h1:KameEIfc1IkluZyXWLn39Wd4tURc6GbCiISGiZm2bQk=
+golang.org/x/sync v0.23.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190422165155-953cdadca894/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200116001909-b77594299b42/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200223170610-d5e6a3e2c0ae/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210616094352-59db8d763f22/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210630005230-0f9fa26af87c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20210927094055-39ccf1dd6fa6/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20211025201205-69cdffdb9359/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220503163025-988cb79eb6c6/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.2.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.7.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/sys v0.22.0 h1:RI27ohtqKCnwULzJLqkv897zojh5/DwS/ENaMzUOaWI=
-golang.org/x/sys v0.22.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.48.0 h1:bbX/i/6MgT9BVLM9RT1thmxL04yeTAhbEz4SyadbXoo=
+golang.org/x/sys v0.48.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/term v0.2.0/go.mod h1:TVmDHMZPmdnySmBfhjOoOdhjzdE1h4u1VwSiw2l1Nuc=
 golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
 golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo=
-golang.org/x/term v0.12.0/go.mod h1:owVbMEjm3cBLCHdkQu9b1opXd4ETQWc3BhuQGKgXgvU=
 golang.org/x/term v0.17.0/go.mod h1:lLRBjIVuehSbZlaOtGMbcMncT+aqLLLmKrsjNrUguwk=
-golang.org/x/term v0.22.0 h1:BbsgPEJULsl2fV/AT3v15Mjva5yXKQDyKf+TbDz7QJk=
-golang.org/x/term v0.22.0/go.mod h1:F3qCibpT5AMpCRfhfT53vVJwhLtIVHhB9XDjfFvnMI4=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
-golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
 golang.org/x/text v0.3.8/go.mod h1:E6s5w1FMmriuDzIBO73fBruAKo1PCIq6d2Q6DHfQ8WQ=
 golang.org/x/text v0.4.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
 golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
 golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
-golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
 golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
-golang.org/x/text v0.16.0 h1:a94ExnEXNtEwYLGJSIUxnWoxoRz/ZcCsV63ROupILh4=
-golang.org/x/text v0.16.0/go.mod h1:GhwF1Be+LQoKShO3cGOHzqOgRrGaYc9AvblQOmPVHnI=
-golang.org/x/time v0.5.0 h1:o7cqy6amK/52YcAKIPlM3a+Fpj35zvRj2TP+e1xFSfk=
-golang.org/x/time v0.5.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
+golang.org/x/text v0.42.0 h1:JbOZXgfeCPU9gacVtYliJqOhD+zhrEqK4LfdpmlUZqI=
+golang.org/x/text v0.42.0/go.mod h1:ojzP1Z+2QtioaF8DTtO8K5q7JWVVYwZKenzujK0Zd0E=
+golang.org/x/time v0.14.0 h1:MRx4UaLrDotUKUdCIqzPC48t1Y9hANFKIRpNx+Te8PI=
+golang.org/x/time v0.14.0/go.mod h1:eL/Oa2bBBK0TkX57Fyni+NgnyQQN4LitPmob2Hjnqw4=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3HoIrodX9oNMXvdceNzlUR8zjMvY=
-golang.org/x/tools v0.0.0-20190311212946-11955173bddd/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
-golang.org/x/tools v0.0.0-20190524140312-2c0ae7006135/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
-golang.org/x/tools v0.0.0-20191108193012-7d206e10da11/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20200130002326-2f3ba24bd6e7/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
-golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
-golang.org/x/tools v0.0.0-20210101214203-2dba1e4ea05c/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
-golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
 golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
 golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
-golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d h1:vU5i/LfpvrRCpgM/VPfJLg5KjxD3E+hfT1SH+d9zLwg=
-golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d/go.mod h1:aiJjzUbINMkxbQROHiO6hDPo2LHcIPhhQsa9DLh0yGk=
+golang.org/x/tools v0.49.0 h1:3NI7VXzL9+1WZD52Dx2ttoPwD5DWrFGpl9mFZDlmisI=
+golang.org/x/tools v0.49.0/go.mod h1:SJNXV9DBKT0UbdttsQjbfJlAE/q+y36++zo3uL3N0Oo=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4=
+gonum.org/v1/gonum v0.17.0/go.mod h1:El3tOrEuMpv2UdMrbNlKEh9vd86bmQ6vqIcDwxEOc1E=
 google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
-google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
 google.golang.org/appengine v1.6.8 h1:IhEN5q69dyKagZPYMSdIjS2HqprW324FRQZJcGqPAsM=
 google.golang.org/appengine v1.6.8/go.mod h1:1jJ3jBArFh5pcgW8gCtRJnepW8FzD1V44FJffLiz/Ds=
-google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
-google.golang.org/genproto v0.0.0-20190819201941-24fa4b261c55/go.mod h1:DMBHOl98Agz4BDEuKkezgsaosCRResVns1a3J2ZsMNc=
-google.golang.org/genproto v0.0.0-20200423170343-7949de9c1215/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
-google.golang.org/genproto v0.0.0-20240205150955-31a09d347014 h1:g/4bk7P6TPMkAUbUhquq98xey1slwvuVJPosdBqYJlU=
-google.golang.org/genproto v0.0.0-20240205150955-31a09d347014/go.mod h1:xEgQu1e4stdSSsxPDK8Azkrk/ECl5HvdPf6nbZrTS5M=
-google.golang.org/genproto/googleapis/api v0.0.0-20240205150955-31a09d347014 h1:x9PwdEgd11LgK+orcck69WVRo7DezSO4VUMPI4xpc8A=
-google.golang.org/genproto/googleapis/api v0.0.0-20240205150955-31a09d347014/go.mod h1:rbHMSEDyoYX62nRVLOCc4Qt1HbsdytAYoVwgjiOhF3I=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20240205150955-31a09d347014 h1:FSL3lRCkhaPFxqi0s9o+V4UI2WTzAVOvkgbd4kVV4Wg=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20240205150955-31a09d347014/go.mod h1:SaPjaZGWb0lPqs6Ittu0spdfrOArqji4ZdeP5IC/9N4=
-google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
-google.golang.org/grpc v1.23.0/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyacEbxg=
-google.golang.org/grpc v1.25.1/go.mod h1:c3i+UQWmh7LiEpx4sFZnkU36qjEYZ0imhYfXVyQciAY=
-google.golang.org/grpc v1.27.0/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk=
-google.golang.org/grpc v1.29.1/go.mod h1:itym6AZVZYACWQqET3MqgPpjcuV5QH3BxFS3IjizoKk=
-google.golang.org/grpc v1.61.1 h1:kLAiWrZs7YeDM6MumDe7m3y4aM6wacLzM1Y/wiLP9XY=
-google.golang.org/grpc v1.61.1/go.mod h1:VUbo7IFqmF1QtCAstipjG0GIoq49KvMe9+h1jFLBNJs=
+google.golang.org/genproto/googleapis/api v0.0.0-20260817212433-ac3dfec99bb1 h1:lrupDmKL3p5kEX1M92oan027eCKcouzjuPbH6YBK+Rs=
+google.golang.org/genproto/googleapis/api v0.0.0-20260817212433-ac3dfec99bb1/go.mod h1:q/3oV3jAi5vwelxsVAprMBC8BcM2zmNe+IjRGd+9/ks=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260817212433-ac3dfec99bb1 h1:utmqiUzZAEINbLmRyAt1QjVkMyLQ+lvIwCpLaB1rZfw=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260817212433-ac3dfec99bb1/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
+google.golang.org/grpc v1.85.0-dev.0.20260825072537-93e31b48545e h1:ar+feAPij1Znzug45m6AoShUCc5AaR8FLA3I6LZd94k=
+google.golang.org/grpc v1.85.0-dev.0.20260825072537-93e31b48545e/go.mod h1:7aY/KlAHanMAVIWHnk8wloQsdlfwzDz/PP9vCbJG6CU=
 google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
 google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
-google.golang.org/protobuf v1.34.2 h1:6xV6lTsCfpGD21XK49h7MhtcApnLqkfYgPcdHftf6hg=
-google.golang.org/protobuf v1.34.2/go.mod h1:qYOHts0dSfpeUzUFpOMr/WGzszTmLH+DiWniOlNbLDw=
+google.golang.org/protobuf v1.36.12 h1:pJOKDDOyeXErUroCihFAd5LQuwXBSpVnKGrj5o/fwxc=
+google.golang.org/protobuf v1.36.12/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/check.v1 v1.0.0-20200902074654-038fdea0a05b/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
-gopkg.in/errgo.v2 v2.1.0/go.mod h1:hNsd1EY+bozCKY1Ytp96fpM3vjJbqLJn88ws8XvfDNI=
 gopkg.in/warnings.v0 v0.1.2 h1:wFXVbFY8DY5/xOe1ECiWdKCzZlxgshcYVNkBHstARME=
 gopkg.in/warnings.v0 v0.1.2/go.mod h1:jksf8JmL6Qr/oQM2OXTHunEvvTAsrWBLb6OOjuVWRNI=
 gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.3.0/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
 gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-gorm.io/driver/postgres v1.5.9 h1:DkegyItji119OlcaLjqN11kHoUgZ/j13E0jkJZgD6A8=
-gorm.io/driver/postgres v1.5.9/go.mod h1:DX3GReXH+3FPWGrrgffdvCk3DQ1dwDPdmbenSkweRGI=
-gorm.io/driver/sqlite v1.5.6 h1:fO/X46qn5NUEEOZtnjJRWRzZMe8nqJiQ9E+0hi+hKQE=
-gorm.io/driver/sqlite v1.5.6/go.mod h1:U+J8craQU6Fzkcvu8oLeAQmi50TkwPEhHDEjQZXDah4=
-gorm.io/gorm v1.25.11 h1:/Wfyg1B/je1hnDx3sMkX+gAlxrlZpn6X0BXRlwXlvHg=
-gorm.io/gorm v1.25.11/go.mod h1:xh7N7RHfYlNc5EmcI/El95gXusucDrQnHXe0+CgWcLQ=
-gotest.tools/v3 v3.3.0 h1:MfDY1b1/0xN1CyMlQDac0ziEy9zJQd9CXBRRDHw2jJo=
-gotest.tools/v3 v3.3.0/go.mod h1:Mcr9QNxkg0uMvy/YElmo4SpXgJKWgQvYrT7Kw5RzJ1A=
-honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
-honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
-modernc.org/libc v1.41.0 h1:g9YAc6BkKlgORsUWj+JwqoB1wU3o4DE3bM3yvA3k+Gk=
-modernc.org/libc v1.41.0/go.mod h1:w0eszPsiXoOnoMJgrXjglgLuDy/bt5RR4y3QzUUeodY=
-modernc.org/mathutil v1.6.0 h1:fRe9+AmYlaej+64JsEEhoWuAYBkOtQiMEU7n/XgfYi4=
-modernc.org/mathutil v1.6.0/go.mod h1:Ui5Q9q1TR2gFm0AQRqQUaBWFLAhQpCwNcuhBOSedWPo=
-modernc.org/memory v1.7.2 h1:Klh90S215mmH8c9gO98QxQFsY+W451E8AnzjoE2ee1E=
-modernc.org/memory v1.7.2/go.mod h1:NO4NVCQy0N7ln+T9ngWqOQfi7ley4vpwvARR+Hjw95E=
-modernc.org/sqlite v1.28.0 h1:Zx+LyDDmXczNnEQdvPuEfcFVA2ZPyaD7UCZDjef3BHQ=
-modernc.org/sqlite v1.28.0/go.mod h1:Qxpazz0zH8Z1xCFyi5GSL3FzbtZ3fvbjmywNogldEW0=
-mvdan.cc/gofumpt v0.1.1/go.mod h1:yXG1r1WqZVKWbVRtBWKWX9+CxGYfA51nSomhM0woR48=
-mvdan.cc/gofumpt v0.6.0 h1:G3QvahNDmpD+Aek/bNOLrFR2XC6ZAdo62dZu65gmwGo=
-mvdan.cc/gofumpt v0.6.0/go.mod h1:4L0wf+kgIPZtcCWXynNS2e6bhmj73umwnuXSZarixzA=
-nhooyr.io/websocket v1.8.10 h1:mv4p+MnGrLDcPlBoWsvPP7XCzTYMXP9F9eIGoKbgx7Q=
-nhooyr.io/websocket v1.8.10/go.mod h1:rN9OFWIUwuxg4fR5tELlYC04bXYowCP9GX47ivo2l+c=
+gotest.tools/v3 v3.5.2 h1:7koQfIKdy+I8UTetycgUqXWSDwpgv193Ka+qRsmBY8Q=
+gotest.tools/v3 v3.5.2/go.mod h1:LtdLGcnqToBH83WByAAi/wiwSFCArdFIUV/xxN4pcjA=
+mvdan.cc/gofumpt v0.12.0 h1:1Lbudkz2kpM9Cjz2pL4M19u7q+GaEhCTNf7N9mfpcho=
+mvdan.cc/gofumpt v0.12.0/go.mod h1:SmBHHrljiZu/uoypeKup3rFzP6eoC9UwCp2iH5E3jZA=
+pgregory.net/rapid v1.2.0 h1:keKAYRcjm+e1F0oAuU5F5+YPAWcyxNNRK2wud503Gnk=
+pgregory.net/rapid v1.2.0/go.mod h1:PY5XlDGj0+V1FCq0o192FdRhpKHGTRIWBgqjDBTrq04=
+repo.anhonesthost.net/CyberCoveLLC/threshold/api v0.1.0 h1:koidiBvmCK/ySuBPSlYZTTT0xD57Y7n+wmDwE2cdGe8=
+repo.anhonesthost.net/CyberCoveLLC/threshold/api v0.1.0/go.mod h1:zbM8drZPFYzaHCkso4i5iyl+3wwznWEildTGsnKhoGk=
+repo.anhonesthost.net/CyberCoveLLC/threshold/sdk v0.1.0 h1:ExuSGqE1pA/1DnS5xrSK7kEhD+4g5hIJC5TgmwH5LAU=
+repo.anhonesthost.net/CyberCoveLLC/threshold/sdk v0.1.0/go.mod h1:cWxYF3tEkYEKTY76ub8kL+vdGmopO0YfJqJGGQJov7k=

internal/provider/const.go

@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2020, 2026
 // SPDX-License-Identifier: MPL-2.0
 
 package provider

internal/provider/data_source_account.go

@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2020, 2026
 // SPDX-License-Identifier: MPL-2.0
 
 package provider
@@ -7,8 +7,8 @@ import (
 	"context"
 	"net/http"
 
-	"github.com/hashicorp/boundary/api"
-	"github.com/hashicorp/boundary/api/accounts"
+	"repo.anhonesthost.net/CyberCoveLLC/threshold/api"
+	"repo.anhonesthost.net/CyberCoveLLC/threshold/api/accounts"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
@@ -16,7 +16,7 @@ import (
 
 func dataSourceAccount() *schema.Resource {
 	return &schema.Resource{
-		Description: "The boundary_account data source allows you to find a Boundary account.",
+		Description: "The boundary_account data source allows you to find a Threshold account.",
 		ReadContext: dataSourceAccountRead,
 
 		Schema: map[string]*schema.Schema{
@@ -86,7 +86,8 @@ func dataSourceAccountRead(ctx context.Context, d *schema.ResourceData, meta int
 	authMethodId := d.Get(AuthMethodIdKey).(string)
 
 	acl := accounts.NewClient(md.client)
-	accountsList, err := acl.List(ctx, authMethodId,
+	accountsList, err := acl.List(
+		ctx, authMethodId,
 		accounts.WithFilter(FilterWithItemNameMatches(name)),
 	)
 	if err != nil {

internal/provider/data_source_account_test.go

@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2020, 2026
 // SPDX-License-Identifier: MPL-2.0
 
 package provider
@@ -8,10 +8,12 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/hashicorp/boundary/testing/controller"
+	"github.com/YakDriver/regexache"
 	"github.com/hashicorp/cap/oidc"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/id"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/stretchr/testify/require"
 )
 
 var accountPasswordRead = `
@@ -36,16 +38,17 @@ data "boundary_account" "acc_oidc" {
 }`
 
 func TestAccAccountReadPassword(t *testing.T) {
-	tc := controller.NewTestController(t, tcConfig...)
-	defer tc.Shutdown()
-	url := tc.ApiAddrs()[0]
+	cfg, err := loadTestConfig()
+	require.NoError(t, err)
+	url := cfg.BoundaryAddr
+	suffix := id.UniqueId()
 
 	var provider *schema.Provider
 	resource.Test(t, resource.TestCase{
 		ProviderFactories: providerFactories(&provider),
 		Steps: []resource.TestStep{
 			{
-				Config: testConfig(url, fooOrg, fooAccountPassword, accountPasswordRead),
+				Config: testConfig(url, fooOrg(suffix), fooAccountPassword, accountPasswordRead),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckAccountResourceExists(provider, "boundary_account_password.foo"),
 					resource.TestCheckResourceAttrSet("data.boundary_account.acc_password", IDKey),
@@ -54,7 +57,7 @@ func TestAccAccountReadPassword(t *testing.T) {
 					resource.TestCheckResourceAttr("data.boundary_account.acc_password", DescriptionKey, fooAccountPasswordDesc),
 					resource.TestCheckResourceAttr("data.boundary_account.acc_password", TypeKey, "password"),
 					resource.TestCheckResourceAttrSet("data.boundary_account.acc_password", "scope.0.id"),
-					resource.TestCheckResourceAttr("data.boundary_account.acc_password", "scope.0.name", "org1"),
+					resource.TestMatchResourceAttr("data.boundary_account.acc_password", "scope.0.name", regexache.MustCompile(`^org1-`)),
 					resource.TestCheckResourceAttr("data.boundary_account.acc_password", "scope.0.type", "org"),
 				),
 			},
@@ -63,16 +66,17 @@ func TestAccAccountReadPassword(t *testing.T) {
 }
 
 func TestAccAccountReadLdap(t *testing.T) {
-	tc := controller.NewTestController(t, tcConfig...)
-	defer tc.Shutdown()
-	url := tc.ApiAddrs()[0]
+	cfg, err := loadTestConfig()
+	require.NoError(t, err)
+	url := cfg.BoundaryAddr
+	suffix := id.UniqueId()
 
 	var provider *schema.Provider
 	resource.Test(t, resource.TestCase{
 		ProviderFactories: providerFactories(&provider),
 		Steps: []resource.TestStep{
 			{
-				Config: testConfig(url, fooOrg, testAccountLdap, accountLdapRead),
+				Config: testConfig(url, fooOrg(suffix), testAccountLdap, accountLdapRead),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckAccountResourceExists(provider, "boundary_account_ldap.foo"),
 					resource.TestCheckResourceAttrSet("data.boundary_account.acc_ldap", IDKey),
@@ -81,7 +85,7 @@ func TestAccAccountReadLdap(t *testing.T) {
 					resource.TestCheckResourceAttr("data.boundary_account.acc_ldap", DescriptionKey, testAccountLdapDesc),
 					resource.TestCheckResourceAttr("data.boundary_account.acc_ldap", TypeKey, "ldap"),
 					resource.TestCheckResourceAttrSet("data.boundary_account.acc_ldap", "scope.0.id"),
-					resource.TestCheckResourceAttr("data.boundary_account.acc_ldap", "scope.0.name", "org1"),
+					resource.TestMatchResourceAttr("data.boundary_account.acc_ldap", "scope.0.name", regexache.MustCompile(`^org1-`)),
 					resource.TestCheckResourceAttr("data.boundary_account.acc_ldap", "scope.0.type", "org"),
 				),
 			},
@@ -91,9 +95,10 @@ func TestAccAccountReadLdap(t *testing.T) {
 
 func TestAccAccountReadOidc(t *testing.T) {
 	tp := oidc.StartTestProvider(t)
-	tc := controller.NewTestController(t, tcConfig...)
-	defer tc.Shutdown()
-	url := tc.ApiAddrs()[0]
+	cfg, err := loadTestConfig()
+	require.NoError(t, err)
+	url := cfg.BoundaryAddr
+	suffix := id.UniqueId()
 
 	var provider *schema.Provider
 	tpCert := strings.TrimSpace(tp.CACert())
@@ -103,7 +108,7 @@ func TestAccAccountReadOidc(t *testing.T) {
 		ProviderFactories: providerFactories(&provider),
 		Steps: []resource.TestStep{
 			{
-				Config: testConfig(url, fooOrg, createConfig, accountOidcRead),
+				Config: testConfig(url, fooOrg(suffix), createConfig, accountOidcRead),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckAccountResourceExists(provider, "boundary_account_oidc.foo"),
 					resource.TestCheckResourceAttrSet("data.boundary_account.acc_oidc", IDKey),
@@ -112,7 +117,7 @@ func TestAccAccountReadOidc(t *testing.T) {
 					resource.TestCheckResourceAttr("data.boundary_account.acc_oidc", DescriptionKey, fooAccountOidcDesc),
 					resource.TestCheckResourceAttr("data.boundary_account.acc_oidc", TypeKey, "oidc"),
 					resource.TestCheckResourceAttrSet("data.boundary_account.acc_oidc", "scope.0.id"),
-					resource.TestCheckResourceAttr("data.boundary_account.acc_oidc", "scope.0.name", "org1"),
+					resource.TestMatchResourceAttr("data.boundary_account.acc_oidc", "scope.0.name", regexache.MustCompile(`^org1-`)),
 					resource.TestCheckResourceAttr("data.boundary_account.acc_oidc", "scope.0.type", "org"),
 				),
 			},

internal/provider/data_source_auth_method.go

@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2020, 2026
 // SPDX-License-Identifier: MPL-2.0
 
 package provider
@@ -7,8 +7,8 @@ import (
 	"context"
 	"net/http"
 
-	"github.com/hashicorp/boundary/api"
-	"github.com/hashicorp/boundary/api/authmethods"
+	"repo.anhonesthost.net/CyberCoveLLC/threshold/api"
+	"repo.anhonesthost.net/CyberCoveLLC/threshold/api/authmethods"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
@@ -16,7 +16,7 @@ import (
 
 func dataSourceAuthMethod() *schema.Resource {
 	return &schema.Resource{
-		Description: "The boundary_auth_method data source allows you to find a Boundary auth method.",
+		Description: "The boundary_auth_method data source allows you to find a Threshold auth method.",
 		ReadContext: dataSourceAuthMethodRead,
 
 		Schema: map[string]*schema.Schema{
@@ -87,7 +87,8 @@ func dataSourceAuthMethodRead(ctx context.Context, d *schema.ResourceData, meta
 	scopeId := d.Get(ScopeIdKey).(string)
 
 	amcl := authmethods.NewClient(md.client)
-	authMethodsList, err := amcl.List(ctx, scopeId,
+	authMethodsList, err := amcl.List(
+		ctx, scopeId,
 		authmethods.WithFilter(FilterWithItemNameMatches(name)),
 	)
 	if err != nil {

internal/provider/data_source_auth_method_test.go

@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2020, 2026
 // SPDX-License-Identifier: MPL-2.0
 
 package provider
@@ -7,16 +7,20 @@ import (
 	"fmt"
 	"testing"
 
-	"github.com/hashicorp/boundary/testing/controller"
+	"github.com/YakDriver/regexache"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/id"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/stretchr/testify/require"
 )
 
 const (
 	testAuthMethodName = "test_auth_method"
 )
 
-var authMethodReadGlobal = fmt.Sprintf(`
+func authMethodReadGlobal(suffix string) string {
+	name := testAuthMethodName + "-" + suffix
+	return fmt.Sprintf(`
 resource "boundary_auth_method" "auth_method" {
 	name 		= "%s"
 	description = "test"
@@ -28,7 +32,8 @@ resource "boundary_auth_method" "auth_method" {
 data "boundary_auth_method" "auth_method" {
 	depends_on = [ boundary_auth_method.auth_method ]
 	name 	   = "%s"
-}`, testAuthMethodName, testAuthMethodName)
+}`, name, name)
+}
 
 var authMethodReadOrg = fmt.Sprintf(`
 resource "boundary_auth_method" "auth_method" {
@@ -46,20 +51,21 @@ data "boundary_auth_method" "auth_method" {
 }`, testAuthMethodName, testAuthMethodName)
 
 func TestAccAuthMethodReadGlobal(t *testing.T) {
-	tc := controller.NewTestController(t, tcConfig...)
-	defer tc.Shutdown()
-	url := tc.ApiAddrs()[0]
+	cfg, err := loadTestConfig()
+	require.NoError(t, err)
+	url := cfg.BoundaryAddr
+	suffix := id.UniqueId()
 
 	var provider *schema.Provider
 	resource.Test(t, resource.TestCase{
 		ProviderFactories: providerFactories(&provider),
 		Steps: []resource.TestStep{
 			{
-				Config: testConfig(url, fooOrg, authMethodReadGlobal),
+				Config: testConfig(url, fooOrg(suffix), authMethodReadGlobal(suffix)),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttrSet("data.boundary_auth_method.auth_method", IDKey),
 					resource.TestCheckResourceAttrSet("data.boundary_auth_method.auth_method", ScopeIdKey),
-					resource.TestCheckResourceAttr("data.boundary_auth_method.auth_method", NameKey, testAuthMethodName),
+					resource.TestMatchResourceAttr("data.boundary_auth_method.auth_method", NameKey, regexache.MustCompile(`^`+testAuthMethodName)),
 					resource.TestCheckResourceAttr("data.boundary_auth_method.auth_method", TypeKey, "password"),
 					resource.TestCheckResourceAttrSet("data.boundary_auth_method.auth_method", DescriptionKey),
 					resource.TestCheckResourceAttrSet("data.boundary_auth_method.auth_method", "scope.0.id"),
@@ -72,16 +78,17 @@ func TestAccAuthMethodReadGlobal(t *testing.T) {
 }
 
 func TestAccAuthMethodReadOrg(t *testing.T) {
-	tc := controller.NewTestController(t, tcConfig...)
-	defer tc.Shutdown()
-	url := tc.ApiAddrs()[0]
+	cfg, err := loadTestConfig()
+	require.NoError(t, err)
+	url := cfg.BoundaryAddr
+	suffix := id.UniqueId()
 
 	var provider *schema.Provider
 	resource.Test(t, resource.TestCase{
 		ProviderFactories: providerFactories(&provider),
 		Steps: []resource.TestStep{
 			{
-				Config: testConfig(url, fooOrg, authMethodReadOrg),
+				Config: testConfig(url, fooOrg(suffix), authMethodReadOrg),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttrSet("data.boundary_auth_method.auth_method", IDKey),
 					resource.TestCheckResourceAttrSet("data.boundary_auth_method.auth_method", ScopeIdKey),
@@ -89,7 +96,7 @@ func TestAccAuthMethodReadOrg(t *testing.T) {
 					resource.TestCheckResourceAttr("data.boundary_auth_method.auth_method", TypeKey, "password"),
 					resource.TestCheckResourceAttrSet("data.boundary_auth_method.auth_method", DescriptionKey),
 					resource.TestCheckResourceAttrSet("data.boundary_auth_method.auth_method", "scope.0.id"),
-					resource.TestCheckResourceAttr("data.boundary_auth_method.auth_method", "scope.0.name", "org1"),
+					resource.TestMatchResourceAttr("data.boundary_auth_method.auth_method", "scope.0.name", regexache.MustCompile(`^org1-`)),
 					resource.TestCheckResourceAttr("data.boundary_auth_method.auth_method", "scope.0.type", "org"),
 				),
 			},

internal/provider/data_source_group.go

@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2020, 2026
 // SPDX-License-Identifier: MPL-2.0
 
 package provider
@@ -7,8 +7,8 @@ import (
 	"context"
 	"net/http"
 
-	"github.com/hashicorp/boundary/api"
-	"github.com/hashicorp/boundary/api/groups"
+	"repo.anhonesthost.net/CyberCoveLLC/threshold/api"
+	"repo.anhonesthost.net/CyberCoveLLC/threshold/api/groups"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
@@ -16,7 +16,7 @@ import (
 
 func dataSourceGroup() *schema.Resource {
 	return &schema.Resource{
-		Description: "The boundary_group data source allows you to find a Boundary group.",
+		Description: "The boundary_group data source allows you to find a Threshold group.",
 		ReadContext: dataSourceGroupRead,
 
 		Schema: map[string]*schema.Schema{
@@ -88,7 +88,8 @@ func dataSourceGroupRead(ctx context.Context, d *schema.ResourceData, meta inter
 	scopeId := d.Get(ScopeIdKey).(string)
 
 	gcl := groups.NewClient(md.client)
-	groupsList, err := gcl.List(ctx, scopeId,
+	groupsList, err := gcl.List(
+		ctx, scopeId,
 		groups.WithFilter(FilterWithItemNameMatches(name)),
 	)
 	if err != nil {

internal/provider/data_source_group_test.go

@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2020, 2026
 // SPDX-License-Identifier: MPL-2.0
 
 package provider
@@ -7,17 +7,20 @@ import (
 	"fmt"
 	"testing"
 
-	"github.com/hashicorp/boundary/testing/controller"
+	"github.com/YakDriver/regexache"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/id"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/stretchr/testify/require"
 )
 
 const (
 	testGroupName = "test_group"
 )
 
-var groupReadGlobal = fmt.Sprintf(`
-
+func groupReadGlobal(suffix string) string {
+	name := testGroupName + "-" + suffix
+	return fmt.Sprintf(`
 resource "boundary_user" "user" {
 	description = "user"
 	scope_id    = "global"
@@ -35,7 +38,8 @@ resource "boundary_group" "group" {
 data "boundary_group" "group" {
 	depends_on = [ boundary_group.group ]
 	name = "%s"
-}`, testGroupName, testGroupName)
+}`, name, name)
+}
 
 var groupReadOrg = fmt.Sprintf(`
 resource "boundary_user" "user" {
@@ -59,21 +63,22 @@ data "boundary_group" "group" {
 }`, testGroupName, testGroupName)
 
 func TestAccGroupReadGlobal(t *testing.T) {
-	tc := controller.NewTestController(t, tcConfig...)
-	defer tc.Shutdown()
-	url := tc.ApiAddrs()[0]
+	cfg, err := loadTestConfig()
+	require.NoError(t, err)
+	url := cfg.BoundaryAddr
+	suffix := id.UniqueId()
 
 	var provider *schema.Provider
 	resource.Test(t, resource.TestCase{
 		ProviderFactories: providerFactories(&provider),
 		Steps: []resource.TestStep{
 			{
-				Config: testConfig(url, fooOrg, groupReadGlobal),
+				Config: testConfig(url, fooOrg(suffix), groupReadGlobal(suffix)),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckGroupResourceExists(provider, "boundary_group.group"),
 					resource.TestCheckResourceAttrSet("data.boundary_group.group", IDKey),
 					resource.TestCheckResourceAttrSet("data.boundary_group.group", ScopeIdKey),
-					resource.TestCheckResourceAttr("data.boundary_group.group", NameKey, testGroupName),
+					resource.TestMatchResourceAttr("data.boundary_group.group", NameKey, regexache.MustCompile(`^`+testGroupName)),
 					resource.TestCheckResourceAttrSet("data.boundary_group.group", DescriptionKey),
 					resource.TestCheckResourceAttrSet("data.boundary_group.group", fmt.Sprintf("%s.#", GroupMemberIdsKey)),
 					resource.TestCheckResourceAttrSet("data.boundary_group.group", "scope.0.id"),
@@ -86,16 +91,17 @@ func TestAccGroupReadGlobal(t *testing.T) {
 }
 
 func TestAccGroupReadOrg(t *testing.T) {
-	tc := controller.NewTestController(t, tcConfig...)
-	defer tc.Shutdown()
-	url := tc.ApiAddrs()[0]
+	cfg, err := loadTestConfig()
+	require.NoError(t, err)
+	url := cfg.BoundaryAddr
+	suffix := id.UniqueId()
 
 	var provider *schema.Provider
 	resource.Test(t, resource.TestCase{
 		ProviderFactories: providerFactories(&provider),
 		Steps: []resource.TestStep{
 			{
-				Config: testConfig(url, fooOrg, groupReadOrg),
+				Config: testConfig(url, fooOrg(suffix), groupReadOrg),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckGroupResourceExists(provider, "boundary_group.group"),
 					resource.TestCheckResourceAttrSet("data.boundary_group.group", IDKey),
@@ -104,7 +110,7 @@ func TestAccGroupReadOrg(t *testing.T) {
 					resource.TestCheckResourceAttrSet("data.boundary_group.group", DescriptionKey),
 					resource.TestCheckResourceAttrSet("data.boundary_group.group", fmt.Sprintf("%s.#", GroupMemberIdsKey)),
 					resource.TestCheckResourceAttrSet("data.boundary_group.group", "scope.0.id"),
-					resource.TestCheckResourceAttr("data.boundary_group.group", "scope.0.name", "org1"),
+					resource.TestMatchResourceAttr("data.boundary_group.group", "scope.0.name", regexache.MustCompile(`^org1-`)),
 					resource.TestCheckResourceAttr("data.boundary_group.group", "scope.0.type", "org"),
 				),
 			},

internal/provider/data_source_role.go

@@ -0,0 +1,163 @@
+// Copyright IBM Corp. 2020, 2026
+// SPDX-License-Identifier: MPL-2.0
+
+package provider
+
+import (
+	"context"
+	"net/http"
+
+	"repo.anhonesthost.net/CyberCoveLLC/threshold/api"
+	"repo.anhonesthost.net/CyberCoveLLC/threshold/api/roles"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
+)
+
+func dataSourceRole() *schema.Resource {
+	return &schema.Resource{
+		Description: "The boundary_role data source allows you to find a Threshold role.",
+		ReadContext: dataSourceRoleRead,
+
+		Schema: map[string]*schema.Schema{
+			NameKey: {
+				Description:  "The name of the role to retrieve.",
+				Type:         schema.TypeString,
+				Required:     true,
+				ValidateFunc: validation.StringIsNotEmpty,
+			},
+			ScopeIdKey: {
+				Description:  "The scope ID in which the resource is created. Defaults `global` if unset.",
+				Type:         schema.TypeString,
+				Optional:     true,
+				Default:      "global",
+				ValidateFunc: validation.StringIsNotEmpty,
+			},
+			IDKey: {
+				Description: "The ID of the retrieved role.",
+				Type:        schema.TypeString,
+				Computed:    true,
+			},
+			DescriptionKey: {
+				Description: "The description of the retrieved role.",
+				Type:        schema.TypeString,
+				Computed:    true,
+			},
+			ScopeKey: {
+				Type:     schema.TypeList,
+				Computed: true,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						IDKey: {
+							Type:     schema.TypeString,
+							Computed: true,
+						},
+						NameKey: {
+							Type:     schema.TypeString,
+							Computed: true,
+						},
+						TypeKey: {
+							Type:     schema.TypeString,
+							Computed: true,
+						},
+						DescriptionKey: {
+							Type:     schema.TypeString,
+							Computed: true,
+						},
+						ParentScopeIdKey: {
+							Type:     schema.TypeString,
+							Computed: true,
+						},
+					},
+				},
+			},
+			rolePrincipalIdsKey: {
+				Description: "The list of principal (user or group) IDs added as principals on the role.",
+				Type:        schema.TypeSet,
+				Elem:        &schema.Schema{Type: schema.TypeString},
+				Computed:    true,
+			},
+			roleGrantStringsKey: {
+				Description: "The list of stringified grants for the role.",
+				Type:        schema.TypeSet,
+				Elem:        &schema.Schema{Type: schema.TypeString},
+				Computed:    true,
+			},
+			roleGrantScopeIdsKey: {
+				Description: "The list of scope IDs for the role's grants.",
+				Type:        schema.TypeSet,
+				Elem:        &schema.Schema{Type: schema.TypeString},
+				Computed:    true,
+			},
+		},
+	}
+}
+
+func dataSourceRoleRead(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
+	md := meta.(*metaData)
+
+	name := d.Get(NameKey).(string)
+	scopeId := d.Get(ScopeIdKey).(string)
+
+	rcl := roles.NewClient(md.client)
+	rolesList, err := rcl.List(
+		ctx, scopeId,
+		roles.WithFilter(FilterWithItemNameMatches(name)),
+	)
+	if err != nil {
+		return diag.Errorf("error calling list role: %v", err)
+	}
+	roles := rolesList.GetItems()
+	if roles == nil {
+		return diag.Errorf("no roles found")
+	}
+	if len(roles) == 0 {
+		return diag.Errorf("no matching role found")
+	}
+	if len(roles) > 1 {
+		return diag.Errorf("error found more than 1 role")
+	}
+
+	rrr, err := rcl.Read(ctx, roles[0].Id)
+	if err != nil {
+		if apiErr := api.AsServerError(err); apiErr != nil && apiErr.Response().StatusCode() == http.StatusNotFound {
+			d.SetId("")
+			return nil
+		}
+		return diag.Errorf("error calling read role: %v", err)
+	}
+	if rrr == nil {
+		return diag.Errorf("role nil after read")
+	}
+
+	if err := setFromRoleRead(d, *rrr.Item); err != nil {
+		return diag.FromErr(err)
+	}
+
+	return nil
+}
+
+func setFromRoleRead(d *schema.ResourceData, role roles.Role) error {
+	if err := d.Set(NameKey, role.Name); err != nil {
+		return err
+	}
+	if err := d.Set(DescriptionKey, role.Description); err != nil {
+		return err
+	}
+	if err := d.Set(ScopeIdKey, role.ScopeId); err != nil {
+		return err
+	}
+	if err := d.Set(roleGrantStringsKey, role.GrantStrings); err != nil {
+		return err
+	}
+	if err := d.Set(roleGrantScopeIdsKey, role.GrantScopeIds); err != nil {
+		return err
+	}
+	if err := d.Set(rolePrincipalIdsKey, role.PrincipalIds); err != nil {
+		return err
+	}
+
+	d.Set(ScopeKey, flattenScopeInfo(role.Scope))
+	d.SetId(role.Id)
+	return nil
+}

internal/provider/data_source_role_test.go

@@ -0,0 +1,133 @@
+// Copyright IBM Corp. 2020, 2026
+// SPDX-License-Identifier: MPL-2.0
+
+package provider
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/YakDriver/regexache"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/id"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/stretchr/testify/require"
+)
+
+const (
+	testRoleName = "my_role"
+)
+
+func roleReadGlobal(suffix string) string {
+	name := testRoleName + "-" + suffix
+	return fmt.Sprintf(`
+resource "boundary_user" "user" {
+  name     = "my_user-%s"
+  scope_id = "global"
+}
+
+resource "boundary_role" "role" {
+  name        = "%s"
+  description = "test role global"
+  scope_id    = "global"
+  grant_strings = [
+    "ids=*;type=*;actions=read"
+  ]
+  principal_ids = [ boundary_user.user.id ]
+}
+
+data "boundary_role" "role" {
+  depends_on = [ boundary_role.role ]
+  name       = "%s"
+}
+`, suffix, name, name)
+}
+
+var roleReadOrg = fmt.Sprintf(`
+resource "boundary_user" "user" {
+  name     = "my_user"
+  scope_id    = "global"
+}
+
+resource "boundary_role" "role" {
+  name        = "%s"
+  description = "test role org"
+  scope_id    = boundary_scope.org1.id
+  grant_strings = [
+    "ids=*;type=*;actions=read"
+  ]
+  principal_ids = [ boundary_user.user.id ]
+}
+
+data "boundary_role" "role" {
+  depends_on = [ boundary_role.role ]
+  name       = "%s"
+  scope_id   = boundary_scope.org1.id
+}
+`, testRoleName, testRoleName)
+
+func TestAccRoleReadGlobal(t *testing.T) {
+	cfg, err := loadTestConfig()
+	require.NoError(t, err)
+	url := cfg.BoundaryAddr
+	suffix := id.UniqueId()
+
+	dataSourceName := "data.boundary_role.role"
+
+	var provider *schema.Provider
+	resource.Test(t, resource.TestCase{
+		ProviderFactories: providerFactories(&provider),
+		Steps: []resource.TestStep{
+			{
+				Config: testConfig(url, roleReadGlobal(suffix)),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttrSet(dataSourceName, IDKey),
+					resource.TestCheckResourceAttrSet(dataSourceName, ScopeIdKey),
+					resource.TestMatchResourceAttr(dataSourceName, NameKey, regexache.MustCompile(`^`+testRoleName)),
+					resource.TestCheckResourceAttrSet(dataSourceName, DescriptionKey),
+					resource.TestCheckResourceAttr(dataSourceName, fmt.Sprintf("%s.#", roleGrantStringsKey), "1"),
+					resource.TestCheckResourceAttr(dataSourceName, fmt.Sprintf("%s.0", roleGrantStringsKey), "ids=*;type=*;actions=read"),
+					resource.TestCheckResourceAttr(dataSourceName, fmt.Sprintf("%s.#", roleGrantScopeIdsKey), "1"),
+					resource.TestCheckResourceAttrSet(dataSourceName, "scope.0.id"),
+					resource.TestCheckResourceAttr(dataSourceName, "scope.0.name", "global"),
+					resource.TestCheckResourceAttr(dataSourceName, "scope.0.type", "global"),
+					resource.TestCheckResourceAttr(dataSourceName, fmt.Sprintf("%s.#", rolePrincipalIdsKey), "1"),
+					resource.TestCheckResourceAttrPair(dataSourceName, fmt.Sprintf("%s.0", rolePrincipalIdsKey), "boundary_user.user", "id"),
+				),
+			},
+		},
+	})
+}
+
+func TestAccRoleReadOrg(t *testing.T) {
+	cfg, err := loadTestConfig()
+	require.NoError(t, err)
+	url := cfg.BoundaryAddr
+	suffix := id.UniqueId()
+
+	dataSourceName := "data.boundary_role.role"
+
+	var provider *schema.Provider
+	resource.Test(t, resource.TestCase{
+		ProviderFactories: providerFactories(&provider),
+		Steps: []resource.TestStep{
+			{
+				Config: testConfig(url, fooOrg(suffix), roleReadOrg),
+				Check: resource.ComposeTestCheckFunc(
+					resource.TestCheckResourceAttrSet(dataSourceName, IDKey),
+					resource.TestCheckResourceAttrSet(dataSourceName, ScopeIdKey),
+					resource.TestCheckResourceAttr(dataSourceName, NameKey, testRoleName),
+					resource.TestCheckResourceAttrSet(dataSourceName, DescriptionKey),
+					resource.TestCheckResourceAttr(dataSourceName, fmt.Sprintf("%s.#", roleGrantStringsKey), "1"),
+					resource.TestCheckResourceAttr(dataSourceName, fmt.Sprintf("%s.0", roleGrantStringsKey), "ids=*;type=*;actions=read"),
+					resource.TestCheckResourceAttr(dataSourceName, fmt.Sprintf("%s.#", roleGrantScopeIdsKey), "1"),
+					resource.TestCheckResourceAttrSet(dataSourceName, "scope.0.id"),
+					resource.TestMatchResourceAttr(dataSourceName, "scope.0.name", regexache.MustCompile(`^org1-`)),
+					resource.TestCheckResourceAttr(dataSourceName, "scope.0.type", "org"),
+					resource.TestCheckResourceAttr(dataSourceName, fmt.Sprintf("%s.#", rolePrincipalIdsKey), "1"),
+					resource.TestCheckResourceAttrPair(dataSourceName, fmt.Sprintf("%s.0", rolePrincipalIdsKey), "boundary_user.user", "id"),
+				),
+			},
+		},
+	})
+}

internal/provider/data_source_scope.go

@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2020, 2026
 // SPDX-License-Identifier: MPL-2.0
 
 package provider
@@ -7,15 +7,15 @@ import (
 	"context"
 	"net/http"
 
-	"github.com/hashicorp/boundary/api"
-	"github.com/hashicorp/boundary/api/scopes"
+	"repo.anhonesthost.net/CyberCoveLLC/threshold/api"
+	"repo.anhonesthost.net/CyberCoveLLC/threshold/api/scopes"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 )
 
 func dataSourceScope() *schema.Resource {
 	return &schema.Resource{
-		Description: "The scope data source allows you to discover an existing Boundary scope by name.",
+		Description: "The scope data source allows you to discover an existing Threshold scope by name.",
 		ReadContext: dataSourceScopeRead,
 
 		Schema: map[string]*schema.Schema{

internal/provider/data_source_scope_test.go

@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2020, 2026
 // SPDX-License-Identifier: MPL-2.0
 
 package provider
@@ -7,62 +7,68 @@ import (
 	"fmt"
 	"testing"
 
-	"github.com/hashicorp/boundary/testing/controller"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/id"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/stretchr/testify/require"
 )
 
 const (
-	orgName        = "test org scope"
-	projectName    = "test project scope"
-	notProjectName = "test project scope with wrong name"
-	scopeDesc      = "created to test the scope datasource"
+	scopeDesc = "created to test the scope datasource"
 )
 
-var scopeCreateAndRead = fmt.Sprintf(`
+func scopeCreateAndRead(suffix string) string {
+	orgName := "test org scope " + suffix
+	projectName := "test project scope " + suffix
+	return fmt.Sprintf(`
 resource "boundary_scope" "global" {
 	global_scope = true
-	name = "global"
-	description = "Global Scope"
-	scope_id = "global"
+	name         = "global"
+	description  = "Global Scope"
+	scope_id     = "global"
 }
 
 resource "boundary_scope" "org" {
-	scope_id = boundary_scope.global.id
-	name = "%s"
+	scope_id    = boundary_scope.global.id
+	name        = "%s"
 	description = "%s"
 }
 
 resource "boundary_scope" "project" {
-	depends_on = [boundary_role.org_admin]
-	scope_id = boundary_scope.org.id
-	name = "%s"
+	depends_on  = [boundary_role.org_admin]
+	scope_id    = boundary_scope.org.id
+	name        = "%s"
 	description = "%s"
 }
 
 resource "boundary_role" "org_admin" {
-	scope_id = "global"
+	scope_id        = "global"
 	grant_scope_ids = [boundary_scope.org.id]
-	grant_strings = ["ids=*;type=*;actions=*"]
-	principal_ids = ["u_auth"]
+	grant_strings   = ["ids=*;type=*;actions=*"]
+	principal_ids   = ["u_auth"]
 }
 
 data "boundary_scope" "org" {
 	depends_on = [boundary_scope.org]
-	scope_id = "global"
-	name = "%s"
+	scope_id   = "global"
+	name       = "%s"
 }
 
 data "boundary_scope" "project" {
 	depends_on = [boundary_scope.project]
-	scope_id = data.boundary_scope.org.id
-	name = "%s"
+	scope_id   = data.boundary_scope.org.id
+	name       = "%s"
 }`, orgName, scopeDesc, projectName, scopeDesc, orgName, projectName)
+}
 
 func TestAccScopeRead(t *testing.T) {
-	tc := controller.NewTestController(t, tcConfig...)
-	defer tc.Shutdown()
-	url := tc.ApiAddrs()[0]
+	cfg, err := loadTestConfig()
+	require.NoError(t, err)
+	url := cfg.BoundaryAddr
+	suffix := id.UniqueId()
+
+	orgName := "test org scope " + suffix
+	projectName := "test project scope " + suffix
 
 	var provider *schema.Provider
 	resource.Test(t, resource.TestCase{
@@ -71,7 +77,7 @@ func TestAccScopeRead(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				// create and read
-				Config: testConfig(url, scopeCreateAndRead),
+				Config: testConfig(url, scopeCreateAndRead(suffix)),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckScopeResourceExists(provider, "boundary_scope.org"),
 					resource.TestCheckResourceAttr("boundary_scope.org", "description", scopeDesc),

internal/provider/data_source_user.go

@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2020, 2026
 // SPDX-License-Identifier: MPL-2.0
 
 package provider
@@ -6,7 +6,7 @@ package provider
 import (
 	"context"
 
-	"github.com/hashicorp/boundary/api/users"
+	"repo.anhonesthost.net/CyberCoveLLC/threshold/api/users"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
@@ -14,7 +14,7 @@ import (
 
 func dataSourceUser() *schema.Resource {
 	return &schema.Resource{
-		Description: "The user data source allows you to find a Boundary user.",
+		Description: "The user data source allows you to find a Threshold user.",
 		ReadContext: dataSourceUserRead,
 
 		Schema: map[string]*schema.Schema{

internal/provider/data_source_user_test.go

@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2020, 2026
 // SPDX-License-Identifier: MPL-2.0
 
 package provider
@@ -8,9 +8,10 @@ import (
 	"testing"
 
 	"github.com/YakDriver/regexache"
-	"github.com/hashicorp/boundary/testing/controller"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/id"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/stretchr/testify/require"
 )
 
 var (
@@ -37,10 +38,11 @@ data "boundary_user" "admin" {
 // NOTE: this test also tests out the direct token auth mechanism.
 
 func TestAccUserDataSource_basicOrgUser(t *testing.T) {
-	tc := controller.NewTestController(t, tcConfig...)
-	defer tc.Shutdown()
-	url := tc.ApiAddrs()[0]
-	token := tc.Token().Token
+	cfg, err := loadTestConfig()
+	require.NoError(t, err)
+	url := cfg.BoundaryAddr
+	token := cfg.BoundaryAuthToken
+	suffix := id.UniqueId()
 
 	resourceName := "boundary_user.org1"
 	dataSourceName := "data.boundary_user.org1"
@@ -52,7 +54,7 @@ func TestAccUserDataSource_basicOrgUser(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				// test create
-				Config: testConfigWithToken(url, token, fooOrg, orgUserDataSource),
+				Config: testConfigWithToken(url, token, fooOrg(suffix), orgUserDataSource),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckUserResourceExists(provider, resourceName),
 					resource.TestCheckResourceAttr(dataSourceName, DescriptionKey, fooDescription),
@@ -64,10 +66,11 @@ func TestAccUserDataSource_basicOrgUser(t *testing.T) {
 }
 
 func TestAccUserDataSource_globalAdminUser(t *testing.T) {
-	tc := controller.NewTestController(t, tcConfig...)
-	defer tc.Shutdown()
-	url := tc.ApiAddrs()[0]
-	token := tc.Token().Token
+	cfg, err := loadTestConfig()
+	require.NoError(t, err)
+	url := cfg.BoundaryAddr
+	token := cfg.BoundaryAuthToken
+	suffix := id.UniqueId()
 
 	dataSourceName := "data.boundary_user.admin"
 
@@ -76,11 +79,11 @@ func TestAccUserDataSource_globalAdminUser(t *testing.T) {
 		ProviderFactories: providerFactories(&provider),
 		Steps: []resource.TestStep{
 			{
-				Config: testConfigWithToken(url, token, fooOrg, globalUserDataSource),
+				Config: testConfigWithToken(url, token, fooOrg(suffix), globalUserDataSource),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr(dataSourceName, NameKey, "admin"),
 					resource.TestCheckResourceAttr(dataSourceName, DescriptionKey, "Initial admin user within the \"global\" scope"),
-					resource.TestCheckResourceAttr(dataSourceName, LoginNameKey, "testuser"),
+					resource.TestCheckResourceAttr(dataSourceName, LoginNameKey, tcLoginName),
 					resource.TestMatchResourceAttr(dataSourceName, IDKey, regexache.MustCompile(`^u_.+`)),
 					resource.TestMatchResourceAttr(dataSourceName, PrimaryAccountIdKey, regexache.MustCompile(`^acctpw_.+`)),
 					resource.TestCheckResourceAttr(dataSourceName, "authorized_actions.#", "8"),

internal/provider/filter.go

@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2020, 2026
 // SPDX-License-Identifier: MPL-2.0
 
 package provider

internal/provider/pathorcontents.go

@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2020, 2026
 // SPDX-License-Identifier: MPL-2.0
 
 // Helpers for dealing with file paths and their contents

internal/provider/provider.go

@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2020, 2026
 // SPDX-License-Identifier: MPL-2.0
 
 package provider
@@ -10,15 +10,15 @@ import (
 	"net/http"
 	"strings"
 
-	"github.com/hashicorp/boundary/api"
-	"github.com/hashicorp/boundary/api/authmethods"
-	"github.com/hashicorp/boundary/sdk/wrapper"
+	"repo.anhonesthost.net/CyberCoveLLC/threshold/api"
+	"repo.anhonesthost.net/CyberCoveLLC/threshold/api/authmethods"
+	"repo.anhonesthost.net/CyberCoveLLC/threshold/sdk/wrapper"
 	wrapping "github.com/hashicorp/go-kms-wrapping/v2"
 	"github.com/hashicorp/go-secure-stdlib/configutil/v2"
 	"github.com/hashicorp/go-secure-stdlib/pluginutil/v2"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
-	kms_plugin_assets "github.com/hashicorp/terraform-provider-boundary/plugins/kms"
+	kms_plugin_assets "repo.anhonesthost.net/CyberCoveLLC/terraform-provider-threshold/plugins/kms"
 )
 
 const (
@@ -38,12 +38,12 @@ func New() *schema.Provider {
 			"addr": {
 				Type:        schema.TypeString,
 				Required:    true,
-				Description: `The base url of the Boundary API, e.g. "http://127.0.0.1:9200". If not set, it will be read from the "BOUNDARY_ADDR" env var.`,
+				Description: `The base url of the Threshold API, e.g. "http://127.0.0.1:9200". If not set, it will be read from the "BOUNDARY_ADDR" env var.`,
 			},
 			"token": {
 				Type:        schema.TypeString,
 				Optional:    true,
-				Description: `The Boundary token to use, as a string or path on disk containing just the string. If set, the token read here will be used in place of authenticating with the auth method specified in "auth_method_id", although the recovery KMS mechanism will still override this. Can also be set with the BOUNDARY_TOKEN environment variable.`,
+				Description: `The Threshold token to use, as a string or path on disk containing just the string. If set, the token read here will be used in place of authenticating with the auth method specified in "auth_method_id", although the recovery KMS mechanism will still override this. Can also be set with the BOUNDARY_TOKEN environment variable.`,
 			},
 			"recovery_kms_hcl": {
 				Type:        schema.TypeString,
@@ -80,12 +80,12 @@ func New() *schema.Provider {
 			"tls_insecure": {
 				Type:        schema.TypeBool,
 				Optional:    true,
-				Description: "When set to true, does not validate the Boundary API endpoint certificate",
+				Description: "When set to true, does not validate the Threshold API endpoint certificate",
 			},
 			"plugin_execution_dir": {
 				Type:        schema.TypeString,
 				Optional:    true,
-				Description: `Specifies a directory that the Boundary provider can use to write and execute its built-in plugins.`,
+				Description: `Specifies a directory that the Threshold provider can use to write and execute its built-in plugins.`,
 			},
 			"scope_id": {
 				Type:        schema.TypeString,
@@ -105,9 +105,12 @@ func New() *schema.Provider {
 			"boundary_auth_method_ldap":                         resourceAuthMethodLdap(),
 			"boundary_credential_library_vault":                 resourceCredentialLibraryVault(),
 			"boundary_credential_library_vault_ssh_certificate": resourceCredentialLibraryVaultSshCertificate(),
+			"boundary_credential_library_vault_ldap":            resourceCredentialLibraryVaultLdap(),
 			"boundary_credential_store_vault":                   resourceCredentialStoreVault(),
 			"boundary_credential_store_static":                  resourceCredentialStoreStatic(),
 			"boundary_credential_username_password":             resourceCredentialUsernamePassword(),
+			"boundary_credential_username_password_domain":      resourceCredentialUsernamePasswordDomain(),
+			"boundary_credential_password":                      resourceCredentialPassword(),
 			"boundary_credential_ssh_private_key":               resourceCredentialSshPrivateKey(),
 			"boundary_credential_json":                          resourceCredentialJson(),
 			"boundary_managed_group":                            resourceManagedGroup(),
@@ -122,11 +125,13 @@ func New() *schema.Provider {
 			"boundary_host_set_static":                          resourceHostSetStatic(),
 			"boundary_host_set_plugin":                          resourceHostSetPlugin(),
 			"boundary_policy_storage":                           resourcePolicyStorage(),
+			"boundary_scope_alias_suffix":                       resourceScopeAliasSuffix(),
 			"boundary_scope_policy_attachment":                  resourceScopePolicyAttachment(),
 			"boundary_role":                                     resourceRole(),
 			"boundary_scope":                                    resourceScope(),
 			"boundary_storage_bucket":                           resourceStorageBucket(),
 			"boundary_target":                                   resourceTarget(),
+			"boundary_target_host_source":                       resourceTargetHostSource(),
 			"boundary_user":                                     resourceUser(),
 			"boundary_worker":                                   resourceWorker(),
 		},
@@ -136,6 +141,7 @@ func New() *schema.Provider {
 			"boundary_group":       dataSourceGroup(),
 			"boundary_scope":       dataSourceScope(),
 			"boundary_user":        dataSourceUser(),
+			"boundary_role":        dataSourceRole(),
 		},
 	}
 
@@ -200,7 +206,8 @@ func providerAuthenticate(ctx context.Context, d *schema.ResourceData, md *metaD
 			ctx,
 			recoveryHclStr,
 			"recovery",
-			configutil.WithPluginOptions(opts...))
+			configutil.WithPluginOptions(opts...),
+		)
 		if err != nil {
 			return fmt.Errorf(`error reading wrappers from "recovery_kms_hcl": %v`, err)
 		}

internal/provider/provider_test.go

@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2020, 2026
 // SPDX-License-Identifier: MPL-2.0
 
 package provider
@@ -12,28 +12,23 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/hashicorp/boundary/testing/controller"
 	"github.com/hashicorp/cap/ldap"
 	"github.com/hashicorp/cap/oidc"
 	wrapping "github.com/hashicorp/go-kms-wrapping/v2"
 	"github.com/hashicorp/go-kms-wrapping/v2/aead"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/id"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/resource"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
 	"github.com/jimlambrt/gldap"
 	"github.com/jimlambrt/gldap/testdirectory"
+	"github.com/stretchr/testify/require"
 )
 
 var (
-	tcLoginName = "testuser"
-	tcPassword  = "passpass"
-	tcPAUM      = "ampw_0000000000"
-	tcConfig    = []controller.Option{
-		controller.WithDefaultPasswordAuthMethodId(tcPAUM),
-		controller.WithDefaultLoginName(tcLoginName),
-		controller.WithDefaultPassword(tcPassword),
-	}
-	tcRecoveryKey = "7xtkEoS5EXPbgynwd+dDLHopaCqK8cq0Rpep4eooaTs="
+	tcLoginName = "admin"
+	tcPassword  = "password"
+	tcPAUM      = "ampw_1234567890"
 )
 
 func providerFactories(p **schema.Provider) map[string]func() (*schema.Provider, error) {
@@ -145,15 +140,23 @@ provider "boundary" {
 func testConfigWithoutAMPWCredentials(url string, res ...string) string {
 	provider := fmt.Sprintf(`
 provider "boundary" {
-	addr  = "%s"
-}`, url)
+	addr           = "%s"
+	auth_method_id = "%s"
+}`, url, tcPAUM)
 
 	c := []string{provider}
 	c = append(c, res...)
 	return strings.Join(c, "\n")
 }
 
-func testConfigWithRecovery(url string, res ...string) string {
+func testConfigWithRecovery(t *testing.T, url string, res ...string) string {
+	t.Helper()
+	cfg, err := loadTestConfig()
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	key := requireRecoveryKey(t, cfg)
 	provider := fmt.Sprintf(`
 provider "boundary" {
 	addr             = "%s"
@@ -161,24 +164,25 @@ provider "boundary" {
 	kms "aead" {
 		purpose = ["recovery", "config"]
 		aead_type = "aes-gcm"
-		key = "7xtkEoS5EXPbgynwd+dDLHopaCqK8cq0Rpep4eooaTs="
+		key = "%s"
 		key_id = "global_recovery"
 	}
 	DOC
-}`, url)
+}`, url, key)
 
 	c := []string{provider}
 	c = append(c, res...)
 	return strings.Join(c, "\n")
 }
 
-func testConfigWithLDAPAuthMethod(url string, loginName string, password string, res ...string) string {
+func testConfigWithLDAPAuthMethod(url string, scopeId string, loginName string, password string, res ...string) string {
 	provider := fmt.Sprintf(`
 provider "boundary" {
-	addr             = "%s"
+	addr                   = "%s"
+	scope_id               = "%s"
 	auth_method_login_name = "%s"
-	auth_method_password = "%s"
-}`, url, loginName, password)
+	auth_method_password   = "%s"
+}`, url, scopeId, loginName, password)
 
 	c := []string{provider}
 	c = append(c, res...)
@@ -208,49 +212,68 @@ func TestProvider(t *testing.T) {
 func TestConfigWithLdapAuthMethod(t *testing.T) {
 	td := createDefaultLdap(t)
 	defer td.Stop()
-	tc := controller.NewTestController(t, tcConfig...)
-	defer tc.Shutdown()
-	url := tc.ApiAddrs()[0]
+	cfg, err := loadTestConfig()
+	require.NoError(t, err)
+	url := cfg.BoundaryAddr
+	suffix := id.UniqueId()
 	ldapLoginName := "alice"
 	ldapPassword := "password"
 
 	createLdapAMConfig := fmt.Sprintf(testPrimaryAuthMethodLdap, td.Host(), td.Port(), testdirectory.DefaultUserDN, testdirectory.DefaultGroupDN)
 	createLdapAccountConfig := fmt.Sprintf(testProviderLdapAccountConfig, ldapLoginName)
 
+	// provider is set by providerFactories when resource.Test initialises.
+	// steps is declared as a var (slice = reference type) so step 1's Check can
+	// write the org scope ID into steps[1].Config before the framework reads it.
 	var provider *schema.Provider
+	var steps []resource.TestStep
+	steps = []resource.TestStep{
+		{
+			// Step 1: create LDAP auth method as primary for the org.
+			// Capture the org scope ID and write it into step 2's provider block.
+			Config: testConfig(url, fooOrg(suffix), createLdapAMConfig, createLdapAccountConfig),
+			Check: resource.ComposeTestCheckFunc(
+				resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapInsecureTlsField, "true"),
+				func(s *terraform.State) error {
+					rs, ok := s.RootModule().Resources["boundary_scope.org1"]
+					if !ok {
+						return fmt.Errorf("boundary_scope.org1 not found in state")
+					}
+					steps[1].Config = testConfigWithLDAPAuthMethod(url, rs.Primary.ID, ldapLoginName, ldapPassword, fooOrg(suffix), createLdapAMConfig, createLdapAccountConfig)
+					return nil
+				},
+			),
+		},
+		{
+			// Step 2: provider uses scope_id=org1 to auto-discover the LDAP primary AM.
+			// Config is written by step 1's Check above; placeholder avoids empty-step error.
+			Config: testConfig(url, fooOrg(suffix), createLdapAMConfig, createLdapAccountConfig),
+			Check: resource.ComposeTestCheckFunc(
+				func(s *terraform.State) error { return testProviderTokenExists(provider)(s) },
+			),
+		},
+		{
+			// Step 3: switch back to password auth and verify it still works after
+			// LDAP was primary for the org.
+			Config: testConfig(url, fooOrg(suffix)),
+			Check: resource.ComposeTestCheckFunc(
+				func(s *terraform.State) error { return testProviderTokenExists(provider)(s) },
+			),
+		},
+	}
+
 	resource.Test(t, resource.TestCase{
 		ProviderFactories: providerFactories(&provider),
 		CheckDestroy:      testAccCheckAuthMethodResourceDestroy(t, provider, ldapAuthMethodType),
-		Steps: []resource.TestStep{
-			{
-				// create ldap auth method
-				Config: testConfig(url, fooOrg, createLdapAMConfig, createLdapAccountConfig),
-				Check: resource.ComposeTestCheckFunc(
-					resource.TestCheckResourceAttr("boundary_auth_method_ldap.test-ldap", authMethodLdapInsecureTlsField, "true"),
-				),
-			},
-			{
-				// authenticate with LDAP auth method and ensure auth token exists
-				Config: testConfigWithLDAPAuthMethod(url, ldapLoginName, ldapPassword, fooOrg, createLdapAMConfig, createLdapAccountConfig),
-				Check: resource.ComposeTestCheckFunc(
-					testProviderTokenExists(provider),
-				),
-			},
-			{
-				// check if authentication with password auth method works after
-				Config: testConfig(url, fooOrg),
-				Check: resource.ComposeTestCheckFunc(
-					testProviderTokenExists(provider),
-				),
-			},
-		},
+		Steps:             steps,
 	})
 }
 
 func TestConfigWithDefaultAuthMethod(t *testing.T) {
-	tc := controller.NewTestController(t, tcConfig...)
-	defer tc.Shutdown()
-	url := tc.ApiAddrs()[0]
+	cfg, err := loadTestConfig()
+	require.NoError(t, err)
+	url := cfg.BoundaryAddr
+	suffix := id.UniqueId()
 
 	var provider *schema.Provider
 	resource.Test(t, resource.TestCase{
@@ -259,7 +282,7 @@ func TestConfigWithDefaultAuthMethod(t *testing.T) {
 		CheckDestroy:      testAccCheckScopeResourceDestroy(t, provider),
 		Steps: []resource.TestStep{
 			{
-				Config: testConfigWithDefaultAuthMethod(url, fooOrg, firstProjectFoo, secondProject),
+				Config: testConfigWithDefaultAuthMethod(url, fooOrg(suffix), firstProjectFoo, secondProject),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckScopeResourceExists(provider, "boundary_scope.org1"),
 					testProviderTokenExists(provider),
@@ -270,9 +293,10 @@ func TestConfigWithDefaultAuthMethod(t *testing.T) {
 }
 
 func TestConfigWithDeprecatedAuthMethod(t *testing.T) {
-	tc := controller.NewTestController(t, tcConfig...)
-	defer tc.Shutdown()
-	url := tc.ApiAddrs()[0]
+	cfg, err := loadTestConfig()
+	require.NoError(t, err)
+	url := cfg.BoundaryAddr
+	suffix := id.UniqueId()
 
 	var provider *schema.Provider
 	resource.Test(t, resource.TestCase{
@@ -281,7 +305,7 @@ func TestConfigWithDeprecatedAuthMethod(t *testing.T) {
 		CheckDestroy:      testAccCheckScopeResourceDestroy(t, provider),
 		Steps: []resource.TestStep{
 			{
-				Config: testConfigWithDeprecatedAuthMethod(url, fooOrg, firstProjectFoo, secondProject),
+				Config: testConfigWithDeprecatedAuthMethod(url, fooOrg(suffix), firstProjectFoo, secondProject),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckScopeResourceExists(provider, "boundary_scope.org1"),
 					testProviderTokenExists(provider),
@@ -292,9 +316,10 @@ func TestConfigWithDeprecatedAuthMethod(t *testing.T) {
 }
 
 func TestConfigWithoutAMPWCredentials(t *testing.T) {
-	tc := controller.NewTestController(t, tcConfig...)
-	defer tc.Shutdown()
-	url := tc.ApiAddrs()[0]
+	cfg, err := loadTestConfig()
+	require.NoError(t, err)
+	url := cfg.BoundaryAddr
+	suffix := id.UniqueId()
 
 	var provider *schema.Provider
 	resource.Test(t, resource.TestCase{
@@ -302,7 +327,7 @@ func TestConfigWithoutAMPWCredentials(t *testing.T) {
 		ProviderFactories: providerFactories(&provider),
 		Steps: []resource.TestStep{
 			{
-				Config:      testConfigWithoutAMPWCredentials(url, fooOrg, firstProjectFoo, secondProject),
+				Config:      testConfigWithoutAMPWCredentials(url, fooOrg(suffix), firstProjectFoo, secondProject),
 				ExpectError: regexp.MustCompile("auth method login name not set, please set auth_method_login_name on the provider"),
 			},
 		},
@@ -310,9 +335,10 @@ func TestConfigWithoutAMPWCredentials(t *testing.T) {
 }
 
 func TestConfigWithOIDCAuthMethod(t *testing.T) {
-	tc := controller.NewTestController(t, tcConfig...)
-	defer tc.Shutdown()
-	url := tc.ApiAddrs()[0]
+	cfg, err := loadTestConfig()
+	require.NoError(t, err)
+	url := cfg.BoundaryAddr
+	suffix := id.UniqueId()
 
 	var provider *schema.Provider
 	resource.Test(t, resource.TestCase{
@@ -320,7 +346,7 @@ func TestConfigWithOIDCAuthMethod(t *testing.T) {
 		ProviderFactories: providerFactories(&provider),
 		Steps: []resource.TestStep{
 			{
-				Config:      testConfigWithOIDCAuthMethod(url, fooOrg, firstProjectFoo, secondProject),
+				Config:      testConfigWithOIDCAuthMethod(url, fooOrg(suffix), firstProjectFoo, secondProject),
 				ExpectError: regexp.MustCompile("OIDC auth method is currently not supported by Boundary Terraform Provider. only password auth method is supported at this time"),
 			},
 		},
@@ -330,12 +356,13 @@ func TestConfigWithOIDCAuthMethod(t *testing.T) {
 // Create OIDC auth method and set it as the primary auth method.
 // Attempt to authenticate with recovery to test checks for default auth method
 func TestRecoveryWithOIDCDefaultAuthMethod(t *testing.T) {
-	tp := oidc.StartTestProvider(t)
-	wrapper := testWrapper(context.Background(), t, tcRecoveryKey)
-	tc := controller.NewTestController(t, append(tcConfig, controller.WithRecoveryKms(wrapper))...)
-	defer tc.Shutdown()
-	url := tc.ApiAddrs()[0]
+	t.Skip("Unskip when we update boundary")
+	cfg, err := loadTestConfig()
+	require.NoError(t, err)
+	url := cfg.BoundaryAddr
+	suffix := id.UniqueId()
 
+	tp := oidc.StartTestProvider(t)
 	tpCert := strings.TrimSpace(tp.CACert())
 	createConfig := fmt.Sprintf(fooAuthMethodOidc, fooAuthMethodOidcDesc, tp.Addr(), tpCert)
 	updateConfig := fmt.Sprintf(fooAuthMethodOidcUpdate, fooAuthMethodOidcDescUpdate, fooAuthMethodOidcCaCerts)
@@ -347,7 +374,7 @@ func TestRecoveryWithOIDCDefaultAuthMethod(t *testing.T) {
 		Steps: []resource.TestStep{
 			{
 				// create auth method
-				Config: testConfig(url, fooOrg, createConfig),
+				Config: testConfig(url, fooOrg(suffix), createConfig),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr("boundary_auth_method_oidc.foo", "description", fooAuthMethodOidcDesc),
 					resource.TestCheckResourceAttr("boundary_auth_method_oidc.foo", "name", "test"),
@@ -357,7 +384,7 @@ func TestRecoveryWithOIDCDefaultAuthMethod(t *testing.T) {
 			importStep("boundary_auth_method_oidc.foo", "client_secret", "is_primary_for_scope"),
 			{
 				// set auth method as primary auth method
-				Config: testConfig(url, fooOrg, updateConfig),
+				Config: testConfig(url, fooOrg(suffix), updateConfig),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr("boundary_auth_method_oidc.foo", "name", "test"),
 					testAccIsPrimaryForScope(provider, "boundary_auth_method_oidc.foo", true),
@@ -365,7 +392,7 @@ func TestRecoveryWithOIDCDefaultAuthMethod(t *testing.T) {
 			},
 			{
 				// authenticate provider with recovery kms with unsupported OIDC primary auth method
-				Config: testConfigWithRecovery(url, fooOrg, updateConfig),
+				Config: testConfigWithRecovery(t, url, fooOrg(suffix), updateConfig),
 				Check: resource.ComposeTestCheckFunc(
 					resource.TestCheckResourceAttr("boundary_auth_method_oidc.foo", "name", "test"),
 					testAccIsPrimaryForScope(provider, "boundary_auth_method_oidc.foo", true),
@@ -387,7 +414,8 @@ func testProviderTokenExists(testProvider *schema.Provider) resource.TestCheckFu
 }
 
 func createDefaultLdap(t *testing.T) *testdirectory.Directory {
-	td := testdirectory.Start(t,
+	td := testdirectory.Start(
+		t,
 		testdirectory.WithDefaults(t, &testdirectory.Defaults{AllowAnonymousBind: true}),
 		testdirectory.WithNoTLS(t),
 	)
@@ -399,7 +427,8 @@ func createDefaultLdap(t *testing.T) *testdirectory.Directory {
 	users := testdirectory.NewUsers(t, []string{"alice"}, testdirectory.WithMembersOf(t, "admin"))
 
 	for _, u := range users {
-		u.Attributes = append(u.Attributes,
+		u.Attributes = append(
+			u.Attributes,
 			gldap.NewEntryAttribute(ldap.DefaultADUserPasswordAttribute, []string{"password"}),
 			gldap.NewEntryAttribute(ldap.DefaultOpenLDAPUserPasswordAttribute, []string{"password"}),
 			gldap.NewEntryAttribute("fullName", []string{"test-full-name"}),