Resolve dependencies against published threshold sdk v0.1.0

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Rename module and SDK import paths for Threshold
2026-10-12 10:35:52 -07:00 · 2026-10-12 10:28:02 -07:00 · 2026-10-01 14:56:23 -04:00 · 2026-10-01 14:53:24 -04:00 · 2026-05-11 22:38:19 -07:00 · 2026-04-22 21:11:07 -07:00
18 changed files with 1751 additions and 425 deletions
@@ -0,0 +1,11 @@
+## PCI review checklist
+
+<!-- heimdall_github_prtemplate:grc-pci_dss-2024-01-05 -->
+
+- [ ] I have documented a clear reason for, and description of, the change I am making.
+
+- [ ] If applicable, I've documented a plan to revert these changes if they require more than reverting the pull request.
+
+- [ ] If applicable, I've documented the impact of any changes to security controls.
+
+  Examples of changes to security controls include using new access control methods, adding or removing logging pipelines, etc.
@@ -16,3 +16,6 @@

 # Test credentials and other items
 /plugin/private*
+
+# vscode settings
+.vscode
@@ -1,4 +1,4 @@
 # These owners will be the default owners for everything in
 # the repo, unless a later match takes precedence.

-@hashicorp/boundary
+* @hashicorp/boundary
@@ -1,4 +1,4 @@
-Copyright (c) 2021 HashiCorp, Inc.
+Copyright IBM Corp. 2021, 2026

 Mozilla Public License Version 2.0
 ==================================
@@ -0,0 +1,9 @@
+This repository is a community fork of hashicorp/boundary-plugin-azure
+(https://github.com/hashicorp/boundary-plugin-azure), maintained for Threshold.
+
+The original work is licensed under the Mozilla Public License 2.0 (see LICENSE).
+Original copyright IBM Corp. / HashiCorp, Inc. is retained in all source file
+headers and in LICENSE. Modifications are limited to the Go module path and the
+import paths of the Boundary SDK/API packages.
+
+This fork is not affiliated with, endorsed by, or supported by HashiCorp or IBM.
@@ -1,12 +1,21 @@
+## About this fork
+
+This is a community fork of
+[hashicorp/boundary-plugin-azure](https://github.com/hashicorp/boundary-plugin-azure)
+for use with Threshold. It is licensed under the MPL-2.0 (see `LICENSE`), and
+the original copyright notices are retained. It is not affiliated with,
+endorsed by, or supported by HashiCorp or IBM. Changes from upstream are limited
+to the Go module path and SDK import paths; see `NOTICE`.
+
 # Azure Host Plugin for HashiCorp Boundary

 This repo contains a Host-type plugin for [HashiCorp
 Boundary](https://www.boundaryproject.io/) allowing dynamically sourcing hosts
 from Azure.

-Host sets created with this plugin define filters which select and group like VM
-resources within Azure; these host sets can in turn be added to targets within
-Boundary as host sources.
+Host sets created with this plugin define filters which select and group Virtual Machines 
+and Virtual Machine instances enscapsulated in both Flexible and Uniform Virtual Machine Scale Sets. 
+These host sets can in turn be added to targets within Boundary as host sources.

 At creation or update of a host catalog of this type, configuration of the
 plugin is performed via the attribute/secret values passed to the create or
@@ -15,8 +24,6 @@ are indicated below with the valid fields.

 Current limitations of this plugin:

- Only VMs can be added to host sets through this plugin, not any other type of
-  compute resource
 - A client secret must be generated against a registered application with any
  necessary permissions
 - For now, credential rotation must be disabled using the `disable_credential_rotation`
@@ -76,7 +83,7 @@ The following attributes are valid on an Azure host Set resource:

 ## Filters

-Azure Resource Manager is used to find matching VMs before their details are
+Azure Resource Manager is used to find matching VMs and VM Scale Sets before their details are
 looked up. There are some limitations with the filtering syntax; specifically,
 when using tags, other types of filters (such as on resource type) are not
 allowed. As a result, it will generally be useful to filter directly on tag
@@ -1,19 +1,20 @@
-module github.com/hashicorp/boundary-plugin-azure
+module repo.anhonesthost.net/CyberCoveLLC/threshold-plugin-azure

-go 1.18
+go 1.26.9

 require (
 	github.com/Azure/azure-sdk-for-go v66.0.0+incompatible
 	github.com/Azure/go-autorest/autorest v0.11.28
 	github.com/Azure/go-autorest/autorest/azure/auth v0.5.11
-	github.com/hashicorp/boundary/sdk v0.0.31
-	github.com/hashicorp/go-secure-stdlib/parseutil v0.1.7
+	github.com/hashicorp/go-secure-stdlib/parseutil v0.2.0
 	github.com/kr/pretty v0.3.0
 	github.com/manicminer/hamilton v0.46.0
 	github.com/mitchellh/mapstructure v1.5.0
-	github.com/stretchr/testify v1.8.2
-	google.golang.org/grpc v1.56.3
-	google.golang.org/protobuf v1.33.0
+	github.com/stretchr/testify v1.11.1
+	golang.org/x/sync v0.23.0
+	google.golang.org/grpc v1.85.0-dev.0.20260825072537-93e31b48545e
+	google.golang.org/protobuf v1.36.12
+	repo.anhonesthost.net/CyberCoveLLC/threshold/sdk v0.1.0
 )

 require (
@@ -27,17 +28,16 @@ require (
 	github.com/Azure/go-autorest/tracing v0.6.0 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/dimchansky/utfbom v1.1.1 // indirect
-	github.com/golang-jwt/jwt/v4 v4.2.0 // indirect
-	github.com/golang/protobuf v1.5.3 // indirect
+	github.com/golang-jwt/jwt/v4 v4.5.2 // indirect
 	github.com/hashicorp/errwrap v1.1.0 // indirect
-	github.com/hashicorp/eventlogger v0.1.2-0.20230227112545-f26a3bdf6871 // indirect
-	github.com/hashicorp/eventlogger/filters/encrypt v0.1.8-0.20230227112545-f26a3bdf6871 // indirect
+	github.com/hashicorp/eventlogger v0.2.11 // indirect
+	github.com/hashicorp/eventlogger/filters/encrypt v0.1.8-0.20231025104552-802587e608f0 // indirect
 	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
-	github.com/hashicorp/go-kms-wrapping/v2 v2.0.9-0.20230228185604-529de2006180 // indirect
+	github.com/hashicorp/go-kms-wrapping/v2 v2.0.20 // indirect
 	github.com/hashicorp/go-multierror v1.1.1 // indirect
 	github.com/hashicorp/go-retryablehttp v0.7.7 // indirect
 	github.com/hashicorp/go-secure-stdlib/strutil v0.1.2 // indirect
-	github.com/hashicorp/go-sockaddr v1.0.2 // indirect
+	github.com/hashicorp/go-sockaddr v1.0.7 // indirect
 	github.com/hashicorp/go-uuid v1.0.3 // indirect
 	github.com/hashicorp/go-version v1.3.0 // indirect
 	github.com/kr/text v0.2.0 // indirect
@@ -46,14 +46,13 @@ require (
 	github.com/mitchellh/pointerstructure v1.2.1 // indirect
 	github.com/mitchellh/reflectwalk v1.0.2 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
-	github.com/rogpeppe/go-internal v1.6.2 // indirect
+	github.com/rogpeppe/go-internal v1.9.0 // indirect
 	github.com/ryanuber/go-glob v1.0.0 // indirect
-	golang.org/x/crypto v0.21.0 // indirect
-	golang.org/x/net v0.23.0 // indirect
-	golang.org/x/oauth2 v0.7.0 // indirect
-	golang.org/x/sys v0.20.0 // indirect
-	golang.org/x/text v0.14.0 // indirect
-	google.golang.org/appengine v1.6.7 // indirect
+	golang.org/x/crypto v0.57.0 // indirect
+	golang.org/x/net v0.60.0 // indirect
+	golang.org/x/oauth2 v0.36.0 // indirect
+	golang.org/x/sys v0.48.0 // indirect
+	golang.org/x/text v0.42.0 // indirect
 	google.golang.org/genproto v0.0.0-20230410155749-daa745c078e1 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 )
@@ -60,10 +60,13 @@ github.com/Azure/go-autorest/tracing v0.6.0/go.mod h1:+vhtPC754Xsa23ID7GlGsrdKBp
 github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
 github.com/BurntSushi/xgb v0.0.0-20160522181843-27f122750802/go.mod h1:IVnqGOEym/WlBOVXweHU+Q+/VP0lqqI8lqeDx9IjBqo=
 github.com/Masterminds/goutils v1.1.1 h1:5nUrii3FMTL5diU80unEVvNevw1nH4+ZV4DSLVJLSYI=
+github.com/Masterminds/goutils v1.1.1/go.mod h1:8cTjp+g8YejhMuvIA5y2vz3BpJxksy863GQaJW2MFNU=
 github.com/Masterminds/semver/v3 v3.2.0 h1:3MEsd0SM6jqZojhjLWWeBY+Kcjy9i6MQAeY7YgDP83g=
+github.com/Masterminds/semver/v3 v3.2.0/go.mod h1:qvl/7zhW3nngYb5+80sSMF+FG2BjYrf8m9wsX0PNOMQ=
 github.com/Masterminds/sprig/v3 v3.2.3 h1:eL2fZNezLomi0uOLqjQoN6BfsDD+fyLtgbJMAj9n6YA=
-github.com/armon/go-radix v0.0.0-20180808171621-7fddfc383310/go.mod h1:ufUuZ+zHj4x4TnLV4JWEpy2hxWSpsRywHrMgIH9cCH8=
+github.com/Masterminds/sprig/v3 v3.2.3/go.mod h1:rXcFaZ2zZbLRJv/xSysmlgIM1u11eBaRMhvYXJNkGuM=
 github.com/armon/go-radix v1.0.0 h1:F4z6KzEeeQIMeLFa97iZU6vupzoecKdU5TX24SNppXI=
+github.com/armon/go-radix v1.0.0/go.mod h1:ufUuZ+zHj4x4TnLV4JWEpy2hxWSpsRywHrMgIH9cCH8=
 github.com/bgentry/speakeasy v0.1.0 h1:ByYyxL9InA1OWqxJqqp2A5pYHUrCiAL6K3J+LKSsQkY=
 github.com/bgentry/speakeasy v0.1.0/go.mod h1:+zsyZBPWlz7T6j88CTgSN5bM796AkVf0kBD4zp0CCIs=
 github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
@@ -82,16 +85,17 @@ github.com/envoyproxy/go-control-plane v0.9.0/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymF
 github.com/envoyproxy/go-control-plane v0.9.1-0.20191026205805-5f8ba28d4473/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
 github.com/envoyproxy/go-control-plane v0.9.4/go.mod h1:6rpuAdCZL397s3pYoYcLgu1mIlRU8Am5FuJP05cCM98=
 github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
-github.com/fatih/color v1.7.0/go.mod h1:Zm6kSWBoL9eyXnKyktHP6abPY2pDugNf5KwzbycvMj4=
-github.com/fatih/color v1.16.0 h1:zmkK9Ngbjj+K0yRhTVONQh1p/HknKYSlNT+vZCzyokM=
+github.com/fatih/color v1.18.0 h1:S8gINlzdQ840/4pfAwic/ZE0djQEH3wM94VfqLTZcOM=
+github.com/fatih/color v1.18.0/go.mod h1:4FelSpRwEGDpQ12mAdzqdOukCy4u8WUtOY6lkT/6HfU=
 github.com/go-gl/glfw v0.0.0-20190409004039-e6da0acd62b1/go.mod h1:vR7hzQXu2zJy9AVAgeJqvqgH9Q5CA+iKCZ2gyEVpxRU=
 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20191125211704-12ad95a8df72/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20200222043503-6f7a984d4dc4/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
-github.com/go-test/deep v1.0.4 h1:u2CU3YKy9I2pmu9pX0eq50wCgjfGIt539SqR7FbHiho=
-github.com/go-test/deep v1.0.4/go.mod h1:wGDj63lr65AM2AQyKZd/NYHGb0R+1RLqB8NKt3aSFNA=
+github.com/go-test/deep v1.1.1 h1:0r/53hagsehfO4bzD2Pgr/+RgHqhmf+k1Bpse2cTu1U=
+github.com/go-test/deep v1.1.1/go.mod h1:5C2ZWiW0ErCdrYzpqxLbTX7MG14M9iiw8DgHncVwcsE=
 github.com/golang-jwt/jwt/v4 v4.0.0/go.mod h1:/xlHOz8bRuivTWchD4jCa+NbatV+wEUSzwAxVc6locg=
-github.com/golang-jwt/jwt/v4 v4.2.0 h1:besgBTC8w8HjP6NzQdxwKH9Z5oQMZ24ThTrHp3cZ8eU=
 github.com/golang-jwt/jwt/v4 v4.2.0/go.mod h1:/xlHOz8bRuivTWchD4jCa+NbatV+wEUSzwAxVc6locg=
+github.com/golang-jwt/jwt/v4 v4.5.2 h1:YtQM7lnr8iZ+j5q71MGKkNw9Mn7AjHM68uc9g5fXeUI=
+github.com/golang-jwt/jwt/v4 v4.5.2/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w39/MY0Ch0=
 github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
 github.com/golang/groupcache v0.0.0-20190702054246-869f871628b6/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
 github.com/golang/groupcache v0.0.0-20191227052852-215e87163ea7/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
@@ -118,8 +122,8 @@ github.com/golang/protobuf v1.4.1/go.mod h1:U8fpvMrcmy5pZrNK1lt4xCsGvpyWQ/VVv6QD
 github.com/golang/protobuf v1.4.2/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
 github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk=
 github.com/golang/protobuf v1.5.2/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
-github.com/golang/protobuf v1.5.3 h1:KhyjKVUg7Usr/dYsdSqoFveMYd5ko72D+zANwlG1mmg=
-github.com/golang/protobuf v1.5.3/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
+github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
+github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
 github.com/google/btree v0.0.0-20180813153112-4030bb1f1f0c/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
 github.com/google/btree v1.0.0/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
 github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5aqRK0M=
@@ -129,9 +133,9 @@ github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/
 github.com/google/go-cmp v0.4.1/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.1/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.4/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.9 h1:O2Tfq5qg4qc4AmwVlvv0oLiVAGB7enBSJ2x2DqQFi38=
+github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
+github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
 github.com/google/martian v2.1.0+incompatible/go.mod h1:9I4somxYTbIHy5NJKHRl3wXiIaQGbYVAs8BPL6v8lEs=
 github.com/google/martian/v3 v3.0.0/go.mod h1:y5Zk1BBys9G+gd6Jrk0W3cC1+ELVxBWuIGO+w/tUAp0=
 github.com/google/pprof v0.0.0-20181206194817-3ea8567a2e57/go.mod h1:zfwlbNMJ+OItoe0UupaVj+oy1omPYYDuagoSzA8v9mc=
@@ -142,47 +146,54 @@ github.com/google/pprof v0.0.0-20200229191704-1ebb73c60ed3/go.mod h1:ZgVRPoUq/hf
 github.com/google/pprof v0.0.0-20200430221834-fc25d7d30c6d/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
 github.com/google/pprof v0.0.0-20200708004538-1a94d8640e99/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
 github.com/google/renameio v0.1.0/go.mod h1:KWCgfxg9yswjAJkECMjeO8J8rahYeXnNhOm40UhjYkI=
-github.com/google/uuid v1.3.0 h1:t6JiXgmwXMjEs8VusXIJk2BXHsn+wx8BZdTaoZ5fu7I=
+github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
+github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/googleapis/gax-go/v2 v2.0.4/go.mod h1:0Wqv26UfaUD9n4G6kQubkQ+KchISgw+vpHVxEJEs9eg=
 github.com/googleapis/gax-go/v2 v2.0.5/go.mod h1:DWXyrwAJ9X0FpwwEdw+IPEYBICEFu5mhpdKc/us6bOk=
-github.com/hashicorp/boundary/sdk v0.0.31 h1:KAPWpic7UFSUc/V4BDOVmXBYtSbSHKwAVrDXA8u/CxE=
-github.com/hashicorp/boundary/sdk v0.0.31/go.mod h1:6SNSerq1eWX35xsC2NE3VLmFzMjsllCbaVXE7dsueaI=
+github.com/hashicorp/cli v1.1.7 h1:/fZJ+hNdwfTSfsxMBa9WWMlfjUZbX8/LnUxgAd7lCVU=
+github.com/hashicorp/cli v1.1.7/go.mod h1:e6Mfpga9OCT1vqzFuoGZiiF/KaG9CbUfO5s3ghU3YgU=
 github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
 github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I=
 github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
-github.com/hashicorp/eventlogger v0.1.2-0.20230227112545-f26a3bdf6871 h1:F5Q9e2zB5xxItZKb7PI3+DVRHajMyVXnulBgbnQqcDU=
-github.com/hashicorp/eventlogger v0.1.2-0.20230227112545-f26a3bdf6871/go.mod h1://CHt6/j+Q2lc0NlUB5af4aS2M0c0aVBg9/JfcpAyhM=
-github.com/hashicorp/eventlogger/filters/encrypt v0.1.8-0.20230227112545-f26a3bdf6871 h1:PETLEST31DMXHOibJLl/nvcc5Tz4mo6eaXdCxT+lebQ=
-github.com/hashicorp/eventlogger/filters/encrypt v0.1.8-0.20230227112545-f26a3bdf6871/go.mod h1:EQPLoX6CONA9BSYUovTQBHfPGE91g7wOxv03sO29FzY=
+github.com/hashicorp/eventlogger v0.2.11 h1:lkK8ARM/DrCeL5deH2yVS6p40337dESi+77p9pIfLqo=
+github.com/hashicorp/eventlogger v0.2.11/go.mod h1:Rmc3MEopz7jUnLokZVTWAsXaEP5rqd20ObGS+pcau3U=
+github.com/hashicorp/eventlogger/filters/encrypt v0.1.8-0.20231025104552-802587e608f0 h1:iAb287bq0TaWTnhDYuN/zVqdD2EwanQg9ncVelC60Xc=
+github.com/hashicorp/eventlogger/filters/encrypt v0.1.8-0.20231025104552-802587e608f0/go.mod h1:tMywUTIvdB/FXhwm6HMTt61C8/eODY6gitCHhXtyojg=
 github.com/hashicorp/go-cleanhttp v0.5.1/go.mod h1:JpRdi6/HCYpAwUzNwuwqhbovhLtngrth3wmdIIUrZ80=
 github.com/hashicorp/go-cleanhttp v0.5.2 h1:035FKYIWjmULyFRBKPs8TBQoi0x6d9G4xc9neXJWAZQ=
 github.com/hashicorp/go-cleanhttp v0.5.2/go.mod h1:kO/YDlP8L1346E6Sodw+PrpBSV4/SoxCXGY6BqNFT48=
 github.com/hashicorp/go-hclog v0.9.2/go.mod h1:5CU+agLiy3J7N7QjHK5d05KxGsuXiQLrjA0H7acj2lQ=
 github.com/hashicorp/go-hclog v1.6.3 h1:Qr2kF+eVWjTiYmU7Y31tYlP1h0q/X3Nl3tPGdaB11/k=
-github.com/hashicorp/go-kms-wrapping/plugin/v2 v2.0.4-0.20230228185604-529de2006180 h1:IiTnT/t7PXQjGGm9PW9IfvSohCG+pY2hsttdMsgNm9g=
-github.com/hashicorp/go-kms-wrapping/v2 v2.0.9-0.20230228185604-529de2006180 h1:HtAdVRTzteZYPBGPNpi3M6+EaCWFicoHr7DZwz5kNtk=
-github.com/hashicorp/go-kms-wrapping/v2 v2.0.9-0.20230228185604-529de2006180/go.mod h1:iRHxwFG8L24HhemSuvDYtuwVkjkl+OkTLvQ5bmqzAqE=
-github.com/hashicorp/go-multierror v1.0.0/go.mod h1:dHtQlpGsu+cZNNAkkCN/P3hoUDHhCYQXV3UM06sGGrk=
+github.com/hashicorp/go-hclog v1.6.3/go.mod h1:W4Qnvbt70Wk/zYJryRzDRU/4r0kIg0PVHBcfoyhpF5M=
+github.com/hashicorp/go-kms-wrapping/plugin/v2 v2.0.8 h1:/GIUjn9GkFXMk/8/irRdbdtmx8CcyeyWdVy/E5LvzyA=
+github.com/hashicorp/go-kms-wrapping/plugin/v2 v2.0.8/go.mod h1:JDc9UOD4EVRDIwPVethJcT5Ibi/Nas6eQDPtA60iwP0=
+github.com/hashicorp/go-kms-wrapping/v2 v2.0.20 h1:afreZ1WJd0WI7v4NsMZ1aL7V/T59sxPuKmQDgGUja20=
+github.com/hashicorp/go-kms-wrapping/v2 v2.0.20/go.mod h1:NeK2Ul15t1zutp/dZzt28XQrGZHosbxE/QLNNfaWObM=
 github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo=
 github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
-github.com/hashicorp/go-plugin v1.4.9 h1:ESiK220/qE0aGxWdzKIvRH69iLiuN/PjoLTm69RoWtU=
+github.com/hashicorp/go-plugin v1.7.0 h1:YghfQH/0QmPNc/AZMTFE3ac8fipZyZECHdDPshfk+mA=
+github.com/hashicorp/go-plugin v1.7.0/go.mod h1:BExt6KEaIYx804z8k4gRzRLEvxKVb+kn0NMcihqOqb8=
 github.com/hashicorp/go-retryablehttp v0.7.0/go.mod h1:vAew36LZh98gCBJNLH42IQ1ER/9wtLZZ8meHqQvEYWY=
 github.com/hashicorp/go-retryablehttp v0.7.7 h1:C8hUCYzor8PIfXHa4UrZkU4VvK8o9ISHxT2Q8+VepXU=
 github.com/hashicorp/go-retryablehttp v0.7.7/go.mod h1:pkQpWZeYWskR+D1tR2O5OcBFOxfA7DoAO6xtkuQnHTk=
-github.com/hashicorp/go-secure-stdlib/base62 v0.1.1/go.mod h1:EdWO6czbmthiwZ3/PUsDV+UD1D5IRU4ActiaWGwt0Yw=
 github.com/hashicorp/go-secure-stdlib/base62 v0.1.2 h1:ET4pqyjiGmY09R5y+rSd70J2w45CtbWDNvGqWp/R3Ng=
-github.com/hashicorp/go-secure-stdlib/configutil/v2 v2.0.7 h1:b1VFIL6LpAh7iVCoQdoZtXAHqfAClpGsESfZULhfGm0=
-github.com/hashicorp/go-secure-stdlib/listenerutil v0.1.5 h1:+vfyObZczNFbpGxHJWTZ+ZdTEF9boRal5rAkwKTc2yg=
-github.com/hashicorp/go-secure-stdlib/parseutil v0.1.7 h1:UpiO20jno/eV1eVZcxqWnUohyKRe1g8FPV/xH1s/2qs=
-github.com/hashicorp/go-secure-stdlib/parseutil v0.1.7/go.mod h1:QmrqtbKuxxSWTN3ETMPuB+VtEiBJ/A9XhoYGv8E1uD8=
-github.com/hashicorp/go-secure-stdlib/pluginutil/v2 v2.0.3 h1:2RnQ/iL17y9FIwGR+ZaPj7fMn2uzdZT+T5ptCi97q8c=
+github.com/hashicorp/go-secure-stdlib/base62 v0.1.2/go.mod h1:EdWO6czbmthiwZ3/PUsDV+UD1D5IRU4ActiaWGwt0Yw=
+github.com/hashicorp/go-secure-stdlib/configutil/v2 v2.0.13 h1:TayxZ5drfMP0G6T++WvnLESGLOWeHtdWDWWTAi2e3Qk=
+github.com/hashicorp/go-secure-stdlib/configutil/v2 v2.0.13/go.mod h1:NDRQ/F3DXTylqjORAP0cA+puH/JFrLlT+NlqxHK2/e8=
+github.com/hashicorp/go-secure-stdlib/listenerutil v0.1.10 h1:2iDz+t0JLl1W0tJhvmhsh/UBgT1JgC8Qxz8HxYMWXQo=
+github.com/hashicorp/go-secure-stdlib/listenerutil v0.1.10/go.mod h1:eZkXE+osawMrAWR4wJRmyKauUwH6mNGbjFuiDujnbPk=
+github.com/hashicorp/go-secure-stdlib/parseutil v0.2.0 h1:U+kC2dOhMFQctRfhK0gRctKAPTloZdMU5ZJxaesJ/VM=
+github.com/hashicorp/go-secure-stdlib/parseutil v0.2.0/go.mod h1:Ll013mhdmsVDuoIXVfBtvgGJsXDYkTw1kooNcoCXuE0=
+github.com/hashicorp/go-secure-stdlib/pluginutil/v2 v2.0.8 h1:pgSicufBI+MvaIG9Keykb3k9B3sWtDNjmsoyrl2/8Qw=
+github.com/hashicorp/go-secure-stdlib/pluginutil/v2 v2.0.8/go.mod h1:sBcjk+paCXCMR9HHLcrYSfPz2FsskD8MQuotKiyM2aA=
 github.com/hashicorp/go-secure-stdlib/reloadutil v0.1.1 h1:SMGUnbpAcat8rIKHkBPjfv81yC46a8eCNZ2hsR2l1EI=
-github.com/hashicorp/go-secure-stdlib/strutil v0.1.1/go.mod h1:gKOamz3EwoIoJq7mlMIRBpVTAUn8qPCrEclOKKWhD3U=
+github.com/hashicorp/go-secure-stdlib/reloadutil v0.1.1/go.mod h1:Ch/bf00Qnx77MZd49JRgHYqHQjtEmTgGU2faufpVZb0=
 github.com/hashicorp/go-secure-stdlib/strutil v0.1.2 h1:kes8mmyCpxJsI7FTwtzRqEy9CdjCtrXrXGuOpxEA7Ts=
 github.com/hashicorp/go-secure-stdlib/strutil v0.1.2/go.mod h1:Gou2R9+il93BqX25LAKCLuM+y9U2T4hlwvT1yprcna4=
-github.com/hashicorp/go-secure-stdlib/tlsutil v0.1.2 h1:phcbL8urUzF/kxA/Oj6awENaRwfWsjP59GW7u2qlDyY=
-github.com/hashicorp/go-sockaddr v1.0.2 h1:ztczhD1jLxIRjVejw8gFomI1BQZOe2WoVOu0SyteCQc=
-github.com/hashicorp/go-sockaddr v1.0.2/go.mod h1:rB4wwRAUzs07qva3c5SdrY/NEtAUjGlgmH/UkBUC97A=
+github.com/hashicorp/go-secure-stdlib/tlsutil v0.1.3 h1:xbrxd0U9XQW8qL1BAz2XrAjAF/P2vcqUTAues9c24B8=
+github.com/hashicorp/go-secure-stdlib/tlsutil v0.1.3/go.mod h1:LWq2Sy8UoKKuK4lFuCNWSjJj57MhNNf2zzBWMtkAIX4=
+github.com/hashicorp/go-sockaddr v1.0.7 h1:G+pTkSO01HpR5qCxg7lxfsFEZaG+C0VssTy/9dbT+Fw=
+github.com/hashicorp/go-sockaddr v1.0.7/go.mod h1:FZQbEYa1pxkQ7WLpyXJ6cbjpT8q0YgQaK/JakXqGyWw=
 github.com/hashicorp/go-uuid v1.0.2/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
 github.com/hashicorp/go-uuid v1.0.3 h1:2gKiV6YVmrJ1i2CKKa9obLvRieoRGviZFL26PcT/Co8=
 github.com/hashicorp/go-uuid v1.0.3/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
@@ -191,16 +202,20 @@ github.com/hashicorp/go-version v1.3.0/go.mod h1:fltr4n8CU8Ke44wwGCBoEymUuxUHl09
 github.com/hashicorp/golang-lru v0.5.0/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
 github.com/hashicorp/golang-lru v0.5.1/go.mod h1:/m3WP610KZHVQ1SGc6re/UDhFvYD7pJ4Ao+sR/qLZy8=
 github.com/hashicorp/hcl v1.0.0 h1:0Anlzjpi4vEasTeNFn2mLJgTSwt0+6sfsiTG8qcWGx4=
-github.com/hashicorp/yamux v0.1.1 h1:yrQxtgseBDrq9Y652vSRDvsKCJKOUD+GzTS4Y0Y8pvE=
+github.com/hashicorp/hcl v1.0.0/go.mod h1:E5yfLk+7swimpb2L/Alb/PJmXilQ/rhwaUYs4T20WEQ=
+github.com/hashicorp/yamux v0.1.2 h1:XtB8kyFOyHXYVFnwT5C3+Bdo8gArse7j2AQ0DA0Uey8=
+github.com/hashicorp/yamux v0.1.2/go.mod h1:C+zze2n6e/7wshOZep2A70/aQU6QBRWJO/G6FT1wIns=
 github.com/huandu/xstrings v1.4.0 h1:D17IlohoQq4UcpqD7fDk80P7l+lwAmlFaBHgOipl2FU=
+github.com/huandu/xstrings v1.4.0/go.mod h1:y5/lhBue+AyNmUVz9RLU9xbLR0o4KIIExikq4ovT0aE=
 github.com/ianlancetaylor/demangle v0.0.0-20181102032728-5e5cf60278f6/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc=
 github.com/imdario/mergo v0.3.13 h1:lFzP57bqS/wsqKssCGmtLAb8A0wKjLGrve2q3PPVcBk=
+github.com/imdario/mergo v0.3.13/go.mod h1:4lJ1jqUDcsbIECGy0RUJAXNIhg+6ocWgb1ALK2O4oXg=
 github.com/jefferai/isbadcipher v0.0.0-20190226160619-51d2077c035f h1:E87tDTVS5W65euzixn7clSzK66puSt1H4I5SC0EmHH4=
+github.com/jefferai/isbadcipher v0.0.0-20190226160619-51d2077c035f/go.mod h1:3J2qVK16Lq8V+wfiL2lPeDZ7UWMxk5LemerHa1p6N00=
 github.com/jstemmer/go-junit-report v0.0.0-20190106144839-af01ea7f8024/go.mod h1:6v2b51hI/fHJwM22ozAgKL4VKDeJcHhJFhtBdhmNjmU=
 github.com/jstemmer/go-junit-report v0.9.1/go.mod h1:Brl9GWCQeLvo8nXZwPNNblvFj/XSXhF0NWZEnDohbsk=
 github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
 github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
-github.com/kr/pretty v0.2.0/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
 github.com/kr/pretty v0.3.0 h1:WgNl7dwNpEZ6jJ9k1snq4pZsg7DOEN8hP9Xw0Tsjwk0=
 github.com/kr/pretty v0.3.0/go.mod h1:640gp4NfQd8pI5XOwp5fnNeVWj67G7CFk/SaSQn7NBk=
 github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
@@ -209,18 +224,14 @@ github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
 github.com/manicminer/hamilton v0.46.0 h1:ag0xqWnALt9uQSfrrrXuQvm6puV8y+LghJQD32lzW+M=
 github.com/manicminer/hamilton v0.46.0/go.mod h1:lbVyngC+/nCWuDp8UhC6Bw+bh7jcP/E+YwqzHTmzemk=
-github.com/mattn/go-colorable v0.0.9/go.mod h1:9vuHe8Xs5qXnSaW/c/ABM9alt+Vo+STaOChaDxuIBZU=
-github.com/mattn/go-colorable v0.1.13 h1:fFA4WZxdEF4tXPZVKMLwD8oUnCTTo08duU7wxecdEvA=
-github.com/mattn/go-isatty v0.0.3/go.mod h1:M+lRXTBqGeGNdLjl/ufCoiOlB5xdOkqRJdNxMWT7Zi4=
+github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE=
+github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
 github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
-github.com/mitchellh/cli v1.0.0/go.mod h1:hNIlj7HEI86fIcpObd7a0FcrxTWetlwJDGcceTlRvqc=
-github.com/mitchellh/cli v1.1.5 h1:OxRIeJXpAMztws/XHlN2vu6imG5Dpq+j61AzAX5fLng=
+github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
 github.com/mitchellh/copystructure v1.2.0 h1:vpKXTN4ewci03Vljg/q9QvCGUDttBOGBIa15WveJJGw=
 github.com/mitchellh/copystructure v1.2.0/go.mod h1:qLl+cE2AmVv+CoeAwDPye/v+N2HKCj9FbZEVFJRxO9s=
 github.com/mitchellh/go-homedir v1.1.0 h1:lukF9ziXFxDFPkA1vsr5zpc1XuPDn/wFntq5mG+4E0Y=
 github.com/mitchellh/go-homedir v1.1.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
-github.com/mitchellh/go-testing-interface v1.14.1 h1:jrgshOhYAUVNMAJiKbEu7EqAwgJJ2JqpQmpLJOu07cU=
-github.com/mitchellh/go-wordwrap v1.0.0/go.mod h1:ZXFpozHsX6DPmq2I0TCekCxypsnAUbP2oI0UX1GXzOo=
 github.com/mitchellh/mapstructure v1.4.1/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
 github.com/mitchellh/mapstructure v1.5.0 h1:jeMsZIYE/09sWLaz43PL7Gy6RuMjD2eJVyuac5Z2hdY=
 github.com/mitchellh/mapstructure v1.5.0/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
@@ -229,42 +240,38 @@ github.com/mitchellh/pointerstructure v1.2.1/go.mod h1:BRAsLI5zgXmw97Lf6s25bs8oh
 github.com/mitchellh/reflectwalk v1.0.2 h1:G2LzWKi524PWgd3mLHV8Y5k7s6XUvT0Gef6zxSIeXaQ=
 github.com/mitchellh/reflectwalk v1.0.2/go.mod h1:mSTlrgnPZtwu0c4WaC2kGObEpuNDbx0jmZXqmk4esnw=
 github.com/oklog/run v1.1.0 h1:GEenZ1cK0+q0+wsJew9qUg/DyD8k3JzYsZAi5gYi2mA=
+github.com/oklog/run v1.1.0/go.mod h1:sVPdnTZT1zYwAJeCMu2Th4T21pA3FPOQRfWjQlk7DVU=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/posener/complete v1.1.1/go.mod h1:em0nMJCgc9GFtwrmVmEMR/ZL6WyhyjMBndrE9hABlRI=
 github.com/posener/complete v1.2.3 h1:NP0eAhjcjImqslEwo/1hq7gpajME0fTLTezBKDqfXqo=
+github.com/posener/complete v1.2.3/go.mod h1:WZIdtGGp+qx0sLrYKtIRAruyNpv6hFCicSgv7Sy7s/s=
 github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
 github.com/rogpeppe/go-internal v1.3.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4=
 github.com/rogpeppe/go-internal v1.6.1/go.mod h1:xXDCJY+GAPziupqXw64V24skbSoqbTEfhy4qGm1nDQc=
-github.com/rogpeppe/go-internal v1.6.2 h1:aIihoIOHCiLZHxyoNQ+ABL4NKhFTgKLBdMLyEAh98m0=
-github.com/rogpeppe/go-internal v1.6.2/go.mod h1:xXDCJY+GAPziupqXw64V24skbSoqbTEfhy4qGm1nDQc=
-github.com/ryanuber/columnize v2.1.0+incompatible/go.mod h1:sm1tb6uqfes/u+d4ooFouqFdy9/2g9QGwK3SQygK0Ts=
+github.com/rogpeppe/go-internal v1.9.0 h1:73kH8U+JUqXU8lRuOHeVHaa/SZPifC7BkcraZVejAe8=
+github.com/rogpeppe/go-internal v1.9.0/go.mod h1:WtVeX8xhTBvf0smdhujwtBcq4Qrzq/fJaraNFVN+nFs=
 github.com/ryanuber/go-glob v1.0.0 h1:iQh3xXAumdQ+4Ufa5b25cRpC5TYKlno6hsv6Cb3pkBk=
 github.com/ryanuber/go-glob v1.0.0/go.mod h1:807d1WSdnB0XRJzKNil9Om6lcp/3a0v4qIHxIXzX/Yc=
 github.com/shopspring/decimal v1.3.1 h1:2Usl1nmF/WZucqkFZhnfFYxxxu8LG21F6nPQBE5gKV8=
+github.com/shopspring/decimal v1.3.1/go.mod h1:DKyhrW/HYNuLGql+MJL6WCR6knT2jwCFRcu2hWCYk4o=
 github.com/spf13/cast v1.5.0 h1:rj3WzYc11XZaIZMPKmwP96zkFEnnAmV8s6XbB2aY32w=
+github.com/spf13/cast v1.5.0/go.mod h1:SpXXQ5YoyJw6s3/6cMTQuxvgRl3PCJiyaX9p6b155UU=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
-github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
-github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
 github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
 github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
-github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
-github.com/stretchr/testify v1.8.2 h1:+h33VjcLVPDHtOdpUCuF+7gSuG3yGIftsP1YvFihtJ8=
-github.com/stretchr/testify v1.8.2/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
+github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
+github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
 github.com/yuin/goldmark v1.1.25/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.1.32/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
-github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 go.opencensus.io v0.21.0/go.mod h1:mSImk1erAIZhrmZN+AvHh14ztQfjbGwt4TtuofqLduU=
 go.opencensus.io v0.22.0/go.mod h1:+kGneAE2xo2IficOXnaByMWTGM9T73dGwxeWcUqIpI8=
 go.opencensus.io v0.22.2/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
 go.opencensus.io v0.22.3/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
 go.opencensus.io v0.22.4/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
-go.uber.org/goleak v1.0.0 h1:qsup4IcBdlmsnGfqyLl4Ntn3C2XCCuKAE7DwHpScyUo=
-go.uber.org/goleak v1.0.0/go.mod h1:8a7PlsEVH3e/a/GLqe5IIrQx6GzcnRmZEufDUTk4A7A=
+go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
+go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20190510104115-cbcb75029529/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20190605123033-f99c8df09eb5/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
@@ -273,8 +280,8 @@ golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPh
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.0.0-20211215153901-e495a2d5b3d3/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
 golang.org/x/crypto v0.0.0-20220722155217-630584e8d5aa/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
-golang.org/x/crypto v0.21.0 h1:X31++rzVUdKhX5sWmSOFZxx8UW/ldWx55cbf08iNAMA=
-golang.org/x/crypto v0.21.0/go.mod h1:0BP7YvVV9gBbVKyeTG0Gyn+gZm94bibOW5BjDEYAOMs=
+golang.org/x/crypto v0.57.0 h1:3ZVCjf8Ggz7zneR/EHRVx68Ctf+2pmIMP2UFhh9cC6M=
+golang.org/x/crypto v0.57.0/go.mod h1:Fdz0i5U6CoizGwLda9DttjSk6qlZo25zYNtR+ycvuZA=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8=
@@ -297,7 +304,6 @@ golang.org/x/lint v0.0.0-20190930215403-16217165b5de/go.mod h1:6SW0HCj/g11FgYtHl
 golang.org/x/lint v0.0.0-20191125180803-fdd1cda4f05f/go.mod h1:5qLYkcX4OjUUV8bRuDixDT3tpyyb+LUpUlRWLxfhWrs=
 golang.org/x/lint v0.0.0-20200130185559-910be7a94367/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
 golang.org/x/lint v0.0.0-20200302205851-738671d3881b/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
-golang.org/x/lint v0.0.0-20210508222113-6edffad5e616 h1:VLliZ0d+/avPrXXH+OakdXhpJuEoBZuwh1m2j7U6Iug=
 golang.org/x/mobile v0.0.0-20190312151609-d3739f865fa6/go.mod h1:z+o9i4GpDbdi3rU15maQ/Ox0txvL9dWGYEHz965HBQE=
 golang.org/x/mobile v0.0.0-20190719004257-d2bd2a29d028/go.mod h1:E/iHnbuqvinMTCcRqshq8CkpyQDoeVncDDYHnLhea+o=
 golang.org/x/mod v0.0.0-20190513183733-4bf6d317e70e/go.mod h1:mXi4GBBbnImb6dmsKGUJ2LatrhH/nqhxcFungHvyanc=
@@ -306,7 +312,6 @@ golang.org/x/mod v0.1.1-0.20191105210325-c90efee705ee/go.mod h1:QqPTAvyqsEbceGzB
 golang.org/x/mod v0.1.1-0.20191107180719-034126e5016b/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg=
 golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/mod v0.4.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190108225652-1e06a53dbb7e/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
@@ -333,19 +338,18 @@ golang.org/x/net v0.0.0-20200520182314-0ba52f642ac2/go.mod h1:qpuaurCH72eLCgpAm/
 golang.org/x/net v0.0.0-20200625001655-4c5254603344/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
 golang.org/x/net v0.0.0-20200707034311-ab3426394381/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
 golang.org/x/net v0.0.0-20200822124328-c89045814202/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
-golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
 golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
 golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
-golang.org/x/net v0.23.0 h1:7EYJ93RZ9vYSZAIb2x3lnuvqO5zneoD6IvWjuhfxjTs=
-golang.org/x/net v0.23.0/go.mod h1:JKghWKKOSdJwpW2GEx0Ja7fmaKnMsbu+MWVZTokSYmg=
+golang.org/x/net v0.60.0 h1:79p50tfZlm0J9YfoDsSi639qSXNGVwEzOPLCxM2FsYU=
+golang.org/x/net v0.60.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20191202225959-858c2ad4c8b6/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20200107190931-bf48bf16ab8d/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20210514164344-f6687ab2804c/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
-golang.org/x/oauth2 v0.7.0 h1:qe6s0zUXlPX80/dITx3440hWZ7GwMwgDDyrSGTPJG/g=
-golang.org/x/oauth2 v0.7.0/go.mod h1:hPLQkd9LyjfXTiRohC/41GhcFqxisoUQ99sCUOHO9x4=
+golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs=
+golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -354,8 +358,8 @@ golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJ
 golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20200317015054-43a5402ce75a/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20200625203802-6e8e738ad208/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sys v0.0.0-20180823144017-11551d06cbcc/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sync v0.23.0 h1:KameEIfc1IkluZyXWLn39Wd4tURc6GbCiISGiZm2bQk=
+golang.org/x/sync v0.23.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190312061237-fead79001313/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -381,12 +385,11 @@ golang.org/x/sys v0.0.0-20200511232937-7e40ca221e25/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20200515095857-1151b9dac4a9/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200523222454-059865788121/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200803210538-64077c9b5642/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.20.0 h1:Od9JTbYCk261bKm4M/mw7AklTlFYIa0bIp9BgSm1S8Y=
-golang.org/x/sys v0.20.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.48.0 h1:bbX/i/6MgT9BVLM9RT1thmxL04yeTAhbEz4SyadbXoo=
+golang.org/x/sys v0.48.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
@@ -394,8 +397,8 @@ golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3
 golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.14.0 h1:ScX5w1eTa3QqT8oi6+ziP7dTV1S2+ALU0bI+0zXKWiQ=
-golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
+golang.org/x/text v0.42.0 h1:JbOZXgfeCPU9gacVtYliJqOhD+zhrEqK4LfdpmlUZqI=
+golang.org/x/text v0.42.0/go.mod h1:ojzP1Z+2QtioaF8DTtO8K5q7JWVVYwZKenzujK0Zd0E=
 golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
@@ -414,7 +417,6 @@ golang.org/x/tools v0.0.0-20190628153133-6cdbf07be9d0/go.mod h1:/rFqwRUd4F7ZHNgw
 golang.org/x/tools v0.0.0-20190816200558-6889da9d5479/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20190911174233-4f2ddba30aff/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20191012152004-8de300cfc20a/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20191108193012-7d206e10da11/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20191113191852-77e3bb0ad9e7/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20191115202509-3a792d9c32b2/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
@@ -440,12 +442,12 @@ golang.org/x/tools v0.0.0-20200618134242-20370b0cb4b2/go.mod h1:EkVYQZoAsY45+roY
 golang.org/x/tools v0.0.0-20200729194436-6467de6f59a7/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA=
 golang.org/x/tools v0.0.0-20200804011535-6c149bb5ef0d/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA=
 golang.org/x/tools v0.0.0-20200825202427-b303f430e36d/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA=
-golang.org/x/tools v0.0.0-20210101214203-2dba1e4ea05c/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
-golang.org/x/tools v0.6.0 h1:BOw41kyTf3PuCW1pVQf8+Cyg8pMlkYB1oo9iJ6D/lKM=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4=
+gonum.org/v1/gonum v0.17.0/go.mod h1:El3tOrEuMpv2UdMrbNlKEh9vd86bmQ6vqIcDwxEOc1E=
 google.golang.org/api v0.4.0/go.mod h1:8k5glujaEP+g9n7WNsDg8QP6cUVNI86fCNMcbazEtwE=
 google.golang.org/api v0.7.0/go.mod h1:WtwebWUNSVBH/HAw79HIFXZNqEvBhG+Ra+ax0hx3E3M=
 google.golang.org/api v0.8.0/go.mod h1:o4eAsZoiT+ibD93RtjEohWalFOjRDx6CVaqeizhEnKg=
@@ -468,7 +470,6 @@ google.golang.org/appengine v1.5.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7
 google.golang.org/appengine v1.6.1/go.mod h1:i06prIuMbXzDqacNJfV5OdTW448YApPu5ww/cMBSeb0=
 google.golang.org/appengine v1.6.5/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
 google.golang.org/appengine v1.6.6/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
-google.golang.org/appengine v1.6.7 h1:FZR1q0exgwxzPzp/aF+VccGrSfxfPpkBqjIIEq3ru6c=
 google.golang.org/appengine v1.6.7/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
 google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
 google.golang.org/genproto v0.0.0-20190307195333-5fe7a883aa19/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
@@ -513,8 +514,8 @@ google.golang.org/grpc v1.28.0/go.mod h1:rpkK4SK4GF4Ach/+MFLZUBavHOvF2JJB5uozKKa
 google.golang.org/grpc v1.29.1/go.mod h1:itym6AZVZYACWQqET3MqgPpjcuV5QH3BxFS3IjizoKk=
 google.golang.org/grpc v1.30.0/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM8pak=
 google.golang.org/grpc v1.31.0/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM8pak=
-google.golang.org/grpc v1.56.3 h1:8I4C0Yq1EjstUzUJzpcRVbuYA2mODtEmpWiQoN/b2nc=
-google.golang.org/grpc v1.56.3/go.mod h1:I9bI3vqKfayGqPUAwGdOSu7kt6oIJLixfffKrpXqQ9s=
+google.golang.org/grpc v1.85.0-dev.0.20260825072537-93e31b48545e h1:ar+feAPij1Znzug45m6AoShUCc5AaR8FLA3I6LZd94k=
+google.golang.org/grpc v1.85.0-dev.0.20260825072537-93e31b48545e/go.mod h1:7aY/KlAHanMAVIWHnk8wloQsdlfwzDz/PP9vCbJG6CU=
 google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
 google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
 google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM=
@@ -527,15 +528,14 @@ google.golang.org/protobuf v1.24.0/go.mod h1:r/3tXBNzIEhYS9I1OUVjXDlt8tc493IdKGj
 google.golang.org/protobuf v1.25.0/go.mod h1:9JNX74DMeImyA3h4bdi1ymwjUzf21/xIlbajtzgsN7c=
 google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
 google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
-google.golang.org/protobuf v1.33.0 h1:uNO2rsAINq/JlFpSdYEKIZ0uKD/R9cpdv0T+yoGwGmI=
-google.golang.org/protobuf v1.33.0/go.mod h1:c6P6GXX6sHbq/GpV6MGZEdwhWPcYBgnhAHhKbcUYpos=
+google.golang.org/protobuf v1.36.12 h1:pJOKDDOyeXErUroCihFAd5LQuwXBSpVnKGrj5o/fwxc=
+google.golang.org/protobuf v1.36.12/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15 h1:YR8cESwS4TdDjEe65xsg0ogRM/Nc3DYOhEAlW+xobZo=
 gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/errgo.v2 v2.1.0/go.mod h1:hNsd1EY+bozCKY1Ytp96fpM3vjJbqLJn88ws8XvfDNI=
 gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
@@ -545,7 +545,8 @@ honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWh
 honnef.co/go/tools v0.0.1-2019.2.3/go.mod h1:a3bituU0lyd329TUQxRnasdCoJDkEUEAqEt0JzvZhAg=
 honnef.co/go/tools v0.0.1-2020.1.3/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
 honnef.co/go/tools v0.0.1-2020.1.4/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
-mvdan.cc/gofumpt v0.1.1/go.mod h1:yXG1r1WqZVKWbVRtBWKWX9+CxGYfA51nSomhM0woR48=
+repo.anhonesthost.net/CyberCoveLLC/threshold/sdk v0.1.0 h1:ExuSGqE1pA/1DnS5xrSK7kEhD+4g5hIJC5TgmwH5LAU=
+repo.anhonesthost.net/CyberCoveLLC/threshold/sdk v0.1.0/go.mod h1:cWxYF3tEkYEKTY76ub8kL+vdGmopO0YfJqJGGQJov7k=
 rsc.io/binaryregexp v0.2.0/go.mod h1:qTv7/COck+e2FymRvadv62gMdZztPaShugOCi3I+8D8=
 rsc.io/quote/v3 v3.1.0/go.mod h1:yEA65RcK8LyAZtP9Kv3t0HmxON59tX3rD+tICJqUlj0=
 rsc.io/sampler v1.3.0/go.mod h1:T1hPZKmBbMNahiBKFy5HrXp6adAjACjK9JXDnKaTXpA=
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2021, 2026
 // SPDX-License-Identifier: MPL-2.0

 package plugin
@@ -11,7 +11,7 @@ import (

 	"github.com/Azure/go-autorest/autorest"
 	"github.com/Azure/go-autorest/autorest/azure/auth"
-	"github.com/hashicorp/boundary/sdk/pbs/controller/api/resources/hostcatalogs"
+	"repo.anhonesthost.net/CyberCoveLLC/threshold/sdk/pbs/controller/api/resources/hostcatalogs"
 	hauth "github.com/manicminer/hamilton/auth"
 	"github.com/manicminer/hamilton/environments"
 	"github.com/manicminer/hamilton/msgraph"
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2021, 2026
 // SPDX-License-Identifier: MPL-2.0

 package plugin
@@ -65,6 +65,56 @@ func getVirtualMachinesClient(opt ...Option) (*compute.VirtualMachinesClient, er
 	return &client, nil
 }

+func getVirtualMachineScaleSetsClient(opt ...Option) (*compute.VirtualMachineScaleSetsClient, error) {
+	opts, err := getOpts(opt...)
+	if err != nil {
+		return nil, fmt.Errorf("error parsing ops: %w", err)
+	}
+	if opts.withSubscriptionId == "" {
+		return nil, errors.New("subscription id is empty")
+	}
+	if opts.withAuthorizer == nil {
+		return nil, errors.New("authorizer is nil")
+	}
+	var client compute.VirtualMachineScaleSetsClient
+	switch opts.withBaseUrl {
+	case "":
+		client = compute.NewVirtualMachineScaleSetsClient(opts.withSubscriptionId)
+	default:
+		client = compute.NewVirtualMachineScaleSetsClientWithBaseURI(opts.withBaseUrl, opts.withSubscriptionId)
+	}
+	client.Authorizer = opts.withAuthorizer
+	if err := client.AddToUserAgent(opts.withUserAgent); err != nil {
+		return nil, fmt.Errorf("error adding identifier to user-agent: %w", err)
+	}
+	return &client, nil
+}
+
+func getVirtualMachineScaleSetVMsClient(opt ...Option) (*compute.VirtualMachineScaleSetVMsClient, error) {
+	opts, err := getOpts(opt...)
+	if err != nil {
+		return nil, fmt.Errorf("error parsing ops: %w", err)
+	}
+	if opts.withSubscriptionId == "" {
+		return nil, errors.New("subscription id is empty")
+	}
+	if opts.withAuthorizer == nil {
+		return nil, errors.New("authorizer is nil")
+	}
+	var client compute.VirtualMachineScaleSetVMsClient
+	switch opts.withBaseUrl {
+	case "":
+		client = compute.NewVirtualMachineScaleSetVMsClient(opts.withSubscriptionId)
+	default:
+		client = compute.NewVirtualMachineScaleSetVMsClientWithBaseURI(opts.withBaseUrl, opts.withSubscriptionId)
+	}
+	client.Authorizer = opts.withAuthorizer
+	if err := client.AddToUserAgent(opts.withUserAgent); err != nil {
+		return nil, fmt.Errorf("error adding identifier to user-agent: %w", err)
+	}
+	return &client, nil
+}
+
 func getNetworkInterfacesClient(opt ...Option) (*network.InterfacesClient, error) {
 	opts, err := getOpts(opt...)
 	if err != nil {
@@ -1,25 +1,33 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2021, 2026
 // SPDX-License-Identifier: MPL-2.0

 package plugin

 const (
-	constBaseUrl                   = "base_url"
+	// Azure service constants
+	constMsComputeService = "Microsoft.Compute"
+	constMsNetworkService = "Microsoft.Network"
+	constSubscriptions    = "subscriptions"
+	constResourceGroups   = "resourceGroups"
+	constProviders        = "providers"
+
+	// Resource type constants
+	constVirtualMachinesResource         = "virtualMachines"
+	constVirtualMachineScaleSetsResource = "virtualMachineScaleSets"
+	constNetworkInterfacesResource       = "networkInterfaces"
+	constPublicIpAddressesResource       = "publicIPAddresses"
+
+	// Field constants
 	constFilter                    = "filter"
-	constSubscriptionId            = "subscription_id"
-	constClientId                  = "client_id"
+	constSecretId                  = "secret_id"
 	constSecretValue               = "secret_value"
 	constCredsLastRotatedTime      = "creds_last_rotated_time"
-	constSecretId                  = "secret_id"
-	constTenantId                  = "tenant_id"
-	constDefaultFilter             = "resourceType eq 'Microsoft.Compute/virtualMachines'"
-	constMsComputeService          = "Microsoft.Compute"
-	constVirtualMachinesResource   = "virtualMachines"
-	constMsNetworkService          = "Microsoft.Network"
-	constNetworkInterfacesResource = "networkInterfaces"
-	constPublicIpAddressesResource = "publicIPAddresses"
-	constSubscriptions             = "subscriptions"
-	constResourceGroups            = "resourceGroups"
-	constProviders                 = "providers"
 	constDisableCredentialRotation = "disable_credential_rotation"
+	constSubscriptionId            = "subscription_id"
+	constTenantId                  = "tenant_id"
+	constClientId                  = "client_id"
+	constBaseUrl                   = "base_url"
+
+	// Worker pool configuration
+	constDefaultWorkers = 1000
 )
@@ -0,0 +1,280 @@
+// Copyright IBM Corp. 2021, 2026
+// SPDX-License-Identifier: MPL-2.0
+
+package plugin
+
+import (
+	"context"
+	"fmt"
+	"strings"
+
+	"github.com/Azure/azure-sdk-for-go/profiles/latest/compute/mgmt/compute"
+	"github.com/Azure/azure-sdk-for-go/profiles/latest/network/mgmt/network"
+)
+
+type networkInfo struct {
+	IpAddresses []string
+}
+
+// Common interface for IP configuration processing
+type networkProcessor interface {
+	processIPConfigurations(ctx context.Context, ipConfigs []network.InterfaceIPConfiguration, ifName string) (*networkInfo, error)
+	getPublicIPAddress(ctx context.Context, publicIPRef *network.PublicIPAddress, ipConf *network.InterfaceIPConfiguration, ifName string) (string, error)
+	getNetworkInterface(ctx context.Context, interfaceID string) (*network.Interface, string, error)
+}
+
+// Standard VM network processor
+type vmNetworkProcessor struct {
+	clients       *azureClients
+	resourceGroup string
+}
+
+// VMSS network processor
+type vmssNetworkProcessor struct {
+	clients       *azureClients
+	resourceGroup string
+	vmssName      string
+	instanceID    string
+}
+
+func processNetworkProfile(
+	ctx context.Context,
+	interfaces []compute.NetworkInterfaceReference,
+	processor networkProcessor,
+	targetInfo *networkInfo,
+) error {
+
+	for _, ifaceRef := range interfaces {
+		if ifaceRef.ID == nil {
+			return fmt.Errorf("nil ID for network interface")
+		}
+
+		iface, ifName, err := processor.getNetworkInterface(ctx, *ifaceRef.ID)
+		if err != nil {
+			return err
+		}
+
+		if iface.InterfacePropertiesFormat == nil || iface.InterfacePropertiesFormat.IPConfigurations == nil {
+			continue
+		}
+
+		networkInfo, err := processor.processIPConfigurations(ctx, *iface.InterfacePropertiesFormat.IPConfigurations, ifName)
+		if err != nil {
+			return err
+		}
+		targetInfo.IpAddresses = append(targetInfo.IpAddresses, networkInfo.IpAddresses...)
+	}
+	return nil
+}
+
+func (p *vmNetworkProcessor) getNetworkInterface(ctx context.Context, interfaceID string) (*network.Interface, string, error) {
+	ifResGroup, ifName, err := splitId(interfaceID, constMsNetworkService, constNetworkInterfacesResource)
+	if err != nil {
+		return nil, "", fmt.Errorf("error splitting network interface id %q: %w", interfaceID, err)
+	}
+
+	iface, err := p.clients.ifClient.Get(ctx, ifResGroup, ifName, "")
+	if err != nil {
+		return nil, "", fmt.Errorf("error fetching network interface: %w", err)
+	}
+
+	return &iface, ifName, nil
+}
+
+func (p *vmNetworkProcessor) processIPConfigurations(
+	ctx context.Context,
+	ipConfigs []network.InterfaceIPConfiguration,
+	ifName string,
+) (
+	*networkInfo,
+	error,
+) {
+	tempInfo := &networkInfo{}
+	for _, ipconf := range ipConfigs {
+		// Process private IP
+		if ipconf.PrivateIPAddress != nil {
+			tempInfo.IpAddresses = append(tempInfo.IpAddresses, *ipconf.PrivateIPAddress)
+		}
+
+		// Process public IP if available
+		if ipconf.PublicIPAddress != nil {
+			ipAddress, err := p.getPublicIPAddress(ctx, ipconf.PublicIPAddress, &ipconf, ifName)
+			if err != nil {
+				return nil, err
+			}
+			tempInfo.IpAddresses = append(tempInfo.IpAddresses, ipAddress)
+		}
+	}
+	return tempInfo, nil
+}
+
+func (p *vmNetworkProcessor) getPublicIPAddress(
+	ctx context.Context,
+	publicIP *network.PublicIPAddress,
+	ipConf *network.InterfaceIPConfiguration,
+	ifName string,
+) (
+	string,
+	error,
+) {
+	if publicIP.ID == nil {
+		return "", fmt.Errorf("ip configuration has public IP address info but nil id")
+	}
+
+	ipResGroup, ipName, err := splitId(*publicIP.ID, constMsNetworkService, constPublicIpAddressesResource)
+	if err != nil {
+		return "", fmt.Errorf("error splitting public ip address id: %w", err)
+	}
+
+	pipInfo, err := p.clients.pipClient.Get(ctx, ipResGroup, ipName, "")
+	if err != nil {
+		return "", fmt.Errorf("error fetching public IP information: %w", err)
+	}
+
+	if pipInfo.PublicIPAddressPropertiesFormat == nil {
+		return "", fmt.Errorf("nil public ip address properties format for public ip %q", *publicIP.ID)
+	}
+
+	if pipInfo.PublicIPAddressPropertiesFormat.IPAddress == nil {
+		return "", fmt.Errorf("nil IP address for public ip %q", *publicIP.ID)
+	}
+
+	return *pipInfo.PublicIPAddressPropertiesFormat.IPAddress, nil
+}
+
+func (p *vmssNetworkProcessor) getNetworkInterface(ctx context.Context, interfaceID string) (*network.Interface, string, error) {
+	ifName := extractResourceSuffix(interfaceID)
+
+	iface, err := p.clients.ifClient.GetVirtualMachineScaleSetNetworkInterface(
+		ctx,
+		p.resourceGroup,
+		p.vmssName,
+		p.instanceID,
+		ifName,
+		"")
+	if err != nil {
+		return nil, "", fmt.Errorf("error fetching VMSS network interface: %w", err)
+	}
+
+	return &iface, ifName, nil
+}
+
+func (p *vmssNetworkProcessor) processIPConfigurations(
+	ctx context.Context,
+	ipConfigs []network.InterfaceIPConfiguration,
+	ifName string,
+) (
+	*networkInfo,
+	error,
+) {
+	tempInfo := &networkInfo{}
+	for _, ipconf := range ipConfigs {
+		if ipconf.PrivateIPAddress != nil {
+			tempInfo.IpAddresses = append(tempInfo.IpAddresses, *ipconf.PrivateIPAddress)
+		}
+
+		if ipconf.PublicIPAddress != nil {
+			ipAddress, err := p.getPublicIPAddress(ctx, ipconf.PublicIPAddress, &ipconf, ifName)
+			if err != nil {
+				return nil, err
+			}
+			tempInfo.IpAddresses = append(tempInfo.IpAddresses, ipAddress)
+		}
+	}
+	return tempInfo, nil
+}
+
+func (p *vmssNetworkProcessor) getPublicIPAddress(
+	ctx context.Context,
+	publicIP *network.PublicIPAddress,
+	ipConf *network.InterfaceIPConfiguration,
+	ifName string,
+) (
+	string,
+	error,
+) {
+	if publicIP == nil || publicIP.ID == nil || ipConf.Name == nil {
+		return "", fmt.Errorf("invalid public IP configuration")
+	}
+
+	pipName := extractResourceSuffix(*publicIP.ID)
+	pipInfo, err := p.clients.pipClient.GetVirtualMachineScaleSetPublicIPAddress(
+		ctx,
+		p.resourceGroup,
+		p.vmssName,
+		p.instanceID,
+		ifName,
+		*ipConf.Name,
+		pipName,
+		"")
+	if err != nil {
+		return "", fmt.Errorf("error fetching public IP information: %w", err)
+	}
+
+	if pipInfo.PublicIPAddressPropertiesFormat == nil {
+		return "", fmt.Errorf("nil public ip address properties format")
+	}
+
+	if pipInfo.PublicIPAddressPropertiesFormat.IPAddress == nil {
+		return "", fmt.Errorf("nil IP address for public ip %q", *publicIP.ID)
+	}
+
+	return *pipInfo.PublicIPAddressPropertiesFormat.IPAddress, nil
+}
+
+func processVMNetworkInterfaces(
+	ctx context.Context,
+	vm compute.VirtualMachine,
+	clients *azureClients,
+	resourceGroup string,
+	netInfo *networkInfo,
+) error {
+
+	if vm.VirtualMachineProperties == nil || vm.VirtualMachineProperties.NetworkProfile == nil {
+		return fmt.Errorf("error fetching network profile")
+	}
+
+	processor := &vmNetworkProcessor{
+		clients:       clients,
+		resourceGroup: resourceGroup,
+	}
+
+	return processNetworkProfile(ctx, *vm.VirtualMachineProperties.NetworkProfile.NetworkInterfaces, processor, netInfo)
+}
+
+func processVMSSNetworkInterfaces(
+	ctx context.Context,
+	vmssvm compute.VirtualMachineScaleSetVM,
+	resourceGroup, vmssName string,
+	clients *azureClients,
+	netInfo *networkInfo,
+) error {
+
+	if vmssvm.VirtualMachineScaleSetVMProperties == nil ||
+		vmssvm.VirtualMachineScaleSetVMProperties.NetworkProfile == nil {
+		return fmt.Errorf("error fetching network profile")
+	}
+
+	if vmssvm.InstanceID == nil {
+		return fmt.Errorf("instance ID is nil")
+	}
+
+	processor := &vmssNetworkProcessor{
+		clients:       clients,
+		resourceGroup: resourceGroup,
+		vmssName:      vmssName,
+		instanceID:    *vmssvm.InstanceID,
+	}
+
+	return processNetworkProfile(ctx,
+		*vmssvm.VirtualMachineScaleSetVMProperties.NetworkProfile.NetworkInterfaces, processor, netInfo)
+}
+
+// extractResourceSuffix extracts the resource name from the end of an Azure resource ID
+func extractResourceSuffix(resourceID string) string {
+	parts := strings.Split(resourceID, "/")
+	if len(parts) > 0 {
+		return parts[len(parts)-1]
+	}
+	return ""
+}
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2021, 2026
 // SPDX-License-Identifier: MPL-2.0

 package plugin
@@ -1,6 +1,8 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2021, 2026
 // SPDX-License-Identifier: MPL-2.0

+// Package plugin implements the Azure host plugin for Boundary,
+// providing functionality to manage and list Azure hosts.
 package plugin

 import (
@@ -8,18 +10,21 @@ import (
 	"errors"
 	"fmt"
 	"strings"
+	"sync"
 	"time"

+	"github.com/Azure/azure-sdk-for-go/profiles/latest/compute/mgmt/compute"
 	"github.com/Azure/azure-sdk-for-go/profiles/latest/network/mgmt/network"
 	"github.com/Azure/azure-sdk-for-go/profiles/latest/resources/mgmt/resources"
-	"github.com/hashicorp/boundary/sdk/pbs/controller/api/resources/hostcatalogs"
-	"github.com/hashicorp/boundary/sdk/pbs/controller/api/resources/hostsets"
 	"github.com/mitchellh/mapstructure"
+	"golang.org/x/sync/errgroup"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
 	"google.golang.org/protobuf/types/known/structpb"

-	pb "github.com/hashicorp/boundary/sdk/pbs/plugin"
+	"repo.anhonesthost.net/CyberCoveLLC/threshold/sdk/pbs/controller/api/resources/hostcatalogs"
+	"repo.anhonesthost.net/CyberCoveLLC/threshold/sdk/pbs/controller/api/resources/hostsets"
+	pb "repo.anhonesthost.net/CyberCoveLLC/threshold/sdk/pbs/plugin"
 )

 // AzurePlugin implements the HostPluginServiceServer interface
@@ -28,37 +33,19 @@ type AzurePlugin struct {
 }

 // Ensure that we are implementing HostPluginServiceServer
-var (
-	_ pb.HostPluginServiceServer = (*AzurePlugin)(nil)
-)
+var _ pb.HostPluginServiceServer = (*AzurePlugin)(nil)

 type SetAttributes struct {
 	Filter string `mapstructure:"filter"`
 }

-func rotateCredFromCallback(ctx context.Context, catalog *hostcatalogs.HostCatalog) (*pb.HostCatalogPersisted, error) {
-	authzInfo, err := getAuthorizationInfo(catalog)
-	if err != nil {
-		return nil, fmt.Errorf("error getting hauth config when creating catalog: %w", err)
-	}
-	newPass, err := rotateCredential(ctx, authzInfo)
-	if err != nil {
-		return nil, fmt.Errorf("error rotating credentials when creating catalog: %w", err)
-	}
-	if newPass == nil {
-		return nil, errors.New("new credential back from rotate is nil")
-	}
-	newSecrets, err := structpb.NewStruct(map[string]interface{}{
-		constSecretId:             *newPass.KeyId,
-		constSecretValue:          *newPass.SecretText,
-		constCredsLastRotatedTime: time.Now().Format(time.RFC3339Nano),
-	})
-	if err != nil {
-		return nil, fmt.Errorf("error formatting new credential data as struct")
-	}
-	return &pb.HostCatalogPersisted{
-		Secrets: newSecrets,
-	}, err
+type azureClients struct {
+	resClient    *resources.Client
+	vmClient     *compute.VirtualMachinesClient
+	vmssClient   *compute.VirtualMachineScaleSetsClient
+	vmssvmClient *compute.VirtualMachineScaleSetVMsClient
+	ifClient     *network.InterfacesClient
+	pipClient    *network.PublicIPAddressesClient
 }

 func (p *AzurePlugin) OnCreateCatalog(_ context.Context, req *pb.OnCreateCatalogRequest) (*pb.OnCreateCatalogResponse, error) {
@@ -94,13 +81,10 @@ func (p *AzurePlugin) OnUpdateCatalog(_ context.Context, req *pb.OnUpdateCatalog
 	}
 	currentCatalog := req.GetCurrentCatalog()
 	if currentCatalog == nil {
-		// Should never happen
 		return nil, status.Error(codes.FailedPrecondition, "current catalog is nil")
 	}
 	secrets := req.GetNewCatalog().GetSecrets()
 	if secrets == nil {
-		// If new secrets weren't passed in, don't rotate what we have on
-		// update.
 		return &pb.OnUpdateCatalogResponse{}, nil
 	}
 	if err := validateSecrets(secrets); err != nil {
@@ -142,10 +126,161 @@ func (p *AzurePlugin) OnUpdateSet(_ context.Context, req *pb.OnUpdateSetRequest)

 func (p *AzurePlugin) ListHosts(ctx context.Context, req *pb.ListHostsRequest) (*pb.ListHostsResponse, error) {
 	if len(req.GetSets()) == 0 {
-		// Nothing to fetch
 		return &pb.ListHostsResponse{}, nil
 	}
-	catalog := req.GetCatalog()
+
+	// Initialize Azure clients and authorization
+	clients, err := p.initializeAzureResources(req.GetCatalog(), req.GetPersisted().GetSecrets())
+	if err != nil {
+		return nil, err
+	}
+
+	// Find matching resources and map them to sets
+	vmResources, vmssResources, resourceToSetMap, err := p.findMatchingResources(ctx, req.GetSets(), clients.resClient)
+	if err != nil {
+		return nil, err
+	}
+
+	// Create mutex and errgroup for parallel processing
+	mu := &sync.Mutex{}
+	vmToNetworkMap := make(map[string]networkInfo)
+	g, ctx := errgroup.WithContext(ctx)
+
+	// Process standard VMs in parallel if they exist
+	if len(vmResources) > 0 {
+		g.Go(func() error {
+			vmNetworkMap, err := p.processStandardVMs(ctx, vmResources, clients)
+			if err != nil {
+				return fmt.Errorf("processing VMs: %w", err)
+			}
+
+			mu.Lock()
+			defer mu.Unlock()
+			for k, v := range vmNetworkMap {
+				vmToNetworkMap[k] = v
+			}
+			return nil
+		})
+	}
+
+	// Process VMSS in parallel if they exist
+	if len(vmssResources) > 0 {
+		g.Go(func() error {
+			vmssNetworkMap, err := p.processVMScaleSets(ctx, vmssResources, clients)
+			if err != nil {
+				return fmt.Errorf("processing VMSS: %w", err)
+			}
+
+			mu.Lock()
+			defer mu.Unlock()
+			for k, v := range vmssNetworkMap {
+				vmToNetworkMap[k] = v
+			}
+			return nil
+		})
+	}
+
+	// Wait for all goroutines to complete and check for errors
+	if err := g.Wait(); err != nil {
+		return nil, err
+	}
+
+	response := buildHostsResponse(vmToNetworkMap, resourceToSetMap)
+	return response, nil
+}
+
+func rotateCredFromCallback(ctx context.Context, catalog *hostcatalogs.HostCatalog) (*pb.HostCatalogPersisted, error) {
+	authzInfo, err := getAuthorizationInfo(catalog)
+	if err != nil {
+		return nil, fmt.Errorf("error getting auth config when creating catalog: %w", err)
+	}
+	newPass, err := rotateCredential(ctx, authzInfo)
+	if err != nil {
+		return nil, fmt.Errorf("error rotating credentials when creating catalog: %w", err)
+	}
+	if newPass == nil {
+		return nil, errors.New("new credential back from rotate is nil")
+	}
+	newSecrets, err := structpb.NewStruct(map[string]interface{}{
+		constSecretId:             *newPass.KeyId,
+		constSecretValue:          *newPass.SecretText,
+		constCredsLastRotatedTime: time.Now().Format(time.RFC3339Nano),
+	})
+	if err != nil {
+		return nil, fmt.Errorf("error formatting new credential data as struct")
+	}
+	return &pb.HostCatalogPersisted{
+		Secrets: newSecrets,
+	}, err
+}
+
+func buildHostsResponse(
+	vmToNetworkMap map[string]networkInfo,
+	resourceToSetMap map[string][]string) *pb.ListHostsResponse {
+
+	ret := &pb.ListHostsResponse{}
+
+	for resourceID, networkInfo := range vmToNetworkMap {
+		host, err := createHostFromResource(resourceID, networkInfo, resourceToSetMap)
+		if err != nil {
+			fmt.Printf("Error creating host from resource: %v\n", err)
+			continue
+		}
+		ret.Hosts = append(ret.Hosts, host)
+	}
+
+	return ret
+}
+
+func createHostFromResource(resourceID string, networkInfo networkInfo,
+	resourceToSetMap map[string][]string) (*pb.ListHostsResponseHost, error) {
+
+	// Extract the resource type from the ID
+	resourceType, err := extractResourceType(resourceID)
+	if err != nil {
+		return nil, fmt.Errorf("invalid resource ID: %w", err)
+	}
+
+	switch resourceType {
+	case constVirtualMachineScaleSetsResource:
+		externalName, err := getExternalNameforVMSSInstance(resourceID)
+		if err != nil {
+			externalName = "" // Use empty name if there's an error
+		}
+
+		setId, err := getSetForVMSSInstance(resourceID)
+		if err != nil {
+			return nil, fmt.Errorf("could not determine set for resource ID: %w", err)
+		}
+		return &pb.ListHostsResponseHost{
+			ExternalId:   resourceID,
+			ExternalName: externalName,
+			IpAddresses:  networkInfo.IpAddresses,
+			SetIds:       resourceToSetMap[setId],
+		}, nil
+
+	case constVirtualMachinesResource:
+		_, externalName, err := splitId(resourceID, constMsComputeService, constVirtualMachinesResource)
+		if err != nil {
+			externalName = "" // Use empty name if there's an error
+		}
+
+		return &pb.ListHostsResponseHost{
+			ExternalId:   resourceID,
+			ExternalName: externalName,
+			IpAddresses:  networkInfo.IpAddresses,
+			SetIds:       resourceToSetMap[resourceID],
+		}, nil
+
+	default:
+		return nil, fmt.Errorf("unsupported resource type: %s", resourceType) // Return explicit error
+	}
+}
+
+func (p *AzurePlugin) initializeAzureResources(
+	catalog *hostcatalogs.HostCatalog,
+	secrets *structpb.Struct) (*azureClients, error) {
+
 	if catalog == nil {
 		return nil, status.Error(codes.FailedPrecondition, "catalog is nil")
 	}
@@ -154,8 +289,8 @@ func (p *AzurePlugin) ListHosts(ctx context.Context, req *pb.ListHostsRequest) (
 		return nil, status.Error(codes.FailedPrecondition, "catalog has no attributes")
 	}

-	// Create an authorizer
-	catalog.Secrets = req.GetPersisted().GetSecrets()
+	// Create authorizer
+	catalog.Secrets = secrets
 	authzInfo, err := getAuthorizationInfo(catalog)
 	if err != nil {
 		return nil, fmt.Errorf("error fetching authorizationInfo: %w", err)
@@ -163,6 +298,7 @@ func (p *AzurePlugin) ListHosts(ctx context.Context, req *pb.ListHostsRequest) (
 	if authzInfo == nil {
 		return nil, status.Error(codes.FailedPrecondition, "authorization info is nil")
 	}
+
 	authorizer, err := authzInfo.autorestAuthorizer()
 	if err != nil {
 		return nil, fmt.Errorf("error fetching autorest authorizer: %w", err)
@@ -171,16 +307,13 @@ func (p *AzurePlugin) ListHosts(ctx context.Context, req *pb.ListHostsRequest) (
 		return nil, errors.New("fetched authorizer is nil")
 	}

-	commonOpts := make([]Option, 0, 3)
-	commonOpts = append(commonOpts,
+	// Set up common client options
+	commonOpts := []Option{
 		WithSubscriptionId(authzInfo.AuthParams.SubscriptionId),
 		WithAuthorizer(authorizer),
-	)
+	}

-	// Getting authorizer will fail if the attr fields are not populated, so
-	// it's safe to access directly at this point.
-	//
-	// TODO: plumb base URL everywhere, not just here
+	// Add base URL if specified
 	catalogAttrFields := catalogAttrs.GetFields()
 	if catalogAttrFields[constBaseUrl] != nil {
 		if baseUrl := catalogAttrFields[constBaseUrl].GetStringValue(); baseUrl != "" {
@@ -188,229 +321,137 @@ func (p *AzurePlugin) ListHosts(ctx context.Context, req *pb.ListHostsRequest) (
 		}
 	}

-	// Create clients
-	resClient, err := getResourcesClient(commonOpts...)
-	if err != nil {
-		return nil, fmt.Errorf("error fetching resources client: %w", err)
-	}
-	if resClient == nil {
-		return nil, errors.New("resource client is nil")
-	}
-	vmClient, err := getVirtualMachinesClient(commonOpts...)
-	if err != nil {
-		return nil, fmt.Errorf("error fetching virtual machines client: %w", err)
-	}
-	if vmClient == nil {
-		return nil, errors.New("virtual machines client is nil")
-	}
-	ifClient, err := getNetworkInterfacesClient(commonOpts...)
-	if err != nil {
-		return nil, fmt.Errorf("error fetching network interfaces client: %w", err)
-	}
-	if ifClient == nil {
-		return nil, errors.New("network interfaces client is nil")
-	}
-	pipClient, err := getPublicIpAddressesClient(commonOpts...)
-	if err != nil {
-		return nil, fmt.Errorf("error fetching public ip address client: %w", err)
-	}
-	if pipClient == nil {
-		return nil, errors.New("public ip address client is nil")
+	// Initialize clients
+	clients := &azureClients{}
+	var initErr error
+
+	// Initialize individual clients with error handling
+	if clients.resClient, initErr = getResourcesClient(commonOpts...); initErr != nil {
+		return nil, fmt.Errorf("error fetching resources client: %w", initErr)
 	}

-	// This next section finds resource IDs that match to the filter in each
-	// host set, and stores a mapping of, for each resource ID, which host sets
-	// it belongs to
-	resourceToSetMap := make(map[string][]string, len(req.GetSets())*10)
-	var resourceInfos []resources.GenericResourceExpanded
-	for _, set := range req.GetSets() {
-		if set == nil {
-			return nil, errors.New("set is nil")
-		}
-		setAttrs := set.GetAttributes()
-		if setAttrs == nil {
-			return nil, fmt.Errorf("set %s has no attributes", set.GetId())
-		}
-		setAttrFields := setAttrs.GetFields()
-		if len(setAttrFields) == 0 {
-			return nil, fmt.Errorf("set %s attributes has no filter", set.GetId())
-		}
-
-		filter := constDefaultFilter
-		if setAttrFields[constFilter] != nil {
-			if filter = setAttrFields[constFilter].GetStringValue(); filter == "" {
-				return nil, fmt.Errorf("set %s filter is empty", set.GetId())
-			}
-		}
-
-		// List values matching the filter; ask for provisioning state information
-		// to ensure we are seeing only fully provisioned machines
-		{
-			iter, err := resClient.ListComplete(ctx, filter, "", nil)
-			if err != nil {
-				return nil, fmt.Errorf("error listing resources: %w", err)
-			}
-			for iter.NotDone() {
-				val := iter.Value()
-				if err := iter.NextWithContext(ctx); err != nil {
-					return nil, fmt.Errorf("error iterating resources: %w", err)
-				}
-				if val.ID == nil { // something went wrong, likely iterator has advanced beyond the end
-					continue
-				}
-				if val.Type == nil || !strings.EqualFold(*val.Type, "Microsoft.Compute/virtualMachines") {
-					// no point continuing if we can't validate that it's a VM
-					continue
-				}
-				resourceInfos = append(resourceInfos, val)
-				resourceToSetMap[*val.ID] = append(resourceToSetMap[*val.ID], set.GetId())
-			}
-		}
+	if clients.vmClient, initErr = getVirtualMachinesClient(commonOpts...); initErr != nil {
+		return nil, fmt.Errorf("error fetching virtual machines client: %w", initErr)
 	}

-	// At this point we have a list of distinct resources and a mapping between
-	// them and the set(s) they belong to. Iterate through them and fetch
-	// information.
-	//
-	// Listing returns IDs which are basically URLs that have key-value
-	// pairs but not the individual components. Get requires the individual
-	// components, and won't accept the ID...
-	//
-	// Anyways, now we find VM details for those resources
-	vmToIfaceMap := make(map[string][]network.Interface)
-	{
-		for _, res := range resourceInfos {
-			resourceGroup, name, err := splitId(*res.ID, constMsComputeService, constVirtualMachinesResource)
-			if err != nil {
-				return nil, fmt.Errorf("error splitting vm id %q: %w", *res.ID, err)
-			}
-			vm, err := vmClient.Get(ctx, resourceGroup, name, "")
-			if err != nil {
-				return nil, fmt.Errorf("error fetching vm with id %q: %w", *res.ID, err)
-			}
-
-			iv, err := vmClient.InstanceView(ctx, resourceGroup, name)
-			if err != nil {
-				return nil, fmt.Errorf("error fetching instance view for vm with id %q: %w", *res.ID, err)
-			}
-			if iv.Statuses == nil {
-				return nil, fmt.Errorf("instance view statuses returned for vm with id %q is null", *res.ID)
-			}
-			var running bool
-			for _, s := range *iv.Statuses {
-				if s.Code == nil {
-					continue
-				}
-				state := strings.ToLower(*s.Code)
-				prefix := "powerstate/"
-				if !strings.HasPrefix(state, prefix) {
-					continue
-				}
-				state = strings.TrimPrefix(state, prefix)
-				if state == "running" {
-					running = true
-					break
-				}
-			}
-			if !running {
-				continue
-			}
-
-			props := vm.VirtualMachineProperties
-			if props == nil {
-				return nil, fmt.Errorf("error fetching properties for vm with id %q: %w", *res.ID, err)
-			}
-			if props.NetworkProfile == nil {
-				return nil, fmt.Errorf("error fetching network profile for vm with id %q", *res.ID)
-			}
-
-			// Within the VM, catalog the various interfaces
-			var ifaces []network.Interface
-			for _, ifaceRef := range *props.NetworkProfile.NetworkInterfaces {
-				if ifaceRef.ID == nil {
-					return nil, fmt.Errorf("nil ID for network interface for vm with id %q", *res.ID)
-				}
-				ifResGroup, ifName, err := splitId(*ifaceRef.ID, constMsNetworkService, constNetworkInterfacesResource)
-				if err != nil {
-					return nil, fmt.Errorf("error splitting network interface id %q: %w", *ifaceRef.ID, err)
-				}
-				iface, err := ifClient.Get(ctx, ifResGroup, ifName, "")
-				if err != nil {
-					return nil, fmt.Errorf("error fetching network interface with id %q: %w", *ifaceRef.ID, err)
-				}
-				if iface.InterfacePropertiesFormat == nil || iface.InterfacePropertiesFormat.IPConfigurations == nil {
-					continue
-				}
-				ifaces = append(ifaces, iface)
-			}
-			vmToIfaceMap[*res.ID] = ifaces
-		}
+	if clients.vmssClient, initErr = getVirtualMachineScaleSetsClient(commonOpts...); initErr != nil {
+		return nil, fmt.Errorf("error fetching virtual machine scale set client: %w", initErr)
 	}

-	// Now, fetch IP details for each of the interfaces for each VM
-	type networkInfo struct {
-		IpAddresses []string
-	}
-	vmToNetworkMap := make(map[string]networkInfo)
-	{
-		for vmId, ifaces := range vmToIfaceMap {
-			var netInfo networkInfo
-			for _, iface := range ifaces {
-				for _, ipconf := range *iface.InterfacePropertiesFormat.IPConfigurations {
-					if ipconf.PrivateIPAddress != nil {
-						netInfo.IpAddresses = append(netInfo.IpAddresses, *ipconf.PrivateIPAddress)
-					}
-					if ipconf.PublicIPAddress != nil {
-						if ipconf.PublicIPAddress.ID == nil {
-							return nil, fmt.Errorf("ip configuration %q has public IP address info but nil id", *ipconf.ID)
-						}
-						ipResGroup, ipName, err := splitId(*ipconf.PublicIPAddress.ID, constMsNetworkService, constPublicIpAddressesResource)
-						if err != nil {
-							return nil, fmt.Errorf("error splitting public ip address id %q: %w", *ipconf.PublicIPAddress.ID, err)
-						}
-						pipInfo, err := pipClient.Get(ctx, ipResGroup, ipName, "")
-						if err != nil {
-							if err != nil {
-								return nil, fmt.Errorf("error fetching public IP information with resource group %q and name %q: %w", ipResGroup, ipName, err)
-							}
-						}
-						if pipInfo.PublicIPAddressPropertiesFormat == nil {
-							return nil, fmt.Errorf("nil public ip address properties format for public ip %q", *ipconf.PublicIPAddress.ID)
-						}
-						if pipInfo.PublicIPAddressPropertiesFormat.IPAddress != nil {
-							netInfo.IpAddresses = append(netInfo.IpAddresses, *pipInfo.PublicIPAddressPropertiesFormat.IPAddress)
-						}
-					}
-				}
-			}
-			vmToNetworkMap[vmId] = netInfo
-		}
+	if clients.vmssvmClient, initErr = getVirtualMachineScaleSetVMsClient(commonOpts...); initErr != nil {
+		return nil, fmt.Errorf("error fetching virtual machine scale set vms client: %w", initErr)
 	}

-	ret := &pb.ListHostsResponse{}
-	for k, v := range vmToNetworkMap {
-		_, externalName, err := splitId(k, constMsComputeService, constVirtualMachinesResource)
-		if err != nil {
-			externalName = ""
-		}
-
-		host := &pb.ListHostsResponseHost{
-			ExternalId:   k,
-			ExternalName: externalName,
-			IpAddresses:  v.IpAddresses,
-			SetIds:       resourceToSetMap[k],
-		}
-		ret.Hosts = append(ret.Hosts, host)
+	if clients.ifClient, initErr = getNetworkInterfacesClient(commonOpts...); initErr != nil {
+		return nil, fmt.Errorf("error fetching network interfaces client: %w", initErr)
 	}
-	return ret, nil
+
+	if clients.pipClient, initErr = getPublicIpAddressesClient(commonOpts...); initErr != nil {
+		return nil, fmt.Errorf("error fetching public ip address client: %w", initErr)
+	}
+
+	return clients, nil
 }

+func (p *AzurePlugin) findMatchingResources(ctx context.Context,
+	sets []*hostsets.HostSet,
+	resClient *resources.Client) (
+	vmResources []resources.GenericResourceExpanded,
+	vmssResources []resources.GenericResourceExpanded,
+	resourceToSetMap map[string][]string,
+	_ error) {
+
+	resourceToSetMap = make(map[string][]string, len(sets)*10) // Pre-allocate map size
+
+	for _, set := range sets {
+		if err := validateHostSet(set); err != nil {
+			return nil, nil, nil, err
+		}
+
+		filter := getSetFilter(set)
+		setVMResources, setVMSSResources, setResourceToSetMap, err := listAndFilterResources(ctx, resClient, filter, set.GetId())
+		if err != nil {
+			return nil, nil, nil, err
+		}
+		vmResources = append(vmResources, setVMResources...)
+		vmssResources = append(vmssResources, setVMSSResources...)
+		for k, v := range setResourceToSetMap {
+			resourceToSetMap[k] = append(resourceToSetMap[k], v...)
+		}
+	}
+
+	return vmResources, vmssResources, resourceToSetMap, nil
+}
+
+func listAndFilterResources(ctx context.Context,
+	resClient *resources.Client,
+	filter, setID string) (
+	vmResources []resources.GenericResourceExpanded,
+	vmssResources []resources.GenericResourceExpanded,
+	resourceToSetMap map[string][]string,
+	_ error) {
+
+	resourceToSetMap = make(map[string][]string)
+	iter, err := resClient.ListComplete(ctx, filter, "", nil)
+	if err != nil {
+		return nil, nil, nil, fmt.Errorf("error listing resources: %w", err)
+	}
+
+	for iter.NotDone() {
+		val := iter.Value()
+		if err := iter.NextWithContext(ctx); err != nil {
+			return nil, nil, nil, fmt.Errorf("error iterating resources: %w", err)
+		}
+
+		if val.ID == nil || val.Type == nil {
+			continue
+		}
+		virtualMachineType := constMsComputeService + "/" + constVirtualMachinesResource
+		virtualMachineScaleSetType := constMsComputeService + "/" + constVirtualMachineScaleSetsResource
+		if strings.EqualFold(*val.Type, virtualMachineType) {
+			vmResources = append(vmResources, val)
+			resourceToSetMap[*val.ID] = append(resourceToSetMap[*val.ID], setID)
+		} else if strings.EqualFold(*val.Type, virtualMachineScaleSetType) {
+			vmssResources = append(vmssResources, val)
+			resourceToSetMap[*val.ID] = append(resourceToSetMap[*val.ID], setID)
+		}
+	}
+
+	return vmResources, vmssResources, resourceToSetMap, nil
+}
+
+// Resource Filter Management
+func getSetFilter(set *hostsets.HostSet) string {
+	setAttrFields := set.GetAttributes().GetFields()
+	if setAttrFields[constFilter] != nil {
+		if filter := setAttrFields[constFilter].GetStringValue(); filter != "" {
+			return filter
+		}
+	}
+	return ""
+}
+
+func validateHostSet(set *hostsets.HostSet) error {
+	if set == nil {
+		return errors.New("set is nil")
+	}
+	setAttrs := set.GetAttributes()
+	if setAttrs == nil {
+		return fmt.Errorf("set %s has no attributes", set.GetId())
+	}
+	if len(setAttrs.GetFields()) == 0 {
+		return fmt.Errorf("set %s attributes has no filter", set.GetId())
+	}
+	return nil
+}
+
+// ID Parsing Functions
 func splitId(in, expectedService, expectedResource string) (string, string, error) {
 	// Note: this could be stolen from the helpers directory in the TF AzureRM
 	// provider but I'm not at the moment because it does a bunch of trickery
-	// for some Azure APIs and we have a much more limited scope. I may come to
-	// regret this.
+	// for some Azure APIs and we have a much more limited scope.
 	splitId := strings.Split(strings.TrimLeft(in, "/"), "/")
+
 	// Run through some sanity checks
 	if len(splitId) != 8 ||
 		!strings.EqualFold(splitId[0], constSubscriptions) ||
@@ -423,47 +464,39 @@ func splitId(in, expectedService, expectedResource string) (string, string, erro
 	return splitId[3], splitId[7], nil
 }

-// Returns an invalid argument error with the problematic fields included
-// in the error message.
-func invalidArgumentError(msg string, f map[string]string) error {
-	var fieldMsgs []string
-	for field, val := range f {
-		fieldMsgs = append(fieldMsgs, fmt.Sprintf("%q: %q", field, val))
+func extractResourceType(resourceID string) (string, error) {
+	if resourceID == "" {
+		return "", fmt.Errorf("empty resource ID provided")
 	}
-	if len(fieldMsgs) > 0 {
-		msg = fmt.Sprintf("%s: [%s]", msg, strings.Join(fieldMsgs, ", "))
+
+	parts := strings.Split(strings.TrimLeft(resourceID, "/"), "/")
+
+	// Validate minimum length and basic structure
+	if len(parts) < 6 {
+		return "", fmt.Errorf("resource ID too short: %s", resourceID)
 	}
-	return status.Error(codes.InvalidArgument, msg)
-}
-
-func validateSecrets(s *structpb.Struct) error {
-	if s == nil {
-		return status.Error(codes.InvalidArgument, "Secrets not provided but are required")
-	}
-	var secrets SecretData
-	if err := mapstructure.Decode(s.AsMap(), &secrets); err != nil {
-		return status.Errorf(codes.InvalidArgument, "error decoding catalog secrets: %s", err)
-	}
-	badFields := make(map[string]string)
-	if len(secrets.SecretValue) == 0 {
-		badFields["secrets.secret_value"] = "This field is required."
-	}
-	if len(secrets.CredsLastRotatedTime) != 0 {
-		badFields["secrets.creds_last_rotated_time"] = "This field is reserved and cannot be set."
-	}
-	if len(badFields) > 0 {
-		return invalidArgumentError("Error in the secrets provided", badFields)
-	}
-	return nil
-}
-
-var allowedCatalogFields = map[string]struct{}{
-	constDisableCredentialRotation: {},
-	constSubscriptionId:            {},
-	constTenantId:                  {},
-	constClientId:                  {},
+
+	// Check for required segments in correct positions
+	if !strings.EqualFold(parts[0], constSubscriptions) ||
+		!strings.EqualFold(parts[2], constResourceGroups) ||
+		!strings.EqualFold(parts[4], constProviders) {
+		return "", fmt.Errorf("malformed resource ID, missing required segments: %s", resourceID)
+	}
+
+	// Check for Microsoft.Compute in correct position
+	if !strings.EqualFold(parts[5], constMsComputeService) {
+		return "", nil // Not a compute resource, return empty string without error
+	}
+
+	// Ensure there's a resource type after Microsoft.Compute
+	if len(parts) < 7 {
+		return "", fmt.Errorf("no resource type found after Microsoft.Compute: %s", resourceID)
+	}
+
+	return parts[6], nil
 }

+// Validation Functions
 func validateCatalog(c *hostcatalogs.HostCatalog) error {
 	if c == nil {
 		return status.Error(codes.InvalidArgument, "catalog is nil")
@@ -473,6 +506,7 @@ func validateCatalog(c *hostcatalogs.HostCatalog) error {
 	if err := mapstructure.Decode(attrMap, &attrs); err != nil {
 		return status.Errorf(codes.InvalidArgument, "error decoding catalog attributes: %s", err)
 	}
+
 	badFields := make(map[string]string)
 	if !attrs.DisableCredentialRotation {
 		badFields["attributes.disable_credential_rotation"] = "This field must be set to true."
@@ -499,8 +533,26 @@ func validateCatalog(c *hostcatalogs.HostCatalog) error {
 	return nil
 }

-var allowedSetFields = map[string]struct{}{
-	constFilter: {},
+func validateSecrets(s *structpb.Struct) error {
+	if s == nil {
+		return status.Error(codes.InvalidArgument, "Secrets not provided but are required")
+	}
+	var secrets SecretData
+	if err := mapstructure.Decode(s.AsMap(), &secrets); err != nil {
+		return status.Errorf(codes.InvalidArgument, "error decoding catalog secrets: %s", err)
+	}
+
+	badFields := make(map[string]string)
+	if len(secrets.SecretValue) == 0 {
+		badFields["secrets.secret_value"] = "This field is required."
+	}
+	if len(secrets.CredsLastRotatedTime) != 0 {
+		badFields["secrets.creds_last_rotated_time"] = "This field is reserved and cannot be set."
+	}
+	if len(badFields) > 0 {
+		return invalidArgumentError("Error in the secrets provided", badFields)
+	}
+	return nil
 }

 func validateSet(s *hostsets.HostSet) error {
@@ -512,6 +564,7 @@ func validateSet(s *hostsets.HostSet) error {
 	if err := mapstructure.Decode(attrMap, &attrs); err != nil {
 		return status.Errorf(codes.InvalidArgument, "error decoding set attributes: %s", err)
 	}
+
 	badFields := make(map[string]string)
 	if _, ok := attrMap[constFilter]; ok && len(attrs.Filter) == 0 {
 		badFields["attributes.filter"] = "This field must be not empty."
@@ -528,3 +581,27 @@ func validateSet(s *hostsets.HostSet) error {
 	}
 	return nil
 }
+
+// Error Handling Functions
+func invalidArgumentError(msg string, f map[string]string) error {
+	var fieldMsgs []string
+	for field, val := range f {
+		fieldMsgs = append(fieldMsgs, fmt.Sprintf("%q: %q", field, val))
+	}
+	if len(fieldMsgs) > 0 {
+		msg = fmt.Sprintf("%s: [%s]", msg, strings.Join(fieldMsgs, ", "))
+	}
+	return status.Error(codes.InvalidArgument, msg)
+}
+
+// Map Definitions for Allowed Fields
+var allowedCatalogFields = map[string]struct{}{
+	constDisableCredentialRotation: {},
+	constSubscriptionId:            {},
+	constTenantId:                  {},
+	constClientId:                  {},
+}
+
+var allowedSetFields = map[string]struct{}{
+	constFilter: {},
+}
@@ -1,4 +1,4 @@
-// Copyright (c) HashiCorp, Inc.
+// Copyright IBM Corp. 2021, 2026
 // SPDX-License-Identifier: MPL-2.0

 package plugin
@@ -7,12 +7,14 @@ import (
 	"context"
 	"os"
 	"path/filepath"
+	"reflect"
+	"strings"
 	"testing"
 	"time"

-	"github.com/hashicorp/boundary/sdk/pbs/controller/api/resources/hostcatalogs"
-	"github.com/hashicorp/boundary/sdk/pbs/controller/api/resources/hostsets"
-	pb "github.com/hashicorp/boundary/sdk/pbs/plugin"
+	"repo.anhonesthost.net/CyberCoveLLC/threshold/sdk/pbs/controller/api/resources/hostcatalogs"
+	"repo.anhonesthost.net/CyberCoveLLC/threshold/sdk/pbs/controller/api/resources/hostsets"
+	pb "repo.anhonesthost.net/CyberCoveLLC/threshold/sdk/pbs/plugin"
 	"github.com/hashicorp/go-secure-stdlib/parseutil"
 	"github.com/kr/pretty"
 	"github.com/manicminer/hamilton/auth"
@@ -448,7 +450,7 @@ func testGetHostStructs(t *testing.T) (*hostcatalogs.HostCatalog, []*hostsets.Ho
 			Id: "set1",
 			Attrs: &hostsets.HostSet_Attributes{
 				Attributes: wrapMap(t, map[string]interface{}{
-					constFilter: constDefaultFilter,
+					constFilter: "",
 				}),
 			},
 		},
@@ -456,7 +458,7 @@ func testGetHostStructs(t *testing.T) (*hostcatalogs.HostCatalog, []*hostsets.Ho
 			Id: "set2",
 			Attrs: &hostsets.HostSet_Attributes{
 				Attributes: wrapMap(t, map[string]interface{}{
-					constFilter: constDefaultFilter,
+					constFilter: "",
 				}),
 			},
 		},
@@ -505,3 +507,287 @@ func testCreateInitialSecret(t *testing.T, hostCatalog *hostcatalogs.HostCatalog

 	return authzInfo, initialCred, cleanup
 }
+
+func TestSplitId(t *testing.T) {
+	tests := []struct {
+		name             string
+		input            string
+		expectedService  string
+		expectedResource string
+		wantRG           string
+		wantName         string
+		wantErr          bool
+	}{
+		{
+			name:             "valid resource id",
+			input:            "/subscriptions/sub1/resourceGroups/rg1/providers/Microsoft.Compute/virtualMachines/vm1",
+			expectedService:  "Microsoft.Compute",
+			expectedResource: "virtualMachines",
+			wantRG:           "rg1",
+			wantName:         "vm1",
+			wantErr:          false,
+		},
+		{
+			name:             "valid with different case",
+			input:            "/SUBSCRIPTIONS/sub1/RESOURCEGROUPS/rg1/PROVIDERS/MICROSOFT.COMPUTE/VIRTUALMACHINES/vm1",
+			expectedService:  "Microsoft.Compute",
+			expectedResource: "virtualMachines",
+			wantRG:           "rg1",
+			wantName:         "vm1",
+			wantErr:          false,
+		},
+		{
+			name:             "invalid - trailing slash",
+			input:            "/subscriptions/sub1/resourceGroups/rg1/providers/Microsoft.Compute/virtualMachines/vm1/",
+			expectedService:  "Microsoft.Compute",
+			expectedResource: "virtualMachines",
+			wantRG:           "",
+			wantName:         "",
+			wantErr:          true,
+		},
+		{
+			name:             "invalid - wrong service",
+			input:            "/subscriptions/sub1/resourceGroups/rg1/providers/Microsoft.Storage/virtualMachines/vm1",
+			expectedService:  "Microsoft.Compute",
+			expectedResource: "virtualMachines",
+			wantRG:           "",
+			wantName:         "",
+			wantErr:          true,
+		},
+		{
+			name:             "invalid - wrong resource type",
+			input:            "/subscriptions/sub1/resourceGroups/rg1/providers/Microsoft.Compute/diskEncryptionSets/des1",
+			expectedService:  "Microsoft.Compute",
+			expectedResource: "virtualMachines",
+			wantRG:           "",
+			wantName:         "",
+			wantErr:          true,
+		},
+		{
+			name:             "invalid - missing segments",
+			input:            "/subscriptions/sub1/resourceGroups/rg1",
+			expectedService:  "Microsoft.Compute",
+			expectedResource: "virtualMachines",
+			wantRG:           "",
+			wantName:         "",
+			wantErr:          true,
+		},
+		{
+			name:             "invalid - empty string",
+			input:            "",
+			expectedService:  "Microsoft.Compute",
+			expectedResource: "virtualMachines",
+			wantRG:           "",
+			wantName:         "",
+			wantErr:          true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			gotRG, gotName, err := splitId(tt.input, tt.expectedService, tt.expectedResource)
+			if (err != nil) != tt.wantErr {
+				t.Errorf("splitId() error = %v, wantErr %v", err, tt.wantErr)
+				return
+			}
+			if gotRG != tt.wantRG {
+				t.Errorf("splitId() gotRG = %v, want %v", gotRG, tt.wantRG)
+			}
+			if gotName != tt.wantName {
+				t.Errorf("splitId() gotName = %v, want %v", gotName, tt.wantName)
+			}
+		})
+	}
+}
+
+func TestExtractResourceType(t *testing.T) {
+	tests := []struct {
+		name    string
+		input   string
+		want    string
+		wantErr bool
+	}{
+		{
+			name:    "valid compute resource",
+			input:   "/subscriptions/sub1/resourceGroups/rg1/providers/Microsoft.Compute/virtualMachines/vm1",
+			want:    "virtualMachines",
+			wantErr: false,
+		},
+		{
+			name:    "valid compute resource different case",
+			input:   "/subscriptions/sub1/resourceGroups/rg1/providers/MICROSOFT.COMPUTE/virtualMachines/vm1",
+			want:    "virtualMachines",
+			wantErr: false,
+		},
+		{
+			name:    "valid with trailing slash",
+			input:   "/subscriptions/sub1/resourceGroups/rg1/providers/Microsoft.Compute/virtualMachines/vm1/",
+			want:    "virtualMachines",
+			wantErr: false,
+		},
+		{
+			name:    "different compute resource type",
+			input:   "/subscriptions/sub1/resourceGroups/rg1/providers/Microsoft.Compute/diskEncryptionSets/des1",
+			want:    "diskEncryptionSets",
+			wantErr: false,
+		},
+		{
+			name:    "non-compute resource",
+			input:   "/subscriptions/sub1/resourceGroups/rg1/providers/Microsoft.Storage/storageAccounts/sa1",
+			want:    "",
+			wantErr: false,
+		},
+		{
+			name:    "malformed - missing provider",
+			input:   "/subscriptions/sub1/resourceGroups/rg1/Microsoft.Compute/virtualMachines/vm1",
+			want:    "",
+			wantErr: true,
+		},
+		{
+			name:    "malformed - missing resource type",
+			input:   "/subscriptions/sub1/resourceGroups/rg1/providers/Microsoft.Compute",
+			want:    "",
+			wantErr: true,
+		},
+		{
+			name:    "empty string",
+			input:   "",
+			want:    "",
+			wantErr: true,
+		},
+		{
+			name:    "too short",
+			input:   "/subscriptions/sub1",
+			want:    "",
+			wantErr: true,
+		},
+		{
+			name:    "malformed structure",
+			input:   "/something/else/entirely",
+			want:    "",
+			wantErr: true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got, err := extractResourceType(tt.input)
+			if (err != nil) != tt.wantErr {
+				t.Errorf("extractResourceType() error = %v, wantErr %v", err, tt.wantErr)
+				return
+			}
+			if got != tt.want {
+				t.Errorf("extractResourceType() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}
+
+func TestCreateHostFromResource(t *testing.T) {
+	// Setup common test data
+	testNetwork := networkInfo{
+		IpAddresses: []string{"192.168.1.1", "192.168.1.2"},
+	}
+
+	// Use full Azure resource paths as keys
+	vmssPath := "/subscriptions/sub1/resourceGroups/rg1/providers/Microsoft.Compute/virtualMachineScaleSets/vmss1"
+	vmPath := "/subscriptions/sub1/resourceGroups/rg1/providers/Microsoft.Compute/virtualMachines/vm-resource1"
+
+	resourceToSetMap := map[string][]string{
+		vmssPath: {"set1", "set2"},
+		vmPath:   {"set3", "set4"},
+	}
+
+	tests := []struct {
+		name       string
+		resourceID string
+		network    networkInfo
+		setMap     map[string][]string
+		want       *pb.ListHostsResponseHost
+		wantErr    bool
+		errMessage string
+	}{
+		{
+			name:       "valid VMSS resource",
+			resourceID: vmssPath + "/virtualMachines/vm1",
+			network:    testNetwork,
+			setMap:     resourceToSetMap,
+			want: &pb.ListHostsResponseHost{
+				ExternalId:   vmssPath + "/virtualMachines/vm1",
+				ExternalName: "vmss1_vm1",
+				IpAddresses:  []string{"192.168.1.1", "192.168.1.2"},
+				SetIds:       []string{"set1", "set2"},
+			},
+			wantErr: false,
+		},
+		{
+			name:       "valid VM resource",
+			resourceID: vmPath,
+			network:    testNetwork,
+			setMap:     resourceToSetMap,
+			want: &pb.ListHostsResponseHost{
+				ExternalId:   vmPath,
+				ExternalName: "vm-resource1",
+				IpAddresses:  []string{"192.168.1.1", "192.168.1.2"},
+				SetIds:       []string{"set3", "set4"},
+			},
+			wantErr: false,
+		},
+		{
+			name:       "invalid resource ID",
+			resourceID: "invalid-resource-id",
+			network:    testNetwork,
+			setMap:     resourceToSetMap,
+			want:       nil,
+			wantErr:    true,
+			errMessage: "invalid resource ID",
+		},
+		{
+			name:       "unsupported resource type",
+			resourceID: "/subscriptions/sub1/resourceGroups/rg1/providers/Microsoft.Compute/unsupportedResource/resource1",
+			network:    testNetwork,
+			setMap:     resourceToSetMap,
+			want:       nil,
+			wantErr:    true,
+			errMessage: "unsupported resource type",
+		},
+		{
+			name:       "VMSS with valid resource type but invalid structure",
+			resourceID: "/subscriptions/sub1/resourceGroups/rg1/providers/Microsoft.Compute/virtualMachineScaleSets", // Missing required segments after virtualMachineScaleSets
+			network:    testNetwork,
+			setMap:     resourceToSetMap,
+			want:       nil,
+			wantErr:    true,
+			errMessage: "could not determine set for resource ID: not a valid VMSS resource ID",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got, err := createHostFromResource(tt.resourceID, tt.network, tt.setMap)
+
+			// Check error cases
+			if tt.wantErr {
+				if err == nil {
+					t.Errorf("createHostFromResource() expected error containing %q, got nil", tt.errMessage)
+					return
+				}
+				if !strings.Contains(err.Error(), tt.errMessage) {
+					t.Errorf("createHostFromResource() error = %v, want error containing %q", err, tt.errMessage)
+				}
+				return
+			}
+
+			// Check non-error cases
+			if err != nil {
+				t.Errorf("createHostFromResource() unexpected error: %v", err)
+				return
+			}
+
+			// Compare the results
+			if !reflect.DeepEqual(got, tt.want) {
+				t.Errorf("createHostFromResource() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}
@@ -0,0 +1,134 @@
+// Copyright IBM Corp. 2021, 2026
+// SPDX-License-Identifier: MPL-2.0
+
+package plugin
+
+import (
+	"context"
+	"fmt"
+	"strings"
+	"sync"
+
+	"github.com/Azure/azure-sdk-for-go/profiles/latest/compute/mgmt/compute"
+	"github.com/Azure/azure-sdk-for-go/profiles/latest/resources/mgmt/resources"
+	"golang.org/x/sync/errgroup"
+)
+
+// vmJob represents a single VM processing job
+type vmJob struct {
+	resource      resources.GenericResourceExpanded
+	resourceGroup string
+	name          string
+}
+
+func (p *AzurePlugin) processStandardVMs(ctx context.Context, resourceInfos []resources.GenericResourceExpanded,
+	clients *azureClients) (map[string]networkInfo, error) {
+
+	// Initialize the map that we'll return
+	vmToNetworkMap := make(map[string]networkInfo)
+
+	// Pre-validate all resource IDs and create jobs slice
+	jobs := make([]vmJob, 0, len(resourceInfos))
+	for _, res := range resourceInfos {
+		resourceGroup, name, err := splitId(*res.ID, constMsComputeService, constVirtualMachinesResource)
+		if err != nil {
+			return nil, fmt.Errorf("invalid vm id %q: %w", *res.ID, err)
+		}
+		jobs = append(jobs, vmJob{
+			resource:      res,
+			resourceGroup: resourceGroup,
+			name:          name,
+		})
+	}
+
+	// Create error group for worker management
+	g, ctx := errgroup.WithContext(ctx)
+
+	// Create job channel
+	jobsChan := make(chan vmJob)
+
+	// Result handling
+	mu := &sync.Mutex{}
+
+	// Start worker pool
+	for i := 0; i < constDefaultWorkers; i++ {
+		g.Go(func() error {
+			for job := range jobsChan {
+				// Process single VM
+				vm, err := clients.vmClient.Get(ctx, job.resourceGroup, job.name, "")
+				if err != nil {
+					return fmt.Errorf("error fetching vm with id %q: %w", *job.resource.ID, err)
+				}
+
+				// Only process running VMs
+				running, err := isVMRunning(ctx, clients.vmClient, job.resourceGroup, job.name)
+				if err != nil {
+					return err
+				}
+				if !running {
+					continue
+				}
+
+				var netInfo networkInfo
+				if err := processVMNetworkInterfaces(ctx, vm, clients, job.resourceGroup, &netInfo); err != nil {
+					return err
+				}
+
+				mu.Lock()
+				vmToNetworkMap[*job.resource.ID] = netInfo
+				mu.Unlock()
+			}
+			return nil
+		})
+	}
+
+	// Send jobs to workers
+	go func() {
+		defer close(jobsChan)
+		for _, job := range jobs {
+			// Check context cancellation
+			if ctx.Err() != nil {
+				return
+			}
+			jobsChan <- job
+		}
+	}()
+
+	// Wait for all workers to complete
+	if err := g.Wait(); err != nil {
+		return nil, err
+	}
+
+	return vmToNetworkMap, nil
+}
+
+// VM Status Check
+func isVMRunning(
+	ctx context.Context,
+	vmClient *compute.VirtualMachinesClient,
+	resourceGroup,
+	name string,
+) (
+	bool,
+	error,
+) {
+
+	iv, err := vmClient.InstanceView(ctx, resourceGroup, name)
+	if err != nil {
+		return false, fmt.Errorf("error fetching instance view for vm %s: %w", name, err)
+	}
+	if iv.Statuses == nil {
+		return false, fmt.Errorf("instance view statuses is null for vm %s", name)
+	}
+
+	for _, s := range *iv.Statuses {
+		if s.Code == nil {
+			continue
+		}
+		state := strings.ToLower(*s.Code)
+		if strings.HasPrefix(state, "powerstate/") && strings.TrimPrefix(state, "powerstate/") == "running" {
+			return true, nil
+		}
+	}
+	return false, nil
+}
@@ -0,0 +1,305 @@
+// Copyright IBM Corp. 2021, 2026
+// SPDX-License-Identifier: MPL-2.0
+
+package plugin
+
+import (
+	"context"
+	"fmt"
+	"strings"
+	"sync"
+
+	"github.com/Azure/azure-sdk-for-go/profiles/latest/compute/mgmt/compute"
+	"github.com/Azure/azure-sdk-for-go/profiles/latest/resources/mgmt/resources"
+	"golang.org/x/sync/errgroup"
+)
+
+// vmssJob represents a single VMSS processing job
+type vmssJob struct {
+	resource      resources.GenericResourceExpanded
+	resourceGroup string
+	name          string
+}
+
+// vmssInstanceJob represents a single VMSS instance processing job
+type vmssInstanceJob struct {
+	vmssvm        compute.VirtualMachineScaleSetVM
+	resourceGroup string
+	vmssName      string
+}
+
+func (p *AzurePlugin) processVMScaleSets(
+	ctx context.Context,
+	resourceInfos []resources.GenericResourceExpanded,
+	clients *azureClients,
+) (
+	map[string]networkInfo,
+	error,
+) {
+
+	// Initialize the map that we'll return
+	vmToNetworkMap := make(map[string]networkInfo)
+
+	// Pre-validate all resource IDs and create jobs slice
+	jobs := make([]vmssJob, 0, len(resourceInfos))
+	for _, res := range resourceInfos {
+		resourceGroup, name, err := splitId(*res.ID, constMsComputeService, constVirtualMachineScaleSetsResource)
+		if err != nil {
+			return nil, fmt.Errorf("invalid vmss id %q: %w", *res.ID, err)
+		}
+		jobs = append(jobs, vmssJob{
+			resource:      res,
+			resourceGroup: resourceGroup,
+			name:          name,
+		})
+	}
+
+	// Create error group for worker management
+	g, ctx := errgroup.WithContext(ctx)
+
+	// Create job channel
+	jobsChan := make(chan vmssJob)
+
+	// Start worker pool
+	for i := 0; i < constDefaultWorkers; i++ {
+		g.Go(func() error {
+			for job := range jobsChan {
+				vmss, err := clients.vmssClient.Get(ctx, job.resourceGroup, job.name, "")
+				if err != nil {
+					return fmt.Errorf("error fetching vmss with id %q: %w", *job.resource.ID, err)
+				}
+
+				// Check if VMSS properties exist
+				if vmss.VirtualMachineScaleSetProperties == nil {
+					continue
+				}
+				vmssProperties := vmss.VirtualMachineScaleSetProperties
+
+				// Skip if OrchestrationMode is empty or Flexible
+				if vmssProperties.OrchestrationMode == "" {
+					continue
+				}
+				if vmssProperties.OrchestrationMode == compute.OrchestrationModeFlexible {
+					continue
+				}
+
+				if err := processVMSSInstancesParallel(ctx, vmss, job.resourceGroup, clients, vmToNetworkMap); err != nil {
+					return fmt.Errorf("error processing uniform vmss instances: %w", err)
+				}
+			}
+			return nil
+		})
+	}
+
+	// Send jobs to workers
+	go func() {
+		defer close(jobsChan)
+		for _, job := range jobs {
+			if ctx.Err() != nil {
+				return
+			}
+			jobsChan <- job
+		}
+	}()
+
+	// Wait for all workers to complete
+	if err := g.Wait(); err != nil {
+		return nil, err
+	}
+
+	return vmToNetworkMap, nil
+}
+
+func processVMSSInstancesParallel(
+	ctx context.Context,
+	vmss compute.VirtualMachineScaleSet,
+	resourceGroup string,
+	clients *azureClients,
+	vmToNetworkMap map[string]networkInfo,
+) error {
+
+	if vmss.Name == nil {
+		return fmt.Errorf("vmss name is nil")
+	}
+
+	vmssvms, err := clients.vmssvmClient.List(ctx, resourceGroup, *vmss.Name, "", "", "")
+	if err != nil {
+		return fmt.Errorf("error fetching vms for vmss %s: %w", *vmss.Name, err)
+	}
+
+	// Create new error group for instance processing
+	g, ctx := errgroup.WithContext(ctx)
+	instanceJobs := make(chan vmssInstanceJob)
+
+	// Start instance workers
+	instanceWorkerCount := constDefaultWorkers
+	if len(vmssvms.Values()) < instanceWorkerCount {
+		instanceWorkerCount = len(vmssvms.Values())
+	}
+
+	mu := &sync.Mutex{}
+
+	// Start instance worker pool
+	for i := 0; i < instanceWorkerCount; i++ {
+		g.Go(func() error {
+			for job := range instanceJobs {
+				if job.vmssvm.ID == nil {
+					return fmt.Errorf("nil ID for vmss vm in scale set %s", *vmss.Name)
+				}
+
+				if err := processVMSSInstanceParallel(ctx, job.vmssvm, job.resourceGroup,
+					job.vmssName, clients, vmToNetworkMap, mu); err != nil {
+					return fmt.Errorf("error processing vmss instance %s: %w", *job.vmssvm.ID, err)
+				}
+			}
+			return nil
+		})
+	}
+
+	// Send instance jobs
+	go func() {
+		defer close(instanceJobs)
+		for _, vmssvm := range vmssvms.Values() {
+			select {
+			case <-ctx.Done():
+				return
+			default:
+			}
+
+			instanceJobs <- vmssInstanceJob{
+				vmssvm:        vmssvm,
+				resourceGroup: resourceGroup,
+				vmssName:      *vmss.Name,
+			}
+		}
+	}()
+
+	return g.Wait()
+}
+
+func processVMSSInstanceParallel(
+	ctx context.Context,
+	vmssvm compute.VirtualMachineScaleSetVM,
+	resourceGroup,
+	vmssName string,
+	clients *azureClients,
+	vmToNetworkMap map[string]networkInfo,
+	mu *sync.Mutex,
+) error {
+
+	if vmssvm.InstanceID == nil {
+		return fmt.Errorf("instance ID is nil")
+	}
+
+	// Check if instance is running
+	if running, err := isVMSSInstanceRunning(ctx, clients.vmssvmClient, resourceGroup,
+		vmssName, vmssvm.InstanceID); err != nil {
+		return err
+	} else if !running {
+		return nil
+	}
+
+	// Process network interfaces for the instance
+	var netInfo networkInfo
+	if err := processVMSSNetworkInterfaces(ctx, vmssvm, resourceGroup, vmssName, clients, &netInfo); err != nil {
+		return err
+	}
+
+	func() {
+		mu.Lock()
+		defer mu.Unlock()
+		vmToNetworkMap[*vmssvm.ID] = netInfo
+	}()
+
+	return nil
+}
+
+// VMSS Instance Status Check
+func isVMSSInstanceRunning(
+	ctx context.Context,
+	vmssvmClient *compute.VirtualMachineScaleSetVMsClient,
+	resourceGroup,
+	vmssName string,
+	instanceID *string,
+) (
+	bool,
+	error,
+) {
+
+	if instanceID == nil {
+		return false, fmt.Errorf("instance ID is nil")
+	}
+
+	iv, err := vmssvmClient.GetInstanceView(ctx, resourceGroup, vmssName, *instanceID)
+	if err != nil {
+		return false, fmt.Errorf("error fetching instance view for instance %s: %w", *instanceID, err)
+	}
+	if iv.Statuses == nil {
+		return false, fmt.Errorf("instance view statuses returned for instance %s is null", *instanceID)
+	}
+
+	for _, s := range *iv.Statuses {
+		if s.Code == nil {
+			continue
+		}
+		state := strings.ToLower(*s.Code)
+		prefix := "powerstate/"
+		if !strings.HasPrefix(state, prefix) {
+			continue
+		}
+		state = strings.TrimPrefix(state, prefix)
+		if state == "running" {
+			return true, nil
+		}
+	}
+	return false, nil
+}
+
+// Helper Functions
+func getSetForVMSSInstance(in string) (string, error) {
+	if in == "" {
+		return "", fmt.Errorf("empty resource ID provided")
+	}
+
+	// Split the path into segments
+	segments := strings.Split(strings.TrimLeft(in, "/"), "/")
+
+	// Check if this is a VMSS path by looking for required segments
+	if len(segments) < 8 ||
+		!strings.EqualFold(segments[0], constSubscriptions) ||
+		!strings.EqualFold(segments[2], constResourceGroups) ||
+		!strings.EqualFold(segments[4], constProviders) ||
+		!strings.EqualFold(segments[5], constMsComputeService) ||
+		!strings.EqualFold(segments[6], constVirtualMachineScaleSetsResource) {
+		return "", fmt.Errorf("not a valid VMSS resource ID: %s", in)
+	}
+
+	// Reconstruct the VMSS path (everything up to but not including virtualMachines)
+	vmssPath := "/" + strings.Join(segments[:8], "/")
+
+	// Additional validation: if the path contains virtualMachines, it should be in the correct position
+	for i, segment := range segments[8:] {
+		if strings.EqualFold(segment, constVirtualMachinesResource) {
+			if i != 0 { // virtualMachines should be immediately after VMSS name
+				return "", fmt.Errorf("unexpected virtualMachines segment position in resource ID: %s", in)
+			}
+			break
+		}
+	}
+
+	return vmssPath, nil
+}
+
+func getExternalNameforVMSSInstance(in string) (string, error) {
+	splitId := strings.Split(strings.TrimLeft(in, "/"), "/")
+	if len(splitId) != 10 ||
+		!strings.EqualFold(splitId[0], constSubscriptions) ||
+		!strings.EqualFold(splitId[2], constResourceGroups) ||
+		!strings.EqualFold(splitId[4], constProviders) ||
+		!strings.EqualFold(splitId[5], constMsComputeService) ||
+		!strings.EqualFold(splitId[6], constVirtualMachineScaleSetsResource) ||
+		!strings.EqualFold(splitId[8], constVirtualMachinesResource) {
+		return "", fmt.Errorf("unexpected format of virtual machine stateful set ID: %v", splitId)
+	}
+	return splitId[7] + "_" + splitId[9], nil
+}
@@ -0,0 +1,156 @@
+// Copyright IBM Corp. 2021, 2026
+// SPDX-License-Identifier: MPL-2.0
+
+package plugin
+
+import (
+	"testing"
+)
+
+func TestGetExternalNameforVMSSInstance(t *testing.T) {
+	tests := []struct {
+		name    string
+		input   string
+		want    string
+		wantErr bool
+	}{
+		{
+			name:    "valid vmss instance id",
+			input:   "/subscriptions/sub1/resourceGroups/rg1/providers/Microsoft.Compute/virtualMachineScaleSets/vmss1/virtualMachines/instance1",
+			want:    "vmss1_instance1",
+			wantErr: false,
+		},
+		{
+			name:    "invalid - vmss instance id with trailing slash",
+			input:   "/subscriptions/sub1/resourceGroups/rg1/providers/Microsoft.Compute/virtualMachineScaleSets/vmss1/virtualMachines/instance1/",
+			want:    "",
+			wantErr: true,
+		},
+		{
+			name:    "case insensitive segment validation",
+			input:   "/SUBSCRIPTIONS/sub1/RESOURCEGROUPS/rg1/PROVIDERS/MICROSOFT.COMPUTE/VIRTUALMACHINESCALESETS/vmss1/VIRTUALMACHINES/instance1",
+			want:    "vmss1_instance1",
+			wantErr: false,
+		},
+		{
+			name:    "invalid - missing segment",
+			input:   "/subscriptions/sub1/resourceGroups/rg1/providers/Microsoft.Compute/virtualMachineScaleSets/vmss1",
+			want:    "",
+			wantErr: true,
+		},
+		{
+			name:    "invalid - wrong resource type",
+			input:   "/subscriptions/sub1/resourceGroups/rg1/providers/Microsoft.Storage/storageAccounts/sa1",
+			want:    "",
+			wantErr: true,
+		},
+		{
+			name:    "invalid - empty string",
+			input:   "",
+			want:    "",
+			wantErr: true,
+		},
+		{
+			name:    "invalid - malformed id",
+			input:   "invalid/format/string",
+			want:    "",
+			wantErr: true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got, err := getExternalNameforVMSSInstance(tt.input)
+			if (err != nil) != tt.wantErr {
+				t.Errorf("getExternalNameforVMSSInstance() error = %v, wantErr %v", err, tt.wantErr)
+				return
+			}
+			if got != tt.want {
+				t.Errorf("getExternalNameforVMSSInstance() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}
+
+func TestGetSetForVMSSInstance(t *testing.T) {
+	tests := []struct {
+		name    string
+		input   string
+		want    string
+		wantErr bool
+	}{
+		{
+			name:    "valid vmss instance id",
+			input:   "/subscriptions/sub1/resourceGroups/rg1/providers/Microsoft.Compute/virtualMachineScaleSets/vmss1/virtualMachines/instance1",
+			want:    "/subscriptions/sub1/resourceGroups/rg1/providers/Microsoft.Compute/virtualMachineScaleSets/vmss1",
+			wantErr: false,
+		},
+		{
+			name:    "valid vmss path without instance",
+			input:   "/subscriptions/sub1/resourceGroups/rg1/providers/Microsoft.Compute/virtualMachineScaleSets/vmss1",
+			want:    "/subscriptions/sub1/resourceGroups/rg1/providers/Microsoft.Compute/virtualMachineScaleSets/vmss1",
+			wantErr: false,
+		},
+		{
+			name:    "case insensitive validation",
+			input:   "/SUBSCRIPTIONS/sub1/RESOURCEGROUPS/rg1/PROVIDERS/MICROSOFT.COMPUTE/VIRTUALMACHINESCALESETS/vmss1",
+			want:    "/SUBSCRIPTIONS/sub1/RESOURCEGROUPS/rg1/PROVIDERS/MICROSOFT.COMPUTE/VIRTUALMACHINESCALESETS/vmss1",
+			wantErr: false,
+		},
+		{
+			name:    "path with trailing slash",
+			input:   "/subscriptions/sub1/resourceGroups/rg1/providers/Microsoft.Compute/virtualMachineScaleSets/vmss1/virtualMachines/instance1/",
+			want:    "/subscriptions/sub1/resourceGroups/rg1/providers/Microsoft.Compute/virtualMachineScaleSets/vmss1",
+			wantErr: false,
+		},
+		{
+			name:    "empty string",
+			input:   "",
+			want:    "",
+			wantErr: true,
+		},
+		{
+			name:    "invalid - flexible orchestration mode VM path",
+			input:   "/subscriptions/sub1/resourceGroups/rg1/providers/Microsoft.Compute/virtualMachines/vmss1_instance1",
+			want:    "",
+			wantErr: true,
+		},
+		{
+			name:    "invalid - wrong provider",
+			input:   "/subscriptions/sub1/resourceGroups/rg1/providers/Microsoft.Storage/virtualMachineScaleSets/vmss1",
+			want:    "",
+			wantErr: true,
+		},
+		{
+			name:    "invalid - malformed path missing segments",
+			input:   "/subscriptions/sub1/resourceGroups",
+			want:    "",
+			wantErr: true,
+		},
+		{
+			name:    "invalid - malformed with virtualMachines in wrong position",
+			input:   "/subscriptions/sub1/resourceGroups/rg1/virtualMachines/providers/Microsoft.Compute/virtualMachineScaleSets/vmss1",
+			want:    "",
+			wantErr: true,
+		},
+		{
+			name:    "invalid - random string",
+			input:   "not/a/valid/path",
+			want:    "",
+			wantErr: true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got, err := getSetForVMSSInstance(tt.input)
+			if (err != nil) != tt.wantErr {
+				t.Errorf("getSetForVMSSInstance() error = %v, wantErr %v", err, tt.wantErr)
+				return
+			}
+			if got != tt.want {
+				t.Errorf("getSetForVMSSInstance() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}
Author	SHA1	Message	Date
shadowdaoandClaude Sonnet 5.5	f5223dad37	Resolve dependencies against published threshold sdk v0.1.0 Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-10-12 10:35:52 -07:00
shadowdaoandClaude Sonnet 5.5	ad32c8d236	Rename module and SDK import paths for Threshold Fork of hashicorp/boundary-plugin-azure (MPL-2.0). Module path and Boundary SDK imports now point at repo.anhonesthost.net/CyberCoveLLC. Adds NOTICE and an About this fork section to the README. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-10-12 10:28:02 -07:00
dependabot[bot]	fd7980c462	Bump google.golang.org/grpc from 1.79.3 to 1.83.2 (#39 ) Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.79.3 to 1.83.2. - [Release notes](https://github.com/grpc/grpc-go/releases) - [Commits](https://github.com/grpc/grpc-go/compare/v1.79.3...v1.83.2) --- updated-dependencies: - dependency-name: google.golang.org/grpc dependency-version: 1.83.1 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-10-01 14:56:23 -04:00
dependabot[bot]	45229de40d	Bump golang.org/x/crypto from 0.46.0 to 0.52.0 (#37 ) Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.46.0 to 0.52.0. - [Commits](https://github.com/golang/crypto/compare/v0.46.0...v0.52.0) --- updated-dependencies: - dependency-name: golang.org/x/crypto dependency-version: 0.52.0 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-10-01 14:53:24 -04:00
hashicorp-copywrite[bot]	9559af5406	[COMPLIANCE] Add/Update Copyright Headers (#35 ) Co-authored-by: hashicorp-copywrite[bot] <110428419+hashicorp-copywrite[bot]@users.noreply.github.com>	2026-05-11 22:38:19 -07:00
dependabot[bot]	dd35aa2e9b	Bump google.golang.org/grpc from 1.56.3 to 1.79.3 (#34 ) Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.56.3 to 1.79.3. - [Release notes](https://github.com/grpc/grpc-go/releases) - [Commits](https://github.com/grpc/grpc-go/compare/v1.56.3...v1.79.3) --- updated-dependencies: - dependency-name: google.golang.org/grpc dependency-version: 1.79.3 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-04-22 21:11:07 -07:00
dependabot[bot]	7c7a6f8338	Bump golang.org/x/crypto from 0.36.0 to 0.45.0 (#32 ) Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.36.0 to 0.45.0. - [Commits](https://github.com/golang/crypto/compare/v0.36.0...v0.45.0) --- updated-dependencies: - dependency-name: golang.org/x/crypto dependency-version: 0.45.0 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-01-25 22:11:32 -08:00
oss-core-libraries-dashboard[bot]andhashicorp-copywrite[bot]	318dd936b4	[COMPLIANCE] Update Copyright and License Headers (Batch 1 of 1) (#33 ) Co-authored-by: hashicorp-copywrite[bot] <110428419+hashicorp-copywrite[bot]@users.noreply.github.com>	2026-01-16 15:55:43 -08:00
dependabot[bot]	1feb12773c	Bump golang.org/x/oauth2 from 0.7.0 to 0.27.0 (#31 ) Bumps [golang.org/x/oauth2](https://github.com/golang/oauth2) from 0.7.0 to 0.27.0. - [Commits](https://github.com/golang/oauth2/compare/v0.7.0...v0.27.0) --- updated-dependencies: - dependency-name: golang.org/x/oauth2 dependency-version: 0.27.0 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2025-07-18 14:51:50 -04:00
Katrina Schwark	2647d63f04	Pci pr template (#30 ) * Create pull_request_template.md * Update pull_request_template.md	2025-06-30 11:58:46 -06:00
dependabot[bot]	4c7b9ce1a8	Bump golang.org/x/net from 0.36.0 to 0.38.0 (#29 ) Bumps [golang.org/x/net](https://github.com/golang/net) from 0.36.0 to 0.38.0. - [Commits](https://github.com/golang/net/compare/v0.36.0...v0.38.0) --- updated-dependencies: - dependency-name: golang.org/x/net dependency-version: 0.38.0 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2025-04-16 16:25:37 -07:00
dependabot[bot]	3c634d99c7	Bump github.com/golang-jwt/jwt/v4 from 4.5.1 to 4.5.2 (#28 ) Bumps [github.com/golang-jwt/jwt/v4](https://github.com/golang-jwt/jwt) from 4.5.1 to 4.5.2. - [Release notes](https://github.com/golang-jwt/jwt/releases) - [Changelog](https://github.com/golang-jwt/jwt/blob/main/VERSION_HISTORY.md) - [Commits](https://github.com/golang-jwt/jwt/compare/v4.5.1...v4.5.2) --- updated-dependencies: - dependency-name: github.com/golang-jwt/jwt/v4 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2025-03-24 15:02:40 -07:00
dependabot[bot]	10b24a35bc	Bump golang.org/x/net from 0.33.0 to 0.36.0 (#27 ) Bumps [golang.org/x/net](https://github.com/golang/net) from 0.33.0 to 0.36.0. - [Commits](https://github.com/golang/net/compare/v0.33.0...v0.36.0) --- updated-dependencies: - dependency-name: golang.org/x/net dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2025-03-17 09:43:30 -07:00
hashicorp-copywrite[bot]	d7826fb66c	[COMPLIANCE] Add Copyright and License Headers (#26 ) Co-authored-by: hashicorp-copywrite[bot] <110428419+hashicorp-copywrite[bot]@users.noreply.github.com>	2025-02-04 09:56:48 -08:00
Benjamin HolmesandJohan Brandhorst-Satzkorn	30ea98c877	Add support for Virtual Machine Scale Sets in the Boundary Azure Plugin (#22 ) * first pass at pulling in VMSS data * infer vmss set id and external name from vmss data as none of these items are present by default * updated scale set name formatting to align with azure portal and json outputs * Update plugin/plugin.go Updated following code review Co-authored-by: Johan Brandhorst-Satzkorn <johan.brandhorst@gmail.com> * Update plugin/plugin.go Updated following code review Co-authored-by: Johan Brandhorst-Satzkorn <johan.brandhorst@gmail.com> * complete refactoring of initial implementation following code review, taking into accounts comments and common sense updates * updated README.md to reflect changes to support VMSS * fixed typo in README.md * WIP: initial updates following code review * refactored resource functions * removed instrumentation statements * resolve ifname comments * address formatting issues in accordance with style recommendations --------- Co-authored-by: Johan Brandhorst-Satzkorn <johan.brandhorst@gmail.com>	2025-01-22 10:36:03 -08:00
Irena Rindos	84ee22dcfd	chore: update deps (#25 )	2025-01-07 12:50:22 -05:00
dependabot[bot]	755c21fa6e	Bump golang.org/x/crypto from 0.21.0 to 0.31.0 (#24 ) Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.21.0 to 0.31.0. - [Commits](https://github.com/golang/crypto/compare/v0.21.0...v0.31.0) --- updated-dependencies: - dependency-name: golang.org/x/crypto dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2024-12-11 16:21:51 -08:00
Johan Brandhorst-Satzkorn	122de4a8f3	Update CODEOWNERS (#23 ) Make the owners effect with a wildcard	2024-11-18 16:23:24 -08:00
Johan Brandhorst-Satzkorn	78198bbdaa	chore: Add CODEOWNERS (#20 )	2024-11-07 10:24:13 -08:00
dependabot[bot]	70309a890e	Bump github.com/golang-jwt/jwt/v4 from 4.2.0 to 4.5.1 Bumps [github.com/golang-jwt/jwt/v4](https://github.com/golang-jwt/jwt) from 4.2.0 to 4.5.1. - [Release notes](https://github.com/golang-jwt/jwt/releases) - [Changelog](https://github.com/golang-jwt/jwt/blob/main/VERSION_HISTORY.md) - [Commits](https://github.com/golang-jwt/jwt/compare/v4.2.0...v4.5.1) --- updated-dependencies: - dependency-name: github.com/golang-jwt/jwt/v4 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>	2024-11-07 00:31:40 +00:00