Merge rebrand/phase-a: Threshold CLI/binary, packaging, docs, legacy fallbacks

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
2026-10-12 10:23:51 -07:00
commit 443e483a16
@@ -7,7 +7,7 @@ if [[ $remote_url == *"boundary-enterprise"* ]]; then
    exit 0
 fi

-if [ -f cmd/boundary/package_registration_ent.go ]; then
+if [ -f cmd/threshold/package_registration_ent.go ]; then
    echo "Found enterprise file while pushing to oss remote"
    exit 1
 fi
@@ -1,44 +0,0 @@
-# Copyright IBM Corp. 2020, 2026
-# SPDX-License-Identifier: BUSL-1.1
-
-schema = 1
-artifacts {
-  zip = [
-    "boundary_${version}_darwin_amd64.zip",
-    "boundary_${version}_darwin_arm64.zip",
-    "boundary_${version}_freebsd_386.zip",
-    "boundary_${version}_freebsd_amd64.zip",
-    "boundary_${version}_freebsd_arm.zip",
-    "boundary_${version}_linux_386.zip",
-    "boundary_${version}_linux_amd64.zip",
-    "boundary_${version}_linux_arm.zip",
-    "boundary_${version}_linux_arm64.zip",
-    "boundary_${version}_netbsd_386.zip",
-    "boundary_${version}_netbsd_amd64.zip",
-    "boundary_${version}_netbsd_arm.zip",
-    "boundary_${version}_openbsd_386.zip",
-    "boundary_${version}_openbsd_amd64.zip",
-    "boundary_${version}_openbsd_arm.zip",
-    "boundary_${version}_solaris_amd64.zip",
-    "boundary_${version}_windows_386.zip",
-    "boundary_${version}_windows_amd64.zip",
-  ]
-  rpm = [
-    "boundary-${version_linux}-1.aarch64.rpm",
-    "boundary-${version_linux}-1.armv7hl.rpm",
-    "boundary-${version_linux}-1.i386.rpm",
-    "boundary-${version_linux}-1.x86_64.rpm",
-  ]
-  deb = [
-    "boundary_${version_linux}-1_amd64.deb",
-    "boundary_${version_linux}-1_arm64.deb",
-    "boundary_${version_linux}-1_armhf.deb",
-    "boundary_${version_linux}-1_i386.deb",
-  ]
-  container = [
-    "boundary_default_linux_386_${version}_${commit_sha}.docker.tar",
-    "boundary_default_linux_amd64_${version}_${commit_sha}.docker.tar",
-    "boundary_default_linux_arm64_${version}_${commit_sha}.docker.tar",
-    "boundary_default_linux_arm_${version}_${commit_sha}.docker.tar",
-  ]
-}
@@ -1,16 +1,15 @@
-# Boundary Docker Image
+# Threshold Docker Image

-The root of this repository contains the officially supported HashiCorp Dockerfile to build the hashicorp/boundary docker image.
-The dev docker image should be built for local dev and testing,
-while the production docker image is built in CI and makes use of CI-built binaries.
-The official docker image is built using the official binaries from releases.hashicorp.com.
+The root of this repository contains the Dockerfile used to build the Threshold
+docker image. Threshold is a community fork of HashiCorp Boundary Community
+Edition and is not affiliated with or endorsed by HashiCorp or IBM.
+
+The dev docker image is built from a locally built binary (`./bin/threshold`),
+while the production docker image makes use of CI-built binaries.

 ## Build

-See the Makefile targets in the root of this repository
-for building Boundary images in either development or release modes:
+See the Makefile targets in the root of this repository for building images:

  - `make docker-build-dev`
-  - `make docker-multiarch-build`
-  - `make docker-build`
  - `make docker`
@@ -1,46 +1,46 @@
 <!---
-This is used for the Overview tab for the boundary docker image on hub.docker.com
-https://hub.docker.com/r/hashicorp/boundary
+This is used for the Overview tab for the threshold docker image on hub.docker.com
+https://repo.anhonesthost.net/CyberCoveLLC/threshold
 --->

-# Boundary
+# Threshold

 ## Usage

 See the latest updates to the Dockerfile for this image in our
-[GitHub repository](https://github.com/hashicorp/boundary).
+[repository](https://repo.anhonesthost.net/CyberCoveLLC/threshold).

 ### Dev Mode

-Due to the limitations of `boundary dev` running and maintaining a postgres docker container,
+Due to the limitations of `threshold dev` running and maintaining a postgres docker container,
 it's not recommended to run `dev` mode inside docker.
 To do so will require knowledge of running [docker-in-docker](https://hub.docker.com/_/docker),
 and the caveats associated with it.

 ### Default Configuration

-The default behavior of the Boundary docker image is to run `boundary server -config /boundary/config.hcl`.
+The default behavior of the Threshold docker image is to run `threshold server -config /threshold/config.hcl`.
 The included `config.hcl` file is meant to serve as an example,
 and is not suitable for actual deployment.
 Please see the comments within the file for more information;
-full configuration details can be found on Boundary's documentation site.
+full configuration details can be found on Threshold's documentation site.

 ### Postgres

-The usage instructions in this README assume you have an external postgres database (version 12 or greater) to run boundary server with.
+The usage instructions in this README assume you have an external postgres database (version 12 or greater) to run threshold server with.
 If you want to get started quickly, you can start a local postgres in docker:

 ```bash
 docker run -it -p 5432:5432 -e POSTGRES_PASSWORD=postgres -e POSTGRES_USER=postgres postgres
 ```

-The postgres URL setting is defined with `env://BOUNDARY_POSTGRES_URL` so it can be easily set with `-e` during docker run:
+The postgres URL setting is defined with `env://THRESHOLD_POSTGRES_URL` so it can be easily set with `-e` during docker run:

 ```bash
 docker run \
    --network host \
-    -e 'BOUNDARY_POSTGRES_URL=postgresql://postgres:postgres@0.0.0.0:5432/postgres?sslmode=disable' \
-    hashicorp/boundary
+    -e 'THRESHOLD_POSTGRES_URL=postgresql://postgres:postgres@0.0.0.0:5432/postgres?sslmode=disable' \
+    repo.anhonesthost.net/cybercovellc/threshold
 ```

 ### Database Init
@@ -52,8 +52,8 @@ initialize the database using the default `config.hcl`:
 ```bash
 docker run \
  --network host \
-  -e 'BOUNDARY_POSTGRES_URL=postgresql://postgres:postgres@0.0.0.0:5432/postgres?sslmode=disable' \
-  hashicorp/boundary database init -config /boundary/config.hcl
+  -e 'THRESHOLD_POSTGRES_URL=postgresql://postgres:postgres@0.0.0.0:5432/postgres?sslmode=disable' \
+  repo.anhonesthost.net/cybercovellc/threshold database init -config /threshold/config.hcl
 ```

 If you want to run this with your own `config.hcl` (assuming `config.hcl` is located at `$(pwd)/config.hcl`):
@@ -61,22 +61,22 @@ If you want to run this with your own `config.hcl` (assuming `config.hcl` is loc
 ```bash
 docker run \
  --network host \
-  -e 'BOUNDARY_POSTGRES_URL=postgresql://postgres:postgres@0.0.0.0:5432/postgres?sslmode=disable' \
-  -v "$(pwd)":/boundary/ \
-  hashicorp/boundary database init -config /boundary/config.hcl
+  -e 'THRESHOLD_POSTGRES_URL=postgresql://postgres:postgres@0.0.0.0:5432/postgres?sslmode=disable' \
+  -v "$(pwd)":/threshold/ \
+  repo.anhonesthost.net/cybercovellc/threshold database init -config /threshold/config.hcl
 ```

 ### Database Migration

-If you are updating to a newer version of boundary with a database instance
+If you are updating to a newer version of threshold with a database instance
 that was initialized with an older version,
 you will need to apply the database migrations:

 ```bash
 docker run \
  --network host \
-  -e 'BOUNDARY_POSTGRES_URL=postgresql://postgres:postgres@0.0.0.0:5432/postgres?sslmode=disable' \
-  hashicorp/boundary database migrate -config /boundary/config.hcl
+  -e 'THRESHOLD_POSTGRES_URL=postgresql://postgres:postgres@0.0.0.0:5432/postgres?sslmode=disable' \
+  repo.anhonesthost.net/cybercovellc/threshold database migrate -config /threshold/config.hcl
 ```

 If you want to run this with your own `config.hcl` (assuming `config.hcl` is located at `$(pwd)/config.hcl`):
@@ -84,14 +84,14 @@ If you want to run this with your own `config.hcl` (assuming `config.hcl` is loc
 ```bash
 docker run \
  --network host \
-  -e 'BOUNDARY_POSTGRES_URL=postgresql://postgres:postgres@0.0.0.0:5432/postgres?sslmode=disable' \
-  -v "$(pwd)":/boundary/ \
-  hashicorp/boundary database migrate -config /boundary/config.hcl
+  -e 'THRESHOLD_POSTGRES_URL=postgresql://postgres:postgres@0.0.0.0:5432/postgres?sslmode=disable' \
+  -v "$(pwd)":/threshold/ \
+  repo.anhonesthost.net/cybercovellc/threshold database migrate -config /threshold/config.hcl
 ```

 ### Server

-Start a Boundary server using the default `config.hcl`:
+Start a Threshold server using the default `config.hcl`:

 ```bash
 docker run \
@@ -99,11 +99,11 @@ docker run \
  -p 9200:9200 \
  -p 9201:9201 \
  -p 9202:9202 \
-  -e 'BOUNDARY_POSTGRES_URL=postgresql://postgres:postgres@0.0.0.0:5432/postgres?sslmode=disable' \
-  hashicorp/boundary
+  -e 'THRESHOLD_POSTGRES_URL=postgresql://postgres:postgres@0.0.0.0:5432/postgres?sslmode=disable' \
+  repo.anhonesthost.net/cybercovellc/threshold
 ```

-Start a Boundary server using your own `config.hcl`, assuming it's located at `$(pwd)/config.hcl`:
+Start a Threshold server using your own `config.hcl`, assuming it's located at `$(pwd)/config.hcl`:

 ```bash
 docker run \
@@ -111,7 +111,7 @@ docker run \
  -p 9200:9200 \
  -p 9201:9201 \
  -p 9202:9202 \
-  -v "$(pwd)":/boundary/ \
-  -e 'BOUNDARY_POSTGRES_URL=postgresql://postgres:postgres@0.0.0.0:5432/postgres?sslmode=disable' \
-  hashicorp/boundary
+  -v "$(pwd)":/threshold/ \
+  -e 'THRESHOLD_POSTGRES_URL=postgresql://postgres:postgres@0.0.0.0:5432/postgres?sslmode=disable' \
+  repo.anhonesthost.net/cybercovellc/threshold
 ```
@@ -14,12 +14,12 @@ controller {

  database {
    # This configuration setting requires the user to execute the container with the URL as an env var
-    # to connect to the Boundary postgres DB. An example of how this can be done assuming the postgres 
+    # to connect to the Threshold postgres DB. An example of how this can be done assuming the postgres 
    # database is running as a container and you're using Docker for Mac (replace host.docker.internal with
    # localhost if you're on Linux):
    #
-    #    $  docker run -e 'BOUNDARY_POSTGRES_URL=postgresql://postgres:postgres@host.docker.internal:5432/postgres?sslmode=disable' [other options] boundary:[version]
-    url = "env://BOUNDARY_POSTGRES_URL"
+    #    $  docker run -e 'THRESHOLD_POSTGRES_URL=postgresql://postgres:postgres@host.docker.internal:5432/postgres?sslmode=disable' [other options] threshold:[version]
+    url = "env://THRESHOLD_POSTGRES_URL"
  }

  public_cluster_addr = "env://HOSTNAME"
@@ -48,7 +48,7 @@ listener "tcp" {
  tls_disable   = true 
 }

-# Root KMS configuration block: this is the root key for Boundary
+# Root KMS configuration block: this is the root key for Threshold
 # Use a production KMS such as AWS KMS in production installs
 kms "aead" {
  purpose = "root"
@@ -67,7 +67,7 @@ kms "aead" {
  key_id = "global_worker-auth"
 }

-# Recovery KMS block: configures the recovery key for Boundary
+# Recovery KMS block: configures the recovery key for Threshold
 # Use a production KMS such as AWS KMS for production installs
 kms "aead" {
  purpose = "recovery"
@@ -12,24 +12,34 @@ set -e
 # Prevent core dumps
 ulimit -c 0

-# If the user is trying to run Boundary directly with some arguments, then
-# pass them to Boundary.
+# Backwards compatibility: honor legacy BOUNDARY_* environment variables by
+# mirroring them to their THRESHOLD_* equivalents when the latter are unset.
+# (The Threshold CLI itself also falls back to BOUNDARY_* for CLI variables.)
+for legacy_name in $(env | sed -n 's/^\(BOUNDARY_[A-Za-z0-9_]*\)=.*/\1/p'); do
+    new_name="THRESHOLD_${legacy_name#BOUNDARY_}"
+    if [ -z "$(printenv "$new_name")" ]; then
+        export "$new_name=$(printenv "$legacy_name")"
+    fi
+done
+
+# If the user is trying to run Threshold directly with some arguments, then
+# pass them to Threshold.
 if [ "${1:0:1}" = '-' ]; then
-    set -- boundary "$@"
+    set -- threshold "$@"
 fi

 if [ "$1" = 'server' ]; then
    shift
-    set -- boundary server \
+    set -- threshold server \
        "$@"
-elif boundary --help "$1" 2>&1 | grep -q "boundary $1"; then
+elif threshold --help "$1" 2>&1 | grep -q "threshold $1"; then
    # We can't use the return code to check for the existence of a subcommand, so
    # we have to use grep to look for a pattern in the help output.
-    set -- boundary "$@"
+    set -- threshold "$@"
 fi

-# If we are running Boundary, make sure it executes as the proper user.
-if [ "$1" = 'boundary' ]; then
+# If we are running Threshold, make sure it executes as the proper user.
+if [ "$1" = 'threshold' ]; then
 	is_root=0
 	if [ "$(id -u)" = '0' ]; then
 		is_root=1
@@ -38,23 +48,23 @@ if [ "$1" = 'boundary' ]; then
    if [ -z "$SKIP_CHOWN" ]; then
        if [ "$is_root" = '1' ]; then
            # If the config dir is bind mounted then chown it
-            if [ "$(stat -c %u /boundary)" != "$(id -u boundary)" ]; then
-                chown -R boundary:boundary /boundary || echo "Could not chown /boundary (may not have appropriate permissions)"
+            if [ "$(stat -c %u /threshold)" != "$(id -u threshold)" ]; then
+                chown -R threshold:threshold /threshold || echo "Could not chown /threshold (may not have appropriate permissions)"
            fi
        else
-            >&2 echo "SKIP_CHOWN not set but running non-root; skipping chown /boundary"
+            >&2 echo "SKIP_CHOWN not set but running non-root; skipping chown /threshold"
        fi
    fi

    if [ -z "$SKIP_SETCAP" ]; then
        if [ "$is_root" = '1' ]; then
-            # Allow mlock to avoid swapping Boundary memory to disk
-            setcap cap_ipc_lock=+ep $(readlink -f $(which boundary))
+            # Allow mlock to avoid swapping Threshold memory to disk
+            setcap cap_ipc_lock=+ep $(readlink -f $(which threshold))

-            # In the case Boundary has been started in a container without IPC_LOCK privileges
-            if ! boundary -version 1>/dev/null 2>/dev/null; then
-                >&2 echo "Couldn't start Boundary with IPC_LOCK. Disabling IPC_LOCK, please use --privileged or --cap-add IPC_LOCK"
-                setcap cap_ipc_lock=-ep $(readlink -f $(which boundary))
+            # In the case Threshold has been started in a container without IPC_LOCK privileges
+            if ! threshold -version 1>/dev/null 2>/dev/null; then
+                >&2 echo "Couldn't start Threshold with IPC_LOCK. Disabling IPC_LOCK, please use --privileged or --cap-add IPC_LOCK"
+                setcap cap_ipc_lock=-ep $(readlink -f $(which threshold))
            fi
        else
            >&2 echo "SKIP_SETCAP not set but running non-root; skipping setcap"
@@ -62,7 +72,7 @@ if [ "$1" = 'boundary' ]; then
    fi

    if [ "$is_root" = '1' ]; then
-      set -- su-exec boundary "$@"
+      set -- su-exec threshold "$@"
    fi
 fi

@@ -15,7 +15,7 @@
 #   # supply the url, or "env://" to name an environment variable
 #   # that contains the URL.
 #   database {
-#       url = "postgresql://boundary:boundarydemo@postgres.yourdomain.com:5432/boundary"
+#       url = "postgresql://threshold:thresholddemo@postgres.yourdomain.com:5432/threshold"
 #   }
 # }

@@ -42,7 +42,7 @@
 #   purpose = "cluster"
 # }

-# # Root KMS configuration block: this is the root key for Boundary
+# # Root KMS configuration block: this is the root key for Threshold
 # # Use a production KMS such as AWS KMS in production installs
 # kms "aead" {
 #   purpose = "root"
@@ -61,7 +61,7 @@
 #   key_id = "global_worker-auth"
 # }

-# # Recovery KMS block: configures the recovery key for Boundary
+# # Recovery KMS block: configures the recovery key for Threshold
 # # Use a production KMS such as AWS KMS for production installs
 # kms "aead" {
 #   purpose = "recovery"
@@ -1,23 +0,0 @@
-[Unit]
-Description="HashiCorp Boundary - Identity-based access management for dynamic infrastructure"
-Documentation=https://www.boundaryproject.io/docs
-StartLimitIntervalSec=60
-StartLimitBurst=3
-
-[Service]
-EnvironmentFile=-/etc/boundary.d/boundary.env
-User=boundary
-Group=boundary
-ProtectSystem=full
-ProtectHome=read-only
-ExecStart=/usr/bin/boundary server -config=/etc/boundary.d/boundary.hcl
-ExecReload=/bin/kill --signal HUP $MAINPID
-KillMode=process
-KillSignal=SIGINT
-Restart=on-failure
-RestartSec=5
-TimeoutStopSec=30
-LimitMEMLOCK=infinity
-
-[Install]
-WantedBy=multi-user.target
@@ -0,0 +1,23 @@
+[Unit]
+Description="Threshold (fork of HashiCorp Boundary CE) - Identity-based access management for dynamic infrastructure"
+Documentation=https://repo.anhonesthost.net/CyberCoveLLC/threshold
+StartLimitIntervalSec=60
+StartLimitBurst=3
+
+[Service]
+EnvironmentFile=-/etc/threshold.d/threshold.env
+User=threshold
+Group=threshold
+ProtectSystem=full
+ProtectHome=read-only
+ExecStart=/usr/bin/threshold server -config=/etc/threshold.d/threshold.hcl
+ExecReload=/bin/kill --signal HUP $MAINPID
+KillMode=process
+KillSignal=SIGINT
+Restart=on-failure
+RestartSec=5
+TimeoutStopSec=30
+LimitMEMLOCK=infinity
+
+[Install]
+WantedBy=multi-user.target
@@ -2,7 +2,7 @@

 if [ "$1" = "purge" ]
 then
-  userdel boundary
+  userdel threshold
 fi

 exit 0
@@ -2,7 +2,7 @@

 set -eu

-USER="boundary"
+USER="threshold"

 if ! id -u $USER > /dev/null 2>&1; then
 	useradd \
@@ -1,9 +1,7 @@
 # Copyright IBM Corp. 2020, 2026
 # SPDX-License-Identifier: BUSL-1.1

-url_docker_registry_dockerhub = "https://hub.docker.com/r/hashicorp/boundary"
-url_docker_registry_ecr = "https://gallery.ecr.aws/hashicorp/boundary"
-url_license = "https://github.com/hashicorp/boundary/blob/main/LICENSE"
-url_project_website = "https://www.boundaryproject.io"
-url_release_notes = "https://www.boundaryproject.io/docs/releases/release-notes"
-url_source_repository = "https://github.com/hashicorp/boundary"
+url_license = "https://repo.anhonesthost.net/CyberCoveLLC/threshold/src/branch/main/LICENSE"
+url_project_website = "https://repo.anhonesthost.net/CyberCoveLLC/threshold"
+url_release_notes = "https://repo.anhonesthost.net/CyberCoveLLC/threshold/src/branch/main/CHANGELOG.md"
+url_source_repository = "https://repo.anhonesthost.net/CyberCoveLLC/threshold"
@@ -0,0 +1,44 @@
+# Copyright IBM Corp. 2020, 2026
+# SPDX-License-Identifier: BUSL-1.1
+
+schema = 1
+artifacts {
+  zip = [
+    "threshold_${version}_darwin_amd64.zip",
+    "threshold_${version}_darwin_arm64.zip",
+    "threshold_${version}_freebsd_386.zip",
+    "threshold_${version}_freebsd_amd64.zip",
+    "threshold_${version}_freebsd_arm.zip",
+    "threshold_${version}_linux_386.zip",
+    "threshold_${version}_linux_amd64.zip",
+    "threshold_${version}_linux_arm.zip",
+    "threshold_${version}_linux_arm64.zip",
+    "threshold_${version}_netbsd_386.zip",
+    "threshold_${version}_netbsd_amd64.zip",
+    "threshold_${version}_netbsd_arm.zip",
+    "threshold_${version}_openbsd_386.zip",
+    "threshold_${version}_openbsd_amd64.zip",
+    "threshold_${version}_openbsd_arm.zip",
+    "threshold_${version}_solaris_amd64.zip",
+    "threshold_${version}_windows_386.zip",
+    "threshold_${version}_windows_amd64.zip",
+  ]
+  rpm = [
+    "threshold-${version_linux}-1.aarch64.rpm",
+    "threshold-${version_linux}-1.armv7hl.rpm",
+    "threshold-${version_linux}-1.i386.rpm",
+    "threshold-${version_linux}-1.x86_64.rpm",
+  ]
+  deb = [
+    "threshold_${version_linux}-1_amd64.deb",
+    "threshold_${version_linux}-1_arm64.deb",
+    "threshold_${version_linux}-1_armhf.deb",
+    "threshold_${version_linux}-1_i386.deb",
+  ]
+  container = [
+    "threshold_default_linux_386_${version}_${commit_sha}.docker.tar",
+    "threshold_default_linux_amd64_${version}_${commit_sha}.docker.tar",
+    "threshold_default_linux_arm64_${version}_${commit_sha}.docker.tar",
+    "threshold_default_linux_arm_${version}_${commit_sha}.docker.tar",
+  ]
+}
@@ -1,3 +1,17 @@
+# Threshold CHANGELOG
+
+> **Note:** Threshold is a community fork of HashiCorp Boundary Community Edition (CE), which was archived upstream on
+> 2026-10-09. Entries below this note are the upstream Boundary changelog and are kept unchanged for history.
+> Threshold-specific changes are listed under the "Threshold" heading, newest first.
+
+## Threshold
+
+### Unreleased
+
+* Renamed the CLI binary to `threshold` and rebranded user-visible text. `THRESHOLD_*` environment variables are now
+  preferred, with `BOUNDARY_*` honored as a fallback. The client cache directory is `~/.threshold` (falling back to an
+  existing `~/.boundary`), and stored tokens are written under new keyring names while old entries are still read.
+
 # Boundary CHANGELOG

 Canonical reference for changes, improvements, and bugfixes for Boundary.
@@ -1,53 +1,46 @@
-# Contributing to Boundary
+# Contributing to Threshold

-Thank you for contributing to Boundary! Here you can find common questions around reporting issues and opening
-pull requests to our project.
+Thank you for contributing to Threshold! Threshold is a community fork of HashiCorp Boundary Community Edition (CE).
+It is not affiliated with or endorsed by HashiCorp or IBM. Here you can find common questions around reporting issues
+and opening pull requests to the project. The repository lives at
+<https://repo.anhonesthost.net/CyberCoveLLC/threshold>.

-When contributing in any way to the Boundary project (new issue, PR, etc), please be aware that our team identifies with many gender pronouns. Please remember to use nonbinary pronouns (they/them) and gender neutral language ("Hello folks") when addressing our team. For more reading on our code of conduct, please see the [HashiCorp community guidelines](https://www.hashicorp.com/community-guidelines). 
+Please be respectful and inclusive when contributing in any way (new issue, PR, etc).

 ## Issue Reporting
 ### Reporting Security Related Vulnerabilities

-We take Boundary's security and our users' trust very seriously. If you believe you have found a security issue 
-in Boundary, please responsibly disclose by contacting us at security@hashicorp.com. Do not open an issue on 
-our GitHub issue tracker if you believe you've found a security related issue, thank you!
+If you believe you have found a security issue in Threshold, please disclose it responsibly by contacting the
+maintainers privately rather than opening a public issue. Issues that exist in upstream HashiCorp Boundary CE should
+also be treated as security-sensitive.

 ### Bug Fixes

-If you believe you found a bug with Boundary, please:
+If you believe you found a bug with Threshold, please:

-1. Build from the latest `main` HEAD commit to attempt to reproduce the issue. It's possible we've already fixed
-the bug, and this is a first good step to ensuring that's not the case.
-1. Take a look at the [Boundary Discuss](https://discuss.hashicorp.com/c/boundary/50) to see if other folks have had
-similar issues.
-1. Ensure a similar ticket is not already opened by searching our opened issues on GitHub.
+1. Build from the latest `main` HEAD commit to attempt to reproduce the issue. It's possible it has already been fixed.
+1. Ensure a similar issue is not already opened by searching the open issues in the repository.

-
-Once you've verified the above, feel free to open a bug fix issue template type from our [issue selector](https://github.com/hashicorp/boundary/issues/new/choose)
-and we'll do our best to triage it as quickly as possible. 
+Once you've verified the above, open an issue in the repository describing how to reproduce the problem.

 ## Pull Requests

 ### New Features & Improvements

-Before writing a line of code, please ask us about a potential improvement or feature that you want to write into Boundary. We may already be working on it; even if we aren't, we need to ensure that both the feature and its proposed implementation is aligned with our road map, vision, and standards for the project. We're happy to help walk through that via a [feature request issue](https://github.com/hashicorp/boundary/issues/new/choose).
-
-You can see a public [road map for Boundary](https://github.com/hashicorp/boundary/issues/new/choose) on our docs site and we encourage
-everyone to look this over to understand at a high level what we're working on with Boundary.
+Before writing a line of code, please open an issue to discuss a potential improvement or feature. Threshold is
+focused on maintaining the Community Edition code base, so changes that stay close to upstream behavior and
+compatibility are the easiest to accept.

 ### Submitting a New Pull Request

 When submitting a pull request, please ensure:

 1. You've added a changelog line clearly describing the new addition under the correct changelog sub-section.
-1. You've followed the above guidelines for contributing to Boundary.
-
-Once you open your PR, our auto-labeling will add labels to help us triage and prioritize your contribution. Please
-allow us a couple of days to comment, request changes, or approve your PR. Thank you for your contribution!
+1. You've followed the above guidelines for contributing to Threshold.

 ## Changelog

-The changelog is updated by PR contributors. Each contribution to Boundary should include a changelog update at the contributor or reviewer discretion. 
+The changelog is updated by PR contributors. Each contribution to Threshold should include a changelog update at the contributor or reviewer discretion. 
 The changelog should be updated when the contribution is large enough to warrant it being called out in the larger release cycle. Enhancements, bug fixes,
 and other contributions that practitioners might want to be aware of should exist in the changelog. 

@@ -72,7 +65,7 @@ Any bug fixes fall into this section.

 Most tests require a postgres database instance to successfully run.
 This is provided via docker
-by running a customized postgres image that is optimized for boundary tests.
+by running a customized postgres image that is optimized for Threshold tests.

 Before running the test suite, this docker container must be started:

@@ -109,7 +102,7 @@ once the test database is ready:
 $ make test
 ```

-Before running any test please ensure that Docker is started. Boundary uses a Docker container to initiate a database for testing.
+Before running any test please ensure that Docker is started. Threshold uses a Docker container to initiate a database for testing.
 If a test is interrupted check to make certain that all Docker containers have been properly destroyed. 

 ### Running individual tests
@@ -13,108 +13,53 @@
 # For local dev and testing purposes, please build and use the `dev` docker image.


-# Development docker image
-FROM docker.mirror.hashicorp.services/alpine:3.21 as dev
+# Development docker image (built from the locally built ./bin/threshold)
+FROM alpine:3.21 as dev

 RUN set -eux && \
-    addgroup boundary && \
-    adduser -s /bin/sh -S -G boundary boundary && \
+    addgroup threshold && \
+    adduser -s /bin/sh -S -G threshold threshold && \
    apk add --no-cache wget ca-certificates dumb-init gnupg libcap openssl su-exec iputils libc6-compat iptables

-ADD bin/boundary /bin/boundary
-RUN setcap cap_ipc_lock=+ep /bin/boundary
+ADD bin/threshold /bin/threshold
+RUN setcap cap_ipc_lock=+ep /bin/threshold

-RUN mkdir /boundary/
-ADD .release/docker/config.hcl /boundary/config.hcl
-RUN chown -R boundary:boundary /boundary/
-RUN chmod -R 640 /boundary/*
+RUN mkdir /threshold/
+ADD .release/docker/config.hcl /threshold/config.hcl
+RUN chown -R threshold:threshold /threshold/
+RUN chmod -R 640 /threshold/*

 EXPOSE 9200 9201 9202
-VOLUME /boundary/
+VOLUME /threshold/

 LABEL org.opencontainers.image.licenses="BUSL-1.1"

 COPY .release/docker/docker-entrypoint.sh /usr/local/bin/docker-entrypoint.sh
-COPY bin/LICENSE.txt /usr/share/doc/boundary/LICENSE.txt
+COPY bin/LICENSE.txt /usr/share/doc/threshold/LICENSE.txt

-USER boundary
+USER threshold
 ENTRYPOINT ["docker-entrypoint.sh"]
-CMD ["server", "-config", "/boundary/config.hcl"]
-
-
-# Official docker image that uses binaries from releases.hashicorp.com
-FROM docker.mirror.hashicorp.services/alpine:3.21 as official
-
-ARG PRODUCT_VERSION
-
-LABEL name="Boundary" \
-      maintainer="HashiCorp Boundary Team <boundary@hashicorp.com>" \
-      vendor="HashiCorp" \
-      version=$PRODUCT_VERSION \
-      release=$PRODUCT_VERSION \
-      summary="Boundary provides simple and secure access to hosts and services" \
-      description="The Boundary Docker image is designed to enable practitioners to run Boundary in server mode on a container scheduler" \
-      org.opencontainers.image.licenses="BUSL-1.1"
-
-RUN set -eux && \
-    addgroup boundary && \
-    adduser -s /bin/sh -S -G boundary boundary && \
-    apk add --no-cache wget ca-certificates dumb-init gnupg libcap openssl su-exec iputils libc6-compat iptables && \
-    gpg --keyserver keyserver.ubuntu.com --recv-keys C874011F0AB405110D02105534365D9472D7468F && \
-    cd /tmp && \
-    apkArch="$(apk --print-arch)" && \
-    case "${apkArch}" in \
-        aarch64) boundaryArch='arm64' ;; \
-        armhf) boundaryArch='armhfv6' ;; \
-        x86) boundaryArch='386' ;; \
-        x86_64) boundaryArch='amd64' ;; \
-        *) echo >&2 "error: unsupported architecture: ${apkArch} (see https://releases.hashicorp.com/boundary/${PRODUCT_VERSION}/ )" && exit 1 ;; \
-    esac && \
-    wget https://releases.hashicorp.com/boundary/${PRODUCT_VERSION}/boundary_${PRODUCT_VERSION}_linux_${boundaryArch}.zip && \
-    wget https://releases.hashicorp.com/boundary/${PRODUCT_VERSION}/boundary_${PRODUCT_VERSION}_SHA256SUMS && \
-    wget https://releases.hashicorp.com/boundary/${PRODUCT_VERSION}/boundary_${PRODUCT_VERSION}_SHA256SUMS.sig && \
-    gpg --batch --verify boundary_${PRODUCT_VERSION}_SHA256SUMS.sig boundary_${PRODUCT_VERSION}_SHA256SUMS && \
-    grep boundary_${PRODUCT_VERSION}_linux_${boundaryArch}.zip boundary_${PRODUCT_VERSION}_SHA256SUMS | sha256sum -c && \
-    unzip -d /bin boundary_${PRODUCT_VERSION}_linux_${boundaryArch}.zip && \
-    rm boundary_${PRODUCT_VERSION}_linux_${boundaryArch}.zip boundary_${PRODUCT_VERSION}_SHA256SUMS boundary_${PRODUCT_VERSION}_SHA256SUMS.sig && \
-    setcap cap_ipc_lock=+ep /bin/boundary && \
-    cp /bin/LICENSE.txt /usr/share/doc/boundary/LICENSE.txt && \
-    mkdir /boundary
-
-COPY .release/docker/config.hcl /boundary/config.hcl
-
-RUN chown -R boundary:boundary /boundary/ 
-RUN chmod -R 640 /boundary/*
-
-EXPOSE 9200 9201 9202
-VOLUME /boundary/
-
-COPY .release/docker/docker-entrypoint.sh /usr/local/bin/docker-entrypoint.sh
-
-USER boundary
-ENTRYPOINT ["docker-entrypoint.sh"]
-CMD ["server", "-config", "/boundary/config.hcl"]
+CMD ["server", "-config", "/threshold/config.hcl"]


 # Production docker image
 # Remember, this cannot be built locally
-FROM docker.mirror.hashicorp.services/alpine:3.21 as default
+FROM alpine:3.21 as default

 ARG BIN_NAME
-# NAME and PRODUCT_VERSION are the name of the software in releases.hashicorp.com
-# and the version to download. Example: NAME=boundary PRODUCT_VERSION=1.2.3.
-ARG NAME=boundary
+# NAME is the name of the software (and of the user/group created in the image);
+# PRODUCT_VERSION is the version. Example: NAME=threshold PRODUCT_VERSION=1.2.3.
+ARG NAME=threshold
 ARG PRODUCT_VERSION
 # TARGETARCH and TARGETOS are set automatically when --platform is provided.
 ARG TARGETOS TARGETARCH

-LABEL name="Boundary" \
-      maintainer="HashiCorp Boundary Team <boundary@hashicorp.com>" \
-      vendor="HashiCorp" \
+LABEL name="Threshold" \
+      vendor="Threshold (fork of HashiCorp Boundary CE)" \
      version=$PRODUCT_VERSION \
      release=$PRODUCT_VERSION \
-      summary="Boundary provides simple and secure access to hosts and services" \
-      description="The Boundary Docker image is designed to enable practitioners to run Boundary in server mode on a container scheduler" \
+      summary="Threshold provides simple and secure access to hosts and services" \
+      description="The Threshold Docker image is designed to enable practitioners to run Threshold, a community fork of HashiCorp Boundary Community Edition, in server mode on a container scheduler. Not affiliated with or endorsed by HashiCorp or IBM." \
      org.opencontainers.image.licenses="BUSL-1.1"

 # Set ARGs as ENV so that they can be used in ENTRYPOINT/CMD
@@ -126,20 +71,20 @@ RUN addgroup ${NAME} && adduser -s /bin/sh -S -G ${NAME} ${NAME}

 RUN apk add --no-cache wget ca-certificates dumb-init gnupg libcap openssl su-exec iputils libc6-compat iptables

-COPY .release/docker/config.hcl /boundary/config.hcl
+COPY .release/docker/config.hcl /threshold/config.hcl

 COPY dist/$TARGETOS/$TARGETARCH/$BIN_NAME /bin/
-COPY dist/$TARGETOS/$TARGETARCH/LICENSE.txt /usr/share/doc/boundary/LICENSE.txt
+COPY dist/$TARGETOS/$TARGETARCH/LICENSE.txt /usr/share/doc/threshold/LICENSE.txt
 RUN setcap cap_ipc_lock=+ep /bin/$BIN_NAME

-RUN chown -R ${NAME}:${NAME} /boundary
-RUN chmod -R 640 /boundary/*
+RUN chown -R ${NAME}:${NAME} /threshold
+RUN chmod -R 640 /threshold/*

 EXPOSE 9200 9201 9202
-VOLUME /boundary/
+VOLUME /threshold/

 COPY .release/docker/docker-entrypoint.sh /usr/local/bin/docker-entrypoint.sh

 USER ${NAME}
 ENTRYPOINT ["docker-entrypoint.sh"]
-CMD ["server", "-config", "/boundary/config.hcl"]
+CMD ["server", "-config", "/threshold/config.hcl"]
@@ -55,16 +55,16 @@ dev:
 .PHONY: build
 build: BUILD_TAGS+=ui
 build: build-ui-ifne
-	@echo "==> Building Boundary with UI features enabled"
+	@echo "==> Building Threshold with UI features enabled"
 	@CGO_ENABLED=$(CGO_ENABLED) BUILD_TAGS='$(BUILD_TAGS)' sh -c "'$(CURDIR)/scripts/build.sh'"

 .PHONY: build-no-ui
 build-no-ui:
-	@echo "==> Building Boundary without UI features"
+	@echo "==> Building Threshold without UI features"
 	@CGO_ENABLED=$(CGO_ENABLED) BUILD_TAGS='$(BUILD_TAGS)' sh -c "'$(CURDIR)/scripts/build.sh'"

 .PHONY: install
-install: export BOUNDARY_INSTALL_BINARY=1
+install: export THRESHOLD_INSTALL_BINARY=1
 install: build

 .PHONY: install-no-plugins
@@ -74,7 +74,7 @@ install-no-plugins: install
 .PHONY: build-memprof
 build-memprof: BUILD_TAGS+=memprofiler
 build-memprof:
-	@echo "==> Building Boundary with memory profiling enabled"
+	@echo "==> Building Threshold with memory profiling enabled"
 	@CGO_ENABLED=$(CGO_ENABLED) BUILD_TAGS='$(BUILD_TAGS)' sh -c "'$(CURDIR)/scripts/build.sh'"

 # Format Go files, ignoring files marked as generated through the header defined at
@@ -363,35 +363,14 @@ install-go:
 	./ci/goinstall.sh

 # Docker build and publish variables and targets
-REGISTRY_NAME?=docker.io/hashicorp
-IMAGE_NAME=boundary
+REGISTRY_NAME?=repo.anhonesthost.net/cybercovellc
+IMAGE_NAME=threshold
 VERSION?=0.7.4
 IMAGE_TAG=$(REGISTRY_NAME)/$(IMAGE_NAME):$(VERSION)
 IMAGE_TAG_DEV?=$(REGISTRY_NAME)/$(IMAGE_NAME):latest-$(shell git rev-parse --short HEAD)

 .PHONY: docker
-docker: docker-build
-
-.PHONY: docker-build
-# Builds from the releases.hashicorp.com official binary
-docker-build:
-	docker build \
-		--tag $(IMAGE_TAG) \
-		--tag hashicorp/boundary:latest \
-		--target=official \
-		--build-arg VERSION=$(VERSION) \
-		.
-
-.PHONY: docker-multiarch-build
-# Builds multiarch from the releases.hashicorp.com official binary
-docker-multiarch-build:
-	docker buildx build \
-		--tag $(IMAGE_TAG) \
-		--tag hashicorp/boundary:latest \
-		--target=official \
-		--build-arg VERSION=$(VERSION) \
-		--platform linux/amd64,linux/arm64 \
-		.
+docker: docker-build-dev

 DEV_DOCKER_GOOS ?= linux
 DEV_DOCKER_GOARCH ?= amd64
@@ -406,7 +385,7 @@ docker-build-dev: build
 		--platform $(DEV_DOCKER_GOOS)/$(DEV_DOCKER_GOARCH) \
 		--tag $(IMAGE_TAG_DEV) \
 		--target=dev \
-		--build-arg=boundary \
+		--build-arg=threshold \
 		.
 	@echo "Successfully built $(IMAGE_TAG_DEV)"

@@ -417,7 +396,7 @@ docker-build-dev: build
 version:
 	@go run \
 		-ldflags "-X 'github.com/hashicorp/boundary/version.Version=$(shell cat version/VERSION)'" \
-		./cmd/boundary version \
+		./cmd/threshold version \
 		| awk '/Version Number:/ { print $$3 }'

 EDITION?=
@@ -425,7 +404,7 @@ EDITION?=
 # This is used for release builds by .github/workflows/build.yml
 edition:
 	@if [ -z "$(EDITION)" ]; then \
-		go run ./cmd/boundary version -format=json | jq -r '.version_metadata // "oss"'; \
+		go run ./cmd/threshold version -format=json | jq -r '.version_metadata // "oss"'; \
 	else \
 		echo $(EDITION); \
 	fi; \
@@ -0,0 +1,26 @@
+Threshold
+=========
+
+Threshold is a community fork of HashiCorp Boundary Community Edition (CE),
+originally developed by HashiCorp, Inc. (an IBM company):
+
+    https://github.com/hashicorp/boundary
+
+The upstream repository was archived on 2026-10-09. Threshold continues
+maintenance of that code base.
+
+Original work:
+    Copyright (c) HashiCorp, Inc.
+    Copyright IBM Corp. 2020, 2026
+    Licensed under the Business Source License 1.1 (see LICENSE).
+
+All existing copyright headers and the LICENSE file are preserved unchanged.
+Threshold is distributed under the same license terms as the upstream project.
+
+Threshold is not affiliated with, endorsed by, or sponsored by HashiCorp,
+Inc. or IBM. "Boundary", "HashiCorp", "HCP Boundary" and related marks are
+the property of their respective owners and are referenced here solely to
+identify the origin of this software.
+
+Portions of this repository (for example the api and sdk modules) carry their
+own license files, which apply to those portions.
@@ -1,10 +1,83 @@
-<img alt="Boundary" src="boundary.png" alt="Image" width="500px"/>
+# Threshold

-Boundary Community Edition (CE) is no longer under active development, and this repository has been archived as of October 8, 2026. Future Boundary development will focus on HCP Boundary and Boundary Enterprise, where we can provide enterprise grade human and agentic access capabilities.
+Threshold provides simple and secure access to hosts and services. It is a
+community-maintained fork of HashiCorp Boundary Community Edition (CE).

-This repository is now read-only and no longer accepts new issues, pull requests, or community contributions. Existing source code and previously released binaries remain available for reference and existing self-managed use.
+## About this fork

-No new Boundary CE releases, maintenance updates, bug fixes, or security patches are currently planned.
+Threshold is a community fork of [HashiCorp Boundary Community Edition](https://github.com/hashicorp/boundary).
+HashiCorp (an IBM company) archived the upstream Boundary CE repository on
+2026-10-09 and announced that no further CE releases, maintenance updates, bug
+fixes or security patches are planned. Threshold continues maintenance of the
+Community Edition code base so that existing self-managed deployments can keep
+receiving fixes.

-Teams continuing to use Boundary CE should evaluate whether it meets their operational, security, and compliance requirements.
-For supported Boundary capabilities, including production-scale governance, compliance, session recording, enterprise support, and future Boundary development, please evaluate HCP Boundary or Boundary Enterprise.
+- Threshold is licensed under the [Business Source License 1.1](LICENSE), the
+  same license as the upstream code. The original license text and all
+  copyright headers are preserved. See [NOTICE](NOTICE) for attribution.
+- **Threshold is not affiliated with, endorsed by, or sponsored by HashiCorp or
+  IBM.** "Boundary", "HashiCorp" and "HCP Boundary" are trademarks of their
+  respective owners and are used here only to describe the origin of this
+  project.
+- Upstream project: <https://github.com/hashicorp/boundary>
+- This repository: <https://repo.anhonesthost.net/CyberCoveLLC/threshold>
+
+### Compatibility with Boundary CE
+
+This is the first phase of the rebrand and is designed to keep existing
+Boundary CE deployments working:
+
+- The command-line binary is now `threshold` (built from `cmd/threshold`).
+- The wire protocol, HTTP API paths (`/v1`), database schema, plugin protocol
+  and configuration file format are unchanged.
+- The Go module path is still `github.com/hashicorp/boundary` for now; it will
+  change in a later phase together with regenerated protobuf code.
+- Release versions are still reported on the wire with the upstream
+  `Boundary v` prefix so mixed clusters keep working. `Threshold v` is also
+  accepted when parsing.
+
+### Environment variable and path fallbacks
+
+Threshold prefers `THRESHOLD_*` environment variables, and transparently falls
+back to the legacy `BOUNDARY_*` name when the `THRESHOLD_*` variable is not set.
+For example `THRESHOLD_ADDR`, `THRESHOLD_TOKEN`, `THRESHOLD_SCOPE_ID`,
+`THRESHOLD_KEYRING_TYPE`, `THRESHOLD_TOKEN_NAME`, `THRESHOLD_CONNECT_*`,
+`THRESHOLD_SKIP_CACHE_DAEMON` and the other CLI and server variables are read
+first, then `BOUNDARY_ADDR`, `BOUNDARY_TOKEN`, and so on. A `THRESHOLD_*` variable that is
+set to a non-empty value always wins. Existing scripts and deployments that
+only set `BOUNDARY_*` variables do not need to change.
+
+Notes:
+
+- `env://VAR` references inside configuration files and flags (for example
+  `url = "env://BOUNDARY_POSTGRES_URL"` or `url = "env://THRESHOLD_POSTGRES_URL"`
+  as used by the bundled container config) name an environment variable
+  literally and are not rewritten; keep using whichever variable name you export.
+- `threshold connect -exec` exports both `THRESHOLD_PROXIED_{PORT,IP,ADDR}` and
+  the legacy `BOUNDARY_PROXIED_{PORT,IP,ADDR}` variables to the child process.
+- The container image entrypoint mirrors any `BOUNDARY_*` variables to the
+  matching `THRESHOLD_*` variable when it is unset.
+
+Other fallbacks:
+
+| Item | New | Legacy fallback |
+|------|-----|-----------------|
+| Client cache directory | `~/.threshold` | `~/.boundary` is used if it exists and `~/.threshold` does not |
+| Keyring entry (macOS Keychain / Windows Credential Manager) | `Threshold Auth Token` | `HashiCorp Boundary Auth Token` is read if the new entry is not found, and removed on `threshold logout` |
+| Keyring prefix (`pass`, libsecret) | `Threshold` | `HashiCorp_Boundary` is read if the new entry is not found, and removed on `threshold logout` |
+
+Tokens are always written using the new names.
+
+## Building
+
+```
+make build        # builds bin/threshold (requires the embedded UI, see Makefile)
+make build-no-ui  # builds bin/threshold without the embedded admin UI
+```
+
+The embedded admin UI is built from the upstream `boundary-ui` project and is
+not part of this repository.
+
+## Contributing
+
+See [CONTRIBUTING.md](CONTRIBUTING.md).
@@ -15,7 +15,6 @@ import (
 	"net"
 	"net/http"
 	"net/url"
-	"os"
 	"path"
 	"strconv"
 	"strings"
@@ -53,14 +52,14 @@ const (

 // Config is used to configure the creation of the client
 type Config struct {
-	// Addr is the address of the Boundary controller. This should be a
-	// complete URL such as "http://boundary.example.com". If you need a custom
+	// Addr is the address of the Threshold controller. This should be a
+	// complete URL such as "http://threshold.example.com". If you need a custom
 	// SSL cert or want to enable insecure mode, you need to specify a custom
 	// HttpClient.
 	Addr string

 	// Token is the client token that reuslts from authentication and can be
-	// used to make calls into Boundary
+	// used to make calls into Threshold
 	Token string

 	// RecoveryKmsWrapper is a wrapper used in the recovery KMS authentication
@@ -68,9 +67,9 @@ type Config struct {
 	// per-call, regardless of any value set in Token.
 	RecoveryKmsWrapper wrapping.Wrapper

-	// HttpClient is the HTTP client to use. Boundary sets sane defaults for the
+	// HttpClient is the HTTP client to use. Threshold sets sane defaults for the
 	// http.Client and its associated http.Transport created in DefaultConfig.
-	// If you must modify Boundary's defaults, it is suggested that you start
+	// If you must modify Threshold's defaults, it is suggested that you start
 	// with that client and modify as needed rather than start with an empty
 	// client (or http.DefaultClient). Currently if the client is cloned the
 	// same HttpClient is used.
@@ -114,20 +113,20 @@ type Config struct {
 }

 // TLSConfig contains the parameters needed to configure TLS on the HTTP client
-// used to communicate with Boundary.
+// used to communicate with Threshold.
 type TLSConfig struct {
 	// CACert is the path to a PEM-encoded CA cert file to use to verify the
-	// Boundary server SSL certificate.
+	// Threshold server SSL certificate.
 	CACert string

 	// CAPath is the path to a directory of PEM-encoded CA cert files to verify
-	// the Boundary server SSL certificate.
+	// the Threshold server SSL certificate.
 	CAPath string

-	// ClientCert is the path to the certificate for Boundary communication
+	// ClientCert is the path to the certificate for Threshold communication
 	ClientCert string

-	// ClientKey is the path to the private key for Boundary communication
+	// ClientKey is the path to the private key for Threshold communication
 	ClientKey string

 	// ServerName, if set, is used to set the SNI host when connecting via
@@ -162,7 +161,7 @@ func RateLimitLinearJitterBackoff(min, max time.Duration, attemptNum int, resp *
 // safe to modify the return value of this function.
 //
 // The default Addr is http://127.0.0.1:9200, but this can be overridden by
-// setting the `BOUNDARY_ADDR` environment variable.
+// setting the `THRESHOLD_ADDR` environment variable.
 //
 // If an error is encountered, this will return nil.
 func DefaultConfig() (*Config, error) {
@@ -270,7 +269,7 @@ func (c *Config) setAddr(addr string) error {
 	// Remove trailing or leading slashes
 	path := strings.Trim(u.Path, "/")
 	// Remove v1 in front or back (e.g. they could have
-	// https://boundary.example.com/myinstall/v1 which would put it at the
+	// https://threshold.example.com/myinstall/v1 which would put it at the
 	// back)
 	path = strings.TrimPrefix(path, "v1")
 	path = strings.TrimSuffix(path, "v1")
@@ -296,15 +295,15 @@ func (c *Config) ReadEnvironment() error {
 	var envServerName string

 	// Parse the environment variables
-	if v := os.Getenv(EnvBoundaryAddr); v != "" {
+	if v := Getenv(EnvBoundaryAddr); v != "" {
 		c.Addr = v
 	}

-	if v := os.Getenv(EnvBoundaryToken); v != "" {
+	if v := Getenv(EnvBoundaryToken); v != "" {
 		c.Token = v
 	}

-	if v := os.Getenv(EnvBoundaryMaxRetries); v != "" {
+	if v := Getenv(EnvBoundaryMaxRetries); v != "" {
 		maxRetries, err := strconv.ParseUint(v, 10, 32)
 		if err != nil {
 			return err
@@ -318,7 +317,7 @@ func (c *Config) ReadEnvironment() error {
 		c.MaxRetries = int(maxRetries)
 	}

-	if v := os.Getenv(EnvBoundarySRVLookup); v != "" {
+	if v := Getenv(EnvBoundarySRVLookup); v != "" {
 		var err error
 		lookup, err := strconv.ParseBool(v)
 		if err != nil {
@@ -327,7 +326,7 @@ func (c *Config) ReadEnvironment() error {
 		c.SRVLookup = lookup
 	}

-	if t := os.Getenv(EnvBoundaryClientTimeout); t != "" {
+	if t := Getenv(EnvBoundaryClientTimeout); t != "" {
 		clientTimeout, err := parseutil.ParseDurationSecond(t)
 		if err != nil {
 			return fmt.Errorf("could not parse %q", EnvBoundaryClientTimeout)
@@ -335,7 +334,7 @@ func (c *Config) ReadEnvironment() error {
 		c.Timeout = clientTimeout
 	}

-	if v := os.Getenv(EnvBoundaryRateLimit); v != "" {
+	if v := Getenv(EnvBoundaryRateLimit); v != "" {
 		rateLimit, burstLimit, err := parseRateLimit(v)
 		if err != nil {
 			return err
@@ -346,31 +345,31 @@ func (c *Config) ReadEnvironment() error {
 	// TLS Config
 	{
 		var foundTLSConfig bool
-		if v := os.Getenv(EnvBoundaryCACert); v != "" {
+		if v := Getenv(EnvBoundaryCACert); v != "" {
 			foundTLSConfig = true
 			envCACert = v
 		}
-		if v := os.Getenv(EnvBoundaryCAPath); v != "" {
+		if v := Getenv(EnvBoundaryCAPath); v != "" {
 			foundTLSConfig = true
 			envCAPath = v
 		}
-		if v := os.Getenv(EnvBoundaryClientCert); v != "" {
+		if v := Getenv(EnvBoundaryClientCert); v != "" {
 			foundTLSConfig = true
 			envClientCert = v
 		}
-		if v := os.Getenv(EnvBoundaryClientKey); v != "" {
+		if v := Getenv(EnvBoundaryClientKey); v != "" {
 			foundTLSConfig = true
 			envClientKey = v
 		}
-		if v := os.Getenv(EnvBoundaryTLSInsecure); v != "" {
+		if v := Getenv(EnvBoundaryTLSInsecure); v != "" {
 			foundTLSConfig = true
 			var err error
 			envInsecure, err = strconv.ParseBool(v)
 			if err != nil {
-				return fmt.Errorf("could not parse BOUNDARY_TLS_INSECURE")
+				return fmt.Errorf("could not parse THRESHOLD_TLS_INSECURE")
 			}
 		}
-		if v := os.Getenv(EnvBoundaryTLSServerName); v != "" {
+		if v := Getenv(EnvBoundaryTLSServerName); v != "" {
 			foundTLSConfig = true
 			envServerName = v
 		}
@@ -405,7 +404,7 @@ func parseRateLimit(val string) (rate float64, burst int, err error) {
 	return rate, burst, err
 }

-// Client is the client to the Boundary API. Create a client with NewClient.
+// Client is the client to the Threshold API. Create a client with NewClient.
 type Client struct {
 	modifyLock sync.RWMutex
 	config     *Config
@@ -413,10 +412,10 @@ type Client struct {

 // NewClient returns a new client for the given configuration.
 //
-// If the configuration is nil, Boundary will use configuration from
+// If the configuration is nil, Threshold will use configuration from
 // DefaultConfig(), which is the recommended starting configuration.
 //
-// If the environment variable `BOUNDARY_TOKEN` is present, the token will be
+// If the environment variable `THRESHOLD_TOKEN` is present, the token will be
 // automatically added to the client. Otherwise, you must manually call
 // `SetToken()`.
 func NewClient(c *Config) (*Client, error) {
@@ -465,9 +464,9 @@ func (c *Client) Addr() string {
 	return c.config.Addr
 }

-// Sets the address of Boundary in the client. The format of address should
+// Sets the address of Threshold in the client. The format of address should
 // be "<Scheme>://<Host>:<Port>". Setting this on a client will override the
-// value of the BOUNDARY_ADDR environment variable.
+// value of the THRESHOLD_ADDR environment variable.
 func (c *Client) SetAddr(addr string) error {
 	c.modifyLock.Lock()
 	defer c.modifyLock.Unlock()
@@ -624,7 +623,7 @@ func copyHeaders(in http.Header) http.Header {
 	return ret
 }

-// NewRequest creates a new raw request object to query the Boundary controller
+// NewRequest creates a new raw request object to query the Threshold controller
 // configured for this client. This is an advanced method and generally
 // doesn't need to be called externally.
 func (c *Client) NewRequest(ctx context.Context, method, requestPath string, body any, opt ...Option) (*retryablehttp.Request, error) {
@@ -762,7 +761,7 @@ func (c *Client) Do(r *retryablehttp.Request, opt ...Option) (*Response, error)
 		return !unicode.IsPrint(c)
 	})
 	if idx != -1 {
-		return nil, fmt.Errorf("configured Boundary token contains non-printable characters and cannot be used")
+		return nil, fmt.Errorf("configured Threshold token contains non-printable characters and cannot be used")
 	}

 	if outputCurlString {
@@ -848,9 +847,9 @@ func (c *Client) Do(r *retryablehttp.Request, opt ...Option) (*Response, error)
 					"but the client is configured to use TLS. Please either enable TLS\n"+
 					"on the server or run the client with -address set to an address\n"+
 					"that uses the http protocol:\n\n"+
-					"    boundary <command> -address http://<address>\n\n"+
-					"You can also set the BOUNDARY_ADDR environment variable:\n\n\n"+
-					"    BOUNDARY_ADDR=http://<address> boundary <command>\n\n"+
+					"    threshold <command> -address http://<address>\n\n"+
+					"You can also set the THRESHOLD_ADDR environment variable:\n\n\n"+
+					"    THRESHOLD_ADDR=http://<address> threshold <command>\n\n"+
 					"where <address> is replaced by the actual address to the controller.",
 				err)
 		}
@@ -0,0 +1,56 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: BUSL-1.1
+
+package api
+
+import (
+	"os"
+	"strings"
+)
+
+const (
+	// legacyEnvPrefix is the environment variable prefix used by upstream
+	// HashiCorp Boundary. It is still honored as a fallback.
+	legacyEnvPrefix = "BOUNDARY_"
+	// envPrefix is the preferred environment variable prefix for Threshold.
+	envPrefix = "THRESHOLD_"
+)
+
+// PreferredEnvName returns the Threshold (THRESHOLD_*) form of an environment
+// variable name. Names that do not use the legacy BOUNDARY_ prefix are
+// returned unchanged.
+func PreferredEnvName(name string) string {
+	if strings.HasPrefix(name, legacyEnvPrefix) {
+		return envPrefix + strings.TrimPrefix(name, legacyEnvPrefix)
+	}
+	return name
+}
+
+// LegacyEnvName returns the legacy (BOUNDARY_*) form of an environment
+// variable name. Names that do not use the THRESHOLD_ prefix are returned
+// unchanged.
+func LegacyEnvName(name string) string {
+	if strings.HasPrefix(name, envPrefix) {
+		return legacyEnvPrefix + strings.TrimPrefix(name, envPrefix)
+	}
+	return name
+}
+
+// LookupEnv looks up an environment variable, preferring the THRESHOLD_*
+// name and falling back to the legacy BOUNDARY_* name. The name may be given
+// with either prefix; names with neither prefix are looked up as-is.
+func LookupEnv(name string) (string, bool) {
+	if v, ok := os.LookupEnv(PreferredEnvName(LegacyEnvName(name))); ok {
+		return v, true
+	}
+	return os.LookupEnv(LegacyEnvName(name))
+}
+
+// Getenv is like os.Getenv but follows the LookupEnv precedence. A set but
+// empty THRESHOLD_* variable falls through to the legacy BOUNDARY_* variable.
+func Getenv(name string) string {
+	if v := os.Getenv(PreferredEnvName(LegacyEnvName(name))); v != "" {
+		return v
+	}
+	return os.Getenv(LegacyEnvName(name))
+}
@@ -0,0 +1,24 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: BUSL-1.1
+
+package api
+
+import "testing"
+
+func TestEnvFallback(t *testing.T) {
+	t.Setenv("THRESHOLD_ZZ_TEST", "")
+	t.Setenv("BOUNDARY_ZZ_TEST", "old")
+	if got := Getenv("BOUNDARY_ZZ_TEST"); got != "old" {
+		t.Fatalf("want old, got %q", got)
+	}
+	t.Setenv("THRESHOLD_ZZ_TEST", "new")
+	if got := Getenv("BOUNDARY_ZZ_TEST"); got != "new" {
+		t.Fatalf("want new, got %q", got)
+	}
+	if got, ok := LookupEnv("THRESHOLD_ZZ_TEST"); !ok || got != "new" {
+		t.Fatalf("want new, got %q %v", got, ok)
+	}
+	if PreferredEnvName("BOUNDARY_ADDR") != "THRESHOLD_ADDR" || LegacyEnvName("THRESHOLD_ADDR") != "BOUNDARY_ADDR" {
+		t.Fatal("name mapping")
+	}
+}
@@ -5,7 +5,6 @@ package api

 import (
 	"fmt"
-	"os"
 	"strings"

 	retryablehttp "github.com/hashicorp/go-retryablehttp"
@@ -60,15 +59,15 @@ func (d *OutputStringError) parseRequest() {
 	for k, v := range d.Request.Header {
 		for _, h := range v {
 			if strings.ToLower(k) == "authorization" {
-				tokenName := os.Getenv("BOUNDARY_TOKEN_NAME")
-				keyringType := os.Getenv("BOUNDARY_KEYRING_TYPE")
+				tokenName := Getenv("THRESHOLD_TOKEN_NAME")
+				keyringType := Getenv("THRESHOLD_KEYRING_TYPE")
 				switch {
 				case tokenName == "none" || keyringType == "none":
 					h = `Bearer <token>`
 				case tokenName == "" && keyringType == "":
-					h = `Bearer $(boundary config get-token)`
+					h = `Bearer $(threshold config get-token)`
 				default:
-					h = fmt.Sprintf("Bearer $(boundary config get-token -keyring-type %s -token-name %s)", keyringType, tokenName)
+					h = fmt.Sprintf("Bearer $(threshold config get-token -keyring-type %s -token-name %s)", keyringType, tokenName)
 				}
 			}
 			d.parsedCurlString = fmt.Sprintf("%s -H \"%s: %s\"", d.parsedCurlString, k, h)
@@ -28,16 +28,16 @@ type AddTokenCommand struct {
 }

 func (c *AddTokenCommand) Synopsis() string {
-	return "Add an auth token to a running boundary cache"
+	return "Add an auth token to a running threshold cache"
 }

 func (c *AddTokenCommand) Help() string {
 	helpText := `
-Usage: boundary cache add-token [options]
+Usage: threshold cache add-token [options]

  Add an auth token to the cache:

-      $ boundary cache add-token
+      $ threshold cache add-token

  For a full list of examples, please see the documentation.

@@ -54,7 +54,7 @@ func (c *AddTokenCommand) Flags() *base.FlagSets {
 		Target:     &c.FlagAddr,
 		EnvVar:     api.EnvBoundaryAddr,
 		Completion: complete.PredictAnything,
-		Usage:      "Addr of the Boundary controller, as a complete URL (e.g. https://boundary.example.com:9200).",
+		Usage:      "Addr of the Threshold controller, as a complete URL (e.g. https://threshold.example.com:9200).",
 	})

 	f = set.NewFlagSet("Client Options")
@@ -21,18 +21,18 @@ type CacheCommand struct {
 }

 func (c *CacheCommand) Synopsis() string {
-	return "Manages the client side Boundary cache"
+	return "Manages the client side Threshold cache"
 }

 func (c *CacheCommand) Help() string {
 	helpText := `
-Usage: boundary cache [sub command] [options]
+Usage: threshold cache [sub command] [options]

-  This command allows interacting with the Boundary cache.
+  This command allows interacting with the Threshold cache.

  Start a cache:

-      $ boundary cache start
+      $ threshold cache start

  For a full list of examples, please see the documentation.

@@ -54,7 +54,7 @@ func (c *CacheCommand) AutocompleteFlags() complete.Flags {

 func (c *CacheCommand) Run(args []string) int {
 	if len(args) >= 2 && args[1] == "daemon" {
-		c.UI.Warn("The `boundary daemon` command is deprecated, use `boundary cache` instead")
+		c.UI.Warn("The `threshold daemon` command is deprecated, use `threshold cache` instead")
 	}
 	return cli.RunResultHelp
 }
@@ -24,7 +24,6 @@ import (
 )

 const (
-	dotDirname  = ".boundary"
 	pidFileName = "cache.pid"
 	logFileName = "cache.log"

@@ -54,16 +53,16 @@ type StartCommand struct {
 }

 func (c *StartCommand) Synopsis() string {
-	return "Start a Boundary cache"
+	return "Start a Threshold cache"
 }

 func (c *StartCommand) Help() string {
 	helpText := `
-Usage: boundary cache start [options]
+Usage: threshold cache start [options]

  Start a cache:

-      $ boundary cache start
+      $ threshold cache start

  For a full list of examples, please see the documentation.

@@ -78,7 +77,7 @@ func (c *StartCommand) Flags() *base.FlagSets {
 	f.StringVar(&base.StringVar{
 		Name:       "log-level",
 		Target:     &c.flagLogLevel,
-		EnvVar:     "BOUNDARY_LOG_LEVEL",
+		EnvVar:     "THRESHOLD_LOG_LEVEL",
 		Completion: complete.PredictSet("trace", "debug", "info", "warn", "err"),
 		Usage: "Log verbosity level, mostly as a fallback for events. Supported values (in order of more detail to less) are " +
 			"\"trace\", \"debug\", \"info\", \"warn\", and \"err\".",
@@ -255,7 +254,7 @@ func DefaultDotDirectory(ctx context.Context) (string, error) {
 	if err != nil {
 		return "", errors.Wrap(ctx, err, op)
 	}
-	return filepath.Join(homeDir, dotDirname), nil
+	return daemon.DotDirectory(homeDir), nil
 }

 // logFile returns a log file which is rotated after it reaches the provided
@@ -34,16 +34,16 @@ type StatusCommand struct {
 }

 func (c *StatusCommand) Synopsis() string {
-	return "Get the status information of the running boundary cache"
+	return "Get the status information of the running threshold cache"
 }

 func (c *StatusCommand) Help() string {
 	helpText := `
-Usage: boundary cache status [options]
+Usage: threshold cache status [options]

-  Get the status of the boundary cache:
+  Get the status of the threshold cache:

-      $ boundary cache status
+      $ threshold cache status

  For a full list of examples, please see the documentation.

@@ -17,16 +17,16 @@ type StopCommand struct {
 }

 func (c *StopCommand) Synopsis() string {
-	return "Stop the Boundary cache"
+	return "Stop the Threshold cache"
 }

 func (c *StopCommand) Help() string {
 	helpText := `
-Usage: boundary cache stop
+Usage: threshold cache stop

  Stop a cache:

-      $ boundary cache stop
+      $ threshold cache stop

  For a full list of examples, please see the documentation.

@@ -76,7 +76,7 @@ func startDaemon(ctx context.Context, baseCmd *base.Command) (started bool, _ er

 	cmdName, err := os.Executable()
 	if err != nil {
-		baseCmd.UI.Error(fmt.Sprintf("unable to find boundary binary for cache startup: %s", err.Error()))
+		baseCmd.UI.Error(fmt.Sprintf("unable to find threshold binary for cache startup: %s", err.Error()))
 		return false, err
 	}

@@ -113,7 +113,7 @@ func stopDaemon(ctx context.Context, baseCmd *base.Command) error {

 	cmdName, err := os.Executable()
 	if err != nil {
-		baseCmd.UI.Error(fmt.Sprintf("unable to find boundary binary for cache startup: %s", err.Error()))
+		baseCmd.UI.Error(fmt.Sprintf("unable to find threshold binary for cache startup: %s", err.Error()))
 		return err
 	}
 	cmd := exec.Command(cmdName, "cache", "stop")
@@ -54,16 +54,16 @@ type SearchCommand struct {
 }

 func (c *SearchCommand) Synopsis() string {
-	return "Search Boundary resources using client cache"
+	return "Search Threshold resources using client cache"
 }

 func (c *SearchCommand) Help() string {
 	helpText := `
-Usage: boundary search [options]
+Usage: threshold search [options]

-  Search a boundary resource:
+  Search a threshold resource:

-      $ boundary search -resource targets -query 'name="foo"'
+      $ threshold search -resource targets -query 'name="foo"'

  For a full list of examples, please see the documentation.

@@ -284,7 +284,7 @@ func TestCleanAndPickTokens(t *testing.T) {
 		assert.ElementsMatch(t, maps.Values(got), []string{at1a.Token, at1b.Token})
 	})

-	t.Run("boundary in memory auth token expires", func(t *testing.T) {
+	t.Run("threshold in memory auth token expires", func(t *testing.T) {
 		require.NoError(t, r.AddRawToken(ctx, boundaryAddr, at1a.Token))
 		require.NoError(t, r.AddRawToken(ctx, boundaryAddr, at1b.Token))

@@ -302,7 +302,7 @@ func TestCleanAndPickTokens(t *testing.T) {
 		assert.ElementsMatch(t, maps.Values(got), []string{at1a.Token})
 	})

-	t.Run("boundary in memory auth token not found", func(t *testing.T) {
+	t.Run("threshold in memory auth token not found", func(t *testing.T) {
 		require.NoError(t, r.AddRawToken(ctx, boundaryAddr, at1a.Token))
 		require.NoError(t, r.AddRawToken(ctx, boundaryAddr, at1b.Token))

@@ -320,7 +320,7 @@ func TestCleanAndPickTokens(t *testing.T) {
 		assert.ElementsMatch(t, maps.Values(got), []string{at1a.Token})
 	})

-	t.Run("boundary keyring auths token expires", func(t *testing.T) {
+	t.Run("threshold keyring auths token expires", func(t *testing.T) {
 		key1 := ringToken{"k1", "t1"}
 		atMap[key1] = keyringAuthToken1
 		require.NoError(t, r.AddKeyringToken(ctx, boundaryAddr, KeyringToken{
@@ -350,7 +350,7 @@ func TestCleanAndPickTokens(t *testing.T) {
 		assert.ElementsMatch(t, maps.Values(got), []string{keyringAuthToken1.Token})
 	})

-	t.Run("boundary in memory auth token check errors", func(t *testing.T) {
+	t.Run("threshold in memory auth token check errors", func(t *testing.T) {
 		require.NoError(t, r.AddRawToken(ctx, boundaryAddr, at1a.Token))
 		require.NoError(t, r.AddRawToken(ctx, boundaryAddr, at1b.Token))

@@ -368,7 +368,7 @@ func TestCleanAndPickTokens(t *testing.T) {
 		assert.ElementsMatch(t, maps.Values(got), []string{at1a.Token})
 	})

-	t.Run("boundary keyring auths token check errors", func(t *testing.T) {
+	t.Run("threshold keyring auths token check errors", func(t *testing.T) {
 		key1 := ringToken{"k1", "t1"}
 		atMap[key1] = keyringAuthToken1
 		require.NoError(t, r.AddKeyringToken(ctx, boundaryAddr, KeyringToken{
@@ -23,7 +23,7 @@ var ErrRefreshNotSupported = stderrors.New("refresh tokens are not supported for
 type RefreshTokenValue string

 // sentinelNoRefreshToken is the value set in the refresh token table when
-// Boundary returns resources but no refresh tokens. The presence of this value
+// Threshold returns resources but no refresh tokens. The presence of this value
 // indicates that the boundary instance queried does not support refresh tokens.
 const sentinelNoRefreshToken RefreshTokenValue = "__no_refresh_token_supported__"

@@ -37,7 +37,7 @@ func upsertUserAndAuthToken(ctx context.Context, reader db.Reader, writer db.Wri
 	case util.IsNil(at):
 		return errors.New(ctx, errors.InvalidParameter, op, "auth token is nil")
 	case bAddr == "":
-		return errors.New(ctx, errors.InvalidParameter, op, "boundary address is empty")
+		return errors.New(ctx, errors.InvalidParameter, op, "threshold address is empty")
 	case at.Id == "":
 		return errors.New(ctx, errors.InvalidParameter, op, "auth token id is empty")
 	case at.UserId == "":
@@ -114,15 +114,15 @@ func (r *Repository) AddRawToken(ctx context.Context, bAddr string, rawToken str
 	const op = "cache.(Repository).AddRawToken"
 	switch {
 	case rawToken == "":
-		return errors.New(ctx, errors.InvalidParameter, op, "boundary auth token is empty", errors.WithoutEvent())
+		return errors.New(ctx, errors.InvalidParameter, op, "threshold auth token is empty", errors.WithoutEvent())
 	case bAddr == "":
-		return errors.New(ctx, errors.InvalidParameter, op, "boundary address is empty", errors.WithoutEvent())
+		return errors.New(ctx, errors.InvalidParameter, op, "threshold address is empty", errors.WithoutEvent())
 	}

 	// rawToken should look something like at_1234567890_someencryptedpayload
 	atIdParts := strings.SplitN(rawToken, "_", 4)
 	if len(atIdParts) != 3 {
-		return errors.New(ctx, errors.InvalidParameter, op, "boundary auth token is is malformed", errors.WithoutEvent())
+		return errors.New(ctx, errors.InvalidParameter, op, "threshold auth token is is malformed", errors.WithoutEvent())
 	}
 	atId := strings.Join(atIdParts[:AuthTokenIdSegmentCount], "_")

@@ -192,9 +192,9 @@ func (r *Repository) AddKeyringToken(ctx context.Context, bAddr string, token Ke
 	case token.KeyringType == "":
 		return errors.New(ctx, errors.InvalidParameter, op, "keyring type is empty", errors.WithoutEvent())
 	case token.AuthTokenId == "":
-		return errors.New(ctx, errors.InvalidParameter, op, "boundary auth token id is empty", errors.WithoutEvent())
+		return errors.New(ctx, errors.InvalidParameter, op, "threshold auth token id is empty", errors.WithoutEvent())
 	case bAddr == "":
-		return errors.New(ctx, errors.InvalidParameter, op, "boundary address is empty", errors.WithoutEvent())
+		return errors.New(ctx, errors.InvalidParameter, op, "threshold address is empty", errors.WithoutEvent())
 	}
 	kt := token.clone()
 	keyringStoredAt, err := r.tokenKeyringFn(kt.KeyringType, kt.TokenName)
@@ -103,7 +103,7 @@ func TestRepository_AddKeyringToken(t *testing.T) {
 				TokenName:   tokenName,
 				AuthTokenId: at.Id,
 			},
-			errorContains: "boundary address is empty",
+			errorContains: "threshold address is empty",
 		},
 		{
 			name: "missing token",
@@ -130,7 +130,7 @@ func TestRepository_AddKeyringToken(t *testing.T) {
 				KeyringType: keyring,
 				TokenName:   tokenName,
 			},
-			errorContains: "boundary auth token id is empty",
+			errorContains: "threshold auth token id is empty",
 		},
 		{
 			name: "unmatching auth token id",
@@ -218,7 +218,7 @@ func TestRepository_AddRawToken(t *testing.T) {
 		{
 			name:          "missing address",
 			rawAt:         at.Token,
-			errorContains: "boundary address is empty",
+			errorContains: "threshold address is empty",
 		},
 		{
 			name:          "missing token",
@@ -229,7 +229,7 @@ func TestRepository_AddRawToken(t *testing.T) {
 			name:          "malformed auth token",
 			addr:          "address",
 			rawAt:         fmt.Sprintf("%s_extraunderscore", at.Token),
-			errorContains: "boundary auth token is is malformed",
+			errorContains: "threshold auth token is is malformed",
 		},
 		{
 			name:          "not found in boundary",
@@ -1079,7 +1079,7 @@ func TestUpsertUserAndAuthToken(t *testing.T) {
 				writer:        txWriter,
 				addr:          "",
 				at:            defaultAt,
-				errorContains: "boundary address is empty",
+				errorContains: "threshold address is empty",
 			},
 			{
 				name:          "auth token is nil",
@@ -256,7 +256,7 @@ func toApiResult(sr *cache.SearchResult) *SearchResult {

 var errSearchNotSupported = &api.Error{
 	Kind:    "Unsupported Search Request",
-	Message: "The request is for a Boundary instance that doesn't support search. The Boundary instance must support refresh tokens for search to be supported.",
+	Message: "The request is for a Threshold instance that doesn't support search. The Threshold instance must support refresh tokens for search to be supported.",
 }

 func writeUnsupportedError(w http.ResponseWriter) {
@@ -191,7 +191,7 @@ func defaultBoundaryTokenReader(ctx context.Context, cp ClientProvider) (cache.B
 		at, err := atClient.Read(ctx, atId)
 		if err != nil {
 			if api.ErrPermissionDenied.Is(err) {
-				return nil, errors.Wrap(ctx, err, op, errors.WithMsg("Failed to get auth token from Boundary"), errors.WithCode(errors.Forbidden), errors.WithoutEvent())
+				return nil, errors.Wrap(ctx, err, op, errors.WithMsg("Failed to get auth token from Threshold"), errors.WithCode(errors.Forbidden), errors.WithoutEvent())
 			}
 			return nil, errors.Wrap(ctx, err, op, errors.WithoutEvent())
 		}
@@ -360,7 +360,7 @@ func (s *CacheServer) printInfo(ctx context.Context) {
 	verInfo := version.Get()
 	if verInfo.Version != "" {
 		s.infoKeys = append(s.infoKeys, "version")
-		s.info["version"] = verInfo.FullVersionNumber(false)
+		s.info["version"] = verInfo.DisplayVersionNumber(false)
 	}
 	if verInfo.Revision != "" {
 		s.info["version sha"] = strings.Trim(verInfo.Revision, "'")
@@ -506,7 +506,7 @@ func setupEventing(ctx context.Context, logger hclog.Logger, serializationLock *

 // openStore will open the underlying store for the db. If no options are
 // provided, it will default to an on disk store using the user's home dir +
-// ".boundary/cache.db". If a url is provided, it will use that as the store.
+// ".threshold/cache.db". If a url is provided, it will use that as the store.
 // Supported options: WithUrl, WithLogger, WithHomeDir
 func openStore(ctx context.Context, opt ...Option) (*db.DB, error) {
 	const op = "daemon.openStore"
@@ -562,7 +562,7 @@ func defaultDbUrl(ctx context.Context, opt ...Option) (string, error) {
 			return "", errors.Wrap(ctx, err, op)
 		}
 	}
-	dotDir := filepath.Join(opts.withHomeDir, dotDirname)
+	dotDir := DotDirectory(opts.withHomeDir)
 	if err := os.MkdirAll(dotDir, 0o700); err != nil {
 		return "", errors.Wrap(ctx, err, op)
 	}
@@ -584,10 +584,27 @@ func defaultDbUrl(ctx context.Context, opt ...Option) (string, error) {
 	return fmt.Sprintf("%s%s", fileName, fkPragma), nil
 }

+// DotDirectory returns the path of the client cache dot directory inside the
+// given home directory. The Threshold directory is preferred; if it does not
+// exist but the legacy directory used by upstream HashiCorp Boundary does, the
+// legacy directory is used so existing state keeps being found.
+func DotDirectory(homeDir string) string {
+	preferred := filepath.Join(homeDir, dotDirname)
+	if _, err := os.Stat(preferred); err == nil {
+		return preferred
+	}
+	legacy := filepath.Join(homeDir, legacyDotDirname)
+	if fi, err := os.Stat(legacy); err == nil && fi.IsDir() {
+		return legacy
+	}
+	return preferred
+}
+
 const (
-	dotDirname = ".boundary"
-	dbFileName = "cache.db"
-	fkPragma   = "?_pragma=foreign_keys(1)"
+	dotDirname       = ".threshold"
+	legacyDotDirname = ".boundary"
+	dbFileName       = "cache.db"
+	fkPragma         = "?_pragma=foreign_keys(1)"
 )

 type gormDebugLogger struct {
@@ -49,7 +49,7 @@ type BoundaryStatus struct {
 	Address string `json:"address,omitempty"`
 	// Whether the controller responses are supported by the cache
 	CacheSupport string `json:"cache_support,omitempty"`
-	// How long ago the Boundary instance was checked for cache compatibility
+	// How long ago the Threshold instance was checked for cache compatibility
 	LastSupportCheck time.Duration `json:"last_support_check,omitempty"`
 }

@@ -131,7 +131,7 @@ func toApiStatus(in *cache.Status, started time.Time, socketAddr, logLocation st
 		// sleeps.
 		Uptime:        time.Since(started.Round(0)),
 		SocketAddress: socketAddr,
-		Version:       version.Get().FullVersionNumber(true),
+		Version:       version.Get().DisplayVersionNumber(true),
 		LogLocation:   logLocation,
 	}

@@ -72,16 +72,20 @@ const (
 	// maxLineLength is the maximum width of any line.
 	maxLineLength int = 78

-	envToken                             = "BOUNDARY_TOKEN"
-	EnvTokenName                         = "BOUNDARY_TOKEN_NAME"
-	EnvKeyringType                       = "BOUNDARY_KEYRING_TYPE"
-	envRecoveryConfig                    = "BOUNDARY_RECOVERY_CONFIG"
-	envSkipCacheDaemon                   = "BOUNDARY_SKIP_CACHE_DAEMON"
-	envSkipClientAgent                   = "BOUNDARY_SKIP_CLIENT_AGENT"
-	EnvClientAgentPort                   = "BOUNDARY_CLIENT_AGENT_LISTENING_PORT"
-	EnvBoundaryClientAgentCliErrorOutput = "BOUNDARY_CLIENT_AGENT_CLI_ERROR_OUTPUT"
+	envToken                             = "THRESHOLD_TOKEN"
+	EnvTokenName                         = "THRESHOLD_TOKEN_NAME"
+	EnvKeyringType                       = "THRESHOLD_KEYRING_TYPE"
+	envRecoveryConfig                    = "THRESHOLD_RECOVERY_CONFIG"
+	envSkipCacheDaemon                   = "THRESHOLD_SKIP_CACHE_DAEMON"
+	envSkipClientAgent                   = "THRESHOLD_SKIP_CLIENT_AGENT"
+	EnvClientAgentPort                   = "THRESHOLD_CLIENT_AGENT_LISTENING_PORT"
+	EnvBoundaryClientAgentCliErrorOutput = "THRESHOLD_CLIENT_AGENT_CLI_ERROR_OUTPUT"

-	StoredTokenName = "HashiCorp Boundary Auth Token"
+	// StoredTokenName is the name of the credential entry written to
+	// wincred/keychain keyrings. LegacyStoredTokenName is the name used by
+	// upstream HashiCorp Boundary; it is only read (and deleted on logout).
+	StoredTokenName       = "Threshold Auth Token"
+	LegacyStoredTokenName = "HashiCorp Boundary Auth Token"
 )

 // reRemoveWhitespace is a regular expression for stripping whitespace from
@@ -339,10 +343,10 @@ func (c *Command) Client(opt ...Option) (*api.Client, error) {
 		}
 		c.client.SetToken(token)

-	case os.Getenv(envToken) != "":
-		// Backwards compat: allow reading from existing BOUNDARY_TOKEN env var
-		c.UI.Warn(`Direct usage of BOUNDARY_TOKEN env var is deprecated; please use "-token env://<env var name>" format, e.g. "-token env://BOUNDARY_TOKEN" to specify an env var to use.`)
-		c.client.SetToken(os.Getenv(envToken))
+	case api.Getenv(envToken) != "":
+		// Backwards compat: allow reading from existing THRESHOLD_TOKEN env var
+		c.UI.Warn(`Direct usage of THRESHOLD_TOKEN env var is deprecated; please use "-token env://<env var name>" format, e.g. "-token env://THRESHOLD_TOKEN" to specify an env var to use.`)
+		c.client.SetToken(api.Getenv(envToken))

 	case c.client.Token() == "" && strings.ToLower(c.FlagKeyringType) != "none":
 		keyringType, tokenName, err := c.DiscoverKeyringTokenInfo()
@@ -393,7 +397,7 @@ func (c *Command) FlagSet(bit FlagSetBit) *FlagSets {
 				Target:     &c.FlagAddr,
 				EnvVar:     api.EnvBoundaryAddr,
 				Completion: complete.PredictAnything,
-				Usage:      "Addr of the Boundary controller, as a complete URL (e.g. https://boundary.example.com:9200).",
+				Usage:      "Addr of the Threshold controller, as a complete URL (e.g. https://threshold.example.com:9200).",
 			})

 			f.StringVar(&StringVar{
@@ -421,7 +425,7 @@ func (c *Command) FlagSet(bit FlagSetBit) *FlagSets {
 				EnvVar:     api.EnvBoundaryClientCert,
 				Completion: complete.PredictFiles("*"),
 				Usage: "Path on the local disk to a single PEM-encoded CA " +
-					"certificate to use for TLS authentication to the Boundary Controller. If " +
+					"certificate to use for TLS authentication to the Threshold Controller. If " +
 					"this flag is specified, -client-key is also required.",
 			})

@@ -439,7 +443,7 @@ func (c *Command) FlagSet(bit FlagSetBit) *FlagSets {
 				Target:     &c.flagTLSServerName,
 				EnvVar:     api.EnvBoundaryTLSServerName,
 				Completion: complete.PredictAnything,
-				Usage: "Name to use as the SNI host when connecting to the Boundary " +
+				Usage: "Name to use as the SNI host when connecting to the Threshold " +
 					"server via TLS.",
 			})

@@ -449,7 +453,7 @@ func (c *Command) FlagSet(bit FlagSetBit) *FlagSets {
 				EnvVar: api.EnvBoundaryTLSInsecure,
 				Usage: "Disable verification of TLS certificates. Using this option " +
 					"is highly discouraged as it decreases the security of data " +
-					"transmissions to and from the Boundary server.",
+					"transmissions to and from the Threshold server.",
 			})
 		}

@@ -5,7 +5,7 @@ package base

 const (
 	// FlagNameAddr is the flag used in the base command to read in the
-	// address of the Boundary server.
+	// address of the Threshold server.
 	FlagNameAddr = "addr"
 	// FlagnameCACert is the flag used in the base command to read in the CA
 	// cert.
@@ -28,6 +28,6 @@ const (
 )

 const (
-	EnvBoundaryCLINoColor = `BOUNDARY_CLI_NO_COLOR`
-	EnvBoundaryCLIFormat  = `BOUNDARY_CLI_FORMAT`
+	EnvBoundaryCLINoColor = `THRESHOLD_CLI_NO_COLOR`
+	EnvBoundaryCLIFormat  = `THRESHOLD_CLI_FORMAT`
 )
@@ -350,7 +350,7 @@ func (b *Server) createInitialLdapAuthMethod(ctx context.Context, host string, p
 		scope.Global.String(),
 		ldap.WithUrls(ctx, u),
 		ldap.WithName(ctx, "Generated global scope initial ldap auth method"),
-		ldap.WithDescription(ctx, "Provides initial administrative and unprivileged authentication into Boundary"),
+		ldap.WithDescription(ctx, "Provides initial administrative and unprivileged authentication into Threshold"),
 		ldap.WithDiscoverDn(ctx),
 		ldap.WithUserDn(ctx, testdirectory.DefaultUserDN),
 		ldap.WithGroupDn(ctx, testdirectory.DefaultGroupDN),
@@ -602,7 +602,7 @@ func (b *Server) createInitialOidcAuthMethod(ctx context.Context) (*oidc.AuthMet
 		b.DevOidcSetup.clientId,
 		b.DevOidcSetup.clientSecret,
 		oidc.WithName("Generated global scope initial oidc auth method"),
-		oidc.WithDescription("Provides initial administrative and unprivileged authentication into Boundary"),
+		oidc.WithDescription("Provides initial administrative and unprivileged authentication into Threshold"),
 		oidc.WithIssuer(discoveryUrl),
 		oidc.WithApiUrl(b.DevOidcSetup.callbackUrl),
 		oidc.WithSigningAlgs(oidc.EdDSA),
@@ -7,7 +7,7 @@ import (
 	"errors"
 	"flag"
 	"fmt"
-	"os"
+	"github.com/hashicorp/boundary/api"
 	"regexp"
 	"sort"
 	"strconv"
@@ -51,7 +51,7 @@ type BoolVar struct {

 func (f *FlagSet) BoolVar(i *BoolVar) {
 	def := i.Default
-	if v, exist := os.LookupEnv(i.EnvVar); exist {
+	if v, exist := api.LookupEnv(i.EnvVar); exist {
 		if b, err := strconv.ParseBool(v); err == nil {
 			def = b
 		}
@@ -112,7 +112,7 @@ type Int64Var struct {

 func (f *FlagSet) Int64Var(i *Int64Var) {
 	initial := i.Default
-	if v, exist := os.LookupEnv(i.EnvVar); exist {
+	if v, exist := api.LookupEnv(i.EnvVar); exist {
 		if i, err := strconv.ParseInt(v, 0, 64); err == nil {
 			initial = i
 		}
@@ -176,7 +176,7 @@ type Uint64Var struct {

 func (f *FlagSet) Uint64Var(i *Uint64Var) {
 	initial := i.Default
-	if v, exist := os.LookupEnv(i.EnvVar); exist {
+	if v, exist := api.LookupEnv(i.EnvVar); exist {
 		if i, err := strconv.ParseUint(v, 0, 64); err == nil {
 			initial = i
 		}
@@ -240,7 +240,7 @@ type Uint16Var struct {

 func (f *FlagSet) Uint16Var(i *Uint16Var) {
 	initial := i.Default
-	if v, exist := os.LookupEnv(i.EnvVar); exist {
+	if v, exist := api.LookupEnv(i.EnvVar); exist {
 		if i, err := strconv.ParseUint(v, 0, 16); err == nil {
 			initial = uint16(i)
 		}
@@ -304,7 +304,7 @@ type StringVar struct {

 func (f *FlagSet) StringVar(i *StringVar) {
 	initial := i.Default
-	if v, exist := os.LookupEnv(i.EnvVar); exist {
+	if v, exist := api.LookupEnv(i.EnvVar); exist {
 		initial = v
 	}

@@ -361,7 +361,7 @@ type Float64Var struct {

 func (f *FlagSet) Float64Var(i *Float64Var) {
 	initial := i.Default
-	if v, exist := os.LookupEnv(i.EnvVar); exist {
+	if v, exist := api.LookupEnv(i.EnvVar); exist {
 		if i, err := strconv.ParseFloat(v, 64); err == nil {
 			initial = i
 		}
@@ -425,7 +425,7 @@ type DurationVar struct {

 func (f *FlagSet) DurationVar(i *DurationVar) {
 	initial := i.Default
-	if v, exist := os.LookupEnv(i.EnvVar); exist {
+	if v, exist := api.LookupEnv(i.EnvVar); exist {
 		if d, err := time.ParseDuration(appendDurationSuffix(v)); err == nil {
 			initial = d
 		}
@@ -507,7 +507,7 @@ type StringSliceVar struct {

 func (f *FlagSet) StringSliceVar(i *StringSliceVar) {
 	initial := i.Default
-	if v, exist := os.LookupEnv(i.EnvVar); exist {
+	if v, exist := api.LookupEnv(i.EnvVar); exist {
 		parts := strings.Split(v, ",")
 		for i := range parts {
 			parts[i] = strings.TrimSpace(parts[i])
@@ -7,7 +7,6 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
-	"os"
 	"sort"
 	"strings"
 	"unicode"
@@ -376,7 +375,7 @@ func Format(ui cli.Ui) string {
 		return t.Format
 	}

-	format := os.Getenv(EnvBoundaryCLIFormat)
+	format := api.Getenv(EnvBoundaryCLIFormat)
 	if format == "" {
 		format = "table"
 	}
@@ -156,7 +156,7 @@ func (b *Server) CreateInitialPasswordAuthMethod(ctx context.Context) (*password
 	}
 	authMethod, err := password.NewAuthMethod(ctx, scope.Global.String(),
 		password.WithName("Generated global scope initial password auth method"),
-		password.WithDescription("Provides initial administrative and unprivileged authentication into Boundary"),
+		password.WithDescription("Provides initial administrative and unprivileged authentication into Threshold"),
 	)
 	if err != nil {
 		return nil, nil, fmt.Errorf("error creating new in memory auth method: %w", err)
@@ -355,7 +355,7 @@ func (b *Server) CreateInitialScopes(ctx context.Context, opt ...Option) (*iam.S
 	}
 	iamOpts := []iam.Option{
 		iam.WithName("Generated org scope"),
-		iam.WithDescription("Provides an initial org scope in Boundary"),
+		iam.WithDescription("Provides an initial org scope in Threshold"),
 		iam.WithRandomReader(b.SecureRandomReader),
 		iam.WithPublicId(b.DevOrgId),
 	}
@@ -381,7 +381,7 @@ func (b *Server) CreateInitialScopes(ctx context.Context, opt ...Option) (*iam.S
 	}
 	iamOpts = []iam.Option{
 		iam.WithName("Generated project scope"),
-		iam.WithDescription("Provides an initial project scope in Boundary"),
+		iam.WithDescription("Provides an initial project scope in Threshold"),
 		iam.WithRandomReader(b.SecureRandomReader),
 		iam.WithPublicId(b.DevProjectId),
 	}
@@ -430,7 +430,7 @@ func (b *Server) CreateInitialHostResources(ctx context.Context) (*static.HostCa
 	}
 	opts := []static.Option{
 		static.WithName("Generated host catalog"),
-		static.WithDescription("Provides an initial host catalog in Boundary"),
+		static.WithDescription("Provides an initial host catalog in Threshold"),
 		static.WithPublicId(b.DevHostCatalogId),
 	}
 	hc, err := static.NewHostCatalog(ctx, b.DevProjectId, opts...)
@@ -455,7 +455,7 @@ func (b *Server) CreateInitialHostResources(ctx context.Context) (*static.HostCa
 	}
 	opts = []static.Option{
 		static.WithName("Generated host"),
-		static.WithDescription("Provides an initial host in Boundary"),
+		static.WithDescription("Provides an initial host in Threshold"),
 		static.WithAddress(b.DevHostAddress),
 		static.WithPublicId(b.DevHostId),
 	}
@@ -478,7 +478,7 @@ func (b *Server) CreateInitialHostResources(ctx context.Context) (*static.HostCa
 	}
 	opts = []static.Option{
 		static.WithName("Generated host set"),
-		static.WithDescription("Provides an initial host set in Boundary"),
+		static.WithDescription("Provides an initial host set in Threshold"),
 		static.WithPublicId(b.DevHostSetId),
 	}
 	hs, err := static.NewHostSet(ctx, hc.PublicId, opts...)
@@ -515,8 +515,8 @@ func (b *Server) CreateInitialTargetWithAddress(ctx context.Context) (target.Tar
 		return nil, fmt.Errorf("failed to create target repository: %w", err)
 	}

-	// When this function is not called as part of boundary dev (eg: as part of
-	// boundary database init or tests), generate random target ids.
+	// When this function is not called as part of threshold dev (eg: as part of
+	// threshold database init or tests), generate random target ids.
 	if len(b.DevTargetId) == 0 {
 		b.DevTargetId, err = db.NewPublicId(ctx, globals.TcpTargetPrefix)
 		if err != nil {
@@ -531,7 +531,7 @@ func (b *Server) CreateInitialTargetWithAddress(ctx context.Context) (target.Tar
 	}
 	opts := []target.Option{
 		target.WithName("Generated target with a direct address"),
-		target.WithDescription("Provides an initial target using an address in Boundary"),
+		target.WithDescription("Provides an initial target using an address in Threshold"),
 		target.WithDefaultPort(uint32(b.DevTargetDefaultPort)),
 		target.WithSessionMaxSeconds(uint32(b.DevTargetSessionMaxSeconds)),
 		target.WithSessionConnectionLimit(int32(b.DevTargetSessionConnectionLimit)),
@@ -580,8 +580,8 @@ func (b *Server) CreateInitialTargetWithHostSources(ctx context.Context) (target
 		return nil, fmt.Errorf("failed to create target repository: %w", err)
 	}

-	// When this function is not called as part of boundary dev (eg: as part of
-	// boundary database init or tests), generate random target ids.
+	// When this function is not called as part of threshold dev (eg: as part of
+	// threshold database init or tests), generate random target ids.
 	if len(b.DevSecondaryTargetId) == 0 {
 		b.DevSecondaryTargetId, err = db.NewPublicId(ctx, globals.TcpTargetPrefix)
 		if err != nil {
@@ -594,7 +594,7 @@ func (b *Server) CreateInitialTargetWithHostSources(ctx context.Context) (target

 	opts := []target.Option{
 		target.WithName("Generated target using host sources"),
-		target.WithDescription("Provides a target using host sources in Boundary"),
+		target.WithDescription("Provides a target using host sources in Threshold"),
 		target.WithDefaultPort(uint32(b.DevTargetDefaultPort)),
 		target.WithSessionMaxSeconds(uint32(b.DevTargetSessionMaxSeconds)),
 		target.WithSessionConnectionLimit(int32(b.DevTargetSessionConnectionLimit)),
@@ -615,7 +615,7 @@ func (b *Server) CreateInitialTargetWithHostSources(ctx context.Context) (target
 }

 // Create targets that can be connected to using an alias. The three targets created are:
-//   - "postgres.boundary.dev": the Boundary dev postgres instance. Uses brokered credentials
+//   - "postgres.boundary.dev": the Threshold dev postgres instance. Uses brokered credentials
 //   - "www.hashicorp.com": a web target
 //   - "ssh.boundary.dev": A localhost ssh target
 func (b *Server) CreateInitialTargetsWithAlias(ctx context.Context) error {
@@ -668,7 +668,7 @@ func (b *Server) CreateInitialTargetsWithAlias(ctx context.Context) error {
 func (b *Server) createSshAliasTarget(ctx context.Context, targetRepo *target.Repository, aliasRepo *aliastar.Repository) error {
 	opts := []target.Option{
 		target.WithName("Generated localhost ssh target with an alias"),
-		target.WithDescription("Provides an initial localhost target to SSH to using an alias in Boundary"),
+		target.WithDescription("Provides an initial localhost target to SSH to using an alias in Threshold"),
 		target.WithDefaultPort(22),
 		target.WithSessionMaxSeconds(uint32(b.DevTargetSessionMaxSeconds)),
 		target.WithSessionConnectionLimit(int32(b.DevTargetSessionConnectionLimit)),
@@ -716,7 +716,7 @@ func (b *Server) createPostgresAliasTarget(ctx context.Context,

 	opts := []target.Option{
 		target.WithName("Generated local postgres target with alias"),
-		target.WithDescription(fmt.Sprintf("Provides a local postgres target using aliasing in Boundary. Connect using the flag `-dbname %s`", dbname)),
+		target.WithDescription(fmt.Sprintf("Provides a local postgres target using aliasing in Threshold. Connect using the flag `-dbname %s`", dbname)),
 		target.WithDefaultPort(uint32(port)),
 		target.WithAddress(host),
 		target.WithSessionMaxSeconds(uint32(b.DevTargetSessionMaxSeconds)),
@@ -779,7 +779,7 @@ func (b *Server) createWebTarget(ctx context.Context,
 ) error {
 	opts := []target.Option{
 		target.WithName("www.hashicorp.com"),
-		target.WithDescription("Provides an initial web target using an address in Boundary. Note: Only HTTPS is supported, as this target uses port 443. Alias names for web targets should match the URL for the target."),
+		target.WithDescription("Provides an initial web target using an address in Threshold. Note: Only HTTPS is supported, as this target uses port 443. Alias names for web targets should match the URL for the target."),
 		target.WithDefaultPort(443),
 		target.WithSessionMaxSeconds(5),
 		target.WithSessionConnectionLimit(int32(b.DevTargetSessionConnectionLimit)),
@@ -8,7 +8,7 @@ package docker

 import (
 	"fmt"
-	"os"
+	"github.com/hashicorp/boundary/api"
 	"strings"

 	"github.com/hashicorp/boundary/globals"
@@ -54,8 +54,8 @@ func startDbInDockerSupported(dialect string, opt ...Option) (cleanup func() err
 	switch dialect {
 	case "postgres", "pgx":
 		switch {
-		case os.Getenv("BOUNDARY_TESTING_PG_URL") != "":
-			url = os.Getenv("BOUNDARY_TESTING_PG_URL")
+		case api.Getenv("THRESHOLD_TESTING_PG_URL") != "":
+			url = api.Getenv("THRESHOLD_TESTING_PG_URL")
 			return func() error { return nil }, url, "", nil
 		case repository != "":
 			runOpts.Repository = repository
@@ -20,12 +20,12 @@ const (
 )

 // buildInfoVec is a gauge metric whose value is always equal to 1 and whose
-// labels contain the current go version, git revision, and boundary version.
+// labels contain the current go version, git revision, and threshold version.
 var buildInfoVec = prometheus.NewGaugeVec(
 	prometheus.GaugeOpts{
 		Namespace: globals.MetricNamespace,
 		Name:      "build_info",
-		Help:      "Gauge with labels describing go version, git revision hash, and Boundary release version.",
+		Help:      "Gauge with labels describing go version, git revision hash, and Threshold release version.",
 	},
 	[]string{labelGoVersion, labelGitRevision, labelBoundaryVersion},
 )
@@ -28,7 +28,11 @@ const (

 	DefaultTokenName = "default"
 	LoginCollection  = "login"
-	PassPrefix       = "HashiCorp_Boundary"
+	// PassPrefix is the prefix used for tokens stored in "pass"-style
+	// keyrings. LegacyPassPrefix is the value used by upstream HashiCorp
+	// Boundary; it is only read as a fallback and never written.
+	PassPrefix       = "Threshold"
+	LegacyPassPrefix = "HashiCorp_Boundary"
 )

 // ErrNoToken is returned when no matching token could be found in the keyring
@@ -125,11 +129,15 @@ func ReadTokenFromKeyring(ui cli.Ui, keyringType, tokenName string) (*authtokens

 	case WincredKeyring, KeychainKeyring:
 		token, err = zkeyring.Get(StoredTokenName, tokenName)
+		if err == zkeyring.ErrNotFound {
+			// Fall back to the entry name used by upstream HashiCorp Boundary
+			token, err = zkeyring.Get(LegacyStoredTokenName, tokenName)
+		}
 		if err != nil {
 			if err == zkeyring.ErrNotFound {
 				ui.Error("No saved credential found, continuing without")
 			} else {
-				ui.Warn("Token must be provided via BOUNDARY_TOKEN env var or -token flag. Reading the token can also be disabled via -keyring-type=none.")
+				ui.Warn("Token must be provided via THRESHOLD_TOKEN env var or -token flag. Reading the token can also be disabled via -keyring-type=none.")
 				return nil, fmt.Errorf("%s: error reading auth token from keyring: %w", op, err)
 			}
 		}
@@ -143,13 +151,26 @@ func ReadTokenFromKeyring(ui cli.Ui, keyringType, tokenName string) (*authtokens

 		kr, err := nkeyring.Open(krConfig)
 		if err != nil {
-			ui.Warn("Token must be provided via BOUNDARY_TOKEN env var or -token flag. Reading the token can also be disabled via -keyring-type=none.")
+			ui.Warn("Token must be provided via THRESHOLD_TOKEN env var or -token flag. Reading the token can also be disabled via -keyring-type=none.")
 			return nil, fmt.Errorf("%s: failed to open keyring: %w", op, err)
 		}

 		item, err := kr.Get(tokenName)
 		if err != nil {
-			ui.Warn("Token must be provided via BOUNDARY_TOKEN env var or -token flag. Reading the token can also be disabled via -keyring-type=none.")
+			// Fall back to the keyring prefix used by upstream HashiCorp Boundary
+			legacyKr, legacyErr := nkeyring.Open(nkeyring.Config{
+				LibSecretCollectionName: LoginCollection,
+				PassPrefix:              LegacyPassPrefix,
+				AllowedBackends:         []nkeyring.BackendType{nkeyring.BackendType(keyringType)},
+			})
+			if legacyErr == nil {
+				if legacyItem, getErr := legacyKr.Get(tokenName); getErr == nil {
+					item, err = legacyItem, nil
+				}
+			}
+		}
+		if err != nil {
+			ui.Warn("Token must be provided via THRESHOLD_TOKEN env var or -token flag. Reading the token can also be disabled via -keyring-type=none.")
 			return nil, fmt.Errorf("%s: failed to get token from keyring: %w", op, err)
 		}

@@ -5,8 +5,8 @@ package logging

 import (
 	"fmt"
+	"github.com/hashicorp/boundary/api"
 	"io"
-	"os"
 	"strings"

 	log "github.com/hashicorp/go-hclog"
@@ -67,7 +67,7 @@ func ParseLogFormat(format string) (LogFormat, error) {

 // ParseEnvLogFormat parses the log format from an environment variable.
 func ParseEnvLogFormat() LogFormat {
-	logFormat := os.Getenv("BOUNDARY_LOG_FORMAT")
+	logFormat := api.Getenv("THRESHOLD_LOG_FORMAT")
 	switch strings.ToLower(logFormat) {
 	case "json":
 		return JSONFormat
@@ -192,7 +192,7 @@ func WithStatusCode(statusCode int) Option {
 }

 // WithDatabaseTemplate allows for using an existing database template for
-// initializing the boundary database.
+// initializing the threshold database.
 func WithDatabaseTemplate(template string) Option {
 	return func(o *Options) {
 		o.withDatabaseTemplate = template
@@ -9,6 +9,7 @@ import (
 	"crypto/tls"
 	"errors"
 	"fmt"
+	"github.com/hashicorp/boundary/api"
 	"io"
 	"os"
 	"os/signal"
@@ -284,7 +285,7 @@ func (b *Server) SetupLogging(flagLogLevel, flagLogFormat, configLogLevel, confi

 	// create GRPC logger
 	namedGRPCLogFaker := b.Logger.Named("grpclogfaker")
-	grpcLogFaker.SetLogOnOff(os.Getenv("BOUNDARY_GRPC_LOGGING") != "")
+	grpcLogFaker.SetLogOnOff(api.Getenv("THRESHOLD_GRPC_LOGGING") != "")
 	grpcLogFaker.SetLogger(namedGRPCLogFaker)

 	b.Info["log level"] = logLevel.String()
@@ -384,7 +385,7 @@ func (b *Server) PrintInfo(ui cli.Ui) {
 	verInfo := version.Get()
 	if verInfo.Version != "" {
 		b.InfoKeys = append(b.InfoKeys, "version")
-		b.Info["version"] = verInfo.FullVersionNumber(false)
+		b.Info["version"] = verInfo.DisplayVersionNumber(false)
 	}
 	if verInfo.Revision != "" {
 		b.Info["version sha"] = strings.Trim(verInfo.Revision, "'")
@@ -405,7 +406,7 @@ func (b *Server) PrintInfo(ui cli.Ui) {
 		}
 	}
 	sort.Strings(b.InfoKeys)
-	ui.Output("==> Boundary server configuration:\n")
+	ui.Output("==> Threshold server configuration:\n")
 	for _, k := range b.InfoKeys {
 		ui.Output(fmt.Sprintf(
 			"%s%s: %s",
@@ -417,7 +418,7 @@ func (b *Server) PrintInfo(ui cli.Ui) {

 	// Output the header that the server has started
 	if !b.CombineLogs {
-		ui.Output("==> Boundary server started! Log data will stream in below:\n")
+		ui.Output("==> Threshold server started! Log data will stream in below:\n")
 	}
 }

@@ -760,7 +761,7 @@ func (b *Server) OpenDatabase(ctx context.Context, dialect, url string) (*db.DB,
 		db.WithMaxIdleConnections(b.DatabaseMaxIdleConnections),
 		db.WithConnMaxIdleTimeDuration(b.DatabaseConnMaxIdleTimeDuration),
 	}
-	if os.Getenv("BOUNDARY_DISABLE_GORM_FORMATTER") == "" {
+	if api.Getenv("THRESHOLD_DISABLE_GORM_FORMATTER") == "" {
 		opts = append(opts, db.WithGormFormatter(b.Logger))
 	}

@@ -153,7 +153,7 @@ func (c *Command) Run(args []string) int {

 		case "list":
 			if c.FlagAuthMethodId == "" {
-				c.PrintCliError(errors.New("AuthMethod ID must be passed in via -auth-method-id or BOUNDARY_AUTH_METHOD_ID"))
+				c.PrintCliError(errors.New("AuthMethod ID must be passed in via -auth-method-id or THRESHOLD_AUTH_METHOD_ID"))
 				return base.CommandUserError
 			}

@@ -57,37 +57,37 @@ func (c *Command) extraHelpFunc(helpMap map[string]func() string) string {
 	switch c.Func {
 	case "":
 		return base.WrapForHelpText([]string{
-			"Usage: boundary accounts [sub command] [options] [args]",
+			"Usage: threshold accounts [sub command] [options] [args]",
 			"",
-			"  This command allows operations on Boundary account resources. Example:",
+			"  This command allows operations on Threshold account resources. Example:",
 			"",
 			"    Read a account:",
 			"",
-			`      $ boundary accounts read -id acctpw_1234567890`,
+			`      $ threshold accounts read -id acctpw_1234567890`,
 			"",
 			"  Please see the accounts subcommand help for detailed usage information.",
 		})
 	case "change-password":
 		helpStr = base.WrapForHelpText([]string{
-			"Usage: boundary accounts change-password [options] [args]",
+			"Usage: threshold accounts change-password [options] [args]",
 			"",
 			"  This command allows changing the password (with verification of the current password) on account-type resources, if the types match and the operation is allowed by the given account type. Example:",
 			"",
 			"    Change the password on a password-type account:",
 			"",
-			`      $ boundary accounts change-password -id acctpw_1234567890 -current-password <empty, to be read by stdin> -new-password <empty, to be read by stdin>`,
+			`      $ threshold accounts change-password -id acctpw_1234567890 -current-password <empty, to be read by stdin> -new-password <empty, to be read by stdin>`,
 			"",
 			"",
 		})
 	case "set-password":
 		helpStr = base.WrapForHelpText([]string{
-			"Usage: boundary accounts set-password [options] [args]",
+			"Usage: threshold accounts set-password [options] [args]",
 			"",
 			"  This command allows setting the password on account-type resources, if the types match and the operation is allowed by the given account type. Example:",
 			"",
 			"    Set the password on a password-type account:",
 			"",
-			`      $ boundary accounts set-password -id acctpw_1234567890 -password <empty, to be read by stdin>`,
+			`      $ threshold accounts set-password -id acctpw_1234567890 -password <empty, to be read by stdin>`,
 			"",
 			"",
 		})
@@ -137,7 +137,7 @@ func (c *LdapCommand) Run(args []string) int {

 		case "create":
 			if c.FlagAuthMethodId == "" {
-				c.PrintCliError(errors.New("AuthMethod ID must be passed in via -auth-method-id or BOUNDARY_AUTH_METHOD_ID"))
+				c.PrintCliError(errors.New("AuthMethod ID must be passed in via -auth-method-id or THRESHOLD_AUTH_METHOD_ID"))
 				return base.CommandUserError
 			}

@@ -33,22 +33,22 @@ func (c *LdapCommand) extraLdapHelpFunc(helpMap map[string]func() string) string
 	switch c.Func {
 	case "create":
 		helpStr = base.WrapForHelpText([]string{
-			"Usage: boundary accounts create ldap [options] [args]",
+			"Usage: threshold accounts create ldap [options] [args]",
 			"",
 			"  Create an ldap-type account. Example:",
 			"",
-			`    $ boundary accounts create ldap -login-name prodops -description "ldap account for ProdOps"`,
+			`    $ threshold accounts create ldap -login-name prodops -description "ldap account for ProdOps"`,
 			"",
 			"",
 		})

 	case "update":
 		helpStr = base.WrapForHelpText([]string{
-			"Usage: boundary accounts update ldap [options] [args]",
+			"Usage: threshold accounts update ldap [options] [args]",
 			"",
 			"  Update an ldap-type account given its ID. Example:",
 			"",
-			`    $ boundary accounts update ldap -id acctldap_1234567890 -name "devops" -description "ldap account for DevOps"`,
+			`    $ threshold accounts update ldap -id acctldap_1234567890 -name "devops" -description "ldap account for DevOps"`,
 			"",
 			"",
 		})
@@ -137,7 +137,7 @@ func (c *OidcCommand) Run(args []string) int {

 		case "create":
 			if c.FlagAuthMethodId == "" {
-				c.PrintCliError(errors.New("AuthMethod ID must be passed in via -auth-method-id or BOUNDARY_AUTH_METHOD_ID"))
+				c.PrintCliError(errors.New("AuthMethod ID must be passed in via -auth-method-id or THRESHOLD_AUTH_METHOD_ID"))
 				return base.CommandUserError
 			}

@@ -35,22 +35,22 @@ func (c *OidcCommand) extraOidcHelpFunc(helpMap map[string]func() string) string
 	switch c.Func {
 	case "create":
 		helpStr = base.WrapForHelpText([]string{
-			"Usage: boundary accounts create oidc [options] [args]",
+			"Usage: threshold accounts create oidc [options] [args]",
 			"",
 			"  Create a oidc-type account. Example:",
 			"",
-			`    $ boundary accounts create oidc -subject "prodops" -description "Oidc account for ProdOps"`,
+			`    $ threshold accounts create oidc -subject "prodops" -description "Oidc account for ProdOps"`,
 			"",
 			"",
 		})

 	case "update":
 		helpStr = base.WrapForHelpText([]string{
-			"Usage: boundary accounts update oidc [options] [args]",
+			"Usage: threshold accounts update oidc [options] [args]",
 			"",
 			"  Update a oidc-type account given its ID. Example:",
 			"",
-			`    $ boundary accounts update oidc -id acctoidc_1234567890 -name "devops" -description "Oidc account for DevOps"`,
+			`    $ threshold accounts update oidc -id acctoidc_1234567890 -name "devops" -description "Oidc account for DevOps"`,
 			"",
 			"",
 		})
@@ -137,7 +137,7 @@ func (c *PasswordCommand) Run(args []string) int {

 		case "create":
 			if c.FlagAuthMethodId == "" {
-				c.PrintCliError(errors.New("AuthMethod ID must be passed in via -auth-method-id or BOUNDARY_AUTH_METHOD_ID"))
+				c.PrintCliError(errors.New("AuthMethod ID must be passed in via -auth-method-id or THRESHOLD_AUTH_METHOD_ID"))
 				return base.CommandUserError
 			}

@@ -39,22 +39,22 @@ func (c *PasswordCommand) extraPasswordHelpFunc(helpMap map[string]func() string
 	switch c.Func {
 	case "create":
 		helpStr = base.WrapForHelpText([]string{
-			"Usage: boundary accounts create password [options] [args]",
+			"Usage: threshold accounts create password [options] [args]",
 			"",
 			"  Create a password-type account. Example:",
 			"",
-			`    $ boundary accounts create password -login-name prodops -description "Password account for ProdOps"`,
+			`    $ threshold accounts create password -login-name prodops -description "Password account for ProdOps"`,
 			"",
 			"",
 		})

 	case "update":
 		helpStr = base.WrapForHelpText([]string{
-			"Usage: boundary accounts update password [options] [args]",
+			"Usage: threshold accounts update password [options] [args]",
 			"",
 			"  Update a password-type account given its ID. Example:",
 			"",
-			`    $ boundary accounts update password -id acctpw_1234567890 -name "devops" -description "Password account for DevOps"`,
+			`    $ threshold accounts update password -id acctpw_1234567890 -name "devops" -description "Password account for DevOps"`,
 			"",
 			"",
 		})
@@ -151,7 +151,7 @@ func (c *Command) Run(args []string) int {

 		case "list":
 			if c.FlagScopeId == "" {
-				c.PrintCliError(errors.New("Scope ID must be passed in via -scope-id or BOUNDARY_SCOPE_ID"))
+				c.PrintCliError(errors.New("Scope ID must be passed in via -scope-id or THRESHOLD_SCOPE_ID"))
 				return base.CommandUserError
 			}

@@ -17,33 +17,33 @@ func (c *Command) extraHelpFunc(helpMap map[string]func() string) string {
 	switch c.Func {
 	case "":
 		return base.WrapForHelpText([]string{
-			"Usage: boundary aliases [sub command] [options] [args]",
+			"Usage: threshold aliases [sub command] [options] [args]",
 			"",
-			"  This command allows operations on Boundary alias resources. Example:",
+			"  This command allows operations on Threshold alias resources. Example:",
 			"",
 			"    Read an alias:",
 			"",
-			`      $ boundary aliases read -id alt_1234567890`,
+			`      $ threshold aliases read -id alt_1234567890`,
 			"",
 			"  Please see the aliases subcommand help for detailed usage information.",
 		})
 	case "create":
 		helpStr = base.WrapForHelpText([]string{
-			"Usage: boundary aliases create target [options] [args]",
+			"Usage: threshold aliases create target [options] [args]",
 			"",
 			"  Create an alias. Example:",
 			"",
-			`    $ boundary aliases create target -value prod-ops.example -name prodops -description "Target alias for ProdOps"`,
+			`    $ threshold aliases create target -value prod-ops.example -name prodops -description "Target alias for ProdOps"`,
 			"",
 			"  Please see the typed subcommand help for detailed usage information.",
 		})
 	case "update":
 		helpStr = base.WrapForHelpText([]string{
-			"Usage: boundary aliases update target [options] [args]",
+			"Usage: threshold aliases update target [options] [args]",
 			"",
 			"  Update an alias. Example:",
 			"",
-			`    $ boundary aliases update target -id alt_1234567890 -name devops`,
+			`    $ threshold aliases update target -id alt_1234567890 -name devops`,
 			"",
 			"  Please see the typed subcommand help for detailed usage information.",
 		})
@@ -137,7 +137,7 @@ func (c *TargetCommand) Run(args []string) int {

 		case "create":
 			if c.FlagScopeId == "" {
-				c.PrintCliError(errors.New("Scope ID must be passed in via -scope-id or BOUNDARY_SCOPE_ID"))
+				c.PrintCliError(errors.New("Scope ID must be passed in via -scope-id or THRESHOLD_SCOPE_ID"))
 				return base.CommandUserError
 			}

@@ -32,33 +32,33 @@ func (c *TargetCommand) extraTargetHelpFunc(helpMap map[string]func() string) st
 	switch c.Func {
 	case "":
 		return base.WrapForHelpText([]string{
-			"Usage: boundary aliases [sub command] [options] [args]",
+			"Usage: threshold aliases [sub command] [options] [args]",
 			"",
-			"  This command allows operations on Boundary alias resources. Example:",
+			"  This command allows operations on Threshold alias resources. Example:",
 			"",
 			"    Read an alias:",
 			"",
-			`      $ boundary aliases read -id alt_1234567890`,
+			`      $ threshold aliases read -id alt_1234567890`,
 			"",
 			"  Please see the aliases subcommand help for detailed usage information.",
 		})
 	case "create":
 		helpStr = base.WrapForHelpText([]string{
-			"Usage: boundary aliases create target [options] [args]",
+			"Usage: threshold aliases create target [options] [args]",
 			"",
 			"  Create a target-type alias. Example:",
 			"",
-			`    $ boundary aliases create target -value prod-ops.example -name prodops -description "Target alias for ProdOps"`,
+			`    $ threshold aliases create target -value prod-ops.example -name prodops -description "Target alias for ProdOps"`,
 			"",
 			"",
 		})
 	case "update":
 		helpStr = base.WrapForHelpText([]string{
-			"Usage: boundary aliases update target [options] [args]",
+			"Usage: threshold aliases update target [options] [args]",
 			"",
 			"  Update an alias. Example:",
 			"",
-			`    $ boundary aliases update target -id alt_1234567890 -name devops`,
+			`    $ threshold aliases update target -id alt_1234567890 -name devops`,
 			"",
 			"",
 		})
@@ -28,29 +28,29 @@ func (c *Command) Synopsis() string {

 func (c *Command) Help() string {
 	return base.WrapForHelpText([]string{
-		"Usage: boundary authenticate [sub command] [options] [args]",
+		"Usage: threshold authenticate [sub command] [options] [args]",
 		"",
-		"  This command authenticates the Boundary commandline client using a specified auth method. Examples:",
+		"  This command authenticates the Threshold commandline client using a specified auth method. Examples:",
 		"",
 		"    Authenticate with the primary auth method in the global scope:",
 		"",
-		"      $ boundary authenticate",
+		"      $ threshold authenticate",
 		"",
 		"    Authenticate using the primary auth method in a specific scope",
 		"",
-		"      $ boundary authenticate password -scope-id o_1234567890",
+		"      $ threshold authenticate password -scope-id o_1234567890",
 		"",
 		"    Authenticate with a password auth method using a specific auth method ID:",
 		"",
-		"      $ boundary authenticate password -auth-method-id ampw_1234567890",
+		"      $ threshold authenticate password -auth-method-id ampw_1234567890",
 		"",
 		"    Authenticate with an OIDC auth method using a specific auth method ID:",
 		"",
-		"      $ boundary authenticate oidc -auth-method-id amoidc_1234567890",
+		"      $ threshold authenticate oidc -auth-method-id amoidc_1234567890",
 		"",
 		"    Authenticate with an LDAP auth method:",
 		"",
-		"      $ boundary authenticate ldap -auth-method-id amldap_1234567890",
+		"      $ threshold authenticate ldap -auth-method-id amldap_1234567890",
 		"",
 		"  Please see the auth method subcommand help for detailed usage information.",
 	}) + c.Flags().Help()
@@ -62,7 +62,7 @@ func (c *Command) Flags() *base.FlagSets {

 	f.StringVar(&base.StringVar{
 		Name:   "scope-id",
-		EnvVar: "BOUNDARY_SCOPE_ID",
+		EnvVar: "THRESHOLD_SCOPE_ID",
 		Target: &c.FlagScopeId,
 		Usage:  "The scope to use for the operation",
 	})
@@ -95,7 +95,7 @@ func (c *Command) Run(args []string) int {
 	aClient := authmethods.NewClient(client)
 	pri, err := getPrimaryAuthMethodId(c.Context, aClient, scope.Global.String(), "")
 	if err != nil {
-		c.PrintCliError(errors.New("Error looking up primary auth method ID for the global scope. Try setting a primary auth method for the global scope, or use an auth method subcommand (see 'boundary authenticate -h' for available sub command usage)."))
+		c.PrintCliError(errors.New("Error looking up primary auth method ID for the global scope. Try setting a primary auth method for the global scope, or use an auth method subcommand (see 'threshold authenticate -h' for available sub command usage)."))
 		return base.CommandUserError
 	}

@@ -71,7 +71,7 @@ func saveAndOrPrintToken(c *base.Command, result *authmethods.AuthenticateResult
 			default:
 				krConfig := nkeyring.Config{
 					LibSecretCollectionName: "login",
-					PassPrefix:              "HashiCorp_Boundary",
+					PassPrefix:              base.PassPrefix,
 					AllowedBackends:         []nkeyring.BackendType{nkeyring.BackendType(keyringType)},
 				}

@@ -100,7 +100,7 @@ func saveAndOrPrintToken(c *base.Command, result *authmethods.AuthenticateResult

 	switch {
 	case gotErr:
-		c.UI.Warn(fmt.Sprintf("The token was not successfully saved to a system keyring. The token is:\n\n%s\n\nIt must be manually passed in via the BOUNDARY_TOKEN env var or -token flag. Storing the token can also be disabled via -keyring-type=none.", token.Token))
+		c.UI.Warn(fmt.Sprintf("The token was not successfully saved to a system keyring. The token is:\n\n%s\n\nIt must be manually passed in via the THRESHOLD_TOKEN env var or -token flag. Storing the token can also be disabled via -keyring-type=none.", token.Token))
 	case c.FlagKeyringType == "none":
 		c.UI.Warn("\nStoring the token in a keyring was disabled. The token is:")
 		c.UI.Output(token.Token)
@@ -124,11 +124,11 @@ func getPrimaryAuthMethodId(ctx context.Context, client *authmethods.Client, sco
 	for _, m := range authMethodListResult.GetItems() {
 		if m.IsPrimary {
 			if !strings.HasPrefix(m.Id, amType) {
-				return "", fmt.Errorf("Error looking up primary auth method in scope '%s': got '%s' but the command requires an auth method prefix of '%s'. Make sure the sub command you're using matches the primary auth method type in the scope being used. For example, if using the password sub command the primary auth method must have a prefix of 'ampw'.\n\nSee 'boundary authenticate -h' for available sub command usage.", scopeId, m.Id, amType)
+				return "", fmt.Errorf("Error looking up primary auth method in scope '%s': got '%s' but the command requires an auth method prefix of '%s'. Make sure the sub command you're using matches the primary auth method type in the scope being used. For example, if using the password sub command the primary auth method must have a prefix of 'ampw'.\n\nSee 'threshold authenticate -h' for available sub command usage.", scopeId, m.Id, amType)
 			}

 			return m.Id, nil
 		}
 	}
-	return "", fmt.Errorf("Primary auth method not found for scope ID: '%s'. Please set a primary auth method on this scope or pass one explicitly using an authenticate sub command (see 'boundary authenticate -h') along with the -auth-method-id flag.", scopeId)
+	return "", fmt.Errorf("Primary auth method not found for scope ID: '%s'. Please set a primary auth method on this scope or pass one explicitly using an authenticate sub command (see 'threshold authenticate -h') along with the -auth-method-id flag.", scopeId)
 }
@@ -35,16 +35,16 @@ type LdapCommand struct {
 }

 func (c *LdapCommand) Synopsis() string {
-	return wordwrap.WrapString("Invoke the ldap auth method to authenticate with Boundary", base.TermWidth)
+	return wordwrap.WrapString("Invoke the ldap auth method to authenticate with Threshold", base.TermWidth)
 }

 func (c *LdapCommand) Help() string {
 	return base.WrapForHelpText([]string{
-		"Usage: boundary authenticate ldap [options] [args]",
+		"Usage: threshold authenticate ldap [options] [args]",
 		"",
-		"  Invoke the ldap auth method to authenticate the Boundary CLI. Example:",
+		"  Invoke the ldap auth method to authenticate the Threshold CLI. Example:",
 		"",
-		`    $ boundary authenticate ldap -auth-method-id amldap_1234567890 -login-name foo`,
+		`    $ threshold authenticate ldap -auth-method-id amldap_1234567890 -login-name foo`,
 		"",
 		"",
 	}) + c.Flags().Help()
@@ -70,7 +70,7 @@ func (c *LdapCommand) Flags() *base.FlagSets {

 	f.StringVar(&base.StringVar{
 		Name:   "auth-method-id",
-		EnvVar: "BOUNDARY_AUTH_METHOD_ID",
+		EnvVar: "THRESHOLD_AUTH_METHOD_ID",
 		Target: &c.FlagAuthMethodId,
 		Usage:  "The auth-method resource to use for the operation.",
 	})
@@ -78,7 +78,7 @@ func (c *LdapCommand) Flags() *base.FlagSets {
 	if !c.parsedOpts.WithSkipScopeIdFlag {
 		f.StringVar(&base.StringVar{
 			Name:   "scope-id",
-			EnvVar: "BOUNDARY_SCOPE_ID",
+			EnvVar: "THRESHOLD_SCOPE_ID",
 			Target: &c.FlagScopeId,
 			Usage:  "The scope ID to use for the operation.",
 		})
@@ -33,16 +33,16 @@ type OidcCommand struct {
 }

 func (c *OidcCommand) Synopsis() string {
-	return wordwrap.WrapString("Invoke the OIDC auth method to authenticate with Boundary", base.TermWidth)
+	return wordwrap.WrapString("Invoke the OIDC auth method to authenticate with Threshold", base.TermWidth)
 }

 func (c *OidcCommand) Help() string {
 	return base.WrapForHelpText([]string{
-		"Usage: boundary authenticate oidc [options] [args]",
+		"Usage: threshold authenticate oidc [options] [args]",
 		"",
-		"  Invoke the OIDC auth method to authenticate the Boundary CLI. Example:",
+		"  Invoke the OIDC auth method to authenticate the Threshold CLI. Example:",
 		"",
-		`    $ boundary authenticate oidc -auth-method-id amoidc_1234567890`,
+		`    $ threshold authenticate oidc -auth-method-id amoidc_1234567890`,
 		"",
 		"",
 	}) + c.Flags().Help()
@@ -54,7 +54,7 @@ func (c *OidcCommand) Flags() *base.FlagSets {

 	f.StringVar(&base.StringVar{
 		Name:   "auth-method-id",
-		EnvVar: "BOUNDARY_AUTH_METHOD_ID",
+		EnvVar: "THRESHOLD_AUTH_METHOD_ID",
 		Target: &c.FlagAuthMethodId,
 		Usage:  "The auth-method resource to use for the operation",
 	})
@@ -62,7 +62,7 @@ func (c *OidcCommand) Flags() *base.FlagSets {
 	if !c.parsedOpts.WithSkipScopeIdFlag {
 		f.StringVar(&base.StringVar{
 			Name:   "scope-id",
-			EnvVar: "BOUNDARY_SCOPE_ID",
+			EnvVar: "THRESHOLD_SCOPE_ID",
 			Target: &c.FlagScopeId,
 			Usage:  "The scope ID to use for the operation.",
 		})
@@ -26,8 +26,8 @@ var (
 )

 var (
-	envPassword  = "BOUNDARY_AUTHENTICATE_PASSWORD_PASSWORD"
-	envLoginName = "BOUNDARY_AUTHENTICATE_PASSWORD_LOGIN_NAME"
+	envPassword  = "THRESHOLD_AUTHENTICATE_PASSWORD_PASSWORD"
+	envLoginName = "THRESHOLD_AUTHENTICATE_PASSWORD_LOGIN_NAME"
 )

 type PasswordCommand struct {
@@ -40,16 +40,16 @@ type PasswordCommand struct {
 }

 func (c *PasswordCommand) Synopsis() string {
-	return wordwrap.WrapString("Invoke the password auth method to authenticate with Boundary", base.TermWidth)
+	return wordwrap.WrapString("Invoke the password auth method to authenticate with Threshold", base.TermWidth)
 }

 func (c *PasswordCommand) Help() string {
 	return base.WrapForHelpText([]string{
-		"Usage: boundary authenticate password [options] [args]",
+		"Usage: threshold authenticate password [options] [args]",
 		"",
-		"  Invoke the password auth method to authenticate the Boundary CLI. Example:",
+		"  Invoke the password auth method to authenticate the Threshold CLI. Example:",
 		"",
-		`    $ boundary authenticate password -auth-method-id ampw_1234567890 -login-name foo`,
+		`    $ threshold authenticate password -auth-method-id ampw_1234567890 -login-name foo`,
 		"",
 		"",
 	}) + c.Flags().Help()
@@ -75,7 +75,7 @@ func (c *PasswordCommand) Flags() *base.FlagSets {

 	f.StringVar(&base.StringVar{
 		Name:   "auth-method-id",
-		EnvVar: "BOUNDARY_AUTH_METHOD_ID",
+		EnvVar: "THRESHOLD_AUTH_METHOD_ID",
 		Target: &c.FlagAuthMethodId,
 		Usage:  "The auth-method resource to use for the operation.",
 	})
@@ -83,7 +83,7 @@ func (c *PasswordCommand) Flags() *base.FlagSets {
 	if !c.parsedOpts.WithSkipScopeIdFlag {
 		f.StringVar(&base.StringVar{
 			Name:   "scope-id",
-			EnvVar: "BOUNDARY_SCOPE_ID",
+			EnvVar: "THRESHOLD_SCOPE_ID",
 			Target: &c.FlagScopeId,
 			Usage:  "The scope ID to use for the operation.",
 		})
@@ -151,7 +151,7 @@ func (c *Command) Run(args []string) int {

 		case "list":
 			if c.FlagScopeId == "" {
-				c.PrintCliError(errors.New("Scope ID must be passed in via -scope-id or BOUNDARY_SCOPE_ID"))
+				c.PrintCliError(errors.New("Scope ID must be passed in via -scope-id or THRESHOLD_SCOPE_ID"))
 				return base.CommandUserError
 			}

@@ -23,37 +23,37 @@ func (c *Command) extraHelpFunc(helpMap map[string]func() string) string {
 	switch c.Func {
 	case "":
 		return base.WrapForHelpText([]string{
-			"Usage: boundary auth-methods [sub command] [options] [args]",
+			"Usage: threshold auth-methods [sub command] [options] [args]",
 			"",
-			"  This command allows operations on Boundary auth method resources. Example:",
+			"  This command allows operations on Threshold auth method resources. Example:",
 			"",
 			"    Read an auth method:",
 			"",
-			`      $ boundary auth-methods read -id ampw_1234567890`,
+			`      $ threshold auth-methods read -id ampw_1234567890`,
 			"",
 			"  Please see the auth-methods subcommand help for detailed usage information.",
 		})
 	case "create":
 		helpStr = base.WrapForHelpText([]string{
-			"Usage: boundary auth-methods create [type] [sub command] [options] [args]",
+			"Usage: threshold auth-methods create [type] [sub command] [options] [args]",
 			"",
-			"  This command allows create operations on Boundary auth method resources. Example:",
+			"  This command allows create operations on Threshold auth method resources. Example:",
 			"",
 			"    Create a password-type auth method:",
 			"",
-			`      $ boundary auth-methods create password -name prodops -description "For ProdOps usage"`,
+			`      $ threshold auth-methods create password -name prodops -description "For ProdOps usage"`,
 			"",
 			"  Please see the typed subcommand help for detailed usage information.",
 		})
 	case "update":
 		helpStr = base.WrapForHelpText([]string{
-			"Usage: boundary auth-methods update [type] [sub command] [options] [args]",
+			"Usage: threshold auth-methods update [type] [sub command] [options] [args]",
 			"",
-			"  This command allows update operations on Boundary auth method resources. Example:",
+			"  This command allows update operations on Threshold auth method resources. Example:",
 			"",
 			"    Update a password-type auth method:",
 			"",
-			`      $ boundary auth-methods update password -id ampw_1234567890 -name devops -description "For DevOps usage"`,
+			`      $ threshold auth-methods update password -id ampw_1234567890 -name devops -description "For DevOps usage"`,
 			"",
 			"  Please see the typed subcommand help for detailed usage information.",
 		})
@@ -137,7 +137,7 @@ func (c *LdapCommand) Run(args []string) int {

 		case "create":
 			if c.FlagScopeId == "" {
-				c.PrintCliError(errors.New("Scope ID must be passed in via -scope-id or BOUNDARY_SCOPE_ID"))
+				c.PrintCliError(errors.New("Scope ID must be passed in via -scope-id or THRESHOLD_SCOPE_ID"))
 				return base.CommandUserError
 			}

@@ -258,22 +258,22 @@ func (c *LdapCommand) extraLdapHelpFunc(helpMap map[string]func() string) string
 	switch c.Func {
 	case "create":
 		helpStr = base.WrapForHelpText([]string{
-			"Usage: boundary auth-methods create ldap [options] [args]",
+			"Usage: threshold auth-methods create ldap [options] [args]",
 			"",
 			"  Create an ldap-type auth method. Example:",
 			"",
-			`    $ boundary auth-methods create ldap -name prodops -description "LDAP auth-method for ProdOps"`,
+			`    $ threshold auth-methods create ldap -name prodops -description "LDAP auth-method for ProdOps"`,
 			"",
 			"",
 		})

 	case "update":
 		helpStr = base.WrapForHelpText([]string{
-			"Usage: boundary auth-methods update ldap [options] [args]",
+			"Usage: threshold auth-methods update ldap [options] [args]",
 			"",
 			"  Update an ldap-type auth method given its ID. Example:",
 			"",
-			`    $ boundary auth-methods update ldap -id amldap_1234567890 -name "devops" -description "LDAP auth-method for DevOps"`,
+			`    $ threshold auth-methods update ldap -id amldap_1234567890 -name "devops" -description "LDAP auth-method for DevOps"`,
 			"",
 			"",
 		})
@@ -137,7 +137,7 @@ func (c *OidcCommand) Run(args []string) int {

 		case "create":
 			if c.FlagScopeId == "" {
-				c.PrintCliError(errors.New("Scope ID must be passed in via -scope-id or BOUNDARY_SCOPE_ID"))
+				c.PrintCliError(errors.New("Scope ID must be passed in via -scope-id or THRESHOLD_SCOPE_ID"))
 				return base.CommandUserError
 			}

@@ -142,7 +142,7 @@ func extraOidcFlagsFuncImpl(c *OidcCommand, set *base.FlagSets, _ *base.FlagSet)
 			f.StringSliceVar(&base.StringSliceVar{
 				Name:   accountClaimMaps,
 				Target: &c.flagAccountClaimMaps,
-				Usage:  `The optional account claim maps from custom claims to the standard claims of sub, name and email.  These maps are represented as key=value where the key equals the Provider from-claim and the value equals the Boundary to-claim.  For example "oid=sub". May be specified multiple times for different to-claims.`,
+				Usage:  `The optional account claim maps from custom claims to the standard claims of sub, name and email.  These maps are represented as key=value where the key equals the Provider from-claim and the value equals the Threshold to-claim.  For example "oid=sub". May be specified multiple times for different to-claims.`,
 			})
 		case stateFlagName:
 			f.StringVar(&base.StringVar{
@@ -177,32 +177,32 @@ func (c *OidcCommand) extraOidcHelpFunc(helpMap map[string]func() string) string
 	switch c.Func {
 	case "create":
 		helpStr = base.WrapForHelpText([]string{
-			"Usage: boundary auth-methods create oidc [options] [args]",
+			"Usage: threshold auth-methods create oidc [options] [args]",
 			"",
 			"  Create an oidc-type auth method. Example:",
 			"",
-			`    $ boundary auth-methods create oidc -name prodops -description "Oidc auth-method for ProdOps"`,
+			`    $ threshold auth-methods create oidc -name prodops -description "Oidc auth-method for ProdOps"`,
 			"",
 			"",
 		})

 	case "update":
 		helpStr = base.WrapForHelpText([]string{
-			"Usage: boundary auth-methods update oidc [options] [args]",
+			"Usage: threshold auth-methods update oidc [options] [args]",
 			"",
 			"  Update an oidc-type auth method given its ID. Example:",
 			"",
-			`    $ boundary auth-methods update oidc -id amoidc_1234567890 -name "devops" -description "Oidc auth-method for DevOps"`,
+			`    $ threshold auth-methods update oidc -id amoidc_1234567890 -name "devops" -description "Oidc auth-method for DevOps"`,
 			"",
 			"",
 		})
 	case "change-state":
 		helpStr = base.WrapForHelpText([]string{
-			"Usage: boundary auth-methods change-state oidc [options] [args]",
+			"Usage: threshold auth-methods change-state oidc [options] [args]",
 			"",
 			"  Change the active and visibility state of an oidc-type auth method given its ID. Example:",
 			"",
-			`    $ boundary auth-methods change-state oidc -id amoidc_1234567890 -state "public-active"`,
+			`    $ threshold auth-methods change-state oidc -id amoidc_1234567890 -state "public-active"`,
 			"",
 			"",
 		})
@@ -137,7 +137,7 @@ func (c *PasswordCommand) Run(args []string) int {

 		case "create":
 			if c.FlagScopeId == "" {
-				c.PrintCliError(errors.New("Scope ID must be passed in via -scope-id or BOUNDARY_SCOPE_ID"))
+				c.PrintCliError(errors.New("Scope ID must be passed in via -scope-id or THRESHOLD_SCOPE_ID"))
 				return base.CommandUserError
 			}

@@ -34,22 +34,22 @@ func (c *PasswordCommand) extraPasswordHelpFunc(helpMap map[string]func() string
 	switch c.Func {
 	case "create":
 		helpStr = base.WrapForHelpText([]string{
-			"Usage: boundary auth-methods create password [options] [args]",
+			"Usage: threshold auth-methods create password [options] [args]",
 			"",
 			"  Create a password-type auth method. Example:",
 			"",
-			`    $ boundary auth-methods create password -name prodops -description "Password auth-method for ProdOps"`,
+			`    $ threshold auth-methods create password -name prodops -description "Password auth-method for ProdOps"`,
 			"",
 			"",
 		})

 	case "update":
 		helpStr = base.WrapForHelpText([]string{
-			"Usage: boundary auth-methods update password [options] [args]",
+			"Usage: threshold auth-methods update password [options] [args]",
 			"",
 			"  Update a password-type auth method given its ID. Example:",
 			"",
-			`    $ boundary auth-methods update password -id ampw_1234567890 -name "devops" -description "Password auth-method for DevOps"`,
+			`    $ threshold auth-methods update password -id ampw_1234567890 -name "devops" -description "Password auth-method for DevOps"`,
 			"",
 			"",
 		})
@@ -146,7 +146,7 @@ func (c *Command) Run(args []string) int {

 		case "list":
 			if c.FlagScopeId == "" {
-				c.PrintCliError(errors.New("Scope ID must be passed in via -scope-id or BOUNDARY_SCOPE_ID"))
+				c.PrintCliError(errors.New("Scope ID must be passed in via -scope-id or THRESHOLD_SCOPE_ID"))
 				return base.CommandUserError
 			}

@@ -10,13 +10,13 @@ func (c *Command) extraHelpFunc(helpMap map[string]func() string) string {
 	switch c.Func {
 	case "":
 		return base.WrapForHelpText([]string{
-			"Usage: boundary auth-tokens [sub command] [options] [args]",
+			"Usage: threshold auth-tokens [sub command] [options] [args]",
 			"",
-			"  This command allows operations on Boundary auth token resources. Example:",
+			"  This command allows operations on Threshold auth token resources. Example:",
 			"",
 			"    List all auth tokens:",
 			"",
-			`      $ boundary auth-tokens list -recursive `,
+			`      $ threshold auth-tokens list -recursive `,
 			"",
 			"  Please see the auth-tokens subcommand help for detailed usage information.",
 			"  Note: To create an auth token, see the authenticate subcommand.",
@@ -129,25 +129,25 @@ func (c *Command) extraHelpFunc(helpMap map[string]func() string) string {
 	switch c.Func {
 	case "":
 		helpStr = base.WrapForHelpText([]string{
-			"Usage: boundary billing [sub command] [options] [args]",
+			"Usage: threshold billing [sub command] [options] [args]",
 			"",
-			"  This command allows for collecting Boundary billing reports. Example:",
+			"  This command allows for collecting Threshold billing reports. Example:",
 			"",
 			"    Monthly active users:",
 			"",
-			`      $ boundary billing monthly-active-users`,
+			`      $ threshold billing monthly-active-users`,
 			"",
 			"  Please see the billing subcommand help for detailed usage information.",
 		})
 	case "monthly-active-users":
 		helpStr = base.WrapForHelpText([]string{
-			"Usage: boundary billing monthly-active-users [options]",
+			"Usage: threshold billing monthly-active-users [options]",
 			"",
-			"  This command allows for collecting active Boundary user reports, by month. Example:",
+			"  This command allows for collecting active Threshold user reports, by month. Example:",
 			"",
 			"    Monthly active users between September 2023 and February 2024:",
 			"",
-			`      $ boundary billing monthly-active-users -start-time="2023-09" -end-time="2024-02"`,
+			`      $ threshold billing monthly-active-users -start-time="2023-09" -end-time="2024-02"`,
 			"",
 			"  Please see the billing subcommand help for detailed usage information.",
 		})
@@ -22,27 +22,27 @@ type ClientAgentCommand struct {
 }

 func (c *ClientAgentCommand) Synopsis() string {
-	return "Manages the Boundary client agent"
+	return "Manages the Threshold client agent"
 }

 func (c *ClientAgentCommand) Help() string {
 	helpText := `
-Usage: boundary client-agent [sub command] [options]
+Usage: threshold client-agent [sub command] [options]

-  This command allows interacting with the Boundary client agent.
+  This command allows interacting with the Threshold client agent.

  Get the status of the agent:

-      $ boundary client-agent status
+      $ threshold client-agent status

  Pause and resume the agent:

-      $ boundary client-agent pause
-      $ boundary client-agent resume
+      $ threshold client-agent pause
+      $ threshold client-agent resume

  List active transparent sessions:

-      $ boundary client-agent sessions
+      $ threshold client-agent sessions

  For a full list of examples, please see the documentation.

@@ -26,16 +26,16 @@ type PauseCommand struct {
 }

 func (c *PauseCommand) Synopsis() string {
-	return "Pauses the running boundary client agent"
+	return "Pauses the running threshold client agent"
 }

 func (c *PauseCommand) Help() string {
 	helpText := `
-Usage: boundary client-agent pause
+Usage: threshold client-agent pause

-  Pause the boundary client agent:
+  Pause the threshold client agent:

-      $ boundary client-agent pause
+      $ threshold client-agent pause

  For a full list of examples, please see the documentation.
 	
@@ -26,16 +26,16 @@ type ResumeCommand struct {
 }

 func (c *ResumeCommand) Synopsis() string {
-	return "Resumes the paused boundary client agent"
+	return "Resumes the paused threshold client agent"
 }

 func (c *ResumeCommand) Help() string {
 	helpText := `
-Usage: boundary client-agent resume
+Usage: threshold client-agent resume

-  Resume the boundary client agent:
+  Resume the threshold client agent:

-      $ boundary client-agent resume
+      $ threshold client-agent resume

  For a full list of examples, please see the documentation.
 	
@@ -36,11 +36,11 @@ func (c *SessionsCommand) Synopsis() string {

 func (c *SessionsCommand) Help() string {
 	helpText := `
-Usage: boundary client-agent sessions [options]
+Usage: threshold client-agent sessions [options]

  List the active transparent sessions:

-      $ boundary client-agent sessions
+      $ threshold client-agent sessions

  For a full list of examples, please see the documentation.

@@ -27,16 +27,16 @@ type StatusCommand struct {
 }

 func (c *StatusCommand) Synopsis() string {
-	return "Get the status information of the running boundary client agent"
+	return "Get the status information of the running threshold client agent"
 }

 func (c *StatusCommand) Help() string {
 	helpText := `
-Usage: boundary client-agent status [options]
+Usage: threshold client-agent status [options]

-  Get the status of the boundary client agent:
+  Get the status of the threshold client agent:

-      $ boundary client-agent status
+      $ threshold client-agent status

  For a full list of examples, please see the documentation.

@@ -27,7 +27,7 @@ func (c *AutocompleteCommand) Synopsis() string {
 		verb = "Install or uninstall"
 	}

-	return fmt.Sprintf("%s autocompletion for Boundary's CLI", verb)
+	return fmt.Sprintf("%s autocompletion for Threshold's CLI", verb)
 }

 func (c *AutocompleteCommand) Help() string {
@@ -47,9 +47,9 @@ func (c *AutocompleteCommand) Help() string {
 		subcmd = " install"
 	}
 	return base.WrapForHelpText([]string{
-		fmt.Sprintf("Usage: boundary config autocomplete%s [options] [args]", subcmd),
+		fmt.Sprintf("Usage: threshold config autocomplete%s [options] [args]", subcmd),
 		"",
-		fmt.Sprintf("  This command %s autocompletion support for Boundary's CLI", verb),
+		fmt.Sprintf("  This command %s autocompletion support for Threshold's CLI", verb),
 	})
 }

@@ -20,21 +20,21 @@ func (c *Command) Synopsis() string {

 func (c *Command) Help() string {
 	return base.WrapForHelpText([]string{
-		"Usage: boundary config <subcommand> [options] [args]",
+		"Usage: threshold config <subcommand> [options] [args]",
 		"",
-		"  This command groups subcommands for operators interacting with Boundary's config files. Here are a few examples of config commands:",
+		"  This command groups subcommands for operators interacting with Threshold's config files. Here are a few examples of config commands:",
 		"",
 		"    Encrypt sensitive values in a config file:",
 		"",
-		"      $ boundary config encrypt config.hcl",
+		"      $ threshold config encrypt config.hcl",
 		"",
 		"    Decrypt sensitive values in a config file:",
 		"",
-		"      $ boundary config decrypt config.hcl",
+		"      $ threshold config decrypt config.hcl",
 		"",
 		"    Read a stored token out:",
 		"",
-		"      $ boundary config get-token",
+		"      $ threshold config get-token",
 		"",
 		"  Please see the individual subcommand help for detailed usage information.",
 	})
@@ -39,21 +39,21 @@ type EncryptDecryptCommand struct {
 }

 func (c *EncryptDecryptCommand) Synopsis() string {
-	return fmt.Sprintf("%s sensitive values in Boundary's configuration file", textproto.CanonicalMIMEHeaderKey(c.Func))
+	return fmt.Sprintf("%s sensitive values in Threshold's configuration file", textproto.CanonicalMIMEHeaderKey(c.Func))
 }

 func (c *EncryptDecryptCommand) Help() string {
 	var args []string
 	args = append(args,
-		"Usage: boundary config {{func}} [options] [args]",
+		"Usage: threshold config {{func}} [options] [args]",
 		"",
-		"  {{upperfunc}} sensitive values in a Boundary's configuration file. These values must be marked with {{{{func}}()}} as appropriate. Example:",
+		"  {{upperfunc}} sensitive values in a Threshold's configuration file. These values must be marked with {{{{func}}()}} as appropriate. Example:",
 		"",
 		`    foo = "{{encrypt(bar)}}"`,
 		"",
 		"  By default this will print out the new configuration. To overwrite into the same file use the -overwrite flag.",
 		"",
-		"    $ boundary config {{func}} -overwrite config.hcl",
+		"    $ threshold config {{func}} -overwrite config.hcl",
 		"",
 		`  In order for this command to perform its task, a "kms" block must be defined within a configuration file. Example:`,
 		"",
@@ -36,17 +36,17 @@ func (c *TokenCommand) Help() string {
 	switch c.Func {
 	case "get-token":
 		args = append(args,
-			"Usage: boundary config get-token [options] [args]",
+			"Usage: threshold config get-token [options] [args]",
 			"",
-			"  Fetch a token stored by the Boundary CLI. Example:",
+			"  Fetch a token stored by the Threshold CLI. Example:",
 			"",
-			`    $ boundary config get-token`,
+			`    $ threshold config get-token`,
 			"",
-			"  This can be useful in various situations. For example, a line such as the following could be in a shell script shared by developers, such that each developer on their own machine executing the script ends up using their own Boundary token:",
+			"  This can be useful in various situations. For example, a line such as the following could be in a shell script shared by developers, such that each developer on their own machine executing the script ends up using their own Threshold token:",
 			"",
-			`    $ curl -H "Authorization: Bearer $(boundary config get-token)" -H "Content-Type: application/json" http://127.0.0.1:9200/v1/roles/r_1234567890`,
+			`    $ curl -H "Authorization: Bearer $(threshold config get-token)" -H "Content-Type: application/json" http://127.0.0.1:9200/v1/roles/r_1234567890`,
 			"",
-			"  Note that this command keeps parity with the behavior of other Boundary commands; if the BOUNDARY_TOKEN environment variable it set, it will override the value loaded from the system store. Not only does this keep parity, but it also allows examples such as the one above to work even if there is no stored token but if an environment variable is specified.",
+			"  Note that this command keeps parity with the behavior of other Threshold commands; if the THRESHOLD_TOKEN environment variable it set, it will override the value loaded from the system store. Not only does this keep parity, but it also allows examples such as the one above to work even if there is no stored token but if an environment variable is specified.",
 			"",
 		)
 	}
@@ -23,7 +23,7 @@ func cassandraOptions(c *Command, set *base.FlagSets) {
 	f.StringVar(&base.StringVar{
 		Name:       "style",
 		Target:     &c.flagCassandraStyle,
-		EnvVar:     "BOUNDARY_CONNECT_CASSANDRA_STYLE",
+		EnvVar:     "THRESHOLD_CONNECT_CASSANDRA_STYLE",
 		Completion: complete.PredictSet("cqlsh"),
 		Default:    "cqlsh",
 		Usage:      `Specifies how the CLI will attempt to invoke a Cassandra client. This will also set a suitable default for -exec if a value was not specified. Currently-understood values are "cqlsh".`,
@@ -32,7 +32,7 @@ func cassandraOptions(c *Command, set *base.FlagSets) {
 	f.StringVar(&base.StringVar{
 		Name:       "username",
 		Target:     &c.flagUsername,
-		EnvVar:     "BOUNDARY_CONNECT_USERNAME",
+		EnvVar:     "THRESHOLD_CONNECT_USERNAME",
 		Completion: complete.PredictNothing,
 		Usage:      `Specifies the username to pass through to the client. May be overridden by credentials sourced from a credential store.`,
 	})
@@ -40,7 +40,7 @@ func cassandraOptions(c *Command, set *base.FlagSets) {
 	f.StringVar(&base.StringVar{
 		Name:       "keyspace",
 		Target:     &c.flagDbname,
-		EnvVar:     "BOUNDARY_CONNECT_KEYSPACE",
+		EnvVar:     "THRESHOLD_CONNECT_KEYSPACE",
 		Completion: complete.PredictNothing,
 		Usage:      `Specifies the keyspace name to pass through to the client.`,
 	})
@@ -55,7 +55,7 @@ var (
 	_ cli.Command             = (*Command)(nil)
 	_ cli.CommandAutocomplete = (*Command)(nil)

-	// rdpDefaultTimeout is the default inactivity timeout for boundary connect rdp
+	// rdpDefaultTimeout is the default inactivity timeout for threshold connect rdp
 	// The default is zero (no timeout), however it is overridden for macOS clients only in connect_darwin.go
 	rdpDefaultTimeout time.Duration = 0
 )
@@ -117,7 +117,7 @@ type Command struct {
 func (c *Command) Synopsis() string {
 	switch c.Func {
 	case "connect":
-		return "Connect to a target through a Boundary worker"
+		return "Connect to a target through a Threshold worker"
 	case "http":
 		return httpSynopsis
 	case "postgres":
@@ -145,26 +145,26 @@ func (c *Command) Help() string {
 	switch c.Func {
 	case "connect":
 		return base.WrapForHelpText([]string{
-			"Usage: boundary connect [options] [args]",
+			"Usage: threshold connect [options] [args]",
 			"",
 			`  This command performs a target authorization (or consumes an existing authorization token) and launches a proxied connection.`,
 			"",
 			"  Example:",
 			"",
-			`      $ boundary connect -target-id ttcp_1234567890`,
+			`      $ threshold connect -target-id ttcp_1234567890`,
 			"",
 			"",
 		}) + c.Flags().Help()

 	default:
 		return base.WrapForHelpText([]string{
-			fmt.Sprintf("Usage: boundary connect %s [options] [args]", c.Func),
+			fmt.Sprintf("Usage: threshold connect %s [options] [args]", c.Func),
 			"",
 			fmt.Sprintf(`  This command performs a target authorization (or consumes an existing authorization token) and launches a proxied %s connection.`, c.Func),
 			"",
 			"  Example:",
 			"",
-			fmt.Sprintf(`      $ boundary connect %s -target-id ttcp_1234567890`, c.Func),
+			fmt.Sprintf(`      $ threshold connect %s -target-id ttcp_1234567890`, c.Func),
 			"",
 			"",
 		}) + c.Flags().Help()
@@ -178,9 +178,9 @@ func (c *Command) Flags() *base.FlagSets {
 	f.StringVar(&base.StringVar{
 		Name:       "authz-token",
 		Target:     &c.flagAuthzToken,
-		EnvVar:     "BOUNDARY_CONNECT_AUTHZ_TOKEN",
+		EnvVar:     "THRESHOLD_CONNECT_AUTHZ_TOKEN",
 		Completion: complete.PredictNothing,
-		Usage:      `Only needed if -target-id is not set. The authorization string returned from the Boundary controller via an "authorize-session" action against a target. If set to "-", the command will attempt to read in the authorization string from standard input.`,
+		Usage:      `Only needed if -target-id is not set. The authorization string returned from the Threshold controller via an "authorize-session" action against a target. If set to "-", the command will attempt to read in the authorization string from standard input.`,
 	})

 	f.StringVar(&base.StringVar{
@@ -198,7 +198,7 @@ func (c *Command) Flags() *base.FlagSets {
 	f.StringVar(&base.StringVar{
 		Name:       "exec",
 		Target:     &c.flagExec,
-		EnvVar:     "BOUNDARY_CONNECT_EXEC",
+		EnvVar:     "THRESHOLD_CONNECT_EXEC",
 		Completion: complete.PredictAnything,
 		Usage:      `If set, after connecting to the worker, the given binary will be executed. This should be a binary on your path, or an absolute path. If all command flags are followed by " -- " (space, two hyphens, space), then any arguments after that will be sent directly to the binary.`,
 	})
@@ -212,7 +212,7 @@ func (c *Command) Flags() *base.FlagSets {
 	f.StringVar(&base.StringVar{
 		Name:       "target-scope-id",
 		Target:     &c.FlagScopeId,
-		EnvVar:     "BOUNDARY_CONNECT_TARGET_SCOPE_ID",
+		EnvVar:     "THRESHOLD_CONNECT_TARGET_SCOPE_ID",
 		Completion: complete.PredictAnything,
 		Usage:      "Target scope ID, if authorizing the session via scope parameters and target name. Mutually exclusive with -scope-name.",
 	})
@@ -220,7 +220,7 @@ func (c *Command) Flags() *base.FlagSets {
 	f.StringVar(&base.StringVar{
 		Name:       "target-scope-name",
 		Target:     &c.FlagScopeName,
-		EnvVar:     "BOUNDARY_CONNECT_TARGET_SCOPE_NAME",
+		EnvVar:     "THRESHOLD_CONNECT_TARGET_SCOPE_NAME",
 		Completion: complete.PredictAnything,
 		Usage:      "Target scope name, if authorizing the session via scope parameters and target name. Mutually exclusive with -scope-id.",
 	})
@@ -237,7 +237,7 @@ func (c *Command) Flags() *base.FlagSets {
 		f.StringVar(&base.StringVar{
 			Name:       "listen-addr",
 			Target:     &c.flagListenAddr,
-			EnvVar:     "BOUNDARY_CONNECT_LISTEN_ADDR",
+			EnvVar:     "THRESHOLD_CONNECT_LISTEN_ADDR",
 			Completion: complete.PredictAnything,
 			Usage:      `If set, the CLI will attempt to bind its listening address to the given value, which must be an IP address. If it cannot, the command will error. If not set, defaults to the most common IPv4 loopback address (127.0.0.1).`,
 		})
@@ -245,7 +245,7 @@ func (c *Command) Flags() *base.FlagSets {
 		f.Int64Var(&base.Int64Var{
 			Name:       "listen-port",
 			Target:     &c.flagListenPort,
-			EnvVar:     "BOUNDARY_CONNECT_LISTEN_PORT",
+			EnvVar:     "THRESHOLD_CONNECT_LISTEN_PORT",
 			Completion: complete.PredictAnything,
 			Usage:      `If set, the CLI will attempt to bind its listening port to the given value. If it cannot, the command will error.`,
 		})
@@ -479,7 +479,7 @@ func (c *Command) Run(args []string) (retCode int) {
 			Credentials:     sa.Credentials,
 		}

-		// the session was created specifically for this `boundary connect`
+		// the session was created specifically for this `threshold connect`
 		// command, and should be closed as soon as the command has exited
 		defer func() {
 			var err error
@@ -840,6 +840,10 @@ func (c *Command) handleExec(clientProxy *apiproxy.ClientProxy, passthroughArgs
 	cmd := exec.Command(c.flagExec, args...)
 	// Add original and network related envs here
 	cmd.Env = append(os.Environ(),
+		fmt.Sprintf("THRESHOLD_PROXIED_PORT=%s", port),
+		fmt.Sprintf("THRESHOLD_PROXIED_IP=%s", host),
+		fmt.Sprintf("THRESHOLD_PROXIED_ADDR=%s", addr),
+		// Legacy names, kept so existing -exec scripts keep working.
 		fmt.Sprintf("BOUNDARY_PROXIED_PORT=%s", port),
 		fmt.Sprintf("BOUNDARY_PROXIED_IP=%s", host),
 		fmt.Sprintf("BOUNDARY_PROXIED_ADDR=%s", addr),
@@ -22,7 +22,7 @@ func httpOptions(c *Command, set *base.FlagSets) {
 	f.StringVar(&base.StringVar{
 		Name:       "style",
 		Target:     &c.flagHttpStyle,
-		EnvVar:     "BOUNDARY_CONNECT_HTTP_STYLE",
+		EnvVar:     "THRESHOLD_CONNECT_HTTP_STYLE",
 		Completion: complete.PredictSet("curl"),
 		Default:    "curl",
 		Usage:      `Specifies how the CLI will attempt to invoke an HTTP client. This will also set a suitable default for -exec if a value was not specified. Currently-understood values are "curl".`,
@@ -31,7 +31,7 @@ func httpOptions(c *Command, set *base.FlagSets) {
 	f.StringVar(&base.StringVar{
 		Name:       "host",
 		Target:     &c.flagHttpHost,
-		EnvVar:     "BOUNDARY_CONNECT_HTTP_HOST",
+		EnvVar:     "THRESHOLD_CONNECT_HTTP_HOST",
 		Completion: complete.PredictNothing,
 		Usage:      `Specifies the host value to use, overriding the endpoint address from the session information. The specified hostname will be passed through to the client (if supported) for use in the Host header and TLS SNI value.`,
 	})
@@ -39,7 +39,7 @@ func httpOptions(c *Command, set *base.FlagSets) {
 	f.StringVar(&base.StringVar{
 		Name:       "path",
 		Target:     &c.flagHttpPath,
-		EnvVar:     "BOUNDARY_CONNECT_HTTP_PATH",
+		EnvVar:     "THRESHOLD_CONNECT_HTTP_PATH",
 		Completion: complete.PredictNothing,
 		Usage:      `Specifies a path that will be appended to the generated URL.`,
 	})
@@ -47,7 +47,7 @@ func httpOptions(c *Command, set *base.FlagSets) {
 	f.StringVar(&base.StringVar{
 		Name:       "method",
 		Target:     &c.flagHttpMethod,
-		EnvVar:     "BOUNDARY_CONNECT_HTTP_METHOD",
+		EnvVar:     "THRESHOLD_CONNECT_HTTP_METHOD",
 		Completion: complete.PredictNothing,
 		Usage:      `Specifies the method to use. If not set, will use the client's default.`,
 	})
@@ -56,7 +56,7 @@ func httpOptions(c *Command, set *base.FlagSets) {
 		Name:       "scheme",
 		Target:     &c.flagHttpScheme,
 		Default:    "https",
-		EnvVar:     "BOUNDARY_CONNECT_HTTP_SCHEME",
+		EnvVar:     "THRESHOLD_CONNECT_HTTP_SCHEME",
 		Completion: complete.PredictNothing,
 		Usage:      `Specifies the scheme to use.`,
 	})
@@ -22,7 +22,7 @@ func kubeOptions(c *Command, set *base.FlagSets) {
 	f.StringVar(&base.StringVar{
 		Name:       "style",
 		Target:     &c.flagKubeStyle,
-		EnvVar:     fmt.Sprintf("BOUNDARY_CONNECT_%s_STYLE", strings.ToUpper(c.Func)),
+		EnvVar:     fmt.Sprintf("THRESHOLD_CONNECT_%s_STYLE", strings.ToUpper(c.Func)),
 		Completion: complete.PredictSet("kubectl"),
 		Default:    "kubectl",
 		Usage:      `Specifies how the CLI will attempt to invoke a Kubernetes client. This will also set a suitable default for -exec if a value was not specified. Currently-understood values are "kubectl".`,
@@ -31,7 +31,7 @@ func kubeOptions(c *Command, set *base.FlagSets) {
 	f.StringVar(&base.StringVar{
 		Name:       "host",
 		Target:     &c.flagKubeHost,
-		EnvVar:     fmt.Sprintf("BOUNDARY_CONNECT_%s_HOST", strings.ToUpper(c.Func)),
+		EnvVar:     fmt.Sprintf("THRESHOLD_CONNECT_%s_HOST", strings.ToUpper(c.Func)),
 		Completion: complete.PredictNothing,
 		Usage:      `Specifies the host value to use, overriding the endpoint address from the session information. The specified hostname will be passed through to the client (if supported) for use in the TLS SNI value.`,
 	})
@@ -40,7 +40,7 @@ func kubeOptions(c *Command, set *base.FlagSets) {
 		Name:       "scheme",
 		Target:     &c.flagKubeScheme,
 		Default:    "https",
-		EnvVar:     fmt.Sprintf("BOUNDARY_CONNECT_%s_SCHEME", strings.ToUpper(c.Func)),
+		EnvVar:     fmt.Sprintf("THRESHOLD_CONNECT_%s_SCHEME", strings.ToUpper(c.Func)),
 		Completion: complete.PredictNothing,
 		Usage:      `Specifies the scheme to use.`,
 	})
@@ -22,7 +22,7 @@ func mongoOptions(c *Command, set *base.FlagSets) {
 	f.StringVar(&base.StringVar{
 		Name:       "style",
 		Target:     &c.flagMongoStyle,
-		EnvVar:     "BOUNDARY_CONNECT_MONGO_STYLE",
+		EnvVar:     "THRESHOLD_CONNECT_MONGO_STYLE",
 		Completion: complete.PredictSet("mongosh"),
 		Default:    "mongosh",
 		Usage:      `Specifies how the CLI will attempt to invoke a MongoDB client. Currently only "mongosh" is supported.`,
@@ -31,7 +31,7 @@ func mongoOptions(c *Command, set *base.FlagSets) {
 	f.StringVar(&base.StringVar{
 		Name:       "username",
 		Target:     &c.flagUsername,
-		EnvVar:     "BOUNDARY_CONNECT_USERNAME",
+		EnvVar:     "THRESHOLD_CONNECT_USERNAME",
 		Completion: complete.PredictNothing,
 		Usage:      `Specifies the username to pass through to the client. May be overridden by credentials sourced from a credential store.`,
 	})
@@ -39,7 +39,7 @@ func mongoOptions(c *Command, set *base.FlagSets) {
 	f.StringVar(&base.StringVar{
 		Name:       "dbname",
 		Target:     &c.flagDbname,
-		EnvVar:     "BOUNDARY_CONNECT_DBNAME",
+		EnvVar:     "THRESHOLD_CONNECT_DBNAME",
 		Completion: complete.PredictNothing,
 		Usage:      `Specifies the database name to pass through to the client.`,
 	})
@@ -47,7 +47,7 @@ func mongoOptions(c *Command, set *base.FlagSets) {
 	f.StringVar(&base.StringVar{
 		Name:       "authentication-database",
 		Target:     &c.flagMongoDbAuthenticationDatabase,
-		EnvVar:     "BOUNDARY_CONNECT_MONGO_AUTHENTICATION_DATABASE",
+		EnvVar:     "THRESHOLD_CONNECT_MONGO_AUTHENTICATION_DATABASE",
 		Completion: complete.PredictNothing,
 		Default:    "",
 		Usage:      `Specifies the authentication database for MongoDB. If omitted, mongosh defaults authSource to the database name (dbname); if none is specified, it defaults to "admin".`,
@@ -23,7 +23,7 @@ func mysqlOptions(c *Command, set *base.FlagSets) {
 	f.StringVar(&base.StringVar{
 		Name:       "style",
 		Target:     &c.flagMySQLStyle,
-		EnvVar:     "BOUNDARY_CONNECT_MYSQL_STYLE",
+		EnvVar:     "THRESHOLD_CONNECT_MYSQL_STYLE",
 		Completion: complete.PredictSet("mysql"),
 		Default:    "mysql",
 		Usage:      `Specifies how the CLI will attempt to invoke a MySQL client. This will also set a suitable default for -exec if a value was not specified. Currently-understood values are "mysql".`,
@@ -32,7 +32,7 @@ func mysqlOptions(c *Command, set *base.FlagSets) {
 	f.StringVar(&base.StringVar{
 		Name:       "username",
 		Target:     &c.flagUsername,
-		EnvVar:     "BOUNDARY_CONNECT_USERNAME",
+		EnvVar:     "THRESHOLD_CONNECT_USERNAME",
 		Completion: complete.PredictNothing,
 		Usage:      `Specifies the username to pass through to the client. May be overridden by credentials sourced from a credential store.`,
 	})
@@ -40,7 +40,7 @@ func mysqlOptions(c *Command, set *base.FlagSets) {
 	f.StringVar(&base.StringVar{
 		Name:       "dbname",
 		Target:     &c.flagDbname,
-		EnvVar:     "BOUNDARY_CONNECT_DBNAME",
+		EnvVar:     "THRESHOLD_CONNECT_DBNAME",
 		Completion: complete.PredictNothing,
 		Usage:      `Specifies the database name to pass through to the client.`,
 	})
@@ -23,7 +23,7 @@ func postgresOptions(c *Command, set *base.FlagSets) {
 	f.StringVar(&base.StringVar{
 		Name:       "style",
 		Target:     &c.flagPostgresStyle,
-		EnvVar:     "BOUNDARY_CONNECT_POSTGRES_STYLE",
+		EnvVar:     "THRESHOLD_CONNECT_POSTGRES_STYLE",
 		Completion: complete.PredictSet("psql"),
 		Default:    "psql",
 		Usage:      `Specifies how the CLI will attempt to invoke a Postgres client. This will also set a suitable default for -exec if a value was not specified. Currently-understood values are "psql".`,
@@ -32,7 +32,7 @@ func postgresOptions(c *Command, set *base.FlagSets) {
 	f.StringVar(&base.StringVar{
 		Name:       "username",
 		Target:     &c.flagUsername,
-		EnvVar:     "BOUNDARY_CONNECT_USERNAME",
+		EnvVar:     "THRESHOLD_CONNECT_USERNAME",
 		Completion: complete.PredictNothing,
 		Usage:      `Specifies the username to pass through to the client. May be overridden by credentials sourced from a credential store.`,
 	})
@@ -40,7 +40,7 @@ func postgresOptions(c *Command, set *base.FlagSets) {
 	f.StringVar(&base.StringVar{
 		Name:       "dbname",
 		Target:     &c.flagDbname,
-		EnvVar:     "BOUNDARY_CONNECT_DBNAME",
+		EnvVar:     "THRESHOLD_CONNECT_DBNAME",
 		Completion: complete.PredictNothing,
 		Usage:      `Specifies the database name to pass through to the client.`,
 	})