Rebrand user-visible CLI text; add legacy fallbacks for keyring, cache dir and version prefix

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

api/client.go

@@ -52,14 +52,14 @@ const (
 
 // Config is used to configure the creation of the client
 type Config struct {
-	// Addr is the address of the Boundary controller. This should be a
-	// complete URL such as "http://boundary.example.com". If you need a custom
+	// Addr is the address of the Threshold controller. This should be a
+	// complete URL such as "http://threshold.example.com". If you need a custom
 	// SSL cert or want to enable insecure mode, you need to specify a custom
 	// HttpClient.
 	Addr string
 
 	// Token is the client token that reuslts from authentication and can be
-	// used to make calls into Boundary
+	// used to make calls into Threshold
 	Token string
 
 	// RecoveryKmsWrapper is a wrapper used in the recovery KMS authentication
@@ -67,9 +67,9 @@ type Config struct {
 	// per-call, regardless of any value set in Token.
 	RecoveryKmsWrapper wrapping.Wrapper
 
-	// HttpClient is the HTTP client to use. Boundary sets sane defaults for the
+	// HttpClient is the HTTP client to use. Threshold sets sane defaults for the
 	// http.Client and its associated http.Transport created in DefaultConfig.
-	// If you must modify Boundary's defaults, it is suggested that you start
+	// If you must modify Threshold's defaults, it is suggested that you start
 	// with that client and modify as needed rather than start with an empty
 	// client (or http.DefaultClient). Currently if the client is cloned the
 	// same HttpClient is used.
@@ -113,20 +113,20 @@ type Config struct {
 }
 
 // TLSConfig contains the parameters needed to configure TLS on the HTTP client
-// used to communicate with Boundary.
+// used to communicate with Threshold.
 type TLSConfig struct {
 	// CACert is the path to a PEM-encoded CA cert file to use to verify the
-	// Boundary server SSL certificate.
+	// Threshold server SSL certificate.
 	CACert string
 
 	// CAPath is the path to a directory of PEM-encoded CA cert files to verify
-	// the Boundary server SSL certificate.
+	// the Threshold server SSL certificate.
 	CAPath string
 
-	// ClientCert is the path to the certificate for Boundary communication
+	// ClientCert is the path to the certificate for Threshold communication
 	ClientCert string
 
-	// ClientKey is the path to the private key for Boundary communication
+	// ClientKey is the path to the private key for Threshold communication
 	ClientKey string
 
 	// ServerName, if set, is used to set the SNI host when connecting via
@@ -161,7 +161,7 @@ func RateLimitLinearJitterBackoff(min, max time.Duration, attemptNum int, resp *
 // safe to modify the return value of this function.
 //
 // The default Addr is http://127.0.0.1:9200, but this can be overridden by
-// setting the `BOUNDARY_ADDR` environment variable.
+// setting the `THRESHOLD_ADDR` environment variable.
 //
 // If an error is encountered, this will return nil.
 func DefaultConfig() (*Config, error) {
@@ -269,7 +269,7 @@ func (c *Config) setAddr(addr string) error {
 	// Remove trailing or leading slashes
 	path := strings.Trim(u.Path, "/")
 	// Remove v1 in front or back (e.g. they could have
-	// https://boundary.example.com/myinstall/v1 which would put it at the
+	// https://threshold.example.com/myinstall/v1 which would put it at the
 	// back)
 	path = strings.TrimPrefix(path, "v1")
 	path = strings.TrimSuffix(path, "v1")
@@ -366,7 +366,7 @@ func (c *Config) ReadEnvironment() error {
 			var err error
 			envInsecure, err = strconv.ParseBool(v)
 			if err != nil {
-				return fmt.Errorf("could not parse BOUNDARY_TLS_INSECURE")
+				return fmt.Errorf("could not parse THRESHOLD_TLS_INSECURE")
 			}
 		}
 		if v := Getenv(EnvBoundaryTLSServerName); v != "" {
@@ -404,7 +404,7 @@ func parseRateLimit(val string) (rate float64, burst int, err error) {
 	return rate, burst, err
 }
 
-// Client is the client to the Boundary API. Create a client with NewClient.
+// Client is the client to the Threshold API. Create a client with NewClient.
 type Client struct {
 	modifyLock sync.RWMutex
 	config     *Config
@@ -412,10 +412,10 @@ type Client struct {
 
 // NewClient returns a new client for the given configuration.
 //
-// If the configuration is nil, Boundary will use configuration from
+// If the configuration is nil, Threshold will use configuration from
 // DefaultConfig(), which is the recommended starting configuration.
 //
-// If the environment variable `BOUNDARY_TOKEN` is present, the token will be
+// If the environment variable `THRESHOLD_TOKEN` is present, the token will be
 // automatically added to the client. Otherwise, you must manually call
 // `SetToken()`.
 func NewClient(c *Config) (*Client, error) {
@@ -464,9 +464,9 @@ func (c *Client) Addr() string {
 	return c.config.Addr
 }
 
-// Sets the address of Boundary in the client. The format of address should
+// Sets the address of Threshold in the client. The format of address should
 // be "<Scheme>://<Host>:<Port>". Setting this on a client will override the
-// value of the BOUNDARY_ADDR environment variable.
+// value of the THRESHOLD_ADDR environment variable.
 func (c *Client) SetAddr(addr string) error {
 	c.modifyLock.Lock()
 	defer c.modifyLock.Unlock()
@@ -623,7 +623,7 @@ func copyHeaders(in http.Header) http.Header {
 	return ret
 }
 
-// NewRequest creates a new raw request object to query the Boundary controller
+// NewRequest creates a new raw request object to query the Threshold controller
 // configured for this client. This is an advanced method and generally
 // doesn't need to be called externally.
 func (c *Client) NewRequest(ctx context.Context, method, requestPath string, body any, opt ...Option) (*retryablehttp.Request, error) {
@@ -761,7 +761,7 @@ func (c *Client) Do(r *retryablehttp.Request, opt ...Option) (*Response, error)
 		return !unicode.IsPrint(c)
 	})
 	if idx != -1 {
-		return nil, fmt.Errorf("configured Boundary token contains non-printable characters and cannot be used")
+		return nil, fmt.Errorf("configured Threshold token contains non-printable characters and cannot be used")
 	}
 
 	if outputCurlString {
@@ -847,9 +847,9 @@ func (c *Client) Do(r *retryablehttp.Request, opt ...Option) (*Response, error)
 					"but the client is configured to use TLS. Please either enable TLS\n"+
 					"on the server or run the client with -address set to an address\n"+
 					"that uses the http protocol:\n\n"+
-					"    boundary <command> -address http://<address>\n\n"+
-					"You can also set the BOUNDARY_ADDR environment variable:\n\n\n"+
-					"    BOUNDARY_ADDR=http://<address> boundary <command>\n\n"+
+					"    threshold <command> -address http://<address>\n\n"+
+					"You can also set the THRESHOLD_ADDR environment variable:\n\n\n"+
+					"    THRESHOLD_ADDR=http://<address> threshold <command>\n\n"+
 					"where <address> is replaced by the actual address to the controller.",
 				err)
 		}