Rebrand user-visible CLI text; add legacy fallbacks for keyring, cache dir and version prefix

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

api/client.go

@@ -52,14 +52,14 @@ const (
 
 // Config is used to configure the creation of the client
 type Config struct {
-	// Addr is the address of the Boundary controller. This should be a
+	// Addr is the address of the Threshold controller. This should be a
-	// complete URL such as "http://boundary.example.com". If you need a custom
+	// complete URL such as "http://threshold.example.com". If you need a custom
 	// SSL cert or want to enable insecure mode, you need to specify a custom
 	// HttpClient.
 	Addr string
 
 	// Token is the client token that reuslts from authentication and can be
-	// used to make calls into Boundary
+	// used to make calls into Threshold
 	Token string
 
 	// RecoveryKmsWrapper is a wrapper used in the recovery KMS authentication
@@ -67,9 +67,9 @@ type Config struct {
 	// per-call, regardless of any value set in Token.
 	RecoveryKmsWrapper wrapping.Wrapper
 
-	// HttpClient is the HTTP client to use. Boundary sets sane defaults for the
+	// HttpClient is the HTTP client to use. Threshold sets sane defaults for the
 	// http.Client and its associated http.Transport created in DefaultConfig.
-	// If you must modify Boundary's defaults, it is suggested that you start
+	// If you must modify Threshold's defaults, it is suggested that you start
 	// with that client and modify as needed rather than start with an empty
 	// client (or http.DefaultClient). Currently if the client is cloned the
 	// same HttpClient is used.
@@ -113,20 +113,20 @@ type Config struct {
 }
 
 // TLSConfig contains the parameters needed to configure TLS on the HTTP client
-// used to communicate with Boundary.
+// used to communicate with Threshold.
 type TLSConfig struct {
 	// CACert is the path to a PEM-encoded CA cert file to use to verify the
-	// Boundary server SSL certificate.
+	// Threshold server SSL certificate.
 	CACert string
 
 	// CAPath is the path to a directory of PEM-encoded CA cert files to verify
-	// the Boundary server SSL certificate.
+	// the Threshold server SSL certificate.
 	CAPath string
 
-	// ClientCert is the path to the certificate for Boundary communication
+	// ClientCert is the path to the certificate for Threshold communication
 	ClientCert string
 
-	// ClientKey is the path to the private key for Boundary communication
+	// ClientKey is the path to the private key for Threshold communication
 	ClientKey string
 
 	// ServerName, if set, is used to set the SNI host when connecting via
@@ -161,7 +161,7 @@ func RateLimitLinearJitterBackoff(min, max time.Duration, attemptNum int, resp *
 // safe to modify the return value of this function.
 //
 // The default Addr is http://127.0.0.1:9200, but this can be overridden by
-// setting the `BOUNDARY_ADDR` environment variable.
+// setting the `THRESHOLD_ADDR` environment variable.
 //
 // If an error is encountered, this will return nil.
 func DefaultConfig() (*Config, error) {
@@ -269,7 +269,7 @@ func (c *Config) setAddr(addr string) error {
 	// Remove trailing or leading slashes
 	path := strings.Trim(u.Path, "/")
 	// Remove v1 in front or back (e.g. they could have
-	// https://boundary.example.com/myinstall/v1 which would put it at the
+	// https://threshold.example.com/myinstall/v1 which would put it at the
 	// back)
 	path = strings.TrimPrefix(path, "v1")
 	path = strings.TrimSuffix(path, "v1")
@@ -366,7 +366,7 @@ func (c *Config) ReadEnvironment() error {
 			var err error
 			envInsecure, err = strconv.ParseBool(v)
 			if err != nil {
-				return fmt.Errorf("could not parse BOUNDARY_TLS_INSECURE")
+				return fmt.Errorf("could not parse THRESHOLD_TLS_INSECURE")
 			}
 		}
 		if v := Getenv(EnvBoundaryTLSServerName); v != "" {
@@ -404,7 +404,7 @@ func parseRateLimit(val string) (rate float64, burst int, err error) {
 	return rate, burst, err
 }
 
-// Client is the client to the Boundary API. Create a client with NewClient.
+// Client is the client to the Threshold API. Create a client with NewClient.
 type Client struct {
 	modifyLock sync.RWMutex
 	config     *Config
@@ -412,10 +412,10 @@ type Client struct {
 
 // NewClient returns a new client for the given configuration.
 //
-// If the configuration is nil, Boundary will use configuration from
+// If the configuration is nil, Threshold will use configuration from
 // DefaultConfig(), which is the recommended starting configuration.
 //
-// If the environment variable `BOUNDARY_TOKEN` is present, the token will be
+// If the environment variable `THRESHOLD_TOKEN` is present, the token will be
 // automatically added to the client. Otherwise, you must manually call
 // `SetToken()`.
 func NewClient(c *Config) (*Client, error) {
@@ -464,9 +464,9 @@ func (c *Client) Addr() string {
 	return c.config.Addr
 }
 
-// Sets the address of Boundary in the client. The format of address should
+// Sets the address of Threshold in the client. The format of address should
 // be "<Scheme>://<Host>:<Port>". Setting this on a client will override the
-// value of the BOUNDARY_ADDR environment variable.
+// value of the THRESHOLD_ADDR environment variable.
 func (c *Client) SetAddr(addr string) error {
 	c.modifyLock.Lock()
 	defer c.modifyLock.Unlock()
@@ -623,7 +623,7 @@ func copyHeaders(in http.Header) http.Header {
 	return ret
 }
 
-// NewRequest creates a new raw request object to query the Boundary controller
+// NewRequest creates a new raw request object to query the Threshold controller
 // configured for this client. This is an advanced method and generally
 // doesn't need to be called externally.
 func (c *Client) NewRequest(ctx context.Context, method, requestPath string, body any, opt ...Option) (*retryablehttp.Request, error) {
@@ -761,7 +761,7 @@ func (c *Client) Do(r *retryablehttp.Request, opt ...Option) (*Response, error)
 		return !unicode.IsPrint(c)
 	})
 	if idx != -1 {
-		return nil, fmt.Errorf("configured Boundary token contains non-printable characters and cannot be used")
+		return nil, fmt.Errorf("configured Threshold token contains non-printable characters and cannot be used")
 	}
 
 	if outputCurlString {
@@ -847,9 +847,9 @@ func (c *Client) Do(r *retryablehttp.Request, opt ...Option) (*Response, error)
 					"but the client is configured to use TLS. Please either enable TLS\n"+
 					"on the server or run the client with -address set to an address\n"+
 					"that uses the http protocol:\n\n"+
-					"    boundary <command> -address http://<address>\n\n"+
+					"    threshold <command> -address http://<address>\n\n"+
-					"You can also set the BOUNDARY_ADDR environment variable:\n\n\n"+
+					"You can also set the THRESHOLD_ADDR environment variable:\n\n\n"+
-					"    BOUNDARY_ADDR=http://<address> boundary <command>\n\n"+
+					"    THRESHOLD_ADDR=http://<address> threshold <command>\n\n"+
 					"where <address> is replaced by the actual address to the controller.",
 				err)
 		}

api/output_string.go

@@ -59,15 +59,15 @@ func (d *OutputStringError) parseRequest() {
 	for k, v := range d.Request.Header {
 		for _, h := range v {
 			if strings.ToLower(k) == "authorization" {
-				tokenName := Getenv("BOUNDARY_TOKEN_NAME")
+				tokenName := Getenv("THRESHOLD_TOKEN_NAME")
-				keyringType := Getenv("BOUNDARY_KEYRING_TYPE")
+				keyringType := Getenv("THRESHOLD_KEYRING_TYPE")
 				switch {
 				case tokenName == "none" || keyringType == "none":
 					h = `Bearer <token>`
 				case tokenName == "" && keyringType == "":
-					h = `Bearer $(boundary config get-token)`
+					h = `Bearer $(threshold config get-token)`
 				default:
-					h = fmt.Sprintf("Bearer $(boundary config get-token -keyring-type %s -token-name %s)", keyringType, tokenName)
+					h = fmt.Sprintf("Bearer $(threshold config get-token -keyring-type %s -token-name %s)", keyringType, tokenName)
 				}
 			}
 			d.parsedCurlString = fmt.Sprintf("%s -H \"%s: %s\"", d.parsedCurlString, k, h)

internal/clientcache/cmd/cache/addtoken.go

@@ -28,16 +28,16 @@ type AddTokenCommand struct {
 }
 
 func (c *AddTokenCommand) Synopsis() string {
-	return "Add an auth token to a running boundary cache"
+	return "Add an auth token to a running threshold cache"
 }
 
 func (c *AddTokenCommand) Help() string {
 	helpText := `
-Usage: boundary cache add-token [options]
+Usage: threshold cache add-token [options]
 
   Add an auth token to the cache:
 
-      $ boundary cache add-token
+      $ threshold cache add-token
 
   For a full list of examples, please see the documentation.
 
@@ -54,7 +54,7 @@ func (c *AddTokenCommand) Flags() *base.FlagSets {
 		Target:     &c.FlagAddr,
 		EnvVar:     api.EnvBoundaryAddr,
 		Completion: complete.PredictAnything,
-		Usage:      "Addr of the Boundary controller, as a complete URL (e.g. https://boundary.example.com:9200).",
+		Usage:      "Addr of the Threshold controller, as a complete URL (e.g. https://threshold.example.com:9200).",
 	})
 
 	f = set.NewFlagSet("Client Options")

internal/clientcache/cmd/cache/cache.go

@@ -21,18 +21,18 @@ type CacheCommand struct {
 }
 
 func (c *CacheCommand) Synopsis() string {
-	return "Manages the client side Boundary cache"
+	return "Manages the client side Threshold cache"
 }
 
 func (c *CacheCommand) Help() string {
 	helpText := `
-Usage: boundary cache [sub command] [options]
+Usage: threshold cache [sub command] [options]
 
-  This command allows interacting with the Boundary cache.
+  This command allows interacting with the Threshold cache.
 
   Start a cache:
 
-      $ boundary cache start
+      $ threshold cache start
 
   For a full list of examples, please see the documentation.
 
@@ -54,7 +54,7 @@ func (c *CacheCommand) AutocompleteFlags() complete.Flags {
 
 func (c *CacheCommand) Run(args []string) int {
 	if len(args) >= 2 && args[1] == "daemon" {
-		c.UI.Warn("The `boundary daemon` command is deprecated, use `boundary cache` instead")
+		c.UI.Warn("The `threshold daemon` command is deprecated, use `threshold cache` instead")
 	}
 	return cli.RunResultHelp
 }

internal/clientcache/cmd/cache/start.go

@@ -24,7 +24,6 @@ import (
 )
 
 const (
-	dotDirname  = ".boundary"
 	pidFileName = "cache.pid"
 	logFileName = "cache.log"
 
@@ -54,16 +53,16 @@ type StartCommand struct {
 }
 
 func (c *StartCommand) Synopsis() string {
-	return "Start a Boundary cache"
+	return "Start a Threshold cache"
 }
 
 func (c *StartCommand) Help() string {
 	helpText := `
-Usage: boundary cache start [options]
+Usage: threshold cache start [options]
 
   Start a cache:
 
-      $ boundary cache start
+      $ threshold cache start
 
   For a full list of examples, please see the documentation.
 
@@ -78,7 +77,7 @@ func (c *StartCommand) Flags() *base.FlagSets {
 	f.StringVar(&base.StringVar{
 		Name:       "log-level",
 		Target:     &c.flagLogLevel,
-		EnvVar:     "BOUNDARY_LOG_LEVEL",
+		EnvVar:     "THRESHOLD_LOG_LEVEL",
 		Completion: complete.PredictSet("trace", "debug", "info", "warn", "err"),
 		Usage: "Log verbosity level, mostly as a fallback for events. Supported values (in order of more detail to less) are " +
 			"\"trace\", \"debug\", \"info\", \"warn\", and \"err\".",
@@ -255,7 +254,7 @@ func DefaultDotDirectory(ctx context.Context) (string, error) {
 	if err != nil {
 		return "", errors.Wrap(ctx, err, op)
 	}
-	return filepath.Join(homeDir, dotDirname), nil
+	return daemon.DotDirectory(homeDir), nil
 }
 
 // logFile returns a log file which is rotated after it reaches the provided

internal/clientcache/cmd/cache/status.go

@@ -34,16 +34,16 @@ type StatusCommand struct {
 }
 
 func (c *StatusCommand) Synopsis() string {
-	return "Get the status information of the running boundary cache"
+	return "Get the status information of the running threshold cache"
 }
 
 func (c *StatusCommand) Help() string {
 	helpText := `
-Usage: boundary cache status [options]
+Usage: threshold cache status [options]
 
-  Get the status of the boundary cache:
+  Get the status of the threshold cache:
 
-      $ boundary cache status
+      $ threshold cache status
 
   For a full list of examples, please see the documentation.
 

internal/clientcache/cmd/cache/stop.go

@@ -17,16 +17,16 @@ type StopCommand struct {
 }
 
 func (c *StopCommand) Synopsis() string {
-	return "Stop the Boundary cache"
+	return "Stop the Threshold cache"
 }
 
 func (c *StopCommand) Help() string {
 	helpText := `
-Usage: boundary cache stop
+Usage: threshold cache stop
 
   Stop a cache:
 
-      $ boundary cache stop
+      $ threshold cache stop
 
   For a full list of examples, please see the documentation.
 

internal/clientcache/cmd/cache/wrapper_register.go

@@ -76,7 +76,7 @@ func startDaemon(ctx context.Context, baseCmd *base.Command) (started bool, _ er
 
 	cmdName, err := os.Executable()
 	if err != nil {
-		baseCmd.UI.Error(fmt.Sprintf("unable to find boundary binary for cache startup: %s", err.Error()))
+		baseCmd.UI.Error(fmt.Sprintf("unable to find threshold binary for cache startup: %s", err.Error()))
 		return false, err
 	}
 
@@ -113,7 +113,7 @@ func stopDaemon(ctx context.Context, baseCmd *base.Command) error {
 
 	cmdName, err := os.Executable()
 	if err != nil {
-		baseCmd.UI.Error(fmt.Sprintf("unable to find boundary binary for cache startup: %s", err.Error()))
+		baseCmd.UI.Error(fmt.Sprintf("unable to find threshold binary for cache startup: %s", err.Error()))
 		return err
 	}
 	cmd := exec.Command(cmdName, "cache", "stop")

internal/clientcache/cmd/search/search.go

@@ -54,16 +54,16 @@ type SearchCommand struct {
 }
 
 func (c *SearchCommand) Synopsis() string {
-	return "Search Boundary resources using client cache"
+	return "Search Threshold resources using client cache"
 }
 
 func (c *SearchCommand) Help() string {
 	helpText := `
-Usage: boundary search [options]
+Usage: threshold search [options]
 
-  Search a boundary resource:
+  Search a threshold resource:
 
-      $ boundary search -resource targets -query 'name="foo"'
+      $ threshold search -resource targets -query 'name="foo"'
 
   For a full list of examples, please see the documentation.
 

internal/clientcache/internal/cache/refresh_test.go

@@ -284,7 +284,7 @@ func TestCleanAndPickTokens(t *testing.T) {
 		assert.ElementsMatch(t, maps.Values(got), []string{at1a.Token, at1b.Token})
 	})
 
-	t.Run("boundary in memory auth token expires", func(t *testing.T) {
+	t.Run("threshold in memory auth token expires", func(t *testing.T) {
 		require.NoError(t, r.AddRawToken(ctx, boundaryAddr, at1a.Token))
 		require.NoError(t, r.AddRawToken(ctx, boundaryAddr, at1b.Token))
 
@@ -302,7 +302,7 @@ func TestCleanAndPickTokens(t *testing.T) {
 		assert.ElementsMatch(t, maps.Values(got), []string{at1a.Token})
 	})
 
-	t.Run("boundary in memory auth token not found", func(t *testing.T) {
+	t.Run("threshold in memory auth token not found", func(t *testing.T) {
 		require.NoError(t, r.AddRawToken(ctx, boundaryAddr, at1a.Token))
 		require.NoError(t, r.AddRawToken(ctx, boundaryAddr, at1b.Token))
 
@@ -320,7 +320,7 @@ func TestCleanAndPickTokens(t *testing.T) {
 		assert.ElementsMatch(t, maps.Values(got), []string{at1a.Token})
 	})
 
-	t.Run("boundary keyring auths token expires", func(t *testing.T) {
+	t.Run("threshold keyring auths token expires", func(t *testing.T) {
 		key1 := ringToken{"k1", "t1"}
 		atMap[key1] = keyringAuthToken1
 		require.NoError(t, r.AddKeyringToken(ctx, boundaryAddr, KeyringToken{
@@ -350,7 +350,7 @@ func TestCleanAndPickTokens(t *testing.T) {
 		assert.ElementsMatch(t, maps.Values(got), []string{keyringAuthToken1.Token})
 	})
 
-	t.Run("boundary in memory auth token check errors", func(t *testing.T) {
+	t.Run("threshold in memory auth token check errors", func(t *testing.T) {
 		require.NoError(t, r.AddRawToken(ctx, boundaryAddr, at1a.Token))
 		require.NoError(t, r.AddRawToken(ctx, boundaryAddr, at1b.Token))
 
@@ -368,7 +368,7 @@ func TestCleanAndPickTokens(t *testing.T) {
 		assert.ElementsMatch(t, maps.Values(got), []string{at1a.Token})
 	})
 
-	t.Run("boundary keyring auths token check errors", func(t *testing.T) {
+	t.Run("threshold keyring auths token check errors", func(t *testing.T) {
 		key1 := ringToken{"k1", "t1"}
 		atMap[key1] = keyringAuthToken1
 		require.NoError(t, r.AddKeyringToken(ctx, boundaryAddr, KeyringToken{

internal/clientcache/internal/cache/repository_refresh_token.go

@@ -23,7 +23,7 @@ var ErrRefreshNotSupported = stderrors.New("refresh tokens are not supported for
 type RefreshTokenValue string
 
 // sentinelNoRefreshToken is the value set in the refresh token table when
-// Boundary returns resources but no refresh tokens. The presence of this value
+// Threshold returns resources but no refresh tokens. The presence of this value
 // indicates that the boundary instance queried does not support refresh tokens.
 const sentinelNoRefreshToken RefreshTokenValue = "__no_refresh_token_supported__"
 

internal/clientcache/internal/cache/repository_token.go

@@ -37,7 +37,7 @@ func upsertUserAndAuthToken(ctx context.Context, reader db.Reader, writer db.Wri
 	case util.IsNil(at):
 		return errors.New(ctx, errors.InvalidParameter, op, "auth token is nil")
 	case bAddr == "":
-		return errors.New(ctx, errors.InvalidParameter, op, "boundary address is empty")
+		return errors.New(ctx, errors.InvalidParameter, op, "threshold address is empty")
 	case at.Id == "":
 		return errors.New(ctx, errors.InvalidParameter, op, "auth token id is empty")
 	case at.UserId == "":
@@ -114,15 +114,15 @@ func (r *Repository) AddRawToken(ctx context.Context, bAddr string, rawToken str
 	const op = "cache.(Repository).AddRawToken"
 	switch {
 	case rawToken == "":
-		return errors.New(ctx, errors.InvalidParameter, op, "boundary auth token is empty", errors.WithoutEvent())
+		return errors.New(ctx, errors.InvalidParameter, op, "threshold auth token is empty", errors.WithoutEvent())
 	case bAddr == "":
-		return errors.New(ctx, errors.InvalidParameter, op, "boundary address is empty", errors.WithoutEvent())
+		return errors.New(ctx, errors.InvalidParameter, op, "threshold address is empty", errors.WithoutEvent())
 	}
 
 	// rawToken should look something like at_1234567890_someencryptedpayload
 	atIdParts := strings.SplitN(rawToken, "_", 4)
 	if len(atIdParts) != 3 {
-		return errors.New(ctx, errors.InvalidParameter, op, "boundary auth token is is malformed", errors.WithoutEvent())
+		return errors.New(ctx, errors.InvalidParameter, op, "threshold auth token is is malformed", errors.WithoutEvent())
 	}
 	atId := strings.Join(atIdParts[:AuthTokenIdSegmentCount], "_")
 
@@ -192,9 +192,9 @@ func (r *Repository) AddKeyringToken(ctx context.Context, bAddr string, token Ke
 	case token.KeyringType == "":
 		return errors.New(ctx, errors.InvalidParameter, op, "keyring type is empty", errors.WithoutEvent())
 	case token.AuthTokenId == "":
-		return errors.New(ctx, errors.InvalidParameter, op, "boundary auth token id is empty", errors.WithoutEvent())
+		return errors.New(ctx, errors.InvalidParameter, op, "threshold auth token id is empty", errors.WithoutEvent())
 	case bAddr == "":
-		return errors.New(ctx, errors.InvalidParameter, op, "boundary address is empty", errors.WithoutEvent())
+		return errors.New(ctx, errors.InvalidParameter, op, "threshold address is empty", errors.WithoutEvent())
 	}
 	kt := token.clone()
 	keyringStoredAt, err := r.tokenKeyringFn(kt.KeyringType, kt.TokenName)

internal/clientcache/internal/cache/repository_token_test.go

@@ -103,7 +103,7 @@ func TestRepository_AddKeyringToken(t *testing.T) {
 				TokenName:   tokenName,
 				AuthTokenId: at.Id,
 			},
-			errorContains: "boundary address is empty",
+			errorContains: "threshold address is empty",
 		},
 		{
 			name: "missing token",
@@ -130,7 +130,7 @@ func TestRepository_AddKeyringToken(t *testing.T) {
 				KeyringType: keyring,
 				TokenName:   tokenName,
 			},
-			errorContains: "boundary auth token id is empty",
+			errorContains: "threshold auth token id is empty",
 		},
 		{
 			name: "unmatching auth token id",
@@ -218,7 +218,7 @@ func TestRepository_AddRawToken(t *testing.T) {
 		{
 			name:          "missing address",
 			rawAt:         at.Token,
-			errorContains: "boundary address is empty",
+			errorContains: "threshold address is empty",
 		},
 		{
 			name:          "missing token",
@@ -229,7 +229,7 @@ func TestRepository_AddRawToken(t *testing.T) {
 			name:          "malformed auth token",
 			addr:          "address",
 			rawAt:         fmt.Sprintf("%s_extraunderscore", at.Token),
-			errorContains: "boundary auth token is is malformed",
+			errorContains: "threshold auth token is is malformed",
 		},
 		{
 			name:          "not found in boundary",
@@ -1079,7 +1079,7 @@ func TestUpsertUserAndAuthToken(t *testing.T) {
 				writer:        txWriter,
 				addr:          "",
 				at:            defaultAt,
-				errorContains: "boundary address is empty",
+				errorContains: "threshold address is empty",
 			},
 			{
 				name:          "auth token is nil",

internal/clientcache/internal/daemon/search_handler.go

@@ -256,7 +256,7 @@ func toApiResult(sr *cache.SearchResult) *SearchResult {
 
 var errSearchNotSupported = &api.Error{
 	Kind:    "Unsupported Search Request",
-	Message: "The request is for a Boundary instance that doesn't support search. The Boundary instance must support refresh tokens for search to be supported.",
+	Message: "The request is for a Threshold instance that doesn't support search. The Threshold instance must support refresh tokens for search to be supported.",
 }
 
 func writeUnsupportedError(w http.ResponseWriter) {

internal/clientcache/internal/daemon/server.go

@@ -191,7 +191,7 @@ func defaultBoundaryTokenReader(ctx context.Context, cp ClientProvider) (cache.B
 		at, err := atClient.Read(ctx, atId)
 		if err != nil {
 			if api.ErrPermissionDenied.Is(err) {
-				return nil, errors.Wrap(ctx, err, op, errors.WithMsg("Failed to get auth token from Boundary"), errors.WithCode(errors.Forbidden), errors.WithoutEvent())
+				return nil, errors.Wrap(ctx, err, op, errors.WithMsg("Failed to get auth token from Threshold"), errors.WithCode(errors.Forbidden), errors.WithoutEvent())
 			}
 			return nil, errors.Wrap(ctx, err, op, errors.WithoutEvent())
 		}
@@ -360,7 +360,7 @@ func (s *CacheServer) printInfo(ctx context.Context) {
 	verInfo := version.Get()
 	if verInfo.Version != "" {
 		s.infoKeys = append(s.infoKeys, "version")
-		s.info["version"] = verInfo.FullVersionNumber(false)
+		s.info["version"] = verInfo.DisplayVersionNumber(false)
 	}
 	if verInfo.Revision != "" {
 		s.info["version sha"] = strings.Trim(verInfo.Revision, "'")
@@ -506,7 +506,7 @@ func setupEventing(ctx context.Context, logger hclog.Logger, serializationLock *
 
 // openStore will open the underlying store for the db. If no options are
 // provided, it will default to an on disk store using the user's home dir +
-// ".boundary/cache.db". If a url is provided, it will use that as the store.
+// ".threshold/cache.db". If a url is provided, it will use that as the store.
 // Supported options: WithUrl, WithLogger, WithHomeDir
 func openStore(ctx context.Context, opt ...Option) (*db.DB, error) {
 	const op = "daemon.openStore"
@@ -562,7 +562,7 @@ func defaultDbUrl(ctx context.Context, opt ...Option) (string, error) {
 			return "", errors.Wrap(ctx, err, op)
 		}
 	}
-	dotDir := filepath.Join(opts.withHomeDir, dotDirname)
+	dotDir := DotDirectory(opts.withHomeDir)
 	if err := os.MkdirAll(dotDir, 0o700); err != nil {
 		return "", errors.Wrap(ctx, err, op)
 	}
@@ -584,8 +584,25 @@ func defaultDbUrl(ctx context.Context, opt ...Option) (string, error) {
 	return fmt.Sprintf("%s%s", fileName, fkPragma), nil
 }
 
+// DotDirectory returns the path of the client cache dot directory inside the
+// given home directory. The Threshold directory is preferred; if it does not
+// exist but the legacy directory used by upstream HashiCorp Boundary does, the
+// legacy directory is used so existing state keeps being found.
+func DotDirectory(homeDir string) string {
+	preferred := filepath.Join(homeDir, dotDirname)
+	if _, err := os.Stat(preferred); err == nil {
+		return preferred
+	}
+	legacy := filepath.Join(homeDir, legacyDotDirname)
+	if fi, err := os.Stat(legacy); err == nil && fi.IsDir() {
+		return legacy
+	}
+	return preferred
+}
+
 const (
-	dotDirname = ".boundary"
+	dotDirname       = ".threshold"
+	legacyDotDirname = ".boundary"
 	dbFileName = "cache.db"
 	fkPragma   = "?_pragma=foreign_keys(1)"
 )

internal/clientcache/internal/daemon/status_handler.go

@@ -49,7 +49,7 @@ type BoundaryStatus struct {
 	Address string `json:"address,omitempty"`
 	// Whether the controller responses are supported by the cache
 	CacheSupport string `json:"cache_support,omitempty"`
-	// How long ago the Boundary instance was checked for cache compatibility
+	// How long ago the Threshold instance was checked for cache compatibility
 	LastSupportCheck time.Duration `json:"last_support_check,omitempty"`
 }
 
@@ -131,7 +131,7 @@ func toApiStatus(in *cache.Status, started time.Time, socketAddr, logLocation st
 		// sleeps.
 		Uptime:        time.Since(started.Round(0)),
 		SocketAddress: socketAddr,
-		Version:       version.Get().FullVersionNumber(true),
+		Version:       version.Get().DisplayVersionNumber(true),
 		LogLocation:   logLocation,
 	}
 

internal/cmd/base/base.go

@@ -72,16 +72,20 @@ const (
 	// maxLineLength is the maximum width of any line.
 	maxLineLength int = 78
 
-	envToken                             = "BOUNDARY_TOKEN"
+	envToken                             = "THRESHOLD_TOKEN"
-	EnvTokenName                         = "BOUNDARY_TOKEN_NAME"
+	EnvTokenName                         = "THRESHOLD_TOKEN_NAME"
-	EnvKeyringType                       = "BOUNDARY_KEYRING_TYPE"
+	EnvKeyringType                       = "THRESHOLD_KEYRING_TYPE"
-	envRecoveryConfig                    = "BOUNDARY_RECOVERY_CONFIG"
+	envRecoveryConfig                    = "THRESHOLD_RECOVERY_CONFIG"
-	envSkipCacheDaemon                   = "BOUNDARY_SKIP_CACHE_DAEMON"
+	envSkipCacheDaemon                   = "THRESHOLD_SKIP_CACHE_DAEMON"
-	envSkipClientAgent                   = "BOUNDARY_SKIP_CLIENT_AGENT"
+	envSkipClientAgent                   = "THRESHOLD_SKIP_CLIENT_AGENT"
-	EnvClientAgentPort                   = "BOUNDARY_CLIENT_AGENT_LISTENING_PORT"
+	EnvClientAgentPort                   = "THRESHOLD_CLIENT_AGENT_LISTENING_PORT"
-	EnvBoundaryClientAgentCliErrorOutput = "BOUNDARY_CLIENT_AGENT_CLI_ERROR_OUTPUT"
+	EnvBoundaryClientAgentCliErrorOutput = "THRESHOLD_CLIENT_AGENT_CLI_ERROR_OUTPUT"
 
-	StoredTokenName = "HashiCorp Boundary Auth Token"
+	// StoredTokenName is the name of the credential entry written to
+	// wincred/keychain keyrings. LegacyStoredTokenName is the name used by
+	// upstream HashiCorp Boundary; it is only read (and deleted on logout).
+	StoredTokenName       = "Threshold Auth Token"
+	LegacyStoredTokenName = "HashiCorp Boundary Auth Token"
 )
 
 // reRemoveWhitespace is a regular expression for stripping whitespace from
@@ -340,8 +344,8 @@ func (c *Command) Client(opt ...Option) (*api.Client, error) {
 		c.client.SetToken(token)
 
 	case api.Getenv(envToken) != "":
-		// Backwards compat: allow reading from existing BOUNDARY_TOKEN env var
+		// Backwards compat: allow reading from existing THRESHOLD_TOKEN env var
-		c.UI.Warn(`Direct usage of BOUNDARY_TOKEN env var is deprecated; please use "-token env://<env var name>" format, e.g. "-token env://BOUNDARY_TOKEN" to specify an env var to use.`)
+		c.UI.Warn(`Direct usage of THRESHOLD_TOKEN env var is deprecated; please use "-token env://<env var name>" format, e.g. "-token env://THRESHOLD_TOKEN" to specify an env var to use.`)
 		c.client.SetToken(api.Getenv(envToken))
 
 	case c.client.Token() == "" && strings.ToLower(c.FlagKeyringType) != "none":
@@ -393,7 +397,7 @@ func (c *Command) FlagSet(bit FlagSetBit) *FlagSets {
 				Target:     &c.FlagAddr,
 				EnvVar:     api.EnvBoundaryAddr,
 				Completion: complete.PredictAnything,
-				Usage:      "Addr of the Boundary controller, as a complete URL (e.g. https://boundary.example.com:9200).",
+				Usage:      "Addr of the Threshold controller, as a complete URL (e.g. https://threshold.example.com:9200).",
 			})
 
 			f.StringVar(&StringVar{
@@ -421,7 +425,7 @@ func (c *Command) FlagSet(bit FlagSetBit) *FlagSets {
 				EnvVar:     api.EnvBoundaryClientCert,
 				Completion: complete.PredictFiles("*"),
 				Usage: "Path on the local disk to a single PEM-encoded CA " +
-					"certificate to use for TLS authentication to the Boundary Controller. If " +
+					"certificate to use for TLS authentication to the Threshold Controller. If " +
 					"this flag is specified, -client-key is also required.",
 			})
 
@@ -439,7 +443,7 @@ func (c *Command) FlagSet(bit FlagSetBit) *FlagSets {
 				Target:     &c.flagTLSServerName,
 				EnvVar:     api.EnvBoundaryTLSServerName,
 				Completion: complete.PredictAnything,
-				Usage: "Name to use as the SNI host when connecting to the Boundary " +
+				Usage: "Name to use as the SNI host when connecting to the Threshold " +
 					"server via TLS.",
 			})
 
@@ -449,7 +453,7 @@ func (c *Command) FlagSet(bit FlagSetBit) *FlagSets {
 				EnvVar: api.EnvBoundaryTLSInsecure,
 				Usage: "Disable verification of TLS certificates. Using this option " +
 					"is highly discouraged as it decreases the security of data " +
-					"transmissions to and from the Boundary server.",
+					"transmissions to and from the Threshold server.",
 			})
 		}
 

internal/cmd/base/const.go

@@ -5,7 +5,7 @@ package base
 
 const (
 	// FlagNameAddr is the flag used in the base command to read in the
-	// address of the Boundary server.
+	// address of the Threshold server.
 	FlagNameAddr = "addr"
 	// FlagnameCACert is the flag used in the base command to read in the CA
 	// cert.
@@ -28,6 +28,6 @@ const (
 )
 
 const (
-	EnvBoundaryCLINoColor = `BOUNDARY_CLI_NO_COLOR`
+	EnvBoundaryCLINoColor = `THRESHOLD_CLI_NO_COLOR`
-	EnvBoundaryCLIFormat  = `BOUNDARY_CLI_FORMAT`
+	EnvBoundaryCLIFormat  = `THRESHOLD_CLI_FORMAT`
 )

internal/cmd/base/dev.go

@@ -350,7 +350,7 @@ func (b *Server) createInitialLdapAuthMethod(ctx context.Context, host string, p
 		scope.Global.String(),
 		ldap.WithUrls(ctx, u),
 		ldap.WithName(ctx, "Generated global scope initial ldap auth method"),
-		ldap.WithDescription(ctx, "Provides initial administrative and unprivileged authentication into Boundary"),
+		ldap.WithDescription(ctx, "Provides initial administrative and unprivileged authentication into Threshold"),
 		ldap.WithDiscoverDn(ctx),
 		ldap.WithUserDn(ctx, testdirectory.DefaultUserDN),
 		ldap.WithGroupDn(ctx, testdirectory.DefaultGroupDN),
@@ -602,7 +602,7 @@ func (b *Server) createInitialOidcAuthMethod(ctx context.Context) (*oidc.AuthMet
 		b.DevOidcSetup.clientId,
 		b.DevOidcSetup.clientSecret,
 		oidc.WithName("Generated global scope initial oidc auth method"),
-		oidc.WithDescription("Provides initial administrative and unprivileged authentication into Boundary"),
+		oidc.WithDescription("Provides initial administrative and unprivileged authentication into Threshold"),
 		oidc.WithIssuer(discoveryUrl),
 		oidc.WithApiUrl(b.DevOidcSetup.callbackUrl),
 		oidc.WithSigningAlgs(oidc.EdDSA),

internal/cmd/base/initial_resources.go

@@ -156,7 +156,7 @@ func (b *Server) CreateInitialPasswordAuthMethod(ctx context.Context) (*password
 	}
 	authMethod, err := password.NewAuthMethod(ctx, scope.Global.String(),
 		password.WithName("Generated global scope initial password auth method"),
-		password.WithDescription("Provides initial administrative and unprivileged authentication into Boundary"),
+		password.WithDescription("Provides initial administrative and unprivileged authentication into Threshold"),
 	)
 	if err != nil {
 		return nil, nil, fmt.Errorf("error creating new in memory auth method: %w", err)
@@ -355,7 +355,7 @@ func (b *Server) CreateInitialScopes(ctx context.Context, opt ...Option) (*iam.S
 	}
 	iamOpts := []iam.Option{
 		iam.WithName("Generated org scope"),
-		iam.WithDescription("Provides an initial org scope in Boundary"),
+		iam.WithDescription("Provides an initial org scope in Threshold"),
 		iam.WithRandomReader(b.SecureRandomReader),
 		iam.WithPublicId(b.DevOrgId),
 	}
@@ -381,7 +381,7 @@ func (b *Server) CreateInitialScopes(ctx context.Context, opt ...Option) (*iam.S
 	}
 	iamOpts = []iam.Option{
 		iam.WithName("Generated project scope"),
-		iam.WithDescription("Provides an initial project scope in Boundary"),
+		iam.WithDescription("Provides an initial project scope in Threshold"),
 		iam.WithRandomReader(b.SecureRandomReader),
 		iam.WithPublicId(b.DevProjectId),
 	}
@@ -430,7 +430,7 @@ func (b *Server) CreateInitialHostResources(ctx context.Context) (*static.HostCa
 	}
 	opts := []static.Option{
 		static.WithName("Generated host catalog"),
-		static.WithDescription("Provides an initial host catalog in Boundary"),
+		static.WithDescription("Provides an initial host catalog in Threshold"),
 		static.WithPublicId(b.DevHostCatalogId),
 	}
 	hc, err := static.NewHostCatalog(ctx, b.DevProjectId, opts...)
@@ -455,7 +455,7 @@ func (b *Server) CreateInitialHostResources(ctx context.Context) (*static.HostCa
 	}
 	opts = []static.Option{
 		static.WithName("Generated host"),
-		static.WithDescription("Provides an initial host in Boundary"),
+		static.WithDescription("Provides an initial host in Threshold"),
 		static.WithAddress(b.DevHostAddress),
 		static.WithPublicId(b.DevHostId),
 	}
@@ -478,7 +478,7 @@ func (b *Server) CreateInitialHostResources(ctx context.Context) (*static.HostCa
 	}
 	opts = []static.Option{
 		static.WithName("Generated host set"),
-		static.WithDescription("Provides an initial host set in Boundary"),
+		static.WithDescription("Provides an initial host set in Threshold"),
 		static.WithPublicId(b.DevHostSetId),
 	}
 	hs, err := static.NewHostSet(ctx, hc.PublicId, opts...)
@@ -515,8 +515,8 @@ func (b *Server) CreateInitialTargetWithAddress(ctx context.Context) (target.Tar
 		return nil, fmt.Errorf("failed to create target repository: %w", err)
 	}
 
-	// When this function is not called as part of boundary dev (eg: as part of
+	// When this function is not called as part of threshold dev (eg: as part of
-	// boundary database init or tests), generate random target ids.
+	// threshold database init or tests), generate random target ids.
 	if len(b.DevTargetId) == 0 {
 		b.DevTargetId, err = db.NewPublicId(ctx, globals.TcpTargetPrefix)
 		if err != nil {
@@ -531,7 +531,7 @@ func (b *Server) CreateInitialTargetWithAddress(ctx context.Context) (target.Tar
 	}
 	opts := []target.Option{
 		target.WithName("Generated target with a direct address"),
-		target.WithDescription("Provides an initial target using an address in Boundary"),
+		target.WithDescription("Provides an initial target using an address in Threshold"),
 		target.WithDefaultPort(uint32(b.DevTargetDefaultPort)),
 		target.WithSessionMaxSeconds(uint32(b.DevTargetSessionMaxSeconds)),
 		target.WithSessionConnectionLimit(int32(b.DevTargetSessionConnectionLimit)),
@@ -580,8 +580,8 @@ func (b *Server) CreateInitialTargetWithHostSources(ctx context.Context) (target
 		return nil, fmt.Errorf("failed to create target repository: %w", err)
 	}
 
-	// When this function is not called as part of boundary dev (eg: as part of
+	// When this function is not called as part of threshold dev (eg: as part of
-	// boundary database init or tests), generate random target ids.
+	// threshold database init or tests), generate random target ids.
 	if len(b.DevSecondaryTargetId) == 0 {
 		b.DevSecondaryTargetId, err = db.NewPublicId(ctx, globals.TcpTargetPrefix)
 		if err != nil {
@@ -594,7 +594,7 @@ func (b *Server) CreateInitialTargetWithHostSources(ctx context.Context) (target
 
 	opts := []target.Option{
 		target.WithName("Generated target using host sources"),
-		target.WithDescription("Provides a target using host sources in Boundary"),
+		target.WithDescription("Provides a target using host sources in Threshold"),
 		target.WithDefaultPort(uint32(b.DevTargetDefaultPort)),
 		target.WithSessionMaxSeconds(uint32(b.DevTargetSessionMaxSeconds)),
 		target.WithSessionConnectionLimit(int32(b.DevTargetSessionConnectionLimit)),
@@ -615,7 +615,7 @@ func (b *Server) CreateInitialTargetWithHostSources(ctx context.Context) (target
 }
 
 // Create targets that can be connected to using an alias. The three targets created are:
-//   - "postgres.boundary.dev": the Boundary dev postgres instance. Uses brokered credentials
+//   - "postgres.boundary.dev": the Threshold dev postgres instance. Uses brokered credentials
 //   - "www.hashicorp.com": a web target
 //   - "ssh.boundary.dev": A localhost ssh target
 func (b *Server) CreateInitialTargetsWithAlias(ctx context.Context) error {
@@ -668,7 +668,7 @@ func (b *Server) CreateInitialTargetsWithAlias(ctx context.Context) error {
 func (b *Server) createSshAliasTarget(ctx context.Context, targetRepo *target.Repository, aliasRepo *aliastar.Repository) error {
 	opts := []target.Option{
 		target.WithName("Generated localhost ssh target with an alias"),
-		target.WithDescription("Provides an initial localhost target to SSH to using an alias in Boundary"),
+		target.WithDescription("Provides an initial localhost target to SSH to using an alias in Threshold"),
 		target.WithDefaultPort(22),
 		target.WithSessionMaxSeconds(uint32(b.DevTargetSessionMaxSeconds)),
 		target.WithSessionConnectionLimit(int32(b.DevTargetSessionConnectionLimit)),
@@ -716,7 +716,7 @@ func (b *Server) createPostgresAliasTarget(ctx context.Context,
 
 	opts := []target.Option{
 		target.WithName("Generated local postgres target with alias"),
-		target.WithDescription(fmt.Sprintf("Provides a local postgres target using aliasing in Boundary. Connect using the flag `-dbname %s`", dbname)),
+		target.WithDescription(fmt.Sprintf("Provides a local postgres target using aliasing in Threshold. Connect using the flag `-dbname %s`", dbname)),
 		target.WithDefaultPort(uint32(port)),
 		target.WithAddress(host),
 		target.WithSessionMaxSeconds(uint32(b.DevTargetSessionMaxSeconds)),
@@ -779,7 +779,7 @@ func (b *Server) createWebTarget(ctx context.Context,
 ) error {
 	opts := []target.Option{
 		target.WithName("www.hashicorp.com"),
-		target.WithDescription("Provides an initial web target using an address in Boundary. Note: Only HTTPS is supported, as this target uses port 443. Alias names for web targets should match the URL for the target."),
+		target.WithDescription("Provides an initial web target using an address in Threshold. Note: Only HTTPS is supported, as this target uses port 443. Alias names for web targets should match the URL for the target."),
 		target.WithDefaultPort(443),
 		target.WithSessionMaxSeconds(5),
 		target.WithSessionConnectionLimit(int32(b.DevTargetSessionConnectionLimit)),

internal/cmd/base/internal/docker/supported.go

@@ -54,8 +54,8 @@ func startDbInDockerSupported(dialect string, opt ...Option) (cleanup func() err
 	switch dialect {
 	case "postgres", "pgx":
 		switch {
-		case api.Getenv("BOUNDARY_TESTING_PG_URL") != "":
+		case api.Getenv("THRESHOLD_TESTING_PG_URL") != "":
-			url = api.Getenv("BOUNDARY_TESTING_PG_URL")
+			url = api.Getenv("THRESHOLD_TESTING_PG_URL")
 			return func() error { return nil }, url, "", nil
 		case repository != "":
 			runOpts.Repository = repository

internal/cmd/base/internal/metric/build_info.go

@@ -20,12 +20,12 @@ const (
 )
 
 // buildInfoVec is a gauge metric whose value is always equal to 1 and whose
-// labels contain the current go version, git revision, and boundary version.
+// labels contain the current go version, git revision, and threshold version.
 var buildInfoVec = prometheus.NewGaugeVec(
 	prometheus.GaugeOpts{
 		Namespace: globals.MetricNamespace,
 		Name:      "build_info",
-		Help:      "Gauge with labels describing go version, git revision hash, and Boundary release version.",
+		Help:      "Gauge with labels describing go version, git revision hash, and Threshold release version.",
 	},
 	[]string{labelGoVersion, labelGitRevision, labelBoundaryVersion},
 )

internal/cmd/base/keyring.go

@@ -28,7 +28,11 @@ const (
 
 	DefaultTokenName = "default"
 	LoginCollection  = "login"
-	PassPrefix       = "HashiCorp_Boundary"
+	// PassPrefix is the prefix used for tokens stored in "pass"-style
+	// keyrings. LegacyPassPrefix is the value used by upstream HashiCorp
+	// Boundary; it is only read as a fallback and never written.
+	PassPrefix       = "Threshold"
+	LegacyPassPrefix = "HashiCorp_Boundary"
 )
 
 // ErrNoToken is returned when no matching token could be found in the keyring
@@ -125,11 +129,15 @@ func ReadTokenFromKeyring(ui cli.Ui, keyringType, tokenName string) (*authtokens
 
 	case WincredKeyring, KeychainKeyring:
 		token, err = zkeyring.Get(StoredTokenName, tokenName)
+		if err == zkeyring.ErrNotFound {
+			// Fall back to the entry name used by upstream HashiCorp Boundary
+			token, err = zkeyring.Get(LegacyStoredTokenName, tokenName)
+		}
 		if err != nil {
 			if err == zkeyring.ErrNotFound {
 				ui.Error("No saved credential found, continuing without")
 			} else {
-				ui.Warn("Token must be provided via BOUNDARY_TOKEN env var or -token flag. Reading the token can also be disabled via -keyring-type=none.")
+				ui.Warn("Token must be provided via THRESHOLD_TOKEN env var or -token flag. Reading the token can also be disabled via -keyring-type=none.")
 				return nil, fmt.Errorf("%s: error reading auth token from keyring: %w", op, err)
 			}
 		}
@@ -143,13 +151,26 @@ func ReadTokenFromKeyring(ui cli.Ui, keyringType, tokenName string) (*authtokens
 
 		kr, err := nkeyring.Open(krConfig)
 		if err != nil {
-			ui.Warn("Token must be provided via BOUNDARY_TOKEN env var or -token flag. Reading the token can also be disabled via -keyring-type=none.")
+			ui.Warn("Token must be provided via THRESHOLD_TOKEN env var or -token flag. Reading the token can also be disabled via -keyring-type=none.")
 			return nil, fmt.Errorf("%s: failed to open keyring: %w", op, err)
 		}
 
 		item, err := kr.Get(tokenName)
 		if err != nil {
-			ui.Warn("Token must be provided via BOUNDARY_TOKEN env var or -token flag. Reading the token can also be disabled via -keyring-type=none.")
+			// Fall back to the keyring prefix used by upstream HashiCorp Boundary
+			legacyKr, legacyErr := nkeyring.Open(nkeyring.Config{
+				LibSecretCollectionName: LoginCollection,
+				PassPrefix:              LegacyPassPrefix,
+				AllowedBackends:         []nkeyring.BackendType{nkeyring.BackendType(keyringType)},
+			})
+			if legacyErr == nil {
+				if legacyItem, getErr := legacyKr.Get(tokenName); getErr == nil {
+					item, err = legacyItem, nil
+				}
+			}
+		}
+		if err != nil {
+			ui.Warn("Token must be provided via THRESHOLD_TOKEN env var or -token flag. Reading the token can also be disabled via -keyring-type=none.")
 			return nil, fmt.Errorf("%s: failed to get token from keyring: %w", op, err)
 		}
 

internal/cmd/base/logging/logging.go

@@ -67,7 +67,7 @@ func ParseLogFormat(format string) (LogFormat, error) {
 
 // ParseEnvLogFormat parses the log format from an environment variable.
 func ParseEnvLogFormat() LogFormat {
-	logFormat := api.Getenv("BOUNDARY_LOG_FORMAT")
+	logFormat := api.Getenv("THRESHOLD_LOG_FORMAT")
 	switch strings.ToLower(logFormat) {
 	case "json":
 		return JSONFormat

internal/cmd/base/option.go

@@ -192,7 +192,7 @@ func WithStatusCode(statusCode int) Option {
 }
 
 // WithDatabaseTemplate allows for using an existing database template for
-// initializing the boundary database.
+// initializing the threshold database.
 func WithDatabaseTemplate(template string) Option {
 	return func(o *Options) {
 		o.withDatabaseTemplate = template

internal/cmd/base/servers.go

@@ -285,7 +285,7 @@ func (b *Server) SetupLogging(flagLogLevel, flagLogFormat, configLogLevel, confi
 
 	// create GRPC logger
 	namedGRPCLogFaker := b.Logger.Named("grpclogfaker")
-	grpcLogFaker.SetLogOnOff(api.Getenv("BOUNDARY_GRPC_LOGGING") != "")
+	grpcLogFaker.SetLogOnOff(api.Getenv("THRESHOLD_GRPC_LOGGING") != "")
 	grpcLogFaker.SetLogger(namedGRPCLogFaker)
 
 	b.Info["log level"] = logLevel.String()
@@ -385,7 +385,7 @@ func (b *Server) PrintInfo(ui cli.Ui) {
 	verInfo := version.Get()
 	if verInfo.Version != "" {
 		b.InfoKeys = append(b.InfoKeys, "version")
-		b.Info["version"] = verInfo.FullVersionNumber(false)
+		b.Info["version"] = verInfo.DisplayVersionNumber(false)
 	}
 	if verInfo.Revision != "" {
 		b.Info["version sha"] = strings.Trim(verInfo.Revision, "'")
@@ -406,7 +406,7 @@ func (b *Server) PrintInfo(ui cli.Ui) {
 		}
 	}
 	sort.Strings(b.InfoKeys)
-	ui.Output("==> Boundary server configuration:\n")
+	ui.Output("==> Threshold server configuration:\n")
 	for _, k := range b.InfoKeys {
 		ui.Output(fmt.Sprintf(
 			"%s%s: %s",
@@ -418,7 +418,7 @@ func (b *Server) PrintInfo(ui cli.Ui) {
 
 	// Output the header that the server has started
 	if !b.CombineLogs {
-		ui.Output("==> Boundary server started! Log data will stream in below:\n")
+		ui.Output("==> Threshold server started! Log data will stream in below:\n")
 	}
 }
 
@@ -761,7 +761,7 @@ func (b *Server) OpenDatabase(ctx context.Context, dialect, url string) (*db.DB,
 		db.WithMaxIdleConnections(b.DatabaseMaxIdleConnections),
 		db.WithConnMaxIdleTimeDuration(b.DatabaseConnMaxIdleTimeDuration),
 	}
-	if api.Getenv("BOUNDARY_DISABLE_GORM_FORMATTER") == "" {
+	if api.Getenv("THRESHOLD_DISABLE_GORM_FORMATTER") == "" {
 		opts = append(opts, db.WithGormFormatter(b.Logger))
 	}
 

internal/cmd/commands/accountscmd/accounts.gen.go

@@ -153,7 +153,7 @@ func (c *Command) Run(args []string) int {
 
 		case "list":
 			if c.FlagAuthMethodId == "" {
-				c.PrintCliError(errors.New("AuthMethod ID must be passed in via -auth-method-id or BOUNDARY_AUTH_METHOD_ID"))
+				c.PrintCliError(errors.New("AuthMethod ID must be passed in via -auth-method-id or THRESHOLD_AUTH_METHOD_ID"))
 				return base.CommandUserError
 			}
 

internal/cmd/commands/accountscmd/funcs.go

@@ -57,37 +57,37 @@ func (c *Command) extraHelpFunc(helpMap map[string]func() string) string {
 	switch c.Func {
 	case "":
 		return base.WrapForHelpText([]string{
-			"Usage: boundary accounts [sub command] [options] [args]",
+			"Usage: threshold accounts [sub command] [options] [args]",
 			"",
-			"  This command allows operations on Boundary account resources. Example:",
+			"  This command allows operations on Threshold account resources. Example:",
 			"",
 			"    Read a account:",
 			"",
-			`      $ boundary accounts read -id acctpw_1234567890`,
+			`      $ threshold accounts read -id acctpw_1234567890`,
 			"",
 			"  Please see the accounts subcommand help for detailed usage information.",
 		})
 	case "change-password":
 		helpStr = base.WrapForHelpText([]string{
-			"Usage: boundary accounts change-password [options] [args]",
+			"Usage: threshold accounts change-password [options] [args]",
 			"",
 			"  This command allows changing the password (with verification of the current password) on account-type resources, if the types match and the operation is allowed by the given account type. Example:",
 			"",
 			"    Change the password on a password-type account:",
 			"",
-			`      $ boundary accounts change-password -id acctpw_1234567890 -current-password <empty, to be read by stdin> -new-password <empty, to be read by stdin>`,
+			`      $ threshold accounts change-password -id acctpw_1234567890 -current-password <empty, to be read by stdin> -new-password <empty, to be read by stdin>`,
 			"",
 			"",
 		})
 	case "set-password":
 		helpStr = base.WrapForHelpText([]string{
-			"Usage: boundary accounts set-password [options] [args]",
+			"Usage: threshold accounts set-password [options] [args]",
 			"",
 			"  This command allows setting the password on account-type resources, if the types match and the operation is allowed by the given account type. Example:",
 			"",
 			"    Set the password on a password-type account:",
 			"",
-			`      $ boundary accounts set-password -id acctpw_1234567890 -password <empty, to be read by stdin>`,
+			`      $ threshold accounts set-password -id acctpw_1234567890 -password <empty, to be read by stdin>`,
 			"",
 			"",
 		})

internal/cmd/commands/accountscmd/ldap_accounts.gen.go

@@ -137,7 +137,7 @@ func (c *LdapCommand) Run(args []string) int {
 
 		case "create":
 			if c.FlagAuthMethodId == "" {
-				c.PrintCliError(errors.New("AuthMethod ID must be passed in via -auth-method-id or BOUNDARY_AUTH_METHOD_ID"))
+				c.PrintCliError(errors.New("AuthMethod ID must be passed in via -auth-method-id or THRESHOLD_AUTH_METHOD_ID"))
 				return base.CommandUserError
 			}
 

internal/cmd/commands/accountscmd/ldap_funcs.go

@@ -33,22 +33,22 @@ func (c *LdapCommand) extraLdapHelpFunc(helpMap map[string]func() string) string
 	switch c.Func {
 	case "create":
 		helpStr = base.WrapForHelpText([]string{
-			"Usage: boundary accounts create ldap [options] [args]",
+			"Usage: threshold accounts create ldap [options] [args]",
 			"",
 			"  Create an ldap-type account. Example:",
 			"",
-			`    $ boundary accounts create ldap -login-name prodops -description "ldap account for ProdOps"`,
+			`    $ threshold accounts create ldap -login-name prodops -description "ldap account for ProdOps"`,
 			"",
 			"",
 		})
 
 	case "update":
 		helpStr = base.WrapForHelpText([]string{
-			"Usage: boundary accounts update ldap [options] [args]",
+			"Usage: threshold accounts update ldap [options] [args]",
 			"",
 			"  Update an ldap-type account given its ID. Example:",
 			"",
-			`    $ boundary accounts update ldap -id acctldap_1234567890 -name "devops" -description "ldap account for DevOps"`,
+			`    $ threshold accounts update ldap -id acctldap_1234567890 -name "devops" -description "ldap account for DevOps"`,
 			"",
 			"",
 		})

internal/cmd/commands/accountscmd/oidc_accounts.gen.go

@@ -137,7 +137,7 @@ func (c *OidcCommand) Run(args []string) int {
 
 		case "create":
 			if c.FlagAuthMethodId == "" {
-				c.PrintCliError(errors.New("AuthMethod ID must be passed in via -auth-method-id or BOUNDARY_AUTH_METHOD_ID"))
+				c.PrintCliError(errors.New("AuthMethod ID must be passed in via -auth-method-id or THRESHOLD_AUTH_METHOD_ID"))
 				return base.CommandUserError
 			}
 

internal/cmd/commands/accountscmd/oidc_funcs.go

@@ -35,22 +35,22 @@ func (c *OidcCommand) extraOidcHelpFunc(helpMap map[string]func() string) string
 	switch c.Func {
 	case "create":
 		helpStr = base.WrapForHelpText([]string{
-			"Usage: boundary accounts create oidc [options] [args]",
+			"Usage: threshold accounts create oidc [options] [args]",
 			"",
 			"  Create a oidc-type account. Example:",
 			"",
-			`    $ boundary accounts create oidc -subject "prodops" -description "Oidc account for ProdOps"`,
+			`    $ threshold accounts create oidc -subject "prodops" -description "Oidc account for ProdOps"`,
 			"",
 			"",
 		})
 
 	case "update":
 		helpStr = base.WrapForHelpText([]string{
-			"Usage: boundary accounts update oidc [options] [args]",
+			"Usage: threshold accounts update oidc [options] [args]",
 			"",
 			"  Update a oidc-type account given its ID. Example:",
 			"",
-			`    $ boundary accounts update oidc -id acctoidc_1234567890 -name "devops" -description "Oidc account for DevOps"`,
+			`    $ threshold accounts update oidc -id acctoidc_1234567890 -name "devops" -description "Oidc account for DevOps"`,
 			"",
 			"",
 		})

internal/cmd/commands/accountscmd/password_accounts.gen.go

@@ -137,7 +137,7 @@ func (c *PasswordCommand) Run(args []string) int {
 
 		case "create":
 			if c.FlagAuthMethodId == "" {
-				c.PrintCliError(errors.New("AuthMethod ID must be passed in via -auth-method-id or BOUNDARY_AUTH_METHOD_ID"))
+				c.PrintCliError(errors.New("AuthMethod ID must be passed in via -auth-method-id or THRESHOLD_AUTH_METHOD_ID"))
 				return base.CommandUserError
 			}
 

internal/cmd/commands/accountscmd/password_funcs.go

@@ -39,22 +39,22 @@ func (c *PasswordCommand) extraPasswordHelpFunc(helpMap map[string]func() string
 	switch c.Func {
 	case "create":
 		helpStr = base.WrapForHelpText([]string{
-			"Usage: boundary accounts create password [options] [args]",
+			"Usage: threshold accounts create password [options] [args]",
 			"",
 			"  Create a password-type account. Example:",
 			"",
-			`    $ boundary accounts create password -login-name prodops -description "Password account for ProdOps"`,
+			`    $ threshold accounts create password -login-name prodops -description "Password account for ProdOps"`,
 			"",
 			"",
 		})
 
 	case "update":
 		helpStr = base.WrapForHelpText([]string{
-			"Usage: boundary accounts update password [options] [args]",
+			"Usage: threshold accounts update password [options] [args]",
 			"",
 			"  Update a password-type account given its ID. Example:",
 			"",
-			`    $ boundary accounts update password -id acctpw_1234567890 -name "devops" -description "Password account for DevOps"`,
+			`    $ threshold accounts update password -id acctpw_1234567890 -name "devops" -description "Password account for DevOps"`,
 			"",
 			"",
 		})

internal/cmd/commands/aliasescmd/aliases.gen.go

@@ -151,7 +151,7 @@ func (c *Command) Run(args []string) int {
 
 		case "list":
 			if c.FlagScopeId == "" {
-				c.PrintCliError(errors.New("Scope ID must be passed in via -scope-id or BOUNDARY_SCOPE_ID"))
+				c.PrintCliError(errors.New("Scope ID must be passed in via -scope-id or THRESHOLD_SCOPE_ID"))
 				return base.CommandUserError
 			}
 

internal/cmd/commands/aliasescmd/funcs.go

@@ -17,33 +17,33 @@ func (c *Command) extraHelpFunc(helpMap map[string]func() string) string {
 	switch c.Func {
 	case "":
 		return base.WrapForHelpText([]string{
-			"Usage: boundary aliases [sub command] [options] [args]",
+			"Usage: threshold aliases [sub command] [options] [args]",
 			"",
-			"  This command allows operations on Boundary alias resources. Example:",
+			"  This command allows operations on Threshold alias resources. Example:",
 			"",
 			"    Read an alias:",
 			"",
-			`      $ boundary aliases read -id alt_1234567890`,
+			`      $ threshold aliases read -id alt_1234567890`,
 			"",
 			"  Please see the aliases subcommand help for detailed usage information.",
 		})
 	case "create":
 		helpStr = base.WrapForHelpText([]string{
-			"Usage: boundary aliases create target [options] [args]",
+			"Usage: threshold aliases create target [options] [args]",
 			"",
 			"  Create an alias. Example:",
 			"",
-			`    $ boundary aliases create target -value prod-ops.example -name prodops -description "Target alias for ProdOps"`,
+			`    $ threshold aliases create target -value prod-ops.example -name prodops -description "Target alias for ProdOps"`,
 			"",
 			"  Please see the typed subcommand help for detailed usage information.",
 		})
 	case "update":
 		helpStr = base.WrapForHelpText([]string{
-			"Usage: boundary aliases update target [options] [args]",
+			"Usage: threshold aliases update target [options] [args]",
 			"",
 			"  Update an alias. Example:",
 			"",
-			`    $ boundary aliases update target -id alt_1234567890 -name devops`,
+			`    $ threshold aliases update target -id alt_1234567890 -name devops`,
 			"",
 			"  Please see the typed subcommand help for detailed usage information.",
 		})

internal/cmd/commands/aliasescmd/target_aliases.gen.go

@@ -137,7 +137,7 @@ func (c *TargetCommand) Run(args []string) int {
 
 		case "create":
 			if c.FlagScopeId == "" {
-				c.PrintCliError(errors.New("Scope ID must be passed in via -scope-id or BOUNDARY_SCOPE_ID"))
+				c.PrintCliError(errors.New("Scope ID must be passed in via -scope-id or THRESHOLD_SCOPE_ID"))
 				return base.CommandUserError
 			}
 

internal/cmd/commands/aliasescmd/target_funcs.go

@@ -32,33 +32,33 @@ func (c *TargetCommand) extraTargetHelpFunc(helpMap map[string]func() string) st
 	switch c.Func {
 	case "":
 		return base.WrapForHelpText([]string{
-			"Usage: boundary aliases [sub command] [options] [args]",
+			"Usage: threshold aliases [sub command] [options] [args]",
 			"",
-			"  This command allows operations on Boundary alias resources. Example:",
+			"  This command allows operations on Threshold alias resources. Example:",
 			"",
 			"    Read an alias:",
 			"",
-			`      $ boundary aliases read -id alt_1234567890`,
+			`      $ threshold aliases read -id alt_1234567890`,
 			"",
 			"  Please see the aliases subcommand help for detailed usage information.",
 		})
 	case "create":
 		helpStr = base.WrapForHelpText([]string{
-			"Usage: boundary aliases create target [options] [args]",
+			"Usage: threshold aliases create target [options] [args]",
 			"",
 			"  Create a target-type alias. Example:",
 			"",
-			`    $ boundary aliases create target -value prod-ops.example -name prodops -description "Target alias for ProdOps"`,
+			`    $ threshold aliases create target -value prod-ops.example -name prodops -description "Target alias for ProdOps"`,
 			"",
 			"",
 		})
 	case "update":
 		helpStr = base.WrapForHelpText([]string{
-			"Usage: boundary aliases update target [options] [args]",
+			"Usage: threshold aliases update target [options] [args]",
 			"",
 			"  Update an alias. Example:",
 			"",
-			`    $ boundary aliases update target -id alt_1234567890 -name devops`,
+			`    $ threshold aliases update target -id alt_1234567890 -name devops`,
 			"",
 			"",
 		})

internal/cmd/commands/authenticate/authenticate.go

@@ -28,29 +28,29 @@ func (c *Command) Synopsis() string {
 
 func (c *Command) Help() string {
 	return base.WrapForHelpText([]string{
-		"Usage: boundary authenticate [sub command] [options] [args]",
+		"Usage: threshold authenticate [sub command] [options] [args]",
 		"",
-		"  This command authenticates the Boundary commandline client using a specified auth method. Examples:",
+		"  This command authenticates the Threshold commandline client using a specified auth method. Examples:",
 		"",
 		"    Authenticate with the primary auth method in the global scope:",
 		"",
-		"      $ boundary authenticate",
+		"      $ threshold authenticate",
 		"",
 		"    Authenticate using the primary auth method in a specific scope",
 		"",
-		"      $ boundary authenticate password -scope-id o_1234567890",
+		"      $ threshold authenticate password -scope-id o_1234567890",
 		"",
 		"    Authenticate with a password auth method using a specific auth method ID:",
 		"",
-		"      $ boundary authenticate password -auth-method-id ampw_1234567890",
+		"      $ threshold authenticate password -auth-method-id ampw_1234567890",
 		"",
 		"    Authenticate with an OIDC auth method using a specific auth method ID:",
 		"",
-		"      $ boundary authenticate oidc -auth-method-id amoidc_1234567890",
+		"      $ threshold authenticate oidc -auth-method-id amoidc_1234567890",
 		"",
 		"    Authenticate with an LDAP auth method:",
 		"",
-		"      $ boundary authenticate ldap -auth-method-id amldap_1234567890",
+		"      $ threshold authenticate ldap -auth-method-id amldap_1234567890",
 		"",
 		"  Please see the auth method subcommand help for detailed usage information.",
 	}) + c.Flags().Help()
@@ -62,7 +62,7 @@ func (c *Command) Flags() *base.FlagSets {
 
 	f.StringVar(&base.StringVar{
 		Name:   "scope-id",
-		EnvVar: "BOUNDARY_SCOPE_ID",
+		EnvVar: "THRESHOLD_SCOPE_ID",
 		Target: &c.FlagScopeId,
 		Usage:  "The scope to use for the operation",
 	})
@@ -95,7 +95,7 @@ func (c *Command) Run(args []string) int {
 	aClient := authmethods.NewClient(client)
 	pri, err := getPrimaryAuthMethodId(c.Context, aClient, scope.Global.String(), "")
 	if err != nil {
-		c.PrintCliError(errors.New("Error looking up primary auth method ID for the global scope. Try setting a primary auth method for the global scope, or use an auth method subcommand (see 'boundary authenticate -h' for available sub command usage)."))
+		c.PrintCliError(errors.New("Error looking up primary auth method ID for the global scope. Try setting a primary auth method for the global scope, or use an auth method subcommand (see 'threshold authenticate -h' for available sub command usage)."))
 		return base.CommandUserError
 	}
 

internal/cmd/commands/authenticate/funcs.go

@@ -71,7 +71,7 @@ func saveAndOrPrintToken(c *base.Command, result *authmethods.AuthenticateResult
 			default:
 				krConfig := nkeyring.Config{
 					LibSecretCollectionName: "login",
-					PassPrefix:              "HashiCorp_Boundary",
+					PassPrefix:              base.PassPrefix,
 					AllowedBackends:         []nkeyring.BackendType{nkeyring.BackendType(keyringType)},
 				}
 
@@ -100,7 +100,7 @@ func saveAndOrPrintToken(c *base.Command, result *authmethods.AuthenticateResult
 
 	switch {
 	case gotErr:
-		c.UI.Warn(fmt.Sprintf("The token was not successfully saved to a system keyring. The token is:\n\n%s\n\nIt must be manually passed in via the BOUNDARY_TOKEN env var or -token flag. Storing the token can also be disabled via -keyring-type=none.", token.Token))
+		c.UI.Warn(fmt.Sprintf("The token was not successfully saved to a system keyring. The token is:\n\n%s\n\nIt must be manually passed in via the THRESHOLD_TOKEN env var or -token flag. Storing the token can also be disabled via -keyring-type=none.", token.Token))
 	case c.FlagKeyringType == "none":
 		c.UI.Warn("\nStoring the token in a keyring was disabled. The token is:")
 		c.UI.Output(token.Token)
@@ -124,11 +124,11 @@ func getPrimaryAuthMethodId(ctx context.Context, client *authmethods.Client, sco
 	for _, m := range authMethodListResult.GetItems() {
 		if m.IsPrimary {
 			if !strings.HasPrefix(m.Id, amType) {
-				return "", fmt.Errorf("Error looking up primary auth method in scope '%s': got '%s' but the command requires an auth method prefix of '%s'. Make sure the sub command you're using matches the primary auth method type in the scope being used. For example, if using the password sub command the primary auth method must have a prefix of 'ampw'.\n\nSee 'boundary authenticate -h' for available sub command usage.", scopeId, m.Id, amType)
+				return "", fmt.Errorf("Error looking up primary auth method in scope '%s': got '%s' but the command requires an auth method prefix of '%s'. Make sure the sub command you're using matches the primary auth method type in the scope being used. For example, if using the password sub command the primary auth method must have a prefix of 'ampw'.\n\nSee 'threshold authenticate -h' for available sub command usage.", scopeId, m.Id, amType)
 			}
 
 			return m.Id, nil
 		}
 	}
-	return "", fmt.Errorf("Primary auth method not found for scope ID: '%s'. Please set a primary auth method on this scope or pass one explicitly using an authenticate sub command (see 'boundary authenticate -h') along with the -auth-method-id flag.", scopeId)
+	return "", fmt.Errorf("Primary auth method not found for scope ID: '%s'. Please set a primary auth method on this scope or pass one explicitly using an authenticate sub command (see 'threshold authenticate -h') along with the -auth-method-id flag.", scopeId)
 }

internal/cmd/commands/authenticate/ldap.go

@@ -35,16 +35,16 @@ type LdapCommand struct {
 }
 
 func (c *LdapCommand) Synopsis() string {
-	return wordwrap.WrapString("Invoke the ldap auth method to authenticate with Boundary", base.TermWidth)
+	return wordwrap.WrapString("Invoke the ldap auth method to authenticate with Threshold", base.TermWidth)
 }
 
 func (c *LdapCommand) Help() string {
 	return base.WrapForHelpText([]string{
-		"Usage: boundary authenticate ldap [options] [args]",
+		"Usage: threshold authenticate ldap [options] [args]",
 		"",
-		"  Invoke the ldap auth method to authenticate the Boundary CLI. Example:",
+		"  Invoke the ldap auth method to authenticate the Threshold CLI. Example:",
 		"",
-		`    $ boundary authenticate ldap -auth-method-id amldap_1234567890 -login-name foo`,
+		`    $ threshold authenticate ldap -auth-method-id amldap_1234567890 -login-name foo`,
 		"",
 		"",
 	}) + c.Flags().Help()
@@ -70,7 +70,7 @@ func (c *LdapCommand) Flags() *base.FlagSets {
 
 	f.StringVar(&base.StringVar{
 		Name:   "auth-method-id",
-		EnvVar: "BOUNDARY_AUTH_METHOD_ID",
+		EnvVar: "THRESHOLD_AUTH_METHOD_ID",
 		Target: &c.FlagAuthMethodId,
 		Usage:  "The auth-method resource to use for the operation.",
 	})
@@ -78,7 +78,7 @@ func (c *LdapCommand) Flags() *base.FlagSets {
 	if !c.parsedOpts.WithSkipScopeIdFlag {
 		f.StringVar(&base.StringVar{
 			Name:   "scope-id",
-			EnvVar: "BOUNDARY_SCOPE_ID",
+			EnvVar: "THRESHOLD_SCOPE_ID",
 			Target: &c.FlagScopeId,
 			Usage:  "The scope ID to use for the operation.",
 		})

internal/cmd/commands/authenticate/oidc.go

@@ -33,16 +33,16 @@ type OidcCommand struct {
 }
 
 func (c *OidcCommand) Synopsis() string {
-	return wordwrap.WrapString("Invoke the OIDC auth method to authenticate with Boundary", base.TermWidth)
+	return wordwrap.WrapString("Invoke the OIDC auth method to authenticate with Threshold", base.TermWidth)
 }
 
 func (c *OidcCommand) Help() string {
 	return base.WrapForHelpText([]string{
-		"Usage: boundary authenticate oidc [options] [args]",
+		"Usage: threshold authenticate oidc [options] [args]",
 		"",
-		"  Invoke the OIDC auth method to authenticate the Boundary CLI. Example:",
+		"  Invoke the OIDC auth method to authenticate the Threshold CLI. Example:",
 		"",
-		`    $ boundary authenticate oidc -auth-method-id amoidc_1234567890`,
+		`    $ threshold authenticate oidc -auth-method-id amoidc_1234567890`,
 		"",
 		"",
 	}) + c.Flags().Help()
@@ -54,7 +54,7 @@ func (c *OidcCommand) Flags() *base.FlagSets {
 
 	f.StringVar(&base.StringVar{
 		Name:   "auth-method-id",
-		EnvVar: "BOUNDARY_AUTH_METHOD_ID",
+		EnvVar: "THRESHOLD_AUTH_METHOD_ID",
 		Target: &c.FlagAuthMethodId,
 		Usage:  "The auth-method resource to use for the operation",
 	})
@@ -62,7 +62,7 @@ func (c *OidcCommand) Flags() *base.FlagSets {
 	if !c.parsedOpts.WithSkipScopeIdFlag {
 		f.StringVar(&base.StringVar{
 			Name:   "scope-id",
-			EnvVar: "BOUNDARY_SCOPE_ID",
+			EnvVar: "THRESHOLD_SCOPE_ID",
 			Target: &c.FlagScopeId,
 			Usage:  "The scope ID to use for the operation.",
 		})

internal/cmd/commands/authenticate/password.go

@@ -26,8 +26,8 @@ var (
 )
 
 var (
-	envPassword  = "BOUNDARY_AUTHENTICATE_PASSWORD_PASSWORD"
+	envPassword  = "THRESHOLD_AUTHENTICATE_PASSWORD_PASSWORD"
-	envLoginName = "BOUNDARY_AUTHENTICATE_PASSWORD_LOGIN_NAME"
+	envLoginName = "THRESHOLD_AUTHENTICATE_PASSWORD_LOGIN_NAME"
 )
 
 type PasswordCommand struct {
@@ -40,16 +40,16 @@ type PasswordCommand struct {
 }
 
 func (c *PasswordCommand) Synopsis() string {
-	return wordwrap.WrapString("Invoke the password auth method to authenticate with Boundary", base.TermWidth)
+	return wordwrap.WrapString("Invoke the password auth method to authenticate with Threshold", base.TermWidth)
 }
 
 func (c *PasswordCommand) Help() string {
 	return base.WrapForHelpText([]string{
-		"Usage: boundary authenticate password [options] [args]",
+		"Usage: threshold authenticate password [options] [args]",
 		"",
-		"  Invoke the password auth method to authenticate the Boundary CLI. Example:",
+		"  Invoke the password auth method to authenticate the Threshold CLI. Example:",
 		"",
-		`    $ boundary authenticate password -auth-method-id ampw_1234567890 -login-name foo`,
+		`    $ threshold authenticate password -auth-method-id ampw_1234567890 -login-name foo`,
 		"",
 		"",
 	}) + c.Flags().Help()
@@ -75,7 +75,7 @@ func (c *PasswordCommand) Flags() *base.FlagSets {
 
 	f.StringVar(&base.StringVar{
 		Name:   "auth-method-id",
-		EnvVar: "BOUNDARY_AUTH_METHOD_ID",
+		EnvVar: "THRESHOLD_AUTH_METHOD_ID",
 		Target: &c.FlagAuthMethodId,
 		Usage:  "The auth-method resource to use for the operation.",
 	})
@@ -83,7 +83,7 @@ func (c *PasswordCommand) Flags() *base.FlagSets {
 	if !c.parsedOpts.WithSkipScopeIdFlag {
 		f.StringVar(&base.StringVar{
 			Name:   "scope-id",
-			EnvVar: "BOUNDARY_SCOPE_ID",
+			EnvVar: "THRESHOLD_SCOPE_ID",
 			Target: &c.FlagScopeId,
 			Usage:  "The scope ID to use for the operation.",
 		})

internal/cmd/commands/authmethodscmd/authmethods.gen.go

@@ -151,7 +151,7 @@ func (c *Command) Run(args []string) int {
 
 		case "list":
 			if c.FlagScopeId == "" {
-				c.PrintCliError(errors.New("Scope ID must be passed in via -scope-id or BOUNDARY_SCOPE_ID"))
+				c.PrintCliError(errors.New("Scope ID must be passed in via -scope-id or THRESHOLD_SCOPE_ID"))
 				return base.CommandUserError
 			}
 

internal/cmd/commands/authmethodscmd/funcs.go

@@ -23,37 +23,37 @@ func (c *Command) extraHelpFunc(helpMap map[string]func() string) string {
 	switch c.Func {
 	case "":
 		return base.WrapForHelpText([]string{
-			"Usage: boundary auth-methods [sub command] [options] [args]",
+			"Usage: threshold auth-methods [sub command] [options] [args]",
 			"",
-			"  This command allows operations on Boundary auth method resources. Example:",
+			"  This command allows operations on Threshold auth method resources. Example:",
 			"",
 			"    Read an auth method:",
 			"",
-			`      $ boundary auth-methods read -id ampw_1234567890`,
+			`      $ threshold auth-methods read -id ampw_1234567890`,
 			"",
 			"  Please see the auth-methods subcommand help for detailed usage information.",
 		})
 	case "create":
 		helpStr = base.WrapForHelpText([]string{
-			"Usage: boundary auth-methods create [type] [sub command] [options] [args]",
+			"Usage: threshold auth-methods create [type] [sub command] [options] [args]",
 			"",
-			"  This command allows create operations on Boundary auth method resources. Example:",
+			"  This command allows create operations on Threshold auth method resources. Example:",
 			"",
 			"    Create a password-type auth method:",
 			"",
-			`      $ boundary auth-methods create password -name prodops -description "For ProdOps usage"`,
+			`      $ threshold auth-methods create password -name prodops -description "For ProdOps usage"`,
 			"",
 			"  Please see the typed subcommand help for detailed usage information.",
 		})
 	case "update":
 		helpStr = base.WrapForHelpText([]string{
-			"Usage: boundary auth-methods update [type] [sub command] [options] [args]",
+			"Usage: threshold auth-methods update [type] [sub command] [options] [args]",
 			"",
-			"  This command allows update operations on Boundary auth method resources. Example:",
+			"  This command allows update operations on Threshold auth method resources. Example:",
 			"",
 			"    Update a password-type auth method:",
 			"",
-			`      $ boundary auth-methods update password -id ampw_1234567890 -name devops -description "For DevOps usage"`,
+			`      $ threshold auth-methods update password -id ampw_1234567890 -name devops -description "For DevOps usage"`,
 			"",
 			"  Please see the typed subcommand help for detailed usage information.",
 		})

internal/cmd/commands/authmethodscmd/ldap_authmethods.gen.go

@@ -137,7 +137,7 @@ func (c *LdapCommand) Run(args []string) int {
 
 		case "create":
 			if c.FlagScopeId == "" {
-				c.PrintCliError(errors.New("Scope ID must be passed in via -scope-id or BOUNDARY_SCOPE_ID"))
+				c.PrintCliError(errors.New("Scope ID must be passed in via -scope-id or THRESHOLD_SCOPE_ID"))
 				return base.CommandUserError
 			}
 

internal/cmd/commands/authmethodscmd/ldap_funcs.go

@@ -258,22 +258,22 @@ func (c *LdapCommand) extraLdapHelpFunc(helpMap map[string]func() string) string
 	switch c.Func {
 	case "create":
 		helpStr = base.WrapForHelpText([]string{
-			"Usage: boundary auth-methods create ldap [options] [args]",
+			"Usage: threshold auth-methods create ldap [options] [args]",
 			"",
 			"  Create an ldap-type auth method. Example:",
 			"",
-			`    $ boundary auth-methods create ldap -name prodops -description "LDAP auth-method for ProdOps"`,
+			`    $ threshold auth-methods create ldap -name prodops -description "LDAP auth-method for ProdOps"`,
 			"",
 			"",
 		})
 
 	case "update":
 		helpStr = base.WrapForHelpText([]string{
-			"Usage: boundary auth-methods update ldap [options] [args]",
+			"Usage: threshold auth-methods update ldap [options] [args]",
 			"",
 			"  Update an ldap-type auth method given its ID. Example:",
 			"",
-			`    $ boundary auth-methods update ldap -id amldap_1234567890 -name "devops" -description "LDAP auth-method for DevOps"`,
+			`    $ threshold auth-methods update ldap -id amldap_1234567890 -name "devops" -description "LDAP auth-method for DevOps"`,
 			"",
 			"",
 		})

internal/cmd/commands/authmethodscmd/oidc_authmethods.gen.go

@@ -137,7 +137,7 @@ func (c *OidcCommand) Run(args []string) int {
 
 		case "create":
 			if c.FlagScopeId == "" {
-				c.PrintCliError(errors.New("Scope ID must be passed in via -scope-id or BOUNDARY_SCOPE_ID"))
+				c.PrintCliError(errors.New("Scope ID must be passed in via -scope-id or THRESHOLD_SCOPE_ID"))
 				return base.CommandUserError
 			}
 

internal/cmd/commands/authmethodscmd/oidc_funcs.go

@@ -142,7 +142,7 @@ func extraOidcFlagsFuncImpl(c *OidcCommand, set *base.FlagSets, _ *base.FlagSet)
 			f.StringSliceVar(&base.StringSliceVar{
 				Name:   accountClaimMaps,
 				Target: &c.flagAccountClaimMaps,
-				Usage:  `The optional account claim maps from custom claims to the standard claims of sub, name and email.  These maps are represented as key=value where the key equals the Provider from-claim and the value equals the Boundary to-claim.  For example "oid=sub". May be specified multiple times for different to-claims.`,
+				Usage:  `The optional account claim maps from custom claims to the standard claims of sub, name and email.  These maps are represented as key=value where the key equals the Provider from-claim and the value equals the Threshold to-claim.  For example "oid=sub". May be specified multiple times for different to-claims.`,
 			})
 		case stateFlagName:
 			f.StringVar(&base.StringVar{
@@ -177,32 +177,32 @@ func (c *OidcCommand) extraOidcHelpFunc(helpMap map[string]func() string) string
 	switch c.Func {
 	case "create":
 		helpStr = base.WrapForHelpText([]string{
-			"Usage: boundary auth-methods create oidc [options] [args]",
+			"Usage: threshold auth-methods create oidc [options] [args]",
 			"",
 			"  Create an oidc-type auth method. Example:",
 			"",
-			`    $ boundary auth-methods create oidc -name prodops -description "Oidc auth-method for ProdOps"`,
+			`    $ threshold auth-methods create oidc -name prodops -description "Oidc auth-method for ProdOps"`,
 			"",
 			"",
 		})
 
 	case "update":
 		helpStr = base.WrapForHelpText([]string{
-			"Usage: boundary auth-methods update oidc [options] [args]",
+			"Usage: threshold auth-methods update oidc [options] [args]",
 			"",
 			"  Update an oidc-type auth method given its ID. Example:",
 			"",
-			`    $ boundary auth-methods update oidc -id amoidc_1234567890 -name "devops" -description "Oidc auth-method for DevOps"`,
+			`    $ threshold auth-methods update oidc -id amoidc_1234567890 -name "devops" -description "Oidc auth-method for DevOps"`,
 			"",
 			"",
 		})
 	case "change-state":
 		helpStr = base.WrapForHelpText([]string{
-			"Usage: boundary auth-methods change-state oidc [options] [args]",
+			"Usage: threshold auth-methods change-state oidc [options] [args]",
 			"",
 			"  Change the active and visibility state of an oidc-type auth method given its ID. Example:",
 			"",
-			`    $ boundary auth-methods change-state oidc -id amoidc_1234567890 -state "public-active"`,
+			`    $ threshold auth-methods change-state oidc -id amoidc_1234567890 -state "public-active"`,
 			"",
 			"",
 		})

internal/cmd/commands/authmethodscmd/password_authmethods.gen.go

@@ -137,7 +137,7 @@ func (c *PasswordCommand) Run(args []string) int {
 
 		case "create":
 			if c.FlagScopeId == "" {
-				c.PrintCliError(errors.New("Scope ID must be passed in via -scope-id or BOUNDARY_SCOPE_ID"))
+				c.PrintCliError(errors.New("Scope ID must be passed in via -scope-id or THRESHOLD_SCOPE_ID"))
 				return base.CommandUserError
 			}
 

internal/cmd/commands/authmethodscmd/password_funcs.go

@@ -34,22 +34,22 @@ func (c *PasswordCommand) extraPasswordHelpFunc(helpMap map[string]func() string
 	switch c.Func {
 	case "create":
 		helpStr = base.WrapForHelpText([]string{
-			"Usage: boundary auth-methods create password [options] [args]",
+			"Usage: threshold auth-methods create password [options] [args]",
 			"",
 			"  Create a password-type auth method. Example:",
 			"",
-			`    $ boundary auth-methods create password -name prodops -description "Password auth-method for ProdOps"`,
+			`    $ threshold auth-methods create password -name prodops -description "Password auth-method for ProdOps"`,
 			"",
 			"",
 		})
 
 	case "update":
 		helpStr = base.WrapForHelpText([]string{
-			"Usage: boundary auth-methods update password [options] [args]",
+			"Usage: threshold auth-methods update password [options] [args]",
 			"",
 			"  Update a password-type auth method given its ID. Example:",
 			"",
-			`    $ boundary auth-methods update password -id ampw_1234567890 -name "devops" -description "Password auth-method for DevOps"`,
+			`    $ threshold auth-methods update password -id ampw_1234567890 -name "devops" -description "Password auth-method for DevOps"`,
 			"",
 			"",
 		})

internal/cmd/commands/authtokenscmd/authtokens.gen.go

@@ -146,7 +146,7 @@ func (c *Command) Run(args []string) int {
 
 		case "list":
 			if c.FlagScopeId == "" {
-				c.PrintCliError(errors.New("Scope ID must be passed in via -scope-id or BOUNDARY_SCOPE_ID"))
+				c.PrintCliError(errors.New("Scope ID must be passed in via -scope-id or THRESHOLD_SCOPE_ID"))
 				return base.CommandUserError
 			}
 

internal/cmd/commands/authtokenscmd/authtokens.go

@@ -10,13 +10,13 @@ func (c *Command) extraHelpFunc(helpMap map[string]func() string) string {
 	switch c.Func {
 	case "":
 		return base.WrapForHelpText([]string{
-			"Usage: boundary auth-tokens [sub command] [options] [args]",
+			"Usage: threshold auth-tokens [sub command] [options] [args]",
 			"",
-			"  This command allows operations on Boundary auth token resources. Example:",
+			"  This command allows operations on Threshold auth token resources. Example:",
 			"",
 			"    List all auth tokens:",
 			"",
-			`      $ boundary auth-tokens list -recursive `,
+			`      $ threshold auth-tokens list -recursive `,
 			"",
 			"  Please see the auth-tokens subcommand help for detailed usage information.",
 			"  Note: To create an auth token, see the authenticate subcommand.",

internal/cmd/commands/billingcmd/funcs.go

@@ -129,25 +129,25 @@ func (c *Command) extraHelpFunc(helpMap map[string]func() string) string {
 	switch c.Func {
 	case "":
 		helpStr = base.WrapForHelpText([]string{
-			"Usage: boundary billing [sub command] [options] [args]",
+			"Usage: threshold billing [sub command] [options] [args]",
 			"",
-			"  This command allows for collecting Boundary billing reports. Example:",
+			"  This command allows for collecting Threshold billing reports. Example:",
 			"",
 			"    Monthly active users:",
 			"",
-			`      $ boundary billing monthly-active-users`,
+			`      $ threshold billing monthly-active-users`,
 			"",
 			"  Please see the billing subcommand help for detailed usage information.",
 		})
 	case "monthly-active-users":
 		helpStr = base.WrapForHelpText([]string{
-			"Usage: boundary billing monthly-active-users [options]",
+			"Usage: threshold billing monthly-active-users [options]",
 			"",
-			"  This command allows for collecting active Boundary user reports, by month. Example:",
+			"  This command allows for collecting active Threshold user reports, by month. Example:",
 			"",
 			"    Monthly active users between September 2023 and February 2024:",
 			"",
-			`      $ boundary billing monthly-active-users -start-time="2023-09" -end-time="2024-02"`,
+			`      $ threshold billing monthly-active-users -start-time="2023-09" -end-time="2024-02"`,
 			"",
 			"  Please see the billing subcommand help for detailed usage information.",
 		})

internal/cmd/commands/clientagentcmd/clientagentcmd.go

@@ -22,27 +22,27 @@ type ClientAgentCommand struct {
 }
 
 func (c *ClientAgentCommand) Synopsis() string {
-	return "Manages the Boundary client agent"
+	return "Manages the Threshold client agent"
 }
 
 func (c *ClientAgentCommand) Help() string {
 	helpText := `
-Usage: boundary client-agent [sub command] [options]
+Usage: threshold client-agent [sub command] [options]
 
-  This command allows interacting with the Boundary client agent.
+  This command allows interacting with the Threshold client agent.
 
   Get the status of the agent:
 
-      $ boundary client-agent status
+      $ threshold client-agent status
 
   Pause and resume the agent:
 
-      $ boundary client-agent pause
+      $ threshold client-agent pause
-      $ boundary client-agent resume
+      $ threshold client-agent resume
 
   List active transparent sessions:
 
-      $ boundary client-agent sessions
+      $ threshold client-agent sessions
 
   For a full list of examples, please see the documentation.
 

internal/cmd/commands/clientagentcmd/pause.go

@@ -26,16 +26,16 @@ type PauseCommand struct {
 }
 
 func (c *PauseCommand) Synopsis() string {
-	return "Pauses the running boundary client agent"
+	return "Pauses the running threshold client agent"
 }
 
 func (c *PauseCommand) Help() string {
 	helpText := `
-Usage: boundary client-agent pause
+Usage: threshold client-agent pause
 
-  Pause the boundary client agent:
+  Pause the threshold client agent:
 
-      $ boundary client-agent pause
+      $ threshold client-agent pause
 
   For a full list of examples, please see the documentation.
 	

internal/cmd/commands/clientagentcmd/resume.go

@@ -26,16 +26,16 @@ type ResumeCommand struct {
 }
 
 func (c *ResumeCommand) Synopsis() string {
-	return "Resumes the paused boundary client agent"
+	return "Resumes the paused threshold client agent"
 }
 
 func (c *ResumeCommand) Help() string {
 	helpText := `
-Usage: boundary client-agent resume
+Usage: threshold client-agent resume
 
-  Resume the boundary client agent:
+  Resume the threshold client agent:
 
-      $ boundary client-agent resume
+      $ threshold client-agent resume
 
   For a full list of examples, please see the documentation.
 	

internal/cmd/commands/clientagentcmd/sessions.go

@@ -36,11 +36,11 @@ func (c *SessionsCommand) Synopsis() string {
 
 func (c *SessionsCommand) Help() string {
 	helpText := `
-Usage: boundary client-agent sessions [options]
+Usage: threshold client-agent sessions [options]
 
   List the active transparent sessions:
 
-      $ boundary client-agent sessions
+      $ threshold client-agent sessions
 
   For a full list of examples, please see the documentation.
 

internal/cmd/commands/clientagentcmd/status.go

@@ -27,16 +27,16 @@ type StatusCommand struct {
 }
 
 func (c *StatusCommand) Synopsis() string {
-	return "Get the status information of the running boundary client agent"
+	return "Get the status information of the running threshold client agent"
 }
 
 func (c *StatusCommand) Help() string {
 	helpText := `
-Usage: boundary client-agent status [options]
+Usage: threshold client-agent status [options]
 
-  Get the status of the boundary client agent:
+  Get the status of the threshold client agent:
 
-      $ boundary client-agent status
+      $ threshold client-agent status
 
   For a full list of examples, please see the documentation.
 

internal/cmd/commands/config/autocomplete.go

@@ -27,7 +27,7 @@ func (c *AutocompleteCommand) Synopsis() string {
 		verb = "Install or uninstall"
 	}
 
-	return fmt.Sprintf("%s autocompletion for Boundary's CLI", verb)
+	return fmt.Sprintf("%s autocompletion for Threshold's CLI", verb)
 }
 
 func (c *AutocompleteCommand) Help() string {
@@ -47,9 +47,9 @@ func (c *AutocompleteCommand) Help() string {
 		subcmd = " install"
 	}
 	return base.WrapForHelpText([]string{
-		fmt.Sprintf("Usage: boundary config autocomplete%s [options] [args]", subcmd),
+		fmt.Sprintf("Usage: threshold config autocomplete%s [options] [args]", subcmd),
 		"",
-		fmt.Sprintf("  This command %s autocompletion support for Boundary's CLI", verb),
+		fmt.Sprintf("  This command %s autocompletion support for Threshold's CLI", verb),
 	})
 }
 

internal/cmd/commands/config/config.go

@@ -20,21 +20,21 @@ func (c *Command) Synopsis() string {
 
 func (c *Command) Help() string {
 	return base.WrapForHelpText([]string{
-		"Usage: boundary config <subcommand> [options] [args]",
+		"Usage: threshold config <subcommand> [options] [args]",
 		"",
-		"  This command groups subcommands for operators interacting with Boundary's config files. Here are a few examples of config commands:",
+		"  This command groups subcommands for operators interacting with Threshold's config files. Here are a few examples of config commands:",
 		"",
 		"    Encrypt sensitive values in a config file:",
 		"",
-		"      $ boundary config encrypt config.hcl",
+		"      $ threshold config encrypt config.hcl",
 		"",
 		"    Decrypt sensitive values in a config file:",
 		"",
-		"      $ boundary config decrypt config.hcl",
+		"      $ threshold config decrypt config.hcl",
 		"",
 		"    Read a stored token out:",
 		"",
-		"      $ boundary config get-token",
+		"      $ threshold config get-token",
 		"",
 		"  Please see the individual subcommand help for detailed usage information.",
 	})

internal/cmd/commands/config/encryptdecrypt.go

@@ -39,21 +39,21 @@ type EncryptDecryptCommand struct {
 }
 
 func (c *EncryptDecryptCommand) Synopsis() string {
-	return fmt.Sprintf("%s sensitive values in Boundary's configuration file", textproto.CanonicalMIMEHeaderKey(c.Func))
+	return fmt.Sprintf("%s sensitive values in Threshold's configuration file", textproto.CanonicalMIMEHeaderKey(c.Func))
 }
 
 func (c *EncryptDecryptCommand) Help() string {
 	var args []string
 	args = append(args,
-		"Usage: boundary config {{func}} [options] [args]",
+		"Usage: threshold config {{func}} [options] [args]",
 		"",
-		"  {{upperfunc}} sensitive values in a Boundary's configuration file. These values must be marked with {{{{func}}()}} as appropriate. Example:",
+		"  {{upperfunc}} sensitive values in a Threshold's configuration file. These values must be marked with {{{{func}}()}} as appropriate. Example:",
 		"",
 		`    foo = "{{encrypt(bar)}}"`,
 		"",
 		"  By default this will print out the new configuration. To overwrite into the same file use the -overwrite flag.",
 		"",
-		"    $ boundary config {{func}} -overwrite config.hcl",
+		"    $ threshold config {{func}} -overwrite config.hcl",
 		"",
 		`  In order for this command to perform its task, a "kms" block must be defined within a configuration file. Example:`,
 		"",

internal/cmd/commands/config/token.go

@@ -36,17 +36,17 @@ func (c *TokenCommand) Help() string {
 	switch c.Func {
 	case "get-token":
 		args = append(args,
-			"Usage: boundary config get-token [options] [args]",
+			"Usage: threshold config get-token [options] [args]",
 			"",
-			"  Fetch a token stored by the Boundary CLI. Example:",
+			"  Fetch a token stored by the Threshold CLI. Example:",
 			"",
-			`    $ boundary config get-token`,
+			`    $ threshold config get-token`,
 			"",
-			"  This can be useful in various situations. For example, a line such as the following could be in a shell script shared by developers, such that each developer on their own machine executing the script ends up using their own Boundary token:",
+			"  This can be useful in various situations. For example, a line such as the following could be in a shell script shared by developers, such that each developer on their own machine executing the script ends up using their own Threshold token:",
 			"",
-			`    $ curl -H "Authorization: Bearer $(boundary config get-token)" -H "Content-Type: application/json" http://127.0.0.1:9200/v1/roles/r_1234567890`,
+			`    $ curl -H "Authorization: Bearer $(threshold config get-token)" -H "Content-Type: application/json" http://127.0.0.1:9200/v1/roles/r_1234567890`,
 			"",
-			"  Note that this command keeps parity with the behavior of other Boundary commands; if the BOUNDARY_TOKEN environment variable it set, it will override the value loaded from the system store. Not only does this keep parity, but it also allows examples such as the one above to work even if there is no stored token but if an environment variable is specified.",
+			"  Note that this command keeps parity with the behavior of other Threshold commands; if the THRESHOLD_TOKEN environment variable it set, it will override the value loaded from the system store. Not only does this keep parity, but it also allows examples such as the one above to work even if there is no stored token but if an environment variable is specified.",
 			"",
 		)
 	}

internal/cmd/commands/connect/cassandra.go

@@ -23,7 +23,7 @@ func cassandraOptions(c *Command, set *base.FlagSets) {
 	f.StringVar(&base.StringVar{
 		Name:       "style",
 		Target:     &c.flagCassandraStyle,
-		EnvVar:     "BOUNDARY_CONNECT_CASSANDRA_STYLE",
+		EnvVar:     "THRESHOLD_CONNECT_CASSANDRA_STYLE",
 		Completion: complete.PredictSet("cqlsh"),
 		Default:    "cqlsh",
 		Usage:      `Specifies how the CLI will attempt to invoke a Cassandra client. This will also set a suitable default for -exec if a value was not specified. Currently-understood values are "cqlsh".`,
@@ -32,7 +32,7 @@ func cassandraOptions(c *Command, set *base.FlagSets) {
 	f.StringVar(&base.StringVar{
 		Name:       "username",
 		Target:     &c.flagUsername,
-		EnvVar:     "BOUNDARY_CONNECT_USERNAME",
+		EnvVar:     "THRESHOLD_CONNECT_USERNAME",
 		Completion: complete.PredictNothing,
 		Usage:      `Specifies the username to pass through to the client. May be overridden by credentials sourced from a credential store.`,
 	})
@@ -40,7 +40,7 @@ func cassandraOptions(c *Command, set *base.FlagSets) {
 	f.StringVar(&base.StringVar{
 		Name:       "keyspace",
 		Target:     &c.flagDbname,
-		EnvVar:     "BOUNDARY_CONNECT_KEYSPACE",
+		EnvVar:     "THRESHOLD_CONNECT_KEYSPACE",
 		Completion: complete.PredictNothing,
 		Usage:      `Specifies the keyspace name to pass through to the client.`,
 	})

internal/cmd/commands/connect/connect.go

@@ -55,7 +55,7 @@ var (
 	_ cli.Command             = (*Command)(nil)
 	_ cli.CommandAutocomplete = (*Command)(nil)
 
-	// rdpDefaultTimeout is the default inactivity timeout for boundary connect rdp
+	// rdpDefaultTimeout is the default inactivity timeout for threshold connect rdp
 	// The default is zero (no timeout), however it is overridden for macOS clients only in connect_darwin.go
 	rdpDefaultTimeout time.Duration = 0
 )
@@ -117,7 +117,7 @@ type Command struct {
 func (c *Command) Synopsis() string {
 	switch c.Func {
 	case "connect":
-		return "Connect to a target through a Boundary worker"
+		return "Connect to a target through a Threshold worker"
 	case "http":
 		return httpSynopsis
 	case "postgres":
@@ -145,26 +145,26 @@ func (c *Command) Help() string {
 	switch c.Func {
 	case "connect":
 		return base.WrapForHelpText([]string{
-			"Usage: boundary connect [options] [args]",
+			"Usage: threshold connect [options] [args]",
 			"",
 			`  This command performs a target authorization (or consumes an existing authorization token) and launches a proxied connection.`,
 			"",
 			"  Example:",
 			"",
-			`      $ boundary connect -target-id ttcp_1234567890`,
+			`      $ threshold connect -target-id ttcp_1234567890`,
 			"",
 			"",
 		}) + c.Flags().Help()
 
 	default:
 		return base.WrapForHelpText([]string{
-			fmt.Sprintf("Usage: boundary connect %s [options] [args]", c.Func),
+			fmt.Sprintf("Usage: threshold connect %s [options] [args]", c.Func),
 			"",
 			fmt.Sprintf(`  This command performs a target authorization (or consumes an existing authorization token) and launches a proxied %s connection.`, c.Func),
 			"",
 			"  Example:",
 			"",
-			fmt.Sprintf(`      $ boundary connect %s -target-id ttcp_1234567890`, c.Func),
+			fmt.Sprintf(`      $ threshold connect %s -target-id ttcp_1234567890`, c.Func),
 			"",
 			"",
 		}) + c.Flags().Help()
@@ -178,9 +178,9 @@ func (c *Command) Flags() *base.FlagSets {
 	f.StringVar(&base.StringVar{
 		Name:       "authz-token",
 		Target:     &c.flagAuthzToken,
-		EnvVar:     "BOUNDARY_CONNECT_AUTHZ_TOKEN",
+		EnvVar:     "THRESHOLD_CONNECT_AUTHZ_TOKEN",
 		Completion: complete.PredictNothing,
-		Usage:      `Only needed if -target-id is not set. The authorization string returned from the Boundary controller via an "authorize-session" action against a target. If set to "-", the command will attempt to read in the authorization string from standard input.`,
+		Usage:      `Only needed if -target-id is not set. The authorization string returned from the Threshold controller via an "authorize-session" action against a target. If set to "-", the command will attempt to read in the authorization string from standard input.`,
 	})
 
 	f.StringVar(&base.StringVar{
@@ -198,7 +198,7 @@ func (c *Command) Flags() *base.FlagSets {
 	f.StringVar(&base.StringVar{
 		Name:       "exec",
 		Target:     &c.flagExec,
-		EnvVar:     "BOUNDARY_CONNECT_EXEC",
+		EnvVar:     "THRESHOLD_CONNECT_EXEC",
 		Completion: complete.PredictAnything,
 		Usage:      `If set, after connecting to the worker, the given binary will be executed. This should be a binary on your path, or an absolute path. If all command flags are followed by " -- " (space, two hyphens, space), then any arguments after that will be sent directly to the binary.`,
 	})
@@ -212,7 +212,7 @@ func (c *Command) Flags() *base.FlagSets {
 	f.StringVar(&base.StringVar{
 		Name:       "target-scope-id",
 		Target:     &c.FlagScopeId,
-		EnvVar:     "BOUNDARY_CONNECT_TARGET_SCOPE_ID",
+		EnvVar:     "THRESHOLD_CONNECT_TARGET_SCOPE_ID",
 		Completion: complete.PredictAnything,
 		Usage:      "Target scope ID, if authorizing the session via scope parameters and target name. Mutually exclusive with -scope-name.",
 	})
@@ -220,7 +220,7 @@ func (c *Command) Flags() *base.FlagSets {
 	f.StringVar(&base.StringVar{
 		Name:       "target-scope-name",
 		Target:     &c.FlagScopeName,
-		EnvVar:     "BOUNDARY_CONNECT_TARGET_SCOPE_NAME",
+		EnvVar:     "THRESHOLD_CONNECT_TARGET_SCOPE_NAME",
 		Completion: complete.PredictAnything,
 		Usage:      "Target scope name, if authorizing the session via scope parameters and target name. Mutually exclusive with -scope-id.",
 	})
@@ -237,7 +237,7 @@ func (c *Command) Flags() *base.FlagSets {
 		f.StringVar(&base.StringVar{
 			Name:       "listen-addr",
 			Target:     &c.flagListenAddr,
-			EnvVar:     "BOUNDARY_CONNECT_LISTEN_ADDR",
+			EnvVar:     "THRESHOLD_CONNECT_LISTEN_ADDR",
 			Completion: complete.PredictAnything,
 			Usage:      `If set, the CLI will attempt to bind its listening address to the given value, which must be an IP address. If it cannot, the command will error. If not set, defaults to the most common IPv4 loopback address (127.0.0.1).`,
 		})
@@ -245,7 +245,7 @@ func (c *Command) Flags() *base.FlagSets {
 		f.Int64Var(&base.Int64Var{
 			Name:       "listen-port",
 			Target:     &c.flagListenPort,
-			EnvVar:     "BOUNDARY_CONNECT_LISTEN_PORT",
+			EnvVar:     "THRESHOLD_CONNECT_LISTEN_PORT",
 			Completion: complete.PredictAnything,
 			Usage:      `If set, the CLI will attempt to bind its listening port to the given value. If it cannot, the command will error.`,
 		})
@@ -479,7 +479,7 @@ func (c *Command) Run(args []string) (retCode int) {
 			Credentials:     sa.Credentials,
 		}
 
-		// the session was created specifically for this `boundary connect`
+		// the session was created specifically for this `threshold connect`
 		// command, and should be closed as soon as the command has exited
 		defer func() {
 			var err error
@@ -840,6 +840,10 @@ func (c *Command) handleExec(clientProxy *apiproxy.ClientProxy, passthroughArgs
 	cmd := exec.Command(c.flagExec, args...)
 	// Add original and network related envs here
 	cmd.Env = append(os.Environ(),
+		fmt.Sprintf("THRESHOLD_PROXIED_PORT=%s", port),
+		fmt.Sprintf("THRESHOLD_PROXIED_IP=%s", host),
+		fmt.Sprintf("THRESHOLD_PROXIED_ADDR=%s", addr),
+		// Legacy names, kept so existing -exec scripts keep working.
 		fmt.Sprintf("BOUNDARY_PROXIED_PORT=%s", port),
 		fmt.Sprintf("BOUNDARY_PROXIED_IP=%s", host),
 		fmt.Sprintf("BOUNDARY_PROXIED_ADDR=%s", addr),

internal/cmd/commands/connect/http.go

@@ -22,7 +22,7 @@ func httpOptions(c *Command, set *base.FlagSets) {
 	f.StringVar(&base.StringVar{
 		Name:       "style",
 		Target:     &c.flagHttpStyle,
-		EnvVar:     "BOUNDARY_CONNECT_HTTP_STYLE",
+		EnvVar:     "THRESHOLD_CONNECT_HTTP_STYLE",
 		Completion: complete.PredictSet("curl"),
 		Default:    "curl",
 		Usage:      `Specifies how the CLI will attempt to invoke an HTTP client. This will also set a suitable default for -exec if a value was not specified. Currently-understood values are "curl".`,
@@ -31,7 +31,7 @@ func httpOptions(c *Command, set *base.FlagSets) {
 	f.StringVar(&base.StringVar{
 		Name:       "host",
 		Target:     &c.flagHttpHost,
-		EnvVar:     "BOUNDARY_CONNECT_HTTP_HOST",
+		EnvVar:     "THRESHOLD_CONNECT_HTTP_HOST",
 		Completion: complete.PredictNothing,
 		Usage:      `Specifies the host value to use, overriding the endpoint address from the session information. The specified hostname will be passed through to the client (if supported) for use in the Host header and TLS SNI value.`,
 	})
@@ -39,7 +39,7 @@ func httpOptions(c *Command, set *base.FlagSets) {
 	f.StringVar(&base.StringVar{
 		Name:       "path",
 		Target:     &c.flagHttpPath,
-		EnvVar:     "BOUNDARY_CONNECT_HTTP_PATH",
+		EnvVar:     "THRESHOLD_CONNECT_HTTP_PATH",
 		Completion: complete.PredictNothing,
 		Usage:      `Specifies a path that will be appended to the generated URL.`,
 	})
@@ -47,7 +47,7 @@ func httpOptions(c *Command, set *base.FlagSets) {
 	f.StringVar(&base.StringVar{
 		Name:       "method",
 		Target:     &c.flagHttpMethod,
-		EnvVar:     "BOUNDARY_CONNECT_HTTP_METHOD",
+		EnvVar:     "THRESHOLD_CONNECT_HTTP_METHOD",
 		Completion: complete.PredictNothing,
 		Usage:      `Specifies the method to use. If not set, will use the client's default.`,
 	})
@@ -56,7 +56,7 @@ func httpOptions(c *Command, set *base.FlagSets) {
 		Name:       "scheme",
 		Target:     &c.flagHttpScheme,
 		Default:    "https",
-		EnvVar:     "BOUNDARY_CONNECT_HTTP_SCHEME",
+		EnvVar:     "THRESHOLD_CONNECT_HTTP_SCHEME",
 		Completion: complete.PredictNothing,
 		Usage:      `Specifies the scheme to use.`,
 	})

internal/cmd/commands/connect/kube.go

@@ -22,7 +22,7 @@ func kubeOptions(c *Command, set *base.FlagSets) {
 	f.StringVar(&base.StringVar{
 		Name:       "style",
 		Target:     &c.flagKubeStyle,
-		EnvVar:     fmt.Sprintf("BOUNDARY_CONNECT_%s_STYLE", strings.ToUpper(c.Func)),
+		EnvVar:     fmt.Sprintf("THRESHOLD_CONNECT_%s_STYLE", strings.ToUpper(c.Func)),
 		Completion: complete.PredictSet("kubectl"),
 		Default:    "kubectl",
 		Usage:      `Specifies how the CLI will attempt to invoke a Kubernetes client. This will also set a suitable default for -exec if a value was not specified. Currently-understood values are "kubectl".`,
@@ -31,7 +31,7 @@ func kubeOptions(c *Command, set *base.FlagSets) {
 	f.StringVar(&base.StringVar{
 		Name:       "host",
 		Target:     &c.flagKubeHost,
-		EnvVar:     fmt.Sprintf("BOUNDARY_CONNECT_%s_HOST", strings.ToUpper(c.Func)),
+		EnvVar:     fmt.Sprintf("THRESHOLD_CONNECT_%s_HOST", strings.ToUpper(c.Func)),
 		Completion: complete.PredictNothing,
 		Usage:      `Specifies the host value to use, overriding the endpoint address from the session information. The specified hostname will be passed through to the client (if supported) for use in the TLS SNI value.`,
 	})
@@ -40,7 +40,7 @@ func kubeOptions(c *Command, set *base.FlagSets) {
 		Name:       "scheme",
 		Target:     &c.flagKubeScheme,
 		Default:    "https",
-		EnvVar:     fmt.Sprintf("BOUNDARY_CONNECT_%s_SCHEME", strings.ToUpper(c.Func)),
+		EnvVar:     fmt.Sprintf("THRESHOLD_CONNECT_%s_SCHEME", strings.ToUpper(c.Func)),
 		Completion: complete.PredictNothing,
 		Usage:      `Specifies the scheme to use.`,
 	})

internal/cmd/commands/connect/mongo.go

@@ -22,7 +22,7 @@ func mongoOptions(c *Command, set *base.FlagSets) {
 	f.StringVar(&base.StringVar{
 		Name:       "style",
 		Target:     &c.flagMongoStyle,
-		EnvVar:     "BOUNDARY_CONNECT_MONGO_STYLE",
+		EnvVar:     "THRESHOLD_CONNECT_MONGO_STYLE",
 		Completion: complete.PredictSet("mongosh"),
 		Default:    "mongosh",
 		Usage:      `Specifies how the CLI will attempt to invoke a MongoDB client. Currently only "mongosh" is supported.`,
@@ -31,7 +31,7 @@ func mongoOptions(c *Command, set *base.FlagSets) {
 	f.StringVar(&base.StringVar{
 		Name:       "username",
 		Target:     &c.flagUsername,
-		EnvVar:     "BOUNDARY_CONNECT_USERNAME",
+		EnvVar:     "THRESHOLD_CONNECT_USERNAME",
 		Completion: complete.PredictNothing,
 		Usage:      `Specifies the username to pass through to the client. May be overridden by credentials sourced from a credential store.`,
 	})
@@ -39,7 +39,7 @@ func mongoOptions(c *Command, set *base.FlagSets) {
 	f.StringVar(&base.StringVar{
 		Name:       "dbname",
 		Target:     &c.flagDbname,
-		EnvVar:     "BOUNDARY_CONNECT_DBNAME",
+		EnvVar:     "THRESHOLD_CONNECT_DBNAME",
 		Completion: complete.PredictNothing,
 		Usage:      `Specifies the database name to pass through to the client.`,
 	})
@@ -47,7 +47,7 @@ func mongoOptions(c *Command, set *base.FlagSets) {
 	f.StringVar(&base.StringVar{
 		Name:       "authentication-database",
 		Target:     &c.flagMongoDbAuthenticationDatabase,
-		EnvVar:     "BOUNDARY_CONNECT_MONGO_AUTHENTICATION_DATABASE",
+		EnvVar:     "THRESHOLD_CONNECT_MONGO_AUTHENTICATION_DATABASE",
 		Completion: complete.PredictNothing,
 		Default:    "",
 		Usage:      `Specifies the authentication database for MongoDB. If omitted, mongosh defaults authSource to the database name (dbname); if none is specified, it defaults to "admin".`,

internal/cmd/commands/connect/mysql.go

@@ -23,7 +23,7 @@ func mysqlOptions(c *Command, set *base.FlagSets) {
 	f.StringVar(&base.StringVar{
 		Name:       "style",
 		Target:     &c.flagMySQLStyle,
-		EnvVar:     "BOUNDARY_CONNECT_MYSQL_STYLE",
+		EnvVar:     "THRESHOLD_CONNECT_MYSQL_STYLE",
 		Completion: complete.PredictSet("mysql"),
 		Default:    "mysql",
 		Usage:      `Specifies how the CLI will attempt to invoke a MySQL client. This will also set a suitable default for -exec if a value was not specified. Currently-understood values are "mysql".`,
@@ -32,7 +32,7 @@ func mysqlOptions(c *Command, set *base.FlagSets) {
 	f.StringVar(&base.StringVar{
 		Name:       "username",
 		Target:     &c.flagUsername,
-		EnvVar:     "BOUNDARY_CONNECT_USERNAME",
+		EnvVar:     "THRESHOLD_CONNECT_USERNAME",
 		Completion: complete.PredictNothing,
 		Usage:      `Specifies the username to pass through to the client. May be overridden by credentials sourced from a credential store.`,
 	})
@@ -40,7 +40,7 @@ func mysqlOptions(c *Command, set *base.FlagSets) {
 	f.StringVar(&base.StringVar{
 		Name:       "dbname",
 		Target:     &c.flagDbname,
-		EnvVar:     "BOUNDARY_CONNECT_DBNAME",
+		EnvVar:     "THRESHOLD_CONNECT_DBNAME",
 		Completion: complete.PredictNothing,
 		Usage:      `Specifies the database name to pass through to the client.`,
 	})

internal/cmd/commands/connect/postgres.go

@@ -23,7 +23,7 @@ func postgresOptions(c *Command, set *base.FlagSets) {
 	f.StringVar(&base.StringVar{
 		Name:       "style",
 		Target:     &c.flagPostgresStyle,
-		EnvVar:     "BOUNDARY_CONNECT_POSTGRES_STYLE",
+		EnvVar:     "THRESHOLD_CONNECT_POSTGRES_STYLE",
 		Completion: complete.PredictSet("psql"),
 		Default:    "psql",
 		Usage:      `Specifies how the CLI will attempt to invoke a Postgres client. This will also set a suitable default for -exec if a value was not specified. Currently-understood values are "psql".`,
@@ -32,7 +32,7 @@ func postgresOptions(c *Command, set *base.FlagSets) {
 	f.StringVar(&base.StringVar{
 		Name:       "username",
 		Target:     &c.flagUsername,
-		EnvVar:     "BOUNDARY_CONNECT_USERNAME",
+		EnvVar:     "THRESHOLD_CONNECT_USERNAME",
 		Completion: complete.PredictNothing,
 		Usage:      `Specifies the username to pass through to the client. May be overridden by credentials sourced from a credential store.`,
 	})
@@ -40,7 +40,7 @@ func postgresOptions(c *Command, set *base.FlagSets) {
 	f.StringVar(&base.StringVar{
 		Name:       "dbname",
 		Target:     &c.flagDbname,
-		EnvVar:     "BOUNDARY_CONNECT_DBNAME",
+		EnvVar:     "THRESHOLD_CONNECT_DBNAME",
 		Completion: complete.PredictNothing,
 		Usage:      `Specifies the database name to pass through to the client.`,
 	})

internal/cmd/commands/connect/rdp.go

@@ -23,7 +23,7 @@ func rdpOptions(c *Command, set *base.FlagSets) {
 	f.StringVar(&base.StringVar{
 		Name:       "style",
 		Target:     &c.flagRdpStyle,
-		EnvVar:     "BOUNDARY_CONNECT_RDP_STYLE",
+		EnvVar:     "THRESHOLD_CONNECT_RDP_STYLE",
 		Completion: complete.PredictSet("mstsc", "open"),
 		Usage:      `Specifies how the CLI will attempt to invoke an RDP client. This will also set a suitable default for -exec if a value was not specified. Currently-understood values are "mstsc", which is the default on Windows and launches the Windows client, and "open", which is the default on Mac and launches via an rdp:// URL.`,
 	})

internal/cmd/commands/connect/redis.go

@@ -22,7 +22,7 @@ func redisOptions(c *Command, set *base.FlagSets) {
 	f.StringVar(&base.StringVar{
 		Name:       "style",
 		Target:     &c.flagRedisStyle,
-		EnvVar:     "BOUNDARY_CONNECT_REDIS_STYLE",
+		EnvVar:     "THRESHOLD_CONNECT_REDIS_STYLE",
 		Completion: complete.PredictSet("redis-cli"),
 		Default:    "redis-cli",
 		Usage:      `Specifies how the CLI will attempt to invoke a Redis client. This will also set a suitable default for -exec if a value was not specified. Currently-understood values are "redis-cli".`,
@@ -31,7 +31,7 @@ func redisOptions(c *Command, set *base.FlagSets) {
 	f.StringVar(&base.StringVar{
 		Name:       "username",
 		Target:     &c.flagUsername,
-		EnvVar:     "BOUNDARY_CONNECT_USERNAME",
+		EnvVar:     "THRESHOLD_CONNECT_USERNAME",
 		Completion: complete.PredictNothing,
 		Usage:      `Specifies the username to pass through to the client. May be overridden by credentials sourced from a credential store.`,
 	})

internal/cmd/commands/connect/ssh.go

@@ -25,7 +25,7 @@ func sshOptions(c *Command, set *base.FlagSets) {
 	f.StringVar(&base.StringVar{
 		Name:       "style",
 		Target:     &c.flagSshStyle,
-		EnvVar:     "BOUNDARY_CONNECT_SSH_STYLE",
+		EnvVar:     "THRESHOLD_CONNECT_SSH_STYLE",
 		Completion: complete.PredictSet("ssh", "putty", "sshpass"),
 		Default:    "ssh",
 		Usage:      `Specifies how the CLI will attempt to invoke an SSH client. This will also set a suitable default for -exec if a value was not specified. Currently-understood values are "ssh" and "putty".`,
@@ -40,7 +40,7 @@ func sshOptions(c *Command, set *base.FlagSets) {
 	f.StringVar(&base.StringVar{
 		Name:       "username",
 		Target:     &c.flagUsername,
-		EnvVar:     "BOUNDARY_CONNECT_USERNAME",
+		EnvVar:     "THRESHOLD_CONNECT_USERNAME",
 		Completion: complete.PredictNothing,
 		Usage:      `Specifies the username to pass through to the client`,
 	})
@@ -163,7 +163,7 @@ func (s *sshFlags) buildArgs(c *Command, port, ip, _ string, creds apiproxy.Cred
 				return nil
 			})
 			// SSH requires the private key file to end with a newline.
-			// When ingesting an ssh_private_key from a file:// Boundary calls strings.TrimSpace
+			// When ingesting an ssh_private_key from a file:// Threshold calls strings.TrimSpace
 			// which will also trim newlines.
 			if !strings.HasSuffix(privateKey, "\n") {
 				privateKey = fmt.Sprintln(privateKey)

internal/cmd/commands/credentiallibrariescmd/credentiallibraries.gen.go

@@ -151,7 +151,7 @@ func (c *Command) Run(args []string) int {
 
 		case "list":
 			if c.FlagCredentialStoreId == "" {
-				c.PrintCliError(errors.New("CredentialStore ID must be passed in via -credential-store-id or BOUNDARY_CREDENTIAL_STORE_ID"))
+				c.PrintCliError(errors.New("CredentialStore ID must be passed in via -credential-store-id or THRESHOLD_CREDENTIAL_STORE_ID"))
 				return base.CommandUserError
 			}
 

internal/cmd/commands/credentiallibrariescmd/funcs.go

@@ -17,37 +17,37 @@ func (c *Command) extraHelpFunc(helpMap map[string]func() string) string {
 	switch c.Func {
 	case "":
 		return base.WrapForHelpText([]string{
-			"Usage: boundary credential-libraries [sub command] [options] [args]",
+			"Usage: threshold credential-libraries [sub command] [options] [args]",
 			"",
-			"  This command allows operations on Boundary credential library resources. Example:",
+			"  This command allows operations on Threshold credential library resources. Example:",
 			"",
 			"    Read a credential library:",
 			"",
-			`      $ boundary credential-libraries read -id clvlt_1234567890`,
+			`      $ threshold credential-libraries read -id clvlt_1234567890`,
 			"",
 			"  Please see the credential-libraries subcommand help for detailed usage information.",
 		})
 	case "create":
 		helpStr = base.WrapForHelpText([]string{
-			"Usage: boundary credential-libraries create [type] [sub command] [options] [args]",
+			"Usage: threshold credential-libraries create [type] [sub command] [options] [args]",
 			"",
-			"  This command allows create operations on Boundary credential library resources. Example:",
+			"  This command allows create operations on Threshold credential library resources. Example:",
 			"",
 			"    Create a credential library:",
 			"",
-			`      $ boundary credential-libraries create vault -credential-store-id csvlt_1234567890 -vault-path "/some/path"`,
+			`      $ threshold credential-libraries create vault -credential-store-id csvlt_1234567890 -vault-path "/some/path"`,
 			"",
 			"  Please see the typed subcommand help for detailed usage information.",
 		})
 	case "update":
 		helpStr = base.WrapForHelpText([]string{
-			"Usage: boundary credential-libraries update [type] [sub command] [options] [args]",
+			"Usage: threshold credential-libraries update [type] [sub command] [options] [args]",
 			"",
-			"  This command allows update operations on Boundary credential library resources. Example:",
+			"  This command allows update operations on Threshold credential library resources. Example:",
 			"",
 			"    Update a vault-type credential library:",
 			"",
-			`      $ boundary credential-libraries update vault -id clvlt_1234567890 -name devops -description "For DevOps usage"`,
+			`      $ threshold credential-libraries update vault -id clvlt_1234567890 -name devops -description "For DevOps usage"`,
 			"",
 			"  Please see the typed subcommand help for detailed usage information.",
 		})

internal/cmd/commands/credentiallibrariescmd/vault-generic_credentiallibraries.gen.go

@@ -137,7 +137,7 @@ func (c *VaultGenericCommand) Run(args []string) int {
 
 		case "create":
 			if c.FlagCredentialStoreId == "" {
-				c.PrintCliError(errors.New("CredentialStore ID must be passed in via -credential-store-id or BOUNDARY_CREDENTIAL_STORE_ID"))
+				c.PrintCliError(errors.New("CredentialStore ID must be passed in via -credential-store-id or THRESHOLD_CREDENTIAL_STORE_ID"))
 				return base.CommandUserError
 			}
 

internal/cmd/commands/credentiallibrariescmd/vault-generic_funcs.go

@@ -153,22 +153,22 @@ func (c *VaultGenericCommand) extraVaultGenericHelpFunc(_ map[string]func() stri
 	switch c.Func {
 	case "create":
 		helpStr = base.WrapForHelpText([]string{
-			"Usage: boundary credential-libraries create vault -credential-store-id [options] [args]",
+			"Usage: threshold credential-libraries create vault -credential-store-id [options] [args]",
 			"",
 			"  Create a vault-generic-type credential library. Example:",
 			"",
-			`    $ boundary credential-libraries create vault-generic -credential-store-id csvlt_1234567890 -vault-path "/some/path"`,
+			`    $ threshold credential-libraries create vault-generic -credential-store-id csvlt_1234567890 -vault-path "/some/path"`,
 			"",
 			"",
 		})
 
 	case "update":
 		helpStr = base.WrapForHelpText([]string{
-			"Usage: boundary credential-libraries update vault [options] [args]",
+			"Usage: threshold credential-libraries update vault [options] [args]",
 			"",
 			"  Update a vault-generic-type credential library given its ID. Example:",
 			"",
-			`    $ boundary credential-libraries update vault-generic -id clvlt_1234567890 -name devops -description "For DevOps usage"`,
+			`    $ threshold credential-libraries update vault-generic -id clvlt_1234567890 -name devops -description "For DevOps usage"`,
 			"",
 			"",
 		})

internal/cmd/commands/credentiallibrariescmd/vault-ldap_credentiallibraries.gen.go

@@ -137,7 +137,7 @@ func (c *VaultLdapCommand) Run(args []string) int {
 
 		case "create":
 			if c.FlagCredentialStoreId == "" {
-				c.PrintCliError(errors.New("CredentialStore ID must be passed in via -credential-store-id or BOUNDARY_CREDENTIAL_STORE_ID"))
+				c.PrintCliError(errors.New("CredentialStore ID must be passed in via -credential-store-id or THRESHOLD_CREDENTIAL_STORE_ID"))
 				return base.CommandUserError
 			}
 

internal/cmd/commands/credentiallibrariescmd/vault-ldap_funcs.go

@@ -59,22 +59,22 @@ func (c *VaultLdapCommand) extraVaultLdapHelpFunc(_ map[string]func() string) st
 	switch c.Func {
 	case "create":
 		helpStr = base.WrapForHelpText([]string{
-			"Usage: boundary credential-libraries create vault-ldap -credential-store-id [options] [args]",
+			"Usage: threshold credential-libraries create vault-ldap -credential-store-id [options] [args]",
 			"",
 			"  Create a vault-ldap-type credential library. Example:",
 			"",
-			`    $ boundary credential-libraries create vault-ldap -credential-store-id csvlt_1234567890 -vault-path "/ldap/static-cred/einstein"`,
+			`    $ threshold credential-libraries create vault-ldap -credential-store-id csvlt_1234567890 -vault-path "/ldap/static-cred/einstein"`,
 			"",
 			"",
 		})
 
 	case "update":
 		helpStr = base.WrapForHelpText([]string{
-			"Usage: boundary credential-libraries update vault-ldap [options] [args]",
+			"Usage: threshold credential-libraries update vault-ldap [options] [args]",
 			"",
 			"  Update a vault-ldap-type credential library given its ID. Example:",
 			"",
-			`    $ boundary credential-libraries update vault-ldap -id clvllt_1234567890 -name devops -description "For DevOps usage"`,
+			`    $ threshold credential-libraries update vault-ldap -id clvllt_1234567890 -name devops -description "For DevOps usage"`,
 			"",
 			"",
 		})

internal/cmd/commands/credentiallibrariescmd/vault-ssh-certificate_credentiallibraries.gen.go

@@ -137,7 +137,7 @@ func (c *VaultSshCertificateCommand) Run(args []string) int {
 
 		case "create":
 			if c.FlagCredentialStoreId == "" {
-				c.PrintCliError(errors.New("CredentialStore ID must be passed in via -credential-store-id or BOUNDARY_CREDENTIAL_STORE_ID"))
+				c.PrintCliError(errors.New("CredentialStore ID must be passed in via -credential-store-id or THRESHOLD_CREDENTIAL_STORE_ID"))
 				return base.CommandUserError
 			}
 

internal/cmd/commands/credentiallibrariescmd/vault-ssh-certificate_funcs.go

@@ -269,22 +269,22 @@ func (c *VaultSshCertificateCommand) extraVaultSshCertificateHelpFunc(_ map[stri
 	switch c.Func {
 	case "create":
 		helpStr = base.WrapForHelpText([]string{
-			"Usage: boundary credential-libraries create vault-ssh-certificate -credential-store-id [options] [args]",
+			"Usage: threshold credential-libraries create vault-ssh-certificate -credential-store-id [options] [args]",
 			"",
 			"  Create a vault-ssh-certificate-type credential library. Example:",
 			"",
-			`    $ boundary credential-libraries create vault-ssh-certificate -credential-store-id  csvlt_1234567890 -vault-path "/ssh/sign/role" -username user`,
+			`    $ threshold credential-libraries create vault-ssh-certificate -credential-store-id  csvlt_1234567890 -vault-path "/ssh/sign/role" -username user`,
 			"",
 			"",
 		})
 
 	case "update":
 		helpStr = base.WrapForHelpText([]string{
-			"Usage: boundary credential-libraries update vault-ssh-certificate [options] [args]",
+			"Usage: threshold credential-libraries update vault-ssh-certificate [options] [args]",
 			"",
 			"  Update a vault-ssh-certificate-type credential library given its ID. Example:",
 			"",
-			`    $ boundary credential-libraries update vault-ssh-certificate -id clvsclt_1234567890 -name devops -description "For DevOps usage"`,
+			`    $ threshold credential-libraries update vault-ssh-certificate -id clvsclt_1234567890 -name devops -description "For DevOps usage"`,
 			"",
 			"",
 		})

internal/cmd/commands/credentiallibrariescmd/vault_credentiallibraries.gen.go

@@ -137,7 +137,7 @@ func (c *VaultCommand) Run(args []string) int {
 
 		case "create":
 			if c.FlagCredentialStoreId == "" {
-				c.PrintCliError(errors.New("CredentialStore ID must be passed in via -credential-store-id or BOUNDARY_CREDENTIAL_STORE_ID"))
+				c.PrintCliError(errors.New("CredentialStore ID must be passed in via -credential-store-id or THRESHOLD_CREDENTIAL_STORE_ID"))
 				return base.CommandUserError
 			}
 

internal/cmd/commands/credentiallibrariescmd/vault_funcs.go

@@ -124,24 +124,24 @@ func (c *VaultCommand) extraVaultHelpFunc(_ map[string]func() string) string {
 	switch c.Func {
 	case "create":
 		helpStr = base.WrapForHelpText([]string{
-			"Deprecated: use 'boundary credential-libraries create vault-generic' instead.",
+			"Deprecated: use 'threshold credential-libraries create vault-generic' instead.",
-			"Usage: boundary credential-libraries create vault -credential-store-id [options] [args]",
+			"Usage: threshold credential-libraries create vault -credential-store-id [options] [args]",
 			"",
 			"  Create a vault-type credential library. Example:",
 			"",
-			`    $ boundary credential-libraries create vault -credential-store-id csvlt_1234567890 -vault-path "/some/path"`,
+			`    $ threshold credential-libraries create vault -credential-store-id csvlt_1234567890 -vault-path "/some/path"`,
 			"",
 			"",
 		})
 
 	case "update":
 		helpStr = base.WrapForHelpText([]string{
-			"Deprecated: use 'boundary credential-libraries update vault-generic' instead.",
+			"Deprecated: use 'threshold credential-libraries update vault-generic' instead.",
-			"Usage: boundary credential-libraries update vault [options] [args]",
+			"Usage: threshold credential-libraries update vault [options] [args]",
 			"",
 			"  Update a vault-type credential library given its ID. Example:",
 			"",
-			`    $ boundary credential-libraries update vault -id clvlt_1234567890 -name devops -description "For DevOps usage"`,
+			`    $ threshold credential-libraries update vault -id clvlt_1234567890 -name devops -description "For DevOps usage"`,
 			"",
 			"",
 		})

internal/cmd/commands/credentialscmd/credentials.gen.go

@@ -151,7 +151,7 @@ func (c *Command) Run(args []string) int {
 
 		case "list":
 			if c.FlagCredentialStoreId == "" {
-				c.PrintCliError(errors.New("CredentialStore ID must be passed in via -credential-store-id or BOUNDARY_CREDENTIAL_STORE_ID"))
+				c.PrintCliError(errors.New("CredentialStore ID must be passed in via -credential-store-id or THRESHOLD_CREDENTIAL_STORE_ID"))
 				return base.CommandUserError
 			}
 

internal/cmd/commands/credentialscmd/funcs.go

@@ -26,37 +26,37 @@ func (c *Command) extraHelpFunc(helpMap map[string]func() string) string {
 	switch c.Func {
 	case "":
 		return base.WrapForHelpText([]string{
-			"Usage: boundary credentials [sub command] [options] [args]",
+			"Usage: threshold credentials [sub command] [options] [args]",
 			"",
-			"  This command allows operations on Boundary credential resources. Example:",
+			"  This command allows operations on Threshold credential resources. Example:",
 			"",
 			"    Read a credential:",
 			"",
-			`      $ boundary credentials read -id cred_1234567890`,
+			`      $ threshold credentials read -id cred_1234567890`,
 			"",
 			"  Please see the credentials subcommand help for detailed usage information.",
 		})
 	case "create":
 		helpStr = base.WrapForHelpText([]string{
-			"Usage: boundary credentials create [type] [sub command] [options] [args]",
+			"Usage: threshold credentials create [type] [sub command] [options] [args]",
 			"",
-			"  This command allows create operations on Boundary credential resources. Example:",
+			"  This command allows create operations on Threshold credential resources. Example:",
 			"",
 			"    Create a credential:",
 			"",
-			`      $ boundary credentials create username-password -credential-store-id cs_1234567890 -username user -password pass`,
+			`      $ threshold credentials create username-password -credential-store-id cs_1234567890 -username user -password pass`,
 			"",
 			"  Please see the typed subcommand help for detailed usage information.",
 		})
 	case "update":
 		helpStr = base.WrapForHelpText([]string{
-			"Usage: boundary credentials update [type] [sub command] [options] [args]",
+			"Usage: threshold credentials update [type] [sub command] [options] [args]",
 			"",
-			"  This command allows update operations on Boundary credential resources. Example:",
+			"  This command allows update operations on Threshold credential resources. Example:",
 			"",
 			"    Update a username/password credential:",
 			"",
-			`      $ boundary credentials update username-password -id cred_1234567890 -name devops -description "For DevOps usage"`,
+			`      $ threshold credentials update username-password -id cred_1234567890 -name devops -description "For DevOps usage"`,
 			"",
 			"  Please see the typed subcommand help for detailed usage information.",
 		})

internal/cmd/commands/credentialscmd/json_credentials.gen.go

@@ -151,7 +151,7 @@ func (c *JsonCommand) Run(args []string) int {
 
 		case "create":
 			if c.FlagCredentialStoreId == "" {
-				c.PrintCliError(errors.New("CredentialStore ID must be passed in via -credential-store-id or BOUNDARY_CREDENTIAL_STORE_ID"))
+				c.PrintCliError(errors.New("CredentialStore ID must be passed in via -credential-store-id or THRESHOLD_CREDENTIAL_STORE_ID"))
 				return base.CommandUserError
 			}
 

internal/cmd/commands/credentialscmd/json_credentials_funcs.go

@@ -12,22 +12,22 @@ func (c *JsonCommand) extraJsonHelpFunc(_ map[string]func() string) string {
 	switch c.Func {
 	case "create":
 		helpStr = base.WrapForHelpText([]string{
-			"Usage: boundary credentials create json -credential-store-id [options] [args]",
+			"Usage: threshold credentials create json -credential-store-id [options] [args]",
 			"",
 			"  Create a json credential. Example:",
 			"",
-			`    $ boundary credentials create json -credential-store-id csst_1234567890 -object file:///home/user/secret`,
+			`    $ threshold credentials create json -credential-store-id csst_1234567890 -object file:///home/user/secret`,
 			"",
 			"",
 		})
 
 	case "update":
 		helpStr = base.WrapForHelpText([]string{
-			"Usage: boundary credentials update json [options] [args]",
+			"Usage: threshold credentials update json [options] [args]",
 			"",
 			"  Update a json credential given its ID. Example:",
 			"",
-			`    $ boundary credentials update json -id csst_1234567890 -name devops -description "For DevOps usage"`,
+			`    $ threshold credentials update json -id csst_1234567890 -name devops -description "For DevOps usage"`,
 			"",
 			"",
 		})

internal/cmd/commands/credentialscmd/password_credentials.gen.go

@@ -137,7 +137,7 @@ func (c *PasswordCommand) Run(args []string) int {
 
 		case "create":
 			if c.FlagCredentialStoreId == "" {
-				c.PrintCliError(errors.New("CredentialStore ID must be passed in via -credential-store-id or BOUNDARY_CREDENTIAL_STORE_ID"))
+				c.PrintCliError(errors.New("CredentialStore ID must be passed in via -credential-store-id or THRESHOLD_CREDENTIAL_STORE_ID"))
 				return base.CommandUserError
 			}
 

internal/cmd/commands/credentialscmd/password_funcs.go

@@ -72,22 +72,22 @@ func (c *PasswordCommand) extraPasswordHelpFunc(_ map[string]func() string) stri
 	switch c.Func {
 	case "create":
 		helpStr = base.WrapForHelpText([]string{
-			"Usage: boundary credentials create password -credential-store-id [options] [args]",
+			"Usage: threshold credentials create password -credential-store-id [options] [args]",
 			"",
 			"  Create a password credential. Example:",
 			"",
-			`    $ boundary credentials create password -credential-store-id csvlt_1234567890 -password pass`,
+			`    $ threshold credentials create password -credential-store-id csvlt_1234567890 -password pass`,
 			"",
 			"",
 		})
 
 	case "update":
 		helpStr = base.WrapForHelpText([]string{
-			"Usage: boundary credentials update password [options] [args]",
+			"Usage: threshold credentials update password [options] [args]",
 			"",
 			"  Update a password credential given its ID. Example:",
 			"",
-			`    $ boundary credentials update password -id clvlt_1234567890 -name devops -description "For DevOps usage"`,
+			`    $ threshold credentials update password -id clvlt_1234567890 -name devops -description "For DevOps usage"`,
 			"",
 			"",
 		})

internal/cmd/commands/credentialscmd/ssh-private-key_credentials.gen.go

@@ -137,7 +137,7 @@ func (c *SshPrivateKeyCommand) Run(args []string) int {
 
 		case "create":
 			if c.FlagCredentialStoreId == "" {
-				c.PrintCliError(errors.New("CredentialStore ID must be passed in via -credential-store-id or BOUNDARY_CREDENTIAL_STORE_ID"))
+				c.PrintCliError(errors.New("CredentialStore ID must be passed in via -credential-store-id or THRESHOLD_CREDENTIAL_STORE_ID"))
 				return base.CommandUserError
 			}
 

internal/cmd/commands/credentialscmd/ssh-private-key_funcs.go

@@ -154,22 +154,22 @@ func (c *SshPrivateKeyCommand) extraSshPrivateKeyHelpFunc(_ map[string]func() st
 	switch c.Func {
 	case "create":
 		helpStr = base.WrapForHelpText([]string{
-			"Usage: boundary credentials create ssh-private-key -credential-store-id [options] [args]",
+			"Usage: threshold credentials create ssh-private-key -credential-store-id [options] [args]",
 			"",
 			"  Create an SSH private key credential. Example:",
 			"",
-			`    $ boundary credentials create ssh-private-key -credential-store-id csvlt_1234567890 -username user -private-key file:///home/user/.ssh/id_ed25519`,
+			`    $ threshold credentials create ssh-private-key -credential-store-id csvlt_1234567890 -username user -private-key file:///home/user/.ssh/id_ed25519`,
 			"",
 			"",
 		})
 
 	case "update":
 		helpStr = base.WrapForHelpText([]string{
-			"Usage: boundary credentials update ssh-private-key [options] [args]",
+			"Usage: threshold credentials update ssh-private-key [options] [args]",
 			"",
 			"  Update an SSH private key credential given its ID. Example:",
 			"",
-			`    $ boundary credentials update ssh-private-key -id clvlt_1234567890 -name devops -description "For DevOps usage"`,
+			`    $ threshold credentials update ssh-private-key -id clvlt_1234567890 -name devops -description "For DevOps usage"`,
 			"",
 			"",
 		})

internal/cmd/commands/credentialscmd/username-password-domain_credentials.gen.go

@@ -137,7 +137,7 @@ func (c *UsernamePasswordDomainCommand) Run(args []string) int {
 
 		case "create":
 			if c.FlagCredentialStoreId == "" {
-				c.PrintCliError(errors.New("CredentialStore ID must be passed in via -credential-store-id or BOUNDARY_CREDENTIAL_STORE_ID"))
+				c.PrintCliError(errors.New("CredentialStore ID must be passed in via -credential-store-id or THRESHOLD_CREDENTIAL_STORE_ID"))
 				return base.CommandUserError
 			}
 

internal/cmd/commands/credentialscmd/username-password-domain_funcs.go

@@ -106,22 +106,22 @@ func (c *UsernamePasswordDomainCommand) extraUsernamePasswordDomainHelpFunc(_ ma
 	switch c.Func {
 	case "create":
 		helpStr = base.WrapForHelpText([]string{
-			"Usage: boundary credentials create username-password-domain -credential-store-id [options] [args]",
+			"Usage: threshold credentials create username-password-domain -credential-store-id [options] [args]",
 			"",
 			"  Create a username password domain credential. Example:",
 			"",
-			`    $ boundary credentials create username-password-domain -credential-store-id csvlt_1234567890 -username user -password env://PASSWORD -domain domain`,
+			`    $ threshold credentials create username-password-domain -credential-store-id csvlt_1234567890 -username user -password env://PASSWORD -domain domain`,
 			"",
 			"",
 		})
 
 	case "update":
 		helpStr = base.WrapForHelpText([]string{
-			"Usage: boundary credentials update username-password-domain [options] [args]",
+			"Usage: threshold credentials update username-password-domain [options] [args]",
 			"",
 			"  Update a username password domain credential given its ID. Example:",
 			"",
-			`    $ boundary credentials update username-password-domain -id clvlt_1234567890 -name devops -description "For DevOps usage"`,
+			`    $ threshold credentials update username-password-domain -id clvlt_1234567890 -name devops -description "For DevOps usage"`,
 			"",
 			"",
 		})

internal/cmd/commands/credentialscmd/username-password_credentials.gen.go

@@ -137,7 +137,7 @@ func (c *UsernamePasswordCommand) Run(args []string) int {
 
 		case "create":
 			if c.FlagCredentialStoreId == "" {
-				c.PrintCliError(errors.New("CredentialStore ID must be passed in via -credential-store-id or BOUNDARY_CREDENTIAL_STORE_ID"))
+				c.PrintCliError(errors.New("CredentialStore ID must be passed in via -credential-store-id or THRESHOLD_CREDENTIAL_STORE_ID"))
 				return base.CommandUserError
 			}
 

internal/cmd/commands/credentialscmd/username-password_funcs.go

@@ -85,22 +85,22 @@ func (c *UsernamePasswordCommand) extraUsernamePasswordHelpFunc(_ map[string]fun
 	switch c.Func {
 	case "create":
 		helpStr = base.WrapForHelpText([]string{
-			"Usage: boundary credentials create username-password -credential-store-id [options] [args]",
+			"Usage: threshold credentials create username-password -credential-store-id [options] [args]",
 			"",
 			"  Create a username password credential. Example:",
 			"",
-			`    $ boundary credentials create username-password -credential-store-id csvlt_1234567890 -username user -password pass`,
+			`    $ threshold credentials create username-password -credential-store-id csvlt_1234567890 -username user -password pass`,
 			"",
 			"",
 		})
 
 	case "update":
 		helpStr = base.WrapForHelpText([]string{
-			"Usage: boundary credentials update username-password [options] [args]",
+			"Usage: threshold credentials update username-password [options] [args]",
 			"",
 			"  Update a username password credential given its ID. Example:",
 			"",
-			`    $ boundary credentials update username-password -id clvlt_1234567890 -name devops -description "For DevOps usage"`,
+			`    $ threshold credentials update username-password -id clvlt_1234567890 -name devops -description "For DevOps usage"`,
 			"",
 			"",
 		})

internal/cmd/commands/credentialstorescmd/credentialstores.gen.go

@@ -151,7 +151,7 @@ func (c *Command) Run(args []string) int {
 
 		case "list":
 			if c.FlagScopeId == "" {
-				c.PrintCliError(errors.New("Scope ID must be passed in via -scope-id or BOUNDARY_SCOPE_ID"))
+				c.PrintCliError(errors.New("Scope ID must be passed in via -scope-id or THRESHOLD_SCOPE_ID"))
 				return base.CommandUserError
 			}
 

internal/cmd/commands/credentialstorescmd/funcs.go

@@ -18,45 +18,45 @@ func (c *Command) extraHelpFunc(helpMap map[string]func() string) string {
 	switch c.Func {
 	case "":
 		return base.WrapForHelpText([]string{
-			"Usage: boundary credential-stores [sub command] [options] [args]",
+			"Usage: threshold credential-stores [sub command] [options] [args]",
 			"",
-			"  This command allows operations on Boundary credential store resources. Example:",
+			"  This command allows operations on Threshold credential store resources. Example:",
 			"",
 			"    Read a credential store:",
 			"",
-			`      $ boundary credential-stores read -id csvlt_1234567890`,
+			`      $ threshold credential-stores read -id csvlt_1234567890`,
 			"",
 			"  Please see the credential-stores subcommand help for detailed usage information.",
 		})
 	case "create":
 		helpStr = base.WrapForHelpText([]string{
-			"Usage: boundary credential-stores create [type] [sub command] [options] [args]",
+			"Usage: threshold credential-stores create [type] [sub command] [options] [args]",
 			"",
-			"  This command allows create operations on Boundary credential store resources. Example:",
+			"  This command allows create operations on Threshold credential store resources. Example:",
 			"",
 			"    Create a vault-type credential store:",
 			"",
-			`      $ boundary credential-stores create vault -scope-id p_1234567890 -vault-address "http://localhost:8200" -vault-token "s.s0m3t0k3n"`,
+			`      $ threshold credential-stores create vault -scope-id p_1234567890 -vault-address "http://localhost:8200" -vault-token "s.s0m3t0k3n"`,
 			"",
 			"    Create a static-type credential store:",
 			"",
-			`      $ boundary credential-stores create static -scope-id p_1234567890`,
+			`      $ threshold credential-stores create static -scope-id p_1234567890`,
 			"",
 			"  Please see the typed subcommand help for detailed usage information.",
 		})
 	case "update":
 		helpStr = base.WrapForHelpText([]string{
-			"Usage: boundary credential-stores update [type] [sub command] [options] [args]",
+			"Usage: threshold credential-stores update [type] [sub command] [options] [args]",
 			"",
-			"  This command allows update operations on Boundary credential store resources. Example:",
+			"  This command allows update operations on Threshold credential store resources. Example:",
 			"",
 			"    Update a vault-type credential store:",
 			"",
-			`      $ boundary credential-stores update vault -id csvlt_1234567890 -name devops -description "For DevOps usage"`,
+			`      $ threshold credential-stores update vault -id csvlt_1234567890 -name devops -description "For DevOps usage"`,
 			"",
 			"    Update a static-type credential store:",
 			"",
-			`      $ boundary credential-stores update static -id cs_1234567890 -name devops -description "For DevOps usage"`,
+			`      $ threshold credential-stores update static -id cs_1234567890 -name devops -description "For DevOps usage"`,
 			"",
 			"  Please see the typed subcommand help for detailed usage information.",
 		})

internal/cmd/commands/credentialstorescmd/static_credentialstores.gen.go

@@ -135,7 +135,7 @@ func (c *StaticCommand) Run(args []string) int {
 
 		case "create":
 			if c.FlagScopeId == "" {
-				c.PrintCliError(errors.New("Scope ID must be passed in via -scope-id or BOUNDARY_SCOPE_ID"))
+				c.PrintCliError(errors.New("Scope ID must be passed in via -scope-id or THRESHOLD_SCOPE_ID"))
 				return base.CommandUserError
 			}
 

internal/cmd/commands/credentialstorescmd/static_funcs.go

@@ -12,22 +12,22 @@ func (c *StaticCommand) extraStaticHelpFunc(helpMap map[string]func() string) st
 	switch c.Func {
 	case "create":
 		helpStr = base.WrapForHelpText([]string{
-			"Usage: boundary credential-stores create static [options] [args]",
+			"Usage: threshold credential-stores create static [options] [args]",
 			"",
 			"  Create a static-type credential store. Example:",
 			"",
-			`    $ boundary credential-stores create static -scope-id p_1234567890`,
+			`    $ threshold credential-stores create static -scope-id p_1234567890`,
 			"",
 			"",
 		})
 
 	case "update":
 		helpStr = base.WrapForHelpText([]string{
-			"Usage: boundary credential-stores update static [options] [args]",
+			"Usage: threshold credential-stores update static [options] [args]",
 			"",
 			"  Update a static-type credential store given its ID. Example:",
 			"",
-			`    $ boundary credential-stores update static -name devops -description "For DevOps usage"`,
+			`    $ threshold credential-stores update static -name devops -description "For DevOps usage"`,
 			"",
 			"",
 		})

internal/cmd/commands/credentialstorescmd/vault_credentialstores.gen.go

@@ -137,7 +137,7 @@ func (c *VaultCommand) Run(args []string) int {
 
 		case "create":
 			if c.FlagScopeId == "" {
-				c.PrintCliError(errors.New("Scope ID must be passed in via -scope-id or BOUNDARY_SCOPE_ID"))
+				c.PrintCliError(errors.New("Scope ID must be passed in via -scope-id or THRESHOLD_SCOPE_ID"))
 				return base.CommandUserError
 			}