Pin UI to threshold-ui main 8e63f6b

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Build the embedded admin UI from CyberCoveLLC/threshold-ui
2026-10-12 14:11:36 -07:00 · 2026-10-12 12:44:26 -07:00 · 2026-10-12 11:14:31 -07:00 · 2026-10-12 11:12:29 -07:00 · 2026-10-12 10:49:41 -07:00 · 2026-10-12 10:37:57 -07:00
45 changed files with 1258 additions and 229 deletions
@@ -3,6 +3,7 @@ name: ci
 on:
  push:
    branches: [main]
+    tags-ignore: ["**"]
  pull_request:
  workflow_dispatch:
  schedule:
@@ -170,7 +170,7 @@ jobs:
          commit: ${{ steps.set-sha.outputs.sha }}
          repo: "hashicorp/boundary-ui"
          name: admin-ui-${{ needs.product-metadata.outputs.product-edition }}
-          path: internal/ui/.tmp/boundary-ui/ui/admin/dist
+          path: internal/ui/.tmp/threshold-ui/ui/admin/dist
      - name: Go Build
        env:
          CGO_ENABLED: "0"
@@ -246,7 +246,7 @@ jobs:
          commit: ${{ steps.set-sha.outputs.sha }}
          repo: "hashicorp/boundary-ui"
          name: admin-ui-${{ needs.product-metadata.outputs.product-edition }}
-          path: internal/ui/.tmp/boundary-ui/ui/admin/dist
+          path: internal/ui/.tmp/threshold-ui/ui/admin/dist
      - name: Go Build
        env:
          CGO_ENABLED: "0"
@@ -282,6 +282,7 @@ jobs:
          rpm_depends: "openssl"
          config_dir: ".release/linux/package/"
          preinstall: ".release/linux/preinst"
+          postinstall: ".release/linux/postinst"
          postremove: ".release/linux/postrm"
      - name: Add Linux Package names to env
        run: |
@@ -344,7 +345,7 @@ jobs:
          commit: ${{ steps.set-sha.outputs.sha }}
          repo: "hashicorp/boundary-ui"
          name: admin-ui-${{ needs.product-metadata.outputs.product-edition }}
-          path: internal/ui/.tmp/boundary-ui/ui/admin/dist
+          path: internal/ui/.tmp/threshold-ui/ui/admin/dist
      - name: Go Build
        env:
          CGO_ENABLED: "0"
@@ -25,6 +25,16 @@ and is not suitable for actual deployment.
 Please see the comments within the file for more information;
 full configuration details can be found on Threshold's documentation site.

+#### Upgrading from the HashiCorp Boundary image
+
+The configuration directory moved from `/boundary` to `/threshold`. For
+compatibility, `/boundary` is a symlink to `/threshold` inside the image, a
+`-config /boundary/config.hcl` argument (or a config mounted at
+`/boundary/config.hcl`) is still honored with a deprecation warning, `boundary`
+is accepted as a command name, and `BOUNDARY_*` environment variables are
+mirrored to `THRESHOLD_*`. Please migrate your mounts and arguments to the
+`/threshold` and `THRESHOLD_*` names.
+
 ### Postgres

 The usage instructions in this README assume you have an external postgres database (version 12 or greater) to run threshold server with.
@@ -22,6 +22,54 @@ for legacy_name in $(env | sed -n 's/^\(BOUNDARY_[A-Za-z0-9_]*\)=.*/\1/p'); do
    fi
 done

+# Backwards compatibility: the legacy HashiCorp Boundary image kept its config
+# in /boundary/config.hcl and ran the "boundary" binary. Accept both.
+# (The *_TEST_* overrides exist only for .release/docker/test-entrypoint.sh.)
+NEW_CONFIG_PATH=${THRESHOLD_ENTRYPOINT_TEST_NEW:-/threshold/config.hcl}
+LEGACY_CONFIG_PATH=${THRESHOLD_ENTRYPOINT_TEST_LEGACY:-/boundary/config.hcl}
+STOCK_CONFIG_COPY=${THRESHOLD_ENTRYPOINT_TEST_STOCK:-/usr/share/threshold/config.hcl.default}
+
+legacy_warn() {
+    >&2 echo "WARNING: $1 (deprecated Boundary-era path); please move to /threshold/config.hcl"
+}
+
+# Prints the config path that should actually be used for a requested -config
+# path. Prefers /threshold/config.hcl, falling back to /boundary/config.hcl.
+resolve_config_path() {
+    case "$1" in
+    "$NEW_CONFIG_PATH")
+        # The image ships a stock demo config at /threshold/config.hcl. If it is
+        # still the stock one and the user supplied their own legacy config
+        # (for example by mounting it at /boundary/config.hcl on an image
+        # where /boundary is a real directory), use theirs.
+        if [ -f "$LEGACY_CONFIG_PATH" ] && ! [ "$LEGACY_CONFIG_PATH" -ef "$NEW_CONFIG_PATH" ] \
+            && [ -f "$STOCK_CONFIG_COPY" ] && cmp -s "$NEW_CONFIG_PATH" "$STOCK_CONFIG_COPY"; then
+            legacy_warn "using $LEGACY_CONFIG_PATH"
+            echo "$LEGACY_CONFIG_PATH"
+            return
+        fi
+        ;;
+    "$LEGACY_CONFIG_PATH")
+        if [ -f "$LEGACY_CONFIG_PATH" ]; then
+            legacy_warn "using $LEGACY_CONFIG_PATH"
+        elif [ -f "$NEW_CONFIG_PATH" ]; then
+            legacy_warn "$LEGACY_CONFIG_PATH not found, falling back to $NEW_CONFIG_PATH"
+            echo "$NEW_CONFIG_PATH"
+            return
+        fi
+        ;;
+    esac
+    echo "$1"
+}
+
+# Accept the legacy command name: "docker run <image> boundary ..." (or an
+# entrypoint/command override that invokes boundary) runs threshold.
+if [ "$1" = 'boundary' ]; then
+    >&2 echo "WARNING: the 'boundary' command is deprecated; use 'threshold' (running threshold)"
+    shift
+    set -- threshold "$@"
+fi
+
 # If the user is trying to run Threshold directly with some arguments, then
 # pass them to Threshold.
 if [ "${1:0:1}" = '-' ]; then
@@ -38,6 +86,26 @@ elif threshold --help "$1" 2>&1 | grep -q "threshold $1"; then
    set -- threshold "$@"
 fi

+# Rewrite -config arguments (see resolve_config_path).
+if [ "$1" = 'threshold' ]; then
+    _n=$#
+    _prev=""
+    while [ "$_n" -gt 0 ]; do
+        _a=$1
+        shift
+        _n=$((_n - 1))
+        case "$_prev" in
+        -config | --config) _new=$(resolve_config_path "$_a") ;;
+        *) _new=$_a ;;
+        esac
+        case "$_a" in
+        -config=* | --config=*) _new="${_a%%=*}=$(resolve_config_path "${_a#*=}")" ;;
+        esac
+        _prev=$_a
+        set -- "$@" "$_new"
+    done
+fi
+
 # If we are running Threshold, make sure it executes as the proper user.
 if [ "$1" = 'threshold' ]; then
 	is_root=0
@@ -51,6 +119,10 @@ if [ "$1" = 'threshold' ]; then
            if [ "$(stat -c %u /threshold)" != "$(id -u threshold)" ]; then
                chown -R threshold:threshold /threshold || echo "Could not chown /threshold (may not have appropriate permissions)"
            fi
+            # Legacy config dir, when it is a real directory (not the symlink to /threshold)
+            if [ -d /boundary ] && [ ! -L /boundary ] && [ "$(stat -c %u /boundary)" != "$(id -u threshold)" ]; then
+                chown -R threshold:threshold /boundary || echo "Could not chown /boundary (may not have appropriate permissions)"
+            fi
        else
            >&2 echo "SKIP_CHOWN not set but running non-root; skipping chown /threshold"
        fi
@@ -0,0 +1,107 @@
+#!/bin/bash
+# Self-contained test for the legacy-path handling in docker-entrypoint.sh.
+#
+# Runs the real entrypoint with a fake "threshold" binary and temporary
+# config paths (via the THRESHOLD_ENTRYPOINT_TEST_* overrides). No Docker or
+# root needed. The entrypoint is written for busybox/ash; bash is used here
+# because it accepts the same ${var:off:len} syntax.
+#
+# Usage: .release/docker/test-entrypoint.sh
+
+set -u
+
+HERE=$(cd "$(dirname "$0")" && pwd)
+ENTRY="$HERE/docker-entrypoint.sh"
+WORK=$(mktemp -d)
+trap 'rm -rf "$WORK"' EXIT
+
+FAILS=0
+PASSES=0
+check() { # check DESC EXPECTED ACTUAL
+	if [ "$2" = "$3" ]; then
+		PASSES=$((PASSES + 1))
+	else
+		FAILS=$((FAILS + 1))
+		echo "FAIL: $1" >&2
+		echo "  expected: $2" >&2
+		echo "  actual:   $3" >&2
+	fi
+}
+
+mkdir -p "$WORK/bin" "$WORK/new" "$WORK/legacy"
+# Fake threshold: print the argument vector on one line, "|"-separated.
+cat >"$WORK/bin/threshold" <<'EOF'
+#!/bin/sh
+case "$1" in --help) [ "$2" = threshold ] || echo "threshold $2"; exit 0 ;; esac
+IFS='|'
+echo "ARGS:$*"
+EOF
+cat >"$WORK/bin/su-exec" <<'EOF'
+#!/bin/sh
+shift
+exec "$@"
+EOF
+chmod 755 "$WORK/bin/threshold" "$WORK/bin/su-exec"
+
+NEWCFG="$WORK/new/config.hcl"
+LEGCFG="$WORK/legacy/config.hcl"
+STOCK="$WORK/stock.hcl"
+
+run() { # run ARGS... ; prints "<stdout-args> || <stderr>"
+	PATH="$WORK/bin:$PATH" SKIP_CHOWN=1 SKIP_SETCAP=1 \
+		THRESHOLD_ENTRYPOINT_TEST_NEW="$NEWCFG" \
+		THRESHOLD_ENTRYPOINT_TEST_LEGACY="$LEGCFG" \
+		THRESHOLD_ENTRYPOINT_TEST_STOCK="$STOCK" \
+		bash "$ENTRY" "$@" 2>"$WORK/err" | grep '^ARGS:'
+}
+stderr() { cat "$WORK/err"; }
+
+echo "stock demo config" >"$STOCK"
+cp "$STOCK" "$NEWCFG"
+
+# 1. default invocation, stock config, no legacy file -> unchanged, no warning
+out=$(run server -config "$NEWCFG")
+check "default path kept" "ARGS:server|-config|$NEWCFG" "$out"
+check "no warning by default" "" "$(stderr | grep -c deprecated | grep -v '^0$')"
+
+# 2. user's own /threshold config (differs from stock) wins over a legacy file
+echo "user threshold config" >"$NEWCFG"
+echo "user legacy config" >"$LEGCFG"
+out=$(run server -config "$NEWCFG")
+check "custom threshold config preferred" "ARGS:server|-config|$NEWCFG" "$out"
+
+# 3. stock /threshold config + user legacy config -> legacy used with warning
+cp "$STOCK" "$NEWCFG"
+out=$(run server -config "$NEWCFG")
+check "legacy config used when threshold is stock" "ARGS:server|-config|$LEGCFG" "$out"
+check "deprecation warning printed" "1" "$(stderr | grep -c 'WARNING.*Boundary-era')"
+
+# 4. explicit legacy path that exists -> used with warning
+out=$(run server -config "$LEGCFG")
+check "explicit legacy path kept" "ARGS:server|-config|$LEGCFG" "$out"
+check "explicit legacy warns" "1" "$(stderr | grep -c 'WARNING')"
+
+# 5. explicit legacy path that does not exist -> fall back to threshold path
+rm -f "$LEGCFG"
+out=$(run server -config "$LEGCFG")
+check "missing legacy falls back to threshold" "ARGS:server|-config|$NEWCFG" "$out"
+
+# 6. -config=PATH form
+echo "user legacy config" >"$LEGCFG"
+out=$(run server -config="$LEGCFG")
+check "-config=path form" "ARGS:server|-config=$LEGCFG" "$out"
+rm -f "$LEGCFG"
+out=$(run server -config="$LEGCFG")
+check "-config=path fallback" "ARGS:server|-config=$NEWCFG" "$out"
+
+# 7. legacy command name
+out=$(run boundary version)
+check "boundary command accepted" "ARGS:version" "$out"
+check "boundary command warns" "1" "$(stderr | grep -c "'boundary' command is deprecated")"
+
+# 8. unrelated args untouched
+out=$(run database init -config "$NEWCFG" -skip-auth-method-creation)
+check "other args preserved" "ARGS:database|init|-config|$NEWCFG|-skip-auth-method-creation" "$out"
+
+echo "passed: $PASSES, failed: $FAILS"
+[ "$FAILS" -eq 0 ]
@@ -5,6 +5,9 @@ StartLimitIntervalSec=60
 StartLimitBurst=3

 [Service]
+# Legacy HashiCorp Boundary environment file (BOUNDARY_* variables are still
+# honored). Read first so that threshold.env takes precedence.
+EnvironmentFile=-/etc/boundary.d/boundary.env
 EnvironmentFile=-/etc/threshold.d/threshold.env
 User=threshold
 Group=threshold
@@ -0,0 +1,163 @@
+#!/bin/sh
+# Threshold package post-install script (deb "postinst" / rpm "%post").
+#
+# Completes an in-place upgrade from a HashiCorp Boundary install. Safe to run
+# repeatedly; never deletes user configuration or data:
+#
+#   1. If the legacy "boundary" user exists and there is no "threshold" user,
+#      run the service as "boundary" through a systemd drop-in, so existing
+#      data/log directory ownership keeps working.
+#   2. Provide a "boundary" command: /usr/bin/boundary -> threshold, only if
+#      /usr/bin/boundary does not exist.
+#   3. If the legacy boundary.service is enabled/active: stop it, carry its
+#      enablement over to threshold.service, and start threshold.service if the
+#      old service was running (rolling back to boundary.service if that fails).
+#   4. Make "systemctl <verb> boundary" address threshold.service by adding a
+#      boundary.service alias symlink, unless something already exists there.
+#
+# THRESHOLD_PKG_ROOT exists only so the logic can be exercised by
+# .release/linux/test/test-package-scripts.sh without root; it is empty in
+# normal use.
+
+set -eu
+
+ROOT="${THRESHOLD_PKG_ROOT:-}"
+NEW_USER="threshold"
+LEGACY_USER="boundary"
+UNIT="threshold.service"
+LEGACY_UNIT="boundary.service"
+SYSTEMD_ETC="$ROOT/etc/systemd/system"
+DROPIN_DIR="$SYSTEMD_ETC/threshold.service.d"
+DROPIN="$DROPIN_DIR/10-legacy-boundary-user.conf"
+DROPIN_MARK="# Managed by the Threshold package (legacy boundary user reuse)"
+
+say() {
+	echo "threshold postinst: $*" >&2
+}
+
+user_exists() {
+	id -u "$1" >/dev/null 2>&1
+}
+
+have_systemd() {
+	command -v systemctl >/dev/null 2>&1 && [ -d "$ROOT/run/systemd/system" ]
+}
+
+# Print the Id= systemd resolves a unit name to (follows aliases).
+unit_id() {
+	systemctl show -p Id "$1" 2>/dev/null | sed -n 's/^Id=//p'
+}
+
+unit_load_state() {
+	systemctl show -p LoadState "$1" 2>/dev/null | sed -n 's/^LoadState=//p'
+}
+
+# Where the packaged threshold.service lives (merged-usr or not).
+packaged_unit_path() {
+	for _p in "$ROOT/usr/lib/systemd/system/$UNIT" "$ROOT/lib/systemd/system/$UNIT"; do
+		if [ -f "$_p" ]; then
+			echo "${_p#"$ROOT"}"
+			return 0
+		fi
+	done
+	return 1
+}
+
+# --- 1. legacy service user -------------------------------------------------
+if user_exists "$LEGACY_USER" && ! user_exists "$NEW_USER"; then
+	_group=$(id -gn "$LEGACY_USER" 2>/dev/null || echo "$LEGACY_USER")
+	_content="$DROPIN_MARK
+[Service]
+User=$LEGACY_USER
+Group=$_group"
+	if [ -e "$DROPIN" ] && ! grep -qF "$DROPIN_MARK" "$DROPIN"; then
+		say "leaving existing $DROPIN untouched (not managed by this package)"
+	else
+		mkdir -p "$DROPIN_DIR"
+		_tmp="$DROPIN.tmp.$$"
+		printf '%s\n' "$_content" >"$_tmp"
+		mv -f "$_tmp" "$DROPIN"
+		say "service will run as existing user '$LEGACY_USER' ($DROPIN)"
+	fi
+fi
+
+# --- 2. "boundary" command ----------------------------------------------------
+_bin="$ROOT/usr/bin/boundary"
+if [ ! -e "$_bin" ] && [ ! -L "$_bin" ]; then
+	if [ -e "$ROOT/usr/bin/threshold" ]; then
+		ln -s threshold "$_bin"
+	fi
+elif [ ! -L "$_bin" ]; then
+	say "/usr/bin/boundary is still the HashiCorp Boundary binary (old package installed); leaving it"
+	say "after removing the old package run: ln -s threshold /usr/bin/boundary"
+fi
+
+# --- 3 + 4. legacy systemd service ----------------------------------------------
+if have_systemd; then
+	_alias="$SYSTEMD_ETC/$LEGACY_UNIT"
+
+	if [ -L "$_alias" ]; then
+		# Already aliased (previous run): nothing to migrate.
+		:
+	elif [ -e "$_alias" ]; then
+		say "$_alias is a custom unit; not touching the legacy service."
+		say "move it away and re-run the package configuration to migrate."
+	else
+		_id=$(unit_id "$LEGACY_UNIT")
+		_load=$(unit_load_state "$LEGACY_UNIT")
+		_legacy_present=0
+		_was_enabled=0
+		_was_active=0
+		if [ "$_id" = "$LEGACY_UNIT" ] && [ "$_load" = "loaded" ]; then
+			_legacy_present=1
+			if systemctl is-enabled --quiet "$LEGACY_UNIT" 2>/dev/null; then
+				_was_enabled=1
+			fi
+			if systemctl is-active --quiet "$LEGACY_UNIT" 2>/dev/null; then
+				_was_active=1
+			fi
+		fi
+
+		# Only act on upgrades: a legacy unit or legacy config is present.
+		if [ "$_legacy_present" = 1 ] || [ -d "$ROOT/etc/boundary.d" ]; then
+			if [ "$_was_active" = 1 ]; then
+				say "stopping $LEGACY_UNIT"
+				systemctl stop "$LEGACY_UNIT" || say "could not stop $LEGACY_UNIT"
+			fi
+			if [ "$_was_enabled" = 1 ]; then
+				systemctl disable "$LEGACY_UNIT" >/dev/null 2>&1 || say "could not disable $LEGACY_UNIT"
+			fi
+
+			# Alias symlink so `systemctl restart boundary` reaches threshold.service.
+			if _unit_path=$(packaged_unit_path); then
+				mkdir -p "$SYSTEMD_ETC"
+				ln -s "$_unit_path" "$_alias"
+			fi
+			systemctl daemon-reload || true
+
+			if [ "$_was_enabled" = 1 ]; then
+				systemctl enable "$UNIT" >/dev/null 2>&1 || say "could not enable $UNIT"
+			fi
+			if [ "$_was_active" = 1 ]; then
+				if systemctl start "$UNIT"; then
+					say "$LEGACY_UNIT migrated to $UNIT (config: /etc/threshold.d)"
+				else
+					say "FAILED to start $UNIT; rolling back to $LEGACY_UNIT"
+					systemctl disable "$UNIT" >/dev/null 2>&1 || true
+					rm -f "$_alias"
+					systemctl daemon-reload || true
+					if [ "$_was_enabled" = 1 ]; then
+						systemctl enable "$LEGACY_UNIT" >/dev/null 2>&1 || true
+					fi
+					systemctl start "$LEGACY_UNIT" || say "could not restart $LEGACY_UNIT"
+				fi
+			elif [ "$_was_enabled" = 1 ]; then
+				say "$LEGACY_UNIT enablement carried over to $UNIT (not started: it was stopped)"
+			fi
+		fi
+	fi
+	# Pick up a new/changed user drop-in even when no migration was needed.
+	systemctl daemon-reload || true
+fi
+
+exit 0
@@ -1,8 +1,55 @@
-#!/bin/bash
+#!/bin/sh
+# Threshold package post-remove script (deb "postrm" / rpm "%postun").
+#
+# deb: $1 is remove|purge|upgrade|...    rpm: $1 is 0 (erase) or 1+ (upgrade)
+#
+# On final removal this removes only what the Threshold package scripts
+# themselves created: the managed systemd drop-in, the /usr/bin/boundary and
+# /etc/systemd/system/boundary.service symlinks (only if they point at
+# Threshold), and on purge the "threshold" user. User configuration, data and
+# the legacy "boundary" user are never touched.
+#
+# THRESHOLD_PKG_ROOT exists only so the logic can be exercised by
+# .release/linux/test/test-package-scripts.sh without root; it is empty in
+# normal use.

-if [ "$1" = "purge" ]
-then
-  userdel threshold
+set -eu
+
+ROOT="${THRESHOLD_PKG_ROOT:-}"
+SYSTEMD_ETC="$ROOT/etc/systemd/system"
+DROPIN_DIR="$SYSTEMD_ETC/threshold.service.d"
+DROPIN="$DROPIN_DIR/10-legacy-boundary-user.conf"
+DROPIN_MARK="# Managed by the Threshold package (legacy boundary user reuse)"
+
+# rm a symlink only if its target's basename matches $2.
+rm_link_if() {
+	if [ -L "$1" ]; then
+		_t=$(readlink "$1" || true)
+		case "${_t##*/}" in
+		"$2") rm -f "$1" ;;
+		esac
+	fi
+}
+
+case "${1:-}" in
+remove | purge | 0)
+	rm_link_if "$ROOT/usr/bin/boundary" threshold
+	rm_link_if "$SYSTEMD_ETC/boundary.service" threshold.service
+	rm_link_if "$SYSTEMD_ETC/multi-user.target.wants/threshold.service" threshold.service
+	if [ -f "$DROPIN" ] && grep -qF "$DROPIN_MARK" "$DROPIN"; then
+		rm -f "$DROPIN"
+		rmdir "$DROPIN_DIR" 2>/dev/null || true
+	fi
+	if command -v systemctl >/dev/null 2>&1 && [ -d "$ROOT/run/systemd/system" ]; then
+		systemctl daemon-reload >/dev/null 2>&1 || true
+	fi
+	;;
+esac
+
+if [ "${1:-}" = "purge" ]; then
+	if id -u threshold >/dev/null 2>&1; then
+		userdel threshold || true
+	fi
 fi

-exit 0
+exit 0
@@ -1,13 +1,98 @@
-#!/bin/bash
+#!/bin/sh
+# Threshold package pre-install script (deb "preinst" / rpm "%pre").
+#
+# Runs before the package files are unpacked. It is safe to run repeatedly and
+# never deletes or overwrites anything:
+#
+#   * Service user: if a HashiCorp Boundary "boundary" user already exists and
+#     there is no "threshold" user yet, no new user is created. The postinst
+#     script makes the service run as the existing "boundary" user so that its
+#     data/log directory ownership keeps working.
+#   * Configuration: files from /etc/boundary.d are COPIED to /etc/threshold.d
+#     (boundary.hcl -> threshold.hcl, boundary.env -> threshold.env, everything
+#     else keeps its name). An existing file in /etc/threshold.d is never
+#     replaced, and the originals in /etc/boundary.d are left untouched.
+#
+# THRESHOLD_PKG_ROOT exists only so the logic can be exercised by
+# .release/linux/test/test-package-scripts.sh without root; it is empty in
+# normal use.

 set -eu

-USER="threshold"
+ROOT="${THRESHOLD_PKG_ROOT:-}"
+NEW_USER="threshold"
+LEGACY_USER="boundary"
+LEGACY_DIR="$ROOT/etc/boundary.d"
+NEW_DIR="$ROOT/etc/threshold.d"

-if ! id -u $USER > /dev/null 2>&1; then
-	useradd \
-		--system \
-		--user-group \
-		--shell /bin/false \
-		$USER
-fi
+say() {
+	echo "threshold preinst: $*" >&2
+}
+
+user_exists() {
+	id -u "$1" >/dev/null 2>&1
+}
+
+# Map a top-level legacy file name to its Threshold name.
+map_name() {
+	case "$1" in
+	boundary.hcl) echo "threshold.hcl" ;;
+	boundary.env) echo "threshold.env" ;;
+	*) echo "$1" ;;
+	esac
+}
+
+# copy_tree SRC_DIR DST_DIR TOPLEVEL(0/1)
+# Copies entries that do not exist yet in DST_DIR; never overwrites.
+copy_tree() {
+	_src=$1
+	_dst=$2
+	_top=$3
+	for _f in "$_src"/* "$_src"/.[!.]*; do
+		if [ ! -e "$_f" ] && [ ! -L "$_f" ]; then
+			continue
+		fi
+		_name=${_f##*/}
+		if [ "$_top" = 1 ]; then
+			_name=$(map_name "$_name")
+		fi
+		_target="$_dst/$_name"
+		if [ -d "$_f" ] && [ ! -L "$_f" ]; then
+			if [ -d "$_target" ]; then
+				copy_tree "$_f" "$_target" 0
+			elif [ -e "$_target" ] || [ -L "$_target" ]; then
+				say "not replacing existing $_target"
+			else
+				cp -pR "$_f" "$_target"
+				say "copied $_f -> $_target"
+			fi
+		elif [ -e "$_target" ] || [ -L "$_target" ]; then
+			# Already present (user's own file, or a previous run): keep it.
+			:
+		else
+			cp -pP "$_f" "$_target"
+			say "copied $_f -> $_target"
+		fi
+	done
+}
+
+# --- service user -----------------------------------------------------------
+if ! user_exists "$NEW_USER"; then
+	if user_exists "$LEGACY_USER"; then
+		say "existing '$LEGACY_USER' user found; reusing it instead of creating '$NEW_USER'"
+	else
+		useradd \
+			--system \
+			--user-group \
+			--shell /bin/false \
+			"$NEW_USER"
+	fi
+fi
+
+# --- configuration migration ------------------------------------------------
+if [ -d "$LEGACY_DIR" ]; then
+	mkdir -p "$NEW_DIR"
+	copy_tree "$LEGACY_DIR" "$NEW_DIR" 1
+fi
+
+exit 0
@@ -0,0 +1,267 @@
+#!/bin/sh
+# Self-contained test for the Linux package scripts (preinst/postinst/postrm).
+#
+# Simulates an old HashiCorp Boundary layout in a temporary directory (fake
+# /etc/boundary.d, a "boundary" user, a running boundary.service) using the
+# THRESHOLD_PKG_ROOT prefix and fake id/useradd/userdel/systemctl commands.
+# Needs neither root nor systemd.
+#
+# Usage: .release/linux/test/test-package-scripts.sh
+
+set -eu
+
+HERE=$(cd "$(dirname "$0")" && pwd)
+PKG_DIR=$(cd "$HERE/.." && pwd)
+PREINST="$PKG_DIR/preinst"
+POSTINST="$PKG_DIR/postinst"
+POSTRM="$PKG_DIR/postrm"
+SH=${TEST_SH:-sh}
+
+WORK=$(mktemp -d)
+trap 'rm -rf "$WORK"' EXIT INT TERM
+
+FAILS=0
+PASSES=0
+
+pass() { PASSES=$((PASSES + 1)); }
+fail() {
+	FAILS=$((FAILS + 1))
+	echo "FAIL: $*" >&2
+}
+assert() { # assert DESC cmd...
+	_d=$1
+	shift
+	if "$@"; then pass; else fail "$_d"; fi
+}
+refute() { # refute DESC cmd...
+	_d=$1
+	shift
+	if "$@"; then fail "$_d"; else pass; fi
+}
+file_has() { grep -qF -- "$2" "$1"; }
+file_eq() { [ "$(cat "$1")" = "$2" ]; }
+
+# --- fake commands ------------------------------------------------------------
+BIN="$WORK/bin"
+mkdir -p "$BIN"
+
+cat >"$BIN/id" <<'EOF'
+#!/bin/sh
+# fake id: id -u NAME | id -gn NAME ; users in $FAKE/users as name:group
+mode=$1
+name=$2
+line=$(grep "^$name:" "$FAKE/users" 2>/dev/null) || exit 1
+case "$mode" in
+-u) echo 1000 ;;
+-gn) echo "${line#*:}" ;;
+esac
+EOF
+cat >"$BIN/useradd" <<'EOF'
+#!/bin/sh
+for a in "$@"; do name=$a; done
+echo "$name:$name" >>"$FAKE/users"
+echo "useradd $name" >>"$FAKE/calls"
+EOF
+cat >"$BIN/userdel" <<'EOF'
+#!/bin/sh
+grep -v "^$1:" "$FAKE/users" >"$FAKE/users.new" || true
+mv "$FAKE/users.new" "$FAKE/users"
+echo "userdel $1" >>"$FAKE/calls"
+EOF
+cat >"$BIN/systemctl" <<'EOF'
+#!/bin/sh
+# fake systemctl backed by files in $FAKE (state) and $THRESHOLD_PKG_ROOT
+resolve() {
+	if [ -L "$THRESHOLD_PKG_ROOT/etc/systemd/system/$1" ]; then
+		_t=$(readlink "$THRESHOLD_PKG_ROOT/etc/systemd/system/$1")
+		echo "${_t##*/}"
+	else
+		echo "$1"
+	fi
+}
+echo "systemctl $*" >>"$FAKE/calls"
+case "$1" in
+show)
+	u=$(resolve "$4")
+	case "$3" in
+	Id) echo "Id=$u" ;;
+	LoadState)
+		if [ -f "$THRESHOLD_PKG_ROOT/usr/lib/systemd/system/$u" ]; then
+			echo "LoadState=loaded"
+		else
+			echo "LoadState=not-found"
+		fi
+		;;
+	esac
+	;;
+is-enabled) u=$(resolve "$3"); [ -e "$FAKE/enabled/$u" ] ;;
+is-active) u=$(resolve "$3"); [ -e "$FAKE/active/$u" ] ;;
+enable) u=$(resolve "$2"); : >"$FAKE/enabled/$u" ;;
+disable) u=$(resolve "$2"); rm -f "$FAKE/enabled/$u" ;;
+start)
+	u=$(resolve "$2")
+	[ -e "$FAKE/fail_start/$u" ] && exit 1
+	: >"$FAKE/active/$u"
+	;;
+stop) u=$(resolve "$2"); rm -f "$FAKE/active/$u" ;;
+daemon-reload) : ;;
+esac
+exit $?
+EOF
+chmod 755 "$BIN"/*
+
+# --- scenario helpers -----------------------------------------------------------
+new_root() { # new_root NAME -> sets ROOT and FAKE, creates skeleton
+	ROOT="$WORK/$1/root"
+	FAKE="$WORK/$1/fake"
+	mkdir -p "$ROOT/etc" "$ROOT/usr/bin" "$ROOT/usr/lib/systemd/system" \
+		"$ROOT/etc/systemd/system" "$ROOT/run/systemd/system" \
+		"$FAKE/enabled" "$FAKE/active" "$FAKE/fail_start"
+	: >"$FAKE/users"
+	: >"$FAKE/calls"
+	# What the package itself would have unpacked.
+	: >"$ROOT/usr/bin/threshold"
+	echo "[Service]" >"$ROOT/usr/lib/systemd/system/threshold.service"
+	export THRESHOLD_PKG_ROOT="$ROOT" FAKE
+}
+
+run_script() { # run_script SCRIPT [ARGS...]
+	_s=$1
+	shift
+	PATH="$BIN:$PATH" "$SH" "$_s" "$@" >"$WORK/out.log" 2>&1
+}
+
+add_legacy_layout() {
+	mkdir -p "$ROOT/etc/boundary.d/tls"
+	echo 'controller { name = "mine" }' >"$ROOT/etc/boundary.d/boundary.hcl"
+	echo 'BOUNDARY_POSTGRES_URL=secret' >"$ROOT/etc/boundary.d/boundary.env"
+	echo 'worker { name = "w" }' >"$ROOT/etc/boundary.d/worker.hcl"
+	echo 'KEY' >"$ROOT/etc/boundary.d/tls/server.key"
+	chmod 600 "$ROOT/etc/boundary.d/tls/server.key"
+	echo "boundary:boundary" >>"$FAKE/users"
+	echo "[Service]" >"$ROOT/usr/lib/systemd/system/boundary.service"
+}
+
+# ==============================================================================
+echo "== scenario 1: upgrade from Boundary (running + enabled), existing threshold.hcl"
+new_root s1
+add_legacy_layout
+: >"$FAKE/enabled/boundary.service"
+: >"$FAKE/active/boundary.service"
+mkdir -p "$ROOT/etc/threshold.d"
+echo 'USER-OWNED' >"$ROOT/etc/threshold.d/threshold.hcl"
+
+assert "preinst succeeds" run_script "$PREINST" install
+assert "threshold.hcl NOT clobbered" file_eq "$ROOT/etc/threshold.d/threshold.hcl" "USER-OWNED"
+assert "boundary.env migrated to threshold.env" file_has "$ROOT/etc/threshold.d/threshold.env" "BOUNDARY_POSTGRES_URL=secret"
+assert "worker.hcl copied under same name" file_has "$ROOT/etc/threshold.d/worker.hcl" 'name = "w"'
+assert "subdirectory copied" file_has "$ROOT/etc/threshold.d/tls/server.key" "KEY"
+assert "originals kept: boundary.hcl" test -f "$ROOT/etc/boundary.d/boundary.hcl"
+assert "originals kept: boundary.env" test -f "$ROOT/etc/boundary.d/boundary.env"
+refute "no duplicate threshold user created" grep -q '^useradd' "$FAKE/calls"
+refute "no boundary.hcl name left in threshold.d" test -e "$ROOT/etc/threshold.d/boundary.hcl"
+
+assert "postinst succeeds" run_script "$POSTINST" configure
+assert "drop-in written" file_has "$ROOT/etc/systemd/system/threshold.service.d/10-legacy-boundary-user.conf" "User=boundary"
+assert "drop-in group" file_has "$ROOT/etc/systemd/system/threshold.service.d/10-legacy-boundary-user.conf" "Group=boundary"
+assert "boundary command symlink" test -L "$ROOT/usr/bin/boundary"
+assert "boundary symlink target is threshold" test "$(readlink "$ROOT/usr/bin/boundary")" = "threshold"
+assert "boundary.service alias symlink" test -L "$ROOT/etc/systemd/system/boundary.service"
+assert "legacy service stopped" test ! -e "$FAKE/active/boundary.service"
+assert "threshold enabled" test -e "$FAKE/enabled/threshold.service"
+assert "threshold started" test -e "$FAKE/active/threshold.service"
+refute "legacy unit not left enabled as itself" grep -q 'enable boundary.service' "$FAKE/calls"
+
+: >"$FAKE/calls"
+assert "postinst idempotent (2nd run)" run_script "$POSTINST" configure
+refute "2nd run does not stop/start anything" grep -qE 'systemctl (stop|start|enable|disable)' "$FAKE/calls"
+assert "preinst idempotent (2nd run)" run_script "$PREINST" upgrade
+assert "threshold.hcl still not clobbered" file_eq "$ROOT/etc/threshold.d/threshold.hcl" "USER-OWNED"
+
+echo "== scenario 1b: postrm remove/purge cleans only generated pieces"
+assert "postrm remove" run_script "$POSTRM" remove
+refute "boundary command symlink removed" test -L "$ROOT/usr/bin/boundary"
+refute "alias symlink removed" test -L "$ROOT/etc/systemd/system/boundary.service"
+refute "drop-in removed" test -e "$ROOT/etc/systemd/system/threshold.service.d/10-legacy-boundary-user.conf"
+assert "user config untouched after remove" test -f "$ROOT/etc/boundary.d/boundary.hcl"
+assert "migrated config untouched after remove" test -f "$ROOT/etc/threshold.d/threshold.env"
+assert "postrm purge (no threshold user: no userdel)" run_script "$POSTRM" purge
+refute "boundary user never deleted" grep -q 'userdel boundary' "$FAKE/calls"
+
+# ==============================================================================
+echo "== scenario 2: fresh install, no Boundary"
+new_root s2
+assert "preinst succeeds" run_script "$PREINST" install
+assert "threshold user created" grep -q '^useradd threshold' "$FAKE/calls"
+refute "no /etc/threshold.d created by migration" test -e "$ROOT/etc/threshold.d"
+assert "postinst succeeds" run_script "$POSTINST" configure
+refute "no drop-in" test -e "$ROOT/etc/systemd/system/threshold.service.d"
+refute "no boundary.service alias on fresh install" test -L "$ROOT/etc/systemd/system/boundary.service"
+assert "boundary command symlink still provided" test -L "$ROOT/usr/bin/boundary"
+refute "threshold not auto-enabled on fresh install" test -e "$FAKE/enabled/threshold.service"
+assert "postrm purge deletes threshold user" run_script "$POSTRM" purge
+assert "userdel threshold called" grep -q '^userdel threshold' "$FAKE/calls"
+
+# ==============================================================================
+echo "== scenario 3: boundary service enabled but threshold start fails -> rollback"
+new_root s3
+add_legacy_layout
+: >"$FAKE/enabled/boundary.service"
+: >"$FAKE/active/boundary.service"
+: >"$FAKE/fail_start/threshold.service"
+assert "preinst succeeds" run_script "$PREINST" install
+assert "postinst still exits 0" run_script "$POSTINST" configure
+assert "legacy service running again" test -e "$FAKE/active/boundary.service"
+assert "legacy service enabled again" test -e "$FAKE/enabled/boundary.service"
+refute "threshold left disabled" test -e "$FAKE/enabled/threshold.service"
+refute "alias removed on rollback" test -L "$ROOT/etc/systemd/system/boundary.service"
+assert "rollback explained" file_has "$WORK/out.log" "rolling back"
+
+# ==============================================================================
+echo "== scenario 4: enabled but stopped boundary service is only carried over"
+new_root s4
+add_legacy_layout
+: >"$FAKE/enabled/boundary.service"
+assert "preinst" run_script "$PREINST" install
+assert "postinst" run_script "$POSTINST" configure
+assert "threshold enabled" test -e "$FAKE/enabled/threshold.service"
+refute "threshold not started" test -e "$FAKE/active/threshold.service"
+
+# ==============================================================================
+echo "== scenario 5: custom regular-file /etc/systemd/system/boundary.service is left alone"
+new_root s5
+add_legacy_layout
+: >"$FAKE/enabled/boundary.service"
+: >"$FAKE/active/boundary.service"
+echo "CUSTOM" >"$ROOT/etc/systemd/system/boundary.service"
+assert "preinst" run_script "$PREINST" install
+assert "postinst" run_script "$POSTINST" configure
+assert "custom unit untouched" file_eq "$ROOT/etc/systemd/system/boundary.service" "CUSTOM"
+assert "legacy service still running" test -e "$FAKE/active/boundary.service"
+refute "threshold not started" test -e "$FAKE/active/threshold.service"
+
+# ==============================================================================
+echo "== scenario 6: old boundary package binary present is not replaced"
+new_root s6
+add_legacy_layout
+echo "OLDBIN" >"$ROOT/usr/bin/boundary"
+assert "preinst" run_script "$PREINST" install
+assert "postinst" run_script "$POSTINST" configure
+refute "boundary binary not turned into symlink" test -L "$ROOT/usr/bin/boundary"
+assert "boundary binary content kept" file_eq "$ROOT/usr/bin/boundary" "OLDBIN"
+assert "postrm remove does not delete the old binary" run_script "$POSTRM" remove
+assert "old binary still there" test -f "$ROOT/usr/bin/boundary"
+
+# ==============================================================================
+echo "== scenario 7: threshold user already exists alongside boundary -> no drop-in"
+new_root s7
+add_legacy_layout
+echo "threshold:threshold" >>"$FAKE/users"
+assert "preinst" run_script "$PREINST" install
+assert "postinst" run_script "$POSTINST" configure
+refute "no drop-in when threshold user exists" test -e "$ROOT/etc/systemd/system/threshold.service.d"
+
+# ==============================================================================
+echo
+echo "passed: $PASSES, failed: $FAILS"
+[ "$FAILS" -eq 0 ]
@@ -29,6 +29,13 @@ ADD .release/docker/config.hcl /threshold/config.hcl
 RUN chown -R threshold:threshold /threshold/
 RUN chmod -R 640 /threshold/*

+# Legacy HashiCorp Boundary compatibility: /boundary -> /threshold and a
+# "boundary" command alias (prints a deprecation notice on stderr).
+RUN mkdir -p /usr/share/threshold && \
+    cp /threshold/config.hcl /usr/share/threshold/config.hcl.default && \
+    ln -s /threshold /boundary && \
+    ln -s threshold /bin/boundary
+
 EXPOSE 9200 9201 9202
 VOLUME /threshold/

@@ -80,6 +87,13 @@ RUN setcap cap_ipc_lock=+ep /bin/$BIN_NAME
 RUN chown -R ${NAME}:${NAME} /threshold
 RUN chmod -R 640 /threshold/*

+# Legacy HashiCorp Boundary compatibility: /boundary -> /threshold and a
+# "boundary" command alias (prints a deprecation notice on stderr).
+RUN mkdir -p /usr/share/threshold && \
+    cp /threshold/config.hcl /usr/share/threshold/config.hcl.default && \
+    ln -s /threshold /boundary && \
+    ln -s ${BIN_NAME} /bin/boundary
+
 EXPOSE 9200 9201 9202
 VOLUME /threshold/

@@ -98,7 +98,7 @@ lint-diff:
 # Set env for all UI targets.
 UI_TARGETS := update-ui-version build-ui build-ui-ifne clean-ui
 # Note the extra .tmp path segment in UI_CLONE_DIR is significant and required.
-$(UI_TARGETS): export UI_CLONE_DIR      := internal/ui/.tmp/boundary-ui
+$(UI_TARGETS): export UI_CLONE_DIR      := internal/ui/.tmp/threshold-ui
 $(UI_TARGETS): export UI_VERSION_FILE   := internal/ui/VERSION
 $(UI_TARGETS): export UI_DEFAULT_BRANCH := main
 $(UI_TARGETS): export UI_COMMITISH ?=
@@ -127,7 +127,7 @@ clean-ui:

 .PHONY: build-ui-ifne
 build-ui-ifne:
-ifeq (,$(wildcard internal/ui/.tmp/boundary-ui/ui/admin/dist))
+ifeq (,$(wildcard internal/ui/.tmp/threshold-ui/ui/admin/dist))
 	@echo "==> No UI assets found, building..."
 	@$(MAKE) build-ui
 else
@@ -68,6 +68,117 @@ Other fallbacks:

 Tokens are always written using the new names.

+## Upgrading from Boundary
+
+Threshold is designed as an in-place replacement for HashiCorp Boundary CE:
+the same database, the same configuration files, and a binary that can still be
+invoked as `boundary`.
+
+### Compatibility guarantees
+
+These are unchanged from upstream Boundary CE, so a mixed fleet of Boundary and
+Threshold controllers and workers interoperates, and you can upgrade (and roll
+back) one node at a time:
+
+- **Database schema**: the schema migrations are untouched and the
+  `boundary_schema_version` table keeps its name. Threshold runs against an
+  existing Boundary database as-is (`threshold database migrate` applies the
+  same migrations Boundary would).
+- **Wire protocol**: protobuf packages, gRPC service names and the `/v1` HTTP
+  API paths are unchanged (only Go import paths were renamed). Versions are
+  still reported to peers with the `Boundary v` prefix.
+- **Plugin protocol**: the plugin magic cookie
+  (`HASHICORP_BOUNDARY_PLUGIN` / `boundary-plugin`) is unchanged, so existing
+  `boundary-plugin-*` binaries keep working.
+- **Configuration file format** (HCL) is unchanged.
+
+Do not run `database migrate` from a newer Threshold than your other nodes
+understand; as with Boundary, upgrade controllers before workers and follow the
+usual rolling-upgrade guidance for schema migrations.
+
+### Linux packages (deb/rpm)
+
+1. Back up `/etc/boundary.d` and take a database backup.
+2. Install the Threshold package. Do not `purge` the old `boundary` package
+   (removal is fine); purging runs its scripts, which may delete the `boundary`
+   user that Threshold will reuse. Installing Threshold while the old package is
+   still installed is supported.
+3. The package scripts then, automatically:
+   - **copy** `/etc/boundary.d` to `/etc/threshold.d` (`boundary.hcl` becomes
+     `threshold.hcl`, `boundary.env` becomes `threshold.env`; subdirectories such
+     as TLS material are copied as-is). Existing files in `/etc/threshold.d` are
+     never overwritten and the originals are never modified or deleted;
+   - keep reading `/etc/boundary.d/boundary.env` as a fallback environment file
+     (`threshold.env` takes precedence), so `BOUNDARY_*` variables keep working;
+   - reuse the existing `boundary` service user and group instead of creating a
+     `threshold` user (through a managed systemd drop-in,
+     `/etc/systemd/system/threshold.service.d/10-legacy-boundary-user.conf`), so
+     ownership of your data, log and key directories keeps working;
+   - if `boundary.service` was enabled and/or running, stop and disable it,
+     enable `threshold.service`, and start it if the old service was running.
+     If `threshold.service` fails to start, the old service is restored;
+   - make `systemctl restart boundary` (and `status`, `stop`, ...) address
+     `threshold.service` via a `boundary.service` alias symlink in
+     `/etc/systemd/system`, and provide `/usr/bin/boundary` as a symlink to
+     `threshold` if no such file exists. The `boundary` command prints a
+     one-line deprecation notice to **stderr** only (silence it with
+     `THRESHOLD_NO_DEPRECATION_NOTICE=1`); stdout, flags and exit codes are
+     identical to `threshold`.
+4. Verify: `systemctl status threshold`, `threshold version`.
+
+What is **not** migrated automatically:
+
+- Paths *inside* your configuration files are not rewritten. A config that
+  refers to `/etc/boundary.d/...` or `/var/lib/boundary` keeps working because
+  those locations are left in place; update them at your own pace.
+- A custom `/etc/systemd/system/boundary.service` unit (a regular file) is left
+  alone and the legacy service is not touched; migrate it by hand.
+- If `/usr/bin/boundary` is still the old binary from the Boundary package, it is
+  left alone. After removing the old package: `ln -s threshold /usr/bin/boundary`.
+- Distribution-specific package-manager behavior such as `--force-confnew` (dpkg)
+  can replace `/etc/threshold.d` defaults; your originals remain in
+  `/etc/boundary.d`.
+- Data directories, the database, KMS keys and the client cache are not moved
+  (the client cache directory is covered by the table above).
+
+Rollback: stop `threshold.service`, remove the `boundary.service` alias
+symlink (`/etc/systemd/system/boundary.service`) and the drop-in, reinstall the
+old Boundary package, and `systemctl enable --now boundary`. Because the
+database schema is unchanged and `/etc/boundary.d` was never modified, nothing
+else needs to be restored. If you ran a Threshold release that applied schema
+migrations newer than your Boundary version, restore the database backup
+instead.
+
+### Container image
+
+The image's configuration directory moved from `/boundary` to `/threshold`
+(default command: `threshold server -config /threshold/config.hcl`). For
+compatibility the image:
+
+- contains `/boundary` as a symlink to `/threshold`, so existing
+  `-v "$(pwd)":/boundary/` mounts land in the right place;
+- falls back to `/boundary/config.hcl` (printing a deprecation warning) when
+  `-config /boundary/config.hcl` is requested, or when the stock demo config is
+  still in place and a config exists at `/boundary/config.hcl`;
+- accepts `boundary ...` as the command and `BOUNDARY_*` environment variables
+  (mirrored to `THRESHOLD_*`).
+
+Plan to switch your mounts, `-config` arguments and environment variables to
+the `/threshold` and `THRESHOLD_*` names; the compatibility paths print
+warnings and may be removed in a future major release.
+
+### Other installs (binary / zip)
+
+Replace the `boundary` binary with `threshold` (or keep the file name
+`boundary`, which behaves identically). Existing `BOUNDARY_*` variables,
+`~/.boundary` and stored credentials are picked up as described above.
+
+### Development mode
+
+`threshold dev` creates the `ssh.threshold.dev` and `postgres.threshold.dev`
+aliases and, for compatibility, the legacy `ssh.boundary.dev` and
+`postgres.boundary.dev` aliases pointing at the same targets.
+
 ## Building

 ```
@@ -75,8 +186,13 @@ make build        # builds bin/threshold (requires the embedded UI, see Makefile
 make build-no-ui  # builds bin/threshold without the embedded admin UI
 ```

-The embedded admin UI is built from the upstream `boundary-ui` project and is
-not part of this repository.
+The embedded admin UI is built from
+[`CyberCoveLLC/threshold-ui`](https://repo.anhonesthost.net/CyberCoveLLC/threshold-ui),
+a rebranded community fork of HashiCorp's `boundary-ui`, and is not part of this
+repository. `internal/ui/VERSION` pins the UI commit; `make build-ui` clones that
+commit into `internal/ui/.tmp/threshold-ui` and builds `ui/admin/dist`
+(requires Node 22+ and pnpm 10). `make update-ui-version` moves the pin
+(`UI_COMMITISH=<sha|branch>`).

 ## Contributing

@@ -43,5 +43,3 @@ require (
 	google.golang.org/genproto/googleapis/api v0.0.0-20260817212433-ac3dfec99bb1 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 )
-
-replace repo.anhonesthost.net/CyberCoveLLC/threshold/sdk => ../sdk
@@ -145,3 +145,5 @@ gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15 h1:YR8cESwS4TdDjEe65xsg0ogR
 gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+repo.anhonesthost.net/CyberCoveLLC/threshold/sdk v0.1.0 h1:ExuSGqE1pA/1DnS5xrSK7kEhD+4g5hIJC5TgmwH5LAU=
+repo.anhonesthost.net/CyberCoveLLC/threshold/sdk v0.1.0/go.mod h1:cWxYF3tEkYEKTY76ub8kL+vdGmopO0YfJqJGGQJov7k=
@@ -10,5 +10,13 @@ import (
 )

 func main() {
+	// When invoked through the legacy "boundary" name (a symlink shipped in
+	// packages/images), print a one-line deprecation notice to stderr. Behavior
+	// is otherwise identical and stdout is never touched.
+	if len(os.Args) > 0 {
+		if notice := cmd.LegacyNameNotice(os.Args[0], os.Getenv); notice != "" {
+			_, _ = os.Stderr.WriteString(notice)
+		}
+	}
 	os.Exit(cmd.Run(os.Args[1:]))
 }
@@ -176,7 +176,7 @@ require (
 	github.com/mitchellh/go-homedir v1.1.0 // indirect
 	github.com/mitchellh/reflectwalk v1.0.2 // indirect
 	github.com/moby/docker-image-spec v1.3.1 // indirect
-	github.com/moby/sys/user v0.4.0 // indirect
+	github.com/moby/sys/user v0.4.1 // indirect
 	github.com/moby/term v0.5.2 // indirect
 	github.com/mtibben/percent v0.2.1 // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
@@ -398,8 +398,8 @@ github.com/moby/moby/api v1.53.0 h1:PihqG1ncw4W+8mZs69jlwGXdaYBeb5brF6BL7mPIS/w=
 github.com/moby/moby/api v1.53.0/go.mod h1:8mb+ReTlisw4pS6BRzCMts5M49W5M7bKt1cJy/YbAqc=
 github.com/moby/moby/client v0.2.2 h1:Pt4hRMCAIlyjL3cr8M5TrXCwKzguebPAc2do2ur7dEM=
 github.com/moby/moby/client v0.2.2/go.mod h1:2EkIPVNCqR05CMIzL1mfA07t0HvVUUOl85pasRz/GmQ=
-github.com/moby/sys/user v0.4.0 h1:jhcMKit7SA80hivmFJcbB1vqmw//wU61Zdui2eQXuMs=
-github.com/moby/sys/user v0.4.0/go.mod h1:bG+tYYYJgaMtRKgEmuueC0hJEAZWwtIbZTB+85uoHjs=
+github.com/moby/sys/user v0.4.1 h1:RgjRlaDKi/Xmyrz4t8lyzXT6v2ooFeO/7xtchmhVWE0=
+github.com/moby/sys/user v0.4.1/go.mod h1:E9QsW5WRe1kUAf7kW8hXKwu1uhsZEAdPLYHYSDudF4Y=
 github.com/moby/term v0.5.2 h1:6qk3FJAFDs6i/q3W/pQ97SX192qKfZgGjCQqfCJkgzQ=
 github.com/moby/term v0.5.2/go.mod h1:d3djjFCrjnB+fl8NJux+EJzu0msscUP+f8it8hPkFLc=
 github.com/morikuni/aec v1.0.0 h1:nP9CBfwrvYnBRgY6qfDQkygYDmYwOilePFkwzv4dU8A=
@@ -615,9 +615,11 @@ func (b *Server) CreateInitialTargetWithHostSources(ctx context.Context) (target
 }

 // Create targets that can be connected to using an alias. The three targets created are:
-//   - "postgres.boundary.dev": the Threshold dev postgres instance. Uses brokered credentials
+//   - "postgres.threshold.dev": the Threshold dev postgres instance. Uses brokered credentials
+//     (the legacy "postgres.boundary.dev" alias is also created)
 //   - "www.hashicorp.com": a web target
-//   - "ssh.boundary.dev": A localhost ssh target
+//   - "ssh.threshold.dev": A localhost ssh target (the legacy "ssh.boundary.dev"
+//     alias is also created)
 func (b *Server) CreateInitialTargetsWithAlias(ctx context.Context) error {
 	rw := db.New(b.Database)

@@ -679,14 +681,9 @@ func (b *Server) createSshAliasTarget(ctx context.Context, targetRepo *target.Re
 		return err
 	}

-	sshAlias := "ssh.boundary.dev"
-	a, err := aliastar.NewAlias(ctx, "global", sshAlias, aliastar.WithDestinationId(t.GetPublicId()))
-	if err != nil {
-		return fmt.Errorf("failed to create alias object %w", err)
-	}
-	_, err = aliasRepo.CreateAlias(ctx, a)
-	if err != nil {
-		return fmt.Errorf("failed to save alias to the db %w", err)
+	sshAlias := "ssh.threshold.dev"
+	if err := createDevAliases(ctx, aliasRepo, t.GetPublicId(), sshAlias, legacySshAlias); err != nil {
+		return err
 	}

 	b.InfoKeys = append(b.InfoKeys, "generated ssh target with alias")
@@ -694,6 +691,29 @@ func (b *Server) createSshAliasTarget(ctx context.Context, targetRepo *target.Re
 	return nil
 }

+// Legacy dev-mode alias names used by upstream HashiCorp Boundary. They are
+// still created, pointing at the same targets, so existing scripts and muscle
+// memory keep working.
+const (
+	legacySshAlias      = "ssh.boundary.dev"
+	legacyPostgresAlias = "postgres.boundary.dev"
+)
+
+// createDevAliases creates one alias per value, all pointing at the given
+// destination target.
+func createDevAliases(ctx context.Context, aliasRepo *aliastar.Repository, destinationId string, values ...string) error {
+	for _, v := range values {
+		a, err := aliastar.NewAlias(ctx, "global", v, aliastar.WithDestinationId(destinationId))
+		if err != nil {
+			return fmt.Errorf("failed to create alias object %w", err)
+		}
+		if _, err = aliasRepo.CreateAlias(ctx, a); err != nil {
+			return fmt.Errorf("failed to save alias to the db %w", err)
+		}
+	}
+	return nil
+}
+
 func (b *Server) createPostgresAliasTarget(ctx context.Context,
 	targetRepo *target.Repository,
 	aliasRepo *aliastar.Repository,
@@ -757,14 +777,9 @@ func (b *Server) createPostgresAliasTarget(ctx context.Context,
 		return fmt.Errorf("failed to associate cred to target: %w", err)
 	}

-	postgresAlias := "postgres.boundary.dev"
-	a, err := aliastar.NewAlias(ctx, "global", postgresAlias, aliastar.WithDestinationId(t.GetPublicId()))
-	if err != nil {
-		return fmt.Errorf("failed to create alias object %w", err)
-	}
-	_, err = aliasRepo.CreateAlias(ctx, a)
-	if err != nil {
-		return fmt.Errorf("failed to save alias to the db %w", err)
+	postgresAlias := "postgres.threshold.dev"
+	if err := createDevAliases(ctx, aliasRepo, t.GetPublicId(), postgresAlias, legacyPostgresAlias); err != nil {
+		return err
 	}

 	b.InfoKeys = append(b.InfoKeys, "generated postgres target with alias")
@@ -0,0 +1,49 @@
+// Copyright IBM Corp. 2020, 2026
+// SPDX-License-Identifier: BUSL-1.1
+
+package cmd
+
+import (
+	"path/filepath"
+	"strings"
+)
+
+// legacyBinaryName is the name of the upstream HashiCorp Boundary binary. A
+// "boundary" symlink to the threshold binary is shipped in packages and
+// container images so existing scripts keep working.
+const legacyBinaryName = "boundary"
+
+// envNoLegacyNameNotice, when set to a non-empty value, silences the
+// deprecation notice printed when the binary is invoked as "boundary".
+const envNoLegacyNameNotice = "THRESHOLD_NO_DEPRECATION_NOTICE"
+
+// invokedAsLegacyName reports whether argv0 refers to the legacy "boundary"
+// binary name. Directory components and a Windows ".exe" suffix are ignored.
+func invokedAsLegacyName(argv0 string) bool {
+	// Normalize Windows separators too, since filepath.Base on unix does not
+	// treat backslash as a separator.
+	argv0 = strings.ReplaceAll(argv0, `\`, "/")
+	base := strings.ToLower(filepath.Base(argv0))
+	base = strings.TrimSuffix(base, ".exe")
+	return base == legacyBinaryName
+}
+
+// LegacyNameNotice returns the one-line deprecation notice (including a
+// trailing newline) to write to stderr when the binary was invoked as
+// "boundary", or an empty string when no notice should be shown. No notice is
+// shown for any other invocation name, when shell completion is running
+// (COMP_LINE is set, so that a notice never corrupts the user's prompt), or
+// when THRESHOLD_NO_DEPRECATION_NOTICE is set. The notice is only ever written
+// to stderr so that machine-readable stdout output is unaffected.
+//
+// getenv is typically os.Getenv.
+func LegacyNameNotice(argv0 string, getenv func(string) string) string {
+	if !invokedAsLegacyName(argv0) {
+		return ""
+	}
+	if getenv("COMP_LINE") != "" || getenv(envNoLegacyNameNotice) != "" {
+		return ""
+	}
+	return "Note: the 'boundary' command name is deprecated; use 'threshold' instead. " +
+		"(Set " + envNoLegacyNameNotice + "=1 to silence this notice.)\n"
+}
@@ -0,0 +1,49 @@
+// Copyright IBM Corp. 2020, 2026
+// SPDX-License-Identifier: BUSL-1.1
+
+package cmd
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestInvokedAsLegacyName(t *testing.T) {
+	t.Parallel()
+	tests := []struct {
+		argv0 string
+		want  bool
+	}{
+		{"boundary", true},
+		{"/usr/bin/boundary", true},
+		{"./boundary", true},
+		{`C:\bin\boundary.exe`, true},
+		{"Boundary.EXE", true},
+		{"threshold", false},
+		{"/usr/bin/threshold", false},
+		{"boundary-worker", false},
+		{"", false},
+	}
+	for _, tt := range tests {
+		t.Run(tt.argv0, func(t *testing.T) {
+			assert.Equal(t, tt.want, invokedAsLegacyName(tt.argv0))
+		})
+	}
+}
+
+func TestLegacyNameNotice(t *testing.T) {
+	t.Parallel()
+	env := func(m map[string]string) func(string) string {
+		return func(k string) string { return m[k] }
+	}
+	n := LegacyNameNotice("/usr/bin/boundary", env(nil))
+	assert.True(t, strings.HasSuffix(n, "\n"))
+	assert.Equal(t, 1, strings.Count(n, "\n"), "notice must be a single line")
+	assert.Contains(t, n, "threshold")
+
+	assert.Empty(t, LegacyNameNotice("/usr/bin/threshold", env(nil)))
+	assert.Empty(t, LegacyNameNotice("boundary", env(map[string]string{"COMP_LINE": "boundary auth"})))
+	assert.Empty(t, LegacyNameNotice("boundary", env(map[string]string{envNoLegacyNameNotice: "1"})))
+}
@@ -1,4 +1,4 @@
-2766be2c2e941020878f837af6188eb500579e31
+8e63f6bd0fb415cdc354f0f5ebd66707fe7c31f0
 # This file determines the version of the UI to embed in the boundary binary.
 # Update this file by running 'make update-ui-version' from the root of this repo.
 # Set UI_COMMITISH when running the above target to update to a specific version.
@@ -13,11 +13,11 @@ import (
 )

 // Sadly we can't embed this into the embed line, but we use it elsewhere
-const contentDir = ".tmp/boundary-ui/ui/admin/dist"
+const contentDir = ".tmp/threshold-ui/ui/admin/dist"

 // content is our static web server content.
 //
-//go:embed .tmp/boundary-ui/ui/admin/dist
+//go:embed .tmp/threshold-ui/ui/admin/dist
 var content embed.FS

 func Handler() http.Handler {
@@ -0,0 +1,19 @@
+# Known, accepted findings. Revisit before ignoreUntil or when upstream publishes a fix.
+
+# github.com/docker/docker 28.5.2: no fixed version published yet. Test-only
+# transitive dependency (golang-migrate -> dktest, used by DB tests); no
+# non-test package imports it and govulncheck reports it as not reachable.
+[[IgnoredVulns]]
+id = "GO-2026-4883"
+ignoreUntil = 2026-12-31
+reason = "docker/docker has no fix; test-only transitive dep, not reachable"
+
+[[IgnoredVulns]]
+id = "GHSA-pxq6-2prw-chj9"
+ignoreUntil = 2026-12-31
+reason = "alias of GO-2026-4883; test-only, not reachable"
+
+[[IgnoredVulns]]
+id = "GO-2026-4887"
+ignoreUntil = 2026-12-31
+reason = "docker/docker has no fix; test-only transitive dep, not reachable"
@@ -1,34 +1,34 @@
-module github.com/hashicorp/boundary/plugins/boundary/mains/aws
+module repo.anhonesthost.net/CyberCoveLLC/threshold/plugins/boundary/mains/aws

 go 1.26.9

 require (
-	github.com/hashicorp/boundary-plugin-aws v0.5.2
-	github.com/hashicorp/boundary/sdk v0.0.58
+	repo.anhonesthost.net/CyberCoveLLC/threshold-plugin-aws v0.8.0
+	repo.anhonesthost.net/CyberCoveLLC/threshold/sdk v0.1.0
 )

 require (
-	github.com/aws/aws-sdk-go-v2 v1.41.5 // indirect
-	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.8 // indirect
+	github.com/aws/aws-sdk-go-v2 v1.41.7 // indirect
+	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.10 // indirect
 	github.com/aws/aws-sdk-go-v2/config v1.32.2 // indirect
 	github.com/aws/aws-sdk-go-v2/credentials v1.19.2 // indirect
 	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.14 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.21 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.21 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.23 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.23 // indirect
 	github.com/aws/aws-sdk-go-v2/internal/ini v1.8.4 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.22 // indirect
-	github.com/aws/aws-sdk-go-v2/service/ec2 v1.193.0 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.24 // indirect
+	github.com/aws/aws-sdk-go-v2/service/ec2 v1.254.0 // indirect
 	github.com/aws/aws-sdk-go-v2/service/iam v1.52.2 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.7 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.13 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.21 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.21 // indirect
-	github.com/aws/aws-sdk-go-v2/service/s3 v1.97.3 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.9 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.15 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.23 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.23 // indirect
+	github.com/aws/aws-sdk-go-v2/service/s3 v1.101.0 // indirect
 	github.com/aws/aws-sdk-go-v2/service/signin v1.0.2 // indirect
 	github.com/aws/aws-sdk-go-v2/service/sso v1.30.5 // indirect
 	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.10 // indirect
 	github.com/aws/aws-sdk-go-v2/service/sts v1.41.2 // indirect
-	github.com/aws/smithy-go v1.24.2 // indirect
+	github.com/aws/smithy-go v1.25.1 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/fatih/color v1.18.0 // indirect
 	github.com/golang/protobuf v1.5.4 // indirect
@@ -41,7 +41,7 @@ require (
 	github.com/hashicorp/go-kms-wrapping/v2 v2.0.20 // indirect
 	github.com/hashicorp/go-multierror v1.1.1 // indirect
 	github.com/hashicorp/go-plugin v1.7.0 // indirect
-	github.com/hashicorp/go-secure-stdlib/awsutil/v2 v2.1.2 // indirect
+	github.com/hashicorp/go-secure-stdlib/awsutil/v2 v2.1.3 // indirect
 	github.com/hashicorp/go-secure-stdlib/base62 v0.1.2 // indirect
 	github.com/hashicorp/go-secure-stdlib/parseutil v0.2.0 // indirect
 	github.com/hashicorp/go-secure-stdlib/pluginutil/v2 v2.0.8 // indirect
@@ -6,38 +6,38 @@ github.com/Masterminds/sprig/v3 v3.2.3 h1:eL2fZNezLomi0uOLqjQoN6BfsDD+fyLtgbJMAj
 github.com/Masterminds/sprig/v3 v3.2.3/go.mod h1:rXcFaZ2zZbLRJv/xSysmlgIM1u11eBaRMhvYXJNkGuM=
 github.com/armon/go-radix v1.0.0 h1:F4z6KzEeeQIMeLFa97iZU6vupzoecKdU5TX24SNppXI=
 github.com/armon/go-radix v1.0.0/go.mod h1:ufUuZ+zHj4x4TnLV4JWEpy2hxWSpsRywHrMgIH9cCH8=
-github.com/aws/aws-sdk-go-v2 v1.41.5 h1:dj5kopbwUsVUVFgO4Fi5BIT3t4WyqIDjGKCangnV/yY=
-github.com/aws/aws-sdk-go-v2 v1.41.5/go.mod h1:mwsPRE8ceUUpiTgF7QmQIJ7lgsKUPQOUl3o72QBrE1o=
-github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.8 h1:eBMB84YGghSocM7PsjmmPffTa+1FBUeNvGvFou6V/4o=
-github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.8/go.mod h1:lyw7GFp3qENLh7kwzf7iMzAxDn+NzjXEAGjKS2UOKqI=
+github.com/aws/aws-sdk-go-v2 v1.41.7 h1:DWpAJt66FmnnaRIOT/8ASTucrvuDPZASqhhLey6tLY8=
+github.com/aws/aws-sdk-go-v2 v1.41.7/go.mod h1:4LAfZOPHNVNQEckOACQx60Y8pSRjIkNZQz1w92xpMJc=
+github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.10 h1:gx1AwW1Iyk9Z9dD9F4akX5gnN3QZwUB20GGKH/I+Rho=
+github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.10/go.mod h1:qqY157uZoqm5OXq/amuaBJyC9hgBCBQnsaWnPe905GY=
 github.com/aws/aws-sdk-go-v2/config v1.32.2 h1:4liUsdEpUUPZs5WVapsJLx5NPmQhQdez7nYFcovrytk=
 github.com/aws/aws-sdk-go-v2/config v1.32.2/go.mod h1:l0hs06IFz1eCT+jTacU/qZtC33nvcnLADAPL/XyrkZI=
 github.com/aws/aws-sdk-go-v2/credentials v1.19.2 h1:qZry8VUyTK4VIo5aEdUcBjPZHL2v4FyQ3QEOaWcFLu4=
 github.com/aws/aws-sdk-go-v2/credentials v1.19.2/go.mod h1:YUqm5a1/kBnoK+/NY5WEiMocZihKSo15/tJdmdXnM5g=
 github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.14 h1:WZVR5DbDgxzA0BJeudId89Kmgy6DIU4ORpxwsVHz0qA=
 github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.14/go.mod h1:Dadl9QO0kHgbrH1GRqGiZdYtW5w+IXXaBNCHTIaheM4=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.21 h1:Rgg6wvjjtX8bNHcvi9OnXWwcE0a2vGpbwmtICOsvcf4=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.21/go.mod h1:A/kJFst/nm//cyqonihbdpQZwiUhhzpqTsdbhDdRF9c=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.21 h1:PEgGVtPoB6NTpPrBgqSE5hE/o47Ij9qk/SEZFbUOe9A=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.21/go.mod h1:p+hz+PRAYlY3zcpJhPwXlLC4C+kqn70WIHwnzAfs6ps=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.23 h1:GpT/TrnBYuE5gan2cZbTtvP+JlHsutdmlV2YfEyNde0=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.23/go.mod h1:xYWD6BS9ywC5bS3sz9Xh04whO/hzK2plt2Zkyrp4JuA=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.23 h1:bpd8vxhlQi2r1hiueOw02f/duEPTMK59Q4QMAoTTtTo=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.23/go.mod h1:15DfR2nw+CRHIk0tqNyifu3G1YdAOy68RftkhMDDwYk=
 github.com/aws/aws-sdk-go-v2/internal/ini v1.8.4 h1:WKuaxf++XKWlHWu9ECbMlha8WOEGm0OUEZqm4K/Gcfk=
 github.com/aws/aws-sdk-go-v2/internal/ini v1.8.4/go.mod h1:ZWy7j6v1vWGmPReu0iSGvRiise4YI5SkR3OHKTZ6Wuc=
-github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.22 h1:rWyie/PxDRIdhNf4DzRk0lvjVOqFJuNnO8WwaIRVxzQ=
-github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.22/go.mod h1:zd/JsJ4P7oGfUhXn1VyLqaRZwPmZwg44Jf2dS84Dm3Y=
-github.com/aws/aws-sdk-go-v2/service/ec2 v1.193.0 h1:RhSoBFT5/8tTmIseJUXM6INTXTQDF8+0oyxWBnozIms=
-github.com/aws/aws-sdk-go-v2/service/ec2 v1.193.0/go.mod h1:mzj8EEjIHSN2oZRXiw1Dd+uB4HZTl7hC8nBzX9IZMWw=
+github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.24 h1:OQqn11BtaYv1WLUowvcA30MpzIu8Ti4pcLPIIyoKZrA=
+github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.24/go.mod h1:X5ZJyfwVrWA96GzPmUCWFQaEARPR7gCrpq2E92PJwAE=
+github.com/aws/aws-sdk-go-v2/service/ec2 v1.254.0 h1:fTLR6dLDTGChAjecRPlVrKeznT0rVdzR4yn9Z68MTGk=
+github.com/aws/aws-sdk-go-v2/service/ec2 v1.254.0/go.mod h1:V0jbRy1/IPapnkqgXSwVOFB+u5pnCwd9S+R3pKWULC4=
 github.com/aws/aws-sdk-go-v2/service/iam v1.52.2 h1:li0ooCUfHIivHn8nB3LstP6HgdNefwu5gnXE4MLVz/U=
 github.com/aws/aws-sdk-go-v2/service/iam v1.52.2/go.mod h1:PuHz5kGh1jtsNpjezdYhRp7xgn6DzCNJJfQt7O7U9Aw=
-github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.7 h1:5EniKhLZe4xzL7a+fU3C2tfUN4nWIqlLesfrjkuPFTY=
-github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.7/go.mod h1:x0nZssQ3qZSnIcePWLvcoFisRXJzcTVvYpAAdYX8+GI=
-github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.13 h1:JRaIgADQS/U6uXDqlPiefP32yXTda7Kqfx+LgspooZM=
-github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.13/go.mod h1:CEuVn5WqOMilYl+tbccq8+N2ieCy0gVn3OtRb0vBNNM=
-github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.21 h1:c31//R3xgIJMSC8S6hEVq+38DcvUlgFY0FM6mSI5oto=
-github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.21/go.mod h1:r6+pf23ouCB718FUxaqzZdbpYFyDtehyZcmP5KL9FkA=
-github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.21 h1:ZlvrNcHSFFWURB8avufQq9gFsheUgjVD9536obIknfM=
-github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.21/go.mod h1:cv3TNhVrssKR0O/xxLJVRfd2oazSnZnkUeTf6ctUwfQ=
-github.com/aws/aws-sdk-go-v2/service/s3 v1.97.3 h1:HwxWTbTrIHm5qY+CAEur0s/figc3qwvLWsNkF4RPToo=
-github.com/aws/aws-sdk-go-v2/service/s3 v1.97.3/go.mod h1:uoA43SdFwacedBfSgfFSjjCvYe8aYBS7EnU5GZ/YKMM=
+github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.9 h1:FLudkZLt5ci0ozzgkVo8BJGwvqNaZbTWb3UcucAateA=
+github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.9/go.mod h1:w7wZ/s9qK7c8g4al+UyoF1Sp/Z45UwMGcqIzLWVQHWk=
+github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.15 h1:ieLCO1JxUWuxTZ1cRd0GAaeX7O6cIxnwk7tc1LsQhC4=
+github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.15/go.mod h1:e3IzZvQ3kAWNykvE0Tr0RDZCMFInMvhku3qNpcIQXhM=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.23 h1:pbrxO/kuIwgEsOPLkaHu0O+m4fNgLU8B3vxQ+72jTPw=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.23/go.mod h1:/CMNUqoj46HpS3MNRDEDIwcgEnrtZlKRaHNaHxIFpNA=
+github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.23 h1:03xatSQO4+AM1lTAbnRg5OK528EUg744nW7F73U8DKw=
+github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.23/go.mod h1:M8l3mwgx5ToK7wot2sBBce/ojzgnPzZXUV445gTSyE8=
+github.com/aws/aws-sdk-go-v2/service/s3 v1.101.0 h1:etqBTKY581iwLL/H/S2sVgk3C9lAsTJFeXWFDsDcWOU=
+github.com/aws/aws-sdk-go-v2/service/s3 v1.101.0/go.mod h1:L2dcoOgS2VSgbPLvpak2NyUPsO1TBN7M45Z4H7DlRc4=
 github.com/aws/aws-sdk-go-v2/service/signin v1.0.2 h1:MxMBdKTYBjPQChlJhi4qlEueqB1p1KcbTEa7tD5aqPs=
 github.com/aws/aws-sdk-go-v2/service/signin v1.0.2/go.mod h1:iS6EPmNeqCsGo+xQmXv0jIMjyYtQfnwg36zl2FwEouk=
 github.com/aws/aws-sdk-go-v2/service/sso v1.30.5 h1:ksUT5KtgpZd3SAiFJNJ0AFEJVva3gjBmN7eXUZjzUwQ=
@@ -46,8 +46,8 @@ github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.10 h1:GtsxyiF3Nd3JahRBJbxLCCd
 github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.10/go.mod h1:/j67Z5XBVDx8nZVp9EuFM9/BS5dvBznbqILGuu73hug=
 github.com/aws/aws-sdk-go-v2/service/sts v1.41.2 h1:a5UTtD4mHBU3t0o6aHQZFJTNKVfxFWfPX7J0Lr7G+uY=
 github.com/aws/aws-sdk-go-v2/service/sts v1.41.2/go.mod h1:6TxbXoDSgBQ225Qd8Q+MbxUxUh6TtNKwbRt/EPS9xso=
-github.com/aws/smithy-go v1.24.2 h1:FzA3bu/nt/vDvmnkg+R8Xl46gmzEDam6mZ1hzmwXFng=
-github.com/aws/smithy-go v1.24.2/go.mod h1:YE2RhdIuDbA5E5bTdciG9KrW3+TiEONeUWCqxX9i1Fc=
+github.com/aws/smithy-go v1.25.1 h1:J8ERsGSU7d+aCmdQur5Txg6bVoYelvQJgtZehD12GkI=
+github.com/aws/smithy-go v1.25.1/go.mod h1:YE2RhdIuDbA5E5bTdciG9KrW3+TiEONeUWCqxX9i1Fc=
 github.com/bgentry/speakeasy v0.1.0 h1:ByYyxL9InA1OWqxJqqp2A5pYHUrCiAL6K3J+LKSsQkY=
 github.com/bgentry/speakeasy v0.1.0/go.mod h1:+zsyZBPWlz7T6j88CTgSN5bM796AkVf0kBD4zp0CCIs=
 github.com/bufbuild/protocompile v0.14.1 h1:iA73zAf/fyljNjQKwYzUHD6AD4R8KMasmwa/FBatYVw=
@@ -67,10 +67,6 @@ github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/hashicorp/boundary-plugin-aws v0.5.2 h1:vt0e/dLNTSPE3fnCoRMN6BeYQd+2ByQ0RnxKcRsmi9w=
-github.com/hashicorp/boundary-plugin-aws v0.5.2/go.mod h1:hGiUb1Ktaqt1w8rLfd2VRh5R0uMIDE6e5DldPf9L0aw=
-github.com/hashicorp/boundary/sdk v0.0.58 h1:vkRFibdZEANlBMK950CjQP39EnnbV7X/mjwtL1sxq1Y=
-github.com/hashicorp/boundary/sdk v0.0.58/go.mod h1:VYwVGAEaHTzihRXpzKZL6EhWBhll59Iul3PGLVL63ao=
 github.com/hashicorp/cli v1.1.7 h1:/fZJ+hNdwfTSfsxMBa9WWMlfjUZbX8/LnUxgAd7lCVU=
 github.com/hashicorp/cli v1.1.7/go.mod h1:e6Mfpga9OCT1vqzFuoGZiiF/KaG9CbUfO5s3ghU3YgU=
 github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
@@ -92,8 +88,8 @@ github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+l
 github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
 github.com/hashicorp/go-plugin v1.7.0 h1:YghfQH/0QmPNc/AZMTFE3ac8fipZyZECHdDPshfk+mA=
 github.com/hashicorp/go-plugin v1.7.0/go.mod h1:BExt6KEaIYx804z8k4gRzRLEvxKVb+kn0NMcihqOqb8=
-github.com/hashicorp/go-secure-stdlib/awsutil/v2 v2.1.2 h1:KlDrZWx/wYpnUcFPB0s9uhPjyNZoeIfhrV2MN/Ly76s=
-github.com/hashicorp/go-secure-stdlib/awsutil/v2 v2.1.2/go.mod h1:6+rVulOPNCQbL3Xv2iLCqM0JmU2WO2wRzP1C6hBKeB8=
+github.com/hashicorp/go-secure-stdlib/awsutil/v2 v2.1.3 h1:mLe7IMysLSedhuu00W7AXsbfb90AA7UKfZmw3OkJ8n4=
+github.com/hashicorp/go-secure-stdlib/awsutil/v2 v2.1.3/go.mod h1:6+rVulOPNCQbL3Xv2iLCqM0JmU2WO2wRzP1C6hBKeB8=
 github.com/hashicorp/go-secure-stdlib/base62 v0.1.2 h1:ET4pqyjiGmY09R5y+rSd70J2w45CtbWDNvGqWp/R3Ng=
 github.com/hashicorp/go-secure-stdlib/base62 v0.1.2/go.mod h1:EdWO6czbmthiwZ3/PUsDV+UD1D5IRU4ActiaWGwt0Yw=
 github.com/hashicorp/go-secure-stdlib/configutil/v2 v2.0.13 h1:TayxZ5drfMP0G6T++WvnLESGLOWeHtdWDWWTAi2e3Qk=
@@ -202,3 +198,7 @@ gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntN
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+repo.anhonesthost.net/CyberCoveLLC/threshold-plugin-aws v0.8.0 h1:2QhSdC9IEmjGoVwKUA3BpXdNAhRyuibDLysT48qdX5Q=
+repo.anhonesthost.net/CyberCoveLLC/threshold-plugin-aws v0.8.0/go.mod h1:yVcnlD/mAQT7VuMmFPUG7uwFNyeH5th7rmShsORY3vs=
+repo.anhonesthost.net/CyberCoveLLC/threshold/sdk v0.1.0 h1:ExuSGqE1pA/1DnS5xrSK7kEhD+4g5hIJC5TgmwH5LAU=
+repo.anhonesthost.net/CyberCoveLLC/threshold/sdk v0.1.0/go.mod h1:cWxYF3tEkYEKTY76ub8kL+vdGmopO0YfJqJGGQJov7k=
@@ -7,8 +7,8 @@ import (
 	"fmt"
 	"os"

-	aws "github.com/hashicorp/boundary-plugin-aws/plugin"
-	hp "github.com/hashicorp/boundary/sdk/plugins"
+	aws "repo.anhonesthost.net/CyberCoveLLC/threshold-plugin-aws/plugin"
+	hp "repo.anhonesthost.net/CyberCoveLLC/threshold/sdk/plugins"
 )

 func main() {
@@ -1,10 +1,10 @@
-module github.com/hashicorp/boundary/plugins/boundary/mains/azure
+module repo.anhonesthost.net/CyberCoveLLC/threshold/plugins/boundary/mains/azure

 go 1.26.9

 require (
-	github.com/hashicorp/boundary-plugin-azure v0.2.0
-	github.com/hashicorp/boundary/sdk v0.0.58
+	repo.anhonesthost.net/CyberCoveLLC/threshold-plugin-azure v0.3.0
+	repo.anhonesthost.net/CyberCoveLLC/threshold/sdk v0.1.0
 )

 require (
@@ -153,10 +153,6 @@ github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/googleapis/gax-go/v2 v2.0.4/go.mod h1:0Wqv26UfaUD9n4G6kQubkQ+KchISgw+vpHVxEJEs9eg=
 github.com/googleapis/gax-go/v2 v2.0.5/go.mod h1:DWXyrwAJ9X0FpwwEdw+IPEYBICEFu5mhpdKc/us6bOk=
-github.com/hashicorp/boundary-plugin-azure v0.2.0 h1:JmsJamOb6IEWodQ7CJW9wJz09o+Q2fk1Cm0GnNruQuQ=
-github.com/hashicorp/boundary-plugin-azure v0.2.0/go.mod h1:V0zTGIqZQNYl9fl7q+NX13F4AyJ3pMGVlfopFfZr9O0=
-github.com/hashicorp/boundary/sdk v0.0.58 h1:vkRFibdZEANlBMK950CjQP39EnnbV7X/mjwtL1sxq1Y=
-github.com/hashicorp/boundary/sdk v0.0.58/go.mod h1:VYwVGAEaHTzihRXpzKZL6EhWBhll59Iul3PGLVL63ao=
 github.com/hashicorp/cli v1.1.7 h1:/fZJ+hNdwfTSfsxMBa9WWMlfjUZbX8/LnUxgAd7lCVU=
 github.com/hashicorp/cli v1.1.7/go.mod h1:e6Mfpga9OCT1vqzFuoGZiiF/KaG9CbUfO5s3ghU3YgU=
 github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
@@ -569,6 +565,10 @@ honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWh
 honnef.co/go/tools v0.0.1-2019.2.3/go.mod h1:a3bituU0lyd329TUQxRnasdCoJDkEUEAqEt0JzvZhAg=
 honnef.co/go/tools v0.0.1-2020.1.3/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
 honnef.co/go/tools v0.0.1-2020.1.4/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
+repo.anhonesthost.net/CyberCoveLLC/threshold-plugin-azure v0.3.0 h1:RTy3GlI9GFlJygIbCaLqBYNK8JofVddGK/AMQM+p7aA=
+repo.anhonesthost.net/CyberCoveLLC/threshold-plugin-azure v0.3.0/go.mod h1:ztBEnNknX6KvYBD7aKV0u46xWTRooegNP227RsPl3Gc=
+repo.anhonesthost.net/CyberCoveLLC/threshold/sdk v0.1.0 h1:ExuSGqE1pA/1DnS5xrSK7kEhD+4g5hIJC5TgmwH5LAU=
+repo.anhonesthost.net/CyberCoveLLC/threshold/sdk v0.1.0/go.mod h1:cWxYF3tEkYEKTY76ub8kL+vdGmopO0YfJqJGGQJov7k=
 rsc.io/binaryregexp v0.2.0/go.mod h1:qTv7/COck+e2FymRvadv62gMdZztPaShugOCi3I+8D8=
 rsc.io/quote/v3 v3.1.0/go.mod h1:yEA65RcK8LyAZtP9Kv3t0HmxON59tX3rD+tICJqUlj0=
 rsc.io/sampler v1.3.0/go.mod h1:T1hPZKmBbMNahiBKFy5HrXp6adAjACjK9JXDnKaTXpA=
@@ -7,8 +7,8 @@ import (
 	"fmt"
 	"os"

-	az "github.com/hashicorp/boundary-plugin-azure/plugin"
-	hp "github.com/hashicorp/boundary/sdk/plugins"
+	az "repo.anhonesthost.net/CyberCoveLLC/threshold-plugin-azure/plugin"
+	hp "repo.anhonesthost.net/CyberCoveLLC/threshold/sdk/plugins"
 )

 func main() {
@@ -1,10 +1,10 @@
-module github.com/hashicorp/boundary/plugins/boundary/mains/gcp
+module repo.anhonesthost.net/CyberCoveLLC/threshold/plugins/boundary/mains/gcp

 go 1.26.9

 require (
-	github.com/hashicorp/boundary-plugin-gcp v0.1.0
-	github.com/hashicorp/boundary/sdk v0.0.58
+	repo.anhonesthost.net/CyberCoveLLC/threshold-plugin-gcp v0.2.0
+	repo.anhonesthost.net/CyberCoveLLC/threshold/sdk v0.1.0
 )

 require (
@@ -63,10 +63,6 @@ github.com/googleapis/enterprise-certificate-proxy v0.3.21 h1:OFdQ3tnCX/zaQ0Cedu
 github.com/googleapis/enterprise-certificate-proxy v0.3.21/go.mod h1:L3D/IQExI6LqEjBdXcZQ1WluSgigQmSwBboFstVPM4w=
 github.com/googleapis/gax-go/v2 v2.23.0 h1:Tchl7qkvE7Ip3y+ztvNufYFvkfqTe7NfLTYGIdJRLuE=
 github.com/googleapis/gax-go/v2 v2.23.0/go.mod h1:rBQKOVJCdb8IFEzg+FCwlt1LP/xMDGuqUXhUG+XMXEg=
-github.com/hashicorp/boundary-plugin-gcp v0.1.0 h1:fIq07J0byp3qJ7aCC+oN+hLt11V5kjgzj3HpOa6r32o=
-github.com/hashicorp/boundary-plugin-gcp v0.1.0/go.mod h1:l15UQaKEEcppwrFGGVNBBVmAZqN5HaOk29dh5uVVztQ=
-github.com/hashicorp/boundary/sdk v0.0.58 h1:vkRFibdZEANlBMK950CjQP39EnnbV7X/mjwtL1sxq1Y=
-github.com/hashicorp/boundary/sdk v0.0.58/go.mod h1:VYwVGAEaHTzihRXpzKZL6EhWBhll59Iul3PGLVL63ao=
 github.com/hashicorp/cli v1.1.7 h1:/fZJ+hNdwfTSfsxMBa9WWMlfjUZbX8/LnUxgAd7lCVU=
 github.com/hashicorp/cli v1.1.7/go.mod h1:e6Mfpga9OCT1vqzFuoGZiiF/KaG9CbUfO5s3ghU3YgU=
 github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
@@ -218,3 +214,7 @@ gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntN
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+repo.anhonesthost.net/CyberCoveLLC/threshold-plugin-gcp v0.2.0 h1:rw4bCBHxBDFPX/Blmqo1+gik+04sXdKHISMjYHM1zW4=
+repo.anhonesthost.net/CyberCoveLLC/threshold-plugin-gcp v0.2.0/go.mod h1:rKjdEXM59o6Uhq62wsD4UBaLs7PTZl2PScqZ5Abe19w=
+repo.anhonesthost.net/CyberCoveLLC/threshold/sdk v0.1.0 h1:ExuSGqE1pA/1DnS5xrSK7kEhD+4g5hIJC5TgmwH5LAU=
+repo.anhonesthost.net/CyberCoveLLC/threshold/sdk v0.1.0/go.mod h1:cWxYF3tEkYEKTY76ub8kL+vdGmopO0YfJqJGGQJov7k=
@@ -7,8 +7,8 @@ import (
 	"fmt"
 	"os"

-	gcp "github.com/hashicorp/boundary-plugin-gcp/plugin"
-	hp "github.com/hashicorp/boundary/sdk/plugins"
+	gcp "repo.anhonesthost.net/CyberCoveLLC/threshold-plugin-gcp/plugin"
+	hp "repo.anhonesthost.net/CyberCoveLLC/threshold/sdk/plugins"
 )

 func main() {
@@ -1,21 +1,19 @@
-module github.com/hashicorp/boundary/plugins/boundary/mains/minio
+module repo.anhonesthost.net/CyberCoveLLC/threshold/plugins/boundary/mains/minio

 go 1.26.9

 require (
-	github.com/hashicorp/boundary-plugin-minio v0.1.7
-	github.com/hashicorp/boundary/sdk v0.0.58
+	repo.anhonesthost.net/CyberCoveLLC/threshold-plugin-minio v0.3.0
+	repo.anhonesthost.net/CyberCoveLLC/threshold/sdk v0.1.0
 )

 require (
+	github.com/cespare/xxhash/v2 v2.3.0 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/dustin/go-humanize v1.0.1 // indirect
-	github.com/fatih/color v1.18.0 // indirect
-	github.com/go-ini/ini v1.67.0 // indirect
-	github.com/goccy/go-json v0.10.4 // indirect
+	github.com/fatih/color v1.19.0 // indirect
 	github.com/golang/protobuf v1.5.4 // indirect
 	github.com/google/uuid v1.6.0 // indirect
-	github.com/hashicorp/boundary-plugin-minio/madmin v0.1.0 // indirect
 	github.com/hashicorp/errwrap v1.1.0 // indirect
 	github.com/hashicorp/eventlogger v0.2.11 // indirect
 	github.com/hashicorp/eventlogger/filters/encrypt v0.1.8-0.20231025104552-802587e608f0 // indirect
@@ -30,24 +28,29 @@ require (
 	github.com/hashicorp/go-sockaddr v1.0.7 // indirect
 	github.com/hashicorp/go-uuid v1.0.3 // indirect
 	github.com/hashicorp/yamux v0.1.2 // indirect
-	github.com/klauspost/compress v1.17.11 // indirect
-	github.com/klauspost/cpuid/v2 v2.2.9 // indirect
+	github.com/klauspost/compress v1.18.7 // indirect
+	github.com/klauspost/cpuid/v2 v2.2.11 // indirect
+	github.com/klauspost/crc32 v1.3.0 // indirect
 	github.com/kr/pretty v0.3.1 // indirect
 	github.com/mattn/go-colorable v0.1.14 // indirect
 	github.com/mattn/go-isatty v0.0.20 // indirect
+	github.com/minio/crc64nvme v1.1.1 // indirect
 	github.com/minio/md5-simd v1.1.2 // indirect
-	github.com/minio/minio-go/v7 v7.0.83 // indirect
+	github.com/minio/minio-go/v7 v7.2.0 // indirect
 	github.com/mitchellh/copystructure v1.2.0 // indirect
 	github.com/mitchellh/mapstructure v1.5.0 // indirect
 	github.com/mitchellh/pointerstructure v1.2.1 // indirect
 	github.com/mitchellh/reflectwalk v1.0.2 // indirect
 	github.com/oklog/run v1.1.0 // indirect
+	github.com/philhofer/fwd v1.2.0 // indirect
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
-	github.com/rogpeppe/go-internal v1.14.1 // indirect
 	github.com/rs/xid v1.6.0 // indirect
 	github.com/ryanuber/go-glob v1.0.0 // indirect
 	github.com/secure-io/sio-go v0.3.1 // indirect
 	github.com/stretchr/testify v1.11.1 // indirect
+	github.com/tinylib/msgp v1.6.1 // indirect
+	github.com/zeebo/xxh3 v1.1.0 // indirect
+	go.yaml.in/yaml/v3 v3.0.4 // indirect
 	golang.org/x/crypto v0.57.0 // indirect
 	golang.org/x/net v0.60.0 // indirect
 	golang.org/x/sys v0.48.0 // indirect
@@ -56,5 +59,7 @@ require (
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20260817212433-ac3dfec99bb1 // indirect
 	google.golang.org/grpc v1.85.0-dev.0.20260825072537-93e31b48545e // indirect
 	google.golang.org/protobuf v1.36.12 // indirect
+	gopkg.in/ini.v1 v1.67.2 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
+	repo.anhonesthost.net/CyberCoveLLC/threshold-plugin-minio/madmin v0.2.0 // indirect
 )
@@ -1,11 +1,11 @@
 dario.cat/mergo v1.0.0 h1:AGCNq9Evsj31mOgNPcLyXc+4PNABt905YmuqPYYpBWk=
 dario.cat/mergo v1.0.0/go.mod h1:uNxQE+84aUszobStD9th8a29P2fMDhsBdgRYvZOxGmk=
-github.com/Azure/go-ansiterm v0.0.0-20230124172434-306776ec8161 h1:L/gRVlceqvL25UVaW/CKtUDjefjrs0SPonmDGUVOYP0=
-github.com/Azure/go-ansiterm v0.0.0-20230124172434-306776ec8161/go.mod h1:xomTg63KZ2rFqZQzSB4Vz2SUXa1BpHTVz9L5PTmPC4E=
+github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c h1:udKWzYgxTojEKWjV8V+WSxDXJ4NFATAsZjh8iIbsQIg=
+github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c/go.mod h1:xomTg63KZ2rFqZQzSB4Vz2SUXa1BpHTVz9L5PTmPC4E=
 github.com/Masterminds/goutils v1.1.1 h1:5nUrii3FMTL5diU80unEVvNevw1nH4+ZV4DSLVJLSYI=
 github.com/Masterminds/goutils v1.1.1/go.mod h1:8cTjp+g8YejhMuvIA5y2vz3BpJxksy863GQaJW2MFNU=
-github.com/Masterminds/semver/v3 v3.2.0 h1:3MEsd0SM6jqZojhjLWWeBY+Kcjy9i6MQAeY7YgDP83g=
-github.com/Masterminds/semver/v3 v3.2.0/go.mod h1:qvl/7zhW3nngYb5+80sSMF+FG2BjYrf8m9wsX0PNOMQ=
+github.com/Masterminds/semver/v3 v3.5.0 h1:kQceYJfbupGfZOKZQg0kou0DgAKhzDg2NZPAwZ/2OOE=
+github.com/Masterminds/semver/v3 v3.5.0/go.mod h1:4V+yj/TJE1HU9XfppCwVMZq3I84lprf4nC11bSS5beM=
 github.com/Masterminds/sprig/v3 v3.2.3 h1:eL2fZNezLomi0uOLqjQoN6BfsDD+fyLtgbJMAj9n6YA=
 github.com/Masterminds/sprig/v3 v3.2.3/go.mod h1:rXcFaZ2zZbLRJv/xSysmlgIM1u11eBaRMhvYXJNkGuM=
 github.com/Microsoft/go-winio v0.6.2 h1:F2VQgta7ecxGYO8k3ZZz3RS8fVIXVxONVUPlNERoyfY=
@@ -20,33 +20,41 @@ github.com/bufbuild/protocompile v0.14.1 h1:iA73zAf/fyljNjQKwYzUHD6AD4R8KMasmwa/
 github.com/bufbuild/protocompile v0.14.1/go.mod h1:ppVdAIhbr2H8asPk6k4pY7t9zB1OU5DoEw9xY/FUi1c=
 github.com/cenkalti/backoff/v4 v4.3.0 h1:MyRJ/UdXutAwSAT+s3wNd7MfTIcy71VQueUuFK343L8=
 github.com/cenkalti/backoff/v4 v4.3.0/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyYozVcomhLiZE=
+github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
+github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
 github.com/containerd/continuity v0.4.3 h1:6HVkalIp+2u1ZLH1J/pYX2oBVXlJZvh1X1A7bEZ9Su8=
 github.com/containerd/continuity v0.4.3/go.mod h1:F6PTNCKepoxEaXLQp3wDAjygEnImnZ/7o4JzpodfroQ=
+github.com/containerd/errdefs v1.0.0 h1:tg5yIfIlQIrxYtu9ajqY42W3lpS19XqdxRQeEwYG8PI=
+github.com/containerd/errdefs v1.0.0/go.mod h1:+YBYIdtsnF4Iw6nWZhJcqGSg/dwvV7tyJ/kCkyJ2k+M=
+github.com/containerd/errdefs/pkg v0.3.0 h1:9IKJ06FvyNlexW690DXuQNx2KA2cUJXx151Xdx3ZPPE=
+github.com/containerd/errdefs/pkg v0.3.0/go.mod h1:NJw6s9HwNuRhnjJhM7pylWwMyAkmCQvQ4GpJHEqRLVk=
 github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/docker/cli v26.1.4+incompatible h1:I8PHdc0MtxEADqYJZvhBrW9bo8gawKwwenxRM7/rLu8=
-github.com/docker/cli v26.1.4+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
-github.com/docker/docker v27.5.0+incompatible h1:um++2NcQtGRTz5eEgO6aJimo6/JxrTXC941hd05JO6U=
-github.com/docker/docker v27.5.0+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
-github.com/docker/go-connections v0.5.0 h1:USnMq7hx7gwdVZq1L49hLXaFtUdTADjXGp+uj1Br63c=
-github.com/docker/go-connections v0.5.0/go.mod h1:ov60Kzw0kKElRwhNs9UlUHAE/F9Fe6GLaXnqyDdmEXc=
+github.com/distribution/reference v0.6.0 h1:0IXCQ5g4/QMHHkarYzh5l+u8T3t73zM5QvfrDyIgxBk=
+github.com/distribution/reference v0.6.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E=
+github.com/docker/cli v29.2.0+incompatible h1:9oBd9+YM7rxjZLfyMGxjraKBKE4/nVyvVfN4qNl9XRM=
+github.com/docker/cli v29.2.0+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
+github.com/docker/go-connections v0.6.0 h1:LlMG9azAe1TqfR7sO+NJttz1gy6KO7VJBh+pMmjSD94=
+github.com/docker/go-connections v0.6.0/go.mod h1:AahvXYshr6JgfUJGdDCs2b5EZG/vmaMAntpSFH5BFKE=
 github.com/docker/go-units v0.5.0 h1:69rxXcBk27SvSaaxTtLh/8llcHD8vYHT7WSdRZ/jvr4=
 github.com/docker/go-units v0.5.0/go.mod h1:fgPhTUdO+D/Jk86RDLlptpiXQzgHJF7gydDDbaIK4Dk=
 github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY=
 github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto=
 github.com/fatih/color v1.13.0/go.mod h1:kLAiJbzzSOZDVNGyDpeOxJ47H46qBXwg5ILebYFFOfk=
-github.com/fatih/color v1.18.0 h1:S8gINlzdQ840/4pfAwic/ZE0djQEH3wM94VfqLTZcOM=
-github.com/fatih/color v1.18.0/go.mod h1:4FelSpRwEGDpQ12mAdzqdOukCy4u8WUtOY6lkT/6HfU=
-github.com/go-ini/ini v1.67.0 h1:z6ZrTEZqSWOTyH2FlglNbNgARyHG8oLW9gMELqKr06A=
-github.com/go-ini/ini v1.67.0/go.mod h1:ByCAeIL28uOIIG0E3PJtZPDL8WnHpFKFOtgjp+3Ies8=
+github.com/fatih/color v1.19.0 h1:Zp3PiM21/9Ld6FzSKyL5c/BULoe/ONr9KlbYVOfG8+w=
+github.com/fatih/color v1.19.0/go.mod h1:zNk67I0ZUT1bEGsSGyCZYZNrHuTkJJB+r6Q9VuMi0LE=
+github.com/felixge/httpsnoop v1.1.0 h1:3YtUj32ZZkqZtt3sZZsClsymw/QDuVfpNhoA31zeORc=
+github.com/felixge/httpsnoop v1.1.0/go.mod h1:Zqxgdd+1Rkcz8euOqdr7lqgCRJztwr5hp9vDSi5UZCE=
+github.com/go-logr/logr v1.4.4 h1:tG4xh9yMsRCAiodLVTxyrkzSZ9+o0L1Kg/+cPVcbP/8=
+github.com/go-logr/logr v1.4.4/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
+github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
+github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
 github.com/go-test/deep v1.1.1 h1:0r/53hagsehfO4bzD2Pgr/+RgHqhmf+k1Bpse2cTu1U=
 github.com/go-test/deep v1.1.1/go.mod h1:5C2ZWiW0ErCdrYzpqxLbTX7MG14M9iiw8DgHncVwcsE=
-github.com/goccy/go-json v0.10.4 h1:JSwxQzIqKfmFX1swYPpUThQZp/Ka4wzJdK0LWVytLPM=
-github.com/goccy/go-json v0.10.4/go.mod h1:oq7eo15ShAhp70Anwd5lgX2pLfOS3QCiwU/PULtXL6M=
-github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
-github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
+github.com/go-viper/mapstructure/v2 v2.5.0 h1:vM5IJoUAy3d7zRSVtIwQgBj7BiWtMPfmPEgAXnvj1Ro=
+github.com/go-viper/mapstructure/v2 v2.5.0/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM=
 github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
 github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
@@ -55,12 +63,6 @@ github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 h1:El6M4kTTCOh6aBiKaU
 github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510/go.mod h1:pupxD2MaaD3pAXIBCelhxNneeOaAeabZDe5s4K6zSpQ=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/hashicorp/boundary-plugin-minio v0.1.7 h1:s6VVeYor6jm6+RtEjAgRahrsi6HW5NMOoY9RhjVXBwo=
-github.com/hashicorp/boundary-plugin-minio v0.1.7/go.mod h1:x7qnQE0bGwsRCiBXMMad1u+nhsLAa2Jpbpu9P3ysNQ0=
-github.com/hashicorp/boundary-plugin-minio/madmin v0.1.0 h1:VH/D4t0L3wmVPn7a1DDqF4nSOTGuWktXLnDny98y63Y=
-github.com/hashicorp/boundary-plugin-minio/madmin v0.1.0/go.mod h1:y0Q45edl67+Q8CVtnMpDeneusJv8ypMXWrKDyTA82qI=
-github.com/hashicorp/boundary/sdk v0.0.58 h1:vkRFibdZEANlBMK950CjQP39EnnbV7X/mjwtL1sxq1Y=
-github.com/hashicorp/boundary/sdk v0.0.58/go.mod h1:VYwVGAEaHTzihRXpzKZL6EhWBhll59Iul3PGLVL63ao=
 github.com/hashicorp/cli v1.1.7 h1:/fZJ+hNdwfTSfsxMBa9WWMlfjUZbX8/LnUxgAd7lCVU=
 github.com/hashicorp/cli v1.1.7/go.mod h1:e6Mfpga9OCT1vqzFuoGZiiF/KaG9CbUfO5s3ghU3YgU=
 github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
@@ -113,11 +115,13 @@ github.com/jefferai/isbadcipher v0.0.0-20190226160619-51d2077c035f h1:E87tDTVS5W
 github.com/jefferai/isbadcipher v0.0.0-20190226160619-51d2077c035f/go.mod h1:3J2qVK16Lq8V+wfiL2lPeDZ7UWMxk5LemerHa1p6N00=
 github.com/jhump/protoreflect v1.17.0 h1:qOEr613fac2lOuTgWN4tPAtLL7fUSbuJL5X5XumQh94=
 github.com/jhump/protoreflect v1.17.0/go.mod h1:h9+vUUL38jiBzck8ck+6G/aeMX8Z4QUY/NiJPwPNi+8=
-github.com/klauspost/compress v1.17.11 h1:In6xLpyWOi1+C7tXUUWv2ot1QvBjxevKAaI6IXrJmUc=
-github.com/klauspost/compress v1.17.11/go.mod h1:pMDklpSncoRMuLFrf1W9Ss9KT+0rH90U12bZKk7uwG0=
+github.com/klauspost/compress v1.18.7 h1:aUyZsS4kH3QTKurYhAOwAHxllVPnOthb3vPfnF1Ehjw=
+github.com/klauspost/compress v1.18.7/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
 github.com/klauspost/cpuid/v2 v2.0.1/go.mod h1:FInQzS24/EEf25PyTYn52gqo7WaD8xa0213Md/qVLRg=
-github.com/klauspost/cpuid/v2 v2.2.9 h1:66ze0taIn2H33fBvCkXuv9BmCwDfafmiIVpKV9kKGuY=
-github.com/klauspost/cpuid/v2 v2.2.9/go.mod h1:rqkxqrZ1EhYM9G+hXH7YdowN5R5RGN6NK4QwQ3WMXF8=
+github.com/klauspost/cpuid/v2 v2.2.11 h1:0OwqZRYI2rFrjS4kvkDnqJkKHdHaRnCm68/DY4OxRzU=
+github.com/klauspost/cpuid/v2 v2.2.11/go.mod h1:hqwkgyIinND0mEev00jJYCxPNVRVXFQeu1XKlok6oO0=
+github.com/klauspost/crc32 v1.3.0 h1:sSmTt3gUt81RP655XGZPElI0PelVTZ6YwCRnPSupoFM=
+github.com/klauspost/crc32 v1.3.0/go.mod h1:D7kQaZhnkX/Y0tstFGf8VUzv2UofNGqCjnC3zdHB0Hw=
 github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
 github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
@@ -130,10 +134,12 @@ github.com/mattn/go-isatty v0.0.12/go.mod h1:cbi8OIDigv2wuxKPP5vlRcQ1OAZbq2CE4Ky
 github.com/mattn/go-isatty v0.0.14/go.mod h1:7GGIvUiUoEMVVmxf/4nioHXj79iQHKdU27kJ6hsGG94=
 github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
 github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
+github.com/minio/crc64nvme v1.1.1 h1:8dwx/Pz49suywbO+auHCBpCtlW1OfpcLN7wYgVR6wAI=
+github.com/minio/crc64nvme v1.1.1/go.mod h1:eVfm2fAzLlxMdUGc0EEBGSMmPwmXD5XiNRpnu9J3bvg=
 github.com/minio/md5-simd v1.1.2 h1:Gdi1DZK69+ZVMoNHRXJyNcxrMA4dSxoYHZSQbirFg34=
 github.com/minio/md5-simd v1.1.2/go.mod h1:MzdKDxYpY2BT9XQFocsiZf/NKVtR7nkE4RoEpN+20RM=
-github.com/minio/minio-go/v7 v7.0.83 h1:W4Kokksvlz3OKf3OqIlzDNKd4MERlC2oN8YptwJ0+GA=
-github.com/minio/minio-go/v7 v7.0.83/go.mod h1:57YXpvc5l3rjPdhqNrDsvVlY0qPI6UTk1bflAe+9doY=
+github.com/minio/minio-go/v7 v7.2.0 h1:RCJM0R1XOsRs+A3x3UCaf3ZYbByDaLjFeAi+YCQEPhs=
+github.com/minio/minio-go/v7 v7.2.0/go.mod h1:EU9hENAStx/xXduNdrGO5e4X5vk19NtgB+RIPjZO8o0=
 github.com/mitchellh/copystructure v1.2.0 h1:vpKXTN4ewci03Vljg/q9QvCGUDttBOGBIa15WveJJGw=
 github.com/mitchellh/copystructure v1.2.0/go.mod h1:qLl+cE2AmVv+CoeAwDPye/v+N2HKCj9FbZEVFJRxO9s=
 github.com/mitchellh/mapstructure v1.4.1/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
@@ -145,21 +151,27 @@ github.com/mitchellh/reflectwalk v1.0.2 h1:G2LzWKi524PWgd3mLHV8Y5k7s6XUvT0Gef6zx
 github.com/mitchellh/reflectwalk v1.0.2/go.mod h1:mSTlrgnPZtwu0c4WaC2kGObEpuNDbx0jmZXqmk4esnw=
 github.com/moby/docker-image-spec v1.3.1 h1:jMKff3w6PgbfSa69GfNg+zN/XLhfXJGnEx3Nl2EsFP0=
 github.com/moby/docker-image-spec v1.3.1/go.mod h1:eKmb5VW8vQEh/BAr2yvVNvuiJuY6UIocYsFu/DxxRpo=
-github.com/moby/term v0.5.0 h1:xt8Q1nalod/v7BqbG21f8mQPqH+xAaC9C3N3wfWbVP0=
-github.com/moby/term v0.5.0/go.mod h1:8FzsFHVUBGZdbDsJw/ot+X+d5HLUbvklYLJ9uGfcI3Y=
+github.com/moby/moby/api v1.53.0 h1:PihqG1ncw4W+8mZs69jlwGXdaYBeb5brF6BL7mPIS/w=
+github.com/moby/moby/api v1.53.0/go.mod h1:8mb+ReTlisw4pS6BRzCMts5M49W5M7bKt1cJy/YbAqc=
+github.com/moby/moby/client v0.2.2 h1:Pt4hRMCAIlyjL3cr8M5TrXCwKzguebPAc2do2ur7dEM=
+github.com/moby/moby/client v0.2.2/go.mod h1:2EkIPVNCqR05CMIzL1mfA07t0HvVUUOl85pasRz/GmQ=
+github.com/moby/sys/user v0.4.0 h1:jhcMKit7SA80hivmFJcbB1vqmw//wU61Zdui2eQXuMs=
+github.com/moby/sys/user v0.4.0/go.mod h1:bG+tYYYJgaMtRKgEmuueC0hJEAZWwtIbZTB+85uoHjs=
+github.com/moby/term v0.5.2 h1:6qk3FJAFDs6i/q3W/pQ97SX192qKfZgGjCQqfCJkgzQ=
+github.com/moby/term v0.5.2/go.mod h1:d3djjFCrjnB+fl8NJux+EJzu0msscUP+f8it8hPkFLc=
 github.com/oklog/run v1.1.0 h1:GEenZ1cK0+q0+wsJew9qUg/DyD8k3JzYsZAi5gYi2mA=
 github.com/oklog/run v1.1.0/go.mod h1:sVPdnTZT1zYwAJeCMu2Th4T21pA3FPOQRfWjQlk7DVU=
 github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U=
 github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM=
-github.com/opencontainers/image-spec v1.1.0 h1:8SG7/vwALn54lVB/0yZ/MMwhFrPYtpEHQb2IpWsCzug=
-github.com/opencontainers/image-spec v1.1.0/go.mod h1:W4s4sFTMaBeK1BQLXbG4AdM2szdn85PY75RI83NrTrM=
-github.com/opencontainers/runc v1.1.14 h1:rgSuzbmgz5DUJjeSnw337TxDbRuqjs6iqQck/2weR6w=
-github.com/opencontainers/runc v1.1.14/go.mod h1:E4C2z+7BxR7GHXp0hAY53mek+x49X1LjPNeMTfRGvOA=
+github.com/opencontainers/image-spec v1.1.1 h1:y0fUlFfIZhPF1W537XOLg0/fcx6zcHCJwooC2xJA040=
+github.com/opencontainers/image-spec v1.1.1/go.mod h1:qpqAh3Dmcf36wStyyWU+kCeDgrGnAve2nCC8+7h8Q0M=
+github.com/opencontainers/runc v1.3.6 h1:SLGIymCtsk80iNPWgbc8dtjI30r+5mTVV+4dN8/17Sk=
+github.com/opencontainers/runc v1.3.6/go.mod h1:o1wyv76EDlTkcf0KTFgN8bMWLPvgF/HfX709lDv+rr4=
 github.com/ory/dockertest/v3 v3.11.0 h1:OiHcxKAvSDUwsEVh2BjxQQc/5EHz9n0va9awCtNGuyA=
 github.com/ory/dockertest/v3 v3.11.0/go.mod h1:VIPxS1gwT9NpPOrfD3rACs8Y9Z7yhzO4SB194iUDnUI=
+github.com/philhofer/fwd v1.2.0 h1:e6DnBTl7vGY+Gz322/ASL4Gyp1FspeMvx1RNDoToZuM=
+github.com/philhofer/fwd v1.2.0/go.mod h1:RqIHx9QI14HlwKwm98g9Re5prTQ6LdeRQn+gXJFxsJM=
 github.com/pkg/diff v0.0.0-20210226163009-20ebb0f2a09e/go.mod h1:pJLUxLENpZxwdsKMEsNbx1VGcRFpLqf3715MtcvvzbA=
-github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
-github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
@@ -176,22 +188,46 @@ github.com/secure-io/sio-go v0.3.1 h1:dNvY9awjabXTYGsTF1PiCySl9Ltofk9GA3VdWlo7rR
 github.com/secure-io/sio-go v0.3.1/go.mod h1:+xbkjDzPjwh4Axd07pRKSNriS9SCiYksWnZqdnfpQxs=
 github.com/shopspring/decimal v1.3.1 h1:2Usl1nmF/WZucqkFZhnfFYxxxu8LG21F6nPQBE5gKV8=
 github.com/shopspring/decimal v1.3.1/go.mod h1:DKyhrW/HYNuLGql+MJL6WCR6knT2jwCFRcu2hWCYk4o=
-github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
-github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
+github.com/sirupsen/logrus v1.9.4 h1:TsZE7l11zFCLZnZ+teH4Umoq5BhEIfIzfRDZ1Uzql2w=
+github.com/sirupsen/logrus v1.9.4/go.mod h1:ftWc9WdOfJ0a92nsE2jF5u5ZwH8Bv2zdeOC42RjbV2g=
 github.com/spf13/cast v1.5.0 h1:rj3WzYc11XZaIZMPKmwP96zkFEnnAmV8s6XbB2aY32w=
 github.com/spf13/cast v1.5.0/go.mod h1:SpXXQ5YoyJw6s3/6cMTQuxvgRl3PCJiyaX9p6b155UU=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
+github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
+github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA=
+github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
 github.com/stretchr/testify v1.7.2/go.mod h1:R6va5+xMeoiuVRoj+gSkQ7d3FALtqAAGI1FQKckRals=
+github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
+github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
 github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
 github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
+github.com/tinylib/msgp v1.6.1 h1:ESRv8eL3u+DNHUoSAAQRE50Hm162zqAnBoGv9PzScPY=
+github.com/tinylib/msgp v1.6.1/go.mod h1:RSp0LW9oSxFut3KzESt5Voq4GVWyS+PSulT77roAqEA=
 github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb h1:zGWFAtiMcyryUHoUjUJX0/lt1H2+i2Ka2n+D3DImSNo=
 github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb/go.mod h1:N2zxlSyiKSe5eX1tZViRH5QA0qijqEDrYZiPEAiq3wU=
 github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 h1:EzJWgHovont7NscjpAxXsDA8S8BMYve8Y5+7cuRE7R0=
 github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415/go.mod h1:GwrjFmJcFw6At/Gs6z4yjiIwzuJ1/+UwLxMQDVQXShQ=
 github.com/xeipuuv/gojsonschema v1.2.0 h1:LhYJRs+L4fBtjZUfuSZIKGeVu0QRy8e5Xi7D17UxZ74=
 github.com/xeipuuv/gojsonschema v1.2.0/go.mod h1:anYRn/JVcOK2ZgGU+IjEV4nwlhoK5sQluxsYJ78Id3Y=
+github.com/zeebo/assert v1.3.0 h1:g7C04CbJuIDKNPFHmsk4hwZDO5O+kntRxzaUoNXj+IQ=
+github.com/zeebo/assert v1.3.0/go.mod h1:Pq9JiuJQpG8JLJdtkwrJESF0Foym2/D9XMU5ciN/wJ0=
+github.com/zeebo/xxh3 v1.1.0 h1:s7DLGDK45Dyfg7++yxI0khrfwq9661w9EN78eP/UZVs=
+github.com/zeebo/xxh3 v1.1.0/go.mod h1:IisAie1LELR4xhVinxWS5+zf1lA4p0MW4T+w+W07F5s=
+go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64=
+go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.70.0 h1:LMuyCAyfalSjDyjdC65nK6N0zoTT63+E/u95X0JovZI=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.70.0/go.mod h1:085m8qbm4hgc8rZWGDEa4vmyyo2c3nPxUslYUKUIU04=
+go.opentelemetry.io/otel v1.45.0 h1:pdrWmLHofpubmArBv1LgFSv1Z0Ie/ppdZzu+kUN5EeU=
+go.opentelemetry.io/otel v1.45.0/go.mod h1:XZxIqPapzEYnhNSScF5DIqXhm/rYi0FzCe2XddAwZfQ=
+go.opentelemetry.io/otel/metric v1.45.0 h1:7Eg1uH7CJ5cXv9is6tnBe1FI6rj1nwUdbFypRm3br/M=
+go.opentelemetry.io/otel/metric v1.45.0/go.mod h1:HAPbm1nd3p1PmFH7v2dR+6BjXxw+Lq4a2+pndMAm08s=
+go.opentelemetry.io/otel/trace v1.45.0 h1:l/mP6Uv7oNO7/TblbhpbgMidxhq1uO/rPsikOyVhxag=
+go.opentelemetry.io/otel/trace v1.45.0/go.mod h1:qoJJA2xNMnxRrdISU/kLtfUH2wNeQbiv+jhs/CxI8bc=
 go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
 go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
+go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
+go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20200302210943-78000ba7a073/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.57.0 h1:3ZVCjf8Ggz7zneR/EHRVx68Ctf+2pmIMP2UFhh9cC6M=
@@ -224,9 +260,16 @@ google.golang.org/grpc v1.85.0-dev.0.20260825072537-93e31b48545e/go.mod h1:7aY/K
 google.golang.org/protobuf v1.36.12 h1:pJOKDDOyeXErUroCihFAd5LQuwXBSpVnKGrj5o/fwxc=
 google.golang.org/protobuf v1.36.12/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
-gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
-gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
-gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
+gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15 h1:YR8cESwS4TdDjEe65xsg0ogRM/Nc3DYOhEAlW+xobZo=
+gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/ini.v1 v1.67.2 h1:JtOSMb9OuaCZKr7h5D/h6iii14sK0hLbplTc6frx4Ss=
+gopkg.in/ini.v1 v1.67.2/go.mod h1:x/cyOwCgZqOkJoDIJ3c1KNHMo10+nLGAhh+kn3Zizss=
+gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+repo.anhonesthost.net/CyberCoveLLC/threshold-plugin-minio v0.3.0 h1:ezLFD2ryLMUDPg1PFzXTgR4xz/v/4P7rT68y1pOUeow=
+repo.anhonesthost.net/CyberCoveLLC/threshold-plugin-minio v0.3.0/go.mod h1:0jQJKoqKB4AoW57TYHaFg+/Tyux4gxDg1zchqOlbWwA=
+repo.anhonesthost.net/CyberCoveLLC/threshold-plugin-minio/madmin v0.2.0 h1:1pNNc5lPXYWeLNn6KRzKydHEvyKMeLIs3ZauC9h+/1M=
+repo.anhonesthost.net/CyberCoveLLC/threshold-plugin-minio/madmin v0.2.0/go.mod h1:RwjAcIDH2aYt3lVdIEv/3XdB5Z2VaTWRhv9EJDFBgW0=
+repo.anhonesthost.net/CyberCoveLLC/threshold/sdk v0.1.0 h1:ExuSGqE1pA/1DnS5xrSK7kEhD+4g5hIJC5TgmwH5LAU=
+repo.anhonesthost.net/CyberCoveLLC/threshold/sdk v0.1.0/go.mod h1:cWxYF3tEkYEKTY76ub8kL+vdGmopO0YfJqJGGQJov7k=
@@ -7,8 +7,8 @@
 package main

 import (
-	minio "github.com/hashicorp/boundary-plugin-minio/plugin"
-	hp "github.com/hashicorp/boundary/sdk/plugins"
+	minio "repo.anhonesthost.net/CyberCoveLLC/threshold-plugin-minio/plugin"
+	hp "repo.anhonesthost.net/CyberCoveLLC/threshold/sdk/plugins"
 )

 func serve() error {
@@ -1,4 +1,4 @@
-module github.com/hashicorp/boundary/plugins/kms/mains/alicloudkms
+module repo.anhonesthost.net/CyberCoveLLC/threshold/plugins/kms/mains/alicloudkms

 go 1.26.9

@@ -1,4 +1,4 @@
-module github.com/hashicorp/boundary/plugins/kms/mains/awskms
+module repo.anhonesthost.net/CyberCoveLLC/threshold/plugins/kms/mains/awskms

 go 1.26.9

@@ -1,4 +1,4 @@
-module github.com/hashicorp/boundary/plugins/kms/mains/azurekeyvault
+module repo.anhonesthost.net/CyberCoveLLC/threshold/plugins/kms/mains/azurekeyvault

 go 1.26.9

@@ -1,4 +1,4 @@
-module github.com/hashicorp/boundary/plugins/kms/mains/gcpckms
+module repo.anhonesthost.net/CyberCoveLLC/threshold/plugins/kms/mains/gcpckms

 go 1.26.9

@@ -1,4 +1,4 @@
-module github.com/hashicorp/boundary/plugins/kms/mains/ibmkp
+module repo.anhonesthost.net/CyberCoveLLC/threshold/plugins/kms/mains/ibmkp

 go 1.26.9

@@ -1,4 +1,4 @@
-module github.com/hashicorp/boundary/plugins/kms/mains/ocikms
+module repo.anhonesthost.net/CyberCoveLLC/threshold/plugins/kms/mains/ocikms

 go 1.26.9

@@ -1,4 +1,4 @@
-module github.com/hashicorp/boundary/plugins/kms/mains/transit
+module repo.anhonesthost.net/CyberCoveLLC/threshold/plugins/kms/mains/transit

 go 1.26.9

@@ -14,24 +14,9 @@ if [ -z "$UI_VERSION_FILE" ]; then
 fi

 UI_EDITION=$(make --no-print-directory edition)
-# allow override for the source of ui files
-# used by end-to-end tests to build enterprise edition from community files
-# UI_SRC_OVERRIDE will override which edition is pulled
-# but UI_EDITION_SRC will still determine the build version
-if [ -n "$UI_SRC_OVERRIDE" ]; then
-  UI_SRC=$UI_SRC_OVERRIDE
-else
-  UI_SRC=$UI_EDITION
-fi
-
-if [ $UI_SRC == "oss" ]; then
-  UI_REPO=https://github.com/hashicorp/boundary-ui
-  REPO_NAME=boundary-ui
-else
-  UI_VERSION_FILE="${UI_VERSION_FILE}_ent"
-  UI_REPO=https://github.com/hashicorp/boundary-ui-enterprise
-  REPO_NAME=boundary-ui-enterprise
-fi
+# Threshold ships a single (community) edition of the admin UI, built from the
+# CyberCoveLLC/threshold-ui fork of hashicorp/boundary-ui.
+UI_REPO=${UI_REPO:-https://repo.anhonesthost.net/CyberCoveLLC/threshold-ui.git}

 UI_CURRENT_COMMIT=$(head -n1 < "${UI_VERSION_FILE}" | cut -d' ' -f1)

@@ -42,31 +27,6 @@ else
  echo "==> Building custom UI version $UI_COMMITISH"
 fi;

-if which gh &> /dev/null;  then
-    echo "Found gh cli, attempting to download ui assets"
-
-    artifact_id=$(gh api "repos/hashicorp/${REPO_NAME}/actions/artifacts" --paginate | \
-        jq ".artifacts[] | select(.workflow_run.head_sha == \"${UI_COMMITISH}f\" and .name == \"admin-ui-${UI_SRC}\")" | \
-        jq --slurp '.[0]' | \
-        jq -r '.id')
-
-    if [[ "${artifact_id}" != "null" ]]; then
-        echo "Downloading artifact: ${artifact_id} for admin-ui-${UI_SRC} ${UI_COMMITISH}"
-        tmp_dir=$(mktemp -d)
-        gh api "repos/hashicorp/${REPO_NAME}/actions/artifacts/${artifact_id}/zip" > "${tmp_dir}/boundary-ui.zip"
-        trap 'rm -rf ${tmp_dir}' EXIT
-
-        # remove any previous artifact download or git clone
-        rm -rf "${UI_CLONE_DIR}"
-
-        mkdir -p "${UI_CLONE_DIR}/ui/admin/dist"
-        unzip "${tmp_dir}/boundary-ui.zip" -d "${UI_CLONE_DIR}/ui/admin/dist"
-        exit $?
-    else
-        echo "could not find artifact: admin-ui-${UI_SRC} ${UI_COMMITISH}, falling back to git clone"
-    fi
-fi
-
 if ! which pnpm &> /dev/null; then
    echo "Pnpm must be installed to build ui assets from a git clone.\nPlease ensure Node v20+ and Pnpm v10+ are installed."
    exit 1
@@ -90,6 +50,6 @@ git checkout "${UI_COMMITISH}"
 git pull --ff-only origin "${UI_COMMITISH}"
 git reset --hard "${UI_COMMITISH}"

-pnpm install
+pnpm install --frozen-lockfile --filter "admin..."
 EDITION=${UI_EDITION} pnpm build
 popd
@@ -13,14 +13,9 @@ if [ -z "$UI_COMMITISH" ]; then
 	echo "Must set UI_COMMITISH"; exit 1
 fi

-UI_EDITION=$(make --no-print-directory edition)
-
-if [ "$UI_EDITION" == "oss" ]; then
-  UI_REPO=https://github.com/hashicorp/boundary-ui
-else
-  UI_VERSION_FILE="${UI_VERSION_FILE}_ent"
-  UI_REPO=https://github.com/hashicorp/boundary-ui-enterprise
-fi
+# Threshold ships a single (community) edition of the admin UI, built from the
+# CyberCoveLLC/threshold-ui fork of hashicorp/boundary-ui.
+UI_REPO=${UI_REPO:-https://repo.anhonesthost.net/CyberCoveLLC/threshold-ui.git}

 shafileabs="$(pwd)/${UI_VERSION_FILE}"
 V="$(git ls-remote ${UI_REPO} ${UI_COMMITISH})"
Author	SHA1	Message	Date
CyberCoveandClaude Sonnet 5.5	00c52a5d03	Pin UI to threshold-ui main 8e63f6b Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-10-12 14:11:36 -07:00
CyberCoveandClaude Sonnet 5.5	89e73b4aa1	Build the embedded admin UI from CyberCoveLLC/threshold-ui - internal/ui/VERSION pins the threshold-ui commit - scripts/uiupdate.sh and scripts/build-ui.sh clone https://repo.anhonesthost.net/CyberCoveLLC/threshold-ui.git; the GitHub artifact download path (hashicorp/boundary-ui) is removed - clone/embed directory renamed .tmp/boundary-ui -> .tmp/threshold-ui (Makefile, assets.go, .github build.yml paths) Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-10-12 12:44:26 -07:00
shadowdaoandClaude Sonnet 5.5	764bb27d54	Merge upgrade-compat: seamless in-place upgrade from Boundary ci / check (push) Successful in 21m11s Details Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-10-12 11:14:31 -07:00
shadowdaoandClaude Sonnet 5.5	d07030a10b	Make in-place upgrade from HashiCorp Boundary seamless Linux packages: migrate /etc/boundary.d to /etc/threshold.d without clobbering, reuse the boundary service user, carry over service enablement with a boundary.service alias, provide a boundary command. Docker: accept /boundary/config.hcl, boundary command, /boundary symlink. CLI: deprecation notice when invoked as boundary (stderr only). Dev mode: also create *.threshold.dev aliases. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-10-12 11:12:29 -07:00
shadowdaoandClaude Sonnet 5.5	80ece9c4fc	Bump moby/sys/user to v0.4.1; document accepted test-only docker/docker findings ci / check (push) Successful in 7m13s Details Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-10-12 10:49:41 -07:00
shadowdaoandClaude Sonnet 5.5	de2ee74928	CI: don't run on tag pushes ci / check (push) Failing after 18m6s Details Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-10-12 10:37:57 -07:00
shadowdaoandClaude Sonnet 5.5	f4b9a16788	Merge plugins/threshold-forks: repoint plugin mains at Threshold forks ci / check (push) Failing after 17m43s Details Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-10-12 10:37:42 -07:00
shadowdaoandClaude Sonnet 5.5	5fdfc8c2cc	Repoint plugin mains at Threshold forks and renamed sdk - boundary host/storage plugin mains use repo.anhonesthost.net/CyberCoveLLC/threshold-plugin-{aws,azure,gcp,minio} - all mains import threshold/sdk (no more duplicate proto registrations) - main module paths renamed under repo.anhonesthost.net/CyberCoveLLC/threshold Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-10-12 10:37:42 -07:00
shadowdaoandClaude Sonnet 5.5	44fd64f588	api: depend on published sdk v0.1.0 (drop local replace) ci / check (push) Failing after 5m49s Details Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-10-12 10:35:07 -07:00
shadowdaoandClaude Sonnet 5.5	a5ba9460e5	Merge rebrand/phase-b: rename Go module path to repo.anhonesthost.net/CyberCoveLLC/threshold ci / check (push) Failing after 19m6s Details Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-10-12 10:34:24 -07:00